omnigateway 0.1.1 → 0.1.3

package/bin/omni.js

@@ -608,6 +608,7 @@ async function* decodeAnthropic(messages) {
   let cacheWriteTokens = 0;
   let outputTokens = 0;
   let stopReason = "endTurn";
+  let terminal = false;
   for await (const msg of messages) {
     const d = json(msg.data);
     if (d === null)
@@ -673,6 +674,7 @@ async function* decodeAnthropic(messages) {
         break;
       }
       case "message_stop":
+        terminal = true;
         yield {
           type: "end",
           stopReason,
@@ -680,6 +682,7 @@ async function* decodeAnthropic(messages) {
         };
         break;
       case "error": {
+        terminal = true;
         const code = ERROR_TYPE[String(d.error?.type)] ?? "UPSTREAM";
         yield {
           type: "error",
@@ -693,6 +696,14 @@ async function* decodeAnthropic(messages) {
         break;
     }
   }
+  if (!terminal) {
+    yield {
+      type: "error",
+      code: "UPSTREAM",
+      message: "upstream stream ended before message_stop",
+      retryable: RETRYABLE.UPSTREAM
+    };
+  }
 }
 
 // packages/providers/src/anthropic/wire.ts
@@ -805,9 +816,10 @@ var anthropicAdapter = {
       ["anthropic-version", API_VERSION],
       ["Accept", req.request.stream ? "text/event-stream" : "application/json"]
     ];
+    const betas = new Set(req.request.betas ?? []);
     if (oauth) {
       protocol.push(["Authorization", `Bearer ${req.credentials.accessToken}`]);
-      protocol.push(["anthropic-beta", OAUTH_BETA]);
+      betas.add(OAUTH_BETA);
     } else if (req.credentials.apiKey !== null) {
       protocol.push(["x-api-key", req.credentials.apiKey]);
     } else {
@@ -815,6 +827,8 @@ var anthropicAdapter = {
         provider: "anthropic"
       });
     }
+    if (betas.size > 0)
+      protocol.push(["anthropic-beta", [...betas].join(",")]);
     const profile = PROFILES.anthropic;
     const headers = orderHeaders(mergeHeaders(profile.headers, protocol), profile.order);
     const bodyString = signAnthropicBody(JSON.stringify(orderFields(withSystem, BODY_ORDER.anthropic)));
@@ -1032,18 +1046,16 @@ async function* decodeChat(messages) {
   let started = false;
   let textOpen = false;
   let textIndex;
-  let ended = false;
+  let done = false;
   let stopReason = "endTurn";
   let usage = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
   const toolIndex = new Map;
   let nextIndex = 0;
-  const emitEnd = () => {
-    ended = true;
-    return { type: "end", stopReason, usage };
-  };
   for await (const msg of messages) {
-    if (msg.data === "[DONE]")
+    if (msg.data === "[DONE]") {
+      done = true;
       break;
+    }
     const d = json2(msg.data);
     if (d === null)
       continue;
@@ -1098,19 +1110,21 @@ async function* decodeChat(messages) {
     }
     if (typeof choice.finish_reason === "string") {
       stopReason = FINISH[choice.finish_reason] ?? "endTurn";
-      if (textOpen)
-        yield { type: "blockEnd", index: textIndex ?? 0 };
-      for (const index of toolIndex.values())
-        yield { type: "blockEnd", index };
-      yield emitEnd();
     }
   }
-  if (!ended) {
+  if (done) {
     if (textOpen)
       yield { type: "blockEnd", index: textIndex ?? 0 };
     for (const index of toolIndex.values())
       yield { type: "blockEnd", index };
-    yield emitEnd();
+    yield { type: "end", stopReason, usage };
+  } else {
+    yield {
+      type: "error",
+      code: "UPSTREAM",
+      message: "upstream stream ended before [DONE]",
+      retryable: RETRYABLE.UPSTREAM
+    };
   }
 }
 
@@ -1265,6 +1279,7 @@ async function* decodeResponses(messages) {
     return assigned;
   };
   let sawToolCall = false;
+  let terminal = false;
   const ownsBlock = new Set;
   for await (const msg of messages) {
     const d = json3(msg.data);
@@ -1340,6 +1355,7 @@ async function* decodeResponses(messages) {
       }
       case "response.completed":
       case "response.incomplete": {
+        terminal = true;
         const r = d.response ?? {};
         const reason = r.incomplete_details?.reason;
         let stopReason = sawToolCall ? "toolUse" : "endTurn";
@@ -1361,6 +1377,7 @@ async function* decodeResponses(messages) {
       }
       case "response.failed":
       case "error": {
+        terminal = true;
         const err = d.response?.error ?? d.error ?? {};
         const code = ERROR_CODE[String(err.code ?? err.type)] ?? "UPSTREAM";
         yield {
@@ -1375,6 +1392,14 @@ async function* decodeResponses(messages) {
         break;
     }
   }
+  if (!terminal) {
+    yield {
+      type: "error",
+      code: "UPSTREAM",
+      message: "upstream stream ended before response completion",
+      retryable: RETRYABLE.UPSTREAM
+    };
+  }
 }
 
 // packages/providers/src/openai/wire.ts
@@ -16415,25 +16440,104 @@ function requireDimension(grain, dimension) {
 }
 
 // packages/control/src/credentials.ts
+function summarizeCredential(credential) {
+  return {
+    id: credential.id,
+    provider: credential.provider,
+    label: credential.label,
+    authType: credential.authType,
+    enabled: credential.enabled,
+    tier: credential.tier,
+    weight: credential.weight,
+    expiresAt: credential.expiresAt,
+    accountEmail: credential.accountEmail,
+    providerData: credential.providerData,
+    disabledReason: credential.disabledReason,
+    disabledAt: credential.disabledAt,
+    hasRefreshToken: credential.hasRefreshToken,
+    createdAt: credential.createdAt,
+    updatedAt: credential.updatedAt
+  };
+}
 async function listCredentials(store) {
-  const credentials = await store.credentials.list();
-  return credentials.map((c) => ({
-    id: c.id,
-    provider: c.provider,
-    label: c.label,
-    authType: c.authType,
-    enabled: c.enabled,
-    tier: c.tier,
-    weight: c.weight,
-    expiresAt: c.expiresAt,
-    accountEmail: c.accountEmail,
-    providerData: c.providerData,
-    disabledReason: c.disabledReason,
-    disabledAt: c.disabledAt,
-    hasRefreshToken: c.hasRefreshToken,
-    createdAt: c.createdAt,
-    updatedAt: c.updatedAt
-  }));
+  return (await store.credentials.list()).map(summarizeCredential);
+}
+async function getCredential(store, id) {
+  const credential = await store.credentials.get(id);
+  if (credential === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  return summarizeCredential(credential);
+}
+async function createApiKeyCredential(store, input) {
+  const provider = parseOrThrow(providerIdSchema, input.provider);
+  if (typeof input.apiKey !== "string" || input.apiKey.trim().length === 0) {
+    throw new GatewayError("BAD_REQUEST", "apiKey: must not be empty");
+  }
+  if (input.label !== undefined && typeof input.label !== "string") {
+    throw new GatewayError("BAD_REQUEST", "label: must be a string");
+  }
+  const label = input.label?.trim() || `${provider} api key`;
+  const created = await store.credentials.create({
+    id: crypto.randomUUID(),
+    provider,
+    label,
+    authType: "apiKey",
+    enabled: true,
+    tier: 1,
+    weight: 1,
+    expiresAt: null,
+    accountEmail: null,
+    providerData: {},
+    disabledReason: null,
+    disabledAt: null,
+    accessToken: null,
+    refreshToken: null,
+    apiKey: input.apiKey,
+    idToken: null
+  });
+  return summarizeCredential(created);
+}
+async function refreshCredential(deps, id) {
+  const credential = await deps.store.credentials.get(id);
+  if (credential === null)
+    throw new GatewayError("BAD_REQUEST", "no such credential");
+  if (credential.authType !== "oauth") {
+    throw new GatewayError("BAD_REQUEST", `credential "${id}" is an api key and has nothing to refresh`);
+  }
+  await deps.refresh(credential);
+  return getCredential(deps.store, id);
+}
+async function credentialHealth(store) {
+  const [health, quota] = await Promise.all([
+    store.credentials.listHealth(),
+    store.credentials.listQuota()
+  ]);
+  return { health, quota };
+}
+async function credentialStatus(store, options) {
+  const [credentials, quota, adminConfigured] = await Promise.all([
+    listCredentials(store),
+    store.credentials.listQuota(),
+    createAdminAuth(store, { now: options.now, sessionTtlMs: 0 }).isConfigured()
+  ]);
+  const byCredential = new Map;
+  for (const row of quota) {
+    const rows = byCredential.get(row.credentialId);
+    if (rows === undefined)
+      byCredential.set(row.credentialId, [row]);
+    else
+      rows.push(row);
+  }
+  return {
+    adminConfigured,
+    credentials: credentials.map(({ id, provider, label, enabled }) => ({
+      id,
+      provider,
+      label,
+      enabled,
+      quota: byCredential.get(id) ?? []
+    }))
+  };
 }
 async function patchCredential(deps, id, input) {
   const patch = parseOrThrow(credentialPatchSchema, input);
@@ -16461,7 +16565,7 @@ function healthKey(credentialId, model) {
 }
 async function buildSnapshot(store, now) {
   const [credentials, healthRows, quotaRows, models, settings] = await Promise.all([
-    store.credentials.list(),
+    store.credentials.listRouting(),
     store.credentials.listHealth(),
     store.credentials.listQuota(),
     store.config.listModels(),
@@ -16775,7 +16879,7 @@ var DEFAULT_SETTINGS = {
 // packages/store/src/sqlite/config.ts
 var SETTINGS_KEY = "settings";
 var ADMIN_HASH_KEY = "adminPasswordHash";
-function createConfigRepo(db) {
+function createConfigRepo(db, emit2 = () => {}) {
   const readRaw = (key) => db.query("SELECT value FROM settings WHERE key = ?").get(key)?.value ?? null;
   const writeRaw = (key, value) => {
     db.run("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value", [key, value]);
@@ -16795,9 +16899,11 @@ function createConfigRepo(db) {
            targets = excluded.targets,
            strategy = excluded.strategy,
            is_alias = excluded.is_alias`, [model.id, JSON.stringify(model.targets), model.strategy, model.isAlias ? 1 : 0]);
+      emit2({ type: "modelsChanged" });
     },
     async removeModel(id) {
       db.run("DELETE FROM virtual_models WHERE id = ?", [id]);
+      emit2({ type: "modelsChanged" });
     },
     async getSettings() {
       const raw = readRaw(SETTINGS_KEY);
@@ -16818,6 +16924,7 @@ function createConfigRepo(db) {
         weights: { ...current.weights, ...patch.weights }
       };
       writeRaw(SETTINGS_KEY, JSON.stringify(next));
+      emit2({ type: "settingsChanged" });
       return next;
     },
     async getAdminPasswordHash() {
@@ -16833,8 +16940,40 @@ function createConfigRepo(db) {
   };
 }
 // packages/store/src/sqlite/credentials.ts
-function createCredentialRepo(db, key) {
-  const view = (row) => ({
+function createCredentialRepo(db, key, emit2 = () => {}) {
+  const open = async (v) => v === null ? null : decrypt(key, v);
+  const secretsFrom = async (row) => ({
+    accessToken: await open(row.access_token),
+    refreshToken: await open(row.refresh_token),
+    apiKey: await open(row.api_key),
+    idToken: await open(row.id_token)
+  });
+  const requiredRow = (row, id) => {
+    if (row === null)
+      throw new Error(`credential ${id} no longer exists`);
+    return row;
+  };
+  const currentSecrets = async (id) => {
+    const row = requiredRow(db.query("SELECT access_token, refresh_token, api_key, id_token FROM credentials WHERE id = ?").get(id), id);
+    return secretsFrom(row);
+  };
+  const currentInferenceSecrets = async (id, authType) => {
+    if (authType === "oauth") {
+      const row2 = requiredRow(db.query("SELECT access_token FROM credentials WHERE id = ?").get(id), id);
+      return { accessToken: await open(row2.access_token), apiKey: null };
+    }
+    const row = requiredRow(db.query("SELECT api_key FROM credentials WHERE id = ?").get(id), id);
+    return { accessToken: null, apiKey: await open(row.api_key) };
+  };
+  const currentRefreshSecrets = async (id) => {
+    const row = requiredRow(db.query("SELECT refresh_token FROM credentials WHERE id = ?").get(id), id);
+    return { refreshToken: await open(row.refresh_token) };
+  };
+  const currentUsageSecrets = async (id) => {
+    const row = requiredRow(db.query("SELECT access_token FROM credentials WHERE id = ?").get(id), id);
+    return { accessToken: await open(row.access_token) };
+  };
+  const view = (row, loadCurrentSecrets = false) => ({
     id: row.id,
     provider: row.provider,
     label: row.label,
@@ -16850,18 +16989,31 @@ function createCredentialRepo(db, key) {
     hasRefreshToken: row.refresh_token !== null,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
-    secrets: async () => ({
-      accessToken: await open(row.access_token),
-      refreshToken: await open(row.refresh_token),
-      apiKey: await open(row.api_key),
-      idToken: await open(row.id_token)
-    })
+    secrets: () => loadCurrentSecrets ? currentSecrets(row.id) : secretsFrom(row),
+    openForInference: async () => {
+      if (loadCurrentSecrets)
+        return currentInferenceSecrets(row.id, row.auth_type);
+      if (row.auth_type === "oauth") {
+        return { accessToken: await open(row.access_token), apiKey: null };
+      }
+      return { accessToken: null, apiKey: await open(row.api_key) };
+    },
+    openForRefresh: async () => loadCurrentSecrets ? currentRefreshSecrets(row.id) : { refreshToken: await open(row.refresh_token) },
+    openForUsage: async () => loadCurrentSecrets ? currentUsageSecrets(row.id) : { accessToken: await open(row.access_token) }
   });
-  const open = async (v) => v === null ? null : decrypt(key, v);
   const seal = async (v) => v === null || v === undefined ? null : encrypt(key, v);
   return {
     async list() {
-      return db.query("SELECT * FROM credentials ORDER BY tier, label").all().map(view);
+      return db.query("SELECT * FROM credentials ORDER BY tier, label").all().map((row) => view(row));
+    },
+    async listRouting() {
+      return db.query(`SELECT id, provider, label, auth_type, enabled, tier, weight, expires_at,
+                  account_email, provider_data, disabled_reason, disabled_at,
+                  NULL AS access_token,
+                  CASE WHEN refresh_token IS NULL THEN NULL ELSE 'present' END AS refresh_token,
+                  NULL AS api_key, NULL AS id_token, created_at, updated_at
+             FROM credentials
+            ORDER BY tier, label`).all().map((row) => view(row, true));
     },
     async get(id) {
       const row = db.query("SELECT * FROM credentials WHERE id = ?").get(id);
@@ -16894,6 +17046,7 @@ function createCredentialRepo(db, key) {
         now
       ]);
       const { accessToken, refreshToken, apiKey, idToken, ...meta3 } = input;
+      emit2({ type: "credentialsChanged" });
       return {
         ...meta3,
         hasRefreshToken: refreshToken != null,
@@ -16930,6 +17083,7 @@ function createCredentialRepo(db, key) {
         return;
       put("updated_at", Date.now());
       db.run(`UPDATE credentials SET ${sets.join(", ")} WHERE id = ?`, [...vals, id]);
+      emit2({ type: "credentialsChanged" });
     },
     async updateSecrets(id, secrets, expiresAt) {
       const sets = [];
@@ -16953,9 +17107,11 @@ function createCredentialRepo(db, key) {
       sets.push("expires_at = ?", "updated_at = ?");
       vals.push(expiresAt, Date.now());
       db.run(`UPDATE credentials SET ${sets.join(", ")} WHERE id = ?`, [...vals, id]);
+      emit2({ type: "credentialsChanged" });
     },
     async remove(id) {
       db.run("DELETE FROM credentials WHERE id = ?", [id]);
+      emit2({ type: "credentialsChanged" });
     },
     async listHealth() {
       return db.query("SELECT * FROM credential_health").all().map((r) => ({
@@ -16986,6 +17142,7 @@ function createCredentialRepo(db, key) {
           stmt.run(r.credentialId, r.model, r.breakerState, r.consecutiveFailures, r.openedAt, r.rateLimitedUntil, r.ewmaTtftMs, r.lastUsedAt);
         }
       })();
+      emit2({ type: "healthSaved", rows });
     },
     async listQuota() {
       return db.query("SELECT * FROM quota_windows").all().map((r) => ({
@@ -17025,6 +17182,7 @@ function createCredentialRepo(db, key) {
           prune.run(credentialId, JSON.stringify(types2));
         }
       })();
+      emit2({ type: "quotaSaved", rows });
     }
   };
 }
@@ -17497,11 +17655,26 @@ function createUsageRepo(db) {
 // packages/store/src/sqlite/store.ts
 async function createStore(opts) {
   const db = openDb(opts.path);
+  const listeners = new Set;
+  const emit2 = (change) => {
+    for (const listener of listeners) {
+      try {
+        listener(change);
+      } catch {}
+    }
+  };
   return {
-    credentials: createCredentialRepo(db, opts.encryptionKey),
-    config: createConfigRepo(db),
+    credentials: createCredentialRepo(db, opts.encryptionKey, emit2),
+    config: createConfigRepo(db, emit2),
     keys: createKeyRepo(db),
     usage: createUsageRepo(db),
+    routing: {
+      version: () => db.query("PRAGMA data_version").get()?.data_version ?? 0,
+      subscribe(listener) {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      }
+    },
     close: () => db.close()
   };
 }
@@ -17829,7 +18002,7 @@ var OAUTH_PROVIDERS = {
 function createRefresher(deps) {
   const inFlight = new Map;
   async function run(credential) {
-    const secrets = await credential.secrets();
+    const secrets = await credential.openForRefresh();
     if (secrets.refreshToken === null) {
       throw new GatewayError("AUTH", `credential ${credential.id} has no refresh token`);
     }
@@ -18166,10 +18339,7 @@ var credentialsList = {
   }
 };
 async function findCredential(ctx, id) {
-  const credential = await (await ctx.store()).credentials.get(id) ?? null;
-  if (credential === null)
-    throw new CliError(`no credential "${id}"`);
-  return credential;
+  return getCredential(await ctx.store(), id);
 }
 var credentialsShow = {
   usage: "credentials show <id>",
@@ -18268,12 +18438,7 @@ var credentialsRefresh = {
   async run(args, { ctx, writer }) {
     const id = requirePositional(args, 0, "credential id");
     const store = await ctx.store();
-    const credential = await store.credentials.get(id);
-    if (credential === null)
-      throw new CliError(`no credential "${id}"`);
-    if (credential.authType !== "oauth") {
-      throw new CliError(`credential "${id}" is an api key and has nothing to refresh`);
-    }
+    const credential = await findCredential(ctx, id);
     const refresh = createRefresher({
       store,
       providers: OAUTH_PROVIDERS,
@@ -18281,9 +18446,8 @@ var credentialsRefresh = {
       now: ctx.now
     });
     note(ctx, writer, `refreshing ${credential.provider} credential ${id}\u2026`);
-    await refresh(credential);
-    const updated = await store.credentials.get(id);
-    emit(ctx, writer, { id, expiresAt: updated?.expiresAt ?? null }, () => `${id} refreshed; expires ${formatTime(updated?.expiresAt ?? null)}`);
+    const updated = await refreshCredential({ store, refresh }, id);
+    emit(ctx, writer, { id, expiresAt: updated.expiresAt }, () => `${id} refreshed; expires ${formatTime(updated.expiresAt)}`);
   }
 };
 var credentialsAddKey = {
@@ -18298,27 +18462,12 @@ var credentialsAddKey = {
     const key = await prompt.secret(`${providerId} API key: `);
     if (key.length === 0)
       throw new CliError("no API key given");
-    const store = await ctx.store();
-    const id = crypto.randomUUID();
-    await store.credentials.create({
-      id,
+    const created = await createApiKeyCredential(await ctx.store(), {
       provider: providerId,
-      label: stringFlag(args.values, "label") ?? `${providerId} api key`,
-      authType: "apiKey",
-      enabled: true,
-      tier: 1,
-      weight: 1,
-      expiresAt: null,
-      accountEmail: null,
-      providerData: {},
-      disabledReason: null,
-      disabledAt: null,
-      accessToken: null,
-      refreshToken: null,
       apiKey: key,
-      idToken: null
+      label: stringFlag(args.values, "label")
     });
-    emit(ctx, writer, { id, provider: providerId }, () => `stored ${providerId} api key as ${id}`);
+    emit(ctx, writer, { id: created.id, provider: created.provider }, () => `stored ${created.provider} api key as ${created.id}`);
   }
 };
 var credentialsHealth = {
@@ -18327,8 +18476,8 @@ var credentialsHealth = {
   options: { all: { type: "boolean" } },
   async run(args, { ctx, writer }) {
     const store = await ctx.store();
-    const [rows, credentials] = await Promise.all([
-      store.credentials.listHealth(),
+    const [{ health: rows }, credentials] = await Promise.all([
+      credentialHealth(store),
       listCredentials(store)
     ]);
     const labels = new Map(credentials.map((c) => [c.id, c.label]));
@@ -19167,30 +19316,11 @@ var status2 = {
     } catch (error51) {
       storeError = error51 instanceof Error ? error51.message : "could not open the database";
     }
-    const credentials = store === null ? [] : await store.credentials.list();
-    const quotaRows = store === null ? [] : await store.credentials.listQuota();
-    const configured = store === null ? false : await createAdminAuth(store, {
-      now: ctx.now,
-      sessionTtlMs: 0
-    }).isConfigured();
-    const byCredential = new Map;
-    for (const row of quotaRows) {
-      const list = byCredential.get(row.credentialId);
-      if (list === undefined)
-        byCredential.set(row.credentialId, [row]);
-      else
-        list.push(row);
-    }
+    const persistent = store === null ? { adminConfigured: false, credentials: [] } : await credentialStatus(store, { now: ctx.now });
+    const { adminConfigured: configured, credentials } = persistent;
     const data = {
       process: process3,
-      adminConfigured: configured,
-      credentials: credentials.map((credential) => ({
-        id: credential.id,
-        provider: credential.provider,
-        label: credential.label,
-        enabled: credential.enabled,
-        quota: byCredential.get(credential.id) ?? []
-      })),
+      ...persistent,
       storeError
     };
     emit(ctx, writer, data, () => {
@@ -19212,15 +19342,12 @@ ${state(ctx, false, storeError)}`;
 
 no credentials; add one with: omni connect <provider>`;
       }
-      const rows = credentials.map((credential) => {
-        const windows = byCredential.get(credential.id) ?? [];
-        return [
-          credential.label,
-          provider(ctx, credential.provider),
-          state(ctx, credential.enabled, credential.enabled ? "enabled" : "disabled"),
-          quotaCell(ctx, windows, ctx.now())
-        ];
-      });
+      const rows = credentials.map((credential) => [
+        credential.label,
+        provider(ctx, credential.provider),
+        state(ctx, credential.enabled, credential.enabled ? "enabled" : "disabled"),
+        quotaCell(ctx, credential.quota, ctx.now())
+      ]);
       return `${header}
 
 ${table([{ header: "ACCOUNT" }, { header: "PROVIDER" }, { header: "STATE" }, { header: "QUOTA" }], rows)}`;