@cat-factory/integrations 0.6.0

package/dist/modules/providers/PersonalSubscriptionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonalSubscriptionService.js","sourceRoot":"","sources":["../../../src/modules/providers/PersonalSubscriptionService.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAChB,MAAM,qBAAqB,CAAA;AAM5B,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,6EAA6E;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC5D,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAqB/D,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,yBAAyB,CAAA;IAC/D,CAAC;IACD,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAA;IAC7D,CAAC;IAEO,gBAAgB,CAAC,MAA0B;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,uBAAuB,CAC/B,WAAW,MAAM,uFAAuF,EACxG,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CACtC,CAAA;QACH,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,KAAK,CACT,MAAc,EACd,KAAqC;QAErC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAC7E,MAAM,EACN,KAAK,CAAC,MAAM,CACb,CAAA;QACD,MAAM,MAAM,GAA+B;YACzC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YACtD,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI;YACxC,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,0BAA0B,CACtC,MAAc,EACd,MAA0B,EAC1B,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAC1E,CAAA;QACD,IAAI,CAAC,KAAK;YAAE,OAAM;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CACvB,qFAAqF;gBACnF,kFAAkF;gBAClF,wEAAwE,CAC3E,CAAA;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;QAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,MAA0B;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,CAAA;IAClG,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA0B;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IAClG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA0B,EAAE,QAAgB;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,uBAAuB,CAC/B,eAAe,MAAM,2CAA2C,EAChE,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CACtC,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,uBAAuB,CAC/B,QAAQ,MAAM,mEAAmE,EACjF,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAC3C,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,uBAAuB,CAC/B,wCAAwC,MAAM,kBAAkB,eAAe,CAAC,KAAK,CAAC,IAAI,EAC1F,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACrC,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,MAAc,EACd,MAA0B,EAC1B,QAAgB;QAEhB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAiC;YAC3C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,WAAW;YACX,MAAM;YACN,MAAM;YACN,WAAW;YACX,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,eAAe;SACtC,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;IAC9E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,WAAmB,EACnB,MAAc,EACd,MAA0B;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CACrE,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,CACJ,CAAA;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,uBAAuB,CAC/B,0BAA0B,MAAM,2DAA2D,EAC3F,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,CACxC,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;QAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC3B,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,aAAa,CACjB,WAAmB,EACnB,MAAc,EACd,MAA0B;QAE1B,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CACnD,WAAW,EACX,MAAM,EACN,MAAM,EACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAC,KAAK,IAAI,CACZ,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,MAAc;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,OAAO,CACtD,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,GAAG,IAAI,CAAC,eAAe,CAC3B,CAAA;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,WAAmB,EACnB,MAAc,EACd,GAAW;QAEX,MAAM,GAAG,GAAyB,EAAE,CAAA;QACpC,mFAAmF;QACnF,mFAAmF;QACnF,sFAAsF;QACtF,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAC5D,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,CACJ,CAAA;YACD,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1E,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACjF,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,uBAAuB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,qBAAqB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,CAAA;IAC9F,CAAC;IAEO,QAAQ,CAAC,MAAkC,EAAE,GAAW;QAC9D,MAAM,aAAa,GACjB,MAAM,CAAC,SAAS,KAAK,IAAI;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAClE,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa;YACb,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,cAAc;SACtF,CAAA;IACH,CAAC;CACF"}

package/dist/modules/providers/ProviderSubscriptionService.d.ts

@@ -0,0 +1,75 @@
+import type { Clock, IdGenerator, ProviderSubscriptionTokenRepository, SecretCipher, SubscriptionVendor } from '@cat-factory/kernel';
+import type { WorkspaceRepository } from '@cat-factory/kernel';
+export interface ProviderSubscriptionServiceDependencies {
+    providerSubscriptionTokenRepository: ProviderSubscriptionTokenRepository;
+    workspaceRepository: WorkspaceRepository;
+    secretCipher: SecretCipher;
+    idGenerator: IdGenerator;
+    clock: Clock;
+    /** Rolling usage window for rotation; defaults to ~5h. */
+    usageWindowMs?: number;
+}
+/** Safe metadata for one pool token (never the secret). */
+export interface VendorCredentialSummary {
+    id: string;
+    vendor: SubscriptionVendor;
+    label: string;
+    createdAt: number;
+    lastUsedAt: number | null;
+    inputTokens: number;
+    outputTokens: number;
+    requestCount: number;
+}
+/** A leased credential: the decrypted secret plus the row id (for usage attribution). */
+export interface LeasedSubscriptionToken {
+    tokenId: string;
+    vendor: SubscriptionVendor;
+    secret: string;
+}
+export declare class ProviderSubscriptionService {
+    private readonly deps;
+    constructor(deps: ProviderSubscriptionServiceDependencies);
+    private get windowMs();
+    /**
+     * Reject an individual-usage vendor (Claude) from the shared workspace pool: such a
+     * subscription is licensed for individual use only, so it is stored per-user by the
+     * PersonalSubscriptionService and never pooled/rotated/shared across a workspace.
+     */
+    private assertPoolable;
+    /** Add a token to the workspace's pool for a vendor. */
+    addToken(workspaceId: string, input: {
+        vendor: SubscriptionVendor;
+        label: string;
+        token: string;
+    }): Promise<VendorCredentialSummary>;
+    /** All live tokens for a workspace (optionally filtered by vendor), metadata only. */
+    listTokens(workspaceId: string, vendor?: SubscriptionVendor): Promise<VendorCredentialSummary[]>;
+    /**
+     * Whether the workspace has at least one live token for a vendor. Individual-usage
+     * vendors are never pooled, so this is always false for them — the executor routes
+     * those through the per-user PersonalSubscriptionService instead.
+     */
+    hasToken(workspaceId: string, vendor: SubscriptionVendor): Promise<boolean>;
+    /** Remove a token from the pool. */
+    removeToken(workspaceId: string, id: string): Promise<void>;
+    /**
+     * Lease the least-loaded live token for a vendor and return its decrypted
+     * secret. Throws ConflictError when the pool is empty so the dispatch path can
+     * surface a clear "connect a token" error rather than dispatching a doomed job.
+     *
+     * Rotation is best-effort, not transactional: the read → choose → markLeased
+     * sequence is not atomic, so two leases that interleave between the read and the
+     * mark can pick the same token. That window is benign (worst case one extra job on
+     * a token) and self-correcting — markLeased stamps `lastUsedAt` synchronously
+     * BEFORE this returns, so the next lease in a burst sees the just-leased token as
+     * least-recently-used and rotates to a different one even though real usage (folded
+     * in only when the job finishes, minutes later) is still zero across the pool.
+     */
+    leaseToken(workspaceId: string, vendor: SubscriptionVendor): Promise<LeasedSubscriptionToken>;
+    /** Fold a completed job's usage into the leased token's rolling-window counters. */
+    recordTokenUsage(workspaceId: string, id: string, usage: {
+        inputTokens: number;
+        outputTokens: number;
+    }): Promise<void>;
+}
+//# sourceMappingURL=ProviderSubscriptionService.d.ts.map

package/dist/modules/providers/ProviderSubscriptionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderSubscriptionService.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/ProviderSubscriptionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,WAAW,EAEX,mCAAmC,EACnC,YAAY,EACZ,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAI5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAyB9D,MAAM,WAAW,uCAAuC;IACtD,mCAAmC,EAAE,mCAAmC,CAAA;IACxE,mBAAmB,EAAE,mBAAmB,CAAA;IACxC,YAAY,EAAE,YAAY,CAAA;IAC1B,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,2DAA2D;AAC3D,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,yFAAyF;AACzF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,kBAAkB,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,2BAA2B;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,uCAAuC,EAAI;IAE9E,OAAO,KAAK,QAAQ,GAEnB;IAED;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB,wDAAwD;IAClD,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE;QAAE,MAAM,EAAE,kBAAkB,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAClE,OAAO,CAAC,uBAAuB,CAAC,CA+BlC;IAED,sFAAsF;IAChF,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAQpC;IAED;;;;OAIG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhF;IAED,oCAAoC;IAC9B,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhE;IAED;;;;;;;;;;;;OAYG;IACG,UAAU,CACd,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAmBlC;IAED,oFAAoF;IAC9E,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC,IAAI,CAAC,CAQf;CACF"}

package/dist/modules/providers/ProviderSubscriptionService.js

@@ -0,0 +1,130 @@
+import { ConflictError } from '@cat-factory/kernel';
+import { requireWorkspace } from '@cat-factory/kernel';
+import { SUBSCRIPTION_VENDORS, isIndividualVendor } from '@cat-factory/kernel';
+import { DEFAULT_USAGE_WINDOW_MS, chooseToken } from './providers.logic.js';
+// Every vendor whose subscription harness we support that is ALSO poolable — i.e.
+// excluding the individual-usage vendors (Claude), which are stored per-user by the
+// PersonalSubscriptionService and never shared in a workspace pool. The single source
+// of truth is the SUBSCRIPTION_VENDORS map in the kernel, so adding a poolable vendor
+// there automatically widens the unfiltered `listTokens` sweep below.
+const ALL_VENDORS = Object.keys(SUBSCRIPTION_VENDORS).filter((v) => !isIndividualVendor(v));
+// Upper bound on live tokens per workspace+vendor. The rotation pool is meant to hold
+// a handful of subscriptions for quota headroom; a generous ceiling keeps the feature
+// usable while bounding accidental/abusive unbounded growth (every lease lists the
+// whole live pool, so an unbounded pool would also bloat that read).
+const MAX_TOKENS_PER_VENDOR = 25;
+export class ProviderSubscriptionService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get windowMs() {
+        return this.deps.usageWindowMs ?? DEFAULT_USAGE_WINDOW_MS;
+    }
+    /**
+     * Reject an individual-usage vendor (Claude) from the shared workspace pool: such a
+     * subscription is licensed for individual use only, so it is stored per-user by the
+     * PersonalSubscriptionService and never pooled/rotated/shared across a workspace.
+     */
+    assertPoolable(vendor) {
+        if (isIndividualVendor(vendor)) {
+            throw new ConflictError(`The ${SUBSCRIPTION_VENDORS[vendor].label} subscription is licensed for individual use ` +
+                `only and cannot be pooled on a workspace. Connect it as a personal subscription instead.`);
+        }
+    }
+    /** Add a token to the workspace's pool for a vendor. */
+    async addToken(workspaceId, input) {
+        await requireWorkspace(this.deps.workspaceRepository, workspaceId);
+        this.assertPoolable(input.vendor);
+        const existing = await this.deps.providerSubscriptionTokenRepository.listByVendor(workspaceId, input.vendor);
+        if (existing.length >= MAX_TOKENS_PER_VENDOR) {
+            throw new ConflictError(`Workspace '${workspaceId}' already has the maximum of ${MAX_TOKENS_PER_VENDOR} ` +
+                `${input.vendor} subscription tokens; remove one before adding another`);
+        }
+        const tokenCipher = await this.deps.secretCipher.encrypt(input.token);
+        const now = this.deps.clock.now();
+        const record = {
+            id: this.deps.idGenerator.next('sub'),
+            workspaceId,
+            vendor: input.vendor,
+            label: input.label,
+            tokenCipher,
+            createdAt: now,
+            lastUsedAt: null,
+            windowStartedAt: null,
+            inputTokens: 0,
+            outputTokens: 0,
+            requestCount: 0,
+            deletedAt: null,
+        };
+        await this.deps.providerSubscriptionTokenRepository.add(record);
+        return toSummary(record);
+    }
+    /** All live tokens for a workspace (optionally filtered by vendor), metadata only. */
+    async listTokens(workspaceId, vendor) {
+        const vendors = vendor ? [vendor] : ALL_VENDORS;
+        const out = [];
+        for (const v of vendors) {
+            const rows = await this.deps.providerSubscriptionTokenRepository.listByVendor(workspaceId, v);
+            for (const row of rows)
+                out.push(toSummary(row));
+        }
+        return out;
+    }
+    /**
+     * Whether the workspace has at least one live token for a vendor. Individual-usage
+     * vendors are never pooled, so this is always false for them — the executor routes
+     * those through the per-user PersonalSubscriptionService instead.
+     */
+    async hasToken(workspaceId, vendor) {
+        if (isIndividualVendor(vendor))
+            return false;
+        const rows = await this.deps.providerSubscriptionTokenRepository.listByVendor(workspaceId, vendor);
+        return rows.length > 0;
+    }
+    /** Remove a token from the pool. */
+    async removeToken(workspaceId, id) {
+        await this.deps.providerSubscriptionTokenRepository.softDelete(workspaceId, id, this.deps.clock.now());
+    }
+    /**
+     * Lease the least-loaded live token for a vendor and return its decrypted
+     * secret. Throws ConflictError when the pool is empty so the dispatch path can
+     * surface a clear "connect a token" error rather than dispatching a doomed job.
+     *
+     * Rotation is best-effort, not transactional: the read → choose → markLeased
+     * sequence is not atomic, so two leases that interleave between the read and the
+     * mark can pick the same token. That window is benign (worst case one extra job on
+     * a token) and self-correcting — markLeased stamps `lastUsedAt` synchronously
+     * BEFORE this returns, so the next lease in a burst sees the just-leased token as
+     * least-recently-used and rotates to a different one even though real usage (folded
+     * in only when the job finishes, minutes later) is still zero across the pool.
+     */
+    async leaseToken(workspaceId, vendor) {
+        this.assertPoolable(vendor);
+        const rows = await this.deps.providerSubscriptionTokenRepository.listByVendor(workspaceId, vendor);
+        const chosen = chooseToken(rows, this.deps.clock.now(), this.windowMs);
+        if (!chosen) {
+            throw new ConflictError(`Workspace '${workspaceId}' has no ${vendor} subscription token connected`);
+        }
+        await this.deps.providerSubscriptionTokenRepository.markLeased(workspaceId, chosen.id, this.deps.clock.now());
+        const secret = await this.deps.secretCipher.decrypt(chosen.tokenCipher);
+        return { tokenId: chosen.id, vendor, secret };
+    }
+    /** Fold a completed job's usage into the leased token's rolling-window counters. */
+    async recordTokenUsage(workspaceId, id, usage) {
+        await this.deps.providerSubscriptionTokenRepository.recordUsage(workspaceId, id, usage, this.deps.clock.now(), this.windowMs);
+    }
+}
+function toSummary(record) {
+    return {
+        id: record.id,
+        vendor: record.vendor,
+        label: record.label,
+        createdAt: record.createdAt,
+        lastUsedAt: record.lastUsedAt,
+        inputTokens: record.inputTokens,
+        outputTokens: record.outputTokens,
+        requestCount: record.requestCount,
+    };
+}
+//# sourceMappingURL=ProviderSubscriptionService.js.map

package/dist/modules/providers/ProviderSubscriptionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderSubscriptionService.js","sourceRoot":"","sources":["../../../src/modules/providers/ProviderSubscriptionService.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAE9E,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAE3E,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,sEAAsE;AACtE,MAAM,WAAW,GAAI,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAA0B,CAAC,MAAM,CACpF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAC9B,CAAA;AAED,sFAAsF;AACtF,sFAAsF;AACtF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAsChC,MAAM,OAAO,2BAA2B;IACT,IAAI;IAAjC,YAA6B,IAA6C;oBAA7C,IAAI;IAA4C,CAAC;IAE9E,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAC3D,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,MAA0B;QAC/C,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CACrB,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,KAAK,+CAA+C;gBACtF,0FAA0F,CAC7F,CAAA;QACH,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,QAAQ,CACZ,WAAmB,EACnB,KAAmE;QAEnE,MAAM,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAA;QAClE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,YAAY,CAC/E,WAAW,EACX,KAAK,CAAC,MAAM,CACb,CAAA;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CACrB,cAAc,WAAW,gCAAgC,qBAAqB,GAAG;gBAC/E,GAAG,KAAK,CAAC,MAAM,wDAAwD,CAC1E,CAAA;QACH,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,MAAM,GAAoC;YAC9C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACrC,WAAW;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;YACX,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,IAAI;SAChB,CAAA;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/D,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,MAA2B;QAE3B,MAAM,OAAO,GAAyB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QACrE,MAAM,GAAG,GAA8B,EAAE,CAAA;QACzC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YAC7F,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,MAA0B;QAC5D,IAAI,kBAAkB,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,YAAY,CAC3E,WAAW,EACX,MAAM,CACP,CAAA;QACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAA;IACxB,CAAC;IAED,oCAAoC;IACpC,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,EAAU;QAC/C,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,UAAU,CAC5D,WAAW,EACX,EAAE,EACF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,MAA0B;QAE1B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,YAAY,CAC3E,WAAW,EACX,MAAM,CACP,CAAA;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,aAAa,CACrB,cAAc,WAAW,YAAY,MAAM,+BAA+B,CAC3E,CAAA;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,UAAU,CAC5D,WAAW,EACX,MAAM,CAAC,EAAE,EACT,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CACtB,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,gBAAgB,CACpB,WAAmB,EACnB,EAAU,EACV,KAAoD;QAEpD,MAAM,IAAI,CAAC,IAAI,CAAC,mCAAmC,CAAC,WAAW,CAC7D,WAAW,EACX,EAAE,EACF,KAAK,EACL,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EACrB,IAAI,CAAC,QAAQ,CACd,CAAA;IACH,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAAuC;IACxD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC"}

package/dist/modules/providers/localModelUrl.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Validate a local-runner base URL. Returns a human-readable error string when the URL
+ * is malformed or points at a non-local host, or `null` when it's acceptable. Used by
+ * the service at the write boundary and by the "Test connection" probe.
+ */
+export declare function localRunnerUrlError(rawUrl: string): string | null;
+//# sourceMappingURL=localModelUrl.d.ts.map

package/dist/modules/providers/localModelUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localModelUrl.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/localModelUrl.ts"],"names":[],"mappings":"AAsCA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBjE"}

package/dist/modules/providers/localModelUrl.js

@@ -0,0 +1,67 @@
+// ---------------------------------------------------------------------------
+// SSRF guard for local-runner base URLs. A runner lives on the user's OWN machine
+// (or LAN), so we forward requests to a user-supplied base URL server-side (both the
+// "Test connection" probe and the run-time LLM proxy). The usual "block private IPs"
+// mitigation is backwards here — loopback/LAN is exactly the intended target — so
+// instead we ALLOW only loopback + RFC1918/ULA private hosts and reject everything
+// else. This keeps the feature working on a single-tenant Node/local deployment (the
+// server shares the LAN with the runner) while denying a tenant on the shared
+// Cloudflare facade the ability to probe arbitrary public hosts or the link-local
+// cloud-metadata endpoint (169.254.169.254 / fe80::). Public/remote runners are not
+// supported by design.
+// ---------------------------------------------------------------------------
+const IPV4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+/** Whether a hostname (no port) is a loopback or RFC1918/ULA private host we forward to. */
+function isLoopbackOrPrivateHost(host) {
+    const h = host.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+    if (h === 'localhost' || h.endsWith('.localhost'))
+        return true;
+    // mDNS `.local` names resolve only on the LAN — acceptable for a same-network runner.
+    if (h.endsWith('.local'))
+        return true;
+    const v4 = IPV4.exec(h);
+    if (v4) {
+        const [a, b] = [Number(v4[1]), Number(v4[2])];
+        if ([a, b, Number(v4[3]), Number(v4[4])].some((n) => n > 255))
+            return false;
+        if (a === 127)
+            return true; // loopback 127.0.0.0/8
+        if (a === 10)
+            return true; // private 10.0.0.0/8
+        if (a === 172 && b >= 16 && b <= 31)
+            return true; // private 172.16.0.0/12
+        if (a === 192 && b === 168)
+            return true; // private 192.168.0.0/16
+        return false; // public, 0.0.0.0, and link-local 169.254.0.0/16 (metadata) → denied
+    }
+    // IPv6 literals (URL.hostname strips the brackets).
+    if (h === '::1')
+        return true; // loopback
+    if (h.startsWith('fc') || h.startsWith('fd'))
+        return true; // ULA fc00::/7
+    // fe80::/10 (link-local), :: (unspecified), and global addresses → denied.
+    return false;
+}
+/**
+ * Validate a local-runner base URL. Returns a human-readable error string when the URL
+ * is malformed or points at a non-local host, or `null` when it's acceptable. Used by
+ * the service at the write boundary and by the "Test connection" probe.
+ */
+export function localRunnerUrlError(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return 'Enter a valid URL, e.g. http://localhost:11434/v1.';
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return 'A runner URL must use http or https.';
+    }
+    if (!isLoopbackOrPrivateHost(url.hostname)) {
+        return ('A local runner must live on your own machine or LAN (localhost, *.local, or a ' +
+            'private 10./172.16–31./192.168. address). Public or remote hosts are not allowed.');
+    }
+    return null;
+}
+//# sourceMappingURL=localModelUrl.js.map

package/dist/modules/providers/localModelUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localModelUrl.js","sourceRoot":"","sources":["../../../src/modules/providers/localModelUrl.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kFAAkF;AAClF,qFAAqF;AACrF,qFAAqF;AACrF,kFAAkF;AAClF,mFAAmF;AACnF,qFAAqF;AACrF,8EAA8E;AAC9E,kFAAkF;AAClF,oFAAoF;AACpF,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,IAAI,GAAG,8CAA8C,CAAA;AAE3D,4FAA4F;AAC5F,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,sFAAsF;IACtF,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7C,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,uBAAuB;QAClD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA,CAAC,qBAAqB;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA,CAAC,wBAAwB;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA,CAAC,yBAAyB;QACjE,OAAO,KAAK,CAAA,CAAC,qEAAqE;IACpF,CAAC;IACD,oDAAoD;IACpD,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA,CAAC,WAAW;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA,CAAC,eAAe;IACzE,2EAA2E;IAC3E,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oDAAoD,CAAA;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,sCAAsC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO,CACL,gFAAgF;YAChF,mFAAmF,CACpF,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/modules/providers/providers.logic.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The fields the rotation policy needs from a pool row. Both
+ * `ProviderSubscriptionTokenRecord` and `ProviderApiKeyRecord` satisfy this, so
+ * `chooseToken` rotates either pool without duplication.
+ */
+export interface PoolRotationRecord {
+    inputTokens: number;
+    outputTokens: number;
+    windowStartedAt: number | null;
+    lastUsedAt: number | null;
+    createdAt: number;
+}
+/** Default rolling usage window (~5h) — mirrors subscription quota windows. */
+export declare const DEFAULT_USAGE_WINDOW_MS: number;
+/** Effective window usage for a row: counters reset once the window ages out. */
+export declare function windowUsage(record: PoolRotationRecord, now: number, windowMs: number): number;
+/**
+ * Choose the next row to lease from a non-empty list of live pool rows.
+ * Least window usage wins; ties break by least-recently-leased (nulls first =
+ * never leased), then oldest created. Returns null only for an empty list.
+ */
+export declare function chooseToken<T extends PoolRotationRecord>(records: T[], now: number, windowMs: number): T | null;
+//# sourceMappingURL=providers.logic.d.ts.map

package/dist/modules/providers/providers.logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.logic.d.ts","sourceRoot":"","sources":["../../../src/modules/providers/providers.logic.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,QAAqB,CAAA;AAEzD,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG7F;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,kBAAkB,EACtD,OAAO,EAAE,CAAC,EAAE,EACZ,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,GACf,CAAC,GAAG,IAAI,CAWV"}

package/dist/modules/providers/providers.logic.js

@@ -0,0 +1,46 @@
+// Pure rotation logic for usage-aware credential pools (subscription tokens AND
+// direct-provider API keys), kept separate from the services so it can be
+// unit-tested without a repository. The policy is usage-aware: prefer the row
+// that has consumed the fewest tokens in the current rolling window, falling back
+// to least-recently-leased (round-robin) and then oldest-created for ties and
+// cold-start rows.
+/** Default rolling usage window (~5h) — mirrors subscription quota windows. */
+export const DEFAULT_USAGE_WINDOW_MS = 5 * 60 * 60 * 1000;
+/** Effective window usage for a row: counters reset once the window ages out. */
+export function windowUsage(record, now, windowMs) {
+    if (record.windowStartedAt == null || now - record.windowStartedAt >= windowMs)
+        return 0;
+    return record.inputTokens + record.outputTokens;
+}
+/**
+ * Choose the next row to lease from a non-empty list of live pool rows.
+ * Least window usage wins; ties break by least-recently-leased (nulls first =
+ * never leased), then oldest created. Returns null only for an empty list.
+ */
+export function chooseToken(records, now, windowMs) {
+    let best = null;
+    let bestUsage = Number.POSITIVE_INFINITY;
+    for (const record of records) {
+        const usage = windowUsage(record, now, windowMs);
+        if (best === null || usage < bestUsage || (usage === bestUsage && isFresher(record, best))) {
+            best = record;
+            bestUsage = usage;
+        }
+    }
+    return best;
+}
+// Tiebreak: a row never leased (lastUsedAt null) is preferred; otherwise the
+// one leased longest ago; otherwise the one created first.
+function isFresher(candidate, current) {
+    const a = candidate.lastUsedAt;
+    const b = current.lastUsedAt;
+    if (a !== b) {
+        if (a == null)
+            return true;
+        if (b == null)
+            return false;
+        return a < b;
+    }
+    return candidate.createdAt < current.createdAt;
+}
+//# sourceMappingURL=providers.logic.js.map

package/dist/modules/providers/providers.logic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.logic.js","sourceRoot":"","sources":["../../../src/modules/providers/providers.logic.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,0EAA0E;AAC1E,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,mBAAmB;AAenB,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEzD,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,MAA0B,EAAE,GAAW,EAAE,QAAgB;IACnF,IAAI,MAAM,CAAC,eAAe,IAAI,IAAI,IAAI,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ;QAAE,OAAO,CAAC,CAAA;IACxF,OAAO,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAY,EACZ,GAAW,EACX,QAAgB;IAEhB,IAAI,IAAI,GAAa,IAAI,CAAA;IACzB,IAAI,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAA;IACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;QAChD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,SAAS,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,GAAG,MAAM,CAAA;YACb,SAAS,GAAG,KAAK,CAAA;QACnB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,6EAA6E;AAC7E,2DAA2D;AAC3D,SAAS,SAAS,CAAC,SAA6B,EAAE,OAA2B;IAC3E,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAA;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,UAAU,CAAA;IAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1B,IAAI,CAAC,IAAI,IAAI;YAAE,OAAO,KAAK,CAAA;QAC3B,OAAO,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;AAChD,CAAC"}

package/dist/modules/runners/HttpRunnerPoolProvider.d.ts

@@ -0,0 +1,51 @@
+import type { RunnerDispatchRequest, RunnerJobView, RunnerPollRequest, RunnerPoolProvider, UrlSafetyPolicy } from '@cat-factory/kernel';
+/** Carries the HTTP status so callers can surface a meaningful (redacted) error. */
+export declare class RunnerPoolApiError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export interface HttpRunnerPoolProviderOptions {
+    defaultTimeoutMs?: number;
+    /** URL/host safety policy; defaults to strict (https-only, no private hosts). */
+    urlPolicy?: UrlSafetyPolicy;
+}
+export declare class HttpRunnerPoolProvider implements RunnerPoolProvider {
+    private readonly defaultTimeoutMs;
+    private readonly urlPolicy;
+    /** Per-isolate OAuth token cache, keyed by token URL + client id. */
+    private readonly oauthCache;
+    constructor(options?: HttpRunnerPoolProviderOptions);
+    dispatch(req: RunnerDispatchRequest): Promise<void>;
+    poll(req: RunnerPollRequest): Promise<RunnerJobView>;
+    release(req: RunnerPollRequest): Promise<void>;
+    /**
+     * The bounded interpolation scope a template sees:
+     *   - `{{input.jobId}}` — the id the pool is keyed on (sticky routing target);
+     *   - `{{input.job}}`   — the full harness job spec as JSON, so a body template can
+     *                         forward it verbatim (`{"payload":{{input.job}}}`);
+     *   - `{{input.kind}}`  — the harness job kind (`run` | `blueprint` | `spec` |
+     *                         `explore` | `bootstrap` | `ci-fix` | `resolve-conflicts` |
+     *                         `merge` | `on-call` | `test` | `fix-tests`). The harness
+     *                         itself reads the kind from the job body (`POST /jobs`), so
+     *                         a manifest does NOT need to route by kind; this is exposed
+     *                         flat only so a manifest can map it to a scheduler-side
+     *                         node selector / queue / resource hint without decoding the
+     *                         embedded `{{input.job}}` JSON;
+     *   - `{{input.instanceType}}` / `{{input.cloudProvider}}` — the provisioning hints
+     *                         the transport stamped on for a self-provisioning pool
+     *                         (present only when the service pins a size/provider), so a
+     *                         manifest can map them to a node selector / resource request
+     *                         / queue without decoding `{{input.job}}`.
+     * Reuses the environments interpolation machinery; the second (`provision`)
+     * namespace is unused by runner manifests.
+     */
+    private scope;
+    private execute;
+    private buildUrl;
+    private authHeaders;
+    private oauthToken;
+    /** Project the scheduler's arbitrary status response onto the canonical view. */
+    private mapJobView;
+    private mapProgress;
+}
+//# sourceMappingURL=HttpRunnerPoolProvider.d.ts.map

package/dist/modules/runners/HttpRunnerPoolProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpRunnerPoolProvider.d.ts","sourceRoot":"","sources":["../../../src/modules/runners/HttpRunnerPoolProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EAErB,aAAa,EACb,iBAAiB,EAGjB,kBAAkB,EAGlB,eAAe,EAChB,MAAM,qBAAqB,CAAA;AA0B5B,oFAAoF;AACpF,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IADzB,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,MAAM,WAAW,6BAA6B;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iFAAiF;IACjF,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,qBAAa,sBAAuB,YAAW,kBAAkB;IAC/D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0D;IAErF,YAAY,OAAO,GAAE,6BAAkC,EAGtD;IAEK,QAAQ,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxD;IAEK,IAAI,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAQzD;IAEK,OAAO,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnD;IAID;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,KAAK;YAmBC,OAAO;IAiDrB,OAAO,CAAC,QAAQ;YAoBF,WAAW;YAgCX,UAAU;IA+CxB,iFAAiF;IACjF,OAAO,CAAC,UAAU;IA4ClB,OAAO,CAAC,WAAW;CAiBpB"}