@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/dist/ai/keys/ai-keys-catalog.listener.js

@@ -0,0 +1,83 @@
+"use strict";
+// =============================================================================
+// Catalog sync -> key recheck (issue #431, epic #419)
+// =============================================================================
+//
+// A user's `reachableModelIds` holds only ids that were in `ai_models` when the
+// key was checked, so a model the catalog discovers LATER is invisible to every
+// existing key until that key is re-checked. This listener subscribes to the
+// catalog's exported hook (`AI_CATALOG_SYNCED_EVENT`) and, when a sync ADDED
+// models, queues `ai.keys.recheck` for the provider; the handler's
+// `staleCutoff` then treats every key checked before the newest discovery as
+// stale.
+//
+// ENQUEUE ONLY, DETACHED, NEVER THROWS. `EventEmitter2` dispatches inside the
+// catalog job's `process()`, so this returns at once; the provider round trips
+// happen on the queue (CLAUDE.md, "Every Long-Running Activity Is a Queue
+// Job", rule 1). A recheck already pending for the provider is reused by the
+// queue's type + subject dedup.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AiKeysCatalogListener_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiKeysCatalogListener = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const index_1 = require("../../jobs/index");
+const ai_catalog_events_1 = require("../catalog/ai-catalog.events");
+const ai_catalog_service_1 = require("../catalog/ai-catalog.service");
+const ai_keys_recheck_task_1 = require("./ai-keys-recheck.task");
+const ai_user_key_constants_1 = require("./ai-user-key.constants");
+let AiKeysCatalogListener = AiKeysCatalogListener_1 = class AiKeysCatalogListener {
+    jobs;
+    logger = new common_1.Logger(AiKeysCatalogListener_1.name);
+    constructor(jobs) {
+        this.jobs = jobs;
+    }
+    handleCatalogSynced(event) {
+        try {
+            if (event.added <= 0)
+                return;
+            const provider = event.providerId;
+            void this.jobs
+                .enqueue({
+                type: ai_user_key_constants_1.AI_KEYS_RECHECK_TYPE,
+                reason: 'backfill',
+                subjectType: ai_catalog_service_1.AI_CATALOG_SUBJECT_TYPE,
+                subjectId: provider,
+                payload: { provider },
+                priority: ai_keys_recheck_task_1.AI_KEYS_RECHECK_PRIORITY,
+            })
+                .then((job) => {
+                this.logger.log(`Catalog sync added ${event.added} model(s) for "${provider}"; queued key recheck ${job.id}`);
+            })
+                .catch((error) => {
+                this.logger.error(`Could not queue the AI key recheck for "${provider}" after a catalog sync: ` +
+                    `${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
+        catch (error) {
+            this.logger.error(`AI catalog listener failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+};
+exports.AiKeysCatalogListener = AiKeysCatalogListener;
+__decorate([
+    (0, event_emitter_1.OnEvent)(ai_catalog_events_1.AI_CATALOG_SYNCED_EVENT),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], AiKeysCatalogListener.prototype, "handleCatalogSynced", null);
+exports.AiKeysCatalogListener = AiKeysCatalogListener = AiKeysCatalogListener_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.JobsService])
+], AiKeysCatalogListener);
+//# sourceMappingURL=ai-keys-catalog.listener.js.map

package/dist/ai/keys/ai-keys-catalog.listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys-catalog.listener.js","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys-catalog.listener.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,sDAAsD;AACtD,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,mEAAmE;AACnE,6EAA6E;AAC7E,SAAS;AACT,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAC7E,gCAAgC;AAChC,gFAAgF;;;;;;;;;;;;;AAEhF,2CAAoD;AACpD,yDAAgD;AAEhD,4CAA+C;AAC/C,oEAAkG;AAClG,sEAAwE;AACxE,iEAAkE;AAClE,mEAA+D;AAGxD,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAGH;IAFZ,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;IAAG,CAAC;IAGlD,mBAAmB,CAAC,KAA2B;QAC7C,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC;gBAAE,OAAO;YAE7B,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC;YAElC,KAAK,IAAI,CAAC,IAAI;iBACX,OAAO,CAAC;gBACP,IAAI,EAAE,4CAAoB;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW,EAAE,4CAAuB;gBACpC,SAAS,EAAE,QAAQ;gBACnB,OAAO,EAAE,EAAE,QAAQ,EAAE;gBACrB,QAAQ,EAAE,+CAAwB;aACnC,CAAC;iBACD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;gBACZ,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,sBAAsB,KAAK,CAAC,KAAK,kBAAkB,QAAQ,yBAAyB,GAAG,CAAC,EAAE,EAAE,CAC7F,CAAC;YACJ,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2CAA2C,QAAQ,0BAA0B;oBAC3E,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAtCY,sDAAqB;AAMhC;IADC,IAAA,uBAAO,EAAC,2CAAuB,CAAC;;;;gEAgChC;gCArCU,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAIwB,mBAAW;GAHnC,qBAAqB,CAsCjC"}

package/dist/ai/keys/ai-keys-recheck.handler.d.ts

@@ -0,0 +1,27 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { Job } from '../../jobs/index';
+import { z } from 'zod';
+import { JobExecutionProfile } from '../../jobs/index';
+import { JobHandler } from '../../jobs/index';
+import { JobHandlerRegistry } from '../../jobs/index';
+import { UserAiKeysService } from './user-ai-keys.service';
+export declare const aiKeysRecheckPayloadSchema: z.ZodObject<{
+    provider: z.ZodString;
+}, z.core.$strip>;
+export type AiKeysRecheckPayload = z.infer<typeof aiKeysRecheckPayloadSchema>;
+export declare class AiKeysRecheckHandler implements JobHandler, OnModuleInit {
+    private readonly registry;
+    private readonly keys;
+    private readonly logger;
+    readonly type = "ai.keys.recheck";
+    readonly label = "AI key recheck";
+    /**
+     * Two bounded provider calls per stale key, 50 keys a page: thirty minutes
+     * covers thousands of keys. Three attempts, like the catalog refresh.
+     */
+    readonly profile: JobExecutionProfile;
+    constructor(registry: JobHandlerRegistry, keys: UserAiKeysService);
+    onModuleInit(): void;
+    process(job: Job): Promise<void>;
+}
+//# sourceMappingURL=ai-keys-recheck.handler.d.ts.map

package/dist/ai/keys/ai-keys-recheck.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys-recheck.handler.d.ts","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys-recheck.handler.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,eAAO,MAAM,0BAA0B;;iBAErC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,qBACa,oBAAqB,YAAW,UAAU,EAAE,YAAY;IAcjE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAdvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,QAAQ,CAAC,IAAI,qBAAwB;IAErC,QAAQ,CAAC,KAAK,oBAAoB;IAElC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAiD;gBAGnE,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,iBAAiB;IAG1C,YAAY,IAAI,IAAI;IAId,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAiCvC"}

package/dist/ai/keys/ai-keys-recheck.handler.js

@@ -0,0 +1,96 @@
+"use strict";
+// =============================================================================
+// `ai.keys.recheck` job handler (issue #431, epic #419)
+// =============================================================================
+//
+// Re-verifies one provider's STALE user keys and refreshes the models each can
+// reach (`UserAiKeysService.recheckStale`). A key is stale when its reachable
+// list is older than a week, or older than the newest model the catalog has
+// discovered for the provider (`staleCutoff`). Payload `{ provider }`,
+// subjectType `'ai_provider'`, subjectId `provider` — enqueued weekly by
+// `AiKeysRecheckTask` and whenever a catalog sync adds models
+// (`AiKeysCatalogListener`).
+//
+// A key the provider now rejects is RECORDED (`lastErrorCode`), never deleted.
+//
+// SERVER-ONLY, PERMANENTLY. No `nodeResultSchema`/`persistNodeResult`: this
+// job decrypts USERS' OWN provider keys, and no AI key may ever reach a worker
+// node (docs/specs/ai-platform.md §2.20).
+//
+// KILL SWITCH. AI or the provider switched off (before or during the sweep) is
+// an expected stop, not a failure: the handler returns normally, so it burns
+// no attempt and fires no `jobs.job_failed`.
+//
+// RATE LIMITS defer the job (`RateLimitError`) instead of charging an attempt;
+// keys already refreshed are no longer stale, so the retry resumes.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AiKeysRecheckHandler_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiKeysRecheckHandler = exports.aiKeysRecheckPayloadSchema = void 0;
+const common_1 = require("@nestjs/common");
+const zod_1 = require("zod");
+const index_1 = require("../../jobs/index");
+const ai_error_1 = require("../core/ai-error");
+const ai_user_key_constants_1 = require("./ai-user-key.constants");
+const user_ai_keys_service_1 = require("./user-ai-keys.service");
+exports.aiKeysRecheckPayloadSchema = zod_1.z.object({
+    provider: zod_1.z.string().min(1).max(64),
+});
+let AiKeysRecheckHandler = AiKeysRecheckHandler_1 = class AiKeysRecheckHandler {
+    registry;
+    keys;
+    logger = new common_1.Logger(AiKeysRecheckHandler_1.name);
+    type = ai_user_key_constants_1.AI_KEYS_RECHECK_TYPE;
+    label = 'AI key recheck';
+    /**
+     * Two bounded provider calls per stale key, 50 keys a page: thirty minutes
+     * covers thousands of keys. Three attempts, like the catalog refresh.
+     */
+    profile = { maxRuntimeMs: 30 * 60_000, maxAttempts: 3 };
+    constructor(registry, keys) {
+        this.registry = registry;
+        this.keys = keys;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async process(job) {
+        const parsed = exports.aiKeysRecheckPayloadSchema.safeParse(job.payload);
+        if (!parsed.success) {
+            throw new Error(`Invalid ${ai_user_key_constants_1.AI_KEYS_RECHECK_TYPE} payload: expected { provider }`);
+        }
+        const { provider } = parsed.data;
+        try {
+            const cutoff = await this.keys.staleCutoff(provider);
+            const counts = await this.keys.recheckStale(provider, cutoff);
+            this.logger.log(`AI key recheck for "${provider}" done: ${counts.ok} ok, ${counts.invalid} rejected, ` +
+                `${counts.failed} failed, ${counts.missing} removed meanwhile (job ${job.id})`);
+        }
+        catch (error) {
+            if (error instanceof ai_error_1.AiError) {
+                if (error.code === 'AI_DISABLED' || error.code === 'AI_PROVIDER_DISABLED') {
+                    this.logger.log(`AI key recheck for "${provider}" stopped: ${error.code}; job ${job.id} is a no-op`);
+                    return;
+                }
+                throw error.toRateLimitError() ?? error;
+            }
+            throw error;
+        }
+    }
+};
+exports.AiKeysRecheckHandler = AiKeysRecheckHandler;
+exports.AiKeysRecheckHandler = AiKeysRecheckHandler = AiKeysRecheckHandler_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.JobHandlerRegistry,
+        user_ai_keys_service_1.UserAiKeysService])
+], AiKeysRecheckHandler);
+//# sourceMappingURL=ai-keys-recheck.handler.js.map

package/dist/ai/keys/ai-keys-recheck.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys-recheck.handler.js","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys-recheck.handler.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,wDAAwD;AACxD,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,8DAA8D;AAC9D,6BAA6B;AAC7B,EAAE;AACF,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,6CAA6C;AAC7C,EAAE;AACF,+EAA+E;AAC/E,oEAAoE;AACpE,gFAAgF;;;;;;;;;;;;;AAEhF,2CAAkE;AAElE,6BAAwB;AAIxB,4CAAsD;AACtD,+CAA2C;AAC3C,mEAA+D;AAC/D,iEAA2D;AAE9C,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACpC,CAAC,CAAC;AAKI,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAcZ;IACA;IAdF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEvD,IAAI,GAAG,4CAAoB,CAAC;IAE5B,KAAK,GAAG,gBAAgB,CAAC;IAElC;;;OAGG;IACM,OAAO,GAAwB,EAAE,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAEtF,YACmB,QAA4B,EAC5B,IAAuB;QADvB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,SAAI,GAAJ,IAAI,CAAmB;IACvC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAQ;QACpB,MAAM,MAAM,GAAG,kCAA0B,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,WAAW,4CAAoB,iCAAiC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAEjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAE9D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,uBAAuB,QAAQ,WAAW,MAAM,CAAC,EAAE,QAAQ,MAAM,CAAC,OAAO,aAAa;gBACpF,GAAG,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,2BAA2B,GAAG,CAAC,EAAE,GAAG,CACjF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kBAAO,EAAE,CAAC;gBAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBAC1E,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,uBAAuB,QAAQ,cAAc,KAAK,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,aAAa,CACpF,CAAC;oBAEF,OAAO;gBACT,CAAC;gBAED,MAAM,KAAK,CAAC,gBAAgB,EAAE,IAAI,KAAK,CAAC;YAC1C,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAvDY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAekB,0BAAkB;QACtB,wCAAiB;GAf/B,oBAAoB,CAuDhC"}

package/dist/ai/keys/ai-keys-recheck.task.d.ts

@@ -0,0 +1,20 @@
+import { JobsService } from '../../jobs/index';
+import type { AiPrisma } from '../data/ai-db';
+import { AiConfigService } from '../config/ai-config.service';
+/** Low priority (ascending is more urgent): background upkeep never outranks user work. */
+export declare const AI_KEYS_RECHECK_PRIORITY = 100;
+export declare class AiKeysRecheckTask {
+    private readonly aiConfig;
+    private readonly prisma;
+    private readonly jobs;
+    private readonly logger;
+    constructor(aiConfig: AiConfigService, prisma: AiPrisma, jobs: JobsService);
+    handleCron(): Promise<void>;
+    /**
+     * Every enabled, registered provider with at least one stored user key; none
+     * at all while the kill switch is off. Deciding per provider is cheap (one
+     * `count`); which KEYS are stale is the handler's question.
+     */
+    dueProviders(): Promise<string[]>;
+}
+//# sourceMappingURL=ai-keys-recheck.task.d.ts.map

package/dist/ai/keys/ai-keys-recheck.task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys-recheck.task.d.ts","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys-recheck.task.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAkB,MAAM,6BAA6B,CAAC;AAG9E,2FAA2F;AAC3F,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,qBACa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACA,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAG1C,QAAQ,EAAE,eAAe,EACA,MAAM,EAAE,QAAQ,EACzC,IAAI,EAAE,WAAW;IAI9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjC;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAmBxC"}

package/dist/ai/keys/ai-keys-recheck.task.js

@@ -0,0 +1,113 @@
+"use strict";
+// =============================================================================
+// Weekly AI key reachability recheck scheduler (issue #431, epic #419)
+// =============================================================================
+//
+// ENQUEUE ONLY (CLAUDE.md, "Every Long-Running Activity Is a Queue Job", rule
+// 1). This cron decides WHETHER a recheck is due — one per enabled provider
+// that has at least one stored user key — and queues `ai.keys.recheck`. Every
+// provider round trip happens in `AiKeysRecheckHandler`, on the queue.
+//
+// NOT `enqueueHousekeepingJob`: that helper dedups by type alone, and this
+// task queues one job PER PROVIDER. `JobsService.enqueue` dedups on type +
+// subject, so a provider whose recheck is still pending is not queued twice.
+//
+// Pinned by `apps/api/test/conformance.spec.ts`.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AiKeysRecheckTask_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiKeysRecheckTask = exports.AI_KEYS_RECHECK_PRIORITY = void 0;
+const common_1 = require("@nestjs/common");
+const schedule_1 = require("@nestjs/schedule");
+const index_1 = require("../../jobs/index");
+const index_2 = require("../../core/index");
+const ai_catalog_service_1 = require("../catalog/ai-catalog.service");
+const ai_config_service_1 = require("../config/ai-config.service");
+const ai_user_key_constants_1 = require("./ai-user-key.constants");
+/** Low priority (ascending is more urgent): background upkeep never outranks user work. */
+exports.AI_KEYS_RECHECK_PRIORITY = 100;
+let AiKeysRecheckTask = AiKeysRecheckTask_1 = class AiKeysRecheckTask {
+    aiConfig;
+    prisma;
+    jobs;
+    logger = new common_1.Logger(AiKeysRecheckTask_1.name);
+    constructor(aiConfig, prisma, jobs) {
+        this.aiConfig = aiConfig;
+        this.prisma = prisma;
+        this.jobs = jobs;
+    }
+    async handleCron() {
+        let providers;
+        try {
+            providers = await this.dueProviders();
+        }
+        catch (error) {
+            this.logger.error(`Could not decide which AI keys are due a recheck: ${errorMessage(error)}`);
+            return;
+        }
+        for (const provider of providers) {
+            try {
+                const job = await this.jobs.enqueue({
+                    type: ai_user_key_constants_1.AI_KEYS_RECHECK_TYPE,
+                    reason: 'backfill',
+                    subjectType: ai_catalog_service_1.AI_CATALOG_SUBJECT_TYPE,
+                    subjectId: provider,
+                    payload: { provider },
+                    priority: exports.AI_KEYS_RECHECK_PRIORITY,
+                });
+                this.logger.log(`Queued AI key recheck ${job.id} for "${provider}"`);
+            }
+            catch (error) {
+                this.logger.error(`Could not queue the AI key recheck for "${provider}": ${errorMessage(error)}`);
+            }
+        }
+    }
+    /**
+     * Every enabled, registered provider with at least one stored user key; none
+     * at all while the kill switch is off. Deciding per provider is cheap (one
+     * `count`); which KEYS are stale is the handler's question.
+     */
+    async dueProviders() {
+        const policy = await this.aiConfig.resolve({ fresh: true });
+        if (!policy.enabled) {
+            return [];
+        }
+        const due = [];
+        for (const provider of Object.keys(policy.providers)) {
+            if (!(0, ai_config_service_1.providerPolicy)(policy, provider)?.enabled)
+                continue;
+            if ((await this.prisma.userAiKey.count({ where: { provider } })) > 0) {
+                due.push(provider);
+            }
+        }
+        return due;
+    }
+};
+exports.AiKeysRecheckTask = AiKeysRecheckTask;
+__decorate([
+    (0, schedule_1.Cron)(schedule_1.CronExpression.EVERY_WEEK),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], AiKeysRecheckTask.prototype, "handleCron", null);
+exports.AiKeysRecheckTask = AiKeysRecheckTask = AiKeysRecheckTask_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(index_2.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [ai_config_service_1.AiConfigService, Object, index_1.JobsService])
+], AiKeysRecheckTask);
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=ai-keys-recheck.task.js.map

package/dist/ai/keys/ai-keys-recheck.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys-recheck.task.js","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys-recheck.task.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,EAAE;AACF,iDAAiD;AACjD,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAA4D;AAC5D,+CAAwD;AAExD,4CAA+C;AAE/C,4CAAmD;AACnD,sEAAwE;AACxE,mEAA8E;AAC9E,mEAA+D;AAE/D,2FAA2F;AAC9E,QAAA,wBAAwB,GAAG,GAAG,CAAC;AAGrC,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAIT;IACyB;IACzB;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,YACmB,QAAyB,EACA,MAAgB,EACzC,IAAiB;QAFjB,aAAQ,GAAR,QAAQ,CAAiB;QACA,WAAM,GAAN,MAAM,CAAU;QACzC,SAAI,GAAJ,IAAI,CAAa;IACjC,CAAC;IAGE,AAAN,KAAK,CAAC,UAAU;QACd,IAAI,SAAmB,CAAC;QAExB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAE9F,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;oBAClC,IAAI,EAAE,4CAAoB;oBAC1B,MAAM,EAAE,UAAU;oBAClB,WAAW,EAAE,4CAAuB;oBACpC,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,EAAE,QAAQ,EAAE;oBACrB,QAAQ,EAAE,gCAAwB;iBACnC,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,EAAE,SAAS,QAAQ,GAAG,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,QAAQ,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,GAAG,GAAa,EAAE,CAAC;QAEzB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,IAAA,kCAAc,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO;gBAAE,SAAS;YAEzD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA/DY,8CAAiB;AAUtB;IADL,IAAA,eAAI,EAAC,yBAAc,CAAC,UAAU,CAAC;;;;mDA4B/B;4BArCU,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;qCADG,mCAAe,UAEnB,mBAAW;GANzB,iBAAiB,CA+D7B;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/ai/keys/ai-keys.module.d.ts

@@ -0,0 +1,3 @@
+export declare class AiKeysModule {
+}
+//# sourceMappingURL=ai-keys.module.d.ts.map

package/dist/ai/keys/ai-keys.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys.module.d.ts","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys.module.ts"],"names":[],"mappings":"AA8BA,qBAgBa,YAAY;CAAG"}

package/dist/ai/keys/ai-keys.module.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiKeysModule = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../credentials/index");
+const ai_config_module_1 = require("../config/ai-config.module");
+const ai_core_module_1 = require("../core/ai-core.module");
+const ai_config_writer_lookup_1 = require("./ai-config-writer.lookup");
+const ai_key_resolver_service_1 = require("./ai-key-resolver.service");
+const ai_keys_catalog_listener_1 = require("./ai-keys-catalog.listener");
+const ai_keys_recheck_handler_1 = require("./ai-keys-recheck.handler");
+const ai_keys_recheck_task_1 = require("./ai-keys-recheck.task");
+const usable_models_service_1 = require("./usable-models.service");
+const org_keys_controller_1 = require("./org-keys.controller");
+const org_key_service_1 = require("./org-key.service");
+const user_ai_keys_controller_1 = require("./user-ai-keys.controller");
+const user_ai_keys_service_1 = require("./user-ai-keys.service");
+// =============================================================================
+// AiKeysModule (issue #431, epic #419)
+// =============================================================================
+//
+// Each user's own (BYOK) provider keys, the key-resolution rule, and the
+// usable-models answer. `UserAiKeysService` is deliberately NOT exported: its
+// `getDecrypted` is plaintext, and the only thing outside this module that may
+// obtain a user's key is `AiKeyResolver`, which applies the policy rule.
+//
+// Also the server-only `ai.keys.recheck` job, its weekly enqueue-only cron,
+// and the listener that queues a recheck when a catalog sync adds models.
+// =============================================================================
+let AiKeysModule = class AiKeysModule {
+};
+exports.AiKeysModule = AiKeysModule;
+exports.AiKeysModule = AiKeysModule = __decorate([
+    (0, common_1.Module)({
+        // `OrgCredentialsModule` (#739): an organization's own keys, the org tier.
+        imports: [ai_core_module_1.AiCoreModule, ai_config_module_1.AiConfigModule, index_1.OrgCredentialsModule],
+        controllers: [user_ai_keys_controller_1.UserAiKeysController, org_keys_controller_1.AiOrgKeysController],
+        providers: [
+            org_key_service_1.AiOrgKeyService,
+            user_ai_keys_service_1.UserAiKeysService,
+            ai_config_writer_lookup_1.AiConfigWriterLookup,
+            ai_key_resolver_service_1.AiKeyResolver,
+            usable_models_service_1.UsableModelsService,
+            ai_keys_recheck_handler_1.AiKeysRecheckHandler,
+            ai_keys_recheck_task_1.AiKeysRecheckTask,
+            ai_keys_catalog_listener_1.AiKeysCatalogListener,
+        ],
+        exports: [ai_key_resolver_service_1.AiKeyResolver, usable_models_service_1.UsableModelsService, org_key_service_1.AiOrgKeyService],
+    })
+], AiKeysModule);
+//# sourceMappingURL=ai-keys.module.js.map

package/dist/ai/keys/ai-keys.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-keys.module.js","sourceRoot":"","sources":["../../../src/ai/keys/ai-keys.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AAExC,mDAA+D;AAE/D,iEAA4D;AAC5D,2DAAsD;AACtD,uEAAiE;AACjE,uEAA0D;AAC1D,yEAAmE;AACnE,uEAAiE;AACjE,iEAA2D;AAC3D,mEAA8D;AAC9D,+DAA4D;AAC5D,uDAAoD;AACpD,uEAAiE;AACjE,iEAA2D;AAE3D,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,gFAAgF;AAkBzE,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAhBxB,IAAA,eAAM,EAAC;QACN,2EAA2E;QAC3E,OAAO,EAAE,CAAC,6BAAY,EAAE,iCAAc,EAAE,4BAAoB,CAAC;QAC7D,WAAW,EAAE,CAAC,8CAAoB,EAAE,yCAAmB,CAAC;QACxD,SAAS,EAAE;YACT,iCAAe;YACf,wCAAiB;YACjB,8CAAoB;YACpB,uCAAa;YACb,2CAAmB;YACnB,8CAAoB;YACpB,wCAAiB;YACjB,gDAAqB;SACtB;QACD,OAAO,EAAE,CAAC,uCAAa,EAAE,2CAAmB,EAAE,iCAAe,CAAC;KAC/D,CAAC;GACW,YAAY,CAAG"}

package/dist/ai/keys/ai-user-key.constants.d.ts

@@ -0,0 +1,15 @@
+/** `encryptSecret`/`decryptSecret` purpose for every `user_ai_keys.secret`. */
+export declare const AI_USER_KEY_PURPOSE = "ai_user_key";
+/** Audit `targetType` for a user's own key lifecycle (`ai_key:set`, `ai_key:delete`). */
+export declare const AI_USER_KEY_AUDIT_TARGET = "user_ai_key";
+/**
+ * The weekly reachability recheck job type. PERMANENT once jobs of it exist.
+ *
+ * @stability experimental
+ */
+export declare const AI_KEYS_RECHECK_TYPE = "ai.keys.recheck";
+/** A key's reachable-model list is re-verified once it is older than this. */
+export declare const AI_KEY_RECHECK_MAX_AGE_MS: number;
+/** Keys read per page by the recheck sweep. */
+export declare const AI_KEY_RECHECK_BATCH_SIZE = 50;
+//# sourceMappingURL=ai-user-key.constants.d.ts.map

package/dist/ai/keys/ai-user-key.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-user-key.constants.d.ts","sourceRoot":"","sources":["../../../src/ai/keys/ai-user-key.constants.ts"],"names":[],"mappings":"AAYA,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,yFAAyF;AACzF,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,QAA0B,CAAC;AAEjE,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,KAAK,CAAC"}

package/dist/ai/keys/ai-user-key.constants.js

@@ -0,0 +1,29 @@
+"use strict";
+// =============================================================================
+// Per-user (BYOK) AI key constants (issue #431, epic #419)
+// =============================================================================
+//
+// ⚠ `AI_USER_KEY_PURPOSE` IS THE AES-GCM SUB-KEY DOMAIN for `user_ai_keys.secret`
+// (`encryptSecret(plaintext, purpose)` derives a per-purpose key). Renaming it
+// makes every stored user key permanently undecryptable — it is not a rename.
+// It is deliberately NOT the admin key's `'ai'` purpose
+// (`config/ai-credential.constants.ts`): the two secret spaces cannot decrypt
+// each other's ciphertext by construction (docs/specs/ai-platform.md §2.1).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_KEY_RECHECK_BATCH_SIZE = exports.AI_KEY_RECHECK_MAX_AGE_MS = exports.AI_KEYS_RECHECK_TYPE = exports.AI_USER_KEY_AUDIT_TARGET = exports.AI_USER_KEY_PURPOSE = void 0;
+/** `encryptSecret`/`decryptSecret` purpose for every `user_ai_keys.secret`. */
+exports.AI_USER_KEY_PURPOSE = 'ai_user_key';
+/** Audit `targetType` for a user's own key lifecycle (`ai_key:set`, `ai_key:delete`). */
+exports.AI_USER_KEY_AUDIT_TARGET = 'user_ai_key';
+/**
+ * The weekly reachability recheck job type. PERMANENT once jobs of it exist.
+ *
+ * @stability experimental
+ */
+exports.AI_KEYS_RECHECK_TYPE = 'ai.keys.recheck';
+/** A key's reachable-model list is re-verified once it is older than this. */
+exports.AI_KEY_RECHECK_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/** Keys read per page by the recheck sweep. */
+exports.AI_KEY_RECHECK_BATCH_SIZE = 50;
+//# sourceMappingURL=ai-user-key.constants.js.map

package/dist/ai/keys/ai-user-key.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-user-key.constants.js","sourceRoot":"","sources":["../../../src/ai/keys/ai-user-key.constants.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2DAA2D;AAC3D,gFAAgF;AAChF,EAAE;AACF,kFAAkF;AAClF,+EAA+E;AAC/E,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;;;AAEhF,+EAA+E;AAClE,QAAA,mBAAmB,GAAG,aAAa,CAAC;AAEjD,yFAAyF;AAC5E,QAAA,wBAAwB,GAAG,aAAa,CAAC;AAEtD;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,8EAA8E;AACjE,QAAA,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjE,+CAA+C;AAClC,QAAA,yBAAyB,GAAG,EAAE,CAAC"}

package/dist/ai/keys/dto/org-ai-key.dto.d.ts

@@ -0,0 +1,18 @@
+declare const SetOrgAiKeyDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    apiKey: import("zod").ZodString;
+}, import("zod/v4/core").$strip>, false>;
+/** `PUT /api/admin/ai/org-keys/:provider` body (#739). Write-only. */
+export declare class SetOrgAiKeyDto extends SetOrgAiKeyDto_base {
+}
+declare const OrgAiKeyViewDto_base: import("nestjs-zod").ZodDto<import("zod").ZodObject<{
+    provider: import("zod").ZodString;
+    displayName: import("zod").ZodString;
+    configured: import("zod").ZodBoolean;
+    hint: import("zod").ZodNullable<import("zod").ZodString>;
+    verifiedAt: import("zod").ZodNullable<import("zod").ZodISODateTime>;
+}, import("zod/v4/core").$strip>, false>;
+/** One provider's organization key, masked (#739). */
+export declare class OrgAiKeyViewDto extends OrgAiKeyViewDto_base {
+}
+export {};
+//# sourceMappingURL=org-ai-key.dto.d.ts.map

package/dist/ai/keys/dto/org-ai-key.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-ai-key.dto.d.ts","sourceRoot":"","sources":["../../../../src/ai/keys/dto/org-ai-key.dto.ts"],"names":[],"mappings":";;;AAGA,sEAAsE;AACtE,qBAAa,cAAe,SAAQ,mBAA+B;CAAG;;;;;;;;AAEtE,sDAAsD;AACtD,qBAAa,eAAgB,SAAQ,oBAAgC;CAAG"}

package/dist/ai/keys/dto/org-ai-key.dto.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgAiKeyViewDto = exports.SetOrgAiKeyDto = void 0;
+const ai_1 = require("@marinoscar/platform-contract/ai");
+const nestjs_zod_1 = require("nestjs-zod");
+/** `PUT /api/admin/ai/org-keys/:provider` body (#739). Write-only. */
+class SetOrgAiKeyDto extends (0, nestjs_zod_1.createZodDto)(ai_1.setOrgAiKeySchema) {
+}
+exports.SetOrgAiKeyDto = SetOrgAiKeyDto;
+/** One provider's organization key, masked (#739). */
+class OrgAiKeyViewDto extends (0, nestjs_zod_1.createZodDto)(ai_1.orgAiKeyViewSchema) {
+}
+exports.OrgAiKeyViewDto = OrgAiKeyViewDto;
+//# sourceMappingURL=org-ai-key.dto.js.map

package/dist/ai/keys/dto/org-ai-key.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-ai-key.dto.js","sourceRoot":"","sources":["../../../../src/ai/keys/dto/org-ai-key.dto.ts"],"names":[],"mappings":";;;AAAA,yDAAyF;AACzF,2CAA0C;AAE1C,sEAAsE;AACtE,MAAa,cAAe,SAAQ,IAAA,yBAAY,EAAC,sBAAiB,CAAC;CAAG;AAAtE,wCAAsE;AAEtE,sDAAsD;AACtD,MAAa,eAAgB,SAAQ,IAAA,yBAAY,EAAC,uBAAkB,CAAC;CAAG;AAAxE,0CAAwE"}

package/dist/ai/keys/dto/usable-ai-model.dto.d.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+export declare const AI_KEY_SOURCES: readonly ["user", "org", "none"];
+/**
+ * Exported for the reference app's wiring and tests (route discovery, contract
+ * and egress suites); not part of the slice's documented surface.
+ *
+ * @internal
+ */
+export declare const usableAiModelSchema: z.ZodObject<{
+    provider: z.ZodString;
+    modelId: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    capabilities: z.ZodObject<{
+        capabilities: z.ZodArray<z.ZodString>;
+        inputModalities: z.ZodArray<z.ZodEnum<import("../../core/capabilities").AiInputModalityEnum>>;
+        outputModalities: z.ZodArray<z.ZodEnum<import("../../core/capabilities").AiOutputModalityEnum>>;
+        reasoningEfforts: z.ZodOptional<z.ZodArray<z.ZodEnum<import("../../core/capabilities").AiReasoningEffortEnum>>>;
+        contextWindow: z.ZodOptional<z.ZodNumber>;
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        voices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    keySource: z.ZodEnum<{
+        org: "org";
+        user: "user";
+        none: "none";
+    }>;
+}, z.core.$strip>;
+declare const UsableAiModelDto_base: import("nestjs-zod").ZodDto<z.ZodObject<{
+    provider: z.ZodString;
+    modelId: z.ZodString;
+    displayName: z.ZodNullable<z.ZodString>;
+    capabilities: z.ZodObject<{
+        capabilities: z.ZodArray<z.ZodString>;
+        inputModalities: z.ZodArray<z.ZodEnum<import("../../core/capabilities").AiInputModalityEnum>>;
+        outputModalities: z.ZodArray<z.ZodEnum<import("../../core/capabilities").AiOutputModalityEnum>>;
+        reasoningEfforts: z.ZodOptional<z.ZodArray<z.ZodEnum<import("../../core/capabilities").AiReasoningEffortEnum>>>;
+        contextWindow: z.ZodOptional<z.ZodNumber>;
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        voices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    keySource: z.ZodEnum<{
+        org: "org";
+        user: "user";
+        none: "none";
+    }>;
+}, z.core.$strip>, false>;
+export declare class UsableAiModelDto extends UsableAiModelDto_base {
+}
+export type UsableAiModel = z.infer<typeof usableAiModelSchema>;
+export {};
+//# sourceMappingURL=usable-ai-model.dto.d.ts.map

package/dist/ai/keys/dto/usable-ai-model.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usable-ai-model.dto.d.ts","sourceRoot":"","sources":["../../../../src/ai/keys/dto/usable-ai-model.dto.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,eAAO,MAAM,cAAc,kCAAmC,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;iBAc9B,CAAC;;;;;;;;;;;;;;;;;;;;AAEH,qBAAa,gBAAiB,SAAQ,qBAAiC;CAAG;AAC1E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}