dsh-account-authorization 0.1.0

package/lib/index.js

@@ -0,0 +1,548 @@
+import AuthorizationService, { AuthorizationDeclinedError, AuthorizationError } from "@deepseek-ai/dsh-authorization";
+import { createHash, randomUUID } from "node:crypto";
+import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+//#region ../lib/types/authorization-compat.js
+/**
+* DSH Desktop 2.0.3 compatibility service.
+*
+* Its bundled authorization service accepts flow metadata but drops it from
+* list()/describe(). Preserve that opaque metadata while leaving flow,
+* credential, and attempt ownership with the Harness authorization service.
+*/
+var TargetPreservingAuthorizationService = class extends AuthorizationService {
+	targets = /* @__PURE__ */ new Map();
+	registerFlow(flow) {
+		const disposeFlow = super.registerFlow(flow);
+		const target = "target" in flow ? flow.target : void 0;
+		if (target === void 0) {
+			this.targets.delete(flow.key);
+			return disposeFlow;
+		}
+		let disposeTarget;
+		try {
+			disposeTarget = this.ctx.effect(() => {
+				this.targets.set(flow.key, target);
+				return () => {
+					if (this.targets.get(flow.key) === target) this.targets.delete(flow.key);
+				};
+			}, "account-authorization: project flow target");
+		} catch (error) {
+			disposeFlow();
+			throw error;
+		}
+		return () => {
+			try {
+				disposeTarget();
+			} finally {
+				disposeFlow();
+			}
+		};
+	}
+	list() {
+		return super.list().map((entry) => this.projectTarget(entry));
+	}
+	describe(key) {
+		const entry = super.describe(key);
+		return entry === void 0 ? void 0 : this.projectTarget(entry);
+	}
+	projectTarget(entry) {
+		const target = this.targets.get(entry.key);
+		return target === void 0 ? entry : Object.assign({}, entry, { target });
+	}
+};
+//#endregion
+//#region ../lib/types/host/index.js
+/** Provider-neutral projection of Harness-owned authorization flows. */
+var __runInitializers = function(thisArg, initializers, value) {
+	var useValue = arguments.length > 2;
+	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+	return useValue ? value : void 0;
+};
+var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+	function accept(f) {
+		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
+		return f;
+	}
+	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+	var _, done = false;
+	for (var i = decorators.length - 1; i >= 0; i--) {
+		var context = {};
+		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+		context.addInitializer = function(f) {
+			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
+			extraInitializers.push(accept(f || null));
+		};
+		var result = (0, decorators[i])(kind === "accessor" ? {
+			get: descriptor.get,
+			set: descriptor.set
+		} : descriptor[key], context);
+		if (kind === "accessor") {
+			if (result === void 0) continue;
+			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+			if (_ = accept(result.get)) descriptor.get = _;
+			if (_ = accept(result.set)) descriptor.set = _;
+			if (_ = accept(result.init)) initializers.unshift(_);
+		} else if (_ = accept(result)) if (kind === "field") initializers.unshift(_);
+		else descriptor[key] = _;
+	}
+	if (target) Object.defineProperty(target, contextIn.name, descriptor);
+	done = true;
+};
+const MAX_RETAINED_ATTEMPTS = 32;
+const MAX_RETAINED_COMMANDS = 64;
+const MAX_RETAINED_REQUESTS = 128;
+const MAX_LABEL_LENGTH = 256;
+const MAX_CODE_LENGTH = 256;
+const MAX_AUTHORIZATION_URL_LENGTH = 4096;
+const MAX_CHOICES = 32;
+function connectionId(key) {
+	return createHash("sha256").update(key).digest("base64url");
+}
+function bounded(value, maximum = MAX_LABEL_LENGTH) {
+	return value.length <= maximum ? value : value.slice(0, maximum);
+}
+function safeAuthorizationUrl(value) {
+	if (value === void 0 || value.length > MAX_AUTHORIZATION_URL_LENGTH) return void 0;
+	try {
+		const url = new URL(value);
+		const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "::1";
+		return url.protocol === "https:" || url.protocol === "http:" && loopback ? url.href : void 0;
+	} catch {
+		return;
+	}
+}
+function methodKind(id) {
+	const normalized = id.toLowerCase();
+	if (normalized.includes("device")) return "device";
+	if (normalized === "oauth" || normalized.includes("browser")) return "browser";
+	return "other";
+}
+function noticeView(notice) {
+	const url = safeAuthorizationUrl(notice.url);
+	if (notice.code !== void 0) return {
+		kind: "device",
+		...url === void 0 ? {} : { url },
+		code: bounded(notice.code, MAX_CODE_LENGTH)
+	};
+	if (url !== void 0) return {
+		kind: "browser",
+		url
+	};
+	return { kind: "waiting" };
+}
+function failure(error, unsupportedInput) {
+	if (unsupportedInput) return {
+		status: "failed",
+		code: "input-required"
+	};
+	if (error instanceof AuthorizationError) {
+		if (error.code === "NO_FLOW") return {
+			status: "failed",
+			code: "unavailable"
+		};
+		if (error.code === "UNKNOWN_METHOD") return {
+			status: "failed",
+			code: "unknown-method"
+		};
+		if (error.code === "ALREADY_IN_FLIGHT") return {
+			status: "failed",
+			code: "in-flight"
+		};
+		if (error.code === "NOT_COMMITTED") return {
+			status: "failed",
+			code: "not-committed"
+		};
+	}
+	return {
+		status: "failed",
+		code: "flow-failed"
+	};
+}
+function assertRequestId(value) {
+	if (!/^[A-Za-z0-9_-]{8,128}$/.test(value)) throw new TypeError("requestId is invalid");
+}
+function isModelAuthorization(entry) {
+	if (!("target" in entry)) return false;
+	const target = entry.target;
+	return typeof target === "object" && target !== null && "kind" in target && target.kind === "llm-provider" && "providerId" in target && typeof target.providerId === "string" && target.providerId.length > 0;
+}
+/** Host service. Harness remains the only owner of flows, attempts, credentials, Providers, and models. */
+let AccountAuthorizationService = (() => {
+	let _classSuper = TypertRemoteService;
+	let _instanceExtraInitializers = [];
+	let _connections_decorators;
+	let _start_decorators;
+	let _observe_decorators;
+	let _choose_decorators;
+	let _cancel_decorators;
+	let _disconnect_decorators;
+	return class AccountAuthorizationService extends _classSuper {
+		static {
+			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+			_connections_decorators = [Remote("connections")];
+			_start_decorators = [Remote("start")];
+			_observe_decorators = [Remote("observe")];
+			_choose_decorators = [Remote("choose")];
+			_cancel_decorators = [Remote("cancel")];
+			_disconnect_decorators = [Remote("disconnect")];
+			__esDecorate(this, null, _connections_decorators, {
+				kind: "method",
+				name: "connections",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "connections" in obj,
+					get: (obj) => obj.connections
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _start_decorators, {
+				kind: "method",
+				name: "start",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "start" in obj,
+					get: (obj) => obj.start
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _observe_decorators, {
+				kind: "method",
+				name: "observe",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "observe" in obj,
+					get: (obj) => obj.observe
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _choose_decorators, {
+				kind: "method",
+				name: "choose",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "choose" in obj,
+					get: (obj) => obj.choose
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _cancel_decorators, {
+				kind: "method",
+				name: "cancel",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "cancel" in obj,
+					get: (obj) => obj.cancel
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _disconnect_decorators, {
+				kind: "method",
+				name: "disconnect",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "disconnect" in obj,
+					get: (obj) => obj.disconnect
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
+				enumerable: true,
+				configurable: true,
+				writable: true,
+				value: _metadata
+			});
+		}
+		static inject = ["authorization", "credentials"];
+		attempts = (__runInitializers(this, _instanceExtraInitializers), /* @__PURE__ */ new Map());
+		startRequests = /* @__PURE__ */ new Map();
+		disconnectRequests = /* @__PURE__ */ new Map();
+		disconnectingConnections = /* @__PURE__ */ new Set();
+		constructor(ctx) {
+			super(ctx, "accountAuthorization");
+			ctx.effect(() => () => {
+				for (const attempt of this.attempts.values()) {
+					attempt.pending?.reject(new AuthorizationDeclinedError());
+					attempt.pending?.dispose();
+					attempt.controller.abort();
+				}
+				this.attempts.clear();
+				this.startRequests.clear();
+				this.disconnectRequests.clear();
+				this.disconnectingConnections.clear();
+			}, "account-authorization: dispose attempts");
+		}
+		flowByConnection(id) {
+			return this.ctx.authorization.list().find((entry) => isModelAuthorization(entry) && connectionId(entry.key) === id);
+		}
+		snapshot(attempt) {
+			return {
+				id: attempt.id,
+				connectionId: attempt.connectionId,
+				revision: attempt.revision,
+				...attempt.notice === void 0 ? {} : { notice: attempt.notice },
+				...attempt.prompt === void 0 ? {} : { prompt: attempt.prompt },
+				...attempt.terminal === void 0 ? {} : { terminal: attempt.terminal }
+			};
+		}
+		changed(attempt) {
+			attempt.revision += 1;
+		}
+		rememberCommand(attempt, requestId, operation) {
+			const existing = attempt.commands.get(requestId);
+			if (existing !== void 0) {
+				if (existing !== operation) throw new TypeError("requestId was already used for another operation");
+				return false;
+			}
+			if (attempt.commands.size >= MAX_RETAINED_COMMANDS) {
+				const first = attempt.commands.keys().next().value;
+				if (first !== void 0) attempt.commands.delete(first);
+			}
+			attempt.commands.set(requestId, operation);
+			return true;
+		}
+		trimAttempts() {
+			if (this.attempts.size < MAX_RETAINED_ATTEMPTS) return;
+			const removable = [...this.attempts.values()].find((attempt) => attempt.terminal !== void 0);
+			if (removable !== void 0) {
+				this.attempts.delete(removable.id);
+				for (const [requestId, record] of this.startRequests) if (record.attemptId === removable.id) this.startRequests.delete(requestId);
+			}
+		}
+		trimRequests(requests) {
+			if (requests.size < MAX_RETAINED_REQUESTS) return;
+			const first = requests.keys().next().value;
+			if (first !== void 0) requests.delete(first);
+		}
+		async connections() {
+			const rows = [];
+			for (const flow of this.ctx.authorization.list()) {
+				if (!isModelAuthorization(flow)) continue;
+				const methods = flow.methods.filter((method) => method.id !== "api-key" && method.id.length <= MAX_LABEL_LENGTH).map((method) => ({
+					id: method.id,
+					label: bounded(method.label),
+					kind: methodKind(method.id)
+				}));
+				if (methods.length === 0) continue;
+				const record = await this.ctx.credentials.describeRecord(flow.key);
+				rows.push({
+					id: connectionId(flow.key),
+					label: bounded(flow.label),
+					configured: record.configured,
+					inFlight: flow.inFlight,
+					methods
+				});
+			}
+			return { connections: rows };
+		}
+		start(request) {
+			assertRequestId(request.requestId);
+			const repeated = this.startRequests.get(request.requestId);
+			if (repeated !== void 0) {
+				const operation = `${request.connectionId}:${request.method}`;
+				if (repeated.operation !== operation) throw new TypeError("requestId was already used for another authorization start");
+				const existing = this.attempts.get(repeated.attemptId);
+				if (existing === void 0) throw new Error("idempotent authorization attempt expired");
+				return this.snapshot(existing);
+			}
+			const flow = this.flowByConnection(request.connectionId);
+			if (flow === void 0) throw new Error("authorization connection is unavailable");
+			if (this.disconnectingConnections.has(request.connectionId)) throw new Error("authorization disconnect is in flight");
+			if (!flow.methods.some((method) => method.id === request.method && method.id !== "api-key")) throw new Error("authorization method is unavailable");
+			this.trimAttempts();
+			if (this.attempts.size >= MAX_RETAINED_ATTEMPTS) throw new Error("too many retained authorization attempts");
+			const attempt = {
+				id: randomUUID(),
+				connectionId: request.connectionId,
+				key: flow.key,
+				controller: new AbortController(),
+				revision: 0,
+				unsupportedInput: false,
+				commands: /* @__PURE__ */ new Map()
+			};
+			this.attempts.set(attempt.id, attempt);
+			this.trimRequests(this.startRequests);
+			this.startRequests.set(request.requestId, {
+				attemptId: attempt.id,
+				operation: `${request.connectionId}:${request.method}`
+			});
+			const prompt = (offered) => {
+				if (offered.kind === "text" && offered.signal !== void 0 && attempt.notice?.kind === "browser") {
+					const signal = offered.signal;
+					return new Promise((_resolve, reject) => {
+						const id = randomUUID();
+						const onAbort = () => {
+							pending.dispose();
+							reject(/* @__PURE__ */ new Error("authorization prompt was withdrawn"));
+						};
+						const pending = {
+							id,
+							kind: "browser-fallback",
+							reject,
+							dispose: () => {
+								signal.removeEventListener("abort", onAbort);
+								if (attempt.pending === pending) delete attempt.pending;
+							}
+						};
+						attempt.pending = pending;
+						signal.addEventListener("abort", onAbort, { once: true });
+						if (signal.aborted) onAbort();
+						else this.changed(attempt);
+					});
+				}
+				if (offered.kind !== "select") {
+					attempt.unsupportedInput = true;
+					this.changed(attempt);
+					return Promise.reject(new AuthorizationDeclinedError());
+				}
+				return new Promise((resolve, reject) => {
+					const id = randomUUID();
+					const onAbort = () => {
+						pending.dispose();
+						reject(/* @__PURE__ */ new Error("authorization prompt was withdrawn"));
+					};
+					const pending = {
+						id,
+						kind: "choice",
+						offered,
+						resolve,
+						reject,
+						dispose: () => {
+							offered.signal?.removeEventListener("abort", onAbort);
+							if (attempt.pending === pending) delete attempt.pending;
+							if (attempt.prompt?.id === id) delete attempt.prompt;
+						}
+					};
+					attempt.pending = pending;
+					attempt.prompt = {
+						id,
+						choices: offered.options.filter((option) => option.id.length <= MAX_LABEL_LENGTH).slice(0, MAX_CHOICES).map((option) => ({
+							id: option.id,
+							label: bounded(option.label),
+							kind: methodKind(option.id)
+						}))
+					};
+					offered.signal?.addEventListener("abort", onAbort, { once: true });
+					if (offered.signal?.aborted === true) onAbort();
+					else this.changed(attempt);
+				});
+			};
+			this.ctx.authorization.begin({
+				key: flow.key,
+				method: request.method,
+				signal: attempt.controller.signal,
+				interaction: {
+					notify: (notice) => {
+						attempt.notice = noticeView(notice);
+						this.changed(attempt);
+					},
+					prompt
+				}
+			}).then((outcome) => {
+				attempt.pending?.dispose();
+				attempt.terminal = attempt.unsupportedInput ? {
+					status: "failed",
+					code: "input-required"
+				} : { status: outcome.status };
+				this.changed(attempt);
+			}, (error) => {
+				attempt.pending?.dispose();
+				attempt.terminal = failure(error, attempt.unsupportedInput);
+				this.changed(attempt);
+			});
+			return this.snapshot(attempt);
+		}
+		observe(attemptId) {
+			const attempt = this.attempts.get(attemptId);
+			if (attempt === void 0) throw new Error("authorization attempt is unavailable");
+			return this.snapshot(attempt);
+		}
+		choose(request) {
+			assertRequestId(request.requestId);
+			const attempt = this.attempts.get(request.attemptId);
+			if (attempt === void 0) throw new Error("authorization attempt is unavailable");
+			const operation = `choose:${request.promptId}:${request.choice}`;
+			if (!this.rememberCommand(attempt, request.requestId, operation)) return this.snapshot(attempt);
+			const pending = attempt.pending;
+			if (pending === void 0 || pending.kind !== "choice" || pending.id !== request.promptId) throw new Error("authorization choice is no longer active");
+			if (!pending.offered.options.some((option) => option.id === request.choice)) throw new Error("authorization choice is invalid");
+			pending.dispose();
+			pending.resolve(request.choice);
+			this.changed(attempt);
+			return this.snapshot(attempt);
+		}
+		cancel(request) {
+			assertRequestId(request.requestId);
+			const attempt = this.attempts.get(request.attemptId);
+			if (attempt === void 0) throw new Error("authorization attempt is unavailable");
+			if (this.rememberCommand(attempt, request.requestId, "cancel")) {
+				attempt.pending?.reject(new AuthorizationDeclinedError());
+				attempt.pending?.dispose();
+				attempt.controller.abort();
+				this.ctx.authorization.cancel(attempt.key);
+				this.changed(attempt);
+			}
+			return this.snapshot(attempt);
+		}
+		async disconnect(request) {
+			assertRequestId(request.requestId);
+			const repeated = this.disconnectRequests.get(request.requestId);
+			if (repeated !== void 0) {
+				if (repeated.connectionId !== request.connectionId) throw new TypeError("requestId was already used for another disconnect");
+				return repeated.result;
+			}
+			const flow = this.flowByConnection(request.connectionId);
+			if (flow === void 0) throw new Error("authorization connection is unavailable");
+			const localAttemptActive = [...this.attempts.values()].some((attempt) => attempt.connectionId === request.connectionId && attempt.terminal === void 0);
+			if (flow.inFlight || localAttemptActive || this.disconnectingConnections.has(request.connectionId)) throw new Error("authorization is in flight");
+			if (this.disconnectRequests.size >= MAX_RETAINED_REQUESTS) {
+				const settled = [...this.disconnectRequests].find(([, record]) => record.settled);
+				if (settled === void 0) throw new Error("too many authorization disconnects are in flight");
+				this.disconnectRequests.delete(settled[0]);
+			}
+			let resolveResult;
+			let rejectResult;
+			const result = new Promise((resolve, reject) => {
+				resolveResult = resolve;
+				rejectResult = reject;
+			});
+			const record = {
+				connectionId: request.connectionId,
+				result,
+				settled: false
+			};
+			this.disconnectRequests.set(request.requestId, record);
+			this.disconnectingConnections.add(request.connectionId);
+			(async () => {
+				try {
+					this.ctx.authorization.cancel(flow.key);
+					await this.ctx.credentials.deleteRecord(flow.key);
+					resolveResult({ disconnected: true });
+				} catch (error) {
+					rejectResult(error);
+				} finally {
+					record.settled = true;
+					this.disconnectingConnections.delete(request.connectionId);
+				}
+			})();
+			return result;
+		}
+	};
+})();
+//#endregion
+//#region ../lib/types/index.js
+/** Mount one authorization owner, then the model-account Host projection. */
+async function apply(ctx) {
+	if (ctx.get("authorization", false) === void 0) await ctx.plugin(TargetPreservingAuthorizationService);
+	await ctx.plugin(AccountAuthorizationService);
+}
+//#endregion
+export { AccountAuthorizationService, TargetPreservingAuthorizationService, apply, apply as default };