@north-light/api 0.3.580 → 0.3.588

package/dist/core/ledger/types.d.ts

@@ -0,0 +1,75 @@
+export type ChargeKind = 'model' | 'tool' | 'sandbox' | 'job' | 'storage' | 'take';
+export type Funding = 'bill' | 'subscription' | 'key' | 'endpoint' | 'take' | 'legacy';
+export type LimitSource = 'grant_sync' | 'person' | 'operator' | 'billing' | 'card';
+/** Why the check refused a call: the limit's id and a sentence. Stored on the refused row. */
+export interface RefusedMark {
+    limit: string;
+    reason: string;
+}
+/** One `charges` row as stored. */
+export interface Charge {
+    id: string;
+    request: string | null;
+    at: string;
+    month: string;
+    kind: ChargeKind;
+    what: string;
+    /** `{input, output, cache_read, cache_write}` tokens, or `{units, unit}` from a receipt; null on a legacy tool row. */
+    units: Record<string, unknown> | null;
+    usd: number | null;
+    payer: string;
+    funding: Funding;
+    sub: string | null;
+    grantee: string;
+    node: string | null;
+    run: string | null;
+    provider: string | null;
+    caused_by: string | null;
+    vendor_ref: string | null;
+    refused: RefusedMark | null;
+    account: string | null;
+    billed_usd: number | null;
+}
+/** What a site hands `writeCharge`. */
+export interface ChargeInput {
+    /** `receipt:<provider>:<receipt_id>` for a tool charge; a fresh id when absent. A repeat of an existing id adds nothing. */
+    id?: string;
+    request?: string | null;
+    at?: Date;
+    kind: ChargeKind;
+    what: string;
+    units?: Record<string, unknown> | null;
+    /** The list-price amount; null when the model has no list price. Ignored (0 is stored) when `refused` is set. */
+    usd: number | null;
+    payer: string;
+    funding: Funding;
+    sub?: string | null;
+    grantee: string;
+    node?: string | null;
+    run?: string | null;
+    provider?: string | null;
+    causedBy?: string | null;
+    vendorRef?: string | null;
+    /** Set when the check refused this call: the row is stored with usd 0 and is not added to the rollup. */
+    refused?: RefusedMark | null;
+    /** The principal Northlight invoices; null when none or house-paid. */
+    account?: string | null;
+    /** The amount Northlight bills, when known at write time (a sandbox or storage row). */
+    billedUsd?: number | null;
+}
+/** One `limits` row. A null filter means any. */
+export interface Limit {
+    id: string;
+    /** Null when `account` is set. */
+    payer: string | null;
+    /** Counts the account's own charges and those of the apps it holds. */
+    account: string | null;
+    funding: Funding | null;
+    grantee: string | null;
+    provider: string | null;
+    sub: string | null;
+    usd_per_month: number;
+    source: LimitSource;
+    updated_at: string;
+}
+export type LimitInput = Omit<Limit, 'updated_at' | 'funding' | 'grantee' | 'provider' | 'sub' | 'account'> & Partial<Pick<Limit, 'funding' | 'grantee' | 'provider' | 'sub' | 'account'>>;

package/dist/core/ledger/types.js

@@ -0,0 +1,2 @@
+// The ledger's row shapes (design-ledger, "Data model").
+export {};

package/dist/core/llm/app-rungs.d.ts

@@ -0,0 +1,16 @@
+import { type ModelStrength } from '../../types.js';
+import { type InferenceEndpoint } from '../grants/mirror.js';
+export interface AppRung {
+    strength: ModelStrength;
+    model: string;
+}
+/** The rung the endpoint serves at `strength`, or the nearest declared one (the stronger on a tie). */
+export declare function rungAt(endpoint: InferenceEndpoint, strength: ModelStrength): AppRung;
+/** The rung a request for `requested` lands on. An omitted model is the `strong` rung. An exact request for a
+ *  concrete id outside the rungs is refused `substitution_refused`. */
+export declare function resolveAppRung(endpoint: InferenceEndpoint, requested: string | undefined, exact?: boolean): AppRung;
+/** Every rung in the order `llm` tries them: the requested rung first, then the declared rungs by distance. */
+export declare function appCandidates(endpoint: InferenceEndpoint, requested: string | undefined, exact?: boolean): AppRung[];
+/** The rung an app-paid grant's node runs on for `requested` (RT-RTE-24), or null when the grant is user-paid or
+ *  absent. Every path that chooses a node's model (spawn, `node config --model`) resolves through here. */
+export declare function appRungForGrant(grantId: string | null | undefined, requested: string | undefined, exact?: boolean): Promise<AppRung | null>;

package/dist/core/llm/app-rungs.js

@@ -0,0 +1,59 @@
+// The app rung resolver (RT-RTE-23): maps (grant's inference endpoint, requested model) to a rung of that endpoint.
+// It reads only the endpoint on the grant and crouter's shipped default ladders — never the owner's ladders, routes
+// or credentials. Launch, the broker and `llm` all call it.
+import { defaultModelLaddersConfig } from '../../types.js';
+import { MODEL_STRENGTHS, stripThinkingSuffix } from '../runtime/model-selection.js';
+import { modelTokenStrength } from '../runtime/launch.js';
+import { RunError } from '../runs/operations.js';
+import { grantRecord } from '../grants/mirror.js';
+const STRENGTHS = MODEL_STRENGTHS;
+/** The endpoint's declared rungs, nearest to `strength` first (the stronger on a tie). */
+function rungsByDistance(endpoint, strength) {
+    const at = STRENGTHS.indexOf(strength);
+    return STRENGTHS.filter((s) => endpoint.rungs[s] !== undefined)
+        .sort((a, b) => Math.abs(STRENGTHS.indexOf(a) - at) - Math.abs(STRENGTHS.indexOf(b) - at) || STRENGTHS.indexOf(a) - STRENGTHS.indexOf(b))
+        .map((s) => ({ strength: s, model: endpoint.rungs[s] }));
+}
+/** The rung the endpoint serves at `strength`, or the nearest declared one (the stronger on a tie). */
+export function rungAt(endpoint, strength) {
+    const nearest = rungsByDistance(endpoint, strength)[0];
+    if (nearest === undefined)
+        throw new RunError(404, 'model_unavailable', 'the app\'s inference endpoint declares no rung');
+    return nearest;
+}
+/** The rung a request for `requested` lands on. An omitted model is the `strong` rung. An exact request for a
+ *  concrete id outside the rungs is refused `substitution_refused`. */
+export function resolveAppRung(endpoint, requested, exact = false) {
+    if (requested === undefined || requested === '')
+        return rungAt(endpoint, 'strong');
+    const strength = modelTokenStrength(requested) ?? undefined;
+    if (strength !== undefined)
+        return rungAt(endpoint, strength);
+    const bare = stripThinkingSuffix(requested);
+    const own = STRENGTHS.find((s) => endpoint.rungs[s] === bare);
+    if (own !== undefined)
+        return { strength: own, model: endpoint.rungs[own] };
+    if (exact)
+        throw new RunError(400, 'substitution_refused', `model '${requested}' is not one of this app's inference rungs`);
+    const ladders = defaultModelLaddersConfig();
+    const ladder = [...Object.entries(ladders.anthropic), ...Object.entries(ladders.openai)].find(([, spec]) => stripThinkingSuffix(spec) === bare);
+    return rungAt(endpoint, ladder?.[0] ?? 'strong');
+}
+/** Every rung in the order `llm` tries them: the requested rung first, then the declared rungs by distance. */
+export function appCandidates(endpoint, requested, exact = false) {
+    const first = resolveAppRung(endpoint, requested, exact);
+    if (exact)
+        return [first];
+    const rest = rungsByDistance(endpoint, first.strength).filter((rung) => rung.strength !== first.strength);
+    return [first, ...rest];
+}
+/** The rung an app-paid grant's node runs on for `requested` (RT-RTE-24), or null when the grant is user-paid or
+ *  absent. Every path that chooses a node's model (spawn, `node config --model`) resolves through here. */
+export async function appRungForGrant(grantId, requested, exact = false) {
+    const grant = grantId ? await grantRecord(grantId) : null;
+    if (grant?.payer !== 'app')
+        return null;
+    if (!grant.inference_endpoint)
+        throw new RunError(404, 'model_unavailable', `${grant.grantee} is app-paid but its grant carries no inference endpoint`);
+    return resolveAppRung(grant.inference_endpoint, requested, exact);
+}

package/dist/core/llm/body-limits.d.ts

@@ -0,0 +1,7 @@
+/** Request-body caps shared by the daemon's routes and the broker's model adapter. */
+/** The cap on a control route's JSON body (spawn, message, config, ...). */
+export declare const CONTROL_BODY_MAX_BYTES: number;
+/** The cap on a route whose body is a model context (`/v1/llm`). A conversation
+ *  carrying inline screenshots is megabytes of base64; 32 MiB is Anthropic's own
+ *  request limit, so a body past it could not be served by the vendor anyway. */
+export declare const MODEL_CONTEXT_BODY_MAX_BYTES: number;

package/dist/core/llm/body-limits.js

@@ -0,0 +1,7 @@
+/** Request-body caps shared by the daemon's routes and the broker's model adapter. */
+/** The cap on a control route's JSON body (spawn, message, config, ...). */
+export const CONTROL_BODY_MAX_BYTES = 4 * 1024 * 1024;
+/** The cap on a route whose body is a model context (`/v1/llm`). A conversation
+ *  carrying inline screenshots is megabytes of base64; 32 MiB is Anthropic's own
+ *  request limit, so a body past it could not be served by the vendor anyway. */
+export const MODEL_CONTEXT_BODY_MAX_BYTES = 32 * 1024 * 1024;

package/dist/core/llm/refusal.d.ts

@@ -0,0 +1,14 @@
+import type { TurnErrorDTO } from '../../api/dto/run-events.js';
+/** True when an assistant message stopped because the vendor refused it on safety grounds.
+ *  The one test both the `llm` path and a run's turn error use. */
+export declare function isSafetyRefusal(message: {
+    rawStopReason?: string;
+} | undefined): boolean;
+/** The error a run's turn reports when its last assistant message stopped with `error`. */
+export type TurnError = TurnErrorDTO;
+/** `rateLimitedUntil`: epoch ms the daemon's final rate-limit refusal said the routes free up; it makes the error `rate_limited`. */
+export declare function turnErrorOf(message: {
+    stopReason?: string;
+    errorMessage?: string;
+    rawStopReason?: string;
+}, rateLimitedUntil?: number): TurnError | undefined;

package/dist/core/llm/refusal.js

@@ -0,0 +1,22 @@
+/** Vendor stop reasons that mean the model's safety system refused the request:
+ *  Anthropic `refusal`/`sensitive`, OpenAI `content_filter`, Bedrock guardrails,
+ *  and Gemini's safety finish reasons. pi keeps the vendor's own value in
+ *  `rawStopReason` when it maps one of these to `stopReason: 'error'`. */
+const SAFETY_REFUSAL_STOP_REASONS = new Set([
+    'refusal', 'sensitive', 'content_filter', 'incomplete.content_filter', 'content_filtered',
+    'guardrail_intervened', 'SAFETY', 'PROHIBITED_CONTENT', 'BLOCKLIST', 'SPII', 'RECITATION',
+]);
+/** True when an assistant message stopped because the vendor refused it on safety grounds.
+ *  The one test both the `llm` path and a run's turn error use. */
+export function isSafetyRefusal(message) {
+    return message?.rawStopReason !== undefined && SAFETY_REFUSAL_STOP_REASONS.has(message.rawStopReason);
+}
+/** `rateLimitedUntil`: epoch ms the daemon's final rate-limit refusal said the routes free up; it makes the error `rate_limited`. */
+export function turnErrorOf(message, rateLimitedUntil) {
+    if (message.stopReason !== 'error')
+        return undefined;
+    const text = message.errorMessage && message.errorMessage !== '' ? message.errorMessage : 'model request failed';
+    if (rateLimitedUntil !== undefined)
+        return { code: 'rate_limited', message: text, retry_at: new Date(rateLimitedUntil).toISOString() };
+    return { code: isSafetyRefusal(message) ? 'content_refused' : 'model_error', message: text };
+}

package/dist/core/locked-file.d.ts

@@ -0,0 +1,27 @@
+export type LockResult<T> = {
+    result: T;
+    next?: string;
+};
+/** Throws if this lock was compromised (stolen/expired) since acquisition. Callers that write
+ *  from INSIDE the critical section must call it immediately before that write, because the
+ *  post-`fn` check cannot un-write a file the callback already replaced. */
+export type LockHeldGuard = () => void;
+export type LockedFilePublish = (next: string) => void;
+export interface LockedFileBackend {
+    withLockAsync<T>(fn: (current: string | undefined, assertLockHeld: LockHeldGuard, publish: LockedFilePublish) => Promise<LockResult<T>>): Promise<T>;
+    /** The current whole-file contents, or undefined when the file does not exist yet.
+     *  Lock-free: every writer replaces the file by atomic rename. */
+    readUnlocked(): string | undefined;
+}
+/** A 0600 JSON file guarded by a cross-process `proper-lockfile` lock on its own path. */
+export declare class LockedJsonFile implements LockedFileBackend {
+    private readonly path;
+    private readonly durable;
+    private readonly initialContent;
+    constructor(path: string, durable?: boolean, initialContent?: string);
+    readUnlocked(): string | undefined;
+    private ensureFile;
+    /** Acquire the lock without blocking the event loop, keeping every read-modify-write
+     *  callback on the same asynchronous path. */
+    withLockAsync<T>(fn: (current: string | undefined, assertLockHeld: LockHeldGuard, publish: LockedFilePublish) => Promise<LockResult<T>>): Promise<T>;
+}

package/dist/core/locked-file.js

@@ -0,0 +1,121 @@
+// locked-file.ts — crouter's cross-process locked read/modify/write primitive for the
+// small JSON state files the runtime co-owns with pi: pi's own `auth.json` (api keys and
+// non-managed OAuth credentials) and crouter's per-provider subscription pool files, which
+// hold every managed account's own credential.
+//
+// The lock is `proper-lockfile` on the target path, so a crouter process and a pi process
+// contending for `auth.json` still exclude each other: same library, same lock path, and
+// same `realpath: false` option. Every callback runs asynchronously and returns
+// `{ result, next }`; `next === undefined` means "no write". Every write lands by atomic
+// tmp+rename (pool callers do their own, inside the callback), so a whole snapshot is the
+// only thing on disk and READS need no lock at all -- `readUnlocked` serves them. That
+// matters: pi asks its CredentialStore for every registered provider (~75) whenever it
+// builds a model runtime, and routing those through the lock made each boot serialize
+// behind seconds of lock acquisition backoff.
+import { chmodSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, writeFileSync, closeSync } from 'node:fs';
+import { dirname } from 'node:path';
+import lockfile from 'proper-lockfile';
+import { publishFileExclusive } from './fs-utils.js';
+const WRITE_OPTIONS = { encoding: 'utf-8', mode: 0o600 };
+// proper-lockfile decides a held lock is abandoned when its lockdir mtime is older than
+// the acquirer's `stale`, and refreshes the mtime on the holder's `update` timer. The holder
+// refreshes well inside the staleness threshold so long-running callbacks remain protected.
+const LOCK_STALE_MS = 30_000;
+const LOCK_UPDATE_MS = 5_000;
+/** A 0600 JSON file guarded by a cross-process `proper-lockfile` lock on its own path. */
+export class LockedJsonFile {
+    path;
+    durable;
+    initialContent;
+    constructor(path, durable = false, initialContent = '{}') {
+        this.path = path;
+        this.durable = durable;
+        this.initialContent = initialContent;
+    }
+    readUnlocked() {
+        return existsSync(this.path) ? readFileSync(this.path, 'utf-8') : undefined;
+    }
+    ensureFile() {
+        const dir = dirname(this.path);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (!existsSync(this.path)) {
+            // Published whole and exclusively: another process may be creating it too, and a
+            // reader (or a lost write) must never see the empty file a plain create leaves.
+            publishFileExclusive(this.path, this.initialContent, 0o600);
+            chmodSync(this.path, 0o600);
+        }
+    }
+    /** Acquire the lock without blocking the event loop, keeping every read-modify-write
+     *  callback on the same asynchronous path. */
+    async withLockAsync(fn) {
+        this.ensureFile();
+        let release;
+        let compromised;
+        const throwIfCompromised = () => {
+            if (compromised)
+                throw compromised;
+        };
+        try {
+            release = await lockfile.lock(this.path, {
+                // A different realpath setting would derive a DIFFERENT lock path for a symlinked
+                // auth.json and silently stop excluding other writers.
+                realpath: false,
+                retries: { retries: 10, factor: 2, minTimeout: 100, maxTimeout: 10_000, randomize: true },
+                stale: LOCK_STALE_MS,
+                // Refresh the lockdir mtime well inside `stale` so long-running callbacks remain protected.
+                update: LOCK_UPDATE_MS,
+                onCompromised: (err) => {
+                    compromised = err;
+                },
+            });
+            throwIfCompromised();
+            const current = existsSync(this.path) ? readFileSync(this.path, 'utf-8') : undefined;
+            let published = false;
+            const publish = (next) => {
+                if (published)
+                    throw new Error(`locked file was published twice: ${this.path}`);
+                throwIfCompromised();
+                const tmp = `${this.path}.${process.pid}.${Date.now()}.tmp`;
+                writeFileSync(tmp, next, WRITE_OPTIONS);
+                chmodSync(tmp, 0o600);
+                if (this.durable) {
+                    const fd = openSync(tmp, 'r');
+                    try {
+                        fsyncSync(fd);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                }
+                renameSync(tmp, this.path);
+                if (this.durable) {
+                    const fd = openSync(dirname(this.path), 'r');
+                    try {
+                        fsyncSync(fd);
+                    }
+                    finally {
+                        closeSync(fd);
+                    }
+                }
+                published = true;
+            };
+            const { result, next } = await fn(current, throwIfCompromised, publish);
+            throwIfCompromised();
+            if (next !== undefined)
+                publish(next);
+            throwIfCompromised();
+            return result;
+        }
+        finally {
+            if (release) {
+                try {
+                    await release();
+                }
+                catch {
+                    // A compromised lock's release throws; the compromise itself already surfaced.
+                }
+            }
+        }
+    }
+}

package/dist/core/log.d.ts

@@ -1,4 +1,6 @@
 export declare const MAX_ROTATING_RECORD_BYTES = 65536;
+/** The daemon log is the one place a day-old incident is diagnosed from; broker and job logs keep the smaller bound. */
+export declare const MAX_DAEMON_ACTIVE_BYTES: number;
 /** Synchronously appends one complete NDJSON record, retaining active + .1 + .2. */
 export declare function appendRotatingRecord(path: string, recordWithoutLf: string): boolean;
 /** One timed/bounded daemon batch instead of a mkdir/stat/open/write per event.

package/dist/core/log.js

@@ -2,10 +2,12 @@ import { appendFileSync, existsSync, mkdirSync, renameSync, rmSync, statSync } f
 import { dirname } from 'node:path';
 export const MAX_ROTATING_RECORD_BYTES = 65_536;
 const MAX_ACTIVE_BYTES = 5 * 1024 * 1024;
+/** The daemon log is the one place a day-old incident is diagnosed from; broker and job logs keep the smaller bound. */
+export const MAX_DAEMON_ACTIVE_BYTES = 16 * 1024 * 1024;
 const MAX_PENDING_BYTES = 128 * 1024;
 const FLUSH_INTERVAL_MS = 200;
 /** Append complete records in batches, rotating at record boundaries. */
-function appendRotatingRecords(path, records) {
+function appendRotatingRecords(path, records, maxActiveBytes = MAX_ACTIVE_BYTES) {
     let pending = '';
     try {
         mkdirSync(dirname(path), { recursive: true });
@@ -13,7 +15,7 @@ function appendRotatingRecords(path, records) {
         for (const record of records) {
             const line = `${record}\n`;
             const lineBytes = Buffer.byteLength(line, 'utf8');
-            if (currentBytes + lineBytes > MAX_ACTIVE_BYTES && currentBytes > 0) {
+            if (currentBytes + lineBytes > maxActiveBytes && currentBytes > 0) {
                 if (pending !== '') {
                     appendFileSync(path, pending, 'utf8');
                     pending = '';
@@ -82,7 +84,7 @@ export function flushDaemonLog() {
     if (buffer.timer !== undefined)
         clearTimeout(buffer.timer);
     daemonBuffer = undefined;
-    if (!appendRotatingRecords(buffer.path, buffer.records)) {
+    if (!appendRotatingRecords(buffer.path, buffer.records, MAX_DAEMON_ACTIVE_BYTES)) {
         for (const record of buffer.records)
             process.stderr.write(`[crtrd] event log append failed: ${record}\n`);
     }

package/dist/core/manifest-stale.d.ts

@@ -0,0 +1,18 @@
+import type { ManifestStaleEnvelope } from '../api/plugin-manifest-schema.js';
+/** What crtr attaches to the `CrtrError` it raises for a stale answer. */
+type StaleErrorDetails = Required<ManifestStaleEnvelope> & {
+    plugin: string;
+};
+/** Did the backend's own error envelope claim staleness? Reads the parsed JSON
+ *  body, before it becomes a `CrtrError`. */
+export declare function envelopeClaimsStale(envelope: Record<string, unknown>): boolean;
+/** The details a transport adds when it converts a stale envelope into the
+ *  error the dispatcher rethrows. */
+export declare function staleErrorDetails(plugin: string): StaleErrorDetails;
+/** Is this the one error class the dispatcher rethrows instead of rendering? */
+export declare function isManifestStaleError(error: unknown): boolean;
+/** The plugin to refetch, or `undefined` when this error is not a recoverable
+ *  stale answer. A stale flag with no plugin name is not actionable: nothing
+ *  identifies the package whose description went out of date. */
+export declare function staleManifestPlugin(error: unknown): string | undefined;
+export {};

package/dist/core/manifest-stale.js

@@ -0,0 +1,39 @@
+// The one place in crtr that names the `manifest_stale` wire field.
+//
+// The field itself is declared in the published format subpath
+// (`src/api/plugin-manifest-schema.ts`), which is what a plugin backend compiles
+// against. This module binds crtr's readers and writer to that declaration, so
+// renaming the field there fails the build here rather than silently splitting
+// the two sides: a backend that keeps setting a field nobody reads, and a client
+// that never recovers.
+import { CrtrError } from './errors.js';
+/** Bound to the published declaration: `keyof` is the field's literal type, so
+ *  a rename over there makes this assignment a type error. */
+const STALE_FIELD = 'manifest_stale';
+/** The plugin whose package produced the out-of-date description, carried
+ *  alongside the flag so the recovery frame knows what to refetch. The backend
+ *  does not send this — the transport that made the call names it. */
+const PLUGIN_FIELD = 'plugin';
+/** Did the backend's own error envelope claim staleness? Reads the parsed JSON
+ *  body, before it becomes a `CrtrError`. */
+export function envelopeClaimsStale(envelope) {
+    return envelope[STALE_FIELD] === true;
+}
+/** The details a transport adds when it converts a stale envelope into the
+ *  error the dispatcher rethrows. */
+export function staleErrorDetails(plugin) {
+    return { [STALE_FIELD]: true, [PLUGIN_FIELD]: plugin };
+}
+/** Is this the one error class the dispatcher rethrows instead of rendering? */
+export function isManifestStaleError(error) {
+    return error instanceof CrtrError && error.details?.[STALE_FIELD] === true;
+}
+/** The plugin to refetch, or `undefined` when this error is not a recoverable
+ *  stale answer. A stale flag with no plugin name is not actionable: nothing
+ *  identifies the package whose description went out of date. */
+export function staleManifestPlugin(error) {
+    if (!isManifestStaleError(error))
+        return undefined;
+    const plugin = error.details?.[PLUGIN_FIELD];
+    return typeof plugin === 'string' ? plugin : undefined;
+}

package/dist/core/model-auth/api-credential-store.d.ts

@@ -0,0 +1,10 @@
+import type { Credential, CredentialInfo, CredentialStore } from '@earendil-works/pi-ai';
+import type { CrtrClient } from '../../api/client.js';
+export declare class ApiCredentialStore implements CredentialStore {
+    private readonly client;
+    constructor(client: () => CrtrClient);
+    read(providerId: string): Promise<Credential | undefined>;
+    list(): Promise<readonly CredentialInfo[]>;
+    modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+    delete(providerId: string): Promise<void>;
+}

package/dist/core/model-auth/api-credential-store.js

@@ -0,0 +1,40 @@
+import { isManagedProvider } from '../managed-providers.js';
+export class ApiCredentialStore {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async read(providerId) {
+        const status = (await this.client().listModelAuth()).providers.find((p) => p.provider === providerId);
+        if (status === undefined || !status.configured)
+            return undefined;
+        if (status.managed) {
+            const expires = Math.max(...status.accounts.map((a) => Date.parse(a.expires_at)));
+            return { type: 'oauth', access: '', refresh: '', expires };
+        }
+        return status.kind === 'api_key' ? { type: 'api_key', key: '' } : { type: 'oauth', access: '', refresh: '', expires: Number.MAX_SAFE_INTEGER };
+    }
+    async list() {
+        return (await this.client().listModelAuth()).providers
+            .filter((p) => p.configured)
+            .map((p) => ({ providerId: p.provider, type: p.managed ? 'oauth' : p.kind }));
+    }
+    async modify(providerId, fn) {
+        if (isManagedProvider(providerId))
+            throw new Error(`${providerId} signs in through the daemon (model_auth.start), not through the credential store`);
+        const next = await fn(await this.read(providerId));
+        if (next === undefined)
+            return undefined;
+        if (next.type === 'api_key') {
+            await this.client().installCredential(providerId, { kind: 'api_key', api_key: next.key ?? '' });
+        }
+        else {
+            const { type: _type, access, refresh, expires, ...extra } = next;
+            await this.client().installCredential(providerId, { kind: 'oauth', access_token: access, refresh_token: refresh, expires_at: new Date(expires).toISOString(), ...(Object.keys(extra).length ? { extra } : {}) });
+        }
+        return next;
+    }
+    async delete(providerId) {
+        await this.client().removeCredential(providerId);
+    }
+}

package/dist/core/model-auth/daemon-login.d.ts

@@ -0,0 +1,13 @@
+import type { ProviderAuthInteraction } from '@earendil-works/pi-ai';
+import type { CrtrClient } from '../../api/client.js';
+import { type ManagedProviderId } from '../managed-providers.js';
+/** A self-host box with a browser on this machine: the vendor's redirect can
+ *  reach the daemon's loopback listener (RT-LLM-41). Over SSH or on a headless
+ *  host the code page / device flow is the only one that works. */
+export declare function localBrowserAvailable(env?: NodeJS.ProcessEnv): boolean;
+/** Sign in to a managed provider through the daemon. Resolves once the daemon
+ *  has written the credential; rejects with `Login cancelled` on abort. */
+export declare function daemonManagedLogin(client: CrtrClient, provider: ManagedProviderId, interaction: ProviderAuthInteraction, options?: {
+    label?: string;
+    loopback?: boolean;
+}): Promise<void>;