@n24q02m/hull 0.4.0-beta.9 → 0.5.0-beta.1

package/build/storage/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,cAAc,EACd,WAAW,EAEX,eAAe,EACf,cAAc,EAEf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACzF,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAwB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAmB,YAAY,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAA0C,aAAa,EAAE,MAAM,eAAe,CAAA;AACrF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAElB,UAAU,EACV,gBAAgB,EACjB,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACL,cAAc,EAEd,eAAe,EACf,cAAc,EAEf,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AACzF,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,gBAAgB,IAAI,UAAU,EAC9B,iBAAiB,IAAI,WAAW,EACjC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAwB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC9F,OAAO,EACL,YAAY,EAGZ,qBAAqB,EAErB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,wBAAwB,EAExB,OAAO,EAEP,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EAEpB,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACpB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,OAAO,EACP,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACb,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAGL,eAAe,EAEf,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAGhB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAA0C,aAAa,EAAE,MAAM,eAAe,CAAA"}

package/build/storage/key-pool-crypto.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Encryption at rest for pooled provider credentials.
+ *
+ * The provider pool lives in `~/.hull/hull.db`, so every API key is sealed
+ * with AES-256-GCM under a 32-byte machine key at `~/.hull/.credential-key`
+ * (created 0600 on first use, never overwritten). Envelope:
+ *
+ *   v1:<base64 nonce>:<base64 ciphertext || 16-byte tag>
+ *
+ * `packages/core-py/src/hull_core/credentials/crypto.py` writes and reads the
+ * same envelope with the same key file, so either stack can open a pool the
+ * other created; both test suites pin one shared vector.
+ */
+export declare const SECRET_KEY_LENGTH = 32;
+export declare const SECRET_NONCE_LENGTH = 12;
+export declare class CredentialCryptoError extends Error {
+    constructor(message: string);
+}
+/**
+ * Read the 32-byte credential key, minting it 0600 on first use.
+ *
+ * Creation is exclusive (`wx`): two processes racing on the first use converge
+ * on the winner's key instead of the later write winning. A pre-existing file
+ * of any other length is refused, never replaced.
+ */
+export declare function loadOrCreateKey(path: string): Buffer;
+/** Seal `plaintext` into a `v1:<nonce>:<ciphertext+tag>` envelope. */
+export declare function encryptSecret(key: Buffer, plaintext: string, nonce?: Buffer): string;
+/** Open an envelope produced by {@link encryptSecret}; never echoes it. */
+export declare function decryptSecret(key: Buffer, envelope: string): string;
+/** Display-only tail of a key (`…abcd`); never enough to reconstruct it. */
+export declare function keyHint(apiKey: string): string;
+/** Constant-time equality used for duplicate detection; never logs either value. */
+export declare function secretsEqual(left: string, right: string): boolean;
+/** Lazy key-file holder used by {@link CredentialStore}. */
+export declare class SecretCipher {
+    readonly keyPath: string;
+    private cachedKey;
+    constructor(keyPath: string);
+    get key(): Buffer;
+    encrypt(plaintext: string): string;
+    decrypt(envelope: string): string;
+}
+//# sourceMappingURL=key-pool-crypto.d.ts.map

package/build/storage/key-pool-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pool-crypto.d.ts","sourceRoot":"","sources":["../../src/storage/key-pool-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,mBAAmB,KAAK,CAAA;AAIrC,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAaD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBpD;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,MAAyC,GAC/C,MAAM,CASR;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BnE;AAED,4EAA4E;AAC5E,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIjE;AAED,4DAA4D;AAC5D,qBAAa,YAAY;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,SAAS,CAAsB;IAEvC,YAAY,OAAO,EAAE,MAAM,EAE1B;IAED,IAAI,GAAG,IAAI,MAAM,CAGhB;IAED,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjC;IAED,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhC;CACF"}

package/build/storage/key-pool-crypto.js

@@ -0,0 +1,132 @@
+/**
+ * Encryption at rest for pooled provider credentials.
+ *
+ * The provider pool lives in `~/.hull/hull.db`, so every API key is sealed
+ * with AES-256-GCM under a 32-byte machine key at `~/.hull/.credential-key`
+ * (created 0600 on first use, never overwritten). Envelope:
+ *
+ *   v1:<base64 nonce>:<base64 ciphertext || 16-byte tag>
+ *
+ * `packages/core-py/src/hull_core/credentials/crypto.py` writes and reads the
+ * same envelope with the same key file, so either stack can open a pool the
+ * other created; both test suites pin one shared vector.
+ */
+import { createCipheriv, createDecipheriv, randomBytes, timingSafeEqual } from 'node:crypto';
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, writeSync } from 'node:fs';
+import { dirname } from 'node:path';
+export const SECRET_KEY_LENGTH = 32;
+export const SECRET_NONCE_LENGTH = 12;
+const ENVELOPE_PREFIX = 'v1';
+const TAG_LENGTH = 16;
+export class CredentialCryptoError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CredentialCryptoError';
+    }
+}
+function checkedKey(key) {
+    if (key.length !== SECRET_KEY_LENGTH) {
+        throw new CredentialCryptoError(`credential key must be exactly ${SECRET_KEY_LENGTH} raw bytes (found ${key.length}); ` +
+            'hull will not overwrite or delete it. Move it aside to mint a fresh key, then re-add the ' +
+            'provider credentials — the old envelopes cannot be recovered without the original key.');
+    }
+    return key;
+}
+/**
+ * Read the 32-byte credential key, minting it 0600 on first use.
+ *
+ * Creation is exclusive (`wx`): two processes racing on the first use converge
+ * on the winner's key instead of the later write winning. A pre-existing file
+ * of any other length is refused, never replaced.
+ */
+export function loadOrCreateKey(path) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    let fd;
+    try {
+        fd = openSync(path, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        return checkedKey(readFileSync(path));
+    }
+    const key = randomBytes(SECRET_KEY_LENGTH);
+    try {
+        writeSync(fd, key);
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return key;
+}
+/** Seal `plaintext` into a `v1:<nonce>:<ciphertext+tag>` envelope. */
+export function encryptSecret(key, plaintext, nonce = randomBytes(SECRET_NONCE_LENGTH)) {
+    checkedKey(key);
+    if (nonce.length !== SECRET_NONCE_LENGTH) {
+        throw new Error(`nonce must be exactly ${SECRET_NONCE_LENGTH} bytes`);
+    }
+    const cipher = createCipheriv('aes-256-gcm', key, nonce);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const payload = Buffer.concat([ciphertext, cipher.getAuthTag()]);
+    return `${ENVELOPE_PREFIX}:${nonce.toString('base64')}:${payload.toString('base64')}`;
+}
+/** Open an envelope produced by {@link encryptSecret}; never echoes it. */
+export function decryptSecret(key, envelope) {
+    checkedKey(key);
+    const parts = envelope.split(':');
+    if (parts.length !== 3 || parts[0] !== ENVELOPE_PREFIX) {
+        throw new CredentialCryptoError('credential secret is not a v1 hull envelope');
+    }
+    const nonce = Buffer.from(parts[1], 'base64');
+    const payload = Buffer.from(parts[2], 'base64');
+    // Node's base64 decoder is lenient; round-tripping rejects `@@@`-style junk.
+    if (nonce.toString('base64') !== parts[1] ||
+        payload.toString('base64') !== parts[2] ||
+        nonce.length !== SECRET_NONCE_LENGTH ||
+        payload.length <= TAG_LENGTH) {
+        throw new CredentialCryptoError('credential secret envelope is corrupt');
+    }
+    try {
+        const decipher = createDecipheriv('aes-256-gcm', key, nonce);
+        decipher.setAuthTag(payload.subarray(payload.length - TAG_LENGTH));
+        const plaintext = Buffer.concat([
+            decipher.update(payload.subarray(0, payload.length - TAG_LENGTH)),
+            decipher.final()
+        ]);
+        return plaintext.toString('utf8');
+    }
+    catch {
+        // Wrong key or damaged row: the message carries neither envelope nor plaintext.
+        throw new CredentialCryptoError('credential secret is corrupt or the key changed');
+    }
+}
+/** Display-only tail of a key (`…abcd`); never enough to reconstruct it. */
+export function keyHint(apiKey) {
+    return apiKey.length >= 8 ? `…${apiKey.slice(-4)}` : '…';
+}
+/** Constant-time equality used for duplicate detection; never logs either value. */
+export function secretsEqual(left, right) {
+    const a = Buffer.from(left, 'utf8');
+    const b = Buffer.from(right, 'utf8');
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Lazy key-file holder used by {@link CredentialStore}. */
+export class SecretCipher {
+    constructor(keyPath) {
+        this.cachedKey = null;
+        this.keyPath = keyPath;
+    }
+    get key() {
+        if (this.cachedKey === null)
+            this.cachedKey = loadOrCreateKey(this.keyPath);
+        return this.cachedKey;
+    }
+    encrypt(plaintext) {
+        return encryptSecret(this.key, plaintext);
+    }
+    decrypt(envelope) {
+        return decryptSecret(this.key, envelope);
+    }
+}
+//# sourceMappingURL=key-pool-crypto.js.map

package/build/storage/key-pool-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pool-crypto.js","sourceRoot":"","sources":["../../src/storage/key-pool-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC5F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC5F,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AACnC,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AACrC,MAAM,eAAe,GAAG,IAAI,CAAA;AAC5B,MAAM,UAAU,GAAG,EAAE,CAAA;AAErB,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAA;IACrC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,qBAAqB,CAC7B,kCAAkC,iBAAiB,qBAAqB,GAAG,CAAC,MAAM,KAAK;YACrF,2FAA2F;YAC3F,wFAAwF,CAC3F,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,IAAI,EAAU,CAAA;IACd,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;QACnE,OAAO,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAA;IAC1C,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;QAClB,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,SAAiB,EACjB,KAAK,GAAW,WAAW,CAAC,mBAAmB,CAAC;IAEhD,UAAU,CAAC,GAAG,CAAC,CAAA;IACf,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,mBAAmB,QAAQ,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IAChE,OAAO,GAAG,eAAe,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;AACvF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACzD,UAAU,CAAC,GAAG,CAAC,CAAA;IACf,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC/C,6EAA6E;IAC7E,IACE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACvC,KAAK,CAAC,MAAM,KAAK,mBAAmB;QACpC,OAAO,CAAC,MAAM,IAAI,UAAU,EAC5B,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC5D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAA;QAClE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;YACjE,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAA;QACF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,MAAM,IAAI,qBAAqB,CAAC,iDAAiD,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;AAC1D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvD,CAAC;AAED,4DAA4D;AAC5D,MAAM,OAAO,YAAY;IAIvB,YAAY,OAAe;QAFnB,cAAS,GAAkB,IAAI,CAAA;QAGrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAED,IAAI,GAAG;QACL,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC3E,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IAC1C,CAAC;CACF"}

package/build/storage/key-pool-store.d.ts

@@ -0,0 +1,134 @@
+/**
+ * SQLite-backed provider key pool and account registry (`~/.hull/hull.db`).
+ *
+ * Mirrors `packages/core-py/src/hull_core/credentials/store.py`, including the
+ * table DDL and the shared `v1:` secret envelope, so either stack can open a
+ * pool the other created. The tables are additive and migration-safe:
+ * `CREATE TABLE/INDEX IF NOT EXISTS` only, no `ALTER`, so a database written by
+ * an older hull (only the `kv` table) keeps working and older hull ignores the
+ * new tables.
+ *
+ * Scope rules:
+ * - A pool is one provider identity; `account_id IS NULL` is that provider's
+ *   default pool and a named account has its own pool. Rotation never hops
+ *   across accounts.
+ * - Entries are ordered by `priority` then insertion order.
+ * - Rotation state lives in the database, not process memory, so two tasks (or
+ *   two processes) never reuse a credential that is cooling down or leased.
+ */
+import { AccountRegistry } from './account-registry.js';
+import { type Account, type Credential, type CredentialHealth, KeyPool, type KeyPoolOptions, type MigrationResult } from './key-pool.js';
+import { SecretCipher } from './key-pool-crypto.js';
+export declare const KEY_POOL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS provider_accounts (\n    account_id TEXT PRIMARY KEY,\n    provider   TEXT NOT NULL,\n    name       TEXT NOT NULL,\n    email      TEXT,\n    workspace  TEXT,\n    labels     TEXT NOT NULL DEFAULT '{}',\n    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),\n    updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))\n);\n\nCREATE UNIQUE INDEX IF NOT EXISTS provider_accounts_name\n    ON provider_accounts(provider, name);\n\nCREATE TABLE IF NOT EXISTS provider_credentials (\n    id              INTEGER PRIMARY KEY AUTOINCREMENT,\n    provider        TEXT NOT NULL,\n    account_id      TEXT,\n    label           TEXT,\n    base_url        TEXT NOT NULL,\n    model           TEXT,\n    secret          TEXT NOT NULL,\n    key_hint        TEXT NOT NULL,\n    priority        INTEGER NOT NULL DEFAULT 0,\n    disabled        INTEGER NOT NULL DEFAULT 0,\n    last_status     INTEGER,\n    failure_count   INTEGER NOT NULL DEFAULT 0,\n    cooldown_until  REAL NOT NULL DEFAULT 0,\n    lease_until     REAL NOT NULL DEFAULT 0,\n    created_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),\n    updated_at      TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))\n);\n\n\nCREATE INDEX IF NOT EXISTS provider_credentials_pool\n    ON provider_credentials(provider, account_id, priority, id);\n";
+export interface AccountRow {
+    account_id: string;
+    provider: string;
+    name: string;
+    email: string | null;
+    workspace: string | null;
+    labels: string;
+}
+/** A `[models.<task>]`-shaped cell, as products and configs already carry it. */
+export interface ModelCellLike {
+    readonly baseUrl: string;
+    readonly apiKey?: string | null;
+    readonly model?: string | null;
+    readonly provider?: string | null;
+    readonly account?: string | null;
+}
+export interface AddCredentialInput {
+    readonly provider: string;
+    readonly apiKey: string;
+    readonly baseUrl: string;
+    readonly model?: string | null;
+    readonly accountId?: string | null;
+    readonly label?: string | null;
+    readonly priority?: number | null;
+}
+export interface CredentialStoreOptions {
+    readonly cipher?: SecretCipher;
+    readonly now?: () => number;
+}
+export interface PoolDiagnostics {
+    readonly total: number;
+    readonly disabled: number;
+    readonly coolingDown: number;
+    readonly leased: number;
+    readonly retryAfter: number | null;
+}
+/** The instance database every hull surface already uses: `~/.hull/hull.db`. */
+export declare function defaultHullDbPath(): string;
+/** Key file that seals this database's credentials (same directory as the DB). */
+export declare function credentialKeyPath(dbPath: string): string;
+/** Ordered provider credential pool plus named accounts, on local SQLite. */
+export declare class CredentialStore {
+    readonly path: string;
+    private readonly db;
+    private readonly cipher;
+    private readonly clock;
+    constructor(dbPath?: string, options?: CredentialStoreOptions);
+    now(): number;
+    close(): void;
+    private toCredential;
+    private toHealth;
+    private row;
+    private requireAccount;
+    private rejectDuplicate;
+    addCredential(input: AddCredentialInput): Credential;
+    removeCredential(credentialId: number): void;
+    setPriority(credentialId: number, priority: number): void;
+    /** Clear disabled/cooldown/failure state after an operator fixes the key. */
+    enable(credentialId: number): void;
+    disable(credentialId: number): void;
+    /** Clear rotation state for one provider (or every provider); returns rows matched. */
+    resetHealth(provider?: string): number;
+    /** Every decrypted entry (all accounts), ordered by provider/priority/id. */
+    credentials(provider?: string): Credential[];
+    /** The rotation pool for one provider/account scope, in priority order. */
+    poolCredentials(provider: string, accountId?: string | null): Credential[];
+    /** Masked state of every entry, including disabled and cooling ones. */
+    health(provider?: string): CredentialHealth[];
+    poolHealth(provider: string, accountId?: string | null): CredentialHealth[];
+    getCredential(credentialId: number): Credential;
+    diagnose(provider: string, accountId?: string | null): PoolDiagnostics;
+    /** Atomically lease the highest-priority usable entry, or return null. */
+    leaseFirst(provider: string, accountId: string | null, options: {
+        now: number;
+        leaseSeconds: number;
+        exclude?: number[];
+    }): Credential | null;
+    releaseLease(credentialId: number): void;
+    recordSuccess(credentialId: number): void;
+    recordFailure(credentialId: number, status: number | null, options?: {
+        now?: number;
+        cooldownUntil?: number | null;
+        disable?: boolean;
+    }): void;
+    accounts(): AccountRegistry;
+    accountRows(): AccountRow[];
+    accountRow(accountId: string): AccountRow | undefined;
+    accountRowsByName(name: string): AccountRow[];
+    insertAccount(account: Account): void;
+    updateAccountRow(accountId: string, values: {
+        name: string;
+        email: string | null;
+        workspace: string | null;
+        labelsJson: string;
+    }): void;
+    deleteAccountRow(accountId: string, options?: {
+        dropCredentials?: boolean;
+    }): void;
+    pool(provider: string, options?: KeyPoolOptions): KeyPool;
+    /** Resolve a `[models.<task>]`-shaped cell's `provider`/`account` pointers. */
+    poolForCell(cell: ModelCellLike, options?: KeyPoolOptions): KeyPool;
+    /**
+     * Seed the pool from the pre-pool single-key config, idempotently. Every
+     * distinct `(baseUrl, apiKey)` becomes one entry in insertion order; running
+     * it again skips what is already stored.
+     */
+    migrateModelCells(cells: Iterable<ModelCellLike>, options?: {
+        provider?: string | null;
+        accountId?: string | null;
+    }): MigrationResult;
+}
+//# sourceMappingURL=key-pool-store.d.ts.map

package/build/storage/key-pool-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-pool-store.d.ts","sourceRoot":"","sources":["../../src/storage/key-pool-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EACL,KAAK,OAAO,EAEZ,KAAK,UAAU,EAEf,KAAK,gBAAgB,EAErB,OAAO,EACP,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAkC,YAAY,EAAgB,MAAM,sBAAsB,CAAA;AAEjG,eAAO,MAAM,eAAe,q3CAqC3B,CAAA;AAwBD,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AA6CD,6EAA6E;AAC7E,qBAAa,eAAe;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAmB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;IAEpC,YAAY,MAAM,GAAE,MAA4B,EAAE,OAAO,GAAE,sBAA2B,EASrF;IAED,GAAG,IAAI,MAAM,CAEZ;IAED,KAAK,IAAI,IAAI,CAEZ;IAID,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,QAAQ;IAsBhB,OAAO,CAAC,GAAG;IAQX,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,eAAe;IAyBvB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CA+BnD;IAED,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAG3C;IAED,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAKxD;IAED,6EAA6E;IAC7E,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAQjC;IAED,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAKlC;IAED,uFAAuF;IACvF,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAQrC;IAID,6EAA6E;IAC7E,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,EAAE,CAQ3C;IAED,2EAA2E;IAC3E,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,UAAU,EAAE,CAO/E;IAED,wEAAwE;IACxE,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAS5C;IAED,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,gBAAgB,EAAE,CAQhF;IAED,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,CAE9C;IAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,GAAG,IAAW,GAAG,eAAe,CAiB3E;IAID,0EAA0E;IAC1E,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACjE,UAAU,GAAG,IAAI,CAkBnB;IAED,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAKvC;IAED,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAOxC;IAED,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAC/E,IAAI,CASN;IAID,QAAQ,IAAI,eAAe,CAE1B;IAED,WAAW,IAAI,UAAU,EAAE,CAE1B;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAEpD;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAE5C;IAED,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuBpC;IAED,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAC3F,IAAI,CAON;IAED,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,IAAI,CAiBrF;IAID,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAE5D;IAED,+EAA+E;IAC/E,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAGtE;IAED;;;;OAIG;IACH,iBAAiB,CACf,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,EAC9B,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO,GACpE,eAAe,CAmCjB;CACF"}