@sift-wiki/conductor 0.0.0 → 0.2.0-beta.1

package/dist/runtime/wakeEnvelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wakeEnvelope.js","sourceRoot":"","sources":["../../src/runtime/wakeEnvelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,+BAA+B,GAAG,mBAAmB,CAAC;AAEnE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9B,SAAS;IACT,MAAM;IACN,aAAa;IACb,WAAW;IACX,SAAS;IACT,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;KACxD,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KACrC,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;QAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACf,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACf,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,gBAAgB;KAC1B,CAAC,CAAC,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC/C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;KACtB,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,OAAO,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,121 @@
+import type { SiftWakeEnvelope } from "./runtime/wakeEnvelope.js";
+import type { WorkApproval, WorkArtifact, WorkArtifactInput, WorkChildTaskInput, WorkDisposition, WorkDispositionResponse, WorkTask, WorkTaskComment, WorkUsageDecision } from "./workTypes.js";
+export type JsonObject = Record<string, unknown>;
+export type ConductorConfig = {
+    apiBaseUrl: string;
+    credential: string;
+    conductorId?: string | undefined;
+    displayName: string;
+    protocolVersion: string;
+};
+export type ConfigStore = {
+    read(): Promise<ConductorConfig | undefined>;
+    write(config: ConductorConfig): Promise<void>;
+    delete(): Promise<void>;
+};
+export type PairConductorRequest = {
+    code: string;
+    displayName?: string;
+    version?: string;
+    protocolVersion?: string;
+    capabilities?: JsonObject;
+};
+export type PairConductorResponse = {
+    conductor: {
+        id: string;
+        displayName: string;
+    };
+    credential: string;
+};
+export type PairConductorClient = {
+    pair(request: PairConductorRequest): Promise<PairConductorResponse>;
+};
+export type ConductorAgentAdvertisement = {
+    localKey: string;
+    displayName: string;
+    adapterType: string;
+    status?: "active" | "inactive";
+    capabilities?: JsonObject;
+};
+export type ConductorAgent = {
+    id: string;
+    agentPrincipalId: string;
+    localKey: string;
+    displayName: string;
+    adapterType: string;
+    status: "active" | "inactive";
+    capabilities: JsonObject;
+};
+export type ClaimedJob = {
+    id: string;
+    runId: string;
+    conductorAgentId: string;
+    localKey: string;
+    adapterType: string;
+    objective: string;
+    taskRecordId?: string | undefined;
+    wakeRequestId?: string | undefined;
+    contextRefs: string[];
+    limits: JsonObject;
+    status: string;
+    attempts: number;
+    leaseExpiresAt?: string | undefined;
+    wakeEnvelope?: SiftWakeEnvelope | undefined;
+};
+export type LeaseRefresh = {
+    job: {
+        id: string;
+        runId: string;
+        status: string;
+        leaseExpiresAt?: string | undefined;
+    };
+    cancelRequested: boolean;
+};
+export type RunEventType = "health" | "progress" | "log" | "artifact" | "approval_requested" | "completed" | "failed" | "cancelled";
+export type RunEventInput = {
+    eventType: RunEventType;
+    payload?: JsonObject;
+    occurredAt?: string;
+};
+export type RunEvent = {
+    id: string;
+    runId: string;
+    sequence: number;
+    eventType: RunEventType;
+    payload: JsonObject;
+    occurredAt: string;
+};
+export type ConductorClient = PairConductorClient & {
+    heartbeat(credential: string, request: {
+        version?: string;
+        protocolVersion?: string;
+        capabilities?: JsonObject;
+    }): Promise<unknown>;
+    advertiseAgents(credential: string, agents: ConductorAgentAdvertisement[]): Promise<ConductorAgent[]>;
+    claimJob(credential: string): Promise<ClaimedJob | undefined>;
+    refreshLease(credential: string, jobId: string): Promise<LeaseRefresh>;
+    appendRunEvent(credential: string, runId: string, event: RunEventInput): Promise<RunEvent>;
+    completeRun(credential: string, runId: string, resultSummary: JsonObject): Promise<unknown>;
+    failRun(credential: string, runId: string, errorSummary: JsonObject): Promise<unknown>;
+    acknowledgeCancellation(credential: string, runId: string, resultSummary: JsonObject): Promise<unknown>;
+};
+export type ConductorWorkClient = {
+    readWorkContext(credential: string, runId: string, taskId: string): Promise<SiftWakeEnvelope>;
+    checkoutTask(credential: string, runId: string, taskId: string): Promise<WorkTask>;
+    createChildTasks(credential: string, runId: string, taskId: string, children: WorkChildTaskInput[]): Promise<WorkTask[]>;
+    addTaskComment(credential: string, runId: string, taskId: string, bodyMarkdown: string): Promise<WorkTaskComment>;
+    registerArtifact(credential: string, runId: string, taskId: string, artifact: WorkArtifactInput): Promise<WorkArtifact>;
+    requestApproval(credential: string, runId: string, taskId: string, request: {
+        type: string;
+        payload?: JsonObject;
+        idempotencyKey?: string;
+    }): Promise<WorkApproval>;
+    reportUsage(credential: string, runId: string, taskId: string, usage: {
+        eventKey: string;
+        costMicros: number;
+        durationMs: number;
+    }): Promise<WorkUsageDecision>;
+    setTaskDisposition(credential: string, runId: string, taskId: string, disposition: WorkDisposition, resultSummary?: JsonObject): Promise<WorkDispositionResponse>;
+    listTasks(userCredential: string, projectId?: string): Promise<WorkTask[]>;
+    listRuns(userCredential: string, taskId?: string): Promise<ClaimedJob[]>;
+};

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/userAuth/service.d.ts

@@ -0,0 +1,26 @@
+import type { ConfigStore } from "../types.js";
+import type { UserAuthorizationStatus, UserCredentialStore } from "./types.js";
+export declare class ConductorUserAuthorizationService {
+    private readonly input;
+    private pending;
+    private pendingTask;
+    private lastMessage;
+    constructor(input: {
+        configStore: ConfigStore;
+        credentialStore: UserCredentialStore;
+        fetch?: typeof fetch | undefined;
+        openBrowser(url: string): Promise<void>;
+        sleep?: ((ms: number) => Promise<void>) | undefined;
+        now?: (() => Date) | undefined;
+    });
+    status(): Promise<UserAuthorizationStatus>;
+    begin(beginInput?: {
+        apiBaseUrl?: string | undefined;
+        deviceLabel?: string | undefined;
+    }): Promise<UserAuthorizationStatus>;
+    signOut(): Promise<UserAuthorizationStatus>;
+    credential(): Promise<string>;
+    private poll;
+    private request;
+    private now;
+}

package/dist/userAuth/service.js

@@ -0,0 +1,170 @@
+import { hostname } from "node:os";
+import { z } from "zod";
+import { storedUserAuthorizationSchema } from "./types.js";
+const DEFAULT_CAPABILITIES = ["record:read", "record:write", "event:audit:read"];
+const deviceResponseSchema = z.object({
+    requestId: z.string(),
+    userCode: z.string(),
+    verificationUri: z.url(),
+    verificationUriComplete: z.url(),
+    expiresAt: z.iso.datetime(),
+    intervalSeconds: z.number().positive(),
+}).strict();
+const pendingResponseSchema = z.object({
+    status: z.enum(["authorization_pending", "slow_down"]),
+    intervalSeconds: z.number().positive(),
+    expiresAt: z.iso.datetime(),
+}).strict();
+const terminalStatusSchema = z.object({ status: z.enum(["access_denied", "expired_token"]) }).strict();
+export class ConductorUserAuthorizationService {
+    input;
+    pending;
+    pendingTask;
+    lastMessage;
+    constructor(input) {
+        this.input = input;
+    }
+    async status() {
+        if (this.pending !== undefined) {
+            return {
+                state: "pending",
+                storageKind: this.input.credentialStore.storageKind,
+                verificationUri: this.pending.verificationUri,
+                userCode: this.pending.userCode,
+                expiresAt: this.pending.expiresAt,
+            };
+        }
+        const stored = await this.input.credentialStore.read();
+        if (stored === undefined || Date.parse(stored.tokenExpiresAt) <= this.now().getTime()) {
+            return {
+                state: "signed_out",
+                storageKind: this.input.credentialStore.storageKind,
+                ...(this.lastMessage === undefined ? {} : { message: this.lastMessage }),
+            };
+        }
+        return {
+            state: "authorized",
+            storageKind: this.input.credentialStore.storageKind,
+            apiBaseUrl: stored.apiBaseUrl,
+            appBaseUrl: stored.appBaseUrl,
+            workspaceId: stored.workspaceId,
+            brainId: stored.brainId,
+            principalId: stored.principalId,
+            tokenLabel: stored.tokenLabel,
+            tokenExpiresAt: stored.tokenExpiresAt,
+            capabilities: stored.capabilities,
+        };
+    }
+    async begin(beginInput = {}) {
+        if (this.pending !== undefined)
+            return this.status();
+        const config = await this.input.configStore.read();
+        const apiBaseUrl = resolveApiBaseUrl(beginInput.apiBaseUrl ?? config?.apiBaseUrl);
+        const response = await this.request(apiBaseUrl, "/cli-auth/device", {
+            deviceLabel: clean(beginInput.deviceLabel) ?? config?.displayName ?? hostname(),
+            requestedCapabilities: DEFAULT_CAPABILITIES,
+        });
+        this.pending = deviceResponseSchema.parse(response);
+        this.lastMessage = undefined;
+        await this.input.openBrowser(this.pending.verificationUriComplete);
+        const pending = this.pending;
+        this.pendingTask = this.poll(apiBaseUrl, pending).finally(() => {
+            if (this.pending === pending)
+                this.pending = undefined;
+            this.pendingTask = undefined;
+        });
+        void this.pendingTask;
+        return this.status();
+    }
+    async signOut() {
+        this.pending = undefined;
+        this.lastMessage = undefined;
+        await this.input.credentialStore.delete();
+        return this.status();
+    }
+    async credential() {
+        const stored = await this.input.credentialStore.read();
+        if (stored === undefined || Date.parse(stored.tokenExpiresAt) <= this.now().getTime()) {
+            throw new Error("Sign in to Sift before managing shared work.");
+        }
+        return stored.token;
+    }
+    async poll(apiBaseUrl, pending) {
+        let intervalSeconds = pending.intervalSeconds;
+        while (this.now().getTime() < Date.parse(pending.expiresAt) && this.pending === pending) {
+            await (this.input.sleep ?? defaultSleep)(intervalSeconds * 1_000);
+            let body;
+            try {
+                body = await this.request(apiBaseUrl, "/cli-auth/device/token", {
+                    requestId: pending.requestId,
+                    userCode: pending.userCode,
+                });
+            }
+            catch {
+                continue;
+            }
+            const waiting = pendingResponseSchema.safeParse(body);
+            if (waiting.success) {
+                intervalSeconds = waiting.data.intervalSeconds;
+                continue;
+            }
+            const terminal = terminalStatusSchema.safeParse(body);
+            if (terminal.success) {
+                this.lastMessage = terminal.data.status === "access_denied" ? "Sift sign-in was denied." : "Sift sign-in expired.";
+                return;
+            }
+            await this.input.credentialStore.write(storedUserAuthorizationSchema.parse(body));
+            this.lastMessage = undefined;
+            return;
+        }
+        this.lastMessage = "Sift sign-in expired.";
+    }
+    async request(apiBaseUrl, route, body) {
+        const response = await (this.input.fetch ?? globalThis.fetch)(new URL(route, withTrailingSlash(apiBaseUrl)), {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        const parsed = await response.json();
+        if (!response.ok)
+            throw new Error(apiErrorMessage(parsed, response.status));
+        return parsed;
+    }
+    now() {
+        return (this.input.now ?? (() => new Date()))();
+    }
+}
+function resolveApiBaseUrl(value) {
+    if (value === undefined) {
+        throw new Error("A Sift API address is required before this computer is paired.");
+    }
+    const parsed = z.url().parse(value.trim());
+    const url = new URL(parsed);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url.hostname))) {
+        throw new Error("The Sift API address must use HTTPS or a loopback HTTP URL.");
+    }
+    return url.toString().replace(/\/+$/u, "");
+}
+function clean(value) {
+    const trimmed = value?.trim();
+    return trimmed === undefined || trimmed.length === 0 ? undefined : trimmed;
+}
+function isLoopback(hostname) {
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+}
+function withTrailingSlash(value) {
+    return value.endsWith("/") ? value : `${value}/`;
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function apiErrorMessage(body, status) {
+    if (typeof body === "object" && body !== null && "error" in body) {
+        const error = body.error;
+        if (typeof error === "object" && error !== null && "message" in error && typeof error.message === "string") {
+            return error.message;
+        }
+    }
+    return `Sift authorization failed (${String(status)}).`;
+}
+//# sourceMappingURL=service.js.map

package/dist/userAuth/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/userAuth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,oBAAoB,GAAqB,CAAC,aAAa,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;AAEnG,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,GAAG,EAAE;IACxB,uBAAuB,EAAE,CAAC,CAAC,GAAG,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAIvG,MAAM,OAAO,iCAAiC;IAKf;IAJrB,OAAO,CAAmC;IAC1C,WAAW,CAA4B;IACvC,WAAW,CAAqB;IAExC,YAA6B,KAO5B;QAP4B,UAAK,GAAL,KAAK,CAOjC;IAAG,CAAC;IAEL,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW;gBACnD,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;gBAC7C,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC/B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;aAClC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACtF,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW;gBACnD,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aACzE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,WAAW;YACnD,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,aAAoF,EAAE;QAChG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,UAAU,IAAI,MAAM,EAAE,UAAU,CAAC,CAAC;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,kBAAkB,EAAE;YAClE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,MAAM,EAAE,WAAW,IAAI,QAAQ,EAAE;YAC/E,qBAAqB,EAAE,oBAAoB;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACvD,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,WAAW,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,OAA6B;QAClE,IAAI,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACxF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC;YAClE,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,wBAAwB,EAAE;oBAC9D,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC3B,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBACnH,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,6BAA6B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,uBAAuB,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,KAAa,EAAE,IAAa;QACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC,EAAE;YAC3G,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAa,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,GAAG;QACT,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,KAAyB;IACtC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC5G,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,IAAa,EAAE,MAAc;IACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3G,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,8BAA8B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;AAC1D,CAAC"}

package/dist/userAuth/store.d.ts

@@ -0,0 +1,42 @@
+import { type StoredUserAuthorization, type UserCredentialStore } from "./types.js";
+type CommandResult = {
+    stdout: string;
+    stderr: string;
+};
+type CommandRunner = (file: string, args: string[]) => Promise<CommandResult>;
+type DpapiRunner = (operation: "protect" | "unprotect", value: string) => Promise<string>;
+export declare function createUserCredentialStore(input?: {
+    platform?: NodeJS.Platform | undefined;
+    metadataPath?: string | undefined;
+    secretPath?: string | undefined;
+}): UserCredentialStore;
+export declare class RestrictedFileUserCredentialStore implements UserCredentialStore {
+    readonly path: string;
+    readonly storageKind: "restricted-file";
+    constructor(path?: string);
+    read(): Promise<StoredUserAuthorization | undefined>;
+    write(value: StoredUserAuthorization): Promise<void>;
+    delete(): Promise<void>;
+}
+export declare class MacKeychainUserCredentialStore implements UserCredentialStore {
+    readonly metadataPath: string;
+    private readonly runCommand;
+    readonly storageKind: "macos-keychain";
+    constructor(metadataPath?: string, runCommand?: CommandRunner);
+    read(): Promise<StoredUserAuthorization | undefined>;
+    write(value: StoredUserAuthorization): Promise<void>;
+    delete(): Promise<void>;
+}
+export declare class WindowsDpapiUserCredentialStore implements UserCredentialStore {
+    readonly metadataPath: string;
+    readonly secretPath: string;
+    private readonly dpapi;
+    readonly storageKind: "windows-dpapi";
+    constructor(metadataPath?: string, secretPath?: string, dpapi?: DpapiRunner);
+    read(): Promise<StoredUserAuthorization | undefined>;
+    write(value: StoredUserAuthorization): Promise<void>;
+    delete(): Promise<void>;
+}
+export declare function defaultUserMetadataPath(env?: NodeJS.ProcessEnv): string;
+export declare function defaultUserSecretPath(env?: NodeJS.ProcessEnv): string;
+export {};

package/dist/userAuth/store.js

@@ -0,0 +1,160 @@
+import { execFile } from "node:child_process";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { defaultConfigPath } from "../config.js";
+import { storedUserAuthorizationSchema } from "./types.js";
+const execFileAsync = promisify(execFile);
+const KEYCHAIN_SERVICE = "wiki.sift.conductor.user";
+const KEYCHAIN_ACCOUNT = "default";
+const storedUserMetadataSchema = storedUserAuthorizationSchema.omit({ token: true });
+export function createUserCredentialStore(input = {}) {
+    const platform = input.platform ?? process.platform;
+    const metadataPath = input.metadataPath ?? defaultUserMetadataPath();
+    if (platform === "darwin")
+        return new MacKeychainUserCredentialStore(metadataPath);
+    if (platform === "win32") {
+        return new WindowsDpapiUserCredentialStore(metadataPath, input.secretPath ?? defaultUserSecretPath());
+    }
+    return new RestrictedFileUserCredentialStore(metadataPath);
+}
+export class RestrictedFileUserCredentialStore {
+    path;
+    storageKind = "restricted-file";
+    constructor(path = defaultUserMetadataPath()) {
+        this.path = path;
+    }
+    async read() {
+        const value = await readJsonIfPresent(this.path);
+        return value === undefined ? undefined : storedUserAuthorizationSchema.parse(value);
+    }
+    async write(value) {
+        await atomicPrivateJsonWrite(this.path, storedUserAuthorizationSchema.parse(value));
+    }
+    delete() {
+        return rm(this.path, { force: true });
+    }
+}
+export class MacKeychainUserCredentialStore {
+    metadataPath;
+    runCommand;
+    storageKind = "macos-keychain";
+    constructor(metadataPath = defaultUserMetadataPath(), runCommand = runExecFile) {
+        this.metadataPath = metadataPath;
+        this.runCommand = runCommand;
+    }
+    async read() {
+        const metadata = await readMetadata(this.metadataPath);
+        if (metadata === undefined)
+            return undefined;
+        let token;
+        try {
+            token = (await this.runCommand("security", ["find-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", KEYCHAIN_SERVICE, "-w"])).stdout.trim();
+        }
+        catch {
+            throw new Error("Sift Conductor user authorization is missing from macOS Keychain. Sign in again.");
+        }
+        return storedUserAuthorizationSchema.parse({ ...metadata, token });
+    }
+    async write(value) {
+        const parsed = storedUserAuthorizationSchema.parse(value);
+        const metadata = withoutToken(parsed);
+        await this.runCommand("security", ["add-generic-password", "-U", "-a", KEYCHAIN_ACCOUNT, "-s", KEYCHAIN_SERVICE, "-w", parsed.token]);
+        await atomicPrivateJsonWrite(this.metadataPath, metadata);
+    }
+    async delete() {
+        await this.runCommand("security", ["delete-generic-password", "-a", KEYCHAIN_ACCOUNT, "-s", KEYCHAIN_SERVICE]).catch(() => undefined);
+        await rm(this.metadataPath, { force: true });
+    }
+}
+export class WindowsDpapiUserCredentialStore {
+    metadataPath;
+    secretPath;
+    dpapi;
+    storageKind = "windows-dpapi";
+    constructor(metadataPath = defaultUserMetadataPath(), secretPath = defaultUserSecretPath(), dpapi = runDpapi) {
+        this.metadataPath = metadataPath;
+        this.secretPath = secretPath;
+        this.dpapi = dpapi;
+    }
+    async read() {
+        const metadata = await readMetadata(this.metadataPath);
+        if (metadata === undefined)
+            return undefined;
+        const encrypted = await readFile(this.secretPath, "utf8").catch(() => undefined);
+        if (encrypted === undefined)
+            throw new Error("Sift Conductor user authorization is missing from Windows credential storage. Sign in again.");
+        const token = await this.dpapi("unprotect", encrypted.trim());
+        return storedUserAuthorizationSchema.parse({ ...metadata, token });
+    }
+    async write(value) {
+        const parsed = storedUserAuthorizationSchema.parse(value);
+        const metadata = withoutToken(parsed);
+        const encrypted = await this.dpapi("protect", parsed.token);
+        await atomicPrivateTextWrite(this.secretPath, `${encrypted}\n`);
+        await atomicPrivateJsonWrite(this.metadataPath, metadata);
+    }
+    async delete() {
+        await Promise.all([rm(this.metadataPath, { force: true }), rm(this.secretPath, { force: true })]);
+    }
+}
+export function defaultUserMetadataPath(env = process.env) {
+    return path.join(path.dirname(defaultConfigPath(env)), "user-authorization.json");
+}
+export function defaultUserSecretPath(env = process.env) {
+    return path.join(path.dirname(defaultConfigPath(env)), "user-authorization.dpapi");
+}
+async function runDpapi(operation, value) {
+    const script = operation === "protect"
+        ? "$b=[Text.Encoding]::UTF8.GetBytes($env:SIFT_CONDUCTOR_SECRET);$e=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($e)"
+        : "$e=[Convert]::FromBase64String($env:SIFT_CONDUCTOR_SECRET);$b=[Security.Cryptography.ProtectedData]::Unprotect($e,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)";
+    const result = await execFileAsync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+        windowsHide: true,
+        env: { ...process.env, SIFT_CONDUCTOR_SECRET: value },
+    });
+    const output = result.stdout.trim();
+    if (output.length === 0)
+        throw new Error("Windows credential protection returned no data.");
+    return output;
+}
+async function readMetadata(filePath) {
+    const value = await readJsonIfPresent(filePath);
+    if (value === undefined)
+        return undefined;
+    return storedUserMetadataSchema.parse(value);
+}
+async function runExecFile(file, args) {
+    const result = await execFileAsync(file, args);
+    return { stdout: result.stdout, stderr: result.stderr };
+}
+async function readJsonIfPresent(filePath) {
+    try {
+        return JSON.parse(await readFile(filePath, "utf8"));
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+async function atomicPrivateJsonWrite(filePath, value) {
+    await atomicPrivateTextWrite(filePath, `${JSON.stringify(value, null, 2)}\n`);
+}
+async function atomicPrivateTextWrite(filePath, value) {
+    await mkdir(path.dirname(filePath), { recursive: true });
+    const temporary = `${filePath}.${String(process.pid)}.tmp`;
+    await writeFile(temporary, value, { mode: 0o600 });
+    await chmod(temporary, 0o600);
+    await rename(temporary, filePath);
+    await chmod(filePath, 0o600);
+}
+function withoutToken(value) {
+    const { token, ...metadata } = storedUserAuthorizationSchema.parse(value);
+    if (token.length === 0)
+        throw new Error("Stored Sift user token is empty.");
+    return storedUserMetadataSchema.parse(metadata);
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+//# sourceMappingURL=store.js.map

package/dist/userAuth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/userAuth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,6BAA6B,EAA0D,MAAM,YAAY,CAAC;AAEnH,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAOrF,MAAM,UAAU,yBAAyB,CAAC,QAItC,EAAE;IACJ,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,uBAAuB,EAAE,CAAC;IACrE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC;IACnF,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,+BAA+B,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,IAAI,qBAAqB,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,iCAAiC,CAAC,YAAY,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,OAAO,iCAAiC;IAGvB;IAFZ,WAAW,GAAG,iBAA0B,CAAC;IAElD,YAAqB,OAAO,uBAAuB,EAAE;QAAhC,SAAI,GAAJ,IAAI,CAA4B;IAAG,CAAC;IAEzD,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA8B;QACxC,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,8BAA8B;IAI9B;IACQ;IAJV,WAAW,GAAG,gBAAyB,CAAC;IAEjD,YACW,eAAe,uBAAuB,EAAE,EAChC,aAA4B,WAAW;QAD/C,iBAAY,GAAZ,YAAY,CAA4B;QAChC,eAAU,GAAV,UAAU,CAA6B;IACvD,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7I,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,6BAA6B,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA8B;QACxC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtI,MAAM,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtI,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IAI/B;IACA;IACQ;IALV,WAAW,GAAG,eAAwB,CAAC;IAEhD,YACW,eAAe,uBAAuB,EAAE,EACxC,aAAa,qBAAqB,EAAE,EAC5B,QAAqB,QAAQ;QAFrC,iBAAY,GAAZ,YAAY,CAA4B;QACxC,eAAU,GAAV,UAAU,CAA0B;QAC5B,UAAK,GAAL,KAAK,CAAwB;IAC7C,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAC7I,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,OAAO,6BAA6B,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAA8B;QACxC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,SAAS,IAAI,CAAC,CAAC;QAChE,MAAM,sBAAsB,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;AACrF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,SAAkC,EAAE,KAAa;IACvE,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS;QACpC,CAAC,CAAC,kNAAkN;QACpN,CAAC,CAAC,uNAAuN,CAAC;IAC5N,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;QAC1G,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,EAAE;KACtD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAc;IACrD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAY,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,KAAc;IACpE,MAAM,sBAAsB,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,KAAa;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAC3D,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC;AACnD,CAAC"}

package/dist/userAuth/types.d.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+export declare const userCapabilitySchema: z.ZodEnum<{
+    "source:write": "source:write";
+    "source:manage": "source:manage";
+    "record:read": "record:read";
+    "record:write": "record:write";
+    "skill:update": "skill:update";
+    "event:audit:read": "event:audit:read";
+    "workspace:govern": "workspace:govern";
+    "workspace:own": "workspace:own";
+}>;
+export type UserCapability = z.infer<typeof userCapabilitySchema>;
+export declare const storedUserAuthorizationSchema: z.ZodObject<{
+    apiBaseUrl: z.ZodURL;
+    appBaseUrl: z.ZodURL;
+    token: z.ZodString;
+    tokenId: z.ZodString;
+    tokenLabel: z.ZodString;
+    tokenExpiresAt: z.ZodISODateTime;
+    workspaceId: z.ZodString;
+    brainId: z.ZodString;
+    principalId: z.ZodString;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "source:write": "source:write";
+        "source:manage": "source:manage";
+        "record:read": "record:read";
+        "record:write": "record:write";
+        "skill:update": "skill:update";
+        "event:audit:read": "event:audit:read";
+        "workspace:govern": "workspace:govern";
+        "workspace:own": "workspace:own";
+    }>>;
+}, z.core.$strict>;
+export type StoredUserAuthorization = z.infer<typeof storedUserAuthorizationSchema>;
+export type UserCredentialStore = {
+    readonly storageKind: "macos-keychain" | "windows-dpapi" | "restricted-file" | "memory";
+    read(): Promise<StoredUserAuthorization | undefined>;
+    write(value: StoredUserAuthorization): Promise<void>;
+    delete(): Promise<void>;
+};
+export type UserAuthorizationStatus = {
+    state: "signed_out";
+    storageKind: UserCredentialStore["storageKind"];
+    message?: string | undefined;
+} | {
+    state: "pending";
+    storageKind: UserCredentialStore["storageKind"];
+    verificationUri: string;
+    userCode: string;
+    expiresAt: string;
+} | {
+    state: "authorized";
+    storageKind: UserCredentialStore["storageKind"];
+    apiBaseUrl: string;
+    appBaseUrl: string;
+    workspaceId: string;
+    brainId: string;
+    principalId: string;
+    tokenLabel: string;
+    tokenExpiresAt: string;
+    capabilities: UserCapability[];
+};
+export declare const userAuthorizationStatusSchema: z.ZodType<UserAuthorizationStatus>;

package/dist/userAuth/types.js

@@ -0,0 +1,29 @@
+import { z } from "zod";
+export const userCapabilitySchema = z.enum([
+    "source:write",
+    "source:manage",
+    "record:read",
+    "record:write",
+    "skill:update",
+    "event:audit:read",
+    "workspace:govern",
+    "workspace:own",
+]);
+export const storedUserAuthorizationSchema = z.object({
+    apiBaseUrl: z.url(),
+    appBaseUrl: z.url(),
+    token: z.string().min(1),
+    tokenId: z.string().min(1),
+    tokenLabel: z.string().min(1),
+    tokenExpiresAt: z.iso.datetime(),
+    workspaceId: z.string().min(1),
+    brainId: z.string().min(1),
+    principalId: z.string().min(1),
+    capabilities: z.array(userCapabilitySchema),
+}).strict();
+export const userAuthorizationStatusSchema = z.discriminatedUnion("state", [
+    z.object({ state: z.literal("signed_out"), storageKind: z.enum(["macos-keychain", "windows-dpapi", "restricted-file", "memory"]), message: z.string().optional() }).strict(),
+    z.object({ state: z.literal("pending"), storageKind: z.enum(["macos-keychain", "windows-dpapi", "restricted-file", "memory"]), verificationUri: z.url(), userCode: z.string(), expiresAt: z.iso.datetime() }).strict(),
+    z.object({ state: z.literal("authorized"), storageKind: z.enum(["macos-keychain", "windows-dpapi", "restricted-file", "memory"]), apiBaseUrl: z.url(), appBaseUrl: z.url(), workspaceId: z.string(), brainId: z.string(), principalId: z.string(), tokenLabel: z.string(), tokenExpiresAt: z.iso.datetime(), capabilities: z.array(userCapabilitySchema) }).strict(),
+]);
+//# sourceMappingURL=types.js.map