@primitive.ai/prim 0.1.0-alpha.8 → 0.1.0-alpha.81

package/dist/chunk-3EEFL6NJ.js

@@ -0,0 +1,529 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { isAbsolute, join, normalize } from "path";
+var UNSAFE_CONFIG_PATH_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u;
+function absolutePath(value, variable) {
+  if (value !== void 0 && UNSAFE_CONFIG_PATH_CHARACTERS.test(value)) {
+    throw new Error(`${variable} contains unsafe characters`);
+  }
+  if (!value || value.trim() !== value || !isAbsolute(value)) return;
+  const normalized = normalize(value);
+  return normalized === value ? value : void 0;
+}
+function resolvePrimConfigDirectory(options = {}) {
+  const env = options.env ?? process.env;
+  const explicit = absolutePath(env.PRIM_CONFIG_DIR, "PRIM_CONFIG_DIR");
+  if (explicit) return { path: explicit, source: "explicit" };
+  const xdgConfigHome = absolutePath(env.XDG_CONFIG_HOME, "XDG_CONFIG_HOME");
+  if (xdgConfigHome) return { path: join(xdgConfigHome, "prim"), source: "xdg" };
+  const home = absolutePath(options.homeDir ?? homedir(), "HOME");
+  if (!home) {
+    throw new Error("cannot resolve Primitive config directory: HOME is not an absolute path");
+  }
+  return { path: join(home, ".config", "prim"), source: "default" };
+}
+function primConfigDirectory(options = {}) {
+  return resolvePrimConfigDirectory(options).path;
+}
+
+// src/lib/workos-connect.ts
+var DISCOVERY_PATH = "/api/cli/auth/connect/config";
+var DEVICE_AUTHORIZATION_PATH = "/oauth2/device_authorization";
+var TOKEN_PATH = "/oauth2/token";
+var DISCOVERY_MAX_BYTES = 16 * 1024;
+var WORKOS_CONNECT_RESPONSE_MAX_BYTES = 64 * 1024;
+var MAX_DEVICE_LIFETIME_SECONDS = 60 * 60;
+var MAX_TOKEN_LIFETIME_SECONDS = 24 * 60 * 60;
+var MAX_INTERVAL_SECONDS = 60;
+var POLL_REQUEST_TIMEOUT_MS = 3e4;
+var SLOW_DOWN_SECONDS = 5;
+var MAX_URL_LENGTH = 2048;
+var MAX_DEVICE_CODE_LENGTH = 4096;
+var MAX_USER_CODE_LENGTH = 128;
+var MAX_CLIENT_ID_LENGTH = 256;
+var CONNECT_CLIENT_ID_PATTERN = /^client_[A-Za-z0-9_-]+$/u;
+var WORKOS_CONNECT_DEFAULT_SCOPES = ["openid", "profile", "email", "offline_access"];
+var WorkosConnectProtocolError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "WorkosConnectProtocolError";
+    this.code = code;
+  }
+};
+function recordFrom(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new WorkosConnectProtocolError("invalid_response", `${label} must be an object`);
+  }
+  return value;
+}
+function exactString(value, field, maxLength) {
+  const containsControl = typeof value === "string" && [...value].some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code === 127;
+  });
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || value.trim() !== value || containsControl) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function safeInteger(value, field, minimum, maximum) {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is invalid`);
+  }
+  return value;
+}
+function canonicalIssuer(value) {
+  const issuer = exactString(value, "issuer", MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(issuer);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", "issuer must be an HTTPS origin");
+  }
+  return issuer;
+}
+function sameIssuerUrl(value, field, issuer) {
+  const raw = exactString(value, field, MAX_URL_LENGTH);
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} must be an HTTPS URL`);
+  }
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.origin !== issuer) {
+    throw new WorkosConnectProtocolError("invalid_response", `${field} is not trusted`);
+  }
+  return parsed.toString();
+}
+function parseWorkosConnectConfiguration(value) {
+  const record = recordFrom(value, "Connect discovery");
+  const expectedKeys = ["protocol_version", "issuer", "client_id", "default_scopes"];
+  if (record.protocol_version !== 1 || Object.keys(record).length !== expectedKeys.length || expectedKeys.some((key) => !Object.hasOwn(record, key)) || !Array.isArray(record.default_scopes) || record.default_scopes.length !== WORKOS_CONNECT_DEFAULT_SCOPES.length || record.default_scopes.some((scope, index) => scope !== WORKOS_CONNECT_DEFAULT_SCOPES[index])) {
+    throw new WorkosConnectProtocolError("invalid_response", "Connect discovery is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.client_id, "client_id", MAX_CLIENT_ID_LENGTH);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_response", "Connect discovery is invalid");
+  }
+  return {
+    issuer,
+    clientId,
+    scopes: [...WORKOS_CONNECT_DEFAULT_SCOPES]
+  };
+}
+function parseWorkosConnectCredentialMetadata(value) {
+  const record = recordFrom(value, "credential metadata");
+  if (record.version !== 1 || record.family !== "workos_connect") {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential metadata is invalid");
+  }
+  const issuer = canonicalIssuer(record.issuer);
+  const clientId = exactString(record.clientId, "clientId", MAX_CLIENT_ID_LENGTH);
+  const accessTokenHash = exactString(record.accessTokenHash, "accessTokenHash", 64);
+  const refreshTokenHash = exactString(record.refreshTokenHash, "refreshTokenHash", 64);
+  if (!CONNECT_CLIENT_ID_PATTERN.test(clientId)) {
+    throw new WorkosConnectProtocolError("invalid_metadata", "credential clientId is invalid");
+  }
+  if (!/^[a-f0-9]{64}$/u.test(accessTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential accessTokenHash is invalid"
+    );
+  }
+  if (!/^[a-f0-9]{64}$/u.test(refreshTokenHash)) {
+    throw new WorkosConnectProtocolError(
+      "invalid_metadata",
+      "credential refreshTokenHash is invalid"
+    );
+  }
+  return {
+    version: 1,
+    family: "workos_connect",
+    issuer,
+    clientId,
+    accessTokenHash,
+    refreshTokenHash
+  };
+}
+async function readBoundedJson(response, maxBytes) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null) {
+    if (!/^\d+$/u.test(contentLength) || Number(contentLength) > maxBytes) {
+      throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+    }
+  }
+  if (!response.body) {
+    throw new WorkosConnectProtocolError("invalid_response", "response body is missing");
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      total += result.value.byteLength;
+      if (total > maxBytes) {
+        await reader.cancel();
+        throw new WorkosConnectProtocolError("invalid_response", "response body is too large");
+      }
+      chunks.push(result.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  let text;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return JSON.parse(text);
+  } catch {
+    throw new WorkosConnectProtocolError("invalid_response", "response body is not valid JSON");
+  }
+}
+async function discoverWorkosConnect(siteUrl, fetchImpl = fetch, signal = AbortSignal.timeout(1e4)) {
+  const response = await fetchImpl(`${siteUrl}${DISCOVERY_PATH}`, { signal });
+  if (response.status === 404) return { state: "legacy_server" };
+  if (!response.ok) {
+    throw new WorkosConnectProtocolError(
+      "discovery_unavailable",
+      `Connect discovery returned HTTP ${response.status}`
+    );
+  }
+  return {
+    state: "available",
+    configuration: parseWorkosConnectConfiguration(
+      await readBoundedJson(response, DISCOVERY_MAX_BYTES)
+    )
+  };
+}
+function workosConnectTokenEndpoint(issuer) {
+  return `${issuer}${TOKEN_PATH}`;
+}
+async function requestWorkosDeviceAuthorization(configuration, fetchImpl = fetch, signal = AbortSignal.timeout(1e4)) {
+  const body = new URLSearchParams({
+    client_id: configuration.clientId,
+    scope: configuration.scopes.join(" ")
+  });
+  const response = await fetchImpl(`${configuration.issuer}${DEVICE_AUTHORIZATION_PATH}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body,
+    signal
+  });
+  const value = await readBoundedJson(response, WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+  if (!response.ok) {
+    const error = recordFrom(value, "device authorization error").error;
+    throw new WorkosConnectProtocolError(
+      typeof error === "string" ? error : "device_authorization_failed",
+      `Device authorization returned HTTP ${response.status}`
+    );
+  }
+  const record = recordFrom(value, "device authorization");
+  const verificationUri = sameIssuerUrl(
+    record.verification_uri,
+    "verification_uri",
+    configuration.issuer
+  );
+  return {
+    deviceCode: exactString(record.device_code, "device_code", MAX_DEVICE_CODE_LENGTH),
+    userCode: exactString(record.user_code, "user_code", MAX_USER_CODE_LENGTH),
+    verificationUri,
+    verificationUriComplete: record.verification_uri_complete === void 0 ? void 0 : sameIssuerUrl(
+      record.verification_uri_complete,
+      "verification_uri_complete",
+      configuration.issuer
+    ),
+    expiresIn: safeInteger(record.expires_in, "expires_in", 1, MAX_DEVICE_LIFETIME_SECONDS),
+    interval: safeInteger(record.interval ?? 5, "interval", 1, MAX_INTERVAL_SECONDS)
+  };
+}
+function parseWorkosConnectTokens(value, options = {}) {
+  const record = recordFrom(value, "token response");
+  const accessToken = exactString(
+    record.access_token,
+    "access_token",
+    WORKOS_CONNECT_RESPONSE_MAX_BYTES
+  );
+  const refreshToken = record.refresh_token === void 0 && options.fallbackRefreshToken !== void 0 ? options.fallbackRefreshToken : exactString(record.refresh_token, "refresh_token", WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+  return {
+    accessToken,
+    refreshToken,
+    expiresIn: record.expires_in === void 0 ? void 0 : safeInteger(record.expires_in, "expires_in", 1, MAX_TOKEN_LIFETIME_SECONDS)
+  };
+}
+function providerError(value) {
+  const error = recordFrom(value, "token error").error;
+  return exactString(error, "error", MAX_USER_CODE_LENGTH);
+}
+async function defaultSleep(milliseconds, signal) {
+  await new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const abort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", abort);
+      resolve();
+    }, milliseconds);
+    signal.addEventListener("abort", abort, { once: true });
+  });
+}
+async function pollWorkosDeviceAuthorization(configuration, authorization, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? defaultSleep;
+  const signal = options.signal ?? AbortSignal.timeout(authorization.expiresIn * 1e3);
+  const deadline = now() + authorization.expiresIn * 1e3;
+  let intervalSeconds = authorization.interval;
+  while (now() < deadline) {
+    await sleep(Math.min(intervalSeconds * 1e3, Math.max(0, deadline - now())), signal);
+    if (now() >= deadline) break;
+    let response;
+    try {
+      response = await fetchImpl(workosConnectTokenEndpoint(configuration.issuer), {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: authorization.deviceCode,
+          client_id: configuration.clientId
+        }),
+        signal: AbortSignal.any([signal, AbortSignal.timeout(POLL_REQUEST_TIMEOUT_MS)])
+      });
+    } catch (error2) {
+      if (signal.aborted) {
+        throw new WorkosConnectProtocolError("expired_token", "Device authorization expired");
+      }
+      continue;
+    }
+    const value = await readBoundedJson(response, WORKOS_CONNECT_RESPONSE_MAX_BYTES);
+    if (response.ok) return parseWorkosConnectTokens(value);
+    const error = providerError(value);
+    if (error === "authorization_pending") continue;
+    if (error === "slow_down") {
+      intervalSeconds = Math.min(MAX_INTERVAL_SECONDS, intervalSeconds + SLOW_DOWN_SECONDS);
+      continue;
+    }
+    if (error === "access_denied" || error === "expired_token") {
+      throw new WorkosConnectProtocolError(error, `Device authorization failed: ${error}`);
+    }
+    throw new WorkosConnectProtocolError(error, "Token endpoint rejected device authorization");
+  }
+  throw new WorkosConnectProtocolError("expired_token", "Device authorization expired");
+}
+
+// src/lib/credentials.ts
+import { createHash } from "crypto";
+import { readFileSync } from "fs";
+import { join as join2 } from "path";
+var CONFIG_DIRECTORY = primConfigDirectory();
+var TOKEN_FILE_PATH = join2(CONFIG_DIRECTORY, "token");
+var REFRESH_TOKEN_PATH = join2(CONFIG_DIRECTORY, "refresh_token");
+var TOKEN_EXPIRES_PATH = join2(CONFIG_DIRECTORY, "token_expires_at");
+var TERMINAL_REFRESH_PATH = join2(CONFIG_DIRECTORY, "refresh_terminal");
+var CREDENTIAL_METADATA_PATH = join2(CONFIG_DIRECTORY, "credential_metadata.json");
+var CREDENTIAL_FAMILY_PATH = join2(CONFIG_DIRECTORY, "credential_family.json");
+var CREDENTIAL_MIGRATION_PATH = join2(CONFIG_DIRECTORY, "credential_migration.json");
+var CREDENTIAL_LOCK_PATH = join2(CONFIG_DIRECTORY, "credentials.lock");
+var MAX_CREDENTIAL_METADATA_BYTES = 4096;
+var CREDENTIAL_MIGRATION_VERSION = 1;
+var CREDENTIAL_MIGRATION_STATE = "family_bound";
+function readTrimmed(path) {
+  try {
+    const value = readFileSync(path, "utf8").trim();
+    return value || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthCredential(options = {}) {
+  const envToken = (options.env ?? process.env).PRIM_TOKEN?.trim();
+  if (envToken) return { token: envToken, source: "environment" };
+  const stored = readTrimmed(options.tokenFilePath ?? TOKEN_FILE_PATH);
+  if (!stored) return void 0;
+  const metadata = readStoredCredentialMetadata(
+    options.metadataPath ?? CREDENTIAL_METADATA_PATH,
+    options.familyPath ?? CREDENTIAL_FAMILY_PATH,
+    options.migrationPath ?? CREDENTIAL_MIGRATION_PATH
+  );
+  if (metadata.state === "legacy_broker") {
+    if (metadata.metadata) {
+      const refreshToken2 = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+      if (!refreshToken2 || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken2)) {
+        return void 0;
+      }
+    }
+    return { token: stored, source: "token_file" };
+  }
+  if (metadata.state === "invalid") return void 0;
+  const refreshToken = readTrimmed(options.refreshTokenPath ?? REFRESH_TOKEN_PATH);
+  if (!refreshToken || metadata.metadata.accessTokenHash !== credentialFingerprint(stored) || metadata.metadata.refreshTokenHash !== credentialFingerprint(refreshToken)) {
+    return void 0;
+  }
+  return { token: stored, source: "token_file" };
+}
+function credentialFingerprint(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function parseLegacyBrokerCredentialMetadata(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("credential family is invalid");
+  }
+  const record = value;
+  if (record.version !== 1 || record.family !== "legacy_broker" || typeof record.accessTokenHash !== "string" || typeof record.refreshTokenHash !== "string" || !/^[a-f0-9]{64}$/u.test(record.accessTokenHash) || !/^[a-f0-9]{64}$/u.test(record.refreshTokenHash)) {
+    throw new Error("credential family is invalid");
+  }
+  return {
+    version: 1,
+    family: "legacy_broker",
+    accessTokenHash: record.accessTokenHash,
+    refreshTokenHash: record.refreshTokenHash
+  };
+}
+function readBoundedCredentialJson(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : null;
+  }
+  if (Buffer.byteLength(raw, "utf8") > MAX_CREDENTIAL_METADATA_BYTES) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readCredentialFamily(path) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return void 0;
+  if (parsed === null) return { state: "invalid" };
+  try {
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) && parsed.family === "legacy_broker") {
+      return { state: "legacy_broker", metadata: parseLegacyBrokerCredentialMetadata(parsed) };
+    }
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function isCredentialMigrationSentinel(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return keys.length === 2 && keys[0] === "state" && keys[1] === "version" && record.version === CREDENTIAL_MIGRATION_VERSION && record.state === CREDENTIAL_MIGRATION_STATE;
+}
+function readCredentialMigrationState(path = CREDENTIAL_MIGRATION_PATH) {
+  const parsed = readBoundedCredentialJson(path);
+  if (parsed === void 0) return "absent";
+  return parsed !== null && isCredentialMigrationSentinel(parsed) ? "valid" : "invalid";
+}
+function readStoredCredentialMetadata(metadataPath = CREDENTIAL_METADATA_PATH, familyPath = CREDENTIAL_FAMILY_PATH, migrationPath = CREDENTIAL_MIGRATION_PATH) {
+  const family = readCredentialFamily(familyPath);
+  if (family) return family;
+  const parsed = readBoundedCredentialJson(metadataPath);
+  if (parsed === void 0) {
+    return readCredentialMigrationState(migrationPath) === "absent" ? { state: "legacy_broker" } : { state: "invalid" };
+  }
+  if (parsed === null) return { state: "invalid" };
+  try {
+    return {
+      state: "workos_connect",
+      metadata: parseWorkosConnectCredentialMetadata(parsed)
+    };
+  } catch {
+    return { state: "invalid" };
+  }
+}
+function decodeJwtPayload(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload)) return void 0;
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
+function jwtExpiresAt(token) {
+  const exp = decodeJwtPayload(token)?.exp;
+  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : void 0;
+}
+function jwtOrganizationId(token) {
+  const orgId = decodeJwtPayload(token)?.org_id;
+  return typeof orgId === "string" && orgId.length > 0 ? orgId : void 0;
+}
+
+export {
+  __commonJS,
+  __toESM,
+  primConfigDirectory,
+  WORKOS_CONNECT_RESPONSE_MAX_BYTES,
+  WorkosConnectProtocolError,
+  readBoundedJson,
+  discoverWorkosConnect,
+  workosConnectTokenEndpoint,
+  requestWorkosDeviceAuthorization,
+  parseWorkosConnectTokens,
+  pollWorkosDeviceAuthorization,
+  TOKEN_FILE_PATH,
+  REFRESH_TOKEN_PATH,
+  TOKEN_EXPIRES_PATH,
+  TERMINAL_REFRESH_PATH,
+  CREDENTIAL_METADATA_PATH,
+  CREDENTIAL_FAMILY_PATH,
+  CREDENTIAL_MIGRATION_PATH,
+  CREDENTIAL_LOCK_PATH,
+  CREDENTIAL_MIGRATION_VERSION,
+  CREDENTIAL_MIGRATION_STATE,
+  resolveAuthCredential,
+  readCredentialMigrationState,
+  readStoredCredentialMetadata,
+  decodeJwtPayload,
+  jwtExpiresAt,
+  jwtOrganizationId
+};