@wardby/cli 0.1.0

package/dist/providers/auth/self-hosted.js

@@ -0,0 +1,377 @@
+import { createHash, randomUUID } from "node:crypto";
+import { SignJWT, jwtVerify } from "jose";
+import { z } from "zod";
+import { NotSupportedError } from "./types.js";
+import { requireSubject } from "./subject.js";
+import { SCOPES_SUPPORTED } from "../../mcp/auth/resource-server.js";
+import { canonicalUrl } from "../../mcp/transport/http-limits.js";
+import { Credentials, DAY, decodeKey, lockUser } from "../../mcp/auth/self-hosted/credentials.js";
+import { Sessions } from "../../mcp/auth/self-hosted/session.js";
+function validRedirect(value) {
+    try {
+        const u = new URL(value);
+        return (!value.includes("#") &&
+            !u.username &&
+            !u.password &&
+            (u.protocol === "https:" || (u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname))));
+    }
+    catch {
+        return false;
+    }
+}
+const registration = z
+    .object({
+    redirectUris: z.array(z.string().min(1).max(2048).refine(validRedirect)).min(1).max(10),
+    clientName: z.string().max(100).optional(),
+    grantTypes: z
+        .array(z.enum(["authorization_code", "refresh_token"]))
+        .min(1)
+        .max(2)
+        .default(["authorization_code", "refresh_token"]),
+    tokenEndpointAuthMethod: z.literal("none").default("none"),
+})
+    .strict();
+const authorization = z
+    .object({
+    clientId: z.string().max(100),
+    redirectUri: z.string().max(2048),
+    codeChallenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+    codeChallengeMethod: z.literal("S256"),
+    scope: z.string().max(512),
+    resource: z.string().max(2048),
+    state: z.string().max(1024).optional(),
+})
+    .strict();
+export class SelfHostedAuthProvider {
+    db;
+    credentials;
+    sessions;
+    config;
+    key;
+    constructor(config, db) {
+        this.db = db;
+        this.config = { ...config, canonicalUri: canonicalUrl(config.canonicalUri).href };
+        this.key = decodeKey(config.signingKey, "AUTH_SIGNING_KEY");
+        const credentialKey = decodeKey(config.credentialHashKey, "AUTH_CREDENTIAL_HASH_KEY");
+        if (this.key.equals(credentialKey))
+            throw new Error("Signing and credential hash keys must be distinct.");
+        if (!Number.isInteger(config.maxClients ?? 1000) || (config.maxClients ?? 1000) < 1)
+            throw new Error("Invalid OAuth client limit.");
+        this.credentials = new Credentials(config.credentialHashKey);
+        this.sessions = new Sessions(db, this.credentials);
+    }
+    asMetadata() {
+        const base = new URL(this.config.canonicalUri).origin;
+        return {
+            issuer: this.config.canonicalUri,
+            authorization_endpoint: base + "/authorize",
+            token_endpoint: base + "/token",
+            registration_endpoint: base + "/register",
+            revocation_endpoint: base + "/revoke",
+            response_types_supported: ["code"],
+            grant_types_supported: ["authorization_code", "refresh_token"],
+            code_challenge_methods_supported: ["S256"],
+            token_endpoint_auth_methods_supported: ["none"],
+            revocation_endpoint_auth_methods_supported: ["none"],
+            scopes_supported: SCOPES_SUPPORTED,
+            authorization_response_iss_parameter_supported: true,
+        };
+    }
+    async registerClient(params) {
+        const p = registration.parse(params);
+        return this.db.$transaction(async (tx) => {
+            await tx.$queryRawUnsafe("SELECT 1 AS locked FROM pg_advisory_xact_lock(7412901)");
+            if ((await tx.oAuthClient.count()) >= (this.config.maxClients ?? 1000))
+                throw new Error("Client capacity reached.");
+            const clientId = randomUUID();
+            await tx.oAuthClient.create({
+                data: {
+                    clientId,
+                    metadata: {
+                        redirect_uris: p.redirectUris,
+                        grant_types: p.grantTypes,
+                        client_name: p.clientName ?? "Unnamed client",
+                        token_endpoint_auth_method: "none",
+                    },
+                },
+            });
+            return { clientId };
+        });
+    }
+    async handleAuthorize(input) {
+        const p = authorization.parse(input);
+        if (p.resource !== this.config.canonicalUri)
+            throw new Error("Invalid resource.");
+        const client = await this.db.oAuthClient.findUnique({ where: { clientId: p.clientId } });
+        const metadata = client?.metadata;
+        if (!metadata?.redirect_uris?.includes(p.redirectUri) || !metadata.grant_types?.includes("authorization_code"))
+            throw new Error("Invalid client or redirect.");
+        const scope = [...new Set(p.scope.split(/\s+/).filter((s) => SCOPES_SUPPORTED.includes(s)))].join(" ");
+        const request = await this.db.oAuthAuthorizationRequest.create({
+            data: {
+                clientId: p.clientId,
+                redirectUri: p.redirectUri,
+                resource: p.resource,
+                requestedScope: scope,
+                codeChallenge: p.codeChallenge,
+                state: p.state,
+                expiresAt: new Date(Date.now() + 600_000),
+            },
+        });
+        return { interactionId: request.id };
+    }
+    async consentPage(sessionToken, interactionId) {
+        const session = await this.sessions.get(sessionToken);
+        const interaction = await this.db.oAuthAuthorizationRequest.findUnique({
+            where: { id: interactionId },
+            include: { client: true },
+        });
+        if (!interaction || interaction.consumedAt || interaction.expiresAt.getTime() <= Date.now())
+            throw new Error("Invalid interaction.");
+        const challenge = await this.sessions.challenge("consent", session.sessionId, interactionId);
+        return { interaction, challenge };
+    }
+    async consent(sessionToken, interactionId, challenge, approve) {
+        const first = await this.sessions.get(sessionToken);
+        return this.db.$transaction(async (tx) => {
+            await lockUser(tx, first.userId);
+            const session = await this.sessions.get(sessionToken, tx);
+            await this.sessions.consumeChallenge(tx, challenge, "consent", session.sessionId, interactionId);
+            const interaction = await tx.oAuthAuthorizationRequest.findUnique({ where: { id: interactionId } });
+            if (!interaction)
+                throw new Error("Invalid interaction.");
+            const used = await tx.oAuthAuthorizationRequest.updateMany({
+                where: { id: interactionId, consumedAt: null, expiresAt: { gt: new Date() } },
+                data: { consumedAt: new Date() },
+            });
+            if (used.count !== 1)
+                throw new Error("Invalid interaction.");
+            const redirect = new URL(interaction.redirectUri);
+            redirect.searchParams.set("iss", this.config.canonicalUri);
+            if (interaction.state !== null)
+                redirect.searchParams.set("state", interaction.state);
+            if (!approve)
+                redirect.searchParams.set("error", "access_denied");
+            else {
+                const code = this.credentials.create("rva");
+                await tx.oAuthAuthorizationCode.create({
+                    data: {
+                        codeId: code.id,
+                        secretHash: code.hash,
+                        clientId: interaction.clientId,
+                        userId: session.userId,
+                        redirectUri: interaction.redirectUri,
+                        resource: interaction.resource,
+                        scope: interaction.requestedScope,
+                        codeChallenge: interaction.codeChallenge,
+                        expiresAt: new Date(Date.now() + 60_000),
+                    },
+                });
+                redirect.searchParams.set("code", code.token);
+            }
+            return redirect.href;
+        });
+    }
+    async handleToken(params) {
+        if (params.resource !== undefined && !this.withinCanonical(params.resource))
+            throw new Error("Invalid grant: resource does not match the canonical URI.");
+        if (params.grantType === "authorization_code")
+            return this.exchange(params);
+        if (params.grantType === "refresh_token")
+            return this.rotate(params);
+        throw new Error("Unsupported grant.");
+    }
+    /**
+     * Whether a token request's `resource` names this server: the canonical URI
+     * itself, or a URL beneath it. The MCP SDK sends the metadata's canonical
+     * URI when it has it, but falls back to the MCP endpoint URL (e.g. `/mcp`
+     * under a root canonical URI) on refresh - rejecting that logged every
+     * Claude Code session out after one access-token lifetime. The issued
+     * token's audience still comes from the grant (code.resource /
+     * family.resource), never from this parameter.
+     */
+    withinCanonical(resource) {
+        let url;
+        try {
+            url = new URL(resource);
+        }
+        catch {
+            return false;
+        }
+        const canonical = new URL(this.config.canonicalUri);
+        if (url.origin !== canonical.origin || url.search || url.hash)
+            return false;
+        const base = canonical.pathname.endsWith("/") ? canonical.pathname : canonical.pathname + "/";
+        return url.pathname === canonical.pathname || url.pathname.startsWith(base);
+    }
+    async exchange(p) {
+        const id = this.credentials.id(p.code, "rva");
+        const code = id ? await this.db.oAuthAuthorizationCode.findUnique({ where: { codeId: id } }) : null;
+        if (!code || !this.credentials.matches(p.code, code.secretHash))
+            throw new Error("Invalid grant: unknown code.");
+        if (code.clientId !== p.clientId)
+            throw new Error("Invalid grant: client_id does not match the code.");
+        if (code.redirectUri !== p.redirectUri)
+            throw new Error("Invalid grant: redirect_uri does not match the code.");
+        if (code.resource !== this.config.canonicalUri)
+            throw new Error("Invalid grant: code resource mismatch.");
+        if (!/^[A-Za-z0-9._~-]{43,128}$/.test(p.codeVerifier) ||
+            createHash("sha256").update(p.codeVerifier).digest("base64url") !== code.codeChallenge)
+            throw new Error("Invalid grant: PKCE verifier mismatch.");
+        return this.db.$transaction(async (tx) => {
+            const user = await lockUser(tx, code.userId);
+            const consumed = await tx.oAuthAuthorizationCode.updateMany({
+                where: { codeId: code.codeId, consumedAt: null, expiresAt: { gt: new Date() } },
+                data: { consumedAt: new Date() },
+            });
+            if (consumed.count !== 1)
+                throw new Error("Invalid grant: code expired or already used.");
+            const family = await tx.oAuthFamily.create({
+                data: {
+                    id: randomUUID(),
+                    clientId: code.clientId,
+                    userId: code.userId,
+                    scope: code.scope,
+                    resource: code.resource,
+                    expiresAt: new Date(Date.now() + 30 * DAY),
+                },
+            });
+            return this.issue(tx, family, user.principal.subject);
+        });
+    }
+    async rotate(p) {
+        const id = this.credentials.id(p.refreshToken, "rvr");
+        const initial = id ? await this.db.oAuthGrant.findUnique({ where: { id }, include: { family: true } }) : null;
+        if (!initial || !this.credentials.matches(p.refreshToken, initial.refreshTokenHash))
+            throw new Error("Invalid grant: unknown refresh token.");
+        if (initial.family.clientId !== p.clientId)
+            throw new Error("Invalid grant: client_id does not match the refresh token.");
+        const result = await this.db.$transaction(async (tx) => {
+            const user = await lockUser(tx, initial.family.userId);
+            await tx.$queryRawUnsafe('SELECT "id" FROM "OAuthFamily" WHERE "id" = $1 FOR UPDATE', initial.familyId);
+            const grant = await tx.oAuthGrant.findUnique({
+                where: { id: initial.id },
+                include: { family: { include: { client: true } } },
+            });
+            // Failures return a reason instead of throwing so the reuse revocation
+            // below COMMITs; the caller throws after the transaction.
+            if (!grant || grant.revokedAt || grant.family.revokedAt)
+                return "refresh token revoked";
+            if (grant.family.expiresAt.getTime() <= Date.now() || grant.expiresAt.getTime() <= Date.now())
+                return "refresh token expired";
+            if (!grant.family.client.metadata.grant_types?.includes("refresh_token"))
+                return "client not registered for refresh_token";
+            if (grant.consumedAt) {
+                await this.revokeFamily(tx, grant.familyId);
+                return "refresh token reused; family revoked";
+            }
+            const result = await this.issue(tx, grant.family, user.principal.subject);
+            await tx.oAuthGrant.update({
+                where: { id: grant.id },
+                data: { consumedAt: new Date(), replacedById: this.credentials.id(result.refreshToken, "rvr") },
+            });
+            return result;
+        });
+        if (typeof result === "string")
+            throw new Error(`Invalid grant: ${result}.`);
+        return result;
+    }
+    async issue(tx, family, subject) {
+        const refresh = this.credentials.create("rvr");
+        await tx.oAuthGrant.create({
+            data: { id: refresh.id, familyId: family.id, refreshTokenHash: refresh.hash, expiresAt: family.expiresAt },
+        });
+        const accessToken = await new SignJWT({
+            scope: family.scope,
+            client_id: family.clientId,
+            fid: family.id,
+            uid: family.userId,
+            ver: 2,
+        })
+            .setProtectedHeader({ alg: "HS256", typ: "at+jwt" })
+            .setIssuer(this.config.canonicalUri)
+            .setAudience(family.resource)
+            .setSubject(requireSubject(subject))
+            .setIssuedAt()
+            .setExpirationTime("10m")
+            .setJti(randomUUID())
+            .sign(this.key);
+        return { accessToken, tokenType: "Bearer", expiresIn: 600, refreshToken: refresh.token, scope: family.scope };
+    }
+    async revokeFamily(tx, id) {
+        await tx.oAuthFamily.update({ where: { id }, data: { revokedAt: new Date() } });
+        await tx.oAuthGrant.updateMany({ where: { familyId: id }, data: { revokedAt: new Date() } });
+    }
+    async revoke(token, clientId) {
+        const id = this.credentials.id(token, "rvr");
+        const grant = id ? await this.db.oAuthGrant.findUnique({ where: { id }, include: { family: true } }) : null;
+        if (!grant || !this.credentials.matches(token, grant.refreshTokenHash) || grant.family.clientId !== clientId)
+            return;
+        await this.db.$transaction(async (tx) => {
+            await tx.$queryRawUnsafe('SELECT "id" FROM "AuthUser" WHERE "id" = $1 FOR UPDATE', grant.family.userId);
+            await this.revokeFamily(tx, grant.familyId);
+        });
+    }
+    async verifyBearer(token) {
+        const { payload } = await jwtVerify(token, this.key, {
+            algorithms: ["HS256"],
+            typ: "at+jwt",
+            issuer: this.config.canonicalUri,
+            audience: this.config.canonicalUri,
+            requiredClaims: ["sub", "iss", "aud", "iat", "exp", "jti", "client_id", "fid", "uid", "ver"],
+        });
+        const subject = requireSubject(payload.sub);
+        if (payload.ver !== 2 ||
+            typeof payload.fid !== "string" ||
+            typeof payload.uid !== "string" ||
+            typeof payload.client_id !== "string")
+            throw new Error("Invalid token.");
+        const family = await this.db.oAuthFamily.findUnique({
+            where: { id: payload.fid },
+            include: { user: { include: { principal: true } } },
+        });
+        if (!family ||
+            family.revokedAt ||
+            family.expiresAt.getTime() <= Date.now() ||
+            family.user.status !== "enabled" ||
+            family.userId !== payload.uid ||
+            family.user.principal.subject !== subject ||
+            family.clientId !== payload.client_id ||
+            payload.scope !== family.scope)
+            throw new Error("Invalid token.");
+        return { subject, scopes: family.scope.split(/\s+/).filter(Boolean), roles: [] };
+    }
+    async cleanup() {
+        const now = new Date();
+        // Retain consumed grants until absolute family expiry for reuse detection.
+        await this.db.oAuthFamily.deleteMany({ where: { expiresAt: { lt: now } } });
+        await this.db.oAuthAuthorizationCode.deleteMany({ where: { expiresAt: { lt: now } } });
+        await this.db.oAuthAuthorizationRequest.deleteMany({ where: { expiresAt: { lt: now } } });
+        await this.db.authFormChallenge.deleteMany({ where: { expiresAt: { lt: now } } });
+        await this.db.authSession.deleteMany({ where: { expiresAt: { lt: now } } });
+        await this.db.authRateLimit.deleteMany({ where: { expiresAt: { lt: now } } });
+        // /register has no auth in front of it once Cloud Run allows
+        // unauthenticated invocation (required for self-hosted OAuth to serve
+        // real clients at all), and maxClients is a hard global cap - so
+        // unthrottled registrations could permanently exhaust it. A client
+        // that never completes a single token exchange within a week is
+        // abandoned or spam, never a real client still mid-flow (authorization
+        // requests expire in 10 minutes, codes in 60 seconds).
+        await this.db.oAuthClient.deleteMany({
+            where: { createdAt: { lt: new Date(now.getTime() - 7 * DAY) }, families: { none: {} } },
+        });
+    }
+    async profile(token) {
+        const v = await this.verifyBearer(token);
+        return { subject: v.subject, roles: [] };
+    }
+    authorizeUrl() {
+        throw new NotSupportedError("Use browser authorization.");
+    }
+    async exchangeCode() {
+        throw new NotSupportedError("Use the token endpoint.");
+    }
+    async refresh() {
+        throw new NotSupportedError("Use the token endpoint.");
+    }
+}

package/dist/providers/auth/subject.d.ts

@@ -0,0 +1 @@
+export declare function requireSubject(value: unknown): string;

package/dist/providers/auth/subject.js

@@ -0,0 +1,6 @@
+export function requireSubject(value) {
+    if (typeof value !== "string" || !value.trim() || Buffer.byteLength(value, "utf8") > 512) {
+        throw new Error("Invalid token subject.");
+    }
+    return value;
+}

package/dist/providers/auth/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Auth seam — OAuth 2.1 resource-server identity and scope extraction.
+ *
+ * Default adapter: DelegatingAuthProvider (resource-server-only; an external
+ * IdP is the authorization server). Native adapter: SelfHostedAuthProvider
+ * (wardby additionally runs the AS role: PKCE /authorize+/token, its own
+ * signed tokens).
+ */
+/**
+ * The interactive-login identity shape (returned by `profile(idToken)`).
+ * Identity only — no scopes here. Scopes are a per-token authorization
+ * grant, not a property of who someone is: the same subject can present
+ * two different tokens carrying two different scope sets, so a scope
+ * field on an identity type would conflate a grant with an identity the
+ * moment more than one token exists for the same subject.
+ */
+export interface AuthProfile {
+    subject: string;
+    email?: string;
+    name?: string;
+    /** Application roles resolved from the provider's token claims. */
+    roles: string[];
+}
+/**
+ * The result of validating a bearer access token (returned by
+ * `verifyBearer`). Distinct from `AuthProfile` precisely because it DOES
+ * carry scopes — this is per-token, not per-identity.
+ */
+export interface VerifiedToken {
+    subject: string;
+    /** OAuth scopes granted to this specific token. */
+    scopes: string[];
+    email?: string;
+    roles?: string[];
+}
+export interface AuthTokens {
+    idToken: string;
+    accessToken: string;
+    refreshToken?: string;
+}
+export interface AuthProvider {
+    authorizeUrl(state: string, redirectUri: string): string;
+    exchangeCode(code: string, redirectUri: string): Promise<AuthTokens>;
+    refresh(refreshToken: string): Promise<AuthTokens>;
+    /** Validate the id token and map its claims to a profile with roles. */
+    profile(idToken: string): Promise<AuthProfile>;
+    /**
+     * Validate a bearer access token (signature, audience, expiry, issuer)
+     * and map its claims to a verified-token result. This is what the MCP
+     * resource-server middleware calls on every authenticated request — both
+     * adapters implement it so the middleware never needs to know which is
+     * active.
+     */
+    verifyBearer(token: string): Promise<VerifiedToken>;
+}
+/** Thrown by verifyBearer when a token's audience doesn't match the configured canonical URI. */
+export declare class AudienceError extends Error {
+    constructor(message: string);
+}
+/** Thrown by authorizeUrl/exchangeCode/refresh on an adapter that doesn't run those flows itself. */
+export declare class NotSupportedError extends Error {
+    constructor(message: string);
+}

package/dist/providers/auth/types.js

@@ -0,0 +1,22 @@
+/**
+ * Auth seam — OAuth 2.1 resource-server identity and scope extraction.
+ *
+ * Default adapter: DelegatingAuthProvider (resource-server-only; an external
+ * IdP is the authorization server). Native adapter: SelfHostedAuthProvider
+ * (wardby additionally runs the AS role: PKCE /authorize+/token, its own
+ * signed tokens).
+ */
+/** Thrown by verifyBearer when a token's audience doesn't match the configured canonical URI. */
+export class AudienceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AudienceError";
+    }
+}
+/** Thrown by authorizeUrl/exchangeCode/refresh on an adapter that doesn't run those flows itself. */
+export class NotSupportedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "NotSupportedError";
+    }
+}

package/dist/providers/coding-proxy/deny-port.d.ts

@@ -0,0 +1,5 @@
+export interface DenyPortListenerHandle {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function startDenyPortListener(host: string, port: number): Promise<DenyPortListenerHandle>;

package/dist/providers/coding-proxy/deny-port.js

@@ -0,0 +1,45 @@
+/**
+ * The coding proxy's second listener: the *deny port*.
+ *
+ * It exists only to be unreachable. No run's NetworkPolicy ever permits a
+ * coding-run pod to reach it, so a run pod that can connect to the proxy on
+ * CODING_PROXY_PORT but not on CODING_PROXY_DENY_PORT has proven its policy is
+ * programmed and port-scoped — something no accident can produce, and the one
+ * witness a cluster without kube-dns (GKE Autopilot, where Cloud DNS is the
+ * only provider) still has.
+ *
+ * It must therefore serve nothing at all: the socket is never read
+ * (`pauseOnConnect`), nothing is ever written to it, and it is destroyed the
+ * moment it is accepted. There is no protocol here to attack and no credential
+ * to leak — only the fact that the TCP handshake completed.
+ */
+import { createServer } from "node:net";
+import { logger } from "../../core/logger.js";
+const denyLog = logger.child({ module: "coding-proxy-deny-port" });
+export async function startDenyPortListener(host, port) {
+    const server = createServer({ pauseOnConnect: true }, (socket) => socket.destroy());
+    await new Promise((resolve, reject) => {
+        // Startup-only: removed the moment listen() succeeds, below, and replaced with a permanent
+        // handler — an 'error' event on a net.Server with no listener at all crashes the process.
+        const onStartupError = (error) => reject(error);
+        server.once("error", onStartupError);
+        server.listen(port, host, () => {
+            server.removeListener("error", onStartupError);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const resolvedPort = typeof address === "object" && address ? address.port : port;
+    // A later accept-level failure (EMFILE, ENFILE, ECONNABORTED, ...) must not crash the process
+    // and must not vanish silently either. These are server-level errors, not connection-level
+    // ones, so there is no peer to name here — only the error itself and the listener's own port.
+    server.on("error", (error) => {
+        denyLog.error({ err: error, port: resolvedPort }, "deny-port listener error");
+    });
+    return {
+        port: resolvedPort,
+        close: () => new Promise((resolve, reject) => {
+            server.close((error) => (error ? reject(error) : resolve()));
+        }),
+    };
+}

package/dist/providers/coding-proxy/environment-credentials.d.ts

@@ -0,0 +1,7 @@
+import type { CredentialResolver } from "./types.js";
+/** Resolves credential references only from the trusted proxy process environment. */
+export declare class EnvironmentCredentialResolver implements CredentialResolver {
+    private readonly env;
+    constructor(env?: NodeJS.ProcessEnv);
+    resolve(reference: string): Promise<string>;
+}

package/dist/providers/coding-proxy/environment-credentials.js

@@ -0,0 +1,16 @@
+/** Resolves credential references only from the trusted proxy process environment. */
+export class EnvironmentCredentialResolver {
+    env;
+    constructor(env = process.env) {
+        this.env = env;
+    }
+    async resolve(reference) {
+        const match = /^env:([A-Z][A-Z0-9_]{0,127})$/.exec(reference);
+        if (!match)
+            throw new Error("coding_credential_reference_invalid");
+        const value = this.env[match[1]];
+        if (!value)
+            throw new Error("coding_credential_unavailable");
+        return value;
+    }
+}

package/dist/providers/coding-proxy/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./metering.js";
+export * from "./memory-ledger.js";
+export * from "./prisma-ledger.js";
+export * from "./proxy.js";
+export * from "./server.js";
+export * from "./secure-fetch.js";
+export * from "./types.js";

package/dist/providers/coding-proxy/index.js

@@ -0,0 +1,7 @@
+export * from "./metering.js";
+export * from "./memory-ledger.js";
+export * from "./prisma-ledger.js";
+export * from "./proxy.js";
+export * from "./server.js";
+export * from "./secure-fetch.js";
+export * from "./types.js";

package/dist/providers/coding-proxy/memory-ledger.d.ts

@@ -0,0 +1,17 @@
+import type { CreateProxySessionInput, ProxyLedger, ProxyRequest, ProxySession, ProxyUsage, ReserveProxyRequestInput, ReserveProxyRequestResult } from "./types.js";
+/** Deterministic contract adapter. Sharing one instance simulates a proxy restart. */
+export declare class MemoryProxyLedger implements ProxyLedger {
+    private readonly sessions;
+    private readonly sessionByCapability;
+    private readonly requests;
+    private readonly requestBySessionKey;
+    createSession(input: CreateProxySessionInput): Promise<void>;
+    findSessionByCapabilityHash(capabilityHash: string): Promise<ProxySession | null>;
+    reserve(input: ReserveProxyRequestInput): Promise<ReserveProxyRequestResult>;
+    complete(requestId: string, usage: ProxyUsage, actualCostUsd: number, upstreamStatus: number): Promise<ProxyRequest>;
+    release(requestId: string, upstreamStatus: number): Promise<void>;
+    markUncertain(requestId: string, upstreamStatus?: number): Promise<void>;
+    cancelSession(sessionId: string): Promise<void>;
+    getRequest(requestId: string): Promise<ProxyRequest | null>;
+    private requiredRequest;
+}