@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/ai/config/ai-config-admin.service.js

@@ -0,0 +1,579 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AiConfigAdminService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiConfigAdminService = exports.AI_CONFIG_REJECTIONS = void 0;
+exports.toPatch = toPatch;
+exports.diffFieldNames = diffFieldNames;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../credentials/index");
+const index_2 = require("../../core/index");
+const index_3 = require("../../settings/index");
+const ai_error_1 = require("../core/ai-error");
+const index_4 = require("../../core/index");
+const provider_registry_1 = require("../core/provider-registry");
+// Registers the five built-in providers (side effect): the admin service reads the registry.
+require("../providers/builtin-ai-providers");
+const ai_credential_constants_1 = require("./ai-credential.constants");
+const ai_provider_definition_1 = require("../providers/ai-provider-definition");
+const ai_config_service_1 = require("./ai-config.service");
+// =============================================================================
+// AiConfigAdminService — read and write the AI configuration (#428, epic #419)
+// =============================================================================
+//
+// Modelled on `StorageConfigAdminService`:
+//
+//     system_settings.global -> `ai` namespace         (non-secret policy)
+//   + credentials(ai, <providerId>)                    (masked, never decrypted)
+//   + AiProviderRegistry                               (what this process can talk to)
+//   -> what `GET /api/admin/ai/config` renders
+//
+// ⚠ NOTHING IN THIS FILE CALLS `CredentialsService.getSecret`. An admin READ
+// has no business decrypting a key; `describe` returns a masked hint. The one
+// place an admin key is ever decrypted for an admin route is the connection
+// test (`AiProviderTestService`), at the moment of use.
+//
+// Audit rows are written directly through Prisma — there is no audit service in
+// this codebase — with `targetType` `ai_config` and codes / field NAMES only in
+// `meta`, never a key and never a value that could hold one
+// (docs/specs/ai-platform.md §2.21).
+// =============================================================================
+/** Stable reason codes for the 400s this service raises (in `details.reason`). */
+exports.AI_CONFIG_REJECTIONS = {
+    UNKNOWN_PROVIDER: 'AI_UNKNOWN_PROVIDER',
+    PROVIDER_NOT_REGISTERED: 'AI_PROVIDER_NOT_REGISTERED',
+    KEY_REQUIRED: 'AI_KEY_REQUIRED',
+    /** A provider-specific field (#448) sent for a provider whose slot has no such field. */
+    FIELD_UNSUPPORTED: 'AI_PROVIDER_FIELD_UNSUPPORTED',
+    /** A provider's settings failed its own slot schema (#448: an http Azure endpoint, credentials in a URL, ...). */
+    SETTINGS_INVALID: 'AI_PROVIDER_SETTINGS_INVALID',
+    /** Enabling a provider that cannot work without an endpoint (#448) before one is set. */
+    BASE_URL_REQUIRED: 'AI_BASE_URL_REQUIRED',
+};
+/**
+ * Exported for the reference app's wiring and tests (route discovery, contract
+ * and egress suites); not part of the slice's documented surface.
+ *
+ * @internal
+ */
+let AiConfigAdminService = AiConfigAdminService_1 = class AiConfigAdminService {
+    prisma;
+    systemSettings;
+    credentials;
+    registry;
+    aiConfig;
+    logger = new common_1.Logger(AiConfigAdminService_1.name);
+    constructor(prisma, systemSettings, credentials, registry, aiConfig) {
+        this.prisma = prisma;
+        this.systemSettings = systemSettings;
+        this.credentials = credentials;
+        this.registry = registry;
+        this.aiConfig = aiConfig;
+    }
+    /**
+     * Everything `GET /api/admin/ai/config` renders.
+     *
+     * Reads the policy FRESH (an admin looking at the page must never be shown a
+     * value up to five seconds stale) and does not create the settings row as a
+     * side effect — `getAiPolicy` and `readRow` are both read-only.
+     */
+    async describeForAdmin() {
+        const [policy, row] = await Promise.all([
+            this.aiConfig.resolve({ fresh: true }),
+            this.readRow(),
+        ]);
+        const ids = this.knownProviderIds(policy);
+        const keyInfos = await Promise.all(ids.map((id) => this.credentials.describe(ai_credential_constants_1.AI_CREDENTIAL_PURPOSE, (0, ai_credential_constants_1.aiCredentialName)(id))));
+        return {
+            enabled: policy.enabled,
+            keyPolicy: policy.keyPolicy,
+            logPromptContent: policy.logPromptContent,
+            defaults: {
+                maxOutputTokensCap: policy.defaults.maxOutputTokensCap ?? null,
+                allowBackgroundRuns: policy.defaults.allowBackgroundRuns,
+                allowRealtime: policy.defaults.allowRealtime,
+            },
+            usageRetentionDays: policy.usageRetentionDays,
+            hostedTools: { ...policy.hostedTools, mcpAllowedHosts: [...policy.hostedTools.mcpAllowedHosts] },
+            limits: structuredClone(policy.limits),
+            deploymentKeyServesOrgs: policy.deploymentKeyServesOrgs,
+            providers: ids.map((id, index) => this.describeProvider(id, policy, keyInfos[index])),
+            descriptors: ids.flatMap((id, index) => ((0, ai_provider_definition_1.getAiProviderDefinition)(id) ? [(0, ai_provider_definition_1.describeAiProvider)(id, keyInfos[index] !== null)] : [])),
+            version: row?.version ?? 0,
+            updatedAt: row?.updatedAt.toISOString() ?? null,
+            updatedBy: row?.updatedByUser ?? null,
+        };
+    }
+    /**
+     * `PUT /api/admin/ai/config` — full replace of the `ai` namespace.
+     *
+     * Order, each step load-bearing (the same order
+     * `StorageConfigAdminService.replace` follows):
+     *   1. read the row; `If-Match` is refused BEFORE anything is written;
+     *   2. validate the providers and the key policy against the registry and
+     *      the credential store — every refusal here is a 400 that wrote nothing;
+     *   3. `patchSettings`, passing `expectedVersion` again so the write itself
+     *      re-checks it;
+     *   4. ⚠ `invalidateCache()` SYNCHRONOUSLY, before the audit row, so this
+     *      instance answers "is AI on?" from the new value immediately;
+     *   5. the audit row, with changed field NAMES only.
+     *
+     * FULL REPLACE OF THE OPTIONAL FIELDS TOO: an empty/absent `baseUrl` or
+     * `maxOutputTokensCap` in the body CLEARS a stored one. `patchSettings`
+     * keeps a field it is not sent, so a cleared field is sent as an explicit
+     * `null`, which its merge treats as "remove" (see `toPatch`).
+     */
+    async replace(input, userId, expectedVersion) {
+        const row = await this.readRow();
+        const currentVersion = row?.version ?? 0;
+        if (expectedVersion !== undefined && currentVersion !== expectedVersion) {
+            throw new common_1.ConflictException(`AI settings version mismatch. Expected ${expectedVersion}, found ${currentVersion}`);
+        }
+        const current = await this.systemSettings.getAiPolicy();
+        const next = this.buildNext(current, input);
+        await this.assertKeysForFallback(next);
+        await this.systemSettings.patchSettings({ ai: toPatch(next) }, userId, expectedVersion);
+        // Step 4 — see the method comment. Nothing awaits between the write and this.
+        this.aiConfig.invalidateCache();
+        const changedFields = diffFieldNames(current, next);
+        await this.audit(userId, 'ai_config:replace', 'ai', { changedFields });
+        this.logger.log(`AI configuration replaced by user ${userId} ` +
+            `(enabled=${next.enabled} keyPolicy=${next.keyPolicy} ` +
+            `changed=${changedFields.join(',') || '(none)'})`);
+        return this.describeForAdmin();
+    }
+    /**
+     * `PUT /api/admin/ai/providers/:provider/key` — verify, then store.
+     *
+     * VERIFY FIRST. A key the provider rejects is a `400 AI_KEY_INVALID` and
+     * nothing is written: storing an unverified key would let a typo silently
+     * replace a working one. A provider that cannot be reached answers with its
+     * own `AiError` (e.g. `503 AI_PROVIDER_UNAVAILABLE`) — also storing nothing.
+     */
+    async setKey(provider, apiKey, userId) {
+        const adapter = this.requireRegistered(provider);
+        const policy = await this.aiConfig.resolve({ fresh: true });
+        await this.verifyKey(adapter, apiKey, (0, ai_config_service_1.providerPolicy)(policy, provider));
+        await this.credentials.setSecret(ai_credential_constants_1.AI_CREDENTIAL_PURPOSE, (0, ai_credential_constants_1.aiCredentialName)(provider), apiKey, {
+            label: (0, ai_credential_constants_1.aiCredentialLabel)(adapter.displayName),
+            updatedByUserId: userId,
+        });
+        await this.audit(userId, 'ai_config:set_key', provider, { provider });
+        this.logger.log(`AI provider key for "${provider}" set by user ${userId}`);
+        return this.describeForAdmin();
+    }
+    /**
+     * Verifies `apiKey` for `provider` with the adapter's own test call, exactly
+     * as {@link setKey} does before it stores anything (#739: the organization
+     * key route reuses it). Writes nothing.
+     *
+     * @throws NotFoundException for a provider with no registered adapter.
+     * @throws AiError `AI_KEY_INVALID` (400) for a rejected key, or the
+     *   provider's own error when it cannot be reached.
+     */
+    async verifyProviderKey(provider, apiKey) {
+        const adapter = this.requireRegistered(provider);
+        const policy = await this.aiConfig.resolve({ fresh: true });
+        await this.verifyKey(adapter, apiKey, (0, ai_config_service_1.providerPolicy)(policy, provider));
+    }
+    /**
+     * `DELETE /api/admin/ai/providers/:provider/key`. Idempotent — removing a
+     * key that is not there is not an error. Under `byok_with_org_fallback` the
+     * response carries `ORG_FALLBACK_WITHOUT_KEY`: the policy still promises a
+     * fallback that no longer exists for this provider.
+     */
+    async deleteKey(provider, userId) {
+        const policy = await this.aiConfig.resolve({ fresh: true });
+        if (!this.knownProviderIds(policy).includes(provider)) {
+            throw this.unknownProvider(provider);
+        }
+        await this.credentials.deleteSecret(ai_credential_constants_1.AI_CREDENTIAL_PURPOSE, (0, ai_credential_constants_1.aiCredentialName)(provider));
+        await this.audit(userId, 'ai_config:delete_key', provider, { provider });
+        this.logger.log(`AI provider key for "${provider}" removed by user ${userId}`);
+        const view = await this.describeForAdmin();
+        return {
+            ...view,
+            warnings: view.keyPolicy === 'byok_with_org_fallback' ? ['ORG_FALLBACK_WITHOUT_KEY'] : [],
+        };
+    }
+    /**
+     * Whether calls to `provider` need a key (#448) — false only for an
+     * OpenAI-compatible server the administrator marked `requiresKey: false`.
+     * Read fresh: it gates an admin action.
+     */
+    async providerRequiresKey(provider) {
+        return (0, ai_config_service_1.providerRequiresKey)((0, ai_config_service_1.providerPolicy)(await this.aiConfig.resolve({ fresh: true }), provider), provider);
+    }
+    /** The adapter for `provider`, or a 404 naming it. */
+    requireRegistered(provider) {
+        const adapter = this.registry.get(provider);
+        if (!adapter) {
+            throw this.unknownProvider(provider);
+        }
+        return adapter;
+    }
+    /**
+     * Registered adapters first (registration order: the built-ins, then an
+     * app's own), then providers with a definition whose adapter is not loaded,
+     * then any other settings slot.
+     */
+    knownProviderIds(policy) {
+        return [
+            ...new Set([...this.registry.ids(), ...(0, ai_provider_definition_1.aiProviderDefinitions)().map((def) => def.id), ...Object.keys(policy.providers)]),
+        ];
+    }
+    // ---------------------------------------------------------------------------
+    describeProvider(id, policy, keyInfo) {
+        const adapter = this.registry.get(id);
+        const definition = (0, ai_provider_definition_1.getAiProviderDefinition)(id);
+        const slot = (0, ai_config_service_1.providerPolicy)(policy, id);
+        const { enabled: _enabled, ...settings } = slot ?? { enabled: false };
+        return {
+            id,
+            displayName: adapter?.displayName ?? definition?.label ?? id,
+            registered: adapter !== undefined,
+            // #921: an adapter registered without a provider definition has no
+            // settings slot, so the `ai` namespace cannot store its settings and it
+            // cannot be enabled. Reported only when false, so a provider that has a
+            // slot keeps the exact response it always had.
+            ...(slot === undefined ? { configurable: false } : {}),
+            enabled: slot?.enabled ?? false,
+            baseUrl: slot?.baseUrl ?? null,
+            settingsFields: (0, ai_config_service_1.providerSettingsFields)(id),
+            settings: structuredClone(settings),
+            requiresBaseUrl: definition?.requiresBaseUrl === true,
+            ...(definition?.help ? { help: { ...definition.help } } : {}),
+            apiVersion: slot?.apiVersion ?? null,
+            apiStyle: slot?.apiStyle ?? null,
+            deployments: slot?.deployments ? { ...slot.deployments } : null,
+            requiresKey: slot?.requiresKey ?? null,
+            keyStatus: {
+                configured: keyInfo !== null,
+                hint: keyInfo?.hint ?? null,
+                updatedAt: keyInfo?.updatedAt.toISOString() ?? null,
+                updatedByUserId: keyInfo?.updatedByUserId ?? null,
+            },
+            supportedCapabilities: this.registry.capabilities(id),
+        };
+    }
+    /**
+     * The namespace to write. A provider the body leaves out keeps its stored
+     * slot; a provider id nobody registered is a 400, as is ENABLING a
+     * provider no adapter is registered for (it could never serve a call).
+     *
+     * The one tolerated slotless id (#921) is a REGISTERED adapter without a
+     * provider definition (an app registered it straight into
+     * `AiProviderRegistry`) submitted exactly as `describeForAdmin` describes
+     * it: switched off, no settings. The admin form sends every listed provider
+     * back, so refusing that would fail every save. It is ignored, never
+     * stored; anything else for it, and any id the registry does not know
+     * either, stays a 400.
+     */
+    buildNext(current, input) {
+        for (const [id, submitted] of Object.entries(input.providers)) {
+            if ((0, ai_provider_definition_1.getAiProviderDefinition)(id) !== undefined)
+                continue;
+            if (!this.registry.get(id)) {
+                throw this.unknownProvider(id, common_1.BadRequestException);
+            }
+            if (!isSlotlessDefault(submitted)) {
+                throw new common_1.BadRequestException({
+                    message: `AI provider "${id}" is registered but cannot be configured: it has no provider definition (registerAiProvider).`,
+                    details: { reason: exports.AI_CONFIG_REJECTIONS.UNKNOWN_PROVIDER, provider: id },
+                });
+            }
+        }
+        const providers = {};
+        for (const id of new Set([...(0, ai_provider_definition_1.aiProviderDefinitions)().map((def) => def.id), ...Object.keys(current.providers)])) {
+            const submitted = input.providers[id];
+            if (!submitted) {
+                const stored = (0, ai_config_service_1.providerPolicy)(current, id) ?? ((0, ai_provider_definition_1.getAiProviderDefinition)(id) ? (0, ai_provider_definition_1.defaultAiProviderSlot)(id) : undefined);
+                if (stored)
+                    providers[id] = stored;
+                continue;
+            }
+            if (submitted.enabled && !this.registry.get(id)) {
+                throw new common_1.BadRequestException({
+                    message: `AI provider "${id}" cannot be enabled: no adapter for it is available in this deployment.`,
+                    details: { reason: exports.AI_CONFIG_REJECTIONS.PROVIDER_NOT_REGISTERED, provider: id },
+                });
+            }
+            providers[id] = this.buildSlot(id, submitted);
+        }
+        const maxOutputTokensCap = input.defaults.maxOutputTokensCap ?? undefined;
+        return {
+            enabled: input.enabled,
+            keyPolicy: input.keyPolicy,
+            logPromptContent: input.logPromptContent,
+            defaults: {
+                ...(maxOutputTokensCap !== undefined ? { maxOutputTokensCap } : {}),
+                allowBackgroundRuns: input.defaults.allowBackgroundRuns,
+                // Optional in the body (#449): omitted keeps the stored value.
+                allowRealtime: input.defaults.allowRealtime ?? current.defaults.allowRealtime,
+            },
+            providers: providers,
+            // Optional in the body (#443): a client written before the field
+            // existed keeps the stored retention rather than failing validation.
+            usageRetentionDays: input.usageRetentionDays ?? current.usageRetentionDays,
+            // Optional in the body too (#442), for the same reason. The host list is
+            // de-duplicated; the DTO already trimmed and lower-cased every entry.
+            hostedTools: input.hostedTools
+                ? { ...input.hostedTools, mcpAllowedHosts: [...new Set(input.hostedTools.mcpAllowedHosts)] }
+                : { ...current.hostedTools, mcpAllowedHosts: [...current.hostedTools.mcpAllowedHosts] },
+            // Optional in the body too (#450). When sent it replaces the stored
+            // limits WHOLESALE — leaving a field out is how a limit is lifted.
+            limits: structuredClone(input.limits ?? current.limits),
+            // #739. Optional in the body: omitted keeps the stored value.
+            deploymentKeyServesOrgs: input.deploymentKeyServesOrgs ?? current.deploymentKeyServesOrgs,
+        };
+    }
+    /**
+     * One provider's next slot from its submitted settings (#448). Every field
+     * the body leaves empty is ABSENT (the provider default) — full replace, as
+     * for `baseUrl` before it. A value for a field this provider's definition
+     * does not declare is a 400 rather than silently dropped, and the built slot
+     * must pass the provider's own `settingsSchema` (an `https`-only Azure
+     * endpoint, no credentials in a URL): the admin form is the one place such a
+     * mistake can be caught before it breaks every call.
+     */
+    buildSlot(id, submitted) {
+        const definition = (0, ai_provider_definition_1.requireAiProviderDefinition)(id);
+        const allowed = new Set((0, ai_config_service_1.providerSettingsFields)(id));
+        const slot = { enabled: submitted.enabled };
+        for (const [field, raw] of Object.entries(submitted)) {
+            if (field === 'enabled' || isEmptySettingsValue(raw))
+                continue;
+            if (!allowed.has(field)) {
+                throw new common_1.BadRequestException({
+                    message: `AI provider "${id}" has no "${field}" setting.`,
+                    details: { reason: exports.AI_CONFIG_REJECTIONS.FIELD_UNSUPPORTED, provider: id, field },
+                });
+            }
+            slot[field] = structuredClone(raw);
+        }
+        let parsed;
+        try {
+            parsed = ai_provider_definition_1.aiProviderKind.parseSettings(id, slot);
+        }
+        catch (error) {
+            if (!(error instanceof index_4.PluggableSettingsError))
+                throw error;
+            throw new common_1.BadRequestException({
+                message: `The settings for AI provider "${id}" are not valid: ${error.issues
+                    .map((issue) => `${issue.path.join('.') || id}: ${issue.message}`)
+                    .join('; ')}.`,
+                details: {
+                    reason: exports.AI_CONFIG_REJECTIONS.SETTINGS_INVALID,
+                    provider: id,
+                    fields: [...new Set(error.issues.map((issue) => String(issue.path[0] ?? '')))].filter(Boolean),
+                },
+            });
+        }
+        if (submitted.enabled && definition.requiresBaseUrl === true && !parsed.baseUrl) {
+            throw new common_1.BadRequestException({
+                message: `AI provider "${id}" needs a base URL before it can be enabled.`,
+                details: { reason: exports.AI_CONFIG_REJECTIONS.BASE_URL_REQUIRED, provider: id },
+            });
+        }
+        return parsed;
+    }
+    /**
+     * `byok_with_org_fallback` promises users without a key that the org key
+     * will serve them, so every provider that would be LIVE under the new
+     * policy must actually have one.
+     *
+     * Only enforced while `next.enabled` is true: the kill switch must always be
+     * reachable, so a deployment whose key went missing can still be turned OFF
+     * (or have the offending provider disabled) without first fixing the key.
+     */
+    async assertKeysForFallback(next) {
+        if (next.keyPolicy !== 'byok_with_org_fallback' || !next.enabled) {
+            return;
+        }
+        for (const id of Object.keys(next.providers)) {
+            const slot = (0, ai_config_service_1.providerPolicy)(next, id);
+            // A keyless provider (#448) is served with no key at all: it needs no fallback.
+            if (!slot?.enabled || !(0, ai_config_service_1.providerRequiresKey)(slot, id))
+                continue;
+            const info = await this.credentials.describe(ai_credential_constants_1.AI_CREDENTIAL_PURPOSE, (0, ai_credential_constants_1.aiCredentialName)(id));
+            if (!info) {
+                throw new common_1.BadRequestException({
+                    message: `The "byok_with_org_fallback" key policy needs an admin key for every enabled ` +
+                        `provider, and "${id}" has none. Save a key for it first, or disable it.`,
+                    details: { reason: exports.AI_CONFIG_REJECTIONS.KEY_REQUIRED, provider: id },
+                });
+            }
+        }
+    }
+    async verifyKey(adapter, apiKey, slot) {
+        let verification;
+        try {
+            verification = await adapter.verifyKey({
+                apiKey,
+                ...(0, ai_config_service_1.providerCallSettings)(slot),
+                requestId: (0, node_crypto_1.randomUUID)(),
+            });
+        }
+        catch (error) {
+            // `wrap` uses a generic message — an SDK's own text may echo the request.
+            throw ai_error_1.AiError.wrap(error);
+        }
+        if (verification.ok)
+            return;
+        const code = verification.code && (0, ai_error_1.isAiErrorCode)(verification.code) ? verification.code : 'AI_KEY_INVALID';
+        throw new ai_error_1.AiError(code, code === 'AI_KEY_INVALID'
+            ? `The ${adapter.displayName} API rejected this key. Nothing was saved.`
+            : `The ${adapter.displayName} key could not be verified. Nothing was saved.`, { details: { provider: adapter.id } });
+    }
+    /** The `global` settings row's provenance, WITHOUT creating it. See `StorageConfigAdminService.readRow`. */
+    async readRow() {
+        return (await this.prisma.systemSettings.findUnique({
+            where: { key: 'global' },
+            select: {
+                version: true,
+                updatedAt: true,
+                updatedByUser: { select: { id: true, email: true } },
+            },
+        }));
+    }
+    unknownProvider(provider, Exception = common_1.NotFoundException) {
+        return new Exception({
+            message: `Unknown AI provider "${provider}".`,
+            details: { reason: exports.AI_CONFIG_REJECTIONS.UNKNOWN_PROVIDER, provider },
+        });
+    }
+    /** Audit row with codes / names only. `targetId` is `'ai'` or a provider id. */
+    async audit(userId, action, targetId, meta) {
+        await this.prisma.auditEvent.create({
+            data: {
+                actorUserId: userId,
+                action,
+                targetType: 'ai_config',
+                targetId,
+                meta: meta,
+            },
+        });
+    }
+};
+exports.AiConfigAdminService = AiConfigAdminService;
+exports.AiConfigAdminService = AiConfigAdminService = AiConfigAdminService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_2.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [Object, index_3.SystemSettingsService,
+        index_1.CredentialsService,
+        provider_registry_1.AiProviderRegistry,
+        ai_config_service_1.AiConfigService])
+], AiConfigAdminService);
+/** A submitted provider setting that means "the provider default": absent, null, empty, or an empty map. */
+function isEmptySettingsValue(raw) {
+    return (raw === undefined ||
+        raw === null ||
+        raw === '' ||
+        (typeof raw === 'object' && !Array.isArray(raw) && Object.keys(raw).length === 0));
+}
+/**
+ * Whether a submitted provider entry equals what `describeForAdmin` reports
+ * for a provider without a settings slot (#921): not enabled, every setting at
+ * the provider default.
+ */
+function isSlotlessDefault(submitted) {
+    return (!submitted.enabled &&
+        Object.entries(submitted).every(([field, raw]) => field === 'enabled' || isEmptySettingsValue(raw)));
+}
+/**
+ * `next` as a settings PATCH body: every optional field this namespace can
+ * hold is sent explicitly, as `null` when absent, so the PATCH merge REMOVES
+ * a stored value rather than keeping it. That is what makes the admin PUT a
+ * full replace of the optional fields as well as the required ones.
+ */
+function toPatch(next) {
+    return {
+        ...next,
+        // Every settings field the provider's slot HAS is sent, `null` when
+        // absent (#448), so a cleared `apiVersion`/`deployments`/... is removed.
+        providers: Object.fromEntries(Object.entries(next.providers).map(([id, slot]) => {
+            const policy = slot;
+            return [
+                id,
+                {
+                    enabled: policy.enabled,
+                    ...Object.fromEntries((0, ai_config_service_1.providerSettingsFields)(id).map((field) => [field, policy[field] ?? null])),
+                },
+            ];
+        })),
+        defaults: {
+            allowBackgroundRuns: next.defaults.allowBackgroundRuns,
+            allowRealtime: next.defaults.allowRealtime,
+            maxOutputTokensCap: next.defaults.maxOutputTokensCap ?? null,
+        },
+    };
+}
+/**
+ * The dotted NAMES of the fields that differ between two policies — never the
+ * values, so an audit row cannot carry anything a future field might hold.
+ */
+function diffFieldNames(before, after) {
+    const flat = (value) => {
+        const out = {
+            enabled: value.enabled,
+            keyPolicy: value.keyPolicy,
+            logPromptContent: value.logPromptContent,
+            'defaults.maxOutputTokensCap': value.defaults.maxOutputTokensCap,
+            'defaults.allowBackgroundRuns': value.defaults.allowBackgroundRuns,
+            'defaults.allowRealtime': value.defaults.allowRealtime,
+            usageRetentionDays: value.usageRetentionDays,
+            'hostedTools.web_search': value.hostedTools.web_search,
+            'hostedTools.file_search': value.hostedTools.file_search,
+            'hostedTools.code_interpreter': value.hostedTools.code_interpreter,
+            'hostedTools.image_generation': value.hostedTools.image_generation,
+            'hostedTools.mcp': value.hostedTools.mcp,
+            // Compared as one value: the audit row names the list, never its hosts.
+            'hostedTools.mcpAllowedHosts': value.hostedTools.mcpAllowedHosts.join('\n'),
+            'limits.perUser.requestsPerMinute': value.limits.perUser?.requestsPerMinute,
+            'limits.perUser.requestsPerDay': value.limits.perUser?.requestsPerDay,
+            'limits.orgKey.requestsPerDayPerUser': value.limits.orgKey?.requestsPerDayPerUser,
+            'limits.orgKey.tokensPerDayPerUser': value.limits.orgKey?.tokensPerDayPerUser,
+            'limits.perOrg.requestsPerDay': value.limits.perOrg?.requestsPerDay,
+            'limits.perOrg.outputTokensPerDay': value.limits.perOrg?.outputTokensPerDay,
+            deploymentKeyServesOrgs: value.deploymentKeyServesOrgs,
+            // Compared as one value, like the host list: the audit row names the map.
+            'limits.perModel': stableJson(value.limits.perModel ?? {}),
+        };
+        for (const [id, slot] of Object.entries(value.providers)) {
+            const policy = slot;
+            out[`providers.${id}.enabled`] = policy.enabled;
+            for (const field of (0, ai_config_service_1.providerSettingsFields)(id)) {
+                // Compared as one value, like the host list: the audit row names the map.
+                out[`providers.${id}.${field}`] = field === 'deployments' ? stableJson(policy.deployments ?? {}) : policy[field];
+            }
+        }
+        return out;
+    };
+    const a = flat(before);
+    const b = flat(after);
+    return [...new Set([...Object.keys(a), ...Object.keys(b)])].filter((key) => a[key] !== b[key]);
+}
+/** A JSON rendering independent of key order, for comparing two values. */
+function stableJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'undefined';
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableJson(v)}`).join(',')}}`;
+}
+//# sourceMappingURL=ai-config-admin.service.js.map

package/dist/ai/config/ai-config-admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-config-admin.service.js","sourceRoot":"","sources":["../../../src/ai/config/ai-config-admin.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAwmBA,0BAwBC;AAMD,wCA8CC;AAprBD,6CAAyC;AAEzC,2CAOwB;AAIxB,mDAAkF;AAElF,4CAAmD;AACnD,gDAA6D;AAC7D,+CAA0D;AAE1D,4CAA0D;AAC1D,iEAA+D;AAC/D,6FAA6F;AAC7F,6CAA2C;AAC3C,uEAImC;AACnC,gFAO6C;AAC7C,2DAO6B;AAQ7B,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,2CAA2C;AAC3C,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,uFAAuF;AACvF,+CAA+C;AAC/C,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,wDAAwD;AACxD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,4DAA4D;AAC5D,qCAAqC;AACrC,gFAAgF;AAEhF,kFAAkF;AACrE,QAAA,oBAAoB,GAAG;IAClC,gBAAgB,EAAE,qBAAqB;IACvC,uBAAuB,EAAE,4BAA4B;IACrD,YAAY,EAAE,iBAAiB;IAC/B,yFAAyF;IACzF,iBAAiB,EAAE,+BAA+B;IAClD,kHAAkH;IAClH,gBAAgB,EAAE,8BAA8B;IAChD,yFAAyF;IACzF,iBAAiB,EAAE,sBAAsB;CACjC,CAAC;AAQX;;;;;GAKG;AAEI,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAIa;IACzB;IACA;IACA;IACA;IAPF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAC4C,MAAgB,EACzC,cAAqC,EACrC,WAA+B,EAC/B,QAA4B,EAC5B,QAAyB;QAJA,WAAM,GAAN,MAAM,CAAU;QACzC,mBAAc,GAAd,cAAc,CAAuB;QACrC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,aAAQ,GAAR,QAAQ,CAAiB;IACzC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,+CAAqB,EAAE,IAAA,0CAAgB,EAAC,EAAE,CAAC,CAAC,CAAC,CACxF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,QAAQ,EAAE;gBACR,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,IAAI,IAAI;gBAC9D,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB;gBACxD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa;aAC7C;YACD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE;YAChG,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;YACtC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;YACvD,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACrF,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,gDAAuB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,2CAAkB,EAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,CAAC;YAC1B,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI;YAC/C,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,IAAI;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,OAAO,CACX,KAA0B,EAC1B,MAAc,EACd,eAAwB;QAExB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,cAAc,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;QAEzC,IAAI,eAAe,KAAK,SAAS,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;YACxE,MAAM,IAAI,0BAAiB,CACzB,0CAA0C,eAAe,WAAW,cAAc,EAAE,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QAExF,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAEhC,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEpD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qCAAqC,MAAM,GAAG;YAC5C,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,SAAS,GAAG;YACvD,WAAW,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,GAAG,CACpD,CAAC;QAEF,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,MAAc,EAAE,MAAc;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAA,kCAAc,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAExE,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,+CAAqB,EAAE,IAAA,0CAAgB,EAAC,QAAQ,CAAC,EAAE,MAAM,EAAE;YAC1F,KAAK,EAAE,IAAA,2CAAiB,EAAC,OAAO,CAAC,WAAW,CAAC;YAC7C,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,QAAQ,iBAAiB,MAAM,EAAE,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,MAAc;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAA,kCAAc,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,MAAc;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,+CAAqB,EAAE,IAAA,0CAAgB,EAAC,QAAQ,CAAC,CAAC,CAAC;QAEvF,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,QAAQ,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAE/E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3C,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EACN,IAAI,CAAC,SAAS,KAAK,wBAAwB,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE;SAClF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB;QACxC,OAAO,IAAA,uCAAmB,EAAC,IAAA,kCAAc,EAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/G,CAAC;IAED,sDAAsD;IACtD,iBAAiB,CAAC,QAAgB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,MAAqB;QACpC,OAAO;YACL,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,IAAA,8CAAqB,GAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;SACxH,CAAC;IACJ,CAAC;IAED,8EAA8E;IAEtE,gBAAgB,CACtB,EAAU,EACV,MAAqB,EACrB,OAA8B;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,IAAA,gDAAuB,EAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAA,kCAAc,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAEtE,OAAO;YACL,EAAE;YACF,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,UAAU,EAAE,KAAK,IAAI,EAAE;YAC5D,UAAU,EAAE,OAAO,KAAK,SAAS;YACjC,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,+CAA+C;YAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK;YAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;YAC9B,cAAc,EAAE,IAAA,0CAAsB,EAAC,EAAE,CAAC;YAC1C,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAA4B;YAC9D,eAAe,EAAE,UAAU,EAAE,eAAe,KAAK,IAAI;YACrD,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,IAAI;YACpC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;YAChC,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;YAC/D,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,IAAI;YACtC,SAAS,EAAE;gBACT,UAAU,EAAE,OAAO,KAAK,IAAI;gBAC5B,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;gBAC3B,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI;gBACnD,eAAe,EAAE,OAAO,EAAE,eAAe,IAAI,IAAI;aAClD;YACD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,SAAS,CAAC,OAAsB,EAAE,KAA0B;QAClE,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,IAAI,IAAA,gDAAuB,EAAC,EAAE,CAAC,KAAK,SAAS;gBAAE,SAAS;YAExD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,4BAAmB,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,OAAO,EAAE,gBAAgB,EAAE,+FAA+F;oBAC1H,OAAO,EAAE,EAAE,MAAM,EAAE,4BAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAqC,EAAE,CAAC;QAEvD,KAAK,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,IAAA,8CAAqB,GAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/G,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAEtC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,IAAA,kCAAc,EAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAA,gDAAuB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAA,8CAAqB,EAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpH,IAAI,MAAM;oBAAE,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;gBACnC,SAAS;YACX,CAAC;YAED,IAAI,SAAS,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,OAAO,EAAE,gBAAgB,EAAE,yEAAyE;oBACpG,OAAO,EAAE,EAAE,MAAM,EAAE,4BAAoB,CAAC,uBAAuB,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAChF,CAAC,CAAC;YACL,CAAC;YAED,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,kBAAkB,IAAI,SAAS,CAAC;QAE1E,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,QAAQ,EAAE;gBACR,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;gBACvD,+DAA+D;gBAC/D,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa;aAC9E;YACD,SAAS,EAAE,SAAuC;YAClD,iEAAiE;YACjE,qEAAqE;YACrE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC5B,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,EAAE;gBAC5F,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE;YACzF,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;YACvD,8DAA8D;YAC9D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,OAAO,CAAC,uBAAuB;SAC1F,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,SAAS,CAAC,EAAU,EAAE,SAAmD;QAC/E,MAAM,UAAU,GAAG,IAAA,oDAA2B,EAAC,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,IAAA,0CAAsB,EAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,IAAI,GAA4B,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QAErE,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,KAAK,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC;gBAAE,SAAS;YAE/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,OAAO,EAAE,gBAAgB,EAAE,aAAa,KAAK,YAAY;oBACzD,OAAO,EAAE,EAAE,MAAM,EAAE,4BAAoB,CAAC,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE;iBACjF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,MAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,GAAG,uCAAc,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,8BAAsB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAE5D,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,iCAAiC,EAAE,oBAAoB,KAAK,CAAC,MAAM;qBACzE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;qBACjE,IAAI,CAAC,IAAI,CAAC,GAAG;gBAChB,OAAO,EAAE;oBACP,MAAM,EAAE,4BAAoB,CAAC,gBAAgB;oBAC7C,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;iBAC/F;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,OAAO,IAAI,UAAU,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAChF,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,gBAAgB,EAAE,8CAA8C;gBACzE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAAoB,CAAC,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAqC,CAAC;IAC/C,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,qBAAqB,CAAC,IAAmB;QACrD,IAAI,IAAI,CAAC,SAAS,KAAK,wBAAwB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACjE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAA,kCAAc,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAEtC,gFAAgF;YAChF,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAA,uCAAmB,EAAC,IAAI,EAAE,EAAE,CAAC;gBAAE,SAAS;YAE/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,+CAAqB,EAAE,IAAA,0CAAgB,EAAC,EAAE,CAAC,CAAC,CAAC;YAE1F,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,OAAO,EACL,+EAA+E;wBAC/E,kBAAkB,EAAE,qDAAqD;oBAC3E,OAAO,EAAE,EAAE,MAAM,EAAE,4BAAoB,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,OAA0B,EAC1B,MAAc,EACd,IAAkC;QAElC,IAAI,YAAY,CAAC;QAEjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC;gBACrC,MAAM;gBACN,GAAG,IAAA,wCAAoB,EAAC,IAAI,CAAC;gBAC7B,SAAS,EAAE,IAAA,wBAAU,GAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0EAA0E;YAC1E,MAAM,kBAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,YAAY,CAAC,EAAE;YAAE,OAAO;QAE5B,MAAM,IAAI,GACR,YAAY,CAAC,IAAI,IAAI,IAAA,wBAAa,EAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAE/F,MAAM,IAAI,kBAAO,CACf,IAAI,EACJ,IAAI,KAAK,gBAAgB;YACvB,CAAC,CAAC,OAAO,OAAO,CAAC,WAAW,4CAA4C;YACxE,CAAC,CAAC,OAAO,OAAO,CAAC,WAAW,gDAAgD,EAC9E,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CACtC,CAAC;IACJ,CAAC;IAED,4GAA4G;IACpG,KAAK,CAAC,OAAO;QACnB,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;YACxB,MAAM,EAAE;gBACN,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;aACrD;SACF,CAAC,CAA2B,CAAC;IAChC,CAAC;IAEO,eAAe,CACrB,QAAgB,EAChB,YAAmE,0BAAiB;QAEpF,OAAO,IAAI,SAAS,CAAC;YACnB,OAAO,EAAE,wBAAwB,QAAQ,IAAI;YAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,4BAAoB,CAAC,gBAAgB,EAAE,QAAQ,EAAE;SACrE,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,KAAK,CACjB,MAAc,EACd,MAAc,EACd,QAAgB,EAChB,IAA6B;QAE7B,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM;gBACnB,MAAM;gBACN,UAAU,EAAE,WAAW;gBACvB,QAAQ;gBACR,IAAI,EAAE,IAA6B;aACpC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAveY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;6CACS,6BAAqB;QACxB,0BAAkB;QACrB,sCAAkB;QAClB,mCAAe;GARjC,oBAAoB,CAuehC;AAED,4GAA4G;AAC5G,SAAS,oBAAoB,CAAC,GAAY;IACxC,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,GAAG,KAAK,IAAI;QACZ,GAAG,KAAK,EAAE;QACV,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAClF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,SAAmD;IAC5E,OAAO,CACL,CAAC,SAAS,CAAC,OAAO;QAClB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CACpG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,OAAO,CAAC,IAAmB;IACzC,OAAO;QACL,GAAG,IAAI;QACP,oEAAoE;QACpE,yEAAyE;QACzE,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YAChD,MAAM,MAAM,GAAG,IAAwB,CAAC;YAExC,OAAO;gBACL,EAAE;gBACF;oBACE,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAA,0CAAsB,EAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;iBACjG;aACF,CAAC;QACJ,CAAC,CAAC,CAC+D;QACnE,QAAQ,EAAE;YACR,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;YACtD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC1C,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,IAAI,IAAI;SAC7D;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAqB,EAAE,KAAoB;IACxE,MAAM,IAAI,GAAG,CAAC,KAAoB,EAA2B,EAAE;QAC7D,MAAM,GAAG,GAA4B;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,6BAA6B,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;YAChE,8BAA8B,EAAE,KAAK,CAAC,QAAQ,CAAC,mBAAmB;YAClE,wBAAwB,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa;YACtD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,wBAAwB,EAAE,KAAK,CAAC,WAAW,CAAC,UAAU;YACtD,yBAAyB,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW;YACxD,8BAA8B,EAAE,KAAK,CAAC,WAAW,CAAC,gBAAgB;YAClE,8BAA8B,EAAE,KAAK,CAAC,WAAW,CAAC,gBAAgB;YAClE,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG;YACxC,wEAAwE;YACxE,6BAA6B,EAAE,KAAK,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3E,kCAAkC,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB;YAC3E,+BAA+B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc;YACrE,qCAAqC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB;YACjF,mCAAmC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB;YAC7E,8BAA8B,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc;YACnE,kCAAkC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB;YAC3E,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,0EAA0E;YAC1E,iBAAiB,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC3D,CAAC;QAEF,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,IAAwB,CAAC;YAExC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAEhD,KAAK,MAAM,KAAK,IAAI,IAAA,0CAAsB,EAAC,EAAE,CAAC,EAAE,CAAC;gBAC/C,0EAA0E;gBAC1E,GAAG,CAAC,aAAa,EAAE,IAAI,KAAK,EAAE,CAAC,GAAG,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAEtB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;IAC7F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAExE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC3F,CAAC"}

package/dist/ai/config/ai-config.module.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The AI policy module: `AiConfigService`, `AiEnabledGuard`,
+ * `AiOrgEnabledInterceptor` and the admin AI configuration routes. Imported by
+ * `AiModule.forRoot`; a feature module imports the configured `AiModule`.
+ *
+ * @stability experimental
+ */
+export declare class AiConfigModule {
+}
+//# sourceMappingURL=ai-config.module.d.ts.map

package/dist/ai/config/ai-config.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-config.module.d.ts","sourceRoot":"","sources":["../../../src/ai/config/ai-config.module.ts"],"names":[],"mappings":"AA+BA;;;;;;GAMG;AACH,qBAmBa,cAAc;CAAG"}