offrouter-core 0.2.0 → 0.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (139) hide show
  1. package/dist/audit.d.ts +137 -0
  2. package/dist/audit.d.ts.map +1 -0
  3. package/dist/audit.js +320 -0
  4. package/dist/audit.js.map +1 -0
  5. package/dist/auth/credential-chain.d.ts +84 -0
  6. package/dist/auth/credential-chain.d.ts.map +1 -0
  7. package/dist/auth/credential-chain.js +150 -0
  8. package/dist/auth/credential-chain.js.map +1 -0
  9. package/dist/auth/index.d.ts +10 -0
  10. package/dist/auth/index.d.ts.map +1 -0
  11. package/dist/auth/index.js +7 -0
  12. package/dist/auth/index.js.map +1 -0
  13. package/dist/auth/keychain.d.ts +60 -0
  14. package/dist/auth/keychain.d.ts.map +1 -0
  15. package/dist/auth/keychain.js +104 -0
  16. package/dist/auth/keychain.js.map +1 -0
  17. package/dist/auth/oauth-pkce.d.ts +138 -0
  18. package/dist/auth/oauth-pkce.d.ts.map +1 -0
  19. package/dist/auth/oauth-pkce.js +375 -0
  20. package/dist/auth/oauth-pkce.js.map +1 -0
  21. package/dist/auth/oauth-server.d.ts +36 -0
  22. package/dist/auth/oauth-server.d.ts.map +1 -0
  23. package/dist/auth/oauth-server.js +210 -0
  24. package/dist/auth/oauth-server.js.map +1 -0
  25. package/dist/config.d.ts +76 -0
  26. package/dist/config.d.ts.map +1 -0
  27. package/dist/config.js +355 -0
  28. package/dist/config.js.map +1 -0
  29. package/dist/delegation.d.ts +123 -0
  30. package/dist/delegation.d.ts.map +1 -0
  31. package/dist/delegation.js +455 -0
  32. package/dist/delegation.js.map +1 -0
  33. package/dist/index.d.ts +41 -0
  34. package/dist/index.d.ts.map +1 -0
  35. package/dist/index.js +26 -0
  36. package/dist/index.js.map +1 -0
  37. package/dist/policy.d.ts +45 -0
  38. package/dist/policy.d.ts.map +1 -0
  39. package/dist/policy.js +318 -0
  40. package/dist/policy.js.map +1 -0
  41. package/{src/protocol.ts → dist/protocol.d.ts} +2 -2
  42. package/dist/protocol.d.ts.map +1 -0
  43. package/dist/protocol.js +6 -0
  44. package/dist/protocol.js.map +1 -0
  45. package/dist/providers/adapter.d.ts +137 -0
  46. package/dist/providers/adapter.d.ts.map +1 -0
  47. package/dist/providers/adapter.js +163 -0
  48. package/dist/providers/adapter.js.map +1 -0
  49. package/dist/providers/catalog-data.d.ts +128 -0
  50. package/dist/providers/catalog-data.d.ts.map +1 -0
  51. package/dist/providers/catalog-data.js +397 -0
  52. package/dist/providers/catalog-data.js.map +1 -0
  53. package/dist/providers/catalog.d.ts +63 -0
  54. package/dist/providers/catalog.d.ts.map +1 -0
  55. package/dist/providers/catalog.js +394 -0
  56. package/dist/providers/catalog.js.map +1 -0
  57. package/dist/providers/fake.d.ts +46 -0
  58. package/dist/providers/fake.d.ts.map +1 -0
  59. package/dist/providers/fake.js +234 -0
  60. package/dist/providers/fake.js.map +1 -0
  61. package/dist/providers/openai-compatible.d.ts +65 -0
  62. package/dist/providers/openai-compatible.d.ts.map +1 -0
  63. package/dist/providers/openai-compatible.js +434 -0
  64. package/dist/providers/openai-compatible.js.map +1 -0
  65. package/dist/proxy/responses-mapper.d.ts +366 -0
  66. package/dist/proxy/responses-mapper.d.ts.map +1 -0
  67. package/dist/proxy/responses-mapper.js +517 -0
  68. package/dist/proxy/responses-mapper.js.map +1 -0
  69. package/dist/proxy/responses-server.d.ts +29 -0
  70. package/dist/proxy/responses-server.d.ts.map +1 -0
  71. package/dist/proxy/responses-server.js +360 -0
  72. package/dist/proxy/responses-server.js.map +1 -0
  73. package/dist/router.d.ts +18 -0
  74. package/dist/router.d.ts.map +1 -0
  75. package/dist/router.js +296 -0
  76. package/dist/router.js.map +1 -0
  77. package/dist/schemas.d.ts +560 -0
  78. package/dist/schemas.d.ts.map +1 -0
  79. package/{src/schemas.ts → dist/schemas.js} +83 -103
  80. package/dist/schemas.js.map +1 -0
  81. package/dist/secrets.d.ts +112 -0
  82. package/dist/secrets.d.ts.map +1 -0
  83. package/dist/secrets.js +326 -0
  84. package/dist/secrets.js.map +1 -0
  85. package/dist/types.d.ts +117 -0
  86. package/dist/types.d.ts.map +1 -0
  87. package/dist/types.js +6 -0
  88. package/dist/types.js.map +1 -0
  89. package/dist/usage-file.d.ts +59 -0
  90. package/dist/usage-file.d.ts.map +1 -0
  91. package/dist/usage-file.js +316 -0
  92. package/dist/usage-file.js.map +1 -0
  93. package/dist/usage.d.ts +235 -0
  94. package/dist/usage.d.ts.map +1 -0
  95. package/dist/usage.js +517 -0
  96. package/dist/usage.js.map +1 -0
  97. package/package.json +9 -4
  98. package/src/audit.test.ts +0 -302
  99. package/src/audit.ts +0 -553
  100. package/src/auth/credential-chain.test.ts +0 -326
  101. package/src/auth/credential-chain.ts +0 -235
  102. package/src/auth/index.ts +0 -45
  103. package/src/auth/keychain.test.ts +0 -265
  104. package/src/auth/keychain.ts +0 -168
  105. package/src/auth/oauth-pkce.test.ts +0 -329
  106. package/src/auth/oauth-pkce.ts +0 -571
  107. package/src/auth/oauth-server.test.ts +0 -83
  108. package/src/auth/oauth-server.ts +0 -296
  109. package/src/config.test.ts +0 -479
  110. package/src/config.ts +0 -505
  111. package/src/delegation.test.ts +0 -368
  112. package/src/delegation.ts +0 -605
  113. package/src/index.ts +0 -280
  114. package/src/policy.test.ts +0 -634
  115. package/src/policy.ts +0 -420
  116. package/src/providers/adapter.test.ts +0 -293
  117. package/src/providers/adapter.ts +0 -328
  118. package/src/providers/catalog-data.test.ts +0 -258
  119. package/src/providers/catalog-data.ts +0 -498
  120. package/src/providers/catalog.test.ts +0 -84
  121. package/src/providers/catalog.ts +0 -483
  122. package/src/providers/fake.ts +0 -312
  123. package/src/providers/openai-compatible.test.ts +0 -366
  124. package/src/providers/openai-compatible.ts +0 -554
  125. package/src/proxy/responses-mapper.test.ts +0 -290
  126. package/src/proxy/responses-mapper.ts +0 -736
  127. package/src/proxy/responses-server.test.ts +0 -322
  128. package/src/proxy/responses-server.ts +0 -469
  129. package/src/router.test.ts +0 -699
  130. package/src/router.ts +0 -352
  131. package/src/schemas.test.ts +0 -291
  132. package/src/secrets.test.ts +0 -271
  133. package/src/secrets.ts +0 -461
  134. package/src/types.ts +0 -173
  135. package/src/usage-file.test.ts +0 -243
  136. package/src/usage-file.ts +0 -435
  137. package/src/usage.test.ts +0 -335
  138. package/src/usage.ts +0 -859
  139. package/tsconfig.json +0 -9
@@ -4,94 +4,82 @@
4
4
  */
5
5
  import { z } from "zod";
6
6
  import { ROUTE_PROTOCOL_VERSION } from "./protocol.js";
7
-
8
7
  export const AuthTierSchema = z.enum(["subscription", "local", "api-key"]);
9
-
10
8
  export const AuthScopeSchema = z.enum([
11
- "first-party",
12
- "third-party",
13
- "unknown",
9
+ "first-party",
10
+ "third-party",
11
+ "unknown",
14
12
  ]);
15
-
16
13
  export const SubscriptionStatusSchema = z.enum([
17
- "active",
18
- "near-limit",
19
- "exhausted",
20
- "rate-limited",
21
- "expired",
22
- "unconfigured",
23
- "unknown",
14
+ "active",
15
+ "near-limit",
16
+ "exhausted",
17
+ "rate-limited",
18
+ "expired",
19
+ "unconfigured",
20
+ "unknown",
24
21
  ]);
25
-
26
22
  export const ProviderHealthSchema = z.enum(["healthy", "degraded", "dead"]);
27
-
28
23
  export const FallbackReasonSchema = z.enum([
29
- "primary",
30
- "subscription_exhausted",
31
- "subscription_degraded",
32
- "subscription_unconfigured",
33
- "subscription_scope_denied",
34
- "local_preferred",
35
- "api_key_fallback",
36
- "policy_denied",
37
- "provider_error",
24
+ "primary",
25
+ "subscription_exhausted",
26
+ "subscription_degraded",
27
+ "subscription_unconfigured",
28
+ "subscription_scope_denied",
29
+ "local_preferred",
30
+ "api_key_fallback",
31
+ "policy_denied",
32
+ "provider_error",
38
33
  ]);
39
-
40
34
  export const HarnessKindSchema = z.enum([
41
- "claude",
42
- "codex",
43
- "gemini",
44
- "grok",
45
- "cursor",
46
- "pi",
47
- "other",
35
+ "claude",
36
+ "codex",
37
+ "gemini",
38
+ "grok",
39
+ "cursor",
40
+ "pi",
41
+ "other",
48
42
  ]);
49
-
50
43
  export const TaskKindSchema = z.enum([
51
- "explain",
52
- "code",
53
- "review",
54
- "plan",
55
- "research",
56
- "image",
57
- "tools",
58
- "other",
44
+ "explain",
45
+ "code",
46
+ "review",
47
+ "plan",
48
+ "research",
49
+ "image",
50
+ "tools",
51
+ "other",
59
52
  ]);
60
-
61
53
  export const RiskLevelSchema = z.enum(["low", "medium", "high"]);
62
-
63
54
  export const PolicyDenialCodeSchema = z.enum([
64
- "profile_not_allowlisted",
65
- "work_profile_denied",
66
- "provider_denied",
67
- "project_untrusted",
68
- "privacy_label_denied",
69
- "local_only_required",
70
- "cost_cap_exceeded",
71
- "api_key_blocked_by_subscription_first_policy",
72
- "subscription_scope_denied",
73
- "capability_missing",
55
+ "profile_not_allowlisted",
56
+ "work_profile_denied",
57
+ "provider_denied",
58
+ "project_untrusted",
59
+ "privacy_label_denied",
60
+ "local_only_required",
61
+ "cost_cap_exceeded",
62
+ "api_key_blocked_by_subscription_first_policy",
63
+ "subscription_scope_denied",
64
+ "capability_missing",
74
65
  ]);
75
-
76
66
  export const PolicyDenialTargetSchema = z.enum([
77
- "profile",
78
- "provider",
79
- "model",
80
- "workspace",
81
- "candidate",
67
+ "profile",
68
+ "provider",
69
+ "model",
70
+ "workspace",
71
+ "candidate",
82
72
  ]);
83
-
84
73
  export const PolicyDenialSchema = z
85
- .object({
74
+ .object({
86
75
  code: PolicyDenialCodeSchema,
87
76
  target: PolicyDenialTargetSchema,
88
77
  id: z.string().min(1),
89
78
  message: z.string().min(1),
90
- })
91
- .strict();
92
-
79
+ })
80
+ .strict();
93
81
  export const ProviderCandidateSchema = z
94
- .object({
82
+ .object({
95
83
  providerId: z.string().min(1),
96
84
  modelId: z.string().min(1),
97
85
  displayName: z.string().optional(),
@@ -108,22 +96,20 @@ export const ProviderCandidateSchema = z
108
96
  contextWindowTokens: z.number().nonnegative().optional(),
109
97
  maxOutputTokens: z.number().nonnegative().optional(),
110
98
  estimatedCostUsd: z.number().nonnegative().optional(),
111
- })
112
- .strict();
113
-
99
+ })
100
+ .strict();
114
101
  export const HarnessRefSchema = z
115
- .object({
102
+ .object({
116
103
  kind: HarnessKindSchema,
117
104
  profile: z.string().min(1),
118
- })
119
- .strict();
120
-
105
+ })
106
+ .strict();
121
107
  /**
122
108
  * Task payload for routing: preview + digest only.
123
109
  * Full prompts are rejected here by schema absence of `prompt`.
124
110
  */
125
111
  export const RouteTaskSchema = z
126
- .object({
112
+ .object({
127
113
  promptPreview: z.string().min(1),
128
114
  promptDigest: z.string().min(1),
129
115
  kind: TaskKindSchema,
@@ -132,58 +118,52 @@ export const RouteTaskSchema = z
132
118
  requiresImages: z.boolean().optional(),
133
119
  requiresStreaming: z.boolean().optional(),
134
120
  requiresJson: z.boolean().optional(),
135
- })
136
- .strict();
137
-
121
+ })
122
+ .strict();
138
123
  export const WorkspaceRefSchema = z
139
- .object({
124
+ .object({
140
125
  cwd: z.string().min(1),
141
126
  trusted: z.boolean(),
142
127
  privacyLabel: z.string().optional(),
143
- })
144
- .strict();
145
-
128
+ })
129
+ .strict();
146
130
  export const RouteConstraintsSchema = z
147
- .object({
131
+ .object({
148
132
  maxCostUsd: z.number().nonnegative().optional(),
149
133
  localOnly: z.boolean().optional(),
150
134
  allowApiKeyFallback: z.boolean().optional(),
151
135
  subscriptionFirst: z.boolean().optional(),
152
- })
153
- .strict();
154
-
136
+ })
137
+ .strict();
155
138
  export const RouteRequestSchema = z
156
- .object({
139
+ .object({
157
140
  protocolVersion: z.literal(ROUTE_PROTOCOL_VERSION),
158
141
  requestId: z.string().min(1),
159
142
  harness: HarnessRefSchema,
160
143
  task: RouteTaskSchema,
161
144
  workspace: WorkspaceRefSchema,
162
145
  constraints: RouteConstraintsSchema,
163
- })
164
- .strict();
165
-
146
+ })
147
+ .strict();
166
148
  export const SelectedRouteSchema = z
167
- .object({
149
+ .object({
168
150
  provider: z.string().min(1),
169
151
  model: z.string().min(1),
170
152
  authTier: AuthTierSchema,
171
153
  authScope: AuthScopeSchema.optional(),
172
154
  accountId: z.string().min(1).optional(),
173
- })
174
- .strict();
175
-
155
+ })
156
+ .strict();
176
157
  export const FallbackChainEntrySchema = z
177
- .object({
158
+ .object({
178
159
  provider: z.string().min(1),
179
160
  model: z.string().min(1),
180
161
  authTier: AuthTierSchema,
181
162
  reason: FallbackReasonSchema,
182
- })
183
- .strict();
184
-
163
+ })
164
+ .strict();
185
165
  export const RouteDecisionSchema = z
186
- .object({
166
+ .object({
187
167
  protocolVersion: z.literal(ROUTE_PROTOCOL_VERSION),
188
168
  decisionId: z.string().min(1),
189
169
  requestId: z.string().min(1),
@@ -197,12 +177,12 @@ export const RouteDecisionSchema = z
197
177
  blocked: z.boolean().optional(),
198
178
  needsConfiguration: z.boolean().optional(),
199
179
  nearLimitWarning: z.string().optional(),
200
- })
201
- .strict();
202
-
180
+ })
181
+ .strict();
203
182
  export const PolicyDecisionSchema = z
204
- .object({
183
+ .object({
205
184
  allowed: z.array(ProviderCandidateSchema),
206
185
  denials: z.array(PolicyDenialSchema),
207
- })
208
- .strict();
186
+ })
187
+ .strict();
188
+ //# sourceMappingURL=schemas.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,aAAa;IACb,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,cAAc;IACd,SAAS;IACT,cAAc;IACd,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,SAAS;IACT,wBAAwB;IACxB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,SAAS;IACT,MAAM;IACN,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,8CAA8C;IAC9C,2BAA2B;IAC3B,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,SAAS;IACT,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE,wBAAwB;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,eAAe;IAC1B,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,MAAM,EAAE,oBAAoB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,eAAe;IACrB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,gBAAgB;IACzB,IAAI,EAAE,eAAe;IACrB,SAAS,EAAE,kBAAkB;IAC7B,WAAW,EAAE,sBAAsB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,oBAAoB;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAC3D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CACrC,CAAC;KACD,MAAM,EAAE,CAAC"}
@@ -0,0 +1,112 @@
1
+ import { mkdir, readFile, rename, unlink, writeFile, chmod } from "node:fs/promises";
2
+ /** Placeholder substituted for secret material in log-safe strings. */
3
+ /** Placeholder substituted for secret material in log-safe strings. */
4
+ export declare const REDACTED: "[REDACTED]";
5
+ /**
6
+ * Contract for provider secret storage.
7
+ * All mutations are async so file + OS-keychain backends share one API.
8
+ */
9
+ export interface SecretStore {
10
+ get(providerId: string): Promise<string | undefined>;
11
+ set(providerId: string, secret: string): Promise<void>;
12
+ delete(providerId: string): Promise<void>;
13
+ listProviders(): Promise<string[]>;
14
+ /**
15
+ * Replace secrets / API-key-like substrings for audit/log output.
16
+ * Must never throw; bad input returns a safe string.
17
+ */
18
+ redact(value: string): string;
19
+ /**
20
+ * JSON-safe diagnostic view. Must never include raw secret values.
21
+ * Also used by `JSON.stringify(store)`.
22
+ */
23
+ toJSON(): Record<string, unknown>;
24
+ }
25
+ export interface FileSecretStoreOptions {
26
+ /** Absolute path to secrets.json (typically `$OFFROUTER_HOME/secrets.json`). */
27
+ filePath: string;
28
+ /** Injectable file operations for failure-path tests. Defaults to node fs. */
29
+ fileSystem?: Partial<FileSecretStoreFileSystem>;
30
+ }
31
+ export interface KeychainSecretStoreOptions {
32
+ /**
33
+ * Keychain/keyring service name. OffRouter only reads entries it wrote
34
+ * under this service — never foreign CLI credential stores.
35
+ */
36
+ service?: string;
37
+ /**
38
+ * Optional account/name prefix for stored items.
39
+ * Full item name is `${accountPrefix}${providerId}`.
40
+ */
41
+ accountPrefix?: string;
42
+ }
43
+ interface FileSecretStoreFileSystem {
44
+ mkdir: typeof mkdir;
45
+ readFile: typeof readFile;
46
+ rename: typeof rename;
47
+ unlink: typeof unlink;
48
+ writeFile: typeof writeFile;
49
+ chmod: typeof chmod;
50
+ }
51
+ /**
52
+ * Standalone redaction for log/audit paths that do not hold a store.
53
+ * Optionally rejects known secret values (longest-first to avoid partials).
54
+ */
55
+ export declare function redact(value: string, knownSecrets?: Iterable<string>): string;
56
+ /**
57
+ * File-backed secret store for tests and user-approved fallback.
58
+ * Writes `$filePath` with mode `0o600` on POSIX after every mutation.
59
+ */
60
+ export declare class FileSecretStore implements SecretStore {
61
+ #private;
62
+ readonly filePath: string;
63
+ constructor(options: FileSecretStoreOptions);
64
+ get(providerId: string): Promise<string | undefined>;
65
+ set(providerId: string, secret: string): Promise<void>;
66
+ delete(providerId: string): Promise<void>;
67
+ listProviders(): Promise<string[]>;
68
+ redact(value: string): string;
69
+ toJSON(): Record<string, unknown>;
70
+ }
71
+ /**
72
+ * Raised when the OS keychain/keyring backend is not available or not wired.
73
+ * Callers should fall back to FileSecretStore only with explicit user approval.
74
+ */
75
+ export declare class KeychainUnavailableError extends Error {
76
+ readonly code: "keychain_unavailable";
77
+ constructor(message: string, options?: {
78
+ cause?: unknown;
79
+ });
80
+ }
81
+ /**
82
+ * OS keychain boundary for real runs.
83
+ *
84
+ * V1 ships this as a typed stub: it never scrapes other CLIs and does not
85
+ * perform network I/O. Get/set/delete/list reject with KeychainUnavailableError
86
+ * until a platform backend is wired. Prefer this store at the seams of real
87
+ * runs once keychain support lands; tests and dry runs use FileSecretStore.
88
+ */
89
+ export declare class KeychainSecretStore implements SecretStore {
90
+ #private;
91
+ readonly service: string;
92
+ readonly accountPrefix: string;
93
+ constructor(options?: KeychainSecretStoreOptions);
94
+ get(providerId: string): Promise<string | undefined>;
95
+ set(providerId: string, secret: string): Promise<void>;
96
+ delete(providerId: string): Promise<void>;
97
+ listProviders(): Promise<string[]>;
98
+ redact(value: string): string;
99
+ toJSON(): Record<string, unknown>;
100
+ }
101
+ /**
102
+ * Retrieve a provider token from the secret store.
103
+ * Returns undefined if no token is stored or the store is unavailable.
104
+ */
105
+ export declare function getProviderToken(providerId: string, store: SecretStore): Promise<string | undefined>;
106
+ /**
107
+ * Store a provider token in the secret store.
108
+ * Throws if the store is unavailable (e.g., KeychainUnavailableError).
109
+ */
110
+ export declare function setProviderToken(providerId: string, token: string, store: SecretStore): Promise<void>;
111
+ export {};
112
+ //# sourceMappingURL=secrets.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACT,KAAK,EACN,MAAM,kBAAkB,CAAC;AAI1B,uEAAuE;AACvE,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAG,YAAqB,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAQD,UAAU,yBAAyB;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB;AAsCD;;;GAGG;AACH,wBAAgB,MAAM,CACpB,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAM,GAClC,MAAM,CAwBR;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,WAAW;;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAMd,OAAO,EAAE,sBAAsB;IAgBrC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAO7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuFlC;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAEpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQ9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAgBlC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf"}