@warmdrift/kgauto-compiler 2.0.0-alpha.9 → 2.0.0-alpha.91

package/dist/key-health.d.mts

@@ -0,0 +1,166 @@
+/**
+ * `@warmdrift/kgauto-compiler/key-health` — per-consumer provider-key health
+ * endpoint factory (alpha.58, KG-fleet-v1 phase 1).
+ *
+ * ## Why this exists
+ *
+ * Consumers (playbacksam, inspire-central, tt-intelligence, global-expansion)
+ * hold their own provider API keys in their own Vercel envs — the library
+ * never sees keys centrally, by design. That means the operator dashboard has
+ * no way to answer "is PB's DeepSeek key still valid?" without a per-consumer
+ * probe surface. This factory is that surface: the consumer mounts ONE route,
+ * the dashboard polls it with the consumer's existing `KGAUTO_INGEST_SECRET`
+ * bearer, and gets back a validity grid for every canonical provider key.
+ *
+ * Probes are the cheapest authenticated GETs each provider offers (model
+ * listings; DeepSeek's balance endpoint) — never a completion call, zero
+ * token cost. Keys themselves NEVER appear in any response: only presence,
+ * validity, HTTP status, latency, and (DeepSeek only) account balance.
+ *
+ * Same design contract as `createBrainForwardRoutes` (brain-proxy.ts):
+ * web-standard Request→Response, never throws (every path returns a
+ * `Response`), bearer gate, runs on Edge/Workers/Node.
+ *
+ * ## Mounting recipes
+ *
+ * ### (a) Next.js app-router route handler — ONE file
+ *
+ *   // app/api/kgauto/v2/keyhealth/route.ts
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'playbacksam',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export const GET = (req: Request) => routes.handle(req);
+ *
+ *   // middleware.ts — if the app gates routes behind auth middleware, the
+ *   // existing brain-proxy public-path prefix ('/api/kgauto/v2/') already
+ *   // covers this route. If the allowlist is per-path, add
+ *   // '/api/kgauto/v2/keyhealth' or server-to-server GETs 307 to /login
+ *   // (the tt-intel middleware-drift shape — see brain-proxy.ts).
+ *
+ * ### (b) Plain per-file Vercel function
+ *
+ *   // api/kgauto/keyhealth.ts
+ *   export const config = { runtime: 'edge' };
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'inspire-central',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export default (req: Request) => routes.handle(req);
+ *
+ * ## Wire shape (LOCKED CONTRACT with the operator dashboard — do not rename)
+ *
+ *   200 {
+ *     app_id: string,
+ *     checked_at: string,          // ISO timestamp
+ *     library_version: string,     // installed @warmdrift/kgauto-compiler
+ *                                  // version (alpha.60+) — the dashboard's
+ *                                  // live vendor-drift signal; absent on
+ *                                  // pre-alpha.60 mounts, render "—"
+ *     keys: [                      // sorted by provider name
+ *       {
+ *         provider: 'anthropic' | 'deepseek' | 'google' | 'openai',
+ *         env: string,             // canonical env var name probed
+ *         present: boolean,        // key present (non-empty after trim)
+ *         valid: boolean | null,   // true 2xx / false 401·403 / null unknown
+ *         status?: number,         // probe HTTP status when a response landed
+ *         latency_ms?: number,     // probe round-trip
+ *         balance_usd?: number,    // DeepSeek only, when currency is USD
+ *         detail?: string,         // e.g. 'timeout', 'http_500', 'key_absent'
+ *       }
+ *     ]
+ *   }
+ */
+type KeyHealthProvider = 'anthropic' | 'deepseek' | 'google' | 'moonshot' | 'openai';
+interface KeyHealthConfig {
+    /** Consumer app id echoed as `app_id` in the response (e.g. 'playbacksam'). */
+    appId: string;
+    /** Bearer token the poller must present (consumer's existing KGAUTO_INGEST_SECRET). */
+    ingestSecret: string;
+    /** Optional fetch impl for tests. */
+    fetchImpl?: typeof fetch;
+    /** Env source; defaults to process.env. Test injection point. */
+    env?: Record<string, string | undefined>;
+    /** Per-provider probe timeout in ms. Default 3000. */
+    timeoutMs?: number;
+}
+/**
+ * alpha.81 — a NON-REVERSIBLE identity for a provider key, so the fleet can
+ * answer "are two consumers on the same key?" without any consumer, or the
+ * brain, ever holding a key value.
+ *
+ * Origin: PB's `one-shared-provider-key-across-four-consumers` (s83). All four
+ * provider keys are Vercel team-level Shared Env Vars across four projects, so
+ * one exhausted account is a four-consumer outage that each consumer diagnoses
+ * locally as its own, and provider spend is a single undifferentiated number.
+ * PB's observation that only kgauto can see this is correct: the library runs
+ * inside every consumer's process and resolves the key there; no consumer can
+ * compare its key against a peer's.
+ *
+ * **Why truncation is the safety property, not an optimization.** The digest is
+ * cut to 12 hex chars (48 bits) — enough that a collision between the handful
+ * of keys in one portfolio is negligible, far too little to verify a guessed
+ * key against. Provider keys are high-entropy random strings, so even the full
+ * digest would not be brute-forceable; the truncation means the stored value is
+ * not a verification oracle even if the key space were later reduced. The
+ * domain-separation prefix keeps these digests useless against any hash
+ * computed for another purpose.
+ *
+ * Never log, return, or persist the key itself. This function is the only
+ * sanctioned way a key becomes a value that may leave the process.
+ */
+declare const KEY_FINGERPRINT_DOMAIN = "kgauto-key-fingerprint-v1:";
+declare const KEY_FINGERPRINT_LENGTH = 12;
+declare function keyFingerprint(key: string): Promise<string | undefined>;
+interface KeyHealthResult {
+    provider: KeyHealthProvider;
+    /** Canonical env var name probed (the resolved one for Google). */
+    env: string;
+    /** Key present (non-empty after trim) in env. */
+    present: boolean;
+    /** true = provider accepted the key (2xx); false = rejected (401/403); null = unknown (absent / timeout / 5xx / 429 / network). */
+    valid: boolean | null;
+    /** HTTP status of the probe, when a response landed. */
+    status?: number;
+    /** Probe round-trip in ms, when a probe ran. */
+    latency_ms?: number;
+    /** DeepSeek only: account balance in USD when the balance API reports USD. */
+    balance_usd?: number;
+    /** Failure class when valid is null with a probe attempted (e.g. 'timeout', 'http_500') or 'key_absent'. */
+    detail?: string;
+    /**
+     * alpha.81 — truncated, domain-separated SHA-256 of the resolved key. NEVER
+     * the key. Identical values across two consumers mean they resolve the same
+     * credential; that is the only question it can answer. Absent when the key is
+     * absent or the runtime exposes no WebCrypto. See {@link keyFingerprint}.
+     */
+    key_fingerprint?: string;
+}
+interface KeyHealthResponseBody {
+    app_id: string;
+    checked_at: string;
+    /**
+     * alpha.60 — installed library version (`LIBRARY_VERSION`). Lets the
+     * operator dashboard render per-consumer vendor drift from the same poll
+     * it already makes; absent on pre-alpha.60 mounts.
+     */
+    library_version: string;
+    keys: KeyHealthResult[];
+}
+interface KeyHealthRoute {
+    /**
+     * Web-standard handler. GET only. Never throws — every error path returns
+     * a `Response`.
+     */
+    handle(req: Request): Promise<Response>;
+}
+/**
+ * Create the per-consumer key-health route. See module docstring for the
+ * mounting recipes ((a) Next.js route handler, (b) per-file Vercel function)
+ * and the locked wire shape.
+ */
+declare function createKeyHealthRoute(config: KeyHealthConfig): KeyHealthRoute;
+
+export { KEY_FINGERPRINT_DOMAIN, KEY_FINGERPRINT_LENGTH, type KeyHealthConfig, type KeyHealthProvider, type KeyHealthResponseBody, type KeyHealthResult, type KeyHealthRoute, createKeyHealthRoute, keyFingerprint };

package/dist/key-health.d.ts

@@ -0,0 +1,166 @@
+/**
+ * `@warmdrift/kgauto-compiler/key-health` — per-consumer provider-key health
+ * endpoint factory (alpha.58, KG-fleet-v1 phase 1).
+ *
+ * ## Why this exists
+ *
+ * Consumers (playbacksam, inspire-central, tt-intelligence, global-expansion)
+ * hold their own provider API keys in their own Vercel envs — the library
+ * never sees keys centrally, by design. That means the operator dashboard has
+ * no way to answer "is PB's DeepSeek key still valid?" without a per-consumer
+ * probe surface. This factory is that surface: the consumer mounts ONE route,
+ * the dashboard polls it with the consumer's existing `KGAUTO_INGEST_SECRET`
+ * bearer, and gets back a validity grid for every canonical provider key.
+ *
+ * Probes are the cheapest authenticated GETs each provider offers (model
+ * listings; DeepSeek's balance endpoint) — never a completion call, zero
+ * token cost. Keys themselves NEVER appear in any response: only presence,
+ * validity, HTTP status, latency, and (DeepSeek only) account balance.
+ *
+ * Same design contract as `createBrainForwardRoutes` (brain-proxy.ts):
+ * web-standard Request→Response, never throws (every path returns a
+ * `Response`), bearer gate, runs on Edge/Workers/Node.
+ *
+ * ## Mounting recipes
+ *
+ * ### (a) Next.js app-router route handler — ONE file
+ *
+ *   // app/api/kgauto/v2/keyhealth/route.ts
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'playbacksam',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export const GET = (req: Request) => routes.handle(req);
+ *
+ *   // middleware.ts — if the app gates routes behind auth middleware, the
+ *   // existing brain-proxy public-path prefix ('/api/kgauto/v2/') already
+ *   // covers this route. If the allowlist is per-path, add
+ *   // '/api/kgauto/v2/keyhealth' or server-to-server GETs 307 to /login
+ *   // (the tt-intel middleware-drift shape — see brain-proxy.ts).
+ *
+ * ### (b) Plain per-file Vercel function
+ *
+ *   // api/kgauto/keyhealth.ts
+ *   export const config = { runtime: 'edge' };
+ *   import { createKeyHealthRoute } from '@warmdrift/kgauto-compiler/key-health';
+ *   const routes = createKeyHealthRoute({
+ *     appId: 'inspire-central',
+ *     ingestSecret: process.env.KGAUTO_INGEST_SECRET!,
+ *   });
+ *   export default (req: Request) => routes.handle(req);
+ *
+ * ## Wire shape (LOCKED CONTRACT with the operator dashboard — do not rename)
+ *
+ *   200 {
+ *     app_id: string,
+ *     checked_at: string,          // ISO timestamp
+ *     library_version: string,     // installed @warmdrift/kgauto-compiler
+ *                                  // version (alpha.60+) — the dashboard's
+ *                                  // live vendor-drift signal; absent on
+ *                                  // pre-alpha.60 mounts, render "—"
+ *     keys: [                      // sorted by provider name
+ *       {
+ *         provider: 'anthropic' | 'deepseek' | 'google' | 'openai',
+ *         env: string,             // canonical env var name probed
+ *         present: boolean,        // key present (non-empty after trim)
+ *         valid: boolean | null,   // true 2xx / false 401·403 / null unknown
+ *         status?: number,         // probe HTTP status when a response landed
+ *         latency_ms?: number,     // probe round-trip
+ *         balance_usd?: number,    // DeepSeek only, when currency is USD
+ *         detail?: string,         // e.g. 'timeout', 'http_500', 'key_absent'
+ *       }
+ *     ]
+ *   }
+ */
+type KeyHealthProvider = 'anthropic' | 'deepseek' | 'google' | 'moonshot' | 'openai';
+interface KeyHealthConfig {
+    /** Consumer app id echoed as `app_id` in the response (e.g. 'playbacksam'). */
+    appId: string;
+    /** Bearer token the poller must present (consumer's existing KGAUTO_INGEST_SECRET). */
+    ingestSecret: string;
+    /** Optional fetch impl for tests. */
+    fetchImpl?: typeof fetch;
+    /** Env source; defaults to process.env. Test injection point. */
+    env?: Record<string, string | undefined>;
+    /** Per-provider probe timeout in ms. Default 3000. */
+    timeoutMs?: number;
+}
+/**
+ * alpha.81 — a NON-REVERSIBLE identity for a provider key, so the fleet can
+ * answer "are two consumers on the same key?" without any consumer, or the
+ * brain, ever holding a key value.
+ *
+ * Origin: PB's `one-shared-provider-key-across-four-consumers` (s83). All four
+ * provider keys are Vercel team-level Shared Env Vars across four projects, so
+ * one exhausted account is a four-consumer outage that each consumer diagnoses
+ * locally as its own, and provider spend is a single undifferentiated number.
+ * PB's observation that only kgauto can see this is correct: the library runs
+ * inside every consumer's process and resolves the key there; no consumer can
+ * compare its key against a peer's.
+ *
+ * **Why truncation is the safety property, not an optimization.** The digest is
+ * cut to 12 hex chars (48 bits) — enough that a collision between the handful
+ * of keys in one portfolio is negligible, far too little to verify a guessed
+ * key against. Provider keys are high-entropy random strings, so even the full
+ * digest would not be brute-forceable; the truncation means the stored value is
+ * not a verification oracle even if the key space were later reduced. The
+ * domain-separation prefix keeps these digests useless against any hash
+ * computed for another purpose.
+ *
+ * Never log, return, or persist the key itself. This function is the only
+ * sanctioned way a key becomes a value that may leave the process.
+ */
+declare const KEY_FINGERPRINT_DOMAIN = "kgauto-key-fingerprint-v1:";
+declare const KEY_FINGERPRINT_LENGTH = 12;
+declare function keyFingerprint(key: string): Promise<string | undefined>;
+interface KeyHealthResult {
+    provider: KeyHealthProvider;
+    /** Canonical env var name probed (the resolved one for Google). */
+    env: string;
+    /** Key present (non-empty after trim) in env. */
+    present: boolean;
+    /** true = provider accepted the key (2xx); false = rejected (401/403); null = unknown (absent / timeout / 5xx / 429 / network). */
+    valid: boolean | null;
+    /** HTTP status of the probe, when a response landed. */
+    status?: number;
+    /** Probe round-trip in ms, when a probe ran. */
+    latency_ms?: number;
+    /** DeepSeek only: account balance in USD when the balance API reports USD. */
+    balance_usd?: number;
+    /** Failure class when valid is null with a probe attempted (e.g. 'timeout', 'http_500') or 'key_absent'. */
+    detail?: string;
+    /**
+     * alpha.81 — truncated, domain-separated SHA-256 of the resolved key. NEVER
+     * the key. Identical values across two consumers mean they resolve the same
+     * credential; that is the only question it can answer. Absent when the key is
+     * absent or the runtime exposes no WebCrypto. See {@link keyFingerprint}.
+     */
+    key_fingerprint?: string;
+}
+interface KeyHealthResponseBody {
+    app_id: string;
+    checked_at: string;
+    /**
+     * alpha.60 — installed library version (`LIBRARY_VERSION`). Lets the
+     * operator dashboard render per-consumer vendor drift from the same poll
+     * it already makes; absent on pre-alpha.60 mounts.
+     */
+    library_version: string;
+    keys: KeyHealthResult[];
+}
+interface KeyHealthRoute {
+    /**
+     * Web-standard handler. GET only. Never throws — every error path returns
+     * a `Response`.
+     */
+    handle(req: Request): Promise<Response>;
+}
+/**
+ * Create the per-consumer key-health route. See module docstring for the
+ * mounting recipes ((a) Next.js route handler, (b) per-file Vercel function)
+ * and the locked wire shape.
+ */
+declare function createKeyHealthRoute(config: KeyHealthConfig): KeyHealthRoute;
+
+export { KEY_FINGERPRINT_DOMAIN, KEY_FINGERPRINT_LENGTH, type KeyHealthConfig, type KeyHealthProvider, type KeyHealthResponseBody, type KeyHealthResult, type KeyHealthRoute, createKeyHealthRoute, keyFingerprint };

package/dist/key-health.js

@@ -0,0 +1,247 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/key-health.ts
+var key_health_exports = {};
+__export(key_health_exports, {
+  KEY_FINGERPRINT_DOMAIN: () => KEY_FINGERPRINT_DOMAIN,
+  KEY_FINGERPRINT_LENGTH: () => KEY_FINGERPRINT_LENGTH,
+  createKeyHealthRoute: () => createKeyHealthRoute,
+  keyFingerprint: () => keyFingerprint
+});
+module.exports = __toCommonJS(key_health_exports);
+
+// src/version.ts
+var LIBRARY_VERSION = "2.0.0-alpha.91";
+
+// src/key-health.ts
+var JSON_HEADERS = { "Content-Type": "application/json" };
+var KEY_FINGERPRINT_DOMAIN = "kgauto-key-fingerprint-v1:";
+var KEY_FINGERPRINT_LENGTH = 12;
+async function keyFingerprint(key) {
+  const trimmed = key?.trim();
+  if (!trimmed) return void 0;
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return void 0;
+  const bytes = new TextEncoder().encode(KEY_FINGERPRINT_DOMAIN + trimmed);
+  const digest = await subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, KEY_FINGERPRINT_LENGTH);
+}
+function jsonResponse(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function bearerOf(req) {
+  const header = req.headers.get("Authorization") ?? "";
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match?.[1]?.trim() ?? "";
+}
+function requireString(name, value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`createKeyHealthRoute: ${name} is required`);
+  }
+  return value;
+}
+function envKey(env, name) {
+  const v = env[name];
+  if (typeof v !== "string") return void 0;
+  const trimmed = v.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+var PROBE_SPECS = [
+  {
+    provider: "anthropic",
+    canonicalEnvName: "ANTHROPIC_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.anthropic.com/v1/models?limit=1",
+      headers: { "x-api-key": key, "anthropic-version": "2023-06-01" }
+    })
+  },
+  {
+    provider: "deepseek",
+    canonicalEnvName: "DEEPSEEK_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.deepseek.com/user/balance",
+      headers: { Authorization: `Bearer ${key}` }
+    }),
+    parseBalanceUsd: (body) => {
+      const infos = body?.balance_infos;
+      if (!Array.isArray(infos) || infos.length === 0) return void 0;
+      const first = infos[0];
+      if (first?.currency !== "USD") return void 0;
+      const n = Number(first.total_balance);
+      return Number.isFinite(n) ? n : void 0;
+    }
+  },
+  {
+    provider: "moonshot",
+    canonicalEnvName: "MOONSHOT_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.moonshot.ai/v1/models",
+      headers: { Authorization: `Bearer ${key}` }
+    })
+  },
+  {
+    provider: "google",
+    canonicalEnvName: "GEMINI_API_KEY",
+    buildRequest: (key) => ({
+      url: `https://generativelanguage.googleapis.com/v1beta/models?pageSize=1&key=${encodeURIComponent(key)}`,
+      headers: {}
+    })
+  },
+  {
+    provider: "openai",
+    canonicalEnvName: "OPENAI_API_KEY",
+    buildRequest: (key) => ({
+      url: "https://api.openai.com/v1/models",
+      headers: { Authorization: `Bearer ${key}` }
+    })
+  }
+];
+function createKeyHealthRoute(config) {
+  const appId = requireString("appId", config.appId);
+  const ingestSecret = requireString("ingestSecret", config.ingestSecret);
+  const fetchFn = config.fetchImpl ?? fetch;
+  const timeoutMs = config.timeoutMs ?? 3e3;
+  async function probeProvider(spec, env) {
+    let key;
+    let envName = spec.canonicalEnvName;
+    if (spec.provider === "google") {
+      const gemini = envKey(env, "GEMINI_API_KEY");
+      const google = envKey(env, "GOOGLE_API_KEY");
+      const aiSdk = envKey(env, "GOOGLE_GENERATIVE_AI_API_KEY");
+      key = gemini ?? google ?? aiSdk;
+      envName = gemini ? "GEMINI_API_KEY" : google ? "GOOGLE_API_KEY" : aiSdk ? "GOOGLE_GENERATIVE_AI_API_KEY" : "GEMINI_API_KEY";
+    } else if (spec.provider === "moonshot") {
+      const moonshot = envKey(env, "MOONSHOT_API_KEY");
+      const kimi = envKey(env, "KIMI_API_KEY");
+      key = moonshot ?? kimi;
+      envName = moonshot ? "MOONSHOT_API_KEY" : kimi ? "KIMI_API_KEY" : "MOONSHOT_API_KEY";
+    } else {
+      key = envKey(env, spec.canonicalEnvName);
+    }
+    if (!key) {
+      return {
+        provider: spec.provider,
+        env: envName,
+        present: false,
+        valid: null,
+        detail: "key_absent"
+      };
+    }
+    const fingerprint = await keyFingerprint(key);
+    const base = {
+      provider: spec.provider,
+      env: envName,
+      present: true,
+      valid: null,
+      ...fingerprint ? { key_fingerprint: fingerprint } : {}
+    };
+    const { url, headers } = spec.buildRequest(key);
+    const started = Date.now();
+    let res;
+    try {
+      res = await fetchFn(url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      const isTimeout = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+      return {
+        ...base,
+        latency_ms: Date.now() - started,
+        // NEVER echo err.message — provider errors could theoretically carry
+        // request context; a fixed vocabulary keeps key material impossible.
+        detail: isTimeout ? "timeout" : "network_error"
+      };
+    }
+    const latencyMs = Date.now() - started;
+    if (res.ok) {
+      const result = {
+        ...base,
+        valid: true,
+        status: res.status,
+        latency_ms: latencyMs
+      };
+      if (spec.parseBalanceUsd) {
+        try {
+          const body = await res.json();
+          const balance = spec.parseBalanceUsd(body);
+          if (balance !== void 0) result.balance_usd = balance;
+        } catch {
+        }
+      }
+      return result;
+    }
+    if (res.status === 401 || res.status === 403) {
+      return { ...base, valid: false, status: res.status, latency_ms: latencyMs };
+    }
+    return {
+      ...base,
+      valid: null,
+      status: res.status,
+      latency_ms: latencyMs,
+      detail: `http_${res.status}`
+    };
+  }
+  async function handle(req) {
+    try {
+      if (req.method !== "GET") {
+        return jsonResponse(405, { error: "method_not_allowed" });
+      }
+      if (bearerOf(req) !== ingestSecret) {
+        return jsonResponse(401, { error: "unauthorized" });
+      }
+      const env = config.env ?? process.env;
+      const settled = await Promise.allSettled(
+        PROBE_SPECS.map((spec) => probeProvider(spec, env))
+      );
+      const keys = settled.map((s, i) => {
+        if (s.status === "fulfilled") return s.value;
+        const spec = PROBE_SPECS[i];
+        return {
+          provider: spec.provider,
+          env: spec.canonicalEnvName,
+          present: true,
+          valid: null,
+          detail: "probe_failed"
+        };
+      });
+      keys.sort((a, b) => a.provider.localeCompare(b.provider));
+      const body = {
+        app_id: appId,
+        checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+        library_version: LIBRARY_VERSION,
+        keys
+      };
+      return jsonResponse(200, body);
+    } catch (err) {
+      void err;
+      return jsonResponse(500, { error: "key_health_internal_error" });
+    }
+  }
+  return { handle };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  KEY_FINGERPRINT_DOMAIN,
+  KEY_FINGERPRINT_LENGTH,
+  createKeyHealthRoute,
+  keyFingerprint
+});

package/dist/key-health.mjs

@@ -0,0 +1,12 @@
+import {
+  KEY_FINGERPRINT_DOMAIN,
+  KEY_FINGERPRINT_LENGTH,
+  createKeyHealthRoute,
+  keyFingerprint
+} from "./chunk-AUZTO6Q5.mjs";
+export {
+  KEY_FINGERPRINT_DOMAIN,
+  KEY_FINGERPRINT_LENGTH,
+  createKeyHealthRoute,
+  keyFingerprint
+};