@pensar/apex 1.8.0 → 1.8.2-canary.fb75c486

package/build/{cli-dqt80sw3.js → cli-w5990vr6.js}

@@ -1,33 +1,54 @@
 import {
   config,
-  ensureValidToken,
-  getPensarApiUrl,
-  getPensarGatewayUrl
-} from "./cli-asyas1xb.js";
+  init_config
+} from "./cli-9egg9azd.js";
+import {
+  __esm
+} from "./cli-8rxa073f.js";
 
-// src/core/auth/signing.ts
-import { createHmac, createHash, randomUUID } from "crypto";
-function signGatewayRequest(signingKey, modelId, body) {
-  const timestamp = String(Math.floor(Date.now() / 1000));
-  const nonce = randomUUID();
-  const bodyHash = createHash("sha256").update(body).digest("hex");
-  const payload = `${timestamp}
-${nonce}
-${modelId}
-${bodyHash}`;
-  const signature = createHmac("sha256", signingKey).update(payload).digest("base64");
-  return { signature, timestamp, nonce };
+// src/core/auth/connection.ts
+function isConnected(cfg) {
+  return !!(cfg.accessToken || cfg.pensarAPIKey);
+}
+async function disconnect() {
+  await config.update({
+    pensarAPIKey: null,
+    accessToken: null,
+    refreshToken: null,
+    workspaceId: null,
+    workspaceSlug: null,
+    gatewaySigningKey: null
+  });
+}
+var init_connection = __esm(() => {
+  init_config();
+});
+
+// src/core/api/constants.ts
+function getPensarApiUrl() {
+  return process.env.PENSAR_API_URL || PENSAR_API_BASE_URL;
+}
+function getPensarGatewayUrl() {
+  return process.env.PENSAR_GATEWAY_URL || PENSAR_GATEWAY_BASE_URL;
+}
+function getPensarConsoleUrl() {
+  return process.env.PENSAR_CONSOLE_URL || PENSAR_CONSOLE_BASE_URL;
 }
+var PENSAR_API_BASE_URL = "https://api.pensar.dev", PENSAR_GATEWAY_BASE_URL = "https://gateway.pensar.dev", PENSAR_CONSOLE_BASE_URL = "https://console.pensar.dev";
+var init_constants = () => {};
+
 // src/core/auth/device-flow.ts
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function startDeviceFlow(apiUrl) {
   const url = apiUrl ?? getPensarApiUrl();
+  let workosClientId;
   try {
     const configResponse = await fetch(`${url}/api/cli/config`);
     if (configResponse.ok) {
       const cliConfig = await configResponse.json();
+      workosClientId = cliConfig.workosClientId;
       const response2 = await fetch("https://api.workos.com/user_management/authorize/device", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -45,13 +66,14 @@ async function startDeviceFlow(apiUrl) {
   } catch {}
   const response = await fetch(`${url}/auth/device/code`, {
     method: "POST",
-    headers: { "Content-Type": "application/json" }
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(workosClientId ? { client_id: workosClientId } : {})
   });
   if (!response.ok) {
     throw new Error("Failed to start device authorization");
   }
   const deviceInfo = await response.json();
-  return { mode: "legacy", deviceInfo };
+  return { mode: "legacy", clientId: workosClientId, deviceInfo };
 }
 async function pollWorkOSToken(params) {
   const { clientId, deviceCode, interval, expiresIn, signal } = params;
@@ -92,7 +114,7 @@ async function pollWorkOSToken(params) {
   throw new Error("Authorization timed out. Please try again.");
 }
 async function pollLegacyToken(params) {
-  const { apiUrl, deviceCode, interval, expiresIn, signal } = params;
+  const { apiUrl, deviceCode, interval, expiresIn, clientId, signal } = params;
   const deadline = Date.now() + expiresIn * 1000;
   while (Date.now() < deadline) {
     if (signal?.aborted)
@@ -104,7 +126,7 @@ async function pollLegacyToken(params) {
       const response = await fetch(`${apiUrl}/auth/device/token`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ deviceCode })
+        body: JSON.stringify(clientId ? { deviceCode, client_id: clientId } : { deviceCode })
       });
       if (!response.ok)
         continue;
@@ -129,6 +151,150 @@ async function pollLegacyToken(params) {
   }
   throw new Error("Authorization timed out. Please try again.");
 }
+var init_device_flow = __esm(() => {
+  init_constants();
+});
+
+// src/core/auth/token.ts
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+      return null;
+    const payload = Buffer.from(parts[1], "base64url").toString("utf-8");
+    return JSON.parse(payload);
+  } catch {
+    return null;
+  }
+}
+function isTokenExpired(token, bufferSeconds = 60) {
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.exp !== "number")
+    return true;
+  const nowSeconds = Math.floor(Date.now() / 1000);
+  return payload.exp - nowSeconds < bufferSeconds;
+}
+async function fetchWorkOSClientId() {
+  if (cachedClientId)
+    return cachedClientId;
+  try {
+    const apiUrl = getPensarApiUrl();
+    const response = await fetch(`${apiUrl}/api/cli/config`);
+    if (!response.ok)
+      return null;
+    const data = await response.json();
+    cachedClientId = data.workosClientId;
+    return cachedClientId;
+  } catch {
+    return null;
+  }
+}
+async function refreshAccessToken(clientId, refreshToken) {
+  try {
+    const response = await fetch("https://api.workos.com/user_management/authenticate", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        client_id: clientId,
+        grant_type: "refresh_token",
+        refresh_token: refreshToken
+      })
+    });
+    if (!response.ok) {
+      console.error(`[pensar] Token refresh failed: ${response.status} ${response.statusText}`);
+      return null;
+    }
+    const data = await response.json();
+    await config.update({
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token
+    });
+    return data.access_token;
+  } catch (err) {
+    console.error("[pensar] Token refresh error:", err);
+    return null;
+  }
+}
+async function ensureValidToken(cfg) {
+  if (cfg.accessToken) {
+    if (!isTokenExpired(cfg.accessToken)) {
+      return { token: cfg.accessToken, type: "workos" };
+    }
+    if (cfg.refreshToken) {
+      const clientId = await fetchWorkOSClientId();
+      if (clientId) {
+        const newToken = await refreshAccessToken(clientId, cfg.refreshToken);
+        if (newToken) {
+          return { token: newToken, type: "workos" };
+        }
+      }
+    }
+  }
+  if (cfg.pensarAPIKey) {
+    return { token: cfg.pensarAPIKey, type: "legacy" };
+  }
+  return null;
+}
+var cachedClientId = null;
+var init_token = __esm(() => {
+  init_constants();
+  init_config();
+});
+
+// src/core/auth/gateway.ts
+async function validateGateway() {
+  const cfg = await config.get();
+  const tokenResult = await ensureValidToken({
+    accessToken: cfg.accessToken,
+    refreshToken: cfg.refreshToken,
+    pensarAPIKey: cfg.pensarAPIKey
+  });
+  if (!tokenResult)
+    return null;
+  const gatewayUrl = cfg.gatewayUrl || getPensarGatewayUrl();
+  const headers = {
+    Authorization: `Bearer ${tokenResult.token}`
+  };
+  if (cfg.workspaceId) {
+    headers["X-Workspace-Id"] = cfg.workspaceId;
+  }
+  const response = await fetch(`${gatewayUrl}/gateway/validate`, {
+    method: "GET",
+    headers
+  });
+  if (!response.ok) {
+    throw new Error(`Gateway validation failed (${response.status})`);
+  }
+  const result = await response.json();
+  if (result.signingKey || result.gatewayUrl) {
+    await config.update({
+      gatewaySigningKey: result.signingKey ?? undefined,
+      gatewayUrl: result.gatewayUrl ?? undefined
+    });
+  }
+  return result;
+}
+var init_gateway = __esm(() => {
+  init_constants();
+  init_config();
+  init_token();
+});
+
+// src/core/auth/signing.ts
+import { createHash, createHmac, randomUUID } from "crypto";
+function signGatewayRequest(signingKey, modelId, body) {
+  const timestamp = String(Math.floor(Date.now() / 1000));
+  const nonce = randomUUID();
+  const bodyHash = createHash("sha256").update(body).digest("hex");
+  const payload = `${timestamp}
+${nonce}
+${modelId}
+${bodyHash}`;
+  const signature = createHmac("sha256", signingKey).update(payload).digest("base64");
+  return { signature, timestamp, nonce };
+}
+var init_signing = () => {};
+
 // src/core/auth/workspaces.ts
 function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -184,51 +350,16 @@ async function selectWorkspace(apiUrl, accessToken, workspaceId) {
   }
   return await response.json();
 }
-// src/core/auth/connection.ts
-function isConnected(cfg) {
-  return !!(cfg.accessToken || cfg.pensarAPIKey);
-}
-async function disconnect() {
-  await config.update({
-    pensarAPIKey: null,
-    accessToken: null,
-    refreshToken: null,
-    workspaceId: null,
-    workspaceSlug: null,
-    gatewaySigningKey: null
-  });
-}
-// src/core/auth/gateway.ts
-async function validateGateway() {
-  const cfg = await config.get();
-  const tokenResult = await ensureValidToken({
-    accessToken: cfg.accessToken,
-    refreshToken: cfg.refreshToken,
-    pensarAPIKey: cfg.pensarAPIKey
-  });
-  if (!tokenResult)
-    return null;
-  const gatewayUrl = cfg.gatewayUrl || getPensarGatewayUrl();
-  const headers = {
-    Authorization: `Bearer ${tokenResult.token}`
-  };
-  if (cfg.workspaceId) {
-    headers["X-Workspace-Id"] = cfg.workspaceId;
-  }
-  const response = await fetch(`${gatewayUrl}/gateway/validate`, {
-    method: "GET",
-    headers
-  });
-  if (!response.ok) {
-    throw new Error(`Gateway validation failed (${response.status})`);
-  }
-  const result = await response.json();
-  if (result.signingKey || result.gatewayUrl) {
-    await config.update({
-      gatewaySigningKey: result.signingKey ?? undefined,
-      gatewayUrl: result.gatewayUrl ?? undefined
-    });
-  }
-  return result;
-}
-export { signGatewayRequest, startDeviceFlow, pollWorkOSToken, pollLegacyToken, fetchWorkspaces, pollForWorkspaceCreation, selectWorkspace, isConnected, disconnect, validateGateway };
+var init_workspaces = () => {};
+
+// src/core/auth/index.ts
+var init_auth = __esm(() => {
+  init_connection();
+  init_device_flow();
+  init_gateway();
+  init_signing();
+  init_token();
+  init_workspaces();
+});
+
+export { getPensarApiUrl, getPensarGatewayUrl, getPensarConsoleUrl, init_constants, isConnected, disconnect, startDeviceFlow, pollWorkOSToken, pollLegacyToken, isTokenExpired, ensureValidToken, validateGateway, signGatewayRequest, fetchWorkspaces, pollForWorkspaceCreation, selectWorkspace, init_auth };