@pyxmate/memory 1.27.0 → 1.27.2

package/dist/chunk-S3CX323Z.mjs

@@ -0,0 +1,34 @@
+// src/cli/probe.ts
+import { randomUUID } from "crypto";
+var PROBE_PATH = "/api/memory/entries?limit=1";
+var PROBE_TIMEOUT_MS = 8e3;
+async function probeCredentials(args) {
+  const fetcher = args.fetcher ?? fetch;
+  const url = `${args.endpoint}${PROBE_PATH}`;
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), PROBE_TIMEOUT_MS);
+  const idempotencyKey = `cli-probe-${randomUUID()}`;
+  try {
+    const res = await fetcher(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${args.apiKey}`,
+        Accept: "application/json",
+        "Idempotency-Key": idempotencyKey
+      },
+      signal: ctl.signal
+    });
+    if (res.status === 401 || res.status === 403) return { kind: "invalid", status: res.status };
+    if (res.ok) return { kind: "ok", status: res.status };
+    return { kind: "unreachable", reason: `HTTP ${res.status}` };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { kind: "unreachable", reason: msg };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export {
+  probeCredentials
+};

package/dist/chunk-THLUBOGD.mjs

@@ -0,0 +1,263 @@
+// src/mcp/errors.ts
+var RUN_LOGIN = "Run: pyx-mem login";
+var RUN_DOCTOR = "Run: pyx-mem doctor";
+function mcpText(text, isError = false) {
+  return { isError, content: [{ type: "text", text }] };
+}
+function mcpMissingCredentials() {
+  return mcpText(`pyx-memory credentials are not configured.
+${RUN_LOGIN}`, true);
+}
+function mcpKeychainError(message, guidance) {
+  const lines = ["pyx-memory credentials could not be read from the OS credential store."];
+  if (message) lines.push(message);
+  if (guidance) lines.push(guidance);
+  lines.push(RUN_LOGIN);
+  return mcpText(lines.join("\n"), true);
+}
+function mcpAuthFailed(status) {
+  return mcpText(`Authentication failed (HTTP ${status}).
+${RUN_LOGIN}`, true);
+}
+function mcpUnreachable(endpoint, reason) {
+  return mcpText(`Unable to reach pyx-memory at ${endpoint}: ${reason}.
+${RUN_DOCTOR}`, true);
+}
+function mcpHttpError(status, body) {
+  return mcpText(`${status}: ${body}`, true);
+}
+function mcpServerError(status, body) {
+  return mcpText(`pyx-memory server error (HTTP ${status}): ${body || "no body"}`, true);
+}
+function mcpEnvelopeError(message) {
+  return mcpText(message, true);
+}
+function mcpJson(payload) {
+  return mcpText(JSON.stringify(payload));
+}
+
+// src/mcp/http-client.ts
+var DEFAULT_TIMEOUT_MS = 15e3;
+function parseRetryAfterSeconds(header) {
+  const value = header?.trim() ?? "";
+  return /^\d+$/.test(value) ? Number(value) : void 0;
+}
+var HTTP_DATE = /^(?:[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT|[A-Z][a-z]{5,8}, \d{2}-[A-Z][a-z]{2}-\d{2} \d{2}:\d{2}:\d{2} GMT|[A-Z][a-z]{2} [A-Z][a-z]{2} [ \d]\d \d{2}:\d{2}:\d{2} \d{4})$/;
+function parseRetryAfterMs(header) {
+  const seconds = parseRetryAfterSeconds(header);
+  if (seconds !== void 0) return seconds * 1e3;
+  const value = header?.trim() ?? "";
+  if (!HTTP_DATE.test(value)) return void 0;
+  const at = Date.parse(value.endsWith(" GMT") ? value : `${value} GMT`);
+  return Number.isNaN(at) ? void 0 : Math.max(0, at - Date.now());
+}
+function validateIdempotencyKey(key) {
+  if (key.length === 0 || !key.isWellFormed() || new TextEncoder().encode(key).byteLength > 256) {
+    throw new Error("idempotencyKey must be 1-256 well-formed UTF-8 bytes");
+  }
+  return key;
+}
+function createHttpClient(credentials, fetchImpl = fetch) {
+  const baseUrl = credentials.endpoint.replace(/\/+$/, "");
+  function buildUrl(path, query) {
+    const url = new URL(`${baseUrl}${path}`);
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v === void 0) continue;
+        url.searchParams.set(k, String(v));
+      }
+    }
+    return url.toString();
+  }
+  function buildHeaders(scope, contentType, idempotencyKey) {
+    const headers = new Headers();
+    headers.set("Authorization", `Bearer ${credentials.apiKey}`);
+    headers.set("Accept", "application/json");
+    if (contentType) headers.set("Content-Type", contentType);
+    if (scope?.tenantId) headers.set("X-Tenant-Id", scope.tenantId);
+    if (scope?.namespaceId) headers.set("X-Namespace-Id", scope.namespaceId);
+    if (scope?.userId) headers.set("X-User-Id", scope.userId);
+    if (scope?.teamId) headers.set("X-Team-Id", scope.teamId);
+    if (scope?.callerAccessLevel) headers.set("X-Caller-Access-Level", scope.callerAccessLevel);
+    if (idempotencyKey !== void 0) {
+      headers.set("Idempotency-Key", validateIdempotencyKey(idempotencyKey));
+    }
+    return headers;
+  }
+  async function send(url, method, headers, body, deadline = {}) {
+    const { timeoutMs, signal } = deadline;
+    const ctl = new AbortController();
+    const timer = setTimeout(
+      () => timeoutMs === void 0 ? ctl.abort() : ctl.abort(
+        new DOMException(`no complete response within ${timeoutMs / 1e3} s`, "TimeoutError")
+      ),
+      timeoutMs ?? DEFAULT_TIMEOUT_MS
+    );
+    try {
+      let res;
+      try {
+        res = await fetchImpl(url, {
+          method,
+          headers,
+          body,
+          signal: signal ? AbortSignal.any([ctl.signal, signal]) : ctl.signal
+        });
+      } catch (err) {
+        return {
+          ok: false,
+          result: mcpUnreachable(baseUrl, err instanceof Error ? err.message : String(err))
+        };
+      } finally {
+        if (timeoutMs === void 0) clearTimeout(timer);
+      }
+      return await readResponse(res);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return {
+    async requestJson(input) {
+      const url = buildUrl(input.path, input.query);
+      const hasBody = input.body !== void 0;
+      const headers = buildHeaders(
+        input.scope,
+        hasBody ? "application/json" : void 0,
+        input.idempotencyKey
+      );
+      return send(
+        url,
+        input.method,
+        headers,
+        hasBody ? JSON.stringify(input.body) : void 0,
+        input
+      );
+    },
+    async requestMultipart(input) {
+      const url = buildUrl(input.path);
+      const headers = buildHeaders(input.scope, void 0, input.idempotencyKey);
+      const form = await input.formData();
+      return send(url, "POST", headers, form);
+    },
+    async requestBytes(input) {
+      const headers = buildHeaders(input.scope, "application/octet-stream", input.idempotencyKey);
+      for (const [name, value] of Object.entries(input.headers)) headers.set(name, value);
+      return send(buildUrl(input.path), input.method, headers, input.body, input);
+    }
+  };
+}
+async function readResponse(res) {
+  if (res.status === 401 || res.status === 403) {
+    return { ok: false, status: res.status, result: mcpAuthFailed(res.status) };
+  }
+  let text;
+  try {
+    text = await res.text();
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      status: res.status,
+      result: mcpEnvelopeError(
+        `Failed to read pyx-memory response (HTTP ${res.status}): ${reason}`
+      )
+    };
+  }
+  return parseHttpResponse(res, text);
+}
+function parseHttpResponse(res, text) {
+  if (res.ok && res.headers.get("content-type")?.includes("application/x-ndjson")) {
+    return parseNdjsonOutcome(res.status, text);
+  }
+  const parsed = parseJsonText(text);
+  const gateway = parsed.ok ? gatewayError(parsed.value) : void 0;
+  const failure = {
+    ok: false,
+    status: res.status,
+    code: parsed.ok ? extractEnvelopeCode(parsed.value) : void 0,
+    retryAfter: res.headers.get("retry-after") ?? void 0
+  };
+  if (res.status >= 500) {
+    return { ...failure, result: mcpServerError(res.status, gateway?.message ?? text) };
+  }
+  if (!parsed.ok) {
+    if (!res.ok) {
+      return { ...failure, result: mcpHttpError(res.status, text || "no body") };
+    }
+    return { ok: true, status: res.status, data: text };
+  }
+  if (!res.ok) {
+    const message = extractEnvelopeError(parsed.value) ?? gateway?.message ?? text ?? `HTTP ${res.status}`;
+    return { ...failure, result: mcpHttpError(res.status, message) };
+  }
+  const envelopeError = extractEnvelopeError(parsed.value);
+  if (envelopeError) {
+    return { ...failure, result: mcpEnvelopeError(envelopeError) };
+  }
+  return { ok: true, status: res.status, data: parsed.value };
+}
+function parseNdjsonOutcome(status, text) {
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    let frame;
+    try {
+      frame = JSON.parse(line);
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      return {
+        ok: false,
+        status,
+        result: mcpEnvelopeError(`pyx-memory sent an invalid NDJSON line: ${reason}`)
+      };
+    }
+    if (frame?.type === "result") return { ok: true, status, data: frame };
+    if (frame?.type === "error") {
+      return { ok: false, status, result: mcpEnvelopeError(JSON.stringify(frame)) };
+    }
+  }
+  return {
+    ok: false,
+    status,
+    result: mcpEnvelopeError("File ingest stream ended without a server result")
+  };
+}
+function parseJsonText(text) {
+  if (text.length === 0) return { ok: true, value: void 0 };
+  try {
+    return { ok: true, value: JSON.parse(text) };
+  } catch {
+    return { ok: false };
+  }
+}
+function gatewayError(parsed) {
+  if (parsed === null || typeof parsed !== "object") return void 0;
+  const error = parsed.error;
+  if (error === null || typeof error !== "object") return void 0;
+  const { code, message } = error;
+  return typeof code === "string" && typeof message === "string" ? { code, message } : void 0;
+}
+function extractEnvelopeCode(parsed) {
+  if (parsed === null || typeof parsed !== "object") return void 0;
+  const obj = parsed;
+  if (obj.success === false && typeof obj.code === "string") return obj.code;
+  return gatewayError(parsed)?.code;
+}
+function extractEnvelopeError(parsed) {
+  if (parsed === null || typeof parsed !== "object") return null;
+  const obj = parsed;
+  if (obj.success === false) {
+    if (typeof obj.error === "string") return obj.error;
+    if (typeof obj.message === "string") return obj.message;
+    return "pyx-memory returned success: false";
+  }
+  return null;
+}
+
+export {
+  mcpText,
+  mcpMissingCredentials,
+  mcpKeychainError,
+  mcpJson,
+  parseRetryAfterSeconds,
+  parseRetryAfterMs,
+  createHttpClient
+};

package/dist/chunk-UESIQ47D.mjs

@@ -0,0 +1,165 @@
+import {
+  createHttpClient
+} from "./chunk-THLUBOGD.mjs";
+import {
+  KeychainError,
+  credentialFingerprint,
+  getDefaultKeychain
+} from "./chunk-7TATCSSN.mjs";
+import {
+  EXIT
+} from "./chunk-4DXEQC6X.mjs";
+
+// src/cli/commands/read-surface.ts
+import { randomUUID } from "crypto";
+async function readSurface(opts) {
+  const provider = opts.keychain ?? getDefaultKeychain();
+  let credentials;
+  try {
+    credentials = await provider.read();
+  } catch (error) {
+    return {
+      ok: false,
+      exit: error instanceof KeychainError ? error.exit : EXIT.CRED_UNAVAILABLE,
+      state: "error",
+      endpoint: null,
+      keySource: null,
+      credentialFingerprint: null,
+      problem: error instanceof KeychainError ? [error.message, error.guidance].filter(Boolean).join(" ") : "The OS credential store could not be read."
+    };
+  }
+  if (!credentials) {
+    return {
+      ok: false,
+      exit: EXIT.NOT_LOGGED_IN,
+      state: "signed_out",
+      endpoint: null,
+      keySource: null,
+      credentialFingerprint: null,
+      problem: null
+    };
+  }
+  const fingerprint = credentialFingerprint(credentials.endpoint, credentials.apiKey);
+  if (!isHttpUrl(credentials.endpoint)) {
+    return {
+      ok: false,
+      exit: EXIT.DOCTOR_FAIL,
+      state: "error",
+      endpoint: null,
+      keySource: "keychain",
+      credentialFingerprint: fingerprint,
+      problem: "The stored pyx-memory endpoint is invalid. Run: pyx-mem login"
+    };
+  }
+  const http = createHttpClient(credentials, opts.fetchImpl ?? fetch);
+  const response = await http.requestJson({
+    ...opts.request,
+    idempotencyKey: `cli-${opts.surface}-${randomUUID()}`
+  });
+  if (!response.ok) {
+    return failedSurfaceRequest(
+      opts.surface,
+      response.status,
+      credentials.endpoint,
+      fingerprint,
+      opts.minimumServiceVersion,
+      http
+    );
+  }
+  const parsed = opts.schema.safeParse(response.data);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      exit: EXIT.DOCTOR_FAIL,
+      state: "error",
+      endpoint: credentials.endpoint,
+      keySource: "keychain",
+      credentialFingerprint: fingerprint,
+      problem: `pyx-memory returned an invalid ${opts.surface} response. Run: pyx-mem doctor`
+    };
+  }
+  return {
+    ok: true,
+    endpoint: credentials.endpoint,
+    credentialFingerprint: fingerprint,
+    data: parsed.data
+  };
+}
+async function failedSurfaceRequest(surface, status, endpoint, credentialFingerprint2, minimumServiceVersion, http) {
+  if (status === 401) {
+    return {
+      ok: false,
+      exit: EXIT.NOT_LOGGED_IN,
+      state: "signed_out",
+      endpoint,
+      keySource: "keychain",
+      credentialFingerprint: credentialFingerprint2,
+      problem: requestFailure(surface, status)
+    };
+  }
+  const serviceVersion = minimumServiceVersion ? await probeServiceVersion(http) : null;
+  const serviceOutdated = serviceVersion !== null && minimumServiceVersion !== void 0 && isVersionOlder(serviceVersion, minimumServiceVersion);
+  return {
+    ok: false,
+    exit: EXIT.DOCTOR_FAIL,
+    state: serviceOutdated ? "service_outdated" : "error",
+    endpoint,
+    keySource: "keychain",
+    credentialFingerprint: credentialFingerprint2,
+    problem: serviceOutdated ? `pyx-memory ${surface} requires service ${minimumServiceVersion} or newer; the connected service reports ${serviceVersion}. Update the hosted pyx-memory service or dashboard integration, then retry.` : requestFailure(surface, status)
+  };
+}
+async function probeServiceVersion(http) {
+  const response = await http.requestJson({ method: "GET", path: "/status" });
+  if (!response.ok) return null;
+  const payload = plainObject(response.data);
+  const topology = plainObject(payload?.success === true ? plainObject(payload.data) : payload);
+  const version = payload?.version ?? plainObject(topology?.service)?.version;
+  return typeof version === "string" && parseVersion(version) ? version : null;
+}
+function plainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function isVersionOlder(actual, minimum) {
+  const left = parseVersion(actual);
+  const right = parseVersion(minimum);
+  if (!left || !right) return false;
+  if (left.core[0] !== right.core[0]) return left.core[0] < right.core[0];
+  if (left.core[1] !== right.core[1]) return left.core[1] < right.core[1];
+  if (left.core[2] !== right.core[2]) return left.core[2] < right.core[2];
+  return left.prerelease !== null && right.prerelease === null;
+}
+function parseVersion(value) {
+  if (value.length > 64) return null;
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
+  if (!match) return null;
+  const core = [Number(match[1]), Number(match[2]), Number(match[3])];
+  return core.every(Number.isSafeInteger) ? { core, prerelease: match[4] ?? null } : null;
+}
+function requestFailure(surface, status) {
+  if (status === 401) {
+    return "Stored pyx-memory credentials were rejected. Run: pyx-mem login";
+  }
+  if (status === 403) {
+    return "pyx-memory denied access (HTTP 403). Check the key scope and project access.";
+  }
+  if (status === void 0) {
+    return "Unable to reach pyx-memory. Run: pyx-mem doctor";
+  }
+  if (status >= 500) {
+    return `pyx-memory is unavailable (HTTP ${status}). Run: pyx-mem doctor`;
+  }
+  return `pyx-memory ${surface} failed (HTTP ${status}). Run: pyx-mem doctor`;
+}
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+export {
+  readSurface
+};

package/dist/chunk-YBPODKB5.mjs

@@ -0,0 +1,132 @@
+import {
+  settle
+} from "./chunk-7IGU3HJO.mjs";
+import {
+  BUSY,
+  ERROR_MESSAGES,
+  JournalInvalidError,
+  KeychainError,
+  LockLostError,
+  convergenceSeconds,
+  createCliLoginApi,
+  credentialFingerprint,
+  getLifecycleKeychain,
+  isEmpty,
+  isKeyRef,
+  loadJournal,
+  saveJournal,
+  withLifecycleLock
+} from "./chunk-7TATCSSN.mjs";
+import {
+  EXIT
+} from "./chunk-4DXEQC6X.mjs";
+
+// src/cli/commands/logout.ts
+function lifecycleFailure(code, cleanupPending, err) {
+  return {
+    ok: false,
+    code,
+    // Keychain guidance is static text; any other error's text is never shown.
+    message: err instanceof KeychainError ? `${err.message} ${err.guidance}` : ERROR_MESSAGES[code].message,
+    retryable: ERROR_MESSAGES[code].retryable,
+    cleanupPending
+  };
+}
+async function cleanupPendingAfterFailure(keychain) {
+  try {
+    return !isEmpty(await loadJournal(keychain));
+  } catch {
+    return true;
+  }
+}
+async function logoutCommand(opts = {}) {
+  const keychain = opts.keychain ?? getLifecycleKeychain();
+  const api = createCliLoginApi(opts.fetchImpl);
+  const fail = (failure, exit) => {
+    if (opts.json) process.stdout.write(`${JSON.stringify(failure)}
+`);
+    else process.stderr.write(`Error: ${failure.message}
+`);
+    return exit;
+  };
+  try {
+    const result = await withLifecycleLock(keychain, (lockLost) => logout(lockLost));
+    return result === BUSY ? fail(lifecycleFailure("busy", false), EXIT.BUSY) : result;
+  } catch (err) {
+    const pending = await cleanupPendingAfterFailure(keychain);
+    if (err instanceof KeychainError) {
+      return fail(lifecycleFailure("credential_store_unavailable", pending, err), err.exit);
+    }
+    if (err instanceof LockLostError) {
+      return fail(lifecycleFailure("lock_lost", pending), EXIT.DOCTOR_FAIL);
+    }
+    if (err instanceof JournalInvalidError) {
+      return fail(lifecycleFailure("journal_invalid", true), EXIT.DOCTOR_FAIL);
+    }
+    return fail(lifecycleFailure("cleanup_pending", true), EXIT.CLEANUP_PENDING);
+  }
+  async function logout(lockLost) {
+    const journal = await loadJournal(keychain);
+    const selected = await keychain.read().catch((err) => {
+      if (err instanceof KeychainError && err.code === "credential-record-invalid") {
+        return "unreadable";
+      }
+      throw err;
+    });
+    const managed = selected !== null && selected !== "unreadable" && selected.provenance === "browser-login" && isKeyRef({ endpoint: selected.endpoint, apiKey: selected.apiKey }) ? { endpoint: selected.endpoint, apiKey: selected.apiKey } : null;
+    if (selected === null || selected === "unreadable") {
+      await keychain.delete();
+    } else {
+      journal.logout = {
+        fingerprint: credentialFingerprint(selected.endpoint, selected.apiKey),
+        revoke: managed
+      };
+      await saveJournal(keychain, journal);
+    }
+    const cleanupPending = !isEmpty(await settle(keychain, api, journal, lockLost));
+    if (await keychain.read() !== null) {
+      return fail(lifecycleFailure("credential_changed", cleanupPending), EXIT.DOCTOR_FAIL);
+    }
+    if (lockLost()) throw new LockLostError();
+    const convergence = convergenceSeconds(journal);
+    const revocationPending = journal.revoke.length > 0;
+    const serverRevocation = revocationPending ? "pending" : convergence !== null ? "revoked" : "not_attempted";
+    const legacy = selected !== null && managed === null;
+    const report = {
+      ok: true,
+      credentialKind: selected === null ? null : managed !== null ? "browser" : "legacy",
+      localDeleted: selected !== null,
+      serverRevocation,
+      cleanupPending,
+      reconnectRequired: selected !== null || serverRevocation !== "not_attempted",
+      // Proxies older than the per-request credential check hold the key in
+      // memory. A key that is still valid on the server keeps them working.
+      pendingLegacySessions: legacy || revocationPending,
+      serverConvergenceSeconds: convergence
+    };
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify(report)}
+`);
+    } else {
+      process.stdout.write(
+        selected === null ? "No pyx-memory credentials were stored.\n" : "pyx-memory credentials deleted from OS credential store.\n"
+      );
+      if (cleanupPending) {
+        process.stderr.write(
+          "The server-side key could not be revoked yet. Run: pyx-mem login-recovery\n"
+        );
+      } else if (report.pendingLegacySessions) {
+        process.stdout.write(
+          "The API key itself was not revoked (other computers may use it). Restart running agents; revoke the key in the dashboard to end it everywhere.\n"
+        );
+      }
+    }
+    return cleanupPending ? EXIT.CLEANUP_PENDING : EXIT.OK;
+  }
+}
+
+export {
+  lifecycleFailure,
+  cleanupPendingAfterFailure,
+  logoutCommand
+};