@happyvertical/smrt-inference 0.0.0-stage → 0.60.15

package/dist/server.js

@@ -0,0 +1,985 @@
+import { F as findInferenceConfigIssues, R as validateInferenceTarget, b as listFusions, y as getFusion } from "./chunks/provider-config-4Bx8N52X.js";
+import { checkInferenceBindings, inferenceProbeUrl, probeInferenceCandidate } from "./node.js";
+import { _ as normalizeTierTarget, a as INFERENCE_BINDING_NAME_PATTERN, b as tierBinding, c as describeInferenceTarget, d as isAllowedByList, f as matchesAllowPattern, g as normalizeFusionDefinition, h as normalizeDefaultTier, i as DEFAULT_TIER_BINDING, l as findKeyMember, m as normalizeAllowList, n as APP_INFERENCE_SCOPE_ID, o as INFERENCE_MODES, p as normalizeAliasDefinition, r as InferenceOverride, s as InferenceBindingValueError, t as InferenceOverrideCollection, u as inferenceTargetRef, v as parseInferenceBinding, x as getInferenceOverrideGeneration, y as stripKeyMembers } from "./chunks/InferenceOverrideCollection-wl7sI-3C.js";
+import { INFERENCE_PRESETS, INFERENCE_PRESET_IDS, INFERENCE_TIERS, getInferenceConfig, inferenceTargetKind, isInferencePresetId, isInferenceTier, mergeInferenceConfigs, reportAiUsage, resolveAutoTier } from "@happyvertical/smrt-core";
+import { AI_PROVIDER_TYPES } from "@happyvertical/ai";
+import { getDefaultAIKeyEnvName } from "@happyvertical/smrt-config";
+//#region src/settings/keys.ts
+var InferenceKeyOriginError = class extends Error {
+	status = 400;
+	constructor(reason) {
+		super(`Cannot bind the key: ${reason}`);
+		this.name = "InferenceKeyOriginError";
+	}
+};
+var LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+var SDK_DEFAULT_BASE = {
+	anthropic: "https://api.anthropic.com",
+	gemini: "https://generativelanguage.googleapis.com"
+};
+var NEEDS_BASE_URL = /* @__PURE__ */ new Set(["litellm", "bifrost"]);
+function text(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function originOf(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new InferenceKeyOriginError("the base URL is not a URL");
+	}
+	if (parsed.username || parsed.password) throw new InferenceKeyOriginError("the base URL carries credentials");
+	if (parsed.protocol === "https:") return parsed.origin;
+	if (parsed.protocol === "http:" && LOOPBACK.has(parsed.hostname)) return parsed.origin;
+	throw new InferenceKeyOriginError("a key travels only over https (plain http is allowed for loopback servers)");
+}
+function inferenceKeyOrigin(input) {
+	const baseUrl = text(input.baseUrl);
+	if (baseUrl) return originOf(baseUrl);
+	const provider = text(input.provider)?.toLowerCase();
+	const preset = text(input.preset) ?? (provider && isInferencePresetId(provider) ? provider : void 0);
+	if (!preset && (!provider || NEEDS_BASE_URL.has(provider))) return null;
+	if (preset && !isInferencePresetId(preset)) return null;
+	const url = inferenceProbeUrl(preset ? { preset } : { provider });
+	return url ? originOf(url) : null;
+}
+function bindInferenceKey(input) {
+	const provider = text(input.provider);
+	const apiKey = text(input.key);
+	if (!provider) throw new InferenceKeyOriginError("no provider");
+	if (!apiKey) throw new InferenceKeyOriginError("the key is empty");
+	const origin = inferenceKeyOrigin(input);
+	if (!origin) throw new InferenceKeyOriginError(`no endpoint is known for "${provider}"; enter its base URL first`);
+	const record = {
+		provider,
+		origin,
+		apiKey
+	};
+	const preset = text(input.preset);
+	const baseUrl = text(input.baseUrl);
+	if (preset) record.preset = preset;
+	if (baseUrl) record.baseUrl = baseUrl;
+	return record;
+}
+function inferenceProviderConfigFromKey(record, choice = {}) {
+	const model = text(choice.model);
+	const preset = text(record.preset) ?? (isInferencePresetId(record.provider) ? record.provider : void 0);
+	if (preset) {
+		if (!model) throw new InferenceKeyOriginError("a preset key needs a model");
+		const custom = text(record.baseUrl);
+		const presetUrl = isInferencePresetId(preset) ? inferenceProbeUrl({ preset }) : void 0;
+		const endpoint = custom ?? presetUrl;
+		if (!endpoint || originOf(endpoint) !== record.origin) throw new InferenceKeyOriginError(`no endpoint on ${record.origin} is known for preset "${preset}"`);
+		if (custom && (!presetUrl || originOf(presetUrl) !== record.origin)) return {
+			provider: "openai",
+			baseUrl: custom,
+			model,
+			apiKey: record.apiKey
+		};
+		return {
+			preset,
+			model,
+			apiKey: record.apiKey
+		};
+	}
+	let baseUrl = text(record.baseUrl);
+	if (!baseUrl) {
+		const provider = record.provider.toLowerCase();
+		const url = inferenceProbeUrl({ provider });
+		baseUrl = Object.hasOwn(SDK_DEFAULT_BASE, provider) ? SDK_DEFAULT_BASE[provider] : url?.replace(/\/(?:models|api\/tags)$/, "");
+	}
+	if (!baseUrl || originOf(baseUrl) !== record.origin) throw new InferenceKeyOriginError(`no endpoint on ${record.origin} is known for "${record.provider}"; enter its base URL`);
+	return {
+		provider: record.provider,
+		baseUrl,
+		...model ? { model } : {},
+		apiKey: record.apiKey
+	};
+}
+function inferenceKeyFor(record, url) {
+	if (!record?.apiKey || !record.origin) return void 0;
+	try {
+		return new URL(url).origin === record.origin ? record.apiKey : void 0;
+	} catch {
+		return;
+	}
+}
+var REDACTED_KEY = "[redacted]";
+function redactInferenceSecret(text2, secret) {
+	let out = text2;
+	if (secret && secret.length >= 4) out = out.split(secret).join(REDACTED_KEY);
+	return out.replace(/\b(sk|rk|pk)-[A-Za-z0-9_-]{8,}/g, REDACTED_KEY).replace(/\b(Bearer)\s+[A-Za-z0-9._~+/=-]{8,}/gi, `$1 ${REDACTED_KEY}`);
+}
+//#endregion
+//#region src/settings/override-service.ts
+var InferenceOverrideAuthorizationError = class extends Error {
+	constructor(request) {
+		super(`Inference override ${request.operation} denied for ${request.scopeType} scope`);
+		this.request = request;
+		this.name = "InferenceOverrideAuthorizationError";
+	}
+	request;
+	status = 403;
+};
+var InferenceTenantTargetNotAllowedError = class extends Error {
+	constructor(binding, ref) {
+		super(`Tenants may not bind ${binding} to ${ref}: not on the tenant allow-list`);
+		this.binding = binding;
+		this.ref = ref;
+		this.name = "InferenceTenantTargetNotAllowedError";
+	}
+	binding;
+	ref;
+	status = 403;
+};
+var InvalidInferenceScopeError = class extends Error {
+	constructor(scopeType, scopeId, reason) {
+		super(`Invalid inference override scope (${scopeType}): ${reason}`);
+		this.scopeType = scopeType;
+		this.scopeId = scopeId;
+		this.name = "InvalidInferenceScopeError";
+	}
+	scopeType;
+	scopeId;
+	status = 400;
+};
+function assertValidInferenceScope(scopeType, scopeId) {
+	if (scopeType !== "app" && scopeType !== "tenant") throw new InvalidInferenceScopeError(String(scopeType), String(scopeId), "scope type must be \"app\" or \"tenant\"");
+	if (typeof scopeId !== "string") throw new InvalidInferenceScopeError(scopeType, String(scopeId), "scope id must be a string");
+	if (scopeType === "app" && scopeId !== "__app__") throw new InvalidInferenceScopeError(scopeType, scopeId, `the app scope is only ever "${APP_INFERENCE_SCOPE_ID}"`);
+	if (scopeType === "tenant" && (!scopeId.trim() || scopeId !== scopeId.trim() || scopeId === "__app__")) throw new InvalidInferenceScopeError(scopeType, scopeId, "a tenant scope id must be non-blank, already trimmed, and not the app scope id");
+}
+function normalizeBindingValue(binding, value) {
+	const parsed = parseInferenceBinding(binding);
+	if (!parsed) throw new InferenceBindingValueError(String(binding), "unknown binding id");
+	switch (parsed.kind) {
+		case "tier": return normalizeTierTarget(binding, value);
+		case "default-tier": return normalizeDefaultTier(binding, value);
+		case "alias": return normalizeAliasDefinition(binding, value);
+		case "fusion": return normalizeFusionDefinition(binding, value);
+	}
+}
+function bindingValueRef(binding, value) {
+	if (binding === "default-tier") return `tier:${String(value)}`;
+	return inferenceTargetRef(value);
+}
+async function isTenantValueAllowed(binding, value, tenantId, allowList, policy) {
+	const ref = bindingValueRef(binding, value);
+	if (!isAllowedByList(ref, allowList)) return false;
+	if (!policy) return true;
+	const parsed = parseInferenceBinding(binding);
+	try {
+		return await policy({
+			binding,
+			tier: parsed?.kind === "tier" ? parsed.name : void 0,
+			ref,
+			value,
+			tenantId
+		}) === true;
+	} catch {
+		return false;
+	}
+}
+var InferenceOverrideService = class {
+	constructor(overrides, authorize, options = {}) {
+		this.overrides = overrides;
+		this.authorize = authorize;
+		this.options = options;
+	}
+	overrides;
+	authorize;
+	options;
+	/**
+	* Set (or, with `null`, revert) one binding at one scope. Tenants may write
+	* only `tier:*` and `default-tier`, and only an allow-listed target;
+	* reverting is always allowed.
+	*
+	* @throws {InvalidInferenceScopeError} for a scope nothing reads.
+	* @throws {InferenceBindingValueError} for an invalid binding or value.
+	* @throws {InferenceOverrideAuthorizationError} when the authorizer declines.
+	* @throws {InferenceTenantTargetNotAllowedError} when the allow-list refuses.
+	*/
+	async setValue(binding, scopeType, scopeId, value, options = {}) {
+		assertValidInferenceScope(scopeType, scopeId);
+		const normalized = normalizeBindingValue(binding, value);
+		const parsed = parseInferenceBinding(binding);
+		if (scopeType === "tenant" && (parsed?.kind === "alias" || parsed?.kind === "fusion")) throw new InferenceBindingValueError(binding, "aliases and fusions are defined at the app scope only");
+		await this.require({
+			operation: normalized === null ? "remove" : "set",
+			binding,
+			scopeType,
+			scopeId,
+			value: normalized
+		});
+		if (scopeType === "tenant" && normalized !== null) {
+			if (!await isTenantValueAllowed(binding, normalized, scopeId, (await this.overrides.findByScope(binding, "app", "__app__"))?.getTenantAllowList() ?? null, this.options.tenantTargetPolicy)) throw new InferenceTenantTargetNotAllowedError(binding, bindingValueRef(binding, normalized));
+		}
+		await options.beforeWrite?.(normalized);
+		await this.overrides.setOverride(binding, scopeType, scopeId, { target: normalized });
+	}
+	/**
+	* Set (or, with `null`, remove) the tenant allow-list of a `tier:*` or
+	* `default-tier` binding. The list lives on the app row.
+	*/
+	async setTenantAllowList(binding, allowList) {
+		const parsed = parseInferenceBinding(binding);
+		if (!parsed || parsed.kind !== "tier" && parsed.kind !== "default-tier") throw new InferenceBindingValueError(String(binding), "only tier and default-tier bindings carry a tenant allow-list");
+		const normalized = normalizeAllowList(binding, allowList);
+		await this.require({
+			operation: "allow-list",
+			binding,
+			scopeType: "app",
+			scopeId: APP_INFERENCE_SCOPE_ID,
+			tenantAllowList: normalized
+		});
+		await this.overrides.setOverride(binding, "app", APP_INFERENCE_SCOPE_ID, { tenantAllowList: normalized });
+	}
+	/** Delete the whole row (value and, on the app row, the allow-list). */
+	async removeOverride(binding, scopeType, scopeId) {
+		assertValidInferenceScope(scopeType, scopeId);
+		if (!parseInferenceBinding(binding)) throw new InferenceBindingValueError(String(binding), "unknown binding id");
+		await this.require({
+			operation: "remove",
+			binding,
+			scopeType,
+			scopeId
+		});
+		return this.overrides.removeOverride(binding, scopeType, scopeId);
+	}
+	async require(request) {
+		let allowed = false;
+		try {
+			allowed = await this.authorize(request) === true;
+		} catch {
+			allowed = false;
+		}
+		if (!allowed) throw new InferenceOverrideAuthorizationError(request);
+	}
+};
+//#endregion
+//#region src/settings/layers.ts
+function mergeSettingsConfigs(...layers) {
+	return mergeInferenceConfigs(...layers);
+}
+function layerFromRows(rows, include) {
+	const layer = {};
+	for (const [binding, row] of rows) {
+		if (!include(binding)) continue;
+		const parsed = parseInferenceBinding(binding);
+		if (!parsed) continue;
+		let value;
+		try {
+			value = row.getValue();
+		} catch {
+			continue;
+		}
+		if (value === null) continue;
+		switch (parsed.kind) {
+			case "tier":
+				layer.tiers ??= {};
+				layer.tiers[parsed.name] = value;
+				break;
+			case "default-tier":
+				layer.defaultTier = value;
+				break;
+			case "alias":
+				layer.aliases ??= {};
+				layer.aliases[parsed.name] = value;
+				break;
+			case "fusion":
+				layer.fusions ??= {};
+				layer.fusions[parsed.name] = value;
+				break;
+		}
+	}
+	return layer;
+}
+async function readInferenceOverrideRows(overrides, tenantId) {
+	const tenant = tenantId ?? null;
+	const [appRows, tenantRows] = await Promise.all([overrides.getScopeMap("app", APP_INFERENCE_SCOPE_ID), tenant ? overrides.getScopeMap("tenant", tenant) : Promise.resolve(/* @__PURE__ */ new Map())]);
+	return {
+		tenantId: tenant,
+		appRows,
+		tenantRows
+	};
+}
+async function loadInferenceOverrideLayers(overrides, options = {}) {
+	return buildInferenceOverrideLayers(await readInferenceOverrideRows(overrides, options.tenantId), options.tenantTargetPolicy);
+}
+async function buildInferenceOverrideLayers(rows, tenantTargetPolicy) {
+	const { tenantId, appRows, tenantRows } = rows;
+	const options = { tenantTargetPolicy };
+	const app = layerFromRows(appRows, () => true);
+	const blocked = [];
+	const allowedTenant = /* @__PURE__ */ new Set();
+	if (tenantId) for (const [binding, row] of tenantRows) {
+		const parsed = parseInferenceBinding(binding);
+		if (parsed?.kind !== "tier" && parsed?.kind !== "default-tier") continue;
+		let value;
+		try {
+			value = row.getValue();
+		} catch {
+			continue;
+		}
+		if (value === null) continue;
+		let allowList = null;
+		try {
+			allowList = appRows.get(binding)?.getTenantAllowList() ?? null;
+		} catch {
+			allowList = null;
+		}
+		if (await isTenantValueAllowed(binding, value, tenantId, allowList, options.tenantTargetPolicy)) allowedTenant.add(binding);
+		else blocked.push(binding);
+	}
+	return {
+		app,
+		tenant: layerFromRows(tenantRows, (binding) => allowedTenant.has(binding)),
+		blockedTenantBindings: blocked.sort(),
+		appRows,
+		tenantRows
+	};
+}
+//#endregion
+//#region src/settings/preferences.ts
+var INFERENCE_PREFERENCE_KIND = "inference";
+var INFERENCE_PREFERENCE_SURFACE = "default";
+var CUSTOMIZE_INFERENCE_PERMISSION = "inference.customize";
+var PERSONALIZE_INFERENCE_PERMISSION = "inference.personalize";
+var INFERENCE_PERMISSION_DEFINITIONS = [{
+	slug: CUSTOMIZE_INFERENCE_PERMISSION,
+	category: "inference",
+	name: "Customize Inference",
+	description: "Change the default inference mode, provider and model everyone in the tenant uses"
+}, {
+	slug: PERSONALIZE_INFERENCE_PERMISSION,
+	category: "inference",
+	name: "Personalize Inference",
+	description: "Keep a personal inference mode, provider and model on top of the tenant default"
+}];
+var PROVIDER_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
+var MODEL_PATTERN = /^[!-~\u00a1-\uffff]{1,200}$/;
+function issue(path, message) {
+	return {
+		path,
+		code: "invalid_setting",
+		message
+	};
+}
+function validBaseUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password && !url.search && !url.hash;
+	} catch {
+		return false;
+	}
+}
+function validateInferencePreferences(payload) {
+	if (payload === null || payload === void 0) return {
+		ok: true,
+		canonical: null,
+		issues: []
+	};
+	if (typeof payload !== "object" || Array.isArray(payload)) return {
+		ok: false,
+		canonical: null,
+		issues: [issue("", "inference preferences are an object")]
+	};
+	const keyMember = findKeyMember(payload);
+	if (keyMember) return {
+		ok: false,
+		canonical: null,
+		issues: [issue(keyMember, "keys are never stored as preferences; they go to smrt-secrets")]
+	};
+	const input = payload;
+	const issues = [];
+	const canonical = {};
+	for (const [member, value] of Object.entries(input)) {
+		if (value === void 0 || value === null || value === "") continue;
+		switch (member) {
+			case "mode":
+				if (INFERENCE_MODES.includes(value)) canonical.mode = value;
+				else issues.push(issue(member, `mode is one of ${INFERENCE_MODES.join(", ")}`));
+				break;
+			case "provider":
+				if (typeof value === "string" && PROVIDER_PATTERN.test(value)) canonical.provider = value;
+				else issues.push(issue(member, "invalid provider id"));
+				break;
+			case "baseUrl":
+				if (typeof value === "string" && validBaseUrl(value)) canonical.baseUrl = value;
+				else issues.push(issue(member, "the base URL is an http(s) URL without credentials, query or fragment"));
+				break;
+			case "model":
+				if (typeof value === "string" && MODEL_PATTERN.test(value)) canonical.model = value;
+				else issues.push(issue(member, "invalid model id"));
+				break;
+			case "defaultTier":
+				if (isInferenceTier(value)) canonical.defaultTier = value;
+				else issues.push(issue(member, `the default tier is one of ${INFERENCE_TIERS.join(", ")}`));
+				break;
+			default: issues.push(issue(member, "unknown inference preference"));
+		}
+	}
+	return {
+		ok: issues.length === 0,
+		canonical: Object.keys(canonical).length > 0 ? canonical : null,
+		issues
+	};
+}
+var inferencePreferenceKind = {
+	kind: INFERENCE_PREFERENCE_KIND,
+	formatVersion: 1,
+	permissions: {
+		tenant: CUSTOMIZE_INFERENCE_PERMISSION,
+		user: PERSONALIZE_INFERENCE_PERMISSION
+	},
+	validate(payload) {
+		return validateInferencePreferences(payload);
+	}
+};
+function createInferencePreferences(store, surfaceId = INFERENCE_PREFERENCE_SURFACE) {
+	return {
+		async read() {
+			const state = await store.load(INFERENCE_PREFERENCE_KIND, surfaceId);
+			const tenant = state.tenant.payload ?? null;
+			const user = state.user?.payload ?? null;
+			return {
+				choices: {
+					...tenant ?? {},
+					...user ?? {}
+				},
+				tenant,
+				user,
+				revisions: {
+					tenant: state.tenant.revision,
+					user: state.user?.revision ?? null
+				},
+				issues: state.issues,
+				canCustomize: state.canCustomize
+			};
+		},
+		/** Save choices at a scope (default `user`); `revision` is the one the client loaded. */
+		write(choices, options) {
+			return store.save(INFERENCE_PREFERENCE_KIND, surfaceId, {
+				scope: options.scope ?? "user",
+				payload: choices,
+				revision: options.revision
+			});
+		},
+		reset(options = {}) {
+			return store.reset(INFERENCE_PREFERENCE_KIND, surfaceId, {
+				scope: options.scope ?? "user",
+				revision: options.revision
+			});
+		}
+	};
+}
+//#endregion
+//#region src/settings/resolver.ts
+var MAX_CACHED_TENANTS = 500;
+function expandStoredAliases(target, appAliases, configAliases) {
+	if (inferenceTargetKind(target) !== "alias") return target;
+	const name = target.alias;
+	if (!Object.hasOwn(appAliases, name)) return target;
+	const expand = (alias, seen) => {
+		if (seen.has(alias)) return [];
+		const next = new Set(seen).add(alias);
+		return ((appAliases[alias] ?? configAliases[alias])?.candidates ?? []).flatMap((candidate) => candidate.alias && Object.hasOwn(appAliases, candidate.alias) ? expand(candidate.alias, next) : [candidate]);
+	};
+	return {
+		kind: "candidates",
+		candidates: expand(name, /* @__PURE__ */ new Set())
+	};
+}
+function createInferenceOverrideResolver(options = {}) {
+	const ttlMs = options.ttlMs ?? 3e4;
+	const cache = /* @__PURE__ */ new Map();
+	let collection;
+	const getCollection = () => {
+		if (options.overrides) return Promise.resolve(options.overrides);
+		collection ??= InferenceOverrideCollection.create({
+			...options.db ?? {},
+			defaultListLimit: void 0,
+			maxListLimit: void 0
+		});
+		return collection;
+	};
+	const rowsFor = async (tenantId) => {
+		const key = tenantId ?? "";
+		const generation = getInferenceOverrideGeneration();
+		const hit = cache.get(key);
+		if (hit && hit.generation === generation && Date.now() - hit.at < ttlMs) return hit.rows;
+		const rows = await readInferenceOverrideRows(await getCollection(), tenantId);
+		cache.delete(key);
+		cache.set(key, {
+			at: Date.now(),
+			generation,
+			rows
+		});
+		if (cache.size > MAX_CACHED_TENANTS) {
+			const oldest = cache.keys().next().value;
+			if (oldest !== void 0) cache.delete(oldest);
+		}
+		return rows;
+	};
+	return { async resolve(request, context) {
+		const tenantId = typeof request.tenantId === "string" && request.tenantId ? request.tenantId : null;
+		const layers = await buildInferenceOverrideLayers(await rowsFor(tenantId), options.tenantTargetPolicy);
+		const merged = mergeSettingsConfigs(context.config, layers.app, layers.tenant);
+		const tier = request.tier === "auto" ? resolveAutoTier(merged) : request.tier;
+		const stored = layers.tenant.tiers?.[tier] ?? layers.app.tiers?.[tier];
+		if (!stored) {
+			const next = {
+				...request,
+				tier
+			};
+			const deferred = options.base ? await options.base.resolve(next, context) : void 0;
+			if (deferred !== void 0) return deferred;
+			return request.tier === "auto" ? context.resolveFromConfig(next) : void 0;
+		}
+		validateInferenceTarget(stored, `inference.tiers.${tier}`, merged);
+		return {
+			tierResolved: tier,
+			target: expandStoredAliases({ ...stored }, layers.app.aliases ?? {}, context.config?.aliases ?? {}),
+			via: "resolver"
+		};
+	} };
+}
+//#endregion
+//#region src/settings/settings-service.ts
+function defaultRegistryFusions() {
+	return listFusions().flatMap((key) => {
+		const definition = getFusion(key);
+		return definition ? [{
+			...definition,
+			key
+		}] : [];
+	});
+}
+var InferenceSettingsConfigError = class extends Error {
+	constructor(issues) {
+		super(`Inference binding refused: ${issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
+		this.issues = issues;
+		this.name = "InferenceSettingsConfigError";
+	}
+	issues;
+	status = 400;
+};
+var InferenceBindingInUseError = class extends Error {
+	constructor(binding, referrers, tenantReferences) {
+		const parts = [...referrers];
+		if (tenantReferences > 0) parts.push(`${tenantReferences} tenant binding(s)`);
+		super(`${binding} is still referenced by ${parts.join(", ")}`);
+		this.binding = binding;
+		this.referrers = referrers;
+		this.tenantReferences = tenantReferences;
+		this.name = "InferenceBindingInUseError";
+	}
+	binding;
+	referrers;
+	tenantReferences;
+	status = 409;
+};
+function withoutListBounds(options) {
+	return {
+		...options,
+		defaultListLimit: void 0,
+		maxListLimit: void 0
+	};
+}
+function isRecord(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function rawValue(layers, scope, binding) {
+	const row = (scope === "app" ? layers.appRows : layers.tenantRows).get(binding);
+	if (!row) return null;
+	try {
+		return row.getValue();
+	} catch {
+		return null;
+	}
+}
+function allowListOf(layers, binding) {
+	try {
+		return layers.appRows.get(binding)?.getTenantAllowList() ?? null;
+	} catch {
+		return null;
+	}
+}
+function nonEmpty(target) {
+	return target && Object.keys(target).length > 0 ? stripKeyMembers(target) : null;
+}
+function bindingRefersTo(binding, value, kind, name) {
+	if (!isRecord(value)) return false;
+	if (binding.startsWith("tier:")) return kind === "alias" ? value.alias === name : value.fusion === name || value.kind === "fusion" && value.fusion === name;
+	if (kind === "alias" && binding.startsWith("alias:") && binding !== `alias:${name}`) return Array.isArray(value.candidates) && value.candidates.some((candidate) => isRecord(candidate) && candidate.alias === name);
+	return false;
+}
+var PRESET_LABELS = {
+	openrouter: "OpenRouter",
+	lemonade: "Lemonade (local)",
+	"llama.cpp": "llama.cpp (local)",
+	"lm-studio": "LM Studio (local)"
+};
+var InferenceSettingsService = class InferenceSettingsService {
+	constructor(overrides, options = {}) {
+		this.overrides = overrides;
+		this.options = options;
+		this.writes = new InferenceOverrideService(overrides, options.authorize ?? (() => false), { tenantTargetPolicy: options.tenantTargetPolicy });
+		this.readConfig = options.config ?? getInferenceConfig;
+	}
+	overrides;
+	options;
+	writes;
+	readConfig;
+	/** Build a service over the given database options (list bounds stripped). */
+	static async create(options = {}, serviceOptions = {}) {
+		const overrides = await InferenceOverrideCollection.create(withoutListBounds(options));
+		return new InferenceSettingsService(overrides, serviceOptions);
+	}
+	loadLayers(tenantId) {
+		return loadInferenceOverrideLayers(this.overrides, {
+			tenantId,
+			tenantTargetPolicy: this.options.tenantTargetPolicy
+		});
+	}
+	/**
+	* The effective config for a tenant: config < app rows < allowed tenant
+	* rows. What the override resolver binds and the doctor checks.
+	* Server-side only: config layers may carry literal keys, so never send
+	* this to a browser (the row methods strip them).
+	*/
+	async getEffectiveConfig(options = {}) {
+		const layers = await this.loadLayers(options.tenantId);
+		return mergeSettingsConfigs(this.readConfig(), layers.app, layers.tenant);
+	}
+	/**
+	* One row per tier (`cheap`, `good`, `great`, `best`): the effective
+	* target, each scope's raw override, and both revert previews.
+	*/
+	async listInferenceSettings(options = {}) {
+		const tenantId = options.tenantId ?? null;
+		const layers = await this.loadLayers(tenantId);
+		const config = this.readConfig();
+		return INFERENCE_TIERS.map((tier) => {
+			const binding = tierBinding(tier);
+			const configTarget = nonEmpty(config?.tiers?.[tier]);
+			const appTarget = rawValue(layers, "app", binding);
+			const tenantTarget = tenantId ? rawValue(layers, "tenant", binding) : null;
+			const tenantBlocked = layers.blockedTenantBindings.includes(binding);
+			const tenantEffective = tenantBlocked ? null : tenantTarget;
+			const appRevertTarget = configTarget;
+			const inheritedTarget = appTarget ?? configTarget;
+			const effectiveTarget = tenantEffective ?? appTarget ?? configTarget;
+			const supplyingLevel = tenantEffective ? "tenant" : appTarget ? "app" : configTarget ? "config" : "default";
+			return {
+				binding,
+				tier,
+				effectiveTarget,
+				effectiveLabel: describeInferenceTarget(effectiveTarget),
+				supplyingLevel,
+				configTarget,
+				appTarget,
+				tenantTarget,
+				appRevertTarget,
+				appRevertLabel: describeInferenceTarget(appRevertTarget),
+				inheritedTarget: tenantId ? inheritedTarget : null,
+				inheritedLabel: tenantId ? describeInferenceTarget(inheritedTarget) : null,
+				tenantAllowList: allowListOf(layers, binding),
+				tenantBlocked
+			};
+		});
+	}
+	/** `auto`'s default tier with the same per-scope shape. */
+	async getDefaultTierSetting(options = {}) {
+		const tenantId = options.tenantId ?? null;
+		const layers = await this.loadLayers(tenantId);
+		const config = this.readConfig();
+		const configTier = config?.defaultTier ?? null;
+		const appTier = rawValue(layers, "app", DEFAULT_TIER_BINDING);
+		const tenantTier = tenantId ? rawValue(layers, "tenant", DEFAULT_TIER_BINDING) : null;
+		const tenantBlocked = layers.blockedTenantBindings.includes(DEFAULT_TIER_BINDING);
+		const tenantEffective = tenantBlocked ? null : tenantTier;
+		const appRevertTier = resolveAutoTier(config);
+		const inheritedTier = appTier ?? appRevertTier;
+		return {
+			binding: DEFAULT_TIER_BINDING,
+			effectiveTier: tenantEffective ?? inheritedTier,
+			supplyingLevel: tenantEffective ? "tenant" : appTier ? "app" : configTier ? "config" : "default",
+			configTier,
+			appTier,
+			tenantTier,
+			appRevertTier,
+			inheritedTier: tenantId ? inheritedTier : null,
+			tenantAllowList: allowListOf(layers, DEFAULT_TIER_BINDING),
+			tenantBlocked
+		};
+	}
+	/** Every alias: config entries, replaced whole by app rows. Sorted by name. */
+	async listInferenceAliases() {
+		const layers = await this.loadLayers(null);
+		const configAliases = this.readConfig()?.aliases ?? {};
+		return [.../* @__PURE__ */ new Set([...Object.keys(configAliases), ...Object.keys(layers.app.aliases ?? {})])].sort().map((name) => {
+			const app = layers.app.aliases?.[name];
+			const alias = app ?? configAliases[name];
+			const setting = {
+				name,
+				source: app ? "app" : "config",
+				candidates: Array.isArray(alias?.candidates) ? stripKeyMembers(alias.candidates) : [],
+				inConfig: Object.hasOwn(configAliases, name)
+			};
+			if (alias?.description) setting.description = alias.description;
+			return setting;
+		});
+	}
+	/**
+	* Fusions from the host's registry (code, read-only), the config's
+	* `inference.fusions`, and app rows (editable JSON). A later source
+	* shadows an earlier one by name.
+	*/
+	async listInferenceFusions() {
+		const layers = await this.loadLayers(null);
+		const out = /* @__PURE__ */ new Map();
+		const registry = this.options.registryFusions ?? defaultRegistryFusions;
+		for (const fusion of registry()) {
+			if (!fusion || typeof fusion.key !== "string") continue;
+			const definition = stripKeyMembers(JSON.parse(JSON.stringify(fusion)));
+			out.set(fusion.key, {
+				name: fusion.key,
+				source: "registry",
+				definition,
+				description: typeof fusion.description === "string" ? fusion.description : void 0,
+				editable: false
+			});
+		}
+		const configFusions = this.readConfig()?.fusions;
+		if (isRecord(configFusions)) for (const [name, definition] of Object.entries(configFusions)) {
+			if (!isRecord(definition)) continue;
+			out.set(name, {
+				name,
+				source: "config",
+				definition: stripKeyMembers(definition),
+				description: typeof definition.description === "string" ? definition.description : void 0,
+				editable: false
+			});
+		}
+		for (const [name, definition] of Object.entries(layers.app.fusions ?? {})) out.set(name, {
+			name,
+			source: "app",
+			definition,
+			description: typeof definition.description === "string" ? definition.description : void 0,
+			editable: true
+		});
+		return [...out.values()].sort((a, b) => a.name.localeCompare(b.name));
+	}
+	/**
+	* Bind (or, with `null`, revert) one tier at one scope. Tenant writes must
+	* pass the allow-list; every write goes through the authorizer.
+	*/
+	async setTierOverride(request) {
+		if (!INFERENCE_TIERS.includes(request.tier)) throw new InferenceBindingValueError(`tier:${String(request.tier)}`, "unknown tier");
+		const binding = tierBinding(request.tier);
+		if (request.target !== null) await this.assertConfigStaysValid(request.scopeType, request.scopeId, { tiers: { [request.tier]: request.target } });
+		await this.writes.setValue(binding, request.scopeType, request.scopeId, request.target);
+	}
+	/** Set (or revert) `auto`'s default tier at one scope. */
+	async setDefaultTierOverride(request) {
+		await this.writes.setValue(DEFAULT_TIER_BINDING, request.scopeType, request.scopeId, request.tier === null ? null : { tier: request.tier });
+	}
+	/** Set (or remove) the tenant allow-list of a tier or of the default tier. */
+	async setTenantAllowList(request) {
+		await this.writes.setTenantAllowList(request.binding, request.allowList);
+	}
+	/** Define (or, with `null`, remove) an app-level alias. */
+	async setAlias(request) {
+		const binding = `alias:${request.name}`;
+		if (!INFERENCE_BINDING_NAME_PATTERN.test(String(request.name))) throw new InferenceBindingValueError(binding, "invalid alias name");
+		if (request.alias !== null) await this.assertConfigStaysValid("app", APP_INFERENCE_SCOPE_ID, { aliases: { [request.name]: request.alias } });
+		await this.writes.setValue(binding, "app", APP_INFERENCE_SCOPE_ID, request.alias, { beforeWrite: (normalized) => normalized === null ? this.assertNotReferenced("alias", request.name) : Promise.resolve() });
+	}
+	/** Store (or, with `null`, remove) an app-level fusion config entry (#4753 shape). */
+	async setFusion(request) {
+		const binding = `fusion:${request.name}`;
+		if (!INFERENCE_BINDING_NAME_PATTERN.test(String(request.name))) throw new InferenceBindingValueError(binding, "invalid fusion name");
+		await this.writes.setValue(binding, "app", APP_INFERENCE_SCOPE_ID, request.definition, { beforeWrite: (normalized) => normalized === null ? this.assertNotReferenced("fusion", request.name) : Promise.resolve() });
+	}
+	/**
+	* Refuse removing an app alias or fusion that a stored binding (any
+	* scope, any tenant) or the config still names, unless config or the
+	* registry keeps defining it. Otherwise the removal would leave dangling
+	* references that fail at call time.
+	*/
+	async assertNotReferenced(kind, name) {
+		const config = this.readConfig();
+		if (kind === "alias" ? Object.hasOwn(config?.aliases ?? {}, name) : Object.hasOwn(config?.fusions ?? {}, name) || [...this.options.registryFusions?.() ?? []].some((fusion) => fusion?.key === name)) return;
+		const referrers = [];
+		for (const [tier, target] of Object.entries(config?.tiers ?? {})) if (bindingRefersTo(`tier:${tier}`, target, kind, name)) referrers.push(`config tiers.${tier}`);
+		for (const [alias, definition] of Object.entries(config?.aliases ?? {})) if (bindingRefersTo(`alias:${alias}`, definition, kind, name)) referrers.push(`config aliases.${alias}`);
+		let tenantReferences = 0;
+		for (const row of await this.overrides.list({})) {
+			let value;
+			try {
+				value = row.getValue();
+			} catch {
+				continue;
+			}
+			if (!bindingRefersTo(row.binding, value, kind, name)) continue;
+			if (row.tenantId) tenantReferences += 1;
+			else referrers.push(row.binding);
+		}
+		if (referrers.length > 0 || tenantReferences > 0) throw new InferenceBindingInUseError(`${kind}:${name}`, referrers, tenantReferences);
+	}
+	/**
+	* Refuse a write that adds a config issue (unknown alias, cycle, key
+	* without endpoint, unknown preset) to the layered config it lands in.
+	* Issues that already existed do not block unrelated writes.
+	*/
+	async assertConfigStaysValid(scopeType, scopeId, change) {
+		const layers = await this.loadLayers(scopeType === "tenant" ? scopeId : null);
+		const before = mergeSettingsConfigs(this.readConfig(), layers.app, layers.tenant);
+		const after = mergeSettingsConfigs(before, change);
+		const seen = new Set(findInferenceConfigIssues(before).map((issue) => `${issue.code}:${issue.path}`));
+		const added = findInferenceConfigIssues(after).filter((issue) => !seen.has(`${issue.code}:${issue.path}`));
+		if (added.length > 0) throw new InferenceSettingsConfigError(added);
+	}
+	/**
+	* Test connection for the default view: probe the endpoint's cheapest
+	* list call (`./node`'s `probeInferenceCandidate`, 3 s). The stored key
+	* record (from the host's `SecretService`) is sent only when the probe URL
+	* is on the key's bound origin; no environment key is read.
+	*/
+	async testConnection(input, options = {}) {
+		const candidate = {};
+		if (input.provider) candidate.provider = input.provider;
+		if (input.preset) candidate.preset = input.preset;
+		if (input.baseUrl) candidate.baseUrl = input.baseUrl;
+		if (input.model) candidate.model = input.model;
+		const url = inferenceProbeUrl(candidate);
+		const apiKey = url ? inferenceKeyFor(options.key, url) : void 0;
+		if (options.key && url && !apiKey) {
+			let where = "that endpoint";
+			try {
+				where = new URL(url).origin;
+			} catch {}
+			return {
+				reachable: false,
+				durationMs: 0,
+				keySent: false,
+				detail: `the stored key is bound to ${options.key.origin} and is never sent to ${where}; save a key for this endpoint`
+			};
+		}
+		const result = await probeInferenceCandidate(apiKey && url ? {
+			...candidate,
+			baseUrl: candidate.baseUrl ?? url.replace(/\/(?:models|api\/tags)$/, ""),
+			apiKey
+		} : candidate, {
+			env: {},
+			fetch: options.fetch,
+			timeoutMs: options.timeoutMs
+		});
+		return {
+			...result,
+			detail: redactInferenceSecret(result.detail, apiKey),
+			keySent: !!apiKey
+		};
+	}
+	/**
+	* Per-candidate test for the alias editor. A candidate already in the
+	* effective config (config file or an app row) reads its key from
+	* `apiKeyEnv` (or its provider's variable) exactly as the doctor does,
+	* sent only to its own endpoint; any other candidate (an unsaved edit) is
+	* probed with no key at all.
+	*/
+	async testCandidate(candidate, options = {}) {
+		if (findKeyLike(candidate)) throw new InferenceBindingValueError("candidate", "a tested candidate never carries a literal key");
+		const configured = await this.isConfiguredCandidate(candidate);
+		return {
+			...await probeInferenceCandidate(candidate, {
+				...options,
+				env: configured ? options.env ?? process.env : {}
+			}),
+			keySent: false
+		};
+	}
+	async isConfiguredCandidate(candidate) {
+		const config = await this.getEffectiveConfig();
+		const wanted = canonicalCandidate(candidate);
+		return Object.values(config?.aliases ?? {}).some((alias) => (alias?.candidates ?? []).some((entry) => canonicalCandidate(entry) === wanted));
+	}
+	/** `smrt doctor --ai` over the effective config for a tenant. */
+	async doctor(options = {}) {
+		return checkInferenceBindings({
+			config: await this.getEffectiveConfig({ tenantId: options.tenantId }) ?? {},
+			probe: options.probe,
+			env: options.env,
+			fetch: options.fetch
+		});
+	}
+	/**
+	* The Usage tab: `reportAiUsage()` (#4751) grouped by model, tier and/or
+	* prompt key. Pass `by: ['model']` where tier and prompt tags do not exist
+	* yet; NULL dimensions are their own bucket, never dropped.
+	*/
+	usage(options = {}) {
+		return reportAiUsage(this.overrides.db, {
+			...options,
+			by: options.by && options.by.length > 0 ? options.by : ["model"]
+		});
+	}
+	/** Local discovery for the model field (#4674's loopback probe). */
+	async discoverModels() {
+		const { discoverLocalInferenceModels } = await import("@happyvertical/smrt-core/byo-inference");
+		return (await discoverLocalInferenceModels()).filter((entry) => entry.available).map((entry) => ({
+			service: entry.service,
+			baseUrl: entry.baseUrl,
+			models: entry.available ? entry.models : []
+		}));
+	}
+	/** Provider choices: #4674 presets, then the AI SDK provider list. */
+	listProviderOptions() {
+		const presets = INFERENCE_PRESET_IDS.map((id) => {
+			const preset = INFERENCE_PRESETS[id];
+			return {
+				id,
+				label: PRESET_LABELS[id] ?? id,
+				kind: "preset",
+				baseUrl: preset.baseUrl,
+				requiresApiKey: preset.requiresApiKey,
+				local: !preset.requiresApiKey
+			};
+		});
+		const providers = AI_PROVIDER_TYPES.map((id) => ({
+			id,
+			label: id,
+			kind: "provider",
+			requiresApiKey: !!getDefaultAIKeyEnvName(id),
+			...id === "litellm" || id === "bifrost" ? { needsBaseUrl: true } : {},
+			...id === "ollama" ? { local: true } : {}
+		}));
+		return [...presets, ...providers];
+	}
+};
+function canonicalCandidate(candidate) {
+	return JSON.stringify([
+		"provider",
+		"model",
+		"baseUrl",
+		"apiKeyEnv",
+		"preset",
+		"alias"
+	].map((field) => {
+		const value = candidate[field];
+		return typeof value === "string" ? value.trim() : null;
+	}));
+}
+function findKeyLike(candidate) {
+	return typeof candidate.apiKey === "string" && candidate.apiKey.length > 0;
+}
+//#endregion
+export { APP_INFERENCE_SCOPE_ID, CUSTOMIZE_INFERENCE_PERMISSION, DEFAULT_TIER_BINDING, INFERENCE_MODES, INFERENCE_PERMISSION_DEFINITIONS, INFERENCE_PREFERENCE_KIND, INFERENCE_PREFERENCE_SURFACE, InferenceBindingInUseError, InferenceBindingValueError, InferenceKeyOriginError, InferenceOverride, InferenceOverrideAuthorizationError, InferenceOverrideCollection, InferenceOverrideService, InferenceSettingsConfigError, InferenceSettingsService, InferenceTenantTargetNotAllowedError, InvalidInferenceScopeError, PERSONALIZE_INFERENCE_PERMISSION, REDACTED_KEY, assertValidInferenceScope, bindInferenceKey, buildInferenceOverrideLayers, createInferenceOverrideResolver, createInferencePreferences, describeInferenceTarget, inferenceKeyFor, inferenceKeyOrigin, inferencePreferenceKind, inferenceProviderConfigFromKey, inferenceTargetRef, isAllowedByList, loadInferenceOverrideLayers, matchesAllowPattern, mergeSettingsConfigs, parseInferenceBinding, readInferenceOverrideRows, redactInferenceSecret, stripKeyMembers, tierBinding, validateInferencePreferences };
+
+//# sourceMappingURL=server.js.map