cartethyia 2.5.4 → 2.5.7

package/src/providers/authentication/jwt-validator.ts

@@ -236,14 +236,13 @@ function jsonResponse(body: unknown): Response {
  *
  * Key fetching, caching, in-flight deduplication, the minimum refresh interval
  * on an unknown `kid`, and `kid`-rotation pickup are all delegated to
- * `jose`'s `createRemoteJWKSet` — the same algorithm this class used to
- * reimplement by hand. `jose` additionally honours each JWK's `use` and
- * `key_ops`, so an encryption key published alongside the signing keys cannot
- * be selected for verification.
+ * `jose`'s `createRemoteJWKSet`. `jose` additionally honours each JWK's `use`
+ * and `key_ops`, so an encryption key published alongside the signing keys
+ * cannot be selected for verification.
  *
  * The algorithm is checked against `SUPPORTED_ALGORITHMS` *before* any key is
- * resolved, so the asymmetric-only allowlist (no `none`, no HMAC) is
- * unchanged by the migration.
+ * resolved, so the asymmetric-only allowlist (no `none`, no HMAC) holds
+ * regardless of what the JWKS publishes.
  */
 export class JwksVerifier {
   readonly #keys: RemoteJWKSet;
@@ -317,10 +316,10 @@ export class JwksVerifier {
 /**
  * One verifier per URL, bounded and time-limited.
  *
- * The registry used to be an unbounded, never-evicted `Map`: every JWKS URL
- * ever seen pinned its verifier — and its key cache — for the process
- * lifetime. A TTL plus a hard entry cap keeps a fleet of issuers from growing
- * it without limit while still sharing a verifier's key cache across calls.
+ * An unbounded, never-evicted registry would pin every JWKS URL ever seen —
+ * and its verifier's key cache — for the process lifetime. A TTL plus a hard
+ * entry cap keeps a fleet of issuers from growing it without limit while still
+ * sharing a verifier's key cache across calls.
  */
 const JWKS_VERIFIER_TTL_MS = 5 * 60 * 1_000;
 const JWKS_VERIFIER_MAX_ENTRIES = 64;

package/src/providers/authentication/oauth-refresh-service.ts

@@ -23,6 +23,7 @@
 import { randomUUID } from "node:crypto";
 import { and, eq, inArray, isNull, lt, or, sql } from "drizzle-orm";
 import type { CartethyiaDatabase } from "../../persistence/db-handle";
+import { sleep } from "../../shared/sleep";
 import { providerAccounts, providerOauthStates } from "../../persistence/schema";
 import { decryptCredentialToString, encryptCredential } from "../../security/crypto";
 import { invalidateCredentialCache } from "../operations/provider-credential-service";
@@ -258,6 +259,7 @@ async function disableAccount(
       )
       .returning({ id: providerOauthStates.providerAccountId });
     if (leaseRows.length === 0) return;
+    const disabledRecoveryMs = resolveAccountDisabledRecoveryMs();
     await tx
       .update(providerAccounts)
       .set({
@@ -271,13 +273,13 @@ async function disableAccount(
         lastErrorCategory: "auth_invalidated",
         lastErrorAt: new Date(),
         // Carries a recovery deadline so `sweepExpiredCooldowns` can bring this
-        // account back once it elapses. `disabled` used to be terminal, which
-        // parked a credential for good on one definitive rejection; the deadline
-        // is also what distinguishes this (machine-disabled) from an operator's
-        // own disable, which leaves `cooldownUntil` null and is therefore never
-        // swept. See `resolveAccountDisabledRecoveryMs`.
-        ...(resolveAccountDisabledRecoveryMs() > 0
-          ? { cooldownUntil: new Date(Date.now() + resolveAccountDisabledRecoveryMs()) }
+        // account back once it elapses; without one, one definitive rejection
+        // parks the credential for good. The deadline is also what distinguishes
+        // this (machine-disabled) from an operator's own disable, which leaves
+        // `cooldownUntil` null and is therefore never swept. See
+        // `resolveAccountDisabledRecoveryMs`.
+        ...(disabledRecoveryMs > 0
+          ? { cooldownUntil: new Date(Date.now() + disabledRecoveryMs) }
           : {}),
       })
       .where(eq(providerAccounts.id, accountId));
@@ -311,10 +313,6 @@ async function markStaticToken(db: CartethyiaDatabase, accountId: string): Promi
     .where(eq(providerAccounts.id, accountId));
 }
 
-function sleep(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 function failureMessage(error: unknown): string {
   if (error instanceof Error) return error.message;
   return String(error);

package/src/providers/configured-openai-providers.ts

@@ -1,137 +1,135 @@
-import type { ApiKeyProviderSpec } from "./configured-provider";
-import type { ProviderId } from "./provider-contracts";
-
-/**
- * Builtin providers whose entire adapter contract is "bearer auth against the
- * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
- * responses, `/v1`-prefixed paths". They carry no catalog, no OAuth, and no
- * provider-specific payload hook, so they share one spec shape rather than
- * one module each.
- *
- * `base_url` is resolved per provider by `providerBaseUrl(provider_id)`.
- *
- * These providers list their models through live `/v1/models` discovery rather
- * than a static catalog: every one of them republishes an aggregator's whole
- * roster, which changes faster than a committed array can. Each registry row
- * pairs this spec with `openAIModelDiscovery`.
- */
-export const GENERIC_API_KEY_PROVIDER_IDS = [
-  "larprouter",
-  "mistral",
-  "fireworks",
-  "nvidia",
-  "gmi",
-  "ollamacloud",
-  "together",
-  "siliconflow",
-  "siliconflowcn",
-  "nanogpt",
-  "baseten",
-  "synthetic",
-  "stepfun",
-  "sakana",
-  "helmcode",
-  "coralbricks",
-  "aiand",
-  "wafer",
-  "coreweave",
-  "qwen-portal",
-  "dashscope",
-  // `deepseek` is intentionally absent: it dispatches on the Anthropic Messages
-  // wire at its `/anthropic` root, not the OpenAI chat/responses wires, so it
-  // carries a dedicated entry in `default-registry.ts` instead.
-  //
-  // The aggregators below are absent for a different reason: their base URL is
-  // already rooted at a version segment that the `/v1`-prefixed path this shape
-  // pins would duplicate (`/openai/v1`, `/v1/openai`, `/v3/openai`, `/api/v1`,
-  // `/v2`, and `/inference/v1`), so `joinUrl` would produce
-  // `…/v1/v1/chat/completions`. They use `versionedRootApiKeySpec` instead,
-  // which pins the path below the version root — the same reason `cerebras`
-  // declares `/chat/completions` explicitly.
-] as const;
-
-/**
- * Ids whose base URL already ends at a version segment.
- *
- * `joinUrl` is plain concatenation and nothing rewrites a declared path, so a
- * base already rooted at a version plus a `/v1/…` path doubles the segment and
- * every request 404s. These specs therefore declare the path *below* the
- * version root. That is the provider stating the truth about its own wire, not
- * a correction applied to it: a wrong path now reaches the operator as the
- * wrong URL instead of being quietly rewritten into a different address.
- */
-export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = [
-  "groq",
-  "deepinfra",
-  "novita",
-  "venice",
-  "qianfan",
-  "zhipucoding",
-  "firepass",
-] as const;
-
-export type VersionedRootApiKeyProviderId =
-  (typeof VERSIONED_ROOT_API_KEY_PROVIDER_IDS)[number];
-
-function versionedRootApiKeySpec(providerId: ProviderId): ApiKeyProviderSpec {
-  return {
-    provider_id: providerId,
-    endpoint_paths_by_wire_family: {
-      chat: "/chat/completions",
-      responses: "/responses",
-    },
-  };
-}
-
-export const VERSIONED_ROOT_API_KEY_SPECS = {
-  groq: versionedRootApiKeySpec("groq"),
-  deepinfra: versionedRootApiKeySpec("deepinfra"),
-  novita: versionedRootApiKeySpec("novita"),
-  venice: versionedRootApiKeySpec("venice"),
-  qianfan: versionedRootApiKeySpec("qianfan"),
-  zhipucoding: versionedRootApiKeySpec("zhipucoding"),
-  firepass: versionedRootApiKeySpec("firepass"),
-} satisfies Readonly<Record<VersionedRootApiKeyProviderId, ApiKeyProviderSpec>>;
-
-/**
- * One id that has both a generic spec and a registry row.
- *
- * Exported so the registry can be checked against the spec list rather than
- * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
- * row naming a provider with no spec is a compile error instead of an
- * `undefined` adapter at first dispatch.
- */
-export type GenericApiKeyProviderId = (typeof GENERIC_API_KEY_PROVIDER_IDS)[number];
-
-function genericApiKeySpec(providerId: GenericApiKeyProviderId): ApiKeyProviderSpec {
-  // These roots are *not* bare hosts — every one of them already ends at `/v1`
-  // — so the path is declared below that root. It used to be pinned from
-  // `BARE_ROOT_ENDPOINTS` and silently corrected at dispatch, which meant the
-  // declared path was wrong for all of them and nothing said so. Both spec
-  // shapes now declare the same thing, so this is the one implementation.
-  return versionedRootApiKeySpec(providerId);
-}
-
-export const GENERIC_API_KEY_SPECS = {
-  larprouter: genericApiKeySpec("larprouter"),
-  mistral: genericApiKeySpec("mistral"),
-  fireworks: genericApiKeySpec("fireworks"),
-  nvidia: genericApiKeySpec("nvidia"),
-  gmi: genericApiKeySpec("gmi"),
-  ollamacloud: genericApiKeySpec("ollamacloud"),
-  together: genericApiKeySpec("together"),
-  siliconflow: genericApiKeySpec("siliconflow"),
-  siliconflowcn: genericApiKeySpec("siliconflowcn"),
-  nanogpt: genericApiKeySpec("nanogpt"),
-  baseten: genericApiKeySpec("baseten"),
-  synthetic: genericApiKeySpec("synthetic"),
-  stepfun: genericApiKeySpec("stepfun"),
-  sakana: genericApiKeySpec("sakana"),
-  helmcode: genericApiKeySpec("helmcode"),
-  coralbricks: genericApiKeySpec("coralbricks"),
-  aiand: genericApiKeySpec("aiand"),
-  wafer: genericApiKeySpec("wafer"),
-  coreweave: genericApiKeySpec("coreweave"),
-  dashscope: genericApiKeySpec("dashscope"),
-  "qwen-portal": genericApiKeySpec("qwen-portal"),
+import type { ApiKeyProviderSpec } from "./configured-provider";
+import type { ProviderId } from "./provider-contracts";
+
+/**
+ * Builtin providers whose entire adapter contract is "bearer auth against the
+ * provider's `BUNDLED_PROVIDER_METADATA` base URL, OpenAI-compatible chat +
+ * responses, `/v1`-prefixed paths". They carry no catalog, no OAuth, and no
+ * provider-specific payload hook, so they share one spec shape rather than
+ * one module each.
+ *
+ * `base_url` is resolved per provider by `providerBaseUrl(provider_id)`.
+ *
+ * These providers list their models through live `/v1/models` discovery rather
+ * than a static catalog: every one of them republishes an aggregator's whole
+ * roster, which changes faster than a committed array can. Each registry row
+ * pairs this spec with `openAIModelDiscovery`.
+ */
+export const GENERIC_API_KEY_PROVIDER_IDS = [
+  "larprouter",
+  "mistral",
+  "fireworks",
+  "nvidia",
+  "gmi",
+  "ollamacloud",
+  "together",
+  "siliconflow",
+  "siliconflowcn",
+  "nanogpt",
+  "baseten",
+  "synthetic",
+  "stepfun",
+  "sakana",
+  "helmcode",
+  "coralbricks",
+  "aiand",
+  "wafer",
+  "coreweave",
+  "qwen-portal",
+  "dashscope",
+  // `deepseek` is intentionally absent: it dispatches on the Anthropic Messages
+  // wire at its `/anthropic` root, not the OpenAI chat/responses wires, so it
+  // carries a dedicated entry in `default-registry.ts` instead.
+  //
+  // The aggregators below are absent for a different reason: their base URL is
+  // already rooted at a version segment that the `/v1`-prefixed path this shape
+  // pins would duplicate (`/openai/v1`, `/v1/openai`, `/v3/openai`, `/api/v1`,
+  // `/v2`, and `/inference/v1`), so `joinUrl` would produce
+  // `…/v1/v1/chat/completions`. They use `versionedRootApiKeySpec` instead,
+  // which pins the path below the version root — the same reason `cerebras`
+  // declares `/chat/completions` explicitly.
+] as const;
+
+/**
+ * Ids whose base URL already ends at a version segment.
+ *
+ * `joinUrl` is plain concatenation and nothing rewrites a declared path, so a
+ * base already rooted at a version plus a `/v1/…` path doubles the segment and
+ * every request 404s. These specs therefore declare the path *below* the
+ * version root. That is the provider stating the truth about its own wire, not
+ * a correction applied to it: a wrong path now reaches the operator as the
+ * wrong URL instead of being quietly rewritten into a different address.
+ */
+export const VERSIONED_ROOT_API_KEY_PROVIDER_IDS = [
+  "groq",
+  "deepinfra",
+  "novita",
+  "venice",
+  "qianfan",
+  "zhipucoding",
+  "firepass",
+] as const;
+
+export type VersionedRootApiKeyProviderId =
+  (typeof VERSIONED_ROOT_API_KEY_PROVIDER_IDS)[number];
+
+function versionedRootApiKeySpec(providerId: ProviderId): ApiKeyProviderSpec {
+  return {
+    provider_id: providerId,
+    endpoint_paths_by_wire_family: {
+      chat: "/chat/completions",
+      responses: "/responses",
+    },
+  };
+}
+
+export const VERSIONED_ROOT_API_KEY_SPECS = {
+  groq: versionedRootApiKeySpec("groq"),
+  deepinfra: versionedRootApiKeySpec("deepinfra"),
+  novita: versionedRootApiKeySpec("novita"),
+  venice: versionedRootApiKeySpec("venice"),
+  qianfan: versionedRootApiKeySpec("qianfan"),
+  zhipucoding: versionedRootApiKeySpec("zhipucoding"),
+  firepass: versionedRootApiKeySpec("firepass"),
+} satisfies Readonly<Record<VersionedRootApiKeyProviderId, ApiKeyProviderSpec>>;
+
+/**
+ * One id that has both a generic spec and a registry row.
+ *
+ * Exported so the registry can be checked against the spec list rather than
+ * repeating the id as a string: `discoveryBackedProvider` takes this type, so a
+ * row naming a provider with no spec is a compile error instead of an
+ * `undefined` adapter at first dispatch.
+ */
+export type GenericApiKeyProviderId = (typeof GENERIC_API_KEY_PROVIDER_IDS)[number];
+
+function genericApiKeySpec(providerId: GenericApiKeyProviderId): ApiKeyProviderSpec {
+  // These roots are *not* bare hosts — every one of them already ends at `/v1`
+  // — so the path is declared below that root. Both spec shapes declare the same
+  // thing, so this is the one implementation.
+  return versionedRootApiKeySpec(providerId);
+}
+
+export const GENERIC_API_KEY_SPECS = {
+  larprouter: genericApiKeySpec("larprouter"),
+  mistral: genericApiKeySpec("mistral"),
+  fireworks: genericApiKeySpec("fireworks"),
+  nvidia: genericApiKeySpec("nvidia"),
+  gmi: genericApiKeySpec("gmi"),
+  ollamacloud: genericApiKeySpec("ollamacloud"),
+  together: genericApiKeySpec("together"),
+  siliconflow: genericApiKeySpec("siliconflow"),
+  siliconflowcn: genericApiKeySpec("siliconflowcn"),
+  nanogpt: genericApiKeySpec("nanogpt"),
+  baseten: genericApiKeySpec("baseten"),
+  synthetic: genericApiKeySpec("synthetic"),
+  stepfun: genericApiKeySpec("stepfun"),
+  sakana: genericApiKeySpec("sakana"),
+  helmcode: genericApiKeySpec("helmcode"),
+  coralbricks: genericApiKeySpec("coralbricks"),
+  aiand: genericApiKeySpec("aiand"),
+  wafer: genericApiKeySpec("wafer"),
+  coreweave: genericApiKeySpec("coreweave"),
+  dashscope: genericApiKeySpec("dashscope"),
+  "qwen-portal": genericApiKeySpec("qwen-portal"),
 } satisfies Readonly<Record<GenericApiKeyProviderId, ApiKeyProviderSpec>>;