evolcore 0.0.8 → 0.0.9

package/ecagent/src/runtime/auth/resolve.ts

@@ -1,141 +0,0 @@
-import type { Api, ImagesApi, ImagesModel, Model, ProviderEnv } from "../types.ts";
-import type {
-	ApiKeyAuth,
-	ApiKeyCredential,
-	AuthContext,
-	AuthResult,
-	Credential,
-	CredentialStore,
-	OAuthAuth,
-	OAuthCredential,
-	ProviderAuth,
-} from "./types.ts";
-
-export type ModelsErrorCode = "model_source" | "model_validation" | "provider" | "stream" | "auth" | "oauth";
-
-export interface AuthResolutionOverrides {
-	apiKey?: string;
-	env?: ProviderEnv;
-}
-
-export class ModelsError extends Error {
-	readonly code: ModelsErrorCode;
-
-	constructor(code: ModelsErrorCode, message: string, options?: { cause?: unknown }) {
-		super(message, options);
-		this.name = "ModelsError";
-		this.code = code;
-	}
-}
-
-/** Model shape auth resolution receives: chat or image-generation models. */
-export type AuthModel = Model<Api> | ImagesModel<ImagesApi>;
-
-/**
- * Auth resolution shared by the `Models` and `ImagesModels` collections.
- * A stored credential owns the provider: ambient/env is consulted only when
- * nothing is stored. No silent env fallback after a failed refresh or for a
- * credential type without a matching handler.
- */
-export async function resolveProviderAuth(
-	provider: { id: string; auth: ProviderAuth },
-	model: AuthModel,
-	credentials: CredentialStore,
-	authContext: AuthContext,
-	overrides?: AuthResolutionOverrides,
-): Promise<AuthResult | undefined> {
-	const requestAuthContext = overrides?.env ? overlayEnvAuthContext(authContext, overrides.env) : authContext;
-
-	if (overrides?.apiKey !== undefined && provider.auth.apiKey) {
-		return resolveApiKey(requestAuthContext, provider.auth.apiKey, model, {
-			type: "api_key",
-			key: overrides.apiKey,
-			env: overrides.env,
-		});
-	}
-
-	const stored = await readCredential(credentials, provider.id);
-	if (stored) {
-		if (stored.type === "oauth" && provider.auth.oauth) {
-			return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, stored);
-		}
-		if (stored.type === "api_key" && provider.auth.apiKey) {
-			const credential = overrides?.env ? { ...stored, env: { ...stored.env, ...overrides.env } } : stored;
-			return resolveApiKey(requestAuthContext, provider.auth.apiKey, model, credential);
-		}
-		return undefined;
-	}
-
-	// Ambient (env vars, AWS profiles, ADC files).
-	return provider.auth.apiKey ? resolveApiKey(requestAuthContext, provider.auth.apiKey, model, undefined) : undefined;
-}
-
-function overlayEnvAuthContext(base: AuthContext, env: ProviderEnv): AuthContext {
-	return {
-		env: async (name) => env[name] || (await base.env(name)),
-		fileExists: (path) => base.fileExists(path),
-	};
-}
-
-/**
- * OAuth resolution with double-checked locking (same pattern as today's
- * AuthStorage): valid tokens cost zero locks; expired tokens lock, re-check
- * expiry under the lock, refresh once globally, and persist the rotated
- * credential before release.
- */
-async function resolveStoredOAuth(
-	credentials: CredentialStore,
-	providerId: string,
-	oauth: OAuthAuth,
-	stored: OAuthCredential,
-): Promise<AuthResult | undefined> {
-	let credential = stored;
-
-	if (Date.now() >= credential.expires) {
-		// Optimistic check said expired; the authoritative check runs under the lock.
-		let post: Credential | undefined;
-		try {
-			post = await credentials.modify(providerId, async (current) => {
-				if (current?.type !== "oauth") return undefined; // logged out meanwhile
-				if (Date.now() < current.expires) return undefined; // another process/request refreshed
-				try {
-					return await oauth.refresh(current);
-				} catch (error) {
-					throw new ModelsError("oauth", `OAuth refresh failed for ${providerId}`, { cause: error });
-				}
-			});
-		} catch (error) {
-			if (error instanceof ModelsError) throw error;
-			throw new ModelsError("auth", `Credential store modify failed for ${providerId}`, { cause: error });
-		}
-		if (post?.type !== "oauth") return undefined; // logged out meanwhile
-		credential = post;
-	}
-
-	try {
-		return { auth: await oauth.toAuth(credential), source: "OAuth" };
-	} catch (error) {
-		throw new ModelsError("oauth", `OAuth auth derivation failed for ${providerId}`, { cause: error });
-	}
-}
-
-async function resolveApiKey(
-	authContext: AuthContext,
-	apiKey: ApiKeyAuth,
-	model: AuthModel,
-	credential: ApiKeyCredential | undefined,
-): Promise<AuthResult | undefined> {
-	try {
-		return await apiKey.resolve({ model, ctx: authContext, credential });
-	} catch (error) {
-		throw new ModelsError("auth", `API key auth failed for provider ${model.provider}`, { cause: error });
-	}
-}
-
-async function readCredential(credentials: CredentialStore, providerId: string): Promise<Credential | undefined> {
-	try {
-		return await credentials.read(providerId);
-	} catch (error) {
-		throw new ModelsError("auth", `Credential store read failed for ${providerId}`, { cause: error });
-	}
-}

package/ecagent/src/runtime/auth/types.ts

@@ -1,182 +0,0 @@
-import type { Api, ImagesApi, ImagesModel, Model, ProviderEnv, ProviderHeaders } from "../types.ts";
-import type { OAuthCredentials } from "../utils/oauth/types.ts";
-
-/**
- * Request auth for a single model request. If a value cannot be expressed as
- * `apiKey`, `headers`, or `baseUrl`, it is provider config, not auth.
- */
-export interface ModelAuth {
-	apiKey?: string;
-	headers?: ProviderHeaders;
-	baseUrl?: string;
-}
-
-/**
- * Stored api-key credential. `env` holds provider-scoped environment/config
- * values such as Cloudflare account/gateway ids.
- */
-export interface ApiKeyCredential {
-	type: "api_key";
-	key?: string;
-	env?: ProviderEnv;
-}
-
-/** Stored OAuth credential (`access`, `refresh`, `expires` from OAuthCredentials). */
-export interface OAuthCredential extends OAuthCredentials {
-	type: "oauth";
-}
-
-/** One type-tagged credential per provider — the shape of today's auth.json. */
-export type Credential = ApiKeyCredential | OAuthCredential;
-
-/**
- * App-owned credential storage, keyed by `Provider.id`, one credential per
- * provider. `modify` is the only write path, so every mutation is a
- * serialized read-modify-write; `Models.getAuth()` runs OAuth refresh inside
- * `modify` so concurrent requests cannot double-refresh a rotated token. The
- * app persists a credential after login via
- * `modify(provider.id, async () => credential)`. Login/logout orchestration
- * is app-owned.
- *
- * Error semantics: `read` resolves `undefined` for missing entries. Methods
- * reject only on storage failure; `Models` wraps such rejections in
- * `ModelsError` with code "auth". Best-effort stores that serve an in-memory
- * view and record persistence errors internally (like coding-agent's
- * AuthStorage) are valid implementations.
- */
-export interface CredentialStore {
-	/**
-	 * Read the stored credential, possibly expired. Display/status use;
-	 * resolved request auth comes from `Models.getAuth()`.
-	 */
-	read(providerId: string): Promise<Credential | undefined>;
-
-	/**
-	 * Serialized write — the only write path. `fn` sees the current credential
-	 * because correct writes (refresh, login-during-refresh) depend on it;
-	 * return the new credential, or undefined to leave the entry unchanged.
-	 * Mutual exclusion per provider id, cross-process too where the backing
-	 * store supports it (e.g. a file lock). Resolves with the post-write
-	 * credential. Rejections from `fn` propagate.
-	 */
-	modify(
-		providerId: string,
-		fn: (current: Credential | undefined) => Promise<Credential | undefined>,
-	): Promise<Credential | undefined>;
-
-	/** Remove a credential (logout). Implementations serialize this against `modify`. */
-	delete(providerId: string): Promise<void>;
-}
-
-/** Environment access for auth resolution. Injectable for tests and browsers. */
-export interface AuthContext {
-	env(name: string): Promise<string | undefined>;
-	/** Check whether a file exists. Supports a leading `~`. Always false in browsers. */
-	fileExists(path: string): Promise<boolean>;
-}
-
-/** Result of resolving auth for a model. */
-export interface AuthResult {
-	auth: ModelAuth;
-	/** Provider-scoped environment/config values resolved from credentials and ambient context. */
-	env?: ProviderEnv;
-	/** Human-readable label for status UI: "ANTHROPIC_API_KEY", "OAuth", "~/.aws/credentials". */
-	source?: string;
-}
-
-/**
- * Prompt shown to the user during login. `signal` lets the flow cancel a
- * pending prompt when an out-of-band event resolves the step, e.g. a
- * `manual_code` prompt raced against a callback server, aborted when the
- * callback wins.
- */
-export type AuthPrompt = { signal?: AbortSignal } & (
-	| { type: "text"; message: string; placeholder?: string }
-	| { type: "secret"; message: string; placeholder?: string }
-	| { type: "select"; message: string; options: readonly { id: string; label: string; description?: string }[] }
-	| { type: "manual_code"; message: string; placeholder?: string }
-);
-
-export type AuthEvent =
-	| { type: "auth_url"; url: string; instructions?: string }
-	| {
-			type: "device_code";
-			userCode: string;
-			verificationUri: string;
-			intervalSeconds?: number;
-			expiresInSeconds?: number;
-	  }
-	| { type: "progress"; message: string };
-
-/**
- * Login interaction callbacks serving both api-key and OAuth flows.
- *
- * `prompt()` returns the entered/selected string (`select` returns the option
- * id). Rejects on cancel/abort. `signal` aborts the whole login flow;
- * per-prompt cancellation uses `AuthPrompt.signal`.
- */
-export interface AuthLoginCallbacks {
-	signal?: AbortSignal;
-
-	prompt(prompt: AuthPrompt): Promise<string>;
-	notify(event: AuthEvent): void;
-}
-
-/**
- * Api-key auth: stored key/provider env plus ambient sources (env vars, AWS
- * profiles, ADC files). Ambient-only providers omit `login`.
- */
-export interface ApiKeyAuth {
-	/** Display name, e.g. "Anthropic API key". */
-	name: string;
-
-	/** Interactive setup (prompt for key/provider env). Absent = ambient-only. */
-	login?(callbacks: AuthLoginCallbacks): Promise<ApiKeyCredential>;
-
-	/**
-	 * Resolve auth from the stored credential and/or ambient sources, merging
-	 * per field (`credential.key ?? env("...")`, `credential.env?.NAME ?? env("...")`).
-	 * undefined = not configured. Receives the chat or image-generation model
-	 * the request is for (both carry `provider` and `baseUrl`).
-	 */
-	resolve(input: {
-		model: Model<Api> | ImagesModel<ImagesApi>;
-		ctx: AuthContext;
-		credential?: ApiKeyCredential;
-	}): Promise<AuthResult | undefined>;
-}
-
-/**
- * OAuth auth. The `refresh`/`toAuth` split lets `Models` own the locked
- * refresh pattern: `refresh` produces a credential, `toAuth` derives request
- * auth from whatever credential ends up stored.
- */
-export interface OAuthAuth {
-	/** Display name, e.g. "Anthropic (Claude Pro/Max)". */
-	name: string;
-
-	login(callbacks: AuthLoginCallbacks): Promise<OAuthCredential>;
-
-	/**
-	 * Exchange the refresh token. Network call; throws on failure
-	 * (invalid_grant etc.). `Models` runs this under the store lock.
-	 */
-	refresh(credential: OAuthCredential): Promise<OAuthCredential>;
-
-	/**
-	 * Side-effect-free derivation of request auth from a valid credential.
-	 * Covers per-credential baseUrl (GitHub Copilot). Async so lazy wrappers
-	 * can load the implementation on first use.
-	 */
-	toAuth(credential: OAuthCredential): Promise<ModelAuth>;
-}
-
-/**
- * Provider auth. At least one of `apiKey`/`oauth` must be present: even
- * ambient-credential providers and keyless local servers provide `apiKey`
- * auth whose `resolve()` reports whether the provider is configured.
- */
-export interface ProviderAuth {
-	apiKey?: ApiKeyAuth;
-	oauth?: OAuthAuth;
-}

package/ecagent/src/runtime/compat.ts

@@ -1,158 +0,0 @@
-export * from "./index.ts";
-export * from "./api/pi-messages.lazy.ts";
-
-import { piMessagesApi } from "./api/pi-messages.lazy.ts";
-import { createFauxCore, type FauxProviderRegistration, type RegisterFauxProviderOptions } from "./providers/faux.ts";
-import type {
-	Api,
-	AssistantMessage,
-	AssistantMessageEventStream,
-	Context,
-	Model,
-	ProviderStreamOptions,
-	SimpleStreamOptions,
-	StreamFunction,
-	StreamOptions,
-} from "./types.ts";
-
-export type ApiStreamFunction = (
-	model: Model<Api>,
-	context: Context,
-	options?: StreamOptions,
-) => AssistantMessageEventStream;
-
-export type ApiStreamSimpleFunction = (
-	model: Model<Api>,
-	context: Context,
-	options?: SimpleStreamOptions,
-) => AssistantMessageEventStream;
-
-export interface ApiProvider<TApi extends Api = Api, TOptions extends StreamOptions = StreamOptions> {
-	api: TApi;
-	stream: StreamFunction<TApi, TOptions>;
-	streamSimple: StreamFunction<TApi, SimpleStreamOptions>;
-}
-
-interface ApiProviderInternal {
-	api: Api;
-	stream: ApiStreamFunction;
-	streamSimple: ApiStreamSimpleFunction;
-}
-
-const apiProviderRegistry = new Map<string, { provider: ApiProviderInternal; sourceId?: string }>();
-
-function wrapStream<TApi extends Api, TOptions extends StreamOptions>(
-	api: TApi,
-	streamFunction: StreamFunction<TApi, TOptions>,
-): ApiStreamFunction {
-	return (model, context, options) => {
-		if (model.api !== api) throw new Error(`Mismatched api: ${model.api} expected ${api}`);
-		return streamFunction(model as Model<TApi>, context, options as TOptions);
-	};
-}
-
-function wrapStreamSimple<TApi extends Api>(
-	api: TApi,
-	streamFunction: StreamFunction<TApi, SimpleStreamOptions>,
-): ApiStreamSimpleFunction {
-	return (model, context, options) => {
-		if (model.api !== api) throw new Error(`Mismatched api: ${model.api} expected ${api}`);
-		return streamFunction(model as Model<TApi>, context, options);
-	};
-}
-
-export function registerApiProvider<TApi extends Api, TOptions extends StreamOptions>(
-	provider: ApiProvider<TApi, TOptions>,
-	sourceId?: string,
-): void {
-	apiProviderRegistry.set(provider.api, {
-		provider: {
-			api: provider.api,
-			stream: wrapStream(provider.api, provider.stream),
-			streamSimple: wrapStreamSimple(provider.api, provider.streamSimple),
-		},
-		sourceId,
-	});
-}
-
-export function getApiProvider(api: Api): ApiProviderInternal | undefined {
-	return apiProviderRegistry.get(api)?.provider;
-}
-
-export function getApiProviders(): ApiProviderInternal[] {
-	return Array.from(apiProviderRegistry.values(), (entry) => entry.provider);
-}
-
-export function unregisterApiProviders(sourceId: string): void {
-	for (const [api, entry] of apiProviderRegistry.entries()) {
-		if (entry.sourceId === sourceId) apiProviderRegistry.delete(api);
-	}
-}
-
-export function registerFauxProvider(options: RegisterFauxProviderOptions = {}): FauxProviderRegistration {
-	const core = createFauxCore(options);
-	const sourceId = `faux-provider-${Math.random().toString(36).slice(2, 10)}`;
-	registerApiProvider({ api: core.api, stream: core.stream, streamSimple: core.streamSimple }, sourceId);
-	return {
-		api: core.api,
-		models: core.models,
-		getModel: core.getModel,
-		state: core.state,
-		setResponses: core.setResponses,
-		appendResponses: core.appendResponses,
-		getPendingResponseCount: core.getPendingResponseCount,
-		unregister: () => unregisterApiProviders(sourceId),
-	};
-}
-
-export function registerBuiltInApiProviders(): void {
-	if (!getApiProvider("pi-messages")) {
-		const streams = piMessagesApi();
-		registerApiProvider({ api: "pi-messages", stream: streams.stream, streamSimple: streams.streamSimple });
-	}
-}
-
-export function resetApiProviders(): void {
-	apiProviderRegistry.clear();
-	registerBuiltInApiProviders();
-}
-
-registerBuiltInApiProviders();
-
-function requireApiProvider(api: Api): ApiProviderInternal {
-	const provider = getApiProvider(api);
-	if (!provider) throw new Error(`No API provider registered for api: ${api}`);
-	return provider;
-}
-
-export function stream<TApi extends Api>(
-	model: Model<TApi>,
-	context: Context,
-	options?: ProviderStreamOptions,
-): AssistantMessageEventStream {
-	return requireApiProvider(model.api).stream(model, context, options);
-}
-
-export async function complete<TApi extends Api>(
-	model: Model<TApi>,
-	context: Context,
-	options?: ProviderStreamOptions,
-): Promise<AssistantMessage> {
-	return stream(model, context, options).result();
-}
-
-export function streamSimple<TApi extends Api>(
-	model: Model<TApi>,
-	context: Context,
-	options?: SimpleStreamOptions,
-): AssistantMessageEventStream {
-	return requireApiProvider(model.api).streamSimple(model, context, options);
-}
-
-export async function completeSimple<TApi extends Api>(
-	model: Model<TApi>,
-	context: Context,
-	options?: SimpleStreamOptions,
-): Promise<AssistantMessage> {
-	return streamSimple(model, context, options).result();
-}

package/ecagent/src/runtime/index.ts

@@ -1,31 +0,0 @@
-export type { Static, TSchema } from "typebox";
-export { Type } from "typebox";
-export * from "./api/lazy.ts";
-export type { PiMessagesEvent, PiMessagesOptions, PiMessagesRewriteImpact } from "./api/pi-messages.ts";
-export * from "./auth/context.ts";
-export * from "./auth/credential-store.ts";
-export * from "./auth/helpers.ts";
-export * from "./auth/types.ts";
-export * from "./models.ts";
-export * from "./providers/faux.ts";
-export * from "./types.ts";
-export * from "./utils/diagnostics.ts";
-export * from "./utils/event-stream.ts";
-export * from "./utils/json-parse.ts";
-export type {
-	OAuthAuthInfo,
-	OAuthCredentials,
-	OAuthDeviceCodeInfo,
-	OAuthLoginCallbacks,
-	OAuthPrompt,
-	OAuthProvider,
-	OAuthProviderId,
-	OAuthProviderInfo,
-	OAuthProviderInterface,
-	OAuthSelectOption,
-	OAuthSelectPrompt,
-} from "./utils/oauth/types.ts";
-export * from "./utils/overflow.ts";
-export * from "./utils/retry.ts";
-export * from "./utils/typebox-helpers.ts";
-export * from "./utils/validation.ts";