@tangle-network/agent-app 0.43.55 → 0.43.57

package/dist/{parts-1sRYSPjF.d.ts → parts-n9XUon0a.d.ts}

@@ -1,5 +1,5 @@
 import { Part } from '@tangle-network/agent-interface';
-import { a as ChatInteractionField, b as ChatInteractionStatus, h as InteractionAnswers, N as NoticeKind } from './contract-KfqJh_au.js';
+import { a as ChatInteractionField, b as ChatInteractionStatus, h as InteractionAnswers, N as NoticeKind } from './contract-TjB68uqA.js';
 import { ChatPlanPersistedPart } from './plans/index.js';
 
 /**
@@ -28,15 +28,19 @@ interface ChatTurnFilePartInput {
     path?: string;
     content?: string;
 }
+/** Resolve input as either a text part or a file part of a chat turn */
 type ChatTurnPartInput = ChatTurnTextPartInput | ChatTurnFilePartInput;
+/** Represent a text event produced by a source with a fixed type and associated text content */
 interface ProducerTextEvent {
     type: 'text';
     text: string;
 }
+/** Define an event representing reasoning output with a fixed type and associated text */
 interface ProducerReasoningEvent {
     type: 'reasoning';
     text: string;
 }
+/** Represent an event triggered by a producer tool call with its identifier, name, and arguments */
 interface ProducerToolCallEvent {
     type: 'tool_call';
     call: {
@@ -45,6 +49,7 @@ interface ProducerToolCallEvent {
         args: Record<string, unknown>;
     };
 }
+/** Describe the structure of an event representing the result of a producer tool call */
 interface ProducerToolResultEvent {
     type: 'tool_result';
     toolCallId: string;
@@ -55,6 +60,7 @@ interface ProducerToolResultEvent {
         message?: string;
     };
 }
+/** Describe usage event with prompt and completion token counts for a producer */
 interface ProducerUsageEvent {
     type: 'usage';
     usage: {
@@ -62,6 +68,7 @@ interface ProducerUsageEvent {
         completionTokens: number;
     };
 }
+/** Define the structure for a producer notice event with type, id, kind, and text fields */
 interface ProducerNoticeEvent {
     type: 'notice';
     id: string;
@@ -69,6 +76,7 @@ interface ProducerNoticeEvent {
     noticeKind: 'warning' | 'auto-declined';
     text: string;
 }
+/** Represent an error event emitted by a producer containing message, code, and optional details */
 interface ProducerErrorEvent {
     type: 'error';
     data: {
@@ -79,12 +87,14 @@ interface ProducerErrorEvent {
 }
 /** Stable raw lifecycle/interaction/plan/route events forwarded unchanged. */
 type ProducerPassthroughEventType = 'turn' | 'metadata' | 'interaction' | 'interaction.cancel' | 'plan.submitted' | 'done' | 'warning' | 'session.run.started' | 'session.run.completed' | 'session.run.failed' | 'turn_status';
+/** Define an event carrying passthrough data with flexible properties for producer communication */
 interface ProducerPassthroughEvent {
     type: ProducerPassthroughEventType;
     data?: Record<string, unknown>;
     /** Route markers and raw passthroughs may carry `turnId`, `status`, `seq`, etc. */
     [key: string]: unknown;
 }
+/** Represent events emitted by a producer during its operation for processing and handling */
 type ProducerWireEvent = ProducerTextEvent | ProducerReasoningEvent | ProducerToolCallEvent | ProducerToolResultEvent | ProducerUsageEvent | ProducerNoticeEvent | ProducerErrorEvent | ProducerPassthroughEvent;
 /** The image/file split an attachment is rendered and persisted under — the
  *  same discriminant as {@link ChatMentionKind}, but a distinct name because an
@@ -140,6 +150,7 @@ interface ChatTurnRequestPayload {
  *  serialized, so composer glue and products never drift from the server's
  *  parser. */
 declare function chatTurnRequestInit(payload: ChatTurnRequestPayload): RequestInit;
+/** Define the maximum byte size allowed for inline parts in data processing */
 declare const INLINE_PARTS_MAX_BYTES = 950000;
 /** Hard cap on the whole `/prompt` request body as it crosses the sandbox
  *  proxy — smaller in practice than a raw-file write cap because a dispatch
@@ -176,11 +187,13 @@ declare function base64WireLen(byteLen: number): number;
  * pulled in.
  */
 declare function formatBytes(bytes: number): string;
+/** Represent errors for invalid chat turn inputs with status and code properties */
 declare class ChatTurnInputError extends Error {
     readonly status: number;
     readonly code: string;
     constructor(message: string, status?: number, code?: string);
 }
+/** Calculate the total byte size of an array of chat turn parts */
 declare function promptPartsByteSize(parts: ChatTurnPartInput[]): number;
 /** Throws `ChatTurnInputError` (413) when the parts' inline payload would blow
  *  the gateway cap. Path-ref parts are tiny by construction and always pass. */
@@ -207,6 +220,7 @@ type ChatMentionKind = 'image' | 'file';
  *  `mentionKind` — never re-declares the extension table; two frozen copies of
  *  one mime table is how one gains a format and the other doesn't. */
 declare function mentionKindForPath(path: string): ChatMentionKind;
+/** Define options to resolve mention paths when converting file mentions to parts */
 interface FileMentionsToPartsOptions {
     /** Resolve a mention's workspace-relative path to the absolute path the
      *  dispatched part should carry (e.g. a host prefixing the in-box vault
@@ -227,6 +241,7 @@ declare function buildMentionPromptBlock(mentions: readonly Pick<FileMention, 'n
 /** Hard cap on mentions per turn. Bounds the prompt pointer block, the
  *  persisted parts, and whatever media budget a dispatch draws from them. */
 declare const MENTION_MAX_COUNT = 16;
+/** Represent the result of a sandbox mention path check indicating success or failure with an error message */
 type SandboxMentionPathCheck = {
     succeeded: true;
 } | {
@@ -321,6 +336,7 @@ interface ChatTextPart {
     text: string;
     id?: string;
 }
+/** Define a reasoning part of a chat with text content and optional metadata fields */
 interface ChatReasoningPart {
     type: 'reasoning';
     text: string;
@@ -331,6 +347,7 @@ interface ChatReasoningPart {
  *  and agent-interface's `ToolState` statuses; `error` is the persisted
  *  terminal form `/stream`'s `normalizePersistedPart` settles on. */
 type ChatToolStatus = 'pending' | 'running' | 'completed' | 'error' | 'failed';
+/** Describe the current state and data of a chat tool including status, input, output, and metadata */
 interface ChatToolState {
     status: ChatToolStatus;
     input?: unknown;
@@ -340,6 +357,7 @@ interface ChatToolState {
     metadata?: Record<string, unknown>;
     time?: ChatPartTime;
 }
+/** Define a chat component representing a tool with its state and optional call identifier */
 interface ChatToolPart {
     type: 'tool';
     id: string;
@@ -362,6 +380,7 @@ interface ChatFilePart {
     path?: string;
     content?: string;
 }
+/** Define properties for an image part within a chat message including optional metadata fields */
 interface ChatImagePart {
     type: 'image';
     filename?: string;
@@ -370,6 +389,7 @@ interface ChatImagePart {
     url?: string;
     path?: string;
 }
+/** Define a subtask part of a chat with prompt, description, agent, and optional identifier */
 interface ChatSubtaskPart {
     type: 'subtask';
     prompt: string;
@@ -395,6 +415,7 @@ interface ChatUsageTokens {
         read?: number;
     };
 }
+/** Define a chat step finish part indicating completion with optional reason, tokens, and cost */
 interface ChatStepFinishPart {
     type: 'step-finish';
     reason?: string;
@@ -416,6 +437,7 @@ interface ChatInteractionPart {
     answers?: InteractionAnswers;
     cancelReason?: string;
 }
+/** Resolve a chat plan part by aliasing it to the persisted chat plan part type */
 type ChatPlanPart = ChatPlanPersistedPart;
 /** Persisted one-line transcript notice — byte-matches `noticePart` in
  *  `/web-react`'s chat-interactions contract. */
@@ -445,6 +467,7 @@ interface ChatMentionPart {
     size?: number;
     turnId?: string;
 }
+/** Represent parts of a chat message including text, reasoning, tools, files, images, subtasks, steps, interactions, notices, plans, and mentions */
 type ChatMessagePart = ChatTextPart | ChatReasoningPart | ChatToolPart | ChatFilePart | ChatImagePart | ChatSubtaskPart | ChatStepStartPart | ChatStepFinishPart | ChatInteractionPart | ChatNoticePart | ChatPlanPart | ChatMentionPart;
 /** Every canonical harness wire-part kind must be storable — compile-time
  *  guarantee that a new agent-interface part kind cannot silently fall out of
@@ -461,10 +484,15 @@ type StorableHarnessPartKind = Part['type'] & ChatMessagePart['type'];
  * kind can silently fall out (the step-finish/interaction trap).
  */
 declare function toChatMessageParts(parts: Array<Record<string, unknown>>): ChatMessagePart[];
+/** Resolve whether a ChatMessagePart is specifically a ChatToolPart based on its type property */
 declare function isChatToolPart(part: ChatMessagePart): part is ChatToolPart;
+/** Resolve whether a chat message part is a text part based on its type property */
 declare function isChatTextPart(part: ChatMessagePart): part is ChatTextPart;
+/** Resolve whether a ChatMessagePart is a ChatInteractionPart based on its type property */
 declare function isChatInteractionPart(part: ChatMessagePart): part is ChatInteractionPart;
+/** Resolve whether a chat message part is a persisted chat plan part */
 declare function isChatPlanPart(part: ChatMessagePart): part is ChatPlanPart;
+/** Determine if a chat message part represents the completion of a chat step */
 declare function isChatStepFinishPart(part: ChatMessagePart): part is ChatStepFinishPart;
 /** Widened to `unknown` — unlike its siblings this guard also runs over raw
  *  untyped stored rows (a transcript renderer reads `message.parts` before the

package/dist/plans/index.d.ts

@@ -47,6 +47,7 @@ type ChatPlan = ChatPlanBase & ({
 type ChatPlanPersistedPart = ChatPlan & {
     type: 'plan';
 };
+/** Resolve the result of parsing a plan submission into success with value or failure with error */
 type ParsePlanSubmittedResult = {
     succeeded: true;
     value: ChatPlan;
@@ -54,12 +55,17 @@ type ParsePlanSubmittedResult = {
     succeeded: false;
     error: string;
 };
+/** Generate a unique key string for a given plan identifier */
 declare function planPartKey(planId: string): string;
+/** Generate a unique key string for a plan based on its ID and revision number */
 declare function planRevisionKey(planId: string, revision: number): string;
+/** Generate a unique follow-up turn ID based on the plan ID and its outcome */
 declare function planFollowUpTurnId(planId: string, outcome: 'approved' | 'rejected'): string;
 /** Plan status is monotonic: only a pending plan can settle. */
 declare function canTransitionPlanStatus(from: ChatPlanStatus, to: ChatPlanStatus): boolean;
+/** Resolve a ChatPlan into its persisted part representation for storage or transmission */
 declare function planToPersistedPart(plan: ChatPlan): ChatPlanPersistedPart;
+/** Resolve a persisted part object into a ChatPlan or return null if the type is not 'plan */
 declare function persistedPartToPlan(part: Record<string, unknown>): ChatPlan | null;
 /** Parses both direct sandbox events (`data.plan`) and session envelopes
  * (`properties.plan`). Session identity is carried by the surrounding stream

package/dist/plans/index.js

@@ -7,7 +7,7 @@ import {
   planPartKey,
   planRevisionKey,
   planToPersistedPart
-} from "../chunk-SIXYZ2FB.js";
+} from "../chunk-YJMCRXQQ.js";
 export {
   PLAN_SUBMITTED_EVENT,
   canTransitionPlanStatus,

package/dist/platform/index.d.ts

@@ -1,5 +1,5 @@
-export { c as AdminGuardOptions, d as AssertBillableBalanceOptions, A as AuthGuard, e as AuthGuardOptions, B as BetterAuthSessionCookieMinterOptions, f as BetterAuthSessionCookieSource, g as BillableBalanceState, G as GuardResolution, S as SsoStateConfig, b as TangleSsoAccountStore, a as TangleSsoAuthClient, h as TangleSsoExchangeResult, i as TangleSsoHandlerOptions, T as TangleSsoHandlers, j as TangleSsoSessionCookieArgs, k as TangleSsoUserCreateError, l as assertBillableBalance, m as createAdminGuard, n as createAuthGuard, o as createBetterAuthSessionCookieMinter, p as createSignedSsoState, q as createTangleSsoHandlers, r as guardResolution, s as parseAdminEmails, t as signSessionCookieValue, v as verifySignedSsoState } from '../sso-CNOsARMJ.js';
-import { f as TangleExecutionEnvironment, j as TangleExecutionKeySource } from '../model-dF2h4xT9.js';
+export { c as AdminGuardOptions, d as AssertBillableBalanceOptions, A as AuthGuard, e as AuthGuardOptions, B as BetterAuthSessionCookieMinterOptions, f as BetterAuthSessionCookieSource, g as BillableBalanceState, G as GuardResolution, S as SsoStateConfig, b as TangleSsoAccountStore, a as TangleSsoAuthClient, h as TangleSsoExchangeResult, i as TangleSsoHandlerOptions, T as TangleSsoHandlers, j as TangleSsoSessionCookieArgs, k as TangleSsoUserCreateError, l as assertBillableBalance, m as createAdminGuard, n as createAuthGuard, o as createBetterAuthSessionCookieMinter, p as createSignedSsoState, q as createTangleSsoHandlers, r as guardResolution, s as parseAdminEmails, t as signSessionCookieValue, v as verifySignedSsoState } from '../sso-Cm00S61u.js';
+import { f as TangleExecutionEnvironment, j as TangleExecutionKeySource } from '../model-DmdkIteM.js';
 import { PlatformIdentity, PlatformBillingClient } from '../billing/index.js';
 
 /**
@@ -12,10 +12,12 @@ import { PlatformIdentity, PlatformBillingClient } from '../billing/index.js';
 
 /** Hub bearer provenance mirrors the execution-key source union. */
 type TangleHubBearerSource = TangleExecutionKeySource;
+/** Represent a resolved bearer token with its associated TangleHub bearer source */
 interface ResolvedTangleHubBearer {
     bearer: string;
     source: TangleHubBearerSource;
 }
+/** Resolve options required to obtain a user's TangleHub bearer token including environment and API key retrieval */
 interface ResolveUserTangleHubBearerOptions {
     userId: string;
     /** Deployment context. Only local development may use env credentials. */
@@ -25,12 +27,14 @@ interface ResolveUserTangleHubBearerOptions {
     /** App-owned lookup for the caller's linked platform API key. */
     getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>;
 }
+/** Resolve options for retrieving a TangleHub bearer token for a specified user */
 interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {
     userId: UserId;
     environment?: TangleExecutionEnvironment;
     env?: Record<string, string | undefined>;
     getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>;
 }
+/** Represent missing Tangle platform link error for a specified user ID */
 declare class TangleBearerMissingError extends Error {
     readonly userId: string;
     constructor(userId: string);
@@ -43,6 +47,7 @@ declare class TangleBearerMissingError extends Error {
  * linked platform key; this keeps integration ownership aligned with the user.
  */
 declare function resolveUserTangleHubBearer(opts: ResolveUserTangleHubBearerOptions): Promise<ResolvedTangleHubBearer>;
+/** Resolve the TangleHub bearer token for a specified user based on provided options */
 declare function resolveUserTangleHubBearerForUser<UserId = string>(opts: ResolveUserTangleHubBearerForUserOptions<UserId>): Promise<ResolvedTangleHubBearer>;
 /** Structural guard (name + userId shape) — robust when the error class is
  *  constructed in a different module instance than the one checking it. */
@@ -68,6 +73,7 @@ interface HubClientLike {
     }>;
     listHealthchecks(): Promise<unknown>;
 }
+/** Define methods to require user ID, get bearer token, and create a hub client bound to the bearer */
 interface HubProxyContext {
     /** Resolve the authenticated user id. Throw the app's own auth Response /
      *  redirect to reject — it propagates untouched. */
@@ -77,10 +83,12 @@ interface HubProxyContext {
     /** A hub client bound to the bearer. */
     createHubClient(bearer: string): HubClientLike;
 }
+/** Define arguments for configuring a proxy route with request and optional parameters */
 interface HubProxyRouteArgs {
     request: Request;
     params?: Record<string, string | undefined>;
 }
+/** Define routes for hub proxy handling catalog, connections, healthchecks, and authorization actions */
 interface HubProxyRoutes {
     /** GET → `{ catalog }`. */
     catalog(args: HubProxyRouteArgs): Promise<Response>;
@@ -99,6 +107,7 @@ interface HubProxyRoutes {
      *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */
     authStart(args: HubProxyRouteArgs): Promise<Response>;
 }
+/** Resolve hub proxy routes with authentication and error handling based on the given context */
 declare function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes;
 
 /**
@@ -112,15 +121,18 @@ declare function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes;
  * `PlatformBillingClient` seam (type-only import — no runtime coupling).
  */
 
+/** Define available subscription tiers for the TanglePlan service */
 type TanglePlanTier = 'free' | 'pro' | 'enterprise';
 /** 'pro' | 'enterprise' pass through; anything else (null, unknown) → 'free'. */
 declare function normalizeTanglePlanTier(plan: string | null | undefined): TanglePlanTier;
+/** Represent platform billing HTTP errors with status code and detailed message */
 declare class PlatformBillingHttpError extends Error {
     readonly status: number;
     constructor(status: number, detail: string);
 }
 /** Structural guard (name + numeric status) — robust across module instances. */
 declare function isPlatformBillingHttpError(error: unknown): error is PlatformBillingHttpError;
+/** Define HTTP options for platform billing including base URL, service token, product slug, fetch implementation, and timeout */
 interface PlatformBillingHttpOptions {
     /** Platform root, e.g. https://id.tangle.tools (trailing slashes stripped). */
     baseUrl: string;
@@ -133,15 +145,18 @@ interface PlatformBillingHttpOptions {
     /** Default 10 000. */
     timeoutMs?: number;
 }
+/** Describe subscription tier and status information for a platform user */
 interface PlatformSubscriptionInfo {
     tier: TanglePlanTier;
     status: string | null;
 }
+/** Describe the platform balance and lifetime spending with an optional update timestamp */
 interface PlatformBalanceSnapshot {
     balance: number;
     lifetimeSpent: number;
     updatedAt?: string;
 }
+/** Describe a product's usage and spending metrics on the platform */
 interface PlatformUsageProductRow {
     product: string | null;
     totalSpent: number;
@@ -171,6 +186,7 @@ interface ProductEntitlement {
     hasSeat: boolean;
     onFreeTier: boolean;
 }
+/** Define methods to interact with platform billing endpoints using user or service authentication */
 interface PlatformBillingHttp {
     /** GET /v1/plans/current (user bearer). */
     getSubscription(userApiKey: string): Promise<PlatformSubscriptionInfo>;
@@ -193,6 +209,7 @@ interface PlatformBillingHttp {
     /** Absolute URL of the $100/mo seat checkout for `productId`. */
     seatCheckoutUrl(productId: string): string;
 }
+/** Create a PlatformBillingHttp instance configured with given options and default behaviors */
 declare function createPlatformBillingHttp(opts: PlatformBillingHttpOptions): PlatformBillingHttp;
 /**
  * Platform Stripe checkout URL for a product's $100/mo seat. One shared price
@@ -201,11 +218,14 @@ declare function createPlatformBillingHttp(opts: PlatformBillingHttpOptions): Pl
  * `billingUrl()` shape — a deterministic platform-rooted URL, no network call.
  */
 declare function seatCheckoutUrl(baseUrl: string, productId: string): string;
+/** Define policy settings for concurrency and overage allowance in a tangle tier */
 interface TangleTierPolicy {
     concurrency: number;
     overageAllowed: boolean;
 }
+/** Define default concurrency and overage policies for each TanglePlanTier level */
 declare const DEFAULT_TANGLE_TIER_POLICY: Record<TanglePlanTier, TangleTierPolicy>;
+/** Describe the state of a Tangle plan tier including subscription, balance, spending, and concurrency details */
 interface TangleTierState {
     tier: TanglePlanTier;
     subscriptionStatus: string | null;
@@ -230,6 +250,7 @@ declare const FREE_TIER_SPEND_CAP_USD = 2;
  * changes live until a product flips the flag.
  */
 declare const DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR = "SEAT_BILLING_ENABLED";
+/** Define options to configure seat billing flag environment variables and override flag name */
 interface SeatBillingFlagOptions {
     env?: Record<string, string | undefined>;
     /** Override the flag name; default {@link DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR}. */
@@ -256,6 +277,7 @@ declare function getProductEntitlement(http: Pick<PlatformBillingHttp, 'getProdu
 /** Entitled = holds an active seat OR is still inside the free tier. The one
  *  predicate all five products gate on. */
 declare function isProductEntitled(ent: ProductEntitlement): boolean;
+/** Define a contract for resolving platform identities based on user identifiers */
 interface PlatformIdentityStore {
     resolveIdentity(userId: string): Promise<PlatformIdentity | null>;
 }

package/dist/platform/index.js

@@ -10,11 +10,11 @@ import {
   parseAdminEmails,
   signSessionCookieValue,
   verifySignedSsoState
-} from "../chunk-TKVJE63N.js";
-import "../chunk-HFC4BTWJ.js";
+} from "../chunk-YRMLYFVR.js";
+import "../chunk-PTUMBMVH.js";
 import {
   resolveTangleDevOrUserKey
-} from "../chunk-7W5XSTUF.js";
+} from "../chunk-JML7WKWU.js";
 
 // src/platform/hub.ts
 var TangleBearerMissingError = class extends Error {

package/dist/platform/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/platform/hub.ts","../../src/platform/billing.ts"],"sourcesContent":["/**\n * Integrations-hub proxy routes: the app-side surface that forwards an\n * authenticated user's requests to the platform's `/v1/integrations/*` API\n * using their stored platform key. Auth, key lookup, and the wire client are\n * structural seams (`HubProxyContext`); error detection is by name + shape so\n * it survives bundlers duplicating module instances.\n */\n\nimport {\n  resolveTangleDevOrUserKey,\n  type TangleExecutionEnvironment,\n  type TangleExecutionKeySource,\n} from '../runtime/model'\n\n/** Hub bearer provenance mirrors the execution-key source union. */\nexport type TangleHubBearerSource = TangleExecutionKeySource\n\nexport interface ResolvedTangleHubBearer {\n  bearer: string\n  source: TangleHubBearerSource\n}\n\nexport interface ResolveUserTangleHubBearerOptions {\n  userId: string\n  /** Deployment context. Only local development may use env credentials. */\n  environment?: TangleExecutionEnvironment\n  /** Env to read for the local-development bearer. */\n  env?: Record<string, string | undefined>\n  /** App-owned lookup for the caller's linked platform API key. */\n  getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>\n}\n\nexport interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {\n  userId: UserId\n  environment?: TangleExecutionEnvironment\n  env?: Record<string, string | undefined>\n  getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>\n}\n\nexport class TangleBearerMissingError extends Error {\n  constructor(readonly userId: string) {\n    super(`No Tangle platform link for user ${userId}`)\n    this.name = 'TangleBearerMissingError'\n  }\n}\n\n/**\n * Resolve the Tangle bearer used by the integration hub proxy.\n *\n * Local development may use a server env key so apps can exercise the hub\n * without completing cross-site SSO. Deployed contexts must use the caller's\n * linked platform key; this keeps integration ownership aligned with the user.\n */\nexport async function resolveUserTangleHubBearer(\n  opts: ResolveUserTangleHubBearerOptions,\n): Promise<ResolvedTangleHubBearer> {\n  const resolved = await resolveTangleDevOrUserKey({\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: opts.getUserApiKey,\n  })\n  if (resolved) return { bearer: resolved.apiKey, source: resolved.source }\n\n  throw new TangleBearerMissingError(opts.userId)\n}\n\nexport async function resolveUserTangleHubBearerForUser<UserId = string>(\n  opts: ResolveUserTangleHubBearerForUserOptions<UserId>,\n): Promise<ResolvedTangleHubBearer> {\n  return resolveUserTangleHubBearer({\n    userId: String(opts.userId),\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: () => opts.getUserApiKey(opts.userId),\n  })\n}\n\n/** Structural guard (name + userId shape) — robust when the error class is\n *  constructed in a different module instance than the one checking it. */\nexport function isTangleBearerMissingError(error: unknown): error is TangleBearerMissingError {\n  return (\n    error instanceof Error &&\n    error.name === 'TangleBearerMissingError' &&\n    typeof (error as { userId?: unknown }).userId === 'string'\n  )\n}\n\n/** Structural detection of the platform hub wire error (name + numeric status). */\nexport function isPlatformHubErrorLike(error: unknown): error is Error & { status: number; code?: string } {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformHubError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\n/** Structural subset of the platform hub wire client — extra methods are fine. */\nexport interface HubClientLike {\n  catalog(): Promise<unknown>\n  listConnections(): Promise<unknown>\n  revokeConnection(connectionId: string): Promise<unknown>\n  startAuth(input: {\n    providerId: string\n    connectorId: string\n    returnUrl: string\n    requestedScopes?: string[]\n  }): Promise<{ authorizationUrl: string; state: string }>\n  listHealthchecks(): Promise<unknown>\n}\n\nexport interface HubProxyContext {\n  /** Resolve the authenticated user id. Throw the app's own auth Response /\n   *  redirect to reject — it propagates untouched. */\n  requireUserId(request: Request): Promise<string>\n  /** The user's platform bearer; throw `TangleBearerMissingError` when unlinked. */\n  getBearer(userId: string): Promise<string>\n  /** A hub client bound to the bearer. */\n  createHubClient(bearer: string): HubClientLike\n}\n\nexport interface HubProxyRouteArgs {\n  request: Request\n  params?: Record<string, string | undefined>\n}\n\nexport interface HubProxyRoutes {\n  /** GET → `{ catalog }`. */\n  catalog(args: HubProxyRouteArgs): Promise<Response>\n  /** GET → `{ connections }`. */\n  connections(args: HubProxyRouteArgs): Promise<Response>\n  /** DELETE → the platform revocation result verbatim; 405 otherwise. */\n  connectionDelete(args: { request: Request; params: { connectionId: string } }): Promise<Response>\n  /** GET → `{ healthchecks }`. */\n  healthchecks(args: HubProxyRouteArgs): Promise<Response>\n  /** POST `{ providerId, connectorId, returnUrl, requestedScopes? }` →\n   *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */\n  authStart(args: HubProxyRouteArgs): Promise<Response>\n}\n\ninterface StartAuthBody {\n  providerId?: string\n  connectorId?: string\n  returnUrl?: string\n  requestedScopes?: string[]\n}\n\nexport function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes {\n  /** Auth runs OUTSIDE the proxy try/catch so the app's auth throw (redirect\n   *  Response etc.) is never swallowed; bearer + platform errors are mapped. */\n  async function proxy(request: Request, call: (hub: HubClientLike) => Promise<Response>): Promise<Response> {\n    const userId = await ctx.requireUserId(request)\n    try {\n      const bearer = await ctx.getBearer(userId)\n      return await call(ctx.createHubClient(bearer))\n    } catch (err) {\n      if (isTangleBearerMissingError(err)) {\n        return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n      }\n      if (isPlatformHubErrorLike(err)) {\n        return Response.json({ error: err.message, code: err.code }, { status: err.status })\n      }\n      throw err\n    }\n  }\n\n  return {\n    catalog: ({ request }) => proxy(request, async (hub) => Response.json({ catalog: await hub.catalog() })),\n\n    connections: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ connections: await hub.listConnections() })),\n\n    connectionDelete: async ({ request, params }) => {\n      if (request.method !== 'DELETE') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      return proxy(request, async (hub) => Response.json(await hub.revokeConnection(params.connectionId)))\n    },\n\n    healthchecks: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ healthchecks: await hub.listHealthchecks() })),\n\n    authStart: async ({ request }) => {\n      if (request.method !== 'POST') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      const userId = await ctx.requireUserId(request)\n      let body: StartAuthBody\n      try {\n        body = (await request.json()) as StartAuthBody\n      } catch {\n        return Response.json({ error: 'Invalid JSON body' }, { status: 400 })\n      }\n      if (!body.providerId || !body.connectorId || !body.returnUrl) {\n        return Response.json({ error: 'providerId, connectorId, and returnUrl are required' }, { status: 400 })\n      }\n      try {\n        const bearer = await ctx.getBearer(userId)\n        const result = await ctx.createHubClient(bearer).startAuth({\n          providerId: body.providerId,\n          connectorId: body.connectorId,\n          returnUrl: body.returnUrl,\n          requestedScopes: body.requestedScopes,\n        })\n        return Response.json({ authorizationUrl: result.authorizationUrl, state: result.state })\n      } catch (err) {\n        if (isTangleBearerMissingError(err)) {\n          return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n        }\n        if (isPlatformHubErrorLike(err)) {\n          return Response.json({ error: err.message, code: err.code }, { status: err.status })\n        }\n        throw err\n      }\n    },\n  }\n}\n","/**\n * Platform billing HTTP transport + tier state for apps on the shared\n * Tangle balance model (id.tangle.tools). Reads authenticate as the user via\n * their per-user platform key (the platform resolves the caller from the\n * key; service or impersonation headers on read routes are rejected). The\n * deduct write authenticates as the product service (`Bearer <serviceToken>`\n * + `X-Service-Name`) and names the target user in the body. Also provides a\n * fetch-backed implementation of the `/billing` module's\n * `PlatformBillingClient` seam (type-only import — no runtime coupling).\n */\n\nimport type { PlatformBillingClient, PlatformIdentity } from '../billing/index'\n\nexport type TanglePlanTier = 'free' | 'pro' | 'enterprise'\n\n/** 'pro' | 'enterprise' pass through; anything else (null, unknown) → 'free'. */\nexport function normalizeTanglePlanTier(plan: string | null | undefined): TanglePlanTier {\n  return plan === 'pro' || plan === 'enterprise' ? plan : 'free'\n}\n\nexport class PlatformBillingHttpError extends Error {\n  constructor(\n    readonly status: number,\n    detail: string,\n  ) {\n    super(`Platform request failed (${status}): ${detail}`)\n    this.name = 'PlatformBillingHttpError'\n  }\n}\n\n/** Structural guard (name + numeric status) — robust across module instances. */\nexport function isPlatformBillingHttpError(error: unknown): error is PlatformBillingHttpError {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformBillingHttpError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\nexport interface PlatformBillingHttpOptions {\n  /** Platform root, e.g. https://id.tangle.tools (trailing slashes stripped). */\n  baseUrl: string\n  /** Used only by `deduct()`; resolved lazily so reads never require it.\n   *  Throws at call time when empty. */\n  serviceToken: string | (() => string)\n  /** Product slug — the `X-Service-Name` header and the deduct `product` field. */\n  productSlug: string\n  fetchImpl?: typeof fetch\n  /** Default 10 000. */\n  timeoutMs?: number\n}\n\nexport interface PlatformSubscriptionInfo {\n  tier: TanglePlanTier\n  status: string | null\n}\n\nexport interface PlatformBalanceSnapshot {\n  balance: number\n  lifetimeSpent: number\n  updatedAt?: string\n}\n\nexport interface PlatformUsageProductRow {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Lifecycle of a per-product seat subscription, mirroring the Stripe states\n *  the platform persists. 'none' = the user has never held this seat. */\nexport type SeatStatus = 'none' | 'active' | 'trialing' | 'past_due' | 'canceled'\n\n/**\n * Per-product entitlement snapshot from the platform — the single read that\n * tells a product whether to show its workspace or the seat paywall. Shape\n * matches `GET /v1/billing/product-entitlement?product=<id>`.\n *\n * `hasSeat` and `onFreeTier` are computed platform-side from the raw seat row\n * + cumulative spend so the gate is identical across all five products:\n * - `hasSeat`     — an active/trialing seat whose period has not lapsed.\n * - `onFreeTier`  — no active seat AND cumulative spend below the free cap\n *                   ($2 / 200¢ lifetime). Keys off lifetime spend, not wallet\n *                   balance, so a router top-up never re-opens free access.\n */\nexport interface ProductEntitlement {\n  seatStatus: SeatStatus\n  /** ISO timestamp the active seat's paid period runs until; null when none. */\n  currentPeriodEnd: string | null\n  /** Cumulative inference spend across the whole suite, in dollars. */\n  lifetimeSpentUsd: number\n  hasSeat: boolean\n  onFreeTier: boolean\n}\n\nexport interface PlatformBillingHttp {\n  /** GET /v1/plans/current (user bearer). */\n  getSubscription(userApiKey: string): Promise<PlatformSubscriptionInfo>\n  /** GET /v1/billing/balance (user bearer). */\n  getBalance(userApiKey: string): Promise<PlatformBalanceSnapshot>\n  /** GET /v1/billing/usage (user bearer). */\n  getUsageByProduct(userApiKey: string): Promise<PlatformUsageProductRow[]>\n  /** GET /v1/billing/product-entitlement?product=<id> (user bearer). */\n  getProductEntitlement(userApiKey: string, productId: string): Promise<ProductEntitlement>\n  /** POST /v1/billing/deduct (service token). */\n  deduct(input: {\n    platformUserId: string\n    amountUsd: number\n    type: string\n    description: string\n    referenceId: string\n  }): Promise<void>\n  /** Absolute URL of the platform's billing-management surface. */\n  billingUrl(): string\n  /** Absolute URL of the $100/mo seat checkout for `productId`. */\n  seatCheckoutUrl(productId: string): string\n}\n\nexport function createPlatformBillingHttp(opts: PlatformBillingHttpOptions): PlatformBillingHttp {\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, '')\n  if (!baseUrl) throw new Error('PlatformBillingHttpOptions.baseUrl is required')\n  if (!opts.productSlug) throw new Error('PlatformBillingHttpOptions.productSlug is required')\n  const fetchImpl = opts.fetchImpl ?? fetch\n  const timeoutMs = opts.timeoutMs ?? 10_000\n\n  function resolveServiceToken(): string {\n    const token = typeof opts.serviceToken === 'function' ? opts.serviceToken() : opts.serviceToken\n    if (!token) throw new Error('A platform service token is required for deduct')\n    return token\n  }\n\n  async function request<T>(path: string, init: RequestInit, headers: Headers): Promise<T> {\n    const res = await fetchImpl(`${baseUrl}${path}`, {\n      ...init,\n      headers,\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n    if (!res.ok) {\n      const body = (await res.json().catch(() => null)) as { error?: { message?: string } } | null\n      throw new PlatformBillingHttpError(res.status, body?.error?.message ?? res.statusText)\n    }\n    return res.json() as Promise<T>\n  }\n\n  function userRead<T>(userApiKey: string, path: string): Promise<T> {\n    const headers = new Headers()\n    headers.set('Authorization', `Bearer ${userApiKey}`)\n    return request<T>(path, {}, headers)\n  }\n\n  return {\n    async getSubscription(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { subscription?: { plan?: string | null; status?: string | null } | null }\n      }>(userApiKey, '/v1/plans/current')\n      const sub = body.data?.subscription ?? null\n      return { tier: normalizeTanglePlanTier(sub?.plan), status: sub?.status ?? null }\n    },\n\n    async getBalance(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { balance?: number; lifetimeSpent?: number; updatedAt?: string }\n      }>(userApiKey, '/v1/billing/balance')\n      return {\n        balance: body.data?.balance ?? 0,\n        lifetimeSpent: body.data?.lifetimeSpent ?? 0,\n        updatedAt: body.data?.updatedAt,\n      }\n    },\n\n    async getUsageByProduct(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: Array<{ product?: string | null; totalSpent?: number; count?: number }>\n      }>(userApiKey, '/v1/billing/usage')\n      return (body.data ?? []).map((row) => ({\n        product: row.product ?? null,\n        totalSpent: row.totalSpent ?? 0,\n        count: row.count ?? 0,\n      }))\n    },\n\n    async getProductEntitlement(userApiKey, productId) {\n      const slug = encodeURIComponent(productId)\n      const body = await userRead<{\n        success: boolean\n        data?: {\n          seatStatus?: SeatStatus | null\n          currentPeriodEnd?: string | null\n          lifetimeSpentUsd?: number | null\n          hasSeat?: boolean | null\n          onFreeTier?: boolean | null\n        }\n      }>(userApiKey, `/v1/billing/product-entitlement?product=${slug}`)\n      const data = body.data ?? {}\n      const hasSeat = data.hasSeat === true\n      return {\n        seatStatus: data.seatStatus ?? 'none',\n        currentPeriodEnd: data.currentPeriodEnd ?? null,\n        lifetimeSpentUsd: data.lifetimeSpentUsd ?? 0,\n        hasSeat,\n        // Free access only when there is no seat AND the platform says so.\n        onFreeTier: !hasSeat && data.onFreeTier === true,\n      }\n    },\n\n    async deduct(input) {\n      const headers = new Headers()\n      headers.set('Authorization', `Bearer ${resolveServiceToken()}`)\n      headers.set('X-Service-Name', opts.productSlug)\n      headers.set('Content-Type', 'application/json')\n      await request('/v1/billing/deduct', {\n        method: 'POST',\n        body: JSON.stringify({\n          userId: input.platformUserId,\n          amount: input.amountUsd,\n          type: input.type,\n          product: opts.productSlug,\n          description: input.description,\n          referenceId: input.referenceId,\n        }),\n      }, headers)\n    },\n\n    billingUrl() {\n      return `${baseUrl}/app/billing`\n    },\n\n    seatCheckoutUrl(productId) {\n      return seatCheckoutUrl(baseUrl, productId)\n    },\n  }\n}\n\n/**\n * Platform Stripe checkout URL for a product's $100/mo seat. One shared price\n * carries `metadata.productId`; the platform distinguishes the product from\n * the `product` query param (not five distinct prices). Mirrors the\n * `billingUrl()` shape — a deterministic platform-rooted URL, no network call.\n */\nexport function seatCheckoutUrl(baseUrl: string, productId: string): string {\n  const root = baseUrl.replace(/\\/+$/, '')\n  return `${root}/app/billing/seat/checkout?product=${encodeURIComponent(productId)}`\n}\n\n// ── Tier policy + composed state ────────────────────────────────────────────\n\nexport interface TangleTierPolicy {\n  concurrency: number\n  overageAllowed: boolean\n}\n\nexport const DEFAULT_TANGLE_TIER_POLICY: Record<TanglePlanTier, TangleTierPolicy> = {\n  free: { concurrency: 1, overageAllowed: false },\n  pro: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n  enterprise: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n}\n\nexport interface TangleTierState {\n  tier: TanglePlanTier\n  subscriptionStatus: string | null\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * Read subscription + balance and project them onto the tier policy. A\n * null/absent key fails CLOSED (free tier, zero balance) — a billable run is\n * never started against an unknown balance. Platform errors throw; callers\n * on the billable path choose their posture explicitly.\n */\nexport async function readTangleTierState(\n  http: PlatformBillingHttp,\n  userApiKey: string | null | undefined,\n  policy: Record<TanglePlanTier, TangleTierPolicy> = DEFAULT_TANGLE_TIER_POLICY,\n): Promise<TangleTierState> {\n  if (!userApiKey) {\n    return {\n      tier: 'free',\n      subscriptionStatus: null,\n      remainingBalanceUsd: 0,\n      lifetimeSpentUsd: 0,\n      ...policy.free,\n    }\n  }\n  const [subscription, balance] = await Promise.all([\n    http.getSubscription(userApiKey),\n    http.getBalance(userApiKey),\n  ])\n  return {\n    tier: subscription.tier,\n    subscriptionStatus: subscription.status,\n    remainingBalanceUsd: balance.balance,\n    lifetimeSpentUsd: balance.lifetimeSpent,\n    ...policy[subscription.tier],\n  }\n}\n\n// ── Per-product seat entitlement ────────────────────────────────────────────\n\n/** Lifetime free-tier cap: $2 (200¢) cumulative inference spend, expressed in\n *  dollars. Free product access ends once cumulative spend crosses this. */\nexport const FREE_TIER_SPEND_CAP_USD = 2\n\n/**\n * Default name of the per-app feature flag gating seat billing. While OFF the\n * entitlement read is skipped and access fails OPEN (entitled) so nothing\n * changes live until a product flips the flag.\n */\nexport const DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR = 'SEAT_BILLING_ENABLED'\n\nexport interface SeatBillingFlagOptions {\n  env?: Record<string, string | undefined>\n  /** Override the flag name; default {@link DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR}. */\n  flagEnvVar?: string\n}\n\n/**\n * Seat billing is OFF unless the flag is explicitly truthy ('true'/'1'/'on'/\n * 'enabled'). Default OFF — pre-rollout, the paywall never engages. Returns\n * false when no env is available (browser bundles) so the client stays\n * fail-open there too.\n */\nexport function isSeatBillingEnabled(opts: SeatBillingFlagOptions = {}): boolean {\n  const env =\n    opts.env ??\n    (typeof process !== 'undefined' ? (process.env as Record<string, string | undefined>) : undefined)\n  if (!env) return false\n  const flag = env[opts.flagEnvVar ?? DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR]?.trim().toLowerCase()\n  return flag === 'true' || flag === '1' || flag === 'on' || flag === 'enabled'\n}\n\n/**\n * Read a user's entitlement for one product. Fails OPEN: an absent key,\n * disabled flag, or unreachable seat endpoint all return a permissive snapshot\n * (`hasSeat: true`) so consumers never break pre-rollout. The platform owns the\n * `hasSeat`/`onFreeTier` computation; this client only transports + degrades\n * safely.\n *\n * @param flag — pass {@link isSeatBillingEnabled} (or your own boolean) so the\n *   product owns when the gate engages. When false, no network call is made.\n */\nexport async function getProductEntitlement(\n  http: Pick<PlatformBillingHttp, 'getProductEntitlement'>,\n  userApiKey: string | null | undefined,\n  productId: string,\n  flag = true,\n): Promise<ProductEntitlement> {\n  if (!flag || !userApiKey) return failOpenEntitlement()\n  try {\n    return await http.getProductEntitlement(userApiKey, productId)\n  } catch {\n    // Seat endpoint unavailable (pre-rollout platform, transient 5xx): never\n    // wall a paying or grandfathered user on a transport hiccup.\n    return failOpenEntitlement()\n  }\n}\n\nfunction failOpenEntitlement(): ProductEntitlement {\n  return {\n    seatStatus: 'active',\n    currentPeriodEnd: null,\n    lifetimeSpentUsd: 0,\n    hasSeat: true,\n    onFreeTier: false,\n  }\n}\n\n/** Entitled = holds an active seat OR is still inside the free tier. The one\n *  predicate all five products gate on. */\nexport function isProductEntitled(ent: ProductEntitlement): boolean {\n  return ent.hasSeat || ent.onFreeTier\n}\n\n// ── Bridge onto the /billing seam ───────────────────────────────────────────\n\nexport interface PlatformIdentityStore {\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n}\n\n/** Concrete fetch-backed `PlatformBillingClient<TanglePlanTier>` for\n *  `createPlatformBalanceManager` (from `/billing`). */\nexport function createTanglePlatformBillingClient(\n  http: PlatformBillingHttp,\n  identity: PlatformIdentityStore,\n): PlatformBillingClient<TanglePlanTier> {\n  return {\n    resolveIdentity: (userId) => identity.resolveIdentity(userId),\n    getPlan: async (apiKey) => (await http.getSubscription(apiKey)).tier,\n    getBalance: async (apiKey) => {\n      const snapshot = await http.getBalance(apiKey)\n      return { balance: snapshot.balance, lifetimeSpent: snapshot.lifetimeSpent }\n    },\n    getUsageByProduct: (apiKey) => http.getUsageByProduct(apiKey),\n    deduct: (input) => http.deduct(input),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuCO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAqB,QAAgB;AACnC,UAAM,oCAAoC,MAAM,EAAE;AAD/B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AASA,eAAsB,2BACpB,MACkC;AAClC,QAAM,WAAW,MAAM,0BAA0B;AAAA,IAC/C,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,KAAK;AAAA,EACtB,CAAC;AACD,MAAI,SAAU,QAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,SAAS,OAAO;AAExE,QAAM,IAAI,yBAAyB,KAAK,MAAM;AAChD;AAEA,eAAsB,kCACpB,MACkC;AAClC,SAAO,2BAA2B;AAAA,IAChC,QAAQ,OAAO,KAAK,MAAM;AAAA,IAC1B,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,MAAM,KAAK,cAAc,KAAK,MAAM;AAAA,EACrD,CAAC;AACH;AAIO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAGO,SAAS,uBAAuB,OAAoE;AACzG,SACE,iBAAiB,SACjB,MAAM,SAAS,sBACf,OAAQ,MAA+B,WAAW;AAEtD;AAoDO,SAAS,qBAAqB,KAAsC;AAGzE,iBAAe,MAAM,SAAkB,MAAoE;AACzG,UAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,QAAI;AACF,YAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,aAAO,MAAM,KAAK,IAAI,gBAAgB,MAAM,CAAC;AAAA,IAC/C,SAAS,KAAK;AACZ,UAAI,2BAA2B,GAAG,GAAG;AACnC,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,uBAAuB,GAAG,GAAG;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAA,IAEvG,aAAa,CAAC,EAAE,QAAQ,MACtB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,aAAa,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;AAAA,IAE3F,kBAAkB,OAAO,EAAE,SAAS,OAAO,MAAM;AAC/C,UAAI,QAAQ,WAAW,UAAU;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,aAAO,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,MAAM,IAAI,iBAAiB,OAAO,YAAY,CAAC,CAAC;AAAA,IACrG;AAAA,IAEA,cAAc,CAAC,EAAE,QAAQ,MACvB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,cAAc,MAAM,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAAA,IAE7F,WAAW,OAAO,EAAE,QAAQ,MAAM;AAChC,UAAI,QAAQ,WAAW,QAAQ;AAC7B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,YAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,QAAQ,KAAK;AAAA,MAC7B,QAAQ;AACN,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,KAAK,cAAc,CAAC,KAAK,eAAe,CAAC,KAAK,WAAW;AAC5D,eAAO,SAAS,KAAK,EAAE,OAAO,sDAAsD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxG;AACA,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,cAAM,SAAS,MAAM,IAAI,gBAAgB,MAAM,EAAE,UAAU;AAAA,UACzD,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,WAAW,KAAK;AAAA,UAChB,iBAAiB,KAAK;AAAA,QACxB,CAAC;AACD,eAAO,SAAS,KAAK,EAAE,kBAAkB,OAAO,kBAAkB,OAAO,OAAO,MAAM,CAAC;AAAA,MACzF,SAAS,KAAK;AACZ,YAAI,2BAA2B,GAAG,GAAG;AACnC,iBAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzE;AACA,YAAI,uBAAuB,GAAG,GAAG;AAC/B,iBAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,QACrF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ACvMO,SAAS,wBAAwB,MAAiD;AACvF,SAAO,SAAS,SAAS,SAAS,eAAe,OAAO;AAC1D;AAEO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YACW,QACT,QACA;AACA,UAAM,4BAA4B,MAAM,MAAM,MAAM,EAAE;AAH7C;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAGO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAiFO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC/C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,oDAAoD;AAC3F,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,YAAY,KAAK,aAAa;AAEpC,WAAS,sBAA8B;AACrC,UAAM,QAAQ,OAAO,KAAK,iBAAiB,aAAa,KAAK,aAAa,IAAI,KAAK;AACnF,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iDAAiD;AAC7E,WAAO;AAAA,EACT;AAEA,iBAAe,QAAW,MAAc,MAAmB,SAA8B;AACvF,UAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,MAC/C,GAAG;AAAA,MACH;AAAA,MACA,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,YAAM,IAAI,yBAAyB,IAAI,QAAQ,MAAM,OAAO,WAAW,IAAI,UAAU;AAAA,IACvF;AACA,WAAO,IAAI,KAAK;AAAA,EAClB;AAEA,WAAS,SAAY,YAAoB,MAA0B;AACjE,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,iBAAiB,UAAU,UAAU,EAAE;AACnD,WAAO,QAAW,MAAM,CAAC,GAAG,OAAO;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,MAAM,gBAAgB,YAAY;AAChC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,YAAM,MAAM,KAAK,MAAM,gBAAgB;AACvC,aAAO,EAAE,MAAM,wBAAwB,KAAK,IAAI,GAAG,QAAQ,KAAK,UAAU,KAAK;AAAA,IACjF;AAAA,IAEA,MAAM,WAAW,YAAY;AAC3B,YAAM,OAAO,MAAM,SAGhB,YAAY,qBAAqB;AACpC,aAAO;AAAA,QACL,SAAS,KAAK,MAAM,WAAW;AAAA,QAC/B,eAAe,KAAK,MAAM,iBAAiB;AAAA,QAC3C,WAAW,KAAK,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,kBAAkB,YAAY;AAClC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,cAAQ,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS;AAAA,QACrC,SAAS,IAAI,WAAW;AAAA,QACxB,YAAY,IAAI,cAAc;AAAA,QAC9B,OAAO,IAAI,SAAS;AAAA,MACtB,EAAE;AAAA,IACJ;AAAA,IAEA,MAAM,sBAAsB,YAAY,WAAW;AACjD,YAAM,OAAO,mBAAmB,SAAS;AACzC,YAAM,OAAO,MAAM,SAShB,YAAY,2CAA2C,IAAI,EAAE;AAChE,YAAM,OAAO,KAAK,QAAQ,CAAC;AAC3B,YAAM,UAAU,KAAK,YAAY;AACjC,aAAO;AAAA,QACL,YAAY,KAAK,cAAc;AAAA,QAC/B,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C;AAAA;AAAA,QAEA,YAAY,CAAC,WAAW,KAAK,eAAe;AAAA,MAC9C;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO;AAClB,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,IAAI,iBAAiB,UAAU,oBAAoB,CAAC,EAAE;AAC9D,cAAQ,IAAI,kBAAkB,KAAK,WAAW;AAC9C,cAAQ,IAAI,gBAAgB,kBAAkB;AAC9C,YAAM,QAAQ,sBAAsB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,MAAM,MAAM;AAAA,UACZ,SAAS,KAAK;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,QACrB,CAAC;AAAA,MACH,GAAG,OAAO;AAAA,IACZ;AAAA,IAEA,aAAa;AACX,aAAO,GAAG,OAAO;AAAA,IACnB;AAAA,IAEA,gBAAgB,WAAW;AACzB,aAAO,gBAAgB,SAAS,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;AAQO,SAAS,gBAAgB,SAAiB,WAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AACvC,SAAO,GAAG,IAAI,sCAAsC,mBAAmB,SAAS,CAAC;AACnF;AASO,IAAM,6BAAuE;AAAA,EAClF,MAAM,EAAE,aAAa,GAAG,gBAAgB,MAAM;AAAA,EAC9C,KAAK,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAAA,EACnE,YAAY,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAC5E;AAiBA,eAAsB,oBACpB,MACA,YACA,SAAmD,4BACzB;AAC1B,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,MACL,MAAM;AAAA,MACN,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,GAAG,OAAO;AAAA,IACZ;AAAA,EACF;AACA,QAAM,CAAC,cAAc,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChD,KAAK,gBAAgB,UAAU;AAAA,IAC/B,KAAK,WAAW,UAAU;AAAA,EAC5B,CAAC;AACD,SAAO;AAAA,IACL,MAAM,aAAa;AAAA,IACnB,oBAAoB,aAAa;AAAA,IACjC,qBAAqB,QAAQ;AAAA,IAC7B,kBAAkB,QAAQ;AAAA,IAC1B,GAAG,OAAO,aAAa,IAAI;AAAA,EAC7B;AACF;AAMO,IAAM,0BAA0B;AAOhC,IAAM,uCAAuC;AAc7C,SAAS,qBAAqB,OAA+B,CAAC,GAAY;AAC/E,QAAM,MACJ,KAAK,QACJ,OAAO,YAAY,cAAe,QAAQ,MAA6C;AAC1F,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAO,IAAI,KAAK,cAAc,oCAAoC,GAAG,KAAK,EAAE,YAAY;AAC9F,SAAO,SAAS,UAAU,SAAS,OAAO,SAAS,QAAQ,SAAS;AACtE;AAYA,eAAsB,sBACpB,MACA,YACA,WACA,OAAO,MACsB;AAC7B,MAAI,CAAC,QAAQ,CAAC,WAAY,QAAO,oBAAoB;AACrD,MAAI;AACF,WAAO,MAAM,KAAK,sBAAsB,YAAY,SAAS;AAAA,EAC/D,QAAQ;AAGN,WAAO,oBAAoB;AAAA,EAC7B;AACF;AAEA,SAAS,sBAA0C;AACjD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AACF;AAIO,SAAS,kBAAkB,KAAkC;AAClE,SAAO,IAAI,WAAW,IAAI;AAC5B;AAUO,SAAS,kCACd,MACA,UACuC;AACvC,SAAO;AAAA,IACL,iBAAiB,CAAC,WAAW,SAAS,gBAAgB,MAAM;AAAA,IAC5D,SAAS,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,GAAG;AAAA,IAChE,YAAY,OAAO,WAAW;AAC5B,YAAM,WAAW,MAAM,KAAK,WAAW,MAAM;AAC7C,aAAO,EAAE,SAAS,SAAS,SAAS,eAAe,SAAS,cAAc;AAAA,IAC5E;AAAA,IACA,mBAAmB,CAAC,WAAW,KAAK,kBAAkB,MAAM;AAAA,IAC5D,QAAQ,CAAC,UAAU,KAAK,OAAO,KAAK;AAAA,EACtC;AACF;","names":[]}
+{"version":3,"sources":["../../src/platform/hub.ts","../../src/platform/billing.ts"],"sourcesContent":["/**\n * Integrations-hub proxy routes: the app-side surface that forwards an\n * authenticated user's requests to the platform's `/v1/integrations/*` API\n * using their stored platform key. Auth, key lookup, and the wire client are\n * structural seams (`HubProxyContext`); error detection is by name + shape so\n * it survives bundlers duplicating module instances.\n */\n\nimport {\n  resolveTangleDevOrUserKey,\n  type TangleExecutionEnvironment,\n  type TangleExecutionKeySource,\n} from '../runtime/model'\n\n/** Hub bearer provenance mirrors the execution-key source union. */\nexport type TangleHubBearerSource = TangleExecutionKeySource\n\n/** Represent a resolved bearer token with its associated TangleHub bearer source */\nexport interface ResolvedTangleHubBearer {\n  bearer: string\n  source: TangleHubBearerSource\n}\n\n/** Resolve options required to obtain a user's TangleHub bearer token including environment and API key retrieval */\nexport interface ResolveUserTangleHubBearerOptions {\n  userId: string\n  /** Deployment context. Only local development may use env credentials. */\n  environment?: TangleExecutionEnvironment\n  /** Env to read for the local-development bearer. */\n  env?: Record<string, string | undefined>\n  /** App-owned lookup for the caller's linked platform API key. */\n  getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>\n}\n\n/** Resolve options for retrieving a TangleHub bearer token for a specified user */\nexport interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {\n  userId: UserId\n  environment?: TangleExecutionEnvironment\n  env?: Record<string, string | undefined>\n  getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>\n}\n\n/** Represent missing Tangle platform link error for a specified user ID */\nexport class TangleBearerMissingError extends Error {\n  constructor(readonly userId: string) {\n    super(`No Tangle platform link for user ${userId}`)\n    this.name = 'TangleBearerMissingError'\n  }\n}\n\n/**\n * Resolve the Tangle bearer used by the integration hub proxy.\n *\n * Local development may use a server env key so apps can exercise the hub\n * without completing cross-site SSO. Deployed contexts must use the caller's\n * linked platform key; this keeps integration ownership aligned with the user.\n */\nexport async function resolveUserTangleHubBearer(\n  opts: ResolveUserTangleHubBearerOptions,\n): Promise<ResolvedTangleHubBearer> {\n  const resolved = await resolveTangleDevOrUserKey({\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: opts.getUserApiKey,\n  })\n  if (resolved) return { bearer: resolved.apiKey, source: resolved.source }\n\n  throw new TangleBearerMissingError(opts.userId)\n}\n\n/** Resolve the TangleHub bearer token for a specified user based on provided options */\nexport async function resolveUserTangleHubBearerForUser<UserId = string>(\n  opts: ResolveUserTangleHubBearerForUserOptions<UserId>,\n): Promise<ResolvedTangleHubBearer> {\n  return resolveUserTangleHubBearer({\n    userId: String(opts.userId),\n    environment: opts.environment,\n    env: opts.env,\n    getUserApiKey: () => opts.getUserApiKey(opts.userId),\n  })\n}\n\n/** Structural guard (name + userId shape) — robust when the error class is\n *  constructed in a different module instance than the one checking it. */\nexport function isTangleBearerMissingError(error: unknown): error is TangleBearerMissingError {\n  return (\n    error instanceof Error &&\n    error.name === 'TangleBearerMissingError' &&\n    typeof (error as { userId?: unknown }).userId === 'string'\n  )\n}\n\n/** Structural detection of the platform hub wire error (name + numeric status). */\nexport function isPlatformHubErrorLike(error: unknown): error is Error & { status: number; code?: string } {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformHubError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\n/** Structural subset of the platform hub wire client — extra methods are fine. */\nexport interface HubClientLike {\n  catalog(): Promise<unknown>\n  listConnections(): Promise<unknown>\n  revokeConnection(connectionId: string): Promise<unknown>\n  startAuth(input: {\n    providerId: string\n    connectorId: string\n    returnUrl: string\n    requestedScopes?: string[]\n  }): Promise<{ authorizationUrl: string; state: string }>\n  listHealthchecks(): Promise<unknown>\n}\n\n/** Define methods to require user ID, get bearer token, and create a hub client bound to the bearer */\nexport interface HubProxyContext {\n  /** Resolve the authenticated user id. Throw the app's own auth Response /\n   *  redirect to reject — it propagates untouched. */\n  requireUserId(request: Request): Promise<string>\n  /** The user's platform bearer; throw `TangleBearerMissingError` when unlinked. */\n  getBearer(userId: string): Promise<string>\n  /** A hub client bound to the bearer. */\n  createHubClient(bearer: string): HubClientLike\n}\n\n/** Define arguments for configuring a proxy route with request and optional parameters */\nexport interface HubProxyRouteArgs {\n  request: Request\n  params?: Record<string, string | undefined>\n}\n\n/** Define routes for hub proxy handling catalog, connections, healthchecks, and authorization actions */\nexport interface HubProxyRoutes {\n  /** GET → `{ catalog }`. */\n  catalog(args: HubProxyRouteArgs): Promise<Response>\n  /** GET → `{ connections }`. */\n  connections(args: HubProxyRouteArgs): Promise<Response>\n  /** DELETE → the platform revocation result verbatim; 405 otherwise. */\n  connectionDelete(args: { request: Request; params: { connectionId: string } }): Promise<Response>\n  /** GET → `{ healthchecks }`. */\n  healthchecks(args: HubProxyRouteArgs): Promise<Response>\n  /** POST `{ providerId, connectorId, returnUrl, requestedScopes? }` →\n   *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */\n  authStart(args: HubProxyRouteArgs): Promise<Response>\n}\n\ninterface StartAuthBody {\n  providerId?: string\n  connectorId?: string\n  returnUrl?: string\n  requestedScopes?: string[]\n}\n\n/** Resolve hub proxy routes with authentication and error handling based on the given context */\nexport function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes {\n  /** Auth runs OUTSIDE the proxy try/catch so the app's auth throw (redirect\n   *  Response etc.) is never swallowed; bearer + platform errors are mapped. */\n  async function proxy(request: Request, call: (hub: HubClientLike) => Promise<Response>): Promise<Response> {\n    const userId = await ctx.requireUserId(request)\n    try {\n      const bearer = await ctx.getBearer(userId)\n      return await call(ctx.createHubClient(bearer))\n    } catch (err) {\n      if (isTangleBearerMissingError(err)) {\n        return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n      }\n      if (isPlatformHubErrorLike(err)) {\n        return Response.json({ error: err.message, code: err.code }, { status: err.status })\n      }\n      throw err\n    }\n  }\n\n  return {\n    catalog: ({ request }) => proxy(request, async (hub) => Response.json({ catalog: await hub.catalog() })),\n\n    connections: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ connections: await hub.listConnections() })),\n\n    connectionDelete: async ({ request, params }) => {\n      if (request.method !== 'DELETE') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      return proxy(request, async (hub) => Response.json(await hub.revokeConnection(params.connectionId)))\n    },\n\n    healthchecks: ({ request }) =>\n      proxy(request, async (hub) => Response.json({ healthchecks: await hub.listHealthchecks() })),\n\n    authStart: async ({ request }) => {\n      if (request.method !== 'POST') {\n        return Response.json({ error: 'Method not allowed' }, { status: 405 })\n      }\n      const userId = await ctx.requireUserId(request)\n      let body: StartAuthBody\n      try {\n        body = (await request.json()) as StartAuthBody\n      } catch {\n        return Response.json({ error: 'Invalid JSON body' }, { status: 400 })\n      }\n      if (!body.providerId || !body.connectorId || !body.returnUrl) {\n        return Response.json({ error: 'providerId, connectorId, and returnUrl are required' }, { status: 400 })\n      }\n      try {\n        const bearer = await ctx.getBearer(userId)\n        const result = await ctx.createHubClient(bearer).startAuth({\n          providerId: body.providerId,\n          connectorId: body.connectorId,\n          returnUrl: body.returnUrl,\n          requestedScopes: body.requestedScopes,\n        })\n        return Response.json({ authorizationUrl: result.authorizationUrl, state: result.state })\n      } catch (err) {\n        if (isTangleBearerMissingError(err)) {\n          return Response.json({ error: 'tangle_link_required' }, { status: 412 })\n        }\n        if (isPlatformHubErrorLike(err)) {\n          return Response.json({ error: err.message, code: err.code }, { status: err.status })\n        }\n        throw err\n      }\n    },\n  }\n}\n","/**\n * Platform billing HTTP transport + tier state for apps on the shared\n * Tangle balance model (id.tangle.tools). Reads authenticate as the user via\n * their per-user platform key (the platform resolves the caller from the\n * key; service or impersonation headers on read routes are rejected). The\n * deduct write authenticates as the product service (`Bearer <serviceToken>`\n * + `X-Service-Name`) and names the target user in the body. Also provides a\n * fetch-backed implementation of the `/billing` module's\n * `PlatformBillingClient` seam (type-only import — no runtime coupling).\n */\n\nimport type { PlatformBillingClient, PlatformIdentity } from '../billing/index'\n\n/** Define available subscription tiers for the TanglePlan service */\nexport type TanglePlanTier = 'free' | 'pro' | 'enterprise'\n\n/** 'pro' | 'enterprise' pass through; anything else (null, unknown) → 'free'. */\nexport function normalizeTanglePlanTier(plan: string | null | undefined): TanglePlanTier {\n  return plan === 'pro' || plan === 'enterprise' ? plan : 'free'\n}\n\n/** Represent platform billing HTTP errors with status code and detailed message */\nexport class PlatformBillingHttpError extends Error {\n  constructor(\n    readonly status: number,\n    detail: string,\n  ) {\n    super(`Platform request failed (${status}): ${detail}`)\n    this.name = 'PlatformBillingHttpError'\n  }\n}\n\n/** Structural guard (name + numeric status) — robust across module instances. */\nexport function isPlatformBillingHttpError(error: unknown): error is PlatformBillingHttpError {\n  return (\n    error instanceof Error &&\n    error.name === 'PlatformBillingHttpError' &&\n    typeof (error as { status?: unknown }).status === 'number'\n  )\n}\n\n/** Define HTTP options for platform billing including base URL, service token, product slug, fetch implementation, and timeout */\nexport interface PlatformBillingHttpOptions {\n  /** Platform root, e.g. https://id.tangle.tools (trailing slashes stripped). */\n  baseUrl: string\n  /** Used only by `deduct()`; resolved lazily so reads never require it.\n   *  Throws at call time when empty. */\n  serviceToken: string | (() => string)\n  /** Product slug — the `X-Service-Name` header and the deduct `product` field. */\n  productSlug: string\n  fetchImpl?: typeof fetch\n  /** Default 10 000. */\n  timeoutMs?: number\n}\n\n/** Describe subscription tier and status information for a platform user */\nexport interface PlatformSubscriptionInfo {\n  tier: TanglePlanTier\n  status: string | null\n}\n\n/** Describe the platform balance and lifetime spending with an optional update timestamp */\nexport interface PlatformBalanceSnapshot {\n  balance: number\n  lifetimeSpent: number\n  updatedAt?: string\n}\n\n/** Describe a product's usage and spending metrics on the platform */\nexport interface PlatformUsageProductRow {\n  product: string | null\n  totalSpent: number\n  count: number\n}\n\n/** Lifecycle of a per-product seat subscription, mirroring the Stripe states\n *  the platform persists. 'none' = the user has never held this seat. */\nexport type SeatStatus = 'none' | 'active' | 'trialing' | 'past_due' | 'canceled'\n\n/**\n * Per-product entitlement snapshot from the platform — the single read that\n * tells a product whether to show its workspace or the seat paywall. Shape\n * matches `GET /v1/billing/product-entitlement?product=<id>`.\n *\n * `hasSeat` and `onFreeTier` are computed platform-side from the raw seat row\n * + cumulative spend so the gate is identical across all five products:\n * - `hasSeat`     — an active/trialing seat whose period has not lapsed.\n * - `onFreeTier`  — no active seat AND cumulative spend below the free cap\n *                   ($2 / 200¢ lifetime). Keys off lifetime spend, not wallet\n *                   balance, so a router top-up never re-opens free access.\n */\nexport interface ProductEntitlement {\n  seatStatus: SeatStatus\n  /** ISO timestamp the active seat's paid period runs until; null when none. */\n  currentPeriodEnd: string | null\n  /** Cumulative inference spend across the whole suite, in dollars. */\n  lifetimeSpentUsd: number\n  hasSeat: boolean\n  onFreeTier: boolean\n}\n\n/** Define methods to interact with platform billing endpoints using user or service authentication */\nexport interface PlatformBillingHttp {\n  /** GET /v1/plans/current (user bearer). */\n  getSubscription(userApiKey: string): Promise<PlatformSubscriptionInfo>\n  /** GET /v1/billing/balance (user bearer). */\n  getBalance(userApiKey: string): Promise<PlatformBalanceSnapshot>\n  /** GET /v1/billing/usage (user bearer). */\n  getUsageByProduct(userApiKey: string): Promise<PlatformUsageProductRow[]>\n  /** GET /v1/billing/product-entitlement?product=<id> (user bearer). */\n  getProductEntitlement(userApiKey: string, productId: string): Promise<ProductEntitlement>\n  /** POST /v1/billing/deduct (service token). */\n  deduct(input: {\n    platformUserId: string\n    amountUsd: number\n    type: string\n    description: string\n    referenceId: string\n  }): Promise<void>\n  /** Absolute URL of the platform's billing-management surface. */\n  billingUrl(): string\n  /** Absolute URL of the $100/mo seat checkout for `productId`. */\n  seatCheckoutUrl(productId: string): string\n}\n\n/** Create a PlatformBillingHttp instance configured with given options and default behaviors */\nexport function createPlatformBillingHttp(opts: PlatformBillingHttpOptions): PlatformBillingHttp {\n  const baseUrl = opts.baseUrl.replace(/\\/+$/, '')\n  if (!baseUrl) throw new Error('PlatformBillingHttpOptions.baseUrl is required')\n  if (!opts.productSlug) throw new Error('PlatformBillingHttpOptions.productSlug is required')\n  const fetchImpl = opts.fetchImpl ?? fetch\n  const timeoutMs = opts.timeoutMs ?? 10_000\n\n  function resolveServiceToken(): string {\n    const token = typeof opts.serviceToken === 'function' ? opts.serviceToken() : opts.serviceToken\n    if (!token) throw new Error('A platform service token is required for deduct')\n    return token\n  }\n\n  async function request<T>(path: string, init: RequestInit, headers: Headers): Promise<T> {\n    const res = await fetchImpl(`${baseUrl}${path}`, {\n      ...init,\n      headers,\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n    if (!res.ok) {\n      const body = (await res.json().catch(() => null)) as { error?: { message?: string } } | null\n      throw new PlatformBillingHttpError(res.status, body?.error?.message ?? res.statusText)\n    }\n    return res.json() as Promise<T>\n  }\n\n  function userRead<T>(userApiKey: string, path: string): Promise<T> {\n    const headers = new Headers()\n    headers.set('Authorization', `Bearer ${userApiKey}`)\n    return request<T>(path, {}, headers)\n  }\n\n  return {\n    async getSubscription(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { subscription?: { plan?: string | null; status?: string | null } | null }\n      }>(userApiKey, '/v1/plans/current')\n      const sub = body.data?.subscription ?? null\n      return { tier: normalizeTanglePlanTier(sub?.plan), status: sub?.status ?? null }\n    },\n\n    async getBalance(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: { balance?: number; lifetimeSpent?: number; updatedAt?: string }\n      }>(userApiKey, '/v1/billing/balance')\n      return {\n        balance: body.data?.balance ?? 0,\n        lifetimeSpent: body.data?.lifetimeSpent ?? 0,\n        updatedAt: body.data?.updatedAt,\n      }\n    },\n\n    async getUsageByProduct(userApiKey) {\n      const body = await userRead<{\n        success: boolean\n        data?: Array<{ product?: string | null; totalSpent?: number; count?: number }>\n      }>(userApiKey, '/v1/billing/usage')\n      return (body.data ?? []).map((row) => ({\n        product: row.product ?? null,\n        totalSpent: row.totalSpent ?? 0,\n        count: row.count ?? 0,\n      }))\n    },\n\n    async getProductEntitlement(userApiKey, productId) {\n      const slug = encodeURIComponent(productId)\n      const body = await userRead<{\n        success: boolean\n        data?: {\n          seatStatus?: SeatStatus | null\n          currentPeriodEnd?: string | null\n          lifetimeSpentUsd?: number | null\n          hasSeat?: boolean | null\n          onFreeTier?: boolean | null\n        }\n      }>(userApiKey, `/v1/billing/product-entitlement?product=${slug}`)\n      const data = body.data ?? {}\n      const hasSeat = data.hasSeat === true\n      return {\n        seatStatus: data.seatStatus ?? 'none',\n        currentPeriodEnd: data.currentPeriodEnd ?? null,\n        lifetimeSpentUsd: data.lifetimeSpentUsd ?? 0,\n        hasSeat,\n        // Free access only when there is no seat AND the platform says so.\n        onFreeTier: !hasSeat && data.onFreeTier === true,\n      }\n    },\n\n    async deduct(input) {\n      const headers = new Headers()\n      headers.set('Authorization', `Bearer ${resolveServiceToken()}`)\n      headers.set('X-Service-Name', opts.productSlug)\n      headers.set('Content-Type', 'application/json')\n      await request('/v1/billing/deduct', {\n        method: 'POST',\n        body: JSON.stringify({\n          userId: input.platformUserId,\n          amount: input.amountUsd,\n          type: input.type,\n          product: opts.productSlug,\n          description: input.description,\n          referenceId: input.referenceId,\n        }),\n      }, headers)\n    },\n\n    billingUrl() {\n      return `${baseUrl}/app/billing`\n    },\n\n    seatCheckoutUrl(productId) {\n      return seatCheckoutUrl(baseUrl, productId)\n    },\n  }\n}\n\n/**\n * Platform Stripe checkout URL for a product's $100/mo seat. One shared price\n * carries `metadata.productId`; the platform distinguishes the product from\n * the `product` query param (not five distinct prices). Mirrors the\n * `billingUrl()` shape — a deterministic platform-rooted URL, no network call.\n */\nexport function seatCheckoutUrl(baseUrl: string, productId: string): string {\n  const root = baseUrl.replace(/\\/+$/, '')\n  return `${root}/app/billing/seat/checkout?product=${encodeURIComponent(productId)}`\n}\n\n// ── Tier policy + composed state ────────────────────────────────────────────\n\n/** Define policy settings for concurrency and overage allowance in a tangle tier */\nexport interface TangleTierPolicy {\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/** Define default concurrency and overage policies for each TanglePlanTier level */\nexport const DEFAULT_TANGLE_TIER_POLICY: Record<TanglePlanTier, TangleTierPolicy> = {\n  free: { concurrency: 1, overageAllowed: false },\n  pro: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n  enterprise: { concurrency: Number.POSITIVE_INFINITY, overageAllowed: true },\n}\n\n/** Describe the state of a Tangle plan tier including subscription, balance, spending, and concurrency details */\nexport interface TangleTierState {\n  tier: TanglePlanTier\n  subscriptionStatus: string | null\n  remainingBalanceUsd: number\n  lifetimeSpentUsd: number\n  concurrency: number\n  overageAllowed: boolean\n}\n\n/**\n * Read subscription + balance and project them onto the tier policy. A\n * null/absent key fails CLOSED (free tier, zero balance) — a billable run is\n * never started against an unknown balance. Platform errors throw; callers\n * on the billable path choose their posture explicitly.\n */\nexport async function readTangleTierState(\n  http: PlatformBillingHttp,\n  userApiKey: string | null | undefined,\n  policy: Record<TanglePlanTier, TangleTierPolicy> = DEFAULT_TANGLE_TIER_POLICY,\n): Promise<TangleTierState> {\n  if (!userApiKey) {\n    return {\n      tier: 'free',\n      subscriptionStatus: null,\n      remainingBalanceUsd: 0,\n      lifetimeSpentUsd: 0,\n      ...policy.free,\n    }\n  }\n  const [subscription, balance] = await Promise.all([\n    http.getSubscription(userApiKey),\n    http.getBalance(userApiKey),\n  ])\n  return {\n    tier: subscription.tier,\n    subscriptionStatus: subscription.status,\n    remainingBalanceUsd: balance.balance,\n    lifetimeSpentUsd: balance.lifetimeSpent,\n    ...policy[subscription.tier],\n  }\n}\n\n// ── Per-product seat entitlement ────────────────────────────────────────────\n\n/** Lifetime free-tier cap: $2 (200¢) cumulative inference spend, expressed in\n *  dollars. Free product access ends once cumulative spend crosses this. */\nexport const FREE_TIER_SPEND_CAP_USD = 2\n\n/**\n * Default name of the per-app feature flag gating seat billing. While OFF the\n * entitlement read is skipped and access fails OPEN (entitled) so nothing\n * changes live until a product flips the flag.\n */\nexport const DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR = 'SEAT_BILLING_ENABLED'\n\n/** Define options to configure seat billing flag environment variables and override flag name */\nexport interface SeatBillingFlagOptions {\n  env?: Record<string, string | undefined>\n  /** Override the flag name; default {@link DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR}. */\n  flagEnvVar?: string\n}\n\n/**\n * Seat billing is OFF unless the flag is explicitly truthy ('true'/'1'/'on'/\n * 'enabled'). Default OFF — pre-rollout, the paywall never engages. Returns\n * false when no env is available (browser bundles) so the client stays\n * fail-open there too.\n */\nexport function isSeatBillingEnabled(opts: SeatBillingFlagOptions = {}): boolean {\n  const env =\n    opts.env ??\n    (typeof process !== 'undefined' ? (process.env as Record<string, string | undefined>) : undefined)\n  if (!env) return false\n  const flag = env[opts.flagEnvVar ?? DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR]?.trim().toLowerCase()\n  return flag === 'true' || flag === '1' || flag === 'on' || flag === 'enabled'\n}\n\n/**\n * Read a user's entitlement for one product. Fails OPEN: an absent key,\n * disabled flag, or unreachable seat endpoint all return a permissive snapshot\n * (`hasSeat: true`) so consumers never break pre-rollout. The platform owns the\n * `hasSeat`/`onFreeTier` computation; this client only transports + degrades\n * safely.\n *\n * @param flag — pass {@link isSeatBillingEnabled} (or your own boolean) so the\n *   product owns when the gate engages. When false, no network call is made.\n */\nexport async function getProductEntitlement(\n  http: Pick<PlatformBillingHttp, 'getProductEntitlement'>,\n  userApiKey: string | null | undefined,\n  productId: string,\n  flag = true,\n): Promise<ProductEntitlement> {\n  if (!flag || !userApiKey) return failOpenEntitlement()\n  try {\n    return await http.getProductEntitlement(userApiKey, productId)\n  } catch {\n    // Seat endpoint unavailable (pre-rollout platform, transient 5xx): never\n    // wall a paying or grandfathered user on a transport hiccup.\n    return failOpenEntitlement()\n  }\n}\n\nfunction failOpenEntitlement(): ProductEntitlement {\n  return {\n    seatStatus: 'active',\n    currentPeriodEnd: null,\n    lifetimeSpentUsd: 0,\n    hasSeat: true,\n    onFreeTier: false,\n  }\n}\n\n/** Entitled = holds an active seat OR is still inside the free tier. The one\n *  predicate all five products gate on. */\nexport function isProductEntitled(ent: ProductEntitlement): boolean {\n  return ent.hasSeat || ent.onFreeTier\n}\n\n// ── Bridge onto the /billing seam ───────────────────────────────────────────\n\n/** Define a contract for resolving platform identities based on user identifiers */\nexport interface PlatformIdentityStore {\n  resolveIdentity(userId: string): Promise<PlatformIdentity | null>\n}\n\n/** Concrete fetch-backed `PlatformBillingClient<TanglePlanTier>` for\n *  `createPlatformBalanceManager` (from `/billing`). */\nexport function createTanglePlatformBillingClient(\n  http: PlatformBillingHttp,\n  identity: PlatformIdentityStore,\n): PlatformBillingClient<TanglePlanTier> {\n  return {\n    resolveIdentity: (userId) => identity.resolveIdentity(userId),\n    getPlan: async (apiKey) => (await http.getSubscription(apiKey)).tier,\n    getBalance: async (apiKey) => {\n      const snapshot = await http.getBalance(apiKey)\n      return { balance: snapshot.balance, lifetimeSpent: snapshot.lifetimeSpent }\n    },\n    getUsageByProduct: (apiKey) => http.getUsageByProduct(apiKey),\n    deduct: (input) => http.deduct(input),\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2CO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAqB,QAAgB;AACnC,UAAM,oCAAoC,MAAM,EAAE;AAD/B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AASA,eAAsB,2BACpB,MACkC;AAClC,QAAM,WAAW,MAAM,0BAA0B;AAAA,IAC/C,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,KAAK;AAAA,EACtB,CAAC;AACD,MAAI,SAAU,QAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,SAAS,OAAO;AAExE,QAAM,IAAI,yBAAyB,KAAK,MAAM;AAChD;AAGA,eAAsB,kCACpB,MACkC;AAClC,SAAO,2BAA2B;AAAA,IAChC,QAAQ,OAAO,KAAK,MAAM;AAAA,IAC1B,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK;AAAA,IACV,eAAe,MAAM,KAAK,cAAc,KAAK,MAAM;AAAA,EACrD,CAAC;AACH;AAIO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAGO,SAAS,uBAAuB,OAAoE;AACzG,SACE,iBAAiB,SACjB,MAAM,SAAS,sBACf,OAAQ,MAA+B,WAAW;AAEtD;AAwDO,SAAS,qBAAqB,KAAsC;AAGzE,iBAAe,MAAM,SAAkB,MAAoE;AACzG,UAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,QAAI;AACF,YAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,aAAO,MAAM,KAAK,IAAI,gBAAgB,MAAM,CAAC;AAAA,IAC/C,SAAS,KAAK;AACZ,UAAI,2BAA2B,GAAG,GAAG;AACnC,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,uBAAuB,GAAG,GAAG;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,MACrF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,SAAS,CAAC,EAAE,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,SAAS,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;AAAA,IAEvG,aAAa,CAAC,EAAE,QAAQ,MACtB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,aAAa,MAAM,IAAI,gBAAgB,EAAE,CAAC,CAAC;AAAA,IAE3F,kBAAkB,OAAO,EAAE,SAAS,OAAO,MAAM;AAC/C,UAAI,QAAQ,WAAW,UAAU;AAC/B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,aAAO,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,MAAM,IAAI,iBAAiB,OAAO,YAAY,CAAC,CAAC;AAAA,IACrG;AAAA,IAEA,cAAc,CAAC,EAAE,QAAQ,MACvB,MAAM,SAAS,OAAO,QAAQ,SAAS,KAAK,EAAE,cAAc,MAAM,IAAI,iBAAiB,EAAE,CAAC,CAAC;AAAA,IAE7F,WAAW,OAAO,EAAE,QAAQ,MAAM;AAChC,UAAI,QAAQ,WAAW,QAAQ;AAC7B,eAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACvE;AACA,YAAM,SAAS,MAAM,IAAI,cAAc,OAAO;AAC9C,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,QAAQ,KAAK;AAAA,MAC7B,QAAQ;AACN,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,KAAK,cAAc,CAAC,KAAK,eAAe,CAAC,KAAK,WAAW;AAC5D,eAAO,SAAS,KAAK,EAAE,OAAO,sDAAsD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxG;AACA,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,UAAU,MAAM;AACzC,cAAM,SAAS,MAAM,IAAI,gBAAgB,MAAM,EAAE,UAAU;AAAA,UACzD,YAAY,KAAK;AAAA,UACjB,aAAa,KAAK;AAAA,UAClB,WAAW,KAAK;AAAA,UAChB,iBAAiB,KAAK;AAAA,QACxB,CAAC;AACD,eAAO,SAAS,KAAK,EAAE,kBAAkB,OAAO,kBAAkB,OAAO,OAAO,MAAM,CAAC;AAAA,MACzF,SAAS,KAAK;AACZ,YAAI,2BAA2B,GAAG,GAAG;AACnC,iBAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,QACzE;AACA,YAAI,uBAAuB,GAAG,GAAG;AAC/B,iBAAO,SAAS,KAAK,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,QACrF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;AC/MO,SAAS,wBAAwB,MAAiD;AACvF,SAAO,SAAS,SAAS,SAAS,eAAe,OAAO;AAC1D;AAGO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YACW,QACT,QACA;AACA,UAAM,4BAA4B,MAAM,MAAM,MAAM,EAAE;AAH7C;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EALW;AAMb;AAGO,SAAS,2BAA2B,OAAmD;AAC5F,SACE,iBAAiB,SACjB,MAAM,SAAS,8BACf,OAAQ,MAA+B,WAAW;AAEtD;AAuFO,SAAS,0BAA0B,MAAuD;AAC/F,QAAM,UAAU,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC/C,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,gDAAgD;AAC9E,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,oDAAoD;AAC3F,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,YAAY,KAAK,aAAa;AAEpC,WAAS,sBAA8B;AACrC,UAAM,QAAQ,OAAO,KAAK,iBAAiB,aAAa,KAAK,aAAa,IAAI,KAAK;AACnF,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iDAAiD;AAC7E,WAAO;AAAA,EACT;AAEA,iBAAe,QAAW,MAAc,MAAmB,SAA8B;AACvF,UAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,MAC/C,GAAG;AAAA,MACH;AAAA,MACA,QAAQ,YAAY,QAAQ,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,YAAM,IAAI,yBAAyB,IAAI,QAAQ,MAAM,OAAO,WAAW,IAAI,UAAU;AAAA,IACvF;AACA,WAAO,IAAI,KAAK;AAAA,EAClB;AAEA,WAAS,SAAY,YAAoB,MAA0B;AACjE,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,IAAI,iBAAiB,UAAU,UAAU,EAAE;AACnD,WAAO,QAAW,MAAM,CAAC,GAAG,OAAO;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,MAAM,gBAAgB,YAAY;AAChC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,YAAM,MAAM,KAAK,MAAM,gBAAgB;AACvC,aAAO,EAAE,MAAM,wBAAwB,KAAK,IAAI,GAAG,QAAQ,KAAK,UAAU,KAAK;AAAA,IACjF;AAAA,IAEA,MAAM,WAAW,YAAY;AAC3B,YAAM,OAAO,MAAM,SAGhB,YAAY,qBAAqB;AACpC,aAAO;AAAA,QACL,SAAS,KAAK,MAAM,WAAW;AAAA,QAC/B,eAAe,KAAK,MAAM,iBAAiB;AAAA,QAC3C,WAAW,KAAK,MAAM;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,kBAAkB,YAAY;AAClC,YAAM,OAAO,MAAM,SAGhB,YAAY,mBAAmB;AAClC,cAAQ,KAAK,QAAQ,CAAC,GAAG,IAAI,CAAC,SAAS;AAAA,QACrC,SAAS,IAAI,WAAW;AAAA,QACxB,YAAY,IAAI,cAAc;AAAA,QAC9B,OAAO,IAAI,SAAS;AAAA,MACtB,EAAE;AAAA,IACJ;AAAA,IAEA,MAAM,sBAAsB,YAAY,WAAW;AACjD,YAAM,OAAO,mBAAmB,SAAS;AACzC,YAAM,OAAO,MAAM,SAShB,YAAY,2CAA2C,IAAI,EAAE;AAChE,YAAM,OAAO,KAAK,QAAQ,CAAC;AAC3B,YAAM,UAAU,KAAK,YAAY;AACjC,aAAO;AAAA,QACL,YAAY,KAAK,cAAc;AAAA,QAC/B,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C;AAAA;AAAA,QAEA,YAAY,CAAC,WAAW,KAAK,eAAe;AAAA,MAC9C;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,OAAO;AAClB,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,IAAI,iBAAiB,UAAU,oBAAoB,CAAC,EAAE;AAC9D,cAAQ,IAAI,kBAAkB,KAAK,WAAW;AAC9C,cAAQ,IAAI,gBAAgB,kBAAkB;AAC9C,YAAM,QAAQ,sBAAsB;AAAA,QAClC,QAAQ;AAAA,QACR,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ,MAAM;AAAA,UACd,QAAQ,MAAM;AAAA,UACd,MAAM,MAAM;AAAA,UACZ,SAAS,KAAK;AAAA,UACd,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,QACrB,CAAC;AAAA,MACH,GAAG,OAAO;AAAA,IACZ;AAAA,IAEA,aAAa;AACX,aAAO,GAAG,OAAO;AAAA,IACnB;AAAA,IAEA,gBAAgB,WAAW;AACzB,aAAO,gBAAgB,SAAS,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;AAQO,SAAS,gBAAgB,SAAiB,WAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AACvC,SAAO,GAAG,IAAI,sCAAsC,mBAAmB,SAAS,CAAC;AACnF;AAWO,IAAM,6BAAuE;AAAA,EAClF,MAAM,EAAE,aAAa,GAAG,gBAAgB,MAAM;AAAA,EAC9C,KAAK,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAAA,EACnE,YAAY,EAAE,aAAa,OAAO,mBAAmB,gBAAgB,KAAK;AAC5E;AAkBA,eAAsB,oBACpB,MACA,YACA,SAAmD,4BACzB;AAC1B,MAAI,CAAC,YAAY;AACf,WAAO;AAAA,MACL,MAAM;AAAA,MACN,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,MAClB,GAAG,OAAO;AAAA,IACZ;AAAA,EACF;AACA,QAAM,CAAC,cAAc,OAAO,IAAI,MAAM,QAAQ,IAAI;AAAA,IAChD,KAAK,gBAAgB,UAAU;AAAA,IAC/B,KAAK,WAAW,UAAU;AAAA,EAC5B,CAAC;AACD,SAAO;AAAA,IACL,MAAM,aAAa;AAAA,IACnB,oBAAoB,aAAa;AAAA,IACjC,qBAAqB,QAAQ;AAAA,IAC7B,kBAAkB,QAAQ;AAAA,IAC1B,GAAG,OAAO,aAAa,IAAI;AAAA,EAC7B;AACF;AAMO,IAAM,0BAA0B;AAOhC,IAAM,uCAAuC;AAe7C,SAAS,qBAAqB,OAA+B,CAAC,GAAY;AAC/E,QAAM,MACJ,KAAK,QACJ,OAAO,YAAY,cAAe,QAAQ,MAA6C;AAC1F,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAO,IAAI,KAAK,cAAc,oCAAoC,GAAG,KAAK,EAAE,YAAY;AAC9F,SAAO,SAAS,UAAU,SAAS,OAAO,SAAS,QAAQ,SAAS;AACtE;AAYA,eAAsB,sBACpB,MACA,YACA,WACA,OAAO,MACsB;AAC7B,MAAI,CAAC,QAAQ,CAAC,WAAY,QAAO,oBAAoB;AACrD,MAAI;AACF,WAAO,MAAM,KAAK,sBAAsB,YAAY,SAAS;AAAA,EAC/D,QAAQ;AAGN,WAAO,oBAAoB;AAAA,EAC7B;AACF;AAEA,SAAS,sBAA0C;AACjD,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,kBAAkB;AAAA,IAClB,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AACF;AAIO,SAAS,kBAAkB,KAAkC;AAClE,SAAO,IAAI,WAAW,IAAI;AAC5B;AAWO,SAAS,kCACd,MACA,UACuC;AACvC,SAAO;AAAA,IACL,iBAAiB,CAAC,WAAW,SAAS,gBAAgB,MAAM;AAAA,IAC5D,SAAS,OAAO,YAAY,MAAM,KAAK,gBAAgB,MAAM,GAAG;AAAA,IAChE,YAAY,OAAO,WAAW;AAC5B,YAAM,WAAW,MAAM,KAAK,WAAW,MAAM;AAC7C,aAAO,EAAE,SAAS,SAAS,SAAS,eAAe,SAAS,cAAc;AAAA,IAC5E;AAAA,IACA,mBAAmB,CAAC,WAAW,KAAK,kBAAkB,MAAM;AAAA,IAC5D,QAAQ,CAAC,UAAU,KAAK,OAAO,KAAK;AAAA,EACtC;AACF;","names":[]}

package/dist/preflight/index.d.ts

@@ -54,6 +54,7 @@ interface PreflightReport {
     criticalFailures: number;
     durationMs: number;
 }
+/** Define configuration options for probing an LLM router with authentication and model details */
 interface RouterChatProbeConfig {
     /** LLM router base URL (LiteLLM / OpenAI-compatible), e.g. `https://router…`. */
     baseUrl: string;
@@ -79,6 +80,7 @@ interface RouterChatProbeConfig {
  * provider down (key still valid); timeout / unreachable → check the router URL.
  */
 declare function routerChatProbe(config: RouterChatProbeConfig): PreflightProbe;
+/** Define configuration options for probing sandbox authentication endpoints */
 interface SandboxAuthProbeConfig {
     /** Sandbox API base URL. */
     baseUrl: string;
@@ -102,6 +104,7 @@ interface SandboxAuthProbeConfig {
  * still valid); timeout / unreachable → check the sandbox URL.
  */
 declare function sandboxAuthProbe(config: SandboxAuthProbeConfig): PreflightProbe;
+/** Define configuration options for performing an HTTP HEAD probe to check URL availability */
 interface HttpHeadProbeConfig {
     /** Probe name in the report. */
     name: string;

package/dist/preflight/index.js

@@ -4,7 +4,7 @@ import {
   routerChatProbe,
   runPreflight,
   sandboxAuthProbe
-} from "../chunk-Q4TKVF3L.js";
+} from "../chunk-JTLYXUEV.js";
 export {
   formatPreflightReport,
   httpHeadProbe,

package/dist/preset-cloudflare/index.d.ts

@@ -1,6 +1,6 @@
 import { KeyProvisioner, KeyCrypto, WorkspaceKeyManager, WorkspaceKeyStore } from '../billing/index.js';
 import { KnowledgeStateAccessor } from '../knowledge/index.js';
-import { e as AppToolHandlers } from '../types-BEOvc_ue.js';
+import { e as AppToolHandlers } from '../types-CBRyqijY.js';
 import { KvLike } from '../web/index.js';
 import '@tangle-network/agent-eval';
 
@@ -147,6 +147,7 @@ declare function createPresetDrizzleSchema(d: DrizzleSqliteCoreLike): {
 /** The KV-backed vault. `KvLike` (from `../web`) is the structural KV contract;
  *  Cloudflare `KVNamespace` satisfies it. Artifacts are stored under their path. */
 type VaultKv = KvLike;
+/** Define configuration options for handling preset tools including database, vault, and optional utilities */
 interface PresetToolHandlerOptions {
     /** The D1 database (Cloudflare `D1Database` satisfies {@link D1Like}). */
     db: D1Like;
@@ -176,6 +177,7 @@ interface PresetToolHandlerOptions {
  * D1 + KV gets all four tools with no handler code.
  */
 declare function createPresetToolHandlers(opts: PresetToolHandlerOptions): AppToolHandlers;
+/** Define options for accessing preset knowledge scoped to a specific workspace and configuration */
 interface PresetKnowledgeAccessorOptions {
     db: D1Like;
     /** The active workspace — every `count` is scoped to it. */
@@ -210,6 +212,7 @@ declare function createPresetFieldCrypto(key: string | (() => string)): KeyCrypt
  * null `revoked_at`. Pure D1 wiring; no key minting (that's the provisioner).
  */
 declare function createPresetWorkspaceKeyStore(db: D1Like): WorkspaceKeyStore;
+/** Define preset billing options including database, provisioner, encryption key, budget, and optional settings */
 interface PresetBillingOptions {
     db: D1Like;
     /** The key provisioner (`@tangle-network/tcloud`'s client satisfies it structurally). */

package/dist/preset-cloudflare/index.js

@@ -7,9 +7,9 @@ import {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore
-} from "../chunk-54GSK2KK.js";
+} from "../chunk-HYTIHYNV.js";
 import "../chunk-TA5Q4I2K.js";
-import "../chunk-G3HCU7TA.js";
+import "../chunk-GXE6KHTS.js";
 export {
   PRESET_MIGRATION_SQL,
   PRESET_TABLES,