@hasna/switcher 0.1.3 → 0.1.5

package/dist/credentials.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { type CredentialChainOptions } from "@hasna/contracts/client";
 import { CommandInterrupted, type ProviderInput } from "./domain";
 declare const keychain: z.ZodObject<{
     kind: z.ZodLiteral<"keychain">;
@@ -13,7 +14,7 @@ declare const keychain: z.ZodObject<{
     service: string;
     account: string;
 }>;
-export declare const credentialBindingSchema: z.ZodObject<{
+export declare const credentialBindingSchema: z.ZodEffects<z.ZodObject<{
     schema: z.ZodLiteral<1>;
     credentialEnv: z.ZodString;
     origins: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
@@ -32,9 +33,15 @@ export declare const credentialBindingSchema: z.ZodObject<{
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"vault">;
         key: z.ZodString;
-        url: z.ZodEffects<z.ZodString, string, string>;
+        url: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         executable: z.ZodEffects<z.ZodString, string, string>;
         operator: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"contracts">;
+        }, "strict", z.ZodTypeAny, {
+            kind: "contracts";
+        }, {
+            kind: "contracts";
+        }>, z.ZodObject<{
             kind: z.ZodLiteral<"env">;
         }, "strict", z.ZodTypeAny, {
             kind: "env";
@@ -42,7 +49,7 @@ export declare const credentialBindingSchema: z.ZodObject<{
             kind: "env";
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"keychain">;
-            account: z.ZodString;
+            account: z.ZodEffects<z.ZodString, string, string>;
         }, "strict", z.ZodTypeAny, {
             kind: "keychain";
             account: string;
@@ -51,27 +58,31 @@ export declare const credentialBindingSchema: z.ZodObject<{
             account: string;
         }>]>;
     }, "strict", z.ZodTypeAny, {
-        url: string;
         key: string;
         executable: string;
         kind: "vault";
         operator: {
+            kind: "contracts";
+        } | {
             kind: "env";
         } | {
             kind: "keychain";
             account: string;
         };
+        url?: string | undefined;
     }, {
-        url: string;
         key: string;
         executable: string;
         kind: "vault";
         operator: {
+            kind: "contracts";
+        } | {
             kind: "env";
         } | {
             kind: "keychain";
             account: string;
         };
+        url?: string | undefined;
     }>]>;
 }, "strict", z.ZodTypeAny, {
     credentialEnv: string;
@@ -80,16 +91,18 @@ export declare const credentialBindingSchema: z.ZodObject<{
         service: string;
         account: string;
     } | {
-        url: string;
         key: string;
         executable: string;
         kind: "vault";
         operator: {
+            kind: "contracts";
+        } | {
             kind: "env";
         } | {
             kind: "keychain";
             account: string;
         };
+        url?: string | undefined;
     };
     schema: 1;
     origins: string[];
@@ -100,16 +113,62 @@ export declare const credentialBindingSchema: z.ZodObject<{
         service: string;
         account: string;
     } | {
-        url: string;
         key: string;
         executable: string;
         kind: "vault";
         operator: {
+            kind: "contracts";
+        } | {
             kind: "env";
         } | {
             kind: "keychain";
             account: string;
         };
+        url?: string | undefined;
+    };
+    schema: 1;
+    origins: string[];
+}>, {
+    credentialEnv: string;
+    source: {
+        kind: "keychain";
+        service: string;
+        account: string;
+    } | {
+        key: string;
+        executable: string;
+        kind: "vault";
+        operator: {
+            kind: "contracts";
+        } | {
+            kind: "env";
+        } | {
+            kind: "keychain";
+            account: string;
+        };
+        url?: string | undefined;
+    };
+    schema: 1;
+    origins: string[];
+}, {
+    credentialEnv: string;
+    source: {
+        kind: "keychain";
+        service: string;
+        account: string;
+    } | {
+        key: string;
+        executable: string;
+        kind: "vault";
+        operator: {
+            kind: "contracts";
+        } | {
+            kind: "env";
+        } | {
+            kind: "keychain";
+            account: string;
+        };
+        url?: string | undefined;
     };
     schema: 1;
     origins: string[];
@@ -130,16 +189,18 @@ export declare class CredentialBindings {
             service: string;
             account: string;
         } | {
-            url: string;
             key: string;
             executable: string;
             kind: "vault";
             operator: {
+                kind: "contracts";
+            } | {
                 kind: "env";
             } | {
                 kind: "keychain";
                 account: string;
             };
+            url?: string | undefined;
         };
         schema: 1;
         origins: string[];
@@ -173,6 +234,8 @@ export declare class CredentialResolver {
 export declare class CredentialInterrupted extends CommandInterrupted {
     constructor(exitCode: number);
 }
+/** Select an operator through the shared credential seam, then pin that choice. */
+export declare function vaultEnvironment(binding: CredentialBinding, env: NodeJS.ProcessEnv, options?: Pick<CredentialChainOptions, "keychain">): Promise<NodeJS.ProcessEnv>;
 /** Internal child mode: the key travels only through an authenticated loopback request. */
 export declare function deliverVaultCredential(): Promise<void>;
 export {};

package/dist/domain.d.ts

@@ -3,7 +3,7 @@ import { type RoutingEvent } from "./model-policy-schema";
 export { modelPolicySchema, routingEventSchema, routingEventsSchema } from "./model-policy-schema";
 export type { ModelPolicy, RoutingEvent } from "./model-policy-schema";
 export type { AuthStyle } from "./auth";
-export declare const VERSION = "0.1.3";
+export declare const VERSION = "0.1.5";
 export declare const harnessSchema: z.ZodEnum<["claude", "codex", "grok", "opencode", "opencode2", "pi", "omp", "dsh", "cline", "hermes", "prime-agent", "gemini", "aider", "kilo"]>;
 export declare const protocolSchema: z.ZodEnum<["anthropic-messages", "openai-responses", "openai-chat", "gemini-generate-content"]>;
 export declare const idSchema: z.ZodString;

package/dist/index.js

@@ -200,7 +200,7 @@ async function boundedJson(response, maxBytes = MAX_BYTES) {
 }
 
 // src/sdk.ts
-import { resolveCredential } from "@hasna/contracts/client";
+import { createClientTransport } from "@hasna/contracts/client";
 
 // src/presets.ts
 var route = (protocol, baseUrl, options = {}) => ({
@@ -361,6 +361,7 @@ function apiError(status, data, apiKey) {
 
 class SwitcherClient {
   options;
+  transport;
   baseUrl;
   constructor(options) {
     this.baseUrl = endpoint(options.baseUrl).replace(/\/v1$/, "");
@@ -368,9 +369,50 @@ class SwitcherClient {
       throw new Error("Switcher API key is required.");
     this.options = { ...options };
   }
+  static fromEnvironment(env = process.env, options = {}) {
+    const shared = createClientTransport("switcher", env, {
+      credentials: options.credentials,
+      timeoutMs: options.timeoutMs ?? 120000,
+      retry: false,
+      fetchImpl: async (input, init) => {
+        const address = String(input).replace(/\/v1\/(health|ready|version)$/, "/$1");
+        const key = new Headers(init?.headers).get("x-api-key") ?? "";
+        let response;
+        try {
+          response = await (options.fetch ?? fetch)(address, init);
+        } catch {
+          throw new SwitcherError(0, "connection_failed", "Switcher API request failed; check endpoint and service availability.");
+        }
+        if (response.status === 401 || response.status === 403) {
+          await response.body?.cancel().catch(() => {});
+          throw new SwitcherError(response.status, "api_error", `Switcher API returned HTTP ${response.status}. Check the configured credential; no alternate identity was selected.`);
+        }
+        let data;
+        try {
+          data = await boundedJson(response);
+        } catch {
+          throw new SwitcherError(response.status, "invalid_response", "Switcher API returned invalid JSON.");
+        }
+        if (!response.ok)
+          throw apiError(response.status, data, key);
+        return Response.json(data);
+      }
+    });
+    const client = new SwitcherClient({ baseUrl: shared.resolution.baseUrl, apiKey: () => {
+      throw new Error("Shared credential transport was not invoked.");
+    } });
+    client.transport = shared.client;
+    return client;
+  }
   async request(method, path, body, options = {}) {
     if (!/^\/v1\/[a-zA-Z0-9/?&=._%+-]+$/.test(path) && !["/health", "/ready", "/version"].includes(path) || path.includes(".."))
       throw new Error("Invalid API path.");
+    if (this.transport)
+      return this.transport.request(method, path.startsWith("/v1/") ? path.slice(3) : path, body, {
+        idempotencyKey: method === "GET" ? undefined : options.idempotencyKey ?? crypto.randomUUID(),
+        headers: options.version === undefined ? undefined : { "if-match": String(options.version) },
+        retry: false
+      });
     const apiKey = typeof this.options.apiKey === "function" ? this.options.apiKey() : this.options.apiKey;
     if (!apiKey || /[\r\n]/.test(apiKey))
       throw new Error("Switcher API key is required.");
@@ -467,11 +509,8 @@ class SwitcherClient {
     return this.request("PATCH", `/v1/runs/${encodeURIComponent(id)}`, input, { version, idempotencyKey });
   }
 }
-function clientFromEnv(env = process.env) {
-  const credential = () => resolveCredential("switcher", Object.fromEntries(Object.entries(env).filter(([name]) => name === "HASNA_SWITCHER_API_KEY")), { keychain: { enabled: false } })?.apiKey ?? "";
-  if (!env.HASNA_SWITCHER_API_URL || !credential())
-    throw new Error("Set HASNA_SWITCHER_API_URL and HASNA_SWITCHER_API_KEY; no local database fallback is available.");
-  return new SwitcherClient({ baseUrl: env.HASNA_SWITCHER_API_URL, apiKey: credential });
+function clientFromEnv(env = process.env, options = {}) {
+  return SwitcherClient.fromEnvironment(env, options);
 }
 export {
   providerFromPreset,

package/dist/mcp/index.js

@@ -55,7 +55,7 @@ var routingEventSchema = z.object({
 var routingEventsSchema = z.array(routingEventSchema).max(1000);
 
 // src/domain.ts
-var VERSION = "0.1.3";
+var VERSION = "0.1.5";
 var harnessSchema = z2.enum(["claude", "codex", "grok", "opencode", "opencode2", "pi", "omp", "dsh", "cline", "hermes", "prime-agent", "gemini", "aider", "kilo"]);
 var protocolSchema = z2.enum(["anthropic-messages", "openai-responses", "openai-chat", "gemini-generate-content"]);
 var idSchema = z2.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/);
@@ -199,7 +199,7 @@ async function boundedJson(response, maxBytes = MAX_BYTES) {
 }
 
 // src/sdk.ts
-import { resolveCredential } from "@hasna/contracts/client";
+import { createClientTransport } from "@hasna/contracts/client";
 
 // src/presets.ts
 var route = (protocol, baseUrl, options = {}) => ({
@@ -321,6 +321,7 @@ function apiError(status, data, apiKey) {
 
 class SwitcherClient {
   options;
+  transport;
   baseUrl;
   constructor(options) {
     this.baseUrl = endpoint(options.baseUrl).replace(/\/v1$/, "");
@@ -328,9 +329,50 @@ class SwitcherClient {
       throw new Error("Switcher API key is required.");
     this.options = { ...options };
   }
+  static fromEnvironment(env = process.env, options = {}) {
+    const shared = createClientTransport("switcher", env, {
+      credentials: options.credentials,
+      timeoutMs: options.timeoutMs ?? 120000,
+      retry: false,
+      fetchImpl: async (input, init) => {
+        const address = String(input).replace(/\/v1\/(health|ready|version)$/, "/$1");
+        const key = new Headers(init?.headers).get("x-api-key") ?? "";
+        let response;
+        try {
+          response = await (options.fetch ?? fetch)(address, init);
+        } catch {
+          throw new SwitcherError(0, "connection_failed", "Switcher API request failed; check endpoint and service availability.");
+        }
+        if (response.status === 401 || response.status === 403) {
+          await response.body?.cancel().catch(() => {});
+          throw new SwitcherError(response.status, "api_error", `Switcher API returned HTTP ${response.status}. Check the configured credential; no alternate identity was selected.`);
+        }
+        let data;
+        try {
+          data = await boundedJson(response);
+        } catch {
+          throw new SwitcherError(response.status, "invalid_response", "Switcher API returned invalid JSON.");
+        }
+        if (!response.ok)
+          throw apiError(response.status, data, key);
+        return Response.json(data);
+      }
+    });
+    const client = new SwitcherClient({ baseUrl: shared.resolution.baseUrl, apiKey: () => {
+      throw new Error("Shared credential transport was not invoked.");
+    } });
+    client.transport = shared.client;
+    return client;
+  }
   async request(method, path, body, options = {}) {
     if (!/^\/v1\/[a-zA-Z0-9/?&=._%+-]+$/.test(path) && !["/health", "/ready", "/version"].includes(path) || path.includes(".."))
       throw new Error("Invalid API path.");
+    if (this.transport)
+      return this.transport.request(method, path.startsWith("/v1/") ? path.slice(3) : path, body, {
+        idempotencyKey: method === "GET" ? undefined : options.idempotencyKey ?? crypto.randomUUID(),
+        headers: options.version === undefined ? undefined : { "if-match": String(options.version) },
+        retry: false
+      });
     const apiKey = typeof this.options.apiKey === "function" ? this.options.apiKey() : this.options.apiKey;
     if (!apiKey || /[\r\n]/.test(apiKey))
       throw new Error("Switcher API key is required.");
@@ -427,11 +469,8 @@ class SwitcherClient {
     return this.request("PATCH", `/v1/runs/${encodeURIComponent(id)}`, input, { version, idempotencyKey });
   }
 }
-function clientFromEnv(env = process.env) {
-  const credential = () => resolveCredential("switcher", Object.fromEntries(Object.entries(env).filter(([name]) => name === "HASNA_SWITCHER_API_KEY")), { keychain: { enabled: false } })?.apiKey ?? "";
-  if (!env.HASNA_SWITCHER_API_URL || !credential())
-    throw new Error("Set HASNA_SWITCHER_API_URL and HASNA_SWITCHER_API_KEY; no local database fallback is available.");
-  return new SwitcherClient({ baseUrl: env.HASNA_SWITCHER_API_URL, apiKey: credential });
+function clientFromEnv(env = process.env, options = {}) {
+  return SwitcherClient.fromEnvironment(env, options);
 }
 
 // src/mcp.ts
@@ -467,6 +506,6 @@ tool("runs_get", "Get launch metadata.", { id: z3.string() }, (p) => clientFromE
 if (process.argv.includes("--version"))
   console.log(VERSION);
 else if (process.argv.includes("--help"))
-  console.log("switcher-mcp: authenticated Switcher API tools over MCP stdio. Requires HASNA_SWITCHER_API_URL and HASNA_SWITCHER_API_KEY.");
+  console.log("switcher-mcp: authenticated Switcher API tools over MCP stdio. Resolves API URL/key through @hasna/contracts (Keychain, canonical config/credentials, or environment).");
 else
   await server.connect(new StdioServerTransport);

package/dist/provider-stream.d.ts

@@ -0,0 +1,17 @@
+import type { HarnessLaunchInput } from "./harness-types";
+/** Recognize whole SSE terminal events, never marker text inside a delta. */
+export declare function terminalEventObserver(protocol: HarnessLaunchInput["protocol"], contentType: string | null): (chunk: Uint8Array) => boolean;
+/** One lifecycle for all bridges: terminal SSE, caller cancellation, and real failure. */
+export declare function proxyProviderStream(input: {
+    response: Response;
+    protocol: HarnessLaunchInput["protocol"];
+    requestSignal: AbortSignal;
+    abort: AbortController;
+    closing: () => boolean;
+    release: () => void;
+    inspect?: (chunk: Uint8Array, done?: boolean) => void;
+    interrupted?: () => void;
+}): {
+    stream: ReadableStream<Uint8Array>;
+    cancel: () => Promise<void>;
+};

package/dist/sdk.d.ts

@@ -1,4 +1,5 @@
 import type { components } from "./generated/api";
+import { type CredentialChainOptions } from "@hasna/contracts/client";
 export { providerFromPreset } from "./presets";
 export type ProviderPreset = components["schemas"]["ProviderPreset"];
 export type ProviderInput = components["schemas"]["ProviderInput"];
@@ -29,10 +30,18 @@ export type ClientOptions = {
     fetch?: typeof fetch;
     timeoutMs?: number;
 };
+export type EnvironmentClientOptions = {
+    credentials?: CredentialChainOptions;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+};
 export declare class SwitcherClient {
     private readonly options;
+    private transport?;
     readonly baseUrl: string;
     constructor(options: ClientOptions);
+    /** Use Contracts' paired authority/credential resolution on every request. */
+    static fromEnvironment(env?: Record<string, string | undefined>, options?: EnvironmentClientOptions): SwitcherClient;
     request<T>(method: string, path: string, body?: unknown, options?: {
         version?: number;
         idempotencyKey?: string;
@@ -617,4 +626,4 @@ export declare class SwitcherClient {
         routingEventsDropped?: number;
     }>;
 }
-export declare function clientFromEnv(env?: Record<string, string | undefined>): SwitcherClient;
+export declare function clientFromEnv(env?: Record<string, string | undefined>, options?: EnvironmentClientOptions): SwitcherClient;

package/dist/sdk.js

@@ -200,7 +200,7 @@ async function boundedJson(response, maxBytes = MAX_BYTES) {
 }
 
 // src/sdk.ts
-import { resolveCredential } from "@hasna/contracts/client";
+import { createClientTransport } from "@hasna/contracts/client";
 
 // src/presets.ts
 var route = (protocol, baseUrl, options = {}) => ({
@@ -361,6 +361,7 @@ function apiError(status, data, apiKey) {
 
 class SwitcherClient {
   options;
+  transport;
   baseUrl;
   constructor(options) {
     this.baseUrl = endpoint(options.baseUrl).replace(/\/v1$/, "");
@@ -368,9 +369,50 @@ class SwitcherClient {
       throw new Error("Switcher API key is required.");
     this.options = { ...options };
   }
+  static fromEnvironment(env = process.env, options = {}) {
+    const shared = createClientTransport("switcher", env, {
+      credentials: options.credentials,
+      timeoutMs: options.timeoutMs ?? 120000,
+      retry: false,
+      fetchImpl: async (input, init) => {
+        const address = String(input).replace(/\/v1\/(health|ready|version)$/, "/$1");
+        const key = new Headers(init?.headers).get("x-api-key") ?? "";
+        let response;
+        try {
+          response = await (options.fetch ?? fetch)(address, init);
+        } catch {
+          throw new SwitcherError(0, "connection_failed", "Switcher API request failed; check endpoint and service availability.");
+        }
+        if (response.status === 401 || response.status === 403) {
+          await response.body?.cancel().catch(() => {});
+          throw new SwitcherError(response.status, "api_error", `Switcher API returned HTTP ${response.status}. Check the configured credential; no alternate identity was selected.`);
+        }
+        let data;
+        try {
+          data = await boundedJson(response);
+        } catch {
+          throw new SwitcherError(response.status, "invalid_response", "Switcher API returned invalid JSON.");
+        }
+        if (!response.ok)
+          throw apiError(response.status, data, key);
+        return Response.json(data);
+      }
+    });
+    const client = new SwitcherClient({ baseUrl: shared.resolution.baseUrl, apiKey: () => {
+      throw new Error("Shared credential transport was not invoked.");
+    } });
+    client.transport = shared.client;
+    return client;
+  }
   async request(method, path, body, options = {}) {
     if (!/^\/v1\/[a-zA-Z0-9/?&=._%+-]+$/.test(path) && !["/health", "/ready", "/version"].includes(path) || path.includes(".."))
       throw new Error("Invalid API path.");
+    if (this.transport)
+      return this.transport.request(method, path.startsWith("/v1/") ? path.slice(3) : path, body, {
+        idempotencyKey: method === "GET" ? undefined : options.idempotencyKey ?? crypto.randomUUID(),
+        headers: options.version === undefined ? undefined : { "if-match": String(options.version) },
+        retry: false
+      });
     const apiKey = typeof this.options.apiKey === "function" ? this.options.apiKey() : this.options.apiKey;
     if (!apiKey || /[\r\n]/.test(apiKey))
       throw new Error("Switcher API key is required.");
@@ -467,11 +509,8 @@ class SwitcherClient {
     return this.request("PATCH", `/v1/runs/${encodeURIComponent(id)}`, input, { version, idempotencyKey });
   }
 }
-function clientFromEnv(env = process.env) {
-  const credential = () => resolveCredential("switcher", Object.fromEntries(Object.entries(env).filter(([name]) => name === "HASNA_SWITCHER_API_KEY")), { keychain: { enabled: false } })?.apiKey ?? "";
-  if (!env.HASNA_SWITCHER_API_URL || !credential())
-    throw new Error("Set HASNA_SWITCHER_API_URL and HASNA_SWITCHER_API_KEY; no local database fallback is available.");
-  return new SwitcherClient({ baseUrl: env.HASNA_SWITCHER_API_URL, apiKey: credential });
+function clientFromEnv(env = process.env, options = {}) {
+  return SwitcherClient.fromEnvironment(env, options);
 }
 export {
   providerFromPreset,

package/dist/serve/index.js

@@ -62,7 +62,7 @@ function canonicalPolicyJSON(value) {
 }
 
 // src/domain.ts
-var VERSION = "0.1.3";
+var VERSION = "0.1.5";
 var harnessSchema = z2.enum(["claude", "codex", "grok", "opencode", "opencode2", "pi", "omp", "dsh", "cline", "hermes", "prime-agent", "gemini", "aider", "kilo"]);
 var protocolSchema = z2.enum(["anthropic-messages", "openai-responses", "openai-chat", "gemini-generate-content"]);
 var idSchema = z2.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,79}$/);
@@ -808,7 +808,7 @@ var openapi_default = {
   openapi: "3.0.3",
   info: {
     title: "Switcher API",
-    version: "0.1.3",
+    version: "0.1.5",
     description: "Authenticated provider/profile/catalog control plane. Launches run locally; the API never returns provider credentials."
   },
   security: [

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.3",
   "info": {
     "title": "Switcher API",
-    "version": "0.1.3",
+    "version": "0.1.5",
     "description": "Authenticated provider/profile/catalog control plane. Launches run locally; the API never returns provider credentials."
   },
   "security": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/switcher",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Universal provider and model switcher for coding harnesses with an API, SDK and self-hosted storage",
   "license": "Apache-2.0",