@ouro.bot/cli 0.1.0-alpha.56 → 0.1.0-alpha.560

package/dist/heart/provider-credentials.js

@@ -0,0 +1,425 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_CREDENTIAL_POOL_NOT_LOADED_ERROR = void 0;
+exports.splitProviderCredentialFields = splitProviderCredentialFields;
+exports.providerCredentialsVaultPath = providerCredentialsVaultPath;
+exports.providerCredentialItemName = providerCredentialItemName;
+exports.providerCredentialMachineHomeDir = providerCredentialMachineHomeDir;
+exports.isProviderCredentialPoolNotLoaded = isProviderCredentialPoolNotLoaded;
+exports.readProviderCredentialPool = readProviderCredentialPool;
+exports.refreshProviderCredentialPool = refreshProviderCredentialPool;
+exports.createProviderCredentialRecord = createProviderCredentialRecord;
+exports.cacheProviderCredentialRecords = cacheProviderCredentialRecords;
+exports.readCachedProviderCredentialRecord = readCachedProviderCredentialRecord;
+exports.readProviderCredentialRecord = readProviderCredentialRecord;
+exports.upsertProviderCredential = upsertProviderCredential;
+exports.redactProviderCredentialPool = redactProviderCredentialPool;
+exports.summarizeProviderCredentialPool = summarizeProviderCredentialPool;
+exports.resetProviderCredentialCache = resetProviderCredentialCache;
+const crypto = __importStar(require("node:crypto"));
+const os = __importStar(require("node:os"));
+const runtime_1 = require("../nerves/runtime");
+const credential_access_1 = require("../repertoire/credential-access");
+const VALID_PROVIDERS = ["azure", "minimax", "anthropic", "openai-codex", "github-copilot"];
+const VALID_PROVENANCE_SOURCES = ["auth-flow", "manual"];
+const VAULT_ITEM_PREFIX = "providers/";
+exports.PROVIDER_CREDENTIAL_POOL_NOT_LOADED_ERROR = "provider credentials have not been loaded from vault";
+const PROVIDER_FIELD_SPLITS = {
+    anthropic: {
+        credentials: ["setupToken", "refreshToken", "expiresAt"],
+        config: [],
+    },
+    "openai-codex": {
+        credentials: ["oauthAccessToken", "refreshToken", "expiresAt"],
+        config: [],
+    },
+    azure: {
+        credentials: ["apiKey"],
+        config: ["endpoint", "deployment", "apiVersion", "managedIdentityClientId"],
+    },
+    minimax: {
+        credentials: ["apiKey"],
+        config: [],
+    },
+    "github-copilot": {
+        credentials: ["githubToken"],
+        config: ["baseUrl"],
+    },
+};
+let cachedPools = new Map();
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isAgentProvider(value) {
+    return VALID_PROVIDERS.includes(value);
+}
+function isProvenanceSource(value) {
+    return typeof value === "string" && VALID_PROVENANCE_SOURCES.includes(value);
+}
+function isCredentialValue(value) {
+    return typeof value === "string" || typeof value === "number";
+}
+function isPresentCredentialValue(value) {
+    if (!isCredentialValue(value))
+        return false;
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    return Number.isFinite(value) && value !== 0;
+}
+function isMissingProviderCredentialError(message, itemName) {
+    const normalized = message.toLowerCase();
+    return normalized.includes(itemName.toLowerCase())
+        && (normalized.includes("no credential found") || normalized.includes("missing") || normalized.includes("not found"));
+}
+function copyKnownFields(source, fields) {
+    const result = {};
+    for (const field of fields) {
+        const value = source[field];
+        if (isPresentCredentialValue(value)) {
+            result[field] = value;
+        }
+    }
+    return result;
+}
+function splitProviderCredentialFields(provider, rawConfig) {
+    const fields = PROVIDER_FIELD_SPLITS[provider];
+    return {
+        credentials: copyKnownFields(rawConfig, fields.credentials),
+        config: copyKnownFields(rawConfig, fields.config),
+    };
+}
+function providerCredentialsVaultPath(agentName) {
+    return `vault:${agentName}:${VAULT_ITEM_PREFIX}*`;
+}
+function providerCredentialItemName(provider) {
+    return `${VAULT_ITEM_PREFIX}${provider}`;
+}
+function providerCredentialMachineHomeDir(homeDir) {
+    return homeDir ?? os.homedir();
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (isRecord(value)) {
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function makeRevision(payload) {
+    const hash = crypto
+        .createHash("sha256")
+        .update(stableJson({
+        provider: payload.provider,
+        credentials: payload.credentials,
+        config: payload.config,
+        provenance: payload.provenance,
+        updatedAt: payload.updatedAt,
+    }))
+        .digest("hex")
+        .slice(0, 16);
+    return `vault_${hash}`;
+}
+function validateProviderCredentialPayload(value, expectedProvider) {
+    if (!isRecord(value))
+        throw new Error("provider credential payload must be an object");
+    if (value.schemaVersion !== 1)
+        throw new Error("provider credential payload schemaVersion must be 1");
+    if (value.kind !== "provider-credential")
+        throw new Error("provider credential payload kind must be provider-credential");
+    if (typeof value.provider !== "string" || !isAgentProvider(value.provider)) {
+        throw new Error("provider credential payload provider must be valid");
+    }
+    if (expectedProvider && value.provider !== expectedProvider) {
+        throw new Error(`provider credential payload provider must be ${expectedProvider}`);
+    }
+    if (typeof value.updatedAt !== "string" || value.updatedAt.length === 0) {
+        throw new Error("provider credential payload updatedAt must be non-empty");
+    }
+    if (!isRecord(value.credentials))
+        throw new Error("provider credential payload credentials must be an object");
+    if (!isRecord(value.config))
+        throw new Error("provider credential payload config must be an object");
+    for (const [field, fieldValue] of Object.entries(value.credentials)) {
+        if (!isCredentialValue(fieldValue))
+            throw new Error(`credentials.${field} must be a string or number`);
+    }
+    for (const [field, fieldValue] of Object.entries(value.config)) {
+        if (!isCredentialValue(fieldValue))
+            throw new Error(`config.${field} must be a string or number`);
+    }
+    if (!isRecord(value.provenance))
+        throw new Error("provider credential payload provenance must be an object");
+    if (!isProvenanceSource(value.provenance.source)) {
+        throw new Error("provider credential payload provenance.source must be auth-flow or manual");
+    }
+    if (typeof value.provenance.updatedAt !== "string" || value.provenance.updatedAt.length === 0) {
+        throw new Error("provider credential payload provenance.updatedAt must be non-empty");
+    }
+    return value;
+}
+function recordFromPayload(payload) {
+    return {
+        provider: payload.provider,
+        revision: makeRevision(payload),
+        updatedAt: payload.updatedAt,
+        credentials: { ...payload.credentials },
+        config: { ...payload.config },
+        provenance: { ...payload.provenance },
+    };
+}
+function missingPool(agentName, error = exports.PROVIDER_CREDENTIAL_POOL_NOT_LOADED_ERROR) {
+    return {
+        ok: false,
+        reason: "missing",
+        poolPath: providerCredentialsVaultPath(agentName),
+        error,
+    };
+}
+function isProviderCredentialPoolNotLoaded(result) {
+    return !result.ok
+        && result.reason === "missing"
+        && result.error === exports.PROVIDER_CREDENTIAL_POOL_NOT_LOADED_ERROR;
+}
+function cacheResult(agentName, result) {
+    cachedPools.set(agentName, result);
+    return result;
+}
+function selectedProviders(providers) {
+    if (!providers || providers.length === 0)
+        return [...VALID_PROVIDERS];
+    return [...new Set(providers)];
+}
+function resultForProvider(poolResult, provider) {
+    if (!poolResult.ok)
+        return poolResult;
+    const record = poolResult.pool.providers[provider];
+    if (!record) {
+        return {
+            ok: false,
+            reason: "missing",
+            poolPath: poolResult.poolPath,
+            error: `${provider} credentials are missing from ${poolResult.poolPath}`,
+        };
+    }
+    return { ok: true, poolPath: poolResult.poolPath, record };
+}
+function readProviderCredentialPool(agentName) {
+    return cachedPools.get(agentName) ?? missingPool(agentName);
+}
+async function refreshProviderCredentialPool(agentName, options = {}) {
+    const providersToRead = selectedProviders(options.providers);
+    try {
+        const store = (0, credential_access_1.getCredentialStore)(agentName);
+        options.onProgress?.(`reading vault items for ${agentName}...`);
+        const providers = {};
+        let updatedAt = new Date(0).toISOString();
+        for (const provider of providersToRead) {
+            const itemName = providerCredentialItemName(provider);
+            options.onProgress?.(`reading ${provider} credentials...`);
+            let raw;
+            try {
+                raw = await store.getRawSecret(itemName, "password");
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                if (isMissingProviderCredentialError(message, itemName))
+                    continue;
+                throw error;
+            }
+            const payload = validateProviderCredentialPayload(JSON.parse(raw), provider);
+            const record = recordFromPayload(payload);
+            providers[provider] = record;
+            if (record.updatedAt > updatedAt)
+                updatedAt = record.updatedAt;
+        }
+        options.onProgress?.("parsing provider credentials...");
+        const pool = {
+            schemaVersion: 1,
+            updatedAt,
+            providers,
+        };
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.provider_credentials_loaded",
+            message: "loaded provider credentials from vault",
+            meta: {
+                agentName,
+                providerCount: Object.keys(providers).length,
+                requestedProviderCount: providersToRead.length,
+                cacheSkipped: options.skipCache === true,
+            },
+        });
+        const result = {
+            ok: true,
+            poolPath: providerCredentialsVaultPath(agentName),
+            pool,
+        };
+        return options.skipCache ? result : cacheResult(agentName, result);
+    }
+    catch (error) {
+        const cached = cachedPools.get(agentName);
+        const result = {
+            ok: false,
+            reason: "unavailable",
+            poolPath: providerCredentialsVaultPath(agentName),
+            error: error instanceof Error ? error.message : String(error),
+        };
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "config/identity",
+            event: "config.provider_credentials_unavailable",
+            message: "provider credentials unavailable",
+            meta: { agentName, reason: result.reason, poolPath: result.poolPath },
+        });
+        if (options.preserveCachedOnFailure && cached?.ok)
+            return cached;
+        return options.skipCache ? result : cacheResult(agentName, result);
+    }
+}
+function createProviderCredentialRecord(input) {
+    const updatedAt = (input.now ?? new Date()).toISOString();
+    const payload = {
+        schemaVersion: 1,
+        kind: "provider-credential",
+        provider: input.provider,
+        updatedAt,
+        credentials: { ...input.credentials },
+        config: { ...input.config },
+        provenance: {
+            source: input.provenance.source,
+            updatedAt,
+        },
+    };
+    return recordFromPayload(payload);
+}
+function cacheProviderCredentialRecords(agentName, records, now = new Date()) {
+    const providers = {};
+    let updatedAt = now.toISOString();
+    for (const record of records) {
+        providers[record.provider] = record;
+        if (record.updatedAt > updatedAt)
+            updatedAt = record.updatedAt;
+    }
+    const pool = {
+        schemaVersion: 1,
+        updatedAt,
+        providers,
+    };
+    return cacheResult(agentName, { ok: true, poolPath: providerCredentialsVaultPath(agentName), pool });
+}
+function readCachedProviderCredentialRecord(agentName, provider) {
+    return resultForProvider(readProviderCredentialPool(agentName), provider);
+}
+async function readProviderCredentialRecord(agentName, provider, options = {}) {
+    const cached = readCachedProviderCredentialRecord(agentName, provider);
+    if (cached.ok || options.refreshIfMissing === false)
+        return cached;
+    return resultForProvider(await refreshProviderCredentialPool(agentName, { providers: [provider] }), provider);
+}
+async function upsertProviderCredential(input) {
+    const updatedAt = (input.now ?? new Date()).toISOString();
+    const payload = {
+        schemaVersion: 1,
+        kind: "provider-credential",
+        provider: input.provider,
+        updatedAt,
+        credentials: { ...input.credentials },
+        config: { ...input.config },
+        provenance: {
+            source: input.provenance.source,
+            updatedAt,
+        },
+    };
+    const record = recordFromPayload(payload);
+    input.onProgress?.(`opening ${input.agentName}'s vault session...`);
+    const store = (0, credential_access_1.getCredentialStore)(input.agentName);
+    input.onProgress?.(`storing ${input.provider} credentials in ${input.agentName}'s vault...`);
+    await store.store(providerCredentialItemName(input.provider), {
+        username: input.provider,
+        password: JSON.stringify(payload),
+        notes: "Ouro provider credentials. The vault item password is a versioned JSON payload.",
+    });
+    input.onProgress?.(`refreshing in-memory provider credential pool from ${input.agentName}'s vault...`);
+    const refreshResult = await refreshProviderCredentialPool(input.agentName, {
+        providers: [input.provider],
+        onProgress: input.onProgress,
+    });
+    if (!refreshResult.ok) {
+        throw new Error(`credential stored in vault, but the in-memory provider credential pool could not be refreshed: ${refreshResult.error}. ` +
+            `Run 'ouro provider refresh --agent ${input.agentName}' after fixing vault access, then run 'ouro auth verify --agent ${input.agentName}'.`);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_credential_upserted",
+        message: "upserted provider credential record in vault",
+        meta: { agentName: input.agentName, provider: input.provider, revision: record.revision, source: record.provenance.source },
+    });
+    return record;
+}
+function redactProviderCredentialPool(pool) {
+    const providers = {};
+    for (const [provider, record] of Object.entries(pool.providers)) {
+        const redactedCredentials = {};
+        for (const key of Object.keys(record.credentials)) {
+            redactedCredentials[key] = "[redacted]";
+        }
+        providers[provider] = {
+            ...record,
+            credentials: redactedCredentials,
+            config: { ...record.config },
+            provenance: { ...record.provenance },
+        };
+    }
+    return {
+        ...pool,
+        providers,
+    };
+}
+function summarizeProviderCredentialPool(pool) {
+    return {
+        providers: Object.entries(pool.providers).map(([, record]) => ({
+            provider: record.provider,
+            revision: record.revision,
+            source: record.provenance.source,
+            updatedAt: record.updatedAt,
+            credentialFields: Object.keys(record.credentials).sort(),
+            configFields: Object.keys(record.config).sort(),
+        })),
+    };
+}
+function resetProviderCredentialCache() {
+    cachedPools = new Map();
+}