@ai-ecoverse/slicc-vault 1.14.0 → 1.15.0

package/README.md

@@ -396,7 +396,7 @@ The vault never injects a secret into a model or MCP endpoint, whatever a rule s
 | `model` | `provider?`, `request`: `{ method, url, headers: [name, value][], body?: string \| bytes }` | `{ request, hits, version }`, the request prepared for the agent's transport, below |
 | `mcp` | `server`, `request` (the same shape) | `{ request, hits, version }`, below |
 | `records` | — | `{ records: [{ kind, name, placeholder, state, provider?, server?, expiresAt?, settings? }] }`: the namespace's `model` and `mcp` records that aren't removed, `state` being `ready`, `expired` or `refreshing` (expired with a refresh source), and `settings` scrubbed over every value (an entry whose name holds a value is dropped; so is a record whose name, provider or server holds one, and an `expiresAt` whose digits are a value). Never a value, a `secret` or a `grant`; the records are read and scrubbed under one scrub version (retried, then `EAGAIN` while values keep changing); `EACCES` while the vault is locked before its first unlock |
-| `grant` | `server`, `response` (the token endpoint's body, a string or bytes), `oauth` (`{ tokenUrl, clientId, scope?, resource? }`), `name?` (a record name; anything else is `EINVAL`) | `{ response, records: [{ kind, name, placeholder }], expiresAt? }`, below |
+| `grant` | `provider`, `name`, `response`, `settings?` for a model-provider sign-in (below), or `server`, `response` (the token endpoint's body, a string or bytes), `oauth` (`{ tokenUrl, clientId, scope?, resource? }`), `name?` (a record name; anything else is `EINVAL`) | `{ response, records: [{ kind, name, placeholder }], expiresAt? }`, below |
 | `refresh` | `server` or `provider`, `name?` | `{ state: 'refreshed', expiresAt? }`: refreshes that server's or provider's token in the vault, as Tokens and refresh describes (an `expiresAt` is left out when its digits are a value before or after the refresh, the replaced and the new token included, or when any other value changed while it ran); `ENOENT` when it has none, `EINVAL` when it has several and no `name` picks one |
 
 **Preparing model and MCP requests (§3.12).** Every model and MCP request of the agent worker goes through `model` or `mcp`, with or without a credential; the response comes back to the worker directly.
@@ -411,9 +411,18 @@ The vault never injects a secret into a model or MCP endpoint, whatever a rule s
 
 **MCP OAuth (`grant`).** The worker registers the server with its `tokenUrl`, sends the code exchange through `mcp` (to exactly `tokenUrl`, with no credential), and hands the token endpoint's body to `grant`, holding it only in transit.
 - `oauth.tokenUrl` must be `https:` and the server's registered `tokenUrl` (`EACCES` otherwise). A server or record name that holds a stored value or one of the returned tokens, in any encoded form, is `EINVAL`. The body is checked as for a refresh (an object with a string `access_token`, no `error`, `token_type` Bearer if present, a valid `expires_in`), and every token must be a valid value (`EINVAL` otherwise), before anything is stored.
-- The access token is sealed as an `mcp` record bound to `server`, named `name` or `<SERVER>_ACCESS_TOKEN` (upper-cased, other characters as `_`, `MCP_` in front of a leading digit), with source `oauth:mcp` and `expiresAt` from `expires_in`. A `refresh_token` is sealed as a `grant` named `<name>_GRANT` with `oauth` and the same `server`, and becomes the token's refresh source.
+- The access token is sealed as an `mcp` record bound to `server`, named `name` or `<SERVER>_ACCESS_TOKEN` (upper-cased, other characters as `_`, `MCP_` in front of a leading digit), with source `oauth:mcp` and `expiresAt` from `expires_in`. A `refresh_token` is sealed as a `grant` named `<name>_GRANT` with `oauth` and the same `server`, and becomes the token's refresh source. A live `<name>_GRANT` that isn't this token's own (a sign-in's, say) is `EEXIST`, checked in the writing transaction; a re-grant without a `refresh_token` removes the token's old grant unless another live credential shares it.
 - Both records are written in one transaction, so `grant` stores all or nothing. The reply's `response` is JSON, a string or bytes like the input, with only `access_token` and `refresh_token` (as their placeholders), any string `token_type`, a numeric `expires_in` that isn't a stored value, and string `scope` scrubbed over every value; every other field, `id_token` included, is dropped. A `grant` whose access-token name is already bound to another server is `EEXIST`, checked in the same transaction.
 
+**Model-provider sign-ins (`grant { provider }`, §3.12.1).** For the subscription sign-ins `xai`, `kimi-coding` and `openai-codex`, the worker runs the device-code flow and hands the vault the final token response: `grant { provider, name, response, settings? }`, with `name` the account's record name. The worker holds that response only in memory and never logs, stores, licks or transcribes it.
+- **The token endpoint and client id come from the vault's own table** (`src/providers.ts`, taken from pi-ai's OAuth modules and checked against the installed pi-ai by a test): `https://auth.x.ai/oauth2/token`, `https://auth.kimi.com/api/oauth/token`, `https://auth.openai.com/oauth/token`. A `server` or `oauth` in the request is `EINVAL`, and any other provider is `ENOTSUP`.
+- **The response** is checked like an MCP grant's, except that a missing `token_type` is taken as `Bearer` (none of these providers' clients reads it); one that's present and not `Bearer` is still refused.
+- **The records:** the access token becomes a `model` record of `provider`, source `oauth:<provider>`, with its `expiresAt`; the refresh token, if any, a `grant` record `<name>_GRANT` that refreshes through `egress` as usual. Both are written in one transaction. The reply is `{ records: [{ kind, name, placeholder }], expiresAt? }`.
+- **Its name and settings** (its own or, without any, those it inherits from the name's record, removed or not, checked in the writing transaction, which is `EAGAIN` if a value was sealed meanwhile) may hold neither a returned token nor a stored value (`EINVAL`), and `<name>_GRANT` must be free or this record's own grant, checked in the transaction that writes them (`EEXIST`); a removed grant still counts as another credential's while that removed credential can be restored. Over an earlier OAuth key whose grant has another name, that grant is removed unless shared. `response` is a string or bytes (any `ArrayBufferView`).
+- **Under an existing name:** a record of another provider, even a removed one, is `EEXIST`. An earlier sign-in of the same provider is rotated, keeping its placeholder; if the new response has no `refresh_token`, the old grant is removed with it unless another live credential still refreshes from it. A key the user pasted (any source but `oauth:`), live or removed within the 30 days it can still be restored (one removed longer ago is gone, whatever its provider), is kept restorable: the sign-in replaces it (same placeholder), and `restore` of that name brings the pasted key back with its own source, settings, expiry and refresh link, and removes the sign-in's grant (unless shared). `list` marks such a record `replaced: true`. The stashed key stays encrypted under the vault key (re-sealed when the lock changes), is scrubbed like any value, and is what `export` writes for that name with the pasted key's own settings and expiry (a backup carries the pasted key, not the sign-in).
+- **Remove** of the `model` record removes its grant too; `restore` restores both (for a record without a pasted key underneath).
+- **Refresh failures:** the provider refusing the refresh is `EACCES "refresh failed: <code>"`; after `invalid_grant`, the grant is dead (not asked again), `records` shows the key `expired` and it isn't filled any more (`EACCES` "NAME expired; sign in again"), whatever its `expiresAt`, until a new sign-in. A network failure (`ENOTCONN`, `ETIMEDOUT`) keeps it `refreshing`.
+
 **Bytes** are any `ArrayBufferView` (`Uint8Array`, `Int8Array`, `DataView`, a `Float32Array`, a Node `Buffer`), read as exactly its own bytes from `byteOffset` for `byteLength`, never the rest of its buffer. Anything else, a bare `ArrayBuffer` included, is `EINVAL` ("chunk must be bytes", or "texts must be a list of strings and bytes").
 
 A stream is compiled against the namespace's values when it opens. If a value is added, rotated or removed while it's open, its next `push`, `idle` or `end` answers `EAGAIN` and the stream is gone: open it again and push the output from its start.

package/dist/types/contract.d.ts

@@ -90,6 +90,7 @@ export interface SecretView {
     server?: string;
     url?: string;
     pinned?: true;
+    replaced?: true;
     settings?: Record<string, string>;
     domains: string[];
     rules: Rule[];
@@ -604,6 +605,12 @@ export type AgentOp = {
     response: string | Uint8Array;
     oauth: OAuthConfig;
     name?: string;
+} | {
+    op: 'grant';
+    provider: 'xai' | 'kimi-coding' | 'openai-codex';
+    name: string;
+    response: string | Uint8Array;
+    settings?: Record<string, string>;
 } | {
     op: 'refresh';
     server: string;
@@ -652,6 +659,14 @@ export type AgentReply = {
         placeholder: string;
     }[];
     expiresAt?: EpochMs;
+} | {
+    op: 'grant';
+    records: {
+        kind: RecordKind;
+        name: string;
+        placeholder: string;
+    }[];
+    expiresAt?: EpochMs;
 } | {
     op: 'refresh';
     state: 'refreshed' | 'requested';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-vault",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "The separate-origin vault at vault.sliccy.ai: sealed secrets, OAuth tokens, and model and MCP credentials for SLICC seven, used only by its injector",
   "piAi": "1.3.0",
   "type": "module",
@@ -48,10 +48,10 @@
   },
   "devDependencies": {
     "@ai-ecoverse/jerk-oauth": "1.0.0",
-    "@ai-ecoverse/slicc-kernel": "1.130.0",
+    "@ai-ecoverse/slicc-kernel": "1.132.1",
     "@ai-ecoverse/slicc-scrub": "1.0.0",
-    "@ai-ecoverse/slicc-shared-web": "1.24.2",
-    "@ai-ecoverse/wasm-bash": "5.3.0-20",
+    "@ai-ecoverse/slicc-shared-web": "1.25.1",
+    "@ai-ecoverse/wasm-bash": "5.3.0-21",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-10",
     "@biomejs/biome": "2.5.15",
     "@earendil-works/pi-ai": "1.3.0",