@byokit/openclaw 0.1.0

package/dist/link.js

@@ -0,0 +1,273 @@
+// Host-side link adapter (7.1): typed, member-checked ops over @byokit/link, sealed approval push
+// via the relay (7.3). Node only.
+import { randomUUID } from 'node:crypto';
+import { createServer } from 'node:http';
+import { WebSocketServer } from 'ws';
+import { PublicLinkError, } from '@byokit/link';
+import { reach } from '@byokit/reach';
+import { b64urlDecode, sealNotice } from "./notices.js";
+import { routeFor } from "./routes.js";
+import { stateWords, words } from "./words.js";
+const VIEW_OPS = new Set(['oc.state', 'oc.routes', 'oc.signin.view', 'oc.sessions', 'oc.approvals', 'oc.events']);
+const refused = () => new PublicLinkError(words('link.notAllowed'));
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const memberKey = (member, sessionKey) => sessionKey.startsWith(`agent:${member}:`);
+function memberSessions(result, member) {
+    const rows = Array.isArray(result) ? result : isRecord(result) && Array.isArray(result.sessions) ? result.sessions : [];
+    return rows.filter((row) => isRecord(row) && typeof row.sessionKey === 'string' && memberKey(member, row.sessionKey));
+}
+export function openclawLink(kit, o) {
+    const passThrough = o.passThrough ?? (() => false);
+    // Grants that have called, so sealed pushes and push actions can check the member (7.3).
+    const seen = new Map();
+    // Devices that registered a box key, by grant id.
+    const boxes = new Map();
+    // One sign-in drive per member+provider, plus the latest view even after it ends.
+    const drives = new Map();
+    const latest = new Map();
+    const memberOf = (grant) => {
+        seen.set(grant.id, grant);
+        const member = o.memberOf(grant);
+        if (member === undefined)
+            throw refused();
+        return member;
+    };
+    const pushApproval = async (approval) => {
+        if (!o.relay)
+            return;
+        const jobs = [];
+        for (const [id, box] of boxes) {
+            const grant = seen.get(id);
+            if (!grant || o.memberOf(grant) !== approval.member)
+                continue;
+            jobs.push(o.relay.notify({ id: approval.id, title: words('approval.notice'), data: sealNotice(approval, box),
+                to: [id], actions: ['allow', 'deny'], urgency: 'high' }, { includeContent: true }));
+        }
+        for (const [id, grant] of seen) {
+            if (boxes.has(id) || o.memberOf(grant) !== approval.member)
+                continue;
+            jobs.push(o.relay.notify({ id: approval.id, title: words('approval.notice'), to: [id], actions: ['allow', 'deny'], urgency: 'high' }, { includeContent: false }));
+        }
+        await Promise.all(jobs);
+    };
+    const offPush = o.relay ? kit.onApproval((a, change) => {
+        if (change !== 'added')
+            return;
+        void pushApproval(a).catch(() => { });
+    }) : undefined;
+    void offPush;
+    const onAction = async (a) => {
+        const grant = seen.get(a.device);
+        const member = grant ? o.memberOf(grant) : undefined;
+        if (member === undefined)
+            throw refused();
+        if (a.action !== 'allow' && a.action !== 'deny')
+            throw refused();
+        if (!kit.approvals(member).some((approval) => approval.id === a.event))
+            throw refused();
+        await kit.decide(a.event, { allow: a.action === 'allow' });
+        return null;
+    };
+    const endReason = (error) => error instanceof PublicLinkError ? error.message.slice(0, 200) : 'failed';
+    const handle = async (req, grant) => {
+        const member = memberOf(grant);
+        if (grant.role === 'view' && !VIEW_OPS.has(req.op))
+            throw refused();
+        const args = isRecord(req.args) ? req.args : {};
+        switch (req.op) {
+            case 'oc.state':
+                return { state: kit.state, words: stateWords(kit.state) };
+            case 'oc.routes':
+                return kit.routes().filter((route) => route.offer);
+            case 'oc.signin.start': {
+                if (typeof args.provider !== 'string' || (args.via !== 'browser' && args.via !== 'code'))
+                    throw new Error('oc.signin.start needs { provider, via: browser|code }');
+                const route = routeFor(args.provider, args.via);
+                if (!route)
+                    throw refused();
+                const key = `${member}:${args.provider}`;
+                drives.get(key)?.cancel();
+                const view = { state: 'waiting', via: args.via };
+                latest.set(key, view);
+                const drive = kit.signIn(member, { authChoice: route.choice, via: args.via }, (next) => {
+                    latest.set(key, next);
+                });
+                drives.set(key, drive);
+                void drive.done.then((done) => { latest.set(key, done); if (drives.get(key) === drive)
+                    drives.delete(key); }, () => { if (drives.get(key) === drive)
+                    drives.delete(key); });
+                return latest.get(key);
+            }
+            case 'oc.signin.view': {
+                if (typeof args.provider !== 'string')
+                    throw new Error('oc.signin.view needs { provider }');
+                // `ready` is the member's account (signed in to this provider), not the engine: `phaseOf` reads it as done.
+                const key = `${member}:${args.provider}`;
+                const ready = kit.state.phase === 'ready' && await kit.signedIn(member, args.provider);
+                // A finished sign-in whose account is gone since (signed out anywhere, or dropped by the engine) is no
+                // sign-in to show: without this the view says done while `ready` says no, which phaseOf reads as opening.
+                if (!ready && !drives.has(key) && latest.get(key)?.state === 'done')
+                    latest.delete(key);
+                return { ready, view: latest.get(key) ?? null };
+            }
+            case 'oc.signin.paste': {
+                if (typeof args.provider !== 'string' || typeof args.text !== 'string')
+                    throw new Error('oc.signin.paste needs { provider, text }');
+                drives.get(`${member}:${args.provider}`)?.paste(args.text);
+                return null;
+            }
+            case 'oc.signin.cancel': {
+                if (typeof args.provider !== 'string')
+                    throw new Error('oc.signin.cancel needs { provider }');
+                drives.get(`${member}:${args.provider}`)?.cancel();
+                return null;
+            }
+            case 'oc.signout': {
+                if (typeof args.provider !== 'string')
+                    throw new Error('oc.signout needs { provider }');
+                await kit.signOut(member, args.provider);
+                return null;
+            }
+            case 'oc.sessions': {
+                const result = await kit.call('sessions.list', {});
+                return memberSessions(result, member);
+            }
+            case 'oc.steer': {
+                if (typeof args.sessionKey !== 'string' || typeof args.text !== 'string')
+                    throw new Error('oc.steer needs { sessionKey, text }');
+                if (!memberKey(member, args.sessionKey))
+                    throw refused();
+                await kit.steer(args.sessionKey, args.text);
+                return null;
+            }
+            case 'oc.abort': {
+                if (typeof args.sessionKey !== 'string')
+                    throw new Error('oc.abort needs { sessionKey }');
+                if (!memberKey(member, args.sessionKey))
+                    throw refused();
+                await kit.abort(args.sessionKey);
+                return null;
+            }
+            case 'oc.approvals':
+                return kit.approvals(member);
+            case 'oc.decide': {
+                if (typeof args.id !== 'string' || typeof args.allow !== 'boolean')
+                    throw new Error('oc.decide needs { id, allow }');
+                if (!kit.approvals(member).some((approval) => approval.id === args.id))
+                    throw refused();
+                await kit.decide(args.id, {
+                    allow: args.allow,
+                    ...(typeof args.reason === 'string' ? { reason: args.reason } : {}),
+                    ...('answer' in args ? { answer: args.answer } : {}),
+                });
+                return null;
+            }
+            case 'oc.notices.register': {
+                // Per-device box key for sealed pushes. Kept in this adapter (not grant meta: the HostOptions
+                // shape gives handle no host for setMeta, and the key is session state devices re-register).
+                if (typeof args.boxPublicKey !== 'string')
+                    throw new Error('oc.notices.register needs { boxPublicKey }');
+                const box = b64urlDecode(args.boxPublicKey);
+                if (!box || box.length !== 32)
+                    throw new Error('oc.notices.register needs a 32-byte b64url boxPublicKey');
+                boxes.set(grant.id, box);
+                return null;
+            }
+            case 'oc.call': {
+                if (typeof args.method !== 'string')
+                    throw new Error('oc.call needs { method, params }');
+                if (!passThrough(args.method, grant))
+                    throw refused();
+                return await kit.call(args.method, args.params);
+            }
+            default:
+                throw refused();
+        }
+    };
+    const stream = async (s, req, grant) => {
+        const member = memberOf(grant);
+        if (req.op === 'oc.run') {
+            if (grant.role === 'view')
+                throw refused();
+            const args = isRecord(req.args) ? req.args : {};
+            if (typeof args.message !== 'string' || (args.model !== undefined && typeof args.model !== 'string'))
+                throw new Error('oc.run needs { message, sessionKey?, model? }');
+            const sessionKey = args.sessionKey === undefined ? `agent:${member}:link:${randomUUID()}` : args.sessionKey;
+            if (typeof sessionKey !== 'string' || !memberKey(member, sessionKey))
+                throw refused();
+            // Ordered frames over the paced stream: each write waits for the last.
+            let tail = Promise.resolve();
+            const send = (frame) => {
+                tail = tail.then(() => s.write(`${JSON.stringify(frame)}\n`)).catch(() => { });
+            };
+            try {
+                const end = await kit.run({ member, sessionKey, message: args.message,
+                    ...(args.model === undefined ? {} : { model: args.model }) }, (e) => send(e));
+                send({ type: 'end', end });
+                await tail;
+                s.end();
+            }
+            catch (error) {
+                await tail;
+                s.end(endReason(error));
+            }
+            return;
+        }
+        if (req.op === 'oc.events') {
+            const offEvent = kit.onEvent('*', (payload, event) => {
+                const record = payload;
+                const agent = record?.agentId;
+                const key = record?.sessionKey;
+                if (agent !== member && !(typeof key === 'string' && memberKey(member, key)))
+                    return;
+                void s.write(`${JSON.stringify({ event, payload })}\n`).catch(() => { });
+            });
+            const offApproval = kit.onApproval((approval, change) => {
+                if (approval.member !== member)
+                    return;
+                void s.write(`${JSON.stringify({ event: 'approval', change, approval })}\n`).catch(() => { });
+            });
+            s.onEnd = () => { offEvent(); offApproval(); };
+            return;
+        }
+        throw refused();
+    };
+    return { handle, stream, allow: () => true, onAction };
+}
+// ponytail: this ~40-line serve() wiring is deliberately duplicated per runtime kit (D3);
+// extract it into a shared package when a third runtime kit appears.
+export async function serve(o) {
+    const r = await reach({ port: o.port, via: o.via, previous: o.previous });
+    const server = createServer(o.http ??
+        ((_req, res) => {
+            res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('Not found');
+        }));
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(o.port, r.bind, () => {
+            server.off('error', reject);
+            resolve();
+        });
+    });
+    const wss = new WebSocketServer({ server });
+    const sockets = new Set();
+    wss.on('connection', (ws, req) => {
+        sockets.add(ws);
+        ws.on('close', () => {
+            sockets.delete(ws);
+        });
+        o.host.accept(ws, { peer: req.socket.remoteAddress });
+    });
+    return {
+        urls: r.urls,
+        ...(r.ingress ? { ingress: r.ingress } : {}),
+        close: async () => {
+            // Ends device sockets first: the http close below waits for connections.
+            for (const ws of sockets)
+                ws.terminate();
+            await new Promise((resolve) => wss.close(() => resolve()));
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}

package/dist/members.d.ts

@@ -0,0 +1,11 @@
+import type { GatewayTransport, Member } from './types.ts';
+export declare const MEMBER_ID: RegExp;
+export declare function createMembers(ctx: {
+    request: GatewayTransport['request'];
+    root: string;
+}): {
+    ensure(member: Member): Promise<{
+        agentId: string;
+        workspace: string;
+    }>;
+};

package/dist/members.js

@@ -0,0 +1,23 @@
+import { join } from 'node:path';
+export const MEMBER_ID = /^[a-z][a-z0-9-]{0,31}$/;
+export function createMembers(ctx) {
+    const cache = new Map();
+    return { ensure(member) {
+            if (!MEMBER_ID.test(member))
+                return Promise.reject(new Error(`invalid member id: ${member}`));
+            const existing = cache.get(member);
+            if (existing)
+                return existing;
+            const workspace = join(ctx.root, 'workspaces', member);
+            const result = (async () => {
+                const list = await ctx.request('agents.list');
+                if (!list.agents.some((agent) => agent.id === member))
+                    await ctx.request('agents.create', { name: member, workspace });
+                return { agentId: member, workspace };
+            })();
+            cache.set(member, result);
+            void result.catch(() => { if (cache.get(member) === result)
+                cache.delete(member); });
+            return result;
+        } };
+}

package/dist/migrate.d.ts

@@ -0,0 +1,22 @@
+import type { RetainedLogin } from './kit.ts';
+import type { SignInCtx } from './signin.ts';
+import type { Member } from './types.ts';
+export type DoctorRunner = () => {
+    status: number | null;
+};
+/**
+ * Stage before `start()` (an import while a Gateway owns the state is exactly how a preserved sign-in is lost):
+ * `prepare()` first, then the member's `auth-profiles.json` (0600), then one offline doctor run. The original file
+ * is never written to: a failed run only clears the staging, so the next boot stages it again byte for byte.
+ */
+export declare function migrateRetainedLogin(ctx: {
+    root: string;
+    prepare(): Promise<void>;
+    doctor: DoctorRunner;
+}, member: Member, source: RetainedLogin): Promise<'staged' | 'nothing' | 'failed'>;
+/**
+ * After `ready`: the migration counts only when the Gateway itself reports every provider signed in. Only then does
+ * a path source move aside (a rename, so the original bytes survive whole) — anything else leaves the sign-in where
+ * it was and the next boot retries it without asking the person to sign in again.
+ */
+export declare function confirmRetainedLogin(ctx: SignInCtx, member: Member, source: RetainedLogin): Promise<boolean>;

package/dist/migrate.js

@@ -0,0 +1,118 @@
+// Retained-login migration (D15, 5.7): stage a Pi auth.json-shaped record into the engine's own store, then confirm
+// only when the Gateway itself reports every provider signed in.
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { MEMBER_ID } from "./members.js";
+import { providers } from "./signin.js";
+const MOVED = '.moved-to-engine';
+const MARKER = '.canonicalized';
+const TRY_MS = 1_500;
+const TRIES = 3;
+/** The file to import from (D15): the path itself, else the retired copy while it is still unconfirmed. */
+function sourceFile(source) {
+    if (!('path' in source))
+        return undefined;
+    if (existsSync(source.path))
+        return source.path;
+    const moved = source.path + MOVED;
+    return existsSync(moved) && !existsSync(moved + MARKER) ? moved : undefined;
+}
+/** The old sign-in's plain `{ '<provider>': credential }` map, or undefined when it is absent or unreadable. */
+function credentials(source, path) {
+    try {
+        const raw = 'record' in source ? source.record : JSON.parse(readFileSync(path, 'utf8'));
+        return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The engine's own provider ids for what the old sign-in holds; `openai-codex` is `openai` (D15). */
+function wantedProviders(legacy) {
+    const names = Object.entries(legacy).map(([key, credential]) => {
+        if (key === 'openai-codex')
+            return 'openai';
+        const own = credential && typeof credential === 'object' ? credential.provider : undefined;
+        return typeof own === 'string' && own !== '' ? own : key.toLowerCase();
+    });
+    return [...new Set(names)];
+}
+/**
+ * Stage before `start()` (an import while a Gateway owns the state is exactly how a preserved sign-in is lost):
+ * `prepare()` first, then the member's `auth-profiles.json` (0600), then one offline doctor run. The original file
+ * is never written to: a failed run only clears the staging, so the next boot stages it again byte for byte.
+ */
+export async function migrateRetainedLogin(ctx, member, source) {
+    // The member id is the only thing between a caller and a credential write, and this runs before any transport
+    // could validate it (D9).
+    if (!MEMBER_ID.test(member))
+        throw new Error(`invalid member id: ${member}`);
+    const path = sourceFile(source);
+    if ('path' in source && !path)
+        return 'nothing';
+    const legacy = credentials(source, path);
+    if (!legacy || !Object.keys(legacy).length)
+        return 'nothing'; // never migrate an empty source
+    // A retired copy without the one provider the engine's canonicalization exists for is not worth importing.
+    if (path?.endsWith(MOVED) && !('openai-codex' in legacy))
+        return 'nothing';
+    await ctx.prepare();
+    const agentDir = join(ctx.root, 'state', 'agents', member, 'agent');
+    const staged = join(agentDir, 'auth-profiles.json');
+    // Only a staging this call wrote may ever be removed: the file is the member's live sign-in once the engine has
+    // imported it, and a failed run must not take that with it.
+    const wrote = !existsSync(staged);
+    if (wrote) {
+        // Doctor canonicalizes legacy provider ids before importing; staging `auth.json` instead keeps the old id,
+        // which looks signed in but cannot authenticate `openai/*` turns.
+        mkdirSync(agentDir, { recursive: true, mode: 0o700 });
+        const body = JSON.stringify({ version: 1, profiles: Object.fromEntries(Object.entries(legacy).map(([provider, credential]) => [`${provider}:default`, credential])) });
+        // Written beside its home and renamed into place, so a reader never sees half a profile store.
+        const staging = `${staged}.staging-${process.pid}`;
+        writeFileSync(staging, body, { mode: 0o600 });
+        renameSync(staging, staged);
+    }
+    // The doctor's exit is a weak yes (it exits 0 even when it imports nothing), so a failed run only clears the
+    // staging; retiring the original stays confirm's job.
+    if (ctx.doctor().status !== 0) {
+        if (wrote)
+            rmSync(staged, { force: true });
+        return 'failed';
+    }
+    return 'staged';
+}
+/**
+ * After `ready`: the migration counts only when the Gateway itself reports every provider signed in. Only then does
+ * a path source move aside (a rename, so the original bytes survive whole) — anything else leaves the sign-in where
+ * it was and the next boot retries it without asking the person to sign in again.
+ */
+export async function confirmRetainedLogin(ctx, member, source) {
+    if (!MEMBER_ID.test(member))
+        throw new Error(`invalid member id: ${member}`);
+    const original = 'path' in source ? source.path : undefined;
+    const path = sourceFile(source);
+    if (original && !path)
+        return false;
+    const legacy = credentials(source, path);
+    if (!legacy)
+        return false;
+    const wanted = wantedProviders(legacy);
+    if (!wanted.length)
+        return false; // nothing recognizable to verify: never retire on a guess
+    try {
+        for (let tries = 0; tries < TRIES; tries++) {
+            const have = await providers(ctx, member, true);
+            if (wanted.every((provider) => have.includes(provider))) {
+                if (path && path === original)
+                    renameSync(path, path + MOVED);
+                if (original)
+                    writeFileSync(original + MOVED + MARKER, '', { mode: 0o600 });
+                return true; // a record source moves nothing: the app deletes its own copy
+            }
+            if (tries < TRIES - 1)
+                await new Promise((resume) => setTimeout(resume, TRY_MS));
+        }
+    }
+    catch { /* the engine is down or the file unreadable: the original stays */ }
+    return false;
+}

package/dist/notices.d.ts

@@ -0,0 +1,9 @@
+import type { Approval } from './types.ts';
+/** Portable base64url. btoa/atob are globals in Node, browsers and React Native. */
+export declare function b64urlEncode(bytes: Uint8Array): string;
+export declare function b64urlDecode(text: string): Uint8Array | null;
+export declare function sealNotice(a: Approval, boxPublicKey: Uint8Array): {
+    v: 1;
+    sealed: string;
+};
+export declare function openNotice(data: Record<string, unknown>, seed: Uint8Array): Approval | null;

package/dist/notices.js

@@ -0,0 +1,75 @@
+// Sealed approval notices for the relay push (7.3). Portable: only @byokit/seal and types —
+// no node:* or Node-only imports may reach here (test/portable.test.ts guards the device entry
+// that re-exports openNotice). The relay reads only the generic title; the approval itself
+// travels sealed to the device's box key.
+import { openBox, sealBox } from '@byokit/seal';
+const SOURCES = new Set(['gate', 'exec', 'plugin', 'question']);
+/** Portable base64url. btoa/atob are globals in Node, browsers and React Native. */
+export function b64urlEncode(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+export function b64urlDecode(text) {
+    try {
+        const padded = text.replaceAll('-', '+').replaceAll('_', '/');
+        const binary = atob(padded + '='.repeat((4 - (padded.length % 4)) % 4));
+        return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isBoxKey = (value) => ArrayBuffer.isView(value) && value instanceof Uint8Array && value.length === 32;
+/** Shape-check a decrypted notice: anything else is a wrong key or a foreign payload, never an approval. */
+function isApproval(value) {
+    if (!isRecord(value))
+        return false;
+    if (typeof value.id !== 'string' || value.id === '')
+        return false;
+    if (typeof value.source !== 'string' || !SOURCES.has(value.source))
+        return false;
+    if (typeof value.member !== 'string')
+        return false;
+    if (typeof value.summary !== 'string')
+        return false;
+    if (typeof value.at !== 'number' || typeof value.expires !== 'number')
+        return false;
+    if (value.sessionKey !== undefined && typeof value.sessionKey !== 'string')
+        return false;
+    if (value.tool !== undefined && typeof value.tool !== 'string')
+        return false;
+    return true;
+}
+export function sealNotice(a, boxPublicKey) {
+    if (!isBoxKey(boxPublicKey))
+        throw new RangeError('sealNotice needs a 32-byte box public key');
+    const bytes = new TextEncoder().encode(JSON.stringify(a));
+    try {
+        return { v: 1, sealed: b64urlEncode(sealBox(bytes, boxPublicKey)) };
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+export function openNotice(data, seed) {
+    if (!isRecord(data) || data.v !== 1 || typeof data.sealed !== 'string')
+        return null;
+    if (!isBoxKey(seed))
+        return null;
+    const bundle = b64urlDecode(data.sealed);
+    if (!bundle)
+        return null;
+    const bytes = openBox(bundle, seed);
+    if (!bytes)
+        return null;
+    try {
+        const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        return isApproval(value) ? value : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/routes.d.ts

@@ -0,0 +1,9 @@
+import type { Route } from './types.ts';
+/** The pin's auth-choice table. `provider` is the id a person's account is known by (the doc's matrix), which for
+ *  MiniMax's portal routes is the account-visible `minimax`, not the wizard's internal `minimax-portal`. `plugin` is
+ *  the bundled plugin the app must allow for that route to start (5.6). Only the pin's bundled provider contracts are
+ *  listed: install-catalog plugins (external providers needing their own install) are not contracted by the pin and
+ *  are deliberately absent. */
+export declare function routes(): Route[];
+/** The route an app should use: only an offered route counts, so an Anthropic fallback can never be picked. */
+export declare function routeFor(provider: string, via: 'browser' | 'code'): Route | undefined;

package/dist/routes.js

@@ -0,0 +1,15 @@
+// Route labels: data, not code (D12). One entry per auth choice in the pinned tarball's provider contracts (O6).
+import routesJson from './routes.json' with { type: 'json' };
+const table = routesJson;
+/** The pin's auth-choice table. `provider` is the id a person's account is known by (the doc's matrix), which for
+ *  MiniMax's portal routes is the account-visible `minimax`, not the wizard's internal `minimax-portal`. `plugin` is
+ *  the bundled plugin the app must allow for that route to start (5.6). Only the pin's bundled provider contracts are
+ *  listed: install-catalog plugins (external providers needing their own install) are not contracted by the pin and
+ *  are deliberately absent. */
+export function routes() {
+    return table;
+}
+/** The route an app should use: only an offered route counts, so an Anthropic fallback can never be picked. */
+export function routeFor(provider, via) {
+    return table.find((route) => route.offer && route.provider === provider && route.via === via);
+}