@tangle-network/agent-app 0.1.9 → 0.1.10

package/dist/billing/index.d.ts

@@ -14,8 +14,8 @@
  * SDK (structural contracts only, like `../tangle`). The `@tangle-network/tcloud`
  * SDK is the provisioner a product passes in; it is not a dependency here.
  */
-/** The key-provisioning operations this needs — the `@tangle-network/tcloud`
- *  SDK's `TCloudClient` satisfies it structurally; pass it in. */
+/** The key-provisioning operations the key manager needs. Wire it from the
+ *  platform via {@link createTcloudKeyProvisioner} rather than casting. */
 interface KeyProvisioner {
     createKey(input: {
         name: string;
@@ -33,6 +33,40 @@ interface KeyProvisioner {
         expiresAt?: string | null;
     }>;
 }
+/**
+ * The subset of the `@tangle-network/tcloud` `TCloudClient` the provisioner uses
+ * — declared with METHOD syntax so the real client (whose `product` is a narrow
+ * union and whose budgets are `number | null`) is assignable bivariantly. The
+ * real SDK client satisfies this; pass it straight in.
+ */
+interface TcloudKeyClient {
+    createKey(opts: {
+        name: string;
+        product?: string;
+        budgetUsd?: number;
+        expiresAt?: string;
+        parentKeyId?: string;
+        allowedModels?: string[];
+        rpmLimit?: number;
+    }): Promise<{
+        id: string;
+        key: string;
+    }>;
+    getKey(id: string): Promise<{
+        budgetUsd?: number | null;
+        budgetSpent?: number;
+        expiresAt?: string | null;
+    }>;
+    revokeKey(id: string): Promise<unknown>;
+}
+/**
+ * Adapt the tcloud SDK client to {@link KeyProvisioner} — the typed seam that
+ * replaces the `as unknown as KeyProvisioner` cast every consumer otherwise
+ * repeats. The platform already exposes child-key minting (parent→child key,
+ * per-key USD budget, expiry); this maps its shapes (`product` union,
+ * `number | null` budgets) onto the manager's contract (`null → undefined`).
+ */
+declare function createTcloudKeyProvisioner(client: TcloudKeyClient): KeyProvisioner;
 /** A stored child-key record (the app's row, shape-normalized). */
 interface WorkspaceKeyRecord {
     /** App row id (opaque). */
@@ -198,4 +232,4 @@ interface PlatformBalanceManager<Plan extends string> {
 declare function createPlatformBalanceManager<Plan extends string>(opts: PlatformBalanceManagerOptions<Plan>): PlatformBalanceManager<Plan>;
 declare function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager;
 
-export { type KeyCrypto, type KeyProvisioner, type PlanLimit, type PlatformBalanceInfo, type PlatformBalanceManager, type PlatformBalanceManagerOptions, type PlatformBillingClient, type PlatformIdentity, type PlatformProductUsage, type SharedBillingState, type WorkspaceKeyManager, type WorkspaceKeyManagerOptions, type WorkspaceKeyRecord, type WorkspaceKeyStore, type WorkspaceModelKeyUsage, createPlatformBalanceManager, createWorkspaceKeyManager };
+export { type KeyCrypto, type KeyProvisioner, type PlanLimit, type PlatformBalanceInfo, type PlatformBalanceManager, type PlatformBalanceManagerOptions, type PlatformBillingClient, type PlatformIdentity, type PlatformProductUsage, type SharedBillingState, type TcloudKeyClient, type WorkspaceKeyManager, type WorkspaceKeyManagerOptions, type WorkspaceKeyRecord, type WorkspaceKeyStore, type WorkspaceModelKeyUsage, createPlatformBalanceManager, createTcloudKeyProvisioner, createWorkspaceKeyManager };

package/dist/billing/index.js

@@ -1,9 +1,11 @@
 import {
   createPlatformBalanceManager,
+  createTcloudKeyProvisioner,
   createWorkspaceKeyManager
-} from "../chunk-EAJSWUU5.js";
+} from "../chunk-YS6A6G57.js";
 export {
   createPlatformBalanceManager,
+  createTcloudKeyProvisioner,
   createWorkspaceKeyManager
 };
 //# sourceMappingURL=index.js.map

package/dist/{chunk-MTJXFHYD.js → chunk-EYXTDVDY.js}

@@ -1,6 +1,6 @@
 import {
   createWorkspaceKeyManager
-} from "./chunk-EAJSWUU5.js";
+} from "./chunk-YS6A6G57.js";
 import {
   createFieldCrypto
 } from "./chunk-TA5Q4I2K.js";
@@ -315,4 +315,4 @@ export {
   createPresetWorkspaceKeyStore,
   createPresetWorkspaceKeyManager
 };
-//# sourceMappingURL=chunk-MTJXFHYD.js.map
+//# sourceMappingURL=chunk-EYXTDVDY.js.map

package/dist/{chunk-EAJSWUU5.js → chunk-YS6A6G57.js}

@@ -1,4 +1,21 @@
 // src/billing/index.ts
+function createTcloudKeyProvisioner(client) {
+  return {
+    createKey: async (input) => {
+      const created = await client.createKey(input);
+      return { id: created.id, key: created.key };
+    },
+    revokeKey: (keyId) => client.revokeKey(keyId),
+    getKey: async (keyId) => {
+      const info = await client.getKey(keyId);
+      return {
+        budgetUsd: info.budgetUsd ?? void 0,
+        budgetSpent: info.budgetSpent ?? void 0,
+        expiresAt: info.expiresAt ?? null
+      };
+    }
+  };
+}
 function nextPeriodEnd(now) {
   return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0));
 }
@@ -111,7 +128,8 @@ function createWorkspaceKeyManager(opts) {
 }
 
 export {
+  createTcloudKeyProvisioner,
   createPlatformBalanceManager,
   createWorkspaceKeyManager
 };
-//# sourceMappingURL=chunk-EAJSWUU5.js.map
+//# sourceMappingURL=chunk-YS6A6G57.js.map

package/dist/chunk-YS6A6G57.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/billing/index.ts"],"sourcesContent":["/**\n * Per-workspace budget-capped model keys — app-owned billing, metered on Tangle.\n *\n * Each workspace (the paying entity) runs the agent on its OWN child API key\n * minted from the platform parent key. The child carries a hard USD budget the\n * Tangle Router enforces AT THE KEY — model spend can't exceed the allowance,\n * zero app-side accounting. The app charges its own subscription (e.g. 5× the\n * allowance) and re-provisions each period. Child budgets are IMMUTABLE on the\n * platform, so a new budget = a fresh key + revoke the prior (rotate).\n *\n * The mint / rotate / rollover / usage LOGIC is generic and lives here.\n * Persistence (which D1 table), secret encryption, and key provisioning are\n * SEAMS each product supplies — so this module imports no DB and no key-mgmt\n * SDK (structural contracts only, like `../tangle`). The `@tangle-network/tcloud`\n * SDK is the provisioner a product passes in; it is not a dependency here.\n */\n\n/** The key-provisioning operations the key manager needs. Wire it from the\n *  platform via {@link createTcloudKeyProvisioner} rather than casting. */\nexport interface KeyProvisioner {\n  createKey(input: { name: string; product: string; budgetUsd: number; expiresAt: string }): Promise<{ id?: string; key?: string }>\n  revokeKey(keyId: string): Promise<unknown>\n  getKey(keyId: string): Promise<{ budgetUsd?: number; budgetSpent?: number; expiresAt?: string | null }>\n}\n\n/**\n * The subset of the `@tangle-network/tcloud` `TCloudClient` the provisioner uses\n * — declared with METHOD syntax so the real client (whose `product` is a narrow\n * union and whose budgets are `number | null`) is assignable bivariantly. The\n * real SDK client satisfies this; pass it straight in.\n */\nexport interface TcloudKeyClient {\n  createKey(opts: {\n    name: string\n    product?: string\n    budgetUsd?: number\n    expiresAt?: string\n    parentKeyId?: string\n    allowedModels?: string[]\n    rpmLimit?: number\n  }): Promise<{ id: string; key: string }>\n  getKey(id: string): Promise<{ budgetUsd?: number | null; budgetSpent?: number; expiresAt?: string | null }>\n  revokeKey(id: string): Promise<unknown>\n}\n\n/**\n * Adapt the tcloud SDK client to {@link KeyProvisioner} — the typed seam that\n * replaces the `as unknown as KeyProvisioner` cast every consumer otherwise\n * repeats. The platform already exposes child-key minting (parent→child key,\n * per-key USD budget, expiry); this maps its shapes (`product` union,\n * `number | null` budgets) onto the manager's contract (`null → undefined`).\n */\nexport function createTcloudKeyProvisioner(client: TcloudKeyClient): KeyProvisioner {\n  return {\n    createKey: async (input) => {\n      const created = await client.createKey(input)\n      return { id: created.id, key: created.key }\n    },\n    revokeKey: (keyId) => client.revokeKey(keyId),\n    getKey: async (keyId) => {\n      const info = await client.getKey(keyId)\n      return {\n        budgetUsd: info.budgetUsd ?? undefined,\n        budgetSpent: info.budgetSpent ?? undefined,\n        expiresAt: info.expiresAt ?? null,\n      }\n    },\n  }\n}\n\n/** A stored child-key record (the app's row, shape-normalized). */\nexport interface WorkspaceKeyRecord {\n  /** App row id (opaque). */\n  id: string\n  keyId: string\n  /** The encrypted secret — decrypted via {@link KeyCrypto.decrypt}. */\n  keyEncrypted: string\n  budgetUsd: number\n  expiresAt: Date | null\n}\n\n/** Persistence seam — the product implements this against its own D1 table. */\nexport interface WorkspaceKeyStore {\n  /** Most-recent active key for the workspace, or null. */\n  getActive(workspaceId: string): Promise<WorkspaceKeyRecord | null>\n  /** All active keys (to revoke priors on rotate). */\n  listActive(workspaceId: string): Promise<Array<{ id: string; keyId: string }>>\n  /** Persist a freshly minted active key. */\n  insert(record: { workspaceId: string; keyId: string; keyEncrypted: string; budgetUsd: number; expiresAt: Date }): Promise<void>\n  /** Mark a prior row revoked. */\n  markRevoked(id: string, now: Date): Promise<void>\n}\n\n/** Secret encryption seam (the app's at-rest crypto). */\nexport interface KeyCrypto {\n  encrypt(secret: string): Promise<string>\n  decrypt(encrypted: string): Promise<string>\n}\n\nexport interface WorkspaceKeyManagerOptions {\n  provisioner: KeyProvisioner\n  store: WorkspaceKeyStore\n  crypto: KeyCrypto\n  /** Default monthly allowance (USD) when a call doesn't specify one. */\n  defaultBudgetUsd: number\n  /** Injectable clock. Default `() => new Date()`. */\n  now?: () => Date\n  /** tcloud product the key is scoped to. Default `'router'`. */\n  product?: string\n}\n\nexport interface WorkspaceModelKeyUsage {\n  keyId: string\n  budgetUsd: number\n  budgetSpent: number\n  budgetRemaining: number\n  expiresAt: string | null\n  exhausted: boolean\n}\n\nexport interface WorkspaceKeyManager {\n  /** The workspace's active child-key secret, provisioning one if absent/expired. */\n  ensureKey(workspaceId: string, opts?: { budgetUsd?: number }): Promise<string>\n  /** Mint a fresh key + revoke priors (period renewal / top-up). `rollover`\n   *  carries the prior key's unused budget into the new one, bounded by\n   *  `rolloverCapUsd`. Returns the new secret. */\n  rotateKey(workspaceId: string, opts?: { budgetUsd?: number; rollover?: boolean; rolloverCapUsd?: number }): Promise<string>\n  /** Live budget usage for the active key (drives the \"$X of $Y used\" panel). */\n  getUsage(workspaceId: string): Promise<WorkspaceModelKeyUsage | null>\n}\n\n/** Period end = first day of next month, midnight UTC. Keys expire at the period\n *  boundary so a forgotten rotation fails closed rather than running free. */\nfunction nextPeriodEnd(now: Date): Date {\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0))\n}\n\n// ---------------------------------------------------------------------------\n// Shared-platform-balance billing\n//\n// A DIFFERENT model from the per-workspace child-key manager above: here every\n// user runs against a SHARED platform balance (id.tangle.tools), keyed by the\n// user's platform identity. The app owns no key minting — it reads the balance,\n// gates a billable turn, and deducts spend through the platform billing API.\n// Plan limits, the platform transport, and identity resolution are SEAMS the\n// product supplies; this module imports no DB and no HTTP client.\n// ---------------------------------------------------------------------------\n\n/** A user's resolved platform identity (from the app's SSO account store). */\nexport interface PlatformIdentity {\n  platformUserId: string\n  /** The user's per-user platform API key (reads), or null when unlinked. */\n  apiKey: string | null\n}\n\n/** Spendable balance for a platform user. */\nexport interface PlatformBalanceInfo {\n  balance: number\n  lifetimeSpent: number\n}\n\n/** Per-product spend aggregate. */\nexport interface PlatformProductUsage {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Plan limits — a PARAMETER per product (dollar allowance, concurrency,\n *  overage policy). Never baked into the framework. */\nexport interface PlanLimit {\n  monthlyBalanceUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * The platform billing transport — the product wires these to id.tangle.tools\n * (or any balance backend). Reads authenticate as the user (their `apiKey`);\n * the deduct write is a service-token call naming the target user. This module\n * never touches HTTP — it only sequences these calls.\n */\nexport interface PlatformBillingClient<Plan extends string> {\n  /** Resolve the user's platform identity, or null when there is no SSO account. */\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n  /** Subscription plan for the user (via their platform key). */\n  getPlan(apiKey: string): Promise<Plan>\n  /** Spendable balance for the user (via their platform key). */\n  getBalance(apiKey: string): Promise<PlatformBalanceInfo>\n  /** Per-product usage rows for the user (via their platform key). */\n  getUsageByProduct(apiKey: string): Promise<PlatformProductUsage[]>\n  /** Deduct spend against the user's balance (service-token write). */\n  deduct(input: { platformUserId: string; amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n}\n\nexport interface SharedBillingState<Plan extends string> {\n  /** Platform user id, or null when the user has no Tangle SSO account. */\n  platformUserId: string | null\n  plan: Plan\n  monthlyBalanceUsd: number\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport interface PlatformBalanceManagerOptions<Plan extends string> {\n  client: PlatformBillingClient<Plan>\n  /** Plan → limits map (the product's pricing). */\n  planLimits: Record<Plan, PlanLimit>\n  /** The plan an unlinked / outage user falls to (fails CLOSED). */\n  freePlan: Plan\n  /** The product slug to attribute usage to (for `getProductUsage`). */\n  productSlug: string\n}\n\nexport interface PlatformBalanceManager<Plan extends string> {\n  /** Resolve the user's plan + balance. Unlinked or platform-outage users fail\n   *  CLOSED: free plan, zero remaining balance — a billable run is never started\n   *  against an unknown balance. */\n  getState(userId: string): Promise<SharedBillingState<Plan>>\n  /** Gate a billable turn: allowed when the plan permits overage or remaining\n   *  balance is positive. Returns the state so the caller deducts against it. */\n  canStartBillableTurn(userId: string): Promise<{ allowed: boolean; state: SharedBillingState<Plan> }>\n  /** Deduct `amountUsd` against the user's platform balance. Throws when the\n   *  user is not platform-linked. */\n  deduct(userId: string, params: { amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n  /** This product's spend for the user (drives a usage panel). */\n  getProductUsage(userId: string): Promise<{ spentUsd: number; transactionCount: number }>\n}\n\nexport function createPlatformBalanceManager<Plan extends string>(\n  opts: PlatformBalanceManagerOptions<Plan>,\n): PlatformBalanceManager<Plan> {\n  const { client, planLimits, freePlan, productSlug } = opts\n\n  const getState: PlatformBalanceManager<Plan>['getState'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    // No SSO account, or linked without a platform key: unlinked free tier with\n    // zero balance. Reads require the user's key — never call them empty.\n    if (!identity || !identity.apiKey) {\n      const limits = planLimits[freePlan]\n      return {\n        platformUserId: identity?.platformUserId ?? null,\n        plan: freePlan,\n        monthlyBalanceUsd: limits.monthlyBalanceUsd,\n        remainingBalanceUsd: 0,\n        lifetimeSpentUsd: 0,\n        concurrency: limits.concurrency,\n        overageAllowed: limits.overageAllowed,\n      }\n    }\n    const [plan, balance] = await Promise.all([client.getPlan(identity.apiKey), client.getBalance(identity.apiKey)])\n    const limits = planLimits[plan]\n    return {\n      platformUserId: identity.platformUserId,\n      plan,\n      monthlyBalanceUsd: limits.monthlyBalanceUsd,\n      remainingBalanceUsd: balance.balance,\n      lifetimeSpentUsd: balance.lifetimeSpent,\n      concurrency: limits.concurrency,\n      overageAllowed: limits.overageAllowed,\n    }\n  }\n\n  const canStartBillableTurn: PlatformBalanceManager<Plan>['canStartBillableTurn'] = async (userId) => {\n    const state = await getState(userId)\n    if (!state.platformUserId) return { allowed: false, state }\n    const allowed = state.overageAllowed || state.remainingBalanceUsd > 0\n    return { allowed, state }\n  }\n\n  const deduct: PlatformBalanceManager<Plan>['deduct'] = async (userId, params) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity) throw new Error('Shared billing requires a platform-linked user')\n    await client.deduct({\n      platformUserId: identity.platformUserId,\n      amountUsd: params.amountUsd,\n      type: params.type,\n      description: params.description,\n      referenceId: params.referenceId,\n    })\n  }\n\n  const getProductUsage: PlatformBalanceManager<Plan>['getProductUsage'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity?.apiKey) return { spentUsd: 0, transactionCount: 0 }\n    const rows = await client.getUsageByProduct(identity.apiKey)\n    const product = rows.find((row) => row.product === productSlug)\n    return { spentUsd: product?.totalSpent ?? 0, transactionCount: product?.count ?? 0 }\n  }\n\n  return { getState, canStartBillableTurn, deduct, getProductUsage }\n}\n\nexport function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager {\n  const clock = opts.now ?? (() => new Date())\n  const product = opts.product ?? 'router'\n\n  const getUsage: WorkspaceKeyManager['getUsage'] = async (workspaceId) => {\n    const active = await opts.store.getActive(workspaceId)\n    if (!active) return null\n    const info = await opts.provisioner.getKey(active.keyId)\n    const budgetUsd = info.budgetUsd ?? active.budgetUsd\n    const budgetSpent = info.budgetSpent ?? 0\n    const budgetRemaining = Math.max(0, budgetUsd - budgetSpent)\n    return {\n      keyId: active.keyId,\n      budgetUsd,\n      budgetSpent,\n      budgetRemaining,\n      expiresAt: info.expiresAt ?? (active.expiresAt ? active.expiresAt.toISOString() : null),\n      exhausted: budgetRemaining <= 0,\n    }\n  }\n\n  const rotateKey: WorkspaceKeyManager['rotateKey'] = async (workspaceId, ropts) => {\n    const now = clock()\n    const allowance = ropts?.budgetUsd ?? opts.defaultBudgetUsd\n\n    let budgetUsd = allowance\n    if (ropts?.rollover) {\n      const prior = await getUsage(workspaceId).catch(() => null)\n      budgetUsd = allowance + (prior?.budgetRemaining ?? 0)\n      if (ropts.rolloverCapUsd != null) budgetUsd = Math.min(budgetUsd, ropts.rolloverCapUsd)\n    }\n\n    const expiresAt = nextPeriodEnd(now)\n    const created = await opts.provisioner.createKey({ name: `ws:${workspaceId}`, product, budgetUsd, expiresAt: expiresAt.toISOString() })\n    if (!created.key || !created.id) throw new Error('tcloud createKey returned no key')\n    const keyEncrypted = await opts.crypto.encrypt(created.key)\n\n    const priors = await opts.store.listActive(workspaceId)\n    await opts.store.insert({ workspaceId, keyId: created.id, keyEncrypted, budgetUsd, expiresAt })\n    for (const p of priors) {\n      await opts.store.markRevoked(p.id, now)\n      // Best-effort upstream revoke — the row is already revoked and an expired\n      // key fails closed regardless, so a transient error is non-fatal.\n      try {\n        await opts.provisioner.revokeKey(p.keyId)\n      } catch {\n        /* non-fatal */\n      }\n    }\n    return created.key\n  }\n\n  const ensureKey: WorkspaceKeyManager['ensureKey'] = async (workspaceId, eopts) => {\n    const now = clock()\n    const active = await opts.store.getActive(workspaceId)\n    if (active && (!active.expiresAt || active.expiresAt.getTime() > now.getTime())) {\n      return opts.crypto.decrypt(active.keyEncrypted)\n    }\n    return rotateKey(workspaceId, { budgetUsd: eopts?.budgetUsd })\n  }\n\n  return { ensureKey, rotateKey, getUsage }\n}\n"],"mappings":";AAoDO,SAAS,2BAA2B,QAAyC;AAClF,SAAO;AAAA,IACL,WAAW,OAAO,UAAU;AAC1B,YAAM,UAAU,MAAM,OAAO,UAAU,KAAK;AAC5C,aAAO,EAAE,IAAI,QAAQ,IAAI,KAAK,QAAQ,IAAI;AAAA,IAC5C;AAAA,IACA,WAAW,CAAC,UAAU,OAAO,UAAU,KAAK;AAAA,IAC5C,QAAQ,OAAO,UAAU;AACvB,YAAM,OAAO,MAAM,OAAO,OAAO,KAAK;AACtC,aAAO;AAAA,QACL,WAAW,KAAK,aAAa;AAAA,QAC7B,aAAa,KAAK,eAAe;AAAA,QACjC,WAAW,KAAK,aAAa;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACF;AAiEA,SAAS,cAAc,KAAiB;AACtC,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;AACtF;AAgGO,SAAS,6BACd,MAC8B;AAC9B,QAAM,EAAE,QAAQ,YAAY,UAAU,YAAY,IAAI;AAEtD,QAAM,WAAqD,OAAO,WAAW;AAC3E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AAGpD,QAAI,CAAC,YAAY,CAAC,SAAS,QAAQ;AACjC,YAAMA,UAAS,WAAW,QAAQ;AAClC,aAAO;AAAA,QACL,gBAAgB,UAAU,kBAAkB;AAAA,QAC5C,MAAM;AAAA,QACN,mBAAmBA,QAAO;AAAA,QAC1B,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,QAClB,aAAaA,QAAO;AAAA,QACpB,gBAAgBA,QAAO;AAAA,MACzB;AAAA,IACF;AACA,UAAM,CAAC,MAAM,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,OAAO,WAAW,SAAS,MAAM,CAAC,CAAC;AAC/G,UAAM,SAAS,WAAW,IAAI;AAC9B,WAAO;AAAA,MACL,gBAAgB,SAAS;AAAA,MACzB;AAAA,MACA,mBAAmB,OAAO;AAAA,MAC1B,qBAAqB,QAAQ;AAAA,MAC7B,kBAAkB,QAAQ;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAA6E,OAAO,WAAW;AACnG,UAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAI,CAAC,MAAM,eAAgB,QAAO,EAAE,SAAS,OAAO,MAAM;AAC1D,UAAM,UAAU,MAAM,kBAAkB,MAAM,sBAAsB;AACpE,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,QAAM,SAAiD,OAAO,QAAQ,WAAW;AAC/E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC/E,UAAM,OAAO,OAAO;AAAA,MAClB,gBAAgB,SAAS;AAAA,MACzB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAmE,OAAO,WAAW;AACzF,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,UAAU,OAAQ,QAAO,EAAE,UAAU,GAAG,kBAAkB,EAAE;AACjE,UAAM,OAAO,MAAM,OAAO,kBAAkB,SAAS,MAAM;AAC3D,UAAM,UAAU,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,WAAW;AAC9D,WAAO,EAAE,UAAU,SAAS,cAAc,GAAG,kBAAkB,SAAS,SAAS,EAAE;AAAA,EACrF;AAEA,SAAO,EAAE,UAAU,sBAAsB,QAAQ,gBAAgB;AACnE;AAEO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,QAAQ,KAAK,QAAQ,MAAM,oBAAI,KAAK;AAC1C,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,WAA4C,OAAO,gBAAgB;AACvE,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,OAAO,KAAK;AACvD,UAAM,YAAY,KAAK,aAAa,OAAO;AAC3C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,kBAAkB,KAAK,IAAI,GAAG,YAAY,WAAW;AAC3D,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,cAAc,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,MAClF,WAAW,mBAAmB;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,YAAY,OAAO,aAAa,KAAK;AAE3C,QAAI,YAAY;AAChB,QAAI,OAAO,UAAU;AACnB,YAAM,QAAQ,MAAM,SAAS,WAAW,EAAE,MAAM,MAAM,IAAI;AAC1D,kBAAY,aAAa,OAAO,mBAAmB;AACnD,UAAI,MAAM,kBAAkB,KAAM,aAAY,KAAK,IAAI,WAAW,MAAM,cAAc;AAAA,IACxF;AAEA,UAAM,YAAY,cAAc,GAAG;AACnC,UAAM,UAAU,MAAM,KAAK,YAAY,UAAU,EAAE,MAAM,MAAM,WAAW,IAAI,SAAS,WAAW,WAAW,UAAU,YAAY,EAAE,CAAC;AACtI,QAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kCAAkC;AACnF,UAAM,eAAe,MAAM,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAE1D,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,WAAW;AACtD,UAAM,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,QAAQ,IAAI,cAAc,WAAW,UAAU,CAAC;AAC9F,eAAW,KAAK,QAAQ;AACtB,YAAM,KAAK,MAAM,YAAY,EAAE,IAAI,GAAG;AAGtC,UAAI;AACF,cAAM,KAAK,YAAY,UAAU,EAAE,KAAK;AAAA,MAC1C,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,WAAW,CAAC,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAC/E,aAAO,KAAK,OAAO,QAAQ,OAAO,YAAY;AAAA,IAChD;AACA,WAAO,UAAU,aAAa,EAAE,WAAW,OAAO,UAAU,CAAC;AAAA,EAC/D;AAEA,SAAO,EAAE,WAAW,WAAW,SAAS;AAC1C;","names":["limits"]}

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { CreateKnowledgeLoopDeps, KnowledgeCandidate, KnowledgeDecider, Knowledg
 export { DEFAULT_HARNESS, Harness, KNOWN_HARNESSES, ResolveSessionHarnessInput, ResolvedSessionHarness, coerceHarness, isHarness, resolveSessionHarness } from './harness/index.js';
 export { AgentAppConfig, AgentDelegationConfig, AgentIdentityConfig, AgentIntegrationsConfig, AgentKnowledgeConfig, AgentTaxonomyConfig, AgentUiConfig, KnowledgeLoopConfig, KnowledgeSourceSpec, agentAppConfigJsonSchema, defineAgentApp } from './config/index.js';
 export { D1Like, D1PreparedLike, DrizzleColumnLike, DrizzleSqliteCoreLike, PRESET_MIGRATION_SQL, PRESET_TABLES, PresetBillingOptions, PresetKnowledgeAccessorOptions, PresetToolHandlerOptions, VaultKv, createD1KnowledgeStateAccessor, createPresetDrizzleSchema, createPresetFieldCrypto, createPresetToolHandlers, createPresetWorkspaceKeyManager, createPresetWorkspaceKeyStore } from './preset-cloudflare/index.js';
-export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBalanceManager, PlatformBalanceManagerOptions, PlatformBillingClient, PlatformIdentity, PlatformProductUsage, SharedBillingState, WorkspaceKeyManager, WorkspaceKeyManagerOptions, WorkspaceKeyRecord, WorkspaceKeyStore, WorkspaceModelKeyUsage, createPlatformBalanceManager, createWorkspaceKeyManager } from './billing/index.js';
+export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBalanceManager, PlatformBalanceManagerOptions, PlatformBillingClient, PlatformIdentity, PlatformProductUsage, SharedBillingState, TcloudKeyClient, WorkspaceKeyManager, WorkspaceKeyManagerOptions, WorkspaceKeyRecord, WorkspaceKeyStore, WorkspaceModelKeyUsage, createPlatformBalanceManager, createTcloudKeyProvisioner, createWorkspaceKeyManager } from './billing/index.js';
 export { DeriveKeyOptions, createFieldCrypto, decodeHexKey, decryptAesGcm, decryptBytes, decryptWithKey, deriveKey, encryptAesGcm, encryptBytes, encryptWithKey } from './crypto/index.js';
 export { JsonRecord, PersistedChatMessageForTurn, ResolvedChatTurn, StreamEvent, asRecord, asString, buildUserTextParts, encodeEvent, finalizeAssistantParts, getPartKey, mergePersistedPart, messageHasTurnId, normalizeClientTurnId, normalizePersistedPart, normalizeTime, normalizeToolEvent, resolveChatTurn, resolveToolId, resolveToolName } from './stream/index.js';
 export { HubExecClient, HubExecClientOptions, HubExecErrorCode, HubExecResult, HubInvokeDeps, HubInvokeInput, HubInvokeOutcome, ParsedIntegrationAction, invokeIntegrationHub, resolveIntegrationAction } from './integrations/index.js';

package/dist/index.js

@@ -26,11 +26,12 @@ import {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore
-} from "./chunk-MTJXFHYD.js";
+} from "./chunk-EYXTDVDY.js";
 import {
   createPlatformBalanceManager,
+  createTcloudKeyProvisioner,
   createWorkspaceKeyManager
-} from "./chunk-EAJSWUU5.js";
+} from "./chunk-YS6A6G57.js";
 import {
   createFieldCrypto,
   decodeHexKey,
@@ -168,6 +169,7 @@ export {
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore,
   createReviewerDecider,
+  createTcloudKeyProvisioner,
   createTokenRecallChecker,
   createWorkspaceKeyManager,
   decodeHexKey,

package/dist/preset-cloudflare/index.js

@@ -7,8 +7,8 @@ import {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore
-} from "../chunk-MTJXFHYD.js";
-import "../chunk-EAJSWUU5.js";
+} from "../chunk-EYXTDVDY.js";
+import "../chunk-YS6A6G57.js";
 import "../chunk-TA5Q4I2K.js";
 export {
   PRESET_MIGRATION_SQL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "packageManager": "pnpm@10.33.4",
   "description": "Application-shell framework for Tangle agent products: a bounded tool loop, the structured agent→app tool side channel, integration-hub client, per-workspace billing, and crypto — composed over the Tangle agent substrate through typed seams.",
   "keywords": [

package/dist/chunk-EAJSWUU5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/billing/index.ts"],"sourcesContent":["/**\n * Per-workspace budget-capped model keys — app-owned billing, metered on Tangle.\n *\n * Each workspace (the paying entity) runs the agent on its OWN child API key\n * minted from the platform parent key. The child carries a hard USD budget the\n * Tangle Router enforces AT THE KEY — model spend can't exceed the allowance,\n * zero app-side accounting. The app charges its own subscription (e.g. 5× the\n * allowance) and re-provisions each period. Child budgets are IMMUTABLE on the\n * platform, so a new budget = a fresh key + revoke the prior (rotate).\n *\n * The mint / rotate / rollover / usage LOGIC is generic and lives here.\n * Persistence (which D1 table), secret encryption, and key provisioning are\n * SEAMS each product supplies — so this module imports no DB and no key-mgmt\n * SDK (structural contracts only, like `../tangle`). The `@tangle-network/tcloud`\n * SDK is the provisioner a product passes in; it is not a dependency here.\n */\n\n/** The key-provisioning operations this needs — the `@tangle-network/tcloud`\n *  SDK's `TCloudClient` satisfies it structurally; pass it in. */\nexport interface KeyProvisioner {\n  createKey(input: { name: string; product: string; budgetUsd: number; expiresAt: string }): Promise<{ id?: string; key?: string }>\n  revokeKey(keyId: string): Promise<unknown>\n  getKey(keyId: string): Promise<{ budgetUsd?: number; budgetSpent?: number; expiresAt?: string | null }>\n}\n\n/** A stored child-key record (the app's row, shape-normalized). */\nexport interface WorkspaceKeyRecord {\n  /** App row id (opaque). */\n  id: string\n  keyId: string\n  /** The encrypted secret — decrypted via {@link KeyCrypto.decrypt}. */\n  keyEncrypted: string\n  budgetUsd: number\n  expiresAt: Date | null\n}\n\n/** Persistence seam — the product implements this against its own D1 table. */\nexport interface WorkspaceKeyStore {\n  /** Most-recent active key for the workspace, or null. */\n  getActive(workspaceId: string): Promise<WorkspaceKeyRecord | null>\n  /** All active keys (to revoke priors on rotate). */\n  listActive(workspaceId: string): Promise<Array<{ id: string; keyId: string }>>\n  /** Persist a freshly minted active key. */\n  insert(record: { workspaceId: string; keyId: string; keyEncrypted: string; budgetUsd: number; expiresAt: Date }): Promise<void>\n  /** Mark a prior row revoked. */\n  markRevoked(id: string, now: Date): Promise<void>\n}\n\n/** Secret encryption seam (the app's at-rest crypto). */\nexport interface KeyCrypto {\n  encrypt(secret: string): Promise<string>\n  decrypt(encrypted: string): Promise<string>\n}\n\nexport interface WorkspaceKeyManagerOptions {\n  provisioner: KeyProvisioner\n  store: WorkspaceKeyStore\n  crypto: KeyCrypto\n  /** Default monthly allowance (USD) when a call doesn't specify one. */\n  defaultBudgetUsd: number\n  /** Injectable clock. Default `() => new Date()`. */\n  now?: () => Date\n  /** tcloud product the key is scoped to. Default `'router'`. */\n  product?: string\n}\n\nexport interface WorkspaceModelKeyUsage {\n  keyId: string\n  budgetUsd: number\n  budgetSpent: number\n  budgetRemaining: number\n  expiresAt: string | null\n  exhausted: boolean\n}\n\nexport interface WorkspaceKeyManager {\n  /** The workspace's active child-key secret, provisioning one if absent/expired. */\n  ensureKey(workspaceId: string, opts?: { budgetUsd?: number }): Promise<string>\n  /** Mint a fresh key + revoke priors (period renewal / top-up). `rollover`\n   *  carries the prior key's unused budget into the new one, bounded by\n   *  `rolloverCapUsd`. Returns the new secret. */\n  rotateKey(workspaceId: string, opts?: { budgetUsd?: number; rollover?: boolean; rolloverCapUsd?: number }): Promise<string>\n  /** Live budget usage for the active key (drives the \"$X of $Y used\" panel). */\n  getUsage(workspaceId: string): Promise<WorkspaceModelKeyUsage | null>\n}\n\n/** Period end = first day of next month, midnight UTC. Keys expire at the period\n *  boundary so a forgotten rotation fails closed rather than running free. */\nfunction nextPeriodEnd(now: Date): Date {\n  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0))\n}\n\n// ---------------------------------------------------------------------------\n// Shared-platform-balance billing\n//\n// A DIFFERENT model from the per-workspace child-key manager above: here every\n// user runs against a SHARED platform balance (id.tangle.tools), keyed by the\n// user's platform identity. The app owns no key minting — it reads the balance,\n// gates a billable turn, and deducts spend through the platform billing API.\n// Plan limits, the platform transport, and identity resolution are SEAMS the\n// product supplies; this module imports no DB and no HTTP client.\n// ---------------------------------------------------------------------------\n\n/** A user's resolved platform identity (from the app's SSO account store). */\nexport interface PlatformIdentity {\n  platformUserId: string\n  /** The user's per-user platform API key (reads), or null when unlinked. */\n  apiKey: string | null\n}\n\n/** Spendable balance for a platform user. */\nexport interface PlatformBalanceInfo {\n  balance: number\n  lifetimeSpent: number\n}\n\n/** Per-product spend aggregate. */\nexport interface PlatformProductUsage {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Plan limits — a PARAMETER per product (dollar allowance, concurrency,\n *  overage policy). Never baked into the framework. */\nexport interface PlanLimit {\n  monthlyBalanceUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * The platform billing transport — the product wires these to id.tangle.tools\n * (or any balance backend). Reads authenticate as the user (their `apiKey`);\n * the deduct write is a service-token call naming the target user. This module\n * never touches HTTP — it only sequences these calls.\n */\nexport interface PlatformBillingClient<Plan extends string> {\n  /** Resolve the user's platform identity, or null when there is no SSO account. */\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n  /** Subscription plan for the user (via their platform key). */\n  getPlan(apiKey: string): Promise<Plan>\n  /** Spendable balance for the user (via their platform key). */\n  getBalance(apiKey: string): Promise<PlatformBalanceInfo>\n  /** Per-product usage rows for the user (via their platform key). */\n  getUsageByProduct(apiKey: string): Promise<PlatformProductUsage[]>\n  /** Deduct spend against the user's balance (service-token write). */\n  deduct(input: { platformUserId: string; amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n}\n\nexport interface SharedBillingState<Plan extends string> {\n  /** Platform user id, or null when the user has no Tangle SSO account. */\n  platformUserId: string | null\n  plan: Plan\n  monthlyBalanceUsd: number\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport interface PlatformBalanceManagerOptions<Plan extends string> {\n  client: PlatformBillingClient<Plan>\n  /** Plan → limits map (the product's pricing). */\n  planLimits: Record<Plan, PlanLimit>\n  /** The plan an unlinked / outage user falls to (fails CLOSED). */\n  freePlan: Plan\n  /** The product slug to attribute usage to (for `getProductUsage`). */\n  productSlug: string\n}\n\nexport interface PlatformBalanceManager<Plan extends string> {\n  /** Resolve the user's plan + balance. Unlinked or platform-outage users fail\n   *  CLOSED: free plan, zero remaining balance — a billable run is never started\n   *  against an unknown balance. */\n  getState(userId: string): Promise<SharedBillingState<Plan>>\n  /** Gate a billable turn: allowed when the plan permits overage or remaining\n   *  balance is positive. Returns the state so the caller deducts against it. */\n  canStartBillableTurn(userId: string): Promise<{ allowed: boolean; state: SharedBillingState<Plan> }>\n  /** Deduct `amountUsd` against the user's platform balance. Throws when the\n   *  user is not platform-linked. */\n  deduct(userId: string, params: { amountUsd: number; type: string; description: string; referenceId: string }): Promise<void>\n  /** This product's spend for the user (drives a usage panel). */\n  getProductUsage(userId: string): Promise<{ spentUsd: number; transactionCount: number }>\n}\n\nexport function createPlatformBalanceManager<Plan extends string>(\n  opts: PlatformBalanceManagerOptions<Plan>,\n): PlatformBalanceManager<Plan> {\n  const { client, planLimits, freePlan, productSlug } = opts\n\n  const getState: PlatformBalanceManager<Plan>['getState'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    // No SSO account, or linked without a platform key: unlinked free tier with\n    // zero balance. Reads require the user's key — never call them empty.\n    if (!identity || !identity.apiKey) {\n      const limits = planLimits[freePlan]\n      return {\n        platformUserId: identity?.platformUserId ?? null,\n        plan: freePlan,\n        monthlyBalanceUsd: limits.monthlyBalanceUsd,\n        remainingBalanceUsd: 0,\n        lifetimeSpentUsd: 0,\n        concurrency: limits.concurrency,\n        overageAllowed: limits.overageAllowed,\n      }\n    }\n    const [plan, balance] = await Promise.all([client.getPlan(identity.apiKey), client.getBalance(identity.apiKey)])\n    const limits = planLimits[plan]\n    return {\n      platformUserId: identity.platformUserId,\n      plan,\n      monthlyBalanceUsd: limits.monthlyBalanceUsd,\n      remainingBalanceUsd: balance.balance,\n      lifetimeSpentUsd: balance.lifetimeSpent,\n      concurrency: limits.concurrency,\n      overageAllowed: limits.overageAllowed,\n    }\n  }\n\n  const canStartBillableTurn: PlatformBalanceManager<Plan>['canStartBillableTurn'] = async (userId) => {\n    const state = await getState(userId)\n    if (!state.platformUserId) return { allowed: false, state }\n    const allowed = state.overageAllowed || state.remainingBalanceUsd > 0\n    return { allowed, state }\n  }\n\n  const deduct: PlatformBalanceManager<Plan>['deduct'] = async (userId, params) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity) throw new Error('Shared billing requires a platform-linked user')\n    await client.deduct({\n      platformUserId: identity.platformUserId,\n      amountUsd: params.amountUsd,\n      type: params.type,\n      description: params.description,\n      referenceId: params.referenceId,\n    })\n  }\n\n  const getProductUsage: PlatformBalanceManager<Plan>['getProductUsage'] = async (userId) => {\n    const identity = await client.resolveIdentity(userId)\n    if (!identity?.apiKey) return { spentUsd: 0, transactionCount: 0 }\n    const rows = await client.getUsageByProduct(identity.apiKey)\n    const product = rows.find((row) => row.product === productSlug)\n    return { spentUsd: product?.totalSpent ?? 0, transactionCount: product?.count ?? 0 }\n  }\n\n  return { getState, canStartBillableTurn, deduct, getProductUsage }\n}\n\nexport function createWorkspaceKeyManager(opts: WorkspaceKeyManagerOptions): WorkspaceKeyManager {\n  const clock = opts.now ?? (() => new Date())\n  const product = opts.product ?? 'router'\n\n  const getUsage: WorkspaceKeyManager['getUsage'] = async (workspaceId) => {\n    const active = await opts.store.getActive(workspaceId)\n    if (!active) return null\n    const info = await opts.provisioner.getKey(active.keyId)\n    const budgetUsd = info.budgetUsd ?? active.budgetUsd\n    const budgetSpent = info.budgetSpent ?? 0\n    const budgetRemaining = Math.max(0, budgetUsd - budgetSpent)\n    return {\n      keyId: active.keyId,\n      budgetUsd,\n      budgetSpent,\n      budgetRemaining,\n      expiresAt: info.expiresAt ?? (active.expiresAt ? active.expiresAt.toISOString() : null),\n      exhausted: budgetRemaining <= 0,\n    }\n  }\n\n  const rotateKey: WorkspaceKeyManager['rotateKey'] = async (workspaceId, ropts) => {\n    const now = clock()\n    const allowance = ropts?.budgetUsd ?? opts.defaultBudgetUsd\n\n    let budgetUsd = allowance\n    if (ropts?.rollover) {\n      const prior = await getUsage(workspaceId).catch(() => null)\n      budgetUsd = allowance + (prior?.budgetRemaining ?? 0)\n      if (ropts.rolloverCapUsd != null) budgetUsd = Math.min(budgetUsd, ropts.rolloverCapUsd)\n    }\n\n    const expiresAt = nextPeriodEnd(now)\n    const created = await opts.provisioner.createKey({ name: `ws:${workspaceId}`, product, budgetUsd, expiresAt: expiresAt.toISOString() })\n    if (!created.key || !created.id) throw new Error('tcloud createKey returned no key')\n    const keyEncrypted = await opts.crypto.encrypt(created.key)\n\n    const priors = await opts.store.listActive(workspaceId)\n    await opts.store.insert({ workspaceId, keyId: created.id, keyEncrypted, budgetUsd, expiresAt })\n    for (const p of priors) {\n      await opts.store.markRevoked(p.id, now)\n      // Best-effort upstream revoke — the row is already revoked and an expired\n      // key fails closed regardless, so a transient error is non-fatal.\n      try {\n        await opts.provisioner.revokeKey(p.keyId)\n      } catch {\n        /* non-fatal */\n      }\n    }\n    return created.key\n  }\n\n  const ensureKey: WorkspaceKeyManager['ensureKey'] = async (workspaceId, eopts) => {\n    const now = clock()\n    const active = await opts.store.getActive(workspaceId)\n    if (active && (!active.expiresAt || active.expiresAt.getTime() > now.getTime())) {\n      return opts.crypto.decrypt(active.keyEncrypted)\n    }\n    return rotateKey(workspaceId, { budgetUsd: eopts?.budgetUsd })\n  }\n\n  return { ensureKey, rotateKey, getUsage }\n}\n"],"mappings":";AAwFA,SAAS,cAAc,KAAiB;AACtC,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,GAAG,IAAI,YAAY,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;AACtF;AAgGO,SAAS,6BACd,MAC8B;AAC9B,QAAM,EAAE,QAAQ,YAAY,UAAU,YAAY,IAAI;AAEtD,QAAM,WAAqD,OAAO,WAAW;AAC3E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AAGpD,QAAI,CAAC,YAAY,CAAC,SAAS,QAAQ;AACjC,YAAMA,UAAS,WAAW,QAAQ;AAClC,aAAO;AAAA,QACL,gBAAgB,UAAU,kBAAkB;AAAA,QAC5C,MAAM;AAAA,QACN,mBAAmBA,QAAO;AAAA,QAC1B,qBAAqB;AAAA,QACrB,kBAAkB;AAAA,QAClB,aAAaA,QAAO;AAAA,QACpB,gBAAgBA,QAAO;AAAA,MACzB;AAAA,IACF;AACA,UAAM,CAAC,MAAM,OAAO,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,QAAQ,SAAS,MAAM,GAAG,OAAO,WAAW,SAAS,MAAM,CAAC,CAAC;AAC/G,UAAM,SAAS,WAAW,IAAI;AAC9B,WAAO;AAAA,MACL,gBAAgB,SAAS;AAAA,MACzB;AAAA,MACA,mBAAmB,OAAO;AAAA,MAC1B,qBAAqB,QAAQ;AAAA,MAC7B,kBAAkB,QAAQ;AAAA,MAC1B,aAAa,OAAO;AAAA,MACpB,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,uBAA6E,OAAO,WAAW;AACnG,UAAM,QAAQ,MAAM,SAAS,MAAM;AACnC,QAAI,CAAC,MAAM,eAAgB,QAAO,EAAE,SAAS,OAAO,MAAM;AAC1D,UAAM,UAAU,MAAM,kBAAkB,MAAM,sBAAsB;AACpE,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,QAAM,SAAiD,OAAO,QAAQ,WAAW;AAC/E,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC/E,UAAM,OAAO,OAAO;AAAA,MAClB,gBAAgB,SAAS;AAAA,MACzB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,QAAM,kBAAmE,OAAO,WAAW;AACzF,UAAM,WAAW,MAAM,OAAO,gBAAgB,MAAM;AACpD,QAAI,CAAC,UAAU,OAAQ,QAAO,EAAE,UAAU,GAAG,kBAAkB,EAAE;AACjE,UAAM,OAAO,MAAM,OAAO,kBAAkB,SAAS,MAAM;AAC3D,UAAM,UAAU,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,WAAW;AAC9D,WAAO,EAAE,UAAU,SAAS,cAAc,GAAG,kBAAkB,SAAS,SAAS,EAAE;AAAA,EACrF;AAEA,SAAO,EAAE,UAAU,sBAAsB,QAAQ,gBAAgB;AACnE;AAEO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,QAAQ,KAAK,QAAQ,MAAM,oBAAI,KAAK;AAC1C,QAAM,UAAU,KAAK,WAAW;AAEhC,QAAM,WAA4C,OAAO,gBAAgB;AACvE,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,MAAM,KAAK,YAAY,OAAO,OAAO,KAAK;AACvD,UAAM,YAAY,KAAK,aAAa,OAAO;AAC3C,UAAM,cAAc,KAAK,eAAe;AACxC,UAAM,kBAAkB,KAAK,IAAI,GAAG,YAAY,WAAW;AAC3D,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,cAAc,OAAO,YAAY,OAAO,UAAU,YAAY,IAAI;AAAA,MAClF,WAAW,mBAAmB;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,YAAY,OAAO,aAAa,KAAK;AAE3C,QAAI,YAAY;AAChB,QAAI,OAAO,UAAU;AACnB,YAAM,QAAQ,MAAM,SAAS,WAAW,EAAE,MAAM,MAAM,IAAI;AAC1D,kBAAY,aAAa,OAAO,mBAAmB;AACnD,UAAI,MAAM,kBAAkB,KAAM,aAAY,KAAK,IAAI,WAAW,MAAM,cAAc;AAAA,IACxF;AAEA,UAAM,YAAY,cAAc,GAAG;AACnC,UAAM,UAAU,MAAM,KAAK,YAAY,UAAU,EAAE,MAAM,MAAM,WAAW,IAAI,SAAS,WAAW,WAAW,UAAU,YAAY,EAAE,CAAC;AACtI,QAAI,CAAC,QAAQ,OAAO,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kCAAkC;AACnF,UAAM,eAAe,MAAM,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAE1D,UAAM,SAAS,MAAM,KAAK,MAAM,WAAW,WAAW;AACtD,UAAM,KAAK,MAAM,OAAO,EAAE,aAAa,OAAO,QAAQ,IAAI,cAAc,WAAW,UAAU,CAAC;AAC9F,eAAW,KAAK,QAAQ;AACtB,YAAM,KAAK,MAAM,YAAY,EAAE,IAAI,GAAG;AAGtC,UAAI;AACF,cAAM,KAAK,YAAY,UAAU,EAAE,KAAK;AAAA,MAC1C,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,QAAM,YAA8C,OAAO,aAAa,UAAU;AAChF,UAAM,MAAM,MAAM;AAClB,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,WAAW;AACrD,QAAI,WAAW,CAAC,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAC/E,aAAO,KAAK,OAAO,QAAQ,OAAO,YAAY;AAAA,IAChD;AACA,WAAO,UAAU,aAAa,EAAE,WAAW,OAAO,UAAU,CAAC;AAAA,EAC/D;AAEA,SAAO,EAAE,WAAW,WAAW,SAAS;AAC1C;","names":["limits"]}