@jingyi0605/codingns4dsh 0.2.1-rc.2 → 0.2.1-rc.4

package/data/build/dist/host/cli-adapters/magpie-management.js

@@ -0,0 +1,1343 @@
+import { isMagpieProviderId, magpieProviderId } from '../../shared/magpie-provider-id.js';
+import { MagpieWebService } from './magpie-web.js';
+const MAX_PROVIDERS = 100;
+const MAX_GROUPS = 200;
+const MAX_ACCOUNTS = 500;
+const MAX_PROVIDER_ICON_FETCHES = 64;
+const PROVIDER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const GROUP_ID = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,127}$/u;
+const MODEL_ID = /^[A-Za-z0-9][A-Za-z0-9._:/+@-]{0,299}$/u;
+const ENDPOINT_FIELDS = ['chat', 'responses', 'anthropic', 'gemini'];
+const ENDPOINT_FIELD_SET = new Set(ENDPOINT_FIELDS);
+const ROUTING_POLICIES = new Set(['smart', 'order', 'rotate', 'usage', 'pace', 'weight', 'manual']);
+/** `provider.MemberEfforts`: the reasoning levels a group may offer its Agents. */
+const MEMBER_LEVELS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+/** How a group picks each turn's level: the Agent's own request, or a classifier's pick. */
+const GROUP_EFFORTS = new Set(['', 'auto']);
+const STICKINESS_POLICIES = new Set(['auto', 'session', 'turn', 'off', 'strict']);
+const ACCOUNT_AGENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+/**
+ * IDs Magpie refuses a provider, whatever its spelling (`provider.Rename`): the gateway itself,
+ * the prefix its routing groups carry, and the destination of model IDs that name none.
+ */
+const RESERVED_PROVIDER_IDS = new Set(['magpie', 'group', 'auto']);
+/**
+ * Fields a provider save does not write back: `was` is the IDs Magpie remembers the provider by,
+ * and `id` is read back under the ID a rename gives it.
+ */
+const PROVIDER_SAVE_KEEPS = new Set(['was', 'id']);
+const PROVIDER_VIEW_FIELDS = new Set([
+    'host', 'key', 'keyList', 'balanceToken', 'account', 'ready', 'chosen', 'speaks', 'models', 'exposed', 'unlisted',
+    'noModels', 'groups', 'off', 'agents', 'sponsored',
+]);
+const PROVIDER_MUTABLE_FIELDS = new Set(['name', 'chat', 'responses', 'anthropic', 'gemini', 'models', 'chosen', 'off']);
+const GROUP_VIEW_FIELDS = new Set(['id', 'ready', 'memberInfo', 'holds', 'offers', 'shared', 'patterns', 'ref']);
+/** Every field `/api/groups/save` writes; one left out of the body comes back as Magpie's default. */
+const GROUP_WRITTEN_FIELDS = [
+    'name', 'members', 'match', 'routing', 'affinity', 'pick', 'unlists', 'fast', 'off', 'weights',
+    'sink', 'firstToken', 'patience', 'context', 'family', 'levels', 'effort', 'classifier', 'rules', 'from',
+];
+const LOGIN_CONTAINER_FIELDS = new Set(['accounts', 'logins', 'data', 'users', 'usage', 'providers', 'items']);
+const MANAGEMENT_CACHE_TTL_MS = 15_000;
+/** Provider, account, and routing-group panels use the authenticated Magpie Web API only. */
+export class MagpieManagementService {
+    webApi;
+    now;
+    mutationTail = Promise.resolve();
+    snapshotCache;
+    snapshotRefresh;
+    providerLogoCache = new Map();
+    constructor(options = {}) {
+        this.webApi = options.webApi;
+        this.now = options.now ?? Date.now;
+    }
+    async readSnapshot(signal) {
+        const cached = this.snapshotCache;
+        if (cached !== undefined) {
+            if (this.now() - cached.loadedAt < MANAGEMENT_CACHE_TTL_MS)
+                return cached.state.snapshot;
+            this.refreshSnapshot();
+            return cached.state.snapshot;
+        }
+        const state = await this.readWebState(signal);
+        this.remember(state);
+        return state.snapshot;
+    }
+    async updateProvider(input, signal) {
+        const update = readProviderUpdate(input);
+        return this.enqueueMutation(async () => {
+            const before = await this.readWebState(signal);
+            const current = before.rawProviders?.find(item => item.id === update.id);
+            const currentRecord = before.snapshot.providers.find(item => item.id === update.id);
+            if (before.snapshot.providerStatus === 'unavailable' || !before.providerWritesSafe || current === undefined || currentRecord === undefined) {
+                throw new Error('Magpie provider data is unavailable');
+            }
+            if (update.models !== undefined && !currentRecord.modelsEditable) {
+                throw new TypeError('Magpie provider models contain entries this Host cannot safely edit');
+            }
+            if (update.on !== undefined && currentRecord.state === 'unknown')
+                throw new Error('Magpie provider availability cannot be verified');
+            if (update.endpointField !== undefined && !currentRecord.endpoints.some(endpoint => endpoint.field === update.endpointField && endpoint.editable)) {
+                throw new TypeError('Only an endpoint already present on this provider can be edited');
+            }
+            const newId = update.newId !== undefined && update.newId !== currentRecord.id ? update.newId : undefined;
+            if (newId !== undefined) {
+                if (!currentRecord.idEditable)
+                    throw new TypeError('Magpie stored this provider under an ID it will not write again, so it cannot be renamed');
+                // Magpie answers a rename to a taken ID by saving over that provider, so the ID has to be
+                // free here: in the snapshot, and among the IDs Magpie remembers the providers by.
+                if (before.snapshot.providers.some(provider => provider.id !== currentRecord.id
+                    && (provider.id === newId || magpieProviderAliasIds(before.rawProviders ?? [], provider.id).includes(newId)))) {
+                    throw new TypeError('Another Magpie provider already answers to this ID');
+                }
+            }
+            const hasConfigChange = providerHasConfigChange(update, currentRecord);
+            const hasStateChange = update.on !== undefined && currentRecord.state !== (update.on ? 'on' : 'off');
+            if (!hasConfigChange && !hasStateChange && newId === undefined) {
+                return { changed: 'provider', id: update.id, snapshot: before.snapshot };
+            }
+            const protectedBefore = providerConfigFingerprint(current);
+            if (hasConfigChange || newId !== undefined) {
+                await this.requestApi('/api/provider/save', {
+                    method: 'POST', body: providerSavePayload(currentRecord, update, newId), ...signalOption(signal),
+                });
+            }
+            if (hasStateChange) {
+                await this.requestApi(`/api/provider/${update.on ? 'on' : 'off'}`, {
+                    method: 'POST', body: { id: newId ?? update.id }, ...signalOption(signal),
+                });
+            }
+            const after = await this.readWebState(signal);
+            const savedId = newId ?? update.id;
+            const saved = after.snapshot.providers.find(item => item.id === savedId);
+            const savedRaw = after.rawProviders?.find(item => item.id === savedId);
+            this.remember(after);
+            if (saved === undefined || savedRaw === undefined || !providerUpdateMatches(update, saved)
+                || !providerRecordMatchesUpdate(currentRecord, update, saved)
+                || providerConfigFingerprint(savedRaw) !== protectedBefore
+                || !otherProvidersUnchanged(before.rawProviders ?? [], after.rawProviders ?? [], savedId, update.id)) {
+                throw new Error('Magpie provider update could not be verified without changing protected settings');
+            }
+            return { changed: 'provider', id: savedId, snapshot: after.snapshot };
+        });
+    }
+    async updateGroup(input, signal) {
+        const update = readGroupUpdate(input);
+        return this.enqueueMutation(async () => {
+            const before = await this.readWebState(signal);
+            if (before.snapshot.groupStatus !== 'available')
+                throw new Error('Magpie routing-group data is unavailable');
+            const current = before.rawGroups?.find(item => normalizeGroupId(item.id) === update.id);
+            const currentRecord = before.snapshot.groups.find(item => item.id === update.id);
+            if (current === undefined || currentRecord === undefined)
+                throw new Error('Magpie routing group was not found');
+            if ((update.routing ?? currentRecord.routing) === 'manual' && (update.pick ?? currentRecord.pick) === null) {
+                throw new TypeError('A manual routing group needs the model it sends to');
+            }
+            if ((update.effort ?? currentRecord.effort) === 'auto' && (update.classifier ?? currentRecord.classifier ?? '') === '') {
+                throw new TypeError('A group that picks each turn\'s reasoning needs the model that rates it');
+            }
+            const protectedBefore = groupConfigFingerprint(current);
+            await this.requestApi('/api/groups/save', {
+                method: 'POST', body: groupSavePayload(current, currentRecord, update), ...signalOption(signal),
+            });
+            const after = await this.readWebState(signal);
+            const saved = after.snapshot.groups.find(item => item.id === update.id);
+            const savedRaw = after.rawGroups?.find(item => normalizeGroupId(item.id) === update.id);
+            this.remember(after);
+            if (saved === undefined || savedRaw === undefined || !groupUpdateMatches(update, saved)
+                || groupConfigFingerprint(savedRaw) !== protectedBefore
+                || !otherGroupsUnchanged(before.rawGroups ?? [], after.rawGroups ?? [], update.id)) {
+                throw new Error('Magpie routing-group update could not be verified without changing protected settings');
+            }
+            return { changed: 'group', id: update.id, snapshot: after.snapshot };
+        });
+    }
+    async updateAccount(input, signal) {
+        const update = readAccountUpdate(input);
+        return this.enqueueMutation(async () => {
+            const before = await this.readWebState(signal);
+            if (before.snapshot.accountStatus !== 'available')
+                throw new Error('Magpie account data is unavailable');
+            if (before.snapshot.accountApiStatus !== 'available')
+                throw new Error('Magpie Web account API is unavailable');
+            const current = findAccount(before.snapshot.accounts, update.agent, update.user);
+            if (current === undefined)
+                throw new Error('Magpie account was not found');
+            if (current.on === null)
+                throw new Error('Magpie account routing status cannot be verified');
+            if (current.on === update.on)
+                return { changed: 'account', id: `${update.agent}/${update.user}`, snapshot: before.snapshot };
+            if (!update.on && before.snapshot.accounts.filter(account => account.agent.toLocaleLowerCase() === update.agent.toLocaleLowerCase() && account.on === true).length <= 1) {
+                throw new Error('Magpie requires at least one account to remain in routing rotation');
+            }
+            await this.requestApi(`/api/login/${update.on ? 'on' : 'off'}`, {
+                method: 'POST', body: { Agent: update.agent, User: update.user }, ...signalOption(signal),
+            });
+            const after = await this.readWebState(signal);
+            const saved = findAccount(after.snapshot.accounts, update.agent, update.user);
+            this.remember(after);
+            if (after.snapshot.accountStatus !== 'available' || saved?.on !== update.on
+                || !otherAccountsUnchanged(before.snapshot.accounts, after.snapshot.accounts, update.agent, update.user)) {
+                throw new Error('Magpie account change could not be verified after saving');
+            }
+            return { changed: 'account', id: `${update.agent}/${update.user}`, snapshot: after.snapshot };
+        });
+    }
+    enqueueMutation(operation) {
+        const next = this.mutationTail.then(operation, operation);
+        this.mutationTail = next.then(() => undefined, () => undefined);
+        return next;
+    }
+    async readWebState(signal) {
+        signal?.throwIfAborted();
+        const [providerResult, groupResult, quotaResult, loginUsageResult] = await Promise.all([
+            this.readApi('/api/providers', signal),
+            this.readApi('/api/groups', signal),
+            this.readApi('/api/usage/quotas', signal),
+            this.readApi('/api/login/usage', signal),
+        ]);
+        // Logos come from the same provider rows, so they are inlined before the snapshot is
+        // remembered: a cached snapshot and the mutation results both carry them already.
+        const providers = providerResult.ok ? parseMagpieWebProviders(providerResult.value) : null;
+        const parsedProviders = providers === null
+            ? null
+            : { ...providers, records: await this.attachProviderLogos(providers.records, signal) };
+        const parsedGroups = groupResult.ok ? parseMagpieWebGroups(groupResult.value) : null;
+        const parsedAccounts = providerResult.ok || quotaResult.ok || loginUsageResult.ok
+            ? parseMagpieWebAccounts(quotaResult.ok ? quotaResult.value : null, loginUsageResult.ok ? loginUsageResult.value : null, providerResult.ok ? providerResult.value : null)
+            : null;
+        const apiAvailable = providerResult.ok || groupResult.ok || quotaResult.ok || loginUsageResult.ok;
+        const snapshot = {
+            capturedAt: new Date(this.now()).toISOString(),
+            availabilityIssue: apiAvailable ? null : 'web-api-unavailable',
+            providerStatus: parsedProviders === null ? 'unavailable' : parsedProviders.partial ? 'partial' : 'available',
+            providers: parsedProviders?.records ?? [],
+            accountStatus: parsedAccounts === null ? 'unavailable' : 'available',
+            accounts: parsedAccounts ?? [],
+            accountApiStatus: loginUsageResult.ok ? 'available' : 'unavailable',
+            groupStatus: parsedGroups === null ? 'unavailable' : 'available',
+            groups: parsedGroups?.groups ?? [],
+        };
+        return {
+            snapshot,
+            rawProviders: parsedProviders?.raw ?? null,
+            providerWritesSafe: parsedProviders?.writesSafe ?? false,
+            rawGroups: parsedGroups?.raw ?? null,
+        };
+    }
+    refreshSnapshot() {
+        if (this.snapshotRefresh !== undefined)
+            return;
+        const refresh = this.readWebState();
+        this.snapshotRefresh = refresh;
+        void refresh.then((state) => this.remember(state), () => undefined).finally(() => {
+            if (this.snapshotRefresh === refresh)
+                this.snapshotRefresh = undefined;
+        });
+    }
+    remember(state) {
+        this.snapshotCache = { state, loadedAt: this.now() };
+    }
+    async readApi(path, signal) {
+        if (this.webApi === undefined)
+            return { ok: false };
+        try {
+            return { ok: true, value: await this.webApi.requestJson(path, { ...signalOption(signal) }) };
+        }
+        catch {
+            signal?.throwIfAborted();
+            return { ok: false };
+        }
+    }
+    async requestApi(path, options) {
+        if (this.webApi === undefined)
+            throw new Error('Magpie Web API is unavailable');
+        return this.webApi.requestJson(path, options);
+    }
+    /**
+     * Inline each provider's Magpie icon, as the subscription page does for its provider cards.
+     *
+     * Provider rows carry the same `icon` field `/api/usage/quotas` does (`claude-color`,
+     * `file:<name>`), so the three views show one logo from one source. A missing icon only
+     * costs that row its logo: the Client still falls back to its own icon table.
+     */
+    async attachProviderLogos(records, signal) {
+        const requestAssetDataUrl = this.webApi?.requestAssetDataUrl;
+        if (typeof requestAssetDataUrl !== 'function')
+            return records;
+        const icons = [...new Set(records
+                .map(record => record.icon)
+                .filter((icon) => icon !== undefined))].slice(0, MAX_PROVIDER_ICON_FETCHES);
+        if (icons.length === 0)
+            return records;
+        const logos = new Map();
+        await Promise.all(icons.map(async (icon) => {
+            const cached = this.providerLogoCache.get(icon);
+            const logo = cached === undefined ? await this.readProviderLogoDataUrl(icon, signal) : cached;
+            if (cached === undefined)
+                this.providerLogoCache.set(icon, logo);
+            logos.set(icon, logo);
+        }));
+        return records.map((record) => {
+            const logoDataUrl = record.icon === undefined ? null : logos.get(record.icon) ?? null;
+            return logoDataUrl === null ? record : { ...record, logoDataUrl };
+        });
+    }
+    async readProviderLogoDataUrl(icon, signal) {
+        const requestAssetDataUrl = this.webApi?.requestAssetDataUrl;
+        if (typeof requestAssetDataUrl !== 'function')
+            return null;
+        for (const path of magpieIconAssetPaths(icon)) {
+            try {
+                const value = await requestAssetDataUrl.call(this.webApi, path, signal === undefined ? {} : { signal });
+                if (value !== null && value !== '')
+                    return value;
+            }
+            catch {
+                signal?.throwIfAborted();
+            }
+        }
+        return null;
+    }
+}
+export function parseMagpieWebProviders(value) {
+    const root = asRecord(value);
+    if (root === null || !Array.isArray(root.providers) || root.providers.length > MAX_PROVIDERS)
+        return null;
+    const raw = [];
+    const records = [];
+    let partial = false;
+    let writesSafe = true;
+    for (const item of root.providers) {
+        const record = asRecord(item);
+        if (record === null) {
+            partial = true;
+            writesSafe = false;
+            continue;
+        }
+        raw.push(record);
+        const parsed = readWebProvider(record);
+        if (parsed === null) {
+            partial = true;
+            writesSafe = false;
+            continue;
+        }
+        records.push(parsed.record);
+        partial ||= parsed.partial;
+    }
+    if (new Set(records.map(record => record.id)).size !== records.length)
+        return null;
+    return { records, raw, partial, writesSafe };
+}
+export function parseMagpieWebGroups(value) {
+    const root = asRecord(value);
+    if (root === null || !Array.isArray(root.groups) || root.groups.length > MAX_GROUPS)
+        return null;
+    const raw = [];
+    const groups = [];
+    for (const item of root.groups) {
+        const record = asRecord(item);
+        const parsed = record === null ? null : readWebGroup(record);
+        if (record === null || parsed === null)
+            return null;
+        raw.push(record);
+        groups.push(parsed);
+    }
+    if (new Set(groups.map(group => group.id)).size !== groups.length)
+        return null;
+    return { groups, raw };
+}
+export function parseMagpieWebAccounts(quotaValue, loginUsageValue, providerValue = null) {
+    const quotaRows = quotaValue === null ? null : readWebRows(quotaValue, MAX_ACCOUNTS);
+    const loginRows = loginUsageValue === null ? null : readLoginUsageRecords(loginUsageValue);
+    const providerRows = providerValue === null ? null : readProviderAccountRecords(providerValue);
+    if (quotaRows === null && loginRows === null && providerRows === null)
+        return null;
+    const accounts = new Map();
+    for (const record of [...(providerRows ?? []), ...(loginRows ?? []), ...(quotaRows ?? [])]) {
+        const account = readWebAccount(record);
+        if (account === null)
+            continue;
+        const key = `${account.agent.toLocaleLowerCase()}\u0000${account.user.toLocaleLowerCase()}`;
+        const before = accounts.get(key);
+        accounts.set(key, before === undefined ? account : mergeAccount(before, account));
+        if (accounts.size > MAX_ACCOUNTS)
+            return null;
+    }
+    return [...accounts.values()];
+}
+export function readProviderUpdate(value) {
+    const record = asRecord(value);
+    if (record === null || typeof record.id !== 'string' || !PROVIDER_ID.test(record.id))
+        throw new TypeError('Invalid Magpie provider update');
+    assertAllowedKeys(record, ['id', 'newId', 'name', 'endpointField', 'endpointUrl', 'models', 'on']);
+    const newId = record.newId === undefined || record.newId === record.id ? undefined : readProviderId(record.newId);
+    const name = optionalUpdateText(record.name, 80, 'provider name');
+    const endpointField = record.endpointField;
+    const endpointUrl = optionalUpdateUrl(record.endpointUrl);
+    const on = optionalUpdateBoolean(record.on, 'provider availability');
+    if (endpointField !== undefined && (typeof endpointField !== 'string' || !ENDPOINT_FIELD_SET.has(endpointField))) {
+        throw new TypeError('Invalid Magpie endpoint field');
+    }
+    const canonicalEndpointUrl = endpointField === 'anthropic' && endpointUrl?.endsWith('/v1') === true
+        ? endpointUrl.slice(0, -3)
+        : endpointUrl;
+    if ((endpointField === undefined) !== (canonicalEndpointUrl === undefined))
+        throw new TypeError('Endpoint field and URL must be updated together');
+    const models = record.models === undefined ? undefined : readModelList(record.models, record.id, false);
+    if (newId === undefined && name === undefined && endpointUrl === undefined && models === undefined && on === undefined)
+        throw new TypeError('Provider update has no changes');
+    return {
+        id: record.id,
+        ...(newId === undefined ? {} : { newId }),
+        ...(name === undefined ? {} : { name }),
+        ...(endpointField === undefined || canonicalEndpointUrl === undefined ? {} : { endpointField: endpointField, endpointUrl: canonicalEndpointUrl }),
+        ...(models === undefined ? {} : { models }),
+        ...(on === undefined ? {} : { on }),
+    };
+}
+/**
+ * Read the ID a provider is renamed to, in the spelling Magpie itself writes it: lower-case
+ * letters, digits and single dashes, its `provider.Slug`. Magpie answers any other spelling by
+ * refusing the save, and it refuses some IDs even when they are spelled that way.
+ */
+function readProviderId(value) {
+    const text = typeof value === 'string' ? value.trim().toLocaleLowerCase() : '';
+    if (text === '' || text.length > 64 || text !== magpieProviderId(text))
+        throw new TypeError('Invalid Magpie provider ID');
+    if (RESERVED_PROVIDER_IDS.has(text))
+        throw new TypeError('Magpie reserves this provider ID');
+    return text;
+}
+/** The IDs a provider answers to: Magpie's `was`, the ones it had before a rename. */
+function magpieProviderAliasIds(rawProviders, providerId) {
+    const aliases = readStringList(rawProviders.find(item => item.id === providerId)?.was, 100);
+    return (aliases ?? []).map(alias => alias.toLocaleLowerCase());
+}
+export function readGroupUpdate(value) {
+    const record = asRecord(value);
+    if (record === null || typeof record.id !== 'string' || !GROUP_ID.test(record.id))
+        throw new TypeError('Invalid Magpie routing-group update');
+    assertAllowedKeys(record, ['id', 'name', 'models', 'routing', 'stays', 'pick', 'unlists', 'fast', 'context', 'levels', 'effort', 'classifier']);
+    const name = optionalUpdateText(record.name, 120, 'group name');
+    const models = record.models === undefined ? undefined : readModelList(record.models, null, true);
+    const routing = optionalEnum(record.routing, ROUTING_POLICIES, 'routing policy');
+    const stays = optionalEnum(record.stays, STICKINESS_POLICIES, 'stickiness policy');
+    const pick = optionalMemberId(record.pick, 'manual routing pick');
+    const unlists = optionalUpdateBoolean(record.unlists, 'group listing');
+    const fast = record.fast === undefined ? undefined : readMemberList(record.fast);
+    const context = record.context === undefined ? undefined : readGroupContext(record.context);
+    if (record.context !== undefined && context === null)
+        throw new TypeError('Invalid group context window');
+    const levels = record.levels === undefined ? undefined : readGroupLevels(record.levels);
+    if (record.levels !== undefined && levels === null)
+        throw new TypeError('Invalid group reasoning levels');
+    const effort = optionalEnum(record.effort, GROUP_EFFORTS, 'group effort policy');
+    const classifier = record.classifier === undefined ? undefined : optionalClassifier(record.classifier);
+    if (record.pick !== undefined && routing !== undefined && routing !== 'manual') {
+        throw new TypeError('Only a manual routing group sends to a picked model');
+    }
+    if ([name, models, routing, stays, pick, unlists, fast, context, levels, effort, classifier].every(item => item === undefined)) {
+        throw new TypeError('Routing-group update has no changes');
+    }
+    return {
+        id: record.id,
+        ...(name === undefined ? {} : { name }),
+        ...(models === undefined ? {} : { models }),
+        ...(routing === undefined ? {} : { routing }),
+        ...(stays === undefined ? {} : { stays }),
+        ...(pick === undefined ? {} : { pick }),
+        ...(unlists === undefined ? {} : { unlists }),
+        ...(fast === undefined ? {} : { fast }),
+        ...(context === undefined || context === null ? {} : { context }),
+        ...(levels === undefined || levels === null ? {} : { levels }),
+        ...(effort === undefined ? {} : { effort }),
+        ...(classifier === undefined ? {} : { classifier }),
+    };
+}
+export function readAccountUpdate(value) {
+    const record = asRecord(value);
+    if (record === null)
+        throw new TypeError('Invalid Magpie account update');
+    assertAllowedKeys(record, ['agent', 'user', 'on']);
+    const agent = safeText(record.agent, 64);
+    const user = safeText(record.user, 180);
+    if (agent === null || !ACCOUNT_AGENT.test(agent) || user === null || typeof record.on !== 'boolean') {
+        throw new TypeError('Invalid Magpie account update');
+    }
+    return { agent, user, on: record.on };
+}
+function readWebProvider(record) {
+    const id = safeText(record.id, 64);
+    if (id === null || !PROVIDER_ID.test(id))
+        return null;
+    let partial = false;
+    const name = safeText(record.name, 180) ?? id;
+    if (record.name !== name)
+        partial = true;
+    // The icon is display-only, so an unusable value leaves the row without one rather than
+    // downgrading a provider whose settings were all read exactly.
+    const icon = optionalQuotaIcon(record.icon);
+    const endpoints = [];
+    for (const field of ENDPOINT_FIELDS) {
+        const value = record[field];
+        if (typeof value !== 'string' || value.trim() === '')
+            continue;
+        const url = safeEndpoint(value);
+        if (url === null) {
+            partial = true;
+            continue;
+        }
+        endpoints.push({ field, url, editable: isPlainEndpoint(value) });
+    }
+    const chosen = readStringList(record.chosen, 2_000);
+    let modelsEditable = Array.isArray(record.models) && record.models.length <= 10_000;
+    if (record.models !== undefined && !Array.isArray(record.models)) {
+        modelsEditable = false;
+        partial = true;
+    }
+    if (Array.isArray(record.models) && record.models.length > 10_000) {
+        modelsEditable = false;
+        partial = true;
+    }
+    if (record.models === undefined)
+        partial = true;
+    if (record.chosen !== undefined && chosen === null) {
+        modelsEditable = false;
+        partial = true;
+    }
+    const chosenSet = chosen === null ? null : new Set(chosen);
+    const rawModels = Array.isArray(record.models) && record.models.length <= 10_000 ? record.models : [];
+    const models = [];
+    for (const value of rawModels) {
+        const model = asRecord(value);
+        const localId = safeText(model?.id, 300);
+        if (model === null || localId === null || !MODEL_ID.test(localId)) {
+            modelsEditable = false;
+            partial = true;
+            continue;
+        }
+        const fullId = localId.startsWith(`${id}/`) ? localId : `${id}/${localId}`;
+        const exposed = chosenSet === null
+            ? model.given === true || model.on === true
+            : chosenSet.has(localId) || chosenSet.has(fullId);
+        models.push({ id: fullId, name: optionalSafeText(model.name, 200), exposed });
+    }
+    const status = typeof record.off === 'boolean' ? record.off ? 'off' : 'on' : 'unknown';
+    const key = asRecord(record.key);
+    const parsedFallback = readStringList(record.fallback, 100);
+    if (record.fallback !== undefined && parsedFallback === null)
+        partial = true;
+    const accountRecord = asRecord(record.account);
+    const rawAccountAgent = accountRecord?.agent ?? accountRecord?.Agent;
+    const accountAgentText = safeText(rawAccountAgent, 64);
+    const accountAgent = accountAgentText !== null && ACCOUNT_AGENT.test(accountAgentText) ? accountAgentText : null;
+    if (rawAccountAgent !== undefined && rawAccountAgent !== null && accountAgent === null)
+        partial = true;
+    const normalized = {
+        id,
+        idEditable: isMagpieProviderId(id),
+        name,
+        ...icon,
+        accountAgent,
+        preset: optionalSafeText(record.preset, 100),
+        protocol: endpoints[0]?.field ?? null,
+        host: safeHost(optionalSafeText(record.host, 300)),
+        website: safeWebUrl(record.website),
+        state: status,
+        account: optionalSafeText(record.account, 180)
+            ?? optionalSafeText(accountRecord?.name ?? accountRecord?.Name, 180)
+            ?? accountAgent,
+        keyMasked: optionalSafeText(key?.masked, 80),
+        endpoints,
+        models,
+        modelsEditable,
+        modelCount: Array.isArray(record.models) && record.models.length <= 10_000 ? optionalInteger(rawModels.length) : null,
+        exposedModelCount: optionalInteger(record.exposed) ?? optionalInteger(chosen?.length ?? null),
+        fallback: parsedFallback ?? [],
+        routing: optionalSafeText(record.routing, 64),
+        affinity: optionalSafeText(record.affinity, 64),
+        maxConcurrency: optionalNumber(record.maxConcurrency),
+    };
+    return { record: normalized, partial };
+}
+function readWebGroup(record) {
+    const rawId = safeText(record.id, 128);
+    const id = rawId === null ? null : normalizeGroupId(rawId);
+    const name = safeText(record.name, 120);
+    if (id === null || !GROUP_ID.test(id) || name === null)
+        return null;
+    const membersValue = record.members === undefined ? [] : record.members;
+    if (!Array.isArray(membersValue) || membersValue.length > 2_000)
+        return null;
+    const memberInfo = Array.isArray(record.memberInfo) && record.memberInfo.length <= 2_000
+        ? record.memberInfo.flatMap(value => {
+            const item = asRecord(value);
+            const itemId = safeText(item?.id ?? item?.of, 512);
+            return item === null || itemId === null ? [] : [[itemId, item]];
+        })
+        : [];
+    const infoById = new Map(memberInfo);
+    const members = [];
+    for (const value of membersValue) {
+        const memberId = safeText(value, 512);
+        if (memberId === null || !(MODEL_ID.test(memberId) || memberId.startsWith('group/')))
+            return null;
+        const info = infoById.get(memberId);
+        members.push({
+            id: memberId,
+            provider: optionalSafeText(info?.provider, 64) ?? providerFromModelId(memberId),
+            name: optionalSafeText(info?.name, 180),
+            model: optionalSafeText(info?.model, 300) ?? modelFromMemberId(memberId),
+            on: readBooleanOrCount(info?.on),
+            ready: optionalBoolean(info?.ready),
+            byPattern: false,
+            ...(typeof info?.canFast === 'boolean' ? { canFast: info.canFast } : {}),
+        });
+    }
+    const patterns = readGroupPatterns(record.match, record.patterns);
+    if (patterns === null)
+        return null;
+    const usedBy = readStringList(record.usedBy ?? record.agents, 500);
+    if (record.usedBy !== undefined || record.agents !== undefined) {
+        if (usedBy === null)
+            return null;
+    }
+    // The member a manual group sends to, and the members sent in their vendor's fast mode.
+    // Both use the same member-id spelling `members` uses, so the editor can compare them.
+    const rawPick = optionalSafeText(record.pick, 512);
+    const pick = rawPick === null ? null : normalizeMemberId(rawPick);
+    if (rawPick !== null && pick === null)
+        return null;
+    const fast = record.fast === undefined ? [] : readStringList(record.fast, 2_000);
+    if (fast === null)
+        return null;
+    if (fast.some(value => normalizeMemberId(value) === null))
+        return null;
+    // The window Agents are told the group takes, and the levels it offers. Magpie's own editor
+    // reads an absent context as 0 (the largest member's) and an absent levels list as "shared".
+    const context = record.context === undefined ? 0 : readGroupContext(record.context);
+    if (context === null)
+        return null;
+    const levels = readGroupLevels(record.levels);
+    if (levels === null)
+        return null;
+    const sharedLevels = readGroupLevels(record.shared) ?? [];
+    // An empty effort is Magpie's "as the Agent asks", not a missing value: `safeText` would
+    // treat it as absent, so the raw string is checked against the two values it may hold.
+    const rawEffort = record.effort === undefined || record.effort === null ? '' : record.effort;
+    const effort = typeof rawEffort === 'string' && GROUP_EFFORTS.has(rawEffort.trim()) ? rawEffort.trim() : null;
+    if (effort === null)
+        return null;
+    const rawClassifier = optionalSafeText(record.classifier, 512);
+    const classifier = rawClassifier === null ? null : normalizeMemberId(rawClassifier);
+    if (rawClassifier !== null && classifier === null)
+        return null;
+    return {
+        id,
+        name,
+        routing: optionalSafeText(record.routing, 64),
+        stays: optionalSafeText(record.affinity ?? record.stays, 64),
+        members,
+        usedBy: usedBy ?? [],
+        patterns,
+        pick,
+        unlists: optionalBoolean(record.unlists),
+        fast,
+        context,
+        levels,
+        sharedLevels,
+        effort,
+        classifier,
+    };
+}
+/**
+ * Read a group's context window: `0` the largest member's, `-1` the smallest, else that many
+ * tokens. Anything else is a shape this Host cannot write back, so the group stays uneditable.
+ */
+function readGroupContext(value) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < -1)
+        return null;
+    return value;
+}
+/** Read a reasoning-level list; a list holding a level Magpie does not name cannot round-trip. */
+function readGroupLevels(value) {
+    if (value === undefined || value === null)
+        return [];
+    const levels = readStringList(value, MEMBER_LEVELS.length);
+    if (levels === null)
+        return null;
+    if (levels.some(level => !MEMBER_LEVELS.includes(level)))
+        return null;
+    return [...new Set(levels)];
+}
+/** Accept a member id Magpie itself would: a model, a group, or a model at a reasoning level. */
+function normalizeMemberId(value) {
+    if (MODEL_ID.test(value) || value.startsWith('group/'))
+        return value;
+    return null;
+}
+function readWebAccount(record, fallbackAgent) {
+    const agent = safeText(record.agent ?? record.Agent ?? record.provider ?? record.Provider ?? fallbackAgent, 64);
+    const user = safeText(record.user ?? record.User ?? record.email ?? record.account, 180);
+    if (agent === null || !ACCOUNT_AGENT.test(agent) || user === null)
+        return null;
+    const windows = readAccountWindows(record.windows ?? record.Windows);
+    if (windows === null)
+        return null;
+    return {
+        agent,
+        user,
+        alias: optionalSafeText(record.alias, 180),
+        plan: optionalSafeText(record.plan, 120),
+        active: optionalBoolean(record.active ?? record.Active),
+        on: optionalBoolean(record.on ?? record.On),
+        balance: optionalSafeText(record.balance, 180),
+        windows,
+        asOf: optionalSafeText(record.asOf ?? record.as_of, 64),
+        readAt: optionalSafeText(record.readAt ?? record.read_at, 64),
+    };
+}
+function readLoginUsageRecords(value) {
+    if (!Array.isArray(value) && asRecord(value) === null)
+        return null;
+    const rows = [];
+    const visit = (item, inheritedAgent, depth) => {
+        if (depth > 5 || rows.length > MAX_ACCOUNTS)
+            return;
+        if (Array.isArray(item)) {
+            for (const child of item)
+                visit(child, inheritedAgent, depth + 1);
+            return;
+        }
+        const record = asRecord(item);
+        if (record === null)
+            return;
+        if (safeText(record.user ?? record.User ?? record.email ?? record.account, 180) !== null) {
+            rows.push(inheritedAgent === undefined || record.agent !== undefined || record.Agent !== undefined || record.provider !== undefined
+                ? record
+                : { ...record, agent: inheritedAgent });
+            return;
+        }
+        for (const [key, child] of Object.entries(record)) {
+            const agent = ACCOUNT_AGENT.test(key) ? key : inheritedAgent;
+            if (LOGIN_CONTAINER_FIELDS.has(key) || asRecord(child) !== null || Array.isArray(child))
+                visit(child, agent, depth + 1);
+        }
+    };
+    visit(value, undefined, 0);
+    return rows.length > MAX_ACCOUNTS ? null : rows;
+}
+function readProviderAccountRecords(value) {
+    const root = asRecord(value);
+    if (root === null || !Array.isArray(root.providers) || root.providers.length > MAX_PROVIDERS)
+        return null;
+    const rows = [];
+    for (const value of root.providers) {
+        const provider = asRecord(value);
+        const providerId = safeText(provider?.id, 64);
+        if (provider === null || providerId === null)
+            continue;
+        const account = asRecord(provider.account);
+        if (account === null || account.logins === undefined || account.logins === null)
+            continue;
+        const agent = safeText(account.agent ?? account.Agent, 64) ?? providerId;
+        if (!ACCOUNT_AGENT.test(agent))
+            continue;
+        const logins = readLoginUsageRecords({ [agent]: account.logins });
+        if (logins === null)
+            return null;
+        for (const login of logins) {
+            rows.push(login);
+            if (rows.length > MAX_ACCOUNTS)
+                return null;
+        }
+    }
+    return rows;
+}
+function readWebRows(value, limit) {
+    const root = asRecord(value);
+    const rows = Array.isArray(value) ? value : Array.isArray(root?.data) ? root.data : null;
+    if (rows === null || rows.length > limit)
+        return null;
+    const records = rows.map(asRecord);
+    return records.some(record => record === null) ? null : records;
+}
+function readAccountWindows(value) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value) || value.length > 100)
+        return null;
+    const windows = [];
+    for (const item of value) {
+        const record = asRecord(item);
+        const name = safeText(record?.name ?? record?.Name, 100);
+        if (record === null || name === null)
+            return null;
+        windows.push({
+            name,
+            used: optionalNumber(record.used ?? record.Used),
+            remaining: optionalNumber(record.remaining ?? record.Remaining),
+            resetsAt: optionalSafeText(record.resetsAt ?? record.resets_at, 64),
+            display: optionalSafeText(record.display, 120),
+        });
+    }
+    return windows;
+}
+function mergeAccount(left, right) {
+    return {
+        agent: left.agent,
+        user: left.user,
+        alias: right.alias ?? left.alias,
+        plan: right.plan ?? left.plan,
+        active: right.active ?? left.active,
+        on: right.on ?? left.on,
+        balance: right.balance ?? left.balance,
+        windows: right.windows.length > 0 ? right.windows : left.windows,
+        asOf: right.asOf ?? left.asOf,
+        readAt: right.readAt ?? left.readAt,
+    };
+}
+function providerHasConfigChange(update, current) {
+    return update.name !== undefined && update.name !== current.name
+        || update.endpointField !== undefined && update.endpointUrl !== undefined
+            && current.endpoints.find(item => item.field === update.endpointField)?.url !== update.endpointUrl
+        || update.models !== undefined && !sameStringOrder(update.models, current.models.filter(model => model.exposed).map(model => model.id));
+}
+/**
+ * The body of a provider save. A rename goes in as `from`, the ID the provider has now, plus the
+ * new `id`: Magpie saves the other fields under the ID it had and then gives it `id`, carrying
+ * the routing groups and Agent configs that name its models along with it.
+ *
+ * The base URLs go back exactly as Magpie returned them: a save that left one out is read as a
+ * provider without that API and is refused with "a provider needs a base URL".
+ */
+function providerSavePayload(current, update, newId) {
+    const payload = { id: current.id };
+    if (newId !== undefined) {
+        payload.id = newId;
+        payload.from = current.id;
+    }
+    if (update.name !== undefined)
+        payload.name = update.name;
+    for (const endpoint of current.endpoints) {
+        payload[endpoint.field] = endpoint.field === update.endpointField && update.endpointUrl !== undefined ? update.endpointUrl : endpoint.url;
+    }
+    if (update.models !== undefined) {
+        // Magpie appends a pick to the provider it is named under, which for a rename is its new ID.
+        const providerId = newId ?? current.id;
+        payload.models = update.models.map(model => localModelId(providerId, model.startsWith(`${current.id}/`) ? `${providerId}/${model.slice(current.id.length + 1)}` : model));
+    }
+    return payload;
+}
+function groupSavePayload(raw, current, update) {
+    const payload = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (GROUP_VIEW_FIELDS.has(key))
+            continue;
+        const clone = safeJsonClone(value);
+        if (clone !== undefined)
+            payload[key] = clone;
+    }
+    // A save rewrites `members` and `match` whole, so a group whose patterns were never fully
+    // readable must not be saved: the unreadable ones would be dropped without saying so.
+    if (!groupPatternsReadable(raw))
+        throw new TypeError('Magpie routing group patterns cannot be read back safely');
+    const models = update.models ?? editableGroupModels(current);
+    const routing = update.routing ?? current.routing ?? 'smart';
+    // Magpie names a group it found its own way (`group/fast-pool`) and a user's group by its
+    // bare id. Saving under the normalized id would re-key or re-create the group, so the id
+    // goes back exactly as it was read.
+    payload.id = typeof raw.id === 'string' ? raw.id : current.id;
+    payload.name = update.name ?? current.name;
+    payload.members = models.filter(model => !isGroupPattern(model));
+    payload.match = models.filter(isGroupPattern);
+    payload.routing = routing;
+    payload.affinity = update.stays ?? current.stays ?? 'auto';
+    // Every other field a group save writes goes back as it was read: a save that left one out
+    // would reset it to Magpie's default, and a manual group's pick would come back empty.
+    payload.pick = routing === 'manual' ? update.pick ?? current.pick ?? '' : '';
+    payload.unlists = update.unlists ?? current.unlists ?? false;
+    payload.fast = (update.fast ?? current.fast).filter(member => payload.members.includes(member));
+    payload.off = (readStringList(raw.off, 2_000) ?? []).filter(member => payload.members.includes(member));
+    payload.weights = Object.fromEntries(Object.entries(asRecord(raw.weights) ?? {})
+        .filter(([member, weight]) => payload.members.includes(member) && optionalInteger(weight) !== null));
+    // The window Agents are told the group takes, and the levels and per-turn effort it offers.
+    payload.context = update.context ?? current.context;
+    payload.levels = update.levels === undefined ? current.levels : [...update.levels];
+    payload.effort = update.effort ?? current.effort;
+    // Magpie clears the classifier whenever the effort is left to the Agent, and needs one as
+    // soon as a turn's level is picked.
+    payload.classifier = payload.effort === 'auto'
+        ? update.classifier ?? current.classifier ?? ''
+        : update.classifier ?? '';
+    for (const key of ['sink', 'firstToken', 'patience', 'family', 'rules']) {
+        if (raw[key] !== undefined)
+            payload[key] = safeJsonClone(raw[key]);
+    }
+    return payload;
+}
+/**
+ * Fingerprint what a provider save must leave alone: everything but the fields it writes
+ * (`providerSavePayload`) and the two it keeps of its own. A rename is read back as such rather
+ * than as an untouched field, so it is the one ID change this Host accepts.
+ */
+function providerConfigFingerprint(record) {
+    const viewOrMutable = new Set([...PROVIDER_VIEW_FIELDS, ...PROVIDER_MUTABLE_FIELDS, ...PROVIDER_SAVE_KEEPS]);
+    const preserved = Object.fromEntries(Object.entries(record).filter(([key]) => !viewOrMutable.has(key)));
+    const key = asRecord(record.key);
+    const keyList = Array.isArray(record.keyList)
+        ? record.keyList.flatMap(value => {
+            const item = asRecord(value);
+            return item === null ? [] : [{ id: item.id, masked: item.masked, active: item.active, on: item.on }];
+        })
+        : record.keyList;
+    return stableJson({
+        preserved,
+        key: key === null ? null : { set: key.set, masked: key.masked, optional: key.optional },
+        keyList,
+        balanceToken: safeBalanceTokenStatus(record.balanceToken),
+    });
+}
+/**
+ * Fingerprint what a group save must leave alone.
+ *
+ * Every field a save writes is covered by `groupUpdateMatches` instead: a save now writes
+ * `pick`, `unlists`, `fast`, `off`, and `weights` as well, and Magpie itself fills `off` with
+ * the members whose provider is switched off. What is left here is everything this Host has
+ * not verified as safe to write.
+ */
+function groupConfigFingerprint(record) {
+    const savedWithTheRest = new Set([
+        ...GROUP_VIEW_FIELDS, ...GROUP_WRITTEN_FIELDS,
+        // `patterns` is read back into `match`; saving both would contradict itself.
+        'patterns',
+    ]);
+    return stableJson(Object.fromEntries(Object.entries(record).filter(([key]) => !savedWithTheRest.has(key))));
+}
+function providerRecordFingerprint(record) {
+    const parsed = readWebProvider(record);
+    return stableJson({ record: parsed?.record ?? null, protected: providerConfigFingerprint(record) });
+}
+function groupRecordFingerprint(record) {
+    const parsed = readWebGroup(record);
+    return stableJson({ record: parsed, protected: groupConfigFingerprint(record) });
+}
+function otherProvidersUnchanged(before, after, id, previousId = id) {
+    // A rename moves one provider between two IDs: neither is another provider whose change would
+    // be a side effect of this save.
+    const own = new Set([id, previousId]);
+    const beforeOthers = before.filter(item => !own.has(String(item.id)));
+    const afterOthers = after.filter(item => !own.has(String(item.id)));
+    if (beforeOthers.length !== afterOthers.length)
+        return false;
+    const afterById = new Map(afterOthers.map(item => [String(item.id), item]));
+    return beforeOthers.every(item => {
+        const saved = afterById.get(String(item.id));
+        return saved !== undefined && providerRecordFingerprint(item) === providerRecordFingerprint(saved);
+    });
+}
+function otherGroupsUnchanged(before, after, id) {
+    const beforeOthers = before.filter(item => normalizeGroupId(item.id) !== id);
+    const afterOthers = after.filter(item => normalizeGroupId(item.id) !== id);
+    if (beforeOthers.length !== afterOthers.length)
+        return false;
+    const afterById = new Map(afterOthers.map(item => [normalizeGroupId(item.id), item]));
+    return beforeOthers.every(item => {
+        const saved = afterById.get(normalizeGroupId(item.id));
+        return saved !== undefined && groupRecordFingerprint(item) === groupRecordFingerprint(saved);
+    });
+}
+function otherAccountsUnchanged(before, after, agent, user) {
+    const accountKey = (account) => `${account.agent.toLocaleLowerCase()}\u0000${account.user.toLocaleLowerCase()}`;
+    const target = `${agent.toLocaleLowerCase()}\u0000${user.toLocaleLowerCase()}`;
+    const previous = new Map(before.filter(account => accountKey(account) !== target).map(account => [accountKey(account), stableJson(account)]));
+    const current = new Map(after.filter(account => accountKey(account) !== target).map(account => [accountKey(account), stableJson(account)]));
+    return previous.size === current.size && [...previous].every(([key, value]) => current.get(key) === value);
+}
+function providerUpdateMatches(update, saved) {
+    // A rename is read back under the new ID; every other field of the record then stands as it is.
+    if (update.newId !== undefined && saved.id !== update.newId)
+        return false;
+    if (update.name !== undefined && update.name !== saved.name)
+        return false;
+    if (update.on !== undefined && (update.on ? 'on' : 'off') !== saved.state)
+        return false;
+    if (update.endpointField !== undefined && update.endpointUrl !== undefined
+        && saved.endpoints.find(item => item.field === update.endpointField)?.url !== update.endpointUrl)
+        return false;
+    if (update.models !== undefined && !sameRenamedModels(update.models, update.id, update.newId ?? update.id, saved.models.filter(model => model.exposed).map(model => model.id)))
+        return false;
+    return true;
+}
+function providerRecordMatchesUpdate(before, update, saved) {
+    if (saved.name !== (update.name ?? before.name))
+        return false;
+    if (saved.state !== (update.on === undefined ? before.state : update.on ? 'on' : 'off'))
+        return false;
+    const models = update.models ?? before.models.filter(model => model.exposed).map(model => model.id);
+    if (!sameRenamedModels(models, update.id, update.newId ?? update.id, saved.models.filter(model => model.exposed).map(model => model.id)))
+        return false;
+    return ENDPOINT_FIELDS.every(field => {
+        const expected = field === update.endpointField && update.endpointUrl !== undefined
+            ? update.endpointUrl
+            : before.endpoints.find(endpoint => endpoint.field === field)?.url;
+        return expected === saved.endpoints.find(endpoint => endpoint.field === field)?.url;
+    });
+}
+/** Model IDs as a renamed provider now spells them: `<id>/<model>` under the ID it was given. */
+function sameRenamedModels(expected, fromId, toId, saved) {
+    const renamed = expected.map(model => model.startsWith(`${fromId}/`) && fromId !== toId ? `${toId}/${model.slice(fromId.length + 1)}` : model);
+    return sameStringOrder(renamed, saved);
+}
+function groupUpdateMatches(update, saved) {
+    if (update.name !== undefined && update.name !== saved.name)
+        return false;
+    if (update.models !== undefined && !sameStringOrder(update.models, editableGroupModels(saved)))
+        return false;
+    for (const key of ['routing', 'stays']) {
+        if (update[key] !== undefined && update[key] !== saved[key])
+            return false;
+    }
+    if (update.pick !== undefined && update.pick !== saved.pick)
+        return false;
+    if (update.unlists !== undefined && update.unlists !== saved.unlists)
+        return false;
+    if (update.fast !== undefined && !sameStringSet(update.fast, saved.fast))
+        return false;
+    if (update.context !== undefined && update.context !== saved.context)
+        return false;
+    if (update.levels !== undefined && !sameStringSet(update.levels, saved.levels))
+        return false;
+    if (update.effort !== undefined && update.effort !== saved.effort)
+        return false;
+    // Magpie clears the classifier itself when no turn's level is picked, so an emptied one is
+    // compared against the group's own cleared value rather than against what was sent.
+    if (update.classifier !== undefined && update.classifier !== (saved.classifier ?? ''))
+        return false;
+    return true;
+}
+function sameStringSet(left, right) {
+    return left.length === right.length && left.every(item => right.includes(item));
+}
+function editableGroupModels(group) {
+    return [...group.members.filter(member => !member.byPattern).map(member => member.id), ...group.patterns];
+}
+function findAccount(accounts, agent, user) {
+    return accounts.find(account => account.agent.toLocaleLowerCase() === agent.toLocaleLowerCase()
+        && account.user.toLocaleLowerCase() === user.toLocaleLowerCase());
+}
+function readGroupPatterns(matchValue, patternsValue) {
+    if (matchValue !== undefined) {
+        const values = readStringList(matchValue, 500);
+        if (values === null)
+            return null;
+        return validatePatterns(values);
+    }
+    if (patternsValue === undefined)
+        return [];
+    if (!Array.isArray(patternsValue) || patternsValue.length > 500)
+        return null;
+    const patterns = patternsValue.flatMap(value => {
+        if (typeof value === 'string')
+            return [value];
+        const record = asRecord(value);
+        const pattern = safeText(record?.pattern, 300);
+        return pattern === null ? [] : [pattern];
+    });
+    if (patterns.length !== patternsValue.length)
+        return null;
+    return validatePatterns(patterns);
+}
+function validatePatterns(values) {
+    const unique = [];
+    for (const value of values) {
+        if (!isGroupPattern(value))
+            return null;
+        if (!unique.includes(value))
+            unique.push(value);
+    }
+    return unique;
+}
+/**
+ * Whether every pattern Magpie returned for this group is one this Host would write back.
+ *
+ * Patterns live in the saved `match` list and `patterns` (the model rows they match now). A
+ * `null` `members` list, or a pattern spelling outside the allowed set, cannot be round-tripped:
+ * a save built from the readable half would quietly remove the rest.
+ */
+function groupPatternsReadable(raw) {
+    const match = readGroupPatterns(raw.match, raw.patterns);
+    if (match === null)
+        return false;
+    const current = raw.match !== undefined
+        ? readStringList(raw.match, 500)
+        : Array.isArray(raw.patterns)
+            ? raw.patterns.flatMap(item => {
+                const record = asRecord(item);
+                const pattern = safeText(record?.pattern ?? item, 300);
+                return pattern === null ? [] : [pattern];
+            })
+            : [];
+    return current !== null && current.length === match.length;
+}
+function isGroupPattern(value) {
+    return (value.includes('*') || value.startsWith('re:'))
+        && /^[A-Za-z0-9_*./:+|()\[\]{}?^-]+$/u.test(value)
+        && value.includes('/');
+}
+function normalizeGroupId(value) {
+    const id = typeof value === 'string' ? value : '';
+    return id.startsWith('group/') ? id.slice('group/'.length) : id;
+}
+function safeEndpoint(value) {
+    if (value.length > 2_048 || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    try {
+        const url = new URL(value);
+        if ((url.protocol !== 'https:' && url.protocol !== 'http:') || url.hostname === '')
+            return null;
+        url.username = '';
+        url.password = '';
+        url.search = '';
+        url.hash = '';
+        return `${url.origin}${url.pathname.replace(/\/$/u, '')}`;
+    }
+    catch {
+        return null;
+    }
+}
+function safeWebUrl(value) {
+    if (typeof value !== 'string' || value.length > 2_048)
+        return null;
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.origin : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isPlainEndpoint(value) {
+    try {
+        const url = new URL(value);
+        return url.username === '' && url.password === '' && url.search === '' && url.hash === '';
+    }
+    catch {
+        return false;
+    }
+}
+function safeHost(value) {
+    if (value === null || value.length > 300 || /[\u0000-\u001f\u007f]/u.test(value))
+        return null;
+    try {
+        const url = new URL(value.includes('://') ? value : `https://${value}`);
+        return `${url.hostname}${url.port === '' ? '' : `:${url.port}`}`;
+    }
+    catch {
+        return safeText(value, 300);
+    }
+}
+function safeBalanceTokenStatus(value) {
+    const record = asRecord(value);
+    return record === null ? null : { takes: record.takes, set: record.set };
+}
+function readModelList(value, providerId, allowPatterns) {
+    if (!Array.isArray(value) || value.length > 200)
+        throw new TypeError('Model list must be an array of at most 200 items');
+    const models = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || item.length > 300 || /[\u0000-\u0020\u007f,]/u.test(item))
+            throw new TypeError('Invalid Magpie model id');
+        const isPattern = allowPatterns && isGroupPattern(item);
+        if (isPattern) {
+            if (!item.includes('/'))
+                throw new TypeError('Invalid routing-group model pattern');
+        }
+        else if (!MODEL_ID.test(item) || !item.includes('/') || providerId !== null && !item.startsWith(`${providerId}/`)) {
+            throw new TypeError('Magpie model id is outside the allowed provider');
+        }
+        if (!models.includes(item))
+            models.push(item);
+    }
+    if (allowPatterns && models.length === 0)
+        throw new TypeError('Routing groups need at least one model or pattern');
+    return models;
+}
+/**
+ * A group's classifier model. Magpie clears it with an empty string whenever no rule asks for an
+ * intent and the effort is left to the Agent, so an empty value must be writable too.
+ */
+function optionalClassifier(value) {
+    if (value === '')
+        return '';
+    const member = optionalMemberId(value, 'group classifier');
+    if (member === undefined)
+        throw new TypeError('Invalid group classifier');
+    return member;
+}
+/** A group member id as Magpie names it: a model, a group, or a model at a reasoning level. */
+function optionalMemberId(value, label) {
+    if (value === undefined)
+        return undefined;
+    const text = safeText(value, 512);
+    if (text === null || !(MODEL_ID.test(text) || text.startsWith('group/')))
+        throw new TypeError(`Invalid ${label}`);
+    return text;
+}
+function readMemberList(value) {
+    if (!Array.isArray(value) || value.length > 2_000)
+        throw new TypeError('Group member list must be an array of at most 2000 entries');
+    const members = value.map(item => safeText(item, 512));
+    if (members.some(item => item === null || !(MODEL_ID.test(item) || item.startsWith('group/')))) {
+        throw new TypeError('Invalid Magpie group member');
+    }
+    return [...new Set(members)];
+}
+function localModelId(providerId, value) {
+    return value.startsWith(`${providerId}/`) ? value.slice(providerId.length + 1) : value;
+}
+function providerFromModelId(value) {
+    if (value.startsWith('group/'))
+        return null;
+    const separator = value.indexOf('/');
+    return separator <= 0 ? null : value.slice(0, separator);
+}
+function modelFromMemberId(value) {
+    return value.startsWith('group/') ? value.slice('group/'.length) : value.slice(value.indexOf('/') + 1);
+}
+function optionalUpdateText(value, maxLength, label) {
+    if (value === undefined)
+        return undefined;
+    const text = safeText(value, maxLength);
+    if (text === null)
+        throw new TypeError(`Invalid ${label}`);
+    return text;
+}
+function optionalUpdateBoolean(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'boolean')
+        throw new TypeError(`Invalid ${label}`);
+    return value;
+}
+function optionalUpdateUrl(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || value.length > 2_048 || /[\u0000-\u0020\u007f]/u.test(value))
+        throw new TypeError('Invalid provider endpoint URL');
+    const safe = safeEndpoint(value);
+    if (safe === null || safe !== value.replace(/\/$/u, ''))
+        throw new TypeError('Provider endpoint must be an HTTP(S) URL without credentials, query, or fragment');
+    return value.replace(/\/$/u, '');
+}
+function optionalEnum(value, allowed, label) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || !allowed.has(value))
+        throw new TypeError(`Invalid ${label}`);
+    return value;
+}
+function sameStringOrder(left, right) {
+    return left.length === right.length && left.every((item, index) => item === right[index]);
+}
+function assertAllowedKeys(record, allowed) {
+    const permitted = new Set(allowed);
+    if (Object.keys(record).some(key => !permitted.has(key)))
+        throw new TypeError('Magpie management update contains an unsupported field');
+}
+function readStringList(value, limit) {
+    if (!Array.isArray(value) || value.length > limit)
+        return null;
+    const items = value.map(item => safeText(item, 512));
+    return items.some(item => item === null) ? null : items;
+}
+/**
+ * Accept one Magpie icon reference: a built-in icon name or a `file:` asset name.
+ *
+ * `/api/providers` and `/api/usage/quotas` carry the same shape; anything else is ignored so
+ * the value can only ever reach the fixed asset routes in `magpieIconAssetPaths`.
+ */
+function optionalQuotaIcon(value) {
+    const icon = safeText(value, 300);
+    if (icon === null)
+        return {};
+    if (/^file:[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/u.test(icon))
+        return { icon };
+    return /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(icon) ? { icon } : {};
+}
+function magpieIconAssetPaths(icon) {
+    if (/^file:[A-Za-z0-9][A-Za-z0-9._~-]{0,255}$/u.test(icon)) {
+        return [`/api/icons/${encodeURIComponent(icon.slice('file:'.length))}`];
+    }
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(icon))
+        return [];
+    return [`/icons/${icon}.svg`, `/icons/${icon}.png`];
+}
+function safeJsonClone(value, depth = 0) {
+    if (depth > 8)
+        return undefined;
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string')
+        return value.length <= 8_192 ? value : undefined;
+    if (Array.isArray(value)) {
+        if (value.length > 2_000)
+            return undefined;
+        const values = value.map(item => safeJsonClone(item, depth + 1));
+        return values.some(item => item === undefined) ? undefined : values;
+    }
+    const record = asRecord(value);
+    if (record === null || Object.keys(record).length > 200)
+        return undefined;
+    const result = {};
+    for (const [key, item] of Object.entries(record)) {
+        if (key.length > 128)
+            return undefined;
+        const cloned = safeJsonClone(item, depth + 1);
+        if (cloned === undefined)
+            return undefined;
+        result[key] = cloned;
+    }
+    return result;
+}
+function stableJson(value) {
+    const normalize = (item) => {
+        if (Array.isArray(item))
+            return item.map(normalize);
+        const record = asRecord(item);
+        return record === null ? item : Object.fromEntries(Object.keys(record).sort().map(key => [key, normalize(record[key])]));
+    };
+    return JSON.stringify(normalize(value));
+}
+function safeText(value, maxLength) {
+    if (typeof value !== 'string')
+        return null;
+    const text = value.trim();
+    return text !== '' && text.length <= maxLength && !/[\u0000-\u001f\u007f]/u.test(text) ? text : null;
+}
+function optionalSafeText(value, maxLength) {
+    return value === undefined || value === null ? null : safeText(value, maxLength);
+}
+function optionalBoolean(value) {
+    return typeof value === 'boolean' ? value : null;
+}
+function readBooleanOrCount(value) {
+    if (typeof value === 'boolean')
+        return value;
+    return typeof value === 'number' && Number.isFinite(value) ? value > 0 : null;
+}
+function optionalNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+function optionalInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function signalOption(signal) {
+    return signal === undefined ? {} : { signal };
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : null;
+}
+//# sourceMappingURL=magpie-management.js.map