@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.2

package/dist/configured-providers.js

@@ -0,0 +1,85 @@
+/**
+ * The set of providers a user holds credentials for, cached per user for the
+ * chat agent's toolbelt (`find_model`, media generation).
+ *
+ * Building it costs one credential resolution per registered provider, so a
+ * cache is worth having — but a cache that never expires is worse than none:
+ * a provider connected after the first chat turn stays invisible until the
+ * process restarts, which on a dev machine is every file save and on the
+ * production server is never. That is how a Codex sign-in could complete and
+ * leave the agent with no Codex.
+ *
+ * So an entry is good for {@link DEFAULT_TTL_MS} and no longer, and
+ * {@link clearProviderCache} from `@nodetool-ai/runtime` drops it immediately —
+ * credential writes call that, so a sign-in takes effect on the next turn
+ * rather than a minute later.
+ *
+ * The TTL is not belt-and-braces on top of that signal. A cached provider is
+ * built around the bearer it was handed, and the Codex bearer is a
+ * short-lived OAuth access token: the credential row is refreshed in place
+ * with no write this process sees, so only expiry rebuilds the instance.
+ */
+import { getProviderCacheVersion } from "@nodetool-ai/runtime";
+import { createLogger } from "@nodetool-ai/config";
+const log = createLogger("nodetool.websocket.configured-providers");
+/** How long a built provider set is reused. Bounds a stale OAuth bearer. */
+export const DEFAULT_TTL_MS = 60_000;
+/**
+ * Build the provider set for one user: every registered provider the user
+ * holds credentials for, keyed by id.
+ *
+ * A provider whose construction throws is absent from the result rather than
+ * fatal — one broken credential must not cost the caller every other provider.
+ */
+export async function loadConfiguredProviders(userId) {
+    const providersMod = await import("@nodetool-ai/runtime");
+    const { getSecret } = await import("@nodetool-ai/models");
+    const getSecretFor = (key) => getSecret(key, userId).then((v) => v ?? undefined);
+    const providers = {};
+    await Promise.all(providersMod.listRegisteredProviderIds().map(async (id) => {
+        try {
+            if (await providersMod.isProviderConfigured(id, getSecretFor)) {
+                providers[id] = await providersMod.getProvider(id, getSecretFor);
+            }
+        }
+        catch (err) {
+            log.debug("Skipping provider without usable credentials", {
+                provider: id,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }));
+    return providers;
+}
+export class ConfiguredProviderCache {
+    entries = new Map();
+    load;
+    ttlMs;
+    now;
+    version;
+    constructor(options) {
+        this.load = options.load ?? loadConfiguredProviders;
+        this.ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+        this.now = options.now ?? Date.now;
+        this.version = options.version ?? getProviderCacheVersion;
+    }
+    async get(userId) {
+        const cached = this.entries.get(userId);
+        if (cached && this.isFresh(cached)) {
+            return cached.providers;
+        }
+        const providers = await this.load(userId);
+        this.entries.set(userId, {
+            providers,
+            version: this.version(),
+            builtAt: this.now()
+        });
+        return providers;
+    }
+    isFresh(entry) {
+        if (entry.version !== this.version())
+            return false;
+        return this.now() - entry.builtAt < this.ttlMs;
+    }
+}
+//# sourceMappingURL=configured-providers.js.map

package/dist/configured-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configured-providers.js","sourceRoot":"","sources":["../src/configured-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,GAAG,GAAG,YAAY,CAAC,yCAAyC,CAAC,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAWrC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc;IAEd,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CACnC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,OAAO,CAAC,GAAG,CACf,YAAY,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,IAAI,MAAM,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9D,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,8CAA8C,EAAE;gBACxD,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,MAAM,OAAO,uBAAuB;IACjB,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IACxC,IAAI,CAA2C;IAC/C,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,OAAO,CAAe;IAEvC,YAAY,OAAuC;QACjD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,uBAAuB,CAAC;QACpD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YACvB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;SACpB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,OAAO,CAAC,KAAiB;QAC/B,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;CACF"}

package/dist/cors.d.ts

@@ -0,0 +1,22 @@
+/** Reset cached config — for tests that mutate `NODETOOL_ALLOWED_ORIGINS`. */
+export declare function resetCorsConfig(): void;
+/**
+ * Whether a request `Origin` is permitted. A missing origin (non-browser
+ * clients, same-origin navigations) is allowed — there is no browser
+ * enforcing CORS in that case, so nothing to gate.
+ */
+export declare function isOriginAllowed(origin: string | undefined | null): boolean;
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request `Origin`.
+ * Returns the origin to reflect when it is allowed, or `null` to omit the
+ * header entirely (a disallowed origin gets no ACAO, so the browser blocks
+ * the cross-origin read).
+ */
+export declare function resolveAllowedOrigin(origin: string | undefined | null): string | null;
+/**
+ * `@fastify/cors` origin delegate. Permits allow-listed origins (the plugin
+ * reflects them) and rejects everything else, replacing the previous
+ * `origin: true` (reflect-any) configuration.
+ */
+export declare function corsOriginDelegate(origin: string | undefined, cb: (err: Error | null, allow: boolean) => void): void;
+//# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AA4DA,8EAA8E;AAC9E,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAM1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GAC9C,IAAI,CAEN"}

package/dist/cors.js

@@ -0,0 +1,91 @@
+/**
+ * CORS origin allow-listing.
+ *
+ * Cross-origin requests are restricted to a configured set of origins
+ * instead of reflecting whatever `Origin` the caller sends. Reflecting any
+ * origin (`origin: true`) or hardcoding `Access-Control-Allow-Origin: *`
+ * turns the server into a CSRF / data-exfiltration surface once requests
+ * carry credentials, so the allow-list is the single source of truth for
+ * both the global `fastifyCors` plugin and the hand-rolled CORS headers on
+ * the storage and MCP endpoints.
+ *
+ * Defaults cover the known web dev server and the server's own origin
+ * (localhost / 127.0.0.1 / [::1] on any port), the Electron renderer
+ * (`file://`), and the first-party NodeTool product domains
+ * (`https://nodetool.ai` and its subdomains, e.g. `app.nodetool.ai`).
+ * Additional origins are granted via the `NODETOOL_ALLOWED_ORIGINS` env var
+ * (comma-separated). Set it to `*` to restore allow-all behaviour for trusted
+ * deployments fronted by their own gateway.
+ */
+import { getEnv } from "@nodetool-ai/config";
+/**
+ * Origins always permitted: localhost/127.0.0.1/[::1] (any port), Electron
+ * file://, and the first-party `nodetool.ai` product domains over HTTPS.
+ */
+const DEFAULT_ALLOWED_ORIGIN_PATTERNS = [
+    /^https?:\/\/localhost(?::\d+)?$/,
+    /^https?:\/\/127\.0\.0\.1(?::\d+)?$/,
+    /^https?:\/\/\[::1\](?::\d+)?$/,
+    // Electron renderer requests that carry a literal `file://` origin. (A
+    // `file://` document that sends `Origin: null` is handled by the
+    // missing-origin branch in isOriginAllowed, not this pattern.)
+    /^file:\/\//,
+    // First-party NodeTool product: https://nodetool.ai and any subdomain
+    // (app.nodetool.ai, api.nodetool.ai, …). HTTPS only — no port allowed so a
+    // look-alike like `nodetool.ai.evil.com` cannot match.
+    /^https:\/\/([a-z0-9-]+\.)*nodetool\.ai$/
+];
+let cachedConfig = null;
+function loadConfig() {
+    if (cachedConfig)
+        return cachedConfig;
+    const raw = getEnv("NODETOOL_ALLOWED_ORIGINS", "")?.trim() ?? "";
+    const entries = raw
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    cachedConfig = {
+        allowAll: entries.includes("*"),
+        exact: new Set(entries.filter((e) => e !== "*"))
+    };
+    return cachedConfig;
+}
+/** Reset cached config — for tests that mutate `NODETOOL_ALLOWED_ORIGINS`. */
+export function resetCorsConfig() {
+    cachedConfig = null;
+}
+/**
+ * Whether a request `Origin` is permitted. A missing origin (non-browser
+ * clients, same-origin navigations) is allowed — there is no browser
+ * enforcing CORS in that case, so nothing to gate.
+ */
+export function isOriginAllowed(origin) {
+    if (!origin)
+        return true;
+    const { allowAll, exact } = loadConfig();
+    if (allowAll)
+        return true;
+    if (exact.has(origin))
+        return true;
+    return DEFAULT_ALLOWED_ORIGIN_PATTERNS.some((re) => re.test(origin));
+}
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request `Origin`.
+ * Returns the origin to reflect when it is allowed, or `null` to omit the
+ * header entirely (a disallowed origin gets no ACAO, so the browser blocks
+ * the cross-origin read).
+ */
+export function resolveAllowedOrigin(origin) {
+    if (!origin)
+        return null;
+    return isOriginAllowed(origin) ? origin : null;
+}
+/**
+ * `@fastify/cors` origin delegate. Permits allow-listed origins (the plugin
+ * reflects them) and rejects everything else, replacing the previous
+ * `origin: true` (reflect-any) configuration.
+ */
+export function corsOriginDelegate(origin, cb) {
+    cb(null, isOriginAllowed(origin));
+}
+//# sourceMappingURL=cors.js.map

package/dist/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;GAGG;AACH,MAAM,+BAA+B,GAAa;IAChD,iCAAiC;IACjC,oCAAoC;IACpC,+BAA+B;IAC/B,uEAAuE;IACvE,iEAAiE;IACjE,+DAA+D;IAC/D,YAAY;IACZ,sEAAsE;IACtE,2EAA2E;IAC3E,uDAAuD;IACvD,yCAAyC;CAC1C,CAAC;AAOF,IAAI,YAAY,GAAsB,IAAI,CAAC;AAE3C,SAAS,UAAU;IACjB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,0BAA0B,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,YAAY,GAAG;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/B,KAAK,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;KACjD,CAAC;IACF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,eAAe;IAC7B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiC;IAC/D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,+BAA+B,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA0B,EAC1B,EAA+C;IAE/C,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AACpC,CAAC"}

package/dist/credit-gate.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The credit spend gate for NodeTool's managed provider.
+ *
+ * Only spend routed through provider "nodetool" — curated models running on
+ * platform-owned keys — is metered; the callers hold that condition. BYOK
+ * providers are never gated: their spend rides the user's own keys, and both
+ * models coexist on one server.
+ *
+ * Two things can refuse a call: a model the operator did not whitelist
+ * (`NODETOOL_CREDIT_MODELS`), and a balance that cannot cover the estimate.
+ * Callers pass the managed model ids the work names so the first refusal
+ * arrives before the run starts, with the model in the message.
+ *
+ * Like the application-budget gate, it fails open: metering must never take
+ * the runner down.
+ */
+import { type CreditRefusal } from "@nodetool-ai/models";
+export type CreditGateResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    refusal: CreditRefusal;
+    reason: string;
+};
+export declare function reserveSpend(userId: string, key: string, estimatedUsd: number): void;
+/** Releasing an unknown key is a no-op, so terminal paths can call it blindly. */
+export declare function releaseSpend(userId: string, key: string): void;
+export declare function reservedSpendUsd(userId: string): number;
+/**
+ * Decide whether `userId` may spend an estimated `estimatedUsd` through the
+ * managed provider on `models`, counting spend already admitted but not yet
+ * settled. Estimates are floors (unpriceable work estimates 0), so an empty
+ * balance blocks even a 0-estimate call.
+ */
+export declare function admitSpend(userId: string | null | undefined, estimatedUsd: number, models?: readonly string[]): Promise<CreditGateResult>;
+//# sourceMappingURL=credit-gate.d.ts.map

package/dist/credit-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit-gate.d.ts","sourceRoot":"","sources":["../src/credit-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEvE,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAmB/D,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GACnB,IAAI,CAON;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAK9D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAcvD;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,SAAS,MAAM,EAAO,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAkB3B"}

package/dist/credit-gate.js

@@ -0,0 +1,76 @@
+/**
+ * The credit spend gate for NodeTool's managed provider.
+ *
+ * Only spend routed through provider "nodetool" — curated models running on
+ * platform-owned keys — is metered; the callers hold that condition. BYOK
+ * providers are never gated: their spend rides the user's own keys, and both
+ * models coexist on one server.
+ *
+ * Two things can refuse a call: a model the operator did not whitelist
+ * (`NODETOOL_CREDIT_MODELS`), and a balance that cannot cover the estimate.
+ * Callers pass the managed model ids the work names so the first refusal
+ * arrives before the run starts, with the model in the message.
+ *
+ * Like the application-budget gate, it fails open: metering must never take
+ * the runner down.
+ */
+import { checkCredits } from "@nodetool-ai/models";
+const RESERVATION_TTL_MS = 2 * 60 * 60 * 1000;
+const reservations = new Map();
+export function reserveSpend(userId, key, estimatedUsd) {
+    let byKey = reservations.get(userId);
+    if (!byKey) {
+        byKey = new Map();
+        reservations.set(userId, byKey);
+    }
+    byKey.set(key, { usd: Math.max(0, estimatedUsd), at: Date.now() });
+}
+/** Releasing an unknown key is a no-op, so terminal paths can call it blindly. */
+export function releaseSpend(userId, key) {
+    const byKey = reservations.get(userId);
+    if (!byKey)
+        return;
+    byKey.delete(key);
+    if (byKey.size === 0)
+        reservations.delete(userId);
+}
+export function reservedSpendUsd(userId) {
+    const byKey = reservations.get(userId);
+    if (!byKey)
+        return 0;
+    const cutoff = Date.now() - RESERVATION_TTL_MS;
+    let total = 0;
+    for (const [key, reservation] of byKey) {
+        if (reservation.at < cutoff) {
+            byKey.delete(key);
+            continue;
+        }
+        total += reservation.usd;
+    }
+    if (byKey.size === 0)
+        reservations.delete(userId);
+    return total;
+}
+/**
+ * Decide whether `userId` may spend an estimated `estimatedUsd` through the
+ * managed provider on `models`, counting spend already admitted but not yet
+ * settled. Estimates are floors (unpriceable work estimates 0), so an empty
+ * balance blocks even a 0-estimate call.
+ */
+export async function admitSpend(userId, estimatedUsd, models = []) {
+    try {
+        const decision = await checkCredits(userId ?? "1", estimatedUsd + reservedSpendUsd(userId ?? "1"), models);
+        return decision.allowed
+            ? { allowed: true }
+            : {
+                allowed: false,
+                refusal: decision.refusal,
+                reason: decision.reason
+            };
+    }
+    catch (error) {
+        console.error("Credit gate check failed (failing open):", error);
+        return { allowed: true };
+    }
+}
+//# sourceMappingURL=credit-gate.js.map

package/dist/credit-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit-gate.js","sourceRoot":"","sources":["../src/credit-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AAoBvE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyC,CAAC;AAEtE,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,GAAW,EACX,YAAoB;IAEpB,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,GAAW;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC;IAC/C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAiC,EACjC,YAAoB,EACpB,MAAM,GAAsB,EAAE;IAE9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,MAAM,IAAI,GAAG,EACb,YAAY,GAAG,gBAAgB,CAAC,MAAM,IAAI,GAAG,CAAC,EAC9C,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC,OAAO;YACrB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;IACR,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/custom-providers.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Persistence for user-defined OpenAI-compatible providers.
+ *
+ * The catalog (slug, display name, optional model list) is one JSON row in the
+ * plaintext `Setting` table; the endpoint URL and API key are ordinary secrets,
+ * so they encrypt at rest and resolve per user through the same `getSecret`
+ * path every other provider credential uses.
+ *
+ * The registry itself is a process global. Sync writes ids into it, never
+ * credentials — two users with the same slug each reach their own endpoint, and
+ * a user who configured nothing sees the provider as unconfigured.
+ */
+import { type CustomProvider } from "@nodetool-ai/protocol";
+/** A definition plus the per-user state the settings UI renders. */
+export interface CustomProviderView extends CustomProvider {
+    base_url: string;
+    has_api_key: boolean;
+}
+/** Definitions plus each one's stored endpoint and whether a key is set. */
+export declare function listCustomProviders(userId: string): Promise<CustomProviderView[]>;
+/** Load the user's catalog into the provider registry. */
+export declare function syncCustomProviderRegistry(userId: string): Promise<string[]>;
+export interface SaveCustomProviderInput {
+    slug: string;
+    name: string;
+    base_url: string;
+    /** Omit to leave a stored key untouched; empty string clears it. */
+    api_key?: string;
+    models?: string[];
+    image_models?: string[];
+    video_models?: string[];
+}
+/**
+ * Create or replace one custom provider. Throws `Error` with a user-facing
+ * message when the slug or URL is unusable — the caller maps it to a 400.
+ */
+export declare function saveCustomProvider(userId: string, input: SaveCustomProviderInput): Promise<CustomProviderView>;
+/** Remove a custom provider and both of its secrets. Returns false if absent. */
+export declare function deleteCustomProvider(userId: string, slug: string): Promise<boolean>;
+//# sourceMappingURL=custom-providers.d.ts.map

package/dist/custom-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-providers.d.ts","sourceRoot":"","sources":["../src/custom-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAQL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,oEAAoE;AACpE,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAqBD,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA0B/B;AAED,0DAA0D;AAC1D,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAqD7B;AAED,iFAAiF;AACjF,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAiBlB"}

package/dist/custom-providers.js

@@ -0,0 +1,134 @@
+/**
+ * Persistence for user-defined OpenAI-compatible providers.
+ *
+ * The catalog (slug, display name, optional model list) is one JSON row in the
+ * plaintext `Setting` table; the endpoint URL and API key are ordinary secrets,
+ * so they encrypt at rest and resolve per user through the same `getSecret`
+ * path every other provider credential uses.
+ *
+ * The registry itself is a process global. Sync writes ids into it, never
+ * credentials — two users with the same slug each reach their own endpoint, and
+ * a user who configured nothing sees the provider as unconfigured.
+ */
+import { Secret, Setting, clearSecretCache } from "@nodetool-ai/models";
+import { syncCustomProviders, clearProviderCache } from "@nodetool-ai/runtime";
+import { CUSTOM_PROVIDERS_SETTING_KEY, customProviderApiKeyKey, customProviderBaseUrlKey, customProviderBaseUrlError, customProviderSlugError, normalizeBaseUrl, parseCustomProviderCatalog } from "@nodetool-ai/protocol";
+async function loadCustomProviderCatalog(userId) {
+    const setting = await Setting.find(userId, CUSTOM_PROVIDERS_SETTING_KEY);
+    return setting ? parseCustomProviderCatalog(setting.getValue()) : [];
+}
+async function saveCatalog(userId, definitions) {
+    await Setting.upsert({
+        userId,
+        key: CUSTOM_PROVIDERS_SETTING_KEY,
+        value: JSON.stringify(definitions),
+        description: "User-defined OpenAI-compatible providers"
+    });
+}
+/** Definitions plus each one's stored endpoint and whether a key is set. */
+export async function listCustomProviders(userId) {
+    const definitions = await loadCustomProviderCatalog(userId);
+    return Promise.all(definitions.map(async (definition) => {
+        const baseUrlKey = customProviderBaseUrlKey(definition.slug);
+        const apiKeyKey = customProviderApiKeyKey(definition.slug);
+        const [urlSecret, keySecret] = await Promise.all([
+            Secret.find(userId, baseUrlKey),
+            Secret.find(userId, apiKeyKey)
+        ]);
+        let baseUrl = process.env[baseUrlKey] ?? "";
+        if (urlSecret) {
+            try {
+                baseUrl = (await urlSecret.getDecryptedValue()) ?? baseUrl;
+            }
+            catch {
+                // An undecryptable URL reads as unset, which is what the card should
+                // show — the user re-enters it.
+            }
+        }
+        return {
+            ...definition,
+            base_url: baseUrl,
+            has_api_key: Boolean(keySecret) || Boolean(process.env[apiKeyKey])
+        };
+    }));
+}
+/** Load the user's catalog into the provider registry. */
+export async function syncCustomProviderRegistry(userId) {
+    const definitions = await loadCustomProviderCatalog(userId);
+    const ids = syncCustomProviders(definitions);
+    clearProviderCache();
+    return ids;
+}
+/**
+ * Create or replace one custom provider. Throws `Error` with a user-facing
+ * message when the slug or URL is unusable — the caller maps it to a 400.
+ */
+export async function saveCustomProvider(userId, input) {
+    const slugError = customProviderSlugError(input.slug);
+    if (slugError)
+        throw new Error(slugError);
+    const urlError = customProviderBaseUrlError(input.base_url);
+    if (urlError)
+        throw new Error(urlError);
+    const definition = {
+        slug: input.slug,
+        name: input.name.trim() || input.slug,
+        models: input.models ?? [],
+        image_models: input.image_models ?? [],
+        video_models: input.video_models ?? []
+    };
+    const catalog = await loadCustomProviderCatalog(userId);
+    const next = catalog.filter((d) => d.slug !== definition.slug);
+    next.push(definition);
+    await saveCatalog(userId, next);
+    const baseUrl = normalizeBaseUrl(input.base_url);
+    const baseUrlKey = customProviderBaseUrlKey(definition.slug);
+    await Secret.upsert({
+        userId,
+        key: baseUrlKey,
+        value: baseUrl,
+        description: `Endpoint for ${definition.name}`
+    });
+    clearSecretCache(userId, baseUrlKey);
+    const apiKeyKey = customProviderApiKeyKey(definition.slug);
+    let hasApiKey = Boolean(await Secret.find(userId, apiKeyKey));
+    if (input.api_key !== undefined) {
+        if (input.api_key) {
+            await Secret.upsert({
+                userId,
+                key: apiKeyKey,
+                value: input.api_key,
+                description: `API key for ${definition.name}`
+            });
+            hasApiKey = true;
+        }
+        else {
+            await Secret.deleteSecret(userId, apiKeyKey);
+            hasApiKey = false;
+        }
+        clearSecretCache(userId, apiKeyKey);
+    }
+    await syncCustomProviderRegistry(userId);
+    return {
+        ...definition,
+        base_url: baseUrl,
+        has_api_key: hasApiKey || Boolean(process.env[apiKeyKey])
+    };
+}
+/** Remove a custom provider and both of its secrets. Returns false if absent. */
+export async function deleteCustomProvider(userId, slug) {
+    const catalog = await loadCustomProviderCatalog(userId);
+    if (!catalog.some((d) => d.slug === slug))
+        return false;
+    await saveCatalog(userId, catalog.filter((d) => d.slug !== slug));
+    for (const key of [
+        customProviderBaseUrlKey(slug),
+        customProviderApiKeyKey(slug)
+    ]) {
+        await Secret.deleteSecret(userId, key);
+        clearSecretCache(userId, key);
+    }
+    await syncCustomProviderRegistry(userId);
+    return true;
+}
+//# sourceMappingURL=custom-providers.js.map

package/dist/custom-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-providers.js","sourceRoot":"","sources":["../src/custom-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,EAE3B,MAAM,uBAAuB,CAAC;AAQ/B,KAAK,UAAU,yBAAyB,CACtC,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAc,EACd,WAA6B;IAE7B,MAAM,OAAO,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,GAAG,EAAE,4BAA4B;QACjC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;QAClC,WAAW,EAAE,0CAA0C;KACxD,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc;IAEd,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,OAAO,CAAC,GAAG,CAChB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACnC,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,iBAAiB,EAAE,CAAC,IAAI,OAAO,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,gCAAgC;YAClC,CAAC;QACH,CAAC;QACD,OAAO;YACL,GAAG,UAAU;YACb,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SACnE,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc;IAEd,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,kBAAkB,EAAE,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAA8B;IAE9B,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,UAAU,GAAmB;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI;QACrC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;KACvC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,wBAAwB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,MAAM,CAAC,MAAM,CAAC;QAClB,MAAM;QACN,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,gBAAgB,UAAU,CAAC,IAAI,EAAE;KAC/C,CAAC,CAAC;IACH,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,MAAM,CAAC;gBAClB,MAAM;gBACN,GAAG,EAAE,SAAS;gBACd,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,WAAW,EAAE,eAAe,UAAU,CAAC,IAAI,EAAE;aAC9C,CAAC,CAAC;YACH,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO;QACL,GAAG,UAAU;QACb,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,EACd,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAExD,MAAM,WAAW,CACf,MAAM,EACN,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CACvC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI;QAChB,wBAAwB,CAAC,IAAI,CAAC;QAC9B,uBAAuB,CAAC,IAAI,CAAC;KAC9B,EAAE,CAAC;QACF,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/debug-sessions.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The interactive escalation session registry. It moved to
+ * `@nodetool-ai/execution/service` — an in-memory map keyed by session id has
+ * nothing server-specific about it, and the agent tools park runs in the same
+ * registry when they run a workflow in-process. This module is the server's
+ * import site for it.
+ */
+export { debugSessions, DebugSession, InteractiveEscalationHandle, TooManyDebugSessionsError, INTERACTIVE_DECISION_TIMEOUT_MS, SESSION_MAX_LIFETIME_MS, CANCEL_SETTLE_TIMEOUT_MS, MAX_LIVE_SESSIONS_PER_USER } from "@nodetool-ai/execution/service";
+export type { CreateDebugSessionOptions, DebugSessionEvent, ParkedEscalation } from "@nodetool-ai/execution/service";
+//# sourceMappingURL=debug-sessions.d.ts.map

package/dist/debug-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-sessions.d.ts","sourceRoot":"","sources":["../src/debug-sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,YAAY,EACZ,2BAA2B,EAC3B,yBAAyB,EACzB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,gCAAgC,CAAC"}

package/dist/debug-sessions.js

@@ -0,0 +1,9 @@
+/**
+ * The interactive escalation session registry. It moved to
+ * `@nodetool-ai/execution/service` — an in-memory map keyed by session id has
+ * nothing server-specific about it, and the agent tools park runs in the same
+ * registry when they run a workflow in-process. This module is the server's
+ * import site for it.
+ */
+export { debugSessions, DebugSession, InteractiveEscalationHandle, TooManyDebugSessionsError, INTERACTIVE_DECISION_TIMEOUT_MS, SESSION_MAX_LIFETIME_MS, CANCEL_SETTLE_TIMEOUT_MS, MAX_LIVE_SESSIONS_PER_USER } from "@nodetool-ai/execution/service";
+//# sourceMappingURL=debug-sessions.js.map

package/dist/debug-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-sessions.js","sourceRoot":"","sources":["../src/debug-sessions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,aAAa,EACb,YAAY,EACZ,2BAA2B,EAC3B,yBAAyB,EACzB,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,gCAAgC,CAAC"}

package/dist/drain.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Process-wide drain state.
+ *
+ * A chat turn already survives a dropped socket ({@link ChatTurnSession}), but
+ * not a restart: the process goes away with the turn's unwritten transcript
+ * rows and its unflushed spans. Fly allows at most 300 s between SIGTERM and
+ * the kill, and a turn can run for half an hour, so the deploy drains a machine
+ * *before* it signals it — SIGUSR2 sets this flag, and the machine then takes
+ * no new work while the turns already in flight finish here.
+ *
+ * Draining changes four things: `/health` answers 503, so the proxy routes new
+ * clients to the other machine; a new `/ws` handshake is refused with 503; an
+ * idle connection is closed with 1012 (service restart) and one holding a turn
+ * or run is closed when that settles; and `chat_message` / `run_job` are
+ * refused before anything is persisted. SIGTERM sets the same flag as a
+ * fallback and then aborts what is left.
+ *
+ * One flag, one process, no un-drain: a machine that has started draining is on
+ * its way out.
+ */
+/** True once this process has entered the drain. */
+export declare function isDraining(): boolean;
+/** Enter the drain. Idempotent — a second call notifies nobody. */
+export declare function startDrain(): void;
+/**
+ * React to the drain. A listener registered while already draining runs at
+ * once: a connection accepted in the window before the refusal took effect has
+ * to close itself the same way one that predates the drain does. Returns the
+ * unsubscribe.
+ */
+export declare function onDrain(listener: () => void): () => void;
+/** Test-only: return the process to the not-draining state. */
+export declare function _resetDrainForTest(): void;
+//# sourceMappingURL=drain.d.ts.map

package/dist/drain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drain.d.ts","sourceRoot":"","sources":["../src/drain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,oDAAoD;AACpD,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,mEAAmE;AACnE,wBAAgB,UAAU,IAAI,IAAI,CAOjC;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAMxD;AAYD,+DAA+D;AAC/D,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}