agl 40.4.0 → 40.5.0

package/dist_ts_authswitch/classes.authoritybroker.d.ts

@@ -1,8 +1,10 @@
 import { AuthSwitchOpenAiProvider } from './classes.openaiprovider.js';
 import type { IOpenAiOAuthCredential } from './interfaces.openai.js';
 import type { IAuthSwitchAccount, IAuthSwitchAccountEvent, IAuthSwitchBinding, IAuthSwitchOperation, IAuthSwitchSnapshot, IReq_AuthSwitchSnapshot, TAuthSwitchRevocation } from './authority-contract.js';
-import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
-import type { IStoredAuthorityAccount, IStoredAuthorityGrant } from './classes.authoritymodels.js';
+import { type TAuthSwitchApiKeyProvider } from './authority-contract.js';
+import { type TAuthSwitchApiKeyVerifier } from './authority-apikeys.js';
+import { AuthSwitchAuthorityDatabase, type TAuthSwitchBindPurpose } from './classes.authoritydatabase.js';
+import { type IStoredAuthorityAccount, type IStoredAuthorityGrant } from './classes.authoritymodels.js';
 import type { IAuthSwitchUsageContext } from './classes.authorityusage.js';
 import type { IClaudeNativeLogin } from './classes.claudenative.js';
 import { type IAuthSwitchSecretCodec } from './classes.authoritysecrets.js';
@@ -14,11 +16,10 @@ export interface IAuthSwitchAuthorityBrokerOptions {
     now?: () => number;
     proactive?: boolean;
     /**
-     * Asks Anthropic whether it accepts an API key before the authority stores it: by default a read of the models
-     * the key may use. It fails with `AnthropicApiKeyAuthError` for a key Anthropic rejected, otherwise with whatever
-     * kept the question from being answered.
+     * Asks a provider whether it accepts an API key before the authority stores it (`TAuthSwitchApiKeyVerifier`): by
+     * default a read of the models the key may use (`authSwitchApiKeyVerifier`).
      */
-    verifyAnthropicApiKey?: (apiKey: string, signal: AbortSignal) => Promise<void>;
+    verifyApiKey?: TAuthSwitchApiKeyVerifier;
 }
 export interface IAuthSwitchResolvedAccess {
     accessToken: string;
@@ -48,7 +49,7 @@ export declare class AuthSwitchAuthorityBroker {
     private readonly secrets;
     private readonly now;
     private readonly proactive;
-    private readonly verifyAnthropicApiKey;
+    private readonly verifyApiKey;
     private readonly starts;
     private readonly operations;
     private readonly refreshes;
@@ -130,6 +131,11 @@ export declare class AuthSwitchAuthorityBroker {
     setAccountMaxUsage(accountId: string, expectedRevision: number, maxUsagePercent: number | null): Promise<IAuthSwitchAccount>;
     /** Lifts only the reserve, atomically with the account revision; the original threshold stays saved. */
     liftAccountReserve(accountId: string, expectedRevision: number, hours: number): Promise<IAuthSwitchAccount>;
+    /**
+     * Sets or clears an API key account's monthly spend limit, as `setAccountMaxUsage` changes a sign-in's threshold.
+     * A key's limit applies from the next request on, to the month's spend so far.
+     */
+    setAccountSpendLimit(accountId: string, expectedRevision: number, spendLimitMicroUsd: number | null): Promise<IAuthSwitchAccount>;
     /**
      * Sets or clears the date an account's subscription ends, as `setAccountMaxUsage` changes its threshold. The date is
      * stored in its ISO 8601 UTC form; a past one is kept as given and means the account lapsed already.
@@ -167,7 +173,7 @@ export declare class AuthSwitchAuthorityBroker {
     bindAccount(input: {
         accountId: string;
         loginId: string;
-        purpose: 'openai_managed' | 'claude_host_native' | 'anthropic_api_key';
+        purpose: TAuthSwitchBindPurpose;
         runtime: IAuthSwitchBinding['runtime'];
         scopeId: string;
         incarnationId: string;
@@ -215,20 +221,25 @@ export declare class AuthSwitchAuthorityBroker {
      */
     private resolveClaudeAccess;
     /**
-     * A bound Anthropic API key, with the refusals `resolveManagedAccess` gives. A key is never renewed: one Anthropic
-     * rejected for exactly this generation ends (`needs_reauth`, `provider_rejected`), and only adding a key it accepts
-     * brings the account back.
+     * A bound Anthropic or OpenAI API key, with the refusals `resolveManagedAccess` gives. A key is never renewed: one its
+     * provider rejected for exactly this generation ends (`needs_reauth`, `provider_rejected`), and only adding a key the
+     * provider accepts brings the account back.
+     */
+    private resolveApiKeyAccess;
+    /**
+     * The key a daemon-held API key grant seals, proven to be the key its account is named by: its provider's sealed
+     * kind (`apiKeySealedKinds`) and a key whose digest is the account's subject.
      */
-    private resolveAnthropicApiKeyAccess;
-    /** The key a daemon-held Anthropic API key grant seals, proven to be the key its account is named by. */
-    private openAnthropicApiKeyAccess;
+    private openApiKeyAccess;
     /**
-     * Adds an Anthropic API key as an account of its own once Anthropic accepted it. The key is sealed like every login
-     * the authority holds and never answered on the management socket again. A key the authority holds already is
-     * refused while its account is ready; adding it after its account was removed, or after Anthropic rejected it,
-     * brings that account back with a new authorization, so a runtime bound to it binds again.
+     * Adds an Anthropic or OpenAI API key as an account of its own once its provider accepted it. A key that begins the
+     * way the other provider's keys do is refused before any request. The key is sealed like every login the authority
+     * holds and never answered on the management socket again; the account keeps only how it ends (`keyHint`). A key the
+     * authority holds already is refused while its account is ready; adding it after its account was removed, or after
+     * its provider rejected it, brings that account back with a new authorization, so a runtime bound to it binds again,
+     * and with the spend limit it had unless the request names one.
      */
-    addAnthropicApiKey(apiKey: string, label?: string): Promise<{
+    addApiKey(providerId: TAuthSwitchApiKeyProvider, apiKey: string, label?: string, spendLimitMicroUsd?: number): Promise<{
         account: IAuthSwitchAccount;
         loginId: string;
     }>;