@happyvertical/smrt-inference 0.0.0-stage → 0.60.16

package/dist/node.js

@@ -0,0 +1,1414 @@
+import { A as candidateLabel, I as findInferenceConfigIssues, a as inferenceProviderBindingFor, l as parseInferenceProviderConfig, o as inferenceProviderConfigSecretName, t as INFERENCE_PROVIDER_CONFIG_SECRET_TYPE, w as classifyInferenceFailure } from "./chunks/provider-config-BSpIQRVM.js";
+import { invalidateUserInferenceResolvers } from "./resolver.js";
+import { INFERENCE_PRESETS, INFERENCE_PRESET_CAPABILITIES, INFERENCE_TIERS, assertInferenceConfig, ensureSystemTables, getInferenceConfig, inferenceCapabilitiesFromSdk, inferenceCapabilityHeuristic, inferencePresetFor, inferenceTargetKind, isInferencePresetId, isPostgresDatabase, resolveInferenceCapabilities, runOnce } from "@happyvertical/smrt-core";
+import { SmrtError } from "@happyvertical/smrt-core/smrt-error";
+import { AI_PROVIDER_TYPES } from "@happyvertical/ai";
+import { getDefaultAIKeyEnvName, redactBaseUrl } from "@happyvertical/smrt-config";
+import { SecretService } from "@happyvertical/smrt-secrets";
+import { withTenant } from "@happyvertical/smrt-tenancy";
+//#region src/hosted.ts
+var HOSTED_INFERENCE_FEATURE_KEY = "inference.hosted";
+var HOSTED_INFERENCE_SECRET_CATEGORY = "inference.hosted";
+var HOSTED_GATEWAY_PROVIDERS = ["bifrost", "litellm"];
+var HOSTED_BUDGET_WINDOWS = [
+	"day",
+	"week",
+	"month",
+	"year"
+];
+var WINDOW_DURATION = {
+	day: "1d",
+	week: "7d",
+	month: "30d",
+	year: "365d"
+};
+var HostedInferenceError = class extends SmrtError {
+	constructor(message, code, details = {}) {
+		super(message, code, "configuration", details);
+	}
+};
+var HOSTED_GATEWAY_ADMIN_TIMEOUT_MS = 3e4;
+var HOSTED_GATEWAY_ADMIN_METHODS = [
+	"createProject",
+	"createVirtualKey",
+	"updateVirtualKey",
+	"deleteVirtualKey",
+	"listProjects"
+];
+var HOSTED_GATEWAY_ENV = {
+	provider: "SMRT_INFERENCE_HOSTED_PROVIDER",
+	baseUrl: "SMRT_INFERENCE_HOSTED_BASE_URL",
+	adminUrl: "SMRT_INFERENCE_HOSTED_ADMIN_URL",
+	adminApiKey: "SMRT_INFERENCE_HOSTED_ADMIN_KEY",
+	adminUser: "SMRT_INFERENCE_HOSTED_ADMIN_USER",
+	adminPassword: "SMRT_INFERENCE_HOSTED_ADMIN_PASSWORD",
+	model: "SMRT_INFERENCE_HOSTED_MODEL",
+	models: "SMRT_INFERENCE_HOSTED_MODELS",
+	keyDuration: "SMRT_INFERENCE_HOSTED_KEY_DURATION",
+	adminTimeoutMs: "SMRT_INFERENCE_HOSTED_ADMIN_TIMEOUT_MS"
+};
+function text$1(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function isPlainHttpUrl(value) {
+	try {
+		const url = new URL(value);
+		return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password && !url.search && !url.hash;
+	} catch {
+		return false;
+	}
+}
+function parseHostedGatewayConfig(value) {
+	const issues = [];
+	const provider = text$1(value.provider)?.toLowerCase();
+	if (!provider || !HOSTED_GATEWAY_PROVIDERS.includes(provider)) issues.push(`provider must be one of ${HOSTED_GATEWAY_PROVIDERS.join(", ")}`);
+	const baseUrl = text$1(value.baseUrl);
+	if (!baseUrl || !isPlainHttpUrl(baseUrl)) issues.push("baseUrl must be an http(s) URL without credentials, query or fragment");
+	const adminUrl = text$1(value.adminUrl);
+	if (adminUrl && !isPlainHttpUrl(adminUrl)) issues.push("adminUrl must be an http(s) URL without credentials, query or fragment");
+	const adminApiKey = text$1(value.adminApiKey);
+	const adminUser = text$1(value.adminUser);
+	const adminPassword = text$1(value.adminPassword);
+	if (provider === "litellm" && !adminApiKey) issues.push("adminApiKey (the LiteLLM master key) is required for litellm");
+	if (provider === "bifrost" && !adminApiKey && !(adminUser && adminPassword)) issues.push("bifrost needs adminApiKey or both adminUser and adminPassword");
+	const tiers = {};
+	for (const tier of INFERENCE_TIERS) {
+		const model2 = text$1(value.tiers?.[tier]);
+		if (model2) tiers[tier] = model2;
+	}
+	const adminTimeoutMs = value.adminTimeoutMs;
+	if (adminTimeoutMs !== void 0 && (!Number.isSafeInteger(adminTimeoutMs) || adminTimeoutMs <= 0)) issues.push("adminTimeoutMs must be a positive integer (ms)");
+	const model = text$1(value.model);
+	const models = (value.models ?? []).map((entry) => text$1(entry)).filter((entry) => !!entry);
+	if (issues.length > 0) throw new HostedInferenceError(`Hosted inference gateway is not configured: ${issues.join("; ")}`, "HOSTED_GATEWAY_NOT_CONFIGURED", { issues });
+	return {
+		provider,
+		baseUrl,
+		...adminUrl ? { adminUrl } : {},
+		...adminApiKey ? { adminApiKey } : {},
+		...adminUser ? { adminUser } : {},
+		...adminPassword ? { adminPassword } : {},
+		...model ? { model } : {},
+		...Object.keys(tiers).length > 0 ? { tiers } : {},
+		...models.length > 0 ? { models } : {},
+		...text$1(value.keyDuration) ? { keyDuration: text$1(value.keyDuration) } : {},
+		...adminTimeoutMs !== void 0 ? { adminTimeoutMs } : {}
+	};
+}
+function hostedGatewayConfigFromEnv(env = process.env) {
+	if (!text$1(env[HOSTED_GATEWAY_ENV.provider])) return void 0;
+	const tiers = {};
+	for (const tier of INFERENCE_TIERS) {
+		const model = text$1(env[`SMRT_INFERENCE_HOSTED_${tier.toUpperCase()}_MODEL`]);
+		if (model) tiers[tier] = model;
+	}
+	return parseHostedGatewayConfig({
+		provider: env[HOSTED_GATEWAY_ENV.provider],
+		baseUrl: env[HOSTED_GATEWAY_ENV.baseUrl],
+		adminUrl: env[HOSTED_GATEWAY_ENV.adminUrl],
+		adminApiKey: env[HOSTED_GATEWAY_ENV.adminApiKey],
+		adminUser: env[HOSTED_GATEWAY_ENV.adminUser],
+		adminPassword: env[HOSTED_GATEWAY_ENV.adminPassword],
+		model: env[HOSTED_GATEWAY_ENV.model],
+		tiers,
+		models: (env[HOSTED_GATEWAY_ENV.models] ?? "").split(","),
+		keyDuration: env[HOSTED_GATEWAY_ENV.keyDuration],
+		...text$1(env[HOSTED_GATEWAY_ENV.adminTimeoutMs]) ? { adminTimeoutMs: Number(text$1(env[HOSTED_GATEWAY_ENV.adminTimeoutMs])) } : {}
+	});
+}
+var envConfig;
+function getHostedGatewayConfig() {
+	envConfig ??= { value: hostedGatewayConfigFromEnv() };
+	if (!envConfig.value) throw new HostedInferenceError(`Hosted inference gateway is not configured: set ${HOSTED_GATEWAY_ENV.provider} (bifrost or litellm), ${HOSTED_GATEWAY_ENV.baseUrl} and the admin credentials.`, "HOSTED_GATEWAY_NOT_CONFIGURED");
+	return envConfig.value;
+}
+function resetHostedGatewayConfig() {
+	envConfig = void 0;
+}
+async function createHostedGatewayAdmin(config) {
+	const { getAI } = await import("@happyvertical/ai");
+	const common = {
+		baseUrl: config.baseUrl,
+		apiKey: config.adminApiKey ?? "smrt-admin",
+		timeout: config.adminTimeoutMs ?? 3e4,
+		...config.adminUrl ? { adminUrl: config.adminUrl } : {},
+		...config.adminApiKey ? { adminApiKey: config.adminApiKey } : {}
+	};
+	const admin = (config.provider === "bifrost" ? await getAI({
+		type: "bifrost",
+		...common,
+		...config.adminUser ? { adminUser: config.adminUser } : {},
+		...config.adminPassword ? { adminPassword: config.adminPassword } : {}
+	}) : await getAI({
+		type: "litellm",
+		...common
+	})).admin;
+	const missing = HOSTED_GATEWAY_ADMIN_METHODS.filter((method) => typeof admin?.[method] !== "function");
+	if (!admin || missing.length > 0) throw new HostedInferenceError(`The ${config.provider} provider of @happyvertical/ai lacks admin calls: ${missing.join(", ")} (needs @happyvertical/ai >= 0.111.7).`, "HOSTED_GATEWAY_UNSUPPORTED", {
+		provider: config.provider,
+		missing
+	});
+	return admin;
+}
+var HOSTED_BUDGET_UNCERTAIN_WINDOW_MS = 15 * 6e4;
+var STATE_PREFIX = `${HOSTED_INFERENCE_SECRET_CATEGORY}:user:`;
+var PROJECT_NAME = `${HOSTED_INFERENCE_SECRET_CATEGORY}:project`;
+var RUN_ONCE_ACTOR_PROJECT = "smrt-inference-hosted";
+function hostedProjectName(tenantId) {
+	return `smrt tenant ${tenantId}`;
+}
+function hostedInferenceStateSecretName(userId) {
+	return `${STATE_PREFIX}${userId}`;
+}
+var ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,199}$/;
+function requireId(value, field) {
+	const id = text$1(value);
+	if (!id || !ID_PATTERN.test(id)) throw new HostedInferenceError(`${field} must be 1-200 characters of letters, digits and . _ : @ -`, "HOSTED_INFERENCE_INVALID", { field });
+	return id;
+}
+function normalizeHostedBudget(budget) {
+	const limit = budget?.limitMicros;
+	if (typeof limit !== "number" || !Number.isSafeInteger(limit) || limit <= 0) throw new HostedInferenceError("budget.limitMicros must be a positive integer (micro-dollars)", "HOSTED_INFERENCE_INVALID", { field: "budget.limitMicros" });
+	const window = budget?.window ?? "month";
+	if (!HOSTED_BUDGET_WINDOWS.includes(window)) throw new HostedInferenceError(`budget.window must be one of ${HOSTED_BUDGET_WINDOWS.join(", ")}`, "HOSTED_INFERENCE_INVALID", { field: "budget.window" });
+	return {
+		limitMicros: limit,
+		window
+	};
+}
+function toGatewayBudget(budget) {
+	return {
+		maxLimit: budget.limitMicros / 1e6,
+		resetDuration: WINDOW_DURATION[budget.window]
+	};
+}
+function sameBudget(a, b) {
+	return !!a && a.limitMicros === b.limitMicros && a.window === b.window;
+}
+var KEY_VALUE_PATTERN = /\bsk-[A-Za-z0-9_-]{8,}/;
+function safeKeyId(id, apiKey) {
+	const handle = text$1(id);
+	if (!handle || handle === apiKey || KEY_VALUE_PATTERN.test(handle)) return null;
+	return handle;
+}
+function parseState(value) {
+	let raw;
+	try {
+		raw = JSON.parse(value);
+	} catch {
+		throw new HostedInferenceError("Stored hosted inference state is not JSON", "HOSTED_STATE_INVALID");
+	}
+	const state = raw;
+	if (!state || typeof state !== "object" || state.version !== 1 || state.status !== "active" && state.status !== "revoked" || typeof state.generation !== "number" || !Number.isSafeInteger(state.generation) || typeof state.keyAlias !== "string" || state.status === "active" && (typeof state.projectId !== "string" || !state.budget)) throw new HostedInferenceError("Stored hosted inference state is invalid", "HOSTED_STATE_INVALID");
+	return {
+		...state,
+		keyId: safeKeyId(state.keyId),
+		...Array.isArray(state.pendingGatewayRevocations) ? { pendingGatewayRevocations: state.pendingGatewayRevocations.map((entry) => ({
+			...entry,
+			keyId: safeKeyId(entry.keyId)
+		})) } : {},
+		prior: state.prior ? parseInferenceProviderConfig(state.prior) : null
+	};
+}
+function isAbsentSecretError(error, name) {
+	if (!(error instanceof Error)) return false;
+	return error.message === `Secret '${name}' not found` || error.message === "Secret not found" || error.message === "Secret disabled" || error.message === "Secret expired";
+}
+function describeState(tenantId, userId, state) {
+	if (!state) return {
+		tenantId,
+		userId,
+		status: "none",
+		generation: 0
+	};
+	return {
+		tenantId,
+		userId,
+		status: state.status,
+		generation: state.generation,
+		...state.provider ? { provider: state.provider } : {},
+		...state.projectId ? { projectId: state.projectId } : {},
+		keyId: state.keyId,
+		...state.keyAlias ? { keyAlias: state.keyAlias } : {},
+		...state.budget ? { budget: state.budget } : {},
+		...state.pendingGatewayRevocations?.length ? { pendingGatewayRevocations: state.pendingGatewayRevocations } : {}
+	};
+}
+var GATEWAY_TIMEOUT_CODE = "HOSTED_GATEWAY_TIMEOUT";
+async function withDeadline(call, ms, operation) {
+	let timer;
+	const deadline = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(Object.assign(/* @__PURE__ */ new Error(`Gateway ${operation} timed out`), { code: GATEWAY_TIMEOUT_CODE })), ms);
+	});
+	try {
+		return await Promise.race([call(), deadline]);
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+function isGatewayTimeout(error) {
+	return !!error && typeof error === "object" && error.code === GATEWAY_TIMEOUT_CODE;
+}
+function mayHaveCreated(error) {
+	if (isGatewayTimeout(error)) return true;
+	const failure = classifyInferenceFailure(error);
+	return failure !== "credential" && failure !== "quota" && failure !== "missing-model" && failure !== "refusal";
+}
+function gatewayFailure(operation, error) {
+	const code = error && typeof error === "object" && "code" in error ? String(error.code) : void 0;
+	const name = error instanceof Error ? error.name : typeof error;
+	return new HostedInferenceError(`Gateway ${operation} failed (${code ?? name}).`, "HOSTED_GATEWAY_FAILED", {
+		operation,
+		...code ? { gatewayCode: code } : {},
+		errorName: name
+	});
+}
+function hostedProviderConfig(gateway, apiKey, keyAlias) {
+	const binding = (model) => ({
+		provider: gateway.provider,
+		baseUrl: gateway.baseUrl,
+		apiKey,
+		...model ? { model } : {}
+	});
+	const tiers = {};
+	for (const [tier, model] of Object.entries(gateway.tiers ?? {})) if (model) tiers[tier] = binding(model);
+	return parseInferenceProviderConfig({
+		version: 1,
+		source: "hosted",
+		mode: "hosted",
+		gatewayKeyAlias: keyAlias,
+		...binding(gateway.model),
+		...Object.keys(tiers).length > 0 ? { tiers } : {}
+	});
+}
+function keyModels(gateway) {
+	if (gateway.models?.length) return gateway.models;
+	const models = /* @__PURE__ */ new Set();
+	if (gateway.model) models.add(gateway.model);
+	for (const model of Object.values(gateway.tiers ?? {})) if (model) models.add(model);
+	return models.size > 0 ? [...models] : void 0;
+}
+function restoredConfig(prior) {
+	if (prior && prior.mode !== "hosted" && prior.source !== "hosted") {
+		if (INFERENCE_TIERS.some((tier) => !!inferenceProviderBindingFor(prior, tier)) || prior.mode) return {
+			config: prior,
+			restored: "prior"
+		};
+	}
+	return {
+		config: { mode: "off" },
+		restored: "off"
+	};
+}
+function defaultNonce() {
+	return globalThis.crypto.randomUUID().replace(/-/g, "").slice(0, 10);
+}
+var lifecycleChain = Promise.resolve();
+function createHostedInferenceProvisioner(options) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const nonce = options.nonce ?? defaultNonce;
+	const deadlineMs = () => {
+		try {
+			return gatewayConfig().adminTimeoutMs ?? 3e4;
+		} catch {
+			return HOSTED_GATEWAY_ADMIN_TIMEOUT_MS;
+		}
+	};
+	let secretsPromise;
+	let adminPromise;
+	let tablesPromise;
+	const gatewayConfig = () => options.gateway ? parseHostedGatewayConfig(options.gateway) : getHostedGatewayConfig();
+	const getSecrets = () => {
+		if (options.secrets) return Promise.resolve(options.secrets);
+		secretsPromise ??= SecretService.create({ db: options.db }).catch((error) => {
+			secretsPromise = void 0;
+			throw error;
+		});
+		return secretsPromise;
+	};
+	const getAdmin = (gateway) => {
+		if (options.admin) return Promise.resolve(options.admin);
+		adminPromise ??= createHostedGatewayAdmin(gateway).catch((error) => {
+			adminPromise = void 0;
+			throw error;
+		});
+		return adminPromise;
+	};
+	const optionalAdmin = async () => {
+		try {
+			return await getAdmin(gatewayConfig());
+		} catch (error) {
+			if (error instanceof HostedInferenceError && (error.code === "HOSTED_GATEWAY_NOT_CONFIGURED" || error.code === "HOSTED_GATEWAY_UNSUPPORTED")) return;
+			throw error;
+		}
+	};
+	const ensureTables = () => {
+		tablesPromise ??= ensureSystemTables(options.db).then(() => void 0).catch((error) => {
+			tablesPromise = void 0;
+			throw error;
+		});
+		return tablesPromise;
+	};
+	const inTenant = (tenantId, fn) => withTenant({
+		tenantId,
+		...options.actor ? { userId: options.actor } : {}
+	}, fn);
+	const withTenantLock = (tenantId, fn) => {
+		const key = JSON.stringify(["smrt.inference.hosted", tenantId]);
+		const run = async () => {
+			if (isPostgresDatabase(options.db) && options.db.transaction) return options.db.transaction(async (tx) => {
+				await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1::text, 0))", key);
+				return fn();
+			});
+			return fn();
+		};
+		const result = lifecycleChain.then(run, run);
+		lifecycleChain = result.then(() => void 0, () => void 0);
+		return result;
+	};
+	const read = async (secrets, name) => {
+		try {
+			return (await secrets.retrieve(name)).value;
+		} catch (error) {
+			if (isAbsentSecretError(error, name)) return void 0;
+			throw error;
+		}
+	};
+	const readState = async (secrets, userId) => {
+		const value = await read(secrets, hostedInferenceStateSecretName(userId));
+		return value === void 0 ? void 0 : parseState(value);
+	};
+	const readUserConfig = async (secrets, userId) => {
+		const value = await read(secrets, inferenceProviderConfigSecretName({ userId }));
+		return value === void 0 ? void 0 : parseInferenceProviderConfig(value);
+	};
+	const writeState = (secrets, userId, state, auditDetails) => secrets.store(hostedInferenceStateSecretName(userId), JSON.stringify(state), {
+		category: HOSTED_INFERENCE_SECRET_CATEGORY,
+		description: "Hosted inference provisioning state",
+		auditDetails
+	});
+	const writeUserConfig = (secrets, userId, config, auditDetails) => secrets.store(inferenceProviderConfigSecretName({ userId }), JSON.stringify(parseInferenceProviderConfig(config)), {
+		category: INFERENCE_PROVIDER_CONFIG_SECRET_TYPE,
+		description: "Inference provider config (user)",
+		auditDetails
+	});
+	const isOurs = (config, keyAlias) => !!keyAlias && config?.source === "hosted" && config.gatewayKeyAlias === keyAlias;
+	const deleteGatewayKey = async (admin, keyId) => {
+		if (!keyId || !admin) return "unsupported";
+		try {
+			return await withDeadline(() => admin.deleteVirtualKey(keyId), deadlineMs(), "deleteVirtualKey") ? "revoked" : "missing";
+		} catch {
+			return "failed";
+		}
+	};
+	const findTenantProject = async (tenantId, gateway, admin) => {
+		let projects;
+		try {
+			projects = await withDeadline(() => admin.listProjects({ tenantId }), deadlineMs(), "listProjects");
+		} catch (error) {
+			throw gatewayFailure("listProjects", error);
+		}
+		return (Array.isArray(projects) ? projects : []).filter((project) => project?.tenantId === tenantId && project.name === hostedProjectName(tenantId) && (gateway.provider !== "litellm" || project.id?.startsWith(`smrt-${tenantId}-`))).map((project) => text$1(project.id)).filter((id) => !!id).sort()[0];
+	};
+	const ensureProject = async (tenantId, gateway, admin, secrets) => {
+		const stored = await read(secrets, PROJECT_NAME);
+		if (stored !== void 0) try {
+			const parsed = JSON.parse(stored);
+			if (typeof parsed.projectId === "string" && parsed.provider === gateway.provider) return parsed.projectId;
+		} catch {}
+		return (await runOnce({
+			db: options.db,
+			tenantId,
+			actor: RUN_ONCE_ACTOR_PROJECT,
+			token: "smrt-inference-hosted:project",
+			content: {
+				provider: gateway.provider,
+				baseUrl: gateway.baseUrl
+			}
+		}, async () => {
+			const found = await findTenantProject(tenantId, gateway, admin);
+			let projectId = found;
+			if (!projectId) {
+				let project;
+				try {
+					project = await withDeadline(() => admin.createProject({
+						id: `smrt-${tenantId}-${nonce()}`,
+						name: hostedProjectName(tenantId),
+						tenantId,
+						metadata: {
+							smrt: HOSTED_INFERENCE_FEATURE_KEY,
+							tenantId
+						}
+					}), deadlineMs(), "createProject");
+				} catch (error) {
+					throw gatewayFailure("createProject", error);
+				}
+				projectId = text$1(project?.id);
+			}
+			if (!projectId) throw new HostedInferenceError("Gateway createProject returned no project id.", "HOSTED_GATEWAY_FAILED", { operation: "createProject" });
+			await secrets.store(PROJECT_NAME, JSON.stringify({
+				projectId,
+				provider: gateway.provider,
+				createdAt: now().toISOString()
+			}), {
+				category: HOSTED_INFERENCE_SECRET_CATEGORY,
+				description: "Hosted inference gateway project",
+				auditDetails: {
+					operation: "inference.hosted.project",
+					projectId,
+					provider: gateway.provider,
+					...found ? { adopted: true } : {}
+				}
+			});
+			return { projectId };
+		})).projectId;
+	};
+	const retryPending = async (state) => {
+		const pending = state.pendingGatewayRevocations ?? [];
+		if (!pending.some((entry) => entry.keyId)) return {
+			state,
+			settled: []
+		};
+		const admin = await optionalAdmin();
+		const remaining = [];
+		const settled = [];
+		for (const entry of pending) {
+			const outcome = await deleteGatewayKey(admin, entry.keyId);
+			if (outcome === "revoked" || outcome === "missing") settled.push({
+				keyId: entry.keyId,
+				keyAlias: entry.keyAlias,
+				gateway: outcome
+			});
+			else remaining.push(entry);
+		}
+		if (settled.length === 0) return {
+			state,
+			settled
+		};
+		return {
+			state: {
+				...state,
+				pendingGatewayRevocations: remaining
+			},
+			settled
+		};
+	};
+	const revokeLocked = async (tenantId, userId, secrets, state, reason, restore, optOut = false) => {
+		const since = now().toISOString();
+		const audit = {
+			operation: "inference.hosted.revoke",
+			reason,
+			keyAlias: state.keyAlias,
+			...state.keyId ? { keyId: state.keyId } : {}
+		};
+		let restored = "kept";
+		if (restore) {
+			const current = await readUserConfig(secrets, userId);
+			if (isOurs(current, state.keyAlias)) {
+				const next2 = restoredConfig(state.prior);
+				restored = next2.restored;
+				await writeUserConfig(secrets, userId, next2.config, {
+					...audit,
+					restored
+				});
+			}
+		}
+		const owedEntry = {
+			keyId: state.keyId,
+			keyAlias: state.keyAlias,
+			reason: "failed",
+			since
+		};
+		const retired = {
+			...state,
+			status: "revoked",
+			generation: state.generation + 1,
+			revokedAt: since,
+			prior: null,
+			...optOut ? { optedOut: true } : {},
+			pendingGatewayRevocations: [...state.pendingGatewayRevocations ?? [], owedEntry]
+		};
+		await writeState(secrets, userId, retired, {
+			...audit,
+			restored,
+			gateway: "pending"
+		});
+		const gateway = await deleteGatewayKey(await optionalAdmin(), state.keyId);
+		const owed = gateway === "unsupported" || gateway === "failed";
+		const next = {
+			...retired,
+			pendingGatewayRevocations: [...state.pendingGatewayRevocations ?? [], ...owed ? [{
+				...owedEntry,
+				reason: gateway
+			}] : []]
+		};
+		await writeState(secrets, userId, next, {
+			...audit,
+			restored,
+			gateway,
+			...owed ? { manualGatewayRevocation: true } : {}
+		});
+		return {
+			...describeState(tenantId, userId, next),
+			revoked: true,
+			gateway,
+			restored
+		};
+	};
+	const provisionLocked = async (tenantId, userId, budget, gateway, secrets) => {
+		let state = await readState(secrets, userId);
+		if (state?.status === "active") {
+			const current = await readUserConfig(secrets, userId);
+			if (isOurs(current, state.keyAlias)) {
+				const sync = sameBudget(state.budget, budget) ? void 0 : await syncLocked(tenantId, userId, budget, secrets);
+				return {
+					...describeState(tenantId, userId, await readState(secrets, userId) ?? state),
+					created: false,
+					...sync && sync.sync !== "none" ? { budgetSync: sync.sync } : {}
+				};
+			}
+			await revokeLocked(tenantId, userId, secrets, state, "user-replaced", false, true);
+			state = await readState(secrets, userId);
+		}
+		if (options.entitled && !await options.entitled(tenantId)) throw new HostedInferenceError(`Tenant ${tenantId} is not entitled to ${HOSTED_INFERENCE_FEATURE_KEY}; nothing was provisioned.`, "HOSTED_NOT_ENTITLED", {
+			tenantId,
+			userId
+		});
+		const generation = state?.generation ?? 0;
+		const admin = await getAdmin(gateway);
+		const projectId = await ensureProject(tenantId, gateway, admin, secrets);
+		let rollback;
+		const provisioned = await runOnce({
+			db: options.db,
+			tenantId,
+			actor: userId,
+			token: "smrt-inference-hosted:provision",
+			content: {
+				userId,
+				generation
+			}
+		}, async () => {
+			const current = await readUserConfig(secrets, userId);
+			const prior = current && current.source !== "hosted" ? current : null;
+			const keyAlias = `smrt-${tenantId}-${userId}-g${generation}-${nonce()}`;
+			const models = keyModels(gateway);
+			const request = {
+				name: keyAlias,
+				description: `smrt hosted inference for user ${userId}`,
+				projectId,
+				tenantId,
+				userId,
+				budget: toGatewayBudget(budget),
+				...models ? { models } : {},
+				...gateway.keyDuration ? { duration: gateway.keyDuration } : {},
+				...gateway.provider === "bifrost" ? { keyIds: ["*"] } : {},
+				metadata: {
+					smrt: HOSTED_INFERENCE_FEATURE_KEY,
+					tenantId,
+					userId,
+					generation
+				}
+			};
+			let key;
+			let createError;
+			try {
+				key = await withDeadline(() => admin.createVirtualKey(request), deadlineMs(), "createVirtualKey");
+			} catch (error) {
+				createError = error;
+			}
+			const apiKey = text$1(key?.key);
+			const keyId = safeKeyId(key?.id, apiKey);
+			const scheduleRollback = () => {
+				const previous = state;
+				rollback = async () => {
+					const outcome = await deleteGatewayKey(admin, keyId);
+					const owed = outcome === "unsupported" || outcome === "failed";
+					const audit2 = {
+						operation: "inference.hosted.provision-rollback",
+						keyAlias,
+						gateway: outcome,
+						...keyId ? { keyId } : {},
+						...owed ? { manualGatewayRevocation: true } : {}
+					};
+					const pending = [...previous?.pendingGatewayRevocations ?? [], ...owed ? [{
+						keyId,
+						keyAlias,
+						reason: "orphaned",
+						since: now().toISOString()
+					}] : []];
+					if (previous) await writeState(secrets, userId, {
+						...previous,
+						pendingGatewayRevocations: pending
+					}, audit2);
+					else if (owed) await writeState(secrets, userId, {
+						version: 1,
+						status: "revoked",
+						generation,
+						keyId: null,
+						keyAlias: "",
+						prior: null,
+						pendingGatewayRevocations: pending
+					}, audit2);
+					else await secrets.delete(hostedInferenceStateSecretName(userId), { auditDetails: audit2 });
+				};
+			};
+			if (createError !== void 0) {
+				if (mayHaveCreated(createError)) scheduleRollback();
+				throw gatewayFailure("createVirtualKey", createError);
+			}
+			if (!apiKey) {
+				scheduleRollback();
+				throw new HostedInferenceError("Gateway createVirtualKey returned no key value.", "HOSTED_GATEWAY_FAILED", { operation: "createVirtualKey" });
+			}
+			const next = {
+				version: 1,
+				status: "active",
+				generation,
+				provider: gateway.provider,
+				projectId,
+				keyId,
+				keyAlias,
+				budget,
+				provisionedAt: now().toISOString(),
+				prior,
+				...state?.pendingGatewayRevocations?.length ? { pendingGatewayRevocations: state.pendingGatewayRevocations } : {}
+			};
+			const audit = {
+				operation: "inference.hosted.provision",
+				keyAlias,
+				projectId,
+				provider: gateway.provider,
+				...keyId ? { keyId } : {}
+			};
+			try {
+				await writeState(secrets, userId, next, audit);
+				await writeUserConfig(secrets, userId, hostedProviderConfig(gateway, apiKey, keyAlias), audit);
+			} catch (error) {
+				scheduleRollback();
+				throw error;
+			}
+			return {
+				...describeState(tenantId, userId, next),
+				created: true
+			};
+		}).catch(async (error) => {
+			if (rollback) await rollback().catch(() => void 0);
+			throw error;
+		});
+		const stored = await readUserConfig(secrets, userId);
+		if (!isOurs(stored, provisioned.keyAlias ?? "")) throw new HostedInferenceError("Hosted inference state for this user was removed outside provisioning; revoke the gateway key named in the audit log and provision again after the run-once claim expires.", "HOSTED_STATE_INVALID", {
+			tenantId,
+			userId,
+			keyAlias: provisioned.keyAlias
+		});
+		return provisioned;
+	};
+	const syncLocked = async (tenantId, userId, budget, secrets) => {
+		const state = await readState(secrets, userId);
+		if (state?.status !== "active") return {
+			...describeState(tenantId, userId, state),
+			sync: "none"
+		};
+		const uncertainAt = state.budgetSyncUncertainAt;
+		if (!uncertainAt && sameBudget(state.budget, budget)) return {
+			...describeState(tenantId, userId, state),
+			sync: "unchanged"
+		};
+		if (!state.keyId) return {
+			...describeState(tenantId, userId, state),
+			sync: "unsupported"
+		};
+		const admin = await getAdmin(gatewayConfig());
+		try {
+			const keyId = state.keyId;
+			await withDeadline(() => admin.updateVirtualKey(keyId, { budget: toGatewayBudget(budget) }), deadlineMs(), "updateVirtualKey");
+		} catch (error) {
+			await writeState(secrets, userId, {
+				...state,
+				budgetSyncUncertainAt: now().toISOString()
+			}, {
+				operation: "inference.hosted.budget-uncertain",
+				keyAlias: state.keyAlias,
+				keyId: state.keyId
+			});
+			throw gatewayFailure("updateVirtualKey", error);
+		}
+		const settled = !uncertainAt || now().getTime() - Date.parse(uncertainAt) >= 9e5;
+		const { budgetSyncUncertainAt: _settled, ...rest } = state;
+		const next = {
+			...settled ? rest : state,
+			budget
+		};
+		if (sameBudget(state.budget, budget) && !(settled && uncertainAt)) return {
+			...describeState(tenantId, userId, next),
+			sync: "updated"
+		};
+		await writeState(secrets, userId, next, {
+			operation: "inference.hosted.budget",
+			keyAlias: state.keyAlias,
+			keyId: state.keyId,
+			limitMicros: budget.limitMicros,
+			window: budget.window
+		});
+		return {
+			...describeState(tenantId, userId, next),
+			sync: "updated"
+		};
+	};
+	const listStates = async (tenantId) => {
+		const secrets = await getSecrets();
+		return inTenant(tenantId, async () => {
+			const rows = await secrets.list({ category: HOSTED_INFERENCE_SECRET_CATEGORY });
+			const states = [];
+			for (const row of rows) {
+				if (!row.name.startsWith(STATE_PREFIX)) continue;
+				const userId = row.name.slice(STATE_PREFIX.length);
+				const state = await readState(secrets, userId);
+				if (state) states.push({
+					userId,
+					state
+				});
+			}
+			return states.sort((a, b) => a.userId.localeCompare(b.userId));
+		});
+	};
+	const retryPendingLocked = async (userId, secrets) => {
+		const state = await readState(secrets, userId);
+		if (!state?.pendingGatewayRevocations?.length) return state;
+		const { state: retried, settled } = await retryPending(state);
+		if (settled.length === 0) return state;
+		await writeState(secrets, userId, retried, {
+			operation: "inference.hosted.revoke-retry",
+			settled,
+			remaining: retried.pendingGatewayRevocations?.length ?? 0
+		});
+		return retried;
+	};
+	const revokeUserLocked = async (tenantId, userId, secrets, reason) => {
+		const state = await readState(secrets, userId);
+		if (state?.status !== "active") return {
+			...describeState(tenantId, userId, await retryPendingLocked(userId, secrets)),
+			revoked: false,
+			gateway: "none"
+		};
+		return revokeLocked(tenantId, userId, secrets, state, reason, true);
+	};
+	const reconcileUserLocked = async (tenantId, userId, budget, gateway, secrets, result) => {
+		const state = await readState(secrets, userId);
+		if (state?.status === "revoked" && state.optedOut) return;
+		if (state?.status === "active") {
+			const current = await readUserConfig(secrets, userId);
+			if (!isOurs(current, state.keyAlias)) {
+				result.revoked.push(await revokeLocked(tenantId, userId, secrets, state, "user-replaced", false, true));
+				return;
+			}
+			result.synced.push(await syncLocked(tenantId, userId, budget, secrets));
+			return;
+		}
+		result.provisioned.push(await provisionLocked(tenantId, userId, budget, gateway, secrets));
+	};
+	const locked = async (tenantId, fn, invalidate) => {
+		await ensureTables();
+		const secrets = await getSecrets();
+		try {
+			return await withTenantLock(tenantId, () => inTenant(tenantId, () => fn(secrets)));
+		} finally {
+			if (invalidate) invalidateUserInferenceResolvers({
+				tenantId,
+				...invalidate.userId ? { userId: invalidate.userId } : {}
+			});
+		}
+	};
+	return {
+		async provision(input) {
+			const tenantId = requireId(input.tenantId, "tenantId");
+			const userId = requireId(input.userId, "userId");
+			const budget = normalizeHostedBudget(input.budget);
+			const gateway = gatewayConfig();
+			return locked(tenantId, (secrets) => provisionLocked(tenantId, userId, budget, gateway, secrets), { userId });
+		},
+		async revoke(input) {
+			const tenantId = requireId(input.tenantId, "tenantId");
+			const userId = requireId(input.userId, "userId");
+			return locked(tenantId, (secrets) => revokeUserLocked(tenantId, userId, secrets, text$1(input.reason) ?? "revoke"), { userId });
+		},
+		async syncBudget(input) {
+			const tenantId = requireId(input.tenantId, "tenantId");
+			const userId = requireId(input.userId, "userId");
+			const budget = normalizeHostedBudget(input.budget);
+			return locked(tenantId, (secrets) => syncLocked(tenantId, userId, budget, secrets));
+		},
+		async status(input) {
+			const tenantId = requireId(input.tenantId, "tenantId");
+			const userId = requireId(input.userId, "userId");
+			const secrets = await getSecrets();
+			return inTenant(tenantId, async () => describeState(tenantId, userId, await readState(secrets, userId)));
+		},
+		async listActive(tenantIdInput) {
+			const tenantId = requireId(tenantIdInput, "tenantId");
+			return (await listStates(tenantId)).filter(({ state }) => state.status === "active").map(({ userId }) => userId);
+		},
+		async listKnown(tenantIdInput) {
+			const tenantId = requireId(tenantIdInput, "tenantId");
+			return (await listStates(tenantId)).map(({ userId }) => userId);
+		},
+		async revokeTenant(tenantIdInput, revokeOptions = {}) {
+			const tenantId = requireId(tenantIdInput, "tenantId");
+			return locked(tenantId, async (secrets) => {
+				const results = [];
+				for (const { userId, state } of await listStates(tenantId)) {
+					if (state.status !== "active") continue;
+					results.push(await revokeUserLocked(tenantId, userId, secrets, text$1(revokeOptions.reason) ?? "revoke"));
+				}
+				return results;
+			}, {});
+		},
+		async syncTenantBudget(tenantIdInput, budgetInput) {
+			const tenantId = requireId(tenantIdInput, "tenantId");
+			const budget = normalizeHostedBudget(budgetInput);
+			return locked(tenantId, async (secrets) => {
+				const results = [];
+				for (const { userId, state } of await listStates(tenantId)) {
+					if (state.status !== "active") continue;
+					results.push(await syncLocked(tenantId, userId, budget, secrets));
+				}
+				return results;
+			});
+		},
+		async acknowledgeGatewayRevocation(input) {
+			const tenantId = requireId(input.tenantId, "tenantId");
+			const userId = requireId(input.userId, "userId");
+			const keyAlias = text$1(input.keyAlias);
+			if (!keyAlias) throw new HostedInferenceError("keyAlias is required", "HOSTED_INFERENCE_INVALID", { field: "keyAlias" });
+			return locked(tenantId, async (secrets) => {
+				const state = await readState(secrets, userId);
+				const pending = state?.pendingGatewayRevocations ?? [];
+				const remaining = pending.filter((entry) => entry.keyAlias !== keyAlias);
+				if (!state || remaining.length === pending.length) return false;
+				await writeState(secrets, userId, {
+					...state,
+					pendingGatewayRevocations: remaining
+				}, {
+					operation: "inference.hosted.revoke-acknowledged",
+					keyAlias
+				});
+				return true;
+			});
+		},
+		async reconcileTenant(tenantIdInput, target) {
+			const tenantId = requireId(tenantIdInput, "tenantId");
+			const budget = target.budget ? normalizeHostedBudget(target.budget) : void 0;
+			const users = (target.users ?? []).map((userId) => requireId(userId, "userId"));
+			if (target.entitled && users.length > 0 && !budget) throw new HostedInferenceError("reconcileTenant needs a budget to provision users.", "HOSTED_INFERENCE_INVALID", { tenantId });
+			const gateway = target.entitled && users.length > 0 ? gatewayConfig() : void 0;
+			return locked(tenantId, async (secrets) => {
+				const result = {
+					tenantId,
+					provisioned: [],
+					revoked: [],
+					synced: [],
+					pending: [],
+					failures: []
+				};
+				const attempt = async (userId, fn) => {
+					try {
+						await fn();
+					} catch (error) {
+						result.failures.push({
+							userId,
+							error
+						});
+					}
+				};
+				const states = await listStates(tenantId);
+				if (!(target.entitled && (!options.entitled || await options.entitled(tenantId)))) for (const { userId, state } of states) {
+					if (state.status !== "active") continue;
+					await attempt(userId, async () => {
+						result.revoked.push(await revokeLocked(tenantId, userId, secrets, state, "entitlement-lost", true));
+					});
+				}
+				else {
+					const wanted = new Set(users);
+					for (const userId of wanted) await attempt(userId, () => reconcileUserLocked(tenantId, userId, budget, gateway, secrets, result));
+					if (budget) for (const { userId, state } of states) {
+						if (wanted.has(userId) || state.status !== "active") continue;
+						await attempt(userId, async () => {
+							result.synced.push(await syncLocked(tenantId, userId, budget, secrets));
+						});
+					}
+				}
+				for (const { userId } of await listStates(tenantId)) await attempt(userId, async () => {
+					const remaining = (await retryPendingLocked(userId, secrets))?.pendingGatewayRevocations?.length ?? 0;
+					if (remaining > 0) result.pending.push({
+						userId,
+						remaining
+					});
+				});
+				return result;
+			}, {});
+		}
+	};
+}
+function provisionHostedInference(options) {
+	const { tenantId, userId, budget, ...deps } = options;
+	return createHostedInferenceProvisioner(deps).provision({
+		tenantId,
+		userId,
+		budget
+	});
+}
+function revokeHostedInference(options) {
+	const { tenantId, userId, reason, ...deps } = options;
+	return createHostedInferenceProvisioner(deps).revoke({
+		tenantId,
+		userId,
+		...reason ? { reason } : {}
+	});
+}
+function hostedBudgetFromGrantMetadata(metadata) {
+	const budget = metadata?.budget;
+	if (!budget || typeof budget !== "object") return void 0;
+	const { limitMicros, window } = budget;
+	if (typeof limitMicros !== "number") return void 0;
+	return {
+		limitMicros,
+		...typeof window === "string" ? { window } : {}
+	};
+}
+function hostedGrant(snapshot) {
+	return snapshot.grants.find((grant) => grant.featureKey === "inference.hosted" && grant.enabled !== false);
+}
+function throwReconcileFailures(result) {
+	if (result.failures.length === 0) return;
+	throw new HostedInferenceError(`Hosted inference failed for ${result.failures.length} user(s) of tenant ${result.tenantId}.`, "HOSTED_GATEWAY_FAILED", {
+		tenantId: result.tenantId,
+		users: result.failures.map((failure) => failure.userId),
+		codes: result.failures.map((failure) => failure.error instanceof SmrtError ? failure.error.code : failure.error instanceof Error ? failure.error.name : "unknown")
+	});
+}
+function createHostedInferenceReconciler(options) {
+	return async (tenantId, snapshot) => {
+		const grant = hostedGrant(snapshot);
+		if (!grant) {
+			const result2 = await options.provisioner.reconcileTenant(tenantId, { entitled: false });
+			throwReconcileFailures(result2);
+			return result2;
+		}
+		const budget = options.budgetFor?.(tenantId, snapshot) ?? hostedBudgetFromGrantMetadata(grant.metadata) ?? options.defaultBudget;
+		if (!budget) throw new HostedInferenceError(`The ${HOSTED_INFERENCE_FEATURE_KEY} grant names no budget (metadata.budget.limitMicros) and no defaultBudget is set.`, "HOSTED_INFERENCE_INVALID", { tenantId });
+		const result = await options.provisioner.reconcileTenant(tenantId, {
+			entitled: true,
+			budget,
+			users: await options.users(tenantId)
+		});
+		throwReconcileFailures(result);
+		return result;
+	};
+}
+function createHostedInferenceEntitlementListener(options) {
+	const reconcile = createHostedInferenceReconciler(options);
+	return async (change) => {
+		if (![
+			change.gained,
+			change.lost,
+			change.changed
+		].some((keys) => keys.includes("inference.hosted"))) return;
+		await reconcile(change.tenantId, change.after);
+	};
+}
+//#endregion
+//#region src/node.ts
+var DEFAULT_PROBE_TIMEOUT_MS = 3e3;
+var OPENAI_DEFAULT_BASE = "https://api.openai.com/v1";
+var ANTHROPIC_DEFAULT_BASE = "https://api.anthropic.com/v1";
+var GEMINI_DEFAULT_BASE = "https://generativelanguage.googleapis.com/v1beta";
+var OLLAMA_DEFAULT_BASE = "http://127.0.0.1:11434";
+var OPENAI_COMPATIBLE = /* @__PURE__ */ new Set([
+	"openai",
+	"litellm",
+	"bifrost"
+]);
+function text(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+function worst(statuses) {
+	if (statuses.includes("error")) return "error";
+	if (statuses.includes("warn")) return "warn";
+	return "ok";
+}
+function keySource(candidate) {
+	if (text(candidate.apiKey)) return {
+		inline: true,
+		required: true
+	};
+	const env = text(candidate.apiKeyEnv);
+	if (env) return {
+		env,
+		required: true
+	};
+	const preset = text(candidate.preset);
+	if (preset && isInferencePresetId(preset)) return { required: INFERENCE_PRESETS[preset].requiresApiKey };
+	if (text(candidate.baseUrl)) return { required: false };
+	const providerEnv = getDefaultAIKeyEnvName(candidate.provider);
+	return providerEnv ? {
+		env: providerEnv,
+		required: true,
+		providerDefault: true
+	} : { required: false };
+}
+function resolveKey(candidate, env) {
+	const source = keySource(candidate);
+	if (source.inline) return text(candidate.apiKey);
+	return source.env ? text(env[source.env]) : void 0;
+}
+function checkCandidateOffline(candidate, options) {
+	const label = candidateLabel(candidate);
+	const problems = [];
+	const statuses = [];
+	const fail = (message) => {
+		problems.push(message);
+		statuses.push("error");
+	};
+	const preset = text(candidate.preset);
+	const provider = text(candidate.provider);
+	if (preset) {
+		if (!isInferencePresetId(preset)) fail(`unknown preset "${preset}"`);
+	} else if (provider) {
+		if (!options.providers.includes(provider.toLowerCase())) fail(`provider "${provider}" is not recognized`);
+	}
+	if (!text(candidate.model)) {
+		problems.push("no model named (the provider default answers)");
+		statuses.push("warn");
+	}
+	const source = keySource(candidate);
+	if (source.required && !resolveKey(candidate, options.env)) if (source.providerDefault) {
+		problems.push(`key variable ${source.env} is not set (fine if the configured client is this provider)`);
+		statuses.push("warn");
+	} else fail(source.env ? `key variable ${source.env} is not set` : "a key is required and none is configured");
+	if ((text(candidate.apiKeyEnv) || text(candidate.apiKey)) && !preset) {
+		if (!text(candidate.baseUrl)) fail("brings its own key without a baseUrl");
+	}
+	const sdkWide = ["HAVE_AI_BASE_URL", "HAVE_AI_API_KEY"].find((name) => text(options.env[name]));
+	if (sdkWide && provider && !preset && !text(candidate.baseUrl)) {
+		problems.push(`${sdkWide} is set: core refuses this candidate unless ${provider} is the configured provider (give it a baseUrl and apiKeyEnv)`);
+		statuses.push("warn");
+	}
+	return {
+		label,
+		status: worst(statuses),
+		problems
+	};
+}
+function probeRequest(candidate, key) {
+	const preset = text(candidate.preset);
+	const provider = (text(candidate.provider) ?? "").toLowerCase();
+	const baseUrl = text(candidate.baseUrl) ?? (preset && isInferencePresetId(preset) ? INFERENCE_PRESETS[preset].baseUrl : void 0);
+	const trim = (url) => url.replace(/\/+$/, "");
+	if (!preset && !baseUrl && provider !== "openai" && OPENAI_COMPATIBLE.has(provider)) return;
+	if (preset || OPENAI_COMPATIBLE.has(provider)) return {
+		url: `${trim(baseUrl ?? OPENAI_DEFAULT_BASE)}/models`,
+		headers: key ? { authorization: `Bearer ${key}` } : {}
+	};
+	if (provider === "anthropic") return {
+		url: `${trim(baseUrl ?? ANTHROPIC_DEFAULT_BASE)}/models`,
+		headers: {
+			"anthropic-version": "2023-06-01",
+			...key ? { "x-api-key": key } : {}
+		}
+	};
+	if (provider === "gemini") return {
+		url: `${trim(baseUrl ?? GEMINI_DEFAULT_BASE)}/models`,
+		headers: key ? { "x-goog-api-key": key } : {}
+	};
+	if (provider === "ollama") return {
+		url: `${trim(baseUrl ?? OLLAMA_DEFAULT_BASE)}/api/tags`,
+		headers: {}
+	};
+}
+function positive(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : void 0;
+}
+function inferenceCapabilitiesFromModelListing(body, model) {
+	if (!model || !body || typeof body !== "object") return void 0;
+	const record = body;
+	const entry = (Array.isArray(record.data) ? record.data : Array.isArray(record.models) ? record.models : []).find((item) => {
+		const row = item;
+		return row?.id === model || row?.name === model || row?.name === `models/${model}`;
+	});
+	if (!entry) return void 0;
+	const out = {};
+	const meta = entry.meta;
+	const topProvider = entry.top_provider;
+	const maxContext = positive(entry.context_length) ?? positive(entry.max_context_length) ?? positive(topProvider?.context_length) ?? positive(meta?.n_ctx_train) ?? positive(entry.inputTokenLimit);
+	if (maxContext !== void 0) out.maxContext = maxContext;
+	if (Array.isArray(entry.supported_parameters)) {
+		const params = entry.supported_parameters;
+		out.tools = params.includes("tools");
+		out.json = params.includes("response_format") || params.includes("structured_outputs");
+	}
+	const architecture = entry.architecture;
+	if (Array.isArray(architecture?.input_modalities)) out.vision = architecture.input_modalities.includes("image");
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+async function inferenceCandidateCapabilities(candidate, options = {}) {
+	const preset = inferencePresetFor(candidate);
+	let sdk;
+	if (options.sdkCapabilities && !text(candidate.baseUrl) && !preset) try {
+		sdk = await options.sdkCapabilities(candidate);
+	} catch {
+		sdk = void 0;
+	}
+	return resolveInferenceCapabilities({
+		provider: inferenceCapabilitiesFromSdk(sdk),
+		preset: preset ? INFERENCE_PRESET_CAPABILITIES[preset] : void 0,
+		probe: options.probe,
+		heuristic: inferenceCapabilityHeuristic(candidate)
+	});
+}
+function inferenceProbeUrl(candidate) {
+	return probeRequest(candidate, void 0)?.url;
+}
+async function probeInferenceCandidate(candidate, options = {}) {
+	const env = options.env ?? process.env;
+	const preset = text(candidate.preset);
+	if (preset && !isInferencePresetId(preset)) return {
+		reachable: false,
+		durationMs: 0,
+		detail: `not probed: unknown preset "${preset}"`
+	};
+	if ((text(candidate.apiKey) || text(candidate.apiKeyEnv)) && !text(candidate.baseUrl) && !preset) return {
+		reachable: false,
+		durationMs: 0,
+		detail: "not probed: a candidate key needs its own baseUrl (it is never sent to a provider default endpoint)"
+	};
+	const request = probeRequest(candidate, resolveKey(candidate, env));
+	if (!request) return {
+		reachable: false,
+		skipped: true,
+		durationMs: 0,
+		detail: `no cheap probe for provider "${candidate.provider ?? "default"}"`
+	};
+	const doFetch = options.fetch ?? globalThis.fetch;
+	const controller = new AbortController();
+	const timeoutMs = options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	const started = Date.now();
+	const where = redactBaseUrl(request.url) ?? "endpoint";
+	try {
+		const response = await doFetch(request.url, {
+			method: "GET",
+			headers: request.headers,
+			signal: controller.signal,
+			redirect: "manual"
+		});
+		const durationMs = Date.now() - started;
+		if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) return {
+			reachable: false,
+			status: response.status || void 0,
+			durationMs,
+			detail: `${where} redirected (not followed: the key stays with its own endpoint)`
+		};
+		if (response.ok) {
+			let capabilities;
+			try {
+				capabilities = inferenceCapabilitiesFromModelListing(await response.json(), text(candidate.model));
+			} catch {}
+			return {
+				reachable: true,
+				status: response.status,
+				durationMs,
+				detail: `${where} answered ${response.status}`,
+				...capabilities ? { capabilities } : {}
+			};
+		}
+		const why = response.status === 401 || response.status === 403 ? "credential rejected" : response.status === 402 || response.status === 429 ? "quota or rate limit" : "endpoint error";
+		return {
+			reachable: false,
+			status: response.status,
+			durationMs,
+			detail: `${where} answered ${response.status} (${why})`
+		};
+	} catch (error) {
+		const aborted = controller.signal.aborted;
+		return {
+			reachable: false,
+			durationMs: Date.now() - started,
+			detail: aborted ? `${where} did not answer within ${timeoutMs} ms` : `${where} unreachable (${error instanceof Error ? error.name : "error"})`
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+function describeTarget(target) {
+	const kind = inferenceTargetKind(target);
+	if (kind === "alias") return `alias ${String(target.alias)}`;
+	if (kind === "candidates") return `${target.candidates?.length ?? 0} inline candidate(s)`;
+	if (kind === "fusion") return `fusion ${String(target.fusion)}`;
+	if (kind !== "single") return `kind ${kind} (not checked here)`;
+	const base = text(target.baseUrl);
+	return `${candidateLabel(target)}${base ? ` at ${redactBaseUrl(base)}` : ""}`;
+}
+async function checkInferenceBindings(options = {}) {
+	const env = options.env ?? process.env;
+	const providers = (options.providers ?? AI_PROVIDER_TYPES).map((name) => name.toLowerCase());
+	const bindings = [];
+	let config;
+	try {
+		config = "config" in options ? options.config : getInferenceConfig();
+		assertInferenceConfig(config);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		return {
+			ok: false,
+			configured: true,
+			bindings: [{
+				binding: "inference",
+				target: "config",
+				status: "error",
+				problems: [message],
+				candidates: []
+			}],
+			issues: [{
+				path: "inference",
+				code: "candidate-invalid",
+				message
+			}]
+		};
+	}
+	const issues = findInferenceConfigIssues(config);
+	const aliases = config?.aliases ?? {};
+	const issuesFor = (prefix) => issues.filter((issue) => issue.path === prefix || issue.path.startsWith(`${prefix}.`) || issue.path.startsWith(`${prefix}[`)).map((issue) => issue.message);
+	const checkList = async (list) => {
+		const out = [];
+		for (const candidate of list) {
+			const nested = text(candidate.alias);
+			if (nested) {
+				out.push({
+					label: `alias:${nested}`,
+					status: Object.hasOwn(aliases, nested) ? "ok" : "error",
+					problems: Object.hasOwn(aliases, nested) ? [`expands alias ${nested} (checked under alias:${nested})`] : [`unknown alias "${nested}"`]
+				});
+				continue;
+			}
+			const checked = checkCandidateOffline(candidate, {
+				env,
+				providers
+			});
+			if (options.probe && checked.status !== "error") {
+				checked.probe = await probeInferenceCandidate(candidate, {
+					env,
+					timeoutMs: options.timeoutMs,
+					fetch: options.fetch
+				});
+				if (!checked.probe.reachable && !checked.probe.skipped) {
+					checked.status = "error";
+					checked.problems.push(checked.probe.detail);
+				}
+				checked.capabilities = await inferenceCandidateCapabilities(candidate, {
+					probe: checked.probe.capabilities,
+					sdkCapabilities: options.sdkCapabilities
+				});
+			}
+			out.push(checked);
+		}
+		return out;
+	};
+	const settle = (binding, target, configProblems, candidates) => {
+		const usable = candidates.some((candidate) => candidate.status !== "error");
+		return {
+			binding,
+			target,
+			status: configProblems.length > 0 || candidates.length > 0 && !usable ? "error" : candidates.every((candidate) => candidate.status === "ok") ? "ok" : "warn",
+			problems: [...configProblems, ...configProblems.length === 0 && candidates.length > 0 && !usable ? ["no candidate can answer"] : []],
+			candidates
+		};
+	};
+	for (const tier of INFERENCE_TIERS) {
+		const target = config?.tiers?.[tier];
+		const name = `tier:${tier}`;
+		if (!target || Object.keys(target).length === 0) {
+			bindings.push({
+				binding: name,
+				target: "the configured client",
+				status: "ok",
+				problems: [],
+				candidates: []
+			});
+			continue;
+		}
+		const kind = inferenceTargetKind(target);
+		const configProblems = issuesFor(`inference.tiers.${tier}`);
+		let candidates = [];
+		if (kind === "single") candidates = await checkList([target]);
+		else if (kind === "candidates") candidates = await checkList(target.candidates ?? []);
+		else if (kind === "alias") {
+			const aliasName = text(target.alias);
+			candidates = [{
+				label: `alias:${aliasName ?? "?"}`,
+				status: aliasName && Object.hasOwn(aliases, aliasName) ? "ok" : "error",
+				problems: []
+			}];
+		}
+		bindings.push(settle(name, describeTarget(target), configProblems, candidates));
+	}
+	for (const [name, alias] of Object.entries(aliases)) {
+		const list = Array.isArray(alias?.candidates) ? alias.candidates : [];
+		bindings.push(settle(`alias:${name}`, `${list.length} candidate(s)${alias?.description ? ` \u2014 ${alias.description}` : ""}`, issuesFor(`inference.aliases.${name}`), await checkList(list)));
+	}
+	for (const [name, fusion] of Object.entries(config?.fusions ?? {})) {
+		const seats = Array.isArray(fusion?.seats) ? fusion.seats.length : 0;
+		bindings.push(settle(`fusion:${name}`, `${String(fusion?.mode)}, ${seats} seat(s)${fusion?.description ? ` \u2014 ${fusion.description}` : ""}`, issuesFor(`inference.fusions.${name}`), []));
+	}
+	for (const binding of bindings) {
+		if (!binding.binding.startsWith("tier:")) continue;
+		const ref = binding.candidates[0]?.label;
+		if (binding.candidates.length !== 1 || !ref?.startsWith("alias:")) continue;
+		const resolved = bindings.find((entry) => entry.binding === ref);
+		const reference = binding.candidates[0];
+		if (resolved && reference) reference.status = resolved.status;
+		if (resolved?.status === "error") {
+			binding.status = "error";
+			binding.problems.push(`${ref} cannot resolve`);
+		} else if (resolved?.status === "warn" && binding.status === "ok") {
+			binding.status = "warn";
+			binding.problems.push(`${ref} has a candidate that cannot answer`);
+		}
+	}
+	return {
+		ok: !bindings.some((binding) => binding.status === "error"),
+		configured: !!config && (!!config.tiers || !!config.aliases),
+		bindings,
+		issues
+	};
+}
+function formatInferenceCapabilities(capabilities) {
+	const flag = (value) => value ? "yes" : "no";
+	return `json ${flag(capabilities.json)}, tools ${flag(capabilities.tools)}, vision ${flag(capabilities.vision)}, context ${capabilities.maxContext ?? "unknown"} (source: ${capabilities.source})`;
+}
+var ICON = {
+	ok: "✅",
+	warn: "⚠️ ",
+	error: "❌"
+};
+function formatInferenceDoctorReport(report) {
+	const lines = [];
+	if (!report.configured) lines.push("  No inference config: every tier uses the configured AI client.");
+	for (const binding of report.bindings) {
+		lines.push(`  ${ICON[binding.status]} ${binding.binding} \u2192 ${binding.target}`);
+		for (const problem of binding.problems) lines.push(`       ${problem}`);
+		for (const candidate of binding.candidates) {
+			const probe = candidate.probe ? candidate.probe.skipped ? " (probe skipped)" : ` (${candidate.probe.detail}, ${candidate.probe.durationMs} ms)` : "";
+			lines.push(`     ${ICON[candidate.status]} ${candidate.label}${probe}`);
+			if (candidate.capabilities) lines.push(`         capabilities: ${formatInferenceCapabilities(candidate.capabilities)}`);
+			for (const problem of candidate.problems) {
+				if (candidate.probe && problem === candidate.probe.detail) continue;
+				lines.push(`         ${problem}`);
+			}
+		}
+	}
+	return lines;
+}
+//#endregion
+export { HOSTED_BUDGET_UNCERTAIN_WINDOW_MS, HOSTED_BUDGET_WINDOWS, HOSTED_GATEWAY_ADMIN_METHODS, HOSTED_GATEWAY_ADMIN_TIMEOUT_MS, HOSTED_GATEWAY_ENV, HOSTED_GATEWAY_PROVIDERS, HOSTED_INFERENCE_FEATURE_KEY, HOSTED_INFERENCE_SECRET_CATEGORY, HostedInferenceError, checkInferenceBindings, createHostedGatewayAdmin, createHostedInferenceEntitlementListener, createHostedInferenceProvisioner, createHostedInferenceReconciler, formatInferenceCapabilities, formatInferenceDoctorReport, getHostedGatewayConfig, hostedBudgetFromGrantMetadata, hostedGatewayConfigFromEnv, hostedInferenceStateSecretName, inferenceCandidateCapabilities, inferenceCapabilitiesFromModelListing, inferenceProbeUrl, normalizeHostedBudget, parseHostedGatewayConfig, probeInferenceCandidate, provisionHostedInference, resetHostedGatewayConfig, revokeHostedInference, toGatewayBudget };
+
+//# sourceMappingURL=node.js.map