offrouter-core 0.2.0 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit.d.ts +137 -0
- package/dist/audit.d.ts.map +1 -0
- package/dist/audit.js +320 -0
- package/dist/audit.js.map +1 -0
- package/dist/auth/credential-chain.d.ts +84 -0
- package/dist/auth/credential-chain.d.ts.map +1 -0
- package/dist/auth/credential-chain.js +150 -0
- package/dist/auth/credential-chain.js.map +1 -0
- package/dist/auth/index.d.ts +10 -0
- package/dist/auth/index.d.ts.map +1 -0
- package/dist/auth/index.js +7 -0
- package/dist/auth/index.js.map +1 -0
- package/dist/auth/keychain.d.ts +60 -0
- package/dist/auth/keychain.d.ts.map +1 -0
- package/dist/auth/keychain.js +104 -0
- package/dist/auth/keychain.js.map +1 -0
- package/dist/auth/oauth-pkce.d.ts +138 -0
- package/dist/auth/oauth-pkce.d.ts.map +1 -0
- package/dist/auth/oauth-pkce.js +375 -0
- package/dist/auth/oauth-pkce.js.map +1 -0
- package/dist/auth/oauth-server.d.ts +36 -0
- package/dist/auth/oauth-server.d.ts.map +1 -0
- package/dist/auth/oauth-server.js +210 -0
- package/dist/auth/oauth-server.js.map +1 -0
- package/dist/config.d.ts +76 -0
- package/dist/config.d.ts.map +1 -0
- package/dist/config.js +355 -0
- package/dist/config.js.map +1 -0
- package/dist/delegation.d.ts +123 -0
- package/dist/delegation.d.ts.map +1 -0
- package/dist/delegation.js +455 -0
- package/dist/delegation.js.map +1 -0
- package/dist/index.d.ts +41 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +26 -0
- package/dist/index.js.map +1 -0
- package/dist/policy.d.ts +45 -0
- package/dist/policy.d.ts.map +1 -0
- package/dist/policy.js +318 -0
- package/dist/policy.js.map +1 -0
- package/{src/protocol.ts → dist/protocol.d.ts} +2 -2
- package/dist/protocol.d.ts.map +1 -0
- package/dist/protocol.js +6 -0
- package/dist/protocol.js.map +1 -0
- package/dist/providers/adapter.d.ts +137 -0
- package/dist/providers/adapter.d.ts.map +1 -0
- package/dist/providers/adapter.js +163 -0
- package/dist/providers/adapter.js.map +1 -0
- package/dist/providers/catalog-data.d.ts +128 -0
- package/dist/providers/catalog-data.d.ts.map +1 -0
- package/dist/providers/catalog-data.js +397 -0
- package/dist/providers/catalog-data.js.map +1 -0
- package/dist/providers/catalog.d.ts +63 -0
- package/dist/providers/catalog.d.ts.map +1 -0
- package/dist/providers/catalog.js +394 -0
- package/dist/providers/catalog.js.map +1 -0
- package/dist/providers/fake.d.ts +46 -0
- package/dist/providers/fake.d.ts.map +1 -0
- package/dist/providers/fake.js +234 -0
- package/dist/providers/fake.js.map +1 -0
- package/dist/providers/openai-compatible.d.ts +65 -0
- package/dist/providers/openai-compatible.d.ts.map +1 -0
- package/dist/providers/openai-compatible.js +434 -0
- package/dist/providers/openai-compatible.js.map +1 -0
- package/dist/proxy/responses-mapper.d.ts +366 -0
- package/dist/proxy/responses-mapper.d.ts.map +1 -0
- package/dist/proxy/responses-mapper.js +517 -0
- package/dist/proxy/responses-mapper.js.map +1 -0
- package/dist/proxy/responses-server.d.ts +29 -0
- package/dist/proxy/responses-server.d.ts.map +1 -0
- package/dist/proxy/responses-server.js +360 -0
- package/dist/proxy/responses-server.js.map +1 -0
- package/dist/router.d.ts +18 -0
- package/dist/router.d.ts.map +1 -0
- package/dist/router.js +296 -0
- package/dist/router.js.map +1 -0
- package/dist/schemas.d.ts +560 -0
- package/dist/schemas.d.ts.map +1 -0
- package/{src/schemas.ts → dist/schemas.js} +83 -103
- package/dist/schemas.js.map +1 -0
- package/dist/secrets.d.ts +112 -0
- package/dist/secrets.d.ts.map +1 -0
- package/dist/secrets.js +326 -0
- package/dist/secrets.js.map +1 -0
- package/dist/types.d.ts +117 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +6 -0
- package/dist/types.js.map +1 -0
- package/dist/usage-file.d.ts +59 -0
- package/dist/usage-file.d.ts.map +1 -0
- package/dist/usage-file.js +316 -0
- package/dist/usage-file.js.map +1 -0
- package/dist/usage.d.ts +235 -0
- package/dist/usage.d.ts.map +1 -0
- package/dist/usage.js +517 -0
- package/dist/usage.js.map +1 -0
- package/package.json +9 -4
- package/src/audit.test.ts +0 -302
- package/src/audit.ts +0 -553
- package/src/auth/credential-chain.test.ts +0 -326
- package/src/auth/credential-chain.ts +0 -235
- package/src/auth/index.ts +0 -45
- package/src/auth/keychain.test.ts +0 -265
- package/src/auth/keychain.ts +0 -168
- package/src/auth/oauth-pkce.test.ts +0 -329
- package/src/auth/oauth-pkce.ts +0 -571
- package/src/auth/oauth-server.test.ts +0 -83
- package/src/auth/oauth-server.ts +0 -296
- package/src/config.test.ts +0 -479
- package/src/config.ts +0 -505
- package/src/delegation.test.ts +0 -368
- package/src/delegation.ts +0 -605
- package/src/index.ts +0 -280
- package/src/policy.test.ts +0 -634
- package/src/policy.ts +0 -420
- package/src/providers/adapter.test.ts +0 -293
- package/src/providers/adapter.ts +0 -328
- package/src/providers/catalog-data.test.ts +0 -258
- package/src/providers/catalog-data.ts +0 -498
- package/src/providers/catalog.test.ts +0 -84
- package/src/providers/catalog.ts +0 -483
- package/src/providers/fake.ts +0 -312
- package/src/providers/openai-compatible.test.ts +0 -366
- package/src/providers/openai-compatible.ts +0 -554
- package/src/proxy/responses-mapper.test.ts +0 -290
- package/src/proxy/responses-mapper.ts +0 -736
- package/src/proxy/responses-server.test.ts +0 -322
- package/src/proxy/responses-server.ts +0 -469
- package/src/router.test.ts +0 -699
- package/src/router.ts +0 -352
- package/src/schemas.test.ts +0 -291
- package/src/secrets.test.ts +0 -271
- package/src/secrets.ts +0 -461
- package/src/types.ts +0 -173
- package/src/usage-file.test.ts +0 -243
- package/src/usage-file.ts +0 -435
- package/src/usage.test.ts +0 -335
- package/src/usage.ts +0 -859
- package/tsconfig.json +0 -9
|
@@ -4,94 +4,82 @@
|
|
|
4
4
|
*/
|
|
5
5
|
import { z } from "zod";
|
|
6
6
|
import { ROUTE_PROTOCOL_VERSION } from "./protocol.js";
|
|
7
|
-
|
|
8
7
|
export const AuthTierSchema = z.enum(["subscription", "local", "api-key"]);
|
|
9
|
-
|
|
10
8
|
export const AuthScopeSchema = z.enum([
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
9
|
+
"first-party",
|
|
10
|
+
"third-party",
|
|
11
|
+
"unknown",
|
|
14
12
|
]);
|
|
15
|
-
|
|
16
13
|
export const SubscriptionStatusSchema = z.enum([
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
14
|
+
"active",
|
|
15
|
+
"near-limit",
|
|
16
|
+
"exhausted",
|
|
17
|
+
"rate-limited",
|
|
18
|
+
"expired",
|
|
19
|
+
"unconfigured",
|
|
20
|
+
"unknown",
|
|
24
21
|
]);
|
|
25
|
-
|
|
26
22
|
export const ProviderHealthSchema = z.enum(["healthy", "degraded", "dead"]);
|
|
27
|
-
|
|
28
23
|
export const FallbackReasonSchema = z.enum([
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
24
|
+
"primary",
|
|
25
|
+
"subscription_exhausted",
|
|
26
|
+
"subscription_degraded",
|
|
27
|
+
"subscription_unconfigured",
|
|
28
|
+
"subscription_scope_denied",
|
|
29
|
+
"local_preferred",
|
|
30
|
+
"api_key_fallback",
|
|
31
|
+
"policy_denied",
|
|
32
|
+
"provider_error",
|
|
38
33
|
]);
|
|
39
|
-
|
|
40
34
|
export const HarnessKindSchema = z.enum([
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
35
|
+
"claude",
|
|
36
|
+
"codex",
|
|
37
|
+
"gemini",
|
|
38
|
+
"grok",
|
|
39
|
+
"cursor",
|
|
40
|
+
"pi",
|
|
41
|
+
"other",
|
|
48
42
|
]);
|
|
49
|
-
|
|
50
43
|
export const TaskKindSchema = z.enum([
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
44
|
+
"explain",
|
|
45
|
+
"code",
|
|
46
|
+
"review",
|
|
47
|
+
"plan",
|
|
48
|
+
"research",
|
|
49
|
+
"image",
|
|
50
|
+
"tools",
|
|
51
|
+
"other",
|
|
59
52
|
]);
|
|
60
|
-
|
|
61
53
|
export const RiskLevelSchema = z.enum(["low", "medium", "high"]);
|
|
62
|
-
|
|
63
54
|
export const PolicyDenialCodeSchema = z.enum([
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
55
|
+
"profile_not_allowlisted",
|
|
56
|
+
"work_profile_denied",
|
|
57
|
+
"provider_denied",
|
|
58
|
+
"project_untrusted",
|
|
59
|
+
"privacy_label_denied",
|
|
60
|
+
"local_only_required",
|
|
61
|
+
"cost_cap_exceeded",
|
|
62
|
+
"api_key_blocked_by_subscription_first_policy",
|
|
63
|
+
"subscription_scope_denied",
|
|
64
|
+
"capability_missing",
|
|
74
65
|
]);
|
|
75
|
-
|
|
76
66
|
export const PolicyDenialTargetSchema = z.enum([
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
67
|
+
"profile",
|
|
68
|
+
"provider",
|
|
69
|
+
"model",
|
|
70
|
+
"workspace",
|
|
71
|
+
"candidate",
|
|
82
72
|
]);
|
|
83
|
-
|
|
84
73
|
export const PolicyDenialSchema = z
|
|
85
|
-
|
|
74
|
+
.object({
|
|
86
75
|
code: PolicyDenialCodeSchema,
|
|
87
76
|
target: PolicyDenialTargetSchema,
|
|
88
77
|
id: z.string().min(1),
|
|
89
78
|
message: z.string().min(1),
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
79
|
+
})
|
|
80
|
+
.strict();
|
|
93
81
|
export const ProviderCandidateSchema = z
|
|
94
|
-
|
|
82
|
+
.object({
|
|
95
83
|
providerId: z.string().min(1),
|
|
96
84
|
modelId: z.string().min(1),
|
|
97
85
|
displayName: z.string().optional(),
|
|
@@ -108,22 +96,20 @@ export const ProviderCandidateSchema = z
|
|
|
108
96
|
contextWindowTokens: z.number().nonnegative().optional(),
|
|
109
97
|
maxOutputTokens: z.number().nonnegative().optional(),
|
|
110
98
|
estimatedCostUsd: z.number().nonnegative().optional(),
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
99
|
+
})
|
|
100
|
+
.strict();
|
|
114
101
|
export const HarnessRefSchema = z
|
|
115
|
-
|
|
102
|
+
.object({
|
|
116
103
|
kind: HarnessKindSchema,
|
|
117
104
|
profile: z.string().min(1),
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
105
|
+
})
|
|
106
|
+
.strict();
|
|
121
107
|
/**
|
|
122
108
|
* Task payload for routing: preview + digest only.
|
|
123
109
|
* Full prompts are rejected here by schema absence of `prompt`.
|
|
124
110
|
*/
|
|
125
111
|
export const RouteTaskSchema = z
|
|
126
|
-
|
|
112
|
+
.object({
|
|
127
113
|
promptPreview: z.string().min(1),
|
|
128
114
|
promptDigest: z.string().min(1),
|
|
129
115
|
kind: TaskKindSchema,
|
|
@@ -132,58 +118,52 @@ export const RouteTaskSchema = z
|
|
|
132
118
|
requiresImages: z.boolean().optional(),
|
|
133
119
|
requiresStreaming: z.boolean().optional(),
|
|
134
120
|
requiresJson: z.boolean().optional(),
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
121
|
+
})
|
|
122
|
+
.strict();
|
|
138
123
|
export const WorkspaceRefSchema = z
|
|
139
|
-
|
|
124
|
+
.object({
|
|
140
125
|
cwd: z.string().min(1),
|
|
141
126
|
trusted: z.boolean(),
|
|
142
127
|
privacyLabel: z.string().optional(),
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
128
|
+
})
|
|
129
|
+
.strict();
|
|
146
130
|
export const RouteConstraintsSchema = z
|
|
147
|
-
|
|
131
|
+
.object({
|
|
148
132
|
maxCostUsd: z.number().nonnegative().optional(),
|
|
149
133
|
localOnly: z.boolean().optional(),
|
|
150
134
|
allowApiKeyFallback: z.boolean().optional(),
|
|
151
135
|
subscriptionFirst: z.boolean().optional(),
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
136
|
+
})
|
|
137
|
+
.strict();
|
|
155
138
|
export const RouteRequestSchema = z
|
|
156
|
-
|
|
139
|
+
.object({
|
|
157
140
|
protocolVersion: z.literal(ROUTE_PROTOCOL_VERSION),
|
|
158
141
|
requestId: z.string().min(1),
|
|
159
142
|
harness: HarnessRefSchema,
|
|
160
143
|
task: RouteTaskSchema,
|
|
161
144
|
workspace: WorkspaceRefSchema,
|
|
162
145
|
constraints: RouteConstraintsSchema,
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
146
|
+
})
|
|
147
|
+
.strict();
|
|
166
148
|
export const SelectedRouteSchema = z
|
|
167
|
-
|
|
149
|
+
.object({
|
|
168
150
|
provider: z.string().min(1),
|
|
169
151
|
model: z.string().min(1),
|
|
170
152
|
authTier: AuthTierSchema,
|
|
171
153
|
authScope: AuthScopeSchema.optional(),
|
|
172
154
|
accountId: z.string().min(1).optional(),
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
155
|
+
})
|
|
156
|
+
.strict();
|
|
176
157
|
export const FallbackChainEntrySchema = z
|
|
177
|
-
|
|
158
|
+
.object({
|
|
178
159
|
provider: z.string().min(1),
|
|
179
160
|
model: z.string().min(1),
|
|
180
161
|
authTier: AuthTierSchema,
|
|
181
162
|
reason: FallbackReasonSchema,
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
163
|
+
})
|
|
164
|
+
.strict();
|
|
185
165
|
export const RouteDecisionSchema = z
|
|
186
|
-
|
|
166
|
+
.object({
|
|
187
167
|
protocolVersion: z.literal(ROUTE_PROTOCOL_VERSION),
|
|
188
168
|
decisionId: z.string().min(1),
|
|
189
169
|
requestId: z.string().min(1),
|
|
@@ -197,12 +177,12 @@ export const RouteDecisionSchema = z
|
|
|
197
177
|
blocked: z.boolean().optional(),
|
|
198
178
|
needsConfiguration: z.boolean().optional(),
|
|
199
179
|
nearLimitWarning: z.string().optional(),
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
180
|
+
})
|
|
181
|
+
.strict();
|
|
203
182
|
export const PolicyDecisionSchema = z
|
|
204
|
-
|
|
183
|
+
.object({
|
|
205
184
|
allowed: z.array(ProviderCandidateSchema),
|
|
206
185
|
denials: z.array(PolicyDenialSchema),
|
|
207
|
-
|
|
208
|
-
|
|
186
|
+
})
|
|
187
|
+
.strict();
|
|
188
|
+
//# sourceMappingURL=schemas.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,aAAa;IACb,aAAa;IACb,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,cAAc;IACd,SAAS;IACT,cAAc;IACd,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,SAAS;IACT,wBAAwB;IACxB,uBAAuB;IACvB,2BAA2B;IAC3B,2BAA2B;IAC3B,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC;IACnC,SAAS;IACT,MAAM;IACN,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,yBAAyB;IACzB,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,8CAA8C;IAC9C,2BAA2B;IAC3B,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,SAAS;IACT,UAAU;IACV,OAAO;IACP,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE,wBAAwB;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,eAAe;IAC1B,kBAAkB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACvD,MAAM,EAAE,oBAAoB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACxD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,eAAe;IACrB,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,gBAAgB;IACzB,IAAI,EAAE,eAAe;IACrB,SAAS,EAAE,kBAAkB;IAC7B,WAAW,EAAE,sBAAsB;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,oBAAoB;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,mBAAmB,CAAC,OAAO,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAC3D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CACrC,CAAC;KACD,MAAM,EAAE,CAAC"}
|
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
import { mkdir, readFile, rename, unlink, writeFile, chmod } from "node:fs/promises";
|
|
2
|
+
/** Placeholder substituted for secret material in log-safe strings. */
|
|
3
|
+
/** Placeholder substituted for secret material in log-safe strings. */
|
|
4
|
+
export declare const REDACTED: "[REDACTED]";
|
|
5
|
+
/**
|
|
6
|
+
* Contract for provider secret storage.
|
|
7
|
+
* All mutations are async so file + OS-keychain backends share one API.
|
|
8
|
+
*/
|
|
9
|
+
export interface SecretStore {
|
|
10
|
+
get(providerId: string): Promise<string | undefined>;
|
|
11
|
+
set(providerId: string, secret: string): Promise<void>;
|
|
12
|
+
delete(providerId: string): Promise<void>;
|
|
13
|
+
listProviders(): Promise<string[]>;
|
|
14
|
+
/**
|
|
15
|
+
* Replace secrets / API-key-like substrings for audit/log output.
|
|
16
|
+
* Must never throw; bad input returns a safe string.
|
|
17
|
+
*/
|
|
18
|
+
redact(value: string): string;
|
|
19
|
+
/**
|
|
20
|
+
* JSON-safe diagnostic view. Must never include raw secret values.
|
|
21
|
+
* Also used by `JSON.stringify(store)`.
|
|
22
|
+
*/
|
|
23
|
+
toJSON(): Record<string, unknown>;
|
|
24
|
+
}
|
|
25
|
+
export interface FileSecretStoreOptions {
|
|
26
|
+
/** Absolute path to secrets.json (typically `$OFFROUTER_HOME/secrets.json`). */
|
|
27
|
+
filePath: string;
|
|
28
|
+
/** Injectable file operations for failure-path tests. Defaults to node fs. */
|
|
29
|
+
fileSystem?: Partial<FileSecretStoreFileSystem>;
|
|
30
|
+
}
|
|
31
|
+
export interface KeychainSecretStoreOptions {
|
|
32
|
+
/**
|
|
33
|
+
* Keychain/keyring service name. OffRouter only reads entries it wrote
|
|
34
|
+
* under this service — never foreign CLI credential stores.
|
|
35
|
+
*/
|
|
36
|
+
service?: string;
|
|
37
|
+
/**
|
|
38
|
+
* Optional account/name prefix for stored items.
|
|
39
|
+
* Full item name is `${accountPrefix}${providerId}`.
|
|
40
|
+
*/
|
|
41
|
+
accountPrefix?: string;
|
|
42
|
+
}
|
|
43
|
+
interface FileSecretStoreFileSystem {
|
|
44
|
+
mkdir: typeof mkdir;
|
|
45
|
+
readFile: typeof readFile;
|
|
46
|
+
rename: typeof rename;
|
|
47
|
+
unlink: typeof unlink;
|
|
48
|
+
writeFile: typeof writeFile;
|
|
49
|
+
chmod: typeof chmod;
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* Standalone redaction for log/audit paths that do not hold a store.
|
|
53
|
+
* Optionally rejects known secret values (longest-first to avoid partials).
|
|
54
|
+
*/
|
|
55
|
+
export declare function redact(value: string, knownSecrets?: Iterable<string>): string;
|
|
56
|
+
/**
|
|
57
|
+
* File-backed secret store for tests and user-approved fallback.
|
|
58
|
+
* Writes `$filePath` with mode `0o600` on POSIX after every mutation.
|
|
59
|
+
*/
|
|
60
|
+
export declare class FileSecretStore implements SecretStore {
|
|
61
|
+
#private;
|
|
62
|
+
readonly filePath: string;
|
|
63
|
+
constructor(options: FileSecretStoreOptions);
|
|
64
|
+
get(providerId: string): Promise<string | undefined>;
|
|
65
|
+
set(providerId: string, secret: string): Promise<void>;
|
|
66
|
+
delete(providerId: string): Promise<void>;
|
|
67
|
+
listProviders(): Promise<string[]>;
|
|
68
|
+
redact(value: string): string;
|
|
69
|
+
toJSON(): Record<string, unknown>;
|
|
70
|
+
}
|
|
71
|
+
/**
|
|
72
|
+
* Raised when the OS keychain/keyring backend is not available or not wired.
|
|
73
|
+
* Callers should fall back to FileSecretStore only with explicit user approval.
|
|
74
|
+
*/
|
|
75
|
+
export declare class KeychainUnavailableError extends Error {
|
|
76
|
+
readonly code: "keychain_unavailable";
|
|
77
|
+
constructor(message: string, options?: {
|
|
78
|
+
cause?: unknown;
|
|
79
|
+
});
|
|
80
|
+
}
|
|
81
|
+
/**
|
|
82
|
+
* OS keychain boundary for real runs.
|
|
83
|
+
*
|
|
84
|
+
* V1 ships this as a typed stub: it never scrapes other CLIs and does not
|
|
85
|
+
* perform network I/O. Get/set/delete/list reject with KeychainUnavailableError
|
|
86
|
+
* until a platform backend is wired. Prefer this store at the seams of real
|
|
87
|
+
* runs once keychain support lands; tests and dry runs use FileSecretStore.
|
|
88
|
+
*/
|
|
89
|
+
export declare class KeychainSecretStore implements SecretStore {
|
|
90
|
+
#private;
|
|
91
|
+
readonly service: string;
|
|
92
|
+
readonly accountPrefix: string;
|
|
93
|
+
constructor(options?: KeychainSecretStoreOptions);
|
|
94
|
+
get(providerId: string): Promise<string | undefined>;
|
|
95
|
+
set(providerId: string, secret: string): Promise<void>;
|
|
96
|
+
delete(providerId: string): Promise<void>;
|
|
97
|
+
listProviders(): Promise<string[]>;
|
|
98
|
+
redact(value: string): string;
|
|
99
|
+
toJSON(): Record<string, unknown>;
|
|
100
|
+
}
|
|
101
|
+
/**
|
|
102
|
+
* Retrieve a provider token from the secret store.
|
|
103
|
+
* Returns undefined if no token is stored or the store is unavailable.
|
|
104
|
+
*/
|
|
105
|
+
export declare function getProviderToken(providerId: string, store: SecretStore): Promise<string | undefined>;
|
|
106
|
+
/**
|
|
107
|
+
* Store a provider token in the secret store.
|
|
108
|
+
* Throws if the store is unavailable (e.g., KeychainUnavailableError).
|
|
109
|
+
*/
|
|
110
|
+
export declare function setProviderToken(providerId: string, token: string, store: SecretStore): Promise<void>;
|
|
111
|
+
export {};
|
|
112
|
+
//# sourceMappingURL=secrets.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACT,KAAK,EACN,MAAM,kBAAkB,CAAC;AAI1B,uEAAuE;AACvE,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAG,YAAqB,CAAC;AAE9C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAQD,UAAU,yBAAyB;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB;AAsCD;;;GAGG;AACH,wBAAgB,MAAM,CACpB,KAAK,EAAE,MAAM,EACb,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAM,GAClC,MAAM,CAwBR;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,WAAW;;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAMd,OAAO,EAAE,sBAAsB;IAgBrC,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAO7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAuFlC;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBAEpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI3D;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAoB,YAAW,WAAW;;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBAEnB,OAAO,GAAE,0BAA+B;IAQ9C,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKpD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKzC,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK7B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAgBlC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,IAAI,CAAC,CAEf"}
|