@holokai/neuron-sdk 0.2.0 → 0.4.0

package/dist/auth.js

@@ -0,0 +1,354 @@
+'use strict';
+
+var fs = require('fs');
+var os = require('os');
+var path = require('path');
+
+// src/logger.ts
+var noopLogger = {
+  debug() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  }
+};
+function defaultCredentialPath() {
+  return path.join(os.homedir(), ".holokai", "neuron-credentials.json");
+}
+function readCredentialFile(path) {
+  let raw;
+  try {
+    raw = fs.readFileSync(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+  const parsed = JSON.parse(raw);
+  if (typeof parsed.client_id !== "string" || typeof parsed.client_secret !== "string" || typeof parsed.token_endpoint !== "string" || typeof parsed.moku_base_url !== "string") {
+    throw new Error(`credential file ${path} is malformed \u2014 expected client_id/client_secret/token_endpoint/moku_base_url`);
+  }
+  return parsed;
+}
+function writeCredentialFile(path$1, credential) {
+  fs.mkdirSync(path.dirname(path$1), { recursive: true, mode: 448 });
+  fs.writeFileSync(path$1, `${JSON.stringify(credential, null, 2)}
+`, { mode: 384 });
+  fs.chmodSync(path$1, 384);
+}
+
+// src/auth/types.ts
+function clientSecretPost(clientId, clientSecret) {
+  return {
+    apply(form) {
+      form.set("client_id", clientId);
+      form.set("client_secret", clientSecret);
+    }
+  };
+}
+var OAuthTokenError = class extends Error {
+  constructor(error, status, description) {
+    super(`token endpoint returned ${error}${description ? `: ${description}` : ""}`);
+    this.error = error;
+    this.status = status;
+    this.name = "OAuthTokenError";
+  }
+};
+var CredentialRevokedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialRevokedError";
+  }
+};
+var EnrollmentError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "EnrollmentError";
+  }
+};
+
+// src/auth/token-client.ts
+async function requestToken(tokenEndpoint, form, fetchImpl) {
+  const res = await fetchImpl(tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: form.toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const error = typeof body["error"] === "string" ? body["error"] : `http_${res.status}`;
+    const description = typeof body["error_description"] === "string" ? body["error_description"] : void 0;
+    throw new OAuthTokenError(error, res.status, description);
+  }
+  if (typeof body["access_token"] !== "string" || typeof body["expires_in"] !== "number") {
+    throw new OAuthTokenError("invalid_response", res.status, "missing access_token/expires_in");
+  }
+  return body;
+}
+
+// src/auth/client-credentials.ts
+var DEFAULT_REFRESH_BUFFER_MS = 6e4;
+function createClientCredentialsAuth(credentialPath, opts = {}) {
+  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  const logger = opts.logger ?? noopLogger;
+  const refreshBufferMs = opts.refreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS;
+  const makeAuthenticator = opts.authenticator ?? ((c) => clientSecretPost(c.client_id, c.client_secret));
+  const now = opts.now ?? Date.now;
+  let credential = null;
+  let cached = null;
+  let inFlight = null;
+  function loadCredential() {
+    const loaded = readCredentialFile(credentialPath);
+    if (!loaded) {
+      throw new CredentialRevokedError(
+        `no credential at ${credentialPath} \u2014 enroll this neuron first (neuron-sdk enroll)`
+      );
+    }
+    return loaded;
+  }
+  async function mintWith(cred) {
+    const form = new URLSearchParams({ grant_type: "client_credentials" });
+    await makeAuthenticator(cred).apply(form);
+    const res = await requestToken(cred.token_endpoint, form, fetchImpl);
+    return { token: res.access_token, expiresIn: res.expires_in };
+  }
+  async function mint() {
+    credential ??= loadCredential();
+    let minted;
+    try {
+      minted = await mintWith(credential);
+    } catch (err) {
+      if (!(err instanceof OAuthTokenError) || err.error !== "invalid_client") throw err;
+      logger.warn(
+        { clientId: credential.client_id },
+        "token mint rejected (invalid_client); re-reading credential file"
+      );
+      const reread = readCredentialFile(credentialPath);
+      const changed = reread && (reread.client_secret !== credential.client_secret || reread.client_id !== credential.client_id);
+      if (!changed) {
+        throw new CredentialRevokedError(
+          `Moku rejected client ${credential.client_id} (invalid_client) and the credential file is unchanged \u2014 the credential was revoked or rotated server-side; re-enroll this neuron`
+        );
+      }
+      credential = reread;
+      try {
+        minted = await mintWith(credential);
+      } catch (retryErr) {
+        if (retryErr instanceof OAuthTokenError && retryErr.error === "invalid_client") {
+          throw new CredentialRevokedError(
+            `Moku rejected client ${credential.client_id} (invalid_client) after credential re-read \u2014 re-enroll this neuron`
+          );
+        }
+        throw retryErr;
+      }
+    }
+    const lifetimeMs = minted.expiresIn * 1e3;
+    const refreshAtMs = now() + Math.max(lifetimeMs - refreshBufferMs, lifetimeMs / 2);
+    cached = { token: minted.token, refreshAtMs };
+    logger.debug(
+      { clientId: credential.client_id, expiresInSeconds: minted.expiresIn },
+      "minted bigbrain access token"
+    );
+    return minted.token;
+  }
+  return async function auth() {
+    if (cached && now() < cached.refreshAtMs) return cached.token;
+    inFlight ??= mint().finally(() => {
+      inFlight = null;
+    });
+    return inFlight;
+  };
+}
+
+// src/auth/discovery.ts
+var DEFAULT_TOKEN_PATH = "/api/v1/auth/token";
+var DEFAULT_DEVICE_AUTHORIZATION_PATH = "/api/v1/auth/device";
+var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+async function discoverEndpoints(mokuBaseUrl, opts = {}) {
+  const base = mokuBaseUrl.replace(/\/+$/, "");
+  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  const logger = opts.logger ?? noopLogger;
+  const fallback = {
+    tokenEndpoint: `${base}${DEFAULT_TOKEN_PATH}`,
+    deviceAuthorizationEndpoint: `${base}${DEFAULT_DEVICE_AUTHORIZATION_PATH}`
+  };
+  let res;
+  try {
+    res = await fetchImpl(`${base}${DISCOVERY_PATH}`, {
+      headers: { Accept: "application/json" }
+    });
+  } catch (err) {
+    logger.warn(
+      { err: err.message },
+      "OAuth discovery unreachable; using default endpoint paths"
+    );
+    return fallback;
+  }
+  if (!res.ok) {
+    logger.warn(
+      { status: res.status },
+      "OAuth discovery not served; using default endpoint paths"
+    );
+    return fallback;
+  }
+  try {
+    const doc = await res.json();
+    const token = doc["token_endpoint"];
+    const device = doc["device_authorization_endpoint"];
+    if (typeof token !== "string" || typeof device !== "string") {
+      logger.warn({}, "OAuth discovery document incomplete; using default endpoint paths");
+      return fallback;
+    }
+    return {
+      tokenEndpoint: reRoot(token, base),
+      deviceAuthorizationEndpoint: reRoot(device, base)
+    };
+  } catch {
+    logger.warn({}, "OAuth discovery document malformed; using default endpoint paths");
+    return fallback;
+  }
+}
+function reRoot(servedUrl, base) {
+  try {
+    const parsed = new URL(servedUrl);
+    return `${base}${parsed.pathname}`;
+  } catch {
+    return `${base}${servedUrl.startsWith("/") ? "" : "/"}${servedUrl}`;
+  }
+}
+var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+async function enroll(opts) {
+  const credentialPath = opts.credentialPath ?? defaultCredentialPath();
+  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  const logger = opts.logger ?? noopLogger;
+  const out = opts.out ?? ((line) => console.log(line));
+  const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const existing = readCredentialFile(credentialPath);
+  if (existing) {
+    try {
+      await createClientCredentialsAuth(credentialPath, { fetch: fetchImpl, logger })();
+      out(`Already enrolled as client ${existing.client_id} (credential: ${credentialPath}).`);
+      return { status: "already-enrolled", clientId: existing.client_id, credentialPath };
+    } catch (err) {
+      if (!(err instanceof CredentialRevokedError)) throw err;
+      logger.warn(
+        { clientId: existing.client_id },
+        "existing credential no longer mints; starting fresh enrollment"
+      );
+    }
+  }
+  const endpoints = await discoverEndpoints(opts.mokuBaseUrl, { fetch: fetchImpl, logger });
+  const deviceForm = new URLSearchParams({ client_name: opts.clientName });
+  deviceForm.set("hostname", opts.hostname ?? os.hostname());
+  if (opts.capabilityTypes?.length) {
+    deviceForm.set("capability_types", opts.capabilityTypes.join(","));
+  }
+  const deviceRes = await fetchImpl(endpoints.deviceAuthorizationEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: deviceForm.toString()
+  });
+  if (!deviceRes.ok) {
+    const text = await deviceRes.text().catch(() => "");
+    throw new EnrollmentError(
+      `device authorization request failed: ${deviceRes.status}${text ? ` \u2014 ${text}` : ""}`,
+      "device_request_failed"
+    );
+  }
+  const device = await deviceRes.json();
+  if (!device.device_code || !device.user_code || !device.verification_uri) {
+    throw new EnrollmentError("device authorization response incomplete", "invalid_response");
+  }
+  out("To authorize this neuron, an org admin must visit:");
+  out(`  ${device.verification_uri_complete ?? device.verification_uri}`);
+  out(`and enter code: ${device.user_code}`);
+  out(`Waiting for approval (expires in ${Math.round(device.expires_in / 60)} min)\u2026`);
+  let intervalMs = (device.interval ?? 5) * 1e3;
+  const deadline = Date.now() + device.expires_in * 1e3;
+  for (; ; ) {
+    if (Date.now() >= deadline) {
+      throw new EnrollmentError("enrollment request expired before approval", "expired_token");
+    }
+    await sleep(intervalMs);
+    const pollForm = new URLSearchParams({
+      grant_type: DEVICE_CODE_GRANT,
+      device_code: device.device_code
+    });
+    let token;
+    try {
+      token = await requestToken(endpoints.tokenEndpoint, pollForm, fetchImpl);
+    } catch (err) {
+      if (err instanceof OAuthTokenError) {
+        switch (err.error) {
+          case "authorization_pending":
+            continue;
+          case "slow_down":
+            intervalMs += 5e3;
+            continue;
+          case "expired_token":
+            throw new EnrollmentError("enrollment request expired before approval", "expired_token");
+          case "access_denied":
+            throw new EnrollmentError("enrollment was denied by the admin", "access_denied");
+        }
+        if (err.status === 409 || err.status >= 500) {
+          logger.warn(
+            { error: err.error, status: err.status },
+            "transient token-endpoint error while polling; will retry"
+          );
+          continue;
+        }
+      }
+      if (!(err instanceof OAuthTokenError) && !(err instanceof EnrollmentError)) {
+        logger.warn(
+          { err: err.message },
+          "token endpoint unreachable while polling; will retry"
+        );
+        continue;
+      }
+      throw err;
+    }
+    if (!token.client_id || !token.client_secret) {
+      throw new EnrollmentError(
+        "redemption response did not include a client credential",
+        "invalid_response"
+      );
+    }
+    const credential = {
+      client_id: token.client_id,
+      client_secret: token.client_secret,
+      token_endpoint: endpoints.tokenEndpoint,
+      moku_base_url: opts.mokuBaseUrl.replace(/\/+$/, "")
+    };
+    writeCredentialFile(credentialPath, credential);
+    out(`Enrolled as client ${credential.client_id}. Credential written to ${credentialPath}.`);
+    return {
+      status: "enrolled",
+      clientId: credential.client_id,
+      credentialPath,
+      accessToken: token.access_token,
+      expiresIn: token.expires_in
+    };
+  }
+}
+
+exports.CredentialRevokedError = CredentialRevokedError;
+exports.EnrollmentError = EnrollmentError;
+exports.OAuthTokenError = OAuthTokenError;
+exports.clientSecretPost = clientSecretPost;
+exports.createClientCredentialsAuth = createClientCredentialsAuth;
+exports.defaultCredentialPath = defaultCredentialPath;
+exports.discoverEndpoints = discoverEndpoints;
+exports.enroll = enroll;
+exports.readCredentialFile = readCredentialFile;
+exports.writeCredentialFile = writeCredentialFile;
+//# sourceMappingURL=auth.js.map
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/logger.ts","../src/auth/credential-file.ts","../src/auth/types.ts","../src/auth/token-client.ts","../src/auth/client-credentials.ts","../src/auth/discovery.ts","../src/auth/enrollment.ts"],"names":["join","homedir","readFileSync","path","mkdirSync","dirname","writeFileSync","chmodSync","osHostname"],"mappings":";;;;;;;AAMO,IAAM,UAAA,GAA2B;AAAA,EACtC,KAAA,GAAQ;AAAA,EAAC,CAAA;AAAA,EACT,IAAA,GAAO;AAAA,EAAC,CAAA;AAAA,EACR,IAAA,GAAO;AAAA,EAAC,CAAA;AAAA,EACR,KAAA,GAAQ;AAAA,EAAC;AACX,CAAA;ACJO,SAAS,qBAAA,GAAgC;AAC9C,EAAA,OAAOA,SAAA,CAAKC,UAAA,EAAQ,EAAG,UAAA,EAAY,yBAAyB,CAAA;AAC9D;AAOO,SAAS,mBAAmB,IAAA,EAAuC;AACxE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAMC,eAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EACjC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,IAAA;AAC7D,IAAA,MAAM,GAAA;AAAA,EACR;AACA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,EAAA,IACE,OAAO,MAAA,CAAO,SAAA,KAAc,QAAA,IAC5B,OAAO,MAAA,CAAO,aAAA,KAAkB,QAAA,IAChC,OAAO,OAAO,cAAA,KAAmB,QAAA,IACjC,OAAO,MAAA,CAAO,kBAAkB,QAAA,EAChC;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,IAAI,CAAA,kFAAA,CAA+E,CAAA;AAAA,EACxH;AACA,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,mBAAA,CAAoBC,QAAc,UAAA,EAAoC;AACpF,EAAAC,YAAA,CAAUC,YAAA,CAAQF,MAAI,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AACzD,EAAAG,gBAAA,CAAcH,QAAM,CAAA,EAAG,IAAA,CAAK,UAAU,UAAA,EAAY,IAAA,EAAM,CAAC,CAAC;AAAA,CAAA,EAAM,EAAE,IAAA,EAAM,GAAA,EAAO,CAAA;AAE/E,EAAAI,YAAA,CAAUJ,QAAM,GAAK,CAAA;AACvB;;;ACNO,SAAS,gBAAA,CAAiB,UAAkB,YAAA,EAA2C;AAC5F,EAAA,OAAO;AAAA,IACL,MAAM,IAAA,EAA6B;AACjC,MAAA,IAAA,CAAK,GAAA,CAAI,aAAa,QAAQ,CAAA;AAC9B,MAAA,IAAA,CAAK,GAAA,CAAI,iBAAiB,YAAY,CAAA;AAAA,IACxC;AAAA,GACF;AACF;AAcO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EACzC,WAAA,CACkB,KAAA,EACA,MAAA,EAChB,WAAA,EACA;AACA,IAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAK,CAAA,EAAG,WAAA,GAAc,KAAK,WAAW,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAJhE,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AACA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;AAQO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAChD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AAAA,EACd;AACF;AAGO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EACzC,WAAA,CACE,SACgB,IAAA,EAKhB;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AANG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAOhB,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AACF;;;ACvFA,eAAsB,YAAA,CACpB,aAAA,EACA,IAAA,EACA,SAAA,EACwB;AACxB,EAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,aAAA,EAAe;AAAA,IACzC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,mCAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACV;AAAA,IACA,IAAA,EAAM,KAAK,QAAA;AAAS,GACrB,CAAA;AAED,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,GAAO,KAAA,CAAM,OAAO,EAAC,CAAE,CAAA;AAE/C,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,CAAK,OAAO,CAAA,KAAM,QAAA,GAAW,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,CAAA,CAAA;AACpF,IAAA,MAAM,WAAA,GACJ,OAAO,IAAA,CAAK,mBAAmB,MAAM,QAAA,GAAW,IAAA,CAAK,mBAAmB,CAAA,GAAI,MAAA;AAC9E,IAAA,MAAM,IAAI,eAAA,CAAgB,KAAA,EAAO,GAAA,CAAI,QAAQ,WAAW,CAAA;AAAA,EAC1D;AAEA,EAAA,IAAI,OAAO,KAAK,cAAc,CAAA,KAAM,YAAY,OAAO,IAAA,CAAK,YAAY,CAAA,KAAM,QAAA,EAAU;AACtF,IAAA,MAAM,IAAI,eAAA,CAAgB,kBAAA,EAAoB,GAAA,CAAI,QAAQ,iCAAiC,CAAA;AAAA,EAC7F;AACA,EAAA,OAAO,IAAA;AACT;;;ACFA,IAAM,yBAAA,GAA4B,GAAA;AAkB3B,SAAS,2BAAA,CACd,cAAA,EACA,IAAA,GAAqC,EAAC,EACxB;AACd,EAAA,MAAM,YAAY,IAAA,CAAK,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,UAAA;AAC9B,EAAA,MAAM,eAAA,GAAkB,KAAK,eAAA,IAAmB,yBAAA;AAChD,EAAA,MAAM,iBAAA,GACJ,KAAK,aAAA,KAAkB,CAAC,MAAwB,gBAAA,CAAiB,CAAA,CAAE,SAAA,EAAW,CAAA,CAAE,aAAa,CAAA,CAAA;AAC/F,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,IAAO,IAAA,CAAK,GAAA;AAE7B,EAAA,IAAI,UAAA,GAAsC,IAAA;AAC1C,EAAA,IAAI,MAAA,GAAwD,IAAA;AAC5D,EAAA,IAAI,QAAA,GAAmC,IAAA;AAEvC,EAAA,SAAS,cAAA,GAAmC;AAC1C,IAAA,MAAM,MAAA,GAAS,mBAAmB,cAAc,CAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,sBAAA;AAAA,QACR,oBAAoB,cAAc,CAAA,oDAAA;AAAA,OACpC;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,eAAe,SAAS,IAAA,EAAuE;AAC7F,IAAA,MAAM,OAAO,IAAI,eAAA,CAAgB,EAAE,UAAA,EAAY,sBAAsB,CAAA;AACrE,IAAA,MAAM,iBAAA,CAAkB,IAAI,CAAA,CAAE,KAAA,CAAM,IAAI,CAAA;AACxC,IAAA,MAAM,MAAM,MAAM,YAAA,CAAa,IAAA,CAAK,cAAA,EAAgB,MAAM,SAAS,CAAA;AACnE,IAAA,OAAO,EAAE,KAAA,EAAO,GAAA,CAAI,YAAA,EAAc,SAAA,EAAW,IAAI,UAAA,EAAW;AAAA,EAC9D;AAEA,EAAA,eAAe,IAAA,GAAwB;AACrC,IAAA,UAAA,KAAe,cAAA,EAAe;AAC9B,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,SAAS,UAAU,CAAA;AAAA,IACpC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,EAAE,GAAA,YAAe,eAAA,CAAA,IAAoB,GAAA,CAAI,KAAA,KAAU,kBAAkB,MAAM,GAAA;AAG/E,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,EAAE,QAAA,EAAU,UAAA,CAAW,SAAA,EAAU;AAAA,QACjC;AAAA,OACF;AACA,MAAA,MAAM,MAAA,GAAS,mBAAmB,cAAc,CAAA;AAChD,MAAA,MAAM,OAAA,GACJ,WACC,MAAA,CAAO,aAAA,KAAkB,WAAW,aAAA,IACnC,MAAA,CAAO,cAAc,UAAA,CAAW,SAAA,CAAA;AACpC,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAI,sBAAA;AAAA,UACR,CAAA,qBAAA,EAAwB,WAAW,SAAS,CAAA,sIAAA;AAAA,SAC9C;AAAA,MACF;AACA,MAAA,UAAA,GAAa,MAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,SAAS,UAAU,CAAA;AAAA,MACpC,SAAS,QAAA,EAAU;AACjB,QAAA,IAAI,QAAA,YAAoB,eAAA,IAAmB,QAAA,CAAS,KAAA,KAAU,gBAAA,EAAkB;AAC9E,UAAA,MAAM,IAAI,sBAAA;AAAA,YACR,CAAA,qBAAA,EAAwB,WAAW,SAAS,CAAA,uEAAA;AAAA,WAC9C;AAAA,QACF;AACA,QAAA,MAAM,QAAA;AAAA,MACR;AAAA,IACF;AAIA,IAAA,MAAM,UAAA,GAAa,OAAO,SAAA,GAAY,GAAA;AACtC,IAAA,MAAM,WAAA,GAAc,KAAI,GAAI,IAAA,CAAK,IAAI,UAAA,GAAa,eAAA,EAAiB,aAAa,CAAC,CAAA;AACjF,IAAA,MAAA,GAAS,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,WAAA,EAAY;AAC5C,IAAA,MAAA,CAAO,KAAA;AAAA,MACL,EAAE,QAAA,EAAU,UAAA,CAAW,SAAA,EAAW,gBAAA,EAAkB,OAAO,SAAA,EAAU;AAAA,MACrE;AAAA,KACF;AACA,IAAA,OAAO,MAAA,CAAO,KAAA;AAAA,EAChB;AAEA,EAAA,OAAO,eAAe,IAAA,GAAwB;AAC5C,IAAA,IAAI,UAAU,GAAA,EAAI,GAAI,MAAA,CAAO,WAAA,SAAoB,MAAA,CAAO,KAAA;AACxD,IAAA,QAAA,KAAa,IAAA,EAAK,CAAE,OAAA,CAAQ,MAAM;AAChC,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAC,CAAA;AACD,IAAA,OAAO,QAAA;AAAA,EACT,CAAA;AACF;;;AC9HO,IAAM,kBAAA,GAAqB,oBAAA;AAC3B,IAAM,iCAAA,GAAoC,qBAAA;AAEjD,IAAM,cAAA,GAAiB,yCAAA;AAavB,eAAsB,iBAAA,CACpB,WAAA,EACA,IAAA,GAAwD,EAAC,EAChC;AACzB,EAAA,MAAM,IAAA,GAAO,WAAA,CAAY,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC3C,EAAA,MAAM,YAAY,IAAA,CAAK,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,UAAA;AAE9B,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,aAAA,EAAe,CAAA,EAAG,IAAI,CAAA,EAAG,kBAAkB,CAAA,CAAA;AAAA,IAC3C,2BAAA,EAA6B,CAAA,EAAG,IAAI,CAAA,EAAG,iCAAiC,CAAA;AAAA,GAC1E;AAEA,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAM,SAAA,CAAU,CAAA,EAAG,IAAI,CAAA,EAAG,cAAc,CAAA,CAAA,EAAI;AAAA,MAChD,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA;AAAmB,KACvC,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,EAAE,GAAA,EAAM,GAAA,CAAc,OAAA,EAAQ;AAAA,MAC9B;AAAA,KACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAA,CAAO,IAAA;AAAA,MACL,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAO;AAAA,MACrB;AAAA,KACF;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,KAAA,GAAQ,IAAI,gBAAgB,CAAA;AAClC,IAAA,MAAM,MAAA,GAAS,IAAI,+BAA+B,CAAA;AAClD,IAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,WAAW,QAAA,EAAU;AAC3D,MAAA,MAAA,CAAO,IAAA,CAAK,EAAC,EAAG,mEAAmE,CAAA;AACnF,MAAA,OAAO,QAAA;AAAA,IACT;AACA,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,MAAA,CAAO,KAAA,EAAO,IAAI,CAAA;AAAA,MACjC,2BAAA,EAA6B,MAAA,CAAO,MAAA,EAAQ,IAAI;AAAA,KAClD;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,MAAA,CAAO,IAAA,CAAK,EAAC,EAAG,kEAAkE,CAAA;AAClF,IAAA,OAAO,QAAA;AAAA,EACT;AACF;AAEA,SAAS,MAAA,CAAO,WAAmB,IAAA,EAAsB;AACvD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,SAAS,CAAA;AAChC,IAAA,OAAO,CAAA,EAAG,IAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAA,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,CAAA,EAAG,IAAI,CAAA,EAAG,SAAA,CAAU,UAAA,CAAW,GAAG,CAAA,GAAI,EAAA,GAAK,GAAG,CAAA,EAAG,SAAS,CAAA,CAAA;AAAA,EACnE;AACF;ACvEA,IAAM,iBAAA,GAAoB,8CAAA;AAwD1B,eAAsB,OAAO,IAAA,EAA4C;AACvE,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,qBAAA,EAAsB;AACpE,EAAA,MAAM,YAAY,IAAA,CAAK,KAAA,IAAS,UAAA,CAAW,KAAA,CAAM,KAAK,UAAU,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,UAAA;AAC9B,EAAA,MAAM,MAAM,IAAA,CAAK,GAAA,KAAQ,CAAC,IAAA,KAAiB,OAAA,CAAQ,IAAI,IAAI,CAAA,CAAA;AAC3D,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,KAAU,CAAC,EAAA,KAAe,IAAI,OAAA,CAAc,CAAC,CAAA,KAAM,UAAA,CAAW,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AAEvF,EAAA,MAAM,QAAA,GAAW,mBAAmB,cAAc,CAAA;AAClD,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,IAAI;AACF,MAAA,MAAM,4BAA4B,cAAA,EAAgB,EAAE,OAAO,SAAA,EAAW,MAAA,EAAQ,CAAA,EAAE;AAChF,MAAA,GAAA,CAAI,CAAA,2BAAA,EAA8B,QAAA,CAAS,SAAS,CAAA,cAAA,EAAiB,cAAc,CAAA,EAAA,CAAI,CAAA;AACvF,MAAA,OAAO,EAAE,MAAA,EAAQ,kBAAA,EAAoB,QAAA,EAAU,QAAA,CAAS,WAAW,cAAA,EAAe;AAAA,IACpF,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,EAAE,GAAA,YAAe,sBAAA,CAAA,EAAyB,MAAM,GAAA;AACpD,MAAA,MAAA,CAAO,IAAA;AAAA,QACL,EAAE,QAAA,EAAU,QAAA,CAAS,SAAA,EAAU;AAAA,QAC/B;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,GAAY,MAAM,iBAAA,CAAkB,IAAA,CAAK,aAAa,EAAE,KAAA,EAAO,SAAA,EAAW,MAAA,EAAQ,CAAA;AAExF,EAAA,MAAM,aAAa,IAAI,eAAA,CAAgB,EAAE,WAAA,EAAa,IAAA,CAAK,YAAY,CAAA;AACvE,EAAA,UAAA,CAAW,GAAA,CAAI,UAAA,EAAY,IAAA,CAAK,QAAA,IAAYK,aAAY,CAAA;AACxD,EAAA,IAAI,IAAA,CAAK,iBAAiB,MAAA,EAAQ;AAChC,IAAA,UAAA,CAAW,IAAI,kBAAA,EAAoB,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,CAAU,SAAA,CAAU,2BAAA,EAA6B;AAAA,IACvE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,mCAAA;AAAA,MAChB,MAAA,EAAQ;AAAA,KACV;AAAA,IACA,IAAA,EAAM,WAAW,QAAA;AAAS,GAC3B,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,OAAO,MAAM,SAAA,CAAU,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAClD,IAAA,MAAM,IAAI,eAAA;AAAA,MACR,CAAA,qCAAA,EAAwC,UAAU,MAAM,CAAA,EAAG,OAAO,CAAA,QAAA,EAAM,IAAI,KAAK,EAAE,CAAA,CAAA;AAAA,MACnF;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAU,MAAM,SAAA,CAAU,IAAA,EAAK;AACrC,EAAA,IAAI,CAAC,OAAO,WAAA,IAAe,CAAC,OAAO,SAAA,IAAa,CAAC,OAAO,gBAAA,EAAkB;AACxE,IAAA,MAAM,IAAI,eAAA,CAAgB,0CAAA,EAA4C,kBAAkB,CAAA;AAAA,EAC1F;AAEA,EAAA,GAAA,CAAI,oDAAoD,CAAA;AACxD,EAAA,GAAA,CAAI,CAAA,EAAA,EAAK,MAAA,CAAO,yBAAA,IAA6B,MAAA,CAAO,gBAAgB,CAAA,CAAE,CAAA;AACtE,EAAA,GAAA,CAAI,CAAA,gBAAA,EAAmB,MAAA,CAAO,SAAS,CAAA,CAAE,CAAA;AACzC,EAAA,GAAA,CAAI,oCAAoC,IAAA,CAAK,KAAA,CAAM,OAAO,UAAA,GAAa,EAAE,CAAC,CAAA,WAAA,CAAQ,CAAA;AAElF,EAAA,IAAI,UAAA,GAAA,CAAc,MAAA,CAAO,QAAA,IAAY,CAAA,IAAK,GAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,UAAA,GAAa,GAAA;AAElD,EAAA,WAAS;AACP,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,QAAA,EAAU;AAC1B,MAAA,MAAM,IAAI,eAAA,CAAgB,4CAAA,EAA8C,eAAe,CAAA;AAAA,IACzF;AACA,IAAA,MAAM,MAAM,UAAU,CAAA;AAEtB,IAAA,MAAM,QAAA,GAAW,IAAI,eAAA,CAAgB;AAAA,MACnC,UAAA,EAAY,iBAAA;AAAA,MACZ,aAAa,MAAA,CAAO;AAAA,KACrB,CAAA;AACD,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,MAAM,YAAA,CAAa,SAAA,CAAU,aAAA,EAAe,UAAU,SAAS,CAAA;AAAA,IACzE,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,eAAA,EAAiB;AAClC,QAAA,QAAQ,IAAI,KAAA;AAAO,UACjB,KAAK,uBAAA;AACH,YAAA;AAAA,UACF,KAAK,WAAA;AACH,YAAA,UAAA,IAAc,GAAA;AACd,YAAA;AAAA,UACF,KAAK,eAAA;AACH,YAAA,MAAM,IAAI,eAAA,CAAgB,4CAAA,EAA8C,eAAe,CAAA;AAAA,UACzF,KAAK,eAAA;AACH,YAAA,MAAM,IAAI,eAAA,CAAgB,oCAAA,EAAsC,eAAe,CAAA;AAAA;AAMnF,QAAA,IAAI,GAAA,CAAI,MAAA,KAAW,GAAA,IAAO,GAAA,CAAI,UAAU,GAAA,EAAK;AAC3C,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,EAAE,KAAA,EAAO,GAAA,CAAI,KAAA,EAAO,MAAA,EAAQ,IAAI,MAAA,EAAO;AAAA,YACvC;AAAA,WACF;AACA,UAAA;AAAA,QACF;AAAA,MACF;AAEA,MAAA,IAAI,EAAE,GAAA,YAAe,eAAA,CAAA,IAAoB,EAAE,eAAe,eAAA,CAAA,EAAkB;AAC1E,QAAA,MAAA,CAAO,IAAA;AAAA,UACL,EAAE,GAAA,EAAM,GAAA,CAAc,OAAA,EAAQ;AAAA,UAC9B;AAAA,SACF;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AAGA,IAAA,IAAI,CAAC,KAAA,CAAM,SAAA,IAAa,CAAC,MAAM,aAAA,EAAe;AAC5C,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,yDAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAA+B;AAAA,MACnC,WAAW,KAAA,CAAM,SAAA;AAAA,MACjB,eAAe,KAAA,CAAM,aAAA;AAAA,MACrB,gBAAgB,SAAA,CAAU,aAAA;AAAA,MAC1B,aAAA,EAAe,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,QAAQ,EAAE;AAAA,KACpD;AACA,IAAA,mBAAA,CAAoB,gBAAgB,UAAU,CAAA;AAC9C,IAAA,GAAA,CAAI,CAAA,mBAAA,EAAsB,UAAA,CAAW,SAAS,CAAA,wBAAA,EAA2B,cAAc,CAAA,CAAA,CAAG,CAAA;AAC1F,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,UAAA;AAAA,MACR,UAAU,UAAA,CAAW,SAAA;AAAA,MACrB,cAAA;AAAA,MACA,aAAa,KAAA,CAAM,YAAA;AAAA,MACnB,WAAW,KAAA,CAAM;AAAA,KACnB;AAAA,EACF;AACF","file":"auth.js","sourcesContent":["import type { NeuronLogger } from './types.js';\n\n/**\n * Silent logger used as a default when no consumer provides one. Single\n * shared instance to avoid each module defining its own copy.\n */\nexport const noopLogger: NeuronLogger = {\n  debug() {},\n  info() {},\n  warn() {},\n  error() {},\n};\n","import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\n\nimport type { StoredCredential } from './types.js';\n\n/** `~/.holokai/neuron-credentials.json` unless the caller overrides. */\nexport function defaultCredentialPath(): string {\n  return join(homedir(), '.holokai', 'neuron-credentials.json');\n}\n\n/**\n * Read a stored credential. Returns null when the file does not exist\n * (unenrolled); throws on a present-but-malformed file, which is an\n * operator problem the caller must not paper over.\n */\nexport function readCredentialFile(path: string): StoredCredential | null {\n  let raw: string;\n  try {\n    raw = readFileSync(path, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;\n    throw err;\n  }\n  const parsed = JSON.parse(raw) as Partial<StoredCredential>;\n  if (\n    typeof parsed.client_id !== 'string' ||\n    typeof parsed.client_secret !== 'string' ||\n    typeof parsed.token_endpoint !== 'string' ||\n    typeof parsed.moku_base_url !== 'string'\n  ) {\n    throw new Error(`credential file ${path} is malformed — expected client_id/client_secret/token_endpoint/moku_base_url`);\n  }\n  return parsed as StoredCredential;\n}\n\n/** Write the credential with owner-only permissions (0700 dir, 0600 file). */\nexport function writeCredentialFile(path: string, credential: StoredCredential): void {\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n  writeFileSync(path, `${JSON.stringify(credential, null, 2)}\\n`, { mode: 0o600 });\n  // writeFileSync's mode only applies on creation; enforce on overwrite too.\n  chmodSync(path, 0o600);\n}\n","/**\n * OAuth endpoint set resolved from RFC 8414 discovery (or the fixed\n * fallback paths when discovery is unreachable — see `discovery.ts`).\n */\nexport interface OAuthEndpoints {\n  tokenEndpoint: string;\n  deviceAuthorizationEndpoint: string;\n}\n\n/**\n * The durable artifact on a neuron host: a revocable Moku OAuth client\n * credential (never a bearer JWT). Field names mirror the wire/JSON\n * shape so the file is greppable against Moku's own vocabulary.\n */\nexport interface StoredCredential {\n  client_id: string;\n  client_secret: string;\n  token_endpoint: string;\n  moku_base_url: string;\n}\n\n/**\n * How the client proves its identity to Moku's token endpoint.\n *\n * v1 ships `client_secret_post` only (matching Moku's discovery doc).\n * The interface exists so `private_key_jwt` (RFC 7523, HOL-2543) can\n * slot in later without touching `createClientCredentialsAuth` callers:\n * a keypair-backed implementation would append a signed\n * `client_assertion` instead of a shared secret.\n */\nexport interface ClientAuthenticator {\n  /** Apply client authentication to the token-endpoint form body. */\n  apply(form: URLSearchParams): void | Promise<void>;\n}\n\n/** RFC 6749 §2.3.1-style shared-secret client auth, in the body. */\nexport function clientSecretPost(clientId: string, clientSecret: string): ClientAuthenticator {\n  return {\n    apply(form: URLSearchParams): void {\n      form.set('client_id', clientId);\n      form.set('client_secret', clientSecret);\n    },\n  };\n}\n\n/** Successful token-endpoint response (RFC 6749 §5.1). On device-flow\n *  redemption Moku additionally delivers the client credential — once. */\nexport interface TokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  scope?: string;\n  client_id?: string;\n  client_secret?: string;\n}\n\n/** Token-endpoint error (`{error, error_description}`, RFC 6749 §5.2). */\nexport class OAuthTokenError extends Error {\n  constructor(\n    public readonly error: string,\n    public readonly status: number,\n    description?: string,\n  ) {\n    super(`token endpoint returned ${error}${description ? `: ${description}` : ''}`);\n    this.name = 'OAuthTokenError';\n  }\n}\n\n/**\n * Terminal auth failure: the stored credential no longer mints (revoked,\n * deleted, or rotated away underneath us) or does not exist. The neuron\n * must be re-enrolled; retrying against Moku is pointless and the SDK\n * will not loop on it.\n */\nexport class CredentialRevokedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'CredentialRevokedError';\n  }\n}\n\n/** Enrollment (device flow) failed terminally. */\nexport class EnrollmentError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | 'expired_token'\n      | 'access_denied'\n      | 'invalid_response'\n      | 'device_request_failed',\n  ) {\n    super(message);\n    this.name = 'EnrollmentError';\n  }\n}\n","import { OAuthTokenError, type TokenResponse } from './types.js';\n\n/**\n * POST a form to an OAuth token endpoint and parse the RFC 6749 response.\n * All Moku token-endpoint interactions are form-urlencoded (never JSON);\n * errors come back as `{error, error_description}`.\n */\nexport async function requestToken(\n  tokenEndpoint: string,\n  form: URLSearchParams,\n  fetchImpl: typeof fetch,\n): Promise<TokenResponse> {\n  const res = await fetchImpl(tokenEndpoint, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      Accept: 'application/json',\n    },\n    body: form.toString(),\n  });\n\n  const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;\n\n  if (!res.ok) {\n    const error = typeof body['error'] === 'string' ? body['error'] : `http_${res.status}`;\n    const description =\n      typeof body['error_description'] === 'string' ? body['error_description'] : undefined;\n    throw new OAuthTokenError(error, res.status, description);\n  }\n\n  if (typeof body['access_token'] !== 'string' || typeof body['expires_in'] !== 'number') {\n    throw new OAuthTokenError('invalid_response', res.status, 'missing access_token/expires_in');\n  }\n  return body as unknown as TokenResponse;\n}\n","import { noopLogger } from '../logger.js';\nimport type { AuthCallback, NeuronLogger } from '../types.js';\n\nimport { readCredentialFile } from './credential-file.js';\nimport { requestToken } from './token-client.js';\nimport {\n  clientSecretPost,\n  CredentialRevokedError,\n  OAuthTokenError,\n  type ClientAuthenticator,\n  type StoredCredential,\n} from './types.js';\n\nexport interface ClientCredentialsAuthOptions {\n  fetch?: typeof fetch;\n  logger?: NeuronLogger;\n  /**\n   * Refresh this long before the token's `expires_in` elapses. The\n   * response's `expires_in` is authoritative (Moku default is 15 min,\n   * per-audience cap 1h) — never assume a lifetime.\n   */\n  refreshBufferMs?: number;\n  /**\n   * Client-auth method factory. Defaults to `client_secret_post` from the\n   * stored credential; a `private_key_jwt` implementation (HOL-2543) can\n   * be injected here without changing any other consumer code.\n   */\n  authenticator?: (credential: StoredCredential) => ClientAuthenticator;\n  /** Clock override for tests. */\n  now?: () => number;\n}\n\nconst DEFAULT_REFRESH_BUFFER_MS = 60_000;\n\n/**\n * Steady-state auth for enrolled (headless/enterprise) neurons: returns an\n * `auth()` callback for `HttpTransport` that mints short-lived\n * `aud=bigbrain` access tokens from Moku via the OAuth2 `client_credentials`\n * grant, using the credential file written by `enroll`.\n *\n * Behavior:\n * - In-memory cache driven by the response's `expires_in`, with proactive\n *   refresh `refreshBufferMs` before expiry.\n * - Single-flight: concurrent callers share one mint request.\n * - On `invalid_client`, the credential file is re-read once before\n *   failing — an operator-rotated secret is picked up without a restart.\n * - If the re-read credential still fails (revoked/deleted client), a\n *   `CredentialRevokedError` is thrown; the SDK's transport will not\n *   retry-loop against Moku on it. Re-enrollment is required.\n */\nexport function createClientCredentialsAuth(\n  credentialPath: string,\n  opts: ClientCredentialsAuthOptions = {},\n): AuthCallback {\n  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);\n  const logger = opts.logger ?? noopLogger;\n  const refreshBufferMs = opts.refreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS;\n  const makeAuthenticator =\n    opts.authenticator ?? ((c: StoredCredential) => clientSecretPost(c.client_id, c.client_secret));\n  const now = opts.now ?? Date.now;\n\n  let credential: StoredCredential | null = null;\n  let cached: { token: string; refreshAtMs: number } | null = null;\n  let inFlight: Promise<string> | null = null;\n\n  function loadCredential(): StoredCredential {\n    const loaded = readCredentialFile(credentialPath);\n    if (!loaded) {\n      throw new CredentialRevokedError(\n        `no credential at ${credentialPath} — enroll this neuron first (neuron-sdk enroll)`,\n      );\n    }\n    return loaded;\n  }\n\n  async function mintWith(cred: StoredCredential): Promise<{ token: string; expiresIn: number }> {\n    const form = new URLSearchParams({ grant_type: 'client_credentials' });\n    await makeAuthenticator(cred).apply(form);\n    const res = await requestToken(cred.token_endpoint, form, fetchImpl);\n    return { token: res.access_token, expiresIn: res.expires_in };\n  }\n\n  async function mint(): Promise<string> {\n    credential ??= loadCredential();\n    let minted: { token: string; expiresIn: number };\n    try {\n      minted = await mintWith(credential);\n    } catch (err) {\n      if (!(err instanceof OAuthTokenError) || err.error !== 'invalid_client') throw err;\n      // The secret may have been rotated on disk by an operator —\n      // re-read once before declaring the credential dead.\n      logger.warn(\n        { clientId: credential.client_id },\n        'token mint rejected (invalid_client); re-reading credential file',\n      );\n      const reread = readCredentialFile(credentialPath);\n      const changed =\n        reread &&\n        (reread.client_secret !== credential.client_secret ||\n          reread.client_id !== credential.client_id);\n      if (!changed) {\n        throw new CredentialRevokedError(\n          `Moku rejected client ${credential.client_id} (invalid_client) and the credential file is unchanged — the credential was revoked or rotated server-side; re-enroll this neuron`,\n        );\n      }\n      credential = reread;\n      try {\n        minted = await mintWith(credential);\n      } catch (retryErr) {\n        if (retryErr instanceof OAuthTokenError && retryErr.error === 'invalid_client') {\n          throw new CredentialRevokedError(\n            `Moku rejected client ${credential.client_id} (invalid_client) after credential re-read — re-enroll this neuron`,\n          );\n        }\n        throw retryErr;\n      }\n    }\n\n    // Refresh ahead of expiry, but never treat a token as expired the\n    // instant it is minted (very short expires_in vs. large buffer).\n    const lifetimeMs = minted.expiresIn * 1000;\n    const refreshAtMs = now() + Math.max(lifetimeMs - refreshBufferMs, lifetimeMs / 2);\n    cached = { token: minted.token, refreshAtMs };\n    logger.debug(\n      { clientId: credential.client_id, expiresInSeconds: minted.expiresIn },\n      'minted bigbrain access token',\n    );\n    return minted.token;\n  }\n\n  return async function auth(): Promise<string> {\n    if (cached && now() < cached.refreshAtMs) return cached.token;\n    inFlight ??= mint().finally(() => {\n      inFlight = null;\n    });\n    return inFlight;\n  };\n}\n","import { noopLogger } from '../logger.js';\nimport type { NeuronLogger } from '../types.js';\n\nimport type { OAuthEndpoints } from './types.js';\n\n/**\n * Fixed fallback paths, pinned to the Moku contract (HOL-1922 /\n * NEURON_AUTH_SPEC.md §4). Moku's public nginx allowlist may not proxy\n * `/.well-known/oauth-authorization-server`, so discovery failing is an\n * expected deployment shape, not an error.\n */\nexport const DEFAULT_TOKEN_PATH = '/api/v1/auth/token';\nexport const DEFAULT_DEVICE_AUTHORIZATION_PATH = '/api/v1/auth/device';\n\nconst DISCOVERY_PATH = '/.well-known/oauth-authorization-server';\n\n/**\n * Resolve OAuth endpoints for a Moku base URL via RFC 8414 discovery,\n * falling back to the fixed default paths when the metadata document is\n * unreachable or malformed.\n *\n * Served endpoint URLs are re-rooted onto `mokuBaseUrl` (path is taken\n * from the document, origin from the caller): the metadata document\n * derives its URLs from the inbound request URL, which behind a\n * TLS-terminating proxy can name an origin the neuron cannot reach.\n * The caller-supplied base URL is the one address known to work.\n */\nexport async function discoverEndpoints(\n  mokuBaseUrl: string,\n  opts: { fetch?: typeof fetch; logger?: NeuronLogger } = {},\n): Promise<OAuthEndpoints> {\n  const base = mokuBaseUrl.replace(/\\/+$/, '');\n  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);\n  const logger = opts.logger ?? noopLogger;\n\n  const fallback: OAuthEndpoints = {\n    tokenEndpoint: `${base}${DEFAULT_TOKEN_PATH}`,\n    deviceAuthorizationEndpoint: `${base}${DEFAULT_DEVICE_AUTHORIZATION_PATH}`,\n  };\n\n  let res: Response;\n  try {\n    res = await fetchImpl(`${base}${DISCOVERY_PATH}`, {\n      headers: { Accept: 'application/json' },\n    });\n  } catch (err) {\n    logger.warn(\n      { err: (err as Error).message },\n      'OAuth discovery unreachable; using default endpoint paths',\n    );\n    return fallback;\n  }\n\n  if (!res.ok) {\n    logger.warn(\n      { status: res.status },\n      'OAuth discovery not served; using default endpoint paths',\n    );\n    return fallback;\n  }\n\n  try {\n    const doc = (await res.json()) as Record<string, unknown>;\n    const token = doc['token_endpoint'];\n    const device = doc['device_authorization_endpoint'];\n    if (typeof token !== 'string' || typeof device !== 'string') {\n      logger.warn({}, 'OAuth discovery document incomplete; using default endpoint paths');\n      return fallback;\n    }\n    return {\n      tokenEndpoint: reRoot(token, base),\n      deviceAuthorizationEndpoint: reRoot(device, base),\n    };\n  } catch {\n    logger.warn({}, 'OAuth discovery document malformed; using default endpoint paths');\n    return fallback;\n  }\n}\n\nfunction reRoot(servedUrl: string, base: string): string {\n  try {\n    const parsed = new URL(servedUrl);\n    return `${base}${parsed.pathname}`;\n  } catch {\n    // Relative path in the document — treat it as one.\n    return `${base}${servedUrl.startsWith('/') ? '' : '/'}${servedUrl}`;\n  }\n}\n","import { hostname as osHostname } from 'node:os';\n\nimport { noopLogger } from '../logger.js';\nimport type { NeuronLogger } from '../types.js';\n\nimport { createClientCredentialsAuth } from './client-credentials.js';\nimport { defaultCredentialPath, readCredentialFile, writeCredentialFile } from './credential-file.js';\nimport { discoverEndpoints } from './discovery.js';\nimport { requestToken } from './token-client.js';\nimport {\n  CredentialRevokedError,\n  EnrollmentError,\n  OAuthTokenError,\n  type StoredCredential,\n} from './types.js';\n\nconst DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';\n\nexport interface EnrollOptions {\n  /** Moku base URL — the only required config (endpoints are discovered). */\n  mokuBaseUrl: string;\n  /** Display name shown to the approving admin. Required by Moku. */\n  clientName: string;\n  /** Display hint for the approval screen; defaults to `os.hostname()`. */\n  hostname?: string;\n  /**\n   * Capability types this neuron intends to serve — display hints for the\n   * approval screen ONLY. Authorization comes from the org's capability\n   * catalog, not from this list (requested ≠ granted).\n   */\n  capabilityTypes?: string[];\n  /** Where to persist the credential. Default: `~/.holokai/neuron-credentials.json`. */\n  credentialPath?: string;\n  fetch?: typeof fetch;\n  logger?: NeuronLogger;\n  /** Where user-facing lines (verification URI + user code) go. Default: console.log. */\n  out?: (line: string) => void;\n  /** Sleep override for tests. */\n  sleep?: (ms: number) => Promise<void>;\n}\n\nexport interface EnrollResult {\n  status: 'already-enrolled' | 'enrolled';\n  clientId: string;\n  credentialPath: string;\n  /** Bootstrap token from the redemption response (only when freshly enrolled). */\n  accessToken?: string;\n  expiresIn?: number;\n}\n\ninterface DeviceAuthorizationResponse {\n  device_code: string;\n  user_code: string;\n  verification_uri: string;\n  verification_uri_complete?: string;\n  expires_in: number;\n  interval?: number;\n}\n\n/**\n * One-time enrollment of a headless neuron via Moku's RFC 8628 device\n * authorization grant.\n *\n * Flow: start a device authorization → print the verification URI +\n * user code (container-log friendly) → poll the token endpoint until an\n * org ADMIN approves in Moku → persist the client credential delivered\n * in the redemption token response (delivered exactly once).\n *\n * Idempotent: if a credential file already exists and still mints, this\n * is a no-op reporting `already-enrolled`. A revoked existing credential\n * falls through to a fresh enrollment.\n */\nexport async function enroll(opts: EnrollOptions): Promise<EnrollResult> {\n  const credentialPath = opts.credentialPath ?? defaultCredentialPath();\n  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);\n  const logger = opts.logger ?? noopLogger;\n  const out = opts.out ?? ((line: string) => console.log(line));\n  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));\n\n  const existing = readCredentialFile(credentialPath);\n  if (existing) {\n    try {\n      await createClientCredentialsAuth(credentialPath, { fetch: fetchImpl, logger })();\n      out(`Already enrolled as client ${existing.client_id} (credential: ${credentialPath}).`);\n      return { status: 'already-enrolled', clientId: existing.client_id, credentialPath };\n    } catch (err) {\n      if (!(err instanceof CredentialRevokedError)) throw err;\n      logger.warn(\n        { clientId: existing.client_id },\n        'existing credential no longer mints; starting fresh enrollment',\n      );\n    }\n  }\n\n  const endpoints = await discoverEndpoints(opts.mokuBaseUrl, { fetch: fetchImpl, logger });\n\n  const deviceForm = new URLSearchParams({ client_name: opts.clientName });\n  deviceForm.set('hostname', opts.hostname ?? osHostname());\n  if (opts.capabilityTypes?.length) {\n    deviceForm.set('capability_types', opts.capabilityTypes.join(','));\n  }\n\n  const deviceRes = await fetchImpl(endpoints.deviceAuthorizationEndpoint, {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/x-www-form-urlencoded',\n      Accept: 'application/json',\n    },\n    body: deviceForm.toString(),\n  });\n  if (!deviceRes.ok) {\n    const text = await deviceRes.text().catch(() => '');\n    throw new EnrollmentError(\n      `device authorization request failed: ${deviceRes.status}${text ? ` — ${text}` : ''}`,\n      'device_request_failed',\n    );\n  }\n  const device = (await deviceRes.json()) as DeviceAuthorizationResponse;\n  if (!device.device_code || !device.user_code || !device.verification_uri) {\n    throw new EnrollmentError('device authorization response incomplete', 'invalid_response');\n  }\n\n  out('To authorize this neuron, an org admin must visit:');\n  out(`  ${device.verification_uri_complete ?? device.verification_uri}`);\n  out(`and enter code: ${device.user_code}`);\n  out(`Waiting for approval (expires in ${Math.round(device.expires_in / 60)} min)…`);\n\n  let intervalMs = (device.interval ?? 5) * 1000;\n  const deadline = Date.now() + device.expires_in * 1000;\n\n  for (;;) {\n    if (Date.now() >= deadline) {\n      throw new EnrollmentError('enrollment request expired before approval', 'expired_token');\n    }\n    await sleep(intervalMs);\n\n    const pollForm = new URLSearchParams({\n      grant_type: DEVICE_CODE_GRANT,\n      device_code: device.device_code,\n    });\n    let token;\n    try {\n      token = await requestToken(endpoints.tokenEndpoint, pollForm, fetchImpl);\n    } catch (err) {\n      if (err instanceof OAuthTokenError) {\n        switch (err.error) {\n          case 'authorization_pending':\n            continue;\n          case 'slow_down':\n            intervalMs += 5_000; // RFC 8628 §3.5\n            continue;\n          case 'expired_token':\n            throw new EnrollmentError('enrollment request expired before approval', 'expired_token');\n          case 'access_denied':\n            throw new EnrollmentError('enrollment was denied by the admin', 'access_denied');\n        }\n        // Non-RFC server hiccups are transient for a poller: a 409 (e.g. a\n        // poll racing the admin's approval write) or 5xx resolves by the\n        // next poll, and the device-code deadline bounds the loop. Only\n        // definitive 4xx protocol errors (invalid_grant, …) are fatal.\n        if (err.status === 409 || err.status >= 500) {\n          logger.warn(\n            { error: err.error, status: err.status },\n            'transient token-endpoint error while polling; will retry',\n          );\n          continue;\n        }\n      }\n      // Network-level failures are equally transient while polling.\n      if (!(err instanceof OAuthTokenError) && !(err instanceof EnrollmentError)) {\n        logger.warn(\n          { err: (err as Error).message },\n          'token endpoint unreachable while polling; will retry',\n        );\n        continue;\n      }\n      throw err;\n    }\n\n    // Redemption: the client credential is delivered exactly once, here.\n    if (!token.client_id || !token.client_secret) {\n      throw new EnrollmentError(\n        'redemption response did not include a client credential',\n        'invalid_response',\n      );\n    }\n    const credential: StoredCredential = {\n      client_id: token.client_id,\n      client_secret: token.client_secret,\n      token_endpoint: endpoints.tokenEndpoint,\n      moku_base_url: opts.mokuBaseUrl.replace(/\\/+$/, ''),\n    };\n    writeCredentialFile(credentialPath, credential);\n    out(`Enrolled as client ${credential.client_id}. Credential written to ${credentialPath}.`);\n    return {\n      status: 'enrolled',\n      clientId: credential.client_id,\n      credentialPath,\n      accessToken: token.access_token,\n      expiresIn: token.expires_in,\n    };\n  }\n}\n"]}