@cortexkit/anthropic-auth-core 1.23.0 → 2.0.0

package/dist/claustrum-enrollment-registry.js

@@ -1,194 +0,0 @@
-import { homedir } from 'node:os';
-import { isAbsolute, join, resolve } from 'node:path';
-import { ClaustrumEnrollmentManager, getClaustrumEnrollmentPaths, } from './claustrum-enrollment.js';
-const REGISTRY_SYMBOL = Symbol.for('cortexkit.anthropic-auth.claustrum-enrollments.v2');
-const PENDING_POLL_MS = 5_000;
-const RETRY_POLL_MS = 60_000;
-const UNAVAILABLE_RETRY_MS = 5_000;
-export function getHostClaustrumEnrollmentPaths(host, env = process.env, cwd = process.cwd()) {
-    const configured = env[`${host.toUpperCase()}_ANTHROPIC_AUTH_CLAUSTRUM_ENROLLMENT_FILE`]?.trim();
-    const tokenPath = configured
-        ? isAbsolute(configured)
-            ? configured
-            : resolve(cwd, configured)
-        : join(env.XDG_STATE_HOME || join(homedir(), '.local', 'state'), 'cortexkit', 'anthropic-auth', `${host}-enrollment.json`);
-    return getClaustrumEnrollmentPaths(tokenPath);
-}
-function registry() {
-    const global = globalThis;
-    if (!global[REGISTRY_SYMBOL])
-        global[REGISTRY_SYMBOL] = new Map();
-    return global[REGISTRY_SYMBOL];
-}
-function notify(entry, status) {
-    entry.status = status;
-    for (const listener of entry.leases.values())
-        listener(status);
-}
-function schedule(entry, delayMs) {
-    if (entry.closed || entry.timer)
-        return;
-    entry.timer = entry.setTimeoutImpl(() => {
-        entry.timer = undefined;
-        void run(entry);
-    }, delayMs);
-    if (typeof entry.timer === 'object' &&
-        entry.timer &&
-        'unref' in entry.timer) {
-        entry.timer.unref();
-    }
-}
-function nextDelay(status, pollIntervalMs) {
-    if (pollIntervalMs === 0 ||
-        status.state === 'approved' ||
-        status.state === 'denied' ||
-        status.state === 'blocked') {
-        return undefined;
-    }
-    if (status.state === 'pending') {
-        return status.retryCode ? RETRY_POLL_MS : pollIntervalMs;
-    }
-    return UNAVAILABLE_RETRY_MS;
-}
-async function getClient(entry) {
-    if (entry.closed)
-        throw new Error('Claustrum enrollment registry is closed');
-    if (entry.client)
-        return entry.client;
-    if (!entry.clientPromise) {
-        entry.clientPromise = entry
-            .connect()
-            .then((client) => {
-            if (entry.closed) {
-                client.close();
-                throw new Error('Claustrum enrollment registry is closed');
-            }
-            entry.client = client;
-            return client;
-        })
-            .finally(() => {
-            entry.clientPromise = undefined;
-        });
-    }
-    return entry.clientPromise;
-}
-async function run(entry) {
-    if (entry.closed)
-        return;
-    if (entry.run)
-        return entry.run;
-    entry.run = (async () => {
-        let status;
-        try {
-            status = await entry.manager.reconcile();
-        }
-        catch {
-            status = {
-                state: 'unavailable',
-                proposedName: entry.proposedName,
-                // Unknown transport/storage errors may echo one-shot bearer material.
-                code: 'unavailable',
-            };
-            // A transport or filesystem failure is not a durable ceremony verdict. Keep
-            // retrying while the process is alive; only the manager persists protocol-terminal
-            // outcomes such as denied, superseded, or already_consumed.
-            if (entry.closed)
-                return;
-            notify(entry, status);
-            if (entry.pollIntervalMs !== 0)
-                schedule(entry, UNAVAILABLE_RETRY_MS);
-            return;
-        }
-        if (entry.closed)
-            return;
-        notify(entry, status);
-        const delay = nextDelay(status, entry.pollIntervalMs);
-        if (delay !== undefined)
-            schedule(entry, delay);
-    })().finally(() => {
-        entry.run = undefined;
-    });
-    return entry.run;
-}
-export function adoptClaustrumEnrollment(options) {
-    const key = resolve(options.paths.tokenPath);
-    const entries = registry();
-    let entry = entries.get(key);
-    if (entry && entry.proposedName !== options.proposedName) {
-        throw new Error('Claustrum enrollment path is already owned by a different consumer');
-    }
-    if (!entry) {
-        const connect = options.connect;
-        const setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;
-        const clearTimeoutImpl = options.clearTimeoutImpl ?? clearTimeout;
-        const lazyClient = {
-            enrollPropose: async (input) => {
-                const current = entry;
-                const client = await getClient(current);
-                if (current.closed)
-                    throw new Error('Claustrum enrollment registry is closed');
-                return client.enrollPropose(input);
-            },
-            enrollPoll: async (input) => {
-                const current = entry;
-                const client = await getClient(current);
-                if (current.closed)
-                    throw new Error('Claustrum enrollment registry is closed');
-                // Once a poll has been sent, let the manager durably collect its one-shot
-                // approval even if release wins meanwhile. Only later calls are fenced.
-                return client.enrollPoll(input);
-            },
-        };
-        entry = {
-            key,
-            proposedName: options.proposedName,
-            leases: new Map(),
-            manager: new ClaustrumEnrollmentManager({
-                client: lazyClient,
-                paths: options.paths,
-                proposedName: options.proposedName,
-            }),
-            connect,
-            setTimeoutImpl,
-            clearTimeoutImpl,
-            pollIntervalMs: options.pollIntervalMs ?? PENDING_POLL_MS,
-            status: { state: 'idle' },
-            closed: false,
-        };
-        entries.set(key, entry);
-    }
-    const lease = Symbol(key);
-    entry.leases.set(lease, options.onStatus ?? (() => { }));
-    options.onStatus?.(entry.status);
-    void run(entry);
-    let released = false;
-    return {
-        status: () => entry?.status ?? { state: 'idle' },
-        reconcileNow: () => (entry ? run(entry) : Promise.resolve()),
-        resetTerminal: async () => {
-            if (!entry)
-                return 'idle';
-            const result = await entry.manager.resetTerminal();
-            if (result === 'reset') {
-                notify(entry, { state: 'idle' });
-                await run(entry);
-            }
-            return result;
-        },
-        release: () => {
-            if (released || !entry)
-                return;
-            released = true;
-            entry.leases.delete(lease);
-            if (entry.leases.size > 0)
-                return;
-            entry.closed = true;
-            if (entry.timer) {
-                entry.clearTimeoutImpl(entry.timer);
-                entry.timer = undefined;
-            }
-            entry.client?.close();
-            entries.delete(key);
-        },
-    };
-}

package/dist/claustrum-enrollment.js

@@ -1,485 +0,0 @@
-import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import { constants as fsConstants } from 'node:fs';
-import { chmod, mkdir, open, realpath, rename, stat, unlink, } from 'node:fs/promises';
-import { basename, dirname, extname, join } from 'node:path';
-import { ClaustrumCredentialError, ClaustrumClient as ClaustrumWireClient, writeEnrollmentTokenFile, } from '@cortexkit/claustrum-client';
-import { acquireRefreshFileLock } from './accounts.js';
-import { parseJsonRedacted } from './json.js';
-export const CLAUSTRUM_OPENCODE_ENROLLMENT_NAME = 'anthropic-auth-opencode';
-export const CLAUSTRUM_PI_ENROLLMENT_NAME = 'anthropic-auth-pi';
-const ENROLLMENT_SCHEMA = 1;
-const ENROLLMENT_FILE_MAX_BYTES = 16 * 1024;
-const ENROLLMENT_LOCK_TTL_MS = 30_000;
-const TOKEN_RE = /^[0-9a-f]{64}$/;
-export function connectClaustrumEnrollmentClient(options = {}) {
-    return ClaustrumWireClient.connect(options);
-}
-export function getClaustrumEnrollmentPaths(tokenPath) {
-    const extension = extname(tokenPath) || '.json';
-    const stem = basename(tokenPath, extname(tokenPath));
-    return {
-        statePath: join(dirname(tokenPath), `${stem}-state${extension}`),
-        tokenPath,
-    };
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function validTimestamp(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
-}
-function validGeneration(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 1;
-}
-function decodeEnrollmentState(value) {
-    if (!isRecord(value) ||
-        value.version !== ENROLLMENT_SCHEMA ||
-        typeof value.proposedName !== 'string' ||
-        value.proposedName.length === 0) {
-        throw new Error('invalid Claustrum enrollment state');
-    }
-    if (value.phase === 'pending') {
-        if (!TOKEN_RE.test(String(value.requestSecret ?? '')) ||
-            (value.requestId !== undefined &&
-                (typeof value.requestId !== 'string' ||
-                    value.requestId.length === 0)) ||
-            !validTimestamp(value.createdAt) ||
-            !validTimestamp(value.updatedAt)) {
-            throw new Error('invalid Claustrum enrollment state');
-        }
-        return {
-            version: 1,
-            phase: 'pending',
-            proposedName: value.proposedName,
-            requestSecret: value.requestSecret,
-            ...(value.requestId !== undefined && {
-                requestId: value.requestId,
-            }),
-            createdAt: value.createdAt,
-            updatedAt: value.updatedAt,
-        };
-    }
-    if (value.phase === 'approved') {
-        if ((value.approvedName !== undefined &&
-            (typeof value.approvedName !== 'string' ||
-                value.approvedName.length === 0)) ||
-            !validGeneration(value.tokenGeneration) ||
-            !validTimestamp(value.updatedAt)) {
-            throw new Error('invalid Claustrum enrollment state');
-        }
-        return {
-            version: 1,
-            phase: 'approved',
-            proposedName: value.proposedName,
-            ...(value.approvedName !== undefined && {
-                approvedName: value.approvedName,
-            }),
-            tokenGeneration: value.tokenGeneration,
-            updatedAt: value.updatedAt,
-        };
-    }
-    if (value.phase === 'denied' || value.phase === 'blocked') {
-        if ((value.errorCode !== undefined && typeof value.errorCode !== 'string') ||
-            !validTimestamp(value.updatedAt)) {
-            throw new Error('invalid Claustrum enrollment state');
-        }
-        return {
-            version: 1,
-            phase: value.phase,
-            proposedName: value.proposedName,
-            ...(value.errorCode !== undefined && {
-                errorCode: value.errorCode,
-            }),
-            updatedAt: value.updatedAt,
-        };
-    }
-    throw new Error('invalid Claustrum enrollment state');
-}
-function decodeTokenFile(value) {
-    if (!isRecord(value) ||
-        !TOKEN_RE.test(String(value.token ?? '')) ||
-        !validGeneration(value.token_generation)) {
-        throw new Error('invalid Claustrum enrollment token file');
-    }
-    return {
-        token: value.token,
-        token_generation: value.token_generation,
-    };
-}
-function validateReadableSecretFile(metadata) {
-    if (!metadata.isFile()) {
-        throw new Error('Claustrum enrollment file must be a regular file');
-    }
-    if ((metadata.mode & 0o077) !== 0) {
-        throw new Error('Claustrum enrollment file must be owner-only');
-    }
-    const expectedUid = process.getuid?.();
-    if (expectedUid !== undefined && metadata.uid !== expectedUid) {
-        throw new Error('Claustrum enrollment file must be owned by the current user');
-    }
-}
-async function readBoundedJson(path) {
-    let descriptor;
-    try {
-        descriptor = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw new Error('Claustrum enrollment file could not be opened safely');
-    }
-    try {
-        validateReadableSecretFile(await descriptor.stat());
-        const source = Buffer.alloc(ENROLLMENT_FILE_MAX_BYTES + 1);
-        const { bytesRead } = await descriptor.read(source, 0, source.byteLength, 0);
-        if (bytesRead > ENROLLMENT_FILE_MAX_BYTES) {
-            throw new Error('Claustrum enrollment file is too large');
-        }
-        return parseJsonRedacted(source.subarray(0, bytesRead).toString('utf8'));
-    }
-    finally {
-        await descriptor.close();
-    }
-}
-async function refuseWritableAncestor(parent) {
-    let component;
-    try {
-        component = await realpath(parent);
-    }
-    catch {
-        return;
-    }
-    for (;;) {
-        const metadata = await stat(component).catch(() => undefined);
-        if (metadata &&
-            (metadata.mode & 0o022) !== 0 &&
-            (metadata.mode & 0o1000) === 0) {
-            throw new Error('Claustrum enrollment path has an unsafe writable ancestor');
-        }
-        const next = dirname(component);
-        if (next === component)
-            return;
-        component = next;
-    }
-}
-async function writeStateAtomic(path, state) {
-    const parent = dirname(path);
-    await mkdir(parent, { recursive: true, mode: 0o700 });
-    await refuseWritableAncestor(parent);
-    const bytes = `${JSON.stringify(state)}\n`;
-    if (Buffer.byteLength(bytes) > ENROLLMENT_FILE_MAX_BYTES) {
-        throw new Error('Claustrum enrollment state is too large');
-    }
-    const temporary = join(parent, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
-    let descriptor;
-    try {
-        descriptor = await open(temporary, 'wx', 0o600);
-        await descriptor.writeFile(bytes, 'utf8');
-        await descriptor.sync();
-        await descriptor.close();
-        descriptor = undefined;
-        await chmod(temporary, 0o600);
-        await rename(temporary, path);
-    }
-    finally {
-        await descriptor?.close().catch(() => { });
-        await unlink(temporary).catch(() => { });
-    }
-}
-export async function readClaustrumEnrollmentStatus(paths, proposedName = CLAUSTRUM_OPENCODE_ENROLLMENT_NAME) {
-    const tokenValue = await readBoundedJson(paths.tokenPath);
-    const token = tokenValue === undefined ? undefined : decodeTokenFile(tokenValue);
-    const stateValue = await readBoundedJson(paths.statePath);
-    const state = stateValue === undefined ? undefined : decodeEnrollmentState(stateValue);
-    if (token) {
-        return {
-            state: 'approved',
-            proposedName: state?.proposedName ?? proposedName,
-            ...(state?.phase === 'approved' &&
-                state.approvedName !== undefined && {
-                approvedName: state.approvedName,
-            }),
-            tokenGeneration: token.token_generation,
-        };
-    }
-    if (!state)
-        return { state: 'idle' };
-    if (state.phase === 'pending') {
-        return {
-            state: 'pending',
-            proposedName: state.proposedName,
-            ...(state.requestId !== undefined && { requestId: state.requestId }),
-        };
-    }
-    if (state.phase === 'approved') {
-        return {
-            state: 'blocked',
-            proposedName: state.proposedName,
-            code: 'missing_token',
-        };
-    }
-    if (state.phase === 'denied')
-        return { state: 'denied', proposedName: state.proposedName };
-    return {
-        state: 'blocked',
-        proposedName: state.proposedName,
-        code: state.errorCode ?? 'unknown',
-    };
-}
-/** Read fresh bearer material for a scoped operation; never publish this value. */
-export async function readClaustrumEnrollmentToken(tokenPath) {
-    await refuseWritableAncestor(tokenPath);
-    const value = await readBoundedJson(tokenPath);
-    if (value === undefined)
-        throw new Error('Claustrum enrollment is not configured');
-    return decodeTokenFile(value);
-}
-function statusFromState(state) {
-    if (state.phase === 'pending') {
-        return {
-            state: 'pending',
-            proposedName: state.proposedName,
-            ...(state.requestId !== undefined && { requestId: state.requestId }),
-        };
-    }
-    if (state.phase === 'approved') {
-        return {
-            state: 'approved',
-            proposedName: state.proposedName,
-            ...(state.approvedName !== undefined && {
-                approvedName: state.approvedName,
-            }),
-            tokenGeneration: state.tokenGeneration,
-        };
-    }
-    if (state.phase === 'denied')
-        return { state: 'denied', proposedName: state.proposedName };
-    return {
-        state: 'blocked',
-        proposedName: state.proposedName,
-        code: state.errorCode ?? 'unknown',
-    };
-}
-export class ClaustrumEnrollmentManager {
-    #client;
-    #paths;
-    #proposedName;
-    #now;
-    #mintSecret;
-    #writeTokenFile;
-    constructor(options) {
-        this.#client = options.client;
-        this.#paths = options.paths;
-        this.#proposedName = options.proposedName;
-        this.#now = options.now ?? Date.now;
-        this.#mintSecret =
-            options.mintSecret ?? (() => randomBytes(32).toString('hex'));
-        this.#writeTokenFile = options.writeTokenFile ?? writeEnrollmentTokenFile;
-    }
-    async status() {
-        return readClaustrumEnrollmentStatus(this.#paths, this.#proposedName);
-    }
-    async resetTerminal() {
-        return resetClaustrumEnrollmentState(this.#paths, this.#proposedName);
-    }
-    async reconcile() {
-        await mkdir(dirname(this.#paths.statePath), {
-            recursive: true,
-            mode: 0o700,
-        });
-        const lock = await acquireRefreshFileLock({
-            name: 'ceremony',
-            path: this.#paths.statePath,
-            ttlMs: ENROLLMENT_LOCK_TTL_MS,
-            renew: true,
-        });
-        if (!lock)
-            return { state: 'busy' };
-        try {
-            const existingToken = await readBoundedJson(this.#paths.tokenPath);
-            const token = existingToken === undefined ? undefined : decodeTokenFile(existingToken);
-            const stateValue = await readBoundedJson(this.#paths.statePath);
-            let state = stateValue === undefined ? undefined : decodeEnrollmentState(stateValue);
-            if (state && state.proposedName !== this.#proposedName) {
-                throw new Error('Claustrum enrollment state belongs to a different consumer');
-            }
-            if (token) {
-                if (!state || state.phase === 'pending') {
-                    const approved = {
-                        version: 1,
-                        phase: 'approved',
-                        proposedName: state?.proposedName ?? this.#proposedName,
-                        tokenGeneration: token.token_generation,
-                        updatedAt: this.#now(),
-                    };
-                    await writeStateAtomic(this.#paths.statePath, approved);
-                    state = approved;
-                }
-                return {
-                    state: 'approved',
-                    proposedName: state.proposedName,
-                    ...(state.phase === 'approved' &&
-                        state.approvedName !== undefined && {
-                        approvedName: state.approvedName,
-                    }),
-                    tokenGeneration: token.token_generation,
-                };
-            }
-            if (state?.phase === 'approved') {
-                const blocked = {
-                    version: 1,
-                    phase: 'blocked',
-                    proposedName: state.proposedName,
-                    errorCode: 'missing_token',
-                    updatedAt: this.#now(),
-                };
-                await writeStateAtomic(this.#paths.statePath, blocked);
-                return statusFromState(blocked);
-            }
-            if (state && state.phase !== 'pending')
-                return statusFromState(state);
-            if (!state) {
-                const now = this.#now();
-                state = {
-                    version: 1,
-                    phase: 'pending',
-                    proposedName: this.#proposedName,
-                    requestSecret: this.#mintSecret(),
-                    createdAt: now,
-                    updatedAt: now,
-                };
-                if (!TOKEN_RE.test(state.requestSecret))
-                    throw new Error('invalid minted Claustrum enrollment secret');
-                await writeStateAtomic(this.#paths.statePath, state);
-            }
-            if (!state.requestId) {
-                try {
-                    const requestSecretHash = createHash('sha256')
-                        .update(Buffer.from(state.requestSecret, 'hex'))
-                        .digest('hex');
-                    const proposed = await this.#client.enrollPropose({
-                        name: state.proposedName,
-                        requestSecretHash,
-                    });
-                    state = {
-                        ...state,
-                        requestId: proposed.requestId,
-                        updatedAt: this.#now(),
-                    };
-                    await writeStateAtomic(this.#paths.statePath, state);
-                }
-                catch (error) {
-                    if (error instanceof ClaustrumCredentialError) {
-                        if (error.code === 'pending_queue_full' ||
-                            error.action === 'retry') {
-                            return {
-                                state: 'pending',
-                                proposedName: state.proposedName,
-                                retryCode: error.code,
-                            };
-                        }
-                        const blocked = {
-                            version: 1,
-                            phase: 'blocked',
-                            proposedName: state.proposedName,
-                            errorCode: error.code,
-                            updatedAt: this.#now(),
-                        };
-                        await writeStateAtomic(this.#paths.statePath, blocked);
-                        return statusFromState(blocked);
-                    }
-                    throw error;
-                }
-            }
-            const requestId = state.requestId;
-            if (!requestId)
-                return statusFromState(state);
-            try {
-                const outcome = await this.#client.enrollPoll({
-                    requestId,
-                    requestSecret: state.requestSecret,
-                });
-                if (outcome.status === 'pending')
-                    return statusFromState(state);
-                if (outcome.status === 'denied') {
-                    const denied = {
-                        version: 1,
-                        phase: 'denied',
-                        proposedName: state.proposedName,
-                        updatedAt: this.#now(),
-                    };
-                    await writeStateAtomic(this.#paths.statePath, denied);
-                    return statusFromState(denied);
-                }
-                await this.#writeTokenFile(this.#paths.tokenPath, {
-                    token: outcome.token,
-                    token_generation: outcome.tokenGeneration,
-                });
-                const approved = {
-                    version: 1,
-                    phase: 'approved',
-                    proposedName: state.proposedName,
-                    approvedName: outcome.name,
-                    tokenGeneration: outcome.tokenGeneration,
-                    updatedAt: this.#now(),
-                };
-                await writeStateAtomic(this.#paths.statePath, approved);
-                return statusFromState(approved);
-            }
-            catch (error) {
-                if (!(error instanceof ClaustrumCredentialError))
-                    throw error;
-                if (error.action === 'retry') {
-                    return {
-                        state: 'pending',
-                        proposedName: state.proposedName,
-                        requestId,
-                        retryCode: error.code,
-                    };
-                }
-                const blocked = {
-                    version: 1,
-                    phase: 'blocked',
-                    proposedName: state.proposedName,
-                    errorCode: error.code,
-                    updatedAt: this.#now(),
-                };
-                await writeStateAtomic(this.#paths.statePath, blocked);
-                return statusFromState(blocked);
-            }
-        }
-        finally {
-            await lock.release();
-        }
-    }
-}
-/** Reset local terminal metadata without connecting to the credential daemon. */
-export async function resetClaustrumEnrollmentState(paths, proposedName) {
-    await mkdir(dirname(paths.statePath), { recursive: true, mode: 0o700 });
-    const lock = await acquireRefreshFileLock({
-        name: 'ceremony',
-        path: paths.statePath,
-        ttlMs: ENROLLMENT_LOCK_TTL_MS,
-        renew: true,
-    });
-    if (!lock)
-        return 'busy';
-    try {
-        if ((await readBoundedJson(paths.tokenPath)) !== undefined)
-            return 'refused-approved';
-        const value = await readBoundedJson(paths.statePath);
-        if (value === undefined)
-            return 'idle';
-        const state = decodeEnrollmentState(value);
-        if (state.proposedName !== proposedName)
-            throw new Error('Claustrum enrollment state belongs to a different consumer');
-        if (state.phase === 'pending')
-            return 'refused-pending';
-        await lock.assertOwned();
-        await unlink(paths.statePath);
-        return 'reset';
-    }
-    finally {
-        await lock.release();
-    }
-}