@tangle-network/agent-app 0.1.8 → 0.1.10

package/dist/billing/index.d.ts

@@ -14,8 +14,8 @@
  * SDK (structural contracts only, like `../tangle`). The `@tangle-network/tcloud`
  * SDK is the provisioner a product passes in; it is not a dependency here.
  */
-/** The key-provisioning operations this needs — the `@tangle-network/tcloud`
- *  SDK's `TCloudClient` satisfies it structurally; pass it in. */
+/** The key-provisioning operations the key manager needs. Wire it from the
+ *  platform via {@link createTcloudKeyProvisioner} rather than casting. */
 interface KeyProvisioner {
     createKey(input: {
         name: string;
@@ -33,6 +33,40 @@ interface KeyProvisioner {
         expiresAt?: string | null;
     }>;
 }
+/**
+ * The subset of the `@tangle-network/tcloud` `TCloudClient` the provisioner uses
+ * — declared with METHOD syntax so the real client (whose `product` is a narrow
+ * union and whose budgets are `number | null`) is assignable bivariantly. The
+ * real SDK client satisfies this; pass it straight in.
+ */
+interface TcloudKeyClient {
+    createKey(opts: {
+        name: string;
+        product?: string;
+        budgetUsd?: number;
+        expiresAt?: string;
+        parentKeyId?: string;
+        allowedModels?: string[];
+        rpmLimit?: number;
+    }): Promise<{
+        id: string;
+        key: string;
+    }>;
+    getKey(id: string): Promise<{
+        budgetUsd?: number | null;
+        budgetSpent?: number;
+        expiresAt?: string | null;
+    }>;
+    revokeKey(id: string): Promise<unknown>;
+}
+/**
+ * Adapt the tcloud SDK client to {@link KeyProvisioner} — the typed seam that
+ * replaces the `as unknown as KeyProvisioner` cast every consumer otherwise
+ * repeats. The platform already exposes child-key minting (parent→child key,
+ * per-key USD budget, expiry); this maps its shapes (`product` union,
+ * `number | null` budgets) onto the manager's contract (`null → undefined`).
+ */
+declare function createTcloudKeyProvisioner(client: TcloudKeyClient): KeyProvisioner;
 /** A stored child-key record (the app's row, shape-normalized). */
 interface WorkspaceKeyRecord {
     /** App row id (opaque). */
@@ -198,4 +232,4 @@ interface PlatformBalanceManager<Plan extends string> {
 declare function createPlatformBalanceManager<Plan extends string>(opts: PlatformBalanceManagerOptions<Plan>): PlatformBalanceManager<Plan>;
 declare function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager;
 
-export { type KeyCrypto, type KeyProvisioner, type PlanLimit, type PlatformBalanceInfo, type PlatformBalanceManager, type PlatformBalanceManagerOptions, type PlatformBillingClient, type PlatformIdentity, type PlatformProductUsage, type SharedBillingState, type WorkspaceKeyManager, type WorkspaceKeyManagerOptions, type WorkspaceKeyRecord, type WorkspaceKeyStore, type WorkspaceModelKeyUsage, createPlatformBalanceManager, createWorkspaceKeyManager };
+export { type KeyCrypto, type KeyProvisioner, type PlanLimit, type PlatformBalanceInfo, type PlatformBalanceManager, type PlatformBalanceManagerOptions, type PlatformBillingClient, type PlatformIdentity, type PlatformProductUsage, type SharedBillingState, type TcloudKeyClient, type WorkspaceKeyManager, type WorkspaceKeyManagerOptions, type WorkspaceKeyRecord, type WorkspaceKeyStore, type WorkspaceModelKeyUsage, createPlatformBalanceManager, createTcloudKeyProvisioner, createWorkspaceKeyManager };

package/dist/billing/index.js

@@ -1,9 +1,11 @@
 import {
   createPlatformBalanceManager,
+  createTcloudKeyProvisioner,
   createWorkspaceKeyManager
-} from "../chunk-EAJSWUU5.js";
+} from "../chunk-YS6A6G57.js";
 export {
   createPlatformBalanceManager,
+  createTcloudKeyProvisioner,
   createWorkspaceKeyManager
 };
 //# sourceMappingURL=index.js.map

package/dist/{chunk-MSXDQ2GB.js → chunk-5RMIUJDI.js}

@@ -27,6 +27,19 @@ function redactString(value, patterns) {
   }
   return value;
 }
+function maskSpans(text, patterns = DEFAULT_REDACTION_PATTERNS) {
+  const spans = detectSpans(text, patterns);
+  if (spans.length === 0) return text;
+  let out = "";
+  let pos = 0;
+  for (const s of spans) {
+    if (s.start > pos) out += text.slice(pos, s.start);
+    out += `[REDACTED:${s.kind}]`;
+    pos = s.end;
+  }
+  if (pos < text.length) out += text.slice(pos);
+  return out;
+}
 function isPlainObject(value) {
   if (value === null || typeof value !== "object") return false;
   const proto = Object.getPrototypeOf(value);
@@ -35,10 +48,18 @@ function isPlainObject(value) {
 function redactForIngestion(value, options = {}) {
   const patterns = options.extraPatterns ? [...DEFAULT_REDACTION_PATTERNS, ...options.extraPatterns] : DEFAULT_REDACTION_PATTERNS;
   const sensitiveKeys = options.extraSensitiveKeys ? /* @__PURE__ */ new Set([...SENSITIVE_KEYS, ...options.extraSensitiveKeys.map((k) => k.toLowerCase())]) : SENSITIVE_KEYS;
+  const maskString = options.stringMode === "mask-spans" ? (s) => maskSpans(s, patterns) : (s) => redactString(s, patterns);
+  const seen = /* @__PURE__ */ new WeakSet();
   const walk = (v) => {
-    if (typeof v === "string") return redactString(v, patterns);
-    if (Array.isArray(v)) return v.map(walk);
+    if (typeof v === "string") return maskString(v);
+    if (Array.isArray(v)) {
+      if (seen.has(v)) return v;
+      seen.add(v);
+      return v.map(walk);
+    }
     if (isPlainObject(v)) {
+      if (seen.has(v)) return v;
+      seen.add(v);
       const out = {};
       for (const [k, val] of Object.entries(v)) {
         out[k] = sensitiveKeys.has(k.toLowerCase()) ? "[REDACTED:field]" : walk(val);
@@ -96,9 +117,10 @@ async function revealSpan(doc, spanId, options) {
 
 export {
   DEFAULT_REDACTION_PATTERNS,
+  maskSpans,
   redactForIngestion,
   detectSpans,
   buildRedactedDocument,
   revealSpan
 };
-//# sourceMappingURL=chunk-MSXDQ2GB.js.map
+//# sourceMappingURL=chunk-5RMIUJDI.js.map

package/dist/chunk-5RMIUJDI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/redact/index.ts"],"sourcesContent":["/**\n * PII redaction — two complementary modes.\n *\n * 1. ONE-WAY scrub (`redactForIngestion`): for production trace payloads. Tool\n *    args + results (and once, the LLM span's prompt) cross the wire into the\n *    ingestion store, which also feeds the analyst-loop's LLM prompts, so\n *    personal identifiers MUST be stripped before they leave the request path.\n *    Destructive — the original is gone, replaced by a sentinel.\n *\n * 2. REVERSIBLE redaction (`buildRedactedDocument` / `revealSpan`): for the UI.\n *    A document is split into text + redacted segments; each redacted original\n *    is kept ENCRYPTED (via a caller-supplied `encrypt` seam → `agent-app/crypto`)\n *    so a viewer can reveal a single span on demand, gated by an authorization\n *    callback and an audit hook. The mask is presentation; the original is\n *    recoverable by an authorized reveal, not lost.\n *\n * Discipline: cheap deterministic string patterns + well-known sensitive object\n * keys (value replaced, key kept, so the shape stays debuggable); recurse arrays\n * + plain objects only; NEVER throw on the one-way path.\n */\n\n/** A named PII pattern. `pattern` is matched case-insensitively at the string\n *  level; keep it non-global (global instances are derived where needed). */\nexport interface RedactionPattern {\n  kind: string\n  pattern: RegExp\n  /** Optional predicate over each match — the pattern fires only when it returns\n   *  true. For matches a regex alone can't decide (e.g. a Luhn check on a\n   *  card-number candidate). When set, the value is scanned globally and the\n   *  first match that passes wins; when absent, a plain `pattern.test` decides. */\n  validate?: (match: string) => boolean\n}\n\n/** The default deterministic patterns. Extend via the `extraPatterns` /\n *  `patterns` options rather than forking this module (the seam that lets a\n *  product add e.g. a credit-card matcher without a local copy). */\nexport const DEFAULT_REDACTION_PATTERNS: readonly RedactionPattern[] = [\n  { kind: 'ssn', pattern: /\\d{3}-\\d{2}-\\d{4}/ },\n  { kind: 'ein', pattern: /\\d{2}-\\d{7}/ },\n]\n\nconst SENSITIVE_KEYS = new Set([\n  'ssn',\n  'ein',\n  'password',\n  'apikey',\n  'token',\n  'secret',\n  'authorization',\n  'email',\n  'phone',\n])\n\nexport interface RedactForIngestionOptions {\n  /** Extra patterns appended to {@link DEFAULT_REDACTION_PATTERNS} for the\n   *  string-level scrub (e.g. credit-card). Additive — defaults still apply. */\n  extraPatterns?: readonly RedactionPattern[]\n  /** Extra sensitive object-key names (case-insensitive) added to the built-in\n   *  set, e.g. the snake_case `api_key` an intake form uses. Additive. */\n  extraSensitiveKeys?: readonly string[]\n  /**\n   * How a matched string is rewritten:\n   * - `'collapse'` (default) — the whole string becomes `[REDACTED:<kind>]` on\n   *   the first matching pattern. Safest for telemetry: nothing of the original\n   *   survives.\n   * - `'mask-spans'` — only the matched substrings are replaced (each with\n   *   `[REDACTED:<kind>]`), preserving surrounding text. Use when a downstream\n   *   reader needs the non-PII context (e.g. an analyst loop reading prose).\n   */\n  stringMode?: 'collapse' | 'mask-spans'\n}\n\nfunction redactString(value: string, patterns: readonly RedactionPattern[]): string {\n  for (const { kind, pattern, validate } of patterns) {\n    if (!validate) {\n      if (pattern.test(value)) return `[REDACTED:${kind}]`\n      continue\n    }\n    const g = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`)\n    for (const m of value.matchAll(g)) {\n      if (m[0].length > 0 && validate(m[0])) return `[REDACTED:${kind}]`\n    }\n  }\n  return value\n}\n\n/**\n * Replace only the PII substrings in `text`, preserving everything around them\n * (the `mask-spans` string mode). Built on {@link detectSpans} so matching,\n * non-overlap, and `validate` predicates behave identically to the reversible\n * path. Each span becomes `[REDACTED:<kind>]`.\n */\nexport function maskSpans(\n  text: string,\n  patterns: readonly RedactionPattern[] = DEFAULT_REDACTION_PATTERNS,\n): string {\n  const spans = detectSpans(text, patterns)\n  if (spans.length === 0) return text\n  let out = ''\n  let pos = 0\n  for (const s of spans) {\n    if (s.start > pos) out += text.slice(pos, s.start)\n    out += `[REDACTED:${s.kind}]`\n    pos = s.end\n  }\n  if (pos < text.length) out += text.slice(pos)\n  return out\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object') return false\n  const proto = Object.getPrototypeOf(value)\n  return proto === Object.prototype || proto === null\n}\n\n/**\n * One-way PII scrub for telemetry/ingestion. Backward-compatible: called with no\n * options it behaves exactly as before (SSN/EIN strings + sensitive object keys\n * → sentinels). `extraPatterns` lets a product add matchers (e.g. credit-card)\n * without forking this module.\n */\nexport function redactForIngestion(value: unknown, options: RedactForIngestionOptions = {}): unknown {\n  const patterns = options.extraPatterns\n    ? [...DEFAULT_REDACTION_PATTERNS, ...options.extraPatterns]\n    : DEFAULT_REDACTION_PATTERNS\n  const sensitiveKeys = options.extraSensitiveKeys\n    ? new Set([...SENSITIVE_KEYS, ...options.extraSensitiveKeys.map((k) => k.toLowerCase())])\n    : SENSITIVE_KEYS\n  const maskString =\n    options.stringMode === 'mask-spans'\n      ? (s: string) => maskSpans(s, patterns)\n      : (s: string) => redactString(s, patterns)\n  // Cycle guard: a payload with a circular reference would otherwise recurse\n  // forever. On re-encountering an object/array, return it untouched to break\n  // the cycle (the same value was already redacted on its first visit).\n  const seen = new WeakSet<object>()\n  const walk = (v: unknown): unknown => {\n    if (typeof v === 'string') return maskString(v)\n    if (Array.isArray(v)) {\n      if (seen.has(v)) return v\n      seen.add(v)\n      return v.map(walk)\n    }\n    if (isPlainObject(v)) {\n      if (seen.has(v)) return v\n      seen.add(v)\n      const out: Record<string, unknown> = {}\n      for (const [k, val] of Object.entries(v)) {\n        out[k] = sensitiveKeys.has(k.toLowerCase()) ? '[REDACTED:field]' : walk(val)\n      }\n      return out\n    }\n    return v\n  }\n  return walk(value)\n}\n\n// ── Reversible document redaction (the UI path) ─────────────────────────────\n\n/** A detected PII span in a source string. */\nexport interface RedactionSpan {\n  /** Stable within a document (index-derived) — used for reveal + audit. */\n  id: string\n  kind: string\n  start: number\n  end: number\n  text: string\n}\n\n/**\n * Find non-overlapping PII spans in `text`. Matches every pattern, sorts by\n * position, and drops overlaps (first match wins). Deterministic — no ids that\n * vary per call.\n */\nexport function detectSpans(\n  text: string,\n  patterns: readonly RedactionPattern[] = DEFAULT_REDACTION_PATTERNS,\n): RedactionSpan[] {\n  const raw: Array<{ kind: string; start: number; end: number; text: string }> = []\n  for (const { kind, pattern, validate } of patterns) {\n    const g = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`)\n    for (const m of text.matchAll(g)) {\n      if (m.index === undefined || m[0].length === 0) continue\n      if (validate && !validate(m[0])) continue\n      raw.push({ kind, start: m.index, end: m.index + m[0].length, text: m[0] })\n    }\n  }\n  raw.sort((a, b) => a.start - b.start || b.end - a.end)\n  const spans: RedactionSpan[] = []\n  let cursor = -1\n  let i = 0\n  for (const s of raw) {\n    if (s.start < cursor) continue // overlaps an earlier (higher-priority) span\n    spans.push({ id: `span-${i++}`, ...s })\n    cursor = s.end\n  }\n  return spans\n}\n\n/** A redacted document segment: literal text, or a masked span with the\n *  original kept ENCRYPTED for an authorized reveal. */\nexport type RedactedDocSegment =\n  | { type: 'text'; text: string }\n  | { type: 'redacted'; id: string; kind: string; cipher: string }\n\nexport interface RedactedDocument {\n  segments: RedactedDocSegment[]\n}\n\nexport interface BuildRedactedDocumentOptions {\n  /** Encrypt one original span value. Wire it to `agent-app/crypto`\n   *  (`encryptWithKey` / `createFieldCrypto`). The cipher is what's stored. */\n  encrypt: (plaintext: string) => string | Promise<string>\n  /** Patterns to detect (default: {@link DEFAULT_REDACTION_PATTERNS}). */\n  patterns?: readonly RedactionPattern[]\n}\n\n/**\n * Split `text` into text + redacted segments, encrypting each redacted span's\n * original. The result carries NO plaintext PII — only the masked structure and\n * ciphertext — so it is safe to ship to a client; reveal happens server-side via\n * {@link revealSpan}.\n */\nexport async function buildRedactedDocument(\n  text: string,\n  options: BuildRedactedDocumentOptions,\n): Promise<RedactedDocument> {\n  const spans = detectSpans(text, options.patterns)\n  const segments: RedactedDocSegment[] = []\n  let pos = 0\n  for (const span of spans) {\n    if (span.start > pos) segments.push({ type: 'text', text: text.slice(pos, span.start) })\n    segments.push({ type: 'redacted', id: span.id, kind: span.kind, cipher: await options.encrypt(span.text) })\n    pos = span.end\n  }\n  if (pos < text.length) segments.push({ type: 'text', text: text.slice(pos) })\n  return { segments }\n}\n\nexport interface RevealSpanOptions {\n  /** Decrypt a span cipher. Wire to `agent-app/crypto` (`decryptWithKey`). */\n  decrypt: (cipher: string) => string | Promise<string>\n  /** Authorization gate — return false to deny the reveal (fail-closed). */\n  canReveal: (segment: { id: string; kind: string }) => boolean | Promise<boolean>\n  /** Audit hook — invoked only on a granted reveal (the caller records who/when). */\n  onReveal?: (segment: { id: string; kind: string }) => void | Promise<void>\n}\n\nexport interface RevealResult {\n  ok: boolean\n  value?: string\n  /** `not_found` | `forbidden` when `ok` is false. */\n  reason?: string\n}\n\n/**\n * Reveal one redacted span's original, gated + audited. Fail-closed: an unknown\n * id or a denied `canReveal` returns `{ ok: false }` and never decrypts; a\n * granted reveal decrypts, fires `onReveal` for the audit trail, and returns the\n * value.\n */\nexport async function revealSpan(\n  doc: RedactedDocument,\n  spanId: string,\n  options: RevealSpanOptions,\n): Promise<RevealResult> {\n  const seg = doc.segments.find((s): s is Extract<RedactedDocSegment, { type: 'redacted' }> =>\n    s.type === 'redacted' && s.id === spanId,\n  )\n  if (!seg) return { ok: false, reason: 'not_found' }\n  const allowed = await options.canReveal({ id: seg.id, kind: seg.kind })\n  if (!allowed) return { ok: false, reason: 'forbidden' }\n  const value = await options.decrypt(seg.cipher)\n  if (options.onReveal) await options.onReveal({ id: seg.id, kind: seg.kind })\n  return { ok: true, value }\n}\n"],"mappings":";AAoCO,IAAM,6BAA0D;AAAA,EACrE,EAAE,MAAM,OAAO,SAAS,oBAAoB;AAAA,EAC5C,EAAE,MAAM,OAAO,SAAS,cAAc;AACxC;AAEA,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAqBD,SAAS,aAAa,OAAe,UAA+C;AAClF,aAAW,EAAE,MAAM,SAAS,SAAS,KAAK,UAAU;AAClD,QAAI,CAAC,UAAU;AACb,UAAI,QAAQ,KAAK,KAAK,EAAG,QAAO,aAAa,IAAI;AACjD;AAAA,IACF;AACA,UAAM,IAAI,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,SAAS,GAAG,IAAI,QAAQ,QAAQ,GAAG,QAAQ,KAAK,GAAG;AACtG,eAAW,KAAK,MAAM,SAAS,CAAC,GAAG;AACjC,UAAI,EAAE,CAAC,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,EAAG,QAAO,aAAa,IAAI;AAAA,IACjE;AAAA,EACF;AACA,SAAO;AACT;AAQO,SAAS,UACd,MACA,WAAwC,4BAChC;AACR,QAAM,QAAQ,YAAY,MAAM,QAAQ;AACxC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,MAAM;AACV,MAAI,MAAM;AACV,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,QAAQ,IAAK,QAAO,KAAK,MAAM,KAAK,EAAE,KAAK;AACjD,WAAO,aAAa,EAAE,IAAI;AAC1B,UAAM,EAAE;AAAA,EACV;AACA,MAAI,MAAM,KAAK,OAAQ,QAAO,KAAK,MAAM,GAAG;AAC5C,SAAO;AACT;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAQO,SAAS,mBAAmB,OAAgB,UAAqC,CAAC,GAAY;AACnG,QAAM,WAAW,QAAQ,gBACrB,CAAC,GAAG,4BAA4B,GAAG,QAAQ,aAAa,IACxD;AACJ,QAAM,gBAAgB,QAAQ,qBAC1B,oBAAI,IAAI,CAAC,GAAG,gBAAgB,GAAG,QAAQ,mBAAmB,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IACtF;AACJ,QAAM,aACJ,QAAQ,eAAe,eACnB,CAAC,MAAc,UAAU,GAAG,QAAQ,IACpC,CAAC,MAAc,aAAa,GAAG,QAAQ;AAI7C,QAAM,OAAO,oBAAI,QAAgB;AACjC,QAAM,OAAO,CAAC,MAAwB;AACpC,QAAI,OAAO,MAAM,SAAU,QAAO,WAAW,CAAC;AAC9C,QAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,UAAI,KAAK,IAAI,CAAC,EAAG,QAAO;AACxB,WAAK,IAAI,CAAC;AACV,aAAO,EAAE,IAAI,IAAI;AAAA,IACnB;AACA,QAAI,cAAc,CAAC,GAAG;AACpB,UAAI,KAAK,IAAI,CAAC,EAAG,QAAO;AACxB,WAAK,IAAI,CAAC;AACV,YAAM,MAA+B,CAAC;AACtC,iBAAW,CAAC,GAAG,GAAG,KAAK,OAAO,QAAQ,CAAC,GAAG;AACxC,YAAI,CAAC,IAAI,cAAc,IAAI,EAAE,YAAY,CAAC,IAAI,qBAAqB,KAAK,GAAG;AAAA,MAC7E;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,KAAK;AACnB;AAmBO,SAAS,YACd,MACA,WAAwC,4BACvB;AACjB,QAAM,MAAyE,CAAC;AAChF,aAAW,EAAE,MAAM,SAAS,SAAS,KAAK,UAAU;AAClD,UAAM,IAAI,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,SAAS,GAAG,IAAI,QAAQ,QAAQ,GAAG,QAAQ,KAAK,GAAG;AACtG,eAAW,KAAK,KAAK,SAAS,CAAC,GAAG;AAChC,UAAI,EAAE,UAAU,UAAa,EAAE,CAAC,EAAE,WAAW,EAAG;AAChD,UAAI,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAG;AACjC,UAAI,KAAK,EAAE,MAAM,OAAO,EAAE,OAAO,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG;AACrD,QAAM,QAAyB,CAAC;AAChC,MAAI,SAAS;AACb,MAAI,IAAI;AACR,aAAW,KAAK,KAAK;AACnB,QAAI,EAAE,QAAQ,OAAQ;AACtB,UAAM,KAAK,EAAE,IAAI,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;AACtC,aAAS,EAAE;AAAA,EACb;AACA,SAAO;AACT;AA0BA,eAAsB,sBACpB,MACA,SAC2B;AAC3B,QAAM,QAAQ,YAAY,MAAM,QAAQ,QAAQ;AAChD,QAAM,WAAiC,CAAC;AACxC,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,QAAQ,IAAK,UAAS,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,KAAK,EAAE,CAAC;AACvF,aAAS,KAAK,EAAE,MAAM,YAAY,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IAAI,EAAE,CAAC;AAC1G,UAAM,KAAK;AAAA,EACb;AACA,MAAI,MAAM,KAAK,OAAQ,UAAS,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAC5E,SAAO,EAAE,SAAS;AACpB;AAwBA,eAAsB,WACpB,KACA,QACA,SACuB;AACvB,QAAM,MAAM,IAAI,SAAS;AAAA,IAAK,CAAC,MAC7B,EAAE,SAAS,cAAc,EAAE,OAAO;AAAA,EACpC;AACA,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAClD,QAAM,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AACtE,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACtD,QAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAC9C,MAAI,QAAQ,SAAU,OAAM,QAAQ,SAAS,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AAC3E,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;","names":[]}

package/dist/{chunk-MTJXFHYD.js → chunk-EYXTDVDY.js}

@@ -1,6 +1,6 @@
 import {
   createWorkspaceKeyManager
-} from "./chunk-EAJSWUU5.js";
+} from "./chunk-YS6A6G57.js";
 import {
   createFieldCrypto
 } from "./chunk-TA5Q4I2K.js";
@@ -315,4 +315,4 @@ export {
   createPresetWorkspaceKeyStore,
   createPresetWorkspaceKeyManager
 };
-//# sourceMappingURL=chunk-MTJXFHYD.js.map
+//# sourceMappingURL=chunk-EYXTDVDY.js.map

package/dist/{chunk-EAJSWUU5.js → chunk-YS6A6G57.js}

@@ -1,4 +1,21 @@
 // src/billing/index.ts
+function createTcloudKeyProvisioner(client) {
+  return {
+    createKey: async (input) => {
+      const created = await client.createKey(input);
+      return { id: created.id, key: created.key };
+    },
+    revokeKey: (keyId) => client.revokeKey(keyId),
+    getKey: async (keyId) => {
+      const info = await client.getKey(keyId);
+      return {
+        budgetUsd: info.budgetUsd ?? void 0,
+        budgetSpent: info.budgetSpent ?? void 0,
+        expiresAt: info.expiresAt ?? null
+      };
+    }
+  };
+}
 function nextPeriodEnd(now) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0));
 }
@@ -111,7 +128,8 @@ function createWorkspaceKeyManager(opts) {
 }
 
 export {
+  createTcloudKeyProvisioner,
   createPlatformBalanceManager,
   createWorkspaceKeyManager
 };
-//# sourceMappingURL=chunk-EAJSWUU5.js.map
+//# sourceMappingURL=chunk-YS6A6G57.js.map

package/dist/chunk-YS6A6G57.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/billing/index.ts"],"sourcesContent":["/**\n * Per-workspace budget-capped model keys — app-owned billing, metered on Tangle.\n *\n * Each workspace (the paying entity) runs the agent on its OWN child API key\n * minted from the platform parent key. The child carries a hard USD budget the\n * Tangle Router enforces AT THE KEY — model spend can't exceed the allowance,\n * zero app-side accounting. The app charges its own subscription (e.g. 5× the\n * allowance) and re-provisions each period. Child budgets are IMMUTABLE on the\n * platform, so a new budget = a fresh key + revoke the prior (rotate).\n *\n * The mint / rotate / rollover / usage LOGIC is generic and lives here.\n * Persistence (which D1 table), secret encryption, and key provisioning are\n * SEAMS each product supplies — so this module imports no DB and no key-mgmt\n * SDK (structural contracts only, like `../tangle`). The `@tangle-network/tcloud`\n * SDK is the provisioner a product passes in; it is not a dependency here.\n */\n\n/** The key-provisioning operations the key manager needs. Wire it from the\n *  platform via {@link createTcloudKeyProvisioner} rather than casting. */\nexport interface KeyProvisioner {\n  createKey(input: { name: string; product: string; budgetUsd: number; expiresAt: string }): Promise<{ id?: string; key?: string }>\n  revokeKey(keyId: string): Promise<unknown>\n  getKey(keyId: string): Promise<{ budgetUsd?: number; budgetSpent?: number; expiresAt?: string | null }>\n}\n\n/**\n * The subset of the `@tangle-network/tcloud` `TCloudClient` the provisioner uses\n * — declared with METHOD syntax so the real client (whose `product` is a narrow\n * union and whose budgets are `number | null`) is assignable bivariantly. The\n * real SDK client satisfies this; pass it straight in.\n */\nexport interface TcloudKeyClient {\n  createKey(opts: {\n    name: string\n    product?: string\n    budgetUsd?: number\n    expiresAt?: string\n    parentKeyId?: string\n    allowedModels?: string[]\n    rpmLimit?: number\n  }): Promise<{ id: string; key: string }>\n  getKey(id: string): Promise<{ budgetUsd?: number | null; budgetSpent?: number; expiresAt?: string | null }>\n  revokeKey(id: string): Promise<unknown>\n}\n\n/**\n * Adapt the tcloud SDK client to {@link KeyProvisioner} — the typed seam that\n * replaces the `as unknown as KeyProvisioner` cast every consumer otherwise\n * repeats. The platform already exposes child-key minting (parent→child key,\n * per-key USD budget, expiry); this maps its shapes (`product` union,\n * `number | null` budgets) onto the manager's contract (`null → undefined`).\n */\nexport function createTcloudKeyProvisioner(client: TcloudKeyClient): KeyProvisioner {\n  return {\n    createKey: async (input) => {\n      const created = await client.createKey(input)\n      return { id: created.id, key: created.key }\n    },\n    revokeKey: (keyId) => client.revokeKey(keyId),\n    getKey: async (keyId) => {\n      const info = await client.getKey(keyId)\n      return {\n        budgetUsd: info.budgetUsd ?? undefined,\n        budgetSpent: info.budgetSpent ?? undefined,\n        expiresAt: info.expiresAt ?? null,\n      }\n    },\n  }\n}\n\n/** A stored child-key record (the app's row, shape-normalized). */\nexport interface WorkspaceKeyRecord {\n  /** App row id (opaque). */\n  id: string\n  keyId: string\n  /** The encrypted secret — decrypted via {@link KeyCrypto.decrypt}. */\n  keyEncrypted: string\n  budgetUsd: number\n  expiresAt: Date | null\n}\n\n/** Persistence seam — the product implements this against its own D1 table. */\nexport interface WorkspaceKeyStore {\n  /** Most-recent active key for the workspace, or null. */\n  getActive(workspaceId: string): Promise<WorkspaceKeyRecord | null>\n  /** All active keys (to revoke priors on rotate). */\n  listActive(workspaceId: string): Promise<Array<{ id: string; keyId: string }>>\n  /** Persist a freshly minted active key. */\n  insert(record: { workspaceId: string; keyId: string; keyEncrypted: string; budgetUsd: number; expiresAt: Date }): Promise<void>\n  /** Mark a prior row revoked. */\n  markRevoked(id: string, now: Date): Promise<void>\n}\n\n/** Secret encryption seam (the app's at-rest crypto). */\nexport interface KeyCrypto {\n  encrypt(secret: string): Promise<string>\n  decrypt(encrypted: string): Promise<string>\n}\n\nexport interface WorkspaceKeyManagerOptions {\n  provisioner: KeyProvisioner\n  store: WorkspaceKeyStore\n  crypto: KeyCrypto\n  /** Default monthly allowance (USD) when a call doesn't specify one. */\n  defaultBudgetUsd: number\n  /** Injectable clock. Default `() => new Date()`. */\n  now?: () => Date\n  /** tcloud product the key is scoped to. Default `'router'`. */\n  product?: string\n}\n\nexport interface WorkspaceModelKeyUsage {\n  keyId: string\n  budgetUsd: number\n  budgetSpent: number\n  budgetRemaining: number\n  expiresAt: string | null\n  exhausted: boolean\n}\n\nexport interface WorkspaceKeyManager {\n  /** The workspace's active child-key secret, provisioning one if absent/expired. */\n  ensureKey(workspaceId: string, opts?: { budgetUsd?: number }): Promise<string>\n  /** Mint a fresh key + revoke priors (period renewal / top-up). `rollover`\n   *  carries the prior key's unused budget into the new one, bounded by\n   *  `rolloverCapUsd`. Returns the new secret. */\n  rotateKey(workspaceId: string, opts?: { budgetUsd?: number; rollover?: boolean; rolloverCapUsd?: number }): Promise<string>\n  /** Live budget usage for the active key (drives the \"$X of $Y used\" panel). */\n  getUsage(workspaceId: string): Promise<WorkspaceModelKeyUsage | null>\n}\n\n/** Period end = first day of next month, midnight UTC. Keys expire at the period\n *  boundary so a forgotten rotation fails closed rather than running free. */\nfunction nextPeriodEnd(now: Date): Date {\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0))\n}\n\n// ---------------------------------------------------------------------------\n// Shared-platform-balance billing\n//\n// A DIFFERENT model from the per-workspace child-key manager above: here every\n// user runs against a SHARED platform balance (id.tangle.tools), keyed by the\n// user's platform identity. The app owns no key minting — it reads the balance,\n// gates a billable turn, and deducts spend through the platform billing API.\n// Plan limits, the platform transport, and identity resolution are SEAMS the\n// product supplies; this module imports no DB and no HTTP client.\n// ---------------------------------------------------------------------------\n\n/** A user's resolved platform identity (from the app's SSO account store). */\nexport interface PlatformIdentity {\n  platformUserId: string\n  /** The user's per-user platform API key (reads), or null when unlinked. */\n  apiKey: string | null\n}\n\n/** Spendable balance for a platform user. */\nexport interface PlatformBalanceInfo {\n  balance: number\n  lifetimeSpent: number\n}\n\n/** Per-product spend aggregate. */\nexport interface PlatformProductUsage {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Plan limits — a PARAMETER per product (dollar allowance, concurrency,\n *  overage policy). Never baked into the framework. */\nexport interface PlanLimit {\n  monthlyBalanceUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * The platform billing transport — the product wires these to id.tangle.tools\n * (or any balance backend). Reads authenticate as the user (their `apiKey`);\n * the deduct write is a service-token call naming the target user. This module\n * never touches HTTP — it only sequences these calls.\n */\nexport interface PlatformBillingClient<Plan extends string> {\n  /** Resolve the user's platform identity, or null when there is no SSO account. */\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n  /** Subscription plan for the user (via their platform key). */\n  getPlan(apiKey: string): Promise<Plan>\n  /** Spendable balance for the user (via their platform key). */\n  getBalance(apiKey: string): Promise<PlatformBalanceInfo>\n  /** Per-product usage rows for the user (via their platform key). */\n  getUsageByProduct(apiKey: string): Promise<PlatformProductUsage[]>\n  /** Deduct spend against the user's balance (service-token write). */\n  deduct(input: { platformUserId: string; amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n}\n\nexport interface SharedBillingState<Plan extends string> {\n  /** Platform user id, or null when the user has no Tangle SSO account. */\n  platformUserId: string | null\n  plan: Plan\n  monthlyBalanceUsd: number\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport interface PlatformBalanceManagerOptions<Plan extends string> {\n  client: PlatformBillingClient<Plan>\n  /** Plan → limits map (the product's pricing). */\n  planLimits: Record<Plan, PlanLimit>\n  /** The plan an unlinked / outage user falls to (fails CLOSED). */\n  freePlan: Plan\n  /** The product slug to attribute usage to (for `getProductUsage`). */\n  productSlug: string\n}\n\nexport interface PlatformBalanceManager<Plan extends string> {\n  /** Resolve the user's plan + balance. Unlinked or platform-outage users fail\n   *  CLOSED: free plan, zero remaining balance — a billable run is never started\n   *  against an unknown balance. */\n  getState(userId: string): Promise<SharedBillingState<Plan>>\n  /** Gate a billable turn: allowed when the plan permits overage or remaining\n   *  balance is positive. Returns the state so the caller deducts against it. */\n  canStartBillableTurn(userId: string): Promise<{ allowed: boolean; state: SharedBillingState<Plan> }>\n  /** Deduct `amountUsd` against the user's platform balance. Throws when the\n   *  user is not platform-linked. */\n  deduct(userId: string, params: { amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n  /** This product's spend for the user (drives a usage panel). */\n  getProductUsage(userId: string): Promise<{ spentUsd: number; transactionCount: number }>\n}\n\nexport function createPlatformBalanceManager<Plan extends string>(\n  opts: PlatformBalanceManagerOptions<Plan>,\n): PlatformBalanceManager<Plan> {\n  const { client, planLimits, freePlan, productSlug } = opts\n\n  const getState: PlatformBalanceManager<Plan>['getState'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    // No SSO account, or linked without a platform key: unlinked free tier with\n    // zero balance. Reads require the user's key — never call them empty.\n    if (!identity || !identity.apiKey) {\n      const limits = planLimits[freePlan]\n      return {\n        platformUserId: identity?.platformUserId ?? null,\n        plan: freePlan,\n        monthlyBalanceUsd: limits.monthlyBalanceUsd,\n        remainingBalanceUsd: 0,\n        lifetimeSpentUsd: 0,\n        concurrency: limits.concurrency,\n        overageAllowed: limits.overageAllowed,\n      }\n    }\n    const [plan, balance] = await Promise.all([client.getPlan(identity.apiKey), client.getBalance(identity.apiKey)])\n    const limits = planLimits[plan]\n    return {\n      platformUserId: identity.platformUserId,\n      plan,\n      monthlyBalanceUsd: limits.monthlyBalanceUsd,\n      remainingBalanceUsd: balance.balance,\n      lifetimeSpentUsd: balance.lifetimeSpent,\n      concurrency: limits.concurrency,\n      overageAllowed: limits.overageAllowed,\n    }\n  }\n\n  const canStartBillableTurn: PlatformBalanceManager<Plan>['canStartBillableTurn'] = async (userId) => {\n    const state = await getState(userId)\n    if (!state.platformUserId) return { allowed: false, state }\n    const allowed = state.overageAllowed || state.remainingBalanceUsd > 0\n    return { allowed, state }\n  }\n\n  const deduct: PlatformBalanceManager<Plan>['deduct'] = async (userId, params) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity) throw new Error('Shared billing requires a platform-linked user')\n    await client.deduct({\n      platformUserId: identity.platformUserId,\n      amountUsd: params.amountUsd,\n      type: params.type,\n      description: params.description,\n      referenceId: params.referenceId,\n    })\n  }\n\n  const getProductUsage: PlatformBalanceManager<Plan>['getProductUsage'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity?.apiKey) return { spentUsd: 0, transactionCount: 0 }\n    const rows = await client.getUsageByProduct(identity.apiKey)\n    const product = rows.find((row) => row.product === productSlug)\n    return { spentUsd: product?.totalSpent ?? 0, transactionCount: product?.count ?? 0 }\n  }\n\n  return { getState, canStartBillableTurn, deduct, getProductUsage }\n}\n\nexport function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager {\n  const clock = opts.now ?? (() => new Date())\n  const product = opts.product ?? 'router'\n\n  const getUsage: WorkspaceKeyManager['getUsage'] = async (workspaceId) => {\n    const active = await opts.store.getActive(workspaceId)\n    if (!active) return null\n    const info = await opts.provisioner.getKey(active.keyId)\n    const budgetUsd = info.budgetUsd ?? active.budgetUsd\n    const budgetSpent = info.budgetSpent ?? 0\n    const budgetRemaining = Math.max(0, budgetUsd - budgetSpent)\n    return {\n      keyId: active.keyId,\n      budgetUsd,\n      budgetSpent,\n      budgetRemaining,\n      expiresAt: info.expiresAt ?? (active.expiresAt ? active.expiresAt.toISOString() : null),\n      exhausted: budgetRemaining <= 0,\n    }\n  }\n\n  const rotateKey: WorkspaceKeyManager['rotateKey'] = async (workspaceId, ropts) => {\n    const now = clock()\n    const allowance = ropts?.budgetUsd ?? opts.defaultBudgetUsd\n\n    let budgetUsd = allowance\n    if (ropts?.rollover) {\n      const prior = await getUsage(workspaceId).catch(() => null)\n      budgetUsd = allowance + (prior?.budgetRemaining ?? 0)\n      if (ropts.rolloverCapUsd != null) budgetUsd = Math.min(budgetUsd, ropts.rolloverCapUsd)\n    }\n\n    const expiresAt = nextPeriodEnd(now)\n    const created = await opts.provisioner.createKey({ name: `ws:${workspaceId}`, product, budgetUsd, expiresAt: expiresAt.toISOString() })\n    if (!created.key || !created.id) throw new Error('tcloud createKey returned no key')\n    const keyEncrypted = await opts.crypto.encrypt(created.key)\n\n    const priors = await opts.store.listActive(workspaceId)\n    await opts.store.insert({ workspaceId, keyId: created.id, keyEncrypted, budgetUsd, expiresAt })\n    for (const p of priors) {\n      await opts.store.markRevoked(p.id, now)\n      // Best-effort upstream revoke — the row is already revoked and an expired\n      // key fails closed regardless, so a transient error is non-fatal.\n      try {\n        await opts.provisioner.revokeKey(p.keyId)\n      } catch {\n        /* non-fatal */\n      }\n    }\n    return created.key\n  }\n\n  const ensureKey: WorkspaceKeyManager['ensureKey'] = async (workspaceId, eopts) => {\n    const now = clock()\n    const active = await opts.store.getActive(workspaceId)\n    if (active && (!active.expiresAt || active.expiresAt.getTime() > now.getTime())) {\n      return opts.crypto.decrypt(active.keyEncrypted)\n    }\n    return rotateKey(workspaceId, { budgetUsd: eopts?.budgetUsd })\n  }\n\n  return { ensureKey, rotateKey, getUsage }\n}\n"],"mappings":";AAoDO,SAAS,2BAA2B,QAAyC;AAClF,SAAO;AAAA,IACL,WAAW,OAAO,UAAU;AAC1B,YAAM,UAAU,MAAM,OAAO,UAAU,KAAK;AAC5C,aAAO,EAAE,IAAI,QAAQ,IAAI,KAAK,QAAQ,IAAI;AAAA,IAC5C;AAAA,IACA,WAAW,CAAC,UAAU,OAAO,UAAU,KAAK;AAAA,IAC5C,QAAQ,OAAO,UAAU;AACvB,YAAM,OAAO,MAAM,OAAO,OAAO,KAAK;AACtC,aAAO;AAAA,QACL,WAAW,KAAK,aAAa;AAAA,QAC7B,aAAa,KAAK,eAAe;AAAA,QACjC,WAAW,KAAK,aAAa;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAiEA,SAAS,cAAc,KAAiB;AACtC,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;AACtF;AAgGO,SAAS,6BACd,MAC8B;AAC9B,QAAM,EAAE,QAAQ,YAAY,UAAU,YAAY,IAAI;AAEtD,QAAM,WAAqD,OAAO,WAAW;AAC3E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AAGpD,QAAI,CAAC,YAAY,CAAC,SAAS,QAAQ;AACjC,YAAMA,UAAS,WAAW,QAAQ;AAClC,aAAO;AAAA,QACL,gBAAgB,UAAU,kBAAkB;AAAA,QAC5C,MAAM;AAAA,QACN,mBAAmBA,QAAO;AAAA,QAC1B,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,QAClB,aAAaA,QAAO;AAAA,QACpB,gBAAgBA,QAAO;AAAA,MACzB;AAAA,IACF;AACA,UAAM,CAAC,MAAM,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,OAAO,WAAW,SAAS,MAAM,CAAC,CAAC;AAC/G,UAAM,SAAS,WAAW,IAAI;AAC9B,WAAO;AAAA,MACL,gBAAgB,SAAS;AAAA,MACzB;AAAA,MACA,mBAAmB,OAAO;AAAA,MAC1B,qBAAqB,QAAQ;AAAA,MAC7B,kBAAkB,QAAQ;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAA6E,OAAO,WAAW;AACnG,UAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAI,CAAC,MAAM,eAAgB,QAAO,EAAE,SAAS,OAAO,MAAM;AAC1D,UAAM,UAAU,MAAM,kBAAkB,MAAM,sBAAsB;AACpE,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,QAAM,SAAiD,OAAO,QAAQ,WAAW;AAC/E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC/E,UAAM,OAAO,OAAO;AAAA,MAClB,gBAAgB,SAAS;AAAA,MACzB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAmE,OAAO,WAAW;AACzF,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,UAAU,OAAQ,QAAO,EAAE,UAAU,GAAG,kBAAkB,EAAE;AACjE,UAAM,OAAO,MAAM,OAAO,kBAAkB,SAAS,MAAM;AAC3D,UAAM,UAAU,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,WAAW;AAC9D,WAAO,EAAE,UAAU,SAAS,cAAc,GAAG,kBAAkB,SAAS,SAAS,EAAE;AAAA,EACrF;AAEA,SAAO,EAAE,UAAU,sBAAsB,QAAQ,gBAAgB;AACnE;AAEO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,QAAQ,KAAK,QAAQ,MAAM,oBAAI,KAAK;AAC1C,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,WAA4C,OAAO,gBAAgB;AACvE,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,OAAO,KAAK;AACvD,UAAM,YAAY,KAAK,aAAa,OAAO;AAC3C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,kBAAkB,KAAK,IAAI,GAAG,YAAY,WAAW;AAC3D,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,cAAc,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,MAClF,WAAW,mBAAmB;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,YAAY,OAAO,aAAa,KAAK;AAE3C,QAAI,YAAY;AAChB,QAAI,OAAO,UAAU;AACnB,YAAM,QAAQ,MAAM,SAAS,WAAW,EAAE,MAAM,MAAM,IAAI;AAC1D,kBAAY,aAAa,OAAO,mBAAmB;AACnD,UAAI,MAAM,kBAAkB,KAAM,aAAY,KAAK,IAAI,WAAW,MAAM,cAAc;AAAA,IACxF;AAEA,UAAM,YAAY,cAAc,GAAG;AACnC,UAAM,UAAU,MAAM,KAAK,YAAY,UAAU,EAAE,MAAM,MAAM,WAAW,IAAI,SAAS,WAAW,WAAW,UAAU,YAAY,EAAE,CAAC;AACtI,QAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kCAAkC;AACnF,UAAM,eAAe,MAAM,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAE1D,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,WAAW;AACtD,UAAM,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,QAAQ,IAAI,cAAc,WAAW,UAAU,CAAC;AAC9F,eAAW,KAAK,QAAQ;AACtB,YAAM,KAAK,MAAM,YAAY,EAAE,IAAI,GAAG;AAGtC,UAAI;AACF,cAAM,KAAK,YAAY,UAAU,EAAE,KAAK;AAAA,MAC1C,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,WAAW,CAAC,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAC/E,aAAO,KAAK,OAAO,QAAQ,OAAO,YAAY;AAAA,IAChD;AACA,WAAO,UAAU,aAAa,EAAE,WAAW,OAAO,UAAU,CAAC;AAAA,EAC/D;AAEA,SAAO,EAAE,WAAW,WAAW,SAAS;AAC1C;","names":["limits"]}

package/dist/index.d.ts

@@ -9,12 +9,12 @@ export { CreateKnowledgeLoopDeps, KnowledgeCandidate, KnowledgeDecider, Knowledg
 export { DEFAULT_HARNESS, Harness, KNOWN_HARNESSES, ResolveSessionHarnessInput, ResolvedSessionHarness, coerceHarness, isHarness, resolveSessionHarness } from './harness/index.js';
 export { AgentAppConfig, AgentDelegationConfig, AgentIdentityConfig, AgentIntegrationsConfig, AgentKnowledgeConfig, AgentTaxonomyConfig, AgentUiConfig, KnowledgeLoopConfig, KnowledgeSourceSpec, agentAppConfigJsonSchema, defineAgentApp } from './config/index.js';
 export { D1Like, D1PreparedLike, DrizzleColumnLike, DrizzleSqliteCoreLike, PRESET_MIGRATION_SQL, PRESET_TABLES, PresetBillingOptions, PresetKnowledgeAccessorOptions, PresetToolHandlerOptions, VaultKv, createD1KnowledgeStateAccessor, createPresetDrizzleSchema, createPresetFieldCrypto, createPresetToolHandlers, createPresetWorkspaceKeyManager, createPresetWorkspaceKeyStore } from './preset-cloudflare/index.js';
-export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBalanceManager, PlatformBalanceManagerOptions, PlatformBillingClient, PlatformIdentity, PlatformProductUsage, SharedBillingState, WorkspaceKeyManager, WorkspaceKeyManagerOptions, WorkspaceKeyRecord, WorkspaceKeyStore, WorkspaceModelKeyUsage, createPlatformBalanceManager, createWorkspaceKeyManager } from './billing/index.js';
+export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBalanceManager, PlatformBalanceManagerOptions, PlatformBillingClient, PlatformIdentity, PlatformProductUsage, SharedBillingState, TcloudKeyClient, WorkspaceKeyManager, WorkspaceKeyManagerOptions, WorkspaceKeyRecord, WorkspaceKeyStore, WorkspaceModelKeyUsage, createPlatformBalanceManager, createTcloudKeyProvisioner, createWorkspaceKeyManager } from './billing/index.js';
 export { DeriveKeyOptions, createFieldCrypto, decodeHexKey, decryptAesGcm, decryptBytes, decryptWithKey, deriveKey, encryptAesGcm, encryptBytes, encryptWithKey } from './crypto/index.js';
 export { JsonRecord, PersistedChatMessageForTurn, ResolvedChatTurn, StreamEvent, asRecord, asString, buildUserTextParts, encodeEvent, finalizeAssistantParts, getPartKey, mergePersistedPart, messageHasTurnId, normalizeClientTurnId, normalizePersistedPart, normalizeTime, normalizeToolEvent, resolveChatTurn, resolveToolId, resolveToolName } from './stream/index.js';
 export { HubExecClient, HubExecClientOptions, HubExecErrorCode, HubExecResult, HubInvokeDeps, HubInvokeInput, HubInvokeOutcome, ParsedIntegrationAction, invokeIntegrationHub, resolveIntegrationAction } from './integrations/index.js';
 export { JsonObject, KvLike, RateLimitResult, RequestContext, SecurityHeaderOptions, addSecurityHeaders, checkRateLimit, extractRequestContext, parseJsonObjectBody, requireString } from './web/index.js';
-export { BuildRedactedDocumentOptions, DEFAULT_REDACTION_PATTERNS, RedactForIngestionOptions, RedactedDocSegment, RedactedDocument, RedactionPattern, RedactionSpan, RevealResult, RevealSpanOptions, buildRedactedDocument, detectSpans, redactForIngestion, revealSpan } from './redact/index.js';
+export { BuildRedactedDocumentOptions, DEFAULT_REDACTION_PATTERNS, RedactForIngestionOptions, RedactedDocSegment, RedactedDocument, RedactionPattern, RedactionSpan, RevealResult, RevealSpanOptions, buildRedactedDocument, detectSpans, maskSpans, redactForIngestion, revealSpan } from './redact/index.js';
 export { CompletionRequirement, CompletionVerdict, CorrectnessChecker, ProducedState, RuntimeEventLike, SatisfiedBy, TaskGold, createLlmCorrectnessChecker, extractProducedState, verifyCompletion, weightedComposite } from '@tangle-network/agent-eval';
 export { D as DEFAULT_TANGLE_ROUTER_BASE_URL, R as ResolveModelOptions, T as TangleModelConfig, r as resolveTangleModelConfig } from './model-BOP69mVu.js';
 import '@tangle-network/agent-knowledge';

package/dist/index.js

@@ -2,9 +2,10 @@ import {
   DEFAULT_REDACTION_PATTERNS,
   buildRedactedDocument,
   detectSpans,
+  maskSpans,
   redactForIngestion,
   revealSpan
-} from "./chunk-MSXDQ2GB.js";
+} from "./chunk-5RMIUJDI.js";
 import {
   DEFAULT_HARNESS,
   KNOWN_HARNESSES,
@@ -25,11 +26,12 @@ import {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore
-} from "./chunk-MTJXFHYD.js";
+} from "./chunk-EYXTDVDY.js";
 import {
   createPlatformBalanceManager,
+  createTcloudKeyProvisioner,
   createWorkspaceKeyManager
-} from "./chunk-EAJSWUU5.js";
+} from "./chunk-YS6A6G57.js";
 import {
   createFieldCrypto,
   decodeHexKey,
@@ -167,6 +169,7 @@ export {
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore,
   createReviewerDecider,
+  createTcloudKeyProvisioner,
   createTokenRecallChecker,
   createWorkspaceKeyManager,
   decodeHexKey,
@@ -191,6 +194,7 @@ export {
   invokeIntegrationHub,
   isAppToolName,
   isHarness,
+  maskSpans,
   mergePersistedPart,
   messageHasTurnId,
   normalizeClientTurnId,

package/dist/preset-cloudflare/index.js

@@ -7,8 +7,8 @@ import {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore
-} from "../chunk-MTJXFHYD.js";
-import "../chunk-EAJSWUU5.js";
+} from "../chunk-EYXTDVDY.js";
+import "../chunk-YS6A6G57.js";
 import "../chunk-TA5Q4I2K.js";
 export {
   PRESET_MIGRATION_SQL,

package/dist/redact/index.d.ts

@@ -40,7 +40,24 @@ interface RedactForIngestionOptions {
     /** Extra sensitive object-key names (case-insensitive) added to the built-in
      *  set, e.g. the snake_case `api_key` an intake form uses. Additive. */
     extraSensitiveKeys?: readonly string[];
+    /**
+     * How a matched string is rewritten:
+     * - `'collapse'` (default) — the whole string becomes `[REDACTED:<kind>]` on
+     *   the first matching pattern. Safest for telemetry: nothing of the original
+     *   survives.
+     * - `'mask-spans'` — only the matched substrings are replaced (each with
+     *   `[REDACTED:<kind>]`), preserving surrounding text. Use when a downstream
+     *   reader needs the non-PII context (e.g. an analyst loop reading prose).
+     */
+    stringMode?: 'collapse' | 'mask-spans';
 }
+/**
+ * Replace only the PII substrings in `text`, preserving everything around them
+ * (the `mask-spans` string mode). Built on {@link detectSpans} so matching,
+ * non-overlap, and `validate` predicates behave identically to the reversible
+ * path. Each span becomes `[REDACTED:<kind>]`.
+ */
+declare function maskSpans(text: string, patterns?: readonly RedactionPattern[]): string;
 /**
  * One-way PII scrub for telemetry/ingestion. Backward-compatible: called with no
  * options it behaves exactly as before (SSN/EIN strings + sensitive object keys
@@ -119,4 +136,4 @@ interface RevealResult {
  */
 declare function revealSpan(doc: RedactedDocument, spanId: string, options: RevealSpanOptions): Promise<RevealResult>;
 
-export { type BuildRedactedDocumentOptions, DEFAULT_REDACTION_PATTERNS, type RedactForIngestionOptions, type RedactedDocSegment, type RedactedDocument, type RedactionPattern, type RedactionSpan, type RevealResult, type RevealSpanOptions, buildRedactedDocument, detectSpans, redactForIngestion, revealSpan };
+export { type BuildRedactedDocumentOptions, DEFAULT_REDACTION_PATTERNS, type RedactForIngestionOptions, type RedactedDocSegment, type RedactedDocument, type RedactionPattern, type RedactionSpan, type RevealResult, type RevealSpanOptions, buildRedactedDocument, detectSpans, maskSpans, redactForIngestion, revealSpan };

package/dist/redact/index.js

@@ -2,13 +2,15 @@ import {
   DEFAULT_REDACTION_PATTERNS,
   buildRedactedDocument,
   detectSpans,
+  maskSpans,
   redactForIngestion,
   revealSpan
-} from "../chunk-MSXDQ2GB.js";
+} from "../chunk-5RMIUJDI.js";
 export {
   DEFAULT_REDACTION_PATTERNS,
   buildRedactedDocument,
   detectSpans,
+  maskSpans,
   redactForIngestion,
   revealSpan
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "packageManager": "pnpm@10.33.4",
   "description": "Application-shell framework for Tangle agent products: a bounded tool loop, the structured agent→app tool side channel, integration-hub client, per-workspace billing, and crypto — composed over the Tangle agent substrate through typed seams.",
   "keywords": [

package/dist/chunk-EAJSWUU5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/billing/index.ts"],"sourcesContent":["/**\n * Per-workspace budget-capped model keys — app-owned billing, metered on Tangle.\n *\n * Each workspace (the paying entity) runs the agent on its OWN child API key\n * minted from the platform parent key. The child carries a hard USD budget the\n * Tangle Router enforces AT THE KEY — model spend can't exceed the allowance,\n * zero app-side accounting. The app charges its own subscription (e.g. 5× the\n * allowance) and re-provisions each period. Child budgets are IMMUTABLE on the\n * platform, so a new budget = a fresh key + revoke the prior (rotate).\n *\n * The mint / rotate / rollover / usage LOGIC is generic and lives here.\n * Persistence (which D1 table), secret encryption, and key provisioning are\n * SEAMS each product supplies — so this module imports no DB and no key-mgmt\n * SDK (structural contracts only, like `../tangle`). The `@tangle-network/tcloud`\n * SDK is the provisioner a product passes in; it is not a dependency here.\n */\n\n/** The key-provisioning operations this needs — the `@tangle-network/tcloud`\n *  SDK's `TCloudClient` satisfies it structurally; pass it in. */\nexport interface KeyProvisioner {\n  createKey(input: { name: string; product: string; budgetUsd: number; expiresAt: string }): Promise<{ id?: string; key?: string }>\n  revokeKey(keyId: string): Promise<unknown>\n  getKey(keyId: string): Promise<{ budgetUsd?: number; budgetSpent?: number; expiresAt?: string | null }>\n}\n\n/** A stored child-key record (the app's row, shape-normalized). */\nexport interface WorkspaceKeyRecord {\n  /** App row id (opaque). */\n  id: string\n  keyId: string\n  /** The encrypted secret — decrypted via {@link KeyCrypto.decrypt}. */\n  keyEncrypted: string\n  budgetUsd: number\n  expiresAt: Date | null\n}\n\n/** Persistence seam — the product implements this against its own D1 table. */\nexport interface WorkspaceKeyStore {\n  /** Most-recent active key for the workspace, or null. */\n  getActive(workspaceId: string): Promise<WorkspaceKeyRecord | null>\n  /** All active keys (to revoke priors on rotate). */\n  listActive(workspaceId: string): Promise<Array<{ id: string; keyId: string }>>\n  /** Persist a freshly minted active key. */\n  insert(record: { workspaceId: string; keyId: string; keyEncrypted: string; budgetUsd: number; expiresAt: Date }): Promise<void>\n  /** Mark a prior row revoked. */\n  markRevoked(id: string, now: Date): Promise<void>\n}\n\n/** Secret encryption seam (the app's at-rest crypto). */\nexport interface KeyCrypto {\n  encrypt(secret: string): Promise<string>\n  decrypt(encrypted: string): Promise<string>\n}\n\nexport interface WorkspaceKeyManagerOptions {\n  provisioner: KeyProvisioner\n  store: WorkspaceKeyStore\n  crypto: KeyCrypto\n  /** Default monthly allowance (USD) when a call doesn't specify one. */\n  defaultBudgetUsd: number\n  /** Injectable clock. Default `() => new Date()`. */\n  now?: () => Date\n  /** tcloud product the key is scoped to. Default `'router'`. */\n  product?: string\n}\n\nexport interface WorkspaceModelKeyUsage {\n  keyId: string\n  budgetUsd: number\n  budgetSpent: number\n  budgetRemaining: number\n  expiresAt: string | null\n  exhausted: boolean\n}\n\nexport interface WorkspaceKeyManager {\n  /** The workspace's active child-key secret, provisioning one if absent/expired. */\n  ensureKey(workspaceId: string, opts?: { budgetUsd?: number }): Promise<string>\n  /** Mint a fresh key + revoke priors (period renewal / top-up). `rollover`\n   *  carries the prior key's unused budget into the new one, bounded by\n   *  `rolloverCapUsd`. Returns the new secret. */\n  rotateKey(workspaceId: string, opts?: { budgetUsd?: number; rollover?: boolean; rolloverCapUsd?: number }): Promise<string>\n  /** Live budget usage for the active key (drives the \"$X of $Y used\" panel). */\n  getUsage(workspaceId: string): Promise<WorkspaceModelKeyUsage | null>\n}\n\n/** Period end = first day of next month, midnight UTC. Keys expire at the period\n *  boundary so a forgotten rotation fails closed rather than running free. */\nfunction nextPeriodEnd(now: Date): Date {\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0))\n}\n\n// ---------------------------------------------------------------------------\n// Shared-platform-balance billing\n//\n// A DIFFERENT model from the per-workspace child-key manager above: here every\n// user runs against a SHARED platform balance (id.tangle.tools), keyed by the\n// user's platform identity. The app owns no key minting — it reads the balance,\n// gates a billable turn, and deducts spend through the platform billing API.\n// Plan limits, the platform transport, and identity resolution are SEAMS the\n// product supplies; this module imports no DB and no HTTP client.\n// ---------------------------------------------------------------------------\n\n/** A user's resolved platform identity (from the app's SSO account store). */\nexport interface PlatformIdentity {\n  platformUserId: string\n  /** The user's per-user platform API key (reads), or null when unlinked. */\n  apiKey: string | null\n}\n\n/** Spendable balance for a platform user. */\nexport interface PlatformBalanceInfo {\n  balance: number\n  lifetimeSpent: number\n}\n\n/** Per-product spend aggregate. */\nexport interface PlatformProductUsage {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Plan limits — a PARAMETER per product (dollar allowance, concurrency,\n *  overage policy). Never baked into the framework. */\nexport interface PlanLimit {\n  monthlyBalanceUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * The platform billing transport — the product wires these to id.tangle.tools\n * (or any balance backend). Reads authenticate as the user (their `apiKey`);\n * the deduct write is a service-token call naming the target user. This module\n * never touches HTTP — it only sequences these calls.\n */\nexport interface PlatformBillingClient<Plan extends string> {\n  /** Resolve the user's platform identity, or null when there is no SSO account. */\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n  /** Subscription plan for the user (via their platform key). */\n  getPlan(apiKey: string): Promise<Plan>\n  /** Spendable balance for the user (via their platform key). */\n  getBalance(apiKey: string): Promise<PlatformBalanceInfo>\n  /** Per-product usage rows for the user (via their platform key). */\n  getUsageByProduct(apiKey: string): Promise<PlatformProductUsage[]>\n  /** Deduct spend against the user's balance (service-token write). */\n  deduct(input: { platformUserId: string; amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n}\n\nexport interface SharedBillingState<Plan extends string> {\n  /** Platform user id, or null when the user has no Tangle SSO account. */\n  platformUserId: string | null\n  plan: Plan\n  monthlyBalanceUsd: number\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport interface PlatformBalanceManagerOptions<Plan extends string> {\n  client: PlatformBillingClient<Plan>\n  /** Plan → limits map (the product's pricing). */\n  planLimits: Record<Plan, PlanLimit>\n  /** The plan an unlinked / outage user falls to (fails CLOSED). */\n  freePlan: Plan\n  /** The product slug to attribute usage to (for `getProductUsage`). */\n  productSlug: string\n}\n\nexport interface PlatformBalanceManager<Plan extends string> {\n  /** Resolve the user's plan + balance. Unlinked or platform-outage users fail\n   *  CLOSED: free plan, zero remaining balance — a billable run is never started\n   *  against an unknown balance. */\n  getState(userId: string): Promise<SharedBillingState<Plan>>\n  /** Gate a billable turn: allowed when the plan permits overage or remaining\n   *  balance is positive. Returns the state so the caller deducts against it. */\n  canStartBillableTurn(userId: string): Promise<{ allowed: boolean; state: SharedBillingState<Plan> }>\n  /** Deduct `amountUsd` against the user's platform balance. Throws when the\n   *  user is not platform-linked. */\n  deduct(userId: string, params: { amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n  /** This product's spend for the user (drives a usage panel). */\n  getProductUsage(userId: string): Promise<{ spentUsd: number; transactionCount: number }>\n}\n\nexport function createPlatformBalanceManager<Plan extends string>(\n  opts: PlatformBalanceManagerOptions<Plan>,\n): PlatformBalanceManager<Plan> {\n  const { client, planLimits, freePlan, productSlug } = opts\n\n  const getState: PlatformBalanceManager<Plan>['getState'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    // No SSO account, or linked without a platform key: unlinked free tier with\n    // zero balance. Reads require the user's key — never call them empty.\n    if (!identity || !identity.apiKey) {\n      const limits = planLimits[freePlan]\n      return {\n        platformUserId: identity?.platformUserId ?? null,\n        plan: freePlan,\n        monthlyBalanceUsd: limits.monthlyBalanceUsd,\n        remainingBalanceUsd: 0,\n        lifetimeSpentUsd: 0,\n        concurrency: limits.concurrency,\n        overageAllowed: limits.overageAllowed,\n      }\n    }\n    const [plan, balance] = await Promise.all([client.getPlan(identity.apiKey), client.getBalance(identity.apiKey)])\n    const limits = planLimits[plan]\n    return {\n      platformUserId: identity.platformUserId,\n      plan,\n      monthlyBalanceUsd: limits.monthlyBalanceUsd,\n      remainingBalanceUsd: balance.balance,\n      lifetimeSpentUsd: balance.lifetimeSpent,\n      concurrency: limits.concurrency,\n      overageAllowed: limits.overageAllowed,\n    }\n  }\n\n  const canStartBillableTurn: PlatformBalanceManager<Plan>['canStartBillableTurn'] = async (userId) => {\n    const state = await getState(userId)\n    if (!state.platformUserId) return { allowed: false, state }\n    const allowed = state.overageAllowed || state.remainingBalanceUsd > 0\n    return { allowed, state }\n  }\n\n  const deduct: PlatformBalanceManager<Plan>['deduct'] = async (userId, params) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity) throw new Error('Shared billing requires a platform-linked user')\n    await client.deduct({\n      platformUserId: identity.platformUserId,\n      amountUsd: params.amountUsd,\n      type: params.type,\n      description: params.description,\n      referenceId: params.referenceId,\n    })\n  }\n\n  const getProductUsage: PlatformBalanceManager<Plan>['getProductUsage'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity?.apiKey) return { spentUsd: 0, transactionCount: 0 }\n    const rows = await client.getUsageByProduct(identity.apiKey)\n    const product = rows.find((row) => row.product === productSlug)\n    return { spentUsd: product?.totalSpent ?? 0, transactionCount: product?.count ?? 0 }\n  }\n\n  return { getState, canStartBillableTurn, deduct, getProductUsage }\n}\n\nexport function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager {\n  const clock = opts.now ?? (() => new Date())\n  const product = opts.product ?? 'router'\n\n  const getUsage: WorkspaceKeyManager['getUsage'] = async (workspaceId) => {\n    const active = await opts.store.getActive(workspaceId)\n    if (!active) return null\n    const info = await opts.provisioner.getKey(active.keyId)\n    const budgetUsd = info.budgetUsd ?? active.budgetUsd\n    const budgetSpent = info.budgetSpent ?? 0\n    const budgetRemaining = Math.max(0, budgetUsd - budgetSpent)\n    return {\n      keyId: active.keyId,\n      budgetUsd,\n      budgetSpent,\n      budgetRemaining,\n      expiresAt: info.expiresAt ?? (active.expiresAt ? active.expiresAt.toISOString() : null),\n      exhausted: budgetRemaining <= 0,\n    }\n  }\n\n  const rotateKey: WorkspaceKeyManager['rotateKey'] = async (workspaceId, ropts) => {\n    const now = clock()\n    const allowance = ropts?.budgetUsd ?? opts.defaultBudgetUsd\n\n    let budgetUsd = allowance\n    if (ropts?.rollover) {\n      const prior = await getUsage(workspaceId).catch(() => null)\n      budgetUsd = allowance + (prior?.budgetRemaining ?? 0)\n      if (ropts.rolloverCapUsd != null) budgetUsd = Math.min(budgetUsd, ropts.rolloverCapUsd)\n    }\n\n    const expiresAt = nextPeriodEnd(now)\n    const created = await opts.provisioner.createKey({ name: `ws:${workspaceId}`, product, budgetUsd, expiresAt: expiresAt.toISOString() })\n    if (!created.key || !created.id) throw new Error('tcloud createKey returned no key')\n    const keyEncrypted = await opts.crypto.encrypt(created.key)\n\n    const priors = await opts.store.listActive(workspaceId)\n    await opts.store.insert({ workspaceId, keyId: created.id, keyEncrypted, budgetUsd, expiresAt })\n    for (const p of priors) {\n      await opts.store.markRevoked(p.id, now)\n      // Best-effort upstream revoke — the row is already revoked and an expired\n      // key fails closed regardless, so a transient error is non-fatal.\n      try {\n        await opts.provisioner.revokeKey(p.keyId)\n      } catch {\n        /* non-fatal */\n      }\n    }\n    return created.key\n  }\n\n  const ensureKey: WorkspaceKeyManager['ensureKey'] = async (workspaceId, eopts) => {\n    const now = clock()\n    const active = await opts.store.getActive(workspaceId)\n    if (active && (!active.expiresAt || active.expiresAt.getTime() > now.getTime())) {\n      return opts.crypto.decrypt(active.keyEncrypted)\n    }\n    return rotateKey(workspaceId, { budgetUsd: eopts?.budgetUsd })\n  }\n\n  return { ensureKey, rotateKey, getUsage }\n}\n"],"mappings":";AAwFA,SAAS,cAAc,KAAiB;AACtC,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;AACtF;AAgGO,SAAS,6BACd,MAC8B;AAC9B,QAAM,EAAE,QAAQ,YAAY,UAAU,YAAY,IAAI;AAEtD,QAAM,WAAqD,OAAO,WAAW;AAC3E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AAGpD,QAAI,CAAC,YAAY,CAAC,SAAS,QAAQ;AACjC,YAAMA,UAAS,WAAW,QAAQ;AAClC,aAAO;AAAA,QACL,gBAAgB,UAAU,kBAAkB;AAAA,QAC5C,MAAM;AAAA,QACN,mBAAmBA,QAAO;AAAA,QAC1B,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,QAClB,aAAaA,QAAO;AAAA,QACpB,gBAAgBA,QAAO;AAAA,MACzB;AAAA,IACF;AACA,UAAM,CAAC,MAAM,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,OAAO,WAAW,SAAS,MAAM,CAAC,CAAC;AAC/G,UAAM,SAAS,WAAW,IAAI;AAC9B,WAAO;AAAA,MACL,gBAAgB,SAAS;AAAA,MACzB;AAAA,MACA,mBAAmB,OAAO;AAAA,MAC1B,qBAAqB,QAAQ;AAAA,MAC7B,kBAAkB,QAAQ;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAA6E,OAAO,WAAW;AACnG,UAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAI,CAAC,MAAM,eAAgB,QAAO,EAAE,SAAS,OAAO,MAAM;AAC1D,UAAM,UAAU,MAAM,kBAAkB,MAAM,sBAAsB;AACpE,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,QAAM,SAAiD,OAAO,QAAQ,WAAW;AAC/E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC/E,UAAM,OAAO,OAAO;AAAA,MAClB,gBAAgB,SAAS;AAAA,MACzB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAmE,OAAO,WAAW;AACzF,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,UAAU,OAAQ,QAAO,EAAE,UAAU,GAAG,kBAAkB,EAAE;AACjE,UAAM,OAAO,MAAM,OAAO,kBAAkB,SAAS,MAAM;AAC3D,UAAM,UAAU,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,WAAW;AAC9D,WAAO,EAAE,UAAU,SAAS,cAAc,GAAG,kBAAkB,SAAS,SAAS,EAAE;AAAA,EACrF;AAEA,SAAO,EAAE,UAAU,sBAAsB,QAAQ,gBAAgB;AACnE;AAEO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,QAAQ,KAAK,QAAQ,MAAM,oBAAI,KAAK;AAC1C,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,WAA4C,OAAO,gBAAgB;AACvE,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,OAAO,KAAK;AACvD,UAAM,YAAY,KAAK,aAAa,OAAO;AAC3C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,kBAAkB,KAAK,IAAI,GAAG,YAAY,WAAW;AAC3D,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,cAAc,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,MAClF,WAAW,mBAAmB;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,YAAY,OAAO,aAAa,KAAK;AAE3C,QAAI,YAAY;AAChB,QAAI,OAAO,UAAU;AACnB,YAAM,QAAQ,MAAM,SAAS,WAAW,EAAE,MAAM,MAAM,IAAI;AAC1D,kBAAY,aAAa,OAAO,mBAAmB;AACnD,UAAI,MAAM,kBAAkB,KAAM,aAAY,KAAK,IAAI,WAAW,MAAM,cAAc;AAAA,IACxF;AAEA,UAAM,YAAY,cAAc,GAAG;AACnC,UAAM,UAAU,MAAM,KAAK,YAAY,UAAU,EAAE,MAAM,MAAM,WAAW,IAAI,SAAS,WAAW,WAAW,UAAU,YAAY,EAAE,CAAC;AACtI,QAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kCAAkC;AACnF,UAAM,eAAe,MAAM,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAE1D,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,WAAW;AACtD,UAAM,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,QAAQ,IAAI,cAAc,WAAW,UAAU,CAAC;AAC9F,eAAW,KAAK,QAAQ;AACtB,YAAM,KAAK,MAAM,YAAY,EAAE,IAAI,GAAG;AAGtC,UAAI;AACF,cAAM,KAAK,YAAY,UAAU,EAAE,KAAK;AAAA,MAC1C,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,WAAW,CAAC,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAC/E,aAAO,KAAK,OAAO,QAAQ,OAAO,YAAY;AAAA,IAChD;AACA,WAAO,UAAU,aAAa,EAAE,WAAW,OAAO,UAAU,CAAC;AAAA,EAC/D;AAEA,SAAO,EAAE,WAAW,WAAW,SAAS;AAC1C;","names":["limits"]}

package/dist/chunk-MSXDQ2GB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/redact/index.ts"],"sourcesContent":["/**\n * PII redaction — two complementary modes.\n *\n * 1. ONE-WAY scrub (`redactForIngestion`): for production trace payloads. Tool\n *    args + results (and once, the LLM span's prompt) cross the wire into the\n *    ingestion store, which also feeds the analyst-loop's LLM prompts, so\n *    personal identifiers MUST be stripped before they leave the request path.\n *    Destructive — the original is gone, replaced by a sentinel.\n *\n * 2. REVERSIBLE redaction (`buildRedactedDocument` / `revealSpan`): for the UI.\n *    A document is split into text + redacted segments; each redacted original\n *    is kept ENCRYPTED (via a caller-supplied `encrypt` seam → `agent-app/crypto`)\n *    so a viewer can reveal a single span on demand, gated by an authorization\n *    callback and an audit hook. The mask is presentation; the original is\n *    recoverable by an authorized reveal, not lost.\n *\n * Discipline: cheap deterministic string patterns + well-known sensitive object\n * keys (value replaced, key kept, so the shape stays debuggable); recurse arrays\n * + plain objects only; NEVER throw on the one-way path.\n */\n\n/** A named PII pattern. `pattern` is matched case-insensitively at the string\n *  level; keep it non-global (global instances are derived where needed). */\nexport interface RedactionPattern {\n  kind: string\n  pattern: RegExp\n  /** Optional predicate over each match — the pattern fires only when it returns\n   *  true. For matches a regex alone can't decide (e.g. a Luhn check on a\n   *  card-number candidate). When set, the value is scanned globally and the\n   *  first match that passes wins; when absent, a plain `pattern.test` decides. */\n  validate?: (match: string) => boolean\n}\n\n/** The default deterministic patterns. Extend via the `extraPatterns` /\n *  `patterns` options rather than forking this module (the seam that lets a\n *  product add e.g. a credit-card matcher without a local copy). */\nexport const DEFAULT_REDACTION_PATTERNS: readonly RedactionPattern[] = [\n  { kind: 'ssn', pattern: /\\d{3}-\\d{2}-\\d{4}/ },\n  { kind: 'ein', pattern: /\\d{2}-\\d{7}/ },\n]\n\nconst SENSITIVE_KEYS = new Set([\n  'ssn',\n  'ein',\n  'password',\n  'apikey',\n  'token',\n  'secret',\n  'authorization',\n  'email',\n  'phone',\n])\n\nexport interface RedactForIngestionOptions {\n  /** Extra patterns appended to {@link DEFAULT_REDACTION_PATTERNS} for the\n   *  string-level scrub (e.g. credit-card). Additive — defaults still apply. */\n  extraPatterns?: readonly RedactionPattern[]\n  /** Extra sensitive object-key names (case-insensitive) added to the built-in\n   *  set, e.g. the snake_case `api_key` an intake form uses. Additive. */\n  extraSensitiveKeys?: readonly string[]\n}\n\nfunction redactString(value: string, patterns: readonly RedactionPattern[]): string {\n  for (const { kind, pattern, validate } of patterns) {\n    if (!validate) {\n      if (pattern.test(value)) return `[REDACTED:${kind}]`\n      continue\n    }\n    const g = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`)\n    for (const m of value.matchAll(g)) {\n      if (m[0].length > 0 && validate(m[0])) return `[REDACTED:${kind}]`\n    }\n  }\n  return value\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object') return false\n  const proto = Object.getPrototypeOf(value)\n  return proto === Object.prototype || proto === null\n}\n\n/**\n * One-way PII scrub for telemetry/ingestion. Backward-compatible: called with no\n * options it behaves exactly as before (SSN/EIN strings + sensitive object keys\n * → sentinels). `extraPatterns` lets a product add matchers (e.g. credit-card)\n * without forking this module.\n */\nexport function redactForIngestion(value: unknown, options: RedactForIngestionOptions = {}): unknown {\n  const patterns = options.extraPatterns\n    ? [...DEFAULT_REDACTION_PATTERNS, ...options.extraPatterns]\n    : DEFAULT_REDACTION_PATTERNS\n  const sensitiveKeys = options.extraSensitiveKeys\n    ? new Set([...SENSITIVE_KEYS, ...options.extraSensitiveKeys.map((k) => k.toLowerCase())])\n    : SENSITIVE_KEYS\n  const walk = (v: unknown): unknown => {\n    if (typeof v === 'string') return redactString(v, patterns)\n    if (Array.isArray(v)) return v.map(walk)\n    if (isPlainObject(v)) {\n      const out: Record<string, unknown> = {}\n      for (const [k, val] of Object.entries(v)) {\n        out[k] = sensitiveKeys.has(k.toLowerCase()) ? '[REDACTED:field]' : walk(val)\n      }\n      return out\n    }\n    return v\n  }\n  return walk(value)\n}\n\n// ── Reversible document redaction (the UI path) ─────────────────────────────\n\n/** A detected PII span in a source string. */\nexport interface RedactionSpan {\n  /** Stable within a document (index-derived) — used for reveal + audit. */\n  id: string\n  kind: string\n  start: number\n  end: number\n  text: string\n}\n\n/**\n * Find non-overlapping PII spans in `text`. Matches every pattern, sorts by\n * position, and drops overlaps (first match wins). Deterministic — no ids that\n * vary per call.\n */\nexport function detectSpans(\n  text: string,\n  patterns: readonly RedactionPattern[] = DEFAULT_REDACTION_PATTERNS,\n): RedactionSpan[] {\n  const raw: Array<{ kind: string; start: number; end: number; text: string }> = []\n  for (const { kind, pattern, validate } of patterns) {\n    const g = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`)\n    for (const m of text.matchAll(g)) {\n      if (m.index === undefined || m[0].length === 0) continue\n      if (validate && !validate(m[0])) continue\n      raw.push({ kind, start: m.index, end: m.index + m[0].length, text: m[0] })\n    }\n  }\n  raw.sort((a, b) => a.start - b.start || b.end - a.end)\n  const spans: RedactionSpan[] = []\n  let cursor = -1\n  let i = 0\n  for (const s of raw) {\n    if (s.start < cursor) continue // overlaps an earlier (higher-priority) span\n    spans.push({ id: `span-${i++}`, ...s })\n    cursor = s.end\n  }\n  return spans\n}\n\n/** A redacted document segment: literal text, or a masked span with the\n *  original kept ENCRYPTED for an authorized reveal. */\nexport type RedactedDocSegment =\n  | { type: 'text'; text: string }\n  | { type: 'redacted'; id: string; kind: string; cipher: string }\n\nexport interface RedactedDocument {\n  segments: RedactedDocSegment[]\n}\n\nexport interface BuildRedactedDocumentOptions {\n  /** Encrypt one original span value. Wire it to `agent-app/crypto`\n   *  (`encryptWithKey` / `createFieldCrypto`). The cipher is what's stored. */\n  encrypt: (plaintext: string) => string | Promise<string>\n  /** Patterns to detect (default: {@link DEFAULT_REDACTION_PATTERNS}). */\n  patterns?: readonly RedactionPattern[]\n}\n\n/**\n * Split `text` into text + redacted segments, encrypting each redacted span's\n * original. The result carries NO plaintext PII — only the masked structure and\n * ciphertext — so it is safe to ship to a client; reveal happens server-side via\n * {@link revealSpan}.\n */\nexport async function buildRedactedDocument(\n  text: string,\n  options: BuildRedactedDocumentOptions,\n): Promise<RedactedDocument> {\n  const spans = detectSpans(text, options.patterns)\n  const segments: RedactedDocSegment[] = []\n  let pos = 0\n  for (const span of spans) {\n    if (span.start > pos) segments.push({ type: 'text', text: text.slice(pos, span.start) })\n    segments.push({ type: 'redacted', id: span.id, kind: span.kind, cipher: await options.encrypt(span.text) })\n    pos = span.end\n  }\n  if (pos < text.length) segments.push({ type: 'text', text: text.slice(pos) })\n  return { segments }\n}\n\nexport interface RevealSpanOptions {\n  /** Decrypt a span cipher. Wire to `agent-app/crypto` (`decryptWithKey`). */\n  decrypt: (cipher: string) => string | Promise<string>\n  /** Authorization gate — return false to deny the reveal (fail-closed). */\n  canReveal: (segment: { id: string; kind: string }) => boolean | Promise<boolean>\n  /** Audit hook — invoked only on a granted reveal (the caller records who/when). */\n  onReveal?: (segment: { id: string; kind: string }) => void | Promise<void>\n}\n\nexport interface RevealResult {\n  ok: boolean\n  value?: string\n  /** `not_found` | `forbidden` when `ok` is false. */\n  reason?: string\n}\n\n/**\n * Reveal one redacted span's original, gated + audited. Fail-closed: an unknown\n * id or a denied `canReveal` returns `{ ok: false }` and never decrypts; a\n * granted reveal decrypts, fires `onReveal` for the audit trail, and returns the\n * value.\n */\nexport async function revealSpan(\n  doc: RedactedDocument,\n  spanId: string,\n  options: RevealSpanOptions,\n): Promise<RevealResult> {\n  const seg = doc.segments.find((s): s is Extract<RedactedDocSegment, { type: 'redacted' }> =>\n    s.type === 'redacted' && s.id === spanId,\n  )\n  if (!seg) return { ok: false, reason: 'not_found' }\n  const allowed = await options.canReveal({ id: seg.id, kind: seg.kind })\n  if (!allowed) return { ok: false, reason: 'forbidden' }\n  const value = await options.decrypt(seg.cipher)\n  if (options.onReveal) await options.onReveal({ id: seg.id, kind: seg.kind })\n  return { ok: true, value }\n}\n"],"mappings":";AAoCO,IAAM,6BAA0D;AAAA,EACrE,EAAE,MAAM,OAAO,SAAS,oBAAoB;AAAA,EAC5C,EAAE,MAAM,OAAO,SAAS,cAAc;AACxC;AAEA,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAWD,SAAS,aAAa,OAAe,UAA+C;AAClF,aAAW,EAAE,MAAM,SAAS,SAAS,KAAK,UAAU;AAClD,QAAI,CAAC,UAAU;AACb,UAAI,QAAQ,KAAK,KAAK,EAAG,QAAO,aAAa,IAAI;AACjD;AAAA,IACF;AACA,UAAM,IAAI,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,SAAS,GAAG,IAAI,QAAQ,QAAQ,GAAG,QAAQ,KAAK,GAAG;AACtG,eAAW,KAAK,MAAM,SAAS,CAAC,GAAG;AACjC,UAAI,EAAE,CAAC,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC,EAAG,QAAO,aAAa,IAAI;AAAA,IACjE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;AAQO,SAAS,mBAAmB,OAAgB,UAAqC,CAAC,GAAY;AACnG,QAAM,WAAW,QAAQ,gBACrB,CAAC,GAAG,4BAA4B,GAAG,QAAQ,aAAa,IACxD;AACJ,QAAM,gBAAgB,QAAQ,qBAC1B,oBAAI,IAAI,CAAC,GAAG,gBAAgB,GAAG,QAAQ,mBAAmB,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,IACtF;AACJ,QAAM,OAAO,CAAC,MAAwB;AACpC,QAAI,OAAO,MAAM,SAAU,QAAO,aAAa,GAAG,QAAQ;AAC1D,QAAI,MAAM,QAAQ,CAAC,EAAG,QAAO,EAAE,IAAI,IAAI;AACvC,QAAI,cAAc,CAAC,GAAG;AACpB,YAAM,MAA+B,CAAC;AACtC,iBAAW,CAAC,GAAG,GAAG,KAAK,OAAO,QAAQ,CAAC,GAAG;AACxC,YAAI,CAAC,IAAI,cAAc,IAAI,EAAE,YAAY,CAAC,IAAI,qBAAqB,KAAK,GAAG;AAAA,MAC7E;AACA,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,KAAK;AACnB;AAmBO,SAAS,YACd,MACA,WAAwC,4BACvB;AACjB,QAAM,MAAyE,CAAC;AAChF,aAAW,EAAE,MAAM,SAAS,SAAS,KAAK,UAAU;AAClD,UAAM,IAAI,IAAI,OAAO,QAAQ,QAAQ,QAAQ,MAAM,SAAS,GAAG,IAAI,QAAQ,QAAQ,GAAG,QAAQ,KAAK,GAAG;AACtG,eAAW,KAAK,KAAK,SAAS,CAAC,GAAG;AAChC,UAAI,EAAE,UAAU,UAAa,EAAE,CAAC,EAAE,WAAW,EAAG;AAChD,UAAI,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAG;AACjC,UAAI,KAAK,EAAE,MAAM,OAAO,EAAE,OAAO,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,CAAC;AAAA,IAC3E;AAAA,EACF;AACA,MAAI,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG;AACrD,QAAM,QAAyB,CAAC;AAChC,MAAI,SAAS;AACb,MAAI,IAAI;AACR,aAAW,KAAK,KAAK;AACnB,QAAI,EAAE,QAAQ,OAAQ;AACtB,UAAM,KAAK,EAAE,IAAI,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;AACtC,aAAS,EAAE;AAAA,EACb;AACA,SAAO;AACT;AA0BA,eAAsB,sBACpB,MACA,SAC2B;AAC3B,QAAM,QAAQ,YAAY,MAAM,QAAQ,QAAQ;AAChD,QAAM,WAAiC,CAAC;AACxC,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,QAAQ,IAAK,UAAS,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,KAAK,EAAE,CAAC;AACvF,aAAS,KAAK,EAAE,MAAM,YAAY,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,IAAI,EAAE,CAAC;AAC1G,UAAM,KAAK;AAAA,EACb;AACA,MAAI,MAAM,KAAK,OAAQ,UAAS,KAAK,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC;AAC5E,SAAO,EAAE,SAAS;AACpB;AAwBA,eAAsB,WACpB,KACA,QACA,SACuB;AACvB,QAAM,MAAM,IAAI,SAAS;AAAA,IAAK,CAAC,MAC7B,EAAE,SAAS,cAAc,EAAE,OAAO;AAAA,EACpC;AACA,MAAI,CAAC,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAClD,QAAM,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AACtE,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACtD,QAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAC9C,MAAI,QAAQ,SAAU,OAAM,QAAQ,SAAS,EAAE,IAAI,IAAI,IAAI,MAAM,IAAI,KAAK,CAAC;AAC3E,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;","names":[]}