audit-tools 0.34.1 → 0.34.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -45,9 +45,20 @@ export declare function deriveCredentialIdentity(source: {
45
45
  * credential identity. Returns null when neither is available, and the caller then
46
46
  * falls back to a pool-scoped key — correct, because a source we cannot attribute to
47
47
  * a credential must not be merged with anyone else's allowance.
48
+ *
49
+ * ⚠ The explicit-account namespace is the SERVICE, never the transport. Account is only
50
+ * meaningful WITHIN a service (`spec/backend-identity-axes.md`), so a proxied lane
51
+ * (`transport: claude-worker`, `service: nim`) and a direct lane
52
+ * (`transport: openai-compatible`, `service: nim`) both declaring `account: "work"` are
53
+ * ONE real credential at one vendor and must yield ONE partition (`nim#work`). Keying on
54
+ * the transport split them into two, double-booking the budget this key protects. Service
55
+ * is normalized to `declared ?? transport` at the producer (`collectDispatchableSources`),
56
+ * so the fallback here only fires for an un-normalized source and preserves the old
57
+ * transport-namespaced key in that case.
48
58
  */
49
59
  export declare function deriveAccountKey(source: {
50
60
  transport: string;
61
+ service?: string;
51
62
  endpoint?: string;
52
63
  api_key_env?: string;
53
64
  api_key?: string;
@@ -1 +1 @@
1
- {"version":3,"file":"accountId.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/accountId.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,GAAG,IAAI,CAShB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,cAAc,EAAE,aAAa,CAAC,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC,GAChE,eAAe,GAAG,IAAI,CAuCxB"}
1
+ {"version":3,"file":"accountId.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/accountId.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,GAAG,IAAI,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,MAAM,GAAG,IAAI,CAGhB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,MAAM,GAAG,IAAI,CAKhB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAIvE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC5C,cAAc,EAAE,aAAa,CAAC,eAAe,GAAG,IAAI,GAAG,SAAS,CAAC,GAChE,eAAe,GAAG,IAAI,CAuCxB"}
@@ -52,10 +52,20 @@ export function deriveCredentialIdentity(source) {
52
52
  * credential identity. Returns null when neither is available, and the caller then
53
53
  * falls back to a pool-scoped key — correct, because a source we cannot attribute to
54
54
  * a credential must not be merged with anyone else's allowance.
55
+ *
56
+ * ⚠ The explicit-account namespace is the SERVICE, never the transport. Account is only
57
+ * meaningful WITHIN a service (`spec/backend-identity-axes.md`), so a proxied lane
58
+ * (`transport: claude-worker`, `service: nim`) and a direct lane
59
+ * (`transport: openai-compatible`, `service: nim`) both declaring `account: "work"` are
60
+ * ONE real credential at one vendor and must yield ONE partition (`nim#work`). Keying on
61
+ * the transport split them into two, double-booking the budget this key protects. Service
62
+ * is normalized to `declared ?? transport` at the producer (`collectDispatchableSources`),
63
+ * so the fallback here only fires for an un-normalized source and preserves the old
64
+ * transport-namespaced key in that case.
55
65
  */
56
66
  export function deriveAccountKey(source) {
57
67
  if (source.account)
58
- return `${source.transport}#${source.account}`;
68
+ return `${source.service ?? source.transport}#${source.account}`;
59
69
  return deriveCredentialIdentity(source);
60
70
  }
61
71
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"accountId.js","sourceRoot":"","sources":["../../../src/shared/quota/accountId.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAIxC;IACC,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,GAAG,kBAAkB,SAAS,MAAM,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,GAAG,kBAAkB,YAAY,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAMhC;IACC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACnE,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAKpC;IACC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,CAAC,SAAS,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA4C,EAC5C,cAAiE;IAEjE,IAAI,aAAa,GAAG,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC;IACrD,IAAI,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,IAAI,MAAM,GAAG,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC;IAC3C,IAAI,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEjD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,OAAO,EAAE,cAAc,CAAC;QAChD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;gBACvF,aAAa,GAAG,eAAe,CAAC;gBAChC,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;gBACzE,MAAM,GAAG,WAAW,CAAC;gBACrB,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAExE,OAAO;QACL,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5D,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,MAAM;QACnB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,QAAQ,EAAE,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"accountId.js","sourceRoot":"","sources":["../../../src/shared/quota/accountId.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAIxC;IACC,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,GAAG,kBAAkB,SAAS,MAAM,CAAC,WAAW,EAAE,CAAC;IAClF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,GAAG,kBAAkB,YAAY,MAAM,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAOhC;IACC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IACrF,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAKpC;IACC,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAM,CAAC,SAAS,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAe;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAA4C,EAC5C,cAAiE;IAEjE,IAAI,aAAa,GAAG,QAAQ,EAAE,cAAc,IAAI,IAAI,CAAC;IACrD,IAAI,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,IAAI,MAAM,GAAG,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC;IAC3C,IAAI,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEjD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,OAAO,EAAE,cAAc,CAAC;QAChD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;gBACvF,aAAa,GAAG,eAAe,CAAC;gBAChC,eAAe,GAAG,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;QACzC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;gBACzE,MAAM,GAAG,WAAW,CAAC;gBACrB,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,aAAa,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAExE,OAAO;QACL,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5D,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,MAAM;QACnB,GAAG,CAAC,QAAQ,EAAE,qBAAqB,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,QAAQ,EAAE,gBAAgB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "audit-tools",
3
- "version": "0.34.1",
3
+ "version": "0.34.2",
4
4
  "private": false,
5
5
  "license": "ISC",
6
6
  "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",