@ai-projector/ide 0.0.0-stage → 0.11.1

package/packages/server/modules/providers/models.js

@@ -0,0 +1,124 @@
+import { HttpError } from "../http/index.js";
+import { normalizeOpenAiBaseUrl } from "./openai-client.js";
+const MAX_MODELS = 500;
+const LIST_TIMEOUT_MS = 10_000;
+const MIN_CONTEXT = 1_000;
+const MAX_CONTEXT = 100_000_000;
+function clean(value) {
+    return typeof value === "string" ? value.replace(/\s+/g, " ").trim().slice(0, 200) : "";
+}
+/** A context window in tokens; anything that is not a sane whole number counts as unknown. */
+function contextTokens(value) {
+    const number = typeof value === "string" ? Number(value) : value;
+    if (typeof number !== "number" || !Number.isInteger(number))
+        return undefined;
+    return number >= MIN_CONTEXT && number <= MAX_CONTEXT ? number : undefined;
+}
+/** The price of a million tokens; input and output are needed, a wrong figure drops the whole price. */
+export function sanitizePrice(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const record = value;
+    const figure = (item) => {
+        const number = typeof item === "string" && item.trim() ? Number(item) : item;
+        return typeof number === "number" && Number.isFinite(number) && number >= 0 && number < 1e6
+            ? number
+            : undefined;
+    };
+    const input = figure(record.input);
+    const output = figure(record.output);
+    if (input === undefined || output === undefined)
+        return undefined;
+    const cacheRead = figure(record.cacheRead);
+    const cacheWrite = figure(record.cacheWrite);
+    return {
+        input,
+        output,
+        ...(cacheRead !== undefined ? { cacheRead } : {}),
+        ...(cacheWrite !== undefined ? { cacheWrite } : {}),
+    };
+}
+/** Registered models of one provider; the alias defaults to the id and stays unique. */
+export function sanitizeModels(value, legacyModel) {
+    const source = Array.isArray(value) ? value : legacyModel ? [{ id: legacyModel }] : [];
+    const seen = new Set();
+    const models = [];
+    for (const item of source) {
+        const record = item && typeof item === "object" ? item : {};
+        const id = clean(typeof item === "string" ? item : record.id);
+        if (!id)
+            continue;
+        const alias = clean(record.alias) || id;
+        if (seen.has(alias))
+            continue;
+        seen.add(alias);
+        const context = contextTokens(record.contextTokens);
+        const price = sanitizePrice(record.price);
+        models.push({
+            id,
+            alias,
+            ...(context ? { contextTokens: context } : {}),
+            ...(price ? { price } : {}),
+            ...(record.thinking === false ? { thinking: false } : {}),
+        });
+        if (models.length >= MAX_MODELS)
+            break;
+    }
+    return models;
+}
+/** The model a request names by its registered name; without a match the provider's first one. */
+export function pickModel(models, name) {
+    const wanted = name?.trim();
+    return models.find((item) => item.alias === wanted) ?? models[0] ?? null;
+}
+/** What a request needs of the model it names: the upstream id, the registered name and the window. */
+export function resolveModel(models, name, fallback) {
+    const chosen = pickModel(models, name);
+    return {
+        model: chosen?.id ?? fallback,
+        modelName: chosen?.alias ?? fallback,
+        contextTokens: chosen?.contextTokens,
+        thinking: chosen?.thinking,
+        price: chosen?.price,
+    };
+}
+/** Model ids from `GET <base>/models` of an OpenAI-compatible server (also Ollama's `models`). */
+export async function fetchRemoteModels(url, apiKey) {
+    if (!url.trim())
+        throw new HttpError(400, "Укажите адрес провайдера");
+    let response;
+    try {
+        response = await fetch(`${normalizeOpenAiBaseUrl(url)}/models`, {
+            headers: {
+                Accept: "application/json",
+                ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+            },
+            signal: AbortSignal.timeout(LIST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        throw new HttpError(502, `Провайдер не отвечает: ${error.message}`);
+    }
+    if (!response.ok)
+        throw new HttpError(502, `Провайдер не отдал список моделей (HTTP ${response.status})`);
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new HttpError(502, "Провайдер вернул не JSON: список моделей не поддерживается");
+    }
+    const record = (body && typeof body === "object" ? body : {});
+    const rows = Array.isArray(body)
+        ? body
+        : Array.isArray(record.data)
+            ? record.data
+            : record.models;
+    if (!Array.isArray(rows))
+        throw new HttpError(502, "Провайдер не отдаёт список моделей");
+    const ids = rows.map((row) => {
+        const item = (row && typeof row === "object" ? row : {});
+        return clean(typeof row === "string" ? row : (item.id ?? item.name));
+    });
+    return [...new Set(ids.filter(Boolean))].sort((a, b) => a.localeCompare(b));
+}

package/packages/server/modules/providers/openai-client.js

@@ -0,0 +1,40 @@
+import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
+export function normalizeOpenAiBaseUrl(rawUrl) {
+    const withProtocol = /^https?:\/\//i.test(rawUrl) ? rawUrl : `http://${rawUrl}`;
+    const url = new URL(withProtocol);
+    const pathname = url.pathname.replace(/\/+$/, "");
+    if (!/\/v\d+[a-z0-9]*(\/|$)/i.test(pathname)) {
+        url.pathname = `${pathname}/v1`;
+    }
+    return url.toString().replace(/\/+$/, "");
+}
+/** Token accounting of OpenAI-compatible servers, including the cache fields providers add. */
+export function convertUsage(usage) {
+    const prompt = usage?.prompt_tokens ?? 0;
+    const completion = usage?.completion_tokens ?? 0;
+    const cacheRead = usage?.prompt_tokens_details?.cached_tokens ?? usage?.prompt_cache_hit_tokens ?? 0;
+    const cacheWrite = usage?.prompt_tokens_details?.cache_write_tokens ?? 0;
+    const reasoning = usage?.completion_tokens_details?.reasoning_tokens ?? 0;
+    return {
+        inputTokens: {
+            total: prompt,
+            noCache: Math.max(0, prompt - cacheRead - cacheWrite),
+            cacheRead,
+            cacheWrite,
+        },
+        outputTokens: {
+            total: completion,
+            text: Math.max(0, completion - reasoning),
+            reasoning,
+        },
+        raw: (usage ?? undefined),
+    };
+}
+export function createQwenOpenAI(options) {
+    return createOpenAICompatible({
+        convertUsage,
+        name: "qwen-openai",
+        baseURL: normalizeOpenAiBaseUrl(options.openaiUrl),
+        apiKey: options.openaiApiKey?.trim() || "not-needed",
+    });
+}

package/packages/server/modules/providers/provider-seeds.js

@@ -0,0 +1,39 @@
+import { inferProviderKind } from "./kinds.js";
+import { sanitizeModels } from "./models.js";
+import { defaultThinkingStyle } from "./thinking.js";
+export const ENV_PROVIDER_ID = "env-default";
+const QWEN_PROVIDER_ID = "qwen-dashscope";
+export const DEFAULT_MODEL = "qwen3.8-flash";
+/** The key of the environment provider is read from the process environment, never stored. */
+export function envProvider(fallback) {
+    const url = fallback.url?.trim();
+    if (!url)
+        return null;
+    return {
+        id: ENV_PROVIDER_ID,
+        name: "Из .env",
+        kind: inferProviderKind(url),
+        thinkingStyle: defaultThinkingStyle(inferProviderKind(url)),
+        url,
+        enabled: true,
+        models: sanitizeModels(null, fallback.model?.trim() || DEFAULT_MODEL),
+        apiKey: "",
+    };
+}
+function qwenSeed() {
+    return {
+        id: QWEN_PROVIDER_ID,
+        name: "Qwen / DashScope",
+        kind: "qwencloud",
+        thinkingStyle: "qwen",
+        url: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
+        enabled: true,
+        models: sanitizeModels(null, DEFAULT_MODEL),
+        apiKey: "",
+    };
+}
+export function seededConfig(fallback) {
+    const fromEnv = envProvider(fallback);
+    const providers = fromEnv ? [fromEnv, qwenSeed()] : [qwenSeed()];
+    return { activeProviderId: providers[0].id, providers };
+}

package/packages/server/modules/providers/provider-store.js

@@ -0,0 +1,317 @@
+import { readFile } from "node:fs/promises";
+import { providersPath } from "../../../core/modules/app-paths/index.js";
+import { setAsideBroken, writeFileAtomic } from "./atomic-file.js";
+import { HttpError } from "../http/index.js";
+import { vault as systemVault } from "../secrets/index.js";
+import { inferProviderKind, isProviderKind } from "./kinds.js";
+import { resolveModel, sanitizeModels } from "./models.js";
+import { defaultThinkingStyle, isThinkingStyle } from "./thinking.js";
+import { DEFAULT_MODEL, ENV_PROVIDER_ID, envProvider, seededConfig } from "./provider-seeds.js";
+import { DEFAULT_PROVIDERS_SECRET, revealSecret } from "./secret-obfuscation.js";
+let writeChain = Promise.resolve();
+let providerVault = systemVault;
+/** Test hook: replaces the secret vault. */
+export const useProviderVault = (next) => {
+    providerVault = next;
+};
+const keyAccount = (id) => `provider:${id}`;
+function withWriteLock(fn) {
+    const next = writeChain.then(fn, fn);
+    writeChain = next.then(() => undefined, () => undefined);
+    return next;
+}
+export function sanitizeProviderId(value) {
+    const cleaned = value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 80);
+    if (!cleaned)
+        throw new HttpError(400, "Некорректный id провайдера");
+    return cleaned;
+}
+function sanitizeName(value, fallback) {
+    if (typeof value !== "string")
+        return fallback;
+    return value.replace(/\s+/g, " ").trim().slice(0, 80) || fallback;
+}
+const sanitizeUrl = (value) => typeof value === "string" ? value.trim().slice(0, 500) : "";
+function toPublic(provider, envKey = "") {
+    const fromEnv = provider.id === ENV_PROVIDER_ID && envKey.trim() !== "";
+    return {
+        id: provider.id,
+        name: provider.name,
+        kind: provider.kind,
+        thinkingStyle: provider.thinkingStyle,
+        ...(provider.fallbackModel ? { fallbackModel: provider.fallbackModel } : {}),
+        url: provider.url,
+        enabled: provider.enabled,
+        models: provider.models,
+        hasApiKey: provider.vault === "keyring" || Boolean(provider.apiKey.trim()) || fromEnv,
+    };
+}
+const fallbackOf = (value) => typeof value === "string" && value.trim() ? { fallbackModel: value.trim().slice(0, 200) } : {};
+/** The fallback model of a provider, when it is still one of the registered models. */
+function fallbackModelOf(provider) {
+    const chosen = provider.models.find((item) => item.alias === provider.fallbackModel);
+    return chosen
+        ? { model: chosen.id, modelName: chosen.alias, thinking: chosen.thinking, price: chosen.price }
+        : undefined;
+}
+function normalizeStoredProvider(value, index) {
+    if (!value || typeof value !== "object")
+        return null;
+    const record = value;
+    try {
+        const id = typeof record.id === "string" && record.id.trim()
+            ? sanitizeProviderId(record.id)
+            : `provider-${index + 1}`;
+        const url = sanitizeUrl(record.url);
+        const kind = isProviderKind(record.kind) ? record.kind : inferProviderKind(url);
+        return {
+            id,
+            name: sanitizeName(record.name, `Провайдер ${index + 1}`),
+            kind,
+            thinkingStyle: isThinkingStyle(record.thinkingStyle)
+                ? record.thinkingStyle
+                : defaultThinkingStyle(kind),
+            ...fallbackOf(record.fallbackModel),
+            url,
+            enabled: record.enabled !== false,
+            models: sanitizeModels(record.models, record.model),
+            apiKey: typeof record.apiKey === "string" ? record.apiKey : "",
+            ...(record.vault === "keyring" ? { vault: "keyring" } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function loadStoredProviders(fallback = {}) {
+    const file = providersPath();
+    try {
+        let parsed;
+        try {
+            const value = JSON.parse(await readFile(file, "utf8"));
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                throw new SyntaxError("providers.json не объект");
+            parsed = value;
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError))
+                throw error;
+            const backup = await setAsideBroken(file);
+            console.error(`providers.json повреждён и сохранён как ${backup}:`, error.message);
+            return seededConfig(fallback);
+        }
+        const providers = Array.isArray(parsed.providers)
+            ? parsed.providers
+                .map((item, index) => normalizeStoredProvider(item, index))
+                .filter((item) => item !== null)
+            : [];
+        if (providers.length === 0)
+            return seededConfig(fallback);
+        const activeProviderId = typeof parsed.activeProviderId === "string" &&
+            providers.some((item) => item.id === parsed.activeProviderId)
+            ? parsed.activeProviderId
+            : (providers[0]?.id ?? null);
+        return { activeProviderId, providers };
+    }
+    catch (error) {
+        // A missing file is the first run; any other failure must not look like one.
+        if (error.code === "ENOENT")
+            return seededConfig(fallback);
+        throw error;
+    }
+}
+export async function loadPublicProviders(fallback = {}) {
+    // Keys left in the file by older versions move into the keyring on first view.
+    await migrateProviderKeys(fallback).catch((error) => console.error("Перенос ключей провайдеров в системное хранилище:", error.message));
+    const stored = await loadStoredProviders(fallback);
+    return {
+        activeProviderId: stored.activeProviderId,
+        providers: stored.providers.map((item) => toPublic(item, fallback.apiKey)),
+    };
+}
+async function writeProvidersFile(config) {
+    await writeFileAtomic(providersPath(), `${JSON.stringify(config, null, 2)}\n`);
+}
+/**
+ * Keys live only in the OS keyring; the providers file holds settings and never a new key. Without
+ * a reachable keyring a key cannot be saved, so the caller refuses before the user types one.
+ */
+export async function assertKeyStore() {
+    if ((await providerVault.storage()).backend !== "keyring")
+        throw new HttpError(409, "Ключи провайдеров хранятся в системном хранилище секретов, оно недоступно");
+}
+async function storeKey(id, plain) {
+    await assertKeyStore();
+    await providerVault.set(keyAccount(id), `Projector: провайдер ${id}`, plain);
+    return { apiKey: "", vault: "keyring" };
+}
+async function mergeProviderWrite(item, index, existingById) {
+    const id = typeof item.id === "string" && item.id.trim()
+        ? sanitizeProviderId(item.id)
+        : `provider-${index + 1}`;
+    const previous = existingById.get(id);
+    const url = sanitizeUrl(item.url);
+    const kind = isProviderKind(item.kind) ? item.kind : (previous?.kind ?? inferProviderKind(url));
+    const base = {
+        id,
+        name: sanitizeName(item.name, `Провайдер ${index + 1}`),
+        kind,
+        thinkingStyle: isThinkingStyle(item.thinkingStyle)
+            ? item.thinkingStyle
+            : (previous?.thinkingStyle ?? defaultThinkingStyle(kind)),
+        ...fallbackOf(item.fallbackModel ?? previous?.fallbackModel),
+        url,
+        enabled: item.enabled === undefined ? (previous?.enabled ?? true) : item.enabled !== false,
+        models: item.models === undefined && !item.model
+            ? (previous?.models ?? [])
+            : sanitizeModels(item.models, item.model),
+    };
+    if (typeof item.apiKey === "string") {
+        const plain = item.apiKey.trim();
+        return { ...base, ...(plain ? await storeKey(id, plain) : { apiKey: "" }) };
+    }
+    // No key in the payload: keep the one already stored, wherever it lives.
+    return {
+        ...base,
+        apiKey: previous?.apiKey ?? "",
+        ...(previous?.vault ? { vault: previous.vault } : {}),
+    };
+}
+/** Removes keyring entries of providers that were deleted or whose key was cleared. */
+async function dropRetiredKeys(before, after) {
+    for (const old of before) {
+        if (old.vault !== "keyring")
+            continue;
+        if (after.some((item) => item.id === old.id && item.vault === "keyring"))
+            continue;
+        await providerVault.delete(keyAccount(old.id));
+    }
+}
+export async function saveProviders(payload, fallback = {}) {
+    return withWriteLock(async () => {
+        const existing = await loadStoredProviders(fallback);
+        const existingById = new Map(existing.providers.map((item) => [item.id, item]));
+        const providers = await Promise.all(payload.providers.map((item, index) => mergeProviderWrite(item, index, existingById)));
+        // Keyring entries go before the file, so a failed keyring write keeps the previous state.
+        await dropRetiredKeys(existing.providers, providers);
+        if (providers.length === 0) {
+            const next = { activeProviderId: null, providers: [] };
+            await writeProvidersFile(next);
+            return { activeProviderId: null, providers: [] };
+        }
+        const requestedActive = typeof payload.activeProviderId === "string"
+            ? payload.activeProviderId
+            : existing.activeProviderId;
+        const activeProviderId = providers.some((item) => item.id === requestedActive)
+            ? requestedActive
+            : providers[0].id;
+        const next = { activeProviderId, providers };
+        await writeProvidersFile(next);
+        return {
+            activeProviderId,
+            providers: providers.map((item) => toPublic(item, fallback.apiKey)),
+        };
+    });
+}
+export async function setActiveProvider(providerId, fallback = {}) {
+    return withWriteLock(async () => {
+        const stored = await loadStoredProviders(fallback);
+        const id = sanitizeProviderId(providerId);
+        if (!stored.providers.some((item) => item.id === id)) {
+            throw new HttpError(404, "Провайдер не найден");
+        }
+        const next = { ...stored, activeProviderId: id };
+        await writeProvidersFile(next);
+        return {
+            activeProviderId: id,
+            providers: stored.providers.map((item) => toPublic(item, fallback.apiKey)),
+        };
+    });
+}
+function revealFileKey(storedKey, secret) {
+    if (!storedKey.trim())
+        return "";
+    try {
+        return revealSecret(storedKey, secret);
+    }
+    catch {
+        return "";
+    }
+}
+async function revealProviderKey(provider, secret, envKey) {
+    if (provider.id === ENV_PROVIDER_ID && !provider.apiKey.trim())
+        return envKey.trim();
+    if (provider.vault !== "keyring")
+        return revealFileKey(provider.apiKey, secret);
+    try {
+        return (await providerVault.get(keyAccount(provider.id))) ?? "";
+    }
+    catch (error) {
+        console.error(`Провайдер ${provider.id}: ключ недоступен: ${error.message}`);
+        return "";
+    }
+}
+async function toResolved(provider, secret, envKey, modelName) {
+    return {
+        id: provider.id,
+        name: provider.name,
+        kind: provider.kind,
+        thinkingStyle: provider.thinkingStyle,
+        url: provider.url.trim(),
+        ...resolveModel(provider.models, modelName, DEFAULT_MODEL),
+        fallback: fallbackModelOf(provider),
+        apiKey: await revealProviderKey(provider, secret, envKey),
+    };
+}
+/**
+ * Moves keys still kept in the providers file into the keyring once it is reachable. The file is
+ * rewritten only after each keyring value reads back identically.
+ */
+export function migrateProviderKeys(fallback = {}) {
+    return withWriteLock(async () => {
+        if ((await providerVault.storage()).backend !== "keyring")
+            return;
+        const stored = await loadStoredProviders(fallback);
+        const secret = fallback.secret || DEFAULT_PROVIDERS_SECRET;
+        let moved = false;
+        const providers = [];
+        for (const item of stored.providers) {
+            const plain = item.vault || !item.apiKey.trim() ? "" : revealFileKey(item.apiKey, secret);
+            if (!plain) {
+                providers.push(item);
+                continue;
+            }
+            await providerVault.set(keyAccount(item.id), `Projector: провайдер ${item.id}`, plain);
+            if ((await providerVault.get(keyAccount(item.id))) !== plain)
+                throw new Error(`Не удалось проверить ключ провайдера ${item.id}`);
+            providers.push({ ...item, apiKey: "", vault: "keyring" });
+            moved = true;
+        }
+        if (moved)
+            await writeProvidersFile({ activeProviderId: stored.activeProviderId, providers });
+    });
+}
+export async function resolveOpenAIProvider(options = {}) {
+    const fallback = options.fallback ?? envFallbackFromProcess();
+    const secret = fallback.secret || DEFAULT_PROVIDERS_SECRET;
+    const stored = await loadStoredProviders(fallback);
+    const requested = options.providerId?.trim();
+    const selected = stored.providers.find((item) => item.id === requested) ||
+        stored.providers.find((item) => item.id === stored.activeProviderId) ||
+        stored.providers[0];
+    const envKey = fallback.apiKey ?? "";
+    if (selected?.url.trim())
+        return toResolved(selected, secret, envKey, options.model);
+    const fromEnv = envProvider(fallback);
+    if (fromEnv?.url.trim())
+        return toResolved(fromEnv, secret, envKey, options.model);
+    throw new HttpError(400, "Провайдер Qwen/OpenAI не настроен");
+}
+export function envFallbackFromProcess() {
+    return {
+        url: process.env.OPENAI_URL || process.env.QWEN_URL,
+        apiKey: process.env.OPENAI_API_KEY || process.env.DASHSCOPE_API_KEY || process.env.QWENCLOUD_API_KEY,
+        model: process.env.OPENAI_MODEL || process.env.QWEN_MODEL,
+        secret: process.env.PROVIDERS_SECRET,
+    };
+}

package/packages/server/modules/providers/quiet-model.js

@@ -0,0 +1,36 @@
+import { defaultSettingsMiddleware, wrapLanguageModel } from "ai";
+import { createQwenOpenAI } from "./openai-client.js";
+import { envFallbackFromProcess, resolveOpenAIProvider } from "./provider-store.js";
+import { quietThinkingBody } from "./thinking.js";
+/**
+ * The chat's provider and model with thinking turned down: one cheap request, no tools and no
+ * history. Used by the small Projector requests that sit beside the chat (Form Doctor, Lens).
+ */
+export async function quietChatModel(selection) {
+    const [providerId, ...rest] = (selection?.provider || "").split(":");
+    const resolved = await resolveOpenAIProvider({
+        providerId,
+        model: rest.join(":"),
+        fallback: envFallbackFromProcess(),
+    });
+    const provider = createQwenOpenAI({
+        openaiUrl: resolved.url,
+        openaiApiKey: resolved.apiKey,
+    });
+    const style = resolved.thinking === false ? "none" : resolved.thinkingStyle;
+    const quiet = quietThinkingBody(style);
+    const model = quiet
+        ? wrapLanguageModel({
+            model: provider.chatModel(resolved.model),
+            middleware: defaultSettingsMiddleware({
+                settings: { providerOptions: { qwenOpenai: quiet } },
+            }),
+        })
+        : provider.chatModel(resolved.model);
+    return {
+        model,
+        provider: resolved.id,
+        name: resolved.modelName,
+        ...(resolved.price ? { price: resolved.price } : {}),
+    };
+}

package/packages/server/modules/providers/secret-obfuscation.js

@@ -0,0 +1,48 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+const PREFIX = "enc:v1:";
+const ALGORITHM = "aes-256-gcm";
+export const DEFAULT_PROVIDERS_SECRET = "projector/openai-provider-keys/v1";
+export const LEGACY_PROVIDER_SECRETS = ["ai-companion/openai-provider-keys/v1"];
+function deriveKey(secret) {
+    return createHash("sha256").update(secret).digest();
+}
+export function obfuscateSecret(plain, secret = DEFAULT_PROVIDERS_SECRET) {
+    const trimmed = plain.trim();
+    if (!trimmed)
+        return "";
+    const iv = randomBytes(12);
+    const cipher = createCipheriv(ALGORITHM, deriveKey(secret), iv);
+    const encrypted = Buffer.concat([cipher.update(trimmed, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${PREFIX}${iv.toString("base64url")}.${tag.toString("base64url")}.${encrypted.toString("base64url")}`;
+}
+function revealWithSecret(value, secret) {
+    const payload = value.slice(PREFIX.length);
+    const [ivPart, tagPart, dataPart] = payload.split(".");
+    if (!ivPart || !tagPart || !dataPart)
+        throw new Error("Invalid obfuscated secret");
+    const decipher = createDecipheriv(ALGORITHM, deriveKey(secret), Buffer.from(ivPart, "base64url"));
+    decipher.setAuthTag(Buffer.from(tagPart, "base64url"));
+    return Buffer.concat([
+        decipher.update(Buffer.from(dataPart, "base64url")),
+        decipher.final(),
+    ]).toString("utf8");
+}
+export function revealSecret(value, secret = DEFAULT_PROVIDERS_SECRET) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return "";
+    if (!trimmed.startsWith(PREFIX))
+        return trimmed;
+    const secrets = [secret, ...LEGACY_PROVIDER_SECRETS.filter((item) => item !== secret)];
+    let lastError;
+    for (const candidate of secrets) {
+        try {
+            return revealWithSecret(trimmed, candidate);
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Invalid obfuscated secret");
+}