@north-light/crouter 0.3.340 → 0.3.341

package/dist/daemon/api/handlers/modelauth.js

@@ -1 +1 @@
-var L=Object.defineProperty;var o=(n,t)=>L(n,"name",{value:t,configurable:!0});import{homedir as P}from"node:os";import{join as k}from"node:path";import{deleteAuthCredential as A,readAuthCredentials as I,setAuthCredential as q}from"../../../core/auth-file.js";import{ApiError as u}from"../../../api/index.js";import{usage as y}from"../../../core/errors.js";import{resolveLaunchTarget as R}from"../../../core/runtime/launch-target.js";import{ANTHROPIC_PROVIDER_ID as D,OPENAI_CODEX_PROVIDER_ID as O,commitManagedLogin as $,readSubscriptionPool as g,removeAllManagedAccounts as M}from"../../../core/subscription-state.js";function l(){const n=process.env.PI_CODING_AGENT_DIR,t=n!==void 0&&n!==""?n:k(P(),".pi","agent");return k(t,"auth.json")}o(l,"authPath");function f(n){return n===D||n===O}o(f,"isManagedProvider");function E(n,t){if(typeof t!="string"||t==="")throw new u(400,"invalid_request",`oauth credential requires \`${n}\``);const e=Date.parse(t);if(Number.isNaN(e))throw new u(400,"invalid_request",`\`${n}\` is not a valid ISO timestamp`);return e}o(E,"parseExpiry");function h(n,t,e){if(typeof e!="string"||e==="")throw new u(400,"invalid_request",`${n} credential requires \`${t}\``);return e}o(h,"requireField");function N(n){return{label:n.label,expires_at:new Date(n.expires).toISOString(),rate_limited_until:new Date(n.rateLimitedUntil).toISOString(),...n.authFailure?{auth_failure:n.authFailure}:{},...n.accountId?{account_id:n.accountId}:{}}}o(N,"toManagedAccountStatus");function S(n){const t=g(n).map(N);return{provider:n,managed:!0,configured:t.length>0,accounts:t}}o(S,"managedStatus");function w(n,t){const e=n.query.getAll(t);if(e.length>1)throw y(`${t} must appear at most once`);return e[0]}o(w,"singleQueryValue");function T(n){const t=n.indexOf("/"),e=t>0?n.slice(0,t):"";if(e==="")throw new u(422,"unresolved_model","the selected launch has no concrete model provider");return e}o(T,"providerFromModel");async function C(){const n=await I(l()),t=[S(D),S(O)];for(const[e,a]of Object.entries(n))f(e)||a.type!=="api_key"&&a.type!=="oauth"||t.push({provider:e,managed:!1,configured:!0,kind:a.type});return{status:200,body:{providers:t}}}o(C,"handleList");async function F(n){for(const[s]of n.query)if(s!=="profile"&&s!=="cwd"&&s!=="kind"&&s!=="model")throw y(`unknown model-auth readiness query parameter: ${s}`);const t=w(n,"profile"),e=w(n,"cwd"),a=w(n,"kind"),r=w(n,"model");if(a!==void 0&&a.trim()==="")throw y("kind must be a non-empty string when provided");if(r!==void 0&&r.trim()==="")throw y("model must be a non-empty string when provided");const d=await R({root:!0,...t!==void 0?{profile:t}:{},...e!==void 0?{cwd:e}:{},...a!==void 0?{kind:a}:{},...r!==void 0?{model:r}:{}},{readOnlyProfileSelection:!0});if(d.launch.model===void 0)throw new u(422,"unresolved_model","the selected launch has no concrete model");const i=T(d.launch.model),c=await I(l());if(f(i)){const s=g(i),m=s.filter(p=>p.authFailure===void 0);if(m.length===0)return{status:200,body:s.length===0?{provider:i,model:d.launch.model,credential:"missing"}:{provider:i,model:d.launch.model,credential:"unusable",reason:"invalid_grant"}};const v=Date.now(),x=m.some(p=>p.rateLimitedUntil<=v),b=Math.min(...m.map(p=>p.rateLimitedUntil));return{status:200,body:{provider:i,model:d.launch.model,credential:"ready",...!x&&b>v?{rate_limited_until:new Date(b).toISOString()}:{}}}}const _=c[i];return{status:200,body:{provider:i,model:d.launch.model,credential:_?.type==="api_key"||_?.type==="oauth"?"ready":"missing"}}}o(F,"handleReadiness");async function j(n){const t=n.params.provider,e=n.body;if(e===void 0||typeof e!="object"||typeof e.kind!="string")throw new u(400,"invalid_request","a credential `kind` is required");switch(e.kind){case"api_key":{const a=h("api_key","api_key",e.api_key);return await q(t,{type:"api_key",key:a},l()),{status:200,body:{provider:t,installed:!0,managed:!1}}}case"oauth":{if(f(t))throw new u(422,"unprocessable",`provider ${t} stores oauth credentials as managed accounts \u2014 use kind \`managed_account\``);const a=h("oauth","access_token",e.access_token),r=h("oauth","refresh_token",e.refresh_token),d=E("expires_at",e.expires_at),i=e.extra??{};await q(t,{type:"oauth",...i,access:a,refresh:r,expires:d},l());const c={provider:t,installed:!0,managed:!1};return typeof e.account_id=="string"&&e.account_id!==""&&(c.account_id=e.account_id),{status:200,body:c}}case"managed_account":{if(!f(t))throw new u(422,"unprocessable",`provider ${t} does not support managed accounts`);const a=typeof e.label=="string"&&e.label.trim()?e.label.trim():void 0;if(!a&&e.auto_label!==!0)throw new u(400,"invalid_request","managed_account credential requires `label` or `auto_label`");const r=typeof e.account_id=="string"&&e.account_id!==""?e.account_id:void 0,d=h("managed_account","access_token",e.access_token),i=h("managed_account","refresh_token",e.refresh_token),c=E("expires_at",e.expires_at),_=typeof e.last_rate_limited_at=="number"?e.last_rate_limited_at:Math.max(0,...g(t).map(m=>m.lastRateLimitedAt));await $(t,a,{refresh:i,access:d,expires:c,...r?{accountId:r}:{},lastRateLimitedAt:_,autoLabel:e.auto_label===!0});const s={provider:t,installed:!0,managed:!0};return r&&(s.account_id=r),{status:200,body:s}}default:throw new u(400,"invalid_request",`unknown credential kind: ${String(e.kind)}`)}}o(j,"handleInstall");async function G(n){const t=n.params.provider;if(f(t)){const a=await M(t),r=await A(t,l());return{status:200,body:{provider:t,removed_accounts:a+(r?1:0)}}}const e=await A(t,l())?1:0;return{status:200,body:{provider:t,removed_accounts:e}}}o(G,"handleDelete");const J=[{method:"GET",pattern:"/v1/model-auth",handler:C},{method:"GET",pattern:"/v1/model-auth/readiness",handler:F},{method:"PUT",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:j},{method:"DELETE",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:G}];export{J as modelAuthRoutes};
+var E=Object.defineProperty;var o=(n,t)=>E(n,"name",{value:t,configurable:!0});import{join as x}from"node:path";import{deleteAuthCredential as k,readAuthCredentials as L,setAuthCredential as A}from"../../../core/auth-file.js";import{PoolCredentialStore as P}from"../../../core/pool-credential-store.js";import{piAgentDir as R}from"../../../core/runtime/package-health.js";import{ApiError as d}from"../../../api/index.js";import{usage as _}from"../../../core/errors.js";import{resolveLaunchTarget as $}from"../../../core/runtime/launch-target.js";import{ANTHROPIC_PROVIDER_ID as q,OPENAI_CODEX_PROVIDER_ID as I,commitManagedLogin as M,readSubscriptionPool as g,removeAllManagedAccounts as C}from"../../../core/subscription-state.js";function l(){return x(R(),"auth.json")}o(l,"authPath");function f(n){return n===q||n===I}o(f,"isManagedProvider");function O(n,t){if(typeof t!="string"||t==="")throw new d(400,"invalid_request",`oauth credential requires \`${n}\``);const e=Date.parse(t);if(Number.isNaN(e))throw new d(400,"invalid_request",`\`${n}\` is not a valid ISO timestamp`);return e}o(O,"parseExpiry");function h(n,t,e){if(typeof e!="string"||e==="")throw new d(400,"invalid_request",`${n} credential requires \`${t}\``);return e}o(h,"requireField");function T(n){return{label:n.label,expires_at:new Date(n.expires).toISOString(),rate_limited_until:new Date(n.rateLimitedUntil).toISOString(),...n.authFailure?{auth_failure:n.authFailure}:{},...n.accountId?{account_id:n.accountId}:{}}}o(T,"toManagedAccountStatus");function D(n){const t=g(n).map(T);return{provider:n,managed:!0,configured:t.length>0,accounts:t}}o(D,"managedStatus");function y(n,t){const e=n.query.getAll(t);if(e.length>1)throw _(`${t} must appear at most once`);return e[0]}o(y,"singleQueryValue");function F(n){const t=n.indexOf("/"),e=t>0?n.slice(0,t):"";if(e==="")throw new d(422,"unresolved_model","the selected launch has no concrete model provider");return e}o(F,"providerFromModel");async function N(){const n=await L(l()),t=[D(q),D(I)];for(const[e,a]of Object.entries(n))f(e)||a.type!=="api_key"&&a.type!=="oauth"||t.push({provider:e,managed:!1,configured:!0,kind:a.type});return{status:200,body:{providers:t}}}o(N,"handleList");async function j(n){for(const[i]of n.query)if(i!=="profile"&&i!=="cwd"&&i!=="kind"&&i!=="model")throw _(`unknown model-auth readiness query parameter: ${i}`);const t=y(n,"profile"),e=y(n,"cwd"),a=y(n,"kind"),r=y(n,"model");if(a!==void 0&&a.trim()==="")throw _("kind must be a non-empty string when provided");if(r!==void 0&&r.trim()==="")throw _("model must be a non-empty string when provided");const u=await $({root:!0,...t!==void 0?{profile:t}:{},...e!==void 0?{cwd:e}:{},...a!==void 0?{kind:a}:{},...r!==void 0?{model:r}:{}},{readOnlyProfileSelection:!0});if(u.launch.model===void 0)throw new d(422,"unresolved_model","the selected launch has no concrete model");const s=F(u.launch.model);if(f(s)){const i=g(s);if(i.length>0){const m=i.filter(p=>p.authFailure===void 0);if(m.length===0)return{status:200,body:{provider:s,model:u.launch.model,credential:"unusable",reason:"invalid_grant"}};const v=Date.now(),S=m.some(p=>p.rateLimitedUntil<=v),b=Math.min(...m.map(p=>p.rateLimitedUntil));return{status:200,body:{provider:s,model:u.launch.model,credential:"ready",...!S&&b>v?{rate_limited_until:new Date(b).toISOString()}:{}}}}}const c=await new P(l()).read(s),w=c?.type==="oauth"||c?.type==="api_key"&&!!c.key;return{status:200,body:{provider:s,model:u.launch.model,credential:w?"ready":"missing"}}}o(j,"handleReadiness");async function U(n){const t=n.params.provider,e=n.body;if(e===void 0||typeof e!="object"||typeof e.kind!="string")throw new d(400,"invalid_request","a credential `kind` is required");switch(e.kind){case"api_key":{const a=h("api_key","api_key",e.api_key);return await A(t,{type:"api_key",key:a},l()),{status:200,body:{provider:t,installed:!0,managed:!1}}}case"oauth":{if(f(t))throw new d(422,"unprocessable",`provider ${t} stores oauth credentials as managed accounts \u2014 use kind \`managed_account\``);const a=h("oauth","access_token",e.access_token),r=h("oauth","refresh_token",e.refresh_token),u=O("expires_at",e.expires_at),s=e.extra??{};await A(t,{type:"oauth",...s,access:a,refresh:r,expires:u},l());const c={provider:t,installed:!0,managed:!1};return typeof e.account_id=="string"&&e.account_id!==""&&(c.account_id=e.account_id),{status:200,body:c}}case"managed_account":{if(!f(t))throw new d(422,"unprocessable",`provider ${t} does not support managed accounts`);const a=typeof e.label=="string"&&e.label.trim()?e.label.trim():void 0;if(!a&&e.auto_label!==!0)throw new d(400,"invalid_request","managed_account credential requires `label` or `auto_label`");const r=typeof e.account_id=="string"&&e.account_id!==""?e.account_id:void 0,u=h("managed_account","access_token",e.access_token),s=h("managed_account","refresh_token",e.refresh_token),c=O("expires_at",e.expires_at),w=typeof e.last_rate_limited_at=="number"?e.last_rate_limited_at:Math.max(0,...g(t).map(m=>m.lastRateLimitedAt));await M(t,a,{refresh:s,access:u,expires:c,...r?{accountId:r}:{},lastRateLimitedAt:w,autoLabel:e.auto_label===!0});const i={provider:t,installed:!0,managed:!0};return r&&(i.account_id=r),{status:200,body:i}}default:throw new d(400,"invalid_request",`unknown credential kind: ${String(e.kind)}`)}}o(U,"handleInstall");async function V(n){const t=n.params.provider;if(f(t)){const a=await C(t),r=await k(t,l());return{status:200,body:{provider:t,removed_accounts:a+(r?1:0)}}}const e=await k(t,l())?1:0;return{status:200,body:{provider:t,removed_accounts:e}}}o(V,"handleDelete");const Y=[{method:"GET",pattern:"/v1/model-auth",handler:N},{method:"GET",pattern:"/v1/model-auth/readiness",handler:j},{method:"PUT",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:U},{method:"DELETE",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:V}];export{Y as modelAuthRoutes};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.340",
+  "version": "0.3.341",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/crouter",
-  "version": "0.3.340",
+  "version": "0.3.341",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/crouter",
-      "version": "0.3.340",
+      "version": "0.3.341",
       "hasInstallScript": true,
       "license": "GPL-3.0-only",
       "workspaces": [
@@ -10859,28 +10859,28 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/crouter-api",
-      "version": "0.3.340",
+      "version": "0.3.341",
       "license": "GPL-3.0-only"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/crouter-env-docker",
-      "version": "0.3.340",
+      "version": "0.3.341",
       "license": "GPL-3.0-only"
     },
     "packages/crouter-plugin": {
       "name": "@north-light/crouter-plugin",
-      "version": "0.3.340",
+      "version": "0.3.341",
       "license": "GPL-3.0-only",
       "dependencies": {
-        "@north-light/crouter-api": "^0.3.340"
+        "@north-light/crouter-api": "^0.3.341"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/crouter-sdk",
-      "version": "0.3.340",
+      "version": "0.3.341",
       "license": "GPL-3.0-only",
       "dependencies": {
-        "@north-light/crouter-api": "^0.3.340"
+        "@north-light/crouter-api": "^0.3.341"
       }
     }
   }