@opengeni/db 2.0.1 → 2.0.2-canary.38789554071001

package/dist/attached-browser-devices.d.ts

@@ -58,4 +58,25 @@ export declare function listAttachedBrowserDevices(db: Database, input: Attached
 export declare function getAttachedBrowserDevice(db: Database, input: AttachedBrowserViewer & {
     deviceId: string;
 }): Promise<AttachedBrowserDeviceValue>;
+/** Where a browser or computer's controller runs, as far as ending it needs. */
+export type InteractionControllerPlacement = {
+    kind: "connected_machine";
+    sandboxId: string;
+} | {
+    kind: "attached_device";
+    deviceId: string;
+} | {
+    kind: string;
+};
+/** True when a browser or computer's controller can never be reached again,
+ * so ending it completes in the control plane:
+ *  - on a Connected Machine that was removed (revoked); that machine can no
+ *    longer run or keep it;
+ *  - in a person's own Chrome whose device is disconnected, or whose machine
+ *    was removed. Such a session holds no Opengeni process or profile; the
+ *    tabs it opened stay with the person as ordinary tabs.
+ * A machine that is only offline still holds its sessions' processes and
+ * private profiles, so it is not gone. Both checks go through the viewer's
+ * own owner-aware machine listing: a machine hidden from them is never gone. */
+export declare function interactionControllerGone(db: Database, viewer: AttachedBrowserViewer, placement: InteractionControllerPlacement | null): Promise<boolean>;
 export {};

package/dist/boot-connect.d.ts

@@ -31,10 +31,18 @@ export type BootGraceSocketDependencies = {
     now?: () => number;
     sleep?: (ms: number) => Promise<void>;
     connect?: (endpoint: DatabaseConnectEndpoint, timeoutMs: number | null) => Promise<net.Socket>;
+    open?: (endpoint: DatabaseConnectEndpoint) => net.Socket;
 };
 export declare function isDatabaseBootTransientConnectError(error: unknown): boolean;
 /** Jittered delay before the next boot connect attempt: 100 ms doubling to 1 s. */
 export declare function databaseBootConnectRetryDelayMs(attempt: number, random?: () => number): number;
+/**
+ * Starts connecting and returns the socket at once, like postgres.js's own
+ * connection path: a failure arrives as the socket's `error` and `close`
+ * events, which postgres.js handles by failing the waiting query and putting
+ * the connection back in its pool to reconnect later.
+ */
+export declare function openDatabaseSocket(endpoint: DatabaseConnectEndpoint): net.Socket;
 /** Opens one connected socket, failing on the first socket error or timeout. */
 export declare function connectDatabaseSocket(endpoint: DatabaseConnectEndpoint, timeoutMs: number | null): Promise<net.Socket>;
 /**
@@ -44,6 +52,14 @@ export declare function connectDatabaseSocket(endpoint: DatabaseConnectEndpoint,
  * reached the server" state, so the grace ends at the first success or when the
  * window since client creation has elapsed, whichever comes first. Each attempt
  * keeps the client's own `connect_timeout`.
+ *
+ * The factory never rejects. postgres.js does not recover a pooled connection
+ * whose socket factory rejects: it fails the waiting query but never returns
+ * the connection to its pool, so after a database restart every connection
+ * leaked one by one and the client hung for good, even once the database was
+ * back. Outside the grace, and when the grace gives up, the factory instead
+ * returns a socket that is still connecting, so a failure reaches postgres.js
+ * as socket events and the connection reconnects like any other.
  */
 export declare function createBootGraceDatabaseSocket(dependencies?: BootGraceSocketDependencies): (target: DatabaseSocketTarget) => Promise<net.Socket>;
 /**

package/dist/browser-sessions.d.ts

@@ -195,6 +195,10 @@ export declare function browserSessionCreateRequestDigest(input: PrepareBrowserS
 export declare function listBrowserSessions(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    /** Only sessions with any association to this agent session. */
+    associatedSessionId?: string;
+    /** Defaults to true (complete history). */
+    includeTerminal?: boolean;
 }): Promise<BrowserSessionListResponseValue>;
 /** Managed browsers that may still have a live browser process on one
  * Connected Machine: every non-terminal browser except a saved one whose
@@ -404,6 +408,19 @@ export declare function settleExpiredBrowserSessionResume(db: Database, input: {
     browserSessionId: string;
     expectedControllerGeneration: string | null;
 }): Promise<boolean>;
+/** Continue an expired resume on its retained controller generation after that
+ * controller re-adopted the generation's own working copy. The browser keeps
+ * its record, history and working profile; nothing is restored or discarded.
+ * The new resume operation completes on that generation, and the expired one
+ * stays settled as `outcome_unknown`. */
+export declare function continueExpiredBrowserSessionResume(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    browserSessionId: string;
+    operationId: string;
+    actorSubjectId: string;
+    controller: InteractionControllerBinding;
+}): Promise<BrowserSessionMutationResponseValue>;
 export declare function failBrowserSessionSuspension(db: Database, input: {
     accountId: string;
     workspaceId: string;

package/dist/canonical-human-identities.js

@@ -11,10 +11,10 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-5HD6PLH4.js";
-import "./chunk-VTH2TKNI.js";
-import "./chunk-PGZ34T44.js";
-import "./chunk-HFNTVT5I.js";
+} from "./chunk-EIYWCPZN.js";
+import "./chunk-5TXWWAJP.js";
+import "./chunk-SMCA7PNJ.js";
+import "./chunk-GDMYQ55A.js";
 import "./chunk-PZ5AY32C.js";
 export {
   CanonicalHumanIdentityAuthorityError,

package/dist/capability-reconciliation.js

@@ -1,8 +1,8 @@
 import {
   withWorkspaceRls
-} from "./chunk-VTH2TKNI.js";
-import "./chunk-PGZ34T44.js";
-import "./chunk-HFNTVT5I.js";
+} from "./chunk-5TXWWAJP.js";
+import "./chunk-SMCA7PNJ.js";
+import "./chunk-GDMYQ55A.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/capability-reconciliation.ts

package/dist/{chunk-VQH2IP4E.js → chunk-2DV4KOMH.js}

@@ -1,10 +1,14 @@
 import {
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 
 // src/connection-token-resolver.ts
-import { normalizeSlackScopes, OFFICIAL_SLACK_MCP_URL } from "@opengeni/contracts/slack-rest-mcp";
+import {
+  isSlackPrivateFileUrl,
+  normalizeSlackScopes,
+  OFFICIAL_SLACK_MCP_URL
+} from "@opengeni/contracts/slack-rest-mcp";
 import { beginMcpPhase, measureMcpPhase } from "@opengeni/observability";
 import {
   PERSONAL_GITHUB_REQUESTED_SCOPES,
@@ -532,6 +536,7 @@ function isOfficialSlackRestDestination(destinationUrl, ref) {
   if (ref.providerDomain.toLowerCase() !== "slack.com" || ref.kind !== "oauth2" || ref.subjectScope !== void 0 && ref.subjectScope !== "subject" && ref.subjectScope !== "workspace")
     return false;
   const url = new URL(destinationUrl);
+  if (isSlackPrivateFileUrl(url)) return true;
   return url.origin === "https://slack.com" && !url.username && !url.password && [
     "auth.test",
     "conversations.list",
@@ -541,6 +546,7 @@ function isOfficialSlackRestDestination(destinationUrl, ref) {
     "users.info",
     "conversations.history",
     "conversations.replies",
+    "files.info",
     "conversations.open",
     "chat.postMessage"
   ].some((method) => url.pathname === `/api/${method}`);
@@ -857,4 +863,4 @@ export {
   refreshOAuthConnectionCredential,
   isPrivateAddress
 };
-//# sourceMappingURL=chunk-VQH2IP4E.js.map
+//# sourceMappingURL=chunk-2DV4KOMH.js.map

package/dist/chunk-2DV4KOMH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connection-token-resolver.ts","../src/connection-refresh-lock.ts","../src/connection-scopes.ts"],"sourcesContent":["import {\n  isSlackPrivateFileUrl,\n  normalizeSlackScopes,\n  OFFICIAL_SLACK_MCP_URL,\n} from \"@opengeni/contracts/slack-rest-mcp\";\nimport { beginMcpPhase, measureMcpPhase } from \"@opengeni/observability\";\nimport {\n  environmentsEncryptionKeyBytes,\n  type McpServerConnectionRef,\n  type Settings,\n} from \"@opengeni/config\";\nimport type {\n  ConnectionCredentialPlacement,\n  ConnectionKind,\n  ConnectionStatus,\n  ConnectionMetadata,\n  McpConnectionResourceScope,\n  McpCredentialAuthNeededReason,\n} from \"@opengeni/contracts\";\n\nimport { type ConnectionUseAttribution } from \"@opengeni/contracts/connection-authority\";\nimport {\n  PERSONAL_GITHUB_REQUESTED_SCOPES,\n  PERSONAL_GITHUB_PROVIDER_DOMAIN,\n  PERSONAL_GITHUB_TOKEN_URL,\n  PersonalGitHubConnectionMetadata,\n} from \"@opengeni/contracts/personal-github\";\nimport { createHash } from \"node:crypto\";\nimport {\n  OAUTH_MAX_RESPONSE_BYTES,\n  pinnedFetch,\n  readResponseJsonBounded,\n  undiciFetch,\n  validateHttpUrl,\n  type DnsLookup,\n  type FetchLike,\n} from \"@opengeni/network\";\nexport { isPrivateAddress } from \"@opengeni/network\";\nimport { Buffer } from \"node:buffer\";\nimport { encryptEnvironmentValue } from \"./environment-crypto\";\nimport type { Database } from \"./database\";\nimport { withConnectionRefreshLock } from \"./connection-refresh-lock\";\nimport type {\n  AcceptedConnectionUseContext,\n  AcceptedConnectionUseResolution,\n} from \"./connection-authority\";\nimport { connectionScopeKey } from \"./connection-scopes\";\n\nconst MAX_CREDENTIAL_PLACEMENTS = 32;\nconst MAX_CREDENTIAL_NAME_BYTES = 256;\nconst MAX_CREDENTIAL_VALUE_BYTES = 16_384;\nconst HEADER_NAME_PATTERN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;\nconst QUERY_NAME_PATTERN = /^[A-Za-z0-9._~-]+$/;\nconst COOKIE_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\nconst FORBIDDEN_CREDENTIAL_HEADERS = new Set([\n  \"connection\",\n  \"content-length\",\n  \"host\",\n  \"proxy-authorization\",\n  \"proxy-connection\",\n  \"te\",\n  \"trailer\",\n  \"transfer-encoding\",\n  \"upgrade\",\n]);\n\nexport type ConnectionCredentialForBroker = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  subjectId: string | null;\n  providerDomain: string;\n  kind: ConnectionKind;\n  status: ConnectionStatus;\n  credential: Record<string, unknown>;\n  grantedScopes: string[];\n  expiresAt: Date | null;\n  lastRefreshAt: Date | null;\n  version: number;\n  /** Immutable execution authority generation; distinct from token refresh version. */\n  authorityGeneration?: number;\n  metadata: Record<string, unknown>;\n};\n\nexport type ConnectionCredentialLookupInput = {\n  workspaceId: string;\n  connectionId?: string;\n  providerDomain: string;\n  kind?: ConnectionKind;\n  subjectId?: string | null;\n  allowSubjectOwned?: boolean;\n  expectedAuthorityGeneration?: number;\n};\n\nexport type ConnectionTokenRefreshInput = {\n  id: string;\n  version: number;\n  workspaceId: string;\n  credentialEncrypted: string;\n  expiresAt: Date | null;\n  grantedScopes?: string[];\n  metadata?: Record<string, unknown>;\n  lastRefreshAt: Date;\n  subjectId?: string | null;\n};\n\nexport type ConnectionStatusGuard = {\n  id: string;\n  version: number;\n  subjectId?: string | null;\n};\n\nexport type ResolveConnectionCredentialResult =\n  | {\n      status: \"ok\";\n      headers: Record<string, string>;\n      /** Credential authority is owned by the embedding host, not the native connection store. */\n      authoritySource?: \"host\";\n      /** Present when the credential bundle or embedding host supplied explicit placements. */\n      placements?: ConnectionCredentialPlacement[];\n      connectionId: string;\n      /** Exact durable version when the credential came from the local connection store. */\n      connectionVersion?: number;\n      /** Actual provider grants; never inferred from requested connection scopes. */\n      grantedScopes?: string[];\n      /** Metadata-only owner attribution from the immediate pre-use fence. */\n      connectionUseAttribution?: ConnectionUseAttribution;\n      /** Metadata-only equality key from current live authority; never credentials or authorization. */\n      operationAuthorityDigest?: string;\n      /**\n       * Revalidate the exact accepted attempt immediately before one target\n       * provider request. Credential lookup/refresh is a separate audited\n       * boundary and must not manufacture a provider-request fact by itself.\n       */\n      authorizeProviderRequest?: () => Promise<boolean>;\n      expiresAt?: Date | null;\n    }\n  | {\n      status: \"auth_needed\";\n      reason: McpCredentialAuthNeededReason;\n      providerDomain: string;\n      /** Credential authority is owned by the embedding host, not the native connection store. */\n      authoritySource?: \"host\";\n      provider?: string;\n      connectionId?: string;\n      scopes?: string[];\n      resource?: string;\n      selectedResources?: McpConnectionResourceScope[];\n      authorizationUrl?: string;\n    };\ntype AuthNeededReason = Extract<\n  ResolveConnectionCredentialResult,\n  { status: \"auth_needed\" }\n>[\"reason\"];\n\nexport type ResolveConnectionCredentialInput = {\n  workspaceId: string;\n  subjectId?: string;\n  serverId: string;\n  toolName?: string;\n  /** @deprecated Use toolName. Retained for the API's pre-existing broker call shape. */\n  toolId?: string;\n  connectionRef: McpServerConnectionRef;\n  /** Exact MCP destination whose request would receive the resolved headers. */\n  destinationUrl: string;\n  /** Defaults to header-only MCP transport. */\n  credentialTarget?: \"mcp\" | \"http_api\";\n  forceRefresh?: boolean;\n  /** Internal lookup mode. Preflight must not refresh credentials or record provider usage. */\n  credentialResolutionMode?: \"execution\" | \"preflight\";\n  /** Frozen provider authority generation captured by the calling integration/catalog. */\n  expectedAuthorityGeneration?: number;\n  /** Attribution already authorized for forwarding to a host resolver; never authorizes local use. */\n  hostConnectionUseAttribution?: ConnectionUseAttribution;\n  /** Exact accepted attempt plus one stable physical-provider request id. */\n  connectionUseContext?: AcceptedConnectionUseContext;\n};\n\nconst OFFICIAL_GMAIL_MCP_RESOURCE = \"https://gmailmcp.googleapis.com/mcp/v1\";\nconst OFFICIAL_GMAIL_REST_HOST = \"gmail.googleapis.com\";\n\n/**\n * The Gmail bridge reuses the exact OAuth grant created for the official\n * hosted Gmail MCP resource, executing every tool against Gmail's REST API\n * instead of Google's Developer Preview MCP endpoint. Keep this exception\n * narrower than ordinary provider-domain binding: HTTPS only, Google's\n * canonical Gmail API host, and the authenticated `users/me` path.\n */\nfunction isOfficialGmailRestDestination(\n  destinationUrl: string,\n  ref: McpServerConnectionRef,\n): boolean {\n  if (\n    ref.providerDomain.toLowerCase() !== \"gmailmcp.googleapis.com\" ||\n    ref.kind !== \"oauth2\" ||\n    ref.subjectScope !== \"subject\"\n  ) {\n    return false;\n  }\n  const destination = new URL(destinationUrl);\n  return (\n    destination.protocol === \"https:\" &&\n    destination.hostname.toLowerCase() === OFFICIAL_GMAIL_REST_HOST &&\n    (destination.pathname === \"/gmail/v1/users/me\" ||\n      destination.pathname.startsWith(\"/gmail/v1/users/me/\"))\n  );\n}\n\n/**\n * Adapts the public embedding credential port to the runtime's connection\n * resolver contract. Scope echoes are checked before credential headers can\n * reach a request; the returned object is a fresh copy so a host cannot mutate\n * headers after resolution.\n */\n\nfunction copySelectedResources(\n  resources: McpConnectionResourceScope[],\n): McpConnectionResourceScope[] {\n  if (resources.length === 0 || resources.length > 256) {\n    throw new Error(\"connection credential returned an invalid selected resource count\");\n  }\n  const seen = new Set<string>();\n  return resources.map((resource) => {\n    if (\n      resource.kind !== \"repository\" ||\n      typeof resource.id !== \"string\" ||\n      resource.id.length === 0 ||\n      resource.id.length > 512\n    ) {\n      throw new Error(\"connection credential returned an invalid selected resource\");\n    }\n    const key = `${resource.kind}\\0${resource.id}`;\n    if (seen.has(key)) {\n      throw new Error(\"connection credential returned duplicate selected resources\");\n    }\n    seen.add(key);\n    return { kind: resource.kind, id: resource.id };\n  });\n}\n\nexport function normalizedCredentialHeaders(\n  headers: Record<string, string>,\n  allowEmpty = false,\n): Record<string, string> {\n  const entries = Object.entries(headers);\n  if ((!allowEmpty && entries.length === 0) || entries.length > 32) {\n    throw new Error(\"connection credential returned an invalid header count\");\n  }\n  const normalized: Record<string, string> = {};\n  for (const [name, value] of entries) {\n    if (\n      name.length > 256 ||\n      !HEADER_NAME_PATTERN.test(name) ||\n      value.length === 0 ||\n      value.length > 16_384 ||\n      /[\\r\\n\\0]/.test(value) ||\n      FORBIDDEN_CREDENTIAL_HEADERS.has(name.toLowerCase()) ||\n      name.toLowerCase().startsWith(\"sec-\")\n    ) {\n      throw new Error(\"connection credential returned an invalid header\");\n    }\n    if (Object.keys(normalized).some((existing) => existing.toLowerCase() === name.toLowerCase())) {\n      throw new Error(\"connection credential returned duplicate headers\");\n    }\n    normalized[name] = value;\n  }\n  return normalized;\n}\n\nexport const BROKERED_CREDENTIAL_SHAPE_HINT =\n  'store { headers: { \"<Header-Name>\": \"<value>\" } } or { placements: [{ carrier: \"header\" | \"query\" | \"cookie\", name, value, prefix? }] }';\n\n/**\n * Why a non-OAuth credential bundle cannot be placed on a brokered request,\n * or null when the runtime broker can use it. Mirrors\n * `credentialMaterialForConnection` exactly so create-time validation and\n * execution never disagree.\n */\nexport function brokeredCredentialBundleProblem(\n  credential: Record<string, unknown>,\n): string | null {\n  if (credential.placements !== undefined) {\n    try {\n      normalizedCredentialPlacements(credential.placements);\n      return null;\n    } catch (error) {\n      return `invalid credential placements (${credentialProblemDetail(error)}); ${BROKERED_CREDENTIAL_SHAPE_HINT}`;\n    }\n  }\n  if (credential.headers !== undefined) {\n    const headers = stringRecord(credential.headers);\n    if (!headers) {\n      return `credential.headers must map header names to string values; ${BROKERED_CREDENTIAL_SHAPE_HINT}`;\n    }\n    try {\n      normalizedCredentialHeaders(headers);\n      return null;\n    } catch (error) {\n      return `invalid credential headers (${credentialProblemDetail(error)}); ${BROKERED_CREDENTIAL_SHAPE_HINT}`;\n    }\n  }\n  const unplaced = Object.keys(credential).filter(\n    (key) => key !== \"headers\" && key !== \"placements\",\n  );\n  return `an api_key credential must say where the secret goes on each request${\n    unplaced.length > 0\n      ? ` (fields such as ${unplaced\n          .slice(0, 3)\n          .map((key) => JSON.stringify(key.slice(0, 64)))\n          .join(\", \")} are never sent)`\n      : \"\"\n  }; ${BROKERED_CREDENTIAL_SHAPE_HINT}`;\n}\n\nfunction credentialProblemDetail(error: unknown): string {\n  return error instanceof Error\n    ? error.message.replace(/^connection credential returned /, \"\")\n    : \"invalid value\";\n}\n\nfunction normalizedCredentialPlacements(value: unknown): ConnectionCredentialPlacement[] {\n  if (!Array.isArray(value) || value.length === 0 || value.length > MAX_CREDENTIAL_PLACEMENTS) {\n    throw new Error(\"connection credential returned an invalid placement count\");\n  }\n  const seen = new Set<string>();\n  return value.map((raw) => {\n    if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) {\n      throw new Error(\"connection credential returned an invalid placement\");\n    }\n    const record = raw as Record<string, unknown>;\n    if (\n      Object.keys(record).some(\n        (key) => key !== \"carrier\" && key !== \"name\" && key !== \"value\" && key !== \"prefix\",\n      )\n    ) {\n      throw new Error(\"connection credential returned an invalid placement\");\n    }\n    const carrier = record.carrier;\n    const name = record.name;\n    const credentialValue = record.value;\n    const prefix = record.prefix;\n    if (\n      (carrier !== \"header\" && carrier !== \"query\" && carrier !== \"cookie\") ||\n      typeof name !== \"string\" ||\n      name.length === 0 ||\n      Buffer.byteLength(name) > MAX_CREDENTIAL_NAME_BYTES ||\n      typeof credentialValue !== \"string\" ||\n      credentialValue.length === 0 ||\n      (typeof prefix !== \"undefined\" && typeof prefix !== \"string\") ||\n      /[\\r\\n\\0]/.test(name) ||\n      /[\\r\\n\\0]/.test(credentialValue) ||\n      (typeof prefix === \"string\" && /[\\r\\n\\0]/.test(prefix)) ||\n      Buffer.byteLength(`${typeof prefix === \"string\" ? prefix : \"\"}${credentialValue}`) >\n        MAX_CREDENTIAL_VALUE_BYTES\n    ) {\n      throw new Error(\"connection credential returned an invalid placement\");\n    }\n    const normalizedName = carrier === \"header\" ? name.toLowerCase() : name;\n    if (\n      (carrier === \"header\" &&\n        (!HEADER_NAME_PATTERN.test(name) ||\n          FORBIDDEN_CREDENTIAL_HEADERS.has(normalizedName) ||\n          normalizedName.startsWith(\"sec-\"))) ||\n      (carrier === \"query\" && !QUERY_NAME_PATTERN.test(name)) ||\n      (carrier === \"cookie\" &&\n        (!COOKIE_NAME_PATTERN.test(name) || /;/.test(`${prefix ?? \"\"}${credentialValue}`)))\n    ) {\n      throw new Error(\"connection credential returned an invalid placement\");\n    }\n    const key = `${carrier}\\0${normalizedName}`;\n    if (seen.has(key)) {\n      throw new Error(\"connection credential returned duplicate placements\");\n    }\n    seen.add(key);\n    return {\n      carrier,\n      name,\n      value: credentialValue,\n      ...(typeof prefix === \"string\" && prefix.length > 0 ? { prefix } : {}),\n    };\n  });\n}\n\nfunction headerMapForPlacements(\n  placements: readonly ConnectionCredentialPlacement[],\n): Record<string, string> {\n  const headers: Record<string, string> = {};\n  for (const placement of placements) {\n    if (placement.carrier === \"header\") {\n      headers[placement.name] = `${placement.prefix ?? \"\"}${placement.value}`;\n    }\n  }\n  return headers;\n}\n\nexport type ConnectionBrokerDeps = {\n  loadCredential: (\n    db: Database,\n    settings: Settings,\n    input: ConnectionCredentialLookupInput,\n  ) => Promise<ConnectionCredentialForBroker | null>;\n  recordRefresh: (db: Database, input: ConnectionTokenRefreshInput) => Promise<boolean>;\n  setStatus: (\n    db: Database,\n    workspaceId: string,\n    status: ConnectionStatus,\n    lastError: string | null,\n    guard: ConnectionStatusGuard,\n  ) => Promise<boolean>;\n  recordUsed: (\n    db: Database,\n    workspaceId: string,\n    connectionId: string,\n    subjectId?: string | null,\n  ) => Promise<void>;\n  refresh: typeof refreshOAuthConnectionCredential;\n  /** Test/adapter seam; standalone defaults to the database-backed refresh lock. */\n  withRefreshLock?: typeof withConnectionRefreshLock;\n  encrypt: typeof encryptEnvironmentValue;\n  keyBytes: typeof environmentsEncryptionKeyBytes;\n  now: () => Date;\n  authorizeAcceptedUse?: (\n    db: Database,\n    input: AcceptedConnectionUseContext & {\n      serverId: string;\n      connectionId?: string;\n      providerDomain: string;\n      connectionKind?: ConnectionKind;\n      subjectScope?: \"workspace\" | \"subject\";\n      ownerSubjectId?: string;\n    },\n  ) => Promise<AcceptedConnectionUseResolution>;\n};\n\nexport type PermanentConnectionRefreshFailure = {\n  workspaceId: string;\n  connectionId: string;\n  connectionVersion: number;\n  subjectId: string | null;\n  providerDomain: string;\n  httpStatus: number;\n  oauthErrorCode: string | null;\n};\n\nexport type ConnectionTokenResolverOptions = {\n  /** Provider-aware transport override used by local/integration adapters. */\n  refreshTransport?: RefreshTransportOptions;\n  /**\n   * Optional provider adapter for an atomic, metadata-aware permanent refresh\n   * transition. Returning true means the adapter owned the transition (even if\n   * its CAS lost to newer truth); false falls back to generic needs_reauth.\n   */\n  transitionPermanentRefreshFailure?: (\n    failure: PermanentConnectionRefreshFailure,\n  ) => Promise<boolean>;\n};\n\nexport type RefreshTransportOptions = {\n  fetchImpl?: FetchLike;\n  dnsLookup?: DnsLookup;\n};\n\nconst inflight = new Map<string, Promise<ConnectionCredentialForBroker>>();\nconst REFRESH_WINDOW_MS = 60_000;\nconst CONNECTION_REFRESH_TIMEOUT_MS = 10_000;\n\nexport function buildConnectionTokenResolver(\n  db: Database,\n  settings: Settings,\n  deps: ConnectionBrokerDeps,\n  options: ConnectionTokenResolverOptions = {},\n): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult> {\n  type CredentialLookupInput = Pick<\n    ResolveConnectionCredentialInput,\n    \"workspaceId\" | \"connectionRef\" | \"subjectId\"\n  > & { expectedAuthorityGeneration?: number };\n  const load = async (\n    input: CredentialLookupInput,\n    lookupDb: Database = db,\n  ): Promise<ConnectionCredentialForBroker | null> => {\n    const subjectOwned = input.connectionRef.subjectScope === \"subject\";\n    if (subjectOwned && !input.subjectId) {\n      return null;\n    }\n    const request: ConnectionCredentialLookupInput = {\n      workspaceId: input.workspaceId,\n      providerDomain: input.connectionRef.providerDomain,\n      allowSubjectOwned: subjectOwned,\n      ...(subjectOwned ? { subjectId: input.subjectId! } : {}),\n      ...(input.expectedAuthorityGeneration !== undefined\n        ? { expectedAuthorityGeneration: input.expectedAuthorityGeneration }\n        : {}),\n    };\n    if (input.connectionRef.connectionId !== undefined) {\n      request.connectionId = input.connectionRef.connectionId;\n    }\n    if (input.connectionRef.kind !== undefined) {\n      request.kind = input.connectionRef.kind;\n    }\n    const credential = await deps.loadCredential(lookupDb, settings, request);\n    if (!credential) return null;\n    if (\n      input.expectedAuthorityGeneration !== undefined &&\n      credential.authorityGeneration !== input.expectedAuthorityGeneration\n    ) {\n      return null;\n    }\n    if (subjectOwned) {\n      return credential.subjectId === input.subjectId ? credential : null;\n    }\n    return credential.subjectId === null ? credential : null;\n  };\n\n  const snapshot = async (\n    cred: ConnectionCredentialForBroker,\n    ref: McpServerConnectionRef,\n    destinationUrl: string,\n    inputCredentialTarget: \"mcp\" | \"http_api\",\n    connectionUseAttribution?: ConnectionUseAttribution,\n    recordUsage = true,\n  ): Promise<ResolveConnectionCredentialResult> => {\n    if (cred.status !== \"active\") {\n      return authNeededForStatus(cred, ref);\n    }\n    if (!connectionBindingMatches(cred, ref, destinationUrl)) {\n      return authNeeded(ref, \"missing_connection\", cred.id);\n    }\n    const missingScopes = missingRequestedScopes(\n      ref.scopes,\n      cred.grantedScopes,\n      cred.providerDomain,\n    );\n    if (missingScopes.length > 0) {\n      return {\n        status: \"auth_needed\",\n        reason: \"insufficient_scope\",\n        providerDomain: ref.providerDomain,\n        ...(ref.provider ? { provider: ref.provider } : {}),\n        connectionId: cred.id,\n        scopes: missingScopes,\n        ...(ref.resource ? { resource: ref.resource } : {}),\n        ...(ref.selectedResources\n          ? { selectedResources: copySelectedResources(ref.selectedResources) }\n          : {}),\n      };\n    }\n    const material = credentialMaterialForConnection(cred, inputCredentialTarget);\n    if (material.status !== \"ok\") {\n      return {\n        status: \"auth_needed\",\n        reason: material.status === \"unsupported\" ? \"unsupported_auth\" : \"refresh_failed\",\n        providerDomain: ref.providerDomain,\n        ...(ref.provider ? { provider: ref.provider } : {}),\n        connectionId: cred.id,\n        ...(ref.scopes ? { scopes: ref.scopes } : {}),\n        ...(ref.resource ? { resource: ref.resource } : {}),\n        ...(ref.selectedResources\n          ? { selectedResources: copySelectedResources(ref.selectedResources) }\n          : {}),\n      };\n    }\n    if (recordUsage) {\n      await deps.recordUsed(db, cred.workspaceId, cred.id, cred.subjectId);\n    }\n    return {\n      status: \"ok\",\n      headers: material.headers,\n      ...(material.placements ? { placements: material.placements } : {}),\n      connectionId: cred.id,\n      connectionVersion: cred.version,\n      ...(cred.providerDomain.toLowerCase() === \"slack.com\"\n        ? { grantedScopes: normalizeSlackScopes(cred.grantedScopes) }\n        : {}),\n      ...(connectionUseAttribution ? { connectionUseAttribution } : {}),\n      expiresAt: cred.expiresAt,\n    };\n  };\n\n  const performRefresh = async (\n    cred: ConnectionCredentialForBroker,\n    ref: McpServerConnectionRef,\n    lockedDb: Database,\n  ): Promise<ConnectionCredentialForBroker> => {\n    const key = deps.keyBytes(settings);\n    if (!key) {\n      throw new Error(\"OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY is not configured\");\n    }\n    const refreshed = await measureMcpPhase(\"oauth_refresh\", () =>\n      deps.refresh(cred, ref, settings, options.refreshTransport),\n    );\n    const refreshRecord: ConnectionTokenRefreshInput = {\n      id: cred.id,\n      version: cred.version,\n      workspaceId: cred.workspaceId,\n      credentialEncrypted: deps.encrypt(key, JSON.stringify(refreshed.credential)),\n      expiresAt: refreshed.expiresAt,\n      lastRefreshAt: deps.now(),\n      subjectId: cred.subjectId,\n    };\n    if (refreshed.grantedScopes !== undefined) {\n      refreshRecord.grantedScopes = refreshed.grantedScopes;\n    }\n    if (refreshed.metadata !== undefined) {\n      refreshRecord.metadata = refreshed.metadata;\n    }\n    const persisted = await deps.recordRefresh(lockedDb, refreshRecord);\n    if (persisted) {\n      const current = await load(\n        {\n          workspaceId: cred.workspaceId,\n          connectionRef: { ...ref, connectionId: cred.id },\n          ...(cred.subjectId ? { subjectId: cred.subjectId } : {}),\n        },\n        lockedDb,\n      );\n      if (current) {\n        return current;\n      }\n    }\n    const winner = await load(\n      {\n        workspaceId: cred.workspaceId,\n        connectionRef: { ...ref, connectionId: cred.id },\n        ...(cred.subjectId ? { subjectId: cred.subjectId } : {}),\n      },\n      lockedDb,\n    );\n    if (winner?.status === \"active\") {\n      return winner;\n    }\n    throw new Error(\"connection credential changed during token refresh\");\n  };\n\n  const refreshSingleFlight = (\n    cred: ConnectionCredentialForBroker,\n    ref: McpServerConnectionRef,\n  ): Promise<ConnectionCredentialForBroker> => {\n    const key = `${cred.subjectId ?? \"workspace\"}:${cred.id}:${cred.version}`;\n    const existing = inflight.get(key);\n    if (existing) {\n      return measureMcpPhase(\"oauth_wait\", () => existing);\n    }\n    const lockWait = beginMcpPhase(\"oauth_wait\");\n    const promise = (deps.withRefreshLock ?? withConnectionRefreshLock)(\n      db,\n      cred,\n      async (lockedDb) => {\n        lockWait.end();\n        // A different worker may have rotated while this request waited. Never\n        // exchange the old token again, or switch to another authority generation.\n        const current = await load(\n          {\n            workspaceId: cred.workspaceId,\n            connectionRef: { ...ref, connectionId: cred.id },\n            ...(cred.subjectId ? { subjectId: cred.subjectId } : {}),\n          },\n          lockedDb,\n        );\n        if (!current || current.authorityGeneration !== cred.authorityGeneration)\n          throw new Error(\"Connection authority changed before token refresh\");\n        if (current.status !== \"active\" || current.version !== cred.version) return current;\n        return performRefresh(current, ref, lockedDb);\n      },\n    ).finally(() => {\n      // A lock acquisition failure must also close the diagnostic interval.\n      lockWait.end(\"failed\");\n      if (inflight.get(key) === promise) {\n        inflight.delete(key);\n      }\n    });\n    inflight.set(key, promise);\n    return promise;\n  };\n\n  return async (input) => {\n    const credentialResolutionMode = input.credentialResolutionMode ?? \"execution\";\n    let ref = input.connectionRef;\n    let subjectId = input.subjectId;\n    let credentialWorkspaceId = input.workspaceId;\n    let expectedAuthorityGeneration = input.expectedAuthorityGeneration;\n    let connectionUseAttribution: ConnectionUseAttribution | undefined;\n    if (ref.authoritySource === \"host\") {\n      return authNeeded(ref, \"unsupported_auth\", ref.connectionId);\n    }\n    // Repository-scoped provider bindings require a broker that can prove the\n    // selected-resource boundary. The generic standalone credential store has\n    // no provider-specific containment adapter, so it must fail closed instead\n    // of handing an account-wide token to the configured endpoint.\n    if (ref.selectedResources) {\n      return authNeeded(ref, \"resource_scope_unavailable\", ref.connectionId);\n    }\n    if (input.connectionUseContext !== undefined) {\n      if (!deps.authorizeAcceptedUse) {\n        return authNeeded(\n          ref,\n          ref.subjectScope === \"subject\" ? \"personal_authority_unavailable\" : \"missing_connection\",\n          ref.connectionId,\n        );\n      }\n      const connectionUseContext = input.connectionUseContext;\n      const authorization = await measureMcpPhase(\n        \"provider_authorization\",\n        () =>\n          deps.authorizeAcceptedUse!(db, {\n            ...connectionUseContext,\n            serverId: input.serverId,\n            ...(ref.connectionId ? { connectionId: ref.connectionId } : {}),\n            providerDomain: ref.providerDomain,\n            ...(ref.kind ? { connectionKind: ref.kind } : {}),\n            subjectScope: ref.subjectScope === \"subject\" ? \"subject\" : \"workspace\",\n            // An owner binding belongs only to the personal lanes. Interactive\n            // turns stamp the initiating human's subjectId on every credential\n            // request regardless of ref scope; forwarding it for a workspace ref\n            // would make the 0279 workspace lane deny the ambient shared row.\n            ...(ref.subjectScope === \"subject\" && subjectId ? { ownerSubjectId: subjectId } : {}),\n          }),\n        (result) => (result.status === \"authorized\" ? \"completed\" : \"rejected\"),\n      );\n      if (authorization.status === \"denied\") {\n        return authNeeded(\n          ref,\n          ref.subjectScope === \"subject\" ? \"personal_authority_unavailable\" : \"missing_connection\",\n          ref.connectionId,\n        );\n      }\n      if (\n        expectedAuthorityGeneration !== undefined &&\n        authorization.attribution.connectionGeneration !== expectedAuthorityGeneration\n      ) {\n        return authNeeded(\n          ref,\n          authorityReasonForScope(ref.subjectScope === \"subject\"),\n          ref.connectionId,\n        );\n      }\n      connectionUseAttribution = authorization.attribution;\n      expectedAuthorityGeneration = authorization.attribution.connectionGeneration;\n      const expectedPersonal = authorization.attribution.scope !== \"workspace\";\n      credentialWorkspaceId = authorization.originWorkspaceId;\n      subjectId = authorization.attribution.ownerSubjectId ?? undefined;\n      ref = {\n        ...ref,\n        connectionId: authorization.attribution.connectionId,\n        kind: authorization.connectionKind,\n        subjectScope: expectedPersonal ? \"subject\" : \"workspace\",\n      };\n    }\n    if (ref.subjectScope === \"subject\" && !subjectId) {\n      return authNeeded(ref, \"personal_authority_unavailable\", ref.connectionId);\n    }\n    let cred: ConnectionCredentialForBroker | null;\n    try {\n      cred = await load({\n        workspaceId: credentialWorkspaceId,\n        connectionRef: ref,\n        ...(subjectId ? { subjectId } : {}),\n        ...(expectedAuthorityGeneration !== undefined ? { expectedAuthorityGeneration } : {}),\n      });\n    } catch {\n      return authNeeded(ref, \"refresh_failed\");\n    }\n    if (!cred) {\n      return authNeeded(ref, \"missing_connection\");\n    }\n    if (cred.status !== \"active\") {\n      return authNeededForStatus(cred, ref);\n    }\n    // Reject an audience/destination mismatch before any provider-side refresh\n    // or usage update. Refreshing first would still create an unauthorized\n    // external side effect even though the token was never sent to the target.\n    if (!connectionBindingMatches(cred, ref, input.destinationUrl)) {\n      return authNeeded(ref, \"missing_connection\", cred.id);\n    }\n    const now = deps.now();\n    if (\n      credentialResolutionMode === \"preflight\" &&\n      cred.kind === \"oauth2\" &&\n      (input.forceRefresh === true ||\n        (cred.expiresAt !== null && cred.expiresAt.getTime() <= now.getTime()))\n    ) {\n      return authNeeded(ref, \"refresh_failed\", cred.id);\n    }\n    if (\n      credentialResolutionMode === \"execution\" &&\n      shouldRefresh(cred, input.forceRefresh === true, now)\n    ) {\n      try {\n        cred = await refreshSingleFlight(cred, ref);\n      } catch (error) {\n        // Only a rejected grant may poison the connection; transient failures\n        // (network errors, AS 5xx) leave it active so the next resolve retries.\n        if (isPermanentRefreshError(error)) {\n          let handled = false;\n          if (options.transitionPermanentRefreshFailure) {\n            try {\n              handled = await options.transitionPermanentRefreshFailure({\n                workspaceId: cred.workspaceId,\n                connectionId: cred.id,\n                connectionVersion: cred.version,\n                subjectId: cred.subjectId,\n                providerDomain: cred.providerDomain,\n                httpStatus: error.httpStatus,\n                oauthErrorCode: error.oauthErrorCode,\n              });\n            } catch {\n              handled = false;\n            }\n          }\n          if (!handled) {\n            await deps\n              // A personal credential may originate outside the workspace\n              // consuming it. Apply the CAS to the same row we refreshed.\n              .setStatus(db, cred.workspaceId, \"needs_reauth\", error.message, {\n                id: cred.id,\n                version: cred.version,\n                subjectId: cred.subjectId,\n              })\n              .catch(() => undefined);\n          }\n        }\n        return authNeeded(ref, \"refresh_failed\", cred.id);\n      }\n    }\n    if (\n      expectedAuthorityGeneration !== undefined &&\n      cred.authorityGeneration !== expectedAuthorityGeneration\n    ) {\n      return authNeeded(ref, authorityReasonForScope(ref.subjectScope === \"subject\"), cred.id);\n    }\n    return await snapshot(\n      cred,\n      ref,\n      input.destinationUrl,\n      input.credentialTarget ?? \"mcp\",\n      connectionUseAttribution,\n      credentialResolutionMode === \"execution\",\n    );\n  };\n}\n\nfunction authorityReasonForScope(personal: boolean): AuthNeededReason {\n  return personal ? \"personal_authority_unavailable\" : \"missing_connection\";\n}\n\nfunction connectionBindingMatches(\n  cred: Pick<ConnectionCredentialForBroker, \"providerDomain\" | \"kind\" | \"credential\" | \"metadata\">,\n  ref: McpServerConnectionRef,\n  destinationUrl: string,\n): boolean {\n  if (cred.providerDomain.toLowerCase() !== ref.providerDomain.toLowerCase()) return false;\n  if (ref.kind && cred.kind !== ref.kind) return false;\n\n  const credential = cred.credential as Record<string, unknown>;\n  const metadata = cred.metadata as Record<string, unknown>;\n  const boundMcpUrl = stringValue(credential.mcp_url) ?? stringValue(metadata.mcpUrl);\n  const destination = canonicalHttpUrl(destinationUrl);\n  if (!destination) return false;\n  if (boundMcpUrl) {\n    const binding = canonicalHttpUrl(boundMcpUrl);\n    if (\n      !binding ||\n      (destination !== binding &&\n        !(\n          binding === canonicalHttpUrl(OFFICIAL_GMAIL_MCP_RESOURCE) &&\n          isOfficialGmailRestDestination(destination, ref)\n        ) &&\n        !(\n          binding === canonicalHttpUrl(OFFICIAL_SLACK_MCP_URL) &&\n          isOfficialSlackRestDestination(destination, ref)\n        ))\n    ) {\n      return false;\n    }\n  } else if (!destinationHostMatchesProvider(destination, cred.providerDomain)) {\n    // Legacy/manual API-key rows may predate mcpUrl metadata. They are still\n    // host-bound to their canonical provider domain, never usable as an\n    // arbitrary bearer/header source for an unrelated MCP destination.\n    return false;\n  }\n  if (cred.kind !== \"oauth2\") return true;\n  const boundResource = stringValue(credential.resource) ?? stringValue(metadata.resource);\n  if (ref.resource) {\n    if (!boundResource) return false;\n    if (canonicalResource(ref.resource) !== canonicalResource(boundResource)) return false;\n  }\n  return true;\n}\n\n/** Credential-free preflight only. Physical requests still resolve credentials\n * and enforce their binding, current status and accepted-use authority. */\nexport function connectionMetadataMatchesBinding(\n  connection: ConnectionMetadata,\n  ref: McpServerConnectionRef,\n  destinationUrl: string,\n): boolean {\n  return (\n    connectionBindingMatches({ ...connection, credential: {} }, ref, destinationUrl) &&\n    missingRequestedScopes(ref.scopes, connection.grantedScopes, connection.providerDomain)\n      .length === 0\n  );\n}\n\n/** Only the reviewed Slack bridge methods may reuse the hosted resource grant. */\nfunction isOfficialSlackRestDestination(\n  destinationUrl: string,\n  ref: McpServerConnectionRef,\n): boolean {\n  if (\n    ref.providerDomain.toLowerCase() !== \"slack.com\" ||\n    ref.kind !== \"oauth2\" ||\n    (ref.subjectScope !== undefined &&\n      ref.subjectScope !== \"subject\" &&\n      ref.subjectScope !== \"workspace\")\n  )\n    return false;\n  const url = new URL(destinationUrl);\n  // Private file bytes for files.info results are a separate reviewed host.\n  if (isSlackPrivateFileUrl(url)) return true;\n  return (\n    url.origin === \"https://slack.com\" &&\n    !url.username &&\n    !url.password &&\n    [\n      \"auth.test\",\n      \"conversations.list\",\n      \"conversations.info\",\n      \"conversations.members\",\n      \"users.list\",\n      \"users.info\",\n      \"conversations.history\",\n      \"conversations.replies\",\n      \"files.info\",\n      \"conversations.open\",\n      \"chat.postMessage\",\n    ].some((method) => url.pathname === `/api/${method}`)\n  );\n}\n\nfunction destinationHostMatchesProvider(destinationUrl: string, providerDomain: string): boolean {\n  const destinationHost = new URL(destinationUrl).hostname.toLowerCase();\n  const provider = providerDomain\n    .trim()\n    .toLowerCase()\n    .replace(/^\\.+|\\.+$/g, \"\");\n  return (\n    Boolean(provider) && (destinationHost === provider || destinationHost.endsWith(`.${provider}`))\n  );\n}\n\nfunction canonicalHttpUrl(value: string): string | null {\n  try {\n    const url = new URL(value);\n    if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return null;\n    url.hash = \"\";\n    url.hostname = url.hostname.toLowerCase();\n    if (\n      (url.protocol === \"https:\" && url.port === \"443\") ||\n      (url.protocol === \"http:\" && url.port === \"80\")\n    ) {\n      url.port = \"\";\n    }\n    url.pathname = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n    return url.toString();\n  } catch {\n    return null;\n  }\n}\n\nfunction canonicalResource(value: string): string {\n  return canonicalHttpUrl(value) ?? value.trim();\n}\n\nexport class ConnectionRefreshHttpError extends Error {\n  readonly httpStatus: number;\n  readonly oauthErrorCode: string | null;\n\n  constructor(httpStatus: number, oauthErrorCode: string | null = null) {\n    super(`connection refresh failed with HTTP ${httpStatus}`);\n    this.name = \"ConnectionRefreshHttpError\";\n    this.httpStatus = httpStatus;\n    this.oauthErrorCode = oauthErrorCode;\n  }\n}\n\n// The token endpoint rejecting the grant itself means re-auth is the only way\n// forward. 429 (throttling) and 408 are transient despite being 4xx; network\n// failures and AS 5xx are likewise retryable.\nfunction isPermanentRefreshError(error: unknown): error is ConnectionRefreshHttpError {\n  return (\n    error instanceof ConnectionRefreshHttpError &&\n    error.httpStatus >= 400 &&\n    error.httpStatus < 500 &&\n    error.httpStatus !== 408 &&\n    error.httpStatus !== 429\n  );\n}\n\nfunction shouldRefresh(cred: ConnectionCredentialForBroker, force: boolean, now: Date): boolean {\n  if (cred.kind !== \"oauth2\") {\n    return false;\n  }\n  if (force) {\n    return true;\n  }\n  if (!cred.expiresAt) {\n    return false;\n  }\n  return cred.expiresAt.getTime() <= now.getTime() + REFRESH_WINDOW_MS;\n}\n\nfunction authNeeded(\n  ref: McpServerConnectionRef,\n  reason: AuthNeededReason,\n  connectionId?: string,\n): ResolveConnectionCredentialResult {\n  return {\n    status: \"auth_needed\",\n    reason,\n    providerDomain: ref.providerDomain,\n    ...(ref.provider ? { provider: ref.provider } : {}),\n    ...(connectionId ? { connectionId } : {}),\n    ...(ref.scopes ? { scopes: ref.scopes } : {}),\n    ...(ref.resource ? { resource: ref.resource } : {}),\n    ...(ref.selectedResources\n      ? { selectedResources: copySelectedResources(ref.selectedResources) }\n      : {}),\n  };\n}\n\nfunction authNeededForStatus(\n  cred: ConnectionCredentialForBroker,\n  ref: McpServerConnectionRef,\n): ResolveConnectionCredentialResult {\n  if (cred.status === \"revoked\") {\n    return authNeeded(ref, \"missing_connection\", cred.id);\n  }\n  return authNeeded(\n    ref,\n    cred.expiresAt && cred.expiresAt.getTime() <= Date.now() ? \"expired\" : \"refresh_failed\",\n    cred.id,\n  );\n}\n\nfunction missingRequestedScopes(\n  requested: string[] | undefined,\n  granted: string[],\n  providerDomain: string,\n): string[] {\n  if (!requested?.length) {\n    return [];\n  }\n  const actual =\n    providerDomain.toLowerCase() === \"slack.com\" ? normalizeSlackScopes(granted) : granted;\n  const grantedSet = new Set(actual.map((scope) => connectionScopeKey(providerDomain, scope)));\n  return requested.filter((scope) => !grantedSet.has(connectionScopeKey(providerDomain, scope)));\n}\n\n/**\n * Normalizes an OAuth token_type into the Authorization scheme to send. RFC 6750\n * says the scheme is case-insensitive, but some MCP servers (e.g. Linear) reject\n * a lowercase `bearer` — so a `bearer`/`BEARER` (or absent) token_type is sent as\n * the canonical `Bearer`. A non-bearer scheme is passed through unchanged.\n */\nexport function normalizeBearerScheme(tokenType: string | null | undefined): string {\n  return !tokenType || /^bearer$/i.test(tokenType) ? \"Bearer\" : tokenType;\n}\n\ntype ConnectionCredentialMaterial =\n  | {\n      status: \"ok\";\n      headers: Record<string, string>;\n      placements?: ConnectionCredentialPlacement[];\n    }\n  | { status: \"invalid\" | \"unsupported\" };\n\nfunction credentialMaterialForConnection(\n  cred: ConnectionCredentialForBroker,\n  target: \"mcp\" | \"http_api\",\n): ConnectionCredentialMaterial {\n  if (cred.kind === \"oauth2\") {\n    const accessToken = stringValue((cred.credential as { access_token?: unknown }).access_token);\n    if (!accessToken) {\n      return { status: \"invalid\" };\n    }\n    return {\n      status: \"ok\",\n      headers: {\n        authorization: `${normalizeBearerScheme(stringValue((cred.credential as { token_type?: unknown }).token_type))} ${accessToken}`,\n      },\n    };\n  }\n  const rawPlacements = (cred.credential as { placements?: unknown }).placements;\n  if (rawPlacements !== undefined) {\n    let placements: ConnectionCredentialPlacement[];\n    try {\n      placements = normalizedCredentialPlacements(rawPlacements);\n    } catch {\n      return { status: \"invalid\" };\n    }\n    if (target !== \"http_api\" && placements.some((placement) => placement.carrier !== \"header\")) {\n      return { status: \"unsupported\" };\n    }\n    return {\n      status: \"ok\",\n      headers: headerMapForPlacements(placements),\n      placements,\n    };\n  }\n  try {\n    const headers = normalizedCredentialHeaders(\n      stringRecord((cred.credential as { headers?: unknown }).headers) ?? {},\n    );\n    return { status: \"ok\", headers };\n  } catch {\n    return { status: \"invalid\" };\n  }\n}\n\nexport async function refreshOAuthConnectionCredential(\n  cred: ConnectionCredentialForBroker,\n  ref: McpServerConnectionRef,\n  settings: Settings,\n  transportOptions: RefreshTransportOptions = {},\n): Promise<{\n  credential: Record<string, unknown>;\n  expiresAt: Date | null;\n  grantedScopes?: string[];\n  metadata?: Record<string, unknown>;\n}> {\n  if (cred.kind !== \"oauth2\") {\n    return {\n      credential: cred.credential,\n      expiresAt: cred.expiresAt,\n      grantedScopes: cred.grantedScopes,\n    };\n  }\n  const refreshToken = stringValue((cred.credential as { refresh_token?: unknown }).refresh_token);\n  const personalGitHubMetadata = PersonalGitHubConnectionMetadata.safeParse(cred.metadata);\n  const personalGitHub =\n    cred.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    personalGitHubMetadata.success;\n  const storedTokenEndpoint =\n    stringValue((cred.credential as { token_endpoint?: unknown }).token_endpoint) ??\n    stringValue((cred.metadata as { tokenEndpoint?: unknown }).tokenEndpoint) ??\n    stringValue((cred.metadata as { token_endpoint?: unknown }).token_endpoint);\n  const tokenEndpoint = personalGitHub ? PERSONAL_GITHUB_TOKEN_URL : storedTokenEndpoint;\n  if (!refreshToken || !tokenEndpoint) {\n    throw new Error(\"connection has no refresh token endpoint\");\n  }\n  if (personalGitHub && storedTokenEndpoint !== PERSONAL_GITHUB_TOKEN_URL) {\n    throw new ConnectionRefreshHttpError(401, \"client_unavailable\");\n  }\n  let validatedTokenEndpoint: string;\n  try {\n    validatedTokenEndpoint = validateHttpUrl(tokenEndpoint, {\n      label: \"OAuth refresh token endpoint\",\n      allowLoopbackHttp: settings.environment === \"local\" || settings.environment === \"test\",\n    });\n  } catch {\n    throw new Error(\"connection has an invalid refresh token endpoint\");\n  }\n  const body = new URLSearchParams();\n  body.set(\"grant_type\", \"refresh_token\");\n  body.set(\"refresh_token\", refreshToken);\n  // Public clients (token_endpoint_auth_method \"none\") must identify themselves\n  // in the token request body (RFC 6749 §3.2.1); grant flows persist the\n  // client_id they authorized with into the bundle/metadata.\n  const clientId =\n    stringValue((cred.credential as { client_id?: unknown }).client_id) ??\n    stringValue((cred.metadata as { clientId?: unknown }).clientId) ??\n    stringValue((cred.metadata as { client_id?: unknown }).client_id);\n  const clientSecret = personalGitHub\n    ? settings.githubPersonalOauthClientSecret\n    : stringValue((cred.credential as { client_secret?: unknown }).client_secret);\n  const authMethod =\n    stringValue(\n      (cred.credential as { token_endpoint_auth_method?: unknown }).token_endpoint_auth_method,\n    ) ?? \"none\";\n  if (\n    personalGitHub &&\n    (!settings.githubPersonalOauthEnabled ||\n      !clientId ||\n      clientId !== settings.githubPersonalOauthClientId ||\n      personalGitHubMetadata.data.oauthEnvironment !== settings.environment ||\n      personalGitHubMetadata.data.oauthClientMarker !==\n        createHash(\"sha256\").update(clientId).digest(\"hex\").slice(0, 32) ||\n      !clientSecret)\n  ) {\n    throw new ConnectionRefreshHttpError(401, \"client_unavailable\");\n  }\n  if (clientId) {\n    body.set(\"client_id\", clientId);\n  }\n  const tokenRequestEncoding =\n    stringValue(\n      (cred.credential as { token_request_encoding?: unknown }).token_request_encoding,\n    ) === \"json\"\n      ? \"json\"\n      : \"form\";\n  const headers: Record<string, string> = {\n    \"content-type\":\n      tokenRequestEncoding === \"json\" ? \"application/json\" : \"application/x-www-form-urlencoded\",\n  };\n  if (clientSecret && authMethod === \"client_secret_post\") {\n    body.set(\"client_secret\", clientSecret);\n  } else if (clientId && clientSecret && authMethod === \"client_secret_basic\") {\n    headers.authorization = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\")}`;\n  }\n  const resource =\n    ref.resource ?? stringValue((cred.credential as { resource?: unknown }).resource);\n  const resourceParameterSupported =\n    (cred.credential as { resource_parameter_supported?: unknown }).resource_parameter_supported !==\n    false;\n  if (resource && resourceParameterSupported) {\n    body.set(\"resource\", resource);\n  }\n  const scopeParameterSupported =\n    (cred.credential as { scope_parameter_supported?: unknown }).scope_parameter_supported !==\n    false;\n  if (ref.scopes?.length && scopeParameterSupported) {\n    body.set(\"scope\", ref.scopes.join(\" \"));\n  }\n  const requestBody: BodyInit =\n    tokenRequestEncoding === \"json\" ? JSON.stringify(Object.fromEntries(body.entries())) : body;\n  const response = await pinnedFetch(\n    validatedTokenEndpoint,\n    {\n      method: \"POST\",\n      headers,\n      body: requestBody,\n      signal: AbortSignal.timeout(CONNECTION_REFRESH_TIMEOUT_MS),\n    },\n    settings,\n    {\n      fetchImpl: transportOptions.fetchImpl ?? undiciFetch,\n      ...(transportOptions.dnsLookup ? { dnsLookup: transportOptions.dnsLookup } : {}),\n      label: \"OAuth token endpoint\",\n      requireHttpsOutsideLocalTest: true,\n    },\n  );\n  if (response.status >= 300 && response.status < 400) {\n    await cancelResponseBody(response);\n    throw new ConnectionRefreshHttpError(response.status);\n  }\n  if (!response.ok) {\n    throw new ConnectionRefreshHttpError(\n      response.status,\n      await readOAuthRefreshErrorCode(response),\n    );\n  }\n  const payload = await readResponseJsonBounded<Record<string, unknown>>(\n    response,\n    OAUTH_MAX_RESPONSE_BYTES,\n    \"OAuth refresh token response\",\n  );\n  const accessToken = stringValue(payload.access_token);\n  if (!accessToken) {\n    throw new Error(\"connection refresh response did not include access_token\");\n  }\n  const expiresAt = expiresAtFromTokenResponse(payload, cred.expiresAt);\n  const scopeText = stringValue(payload.scope);\n  const returnedScopes = scopeText?.split(/[\\s,]+/).filter(Boolean) ?? [];\n  // A successful Microsoft refresh proves offline access, although Microsoft\n  // reports only access-token permissions in the response's scope field.\n  if (\n    scopeText &&\n    ref.providerDomain.toLowerCase() === \"graph.microsoft.com\" &&\n    !returnedScopes.some((scope) => scope.toLowerCase() === \"offline_access\")\n  ) {\n    returnedScopes.push(\"offline_access\");\n  }\n  const refreshTokenExpiresIn =\n    typeof payload.refresh_token_expires_in === \"number\"\n      ? payload.refresh_token_expires_in\n      : undefined;\n  const refreshTokenExpiresAt =\n    personalGitHub && refreshTokenExpiresIn && refreshTokenExpiresIn > 0\n      ? new Date(Date.now() + refreshTokenExpiresIn * 1000).toISOString()\n      : null;\n  if (\n    personalGitHub &&\n    scopeText &&\n    (returnedScopes.length !== PERSONAL_GITHUB_REQUESTED_SCOPES.length ||\n      returnedScopes.some((scope) => !PERSONAL_GITHUB_REQUESTED_SCOPES.includes(scope as \"repo\")))\n  ) {\n    throw new ConnectionRefreshHttpError(401, \"scope_changed\");\n  }\n  const nextCredential = {\n    ...cred.credential,\n    access_token: accessToken,\n    refresh_token: stringValue(payload.refresh_token) ?? refreshToken,\n    token_type:\n      stringValue(payload.token_type) ??\n      stringValue((cred.credential as { token_type?: unknown }).token_type) ??\n      \"Bearer\",\n    ...(expiresAt ? { expires_at: expiresAt.toISOString() } : {}),\n    ...(resource ? { resource } : {}),\n    ...(scopeText\n      ? {\n          scope:\n            ref.providerDomain.toLowerCase() === \"graph.microsoft.com\"\n              ? returnedScopes.join(\" \")\n              : scopeText,\n        }\n      : {}),\n    ...(refreshTokenExpiresAt ? { refresh_token_expires_at: refreshTokenExpiresAt } : {}),\n    ...(clientSecret && !personalGitHub\n      ? { client_secret: clientSecret, token_endpoint_auth_method: authMethod }\n      : {}),\n  };\n  return {\n    credential: nextCredential,\n    expiresAt,\n    ...(personalGitHub\n      ? { grantedScopes: [...PERSONAL_GITHUB_REQUESTED_SCOPES] }\n      : scopeText\n        ? { grantedScopes: returnedScopes }\n        : {}),\n    ...(refreshTokenExpiresAt\n      ? {\n          metadata: PersonalGitHubConnectionMetadata.parse({\n            ...personalGitHubMetadata.data,\n            refreshTokenExpiresAt,\n          }),\n        }\n      : {}),\n  };\n}\n\nasync function readOAuthRefreshErrorCode(response: Response): Promise<string | null> {\n  try {\n    const payload = await readResponseJsonBounded<Record<string, unknown>>(\n      response,\n      OAUTH_MAX_RESPONSE_BYTES,\n      \"OAuth refresh error response\",\n    );\n    const code = stringValue(payload.error);\n    return code && /^[a-z0-9_.-]{1,64}$/i.test(code) ? code : null;\n  } catch {\n    await cancelResponseBody(response);\n    return null;\n  }\n}\n\nfunction expiresAtFromTokenResponse(\n  payload: Record<string, unknown>,\n  fallback: Date | null,\n): Date | null {\n  const expiresAt = stringValue(payload.expires_at);\n  if (expiresAt) {\n    const parsed = new Date(expiresAt);\n    return Number.isNaN(parsed.getTime()) ? fallback : parsed;\n  }\n  const expiresIn = typeof payload.expires_in === \"number\" ? payload.expires_in : undefined;\n  if (expiresIn && Number.isFinite(expiresIn) && expiresIn > 0) {\n    return new Date(Date.now() + expiresIn * 1000);\n  }\n  return fallback;\n}\n\nfunction stringRecord(value: unknown): Record<string, string> | null {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) {\n    return null;\n  }\n  const out: Record<string, string> = {};\n  for (const [key, raw] of Object.entries(value)) {\n    if (typeof raw !== \"string\") {\n      return null;\n    }\n    out[key] = raw;\n  }\n  return out;\n}\n\nfunction stringValue(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\nasync function cancelResponseBody(response: Response): Promise<void> {\n  await response.body?.cancel().catch(() => undefined);\n}\n","import { sql } from \"drizzle-orm\";\nimport { setSubjectRlsContext, withRlsContext, type Database } from \"./database\";\nimport type { ConnectionCredentialForBroker } from \"./connection-token-resolver\";\n\n/** Serialize rotating-token exchange across workers, not only within one process. */\nexport async function withConnectionRefreshLock<T>(\n  db: Database,\n  credential: ConnectionCredentialForBroker,\n  work: (lockedDb: Database) => Promise<T>,\n): Promise<T> {\n  return withRlsContext(\n    db,\n    { accountId: credential.accountId, workspaceId: credential.workspaceId },\n    async (tx) => {\n      if (credential.subjectId) await setSubjectRlsContext(tx, credential.subjectId);\n      await tx.execute(\n        sql`select pg_advisory_xact_lock(hashtextextended(${`connection-refresh:${credential.id}`}, 0))`,\n      );\n      return work(tx);\n    },\n  );\n}\n","/**\n * Canonical comparison key for provider-reported OAuth scopes.\n *\n * Google may return the canonical userinfo scope URLs after the application\n * requested the standard `email` / `profile` aliases. Microsoft scope names\n * are case-insensitive. All other providers retain exact comparison.\n */\nexport function connectionScopeKey(providerDomain: string, value: string): string {\n  const scope = value.trim();\n  const domain = providerDomain.toLowerCase();\n  if (domain === \"googleapis.com\" || domain.endsWith(\".googleapis.com\")) {\n    if (scope === \"email\" || scope === \"https://www.googleapis.com/auth/userinfo.email\") {\n      return \"google:email\";\n    }\n    if (scope === \"profile\" || scope === \"https://www.googleapis.com/auth/userinfo.profile\") {\n      return \"google:profile\";\n    }\n  }\n  return domain === \"graph.microsoft.com\" ? scope.toLowerCase() : scope;\n}\n"],"mappings":";;;;;;AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe,uBAAuB;AAgB/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,wBAAwB;AACjC,SAAS,cAAc;;;ACtCvB,SAAS,WAAW;AAKpB,eAAsB,0BACpB,IACA,YACA,MACY;AACZ,SAAO;AAAA,IACL;AAAA,IACA,EAAE,WAAW,WAAW,WAAW,aAAa,WAAW,YAAY;AAAA,IACvE,OAAO,OAAO;AACZ,UAAI,WAAW,UAAW,OAAM,qBAAqB,IAAI,WAAW,SAAS;AAC7E,YAAM,GAAG;AAAA,QACP,oDAAoD,sBAAsB,WAAW,EAAE,EAAE;AAAA,MAC3F;AACA,aAAO,KAAK,EAAE;AAAA,IAChB;AAAA,EACF;AACF;;;ACdO,SAAS,mBAAmB,gBAAwB,OAAuB;AAChF,QAAM,QAAQ,MAAM,KAAK;AACzB,QAAM,SAAS,eAAe,YAAY;AAC1C,MAAI,WAAW,oBAAoB,OAAO,SAAS,iBAAiB,GAAG;AACrE,QAAI,UAAU,WAAW,UAAU,kDAAkD;AACnF,aAAO;AAAA,IACT;AACA,QAAI,UAAU,aAAa,UAAU,oDAAoD;AACvF,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,WAAW,wBAAwB,MAAM,YAAY,IAAI;AAClE;;;AF6BA,IAAM,4BAA4B;AAClC,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAC5B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAC5B,IAAM,+BAA+B,oBAAI,IAAI;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAkHD,IAAM,8BAA8B;AACpC,IAAM,2BAA2B;AASjC,SAAS,+BACP,gBACA,KACS;AACT,MACE,IAAI,eAAe,YAAY,MAAM,6BACrC,IAAI,SAAS,YACb,IAAI,iBAAiB,WACrB;AACA,WAAO;AAAA,EACT;AACA,QAAM,cAAc,IAAI,IAAI,cAAc;AAC1C,SACE,YAAY,aAAa,YACzB,YAAY,SAAS,YAAY,MAAM,6BACtC,YAAY,aAAa,wBACxB,YAAY,SAAS,WAAW,qBAAqB;AAE3D;AASA,SAAS,sBACP,WAC8B;AAC9B,MAAI,UAAU,WAAW,KAAK,UAAU,SAAS,KAAK;AACpD,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,UAAU,IAAI,CAAC,aAAa;AACjC,QACE,SAAS,SAAS,gBAClB,OAAO,SAAS,OAAO,YACvB,SAAS,GAAG,WAAW,KACvB,SAAS,GAAG,SAAS,KACrB;AACA,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,UAAM,MAAM,GAAG,SAAS,IAAI,KAAK,SAAS,EAAE;AAC5C,QAAI,KAAK,IAAI,GAAG,GAAG;AACjB,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,SAAK,IAAI,GAAG;AACZ,WAAO,EAAE,MAAM,SAAS,MAAM,IAAI,SAAS,GAAG;AAAA,EAChD,CAAC;AACH;AAEO,SAAS,4BACd,SACA,aAAa,OACW;AACxB,QAAM,UAAU,OAAO,QAAQ,OAAO;AACtC,MAAK,CAAC,cAAc,QAAQ,WAAW,KAAM,QAAQ,SAAS,IAAI;AAChE,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,QAAM,aAAqC,CAAC;AAC5C,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QACE,KAAK,SAAS,OACd,CAAC,oBAAoB,KAAK,IAAI,KAC9B,MAAM,WAAW,KACjB,MAAM,SAAS,SACf,WAAW,KAAK,KAAK,KACrB,6BAA6B,IAAI,KAAK,YAAY,CAAC,KACnD,KAAK,YAAY,EAAE,WAAW,MAAM,GACpC;AACA,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,QAAI,OAAO,KAAK,UAAU,EAAE,KAAK,CAAC,aAAa,SAAS,YAAY,MAAM,KAAK,YAAY,CAAC,GAAG;AAC7F,YAAM,IAAI,MAAM,kDAAkD;AAAA,IACpE;AACA,eAAW,IAAI,IAAI;AAAA,EACrB;AACA,SAAO;AACT;AAEO,IAAM,iCACX;AAQK,SAAS,gCACd,YACe;AACf,MAAI,WAAW,eAAe,QAAW;AACvC,QAAI;AACF,qCAA+B,WAAW,UAAU;AACpD,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,kCAAkC,wBAAwB,KAAK,CAAC,MAAM,8BAA8B;AAAA,IAC7G;AAAA,EACF;AACA,MAAI,WAAW,YAAY,QAAW;AACpC,UAAM,UAAU,aAAa,WAAW,OAAO;AAC/C,QAAI,CAAC,SAAS;AACZ,aAAO,8DAA8D,8BAA8B;AAAA,IACrG;AACA,QAAI;AACF,kCAA4B,OAAO;AACnC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,+BAA+B,wBAAwB,KAAK,CAAC,MAAM,8BAA8B;AAAA,IAC1G;AAAA,EACF;AACA,QAAM,WAAW,OAAO,KAAK,UAAU,EAAE;AAAA,IACvC,CAAC,QAAQ,QAAQ,aAAa,QAAQ;AAAA,EACxC;AACA,SAAO,uEACL,SAAS,SAAS,IACd,oBAAoB,SACjB,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,QAAQ,KAAK,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,EAC7C,KAAK,IAAI,CAAC,qBACb,EACN,KAAK,8BAA8B;AACrC;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,iBAAiB,QACpB,MAAM,QAAQ,QAAQ,oCAAoC,EAAE,IAC5D;AACN;AAEA,SAAS,+BAA+B,OAAiD;AACvF,MAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,KAAK,MAAM,SAAS,2BAA2B;AAC3F,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM,IAAI,CAAC,QAAQ;AACxB,QAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACzD,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,UAAM,SAAS;AACf,QACE,OAAO,KAAK,MAAM,EAAE;AAAA,MAClB,CAACA,SAAQA,SAAQ,aAAaA,SAAQ,UAAUA,SAAQ,WAAWA,SAAQ;AAAA,IAC7E,GACA;AACA,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,UAAM,UAAU,OAAO;AACvB,UAAM,OAAO,OAAO;AACpB,UAAM,kBAAkB,OAAO;AAC/B,UAAM,SAAS,OAAO;AACtB,QACG,YAAY,YAAY,YAAY,WAAW,YAAY,YAC5D,OAAO,SAAS,YAChB,KAAK,WAAW,KAChB,OAAO,WAAW,IAAI,IAAI,6BAC1B,OAAO,oBAAoB,YAC3B,gBAAgB,WAAW,KAC1B,OAAO,WAAW,eAAe,OAAO,WAAW,YACpD,WAAW,KAAK,IAAI,KACpB,WAAW,KAAK,eAAe,KAC9B,OAAO,WAAW,YAAY,WAAW,KAAK,MAAM,KACrD,OAAO,WAAW,GAAG,OAAO,WAAW,WAAW,SAAS,EAAE,GAAG,eAAe,EAAE,IAC/E,4BACF;AACA,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,UAAM,iBAAiB,YAAY,WAAW,KAAK,YAAY,IAAI;AACnE,QACG,YAAY,aACV,CAAC,oBAAoB,KAAK,IAAI,KAC7B,6BAA6B,IAAI,cAAc,KAC/C,eAAe,WAAW,MAAM,MACnC,YAAY,WAAW,CAAC,mBAAmB,KAAK,IAAI,KACpD,YAAY,aACV,CAAC,oBAAoB,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,UAAU,EAAE,GAAG,eAAe,EAAE,IAClF;AACA,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,UAAM,MAAM,GAAG,OAAO,KAAK,cAAc;AACzC,QAAI,KAAK,IAAI,GAAG,GAAG;AACjB,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,SAAK,IAAI,GAAG;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,GAAI,OAAO,WAAW,YAAY,OAAO,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,IACtE;AAAA,EACF,CAAC;AACH;AAEA,SAAS,uBACP,YACwB;AACxB,QAAM,UAAkC,CAAC;AACzC,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,YAAY,UAAU;AAClC,cAAQ,UAAU,IAAI,IAAI,GAAG,UAAU,UAAU,EAAE,GAAG,UAAU,KAAK;AAAA,IACvE;AAAA,EACF;AACA,SAAO;AACT;AAqEA,IAAM,WAAW,oBAAI,IAAoD;AACzE,IAAM,oBAAoB;AAC1B,IAAM,gCAAgC;AAE/B,SAAS,6BACd,IACA,UACA,MACA,UAA0C,CAAC,GAC8C;AAKzF,QAAM,OAAO,OACX,OACA,WAAqB,OAC6B;AAClD,UAAM,eAAe,MAAM,cAAc,iBAAiB;AAC1D,QAAI,gBAAgB,CAAC,MAAM,WAAW;AACpC,aAAO;AAAA,IACT;AACA,UAAM,UAA2C;AAAA,MAC/C,aAAa,MAAM;AAAA,MACnB,gBAAgB,MAAM,cAAc;AAAA,MACpC,mBAAmB;AAAA,MACnB,GAAI,eAAe,EAAE,WAAW,MAAM,UAAW,IAAI,CAAC;AAAA,MACtD,GAAI,MAAM,gCAAgC,SACtC,EAAE,6BAA6B,MAAM,4BAA4B,IACjE,CAAC;AAAA,IACP;AACA,QAAI,MAAM,cAAc,iBAAiB,QAAW;AAClD,cAAQ,eAAe,MAAM,cAAc;AAAA,IAC7C;AACA,QAAI,MAAM,cAAc,SAAS,QAAW;AAC1C,cAAQ,OAAO,MAAM,cAAc;AAAA,IACrC;AACA,UAAM,aAAa,MAAM,KAAK,eAAe,UAAU,UAAU,OAAO;AACxE,QAAI,CAAC,WAAY,QAAO;AACxB,QACE,MAAM,gCAAgC,UACtC,WAAW,wBAAwB,MAAM,6BACzC;AACA,aAAO;AAAA,IACT;AACA,QAAI,cAAc;AAChB,aAAO,WAAW,cAAc,MAAM,YAAY,aAAa;AAAA,IACjE;AACA,WAAO,WAAW,cAAc,OAAO,aAAa;AAAA,EACtD;AAEA,QAAM,WAAW,OACf,MACA,KACA,gBACA,uBACA,0BACA,cAAc,SACiC;AAC/C,QAAI,KAAK,WAAW,UAAU;AAC5B,aAAO,oBAAoB,MAAM,GAAG;AAAA,IACtC;AACA,QAAI,CAAC,yBAAyB,MAAM,KAAK,cAAc,GAAG;AACxD,aAAO,WAAW,KAAK,sBAAsB,KAAK,EAAE;AAAA,IACtD;AACA,UAAM,gBAAgB;AAAA,MACpB,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AACA,QAAI,cAAc,SAAS,GAAG;AAC5B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,gBAAgB,IAAI;AAAA,QACpB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,QACjD,cAAc,KAAK;AAAA,QACnB,QAAQ;AAAA,QACR,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,QACjD,GAAI,IAAI,oBACJ,EAAE,mBAAmB,sBAAsB,IAAI,iBAAiB,EAAE,IAClE,CAAC;AAAA,MACP;AAAA,IACF;AACA,UAAM,WAAW,gCAAgC,MAAM,qBAAqB;AAC5E,QAAI,SAAS,WAAW,MAAM;AAC5B,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,SAAS,WAAW,gBAAgB,qBAAqB;AAAA,QACjE,gBAAgB,IAAI;AAAA,QACpB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,QACjD,cAAc,KAAK;AAAA,QACnB,GAAI,IAAI,SAAS,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,QAC3C,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,QACjD,GAAI,IAAI,oBACJ,EAAE,mBAAmB,sBAAsB,IAAI,iBAAiB,EAAE,IAClE,CAAC;AAAA,MACP;AAAA,IACF;AACA,QAAI,aAAa;AACf,YAAM,KAAK,WAAW,IAAI,KAAK,aAAa,KAAK,IAAI,KAAK,SAAS;AAAA,IACrE;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,SAAS;AAAA,MAClB,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC;AAAA,MACjE,cAAc,KAAK;AAAA,MACnB,mBAAmB,KAAK;AAAA,MACxB,GAAI,KAAK,eAAe,YAAY,MAAM,cACtC,EAAE,eAAe,qBAAqB,KAAK,aAAa,EAAE,IAC1D,CAAC;AAAA,MACL,GAAI,2BAA2B,EAAE,yBAAyB,IAAI,CAAC;AAAA,MAC/D,WAAW,KAAK;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,iBAAiB,OACrB,MACA,KACA,aAC2C;AAC3C,UAAM,MAAM,KAAK,SAAS,QAAQ;AAClC,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,YAAY,MAAM;AAAA,MAAgB;AAAA,MAAiB,MACvD,KAAK,QAAQ,MAAM,KAAK,UAAU,QAAQ,gBAAgB;AAAA,IAC5D;AACA,UAAM,gBAA6C;AAAA,MACjD,IAAI,KAAK;AAAA,MACT,SAAS,KAAK;AAAA,MACd,aAAa,KAAK;AAAA,MAClB,qBAAqB,KAAK,QAAQ,KAAK,KAAK,UAAU,UAAU,UAAU,CAAC;AAAA,MAC3E,WAAW,UAAU;AAAA,MACrB,eAAe,KAAK,IAAI;AAAA,MACxB,WAAW,KAAK;AAAA,IAClB;AACA,QAAI,UAAU,kBAAkB,QAAW;AACzC,oBAAc,gBAAgB,UAAU;AAAA,IAC1C;AACA,QAAI,UAAU,aAAa,QAAW;AACpC,oBAAc,WAAW,UAAU;AAAA,IACrC;AACA,UAAM,YAAY,MAAM,KAAK,cAAc,UAAU,aAAa;AAClE,QAAI,WAAW;AACb,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,UACE,aAAa,KAAK;AAAA,UAClB,eAAe,EAAE,GAAG,KAAK,cAAc,KAAK,GAAG;AAAA,UAC/C,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,QACxD;AAAA,QACA;AAAA,MACF;AACA,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,eAAe,EAAE,GAAG,KAAK,cAAc,KAAK,GAAG;AAAA,QAC/C,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,UAAU;AAC/B,aAAO;AAAA,IACT;AACA,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAEA,QAAM,sBAAsB,CAC1B,MACA,QAC2C;AAC3C,UAAM,MAAM,GAAG,KAAK,aAAa,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO;AACvE,UAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAI,UAAU;AACZ,aAAO,gBAAgB,cAAc,MAAM,QAAQ;AAAA,IACrD;AACA,UAAM,WAAW,cAAc,YAAY;AAC3C,UAAM,WAAW,KAAK,mBAAmB;AAAA,MACvC;AAAA,MACA;AAAA,MACA,OAAO,aAAa;AAClB,iBAAS,IAAI;AAGb,cAAM,UAAU,MAAM;AAAA,UACpB;AAAA,YACE,aAAa,KAAK;AAAA,YAClB,eAAe,EAAE,GAAG,KAAK,cAAc,KAAK,GAAG;AAAA,YAC/C,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,UACxD;AAAA,UACA;AAAA,QACF;AACA,YAAI,CAAC,WAAW,QAAQ,wBAAwB,KAAK;AACnD,gBAAM,IAAI,MAAM,mDAAmD;AACrE,YAAI,QAAQ,WAAW,YAAY,QAAQ,YAAY,KAAK,QAAS,QAAO;AAC5E,eAAO,eAAe,SAAS,KAAK,QAAQ;AAAA,MAC9C;AAAA,IACF,EAAE,QAAQ,MAAM;AAEd,eAAS,IAAI,QAAQ;AACrB,UAAI,SAAS,IAAI,GAAG,MAAM,SAAS;AACjC,iBAAS,OAAO,GAAG;AAAA,MACrB;AAAA,IACF,CAAC;AACD,aAAS,IAAI,KAAK,OAAO;AACzB,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,UAAU;AACtB,UAAM,2BAA2B,MAAM,4BAA4B;AACnE,QAAI,MAAM,MAAM;AAChB,QAAI,YAAY,MAAM;AACtB,QAAI,wBAAwB,MAAM;AAClC,QAAI,8BAA8B,MAAM;AACxC,QAAI;AACJ,QAAI,IAAI,oBAAoB,QAAQ;AAClC,aAAO,WAAW,KAAK,oBAAoB,IAAI,YAAY;AAAA,IAC7D;AAKA,QAAI,IAAI,mBAAmB;AACzB,aAAO,WAAW,KAAK,8BAA8B,IAAI,YAAY;AAAA,IACvE;AACA,QAAI,MAAM,yBAAyB,QAAW;AAC5C,UAAI,CAAC,KAAK,sBAAsB;AAC9B,eAAO;AAAA,UACL;AAAA,UACA,IAAI,iBAAiB,YAAY,mCAAmC;AAAA,UACpE,IAAI;AAAA,QACN;AAAA,MACF;AACA,YAAM,uBAAuB,MAAM;AACnC,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA,MACE,KAAK,qBAAsB,IAAI;AAAA,UAC7B,GAAG;AAAA,UACH,UAAU,MAAM;AAAA,UAChB,GAAI,IAAI,eAAe,EAAE,cAAc,IAAI,aAAa,IAAI,CAAC;AAAA,UAC7D,gBAAgB,IAAI;AAAA,UACpB,GAAI,IAAI,OAAO,EAAE,gBAAgB,IAAI,KAAK,IAAI,CAAC;AAAA,UAC/C,cAAc,IAAI,iBAAiB,YAAY,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,UAK3D,GAAI,IAAI,iBAAiB,aAAa,YAAY,EAAE,gBAAgB,UAAU,IAAI,CAAC;AAAA,QACrF,CAAC;AAAA,QACH,CAAC,WAAY,OAAO,WAAW,eAAe,cAAc;AAAA,MAC9D;AACA,UAAI,cAAc,WAAW,UAAU;AACrC,eAAO;AAAA,UACL;AAAA,UACA,IAAI,iBAAiB,YAAY,mCAAmC;AAAA,UACpE,IAAI;AAAA,QACN;AAAA,MACF;AACA,UACE,gCAAgC,UAChC,cAAc,YAAY,yBAAyB,6BACnD;AACA,eAAO;AAAA,UACL;AAAA,UACA,wBAAwB,IAAI,iBAAiB,SAAS;AAAA,UACtD,IAAI;AAAA,QACN;AAAA,MACF;AACA,iCAA2B,cAAc;AACzC,oCAA8B,cAAc,YAAY;AACxD,YAAM,mBAAmB,cAAc,YAAY,UAAU;AAC7D,8BAAwB,cAAc;AACtC,kBAAY,cAAc,YAAY,kBAAkB;AACxD,YAAM;AAAA,QACJ,GAAG;AAAA,QACH,cAAc,cAAc,YAAY;AAAA,QACxC,MAAM,cAAc;AAAA,QACpB,cAAc,mBAAmB,YAAY;AAAA,MAC/C;AAAA,IACF;AACA,QAAI,IAAI,iBAAiB,aAAa,CAAC,WAAW;AAChD,aAAO,WAAW,KAAK,kCAAkC,IAAI,YAAY;AAAA,IAC3E;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,QAChB,aAAa;AAAA,QACb,eAAe;AAAA,QACf,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,QACjC,GAAI,gCAAgC,SAAY,EAAE,4BAA4B,IAAI,CAAC;AAAA,MACrF,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,WAAW,KAAK,gBAAgB;AAAA,IACzC;AACA,QAAI,CAAC,MAAM;AACT,aAAO,WAAW,KAAK,oBAAoB;AAAA,IAC7C;AACA,QAAI,KAAK,WAAW,UAAU;AAC5B,aAAO,oBAAoB,MAAM,GAAG;AAAA,IACtC;AAIA,QAAI,CAAC,yBAAyB,MAAM,KAAK,MAAM,cAAc,GAAG;AAC9D,aAAO,WAAW,KAAK,sBAAsB,KAAK,EAAE;AAAA,IACtD;AACA,UAAM,MAAM,KAAK,IAAI;AACrB,QACE,6BAA6B,eAC7B,KAAK,SAAS,aACb,MAAM,iBAAiB,QACrB,KAAK,cAAc,QAAQ,KAAK,UAAU,QAAQ,KAAK,IAAI,QAAQ,IACtE;AACA,aAAO,WAAW,KAAK,kBAAkB,KAAK,EAAE;AAAA,IAClD;AACA,QACE,6BAA6B,eAC7B,cAAc,MAAM,MAAM,iBAAiB,MAAM,GAAG,GACpD;AACA,UAAI;AACF,eAAO,MAAM,oBAAoB,MAAM,GAAG;AAAA,MAC5C,SAAS,OAAO;AAGd,YAAI,wBAAwB,KAAK,GAAG;AAClC,cAAI,UAAU;AACd,cAAI,QAAQ,mCAAmC;AAC7C,gBAAI;AACF,wBAAU,MAAM,QAAQ,kCAAkC;AAAA,gBACxD,aAAa,KAAK;AAAA,gBAClB,cAAc,KAAK;AAAA,gBACnB,mBAAmB,KAAK;AAAA,gBACxB,WAAW,KAAK;AAAA,gBAChB,gBAAgB,KAAK;AAAA,gBACrB,YAAY,MAAM;AAAA,gBAClB,gBAAgB,MAAM;AAAA,cACxB,CAAC;AAAA,YACH,QAAQ;AACN,wBAAU;AAAA,YACZ;AAAA,UACF;AACA,cAAI,CAAC,SAAS;AACZ,kBAAM,KAGH,UAAU,IAAI,KAAK,aAAa,gBAAgB,MAAM,SAAS;AAAA,cAC9D,IAAI,KAAK;AAAA,cACT,SAAS,KAAK;AAAA,cACd,WAAW,KAAK;AAAA,YAClB,CAAC,EACA,MAAM,MAAM,MAAS;AAAA,UAC1B;AAAA,QACF;AACA,eAAO,WAAW,KAAK,kBAAkB,KAAK,EAAE;AAAA,MAClD;AAAA,IACF;AACA,QACE,gCAAgC,UAChC,KAAK,wBAAwB,6BAC7B;AACA,aAAO,WAAW,KAAK,wBAAwB,IAAI,iBAAiB,SAAS,GAAG,KAAK,EAAE;AAAA,IACzF;AACA,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,MAAM,oBAAoB;AAAA,MAC1B;AAAA,MACA,6BAA6B;AAAA,IAC/B;AAAA,EACF;AACF;AAEA,SAAS,wBAAwB,UAAqC;AACpE,SAAO,WAAW,mCAAmC;AACvD;AAEA,SAAS,yBACP,MACA,KACA,gBACS;AACT,MAAI,KAAK,eAAe,YAAY,MAAM,IAAI,eAAe,YAAY,EAAG,QAAO;AACnF,MAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAM,QAAO;AAE/C,QAAM,aAAa,KAAK;AACxB,QAAM,WAAW,KAAK;AACtB,QAAM,cAAc,YAAY,WAAW,OAAO,KAAK,YAAY,SAAS,MAAM;AAClF,QAAM,cAAc,iBAAiB,cAAc;AACnD,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,aAAa;AACf,UAAM,UAAU,iBAAiB,WAAW;AAC5C,QACE,CAAC,WACA,gBAAgB,WACf,EACE,YAAY,iBAAiB,2BAA2B,KACxD,+BAA+B,aAAa,GAAG,MAEjD,EACE,YAAY,iBAAiB,sBAAsB,KACnD,+BAA+B,aAAa,GAAG,IAEnD;AACA,aAAO;AAAA,IACT;AAAA,EACF,WAAW,CAAC,+BAA+B,aAAa,KAAK,cAAc,GAAG;AAI5E,WAAO;AAAA,EACT;AACA,MAAI,KAAK,SAAS,SAAU,QAAO;AACnC,QAAM,gBAAgB,YAAY,WAAW,QAAQ,KAAK,YAAY,SAAS,QAAQ;AACvF,MAAI,IAAI,UAAU;AAChB,QAAI,CAAC,cAAe,QAAO;AAC3B,QAAI,kBAAkB,IAAI,QAAQ,MAAM,kBAAkB,aAAa,EAAG,QAAO;AAAA,EACnF;AACA,SAAO;AACT;AAIO,SAAS,iCACd,YACA,KACA,gBACS;AACT,SACE,yBAAyB,EAAE,GAAG,YAAY,YAAY,CAAC,EAAE,GAAG,KAAK,cAAc,KAC/E,uBAAuB,IAAI,QAAQ,WAAW,eAAe,WAAW,cAAc,EACnF,WAAW;AAElB;AAGA,SAAS,+BACP,gBACA,KACS;AACT,MACE,IAAI,eAAe,YAAY,MAAM,eACrC,IAAI,SAAS,YACZ,IAAI,iBAAiB,UACpB,IAAI,iBAAiB,aACrB,IAAI,iBAAiB;AAEvB,WAAO;AACT,QAAM,MAAM,IAAI,IAAI,cAAc;AAElC,MAAI,sBAAsB,GAAG,EAAG,QAAO;AACvC,SACE,IAAI,WAAW,uBACf,CAAC,IAAI,YACL,CAAC,IAAI,YACL;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,CAAC,WAAW,IAAI,aAAa,QAAQ,MAAM,EAAE;AAExD;AAEA,SAAS,+BAA+B,gBAAwB,gBAAiC;AAC/F,QAAM,kBAAkB,IAAI,IAAI,cAAc,EAAE,SAAS,YAAY;AACrE,QAAM,WAAW,eACd,KAAK,EACL,YAAY,EACZ,QAAQ,cAAc,EAAE;AAC3B,SACE,QAAQ,QAAQ,MAAM,oBAAoB,YAAY,gBAAgB,SAAS,IAAI,QAAQ,EAAE;AAEjG;AAEA,SAAS,iBAAiB,OAA8B;AACtD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,IAAI,aAAa,WAAW,IAAI,aAAa,SAAU,QAAO;AAClE,QAAI,OAAO;AACX,QAAI,WAAW,IAAI,SAAS,YAAY;AACxC,QACG,IAAI,aAAa,YAAY,IAAI,SAAS,SAC1C,IAAI,aAAa,WAAW,IAAI,SAAS,MAC1C;AACA,UAAI,OAAO;AAAA,IACb;AACA,QAAI,WAAW,IAAI,SAAS,QAAQ,QAAQ,EAAE,KAAK;AACnD,WAAO,IAAI,SAAS;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,OAAuB;AAChD,SAAO,iBAAiB,KAAK,KAAK,MAAM,KAAK;AAC/C;AAEO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EACA;AAAA,EAET,YAAY,YAAoB,iBAAgC,MAAM;AACpE,UAAM,uCAAuC,UAAU,EAAE;AACzD,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,iBAAiB;AAAA,EACxB;AACF;AAKA,SAAS,wBAAwB,OAAqD;AACpF,SACE,iBAAiB,8BACjB,MAAM,cAAc,OACpB,MAAM,aAAa,OACnB,MAAM,eAAe,OACrB,MAAM,eAAe;AAEzB;AAEA,SAAS,cAAc,MAAqC,OAAgB,KAAoB;AAC9F,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,EACT;AACA,MAAI,OAAO;AACT,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAK,WAAW;AACnB,WAAO;AAAA,EACT;AACA,SAAO,KAAK,UAAU,QAAQ,KAAK,IAAI,QAAQ,IAAI;AACrD;AAEA,SAAS,WACP,KACA,QACA,cACmC;AACnC,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA,gBAAgB,IAAI;AAAA,IACpB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,IAAI,SAAS,EAAE,QAAQ,IAAI,OAAO,IAAI,CAAC;AAAA,IAC3C,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC;AAAA,IACjD,GAAI,IAAI,oBACJ,EAAE,mBAAmB,sBAAsB,IAAI,iBAAiB,EAAE,IAClE,CAAC;AAAA,EACP;AACF;AAEA,SAAS,oBACP,MACA,KACmC;AACnC,MAAI,KAAK,WAAW,WAAW;AAC7B,WAAO,WAAW,KAAK,sBAAsB,KAAK,EAAE;AAAA,EACtD;AACA,SAAO;AAAA,IACL;AAAA,IACA,KAAK,aAAa,KAAK,UAAU,QAAQ,KAAK,KAAK,IAAI,IAAI,YAAY;AAAA,IACvE,KAAK;AAAA,EACP;AACF;AAEA,SAAS,uBACP,WACA,SACA,gBACU;AACV,MAAI,CAAC,WAAW,QAAQ;AACtB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,SACJ,eAAe,YAAY,MAAM,cAAc,qBAAqB,OAAO,IAAI;AACjF,QAAM,aAAa,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,mBAAmB,gBAAgB,KAAK,CAAC,CAAC;AAC3F,SAAO,UAAU,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,mBAAmB,gBAAgB,KAAK,CAAC,CAAC;AAC/F;AAQO,SAAS,sBAAsB,WAA8C;AAClF,SAAO,CAAC,aAAa,YAAY,KAAK,SAAS,IAAI,WAAW;AAChE;AAUA,SAAS,gCACP,MACA,QAC8B;AAC9B,MAAI,KAAK,SAAS,UAAU;AAC1B,UAAM,cAAc,YAAa,KAAK,WAA0C,YAAY;AAC5F,QAAI,CAAC,aAAa;AAChB,aAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,GAAG,sBAAsB,YAAa,KAAK,WAAwC,UAAU,CAAC,CAAC,IAAI,WAAW;AAAA,MAC/H;AAAA,IACF;AAAA,EACF;AACA,QAAM,gBAAiB,KAAK,WAAwC;AACpE,MAAI,kBAAkB,QAAW;AAC/B,QAAI;AACJ,QAAI;AACF,mBAAa,+BAA+B,aAAa;AAAA,IAC3D,QAAQ;AACN,aAAO,EAAE,QAAQ,UAAU;AAAA,IAC7B;AACA,QAAI,WAAW,cAAc,WAAW,KAAK,CAAC,cAAc,UAAU,YAAY,QAAQ,GAAG;AAC3F,aAAO,EAAE,QAAQ,cAAc;AAAA,IACjC;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,uBAAuB,UAAU;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,UAAM,UAAU;AAAA,MACd,aAAc,KAAK,WAAqC,OAAO,KAAK,CAAC;AAAA,IACvE;AACA,WAAO,EAAE,QAAQ,MAAM,QAAQ;AAAA,EACjC,QAAQ;AACN,WAAO,EAAE,QAAQ,UAAU;AAAA,EAC7B;AACF;AAEA,eAAsB,iCACpB,MACA,KACA,UACA,mBAA4C,CAAC,GAM5C;AACD,MAAI,KAAK,SAAS,UAAU;AAC1B,WAAO;AAAA,MACL,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,IACtB;AAAA,EACF;AACA,QAAM,eAAe,YAAa,KAAK,WAA2C,aAAa;AAC/F,QAAM,yBAAyB,iCAAiC,UAAU,KAAK,QAAQ;AACvF,QAAM,iBACJ,KAAK,eAAe,YAAY,MAAM,mCACtC,uBAAuB;AACzB,QAAM,sBACJ,YAAa,KAAK,WAA4C,cAAc,KAC5E,YAAa,KAAK,SAAyC,aAAa,KACxE,YAAa,KAAK,SAA0C,cAAc;AAC5E,QAAM,gBAAgB,iBAAiB,4BAA4B;AACnE,MAAI,CAAC,gBAAgB,CAAC,eAAe;AACnC,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,MAAI,kBAAkB,wBAAwB,2BAA2B;AACvE,UAAM,IAAI,2BAA2B,KAAK,oBAAoB;AAAA,EAChE;AACA,MAAI;AACJ,MAAI;AACF,6BAAyB,gBAAgB,eAAe;AAAA,MACtD,OAAO;AAAA,MACP,mBAAmB,SAAS,gBAAgB,WAAW,SAAS,gBAAgB;AAAA,IAClF,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,OAAK,IAAI,cAAc,eAAe;AACtC,OAAK,IAAI,iBAAiB,YAAY;AAItC,QAAM,WACJ,YAAa,KAAK,WAAuC,SAAS,KAClE,YAAa,KAAK,SAAoC,QAAQ,KAC9D,YAAa,KAAK,SAAqC,SAAS;AAClE,QAAM,eAAe,iBACjB,SAAS,kCACT,YAAa,KAAK,WAA2C,aAAa;AAC9E,QAAM,aACJ;AAAA,IACG,KAAK,WAAwD;AAAA,EAChE,KAAK;AACP,MACE,mBACC,CAAC,SAAS,8BACT,CAAC,YACD,aAAa,SAAS,+BACtB,uBAAuB,KAAK,qBAAqB,SAAS,eAC1D,uBAAuB,KAAK,sBAC1B,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,KACjE,CAAC,eACH;AACA,UAAM,IAAI,2BAA2B,KAAK,oBAAoB;AAAA,EAChE;AACA,MAAI,UAAU;AACZ,SAAK,IAAI,aAAa,QAAQ;AAAA,EAChC;AACA,QAAM,uBACJ;AAAA,IACG,KAAK,WAAoD;AAAA,EAC5D,MAAM,SACF,SACA;AACN,QAAM,UAAkC;AAAA,IACtC,gBACE,yBAAyB,SAAS,qBAAqB;AAAA,EAC3D;AACA,MAAI,gBAAgB,eAAe,sBAAsB;AACvD,SAAK,IAAI,iBAAiB,YAAY;AAAA,EACxC,WAAW,YAAY,gBAAgB,eAAe,uBAAuB;AAC3E,YAAQ,gBAAgB,SAAS,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ,CAAC;AAAA,EAChG;AACA,QAAM,WACJ,IAAI,YAAY,YAAa,KAAK,WAAsC,QAAQ;AAClF,QAAM,6BACH,KAAK,WAA0D,iCAChE;AACF,MAAI,YAAY,4BAA4B;AAC1C,SAAK,IAAI,YAAY,QAAQ;AAAA,EAC/B;AACA,QAAM,0BACH,KAAK,WAAuD,8BAC7D;AACF,MAAI,IAAI,QAAQ,UAAU,yBAAyB;AACjD,SAAK,IAAI,SAAS,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,EACxC;AACA,QAAM,cACJ,yBAAyB,SAAS,KAAK,UAAU,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,IAAI;AACzF,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM;AAAA,MACN,QAAQ,YAAY,QAAQ,6BAA6B;AAAA,IAC3D;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,iBAAiB,aAAa;AAAA,MACzC,GAAI,iBAAiB,YAAY,EAAE,WAAW,iBAAiB,UAAU,IAAI,CAAC;AAAA,MAC9E,OAAO;AAAA,MACP,8BAA8B;AAAA,IAChC;AAAA,EACF;AACA,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,UAAM,mBAAmB,QAAQ;AACjC,UAAM,IAAI,2BAA2B,SAAS,MAAM;AAAA,EACtD;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,SAAS;AAAA,MACT,MAAM,0BAA0B,QAAQ;AAAA,IAC1C;AAAA,EACF;AACA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,cAAc,YAAY,QAAQ,YAAY;AACpD,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,QAAM,YAAY,2BAA2B,SAAS,KAAK,SAAS;AACpE,QAAM,YAAY,YAAY,QAAQ,KAAK;AAC3C,QAAM,iBAAiB,WAAW,MAAM,QAAQ,EAAE,OAAO,OAAO,KAAK,CAAC;AAGtE,MACE,aACA,IAAI,eAAe,YAAY,MAAM,yBACrC,CAAC,eAAe,KAAK,CAAC,UAAU,MAAM,YAAY,MAAM,gBAAgB,GACxE;AACA,mBAAe,KAAK,gBAAgB;AAAA,EACtC;AACA,QAAM,wBACJ,OAAO,QAAQ,6BAA6B,WACxC,QAAQ,2BACR;AACN,QAAM,wBACJ,kBAAkB,yBAAyB,wBAAwB,IAC/D,IAAI,KAAK,KAAK,IAAI,IAAI,wBAAwB,GAAI,EAAE,YAAY,IAChE;AACN,MACE,kBACA,cACC,eAAe,WAAW,iCAAiC,UAC1D,eAAe,KAAK,CAAC,UAAU,CAAC,iCAAiC,SAAS,KAAe,CAAC,IAC5F;AACA,UAAM,IAAI,2BAA2B,KAAK,eAAe;AAAA,EAC3D;AACA,QAAM,iBAAiB;AAAA,IACrB,GAAG,KAAK;AAAA,IACR,cAAc;AAAA,IACd,eAAe,YAAY,QAAQ,aAAa,KAAK;AAAA,IACrD,YACE,YAAY,QAAQ,UAAU,KAC9B,YAAa,KAAK,WAAwC,UAAU,KACpE;AAAA,IACF,GAAI,YAAY,EAAE,YAAY,UAAU,YAAY,EAAE,IAAI,CAAC;AAAA,IAC3D,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/B,GAAI,YACA;AAAA,MACE,OACE,IAAI,eAAe,YAAY,MAAM,wBACjC,eAAe,KAAK,GAAG,IACvB;AAAA,IACR,IACA,CAAC;AAAA,IACL,GAAI,wBAAwB,EAAE,0BAA0B,sBAAsB,IAAI,CAAC;AAAA,IACnF,GAAI,gBAAgB,CAAC,iBACjB,EAAE,eAAe,cAAc,4BAA4B,WAAW,IACtE,CAAC;AAAA,EACP;AACA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ;AAAA,IACA,GAAI,iBACA,EAAE,eAAe,CAAC,GAAG,gCAAgC,EAAE,IACvD,YACE,EAAE,eAAe,eAAe,IAChC,CAAC;AAAA,IACP,GAAI,wBACA;AAAA,MACE,UAAU,iCAAiC,MAAM;AAAA,QAC/C,GAAG,uBAAuB;AAAA,QAC1B;AAAA,MACF,CAAC;AAAA,IACH,IACA,CAAC;AAAA,EACP;AACF;AAEA,eAAe,0BAA0B,UAA4C;AACnF,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,OAAO,YAAY,QAAQ,KAAK;AACtC,WAAO,QAAQ,uBAAuB,KAAK,IAAI,IAAI,OAAO;AAAA,EAC5D,QAAQ;AACN,UAAM,mBAAmB,QAAQ;AACjC,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BACP,SACA,UACa;AACb,QAAM,YAAY,YAAY,QAAQ,UAAU;AAChD,MAAI,WAAW;AACb,UAAM,SAAS,IAAI,KAAK,SAAS;AACjC,WAAO,OAAO,MAAM,OAAO,QAAQ,CAAC,IAAI,WAAW;AAAA,EACrD;AACA,QAAM,YAAY,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAChF,MAAI,aAAa,OAAO,SAAS,SAAS,KAAK,YAAY,GAAG;AAC5D,WAAO,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AAAA,EAC/C;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAA+C;AACnE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO;AAAA,EACT;AACA,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC9C,QAAI,OAAO,QAAQ,UAAU;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,GAAG,IAAI;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,YAAY,OAAoC;AACvD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,eAAe,mBAAmB,UAAmC;AACnE,QAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AACrD;","names":["key"]}

package/dist/{chunk-I6HYVEFV.js → chunk-2GZRWV36.js}

@@ -1,7 +1,7 @@
 import {
   rawRows,
   withWorkspaceSubjectRls
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 
 // src/connect-attempts.ts
 import { createHash } from "crypto";
@@ -245,4 +245,4 @@ export {
   claimConnectOperation,
   finishConnectOperation
 };
-//# sourceMappingURL=chunk-I6HYVEFV.js.map
+//# sourceMappingURL=chunk-2GZRWV36.js.map

package/dist/{chunk-VTH2TKNI.js → chunk-5TXWWAJP.js}

@@ -1,13 +1,13 @@
 import {
   databaseBootConnectOptions
-} from "./chunk-PGZ34T44.js";
+} from "./chunk-SMCA7PNJ.js";
 import {
   LOSSLESS_CONTENT_WRITER_APPLICATION_NAME,
   schema_exports,
   sessions,
   workspaceSessionActivityRevisions,
   workspaces
-} from "./chunk-HFNTVT5I.js";
+} from "./chunk-GDMYQ55A.js";
 
 // src/persistence-errors.ts
 var SQLSTATE_KEYS = ["sqlState", "sqlstate", "code"];
@@ -985,4 +985,4 @@ export {
   withAccountRls,
   dbBindingFor
 };
-//# sourceMappingURL=chunk-VTH2TKNI.js.map
+//# sourceMappingURL=chunk-5TXWWAJP.js.map

package/dist/{chunk-UWJCRJC5.js → chunk-6ZSZIMC7.js}

@@ -1,6 +1,6 @@
 import {
   subscriptionCoreProvider
-} from "./chunk-IYUTXSFX.js";
+} from "./chunk-RK3MKIHK.js";
 
 // src/subscription-core/provider.ts
 function subscriptionCoreProviderId(provider) {
@@ -32,4 +32,4 @@ export {
   subscriptionCoreConnectionKind,
   memoByProvider
 };
-//# sourceMappingURL=chunk-UWJCRJC5.js.map
+//# sourceMappingURL=chunk-6ZSZIMC7.js.map

package/dist/{chunk-YS3D7KV5.js → chunk-77VCFW25.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 
 // src/managed-auth-session-sets.ts
 import {
@@ -296,4 +296,4 @@ export {
   reapManagedAuthIsolatedSessions,
   reapExpiredManagedAuthSessionSets
 };
-//# sourceMappingURL=chunk-YS3D7KV5.js.map
+//# sourceMappingURL=chunk-77VCFW25.js.map

package/dist/{chunk-5JRYRG7Z.js → chunk-BSRJZ6M5.js}

@@ -7,7 +7,7 @@ import {
   withAccountRls,
   withRlsContext,
   withWorkspaceRls
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 import {
   connections,
   creditDebitAllocations,
@@ -20,7 +20,7 @@ import {
   workspaceVideoGenerationPolicies,
   workspaceVideoGenerationQuotas,
   workspaces
-} from "./chunk-HFNTVT5I.js";
+} from "./chunk-GDMYQ55A.js";
 
 // src/video-generation.ts
 import {
@@ -1412,4 +1412,4 @@ export {
   mediaGenerationResultForStoredOperation,
   getVideoGenerationOperationSummary
 };
-//# sourceMappingURL=chunk-5JRYRG7Z.js.map
+//# sourceMappingURL=chunk-BSRJZ6M5.js.map

package/dist/{chunk-5HD6PLH4.js → chunk-EIYWCPZN.js}

@@ -1,7 +1,7 @@
 import {
   nestedPostgresSqlState,
   rawRows
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 
 // src/canonical-human-identities.ts
 import { createHash } from "crypto";
@@ -318,4 +318,4 @@ export {
   getCanonicalHumanIdentityProjection,
   applyCanonicalHumanIdentityOperation
 };
-//# sourceMappingURL=chunk-5HD6PLH4.js.map
+//# sourceMappingURL=chunk-EIYWCPZN.js.map

package/dist/{chunk-PYBW3KGM.js → chunk-F4BP3GNU.js}

@@ -6,7 +6,7 @@ import {
   rlsContextForWorkspace,
   setSubjectRlsContext,
   withRlsContext
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 
 // src/organization-integration-policy.ts
 import {
@@ -153,4 +153,4 @@ export {
   withOrganizationIntegrationPolicyFence,
   withOrganizationIntegrationAcquisition
 };
-//# sourceMappingURL=chunk-PYBW3KGM.js.map
+//# sourceMappingURL=chunk-F4BP3GNU.js.map

package/dist/{chunk-3VEDJM6S.js → chunk-F5JG7FDH.js}

@@ -2,7 +2,7 @@ import {
   memoByProvider,
   subscriptionCoreConnectionKind,
   subscriptionCoreProviderId
-} from "./chunk-UWJCRJC5.js";
+} from "./chunk-6ZSZIMC7.js";
 import {
   SUBSCRIPTION_CORE_CODEX,
   SubscriptionCoreCodexAccessLostError,
@@ -20,12 +20,12 @@ import {
   releaseSubscriptionTurnLease,
   subscriptionCoreCodexProvider,
   writeSubscriptionSessionBinding
-} from "./chunk-IYUTXSFX.js";
+} from "./chunk-RK3MKIHK.js";
 import {
   rawRows,
   withRlsContext,
   withSessionRlsActorContext
-} from "./chunk-VTH2TKNI.js";
+} from "./chunk-5TXWWAJP.js";
 
 // src/subscription-core-codex.ts
 import { CodexReloginRequired } from "@opengeni/codex";
@@ -128,6 +128,7 @@ import {
   personalFallbackActive,
   decidePlacement,
   quotaCapacity,
+  storedQuotaDocument,
   subscriptionCoreCredentialRefresher as subscriptionCoreCredentialRefresher2
 } from "@opengeni/subscriptions";
 
@@ -537,6 +538,7 @@ var SubscriptionBindingConflict = class extends Error {
   }
 };
 var BINDING_CONFLICT_RETRIES = 3;
+var SUBSCRIPTION_CORE_REFUSAL_CLAIM_MS = 2 * 6e4;
 var DELETED_EXPLICIT_WAIT = {
   kind: "wait",
   reason: "pinned_account_ineligible",
@@ -947,6 +949,7 @@ var subscriptionCoreTurns = memoByProvider((provider) => {
   }
   async function recordSubscriptionCoreModelCooldown(db, identity, lease, input) {
     if (!input.modelId.trim() || input.modelId.length > 256) return false;
+    const claimSince = input.refusedAt === void 0 ? null : input.refusedAt - SUBSCRIPTION_CORE_REFUSAL_CLAIM_MS;
     const access = await withLeasedConnection(db, identity, lease, async (tx) => {
       const [connection] = await rawRows(
         tx,
@@ -963,6 +966,28 @@ var subscriptionCoreTurns = memoByProvider((provider) => {
         exhaustedKind: null,
         source: "refusal"
       };
+      const stored = sql2`subscription_connection_quota.quota`;
+      const until = sql2`greatest(
+        coalesce((${stored}->'modelCooldowns'->>${input.modelId}::text)::bigint, 0),
+        ${input.until.getTime()}::bigint
+      )`;
+      const claim = sql2`(${stored}->'modelCooldownClaims'->${input.modelId}::text)`;
+      const cooled = sql2`jsonb_set(
+        case when jsonb_typeof(${stored}->'modelCooldowns') = 'object'
+          then ${stored}
+          else jsonb_set(${stored}, '{modelCooldowns}', '{}'::jsonb)
+        end,
+        array['modelCooldowns', ${input.modelId}],
+        to_jsonb(${until})
+      )`;
+      const keepClaim = sql2`(
+        ${claimSince}::bigint is not null
+        and jsonb_typeof(${claim}) = 'object'
+        and ${claim}->'until' = ${stored}->'modelCooldowns'->${input.modelId}::text
+        and case when jsonb_typeof(${claim}->'observedAt') = 'number'
+          then (${claim}->>'observedAt')::numeric >= ${claimSince}::bigint
+          else false end
+      )`;
       const rows = await rawRows(
         tx,
         sql2`insert into subscription_connection_quota (
@@ -982,16 +1007,20 @@ var subscriptionCoreTurns = memoByProvider((provider) => {
                 when subscription_connection_quota.observed_refresh_generation
                   is distinct from excluded.observed_refresh_generation
                 then excluded.quota
+                when ${stored}->'modelCooldownClaims' is null then ${cooled}
+                when jsonb_typeof(${stored}->'modelCooldownClaims') <> 'object'
+                  then ${cooled} - 'modelCooldownClaims'
                 else jsonb_set(
-                  case when jsonb_typeof(subscription_connection_quota.quota->'modelCooldowns') = 'object'
-                    then subscription_connection_quota.quota
-                    else jsonb_set(subscription_connection_quota.quota, '{modelCooldowns}', '{}'::jsonb)
-                  end,
-                  array['modelCooldowns', ${input.modelId}],
-                  to_jsonb(greatest(
-                    coalesce((subscription_connection_quota.quota->'modelCooldowns'->>${input.modelId})::bigint, 0),
-                    ${input.until.getTime()}::bigint
-                  ))
+                  ${cooled},
+                  '{modelCooldownClaims}',
+                  ((${stored}->'modelCooldownClaims') - ${input.modelId}::text) ||
+                    case when ${keepClaim}
+                      then jsonb_build_object(
+                        ${input.modelId}::text,
+                        ${claim} || jsonb_build_object('until', ${until})
+                      )
+                      else '{}'::jsonb
+                    end
                 )
               end,
               updated_at = case
@@ -1292,13 +1321,7 @@ var subscriptionCoreTurns = memoByProvider((provider) => {
       if (!next || next === current) return { applied: false, recovered: false };
       const observedNow = observation.observedAt ?? Date.now();
       const recovered = current !== null && quotaCapacity(current, observedNow).kind === "exhausted" && quotaCapacity(next, observedNow).kind !== "exhausted";
-      const stored = {
-        windows: next.windows,
-        modelCooldowns: next.modelCooldowns,
-        exhaustedUntil: next.exhaustedUntil,
-        exhaustedKind: next.exhaustedKind,
-        source: next.source
-      };
+      const stored = storedQuotaDocument(next);
       const observedAt = new Date(next.observedAt ?? Date.now()).toISOString();
       await tx.execute(
         sql2`insert into subscription_connection_quota (
@@ -1515,4 +1538,4 @@ export {
   refreshSubscriptionCoreCodexCredential,
   buildSubscriptionCoreCodexTokenResolver
 };
-//# sourceMappingURL=chunk-3VEDJM6S.js.map
+//# sourceMappingURL=chunk-F5JG7FDH.js.map