@gaunt-sloth/core 2.0.0-beta.2 → 2.0.0-beta.3

package/dist/utils/vertexaiUtils.js

@@ -1,3 +1,4 @@
+import { env } from '#src/utils/systemUtils.js';
 export function isVertexGoogleLlm(llm) {
     if (!llm || typeof llm !== 'object') {
         return false;
@@ -70,12 +71,110 @@ const VERTEX_AUTH_GUIDANCE = {
         'Check the one this session is configured for — a Google AI Studio key is not valid for ' +
         'Vertex AI endpoints.',
 };
+/**
+ * The longest value still treated as a filesystem path. 260 is Windows' classic `MAX_PATH`, which is
+ * a defensible ceiling for a path and sits an order of magnitude below any credential: the deepest
+ * realistic ADC path — a CI runner's temp directory plus
+ * `application_default_credentials.json` — is around 120 characters, while a service-account key is
+ * ~1700 as JSON and ~2300 base64-encoded. Nothing has to land in the gap for the test to be useful.
+ */
+const MAX_CREDENTIAL_PATH_LENGTH = 260;
+/**
+ * Whether a value is the credential ITSELF rather than a path to one.
+ *
+ * Deliberately tested by SIZE first rather than by shape. The shape test alone (`{`) catches a
+ * pasted JSON key and misses the base64 form that CI secret stores hand out, and widening it one
+ * encoding at a time only ever covers the last spelling somebody thought of — the value is
+ * attacker-irrelevant but user-supplied and its formats are open-ended. Length closes the class
+ * because every credential is enormous next to every path. The shape test is kept alongside it for
+ * the short, hand-trimmed JSON that a size test alone would let through.
+ */
+function isCredentialContent(value) {
+    return value.length > MAX_CREDENTIAL_PATH_LENGTH || value.trimStart().startsWith('{');
+}
+/**
+ * Where an ADC session's credentials are being read from when an environment variable names a file,
+ * and the spelling of the variable that named it — `undefined` when no such variable is in play.
+ *
+ * THIS IS THE ONE ENVIRONMENT READ IN THIS FILE AND IT IS DELIBERATE, so read it against the
+ * comment on {@link vertexAuthMode} rather than as a contradiction of it. That function decides
+ * WHICH credential is in use and must keep doing so from the constructed client alone. This one
+ * decides nothing: the session has already been classified as ADC from the client, and the
+ * environment is consulted only to compose the DIAGNOSTIC SENTENCE for it. Read-only, through the
+ * `systemUtils` accessor like every other environment read in this package.
+ *
+ * It is not client-derived because there is nothing client-derived to be had. Measured on
+ * google-auth-library 10.9.1: `GoogleAuth.keyFilename` is populated only from constructor options,
+ * so on a Vertex client it is `undefined` both with and without the variable set, and stays
+ * `undefined` after a resolution attempt. The only artifact a successful resolution leaves behind is
+ * `jsonContent` — the parsed key file, which holds the private key and must never be printed.
+ *
+ * Mirrors `googleauth.js` rather than reinventing it: both spellings, upper case first, and an empty
+ * value falls through to the well-known file instead of counting as set.
+ */
+function adcCredentialFileFromEnvironment() {
+    for (const variable of ['GOOGLE_APPLICATION_CREDENTIALS', 'google_application_credentials']) {
+        const path = env[variable];
+        if (!path) {
+            continue;
+        }
+        // First non-empty wins, exactly as the library's `||` does — so a value that is credential
+        // CONTENT rather than a path ends the search rather than falling through to the other spelling.
+        //
+        // Pasting the service-account key into the variable instead of writing it to a file is a common
+        // CI misconfiguration, and such a session must NOT be described below. There is no file for the
+        // message to point at, so naming one would be exactly the kind of claim-that-does-not-hold this
+        // hint exists to avoid; and the value is a private key, while this message also reaches the log
+        // stream and debug dumps. It falls back to the pinned `adc` sentence, which asserts nothing
+        // about where the credentials came from.
+        return isCredentialContent(path) ? undefined : { variable, path };
+    }
+    return undefined;
+}
+/**
+ * The remedy for an ADC session whose credentials come from a file named in the environment.
+ *
+ * The diagnosis is the same as the plain `adc` one and is CORRECT — this really is ADC. What
+ * differs is that the plain remedy is inert here: `google-auth-library` resolves this variable
+ * before it reads the well-known file, so `gcloud auth application-default login` writes a file
+ * this session never opens, reports success, and leaves the failure exactly where it was. Naming
+ * the command anyway is the point — the reader has usually just run it.
+ */
+function adcFromEnvironmentGuidance(variable, path) {
+    return ('This session authenticates through Application Default Credentials, and those credentials ' +
+        'come from `' +
+        variable +
+        '` in your environment, which points at `' +
+        path +
+        '`. That variable is resolved BEFORE the well-known credentials file, so ' +
+        '`gcloud auth application-default login` writes a file this session never reads and the ' +
+        'failure survives it. Repair or replace the credentials in the file above, or unset ' +
+        '`' +
+        variable +
+        '` so the well-known Application Default Credentials file is used instead. ' +
+        'No API key is in use — a `type: vertexai` config ignores any `GOOGLE_API_KEY` in your ' +
+        'environment, so unsetting that will not help here.');
+}
+/**
+ * The sentence for a classified session. Only the ADC branch is refined further, and only into the
+ * one sub-case whose remedy would otherwise be inert; every other mode returns its pinned string
+ * unchanged.
+ */
+function vertexAuthGuidance(mode) {
+    if (mode === 'adc') {
+        const fromEnvironment = adcCredentialFileFromEnvironment();
+        if (fromEnvironment) {
+            return adcFromEnvironmentGuidance(fromEnvironment.variable, fromEnvironment.path);
+        }
+    }
+    return VERTEX_AUTH_GUIDANCE[mode];
+}
 export function enhanceVertexUnauthorizedMessage(originalMessage, llm) {
     if (!isVertexGoogleLlm(llm) || !VERTEX_AUTH_ERROR_PATTERN.test(originalMessage)) {
         return originalMessage;
     }
     return (`${originalMessage}\n\n` +
         'Vertex AI authentication failed. ' +
-        `${VERTEX_AUTH_GUIDANCE[vertexAuthMode(llm)]}\n`);
+        `${vertexAuthGuidance(vertexAuthMode(llm))}\n`);
 }
 //# sourceMappingURL=vertexaiUtils.js.map

package/dist/utils/vertexaiUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"vertexaiUtils.js","sourceRoot":"","sources":["../../src/utils/vertexaiUtils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAA6B,CAAC;IAC5C,OAAO,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,gEAAgE;AAChE,gFAAgF;AAChF,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,4DAA4D,CAAC;AAY/F;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GACV,GAGD,EAAE,SAAS,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAmC;IAC3D,MAAM,EACJ,oFAAoF;QACpF,wEAAwE;QACxE,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,6CAA6C;IAC/C,cAAc,EACZ,6FAA6F;QAC7F,6FAA6F;QAC7F,4DAA4D;QAC5D,6FAA6F;QAC7F,eAAe;IACjB,GAAG,EACD,8FAA8F;QAC9F,+CAA+C;QAC/C,wFAAwF;QACxF,oDAAoD;IACtD,OAAO,EACL,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,sBAAsB;CACzB,CAAC;AAEF,MAAM,UAAU,gCAAgC,CAAC,eAAuB,EAAE,GAAY;IACpF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChF,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CACL,GAAG,eAAe,MAAM;QACxB,mCAAmC;QACnC,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vertexaiUtils.js","sourceRoot":"","sources":["../../src/utils/vertexaiUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAEhD,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAA6B,CAAC;IAC5C,OAAO,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,gEAAgE;AAChE,gFAAgF;AAChF,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,4DAA4D,CAAC;AAY/F;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GACV,GAGD,EAAE,SAAS,CAAC;QACb,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAmC;IAC3D,MAAM,EACJ,oFAAoF;QACpF,wEAAwE;QACxE,4FAA4F;QAC5F,0FAA0F;QAC1F,4FAA4F;QAC5F,6CAA6C;IAC/C,cAAc,EACZ,6FAA6F;QAC7F,6FAA6F;QAC7F,4DAA4D;QAC5D,6FAA6F;QAC7F,eAAe;IACjB,GAAG,EACD,8FAA8F;QAC9F,+CAA+C;QAC/C,wFAAwF;QACxF,oDAAoD;IACtD,OAAO,EACL,8FAA8F;QAC9F,6FAA6F;QAC7F,yFAAyF;QACzF,yFAAyF;QACzF,sBAAsB;CACzB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,MAAM,GAAG,0BAA0B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,gCAAgC;IACvC,KAAK,MAAM,QAAQ,IAAI,CAAC,gCAAgC,EAAE,gCAAgC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,2FAA2F;QAC3F,gGAAgG;QAChG,EAAE;QACF,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,gGAAgG;QAChG,4FAA4F;QAC5F,yCAAyC;QACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CAAC,QAAgB,EAAE,IAAY;IAChE,OAAO,CACL,4FAA4F;QAC5F,aAAa;QACb,QAAQ;QACR,0CAA0C;QAC1C,IAAI;QACJ,0EAA0E;QAC1E,yFAAyF;QACzF,qFAAqF;QACrF,GAAG;QACH,QAAQ;QACR,4EAA4E;QAC5E,wFAAwF;QACxF,oDAAoD,CACrD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAoB;IAC9C,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,eAAe,GAAG,gCAAgC,EAAE,CAAC;QAC3D,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,0BAA0B,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,eAAuB,EAAE,GAAY;IACpF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QAChF,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,OAAO,CACL,GAAG,eAAe,MAAM;QACxB,mCAAmC;QACnC,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAC/C,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gaunt-sloth/core",
-  "version": "2.0.0-beta.2",
+  "version": "2.0.0-beta.3",
   "description": "Core utilities and types for Gaunt Sloth",
   "license": "MIT",
   "author": "Andrew Kondratev",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@langchain/core": "^1.2.9",
-    "@langchain/langgraph": "^1.4.12",
+    "@langchain/langgraph": "^1.4.13",
     "jiti": "^2.7.0",
     "jsonc-parser": "^3.3.1",
     "langchain": "^1.5.10",
@@ -89,6 +89,7 @@
   "scripts": {
     "build": "tsc",
     "schema:generate": "node scripts/generate-config-schema.mjs",
-    "surface:generate": "node scripts/generate-type-surface.mjs"
+    "surface:generate": "node scripts/generate-type-surface.mjs",
+    "value-surface:generate": "node scripts/generate-value-surface.mjs"
   }
 }