pilotswarm-sdk 0.5.47 → 0.5.49

package/dist/management-client.js

@@ -22,7 +22,7 @@ import { resolveStorageConfig } from "./storage-config.js";
 import { getDuroxideStorageProvider, getRuntimeStorageProvider } from "./storage-providers.js";
 import { SessionDumper } from "./session-dumper.js";
 import { computeSessionFootprint, FootprintCache } from "./footprint.js";
-import { loadModelProviders, loadModelProviderTypes } from "./model-providers.js";
+import { loadModelProviders, loadModelProviderTypes, providerTypeUsesWorkloadIdentity } from "./model-providers.js";
 import { bootstrapProviders, resolveProviderCredential, resolveRuntimeModelSelection } from "./provider-catalog.js";
 import { deriveStatusFromCmsAndRuntime, shouldSyncCompletedStatus, shouldSyncFailedStatus } from "./session-status.js";
 import { assertUnambiguousProvider, isWebOptions } from "./web/api-connection.js";
@@ -2509,6 +2509,33 @@ export class PilotSwarmManagementClient {
         throw new ProviderError("PROVIDER_INVALID", `No provider type named "${wanted}" on this deployment. `
             + `It has ${known.slice(0, 6).join(", ")}${known.length > 6 ? ", …" : ""}.`);
     }
+    /**
+     * Does this type authenticate as the worker rather than with a key?
+     *
+     * The store knows a type only by its name, so the decision is made here,
+     * where the type catalog is. An unknown type answers false and is refused
+     * a moment later by `_assertKnownProviderType` — this is not the place
+     * that reports it.
+     */
+    _typeUsesWorkloadIdentity(typeId) {
+        const wanted = String(typeId ?? "").trim();
+        const group = this.getModelsByProvider().find((candidate) => candidate.providerId === wanted);
+        return providerTypeUsesWorkloadIdentity(group?.type);
+    }
+    /**
+     * Refuse a key update on a provider that has no key.
+     *
+     * Accepting it would store a real secret in a row nothing ever reads a
+     * secret from, and tell the person their rotation worked.
+     */
+    async _assertCredentialIsUpdatable(store, name, actor, isAdmin) {
+        const rows = await store.listProviders(actor, isAdmin);
+        const row = rows.find((candidate) => candidate.name === name);
+        if (row && this._typeUsesWorkloadIdentity(row.typeId)) {
+            throw new ProviderError("PROVIDER_INVALID", `Provider "${name}" authenticates with the worker's workload identity and has no key to update. `
+                + "Change the worker's identity configuration instead.");
+        }
+    }
     async createProvider(viewer, input) {
         const { store, actor, isAdmin } = await this._providerActor(viewer);
         this._assertKnownProviderType(input.type);
@@ -2518,6 +2545,7 @@ export class PilotSwarmManagementClient {
             class: "shared",
             secretRef: input.credentials ?? null,
             baseUrl: input.baseUrl ?? null,
+            workloadIdentity: this._typeUsesWorkloadIdentity(input.type),
         }, actor, isAdmin);
         await this._auditProviderMutation(viewer, "createProvider", created.name, { class: "shared", type: created.typeId });
         // A name that did not resolve a moment ago now does.
@@ -2531,6 +2559,15 @@ export class PilotSwarmManagementClient {
             throw new ProviderError("PROVIDER_FORBIDDEN", "Sign in to add a personal provider.");
         }
         this._assertKnownProviderType(input.type);
+        // A personal provider exists to run on ITS OWNER'S credentials. This
+        // type has none: it runs on the worker's, which is the organization's.
+        // A personal one would spend the cluster's own account under a name no
+        // administrator can cap, hold or delete, because a personal provider
+        // answers only to its owner — and anyone signed in may create one.
+        if (this._typeUsesWorkloadIdentity(input.type)) {
+            throw new ProviderError("PROVIDER_FORBIDDEN", `Provider type "${input.type}" authenticates with the worker's own identity, `
+                + "so it cannot be a personal provider. An administrator can add it as a shared one.");
+        }
         const created = await store.createProvider({
             name: input.name,
             typeId: input.type,
@@ -2545,7 +2582,8 @@ export class PilotSwarmManagementClient {
     }
     /** Replace the credential on one of the caller's own personal providers. */
     async updateMyProviderCredential(viewer, input) {
-        const { store, actor } = await this._providerActor(viewer);
+        const { store, actor, isAdmin } = await this._providerActor(viewer);
+        await this._assertCredentialIsUpdatable(store, input.name, actor, isAdmin);
         const updated = await store.updatePersonalCredential(input.name, input.credentials, actor);
         await this._auditProviderMutation(viewer, "updateMyProviderCredential", updated.name, {
             class: "personal",
@@ -2563,6 +2601,7 @@ export class PilotSwarmManagementClient {
      */
     async updateSharedProviderCredential(viewer, input) {
         const { store, actor, isAdmin } = await this._providerActor(viewer);
+        await this._assertCredentialIsUpdatable(store, input.name, actor, isAdmin);
         const updated = await store.updateSharedCredential(input.name, input.credentials, actor, isAdmin);
         await this._auditProviderMutation(viewer, "updateSharedProviderCredential", updated.name, {
             class: "shared",
@@ -2993,6 +3032,18 @@ export class PilotSwarmManagementClient {
             truncated: breakdown.length > limit,
         };
     }
+    /**
+     * The cluster summary: totals for today / the week / the month, a per-day
+     * series and the per-model pivot, over every provider (or the ones named).
+     * Read from the ledger, so system sessions are in it — unlike the meters
+     * the Providers tab reads, which count people's turns only.
+     */
+    async getProviderUsageSummary(viewer, query = {}) {
+        const { store, actor, isAdmin } = await this._providerActor(viewer);
+        const days = clampInteger(query.days ?? undefined, 14, 1, 365);
+        const providers = Array.isArray(query.providers) ? query.providers : null;
+        return await store.usageSummary(actor, isAdmin, days, providers);
+    }
     /** Sessions waiting on a limit right now, with what is holding each one. */
     async listPausedSessions(viewer) {
         const { store, actor, isAdmin } = await this._providerActor(viewer);
@@ -3394,9 +3445,15 @@ export class PilotSwarmManagementClient {
             qualifiedName: descriptor.qualifiedName,
             providerId: descriptor.providerId,
             providerType: descriptor.providerType,
-            credentialAvailable: resolved.type === "github"
-                ? Boolean(resolved.githubToken)
-                : Boolean(resolved.sdkProvider?.apiKey),
+            // A workload-identity provider has a credential in every sense
+            // that matters here — the worker can authenticate — it just is
+            // not a stored one. Testing for a key would grey out the model in
+            // every picker and refuse it as a default.
+            credentialAvailable: resolved.usesWorkloadIdentity
+                ? true
+                : resolved.type === "github"
+                    ? Boolean(resolved.githubToken)
+                    : Boolean(resolved.sdkProvider?.apiKey),
         };
     }
     // ─── Session Dump ────────────────────────────────────────