@ponythewhite/base-context 1.0.0 → 1.0.1

package/dist/core/auth-storage.js

@@ -6,14 +6,13 @@
  * try to refresh tokens simultaneously.
  */
 import { createHash } from "node:crypto";
-import { findEnvKeys, getEnvApiKey, getPrimeTeamId, } from "@ponythewhite/base-context-ai";
+import { findEnvKeys, getEnvApiKey, } from "@ponythewhite/base-context-ai";
 import { getOAuthApiKey, getOAuthProvider, getOAuthProviders } from "@ponythewhite/base-context-ai/oauth";
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import lockfile from "proper-lockfile";
 import { getAgentDir } from "../config.js";
 import { assertProductStatePath } from "../runtime-paths.js";
-import { clearPrimeCliCredentials, getPrimeCliConfigPath, loadPrimeCliConfig, PRIME_INFERENCE_PROVIDER_ID, savePrimeCliApiKey, savePrimeCliTeamSelection, } from "./prime-inference-auth.js";
 import { getProviderAuthContract, isProviderApiKeyAllowed } from "./provider-contracts.js";
 import { resolveConfigValue, resolveConfigValueUncached } from "./resolve-config-value.js";
 export class FileAuthStorageBackend {
@@ -160,7 +159,6 @@ export class InMemoryAuthStorageBackend {
  */
 export class AuthStorage {
     storage;
-    options;
     existingOpenAICodexSubscription;
     data = {};
     runtimeOverrides = new Map();
@@ -168,23 +166,21 @@ export class AuthStorage {
     fallbackResolver;
     loadError = null;
     errors = [];
-    constructor(storage, options = {}, existingOpenAICodexSubscription = false) {
+    constructor(storage, existingOpenAICodexSubscription = false) {
         this.storage = storage;
-        this.options = options;
         this.existingOpenAICodexSubscription = existingOpenAICodexSubscription;
         this.reload();
     }
-    static create(authPath, options) {
-        const authOptions = options ?? { usePrimeCliConfig: authPath === undefined };
-        return new AuthStorage(new FileAuthStorageBackend(authPath ?? join(getAgentDir(), "auth.json")), authOptions);
+    static create(authPath) {
+        return new AuthStorage(new FileAuthStorageBackend(authPath ?? join(getAgentDir(), "auth.json")));
     }
     /** Reuse an existing host login only through an explicitly read-only backend.
-     * This does not authorize this distribution's OAuth login or refresh client.
+     * This SDK mode never logs in, writes credentials, or refreshes tokens.
      */
     static fromStorage(storage, options) {
         const existing = options?.existingOpenAICodexSubscription === true;
         if (!existing)
-            return new AuthStorage(storage, options);
+            return new AuthStorage(storage);
         if (storage instanceof FileAuthStorageBackend)
             throw new Error("Existing OpenAI subscription requires a read-only auth backend");
         const readOnly = {
@@ -199,7 +195,7 @@ export class AuthStorage {
                 throw new Error("Existing OpenAI subscription refresh is disabled");
             },
         };
-        return new AuthStorage(readOnly, { ...options, usePrimeCliConfig: false }, true);
+        return new AuthStorage(readOnly, true);
     }
     isExistingOpenAICodexSubscription(provider) {
         return this.existingOpenAICodexSubscription && provider === "openai-codex";
@@ -208,10 +204,10 @@ export class AuthStorage {
         if (this.existingOpenAICodexSubscription)
             throw new Error("Existing OpenAI subscription storage is read-only");
     }
-    static inMemory(data = {}, options) {
+    static inMemory(data = {}) {
         const storage = new InMemoryAuthStorageBackend();
         storage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));
-        return AuthStorage.fromStorage(storage, options);
+        return AuthStorage.fromStorage(storage);
     }
     /**
      * Set a runtime API key override (not persisted to disk).
@@ -282,7 +278,7 @@ export class AuthStorage {
         }
         if (this.isExistingOpenAICodexSubscription(providerId))
             return `oauth:${credential.access}\0${credential.expires}`;
-        if (getProviderAuthContract(providerId).oauth !== "validated") {
+        if (getProviderAuthContract(providerId).oauth !== "supported") {
             return undefined;
         }
         const provider = getOAuthProvider(providerId);
@@ -304,26 +300,11 @@ export class AuthStorage {
             }),
         };
     }
-    getPrimeCliAuthCandidate(provider) {
-        const apiKey = this.getPrimeCliApiKey(provider);
-        if (!apiKey) {
-            return undefined;
-        }
-        return {
-            label: "Base Context provider config",
-            ...this.createAuthSourceCandidate({
-                configured: false,
-                source: "prime_cli",
-                identityMaterial: provider,
-                valueMaterial: apiKey,
-            }),
-        };
-    }
     getStoredAuthCandidate(provider, options) {
         const credential = this.data[provider];
         if (!credential ||
             (credential.type === "oauth" &&
-                getProviderAuthContract(provider).oauth !== "validated" &&
+                getProviderAuthContract(provider).oauth !== "supported" &&
                 !this.isExistingOpenAICodexSubscription(provider))) {
             return undefined;
         }
@@ -352,12 +333,11 @@ export class AuthStorage {
         });
     }
     getEnvironmentApiKey(provider) {
-        // The generic resolver prefers ANTHROPIC_OAUTH_TOKEN, an unavailable subscription route.
-        const apiKey = provider === "anthropic" ? process.env.ANTHROPIC_API_KEY : getEnvApiKey(provider);
+        const apiKey = getEnvApiKey(provider);
         return apiKey && isProviderApiKeyAllowed(provider, apiKey) ? apiKey : undefined;
     }
     getEnvironmentAuthCandidate(provider) {
-        const envKeys = findEnvKeys(provider)?.filter((key) => key !== "ANTHROPIC_OAUTH_TOKEN");
+        const envKeys = findEnvKeys(provider);
         const envKey = envKeys?.[0];
         const apiKey = this.getEnvironmentApiKey(provider);
         if (!apiKey) {
@@ -416,20 +396,12 @@ export class AuthStorage {
     }
     getAuthSourceCandidates(provider, options) {
         const fallbackCandidate = options?.includeFallback === false ? undefined : this.getFallbackAuthCandidate(provider);
-        const candidates = provider === PRIME_INFERENCE_PROVIDER_ID
-            ? [
-                this.getRuntimeAuthCandidate(provider),
-                this.getEnvironmentAuthCandidate(provider),
-                this.getPrimeCliAuthCandidate(provider),
-                this.getStoredAuthCandidate(provider),
-                fallbackCandidate,
-            ]
-            : [
-                this.getRuntimeAuthCandidate(provider),
-                this.getStoredAuthCandidate(provider),
-                this.getEnvironmentAuthCandidate(provider),
-                fallbackCandidate,
-            ];
+        const candidates = [
+            this.getRuntimeAuthCandidate(provider),
+            this.getStoredAuthCandidate(provider),
+            this.getEnvironmentAuthCandidate(provider),
+            fallbackCandidate,
+        ];
         return candidates.filter((candidate) => candidate !== undefined);
     }
     isAuthSourceStale(provider, candidate) {
@@ -655,7 +627,7 @@ export class AuthStorage {
     async login(providerId, callbacks) {
         this.assertWritableStorage();
         const contract = getProviderAuthContract(providerId);
-        if (contract.oauth !== "validated") {
+        if (contract.oauth !== "supported") {
             throw new Error(contract.guidance);
         }
         const provider = getOAuthProvider(providerId);
@@ -669,16 +641,6 @@ export class AuthStorage {
      * Logout from a provider.
      */
     logout(provider) {
-        if (provider === PRIME_INFERENCE_PROVIDER_ID && this.isPrimeCliConfigEnabled()) {
-            try {
-                clearPrimeCliCredentials(this.getEnabledPrimeCliConfigPath());
-                this.clearStaleAuthSource(provider, "prime_cli");
-            }
-            catch (error) {
-                this.recordError(error);
-                throw error;
-            }
-        }
         this.remove(provider);
     }
     /**
@@ -686,7 +648,7 @@ export class AuthStorage {
      * Multiple pi instances may try to refresh simultaneously when tokens expire.
      */
     async refreshOAuthTokenWithLock(providerId) {
-        if (getProviderAuthContract(providerId).oauth !== "validated") {
+        if (getProviderAuthContract(providerId).oauth !== "supported") {
             return null;
         }
         const provider = getOAuthProvider(providerId);
@@ -698,7 +660,7 @@ export class AuthStorage {
             this.data = currentData;
             this.loadError = null;
             const cred = currentData[providerId];
-            if (cred?.type !== "oauth" || getProviderAuthContract(providerId).oauth !== "validated") {
+            if (cred?.type !== "oauth" || getProviderAuthContract(providerId).oauth !== "supported") {
                 return { result: null };
             }
             if (Date.now() < cred.expires) {
@@ -728,8 +690,8 @@ export class AuthStorage {
      * Get API key for a provider.
      * Priority:
      * 1. Runtime override (CLI --api-key)
-     * 2. Prime Inference: environment variable, Base Context provider config, auth.json
-     * 3. Other providers: auth.json, environment variable
+     * 2. auth.json
+     * 3. Environment variable
      * 4. Fallback resolver (models.json custom providers)
      */
     async getApiKeyWithSourceToken(providerId, options) {
@@ -762,27 +724,6 @@ export class AuthStorage {
                 sourceToken: this.getAuthSourceTokenForCandidate(providerId, runtimeCandidate),
             };
         }
-        const envCandidate = this.getEnvironmentAuthCandidate(providerId);
-        const envKey = this.getEnvironmentApiKey(providerId);
-        if (providerId === PRIME_INFERENCE_PROVIDER_ID &&
-            envKey &&
-            envCandidate &&
-            !this.isAuthSourceStale(providerId, envCandidate)) {
-            return {
-                apiKey: envKey,
-                sourceToken: this.getAuthSourceTokenForCandidate(providerId, envCandidate),
-            };
-        }
-        if (providerId === PRIME_INFERENCE_PROVIDER_ID) {
-            const primeCliCandidate = this.getPrimeCliAuthCandidate(providerId);
-            const primeCliKey = this.getPrimeCliApiKey(providerId);
-            if (primeCliKey && primeCliCandidate && !this.isAuthSourceStale(providerId, primeCliCandidate)) {
-                return {
-                    apiKey: primeCliKey,
-                    sourceToken: this.getAuthSourceTokenForCandidate(providerId, primeCliCandidate),
-                };
-            }
-        }
         const cred = this.data[providerId];
         if (cred?.type === "api_key") {
             const storedCandidate = this.getStoredAuthCandidate(providerId);
@@ -802,7 +743,7 @@ export class AuthStorage {
                 }
             }
         }
-        if (cred?.type === "oauth" && getProviderAuthContract(providerId).oauth === "validated") {
+        if (cred?.type === "oauth" && getProviderAuthContract(providerId).oauth === "supported") {
             const storedCandidate = this.getStoredAuthCandidate(providerId);
             if (storedCandidate && !this.isAuthSourceStale(providerId, storedCandidate)) {
                 const provider = getOAuthProvider(providerId);
@@ -830,7 +771,7 @@ export class AuthStorage {
                         this.reload();
                         const updatedCred = this.data[providerId];
                         if (updatedCred?.type === "oauth" &&
-                            getProviderAuthContract(providerId).oauth === "validated" &&
+                            getProviderAuthContract(providerId).oauth === "supported" &&
                             Date.now() < updatedCred.expires) {
                             const updatedCandidate = this.getStoredAuthCandidate(providerId);
                             return {
@@ -852,11 +793,9 @@ export class AuthStorage {
                 }
             }
         }
-        // Stored auth wins over environment variables for non-Prime-Inference providers.
-        if (providerId !== PRIME_INFERENCE_PROVIDER_ID &&
-            envKey &&
-            envCandidate &&
-            !this.isAuthSourceStale(providerId, envCandidate)) {
+        const envCandidate = this.getEnvironmentAuthCandidate(providerId);
+        const envKey = this.getEnvironmentApiKey(providerId);
+        if (envKey && envCandidate && !this.isAuthSourceStale(providerId, envCandidate)) {
             return {
                 apiKey: envKey,
                 sourceToken: this.getAuthSourceTokenForCandidate(providerId, envCandidate),
@@ -881,161 +820,12 @@ export class AuthStorage {
         return result.apiKey;
     }
     /**
-     * Get registered OAuth providers validated for this distribution.
+     * Get supported registered OAuth providers. Read-only SDK storage cannot log in.
      */
     getOAuthProviders() {
-        return getOAuthProviders().filter((provider) => getProviderAuthContract(provider.id).oauth === "validated");
-    }
-    setPrimeInferenceTeamSelection(team) {
-        if (this.isPrimeCliConfigEnabled()) {
-            try {
-                savePrimeCliTeamSelection(team, this.getEnabledPrimeCliConfigPath());
-            }
-            catch (error) {
-                this.recordError(error);
-                throw error;
-            }
-            return;
-        }
-        const credential = this.data[PRIME_INFERENCE_PROVIDER_ID];
-        if (credential?.type !== "api_key") {
-            return;
-        }
-        this.set(PRIME_INFERENCE_PROVIDER_ID, {
-            ...credential,
-            primeTeam: team ? this.toPrimeTeamCredential(team) : null,
-        });
-    }
-    setPrimeInferenceApiKey(apiKey) {
-        if (this.isPrimeCliConfigEnabled()) {
-            try {
-                const configPath = this.getEnabledPrimeCliConfigPath();
-                const config = loadPrimeCliConfig(configPath);
-                const existingCredential = this.data[PRIME_INFERENCE_PROVIDER_ID];
-                const legacyPrimeTeam = existingCredential?.type === "api_key" ? existingCredential.primeTeam : undefined;
-                if (config.apiKey !== apiKey) {
-                    savePrimeCliApiKey(apiKey, configPath);
-                }
-                else if (!config.teamIdFromEnv && (legacyPrimeTeam === null || (!config.teamId && legacyPrimeTeam))) {
-                    savePrimeCliTeamSelection(legacyPrimeTeam, configPath);
-                }
-                this.clearStaleAuthSource(PRIME_INFERENCE_PROVIDER_ID, "prime_cli");
-            }
-            catch (error) {
-                this.recordError(error);
-                throw error;
-            }
-            if (this.data[PRIME_INFERENCE_PROVIDER_ID]) {
-                this.remove(PRIME_INFERENCE_PROVIDER_ID);
-            }
-            return;
-        }
-        const existingCredential = this.data[PRIME_INFERENCE_PROVIDER_ID];
-        const existingPrimeTeam = existingCredential?.type === "api_key" ? existingCredential.primeTeam : undefined;
-        this.set(PRIME_INFERENCE_PROVIDER_ID, {
-            type: "api_key",
-            key: apiKey,
-            ...(existingPrimeTeam !== undefined ? { primeTeam: existingPrimeTeam } : {}),
-        });
-    }
-    getPrimeInferenceTeamSelection() {
-        if (getPrimeTeamId()) {
-            return undefined;
-        }
-        let config;
-        if (this.isPrimeCliConfigEnabled()) {
-            config = this.getPrimeCliConfig(PRIME_INFERENCE_PROVIDER_ID);
-            if (config?.teamIdFromEnv) {
-                return undefined;
-            }
-        }
-        const credential = this.data[PRIME_INFERENCE_PROVIDER_ID];
-        const authSource = this.getAuthStatus(PRIME_INFERENCE_PROVIDER_ID).source;
-        if (authSource === "runtime" || authSource === "environment") {
-            return undefined;
-        }
-        if (authSource === "prime_cli") {
-            if (credential?.type === "api_key" && credential.primeTeam === null) {
-                return null;
-            }
-            if (config?.teamId) {
-                return this.toPrimeTeamCredential({
-                    teamId: config.teamId,
-                    name: config.teamName ?? "Prime Inference team",
-                    ...(config.teamRole ? { role: config.teamRole } : {}),
-                });
-            }
-            if (credential?.type === "api_key" && credential.primeTeam) {
-                return credential.primeTeam;
-            }
-            return null;
-        }
-        if (credential?.type === "api_key" && credential.primeTeam !== undefined) {
-            return credential.primeTeam;
-        }
-        if (!config?.apiKey && config?.teamId) {
-            return this.toPrimeTeamCredential({
-                teamId: config.teamId,
-                name: config.teamName ?? "Prime Inference team",
-                ...(config.teamRole ? { role: config.teamRole } : {}),
-            });
-        }
-        return undefined;
-    }
-    getProviderHeaders(providerId) {
-        if (providerId !== PRIME_INFERENCE_PROVIDER_ID) {
-            return undefined;
-        }
-        const environmentTeamId = getPrimeTeamId();
-        if (environmentTeamId) {
-            return { "X-Prime-Team-ID": environmentTeamId };
-        }
-        const teamId = this.getPrimeInferenceTeamSelection()?.teamId;
-        return teamId ? { "X-Prime-Team-ID": teamId } : undefined;
-    }
-    getPrimeCliConfigPath() {
-        if (!this.isPrimeCliConfigEnabled()) {
-            return undefined;
-        }
-        return getPrimeCliConfigPath(this.options.primeCliConfigPath);
-    }
-    toPrimeTeamCredential(team) {
-        const credential = {
-            teamId: team.teamId,
-            name: team.name,
-        };
-        if (team.slug) {
-            credential.slug = team.slug;
-        }
-        if (team.role) {
-            credential.role = team.role;
-        }
-        if (team.createdAt) {
-            credential.createdAt = team.createdAt;
-        }
-        return credential;
-    }
-    getPrimeCliConfig(providerId) {
-        if (providerId !== PRIME_INFERENCE_PROVIDER_ID) {
-            return undefined;
-        }
-        if (!this.isPrimeCliConfigEnabled()) {
-            return undefined;
-        }
-        return loadPrimeCliConfig(this.options.primeCliConfigPath);
-    }
-    getPrimeCliApiKey(providerId) {
-        return this.getPrimeCliConfig(providerId)?.apiKey;
-    }
-    getEnabledPrimeCliConfigPath() {
-        const configPath = this.getPrimeCliConfigPath();
-        if (!configPath) {
-            throw new Error("Base Context Prime Inference config is not enabled");
-        }
-        return configPath;
-    }
-    isPrimeCliConfigEnabled() {
-        return Boolean(this.options.usePrimeCliConfig || this.options.primeCliConfigPath);
+        if (this.existingOpenAICodexSubscription)
+            return [];
+        return getOAuthProviders().filter((provider) => getProviderAuthContract(provider.id).oauth === "supported");
     }
 }
 //# sourceMappingURL=auth-storage.js.map