@ashx-j/lunr 0.2.25 → 0.2.27

package/dist/core/subscriptions.d.ts

@@ -25,9 +25,14 @@ interface ProviderPool {
     keys: SubEntry[];
 }
 type SubscriptionData = Record<string, ProviderPool>;
+export interface RequestSubscriptionKey {
+    providerId: string;
+    fingerprint: string;
+}
+/** Request identities are non-secret digests kept outside messages and storage. */
+export declare function subscriptionKeyFingerprint(providerId: string, key: string): string;
 export declare class SubscriptionManager {
     private data;
-    private loaded;
     private storage;
     private authStorage;
     private queue;
@@ -37,9 +42,13 @@ export declare class SubscriptionManager {
     static fromStorage(authStorage: CredentialStore, storage: AuthStorageBackend): SubscriptionManager;
     static inMemory(authStorage: CredentialStore, data?: SubscriptionData): SubscriptionManager;
     private parseStorageData;
-    private ensureLoaded;
+    /**
+     * Lock order is subscriptions then auth. Keep selection and its auth mirror
+     * under the subscription lock so later selectors cannot overtake a mirror.
+     * These files are not an atomic commit: a failed mirror aborts the pool write;
+     * a later pool write failure can leave auth ahead and a repeated selection repairs it.
+     */
     private enqueue;
-    private persist;
     private readRawCredential;
     private ensurePool;
     private nextId;
@@ -51,12 +60,12 @@ export declare class SubscriptionManager {
     renameKey(providerId: string, id: string, name: string): Promise<void>;
     setActive(providerId: string, id: string): Promise<void>;
     /**
-     * Mark the active key exhausted and rotate to the next non-exhausted key in
+     * Mark the request's key exhausted and rotate to the next non-exhausted key in
      * round-robin order. A parseable reset time is persisted as exhaustedUntil;
-     * otherwise the exhaustion is process-local only. Returns the new active key,
-     * or null when no non-exhausted alternative exists (current key stays active).
+     * otherwise the exhaustion is process-local only. A later selection is preserved.
+     * Returns the usable active key for retry, or null when no alternative exists.
      */
-    rotateOnFailure(providerId: string, errorMessage: string, now?: number): Promise<SubEntry | null>;
+    rotateOnFailure(providerId: string, errorMessage: string, requestFingerprint: string | undefined, now?: number): Promise<SubEntry | null>;
     /** Manual reactivate: clears persisted and process-local exhaustion for a key. */
     clearExhaustion(providerId: string, id: string): Promise<void>;
 }

package/dist/core/subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../src/core/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,KAAK,kBAAkB,EAAsD,MAAM,mBAAmB,CAAC;AAGhH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,EAAE,CAAC;CACjB;AAED,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAErD,qBAAa,mBAAmB;IAC/B,OAAO,CAAC,IAAI,CAAwB;IACpC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,WAAW,CAAkB;IAErC,OAAO,CAAC,KAAK,CAAuC;IAGpD,OAAO,CAAC,eAAe,CAAkC;IAEzD,OAAO,eAGN;IAED,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAK9E;IAED,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CAEjG;IAED,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,IAAI,GAAE,gBAAqB,GAAG,mBAAmB,CAI9F;IAED,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,OAAO;IAMf,OAAO,CAAC,OAAO;YAQD,iBAAiB;YAajB,UAAU;IAiBxB,OAAO,CAAC,MAAM;YASA,YAAY;IAIpB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAKlD;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAKjE;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY9E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B7D;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7D;IAED;;;;;OAKG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA0ClH;IAED,kFAAkF;IAC5E,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAenE;CACD","sourcesContent":["/**\n * lunr: multi-subscription API-key pools per provider.\n *\n * The pool lives in subscriptions.json next to auth.json; auth.json always\n * holds the ACTIVE credential, so rotation is just mirroring the chosen pool\n * key into auth.json via AuthStorage.modify. Persistence reuses the\n * AuthStorage backend classes (proper-lockfile guarded read-modify-write,\n * mode 0600) pointed at the subscriptions.json path.\n *\n * Raw keys are never logged or embedded in error messages — errors refer to\n * provider and key ids only.\n */\n\nimport type { Credential, CredentialStore } from \"@ashx-j/lunr-ai\";\nimport { join } from \"path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend } from \"./auth-storage.ts\";\nimport { parseResetTimeMs } from \"./usage-limit.ts\";\n\nexport interface SubEntry {\n\tid: string;\n\tname: string;\n\tkey: string;\n\taddedAt: number;\n\texhaustedUntil?: number;\n\tlastError?: string;\n}\n\ninterface ProviderPool {\n\tactive: string;\n\tkeys: SubEntry[];\n}\n\ntype SubscriptionData = Record<string, ProviderPool>;\n\nexport class SubscriptionManager {\n\tprivate data: SubscriptionData = {};\n\tprivate loaded = false;\n\tprivate storage: AuthStorageBackend;\n\tprivate authStorage: CredentialStore;\n\t// In-process write queue so mutations serialize even before the file lock.\n\tprivate queue: Promise<unknown> = Promise.resolve();\n\t// Per-provider ids of keys exhausted without a parseable reset time.\n\t// Process-local on purpose: infinite exhaustion is never persisted.\n\tprivate memoryExhausted = new Map<string, Set<string>>();\n\n\tprivate constructor(authStorage: CredentialStore, storage: AuthStorageBackend) {\n\t\tthis.authStorage = authStorage;\n\t\tthis.storage = storage;\n\t}\n\n\tstatic create(authStorage: CredentialStore, path?: string): SubscriptionManager {\n\t\treturn new SubscriptionManager(\n\t\t\tauthStorage,\n\t\t\tnew FileAuthStorageBackend(path ?? join(getAgentDir(), \"subscriptions.json\")),\n\t\t);\n\t}\n\n\tstatic fromStorage(authStorage: CredentialStore, storage: AuthStorageBackend): SubscriptionManager {\n\t\treturn new SubscriptionManager(authStorage, storage);\n\t}\n\n\tstatic inMemory(authStorage: CredentialStore, data: SubscriptionData = {}): SubscriptionManager {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn SubscriptionManager.fromStorage(authStorage, storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): SubscriptionData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as SubscriptionData;\n\t}\n\n\tprivate ensureLoaded(): void {\n\t\tif (this.loaded) return;\n\t\tthis.loaded = true;\n\t\tlet content: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t} catch {\n\t\t\t// Preserve the empty snapshot; a malformed file is never overwritten by a load.\n\t\t}\n\t}\n\n\tprivate enqueue<T>(fn: () => Promise<T>): Promise<T> {\n\t\tconst next = this.queue.then(fn);\n\t\tthis.queue = next.catch(() => {});\n\t\treturn next;\n\t}\n\n\tprivate persist(): Promise<void> {\n\t\treturn this.storage.withLockAsync(async () => ({\n\t\t\tresult: undefined,\n\t\t\tnext: JSON.stringify(this.data, null, 2),\n\t\t}));\n\t}\n\n\t/** Raw stored credential read via the modify path (returning undefined leaves it unchanged). */\n\tprivate async readRawCredential(providerId: string): Promise<Credential | undefined> {\n\t\tlet current: Credential | undefined;\n\t\tawait this.authStorage.modify(providerId, async (credential) => {\n\t\t\tcurrent = credential;\n\t\t\treturn undefined;\n\t\t});\n\t\treturn current;\n\t}\n\n\t/**\n\t * Pool for a provider, lazy-importing an existing stored api_key credential\n\t * as \"Sub 1\" on first access. OAuth credentials are not imported.\n\t */\n\tprivate async ensurePool(providerId: string): Promise<ProviderPool | undefined> {\n\t\tthis.ensureLoaded();\n\t\tconst existing = this.data[providerId];\n\t\tif (existing) return existing;\n\n\t\tconst credential = await this.readRawCredential(providerId);\n\t\tif (credential?.type !== \"api_key\" || credential.key === undefined) return undefined;\n\n\t\tconst pool: ProviderPool = {\n\t\t\tactive: \"1\",\n\t\t\tkeys: [{ id: \"1\", name: \"Sub 1\", key: credential.key, addedAt: Date.now() }],\n\t\t};\n\t\tthis.data = { ...this.data, [providerId]: pool };\n\t\tawait this.persist();\n\t\treturn pool;\n\t}\n\n\tprivate nextId(pool: ProviderPool): string {\n\t\tlet max = 0;\n\t\tfor (const entry of pool.keys) {\n\t\t\tconst numeric = Number.parseInt(entry.id, 10);\n\t\t\tif (Number.isFinite(numeric) && numeric > max) max = numeric;\n\t\t}\n\t\treturn String(max + 1);\n\t}\n\n\tprivate async mirrorActive(providerId: string, key: string): Promise<void> {\n\t\tawait this.authStorage.modify(providerId, async () => ({ type: \"api_key\", key }));\n\t}\n\n\tasync list(providerId: string): Promise<SubEntry[]> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool ? [...pool.keys] : [];\n\t\t});\n\t}\n\n\tasync getActive(providerId: string): Promise<SubEntry | undefined> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool?.keys.find((entry) => entry.id === pool.active);\n\t\t});\n\t}\n\n\tasync addKey(providerId: string, key: string, name?: string): Promise<SubEntry> {\n\t\treturn this.enqueue(async () => {\n\t\t\tthis.ensureLoaded();\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst id = pool ? this.nextId(pool) : \"1\";\n\t\t\tconst entry: SubEntry = { id, name: name ?? `Sub ${id}`, key, addedAt: Date.now() };\n\t\t\tconst keys = [...(pool?.keys ?? []), entry];\n\t\t\tthis.data = { ...this.data, [providerId]: { active: id, keys } };\n\t\t\tawait this.persist();\n\t\t\tawait this.mirrorActive(providerId, key);\n\t\t\treturn entry;\n\t\t});\n\t}\n\n\tasync removeKey(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool || !pool.keys.some((entry) => entry.id === id)) return;\n\n\t\t\tconst keys = pool.keys.filter((entry) => entry.id !== id);\n\t\t\tthis.memoryExhausted.get(providerId)?.delete(id);\n\n\t\t\tif (keys.length === 0) {\n\t\t\t\tconst data = { ...this.data };\n\t\t\t\tdelete data[providerId];\n\t\t\t\tthis.data = data;\n\t\t\t\tawait this.persist();\n\t\t\t\tawait this.authStorage.delete(providerId);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tlet active = pool.active;\n\t\t\tif (active === id) {\n\t\t\t\tactive = keys[0]?.id ?? active;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t\t\tawait this.persist();\n\t\t\t\tconst promoted = keys.find((entry) => entry.id === active);\n\t\t\t\tif (promoted) await this.mirrorActive(providerId, promoted.key);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t\tawait this.persist();\n\t\t});\n\t}\n\n\tasync renameKey(providerId: string, id: string, name: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst keys = pool.keys.map((entry) => (entry.id === id ? { ...entry, name } : entry));\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\tawait this.persist();\n\t\t});\n\t}\n\n\tasync setActive(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst entry = pool?.keys.find((candidate) => candidate.id === id);\n\t\t\tif (!pool || !entry) return;\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, active: id } };\n\t\t\tawait this.persist();\n\t\t\tawait this.mirrorActive(providerId, entry.key);\n\t\t});\n\t}\n\n\t/**\n\t * Mark the active key exhausted and rotate to the next non-exhausted key in\n\t * round-robin order. A parseable reset time is persisted as exhaustedUntil;\n\t * otherwise the exhaustion is process-local only. Returns the new active key,\n\t * or null when no non-exhausted alternative exists (current key stays active).\n\t */\n\tasync rotateOnFailure(providerId: string, errorMessage: string, now: number = Date.now()): Promise<SubEntry | null> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return null;\n\t\t\tconst currentIndex = pool.keys.findIndex((entry) => entry.id === pool.active);\n\t\t\tif (currentIndex === -1) return null;\n\t\t\tconst current = pool.keys[currentIndex];\n\t\t\tif (!current) return null;\n\n\t\t\tconst resetAt = parseResetTimeMs(errorMessage);\n\t\t\tlet keys = pool.keys;\n\t\t\tif (resetAt !== undefined && resetAt > now) {\n\t\t\t\tkeys = pool.keys.map((entry) =>\n\t\t\t\t\tentry.id === current.id ? { ...entry, exhaustedUntil: resetAt, lastError: errorMessage } : entry,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst set = this.memoryExhausted.get(providerId) ?? new Set<string>();\n\t\t\t\tset.add(current.id);\n\t\t\t\tthis.memoryExhausted.set(providerId, set);\n\t\t\t}\n\n\t\t\tconst isExhausted = (entry: SubEntry): boolean =>\n\t\t\t\tthis.memoryExhausted.get(providerId)?.has(entry.id) === true ||\n\t\t\t\t(entry.exhaustedUntil !== undefined && entry.exhaustedUntil > now);\n\n\t\t\tfor (let offset = 1; offset < keys.length; offset++) {\n\t\t\t\tconst candidate = keys[(currentIndex + offset) % keys.length];\n\t\t\t\tif (!candidate || isExhausted(candidate)) continue;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active: candidate.id, keys } };\n\t\t\t\tawait this.persist();\n\t\t\t\tawait this.mirrorActive(providerId, candidate.key);\n\t\t\t\treturn candidate;\n\t\t\t}\n\n\t\t\t// No alternative: keep the (now-exhausted) current key active, but still\n\t\t\t// persist its exhaustion state when a reset time was recorded.\n\t\t\tif (keys !== pool.keys) {\n\t\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\t\tawait this.persist();\n\t\t\t}\n\t\t\treturn null;\n\t\t});\n\t}\n\n\t/** Manual reactivate: clears persisted and process-local exhaustion for a key. */\n\tasync clearExhaustion(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tthis.memoryExhausted.get(providerId)?.delete(id);\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst target = pool.keys.find((entry) => entry.id === id);\n\t\t\tif (!target || (target.exhaustedUntil === undefined && target.lastError === undefined)) return;\n\t\t\tconst keys = pool.keys.map((entry) => {\n\t\t\t\tif (entry.id !== id) return entry;\n\t\t\t\tconst { exhaustedUntil: _exhaustedUntil, lastError: _lastError, ...rest } = entry;\n\t\t\t\treturn rest;\n\t\t\t});\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\tawait this.persist();\n\t\t});\n\t}\n}\n"]}
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../src/core/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAAE,KAAK,kBAAkB,EAAsD,MAAM,mBAAmB,CAAC;AAIhH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,YAAY;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,EAAE,CAAC;CACjB;AAED,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,sBAAsB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElF;AAED,qBAAa,mBAAmB;IAC/B,OAAO,CAAC,IAAI,CAAwB;IACpC,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,WAAW,CAAkB;IAErC,OAAO,CAAC,KAAK,CAAuC;IAGpD,OAAO,CAAC,eAAe,CAAkC;IAEzD,OAAO,eAGN;IAED,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAK9E;IAED,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CAEjG;IAED,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,eAAe,EAAE,IAAI,GAAE,gBAAqB,GAAG,mBAAmB,CAI9F;IAED,OAAO,CAAC,gBAAgB;IAmCxB;;;;;OAKG;IACH,OAAO,CAAC,OAAO;YAeD,iBAAiB;YAajB,UAAU;IAexB,OAAO,CAAC,MAAM;YASA,YAAY;IAapB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAKlD;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAKjE;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU9E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC7D;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ7D;IAED;;;;;OAKG;IACG,eAAe,CACpB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,GAAG,GAAE,MAAmB,GACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4C1B;IAED,kFAAkF;IAC5E,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAcnE;CACD","sourcesContent":["/**\n * lunr: multi-subscription API-key pools per provider.\n *\n * The pool lives in subscriptions.json next to auth.json; auth.json always\n * holds the ACTIVE credential, so rotation is just mirroring the chosen pool\n * key into auth.json via AuthStorage.modify. Persistence reuses the\n * AuthStorage backend classes (proper-lockfile guarded read-modify-write,\n * mode 0600) pointed at the subscriptions.json path.\n *\n * Raw keys are never logged or embedded in error messages — errors refer to\n * provider and key ids only.\n */\n\nimport { createHash } from \"node:crypto\";\nimport type { Credential, CredentialStore } from \"@ashx-j/lunr-ai\";\nimport { join } from \"path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend } from \"./auth-storage.ts\";\nimport { parseResetTimeMs } from \"./usage-limit.ts\";\nimport { clearPlanUsageCache } from \"./usage-service.ts\";\n\nexport interface SubEntry {\n\tid: string;\n\tname: string;\n\tkey: string;\n\taddedAt: number;\n\texhaustedUntil?: number;\n\tlastError?: string;\n}\n\ninterface ProviderPool {\n\tactive: string;\n\tkeys: SubEntry[];\n}\n\ntype SubscriptionData = Record<string, ProviderPool>;\n\nexport interface RequestSubscriptionKey {\n\tproviderId: string;\n\tfingerprint: string;\n}\n\n/** Request identities are non-secret digests kept outside messages and storage. */\nexport function subscriptionKeyFingerprint(providerId: string, key: string): string {\n\treturn createHash(\"sha256\").update(providerId).update(\"\\0\").update(key).digest(\"hex\");\n}\n\nexport class SubscriptionManager {\n\tprivate data: SubscriptionData = {};\n\tprivate storage: AuthStorageBackend;\n\tprivate authStorage: CredentialStore;\n\t// In-process write queue so mutations serialize even before the file lock.\n\tprivate queue: Promise<unknown> = Promise.resolve();\n\t// Per-provider fingerprints exhausted without a parseable reset time.\n\t// Process-local on purpose: infinite exhaustion is never persisted.\n\tprivate memoryExhausted = new Map<string, Set<string>>();\n\n\tprivate constructor(authStorage: CredentialStore, storage: AuthStorageBackend) {\n\t\tthis.authStorage = authStorage;\n\t\tthis.storage = storage;\n\t}\n\n\tstatic create(authStorage: CredentialStore, path?: string): SubscriptionManager {\n\t\treturn new SubscriptionManager(\n\t\t\tauthStorage,\n\t\t\tnew FileAuthStorageBackend(path ?? join(getAgentDir(), \"subscriptions.json\")),\n\t\t);\n\t}\n\n\tstatic fromStorage(authStorage: CredentialStore, storage: AuthStorageBackend): SubscriptionManager {\n\t\treturn new SubscriptionManager(authStorage, storage);\n\t}\n\n\tstatic inMemory(authStorage: CredentialStore, data: SubscriptionData = {}): SubscriptionManager {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn SubscriptionManager.fromStorage(authStorage, storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): SubscriptionData {\n\t\tif (content === undefined) return {};\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(content);\n\t\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) throw new Error();\n\t\t\tfor (const value of Object.values(parsed as Record<string, unknown>)) {\n\t\t\t\tif (!value || typeof value !== \"object\") throw new Error();\n\t\t\t\tconst pool = value as Record<string, unknown>;\n\t\t\t\tif (typeof pool.active !== \"string\" || !Array.isArray(pool.keys)) throw new Error();\n\t\t\t\tconst ids = new Set<string>();\n\t\t\t\tfor (const value of pool.keys as unknown[]) {\n\t\t\t\t\tif (!value || typeof value !== \"object\") throw new Error();\n\t\t\t\t\tconst entry = value as Record<string, unknown>;\n\t\t\t\t\tif (\n\t\t\t\t\t\ttypeof entry.id !== \"string\" ||\n\t\t\t\t\t\tids.has(entry.id) ||\n\t\t\t\t\t\ttypeof entry.name !== \"string\" ||\n\t\t\t\t\t\ttypeof entry.key !== \"string\" ||\n\t\t\t\t\t\ttypeof entry.addedAt !== \"number\" ||\n\t\t\t\t\t\t!Number.isFinite(entry.addedAt) ||\n\t\t\t\t\t\t(entry.exhaustedUntil !== undefined &&\n\t\t\t\t\t\t\t(typeof entry.exhaustedUntil !== \"number\" || !Number.isFinite(entry.exhaustedUntil))) ||\n\t\t\t\t\t\t(entry.lastError !== undefined && typeof entry.lastError !== \"string\")\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new Error();\n\t\t\t\t\tids.add(entry.id);\n\t\t\t\t}\n\t\t\t\tif (!ids.has(pool.active)) throw new Error();\n\t\t\t}\n\t\t\treturn parsed as SubscriptionData;\n\t\t} catch {\n\t\t\tthrow new Error(\"Subscription storage is malformed. Repair it before changing subscriptions.\");\n\t\t}\n\t}\n\n\t/**\n\t * Lock order is subscriptions then auth. Keep selection and its auth mirror\n\t * under the subscription lock so later selectors cannot overtake a mirror.\n\t * These files are not an atomic commit: a failed mirror aborts the pool write;\n\t * a later pool write failure can leave auth ahead and a repeated selection repairs it.\n\t */\n\tprivate enqueue<T>(fn: () => Promise<T>): Promise<T> {\n\t\tconst next = this.queue.then(() =>\n\t\t\tthis.storage.withLockAsync(async (current) => {\n\t\t\t\tthis.data = this.parseStorageData(current);\n\t\t\t\tconst before = JSON.stringify(this.data, null, 2);\n\t\t\t\tconst result = await fn();\n\t\t\t\tconst after = JSON.stringify(this.data, null, 2);\n\t\t\t\treturn { result, next: before === after ? undefined : after };\n\t\t\t}),\n\t\t);\n\t\tthis.queue = next.catch(() => {});\n\t\treturn next;\n\t}\n\n\t/** Raw stored credential read via the modify path (returning undefined leaves it unchanged). */\n\tprivate async readRawCredential(providerId: string): Promise<Credential | undefined> {\n\t\tlet current: Credential | undefined;\n\t\tawait this.authStorage.modify(providerId, async (credential) => {\n\t\t\tcurrent = credential;\n\t\t\treturn undefined;\n\t\t});\n\t\treturn current;\n\t}\n\n\t/**\n\t * Pool for a provider, lazy-importing an existing stored api_key credential\n\t * as \"Sub 1\" on first access. OAuth credentials are not imported.\n\t */\n\tprivate async ensurePool(providerId: string): Promise<ProviderPool | undefined> {\n\t\tconst existing = this.data[providerId];\n\t\tif (existing) return existing;\n\n\t\tconst credential = await this.readRawCredential(providerId);\n\t\tif (credential?.type !== \"api_key\" || credential.key === undefined) return undefined;\n\n\t\tconst pool: ProviderPool = {\n\t\t\tactive: \"1\",\n\t\t\tkeys: [{ id: \"1\", name: \"Sub 1\", key: credential.key, addedAt: Date.now() }],\n\t\t};\n\t\tthis.data = { ...this.data, [providerId]: pool };\n\t\treturn pool;\n\t}\n\n\tprivate nextId(pool: ProviderPool): string {\n\t\tlet max = 0;\n\t\tfor (const entry of pool.keys) {\n\t\t\tconst numeric = Number.parseInt(entry.id, 10);\n\t\t\tif (Number.isFinite(numeric) && numeric > max) max = numeric;\n\t\t}\n\t\treturn String(max + 1);\n\t}\n\n\tprivate async mirrorActive(providerId: string, key: string): Promise<void> {\n\t\tclearPlanUsageCache();\n\t\ttry {\n\t\t\tawait this.authStorage.modify(providerId, async (current) => ({\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey,\n\t\t\t\t...(current?.type === \"api_key\" && current.env ? { env: current.env } : {}),\n\t\t\t}));\n\t\t} finally {\n\t\t\tclearPlanUsageCache();\n\t\t}\n\t}\n\n\tasync list(providerId: string): Promise<SubEntry[]> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool ? [...pool.keys] : [];\n\t\t});\n\t}\n\n\tasync getActive(providerId: string): Promise<SubEntry | undefined> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool?.keys.find((entry) => entry.id === pool.active);\n\t\t});\n\t}\n\n\tasync addKey(providerId: string, key: string, name?: string): Promise<SubEntry> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst id = pool ? this.nextId(pool) : \"1\";\n\t\t\tconst entry: SubEntry = { id, name: name ?? `Sub ${id}`, key, addedAt: Date.now() };\n\t\t\tconst keys = [...(pool?.keys ?? []), entry];\n\t\t\tthis.data = { ...this.data, [providerId]: { active: id, keys } };\n\t\t\tawait this.mirrorActive(providerId, key);\n\t\t\treturn entry;\n\t\t});\n\t}\n\n\tasync removeKey(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool || !pool.keys.some((entry) => entry.id === id)) return;\n\n\t\t\tconst keys = pool.keys.filter((entry) => entry.id !== id);\n\t\t\tconst removed = pool.keys.find((entry) => entry.id === id)!;\n\t\t\tif (!keys.some((entry) => entry.key === removed.key)) {\n\t\t\t\tthis.memoryExhausted.get(providerId)?.delete(subscriptionKeyFingerprint(providerId, removed.key));\n\t\t\t}\n\n\t\t\tif (keys.length === 0) {\n\t\t\t\tconst data = { ...this.data };\n\t\t\t\tdelete data[providerId];\n\t\t\t\tthis.data = data;\n\t\t\t\tclearPlanUsageCache();\n\t\t\t\ttry {\n\t\t\t\t\tawait this.authStorage.delete(providerId);\n\t\t\t\t} finally {\n\t\t\t\t\tclearPlanUsageCache();\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tlet active = pool.active;\n\t\t\tif (active === id) {\n\t\t\t\tactive = keys[0]?.id ?? active;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t\t\tconst promoted = keys.find((entry) => entry.id === active);\n\t\t\t\tif (promoted) await this.mirrorActive(providerId, promoted.key);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t});\n\t}\n\n\tasync renameKey(providerId: string, id: string, name: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst keys = pool.keys.map((entry) => (entry.id === id ? { ...entry, name } : entry));\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t});\n\t}\n\n\tasync setActive(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst entry = pool?.keys.find((candidate) => candidate.id === id);\n\t\t\tif (!pool || !entry) return;\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, active: id } };\n\t\t\tawait this.mirrorActive(providerId, entry.key);\n\t\t});\n\t}\n\n\t/**\n\t * Mark the request's key exhausted and rotate to the next non-exhausted key in\n\t * round-robin order. A parseable reset time is persisted as exhaustedUntil;\n\t * otherwise the exhaustion is process-local only. A later selection is preserved.\n\t * Returns the usable active key for retry, or null when no alternative exists.\n\t */\n\tasync rotateOnFailure(\n\t\tproviderId: string,\n\t\terrorMessage: string,\n\t\trequestFingerprint: string | undefined,\n\t\tnow: number = Date.now(),\n\t): Promise<SubEntry | null> {\n\t\tif (!requestFingerprint) return null;\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = this.data[providerId];\n\t\t\tif (!pool || pool.keys.length < 2) return null;\n\t\t\tconst currentIndex = pool.keys.findIndex((entry) => entry.id === pool.active);\n\t\t\tif (currentIndex === -1) return null;\n\t\t\tconst current = pool.keys[currentIndex];\n\t\t\tconst matchesRequest = (entry: SubEntry): boolean =>\n\t\t\t\tsubscriptionKeyFingerprint(providerId, entry.key) === requestFingerprint;\n\t\t\tif (!current || !pool.keys.some(matchesRequest)) return null;\n\n\t\t\tconst resetAt = parseResetTimeMs(errorMessage);\n\t\t\tlet keys = pool.keys;\n\t\t\tif (resetAt !== undefined && resetAt > now) {\n\t\t\t\tkeys = pool.keys.map((entry) =>\n\t\t\t\t\tmatchesRequest(entry) ? { ...entry, exhaustedUntil: resetAt, lastError: errorMessage } : entry,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst set = this.memoryExhausted.get(providerId) ?? new Set<string>();\n\t\t\t\tset.add(requestFingerprint);\n\t\t\t\tthis.memoryExhausted.set(providerId, set);\n\t\t\t}\n\n\t\t\tconst isExhausted = (entry: SubEntry): boolean =>\n\t\t\t\tthis.memoryExhausted.get(providerId)?.has(subscriptionKeyFingerprint(providerId, entry.key)) === true ||\n\t\t\t\t(entry.exhaustedUntil !== undefined && entry.exhaustedUntil > now);\n\n\t\t\tif (keys !== pool.keys) this.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\t// Another owner already selected a different credential. Retry it without\n\t\t\t// replacing its selection or mirroring a stale failure over its auth.\n\t\t\tif (!matchesRequest(current)) return isExhausted(current) ? null : current;\n\n\t\t\tfor (let offset = 1; offset < keys.length; offset++) {\n\t\t\t\tconst candidate = keys[(currentIndex + offset) % keys.length];\n\t\t\t\tif (!candidate || isExhausted(candidate)) continue;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active: candidate.id, keys } };\n\t\t\t\tawait this.mirrorActive(providerId, candidate.key);\n\t\t\t\treturn candidate;\n\t\t\t}\n\n\t\t\t// No alternative: keep the now-exhausted current key active.\n\t\t\treturn null;\n\t\t});\n\t}\n\n\t/** Manual reactivate: clears persisted and process-local exhaustion for a key. */\n\tasync clearExhaustion(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst target = pool.keys.find((entry) => entry.id === id);\n\t\t\tif (target) this.memoryExhausted.get(providerId)?.delete(subscriptionKeyFingerprint(providerId, target.key));\n\t\t\tif (!target || (target.exhaustedUntil === undefined && target.lastError === undefined)) return;\n\t\t\tconst keys = pool.keys.map((entry) => {\n\t\t\t\tif (entry.id !== id) return entry;\n\t\t\t\tconst { exhaustedUntil: _exhaustedUntil, lastError: _lastError, ...rest } = entry;\n\t\t\t\treturn rest;\n\t\t\t});\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t});\n\t}\n}\n"]}

package/dist/core/subscriptions.js

@@ -10,18 +10,23 @@
  * Raw keys are never logged or embedded in error messages — errors refer to
  * provider and key ids only.
  */
+import { createHash } from "node:crypto";
 import { join } from "path";
 import { getAgentDir } from "../config.js";
 import { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage.js";
 import { parseResetTimeMs } from "./usage-limit.js";
+import { clearPlanUsageCache } from "./usage-service.js";
+/** Request identities are non-secret digests kept outside messages and storage. */
+export function subscriptionKeyFingerprint(providerId, key) {
+    return createHash("sha256").update(providerId).update("\0").update(key).digest("hex");
+}
 export class SubscriptionManager {
     data = {};
-    loaded = false;
     storage;
     authStorage;
     // In-process write queue so mutations serialize even before the file lock.
     queue = Promise.resolve();
-    // Per-provider ids of keys exhausted without a parseable reset time.
+    // Per-provider fingerprints exhausted without a parseable reset time.
     // Process-local on purpose: infinite exhaustion is never persisted.
     memoryExhausted = new Map();
     constructor(authStorage, storage) {
@@ -40,38 +45,61 @@ export class SubscriptionManager {
         return SubscriptionManager.fromStorage(authStorage, storage);
     }
     parseStorageData(content) {
-        if (!content) {
+        if (content === undefined)
             return {};
-        }
-        return JSON.parse(content);
-    }
-    ensureLoaded() {
-        if (this.loaded)
-            return;
-        this.loaded = true;
-        let content;
         try {
-            this.storage.withLock((current) => {
-                content = current;
-                return { result: undefined };
-            });
-            this.data = this.parseStorageData(content);
+            const parsed = JSON.parse(content);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error();
+            for (const value of Object.values(parsed)) {
+                if (!value || typeof value !== "object")
+                    throw new Error();
+                const pool = value;
+                if (typeof pool.active !== "string" || !Array.isArray(pool.keys))
+                    throw new Error();
+                const ids = new Set();
+                for (const value of pool.keys) {
+                    if (!value || typeof value !== "object")
+                        throw new Error();
+                    const entry = value;
+                    if (typeof entry.id !== "string" ||
+                        ids.has(entry.id) ||
+                        typeof entry.name !== "string" ||
+                        typeof entry.key !== "string" ||
+                        typeof entry.addedAt !== "number" ||
+                        !Number.isFinite(entry.addedAt) ||
+                        (entry.exhaustedUntil !== undefined &&
+                            (typeof entry.exhaustedUntil !== "number" || !Number.isFinite(entry.exhaustedUntil))) ||
+                        (entry.lastError !== undefined && typeof entry.lastError !== "string"))
+                        throw new Error();
+                    ids.add(entry.id);
+                }
+                if (!ids.has(pool.active))
+                    throw new Error();
+            }
+            return parsed;
         }
         catch {
-            // Preserve the empty snapshot; a malformed file is never overwritten by a load.
+            throw new Error("Subscription storage is malformed. Repair it before changing subscriptions.");
         }
     }
+    /**
+     * Lock order is subscriptions then auth. Keep selection and its auth mirror
+     * under the subscription lock so later selectors cannot overtake a mirror.
+     * These files are not an atomic commit: a failed mirror aborts the pool write;
+     * a later pool write failure can leave auth ahead and a repeated selection repairs it.
+     */
     enqueue(fn) {
-        const next = this.queue.then(fn);
+        const next = this.queue.then(() => this.storage.withLockAsync(async (current) => {
+            this.data = this.parseStorageData(current);
+            const before = JSON.stringify(this.data, null, 2);
+            const result = await fn();
+            const after = JSON.stringify(this.data, null, 2);
+            return { result, next: before === after ? undefined : after };
+        }));
         this.queue = next.catch(() => { });
         return next;
     }
-    persist() {
-        return this.storage.withLockAsync(async () => ({
-            result: undefined,
-            next: JSON.stringify(this.data, null, 2),
-        }));
-    }
     /** Raw stored credential read via the modify path (returning undefined leaves it unchanged). */
     async readRawCredential(providerId) {
         let current;
@@ -86,7 +114,6 @@ export class SubscriptionManager {
      * as "Sub 1" on first access. OAuth credentials are not imported.
      */
     async ensurePool(providerId) {
-        this.ensureLoaded();
         const existing = this.data[providerId];
         if (existing)
             return existing;
@@ -98,7 +125,6 @@ export class SubscriptionManager {
             keys: [{ id: "1", name: "Sub 1", key: credential.key, addedAt: Date.now() }],
         };
         this.data = { ...this.data, [providerId]: pool };
-        await this.persist();
         return pool;
     }
     nextId(pool) {
@@ -111,7 +137,17 @@ export class SubscriptionManager {
         return String(max + 1);
     }
     async mirrorActive(providerId, key) {
-        await this.authStorage.modify(providerId, async () => ({ type: "api_key", key }));
+        clearPlanUsageCache();
+        try {
+            await this.authStorage.modify(providerId, async (current) => ({
+                type: "api_key",
+                key,
+                ...(current?.type === "api_key" && current.env ? { env: current.env } : {}),
+            }));
+        }
+        finally {
+            clearPlanUsageCache();
+        }
     }
     async list(providerId) {
         return this.enqueue(async () => {
@@ -127,13 +163,11 @@ export class SubscriptionManager {
     }
     async addKey(providerId, key, name) {
         return this.enqueue(async () => {
-            this.ensureLoaded();
             const pool = await this.ensurePool(providerId);
             const id = pool ? this.nextId(pool) : "1";
             const entry = { id, name: name ?? `Sub ${id}`, key, addedAt: Date.now() };
             const keys = [...(pool?.keys ?? []), entry];
             this.data = { ...this.data, [providerId]: { active: id, keys } };
-            await this.persist();
             await this.mirrorActive(providerId, key);
             return entry;
         });
@@ -144,27 +178,33 @@ export class SubscriptionManager {
             if (!pool || !pool.keys.some((entry) => entry.id === id))
                 return;
             const keys = pool.keys.filter((entry) => entry.id !== id);
-            this.memoryExhausted.get(providerId)?.delete(id);
+            const removed = pool.keys.find((entry) => entry.id === id);
+            if (!keys.some((entry) => entry.key === removed.key)) {
+                this.memoryExhausted.get(providerId)?.delete(subscriptionKeyFingerprint(providerId, removed.key));
+            }
             if (keys.length === 0) {
                 const data = { ...this.data };
                 delete data[providerId];
                 this.data = data;
-                await this.persist();
-                await this.authStorage.delete(providerId);
+                clearPlanUsageCache();
+                try {
+                    await this.authStorage.delete(providerId);
+                }
+                finally {
+                    clearPlanUsageCache();
+                }
                 return;
             }
             let active = pool.active;
             if (active === id) {
                 active = keys[0]?.id ?? active;
                 this.data = { ...this.data, [providerId]: { active, keys } };
-                await this.persist();
                 const promoted = keys.find((entry) => entry.id === active);
                 if (promoted)
                     await this.mirrorActive(providerId, promoted.key);
                 return;
             }
             this.data = { ...this.data, [providerId]: { active, keys } };
-            await this.persist();
         });
     }
     async renameKey(providerId, id, name) {
@@ -174,7 +214,6 @@ export class SubscriptionManager {
                 return;
             const keys = pool.keys.map((entry) => (entry.id === id ? { ...entry, name } : entry));
             this.data = { ...this.data, [providerId]: { ...pool, keys } };
-            await this.persist();
         });
     }
     async setActive(providerId, id) {
@@ -184,65 +223,68 @@ export class SubscriptionManager {
             if (!pool || !entry)
                 return;
             this.data = { ...this.data, [providerId]: { ...pool, active: id } };
-            await this.persist();
             await this.mirrorActive(providerId, entry.key);
         });
     }
     /**
-     * Mark the active key exhausted and rotate to the next non-exhausted key in
+     * Mark the request's key exhausted and rotate to the next non-exhausted key in
      * round-robin order. A parseable reset time is persisted as exhaustedUntil;
-     * otherwise the exhaustion is process-local only. Returns the new active key,
-     * or null when no non-exhausted alternative exists (current key stays active).
+     * otherwise the exhaustion is process-local only. A later selection is preserved.
+     * Returns the usable active key for retry, or null when no alternative exists.
      */
-    async rotateOnFailure(providerId, errorMessage, now = Date.now()) {
+    async rotateOnFailure(providerId, errorMessage, requestFingerprint, now = Date.now()) {
+        if (!requestFingerprint)
+            return null;
         return this.enqueue(async () => {
-            const pool = await this.ensurePool(providerId);
-            if (!pool)
+            const pool = this.data[providerId];
+            if (!pool || pool.keys.length < 2)
                 return null;
             const currentIndex = pool.keys.findIndex((entry) => entry.id === pool.active);
             if (currentIndex === -1)
                 return null;
             const current = pool.keys[currentIndex];
-            if (!current)
+            const matchesRequest = (entry) => subscriptionKeyFingerprint(providerId, entry.key) === requestFingerprint;
+            if (!current || !pool.keys.some(matchesRequest))
                 return null;
             const resetAt = parseResetTimeMs(errorMessage);
             let keys = pool.keys;
             if (resetAt !== undefined && resetAt > now) {
-                keys = pool.keys.map((entry) => entry.id === current.id ? { ...entry, exhaustedUntil: resetAt, lastError: errorMessage } : entry);
+                keys = pool.keys.map((entry) => matchesRequest(entry) ? { ...entry, exhaustedUntil: resetAt, lastError: errorMessage } : entry);
             }
             else {
                 const set = this.memoryExhausted.get(providerId) ?? new Set();
-                set.add(current.id);
+                set.add(requestFingerprint);
                 this.memoryExhausted.set(providerId, set);
             }
-            const isExhausted = (entry) => this.memoryExhausted.get(providerId)?.has(entry.id) === true ||
+            const isExhausted = (entry) => this.memoryExhausted.get(providerId)?.has(subscriptionKeyFingerprint(providerId, entry.key)) === true ||
                 (entry.exhaustedUntil !== undefined && entry.exhaustedUntil > now);
+            if (keys !== pool.keys)
+                this.data = { ...this.data, [providerId]: { ...pool, keys } };
+            // Another owner already selected a different credential. Retry it without
+            // replacing its selection or mirroring a stale failure over its auth.
+            if (!matchesRequest(current))
+                return isExhausted(current) ? null : current;
             for (let offset = 1; offset < keys.length; offset++) {
                 const candidate = keys[(currentIndex + offset) % keys.length];
                 if (!candidate || isExhausted(candidate))
                     continue;
                 this.data = { ...this.data, [providerId]: { active: candidate.id, keys } };
-                await this.persist();
                 await this.mirrorActive(providerId, candidate.key);
                 return candidate;
             }
-            // No alternative: keep the (now-exhausted) current key active, but still
-            // persist its exhaustion state when a reset time was recorded.
-            if (keys !== pool.keys) {
-                this.data = { ...this.data, [providerId]: { ...pool, keys } };
-                await this.persist();
-            }
+            // No alternative: keep the now-exhausted current key active.
             return null;
         });
     }
     /** Manual reactivate: clears persisted and process-local exhaustion for a key. */
     async clearExhaustion(providerId, id) {
         return this.enqueue(async () => {
-            this.memoryExhausted.get(providerId)?.delete(id);
             const pool = await this.ensurePool(providerId);
             if (!pool)
                 return;
             const target = pool.keys.find((entry) => entry.id === id);
+            if (target)
+                this.memoryExhausted.get(providerId)?.delete(subscriptionKeyFingerprint(providerId, target.key));
             if (!target || (target.exhaustedUntil === undefined && target.lastError === undefined))
                 return;
             const keys = pool.keys.map((entry) => {
@@ -252,7 +294,6 @@ export class SubscriptionManager {
                 return rest;
             });
             this.data = { ...this.data, [providerId]: { ...pool, keys } };
-            await this.persist();
         });
     }
 }

package/dist/core/subscriptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../src/core/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAA2B,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAChH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAkBpD,MAAM,OAAO,mBAAmB;IACvB,IAAI,GAAqB,EAAE,CAAC;IAC5B,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,CAAqB;IAC5B,WAAW,CAAkB;IACrC,2EAA2E;IACnE,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACpD,qEAAqE;IACrE,oEAAoE;IAC5D,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEzD,YAAoB,WAA4B,EAAE,OAA2B,EAAE;QAC9E,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAAA,CACvB;IAED,MAAM,CAAC,MAAM,CAAC,WAA4B,EAAE,IAAa,EAAuB;QAC/E,OAAO,IAAI,mBAAmB,CAC7B,WAAW,EACX,IAAI,sBAAsB,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAC7E,CAAC;IAAA,CACF;IAED,MAAM,CAAC,WAAW,CAAC,WAA4B,EAAE,OAA2B,EAAuB;QAClG,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAAA,CACrD;IAED,MAAM,CAAC,QAAQ,CAAC,WAA4B,EAAE,IAAI,GAAqB,EAAE,EAAuB;QAC/F,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAAA,CAC7D;IAEO,gBAAgB,CAAC,OAA2B,EAAoB;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB,CAAC;IAAA,CAC/C;IAEO,YAAY,GAAS;QAC5B,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAClC,OAAO,GAAG,OAAO,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAAA,CAC7B,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,gFAAgF;QACjF,CAAC;IAAA,CACD;IAEO,OAAO,CAAI,EAAoB,EAAc;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IAAA,CACZ;IAEO,OAAO,GAAkB;QAChC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;SACxC,CAAC,CAAC,CAAC;IAAA,CACJ;IAED,gGAAgG;IACxF,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAmC;QACpF,IAAI,OAA+B,CAAC;QACpC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;YAC/D,OAAO,GAAG,UAAU,CAAC;YACrB,OAAO,SAAS,CAAC;QAAA,CACjB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAAA,CACf;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAqC;QAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAErF,MAAM,IAAI,GAAiB;YAC1B,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IAAA,CACZ;IAEO,MAAM,CAAC,IAAkB,EAAU;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAAA,CACvB;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,GAAW,EAAiB;QAC1E,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAAA,CAClF;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAuB;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAA,CAClC,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAiC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QAAA,CAC5D,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,GAAW,EAAE,IAAa,EAAqB;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1C,MAAM,KAAK,GAAa,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC;QAAA,CACb,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAiB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,OAAO;YAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAEjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC1C,OAAO;YACR,CAAC;YAED,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACnB,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC;gBAC/B,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;gBAC3D,IAAI,QAAQ;oBAAE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChE,OAAO;YACR,CAAC;YAED,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAAA,CACrB,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAE,IAAY,EAAiB;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAAA,CACrB,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAiB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO;YAC5B,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAA,CAC/C,CAAC,CAAC;IAAA,CACH;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,YAAoB,EAAE,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,EAA4B;QACnH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9E,IAAI,YAAY,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACrB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9B,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAChG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBACtE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACpB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAW,EAAE,CAChD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI;gBAC5D,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC;YAEpE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9D,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACnD,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC3E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC9D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC;QAAA,CACZ,CAAC,CAAC;IAAA,CACH;IAED,kFAAkF;IAClF,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,EAAU,EAAiB;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;gBAAE,OAAO;YAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAClC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;gBAClF,OAAO,IAAI,CAAC;YAAA,CACZ,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAAA,CACrB,CAAC,CAAC;IAAA,CACH;CACD","sourcesContent":["/**\n * lunr: multi-subscription API-key pools per provider.\n *\n * The pool lives in subscriptions.json next to auth.json; auth.json always\n * holds the ACTIVE credential, so rotation is just mirroring the chosen pool\n * key into auth.json via AuthStorage.modify. Persistence reuses the\n * AuthStorage backend classes (proper-lockfile guarded read-modify-write,\n * mode 0600) pointed at the subscriptions.json path.\n *\n * Raw keys are never logged or embedded in error messages — errors refer to\n * provider and key ids only.\n */\n\nimport type { Credential, CredentialStore } from \"@ashx-j/lunr-ai\";\nimport { join } from \"path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend } from \"./auth-storage.ts\";\nimport { parseResetTimeMs } from \"./usage-limit.ts\";\n\nexport interface SubEntry {\n\tid: string;\n\tname: string;\n\tkey: string;\n\taddedAt: number;\n\texhaustedUntil?: number;\n\tlastError?: string;\n}\n\ninterface ProviderPool {\n\tactive: string;\n\tkeys: SubEntry[];\n}\n\ntype SubscriptionData = Record<string, ProviderPool>;\n\nexport class SubscriptionManager {\n\tprivate data: SubscriptionData = {};\n\tprivate loaded = false;\n\tprivate storage: AuthStorageBackend;\n\tprivate authStorage: CredentialStore;\n\t// In-process write queue so mutations serialize even before the file lock.\n\tprivate queue: Promise<unknown> = Promise.resolve();\n\t// Per-provider ids of keys exhausted without a parseable reset time.\n\t// Process-local on purpose: infinite exhaustion is never persisted.\n\tprivate memoryExhausted = new Map<string, Set<string>>();\n\n\tprivate constructor(authStorage: CredentialStore, storage: AuthStorageBackend) {\n\t\tthis.authStorage = authStorage;\n\t\tthis.storage = storage;\n\t}\n\n\tstatic create(authStorage: CredentialStore, path?: string): SubscriptionManager {\n\t\treturn new SubscriptionManager(\n\t\t\tauthStorage,\n\t\t\tnew FileAuthStorageBackend(path ?? join(getAgentDir(), \"subscriptions.json\")),\n\t\t);\n\t}\n\n\tstatic fromStorage(authStorage: CredentialStore, storage: AuthStorageBackend): SubscriptionManager {\n\t\treturn new SubscriptionManager(authStorage, storage);\n\t}\n\n\tstatic inMemory(authStorage: CredentialStore, data: SubscriptionData = {}): SubscriptionManager {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn SubscriptionManager.fromStorage(authStorage, storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): SubscriptionData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as SubscriptionData;\n\t}\n\n\tprivate ensureLoaded(): void {\n\t\tif (this.loaded) return;\n\t\tthis.loaded = true;\n\t\tlet content: string | undefined;\n\t\ttry {\n\t\t\tthis.storage.withLock((current) => {\n\t\t\t\tcontent = current;\n\t\t\t\treturn { result: undefined };\n\t\t\t});\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t} catch {\n\t\t\t// Preserve the empty snapshot; a malformed file is never overwritten by a load.\n\t\t}\n\t}\n\n\tprivate enqueue<T>(fn: () => Promise<T>): Promise<T> {\n\t\tconst next = this.queue.then(fn);\n\t\tthis.queue = next.catch(() => {});\n\t\treturn next;\n\t}\n\n\tprivate persist(): Promise<void> {\n\t\treturn this.storage.withLockAsync(async () => ({\n\t\t\tresult: undefined,\n\t\t\tnext: JSON.stringify(this.data, null, 2),\n\t\t}));\n\t}\n\n\t/** Raw stored credential read via the modify path (returning undefined leaves it unchanged). */\n\tprivate async readRawCredential(providerId: string): Promise<Credential | undefined> {\n\t\tlet current: Credential | undefined;\n\t\tawait this.authStorage.modify(providerId, async (credential) => {\n\t\t\tcurrent = credential;\n\t\t\treturn undefined;\n\t\t});\n\t\treturn current;\n\t}\n\n\t/**\n\t * Pool for a provider, lazy-importing an existing stored api_key credential\n\t * as \"Sub 1\" on first access. OAuth credentials are not imported.\n\t */\n\tprivate async ensurePool(providerId: string): Promise<ProviderPool | undefined> {\n\t\tthis.ensureLoaded();\n\t\tconst existing = this.data[providerId];\n\t\tif (existing) return existing;\n\n\t\tconst credential = await this.readRawCredential(providerId);\n\t\tif (credential?.type !== \"api_key\" || credential.key === undefined) return undefined;\n\n\t\tconst pool: ProviderPool = {\n\t\t\tactive: \"1\",\n\t\t\tkeys: [{ id: \"1\", name: \"Sub 1\", key: credential.key, addedAt: Date.now() }],\n\t\t};\n\t\tthis.data = { ...this.data, [providerId]: pool };\n\t\tawait this.persist();\n\t\treturn pool;\n\t}\n\n\tprivate nextId(pool: ProviderPool): string {\n\t\tlet max = 0;\n\t\tfor (const entry of pool.keys) {\n\t\t\tconst numeric = Number.parseInt(entry.id, 10);\n\t\t\tif (Number.isFinite(numeric) && numeric > max) max = numeric;\n\t\t}\n\t\treturn String(max + 1);\n\t}\n\n\tprivate async mirrorActive(providerId: string, key: string): Promise<void> {\n\t\tawait this.authStorage.modify(providerId, async () => ({ type: \"api_key\", key }));\n\t}\n\n\tasync list(providerId: string): Promise<SubEntry[]> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool ? [...pool.keys] : [];\n\t\t});\n\t}\n\n\tasync getActive(providerId: string): Promise<SubEntry | undefined> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool?.keys.find((entry) => entry.id === pool.active);\n\t\t});\n\t}\n\n\tasync addKey(providerId: string, key: string, name?: string): Promise<SubEntry> {\n\t\treturn this.enqueue(async () => {\n\t\t\tthis.ensureLoaded();\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst id = pool ? this.nextId(pool) : \"1\";\n\t\t\tconst entry: SubEntry = { id, name: name ?? `Sub ${id}`, key, addedAt: Date.now() };\n\t\t\tconst keys = [...(pool?.keys ?? []), entry];\n\t\t\tthis.data = { ...this.data, [providerId]: { active: id, keys } };\n\t\t\tawait this.persist();\n\t\t\tawait this.mirrorActive(providerId, key);\n\t\t\treturn entry;\n\t\t});\n\t}\n\n\tasync removeKey(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool || !pool.keys.some((entry) => entry.id === id)) return;\n\n\t\t\tconst keys = pool.keys.filter((entry) => entry.id !== id);\n\t\t\tthis.memoryExhausted.get(providerId)?.delete(id);\n\n\t\t\tif (keys.length === 0) {\n\t\t\t\tconst data = { ...this.data };\n\t\t\t\tdelete data[providerId];\n\t\t\t\tthis.data = data;\n\t\t\t\tawait this.persist();\n\t\t\t\tawait this.authStorage.delete(providerId);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tlet active = pool.active;\n\t\t\tif (active === id) {\n\t\t\t\tactive = keys[0]?.id ?? active;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t\t\tawait this.persist();\n\t\t\t\tconst promoted = keys.find((entry) => entry.id === active);\n\t\t\t\tif (promoted) await this.mirrorActive(providerId, promoted.key);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t\tawait this.persist();\n\t\t});\n\t}\n\n\tasync renameKey(providerId: string, id: string, name: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst keys = pool.keys.map((entry) => (entry.id === id ? { ...entry, name } : entry));\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\tawait this.persist();\n\t\t});\n\t}\n\n\tasync setActive(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst entry = pool?.keys.find((candidate) => candidate.id === id);\n\t\t\tif (!pool || !entry) return;\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, active: id } };\n\t\t\tawait this.persist();\n\t\t\tawait this.mirrorActive(providerId, entry.key);\n\t\t});\n\t}\n\n\t/**\n\t * Mark the active key exhausted and rotate to the next non-exhausted key in\n\t * round-robin order. A parseable reset time is persisted as exhaustedUntil;\n\t * otherwise the exhaustion is process-local only. Returns the new active key,\n\t * or null when no non-exhausted alternative exists (current key stays active).\n\t */\n\tasync rotateOnFailure(providerId: string, errorMessage: string, now: number = Date.now()): Promise<SubEntry | null> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return null;\n\t\t\tconst currentIndex = pool.keys.findIndex((entry) => entry.id === pool.active);\n\t\t\tif (currentIndex === -1) return null;\n\t\t\tconst current = pool.keys[currentIndex];\n\t\t\tif (!current) return null;\n\n\t\t\tconst resetAt = parseResetTimeMs(errorMessage);\n\t\t\tlet keys = pool.keys;\n\t\t\tif (resetAt !== undefined && resetAt > now) {\n\t\t\t\tkeys = pool.keys.map((entry) =>\n\t\t\t\t\tentry.id === current.id ? { ...entry, exhaustedUntil: resetAt, lastError: errorMessage } : entry,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst set = this.memoryExhausted.get(providerId) ?? new Set<string>();\n\t\t\t\tset.add(current.id);\n\t\t\t\tthis.memoryExhausted.set(providerId, set);\n\t\t\t}\n\n\t\t\tconst isExhausted = (entry: SubEntry): boolean =>\n\t\t\t\tthis.memoryExhausted.get(providerId)?.has(entry.id) === true ||\n\t\t\t\t(entry.exhaustedUntil !== undefined && entry.exhaustedUntil > now);\n\n\t\t\tfor (let offset = 1; offset < keys.length; offset++) {\n\t\t\t\tconst candidate = keys[(currentIndex + offset) % keys.length];\n\t\t\t\tif (!candidate || isExhausted(candidate)) continue;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active: candidate.id, keys } };\n\t\t\t\tawait this.persist();\n\t\t\t\tawait this.mirrorActive(providerId, candidate.key);\n\t\t\t\treturn candidate;\n\t\t\t}\n\n\t\t\t// No alternative: keep the (now-exhausted) current key active, but still\n\t\t\t// persist its exhaustion state when a reset time was recorded.\n\t\t\tif (keys !== pool.keys) {\n\t\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\t\tawait this.persist();\n\t\t\t}\n\t\t\treturn null;\n\t\t});\n\t}\n\n\t/** Manual reactivate: clears persisted and process-local exhaustion for a key. */\n\tasync clearExhaustion(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tthis.memoryExhausted.get(providerId)?.delete(id);\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst target = pool.keys.find((entry) => entry.id === id);\n\t\t\tif (!target || (target.exhaustedUntil === undefined && target.lastError === undefined)) return;\n\t\t\tconst keys = pool.keys.map((entry) => {\n\t\t\t\tif (entry.id !== id) return entry;\n\t\t\t\tconst { exhaustedUntil: _exhaustedUntil, lastError: _lastError, ...rest } = entry;\n\t\t\t\treturn rest;\n\t\t\t});\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\tawait this.persist();\n\t\t});\n\t}\n}\n"]}
+{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../src/core/subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAA2B,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAChH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAuBzD,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CAAC,UAAkB,EAAE,GAAW,EAAU;IACnF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACtF;AAED,MAAM,OAAO,mBAAmB;IACvB,IAAI,GAAqB,EAAE,CAAC;IAC5B,OAAO,CAAqB;IAC5B,WAAW,CAAkB;IACrC,2EAA2E;IACnE,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IACpD,sEAAsE;IACtE,oEAAoE;IAC5D,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEzD,YAAoB,WAA4B,EAAE,OAA2B,EAAE;QAC9E,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAAA,CACvB;IAED,MAAM,CAAC,MAAM,CAAC,WAA4B,EAAE,IAAa,EAAuB;QAC/E,OAAO,IAAI,mBAAmB,CAC7B,WAAW,EACX,IAAI,sBAAsB,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAC7E,CAAC;IAAA,CACF;IAED,MAAM,CAAC,WAAW,CAAC,WAA4B,EAAE,OAA2B,EAAuB;QAClG,OAAO,IAAI,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAAA,CACrD;IAED,MAAM,CAAC,QAAQ,CAAC,WAA4B,EAAE,IAAI,GAAqB,EAAE,EAAuB;QAC/F,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAAA,CAC7D;IAEO,gBAAgB,CAAC,OAA2B,EAAoB;QACvE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACtF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAiC,CAAC,EAAE,CAAC;gBACtE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC3D,MAAM,IAAI,GAAG,KAAgC,CAAC;gBAC9C,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAiB,EAAE,CAAC;oBAC5C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC3D,MAAM,KAAK,GAAG,KAAgC,CAAC;oBAC/C,IACC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;wBAC5B,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACjB,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;wBAC9B,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;wBAC7B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;wBACjC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;wBAC/B,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;4BAClC,CAAC,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;wBACtF,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;wBAEtE,MAAM,IAAI,KAAK,EAAE,CAAC;oBACnB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,MAA0B,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAChG,CAAC;IAAA,CACD;IAED;;;;;OAKG;IACK,OAAO,CAAI,EAAoB,EAAc;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CACjC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAAA,CAC9D,CAAC,CACF,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IAAA,CACZ;IAED,gGAAgG;IACxF,KAAK,CAAC,iBAAiB,CAAC,UAAkB,EAAmC;QACpF,IAAI,OAA+B,CAAC;QACpC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;YAC/D,OAAO,GAAG,UAAU,CAAC;YACrB,OAAO,SAAS,CAAC;QAAA,CACjB,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAAA,CACf;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAqC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAErF,MAAM,IAAI,GAAiB;YAC1B,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;SAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IAAA,CACZ;IAEO,MAAM,CAAC,IAAkB,EAAU;QAC1C,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG;gBAAE,GAAG,GAAG,OAAO,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAAA,CACvB;IAEO,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,GAAW,EAAiB;QAC1E,mBAAmB,EAAE,CAAC;QACtB,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC7D,IAAI,EAAE,SAAS;gBACf,GAAG;gBACH,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACV,mBAAmB,EAAE,CAAC;QACvB,CAAC;IAAA,CACD;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAuB;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAA,CAClC,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAiC;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,OAAO,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;QAAA,CAC5D,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,GAAW,EAAE,IAAa,EAAqB;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1C,MAAM,KAAK,GAAa,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC;QAAA,CACb,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAiB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,OAAO;YAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACnG,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,mBAAmB,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACJ,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC3C,CAAC;wBAAS,CAAC;oBACV,mBAAmB,EAAE,CAAC;gBACvB,CAAC;gBACD,OAAO;YACR,CAAC;YAED,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACzB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACnB,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC;gBAC/B,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;gBAC3D,IAAI,QAAQ;oBAAE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChE,OAAO;YACR,CAAC;YAED,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAAA,CAC7D,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAE,IAAY,EAAiB;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAAA,CAC9D,CAAC,CAAC;IAAA,CACH;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,EAAU,EAAiB;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAO;YAC5B,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAAA,CAC/C,CAAC,CAAC;IAAA,CACH;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CACpB,UAAkB,EAClB,YAAoB,EACpB,kBAAsC,EACtC,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,EACG;QAC3B,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9E,IAAI,YAAY,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,cAAc,GAAG,CAAC,KAAe,EAAW,EAAE,CACnD,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,kBAAkB,CAAC;YAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAAE,OAAO,IAAI,CAAC;YAE7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACrB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBAC5C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9B,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAC9F,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;gBACtE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC5B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,KAAe,EAAW,EAAE,CAChD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBACrG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC;YAEpE,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACtF,0EAA0E;YAC1E,sEAAsE;YACtE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;gBAAE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAE3E,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;gBACrD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9D,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS,CAAC;oBAAE,SAAS;gBACnD,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC3E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnD,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,6DAA6D;YAC7D,OAAO,IAAI,CAAC;QAAA,CACZ,CAAC,CAAC;IAAA,CACH;IAED,kFAAkF;IAClF,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,EAAU,EAAiB;QACpE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1D,IAAI,MAAM;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,0BAA0B,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7G,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;gBAAE,OAAO;YAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE;oBAAE,OAAO,KAAK,CAAC;gBAClC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;gBAClF,OAAO,IAAI,CAAC;YAAA,CACZ,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;QAAA,CAC9D,CAAC,CAAC;IAAA,CACH;CACD","sourcesContent":["/**\n * lunr: multi-subscription API-key pools per provider.\n *\n * The pool lives in subscriptions.json next to auth.json; auth.json always\n * holds the ACTIVE credential, so rotation is just mirroring the chosen pool\n * key into auth.json via AuthStorage.modify. Persistence reuses the\n * AuthStorage backend classes (proper-lockfile guarded read-modify-write,\n * mode 0600) pointed at the subscriptions.json path.\n *\n * Raw keys are never logged or embedded in error messages — errors refer to\n * provider and key ids only.\n */\n\nimport { createHash } from \"node:crypto\";\nimport type { Credential, CredentialStore } from \"@ashx-j/lunr-ai\";\nimport { join } from \"path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend, InMemoryAuthStorageBackend } from \"./auth-storage.ts\";\nimport { parseResetTimeMs } from \"./usage-limit.ts\";\nimport { clearPlanUsageCache } from \"./usage-service.ts\";\n\nexport interface SubEntry {\n\tid: string;\n\tname: string;\n\tkey: string;\n\taddedAt: number;\n\texhaustedUntil?: number;\n\tlastError?: string;\n}\n\ninterface ProviderPool {\n\tactive: string;\n\tkeys: SubEntry[];\n}\n\ntype SubscriptionData = Record<string, ProviderPool>;\n\nexport interface RequestSubscriptionKey {\n\tproviderId: string;\n\tfingerprint: string;\n}\n\n/** Request identities are non-secret digests kept outside messages and storage. */\nexport function subscriptionKeyFingerprint(providerId: string, key: string): string {\n\treturn createHash(\"sha256\").update(providerId).update(\"\\0\").update(key).digest(\"hex\");\n}\n\nexport class SubscriptionManager {\n\tprivate data: SubscriptionData = {};\n\tprivate storage: AuthStorageBackend;\n\tprivate authStorage: CredentialStore;\n\t// In-process write queue so mutations serialize even before the file lock.\n\tprivate queue: Promise<unknown> = Promise.resolve();\n\t// Per-provider fingerprints exhausted without a parseable reset time.\n\t// Process-local on purpose: infinite exhaustion is never persisted.\n\tprivate memoryExhausted = new Map<string, Set<string>>();\n\n\tprivate constructor(authStorage: CredentialStore, storage: AuthStorageBackend) {\n\t\tthis.authStorage = authStorage;\n\t\tthis.storage = storage;\n\t}\n\n\tstatic create(authStorage: CredentialStore, path?: string): SubscriptionManager {\n\t\treturn new SubscriptionManager(\n\t\t\tauthStorage,\n\t\t\tnew FileAuthStorageBackend(path ?? join(getAgentDir(), \"subscriptions.json\")),\n\t\t);\n\t}\n\n\tstatic fromStorage(authStorage: CredentialStore, storage: AuthStorageBackend): SubscriptionManager {\n\t\treturn new SubscriptionManager(authStorage, storage);\n\t}\n\n\tstatic inMemory(authStorage: CredentialStore, data: SubscriptionData = {}): SubscriptionManager {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn SubscriptionManager.fromStorage(authStorage, storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): SubscriptionData {\n\t\tif (content === undefined) return {};\n\t\ttry {\n\t\t\tconst parsed: unknown = JSON.parse(content);\n\t\t\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) throw new Error();\n\t\t\tfor (const value of Object.values(parsed as Record<string, unknown>)) {\n\t\t\t\tif (!value || typeof value !== \"object\") throw new Error();\n\t\t\t\tconst pool = value as Record<string, unknown>;\n\t\t\t\tif (typeof pool.active !== \"string\" || !Array.isArray(pool.keys)) throw new Error();\n\t\t\t\tconst ids = new Set<string>();\n\t\t\t\tfor (const value of pool.keys as unknown[]) {\n\t\t\t\t\tif (!value || typeof value !== \"object\") throw new Error();\n\t\t\t\t\tconst entry = value as Record<string, unknown>;\n\t\t\t\t\tif (\n\t\t\t\t\t\ttypeof entry.id !== \"string\" ||\n\t\t\t\t\t\tids.has(entry.id) ||\n\t\t\t\t\t\ttypeof entry.name !== \"string\" ||\n\t\t\t\t\t\ttypeof entry.key !== \"string\" ||\n\t\t\t\t\t\ttypeof entry.addedAt !== \"number\" ||\n\t\t\t\t\t\t!Number.isFinite(entry.addedAt) ||\n\t\t\t\t\t\t(entry.exhaustedUntil !== undefined &&\n\t\t\t\t\t\t\t(typeof entry.exhaustedUntil !== \"number\" || !Number.isFinite(entry.exhaustedUntil))) ||\n\t\t\t\t\t\t(entry.lastError !== undefined && typeof entry.lastError !== \"string\")\n\t\t\t\t\t)\n\t\t\t\t\t\tthrow new Error();\n\t\t\t\t\tids.add(entry.id);\n\t\t\t\t}\n\t\t\t\tif (!ids.has(pool.active)) throw new Error();\n\t\t\t}\n\t\t\treturn parsed as SubscriptionData;\n\t\t} catch {\n\t\t\tthrow new Error(\"Subscription storage is malformed. Repair it before changing subscriptions.\");\n\t\t}\n\t}\n\n\t/**\n\t * Lock order is subscriptions then auth. Keep selection and its auth mirror\n\t * under the subscription lock so later selectors cannot overtake a mirror.\n\t * These files are not an atomic commit: a failed mirror aborts the pool write;\n\t * a later pool write failure can leave auth ahead and a repeated selection repairs it.\n\t */\n\tprivate enqueue<T>(fn: () => Promise<T>): Promise<T> {\n\t\tconst next = this.queue.then(() =>\n\t\t\tthis.storage.withLockAsync(async (current) => {\n\t\t\t\tthis.data = this.parseStorageData(current);\n\t\t\t\tconst before = JSON.stringify(this.data, null, 2);\n\t\t\t\tconst result = await fn();\n\t\t\t\tconst after = JSON.stringify(this.data, null, 2);\n\t\t\t\treturn { result, next: before === after ? undefined : after };\n\t\t\t}),\n\t\t);\n\t\tthis.queue = next.catch(() => {});\n\t\treturn next;\n\t}\n\n\t/** Raw stored credential read via the modify path (returning undefined leaves it unchanged). */\n\tprivate async readRawCredential(providerId: string): Promise<Credential | undefined> {\n\t\tlet current: Credential | undefined;\n\t\tawait this.authStorage.modify(providerId, async (credential) => {\n\t\t\tcurrent = credential;\n\t\t\treturn undefined;\n\t\t});\n\t\treturn current;\n\t}\n\n\t/**\n\t * Pool for a provider, lazy-importing an existing stored api_key credential\n\t * as \"Sub 1\" on first access. OAuth credentials are not imported.\n\t */\n\tprivate async ensurePool(providerId: string): Promise<ProviderPool | undefined> {\n\t\tconst existing = this.data[providerId];\n\t\tif (existing) return existing;\n\n\t\tconst credential = await this.readRawCredential(providerId);\n\t\tif (credential?.type !== \"api_key\" || credential.key === undefined) return undefined;\n\n\t\tconst pool: ProviderPool = {\n\t\t\tactive: \"1\",\n\t\t\tkeys: [{ id: \"1\", name: \"Sub 1\", key: credential.key, addedAt: Date.now() }],\n\t\t};\n\t\tthis.data = { ...this.data, [providerId]: pool };\n\t\treturn pool;\n\t}\n\n\tprivate nextId(pool: ProviderPool): string {\n\t\tlet max = 0;\n\t\tfor (const entry of pool.keys) {\n\t\t\tconst numeric = Number.parseInt(entry.id, 10);\n\t\t\tif (Number.isFinite(numeric) && numeric > max) max = numeric;\n\t\t}\n\t\treturn String(max + 1);\n\t}\n\n\tprivate async mirrorActive(providerId: string, key: string): Promise<void> {\n\t\tclearPlanUsageCache();\n\t\ttry {\n\t\t\tawait this.authStorage.modify(providerId, async (current) => ({\n\t\t\t\ttype: \"api_key\",\n\t\t\t\tkey,\n\t\t\t\t...(current?.type === \"api_key\" && current.env ? { env: current.env } : {}),\n\t\t\t}));\n\t\t} finally {\n\t\t\tclearPlanUsageCache();\n\t\t}\n\t}\n\n\tasync list(providerId: string): Promise<SubEntry[]> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool ? [...pool.keys] : [];\n\t\t});\n\t}\n\n\tasync getActive(providerId: string): Promise<SubEntry | undefined> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\treturn pool?.keys.find((entry) => entry.id === pool.active);\n\t\t});\n\t}\n\n\tasync addKey(providerId: string, key: string, name?: string): Promise<SubEntry> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst id = pool ? this.nextId(pool) : \"1\";\n\t\t\tconst entry: SubEntry = { id, name: name ?? `Sub ${id}`, key, addedAt: Date.now() };\n\t\t\tconst keys = [...(pool?.keys ?? []), entry];\n\t\t\tthis.data = { ...this.data, [providerId]: { active: id, keys } };\n\t\t\tawait this.mirrorActive(providerId, key);\n\t\t\treturn entry;\n\t\t});\n\t}\n\n\tasync removeKey(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool || !pool.keys.some((entry) => entry.id === id)) return;\n\n\t\t\tconst keys = pool.keys.filter((entry) => entry.id !== id);\n\t\t\tconst removed = pool.keys.find((entry) => entry.id === id)!;\n\t\t\tif (!keys.some((entry) => entry.key === removed.key)) {\n\t\t\t\tthis.memoryExhausted.get(providerId)?.delete(subscriptionKeyFingerprint(providerId, removed.key));\n\t\t\t}\n\n\t\t\tif (keys.length === 0) {\n\t\t\t\tconst data = { ...this.data };\n\t\t\t\tdelete data[providerId];\n\t\t\t\tthis.data = data;\n\t\t\t\tclearPlanUsageCache();\n\t\t\t\ttry {\n\t\t\t\t\tawait this.authStorage.delete(providerId);\n\t\t\t\t} finally {\n\t\t\t\t\tclearPlanUsageCache();\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tlet active = pool.active;\n\t\t\tif (active === id) {\n\t\t\t\tactive = keys[0]?.id ?? active;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t\t\tconst promoted = keys.find((entry) => entry.id === active);\n\t\t\t\tif (promoted) await this.mirrorActive(providerId, promoted.key);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tthis.data = { ...this.data, [providerId]: { active, keys } };\n\t\t});\n\t}\n\n\tasync renameKey(providerId: string, id: string, name: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst keys = pool.keys.map((entry) => (entry.id === id ? { ...entry, name } : entry));\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t});\n\t}\n\n\tasync setActive(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tconst entry = pool?.keys.find((candidate) => candidate.id === id);\n\t\t\tif (!pool || !entry) return;\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, active: id } };\n\t\t\tawait this.mirrorActive(providerId, entry.key);\n\t\t});\n\t}\n\n\t/**\n\t * Mark the request's key exhausted and rotate to the next non-exhausted key in\n\t * round-robin order. A parseable reset time is persisted as exhaustedUntil;\n\t * otherwise the exhaustion is process-local only. A later selection is preserved.\n\t * Returns the usable active key for retry, or null when no alternative exists.\n\t */\n\tasync rotateOnFailure(\n\t\tproviderId: string,\n\t\terrorMessage: string,\n\t\trequestFingerprint: string | undefined,\n\t\tnow: number = Date.now(),\n\t): Promise<SubEntry | null> {\n\t\tif (!requestFingerprint) return null;\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = this.data[providerId];\n\t\t\tif (!pool || pool.keys.length < 2) return null;\n\t\t\tconst currentIndex = pool.keys.findIndex((entry) => entry.id === pool.active);\n\t\t\tif (currentIndex === -1) return null;\n\t\t\tconst current = pool.keys[currentIndex];\n\t\t\tconst matchesRequest = (entry: SubEntry): boolean =>\n\t\t\t\tsubscriptionKeyFingerprint(providerId, entry.key) === requestFingerprint;\n\t\t\tif (!current || !pool.keys.some(matchesRequest)) return null;\n\n\t\t\tconst resetAt = parseResetTimeMs(errorMessage);\n\t\t\tlet keys = pool.keys;\n\t\t\tif (resetAt !== undefined && resetAt > now) {\n\t\t\t\tkeys = pool.keys.map((entry) =>\n\t\t\t\t\tmatchesRequest(entry) ? { ...entry, exhaustedUntil: resetAt, lastError: errorMessage } : entry,\n\t\t\t\t);\n\t\t\t} else {\n\t\t\t\tconst set = this.memoryExhausted.get(providerId) ?? new Set<string>();\n\t\t\t\tset.add(requestFingerprint);\n\t\t\t\tthis.memoryExhausted.set(providerId, set);\n\t\t\t}\n\n\t\t\tconst isExhausted = (entry: SubEntry): boolean =>\n\t\t\t\tthis.memoryExhausted.get(providerId)?.has(subscriptionKeyFingerprint(providerId, entry.key)) === true ||\n\t\t\t\t(entry.exhaustedUntil !== undefined && entry.exhaustedUntil > now);\n\n\t\t\tif (keys !== pool.keys) this.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t\t// Another owner already selected a different credential. Retry it without\n\t\t\t// replacing its selection or mirroring a stale failure over its auth.\n\t\t\tif (!matchesRequest(current)) return isExhausted(current) ? null : current;\n\n\t\t\tfor (let offset = 1; offset < keys.length; offset++) {\n\t\t\t\tconst candidate = keys[(currentIndex + offset) % keys.length];\n\t\t\t\tif (!candidate || isExhausted(candidate)) continue;\n\t\t\t\tthis.data = { ...this.data, [providerId]: { active: candidate.id, keys } };\n\t\t\t\tawait this.mirrorActive(providerId, candidate.key);\n\t\t\t\treturn candidate;\n\t\t\t}\n\n\t\t\t// No alternative: keep the now-exhausted current key active.\n\t\t\treturn null;\n\t\t});\n\t}\n\n\t/** Manual reactivate: clears persisted and process-local exhaustion for a key. */\n\tasync clearExhaustion(providerId: string, id: string): Promise<void> {\n\t\treturn this.enqueue(async () => {\n\t\t\tconst pool = await this.ensurePool(providerId);\n\t\t\tif (!pool) return;\n\t\t\tconst target = pool.keys.find((entry) => entry.id === id);\n\t\t\tif (target) this.memoryExhausted.get(providerId)?.delete(subscriptionKeyFingerprint(providerId, target.key));\n\t\t\tif (!target || (target.exhaustedUntil === undefined && target.lastError === undefined)) return;\n\t\t\tconst keys = pool.keys.map((entry) => {\n\t\t\t\tif (entry.id !== id) return entry;\n\t\t\t\tconst { exhaustedUntil: _exhaustedUntil, lastError: _lastError, ...rest } = entry;\n\t\t\t\treturn rest;\n\t\t\t});\n\t\t\tthis.data = { ...this.data, [providerId]: { ...pool, keys } };\n\t\t});\n\t}\n}\n"]}

package/dist/core/trust-manager.d.ts

@@ -19,7 +19,8 @@ export declare function getProjectTrustOptions(cwd: string, options?: {
 }): ProjectTrustOption[];
 /**
  * Returns true when cwd has project-local resources that must be gated by
- * project trust: trust-requiring entries under cwd/.pi, or .agents/skills in
+ * project trust: settings/resources under cwd/.lunr, executable integration
+ * configuration, or .agents/skills in
  * cwd or one of its ancestors. Returns false when no such project resources
  * exist. The user/global ~/.agents/skills directory is always treated as a
  * trusted user resource and is ignored here, even when cwd is $HOME.

package/dist/core/trust-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trust-manager.d.ts","sourceRoot":"","sources":["../../src/core/trust-manager.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,IAAI,CAAC;AAElD,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAkCD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,kBAAkB,EAAE,CA8BpH;AAkFD;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAsBtE;AAED,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,SAAS,CAAS;IAE1B,YAAY,QAAQ,EAAE,MAAM,EAE3B;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAErC;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAKnD;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAErD;IAED,OAAO,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAa7C;CACD","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport lockfile from \"proper-lockfile\";\nimport { CONFIG_DIR_NAME } from \"../config.ts\";\nimport { canonicalizePath, resolvePath } from \"../utils/paths.ts\";\n\nexport type ProjectTrustDecision = boolean | null;\n\nexport interface ProjectTrustStoreEntry {\n\tpath: string;\n\tdecision: boolean;\n}\n\nexport interface ProjectTrustUpdate {\n\tpath: string;\n\tdecision: ProjectTrustDecision;\n}\n\nexport interface ProjectTrustOption {\n\tlabel: string;\n\ttrusted: boolean;\n\tupdates: ProjectTrustUpdate[];\n\tsavedPath?: string;\n}\n\ntype TrustFile = Record<string, boolean | null | undefined>;\n\nconst TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [\n\t\"settings.json\",\n\t\"extensions\",\n\t\"skills\",\n\t\"prompts\",\n\t\"themes\",\n\t\"SYSTEM.md\",\n\t\"APPEND_SYSTEM.md\",\n] as const;\n\nfunction normalizeCwd(cwd: string): string {\n\treturn canonicalizePath(resolvePath(cwd));\n}\n\nfunction findNearestTrustEntry(data: TrustFile, cwd: string): ProjectTrustStoreEntry | null {\n\tlet currentDir = normalizeCwd(cwd);\n\twhile (true) {\n\t\tconst value = data[currentDir];\n\t\tif (value === true || value === false) {\n\t\t\treturn { path: currentDir, decision: value };\n\t\t}\n\n\t\tconst parentDir = dirname(currentDir);\n\t\tif (parentDir === currentDir) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrentDir = parentDir;\n\t}\n}\n\nexport function getProjectTrustParentPath(cwd: string): string | undefined {\n\tconst trustPath = normalizeCwd(cwd);\n\tconst parentDir = dirname(trustPath);\n\treturn parentDir === trustPath ? undefined : parentDir;\n}\n\nexport function getProjectTrustOptions(cwd: string, options?: { includeSessionOnly?: boolean }): ProjectTrustOption[] {\n\tconst trustPath = normalizeCwd(cwd);\n\tconst trustOptions: ProjectTrustOption[] = [\n\t\t{ label: \"Trust\", trusted: true, updates: [{ path: trustPath, decision: true }], savedPath: trustPath },\n\t];\n\tconst parentPath = getProjectTrustParentPath(cwd);\n\tif (parentPath !== undefined) {\n\t\ttrustOptions.push({\n\t\t\tlabel: `Trust parent folder (${parentPath})`,\n\t\t\ttrusted: true,\n\t\t\tupdates: [\n\t\t\t\t{ path: parentPath, decision: true },\n\t\t\t\t{ path: trustPath, decision: null },\n\t\t\t],\n\t\t\tsavedPath: parentPath,\n\t\t});\n\t}\n\tif (options?.includeSessionOnly) {\n\t\ttrustOptions.push({ label: \"Trust (this session only)\", trusted: true, updates: [] });\n\t}\n\ttrustOptions.push({\n\t\tlabel: \"Do not trust\",\n\t\ttrusted: false,\n\t\tupdates: [{ path: trustPath, decision: false }],\n\t\tsavedPath: trustPath,\n\t});\n\tif (options?.includeSessionOnly) {\n\t\ttrustOptions.push({ label: \"Do not trust (this session only)\", trusted: false, updates: [] });\n\t}\n\treturn trustOptions;\n}\n\nfunction readTrustFile(path: string): TrustFile {\n\tif (!existsSync(path)) {\n\t\treturn {};\n\t}\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tthrow new Error(`Failed to read trust store ${path}: ${message}`);\n\t}\n\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\tthrow new Error(`Invalid trust store ${path}: expected an object`);\n\t}\n\n\tconst data: TrustFile = {};\n\tfor (const [key, value] of Object.entries(parsed)) {\n\t\tif (value !== true && value !== false && value !== null) {\n\t\t\tthrow new Error(`Invalid trust store ${path}: value for ${JSON.stringify(key)} must be true, false, or null`);\n\t\t}\n\t\tdata[key] = value;\n\t}\n\treturn data;\n}\n\nfunction writeTrustFile(path: string, data: TrustFile): void {\n\tconst sorted: TrustFile = {};\n\tfor (const key of Object.keys(data).sort()) {\n\t\tconst value = data[key];\n\t\tif (value === true || value === false || value === null) {\n\t\t\tsorted[key] = value;\n\t\t}\n\t}\n\tmkdirSync(dirname(path), { recursive: true });\n\twriteFileSync(path, `${JSON.stringify(sorted, null, 2)}\\n`, \"utf-8\");\n}\n\nfunction acquireTrustLockSync(path: string): () => void {\n\tconst trustDir = dirname(path);\n\tmkdirSync(trustDir, { recursive: true });\n\tconst maxAttempts = 10;\n\tconst delayMs = 20;\n\tlet lastError: unknown;\n\n\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\ttry {\n\t\t\treturn lockfile.lockSync(trustDir, { realpath: false, lockfilePath: `${path}.lock` });\n\t\t} catch (error) {\n\t\t\tconst code =\n\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t: undefined;\n\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tlastError = error;\n\t\t\tconst start = Date.now();\n\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t// Sleep synchronously to avoid changing trust store callers to async.\n\t\t\t}\n\t\t}\n\t}\n\n\tif (lastError instanceof Error) {\n\t\tthrow lastError;\n\t}\n\tthrow new Error(\"Failed to acquire trust store lock\");\n}\n\nfunction withTrustFileLock<T>(path: string, fn: () => T): T {\n\tconst release = acquireTrustLockSync(path);\n\ttry {\n\t\treturn fn();\n\t} finally {\n\t\trelease();\n\t}\n}\n\n/**\n * Returns true when cwd has project-local resources that must be gated by\n * project trust: trust-requiring entries under cwd/.pi, or .agents/skills in\n * cwd or one of its ancestors. Returns false when no such project resources\n * exist. The user/global ~/.agents/skills directory is always treated as a\n * trusted user resource and is ignored here, even when cwd is $HOME.\n */\nexport function hasTrustRequiringProjectResources(cwd: string): boolean {\n\tconst homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));\n\tconst userAgentsSkillsDir = join(homeDir, \".agents\", \"skills\");\n\tlet currentDir = canonicalizePath(resolvePath(cwd));\n\n\tconst configDir = join(currentDir, CONFIG_DIR_NAME);\n\tif (TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry)))) {\n\t\treturn true;\n\t}\n\n\twhile (true) {\n\t\tconst agentsSkillsDir = join(currentDir, \".agents\", \"skills\");\n\t\tif (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst parentDir = dirname(currentDir);\n\t\tif (parentDir === currentDir) {\n\t\t\treturn false;\n\t\t}\n\t\tcurrentDir = parentDir;\n\t}\n}\n\nexport class ProjectTrustStore {\n\tprivate trustPath: string;\n\n\tconstructor(agentDir: string) {\n\t\tthis.trustPath = join(resolvePath(agentDir), \"trust.json\");\n\t}\n\n\tget(cwd: string): ProjectTrustDecision {\n\t\treturn this.getEntry(cwd)?.decision ?? null;\n\t}\n\n\tgetEntry(cwd: string): ProjectTrustStoreEntry | null {\n\t\treturn withTrustFileLock(this.trustPath, () => {\n\t\t\tconst data = readTrustFile(this.trustPath);\n\t\t\treturn findNearestTrustEntry(data, cwd);\n\t\t});\n\t}\n\n\tset(cwd: string, decision: ProjectTrustDecision): void {\n\t\tthis.setMany([{ path: cwd, decision }]);\n\t}\n\n\tsetMany(decisions: ProjectTrustUpdate[]): void {\n\t\twithTrustFileLock(this.trustPath, () => {\n\t\t\tconst data = readTrustFile(this.trustPath);\n\t\t\tfor (const { path, decision } of decisions) {\n\t\t\t\tconst key = normalizeCwd(path);\n\t\t\t\tif (decision === null) {\n\t\t\t\t\tdelete data[key];\n\t\t\t\t} else {\n\t\t\t\t\tdata[key] = decision;\n\t\t\t\t}\n\t\t\t}\n\t\t\twriteTrustFile(this.trustPath, data);\n\t\t});\n\t}\n}\n"]}
+{"version":3,"file":"trust-manager.d.ts","sourceRoot":"","sources":["../../src/core/trust-manager.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,IAAI,CAAC;AAElD,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAmCD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,kBAAkB,EAAE,CA8BpH;AAkFD;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA6BtE;AAED,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,SAAS,CAAS;IAE1B,YAAY,QAAQ,EAAE,MAAM,EAE3B;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAErC;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAKnD;IAED,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAErD;IAED,OAAO,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAa7C;CACD","sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nimport lockfile from \"proper-lockfile\";\nimport { CONFIG_DIR_NAME } from \"../config.ts\";\nimport { canonicalizePath, resolvePath } from \"../utils/paths.ts\";\n\nexport type ProjectTrustDecision = boolean | null;\n\nexport interface ProjectTrustStoreEntry {\n\tpath: string;\n\tdecision: boolean;\n}\n\nexport interface ProjectTrustUpdate {\n\tpath: string;\n\tdecision: ProjectTrustDecision;\n}\n\nexport interface ProjectTrustOption {\n\tlabel: string;\n\ttrusted: boolean;\n\tupdates: ProjectTrustUpdate[];\n\tsavedPath?: string;\n}\n\ntype TrustFile = Record<string, boolean | null | undefined>;\n\nconst TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [\n\t\"settings.json\",\n\t\"mcp.json\",\n\t\"extensions\",\n\t\"skills\",\n\t\"prompts\",\n\t\"themes\",\n\t\"SYSTEM.md\",\n\t\"APPEND_SYSTEM.md\",\n] as const;\n\nfunction normalizeCwd(cwd: string): string {\n\treturn canonicalizePath(resolvePath(cwd));\n}\n\nfunction findNearestTrustEntry(data: TrustFile, cwd: string): ProjectTrustStoreEntry | null {\n\tlet currentDir = normalizeCwd(cwd);\n\twhile (true) {\n\t\tconst value = data[currentDir];\n\t\tif (value === true || value === false) {\n\t\t\treturn { path: currentDir, decision: value };\n\t\t}\n\n\t\tconst parentDir = dirname(currentDir);\n\t\tif (parentDir === currentDir) {\n\t\t\treturn null;\n\t\t}\n\t\tcurrentDir = parentDir;\n\t}\n}\n\nexport function getProjectTrustParentPath(cwd: string): string | undefined {\n\tconst trustPath = normalizeCwd(cwd);\n\tconst parentDir = dirname(trustPath);\n\treturn parentDir === trustPath ? undefined : parentDir;\n}\n\nexport function getProjectTrustOptions(cwd: string, options?: { includeSessionOnly?: boolean }): ProjectTrustOption[] {\n\tconst trustPath = normalizeCwd(cwd);\n\tconst trustOptions: ProjectTrustOption[] = [\n\t\t{ label: \"Trust\", trusted: true, updates: [{ path: trustPath, decision: true }], savedPath: trustPath },\n\t];\n\tconst parentPath = getProjectTrustParentPath(cwd);\n\tif (parentPath !== undefined) {\n\t\ttrustOptions.push({\n\t\t\tlabel: `Trust parent folder (${parentPath})`,\n\t\t\ttrusted: true,\n\t\t\tupdates: [\n\t\t\t\t{ path: parentPath, decision: true },\n\t\t\t\t{ path: trustPath, decision: null },\n\t\t\t],\n\t\t\tsavedPath: parentPath,\n\t\t});\n\t}\n\tif (options?.includeSessionOnly) {\n\t\ttrustOptions.push({ label: \"Trust (this session only)\", trusted: true, updates: [] });\n\t}\n\ttrustOptions.push({\n\t\tlabel: \"Do not trust\",\n\t\ttrusted: false,\n\t\tupdates: [{ path: trustPath, decision: false }],\n\t\tsavedPath: trustPath,\n\t});\n\tif (options?.includeSessionOnly) {\n\t\ttrustOptions.push({ label: \"Do not trust (this session only)\", trusted: false, updates: [] });\n\t}\n\treturn trustOptions;\n}\n\nfunction readTrustFile(path: string): TrustFile {\n\tif (!existsSync(path)) {\n\t\treturn {};\n\t}\n\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(readFileSync(path, \"utf-8\"));\n\t} catch (error) {\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tthrow new Error(`Failed to read trust store ${path}: ${message}`);\n\t}\n\n\tif (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n\t\tthrow new Error(`Invalid trust store ${path}: expected an object`);\n\t}\n\n\tconst data: TrustFile = {};\n\tfor (const [key, value] of Object.entries(parsed)) {\n\t\tif (value !== true && value !== false && value !== null) {\n\t\t\tthrow new Error(`Invalid trust store ${path}: value for ${JSON.stringify(key)} must be true, false, or null`);\n\t\t}\n\t\tdata[key] = value;\n\t}\n\treturn data;\n}\n\nfunction writeTrustFile(path: string, data: TrustFile): void {\n\tconst sorted: TrustFile = {};\n\tfor (const key of Object.keys(data).sort()) {\n\t\tconst value = data[key];\n\t\tif (value === true || value === false || value === null) {\n\t\t\tsorted[key] = value;\n\t\t}\n\t}\n\tmkdirSync(dirname(path), { recursive: true });\n\twriteFileSync(path, `${JSON.stringify(sorted, null, 2)}\\n`, \"utf-8\");\n}\n\nfunction acquireTrustLockSync(path: string): () => void {\n\tconst trustDir = dirname(path);\n\tmkdirSync(trustDir, { recursive: true });\n\tconst maxAttempts = 10;\n\tconst delayMs = 20;\n\tlet lastError: unknown;\n\n\tfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n\t\ttry {\n\t\t\treturn lockfile.lockSync(trustDir, { realpath: false, lockfilePath: `${path}.lock` });\n\t\t} catch (error) {\n\t\t\tconst code =\n\t\t\t\ttypeof error === \"object\" && error !== null && \"code\" in error\n\t\t\t\t\t? String((error as { code?: unknown }).code)\n\t\t\t\t\t: undefined;\n\t\t\tif (code !== \"ELOCKED\" || attempt === maxAttempts) {\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tlastError = error;\n\t\t\tconst start = Date.now();\n\t\t\twhile (Date.now() - start < delayMs) {\n\t\t\t\t// Sleep synchronously to avoid changing trust store callers to async.\n\t\t\t}\n\t\t}\n\t}\n\n\tif (lastError instanceof Error) {\n\t\tthrow lastError;\n\t}\n\tthrow new Error(\"Failed to acquire trust store lock\");\n}\n\nfunction withTrustFileLock<T>(path: string, fn: () => T): T {\n\tconst release = acquireTrustLockSync(path);\n\ttry {\n\t\treturn fn();\n\t} finally {\n\t\trelease();\n\t}\n}\n\n/**\n * Returns true when cwd has project-local resources that must be gated by\n * project trust: settings/resources under cwd/.lunr, executable integration\n * configuration, or .agents/skills in\n * cwd or one of its ancestors. Returns false when no such project resources\n * exist. The user/global ~/.agents/skills directory is always treated as a\n * trusted user resource and is ignored here, even when cwd is $HOME.\n */\nexport function hasTrustRequiringProjectResources(cwd: string): boolean {\n\tconst homeDir = canonicalizePath(resolvePath(process.env.HOME || homedir()));\n\tconst userAgentsSkillsDir = join(homeDir, \".agents\", \"skills\");\n\tlet currentDir = canonicalizePath(resolvePath(cwd));\n\n\tconst configDir = join(currentDir, CONFIG_DIR_NAME);\n\tif (\n\t\t[\".mcp.json\", \".pi/mcp.json\", \".vscode/mcp.json\", \".pi-lsp.json\"].some((entry) =>\n\t\t\texistsSync(join(currentDir, entry)),\n\t\t)\n\t) {\n\t\treturn true;\n\t}\n\tif (TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry)))) {\n\t\treturn true;\n\t}\n\n\twhile (true) {\n\t\tconst agentsSkillsDir = join(currentDir, \".agents\", \"skills\");\n\t\tif (agentsSkillsDir !== userAgentsSkillsDir && existsSync(agentsSkillsDir)) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst parentDir = dirname(currentDir);\n\t\tif (parentDir === currentDir) {\n\t\t\treturn false;\n\t\t}\n\t\tcurrentDir = parentDir;\n\t}\n}\n\nexport class ProjectTrustStore {\n\tprivate trustPath: string;\n\n\tconstructor(agentDir: string) {\n\t\tthis.trustPath = join(resolvePath(agentDir), \"trust.json\");\n\t}\n\n\tget(cwd: string): ProjectTrustDecision {\n\t\treturn this.getEntry(cwd)?.decision ?? null;\n\t}\n\n\tgetEntry(cwd: string): ProjectTrustStoreEntry | null {\n\t\treturn withTrustFileLock(this.trustPath, () => {\n\t\t\tconst data = readTrustFile(this.trustPath);\n\t\t\treturn findNearestTrustEntry(data, cwd);\n\t\t});\n\t}\n\n\tset(cwd: string, decision: ProjectTrustDecision): void {\n\t\tthis.setMany([{ path: cwd, decision }]);\n\t}\n\n\tsetMany(decisions: ProjectTrustUpdate[]): void {\n\t\twithTrustFileLock(this.trustPath, () => {\n\t\t\tconst data = readTrustFile(this.trustPath);\n\t\t\tfor (const { path, decision } of decisions) {\n\t\t\t\tconst key = normalizeCwd(path);\n\t\t\t\tif (decision === null) {\n\t\t\t\t\tdelete data[key];\n\t\t\t\t} else {\n\t\t\t\t\tdata[key] = decision;\n\t\t\t\t}\n\t\t\t}\n\t\t\twriteTrustFile(this.trustPath, data);\n\t\t});\n\t}\n}\n"]}

package/dist/core/trust-manager.js

@@ -6,6 +6,7 @@ import { CONFIG_DIR_NAME } from "../config.js";
 import { canonicalizePath, resolvePath } from "../utils/paths.js";
 const TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES = [
     "settings.json",
+    "mcp.json",
     "extensions",
     "skills",
     "prompts",
@@ -141,7 +142,8 @@ function withTrustFileLock(path, fn) {
 }
 /**
  * Returns true when cwd has project-local resources that must be gated by
- * project trust: trust-requiring entries under cwd/.pi, or .agents/skills in
+ * project trust: settings/resources under cwd/.lunr, executable integration
+ * configuration, or .agents/skills in
  * cwd or one of its ancestors. Returns false when no such project resources
  * exist. The user/global ~/.agents/skills directory is always treated as a
  * trusted user resource and is ignored here, even when cwd is $HOME.
@@ -151,6 +153,9 @@ export function hasTrustRequiringProjectResources(cwd) {
     const userAgentsSkillsDir = join(homeDir, ".agents", "skills");
     let currentDir = canonicalizePath(resolvePath(cwd));
     const configDir = join(currentDir, CONFIG_DIR_NAME);
+    if ([".mcp.json", ".pi/mcp.json", ".vscode/mcp.json", ".pi-lsp.json"].some((entry) => existsSync(join(currentDir, entry)))) {
+        return true;
+    }
     if (TRUST_REQUIRING_PROJECT_CONFIG_RESOURCES.some((entry) => existsSync(join(configDir, entry)))) {
         return true;
     }