@cortexkit/common-auth 0.1.0

package/dist/rpc/rpc-server.js

@@ -0,0 +1,135 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { readFile, unlink } from 'node:fs/promises';
+import { createServer, } from 'node:http';
+import { join } from 'node:path';
+import { sweepRpcState, writePortFile } from './port-file.js';
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > 1_000_000) {
+                req.destroy();
+                reject(new Error('body too large'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        req.on('error', reject);
+    });
+}
+function tokenOk(header, token) {
+    if (!header?.startsWith('Bearer '))
+        return false;
+    const got = Buffer.from(header.slice(7));
+    const want = Buffer.from(token);
+    return got.length === want.length && timingSafeEqual(got, want);
+}
+export async function startRpcServer(options) {
+    const log = options.log ?? { warn() { }, debug() { } };
+    const token = randomBytes(32).toString('hex');
+    // The receipt timeout limits request delivery, not handler execution.
+    // The socket inactivity timeout must also allow slow handlers to finish.
+    const handlerTimeoutMs = options.timeoutMs ?? 90_000;
+    const receiptTimeoutMs = options.receiptTimeoutMs ?? 2_000;
+    let warnedMissingNotificationSession = false;
+    const server = createServer((req, res) => {
+        req.setTimeout(handlerTimeoutMs, () => {
+            req.socket.destroy();
+        });
+        void dispatch(req, res);
+    });
+    server.requestTimeout = receiptTimeoutMs;
+    server.headersTimeout = receiptTimeoutMs;
+    async function dispatch(req, res) {
+        const json = (status, value) => {
+            // Guard against writing to a socket that was destroyed (e.g. when
+            // readBody rejected after req.destroy() on an oversized body).
+            if (res.headersSent || res.writableEnded || res.destroyed)
+                return;
+            res.writeHead(status, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(value));
+        };
+        try {
+            const url = req.url ?? '';
+            if (req.method === 'GET' && url === '/health')
+                return json(200, { ok: true });
+            if (req.method !== 'POST' || !url.startsWith('/rpc/'))
+                return json(404, { error: 'not found' });
+            if (!tokenOk(req.headers.authorization, token))
+                return json(401, { error: 'unauthorized' });
+            const method = url.slice('/rpc/'.length);
+            const body = await readBody(req);
+            const params = JSON.parse(body || '{}');
+            if (method === 'pending-notifications') {
+                const sessionId = typeof params.sessionId === 'string' ? params.sessionId : undefined;
+                if (sessionId === undefined && !warnedMissingNotificationSession) {
+                    warnedMissingNotificationSession = true;
+                    log.warn('rpc notification drain missing session id', {
+                        pid: process.pid,
+                    });
+                }
+                const messages = options.drain(Number(params.lastReceivedId ?? 0), sessionId);
+                return json(200, { messages });
+            }
+            if (method === 'apply') {
+                const result = await options.apply(params);
+                return json(200, result);
+            }
+            return json(404, { error: 'unknown method' });
+        }
+        catch (error) {
+            json(500, {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    const port = await new Promise((resolve, reject) => {
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (addr && typeof addr === 'object')
+                resolve(addr.port);
+            else
+                reject(new Error('no port'));
+        });
+    });
+    server.unref();
+    if (options.sweepRoot) {
+        try {
+            await sweepRpcState(options.sweepRoot, options.dir, options.isManagedDir, log);
+        }
+        catch (error) {
+            log.warn('rpc state sweep failed', {
+                pid: process.pid,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    try {
+        await writePortFile(options.dir, { port, token, pid: process.pid }, { secureDir: options.secureDir });
+        log.debug('rpc server pid', {
+            pid: process.pid,
+            rpcPort: port,
+        });
+    }
+    catch (error) {
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw error;
+    }
+    return {
+        port,
+        token,
+        async stop() {
+            await new Promise((resolve) => server.close(() => resolve()));
+            const portFile = join(options.dir, `port-${process.pid}.json`);
+            const current = await readFile(portFile, 'utf8')
+                .then((raw) => JSON.parse(raw))
+                .catch(() => undefined);
+            if (current?.port === port && current.token === token)
+                await unlink(portFile).catch(() => { });
+        },
+    };
+}

package/dist/rpc/server-registry.d.ts

@@ -0,0 +1,11 @@
+import type { RpcServerHandle } from './rpc-server.js';
+export interface RpcServerAdoption {
+    server: RpcServerHandle;
+    release: () => Promise<void>;
+}
+/**
+ * Serializes same-directory replacement. Release checks the adopted server
+ * identity so an older holder cannot stop or remove its successor.
+ * Distinct project directories remain independent.
+ */
+export declare function adoptRpcServer(registryKey: string, rpcDir: string, create: () => Promise<RpcServerHandle>): Promise<RpcServerAdoption>;

package/dist/rpc/server-registry.js

@@ -0,0 +1,47 @@
+/**
+ * Serializes same-directory replacement. Release checks the adopted server
+ * identity so an older holder cannot stop or remove its successor.
+ * Distinct project directories remain independent.
+ */
+export async function adoptRpcServer(registryKey, rpcDir, create) {
+    const globals = globalThis;
+    const key = Symbol.for(registryKey);
+    const registry = globals[key] ?? { servers: new Map(), pending: new Map() };
+    globals[key] = registry;
+    const { servers, pending } = registry;
+    const predecessor = pending.get(rpcDir) ?? Promise.resolve();
+    let server;
+    const start = predecessor
+        .catch(() => { })
+        .then(async () => {
+        const previous = servers.get(rpcDir);
+        if (previous) {
+            await previous.stop();
+            if (servers.get(rpcDir) === previous)
+                servers.delete(rpcDir);
+        }
+        server = await create();
+        servers.set(rpcDir, server);
+    });
+    pending.set(rpcDir, start);
+    try {
+        await start;
+    }
+    finally {
+        if (pending.get(rpcDir) === start)
+            pending.delete(rpcDir);
+    }
+    const adoptedServer = server;
+    if (!adoptedServer)
+        throw new Error('RPC server failed to start');
+    return {
+        server: adoptedServer,
+        release: async () => {
+            if (servers.get(rpcDir) !== adoptedServer)
+                return;
+            await adoptedServer.stop();
+            if (servers.get(rpcDir) === adoptedServer)
+                servers.delete(rpcDir);
+        },
+    };
+}

package/dist/sidebar-file/index.d.ts

@@ -0,0 +1,2 @@
+export type { SidebarFile, SidebarFileHooks, SidebarFileOptions, } from './sidebar-file.js';
+export { createSidebarFile } from './sidebar-file.js';

package/dist/sidebar-file/index.js

@@ -0,0 +1 @@
+export { createSidebarFile } from './sidebar-file.js';

package/dist/sidebar-file/sidebar-file.d.ts

@@ -0,0 +1,23 @@
+export interface SidebarFileHooks {
+    /** Runs on the first merge attempt, before checking for older, unlocked writers. */
+    beforeRecheck?: () => void | Promise<void>;
+    /** @internal Test seam after staging, before the ownership fence. */
+    beforeCommit?: () => Promise<void>;
+}
+export interface SidebarFileOptions<T> {
+    path: string;
+    defaultValue: T;
+    normalize: (parsed: unknown) => T;
+    timeoutMs?: number;
+    logger?: {
+        warn: (message: string, payload?: unknown) => void;
+        debug: (message: string, payload?: unknown) => void;
+    };
+}
+export interface SidebarFile<T> {
+    read(): Promise<T>;
+    write(value: T, hooks?: SidebarFileHooks): Promise<void>;
+    update(merge: (latest: T) => T | undefined, hooks?: SidebarFileHooks): Promise<void>;
+}
+/** Binds generic persistence to a caller's path and normalization policy. */
+export declare function createSidebarFile<T>(options: SidebarFileOptions<T>): SidebarFile<T>;

package/dist/sidebar-file/sidebar-file.js

@@ -0,0 +1,84 @@
+import { chmod, mkdir, readFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { WRITER_LOCK_CONSTANTS, withLock, writeJsonAtomic, } from '../fs/index.js';
+/** Binds generic persistence to a caller's path and normalization policy. */
+export function createSidebarFile(options) {
+    const { path, defaultValue, normalize } = options;
+    let chain = Promise.resolve();
+    const parse = (raw) => {
+        if (raw === '')
+            return defaultValue;
+        try {
+            return normalize(JSON.parse(raw));
+        }
+        catch {
+            return defaultValue;
+        }
+    };
+    const readRaw = async () => {
+        try {
+            return await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return '';
+            throw error;
+        }
+    };
+    const read = async () => {
+        try {
+            return parse(await readRaw());
+        }
+        catch {
+            return defaultValue;
+        }
+    };
+    const enqueue = (operation) => {
+        const result = chain.then(operation);
+        // Keep the next operation runnable without hiding this caller's rejection.
+        chain = result.catch(() => { });
+        return result;
+    };
+    const persist = async (merge, hooks) => {
+        const parent = dirname(path);
+        await mkdir(parent, { recursive: true, mode: 0o700 });
+        await chmod(parent, 0o700).catch((error) => {
+            options.logger?.warn('sidebar directory permission remediation failed', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        });
+        await withLock(path, {
+            ...WRITER_LOCK_CONSTANTS.sidebar,
+            timeoutMs: options.timeoutMs ?? WRITER_LOCK_CONSTANTS.sidebar.timeoutMs,
+        }, async (lock) => {
+            const commit = (value) => writeJsonAtomic(path, value, {
+                serialize: JSON.stringify,
+                beforeRename: async () => {
+                    await hooks?.beforeCommit?.();
+                    await lock.assertOwned();
+                },
+            });
+            // Older processes may ignore the lock; remerge if their bytes changed.
+            for (let attempt = 0; attempt < 3; attempt += 1) {
+                const raw = await readRaw();
+                const next = merge(parse(raw));
+                if (next === undefined)
+                    return;
+                if (attempt === 0)
+                    await hooks?.beforeRecheck?.();
+                if ((await readRaw()) !== raw)
+                    continue;
+                await commit(next);
+                return;
+            }
+            const next = merge(await read());
+            if (next !== undefined)
+                await commit(next);
+        });
+    };
+    return {
+        read,
+        write: (value, hooks) => enqueue(() => persist(() => value, hooks)),
+        update: (merge, hooks) => enqueue(() => persist(merge, hooks)),
+    };
+}

package/dist/tui/index.d.ts

@@ -0,0 +1,8 @@
+export interface LoadTuiOptions {
+    rawEntry: string;
+    runtimeEntry: string;
+    importModule?: (specifier: string) => Promise<{
+        default?: unknown;
+    }>;
+}
+export declare function loadTui({ rawEntry, runtimeEntry, importModule, }: LoadTuiOptions): Promise<unknown>;

package/dist/tui/index.js

@@ -0,0 +1,21 @@
+import { isAbsolute } from 'node:path';
+export async function loadTui({ rawEntry, runtimeEntry, importModule = (entry) => import(entry), }) {
+    for (const [option, entry] of Object.entries({ rawEntry, runtimeEntry })) {
+        if (!isAbsolute(entry) &&
+            !(entry.startsWith('file:') && new URL(entry).pathname.startsWith('/'))) {
+            throw new Error(`${option} must be an absolute path or file URL: ${entry}`);
+        }
+    }
+    let entry = runtimeEntry;
+    try {
+        await importModule(`opentui:runtime-module:${encodeURIComponent('@opentui/solid')}`);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!/Cannot find|Could not resolve|Module not found|Unable to resolve/.test(message) ||
+            !message.includes('opentui:runtime-module:'))
+            throw error;
+        entry = rawEntry;
+    }
+    return (await importModule(entry)).default;
+}

package/dist/tui-build/build-tui.d.ts

@@ -0,0 +1,23 @@
+export type TransformSolidSource = (code: string, options: {
+    filename: string;
+    moduleName: string;
+    resolvePath: (specifier: string) => string | null;
+}) => Promise<string>;
+export interface BuildTuiOptions {
+    inline?: (string | {
+        name: string;
+        root: string;
+    })[];
+    runtimeModules?: string[];
+    loadSolidTransform?: () => Promise<TransformSolidSource>;
+}
+export interface TuiBuildResult {
+    emitted: string[];
+    sources: string[];
+    selector: string;
+    externals: Set<string>;
+}
+export declare const runtimeModules: string[];
+export declare const runtimeModuleId: (specifier: string) => string;
+export declare function loadSolidTransform(): Promise<TransformSolidSource>;
+export declare function buildTui(entryFile: string, variant: 'raw' | 'runtime', destinationDir: string, options?: BuildTuiOptions): Promise<TuiBuildResult>;

package/dist/tui-build/build-tui.js

@@ -0,0 +1,190 @@
+import { createHash } from 'node:crypto';
+import { existsSync, realpathSync } from 'node:fs';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { basename, dirname, extname, join, relative, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { isBareSpecifier, parseImports } from './walker.js';
+export const runtimeModules = [
+    '@opentui/core',
+    '@opentui/core/testing',
+    '@opentui/solid',
+    '@opentui/solid/components',
+    '@opentui/solid/jsx-runtime',
+    '@opentui/solid/jsx-dev-runtime',
+    'solid-js',
+    'solid-js/store',
+];
+export const runtimeModuleId = (specifier) => `opentui:runtime-module:${encodeURIComponent(specifier)}`;
+export async function loadSolidTransform() {
+    const specifier = '@opentui/solid/scripts/solid-transform.js';
+    try {
+        return (await import(specifier)).transformSolidSource;
+    }
+    catch {
+        const require = createRequire(import.meta.url);
+        const root = dirname(require.resolve('@opentui/solid/package.json'));
+        return (await import(pathToFileURL(join(root, 'scripts/solid-transform.js')).href)).transformSolidSource;
+    }
+}
+function exportTarget(value) {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.map(exportTarget).find(Boolean);
+    if (value && typeof value === 'object') {
+        const conditions = value;
+        for (const [key, condition] of Object.entries(conditions)) {
+            if (!['bun', 'import', 'node', 'default'].includes(key))
+                continue;
+            const target = exportTarget(condition);
+            if (target)
+                return target;
+        }
+    }
+    return undefined;
+}
+export async function buildTui(entryFile, variant, destinationDir, options = {}) {
+    const entry = resolve(entryFile);
+    const destination = resolve(destinationDir);
+    const roots = new Map();
+    for (const item of options.inline ?? ['@cortexkit/common-auth']) {
+        if (typeof item !== 'string')
+            roots.set(item.name, resolve(item.root));
+        else {
+            let directory = dirname(entry);
+            for (;;) {
+                const manifest = join(directory, 'package.json');
+                if (existsSync(manifest) &&
+                    JSON.parse(await readFile(manifest, 'utf8')).name === item) {
+                    roots.set(item, realpathSync(directory));
+                    break;
+                }
+                const installed = join(directory, 'node_modules', item);
+                if (existsSync(join(installed, 'package.json'))) {
+                    roots.set(item, realpathSync(installed));
+                    break;
+                }
+                const parent = dirname(directory);
+                if (parent === directory)
+                    throw new Error(`Cannot locate package root for ${item} from ${entry}`);
+                directory = parent;
+            }
+        }
+    }
+    const resolveExport = async (specifier, root, name) => {
+        const manifest = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+        const subpath = specifier === name ? '.' : `.${specifier.slice(name.length)}`;
+        const exports = manifest.exports;
+        let target = exportTarget(exports?.[subpath] ?? (subpath === '.' ? exports : undefined));
+        if (!target && exports && typeof exports === 'object') {
+            const patterns = Object.keys(exports)
+                .filter((key) => key.includes('*'))
+                .sort((a, b) => b.indexOf('*') - a.indexOf('*') || b.length - a.length);
+            for (const pattern of patterns) {
+                const [prefix = '', suffix = ''] = pattern.split('*');
+                if (!subpath.startsWith(prefix) || !subpath.endsWith(suffix))
+                    continue;
+                const wildcard = subpath.slice(prefix.length, suffix ? -suffix.length : undefined);
+                target = exportTarget(exports[pattern])?.replaceAll('*', wildcard);
+                break;
+            }
+        }
+        const absolute = target
+            ? resolve(root, target)
+            : `${root}/<missing exports ${subpath}>`;
+        if (!target || !existsSync(absolute))
+            throw new Error(`Cannot inline ${specifier}: resolved target ${absolute} does not exist`);
+        return realpathSync(absolute);
+    };
+    const transform = variant === 'runtime'
+        ? await (options.loadSolidTransform ?? loadSolidTransform)()
+        : undefined;
+    const runtime = new Set(options.runtimeModules ?? runtimeModules);
+    await rm(destination, { recursive: true, force: true });
+    await mkdir(destination, { recursive: true });
+    const result = {
+        emitted: [],
+        sources: [],
+        selector: 'selector.js',
+        externals: new Set(),
+    };
+    const copied = new Map();
+    const relativeImport = (from, to) => {
+        const path = relative(dirname(from), to).split('\\').join('/');
+        return path.startsWith('.') ? path : `./${path}`;
+    };
+    const visit = async (source, shared) => {
+        source = realpathSync(source);
+        if (relative(dirname(entry), source).startsWith('../'))
+            shared = true;
+        const previous = copied.get(source);
+        if (previous)
+            return previous;
+        const extension = variant === 'raw' && extname(source) === '.tsx' ? '.tsx' : '.js';
+        const name = shared
+            ? `shared/${createHash('sha256').update(source).digest('hex').slice(0, 16)}-${basename(source).replace(/\.[^.]+$/, '')}${extension}`
+            : relative(dirname(entry), source).replace(/\.[^.]+$/, extension);
+        if (name.startsWith('../'))
+            throw new Error(`Entry dependency escapes source directory: ${source}`);
+        copied.set(source, name);
+        let code = await readFile(source, 'utf8');
+        if (transform && /\.[jt]sx$/.test(source))
+            code = await transform(code, {
+                filename: source,
+                moduleName: runtimeModuleId('@opentui/solid'),
+                resolvePath: (specifier) => runtime.has(specifier) ? runtimeModuleId(specifier) : null,
+            });
+        const references = parseImports(code, source);
+        const replacements = [];
+        for (const reference of references) {
+            let specifier = reference.specifier;
+            const inline = [...roots].find(([name]) => specifier === name || specifier.startsWith(`${name}/`));
+            if (inline)
+                specifier = relativeImport(name, await visit(await resolveExport(specifier, inline[1], inline[0]), true));
+            else if (specifier.startsWith('.')) {
+                const base = resolve(dirname(source), specifier);
+                const candidates = [
+                    base,
+                    base.replace(/\.js$/, '.ts'),
+                    base.replace(/\.js$/, '.tsx'),
+                    `${base}.ts`,
+                    `${base}.tsx`,
+                    `${base}.js`,
+                    join(base, 'index.ts'),
+                    join(base, 'index.js'),
+                ];
+                const target = candidates.find(existsSync);
+                if (!target)
+                    throw new Error(`Missing relative import in ${source}: ${specifier}`);
+                specifier = relativeImport(name, await visit(target, shared));
+            }
+            else if (variant === 'runtime' && runtime.has(specifier))
+                specifier = runtimeModuleId(specifier);
+            replacements.push({ ...reference, text: JSON.stringify(specifier) });
+        }
+        for (const replacement of replacements.reverse())
+            code =
+                code.slice(0, replacement.start) +
+                    replacement.text +
+                    code.slice(replacement.end);
+        if (/\.[cm]?ts$/.test(source))
+            code = new Bun.Transpiler({ loader: 'ts', target: 'bun' }).transformSync(code);
+        const output = join(destination, name);
+        await mkdir(dirname(output), { recursive: true });
+        await writeFile(output, code);
+        for (const reference of parseImports(code, source)) {
+            if (isBareSpecifier(reference.specifier))
+                result.externals.add(reference.specifier);
+        }
+        result.emitted.push(name);
+        result.sources.push(source);
+        return name;
+    };
+    await visit(entry, false);
+    const selectorSource = fileURLToPath(import.meta.resolve('@cortexkit/common-auth/tui'));
+    await writeFile(join(destination, result.selector), await readFile(selectorSource));
+    result.emitted.push(result.selector);
+    result.sources.push(selectorSource);
+    return result;
+}

package/dist/tui-build/index.d.ts

@@ -0,0 +1,3 @@
+export type { BuildTuiOptions, TransformSolidSource, TuiBuildResult, } from './build-tui.js';
+export { buildTui, loadSolidTransform, runtimeModuleId, runtimeModules, } from './build-tui.js';
+export { assertEmittedPublishList } from './publish-list.js';

package/dist/tui-build/index.js

@@ -0,0 +1,2 @@
+export { buildTui, loadSolidTransform, runtimeModuleId, runtimeModules, } from './build-tui.js';
+export { assertEmittedPublishList } from './publish-list.js';

package/dist/tui-build/publish-list.d.ts

@@ -0,0 +1,2 @@
+/** Compare the files npm actually publishes, not the manifest's glob patterns. */
+export declare function assertEmittedPublishList(packageRoot: string, destinationDir: string, emitted: readonly string[]): Promise<void>;

package/dist/tui-build/publish-list.js

@@ -0,0 +1,20 @@
+import { execFile } from 'node:child_process';
+import { relative, resolve } from 'node:path';
+import { promisify } from 'node:util';
+/** Compare the files npm actually publishes, not the manifest's glob patterns. */
+export async function assertEmittedPublishList(packageRoot, destinationDir, emitted) {
+    const { stdout } = await promisify(execFile)('npm', ['pack', '--json', '--dry-run', '--ignore-scripts'], { cwd: packageRoot });
+    const packed = JSON.parse(stdout);
+    const prefix = `${relative(resolve(packageRoot), resolve(destinationDir)).split('\\').join('/')}/`;
+    const packageInfo = packed[0];
+    if (!packageInfo)
+        throw new Error('npm pack returned no package');
+    const actual = packageInfo.files
+        .map((file) => file.path)
+        .filter((path) => path.startsWith(prefix))
+        .map((path) => path.slice(prefix.length))
+        .sort();
+    const expected = [...emitted].sort();
+    if (JSON.stringify(actual) !== JSON.stringify(expected))
+        throw new Error(`Published destination differs from emitted: ${JSON.stringify({ actual, expected })}`);
+}

package/dist/tui-build/walker.d.ts

@@ -0,0 +1,8 @@
+export interface ImportReference {
+    specifier: string;
+    start: number;
+    end: number;
+}
+/** Locate module strings without treating comments or ordinary strings as imports. */
+export declare function parseImports(code: string, filename: string): ImportReference[];
+export declare function isBareSpecifier(specifier: string): boolean;