@actuate-media/cms-core 0.42.0 → 0.43.0

package/dist/ai/providers/anthropic.js

@@ -0,0 +1,36 @@
+/**
+ * Anthropic adapter. Uses the `/v1/models` listing endpoint with `x-api-key`
+ * and the required `anthropic-version` header. Hostname is fixed.
+ */
+import { extractModelIds, messageFromStatus, statusFromHttp, timedFetch, } from './http.js';
+const ANTHROPIC_BASE = 'https://api.anthropic.com/v1';
+const ANTHROPIC_VERSION = '2023-06-01';
+function headers(ctx) {
+    return { 'x-api-key': ctx.apiKey, 'anthropic-version': ANTHROPIC_VERSION };
+}
+export async function testConnection(ctx) {
+    const testedAt = new Date().toISOString();
+    if (!ctx.apiKey) {
+        return { ok: false, status: 'needs_setup', message: messageFromStatus('needs_setup'), testedAt };
+    }
+    try {
+        const res = await timedFetch(`${ANTHROPIC_BASE}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+        const status = statusFromHttp(res.status);
+        return { ok: status === 'connected', status, message: messageFromStatus(status), testedAt };
+    }
+    catch {
+        return {
+            ok: false,
+            status: 'provider_down',
+            message: messageFromStatus('provider_down'),
+            testedAt,
+        };
+    }
+}
+export async function listModels(ctx) {
+    const res = await timedFetch(`${ANTHROPIC_BASE}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+    if (!res.ok)
+        throw new Error(`Anthropic model listing failed (${res.status})`);
+    return extractModelIds(await res.json());
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/ai/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/ai/providers/anthropic.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,GACX,MAAM,WAAW,CAAA;AAElB,MAAM,cAAc,GAAG,8BAA8B,CAAA;AACrD,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAEtC,SAAS,OAAO,CAAC,GAAmB;IAClC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAA;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAmB;IACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAA;IAClG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,cAAc,SAAS,EAC1B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;YAC3C,QAAQ;SACT,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,cAAc,SAAS,EAC1B,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC9E,OAAO,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/ai/providers/custom.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Custom OpenAI-compatible provider adapter. The base URL is admin-controlled,
+ * so it is SSRF-validated and DNS-resolved before any request. Falls back to an
+ * empty model list (manual entry in the UI) when the endpoint doesn't support
+ * `/models`.
+ */
+import type { AIConnectionTestResult } from '../types.js';
+import { type AdapterContext } from './http.js';
+export declare function testConnection(ctx: AdapterContext): Promise<AIConnectionTestResult>;
+export declare function listModels(ctx: AdapterContext): Promise<string[]>;
+//# sourceMappingURL=custom.d.ts.map

package/dist/ai/providers/custom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.d.ts","sourceRoot":"","sources":["../../../src/ai/providers/custom.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,KAAK,cAAc,EAOpB,MAAM,WAAW,CAAA;AAMlB,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAiDzF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWvE"}

package/dist/ai/providers/custom.js

@@ -0,0 +1,70 @@
+/**
+ * Custom OpenAI-compatible provider adapter. The base URL is admin-controlled,
+ * so it is SSRF-validated and DNS-resolved before any request. Falls back to an
+ * empty model list (manual entry in the UI) when the endpoint doesn't support
+ * `/models`.
+ */
+import { assertSafeBaseUrl, extractModelIds, messageFromStatus, statusFromHttp, timedFetch, trimTrailingSlash, } from './http.js';
+function headers(ctx) {
+    return { authorization: `Bearer ${ctx.apiKey}` };
+}
+export async function testConnection(ctx) {
+    const testedAt = new Date().toISOString();
+    if (!ctx.baseUrl) {
+        return {
+            ok: false,
+            status: 'needs_setup',
+            message: 'A base URL is required for a custom provider.',
+            testedAt,
+        };
+    }
+    try {
+        await assertSafeBaseUrl(ctx.baseUrl);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            status: 'unknown',
+            message: err instanceof Error ? err.message : 'Invalid base URL.',
+            testedAt,
+        };
+    }
+    if (!ctx.apiKey) {
+        return { ok: false, status: 'needs_setup', message: messageFromStatus('needs_setup'), testedAt };
+    }
+    try {
+        const res = await timedFetch(`${trimTrailingSlash(ctx.baseUrl)}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+        // A 404 likely means the endpoint doesn't implement /models; the connection
+        // itself may still be usable with a manually-entered model id.
+        if (res.status === 404) {
+            return {
+                ok: true,
+                status: 'connected',
+                message: 'Connected. This endpoint does not list models; enter a model id manually.',
+                testedAt,
+            };
+        }
+        const status = statusFromHttp(res.status);
+        return { ok: status === 'connected', status, message: messageFromStatus(status), testedAt };
+    }
+    catch {
+        return {
+            ok: false,
+            status: 'provider_down',
+            message: messageFromStatus('provider_down'),
+            testedAt,
+        };
+    }
+}
+export async function listModels(ctx) {
+    if (!ctx.baseUrl)
+        return [];
+    await assertSafeBaseUrl(ctx.baseUrl);
+    const res = await timedFetch(`${trimTrailingSlash(ctx.baseUrl)}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+    if (res.status === 404)
+        return [];
+    if (!res.ok)
+        throw new Error(`Custom provider model listing failed (${res.status})`);
+    return extractModelIds(await res.json());
+}
+//# sourceMappingURL=custom.js.map

package/dist/ai/providers/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../src/ai/providers/custom.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAEL,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAElB,SAAS,OAAO,CAAC,GAAmB;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAmB;IACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,+CAA+C;YACxD,QAAQ;SACT,CAAA;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB;YACjE,QAAQ;SACT,CAAA;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAA;IAClG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAC1C,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;QACD,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,2EAA2E;gBACpF,QAAQ;aACT,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;YAC3C,QAAQ;SACT,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB;IAClD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAC3B,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAC1C,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,CAAA;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACpF,OAAO,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/ai/providers/http.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Shared HTTP helpers for AI provider adapters: a timeout-bounded fetch, a
+ * status->AIConnectionStatus mapper, and an SSRF guard for custom base URLs.
+ * Built-in providers use fixed hostnames; only custom endpoints are
+ * admin-controlled and therefore validated/resolved.
+ */
+import type { AIConnectionStatus } from '../types.js';
+export interface AdapterContext {
+    apiKey: string;
+    baseUrl?: string;
+    organizationId?: string;
+    projectId?: string;
+    /** Injectable fetch for tests; defaults to global `fetch`. */
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/** Map an HTTP response status to a connection-health value. */
+export declare function statusFromHttp(status: number): AIConnectionStatus;
+/** A short, safe message for a status (never contains the key). */
+export declare function messageFromStatus(status: AIConnectionStatus): string;
+export declare function timedFetch(url: string, init: RequestInit, ctx: AdapterContext): Promise<Response>;
+/**
+ * Validate a custom provider base URL against SSRF (no private/internal hosts,
+ * https/http only) AND resolve its DNS to defend against rebinding. Throws on
+ * rejection with a safe message.
+ */
+export declare function assertSafeBaseUrl(baseUrl: string): Promise<void>;
+/** Strip a trailing slash so we can append `/models` etc. cleanly. */
+export declare function trimTrailingSlash(url: string): string;
+/** Best-effort extraction of model ids from an OpenAI-compatible list payload. */
+export declare function extractModelIds(payload: unknown): string[];
+//# sourceMappingURL=http.d.ts.map

package/dist/ai/providers/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/ai/providers/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAMjE;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAepE;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,QAAQ,CAAC,CAYnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAetE;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAS1D"}

package/dist/ai/providers/http.js

@@ -0,0 +1,90 @@
+/**
+ * Shared HTTP helpers for AI provider adapters: a timeout-bounded fetch, a
+ * status->AIConnectionStatus mapper, and an SSRF guard for custom base URLs.
+ * Built-in providers use fixed hostnames; only custom endpoints are
+ * admin-controlled and therefore validated/resolved.
+ */
+import { resolveAndCheck, validateWebhookUrl } from '../../security/webhook.js';
+/** Map an HTTP response status to a connection-health value. */
+export function statusFromHttp(status) {
+    if (status >= 200 && status < 300)
+        return 'connected';
+    if (status === 401 || status === 403)
+        return 'invalid_key';
+    if (status === 429)
+        return 'rate_limited';
+    if (status >= 500)
+        return 'provider_down';
+    return 'unknown';
+}
+/** A short, safe message for a status (never contains the key). */
+export function messageFromStatus(status) {
+    switch (status) {
+        case 'connected':
+            return 'Connection successful.';
+        case 'invalid_key':
+            return 'The API key was rejected (invalid or unauthorized).';
+        case 'rate_limited':
+            return 'The provider rate-limited the request. Try again shortly.';
+        case 'provider_down':
+            return 'The provider returned a server error. It may be temporarily unavailable.';
+        case 'needs_setup':
+            return 'No API key is configured for this provider.';
+        default:
+            return 'Could not determine connection status.';
+    }
+}
+export async function timedFetch(url, init, ctx) {
+    const doFetch = ctx.fetchImpl ?? globalThis.fetch;
+    if (typeof doFetch !== 'function') {
+        throw new Error('fetch is not available in this runtime');
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), ctx.timeoutMs ?? 10_000);
+    try {
+        return await doFetch(url, { ...init, redirect: 'error', signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Validate a custom provider base URL against SSRF (no private/internal hosts,
+ * https/http only) AND resolve its DNS to defend against rebinding. Throws on
+ * rejection with a safe message.
+ */
+export async function assertSafeBaseUrl(baseUrl) {
+    const check = validateWebhookUrl(baseUrl);
+    if (!check.valid) {
+        throw new Error(`Unsafe base URL: ${check.error ?? 'invalid'}`);
+    }
+    let host;
+    try {
+        host = new URL(baseUrl).hostname;
+    }
+    catch {
+        throw new Error('Unsafe base URL: invalid URL');
+    }
+    const resolved = await resolveAndCheck(host);
+    if (!resolved.safe) {
+        throw new Error(`Unsafe base URL: ${resolved.error ?? 'resolves to a private address'}`);
+    }
+}
+/** Strip a trailing slash so we can append `/models` etc. cleanly. */
+export function trimTrailingSlash(url) {
+    return url.replace(/\/+$/, '');
+}
+/** Best-effort extraction of model ids from an OpenAI-compatible list payload. */
+export function extractModelIds(payload) {
+    const data = payload?.data;
+    if (!Array.isArray(data))
+        return [];
+    const ids = [];
+    for (const entry of data) {
+        const id = entry?.id;
+        if (typeof id === 'string' && id.trim())
+            ids.push(id.trim());
+    }
+    return ids;
+}
+//# sourceMappingURL=http.js.map

package/dist/ai/providers/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/ai/providers/http.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAa/E,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,WAAW,CAAA;IACrD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAA;IAC1D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAA;IACzC,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,eAAe,CAAA;IACzC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,wBAAwB,CAAA;QACjC,KAAK,aAAa;YAChB,OAAO,qDAAqD,CAAA;QAC9D,KAAK,cAAc;YACjB,OAAO,2DAA2D,CAAA;QACpE,KAAK,eAAe;YAClB,OAAO,0EAA0E,CAAA;QACnF,KAAK,aAAa;YAChB,OAAO,6CAA6C,CAAA;QACtD;YACE,OAAO,wCAAwC,CAAA;IACnD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,IAAiB,EACjB,GAAmB;IAEnB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAA;IACjD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,CAAA;IAC3E,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IACtF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,KAAK,IAAI,+BAA+B,EAAE,CAAC,CAAA;IAC1F,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAChC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,MAAM,IAAI,GAAI,OAA8B,EAAE,IAAI,CAAA;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAI,KAA0B,EAAE,EAAE,CAAA;QAC1C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/ai/providers/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Provider adapter dispatcher. Selects the right adapter by provider key and
+ * exposes a uniform `testConnection` / `listModels` surface to the catalog and
+ * route layers.
+ */
+import type { AIConnectionTestResult, AIProviderKey } from '../types.js';
+import type { AdapterContext } from './http.js';
+export type { AdapterContext } from './http.js';
+interface ProviderAdapter {
+    testConnection(ctx: AdapterContext): Promise<AIConnectionTestResult>;
+    listModels(ctx: AdapterContext): Promise<string[]>;
+}
+export declare function getAdapter(provider: AIProviderKey): ProviderAdapter;
+export declare function testConnection(provider: AIProviderKey, ctx: AdapterContext): Promise<AIConnectionTestResult>;
+export declare function listModels(provider: AIProviderKey, ctx: AdapterContext): Promise<string[]>;
+//# sourceMappingURL=index.d.ts.map

package/dist/ai/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai/providers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAGxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAI/C,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAE/C,UAAU,eAAe;IACvB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACpE,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;CACnD;AASD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,GAAG,eAAe,CAEnE;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EACvB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAE1F"}

package/dist/ai/providers/index.js

@@ -0,0 +1,25 @@
+/**
+ * Provider adapter dispatcher. Selects the right adapter by provider key and
+ * exposes a uniform `testConnection` / `listModels` surface to the catalog and
+ * route layers.
+ */
+import * as anthropic from './anthropic.js';
+import * as custom from './custom.js';
+import * as openai from './openai.js';
+import * as xai from './xai.js';
+const ADAPTERS = {
+    openai,
+    anthropic,
+    xai,
+    custom,
+};
+export function getAdapter(provider) {
+    return ADAPTERS[provider] ?? custom;
+}
+export function testConnection(provider, ctx) {
+    return getAdapter(provider).testConnection(ctx);
+}
+export function listModels(provider, ctx) {
+    return getAdapter(provider).listModels(ctx);
+}
+//# sourceMappingURL=index.js.map

package/dist/ai/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai/providers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAS/B,MAAM,QAAQ,GAA2C;IACvD,MAAM;IACN,SAAS;IACT,GAAG;IACH,MAAM;CACP,CAAA;AAED,MAAM,UAAU,UAAU,CAAC,QAAuB;IAChD,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAA;AACrC,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,QAAuB,EACvB,GAAmB;IAEnB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAuB,EAAE,GAAmB;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC"}

package/dist/ai/providers/openai.d.ts

@@ -0,0 +1,10 @@
+/**
+ * OpenAI (and OpenAI-compatible) adapter. Uses the `/v1/models` listing
+ * endpoint with Bearer auth. Hostname is fixed (api.openai.com) so no SSRF
+ * validation is needed here.
+ */
+import type { AIConnectionTestResult } from '../types.js';
+import { type AdapterContext } from './http.js';
+export declare function testConnection(ctx: AdapterContext): Promise<AIConnectionTestResult>;
+export declare function listModels(ctx: AdapterContext): Promise<string[]>;
+//# sourceMappingURL=openai.d.ts.map

package/dist/ai/providers/openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/ai/providers/openai.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,KAAK,cAAc,EAKpB,MAAM,WAAW,CAAA;AAWlB,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqBzF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQvE"}

package/dist/ai/providers/openai.js

@@ -0,0 +1,41 @@
+/**
+ * OpenAI (and OpenAI-compatible) adapter. Uses the `/v1/models` listing
+ * endpoint with Bearer auth. Hostname is fixed (api.openai.com) so no SSRF
+ * validation is needed here.
+ */
+import { extractModelIds, messageFromStatus, statusFromHttp, timedFetch, } from './http.js';
+const OPENAI_BASE = 'https://api.openai.com/v1';
+function headers(ctx) {
+    const h = { authorization: `Bearer ${ctx.apiKey}` };
+    if (ctx.organizationId)
+        h['openai-organization'] = ctx.organizationId;
+    if (ctx.projectId)
+        h['openai-project'] = ctx.projectId;
+    return h;
+}
+export async function testConnection(ctx) {
+    const testedAt = new Date().toISOString();
+    if (!ctx.apiKey) {
+        return { ok: false, status: 'needs_setup', message: messageFromStatus('needs_setup'), testedAt };
+    }
+    try {
+        const res = await timedFetch(`${OPENAI_BASE}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+        const status = statusFromHttp(res.status);
+        return { ok: status === 'connected', status, message: messageFromStatus(status), testedAt };
+    }
+    catch {
+        return {
+            ok: false,
+            status: 'provider_down',
+            message: messageFromStatus('provider_down'),
+            testedAt,
+        };
+    }
+}
+export async function listModels(ctx) {
+    const res = await timedFetch(`${OPENAI_BASE}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+    if (!res.ok)
+        throw new Error(`OpenAI model listing failed (${res.status})`);
+    return extractModelIds(await res.json());
+}
+//# sourceMappingURL=openai.js.map

package/dist/ai/providers/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/ai/providers/openai.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,GACX,MAAM,WAAW,CAAA;AAElB,MAAM,WAAW,GAAG,2BAA2B,CAAA;AAE/C,SAAS,OAAO,CAAC,GAAmB;IAClC,MAAM,CAAC,GAA2B,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;IAC3E,IAAI,GAAG,CAAC,cAAc;QAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,GAAG,CAAC,cAAc,CAAA;IACrE,IAAI,GAAG,CAAC,SAAS;QAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,SAAS,CAAA;IACtD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAmB;IACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAA;IAClG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,WAAW,SAAS,EACvB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;YAC3C,QAAQ;SACT,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,WAAW,SAAS,EACvB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3E,OAAO,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/ai/providers/xai.d.ts

@@ -0,0 +1,9 @@
+/**
+ * xAI (Grok) adapter. xAI's API is OpenAI-compatible: `/v1/models` with Bearer
+ * auth. Hostname is fixed (api.x.ai).
+ */
+import type { AIConnectionTestResult } from '../types.js';
+import { type AdapterContext } from './http.js';
+export declare function testConnection(ctx: AdapterContext): Promise<AIConnectionTestResult>;
+export declare function listModels(ctx: AdapterContext): Promise<string[]>;
+//# sourceMappingURL=xai.d.ts.map

package/dist/ai/providers/xai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.d.ts","sourceRoot":"","sources":["../../../src/ai/providers/xai.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,KAAK,cAAc,EAKpB,MAAM,WAAW,CAAA;AAQlB,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqBzF;AAED,wBAAsB,UAAU,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIvE"}

package/dist/ai/providers/xai.js

@@ -0,0 +1,35 @@
+/**
+ * xAI (Grok) adapter. xAI's API is OpenAI-compatible: `/v1/models` with Bearer
+ * auth. Hostname is fixed (api.x.ai).
+ */
+import { extractModelIds, messageFromStatus, statusFromHttp, timedFetch, } from './http.js';
+const XAI_BASE = 'https://api.x.ai/v1';
+function headers(ctx) {
+    return { authorization: `Bearer ${ctx.apiKey}` };
+}
+export async function testConnection(ctx) {
+    const testedAt = new Date().toISOString();
+    if (!ctx.apiKey) {
+        return { ok: false, status: 'needs_setup', message: messageFromStatus('needs_setup'), testedAt };
+    }
+    try {
+        const res = await timedFetch(`${XAI_BASE}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+        const status = statusFromHttp(res.status);
+        return { ok: status === 'connected', status, message: messageFromStatus(status), testedAt };
+    }
+    catch {
+        return {
+            ok: false,
+            status: 'provider_down',
+            message: messageFromStatus('provider_down'),
+            testedAt,
+        };
+    }
+}
+export async function listModels(ctx) {
+    const res = await timedFetch(`${XAI_BASE}/models`, { method: 'GET', headers: headers(ctx) }, ctx);
+    if (!res.ok)
+        throw new Error(`xAI model listing failed (${res.status})`);
+    return extractModelIds(await res.json());
+}
+//# sourceMappingURL=xai.js.map

package/dist/ai/providers/xai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xai.js","sourceRoot":"","sources":["../../../src/ai/providers/xai.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAEL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,UAAU,GACX,MAAM,WAAW,CAAA;AAElB,MAAM,QAAQ,GAAG,qBAAqB,CAAA;AAEtC,SAAS,OAAO,CAAC,GAAmB;IAClC,OAAO,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAmB;IACtD,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,CAAA;IAClG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,QAAQ,SAAS,EACpB,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EACxC,GAAG,CACJ,CAAA;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,iBAAiB,CAAC,eAAe,CAAC;YAC3C,QAAQ;SACT,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,QAAQ,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACjG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IACxE,OAAO,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC"}

package/dist/ai/types.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Shared types for the Settings > AI governance layer.
+ *
+ * Phases 1-2 cover provider connections (encrypted keys) and a dynamic,
+ * normalized model catalog. Feature config, budget, and data-policy shapes are
+ * declared here for forward-compatibility (enforcement + metering land in later
+ * phases) but only `features[].enabled` and `budget.monthlyTokenLimit` are
+ * wired into the UI for now.
+ */
+/** Provider keys are stable code identifiers. `openai` covers OpenAI/ChatGPT. */
+export type AIProviderKey = 'openai' | 'anthropic' | 'xai' | 'custom';
+/** Where a provider's API key actually comes from at runtime. */
+export type AIKeySource = 'environment' | 'database' | 'config';
+/** Connection health surfaced in the UI (always rendered as text, not color-only). */
+export type AIConnectionStatus = 'connected' | 'invalid_key' | 'rate_limited' | 'provider_down' | 'needs_setup' | 'unknown';
+/** Availability of a catalog model relative to the connected account. */
+export type AIModelStatus = 'available' | 'unavailable' | 'deprecated' | 'unknown';
+export interface AIModelCapabilities {
+    text: boolean;
+    vision: boolean;
+    imageGeneration: boolean;
+    embeddings: boolean;
+    toolCalling: boolean;
+    structuredOutput: boolean;
+    streaming: boolean;
+    reasoning: boolean;
+    longContext: boolean;
+}
+export interface AIModelPricing {
+    inputPerMillion?: number;
+    outputPerMillion?: number;
+    image?: number;
+    search?: number;
+}
+/** Normalized model record (merged from live listing + curated metadata). */
+export interface AIModel {
+    /** Stable internal id: `${provider}:${providerModelId}`. */
+    id: string;
+    provider: AIProviderKey;
+    providerModelId: string;
+    displayName: string;
+    description?: string;
+    status: AIModelStatus;
+    capabilities: AIModelCapabilities;
+    contextWindow?: number;
+    maxOutputTokens?: number;
+    inputModalities: string[];
+    outputModalities: string[];
+    pricing?: AIModelPricing;
+    aliases?: string[];
+    lastSyncedAt: string;
+    source: 'provider' | 'manual' | 'config';
+    metadata: Record<string, unknown>;
+}
+/**
+ * Stored provider connection. The encrypted key NEVER leaves the server — API
+ * responses use {@link AIProviderConnectionPublic}.
+ */
+export interface AIProviderConnection {
+    id: string;
+    provider: AIProviderKey;
+    displayName: string;
+    enabled: boolean;
+    status: AIConnectionStatus;
+    /** Encrypted via `encryptSecret`. Absent when the key is env-managed. */
+    apiKeyEncrypted?: string;
+    apiKeyLast4?: string;
+    baseUrl?: string;
+    organizationId?: string;
+    projectId?: string;
+    lastTestedAt?: string;
+    lastSuccessfulRunAt?: string;
+    lastModelSyncAt?: string;
+    createdAt: string;
+    updatedAt: string;
+    updatedBy: string;
+}
+/** Client-safe provider view: no key material, source resolved dynamically. */
+export type AIProviderConnectionPublic = Omit<AIProviderConnection, 'apiKeyEncrypted'> & {
+    apiKeySource: AIKeySource;
+    /** True when the key is env-managed and therefore not editable in the UI. */
+    keyManagedExternally: boolean;
+    hasKey: boolean;
+};
+export type AIFeatureCategory = 'seo' | 'media' | 'content' | 'forms' | 'security' | 'developer' | 'search';
+export interface AIFeatureConfig {
+    key: string;
+    label: string;
+    description: string;
+    enabled: boolean;
+    category: AIFeatureCategory;
+    requiredCapabilities: string[];
+    providerId?: string;
+    modelId?: string;
+    fallbackModelIds?: string[];
+    approvalRequired: boolean;
+    allowBulkApply: boolean;
+    maxMonthlyTokens?: number;
+    maxRequestsPerDay?: number;
+    rolesAllowed: string[];
+    permissionsRequired: string[];
+    dataPolicyKey?: string;
+}
+export interface AIBudgetSettings {
+    monthlyTokenLimit?: number;
+    monthlyCostLimit?: number;
+    alertAtPercentages: number[];
+    disableWhenExceeded: boolean;
+    perFeatureLimits?: Record<string, number>;
+    perUserLimits?: Record<string, number>;
+}
+export interface AISettings {
+    defaultProviderId?: string;
+    defaultModelId?: string;
+    defaultTextModelId?: string;
+    defaultReasoningModelId?: string;
+    defaultVisionModelId?: string;
+    defaultEmbeddingModelId?: string;
+    defaultImageGenerationModelId?: string;
+    features: AIFeatureConfig[];
+    budget: AIBudgetSettings;
+    logsRetentionDays: number;
+}
+/**
+ * Cached, normalized model catalog keyed by provider connection id. Persisted in
+ * the `__ai_config__` document so the model selector renders without a live call.
+ */
+export interface AICatalogEntry {
+    models: AIModel[];
+    lastSyncedAt: string;
+    /** True when the entry came from the curated fallback (no live listing). */
+    fromFallback: boolean;
+}
+/** Shape of the `data` blob on the `__ai_config__` Document. */
+export interface AIConfigDocument {
+    providers: AIProviderConnection[];
+    settings: AISettings;
+    catalog?: Record<string, AICatalogEntry>;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+/** Monthly usage summary for the budget meter (real counts; 0 until Phase 4). */
+export interface AIUsageSummary {
+    totalTokens: number;
+    promptTokens: number;
+    completionTokens: number;
+    estimatedCost?: number;
+    monthlyTokenLimit?: number;
+    periodStart: string;
+    periodEnd: string;
+    runCount: number;
+}
+/** Result of an adapter connection test. */
+export interface AIConnectionTestResult {
+    ok: boolean;
+    status: AIConnectionStatus;
+    /** Human-readable detail (safe to show; never contains the key). */
+    message: string;
+    testedAt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/ai/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ai/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAA;AAErE,iEAAiE;AACjE,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,UAAU,GAAG,QAAQ,CAAA;AAE/D,sFAAsF;AACtF,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,aAAa,GACb,cAAc,GACd,eAAe,GACf,aAAa,GACb,SAAS,CAAA;AAEb,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG,SAAS,CAAA;AAElF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE,OAAO,CAAA;IACf,eAAe,EAAE,OAAO,CAAA;IACxB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,gBAAgB,EAAE,OAAO,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,aAAa,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,aAAa,CAAA;IACrB,YAAY,EAAE,mBAAmB,CAAA;IACjC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,aAAa,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,kBAAkB,CAAA;IAC1B,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,+EAA+E;AAC/E,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,GAAG;IACvF,YAAY,EAAE,WAAW,CAAA;IACzB,6EAA6E;IAC7E,oBAAoB,EAAE,OAAO,CAAA;IAC7B,MAAM,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,iBAAiB,GACzB,KAAK,GACL,OAAO,GACP,SAAS,GACT,OAAO,GACP,UAAU,GACV,WAAW,GACX,QAAQ,CAAA;AAEZ,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,gBAAgB,EAAE,OAAO,CAAA;IACzB,cAAc,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAA;IAC5B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,MAAM,EAAE,gBAAgB,CAAA;IACxB,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,oBAAoB,EAAE,CAAA;IACjC,QAAQ,EAAE,UAAU,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,kBAAkB,CAAA;IAC1B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB"}

package/dist/ai/types.js

@@ -0,0 +1,11 @@
+/**
+ * Shared types for the Settings > AI governance layer.
+ *
+ * Phases 1-2 cover provider connections (encrypted keys) and a dynamic,
+ * normalized model catalog. Feature config, budget, and data-policy shapes are
+ * declared here for forward-compatibility (enforcement + metering land in later
+ * phases) but only `features[].enabled` and `budget.monthlyTokenLimit` are
+ * wired into the UI for now.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/ai/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ai/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/ai/usage.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AI usage aggregation.
+ *
+ * Until the dedicated per-run metering table lands (Phase 4), usage is derived
+ * from token totals already recorded in `actuate_audit_logs` (`details
+ * .totalTokensUsed` / `details.tokensUsed`). This returns REAL counts — it is 0
+ * when nothing has run, never a fabricated number.
+ */
+import type { AIUsageSummary } from './types.js';
+/**
+ * Sum token usage from audit-log entries within the period. Recognizes the
+ * fields current AI handlers write today and is tolerant of missing data.
+ */
+export declare function getUsageSummary(db: unknown, period?: {
+    start?: Date;
+    end?: Date;
+}): Promise<AIUsageSummary>;
+//# sourceMappingURL=usage.d.ts.map