@carlonicora/nestjs-neo4jsonapi 2.7.2 → 2.8.0

package/dist/foundations/ai-connection/services/ai-connection-encryption.service.js

@@ -0,0 +1,148 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiConnectionEncryptionService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+const base_config_1 = require("../../../config/base.config");
+/**
+ * AI Connection Encryption Service
+ *
+ * Provides AES-256-GCM encryption/decryption for AI connection secrets
+ * (`apiKey`, `googleCredentialsBase64`). Secrets are encrypted before storage in
+ * Neo4j and decrypted only when the resolver builds a candidate — they are never
+ * serialised back over the API.
+ *
+ * Mirrors {@link TotpEncryptionService} (the in-package AES-256-GCM canonical),
+ * keyed from `encryption.key` (ENCRYPTION_KEY) instead of the TOTP key.
+ *
+ * Format: IV (12 bytes) + AuthTag (16 bytes) + Ciphertext (base64 encoded)
+ */
+let AiConnectionEncryptionService = class AiConnectionEncryptionService {
+    constructor() {
+        this.algorithm = "aes-256-gcm";
+        this.ivLength = 12; // 96 bits for GCM
+        this.authTagLength = 16; // 128 bits
+    }
+    /**
+     * Whether a key is configured at all. Writing a secret without one must fail
+     * loudly at the admin API (fail-closed on write, fail-open on read).
+     */
+    isConfigured() {
+        return !!base_config_1.baseConfig.encryption.key;
+    }
+    /**
+     * Get the encryption key from config.
+     * The key must be exactly 32 bytes (256 bits) for AES-256.
+     */
+    getKey() {
+        const keyString = base_config_1.baseConfig.encryption.key;
+        if (!keyString) {
+            throw new Error("ENCRYPTION_KEY is not configured — cannot store AI connection secrets");
+        }
+        // If the key is hex-encoded (64 chars = 32 bytes), decode it
+        if (keyString.length === 64 && /^[0-9a-fA-F]+$/.test(keyString)) {
+            return Buffer.from(keyString, "hex");
+        }
+        // If the key is base64-encoded
+        if (keyString.length === 44 && keyString.endsWith("=")) {
+            const decoded = Buffer.from(keyString, "base64");
+            if (decoded.length === 32) {
+                return decoded;
+            }
+        }
+        // Otherwise, derive a 32-byte key using SHA-256
+        return crypto.createHash("sha256").update(keyString).digest();
+    }
+    /**
+     * Encrypt an AI connection secret using AES-256-GCM.
+     *
+     * @param plaintext - The secret to encrypt (API key or base64 GCP credentials)
+     * @returns The encrypted secret as a base64-encoded string containing IV, auth tag, and ciphertext
+     */
+    encrypt(plaintext) {
+        const key = this.getKey();
+        const iv = crypto.randomBytes(this.ivLength);
+        const cipher = crypto.createCipheriv(this.algorithm, key, iv);
+        const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        // Combine IV + AuthTag + Ciphertext
+        const combined = Buffer.concat([iv, authTag, encrypted]);
+        return combined.toString("base64");
+    }
+    /**
+     * Decrypt an AI connection secret encrypted with AES-256-GCM.
+     *
+     * @param ciphertext - The base64-encoded encrypted secret (IV + AuthTag + Ciphertext)
+     * @returns The decrypted secret
+     * @throws Error if decryption fails (invalid key, corrupted data, or tampered data)
+     */
+    decrypt(ciphertext) {
+        const key = this.getKey();
+        const combined = Buffer.from(ciphertext, "base64");
+        // Extract IV, AuthTag, and encrypted data
+        const iv = combined.subarray(0, this.ivLength);
+        const authTag = combined.subarray(this.ivLength, this.ivLength + this.authTagLength);
+        const encrypted = combined.subarray(this.ivLength + this.authTagLength);
+        const decipher = crypto.createDecipheriv(this.algorithm, key, iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        return decrypted.toString("utf8");
+    }
+    /**
+     * Verify that the encryption system is properly configured.
+     * Performs a round-trip encryption/decryption test.
+     *
+     * @returns true if encryption is working correctly
+     * @throws Error if encryption is not properly configured
+     */
+    verify() {
+        const testData = "test-secret-" + crypto.randomBytes(8).toString("hex");
+        const encrypted = this.encrypt(testData);
+        const decrypted = this.decrypt(encrypted);
+        return decrypted === testData;
+    }
+};
+exports.AiConnectionEncryptionService = AiConnectionEncryptionService;
+exports.AiConnectionEncryptionService = AiConnectionEncryptionService = __decorate([
+    (0, common_1.Injectable)()
+], AiConnectionEncryptionService);
+//# sourceMappingURL=ai-connection-encryption.service.js.map

package/dist/foundations/ai-connection/services/ai-connection-encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-connection-encryption.service.js","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/services/ai-connection-encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+CAAiC;AACjC,6DAAyD;AAEzD;;;;;;;;;;;;GAYG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAAnC;QACY,cAAS,GAAG,aAAa,CAAC;QAC1B,aAAQ,GAAG,EAAE,CAAC,CAAC,kBAAkB;QACjC,kBAAa,GAAG,EAAE,CAAC,CAAC,WAAW;IAgGlD,CAAC;IA9FC;;;OAGG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,wBAAU,CAAC,UAAU,CAAC,GAAG,CAAC;IACrC,CAAC;IAED;;;OAGG;IACK,MAAM;QACZ,MAAM,SAAS,GAAG,wBAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,SAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAEzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,UAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnD,0CAA0C;QAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEhF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,MAAM;QACJ,MAAM,QAAQ,GAAG,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,SAAS,KAAK,QAAQ,CAAC;IAChC,CAAC;CACF,CAAA;AAnGY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;GACA,6BAA6B,CAmGzC"}

package/dist/foundations/ai-connection/services/ai-connection.service.d.ts

@@ -0,0 +1,79 @@
+import { ConfigService } from "@nestjs/config";
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import { ClsService } from "nestjs-cls";
+import { BaseConfigInterface } from "../../../config/interfaces/base.config.interface";
+import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
+import { AbstractService } from "../../../core/neo4j/abstracts/abstract.service";
+import { AiConnection, AiConnectionDescriptor } from "../entities/ai-connection";
+import { AiConnectionRepository } from "../repositories/ai-connection.repository";
+import { AiConnectionEncryptionService } from "./ai-connection-encryption.service";
+export declare class AiConnectionService extends AbstractService<AiConnection, typeof AiConnectionDescriptor.relationships> {
+    private readonly aiConnectionRepository;
+    private readonly encryption;
+    private readonly eventEmitter;
+    private readonly configService;
+    protected readonly descriptor: import("../../..").EntityDescriptor<AiConnection, {
+        company: {
+            model: import("../../..").DataMeta;
+            direction: "out";
+            relationship: string;
+            cardinality: "one";
+            required: false;
+            dtoKey: string;
+            immutable: true;
+        };
+    }>;
+    constructor(jsonApiService: JsonApiService, aiConnectionRepository: AiConnectionRepository, clsService: ClsService, encryption: AiConnectionEncryptionService, eventEmitter: EventEmitter2, configService: ConfigService<BaseConfigInterface>);
+    /**
+     * List with the editor's meta: the provider field registry and the .env
+     * defaults per connection type (never secrets) — spec § 3.
+     */
+    findAllWithMeta(params: {
+        query: any;
+    }): Promise<any>;
+    /**
+     * Create from a JSON:API body: validate against the provider registry,
+     * encrypt secrets, persist, then refresh every resolver snapshot.
+     *
+     * This name shadows `AbstractService.create()`, which `createFromDTO()` calls
+     * back into with *mapped repository params* (`{ id, ...fields }`) — routing
+     * those through the body path would recurse forever. The shape guard below
+     * keeps both entry points working: a JSON:API body always carries `data`,
+     * mapped repository params never do.
+     */
+    create(body: any, included?: unknown[]): Promise<any>;
+    update(body: {
+        data: {
+            id: string;
+            attributes: Record<string, any>;
+            [k: string]: any;
+        };
+    }): Promise<any>;
+    reorder(params: {
+        ids: string[];
+    }): Promise<void>;
+    deleteConnection(params: {
+        id: string;
+    }): Promise<void>;
+    /**
+     * The inherited `AbstractService.delete()` enforces company ownership
+     * (`clsService.companyId === entity.company?.id`). That check is meaningless
+     * here and would reject every delete: this entity is `isCompanyScoped: false`
+     * and its `company` edge is the CONFIGURES *target* (the company a chain is
+     * scoped TO), not an owner — a global connection has no company at all, so
+     * `"" !== undefined` would always throw ForbiddenException.
+     *
+     * Authorisation is enforced at the controller (`AdminJwtAuthGuard` +
+     * `@Roles(RoleId.Administrator)`), matching every other admin-only foundation.
+     */
+    delete(params: {
+        id: string;
+    }): Promise<void>;
+    /**
+     * Registry validation + secret encryption. `onlyEncrypt` limits encryption to
+     * the secrets this request actually supplied (update path: kept secrets are
+     * already ciphertext).
+     */
+    private validateAndEncrypt;
+}
+//# sourceMappingURL=ai-connection.service.d.ts.map

package/dist/foundations/ai-connection/services/ai-connection.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-connection.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/services/ai-connection.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAMhF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAInF,qBACa,mBAAoB,SAAQ,eAAe,CAAC,YAAY,EAAE,OAAO,sBAAsB,CAAC,aAAa,CAAC;IAK/G,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAEvC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IARhC,SAAS,CAAC,QAAQ,CAAC,UAAU;;;;;;;;;;OAA0B;gBAGrD,cAAc,EAAE,cAAc,EACb,sBAAsB,EAAE,sBAAsB,EAC/D,UAAU,EAAE,UAAU,EACL,UAAU,EAAE,6BAA6B,EACzC,YAAY,EAAE,aAAa,EAC3B,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC;IAKpE;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAiC3D;;;;;;;;;OASG;IACG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IASrD,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAAC,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IA6BvG,OAAO,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAejD,gBAAgB,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D;;;;;;;;;;OAUG;IACG,MAAM,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnD;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAiB3B"}

package/dist/foundations/ai-connection/services/ai-connection.service.js

@@ -0,0 +1,184 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiConnectionService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const nestjs_cls_1 = require("nestjs-cls");
+const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
+const ai_candidate_interface_1 = require("../../../core/llm/interfaces/ai-candidate.interface");
+const abstract_service_1 = require("../../../core/neo4j/abstracts/abstract.service");
+const ai_connection_1 = require("../entities/ai-connection");
+const ai_provider_registry_1 = require("../registry/ai-provider.registry");
+const ai_connection_repository_1 = require("../repositories/ai-connection.repository");
+const ai_connection_encryption_service_1 = require("./ai-connection-encryption.service");
+const SECRET_FIELDS = ["apiKey", "googleCredentialsBase64"];
+let AiConnectionService = class AiConnectionService extends abstract_service_1.AbstractService {
+    constructor(jsonApiService, aiConnectionRepository, clsService, encryption, eventEmitter, configService) {
+        super(jsonApiService, aiConnectionRepository, clsService, ai_connection_1.AiConnectionDescriptor.model);
+        this.aiConnectionRepository = aiConnectionRepository;
+        this.encryption = encryption;
+        this.eventEmitter = eventEmitter;
+        this.configService = configService;
+        this.descriptor = ai_connection_1.AiConnectionDescriptor;
+    }
+    /**
+     * List with the editor's meta: the provider field registry and the .env
+     * defaults per connection type (never secrets) — spec § 3.
+     */
+    async findAllWithMeta(params) {
+        const response = await this.find({ query: params.query, fetchAll: true });
+        const ai = this.configService.get("ai");
+        const envBlockFor = (type) => {
+            switch (type) {
+                case "aiLite":
+                    return ai?.aiLite;
+                case "aiLarge":
+                    return ai?.aiLarge;
+                case "vision":
+                    return ai?.vision;
+                case "audio":
+                    return ai?.audio;
+                case "embedder":
+                    return ai?.embedder;
+                case "transcriber":
+                    return ai?.transcriber;
+                case "documentAi":
+                    return ai?.documentAi;
+                default:
+                    return ai?.ai;
+            }
+        };
+        const envDefaults = Object.fromEntries(ai_candidate_interface_1.AI_CONNECTION_TYPES.map((type) => {
+            const block = envBlockFor(type);
+            return [type, { provider: block?.provider, model: block?.model, url: block?.url }];
+        }));
+        response.meta = { ...(response.meta ?? {}), providerRegistry: ai_provider_registry_1.AI_PROVIDER_REGISTRY, envDefaults };
+        return response;
+    }
+    /**
+     * Create from a JSON:API body: validate against the provider registry,
+     * encrypt secrets, persist, then refresh every resolver snapshot.
+     *
+     * This name shadows `AbstractService.create()`, which `createFromDTO()` calls
+     * back into with *mapped repository params* (`{ id, ...fields }`) — routing
+     * those through the body path would recurse forever. The shape guard below
+     * keeps both entry points working: a JSON:API body always carries `data`,
+     * mapped repository params never do.
+     */
+    async create(body, included) {
+        if (!body?.data)
+            return super.create(body, included);
+        this.validateAndEncrypt(body.data.attributes);
+        const response = await this.createFromDTO({ data: body.data });
+        this.eventEmitter.emit(ai_candidate_interface_1.AI_CONNECTIONS_CHANGED_EVENT);
+        return response;
+    }
+    async update(body) {
+        const existing = await this.aiConnectionRepository.findById({ id: body.data.id });
+        // Blank/omitted secret = keep the stored (already encrypted) value; a
+        // supplied one is validated + re-encrypted (spec § Decisions "Secrets").
+        const attributes = body.data.attributes;
+        const suppliedSecrets = new Set();
+        for (const field of SECRET_FIELDS) {
+            const value = attributes[field];
+            if (value === undefined || value === null || value === "") {
+                const stored = existing?.[field];
+                if (stored === undefined || stored === null) {
+                    // No stored value either: the key must be ABSENT, not undefined — the
+                    // PUT query builder emits a SET term for every present key while the
+                    // param mapper strips undefined values, so an undefined key produces
+                    // "Neo4jError: Expected parameter(s): <field>".
+                    delete attributes[field];
+                }
+                else {
+                    attributes[field] = stored;
+                }
+            }
+            else {
+                suppliedSecrets.add(field);
+            }
+        }
+        this.validateAndEncrypt(attributes, suppliedSecrets);
+        const response = await this.putFromDTO({ data: body.data });
+        this.eventEmitter.emit(ai_candidate_interface_1.AI_CONNECTIONS_CHANGED_EVENT);
+        return response;
+    }
+    async reorder(params) {
+        // A reorder is defined over exactly one chain (connectionType + scope) —
+        // a malformed request mixing chains would scramble positions across them.
+        const connections = await this.aiConnectionRepository.findByIds({ ids: params.ids });
+        if (connections.length !== params.ids.length) {
+            throw new common_1.BadRequestException("One or more connections in the reorder request do not exist");
+        }
+        const chains = new Set(connections.map((c) => `${c.connectionType}|${c.companyId ?? "global"}`));
+        if (chains.size > 1) {
+            throw new common_1.BadRequestException("Reorder must target a single chain (one connection type and scope)");
+        }
+        await this.aiConnectionRepository.updatePositions({ ids: params.ids });
+        this.eventEmitter.emit(ai_candidate_interface_1.AI_CONNECTIONS_CHANGED_EVENT);
+    }
+    async deleteConnection(params) {
+        await this.delete({ id: params.id });
+        this.eventEmitter.emit(ai_candidate_interface_1.AI_CONNECTIONS_CHANGED_EVENT);
+    }
+    /**
+     * The inherited `AbstractService.delete()` enforces company ownership
+     * (`clsService.companyId === entity.company?.id`). That check is meaningless
+     * here and would reject every delete: this entity is `isCompanyScoped: false`
+     * and its `company` edge is the CONFIGURES *target* (the company a chain is
+     * scoped TO), not an owner — a global connection has no company at all, so
+     * `"" !== undefined` would always throw ForbiddenException.
+     *
+     * Authorisation is enforced at the controller (`AdminJwtAuthGuard` +
+     * `@Roles(RoleId.Administrator)`), matching every other admin-only foundation.
+     */
+    async delete(params) {
+        const entity = await this.aiConnectionRepository.findById({ id: params.id });
+        if (!entity)
+            throw new common_1.NotFoundException();
+        await this.aiConnectionRepository.delete({ id: params.id });
+    }
+    /**
+     * Registry validation + secret encryption. `onlyEncrypt` limits encryption to
+     * the secrets this request actually supplied (update path: kept secrets are
+     * already ciphertext).
+     */
+    validateAndEncrypt(attributes, onlyEncrypt) {
+        (0, ai_provider_registry_1.validateAiConnectionAttributes)({
+            connectionType: attributes.connectionType,
+            provider: attributes.provider,
+            attributes,
+        });
+        for (const field of SECRET_FIELDS) {
+            const value = attributes[field];
+            const mustEncrypt = value !== undefined && value !== null && value !== "" && (!onlyEncrypt || onlyEncrypt.has(field));
+            if (!mustEncrypt)
+                continue;
+            if (!this.encryption.isConfigured()) {
+                throw new common_1.BadRequestException("ENCRYPTION_KEY is not configured — cannot store AI connection secrets");
+            }
+            attributes[field] = this.encryption.encrypt(String(value));
+        }
+    }
+};
+exports.AiConnectionService = AiConnectionService;
+exports.AiConnectionService = AiConnectionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
+        ai_connection_repository_1.AiConnectionRepository,
+        nestjs_cls_1.ClsService,
+        ai_connection_encryption_service_1.AiConnectionEncryptionService,
+        event_emitter_1.EventEmitter2,
+        config_1.ConfigService])
+], AiConnectionService);
+//# sourceMappingURL=ai-connection.service.js.map

package/dist/foundations/ai-connection/services/ai-connection.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-connection.service.js","sourceRoot":"","sources":["../../../../src/foundations/ai-connection/services/ai-connection.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoF;AACpF,2CAA+C;AAC/C,yDAAsD;AACtD,2CAAwC;AAGxC,oFAAgF;AAChF,gGAI6D;AAC7D,qFAAiF;AACjF,6DAAiF;AACjF,2EAAwG;AACxG,uFAAkF;AAClF,yFAAmF;AAEnF,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,yBAAyB,CAAU,CAAC;AAG9D,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,kCAA0E;IAGjH,YACE,cAA8B,EACb,sBAA8C,EAC/D,UAAsB,EACL,UAAyC,EACzC,YAA2B,EAC3B,aAAiD;QAElE,KAAK,CAAC,cAAc,EAAE,sBAAsB,EAAE,UAAU,EAAE,sCAAsB,CAAC,KAAK,CAAC,CAAC;QANvE,2BAAsB,GAAtB,sBAAsB,CAAwB;QAE9C,eAAU,GAAV,UAAU,CAA+B;QACzC,iBAAY,GAAZ,YAAY,CAAe;QAC3B,kBAAa,GAAb,aAAa,CAAoC;QARjD,eAAU,GAAG,sCAAsB,CAAC;IAWvD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,MAAsB;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAoB,IAAI,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,CAAC,IAAsB,EAAE,EAAE;YAC7C,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,QAAQ;oBACX,OAAO,EAAE,EAAE,MAAM,CAAC;gBACpB,KAAK,SAAS;oBACZ,OAAO,EAAE,EAAE,OAAO,CAAC;gBACrB,KAAK,QAAQ;oBACX,OAAO,EAAE,EAAE,MAAM,CAAC;gBACpB,KAAK,OAAO;oBACV,OAAO,EAAE,EAAE,KAAK,CAAC;gBACnB,KAAK,UAAU;oBACb,OAAO,EAAE,EAAE,QAAQ,CAAC;gBACtB,KAAK,aAAa;oBAChB,OAAO,EAAE,EAAE,WAAW,CAAC;gBACzB,KAAK,YAAY;oBACf,OAAO,EAAE,EAAE,UAAU,CAAC;gBACxB;oBACE,OAAO,EAAE,EAAE,EAAE,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CACpC,4CAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAoE,CAAC;YACnG,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CACH,CAAC;QACF,QAAQ,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,2CAAoB,EAAE,WAAW,EAAE,CAAC;QAClG,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,IAAS,EAAE,QAAoB;QAC1C,IAAI,CAAC,IAAI,EAAE,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAErD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAW,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qDAA4B,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiF;QAC5F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,MAAM,GAAI,QAAgB,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBAC5C,sEAAsE;oBACtE,qEAAqE;oBACrE,qEAAqE;oBACrE,gDAAgD;oBAChD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;gBAC7B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAW,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qDAA4B,CAAC,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAyB;QACrC,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACrF,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;QACjG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,4BAAmB,CAAC,oEAAoE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qDAA4B,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAsB;QAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,qDAA4B,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,MAAsB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,EAAE,CAAC;QAE3C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,UAA+B,EAAE,WAAyB;QACnF,IAAA,qDAA8B,EAAC;YAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU;SACX,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,WAAW,GACf,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACpG,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;gBACpC,MAAM,IAAI,4BAAmB,CAAC,uEAAuE,CAAC,CAAC;YACzG,CAAC;YACD,UAAU,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF,CAAA;AA/JY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;qCAKO,gCAAc;QACW,iDAAsB;QACnD,uBAAU;QACO,gEAA6B;QAC3B,6BAAa;QACZ,sBAAa;GATpC,mBAAmB,CA+J/B"}

package/dist/foundations/foundations.modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"foundations.modules.d.ts","sourceRoot":"","sources":["../../src/foundations/foundations.modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAS7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AA2BvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAGrG;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,kEAAkE;IAClE,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;CACvB;AAkDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,iBAAiB;IAC5B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,GAAG,aAAa;CAoBhE"}
+{"version":3,"file":"foundations.modules.d.ts","sourceRoot":"","sources":["../../src/foundations/foundations.modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAU7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AA2BvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAGrG;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,kEAAkE;IAClE,YAAY,CAAC,EAAE,wBAAwB,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;CACvB;AAmDD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,iBAAiB;IAC5B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,uBAAuB,GAAG,aAAa;CAoBhE"}

package/dist/foundations/foundations.modules.js

@@ -9,6 +9,7 @@ var FoundationsModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FoundationsModule = void 0;
 const common_1 = require("@nestjs/common");
+const ai_connection_module_1 = require("./ai-connection/ai-connection.module");
 const assistant_module_1 = require("./assistant/assistant.module");
 const atomicfact_module_1 = require("./atomicfact/atomicfact.module");
 const audit_module_1 = require("./audit/audit.module");
@@ -51,6 +52,7 @@ const waitlist_module_1 = require("./waitlist/waitlist.module");
  * Queue registration is handled centrally by QueueModule (via baseConfig.chunkQueues).
  */
 const STATIC_FOUNDATION_MODULES = [
+    ai_connection_module_1.AiConnectionModule,
     assistant_module_1.AssistantModule,
     atomicfact_module_1.AtomicFactModule,
     audit_module_1.AuditModule,

package/dist/foundations/foundations.modules.js.map

@@ -1 +1 @@
-{"version":3,"file":"foundations.modules.js","sourceRoot":"","sources":["../../src/foundations/foundations.modules.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA6D;AAC7D,mEAA+D;AAC/D,sEAAkE;AAClE,uDAAmD;AACnD,oDAAgD;AAChD,uDAAmD;AACnD,6DAAyD;AACzD,6DAAyD;AACzD,6DAAyD;AAEzD,gEAA4D;AAE5D,4EAAuE;AACvE,6DAAyD;AACzD,0DAAqD;AACrD,sEAAkE;AAClE,sEAAkE;AAClE,0DAAsD;AACtD,4EAAwE;AACxE,uDAAmD;AACnD,oDAAgD;AAChD,mEAA+D;AAC/D,oDAAgD;AAChD,8CAA0C;AAC1C,qFAAgF;AAChF,kFAA6E;AAC7E,iDAAmD;AACnD,qDAAuD;AACvD,mEAAoE;AACpE,+DAAiE;AACjE,4EAAuE;AACvE,kFAA6E;AAC7E,0DAAsD;AACtD,4EAAuE;AACvE,sEAAkE;AAClE,sEAAiE;AACjE,oDAAgD;AAChD,+EAA0E;AAE1E,gEAA4D;AAsB5D;;;;GAIG;AACH,MAAM,yBAAyB,GAAG;IAChC,kCAAe;IACf,oCAAgB;IAChB,0BAAW;IACX,wBAAU;IACV,0BAAW;IACX,8BAAa;IACb,8BAAa;IACb,uCAAiB;IACjB,8BAAa;IACb,2BAAW;IACX,oCAAgB;IAChB,oCAAgB;IAChB,4BAAY;IACZ,wCAAkB;IAClB,0BAAW;IACX,wBAAU;IACV,kCAAe;IACf,wBAAU;IACV,oBAAQ;IACR,oCAAgB;IAChB,mCAAe;IACf,wBAAU;IACV,gCAAc;IACd,4BAAY;IACZ,6EAA6E;IAC7E,oEAAoE;IACpE,0EAA0E;IAC1E,4DAA4D;IAC5D,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,6CAAoB;IACpB,iDAAyB;IACzB,8CAAwB;IACxB,gCAAiB;IACjB,oCAAmB;IACnB,2CAAmB;IACnB,uCAAiB;IACjB,2CAAmB;IACnB,uCAAiB;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,MAAgC;QAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAY,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1E,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,cAAc,GAAiE;YACnF,EAAE,QAAQ,EAAE,8BAAa,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,8BAAa,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE;YAC3F,EAAE,QAAQ,EAAE,yCAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,yCAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE;YACjG,EAAE,QAAQ,EAAE,gCAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,gCAAc,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;SACtF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnD,OAAO;YACL,MAAM,EAAE,mBAAiB;YACzB,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SACxE,CAAC;IACJ,CAAC;CACF,CAAA;AA3BY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,iBAAiB,CA2B7B"}
+{"version":3,"file":"foundations.modules.js","sourceRoot":"","sources":["../../src/foundations/foundations.modules.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA6D;AAC7D,+EAA0E;AAC1E,mEAA+D;AAC/D,sEAAkE;AAClE,uDAAmD;AACnD,oDAAgD;AAChD,uDAAmD;AACnD,6DAAyD;AACzD,6DAAyD;AACzD,6DAAyD;AAEzD,gEAA4D;AAE5D,4EAAuE;AACvE,6DAAyD;AACzD,0DAAqD;AACrD,sEAAkE;AAClE,sEAAkE;AAClE,0DAAsD;AACtD,4EAAwE;AACxE,uDAAmD;AACnD,oDAAgD;AAChD,mEAA+D;AAC/D,oDAAgD;AAChD,8CAA0C;AAC1C,qFAAgF;AAChF,kFAA6E;AAC7E,iDAAmD;AACnD,qDAAuD;AACvD,mEAAoE;AACpE,+DAAiE;AACjE,4EAAuE;AACvE,kFAA6E;AAC7E,0DAAsD;AACtD,4EAAuE;AACvE,sEAAkE;AAClE,sEAAiE;AACjE,oDAAgD;AAChD,+EAA0E;AAE1E,gEAA4D;AAsB5D;;;;GAIG;AACH,MAAM,yBAAyB,GAAG;IAChC,yCAAkB;IAClB,kCAAe;IACf,oCAAgB;IAChB,0BAAW;IACX,wBAAU;IACV,0BAAW;IACX,8BAAa;IACb,8BAAa;IACb,uCAAiB;IACjB,8BAAa;IACb,2BAAW;IACX,oCAAgB;IAChB,oCAAgB;IAChB,4BAAY;IACZ,wCAAkB;IAClB,0BAAW;IACX,wBAAU;IACV,kCAAe;IACf,wBAAU;IACV,oBAAQ;IACR,oCAAgB;IAChB,mCAAe;IACf,wBAAU;IACV,gCAAc;IACd,4BAAY;IACZ,6EAA6E;IAC7E,oEAAoE;IACpE,0EAA0E;IAC1E,4DAA4D;IAC5D,8EAA8E;IAC9E,4EAA4E;IAC5E,8CAA8C;IAC9C,6CAAoB;IACpB,iDAAyB;IACzB,8CAAwB;IACxB,gCAAiB;IACjB,oCAAmB;IACnB,2CAAmB;IACnB,uCAAiB;IACjB,2CAAmB;IACnB,uCAAiB;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,MAAgC;QAC7C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAY,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1E,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,cAAc,GAAiE;YACnF,EAAE,QAAQ,EAAE,8BAAa,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,8BAAa,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE;YAC3F,EAAE,QAAQ,EAAE,yCAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,yCAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE;YACjG,EAAE,QAAQ,EAAE,gCAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,gCAAc,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;SACtF,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnD,OAAO;YACL,MAAM,EAAE,mBAAiB;YACzB,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;SACxE,CAAC;IACJ,CAAC;CACF,CAAA;AA3BY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,iBAAiB,CA2B7B"}

package/dist/foundations/index.d.ts

@@ -2,6 +2,7 @@
  * Foundation modules - domain-specific business logic modules
  */
 export * from "./foundations.modules";
+export * from "./ai-connection";
 export * from "./assistant";
 export * from "./assistant-action";
 export * from "./assistant-message";

package/dist/foundations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/foundations/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,cAAc,uBAAuB,CAAC;AAGtC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,QAAQ,CAAC;AACvB,cAAc,MAAM,CAAC;AACrB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/foundations/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,cAAc,uBAAuB,CAAC;AAGtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,QAAQ,CAAC;AACvB,cAAc,MAAM,CAAC;AACrB,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,QAAQ,CAAC"}

package/dist/foundations/index.js

@@ -20,6 +20,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // Centralized FoundationsModule - import all foundation modules with single forRoot()
 __exportStar(require("./foundations.modules"), exports);
 // Individual foundation modules with entities, metas, repositories, and services
+__exportStar(require("./ai-connection"), exports);
 __exportStar(require("./assistant"), exports);
 __exportStar(require("./assistant-action"), exports);
 __exportStar(require("./assistant-message"), exports);

package/dist/foundations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/foundations/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,sFAAsF;AACtF,wDAAsC;AAEtC,iFAAiF;AACjF,8CAA4B;AAC5B,qDAAmC;AACnC,sDAAoC;AACpC,+CAA6B;AAC7B,0CAAwB;AACxB,yCAAuB;AACvB,0CAAwB;AACxB,4CAA0B;AAC1B,4CAA0B;AAC1B,8CAA4B;AAC5B,4CAA0B;AAC1B,4CAA0B;AAC1B,iDAA+B;AAC/B,4CAA0B;AAC1B,gDAA8B;AAC9B,2CAAyB;AACzB,+CAA6B;AAC7B,+CAA6B;AAC7B,2CAAyB;AACzB,iDAA+B;AAC/B,0CAAwB;AACxB,yCAAuB;AACvB,6CAA2B;AAC3B,8CAA4B;AAC5B,yCAAuB;AACvB,uCAAqB;AACrB,2CAAyB;AACzB,+CAA6B;AAC7B,+CAA6B;AAC7B,yCAAuB;AACvB,kDAAgC;AAChC,6CAA2B;AAC3B,yCAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/foundations/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,sFAAsF;AACtF,wDAAsC;AAEtC,iFAAiF;AACjF,kDAAgC;AAChC,8CAA4B;AAC5B,qDAAmC;AACnC,sDAAoC;AACpC,+CAA6B;AAC7B,0CAAwB;AACxB,yCAAuB;AACvB,0CAAwB;AACxB,4CAA0B;AAC1B,4CAA0B;AAC1B,8CAA4B;AAC5B,4CAA0B;AAC1B,4CAA0B;AAC1B,iDAA+B;AAC/B,4CAA0B;AAC1B,gDAA8B;AAC9B,2CAAyB;AACzB,+CAA6B;AAC7B,+CAA6B;AAC7B,2CAAyB;AACzB,iDAA+B;AAC/B,0CAAwB;AACxB,yCAAuB;AACvB,6CAA2B;AAC3B,8CAA4B;AAC5B,yCAAuB;AACvB,uCAAqB;AACrB,2CAAyB;AACzB,+CAA6B;AAC7B,+CAA6B;AAC7B,yCAAuB;AACvB,kDAAgC;AAChC,6CAA2B;AAC3B,yCAAuB"}

package/dist/foundations/tokenusage/services/tokenusage.service.d.ts

@@ -9,6 +9,21 @@ import { AbstractService } from "../../../core/neo4j/abstracts/abstract.service"
 import { TokenUsage, TokenUsageDescriptor } from "../../tokenusage/entities/tokenusage";
 import { TokenUsageAggregated, TokenUsageRepository, TokenUsageSummary } from "../../tokenusage/repositories/tokenusage.repository";
 import { ModelWeight } from "../../../core/llm/enums/model.weight";
+/**
+ * Per-call cost rates, in euros per 1M tokens, belonging to the AI connection
+ * that ACTUALLY served a call.
+ *
+ * Exists because a call may be served by any link of a DB-backed fallback chain
+ * (`AiConnection`), and each link carries its own prices — so the config block
+ * for the tier is no longer necessarily the right rate card. Supplied ONLY for
+ * candidates whose `source` is `"db"`; an `.env`-sourced candidate passes
+ * nothing and keeps the config-block path exactly as before.
+ */
+export interface TokenUsageRatesInterface {
+    inputCostPer1MTokens?: number;
+    outputCostPer1MTokens?: number;
+    cachedInputCostPer1MTokens?: number;
+}
 /**
  * TokenUsage service.
  *
@@ -43,11 +58,23 @@ export declare class TokenUsageService extends AbstractService<TokenUsage, typeo
      * Computes the monetary cost of a call from the per-tier rates in config
      * (`inputCostPer1MTokens` / `outputCostPer1MTokens`). Single source of truth —
      * used both for persistence and for surfacing cost in ephemeral telemetry.
+     *
+     * `rates` overrides those config rates with the ones belonging to the AI
+     * connection that actually served the call (see
+     * {@link TokenUsageRatesInterface}). It is passed ONLY for DB-backed
+     * connections, so a caller that never configures any keeps the config-block
+     * path bit-for-bit. Each rate falls back to the config block individually, so
+     * a connection that prices only some fields still bills the rest at the tier
+     * rate — EXCEPT the cached rate, which falls back to the EFFECTIVE input rate
+     * rather than the config's cached rate: mixing one connection's input price
+     * with another's cache discount would price cached tokens above uncached ones.
      */
     computeCost(params: {
         tokens: TokenUsageInterface;
         useVisionCosts?: boolean;
         modelWeight?: ModelWeight;
+        /** Rates of the connection that served the call; overrides the config block. */
+        rates?: TokenUsageRatesInterface;
     }): number;
     /**
      * Persists one usage record and converts its monetary cost into billing
@@ -71,6 +98,8 @@ export declare class TokenUsageService extends AbstractService<TokenUsage, typeo
         applyMinimum?: boolean;
         /** Pre-computed cost in euros; when provided `computeCost` is skipped (embeddings: estimated tokens × the embedder rate). */
         costOverride?: number;
+        /** Rates of the AI connection that served the call; forwarded to `computeCost`. */
+        rates?: TokenUsageRatesInterface;
     }): Promise<void>;
     /**
      * KEPT (custom filtering not covered by inherited find()): date-range + tokenUsageType

package/dist/foundations/tokenusage/services/tokenusage.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenusage.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/tokenusage/services/tokenusage.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAA0B,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,iBAAkB,SAAQ,eAAe,CAAC,UAAU,EAAE,OAAO,oBAAoB,CAAC,aAAa,CAAC;IAOzG,SAAS,CAAC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB;IAE7D,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC;IACpE,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa;IAThD,SAAS,CAAC,QAAQ,CAAC,UAAU,sDAAwB;IAErD,SAAS,CAAC,QAAQ,CAAC,MAAM,SAAsC;gBAG7D,cAAc,EAAE,cAAc,EACX,oBAAoB,EAAE,oBAAoB,EAC7D,UAAU,EAAE,UAAU,EACH,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC,EACjD,YAAY,EAAE,aAAa;IAKhD,SAAS,KAAK,QAAQ,IAAI,iBAAiB,CAE1C;IAED,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW;IAW9C;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,mBAAmB,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,MAAM;IAYjH;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,MAAM,EAAE,mBAAmB,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,sJAAsJ;QACtJ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,6HAA6H;QAC7H,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8CjB;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE;IAezG;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAO9G;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAMpG"}
+{"version":3,"file":"tokenusage.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/tokenusage/services/tokenusage.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAA0B,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAGnE;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,iBAAkB,SAAQ,eAAe,CAAC,UAAU,EAAE,OAAO,oBAAoB,CAAC,aAAa,CAAC;IAOzG,SAAS,CAAC,QAAQ,CAAC,oBAAoB,EAAE,oBAAoB;IAE7D,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC;IACpE,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa;IAThD,SAAS,CAAC,QAAQ,CAAC,UAAU,sDAAwB;IAErD,SAAS,CAAC,QAAQ,CAAC,MAAM,SAAsC;gBAG7D,cAAc,EAAE,cAAc,EACX,oBAAoB,EAAE,oBAAoB,EAC7D,UAAU,EAAE,UAAU,EACH,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC,EACjD,YAAY,EAAE,aAAa;IAKhD,SAAS,KAAK,QAAQ,IAAI,iBAAiB,CAE1C;IAED,SAAS,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,WAAW;IAW9C;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,gFAAgF;QAChF,KAAK,CAAC,EAAE,wBAAwB,CAAC;KAClC,GAAG,MAAM;IAcV;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAC7B,MAAM,EAAE,mBAAmB,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,WAAW,CAAC,EAAE,WAAW,CAAC;QAC1B,sJAAsJ;QACtJ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,6HAA6H;QAC7H,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mFAAmF;QACnF,KAAK,CAAC,EAAE,wBAAwB,CAAC;KAClC,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CjB;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,GAAG,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE;IAezG;;;OAGG;IACG,qBAAqB,CAAC,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAO9G;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAMpG"}

package/dist/foundations/tokenusage/services/tokenusage.service.js

@@ -70,13 +70,24 @@ let TokenUsageService = TokenUsageService_1 = class TokenUsageService extends ab
      * Computes the monetary cost of a call from the per-tier rates in config
      * (`inputCostPer1MTokens` / `outputCostPer1MTokens`). Single source of truth —
      * used both for persistence and for surfacing cost in ephemeral telemetry.
+     *
+     * `rates` overrides those config rates with the ones belonging to the AI
+     * connection that actually served the call (see
+     * {@link TokenUsageRatesInterface}). It is passed ONLY for DB-backed
+     * connections, so a caller that never configures any keeps the config-block
+     * path bit-for-bit. Each rate falls back to the config block individually, so
+     * a connection that prices only some fields still bills the rest at the tier
+     * rate — EXCEPT the cached rate, which falls back to the EFFECTIVE input rate
+     * rather than the config's cached rate: mixing one connection's input price
+     * with another's cache discount would price cached tokens above uncached ones.
      */
     computeCost(params) {
         const costConfig = params.useVisionCosts ? this.aiConfig.vision : this.configForWeight(params.modelWeight);
-        const inputRate = costConfig.inputCostPer1MTokens ?? 0;
-        const outputRate = costConfig.outputCostPer1MTokens ?? 0;
+        const inputRate = params.rates?.inputCostPer1MTokens ?? costConfig.inputCostPer1MTokens ?? 0;
+        const outputRate = params.rates?.outputCostPer1MTokens ?? costConfig.outputCostPer1MTokens ?? 0;
         // vision/audio configs have no cached rate → falls back to the full input rate (no discount).
-        const cachedRate = costConfig.cachedInputCostPer1MTokens ?? inputRate;
+        const configCachedRate = costConfig.cachedInputCostPer1MTokens;
+        const cachedRate = params.rates?.cachedInputCostPer1MTokens ?? (params.rates ? inputRate : (configCachedRate ?? inputRate));
         const cached = Math.min(params.tokens.cached ?? 0, params.tokens.input);
         const uncachedInput = params.tokens.input - cached;
         const cost = uncachedInput * inputRate + cached * cachedRate + params.tokens.output * outputRate;
@@ -99,6 +110,7 @@ let TokenUsageService = TokenUsageService_1 = class TokenUsageService extends ab
                 tokens: params.tokens,
                 useVisionCosts: params.useVisionCosts,
                 modelWeight: params.modelWeight,
+                rates: params.rates,
             });
         const creditsConfig = this.configService.get("credits");
         let credits = 0;

package/dist/foundations/tokenusage/services/tokenusage.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenusage.service.js","sourceRoot":"","sources":["../../../../src/foundations/tokenusage/services/tokenusage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,2CAA+C;AAC/C,yDAAsD;AACtD,mCAAoC;AACpC,2CAAwC;AAGxC,2FAAuF;AACvF,oFAAgF;AAChF,qFAAiF;AACjF,qEAAwF;AACxF,+FAI6D;AAC7D,uEAAmE;AACnE,mEAAoG;AAEpG;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAkB,SAAQ,kCAAsE;IAK3G,YACE,cAA8B,EACX,oBAA0C,EAC7D,UAAsB,EACH,aAAiD,EACjD,YAA2B;QAE9C,KAAK,CAAC,cAAc,EAAE,oBAAoB,EAAE,UAAU,EAAE,iCAAoB,CAAC,KAAK,CAAC,CAAC;QALjE,yBAAoB,GAApB,oBAAoB,CAAsB;QAE1C,kBAAa,GAAb,aAAa,CAAoC;QACjD,iBAAY,GAAZ,YAAY,CAAe;QAT7B,eAAU,GAAG,iCAAoB,CAAC;QAElC,WAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAU/D,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAoB,IAAI,CAAC,CAAC;IACzD,CAAC;IAES,eAAe,CAAC,MAAoB;QAC5C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,0BAAW,CAAC,IAAI;gBACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,0BAAW,CAAC,KAAK;gBACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B;gBACE,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,MAA4F;QACtG,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAG,UAAU,CAAC,oBAAoB,IAAI,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,UAAU,CAAC,qBAAqB,IAAI,CAAC,CAAC;QACzD,8FAA8F;QAC9F,MAAM,UAAU,GAAI,UAAsD,CAAC,0BAA0B,IAAI,SAAS,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QACjG,OAAO,IAAI,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAWtB;QACC,MAAM,IAAI,GACR,MAAM,CAAC,YAAY;YACnB,IAAI,CAAC,WAAW,CAAC;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;QAEL,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAyB,SAAS,CAAC,CAAC;QAChF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;YACxE,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YACrC,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAChC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAClC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5C,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;QAEH,yEAAyE;QACzE,qFAAqF;QACrF,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,OAAO,GAA8B;gBACzC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,OAAO;aACjB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,8CAA0B,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kBAAkB,8CAA0B,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAqF;QACvG,MAAM,SAAS,GAAqB,IAAI,oCAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAClC,iCAAoB,CAAC,KAAK,EAC1B,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM,EAAE,SAAS,CAAC,cAAc,EAAE;SACnC,CAAC,EACF,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAgD;QAC1E,OAAO,IAAI,CAAC,oBAAoB,CAAC,2BAA2B,CAAC;YAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,MAAgD;QACpE,OAAO,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;YAChD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA3JY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAOO,gCAAc;QACW,4CAAoB;QACjD,uBAAU;QACY,sBAAa;QACd,6BAAa;GAVrC,iBAAiB,CA2J7B"}
+{"version":3,"file":"tokenusage.service.js","sourceRoot":"","sources":["../../../../src/foundations/tokenusage/services/tokenusage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,2CAA+C;AAC/C,yDAAsD;AACtD,mCAAoC;AACpC,2CAAwC;AAGxC,2FAAuF;AACvF,oFAAgF;AAChF,qFAAiF;AACjF,qEAAwF;AACxF,+FAI6D;AAC7D,uEAAmE;AACnE,mEAAoG;AAkBpG;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,iBAAiB,yBAAvB,MAAM,iBAAkB,SAAQ,kCAAsE;IAK3G,YACE,cAA8B,EACX,oBAA0C,EAC7D,UAAsB,EACH,aAAiD,EACjD,YAA2B;QAE9C,KAAK,CAAC,cAAc,EAAE,oBAAoB,EAAE,UAAU,EAAE,iCAAoB,CAAC,KAAK,CAAC,CAAC;QALjE,yBAAoB,GAApB,oBAAoB,CAAsB;QAE1C,kBAAa,GAAb,aAAa,CAAoC;QACjD,iBAAY,GAAZ,YAAY,CAAe;QAT7B,eAAU,GAAG,iCAAoB,CAAC;QAElC,WAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAU/D,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAoB,IAAI,CAAC,CAAC;IACzD,CAAC;IAES,eAAe,CAAC,MAAoB;QAC5C,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,0BAAW,CAAC,IAAI;gBACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9B,KAAK,0BAAW,CAAC,KAAK;gBACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC/B;gBACE,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,WAAW,CAAC,MAMX;QACC,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3G,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,oBAAoB,IAAI,UAAU,CAAC,oBAAoB,IAAI,CAAC,CAAC;QAC7F,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,qBAAqB,IAAI,UAAU,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChG,8FAA8F;QAC9F,MAAM,gBAAgB,GAAI,UAAsD,CAAC,0BAA0B,CAAC;QAC5G,MAAM,UAAU,GACd,MAAM,CAAC,KAAK,EAAE,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC;QACnD,MAAM,IAAI,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;QACjG,OAAO,IAAI,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAatB;QACC,MAAM,IAAI,GACR,MAAM,CAAC,YAAY;YACnB,IAAI,CAAC,WAAW,CAAC;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;QAEL,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAyB,SAAS,CAAC,CAAC;QAChF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,aAAa,IAAI,aAAa,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC;YACxE,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YACrC,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,cAAc,EAAE,MAAM,CAAC,IAAI;YAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAChC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAClC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC;YAC5C,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;QAEH,yEAAyE;QACzE,qFAAqF;QACrF,yEAAyE;QACzE,IAAI,CAAC;YACH,MAAM,OAAO,GAA8B;gBACzC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC5B,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,OAAO;aACjB,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,8CAA0B,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kBAAkB,8CAA0B,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAqF;QACvG,MAAM,SAAS,GAAqB,IAAI,oCAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAClC,iCAAoB,CAAC,KAAK,EAC1B,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;YAC5C,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,MAAM,EAAE,SAAS,CAAC,cAAc,EAAE;SACnC,CAAC,EACF,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAgD;QAC1E,OAAO,IAAI,CAAC,oBAAoB,CAAC,2BAA2B,CAAC;YAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,MAAgD;QACpE,OAAO,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;YAChD,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAhLY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAOO,gCAAc;QACW,4CAAoB;QACjD,uBAAU;QACY,sBAAa;QACd,6BAAa;GAVrC,iBAAiB,CAgL7B"}