@north-light/crouter-api 0.3.161 → 0.3.162

package/dist/client.d.ts

@@ -10,7 +10,7 @@ import type { NodeConfigPatch } from './dto/config.js';
 import type { AttachEnsureRequest, AttachEnsureResultDTO } from './dto/attach.js';
 import type { EnsureProfileRequest, ProfileDTO } from './dto/profiles.js';
 import type { FilePeekDTO } from './dto/files.js';
-import type { CredentialResultDTO, InstallCredentialRequest } from './dto/modelauth.js';
+import type { CredentialRemovalResultDTO, CredentialResultDTO, InstallCredentialRequest, ModelAuthListDTO } from './dto/modelauth.js';
 import type { CreateHumanBridgeRequest, HumanBridgeResultDTO, HumanConsultResultDTO, HumanDeliverResultDTO, HumanVisualResultDTO } from './dto/human.js';
 import type { CancelInboxTicketRequest, CanceledTicketResultDTO, DeckTicketResultDTO, InboxDeckDTO, InboxListDTO, InboxTicketIdDTO, RespondInboxDeckRequest } from './dto/inbox.js';
 import type { AttentionCountsDTO, AttentionDTO, DashboardDTO, DashboardQuery, HistoryGrepQuery, HistoryGrepResultDTO, HistoryReadQuery, HistoryReadResultDTO, HistorySearchQuery, HistorySearchResultDTO, PruneRequest, PruneResultDTO, RebuildIndexResultDTO, RosterDTO, SnapshotDTO } from './dto/canvas.js';
@@ -139,7 +139,9 @@ export declare class CrtrClient {
     /** Delete one profile by exact id or unique name (`DELETE /v1/profiles/:name`,
      *  idempotent — a miss is success). */
     deleteProfile(name: string): Promise<void>;
+    listModelAuth(): Promise<ModelAuthListDTO>;
     installCredential(provider: string, req: InstallCredentialRequest): Promise<CredentialResultDTO>;
+    removeCredential(provider: string): Promise<CredentialRemovalResultDTO>;
     /** Create a terminal `kind:'human'` bridge node with NO broker engine
      *  (`spawnNode` server-side). Distinct from `createNode` (which launches a
      *  broker) precisely because a human bridge must never have one. */

package/dist/client.js

@@ -252,9 +252,15 @@ export class CrtrClient {
         await this.request('DELETE', routes.profile(name));
     }
     // ---- Model auth --------------------------------------------------------
+    listModelAuth() {
+        return this.request('GET', routes.modelAuths());
+    }
     installCredential(provider, req) {
         return this.request('PUT', routes.modelAuth(provider), req);
     }
+    removeCredential(provider) {
+        return this.request('DELETE', routes.modelAuth(provider));
+    }
     // ---- Human bridge + completion-handler forwarding (spec §6.5) ----------
     /** Create a terminal `kind:'human'` bridge node with NO broker engine
      *  (`spawnNode` server-side). Distinct from `createNode` (which launches a

package/dist/dto/modelauth.d.ts

@@ -39,3 +39,35 @@ export interface CredentialResultDTO {
     managed: boolean;
     account_id?: string;
 }
+/** One managed-pool account, projected without credential material. Timestamps are
+ * ISO strings so remote consumers do not need to understand pi's epoch-ms storage. */
+export interface ManagedAccountStatusDTO {
+    label: string;
+    expires_at: string;
+    rate_limited_until: string;
+    auth_failure?: 'invalid_grant';
+    account_id?: string;
+}
+/** A provider's sanitized credential state. Managed providers are always listed
+ * (even with no accounts); non-managed providers appear only when auth.json has
+ * an API-key or OAuth credential for them. */
+export type ModelAuthProviderStatusDTO = {
+    provider: string;
+    managed: true;
+    configured: boolean;
+    accounts: ManagedAccountStatusDTO[];
+} | {
+    provider: string;
+    managed: false;
+    configured: true;
+    kind: 'api_key' | 'oauth';
+};
+/** `GET /v1/model-auth` — credential-presence projection for every known provider. */
+export interface ModelAuthListDTO {
+    providers: ModelAuthProviderStatusDTO[];
+}
+/** `DELETE /v1/model-auth/{provider}` — all user credentials removed for one provider. */
+export interface CredentialRemovalResultDTO {
+    provider: string;
+    removed_accounts: number;
+}

package/dist/dto/modelauth.js

@@ -1,3 +1,4 @@
 // Model-auth DTOs (spec §7.6). `PUT /v1/model-auth/{provider}` installs/rotates
-// already-obtained credential material; interactive collection stays client-side.
+// already-obtained credential material; `GET /v1/model-auth` exposes only sanitized
+// connection state; interactive collection stays client-side.
 export {};

package/dist/routes.d.ts

@@ -59,6 +59,7 @@ export declare const routes: {
     readonly humanInboxCancel: (ticketId: string) => string;
     readonly profiles: () => string;
     readonly profile: (name: string) => string;
+    readonly modelAuths: () => string;
     readonly modelAuth: (provider: string) => string;
     readonly filePeek: () => string;
 };

package/dist/routes.js

@@ -85,6 +85,7 @@ export const routes = {
     profiles: () => `${V}/profiles`,
     profile: (name) => `${V}/profiles/${name}`,
     // Model auth
+    modelAuths: () => `${V}/model-auth`,
     modelAuth: (provider) => `${V}/model-auth/${provider}`,
     // Host file read (browser file-peek panel). The absolute path rides as a
     // `path` query param, not a path segment — it is not a single safe segment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter-api",
-  "version": "0.3.161",
+  "version": "0.3.162",
   "description": "Typed crtrd /v1 API contract — DTOs, route builders, the error contract, and the CrtrClient. Zero runtime dependencies.",
   "type": "module",
   "main": "./dist/index.js",