@wenathlan/devthink 1.1.15 → 2.0.2

package/devthink.ts

@@ -1,397 +0,0 @@
-#!/usr/bin/env bun
-
-import { readFileSync } from "node:fs";
-import { createInterface } from "node:readline/promises";
-import { stdin, stdout } from "node:process";
-import { clearAuthCredential, ensurePaths, getConfigValue, migrateLegacyCredentials, parseConfigValue, readAuth, readConfig, redactAuth, redactConfig, resolvePaths, saveConfig, setAuthCredential, setConfigValue, type DevThinkConfig } from "./config.ts";
-import { createMemoryStore, memorySummary } from "./memory.ts";
-import { listModes, modePrompt, resolveMode } from "./modes.ts";
-import { listModels, listProviders, streamChat } from "./providers.ts";
-import { appendMessage, createSession, exportSession, listSessions, loadSession, type Session } from "./session.ts";
-import { createPairing, createPairingLink, getIdentity, pairingStatus, revokeBrowserSessions, setIdentityUserId } from "./identity.ts";
-import { readPreferences, savePreference } from "./storage.ts";
-import type { ChatEvent } from "./stream.ts";
-import { banner, box, colors, formatConfig, formatEvent, statusBar } from "./ui.ts";
-import { startServer } from "./server.ts";
-import { exportLocalSnapshot, remoteSyncStatus } from "./sync.ts";
-
-export type ParsedArgs = { flags: Record<string, string | boolean>; positional: string[] };
-
-function version(): string {
-  const embedded = process.env.DEVTHINK_VERSION?.trim();
-  if (embedded) return embedded;
-  try {
-    const file = new URL("./package.json", import.meta.url);
-    return String((JSON.parse(readFileSync(file, "utf8")) as { version?: string }).version || "0.0.0");
-  } catch {
-    return "0.0.0";
-  }
-}
-
-function parseArgs(args: string[]): ParsedArgs {
-  const flags: Record<string, string | boolean> = {};
-  const positional: string[] = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const value = args[index];
-    if (!value.startsWith("-")) {
-      positional.push(value);
-      continue;
-    }
-    const key = value.replace(/^-+/, "");
-    const next = args[index + 1];
-    if (next && !next.startsWith("-")) {
-      flags[key] = next;
-      index += 1;
-    } else flags[key] = true;
-  }
-  return { flags, positional };
-}
-
-function stringFlag(parsed: ParsedArgs, key: string): string | undefined {
-  const value = parsed.flags[key];
-  return typeof value === "string" ? value : undefined;
-}
-
-function boolFlag(parsed: ParsedArgs, key: string): boolean {
-  return parsed.flags[key] === true;
-}
-
-function printHelp(): void {
-  console.log([
-    `${colors.cyan}${colors.bold}DevThink CLI${colors.reset} v${version()}`,
-    "",
-    "Usage: devthink <command> [options]",
-    "",
-    "Commands:",
-    "  chat [message]             Stream a model response",
-    "  providers                 List supported provider transports",
-    "  models --provider <id>    List provider models",
-    "  modes                     List the 20 operational modes",
-    "  config [key] [value]      Read or write local configuration",
-    "  config preferences         Show shared workbench preferences",
-    "  config settings            Show shared identity, pairing, provider and database summary",
-    "  config set <key> <value>  Set theme, railMode, or interfaceZoom",
-    "  auth login <provider>     Save a user-provided official credential",
-    "  auth status               Show redacted configured credential sources",
-    "  auth clear <provider>     Remove a stored provider credential",
-    "  auth migrate              Move legacy config credentials into auth.json",
-    "  identity [--id <value>]   Show or set the local public user identifier",
-    "  pair create               Create an automatic one-time link for the web workbench",
-    "  pair revoke               Revoke current paired browser sessions",
-    "  sync status               Show local snapshot and remote adapter readiness",
-    "  sync export               Print a credential-free local sync snapshot",
-    "  gateway status            Show the embedded provider gateway state",
-    "  sessions list             List saved sessions",
-    "  sessions export <id>      Print a session as Markdown or JSON",
-    "  projects                  List local workspaces shared with the web",
-    "  usage                     Show local workspace, session, tab and message counts",
-    "  routes                    List browser and gateway routes",
-    "  serve [--port <n>]        Start the local loopback API",
-    "  init                      Create local DevThink directories",
-    "  interactive               Start the terminal chat loop",
-    "",
-    "Chat options:",
-    "  --provider <id>           openai, zai, anthropic, google, openrouter, qwen, deepseek, groq, mistral, xai, ollama, mimo",
-    "  --model <id>              Provider model identifier",
-    "  --mode <id>               One of the 20 registered modes",
-    "  --prompt <text>           Explicit prompt, useful in scripts",
-    "  --format json             Emit one machine-readable result",
-    "  --no-save                 Do not persist the session",
-    "",
-    "Credentials are read from ~/.config/devthink/auth.json or environment variables. Browser-cookie capture and anti-bot bypass are not supported.",
-  ].join("\n"));
-}
-
-function loadRuntime(): { config: DevThinkConfig; paths: ReturnType<typeof resolvePaths>; memory: ReturnType<typeof createMemoryStore> } {
-  const paths = ensurePaths(resolvePaths());
-  const config = readConfig(paths);
-  return { config, paths, memory: createMemoryStore(paths) };
-}
-
-function printEvents(events: ChatEvent[], json: boolean): void {
-  if (json) {
-    console.log(JSON.stringify(events));
-    return;
-  }
-  for (const event of events) {
-    const rendered = formatEvent(event);
-    if (rendered) process.stdout.write(rendered);
-  }
-  process.stdout.write("\n");
-}
-
-async function runChat(prompt: string, parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>, current?: Session, render?: { onEvent?: (event: ChatEvent) => void; silent?: boolean }): Promise<Session | undefined> {
-  const provider = stringFlag(parsed, "provider") || runtime.config.activeProvider || runtime.config.provider;
-  const model = stringFlag(parsed, "model") || runtime.config.activeModel || runtime.config.model;
-  const mode = stringFlag(parsed, "mode") || "chat";
-  if (!provider || !model) throw new Error("Set provider and model with --provider/--model or devthink config.");
-  const modeDefinition = resolveMode(mode);
-  const requestedSession = stringFlag(parsed, "session");
-  const session = current || (requestedSession ? loadSession(runtime.paths, requestedSession) : undefined) || createSession(runtime.paths, { mode: modeDefinition.id, model, provider, workspaceId: stringFlag(parsed, "workspace"), tabId: stringFlag(parsed, "tab") });
-  const storedMemory = runtime.memory.resolve({ text: prompt, sessionId: session.id });
-  const system = [modePrompt(modeDefinition), storedMemory ? `Relevant local memory: ${storedMemory.content}` : memorySummary(runtime.memory)].filter(Boolean).join("\n\n");
-  const userMessage = { role: "user" as const, content: prompt };
-  const nextSession = appendMessage(runtime.paths, session, userMessage);
-  const events: ChatEvent[] = [];
-  let text = "";
-  let reasoning = "";
-  const json = stringFlag(parsed, "format") === "json";
-  const stream = await streamChat({ provider, model, messages: [{ role: "system", content: system }, ...nextSession.messages.map(({ role, content }) => ({ role, content }))], temperature: runtime.config.temperature, maxTokens: runtime.config.maxTokens }, runtime.config, runtime.paths);
-  for await (const event of stream) {
-    events.push(event);
-    if (event.type === "text") text += event.text;
-    if (event.type === "reasoning") reasoning += event.text;
-    render?.onEvent?.(event);
-    if (!json && !render?.silent) {
-      const rendered = formatEvent(event);
-      if (rendered) process.stdout.write(rendered);
-    }
-  }
-  const withAssistant = appendMessage(runtime.paths, nextSession, { role: "assistant", content: text });
-  runtime.memory.remember({ layer: "session", key: withAssistant.id, content: text.slice(0, 2000) });
-  if (json) console.log(JSON.stringify({ workspaceId: withAssistant.workspaceId, sessionId: withAssistant.id, tabId: withAssistant.activeTabId, messageId: withAssistant.messages.at(-1)?.id, provider, model, mode: modeDefinition.id, text, reasoning }));
-  else if (!render?.silent) process.stdout.write("\n");
-  return withAssistant;
-}
-
-async function handleConfig(parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>): Promise<void> {
-  const action = parsed.positional[1];
-  if (action === "settings") {
-    const identity = getIdentity(runtime.paths);
-    const sessions = listSessions(runtime.paths);
-    return console.log(JSON.stringify({
-      identity,
-      pairing: pairingStatus(runtime.paths),
-      preferences: Object.fromEntries(Object.entries(readPreferences(runtime.paths)).map(([key, preference]) => [key, preference.value])),
-      provider: { activeProvider: runtime.config.activeProvider || runtime.config.provider || undefined, activeModel: runtime.config.activeModel || runtime.config.model || undefined },
-      database: { ownerUserId: identity.userId, local: true, persistence: "cli-owned-sqlite", workspaces: new Set(sessions.map((session) => session.workspaceId)).size, sessions: sessions.length },
-    }, null, 2));
-  }
-  if (action === "preferences") return console.log(JSON.stringify(Object.fromEntries(Object.entries(readPreferences(runtime.paths)).map(([key, preference]) => [key, preference.value])), null, 2));
-  if (action === "set") {
-    const key = parsed.positional[2];
-    const value = parsed.positional[3];
-    if (!key || !value) throw new Error("Usage: devthink config set <theme|railMode|interfaceZoom> <value>");
-    const valid = (key === "theme" && ["dark", "light"].includes(value)) || (key === "railMode" && ["always", "auto", "off"].includes(value)) || (key === "interfaceZoom" && /^(?:[8-9][0-9]|1[0-4][0-9]|150)$/.test(value));
-    if (!valid) throw new Error("Supported values: theme dark|light; railMode always|auto|off; interfaceZoom 80-150.");
-    savePreference(runtime.paths, key, value);
-    return console.log(`${key} updated.`);
-  }
-  const key = action;
-  const raw = parsed.positional[2];
-  if (!key) return console.log(formatConfig(redactConfig(runtime.config)));
-  if (raw === undefined) return console.log(`${key} = ${JSON.stringify(getConfigValue(runtime.config, key))}`);
-  saveConfig(setConfigValue(runtime.config, key, parseConfigValue(raw)), runtime.paths);
-  console.log(`${key} updated.`);
-}
-
-async function handleAuth(parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>): Promise<void> {
-  const action = parsed.positional[1] || "status";
-  if (action === "status") return console.log(JSON.stringify({ config: redactConfig(runtime.config), auth: redactAuth(readAuth(runtime.paths)), authPath: runtime.paths.auth }, null, 2));
-  if (action === "login") {
-    const provider = parsed.positional[2];
-    const token = stringFlag(parsed, "token") || stringFlag(parsed, "api-key");
-    const kind = stringFlag(parsed, "kind") || "api-key";
-    if (!provider || !token) throw new Error("Usage: devthink auth login <provider> --token <user-provided-credential> [--kind api-key|bearer|oauth]");
-    if (!(["api-key", "bearer", "oauth"] as string[]).includes(kind)) throw new Error("--kind must be api-key, bearer or oauth.");
-    const expiresAt = stringFlag(parsed, "expires-at");
-    const refreshToken = stringFlag(parsed, "refresh-token");
-    const resourceUrl = stringFlag(parsed, "resource-url");
-    const credential = kind === "oauth" ? { kind: "oauth" as const, accessToken: token, ...(refreshToken ? { refreshToken } : {}), ...(expiresAt ? { expiresAt: Number(expiresAt) } : {}), ...(resourceUrl ? { resourceUrl } : {}) } : { kind: kind as "api-key" | "bearer", value: token };
-    setAuthCredential(provider, credential, runtime.paths);
-    saveConfig({ ...runtime.config, activeProvider: runtime.config.activeProvider || provider }, runtime.paths);
-    return console.log(`${provider} credential saved to ${runtime.paths.auth}.`);
-  }
-  if (action === "clear") {
-    const provider = parsed.positional[2];
-    if (!provider) throw new Error("Usage: devthink auth clear <provider>");
-    clearAuthCredential(provider, runtime.paths);
-    const next = { ...runtime.config };
-    const providers = { ...(next.providers || {}) };
-    if (providers[provider]) {
-      const { auth: _auth, apiKey: _apiKey, ...remaining } = providers[provider];
-      providers[provider] = remaining;
-    }
-    next.providers = providers;
-    delete (next as Record<string, unknown>)[`${provider}ApiKey`];
-    saveConfig(next, runtime.paths);
-    return console.log(`${provider} credential cleared from ${runtime.paths.auth}; legacy config fields were removed if present.`);
-  }
-  if (action === "migrate") {
-    const result = migrateLegacyCredentials(runtime.config, runtime.paths);
-    return console.log(result.migrated.length ? `Migrated ${result.migrated.join(", ")} to ${runtime.paths.auth}.` : "No legacy credentials needed migration.");
-  }
-  throw new Error("Supported auth actions: login, status, clear, migrate.");
-}
-
-function handleIdentity(parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>): void {
-  const requestedUserId = stringFlag(parsed, "id");
-  const identity = requestedUserId ? setIdentityUserId(runtime.paths, requestedUserId) : getIdentity(runtime.paths);
-  console.log(JSON.stringify({ identity, pairing: pairingStatus(runtime.paths) }, null, 2));
-}
-
-function handlePairing(parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>): void {
-  const action = parsed.positional[1] || "create";
-  if (action === "status") return handleIdentity(parsed, runtime);
-  if (action === "revoke") return console.log(`Revoked ${revokeBrowserSessions(runtime.paths)} paired browser session(s).`);
-  if (action !== "create") throw new Error("Supported pair actions: create, status, revoke.");
-  const pairing = createPairing(runtime.paths);
-  const pagesUrl = stringFlag(parsed, "web-url") || runtime.config.web?.pagesUrl;
-  const gatewayUrl = stringFlag(parsed, "gateway") || runtime.config.web?.gatewayUrl;
-  const openUrl = createPairingLink(pagesUrl, gatewayUrl, pairing.pairingId, pairing.code);
-  console.log(JSON.stringify({ userId: pairing.identity.userId, pairingId: pairing.pairingId, code: pairing.code, expiresAt: pairing.expiresAt, ...(pagesUrl ? { pagesUrl } : {}), ...(gatewayUrl ? { gatewayUrl } : {}), ...(openUrl ? { openUrl } : {}), message: openUrl ? "Open openUrl to prefill and consume this one-time local invitation automatically." : "Set web.pagesUrl and web.gatewayUrl, or pass --web-url and --gateway, to generate an automatic invitation link." }, null, 2));
-}
-
-function handleSync(parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>): void {
-  const action = parsed.positional[1] || "status";
-  const snapshot = exportLocalSnapshot(runtime.paths);
-  if (action === "export") return console.log(JSON.stringify(snapshot, null, 2));
-  if (action === "status") return console.log(JSON.stringify({ userId: snapshot.userId, deviceId: snapshot.deviceId, workspaces: snapshot.workspaces.length, sessions: snapshot.sessions.length, remote: remoteSyncStatus(runtime.config) }, null, 2));
-  throw new Error("Supported sync actions: status, export.");
-}
-
-function handleGateway(runtime: ReturnType<typeof loadRuntime>): void {
-  const activeProvider = runtime.config.activeProvider || runtime.config.provider || "not configured";
-  const endpoint = activeProvider === "not configured" ? undefined : runtime.config.providers?.[activeProvider]?.baseUrl || runtime.config.baseUrl;
-  console.log(formatConfig({
-    mode: runtime.config.gateway?.mode || "embedded",
-    streaming: runtime.config.gateway?.stream ?? true,
-    activeProvider,
-    endpoint: endpoint || "provider default",
-    webEnabled: runtime.config.web?.enabled ?? true,
-    config: runtime.paths.config,
-    auth: runtime.paths.auth,
-  }));
-}
-
-async function handleSessions(parsed: ParsedArgs, runtime: ReturnType<typeof loadRuntime>): Promise<void> {
-  const action = parsed.positional[1] || "list";
-  if (action === "list") return console.log(listSessions(runtime.paths).map((session) => `${session.id}  ${session.title}`).join("\n") || "No sessions.");
-  if (action === "export") {
-    const id = parsed.positional[2];
-    if (!id) throw new Error("Usage: devthink sessions export <id>");
-    console.log(exportSession(runtime.paths, id, stringFlag(parsed, "format") === "json" ? "json" : "markdown"));
-    return;
-  }
-  throw new Error("Supported session actions: list, export.");
-}
-
-function handleProjects(runtime: ReturnType<typeof loadRuntime>): void {
-  const projects = new Map<string, { title: string; sessions: number; updatedAt: string }>();
-  for (const session of listSessions(runtime.paths)) {
-    const current = projects.get(session.workspaceId);
-    projects.set(session.workspaceId, { title: current?.title || session.title.replace(/^Untitled session$/, "Untitled workspace"), sessions: (current?.sessions || 0) + 1, updatedAt: current?.updatedAt && current.updatedAt > session.updatedAt ? current.updatedAt : session.updatedAt });
-  }
-  const output = [...projects.entries()].sort((left, right) => right[1].updatedAt.localeCompare(left[1].updatedAt)).map(([id, project]) => `${id}  ${project.sessions} session${project.sessions === 1 ? "" : "s"}  ${project.title}`);
-  console.log(output.join("\n") || "No projects.");
-}
-
-function handleUsage(runtime: ReturnType<typeof loadRuntime>): void {
-  const sessions = listSessions(runtime.paths);
-  console.log(JSON.stringify({ workspaces: new Set(sessions.map((session) => session.workspaceId)).size, sessions: sessions.length, tabs: sessions.reduce((total, session) => total + session.tabs.length, 0), messages: sessions.reduce((total, session) => total + session.messages.length, 0), providers: listProviders().length }, null, 2));
-}
-
-function handleRoutes(): void {
-  console.log(["web: /", "web: /providers", "web: /projects", "web: /routes", "web: /usage", "web: /settings", "web: /w/:workspaceId/s/:sessionId/t/:tabId/:sectionId", "gateway: GET /health", "gateway: GET /identity", "gateway: PUT /identity", "gateway: GET /settings", "gateway: GET /providers", "gateway: GET /workspaces", "gateway: GET /usage", "gateway: GET /preferences", "gateway: PATCH /preferences", "gateway: POST /sessions", "gateway: POST /chat"].join("\n"));
-}
-
-async function interactive(runtime: ReturnType<typeof loadRuntime>): Promise<void> {
-  if (process.stdin.isTTY && process.stdout.isTTY && process.env.DEVTHINK_PLAIN !== "1") {
-    try {
-      const { startTerminalWorkspace } = await import("./terminal-ui.tsx");
-      return await startTerminalWorkspace(runtime, version(), (prompt, current, onEvent) => runChat(prompt, { flags: { mode: runtime.config.mode || "chat" }, positional: [] }, runtime, current, { onEvent, silent: true }));
-    } catch (error) {
-      process.stderr.write(`${colors.yellow}Terminal workspace fallback: ${error instanceof Error ? error.message : "renderer unavailable"}${colors.reset}\n`);
-    }
-  }
-  const input = createInterface({ input: stdin, output: stdout, terminal: true });
-  let session: Session | undefined;
-  let mode = runtime.config.mode || "chat";
-  console.log(banner(version()));
-  console.log(box("status", statusBar(runtime.config.activeProvider || runtime.config.provider || "not configured", runtime.config.activeModel || runtime.config.model || "not configured", mode)));
-  console.log("Type a message or /help. Use /exit to leave.");
-  try {
-    while (true) {
-      const value = (await input.question("> ")).trim();
-      if (!value) continue;
-      if (value === "/exit" || value === "/quit") break;
-      if (value === "/help") {
-        console.log("/models  /modes  /new  /sessions  /mode <id>  /clear  /exit");
-        continue;
-      }
-      if (value === "/clear") {
-        console.clear();
-        continue;
-      }
-      if (value === "/new") {
-        session = undefined;
-        console.log("New session ready.");
-        continue;
-      }
-      if (value.startsWith("/mode ")) {
-        mode = resolveMode(value.slice(6).trim()).id;
-        console.log(`Mode: ${mode}`);
-        continue;
-      }
-      if (value === "/modes") {
-        console.log(listModes().map((item) => `${item.id}  ${item.purpose}`).join("\n"));
-        continue;
-      }
-      if (value === "/sessions") {
-        console.log(listSessions(runtime.paths).map((item) => `${item.id}  ${item.title}`).join("\n") || "No sessions.");
-        continue;
-      }
-      if (value === "/models") {
-        const provider = runtime.config.activeProvider || runtime.config.provider;
-        if (!provider) console.log("Configure a provider first.");
-        else console.log((await listModels(provider, runtime.config)).map((item) => item.id).join("\n"));
-        continue;
-      }
-      session = await runChat(value, { flags: { mode }, positional: [] }, runtime, session);
-    }
-  } finally {
-    input.close();
-  }
-}
-
-export async function main(argv = process.argv.slice(2)): Promise<void> {
-  const parsed = parseArgs(argv);
-  const runtime = loadRuntime();
-  const command = parsed.positional[0] || (process.stdin.isTTY ? "interactive" : "help");
-  if (boolFlag(parsed, "help") || command === "help") return printHelp();
-  if (boolFlag(parsed, "version") || command === "version") return console.log(version());
-  if (command === "init") return console.log(`Initialized ${runtime.paths.home}\nConfig: ${runtime.paths.config}`);
-  if (command === "providers") return console.log(listProviders().map((provider) => `${provider.id}  ${provider.protocol}  ${provider.env}`).join("\n"));
-  if (command === "modes") return console.log(listModes().map((mode) => `${mode.id}  ${mode.purpose}`).join("\n"));
-  if (command === "config") return handleConfig(parsed, runtime);
-  if (command === "auth") return handleAuth(parsed, runtime);
-  if (command === "identity") return handleIdentity(parsed, runtime);
-  if (command === "pair") return handlePairing(parsed, runtime);
-  if (command === "sync") return handleSync(parsed, runtime);
-  if (command === "gateway") return handleGateway(runtime);
-  if (command === "sessions") return handleSessions(parsed, runtime);
-  if (command === "projects") return handleProjects(runtime);
-  if (command === "usage") return handleUsage(runtime);
-  if (command === "routes") return handleRoutes();
-  if (command === "models") {
-    const provider = stringFlag(parsed, "provider") || runtime.config.activeProvider || runtime.config.provider;
-    if (!provider) throw new Error("Use --provider or configure provider.");
-    return console.log((await listModels(provider, runtime.config, runtime.paths)).map((model) => `${model.id}  ${model.provider}`).join("\n"));
-  }
-  if (command === "serve") {
-    const server = await startServer({ port: stringFlag(parsed, "port") ? Number(stringFlag(parsed, "port")) : undefined, config: runtime.config, paths: runtime.paths });
-    console.log(`DevThink API listening at ${server.address}`);
-    return;
-  }
-  if (command === "interactive") return interactive(runtime);
-  if (command === "chat") {
-    const prompt = stringFlag(parsed, "prompt") || parsed.positional.slice(1).join(" ");
-    if (!prompt) throw new Error("Usage: devthink chat --prompt \"your message\"");
-    return void (await runChat(prompt, parsed, runtime));
-  }
-  throw new Error(`Unknown command: ${command}`);
-}
-
-const directEntry = process.argv[1]?.endsWith("devthink.ts") || process.argv[1]?.endsWith("devthink");
-const bunEntry = (import.meta as ImportMeta & { main?: boolean }).main === true;
-if (directEntry || bunEntry) main().catch((error: unknown) => { console.error(`${colors.red}Error:${colors.reset} ${error instanceof Error ? error.message : "Command failed."}`); process.exitCode = 1; });

package/identity.ts

@@ -1,156 +0,0 @@
-import { createHash, randomInt, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { ensurePaths, type DevThinkPaths } from "./config.ts";
-import { createCompactId } from "./ids.ts";
-
-export type DevThinkIdentity = { version: 1; userId: string; deviceId: string; createdAt: string };
-export type PairingRecord = { id: string; userId: string; deviceId: string; codeHash?: string; createdAt: string; expiresAt: number; usedAt?: string; revokedAt?: string };
-export type BrowserSession = { id: string; userId: string; deviceId: string; tokenHash: string; createdAt: string; expiresAt: number; revokedAt?: string };
-type PairingStore = { version: 1; pairings: PairingRecord[]; sessions: BrowserSession[] };
-
-const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-const codeLength = 8;
-const pairingLifetimeMs = 5 * 60 * 1000;
-const browserSessionLifetimeMs = 15 * 60 * 1000;
-
-export function normalizePublicUserId(value: string): string {
-  const userId = value.trim().toLowerCase();
-  if (!/^[a-z][a-z0-9]{9,14}$/.test(userId)) throw new Error("Public user ID must contain 10-15 lowercase letters or numbers and start with a letter.");
-  return userId;
-}
-
-function digest(value: string): string {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-function privateWrite(path: string, value: unknown): void {
-  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  renameSync(temporary, path);
-}
-
-function createId(prefix: string): string {
-  return createCompactId(prefix);
-}
-
-function code(): string {
-  return Array.from({ length: codeLength }, () => alphabet[randomInt(alphabet.length)]).join("");
-}
-
-export function getIdentity(paths: DevThinkPaths): DevThinkIdentity {
-  ensurePaths(paths);
-  try {
-    if (existsSync(paths.identity)) {
-      const parsed: unknown = JSON.parse(readFileSync(paths.identity, "utf8"));
-      if (parsed && typeof parsed === "object" && typeof (parsed as DevThinkIdentity).userId === "string" && typeof (parsed as DevThinkIdentity).deviceId === "string") return parsed as DevThinkIdentity;
-    }
-  } catch {}
-  const identity: DevThinkIdentity = { version: 1, userId: createId("u"), deviceId: createId("d"), createdAt: new Date().toISOString() };
-  privateWrite(paths.identity, identity);
-  return identity;
-}
-
-/** Updates the public local-person identifier and migrates active local pairing records. */
-export function setIdentityUserId(paths: DevThinkPaths, requestedUserId: string): DevThinkIdentity {
-  const current = getIdentity(paths);
-  const userId = normalizePublicUserId(requestedUserId);
-  if (current.userId === userId) return current;
-  const next = { ...current, userId };
-  privateWrite(paths.identity, next);
-  const store = readStore(paths);
-  for (const record of store.pairings) if (record.userId === current.userId) record.userId = userId;
-  for (const session of store.sessions) if (session.userId === current.userId) session.userId = userId;
-  writeStore(paths, store);
-  return next;
-}
-
-function readStore(paths: DevThinkPaths): PairingStore {
-  try {
-    if (existsSync(paths.pairings)) {
-      const parsed: unknown = JSON.parse(readFileSync(paths.pairings, "utf8"));
-      if (parsed && typeof parsed === "object" && Array.isArray((parsed as PairingStore).pairings) && Array.isArray((parsed as PairingStore).sessions)) return parsed as PairingStore;
-    }
-  } catch {}
-  return { version: 1, pairings: [], sessions: [] };
-}
-
-function writeStore(paths: DevThinkPaths, store: PairingStore): void {
-  ensurePaths(paths);
-  privateWrite(paths.pairings, store);
-}
-
-function active(store: PairingStore): PairingStore {
-  const now = Date.now();
-  return { version: 1, pairings: store.pairings.filter((record) => record.expiresAt > now || Boolean(record.usedAt) || Boolean(record.revokedAt)).slice(-100), sessions: store.sessions.filter((session) => session.expiresAt > now && !session.revokedAt).slice(-100) };
-}
-
-export function createPairing(paths: DevThinkPaths, lifetimeMs = pairingLifetimeMs): { identity: DevThinkIdentity; pairingId: string; code: string; expiresAt: number } {
-  const identity = getIdentity(paths);
-  const store = active(readStore(paths));
-  const pairingId = createId("p");
-  const oneTimeCode = code();
-  const expiresAt = Date.now() + lifetimeMs;
-  store.pairings.push({ id: pairingId, userId: identity.userId, deviceId: identity.deviceId, codeHash: digest(oneTimeCode), createdAt: new Date().toISOString(), expiresAt });
-  writeStore(paths, store);
-  return { identity, pairingId, code: oneTimeCode, expiresAt };
-}
-
-/** Builds a one-time workbench invitation without embedding any provider credential. */
-export function createPairingLink(pagesUrl: string | undefined, gatewayUrl: string | undefined, pairingId: string, oneTimeCode: string): string | undefined {
-  if (!pagesUrl || !gatewayUrl) return undefined;
-  try {
-    const url = new URL(pagesUrl);
-    url.searchParams.set("gateway", gatewayUrl);
-    url.searchParams.set("pair", pairingId);
-    url.searchParams.set("code", oneTimeCode);
-    return url.toString();
-  } catch {
-    return undefined;
-  }
-}
-
-export function consumePairing(paths: DevThinkPaths, pairingId: string, oneTimeCode: string, sessionLifetimeMs = browserSessionLifetimeMs): { token: string; identity: DevThinkIdentity; expiresAt: number } | undefined {
-  const store = active(readStore(paths));
-  const record = store.pairings.find((candidate) => candidate.id === pairingId && !candidate.usedAt && !candidate.revokedAt && candidate.expiresAt > Date.now());
-  if (!record?.codeHash) return undefined;
-  const supplied = Buffer.from(digest(oneTimeCode));
-  const stored = Buffer.from(record.codeHash);
-  if (supplied.length !== stored.length || !timingSafeEqual(supplied, stored)) return undefined;
-  const token = createId("pt");
-  const expiresAt = Date.now() + sessionLifetimeMs;
-  record.usedAt = new Date().toISOString();
-  delete record.codeHash;
-  store.sessions.push({ id: createId("bs"), userId: record.userId, deviceId: record.deviceId, tokenHash: digest(token), createdAt: new Date().toISOString(), expiresAt });
-  writeStore(paths, store);
-  return { token, identity: getIdentity(paths), expiresAt };
-}
-
-export function verifyBrowserSession(paths: DevThinkPaths, token: string | undefined): BrowserSession | undefined {
-  if (!token) return undefined;
-  const store = active(readStore(paths));
-  const tokenHash = digest(token);
-  const session = store.sessions.find((candidate) => candidate.tokenHash === tokenHash && candidate.expiresAt > Date.now() && !candidate.revokedAt);
-  writeStore(paths, store);
-  return session;
-}
-
-export function revokeBrowserSessions(paths: DevThinkPaths): number {
-  const store = readStore(paths);
-  const identity = getIdentity(paths);
-  let count = 0;
-  for (const session of store.sessions) {
-    if (session.userId === identity.userId && !session.revokedAt) {
-      session.revokedAt = new Date().toISOString();
-      count += 1;
-    }
-  }
-  writeStore(paths, store);
-  return count;
-}
-
-export function pairingStatus(paths: DevThinkPaths): { identity: DevThinkIdentity; activePairs: number; activeSessions: number } {
-  const store = active(readStore(paths));
-  writeStore(paths, store);
-  const identity = getIdentity(paths);
-  return { identity, activePairs: store.pairings.filter((record) => record.userId === identity.userId && !record.usedAt && !record.revokedAt && record.expiresAt > Date.now()).length, activeSessions: store.sessions.filter((session) => session.userId === identity.userId && !session.revokedAt && session.expiresAt > Date.now()).length };
-}

package/ids.ts

@@ -1,22 +0,0 @@
-/** DevThink identity contract: compact, lowercase, URL-safe identifiers for new local records. */
-import { randomBytes } from "node:crypto";
-
-const alphabet = "0123456789abcdefghjkmnpqrstvwxyz";
-const tokenLength = 10;
-
-/** Generates a 50-bit compact suffix that avoids ambiguous characters. */
-export function compactToken(): string {
-  const bytes = randomBytes(tokenLength);
-  return Array.from(bytes, (value) => alphabet[value & 31]).join("");
-}
-
-/** Creates a short identifier such as `s_1e9k2m7v3q`; existing longer IDs remain valid inputs. */
-export function createCompactId(prefix: string): string {
-  const normalized = prefix.toLowerCase().replace(/[^a-z0-9]/g, "").slice(0, 4) || "id";
-  return `${normalized}_${compactToken()}`;
-}
-
-/** Identifies the compact format without rejecting existing legacy identifiers. */
-export function isCompactId(value: string): boolean {
-  return /^[a-z0-9]{1,4}_[0123456789abcdefghjkmnpqrstvwxyz]{10}$/.test(value);
-}