@oharness/engine 0.1.0

package/dist/auth/providers/generic.js

@@ -0,0 +1,155 @@
+import { refreshCredential, startAuthCodeFlow, startDeviceFlow, startLoopbackFlow, } from "../oauth.js";
+import { isExpired } from "../types.js";
+/** Build a plain API-key auth provider. */
+export function apiKeyProvider(opts) {
+    const header = opts.header ?? "authorization";
+    const format = opts.format ?? ((key) => `Bearer ${key}`);
+    const endpoint = () => {
+        const moved = opts.baseUrl?.();
+        return moved ? { baseUrl: moved } : {};
+    };
+    return {
+        id: opts.id,
+        label: opts.label,
+        methods: [
+            {
+                type: "api",
+                label: "API key",
+                prompts: [
+                    {
+                        type: "text",
+                        key: "key",
+                        message: `${opts.label} API key`,
+                        placeholder: opts.placeholder,
+                        secret: true,
+                        validate: opts.validate,
+                    },
+                ],
+            },
+        ],
+        async loader(credential) {
+            for (const name of opts.envVars ?? []) {
+                const value = process.env[name];
+                if (value) {
+                    return { headers: { [header]: format(value) }, source: `env:${name}`, ...endpoint() };
+                }
+            }
+            if (credential?.type === "api") {
+                return { headers: { [header]: format(credential.key) }, source: "stored:api", ...endpoint() };
+            }
+            return undefined;
+        },
+        async discover() {
+            for (const name of opts.envVars ?? []) {
+                const value = process.env[name];
+                if (value)
+                    return { credential: { type: "api", key: value }, source: `env:${name}` };
+            }
+            return undefined;
+        },
+    };
+}
+/**
+ * Build an OAuth auth provider covering the flows a terminal app can actually
+ * complete: device code, loopback redirect, or paste-the-code.
+ */
+export function oauthProvider(opts) {
+    const header = opts.header ?? "authorization";
+    const format = opts.format ?? ((token) => `Bearer ${token}`);
+    const methods = [];
+    if (opts.deviceCodeUrl) {
+        methods.push({
+            type: "oauth",
+            label: `Sign in to ${opts.label} (device code)`,
+            authorize: async () => startDeviceFlow({
+                deviceCodeUrl: opts.deviceCodeUrl,
+                tokenUrl: opts.tokenUrl,
+                clientId: opts.clientId,
+                scope: opts.scope,
+                headers: opts.headers,
+            }),
+        });
+    }
+    if (opts.authorizeUrl) {
+        methods.push({
+            type: "oauth",
+            label: `Sign in to ${opts.label} (browser)`,
+            authorize: async () => {
+                const shared = {
+                    authorizeUrl: opts.authorizeUrl,
+                    tokenUrl: opts.tokenUrl,
+                    clientId: opts.clientId,
+                    clientSecret: opts.clientSecret,
+                    scope: opts.scope,
+                    extraParams: opts.extraParams,
+                    headers: opts.headers,
+                };
+                // A loopback listener is nicer, but is useless over SSH or in a
+                // container where the browser cannot reach 127.0.0.1.
+                return opts.preferPasteCode
+                    ? startAuthCodeFlow({ ...shared, redirectUri: "urn:ietf:wg:oauth:2.0:oob" })
+                    : startLoopbackFlow(shared);
+            },
+        });
+    }
+    if (opts.envVars?.length) {
+        methods.push({
+            type: "api",
+            label: "API key",
+            prompts: [{ type: "text", key: "key", message: `${opts.label} API key`, secret: true }],
+        });
+    }
+    return {
+        id: opts.id,
+        label: opts.label,
+        methods,
+        async loader(credential) {
+            for (const name of opts.envVars ?? []) {
+                const value = process.env[name];
+                if (value) {
+                    return {
+                        headers: { [header]: format(value), ...opts.extraHeaders },
+                        removeHeaders: opts.removeHeaders,
+                        source: `env:${name}`,
+                    };
+                }
+            }
+            if (credential?.type === "oauth") {
+                return {
+                    headers: { [header]: format(credential.access), ...opts.extraHeaders },
+                    removeHeaders: opts.removeHeaders,
+                    ...(credential.baseUrl ? { baseUrl: credential.baseUrl } : {}),
+                    source: "stored:oauth",
+                };
+            }
+            if (credential?.type === "api") {
+                return {
+                    headers: { [header]: format(credential.key), ...opts.extraHeaders },
+                    removeHeaders: opts.removeHeaders,
+                    source: "stored:api",
+                };
+            }
+            return undefined;
+        },
+        async refresh(credential) {
+            if (!isExpired(credential))
+                return undefined;
+            return refreshCredential(credential, {
+                tokenUrl: opts.tokenUrl,
+                clientId: opts.clientId,
+                clientSecret: opts.clientSecret,
+                headers: opts.headers,
+                scope: opts.scope,
+            });
+        },
+        async discover() {
+            for (const name of opts.envVars ?? []) {
+                const value = process.env[name];
+                if (value)
+                    return { credential: { type: "api", key: value }, source: `env:${name}` };
+            }
+            return undefined;
+        },
+    };
+}
+//# sourceMappingURL=generic.js.map

package/dist/auth/providers/generic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../src/auth/providers/generic.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,2CAA2C;AAC3C,MAAM,UAAU,cAAc,CAAC,IAoB9B;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,GAAyB,EAAE;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,GAAG,EAAE,KAAK;wBACV,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,UAAU;wBAChC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC7B,MAAM,EAAE,IAAI;wBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB;iBACF;aACF;SACF;QACD,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC;gBACxF,CAAC;YACH,CAAC;YACD,IAAI,UAAU,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAC;YAChG,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK;oBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YACvF,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAkCD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAErE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,cAAc,IAAI,CAAC,KAAK,gBAAgB;YAC/C,SAAS,EAAE,KAAK,IAAI,EAAE,CACpB,eAAe,CAAC;gBACd,aAAa,EAAE,IAAI,CAAC,aAAc;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;SACL,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,cAAc,IAAI,CAAC,KAAK,YAAY;YAC3C,SAAS,EAAE,KAAK,IAAI,EAAE;gBACpB,MAAM,MAAM,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAa;oBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC;gBACF,gEAAgE;gBAChE,sDAAsD;gBACtD,OAAO,IAAI,CAAC,eAAe;oBACzB,CAAC,CAAC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;oBAC5E,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACxF,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO;QAEP,KAAK,CAAC,MAAM,CAAC,UAAU;YACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO;wBACL,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE;wBAC1D,aAAa,EAAE,IAAI,CAAC,aAAa;wBACjC,MAAM,EAAE,OAAO,IAAI,EAAE;qBACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBACjC,OAAO;oBACL,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE;oBACtE,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,MAAM,EAAE,cAAc;iBACvB,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO;oBACL,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE;oBACnE,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,MAAM,EAAE,YAAY;iBACrB,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,UAA2B;YACvC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC7C,OAAO,iBAAiB,CAAC,UAAU,EAAE;gBACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,QAAQ;YACZ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK;oBAAE,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;YACvF,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/providers/official.d.ts

@@ -0,0 +1,3 @@
+import type { AuthProvider } from "../types.ts";
+export declare function officialBaseUrl(): string;
+export declare const officialAuth: AuthProvider;

package/dist/auth/providers/official.js

@@ -0,0 +1,90 @@
+import { isExpired } from "../types.js";
+import { accountSignIn, bearer, refreshSession } from "./account.js";
+/**
+ * The official plan — an OHarness account and nothing else asked for.
+ *
+ * Two credentials reach it, and they are the same account either way:
+ *
+ * - The session from signing in, held here and refreshed like any OAuth token.
+ * - An `oh-` key the account holder created on the OHarness site. It is not a
+ *   second wallet, only a second key to the same one — CI and SDKs need
+ *   something that does not expire, and `OHARNESS_API_KEY` is how that key is
+ *   carried into a process, not a separate thing issued to a machine.
+ *
+ * What is deliberately absent is any upstream credential. The models are
+ * served by a gateway that holds the OpenAI, Anthropic and Google keys; usage
+ * is metered against the account's balance on the way through. Which gateway
+ * that is stays an implementation detail — the subscriber never learns it, and
+ * moving it is a change to `DEFAULT_BASE_URL` rather than to anyone's setup.
+ */
+/**
+ * Where official-plan requests go.
+ *
+ * This is the metering endpoint, not the upstream gateway: it is what reads
+ * the account, checks the balance and writes the ledger entry, and only then
+ * forwards. Pointing it at the upstream instead skips the half of the request
+ * that knows who is asking — the upstream sees an account token where it wants
+ * its own key and answers `invalid_api_key`, which is a confusing way to be
+ * told the meter is not in the path. `OHARNESS_BASE_URL` moves it for a
+ * staging or self-hosted deployment.
+ *
+ * A domain of ours rather than the host's generated one, because this string
+ * is compiled into every desktop build and the desktop reads no environment:
+ * whatever is written here is where installed copies go until they are
+ * replaced. A hosting subdomain would make "move the gateway" and "abandon
+ * everyone who has not updated" the same act.
+ */
+const DEFAULT_BASE_URL = "https://api.oharness.ai";
+export function officialBaseUrl() {
+    return (process.env["OHARNESS_BASE_URL"] ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+export const officialAuth = {
+    id: "official",
+    label: "OHarness",
+    methods: [
+        accountSignIn("Sign in to your OHarness account"),
+        {
+            type: "api",
+            label: "OHarness API key",
+            prompts: [
+                {
+                    type: "text",
+                    key: "key",
+                    message: "OHarness API key",
+                    placeholder: "oh-…",
+                    secret: true,
+                    validate: (value) => /^\S+$/.test(value) && !/^["']|["']$/.test(value)
+                        ? undefined
+                        : "paste the key alone — no quotes or spaces",
+                },
+            ],
+        },
+    ],
+    async loader(credential) {
+        const envKey = process.env["OHARNESS_API_KEY"];
+        if (envKey)
+            return bearer(envKey, "env:OHARNESS_API_KEY");
+        if (credential?.type === "oauth" && !isExpired(credential)) {
+            return {
+                ...bearer(credential.access, "stored:account"),
+                // The gateway may pin an account to a regional host at login.
+                ...(credential.baseUrl ? { baseUrl: credential.baseUrl } : {}),
+            };
+        }
+        if (credential?.type === "api")
+            return bearer(credential.key, "stored:api");
+        return undefined;
+    },
+    async refresh(credential) {
+        if (!isExpired(credential))
+            return undefined;
+        return refreshSession(credential);
+    },
+    async discover() {
+        const envKey = process.env["OHARNESS_API_KEY"];
+        if (!envKey)
+            return undefined;
+        return { credential: { type: "api", key: envKey }, source: "env:OHARNESS_API_KEY" };
+    },
+};
+//# sourceMappingURL=official.js.map

package/dist/auth/providers/official.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"official.js","sourceRoot":"","sources":["../../../src/auth/providers/official.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAErE;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,UAAU;IAEjB,OAAO,EAAE;QACP,aAAa,CAAC,kCAAkC,CAAC;QACjD;YACE,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,KAAK;oBACV,OAAO,EAAE,kBAAkB;oBAC3B,WAAW,EAAE,MAAM;oBACnB,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;wBAC/C,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,2CAA2C;iBAClD;aACF;SACF;KACF;IAED,KAAK,CAAC,MAAM,CAAC,UAAU;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC/C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAE1D,IAAI,UAAU,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,OAAO;gBACL,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC;gBAC9C,8DAA8D;gBAC9D,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,EAAE,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAE5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAA2B;QACvC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7C,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACtF,CAAC;CACF,CAAC"}

package/dist/auth/providers/ottoport.d.ts

@@ -0,0 +1,3 @@
+import type { AuthProvider } from "../types.ts";
+export declare function ottoportBaseUrl(): string;
+export declare const ottoportAuth: AuthProvider;

package/dist/auth/providers/ottoport.js

@@ -0,0 +1,60 @@
+import { apiKeyProvider } from "./generic.js";
+/**
+ * OttoPort — an OpenAI-compatible gateway, brought by the user.
+ *
+ * This entry is for someone who has their own OttoPort account: they create a
+ * key in OttoPort's console and paste it here, and their usage is billed
+ * against their own credit balance there. It is an ordinary vendor entry, no
+ * different in kind from OpenAI or OpenRouter.
+ *
+ * It is *not* the official OHarness plan. That plan happens to route through
+ * this gateway today, but the subscriber never holds an OttoPort key and never
+ * sees an OttoPort account — see `official.ts`. Keeping the two apart is what
+ * lets the plan's billing, quota and upstream be ours to change.
+ */
+/**
+ * The gateway. Per-deployment, so staging and self-hosted work unchanged:
+ * `OTTOPORT_BASE_URL` moves it without a release.
+ */
+const DEFAULT_BASE_URL = "https://ottoport.ai";
+/** Where the API sits under the host. Stated once; two things below need it. */
+const API_PATH = "/api/v1";
+export function ottoportBaseUrl() {
+    return (process.env["OTTOPORT_BASE_URL"] ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+}
+/**
+ * The endpoint to call, when the environment has moved it — and nothing at
+ * all when it has not.
+ *
+ * The variable names a *host*, which is how it is documented and how anyone
+ * would think to set it, while what the wire needs is the API root. Appending
+ * the path here is what makes `OTTOPORT_BASE_URL=https://staging.ottoport.ai`
+ * do what it says instead of sending every completion to a 404 one level up.
+ * A value that already carries the path is left alone, since typing the whole
+ * root is the other obvious reading.
+ *
+ * Silent when unset, deliberately: the catalog's `baseUrl` is the default, and
+ * a user catalog is the other way to move this endpoint. An override that
+ * returned the default anyway would outrank that file for no reason.
+ */
+function movedEndpoint() {
+    const moved = process.env["OTTOPORT_BASE_URL"];
+    if (!moved)
+        return undefined;
+    const host = moved.replace(/\/+$/, "");
+    return host.endsWith(API_PATH) ? host : `${host}${API_PATH}`;
+}
+export const ottoportAuth = apiKeyProvider({
+    id: "ottoport",
+    label: "OttoPort",
+    envVars: ["OTTOPORT_API_KEY"],
+    placeholder: "op-…",
+    baseUrl: movedEndpoint,
+    // Deliberately loose about the prefix: rejecting a key the gateway would
+    // have accepted is worse than passing a typo through to a 401. Quotes and
+    // spaces are the real failure — they come from pasting `KEY="op-…"`.
+    validate: (value) => /^\S+$/.test(value) && !/^["']|["']$/.test(value)
+        ? undefined
+        : "paste the key alone — no quotes or spaces",
+});
+//# sourceMappingURL=ottoport.js.map

package/dist/auth/providers/ottoport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ottoport.js","sourceRoot":"","sources":["../../../src/auth/providers/ottoport.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,gFAAgF;AAChF,MAAM,QAAQ,GAAG,SAAS,CAAC;AAE3B,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAiB,cAAc,CAAC;IACvD,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,UAAU;IACjB,OAAO,EAAE,CAAC,kBAAkB,CAAC;IAC7B,WAAW,EAAE,MAAM;IACnB,OAAO,EAAE,aAAa;IACtB,yEAAyE;IACzE,0EAA0E;IAC1E,qEAAqE;IACrE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,2CAA2C;CAClD,CAAC,CAAC"}

package/dist/auth/store.d.ts

@@ -0,0 +1,22 @@
+import type { Credential } from "./types.ts";
+/**
+ * Credential storage.
+ *
+ * Written 0600 in a 0700 directory: these are live access tokens, and on a
+ * shared machine a world-readable auth file is the whole security story.
+ * Writes go through a temp file + rename so a crash mid-write cannot leave a
+ * truncated credential set behind.
+ */
+export declare class AuthStore {
+    private readonly file;
+    private cache?;
+    constructor(file?: string);
+    get location(): string;
+    all(): Promise<Record<string, Credential>>;
+    get(providerId: string): Promise<Credential | undefined>;
+    set(providerId: string, credential: Credential): Promise<void>;
+    remove(providerId: string): Promise<boolean>;
+    /** Drop the in-memory copy so the next read comes from disk. */
+    invalidate(): void;
+    private persist;
+}

package/dist/auth/store.js

@@ -0,0 +1,138 @@
+import { userPath } from "../paths.js";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { parseJson } from "../util/json.js";
+const FILE_MODE = 0o600;
+const DIR_MODE = 0o700;
+/**
+ * Credential storage.
+ *
+ * Written 0600 in a 0700 directory: these are live access tokens, and on a
+ * shared machine a world-readable auth file is the whole security story.
+ * Writes go through a temp file + rename so a crash mid-write cannot leave a
+ * truncated credential set behind.
+ */
+export class AuthStore {
+    file;
+    cache;
+    constructor(file) {
+        this.file =
+            file ??
+                process.env["OHARNESS_AUTH_FILE"] ??
+                userPath("auth.json");
+    }
+    get location() {
+        return this.file;
+    }
+    async all() {
+        if (this.cache)
+            return this.cache;
+        // An env override lets CI inject credentials without touching disk.
+        const inline = process.env["OHARNESS_AUTH_CONTENT"];
+        if (inline) {
+            const parsed = parseJson(inline);
+            if (parsed.ok) {
+                this.cache = parsed.value;
+                return this.cache;
+            }
+        }
+        let raw;
+        try {
+            raw = await readFile(this.file, "utf8");
+        }
+        catch {
+            this.cache = {};
+            return this.cache;
+        }
+        const parsed = parseJson(raw);
+        if (!parsed.ok) {
+            // A corrupt auth file should not be fatal — treat it as empty and let
+            // the user log in again rather than blocking every request.
+            this.cache = {};
+            return this.cache;
+        }
+        const out = {};
+        for (const [key, value] of Object.entries(parsed.value)) {
+            const credential = validate(value);
+            if (credential)
+                out[normalizeKey(key)] = credential;
+        }
+        this.cache = out;
+        return out;
+    }
+    async get(providerId) {
+        return (await this.all())[normalizeKey(providerId)];
+    }
+    async set(providerId, credential) {
+        const all = { ...(await this.all()), [normalizeKey(providerId)]: credential };
+        await this.persist(all);
+    }
+    async remove(providerId) {
+        const all = { ...(await this.all()) };
+        const key = normalizeKey(providerId);
+        if (!(key in all))
+            return false;
+        delete all[key];
+        await this.persist(all);
+        return true;
+    }
+    /** Drop the in-memory copy so the next read comes from disk. */
+    invalidate() {
+        this.cache = undefined;
+    }
+    async persist(all) {
+        await mkdir(path.dirname(this.file), { recursive: true, mode: DIR_MODE });
+        const temp = `${this.file}.${process.pid}.tmp`;
+        await writeFile(temp, JSON.stringify(all, null, 2), { encoding: "utf8", mode: FILE_MODE });
+        await rename(temp, this.file);
+        // rename preserves the temp file's mode, but be explicit in case the file
+        // already existed with looser permissions.
+        await chmod(this.file, FILE_MODE).catch(() => { });
+        this.cache = all;
+    }
+}
+/** Trailing slashes are easy to introduce via config and break lookups. */
+function normalizeKey(key) {
+    return key.replace(/\/+$/, "");
+}
+function validate(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const v = value;
+    switch (v["type"]) {
+        case "api":
+            return typeof v["key"] === "string"
+                ? {
+                    type: "api",
+                    key: v["key"],
+                    ...(isStringRecord(v["metadata"]) ? { metadata: v["metadata"] } : {}),
+                }
+                : undefined;
+        case "oauth":
+            return typeof v["access"] === "string" &&
+                typeof v["refresh"] === "string" &&
+                typeof v["expires"] === "number"
+                ? {
+                    type: "oauth",
+                    access: v["access"],
+                    refresh: v["refresh"],
+                    expires: v["expires"],
+                    ...(typeof v["accountId"] === "string" ? { accountId: v["accountId"] } : {}),
+                    ...(typeof v["baseUrl"] === "string" ? { baseUrl: v["baseUrl"] } : {}),
+                    ...(isStringRecord(v["metadata"]) ? { metadata: v["metadata"] } : {}),
+                }
+                : undefined;
+        case "wellknown":
+            return typeof v["key"] === "string" && typeof v["token"] === "string"
+                ? { type: "wellknown", key: v["key"], token: v["token"] }
+                : undefined;
+        default:
+            return undefined;
+    }
+}
+function isStringRecord(value) {
+    return (!!value &&
+        typeof value === "object" &&
+        Object.values(value).every((v) => typeof v === "string"));
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IACH,IAAI,CAAS;IACtB,KAAK,CAA8B;IAE3C,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI;YACP,IAAI;gBACJ,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBACjC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAElC,oEAAoE;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,SAAS,CAA6B,MAAM,CAAC,CAAC;YAC7D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC1B,OAAO,IAAI,CAAC,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAA0B,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,UAAU;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB,EAAE,UAAsB;QAClD,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC9E,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gEAAgE;IAChE,UAAU;QACR,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAA+B;QACnD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QAC/C,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,0EAA0E;QAC1E,2CAA2C;QAC3C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAElD,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;IACnB,CAAC;CACF;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ;gBACjC,CAAC,CAAC;oBACE,IAAI,EAAE,KAAK;oBACX,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC;oBACb,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE;gBACH,CAAC,CAAC,SAAS,CAAC;QAEhB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;gBACpC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;gBAChC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;gBAChC,CAAC,CAAC;oBACE,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;oBACnB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;oBACrB,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;oBACrB,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5E,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACtE;gBACH,CAAC,CAAC,SAAS,CAAC;QAEhB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACnE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE;gBACzD,CAAC,CAAC,SAAS,CAAC;QAEhB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CACzD,CAAC;AACJ,CAAC"}