studiograph 1.3.48-next.13 → 1.3.48-next.131

package/dist/core/secrets/probes/anthropic.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Test-connection probe for Anthropic API keys.
+ *
+ * Implements the staged-advisory contract: each call walks an ordered
+ * sequence of stages (reachable → auth → listing → model_in_list), and
+ * returns the per-stage outcomes plus an overall ok flag. The overall
+ * flag is true IFF every non-advisory stage passed; the `model_in_list`
+ * stage is advisory, so a missing model.id only surfaces as a hint —
+ * the user might be using a preview-tagged or beta model that isn't in
+ * the public listing yet.
+ *
+ * No upstream error bodies are echoed. Stage details are short,
+ * human-authored strings, and never carry the API key, header values,
+ * or the upstream response payload beyond what's explicitly modeled
+ * here.
+ *
+ * Other providers (r2, brave) still use the legacy stub shape — they
+ * return `{ ok, message, durationMs }` only, no stages. The shared
+ * TestResult type below treats the new fields as optional so both
+ * shapes coexist behind one type until later waves promote the rest
+ * to staged diagnostics.
+ */
+/**
+ * One step in a staged probe. The Anthropic probe today emits four
+ * stages in order. Other probes (r2, brave) don't emit stages — they
+ * fill `stages: undefined`.
+ *
+ * `error_code` is a stable string the UI can switch on (e.g. 'network',
+ * 'unauthorized', 'upstream_5xx'). `detail` is human-readable copy
+ * suitable for direct display; it never carries the secret value or an
+ * echoed upstream-body fragment beyond a short canned phrase.
+ */
+export interface ProbeStage {
+    name: 'reachable' | 'auth' | 'listing' | 'model_in_list';
+    ok: boolean;
+    error_code?: string;
+    detail?: string;
+}
+export interface ProbeAdvisory {
+    /**
+     * Mirror of the `model_in_list` stage outcome — true when the
+     * configured model.id was found in /v1/models, false when absent.
+     * Undefined when the probe didn't get far enough to check (e.g.
+     * stopped at `auth`).
+     */
+    model_in_list?: boolean;
+    /** Top-N nearby IDs from the listing response, when model_in_list is false. */
+    suggestions?: string[];
+}
+export interface TestResult {
+    ok: boolean;
+    /**
+     * Short, human-readable status. Never carries the secret value.
+     * Legacy callers (r2, brave stubs) still set this; the staged
+     * Anthropic probe also sets it (mirrors the final stage's detail or
+     * a one-liner summary) so a UI that hasn't been taught about
+     * `stages` still has copy to render.
+     */
+    message?: string;
+    /** Wall-clock duration in ms. */
+    durationMs?: number;
+    /**
+     * Ordered probe stages. Present when the probe is staged; absent for
+     * legacy stubs. The Anthropic probe always emits 1–4 entries
+     * depending on how far it got.
+     */
+    stages?: ProbeStage[];
+    /** Advisory hints (model_in_list, did-you-mean suggestions). */
+    advisory?: ProbeAdvisory;
+}
+/**
+ * Optional context passed alongside the probed value. Today only the
+ * configured `model_id` is plumbed in — the API layer reads it from
+ * the secret store and forwards it so stage 4 can verify the listing
+ * contains the user's chosen ID. Stub probes ignore this param.
+ */
+export interface ProbeContext {
+    model_id?: string;
+}
+/**
+ * Pick the top-N closest model IDs to `needle` from `haystack`. Prefix
+ * matches win first, then sort the rest by Levenshtein distance.
+ * Returns at most `limit` entries.
+ */
+export declare function suggestModelIds(needle: string, haystack: readonly string[], limit?: number): string[];
+/**
+ * Anthropic probe entry point.
+ *
+ * Signature is loose so the legacy `(apiKey) => Promise<TestResult>`
+ * call sites in `registry.ts` and the `/api/secrets/:key/test`
+ * dispatcher keep working. When the API layer has a configured
+ * `model.id` it forwards it via `ctx.model_id`; otherwise stage 4
+ * runs without a needle and reports `model_in_list: undefined`.
+ *
+ * The injected `fetchImpl` lets unit tests swap in a mock without
+ * patching the global. Default = the platform `fetch`.
+ */
+export declare function probeAnthropic(apiKey: string, ctx?: ProbeContext, fetchImpl?: typeof fetch): Promise<TestResult>;

package/dist/core/secrets/probes/anthropic.js

@@ -0,0 +1,300 @@
+/**
+ * Test-connection probe for Anthropic API keys.
+ *
+ * Implements the staged-advisory contract: each call walks an ordered
+ * sequence of stages (reachable → auth → listing → model_in_list), and
+ * returns the per-stage outcomes plus an overall ok flag. The overall
+ * flag is true IFF every non-advisory stage passed; the `model_in_list`
+ * stage is advisory, so a missing model.id only surfaces as a hint —
+ * the user might be using a preview-tagged or beta model that isn't in
+ * the public listing yet.
+ *
+ * No upstream error bodies are echoed. Stage details are short,
+ * human-authored strings, and never carry the API key, header values,
+ * or the upstream response payload beyond what's explicitly modeled
+ * here.
+ *
+ * Other providers (r2, brave) still use the legacy stub shape — they
+ * return `{ ok, message, durationMs }` only, no stages. The shared
+ * TestResult type below treats the new fields as optional so both
+ * shapes coexist behind one type until later waves promote the rest
+ * to staged diagnostics.
+ */
+const ANTHROPIC_API_BASE = 'https://api.anthropic.com';
+const REACHABLE_TIMEOUT_MS = 5_000;
+const AUTH_TIMEOUT_MS = 10_000;
+/**
+ * Levenshtein distance, capped — we only need to rank suggestions for
+ * a short user-supplied model.id against a short list. The cap keeps
+ * the function from running away on long strings (model IDs are
+ * typically 10–40 chars).
+ */
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    const v0 = new Array(b.length + 1);
+    const v1 = new Array(b.length + 1);
+    for (let i = 0; i <= b.length; i++)
+        v0[i] = i;
+    for (let i = 0; i < a.length; i++) {
+        v1[0] = i + 1;
+        for (let j = 0; j < b.length; j++) {
+            const cost = a[i] === b[j] ? 0 : 1;
+            v1[j + 1] = Math.min(v1[j] + 1, v0[j + 1] + 1, v0[j] + cost);
+        }
+        for (let j = 0; j <= b.length; j++)
+            v0[j] = v1[j];
+    }
+    return v1[b.length];
+}
+/**
+ * Pick the top-N closest model IDs to `needle` from `haystack`. Prefix
+ * matches win first, then sort the rest by Levenshtein distance.
+ * Returns at most `limit` entries.
+ */
+export function suggestModelIds(needle, haystack, limit = 3) {
+    if (!needle || haystack.length === 0)
+        return haystack.slice(0, limit);
+    const prefixes = [];
+    const rest = [];
+    for (const id of haystack) {
+        if (id === needle)
+            continue;
+        if (id.startsWith(needle) || needle.startsWith(id)) {
+            prefixes.push(id);
+        }
+        else {
+            rest.push({ id, d: levenshtein(id, needle) });
+        }
+    }
+    rest.sort((a, b) => a.d - b.d);
+    return [...prefixes, ...rest.map((r) => r.id)].slice(0, limit);
+}
+/**
+ * Fetch wrapper that honours a per-call timeout via AbortController.
+ * Returns the Response on success; throws the original error on
+ * network failure / abort. Callers convert the throw into a stage
+ * with an error_code rather than propagating raw error text.
+ *
+ * Accepts the fetch impl as an explicit dep so unit tests can swap
+ * in a mock without patching the global.
+ */
+async function fetchWithTimeout(fetchImpl, url, init) {
+    const { timeoutMs, ...rest } = init;
+    const ctl = new AbortController();
+    const handle = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { ...rest, signal: ctl.signal });
+    }
+    finally {
+        clearTimeout(handle);
+    }
+}
+/**
+ * Anthropic probe entry point.
+ *
+ * Signature is loose so the legacy `(apiKey) => Promise<TestResult>`
+ * call sites in `registry.ts` and the `/api/secrets/:key/test`
+ * dispatcher keep working. When the API layer has a configured
+ * `model.id` it forwards it via `ctx.model_id`; otherwise stage 4
+ * runs without a needle and reports `model_in_list: undefined`.
+ *
+ * The injected `fetchImpl` lets unit tests swap in a mock without
+ * patching the global. Default = the platform `fetch`.
+ */
+export async function probeAnthropic(apiKey, ctx, fetchImpl = fetch) {
+    const started = Date.now();
+    const stages = [];
+    const advisory = {};
+    if (!apiKey || typeof apiKey !== 'string') {
+        return {
+            ok: false,
+            message: 'No API key provided',
+            durationMs: Date.now() - started,
+            stages: [{ name: 'auth', ok: false, error_code: 'missing_value', detail: 'No API key provided' }],
+        };
+    }
+    // ── Stage 1: reachable ────────────────────────────────────────────────
+    // Cheap network round-trip to verify DNS + TCP + TLS to the API host.
+    // A 404 here is fine — we just need a response. The intent is to
+    // separate "network broken" from "API key bad" so the UI can show
+    // a useful error.
+    try {
+        await fetchWithTimeout(fetchImpl, `${ANTHROPIC_API_BASE}/`, {
+            method: 'GET',
+            timeoutMs: REACHABLE_TIMEOUT_MS,
+            // The bare hostname returns 404 with a small JSON body — we don't
+            // care about status here, only that we reached the server.
+        });
+        stages.push({ name: 'reachable', ok: true });
+    }
+    catch (err) {
+        stages.push({
+            name: 'reachable',
+            ok: false,
+            error_code: 'network',
+            detail: err instanceof Error && err.name === 'AbortError'
+                ? 'Timed out connecting to api.anthropic.com'
+                : 'Could not reach api.anthropic.com',
+        });
+        return {
+            ok: false,
+            message: 'Network unreachable',
+            durationMs: Date.now() - started,
+            stages,
+        };
+    }
+    // ── Stages 2 + 3: auth + listing ─────────────────────────────────────
+    // One request covers both — `GET /v1/models` returns 401/403 on bad
+    // auth and a `{ data: [...] }` envelope on success. We score the
+    // stages separately so the UI can show "auth ok, but listing shape
+    // unexpected" if Anthropic ever changes the response.
+    let listing;
+    try {
+        const resp = await fetchWithTimeout(fetchImpl, `${ANTHROPIC_API_BASE}/v1/models`, {
+            method: 'GET',
+            headers: {
+                'x-api-key': apiKey,
+                'anthropic-version': '2023-06-01',
+            },
+            timeoutMs: AUTH_TIMEOUT_MS,
+        });
+        if (resp.status === 401 || resp.status === 403) {
+            stages.push({
+                name: 'auth',
+                ok: false,
+                error_code: 'unauthorized',
+                detail: 'API key rejected (HTTP ' + resp.status + ')',
+            });
+            return {
+                ok: false,
+                message: 'API key rejected',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        if (resp.status >= 500) {
+            stages.push({
+                name: 'auth',
+                ok: false,
+                error_code: 'upstream_5xx',
+                detail: 'Anthropic returned HTTP ' + resp.status,
+            });
+            return {
+                ok: false,
+                message: 'Upstream error',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        if (resp.status < 200 || resp.status >= 300) {
+            stages.push({
+                name: 'auth',
+                ok: false,
+                error_code: 'unexpected_status',
+                detail: 'Unexpected HTTP ' + resp.status,
+            });
+            return {
+                ok: false,
+                message: 'Unexpected status',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        stages.push({ name: 'auth', ok: true });
+        // Listing — parse the JSON. A network success with a malformed body
+        // gets its own error_code so the UI can distinguish from outright
+        // auth failure.
+        try {
+            listing = await resp.json();
+        }
+        catch {
+            stages.push({
+                name: 'listing',
+                ok: false,
+                error_code: 'invalid_json',
+                detail: 'Could not parse /v1/models response',
+            });
+            return {
+                ok: false,
+                message: 'Invalid response shape',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        if (!listing || !Array.isArray(listing.data)) {
+            stages.push({
+                name: 'listing',
+                ok: false,
+                error_code: 'invalid_shape',
+                detail: 'Listing response missing `data` array',
+            });
+            return {
+                ok: false,
+                message: 'Invalid response shape',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        stages.push({ name: 'listing', ok: true });
+    }
+    catch (err) {
+        stages.push({
+            name: 'auth',
+            ok: false,
+            error_code: 'network',
+            detail: err instanceof Error && err.name === 'AbortError'
+                ? 'Timed out fetching /v1/models'
+                : 'Network error fetching /v1/models',
+        });
+        return {
+            ok: false,
+            message: 'Network error',
+            durationMs: Date.now() - started,
+            stages,
+        };
+    }
+    // ── Stage 4: model_in_list (ADVISORY) ────────────────────────────────
+    // Only runs when the API caller forwarded a configured model.id.
+    // The stage's ok flag is reported per-stage but does NOT flip the
+    // overall ok: preview / unlisted models are intentionally allowed.
+    const ids = (listing.data ?? [])
+        .map((m) => (m && typeof m.id === 'string') ? m.id : undefined)
+        .filter((s) => !!s);
+    if (ctx?.model_id) {
+        const present = ids.includes(ctx.model_id);
+        if (present) {
+            stages.push({ name: 'model_in_list', ok: true });
+            advisory.model_in_list = true;
+        }
+        else {
+            const suggestions = suggestModelIds(ctx.model_id, ids, 3);
+            stages.push({
+                name: 'model_in_list',
+                ok: false,
+                error_code: 'not_listed',
+                detail: 'Configured model.id not found in /v1/models (advisory — preview models are allowed)',
+            });
+            advisory.model_in_list = false;
+            if (suggestions.length > 0)
+                advisory.suggestions = suggestions;
+        }
+    }
+    // Overall ok = every non-advisory stage passed. By construction we
+    // returned early on any non-advisory failure, so reaching here means
+    // reachable + auth + listing are all green.
+    return {
+        ok: true,
+        message: ctx?.model_id && advisory.model_in_list === false
+            ? 'Key valid; configured model.id not in listing (advisory)'
+            : 'Key valid',
+        durationMs: Date.now() - started,
+        stages,
+        advisory: Object.keys(advisory).length > 0 ? advisory : undefined,
+    };
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/core/secrets/probes/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+DH,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;GAKG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAA2B,EAAE,KAAK,GAAG,CAAC;IACpF,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAqC,EAAE,CAAC;IAClD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,KAAK,MAAM;YAAE,SAAS;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,SAAuB,EACvB,GAAW,EACX,IAAyC;IAEzC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,GAAkB,EAClB,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;SAClG,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,iEAAiE;IACjE,kEAAkE;IAClE,kBAAkB;IAClB,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,kBAAkB,GAAG,EAAE;YAC1D,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,oBAAoB;YAC/B,kEAAkE;YAClE,2DAA2D;SACrB,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,WAAW;YACjB,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;gBACvD,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,mCAAmC;SACxC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,MAAM;SACP,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,sDAAsD;IACtD,IAAI,OAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,kBAAkB,YAAY,EAAE;YAChF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,mBAAmB,EAAE,YAAY;aAClC;YACD,SAAS,EAAE,eAAe;SACY,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG;aACtD,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAAC,MAAM;aACjD,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,gBAAgB;gBACzB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC,MAAM;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,mBAAmB;gBAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,oEAAoE;QACpE,kEAAkE;QAClE,gBAAgB;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAuC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,wBAAwB;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,uCAAuC;aAChD,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,wBAAwB;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;gBACvD,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,mCAAmC;SACxC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,MAAM;SACP,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,qFAAqF;aAC9F,CAAC,CAAC;YACH,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC;YAC/B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACjE,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,4CAA4C;IAC5C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK;YACxD,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,WAAW;QACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QAChC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC"}

package/dist/core/secrets/probes/brave.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Test-connection probe for Brave Search API.
+ *
+ * Stub-quality: structure + return shape only. A production probe would
+ * call https://api.search.brave.com/res/v1/web/search?q=test with the key
+ * and surface 200 vs 401 vs 429.
+ */
+import type { TestResult } from './anthropic.js';
+export declare function probeBrave(apiKey: string): Promise<TestResult>;

package/dist/core/secrets/probes/brave.js

@@ -0,0 +1,15 @@
+/**
+ * Test-connection probe for Brave Search API.
+ *
+ * Stub-quality: structure + return shape only. A production probe would
+ * call https://api.search.brave.com/res/v1/web/search?q=test with the key
+ * and surface 200 vs 401 vs 429.
+ */
+export async function probeBrave(apiKey) {
+    const started = Date.now();
+    if (!apiKey || typeof apiKey !== 'string') {
+        return { ok: false, message: 'No API key provided', durationMs: Date.now() - started };
+    }
+    return { ok: true, message: 'Probe stub — not contacted upstream', durationMs: Date.now() - started };
+}
+//# sourceMappingURL=brave.js.map

package/dist/core/secrets/probes/brave.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brave.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/brave.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AACxG,CAAC"}

package/dist/core/secrets/probes/r2.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Test-connection probe for R2 / S3-compatible storage.
+ *
+ * Stub-quality: structure + return shape only. A production probe would do a
+ * HeadBucket via the AWS SDK and surface 200 vs 403 vs 404. For Phase -1 we
+ * only need the contract.
+ */
+import type { TestResult } from './anthropic.js';
+export interface R2Probe {
+    endpoint: string;
+    bucket: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export declare function probeR2(_value: R2Probe | string): Promise<TestResult>;

package/dist/core/secrets/probes/r2.js

@@ -0,0 +1,14 @@
+/**
+ * Test-connection probe for R2 / S3-compatible storage.
+ *
+ * Stub-quality: structure + return shape only. A production probe would do a
+ * HeadBucket via the AWS SDK and surface 200 vs 403 vs 404. For Phase -1 we
+ * only need the contract.
+ */
+export async function probeR2(_value) {
+    const started = Date.now();
+    // Stub: would HeadBucket and inspect status. Returning ok-by-shape avoids
+    // accidentally hitting real R2 buckets in tests.
+    return { ok: true, message: 'Probe stub — not contacted upstream', durationMs: Date.now() - started };
+}
+//# sourceMappingURL=r2.js.map

package/dist/core/secrets/probes/r2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/r2.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAwB;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,iDAAiD;IACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AACxG,CAAC"}

package/dist/core/secrets/probes/voyage.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Test-connection probe for Voyage AI embeddings API.
+ *
+ * Makes a small real embedding call against
+ *   POST https://api.voyageai.com/v1/embeddings
+ * with the configured model (voyage-3) and a fixed test input. Returns
+ * `ok: true` on HTTP 200, `ok: false` on auth / network / other errors.
+ *
+ * The probe never echoes the upstream error body — only a generic
+ * canned phrase and the HTTP status code (no headers, no payload).
+ */
+import type { TestResult } from './anthropic.js';
+export declare function probeVoyage(apiKey: string): Promise<TestResult>;

package/dist/core/secrets/probes/voyage.js

@@ -0,0 +1,52 @@
+/**
+ * Test-connection probe for Voyage AI embeddings API.
+ *
+ * Makes a small real embedding call against
+ *   POST https://api.voyageai.com/v1/embeddings
+ * with the configured model (voyage-3) and a fixed test input. Returns
+ * `ok: true` on HTTP 200, `ok: false` on auth / network / other errors.
+ *
+ * The probe never echoes the upstream error body — only a generic
+ * canned phrase and the HTTP status code (no headers, no payload).
+ */
+const VOYAGE_URL = 'https://api.voyageai.com/v1/embeddings';
+const VOYAGE_MODEL = 'voyage-3';
+const PROBE_INPUT = 'studiograph probe';
+export async function probeVoyage(apiKey) {
+    const started = Date.now();
+    if (!apiKey || typeof apiKey !== 'string' || apiKey.length === 0) {
+        return { ok: false, message: 'No API key provided', durationMs: Date.now() - started };
+    }
+    try {
+        const res = await fetch(VOYAGE_URL, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ input: PROBE_INPUT, model: VOYAGE_MODEL }),
+        });
+        const durationMs = Date.now() - started;
+        if (res.ok) {
+            return { ok: true, durationMs };
+        }
+        if (res.status === 401 || res.status === 403) {
+            return { ok: false, message: 'API key rejected', durationMs };
+        }
+        if (res.status === 429) {
+            return { ok: false, message: 'Rate limited (try again shortly)', durationMs };
+        }
+        if (res.status >= 500) {
+            return { ok: false, message: `Upstream ${res.status}`, durationMs };
+        }
+        return { ok: false, message: `HTTP ${res.status}`, durationMs };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            message: err instanceof Error && err.message ? err.message.slice(0, 100) : 'Network error',
+            durationMs: Date.now() - started,
+        };
+    }
+}
+//# sourceMappingURL=voyage.js.map

package/dist/core/secrets/probes/voyage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voyage.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/voyage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAC5D,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACzF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,MAAM,EAAE;gBACnC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;SAClE,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACxC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAClC,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe;YAC1F,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SACjC,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/secrets/read-flip.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Read-flip helpers — Phase 6 of the secrets refactor.
+ *
+ * Call sites that historically read directly from `~/.studiograph/user.json`
+ * / `workspace.json` / `process.env.*` route through this module so the
+ * flip is uniform across the codebase.
+ *
+ * Contract: every helper here returns `undefined` when the resolver
+ * returns `unset` (or when the store hasn't been initialized yet —
+ * very early boot or test harness without a store). Callers MUST fall
+ * back to their pre-existing legacy read in that case. This is the
+ * transitional safety net documented in the plan: if the importer
+ * hasn't run yet (boot race, mis-provisioned redeploy), the resolver
+ * sees empty slots and we don't want to regress to "no value at all".
+ *
+ * When the resolver returns a value, callers MUST use it and skip the
+ * legacy read. The store is the source of truth in production.
+ *
+ * Why a thin wrapper rather than inlining `getSettingsResolver()?.resolve()`
+ * at every call site:
+ *   1. Single place to handle the "store not yet initialized" guard.
+ *   2. Single place to flip the implementation again in Phase 9 (when
+ *      legacy fallbacks are removed).
+ *   3. Concise call sites: `tryResolve('model.anthropic.api_key')` is
+ *      shorter than the resolver dance.
+ *
+ * Historical note: the `STUDIOGRAPH_NEW_STORE` env flag previously
+ * gated these helpers (returned undefined when off). The flag was
+ * removed once Phase 6 was proven stable in production — the store is
+ * now unconditional. The env var can still be set on Railway services
+ * for backwards-compat; it is silently ignored.
+ */
+import type { ResolverContext } from './SettingsResolver.js';
+/**
+ * Try to resolve a value through the new store. Returns `undefined`
+ * when the flag is off OR the resolver returns unset. Callers handle
+ * `undefined` by falling back to their legacy reader.
+ *
+ * For non-secret values, this hits the `settings` table directly via
+ * the resolver's read path. The value type is whatever was JSON-stored,
+ * cast to T at the boundary.
+ *
+ * For secret values, this calls `unsafeGetForResolver` through the
+ * resolver — same access pattern as the legacy reader, except the
+ * value lands from an encrypted SQLite row rather than a 0o600 JSON
+ * file. The "unsafe" prefix on the underlying call is a marker for
+ * "value crosses the resolver boundary" — UI/API callers must use
+ * `describe()` instead and never touch this helper.
+ */
+export declare function tryResolve<T = string>(key: string, ctx?: ResolverContext): T | undefined;
+/**
+ * Same shape but also returns the resolution source. Useful for
+ * surfaces that want to show a "shadowed by environment" banner in
+ * the UI without re-doing the lookup.
+ */
+export declare function tryResolveWithSource<T = string>(key: string, ctx?: ResolverContext): {
+    value: T | undefined;
+    source: 'env' | 'store' | 'default' | 'unset';
+} | undefined;