@gjermundgaraba/clankercreds 0.1.1 → 0.2.0

package/dist/main.mjs

@@ -3,12 +3,11 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { Option, Predicate, Schema } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/unstable/http";
-import * as ActionHttpClient from "@gjermundgaraba/effect-actions/ActionHttpClient";
+import { Context, Data, Effect, Option, Predicate, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
-import * as ActionGroup from "@gjermundgaraba/effect-actions/ActionGroup";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
+import * as Authentication from "@gjermundgaraba/effect-actions/Authentication";
 import { YAMLMap, isMap, parseDocument } from "yaml";
 //#region src/files.ts
 /** Secrets are readable by their owner only, in directories only the owner can enter. */
@@ -98,44 +97,49 @@ const loadConfig = () => {
 		configHome: configHome(home)
 	};
 };
-//#endregion
-//#region ../../node_modules/.pnpm/@gjermundgaraba+clankerauth-sdk@0.9.0_@gjermundgaraba+effect-actions@0.7.0_effect@4.0.0-rc.117_/node_modules/@gjermundgaraba/clankerauth-sdk/dist/errors.js
+Data.TaggedError("Unauthorized");
 /**
-* Every refusal this package produces, as schemas. This entry point is browser-safe:
-* a shared contract declares these on its surface and a browser client decodes them,
-* without pulling token verification or its cryptography into the bundle.
-*
-* Schemas define public responses. Diagnostic causes are internal, non-enumerable fields.
+* The issuer could not be reached, so the credential could not be decided: a 503, not a
+* refusal. A resource's descriptor declares it,
+* `Authentication.make("notes.Login", CurrentPrincipal, { error: ProviderUnavailable })`.
+* Its public response is the schema. Diagnostic causes are internal, non-enumerable fields.
 */
-var Unauthorized = class extends Schema.TaggedError()("Unauthorized", { message: Schema.String }, { httpApiStatus: 401 }) {
-	constructor(options) {
-		super({ message: options.message });
-		Object.defineProperty(this, "cause", { value: options.cause });
-	}
-};
-var RateLimited = class extends Schema.TaggedError()("RateLimited", { message: Schema.String }, { httpApiStatus: 429 }) {};
 var ProviderUnavailable = class extends Schema.TaggedError()("ProviderUnavailable", { operation: Schema.String }, { httpApiStatus: 503 }) {
 	constructor(options) {
 		super({ operation: options.operation });
 		Object.defineProperty(this, "cause", { value: options.cause });
 	}
 };
+Data.TaggedError("InsufficientScope");
+Schema.TaggedError()("ConfigurationError", { message: Schema.String });
+//#endregion
+//#region ../../node_modules/.pnpm/@gjermundgaraba+clankerauth-sdk@0.13.0_@gjermundgaraba+effect-actions@0.10.0_effect@4.0.0__effect@4.0.0/node_modules/@gjermundgaraba/clankerauth-sdk/dist/session.js
 /**
-* A verified credential lacks one scope the requested access needs. It names only
-* the missing scope, so a refusal never enumerates the resource's permissions.
+* The identity a browser page needs, without any verification code. This entry point is
+* browser-safe: it declares the identity a protected contract states, the `whoami` contract
+* and the issuer's sign-out URL, so contracts, bindings and pages import it directly, and a
+* server answers `Whoami` with its resource's `session`.
 */
-var InsufficientScope = class extends Schema.TaggedError()("InsufficientScope", { scope: Schema.String }, { httpApiStatus: 403 }) {};
-Schema.TaggedError()("ConfigurationError", { message: Schema.String });
 /**
-* What verification, admission and the authorization hook refuse with — one list, so a
-* surface declares `errors: authenticationErrors` and answers every refusal the same way.
+* The caller: what a protected contract states, `caller: CurrentPrincipal`, and what an
+* authentication descriptor proves,
+* `Authentication.make("notes.Login", CurrentPrincipal, { error: ProviderUnavailable })`.
+* Remotely, the resource's provider gives it per request, from the verified credential; on
+* a trusted local surface, the host gives it the process, `Notes.local(subject)`.
 */
-const authenticationErrors = [
-	Unauthorized,
-	InsufficientScope,
-	RateLimited,
-	ProviderUnavailable
-];
+var CurrentPrincipal = class extends Context.Service()("@clankerauth/CurrentPrincipal") {};
+/** The verified credential behind a request, as the resource server read it. */
+const Principal = Schema.Struct({
+	subject: Schema.NonEmptyString,
+	issuer: Schema.NonEmptyString,
+	scopes: Schema.Array(Schema.String)
+});
+Action.make("whoami", {
+	description: "The verified subject, issuer and scopes behind this request's credential.",
+	readOnly: true,
+	caller: CurrentPrincipal,
+	success: Principal
+});
 //#endregion
 //#region ../../packages/api/src/bundle.ts
 const GhCredential = Schema.Struct({
@@ -169,7 +173,11 @@ const PiCredential = Schema.Struct({
 	accessToken: Schema.String
 });
 /**
-* The client is baked into images, so old clients read what the service sends. A change
+* The service sends typed credentials, never file contents or paths, so it cannot write
+* anything on a machine but what the client knows how to place. The cost is that a new
+* tool, or a placement fix, needs a client release, which new machines install.
+*
+* Each machine keeps the client its setup installed, so old clients read what the service sends. A change
 * an old client would get wrong is a new type name, which it skips: the decoder drops fields
 * it does not know, so one ignoring `host` would place a GHE token as github.com's. A field
 * an old client can safely ignore may be added, as pi's `accessToken` was; the service ships
@@ -194,8 +202,6 @@ const UnknownCredential = Schema.Struct({ type: Schema.String.check(Schema.makeF
 const Bundle = Schema.Struct({ credentials: Schema.Array(Schema.Union([TypedCredential, UnknownCredential])) });
 //#endregion
 //#region ../../packages/api/src/shared.ts
-/** The caller asked for something the service cannot do with the input given. */
-var BadRequest = class extends Schema.TaggedError()("BadRequest", { message: Schema.String }, { httpApiStatus: 400 }) {};
 /**
 * What was asked for does not exist: a bundle, credential or sign-in by that name, a
 * bundle for the calling key, or a ChatGPT login in the bundle that has none.
@@ -206,19 +212,6 @@ Schema.TaggedError()("Conflict", { message: Schema.String }, { httpApiStatus: 40
 var NeedsSignIn = class extends Schema.TaggedError()("NeedsSignIn", { message: Schema.String }, { httpApiStatus: 409 }) {};
 /** OpenAI could not be reached and no valid token is held. Waiting helps; retrying now does not. */
 var UpstreamUnavailable = class extends Schema.TaggedError()("UpstreamUnavailable", { message: Schema.String }, { httpApiStatus: 503 }) {};
-/** The request could not be represented on the wire; never a caller-fixable failure. */
-var InternalError = class extends Schema.TaggedError()("InternalError", { message: Schema.String }, { httpApiStatus: 500 }) {};
-/** Transport failures answer with the same public errors handlers use. */
-const schemaError = {
-	invalid: {
-		schema: BadRequest,
-		make: () => new BadRequest({ message: "The request does not match the action's input." })
-	},
-	internal: {
-		schema: InternalError,
-		make: () => new InternalError({ message: "The response could not be encoded." })
-	}
-};
 Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/));
 Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/), Schema.isMaxLength(253));
 /**
@@ -257,28 +250,25 @@ const claimsOf = (jwt) => {
 * What a machine key can do: read the one bundle bound to it, and nothing else. The
 * bundle is never named: the key is bound to it on the server.
 */
-const Machine = ActionGroup.make({
-	name: "machine",
-	schemaError
-}, Action.make("bundle", {
-	access: "read",
+const Machine = [Action.make("bundle", {
+	readOnly: false,
+	caller: CurrentPrincipal,
 	description: "Fetch the typed credentials of the bundle bound to the calling key.",
 	input: Schema.Struct({ clientId: ClientId }),
 	success: Bundle,
-	errors: [NotFound],
-	mcp: false
+	error: NotFound
 }), Action.make("codexLogin", {
-	access: "read",
+	readOnly: false,
+	caller: CurrentPrincipal,
 	description: "The current ChatGPT login of the bundle bound to the calling key, as the codex type carries it, refreshed first when it has expired.",
 	input: Schema.Struct({ clientId: ClientId }),
 	success: CodexLogin,
-	errors: [
+	error: [
 		NotFound,
 		NeedsSignIn,
 		UpstreamUnavailable
-	],
-	mcp: false
-}));
+	]
+})];
 /**
 * Codex treats a 401 as permanent and stops retrying; every other failure is transient.
 * The codes are the ones Codex classifies: `refresh_token_invalidated` reads as revoked.
@@ -293,26 +283,27 @@ var CodexRefreshUnavailable = class extends Schema.TaggedError()("CodexRefreshUn
 }) }, { httpApiStatus: 503 }) {};
 /**
 * Codex's own refresh request, the one request whose shape is not ours. The refresh-token
-* field carries `<clientId>:<key>`, so this group authenticates in its handler instead of
-* through bearer middleware. The answer leaves `refresh_token` out, so Codex keeps the
-* composite it has.
+* field carries `<clientId>:<key>`, so the contract is public and its handler authenticates
+* the key against the machine resource. The answer leaves `refresh_token` out, so Codex keeps the
+* composite it has. Its input alone accepts fields it does not name: Codex may add one,
+* and every other action refuses them.
 */
-const Codex = ActionGroup.make({ name: "codex" }, Action.make("refresh", {
-	access: "read",
+const CodexRefresh = Action.make("codexRefresh", {
+	readOnly: false,
+	caller: Action.Anyone,
 	description: "Answer Codex's token refresh with the bundle's current ChatGPT tokens.",
-	input: Schema.Struct({
+	input: Schema.StructWithRest(Schema.Struct({
 		grant_type: Schema.Literal("refresh_token"),
 		refresh_token: Schema.String,
 		client_id: Schema.optionalKey(Schema.String),
 		scope: Schema.optionalKey(Schema.String)
-	}),
+	}), [Schema.Record(Schema.String, Schema.Json)]),
 	success: Schema.Struct({
 		access_token: Schema.String,
 		id_token: Schema.String
 	}),
-	errors: [CodexRefreshRejected, CodexRefreshUnavailable],
-	mcp: false
-}));
+	error: [CodexRefreshRejected, CodexRefreshUnavailable]
+});
 /** `<clientId>:<key>`. Client ids exclude `:`, so the key is the rest. */
 const formatCodexRefreshToken = (clientId, key) => `${clientId}:${key}`;
 const parseCodexRefreshToken = (value) => {
@@ -322,47 +313,45 @@ const parseCodexRefreshToken = (value) => {
 		key: value.slice(colon + 1)
 	};
 };
-const MachineHttp = ActionHttp.make({
-	apiPath: "/v1",
-	errors: authenticationErrors
-}, Machine);
-ActionHttp.make({ apiPath: "/v1" }, Codex);
-Object.keys(ActionGroup.contracts(Machine, Codex)).map((key) => `/v1/${key.replace(".", "/")}`);
+/**
+* A machine key's bearer token on the public port, verified by the machine resource's own
+* provider, which requires `clankercreds:machine`: a key without that scope is refused here.
+*/
+const MachineLogin = Authentication.make("clankercreds.machine", CurrentPrincipal, { error: ProviderUnavailable });
+/** Everything the public listener serves: the machine actions, and Codex's refresh beside them. */
+const MachineHttp = ActionHttp.make([...Machine, CodexRefresh], {
+	prefix: "/v1",
+	authentication: MachineLogin
+});
 //#endregion
 //#region src/service.ts
 /** The service answered and said no. Retrying the same request will not help. */
 var Refused = class extends Error {};
 /** No answer worth acting on. Whatever the machine already holds stays in place. */
 var Unreachable = class extends Error {};
-/**
-* The deadline covers the whole request, the body included. It matters most to `token`:
-* pi gives the command about ten seconds, and a hang would cost it a token it already holds.
-*/
-const connect = (config, deadlineMs) => ActionHttpClient.promise(MachineHttp, {
+const connect = (config) => ActionHttp.fetchClient(MachineHttp, {
 	baseUrl: config.service,
-	transformClient: HttpClient.mapRequest(HttpClientRequest.bearerToken(config.key)),
-	fetch: (input, init) => {
-		const deadline = AbortSignal.timeout(deadlineMs);
-		const signal = init?.signal ? AbortSignal.any([init.signal, deadline]) : deadline;
-		return fetch(input, {
-			...init,
-			signal
-		});
-	}
+	transformClient: HttpClient.mapRequest(HttpClientRequest.bearerToken(config.key))
 });
 /**
-* The key's own refusals and the declared answers are refusals. Whatever is left is an
-* outage: transport, upstream, a broken answer, or a service that never answers.
+* The key's own refusals, input the service will not take, and the declared answers are
+* refusals. Whatever is left is an outage: transport, upstream, a broken answer, or a
+* service that never answers within its deadline.
 */
 const classify = (error) => {
-	if (error instanceof Unauthorized) return new Refused("The machine key was refused. It may have been revoked.");
-	if (error instanceof InsufficientScope) return new Refused("The machine key does not carry the machine scope.");
-	if (error instanceof NotFound || error instanceof BadRequest || error instanceof NeedsSignIn) return new Refused(error.message);
+	if (error instanceof Action.Unauthenticated) return new Refused("The machine key was refused. It may have been revoked or expired, or not be granted here.");
+	if (error instanceof Action.Forbidden) return new Refused("The machine key does not carry the machine scope. A new grant takes up to a minute to apply.");
+	if (error instanceof Action.InvalidInput || error instanceof NotFound || error instanceof NeedsSignIn) return new Refused(error.message);
 	return new Unreachable(error instanceof Error ? error.message : String(error));
 };
-const refuse = (error) => Promise.reject(classify(error));
-const fetchBundle = (config, clientId) => connect(config, 3e4).machine.bundle({ clientId }).catch(refuse);
-const fetchCodexLogin = (config, clientId) => connect(config, 5e3).machine.codexLogin({ clientId }).catch(refuse);
+/**
+* One call, within its deadline. The deadline covers the whole request, the body included:
+* the call is interrupted, which aborts its `fetch`. It matters most to `token`: pi gives
+* the command about ten seconds, and a hang would cost it a token it already holds.
+*/
+const within = (call, deadlineMs) => Effect.runPromise(Effect.timeout(call, deadlineMs)).catch((error) => Promise.reject(classify(error)));
+const fetchBundle = (config, clientId, deadlineMs = 3e4) => within(connect(config).bundle({ clientId }), deadlineMs);
+const fetchCodexLogin = (config, clientId, deadlineMs = 5e3) => within(connect(config).codexLogin({ clientId }), deadlineMs);
 //#endregion
 //#region src/place/claude.ts
 const settingsFile = (home) => join(home, ".claude/settings.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankercreds",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "The machine client of clankercreds: fetches a bundle of credentials and places each where its tool expects it.",
   "license": "MIT",
   "repository": {
@@ -19,17 +19,17 @@
     "access": "public"
   },
   "dependencies": {
-    "@gjermundgaraba/effect-actions": "0.7.0",
-    "effect": "4.0.0-rc.117",
+    "@gjermundgaraba/effect-actions": "0.10.0",
+    "effect": "4.0.0",
     "yaml": "2.9.1"
   },
   "devDependencies": {
     "@clankercreds/api": "0.0.0",
-    "@gjermundgaraba/clankerauth-sdk": "0.9.0",
+    "@gjermundgaraba/clankerauth-sdk": "0.13.0",
     "@types/node": "26.6.2",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0-rc.1",
-    "vite-plus": "1.0.0-rc.1"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
+    "vite-plus": "1.0.0"
   },
   "engines": {
     "node": ">=26"