nolo-cli 0.1.30 → 0.1.31

package/ai/token/providerCredential.ts

@@ -0,0 +1,89 @@
+import crypto from "crypto";
+
+export type ProviderApiKeySource =
+  | "platform_env"
+  | "agent_secret"
+  | "agent_reference"
+  | "user_secret"
+  | "space_secret"
+  | "unknown";
+
+export type ProviderCredentialIdentity = {
+  credentialId: string;
+  credentialFingerprint: string;
+  providerAccountKey: string;
+  apiKeySource: ProviderApiKeySource;
+  providerAccountAlias?: string;
+  environment?: string;
+  officialBillingAccountId?: string;
+  registryStatus?: "active" | "rotating" | "revoked";
+  registryEffectiveFrom?: string;
+  registryEffectiveTo?: string;
+};
+
+const normalizeToken = (value?: string | null) => value?.trim() || "";
+
+const safeTokenHash = (token: string) =>
+  crypto.createHash("sha256").update(token).digest("hex");
+
+const normalizeKeyPart = (value: string) =>
+  value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "") || "unknown";
+
+export function buildProviderAccountKey({
+  provider,
+  apiKeySource,
+  providerAccountAlias,
+  environment,
+}: {
+  provider: string;
+  apiKeySource: ProviderApiKeySource;
+  providerAccountAlias?: string | null;
+  environment?: string | null;
+}) {
+  const providerPart = normalizeKeyPart(provider);
+  const environmentPart = environment?.trim()
+    ? normalizeKeyPart(environment)
+    : "unknown-env";
+  const accountPart = providerAccountAlias?.trim()
+    ? normalizeKeyPart(providerAccountAlias)
+    : normalizeKeyPart(apiKeySource);
+  return `provider-account-${providerPart}-${environmentPart}-${accountPart}`;
+}
+
+export function createProviderCredentialIdentity({
+  provider,
+  apiKey,
+  apiKeySource,
+  providerAccountAlias,
+  environment,
+}: {
+  provider: string;
+  apiKey?: string | null;
+  apiKeySource: ProviderApiKeySource;
+  providerAccountAlias?: string | null;
+  environment?: string | null;
+}): ProviderCredentialIdentity | undefined {
+  const token = normalizeToken(apiKey);
+  if (!token) return undefined;
+  const hash = safeTokenHash(token);
+  const normalizedProvider = provider.trim().toLowerCase() || "unknown";
+  return {
+    credentialId: `cred_${normalizedProvider}_${apiKeySource}_${hash.slice(0, 16)}`,
+    credentialFingerprint: `sha256:${hash}`,
+    providerAccountKey: buildProviderAccountKey({
+      provider: normalizedProvider,
+      apiKeySource,
+      providerAccountAlias,
+      environment,
+    }),
+    apiKeySource,
+    ...(providerAccountAlias?.trim()
+      ? { providerAccountAlias: providerAccountAlias.trim() }
+      : {}),
+    ...(environment?.trim() ? { environment: environment.trim() } : {}),
+  };
+}

package/ai/token/providerCredentialAnomaly.ts

@@ -0,0 +1,154 @@
+import {
+  createBillingAnomaly,
+  type BillingAnomaly,
+} from "./billingAnomaly";
+import type { ProviderCallEvent } from "./providerCall";
+import type { ProviderCredentialIdentity } from "./providerCredential";
+
+export type BillingAnomalyWriterLike = (args: {
+  store: {
+    get(key: string): Promise<unknown>;
+    put(key: string, value: unknown): Promise<void>;
+  };
+  anomaly: BillingAnomaly;
+}) => Promise<{ key: string }>;
+
+export type BillingAnomalyWriteStore = Parameters<BillingAnomalyWriterLike>[0]["store"];
+
+export const isDuplicateBillingAnomalyError = (error: unknown) =>
+  error instanceof Error && error.message.startsWith("billing anomaly already exists:");
+
+export function createRevokedProviderCredentialUsedAnomaly({
+  event,
+  credential,
+  createdAt,
+}: {
+  event: ProviderCallEvent;
+  credential: ProviderCredentialIdentity;
+  createdAt: string;
+}): BillingAnomaly {
+  return createBillingAnomaly({
+    anomalyId: `anom_provider_credential_revoked_used_${event.providerCallId}`,
+    kind: "provider_credential_revoked_used",
+    severity: "high",
+    stage: "provider_call",
+    userId: event.userId,
+    dialogId: event.dialogId,
+    agentId: event.agentId,
+    provider: event.provider,
+    model: event.model,
+    providerCallId: event.providerCallId,
+    message: "Revoked provider credential was used for a provider call",
+    evidence: {
+      credentialId: credential.credentialId,
+      providerAccountKey: credential.providerAccountKey,
+      providerAccountAlias: credential.providerAccountAlias,
+      officialBillingAccountId: credential.officialBillingAccountId,
+      apiKeySource: credential.apiKeySource,
+      environment: credential.environment,
+      registryStatus: credential.registryStatus,
+      registryEffectiveFrom: credential.registryEffectiveFrom,
+      registryEffectiveTo: credential.registryEffectiveTo,
+      providerCallStatus: event.status,
+    },
+    createdAt,
+  });
+}
+
+export function createRevokedProviderCredentialBlockedAnomaly({
+  event,
+  credential,
+  createdAt,
+}: {
+  event: ProviderCallEvent;
+  credential: ProviderCredentialIdentity;
+  createdAt: string;
+}): BillingAnomaly {
+  return createBillingAnomaly({
+    anomalyId: `anom_provider_credential_revoked_blocked_${event.providerCallId}`,
+    kind: "provider_credential_revoked_blocked",
+    severity: "critical",
+    stage: "provider_call",
+    userId: event.userId,
+    dialogId: event.dialogId,
+    agentId: event.agentId,
+    provider: event.provider,
+    model: event.model,
+    providerCallId: event.providerCallId,
+    message: "Revoked provider credential was blocked before provider dispatch",
+    evidence: {
+      credentialId: credential.credentialId,
+      providerAccountKey: credential.providerAccountKey,
+      providerAccountAlias: credential.providerAccountAlias,
+      officialBillingAccountId: credential.officialBillingAccountId,
+      apiKeySource: credential.apiKeySource,
+      environment: credential.environment,
+      registryStatus: credential.registryStatus,
+      registryEffectiveFrom: credential.registryEffectiveFrom,
+      registryEffectiveTo: credential.registryEffectiveTo,
+      providerCallStatus: event.status,
+      blockedBeforeDispatch: true,
+    },
+    createdAt,
+  });
+}
+
+export async function writeRevokedProviderCredentialUsedAnomalyIfNeeded({
+  store,
+  event,
+  now = () => new Date(),
+  billingAnomalyWriter,
+  onError,
+}: {
+  store: BillingAnomalyWriteStore;
+  event: ProviderCallEvent;
+  now?: () => Date;
+  billingAnomalyWriter: BillingAnomalyWriterLike;
+  onError?: (error: unknown) => void;
+}) {
+  const credential = event.credential;
+  if (credential?.registryStatus !== "revoked") return;
+  try {
+    await billingAnomalyWriter({
+      store,
+      anomaly: createRevokedProviderCredentialUsedAnomaly({
+        event,
+        credential,
+        createdAt: now().toISOString(),
+      }),
+    });
+  } catch (error) {
+    if (isDuplicateBillingAnomalyError(error)) return;
+    onError?.(error);
+  }
+}
+
+export async function writeRevokedProviderCredentialBlockedAnomalyIfNeeded({
+  store,
+  event,
+  now = () => new Date(),
+  billingAnomalyWriter,
+  onError,
+}: {
+  store: BillingAnomalyWriteStore;
+  event: ProviderCallEvent;
+  now?: () => Date;
+  billingAnomalyWriter: BillingAnomalyWriterLike;
+  onError?: (error: unknown) => void;
+}) {
+  const credential = event.credential;
+  if (credential?.registryStatus !== "revoked") return;
+  try {
+    await billingAnomalyWriter({
+      store,
+      anomaly: createRevokedProviderCredentialBlockedAnomaly({
+        event,
+        credential,
+        createdAt: now().toISOString(),
+      }),
+    });
+  } catch (error) {
+    if (isDuplicateBillingAnomalyError(error)) return;
+    onError?.(error);
+  }
+}

package/ai/token/providerCredentialLifecycle.ts

@@ -0,0 +1,59 @@
+import type { ProviderCredentialStatus } from "./providerCredentialRegistry";
+
+export type ProviderCredentialLifecycleEvent = {
+  schemaVersion: 1;
+  recordType: "provider_credential_lifecycle_event";
+  credentialId: string;
+  eventId: string;
+  status: ProviderCredentialStatus;
+  effectiveAt: string;
+  createdAt: string;
+  reason?: string;
+  actorId?: string;
+};
+
+export const buildProviderCredentialLifecycleEventKey = (
+  credentialId: string,
+  eventId: string
+) => `provider-credential-lifecycle-${credentialId}-event-${eventId}`;
+
+function assertIsoTimestamp(name: string, value: string) {
+  const time = Date.parse(value);
+  if (!Number.isFinite(time)) {
+    throw new Error(`${name} must be an ISO timestamp`);
+  }
+}
+
+export function createProviderCredentialLifecycleEvent({
+  credentialId,
+  eventId,
+  status,
+  effectiveAt,
+  createdAt,
+  reason,
+  actorId,
+}: {
+  credentialId: string;
+  eventId: string;
+  status: ProviderCredentialStatus;
+  effectiveAt: string;
+  createdAt: string;
+  reason?: string | null;
+  actorId?: string | null;
+}): ProviderCredentialLifecycleEvent {
+  if (!credentialId.trim()) throw new Error("credentialId is required");
+  if (!eventId.trim()) throw new Error("eventId is required");
+  assertIsoTimestamp("effectiveAt", effectiveAt);
+  assertIsoTimestamp("createdAt", createdAt);
+  return {
+    schemaVersion: 1,
+    recordType: "provider_credential_lifecycle_event",
+    credentialId: credentialId.trim(),
+    eventId: eventId.trim(),
+    status,
+    effectiveAt,
+    createdAt,
+    ...(reason?.trim() ? { reason: reason.trim() } : {}),
+    ...(actorId?.trim() ? { actorId: actorId.trim() } : {}),
+  };
+}

package/ai/token/providerCredentialLifecycleWriter.ts

@@ -0,0 +1,44 @@
+import {
+  buildProviderCredentialLifecycleEventKey,
+  type ProviderCredentialLifecycleEvent,
+} from "./providerCredentialLifecycle";
+
+export type ProviderCredentialLifecycleStore = {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+};
+
+const isMissingRecordError = (error: unknown) => {
+  if (!error || typeof error !== "object") return false;
+  const code = (error as { code?: unknown }).code;
+  const message = (error as { message?: unknown }).message;
+  return (
+    code === "LEVEL_NOT_FOUND" ||
+    code === "NOT_FOUND" ||
+    message === "NotFound"
+  );
+};
+
+export async function writeProviderCredentialLifecycleEvent({
+  store,
+  event,
+}: {
+  store: ProviderCredentialLifecycleStore;
+  event: ProviderCredentialLifecycleEvent;
+}): Promise<{ key: string }> {
+  const key = buildProviderCredentialLifecycleEventKey(
+    event.credentialId,
+    event.eventId
+  );
+  let existing: unknown;
+  try {
+    existing = await store.get(key);
+  } catch (error) {
+    if (!isMissingRecordError(error)) throw error;
+  }
+  if (existing) {
+    throw new Error(`provider credential lifecycle event already exists: ${key}`);
+  }
+  await store.put(key, event);
+  return { key };
+}

package/ai/token/providerCredentialRegistry.ts

@@ -0,0 +1,83 @@
+import type {
+  ProviderApiKeySource,
+  ProviderCredentialIdentity,
+} from "./providerCredential";
+
+export type ProviderCredentialStatus = "active" | "rotating" | "revoked";
+
+export type ProviderCredentialRegistryRecord = {
+  schemaVersion: 1;
+  recordType: "provider_credential";
+  credentialId: string;
+  provider: string;
+  providerAccountKey: string;
+  credentialFingerprint: string;
+  apiKeySource: ProviderApiKeySource;
+  status: ProviderCredentialStatus;
+  effectiveFrom: string;
+  effectiveTo?: string;
+  createdAt: string;
+  providerAccountAlias?: string;
+  environment?: string;
+  officialBillingAccountId?: string;
+  note?: string;
+};
+
+export const buildProviderCredentialRegistryKey = (credentialId: string) =>
+  `provider-credential-${credentialId}`;
+
+function assertIsoTimestamp(name: string, value: string) {
+  const time = Date.parse(value);
+  if (!Number.isFinite(time)) {
+    throw new Error(`${name} must be an ISO timestamp`);
+  }
+}
+
+export function createProviderCredentialRegistryRecord({
+  provider,
+  identity,
+  status,
+  effectiveFrom,
+  effectiveTo,
+  createdAt,
+  officialBillingAccountId,
+  note,
+}: {
+  provider: string;
+  identity?: ProviderCredentialIdentity;
+  status: ProviderCredentialStatus;
+  effectiveFrom: string;
+  effectiveTo?: string;
+  createdAt: string;
+  officialBillingAccountId?: string | null;
+  note?: string | null;
+}): ProviderCredentialRegistryRecord {
+  if (!identity) {
+    throw new Error("provider credential identity is required");
+  }
+  assertIsoTimestamp("effectiveFrom", effectiveFrom);
+  assertIsoTimestamp("createdAt", createdAt);
+  if (effectiveTo) assertIsoTimestamp("effectiveTo", effectiveTo);
+  const normalizedProvider = provider.trim().toLowerCase() || "unknown";
+  return {
+    schemaVersion: 1,
+    recordType: "provider_credential",
+    credentialId: identity.credentialId,
+    provider: normalizedProvider,
+    providerAccountKey: identity.providerAccountKey,
+    credentialFingerprint: identity.credentialFingerprint,
+    apiKeySource: identity.apiKeySource,
+    status,
+    effectiveFrom,
+    ...(effectiveTo ? { effectiveTo } : {}),
+    createdAt,
+    ...(identity.providerAccountAlias
+      ? { providerAccountAlias: identity.providerAccountAlias }
+      : {}),
+    ...(identity.environment ? { environment: identity.environment } : {}),
+    ...(officialBillingAccountId?.trim()
+      ? { officialBillingAccountId: officialBillingAccountId.trim() }
+      : {}),
+    ...(note?.trim() ? { note: note.trim() } : {}),
+  };
+}

package/ai/token/providerCredentialRegistryCommand.ts

@@ -0,0 +1,97 @@
+import {
+  createProviderCredentialIdentity,
+  type ProviderApiKeySource,
+} from "./providerCredential";
+import {
+  buildProviderCredentialRegistryKey,
+  createProviderCredentialRegistryRecord,
+  type ProviderCredentialRegistryRecord,
+  type ProviderCredentialStatus,
+} from "./providerCredentialRegistry";
+import type { RuntimeCredentialEnv } from "./providerCredentialRuntime";
+
+export type ProviderCredentialRegistryPublicSummary = {
+  credentialId: string;
+  provider: string;
+  providerAccountKey: string;
+  providerAccountAlias?: string;
+  apiKeySource: ProviderApiKeySource;
+  environment?: string;
+  officialBillingAccountId?: string;
+  status: ProviderCredentialStatus;
+  effectiveFrom: string;
+  effectiveTo?: string;
+};
+
+const credentialEnvironment = (env: RuntimeCredentialEnv) =>
+  env.NOLO_DEPLOY_ENV?.trim() ||
+  env.NOLO_ENV?.trim() ||
+  env.NODE_ENV?.trim() ||
+  undefined;
+
+export function buildProviderCredentialRegistryRegistration({
+  provider,
+  apiKey,
+  apiKeySource,
+  env = process.env,
+  providerAccountAlias,
+  officialBillingAccountId,
+  effectiveFrom,
+  effectiveTo,
+  createdAt,
+  status = "active",
+  note,
+}: {
+  provider: string;
+  apiKey?: string | null;
+  apiKeySource: ProviderApiKeySource;
+  env?: RuntimeCredentialEnv;
+  providerAccountAlias?: string | null;
+  officialBillingAccountId?: string | null;
+  effectiveFrom: string;
+  effectiveTo?: string;
+  createdAt: string;
+  status?: ProviderCredentialStatus;
+  note?: string | null;
+}): {
+  key: string;
+  record: ProviderCredentialRegistryRecord;
+  publicSummary: ProviderCredentialRegistryPublicSummary;
+} {
+  if (!apiKey?.trim()) {
+    throw new Error("api key is required");
+  }
+  const identity = createProviderCredentialIdentity({
+    provider,
+    apiKey,
+    apiKeySource,
+    providerAccountAlias,
+    environment: credentialEnvironment(env),
+  });
+  const record = createProviderCredentialRegistryRecord({
+    provider,
+    identity,
+    status,
+    effectiveFrom,
+    effectiveTo,
+    createdAt,
+    officialBillingAccountId,
+    note,
+  });
+  return {
+    key: buildProviderCredentialRegistryKey(record.credentialId),
+    record,
+    publicSummary: {
+      credentialId: record.credentialId,
+      provider: record.provider,
+      providerAccountKey: record.providerAccountKey,
+      providerAccountAlias: record.providerAccountAlias,
+      apiKeySource: record.apiKeySource,
+      environment: record.environment,
+      officialBillingAccountId: record.officialBillingAccountId,
+      status: record.status,
+      effectiveFrom: record.effectiveFrom,
+      effectiveTo: record.effectiveTo,
+    },
+  };
+}

package/ai/token/providerCredentialRegistryList.ts

@@ -0,0 +1,124 @@
+import type { ProviderCredentialRegistryPublicSummary } from "./providerCredentialRegistryCommand";
+import type { ProviderCredentialLifecycleEvent } from "./providerCredentialLifecycle";
+import type {
+  ProviderCredentialRegistryRecord,
+  ProviderCredentialStatus,
+} from "./providerCredentialRegistry";
+
+export type ProviderCredentialRegistryListStore = {
+  iterator(options?: { gte?: string; lte?: string }): AsyncIterable<[string, unknown]>;
+};
+
+const REGISTRY_PREFIX = "provider-credential-";
+const LIFECYCLE_PREFIX = "provider-credential-lifecycle-";
+
+function isRegistryRecord(value: unknown): value is ProviderCredentialRegistryRecord {
+  if (!value || typeof value !== "object") return false;
+  const record = value as Partial<ProviderCredentialRegistryRecord>;
+  return (
+    record.schemaVersion === 1 &&
+    record.recordType === "provider_credential" &&
+    typeof record.credentialId === "string" &&
+    typeof record.provider === "string" &&
+    typeof record.providerAccountKey === "string" &&
+    typeof record.credentialFingerprint === "string" &&
+    typeof record.apiKeySource === "string" &&
+    typeof record.status === "string" &&
+    typeof record.effectiveFrom === "string"
+  );
+}
+
+function isLifecycleEvent(value: unknown): value is ProviderCredentialLifecycleEvent {
+  if (!value || typeof value !== "object") return false;
+  const event = value as Partial<ProviderCredentialLifecycleEvent>;
+  return (
+    event.schemaVersion === 1 &&
+    event.recordType === "provider_credential_lifecycle_event" &&
+    typeof event.credentialId === "string" &&
+    typeof event.eventId === "string" &&
+    typeof event.status === "string" &&
+    typeof event.effectiveAt === "string" &&
+    typeof event.createdAt === "string"
+  );
+}
+
+function toPublicSummary(
+  record: ProviderCredentialRegistryRecord
+): ProviderCredentialRegistryPublicSummary {
+  return {
+    credentialId: record.credentialId,
+    provider: record.provider,
+    providerAccountKey: record.providerAccountKey,
+    providerAccountAlias: record.providerAccountAlias,
+    apiKeySource: record.apiKeySource,
+    environment: record.environment,
+    officialBillingAccountId: record.officialBillingAccountId,
+    status: record.status,
+    effectiveFrom: record.effectiveFrom,
+    effectiveTo: record.effectiveTo,
+  };
+}
+
+export async function listProviderCredentialRegistryRecords({
+  store,
+  provider,
+  status,
+  at = new Date().toISOString(),
+}: {
+  store: ProviderCredentialRegistryListStore;
+  provider?: string;
+  status?: ProviderCredentialStatus;
+  at?: string;
+}): Promise<{
+  count: number;
+  credentials: ProviderCredentialRegistryPublicSummary[];
+}> {
+  const normalizedProvider = provider?.trim().toLowerCase();
+  const lifecycleByCredential = new Map<string, ProviderCredentialLifecycleEvent>();
+  const atMs = Date.parse(at);
+  for await (const [, value] of store.iterator({
+    gte: LIFECYCLE_PREFIX,
+    lte: `${LIFECYCLE_PREFIX}\uffff`,
+  })) {
+    if (!isLifecycleEvent(value)) continue;
+    const effectiveMs = Date.parse(value.effectiveAt);
+    if (!Number.isFinite(effectiveMs) || effectiveMs > atMs) continue;
+    const existing = lifecycleByCredential.get(value.credentialId);
+    if (
+      !existing ||
+      Date.parse(existing.effectiveAt) < effectiveMs ||
+      (existing.effectiveAt === value.effectiveAt &&
+        existing.createdAt < value.createdAt)
+    ) {
+      lifecycleByCredential.set(value.credentialId, value);
+    }
+  }
+  const credentials: ProviderCredentialRegistryPublicSummary[] = [];
+  for await (const [, value] of store.iterator({
+    gte: REGISTRY_PREFIX,
+    lte: `${REGISTRY_PREFIX}\uffff`,
+  })) {
+    if (!isRegistryRecord(value)) continue;
+    if (normalizedProvider && value.provider !== normalizedProvider) continue;
+    const summary = toPublicSummary(value);
+    const lifecycle = lifecycleByCredential.get(value.credentialId);
+    if (lifecycle) {
+      summary.status = lifecycle.status;
+      if (lifecycle.status === "revoked") {
+        summary.effectiveTo = lifecycle.effectiveAt;
+      }
+    }
+    if (status && summary.status !== status) continue;
+    credentials.push(summary);
+  }
+  credentials.sort(
+    (a, b) =>
+      a.provider.localeCompare(b.provider) ||
+      a.providerAccountKey.localeCompare(b.providerAccountKey) ||
+      a.credentialId.localeCompare(b.credentialId)
+  );
+  return {
+    count: credentials.length,
+    credentials,
+  };
+}