@tangle-network/agent-app 0.43.24 → 0.43.26

package/dist/platform/index.js

@@ -1,240 +1,21 @@
 import {
-  clearCookieHeader,
-  readCookieValue,
-  serializeCookie
-} from "../chunk-HFC4BTWJ.js";
+  TangleSsoUserCreateError,
+  assertBillableBalance,
+  createAdminGuard,
+  createAuthGuard,
+  createBetterAuthSessionCookieMinter,
+  createSignedSsoState,
+  createTangleSsoHandlers,
+  guardResolution,
+  parseAdminEmails,
+  signSessionCookieValue,
+  verifySignedSsoState
+} from "../chunk-TKVJE63N.js";
+import "../chunk-HFC4BTWJ.js";
 import {
-  isTangleBillingEnforcementDisabled,
   resolveTangleDevOrUserKey
 } from "../chunk-7W5XSTUF.js";
 
-// src/platform/sso.ts
-var DEFAULT_STATE_TTL_SECONDS = 600;
-var DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;
-var DEFAULT_REDIRECT_PATH = "/app";
-var DEFAULT_LOGIN_PATH = "/login";
-var DEFAULT_SESSION_COOKIE = "better-auth.session_token";
-function randomHex(bytes) {
-  const buf = new Uint8Array(bytes);
-  crypto.getRandomValues(buf);
-  return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacBytes(secret, value) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  return new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value)));
-}
-async function hmacHex(secret, value) {
-  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, "0")).join("");
-}
-function constantTimeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-async function createSignedSsoState(config) {
-  if (!config.secret) throw new Error("SsoStateConfig.secret is required");
-  const now = config.now ?? Date.now;
-  const payload = `${randomHex(16)}.${now().toString(36)}`;
-  return `${payload}.${await hmacHex(config.secret, payload)}`;
-}
-async function verifySignedSsoState(state, config) {
-  if (!config.secret) throw new Error("SsoStateConfig.secret is required");
-  const parts = state.split(".");
-  if (parts.length !== 3) return false;
-  const [random, timestamp, mac] = parts;
-  if (!random || !timestamp || !mac) return false;
-  const expected = await hmacHex(config.secret, `${random}.${timestamp}`);
-  if (!constantTimeEqual(mac, expected)) return false;
-  const mintedAt = parseInt(timestamp, 36);
-  if (!Number.isFinite(mintedAt)) return false;
-  const now = config.now ?? Date.now;
-  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1e3;
-  return now() - mintedAt <= ttlMs;
-}
-var TangleSsoUserCreateError = class extends Error {
-  constructor(message = "Failed to create local user for Tangle SSO") {
-    super(message);
-    this.name = "TangleSsoUserCreateError";
-  }
-};
-async function signSessionCookieValue(token, secret) {
-  if (!secret) throw new Error("signSessionCookieValue requires a non-empty secret");
-  const sig = await hmacBytes(secret, token);
-  let bin = "";
-  for (const byte of sig) bin += String.fromCharCode(byte);
-  return `${token}.${btoa(bin)}`;
-}
-function createBetterAuthSessionCookieMinter(auth, options = {}) {
-  const warn = options.warn ?? ((message) => console.warn(message));
-  return async ({ token, ttlSeconds }) => {
-    const ctx = await auth.$context;
-    if (!ctx.secret) {
-      throw new Error("createBetterAuthSessionCookieMinter: auth context has no secret");
-    }
-    const { name, attributes } = ctx.authCookies.sessionToken;
-    if (attributes.domain) {
-      throw new Error(
-        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) \u2014 a domain-wide session cookie shadows sibling apps that share the parent domain`
-      );
-    }
-    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {
-      warn(
-        `[tangle-sso] session cookie is named "${name}" \u2014 better-auth's default. The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).`
-      );
-    }
-    const sameSite = typeof attributes.sameSite === "string" ? attributes.sameSite : "lax";
-    const cookieOptions = {
-      name,
-      path: typeof attributes.path === "string" ? attributes.path : "/",
-      httpOnly: attributes.httpOnly !== false,
-      sameSite: sameSite.charAt(0).toUpperCase() + sameSite.slice(1),
-      secure: Boolean(attributes.secure) || name.startsWith("__Secure-"),
-      maxAgeSeconds: ttlSeconds
-    };
-    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)];
-    if (name !== DEFAULT_SESSION_COOKIE) {
-      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }));
-    }
-    return cookies;
-  };
-}
-function sanitizeRedirectPath(value, fallback) {
-  if (value && value.startsWith("/") && !value.startsWith("//")) return value;
-  return fallback;
-}
-function redirectResponse(location, headers = new Headers()) {
-  headers.set("Location", location);
-  return new Response(null, { status: 302, headers });
-}
-function clientIp(request) {
-  return request.headers.get("CF-Connecting-IP") ?? request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? null;
-}
-function parseStateCookiePayload(raw) {
-  if (!raw) return null;
-  try {
-    const parsed = JSON.parse(raw);
-    if (parsed === null || typeof parsed !== "object") return null;
-    const { s, r } = parsed;
-    if (typeof s !== "string" || typeof r !== "string") return null;
-    return { s, r };
-  } catch {
-    return null;
-  }
-}
-function createTangleSsoHandlers(opts) {
-  if (!opts.stateSecret) throw new Error("TangleSsoHandlerOptions.stateSecret is required");
-  if (!opts.callbackUrl) throw new Error("TangleSsoHandlerOptions.callbackUrl is required");
-  if (!opts.stateCookieName) throw new Error("TangleSsoHandlerOptions.stateCookieName is required");
-  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE;
-  let mintSessionCookies;
-  if (opts.setSessionCookie) {
-    const seam = opts.setSessionCookie;
-    mintSessionCookies = async (args) => await seam(args);
-  } else if (opts.sessionCookieSecret) {
-    const secret = opts.sessionCookieSecret;
-    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [
-      serializeCookie(await signSessionCookieValue(token, secret), {
-        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,
-        secure,
-        maxAgeSeconds: ttlSeconds
-      })
-    ];
-  } else {
-    throw new Error(
-      "TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret: better-auth only accepts HMAC-signed (and, on https, __Secure--prefixed) session cookies, so an unsigned default would mint sessions that read back null"
-    );
-  }
-  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS;
-  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS;
-  const defaultRedirectPath = opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH;
-  const loginPath = opts.loginPath ?? DEFAULT_LOGIN_PATH;
-  const log = opts.log ?? (() => {
-  });
-  const now = opts.now ?? Date.now;
-  const stateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1e3, now };
-  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies };
-  function loginErrorRedirect(code) {
-    const headers = new Headers();
-    headers.append("Set-Cookie", clearCookieHeader(stateCookieOpts));
-    return redirectResponse(`${loginPath}?error=${code}`, headers);
-  }
-  return {
-    async start(request) {
-      const url = new URL(request.url);
-      const redirectPath = sanitizeRedirectPath(url.searchParams.get("redirect"), defaultRedirectPath);
-      const state = await createSignedSsoState(stateConfig);
-      const cookie = serializeCookie(JSON.stringify({ s: state, r: redirectPath }), {
-        ...stateCookieOpts,
-        maxAgeSeconds: stateTtlSeconds
-      });
-      const headers = new Headers();
-      headers.append("Set-Cookie", cookie);
-      return redirectResponse(opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl }), headers);
-    },
-    async callback(request) {
-      const url = new URL(request.url);
-      const code = url.searchParams.get("code");
-      const stateFromPlatform = url.searchParams.get("state");
-      if (!code || !stateFromPlatform) return loginErrorRedirect("tangle_callback_missing");
-      const payload = parseStateCookiePayload(readCookieValue(request.headers.get("cookie"), opts.stateCookieName));
-      if (!payload || payload.s !== stateFromPlatform) return loginErrorRedirect("tangle_state_mismatch");
-      if (!await verifySignedSsoState(payload.s, stateConfig)) return loginErrorRedirect("tangle_state_mismatch");
-      let exchanged;
-      try {
-        exchanged = await opts.auth.exchange(code);
-      } catch (err) {
-        log("[tangle-sso] exchange failed", err);
-        return loginErrorRedirect("tangle_exchange_failed");
-      }
-      let userId;
-      try {
-        ;
-        ({ userId } = await opts.store.upsertUserByEmail({
-          email: exchanged.user.email,
-          name: exchanged.user.name ?? null,
-          tangleUserId: exchanged.user.id
-        }));
-      } catch (err) {
-        if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect("tangle_user_create_failed");
-        throw err;
-      }
-      const expiresAt = new Date(now() + sessionTtlSeconds * 1e3);
-      const { token } = await opts.store.createSession({
-        userId,
-        expiresAt,
-        ipAddress: clientIp(request),
-        userAgent: request.headers.get("user-agent")
-      });
-      await opts.store.saveTangleLink({
-        userId,
-        sessionToken: token,
-        tangleUserId: exchanged.user.id,
-        email: exchanged.user.email,
-        name: exchanged.user.name ?? null,
-        apiKey: exchanged.apiKey,
-        planTier: exchanged.plan?.tier ?? null
-      });
-      const headers = new Headers();
-      headers.append("Set-Cookie", clearCookieHeader(stateCookieOpts));
-      const sessionCookies = await mintSessionCookies({
-        token,
-        expiresAt,
-        ttlSeconds: sessionTtlSeconds,
-        secure: opts.secureCookies
-      });
-      for (const cookie of sessionCookies) headers.append("Set-Cookie", cookie);
-      return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers);
-    }
-  };
-}
-
 // src/platform/hub.ts
 var TangleBearerMissingError = class extends Error {
   constructor(userId) {
@@ -504,52 +285,6 @@ function createTanglePlatformBillingClient(http, identity) {
     deduct: (input) => http.deduct(input)
   };
 }
-
-// src/platform/guards.ts
-function createAuthGuard(opts) {
-  const loginPath = opts.loginPath ?? "/login";
-  async function requireSession(request, o = {}) {
-    const session = await opts.getSession(request);
-    if (!session) {
-      if (o.apiResponse) {
-        throw Response.json({ error: "Unauthorized", code: "auth.unauthenticated" }, { status: 401 });
-      }
-      throw new Response(null, { status: 302, headers: { Location: loginPath } });
-    }
-    return session;
-  }
-  return {
-    requireSession,
-    requireUser: (request) => requireSession(request),
-    requireApiUser: (request) => requireSession(request, { apiResponse: true }),
-    getOptionalSession: async (request) => await opts.getSession(request) ?? null
-  };
-}
-function parseAdminEmails(raw) {
-  return (raw ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
-}
-function createAdminGuard(opts) {
-  return async (request) => {
-    const session = await opts.requireUser(request);
-    const allowed = opts.allowedEmails();
-    if (allowed.length === 0) throw new Response("Not found", { status: 404 });
-    const email = (opts.emailOf(session) ?? "").toLowerCase();
-    if (!allowed.includes(email)) throw new Response("Not found", { status: 404 });
-    return session;
-  };
-}
-function assertBillableBalance(state, opts = {}) {
-  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return;
-  if (state.overageAllowed || state.remainingBalanceUsd > 0) return;
-  throw Response.json(
-    {
-      ...opts.errorBody,
-      error: opts.errorMessage ?? "Add balance or upgrade your plan to invoke this agent.",
-      code: "billing.balance_required"
-    },
-    { status: 402 }
-  );
-}
 export {
   DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR,
   DEFAULT_TANGLE_TIER_POLICY,
@@ -567,6 +302,7 @@ export {
   createTanglePlatformBillingClient,
   createTangleSsoHandlers,
   getProductEntitlement,
+  guardResolution,
   isPlatformBillingHttpError,
   isPlatformHubErrorLike,
   isProductEntitled,

package/dist/platform/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/platform/sso.ts","../../src/platform/hub.ts","../../src/platform/billing.ts","../../src/platform/guards.ts"],"sourcesContent":["/**\n * Cross-site Tangle SSO for agent apps: signed-state CSRF cookies plus the\n * full start/callback orchestration against the platform's /cross-site\n * bridge. The platform wire client and account persistence are structural\n * seams (`TangleSsoAuthClient` / `TangleSsoAccountStore`), so this module\n * never imports agent-runtime, an auth framework, or a database driver.\n * WebCrypto only — runs in workerd without node compatibility flags.\n */\n\nimport { clearCookieHeader, readCookieValue, serializeCookie } from '../web/index'\n\nconst DEFAULT_STATE_TTL_SECONDS = 600\nconst DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7\nconst DEFAULT_REDIRECT_PATH = '/app'\nconst DEFAULT_LOGIN_PATH = '/login'\nconst DEFAULT_SESSION_COOKIE = 'better-auth.session_token'\n\n// ── Signed state ────────────────────────────────────────────────────────────\n\nexport interface SsoStateConfig {\n  /** HMAC-SHA256 secret (e.g. the app's auth secret). */\n  secret: string\n  /** State lifetime in ms. Default 600 000. */\n  ttlMs?: number\n  /** Injectable clock (ms since epoch). Default Date.now. */\n  now?: () => number\n}\n\nfunction randomHex(bytes: number): string {\n  const buf = new Uint8Array(bytes)\n  crypto.getRandomValues(buf)\n  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function hmacBytes(secret: string, value: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value)))\n}\n\nasync function hmacHex(secret: string, value: string): Promise<string> {\n  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n\n/** Mint a `<randomHex32>.<timestamp36>.<hmacHex>` state value. The timestamp\n *  is inside the signed payload, so expiry survives cookie-attribute tampering. */\nexport async function createSignedSsoState(config: SsoStateConfig): Promise<string> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const now = config.now ?? Date.now\n  const payload = `${randomHex(16)}.${now().toString(36)}`\n  return `${payload}.${await hmacHex(config.secret, payload)}`\n}\n\n/** Verify the MAC (constant-time) and the signed TTL. */\nexport async function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const parts = state.split('.')\n  if (parts.length !== 3) return false\n  const [random, timestamp, mac] = parts\n  if (!random || !timestamp || !mac) return false\n  const expected = await hmacHex(config.secret, `${random}.${timestamp}`)\n  if (!constantTimeEqual(mac, expected)) return false\n  const mintedAt = parseInt(timestamp, 36)\n  if (!Number.isFinite(mintedAt)) return false\n  const now = config.now ?? Date.now\n  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1000\n  return now() - mintedAt <= ttlMs\n}\n\n// ── Seams ───────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoExchangeResult {\n  apiKey: string\n  user: { id: string; email: string; name?: string | null }\n  plan?: { tier: string } | null\n}\n\n/** Structural mirror of the platform auth wire client — any object with these\n *  two methods satisfies it without this module importing the concrete class. */\nexport interface TangleSsoAuthClient {\n  authorizeUrl(options: { state: string; redirectUri?: string }): string\n  exchange(code: string): Promise<TangleSsoExchangeResult>\n}\n\n/** Thrown by `upsertUserByEmail` when the app-local user row cannot be\n *  created; the callback handler maps it to `?error=tangle_user_create_failed`.\n *  Any other store error propagates. */\nexport class TangleSsoUserCreateError extends Error {\n  constructor(message = 'Failed to create local user for Tangle SSO') {\n    super(message)\n    this.name = 'TangleSsoUserCreateError'\n  }\n}\n\n/**\n * Account persistence seam. Covers both storage styles in use: link-table\n * apps (a per-user platform-link row) and session-column apps (the key on the\n * session row) — `saveTangleLink` receives both `userId` and `sessionToken`,\n * and each app persists with the key it needs. `createSession` runs first so\n * the token is always available to `saveTangleLink`.\n */\nexport interface TangleSsoAccountStore {\n  /** Find-or-create the app-local user. `tangleUserId` is the platform's\n   *  stable user id — match on it first when the app stores it (emails are\n   *  mutable on the platform; the id is not), falling back to email for\n   *  first-time logins. */\n  upsertUserByEmail(input: { email: string; name: string | null; tangleUserId: string }): Promise<{ userId: string }>\n  /** Create an app session row; returns the session-cookie token value. */\n  createSession(input: {\n    userId: string\n    expiresAt: Date\n    ipAddress: string | null\n    userAgent: string | null\n  }): Promise<{ token: string }>\n  /** Persist the platform link (API key + platform identity). */\n  saveTangleLink(input: {\n    userId: string\n    sessionToken: string\n    tangleUserId: string\n    email: string\n    name: string | null\n    apiKey: string\n    planTier: string | null\n  }): Promise<void>\n}\n\n// ── Session cookie ──────────────────────────────────────────────────────────\n\n/** Successful-login context handed to the `setSessionCookie` seam. */\nexport interface TangleSsoSessionCookieArgs {\n  /** Session token returned by `store.createSession`. */\n  token: string\n  /** Session expiry (now + `sessionTtlSeconds`). */\n  expiresAt: Date\n  /** Mirrors `sessionTtlSeconds` after defaulting. */\n  ttlSeconds: number\n  /** Mirrors `TangleSsoHandlerOptions.secureCookies`. */\n  secure: boolean\n}\n\n/**\n * Sign a session token to better-call's signed-cookie contract — the value\n * better-auth's `getSignedCookie` verifies: `<token>.<signature>` where the\n * signature is the raw HMAC-SHA256 of the token under `secret`, encoded as\n * STANDARD base64 WITH padding (32 bytes → 44 chars ending `=`; better-call\n * rejects any other length or suffix, so url-safe/unpadded variants read back\n * as a null session). The joined value is percent-encoded once at cookie\n * serialization, matching better-call's `serializeSignedCookie` byte-exactly.\n */\nexport async function signSessionCookieValue(token: string, secret: string): Promise<string> {\n  if (!secret) throw new Error('signSessionCookieValue requires a non-empty secret')\n  const sig = await hmacBytes(secret, token)\n  let bin = ''\n  for (const byte of sig) bin += String.fromCharCode(byte)\n  return `${token}.${btoa(bin)}`\n}\n\n/** Structural slice of a `betterAuth()` instance — only what cookie minting\n *  reads. No better-auth import: the signing contract is implemented by\n *  `signSessionCookieValue`, byte-compatible with better-auth's own\n *  `makeSignature`. */\nexport interface BetterAuthSessionCookieSource {\n  $context: PromiseLike<{\n    secret: string\n    authCookies: {\n      sessionToken: {\n        /** Final cookie name — better-auth decides the `__Secure-` prefix\n         *  (and any `advanced.cookiePrefix`) once at `betterAuth()` init. */\n        name: string\n        attributes: {\n          secure?: boolean\n          sameSite?: string\n          path?: string\n          httpOnly?: boolean\n          domain?: string\n        }\n      }\n    }\n  }>\n}\n\nexport interface BetterAuthSessionCookieMinterOptions {\n  /** Receives the shadowed-cookie-name warning (see below). Default\n   *  console.warn. */\n  warn?: (message: string) => void\n}\n\n/**\n * Canonical `setSessionCookie` wiring for better-auth apps: mint the session\n * Set-Cookie exactly as better-auth's own login flows do — name + attributes\n * from `auth.$context.authCookies.sessionToken` (better-auth stays\n * authoritative over prefix/name/attributes) and the value signed to\n * better-call's `getSignedCookie` contract. A raw unprefixed\n * `better-auth.session_token` left by an earlier login is explicitly expired\n * so it cannot shadow the real cookie.\n *\n * Warns when the app's session cookie still has better-auth's DEFAULT name:\n * the Tangle platform (id.tangle.tools) sets a `Domain=.tangle.tools` cookie\n * under that exact name, and equal-path cookies are sent oldest-first — the\n * platform's cookie is always older (the user signs in there before the app's\n * callback runs), so the app reads the platform's token, fails its own\n * signature check, and every fresh login lands logged-out. Per-app\n * `advanced.cookiePrefix` is the fix.\n *\n * Throws on a domain-scoped session cookie for the same reason: a\n * `Domain=`-wide session cookie is exactly the shadowing footgun.\n */\nexport function createBetterAuthSessionCookieMinter(\n  auth: BetterAuthSessionCookieSource,\n  options: BetterAuthSessionCookieMinterOptions = {},\n): (args: TangleSsoSessionCookieArgs) => Promise<string[]> {\n  const warn = options.warn ?? ((message: string) => console.warn(message))\n  return async ({ token, ttlSeconds }) => {\n    const ctx = await auth.$context\n    if (!ctx.secret) {\n      throw new Error('createBetterAuthSessionCookieMinter: auth context has no secret')\n    }\n    const { name, attributes } = ctx.authCookies.sessionToken\n    if (attributes.domain) {\n      throw new Error(\n        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) — ` +\n          'a domain-wide session cookie shadows sibling apps that share the parent domain',\n      )\n    }\n    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {\n      warn(\n        `[tangle-sso] session cookie is named \"${name}\" — better-auth's default. ` +\n          'The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, ' +\n          \"and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. \" +\n          \"Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).\",\n      )\n    }\n    const sameSite = typeof attributes.sameSite === 'string' ? attributes.sameSite : 'lax'\n    const cookieOptions = {\n      name,\n      path: typeof attributes.path === 'string' ? attributes.path : '/',\n      httpOnly: attributes.httpOnly !== false,\n      sameSite: (sameSite.charAt(0).toUpperCase() + sameSite.slice(1)) as 'Lax' | 'Strict' | 'None',\n      secure: Boolean(attributes.secure) || name.startsWith('__Secure-'),\n      maxAgeSeconds: ttlSeconds,\n    }\n    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)]\n    if (name !== DEFAULT_SESSION_COOKIE) {\n      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }))\n    }\n    return cookies\n  }\n}\n\n// ── Handlers ────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoHandlerOptions {\n  auth: TangleSsoAuthClient\n  store: TangleSsoAccountStore\n  /** HMAC secret for the state cookie. */\n  stateSecret: string\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  stateCookieName: string\n  /** Default 'better-auth.session_token'. Ignored when `setSessionCookie` is\n   *  provided. The default path prepends `__Secure-` iff `secureCookies`. */\n  sessionCookieName?: string\n  /** Mint the host auth framework's own session cookie(s); return complete\n   *  Set-Cookie header values (the handler appends them verbatim and sets no\n   *  session cookie itself). Supply this when the framework should stay\n   *  authoritative over name/prefix/signing/attributes — e.g. better-auth:\n   *  `auth.$context.authCookies.sessionToken` + `makeSignature`. */\n  setSessionCookie?: (\n    args: TangleSsoSessionCookieArgs,\n  ) => readonly string[] | Promise<readonly string[]>\n  /** HMAC-SHA256 secret the host auth framework verifies session cookies with\n   *  (better-auth: its `secret`). Required when `setSessionCookie` is absent —\n   *  the default cookie is minted to better-call's signed contract via\n   *  `signSessionCookieValue`; an unsigned or mis-signed value reads back as a\n   *  null session, so there is deliberately no fallback to `stateSecret`\n   *  (which is not guaranteed to be the auth secret). */\n  sessionCookieSecret?: string\n  /** Adds `Secure` to every cookie this module sets, and (default session\n   *  cookie only) the `__Secure-` name prefix. Must match the auth\n   *  framework's own secure-cookie decision (better-auth: https `baseURL` /\n   *  `advanced.useSecureCookies`), or it will look up a different cookie name\n   *  than the one set here. */\n  secureCookies: boolean\n  /** Default 604 800 (7 days). */\n  sessionTtlSeconds?: number\n  /** Default 600. Applies to both the cookie Max-Age and the signed TTL. */\n  stateTtlSeconds?: number\n  /** Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default '/login'. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n  now?: () => number\n}\n\nexport interface TangleSsoHandlers {\n  /** GET start route: mint + sign state, set the state cookie, 302 to the\n   *  platform authorize URL. `?redirect=` carries the post-login path. */\n  start(request: Request): Promise<Response>\n  /** GET callback route: verify state, exchange the code, upsert the user,\n   *  create the session, save the platform link, set the session cookie\n   *  (via the `setSessionCookie` seam, else signed to better-call's contract\n   *  with `sessionCookieSecret`), 302 to the saved redirect. Every failure\n   *  302s to `loginPath?error=…` with the state cookie cleared. */\n  callback(request: Request): Promise<Response>\n}\n\n/** Accept only same-origin absolute paths (rejects `//host` protocol-relative URLs). */\nfunction sanitizeRedirectPath(value: string | null, fallback: string): string {\n  if (value && value.startsWith('/') && !value.startsWith('//')) return value\n  return fallback\n}\n\nfunction redirectResponse(location: string, headers = new Headers()): Response {\n  headers.set('Location', location)\n  return new Response(null, { status: 302, headers })\n}\n\n/** Real client IP: `CF-Connecting-IP` behind Cloudflare, else the first\n *  `x-forwarded-for` hop (the rest of the list is sender-controlled). */\nfunction clientIp(request: Request): string | null {\n  return (\n    request.headers.get('CF-Connecting-IP') ??\n    request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n    null\n  )\n}\n\ninterface StateCookiePayload {\n  s: string\n  r: string\n}\n\nfunction parseStateCookiePayload(raw: string | null): StateCookiePayload | null {\n  if (!raw) return null\n  try {\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed === null || typeof parsed !== 'object') return null\n    const { s, r } = parsed as Record<string, unknown>\n    if (typeof s !== 'string' || typeof r !== 'string') return null\n    return { s, r }\n  } catch {\n    return null\n  }\n}\n\nexport function createTangleSsoHandlers(opts: TangleSsoHandlerOptions): TangleSsoHandlers {\n  if (!opts.stateSecret) throw new Error('TangleSsoHandlerOptions.stateSecret is required')\n  if (!opts.callbackUrl) throw new Error('TangleSsoHandlerOptions.callbackUrl is required')\n  if (!opts.stateCookieName) throw new Error('TangleSsoHandlerOptions.stateCookieName is required')\n\n  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE\n\n  let mintSessionCookies: (args: TangleSsoSessionCookieArgs) => Promise<readonly string[]>\n  if (opts.setSessionCookie) {\n    const seam = opts.setSessionCookie\n    mintSessionCookies = async (args) => await seam(args)\n  } else if (opts.sessionCookieSecret) {\n    const secret = opts.sessionCookieSecret\n    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [\n      serializeCookie(await signSessionCookieValue(token, secret), {\n        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,\n        secure,\n        maxAgeSeconds: ttlSeconds,\n      }),\n    ]\n  } else {\n    throw new Error(\n      'TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret: ' +\n        'better-auth only accepts HMAC-signed (and, on https, __Secure--prefixed) session cookies, ' +\n        'so an unsigned default would mint sessions that read back null',\n    )\n  }\n  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS\n  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS\n  const defaultRedirectPath = opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH\n  const loginPath = opts.loginPath ?? DEFAULT_LOGIN_PATH\n  const log = opts.log ?? (() => {})\n  const now = opts.now ?? Date.now\n  const stateConfig: SsoStateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1000, now }\n\n  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies }\n\n  function loginErrorRedirect(code: string): Response {\n    const headers = new Headers()\n    headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n    return redirectResponse(`${loginPath}?error=${code}`, headers)\n  }\n\n  return {\n    async start(request) {\n      const url = new URL(request.url)\n      const redirectPath = sanitizeRedirectPath(url.searchParams.get('redirect'), defaultRedirectPath)\n      const state = await createSignedSsoState(stateConfig)\n      const cookie = serializeCookie(JSON.stringify({ s: state, r: redirectPath }), {\n        ...stateCookieOpts,\n        maxAgeSeconds: stateTtlSeconds,\n      })\n      const headers = new Headers()\n      headers.append('Set-Cookie', cookie)\n      return redirectResponse(opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl }), headers)\n    },\n\n    async callback(request) {\n      const url = new URL(request.url)\n      const code = url.searchParams.get('code')\n      const stateFromPlatform = url.searchParams.get('state')\n      if (!code || !stateFromPlatform) return loginErrorRedirect('tangle_callback_missing')\n\n      const payload = parseStateCookiePayload(readCookieValue(request.headers.get('cookie'), opts.stateCookieName))\n      if (!payload || payload.s !== stateFromPlatform) return loginErrorRedirect('tangle_state_mismatch')\n      if (!(await verifySignedSsoState(payload.s, stateConfig))) return loginErrorRedirect('tangle_state_mismatch')\n\n      let exchanged: TangleSsoExchangeResult\n      try {\n        exchanged = await opts.auth.exchange(code)\n      } catch (err) {\n        log('[tangle-sso] exchange failed', err)\n        return loginErrorRedirect('tangle_exchange_failed')\n      }\n\n      let userId: string\n      try {\n        ;({ userId } = await opts.store.upsertUserByEmail({\n          email: exchanged.user.email,\n          name: exchanged.user.name ?? null,\n          tangleUserId: exchanged.user.id,\n        }))\n      } catch (err) {\n        if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect('tangle_user_create_failed')\n        throw err\n      }\n\n      const expiresAt = new Date(now() + sessionTtlSeconds * 1000)\n      const { token } = await opts.store.createSession({\n        userId,\n        expiresAt,\n        ipAddress: clientIp(request),\n        userAgent: request.headers.get('user-agent'),\n      })\n\n      await opts.store.saveTangleLink({\n        userId,\n        sessionToken: token,\n        tangleUserId: exchanged.user.id,\n        email: exchanged.user.email,\n        name: exchanged.user.name ?? null,\n        apiKey: exchanged.apiKey,\n        planTier: exchanged.plan?.tier ?? null,\n      })\n\n      const headers = new Headers()\n      headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n      const sessionCookies = await mintSessionCookies({\n        token,\n        expiresAt,\n        ttlSeconds: sessionTtlSeconds,\n        secure: opts.secureCookies,\n      })\n      for (const cookie of sessionCookies) headers.append('Set-Cookie', cookie)\n      return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers)\n    },\n  }\n}\n","/**\n * Integrations-hub proxy routes: the app-side surface that forwards an\n * authenticated user's requests to the platform's `/v1/integrations/*` API\n * using their stored platform key. Auth, key lookup, and the wire client are\n * structural seams (`HubProxyContext`); error detection is by name + shape so\n * it survives bundlers duplicating module instances.\n */\n\nimport {\n  resolveTangleDevOrUserKey,\n  type TangleExecutionEnvironment,\n  type TangleExecutionKeySource,\n} from '../runtime/model'\n\n/** Hub bearer provenance mirrors the execution-key source union. */\nexport type TangleHubBearerSource = TangleExecutionKeySource\n\nexport interface ResolvedTangleHubBearer {\n  bearer: string\n  source: TangleHubBearerSource\n}\n\nexport interface ResolveUserTangleHubBearerOptions {\n  userId: string\n  /** Deployment context. Only local development may use env credentials. */\n  environment?: TangleExecutionEnvironment\n  /** Env to read for the local-development bearer. */\n  env?: Record<string, string | undefined>\n  /** App-owned lookup for the caller's linked platform API key. */\n  getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>\n}\n\nexport interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {\n  userId: UserId\n  environment?: TangleExecutionEnvironment\n  env?: Record<string, string | undefined>\n  getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>\n}\n\nexport class TangleBearerMissingError extends Error {\n  constructor(readonly userId: string) {\n    super(`No Tangle platform link for user ${userId}`)\n    this.name = 'TangleBearerMissingError'\n  }\n}\n\n/**\n * Resolve the Tangle bearer used by the integration hub proxy.\n *\n * Local development may use a server env key so apps can exercise the hub\n * without completing cross-site SSO. Deployed contexts must use the caller's\n * linked platform key; this keeps integration ownership aligned with the user.\n */\nexport async function resolveUserTangleHubBearer(\n  opts: ResolveUserTangleHubBearerOptions,\n): Promise<ResolvedTangleHubBearer> {\n  const resolved = await resolveTangleDevOrUserKey({\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: opts.getUserApiKey,\n  })\n  if (resolved) return { bearer: resolved.apiKey, source: resolved.source }\n\n  throw new TangleBearerMissingError(opts.userId)\n}\n\nexport async function resolveUserTangleHubBearerForUser<UserId = string>(\n  opts: ResolveUserTangleHubBearerForUserOptions<UserId>,\n): Promise<ResolvedTangleHubBearer> {\n  return resolveUserTangleHubBearer({\n    userId: String(opts.userId),\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: () => opts.getUserApiKey(opts.userId),\n  })\n}\n\n/** Structural guard (name + userId shape) — robust when the error class is\n *  constructed in a different module instance than the one checking it. */\nexport function isTangleBearerMissingError(error: unknown): error is TangleBearerMissingError {\n  return (\n    error instanceof Error &&\n    error.name === 'TangleBearerMissingError' &&\n    typeof (error as { userId?: unknown }).userId === 'string'\n  )\n}\n\n/** Structural detection of the platform hub wire error (name + numeric status). */\nexport function isPlatformHubErrorLike(error: unknown): error is Error & { status: number; code?: string } {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformHubError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\n/** Structural subset of the platform hub wire client — extra methods are fine. */\nexport interface HubClientLike {\n  catalog(): Promise<unknown>\n  listConnections(): Promise<unknown>\n  revokeConnection(connectionId: string): Promise<unknown>\n  startAuth(input: {\n    providerId: string\n    connectorId: string\n    returnUrl: string\n    requestedScopes?: string[]\n  }): Promise<{ authorizationUrl: string; state: string }>\n  listHealthchecks(): Promise<unknown>\n}\n\nexport interface HubProxyContext {\n  /** Resolve the authenticated user id. Throw the app's own auth Response /\n   *  redirect to reject — it propagates untouched. */\n  requireUserId(request: Request): Promise<string>\n  /** The user's platform bearer; throw `TangleBearerMissingError` when unlinked. */\n  getBearer(userId: string): Promise<string>\n  /** A hub client bound to the bearer. */\n  createHubClient(bearer: string): HubClientLike\n}\n\nexport interface HubProxyRouteArgs {\n  request: Request\n  params?: Record<string, string | undefined>\n}\n\nexport interface HubProxyRoutes {\n  /** GET → `{ catalog }`. */\n  catalog(args: HubProxyRouteArgs): Promise<Response>\n  /** GET → `{ connections }`. */\n  connections(args: HubProxyRouteArgs): Promise<Response>\n  /** DELETE → the platform revocation result verbatim; 405 otherwise. */\n  connectionDelete(args: { request: Request; params: { connectionId: string } }): Promise<Response>\n  /** GET → `{ healthchecks }`. */\n  healthchecks(args: HubProxyRouteArgs): Promise<Response>\n  /** POST `{ providerId, connectorId, returnUrl, requestedScopes? }` →\n   *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */\n  authStart(args: HubProxyRouteArgs): Promise<Response>\n}\n\ninterface StartAuthBody {\n  providerId?: string\n  connectorId?: string\n  returnUrl?: string\n  requestedScopes?: string[]\n}\n\nexport function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes {\n  /** Auth runs OUTSIDE the proxy try/catch so the app's auth throw (redirect\n   *  Response etc.) is never swallowed; bearer + platform errors are mapped. */\n  async function proxy(request: Request, call: (hub: HubClientLike) => Promise<Response>): Promise<Response> {\n    const userId = await ctx.requireUserId(request)\n    try {\n      const bearer = await ctx.getBearer(userId)\n      return await call(ctx.createHubClient(bearer))\n    } catch (err) {\n      if (isTangleBearerMissingError(err)) {\n        return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n      }\n      if (isPlatformHubErrorLike(err)) {\n        return Response.json({ error: err.message, code: err.code }, { status: err.status })\n      }\n      throw err\n    }\n  }\n\n  return {\n    catalog: ({ request }) => proxy(request, async (hub) => Response.json({ catalog: await hub.catalog() })),\n\n    connections: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ connections: await hub.listConnections() })),\n\n    connectionDelete: async ({ request, params }) => {\n      if (request.method !== 'DELETE') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      return proxy(request, async (hub) => Response.json(await hub.revokeConnection(params.connectionId)))\n    },\n\n    healthchecks: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ healthchecks: await hub.listHealthchecks() })),\n\n    authStart: async ({ request }) => {\n      if (request.method !== 'POST') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      const userId = await ctx.requireUserId(request)\n      let body: StartAuthBody\n      try {\n        body = (await request.json()) as StartAuthBody\n      } catch {\n        return Response.json({ error: 'Invalid JSON body' }, { status: 400 })\n      }\n      if (!body.providerId || !body.connectorId || !body.returnUrl) {\n        return Response.json({ error: 'providerId, connectorId, and returnUrl are required' }, { status: 400 })\n      }\n      try {\n        const bearer = await ctx.getBearer(userId)\n        const result = await ctx.createHubClient(bearer).startAuth({\n          providerId: body.providerId,\n          connectorId: body.connectorId,\n          returnUrl: body.returnUrl,\n          requestedScopes: body.requestedScopes,\n        })\n        return Response.json({ authorizationUrl: result.authorizationUrl, state: result.state })\n      } catch (err) {\n        if (isTangleBearerMissingError(err)) {\n          return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n        }\n        if (isPlatformHubErrorLike(err)) {\n          return Response.json({ error: err.message, code: err.code }, { status: err.status })\n        }\n        throw err\n      }\n    },\n  }\n}\n","/**\n * Platform billing HTTP transport + tier state for apps on the shared\n * Tangle balance model (id.tangle.tools). Reads authenticate as the user via\n * their per-user platform key (the platform resolves the caller from the\n * key; service or impersonation headers on read routes are rejected). The\n * deduct write authenticates as the product service (`Bearer <serviceToken>`\n * + `X-Service-Name`) and names the target user in the body. Also provides a\n * fetch-backed implementation of the `/billing` module's\n * `PlatformBillingClient` seam (type-only import — no runtime coupling).\n */\n\nimport type { PlatformBillingClient, PlatformIdentity } from '../billing/index'\n\nexport type TanglePlanTier = 'free' | 'pro' | 'enterprise'\n\n/** 'pro' | 'enterprise' pass through; anything else (null, unknown) → 'free'. */\nexport function normalizeTanglePlanTier(plan: string | null | undefined): TanglePlanTier {\n  return plan === 'pro' || plan === 'enterprise' ? plan : 'free'\n}\n\nexport class PlatformBillingHttpError extends Error {\n  constructor(\n    readonly status: number,\n    detail: string,\n  ) {\n    super(`Platform request failed (${status}): ${detail}`)\n    this.name = 'PlatformBillingHttpError'\n  }\n}\n\n/** Structural guard (name + numeric status) — robust across module instances. */\nexport function isPlatformBillingHttpError(error: unknown): error is PlatformBillingHttpError {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformBillingHttpError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\nexport interface PlatformBillingHttpOptions {\n  /** Platform root, e.g. https://id.tangle.tools (trailing slashes stripped). */\n  baseUrl: string\n  /** Used only by `deduct()`; resolved lazily so reads never require it.\n   *  Throws at call time when empty. */\n  serviceToken: string | (() => string)\n  /** Product slug — the `X-Service-Name` header and the deduct `product` field. */\n  productSlug: string\n  fetchImpl?: typeof fetch\n  /** Default 10 000. */\n  timeoutMs?: number\n}\n\nexport interface PlatformSubscriptionInfo {\n  tier: TanglePlanTier\n  status: string | null\n}\n\nexport interface PlatformBalanceSnapshot {\n  balance: number\n  lifetimeSpent: number\n  updatedAt?: string\n}\n\nexport interface PlatformUsageProductRow {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Lifecycle of a per-product seat subscription, mirroring the Stripe states\n *  the platform persists. 'none' = the user has never held this seat. */\nexport type SeatStatus = 'none' | 'active' | 'trialing' | 'past_due' | 'canceled'\n\n/**\n * Per-product entitlement snapshot from the platform — the single read that\n * tells a product whether to show its workspace or the seat paywall. Shape\n * matches `GET /v1/billing/product-entitlement?product=<id>`.\n *\n * `hasSeat` and `onFreeTier` are computed platform-side from the raw seat row\n * + cumulative spend so the gate is identical across all five products:\n * - `hasSeat`     — an active/trialing seat whose period has not lapsed.\n * - `onFreeTier`  — no active seat AND cumulative spend below the free cap\n *                   ($2 / 200¢ lifetime). Keys off lifetime spend, not wallet\n *                   balance, so a router top-up never re-opens free access.\n */\nexport interface ProductEntitlement {\n  seatStatus: SeatStatus\n  /** ISO timestamp the active seat's paid period runs until; null when none. */\n  currentPeriodEnd: string | null\n  /** Cumulative inference spend across the whole suite, in dollars. */\n  lifetimeSpentUsd: number\n  hasSeat: boolean\n  onFreeTier: boolean\n}\n\nexport interface PlatformBillingHttp {\n  /** GET /v1/plans/current (user bearer). */\n  getSubscription(userApiKey: string): Promise<PlatformSubscriptionInfo>\n  /** GET /v1/billing/balance (user bearer). */\n  getBalance(userApiKey: string): Promise<PlatformBalanceSnapshot>\n  /** GET /v1/billing/usage (user bearer). */\n  getUsageByProduct(userApiKey: string): Promise<PlatformUsageProductRow[]>\n  /** GET /v1/billing/product-entitlement?product=<id> (user bearer). */\n  getProductEntitlement(userApiKey: string, productId: string): Promise<ProductEntitlement>\n  /** POST /v1/billing/deduct (service token). */\n  deduct(input: {\n    platformUserId: string\n    amountUsd: number\n    type: string\n    description: string\n    referenceId: string\n  }): Promise<void>\n  /** Absolute URL of the platform's billing-management surface. */\n  billingUrl(): string\n  /** Absolute URL of the $100/mo seat checkout for `productId`. */\n  seatCheckoutUrl(productId: string): string\n}\n\nexport function createPlatformBillingHttp(opts: PlatformBillingHttpOptions): PlatformBillingHttp {\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, '')\n  if (!baseUrl) throw new Error('PlatformBillingHttpOptions.baseUrl is required')\n  if (!opts.productSlug) throw new Error('PlatformBillingHttpOptions.productSlug is required')\n  const fetchImpl = opts.fetchImpl ?? fetch\n  const timeoutMs = opts.timeoutMs ?? 10_000\n\n  function resolveServiceToken(): string {\n    const token = typeof opts.serviceToken === 'function' ? opts.serviceToken() : opts.serviceToken\n    if (!token) throw new Error('A platform service token is required for deduct')\n    return token\n  }\n\n  async function request<T>(path: string, init: RequestInit, headers: Headers): Promise<T> {\n    const res = await fetchImpl(`${baseUrl}${path}`, {\n      ...init,\n      headers,\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n    if (!res.ok) {\n      const body = (await res.json().catch(() => null)) as { error?: { message?: string } } | null\n      throw new PlatformBillingHttpError(res.status, body?.error?.message ?? res.statusText)\n    }\n    return res.json() as Promise<T>\n  }\n\n  function userRead<T>(userApiKey: string, path: string): Promise<T> {\n    const headers = new Headers()\n    headers.set('Authorization', `Bearer ${userApiKey}`)\n    return request<T>(path, {}, headers)\n  }\n\n  return {\n    async getSubscription(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { subscription?: { plan?: string | null; status?: string | null } | null }\n      }>(userApiKey, '/v1/plans/current')\n      const sub = body.data?.subscription ?? null\n      return { tier: normalizeTanglePlanTier(sub?.plan), status: sub?.status ?? null }\n    },\n\n    async getBalance(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { balance?: number; lifetimeSpent?: number; updatedAt?: string }\n      }>(userApiKey, '/v1/billing/balance')\n      return {\n        balance: body.data?.balance ?? 0,\n        lifetimeSpent: body.data?.lifetimeSpent ?? 0,\n        updatedAt: body.data?.updatedAt,\n      }\n    },\n\n    async getUsageByProduct(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: Array<{ product?: string | null; totalSpent?: number; count?: number }>\n      }>(userApiKey, '/v1/billing/usage')\n      return (body.data ?? []).map((row) => ({\n        product: row.product ?? null,\n        totalSpent: row.totalSpent ?? 0,\n        count: row.count ?? 0,\n      }))\n    },\n\n    async getProductEntitlement(userApiKey, productId) {\n      const slug = encodeURIComponent(productId)\n      const body = await userRead<{\n        success: boolean\n        data?: {\n          seatStatus?: SeatStatus | null\n          currentPeriodEnd?: string | null\n          lifetimeSpentUsd?: number | null\n          hasSeat?: boolean | null\n          onFreeTier?: boolean | null\n        }\n      }>(userApiKey, `/v1/billing/product-entitlement?product=${slug}`)\n      const data = body.data ?? {}\n      const hasSeat = data.hasSeat === true\n      return {\n        seatStatus: data.seatStatus ?? 'none',\n        currentPeriodEnd: data.currentPeriodEnd ?? null,\n        lifetimeSpentUsd: data.lifetimeSpentUsd ?? 0,\n        hasSeat,\n        // Free access only when there is no seat AND the platform says so.\n        onFreeTier: !hasSeat && data.onFreeTier === true,\n      }\n    },\n\n    async deduct(input) {\n      const headers = new Headers()\n      headers.set('Authorization', `Bearer ${resolveServiceToken()}`)\n      headers.set('X-Service-Name', opts.productSlug)\n      headers.set('Content-Type', 'application/json')\n      await request('/v1/billing/deduct', {\n        method: 'POST',\n        body: JSON.stringify({\n          userId: input.platformUserId,\n          amount: input.amountUsd,\n          type: input.type,\n          product: opts.productSlug,\n          description: input.description,\n          referenceId: input.referenceId,\n        }),\n      }, headers)\n    },\n\n    billingUrl() {\n      return `${baseUrl}/app/billing`\n    },\n\n    seatCheckoutUrl(productId) {\n      return seatCheckoutUrl(baseUrl, productId)\n    },\n  }\n}\n\n/**\n * Platform Stripe checkout URL for a product's $100/mo seat. One shared price\n * carries `metadata.productId`; the platform distinguishes the product from\n * the `product` query param (not five distinct prices). Mirrors the\n * `billingUrl()` shape — a deterministic platform-rooted URL, no network call.\n */\nexport function seatCheckoutUrl(baseUrl: string, productId: string): string {\n  const root = baseUrl.replace(/\\/+$/, '')\n  return `${root}/app/billing/seat/checkout?product=${encodeURIComponent(productId)}`\n}\n\n// ── Tier policy + composed state ────────────────────────────────────────────\n\nexport interface TangleTierPolicy {\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport const DEFAULT_TANGLE_TIER_POLICY: Record<TanglePlanTier, TangleTierPolicy> = {\n  free: { concurrency: 1, overageAllowed: false },\n  pro: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n  enterprise: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n}\n\nexport interface TangleTierState {\n  tier: TanglePlanTier\n  subscriptionStatus: string | null\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * Read subscription + balance and project them onto the tier policy. A\n * null/absent key fails CLOSED (free tier, zero balance) — a billable run is\n * never started against an unknown balance. Platform errors throw; callers\n * on the billable path choose their posture explicitly.\n */\nexport async function readTangleTierState(\n  http: PlatformBillingHttp,\n  userApiKey: string | null | undefined,\n  policy: Record<TanglePlanTier, TangleTierPolicy> = DEFAULT_TANGLE_TIER_POLICY,\n): Promise<TangleTierState> {\n  if (!userApiKey) {\n    return {\n      tier: 'free',\n      subscriptionStatus: null,\n      remainingBalanceUsd: 0,\n      lifetimeSpentUsd: 0,\n      ...policy.free,\n    }\n  }\n  const [subscription, balance] = await Promise.all([\n    http.getSubscription(userApiKey),\n    http.getBalance(userApiKey),\n  ])\n  return {\n    tier: subscription.tier,\n    subscriptionStatus: subscription.status,\n    remainingBalanceUsd: balance.balance,\n    lifetimeSpentUsd: balance.lifetimeSpent,\n    ...policy[subscription.tier],\n  }\n}\n\n// ── Per-product seat entitlement ────────────────────────────────────────────\n\n/** Lifetime free-tier cap: $2 (200¢) cumulative inference spend, expressed in\n *  dollars. Free product access ends once cumulative spend crosses this. */\nexport const FREE_TIER_SPEND_CAP_USD = 2\n\n/**\n * Default name of the per-app feature flag gating seat billing. While OFF the\n * entitlement read is skipped and access fails OPEN (entitled) so nothing\n * changes live until a product flips the flag.\n */\nexport const DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR = 'SEAT_BILLING_ENABLED'\n\nexport interface SeatBillingFlagOptions {\n  env?: Record<string, string | undefined>\n  /** Override the flag name; default {@link DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR}. */\n  flagEnvVar?: string\n}\n\n/**\n * Seat billing is OFF unless the flag is explicitly truthy ('true'/'1'/'on'/\n * 'enabled'). Default OFF — pre-rollout, the paywall never engages. Returns\n * false when no env is available (browser bundles) so the client stays\n * fail-open there too.\n */\nexport function isSeatBillingEnabled(opts: SeatBillingFlagOptions = {}): boolean {\n  const env =\n    opts.env ??\n    (typeof process !== 'undefined' ? (process.env as Record<string, string | undefined>) : undefined)\n  if (!env) return false\n  const flag = env[opts.flagEnvVar ?? DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR]?.trim().toLowerCase()\n  return flag === 'true' || flag === '1' || flag === 'on' || flag === 'enabled'\n}\n\n/**\n * Read a user's entitlement for one product. Fails OPEN: an absent key,\n * disabled flag, or unreachable seat endpoint all return a permissive snapshot\n * (`hasSeat: true`) so consumers never break pre-rollout. The platform owns the\n * `hasSeat`/`onFreeTier` computation; this client only transports + degrades\n * safely.\n *\n * @param flag — pass {@link isSeatBillingEnabled} (or your own boolean) so the\n *   product owns when the gate engages. When false, no network call is made.\n */\nexport async function getProductEntitlement(\n  http: Pick<PlatformBillingHttp, 'getProductEntitlement'>,\n  userApiKey: string | null | undefined,\n  productId: string,\n  flag = true,\n): Promise<ProductEntitlement> {\n  if (!flag || !userApiKey) return failOpenEntitlement()\n  try {\n    return await http.getProductEntitlement(userApiKey, productId)\n  } catch {\n    // Seat endpoint unavailable (pre-rollout platform, transient 5xx): never\n    // wall a paying or grandfathered user on a transport hiccup.\n    return failOpenEntitlement()\n  }\n}\n\nfunction failOpenEntitlement(): ProductEntitlement {\n  return {\n    seatStatus: 'active',\n    currentPeriodEnd: null,\n    lifetimeSpentUsd: 0,\n    hasSeat: true,\n    onFreeTier: false,\n  }\n}\n\n/** Entitled = holds an active seat OR is still inside the free tier. The one\n *  predicate all five products gate on. */\nexport function isProductEntitled(ent: ProductEntitlement): boolean {\n  return ent.hasSeat || ent.onFreeTier\n}\n\n// ── Bridge onto the /billing seam ───────────────────────────────────────────\n\nexport interface PlatformIdentityStore {\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n}\n\n/** Concrete fetch-backed `PlatformBillingClient<TanglePlanTier>` for\n *  `createPlatformBalanceManager` (from `/billing`). */\nexport function createTanglePlatformBillingClient(\n  http: PlatformBillingHttp,\n  identity: PlatformIdentityStore,\n): PlatformBillingClient<TanglePlanTier> {\n  return {\n    resolveIdentity: (userId) => identity.resolveIdentity(userId),\n    getPlan: async (apiKey) => (await http.getSubscription(apiKey)).tier,\n    getBalance: async (apiKey) => {\n      const snapshot = await http.getBalance(apiKey)\n      return { balance: snapshot.balance, lifetimeSpent: snapshot.lifetimeSpent }\n    },\n    getUsageByProduct: (apiKey) => http.getUsageByProduct(apiKey),\n    deduct: (input) => http.deduct(input),\n  }\n}\n","/**\n * Request guards for agent-app routes: session auth (302 redirect for pages,\n * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to\n * non-admins), and the billable-balance gate (402 with a stable code).\n * Session resolution is a seam; thrown Responses follow the router convention\n * of surfacing a thrown Response as the route result.\n */\n\nimport { isTangleBillingEnforcementDisabled } from '../runtime/model'\n\nexport interface AuthGuardOptions<Session> {\n  /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */\n  getSession(request: Request): Promise<Session | null | undefined>\n  /** Default '/login'. */\n  loginPath?: string\n}\n\nexport interface AuthGuard<Session> {\n  /** Page guard — throws a 302 redirect Response to `loginPath`. */\n  requireUser(request: Request): Promise<Session>\n  /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */\n  requireApiUser(request: Request): Promise<Session>\n  /** `apiResponse` selects the 401 JSON path over the redirect. */\n  requireSession(request: Request, opts?: { apiResponse?: boolean }): Promise<Session>\n  getOptionalSession(request: Request): Promise<Session | null>\n}\n\nexport function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session> {\n  const loginPath = opts.loginPath ?? '/login'\n\n  async function requireSession(request: Request, o: { apiResponse?: boolean } = {}): Promise<Session> {\n    const session = await opts.getSession(request)\n    if (!session) {\n      if (o.apiResponse) {\n        throw Response.json({ error: 'Unauthorized', code: 'auth.unauthenticated' }, { status: 401 })\n      }\n      throw new Response(null, { status: 302, headers: { Location: loginPath } })\n    }\n    return session\n  }\n\n  return {\n    requireSession,\n    requireUser: (request) => requireSession(request),\n    requireApiUser: (request) => requireSession(request, { apiResponse: true }),\n    getOptionalSession: async (request) => (await opts.getSession(request)) ?? null,\n  }\n}\n\n/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */\nexport function parseAdminEmails(raw: string | null | undefined): string[] {\n  return (raw ?? '')\n    .split(/[,\\s]+/)\n    .map((e) => e.trim().toLowerCase())\n    .filter(Boolean)\n}\n\nexport interface AdminGuardOptions<Session> {\n  requireUser(request: Request): Promise<Session>\n  emailOf(session: Session): string | null | undefined\n  /** Resolved per request; an EMPTY allowlist refuses everyone. */\n  allowedEmails(): string[]\n}\n\n/** Non-admins (and empty allowlists) get 404, keeping the route invisible —\n *  better than a \"forbidden\" footprint that advertises its existence. */\nexport function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session> {\n  return async (request) => {\n    const session = await opts.requireUser(request)\n    const allowed = opts.allowedEmails()\n    if (allowed.length === 0) throw new Response('Not found', { status: 404 })\n    const email = (opts.emailOf(session) ?? '').toLowerCase()\n    if (!allowed.includes(email)) throw new Response('Not found', { status: 404 })\n    return session\n  }\n}\n\nexport interface BillableBalanceState {\n  overageAllowed: boolean\n  remainingBalanceUsd: number\n}\n\nexport interface AssertBillableBalanceOptions {\n  env?: Record<string, string | undefined>\n  /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),\n   *  fed to `isTangleBillingEnforcementDisabled`. */\n  enforcementEnvVar?: string\n  /** Default 'Add balance or upgrade your plan to invoke this agent.'. */\n  errorMessage?: string\n  /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */\n  errorBody?: Record<string, unknown>\n}\n\n/**\n * Gate a billable turn: passes when enforcement is disabled (dev default),\n * the tier allows overage, or remaining balance is positive. Otherwise throws\n * a 402 Response with the stable `billing.balance_required` code so clients\n * can route to the billing screen.\n */\nexport function assertBillableBalance(state: BillableBalanceState, opts: AssertBillableBalanceOptions = {}): void {\n  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return\n  if (state.overageAllowed || state.remainingBalanceUsd > 0) return\n  // errorBody first: the stable error/code contract always wins over caller extras.\n  throw Response.json(\n    {\n      ...opts.errorBody,\n      error: opts.errorMessage ?? 'Add balance or upgrade your plan to invoke this agent.',\n      code: 'billing.balance_required',\n    },\n    { status: 402 },\n  )\n}\n"],"mappings":";;;;;;;;;;;AAWA,IAAM,4BAA4B;AAClC,IAAM,8BAA8B,KAAK,KAAK,KAAK;AACnD,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAa/B,SAAS,UAAU,OAAuB;AACxC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACxE;AAEA,eAAe,UAAU,QAAgB,OAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;AAC9F;AAEA,eAAe,QAAQ,QAAgB,OAAgC;AACrE,SAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AAIA,eAAsB,qBAAqB,QAAyC;AAClF,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,UAAU,GAAG,UAAU,EAAE,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;AACtD,SAAO,GAAG,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC;AAC5D;AAGA,eAAsB,qBAAqB,OAAe,QAA0C;AAClG,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,WAAW,GAAG,IAAI;AACjC,MAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAK,QAAO;AAC1C,QAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,GAAG,MAAM,IAAI,SAAS,EAAE;AACtE,MAAI,CAAC,kBAAkB,KAAK,QAAQ,EAAG,QAAO;AAC9C,QAAM,WAAW,SAAS,WAAW,EAAE;AACvC,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,QAAQ,OAAO,SAAS,4BAA4B;AAC1D,SAAO,IAAI,IAAI,YAAY;AAC7B;AAoBO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAU,8CAA8C;AAClE,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAyDA,eAAsB,uBAAuB,OAAe,QAAiC;AAC3F,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACjF,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK;AACzC,MAAI,MAAM;AACV,aAAW,QAAQ,IAAK,QAAO,OAAO,aAAa,IAAI;AACvD,SAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;AAC9B;AAoDO,SAAS,oCACd,MACA,UAAgD,CAAC,GACQ;AACzD,QAAM,OAAO,QAAQ,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACvE,SAAO,OAAO,EAAE,OAAO,WAAW,MAAM;AACtC,UAAM,MAAM,MAAM,KAAK;AACvB,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,EAAE,MAAM,WAAW,IAAI,IAAI,YAAY;AAC7C,QAAI,WAAW,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wFAAwF,WAAW,MAAM;AAAA,MAE3G;AAAA,IACF;AACA,QAAI,SAAS,0BAA0B,SAAS,YAAY,sBAAsB,IAAI;AACpF;AAAA,QACE,yCAAyC,IAAI;AAAA,MAI/C;AAAA,IACF;AACA,UAAM,WAAW,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjF,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,MAAM,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,MAC9D,UAAU,WAAW,aAAa;AAAA,MAClC,UAAW,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,MAAM,CAAC;AAAA,MAC9D,QAAQ,QAAQ,WAAW,MAAM,KAAK,KAAK,WAAW,WAAW;AAAA,MACjE,eAAe;AAAA,IACjB;AACA,UAAM,UAAU,CAAC,gBAAgB,MAAM,uBAAuB,OAAO,IAAI,MAAM,GAAG,aAAa,CAAC;AAChG,QAAI,SAAS,wBAAwB;AACnC,cAAQ,KAAK,kBAAkB,EAAE,GAAG,eAAe,MAAM,uBAAuB,CAAC,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AACF;AA8DA,SAAS,qBAAqB,OAAsB,UAA0B;AAC5E,MAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,SAAS,iBAAiB,UAAkB,UAAU,IAAI,QAAQ,GAAa;AAC7E,UAAQ,IAAI,YAAY,QAAQ;AAChC,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAIA,SAAS,SAAS,SAAiC;AACjD,SACE,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC5D;AAEJ;AAOA,SAAS,wBAAwB,KAA+C;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,UAAM,EAAE,GAAG,EAAE,IAAI;AACjB,QAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,WAAO,EAAE,GAAG,EAAE;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBAAwB,MAAkD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,qDAAqD;AAEhG,QAAM,oBAAoB,KAAK,qBAAqB;AAEpD,MAAI;AACJ,MAAI,KAAK,kBAAkB;AACzB,UAAM,OAAO,KAAK;AAClB,yBAAqB,OAAO,SAAS,MAAM,KAAK,IAAI;AAAA,EACtD,WAAW,KAAK,qBAAqB;AACnC,UAAM,SAAS,KAAK;AACpB,yBAAqB,OAAO,EAAE,OAAO,QAAQ,WAAW,MAAM;AAAA,MAC5D,gBAAgB,MAAM,uBAAuB,OAAO,MAAM,GAAG;AAAA,QAC3D,MAAM,SAAS,YAAY,iBAAiB,KAAK;AAAA,QACjD;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,sBAAsB,KAAK,uBAAuB;AACxD,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cAA8B,EAAE,QAAQ,KAAK,aAAa,OAAO,kBAAkB,KAAM,IAAI;AAEnG,QAAM,kBAAkB,EAAE,MAAM,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAEjF,WAAS,mBAAmB,MAAwB;AAClD,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,WAAO,iBAAiB,GAAG,SAAS,UAAU,IAAI,IAAI,OAAO;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,eAAe,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,mBAAmB;AAC/F,YAAM,QAAQ,MAAM,qBAAqB,WAAW;AACpD,YAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG;AAAA,QAC5E,GAAG;AAAA,QACH,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,MAAM;AACnC,aAAO,iBAAiB,KAAK,KAAK,aAAa,EAAE,OAAO,aAAa,KAAK,YAAY,CAAC,GAAG,OAAO;AAAA,IACnG;AAAA,IAEA,MAAM,SAAS,SAAS;AACtB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,oBAAoB,IAAI,aAAa,IAAI,OAAO;AACtD,UAAI,CAAC,QAAQ,CAAC,kBAAmB,QAAO,mBAAmB,yBAAyB;AAEpF,YAAM,UAAU,wBAAwB,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK,eAAe,CAAC;AAC5G,UAAI,CAAC,WAAW,QAAQ,MAAM,kBAAmB,QAAO,mBAAmB,uBAAuB;AAClG,UAAI,CAAE,MAAM,qBAAqB,QAAQ,GAAG,WAAW,EAAI,QAAO,mBAAmB,uBAAuB;AAE5G,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,KAAK,KAAK,SAAS,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,gCAAgC,GAAG;AACvC,eAAO,mBAAmB,wBAAwB;AAAA,MACpD;AAEA,UAAI;AACJ,UAAI;AACF;AAAC,SAAC,EAAE,OAAO,IAAI,MAAM,KAAK,MAAM,kBAAkB;AAAA,UAChD,OAAO,UAAU,KAAK;AAAA,UACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,UAC7B,cAAc,UAAU,KAAK;AAAA,QAC/B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,YAAI,eAAe,yBAA0B,QAAO,mBAAmB,2BAA2B;AAClG,cAAM;AAAA,MACR;AAEA,YAAM,YAAY,IAAI,KAAK,IAAI,IAAI,oBAAoB,GAAI;AAC3D,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAc;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,WAAW,SAAS,OAAO;AAAA,QAC3B,WAAW,QAAQ,QAAQ,IAAI,YAAY;AAAA,MAC7C,CAAC;AAED,YAAM,KAAK,MAAM,eAAe;AAAA,QAC9B;AAAA,QACA,cAAc;AAAA,QACd,cAAc,UAAU,KAAK;AAAA,QAC7B,OAAO,UAAU,KAAK;AAAA,QACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,QAC7B,QAAQ,UAAU;AAAA,QAClB,UAAU,UAAU,MAAM,QAAQ;AAAA,MACpC,CAAC;AAED,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,YAAM,iBAAiB,MAAM,mBAAmB;AAAA,QAC9C;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,UAAU,eAAgB,SAAQ,OAAO,cAAc,MAAM;AACxE,aAAO,iBAAiB,qBAAqB,QAAQ,GAAG,mBAAmB,GAAG,OAAO;AAAA,IACvF;AAAA,EACF;AACF;;;ACrbO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAqB,QAAgB;AACnC,UAAM,oCAAoC,MAAM,EAAE;AAD/B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AASA,eAAsB,2BACpB,MACkC;AAClC,QAAM,WAAW,MAAM,0BAA0B;AAAA,IAC/C,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,KAAK;AAAA,EACtB,CAAC;AACD,MAAI,SAAU,QAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,SAAS,OAAO;AAExE,QAAM,IAAI,yBAAyB,KAAK,MAAM;AAChD;AAEA,eAAsB,kCACpB,MACkC;AAClC,SAAO,2BAA2B;AAAA,IAChC,QAAQ,OAAO,KAAK,MAAM;AAAA,IAC1B,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,MAAM,KAAK,cAAc,KAAK,MAAM;AAAA,EACrD,CAAC;AACH;AAIO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAGO,SAAS,uBAAuB,OAAoE;AACzG,SACE,iBAAiB,SACjB,MAAM,SAAS,sBACf,OAAQ,MAA+B,WAAW;AAEtD;AAoDO,SAAS,qBAAqB,KAAsC;AAGzE,iBAAe,MAAM,SAAkB,MAAoE;AACzG,UAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,QAAI;AACF,YAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,aAAO,MAAM,KAAK,IAAI,gBAAgB,MAAM,CAAC;AAAA,IAC/C,SAAS,KAAK;AACZ,UAAI,2BAA2B,GAAG,GAAG;AACnC,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,uBAAuB,GAAG,GAAG;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAA,IAEvG,aAAa,CAAC,EAAE,QAAQ,MACtB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,aAAa,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;AAAA,IAE3F,kBAAkB,OAAO,EAAE,SAAS,OAAO,MAAM;AAC/C,UAAI,QAAQ,WAAW,UAAU;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,aAAO,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,MAAM,IAAI,iBAAiB,OAAO,YAAY,CAAC,CAAC;AAAA,IACrG;AAAA,IAEA,cAAc,CAAC,EAAE,QAAQ,MACvB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,cAAc,MAAM,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAAA,IAE7F,WAAW,OAAO,EAAE,QAAQ,MAAM;AAChC,UAAI,QAAQ,WAAW,QAAQ;AAC7B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,YAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,QAAQ,KAAK;AAAA,MAC7B,QAAQ;AACN,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,KAAK,cAAc,CAAC,KAAK,eAAe,CAAC,KAAK,WAAW;AAC5D,eAAO,SAAS,KAAK,EAAE,OAAO,sDAAsD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxG;AACA,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,cAAM,SAAS,MAAM,IAAI,gBAAgB,MAAM,EAAE,UAAU;AAAA,UACzD,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,WAAW,KAAK;AAAA,UAChB,iBAAiB,KAAK;AAAA,QACxB,CAAC;AACD,eAAO,SAAS,KAAK,EAAE,kBAAkB,OAAO,kBAAkB,OAAO,OAAO,MAAM,CAAC;AAAA,MACzF,SAAS,KAAK;AACZ,YAAI,2BAA2B,GAAG,GAAG;AACnC,iBAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzE;AACA,YAAI,uBAAuB,GAAG,GAAG;AAC/B,iBAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,QACrF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACvMO,SAAS,wBAAwB,MAAiD;AACvF,SAAO,SAAS,SAAS,SAAS,eAAe,OAAO;AAC1D;AAEO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YACW,QACT,QACA;AACA,UAAM,4BAA4B,MAAM,MAAM,MAAM,EAAE;AAH7C;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAGO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAiFO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC/C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,oDAAoD;AAC3F,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,YAAY,KAAK,aAAa;AAEpC,WAAS,sBAA8B;AACrC,UAAM,QAAQ,OAAO,KAAK,iBAAiB,aAAa,KAAK,aAAa,IAAI,KAAK;AACnF,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iDAAiD;AAC7E,WAAO;AAAA,EACT;AAEA,iBAAe,QAAW,MAAc,MAAmB,SAA8B;AACvF,UAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,MAC/C,GAAG;AAAA,MACH;AAAA,MACA,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,YAAM,IAAI,yBAAyB,IAAI,QAAQ,MAAM,OAAO,WAAW,IAAI,UAAU;AAAA,IACvF;AACA,WAAO,IAAI,KAAK;AAAA,EAClB;AAEA,WAAS,SAAY,YAAoB,MAA0B;AACjE,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,iBAAiB,UAAU,UAAU,EAAE;AACnD,WAAO,QAAW,MAAM,CAAC,GAAG,OAAO;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,MAAM,gBAAgB,YAAY;AAChC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,YAAM,MAAM,KAAK,MAAM,gBAAgB;AACvC,aAAO,EAAE,MAAM,wBAAwB,KAAK,IAAI,GAAG,QAAQ,KAAK,UAAU,KAAK;AAAA,IACjF;AAAA,IAEA,MAAM,WAAW,YAAY;AAC3B,YAAM,OAAO,MAAM,SAGhB,YAAY,qBAAqB;AACpC,aAAO;AAAA,QACL,SAAS,KAAK,MAAM,WAAW;AAAA,QAC/B,eAAe,KAAK,MAAM,iBAAiB;AAAA,QAC3C,WAAW,KAAK,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,kBAAkB,YAAY;AAClC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,cAAQ,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS;AAAA,QACrC,SAAS,IAAI,WAAW;AAAA,QACxB,YAAY,IAAI,cAAc;AAAA,QAC9B,OAAO,IAAI,SAAS;AAAA,MACtB,EAAE;AAAA,IACJ;AAAA,IAEA,MAAM,sBAAsB,YAAY,WAAW;AACjD,YAAM,OAAO,mBAAmB,SAAS;AACzC,YAAM,OAAO,MAAM,SAShB,YAAY,2CAA2C,IAAI,EAAE;AAChE,YAAM,OAAO,KAAK,QAAQ,CAAC;AAC3B,YAAM,UAAU,KAAK,YAAY;AACjC,aAAO;AAAA,QACL,YAAY,KAAK,cAAc;AAAA,QAC/B,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C;AAAA;AAAA,QAEA,YAAY,CAAC,WAAW,KAAK,eAAe;AAAA,MAC9C;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO;AAClB,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,IAAI,iBAAiB,UAAU,oBAAoB,CAAC,EAAE;AAC9D,cAAQ,IAAI,kBAAkB,KAAK,WAAW;AAC9C,cAAQ,IAAI,gBAAgB,kBAAkB;AAC9C,YAAM,QAAQ,sBAAsB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,MAAM,MAAM;AAAA,UACZ,SAAS,KAAK;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,QACrB,CAAC;AAAA,MACH,GAAG,OAAO;AAAA,IACZ;AAAA,IAEA,aAAa;AACX,aAAO,GAAG,OAAO;AAAA,IACnB;AAAA,IAEA,gBAAgB,WAAW;AACzB,aAAO,gBAAgB,SAAS,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;AAQO,SAAS,gBAAgB,SAAiB,WAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AACvC,SAAO,GAAG,IAAI,sCAAsC,mBAAmB,SAAS,CAAC;AACnF;AASO,IAAM,6BAAuE;AAAA,EAClF,MAAM,EAAE,aAAa,GAAG,gBAAgB,MAAM;AAAA,EAC9C,KAAK,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAAA,EACnE,YAAY,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAC5E;AAiBA,eAAsB,oBACpB,MACA,YACA,SAAmD,4BACzB;AAC1B,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,MACL,MAAM;AAAA,MACN,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,GAAG,OAAO;AAAA,IACZ;AAAA,EACF;AACA,QAAM,CAAC,cAAc,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChD,KAAK,gBAAgB,UAAU;AAAA,IAC/B,KAAK,WAAW,UAAU;AAAA,EAC5B,CAAC;AACD,SAAO;AAAA,IACL,MAAM,aAAa;AAAA,IACnB,oBAAoB,aAAa;AAAA,IACjC,qBAAqB,QAAQ;AAAA,IAC7B,kBAAkB,QAAQ;AAAA,IAC1B,GAAG,OAAO,aAAa,IAAI;AAAA,EAC7B;AACF;AAMO,IAAM,0BAA0B;AAOhC,IAAM,uCAAuC;AAc7C,SAAS,qBAAqB,OAA+B,CAAC,GAAY;AAC/E,QAAM,MACJ,KAAK,QACJ,OAAO,YAAY,cAAe,QAAQ,MAA6C;AAC1F,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAO,IAAI,KAAK,cAAc,oCAAoC,GAAG,KAAK,EAAE,YAAY;AAC9F,SAAO,SAAS,UAAU,SAAS,OAAO,SAAS,QAAQ,SAAS;AACtE;AAYA,eAAsB,sBACpB,MACA,YACA,WACA,OAAO,MACsB;AAC7B,MAAI,CAAC,QAAQ,CAAC,WAAY,QAAO,oBAAoB;AACrD,MAAI;AACF,WAAO,MAAM,KAAK,sBAAsB,YAAY,SAAS;AAAA,EAC/D,QAAQ;AAGN,WAAO,oBAAoB;AAAA,EAC7B;AACF;AAEA,SAAS,sBAA0C;AACjD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AACF;AAIO,SAAS,kBAAkB,KAAkC;AAClE,SAAO,IAAI,WAAW,IAAI;AAC5B;AAUO,SAAS,kCACd,MACA,UACuC;AACvC,SAAO;AAAA,IACL,iBAAiB,CAAC,WAAW,SAAS,gBAAgB,MAAM;AAAA,IAC5D,SAAS,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,GAAG;AAAA,IAChE,YAAY,OAAO,WAAW;AAC5B,YAAM,WAAW,MAAM,KAAK,WAAW,MAAM;AAC7C,aAAO,EAAE,SAAS,SAAS,SAAS,eAAe,SAAS,cAAc;AAAA,IAC5E;AAAA,IACA,mBAAmB,CAAC,WAAW,KAAK,kBAAkB,MAAM;AAAA,IAC5D,QAAQ,CAAC,UAAU,KAAK,OAAO,KAAK;AAAA,EACtC;AACF;;;ACrXO,SAAS,gBAAyB,MAAqD;AAC5F,QAAM,YAAY,KAAK,aAAa;AAEpC,iBAAe,eAAe,SAAkB,IAA+B,CAAC,GAAqB;AACnG,UAAM,UAAU,MAAM,KAAK,WAAW,OAAO;AAC7C,QAAI,CAAC,SAAS;AACZ,UAAI,EAAE,aAAa;AACjB,cAAM,SAAS,KAAK,EAAE,OAAO,gBAAgB,MAAM,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9F;AACA,YAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,UAAU,EAAE,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,CAAC,YAAY,eAAe,OAAO;AAAA,IAChD,gBAAgB,CAAC,YAAY,eAAe,SAAS,EAAE,aAAa,KAAK,CAAC;AAAA,IAC1E,oBAAoB,OAAO,YAAa,MAAM,KAAK,WAAW,OAAO,KAAM;AAAA,EAC7E;AACF;AAGO,SAAS,iBAAiB,KAA0C;AACzE,UAAQ,OAAO,IACZ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO;AACnB;AAWO,SAAS,iBAA0B,MAA0E;AAClH,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,YAAY,OAAO;AAC9C,UAAM,UAAU,KAAK,cAAc;AACnC,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACzE,UAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,IAAI,YAAY;AACxD,QAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC7E,WAAO;AAAA,EACT;AACF;AAwBO,SAAS,sBAAsB,OAA6B,OAAqC,CAAC,GAAS;AAChH,MAAI,mCAAmC,EAAE,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB,CAAC,EAAG;AACtG,MAAI,MAAM,kBAAkB,MAAM,sBAAsB,EAAG;AAE3D,QAAM,SAAS;AAAA,IACb;AAAA,MACE,GAAG,KAAK;AAAA,MACR,OAAO,KAAK,gBAAgB;AAAA,MAC5B,MAAM;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;","names":[]}
+{"version":3,"sources":["../../src/platform/hub.ts","../../src/platform/billing.ts"],"sourcesContent":["/**\n * Integrations-hub proxy routes: the app-side surface that forwards an\n * authenticated user's requests to the platform's `/v1/integrations/*` API\n * using their stored platform key. Auth, key lookup, and the wire client are\n * structural seams (`HubProxyContext`); error detection is by name + shape so\n * it survives bundlers duplicating module instances.\n */\n\nimport {\n  resolveTangleDevOrUserKey,\n  type TangleExecutionEnvironment,\n  type TangleExecutionKeySource,\n} from '../runtime/model'\n\n/** Hub bearer provenance mirrors the execution-key source union. */\nexport type TangleHubBearerSource = TangleExecutionKeySource\n\nexport interface ResolvedTangleHubBearer {\n  bearer: string\n  source: TangleHubBearerSource\n}\n\nexport interface ResolveUserTangleHubBearerOptions {\n  userId: string\n  /** Deployment context. Only local development may use env credentials. */\n  environment?: TangleExecutionEnvironment\n  /** Env to read for the local-development bearer. */\n  env?: Record<string, string | undefined>\n  /** App-owned lookup for the caller's linked platform API key. */\n  getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>\n}\n\nexport interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {\n  userId: UserId\n  environment?: TangleExecutionEnvironment\n  env?: Record<string, string | undefined>\n  getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>\n}\n\nexport class TangleBearerMissingError extends Error {\n  constructor(readonly userId: string) {\n    super(`No Tangle platform link for user ${userId}`)\n    this.name = 'TangleBearerMissingError'\n  }\n}\n\n/**\n * Resolve the Tangle bearer used by the integration hub proxy.\n *\n * Local development may use a server env key so apps can exercise the hub\n * without completing cross-site SSO. Deployed contexts must use the caller's\n * linked platform key; this keeps integration ownership aligned with the user.\n */\nexport async function resolveUserTangleHubBearer(\n  opts: ResolveUserTangleHubBearerOptions,\n): Promise<ResolvedTangleHubBearer> {\n  const resolved = await resolveTangleDevOrUserKey({\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: opts.getUserApiKey,\n  })\n  if (resolved) return { bearer: resolved.apiKey, source: resolved.source }\n\n  throw new TangleBearerMissingError(opts.userId)\n}\n\nexport async function resolveUserTangleHubBearerForUser<UserId = string>(\n  opts: ResolveUserTangleHubBearerForUserOptions<UserId>,\n): Promise<ResolvedTangleHubBearer> {\n  return resolveUserTangleHubBearer({\n    userId: String(opts.userId),\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: () => opts.getUserApiKey(opts.userId),\n  })\n}\n\n/** Structural guard (name + userId shape) — robust when the error class is\n *  constructed in a different module instance than the one checking it. */\nexport function isTangleBearerMissingError(error: unknown): error is TangleBearerMissingError {\n  return (\n    error instanceof Error &&\n    error.name === 'TangleBearerMissingError' &&\n    typeof (error as { userId?: unknown }).userId === 'string'\n  )\n}\n\n/** Structural detection of the platform hub wire error (name + numeric status). */\nexport function isPlatformHubErrorLike(error: unknown): error is Error & { status: number; code?: string } {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformHubError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\n/** Structural subset of the platform hub wire client — extra methods are fine. */\nexport interface HubClientLike {\n  catalog(): Promise<unknown>\n  listConnections(): Promise<unknown>\n  revokeConnection(connectionId: string): Promise<unknown>\n  startAuth(input: {\n    providerId: string\n    connectorId: string\n    returnUrl: string\n    requestedScopes?: string[]\n  }): Promise<{ authorizationUrl: string; state: string }>\n  listHealthchecks(): Promise<unknown>\n}\n\nexport interface HubProxyContext {\n  /** Resolve the authenticated user id. Throw the app's own auth Response /\n   *  redirect to reject — it propagates untouched. */\n  requireUserId(request: Request): Promise<string>\n  /** The user's platform bearer; throw `TangleBearerMissingError` when unlinked. */\n  getBearer(userId: string): Promise<string>\n  /** A hub client bound to the bearer. */\n  createHubClient(bearer: string): HubClientLike\n}\n\nexport interface HubProxyRouteArgs {\n  request: Request\n  params?: Record<string, string | undefined>\n}\n\nexport interface HubProxyRoutes {\n  /** GET → `{ catalog }`. */\n  catalog(args: HubProxyRouteArgs): Promise<Response>\n  /** GET → `{ connections }`. */\n  connections(args: HubProxyRouteArgs): Promise<Response>\n  /** DELETE → the platform revocation result verbatim; 405 otherwise. */\n  connectionDelete(args: { request: Request; params: { connectionId: string } }): Promise<Response>\n  /** GET → `{ healthchecks }`. */\n  healthchecks(args: HubProxyRouteArgs): Promise<Response>\n  /** POST `{ providerId, connectorId, returnUrl, requestedScopes? }` →\n   *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */\n  authStart(args: HubProxyRouteArgs): Promise<Response>\n}\n\ninterface StartAuthBody {\n  providerId?: string\n  connectorId?: string\n  returnUrl?: string\n  requestedScopes?: string[]\n}\n\nexport function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes {\n  /** Auth runs OUTSIDE the proxy try/catch so the app's auth throw (redirect\n   *  Response etc.) is never swallowed; bearer + platform errors are mapped. */\n  async function proxy(request: Request, call: (hub: HubClientLike) => Promise<Response>): Promise<Response> {\n    const userId = await ctx.requireUserId(request)\n    try {\n      const bearer = await ctx.getBearer(userId)\n      return await call(ctx.createHubClient(bearer))\n    } catch (err) {\n      if (isTangleBearerMissingError(err)) {\n        return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n      }\n      if (isPlatformHubErrorLike(err)) {\n        return Response.json({ error: err.message, code: err.code }, { status: err.status })\n      }\n      throw err\n    }\n  }\n\n  return {\n    catalog: ({ request }) => proxy(request, async (hub) => Response.json({ catalog: await hub.catalog() })),\n\n    connections: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ connections: await hub.listConnections() })),\n\n    connectionDelete: async ({ request, params }) => {\n      if (request.method !== 'DELETE') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      return proxy(request, async (hub) => Response.json(await hub.revokeConnection(params.connectionId)))\n    },\n\n    healthchecks: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ healthchecks: await hub.listHealthchecks() })),\n\n    authStart: async ({ request }) => {\n      if (request.method !== 'POST') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      const userId = await ctx.requireUserId(request)\n      let body: StartAuthBody\n      try {\n        body = (await request.json()) as StartAuthBody\n      } catch {\n        return Response.json({ error: 'Invalid JSON body' }, { status: 400 })\n      }\n      if (!body.providerId || !body.connectorId || !body.returnUrl) {\n        return Response.json({ error: 'providerId, connectorId, and returnUrl are required' }, { status: 400 })\n      }\n      try {\n        const bearer = await ctx.getBearer(userId)\n        const result = await ctx.createHubClient(bearer).startAuth({\n          providerId: body.providerId,\n          connectorId: body.connectorId,\n          returnUrl: body.returnUrl,\n          requestedScopes: body.requestedScopes,\n        })\n        return Response.json({ authorizationUrl: result.authorizationUrl, state: result.state })\n      } catch (err) {\n        if (isTangleBearerMissingError(err)) {\n          return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n        }\n        if (isPlatformHubErrorLike(err)) {\n          return Response.json({ error: err.message, code: err.code }, { status: err.status })\n        }\n        throw err\n      }\n    },\n  }\n}\n","/**\n * Platform billing HTTP transport + tier state for apps on the shared\n * Tangle balance model (id.tangle.tools). Reads authenticate as the user via\n * their per-user platform key (the platform resolves the caller from the\n * key; service or impersonation headers on read routes are rejected). The\n * deduct write authenticates as the product service (`Bearer <serviceToken>`\n * + `X-Service-Name`) and names the target user in the body. Also provides a\n * fetch-backed implementation of the `/billing` module's\n * `PlatformBillingClient` seam (type-only import — no runtime coupling).\n */\n\nimport type { PlatformBillingClient, PlatformIdentity } from '../billing/index'\n\nexport type TanglePlanTier = 'free' | 'pro' | 'enterprise'\n\n/** 'pro' | 'enterprise' pass through; anything else (null, unknown) → 'free'. */\nexport function normalizeTanglePlanTier(plan: string | null | undefined): TanglePlanTier {\n  return plan === 'pro' || plan === 'enterprise' ? plan : 'free'\n}\n\nexport class PlatformBillingHttpError extends Error {\n  constructor(\n    readonly status: number,\n    detail: string,\n  ) {\n    super(`Platform request failed (${status}): ${detail}`)\n    this.name = 'PlatformBillingHttpError'\n  }\n}\n\n/** Structural guard (name + numeric status) — robust across module instances. */\nexport function isPlatformBillingHttpError(error: unknown): error is PlatformBillingHttpError {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformBillingHttpError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\nexport interface PlatformBillingHttpOptions {\n  /** Platform root, e.g. https://id.tangle.tools (trailing slashes stripped). */\n  baseUrl: string\n  /** Used only by `deduct()`; resolved lazily so reads never require it.\n   *  Throws at call time when empty. */\n  serviceToken: string | (() => string)\n  /** Product slug — the `X-Service-Name` header and the deduct `product` field. */\n  productSlug: string\n  fetchImpl?: typeof fetch\n  /** Default 10 000. */\n  timeoutMs?: number\n}\n\nexport interface PlatformSubscriptionInfo {\n  tier: TanglePlanTier\n  status: string | null\n}\n\nexport interface PlatformBalanceSnapshot {\n  balance: number\n  lifetimeSpent: number\n  updatedAt?: string\n}\n\nexport interface PlatformUsageProductRow {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Lifecycle of a per-product seat subscription, mirroring the Stripe states\n *  the platform persists. 'none' = the user has never held this seat. */\nexport type SeatStatus = 'none' | 'active' | 'trialing' | 'past_due' | 'canceled'\n\n/**\n * Per-product entitlement snapshot from the platform — the single read that\n * tells a product whether to show its workspace or the seat paywall. Shape\n * matches `GET /v1/billing/product-entitlement?product=<id>`.\n *\n * `hasSeat` and `onFreeTier` are computed platform-side from the raw seat row\n * + cumulative spend so the gate is identical across all five products:\n * - `hasSeat`     — an active/trialing seat whose period has not lapsed.\n * - `onFreeTier`  — no active seat AND cumulative spend below the free cap\n *                   ($2 / 200¢ lifetime). Keys off lifetime spend, not wallet\n *                   balance, so a router top-up never re-opens free access.\n */\nexport interface ProductEntitlement {\n  seatStatus: SeatStatus\n  /** ISO timestamp the active seat's paid period runs until; null when none. */\n  currentPeriodEnd: string | null\n  /** Cumulative inference spend across the whole suite, in dollars. */\n  lifetimeSpentUsd: number\n  hasSeat: boolean\n  onFreeTier: boolean\n}\n\nexport interface PlatformBillingHttp {\n  /** GET /v1/plans/current (user bearer). */\n  getSubscription(userApiKey: string): Promise<PlatformSubscriptionInfo>\n  /** GET /v1/billing/balance (user bearer). */\n  getBalance(userApiKey: string): Promise<PlatformBalanceSnapshot>\n  /** GET /v1/billing/usage (user bearer). */\n  getUsageByProduct(userApiKey: string): Promise<PlatformUsageProductRow[]>\n  /** GET /v1/billing/product-entitlement?product=<id> (user bearer). */\n  getProductEntitlement(userApiKey: string, productId: string): Promise<ProductEntitlement>\n  /** POST /v1/billing/deduct (service token). */\n  deduct(input: {\n    platformUserId: string\n    amountUsd: number\n    type: string\n    description: string\n    referenceId: string\n  }): Promise<void>\n  /** Absolute URL of the platform's billing-management surface. */\n  billingUrl(): string\n  /** Absolute URL of the $100/mo seat checkout for `productId`. */\n  seatCheckoutUrl(productId: string): string\n}\n\nexport function createPlatformBillingHttp(opts: PlatformBillingHttpOptions): PlatformBillingHttp {\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, '')\n  if (!baseUrl) throw new Error('PlatformBillingHttpOptions.baseUrl is required')\n  if (!opts.productSlug) throw new Error('PlatformBillingHttpOptions.productSlug is required')\n  const fetchImpl = opts.fetchImpl ?? fetch\n  const timeoutMs = opts.timeoutMs ?? 10_000\n\n  function resolveServiceToken(): string {\n    const token = typeof opts.serviceToken === 'function' ? opts.serviceToken() : opts.serviceToken\n    if (!token) throw new Error('A platform service token is required for deduct')\n    return token\n  }\n\n  async function request<T>(path: string, init: RequestInit, headers: Headers): Promise<T> {\n    const res = await fetchImpl(`${baseUrl}${path}`, {\n      ...init,\n      headers,\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n    if (!res.ok) {\n      const body = (await res.json().catch(() => null)) as { error?: { message?: string } } | null\n      throw new PlatformBillingHttpError(res.status, body?.error?.message ?? res.statusText)\n    }\n    return res.json() as Promise<T>\n  }\n\n  function userRead<T>(userApiKey: string, path: string): Promise<T> {\n    const headers = new Headers()\n    headers.set('Authorization', `Bearer ${userApiKey}`)\n    return request<T>(path, {}, headers)\n  }\n\n  return {\n    async getSubscription(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { subscription?: { plan?: string | null; status?: string | null } | null }\n      }>(userApiKey, '/v1/plans/current')\n      const sub = body.data?.subscription ?? null\n      return { tier: normalizeTanglePlanTier(sub?.plan), status: sub?.status ?? null }\n    },\n\n    async getBalance(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { balance?: number; lifetimeSpent?: number; updatedAt?: string }\n      }>(userApiKey, '/v1/billing/balance')\n      return {\n        balance: body.data?.balance ?? 0,\n        lifetimeSpent: body.data?.lifetimeSpent ?? 0,\n        updatedAt: body.data?.updatedAt,\n      }\n    },\n\n    async getUsageByProduct(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: Array<{ product?: string | null; totalSpent?: number; count?: number }>\n      }>(userApiKey, '/v1/billing/usage')\n      return (body.data ?? []).map((row) => ({\n        product: row.product ?? null,\n        totalSpent: row.totalSpent ?? 0,\n        count: row.count ?? 0,\n      }))\n    },\n\n    async getProductEntitlement(userApiKey, productId) {\n      const slug = encodeURIComponent(productId)\n      const body = await userRead<{\n        success: boolean\n        data?: {\n          seatStatus?: SeatStatus | null\n          currentPeriodEnd?: string | null\n          lifetimeSpentUsd?: number | null\n          hasSeat?: boolean | null\n          onFreeTier?: boolean | null\n        }\n      }>(userApiKey, `/v1/billing/product-entitlement?product=${slug}`)\n      const data = body.data ?? {}\n      const hasSeat = data.hasSeat === true\n      return {\n        seatStatus: data.seatStatus ?? 'none',\n        currentPeriodEnd: data.currentPeriodEnd ?? null,\n        lifetimeSpentUsd: data.lifetimeSpentUsd ?? 0,\n        hasSeat,\n        // Free access only when there is no seat AND the platform says so.\n        onFreeTier: !hasSeat && data.onFreeTier === true,\n      }\n    },\n\n    async deduct(input) {\n      const headers = new Headers()\n      headers.set('Authorization', `Bearer ${resolveServiceToken()}`)\n      headers.set('X-Service-Name', opts.productSlug)\n      headers.set('Content-Type', 'application/json')\n      await request('/v1/billing/deduct', {\n        method: 'POST',\n        body: JSON.stringify({\n          userId: input.platformUserId,\n          amount: input.amountUsd,\n          type: input.type,\n          product: opts.productSlug,\n          description: input.description,\n          referenceId: input.referenceId,\n        }),\n      }, headers)\n    },\n\n    billingUrl() {\n      return `${baseUrl}/app/billing`\n    },\n\n    seatCheckoutUrl(productId) {\n      return seatCheckoutUrl(baseUrl, productId)\n    },\n  }\n}\n\n/**\n * Platform Stripe checkout URL for a product's $100/mo seat. One shared price\n * carries `metadata.productId`; the platform distinguishes the product from\n * the `product` query param (not five distinct prices). Mirrors the\n * `billingUrl()` shape — a deterministic platform-rooted URL, no network call.\n */\nexport function seatCheckoutUrl(baseUrl: string, productId: string): string {\n  const root = baseUrl.replace(/\\/+$/, '')\n  return `${root}/app/billing/seat/checkout?product=${encodeURIComponent(productId)}`\n}\n\n// ── Tier policy + composed state ────────────────────────────────────────────\n\nexport interface TangleTierPolicy {\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport const DEFAULT_TANGLE_TIER_POLICY: Record<TanglePlanTier, TangleTierPolicy> = {\n  free: { concurrency: 1, overageAllowed: false },\n  pro: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n  enterprise: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n}\n\nexport interface TangleTierState {\n  tier: TanglePlanTier\n  subscriptionStatus: string | null\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * Read subscription + balance and project them onto the tier policy. A\n * null/absent key fails CLOSED (free tier, zero balance) — a billable run is\n * never started against an unknown balance. Platform errors throw; callers\n * on the billable path choose their posture explicitly.\n */\nexport async function readTangleTierState(\n  http: PlatformBillingHttp,\n  userApiKey: string | null | undefined,\n  policy: Record<TanglePlanTier, TangleTierPolicy> = DEFAULT_TANGLE_TIER_POLICY,\n): Promise<TangleTierState> {\n  if (!userApiKey) {\n    return {\n      tier: 'free',\n      subscriptionStatus: null,\n      remainingBalanceUsd: 0,\n      lifetimeSpentUsd: 0,\n      ...policy.free,\n    }\n  }\n  const [subscription, balance] = await Promise.all([\n    http.getSubscription(userApiKey),\n    http.getBalance(userApiKey),\n  ])\n  return {\n    tier: subscription.tier,\n    subscriptionStatus: subscription.status,\n    remainingBalanceUsd: balance.balance,\n    lifetimeSpentUsd: balance.lifetimeSpent,\n    ...policy[subscription.tier],\n  }\n}\n\n// ── Per-product seat entitlement ────────────────────────────────────────────\n\n/** Lifetime free-tier cap: $2 (200¢) cumulative inference spend, expressed in\n *  dollars. Free product access ends once cumulative spend crosses this. */\nexport const FREE_TIER_SPEND_CAP_USD = 2\n\n/**\n * Default name of the per-app feature flag gating seat billing. While OFF the\n * entitlement read is skipped and access fails OPEN (entitled) so nothing\n * changes live until a product flips the flag.\n */\nexport const DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR = 'SEAT_BILLING_ENABLED'\n\nexport interface SeatBillingFlagOptions {\n  env?: Record<string, string | undefined>\n  /** Override the flag name; default {@link DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR}. */\n  flagEnvVar?: string\n}\n\n/**\n * Seat billing is OFF unless the flag is explicitly truthy ('true'/'1'/'on'/\n * 'enabled'). Default OFF — pre-rollout, the paywall never engages. Returns\n * false when no env is available (browser bundles) so the client stays\n * fail-open there too.\n */\nexport function isSeatBillingEnabled(opts: SeatBillingFlagOptions = {}): boolean {\n  const env =\n    opts.env ??\n    (typeof process !== 'undefined' ? (process.env as Record<string, string | undefined>) : undefined)\n  if (!env) return false\n  const flag = env[opts.flagEnvVar ?? DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR]?.trim().toLowerCase()\n  return flag === 'true' || flag === '1' || flag === 'on' || flag === 'enabled'\n}\n\n/**\n * Read a user's entitlement for one product. Fails OPEN: an absent key,\n * disabled flag, or unreachable seat endpoint all return a permissive snapshot\n * (`hasSeat: true`) so consumers never break pre-rollout. The platform owns the\n * `hasSeat`/`onFreeTier` computation; this client only transports + degrades\n * safely.\n *\n * @param flag — pass {@link isSeatBillingEnabled} (or your own boolean) so the\n *   product owns when the gate engages. When false, no network call is made.\n */\nexport async function getProductEntitlement(\n  http: Pick<PlatformBillingHttp, 'getProductEntitlement'>,\n  userApiKey: string | null | undefined,\n  productId: string,\n  flag = true,\n): Promise<ProductEntitlement> {\n  if (!flag || !userApiKey) return failOpenEntitlement()\n  try {\n    return await http.getProductEntitlement(userApiKey, productId)\n  } catch {\n    // Seat endpoint unavailable (pre-rollout platform, transient 5xx): never\n    // wall a paying or grandfathered user on a transport hiccup.\n    return failOpenEntitlement()\n  }\n}\n\nfunction failOpenEntitlement(): ProductEntitlement {\n  return {\n    seatStatus: 'active',\n    currentPeriodEnd: null,\n    lifetimeSpentUsd: 0,\n    hasSeat: true,\n    onFreeTier: false,\n  }\n}\n\n/** Entitled = holds an active seat OR is still inside the free tier. The one\n *  predicate all five products gate on. */\nexport function isProductEntitled(ent: ProductEntitlement): boolean {\n  return ent.hasSeat || ent.onFreeTier\n}\n\n// ── Bridge onto the /billing seam ───────────────────────────────────────────\n\nexport interface PlatformIdentityStore {\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n}\n\n/** Concrete fetch-backed `PlatformBillingClient<TanglePlanTier>` for\n *  `createPlatformBalanceManager` (from `/billing`). */\nexport function createTanglePlatformBillingClient(\n  http: PlatformBillingHttp,\n  identity: PlatformIdentityStore,\n): PlatformBillingClient<TanglePlanTier> {\n  return {\n    resolveIdentity: (userId) => identity.resolveIdentity(userId),\n    getPlan: async (apiKey) => (await http.getSubscription(apiKey)).tier,\n    getBalance: async (apiKey) => {\n      const snapshot = await http.getBalance(apiKey)\n      return { balance: snapshot.balance, lifetimeSpent: snapshot.lifetimeSpent }\n    },\n    getUsageByProduct: (apiKey) => http.getUsageByProduct(apiKey),\n    deduct: (input) => http.deduct(input),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuCO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAqB,QAAgB;AACnC,UAAM,oCAAoC,MAAM,EAAE;AAD/B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AASA,eAAsB,2BACpB,MACkC;AAClC,QAAM,WAAW,MAAM,0BAA0B;AAAA,IAC/C,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,KAAK;AAAA,EACtB,CAAC;AACD,MAAI,SAAU,QAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,SAAS,OAAO;AAExE,QAAM,IAAI,yBAAyB,KAAK,MAAM;AAChD;AAEA,eAAsB,kCACpB,MACkC;AAClC,SAAO,2BAA2B;AAAA,IAChC,QAAQ,OAAO,KAAK,MAAM;AAAA,IAC1B,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,MAAM,KAAK,cAAc,KAAK,MAAM;AAAA,EACrD,CAAC;AACH;AAIO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAGO,SAAS,uBAAuB,OAAoE;AACzG,SACE,iBAAiB,SACjB,MAAM,SAAS,sBACf,OAAQ,MAA+B,WAAW;AAEtD;AAoDO,SAAS,qBAAqB,KAAsC;AAGzE,iBAAe,MAAM,SAAkB,MAAoE;AACzG,UAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,QAAI;AACF,YAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,aAAO,MAAM,KAAK,IAAI,gBAAgB,MAAM,CAAC;AAAA,IAC/C,SAAS,KAAK;AACZ,UAAI,2BAA2B,GAAG,GAAG;AACnC,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,uBAAuB,GAAG,GAAG;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAA,IAEvG,aAAa,CAAC,EAAE,QAAQ,MACtB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,aAAa,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;AAAA,IAE3F,kBAAkB,OAAO,EAAE,SAAS,OAAO,MAAM;AAC/C,UAAI,QAAQ,WAAW,UAAU;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,aAAO,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,MAAM,IAAI,iBAAiB,OAAO,YAAY,CAAC,CAAC;AAAA,IACrG;AAAA,IAEA,cAAc,CAAC,EAAE,QAAQ,MACvB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,cAAc,MAAM,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAAA,IAE7F,WAAW,OAAO,EAAE,QAAQ,MAAM;AAChC,UAAI,QAAQ,WAAW,QAAQ;AAC7B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,YAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,QAAQ,KAAK;AAAA,MAC7B,QAAQ;AACN,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,KAAK,cAAc,CAAC,KAAK,eAAe,CAAC,KAAK,WAAW;AAC5D,eAAO,SAAS,KAAK,EAAE,OAAO,sDAAsD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxG;AACA,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,cAAM,SAAS,MAAM,IAAI,gBAAgB,MAAM,EAAE,UAAU;AAAA,UACzD,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,WAAW,KAAK;AAAA,UAChB,iBAAiB,KAAK;AAAA,QACxB,CAAC;AACD,eAAO,SAAS,KAAK,EAAE,kBAAkB,OAAO,kBAAkB,OAAO,OAAO,MAAM,CAAC;AAAA,MACzF,SAAS,KAAK;AACZ,YAAI,2BAA2B,GAAG,GAAG;AACnC,iBAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzE;AACA,YAAI,uBAAuB,GAAG,GAAG;AAC/B,iBAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,QACrF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACvMO,SAAS,wBAAwB,MAAiD;AACvF,SAAO,SAAS,SAAS,SAAS,eAAe,OAAO;AAC1D;AAEO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YACW,QACT,QACA;AACA,UAAM,4BAA4B,MAAM,MAAM,MAAM,EAAE;AAH7C;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAGO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAiFO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC/C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,oDAAoD;AAC3F,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,YAAY,KAAK,aAAa;AAEpC,WAAS,sBAA8B;AACrC,UAAM,QAAQ,OAAO,KAAK,iBAAiB,aAAa,KAAK,aAAa,IAAI,KAAK;AACnF,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iDAAiD;AAC7E,WAAO;AAAA,EACT;AAEA,iBAAe,QAAW,MAAc,MAAmB,SAA8B;AACvF,UAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,MAC/C,GAAG;AAAA,MACH;AAAA,MACA,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,YAAM,IAAI,yBAAyB,IAAI,QAAQ,MAAM,OAAO,WAAW,IAAI,UAAU;AAAA,IACvF;AACA,WAAO,IAAI,KAAK;AAAA,EAClB;AAEA,WAAS,SAAY,YAAoB,MAA0B;AACjE,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,iBAAiB,UAAU,UAAU,EAAE;AACnD,WAAO,QAAW,MAAM,CAAC,GAAG,OAAO;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,MAAM,gBAAgB,YAAY;AAChC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,YAAM,MAAM,KAAK,MAAM,gBAAgB;AACvC,aAAO,EAAE,MAAM,wBAAwB,KAAK,IAAI,GAAG,QAAQ,KAAK,UAAU,KAAK;AAAA,IACjF;AAAA,IAEA,MAAM,WAAW,YAAY;AAC3B,YAAM,OAAO,MAAM,SAGhB,YAAY,qBAAqB;AACpC,aAAO;AAAA,QACL,SAAS,KAAK,MAAM,WAAW;AAAA,QAC/B,eAAe,KAAK,MAAM,iBAAiB;AAAA,QAC3C,WAAW,KAAK,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,kBAAkB,YAAY;AAClC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,cAAQ,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS;AAAA,QACrC,SAAS,IAAI,WAAW;AAAA,QACxB,YAAY,IAAI,cAAc;AAAA,QAC9B,OAAO,IAAI,SAAS;AAAA,MACtB,EAAE;AAAA,IACJ;AAAA,IAEA,MAAM,sBAAsB,YAAY,WAAW;AACjD,YAAM,OAAO,mBAAmB,SAAS;AACzC,YAAM,OAAO,MAAM,SAShB,YAAY,2CAA2C,IAAI,EAAE;AAChE,YAAM,OAAO,KAAK,QAAQ,CAAC;AAC3B,YAAM,UAAU,KAAK,YAAY;AACjC,aAAO;AAAA,QACL,YAAY,KAAK,cAAc;AAAA,QAC/B,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C;AAAA;AAAA,QAEA,YAAY,CAAC,WAAW,KAAK,eAAe;AAAA,MAC9C;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO;AAClB,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,IAAI,iBAAiB,UAAU,oBAAoB,CAAC,EAAE;AAC9D,cAAQ,IAAI,kBAAkB,KAAK,WAAW;AAC9C,cAAQ,IAAI,gBAAgB,kBAAkB;AAC9C,YAAM,QAAQ,sBAAsB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,MAAM,MAAM;AAAA,UACZ,SAAS,KAAK;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,QACrB,CAAC;AAAA,MACH,GAAG,OAAO;AAAA,IACZ;AAAA,IAEA,aAAa;AACX,aAAO,GAAG,OAAO;AAAA,IACnB;AAAA,IAEA,gBAAgB,WAAW;AACzB,aAAO,gBAAgB,SAAS,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;AAQO,SAAS,gBAAgB,SAAiB,WAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AACvC,SAAO,GAAG,IAAI,sCAAsC,mBAAmB,SAAS,CAAC;AACnF;AASO,IAAM,6BAAuE;AAAA,EAClF,MAAM,EAAE,aAAa,GAAG,gBAAgB,MAAM;AAAA,EAC9C,KAAK,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAAA,EACnE,YAAY,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAC5E;AAiBA,eAAsB,oBACpB,MACA,YACA,SAAmD,4BACzB;AAC1B,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,MACL,MAAM;AAAA,MACN,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,GAAG,OAAO;AAAA,IACZ;AAAA,EACF;AACA,QAAM,CAAC,cAAc,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChD,KAAK,gBAAgB,UAAU;AAAA,IAC/B,KAAK,WAAW,UAAU;AAAA,EAC5B,CAAC;AACD,SAAO;AAAA,IACL,MAAM,aAAa;AAAA,IACnB,oBAAoB,aAAa;AAAA,IACjC,qBAAqB,QAAQ;AAAA,IAC7B,kBAAkB,QAAQ;AAAA,IAC1B,GAAG,OAAO,aAAa,IAAI;AAAA,EAC7B;AACF;AAMO,IAAM,0BAA0B;AAOhC,IAAM,uCAAuC;AAc7C,SAAS,qBAAqB,OAA+B,CAAC,GAAY;AAC/E,QAAM,MACJ,KAAK,QACJ,OAAO,YAAY,cAAe,QAAQ,MAA6C;AAC1F,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAO,IAAI,KAAK,cAAc,oCAAoC,GAAG,KAAK,EAAE,YAAY;AAC9F,SAAO,SAAS,UAAU,SAAS,OAAO,SAAS,QAAQ,SAAS;AACtE;AAYA,eAAsB,sBACpB,MACA,YACA,WACA,OAAO,MACsB;AAC7B,MAAI,CAAC,QAAQ,CAAC,WAAY,QAAO,oBAAoB;AACrD,MAAI;AACF,WAAO,MAAM,KAAK,sBAAsB,YAAY,SAAS;AAAA,EAC/D,QAAQ;AAGN,WAAO,oBAAoB;AAAA,EAC7B;AACF;AAEA,SAAS,sBAA0C;AACjD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AACF;AAIO,SAAS,kBAAkB,KAAkC;AAClE,SAAO,IAAI,WAAW,IAAI;AAC5B;AAUO,SAAS,kCACd,MACA,UACuC;AACvC,SAAO;AAAA,IACL,iBAAiB,CAAC,WAAW,SAAS,gBAAgB,MAAM;AAAA,IAC5D,SAAS,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,GAAG;AAAA,IAChE,YAAY,OAAO,WAAW;AAC5B,YAAM,WAAW,MAAM,KAAK,WAAW,MAAM;AAC7C,aAAO,EAAE,SAAS,SAAS,SAAS,eAAe,SAAS,cAAc;AAAA,IAC5E;AAAA,IACA,mBAAmB,CAAC,WAAW,KAAK,kBAAkB,MAAM;AAAA,IAC5D,QAAQ,CAAC,UAAU,KAAK,OAAO,KAAK;AAAA,EACtC;AACF;","names":[]}

package/dist/preset-cloudflare/index.d.ts

@@ -63,15 +63,6 @@ declare const PRESET_TABLES: {
             readonly createdAt: "created_at";
         };
     };
-    readonly threads: {
-        readonly name: "threads";
-        readonly columns: {
-            readonly id: "id";
-            readonly workspaceId: "workspace_id";
-            readonly title: "title";
-            readonly createdAt: "created_at";
-        };
-    };
     readonly knowledge: {
         readonly name: "knowledge";
         readonly columns: {
@@ -148,7 +139,6 @@ interface DrizzleSqliteCoreLike {
  * ```
  */
 declare function createPresetDrizzleSchema(d: DrizzleSqliteCoreLike): {
-    threads: unknown;
     proposals: unknown;
     knowledge: unknown;
     deadlines: unknown;

package/dist/preset-cloudflare/index.js

@@ -7,7 +7,7 @@ import {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore
-} from "../chunk-SAOAAA3S.js";
+} from "../chunk-UHXQ3KNX.js";
 import "../chunk-G3HCU7TA.js";
 import "../chunk-TA5Q4I2K.js";
 export {

package/dist/profile/index.d.ts

@@ -89,6 +89,33 @@ interface ProfileOverlay {
     /** Profile `name` override. When unset, the base name is kept. */
     name?: string;
 }
+/** Byte budget on the FINAL composed `prompt.systemPrompt`. Past this the
+ *  model degrades sharply (a 122,659-byte prompt shipped once and the model
+ *  returned empty answers), so the default gate throws well before that. */
+declare const DEFAULT_MAX_SYSTEM_PROMPT_BYTES = 40000;
+/** Budget config for the composed system prompt. */
+interface ComposeProfileBudget {
+    /** Byte cap on the composed `prompt.systemPrompt`.
+     *  Default {@link DEFAULT_MAX_SYSTEM_PROMPT_BYTES}. */
+    maxSystemPromptBytes?: number;
+    /** Downgrade the over-budget throw to a `console.warn` — the escape hatch
+     *  for a product with a known-big prompt that must still ship (it yells on
+     *  every compose instead of blocking). */
+    warnOnly?: boolean;
+}
+/** Largest markdown-heading-delimited sections of a prompt, by UTF-8 bytes.
+ *  Cheap heuristic: split on `#`-heading lines; the preamble before the first
+ *  heading reports as "(preamble)". */
+declare function largestPromptSections(prompt: string, top?: number): Array<{
+    title: string;
+    bytes: number;
+}>;
+/** Enforce {@link ComposeProfileBudget} on a composed system prompt: over
+ *  budget throws (or warns with `warnOnly`) with the actual size and the
+ *  top-3 largest sections. Exported so a product assembling its prompt
+ *  outside {@link composeAgentProfile} (e.g. via the `/prompt` assembler) can
+ *  run the same gate at its own final-composition point. */
+declare function assertSystemPromptWithinBudget(systemPrompt: string, budget?: ComposeProfileBudget): void;
 /** Project per-user skills onto SDK file mounts at the harness skill-discovery
  *  path. No tier gate — a user skill is mounted because the user added it.
  *  Sorted by path for determinism (matches {@link registrySkills}). */
@@ -109,8 +136,12 @@ declare function userSkillMounts(userSkills: UserSkill[]): AgentProfileFileMount
  * not a hand-rolled spread. `mergeAgentProfiles(base, overlay)` returns
  * `undefined` only when BOTH are `undefined`; `base` is always defined here, so
  * the result is non-`undefined` by construction and we assert that to the caller.
+ *
+ * The composed `prompt.systemPrompt` is byte-budgeted here — the single point
+ * where the FINAL prompt exists ({@link assertSystemPromptWithinBudget};
+ * default {@link DEFAULT_MAX_SYSTEM_PROMPT_BYTES}, `warnOnly` escape hatch).
  */
-declare function composeAgentProfile(base: AgentProfile, channels?: ProfileChannels, overlay?: ProfileOverlay): AgentProfile;
+declare function composeAgentProfile(base: AgentProfile, channels?: ProfileChannels, overlay?: ProfileOverlay, budget?: ComposeProfileBudget): AgentProfile;
 /** True body of an addendum file with HTML comments stripped — an all-comment
  *  placeholder counts as empty, so the loader falls back to the baseline. */
 declare function stripComments(raw: string): string;
@@ -146,4 +177,4 @@ interface EvolvableSectionInput {
  */
 declare function makeEvolvableSection(input: EvolvableSectionInput): profile.AgentProfileSection;
 
-export { type EvolvableSectionInput, type ProfileChannels, type ProfileOverlay, SkillEntry, type UserSkill, composeAgentProfile, makeEvolvableSection, stripComments, userSkillMounts };
+export { type ComposeProfileBudget, DEFAULT_MAX_SYSTEM_PROMPT_BYTES, type EvolvableSectionInput, type ProfileChannels, type ProfileOverlay, SkillEntry, type UserSkill, assertSystemPromptWithinBudget, composeAgentProfile, largestPromptSections, makeEvolvableSection, stripComments, userSkillMounts };