@gjermundgaraba/clankercreds 0.4.0 → 0.5.0

package/dist/{admin-DC0cTmmT.mjs → admin-BcOFNDUc.mjs}

@@ -1,4 +1,4 @@
-import { a as LoginKind, c as NotFound, f as scopes, i as Host, l as SecretKind, m as ProviderUnavailable, n as Conflict, o as Name, p as CurrentPrincipal, s as NeedsSignIn, u as UpstreamUnavailable } from "./shared-C56uw1xx.mjs";
+import { a as Name, c as SecretKind, d as scopes, f as CurrentPrincipal, i as LoginKind, l as UpstreamUnavailable, n as Conflict, o as NeedsSignIn, p as ProviderUnavailable, r as Host, s as NotFound } from "./shared-DyTG-WFI.mjs";
 import { Config, Console, Effect, Option, Redacted, Schema } from "effect";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
@@ -138,7 +138,8 @@ const Admin = [
 		input: Schema.Struct({
 			name: Name,
 			kind: SecretKind,
-			value: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(16384)),
+			/** Surrounding whitespace, such as a pasted line ending, is not part of a secret: a value carrying any is refused, never altered. */
+			value: Schema.Trimmed.check(Schema.isMinLength(1), Schema.isMaxLength(16384)),
 			host: Schema.optionalKey(Host),
 			/** Any date string JavaScript parses; a typo is refused, so alerting never loses it. Left out, it does not expire. */
 			expiresAt: Schema.optionalKey(Schema.DateFromString)
@@ -243,7 +244,7 @@ const AdminHttp = ActionHttp.make(Admin, {
 });
 //#endregion
 //#region package.json
-var version = "0.4.0";
+var version = "0.5.0";
 //#endregion
 //#region src/admin.ts
 /** A refusal of this command's own, printed as its message on stderr, exiting 1. */
@@ -294,11 +295,11 @@ const operator = Effect.gen(function* () {
 });
 /**
 * The secret's value, from stdin: a flag would leave it in the process list and the shell's
-* history. Line endings a pipe adds, such as `op read`'s, are not part of it.
+* history. Surrounding whitespace, such as the line ending `op read` adds, is not part of it.
 */
 const valueFromStdin = Effect.gen(function* () {
 	if (process.stdin.isTTY) return yield* refused("Pipe the value in, such as `op read 'op://…' | clankercreds admin put-credential …`; it is never taken from a flag or the terminal.");
-	const value = (yield* Effect.promise(() => text(process.stdin))).replace(/[\r\n]+$/, "");
+	const value = (yield* Effect.promise(() => text(process.stdin))).trim();
 	if (value === "") return yield* refused("The value on stdin is empty.");
 	return value;
 });

package/dist/main.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as NotFound, d as claimsOf, m as ProviderUnavailable, o as Name, p as CurrentPrincipal, r as CredentialKind, s as NeedsSignIn, t as ClientId, u as UpstreamUnavailable } from "./shared-C56uw1xx.mjs";
+import { a as Name, f as CurrentPrincipal, l as UpstreamUnavailable, o as NeedsSignIn, p as ProviderUnavailable, s as NotFound, t as ClientId, u as claimsOf } from "./shared-DyTG-WFI.mjs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { Effect, Option, Predicate, Schema } from "effect";
@@ -57,12 +57,13 @@ const PiCredential = Schema.Struct({
 });
 /**
 * A credential no machine places: an API key, or a Grok or Cursor login's access token, for
-* a service such as clankerusage that knows which provider each name is for. A machine
-* whose config names one refuses the sync.
+* a service such as clankerusage. `kind` is the credential's own, and any string, so a kind
+* newer than the caller's contract still decodes. The client skips one a config names.
 */
 const TokenCredential = Schema.Struct({
 	type: Schema.Literal("token"),
 	...fromCredential,
+	kind: Schema.String,
 	token: Schema.String
 });
 /**
@@ -98,10 +99,13 @@ const UnknownCredential = Schema.Struct({ type: Schema.String.check(Schema.makeF
 const Delivery = Schema.Struct({ credentials: Schema.Array(Schema.Union([TypedCredential, UnknownCredential])) });
 //#endregion
 //#region ../../packages/api/src/machine.ts
-/** A credential the calling key may read, without its value. */
+/**
+* A credential the calling key may read, without its value. `kind` is any string, so a kind
+* newer than the caller's contract does not fail the whole list.
+*/
 const Grant = Schema.Struct({
 	name: Name,
-	kind: CredentialKind
+	kind: Schema.String
 });
 /**
 * What a machine key can do: read the credentials it is granted, by name, and nothing else.
@@ -741,7 +745,7 @@ const commandFor = (name) => {
 };
 const main = async () => {
 	if (process.argv[2] === "admin") {
-		(await import("./admin-DC0cTmmT.mjs")).run(process.argv.slice(2));
+		(await import("./admin-BcOFNDUc.mjs")).run(process.argv.slice(2));
 		return;
 	}
 	const command = commandFor(process.argv[2]);

package/dist/{shared-C56uw1xx.mjs → shared-DyTG-WFI.mjs}

@@ -90,7 +90,7 @@ const LoginKind = Schema.Literals([
 	"grok",
 	"cursor"
 ]);
-const CredentialKind = Schema.Literals([...SecretKind.literals, ...LoginKind.literals]);
+Schema.Literals([...SecretKind.literals, ...LoginKind.literals]);
 /** A GitHub host, lowercase: it is written into `gh`'s and git's configuration as is. */
 const Host = Schema.String.check(Schema.isPattern(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/), Schema.isMaxLength(253));
 /**
@@ -124,4 +124,4 @@ const claimsOf = (jwt) => {
 	});
 };
 //#endregion
-export { LoginKind as a, NotFound as c, claimsOf as d, scopes as f, Host as i, SecretKind as l, ProviderUnavailable as m, Conflict as n, Name as o, CurrentPrincipal as p, CredentialKind as r, NeedsSignIn as s, ClientId as t, UpstreamUnavailable as u };
+export { Name as a, SecretKind as c, scopes as d, CurrentPrincipal as f, LoginKind as i, UpstreamUnavailable as l, Conflict as n, NeedsSignIn as o, ProviderUnavailable as p, Host as r, NotFound as s, ClientId as t, claimsOf as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankercreds",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The clankercreds command: a machine client that fetches the credentials its config names and places each where its tool expects it, and the operator's admin commands.",
   "license": "MIT",
   "repository": {
@@ -27,7 +27,7 @@
   },
   "devDependencies": {
     "@gjermundgaraba/clankerauth-sdk": "0.16.0",
-    "@gjermundgaraba/clankercreds-api": "0.4.0",
+    "@gjermundgaraba/clankercreds-api": "0.5.0",
     "@types/node": "26.6.5",
     "typescript": "7.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@1.1.0",