@sipher.dev/agents 0.1.0 → 0.1.2

package/dist/local-machine-controller-CjOyllJj.js

@@ -0,0 +1,453 @@
+import { A as insecureTlsForServer, C as MachineClaimError, D as discoverDeployment, a as installDeploymentConnector, b as resolveConnectorProfileContext, f as normalizeServerUrl, g as runServiceCommand, j as tlsFailureHint, k as fetchForConfiguredServer, u as removeConnectorRegistry, w as MachineClient } from "./release-resolver-PnPDodU9.js";
+import { hostname } from "node:os";
+import { rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { setTimeout } from "node:timers/promises";
+//#region src/auth-client.ts
+const REQUEST_TIMEOUT_MS = 3e4;
+var CliAuthClient = class {
+	serverUrl;
+	tlsOptions;
+	constructor(serverUrl, tlsOptions = {}) {
+		this.serverUrl = serverUrl;
+		this.tlsOptions = tlsOptions;
+	}
+	async startDeviceAuthorization(input) {
+		const body = {
+			deployment_id: input.deploymentId,
+			connector_install_id: input.connectorInstallId,
+			service_key: input.serviceKey,
+			challenge: input.challenge,
+			...input.expectedMachineId ? { expected_machine_id: input.expectedMachineId } : {},
+			...input.deviceLabel ? { device_label: input.deviceLabel } : {},
+			...input.bootstrap ? {
+				policy_digest: input.bootstrap.policyDigest,
+				release_tuple: input.bootstrap.releaseTuple
+			} : {}
+		};
+		const response = await postJson(new URL("/api/cli/oauth/device", this.serverUrl), body, this.tlsOptions);
+		return {
+			deviceCode: readString(response, "device_code"),
+			userCode: readString(response, "user_code"),
+			verificationUri: readString(response, "verification_uri"),
+			verificationUriComplete: readString(response, "verification_uri_complete"),
+			expiresIn: readNumber(response, "expires_in"),
+			interval: readNumber(response, "interval")
+		};
+	}
+	async pollDeviceToken(deviceCode) {
+		return parseTokenResponse(await postForm(new URL("/api/cli/oauth/token", this.serverUrl), {
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			device_code: deviceCode
+		}, this.tlsOptions));
+	}
+	async refresh(refreshToken) {
+		return parseTokenResponse(await postForm(new URL("/api/cli/oauth/token", this.serverUrl), {
+			grant_type: "refresh_token",
+			refresh_token: refreshToken
+		}, this.tlsOptions));
+	}
+	async revoke(refreshToken) {
+		await postForm(new URL("/api/cli/oauth/revoke", this.serverUrl), { refresh_token: refreshToken }, this.tlsOptions);
+	}
+};
+async function postJson(url, body, tlsOptions) {
+	const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	let response;
+	try {
+		response = await fetchForConfiguredServer(url, {
+			method: "POST",
+			redirect: "manual",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(body),
+			signal
+		}, tlsOptions);
+	} catch (error) {
+		throw new Error(tlsFailureHint(error) ?? "CLI auth request failed: fetch failed.");
+	}
+	return readResponse(response);
+}
+async function postForm(url, body, tlsOptions) {
+	const signal = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	let response;
+	try {
+		response = await fetchForConfiguredServer(url, {
+			method: "POST",
+			redirect: "manual",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams(body),
+			signal
+		}, tlsOptions);
+	} catch (error) {
+		throw new Error(tlsFailureHint(error) ?? "CLI auth request failed: fetch failed.");
+	}
+	return readResponse(response);
+}
+async function readResponse(response) {
+	const value = await response.json().catch(() => ({}));
+	if (!response.ok) {
+		const error = isRecord(value) && typeof value.error === "string" ? value.error : "request_failed";
+		throw new Error(`CLI auth request failed: ${error}`);
+	}
+	if (!isRecord(value)) throw new Error("CLI auth response was invalid.");
+	return value;
+}
+function parseTokenResponse(value) {
+	const tokenType = readString(value, "token_type");
+	if (tokenType !== "Bearer") throw new Error("CLI auth token response was invalid.");
+	return {
+		accessToken: readString(value, "access_token"),
+		refreshToken: readString(value, "refresh_token"),
+		expiresIn: readNumber(value, "expires_in"),
+		tokenType,
+		deploymentId: readString(value, "deployment_id")
+	};
+}
+function readString(value, key) {
+	const field = value[key];
+	if (typeof field !== "string" || !field.trim()) throw new Error("CLI auth response was invalid.");
+	return field;
+}
+function readNumber(value, key) {
+	const field = value[key];
+	if (typeof field !== "number" || !Number.isFinite(field)) throw new Error("CLI auth response was invalid.");
+	return field;
+}
+function isRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+//#endregion
+//#region src/local-machine-controller.ts
+const ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
+async function discoverDeploymentForStore(options) {
+	const knownByUrl = await options.store.findProfileForServerUrl(options.serverUrl);
+	const allowInsecureTls = options.allowInsecureTls ?? (knownByUrl ? insecureTlsForServer(knownByUrl.canonicalOrigin, options.serverUrl, knownByUrl.allowInsecureTls) : void 0);
+	const discovered = await discoverDeployment(options.serverUrl, {
+		allowInsecureTls,
+		...knownByUrl ? {
+			trustedCanonicalOrigin: knownByUrl.canonicalOrigin,
+			expectedDeploymentId: knownByUrl.deploymentId
+		} : {}
+	});
+	if (knownByUrl) return discovered;
+	const knownById = await options.store.getProfile(discovered.deploymentId);
+	if (!knownById) return discovered;
+	return discoverDeployment(options.serverUrl, {
+		allowInsecureTls: options.allowInsecureTls ?? insecureTlsForServer(knownById.canonicalOrigin, options.serverUrl, knownById.allowInsecureTls),
+		trustedCanonicalOrigin: knownById.canonicalOrigin,
+		expectedDeploymentId: knownById.deploymentId
+	});
+}
+async function setupConnectorProfile(options) {
+	const deployment = await discoverDeploymentForStore({
+		serverUrl: options.serverUrl,
+		store: options.store,
+		allowInsecureTls: options.allowInsecureTls
+	});
+	const claimed = await claimLocalMachine({
+		deployment,
+		store: options.store,
+		name: options.name,
+		credentialLane: "pending",
+		allowInsecureTls: insecureTlsForServer(options.serverUrl, deployment.serverUrl, options.allowInsecureTls),
+		...options.bootstrap ? { bootstrap: {
+			policyDigest: options.bootstrap.policyDigest,
+			releaseTuple: options.bootstrap.releaseTuple
+		} } : {}
+	});
+	const { machine, serverUrl, clientAccessToken } = claimed;
+	let profile = claimed.profile;
+	if (options.bootstrap) {
+		if (!machine.bootstrap) throw new Error("Server did not issue connector bootstrap credentials.");
+		profile = await options.store.updateProfile(deployment.deploymentId, (current) => ({
+			...current ?? profile,
+			bootstrapReceipt: {
+				receiptId: machine.bootstrap.receiptId,
+				policyDigest: options.bootstrap.policyDigest,
+				snapshot: options.bootstrap.release.snapshot
+			}
+		}));
+		const credentials = {
+			...machine.bootstrap,
+			machineId: machine.machineId
+		};
+		await installDeploymentConnector({
+			deployment,
+			release: options.bootstrap.release,
+			credentials,
+			connectorInstallId: profile.connectorInstallId,
+			challenge: profile.challenge,
+			...profile.allowInsecureTls ? { allowInsecureTls: true } : {},
+			acknowledge: (receiptId) => new MachineClient(serverUrl, { allowInsecureTls: profile.allowInsecureTls }).acknowledgeBootstrap({
+				accessToken: clientAccessToken,
+				receiptId
+			}),
+			...options.reconciliationLockHeld ? { reconciliationLockHeld: true } : {}
+		});
+		await options.store.clearBootstrapReceipt(deployment.deploymentId);
+	}
+	if (options.installService) {
+		if (!options.serviceInstaller) throw new Error("Connector service install is not available in this runtime.");
+		await options.serviceInstaller({
+			serverUrl,
+			deploymentId: profile.deploymentId,
+			serviceKey: profile.serviceKey,
+			allowInsecureTls: profile.allowInsecureTls
+		});
+	}
+	return machine;
+}
+async function resumeConnectorBootstrap(options) {
+	const stored = await options.store.getProfile(options.deployment.deploymentId);
+	const receipt = stored?.bootstrapReceipt;
+	if (!stored?.refreshToken || !receipt) throw new Error("Recoverable connector bootstrap receipt was not found.");
+	const claimed = await claimLocalMachine({
+		deployment: options.deployment,
+		store: options.store,
+		credentialLane: "active",
+		allowInsecureTls: options.allowInsecureTls,
+		bootstrap: {
+			policyDigest: receipt.policyDigest,
+			releaseTuple: receipt.snapshot.tuple,
+			receiptId: receipt.receiptId
+		}
+	});
+	if (!claimed.machine.bootstrap) throw new Error("Server did not recover connector bootstrap credentials.");
+	const nextReceipt = claimed.machine.bootstrap.receiptId;
+	await options.store.updateProfile(options.deployment.deploymentId, (current) => ({
+		...current ?? claimed.profile,
+		bootstrapReceipt: {
+			receiptId: nextReceipt,
+			policyDigest: receipt.policyDigest,
+			snapshot: receipt.snapshot
+		}
+	}));
+	await installDeploymentConnector({
+		deployment: options.deployment,
+		release: options.release,
+		credentials: {
+			...claimed.machine.bootstrap,
+			machineId: claimed.machine.machineId
+		},
+		connectorInstallId: claimed.profile.connectorInstallId,
+		challenge: claimed.profile.challenge,
+		...claimed.profile.allowInsecureTls ? { allowInsecureTls: true } : {},
+		acknowledge: (receiptId) => new MachineClient(options.deployment.serverUrl, { allowInsecureTls: claimed.profile.allowInsecureTls }).acknowledgeBootstrap({
+			accessToken: claimed.clientAccessToken,
+			receiptId
+		}),
+		...options.reconciliationLockHeld ? { reconciliationLockHeld: true } : {}
+	});
+	await options.store.clearBootstrapReceipt(options.deployment.deploymentId);
+	return claimed.machine;
+}
+async function repairConnectorProfile(options) {
+	const deployment = options.deployment ?? await discoverDeploymentForStore({
+		serverUrl: options.serverUrl,
+		store: options.store,
+		allowInsecureTls: options.allowInsecureTls
+	});
+	const storedProfile = await options.store.getProfile(deployment.deploymentId);
+	return claimLocalMachine({
+		deployment,
+		store: options.store,
+		name: options.name,
+		credentialLane: "active",
+		allowInsecureTls: insecureTlsForServer(options.serverUrl, deployment.serverUrl, options.allowInsecureTls ?? storedProfile?.allowInsecureTls)
+	});
+}
+async function startConnectorDeviceAuthorization(options) {
+	const deployment = await discoverDeploymentForStore({
+		serverUrl: options.serverUrl,
+		store: options.store,
+		allowInsecureTls: options.allowInsecureTls
+	});
+	const allowInsecureTls = insecureTlsForServer(options.serverUrl, deployment.serverUrl, options.allowInsecureTls);
+	const profile = await options.store.prepareDeployment(deployment, { allowInsecureTls });
+	return {
+		...await new CliAuthClient(deployment.serverUrl, { allowInsecureTls }).startDeviceAuthorization({
+			deploymentId: deployment.deploymentId,
+			connectorInstallId: profile.connectorInstallId,
+			serviceKey: deployment.serviceKey,
+			challenge: profile.challenge,
+			expectedMachineId: profile.machineId,
+			deviceLabel: options.deviceLabel ?? hostname(),
+			...options.bootstrap ? { bootstrap: options.bootstrap } : {}
+		}),
+		serverUrl: deployment.serverUrl,
+		deploymentId: deployment.deploymentId
+	};
+}
+async function pollConnectorDeviceToken(options) {
+	const token = await pollDeviceToken(new CliAuthClient(normalizeServerUrl(options.serverUrl), { allowInsecureTls: options.allowInsecureTls }), {
+		deviceCode: options.deviceCode,
+		intervalSeconds: options.intervalSeconds,
+		expiresInSeconds: options.expiresInSeconds
+	});
+	if (token.deploymentId !== options.deploymentId) throw new Error("Authenticated token grant belongs to a different deployment.");
+	return options.store.savePendingLogin({
+		deploymentId: options.deploymentId,
+		refreshToken: token.refreshToken,
+		accessToken: token.accessToken,
+		expiresInSeconds: token.expiresIn
+	});
+}
+async function ensureAccessToken(input) {
+	const serverUrl = normalizeServerUrl(input.serverUrl);
+	return input.store.withLockedData(async (data) => {
+		const now = input.now ?? /* @__PURE__ */ new Date();
+		const pendingProfile = data.pendingProfiles[input.deploymentId];
+		const activeProfile = data.profiles[input.deploymentId];
+		const pending = data.pendingLogins[input.deploymentId];
+		const profile = input.usePendingCredentials ? pendingProfile : activeProfile;
+		const credentials = input.usePendingCredentials ? pending : activeProfile;
+		if (!profile) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+		if (!credentials?.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+		const auth = input.authClient ?? new CliAuthClient(serverUrl, { allowInsecureTls: input.allowInsecureTls });
+		if (!input.forceRefresh && credentials.accessToken && tokenIsFresh(credentials.accessTokenExpiresAt, now)) return credentials.accessToken;
+		const refreshed = await auth.refresh(credentials.refreshToken);
+		if (refreshed.deploymentId !== profile.deploymentId) throw new Error("Authenticated token grant belongs to a different deployment.");
+		const updated = {
+			...credentials,
+			refreshToken: refreshed.refreshToken,
+			accessToken: refreshed.accessToken,
+			accessTokenExpiresAt: expiresAt(refreshed.expiresIn, now)
+		};
+		if (input.usePendingCredentials) data.pendingLogins[input.deploymentId] = updated;
+		else data.profiles[input.deploymentId] = {
+			...activeProfile,
+			...updated
+		};
+		return refreshed.accessToken;
+	});
+}
+function createAccessTokenProvider(input) {
+	return async (options) => {
+		const deployment = await discoverDeploymentForStore({
+			serverUrl: input.serverUrl,
+			store: input.store,
+			allowInsecureTls: input.allowInsecureTls
+		});
+		if (deployment.deploymentId !== input.deploymentId) throw new Error("Discovered deployment identity changed before connector authentication.");
+		const allowInsecureTls = insecureTlsForServer(input.serverUrl, deployment.serverUrl, input.allowInsecureTls);
+		const accessToken = await ensureAccessToken({
+			...input,
+			serverUrl: deployment.serverUrl,
+			forceRefresh: options?.forceRefresh,
+			allowInsecureTls
+		});
+		return {
+			serverUrl: deployment.serverUrl,
+			accessToken,
+			...allowInsecureTls ? { allowInsecureTls: true } : {}
+		};
+	};
+}
+async function claimLocalMachine(options) {
+	const deployment = options.deployment;
+	const serverUrl = deployment.serverUrl;
+	const prepared = options.credentialLane === "pending" ? await options.store.prepareDeployment(deployment, { allowInsecureTls: options.allowInsecureTls }) : await options.store.getProfile(deployment.deploymentId);
+	if (!prepared || options.credentialLane === "active" && !prepared.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+	const accessToken = await ensureAccessToken({
+		serverUrl,
+		deploymentId: deployment.deploymentId,
+		store: options.store,
+		usePendingCredentials: options.credentialLane === "pending",
+		allowInsecureTls: options.allowInsecureTls
+	}).catch((error) => {
+		throw markRefreshError(error);
+	});
+	const machineClient = new MachineClient(serverUrl, { allowInsecureTls: options.allowInsecureTls });
+	const claimInput = {
+		accessToken,
+		deploymentId: deployment.deploymentId,
+		serviceKey: deployment.serviceKey,
+		challenge: prepared.challenge,
+		connectorInstallId: prepared.connectorInstallId,
+		name: options.name,
+		...options.bootstrap ? { bootstrap: options.bootstrap } : {}
+	};
+	let machine;
+	try {
+		machine = await machineClient.claim(claimInput);
+	} catch (error) {
+		if (error instanceof MachineClaimError && error.code === "machine_retirement_pending") {
+			const retirement = await machineClient.readRetirement(accessToken);
+			if (!retirement || retirement.deploymentId !== deployment.deploymentId || retirement.connectorInstallId !== prepared.connectorInstallId) throw new Error("Machine retirement did not match the local deployment binding.");
+			await clearRetiredLocalBinding(deployment.deploymentId, deployment.serviceKey);
+			if (!retirement.acknowledged) await machineClient.acknowledgeRetirement({
+				accessToken,
+				retirement
+			});
+			machine = await machineClient.claim(claimInput);
+		} else {
+			if (!options.bootstrap || error instanceof MachineClaimError && error.status < 500) throw error;
+			machine = await machineClient.claim(claimInput);
+		}
+	}
+	const profile = options.credentialLane === "pending" ? await options.store.commitPendingDeployment(deployment.deploymentId, machine.machineId) : await options.store.updateProfile(deployment.deploymentId, (current) => {
+		if (!current?.refreshToken) throw new Error(`Not logged in to ${serverUrl}. Run agents login.`);
+		const updated = {
+			...current,
+			serverUrl,
+			canonicalOrigin: deployment.canonicalOrigin,
+			aliases: deployment.aliases,
+			policyDigest: deployment.policyDigest,
+			serviceKey: deployment.serviceKey,
+			machineId: machine.machineId
+		};
+		delete updated.allowInsecureTls;
+		if (options.allowInsecureTls) updated.allowInsecureTls = true;
+		return updated;
+	});
+	return {
+		machine,
+		serverUrl,
+		profile,
+		clientAccessToken: accessToken
+	};
+}
+async function clearRetiredLocalBinding(deploymentId, serviceKey) {
+	const context = resolveConnectorProfileContext(serviceKey);
+	await runServiceCommand("uninstall", {
+		deploymentId,
+		serviceKey
+	});
+	await Promise.all([
+		removeConnectorRegistry(context),
+		rm(dirname(context.configPath), {
+			recursive: true,
+			force: true
+		}),
+		rm(context.statePath, {
+			recursive: true,
+			force: true
+		})
+	]);
+}
+async function pollDeviceToken(auth, input) {
+	const expiresAt = Date.now() + input.expiresInSeconds * 1e3;
+	let intervalMs = Math.max(1, input.intervalSeconds) * 1e3;
+	while (Date.now() < expiresAt) try {
+		return await auth.pollDeviceToken(input.deviceCode);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "";
+		if (message.includes("slow_down")) intervalMs += 5e3;
+		if (!message.includes("authorization_pending") && !message.includes("slow_down")) throw error;
+		await setTimeout(intervalMs);
+	}
+	throw new Error("CLI login expired before authorization completed.");
+}
+function tokenIsFresh(expiresAtValue, now) {
+	if (!expiresAtValue) return false;
+	return new Date(expiresAtValue).getTime() - now.getTime() > ACCESS_TOKEN_REFRESH_SKEW_MS;
+}
+function expiresAt(expiresInSeconds, now) {
+	return new Date(now.getTime() + Math.max(0, expiresInSeconds) * 1e3).toISOString();
+}
+function markRefreshError(error) {
+	if (error instanceof Error) return Object.assign(error, { localMachineStage: "refresh" });
+	return Object.assign(/* @__PURE__ */ new Error("Failed to refresh connector access token."), { localMachineStage: "refresh" });
+}
+//#endregion
+export { repairConnectorProfile as a, startConnectorDeviceAuthorization as c, pollConnectorDeviceToken as i, CliAuthClient as l, discoverDeploymentForStore as n, resumeConnectorBootstrap as o, ensureAccessToken as r, setupConnectorProfile as s, createAccessTokenProvider as t };