@cogenta/agents 0.2.0 → 0.4.0

package/dist/providers/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/providers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGhD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAaxE;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IAInE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAA;IACvD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAA;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACzF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAEzF,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,GAAG,CAAC,IAAI;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,sBAAsB,IAAI,gCAAgC;oBACnE,IAAI,EAAE,sEAAsE;iBAC7E,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/providers/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAoChD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,KAA0B;IAC3D,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC7F,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;YAC3C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC;KAC5D,CAAA;IAED,IAAI,YAAY,EAAE,UAAU,KAAK,WAAW,EAAE,CAAC;QAC7C,OAAO,qBAAqB,CAAC;YAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,YAAY,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,kBAAkB,CAAC;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,MAAM;SACV,CAAC,CAAA;IACJ,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,YAAY,EAAE,cAAc,CAAA;IAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,IAAI,IAAI,+DAA+D;YAChF,IAAI,EAAE,sFAAsF;SAC7F,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA8B;IAInE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,GAAG,CAAC,IAAI;YACN,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,sBAAsB,IAAI,gCAAgC;oBACnE,IAAI,EAAE,sEAAsE;iBAC7E,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/providers/request-signal.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Every default-`false` timeout: none of the three adapters ever bounded a
+ * model call on their own — `ChatOptions.signal` only cancels when a caller
+ * (the run loop's own cancellation, task 2) supplies one, and the run loop
+ * never does for a single chat turn triggered by `POST
+ * .../conversation/messages`. Reproduced live: a stalled DeepSeek response
+ * left that request (and the browser tab awaiting it) hung for minutes with
+ * no error, nothing in the server log, and no way to recover short of
+ * killing the process. This is the floor every adapter now falls back to
+ * when the caller supplies no signal of its own — a stalled vendor fails
+ * with a named error instead of hanging the caller forever.
+ */
+export declare const DEFAULT_PROVIDER_REQUEST_TIMEOUT_MS = 180000;
+/**
+ * The caller's own signal (if any) combined with a timeout floor, so a
+ * cancellation the run loop already wants (budget exceeded, kill switch)
+ * still works exactly as before, and an otherwise-uncancelled call still
+ * gives up eventually. `timeoutMs` defaults to the real floor above —
+ * overridable only so a test can prove the behaviour without a real
+ * two-minute wait.
+ */
+export declare function requestSignalWithTimeout(callerSignal: AbortSignal | undefined, timeoutMs?: number): AbortSignal;
+//# sourceMappingURL=request-signal.d.ts.map

package/dist/providers/request-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-signal.d.ts","sourceRoot":"","sources":["../../src/providers/request-signal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mCAAmC,SAAU,CAAA;AAE1D;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,WAAW,GAAG,SAAS,EACrC,SAAS,GAAE,MAA4C,GACtD,WAAW,CAGb"}

package/dist/providers/request-signal.js

@@ -0,0 +1,26 @@
+/**
+ * Every default-`false` timeout: none of the three adapters ever bounded a
+ * model call on their own — `ChatOptions.signal` only cancels when a caller
+ * (the run loop's own cancellation, task 2) supplies one, and the run loop
+ * never does for a single chat turn triggered by `POST
+ * .../conversation/messages`. Reproduced live: a stalled DeepSeek response
+ * left that request (and the browser tab awaiting it) hung for minutes with
+ * no error, nothing in the server log, and no way to recover short of
+ * killing the process. This is the floor every adapter now falls back to
+ * when the caller supplies no signal of its own — a stalled vendor fails
+ * with a named error instead of hanging the caller forever.
+ */
+export const DEFAULT_PROVIDER_REQUEST_TIMEOUT_MS = 180_000;
+/**
+ * The caller's own signal (if any) combined with a timeout floor, so a
+ * cancellation the run loop already wants (budget exceeded, kill switch)
+ * still works exactly as before, and an otherwise-uncancelled call still
+ * gives up eventually. `timeoutMs` defaults to the real floor above —
+ * overridable only so a test can prove the behaviour without a real
+ * two-minute wait.
+ */
+export function requestSignalWithTimeout(callerSignal, timeoutMs = DEFAULT_PROVIDER_REQUEST_TIMEOUT_MS) {
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    return callerSignal === undefined ? timeoutSignal : AbortSignal.any([callerSignal, timeoutSignal]);
+}
+//# sourceMappingURL=request-signal.js.map

package/dist/providers/request-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-signal.js","sourceRoot":"","sources":["../../src/providers/request-signal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,OAAO,CAAA;AAE1D;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAqC,EACrC,SAAS,GAAW,mCAAmC;IAEvD,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACpD,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAA;AACpG,CAAC"}

package/dist/providers/resolve.d.ts

@@ -0,0 +1,13 @@
+import type { ProviderRegistryConfig } from './registry.js';
+import type { ProviderConfigStore } from './store.js';
+/**
+ * Turns the persisted, encrypted `ProviderConfigStore` into the plaintext
+ * shape `createProviderRegistry` needs — the one place a key is decrypted
+ * for actual use (R7: never logged, never returned from this function's
+ * caller over the wire). A provider with no saved key, or saved but
+ * disabled, is simply absent from the result — exactly R2's "no provider
+ * configured" state `createProviderRegistry`'s own doc comment already
+ * describes.
+ */
+export declare function resolveProviderRegistryConfig(store: ProviderConfigStore): Promise<ProviderRegistryConfig>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/providers/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/providers/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,sBAAsB,CAAC,CA4BjC"}

package/dist/providers/resolve.js

@@ -0,0 +1,30 @@
+/**
+ * Turns the persisted, encrypted `ProviderConfigStore` into the plaintext
+ * shape `createProviderRegistry` needs — the one place a key is decrypted
+ * for actual use (R7: never logged, never returned from this function's
+ * caller over the wire). A provider with no saved key, or saved but
+ * disabled, is simply absent from the result — exactly R2's "no provider
+ * configured" state `createProviderRegistry`'s own doc comment already
+ * describes.
+ */
+export async function resolveProviderRegistryConfig(store) {
+    const configs = await store.list();
+    const config = {};
+    for (const entry of configs) {
+        if (!entry.enabled)
+            continue;
+        const apiKey = await store.decryptKey(entry.provider);
+        config[entry.provider] = {
+            apiKey,
+            model: entry.model,
+            ...(entry.baseUrl === undefined ? {} : { baseUrl: entry.baseUrl }),
+            ...(entry.maxOutputTokens === undefined ? {} : { maxOutputTokens: entry.maxOutputTokens }),
+            ...(entry.requestTimeoutMs === undefined ? {} : { requestTimeoutMs: entry.requestTimeoutMs }),
+            ...(entry.maxCorrectionAttempts === undefined
+                ? {}
+                : { maxCorrectionAttempts: entry.maxCorrectionAttempts }),
+        };
+    }
+    return config;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/providers/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/providers/resolve.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,KAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,MAAM,MAAM,GAUR,EAAE,CAAA;IACN,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,SAAQ;QAC5B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACrD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG;YACvB,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC7F,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC;SAC5D,CAAA;IACH,CAAC;IACD,OAAO,MAAgC,CAAA;AACzC,CAAC"}

package/dist/providers/store.d.ts

@@ -0,0 +1,70 @@
+import type { ProviderName } from './registry.js';
+export interface StoredProviderConfig {
+    readonly provider: ProviderName;
+    readonly enabled: boolean;
+    readonly model: string;
+    readonly baseUrl?: string;
+    /** Last 4 characters of the real key, for the admin to confirm which key is saved without ever re-displaying it in full. */
+    readonly maskedKey: string;
+    readonly updatedAt: string;
+    /**
+     * The completion budget (`ProviderClient.maxOutputTokens`), request retry
+     * count (`maxCorrectionAttempts`) and HTTP/agent-loop timeout
+     * (`requestTimeoutMs`, milliseconds) this provider's client resolves to.
+     * Absent means "use the built-in fallback" (`resolve.ts`) — every one of
+     * these was, before this admin surface existed, a number hardcoded per
+     * call site with no way for an admin to say "this particular model needs
+     * more room to think" (the exact bug a real reasoning-model run
+     * reproduced: DeepSeek's `deepseek-v4-flash` silently truncated to an
+     * empty response at a too-low hardcoded ceiling).
+     */
+    readonly maxOutputTokens?: number;
+    readonly requestTimeoutMs?: number;
+    readonly maxCorrectionAttempts?: number;
+}
+export interface ProviderConfigInput {
+    readonly provider: ProviderName;
+    readonly apiKey: string;
+    readonly model: string;
+    readonly baseUrl?: string;
+    readonly enabled?: boolean;
+    readonly maxOutputTokens?: number;
+    readonly requestTimeoutMs?: number;
+    readonly maxCorrectionAttempts?: number;
+}
+export interface ProviderConfigStore {
+    list(): Promise<readonly StoredProviderConfig[]>;
+    get(provider: ProviderName): Promise<StoredProviderConfig | undefined>;
+    /** Encrypts and persists `apiKey`; creates or overwrites this provider's one record. */
+    upsert(input: ProviderConfigInput): Promise<StoredProviderConfig>;
+    setEnabled(provider: ProviderName, enabled: boolean): Promise<StoredProviderConfig>;
+    /**
+     * Changes `model`/`baseUrl`/tuning without touching the saved key — so an
+     * admin can adjust any of these, including *after* the first save,
+     * without being made to re-paste an API key they may no longer have
+     * handy. `undefined` on a tuning field leaves it as saved; `null`
+     * explicitly clears it back to "use the built-in default" (the one thing
+     * a plain optional field can't express — leaving it out of the patch and
+     * clearing it back to unset need distinct wire shapes). Throws
+     * `PROVIDER_NOT_CONFIGURED` if this provider has no saved key yet.
+     */
+    updateSettings(provider: ProviderName, patch: {
+        readonly model?: string;
+        readonly baseUrl?: string;
+        readonly maxOutputTokens?: number | null;
+        readonly requestTimeoutMs?: number | null;
+        readonly maxCorrectionAttempts?: number | null;
+    }): Promise<StoredProviderConfig>;
+    remove(provider: ProviderName): Promise<void>;
+    /** The one place the real key is ever decrypted — never exposed on `StoredProviderConfig` itself. Throws `PROVIDER_NOT_CONFIGURED` if this provider has no saved key. */
+    decryptKey(provider: ProviderName): Promise<string>;
+}
+export interface FileProviderConfigStoreOptions {
+    readonly dir: string;
+    /** `COGENTA_AUTH_SIGNING_KEY` — the encryption key is derived from it, never stored itself. */
+    readonly signingKey: string;
+    readonly now?: () => Date;
+}
+/** One `<provider>.json` record per configured provider, under `options.dir` — the same one-file-per-record shape every other file store in this package uses (R1: no external service). */
+export declare function createFileProviderConfigStore(options: FileProviderConfigStoreOptions): ProviderConfigStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/providers/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/providers/store.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAqEjD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,4HAA4H;IAC5H,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CACxC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;CACxC;AA+BD,MAAM,WAAW,mBAAmB;IAClC,IAAI,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAA;IAChD,GAAG,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACtE,wFAAwF;IACxF,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACjE,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IACnF;;;;;;;;;OASG;IACH,cAAc,CACZ,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACxC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACzC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAC/C,GACA,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,MAAM,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,yKAAyK;IACzK,UAAU,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACpD;AAqDD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAC1B;AAED,4LAA4L;AAC5L,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,mBAAmB,CAmMrB"}

package/dist/providers/store.js

@@ -0,0 +1,308 @@
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CogentaError } from '@cogenta/core';
+import { findProviderCatalogEntry } from './catalog.js';
+/**
+ * L22 task 1bis's "Providers" screen: which LLM providers this site has
+ * configured, each one's API key, and its default model — persisted so an
+ * operator can turn a provider on from the admin instead of only via
+ * `COGENTA_LLM_API_KEY`/`cogenta.config.mjs`'s single `llm` section
+ * (`@cogenta/core`'s `llmSchema`, unchanged and still the install-time
+ * default — `agents/orchestrator.ts` imports it as the first configured
+ * provider the first time this store is read, so an existing site loses
+ * nothing by upgrading).
+ *
+ * Fiche 56 widened `provider` from the closed 3-literal union to a free
+ * string (`registry.ts`'s `ProviderName`) so a catalog id (OpenRouter,
+ * DeepSeek, Qwen, GLM, …) or an operator-chosen custom id both fit. `upsert`
+ * is the write boundary that keeps this safe: `assertValidProviderId` rejects
+ * anything that is not a plain slug (this store builds a filename directly
+ * from `provider` — see `fileFor` — so a malformed id is a path-traversal
+ * risk, not merely an aesthetic one), and a name absent from the catalog
+ * must carry its own `baseUrl` or it could never resolve to a working client
+ * (`registry.ts`'s `buildClient` throws `PROVIDER_CUSTOM_BASE_URL_REQUIRED`
+ * for exactly that case — this store refuses the same shape earlier, at the
+ * point an operator can still fix it, rather than at first agent run).
+ *
+ * "Jamais affichée en clair une fois enregistrée" (the lot's own words, same
+ * discipline as `create-cogenta`'s masked key prompt) rules out storing the
+ * key as recoverable plaintext an API response could echo back — but an LLM
+ * call still needs the real key at request time, which rules out a one-way
+ * hash (`@cogenta/auth`'s `ApiKeyStore` model: fine for a bearer token this
+ * site itself verifies, useless for a key a *vendor* must see). This store
+ * therefore encrypts at rest (AES-256-GCM, `node:crypto`, zero new
+ * dependency — R9/R10) with a key derived from `COGENTA_AUTH_SIGNING_KEY`
+ * (the secret every real deployment already has, R7 — no second secret to
+ * generate, rotate or lose) via `scryptSync` with a purpose-specific salt,
+ * so the derived key is never the literal signing key reused across
+ * purposes. `list()`/`get()` return only a masked preview; the plaintext key
+ * is decrypted solely inside `resolveProviderRegistryConfig`, which the
+ * runtime hands straight to `createProviderRegistry` and never logs or
+ * returns over the wire (R7).
+ */
+/**
+ * A safe filename component and a reasonable admin-typed identifier: lower-
+ * case slug, 2-64 characters, no leading/trailing/doubled hyphen. Every
+ * catalog id in `catalog.ts` matches this by construction; the check exists
+ * for an operator-typed custom provider id.
+ */
+const PROVIDER_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+){0,10}$/u;
+function assertValidProviderId(provider) {
+    if (PROVIDER_ID_PATTERN.test(provider) && provider.length <= 64)
+        return;
+    throw new CogentaError({
+        code: 'PROVIDER_ID_INVALID',
+        message: `"${provider}" is not a valid provider id.`,
+        hint: 'Use lowercase letters, digits and single hyphens only (e.g. "openrouter", "my-vllm-server").',
+    });
+}
+/** A provider id the catalog does not know needs its own `baseUrl` — otherwise it could never resolve to a working client (see `registry.ts`'s `buildClient`). */
+function assertResolvable(provider, baseUrl) {
+    if (findProviderCatalogEntry(provider) !== undefined)
+        return;
+    if (baseUrl !== undefined && baseUrl.trim().length > 0)
+        return;
+    throw new CogentaError({
+        code: 'PROVIDER_CUSTOM_BASE_URL_REQUIRED',
+        message: `"${provider}" is not a built-in provider — a custom provider needs a non-empty "baseUrl".`,
+        hint: 'Add a baseUrl pointing at an OpenAI-compatible chat completions endpoint, or use a catalog provider id.',
+    });
+}
+/** Bounds wide enough for any real model/deployment, narrow enough to catch a typo (a negative, a zero, or a value nobody would deliberately set) before it reaches an HTTP request. */
+const TUNING_BOUNDS = {
+    maxOutputTokens: { min: 1, max: 200_000 },
+    requestTimeoutMs: { min: 1000, max: 600_000 },
+    maxCorrectionAttempts: { min: 1, max: 10 },
+};
+function assertValidTuning(input) {
+    for (const [field, bounds] of Object.entries(TUNING_BOUNDS)) {
+        const value = input[field];
+        if (value === undefined)
+            continue;
+        if (!Number.isInteger(value) || value < bounds.min || value > bounds.max) {
+            throw new CogentaError({
+                code: 'PROVIDER_TUNING_INVALID',
+                message: `"${field}" must be a whole number between ${bounds.min} and ${bounds.max}.`,
+                hint: 'Leave it empty to use the built-in default for this field.',
+            });
+        }
+    }
+}
+const KEY_DERIVATION_SALT = 'cogenta-provider-secrets-v1';
+const ALGORITHM = 'aes-256-gcm';
+function deriveKey(signingKey) {
+    return scryptSync(signingKey, KEY_DERIVATION_SALT, 32);
+}
+function mask(apiKey) {
+    const tail = apiKey.slice(-4);
+    return tail.length === 0 ? '••••' : `••••${tail}`;
+}
+function providerNotConfigured(provider) {
+    return new CogentaError({
+        code: 'PROVIDER_NOT_CONFIGURED',
+        message: `No API key is saved for "${provider}".`,
+        hint: 'Configure it from the admin\'s "Providers" screen first.',
+    });
+}
+function toSummary(record) {
+    return {
+        provider: record.provider,
+        enabled: record.enabled,
+        model: record.model,
+        ...(record.baseUrl === undefined ? {} : { baseUrl: record.baseUrl }),
+        maskedKey: record.maskedKey,
+        updatedAt: record.updatedAt,
+        ...(record.maxOutputTokens === undefined ? {} : { maxOutputTokens: record.maxOutputTokens }),
+        ...(record.requestTimeoutMs === undefined ? {} : { requestTimeoutMs: record.requestTimeoutMs }),
+        ...(record.maxCorrectionAttempts === undefined
+            ? {}
+            : { maxCorrectionAttempts: record.maxCorrectionAttempts }),
+    };
+}
+/** One `<provider>.json` record per configured provider, under `options.dir` — the same one-file-per-record shape every other file store in this package uses (R1: no external service). */
+export function createFileProviderConfigStore(options) {
+    const now = options.now ?? (() => new Date());
+    const key = deriveKey(options.signingKey);
+    const ready = mkdir(options.dir, { recursive: true });
+    /**
+     * The one place every method that touches disk builds a path from
+     * `provider` — validating here, rather than only in `upsert`, is what
+     * closes the path-traversal gap `PATCH`/`DELETE /api/providers/:provider`
+     * would otherwise reopen: the router no longer allowlists `provider`
+     * against a fixed name list before calling `setEnabled`/`updateSettings`/
+     * `remove` (fiche 56 removed that gate to admit catalog and custom ids),
+     * so this store is the only remaining checkpoint before an attacker-
+     * controlled string like `../../agents/some-agent` reaches `readFile`/
+     * `writeFile`/`rm`. A caller of `get`/`decryptKey` on a malformed id gets
+     * the same `PROVIDER_ID_INVALID` an `upsert` would — never a silent
+     * "not found" that would let the check be bypassed by relying on ENOENT.
+     */
+    function fileFor(provider) {
+        assertValidProviderId(provider);
+        return join(options.dir, `${provider}.json`);
+    }
+    function encrypt(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv(ALGORITHM, key, iv);
+        const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        return {
+            iv: iv.toString('base64'),
+            authTag: cipher.getAuthTag().toString('base64'),
+            ciphertext: ciphertext.toString('base64'),
+        };
+    }
+    function decrypt(record) {
+        const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(record.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(record.authTag, 'base64'));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(record.ciphertext, 'base64')),
+            decipher.final(),
+        ]);
+        return plaintext.toString('utf8');
+    }
+    async function readRecord(provider) {
+        // `fileFor` (which validates `provider`) is called outside the try
+        // block on purpose: a `PROVIDER_ID_INVALID` it throws must propagate as
+        // itself, never be caught below and rewritten into a misleading
+        // "the file may be corrupted" `INTERNAL` error.
+        const path = fileFor(provider);
+        try {
+            const raw = await readFile(path, 'utf8');
+            return JSON.parse(raw);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw new CogentaError({
+                code: 'INTERNAL',
+                message: `Could not read the saved configuration for provider "${provider}".`,
+                hint: 'The file may be corrupted; consider removing it and reconfiguring the provider.',
+                cause: error,
+            });
+        }
+    }
+    return {
+        async list() {
+            await ready;
+            const filenames = await readdir(options.dir).catch(() => []);
+            const records = [];
+            for (const filename of filenames) {
+                if (!filename.endsWith('.json'))
+                    continue;
+                const provider = filename.replace(/\.json$/u, '');
+                if (!PROVIDER_ID_PATTERN.test(provider))
+                    continue;
+                const record = await readRecord(provider);
+                if (record !== null)
+                    records.push(toSummary(record));
+            }
+            return records.sort((a, b) => a.provider.localeCompare(b.provider));
+        },
+        async get(provider) {
+            await ready;
+            const record = await readRecord(provider);
+            return record === null ? undefined : toSummary(record);
+        },
+        async upsert(input) {
+            await ready;
+            assertValidProviderId(input.provider);
+            assertResolvable(input.provider, input.baseUrl);
+            assertValidTuning(input);
+            const { iv, authTag, ciphertext } = encrypt(input.apiKey);
+            const record = {
+                provider: input.provider,
+                enabled: input.enabled ?? true,
+                model: input.model,
+                ...(input.baseUrl === undefined ? {} : { baseUrl: input.baseUrl }),
+                maskedKey: mask(input.apiKey),
+                iv,
+                authTag,
+                ciphertext,
+                updatedAt: now().toISOString(),
+                ...(input.maxOutputTokens === undefined ? {} : { maxOutputTokens: input.maxOutputTokens }),
+                ...(input.requestTimeoutMs === undefined
+                    ? {}
+                    : { requestTimeoutMs: input.requestTimeoutMs }),
+                ...(input.maxCorrectionAttempts === undefined
+                    ? {}
+                    : { maxCorrectionAttempts: input.maxCorrectionAttempts }),
+            };
+            await writeFile(fileFor(input.provider), JSON.stringify(record, null, 2), 'utf8');
+            return toSummary(record);
+        },
+        async setEnabled(provider, enabled) {
+            await ready;
+            const existing = await readRecord(provider);
+            if (existing === null)
+                throw providerNotConfigured(provider);
+            const updated = { ...existing, enabled, updatedAt: now().toISOString() };
+            await writeFile(fileFor(provider), JSON.stringify(updated, null, 2), 'utf8');
+            return toSummary(updated);
+        },
+        async remove(provider) {
+            await ready;
+            await rm(fileFor(provider), { force: true });
+        },
+        async updateSettings(provider, patch) {
+            await ready;
+            const existing = await readRecord(provider);
+            if (existing === null)
+                throw providerNotConfigured(provider);
+            const nextBaseUrl = patch.baseUrl !== undefined
+                ? patch.baseUrl
+                : existing.baseUrl === undefined
+                    ? undefined
+                    : existing.baseUrl;
+            assertResolvable(provider, nextBaseUrl);
+            assertValidTuning({
+                ...(patch.maxOutputTokens === undefined || patch.maxOutputTokens === null
+                    ? {}
+                    : { maxOutputTokens: patch.maxOutputTokens }),
+                ...(patch.requestTimeoutMs === undefined || patch.requestTimeoutMs === null
+                    ? {}
+                    : { requestTimeoutMs: patch.requestTimeoutMs }),
+                ...(patch.maxCorrectionAttempts === undefined || patch.maxCorrectionAttempts === null
+                    ? {}
+                    : { maxCorrectionAttempts: patch.maxCorrectionAttempts }),
+            });
+            // `null` clears a tuning field back to "use the built-in default";
+            // `undefined` leaves it exactly as saved — the reason this can't just
+            // be `patch.x ?? existing.x` the way `model` above is. Starting from
+            // `existing` stripped of all three (rather than the full record) and
+            // re-adding only what survives is what lets a `null` actually delete
+            // the key instead of merely being overwritten back to its old value.
+            const { maxOutputTokens: _existingMaxOutputTokens, requestTimeoutMs: _existingRequestTimeoutMs, maxCorrectionAttempts: _existingMaxCorrectionAttempts, ...existingWithoutTuning } = existing;
+            const nextMaxOutputTokens = patch.maxOutputTokens === undefined
+                ? existing.maxOutputTokens
+                : (patch.maxOutputTokens ?? undefined);
+            const nextRequestTimeoutMs = patch.requestTimeoutMs === undefined
+                ? existing.requestTimeoutMs
+                : (patch.requestTimeoutMs ?? undefined);
+            const nextMaxCorrectionAttempts = patch.maxCorrectionAttempts === undefined
+                ? existing.maxCorrectionAttempts
+                : (patch.maxCorrectionAttempts ?? undefined);
+            const updated = {
+                ...existingWithoutTuning,
+                model: patch.model ?? existing.model,
+                ...(nextBaseUrl === undefined ? {} : { baseUrl: nextBaseUrl }),
+                updatedAt: now().toISOString(),
+                ...(nextMaxOutputTokens === undefined ? {} : { maxOutputTokens: nextMaxOutputTokens }),
+                ...(nextRequestTimeoutMs === undefined ? {} : { requestTimeoutMs: nextRequestTimeoutMs }),
+                ...(nextMaxCorrectionAttempts === undefined
+                    ? {}
+                    : { maxCorrectionAttempts: nextMaxCorrectionAttempts }),
+            };
+            await writeFile(fileFor(provider), JSON.stringify(updated, null, 2), 'utf8');
+            return toSummary(updated);
+        },
+        async decryptKey(provider) {
+            await ready;
+            const record = await readRecord(provider);
+            if (record === null)
+                throw providerNotConfigured(provider);
+            return decrypt(record);
+        },
+    };
+}
+//# sourceMappingURL=store.js.map

package/dist/providers/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/providers/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAGvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,kCAAkC,CAAA;AAE9D,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE;QAAE,OAAM;IACvE,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,IAAI,QAAQ,+BAA+B;QACpD,IAAI,EAAE,8FAA8F;KACrG,CAAC,CAAA;AACJ,CAAC;AAED,kKAAkK;AAClK,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAA2B;IACrE,IAAI,wBAAwB,CAAC,QAAQ,CAAC,KAAK,SAAS;QAAE,OAAM;IAC5D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAM;IAC9D,MAAM,IAAI,YAAY,CAAC;QACrB,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,IAAI,QAAQ,+EAA+E;QACpG,IAAI,EAAE,yGAAyG;KAChH,CAAC,CAAA;AACJ,CAAC;AAqCD,wLAAwL;AACxL,MAAM,aAAa,GAAG;IACpB,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE;IACzC,gBAAgB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE;IAC7C,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;CAClC,CAAA;AAEV,SAAS,iBAAiB,CACxB,KAGC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAGvD,EAAE,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YACzE,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,IAAI,KAAK,oCAAoC,MAAM,CAAC,GAAG,QAAQ,MAAM,CAAC,GAAG,GAAG;gBACrF,IAAI,EAAE,4DAA4D;aACnE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAgDD,MAAM,mBAAmB,GAAG,6BAA6B,CAAA;AACzD,MAAM,SAAS,GAAG,aAAa,CAAA;AAE/B,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,UAAU,CAAC,UAAU,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAA;AACnD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAsB;IACnD,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,4BAA4B,QAAQ,IAAI;QACjD,IAAI,EAAE,0DAA0D;KACjE,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAuB;IACxC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACpE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5F,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC/F,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC;KAC7D,CAAA;AACH,CAAC;AASD,4LAA4L;AAC5L,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD;;;;;;;;;;;;OAYG;IACH,SAAS,OAAO,CAAC,QAAsB;QACrC,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED,SAAS,OAAO,CAAC,SAAiB;QAChC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAA;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACpF,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC1C,CAAA;IACH,CAAC;IAED,SAAS,OAAO,CAAC,MAAuB;QACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAA;QACnF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC1D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACzD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAA;QACF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,QAAsB;QAC9C,mEAAmE;QACnE,wEAAwE;QACxE,gEAAgE;QAChE,gDAAgD;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YACxC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAA;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YACnE,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,wDAAwD,QAAQ,IAAI;gBAC7E,IAAI,EAAE,iFAAiF;gBACvF,KAAK,EAAE,KAAK;aACb,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,KAAK,CAAA;YACX,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YAC5D,MAAM,OAAO,GAA2B,EAAE,CAAA;YAC1C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,SAAQ;gBACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAiB,CAAA;gBACjE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;gBACzC,IAAI,MAAM,KAAK,IAAI;oBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QACrE,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,QAAQ;YAChB,MAAM,KAAK,CAAA;YACX,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;YACzC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACxD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,KAAK,CAAA;YACX,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YACrC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;YAC/C,iBAAiB,CAAC,KAAK,CAAC,CAAA;YACxB,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACzD,MAAM,MAAM,GAAoB;gBAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC7B,EAAE;gBACF,OAAO;gBACP,UAAU;gBACV,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;gBAC9B,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1F,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;oBAC3C,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC;aAC5D,CAAA;YACD,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YACjF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;QAC1B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO;YAChC,MAAM,KAAK,CAAA;YACX,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;YAC3C,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,OAAO,GAAoB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;YACzF,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC5E,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,QAAQ;YACnB,MAAM,KAAK,CAAA;YACX,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK;YAClC,MAAM,KAAK,CAAA;YACX,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;YAC3C,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;YAC5D,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,KAAK,SAAS;gBACzB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;oBAC9B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAA;YACxB,gBAAgB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;YACvC,iBAAiB,CAAC;gBAChB,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;oBACvE,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;oBACzE,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,IAAI;oBACnF,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC;aAC5D,CAAC,CAAA;YACF,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,EACJ,eAAe,EAAE,wBAAwB,EACzC,gBAAgB,EAAE,yBAAyB,EAC3C,qBAAqB,EAAE,8BAA8B,EACrD,GAAG,qBAAqB,EACzB,GAAG,QAAQ,CAAA;YACZ,MAAM,mBAAmB,GACvB,KAAK,CAAC,eAAe,KAAK,SAAS;gBACjC,CAAC,CAAC,QAAQ,CAAC,eAAe;gBAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,SAAS,CAAC,CAAA;YAC1C,MAAM,oBAAoB,GACxB,KAAK,CAAC,gBAAgB,KAAK,SAAS;gBAClC,CAAC,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAA;YAC3C,MAAM,yBAAyB,GAC7B,KAAK,CAAC,qBAAqB,KAAK,SAAS;gBACvC,CAAC,CAAC,QAAQ,CAAC,qBAAqB;gBAChC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,IAAI,SAAS,CAAC,CAAA;YAChD,MAAM,OAAO,GAAoB;gBAC/B,GAAG,qBAAqB;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;gBACpC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;gBAC9D,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;gBAC9B,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC;gBACtF,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;gBACzF,GAAG,CAAC,yBAAyB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,CAAC;aAC1D,CAAA;YACD,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC5E,OAAO,SAAS,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,QAAQ;YACvB,MAAM,KAAK,CAAA;YACX,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;YACzC,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;YAC1D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAA;QACxB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/providers/tool-names.d.ts

@@ -0,0 +1,9 @@
+import type { ChatRequest } from './types.js';
+export declare function encodeToolName(name: string): string;
+/**
+ * The decoder for one request. Throws when two distinct tool names would
+ * collide on the wire (`a.b` next to `a__b`) — a misconfiguration worth a
+ * loud error, never a silently wrong tool.
+ */
+export declare function createToolNameDecoder(request: ChatRequest): (wire: string) => string;
+//# sourceMappingURL=tool-names.d.ts.map

package/dist/providers/tool-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-names.d.ts","sourceRoot":"","sources":["../../src/providers/tool-names.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA4B7C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAmBpF"}

package/dist/providers/tool-names.js

@@ -0,0 +1,56 @@
+import { CogentaError } from '@cogenta/core';
+/**
+ * Contract C names its tools with a dot (`content.read`, `redirects.create`,
+ * `code.propose_patch`); every vendor wire format refuses that character in
+ * a function name — OpenAI-compatible endpoints (OpenAI, DeepSeek, Qwen,
+ * OpenRouter…) and Anthropic both enforce `^[a-zA-Z0-9_-]+$`, and Gemini
+ * has its own narrower rules. Found live: DeepSeek answered every agent run
+ * with `400 Invalid 'tools[0].function.name': string does not match
+ * pattern` before the request ever reached a model, and nothing in the
+ * catalog could have worked with a single tool declared.
+ *
+ * The fix lives here rather than in the tool names themselves: contract C
+ * is frozen, and a dot is the right separator for humans, the audit log
+ * and the permission taxonomy. Each adapter encodes on the way out and
+ * decodes on the way back, so no other layer ever sees a wire name.
+ *
+ * Encoding is deterministic (`.` and anything else outside the safe set →
+ * `__`), which is what lets an assistant message from earlier in the
+ * conversation — one that echoes a previous tool call by name — be encoded
+ * without any state. Decoding needs the reverse map, built from the request
+ * itself; a wire name the map does not know (a model inventing a tool) is
+ * returned unchanged, and the runtime's own registry refuses it downstream
+ * exactly as it would have before.
+ */
+const UNSAFE = /[^a-zA-Z0-9_-]/gu;
+export function encodeToolName(name) {
+    return name.replace(UNSAFE, '__');
+}
+/**
+ * The decoder for one request. Throws when two distinct tool names would
+ * collide on the wire (`a.b` next to `a__b`) — a misconfiguration worth a
+ * loud error, never a silently wrong tool.
+ */
+export function createToolNameDecoder(request) {
+    const byWire = new Map();
+    const register = (name) => {
+        const wire = encodeToolName(name);
+        const existing = byWire.get(wire);
+        if (existing !== undefined && existing !== name) {
+            throw new CogentaError({
+                code: 'PROVIDER_REQUEST_FAILED',
+                message: `Tool names "${existing}" and "${name}" are indistinguishable once encoded for the provider ("${wire}").`,
+                hint: 'Rename one of the two tools so they differ by more than characters the wire format refuses.',
+            });
+        }
+        byWire.set(wire, name);
+    };
+    for (const tool of request.tools ?? [])
+        register(tool.name);
+    for (const message of request.messages) {
+        for (const call of message.toolCalls ?? [])
+            register(call.name);
+    }
+    return (wire) => byWire.get(wire) ?? wire;
+}
+//# sourceMappingURL=tool-names.js.map

package/dist/providers/tool-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-names.js","sourceRoot":"","sources":["../../src/providers/tool-names.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAG5C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,GAAG,kBAAkB,CAAA;AAEjC,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAoB;IACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAQ,EAAE;QACtC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,eAAe,QAAQ,UAAU,IAAI,2DAA2D,IAAI,KAAK;gBAClH,IAAI,EAAE,6FAA6F;aACpG,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACxB,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3D,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AAC3C,CAAC"}