@tinycloud/courier 0.2.4-beta.3 → 0.3.0-beta.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -0
- package/dist/args.js +1 -1
- package/dist/args.js.map +1 -1
- package/dist/credential-source.d.ts +38 -0
- package/dist/credential-source.js +170 -0
- package/dist/credential-source.js.map +1 -0
- package/dist/credential.d.ts +15 -0
- package/dist/credential.js +174 -0
- package/dist/credential.js.map +1 -0
- package/dist/main.js +7 -0
- package/dist/main.js.map +1 -1
- package/dist/profile.d.ts +1 -0
- package/dist/profile.js +7 -3
- package/dist/profile.js.map +1 -1
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -73,6 +73,23 @@ local agent key: the verification method and the public `jwk.x` must match, and
|
|
|
73
73
|
the JWK must carry no private fields. An expired or unknown code fails with
|
|
74
74
|
`[code-not-found]`; paste the full grant code instead.
|
|
75
75
|
|
|
76
|
+
### Email credentials
|
|
77
|
+
|
|
78
|
+
`courier credential acquire --email <addr>` sends a verification code to the
|
|
79
|
+
address and stores a pending request under `COURIER_HOME/credentials/` (owner-only).
|
|
80
|
+
Run it again with `--code-stdin` and enter the code on stdin, for example
|
|
81
|
+
`courier credential acquire --email <addr> --code-stdin < code.txt`. The code is
|
|
82
|
+
never passed on argv: `--code <value>` and a bare `--code` are refused with a usage
|
|
83
|
+
error that names `--code-stdin`, before any network call or credential directory is
|
|
84
|
+
created. A pending request expires after 15 minutes. A new request for the same
|
|
85
|
+
address replaces the older pending request only after the new request succeeds; if
|
|
86
|
+
the new request fails, the older pending request is kept and `--code-stdin` still
|
|
87
|
+
completes it.
|
|
88
|
+
|
|
89
|
+
`courier credential show --email <addr>` prints the stored credential's `email`,
|
|
90
|
+
`credentialId`, `issuedAt`, `expiresAt` and `status`. The credential itself is
|
|
91
|
+
never printed.
|
|
92
|
+
|
|
76
93
|
### Settings
|
|
77
94
|
|
|
78
95
|
| Setting | Flag | Env | Stored | Default |
|
package/dist/args.js
CHANGED
|
@@ -2,7 +2,7 @@ import { CourierError } from './errors.js';
|
|
|
2
2
|
/** Minimal parser: `--flag value`, `--flag=value`, `--flag` (boolean), `-h`. */
|
|
3
3
|
export function parseArgs(argv) {
|
|
4
4
|
const positional = [];
|
|
5
|
-
const BOOLS = { json: true, help: true, force: true, stdin: true, quiet: true, 'rotate-key': true, paste: true, request: true, peek: true, resume: true, once: true, unguarded: true, 'install-launchd': true, 'install-systemd': true, 'dry-run': true };
|
|
5
|
+
const BOOLS = { json: true, help: true, force: true, stdin: true, 'code-stdin': true, quiet: true, 'rotate-key': true, paste: true, request: true, peek: true, resume: true, once: true, unguarded: true, 'install-launchd': true, 'install-systemd': true, 'dry-run': true };
|
|
6
6
|
const flags = new Map();
|
|
7
7
|
for (let i = 0; i < argv.length; i++) {
|
|
8
8
|
const a = argv[i];
|
package/dist/args.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAU3C,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,KAAK,GAAyB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACpS,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtC,MAAM;QACR,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO;QACL,UAAU;QACV,KAAK;QACL,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY,EAAE,KAAa;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,KAAK,IAAI,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACxG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAgB,EAAE,KAAe;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,SAAS,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpI,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC"}
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
import { type CredentialRequirement, type StoredCredentialRecord, type VerifiedCredential } from '@tinycloud/sdk-core';
|
|
2
|
+
/**
|
|
3
|
+
* Credentials held by Courier, keyed by holder DID and requirement digest.
|
|
4
|
+
* Same `find`/`store` contract as the receiver custody used by `tinycloud share receive`.
|
|
5
|
+
*/
|
|
6
|
+
export interface CredentialSource {
|
|
7
|
+
find(input: {
|
|
8
|
+
readonly requirement: CredentialRequirement;
|
|
9
|
+
readonly requirementDigest: string;
|
|
10
|
+
readonly holderDid: string;
|
|
11
|
+
readonly now?: Date;
|
|
12
|
+
}): Promise<StoredCredentialRecord | undefined>;
|
|
13
|
+
store(input: {
|
|
14
|
+
readonly verified: VerifiedCredential;
|
|
15
|
+
readonly requirement: CredentialRequirement;
|
|
16
|
+
readonly requirementDigest: string;
|
|
17
|
+
readonly holderDid: string;
|
|
18
|
+
readonly now?: Date;
|
|
19
|
+
}): Promise<StoredCredentialRecord>;
|
|
20
|
+
}
|
|
21
|
+
/** Stored credentials for the Courier agent. Records are dropped once they fail the requirement's window. */
|
|
22
|
+
export declare class StoredCredentialSource implements CredentialSource {
|
|
23
|
+
private readonly home;
|
|
24
|
+
constructor(home?: string);
|
|
25
|
+
find(input: {
|
|
26
|
+
readonly requirement: CredentialRequirement;
|
|
27
|
+
readonly requirementDigest: string;
|
|
28
|
+
readonly holderDid: string;
|
|
29
|
+
readonly now?: Date;
|
|
30
|
+
}): Promise<StoredCredentialRecord | undefined>;
|
|
31
|
+
store(input: {
|
|
32
|
+
readonly verified: VerifiedCredential;
|
|
33
|
+
readonly requirement: CredentialRequirement;
|
|
34
|
+
readonly requirementDigest: string;
|
|
35
|
+
readonly holderDid: string;
|
|
36
|
+
readonly now?: Date;
|
|
37
|
+
}): Promise<StoredCredentialRecord>;
|
|
38
|
+
}
|
|
@@ -0,0 +1,170 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Credential store under `<home>/credentials/`.
|
|
3
|
+
*
|
|
4
|
+
* - Directory is created 0700 and re-checked on every read (real dir, owned by
|
|
5
|
+
* the current uid, no group/world bits). Files are written 0600 via O_EXCL
|
|
6
|
+
* temp + fsync + rename, and read only with O_NOFOLLOW after an lstat check
|
|
7
|
+
* (regular file, 0600, owned by current uid, same dev/ino on open).
|
|
8
|
+
*
|
|
9
|
+
* Pending email-proof requests are not stored here; `@tinycloud/node-sdk/credential-pending-store`
|
|
10
|
+
* owns them.
|
|
11
|
+
*/
|
|
12
|
+
import fs from 'node:fs';
|
|
13
|
+
import path from 'node:path';
|
|
14
|
+
import { createHash, randomBytes } from 'node:crypto';
|
|
15
|
+
import { createStoredCredentialRecord, credentialMatchesRequirement, } from '@tinycloud/sdk-core';
|
|
16
|
+
import { CourierError } from './errors.js';
|
|
17
|
+
import { mkdirOwnerOnly, profileDir } from './profile.js';
|
|
18
|
+
const DIR_NAME = 'credentials';
|
|
19
|
+
function credentialsDir(home) {
|
|
20
|
+
return path.join(home, DIR_NAME);
|
|
21
|
+
}
|
|
22
|
+
function sha256Hex(text) {
|
|
23
|
+
return createHash('sha256').update(text).digest('hex');
|
|
24
|
+
}
|
|
25
|
+
function credentialFile(home, holderDid, requirementDigest) {
|
|
26
|
+
return path.join(credentialsDir(home), `credential-${sha256Hex(`${holderDid}\n${requirementDigest}`)}.json`);
|
|
27
|
+
}
|
|
28
|
+
function lstatOrUndefined(file) {
|
|
29
|
+
try {
|
|
30
|
+
return fs.lstatSync(file);
|
|
31
|
+
}
|
|
32
|
+
catch (error) {
|
|
33
|
+
if (error.code === 'ENOENT')
|
|
34
|
+
return undefined;
|
|
35
|
+
throw error;
|
|
36
|
+
}
|
|
37
|
+
}
|
|
38
|
+
function assertOwnerOnly(st, label, expectedMode) {
|
|
39
|
+
const mode = st.mode & 0o777;
|
|
40
|
+
if ((mode & 0o077) !== 0) {
|
|
41
|
+
throw new CourierError('credential-permissions', `${label} must be owner-only (mode ${expectedMode}); found mode ${mode.toString(8)}.`);
|
|
42
|
+
}
|
|
43
|
+
assertOwnedByCurrentUser(st, label);
|
|
44
|
+
}
|
|
45
|
+
function assertOwnedByCurrentUser(st, label) {
|
|
46
|
+
if (typeof process.getuid === 'function' && st.uid !== process.getuid()) {
|
|
47
|
+
throw new CourierError('credential-permissions', `${label} is not owned by the current user.`);
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
/** Creates the store directory 0700 if absent. Refuses a symlink or a directory owned by another user. */
|
|
51
|
+
function ensureSecureDir(home) {
|
|
52
|
+
const dir = credentialsDir(home);
|
|
53
|
+
mkdirOwnerOnly(dir);
|
|
54
|
+
const st = fs.lstatSync(dir);
|
|
55
|
+
if (!st.isDirectory())
|
|
56
|
+
throw new CourierError('credential-permissions', `${dir} must be a real directory, not a symlink or file.`);
|
|
57
|
+
assertOwnedByCurrentUser(st, dir);
|
|
58
|
+
fs.chmodSync(dir, 0o700);
|
|
59
|
+
}
|
|
60
|
+
/** Returns false when the store directory does not exist. Re-checks symlink, owner, and mode on every call. */
|
|
61
|
+
function checkSecureDir(home) {
|
|
62
|
+
const dir = credentialsDir(home);
|
|
63
|
+
const st = lstatOrUndefined(dir);
|
|
64
|
+
if (!st)
|
|
65
|
+
return false;
|
|
66
|
+
if (!st.isDirectory())
|
|
67
|
+
throw new CourierError('credential-permissions', `${dir} must be a real directory, not a symlink or file.`);
|
|
68
|
+
assertOwnerOnly(st, dir, '0700');
|
|
69
|
+
return true;
|
|
70
|
+
}
|
|
71
|
+
/**
|
|
72
|
+
* Atomic owner-only write: O_EXCL|O_NOFOLLOW temp file at 0600, fsync, then rename.
|
|
73
|
+
* Refuses to replace a destination that is not a regular file.
|
|
74
|
+
*/
|
|
75
|
+
function writeOwnerOnly(home, file, obj) {
|
|
76
|
+
ensureSecureDir(home);
|
|
77
|
+
const existing = lstatOrUndefined(file);
|
|
78
|
+
if (existing && !existing.isFile()) {
|
|
79
|
+
throw new CourierError('credential-permissions', `${path.basename(file)} exists and is not a regular file; refusing to replace it.`);
|
|
80
|
+
}
|
|
81
|
+
const temp = `${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
|
|
82
|
+
let fd;
|
|
83
|
+
try {
|
|
84
|
+
fd = fs.openSync(temp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
|
|
85
|
+
fs.writeFileSync(fd, JSON.stringify(obj, null, 2) + '\n');
|
|
86
|
+
fs.fchmodSync(fd, 0o600);
|
|
87
|
+
fs.fsyncSync(fd);
|
|
88
|
+
fs.closeSync(fd);
|
|
89
|
+
fd = undefined;
|
|
90
|
+
fs.renameSync(temp, file);
|
|
91
|
+
}
|
|
92
|
+
finally {
|
|
93
|
+
if (fd !== undefined)
|
|
94
|
+
fs.closeSync(fd);
|
|
95
|
+
try {
|
|
96
|
+
fs.unlinkSync(temp);
|
|
97
|
+
}
|
|
98
|
+
catch { /* renamed or absent */ }
|
|
99
|
+
}
|
|
100
|
+
}
|
|
101
|
+
/**
|
|
102
|
+
* Reads an owner-only JSON file. Re-checks the directory and the file on every read,
|
|
103
|
+
* refuses symlinks, and confirms the opened descriptor is the same inode that was checked.
|
|
104
|
+
*/
|
|
105
|
+
function readOwnerOnly(home, file) {
|
|
106
|
+
if (!checkSecureDir(home))
|
|
107
|
+
return undefined;
|
|
108
|
+
const label = path.basename(file);
|
|
109
|
+
const before = lstatOrUndefined(file);
|
|
110
|
+
if (!before)
|
|
111
|
+
return undefined;
|
|
112
|
+
if (!before.isFile())
|
|
113
|
+
throw new CourierError('credential-permissions', `${label} must be a regular file; symlinks are refused.`);
|
|
114
|
+
assertOwnerOnly(before, label, '0600');
|
|
115
|
+
const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
|
|
116
|
+
let text;
|
|
117
|
+
try {
|
|
118
|
+
const opened = fs.fstatSync(fd);
|
|
119
|
+
if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) {
|
|
120
|
+
throw new CourierError('credential-permissions', `${label} changed while it was being opened.`);
|
|
121
|
+
}
|
|
122
|
+
if (opened.nlink !== 1)
|
|
123
|
+
throw new CourierError('credential-permissions', `${label} has multiple hard links; refusing to read it.`);
|
|
124
|
+
assertOwnerOnly(opened, label, '0600');
|
|
125
|
+
text = fs.readFileSync(fd, 'utf8');
|
|
126
|
+
}
|
|
127
|
+
finally {
|
|
128
|
+
fs.closeSync(fd);
|
|
129
|
+
}
|
|
130
|
+
try {
|
|
131
|
+
return JSON.parse(text);
|
|
132
|
+
}
|
|
133
|
+
catch {
|
|
134
|
+
throw new CourierError('credential-store-invalid', `Invalid credential store file ${label}.`);
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
function removeFile(file) {
|
|
138
|
+
fs.rmSync(file, { force: true });
|
|
139
|
+
}
|
|
140
|
+
/** Stored credentials for the Courier agent. Records are dropped once they fail the requirement's window. */
|
|
141
|
+
export class StoredCredentialSource {
|
|
142
|
+
home;
|
|
143
|
+
constructor(home = profileDir()) {
|
|
144
|
+
this.home = home;
|
|
145
|
+
}
|
|
146
|
+
async find(input) {
|
|
147
|
+
const file = credentialFile(this.home, input.holderDid, input.requirementDigest);
|
|
148
|
+
const record = readOwnerOnly(this.home, file);
|
|
149
|
+
if (!record)
|
|
150
|
+
return undefined;
|
|
151
|
+
const now = input.now ?? new Date();
|
|
152
|
+
if (!credentialMatchesRequirement(input.requirement, record, input.holderDid, now)) {
|
|
153
|
+
removeFile(file);
|
|
154
|
+
return undefined;
|
|
155
|
+
}
|
|
156
|
+
return record;
|
|
157
|
+
}
|
|
158
|
+
async store(input) {
|
|
159
|
+
const record = await createStoredCredentialRecord({
|
|
160
|
+
verified: input.verified,
|
|
161
|
+
ownerDid: input.holderDid,
|
|
162
|
+
requirement: input.requirement,
|
|
163
|
+
requirementDigest: input.requirementDigest,
|
|
164
|
+
storedAt: (input.now ?? new Date()).toISOString(),
|
|
165
|
+
});
|
|
166
|
+
writeOwnerOnly(this.home, credentialFile(this.home, input.holderDid, input.requirementDigest), record);
|
|
167
|
+
return record;
|
|
168
|
+
}
|
|
169
|
+
}
|
|
170
|
+
//# sourceMappingURL=credential-source.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credential-source.js","sourceRoot":"","sources":["../src/credential-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAI7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAsB1D,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB,EAAE,iBAAyB;IAChF,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,cAAc,SAAS,CAAC,GAAG,SAAS,KAAK,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC;AAC/G,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,EAAY,EAAE,KAAa,EAAE,YAAoB;IACxE,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,KAAK,6BAA6B,YAAY,iBAAiB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1I,CAAC;IACD,wBAAwB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,EAAY,EAAE,KAAa;IAC3D,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,GAAG,mDAAmD,CAAC,CAAC;IACnI,wBAAwB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAClC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,+GAA+G;AAC/G,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,GAAG,mDAAmD,CAAC,CAAC;IACnI,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,GAAY;IAC9D,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5H,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1D,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,GAAG,SAAS,CAAC;QACf,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAI,IAAY,EAAE,IAAY;IAClD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,KAAK,gDAAgD,CAAC,CAAC;IACjI,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC/E,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,KAAK,qCAAqC,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,EAAE,GAAG,KAAK,gDAAgD,CAAC,CAAC;QACnI,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,0BAA0B,EAAE,iCAAiC,KAAK,GAAG,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,6GAA6G;AAC7G,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,OAAe,UAAU,EAAE;QAA3B,SAAI,GAAJ,IAAI,CAAuB;IAAG,CAAC;IAE5D,KAAK,CAAC,IAAI,CAAC,KAA2I;QACpJ,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,aAAa,CAAyB,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YACnF,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAkL;QAC5L,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SAClD,CAAC,CAAC;QACH,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;QACvG,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
import { completeEmailProof, requestEmailProofCode } from '@tinycloud/node-sdk/credentials';
|
|
2
|
+
import { type ParsedArgs } from './args.js';
|
|
3
|
+
import { type AgentKey } from './profile.js';
|
|
4
|
+
export interface CredentialDeps {
|
|
5
|
+
home?: string;
|
|
6
|
+
now?: () => Date;
|
|
7
|
+
fetch?: typeof fetch;
|
|
8
|
+
loadKey?: (home: string) => AgentKey;
|
|
9
|
+
requestCode?: typeof requestEmailProofCode;
|
|
10
|
+
completeProof?: typeof completeEmailProof;
|
|
11
|
+
/** Reads the first line of stdin for `--code-stdin`. */
|
|
12
|
+
readStdinLine?: () => Promise<string>;
|
|
13
|
+
out?: (text: string) => void;
|
|
14
|
+
}
|
|
15
|
+
export declare function cmdCredential(args: ParsedArgs, deps?: CredentialDeps): Promise<void>;
|
|
@@ -0,0 +1,174 @@
|
|
|
1
|
+
import { createPrivateKey, sign as cryptoSign } from 'node:crypto';
|
|
2
|
+
import { createInterface } from 'node:readline';
|
|
3
|
+
import { completeEmailProof, createEd25519HolderSigner, EmailProofError, emailProofRequirement, requestEmailProofCode, } from '@tinycloud/node-sdk/credentials';
|
|
4
|
+
import { createFileEmailProofPendingStore, PendingStoreError } from '@tinycloud/node-sdk/credential-pending-store';
|
|
5
|
+
import { credentialRequirementDigest } from '@tinycloud/sdk-core';
|
|
6
|
+
import { CourierError } from './errors.js';
|
|
7
|
+
import { requireFlag } from './args.js';
|
|
8
|
+
import { cmd } from './program.js';
|
|
9
|
+
import { loadKey, profileDir } from './profile.js';
|
|
10
|
+
import { StoredCredentialSource } from './credential-source.js';
|
|
11
|
+
const acquireUsage = () => `Usage: ${cmd('credential acquire --email <addr> [--code-stdin]')}`;
|
|
12
|
+
const showUsage = () => `Usage: ${cmd('credential show --email <addr>')}`;
|
|
13
|
+
const credentialUsage = () => `${acquireUsage()}\n${showUsage()}`;
|
|
14
|
+
/**
|
|
15
|
+
* Holder over Courier's did:key Ed25519 agent key. The private key stays inside
|
|
16
|
+
* Node's KeyObject; only signature bytes leave this function.
|
|
17
|
+
*/
|
|
18
|
+
function holderFor(key) {
|
|
19
|
+
let privateKey;
|
|
20
|
+
try {
|
|
21
|
+
privateKey = createPrivateKey({ key: key.jwk, format: 'jwk' });
|
|
22
|
+
}
|
|
23
|
+
catch {
|
|
24
|
+
throw new CourierError('credential.request.HOLDER_INVALID', 'Agent signing key is unusable.');
|
|
25
|
+
}
|
|
26
|
+
try {
|
|
27
|
+
return createEd25519HolderSigner(key.did, async (bytes) => new Uint8Array(cryptoSign(null, bytes, privateKey)));
|
|
28
|
+
}
|
|
29
|
+
catch (error) {
|
|
30
|
+
throw mapEmailProofError(error, 'request');
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
function isEmailProofError(error) {
|
|
34
|
+
return error instanceof EmailProofError;
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Maps a witness-flow failure to a stable `credential.<step>.<CODE>` code. The
|
|
38
|
+
* message never contains the verification code, the pending verifier, or key material.
|
|
39
|
+
*/
|
|
40
|
+
function mapEmailProofError(error, fallbackStep) {
|
|
41
|
+
if (isEmailProofError(error))
|
|
42
|
+
return new CourierError(`credential.${error.step}.${error.code}`, error.message);
|
|
43
|
+
return new CourierError(`credential.${fallbackStep}.FAILED`, 'Email verification failed.');
|
|
44
|
+
}
|
|
45
|
+
/** The witness marks which failures leave the pending request usable for another code. */
|
|
46
|
+
function keepsPendingAfterFailure(error) {
|
|
47
|
+
return isEmailProofError(error) && error.recoverable;
|
|
48
|
+
}
|
|
49
|
+
/** Pending-store failures keep their store codes (`credential-permissions`, `credential-store-invalid`). */
|
|
50
|
+
async function withStoreErrors(run) {
|
|
51
|
+
try {
|
|
52
|
+
return await run();
|
|
53
|
+
}
|
|
54
|
+
catch (error) {
|
|
55
|
+
if (error instanceof PendingStoreError)
|
|
56
|
+
throw new CourierError(error.code, error.message);
|
|
57
|
+
throw error;
|
|
58
|
+
}
|
|
59
|
+
}
|
|
60
|
+
async function readStdinFirstLine() {
|
|
61
|
+
const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
|
|
62
|
+
for await (const line of rl) {
|
|
63
|
+
rl.close();
|
|
64
|
+
return line;
|
|
65
|
+
}
|
|
66
|
+
return '';
|
|
67
|
+
}
|
|
68
|
+
async function acquire(args, deps) {
|
|
69
|
+
const address = requireFlag(args, 'email', acquireUsage()).trim();
|
|
70
|
+
if (args.has('code'))
|
|
71
|
+
throw new CourierError('usage', `--code is refused: it puts the code on argv. Enter the code with --code-stdin. ${acquireUsage()}`);
|
|
72
|
+
const key = deps.loadKey(deps.home);
|
|
73
|
+
const holder = holderFor(key);
|
|
74
|
+
const store = createFileEmailProofPendingStore({ home: deps.home });
|
|
75
|
+
if (!args.has('code-stdin')) {
|
|
76
|
+
// Step 1: the witness emails an 8-digit code. Pending state persists until the owner supplies it.
|
|
77
|
+
// The older live request for this address is deleted only after the new one is stored, so a
|
|
78
|
+
// failed request never destroys a still-valid pending record.
|
|
79
|
+
const older = await withStoreErrors(() => store.findLive(address, deps.now()));
|
|
80
|
+
let pending;
|
|
81
|
+
try {
|
|
82
|
+
pending = await deps.requestCode({ address, holder, fetch: deps.fetch, now: deps.now });
|
|
83
|
+
}
|
|
84
|
+
catch (error) {
|
|
85
|
+
throw mapEmailProofError(error, 'request');
|
|
86
|
+
}
|
|
87
|
+
await withStoreErrors(async () => {
|
|
88
|
+
await store.put(pending);
|
|
89
|
+
if (older && older.requestId !== pending.requestId)
|
|
90
|
+
await store.delete(older.requestId);
|
|
91
|
+
});
|
|
92
|
+
deps.out(`Verification code sent to ${address}. Run \`${cmd(`credential acquire --email ${address} --code-stdin`)}\` and enter the code within 15 minutes.\n`);
|
|
93
|
+
return;
|
|
94
|
+
}
|
|
95
|
+
// Step 2: the code is validated before any store or network access, then used once and never written.
|
|
96
|
+
const code = (await deps.readStdinLine()).trim();
|
|
97
|
+
if (!/^\d{8}$/.test(code))
|
|
98
|
+
throw new CourierError('credential.code.CODE_INVALID', 'Verification code must be 8 digits.');
|
|
99
|
+
const pending = await withStoreErrors(() => store.findLive(address, deps.now()));
|
|
100
|
+
if (!pending) {
|
|
101
|
+
throw new CourierError('credential-request-missing', `No pending verification for ${address}. Run \`${cmd(`credential acquire --email ${address}`)}\` first.`);
|
|
102
|
+
}
|
|
103
|
+
if (pending.holderDid !== holder.did) {
|
|
104
|
+
await withStoreErrors(() => store.delete(pending.requestId));
|
|
105
|
+
throw new CourierError('credential.session.SESSION_INVALID', 'Pending verification belongs to a different agent key. Request a new code.');
|
|
106
|
+
}
|
|
107
|
+
let result;
|
|
108
|
+
try {
|
|
109
|
+
result = await deps.completeProof({ pending, code, holder, fetch: deps.fetch, now: deps.now });
|
|
110
|
+
}
|
|
111
|
+
catch (error) {
|
|
112
|
+
if (keepsPendingAfterFailure(error)) {
|
|
113
|
+
// Retryable: the same pending request stays until its expiry.
|
|
114
|
+
const mapped = mapEmailProofError(error, 'credential');
|
|
115
|
+
throw new CourierError(mapped.code, `${mapped.message} Retry with --code-stdin before ${pending.expiresAt}.`);
|
|
116
|
+
}
|
|
117
|
+
// Terminal: attempts exhausted, session/signature/credential failure, or unknown. A new request is needed.
|
|
118
|
+
await withStoreErrors(() => store.delete(pending.requestId));
|
|
119
|
+
throw mapEmailProofError(error, 'credential');
|
|
120
|
+
}
|
|
121
|
+
const requirement = emailProofRequirement(address);
|
|
122
|
+
const requirementDigest = await credentialRequirementDigest(requirement);
|
|
123
|
+
await new StoredCredentialSource(deps.home).store({
|
|
124
|
+
verified: result.verified,
|
|
125
|
+
requirement,
|
|
126
|
+
requirementDigest,
|
|
127
|
+
holderDid: holder.did,
|
|
128
|
+
now: deps.now(),
|
|
129
|
+
});
|
|
130
|
+
await withStoreErrors(() => store.delete(pending.requestId));
|
|
131
|
+
deps.out(`Email credential stored for ${address}. It is valid for up to 1 hour from issuance.\n`);
|
|
132
|
+
}
|
|
133
|
+
async function show(args, deps) {
|
|
134
|
+
const address = requireFlag(args, 'email', showUsage()).trim();
|
|
135
|
+
const holder = holderFor(deps.loadKey(deps.home));
|
|
136
|
+
const requirement = emailProofRequirement(address);
|
|
137
|
+
const requirementDigest = await credentialRequirementDigest(requirement);
|
|
138
|
+
const record = await new StoredCredentialSource(deps.home).find({
|
|
139
|
+
requirement,
|
|
140
|
+
requirementDigest,
|
|
141
|
+
holderDid: holder.did,
|
|
142
|
+
now: deps.now(),
|
|
143
|
+
});
|
|
144
|
+
if (!record) {
|
|
145
|
+
throw new CourierError('credential.show.NOT_FOUND', `No valid stored email credential for ${address}. Run \`${cmd(`credential acquire --email ${address}`)}\`.`);
|
|
146
|
+
}
|
|
147
|
+
// The bearer `credential` (SD-JWT) is never printed.
|
|
148
|
+
deps.out([
|
|
149
|
+
`email: ${record.claims.email}`,
|
|
150
|
+
`credentialId: ${record.credentialId}`,
|
|
151
|
+
`issuedAt: ${record.issuedAt}`,
|
|
152
|
+
`expiresAt: ${record.expiresAt}`,
|
|
153
|
+
`status: ${record.status.method}`,
|
|
154
|
+
'',
|
|
155
|
+
].join('\n'));
|
|
156
|
+
}
|
|
157
|
+
export async function cmdCredential(args, deps = {}) {
|
|
158
|
+
const resolved = {
|
|
159
|
+
home: deps.home ?? profileDir(),
|
|
160
|
+
now: deps.now ?? (() => new Date()),
|
|
161
|
+
fetch: deps.fetch,
|
|
162
|
+
loadKey: deps.loadKey ?? ((home) => loadKey(home)),
|
|
163
|
+
requestCode: deps.requestCode ?? requestEmailProofCode,
|
|
164
|
+
completeProof: deps.completeProof ?? completeEmailProof,
|
|
165
|
+
readStdinLine: deps.readStdinLine ?? readStdinFirstLine,
|
|
166
|
+
out: deps.out ?? ((text) => { process.stdout.write(text); }),
|
|
167
|
+
};
|
|
168
|
+
switch (args.positional[0]) {
|
|
169
|
+
case 'acquire': return acquire(args, resolved);
|
|
170
|
+
case 'show': return show(args, resolved);
|
|
171
|
+
default: throw new CourierError('usage', credentialUsage());
|
|
172
|
+
}
|
|
173
|
+
}
|
|
174
|
+
//# sourceMappingURL=credential.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,IAAI,IAAI,UAAU,EAAmC,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GAItB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gCAAgC,EAAE,iBAAiB,EAAmC,MAAM,8CAA8C,CAAC;AACpJ,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAmB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAiB,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AA2BhE,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,UAAU,GAAG,CAAC,kDAAkD,CAAC,EAAE,CAAC;AAC/F,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,UAAU,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC;AAC1E,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,GAAG,YAAY,EAAE,KAAK,SAAS,EAAE,EAAE,CAAC;AAElE;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAa;IAC9B,IAAI,UAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,gCAAgC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAiB,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,eAAe,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAc,EAAE,YAAkB;IAC5D,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,YAAY,CAAC,cAAc,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/G,OAAO,IAAI,YAAY,CAAC,cAAc,YAAY,SAAS,EAAE,4BAA4B,CAAC,CAAC;AAC7F,CAAC;AAED,0FAA0F;AAC1F,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC;AACvD,CAAC;AAED,4GAA4G;AAC5G,KAAK,UAAU,eAAe,CAAI,GAAqB;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAc;IACrD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,kFAAkF,YAAY,EAAE,EAAE,CAAC,CAAC;IAC1J,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,KAAK,GAA+B,gCAAgC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAEhG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5B,kGAAkG;QAClG,4FAA4F;QAC5F,8DAA8D;QAC9D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,eAAe,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;gBAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,6BAA6B,OAAO,WAAW,GAAG,CAAC,8BAA8B,OAAO,eAAe,CAAC,4CAA4C,CAAC,CAAC;QAC/J,OAAO;IACT,CAAC;IAED,sGAAsG;IACtG,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,8BAA8B,EAAE,qCAAqC,CAAC,CAAC;IAEzH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,+BAA+B,OAAO,WAAW,GAAG,CAAC,8BAA8B,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,YAAY,CAAC,oCAAoC,EAAE,4EAA4E,CAAC,CAAC;IAC7I,CAAC;IAED,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,8DAA8D;YAC9D,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,mCAAmC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAChH,CAAC;QACD,2GAA2G;QAC3G,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7D,MAAM,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACzE,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW;QACX,iBAAiB;QACjB,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;KAChB,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,+BAA+B,OAAO,iDAAiD,CAAC,CAAC;AACpG,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAgB,EAAE,IAAc;IAClD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,MAAM,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QAC9D,WAAW;QACX,iBAAiB;QACjB,SAAS,EAAE,MAAM,CAAC,GAAG;QACrB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,2BAA2B,EAAE,wCAAwC,OAAO,WAAW,GAAG,CAAC,8BAA8B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACnK,CAAC;IACD,qDAAqD;IACrD,IAAI,CAAC,GAAG,CACN;QACE,UAAU,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE;QAC/B,iBAAiB,MAAM,CAAC,YAAY,EAAE;QACtC,aAAa,MAAM,CAAC,QAAQ,EAAE;QAC9B,cAAc,MAAM,CAAC,SAAS,EAAE;QAChC,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;QACjC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAgB,EAAE,OAAuB,EAAE;IAC7E,MAAM,QAAQ,GAAa;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE;QAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QACnC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,qBAAqB;QACtD,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,kBAAkB;QACvD,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,kBAAkB;QACvD,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;KACrE,CAAC;IACF,QAAQ,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,KAAK,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}
|
package/dist/main.js
CHANGED
|
@@ -9,6 +9,7 @@ import { cmdApproval } from './approval.js';
|
|
|
9
9
|
import { cmdPause, cmdResume } from './pause.js';
|
|
10
10
|
import { cmdGuard } from './guard/command.js';
|
|
11
11
|
import { cmdBroker, cmdRunApproved } from './broker.js';
|
|
12
|
+
import { cmdCredential } from './credential.js';
|
|
12
13
|
function usage() {
|
|
13
14
|
const name = programName();
|
|
14
15
|
return `${name} — agent-to-agent threads over TinyCloud (v0)
|
|
@@ -106,6 +107,11 @@ Delivery (one watcher per person per machine; never calls a model):
|
|
|
106
107
|
Sender: accept one-line item requests over a Unix socket and send the
|
|
107
108
|
named outbox item. Replies are ok or refused:<code>.
|
|
108
109
|
|
|
110
|
+
credential acquire --email <addr> [--code-stdin]
|
|
111
|
+
Email proof: send a verification code to the address, then enter it with
|
|
112
|
+
--code-stdin (reads one line from stdin; keeps the code off argv).
|
|
113
|
+
credential show --email <addr> Show the stored email credential for this agent key (no secret printed).
|
|
114
|
+
|
|
109
115
|
pause <peer> <threadId> [--reason "…"] Humans: stop waking your agent for a thread; tells the peer
|
|
110
116
|
resume <peer> <threadId> Humans: wake it again (the wake budget starts over)
|
|
111
117
|
|
|
@@ -148,6 +154,7 @@ export async function run(argv) {
|
|
|
148
154
|
case 'approval': return cmdApproval(sub);
|
|
149
155
|
case 'pause': return cmdPause(sub);
|
|
150
156
|
case 'resume': return cmdResume(sub);
|
|
157
|
+
case 'credential': return cmdCredential(sub);
|
|
151
158
|
case 'guard': return cmdGuard(sub);
|
|
152
159
|
case 'run-approved': return cmdRunApproved(sub);
|
|
153
160
|
case 'broker': return cmdBroker(sub);
|
package/dist/main.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,GAClH,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,GAClH,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,SAAS,KAAK;IACZ,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,OAAO,GAAG,IAAI;;SAEP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuGT,GAAG,CAAC,SAAS,CAAC;;;;;CAKjB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAe,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,UAAU,CAAC,CAAC,OAAO,WAAW,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,SAAS,CAAC,CAAC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,UAAU,CAAC,CAAC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,KAAK,YAAY,CAAC,CAAC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7C,KAAK,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,cAAc,CAAC,CAAC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,QAAQ,CAAC,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC;YACE,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,oBAAoB,OAAO,SAAS,KAAK,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAA0B,EAAE;IACrE,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}
|
package/dist/profile.d.ts
CHANGED
|
@@ -58,6 +58,7 @@ export interface Profile {
|
|
|
58
58
|
}
|
|
59
59
|
export declare function profileDir(): string;
|
|
60
60
|
export declare function profileExists(): boolean;
|
|
61
|
+
export declare function mkdirOwnerOnly(dir: string): void;
|
|
61
62
|
export declare function writeSecure(file: string, obj: unknown): void;
|
|
62
63
|
export declare function loadProfile(home?: string): Profile;
|
|
63
64
|
export declare function saveProfile(profile: Profile): void;
|
package/dist/profile.js
CHANGED
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
import fs from 'node:fs';
|
|
2
2
|
import path from 'node:path';
|
|
3
|
+
import os from 'node:os';
|
|
3
4
|
import { randomBytes } from 'node:crypto';
|
|
4
5
|
import { cmd } from './program.js';
|
|
5
6
|
import { CourierError } from './errors.js';
|
|
6
7
|
export function profileDir() {
|
|
7
|
-
return process.env.COURIER_HOME || path.join(
|
|
8
|
+
return process.env.COURIER_HOME || path.join(os.homedir(), '.courier');
|
|
8
9
|
}
|
|
9
10
|
function profilePath(name, home = profileDir()) {
|
|
10
11
|
return path.join(home, name);
|
|
@@ -12,11 +13,14 @@ function profilePath(name, home = profileDir()) {
|
|
|
12
13
|
export function profileExists() {
|
|
13
14
|
return fs.existsSync(profilePath('profile.json'));
|
|
14
15
|
}
|
|
15
|
-
function
|
|
16
|
-
const dir = profileDir();
|
|
16
|
+
export function mkdirOwnerOnly(dir) {
|
|
17
17
|
fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
|
|
18
|
+
// mkdir's mode is masked by umask; chmod sets the final bits explicitly.
|
|
18
19
|
fs.chmodSync(dir, 0o700);
|
|
19
20
|
}
|
|
21
|
+
function ensureSecureDir() {
|
|
22
|
+
mkdirOwnerOnly(profileDir());
|
|
23
|
+
}
|
|
20
24
|
export function writeSecure(file, obj) {
|
|
21
25
|
ensureSecureDir();
|
|
22
26
|
const temp = `${file}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
|
package/dist/profile.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAsD3C,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"profile.js","sourceRoot":"","sources":["../src/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAsD3C,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAI,GAAG,UAAU,EAAE;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,yEAAyE;IACzE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe;IACtB,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAY;IACpD,eAAe,EAAE,CAAC;IAClB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5E,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAI,IAAY,EAAE,QAAiB,EAAE,IAAI,GAAG,UAAU,EAAE;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,IAAI,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,YAAY,EAAE,WAAW,IAAI,OAAO,UAAU,EAAE,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IAC/C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,GAAG,UAAU,EAAE,+CAA+C,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtI,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IAC5C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,GAAG,IAAI,+CAA+C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACxD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,WAAW,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,UAAU,EAAE;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAU,cAAc,EAAE,IAAI,EAAE,IAAI,CAAE,CAAC;IAChE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,sBAAsB,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,yGAAyG,GAAG,CAAC,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;IACzM,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,+BAA+B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC/J,MAAM,OAAO,GAAG,MAAiB,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,sBAAsB,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAC7J,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;IACrB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,WAAW,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,UAAU,EAAE;IACzC,MAAM,GAAG,GAAG,UAAU,CAAW,UAAU,EAAE,IAAI,EAAE,IAAI,CAAE,CAAC;IAC1D,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,wBAAwB,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAa;IACnC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAI,GAAG,UAAU,EAAE;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAa,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,0BAA0B,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,WAAW,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,CAAU,EAAE,MAAc;IAChD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,YAAY,CACpB,cAAc,EACd,iBAAiB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAC5H,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@tinycloud/courier",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0-beta.4",
|
|
4
4
|
"description": "Courier: agent-to-agent threads over TinyCloud (CLI, library and agent skill)",
|
|
5
5
|
"author": "TinyCloud, Inc.",
|
|
6
6
|
"type": "module",
|
|
@@ -30,11 +30,11 @@
|
|
|
30
30
|
"test:live": "tsc -p tsconfig.json && node scripts/happy-path.mjs"
|
|
31
31
|
},
|
|
32
32
|
"dependencies": {
|
|
33
|
-
"@tinycloud/node-sdk": "3.6.0-beta.
|
|
33
|
+
"@tinycloud/node-sdk": "3.6.0-beta.5",
|
|
34
|
+
"@tinycloud/sdk-core": "3.6.0-beta.4",
|
|
34
35
|
"ulid": "^3.0.2"
|
|
35
36
|
},
|
|
36
37
|
"devDependencies": {
|
|
37
|
-
"@tinycloud/sdk-core": "3.6.0-beta.4",
|
|
38
38
|
"@types/node": "^20",
|
|
39
39
|
"typescript": "^5.9.3"
|
|
40
40
|
},
|