@sriinnu/kosha-discovery 0.5.0

package/dist/credentials/resolver.d.ts

@@ -0,0 +1,170 @@
+/**
+ * kosha-discovery — Multi-source credential resolver.
+ *
+ * Implements a layered search strategy to locate API keys and
+ * access tokens for each supported provider.  The search hierarchy is:
+ *
+ *   1. **Explicit config** — key passed directly via `KoshaConfig.providers`
+ *   2. **Environment variables** — e.g. `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`
+ *   3. **CLI tool credential files** — Claude CLI, Copilot, Codex, Gemini CLI
+ *   4. **Config / OAuth files** — `~/.config/*`, gcloud ADC, `~/.aws/*`
+ *   5. **CLI subprocess** — `gcloud auth print-access-token` etc.
+ *
+ * The resolver returns the **first** credential found and never throws.
+ * If nothing is found, `{ source: "none" }` is returned.
+ * @module
+ */
+import type { CredentialResult } from "../types.js";
+/**
+ * Multi-source credential resolver for AI providers.
+ *
+ * Resolution priority per provider:
+ *   1. Explicit config key (passed programmatically)
+ *   2. Environment variables
+ *   3. CLI tool credential files (Claude CLI, Copilot, Gemini CLI, etc.)
+ *   4. Config / OAuth files (~/.config/*)
+ *
+ * Always returns a {@link CredentialResult}; never throws.
+ */
+export declare class CredentialResolver {
+    private readonly home;
+    private readonly isWindows;
+    /**
+     * Resolve credentials for the given provider.
+     *
+     * @param providerId  - Provider slug (e.g. "anthropic", "openai").
+     * @param explicitKey - Optional API key passed from user config; takes
+     *                      highest precedence when provided.
+     * @returns The first credential found, or `{ source: "none" }`.
+     */
+    resolve(providerId: string, explicitKey?: string): Promise<CredentialResult>;
+    /**
+     * Search hierarchy for Anthropic credentials:
+     *   1. Explicit config key
+     *   2. `ANTHROPIC_API_KEY` env var
+     *   3. `~/.claude.json` (Claude CLI)
+     *   4. `~/.config/claude/settings.json` (Claude CLI settings)
+     *   5. `~/.claude/credentials.json` (Claude CLI OAuth)
+     *   6. `~/.codex/auth.json` (Codex CLI — stores Anthropic keys)
+     */
+    private resolveAnthropic;
+    /**
+     * Search hierarchy for OpenAI credentials:
+     *   1. Explicit config key
+     *   2. `OPENAI_API_KEY` env var
+     *   3. GitHub Copilot `hosts.json` (contains an OAuth token usable with OpenAI-compatible APIs)
+     *   4. GitHub Copilot `apps.json` (alternative credential location)
+     */
+    private resolveOpenAI;
+    /**
+     * Search hierarchy for Google / Gemini credentials:
+     *   1. Explicit config key
+     *   2. `GOOGLE_API_KEY` or `GEMINI_API_KEY` env var
+     *   3. Gemini CLI `~/.gemini/credentials.json`
+     *   4. gcloud Application Default Credentials (ADC)
+     */
+    private resolveGoogle;
+    /**
+     * Search hierarchy for OpenRouter credentials:
+     *   1. Explicit config key
+     *   2. `OPENROUTER_API_KEY` env var
+     *   (No known CLI tool stores OpenRouter keys on disk.)
+     */
+    private resolveOpenRouter;
+    /**
+     * Ollama runs locally and never requires authentication.
+     * Returns `{ source: "none" }` unconditionally.
+     */
+    private resolveOllama;
+    /**
+     * Search hierarchy for AWS Bedrock credentials:
+     *   1. Explicit config key (`config.providers.bedrock.apiKey` or `config.providers.aws.apiKey`)
+     *   2. `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` env vars (both must be present)
+     *   3. `AWS_PROFILE` env var — signals a named profile in `~/.aws/credentials`
+     *   4. `~/.aws/credentials` — reads the `[default]` profile's `aws_access_key_id`
+     *   5. `~/.aws/config` — detects SSO or IAM role configuration (presence check only)
+     *
+     * The returned `metadata.region` is resolved from (in order):
+     *   `AWS_DEFAULT_REGION` → `AWS_REGION` → `region` in `~/.aws/config [default]` → `"us-east-1"`
+     *
+     * @param explicitKey - Optional AWS access key ID passed from user config.
+     * @returns Resolved credential with `key` (access key ID or sentinel) and `metadata.region`.
+     */
+    private resolveBedrockCredential;
+    /**
+     * Resolve the effective AWS region from environment variables or the
+     * parsed `~/.aws/config` content.
+     *
+     * Priority: `AWS_DEFAULT_REGION` → `AWS_REGION` → `region` in `[default]`
+     * profile of the provided config text → `"us-east-1"` fallback.
+     *
+     * @param awsConfigRaw - Optional raw text of `~/.aws/config` already read by the caller.
+     * @returns The resolved region string.
+     */
+    private resolveAwsRegion;
+    /**
+     * Parse a single named section from an AWS INI-format file.
+     *
+     * AWS credential/config files use INI syntax with `[section]` headers and
+     * `key = value` pairs. This parser is intentionally minimal: it only extracts
+     * key-value pairs belonging to the requested section and ignores all others.
+     *
+     * @param text        - Raw file content.
+     * @param sectionName - Section header to extract (without brackets), e.g. `"default"`.
+     * @returns A map of key → value strings found within the section, or `{}` if not found.
+     */
+    private parseAwsIniSection;
+    /**
+     * Search hierarchy for GCP Vertex AI credentials:
+     *   1. Explicit config key (`config.providers.vertex.apiKey`)
+     *   2. `GOOGLE_APPLICATION_CREDENTIALS` env var — path to service account JSON
+     *   3. `~/.config/gcloud/application_default_credentials.json` (gcloud ADC)
+     *   4. `gcloud auth print-access-token` subprocess (5 s timeout)
+     *
+     * The returned `metadata` always contains `region` and optionally `projectId`
+     * resolved from (in order):
+     *   - `GOOGLE_CLOUD_PROJECT` / `GCLOUD_PROJECT` env vars
+     *   - `gcloud config get-value project` subprocess
+     *
+     * @param explicitKey - Optional explicit key or service-account path from user config.
+     * @returns Resolved credential with `key` and `metadata.{ projectId?, region }`.
+     */
+    private resolveVertexCredential;
+    /**
+     * Resolve Vertex AI metadata: GCP project ID and region.
+     *
+     * Project ID priority: `GOOGLE_CLOUD_PROJECT` → `GCLOUD_PROJECT` → `gcloud config get-value project`
+     * Region priority:     `GOOGLE_CLOUD_REGION` → `"us-central1"`
+     *
+     * @returns Metadata object with `region` (always set) and optional `projectId`.
+     */
+    private resolveVertexMetadata;
+    /**
+     * Run `gcloud auth print-access-token` and return the trimmed token.
+     * Returns `null` on any error (gcloud not installed, not authenticated, timeout, etc.).
+     */
+    private execGcloudToken;
+    /**
+     * Run `gcloud config get-value project` and return the trimmed project ID.
+     * Returns `null` on any error.
+     */
+    private execGcloudProject;
+    /**
+     * Generic resolver for providers that only need an explicit key or a single env var.
+     * Used by NVIDIA, Together AI, Fireworks AI, Groq, and Mistral AI.
+     */
+    private resolveNvidia;
+    private resolveSimpleEnvKey;
+    private resolveMultiEnvKey;
+    /** Safely read and parse a JSON file; returns null on any error. */
+    private readJson;
+    /** Safely read a text file as a string; returns null on any error. */
+    private readTextFile;
+    /** Return candidate paths for GitHub Copilot config files. */
+    private getCopilotPaths;
+    /** Return candidate paths for gcloud ADC. */
+    private getGcloudPaths;
+    /** Extract the first OAuth token from a Copilot hosts/apps JSON structure. */
+    private extractCopilotToken;
+}
+//# sourceMappingURL=resolver.d.ts.map

package/dist/credentials/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;GAUG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IAEpD;;;;;;;OAOG;IACG,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuDlF;;;;;;;;OAQG;YACW,gBAAgB;IAuD9B;;;;;;OAMG;YACW,aAAa;IA2C3B;;;;;;OAMG;YACW,aAAa;IAkD3B;;;;;OAKG;YACW,iBAAiB;IAoB/B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAQrB;;;;;;;;;;;;;OAaG;YACW,wBAAwB;IAqDtC;;;;;;;;;OASG;YACW,gBAAgB;IAsB9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IAkC1B;;;;;;;;;;;;;;OAcG;YACW,uBAAuB;IA0CrC;;;;;;;OAOG;YACW,qBAAqB;IAkBnC;;;OAGG;IACH,OAAO,CAAC,eAAe;IAavB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAkBzB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,mBAAmB;IAa3B,OAAO,CAAC,kBAAkB;IAmB1B,oEAAoE;YACtD,QAAQ;IAStB,sEAAsE;YACxD,YAAY;IAQ1B,8DAA8D;IAC9D,OAAO,CAAC,eAAe;IAiBvB,6CAA6C;IAC7C,OAAO,CAAC,cAAc;IAetB,8EAA8E;IAC9E,OAAO,CAAC,mBAAmB;CAS3B"}