@contextplusplus/core 1.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yigit Konur
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/application/cache/key.d.ts

@@ -0,0 +1,21 @@
+import type { EndpointId, ProviderId } from "../../domain/ids.js";
+export interface CacheKeyInput {
+    readonly providerId: ProviderId | string;
+    readonly endpointId: EndpointId | string;
+    readonly method: string;
+    readonly url: string | URL;
+    readonly query?: Readonly<Record<string, string | number | boolean | null | undefined>>;
+    readonly body?: unknown;
+    readonly vary?: Readonly<Record<string, string | undefined>>;
+    readonly apiVersion?: string;
+}
+export declare const PROVIDER_CACHE_KEY_PREFIX = "contextplusplus:provider:";
+export declare const TRACKING_PARAM_PATTERN: RegExp;
+export declare const TRACKING_PARAMS: ReadonlySet<string>;
+export declare function buildCacheKey(input: CacheKeyInput): string;
+export declare function isProviderCacheKey(key: string): boolean;
+export declare function canonicalizeUrl(value: string | URL, query?: Readonly<Record<string, string | number | boolean | null | undefined>>): string;
+export declare function sanitizeVaryHeaders(headers: Readonly<Record<string, string | undefined>>): Record<string, string>;
+export declare function isSecretHeaderName(name: string): boolean;
+export declare function stableStringify(value: unknown): string;
+//# sourceMappingURL=key.d.ts.map

package/dist/application/cache/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../../src/application/cache/key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAIrE,eAAO,MAAM,sBAAsB,QAAW,CAAC;AAC/C,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAI9C,CAAC;AAUH,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAe1D;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,GAAG,EACnB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAC7E,MAAM,CA0BR;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACpD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBxB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOxD;AAMD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAmBtD"}

package/dist/application/cache/key.js

@@ -0,0 +1,110 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2e347fbc-e061-5a55-bffe-01873c1feb1c")}catch(e){}}();
+import { createHash } from "node:crypto";
+export const PROVIDER_CACHE_KEY_PREFIX = "contextplusplus:provider:";
+// Canonical tracking-param literals — also consumed by
+// src/infrastructure/markdown/handlebars-renderer.ts. Extend the set here, do
+// NOT redeclare these in renderer / sanitizer code.
+export const TRACKING_PARAM_PATTERN = /^utm_/i;
+export const TRACKING_PARAMS = new Set([
+    "fbclid",
+    "gclid",
+    "msclkid"
+]);
+const BLOCKED_HEADER_NAMES = new Set([
+    "authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key"
+]);
+const TOKEN_HEADER_PATTERN = /(^|-)token($|-)/i;
+const SECRET_HEADER_PATTERN = /(^|-)secret($|-)/i;
+export function buildCacheKey(input) {
+    const providerId = String(input.providerId);
+    const endpointId = String(input.endpointId);
+    const canonical = {
+        providerId,
+        endpointId,
+        method: input.method.toUpperCase(),
+        url: canonicalizeUrl(input.url, input.query),
+        vary: sanitizeVaryHeaders(input.vary ?? {}),
+        ...(input.apiVersion !== undefined ? { apiVersion: input.apiVersion } : {}),
+        ...(input.body !== undefined ? { body: input.body } : {})
+    };
+    const hash = createHash("sha256").update(stableStringify(canonical)).digest("hex");
+    return `${PROVIDER_CACHE_KEY_PREFIX}${providerId}:${endpointId}:${hash}`;
+}
+export function isProviderCacheKey(key) {
+    return key.startsWith(PROVIDER_CACHE_KEY_PREFIX);
+}
+export function canonicalizeUrl(value, query) {
+    const url = new URL(value.toString());
+    url.hostname = url.hostname.toLowerCase();
+    url.hash = "";
+    if (query !== undefined) {
+        for (const [key, entryValue] of Object.entries(query)) {
+            url.searchParams.delete(key);
+            if (entryValue !== undefined && entryValue !== null) {
+                url.searchParams.append(key, String(entryValue));
+            }
+        }
+    }
+    const sortedSearch = [...url.searchParams.entries()]
+        .filter(([key]) => !isTrackingParam(key))
+        .sort(([leftKey, leftValue], [rightKey, rightValue]) => {
+        const keyCompare = leftKey.localeCompare(rightKey);
+        return keyCompare === 0 ? leftValue.localeCompare(rightValue) : keyCompare;
+    });
+    url.search = "";
+    for (const [key, entryValue] of sortedSearch) {
+        url.searchParams.append(key, entryValue);
+    }
+    return url.toString();
+}
+export function sanitizeVaryHeaders(headers) {
+    const output = {};
+    for (const [name, value] of Object.entries(headers)) {
+        const normalizedName = name.toLowerCase();
+        if (value === undefined) {
+            continue;
+        }
+        const trimmedValue = value.trim();
+        if (isSecretHeaderName(normalizedName)) {
+            output[`${normalizedName}:sha256`] = createHash("sha256")
+                .update(trimmedValue)
+                .digest("hex");
+        }
+        else {
+            output[normalizedName] = trimmedValue;
+        }
+    }
+    return Object.fromEntries(Object.entries(output).sort(([left], [right]) => left.localeCompare(right)));
+}
+export function isSecretHeaderName(name) {
+    const normalizedName = name.toLowerCase();
+    return (BLOCKED_HEADER_NAMES.has(normalizedName) ||
+        TOKEN_HEADER_PATTERN.test(normalizedName) ||
+        SECRET_HEADER_PATTERN.test(normalizedName));
+}
+function isTrackingParam(name) {
+    return TRACKING_PARAM_PATTERN.test(name) || TRACKING_PARAMS.has(name.toLowerCase());
+}
+export function stableStringify(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+    }
+    const entries = Object.entries(value).sort(([left], [right]) => {
+        return left.localeCompare(right);
+    });
+    const body = entries
+        .map(([key, child]) => {
+        return `${JSON.stringify(key)}:${stableStringify(child)}`;
+    })
+        .join(",");
+    return `{${body}}`;
+}
+//# sourceMappingURL=key.js.map
+//# debugId=2e347fbc-e061-5a55-bffe-01873c1feb1c

package/dist/application/cache/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sources":["../../../src/application/cache/key.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAczC,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AACrE,uDAAuD;AACvD,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAQ,CAAC;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,QAAQ;IACR,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,WAAW;CACZ,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,KAAoB;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG;QAChB,UAAU;QACV,UAAU;QACV,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAClC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;QAC5C,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnF,OAAO,GAAG,yBAAyB,GAAG,UAAU,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAAmB,EACnB,KAA8E;IAE9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACpD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE;QACrD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7E,CAAC,CAAC,CAAC;IACL,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7C,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAqD;IAErD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,cAAc,SAAS,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;iBACtD,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,cAAc,CAAC,GAAG,YAAY,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACL,oBAAoB,CAAC,GAAG,CAAC,cAAc,CAAC;QACxC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC;QACzC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE;QAC7D,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QACpB,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,OAAO,IAAI,IAAI,GAAG,CAAC;AACrB,CAAC","debugId":"2e347fbc-e061-5a55-bffe-01873c1feb1c"}

package/dist/application/cache/ttl.d.ts

@@ -0,0 +1,2 @@
+export declare function remainingTtlSecondsFromExpiresAt(expiresAt: string, now?: Date): number | undefined;
+//# sourceMappingURL=ttl.d.ts.map

package/dist/application/cache/ttl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl.d.ts","sourceRoot":"","sources":["../../../src/application/cache/ttl.ts"],"names":[],"mappings":"AAEA,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,IAAiB,GACrB,MAAM,GAAG,SAAS,CAMpB"}

package/dist/application/cache/ttl.js

@@ -0,0 +1,13 @@
+// Shared TTL math for cache layers. Both the legacy Promise cache and the
+// active Effect cache need the same overwrite-rollback TTL calculation.
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4532b61a-dda7-5783-a51e-e24c7d696a1a")}catch(e){}}();
+export function remainingTtlSecondsFromExpiresAt(expiresAt, now = new Date()) {
+    const remainingMs = Date.parse(expiresAt) - now.getTime();
+    if (!Number.isFinite(remainingMs) || remainingMs <= 0) {
+        return undefined;
+    }
+    return Math.max(1, Math.ceil(remainingMs / 1000));
+}
+//# sourceMappingURL=ttl.js.map
+//# debugId=4532b61a-dda7-5783-a51e-e24c7d696a1a

package/dist/application/cache/ttl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ttl.js","sources":["../../../src/application/cache/ttl.ts"],"sourceRoot":"","names":[],"mappings":"AAAA,0EAA0E;AAC1E,wEAAwE;;;AACxE,MAAM,UAAU,gCAAgC,CAC9C,SAAiB,EACjB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC","debugId":"4532b61a-dda7-5783-a51e-e24c7d696a1a"}

package/dist/application/config/provider-policy-schema.d.ts

@@ -0,0 +1,69 @@
+import { Duration, Schema } from "effect";
+export declare const ProviderCapabilitySchema: Schema.Literal<["single", "batch", "crawl", "map", "browser", "structured-extract"]>;
+export declare const RatePolicySchema: Schema.Struct<{
+    algorithm: Schema.Literal<["fixed-window", "token-bucket"]>;
+    documentedLimit: Schema.filter<typeof Schema.Number>;
+    interval: typeof Schema.Duration;
+    utilizationTarget: Schema.optionalWith<Schema.filter<typeof Schema.Number>, {
+        default: () => number;
+    }>;
+    maxConcurrency: Schema.filter<Schema.filter<typeof Schema.Number>>;
+}>;
+export declare const BatchPolicySchema: Schema.Struct<{
+    maxItems: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    maxPayloadBytes: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    supportsPartialResults: typeof Schema.Boolean;
+    pollInterval: typeof Schema.Duration;
+    resultTtl: typeof Schema.Duration;
+}>;
+export declare const CachePolicySchema: Schema.Struct<{
+    cacheable: typeof Schema.Boolean;
+    ttl: typeof Schema.Duration;
+    originAllowlist: Schema.Array$<typeof Schema.String>;
+}>;
+export declare const FallbackPolicySchema: Schema.Struct<{
+    fallbackOn: Schema.Array$<typeof Schema.String>;
+    stopOn: Schema.Array$<typeof Schema.String>;
+}>;
+export declare const ProviderPolicySchema: Schema.Struct<{
+    providerId: Schema.brand<Schema.filter<typeof Schema.NonEmptyString>, "ProviderId">;
+    serviceId: Schema.brand<Schema.filter<typeof Schema.NonEmptyString>, "ServiceId">;
+    endpointId: Schema.brand<Schema.filter<typeof Schema.NonEmptyString>, "EndpointId">;
+    capabilities: Schema.Array$<Schema.Literal<["single", "batch", "crawl", "map", "browser", "structured-extract"]>>;
+    cost: Schema.filter<typeof Schema.Number>;
+    ratePolicy: Schema.Struct<{
+        algorithm: Schema.Literal<["fixed-window", "token-bucket"]>;
+        documentedLimit: Schema.filter<typeof Schema.Number>;
+        interval: typeof Schema.Duration;
+        utilizationTarget: Schema.optionalWith<Schema.filter<typeof Schema.Number>, {
+            default: () => number;
+        }>;
+        maxConcurrency: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    }>;
+    batchPolicy: Schema.optional<Schema.Struct<{
+        maxItems: Schema.filter<Schema.filter<typeof Schema.Number>>;
+        maxPayloadBytes: Schema.filter<Schema.filter<typeof Schema.Number>>;
+        supportsPartialResults: typeof Schema.Boolean;
+        pollInterval: typeof Schema.Duration;
+        resultTtl: typeof Schema.Duration;
+    }>>;
+    cachePolicy: Schema.Struct<{
+        cacheable: typeof Schema.Boolean;
+        ttl: typeof Schema.Duration;
+        originAllowlist: Schema.Array$<typeof Schema.String>;
+    }>;
+    fallbackPolicy: Schema.Struct<{
+        fallbackOn: Schema.Array$<typeof Schema.String>;
+        stopOn: Schema.Array$<typeof Schema.String>;
+    }>;
+    timeout: typeof Schema.Duration;
+}>;
+export type ProviderPolicyConfig = Schema.Schema.Type<typeof ProviderPolicySchema>;
+export declare const defaultBatchPolicy: {
+    readonly maxItems: 100;
+    readonly maxPayloadBytes: number;
+    readonly supportsPartialResults: true;
+    readonly pollInterval: Duration.Duration;
+    readonly resultTtl: Duration.Duration;
+};
+//# sourceMappingURL=provider-policy-schema.d.ts.map

package/dist/application/config/provider-policy-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-policy-schema.d.ts","sourceRoot":"","sources":["../../../src/application/config/provider-policy-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAG1C,eAAO,MAAM,wBAAwB,sFAOpC,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;EAS3B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;EAI5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;EAG/B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW/B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEnF,eAAO,MAAM,kBAAkB;;;;;;CAMrB,CAAC"}

package/dist/application/config/provider-policy-schema.js

@@ -0,0 +1,49 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="883ec9c7-33fb-5225-b46e-178377b165a5")}catch(e){}}();
+import { Duration, Schema } from "effect";
+import { EndpointId, ProviderId, ServiceId } from "../../domain/ids.js";
+export const ProviderCapabilitySchema = Schema.Literal("single", "batch", "crawl", "map", "browser", "structured-extract");
+export const RatePolicySchema = Schema.Struct({
+    algorithm: Schema.Literal("fixed-window", "token-bucket"),
+    documentedLimit: Schema.Number.pipe(Schema.greaterThan(0)),
+    interval: Schema.Duration,
+    utilizationTarget: Schema.Number.pipe(Schema.between(0.1, 1), Schema.optionalWith({ default: () => 0.95 })),
+    maxConcurrency: Schema.Number.pipe(Schema.int(), Schema.greaterThan(0))
+});
+export const BatchPolicySchema = Schema.Struct({
+    maxItems: Schema.Number.pipe(Schema.int(), Schema.greaterThan(0)),
+    maxPayloadBytes: Schema.Number.pipe(Schema.int(), Schema.greaterThan(0)),
+    supportsPartialResults: Schema.Boolean,
+    pollInterval: Schema.Duration,
+    resultTtl: Schema.Duration
+});
+export const CachePolicySchema = Schema.Struct({
+    cacheable: Schema.Boolean,
+    ttl: Schema.Duration,
+    originAllowlist: Schema.Array(Schema.String)
+});
+export const FallbackPolicySchema = Schema.Struct({
+    fallbackOn: Schema.Array(Schema.String),
+    stopOn: Schema.Array(Schema.String)
+});
+export const ProviderPolicySchema = Schema.Struct({
+    providerId: ProviderId,
+    serviceId: ServiceId,
+    endpointId: EndpointId,
+    capabilities: Schema.Array(ProviderCapabilitySchema),
+    cost: Schema.Number.pipe(Schema.greaterThan(0)),
+    ratePolicy: RatePolicySchema,
+    batchPolicy: Schema.optional(BatchPolicySchema),
+    cachePolicy: CachePolicySchema,
+    fallbackPolicy: FallbackPolicySchema,
+    timeout: Schema.Duration
+});
+export const defaultBatchPolicy = {
+    maxItems: 100,
+    maxPayloadBytes: 1024 * 1024,
+    supportsPartialResults: true,
+    pollInterval: Duration.seconds(2),
+    resultTtl: Duration.hours(1)
+};
+//# sourceMappingURL=provider-policy-schema.js.map
+//# debugId=883ec9c7-33fb-5225-b46e-178377b165a5

package/dist/application/config/provider-policy-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-policy-schema.js","sources":["../../../src/application/config/provider-policy-schema.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAExE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,OAAO,CACpD,QAAQ,EACR,OAAO,EACP,OAAO,EACP,KAAK,EACL,SAAS,EACT,oBAAoB,CACrB,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC;IACzD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CACnC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EACtB,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAC7C;IACD,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CACxE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxE,sBAAsB,EAAE,MAAM,CAAC,OAAO;IACtC,YAAY,EAAE,MAAM,CAAC,QAAQ;IAC7B,SAAS,EAAE,MAAM,CAAC,QAAQ;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC,OAAO;IACzB,GAAG,EAAE,MAAM,CAAC,QAAQ;IACpB,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,UAAU;IACtB,SAAS,EAAE,SAAS;IACpB,UAAU,EAAE,UAAU;IACtB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/C,UAAU,EAAE,gBAAgB;IAC5B,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,iBAAiB;IAC9B,cAAc,EAAE,oBAAoB;IACpC,OAAO,EAAE,MAAM,CAAC,QAAQ;CACzB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,GAAG;IACb,eAAe,EAAE,IAAI,GAAG,IAAI;IAC5B,sBAAsB,EAAE,IAAI;IAC5B,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;CACpB,CAAC","debugId":"883ec9c7-33fb-5225-b46e-178377b165a5"}

package/dist/application/ports/api-key-service.d.ts

@@ -0,0 +1,49 @@
+import { Context, type Effect, type Redacted } from "effect";
+import type { BillingStateError, InputValidationError, NotFoundError } from "../../domain/errors.js";
+import type { UserId } from "../../domain/ids.js";
+import type { ApiKeyScope } from "../../domain/scopes.js";
+export interface ApiKeyMetadata {
+    readonly id: string;
+    readonly name: string;
+    readonly keyPrefix: string;
+    readonly createdAt: string;
+    readonly lastUsedAt: string | null;
+    readonly expiresAt: string | null;
+    readonly revokedAt: string | null;
+    /** Capability scopes granted to this key (full set for legacy keys). */
+    readonly scopes: readonly ApiKeyScope[];
+}
+export interface CreatedApiKey {
+    readonly key: Redacted.Redacted<string>;
+    readonly metadata: ApiKeyMetadata;
+}
+export interface ApiKeyServiceApi {
+    readonly create: (options: {
+        readonly userId: UserId;
+        readonly name: string;
+        readonly expiresAt?: string | undefined;
+        /** Scopes to grant; omitted/empty → full scope (back-compat default). */
+        readonly scopes?: readonly ApiKeyScope[] | undefined;
+    }) => Effect.Effect<CreatedApiKey, InputValidationError | BillingStateError>;
+    readonly list: (userId: UserId) => Effect.Effect<readonly ApiKeyMetadata[], BillingStateError>;
+    readonly revoke: (options: {
+        readonly userId: UserId;
+        readonly keyId: string;
+    }) => Effect.Effect<ApiKeyMetadata, InputValidationError | NotFoundError | BillingStateError>;
+    /**
+     * Mints a fresh secret on the caller's OWN key, invalidating the old secret
+     * immediately. Returns the new raw secret exactly once (same shape as
+     * {@link create}). A missing, foreign, or already-revoked key resolves to a
+     * {@link NotFoundError} so key ids stay non-enumerable across accounts.
+     */
+    readonly rotate: (options: {
+        readonly userId: UserId;
+        readonly keyId: string;
+    }) => Effect.Effect<CreatedApiKey, InputValidationError | NotFoundError | BillingStateError>;
+}
+declare const ApiKeyService_base: Context.TagClass<ApiKeyService, "app/ApiKeyService", ApiKeyServiceApi>;
+export declare class ApiKeyService extends ApiKeyService_base {
+    static make(service: Context.Tag.Service<ApiKeyService>): ApiKeyServiceApi;
+}
+export {};
+//# sourceMappingURL=api-key-service.d.ts.map

package/dist/application/ports/api-key-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-service.d.ts","sourceRoot":"","sources":["../../../src/application/ports/api-key-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACd,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxC,yEAAyE;QACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC;KACtD,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,oBAAoB,GAAG,iBAAiB,CAAC,CAAC;IAC7E,QAAQ,CAAC,IAAI,EAAE,CACb,MAAM,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,KAAK,MAAM,CAAC,MAAM,CACjB,cAAc,EACd,oBAAoB,GAAG,aAAa,GAAG,iBAAiB,CACzD,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,KAAK,MAAM,CAAC,MAAM,CACjB,aAAa,EACb,oBAAoB,GAAG,aAAa,GAAG,iBAAiB,CACzD,CAAC;CACH;;AAED,qBAAa,aAAc,SAAQ,kBAGhC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;CAGxD"}

package/dist/application/ports/api-key-service.js

@@ -0,0 +1,10 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="1d4459d3-589d-548b-b74a-609c08469921")}catch(e){}}();
+import { Context } from "effect";
+export class ApiKeyService extends Context.Tag("app/ApiKeyService")() {
+    static make(service) {
+        return service;
+    }
+}
+//# sourceMappingURL=api-key-service.js.map
+//# debugId=1d4459d3-589d-548b-b74a-609c08469921

package/dist/application/ports/api-key-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-service.js","sources":["../../../src/application/ports/api-key-service.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,OAAO,EAA8B,MAAM,QAAQ,CAAC;AA2D7D,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAGhE;IACD,MAAM,CAAC,IAAI,CAAC,OAA2C;QACrD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF","debugId":"1d4459d3-589d-548b-b74a-609c08469921"}

package/dist/application/ports/artifact-store.d.ts

@@ -0,0 +1,26 @@
+import { Context, Effect } from "effect";
+import { ArtifactWriteError } from "../../domain/errors.js";
+import type { RunId } from "../../domain/ids.js";
+import type { ArtifactPaths } from "../../domain/result.js";
+export type ArtifactName = keyof ArtifactPaths;
+export interface SaveRunArtifactOptions {
+    readonly extension?: "json" | "md" | "txt";
+    readonly redactSecrets?: boolean;
+}
+declare const ArtifactStore_base: Context.TagClass<ArtifactStore, "app/ArtifactStore", {
+    readonly saveRunArtifact: (runId: RunId | string, name: ArtifactName, body: unknown, options?: SaveRunArtifactOptions) => Effect.Effect<{
+        readonly absolutePath: string;
+    }, ArtifactWriteError>;
+    readonly saveRunBundle: (runId: RunId | string, files: Partial<Record<ArtifactName, unknown>>) => Effect.Effect<ArtifactPaths, ArtifactWriteError>;
+}>;
+export declare class ArtifactStore extends ArtifactStore_base {
+    static make(service: Context.Tag.Service<ArtifactStore>): {
+        readonly saveRunArtifact: (runId: RunId | string, name: ArtifactName, body: unknown, options?: SaveRunArtifactOptions) => Effect.Effect<{
+            readonly absolutePath: string;
+        }, ArtifactWriteError>;
+        readonly saveRunBundle: (runId: RunId | string, files: Partial<Record<ArtifactName, unknown>>) => Effect.Effect<ArtifactPaths, ArtifactWriteError>;
+    };
+}
+export type ArtifactStoreApi = Context.Tag.Service<typeof ArtifactStore>;
+export {};
+//# sourceMappingURL=artifact-store.d.ts.map

package/dist/application/ports/artifact-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-store.d.ts","sourceRoot":"","sources":["../../../src/application/ports/artifact-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;;8BAK6B,CACxB,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,sBAAsB,KAC7B,MAAM,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EAAE,kBAAkB,CAAC;4BACjD,CACtB,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;;AAZzD,qBAAa,aAAc,SAAQ,kBAchC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;kCAZ3B,CACxB,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,sBAAsB,KAC7B,MAAM,CAAC,MAAM,CAAC;YAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;SAAE,EAAE,kBAAkB,CAAC;gCACjD,CACtB,KAAK,EAAE,KAAK,GAAG,MAAM,EACrB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;;CAMxD;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/application/ports/artifact-store.js

@@ -0,0 +1,11 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="88c9403a-cd36-5b96-83a1-9752a2ca340e")}catch(e){}}();
+import { Context, Effect } from "effect";
+import { ArtifactWriteError } from "../../domain/errors.js";
+export class ArtifactStore extends Context.Tag("app/ArtifactStore")() {
+    static make(service) {
+        return service;
+    }
+}
+//# sourceMappingURL=artifact-store.js.map
+//# debugId=88c9403a-cd36-5b96-83a1-9752a2ca340e

package/dist/application/ports/artifact-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-store.js","sources":["../../../src/application/ports/artifact-store.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAW5D,MAAM,OAAO,aAAc,SAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAchE;IACD,MAAM,CAAC,IAAI,CAAC,OAA2C;QACrD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF","debugId":"88c9403a-cd36-5b96-83a1-9752a2ca340e"}

package/dist/application/ports/auth-service.d.ts

@@ -0,0 +1,38 @@
+import { Context, type Effect, type Redacted } from "effect";
+import type { InvalidCredentialError } from "../../domain/errors.js";
+import type { UserId } from "../../domain/ids.js";
+import type { ApiKeyScope } from "../../domain/scopes.js";
+/**
+ * How a request presented its identity. `bearer` is a Supabase Auth JWT;
+ * `api-key` is a hashed programmatic key from the `api_keys` table.
+ */
+export type AuthCredentialKind = "bearer" | "api-key";
+export interface AuthenticatedUser {
+    readonly userId: UserId;
+    readonly email?: string;
+    readonly role: string;
+    readonly credential: AuthCredentialKind;
+    /**
+     * Capability scopes for an `api-key` credential. Omitted for bearer sessions
+     * (implicitly full-scope) and for legacy keys with no explicit scope set
+     * (also treated as full). Present and possibly-restricted only for a scoped
+     * key; the boundary gates routes against it via `authorizesScope`.
+     */
+    readonly scopes?: readonly ApiKeyScope[];
+}
+/**
+ * The port only fails when a credential was presented but could not be
+ * verified. "No credential at all" is an `AuthenticationRequiredError` raised
+ * by the boundary/workflow, not by this service.
+ */
+export type AuthServiceError = InvalidCredentialError;
+export interface AuthServiceApi {
+    readonly verifyBearerToken: (token: Redacted.Redacted<string>) => Effect.Effect<AuthenticatedUser, AuthServiceError, never>;
+    readonly verifyApiKey: (apiKey: Redacted.Redacted<string>) => Effect.Effect<AuthenticatedUser, AuthServiceError, never>;
+}
+declare const AuthService_base: Context.TagClass<AuthService, "app/AuthService", AuthServiceApi>;
+export declare class AuthService extends AuthService_base {
+    static make(service: Context.Tag.Service<AuthService>): AuthServiceApi;
+}
+export {};
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/application/ports/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../src/application/ports/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEtD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC/D,QAAQ,CAAC,YAAY,EAAE,CACrB,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAC9B,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;CAChE;;AAED,qBAAa,WAAY,SAAQ,gBAG9B;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;CAGtD"}

package/dist/application/ports/auth-service.js

@@ -0,0 +1,10 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="de55ec61-6fa5-5617-8cf2-5949464554bf")}catch(e){}}();
+import { Context } from "effect";
+export class AuthService extends Context.Tag("app/AuthService")() {
+    static make(service) {
+        return service;
+    }
+}
+//# sourceMappingURL=auth-service.js.map
+//# debugId=de55ec61-6fa5-5617-8cf2-5949464554bf

package/dist/application/ports/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sources":["../../../src/application/ports/auth-service.ts"],"sourceRoot":"","names":[],"mappings":";;AAAA,OAAO,EAAE,OAAO,EAA8B,MAAM,QAAQ,CAAC;AAyC7D,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAG5D;IACD,MAAM,CAAC,IAAI,CAAC,OAAyC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF","debugId":"de55ec61-6fa5-5617-8cf2-5949464554bf"}

package/dist/application/ports/billing-service.d.ts

@@ -0,0 +1,84 @@
+import { Context, type Effect, type Redacted } from "effect";
+import type { BillingStateError, InputValidationError } from "../../domain/errors.js";
+import type { UserId } from "../../domain/ids.js";
+/**
+ * The two flat Model A tiers. Both map 1:1 to a `plan_tiers` row and to a flat
+ * recurring Stripe Price via config (standard $7 / pro $17). There is no metered
+ * usage — quota is enforced app-side via `check_and_increment_quota`.
+ */
+export type BillingPlan = "standard" | "pro";
+export interface CheckoutSessionRequest {
+    readonly userId: UserId;
+    readonly plan: BillingPlan;
+    readonly customerEmail?: string;
+}
+/**
+ * Opening a billing portal is bound to the authenticated user only. The Stripe
+ * customer is resolved server-side from the user's mapped customer
+ * (`profiles.stripe_customer_id`); the request never carries a client-supplied
+ * customer id, so one tenant can never target another tenant's customer (IDOR).
+ */
+export interface PortalSessionRequest {
+    readonly userId: UserId;
+}
+/** A redirect URL the client sends the browser to (Stripe-hosted page). */
+export interface BillingSessionResult {
+    readonly url: string;
+}
+/**
+ * Outcome of processing one verified Stripe webhook event. `applied` is false
+ * for an ignored event type or a duplicate (at-least-once) delivery; the route
+ * still answers 200 so Stripe stops retrying.
+ */
+export interface WebhookProcessResult {
+    readonly applied: boolean;
+    readonly eventType: string;
+}
+/**
+ * Creating a checkout / portal session reaches Stripe (network) and so can fail
+ * with `BillingStateError` (502/500-class). An unknown plan or missing price
+ * configuration is an `InputValidationError`.
+ */
+export type BillingSessionError = InputValidationError | BillingStateError;
+/**
+ * A bad or missing `Stripe-Signature` is an `InputValidationError` (sanitized
+ * 400 — never echoes the signature); an upsert failure is a `BillingStateError`.
+ */
+export type WebhookError = InputValidationError | BillingStateError;
+export interface BillingServiceApi {
+    readonly createCheckoutSession: (request: CheckoutSessionRequest) => Effect.Effect<BillingSessionResult, BillingSessionError, never>;
+    readonly createPortalSession: (request: PortalSessionRequest) => Effect.Effect<BillingSessionResult, BillingSessionError, never>;
+    /**
+     * Verifies the raw signed payload against the webhook secret and, on a
+     * subscription lifecycle event, upserts `subscriptions` idempotently. The raw
+     * body string is required by Stripe's `constructEvent`; the route must read it
+     * before any JSON body parser runs.
+     */
+    readonly handleWebhookEvent: (input: {
+        readonly payload: string;
+        readonly signature: string | undefined;
+    }) => Effect.Effect<WebhookProcessResult, WebhookError, never>;
+}
+declare const BillingService_base: Context.TagClass<BillingService, "app/BillingService", BillingServiceApi>;
+export declare class BillingService extends BillingService_base {
+    static make(service: Context.Tag.Service<BillingService>): BillingServiceApi;
+}
+/**
+ * Maps a Stripe Price id to a Model A plan. Lives here (not the live layer) so
+ * routes and the fake share one resolution rule. The id strings come from
+ * config; an unknown price resolves to `undefined` (caller raises a billing
+ * error rather than guessing a tier).
+ */
+export declare function planForPriceId(priceId: string | null | undefined, prices: {
+    readonly standard?: string;
+    readonly pro?: string;
+}): BillingPlan | undefined;
+/** The config-supplied Stripe Price id for a plan, or `undefined` if unset. */
+export declare function priceIdForPlan(plan: BillingPlan, prices: {
+    readonly standard?: string;
+    readonly pro?: string;
+}): string | undefined;
+/** Stripe credential helper shared by the live layer when feeding the SDK. */
+export type StripeSecret = Redacted.Redacted<string>;
+export {};
+//# sourceMappingURL=billing-service.d.ts.map

package/dist/application/ports/billing-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-service.d.ts","sourceRoot":"","sources":["../../../src/application/ports/billing-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;AAE7C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,qBAAqB,EAAE,CAC9B,OAAO,EAAE,sBAAsB,KAC5B,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;IACrE,QAAQ,CAAC,mBAAmB,EAAE,CAC5B,OAAO,EAAE,oBAAoB,KAC1B,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAC;IACrE;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KACxC,KAAK,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;CAChE;;AAED,qBAAa,cAAe,SAAQ,mBAGjC;IACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;CAGzD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,WAAW,GAAG,SAAS,CAWzB;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D,MAAM,GAAG,SAAS,CAEpB;AAED,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC"}

package/dist/application/ports/billing-service.js

@@ -0,0 +1,32 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="44d7de6c-29a9-5978-9205-01f229548d55")}catch(e){}}();
+import { Context } from "effect";
+export class BillingService extends Context.Tag("app/BillingService")() {
+    static make(service) {
+        return service;
+    }
+}
+/**
+ * Maps a Stripe Price id to a Model A plan. Lives here (not the live layer) so
+ * routes and the fake share one resolution rule. The id strings come from
+ * config; an unknown price resolves to `undefined` (caller raises a billing
+ * error rather than guessing a tier).
+ */
+export function planForPriceId(priceId, prices) {
+    if (priceId === null || priceId === undefined || priceId.length === 0) {
+        return undefined;
+    }
+    if (prices.standard !== undefined && priceId === prices.standard) {
+        return "standard";
+    }
+    if (prices.pro !== undefined && priceId === prices.pro) {
+        return "pro";
+    }
+    return undefined;
+}
+/** The config-supplied Stripe Price id for a plan, or `undefined` if unset. */
+export function priceIdForPlan(plan, prices) {
+    return plan === "standard" ? prices.standard : prices.pro;
+}
+//# sourceMappingURL=billing-service.js.map
+//# debugId=44d7de6c-29a9-5978-9205-01f229548d55