@gjermundgaraba/clankercreds 0.3.0 → 0.5.0

package/dist/{admin-CXDLXpaH.mjs → admin-BcOFNDUc.mjs}

@@ -1,4 +1,4 @@
-import { a as NeedsSignIn, d as ProviderUnavailable, i as Name, l as scopes, n as Conflict, o as NotFound, r as Host, s as UpstreamUnavailable, u as CurrentPrincipal } from "./shared-DBK2cCkw.mjs";
+import { a as Name, c as SecretKind, d as scopes, f as CurrentPrincipal, i as LoginKind, l as UpstreamUnavailable, n as Conflict, o as NeedsSignIn, p as ProviderUnavailable, r as Host, s as NotFound } from "./shared-DyTG-WFI.mjs";
 import { Config, Console, Effect, Option, Redacted, Schema } from "effect";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
@@ -12,8 +12,6 @@ import * as ActionCli from "@gjermundgaraba/effect-actions/ActionCli";
 //#region ../../packages/api/src/admin.ts
 /** Written by the service, always ISO. What an operator enters is decoded as a date instead. */
 const Timestamp = Schema.String;
-/** The kinds an operator stores a value for. A ChatGPT login only ever comes from a sign-in. */
-const SecretKind = Schema.Literals(["gh", "claude"]);
 /** A stored secret's state. The value itself is never read back out. */
 const SecretStatus = Schema.Struct({
 	name: Name,
@@ -24,20 +22,21 @@ const SecretStatus = Schema.Struct({
 	createdAt: Timestamp,
 	updatedAt: Timestamp
 });
-/** A ChatGPT login's state. It exists from the first completed sign-in on. */
-const ChatgptStatus = Schema.Struct({
+/** A login's state. It exists from the first completed sign-in on. */
+const LoginStatus = Schema.Struct({
 	name: Name,
-	kind: Schema.Literal("chatgpt"),
+	kind: LoginKind,
 	needsSignIn: Schema.Boolean,
 	email: Schema.NullOr(Schema.String),
-	accountId: Schema.String,
+	/** The ChatGPT account a ChatGPT login is for; null for every other kind. */
+	accountId: Schema.NullOr(Schema.String),
 	accessExpiresAt: Timestamp,
 	lastRefreshAt: Timestamp,
 	lastError: Schema.NullOr(Schema.String),
 	createdAt: Timestamp,
 	updatedAt: Timestamp
 });
-const CredentialStatus = Schema.Union([SecretStatus, ChatgptStatus]);
+const CredentialStatus = Schema.Union([SecretStatus, LoginStatus]);
 /** The clankerauth id of a machine key. */
 const KeyId = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
 /**
@@ -65,16 +64,21 @@ const ClaudeSignIn = Schema.Struct({
 * `authorizeUrl`. An approval that left out a scope the token needs ends it: start again.
 */
 var SignInRefused = class extends Schema.TaggedError()("SignInRefused", { message: Schema.String }, { httpApiStatus: 422 }) {};
+/**
+* A login's sign-in: open `verificationUrl` and approve, entering `userCode` where the
+* provider asks for one. Cursor's link carries everything and has no code.
+*/
 const SignInState = Schema.Struct({
 	signInId: Schema.String,
 	credential: Name,
+	kind: LoginKind,
 	status: Schema.Literals([
 		"pending",
 		"complete",
 		"failed",
 		"expired"
 	]),
-	userCode: Schema.String,
+	userCode: Schema.NullOr(Schema.String),
 	verificationUrl: Schema.String,
 	expiresAt: Timestamp,
 	message: Schema.optionalKey(Schema.String)
@@ -108,10 +112,10 @@ const AuditQuery = Schema.Struct({
 	clientId: Schema.optionalKey(Schema.String)
 });
 /**
-* A read whose user code signs a ChatGPT account in: exported so the server's authorization
+* A read whose code or link signs an account in: exported so the server's authorization
 * rule can name it.
 */
-const GetChatgptSignIn = Action.make("getChatgptSignIn", {
+const GetSignIn = Action.make("getSignIn", {
 	readOnly: true,
 	caller: CurrentPrincipal,
 	description: "Read a sign-in. The service holds one in memory only, until the next sign-in starts after it expired; one it no longer holds is not found.",
@@ -124,17 +128,18 @@ const Admin = [
 	Action.make("listCredentials", {
 		readOnly: true,
 		caller: CurrentPrincipal,
-		description: "Every credential with its state: expiry, last refresh, last error and whether a ChatGPT login needs a new sign-in. Values are never returned.",
+		description: "Every credential with its state: expiry, last refresh, last error and whether a login needs a new sign-in. Values are never returned.",
 		success: Schema.Struct({ credentials: Schema.Array(CredentialStatus) })
 	}),
 	Action.make("putCredential", {
 		readOnly: false,
 		caller: CurrentPrincipal,
-		description: "Store a secret under a name, or replace its value and expiry. A `gh` token is for `host`, github.com unless given. A credential's kind and host never change; remove it and put it again instead. Machines receive it on their next sync.",
+		description: "Store a secret under a name, or replace its value and expiry: a `gh` or `claude` token a machine places, or a `token`, any other service's API key, which a service such as clankerusage reads. A `gh` token is for `host`, github.com unless given. A credential's kind and host never change; remove it and put it again instead. Keys granted it receive it on their next sync.",
 		input: Schema.Struct({
 			name: Name,
 			kind: SecretKind,
-			value: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16384)),
+			/** Surrounding whitespace, such as a pasted line ending, is not part of a secret: a value carrying any is refused, never altered. */
+			value: Schema.Trimmed.check(Schema.isMinLength(1), Schema.isMaxLength(16384)),
 			host: Schema.optionalKey(Host),
 			/** Any date string JavaScript parses; a typo is refused, so alerting never loses it. Left out, it does not expire. */
 			expiresAt: Schema.optionalKey(Schema.DateFromString)
@@ -153,21 +158,24 @@ const Admin = [
 		success: Schema.Void,
 		error: [NotFound, Conflict]
 	}),
-	Action.make("startChatgptSignIn", {
+	Action.make("startSignIn", {
 		readOnly: false,
 		caller: CurrentPrincipal,
-		description: "Start a device-code sign-in for a ChatGPT credential; the credential is created, or its login replaced, when the sign-in completes. Approve the code at the returned URL, then poll getChatgptSignIn.",
-		input: Schema.Struct({ name: Name }),
+		description: "Start a sign-in for a ChatGPT, Grok or Cursor login; the credential is created, or its login replaced, when the sign-in completes. Open the returned verificationUrl and approve, entering userCode where one is given, then poll getSignIn.",
+		input: Schema.Struct({
+			name: Name,
+			kind: LoginKind
+		}),
 		success: SignInState,
 		error: [Conflict, UpstreamUnavailable]
 	}),
-	GetChatgptSignIn,
-	Action.make("refreshChatgptCredential", {
+	GetSignIn,
+	Action.make("refreshCredential", {
 		readOnly: false,
 		caller: CurrentPrincipal,
-		description: "Refresh one ChatGPT login now instead of waiting for its schedule.",
+		description: "Refresh one login now instead of waiting for its schedule.",
 		input: Schema.Struct({ name: Name }),
-		success: ChatgptStatus,
+		success: LoginStatus,
 		error: [
 			NotFound,
 			Conflict,
@@ -236,7 +244,7 @@ const AdminHttp = ActionHttp.make(Admin, {
 });
 //#endregion
 //#region package.json
-var version = "0.3.0";
+var version = "0.5.0";
 //#endregion
 //#region src/admin.ts
 /** A refusal of this command's own, printed as its message on stderr, exiting 1. */
@@ -287,11 +295,11 @@ const operator = Effect.gen(function* () {
 });
 /**
 * The secret's value, from stdin: a flag would leave it in the process list and the shell's
-* history. Line endings a pipe adds, such as `op read`'s, are not part of it.
+* history. Surrounding whitespace, such as the line ending `op read` adds, is not part of it.
 */
 const valueFromStdin = Effect.gen(function* () {
 	if (process.stdin.isTTY) return yield* refused("Pipe the value in, such as `op read 'op://…' | clankercreds admin put-credential …`; it is never taken from a flag or the terminal.");
-	const value = (yield* Effect.promise(() => text(process.stdin))).replace(/[\r\n]+$/, "");
+	const value = (yield* Effect.promise(() => text(process.stdin))).trim();
 	if (value === "") return yield* refused("The value on stdin is empty.");
 	return value;
 });
@@ -299,7 +307,7 @@ const json = (value) => Console.log(JSON.stringify(value, null, 2));
 /** `putCredential`, its value read from stdin and every other field a flag. */
 const putCredential = Command.make("put-credential", {
 	name: Flag.String("name").pipe(Flag.withDescription("The credential's name")),
-	kind: Flag.Literals("kind", SecretKind.literals).pipe(Flag.withDescription("The tool the secret is for")),
+	kind: Flag.Literals("kind", SecretKind.literals).pipe(Flag.withDescription("What the secret is: a gh or claude token a machine places, or a token, any other service's API key")),
 	host: Flag.String("host").pipe(Flag.withDescription("A gh token's host; github.com when left out"), Flag.optional),
 	expiresAt: Flag.String("expires-at").pipe(Flag.withDescription("When the secret expires, any date string; it never does when left out"), Flag.optional)
 }, ({ name, kind, host, expiresAt }) => Effect.gen(function* () {

package/dist/main.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as NeedsSignIn, c as claimsOf, d as ProviderUnavailable, i as Name, o as NotFound, s as UpstreamUnavailable, t as ClientId, u as CurrentPrincipal } from "./shared-DBK2cCkw.mjs";
+import { a as Name, f as CurrentPrincipal, l as UpstreamUnavailable, o as NeedsSignIn, p as ProviderUnavailable, s as NotFound, t as ClientId, u as claimsOf } from "./shared-DyTG-WFI.mjs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { Effect, Option, Predicate, Schema } from "effect";
@@ -11,8 +11,16 @@ import { randomBytes } from "node:crypto";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { YAMLMap, isMap, parseDocument } from "yaml";
 //#region ../../packages/api/src/credentials.ts
-/** The credential an entry was delivered from, as the machine asked for it by name. */
-const fromCredential = { credential: Name };
+/**
+* The credential an entry was delivered from, as it was asked for by name, and when what it
+* carries expires, as ISO: a secret's as the operator entered it, a login's access token's
+* own. Null never expires. A login delivered past it could not be renewed in time, as when its
+* provider is away: sync again later. Whether it needs a new sign-in is the operator's to see.
+*/
+const fromCredential = {
+	credential: Name,
+	expiresAt: Schema.NullOr(Schema.String)
+};
 const GhCredential = Schema.Struct({
 	type: Schema.Literal("gh"),
 	...fromCredential,
@@ -48,6 +56,17 @@ const PiCredential = Schema.Struct({
 	accessToken: Schema.String
 });
 /**
+* A credential no machine places: an API key, or a Grok or Cursor login's access token, for
+* a service such as clankerusage. `kind` is the credential's own, and any string, so a kind
+* newer than the caller's contract still decodes. The client skips one a config names.
+*/
+const TokenCredential = Schema.Struct({
+	type: Schema.Literal("token"),
+	...fromCredential,
+	kind: Schema.String,
+	token: Schema.String
+});
+/**
 * The service sends typed credentials, never file contents or paths, so it cannot write
 * anything on a machine but what the client knows how to place. The cost is that a new
 * tool, or a placement fix, needs a client release, which new machines install. Each entry
@@ -64,7 +83,8 @@ const TypedCredential = Schema.Union([
 	GhCredential,
 	ClaudeCredential,
 	CodexCredential,
-	PiCredential
+	PiCredential,
+	TokenCredential
 ]);
 /** The types this build knows, derived from the union so there is one list. */
 const knownTypes = TypedCredential.members.map((member) => member.fields.type.literal);
@@ -75,39 +95,57 @@ const isKnownType = (type) => knownTypes.some((known) => known === type);
 * schema must not land here, or a broken credential would be placed as an empty one.
 */
 const UnknownCredential = Schema.Struct({ type: Schema.String.check(Schema.makeFilter((type) => !isKnownType(type), { message: "a known credential type must match its schema" })) });
-/** Everything the machine asked for, sent in full on every sync. */
+/** Everything the caller asked for, sent in full on every sync. */
 const Delivery = Schema.Struct({ credentials: Schema.Array(Schema.Union([TypedCredential, UnknownCredential])) });
 //#endregion
 //#region ../../packages/api/src/machine.ts
 /**
+* A credential the calling key may read, without its value. `kind` is any string, so a kind
+* newer than the caller's contract does not fail the whole list.
+*/
+const Grant = Schema.Struct({
+	name: Name,
+	kind: Schema.String
+});
+/**
 * What a machine key can do: read the credentials it is granted, by name, and nothing else.
-* The machine names what it wants; the grants on the server decide whether it may.
+* The caller names what it wants; the grants on the server decide whether it may. A machine
+* is one caller; a service such as clankerusage, holding a key of its own, is another.
 */
-const Machine = [Action.make("sync", {
-	readOnly: false,
-	caller: CurrentPrincipal,
-	description: "Fetch the named credentials as typed entries. Refused whole when the calling key is not granted any one of them.",
-	input: Schema.Struct({
-		clientId: ClientId,
-		credentials: Schema.Array(Name)
+const Machine = [
+	Action.make("sync", {
+		readOnly: false,
+		caller: CurrentPrincipal,
+		description: "Fetch the named credentials as typed entries, each with its expiry; a login near expiry is refreshed first. Refused whole when the calling key is not granted any one of them.",
+		input: Schema.Struct({
+			clientId: ClientId,
+			credentials: Schema.Array(Name)
+		}),
+		success: Delivery,
+		error: NotFound
 	}),
-	success: Delivery,
-	error: NotFound
-}), Action.make("codexLogin", {
-	readOnly: false,
-	caller: CurrentPrincipal,
-	description: "The current login of a ChatGPT credential the calling key is granted, as the codex type carries it, refreshed first when it has expired.",
-	input: Schema.Struct({
-		clientId: ClientId,
-		credential: Name
+	Action.make("codexLogin", {
+		readOnly: false,
+		caller: CurrentPrincipal,
+		description: "The current login of a ChatGPT credential the calling key is granted, as the codex type carries it, refreshed first when it has expired.",
+		input: Schema.Struct({
+			clientId: ClientId,
+			credential: Name
+		}),
+		success: CodexLogin,
+		error: [
+			NotFound,
+			NeedsSignIn,
+			UpstreamUnavailable
+		]
 	}),
-	success: CodexLogin,
-	error: [
-		NotFound,
-		NeedsSignIn,
-		UpstreamUnavailable
-	]
-})];
+	Action.make("listGrants", {
+		readOnly: true,
+		caller: CurrentPrincipal,
+		description: "The names and kinds of the credentials the calling key is granted, so a caller can offer them to pick from. Values are never returned.",
+		success: Schema.Struct({ credentials: Schema.Array(Grant) })
+	})
+];
 /**
 * Codex treats a 401 as permanent and stops retrying; every other failure is transient.
 * The codes are the ones Codex classifies: `refresh_token_invalidated` reads as revoked.
@@ -582,6 +620,9 @@ const placements = {
 		remove: (config) => removePi(config.home)
 	}
 };
+/** What this client places; anything else delivered, a token or a type it does not know, is skipped. */
+const isPlaceable = (credential) => Object.hasOwn(placements, credential.type);
+const placeableTypes = knownTypes.filter((type) => Object.hasOwn(placements, type));
 /** What the delivery carries of one type is placed; a type it does not carry is undone. */
 const settle = (config, identity, known, type) => {
 	const credentials = known.filter((credential) => credential.type === type);
@@ -602,16 +643,17 @@ const slot = (credential) => {
 	}
 };
 /**
-* Two credentials for one slot would leave the machine holding whichever came last, so the
+* Two credentials for one slot would leave the machine holding whichever came last: the
 * whole sync is refused before anything is written.
 */
-const refuseShared = (known) => {
+const oneEach = (placed) => {
 	const claimed = /* @__PURE__ */ new Map();
-	for (const credential of known) {
+	for (const credential of placed) {
 		const other = claimed.get(slot(credential));
 		if (other !== void 0 && other !== credential.credential) throw new Error(`${other} and ${credential.credential} are both ${slot(credential)}; a machine holds one, so config.json must name only one of them`);
 		claimed.set(slot(credential), credential.credential);
 	}
+	return placed;
 };
 /**
 * Idempotent: every credential the config names is fetched and placed every time, and every
@@ -626,15 +668,14 @@ const sync = async (config) => {
 		key: config.key
 	};
 	const delivery = await fetchDelivery(config, identity.clientId);
-	const known = delivery.credentials.filter((credential) => isKnownType(credential.type));
-	refuseShared(known);
+	const known = oneEach(delivery.credentials.filter(isPlaceable));
 	const report = {
 		placed: new Array(),
 		removed: new Array(),
-		skipped: delivery.credentials.flatMap(({ type }) => isKnownType(type) ? [] : [type]),
+		skipped: delivery.credentials.flatMap((credential) => isPlaceable(credential) ? [] : [credential.type]),
 		failed: new Array()
 	};
-	for (const type of knownTypes) try {
+	for (const type of placeableTypes) try {
 		const outcome = settle(config, identity, known, type);
 		if (outcome !== void 0) report[outcome].push(type);
 	} catch (error) {
@@ -684,7 +725,7 @@ const usage = `Usage: clankercreds <command>
 `;
 const runSync = async () => {
 	const report = await sync(loadConfig());
-	for (const type of report.skipped) console.error(`warning: skipped unknown credential type "${type}"; update clankercreds`);
+	for (const type of report.skipped) console.error(`warning: skipped credential type "${type}", which this client does not place; if it is new, update clankercreds`);
 	for (const type of report.placed) console.log(`placed ${type}`);
 	for (const type of report.removed) console.log(`removed ${type}`);
 	for (const { type, message } of report.failed) console.error(`error: ${type}: ${message}`);
@@ -704,7 +745,7 @@ const commandFor = (name) => {
 };
 const main = async () => {
 	if (process.argv[2] === "admin") {
-		(await import("./admin-CXDLXpaH.mjs")).run(process.argv.slice(2));
+		(await import("./admin-BcOFNDUc.mjs")).run(process.argv.slice(2));
 		return;
 	}
 	const command = commandFor(process.argv[2]);

package/dist/{shared-DBK2cCkw.mjs → shared-DyTG-WFI.mjs}

@@ -16,7 +16,7 @@ var ProviderUnavailable = class extends Schema.TaggedError()("ProviderUnavailabl
 Data.TaggedError("InsufficientScope");
 Schema.TaggedError()("ConfigurationError", { message: Schema.String });
 //#endregion
-//#region ../../node_modules/.pnpm/@gjermundgaraba+clankerauth-sdk@0.15.0_@gjermundgaraba+effect-actions@0.11.0_effect@4.0.2__effect@4.0.2/node_modules/@gjermundgaraba/clankerauth-sdk/dist/session.js
+//#region ../../node_modules/.pnpm/@gjermundgaraba+clankerauth-sdk@0.16.0_@gjermundgaraba+effect-actions@0.11.0_effect@4.0.2__effect@4.0.2/node_modules/@gjermundgaraba/clankerauth-sdk/dist/session.js
 /**
 * The identity a browser page needs, without any verification code. This entry point is
 * browser-safe: it declares the identity a protected contract states, the `whoami` contract
@@ -62,9 +62,9 @@ const scopes = {
 var NotFound = class extends Schema.TaggedError()("NotFound", { message: Schema.String }, { httpApiStatus: 404 }) {};
 /** The change collides with what is stored: a taken name, or a credential still in use. */
 var Conflict = class extends Schema.TaggedError()("Conflict", { message: Schema.String }, { httpApiStatus: 409 }) {};
-/** The ChatGPT login is dead, or was never completed. Only a new device sign-in revives it. */
+/** The login is dead, or was never completed. Only a new sign-in revives it. */
 var NeedsSignIn = class extends Schema.TaggedError()("NeedsSignIn", { message: Schema.String }, { httpApiStatus: 409 }) {};
-/** OpenAI could not be reached and no valid token is held. Waiting helps; retrying now does not. */
+/** The provider could not be reached and no valid token is held. Waiting helps; retrying now does not. */
 var UpstreamUnavailable = class extends Schema.TaggedError()("UpstreamUnavailable", { message: Schema.String }, { httpApiStatus: 503 }) {};
 /**
 * Credential names: lowercase labels, because they are typed by hand and are
@@ -72,6 +72,25 @@ var UpstreamUnavailable = class extends Schema.TaggedError()("UpstreamUnavailabl
 * and `github-main` be two credentials.
 */
 const Name = Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/));
+/**
+* What an operator stores a value for: a GitHub token, a Claude token, or `token`, any other
+* service's API key, which a service such as clankerusage reads and no machine places.
+*/
+const SecretKind = Schema.Literals([
+	"gh",
+	"claude",
+	"token"
+]);
+/**
+* What a sign-in creates and the service keeps refreshed. The refresh token never leaves
+* the service; only access tokens are delivered.
+*/
+const LoginKind = Schema.Literals([
+	"chatgpt",
+	"grok",
+	"cursor"
+]);
+Schema.Literals([...SecretKind.literals, ...LoginKind.literals]);
 /** A GitHub host, lowercase: it is written into `gh`'s and git's configuration as is. */
 const Host = Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/), Schema.isMaxLength(253));
 /**
@@ -85,7 +104,7 @@ const Claims = Schema.Struct({
 	"https://api.openai.com/auth": Schema.optionalKey(Schema.Struct({ chatgpt_account_id: Schema.optionalKey(Schema.String) }))
 });
 /**
-* The claims of an OpenAI JWT, unverified: they are read for their timing and their
+* The claims of a JWT, unverified: they are read for their timing, email and, in OpenAI's,
 * account, never trusted for anything. Anything unreadable is simply no claims.
 */
 const claimsOf = (jwt) => {
@@ -105,4 +124,4 @@ const claimsOf = (jwt) => {
 	});
 };
 //#endregion
-export { NeedsSignIn as a, claimsOf as c, ProviderUnavailable as d, Name as i, scopes as l, Conflict as n, NotFound as o, Host as r, UpstreamUnavailable as s, ClientId as t, CurrentPrincipal as u };
+export { Name as a, SecretKind as c, scopes as d, CurrentPrincipal as f, LoginKind as i, UpstreamUnavailable as l, Conflict as n, NeedsSignIn as o, ProviderUnavailable as p, Host as r, NotFound as s, ClientId as t, claimsOf as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankercreds",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "The clankercreds command: a machine client that fetches the credentials its config names and places each where its tool expects it, and the operator's admin commands.",
   "license": "MIT",
   "repository": {
@@ -20,14 +20,15 @@
   },
   "dependencies": {
     "@effect/platform-node": "4.0.2",
+    "@effect/platform-node-shared": "4.0.2",
     "@gjermundgaraba/effect-actions": "0.11.0",
     "effect": "4.0.2",
     "yaml": "2.9.1"
   },
   "devDependencies": {
-    "@clankercreds/api": "0.0.0",
-    "@gjermundgaraba/clankerauth-sdk": "0.15.0",
-    "@types/node": "26.6.4",
+    "@gjermundgaraba/clankerauth-sdk": "0.16.0",
+    "@gjermundgaraba/clankercreds-api": "0.5.0",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",
     "vite-plus": "1.1.0"