aweshare 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 aweshare contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,246 @@
+<div align="center">
+
+  <img src="logo/logo.webp" alt="aweshare" width="860">
+
+# aweshare
+
+**Open-source, local-first AI capability relay**
+
+**English** · [简体中文](./README_cn.md)
+
+</div>
+
+Producers run a lightweight agent on their own machine and share local Ollama/vLLM or **authorized** OpenAI/Anthropic backends. Upstream API keys live only on the producer's device and are injected by the local agent at forwarding time. Consumers point a standard OpenAI/Anthropic SDK at the hub and call models by `namespace/alias` — exactly like using any other model vendor.
+
+```
+Consumer (standard SDK, zero changes)         Producer side
+┌───────────────────────┐            ┌────────────────────────────┐
+│ Claude Code           │            │ aweshare agent (Node CLI)   │
+│  ANTHROPIC_BASE_URL ──┼──► HTTPS ──┤  ~/.aweshare/config.toml   │
+│ OpenAI SDK / Codex    │            │  ~/.aweshare/secrets.json  │
+└───────────────────────┘            │   │ upstream key injection  │
+           │ /v1/messages            │   ▼ (the only place it happens)
+           │ /v1/chat/completions    │  Ollama / vLLM / OpenAI / Anthropic
+           ▼                         │
+┌─────────────────────────────┐      │
+│ aweshare hub (public, 1 node)│◄───── WSS reverse tunnel (agent dials out)
+│ auth / grants / route / meter│      no public IP, no port forwarding needed
+└─────────────────────────────┘
+```
+
+- **Grant-based trust**: consumers can only use aliases explicitly granted to them. No payments, no marketplace.
+- **Namespaced aliases**: `peng/gpt-4o` is globally unique with one owner — routing is a deterministic lookup.
+- v1 relays **native transparent SSE** for OpenAI↔OpenAI (chat completions and Responses), Anthropic↔Anthropic. No cross-protocol conversion, no smart routing, no web console.
+
+## Trust boundary (read this first)
+
+- To route and meter, **consumer prompts and model responses transit the hub in plaintext — this is not end-to-end encryption**. The hub persists no request/response content, but the hub operator can technically see it. Only use a hub instance you trust — which is why the hub is open source and self-hostable.
+- Upstream API keys never leave the producer's device and are never sent to consumers; the hub database stores only SHA-256 hashes of tokens.
+
+### Compliance and disclaimer
+
+- aweshare is relay software: it cannot and does not judge whether you are allowed to share a given upstream key or subscription — that question is between you and the upstream provider. Being able to call an API yourself does not mean you may resell or re-provide it to third parties.
+- Before sharing anything, read the upstream's terms (account rules, subscription and seat limits, forwarding, commercial-use clauses). Sharing a personal-subscription key — coding plans included — with third parties likely violates those terms; self-hosted open models have no such issue. **When in doubt, don't share.**
+- The producer bears the consequences of sharing (key revocation, account suspension or termination by the upstream). The hub operator is responsible for operating the hub lawfully and for informing consumers of the plaintext-transit boundary above.
+- The software is provided "as is" under the [MIT license](./LICENSE), without warranty of any kind. The authors and contributors are not liable for how aweshare is used or for any damage arising from sharing access through it.
+
+## Quickstart
+
+Published as [`aweshare`](https://www.npmjs.com/package/aweshare) on npm (requires Node ≥ 22) and as a Docker image (`ghcr.io/mugpeng/aweshare`). No clone needed.
+
+### 1. Start the hub (operator, one VPS)
+
+**npm** (simplest):
+
+```bash
+npm install -g aweshare
+aweshare hub init        # data in ~/.aweshare-hub; prints the admin token — save it
+aweshare hub serve       # listens on :8787 (put Caddy/nginx TLS in front)
+```
+
+**docker**:
+
+```bash
+docker run -d --name aweshare-hub --restart unless-stopped \
+  -p 127.0.0.1:8787:8787 -v "$PWD/data:/data" ghcr.io/mugpeng/aweshare:latest
+docker exec aweshare-hub node apps/hub/dist/cli.js init   # first run: prints the admin token, save it
+```
+
+Then issue tokens (admin token in hand):
+
+```bash
+aweshare hub token issue --role producer --name peng     # → asp_..., give to the producer
+aweshare hub token issue --role consumer --name alice    # → asc_..., give to the consumer
+```
+
+The producer's `name` becomes their alias namespace (the `peng/` in `peng/gpt-4o`).
+
+### 2. Producer first run (in this order)
+
+```bash
+npm install -g aweshare   # ⓪ once, on the producer machine (Node ≥ 22)
+
+# ① init: writes ~/.aweshare/config.toml + secrets.json (0600)
+aweshare agent init --hub https://hub.example.com --token asp_...
+
+# ② Edit the config (see below); put upstream keys in secrets.json — they never leave this machine
+
+# ③ doctor: pre-flight checks, ordered to find the first failing link
+aweshare agent doctor
+
+# ④ Grant a consumer
+aweshare agent grant --alias peng/qwen2.5.7b --consumer alice
+#    time-limited trial: add --expires-in 7d (re-granting refreshes the expiry)
+
+# ⑤ Start (long-running; when it stops, aliases go offline and consumers get 503)
+aweshare agent start
+```
+
+### 3. Consumer first run (in this order)
+
+```bash
+# ① one small curl to prove the path
+curl https://hub.example.com/v1/chat/completions \
+  -H "Authorization: Bearer asc_..." -H "content-type: application/json" \
+  -d '{"model":"peng/qwen2.5.7b","messages":[{"role":"user","content":"ping"}]}'
+
+# ② configure your tool (below) → run one minimal task
+# ③ check usage: aweshare hub usage --alias peng/qwen2.5.7b
+# ④ only then move to real workloads
+```
+
+## Consumer tool configuration
+
+**OpenAI SDK / any OpenAI-compatible tool**
+
+```ts
+const client = new OpenAI({ baseURL: 'https://hub.example.com/v1', apiKey: 'asc_...' })
+await client.chat.completions.create({ model: 'peng/gpt-4o', messages: [...] })
+```
+
+**Claude Code** (the key is the `asc_` consumer key — **not** any upstream x-api-key)
+
+```bash
+export ANTHROPIC_BASE_URL=https://hub.example.com
+export ANTHROPIC_API_KEY=asc_...
+claude --model peng/sonnet
+```
+
+If Claude Code has a stale OAuth login it overrides env config — switch with `/login` or clean stored credentials.
+
+**Codex** (the default Responses wire protocol works — the alias must be backed by a `responses`-protocol offering; `wire_api = "chat"` against an `openai`-protocol offering also works)
+
+```toml
+[model_providers.aweshare]
+base_url = "https://hub.example.com/v1"
+```
+
+**Discovering models**: `GET /v1/models` (OpenAI SDK `client.models.list()`) returns every alias granted to the key, with online status.
+
+## Producer config reference (~/.aweshare/config.toml)
+
+```toml
+hubUrl = "https://hub.example.com"
+token = "asp_..."
+
+[[backends]]
+id = "ollama"
+protocol = "openai"                      # openai-style baseUrl includes /v1 (SDK convention)
+baseUrl = "http://127.0.0.1:11434/v1"
+
+[[backends]]
+id = "anthropic-main"
+protocol = "anthropic"                   # anthropic-style baseUrl excludes /v1 (agent adds it)
+baseUrl = "https://api.anthropic.com"
+keyRef = "anthropic-key"                 # key lives in secrets.json under this name
+
+[[backends]]
+id = "glm-responses"
+protocol = "responses"                   # responses-style baseUrl includes the version path
+baseUrl = "https://open.bigmodel.cn/api/v1"
+keyRef = "glm-key"                       # e.g. a GLM coding-plan key (Codex-ready)
+
+[[offerings]]
+alias = "peng/qwen2.5.7b"                # namespace must be your producer name
+backend = "ollama"
+upstreamModel = "qwen2.5:7b"             # the real backend id (full tag from `ollama list`)
+maxConcurrency = 1                       # start at 1 for local models; raise for cloud APIs
+```
+
+Key hygiene: use dedicated, least-privilege, revocable keys with budget alerts; keep `secrets.json` at 0600 and out of git/screenshots; rotate on suspected leaks. Before sharing, check the upstream's terms: account rules, subscription limits, forwarding and commercial-use constraints.
+
+## Consumer limits (hub-wide defaults + per-consumer overrides)
+
+Every consumer gets the hub-wide defaults (`AWESHARE_CONSUMER_RPS` / `BURST` / `CONCURRENCY`, see Operations). On top of that, the hub admin can set **sparse per-consumer overrides** — only the keys you set take effect, everything else keeps the defaults:
+
+```bash
+aweshare hub consumer limits --name alice            # show current overrides
+aweshare hub consumer limits --name alice --tpm 60000 --max-total-tokens 5000000
+aweshare hub consumer limits --name alice --rps 2    # later calls merge, not replace
+aweshare hub consumer limits --name alice --clear    # back to hub-wide defaults
+```
+
+| Key | Meaning | Enforcement |
+|---|---|---|
+| `rps` / `burst` / `maxConcurrent` | override the hub-wide rate/inflight defaults for this consumer | 429 `RATE_LIMITED` |
+| `tpm` | max tokens (prompt + completion) in any sliding 60s window | 429 `RATE_LIMITED` (in-memory window, like the RPS bucket) |
+| `maxTotalTokens` | lifetime token budget for this consumer | 429 `QUOTA_EXCEEDED` (sums `usage_events`) |
+
+Grants can also carry an expiry: `aweshare hub grant add --alias peng/gpt-4o --consumer alice --expires-in 7d` (or `aweshare agent grant … --expires-in 7d` on the producer side). An expired grant returns `403 GRANT_EXPIRED`; re-granting refreshes the expiry.
+
+Honest limits: token-based caps count what upstreams report — Ollama streams report no usage, so they contribute 0. TPM is best-effort (concurrent requests that all pass before any finishes can overshoot); the lifetime budget is exact because it sums persisted rows.
+
+## Endpoints and errors
+
+| Endpoint | Purpose |
+|---|---|
+| `POST /v1/chat/completions` · `POST /v1/messages` · `POST /v1/responses` | inference (Bearer or `x-api-key`) |
+| `GET /v1/models` | aliases visible to this key, with status |
+| `GET /healthz` | liveness |
+| `/admin/v1/*` | token/grant/usage management (admin or producer token) · consumer limit overrides: `GET`/`PUT`/`DELETE /admin/v1/consumers/{name}/limits` (admin only) |
+
+Error semantics: `401` invalid key · `403` not granted or `GRANT_EXPIRED` · `404` unknown alias · `400 PROTOCOL_MISMATCH` protocol/alias mismatch · `429` rate limit, TPM or producer concurrency cap (`QUOTA_EXCEEDED` = lifetime token budget hit) · `502` upstream/tunnel failure (upstream 4xx/5xx passes through verbatim) · `503` producer offline / backend degraded · `504` timeout. Errors carry `{error:{code,message,requestId}}`; the requestId spans both sides' logs.
+
+Usage metering: one row per request (alias, real model, status, duration, byte counts, best-effort token counts), **zero content stored**. Producers list grants with `aweshare agent list`; query usage with `aweshare hub usage`.
+
+## Operations
+
+| Env var | Default | Purpose |
+|---|---|---|
+| `AWESHARE_HUB_DATA_DIR` | `~/.aweshare-hub` | data dir (SQLite/pepper/admin token; volume-mount = backup) |
+| `AWESHARE_HUB_PORT` / `HOST` | 8787 / 0.0.0.0 | listen address |
+| `AWESHARE_CONSUMER_RPS` / `BURST` / `CONCURRENCY` | 10 / 20 / 8 | per-consumer limits |
+| `AWESHARE_HEAD_TIMEOUT_MS` / `IDLE_TIMEOUT_MS` | 120000 / 300000 | response-head timeout / stream idle timeout |
+| `AWESHARE_MAX_BODY_BYTES` | 32MB | request body cap |
+
+Health: agent heartbeats every 15s, silent 45s = dead; backends with 2 consecutive AUTH/QUOTA failures auto-degrade (alias shows `degraded`, dispatch stops), 30s probes recover. A new connection with the same producer token replaces the old one (latest-wins).
+
+## Development
+
+```bash
+pnpm install
+pnpm test        # 98 tests: protocol / hub contract (fake agent vs real hub) / agent unit / e2e (real SDKs)
+pnpm build       # tsc -b, whole monorepo
+pnpm check       # biome
+```
+
+To run the CLIs from a source checkout without `node apps/.../dist/cli.js`, link them once after building:
+
+```bash
+npm link                 # or: pnpm link --global — exposes the single `aweshare` bin
+aweshare hub serve
+aweshare agent doctor
+```
+
+Releasing: push a `v*` tag with a matching `## [x.y.z]` section in `docs/CHANGELOG.md`; CI publishes `aweshare-protocol` + `aweshare` to npm (needs the `NPM_TOKEN` secret) and the Docker image to `ghcr.io/mugpeng/aweshare`.
+
+Layout: `packages/protocol` (shared wire protocol) · `apps/hub` (HTTP+WS+SQLite+CLI) · `apps/agent` (CLI). Design docs live in `docs/specs/`; the changelog in `docs/CHANGELOG.md`; contribution scope in [CONTRIBUTING.md](./CONTRIBUTING.md).
+
+## Known limitations (v1)
+
+- No cross-protocol conversion: an alias speaks exactly one wire (openai chat, anthropic messages, or openai responses).
+- Ollama streams carry no usage → token counts recorded as NULL (best effort by design).
+- Single hub instance + SQLite; no horizontal scaling.
+- Corporate proxies may block the WebSocket tunnel (environmental limit).
+
+MIT License.

package/apps/agent/dist/adapters.d.ts

@@ -0,0 +1,15 @@
+import type { RequestStartMessage } from 'aweshare-protocol';
+import type { Backend } from './config.js';
+export interface ResolvedBackend extends Backend {
+    apiKey?: string;
+}
+export interface UpstreamRequest {
+    url: string;
+    headers: Record<string, string>;
+}
+/**
+ * Rebuild the upstream request from the tunnel message.
+ * The hub already stripped consumer credentials; the upstream key is
+ * injected here and nowhere else.
+ */
+export declare function buildUpstreamRequest(backend: ResolvedBackend, msg: RequestStartMessage): UpstreamRequest;

package/apps/agent/dist/adapters.js

@@ -0,0 +1,25 @@
+/**
+ * Rebuild the upstream request from the tunnel message.
+ * The hub already stripped consumer credentials; the upstream key is
+ * injected here and nowhere else.
+ */
+export function buildUpstreamRequest(backend, msg) {
+    const base = backend.baseUrl.replace(/\/+$/, '');
+    // anthropic baseUrl excludes /v1 (SDK convention); openai/responses baseUrl already has it
+    const prefix = backend.protocol === 'anthropic' ? '/v1' : '';
+    const url = new URL(base + prefix + msg.path);
+    for (const [key, value] of Object.entries(msg.query ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    const headers = { ...msg.headers };
+    if (backend.protocol === 'anthropic') {
+        if (backend.apiKey)
+            headers['x-api-key'] = backend.apiKey;
+        headers['anthropic-version'] = headers['anthropic-version'] ?? '2023-06-01';
+    }
+    else if (backend.apiKey) {
+        headers.authorization = `Bearer ${backend.apiKey}`;
+    }
+    return { url: url.toString(), headers };
+}
+//# sourceMappingURL=adapters.js.map

package/apps/agent/dist/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAwB,EACxB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAChD,2FAA2F;IAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;IAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,MAAM,CAAA;QACzD,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,YAAY,CAAA;IAC7E,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,MAAM,EAAE,CAAA;IACpD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAA;AACzC,CAAC"}

package/apps/agent/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/apps/agent/dist/cli.js

@@ -0,0 +1,175 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import pino from 'pino';
+import { agentDir, CONFIG_TEMPLATE, loadAgentConfig, SECRETS_TEMPLATE, writeFileAtomic, } from './config.js';
+import { AgentConnection } from './connection.js';
+import { runDoctor } from './doctor.js';
+const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+const USAGE = `aweshare agent — share local/authorized AI capacity through an aweshare hub
+
+Usage:
+  aweshare agent init [--hub URL] [--token asp_...]   write config template + empty secrets
+  aweshare agent start                                connect, register offerings, relay
+  aweshare agent doctor                               pre-flight checks (direct replay first, hub last)
+  aweshare agent grant --alias ALIAS --consumer NAME [--expires-in 7d|12h|30m|90s]
+  aweshare agent revoke --alias ALIAS --consumer NAME
+  aweshare agent list                                 list grants for your namespace
+
+Environment:
+  AWESHARE_AGENT_DIR   config directory (default ~/.aweshare)`;
+function parseFlags(argv) {
+    const positional = [];
+    const flags = new Map();
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a.startsWith('--')) {
+            const eq = a.indexOf('=');
+            if (eq >= 0) {
+                flags.set(a.slice(2, eq), a.slice(eq + 1));
+            }
+            else if (i + 1 < argv.length && !argv[i + 1].startsWith('--')) {
+                flags.set(a.slice(2), argv[++i]);
+            }
+            else {
+                flags.set(a.slice(2), 'true');
+            }
+        }
+        else {
+            positional.push(a);
+        }
+    }
+    return { positional, flags };
+}
+function fail(message) {
+    console.error(`error: ${message}`);
+    process.exit(1);
+}
+/** Node fetch reports "fetch failed" without the reason; surface the cause. */
+function errorMessage(err) {
+    if (err instanceof Error) {
+        const cause = err.cause;
+        return cause ? `${err.message} (${cause.code ?? cause.message})` : err.message;
+    }
+    return String(err);
+}
+/** Parse a human duration like 90s, 30m, 12h, 7d into milliseconds. */
+function parseDuration(raw) {
+    const m = /^(\d+)([smhd])$/.exec(raw);
+    if (!m)
+        fail(`--expires-in must look like 90s, 30m, 12h or 7d, got '${raw}'`);
+    const unit = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2]];
+    return Number(m[1]) * unit;
+}
+async function main() {
+    const [cmd, ...rest] = process.argv.slice(2);
+    const { flags } = parseFlags(rest);
+    if (cmd === '-v' || cmd === '--version') {
+        console.log(`aweshare agent ${VERSION}`);
+        return;
+    }
+    if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h' || flags.get('help') === 'true') {
+        console.log(USAGE);
+        return;
+    }
+    const dir = agentDir();
+    switch (cmd) {
+        case 'init': {
+            const configPath = join(dir, 'config.toml');
+            const secretsPath = join(dir, 'secrets.json');
+            if (!existsSync(configPath)) {
+                let template = CONFIG_TEMPLATE;
+                if (flags.get('hub')) {
+                    template = template.replace('hubUrl = "http://127.0.0.1:8787"', `hubUrl = "${flags.get('hub')}"`);
+                }
+                if (flags.get('token')) {
+                    template = template.replace('token = "asp_PASTE_PRODUCER_TOKEN"', `token = "${flags.get('token')}"`);
+                }
+                writeFileAtomic(configPath, template, 0o600);
+                console.log(`wrote ${configPath}`);
+            }
+            else {
+                console.log(`exists, kept: ${configPath}`);
+            }
+            if (!existsSync(secretsPath)) {
+                writeFileAtomic(secretsPath, SECRETS_TEMPLATE, 0o600);
+                console.log(`wrote ${secretsPath}`);
+            }
+            else {
+                console.log(`exists, kept: ${secretsPath}`);
+            }
+            console.log('\nnext steps:');
+            console.log('  1. edit config.toml: backends + offerings (namespace must be your producer name)');
+            console.log('  2. put upstream keys in secrets.json (they never leave this machine)');
+            console.log('  3. aweshare agent doctor   # find the first failing link');
+            console.log('  4. aweshare agent grant --alias YOU/model --consumer NAME');
+            console.log('  5. aweshare agent start');
+            return;
+        }
+        case 'doctor': {
+            const report = await runDoctor(dir);
+            for (const check of report.checks) {
+                console.log(`${check.ok ? '  ok ' : 'FAIL '} ${check.name}: ${check.detail}`);
+            }
+            console.log(report.ok ? '\ndoctor: all green' : '\ndoctor: fix the first FAIL above, then re-run');
+            process.exitCode = report.ok ? 0 : 1;
+            return;
+        }
+        case 'start': {
+            const { config, secrets } = loadAgentConfig(dir);
+            const connection = new AgentConnection({
+                config,
+                secrets,
+                log: pino({ level: process.env.AWESHARE_LOG ?? 'info' }),
+            });
+            const shutdown = () => {
+                console.error('\nshutting down…');
+                void connection.stop().then(() => process.exit(0));
+            };
+            process.on('SIGINT', shutdown);
+            process.on('SIGTERM', shutdown);
+            await connection.start();
+            return;
+        }
+        case 'grant':
+        case 'revoke':
+        case 'list': {
+            const { config } = loadAgentConfig(dir);
+            const base = config.hubUrl;
+            const auth = { authorization: `Bearer ${config.token}`, 'content-type': 'application/json' };
+            if (cmd === 'grant' || cmd === 'revoke') {
+                const alias = flags.get('alias');
+                const consumer = flags.get('consumer');
+                if (!alias || !consumer)
+                    fail('--alias and --consumer are required');
+                const body = { alias, consumer };
+                const expiresIn = flags.get('expires-in');
+                if (cmd === 'grant' && expiresIn) {
+                    body.expiresAt = new Date(Date.now() + parseDuration(expiresIn)).toISOString();
+                }
+                const res = cmd === 'grant'
+                    ? await fetch(`${base}/admin/v1/grants`, {
+                        method: 'PUT',
+                        headers: auth,
+                        body: JSON.stringify(body),
+                    })
+                    : await fetch(`${base}/admin/v1/grants?alias=${encodeURIComponent(alias)}&consumer=${encodeURIComponent(consumer)}`, { method: 'DELETE', headers: auth });
+                const data = (await res.json().catch(() => ({})));
+                if (!res.ok)
+                    fail(`${res.status} ${data.error?.message ?? res.statusText}`);
+                console.log(JSON.stringify(data));
+                return;
+            }
+            const res = await fetch(`${base}/admin/v1/grants`, { headers: auth });
+            const data = (await res.json().catch(() => ({})));
+            if (!res.ok)
+                fail(`${res.status} ${data.error?.message ?? res.statusText}`);
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        default:
+            fail(`unknown command: ${cmd}\n\n${USAGE}`);
+    }
+}
+main().catch((err) => fail(errorMessage(err)));
+//# sourceMappingURL=cli.js.map

package/apps/agent/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EACL,QAAQ,EACR,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAG7E,CAAC,OAAO,CAAA;AAET,MAAM,KAAK,GAAG;;;;;;;;;;;8DAWgD,CAAA;AAE9D,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAA;QAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAW,CAAC,CAAA;YAC5C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,GAA+D,CAAC,KAAK,CAAA;QACpF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAA0B,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAA;QACxC,OAAM;IACR,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;IAEtB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,IAAI,QAAQ,GAAG,eAAe,CAAA;gBAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,kCAAkC,EAClC,aAAa,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CACjC,CAAA;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,oCAAoC,EACpC,YAAY,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAClC,CAAA;gBACH,CAAC;gBACD,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;YAC5C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;gBACrD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAA;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CACT,oFAAoF,CACrF,CAAA;YACD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;YACrF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;YAC1E,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/E,CAAC;YACD,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iDAAiD,CACtF,CAAA;YACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAChD,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;gBACrC,MAAM;gBACN,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;aACzD,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACjC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,CAAC,CAAA;YACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC/B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;YAC1B,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;YAC5F,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACtC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;oBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;gBACpE,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;gBACxD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBACzC,IAAI,GAAG,KAAK,OAAO,IAAI,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;gBAChF,CAAC;gBACD,MAAM,GAAG,GACP,GAAG,KAAK,OAAO;oBACb,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE;wBACrC,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CAAC;oBACJ,CAAC,CAAC,MAAM,KAAK,CACT,GAAG,IAAI,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACrG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAA;gBACP,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAqC,CAAA;gBACrF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;gBAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;gBACjC,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAqC,CAAA;YACrF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC1C,OAAM;QACR,CAAC;QAED;YACE,IAAI,CAAC,oBAAoB,GAAG,OAAO,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA"}

package/apps/agent/dist/config.d.ts

@@ -0,0 +1,38 @@
+import { type Protocol } from 'aweshare-protocol';
+export interface Backend {
+    id: string;
+    protocol: Protocol;
+    /**
+     * Follows the SDK convention of the protocol:
+     * openai-style includes /v1 (e.g. http://127.0.0.1:11434/v1); anthropic-style
+     * excludes it (the agent appends /v1 itself); responses follows the openai
+     * convention (e.g. https://open.bigmodel.cn/api/v1).
+     */
+    baseUrl: string;
+    keyRef?: string;
+}
+export interface AgentOffering {
+    alias: string;
+    backend: string;
+    upstreamModel: string;
+    maxConcurrency: number;
+}
+export interface AgentConfig {
+    hubUrl: string;
+    token: string;
+    backends: Backend[];
+    offerings: AgentOffering[];
+}
+export declare function agentDir(env?: NodeJS.ProcessEnv): string;
+export declare class ConfigError extends Error {
+    readonly problems: string[];
+    constructor(message: string, problems: string[]);
+}
+export declare function loadAgentConfig(dir: string): {
+    config: AgentConfig;
+    secrets: Record<string, string>;
+};
+/** tmp+rename atomic write with owner-only permissions. */
+export declare function writeFileAtomic(path: string, content: string, mode?: number): void;
+export declare const CONFIG_TEMPLATE = "# aweshare agent configuration (~/.aweshare/config.toml)\n# Secrets live in ~/.aweshare/secrets.json and never leave this machine.\n\nhubUrl = \"http://127.0.0.1:8787\"\ntoken = \"asp_PASTE_PRODUCER_TOKEN\"\n\n# Backends hold the upstream API. baseUrl follows the SDK convention:\n#   openai-style (OpenAI/Ollama/vLLM/LM Studio) includes /v1, e.g. http://127.0.0.1:11434/v1\n#   anthropic-style excludes /v1, e.g. https://api.anthropic.com\n#   responses-style includes the version path, e.g. https://open.bigmodel.cn/api/v1\n[[backends]]\nid = \"ollama\"\nprotocol = \"openai\"\nbaseUrl = \"http://127.0.0.1:11434/v1\"\n# keyRef = \"ollama-key\"     # optional; keys live in secrets.json\n\n[[backends]]\nid = \"openai\"\nprotocol = \"openai\"\nbaseUrl = \"https://api.openai.com/v1\"\nkeyRef = \"openai-key\"\n\n# Offerings map a public alias (namespace/name) to a backend model.\n# The namespace must match your producer name on the hub.\n[[offerings]]\nalias = \"YOUR_NAME/qwen2.5.7b\"\nbackend = \"ollama\"\nupstreamModel = \"qwen2.5:7b\"   # must match 'ollama list' exactly, including the tag\nmaxConcurrency = 1             # start at 1 for local models\n\n[[offerings]]\nalias = \"YOUR_NAME/gpt-4o\"\nbackend = \"openai\"\nupstreamModel = \"gpt-4o-2024-11-20\"\nmaxConcurrency = 4\n";
+export declare const SECRETS_TEMPLATE = "{\n  \"openai-key\": \"sk-PASTE_YOUR_KEY\"\n}\n";