@cortexkit/opencode-openai-auth 1.2.0 → 1.3.0

package/dist/index-r2s51ac1.js

@@ -1,2 +0,0 @@
-import{ef as O}from"./index-xwvze96g.js";import{randomUUID as w}from"node:crypto";import{lstat as N,readFile as B,rename as b,unlink as U}from"node:fs/promises";import{dirname as V,resolve as L}from"node:path";var S=process.platform==="win32",W=new Set;function I(j){if(j?.reason==="io-error"){if(j.win32Code===2||j.win32Code===3)return"ENOENT";if(j.win32Code===80||j.win32Code===183)return"EEXIST"}return j?.code??"ERR_PRIVATE_FILE"}var C;function q(){return C??=import("@cortexkit/private-files"),C}class R extends Error{path;stage;code;win32Code;reason;published=!1;durabilityConfirmed=!1;fileDurable=!1;attempts=0;elapsedMs=0;orphanPath;constructor(j,G,A){let z=A;super(`Private file refused at ${G}: ${j} (${z?.reason??z?.code??"io-error"}). Use a safe parent directory. Repair only a named secret file in safe ancestry whose owner the published policy trusts, without changing its owner or any existing directory. Previously exposed credentials may need rotation. Windows requires the private-files native prebuild and an ACL-persisting local filesystem such as NTFS.`,{cause:A});this.path=j,this.stage=G,this.name="PrivateFileError",this.code=I(z),this.win32Code=z?.win32Code,this.reason=z?.reason}}async function x(j,G,A){try{return await A()}catch(z){if(z instanceof R)throw z;throw new R(j,G,z)}}var E;async function _(j,G){j=L(j),G??=E,await x(j,"safe-parent",async()=>{let A=await(await q()).verifySafeParent(j,G);if(A.ok===!1){if(A.reason==="io-error"||A.reason==="wrong-kind")await N(j);throw new R(A.level??A.path,"safe-parent",{...A,code:"ERR_PRIVATE_FILES_SECURITY"})}})}async function T(j,G,A=!1){if(j=L(j),G==="directory")return _(j);await x(j,"verify",async()=>{let z=await q(),K=await z.verifyOwnerOnly(j),H=!1;if(!K.ok){let{reason:M}=K.refusal;if(M==="io-error")await z.verifyPrivatePath(j,G);if(A&&[z.EXTRA_ACE,z.NOT_PROTECTED,z.NULL_DACL,z.EMPTY_DACL].includes(M))await _(V(j)),await z.securePrivatePath(j,G),H=!0;else throw Object.assign(Error("Owner-only verification refused"),{reason:M,code:"ERR_PRIVATE_FILES_SECURITY"})}if(await z.verifyPrivatePath(j,G),H&&!W.has(j))W.add(j),process.emitWarning(`Private permissions tightened: ${j}. This object may have been readable before; rotate credentials if needed.`,"PrivateFileMigration")})}async function D(j,G=!1,A){j=L(j),await x(j,"directory",async()=>{let z=await q();try{return await N(j),await _(j,A)}catch(H){if(I(H)!=="ENOENT")throw H}let K=V(j);if(K===j)throw Object.assign(Error("Missing root"),{code:"ENOENT"});await D(K,!1,A);try{await z.createOwnerOnly(j,{kind:"dir"})}catch(H){if(I(H)!=="EEXIST")throw H}await _(j,A)})}async function m(j,G=!1){if(!S)return B(j,"utf8");return(await k(j,G)).toString("utf8")}async function k(j,G=!1){if(!S)return B(j);if(j=L(j),G)await _(V(j)),await T(j,"file",!0);return x(j,"read",async()=>(await q()).readOwnerOnly(j))}async function F(j,G){await _(V(L(j))),await x(j,"create",async()=>{await(await q()).createPrivateFile(L(j),G)})}async function c(j){await _(V(L(j))),await x(j,"directory-create",async()=>{await(await q()).createOwnerOnly(L(j),{kind:"dir"})})}async function g(j,G,A={}){j=L(j),G=L(G);let z=A.now??(()=>performance.now()),K=z(),H=Math.min(K+500,A.deadline??1/0),M=[0,10,20,40,80,100],Y,$=0;for(let Q of M){if(z()>=H)break;if(Q)await(A.sleep??((X)=>new Promise((Z)=>setTimeout(Z,X))))(Math.min(Q,Math.max(0,H-z())));if(z()>=H)break;if(await A.beforeRename?.(),z()>=H)break;$++;try{return await(A.rename??b)(j,G),{attempts:$,elapsedMs:z()-K}}catch(X){Y??=X;let Z=X;if(!(Z.win32Code!==void 0?Z.win32Code===32||Z.win32Code===33:["EBUSY","EPERM","EACCES"].includes(Z.code??"")&&!Z.reason))break}}let J=new R(G,"rename",Y??Object.assign(Error("Publication deadline expired"),{code:"ETIMEDOUT"}));throw J.attempts=$,J.elapsedMs=z()-K,J}async function v(j,G,A={}){j=L(j),await D(V(j));try{await T(j,"file",!0)}catch(J){if(J.code!=="ENOENT")throw J}let z=L(A.stagePath??`${j}.${w()}.tmp`);if(V(z)!==V(j))throw new R(j,"stage-directory",{code:"EXDEV"});let K=!1,H=!1,M={attempts:0,elapsedMs:0},Y="stage-create",$=(J)=>{try{A.onOutcome?.({path:j,stage:J?.stage??"published",published:H,fileDurable:H,durabilityConfirmed:!1,attempts:J?.attempts??M.attempts,elapsedMs:J?.elapsedMs??M.elapsedMs,...J&&{code:J.code,win32Code:J.win32Code}})}catch{}};try{if(await F(z,G),K=!0,Y="before-rename",M=await g(z,j,A),K=!1,H=!0,Y="published-callback",A.onRenamed?.(),Y="published-verify",await T(j,"file"),A.durable&&A.durability!=="file-only-on-windows")throw new R(j,"directory-sync-unsupported",{code:"ENOTSUP"});$()}catch(J){let Q=J instanceof R?J:new R(j,Y,J);if(Q.published=H,Q.fileDurable=H,H)Object.assign(Q,M);if(K){try{await U(z)}catch{Q.orphanPath=z}K=!1}throw $(Q),Q}finally{if(K)await U(z).catch(()=>{})}}
-export{S as Pe,R as Qe,x as Re,_ as Se,T as Te,D as Ue,m as Ve,F as We,c as Xe,g as Ye,v as Ze};