@gjermundgaraba/clankercreds-api 0.0.0-stage → 0.5.0

package/dist/shared.js

@@ -0,0 +1,87 @@
+import { Option, Schema } from "effect";
+/** Every route is `POST /v1/<action>`: both bindings mount here, each on its own listener. */
+export const apiPath = "/v1";
+/**
+ * What a credential of the clankercreds resource may carry. `machine` admits the
+ * public actions and nothing else; `read` and `admin` admit the admin actions.
+ */
+export const scopes = {
+    machine: "clankercreds:machine",
+    read: "clankercreds:read",
+    admin: "clankercreds:admin",
+};
+/**
+ * What was asked for does not exist: a key, credential or sign-in by that name, or a
+ * credential the calling machine key is not granted, which it is not told apart from one
+ * that does not exist.
+ */
+export class NotFound extends Schema.TaggedError()("NotFound", { message: Schema.String }, { httpApiStatus: 404 }) {
+}
+/** The change collides with what is stored: a taken name, or a credential still in use. */
+export class Conflict extends Schema.TaggedError()("Conflict", { message: Schema.String }, { httpApiStatus: 409 }) {
+}
+/** The login is dead, or was never completed. Only a new sign-in revives it. */
+export class NeedsSignIn extends Schema.TaggedError()("NeedsSignIn", { message: Schema.String }, { httpApiStatus: 409 }) {
+}
+/** The provider could not be reached and no valid token is held. Waiting helps; retrying now does not. */
+export class UpstreamUnavailable extends Schema.TaggedError()("UpstreamUnavailable", { message: Schema.String }, { httpApiStatus: 503 }) {
+}
+/**
+ * Credential names: lowercase labels, because they are typed by hand and are
+ * identities. SQLite compares them case-sensitively, so mixed case would let `GitHub-Main`
+ * and `github-main` be two credentials.
+ */
+export const Name = Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/));
+/**
+ * What an operator stores a value for: a GitHub token, a Claude token, or `token`, any other
+ * service's API key, which a service such as clankerusage reads and no machine places.
+ */
+export const SecretKind = Schema.Literals(["gh", "claude", "token"]);
+/**
+ * What a sign-in creates and the service keeps refreshed. The refresh token never leaves
+ * the service; only access tokens are delivered.
+ */
+export const LoginKind = Schema.Literals(["chatgpt", "grok", "cursor"]);
+export const CredentialKind = Schema.Literals([...SecretKind.literals, ...LoginKind.literals]);
+/** A GitHub host, lowercase: it is written into `gh`'s and git's configuration as is. */
+export const Host = Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/), Schema.isMaxLength(253));
+/**
+ * The machine's self-generated label. It identifies nothing; it only groups audit rows.
+ * It excludes `:` because the Codex refresh token is `<clientId>:<credential>:<key>`.
+ */
+export const ClientId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{1,64}$/));
+/**
+ * The one id the service records for a caller, whichever way clankerauth names it: the
+ * process itself, which no surface here admits, by its subject.
+ */
+export const keyIdOf = ({ actor, subject }) => {
+    switch (actor.kind) {
+        case "key":
+            return actor.keyId;
+        case "client":
+            return actor.clientId;
+        case "local":
+            return subject;
+    }
+};
+const Claims = Schema.Struct({
+    exp: Schema.optionalKey(Schema.Number),
+    email: Schema.optionalKey(Schema.String),
+    "https://api.openai.com/auth": Schema.optionalKey(Schema.Struct({ chatgpt_account_id: Schema.optionalKey(Schema.String) })),
+});
+/**
+ * The claims of a JWT, unverified: they are read for their timing, email and, in OpenAI's,
+ * account, never trusted for anything. Anything unreadable is simply no claims.
+ */
+export const claimsOf = (jwt) => {
+    const payload = Buffer.from(jwt.split(".")[1] ?? "", "base64url").toString("utf8");
+    const claims = Schema.decodeUnknownOption(Schema.fromJsonString(Claims))(payload);
+    return Option.match(claims, {
+        onNone: () => ({ exp: undefined, email: undefined, accountId: undefined }),
+        onSome: (value) => ({
+            exp: value.exp,
+            email: value.email,
+            accountId: value["https://api.openai.com/auth"]?.chatgpt_account_id,
+        }),
+    });
+};

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@gjermundgaraba/clankercreds-api",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.5.0",
+  "description": "The clankercreds wire contract: the machine and admin actions and the typed credentials they deliver, for a typed client of either API.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gjermundgaraba/clankercreds.git",
+    "directory": "packages/api"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./machine": {
+      "types": "./dist/machine.d.ts",
+      "import": "./dist/machine.js"
+    },
+    "./admin": {
+      "types": "./dist/admin.d.ts",
+      "import": "./dist/admin.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@gjermundgaraba/clankerauth-sdk": "0.16.0",
+    "@gjermundgaraba/effect-actions": "0.11.0",
+    "@types/node": "26.6.5",
+    "effect": "4.0.2",
+    "typescript": "7.0.2",
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
+    "vite-plus": "1.1.0"
+  },
+  "peerDependencies": {
+    "@gjermundgaraba/clankerauth-sdk": ">=0.16.0 <1",
+    "@gjermundgaraba/effect-actions": ">=0.11.0 <1",
+    "effect": "^4.0.2"
+  },
+  "engines": {
+    "node": ">=26"
+  },
+  "scripts": {
+    "test": "vp test --passWithNoTests",
+    "check": "vp check"
+  }
 }

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.