@openclaw/chutes-provider 0.0.0 → 2026.6.9

package/dist/oauth.js

@@ -0,0 +1,149 @@
+import { generatePkceVerifierChallenge, toFormUrlEncoded } from "openclaw/plugin-sdk/provider-auth";
+import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { randomBytes } from "node:crypto";
+import { resolveExpiresAtMsFromDurationSeconds } from "openclaw/plugin-sdk/number-runtime";
+import { parseOAuthCallbackInput, waitForLocalOAuthCallback } from "openclaw/plugin-sdk/provider-auth-runtime";
+import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+//#region extensions/chutes/oauth.ts
+/**
+* Chutes OAuth PKCE login flow.
+*/
+const CHUTES_AUTHORIZE_ENDPOINT = "https://api.chutes.ai/idp/authorize";
+const CHUTES_TOKEN_ENDPOINT = "https://api.chutes.ai/idp/token";
+const CHUTES_USERINFO_ENDPOINT = "https://api.chutes.ai/idp/userinfo";
+const CHUTES_TOKEN_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+function parseRedirectUri(redirectUri) {
+	const url = new URL(redirectUri);
+	if (url.protocol !== "http:") throw new Error(`Chutes OAuth redirect URI must be http:// (got ${redirectUri})`);
+	const hostname = url.hostname || "127.0.0.1";
+	if (hostname !== "localhost" && hostname !== "127.0.0.1" && hostname !== "::1") throw new Error(`Chutes OAuth redirect hostname must be loopback (got ${hostname}). Use http://127.0.0.1:<port>/...`);
+	return {
+		hostname,
+		port: url.port ? Number.parseInt(url.port, 10) : 80,
+		pathname: url.pathname || "/"
+	};
+}
+function parseManualOAuthInput(input, expectedState) {
+	const parsed = parseOAuthCallbackInput(input, {
+		invalidInput: "Paste the full redirect URL (must include code + state).",
+		missingState: "Missing 'state' parameter. Paste the full redirect URL."
+	});
+	if ("error" in parsed) throw new Error(parsed.error);
+	if (parsed.state !== expectedState) throw new Error("OAuth state mismatch - possible CSRF attack. Please retry login.");
+	return parsed;
+}
+function buildAuthorizeUrl(params) {
+	return `${CHUTES_AUTHORIZE_ENDPOINT}?${new URLSearchParams({
+		client_id: params.clientId,
+		redirect_uri: params.redirectUri,
+		response_type: "code",
+		scope: params.scopes.join(" "),
+		state: params.state,
+		code_challenge: params.challenge,
+		code_challenge_method: "S256"
+	}).toString()}`;
+}
+function resolveChutesExpiresAt(value, now) {
+	return resolveExpiresAtMsFromDurationSeconds(value, {
+		nowMs: now,
+		bufferMs: 300 * 1e3,
+		minRemainingMs: 3e4
+	});
+}
+async function fetchChutesUserInfo(params) {
+	const response = await (params.fetchFn ?? fetch)(CHUTES_USERINFO_ENDPOINT, { headers: { Authorization: `Bearer ${params.accessToken}` } });
+	if (!response.ok) return null;
+	const data = await response.json();
+	return data && typeof data === "object" ? data : null;
+}
+async function exchangeChutesCodeForTokens(params) {
+	const fetchFn = params.fetchFn ?? fetch;
+	const now = params.now ?? Date.now();
+	const body = new URLSearchParams(toFormUrlEncoded({
+		grant_type: "authorization_code",
+		client_id: params.app.clientId,
+		code: params.code,
+		redirect_uri: params.app.redirectUri,
+		code_verifier: params.codeVerifier
+	}));
+	if (params.app.clientSecret) body.set("client_secret", params.app.clientSecret);
+	const response = await fetchFn(CHUTES_TOKEN_ENDPOINT, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (!response.ok) {
+		const detail = await readResponseTextLimited(response, CHUTES_TOKEN_ERROR_BODY_LIMIT_BYTES).catch(() => "");
+		throw new Error(`Chutes token exchange failed: ${detail}`);
+	}
+	const data = await response.json();
+	const access = normalizeOptionalString(data.access_token);
+	const refresh = normalizeOptionalString(data.refresh_token);
+	const expires = resolveChutesExpiresAt(data.expires_in, now);
+	if (!access) throw new Error("Chutes token exchange returned no access_token");
+	if (!refresh) throw new Error("Chutes token exchange returned no refresh_token");
+	if (expires === void 0) throw new Error("Chutes token exchange returned invalid expires_in");
+	const info = await fetchChutesUserInfo({
+		accessToken: access,
+		fetchFn
+	});
+	return {
+		access,
+		refresh,
+		expires,
+		email: info?.username,
+		accountId: info?.sub,
+		clientId: params.app.clientId
+	};
+}
+/** Runs Chutes OAuth and returns refreshable stored credentials. */
+async function loginChutes(params) {
+	const { verifier, challenge } = generatePkceVerifierChallenge();
+	const state = params.createState?.() ?? randomBytes(16).toString("hex");
+	const timeoutMs = params.timeoutMs ?? 180 * 1e3;
+	const url = buildAuthorizeUrl({
+		clientId: params.app.clientId,
+		redirectUri: params.app.redirectUri,
+		scopes: params.app.scopes,
+		state,
+		challenge
+	});
+	let codeAndState;
+	if (params.manual) {
+		await params.onAuth({ url });
+		params.onProgress?.("Waiting for redirect URL...");
+		codeAndState = parseManualOAuthInput(await params.onPrompt({
+			message: "Paste the redirect URL",
+			placeholder: `${params.app.redirectUri}?code=...&state=...`
+		}), state);
+	} else {
+		const redirect = parseRedirectUri(params.app.redirectUri);
+		const callback = waitForLocalOAuthCallback({
+			expectedState: state,
+			timeoutMs,
+			port: redirect.port,
+			callbackPath: redirect.pathname,
+			redirectUri: params.app.redirectUri,
+			successTitle: "Chutes OAuth complete",
+			hostname: redirect.hostname,
+			onProgress: params.onProgress
+		}).catch(async () => {
+			params.onProgress?.("OAuth callback not detected; paste redirect URL...");
+			return parseManualOAuthInput(await params.onPrompt({
+				message: "Paste the redirect URL",
+				placeholder: `${params.app.redirectUri}?code=...&state=...`
+			}), state);
+		});
+		await params.onAuth({ url });
+		codeAndState = await callback;
+	}
+	params.onProgress?.("Exchanging code for tokens...");
+	return await exchangeChutesCodeForTokens({
+		app: params.app,
+		code: codeAndState.code,
+		codeVerifier: verifier,
+		fetchFn: params.fetchFn
+	});
+}
+//#endregion
+export { loginChutes };

package/dist/onboard.js

@@ -0,0 +1,62 @@
+import { CHUTES_BASE_URL, CHUTES_DEFAULT_MODEL_REF, CHUTES_MODEL_CATALOG, buildChutesModelDefinition } from "./models.js";
+import { applyAgentDefaultModelPrimary, applyProviderConfigWithModelCatalogPreset } from "openclaw/plugin-sdk/provider-onboard";
+//#region extensions/chutes/onboard.ts
+/**
+* Chutes onboarding config helpers for OAuth and API-key setup.
+*/
+/**
+* Apply Chutes provider configuration without changing the default model.
+* Registers all catalog models and sets provider aliases (chutes-fast, etc.).
+*/
+function applyChutesProviderConfig(cfg) {
+	return applyProviderConfigWithModelCatalogPreset(cfg, {
+		providerId: "chutes",
+		api: "openai-completions",
+		baseUrl: CHUTES_BASE_URL,
+		catalogModels: CHUTES_MODEL_CATALOG.map(buildChutesModelDefinition),
+		aliases: [
+			...CHUTES_MODEL_CATALOG.map((model) => `chutes/${model.id}`),
+			{
+				modelRef: "chutes-fast",
+				alias: "chutes/zai-org/GLM-4.7-FP8"
+			},
+			{
+				modelRef: "chutes-vision",
+				alias: "chutes/chutesai/Mistral-Small-3.2-24B-Instruct-2506"
+			},
+			{
+				modelRef: "chutes-pro",
+				alias: "chutes/deepseek-ai/DeepSeek-V3.2-TEE"
+			}
+		]
+	});
+}
+/**
+* Apply Chutes provider configuration AND set Chutes as the default model.
+*/
+function applyChutesConfig(cfg) {
+	const next = applyChutesProviderConfig(cfg);
+	return {
+		...next,
+		agents: {
+			...next.agents,
+			defaults: {
+				...next.agents?.defaults,
+				model: {
+					primary: CHUTES_DEFAULT_MODEL_REF,
+					fallbacks: ["chutes/deepseek-ai/DeepSeek-V3.2-TEE", "chutes/Qwen/Qwen3-32B"]
+				},
+				imageModel: {
+					primary: "chutes/chutesai/Mistral-Small-3.2-24B-Instruct-2506",
+					fallbacks: ["chutes/chutesai/Mistral-Small-3.1-24B-Instruct-2503"]
+				}
+			}
+		}
+	};
+}
+/** Applies Chutes provider config and sets the default model for API-key auth. */
+function applyChutesApiKeyConfig(cfg) {
+	return applyAgentDefaultModelPrimary(applyChutesProviderConfig(cfg), CHUTES_DEFAULT_MODEL_REF);
+}
+//#endregion
+export { CHUTES_DEFAULT_MODEL_REF, applyChutesApiKeyConfig, applyChutesConfig, applyChutesProviderConfig };

package/dist/provider-catalog.js

@@ -0,0 +1,25 @@
+import { CHUTES_BASE_URL, CHUTES_MODEL_CATALOG, buildChutesModelDefinition, discoverChutesModels } from "./models.js";
+//#region extensions/chutes/provider-catalog.ts
+/** Builds the static Chutes provider catalog from bundled model metadata. */
+function buildStaticChutesProvider() {
+	return {
+		baseUrl: CHUTES_BASE_URL,
+		api: "openai-completions",
+		models: CHUTES_MODEL_CATALOG.map(buildChutesModelDefinition)
+	};
+}
+/**
+* Build the Chutes provider with dynamic model discovery.
+* Falls back to the static catalog on failure.
+* Accepts an optional access token (API key or OAuth access token) for authenticated discovery.
+*/
+async function buildChutesProvider(accessToken) {
+	const models = await discoverChutesModels(accessToken);
+	return {
+		baseUrl: CHUTES_BASE_URL,
+		api: "openai-completions",
+		models: models.length > 0 ? models : CHUTES_MODEL_CATALOG.map(buildChutesModelDefinition)
+	};
+}
+//#endregion
+export { buildChutesProvider, buildStaticChutesProvider };

package/npm-shrinkwrap.json

@@ -0,0 +1,12 @@
+{
+  "name": "@openclaw/chutes-provider",
+  "version": "2026.6.9",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "@openclaw/chutes-provider",
+      "version": "2026.6.9"
+    }
+  }
+}