aisubs 0.3.6 → 0.3.8

package/dist/sqlite-store.d.ts

@@ -0,0 +1,61 @@
+import { DatabaseSync } from "node:sqlite";
+import type { CoordinatedCredentialStore, OAuthCredential, ProviderId, VersionedCredential } from "./types.js";
+/** Node SQLite persistence. Pass a DatabaseSync to share a host-owned connection. */
+export declare class SqliteCredentialStore implements CoordinatedCredentialStore {
+    private readonly database;
+    private readonly ownsConnection;
+    private readonly queues;
+    constructor(database: string | DatabaseSync);
+    read(provider: ProviderId): Promise<OAuthCredential | null>;
+    listKeys(): Promise<string[]>;
+    readVersioned(provider: ProviderId): Promise<VersionedCredential>;
+    replaceCredential(input: {
+        provider: ProviderId;
+        credential: OAuthCredential;
+        expectedGeneration: number;
+        operationId: string;
+    }): Promise<{
+        applied: boolean;
+        record: VersionedCredential;
+    }>;
+    deleteCredential(input: {
+        provider: ProviderId;
+        operationId: string;
+    }): Promise<void>;
+    claimRefresh(input: {
+        provider: ProviderId;
+        expectedVersion: number;
+        expectedGeneration: number;
+        claimId: string;
+        operationId: string;
+    }): Promise<"claimed" | "busy" | "changed" | "missing">;
+    commitRefresh(input: {
+        provider: ProviderId;
+        claimId: string;
+        expectedGeneration: number;
+        credential: OAuthCredential;
+        operationId: string;
+    }): Promise<{
+        applied: boolean;
+        record: VersionedCredential;
+    }>;
+    modify(provider: ProviderId, update: (current: OAuthCredential | null) => OAuthCredential | null | Promise<OAuthCredential | null>): Promise<OAuthCredential | null>;
+    delete(provider: ProviderId): Promise<void>;
+    close(): void;
+    private row;
+    private generation;
+    private setGeneration;
+    private writeCredential;
+    private versioned;
+    private operation;
+    private rememberOperation;
+}
+export declare class SqliteApiKeyStore {
+    private readonly database;
+    private readonly ownsConnection;
+    constructor(database: string | DatabaseSync);
+    readOrCreate(): Promise<string>;
+    regenerate(): Promise<string>;
+    close(): void;
+    private read;
+}

package/dist/sqlite-store.js

@@ -0,0 +1,323 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+import { mkdirSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+/** Node SQLite persistence. Pass a DatabaseSync to share a host-owned connection. */
+export class SqliteCredentialStore {
+    database;
+    ownsConnection;
+    queues = new Map();
+    constructor(database) {
+        if (typeof database === "string") {
+            mkdirSync(dirname(database), { recursive: true, mode: 0o700 });
+            this.database = new DatabaseSync(database, { timeout: 5_000 });
+            this.ownsConnection = true;
+        }
+        else {
+            this.database = database;
+            this.ownsConnection = false;
+        }
+        this.database.exec(`
+      PRAGMA foreign_keys = ON;
+      CREATE TABLE IF NOT EXISTS aisubs_credentials (
+        account_key TEXT PRIMARY KEY,
+        credential_json TEXT NOT NULL,
+        version INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS aisubs_refresh_claims (
+        account_key TEXT PRIMARY KEY,
+        claim_id TEXT NOT NULL UNIQUE,
+        credential_version INTEGER NOT NULL,
+        account_generation INTEGER NOT NULL,
+        created_at INTEGER NOT NULL
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS aisubs_account_generations (
+        account_key TEXT PRIMARY KEY,
+        generation INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS aisubs_operations (
+        operation_id TEXT PRIMARY KEY,
+        result_json TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      ) STRICT;
+      CREATE TABLE IF NOT EXISTS aisubs_api_keys (
+        name TEXT PRIMARY KEY,
+        value TEXT NOT NULL,
+        updated_at INTEGER NOT NULL
+      ) STRICT;
+    `);
+    }
+    async read(provider) {
+        const row = this.row(provider);
+        return row ? JSON.parse(row.credential_json) : null;
+    }
+    async listKeys() {
+        return this.database.prepare("SELECT account_key FROM aisubs_credentials ORDER BY rowid").all().map(({ account_key }) => account_key);
+    }
+    async readVersioned(provider) {
+        const row = this.row(provider);
+        return {
+            credential: row ? JSON.parse(row.credential_json) : null,
+            version: row?.version ?? 0,
+            generation: this.generation(provider),
+        };
+    }
+    async replaceCredential(input) {
+        const replay = this.operation(input.operationId);
+        if (replay)
+            return replay;
+        this.database.exec("BEGIN IMMEDIATE");
+        try {
+            const generation = this.generation(input.provider);
+            if (generation !== input.expectedGeneration) {
+                const result = { applied: false, record: this.versioned(input.provider) };
+                this.rememberOperation(input.operationId, result);
+                this.database.exec("COMMIT");
+                return result;
+            }
+            this.writeCredential(input.provider, input.credential);
+            this.setGeneration(input.provider, generation + 1);
+            this.database
+                .prepare("DELETE FROM aisubs_refresh_claims WHERE account_key = ?")
+                .run(input.provider);
+            const result = { applied: true, record: this.versioned(input.provider) };
+            this.rememberOperation(input.operationId, result);
+            this.database.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            this.database.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    async deleteCredential(input) {
+        if (this.operation(input.operationId))
+            return;
+        this.database.exec("BEGIN IMMEDIATE");
+        try {
+            this.database
+                .prepare("DELETE FROM aisubs_credentials WHERE account_key = ?")
+                .run(input.provider);
+            this.database
+                .prepare("DELETE FROM aisubs_refresh_claims WHERE account_key = ?")
+                .run(input.provider);
+            this.setGeneration(input.provider, this.generation(input.provider) + 1);
+            this.rememberOperation(input.operationId, { applied: true });
+            this.database.exec("COMMIT");
+        }
+        catch (error) {
+            this.database.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    async claimRefresh(input) {
+        const replay = this.operation(input.operationId);
+        if (replay?.value)
+            return replay.value;
+        this.database.exec("BEGIN IMMEDIATE");
+        try {
+            const row = this.row(input.provider);
+            const generation = this.generation(input.provider);
+            const value = !row
+                ? "missing"
+                : row.version !== input.expectedVersion || generation !== input.expectedGeneration
+                    ? "changed"
+                    : this.database
+                        .prepare("SELECT 1 FROM aisubs_refresh_claims WHERE account_key = ?")
+                        .get(input.provider)
+                        ? "busy"
+                        : "claimed";
+            if (value === "claimed") {
+                this.database
+                    .prepare(`INSERT INTO aisubs_refresh_claims(account_key, claim_id, credential_version, account_generation, created_at)
+            VALUES(?, ?, ?, ?, ?)`)
+                    .run(input.provider, input.claimId, input.expectedVersion, input.expectedGeneration, Date.now());
+            }
+            this.rememberOperation(input.operationId, { value });
+            this.database.exec("COMMIT");
+            return value;
+        }
+        catch (error) {
+            this.database.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    async commitRefresh(input) {
+        const replay = this.operation(input.operationId);
+        if (replay)
+            return replay;
+        this.database.exec("BEGIN IMMEDIATE");
+        try {
+            const claim = this.database
+                .prepare(`SELECT account_generation FROM aisubs_refresh_claims
+          WHERE account_key = ? AND claim_id = ?`)
+                .get(input.provider, input.claimId);
+            const applied = Boolean(claim &&
+                claim.account_generation === input.expectedGeneration &&
+                this.generation(input.provider) === input.expectedGeneration);
+            if (applied) {
+                this.writeCredential(input.provider, input.credential);
+                this.database
+                    .prepare("DELETE FROM aisubs_refresh_claims WHERE account_key = ? AND claim_id = ?")
+                    .run(input.provider, input.claimId);
+            }
+            const result = { applied, record: this.versioned(input.provider) };
+            this.rememberOperation(input.operationId, result);
+            this.database.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            this.database.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    async modify(provider, update) {
+        const previous = this.queues.get(provider) ?? Promise.resolve();
+        let result = null;
+        const current = previous.then(async () => {
+            for (;;) {
+                const observed = this.row(provider);
+                result = await update(observed ? JSON.parse(observed.credential_json) : null);
+                this.database.exec("BEGIN IMMEDIATE");
+                try {
+                    const latest = this.row(provider);
+                    if ((latest?.version ?? 0) !== (observed?.version ?? 0)) {
+                        this.database.exec("ROLLBACK");
+                        continue;
+                    }
+                    if (result) {
+                        this.database
+                            .prepare(`INSERT INTO aisubs_credentials(account_key, credential_json, version, updated_at)
+                VALUES(?, ?, 1, ?)
+                ON CONFLICT(account_key) DO UPDATE SET credential_json = excluded.credential_json,
+                  version = aisubs_credentials.version + 1, updated_at = excluded.updated_at`)
+                            .run(provider, JSON.stringify(result), Date.now());
+                    }
+                    else {
+                        this.database
+                            .prepare("DELETE FROM aisubs_credentials WHERE account_key = ?")
+                            .run(provider);
+                    }
+                    this.database.exec("COMMIT");
+                    return;
+                }
+                catch (error) {
+                    this.database.exec("ROLLBACK");
+                    throw error;
+                }
+            }
+        });
+        const settled = current.catch(() => { });
+        this.queues.set(provider, settled);
+        try {
+            await current;
+        }
+        finally {
+            if (this.queues.get(provider) === settled)
+                this.queues.delete(provider);
+        }
+        return result;
+    }
+    async delete(provider) {
+        await this.modify(provider, () => null);
+    }
+    close() {
+        if (this.ownsConnection)
+            this.database.close();
+    }
+    row(provider) {
+        return this.database
+            .prepare("SELECT credential_json, version FROM aisubs_credentials WHERE account_key = ?")
+            .get(provider);
+    }
+    generation(provider) {
+        const row = this.database
+            .prepare("SELECT generation FROM aisubs_account_generations WHERE account_key = ?")
+            .get(provider);
+        return row?.generation ?? 0;
+    }
+    setGeneration(provider, generation) {
+        this.database
+            .prepare(`INSERT INTO aisubs_account_generations(account_key, generation, updated_at) VALUES(?, ?, ?)
+        ON CONFLICT(account_key) DO UPDATE SET generation = excluded.generation, updated_at = excluded.updated_at`)
+            .run(provider, generation, Date.now());
+    }
+    writeCredential(provider, credential) {
+        this.database
+            .prepare(`INSERT INTO aisubs_credentials(account_key, credential_json, version, updated_at)
+        VALUES(?, ?, 1, ?)
+        ON CONFLICT(account_key) DO UPDATE SET credential_json = excluded.credential_json,
+          version = aisubs_credentials.version + 1, updated_at = excluded.updated_at`)
+            .run(provider, JSON.stringify(credential), Date.now());
+    }
+    versioned(provider) {
+        const row = this.row(provider);
+        return {
+            credential: row ? JSON.parse(row.credential_json) : null,
+            version: row?.version ?? 0,
+            generation: this.generation(provider),
+        };
+    }
+    operation(operationId) {
+        const row = this.database
+            .prepare("SELECT result_json FROM aisubs_operations WHERE operation_id = ?")
+            .get(operationId);
+        return row ? JSON.parse(row.result_json) : undefined;
+    }
+    rememberOperation(operationId, result) {
+        this.database
+            .prepare("INSERT OR IGNORE INTO aisubs_operations(operation_id, result_json, created_at) VALUES(?, ?, ?)")
+            .run(operationId, JSON.stringify(result), Date.now());
+    }
+}
+export class SqliteApiKeyStore {
+    database;
+    ownsConnection;
+    constructor(database) {
+        if (typeof database === "string") {
+            mkdirSync(dirname(database), { recursive: true, mode: 0o700 });
+            this.database = new DatabaseSync(database, { timeout: 5_000 });
+            this.ownsConnection = true;
+        }
+        else {
+            this.database = database;
+            this.ownsConnection = false;
+        }
+        this.database.exec(`CREATE TABLE IF NOT EXISTS aisubs_api_keys (
+      name TEXT PRIMARY KEY, value TEXT NOT NULL, updated_at INTEGER NOT NULL
+    ) STRICT;`);
+    }
+    async readOrCreate() {
+        const existing = this.read();
+        if (existing)
+            return existing;
+        const value = apiKey();
+        this.database
+            .prepare("INSERT OR IGNORE INTO aisubs_api_keys(name, value, updated_at) VALUES('default', ?, ?)")
+            .run(value, Date.now());
+        return this.read() ?? value;
+    }
+    async regenerate() {
+        const value = apiKey();
+        this.database
+            .prepare(`INSERT INTO aisubs_api_keys(name, value, updated_at) VALUES('default', ?, ?)
+        ON CONFLICT(name) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
+            .run(value, Date.now());
+        return value;
+    }
+    close() {
+        if (this.ownsConnection)
+            this.database.close();
+    }
+    read() {
+        const row = this.database
+            .prepare("SELECT value FROM aisubs_api_keys WHERE name = 'default'")
+            .get();
+        return row?.value ?? null;
+    }
+}
+function apiKey() {
+    return `aisubs_${randomBytes(32).toString("base64url")}_${randomUUID().slice(0, 8)}`;
+}

package/dist/store.d.ts

@@ -1,24 +1 @@
-import type { CredentialStore, OAuthCredential, ProviderId } from "./types.js";
 export declare function defaultAiSubsDataDir(): string;
-export declare class FileApiKeyStore {
-    readonly file: string;
-    constructor(file: string);
-    readOrCreate(): Promise<string>;
-    regenerate(): Promise<string>;
-}
-export declare class FileCredentialStore implements CredentialStore {
-    readonly file: string;
-    constructor(file: string);
-    read(provider: ProviderId): Promise<OAuthCredential | null>;
-    listKeys(): Promise<string[]>;
-    modify(provider: ProviderId, update: (current: OAuthCredential | null) => OAuthCredential | null | Promise<OAuthCredential | null>): Promise<OAuthCredential | null>;
-    delete(provider: ProviderId): Promise<void>;
-}
-export declare class MemoryCredentialStore implements CredentialStore {
-    private readonly values;
-    private readonly queues;
-    read(provider: ProviderId): Promise<OAuthCredential | null>;
-    listKeys(): Promise<string[]>;
-    modify(provider: ProviderId, update: (current: OAuthCredential | null) => OAuthCredential | null | Promise<OAuthCredential | null>): Promise<OAuthCredential | null>;
-    delete(provider: ProviderId): Promise<void>;
-}

package/dist/store.js

@@ -1,196 +1,6 @@
-import { createHash, randomBytes } from "node:crypto";
-import { chmod, link, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
-import { abortableDelay, isRecord } from "./utils.js";
-const LOCK_TIMEOUT_MS = 15_000;
-const LOCK_STALE_MS = 120_000;
-function isCredential(value) {
-    if (!isRecord(value) || typeof value.accessToken !== "string")
-        return false;
-    if (typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt))
-        return false;
-    if (value.refreshToken != null && typeof value.refreshToken !== "string")
-        return false;
-    if (value.account != null &&
-        (!isRecord(value.account) ||
-            ![value.account.id, value.account.label, value.account.email, value.account.plan].every((item) => item == null || typeof item === "string")))
-        return false;
-    return (value.metadata == null ||
-        (isRecord(value.metadata) &&
-            Object.values(value.metadata).every((item) => item == null ||
-                typeof item === "string" ||
-                typeof item === "number" ||
-                typeof item === "boolean")));
-}
+import { join, resolve } from "node:path";
 export function defaultAiSubsDataDir() {
     const override = process.env.AISUBS_DATA_DIR?.trim();
     return override ? resolve(override) : join(homedir(), ".aisubs");
 }
-export class FileApiKeyStore {
-    file;
-    constructor(file) {
-        this.file = file;
-    }
-    async readOrCreate() {
-        try {
-            const value = (await readFile(this.file, "utf8")).trim();
-            if (value)
-                return value;
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-        const value = `aisubs_${randomBytes(32).toString("base64url")}`;
-        const temp = `${this.file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-        await mkdir(dirname(this.file), { recursive: true, mode: 0o700 });
-        try {
-            await writeFile(temp, `${value}\n`, { mode: 0o600 });
-            try {
-                await link(temp, this.file);
-                return value;
-            }
-            catch (error) {
-                if (error.code !== "EEXIST")
-                    throw error;
-                const existing = (await readFile(this.file, "utf8")).trim();
-                return existing || this.regenerate();
-            }
-        }
-        finally {
-            await rm(temp, { force: true }).catch(() => { });
-        }
-    }
-    async regenerate() {
-        const value = `aisubs_${randomBytes(32).toString("base64url")}`;
-        const temp = `${this.file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-        await mkdir(dirname(this.file), { recursive: true, mode: 0o700 });
-        try {
-            await writeFile(temp, `${value}\n`, { mode: 0o600 });
-            await rename(temp, this.file);
-            return value;
-        }
-        finally {
-            await rm(temp, { force: true }).catch(() => { });
-        }
-    }
-}
-async function readEnvelope(file) {
-    try {
-        const parsed = JSON.parse(await readFile(file, "utf8"));
-        if (!isRecord(parsed))
-            throw new Error("Credential store must contain a JSON object");
-        const credentials = {};
-        for (const [key, value] of Object.entries(parsed)) {
-            if (!isCredential(value))
-                throw new Error(`Credential store entry ${key} is invalid`);
-            credentials[key] = value;
-        }
-        return credentials;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return {};
-        throw error;
-    }
-}
-async function withFileLock(path, task) {
-    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const deadline = Date.now() + LOCK_TIMEOUT_MS;
-    let handle;
-    while (!handle) {
-        try {
-            handle = await open(path, "wx", 0o600);
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            try {
-                if (Date.now() - (await stat(path)).mtimeMs > LOCK_STALE_MS)
-                    await rm(path, { force: true });
-            }
-            catch { }
-            if (Date.now() >= deadline)
-                throw new Error("Timed out waiting for credential-store lock");
-            await abortableDelay(25);
-        }
-    }
-    try {
-        return await task();
-    }
-    finally {
-        await handle.close().catch(() => { });
-        await rm(path, { force: true }).catch(() => { });
-    }
-}
-async function writeEnvelope(file, value) {
-    const temp = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
-    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
-    try {
-        await writeFile(temp, JSON.stringify(value, null, 2), { mode: 0o600 });
-        await rename(temp, file);
-        if (process.platform !== "win32")
-            await chmod(file, 0o600);
-    }
-    finally {
-        await rm(temp, { force: true }).catch(() => { });
-    }
-}
-export class FileCredentialStore {
-    file;
-    constructor(file) {
-        this.file = file;
-    }
-    async read(provider) {
-        return (await readEnvelope(this.file))[provider] ?? null;
-    }
-    async listKeys() {
-        return Object.keys(await readEnvelope(this.file));
-    }
-    async modify(provider, update) {
-        const lockId = createHash("sha256").update(provider).digest("hex");
-        return withFileLock(join(dirname(this.file), `${lockId}.credential.lock`), async () => {
-            const next = await update(await this.read(provider));
-            await withFileLock(`${this.file}.lock`, async () => {
-                const all = await readEnvelope(this.file);
-                if (next)
-                    all[provider] = next;
-                else
-                    delete all[provider];
-                await writeEnvelope(this.file, all);
-            });
-            return next;
-        });
-    }
-    async delete(provider) {
-        await this.modify(provider, () => null);
-    }
-}
-export class MemoryCredentialStore {
-    values = new Map();
-    queues = new Map();
-    async read(provider) {
-        return this.values.get(provider) ?? null;
-    }
-    async listKeys() {
-        return [...this.values.keys()];
-    }
-    async modify(provider, update) {
-        const previous = this.queues.get(provider) ?? Promise.resolve();
-        let result = null;
-        const current = previous.then(async () => {
-            result = await update(this.values.get(provider) ?? null);
-            if (result)
-                this.values.set(provider, result);
-            else
-                this.values.delete(provider);
-        });
-        this.queues.set(provider, current.catch(() => { }));
-        await current;
-        return result;
-    }
-    async delete(provider) {
-        await this.modify(provider, () => null);
-    }
-}

package/dist/types.d.ts

@@ -18,6 +18,45 @@ export interface CredentialStore {
     modify(provider: ProviderId, update: (current: OAuthCredential | null) => OAuthCredential | null | Promise<OAuthCredential | null>): Promise<OAuthCredential | null>;
     delete(provider: ProviderId): Promise<void>;
 }
+export interface VersionedCredential {
+    credential: OAuthCredential | null;
+    version: number;
+    generation: number;
+}
+/** Structured, remote-safe credential mutations used by hosted/shared stores. */
+export interface CoordinatedCredentialStore extends CredentialStore {
+    readVersioned(provider: ProviderId): Promise<VersionedCredential>;
+    replaceCredential(input: {
+        provider: ProviderId;
+        credential: OAuthCredential;
+        expectedGeneration: number;
+        operationId: string;
+    }): Promise<{
+        applied: boolean;
+        record: VersionedCredential;
+    }>;
+    deleteCredential(input: {
+        provider: ProviderId;
+        operationId: string;
+    }): Promise<void>;
+    claimRefresh(input: {
+        provider: ProviderId;
+        expectedVersion: number;
+        expectedGeneration: number;
+        claimId: string;
+        operationId: string;
+    }): Promise<"claimed" | "busy" | "changed" | "missing">;
+    commitRefresh(input: {
+        provider: ProviderId;
+        claimId: string;
+        expectedGeneration: number;
+        credential: OAuthCredential;
+        operationId: string;
+    }): Promise<{
+        applied: boolean;
+        record: VersionedCredential;
+    }>;
+}
 export interface UsageMeter {
     id: string;
     label: string;
@@ -72,6 +111,7 @@ export interface ProviderModel {
     maxOutputTokens?: number;
     reasoningEfforts?: string[];
     inputModalities?: string[];
+    outputModalities?: string[];
     endpoints?: string[];
     supportsToolCall?: boolean;
     available?: boolean;