@pyxmate/memory 1.27.0 → 1.27.2

package/dist/login-browser-DO2O2Q2G.mjs

@@ -0,0 +1,407 @@
+import {
+  settle
+} from "./chunk-7IGU3HJO.mjs";
+import {
+  ERROR_MESSAGES,
+  JournalInvalidError,
+  KeychainError,
+  createCliLoginApi,
+  credentialFingerprint,
+  getLifecycleKeychain,
+  hasRoomForLogin,
+  isEmpty,
+  isKeyRef,
+  loadJournal,
+  parseEndpoint,
+  releaseLifecycleLock,
+  saveJournal
+} from "./chunk-7TATCSSN.mjs";
+import {
+  EXIT
+} from "./chunk-4DXEQC6X.mjs";
+
+// src/cli/commands/login-browser.ts
+import { spawn } from "child_process";
+import { createHash as createHash2, randomBytes } from "crypto";
+import { hostname } from "os";
+import { createInterface } from "readline";
+
+// src/cli/lifecycle/callback-server.ts
+import { createHash, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+var CALLBACK_PATH = "/pyx-memory/callback";
+var CODE_RE = /^[A-Za-z0-9_-]{43}$/;
+var STYLES = `
+:root { color-scheme: dark; font-family: "Avenir Next", "Trebuchet MS", sans-serif; }
+* { box-sizing: border-box; }
+body {
+  margin: 0; min-height: 100vh; min-height: 100svh; padding: 32px 20px;
+  display: flex; color: #f7f8fb; background: #0b0b0e;
+  background-image: radial-gradient(ellipse at 50% 55%, #0071e31c, transparent 65%);
+}
+main { width: 100%; max-width: 496px; margin: auto; }
+.brand { margin: 0 0 20px 8px; font-size: 15px; font-weight: 600; letter-spacing: -.02em; }
+.brand span { margin-left: 8px; color: #a9adb8; font-weight: 400; }
+.card {
+  padding: clamp(24px, 6vw, 40px); border: 1px solid #30333c; border-radius: 28px;
+  background: #15161c; box-shadow: 0 24px 80px #0006;
+}
+.symbol {
+  display: grid; place-items: center; width: 64px; height: 64px; margin-bottom: 32px;
+  border: 1px solid #2c4059; border-radius: 20px; color: #6ab4ff; background: #12263a;
+}
+.continue .symbol { animation: arrive 360ms cubic-bezier(.22, 1, .36, 1); }
+.cancelled .symbol { color: #a9adb8; background: #20222b; border-color: #383b47; }
+.invalid .symbol { color: #f4bd7a; background: #302719; border-color: #59462d; }
+h1 {
+  margin: 0 0 20px; font-size: clamp(28px, 6vw, 40px); font-weight: 600;
+  line-height: 1.12; letter-spacing: -.035em; overflow-wrap: break-word;
+}
+p { margin: 0; color: #a9adb8; font-size: 16px; line-height: 1.65; }
+.note { margin-top: 32px; padding-top: 24px; border-top: 1px solid #30333c; font-size: 14px; }
+@keyframes arrive { from { opacity: .65; transform: translateY(4px); } }
+@media (prefers-reduced-motion: reduce) { .continue .symbol { animation: none; } }
+`;
+var PAGE_CSP = `default-src 'none'; style-src 'sha256-${createHash("sha256").update(STYLES).digest("base64")}'; base-uri 'none'; form-action 'none'`;
+var page = (state, title, text, icon) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title} \xB7 Pyx Memory</title>
+<style>${STYLES}</style>
+</head>
+<body>
+<main class="${state}">
+<div class="brand">pyx<span>Memory</span></div>
+<section class="card" aria-labelledby="title">
+<div class="symbol" aria-hidden="true"><svg width="30" height="30" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">${icon}</svg></div>
+<h1 id="title">${title}</h1>
+<p>${text}</p>
+<p class="note">You can close this tab.</p>
+</section>
+</main>
+</body>
+</html>`;
+var ACCEPTED_PAGE = page(
+  "continue",
+  "Continue in your app",
+  "Your approval was received. Return to the app that started this sign-in to finish connecting.",
+  '<path d="m9 4-5 5 5 5M4 9h10a6 6 0 0 1 0 12h-2"/>'
+);
+var DENIED_PAGE = page(
+  "cancelled",
+  "Sign-in cancelled",
+  "Return to the app that started this sign-in. You can try again there whenever you\u2019re ready.",
+  '<path d="m7 7 10 10M17 7 7 17"/>'
+);
+var REJECTED_PAGE = page(
+  "invalid",
+  "This sign-in link isn\u2019t valid",
+  "Return to the app that started this sign-in to continue or try again.",
+  '<path d="M12 6v7m0 4v.01"/><circle cx="12" cy="12" r="10"/>'
+);
+function sameSecret(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function single(params, key) {
+  const values = params.getAll(key);
+  return values.length === 1 ? values[0] : null;
+}
+async function startCallbackServer() {
+  let expected = null;
+  let settle2 = () => {
+  };
+  const result = new Promise((resolve) => {
+    settle2 = resolve;
+  });
+  function accept(method, host, rawUrl) {
+    if (method !== "GET" || expected === null || host !== `127.0.0.1:${port}`) return null;
+    const url = new URL(rawUrl, `http://127.0.0.1:${port}`);
+    if (url.pathname !== CALLBACK_PATH) return null;
+    const params = url.searchParams;
+    const keys = new Set(params.keys());
+    const code = single(params, "code");
+    const error = single(params, "error");
+    if (keys.size !== 3 || single(params, "request") !== expected.requestId || !sameSecret(single(params, "state") ?? "", expected.state)) {
+      return null;
+    }
+    if (code !== null && CODE_RE.test(code)) return { code };
+    if (error === "access_denied") return { denied: true };
+    return null;
+  }
+  const server = createServer({ maxHeaderSize: 8192 }, (req, res) => {
+    const accepted = accept(req.method, req.headers.host, req.url ?? "");
+    if (accepted !== null) {
+      expected = null;
+      settle2(accepted);
+    }
+    res.writeHead(accepted === null ? 400 : 200, {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": PAGE_CSP,
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff",
+      Connection: "close"
+    });
+    res.end(accepted === null ? REJECTED_PAGE : "denied" in accepted ? DENIED_PAGE : ACCEPTED_PAGE);
+  });
+  server.requestTimeout = 5e3;
+  server.headersTimeout = 5e3;
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  const port = server.address().port;
+  return {
+    port,
+    expect(requestId, state) {
+      expected = { requestId, state };
+    },
+    result,
+    close() {
+      server.close();
+      server.closeAllConnections();
+    }
+  };
+}
+
+// src/cli/commands/login-browser.ts
+var DEFAULT_ENDPOINT = "https://memory.api.pyxmate.com";
+var MAX_STDIN_LINE = 1024;
+var Stop = class extends Error {
+  constructor(outcome) {
+    super(outcome);
+    this.outcome = outcome;
+  }
+  outcome;
+};
+function stopFor(failure) {
+  return new Stop(failure.code === "cancelled" ? "requested" : failure.code);
+}
+function printHuman(e) {
+  if (e.event === "awaiting_browser") {
+    process.stdout.write(`Sign in with your browser:
+${e.authorizationUrl}
+`);
+  } else if (e.event === "connecting") {
+    process.stdout.write("Finishing sign-in\u2026\n");
+  } else if (e.event === "connected") {
+    process.stdout.write(
+      `Connected to ${e.connection.projectName} as ${e.connection.accountLabel}. Run: pyx-mem doctor
+`
+    );
+  } else if (e.event === "cancelled") {
+    process.stdout.write("Sign-in cancelled. Stored credentials were not changed.\n");
+  } else {
+    process.stderr.write(`Error: ${e.message}
+`);
+  }
+  if ("cleanupPending" in e && e.cleanupPending && e.event !== "error") {
+    process.stderr.write("Server-side cleanup is pending. Run: pyx-mem login-recovery\n");
+  }
+}
+function openInBrowser(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => {
+    process.stderr.write(
+      "Could not open a browser automatically. Open the sign-in URL yourself.\n"
+    );
+  });
+  child.unref();
+}
+function exitFor(outcome) {
+  if (outcome === "requested" || outcome === "denied") return EXIT.CANCELLED;
+  if (outcome === "busy") return EXIT.BUSY;
+  if (outcome === "cleanup_pending") return EXIT.CLEANUP_PENDING;
+  if (outcome === "invalid_endpoint") return EXIT.USAGE;
+  return EXIT.DOCTOR_FAIL;
+}
+async function snapshot(keychain) {
+  try {
+    const credentials = await keychain.read();
+    return {
+      token: credentials === null ? "none" : credentialFingerprint(credentials.endpoint, credentials.apiKey),
+      credentials
+    };
+  } catch (err) {
+    if (err instanceof KeychainError && err.code === "credential-record-invalid") {
+      return { token: "invalid", credentials: null };
+    }
+    throw err;
+  }
+}
+async function browserLoginCommand(opts) {
+  const keychain = opts.keychain ?? getLifecycleKeychain();
+  const api = createCliLoginApi(opts.fetchImpl);
+  const emit = opts.json ? (e) => process.stdout.write(`${JSON.stringify(e)}
+`) : printHuman;
+  const stop = new AbortController();
+  let lockLost = false;
+  const cancel = () => stop.abort();
+  const stopped = new Promise((_, reject) => {
+    stop.signal.addEventListener("abort", () => reject(new Stop("requested")));
+  });
+  stopped.catch(() => {
+  });
+  const check = () => {
+    if (lockLost) throw new Stop("lock_lost");
+    if (stop.signal.aborted) throw new Stop("requested");
+  };
+  process.once("SIGINT", cancel);
+  process.once("SIGTERM", cancel);
+  const lines = opts.json ? createInterface({ input: opts.input ?? process.stdin }) : null;
+  lines?.on("line", (line) => {
+    if (line.length > MAX_STDIN_LINE) return;
+    try {
+      if (JSON.parse(line)?.action === "cancel") cancel();
+    } catch {
+    }
+  });
+  if (opts.noOpen) lines?.on("close", cancel);
+  let release = null;
+  let listener = null;
+  let journal = null;
+  let connected = null;
+  let outcome = null;
+  let storeError = null;
+  try {
+    release = await keychain.acquireLock(() => {
+      lockLost = true;
+      cancel();
+    });
+    if (release === null) throw new Stop("busy");
+    journal = await settle(keychain, api, await loadJournal(keychain), () => lockLost);
+    if (journal.login !== null) throw new Stop("cleanup_pending");
+    const base = await snapshot(keychain);
+    const endpoint = parseEndpoint(opts.endpoint ?? base.credentials?.endpoint ?? DEFAULT_ENDPOINT);
+    if (endpoint === null) throw new Stop("invalid_endpoint");
+    const replaced = base.credentials ? { endpoint: base.credentials.endpoint, apiKey: base.credentials.apiKey } : null;
+    const previous = replaced !== null && base.credentials?.provenance === "browser-login" && isKeyRef(replaced) ? replaced : void 0;
+    if (!hasRoomForLogin(journal, endpoint, previous)) throw new Stop("cleanup_pending");
+    listener = await startCallbackServer();
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const started = await api.start(
+      endpoint,
+      {
+        codeChallenge: createHash2("sha256").update(codeVerifier).digest("base64url"),
+        callbackPort: listener.port,
+        state,
+        deviceLabel: hostname().replace(/\p{Cc}/gu, "").trim().slice(0, 64) || "this computer"
+      },
+      stop.signal
+    );
+    check();
+    if (!started.ok) throw stopFor(started);
+    const login = {
+      phase: "started",
+      endpoint,
+      requestId: started.requestId,
+      codeVerifier,
+      expiresAt: started.expiresAt.getTime()
+    };
+    journal.login = login;
+    await saveJournal(keychain, journal);
+    check();
+    listener.expect(started.requestId, state);
+    emit({
+      event: "awaiting_browser",
+      authorizationUrl: started.authorizationUrl,
+      expiresAt: started.expiresAt.toISOString()
+    });
+    if (!opts.noOpen) (opts.openBrowser ?? openInBrowser)(started.authorizationUrl);
+    let expiry;
+    const expired = new Promise((_, reject) => {
+      const ms = Math.min(Math.max(started.expiresAt.getTime() - Date.now(), 0), 6e5);
+      expiry = setTimeout(() => reject(new Stop("expired")), ms);
+    });
+    const callback = await Promise.race([listener.result, stopped, expired]).finally(
+      () => clearTimeout(expiry)
+    );
+    check();
+    if ("denied" in callback) throw new Stop("denied");
+    emit({ event: "connecting" });
+    const redeemed = await api.redeem(login, callback.code, stop.signal);
+    check();
+    if (!redeemed.ok) throw stopFor(redeemed);
+    const issued = { ...login, phase: "issued", apiKey: redeemed.apiKey };
+    journal.login = issued;
+    await saveJournal(keychain, journal);
+    check();
+    const confirmed = await api.confirm(issued, stop.signal);
+    check();
+    if (!confirmed.ok) throw stopFor(confirmed);
+    const current = (await loadJournal(keychain)).login;
+    if (current?.requestId !== issued.requestId || current.phase !== "issued") {
+      throw new Stop("lock_lost");
+    }
+    journal.login = { ...issued, phase: "committing", ...previous ? { previous } : {} };
+    await saveJournal(keychain, journal);
+    check();
+    if ((await snapshot(keychain)).token !== base.token) throw new Stop("credential_changed");
+    check();
+    const fingerprint = credentialFingerprint(endpoint, redeemed.apiKey);
+    try {
+      await keychain.write({
+        schemaVersion: 1,
+        endpoint,
+        apiKey: redeemed.apiKey,
+        connection: redeemed.connection,
+        provenance: "browser-login"
+      });
+    } catch (err) {
+      if ((await snapshot(keychain)).token !== fingerprint) throw err;
+    }
+    connected = { connection: redeemed.connection, fingerprint };
+  } catch (err) {
+    if (err instanceof Stop) outcome = err.outcome;
+    else if (err instanceof JournalInvalidError) outcome = "journal_invalid";
+    else if (err instanceof KeychainError) {
+      storeError = err;
+      outcome = "credential_store_unavailable";
+    } else outcome = "login_failed";
+  }
+  listener?.close();
+  lines?.close();
+  process.off("SIGINT", cancel);
+  process.off("SIGTERM", cancel);
+  let cleanupPending = outcome !== "busy";
+  if (journal !== null && !lockLost) {
+    try {
+      cleanupPending = !isEmpty(await settle(keychain, api, journal, () => lockLost));
+    } catch {
+      cleanupPending = true;
+    }
+  }
+  if (release !== null) await releaseLifecycleLock(release);
+  if (connected !== null) {
+    emit({
+      event: "connected",
+      connection: connected.connection,
+      credentialFingerprint: connected.fingerprint,
+      cleanupPending
+    });
+    return EXIT.OK;
+  }
+  if (outcome === "requested" || outcome === "denied") {
+    emit({ event: "cancelled", reason: outcome, cleanupPending });
+    return EXIT.CANCELLED;
+  }
+  const code = outcome ?? "login_failed";
+  emit({
+    event: "error",
+    code,
+    message: storeError ? `${storeError.message} ${storeError.guidance}` : ERROR_MESSAGES[code].message,
+    retryable: ERROR_MESSAGES[code].retryable,
+    cleanupPending
+  });
+  return storeError?.exit ?? exitFor(code);
+}
+export {
+  DEFAULT_ENDPOINT,
+  browserLoginCommand
+};

package/dist/login-recovery-AOO76PYX.mjs

@@ -0,0 +1,97 @@
+import {
+  cleanupPendingAfterFailure,
+  lifecycleFailure
+} from "./chunk-YBPODKB5.mjs";
+import {
+  settle
+} from "./chunk-7IGU3HJO.mjs";
+import {
+  BUSY,
+  JournalInvalidError,
+  KeychainError,
+  LockLostError,
+  convergenceSeconds,
+  createCliLoginApi,
+  credentialFingerprint,
+  emptyJournal,
+  getLifecycleKeychain,
+  isEmpty,
+  isKeyRef,
+  loadJournal,
+  saveJournal,
+  withLifecycleLock
+} from "./chunk-7TATCSSN.mjs";
+import {
+  EXIT
+} from "./chunk-4DXEQC6X.mjs";
+
+// src/cli/commands/login-recovery.ts
+async function signOutJournal(keychain) {
+  const journal = emptyJournal();
+  const shared = await keychain.read().catch((err) => {
+    if (err instanceof KeychainError && err.code === "credential-record-invalid") return null;
+    throw err;
+  });
+  if (shared !== null) {
+    const key = { endpoint: shared.endpoint, apiKey: shared.apiKey };
+    journal.logout = {
+      fingerprint: credentialFingerprint(shared.endpoint, shared.apiKey),
+      revoke: shared.provenance === "browser-login" && isKeyRef(key) ? key : null
+    };
+  }
+  await saveJournal(keychain, journal);
+  return journal;
+}
+async function loginRecoveryCommand(opts = {}) {
+  const keychain = opts.keychain ?? getLifecycleKeychain();
+  const fail = (failure, exit) => {
+    if (opts.json) process.stdout.write(`${JSON.stringify(failure)}
+`);
+    else process.stderr.write(`Error: ${failure.message}
+`);
+    return exit;
+  };
+  try {
+    const journal = await withLifecycleLock(keychain, async (lockLost) => {
+      const loaded = await loadJournal(keychain).catch((err) => {
+        if (err instanceof JournalInvalidError && opts.discardUnreadableJournal) {
+          return signOutJournal(keychain);
+        }
+        throw err;
+      });
+      const settled = await settle(keychain, createCliLoginApi(opts.fetchImpl), loaded, lockLost);
+      if (lockLost()) throw new LockLostError();
+      return settled;
+    });
+    if (journal === BUSY) return fail(lifecycleFailure("busy", true), EXIT.BUSY);
+    if (!isEmpty(journal)) {
+      return fail(lifecycleFailure("cleanup_pending", true), EXIT.CLEANUP_PENDING);
+    }
+    const convergence = convergenceSeconds(journal);
+    const report = {
+      ok: true,
+      cleanupPending: false,
+      serverRevocation: convergence !== null ? "revoked" : "not_attempted",
+      serverConvergenceSeconds: convergence
+    };
+    if (opts.json) process.stdout.write(`${JSON.stringify(report)}
+`);
+    else process.stdout.write("Nothing is pending.\n");
+    return EXIT.OK;
+  } catch (err) {
+    if (err instanceof JournalInvalidError) {
+      return fail(lifecycleFailure("journal_invalid", true), EXIT.DOCTOR_FAIL);
+    }
+    const pending = await cleanupPendingAfterFailure(keychain);
+    if (err instanceof KeychainError) {
+      return fail(lifecycleFailure("credential_store_unavailable", pending, err), err.exit);
+    }
+    if (err instanceof LockLostError) {
+      return fail(lifecycleFailure("lock_lost", pending), EXIT.DOCTOR_FAIL);
+    }
+    return fail(lifecycleFailure("cleanup_pending", true), EXIT.CLEANUP_PENDING);
+  }
+}
+export {
+  loginRecoveryCommand
+};

package/dist/logout-4CO53LNA.mjs

@@ -0,0 +1,13 @@
+import {
+  cleanupPendingAfterFailure,
+  lifecycleFailure,
+  logoutCommand
+} from "./chunk-YBPODKB5.mjs";
+import "./chunk-7IGU3HJO.mjs";
+import "./chunk-7TATCSSN.mjs";
+import "./chunk-4DXEQC6X.mjs";
+export {
+  cleanupPendingAfterFailure,
+  lifecycleFailure,
+  logoutCommand
+};