@crouton-kit/crouter 0.3.33 → 0.3.35

package/dist/core/canvas/wakeups.js

@@ -1,185 +0,0 @@
-// wakeups.ts — the WAKEUPS table data-access layer (canvas.db, migration v7).
-//
-// One-module-per-table (the focuses.ts precedent): ALL SQL that touches the
-// `wakeups` table lives HERE and nowhere else — never appended to canvas.ts,
-// which keeps the node/edge model. A WAKEUP is one durable row = "do <kind> at
-// fire_at [every recur]", carrying a fire time, a kind, an optional payload, an
-// optional recurrence cadence, a nullable TARGET node_id, and the owner_id of
-// the node that ARMED it.
-//
-// Two anchors, two reap rules (design D1/D2):
-//   - node_id  → the revive target AND the node-anchored cancel anchor; it
-//     carries the `ON DELETE CASCADE` FK, so a pruned node's node-anchored wakes
-//     are reaped FOR FREE in pruneNodes' same `DELETE FROM nodes` (canvas.ts is
-//     UNTOUCHED — the cascade does it; there is no pruneNodes wakeups code).
-//     NULL = canvas-detached (a deferred spawn / spawn-cron).
-//   - owner_id → the armer; a PLAIN indexed column with NO FK, so a crashed-
-//     then-pruned armer's detached cron is NOT cascade-dropped (Invariant E).
-//     Reaped only by the explicit cancelWakesFor DELETE on deliberate close.
-//
-// Each function is a single-statement query mirroring the canvas.ts atomic-setter
-// pattern (setStatus/setIntent/setPresence) — no read-modify-write, serialized by
-// WAL. The data-access layer OWNS payload serialization: armWake JSON.stringifies
-// the typed per-kind union on write; dueWakes/listWakes JSON.parse it back on read
-// (Maj-1), so callers consume `payload.body` / `payload as SpawnChildOpts` directly.
-//
-// `wakeup_id` is CALLER-SUPPLIED (the command surface mints `wk-${newNodeId()}`):
-// the canvas layer never imports newNodeId from runtime/nodes.ts — that would
-// force a canvas → runtime → canvas import cycle (Min-1).
-import { openDb } from './db.js';
-/** A thrown integrity-backstop error from armWake. `code` is the AC-N3 code the
- *  command surface (the ONLY sanctioned caller of armWake) maps to a rendered
- *  error block — armWake carries integrity backstops only (empty body / recur-on-
- *  deadline / unknown kind); target-resolvability + recoverable-state + the
- *  per-owner cap live in the surface (Min-6), so a non-surface armer could insert
- *  a dangling wake — every armer MUST route through the surface. */
-export class WakeArmError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-        this.name = 'WakeArmError';
-    }
-}
-/** Hydrate a raw row into a Wakeup, JSON.parsing `payload` back into the typed
- *  per-kind union (NULL column → null). */
-function wakeupFrom(r) {
-    const raw = r['payload'];
-    return {
-        wakeup_id: r['wakeup_id'],
-        node_id: r['node_id'] ?? null,
-        owner_id: r['owner_id'],
-        fire_at: r['fire_at'],
-        kind: r['kind'],
-        recur: r['recur'] ?? null,
-        payload: raw == null ? null : JSON.parse(raw),
-        created: r['created'],
-    };
-}
-// ---------------------------------------------------------------------------
-// Writes — each a single-statement INSERT/UPDATE/DELETE.
-// ---------------------------------------------------------------------------
-/** INSERT one wakeup row from the pinned spec, returning its (caller-supplied)
- *  `wakeup_id`. JSON.stringifies the typed `payload` union into the TEXT column
- *  and stamps `created`.
- *
- *  Deadline upsert (design Q3, "≤1 deadline per node"): for `kind === 'deadline'`
- *  the node's existing deadline is canceled first, then the new one inserted — the
- *  partial unique index `idx_wakeups_deadline` is the schema-level backstop.
- *
- *  Integrity backstops (throw WakeArmError; the surface maps the code to AC-N3):
- *   - empty/whitespace note `body` for `noted`/`deadline` → `empty_note`.
- *   - non-NULL `recur` on a `deadline`                    → `deadline_cannot_recur`.
- *   - unknown `kind`                                      → `bad_kind`.
- *  NO target-resolvability / recoverable-state / cap backstop here (Min-6). */
-export function armWake(spec) {
-    const { kind } = spec;
-    if (kind !== 'bare' && kind !== 'noted' && kind !== 'deadline' && kind !== 'spawn') {
-        throw new WakeArmError('bad_kind', `unknown wake kind: ${String(kind)}`);
-    }
-    if (kind === 'noted' || kind === 'deadline') {
-        const body = spec.payload?.body;
-        if (typeof body !== 'string' || body.trim() === '') {
-            throw new WakeArmError('empty_note', `a ${kind} wake requires a non-empty note body.`);
-        }
-    }
-    if (kind === 'deadline' && spec.recur != null) {
-        throw new WakeArmError('deadline_cannot_recur', 'a deadline wake cannot recur.');
-    }
-    // Deadline upsert: clear the node's existing deadline before inserting the new one.
-    if (kind === 'deadline' && spec.node_id != null) {
-        cancelDeadlinesFor(spec.node_id);
-    }
-    const payloadText = spec.payload == null ? null : JSON.stringify(spec.payload);
-    openDb()
-        .prepare(`INSERT INTO wakeups (wakeup_id, node_id, owner_id, fire_at, kind, recur, payload, created)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
-        .run(spec.wakeup_id, spec.node_id ?? null, spec.owner_id, spec.fire_at, kind, spec.recur ?? null, payloadText, new Date().toISOString());
-    return spec.wakeup_id;
-}
-/** UPDATE the next fire time — recurrence advancement (the daemon settles a
- *  recurring row to its next slot BEFORE enacting, crash-safe; design D4). */
-export function advanceWake(wakeup_id, nextFireIso) {
-    openDb().prepare('UPDATE wakeups SET fire_at = ? WHERE wakeup_id = ?').run(nextFireIso, wakeup_id);
-}
-/** DELETE one wakeup by id — one-shot consumption (the daemon settles a one-shot
- *  row BEFORE enacting, crash-safe; design D4). */
-export function consumeWake(wakeup_id) {
-    openDb().prepare('DELETE FROM wakeups WHERE wakeup_id = ?').run(wakeup_id);
-}
-/** DELETE one wakeup by id — the explicit user/surface cancel. Idempotent:
- *  0 rows ⇒ no error (AC-C2). */
-export function cancelWake(wakeup_id) {
-    openDb().prepare('DELETE FROM wakeups WHERE wakeup_id = ?').run(wakeup_id);
-}
-/** DELETE every wake anchored to this node AND every detached wake it ARMED —
- *  deliberate close/reap (ruling A). Hooked at transition('cancel'). */
-export function cancelWakesFor(node_id) {
-    openDb()
-        .prepare('DELETE FROM wakeups WHERE node_id = ? OR owner_id = ?')
-        .run(node_id, node_id);
-}
-/** DELETE this node's one-shot self-alarms (recur IS NULL); node-anchored crons
- *  SURVIVE — finalize is the instance finishing, not a teardown of standing
- *  schedules (design Q1). Hooked at transition('finalize'). */
-export function cancelSelfAlarms(node_id) {
-    openDb().prepare('DELETE FROM wakeups WHERE node_id = ? AND recur IS NULL').run(node_id);
-}
-/** DELETE this node's pending deadline(s) — cancel-on-wake (design §6.4).
- *  Hooked at reviveNode, so the deadline always belongs to the dormancy left. */
-export function cancelDeadlinesFor(node_id) {
-    openDb().prepare("DELETE FROM wakeups WHERE node_id = ? AND kind = 'deadline'").run(node_id);
-}
-// ---------------------------------------------------------------------------
-// Reads.
-// ---------------------------------------------------------------------------
-/** The daemon's per-tick due query: every row whose fire_at has arrived, in
- *  fire_at order, with `payload` parsed into the typed union. Returns exactly ONE
- *  row per recurring wake regardless of missed slots — coalescing is structural
- *  (AC-E2). */
-export function dueWakes(nowIso) {
-    return openDb()
-        .prepare('SELECT * FROM wakeups WHERE fire_at <= ? ORDER BY fire_at')
-        .all(nowIso).map(wakeupFrom);
-}
-/** List wakes for a scope (node / owner / subtree / due / canvas), `payload`
- *  parsed as in dueWakes. The subtree variant binds the id set with `?`
- *  placeholders (mirroring listNodes — the codebase's one safe dynamic-IN spot);
- *  ids are NEVER string-concatenated (Min-10). */
-export function listWakes(scope) {
-    const db = openDb();
-    let rows;
-    if ('node' in scope) {
-        rows = db
-            .prepare('SELECT * FROM wakeups WHERE node_id = ? ORDER BY fire_at')
-            .all(scope.node);
-    }
-    else if ('owner' in scope) {
-        rows = db
-            .prepare('SELECT * FROM wakeups WHERE owner_id = ? ORDER BY fire_at')
-            .all(scope.owner);
-    }
-    else if ('subtree' in scope) {
-        if (scope.subtree.length === 0)
-            return [];
-        const placeholders = scope.subtree.map(() => '?').join(',');
-        rows = db
-            .prepare(`SELECT * FROM wakeups WHERE node_id IN (${placeholders}) ORDER BY fire_at`)
-            .all(...scope.subtree);
-    }
-    else if ('due' in scope) {
-        rows = db
-            .prepare('SELECT * FROM wakeups WHERE fire_at <= ? ORDER BY fire_at')
-            .all(scope.due);
-    }
-    else {
-        rows = db.prepare('SELECT * FROM wakeups ORDER BY fire_at').all();
-    }
-    return rows.map(wakeupFrom);
-}
-/** True if the node has ANY pending self-anchored wake (of any kind). Consumed by
- *  the stop-guard self-wake seam so a no-child poll node releases dormant after
- *  arming instead of being nagged to finish (AC-X3/AC-R1). */
-export function hasPendingSelfWake(node_id) {
-    return (openDb().prepare('SELECT 1 FROM wakeups WHERE node_id = ? LIMIT 1').get(node_id) !== undefined);
-}

package/dist/core/hearth/registry.d.ts

@@ -1,15 +0,0 @@
-import type { HomeRecord, TenantId } from './types.js';
-export type RegistryData = Record<TenantId, HomeRecord>;
-export declare class RegistryLockError extends Error {
-    readonly lockPath: string;
-    readonly holder: string;
-    readonly ageMs: number | null;
-    constructor(lockPath: string, holder: string, ageMs: number | null);
-}
-export declare function acquireRegistryLock(registryPath: string): () => void;
-export declare function readRegistry(registryPath: string): RegistryData;
-export declare function writeRegistry(registryPath: string, data: RegistryData): RegistryData;
-export declare function getHome(registryPath: string, tenantId: TenantId): HomeRecord | null;
-export declare function putHome(registryPath: string, home: HomeRecord): HomeRecord;
-export declare function updateHome(registryPath: string, tenantId: TenantId, mutate: (home: HomeRecord) => HomeRecord | void): HomeRecord;
-export declare function listHomes(registryPath: string): HomeRecord[];

package/dist/core/hearth/registry.js

@@ -1,179 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, chmodSync } from 'node:fs';
-import { dirname, join, basename } from 'node:path';
-import { homedir } from 'node:os';
-import { general } from '../errors.js';
-import { nowIso } from '../fs-utils.js';
-const LOCK_STALE_MS = 2 * 60_000;
-function expandHomePath(path) {
-    if (path.startsWith('~'))
-        return join(homedir(), path.slice(1));
-    return path;
-}
-function registryLockPath(registryPath) {
-    return `${registryPath}.lock`;
-}
-function lockOwnerPath(lockPath) {
-    return join(lockPath, 'owner.json');
-}
-function ensureParentDir(path) {
-    mkdirSync(dirname(path), { recursive: true });
-}
-function readJson(path) {
-    return JSON.parse(readFileSync(path, 'utf8'));
-}
-function normalizeRegistry(value) {
-    if (value === null || typeof value !== 'object' || Array.isArray(value))
-        return {};
-    const out = {};
-    for (const [tenantId, record] of Object.entries(value)) {
-        if (record === null || typeof record !== 'object' || Array.isArray(record))
-            continue;
-        const obj = record;
-        if (typeof obj.tenantId !== 'string' || obj.tenantId === '')
-            continue;
-        out[tenantId] = obj;
-    }
-    return out;
-}
-function atomicWriteJson(path, value) {
-    ensureParentDir(path);
-    const tmp = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    const content = JSON.stringify(value, null, 2) + '\n';
-    writeFileSync(tmp, content, { encoding: 'utf8', mode: 0o600 });
-    try {
-        renameSync(tmp, path);
-        chmodSync(path, 0o600);
-    }
-    catch (error) {
-        try {
-            unlinkSync(tmp);
-        }
-        catch {
-            /* ignore */
-        }
-        throw error;
-    }
-}
-function lockDiagnostics(lockPath) {
-    let holder = lockPath;
-    let ageMs = null;
-    let stale = false;
-    try {
-        const st = statSync(lockPath);
-        ageMs = Date.now() - st.mtimeMs;
-        stale = ageMs >= LOCK_STALE_MS;
-    }
-    catch {
-        /* ignore */
-    }
-    const ownerFile = lockOwnerPath(lockPath);
-    try {
-        const owner = JSON.parse(readFileSync(ownerFile, 'utf8'));
-        if (typeof owner.holder === 'string' && owner.holder !== '')
-            holder = owner.holder;
-        else if (typeof owner.pid === 'number')
-            holder = `pid ${owner.pid}`;
-        else if (typeof owner.startedAt === 'string')
-            holder = owner.startedAt;
-    }
-    catch {
-        /* ignore */
-    }
-    return { holder, ageMs, stale };
-}
-export class RegistryLockError extends Error {
-    lockPath;
-    holder;
-    ageMs;
-    constructor(lockPath, holder, ageMs) {
-        super(ageMs === null
-            ? `registry lock held at ${lockPath} by ${holder}`
-            : `registry lock held at ${lockPath} by ${holder} (${Math.ceil(ageMs / 1000)}s old)`);
-        this.lockPath = lockPath;
-        this.holder = holder;
-        this.ageMs = ageMs;
-        this.name = 'RegistryLockError';
-    }
-}
-export function acquireRegistryLock(registryPath) {
-    const lockPath = registryLockPath(registryPath);
-    ensureParentDir(lockPath);
-    try {
-        mkdirSync(lockPath, { mode: 0o700 });
-    }
-    catch (error) {
-        const diagnostics = lockDiagnostics(lockPath);
-        throw new RegistryLockError(lockPath, diagnostics.holder, diagnostics.ageMs);
-    }
-    const owner = {
-        holder: `${process.pid}@${basename(registryPath)}:${nowIso()}`,
-        pid: process.pid,
-        startedAt: nowIso(),
-        cwd: process.cwd(),
-    };
-    atomicWriteJson(lockOwnerPath(lockPath), owner);
-    return () => {
-        try {
-            rmSync(lockPath, { recursive: true, force: true });
-        }
-        catch {
-            /* ignore */
-        }
-    };
-}
-export function readRegistry(registryPath) {
-    const path = expandHomePath(registryPath);
-    if (!existsSync(path))
-        return {};
-    return normalizeRegistry(readJson(path));
-}
-export function writeRegistry(registryPath, data) {
-    const path = expandHomePath(registryPath);
-    const release = acquireRegistryLock(path);
-    try {
-        atomicWriteJson(path, data);
-        return data;
-    }
-    finally {
-        release();
-    }
-}
-export function getHome(registryPath, tenantId) {
-    const registry = readRegistry(registryPath);
-    return registry[tenantId] ?? null;
-}
-export function putHome(registryPath, home) {
-    const path = expandHomePath(registryPath);
-    const release = acquireRegistryLock(path);
-    try {
-        const registry = readRegistry(path);
-        registry[home.tenantId] = home;
-        atomicWriteJson(path, registry);
-        return home;
-    }
-    finally {
-        release();
-    }
-}
-export function updateHome(registryPath, tenantId, mutate) {
-    const path = expandHomePath(registryPath);
-    const release = acquireRegistryLock(path);
-    try {
-        const registry = readRegistry(path);
-        const current = registry[tenantId];
-        if (current === undefined) {
-            throw general(`no home for tenant ${tenantId}`, { tenantId, registryPath: path });
-        }
-        const draft = { ...current };
-        const next = mutate(draft) ?? draft;
-        registry[tenantId] = next;
-        atomicWriteJson(path, registry);
-        return next;
-    }
-    finally {
-        release();
-    }
-}
-export function listHomes(registryPath) {
-    return Object.values(readRegistry(registryPath)).sort((a, b) => a.tenantId.localeCompare(b.tenantId));
-}

package/dist/hearth/wake-proxy/__tests__/anthropic-oauth.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/hearth/wake-proxy/__tests__/anthropic-oauth.test.js

@@ -1,289 +0,0 @@
-import assert from 'node:assert/strict';
-import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import test from 'node:test';
-import { ANTHROPIC_AUTHORIZE_URL, ANTHROPIC_CLIENT_ID, ANTHROPIC_REDIRECT_URI, ANTHROPIC_SCOPES, ANTHROPIC_TOKEN_URL, finishAnthropicOAuthSession, redactAnthropicOAuthMessage, startAnthropicOAuthSession, } from '../anthropic-oauth.js';
-const PROVIDER_SOURCE_PATH = join(process.cwd(), 'node_modules/@earendil-works/pi-ai/dist/utils/oauth/anthropic.js');
-function makeRandomBytes(values) {
-    let index = 0;
-    return (size) => {
-        const value = values[index++];
-        assert.ok(value, `unexpected randomBytes call ${index} for size ${size}`);
-        return value;
-    };
-}
-function sha256Base64url(input) {
-    return createHash('sha256').update(input, 'utf8').digest('base64url');
-}
-function makeFetch(responseBody, calls) {
-    return async (input, init) => {
-        calls.push({ input, init });
-        return {
-            ok: true,
-            status: 200,
-            statusText: 'OK',
-            async text() {
-                return JSON.stringify(responseBody);
-            },
-        };
-    };
-}
-test('startAnthropicOAuthSession builds a PKCE auth URL with Claude Code state bound to the verifier', () => {
-    const sessionIdBytes = Buffer.alloc(16, 1);
-    const verifierBytes = Buffer.alloc(32, 3);
-    const verifier = verifierBytes.toString('base64url');
-    const shaInputs = [];
-    const started = startAnthropicOAuthSession('tenant-a', () => 1_000_000, {
-        randomBytes: makeRandomBytes([sessionIdBytes, verifierBytes]),
-        sha256: (input) => {
-            shaInputs.push(input);
-            return Buffer.alloc(32, 9);
-        },
-    });
-    assert.equal(started.ok, true);
-    if (!started.ok)
-        throw new Error('expected success');
-    assert.ok(started.authUrl.includes('response_type=code'));
-    assert.ok(started.authUrl.includes('code_challenge_method=S256'));
-    // Regression: claude.ai rejects the authorize request with "Invalid request
-    // format" without code=true (the Claude Code authorize flow param).
-    assert.ok(started.authUrl.includes('code=true'));
-    const authUrl = new URL(started.authUrl);
-    assert.equal(authUrl.origin + authUrl.pathname, ANTHROPIC_AUTHORIZE_URL);
-    assert.equal(authUrl.searchParams.get('client_id'), ANTHROPIC_CLIENT_ID);
-    assert.equal(authUrl.searchParams.get('redirect_uri'), ANTHROPIC_REDIRECT_URI);
-    assert.equal(authUrl.searchParams.get('scope'), ANTHROPIC_SCOPES);
-    assert.equal(authUrl.searchParams.get('response_type'), 'code');
-    assert.equal(authUrl.searchParams.get('code_challenge_method'), 'S256');
-    assert.equal(authUrl.searchParams.get('state'), verifier);
-    assert.equal(authUrl.searchParams.get('code_challenge'), Buffer.alloc(32, 9).toString('base64url'));
-    assert.ok(!started.authUrl.includes(sessionIdBytes.toString('base64url')));
-    assert.equal(shaInputs[0], verifier);
-});
-test('startAnthropicOAuthSession keeps Claude Code state coupled to the PKCE verifier', () => {
-    const sessionIdBytes = Buffer.alloc(16, 41);
-    const verifierBytes = Buffer.alloc(32, 42);
-    const verifier = verifierBytes.toString('base64url');
-    const started = startAnthropicOAuthSession('tenant-a-pkce', () => 2_000_000, {
-        randomBytes: makeRandomBytes([sessionIdBytes, verifierBytes]),
-    });
-    assert.equal(started.ok, true);
-    if (!started.ok)
-        throw new Error('expected success');
-    const authUrl = new URL(started.authUrl);
-    const state = authUrl.searchParams.get('state');
-    assert.ok(state);
-    assert.equal(state, verifier);
-    assert.equal(authUrl.searchParams.get('code_challenge'), sha256Base64url(state));
-});
-test('finishAnthropicOAuthSession rejects foreign state, unknown session, and expired sessions without token exchange', async () => {
-    const fetchCalls = [];
-    const started = startAnthropicOAuthSession('tenant-b', () => 10_000, {
-        randomBytes: makeRandomBytes([Buffer.alloc(16, 4), Buffer.alloc(32, 6)]),
-        sha256: () => Buffer.alloc(32, 7),
-    });
-    assert.equal(started.ok, true);
-    if (!started.ok)
-        throw new Error('expected success');
-    const foreignState = await finishAnthropicOAuthSession({
-        tenantId: 'tenant-b',
-        sessionId: started.sessionId,
-        redirectUrl: 'http://localhost:53692/callback?code=abc123&state=wrong-state',
-    }, {
-        now: () => 10_000,
-        fetch: makeFetch({ access_token: 'x', refresh_token: 'y', expires_in: 600 }, fetchCalls),
-    });
-    assert.equal(foreignState.ok, false);
-    assert.equal(foreignState.status, 400);
-    assert.equal(fetchCalls.length, 0);
-    const unknownSession = await finishAnthropicOAuthSession({
-        tenantId: 'tenant-c',
-        sessionId: 'missing-session',
-        redirectUrl: 'http://localhost:53692/callback?code=abc123&state=wrong-state',
-    }, {
-        now: () => 10_000,
-        fetch: makeFetch({ access_token: 'x', refresh_token: 'y', expires_in: 600 }, fetchCalls),
-    });
-    assert.equal(unknownSession.ok, false);
-    assert.equal(unknownSession.status, 400);
-    assert.equal(fetchCalls.length, 0);
-    const expiredStart = startAnthropicOAuthSession('tenant-d', () => 20_000, {
-        randomBytes: makeRandomBytes([Buffer.alloc(16, 8), Buffer.alloc(32, 10)]),
-        sha256: () => Buffer.alloc(32, 11),
-    });
-    assert.equal(expiredStart.ok, true);
-    if (!expiredStart.ok)
-        throw new Error('expected success');
-    const expired = await finishAnthropicOAuthSession({
-        tenantId: 'tenant-d',
-        sessionId: expiredStart.sessionId,
-        redirectUrl: 'http://localhost:53692/callback?code=abc123&state=whatever',
-    }, {
-        now: () => 20_000 + 10 * 60_000 + 1,
-        fetch: makeFetch({ access_token: 'x', refresh_token: 'y', expires_in: 600 }, fetchCalls),
-    });
-    assert.equal(expired.ok, false);
-    assert.equal(expired.status, 400);
-    assert.equal(fetchCalls.length, 0);
-});
-// Regression: a stale/zombie in-memory OAuth session used to make /start return
-// 409 "already in progress" for the whole 10-min TTL, trapping the user on an
-// about:blank popup with no usable authUrl (Hearth live triage 2026-06-29).
-// A fresh start must always supersede the prior session and hand back a usable,
-// distinct authUrl. Pre-fix this test would have failed on the second start.
-test('startAnthropicOAuthSession supersedes a stale pending session and returns a fresh usable authUrl', () => {
-    const now = 30_000;
-    const first = startAnthropicOAuthSession('tenant-e', () => now, {
-        randomBytes: makeRandomBytes([Buffer.alloc(16, 12), Buffer.alloc(32, 14)]),
-        sha256: () => Buffer.alloc(32, 15),
-    });
-    assert.equal(first.ok, true);
-    if (!first.ok)
-        throw new Error('expected success');
-    // Second click while the first session is still live (within TTL): no 409 lock.
-    const second = startAnthropicOAuthSession('tenant-e', () => now + 1_000, {
-        randomBytes: makeRandomBytes([Buffer.alloc(16, 16), Buffer.alloc(32, 18)]),
-        sha256: () => Buffer.alloc(32, 19),
-    });
-    assert.equal(second.ok, true);
-    if (!second.ok)
-        throw new Error('expected fresh start to succeed, not a 409 lock');
-    assert.ok(second.authUrl.includes('response_type=code'));
-    assert.notEqual(second.sessionId, first.sessionId);
-    // The superseded session's state must no longer be the active one.
-    assert.notEqual(new URL(second.authUrl).searchParams.get('state'), new URL(first.authUrl).searchParams.get('state'));
-});
-// Security companion to the supersede fix: after a fresh start replaces the
-// pending session, a callback carrying the OLD session's id/state must NOT be
-// able to complete auth — newest valid session wins, superseded state fails.
-test('finishAnthropicOAuthSession rejects a superseded callback after a fresh start', async () => {
-    const now = 50_000;
-    const firstSessionId = Buffer.alloc(16, 30);
-    const firstVerifierBytes = Buffer.alloc(32, 32);
-    const firstVerifier = firstVerifierBytes.toString('base64url');
-    const first = startAnthropicOAuthSession('tenant-g', () => now, {
-        randomBytes: makeRandomBytes([firstSessionId, firstVerifierBytes]),
-        sha256: () => Buffer.alloc(32, 33),
-    });
-    assert.equal(first.ok, true);
-    if (!first.ok)
-        throw new Error('expected success');
-    // User re-clicks; a new session supersedes the first.
-    const second = startAnthropicOAuthSession('tenant-g', () => now + 1_000, {
-        randomBytes: makeRandomBytes([Buffer.alloc(16, 34), Buffer.alloc(32, 36)]),
-        sha256: () => Buffer.alloc(32, 37),
-    });
-    assert.equal(second.ok, true);
-    if (!second.ok)
-        throw new Error('expected success');
-    // A late callback from the FIRST (superseded) session must fail without exchange.
-    const fetchCalls = [];
-    const stale = await finishAnthropicOAuthSession({
-        tenantId: 'tenant-g',
-        sessionId: first.sessionId,
-        redirectUrl: `http://localhost:53692/callback?code=stale-code&state=${firstVerifier}`,
-    }, {
-        now: () => now + 2_000,
-        fetch: makeFetch({ access_token: 'x', refresh_token: 'y', expires_in: 600 }, fetchCalls),
-    });
-    assert.equal(stale.ok, false);
-    if (stale.ok)
-        throw new Error('superseded callback must not complete auth');
-    assert.equal(stale.status, 400);
-    assert.equal(fetchCalls.length, 0);
-});
-test('finishAnthropicOAuthSession exchanges the stored verifier and returns Pi-compatible credentials with the skew applied', async () => {
-    const sessionIdBytes = Buffer.alloc(16, 24);
-    const verifierBytes = Buffer.alloc(32, 26);
-    const verifier = verifierBytes.toString('base64url');
-    const now = 40_000;
-    const started = startAnthropicOAuthSession('tenant-f', () => now, {
-        randomBytes: makeRandomBytes([sessionIdBytes, verifierBytes]),
-        sha256: (input) => {
-            assert.equal(input, verifier);
-            return Buffer.alloc(32, 27);
-        },
-    });
-    assert.equal(started.ok, true);
-    if (!started.ok)
-        throw new Error('expected success');
-    const fetchCalls = [];
-    const finished = await finishAnthropicOAuthSession({
-        tenantId: 'tenant-f',
-        sessionId: started.sessionId,
-        redirectUrl: `http://localhost:53692/callback?code=auth-code-123&state=${verifier}`,
-    }, {
-        now: () => now,
-        fetch: async (input, init) => {
-            fetchCalls.push({ input, init });
-            const request = new Request(String(input), init);
-            const body = JSON.parse(await request.text());
-            assert.equal(body.grant_type, 'authorization_code');
-            assert.equal(body.client_id, ANTHROPIC_CLIENT_ID);
-            assert.equal(body.code, 'auth-code-123');
-            assert.equal(body.state, verifier);
-            assert.equal(body.redirect_uri, ANTHROPIC_REDIRECT_URI);
-            assert.equal(body.code_verifier, verifier);
-            return {
-                ok: true,
-                status: 200,
-                statusText: 'OK',
-                async text() {
-                    return JSON.stringify({
-                        access_token: 'access-token-1',
-                        refresh_token: 'refresh-token-1',
-                        expires_in: 600,
-                    });
-                },
-            };
-        },
-    });
-    assert.equal(fetchCalls.length, 1);
-    assert.equal(finished.ok, true);
-    if (!finished.ok)
-        throw new Error('expected success');
-    assert.deepEqual(finished.credential, {
-        type: 'oauth',
-        refresh: 'refresh-token-1',
-        access: 'access-token-1',
-        expires: now + 600_000 - 300_000,
-    });
-    assert.equal(finished.type, 'oauth');
-    assert.equal(finished.refresh, 'refresh-token-1');
-    assert.equal(finished.access, 'access-token-1');
-    assert.equal(finished.expires, now + 600_000 - 300_000);
-});
-test('contract guard: the installed Pi Anthropic OAuth source still matches the copied constants', () => {
-    const source = readFileSync(PROVIDER_SOURCE_PATH, 'utf8');
-    assert.match(source, /const CLIENT_ID = decode\("OWQxYzI1MGEtZTYxYi00NGQ5LTg4ZWQtNTk0NGQxOTYyZjVl"\);/);
-    assert.match(source, /const AUTHORIZE_URL = "https:\/\/claude\.ai\/oauth\/authorize";/);
-    assert.match(source, /const TOKEN_URL = "https:\/\/platform\.claude\.com\/v1\/oauth\/token";/);
-    assert.match(source, /const CALLBACK_PORT = 53692;/);
-    assert.match(source, /const CALLBACK_PATH = "\/callback";/);
-    assert.match(source, /const REDIRECT_URI = `http:\/\/localhost:\$\{CALLBACK_PORT\}\$\{CALLBACK_PATH\}`;/);
-    assert.match(source, /const SCOPES = "org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";/);
-    assert.equal(ANTHROPIC_CLIENT_ID, '9d1c250a-e61b-44d9-88ed-5944d1962f5e');
-    assert.equal(ANTHROPIC_AUTHORIZE_URL, 'https://claude.ai/oauth/authorize');
-    assert.equal(ANTHROPIC_TOKEN_URL, 'https://platform.claude.com/v1/oauth/token');
-    assert.equal(ANTHROPIC_REDIRECT_URI, 'http://localhost:53692/callback');
-    assert.equal(ANTHROPIC_SCOPES, 'org:create_api_key user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload');
-});
-test('redaction removes Anthropic OAuth and bearer/token material from log text', () => {
-    const redacted = redactAnthropicOAuthMessage('Authorization: Bearer owner-token https://localhost:53692/callback?code=auth-code&state=state-value&code_verifier=verifier-value {"access_token":"access-value","refresh_token":"refresh-value","access":"access-two","refresh":"refresh-two","code":"json-code","state":"json-state","code_verifier":"json-verifier"} code=assign-code state=assign-state code_verifier=assign-verifier hearth_owner=owner-cookie');
-    assert.ok(!redacted.includes('owner-token'));
-    assert.ok(!redacted.includes('auth-code'));
-    assert.ok(!redacted.includes('state-value'));
-    assert.ok(!redacted.includes('verifier-value'));
-    assert.ok(!redacted.includes('json-code'));
-    assert.ok(!redacted.includes('json-state'));
-    assert.ok(!redacted.includes('json-verifier'));
-    assert.ok(!redacted.includes('assign-code'));
-    assert.ok(!redacted.includes('assign-state'));
-    assert.ok(!redacted.includes('assign-verifier'));
-    assert.ok(!redacted.includes('access-value'));
-    assert.ok(!redacted.includes('refresh-value'));
-    assert.ok(!redacted.includes('owner-cookie'));
-    assert.match(redacted, /\[redacted redirect url\]/);
-    assert.match(redacted, /Bearer \[redacted\]/);
-});

package/dist/hearth/wake-proxy/__tests__/config-timeout.test.d.ts

@@ -1 +0,0 @@
-export {};