nolo-cli 0.1.30 → 0.1.31

package/ai/token/providerCredentialRegistryResolver.ts

@@ -0,0 +1,150 @@
+import type { ProviderCredentialIdentity } from "./providerCredential";
+import type { ProviderCredentialLifecycleEvent } from "./providerCredentialLifecycle";
+import {
+  buildProviderCredentialRegistryKey,
+  type ProviderCredentialRegistryRecord,
+} from "./providerCredentialRegistry";
+
+export type ProviderCredentialRegistryReadStore = {
+  get(key: string): Promise<unknown>;
+  iterator?(options?: { gte?: string; lte?: string }): AsyncIterable<[string, unknown]>;
+};
+
+const LIFECYCLE_PREFIX = "provider-credential-lifecycle-";
+
+const isMissingRecordError = (error: unknown) => {
+  if (!error || typeof error !== "object") return false;
+  const code = (error as { code?: unknown }).code;
+  const message = (error as { message?: unknown }).message;
+  return (
+    code === "LEVEL_NOT_FOUND" ||
+    code === "NOT_FOUND" ||
+    message === "NotFound"
+  );
+};
+
+function isRegistryRecord(value: unknown): value is ProviderCredentialRegistryRecord {
+  if (!value || typeof value !== "object") return false;
+  const record = value as Partial<ProviderCredentialRegistryRecord>;
+  return (
+    record.schemaVersion === 1 &&
+    record.recordType === "provider_credential" &&
+    typeof record.credentialId === "string" &&
+    typeof record.provider === "string" &&
+    typeof record.providerAccountKey === "string" &&
+    typeof record.credentialFingerprint === "string" &&
+    typeof record.apiKeySource === "string" &&
+    typeof record.status === "string"
+  );
+}
+
+function isLifecycleEvent(value: unknown): value is ProviderCredentialLifecycleEvent {
+  if (!value || typeof value !== "object") return false;
+  const event = value as Partial<ProviderCredentialLifecycleEvent>;
+  return (
+    event.schemaVersion === 1 &&
+    event.recordType === "provider_credential_lifecycle_event" &&
+    typeof event.credentialId === "string" &&
+    typeof event.eventId === "string" &&
+    typeof event.status === "string" &&
+    typeof event.effectiveAt === "string" &&
+    typeof event.createdAt === "string"
+  );
+}
+
+function isEffective(record: ProviderCredentialRegistryRecord, at: string) {
+  const atMs = Date.parse(at);
+  const fromMs = Date.parse(record.effectiveFrom);
+  const toMs = record.effectiveTo ? Date.parse(record.effectiveTo) : undefined;
+  if (!Number.isFinite(atMs) || !Number.isFinite(fromMs)) return false;
+  if (atMs < fromMs) return false;
+  return typeof toMs !== "number" || !Number.isFinite(toMs) || atMs < toMs;
+}
+
+async function findLatestEffectiveLifecycleEvent({
+  store,
+  credentialId,
+  at,
+}: {
+  store: ProviderCredentialRegistryReadStore;
+  credentialId: string;
+  at: string;
+}) {
+  if (!store.iterator) return undefined;
+  const atMs = Date.parse(at);
+  if (!Number.isFinite(atMs)) return undefined;
+  const prefix = `${LIFECYCLE_PREFIX}${credentialId}-event-`;
+  let latest: ProviderCredentialLifecycleEvent | undefined;
+  for await (const [, value] of store.iterator({
+    gte: prefix,
+    lte: `${prefix}\uffff`,
+  })) {
+    if (!isLifecycleEvent(value)) continue;
+    if (value.credentialId !== credentialId) continue;
+    const effectiveMs = Date.parse(value.effectiveAt);
+    if (!Number.isFinite(effectiveMs) || effectiveMs > atMs) continue;
+    if (!latest) {
+      latest = value;
+      continue;
+    }
+    const latestMs = Date.parse(latest.effectiveAt);
+    if (
+      latestMs < effectiveMs ||
+      (latest.effectiveAt === value.effectiveAt && latest.createdAt < value.createdAt)
+    ) {
+      latest = value;
+    }
+  }
+  return latest;
+}
+
+export async function resolveProviderCredentialIdentity({
+  store,
+  provider,
+  identity,
+  at = new Date().toISOString(),
+}: {
+  store?: ProviderCredentialRegistryReadStore;
+  provider: string;
+  identity?: ProviderCredentialIdentity;
+  at?: string;
+}): Promise<ProviderCredentialIdentity | undefined> {
+  if (!identity || !store) return identity;
+  let value: unknown;
+  try {
+    value = await store.get(buildProviderCredentialRegistryKey(identity.credentialId));
+  } catch (error) {
+    if (isMissingRecordError(error)) return identity;
+    throw error;
+  }
+  if (!isRegistryRecord(value)) return identity;
+  const record = value;
+  if (record.provider !== provider.trim().toLowerCase()) return identity;
+  if (record.credentialFingerprint !== identity.credentialFingerprint) return identity;
+  if (record.status === "revoked") return identity;
+  if (!isEffective(record, at)) return identity;
+  const lifecycle = await findLatestEffectiveLifecycleEvent({
+    store,
+    credentialId: record.credentialId,
+    at,
+  });
+  const registryStatus = lifecycle?.status ?? record.status;
+  return {
+    ...identity,
+    providerAccountKey: record.providerAccountKey,
+    ...(record.providerAccountAlias
+      ? { providerAccountAlias: record.providerAccountAlias }
+      : {}),
+    ...(record.environment ? { environment: record.environment } : {}),
+    ...(record.officialBillingAccountId
+      ? { officialBillingAccountId: record.officialBillingAccountId }
+      : {}),
+    registryStatus,
+    registryEffectiveFrom: record.effectiveFrom,
+    ...(registryStatus === "revoked" && lifecycle
+      ? { registryEffectiveTo: lifecycle.effectiveAt }
+      : record.effectiveTo
+        ? { registryEffectiveTo: record.effectiveTo }
+        : {}),
+  };
+}

package/ai/token/providerCredentialRegistryWriter.ts

@@ -0,0 +1,41 @@
+import {
+  buildProviderCredentialRegistryKey,
+  type ProviderCredentialRegistryRecord,
+} from "./providerCredentialRegistry";
+
+export type ProviderCredentialRegistryStore = {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+};
+
+const isMissingRecordError = (error: unknown) => {
+  if (!error || typeof error !== "object") return false;
+  const code = (error as { code?: unknown }).code;
+  const message = (error as { message?: unknown }).message;
+  return (
+    code === "LEVEL_NOT_FOUND" ||
+    code === "NOT_FOUND" ||
+    message === "NotFound"
+  );
+};
+
+export async function writeProviderCredentialRegistryRecord({
+  store,
+  record,
+}: {
+  store: ProviderCredentialRegistryStore;
+  record: ProviderCredentialRegistryRecord;
+}): Promise<{ key: string }> {
+  const key = buildProviderCredentialRegistryKey(record.credentialId);
+  let existing: unknown;
+  try {
+    existing = await store.get(key);
+  } catch (error) {
+    if (!isMissingRecordError(error)) throw error;
+  }
+  if (existing) {
+    throw new Error(`provider credential registry record already exists: ${key}`);
+  }
+  await store.put(key, record);
+  return { key };
+}

package/ai/token/providerCredentialRotationCommand.ts

@@ -0,0 +1,102 @@
+import {
+  createProviderCredentialLifecycleEvent,
+  type ProviderCredentialLifecycleEvent,
+} from "./providerCredentialLifecycle";
+import {
+  buildProviderCredentialRegistryRegistration,
+  type ProviderCredentialRegistryPublicSummary,
+} from "./providerCredentialRegistryCommand";
+import type {
+  ProviderCredentialRegistryRecord,
+  ProviderCredentialStatus,
+} from "./providerCredentialRegistry";
+import type { ProviderApiKeySource } from "./providerCredential";
+import type { RuntimeCredentialEnv } from "./providerCredentialRuntime";
+
+export type ProviderCredentialRotationPublicSummary = {
+  oldCredential: {
+    credentialId: string;
+    provider: string;
+    providerAccountKey: string;
+    providerAccountAlias?: string;
+    status: ProviderCredentialStatus;
+    effectiveAt: string;
+  };
+  newCredential: ProviderCredentialRegistryPublicSummary;
+};
+
+export function buildProviderCredentialRotationPlan({
+  oldRecord,
+  newApiKey,
+  newApiKeySource,
+  env = process.env,
+  oldStatus,
+  effectiveAt,
+  createdAt,
+  eventId,
+  actorId,
+  reason,
+  providerAccountAlias,
+  officialBillingAccountId,
+  note,
+}: {
+  oldRecord: ProviderCredentialRegistryRecord;
+  newApiKey?: string | null;
+  newApiKeySource: ProviderApiKeySource;
+  env?: RuntimeCredentialEnv;
+  oldStatus: Extract<ProviderCredentialStatus, "rotating" | "revoked">;
+  effectiveAt: string;
+  createdAt: string;
+  eventId: string;
+  actorId?: string | null;
+  reason?: string | null;
+  providerAccountAlias?: string | null;
+  officialBillingAccountId?: string | null;
+  note?: string | null;
+}): {
+  oldLifecycleEvent: ProviderCredentialLifecycleEvent;
+  newRegistration: ReturnType<typeof buildProviderCredentialRegistryRegistration>;
+  publicSummary: ProviderCredentialRotationPublicSummary;
+} {
+  const oldLifecycleEvent = createProviderCredentialLifecycleEvent({
+    credentialId: oldRecord.credentialId,
+    eventId,
+    status: oldStatus,
+    effectiveAt,
+    createdAt,
+    reason,
+    actorId,
+  });
+  const newRegistration = buildProviderCredentialRegistryRegistration({
+    provider: oldRecord.provider,
+    apiKey: newApiKey,
+    apiKeySource: newApiKeySource,
+    env,
+    providerAccountAlias:
+      providerAccountAlias ?? oldRecord.providerAccountAlias ?? undefined,
+    officialBillingAccountId:
+      officialBillingAccountId ?? oldRecord.officialBillingAccountId ?? undefined,
+    effectiveFrom: effectiveAt,
+    createdAt,
+    status: "active",
+    note,
+  });
+  if (newRegistration.record.credentialId === oldRecord.credentialId) {
+    throw new Error("new credential must differ from old credential");
+  }
+  return {
+    oldLifecycleEvent,
+    newRegistration,
+    publicSummary: {
+      oldCredential: {
+        credentialId: oldRecord.credentialId,
+        provider: oldRecord.provider,
+        providerAccountKey: oldRecord.providerAccountKey,
+        providerAccountAlias: oldRecord.providerAccountAlias,
+        status: oldLifecycleEvent.status,
+        effectiveAt: oldLifecycleEvent.effectiveAt,
+      },
+      newCredential: newRegistration.publicSummary,
+    },
+  };
+}

package/ai/token/providerCredentialRuntime.ts

@@ -0,0 +1,56 @@
+import {
+  createProviderCredentialIdentity,
+  type ProviderApiKeySource,
+  type ProviderCredentialIdentity,
+} from "./providerCredential";
+import {
+  resolveProviderCredentialIdentity,
+  type ProviderCredentialRegistryReadStore,
+} from "./providerCredentialRegistryResolver";
+
+export type RuntimeCredentialEnv = Record<string, string | undefined>;
+
+const providerAccountAlias = (provider: string, env: RuntimeCredentialEnv) => {
+  const normalized = provider.trim().toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+  return (
+    env[`NOLO_${normalized}_ACCOUNT_ALIAS`]?.trim() ||
+    env[`${normalized}_ACCOUNT_ALIAS`]?.trim() ||
+    undefined
+  );
+};
+
+const credentialEnvironment = (env: RuntimeCredentialEnv) =>
+  env.NOLO_DEPLOY_ENV?.trim() ||
+  env.NOLO_ENV?.trim() ||
+  env.NODE_ENV?.trim() ||
+  undefined;
+
+export async function resolveRuntimeProviderCredential({
+  provider,
+  apiKey,
+  apiKeySource,
+  env = process.env,
+  registryStore,
+  at,
+}: {
+  provider: string;
+  apiKey?: string | null;
+  apiKeySource: ProviderApiKeySource;
+  env?: RuntimeCredentialEnv;
+  registryStore?: ProviderCredentialRegistryReadStore;
+  at?: string;
+}): Promise<ProviderCredentialIdentity | undefined> {
+  const identity = createProviderCredentialIdentity({
+    provider,
+    apiKey,
+    apiKeySource,
+    providerAccountAlias: providerAccountAlias(provider, env),
+    environment: credentialEnvironment(env),
+  });
+  return resolveProviderCredentialIdentity({
+    store: registryStore,
+    provider,
+    identity,
+    at,
+  });
+}

package/ai/token/providerDispatchIntent.ts

@@ -0,0 +1,67 @@
+import type { ProviderCredentialIdentity } from "./providerCredential";
+
+export type ProviderDispatchIntentStatus = "dispatching";
+
+export type ProviderDispatchIntent = {
+  providerCallId: string;
+  intentId: string;
+  userId: string;
+  dialogId?: string;
+  agentId?: string;
+  provider: string;
+  model: string;
+  endpoint?: string;
+  serviceTier?: string;
+  credential?: ProviderCredentialIdentity;
+  request: {
+    url: string;
+    method: string;
+    bodyHash?: string;
+  };
+  status: ProviderDispatchIntentStatus;
+  createdAt: string;
+};
+
+export type CreateProviderDispatchIntentInput = {
+  providerCallId: string;
+  intentId: string;
+  userId: string;
+  dialogId?: string;
+  agentId?: string;
+  provider: string;
+  model: string;
+  endpoint?: string;
+  serviceTier?: string;
+  credential?: ProviderCredentialIdentity;
+  url: string;
+  method: string;
+  bodyHash?: string;
+  createdAt: string;
+};
+
+export const buildProviderDispatchIntentKey = (
+  providerCallId: string,
+  intentId: string
+) => `provider-dispatch-intent-${providerCallId}-${intentId}`;
+
+export const createProviderDispatchIntent = (
+  input: CreateProviderDispatchIntentInput
+): ProviderDispatchIntent => ({
+  providerCallId: input.providerCallId,
+  intentId: input.intentId,
+  userId: input.userId,
+  dialogId: input.dialogId,
+  agentId: input.agentId,
+  provider: input.provider,
+  model: input.model,
+  endpoint: input.endpoint,
+  serviceTier: input.serviceTier,
+  credential: input.credential,
+  request: {
+    url: input.url,
+    method: input.method,
+    bodyHash: input.bodyHash,
+  },
+  status: "dispatching",
+  createdAt: input.createdAt,
+});

package/ai/token/providerDispatchIntentWriter.ts

@@ -0,0 +1,36 @@
+import {
+  buildProviderDispatchIntentKey,
+  type ProviderDispatchIntent,
+} from "./providerDispatchIntent";
+
+export type ProviderDispatchIntentStore = {
+  get(key: string): Promise<unknown>;
+  put(key: string, value: unknown): Promise<void>;
+};
+
+const isMissingRecordError = (error: unknown) => {
+  if (!error || typeof error !== "object") return false;
+  const code = (error as { code?: unknown }).code;
+  return code === "LEVEL_NOT_FOUND" || code === "NOT_FOUND";
+};
+
+export async function writeProviderDispatchIntent({
+  store,
+  intent,
+}: {
+  store: ProviderDispatchIntentStore;
+  intent: ProviderDispatchIntent;
+}): Promise<{ key: string }> {
+  const key = buildProviderDispatchIntentKey(intent.providerCallId, intent.intentId);
+  let existing: unknown;
+  try {
+    existing = await store.get(key);
+  } catch (error) {
+    if (!isMissingRecordError(error)) throw error;
+  }
+  if (existing) {
+    throw new Error(`provider dispatch intent already exists: ${key}`);
+  }
+  await store.put(key, intent);
+  return { key };
+}