@t4h/agent-runtime 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -1
- package/dist/brain.d.ts +8 -0
- package/dist/brain.js +11 -0
- package/dist/brain.js.map +1 -1
- package/dist/env.d.ts +4 -1
- package/dist/env.js +8 -4
- package/dist/env.js.map +1 -1
- package/dist/gateway.d.ts +5 -1
- package/dist/gateway.js +4 -2
- package/dist/gateway.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/model-auth.d.ts +83 -0
- package/dist/model-auth.js +231 -0
- package/dist/model-auth.js.map +1 -0
- package/dist/start.js +2 -1
- package/dist/start.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -80,10 +80,27 @@ depois, de qualquer réplica, e só para quem perguntou.
|
|
|
80
80
|
| `GATEWAY_URL`, `KEYCLOAK_ISSUER` | obrigatórios | sem `GATEWAY_URL`: `wiring` local |
|
|
81
81
|
| `AGENT_<ID>_CLIENT_SECRET` | um por agente (hífen vira `_`) | |
|
|
82
82
|
| `GATEWAY_DEV_TOKEN` | proibido | token fixo no lugar do Keycloak |
|
|
83
|
-
| `
|
|
83
|
+
| `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID` (`ANTHROPIC_WORKSPACE_ID`) | credencial do modelo por federação (ou `ANTHROPIC_API_KEY`) | no GitHub Actions, a identidade é o OIDC do job |
|
|
84
|
+
| `ANTHROPIC_IDENTITY_SOURCE` / `ANTHROPIC_KEYCLOAK_SCOPE` / `ANTHROPIC_OIDC_AUDIENCE` | | `keycloak` (`github-actions` no Actions) / `aud-claude-console` / `https://api.anthropic.com` |
|
|
84
85
|
| `AGENTS_ASK_WAIT_MS` | | 20000, abaixo de `PROVIDER_CALL_TIMEOUT_MS` (30000) |
|
|
85
86
|
| `PORT`, `GATEWAY_JWKS_URL`, `GATEWAY_ISSUER`, `SERVICE_AUDIENCE`, mTLS | como em `loadProviderEnv()` | sem passaporte: sem conector |
|
|
86
87
|
|
|
88
|
+
## Credencial do modelo sem API key (0.3)
|
|
89
|
+
|
|
90
|
+
Com os IDs de Workload Identity Federation da Anthropic no ambiente, o runtime troca um JWT
|
|
91
|
+
por um token curto da API e o entrega ao Claude Code de cada execução
|
|
92
|
+
(`ANTHROPIC_AUTH_TOKEN`). A troca é feita uma vez, no runtime, e não em cada processo: o JWT
|
|
93
|
+
tem `jti` de uso único, e cada troca pede um JWT novo.
|
|
94
|
+
|
|
95
|
+
- **Aplicação (`keycloak`):** o client do próprio agente (`agent-<id>`) faz
|
|
96
|
+
`client_credentials` no escopo `aud-claude-console`. O agente usa o modelo com a mesma
|
|
97
|
+
identidade com que usa o gateway.
|
|
98
|
+
- **CI dos evals (`github-actions`):** o token OIDC do job (`permissions: id-token: write`),
|
|
99
|
+
sem segredo no repositório. É o padrão quando `ACTIONS_ID_TOKEN_REQUEST_URL` existe.
|
|
100
|
+
- `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, profile ou Bedrock/Vertex continuam valendo
|
|
101
|
+
(o Claude Code resolve sozinho). Uma API key junto com os IDs da federação falha no boot,
|
|
102
|
+
porque a key venceria em silêncio.
|
|
103
|
+
|
|
87
104
|
## Da 0.1 para a 0.2
|
|
88
105
|
|
|
89
106
|
- O conector (proto, handlers, catálogo) e o wiring do gateway saíram do template e
|
package/dist/brain.d.ts
CHANGED
|
@@ -14,6 +14,7 @@
|
|
|
14
14
|
*/
|
|
15
15
|
import { type McpServerConfig } from '@anthropic-ai/claude-agent-sdk';
|
|
16
16
|
import type { LoadedAgent } from './manifest.js';
|
|
17
|
+
import { type ModelAuth } from './model-auth.js';
|
|
17
18
|
import type { PolicyGate } from './policy.js';
|
|
18
19
|
import type { ResolvedSkills } from './plugins.js';
|
|
19
20
|
import type { RuntimeTools } from './runtime-tools.js';
|
|
@@ -41,8 +42,15 @@ export interface Brain {
|
|
|
41
42
|
}
|
|
42
43
|
export declare class ClaudeBrain implements Brain {
|
|
43
44
|
private readonly opts;
|
|
45
|
+
private readonly modelAuth;
|
|
46
|
+
/**
|
|
47
|
+
* `modelAuth`: de onde vem a credencial do modelo. Padrão: do ambiente
|
|
48
|
+
* (`modelAuthFromEnv`), o que cobre a federação pelo Keycloak na aplicação e pelo OIDC do
|
|
49
|
+
* GitHub nos evals da CI. `null`: deixa o Claude Code resolver sozinho.
|
|
50
|
+
*/
|
|
44
51
|
constructor(opts?: {
|
|
45
52
|
debug?: boolean;
|
|
53
|
+
modelAuth?: ModelAuth | null;
|
|
46
54
|
});
|
|
47
55
|
run(task: BrainTask): Promise<BrainResult>;
|
|
48
56
|
}
|
package/dist/brain.js
CHANGED
|
@@ -13,13 +13,21 @@
|
|
|
13
13
|
* Os testes usam um Brain roteirizado que chama o mesmo portão, sem modelo.
|
|
14
14
|
*/
|
|
15
15
|
import { query } from '@anthropic-ai/claude-agent-sdk';
|
|
16
|
+
import { childEnv, modelAuthFromEnv } from './model-auth.js';
|
|
16
17
|
function isErrorResponse(r) {
|
|
17
18
|
return typeof r === 'object' && r !== null && r.isError === true;
|
|
18
19
|
}
|
|
19
20
|
export class ClaudeBrain {
|
|
20
21
|
opts;
|
|
22
|
+
modelAuth;
|
|
23
|
+
/**
|
|
24
|
+
* `modelAuth`: de onde vem a credencial do modelo. Padrão: do ambiente
|
|
25
|
+
* (`modelAuthFromEnv`), o que cobre a federação pelo Keycloak na aplicação e pelo OIDC do
|
|
26
|
+
* GitHub nos evals da CI. `null`: deixa o Claude Code resolver sozinho.
|
|
27
|
+
*/
|
|
21
28
|
constructor(opts = {}) {
|
|
22
29
|
this.opts = opts;
|
|
30
|
+
this.modelAuth = opts.modelAuth === undefined ? modelAuthFromEnv() : (opts.modelAuth ?? undefined);
|
|
23
31
|
}
|
|
24
32
|
async run(task) {
|
|
25
33
|
const { gate } = task;
|
|
@@ -53,6 +61,8 @@ export class ClaudeBrain {
|
|
|
53
61
|
return d.allow ? { behavior: 'allow', updatedInput: input } : { behavior: 'deny', message: d.message };
|
|
54
62
|
};
|
|
55
63
|
const m = task.agent.manifest;
|
|
64
|
+
// Token curto do modelo, trocado pelo runtime (federação); sem ele, o Claude Code resolve.
|
|
65
|
+
const auth = this.modelAuth ? await this.modelAuth.env(task.agent) : undefined;
|
|
56
66
|
let text = '';
|
|
57
67
|
let costUsd = 0;
|
|
58
68
|
let turns = 0;
|
|
@@ -80,6 +90,7 @@ export class ClaudeBrain {
|
|
|
80
90
|
...(task.budgetUsd ? { maxBudgetUsd: task.budgetUsd } : {}),
|
|
81
91
|
persistSession: false,
|
|
82
92
|
abortController,
|
|
93
|
+
...(auth ? { env: childEnv(process.env, auth) } : {}),
|
|
83
94
|
...(this.opts.debug ? { stderr: (s) => process.stderr.write(s) } : {}),
|
|
84
95
|
},
|
|
85
96
|
});
|
package/dist/brain.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"brain.js","sourceRoot":"","sources":["../src/brain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAkE,MAAM,gCAAgC,CAAC;
|
|
1
|
+
{"version":3,"file":"brain.js","sourceRoot":"","sources":["../src/brain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAkE,MAAM,gCAAgC,CAAC;AAEvH,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAkB,MAAM,iBAAiB,CAAC;AA8B7E,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA2B,CAAC,OAAO,KAAK,IAAI,CAAC;AAC9F,CAAC;AAED,MAAM,OAAO,WAAW;IAQO;IAPZ,SAAS,CAAwB;IAElD;;;;OAIG;IACH,YAA6B,OAA0D,EAAE;QAA5D,SAAI,GAAJ,IAAI,CAAwD;QACvF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAe;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAErF,MAAM,UAAU,GAAiB,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC1D,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY;gBAAE,OAAO,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC;YAC1C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAA4B,EAAE,EAAE,CAAC,CAAC;YACrG,OAAO;gBACL,kBAAkB,EAAE;oBAClB,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBAC9C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC5D;aACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,WAAW,GAAiB,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,IAAI,KAAK,CAAC,eAAe,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAClG,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,KAAK,oBAAoB,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,mFAAmF;QACnF,MAAM,UAAU,GAAG,KAAK,EACtB,QAAgB,EAChB,KAA8B,EAC9B,CAAwB,EACG,EAAE;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzG,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,2FAA2F;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAyB,CAAC;QAE9B,MAAM,CAAC,GAAG,KAAK,CAAC;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACjD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1G,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;gBACnE,eAAe,EAAE,IAAI;gBACrB,cAAc,EAAE,EAAE;gBAClB,cAAc,EAAE,SAAS;gBACzB,UAAU;gBACV,KAAK,EAAE;oBACL,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvC,kBAAkB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;iBAC/C;gBACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,cAAc,EAAE,KAAK;gBACrB,eAAe;gBACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC;gBAC7B,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;gBACtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;oBAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;;oBAC5C,KAAK,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}
|
package/dist/env.d.ts
CHANGED
|
@@ -4,12 +4,13 @@
|
|
|
4
4
|
* na primeira rodada.
|
|
5
5
|
*
|
|
6
6
|
* Em produção (`NODE_ENV=production`) não há atalho: Postgres de verdade, eventos
|
|
7
|
-
* assinados, identidade própria de cada agente no Keycloak,
|
|
7
|
+
* assinados, identidade própria de cada agente no Keycloak, credencial do modelo e o conector
|
|
8
8
|
* com mTLS. Fora de produção, o que faltar cai no modo local (PGlite, eventos sem
|
|
9
9
|
* assinatura, sem conector, `wiring` de stub no lugar do gateway).
|
|
10
10
|
*/
|
|
11
11
|
import { type ProviderEnv } from '@t4h/mcp-provider-sdk';
|
|
12
12
|
import type { LoadedAgent } from './manifest.js';
|
|
13
|
+
import { type ModelAuthConfig } from './model-auth.js';
|
|
13
14
|
export interface AgentEnv {
|
|
14
15
|
nodeEnv: string;
|
|
15
16
|
isProduction: boolean;
|
|
@@ -40,6 +41,8 @@ export interface AgentEnv {
|
|
|
40
41
|
* chamada (`requireCallBinding` do SDK de providers). Desligado por padrão, como no SDK.
|
|
41
42
|
*/
|
|
42
43
|
requireCallBinding: boolean;
|
|
44
|
+
/** Credencial do modelo: nativa do Claude Code ou federação feita pelo runtime. */
|
|
45
|
+
model: ModelAuthConfig;
|
|
43
46
|
/** Quanto `agent_ask` espera a resposta antes de devolver `running`. */
|
|
44
47
|
askWaitMs: number;
|
|
45
48
|
debug: boolean;
|
package/dist/env.js
CHANGED
|
@@ -4,11 +4,12 @@
|
|
|
4
4
|
* na primeira rodada.
|
|
5
5
|
*
|
|
6
6
|
* Em produção (`NODE_ENV=production`) não há atalho: Postgres de verdade, eventos
|
|
7
|
-
* assinados, identidade própria de cada agente no Keycloak,
|
|
7
|
+
* assinados, identidade própria de cada agente no Keycloak, credencial do modelo e o conector
|
|
8
8
|
* com mTLS. Fora de produção, o que faltar cai no modo local (PGlite, eventos sem
|
|
9
9
|
* assinatura, sem conector, `wiring` de stub no lugar do gateway).
|
|
10
10
|
*/
|
|
11
11
|
import { loadProviderEnv, optionalEnv } from '@t4h/mcp-provider-sdk';
|
|
12
|
+
import { readModelAuth } from './model-auth.js';
|
|
12
13
|
import { parseEventSecrets } from './signature.js';
|
|
13
14
|
/** Padrão do gateway para cortar a chamada ao provider (`PROVIDER_CALL_TIMEOUT_MS`). */
|
|
14
15
|
export const GATEWAY_CALL_TIMEOUT_MS = 30_000;
|
|
@@ -101,9 +102,11 @@ export function loadAgentEnv(agents, env = process.env) {
|
|
|
101
102
|
};
|
|
102
103
|
}
|
|
103
104
|
// ── modelo ──────────────────────────────────────────────────────────────────────
|
|
104
|
-
const
|
|
105
|
-
|
|
106
|
-
|
|
105
|
+
const model = readModelAuth(env);
|
|
106
|
+
problems.push(...model.problems);
|
|
107
|
+
if (isProduction && model.config.mode === 'none' && !model.problems.length) {
|
|
108
|
+
problems.push('credencial do modelo é obrigatória em produção: federação (ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_SERVICE_ACCOUNT_ID) ou ANTHROPIC_API_KEY');
|
|
109
|
+
}
|
|
107
110
|
// ── conector gRPC ───────────────────────────────────────────────────────────────
|
|
108
111
|
// Em produção, sempre (e o SDK já exige mTLS). Fora dela, só se o passaporte estiver
|
|
109
112
|
// configurado; configurado pela metade, falha como em produção.
|
|
@@ -127,6 +130,7 @@ export function loadAgentEnv(agents, env = process.env) {
|
|
|
127
130
|
...(gateway ? { gateway } : {}),
|
|
128
131
|
...(connector ? { connector } : {}),
|
|
129
132
|
requireCallBinding: optionalEnv('PROVIDER_REQUIRE_CALL_BINDING', env) === '1',
|
|
133
|
+
model: model.config,
|
|
130
134
|
askWaitMs,
|
|
131
135
|
debug: optionalEnv('AGENT_DEBUG', env) === '1',
|
|
132
136
|
};
|
package/dist/env.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAEvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAwB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAuCnD,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,SAAS,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAsB,EAAE,QAAkB,EAAE,GAAG,GAAG,CAAC;IACjG,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,KAAK,YAAY,CAAC;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,mFAAmF;IACnF,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACnF,IAAI,YAAY,IAAI,CAAC,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;SACvH,IAAI,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAE7I,mFAAmF;IACnF,IAAI,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC3I,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACzH,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElG,mFAAmF;IACnF,MAAM,cAAc,GAAG,MAAM,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,SAAS,gEAAgE,cAAc,MAAM,CAAC,CAAC;IACtI,CAAC;IAED,mFAAmF;IACnF,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;YAC9C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAA4B,CAAC;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAC9G,IAAI,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAChF,IAAI,cAAc,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,6CAA6C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC,kEAAkE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG;YACR,GAAG,EAAE,UAAU;YACf,GAAG,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,aAAa;SACd,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,wKAAwK,CAAC,CAAC;IAC1L,CAAC;IAED,mFAAmF;IACnF,qFAAqF;IACrF,gEAAgE;IAChE,IAAI,SAAkC,CAAC;IACvC,IAAI,YAAY,IAAI,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC;QACvG,IAAI,CAAC;YACH,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,aAAc,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO;QACL,OAAO;QACP,YAAY;QACZ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE;QACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,EAAE,GAAG,CAAC,KAAK,GAAG;QAC7E,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,SAAS;QACT,KAAK,EAAE,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,GAAG;KAC/C,CAAC;AACJ,CAAC"}
|
package/dist/gateway.d.ts
CHANGED
|
@@ -19,14 +19,18 @@ export declare class StaticTokenSource implements TokenSource {
|
|
|
19
19
|
}
|
|
20
20
|
/** Token curto do Keycloak, renovado um minuto antes de vencer. */
|
|
21
21
|
export declare class ClientCredentialsTokenSource implements TokenSource {
|
|
22
|
+
/** `cache: false`: um token novo a cada chamada (para quem precisa de `jti` novo). */
|
|
22
23
|
private readonly cfg;
|
|
23
24
|
private readonly fetchImpl;
|
|
24
25
|
private cached?;
|
|
25
|
-
constructor(
|
|
26
|
+
constructor(
|
|
27
|
+
/** `cache: false`: um token novo a cada chamada (para quem precisa de `jti` novo). */
|
|
28
|
+
cfg: {
|
|
26
29
|
issuer: string;
|
|
27
30
|
clientId: string;
|
|
28
31
|
clientSecret: string;
|
|
29
32
|
scope?: string;
|
|
33
|
+
cache?: boolean;
|
|
30
34
|
}, fetchImpl?: typeof fetch);
|
|
31
35
|
token(): Promise<string>;
|
|
32
36
|
}
|
package/dist/gateway.js
CHANGED
|
@@ -13,13 +13,15 @@ export class ClientCredentialsTokenSource {
|
|
|
13
13
|
cfg;
|
|
14
14
|
fetchImpl;
|
|
15
15
|
cached;
|
|
16
|
-
constructor(
|
|
16
|
+
constructor(
|
|
17
|
+
/** `cache: false`: um token novo a cada chamada (para quem precisa de `jti` novo). */
|
|
18
|
+
cfg, fetchImpl = fetch) {
|
|
17
19
|
this.cfg = cfg;
|
|
18
20
|
this.fetchImpl = fetchImpl;
|
|
19
21
|
}
|
|
20
22
|
async token() {
|
|
21
23
|
const now = Date.now();
|
|
22
|
-
if (this.cached && this.cached.exp - 60_000 > now)
|
|
24
|
+
if (this.cfg.cache !== false && this.cached && this.cached.exp - 60_000 > now)
|
|
23
25
|
return this.cached.value;
|
|
24
26
|
const body = new URLSearchParams({
|
|
25
27
|
grant_type: 'client_credentials',
|
package/dist/gateway.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAeA,0FAA0F;AAC1F,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAC9C,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,4BAA4B;
|
|
1
|
+
{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAeA,0FAA0F;AAC1F,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAC9C,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,4BAA4B;IAKpB;IACA;IALX,MAAM,CAAkC;IAEhD;IACE,sFAAsF;IACrE,GAAgG,EAChG,YAA0B,KAAK;QAD/B,QAAG,GAAH,GAAG,CAA6F;QAChG,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QACxG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;QAChF,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAQD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAGnB;IAFlB,YACE,OAAe,EACC,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,OAAO,aAAa;IAIL;IACA;IAJX,GAAG,GAAG,CAAC,CAAC;IAEhB,YACmB,GAAyC,EACzC,YAA0B,KAAK;QAD/B,QAAG,GAAH,GAAG,CAAsC;QACzC,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,QAAQ,CAAC,UAAkB;QACzB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU,CAAC,WAAqB,EAAE,SAAsB,IAAI,CAAC,GAAG,CAAC,MAAM;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,WAAW,CACvB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CACtI,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,UAAkB,EAAE,MAAc,EAAE,MAAe,EAAE,SAAsB,IAAI,CAAC,GAAG,CAAC,MAAM;QACrG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE;YAChG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8D,CAAC;QAC7F,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,MAAoB;QACtD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAA2B,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,IAAY,EAAE,IAA6B;QAC5E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAwE,UAAU,EAAE,YAAY,EAAE;YACxH,IAAI;YACJ,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;CACF"}
|
package/dist/index.d.ts
CHANGED
|
@@ -42,3 +42,5 @@ export { loadEvalCases, runEvalCase, runEvals, subsetMatch } from './evals.js';
|
|
|
42
42
|
export type { EvalCase, EvalResult } from './evals.js';
|
|
43
43
|
export { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk';
|
|
44
44
|
export type { McpServerConfig } from '@anthropic-ai/claude-agent-sdk';
|
|
45
|
+
export { AnthropicFederationTokenSource, githubActionsIdentity, modelAuthFromEnv, readModelAuth, childEnv, DEFAULT_KEYCLOAK_SCOPE, DEFAULT_GITHUB_AUDIENCE, } from './model-auth.js';
|
|
46
|
+
export type { ModelAuth, ModelAuthConfig, FederationIds } from './model-auth.js';
|
package/dist/index.js
CHANGED
|
@@ -24,4 +24,5 @@ export { consoleNotifier, MemoryNotifier } from './notifier.js';
|
|
|
24
24
|
export { loadEvalCases, runEvalCase, runEvals, subsetMatch } from './evals.js';
|
|
25
25
|
// Para servir conectores em processo (stubs locais, evals) sem depender do SDK direto.
|
|
26
26
|
export { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk';
|
|
27
|
+
export { AnthropicFederationTokenSource, githubActionsIdentity, modelAuthFromEnv, readModelAuth, childEnv, DEFAULT_KEYCLOAK_SCOPE, DEFAULT_GITHUB_AUDIENCE, } from './model-auth.js';
|
|
27
28
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGtH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGlG,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1H,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EACL,aAAa,EACb,YAAY,EACZ,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGpJ,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGrF,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG/E,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGtH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGlG,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1H,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EACL,aAAa,EACb,YAAY,EACZ,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGpJ,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGrF,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG/E,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AAG1E,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,QAAQ,EACR,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC"}
|
|
@@ -0,0 +1,83 @@
|
|
|
1
|
+
import { type TokenSource } from './gateway.js';
|
|
2
|
+
import type { LoadedAgent } from './manifest.js';
|
|
3
|
+
export declare const ANTHROPIC_BASE_URL = "https://api.anthropic.com";
|
|
4
|
+
/** Escopo do Keycloak que põe `aud: claude-console` no token (o mesmo que o Hub usa). */
|
|
5
|
+
export declare const DEFAULT_KEYCLOAK_SCOPE = "aud-claude-console";
|
|
6
|
+
/** Audience do token OIDC do GitHub Actions (padrão da Anthropic para esse provedor). */
|
|
7
|
+
export declare const DEFAULT_GITHUB_AUDIENCE = "https://api.anthropic.com";
|
|
8
|
+
export interface FederationIds {
|
|
9
|
+
organizationId: string;
|
|
10
|
+
federationRuleId: string;
|
|
11
|
+
serviceAccountId: string;
|
|
12
|
+
/** Obrigatório quando a regra vale para mais de um workspace. */
|
|
13
|
+
workspaceId?: string;
|
|
14
|
+
}
|
|
15
|
+
export type ModelAuthConfig =
|
|
16
|
+
/** O Claude Code resolve sozinho (API key, token, profile, federação por arquivo, nuvem). */
|
|
17
|
+
{
|
|
18
|
+
mode: 'native';
|
|
19
|
+
source: string;
|
|
20
|
+
} | {
|
|
21
|
+
mode: 'federation';
|
|
22
|
+
identity: 'keycloak';
|
|
23
|
+
ids: FederationIds;
|
|
24
|
+
baseUrl: string;
|
|
25
|
+
keycloak: {
|
|
26
|
+
issuer?: string;
|
|
27
|
+
scope: string;
|
|
28
|
+
};
|
|
29
|
+
} | {
|
|
30
|
+
mode: 'federation';
|
|
31
|
+
identity: 'github-actions';
|
|
32
|
+
ids: FederationIds;
|
|
33
|
+
baseUrl: string;
|
|
34
|
+
audience: string;
|
|
35
|
+
}
|
|
36
|
+
/** Nada configurado: só vale fora de produção (login local do Claude Code). */
|
|
37
|
+
| {
|
|
38
|
+
mode: 'none';
|
|
39
|
+
};
|
|
40
|
+
/**
|
|
41
|
+
* Lê a configuração da credencial do modelo. Devolve também os problemas, para o
|
|
42
|
+
* `loadAgentEnv` juntar com os outros e falhar no boot.
|
|
43
|
+
*/
|
|
44
|
+
export declare function readModelAuth(env?: NodeJS.ProcessEnv): {
|
|
45
|
+
config: ModelAuthConfig;
|
|
46
|
+
problems: string[];
|
|
47
|
+
};
|
|
48
|
+
/** Um JWT novo do GitHub Actions a cada chamada (o do job vale ~5 min e tem `jti`). */
|
|
49
|
+
export declare function githubActionsIdentity(audience: string, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): () => Promise<string>;
|
|
50
|
+
/**
|
|
51
|
+
* Token da API da Claude por federação, guardado até 2 min antes de vencer. Cada troca
|
|
52
|
+
* pede um JWT novo a `identity` e nunca repete um que já foi apresentado.
|
|
53
|
+
*/
|
|
54
|
+
export declare class AnthropicFederationTokenSource implements TokenSource {
|
|
55
|
+
private readonly cfg;
|
|
56
|
+
private readonly identity;
|
|
57
|
+
private readonly fetchImpl;
|
|
58
|
+
private readonly now;
|
|
59
|
+
private cached?;
|
|
60
|
+
private inflight?;
|
|
61
|
+
constructor(cfg: {
|
|
62
|
+
ids: FederationIds;
|
|
63
|
+
baseUrl?: string;
|
|
64
|
+
label: string;
|
|
65
|
+
}, identity: () => Promise<string>, fetchImpl?: typeof fetch, now?: () => number);
|
|
66
|
+
token(): Promise<string>;
|
|
67
|
+
private exchange;
|
|
68
|
+
}
|
|
69
|
+
/** O que o `ClaudeBrain` pede antes de cada execução: variáveis a mais para o Claude Code. */
|
|
70
|
+
export interface ModelAuth {
|
|
71
|
+
env(agent: LoadedAgent): Promise<Record<string, string>>;
|
|
72
|
+
}
|
|
73
|
+
/**
|
|
74
|
+
* Credencial do modelo a partir do ambiente. `undefined` quando o Claude Code resolve
|
|
75
|
+
* sozinho (ou, fora de produção, com o login local dele). Lança se a configuração for
|
|
76
|
+
* inválida; o `loadAgentEnv` já pegou isso no boot.
|
|
77
|
+
*/
|
|
78
|
+
export declare function modelAuthFromEnv(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): ModelAuth | undefined;
|
|
79
|
+
/**
|
|
80
|
+
* Ambiente do processo do Claude Code: o do host, sem o que faria sombra ao token trocado
|
|
81
|
+
* aqui, mais as variáveis da credencial.
|
|
82
|
+
*/
|
|
83
|
+
export declare function childEnv(base: NodeJS.ProcessEnv, extra: Record<string, string>): Record<string, string>;
|
|
@@ -0,0 +1,231 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Credencial do modelo sem API key: Workload Identity Federation da Anthropic.
|
|
3
|
+
*
|
|
4
|
+
* O runtime troca um JWT de um provedor de identidade em que a Anthropic confia por um
|
|
5
|
+
* token curto da API (`sk-ant-oat01-…`) e o entrega ao Claude Code de cada execução como
|
|
6
|
+
* `ANTHROPIC_AUTH_TOKEN`. Dois provedores:
|
|
7
|
+
*
|
|
8
|
+
* - `keycloak` (a aplicação): o client do próprio agente (`agent-<id>`) faz
|
|
9
|
+
* client_credentials no escopo `aud-claude-console`. O modelo é usado com a mesma
|
|
10
|
+
* identidade com que o agente usa o gateway.
|
|
11
|
+
* - `github-actions` (CI dos evals): o token OIDC do job, sem segredo guardado no repo.
|
|
12
|
+
*
|
|
13
|
+
* A troca é feita aqui, uma vez, e não em cada processo do Claude Code: o JWT tem `jti` de
|
|
14
|
+
* uso único na Anthropic, e cada processo apresentando o mesmo JWT seria recusado como
|
|
15
|
+
* replay. Cada troca pede um JWT novo ao provedor.
|
|
16
|
+
*
|
|
17
|
+
* Com `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_PROFILE`,
|
|
18
|
+
* `ANTHROPIC_IDENTITY_TOKEN[_FILE]` ou Bedrock/Vertex no ambiente, o runtime não interfere:
|
|
19
|
+
* o Claude Code resolve sozinho.
|
|
20
|
+
*/
|
|
21
|
+
import { optionalEnv } from '@t4h/mcp-provider-sdk';
|
|
22
|
+
import { agentSecretVar } from './env.js';
|
|
23
|
+
import { ClientCredentialsTokenSource } from './gateway.js';
|
|
24
|
+
export const ANTHROPIC_BASE_URL = 'https://api.anthropic.com';
|
|
25
|
+
/** Escopo do Keycloak que põe `aud: claude-console` no token (o mesmo que o Hub usa). */
|
|
26
|
+
export const DEFAULT_KEYCLOAK_SCOPE = 'aud-claude-console';
|
|
27
|
+
/** Audience do token OIDC do GitHub Actions (padrão da Anthropic para esse provedor). */
|
|
28
|
+
export const DEFAULT_GITHUB_AUDIENCE = 'https://api.anthropic.com';
|
|
29
|
+
/** Variáveis que não podem chegar ao Claude Code junto com o token trocado aqui. */
|
|
30
|
+
const SHADOWING_VARS = [
|
|
31
|
+
'ANTHROPIC_API_KEY',
|
|
32
|
+
'ANTHROPIC_PROFILE',
|
|
33
|
+
'ANTHROPIC_FEDERATION_RULE_ID',
|
|
34
|
+
'ANTHROPIC_ORGANIZATION_ID',
|
|
35
|
+
'ANTHROPIC_SERVICE_ACCOUNT_ID',
|
|
36
|
+
'ANTHROPIC_WORKSPACE_ID',
|
|
37
|
+
'ANTHROPIC_IDENTITY_TOKEN',
|
|
38
|
+
'ANTHROPIC_IDENTITY_TOKEN_FILE',
|
|
39
|
+
];
|
|
40
|
+
const NATIVE = [
|
|
41
|
+
'ANTHROPIC_API_KEY',
|
|
42
|
+
'ANTHROPIC_AUTH_TOKEN',
|
|
43
|
+
'ANTHROPIC_PROFILE',
|
|
44
|
+
'ANTHROPIC_IDENTITY_TOKEN_FILE',
|
|
45
|
+
'ANTHROPIC_IDENTITY_TOKEN',
|
|
46
|
+
'CLAUDE_CODE_USE_BEDROCK',
|
|
47
|
+
'CLAUDE_CODE_USE_VERTEX',
|
|
48
|
+
];
|
|
49
|
+
/**
|
|
50
|
+
* Lê a configuração da credencial do modelo. Devolve também os problemas, para o
|
|
51
|
+
* `loadAgentEnv` juntar com os outros e falhar no boot.
|
|
52
|
+
*/
|
|
53
|
+
export function readModelAuth(env = process.env) {
|
|
54
|
+
const problems = [];
|
|
55
|
+
const ids = {
|
|
56
|
+
organizationId: optionalEnv('ANTHROPIC_ORGANIZATION_ID', env),
|
|
57
|
+
federationRuleId: optionalEnv('ANTHROPIC_FEDERATION_RULE_ID', env),
|
|
58
|
+
serviceAccountId: optionalEnv('ANTHROPIC_SERVICE_ACCOUNT_ID', env),
|
|
59
|
+
};
|
|
60
|
+
const anyId = Object.values(ids).some(Boolean);
|
|
61
|
+
const native = NATIVE.find((k) => optionalEnv(k, env));
|
|
62
|
+
// Com a variável nativa, o Claude Code usa ela e ignora a federação em silêncio.
|
|
63
|
+
if (native && anyId && !native.startsWith('ANTHROPIC_IDENTITY_TOKEN')) {
|
|
64
|
+
problems.push(`${native} e a federação (ANTHROPIC_FEDERATION_RULE_ID…) ao mesmo tempo: ${native} venceria em silêncio; deixe só um`);
|
|
65
|
+
}
|
|
66
|
+
if (native)
|
|
67
|
+
return { config: { mode: 'native', source: native }, problems };
|
|
68
|
+
if (!anyId)
|
|
69
|
+
return { config: { mode: 'none' }, problems };
|
|
70
|
+
const missing = Object.entries({
|
|
71
|
+
ANTHROPIC_ORGANIZATION_ID: ids.organizationId,
|
|
72
|
+
ANTHROPIC_FEDERATION_RULE_ID: ids.federationRuleId,
|
|
73
|
+
ANTHROPIC_SERVICE_ACCOUNT_ID: ids.serviceAccountId,
|
|
74
|
+
})
|
|
75
|
+
.filter(([, v]) => !v)
|
|
76
|
+
.map(([k]) => k);
|
|
77
|
+
if (missing.length) {
|
|
78
|
+
problems.push(`federação do modelo pela metade: falta ${missing.join(', ')}`);
|
|
79
|
+
return { config: { mode: 'none' }, problems };
|
|
80
|
+
}
|
|
81
|
+
const fed = {
|
|
82
|
+
organizationId: ids.organizationId,
|
|
83
|
+
federationRuleId: ids.federationRuleId,
|
|
84
|
+
serviceAccountId: ids.serviceAccountId,
|
|
85
|
+
...(optionalEnv('ANTHROPIC_WORKSPACE_ID', env) ? { workspaceId: optionalEnv('ANTHROPIC_WORKSPACE_ID', env) } : {}),
|
|
86
|
+
};
|
|
87
|
+
const baseUrl = (optionalEnv('ANTHROPIC_BASE_URL', env) ?? ANTHROPIC_BASE_URL).replace(/\/$/, '');
|
|
88
|
+
const inActions = Boolean(optionalEnv('ACTIONS_ID_TOKEN_REQUEST_URL', env));
|
|
89
|
+
const identity = optionalEnv('ANTHROPIC_IDENTITY_SOURCE', env) ?? (inActions ? 'github-actions' : 'keycloak');
|
|
90
|
+
if (identity === 'github-actions') {
|
|
91
|
+
if (!inActions || !optionalEnv('ACTIONS_ID_TOKEN_REQUEST_TOKEN', env)) {
|
|
92
|
+
problems.push('ANTHROPIC_IDENTITY_SOURCE=github-actions sem o token OIDC do job: dê `permissions: id-token: write` ao job');
|
|
93
|
+
}
|
|
94
|
+
return {
|
|
95
|
+
config: { mode: 'federation', identity, ids: fed, baseUrl, audience: optionalEnv('ANTHROPIC_OIDC_AUDIENCE', env) ?? DEFAULT_GITHUB_AUDIENCE },
|
|
96
|
+
problems,
|
|
97
|
+
};
|
|
98
|
+
}
|
|
99
|
+
if (identity === 'keycloak') {
|
|
100
|
+
const issuer = optionalEnv('KEYCLOAK_ISSUER', env);
|
|
101
|
+
if (!issuer)
|
|
102
|
+
problems.push('federação do modelo pelo Keycloak sem KEYCLOAK_ISSUER');
|
|
103
|
+
return {
|
|
104
|
+
config: {
|
|
105
|
+
mode: 'federation',
|
|
106
|
+
identity,
|
|
107
|
+
ids: fed,
|
|
108
|
+
baseUrl,
|
|
109
|
+
keycloak: { ...(issuer ? { issuer } : {}), scope: optionalEnv('ANTHROPIC_KEYCLOAK_SCOPE', env) ?? DEFAULT_KEYCLOAK_SCOPE },
|
|
110
|
+
},
|
|
111
|
+
problems,
|
|
112
|
+
};
|
|
113
|
+
}
|
|
114
|
+
problems.push(`ANTHROPIC_IDENTITY_SOURCE="${identity}" inválido: use keycloak ou github-actions`);
|
|
115
|
+
return { config: { mode: 'none' }, problems };
|
|
116
|
+
}
|
|
117
|
+
/** Um JWT novo do GitHub Actions a cada chamada (o do job vale ~5 min e tem `jti`). */
|
|
118
|
+
export function githubActionsIdentity(audience, env = process.env, fetchImpl = fetch) {
|
|
119
|
+
return async () => {
|
|
120
|
+
const url = optionalEnv('ACTIONS_ID_TOKEN_REQUEST_URL', env);
|
|
121
|
+
const bearer = optionalEnv('ACTIONS_ID_TOKEN_REQUEST_TOKEN', env);
|
|
122
|
+
if (!url || !bearer)
|
|
123
|
+
throw new Error('sem o token OIDC do GitHub Actions: o job precisa de `permissions: id-token: write`');
|
|
124
|
+
const res = await fetchImpl(`${url}&audience=${encodeURIComponent(audience)}`, { headers: { authorization: `Bearer ${bearer}` } });
|
|
125
|
+
if (!res.ok)
|
|
126
|
+
throw new Error(`GitHub recusou o token OIDC: HTTP ${res.status}`);
|
|
127
|
+
const { value } = (await res.json());
|
|
128
|
+
if (!value)
|
|
129
|
+
throw new Error('GitHub devolveu o token OIDC vazio');
|
|
130
|
+
return value;
|
|
131
|
+
};
|
|
132
|
+
}
|
|
133
|
+
/**
|
|
134
|
+
* Token da API da Claude por federação, guardado até 2 min antes de vencer. Cada troca
|
|
135
|
+
* pede um JWT novo a `identity` e nunca repete um que já foi apresentado.
|
|
136
|
+
*/
|
|
137
|
+
export class AnthropicFederationTokenSource {
|
|
138
|
+
cfg;
|
|
139
|
+
identity;
|
|
140
|
+
fetchImpl;
|
|
141
|
+
now;
|
|
142
|
+
cached;
|
|
143
|
+
inflight;
|
|
144
|
+
constructor(cfg, identity, fetchImpl = fetch, now = Date.now) {
|
|
145
|
+
this.cfg = cfg;
|
|
146
|
+
this.identity = identity;
|
|
147
|
+
this.fetchImpl = fetchImpl;
|
|
148
|
+
this.now = now;
|
|
149
|
+
}
|
|
150
|
+
token() {
|
|
151
|
+
if (this.cached && this.cached.exp - 120_000 > this.now())
|
|
152
|
+
return Promise.resolve(this.cached.value);
|
|
153
|
+
// Duas execuções ao mesmo tempo esperam a mesma troca, em vez de gastar dois JWT.
|
|
154
|
+
this.inflight ??= this.exchange().finally(() => (this.inflight = undefined));
|
|
155
|
+
return this.inflight;
|
|
156
|
+
}
|
|
157
|
+
async exchange() {
|
|
158
|
+
const { ids } = this.cfg;
|
|
159
|
+
const started = this.now();
|
|
160
|
+
const res = await this.fetchImpl(`${(this.cfg.baseUrl ?? ANTHROPIC_BASE_URL).replace(/\/$/, '')}/v1/oauth/token`, {
|
|
161
|
+
method: 'POST',
|
|
162
|
+
headers: { 'content-type': 'application/json' },
|
|
163
|
+
body: JSON.stringify({
|
|
164
|
+
grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
|
|
165
|
+
assertion: await this.identity(),
|
|
166
|
+
federation_rule_id: ids.federationRuleId,
|
|
167
|
+
organization_id: ids.organizationId,
|
|
168
|
+
service_account_id: ids.serviceAccountId,
|
|
169
|
+
...(ids.workspaceId ? { workspace_id: ids.workspaceId } : {}),
|
|
170
|
+
}),
|
|
171
|
+
});
|
|
172
|
+
if (!res.ok) {
|
|
173
|
+
// O 401 da Anthropic é opaco de propósito; o motivo fica no histórico de autenticação do Console.
|
|
174
|
+
const requestId = res.headers.get('request-id');
|
|
175
|
+
throw new Error(`Anthropic recusou a federação de ${this.cfg.label}: HTTP ${res.status}${requestId ? ` (request-id ${requestId})` : ''}`);
|
|
176
|
+
}
|
|
177
|
+
const json = (await res.json());
|
|
178
|
+
if (!json.access_token || !json.expires_in)
|
|
179
|
+
throw new Error(`Anthropic devolveu a federação de ${this.cfg.label} sem token`);
|
|
180
|
+
this.cached = { value: json.access_token, exp: started + json.expires_in * 1000 };
|
|
181
|
+
return json.access_token;
|
|
182
|
+
}
|
|
183
|
+
}
|
|
184
|
+
/**
|
|
185
|
+
* Credencial do modelo a partir do ambiente. `undefined` quando o Claude Code resolve
|
|
186
|
+
* sozinho (ou, fora de produção, com o login local dele). Lança se a configuração for
|
|
187
|
+
* inválida; o `loadAgentEnv` já pegou isso no boot.
|
|
188
|
+
*/
|
|
189
|
+
export function modelAuthFromEnv(env = process.env, fetchImpl = fetch) {
|
|
190
|
+
const { config, problems } = readModelAuth(env);
|
|
191
|
+
if (problems.length)
|
|
192
|
+
throw new Error(`credencial do modelo: ${problems.join('; ')}`);
|
|
193
|
+
if (config.mode !== 'federation')
|
|
194
|
+
return undefined;
|
|
195
|
+
if (config.identity === 'github-actions') {
|
|
196
|
+
const shared = new AnthropicFederationTokenSource({ ids: config.ids, baseUrl: config.baseUrl, label: 'GitHub Actions' }, githubActionsIdentity(config.audience, env, fetchImpl), fetchImpl);
|
|
197
|
+
return { env: async () => ({ ANTHROPIC_AUTH_TOKEN: await shared.token() }) };
|
|
198
|
+
}
|
|
199
|
+
// Keycloak: cada agente com o próprio client, como no gateway.
|
|
200
|
+
const { issuer, scope } = config.keycloak;
|
|
201
|
+
const perAgent = new Map();
|
|
202
|
+
return {
|
|
203
|
+
env: async (agent) => {
|
|
204
|
+
const id = agent.manifest.id;
|
|
205
|
+
let source = perAgent.get(id);
|
|
206
|
+
if (!source) {
|
|
207
|
+
const secret = optionalEnv(agentSecretVar(id), env);
|
|
208
|
+
if (!issuer || !secret)
|
|
209
|
+
throw new Error(`${id}: a federação do modelo pelo Keycloak precisa de KEYCLOAK_ISSUER e ${agentSecretVar(id)}`);
|
|
210
|
+
const clientId = agent.manifest.identity.clientId ?? `agent-${id}`;
|
|
211
|
+
// Sem cache: cada troca na Anthropic precisa de um JWT com `jti` novo.
|
|
212
|
+
const keycloak = new ClientCredentialsTokenSource({ issuer, clientId, clientSecret: secret, scope, cache: false }, fetchImpl);
|
|
213
|
+
source = new AnthropicFederationTokenSource({ ids: config.ids, baseUrl: config.baseUrl, label: clientId }, () => keycloak.token(), fetchImpl);
|
|
214
|
+
perAgent.set(id, source);
|
|
215
|
+
}
|
|
216
|
+
return { ANTHROPIC_AUTH_TOKEN: await source.token() };
|
|
217
|
+
},
|
|
218
|
+
};
|
|
219
|
+
}
|
|
220
|
+
/**
|
|
221
|
+
* Ambiente do processo do Claude Code: o do host, sem o que faria sombra ao token trocado
|
|
222
|
+
* aqui, mais as variáveis da credencial.
|
|
223
|
+
*/
|
|
224
|
+
export function childEnv(base, extra) {
|
|
225
|
+
const out = {};
|
|
226
|
+
for (const [k, v] of Object.entries(base))
|
|
227
|
+
if (v !== undefined && !SHADOWING_VARS.includes(k))
|
|
228
|
+
out[k] = v;
|
|
229
|
+
return { ...out, ...extra };
|
|
230
|
+
}
|
|
231
|
+
//# sourceMappingURL=model-auth.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"model-auth.js","sourceRoot":"","sources":["../src/model-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAoB,MAAM,cAAc,CAAC;AAG9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAC3D,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAEnE,oFAAoF;AACpF,MAAM,cAAc,GAAG;IACrB,mBAAmB;IACnB,mBAAmB;IACnB,8BAA8B;IAC9B,2BAA2B;IAC3B,8BAA8B;IAC9B,wBAAwB;IACxB,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC;AAkBF,MAAM,MAAM,GAAG;IACb,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,+BAA+B;IAC/B,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG;QACV,cAAc,EAAE,WAAW,CAAC,2BAA2B,EAAE,GAAG,CAAC;QAC7D,gBAAgB,EAAE,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC;QAClE,gBAAgB,EAAE,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC;KACnE,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,iFAAiF;IACjF,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,kEAAkE,MAAM,oCAAoC,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,yBAAyB,EAAE,GAAG,CAAC,cAAc;QAC7C,4BAA4B,EAAE,GAAG,CAAC,gBAAgB;QAClD,4BAA4B,EAAE,GAAG,CAAC,gBAAgB;KACnD,CAAC;SACC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAkB;QACzB,cAAc,EAAE,GAAG,CAAC,cAAe;QACnC,gBAAgB,EAAE,GAAG,CAAC,gBAAiB;QACvC,gBAAgB,EAAE,GAAG,CAAC,gBAAiB;QACvC,GAAG,CAAC,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpH,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,WAAW,CAAC,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAE9G,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,IAAI,uBAAuB,EAAE;YAC7I,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACpF,OAAO;YACL,MAAM,EAAE;gBACN,IAAI,EAAE,YAAY;gBAClB,QAAQ;gBACR,GAAG,EAAE,GAAG;gBACR,OAAO;gBACP,QAAQ,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,0BAA0B,EAAE,GAAG,CAAC,IAAI,sBAAsB,EAAE;aAC3H;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,8BAA8B,QAAQ,4CAA4C,CAAC,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAE,YAA0B,KAAK;IAC3H,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QAC5H,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA8B;IAKtB;IACA;IACA;IACA;IAPX,MAAM,CAAkC;IACxC,QAAQ,CAAmB;IAEnC,YACmB,GAA4D,EAC5D,QAA+B,EAC/B,YAA0B,KAAK,EAC/B,MAAoB,IAAI,CAAC,GAAG;QAH5B,QAAG,GAAH,GAAG,CAAyD;QAC5D,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,cAAS,GAAT,SAAS,CAAsB;QAC/B,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrG,kFAAkF;QAClF,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,EAAE;YAChH,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,QAAQ,EAAE;gBAChC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB;gBACxC,eAAe,EAAE,GAAG,CAAC,cAAc;gBACnC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB;gBACxC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,kGAAkG;YAClG,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,GAAG,CAAC,KAAK,UAAU,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5I,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC;QAC7H,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAOD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,YAA0B,KAAK;IACpG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAEnD,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,8BAA8B,CAC/C,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EACrE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,EACtD,SAAS,CACV,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,+DAA+D;IAC/D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;IACnE,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sEAAsE,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzI,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,SAAS,EAAE,EAAE,CAAC;gBACnE,uEAAuE;gBACvE,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC9H,MAAM,GAAG,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;gBAC9I,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,EAAE,oBAAoB,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,KAA6B;IAC7E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1G,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AAC9B,CAAC"}
|
package/dist/start.js
CHANGED
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
*/
|
|
14
14
|
import { createProviderServer, loadProviderContract } from '@t4h/mcp-provider-sdk';
|
|
15
15
|
import { ClaudeBrain } from './brain.js';
|
|
16
|
+
import { modelAuthFromEnv } from './model-auth.js';
|
|
16
17
|
import { agentsConnectorHandlers, agentsProtoPath, AGENTS_SERVICE_FQN } from './connector.js';
|
|
17
18
|
import { loadAgentEnv } from './env.js';
|
|
18
19
|
import { AgentHost } from './host.js';
|
|
@@ -38,7 +39,7 @@ export async function startAgents(opts) {
|
|
|
38
39
|
const host = new AgentHost({
|
|
39
40
|
agents,
|
|
40
41
|
store,
|
|
41
|
-
brain: opts.brain ?? new ClaudeBrain({ debug: env.debug }),
|
|
42
|
+
brain: opts.brain ?? new ClaudeBrain({ debug: env.debug, modelAuth: modelAuthFromEnv(opts.env ?? process.env) ?? null }),
|
|
42
43
|
notifier: opts.notifier ?? consoleNotifier,
|
|
43
44
|
...(opts.pluginsDir ? { pluginsDir: opts.pluginsDir } : {}),
|
|
44
45
|
askWaitMs: env.askWaitMs,
|
package/dist/start.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"start.js","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAiB,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAC;AA6BzD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACzI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,uJAAuJ,CAAC,CAAC;IACxK,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC;QACzB,MAAM;QACN,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"start.js","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAiB,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAC;AA6BzD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACzI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,uJAAuJ,CAAC,CAAC;IACxK,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC;QACzB,MAAM;QACN,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACxH,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe;QAC1C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc;QACzC,GAAG,MAAM;KACV,CAAC,CAAC;IAEH,IAAI,QAAoC,CAAC;IACzC,IAAI,aAAiC,CAAC;IACtC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;YAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB;YAC/C,UAAU,EAAE,GAAG,CAAC,YAAY;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,oBAAoB,CAAC;gBACpC,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC;gBACvC,QAAQ,EAAE,MAAM,oBAAoB,CAAC,eAAe,EAAE,EAAE,kBAAkB,CAAC;gBAC3E,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;gBAChC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB;gBACrE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,aAAa,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC;IACV,CAAC;IAED,OAAO,CAAC,IAAI,CACV,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE;QACnF,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjF,CAAC;IAEF,IAAI,QAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,sCAAsC;QACtC,MAAM,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,EAAE,CAAC,CAAC;IAER,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC;gBACtC,qDAAqD;gBACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,EAAE,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,CAAC,EAAE,EAAE;oBACJ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AACpG,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@t4h/agent-runtime",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "Runtime dos colaboradores digitais (agentes de IA) da Tech for Humans: manifesto agent.yaml, caixa de entrada de eventos, rodadas, níveis de autonomia por rotina com disjuntor, memória curta (SQLite) e longa (Postgres), acesso aos sistemas pelo Enterprise MCP Gateway com a identidade própria do agente, o conector agents_<círculo> e o boot do processo (startAgents).",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"engines": {
|