@alilis/k-hat 0.1.0

package/dist/config.js

@@ -0,0 +1,84 @@
+import { readFile, writeFile, rename } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+export const defaultTimeouts = { headerMs: 60_000, streamIdleMs: 300_000 };
+export const defaultConfig = {
+    version: 1,
+    bind: '127.0.0.1',
+    port: 8787,
+    requestBodyLimitMB: 64,
+    providers: [],
+    routes: []
+};
+export async function readJsonFile(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+export async function loadConfig(path) {
+    const raw = await readJsonFile(path);
+    return raw === undefined ? structuredClone(defaultConfig) : validateConfig(raw);
+}
+export async function saveJsonAtomic(path, value) {
+    const temp = `${path}.tmp-${process.pid}-${randomBytes(8).toString('hex')}`;
+    await writeFile(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    await rename(temp, path);
+}
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
+}
+export function validateConfig(config) {
+    if (!config || config.version !== 1 || !Array.isArray(config.providers) || !Array.isArray(config.routes)) {
+        throw new Error('Invalid configuration: expected version 1 with providers and routes');
+    }
+    if (config.timeouts !== undefined) {
+        for (const field of ['headerMs', 'streamIdleMs']) {
+            const value = config.timeouts[field];
+            if (!Number.isInteger(value) || value < 1)
+                throw new Error(`Invalid timeouts.${field}: expected a positive integer`);
+        }
+    }
+    for (const provider of config.providers) {
+        if (!provider.id || !provider.baseUrl || (provider.protocol !== 'openai' && provider.protocol !== 'anthropic') || !Array.isArray(provider.keys))
+            throw new Error(`Invalid provider: ${provider.id}`);
+        let url;
+        try {
+            url = new URL(provider.baseUrl);
+        }
+        catch {
+            throw new Error(`Provider ${provider.id}: baseUrl is not a valid URL`);
+        }
+        if (url.protocol !== 'https:' && !isLoopbackHost(url.hostname))
+            throw new Error(`Provider ${provider.id}: baseUrl must use https (plain http is only allowed on loopback hosts)`);
+        if (url.pathname !== '/')
+            throw new Error(`Provider ${provider.id}: baseUrl must not contain a path (strip trailing /v1 etc.)`);
+        for (const key of provider.keys) {
+            if (!key.id || !Number.isInteger(key.weight) || key.weight < 1)
+                throw new Error(`Invalid key in provider ${provider.id}`);
+            if (key.vaultRef !== `${provider.id}/${key.id}`)
+                throw new Error(`Invalid key ${provider.id}/${key.id}: vaultRef must match provider and key id`);
+        }
+    }
+    for (const route of config.routes) {
+        if (!route.model || !route.provider)
+            throw new Error('Invalid route: model and provider are required');
+        if (!config.providers.some((item) => item.id === route.provider))
+            throw new Error(`Invalid route ${route.model}: unknown provider ${route.provider}`);
+    }
+    return config;
+}
+export async function loadState(path) {
+    try {
+        const state = JSON.parse(await readFile(path, 'utf8'));
+        return { keys: state.keys ?? {}, counters: state.counters ?? {} };
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return { keys: {}, counters: {} };
+        throw error;
+    }
+}

package/dist/doctor.js

@@ -0,0 +1,123 @@
+import { readFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const TOOL_PATHS = {
+    Codex: [join(homedir(), '.codex', 'config.toml'), join(homedir(), '.codex', 'config.json')],
+    OpenCode: [join(homedir(), '.config', 'opencode', 'opencode.jsonc'), join(homedir(), '.config', 'opencode', 'config.json'), join(homedir(), '.opencode', 'config.json')],
+    ZCode: [join(homedir(), '.zcode', 'v2', 'config.json'), join(homedir(), '.zcode', 'config.yaml'), join(homedir(), '.zcode', 'config.yml')],
+    Cursor: [join(process.env.APPDATA ?? join(homedir(), 'AppData', 'Roaming'), 'Cursor', 'User', 'settings.json'), join(homedir(), '.cursor', 'config.json')]
+};
+function stripJsonComments(text) { return text.replace(/\/\*[\s\S]*?\*\//g, '').replace(/(^|\s)\/\/.*$/gm, '$1'); }
+function scalar(value) {
+    const v = value.trim().replace(/^['"]|['"]$/g, '');
+    if (v === 'true')
+        return true;
+    if (v === 'false')
+        return false;
+    if (v === 'null')
+        return null;
+    const n = Number(v);
+    return v !== '' && Number.isFinite(n) ? n : v;
+}
+/** Deliberately small, dependency-free TOML reader for the common provider tables. */
+export function parseToml(text) {
+    const result = {};
+    let section = result;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/\s+#.*$/, '').trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const header = line.match(/^\[([^\]]+)\]$/);
+        if (header) {
+            section = result;
+            for (const part of header[1].split('.'))
+                section = (section[part] ??= {});
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (eq < 1)
+            continue;
+        section[line.slice(0, eq).trim()] = scalar(line.slice(eq + 1));
+    }
+    return result;
+}
+/** Reads flat/nested YAML values sufficiently to inspect endpoint settings without a YAML dependency. */
+export function parseYaml(text) {
+    const root = {};
+    const stack = [{ indent: -1, value: root }];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.replace(/\s+#.*$/, '');
+        if (!line.trim() || line.trim().startsWith('#'))
+            continue;
+        const m = line.match(/^(\s*)([^:]+):\s*(.*)$/);
+        if (!m)
+            continue;
+        const indent = m[1].length;
+        while (stack.length > 1 && indent <= stack.at(-1).indent)
+            stack.pop();
+        const parent = stack.at(-1).value;
+        const key = m[2].trim().replace(/^['"]|['"]$/g, '');
+        if (m[3].trim())
+            parent[key] = scalar(m[3]);
+        else {
+            const child = {};
+            parent[key] = child;
+            stack.push({ indent, value: child });
+        }
+    }
+    return root;
+}
+export function parseDoctorConfig(text, format) {
+    try {
+        if (format === 'toml')
+            return parseToml(text);
+        if (format === 'yaml')
+            return parseYaml(text);
+        return JSON.parse(stripJsonComments(text));
+    }
+    catch {
+        return {};
+    }
+}
+function findValues(value, keys, out, path = '') {
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        const next = path ? `${path}.${key}` : key;
+        if (keys.has(key.toLowerCase()) && typeof child === 'string')
+            out.push({ path: next, value: child });
+        findValues(child, keys, out, next);
+    }
+}
+function formatFor(path) { const lower = path.toLowerCase(); return lower.endsWith('.toml') ? 'toml' : lower.endsWith('.yaml') || lower.endsWith('.yml') ? 'yaml' : 'json'; }
+export function inspectDoctorConfig(tool, path, text, proxyBase = 'http://127.0.0.1:8787/v1') {
+    const format = formatFor(path);
+    const data = parseDoctorConfig(text, format);
+    const found = [];
+    findValues(data, new Set(['base_url', 'baseurl', 'endpoint', 'apiurl', 'api_url']), found);
+    const changes = found.filter(({ value }) => !value.includes('127.0.0.1:8787')).map(({ path: key, value }) => ({ path: key, current: value, suggested: proxyBase }));
+    if (!changes.length) {
+        const examplePath = tool === 'Codex' ? 'model_providers.<name>.base_url' : 'provider.<name>.options.baseURL';
+        changes.push({ path: examplePath, suggested: `${proxyBase}（新增该项）` });
+    }
+    const warnings = tool === 'Cursor' ? ['Cursor 仅部分功能支持自定义 OpenAI 端点；Tab 等功能可能仍走官方服务。'] : ['建议将入口令牌写入工具支持的凭据存储，不要把明文 token 提交到配置文件。'];
+    return { tool, path, format, detected: true, summary: changes.some((x) => x.current !== undefined) ? '检测到可迁移的端点配置' : '检测到配置文件，可按建议接入 khat', changes, warnings };
+}
+export async function runDoctor(options = {}) {
+    const read = options.readFile ?? ((path) => readFile(path, 'utf8'));
+    const output = [];
+    for (const tool of Object.keys(options.paths ?? TOOL_PATHS))
+        for (const path of options.paths?.[tool] ?? TOOL_PATHS[tool]) {
+            try {
+                output.push(inspectDoctorConfig(tool, path, await read(path), options.proxyBase));
+                break;
+            }
+            catch (error) {
+                if (error?.code !== 'ENOENT')
+                    output.push({ tool, path, format: formatFor(path), detected: true, summary: '无法读取配置文件', changes: [], warnings: [error?.message ?? '读取失败'] });
+            }
+        }
+    return output;
+}
+export function formatDoctorSuggestion(item) { return [`  ${item.tool}: detected (${item.path})`, ...item.changes.map((x) => `    ${x.path}: ${x.current ? `${x.current} -> ` : ''}${x.suggested}`), ...item.warnings.map((x) => `    warning: ${x}`)]; }
+export { TOOL_PATHS };

package/dist/dpapi.js

@@ -0,0 +1,34 @@
+import { spawn } from 'node:child_process';
+// Extra entropy bound into the DPAPI blob so a bare ProtectedData::Unprotect call
+// by other local code cannot reuse vault master key material.
+const ENTROPY = 'khat-vault-v1';
+function powershell(script, input) {
+    return new Promise((resolve, reject) => {
+        const child = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], { windowsHide: true });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (chunk) => (stdout += chunk));
+        child.stderr.on('data', (chunk) => (stderr += chunk));
+        child.on('error', reject);
+        child.on('close', (code) => (code === 0 ? resolve(stdout.trim()) : reject(new Error(`powershell exited with code ${code}: ${stderr.trim()}`))));
+        // Secrets travel via stdin only; they never appear on the command line.
+        child.stdin.end(input);
+    });
+}
+async function dpapi(data, direction) {
+    if (process.platform !== 'win32') {
+        throw new Error('Windows DPAPI protector cannot run on this platform; use the platform key-protector factory');
+    }
+    const script = [
+        'Add-Type -AssemblyName System.Security',
+        "$in=[Convert]::FromBase64String([Console]::In.ReadToEnd().Trim())",
+        "$e=[Text.Encoding]::UTF8.GetBytes('" + ENTROPY + "')",
+        `$out=[Security.Cryptography.ProtectedData]::${direction === 'protect' ? 'Protect' : 'Unprotect'}($in,$e,[Security.Cryptography.DataProtectionScope]::CurrentUser)`,
+        '[Convert]::ToBase64String($out)'
+    ].join('\n');
+    return Buffer.from(await powershell(script, data.toString('base64')), 'base64');
+}
+export const dpapiProtector = {
+    protect: (plain) => dpapi(plain, 'protect'),
+    unprotect: (wrapped) => dpapi(wrapped, 'unprotect')
+};

package/dist/key-protector.js

@@ -0,0 +1,94 @@
+import { spawn } from 'node:child_process';
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { dpapiProtector } from './dpapi.js';
+const SERVICE = 'khat-vault';
+const ACCOUNT = 'khat';
+function run(command, args, input = '') {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+        let out = '', err = '';
+        child.stdout.on('data', (chunk) => out += chunk);
+        child.stderr.on('data', (chunk) => err += chunk);
+        child.once('error', (error) => reject(new Error(`${command} is unavailable: ${error.message}`)));
+        child.once('close', (code) => code === 0 ? resolve(out) : reject(new Error(`${command} failed (exit ${code}): ${err.trim() || out.trim()}`)));
+        child.stdin.end(input);
+    });
+}
+function commandProtector(platform, runner = run) {
+    let cached;
+    async function load() {
+        if (cached)
+            return cached;
+        try {
+            const output = platform === 'darwin'
+                ? await runner('security', ['find-generic-password', '-a', ACCOUNT, '-s', SERVICE, '-w'])
+                : await runner('secret-tool', ['lookup', 'service', SERVICE, 'account', ACCOUNT]);
+            const value = Buffer.from(output.trim(), 'base64');
+            if (value.length !== 32)
+                throw new Error('stored protector key has an invalid length');
+            cached = value;
+            return value;
+        }
+        catch (error) {
+            if (error?.message?.includes('unavailable'))
+                throw new Error(`${platform === 'darwin' ? 'macOS Keychain (security)' : 'Linux Secret Service (secret-tool)'} is unavailable; install/enable it before using khat (no plaintext fallback)`);
+            throw new Error(`could not read Khat protector key from ${platform === 'darwin' ? 'macOS Keychain' : 'Linux Secret Service'}: ${error.message}`);
+        }
+    }
+    async function ensure() {
+        try {
+            return await load();
+        }
+        catch (error) {
+            if (!error.message.startsWith('could not read'))
+                throw error;
+            const key = randomBytes(32).toString('base64');
+            try {
+                if (platform === 'darwin')
+                    await runner('security', ['add-generic-password', '-a', ACCOUNT, '-s', SERVICE, '-w', key, '-U']);
+                else
+                    await runner('secret-tool', ['store', '--label=Khat vault protector', 'service', SERVICE, 'account', ACCOUNT], key);
+                cached = Buffer.from(key, 'base64');
+                return cached;
+            }
+            catch (saveError) {
+                throw new Error(`could not create Khat protector key in ${platform === 'darwin' ? 'macOS Keychain' : 'Linux Secret Service'}: ${saveError.message} (no plaintext fallback)`);
+            }
+        }
+    }
+    return {
+        protect: async (plain) => {
+            const key = await ensure();
+            const nonce = randomBytes(12);
+            const cipher = createCipheriv('aes-256-gcm', key, nonce);
+            const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()]);
+            return Buffer.concat([nonce, cipher.getAuthTag(), ciphertext]);
+        },
+        unprotect: async (wrapped) => {
+            const key = await load();
+            if (wrapped.length < 28)
+                throw new Error('could not unwrap vault master key: invalid protected data');
+            try {
+                const decipher = createDecipheriv('aes-256-gcm', key, wrapped.subarray(0, 12));
+                decipher.setAuthTag(wrapped.subarray(12, 28));
+                return Buffer.concat([decipher.update(wrapped.subarray(28)), decipher.final()]);
+            }
+            catch {
+                throw new Error('could not unwrap vault master key: protector key mismatch or corrupted data');
+            }
+        }
+    };
+}
+export function createKeyProtector(platform = process.platform) {
+    if (platform === 'win32')
+        return dpapiProtector;
+    if (platform === 'darwin')
+        return commandProtector('darwin');
+    if (platform === 'linux')
+        return commandProtector('linux');
+    throw new Error(`unsupported platform '${platform}': Khat vault protection requires Windows DPAPI, macOS Keychain, or Linux Secret Service`);
+}
+/** Test seam for command-backed platform implementations. */
+export function createCommandKeyProtector(platform, runner) {
+    return commandProtector(platform, runner);
+}

package/dist/logger.js

@@ -0,0 +1,67 @@
+import { appendFile, mkdir, readFile, rename, stat, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+const DEFAULT_MAX_BYTES = 10 * 1024 * 1024;
+const DEFAULT_HISTORY_COUNT = 5;
+export class LogWriter {
+    directory;
+    maxBytes;
+    historyCount;
+    filePath;
+    queue = Promise.resolve();
+    constructor(directory, maxBytes = DEFAULT_MAX_BYTES, historyCount = DEFAULT_HISTORY_COUNT) {
+        this.directory = directory;
+        this.maxBytes = maxBytes;
+        this.historyCount = historyCount;
+        this.filePath = join(directory, 'khat.jsonl');
+    }
+    append(entry) {
+        this.queue = this.queue.then(async () => {
+            await mkdir(this.directory, { recursive: true, mode: 0o700 });
+            await this.rotateIfNeeded();
+            await appendFile(this.filePath, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+        });
+        return this.queue;
+    }
+    async recent(tail = 50) {
+        const count = Math.max(1, Math.min(Math.floor(tail), 1_000));
+        let content;
+        try {
+            content = await readFile(this.filePath, 'utf8');
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        const entries = [];
+        for (const line of content.split('\n')) {
+            if (!line)
+                continue;
+            try {
+                entries.push(JSON.parse(line));
+            }
+            catch { }
+        }
+        return entries.slice(-count);
+    }
+    async rotateIfNeeded() {
+        try {
+            if ((await stat(this.filePath)).size < this.maxBytes)
+                return;
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        for (let index = this.historyCount - 1; index >= 1; index--) {
+            const from = `${this.filePath}.${index}`;
+            const to = `${this.filePath}.${index + 1}`;
+            if (index === this.historyCount - 1)
+                await unlink(to).catch(() => undefined);
+            await rename(from, to).catch((error) => { if (error?.code !== 'ENOENT')
+                throw error; });
+        }
+        await rename(this.filePath, `${this.filePath}.1`);
+    }
+}

package/dist/portable-vault.js

@@ -0,0 +1,146 @@
+import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from 'node:crypto';
+import { access, mkdir, readFile, rename, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { saveJsonAtomic, validateConfig } from './config.js';
+import { Vault } from './vault.js';
+const FORMAT = 'khat-vault-export';
+const VERSION = 1;
+const AAD = 'khat-vault-export-v1';
+const ITERATIONS = 210_000;
+const KEY_LENGTH = 32;
+const MAX_CIPHERTEXT = 16 * 1024 * 1024;
+const B64 = /^[A-Za-z0-9+/]*={0,2}$/;
+function b64(value) { return value.toString('base64'); }
+function decode(value, name, min = 1, max = 1024) {
+    if (typeof value !== 'string' || !B64.test(value) || value.length % 4 !== 0)
+        throw new Error(`invalid export ${name}`);
+    const result = Buffer.from(value, 'base64');
+    if (result.length < min || result.length > max)
+        throw new Error(`invalid export ${name} length`);
+    return result;
+}
+export function makeExport(secrets, password, config) {
+    if (!password)
+        throw new Error('export password must not be empty');
+    const salt = randomBytes(16), nonce = randomBytes(12);
+    const key = pbkdf2Sync(password, salt, ITERATIONS, KEY_LENGTH, 'sha256');
+    const cipher = createCipheriv('aes-256-gcm', key, nonce);
+    cipher.setAAD(Buffer.from(AAD));
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify({ secrets, ...(config ? { config: structuredClone(config) } : {}) })), cipher.final()]);
+    const envelope = { format: FORMAT, version: VERSION, kdf: { name: 'pbkdf2', hash: 'sha256', iterations: ITERATIONS, salt: b64(salt), keyLength: KEY_LENGTH }, cipher: { name: 'aes-256-gcm', nonce: b64(nonce), ciphertext: b64(ciphertext), tag: b64(cipher.getAuthTag()) } };
+    return Buffer.from(JSON.stringify(envelope, null, 2) + '\n');
+}
+export async function exportPortable(path, vault, password, config) {
+    await saveJsonAtomic(path, JSON.parse(makeExport(vault.secrets, password, config).toString('utf8')));
+}
+export function readExport(raw, password) {
+    if (!password)
+        throw new Error('import password must not be empty');
+    let envelope;
+    try {
+        envelope = JSON.parse(raw.toString());
+    }
+    catch {
+        throw new Error('export file is not valid JSON');
+    }
+    if (envelope?.format !== FORMAT || envelope.version !== VERSION)
+        throw new Error('unsupported export format or version');
+    const kdf = envelope.kdf, cipher = envelope.cipher;
+    if (kdf?.name !== 'pbkdf2' || kdf.hash !== 'sha256' || kdf.keyLength !== KEY_LENGTH || kdf.iterations !== ITERATIONS)
+        throw new Error('unsupported or unsafe export KDF parameters');
+    const salt = decode(kdf.salt, 'salt', 16, 16), nonce = decode(cipher?.nonce, 'nonce', 12, 12), tag = decode(cipher?.tag, 'tag', 16, 16), ciphertext = decode(cipher?.ciphertext, 'ciphertext', 1, MAX_CIPHERTEXT);
+    try {
+        const decipher = createDecipheriv('aes-256-gcm', pbkdf2Sync(password, salt, ITERATIONS, KEY_LENGTH, 'sha256'), nonce);
+        decipher.setAAD(Buffer.from(AAD));
+        decipher.setAuthTag(tag);
+        return JSON.parse(Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8'));
+    }
+    catch {
+        throw new Error('could not decrypt export (wrong password or corrupted file)');
+    }
+}
+function validatePayload(payload) {
+    if (!payload || typeof payload !== 'object' || !payload.secrets || typeof payload.secrets !== 'object' || Array.isArray(payload.secrets))
+        throw new Error('export payload has invalid secrets');
+    for (const [ref, value] of Object.entries(payload.secrets))
+        if (!ref || typeof value !== 'string' || !value)
+            throw new Error('export payload has invalid secret');
+    if (payload.config) {
+        validateConfig(payload.config);
+        const refs = new Set();
+        for (const provider of payload.config.providers ?? [])
+            for (const key of provider.keys ?? []) {
+                if (key.vaultRef !== `${provider.id}/${key.id}`)
+                    throw new Error(`export has inconsistent vaultRef for ${provider.id}/${key.id}`);
+                refs.add(key.vaultRef);
+            }
+        for (const ref of refs)
+            if (!(ref in payload.secrets))
+                throw new Error(`export is missing secret for ${ref}`);
+    }
+}
+export async function importPortable(path, targetDir, protector, password, force = false) {
+    const payload = readExport(await readFile(path), password);
+    validatePayload(payload);
+    await mkdir(targetDir, { recursive: true, mode: 0o700 });
+    const configPath = join(targetDir, 'config.json'), vaultPath = join(targetDir, 'vault.json'), statePath = join(targetDir, 'state.json');
+    if (!force) {
+        for (const item of [configPath, vaultPath, statePath]) {
+            try {
+                await access(item);
+                throw new Error(`target is already initialized at ${targetDir}; use --force to replace it`);
+            }
+            catch (e) {
+                if (e.message?.startsWith('target is already'))
+                    throw e;
+            }
+        }
+    }
+    const stage = join(targetDir, `.import-${process.pid}-${randomBytes(6).toString('hex')}`);
+    await mkdir(stage, { mode: 0o700 });
+    try {
+        const vault = await Vault.create(join(stage, 'vault.json'), protector);
+        for (const [ref, value] of Object.entries(payload.secrets))
+            vault.set(ref, value);
+        await vault.save();
+        await saveJsonAtomic(join(stage, 'config.json'), payload.config ?? { version: 1, bind: '127.0.0.1', port: 8787, requestBodyLimitMB: 64, providers: [], routes: [] });
+        await saveJsonAtomic(join(stage, 'state.json'), { keys: {}, counters: {} });
+        const backup = force ? join(targetDir, `.import-backup-${process.pid}-${randomBytes(6).toString('hex')}`) : undefined;
+        if (backup)
+            await mkdir(backup, { mode: 0o700 });
+        const moved = [];
+        try {
+            for (const name of ['vault.json', 'config.json', 'state.json']) {
+                const destination = join(targetDir, name);
+                if (backup) {
+                    try {
+                        await rename(destination, join(backup, name));
+                    }
+                    catch (error) {
+                        if (error?.code !== 'ENOENT')
+                            throw error;
+                    }
+                }
+                await rename(join(stage, name), destination);
+                moved.push(name);
+            }
+            if (backup)
+                await rm(backup, { recursive: true, force: true });
+        }
+        catch (error) {
+            for (const name of moved)
+                await rm(join(targetDir, name), { force: true });
+            if (backup)
+                for (const name of ['vault.json', 'config.json', 'state.json']) {
+                    try {
+                        await rename(join(backup, name), join(targetDir, name));
+                    }
+                    catch { }
+                }
+            throw error;
+        }
+    }
+    finally {
+        await rm(stage, { recursive: true, force: true });
+    }
+}

package/dist/router.js

@@ -0,0 +1,10 @@
+export function resolveProvider(config, model) {
+    const slash = model.indexOf('/');
+    if (slash > 0) {
+        const providerId = model.slice(0, slash);
+        const provider = config.providers.find((item) => item.id === providerId);
+        return provider && config.routes.some((route) => route.provider === providerId && route.model === model.slice(slash + 1)) ? provider : undefined;
+    }
+    const route = config.routes.find((item) => item.model === model);
+    return route ? config.providers.find((item) => item.id === route.provider) : undefined;
+}

package/dist/selector.js

@@ -0,0 +1,23 @@
+export class WeightedSelector {
+    current = new Map();
+    select(providerId, keys, states) {
+        const available = keys.filter((key) => states[`${providerId}/${key.id}`]?.status !== 'unavailable');
+        if (!available.length)
+            return undefined;
+        let total = 0;
+        let selected = available[0];
+        let best = Number.NEGATIVE_INFINITY;
+        for (const key of available) {
+            const id = `${providerId}/${key.id}`;
+            const weight = (this.current.get(id) ?? 0) + key.weight;
+            this.current.set(id, weight);
+            total += key.weight;
+            if (weight > best) {
+                best = weight;
+                selected = key;
+            }
+        }
+        this.current.set(`${providerId}/${selected.id}`, (this.current.get(`${providerId}/${selected.id}`) ?? 0) - total);
+        return selected;
+    }
+}