@alashi/cli 0.10.0 → 0.12.0

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { AIProvider, AppContext, AppDefinition, AppManifest, AppSdkError, ConfigObject } from "@alashi/apps-sdk";
-import { Hono } from "hono";
+import { AIProvider, AppContext, AppDefinition, AppManifest, AppSdkError, ConfigObject, ModelTokenUsage } from "@alashi/apps-sdk";
+import { Context, Hono, MiddlewareHandler } from "hono";
 //#region src/sources.d.ts
 type AppSourceSpec = {
   type: "git";
@@ -33,11 +33,43 @@ interface AppBudget {
    */
   dailyUsd: number;
 }
+/**
+ * How the host decides whether a request must be authenticated.
+ *
+ * - `auto` (default): requests that verifiably come from the local console
+ *   (loopback peer, local Host header, no forwarding headers) are trusted as
+ *   the owner; everything else must present a credential. Note the limit: a
+ *   proxy that strips its forwarding headers and rewrites Host is
+ *   indistinguishable from a local request — anyone deliberately exposing the
+ *   host through a tunnel should set `required`.
+ * - `required`: every request needs a credential, even on localhost.
+ * - `off`: no authentication at all (current behavior; loopback binds only).
+ */
+type AuthMode = "auto" | "required" | "off";
+/** Host auth settings (`config.auth`) — a host concern, never app config. */
+interface AuthConfig {
+  mode?: AuthMode;
+  /**
+   * App names whose UI and API (`/app/<name>/*`) need no identity. A grant,
+   * so it lives here where only the host's owner can set it — an app manifest
+   * can never declare itself public.
+   */
+  public?: string[];
+  /**
+   * Trust `Tailscale-User-*` identity headers (set by `tailscale serve`) as a
+   * signed-in user. Only enable when the host is reachable exclusively
+   * through Tailscale — the headers are plain text to anyone who can connect
+   * directly.
+   */
+  trustTailscaleHeaders?: boolean;
+}
 interface GlobalConfig {
   registries: RegistryRef[];
   port?: number;
   /** Bind address for `alashi serve`; defaults to loopback (the dashboard has no auth). */
   host?: string;
+  /** Host authentication; absent means `mode: "auto"` with no public apps. */
+  auth?: AuthConfig;
   /** Per-app global overrides, keyed by app name (middle config layer). */
   apps?: Record<string, ConfigObject>;
   /**
@@ -74,18 +106,64 @@ interface JobState {
   lastRun: Record<string, string>;
   runs: JobRun[];
 }
+/** Tokens and cost one model consumed within a usage bucket (a day or a month). */
+interface ModelUsageTotals {
+  inputTokens: number;
+  outputTokens: number;
+  cacheReadInputTokens: number;
+  cacheCreationInputTokens: number;
+  costUsd: number;
+}
 /** One UTC day of AI spend for an app. */
 interface UsageDay {
   /** UTC calendar day, `YYYY-MM-DD`. */
   date: string;
   /** Sum of the `costUsd` the provider reported for that day's turns. */
   costUsd: number;
-  /** Turns that reported a cost (turns without one are not counted). */
+  /** Turns that reported cost or token usage (turns without either are not counted). */
+  turns: number;
+  /** Per-model token/cost totals, keyed by the engine's model id. Absent for days recorded before token metering. */
+  models?: Record<string, ModelUsageTotals>;
+}
+/** One UTC calendar month of AI spend; months are never pruned. */
+interface UsageMonth {
+  /** UTC calendar month, `YYYY-MM`. */
+  month: string;
+  costUsd: number;
   turns: number;
+  models?: Record<string, ModelUsageTotals>;
 }
-/** Host-side AI spend for an app, oldest day first, trimmed to the retention window. */
+/**
+ * Host-side AI spend for an app: daily series (oldest first, trimmed to the
+ * retention window) plus monthly rollups that survive daily pruning so
+ * long-term trends remain visible. `months` is absent only in files written
+ * before rollups existed; the recorder backfills it from `days` on first touch.
+ */
 interface UsageState {
   days: UsageDay[];
+  months?: UsageMonth[];
+}
+/** A long-lived bearer credential; only the sha256 of the secret is stored. */
+interface AuthTokenRecord {
+  id: string;
+  label?: string;
+  hash: string;
+  createdAt: string;
+  lastUsedAt?: string;
+}
+/** A browser session; only the sha256 of the cookie value is stored. */
+interface AuthSessionRecord {
+  hash: string;
+  /** Display name for attribution (token label, tailscale login, or "owner"). */
+  name: string;
+  level: "owner" | "user";
+  createdAt: string;
+  expiresAt: string;
+}
+/** Host auth state (`auth.json` at the store root — OS bookkeeping, not app state). */
+interface AuthState {
+  tokens: AuthTokenRecord[];
+  sessions: AuthSessionRecord[];
 }
 interface InstallRecord {
   name: string;
@@ -130,9 +208,123 @@ declare class Store {
   writeJobState(name: string, state: JobState): Promise<void>;
   readUsageState(name: string): Promise<UsageState>;
   writeUsageState(name: string, state: UsageState): Promise<void>;
+  get authStatePath(): string;
+  readAuthState(): Promise<AuthState>;
+  writeAuthState(state: AuthState): Promise<void>;
   listInstalled(): Promise<InstallRecord[]>;
 }
 //#endregion
+//#region src/auth.d.ts
+declare const SESSION_COOKIE = "alashi_session";
+/** Who a request is, once a credential (or the console heuristic) vouched for it. */
+interface Identity {
+  level: "owner" | "user";
+  via: "console" | "boot" | "token" | "session" | "tailscale" | "off";
+  /** Display name for attribution: token label, tailscale login, or "owner". */
+  name: string;
+}
+/** What a route demands. `user` is any signed-in identity; `owner` outranks it. */
+type AccessLevel = "public" | "user" | "owner";
+declare module "hono" {
+  interface ContextVariableMap {
+    identity?: Identity;
+  }
+}
+/**
+ * The console heuristic: is this request verifiably from the local machine?
+ *
+ * Requires all three of: a loopback peer address, a local request hostname,
+ * and no forwarding headers — because tunnels (ngrok, cloudflared, `tailscale
+ * serve`) connect from loopback too, and what gives them away is the forwarded
+ * hostname or the forwarding headers they add. A proxy configured to strip
+ * both is indistinguishable from a local request; `mode: "required"` exists
+ * for anyone deliberately exposing the host.
+ *
+ * `hostname` is the request URL's hostname (which the server derives from the
+ * Host header) rather than the raw header, because in-process requests carry
+ * no Host header at all. `remoteAddress === undefined` means an in-process
+ * request (tests, the host calling itself) — there is no socket, so it is by
+ * definition local.
+ */
+declare function isConsoleRequest(hostname: string, headers: {
+  get(name: string): string | null;
+}, remoteAddress: string | undefined): boolean;
+/**
+ * The access level a path demands. Deny-by-default shape: everything is at
+ * least `user` unless it is explicitly public, and the routes that change
+ * host state or spend-relevant settings (config, budgets, manual job runs)
+ * are `owner`.
+ */
+declare function requiredLevel(path: string, publicApps: readonly string[]): AccessLevel;
+/** Public shape of a token for `alashi token list` — never includes the hash. */
+interface TokenInfo {
+  id: string;
+  label?: string;
+  createdAt: string;
+  lastUsedAt?: string;
+}
+/**
+ * Host authentication: bearer tokens and browser sessions persisted in
+ * `auth.json` (hashes only), plus an in-memory one-time boot login token.
+ * Writes are serialized so concurrent logins cannot lose each other's update.
+ */
+declare class AuthService {
+  private readonly store;
+  private queue;
+  private bootHash;
+  constructor(store: Store);
+  /**
+   * Mints the one-time login secret printed at serve startup. In-memory only
+   * and consumed by the first successful login; restart the host (or mint a
+   * real token) to get another.
+   */
+  issueBootToken(): string;
+  /** Creates a persistent owner bearer token; the secret is only returned here. */
+  mintToken(label?: string): Promise<{
+    id: string;
+    secret: string;
+  }>;
+  listTokens(): Promise<TokenInfo[]>;
+  /** Revokes a token and every session it created is left alone: sessions expire on their own. */
+  revokeToken(id: string): Promise<boolean>;
+  /**
+   * Exchanges a login secret (boot token or minted token) for an identity.
+   * A boot token is consumed by success; minted tokens are reusable.
+   */
+  redeemLoginSecret(secret: string): Promise<Identity | undefined>;
+  /** Resolves `Authorization: Bearer <secret>`; undefined when absent or invalid. */
+  bearerIdentity(authorization: string | undefined): Promise<Identity | undefined>;
+  private tokenIdentity;
+  /** Creates a session for an already-verified identity; returns the cookie value. */
+  createSession(identity: Identity, at?: Date): Promise<string>;
+  /** Resolves a session cookie value; undefined when unknown or expired. */
+  sessionIdentity(value: string | undefined, at?: Date): Promise<Identity | undefined>;
+  /** Deletes the session behind a cookie value (logout). */
+  destroySession(value: string): Promise<void>;
+  /** Read-modify-write of auth.json, serialized, with expired sessions pruned. */
+  private mutate;
+}
+/** How the middleware learns the peer address; injectable for tests. */
+type RemoteAddressResolver = (c: Context) => string | undefined;
+interface AuthMiddlewareOptions {
+  getRemoteAddress?: RemoteAddressResolver;
+}
+/**
+ * The host's front door. Resolves an identity for every request (bearer token,
+ * session cookie, tailscale headers, console heuristic — in that order) and
+ * enforces the path's required level. Auth config is read per request so
+ * settings changes apply without a restart.
+ */
+declare function createAuthMiddleware(store: Store, auth: AuthService, options?: AuthMiddlewareOptions): MiddlewareHandler;
+/**
+ * The auth surface itself (all public in the policy map):
+ *   GET  /login    login form; `?token=` redeems the printed one-time URL
+ *   POST /login    { token } (form-encoded) -> session cookie + redirect /
+ *   GET  /logout   destroys the session, back to /login
+ *   GET  /api/me   the resolved identity, or { identity: null }
+ */
+declare function registerAuthRoutes(app: Hono, auth: AuthService): void;
+//#endregion
 //#region src/usage.d.ts
 /** Days of history kept in usage.json; older days are dropped on write. */
 declare const USAGE_RETENTION_DAYS = 90;
@@ -140,6 +332,12 @@ declare const USAGE_RETENTION_DAYS = 90;
 declare function utcDay(at?: Date): string;
 /** Money for humans: sub-dollar spend needs the extra digits, larger sums don't. */
 declare function formatUsd(value: number): string;
+/** One turn's metering as reported by the engine; either part may be missing. */
+interface TurnUsage {
+  costUsd?: number;
+  /** Per-turn token/cost deltas keyed by model id (provider-neutral). */
+  modelUsage?: Record<string, ModelTokenUsage>;
+}
 /** A summary of an app's recorded spend, as served by GET /api/apps/:name/usage. */
 interface UsageSummary {
   /** The UTC day "today" refers to. */
@@ -148,22 +346,39 @@ interface UsageSummary {
   todayCostUsd: number;
   /** Turns recorded so far today. */
   todayTurns: number;
+  /** Per-model tokens/cost recorded so far today. */
+  todayModels: Record<string, ModelUsageTotals>;
   /** Spend across the whole retention window. */
   totalCostUsd: number;
+  /** Per-model tokens/cost across the whole retention window. */
+  models: Record<string, ModelUsageTotals>;
   /** Days kept in the retention window. */
   retentionDays: number;
+  /**
+   * Whether the host has ever metered a turn for this app (monthly rollups
+   * persist, so this survives the daily retention window). False means "no
+   * data at all" — which is not the same thing as a measured zero, and must
+   * not be rendered as `$0.0000`. The host meters only sessions an app opens
+   * through `ctx.ai`, so an app that tracks its own costs elsewhere can be
+   * unrecorded here while still reporting real spend of its own.
+   */
+  recorded: boolean;
   /** Daily series, oldest first; days with no spend are absent. */
   days: UsageDay[];
+  /** Monthly rollups, oldest first; never pruned, so trends outlive the daily window. */
+  months: UsageMonth[];
 }
 /**
- * Per-app, per-UTC-day AI spend, persisted as OS bookkeeping in the app
- * container (`apps/<name>/usage.json`, next to jobs.json and chat.json).
+ * Per-app AI spend and token usage, persisted as OS bookkeeping in the app
+ * container (`apps/<name>/usage.json`, next to jobs.json and chat.json):
+ * a per-UTC-day series trimmed to the retention window, plus per-month
+ * rollups that are kept forever.
  *
- * Cost arrives from the `result` event's `costUsd`, which the SDK contract
- * marks optional: engines that do not report cost simply contribute nothing.
- * Writes are serialized per app so concurrent turns cannot lose an update,
- * and each app has its own queue so a slow write for one app never delays
- * another.
+ * Cost and per-model tokens arrive from the `result` event, whose fields the
+ * SDK contract marks optional: engines that report neither simply contribute
+ * nothing. Writes are serialized per app so concurrent turns cannot lose an
+ * update, and each app has its own queue so a slow write for one app never
+ * delays another.
  */
 declare class UsageRecorder {
   private readonly store;
@@ -172,16 +387,26 @@ declare class UsageRecorder {
   private readonly queues;
   constructor(store: Store, retentionDays?: number);
   /**
-   * Adds one turn's cost to the app's total for the UTC day of `at`.
-   * A missing, non-finite, or negative `costUsd` is ignored (no turn counted,
-   * no file written) so a provider that omits cost cannot corrupt the totals.
+   * Adds one turn's cost and token usage to the app's totals for the UTC day
+   * and month of `at`. A missing, non-finite, or negative `costUsd` is
+   * ignored; a turn that reports neither valid cost nor any model usage is
+   * not counted and nothing is written, so a provider that omits metering
+   * cannot corrupt the totals.
    */
-  record(appName: string, costUsd: number | undefined, at?: Date): Promise<void>;
-  /** The app's recorded days, oldest first, with expired days filtered out. */
-  read(appName: string, at?: Date): Promise<UsageState>;
-  /** Today's spend plus the daily series, for the dashboard and the usage endpoint. */
+  record(appName: string, turn: TurnUsage, at?: Date): Promise<void>;
+  /** The app's recorded usage, oldest first, with expired days filtered out. */
+  read(appName: string, at?: Date): Promise<Required<UsageState>>;
+  /** Today's spend plus the daily/monthly series, for the dashboard and the usage endpoints. */
   summary(appName: string, at?: Date): Promise<UsageSummary>;
-  /** Drops days outside the retention window and normalizes ordering/values. */
+  private apply;
+  /**
+   * One-time migration for files written before monthly rollups existed:
+   * absent `months` is seeded from the surviving days, so history inside the
+   * retention window is not lost to the rollups. After the first write the
+   * field is always present (possibly empty) and this is a no-op.
+   */
+  private normalize;
+  /** Drops days outside the retention window and normalizes ordering/values. Months are kept forever. */
   private prune;
   private enqueue;
 }
@@ -199,6 +424,12 @@ interface BudgetStatus {
   date: string;
   /** Spend recorded for that day. */
   spentUsd: number;
+  /**
+   * Whether the host has any metered history for this app at all. When false,
+   * `spentUsd` is an absence of data rather than a measured zero, and should be
+   * rendered as such — never as `$0.0000`.
+   */
+  recorded: boolean;
   /** The configured daily cap; absent when the app has none. */
   dailyUsd?: number;
   /** Spend left before sessions are refused; absent when there is no cap. */
@@ -275,13 +506,24 @@ interface InstallOptions {
   /** Expected app name (enforced against the manifest when set). */
   expectName?: string;
 }
+/**
+ * What an install or update produced: the record that was persisted, plus the
+ * manifest warnings from loading the app. Warnings are deliberately *not* part
+ * of {@link InstallRecord} — they describe this host's SDK, not the app, and
+ * go stale the moment the host is upgraded.
+ */
+interface InstallResult {
+  record: InstallRecord;
+  /** Manifest keys this host's SDK ignored; never a reason to fail the command. */
+  warnings: string[];
+}
 /**
  * Install flow: materialize the source into a staging dir, install deps
  * (scripts disabled), import + validate the manifest, and only then move
  * it into apps/<name>/repo. A failed validation never leaves a broken app.
  */
-declare function installApp(store: Store, source: string | AppSourceSpec, options?: InstallOptions): Promise<InstallRecord>;
-declare function updateApp(store: Store, name: string): Promise<InstallRecord>;
+declare function installApp(store: Store, source: string | AppSourceSpec, options?: InstallOptions): Promise<InstallResult>;
+declare function updateApp(store: Store, name: string): Promise<InstallResult>;
 interface RemoveOptions {
   /** Also delete the app's data/ and config (default keeps them). */
   purge?: boolean;
@@ -293,13 +535,28 @@ interface LoadedApp {
   definition: AppDefinition;
   manifest: AppManifest;
   entryPath: string;
+  /**
+   * One human-readable line per manifest key this host's SDK did not
+   * recognize and therefore dropped from {@link LoadedApp.manifest}. Never a
+   * reason to refuse the app: only `sdkVersion` decides version skew.
+   */
+  warnings: string[];
+}
+interface LoadAppOptions {
+  /**
+   * Where manifest warnings go. Defaults to `console.warn`, prefixed with the
+   * app name — `getApp` in server.ts caches loads, so that is once per load,
+   * not once per request. Callers that surface the warnings themselves (the
+   * CLI on install/update) pass their own sink to avoid printing twice.
+   */
+  warn?: (message: string) => void;
 }
 /**
  * Imports an app's entry module and validates its default export.
  * The manifest is always re-validated here — the host never trusts
  * that an app used defineApp().
  */
-declare function loadApp(repoDir: string): Promise<LoadedApp>;
+declare function loadApp(repoDir: string, options?: LoadAppOptions): Promise<LoadedApp>;
 //#endregion
 //#region src/portability.d.ts
 /**
@@ -439,18 +696,43 @@ interface AppServer {
   app: Hono;
   /** Cron scheduler for manifest-declared jobs; call start() to begin firing. */
   scheduler: Scheduler;
+  /** Host auth: the CLI uses it to issue the boot login token and mint bearer tokens. */
+  auth: AuthService;
   /** Stops the scheduler and closes all warm AI sessions. */
   close(): Promise<void>;
 }
+interface ServerOptions {
+  /** Host auth service; created internally when not supplied. */
+  auth?: AuthService;
+  /**
+   * How the auth middleware learns the peer address. Defaults to
+   * @hono/node-server's conninfo; in-process requests (tests) have no socket
+   * and resolve to undefined, which the console heuristic treats as local.
+   */
+  getRemoteAddress?: RemoteAddressResolver;
+}
 /**
- * The host HTTP surface:
+ * The host HTTP surface (all routes sit behind the auth policy middleware —
+ * see auth.ts: public/user/owner levels, config-driven via config.auth):
+ *   GET  /login                 sign-in form; ?token= redeems a printed login URL
+ *   POST /login                 { token } form -> session cookie
+ *   GET  /logout                destroy the session
+ *   GET  /api/me                the request's resolved identity, or null
  *   GET  /                      dashboard of installed apps
  *   GET  /settings/:name        per-app settings page (config form)
- *   GET  /api/apps              installed apps as JSON, each with todayCostUsd
- *                               and its daily spend cap / over-budget state
+ *   GET  /api/apps              installed apps as JSON, each with todayCostUsd,
+ *                               `recorded` (false when the host has never metered
+ *                               the app, so todayCostUsd is an absence rather than
+ *                               a measured zero), and its daily spend cap /
+ *                               over-budget state
+ *   GET  /api/usage             host-wide usage: per-app summaries (cost, turns,
+ *                               per-model tokens, daily series, monthly rollups)
+ *                               plus combined totals across apps
  *   GET  /api/apps/:name/usage  recorded AI spend: today's total, a daily series,
- *                               and the budget status
- *   GET  /api/apps/:name/budget today's spend against the app's daily cap
+ *                               per-model token totals, monthly rollups,
+ *                               `recorded`, and the budget status
+ *   GET  /api/apps/:name/budget today's spend against the app's daily cap,
+ *                               plus `recorded`
  *   PUT  /api/apps/:name/budget { dailyUsd: number | null } -> set or clear the cap
  *                               (a host setting; apps cannot set their own)
  *   POST /api/apps/:name/chat   { message, conversationId? } -> SSE stream of AgentEvents
@@ -476,7 +758,7 @@ interface AppServer {
  *                               otherwise the app's fetch handler (/app/:name stripped),
  *                               otherwise 404
  */
-declare function createServer(store: Store, provider: AIProvider): AppServer;
+declare function createServer(store: Store, provider: AIProvider, options?: ServerOptions): AppServer;
 //#endregion
-export { type AppBudget, type AppServer, type AppSourceSpec, BUDGET_EXCEEDED_CODE, BudgetExceededError, type BudgetStatus, EXPORT_FORMAT_VERSION, type ExportMetadata, type ExportOptions, type ExportResult, type GlobalConfig, type ImportResult, type InstallOptions, type InstallRecord, type LoadedApp, type RegistryApp, type RegistryIndex, type RegistryRef, type RemoveOptions, type ResolvedApp, type SourceArg, Store, USAGE_RETENTION_DAYS, type UsageDay, UsageRecorder, type UsageState, type UsageSummary, addRegistry, appBudget, assertWithinBudget, budgetStatus, budgetStatusFor, buildAppContext, checkSdkCompatibility, createServer, exportApp, fetchSource, formatUsd, importApp, installApp, installDependencies, loadApp, parseSourceArg, readCachedIndex, refreshRegistry, removeApp, removeRegistry, resolveApp, setAppBudget, updateApp, updateSource, utcDay };
+export { type AccessLevel, type AppBudget, type AppServer, type AppSourceSpec, type AuthConfig, type AuthMode, AuthService, type AuthState, BUDGET_EXCEEDED_CODE, BudgetExceededError, type BudgetStatus, EXPORT_FORMAT_VERSION, type ExportMetadata, type ExportOptions, type ExportResult, type GlobalConfig, type Identity, type ImportResult, type InstallOptions, type InstallRecord, type InstallResult, type LoadAppOptions, type LoadedApp, type RegistryApp, type RegistryIndex, type RegistryRef, type RemoveOptions, type ResolvedApp, SESSION_COOKIE, type ServerOptions, type SourceArg, Store, type TokenInfo, USAGE_RETENTION_DAYS, type UsageDay, UsageRecorder, type UsageState, type UsageSummary, addRegistry, appBudget, assertWithinBudget, budgetStatus, budgetStatusFor, buildAppContext, checkSdkCompatibility, createAuthMiddleware, createServer, exportApp, fetchSource, formatUsd, importApp, installApp, installDependencies, isConsoleRequest, loadApp, parseSourceArg, readCachedIndex, refreshRegistry, registerAuthRoutes, removeApp, removeRegistry, requiredLevel, resolveApp, setAppBudget, updateApp, updateSource, utcDay };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sources.ts","../src/store.ts","../src/usage.ts","../src/budget.ts","../src/compat.ts","../src/installer.ts","../src/loader.ts","../src/portability.ts","../src/registry.ts","../src/runtime.ts","../src/scheduler.ts","../src/server.ts"],"mappings":";;;KAQY;EACN;EAAa;EAAa;;EAC1B;EAAe;;;KAGT,YAAY;EAAkB;EAAkB;;iBAE5C,eAAe,cAAc;;iBAwBvB,YAAY,MAAM,eAAe,kBAAkB;;iBAanD,aAAa,MAAM,eAAe,kBAAkB;;;UC9CzD;EACf;EACA;;;UAIe;;;;;EAKf;;UAGe;EACf,YAAY;EACZ;;EAEA;;EAEA,OAAO,eAAe;;;;;;;;;EAStB,UAAU,eAAe;;UAGV;EACf;;EAEA;EACA;EACA;;;UAIe;EACf,eAAe;;UAGA;EACf;EACA;EACA;EACA;EACA;EACA;;;UAIe;EACf,SAAS;EACT,MAAM;;;UAIS;;EAEf;;EAEA;;EAEA;;;UAIe;EACf,MAAM;;UAGS;EACf;EACA;;EAEA;EACA,QAAQ;EACR;EACA;;;;;;;cAwBW;WACF;EAET,YAAY;MAIR;MAIA;MAIA;MAIA;;EAKJ,OAAO;EAOP,WAAW;EAIX,WAAW;EAIX,cAAc;EAId,cAAc;EAId,iBAAiB;EAIjB,gBAAgB;EAIhB,aAAa;EAIb,kBAAkB;EAOlB,oBAA0B,QAAQ;EAIlC,kBAAwB,QAAQ,eAAe;EAI/C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,QAAQ,gBAAgB;EAI7C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,cAAc,QAAQ,eAAe;EAI1D,cAAoB,eAAe,QAAQ;EAK3C,eAAqB,cAAc,OAAO,YAAY;EAItD,aAAmB,eAAe,QAAQ;EAK1C,cAAoB,cAAc,OAAO,WAAW;EAIpD,eAAqB,eAAe,QAAQ;EAK5C,gBAAsB,cAAc,OAAO,aAAa;EAIxD,iBAAuB,QAAQ;;;;;cClOpB;;iBAQG,OAAO,KAAI;;iBASX,UAAU;;UAKT;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,MAAM;;;;;;;;;;;;cAaK;mBAKT;mBACA;;mBAJe;EAEjB,YACE,OAAwB,OACxB;;;;;;EAQF,OAAO,iBAAiB,6BAA6B,KAAI,OAAoB;;EAmB7E,KAAW,iBAAiB,KAAI,OAAoB,QAAQ;;EAK5D,QAAc,iBAAiB,KAAI,OAAoB,QAAQ;;UAevD;UAmBA;;;;;;;;;cCjHG;;UAGI;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;;;;;;;;;;cAYW,4BAA4B;WAC9B,aAAa;WACb;;WAEA;;WAEA;;WAEA;EAET,YAAY,iBAAiB;IAAU;IAAc;IAAkB;;;SAchE,GAAG,eAAe,OAAO;;;;;;;;;;;;;iBAkBlB,UAAU,QAAQ,cAAc;;iBAYhC,gBAAgB,SAAS,cAAc,+BAA+B;;iBAahE,aACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH,QAAQ;;;;;;iBAUW,mBACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH;;;;;;iBAemB,aACpB,OAAO,OACP,cACA,+BACC;;;;;;;iBCrIa,sBAAsB,UAAU,KAAK;;;;iBCkB/B,oBAAoB,cAAc;UAevC;;EAEf;;;;;;;iBAQoB,WACpB,OAAO,OACP,iBAAiB,eACjB,UAAS,iBACR,QAAQ;iBAyEW,UAAU,OAAO,OAAO,eAAe,QAAQ;UAsBpD;;EAEf;;iBAGoB,UACpB,OAAO,OACP,cACA,UAAS,gBACR;;;UCrIc;EACf,YAAY;EACZ,UAAU;EACV;;;;;;;iBAQoB,QAAQ,kBAAkB,QAAQ;;;;;;;;;;;;;;;cCG3C;UAaI;EACf;EACA;EACA,KAAK;;EAEL;;UAGe;;EAEf;;UAGe;EACf;EACA,QAAQ;EACR;EACA;;UAGe;EACf,QAAQ;EACR;EACA;;;;;;iBA8CoB,UACpB,OAAO,OACP,UAAU,YACV,cACA,UAAS,gBACR,QAAQ;;iBAgMW,UACpB,OAAO,OACP,UAAU,YACV,sBACC,QAAQ;;;UC3TM;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf,MAAM;;;;;;;iBAkCc,gBAAgB,OAAO,OAAO,UAAU,cAAc,QAAQ;iBAuB9D,gBACpB,OAAO,OACP,eACC,QAAQ;iBASW,YAAY,OAAO,OAAO,cAAc,cAAc,QAAQ;iBAW9D,eAAe,OAAO,OAAO,eAAe;UAWjD;EACf;EACA,KAAK;;;iBAIe,WAAW,OAAO,OAAO,kBAAkB,QAAQ;;;;;;;;;;;;;;;;;iBCgFnD,gBACpB,OAAO,OACP,UAAU,aACV,UAAU,YACV,QAAQ,gBACP,QAAQ;;;UClMM;EACf,UAAU;EACV,KAAK;EACL,cAAc,gBAAgB,KAAK,eAAe;;UAGnC;EACf;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA,YAAY;;;;;;;;cAiBD;mBAQT;mBACA;UARM;UACA;UACA;;UAEA;EAER,YACE,OAAwB,OACxB,SAA0B,iBAAiB,QAAQ;EAGrD,SAAe;EAuCf;;;;;EAUA,IACE,iBACA,iBACA,UAAS,oBACR,QAAQ;;EAmCX,OAAa,kBAAkB,QAAQ;UA4B/B;;;;UCnFO;;EAEf,KAAK;;EAEL,WAAW;;EAEX,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqCK,aAAa,OAAO,OAAO,UAAU,aAAa"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/sources.ts","../src/store.ts","../src/auth.ts","../src/usage.ts","../src/budget.ts","../src/compat.ts","../src/installer.ts","../src/loader.ts","../src/portability.ts","../src/registry.ts","../src/runtime.ts","../src/scheduler.ts","../src/server.ts"],"mappings":";;;KAQY;EACN;EAAa;EAAa;;EAC1B;EAAe;;;KAGT,YAAY;EAAkB;EAAkB;;iBAE5C,eAAe,cAAc;;iBAwBvB,YAAY,MAAM,eAAe,kBAAkB;;iBAanD,aAAa,MAAM,eAAe,kBAAkB;;;UC9CzD;EACf;EACA;;;UAIe;;;;;EAKf;;;;;;;;;;;;;;KAeU;;UAGK;EACf,OAAO;;;;;;EAMP;;;;;;;EAOA;;UAGe;EACf,YAAY;EACZ;;EAEA;;EAEA,OAAO;;EAEP,OAAO,eAAe;;;;;;;;;EAStB,UAAU,eAAe;;UAGV;EACf;;EAEA;EACA;EACA;;;UAIe;EACf,eAAe;;UAGA;EACf;EACA;EACA;EACA;EACA;EACA;;;UAIe;EACf,SAAS;EACT,MAAM;;;UAIS;EACf;EACA;EACA;EACA;EACA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA,SAAS,eAAe;;;UAIT;;EAEf;EACA;EACA;EACA,SAAS,eAAe;;;;;;;;UAST;EACf,MAAM;EACN,SAAS;;;UAIM;EACf;EACA;EACA;EACA;EACA;;;UAIe;EACf;;EAEA;EACA;EACA;EACA;;;UAIe;EACf,QAAQ;EACR,UAAU;;UAGK;EACf;EACA;;EAEA;EACA,QAAQ;EACR;EACA;;;;;;;cAwBW;WACF;EAET,YAAY;MAIR;MAIA;MAIA;MAIA;;EAKJ,OAAO;EAOP,WAAW;EAIX,WAAW;EAIX,cAAc;EAId,cAAc;EAId,iBAAiB;EAIjB,gBAAgB;EAIhB,aAAa;EAIb,kBAAkB;EAOlB,oBAA0B,QAAQ;EAIlC,kBAAwB,QAAQ,eAAe;EAI/C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,QAAQ,gBAAgB;EAI7C,cAAoB,eAAe,QAAQ;EAI3C,eAAqB,cAAc,QAAQ,eAAe;EAI1D,cAAoB,eAAe,QAAQ;EAK3C,eAAqB,cAAc,OAAO,YAAY;EAItD,aAAmB,eAAe,QAAQ;EAK1C,cAAoB,cAAc,OAAO,WAAW;EAIpD,eAAqB,eAAe,QAAQ;EAQ5C,gBAAsB,cAAc,OAAO,aAAa;MAIpD;EAIJ,iBAAuB,QAAQ;EAK/B,eAAqB,OAAO,YAAY;EAIxC,iBAAuB,QAAQ;;;;cClUpB;;UAMI;EACf;EACA;;EAEA;;;KAIU;;YAGA;IACR,WAAW;;;;;;;;;;;;;;;;;;;iBAmDC,iBACd,kBACA;EAAW,IAAI;GACf;;;;;;;iBAcc,cAAc,cAAc,gCAAgC;;UAoB3D;EACf;EACA;EACA;EACA;;;;;;;cAQW;mBAIC;UAHJ;UACA;EAER,YAAY,OAAwB;;;;;;EAOpC;;EAOA,UAAgB,iBAAiB;IAAU;IAAY;;EAcvD,cAAoB,QAAQ;;EAM5B,YAAkB,aAAa;;;;;EAc/B,kBAAwB,iBAAiB,QAAQ;;EAUjD,eAAqB,oCAAoC,QAAQ;UAOnD;;EAad,cAAoB,UAAU,UAAU,KAAI,OAAoB;;EAgBhE,gBACE,2BACA,KAAI,OACH,QAAQ;;EAUX,eAAqB,gBAAgB;;UAQ7B;;;KAgBE,yBAAyB,GAAG;UAEvB;EACf,mBAAmB;;;;;;;;iBAqBL,qBACd,OAAO,OACP,MAAM,aACN,UAAS,wBACR;;;;;;;;iBAwFa,mBAAmB,KAAK,MAAM,MAAM;;;;cCrXvC;;iBAQG,OAAO,KAAI;;iBAcX,UAAU;;UAKT;EACf;;EAEA,aAAa,eAAe;;;UAIb;;EAEf;;EAEA;;EAEA;;EAEA,aAAa,eAAe;;EAE5B;;EAEA,QAAQ,eAAe;;EAEvB;;;;;;;;;EASA;;EAEA,MAAM;;EAEN,QAAQ;;;;;;;;;;;;;;cA2HG;mBAKT;mBACA;;mBAJe;EAEjB,YACE,OAAwB,OACxB;;;;;;;;EAUF,OAAO,iBAAiB,MAAM,WAAW,KAAI,OAAoB;;EAsCjE,KAAW,iBAAiB,KAAI,OAAoB,QAAQ,SAAS;;EAKrE,QAAc,iBAAiB,KAAI,OAAoB,QAAQ;UAsBvD;;;;;;;UAmBA;;UAmBA;UAwCA;;;;;;;;;cClVG;;UAGI;;EAEf;;EAEA;;;;;;EAMA;;EAEA;;EAEA;;EAEA;;;;;;;;;;;cAYW,4BAA4B;WAC9B,aAAa;WACb;;WAEA;;WAEA;;WAEA;EAET,YAAY,iBAAiB;IAAU;IAAc;IAAkB;;;SAchE,GAAG,eAAe,OAAO;;;;;;;;;;;;;iBAkBlB,UAAU,QAAQ,cAAc;;iBAYhC,gBAAgB,SAAS,cAAc,+BAA+B;;iBAchE,aACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH,QAAQ;;;;;;iBAUW,mBACpB,OAAO,OACP,OAAO,eACP,cACA,KAAI,OACH;;;;;;iBAemB,aACpB,OAAO,OACP,cACA,+BACC;;;;;;;iBC5Ia,sBAAsB,UAAU,KAAK;;;;iBCkB/B,oBAAoB,cAAc;UAevC;;EAEf;;;;;;;;UASe;EACf,QAAQ;;EAER;;;;;;;iBAQoB,WACpB,OAAO,OACP,iBAAiB,eACjB,UAAS,iBACR,QAAQ;iBA0EW,UAAU,OAAO,OAAO,eAAe,QAAQ;UAsBpD;;EAEf;;iBAGoB,UACpB,OAAO,OACP,cACA,UAAS,gBACR;;;UCxIc;EACf,YAAY;EACZ,UAAU;EACV;;;;;;EAMA;;UAGe;;;;;;;EAOf,QAAQ;;;;;;;iBAQY,QAAQ,iBAAiB,UAAS,iBAAsB,QAAQ;;;;;;;;;;;;;;;cCvBzE;UAaI;EACf;EACA;EACA,KAAK;;EAEL;;UAGe;;EAEf;;UAGe;EACf;EACA,QAAQ;EACR;EACA;;UAGe;EACf,QAAQ;EACR;EACA;;;;;;iBA8CoB,UACpB,OAAO,OACP,UAAU,YACV,cACA,UAAS,gBACR,QAAQ;;iBAgMW,UACpB,OAAO,OACP,UAAU,YACV,sBACC,QAAQ;;;UC3TM;EACf;EACA;EACA;EACA;EACA;;UAGe;EACf,MAAM;;;;;;;iBAkCc,gBAAgB,OAAO,OAAO,UAAU,cAAc,QAAQ;iBAuB9D,gBACpB,OAAO,OACP,eACC,QAAQ;iBASW,YAAY,OAAO,OAAO,cAAc,cAAc,QAAQ;iBAW9D,eAAe,OAAO,OAAO,eAAe;UAWjD;EACf;EACA,KAAK;;;iBAIe,WAAW,OAAO,OAAO,kBAAkB,QAAQ;;;;;;;;;;;;;;;;;iBCmFnD,gBACpB,OAAO,OACP,UAAU,aACV,UAAU,YACV,QAAQ,gBACP,QAAQ;;;UCrMM;EACf,UAAU;EACV,KAAK;EACL,cAAc,gBAAgB,KAAK,eAAe;;UAGnC;EACf;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA,YAAY;;;;;;;;cAiBD;mBAQT;mBACA;UARM;UACA;UACA;;UAEA;EAER,YACE,OAAwB,OACxB,SAA0B,iBAAiB,QAAQ;EAGrD,SAAe;EAuCf;;;;;EAUA,IACE,iBACA,iBACA,UAAS,oBACR,QAAQ;;EAmCX,OAAa,kBAAkB,QAAQ;UA4B/B;;;;UCjDO;;EAEf,KAAK;;EAEL,WAAW;;EAEX,MAAM;;EAEN,SAAS;;UAGM;;EAEf,OAAO;;;;;;EAMP,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkDL,aACd,OAAO,OACP,UAAU,YACV,UAAS,gBACR"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { A as UsageRecorder, C as BudgetExceededError, D as budgetStatusFor, E as budgetStatus, M as utcDay, O as setAppBudget, S as BUDGET_EXCEEDED_CODE, T as assertWithinBudget, _ as fetchSource, a as EXPORT_FORMAT_VERSION, b as loadApp, c as installApp, d as updateApp, f as addRegistry, g as resolveApp, h as removeRegistry, j as formatUsd, k as USAGE_RETENTION_DAYS, l as installDependencies, m as refreshRegistry, n as createServer, o as exportApp, p as readCachedIndex, r as buildAppContext, s as importApp, t as Store, u as removeApp, v as parseSourceArg, w as appBudget, x as checkSdkCompatibility, y as updateSource } from "./store-VoJe_U1Q.mjs";
-export { BUDGET_EXCEEDED_CODE, BudgetExceededError, EXPORT_FORMAT_VERSION, Store, USAGE_RETENTION_DAYS, UsageRecorder, addRegistry, appBudget, assertWithinBudget, budgetStatus, budgetStatusFor, buildAppContext, checkSdkCompatibility, createServer, exportApp, fetchSource, formatUsd, importApp, installApp, installDependencies, loadApp, parseSourceArg, readCachedIndex, refreshRegistry, removeApp, removeRegistry, resolveApp, setAppBudget, updateApp, updateSource, utcDay };
+import { A as UsageRecorder, C as BudgetExceededError, D as budgetStatusFor, E as budgetStatus, F as createAuthMiddleware, I as isConsoleRequest, L as registerAuthRoutes, M as utcDay, N as AuthService, O as setAppBudget, P as SESSION_COOKIE, R as requiredLevel, S as BUDGET_EXCEEDED_CODE, T as assertWithinBudget, _ as fetchSource, a as EXPORT_FORMAT_VERSION, b as loadApp, c as installApp, d as updateApp, f as addRegistry, g as resolveApp, h as removeRegistry, j as formatUsd, k as USAGE_RETENTION_DAYS, l as installDependencies, m as refreshRegistry, n as createServer, o as exportApp, p as readCachedIndex, r as buildAppContext, s as importApp, t as Store, u as removeApp, v as parseSourceArg, w as appBudget, x as checkSdkCompatibility, y as updateSource } from "./store-BNZqhcwm.mjs";
+export { AuthService, BUDGET_EXCEEDED_CODE, BudgetExceededError, EXPORT_FORMAT_VERSION, SESSION_COOKIE, Store, USAGE_RETENTION_DAYS, UsageRecorder, addRegistry, appBudget, assertWithinBudget, budgetStatus, budgetStatusFor, buildAppContext, checkSdkCompatibility, createAuthMiddleware, createServer, exportApp, fetchSource, formatUsd, importApp, installApp, installDependencies, isConsoleRequest, loadApp, parseSourceArg, readCachedIndex, refreshRegistry, registerAuthRoutes, removeApp, removeRegistry, requiredLevel, resolveApp, setAppBudget, updateApp, updateSource, utcDay };