@undefineds.co/xpod 0.3.70 → 0.3.71-rc.13

package/dist/api/ai-gateway/pod/HostedPodDataAccess.js

@@ -0,0 +1,149 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostedPodDataAccess = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_net_1 = require("node:net");
+const AiConnectionServiceAccess_1 = require("../service-access/AiConnectionServiceAccess");
+const GatewayAdminProxyAuth_1 = require("../../../runtime/GatewayAdminProxyAuth");
+const INTERNAL_POD_DATA_PATH = '/.internal/pod-data';
+const STRIPPED_CALLER_HEADERS = new Set([
+    'authorization',
+    'dpop',
+    'cookie',
+]);
+class HostedPodDataAccess {
+    constructor(options) {
+        this.cssBaseUrl = new URL(options.cssBaseUrl);
+        if (!isLoopbackHostname(this.cssBaseUrl.hostname)) {
+            throw new Error('hosted_pod_css_loopback_required');
+        }
+        this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;
+        this.fetch = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        this.nonce = options.nonce ?? node_crypto_1.randomUUID;
+    }
+    async getTrustedFetch(owner, auth) {
+        return async (input, init) => {
+            const request = new Request(input, init);
+            const method = normalizeMethod(request.method);
+            const resourceUrl = normalizeResourceUrl(request.url);
+            const authorization = this.authorize({ owner, auth, method, resourceUrl });
+            const loopbackUrl = new URL(INTERNAL_POD_DATA_PATH, this.cssBaseUrl);
+            const headers = this.headersForLoopback(request.headers, {
+                ownerWebId: owner,
+                method,
+                resourceUrl,
+                principalKind: authorization.principalKind,
+                scopes: [method === 'GET' ? 'ai:credentials:read' : 'ai:credentials:write'],
+            });
+            return this.fetch(loopbackUrl, {
+                method,
+                headers,
+                body: request.body,
+                signal: init?.signal ?? request.signal,
+                ...(request.body ? { duplex: 'half' } : {}),
+            });
+        };
+    }
+    authorize(input) {
+        this.assertHostedAllowedResource(input.owner, input.resourceUrl);
+        if (!input.auth) {
+            throw new Error('hosted_pod_auth_required');
+        }
+        if (input.auth.type !== 'solid') {
+            throw new Error('hosted_pod_solid_principal_required');
+        }
+        if (input.auth.webId !== input.owner) {
+            throw new Error('hosted_pod_owner_mismatch');
+        }
+        return { principalKind: 'solid-user' };
+    }
+    assertHostedAllowedResource(owner, resourceUrl) {
+        const resource = parseUrl(resourceUrl, 'hosted_pod_resource_url_invalid');
+        const ownerUrl = parseUrl(owner, 'hosted_pod_owner_url_invalid');
+        const podRoot = hostedPodRootFromOwner(ownerUrl);
+        if (!podRoot || resource.origin !== podRoot.origin || !resource.pathname.startsWith(podRoot.pathname)) {
+            throw new Error('hosted_pod_remote_resource');
+        }
+        if (resource.hash || resource.search) {
+            throw new Error('hosted_pod_resource_not_allowed');
+        }
+        const allowed = (0, AiConnectionServiceAccess_1.createAiConnectionServiceAccess)({
+            ownerWebId: owner,
+            serviceWebId: owner,
+        }).resources.map((entry) => entry.url);
+        if (!allowed.includes(resource.href)) {
+            throw new Error('hosted_pod_resource_not_allowed');
+        }
+    }
+    headersForLoopback(headers, intent) {
+        const next = new Headers();
+        headers.forEach((value, key) => {
+            const normalized = key.toLowerCase();
+            if (STRIPPED_CALLER_HEADERS.has(normalized)
+                || GatewayAdminProxyAuth_1.GATEWAY_ADMIN_PROXY_HEADERS.includes(normalized)
+                || normalized.startsWith('x-xpod-admin-proxy-')) {
+                return;
+            }
+            next.set(key, value);
+        });
+        if (!this.gatewayAdminProxyAuthSecret) {
+            throw new Error('XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET is required for hosted Pod data access');
+        }
+        const marker = (0, GatewayAdminProxyAuth_1.createGatewayAdminProxyHeaders)({
+            secret: this.gatewayAdminProxyAuthSecret,
+            method: intent.method,
+            url: INTERNAL_POD_DATA_PATH,
+            originalClientLoopback: true,
+            issuedAt: this.now(),
+            nonce: this.nonce(),
+            intent,
+        });
+        for (const [key, value] of Object.entries(marker)) {
+            if (value !== undefined) {
+                next.set(key, Array.isArray(value) ? value.join(', ') : String(value));
+            }
+        }
+        return next;
+    }
+}
+exports.HostedPodDataAccess = HostedPodDataAccess;
+function normalizeMethod(method) {
+    const upper = (method ?? 'GET').toUpperCase();
+    if (upper === 'GET' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {
+        return upper;
+    }
+    throw new Error('hosted_pod_method_not_allowed');
+}
+function normalizeResourceUrl(value) {
+    return new URL(value).href;
+}
+function parseUrl(value, errorCode) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        throw new Error(errorCode);
+    }
+}
+function hostedPodRootFromOwner(ownerUrl) {
+    if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {
+        return undefined;
+    }
+    const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);
+    if (!podPath || !podPath.endsWith('/')) {
+        return undefined;
+    }
+    return new URL(podPath, ownerUrl.origin);
+}
+function isLoopbackHostname(hostname) {
+    const normalized = hostname.replace(/^\[|\]$/gu, '').toLowerCase();
+    if (normalized === 'localhost') {
+        return true;
+    }
+    if ((0, node_net_1.isIP)(normalized) === 4) {
+        return normalized.startsWith('127.');
+    }
+    return normalized === '::1';
+}
+//# sourceMappingURL=HostedPodDataAccess.js.map

package/dist/api/ai-gateway/pod/HostedPodDataAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostedPodDataAccess.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/pod/HostedPodDataAccess.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,uCAAgC;AAChC,2FAA8F;AAE9F,kFAIgD;AAkBhD,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AACrD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,eAAe;IACf,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAa,mBAAmB;IAO9B,YAAmB,OAAmC;QACpD,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QAC3H,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,wBAAU,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,IAAmC;QAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE;gBACvD,UAAU,EAAE,KAAK;gBACjB,MAAM;gBACN,WAAW;gBACX,aAAa,EAAE,aAAa,CAAC,aAAa;gBAC1C,MAAM,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;aAC5E,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC7B,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,OAAO,CAAC,MAAM;gBACtC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7B,CAAC,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,KAKjB;QACC,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAEjE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACzC,CAAC;IAEO,2BAA2B,CAAC,KAAa,EAAE,WAAmB;QACpE,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,2DAA+B,EAAC;YAC9C,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,OAAgB,EAAE,MAA+B;QAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;YACrC,IACE,uBAAuB,CAAC,GAAG,CAAC,UAAU,CAAC;mBACpC,mDAA2B,CAAC,QAAQ,CAAC,UAAwD,CAAC;mBAC9F,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAC/C,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,sDAA8B,EAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,2BAA2B;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,sBAAsB;YAC3B,sBAAsB,EAAE,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YACnB,MAAM;SACP,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AApHD,kDAoHC;AAED,SAAS,eAAe,CAAC,MAA0B;IACjD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,SAAiB;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAa;IAC3C,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAA,eAAI,EAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,UAAU,KAAK,KAAK,CAAC;AAC9B,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { isIP } from 'node:net';\nimport { createAiConnectionServiceAccess } from '../service-access/AiConnectionServiceAccess';\nimport type { AuthContext, SolidAuthContext } from '../../auth/AuthContext';\nimport {\n  createGatewayAdminProxyHeaders,\n  GATEWAY_ADMIN_PROXY_HEADERS,\n  type GatewayAdminProxyIntent,\n} from '../../../runtime/GatewayAdminProxyAuth';\n\nexport interface InternalPodAccessTokenProvider {\n  getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined>;\n}\n\nexport type InternalPodAccessAuthContext = AuthContext | undefined;\n\nexport interface HostedPodDataAccessOptions {\n  cssBaseUrl: string;\n  gatewayAdminProxyAuthSecret?: string;\n  fetch?: typeof fetch;\n  now?: () => number;\n  nonce?: () => string;\n}\n\ntype InternalPodDataMethod = 'GET' | 'PUT' | 'PATCH' | 'DELETE';\n\nconst INTERNAL_POD_DATA_PATH = '/.internal/pod-data';\nconst STRIPPED_CALLER_HEADERS = new Set([\n  'authorization',\n  'dpop',\n  'cookie',\n]);\n\nexport class HostedPodDataAccess implements InternalPodAccessTokenProvider {\n  private readonly cssBaseUrl: URL;\n  private readonly gatewayAdminProxyAuthSecret?: string;\n  private readonly fetch: typeof fetch;\n  private readonly now: () => number;\n  private readonly nonce: () => string;\n\n  public constructor(options: HostedPodDataAccessOptions) {\n    this.cssBaseUrl = new URL(options.cssBaseUrl);\n    if (!isLoopbackHostname(this.cssBaseUrl.hostname)) {\n      throw new Error('hosted_pod_css_loopback_required');\n    }\n    this.gatewayAdminProxyAuthSecret = options.gatewayAdminProxyAuthSecret ?? process.env.XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET;\n    this.fetch = options.fetch ?? fetch;\n    this.now = options.now ?? Date.now;\n    this.nonce = options.nonce ?? randomUUID;\n  }\n\n  public async getTrustedFetch(owner: string, auth?: InternalPodAccessAuthContext): Promise<typeof fetch | undefined> {\n    return async (input, init) => {\n      const request = new Request(input, init);\n      const method = normalizeMethod(request.method);\n      const resourceUrl = normalizeResourceUrl(request.url);\n      const authorization = this.authorize({ owner, auth, method, resourceUrl });\n      const loopbackUrl = new URL(INTERNAL_POD_DATA_PATH, this.cssBaseUrl);\n      const headers = this.headersForLoopback(request.headers, {\n        ownerWebId: owner,\n        method,\n        resourceUrl,\n        principalKind: authorization.principalKind,\n        scopes: [method === 'GET' ? 'ai:credentials:read' : 'ai:credentials:write'],\n      });\n\n      return this.fetch(loopbackUrl, {\n        method,\n        headers,\n        body: request.body,\n        signal: init?.signal ?? request.signal,\n        ...(request.body ? { duplex: 'half' } : {}),\n      } as RequestInit);\n    };\n  }\n\n  private authorize(input: {\n    owner: string;\n    auth?: InternalPodAccessAuthContext;\n    method: InternalPodDataMethod;\n    resourceUrl: string;\n  }): { principalKind: GatewayAdminProxyIntent['principalKind'] } {\n    this.assertHostedAllowedResource(input.owner, input.resourceUrl);\n\n    if (!input.auth) {\n      throw new Error('hosted_pod_auth_required');\n    }\n    if (input.auth.type !== 'solid') {\n      throw new Error('hosted_pod_solid_principal_required');\n    }\n    if (input.auth.webId !== input.owner) {\n      throw new Error('hosted_pod_owner_mismatch');\n    }\n    return { principalKind: 'solid-user' };\n  }\n\n  private assertHostedAllowedResource(owner: string, resourceUrl: string): void {\n    const resource = parseUrl(resourceUrl, 'hosted_pod_resource_url_invalid');\n    const ownerUrl = parseUrl(owner, 'hosted_pod_owner_url_invalid');\n    const podRoot = hostedPodRootFromOwner(ownerUrl);\n    if (!podRoot || resource.origin !== podRoot.origin || !resource.pathname.startsWith(podRoot.pathname)) {\n      throw new Error('hosted_pod_remote_resource');\n    }\n    if (resource.hash || resource.search) {\n      throw new Error('hosted_pod_resource_not_allowed');\n    }\n\n    const allowed = createAiConnectionServiceAccess({\n      ownerWebId: owner,\n      serviceWebId: owner,\n    }).resources.map((entry) => entry.url);\n    if (!allowed.includes(resource.href)) {\n      throw new Error('hosted_pod_resource_not_allowed');\n    }\n  }\n\n  private headersForLoopback(headers: Headers, intent: GatewayAdminProxyIntent): Headers {\n    const next = new Headers();\n    headers.forEach((value, key) => {\n      const normalized = key.toLowerCase();\n      if (\n        STRIPPED_CALLER_HEADERS.has(normalized)\n        || GATEWAY_ADMIN_PROXY_HEADERS.includes(normalized as typeof GATEWAY_ADMIN_PROXY_HEADERS[number])\n        || normalized.startsWith('x-xpod-admin-proxy-')\n      ) {\n        return;\n      }\n      next.set(key, value);\n    });\n\n    if (!this.gatewayAdminProxyAuthSecret) {\n      throw new Error('XPOD_GATEWAY_ADMIN_PROXY_AUTH_SECRET is required for hosted Pod data access');\n    }\n    const marker = createGatewayAdminProxyHeaders({\n      secret: this.gatewayAdminProxyAuthSecret,\n      method: intent.method,\n      url: INTERNAL_POD_DATA_PATH,\n      originalClientLoopback: true,\n      issuedAt: this.now(),\n      nonce: this.nonce(),\n      intent,\n    });\n    for (const [key, value] of Object.entries(marker)) {\n      if (value !== undefined) {\n        next.set(key, Array.isArray(value) ? value.join(', ') : String(value));\n      }\n    }\n    return next;\n  }\n}\n\nfunction normalizeMethod(method: string | undefined): InternalPodDataMethod {\n  const upper = (method ?? 'GET').toUpperCase();\n  if (upper === 'GET' || upper === 'PUT' || upper === 'PATCH' || upper === 'DELETE') {\n    return upper;\n  }\n  throw new Error('hosted_pod_method_not_allowed');\n}\n\nfunction normalizeResourceUrl(value: string): string {\n  return new URL(value).href;\n}\n\nfunction parseUrl(value: string, errorCode: string): URL {\n  try {\n    return new URL(value);\n  } catch {\n    throw new Error(errorCode);\n  }\n}\n\nfunction hostedPodRootFromOwner(ownerUrl: URL): URL | undefined {\n  if (ownerUrl.hash !== '#me' || !ownerUrl.pathname.endsWith('/profile/card')) {\n    return undefined;\n  }\n  const podPath = ownerUrl.pathname.slice(0, -'profile/card'.length);\n  if (!podPath || !podPath.endsWith('/')) {\n    return undefined;\n  }\n  return new URL(podPath, ownerUrl.origin);\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  const normalized = hostname.replace(/^\\[|\\]$/gu, '').toLowerCase();\n  if (normalized === 'localhost') {\n    return true;\n  }\n  if (isIP(normalized) === 4) {\n    return normalized.startsWith('127.');\n  }\n  return normalized === '::1';\n}\n"]}

package/dist/api/ai-gateway/quota/ProviderQuotaAdapter.d.ts

@@ -1,9 +1,9 @@
 import { quotaSnapshotResource, type QuotaSnapshotRow } from '@undefineds.co/models';
 import type { AuthContext } from '../../auth/AuthContext';
-import type { GatewayDeployment } from '../auth/GatewayApiKey';
-import type { InternalPodAccessTokenProvider } from '../auth/PodGatewayAccessKeyRepository';
+import type { GatewayDeployment } from '../auth/InvocationTokenCodec';
+import type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';
 import type { ConnectCredentialRecord, PodCredentialRepository } from '../connect';
-import type { CredentialVault, ProviderSecret } from '../credentials/CredentialVault';
+import type { ProviderSecret } from '../credentials/CredentialVault';
 export type QuotaSnapshotStatus = 'available' | 'unsupported' | 'error';
 export interface QuotaWindow {
     name: string;
@@ -49,18 +49,21 @@ export interface QuotaSnapshotRepository {
         provider: string;
         credentialIri: string;
         now: Date;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot | undefined>;
     findLatest(input: {
         webId: string;
         deployment: GatewayDeployment;
         provider: string;
         credentialIri: string;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot | undefined>;
     upsert(input: {
         webId: string;
         deployment: GatewayDeployment;
         provider: string;
         snapshot: NormalizedQuotaSnapshot;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot>;
 }
 export interface ProviderQuotaStatusInput {
@@ -71,10 +74,10 @@ export interface ProviderQuotaStatusInput {
     refresh?: boolean;
     now?: Date;
     signal?: AbortSignal;
+    auth?: AuthContext;
 }
 export interface ProviderQuotaServiceOptions {
     repository: QuotaSnapshotRepository;
-    vault: CredentialVault;
     adapters: ProviderQuotaAdapter[];
     credentialRepository?: PodCredentialRepository;
     credentials?: QuotaCredentialRecord[];
@@ -82,7 +85,6 @@ export interface ProviderQuotaServiceOptions {
 }
 export declare class ProviderQuotaService {
     private readonly repository;
-    private readonly vault;
     private readonly adapters;
     private readonly credentialRepository?;
     private readonly credentials;
@@ -107,18 +109,21 @@ export declare class InMemoryQuotaSnapshotRepository implements QuotaSnapshotRep
         provider: string;
         credentialIri: string;
         now: Date;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot | undefined>;
     findLatest(input: {
         webId: string;
         deployment: GatewayDeployment;
         provider: string;
         credentialIri: string;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot | undefined>;
     upsert(input: {
         webId: string;
         deployment: GatewayDeployment;
         provider: string;
         snapshot: NormalizedQuotaSnapshot;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot>;
 }
 type QuotaSnapshotDb = {
@@ -158,18 +163,21 @@ export declare class PodQuotaSnapshotRepository implements QuotaSnapshotReposito
         provider: string;
         credentialIri: string;
         now: Date;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot | undefined>;
     findLatest(input: {
         webId: string;
         deployment: GatewayDeployment;
         provider: string;
         credentialIri: string;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot | undefined>;
     upsert(input: {
         webId: string;
         deployment: GatewayDeployment;
         provider: string;
         snapshot: NormalizedQuotaSnapshot;
+        auth?: AuthContext;
     }): Promise<NormalizedQuotaSnapshot>;
     private dbForOwner;
     private resolveTrustedFetch;

package/dist/api/ai-gateway/quota/ProviderQuotaAdapter.js

@@ -10,12 +10,12 @@ exports.decimalAmount = decimalAmount;
 exports.normalizeProvider = normalizeProvider;
 const drizzle_solid_1 = require("@undefineds.co/drizzle-solid");
 const models_1 = require("@undefineds.co/models");
+const PlaintextCredentialPayload_1 = require("../credentials/PlaintextCredentialPayload");
 class ProviderQuotaService {
     constructor(options) {
         this.adapters = new Map();
         this.inFlightRefreshes = new Map();
         this.repository = options.repository;
-        this.vault = options.vault;
         this.credentialRepository = options.credentialRepository;
         this.credentials = options.credentials ?? [];
         this.now = options.now ?? (() => new Date());
@@ -55,6 +55,7 @@ class ProviderQuotaService {
             deployment: input.deployment,
             provider,
             credentialIri: input.credentialIri,
+            auth: input.auth,
         });
         if (!input.refresh) {
             const cached = await this.repository.findFresh({
@@ -63,6 +64,7 @@ class ProviderQuotaService {
                 provider,
                 credentialIri: credential.credentialIri,
                 now,
+                auth: input.auth,
             });
             if (cached) {
                 return { ...cached, stale: false };
@@ -72,6 +74,7 @@ class ProviderQuotaService {
                 deployment: input.deployment,
                 provider,
                 credentialIri: credential.credentialIri,
+                auth: input.auth,
             });
             if (latest) {
                 return { ...latest, stale: true };
@@ -99,6 +102,7 @@ class ProviderQuotaService {
             adapter,
             now,
             signal: input.signal,
+            auth: input.auth,
         }).finally(() => {
             this.inFlightRefreshes.delete(refreshKey);
         });
@@ -111,6 +115,7 @@ class ProviderQuotaService {
             deployment: input.input.deployment,
             provider: input.provider,
             credentialIri: input.input.credentialIri,
+            auth: input.input.auth,
         });
         const adapter = this.adapters.get(input.provider);
         if (!adapter) {
@@ -124,21 +129,11 @@ class ProviderQuotaService {
             adapter,
             now: input.now,
             signal: input.input.signal,
+            auth: input.input.auth,
         });
     }
     async fetchAndCache(input) {
-        const secret = await this.vault.open({ webId: input.webId }, input.credential.credentialIri, input.provider, input.credential.encryptedSecret);
-        if (this.vault.needsRewrap?.(input.credential.encryptedSecret)
-            && this.credentialRepository?.rewrapCredential) {
-            const rewrapped = await this.vault.rewrap({ webId: input.webId }, input.credential.encryptedSecret);
-            await this.credentialRepository.rewrapCredential({
-                webId: input.webId,
-                deployment: input.deployment,
-                credentialId: input.credential.id,
-                expectedVersion: input.credential.version,
-                encryptedSecret: rewrapped,
-            });
-        }
+        const secret = (0, PlaintextCredentialPayload_1.decodePlaintextCredential)(input.credential);
         let snapshot;
         try {
             snapshot = await input.adapter.fetch({
@@ -164,6 +159,7 @@ class ProviderQuotaService {
             deployment: input.deployment,
             provider: input.provider,
             snapshot,
+            auth: input.auth,
         });
     }
     async resolveCredential(input) {
@@ -178,6 +174,7 @@ class ProviderQuotaService {
             webId: input.webId,
             deployment: input.deployment,
             provider: input.provider,
+            auth: input.auth,
         });
         if (active
             && (!input.credentialIri || active.credentialIri === input.credentialIri)) {
@@ -239,7 +236,7 @@ class PodQuotaSnapshotRepository {
         this.dbFactory = options.dbFactory ?? createDefaultQuotaSnapshotDb;
     }
     async findFresh(input) {
-        const db = await this.dbForOwner(input.webId);
+        const db = await this.dbForOwner(input.webId, input.auth);
         const row = await models_1.aiGatewayRepository.findFreshQuotaSnapshot(db, {
             owner: input.webId,
             deployment: input.deployment,
@@ -250,7 +247,7 @@ class PodQuotaSnapshotRepository {
         return row ? snapshotFromRow(row, false) : undefined;
     }
     async findLatest(input) {
-        const db = await this.dbForOwner(input.webId);
+        const db = await this.dbForOwner(input.webId, input.auth);
         const row = await models_1.aiGatewayRepository.findLatestQuotaSnapshot(db, {
             owner: input.webId,
             deployment: input.deployment,
@@ -260,7 +257,7 @@ class PodQuotaSnapshotRepository {
         return row ? snapshotFromRow(row, true) : undefined;
     }
     async upsert(input) {
-        const db = await this.dbForOwner(input.webId);
+        const db = await this.dbForOwner(input.webId, input.auth);
         const snapshot = sanitizeSnapshot({
             ...input.snapshot,
             id: input.snapshot.id ?? (0, models_1.quotaSnapshotId)({
@@ -286,13 +283,13 @@ class PodQuotaSnapshotRepository {
         return { ...snapshot, stale: false };
     }
     async dbForOwner(owner, auth) {
-        const trustedFetch = await this.resolveTrustedFetch(owner);
+        const trustedFetch = await this.resolveTrustedFetch(owner, auth);
         const db = await this.dbFactory({ owner, auth, fetch: trustedFetch });
         await db.init?.(models_1.quotaSnapshotResource);
         return db;
     }
-    async resolveTrustedFetch(owner) {
-        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);
+    async resolveTrustedFetch(owner, auth) {
+        const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner, auth);
         if (!trustedFetch) {
             throw new Error('AI Connection service identity is not configured');
         }

package/dist/api/ai-gateway/quota/ProviderQuotaAdapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProviderQuotaAdapter.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/quota/ProviderQuotaAdapter.ts"],"names":[],"mappings":";;;AAigBA,4DAkBC;AAED,gDA6BC;AAED,4CAGC;AAED,kDAsBC;AAED,0BASC;AAED,sCA4BC;AAED,8CAEC;AA5nBD,gEAAuD;AACvD,kDAK+B;AA4F/B,MAAa,oBAAoB;IAS/B,YAAmB,OAAoC;QANtC,aAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;QAInD,sBAAiB,GAAG,IAAI,GAAG,EAA4C,CAAC;QAGvF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAA+B;QACjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,eAAe,CAAC;gBACjC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;gBACR,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;gBACnC,KAAK;gBACL,QAAQ;gBACR,GAAG;aACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,uCAAuC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,uCAAuC,CACnD,KAA+B,EAC/B,QAAgB,EAChB,GAAS;QAET,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;gBACR,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACrC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;gBACR,aAAa,EAAE,UAAU,CAAC,aAAa;aACxC,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,aAAa,EAAE,UAAU,CAAC,aAAa;SACxC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,UAAU;YACV,OAAO;YACP,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAI7B;QACC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YACxB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;SACzC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YACxB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU;YACV,OAAO;YACP,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;SAC3B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAQ3B;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACtB,KAAK,CAAC,UAAU,CAAC,aAAa,EAC9B,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,CAAC,eAAe,CACjC,CAAC;QACF,IACE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;eACvD,IAAI,CAAC,oBAAoB,EAAE,gBAAgB,EAC9C,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CACvC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACtB,KAAK,CAAC,UAAU,CAAC,eAAe,CACjC,CAAC;YACF,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC;gBAC/C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;gBACjC,eAAe,EAAE,KAAK,CAAC,UAAU,CAAC,OAAO;gBACzC,eAAe,EAAE,SAAS;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM;gBACN,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,QAAQ,GAAG,kBAAkB,CAAC;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;gBAC1C,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACxC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,QAAQ,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAK/B;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAC5B,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eACzC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ;eACxD,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;YAClE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IACE,MAAM;eACH,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAAC,EACzE,CAAC;YACD,OAAO,MAA+B,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;CACF;AAhOD,oDAgOC;AAED,MAAa,+BAA+B;IAA5C;QACkB,SAAI,GAIf,EAAE,CAAC;IA4DV,CAAC;IA1DQ,KAAK,CAAC,SAAS,CAAC,KAMtB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAKvB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI;aAClB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAC5B,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eACzC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;eAC3E,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAKnB;QACC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAA,wBAAoB,EAAC;YACnD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACnC,EAAE;YACF,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE,KAAK;SACb,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF;AAjED,0EAiEC;AA2BD,MAAa,0BAA0B;IAIrC,YAAmB,UAA6C,EAAE;QAChE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4BAA4B,CAAC;IACrE,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAMtB;QACC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,4BAAmB,CAAC,sBAAsB,CAAC,EAAW,EAAE;YACxE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,aAAa;YAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAKvB;QACC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,4BAAmB,CAAC,uBAAuB,CAAC,EAAW,EAAE;YACzE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,aAAa;SAChC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAKnB;QACC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,GAAG,KAAK,CAAC,QAAQ;YACjB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAA,wBAAoB,EAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;aACtC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,4BAAmB,CAAC,mBAAmB,CAAC,EAAW,EAAE;YACzD,EAAE,EAAE,QAAQ,CAAC,EAAG;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzC,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACf,CAAC,CAAC;QACZ,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QACxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,8BAAqB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AA/FD,gEA+FC;AAED,SAAgB,wBAAwB,CACtC,KAMC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QACrF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,KAQC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QACpF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE;YACR,GAAG,KAAK,CAAC,QAAQ;YACjB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC;gBACzB,QAAQ,EAAE;oBACR,MAAM,EAAE,cAAc;oBACtB,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzH;aACF,CAAC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAsB;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;QAC5C,MAAM,EAAE,KAAK;QACb,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,SAAgB,OAAO,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,aAAa,CAAC,KAAc;IAK1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,OAAO;QACL,KAAK;QACL,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,KAKxB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,UAAU;QAChB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,KAAK,CAAC,aAAa;KACpB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,QAAQ,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM;YACT,OAAO,2BAA2B,CAAC;QACrC,KAAK,UAAU;YACb,OAAO,wBAAwB,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,gCAAgC,CAAC;QAC1C,KAAK,WAAW;YACd,OAAO,mCAAmC,CAAC;QAC7C,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,CACZ,KAAK;WACF,OAAO,KAAK,KAAK,QAAQ;WACzB,MAAM,IAAI,KAAK;WACd,KAA4B,CAAC,IAAI,KAAK,YAAY,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiC;IACzD,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAA4B,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,QAAiC;IACvD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,GAAqB,EAAE,KAAc;IAC5D,OAAO,gBAAgB,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACzF,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACxD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC5F,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,aAAa,EAAE,8BAAqB;SACrC;KACF,CAC4B,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { drizzle } from '@undefineds.co/drizzle-solid';\nimport {\n  aiGatewayRepository,\n  quotaSnapshotId as buildQuotaSnapshotId,\n  quotaSnapshotResource,\n  type QuotaSnapshotRow,\n} from '@undefineds.co/models';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { GatewayDeployment } from '../auth/GatewayApiKey';\nimport type { InternalPodAccessTokenProvider } from '../auth/PodGatewayAccessKeyRepository';\nimport type { ConnectCredentialRecord, PodCredentialRepository } from '../connect';\nimport type { CredentialVault, ProviderSecret } from '../credentials/CredentialVault';\n\nexport type QuotaSnapshotStatus = 'available' | 'unsupported' | 'error';\n\nexport interface QuotaWindow {\n  name: string;\n  used?: number;\n  usedExact?: string;\n  limit?: number;\n  limitExact?: string;\n  remaining?: number;\n  remainingExact?: string;\n  displayApprox?: boolean;\n  currency?: string;\n  resetsAt?: string;\n}\n\nexport interface NormalizedQuotaSnapshot {\n  id?: string;\n  credential: string;\n  status: QuotaSnapshotStatus;\n  balance?: number;\n  windows: QuotaWindow[];\n  observedAt: string;\n  expiresAt: string;\n  source: string;\n  stale?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface QuotaCredentialRecord extends ConnectCredentialRecord {\n  baseUrl?: string;\n}\n\nexport interface ProviderQuotaFetchInput {\n  credential: QuotaCredentialRecord;\n  secret: ProviderSecret;\n  now: Date;\n  signal?: AbortSignal;\n}\n\nexport interface ProviderQuotaAdapter {\n  readonly provider: string;\n  fetch(input: ProviderQuotaFetchInput): Promise<NormalizedQuotaSnapshot>;\n}\n\nexport interface QuotaSnapshotRepository {\n  findFresh(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    now: Date;\n  }): Promise<NormalizedQuotaSnapshot | undefined>;\n  findLatest(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n  }): Promise<NormalizedQuotaSnapshot | undefined>;\n  upsert(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    snapshot: NormalizedQuotaSnapshot;\n  }): Promise<NormalizedQuotaSnapshot>;\n}\n\nexport interface ProviderQuotaStatusInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  credentialIri?: string;\n  refresh?: boolean;\n  now?: Date;\n  signal?: AbortSignal;\n}\n\nexport interface ProviderQuotaServiceOptions {\n  repository: QuotaSnapshotRepository;\n  vault: CredentialVault;\n  adapters: ProviderQuotaAdapter[];\n  credentialRepository?: PodCredentialRepository;\n  credentials?: QuotaCredentialRecord[];\n  now?: () => Date;\n}\n\nexport class ProviderQuotaService {\n  private readonly repository: QuotaSnapshotRepository;\n  private readonly vault: CredentialVault;\n  private readonly adapters = new Map<string, ProviderQuotaAdapter>();\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly credentials: QuotaCredentialRecord[];\n  private readonly now: () => Date;\n  private readonly inFlightRefreshes = new Map<string, Promise<NormalizedQuotaSnapshot>>();\n\n  public constructor(options: ProviderQuotaServiceOptions) {\n    this.repository = options.repository;\n    this.vault = options.vault;\n    this.credentialRepository = options.credentialRepository;\n    this.credentials = options.credentials ?? [];\n    this.now = options.now ?? (() => new Date());\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public async status(input: ProviderQuotaStatusInput): Promise<NormalizedQuotaSnapshot> {\n    const provider = normalizeProvider(input.provider);\n    const now = input.now ?? this.now();\n    if (input.refresh && input.credentialIri) {\n      const refreshKey = quotaRefreshKey({\n        webId: input.webId,\n        deployment: input.deployment,\n        provider,\n        credentialIri: input.credentialIri,\n      });\n      const inFlight = this.inFlightRefreshes.get(refreshKey);\n      if (inFlight) {\n        return inFlight;\n      }\n      const refresh = this.refreshAndCache({\n        input,\n        provider,\n        now,\n      }).finally(() => {\n        this.inFlightRefreshes.delete(refreshKey);\n      });\n      this.inFlightRefreshes.set(refreshKey, refresh);\n      return refresh;\n    }\n\n    return this.statusAfterImplicitCredentialResolution(input, provider, now);\n  }\n\n  private async statusAfterImplicitCredentialResolution(\n    input: ProviderQuotaStatusInput,\n    provider: string,\n    now: Date,\n  ): Promise<NormalizedQuotaSnapshot> {\n    const credential = await this.resolveCredential({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider,\n      credentialIri: input.credentialIri,\n    });\n\n    if (!input.refresh) {\n      const cached = await this.repository.findFresh({\n        webId: input.webId,\n        deployment: input.deployment,\n        provider,\n        credentialIri: credential.credentialIri,\n        now,\n      });\n      if (cached) {\n        return { ...cached, stale: false };\n      }\n      const latest = await this.repository.findLatest({\n        webId: input.webId,\n        deployment: input.deployment,\n        provider,\n        credentialIri: credential.credentialIri,\n      });\n      if (latest) {\n        return { ...latest, stale: true };\n      }\n    }\n\n    const adapter = this.adapters.get(provider);\n    if (!adapter) {\n      throw new Error(`quota_adapter_not_found:${provider}`);\n    }\n    const refreshKey = quotaRefreshKey({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider,\n      credentialIri: credential.credentialIri,\n    });\n    const inFlight = this.inFlightRefreshes.get(refreshKey);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const refresh = this.fetchAndCache({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider,\n      credential,\n      adapter,\n      now,\n      signal: input.signal,\n    }).finally(() => {\n      this.inFlightRefreshes.delete(refreshKey);\n    });\n    this.inFlightRefreshes.set(refreshKey, refresh);\n    return refresh;\n  }\n\n  private async refreshAndCache(input: {\n    input: ProviderQuotaStatusInput;\n    provider: string;\n    now: Date;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const credential = await this.resolveCredential({\n      webId: input.input.webId,\n      deployment: input.input.deployment,\n      provider: input.provider,\n      credentialIri: input.input.credentialIri,\n    });\n    const adapter = this.adapters.get(input.provider);\n    if (!adapter) {\n      throw new Error(`quota_adapter_not_found:${input.provider}`);\n    }\n    return this.fetchAndCache({\n      webId: input.input.webId,\n      deployment: input.input.deployment,\n      provider: input.provider,\n      credential,\n      adapter,\n      now: input.now,\n      signal: input.input.signal,\n    });\n  }\n\n  private async fetchAndCache(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credential: QuotaCredentialRecord;\n    adapter: ProviderQuotaAdapter;\n    now: Date;\n    signal?: AbortSignal;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const secret = await this.vault.open(\n      { webId: input.webId },\n      input.credential.credentialIri,\n      input.provider,\n      input.credential.encryptedSecret,\n    );\n    if (\n      this.vault.needsRewrap?.(input.credential.encryptedSecret)\n      && this.credentialRepository?.rewrapCredential\n    ) {\n      const rewrapped = await this.vault.rewrap(\n        { webId: input.webId },\n        input.credential.encryptedSecret,\n      );\n      await this.credentialRepository.rewrapCredential({\n        webId: input.webId,\n        deployment: input.deployment,\n        credentialId: input.credential.id,\n        expectedVersion: input.credential.version,\n        encryptedSecret: rewrapped,\n      });\n    }\n    let snapshot: NormalizedQuotaSnapshot;\n    try {\n      snapshot = await input.adapter.fetch({\n        credential: input.credential,\n        secret,\n        now: input.now,\n        signal: input.signal,\n      });\n    } catch (error) {\n      if (isAbortError(error)) {\n        throw error;\n      }\n      snapshot = errorQuotaSnapshot({\n        credential: input.credential.credentialIri,\n        source: quotaErrorSource(input.provider),\n        now: input.now,\n        metadata: { reason: 'provider_quota_unavailable' },\n      });\n    }\n    return this.repository.upsert({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      snapshot,\n    });\n  }\n\n  private async resolveCredential(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri?: string;\n  }): Promise<QuotaCredentialRecord> {\n    const listed = this.credentials.find((candidate) =>\n      candidate.webId === input.webId\n      && candidate.deployment === input.deployment\n      && normalizeProvider(candidate.provider) === input.provider\n      && (!input.credentialIri || candidate.credentialIri === input.credentialIri));\n    if (listed) {\n      return listed;\n    }\n\n    const active = await this.credentialRepository?.getActiveCredential({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n    });\n    if (\n      active\n      && (!input.credentialIri || active.credentialIri === input.credentialIri)\n    ) {\n      return active as QuotaCredentialRecord;\n    }\n    throw new Error('quota_credential_not_found');\n  }\n}\n\nexport class InMemoryQuotaSnapshotRepository implements QuotaSnapshotRepository {\n  public readonly rows: Array<NormalizedQuotaSnapshot & {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n  }> = [];\n\n  public async findFresh(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    now: Date;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const latest = await this.findLatest(input);\n    if (!latest || new Date(latest.expiresAt).getTime() <= input.now.getTime()) {\n      return undefined;\n    }\n    return latest;\n  }\n\n  public async findLatest(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const row = this.rows\n      .filter((candidate) =>\n        candidate.webId === input.webId\n        && candidate.deployment === input.deployment\n        && normalizeProvider(candidate.provider) === normalizeProvider(input.provider)\n        && candidate.credential === input.credentialIri)\n      .sort((a, b) => new Date(b.observedAt).getTime() - new Date(a.observedAt).getTime())[0];\n    return row ? publicSnapshot(row) : undefined;\n  }\n\n  public async upsert(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    snapshot: NormalizedQuotaSnapshot;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const id = input.snapshot.id ?? buildQuotaSnapshotId({\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: input.snapshot.credential,\n    });\n    const next = {\n      ...sanitizeSnapshot(input.snapshot),\n      id,\n      webId: input.webId,\n      deployment: input.deployment,\n      provider: normalizeProvider(input.provider),\n      stale: false,\n    };\n    const index = this.rows.findIndex((row) => row.id === id);\n    if (index === -1) {\n      this.rows.push(next);\n    } else {\n      this.rows[index] = next;\n    }\n    return publicSnapshot(next);\n  }\n}\n\ntype QuotaSnapshotDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  select(): {\n    from(resource: typeof quotaSnapshotResource): {\n      where(condition: unknown): { execute(): Promise<QuotaSnapshotRow[]> };\n    };\n  };\n  findById<TRow>(resource: typeof quotaSnapshotResource, id: string): Promise<TRow | null>;\n  findByIri<TRow>(resource: typeof quotaSnapshotResource, iri: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof quotaSnapshotResource, id: string, patch: unknown): Promise<TRow | null>;\n  updateByIri<TRow>(resource: typeof quotaSnapshotResource, iri: string, patch: unknown): Promise<TRow | null>;\n  insert(resource: typeof quotaSnapshotResource): {\n    values(value: unknown): { execute(): Promise<QuotaSnapshotRow[]> };\n  };\n};\n\nexport interface PodQuotaSnapshotRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n  }) => Promise<QuotaSnapshotDb>;\n}\n\nexport class PodQuotaSnapshotRepository implements QuotaSnapshotRepository {\n  private readonly dbFactory: NonNullable<PodQuotaSnapshotRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n\n  public constructor(options: PodQuotaSnapshotRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.dbFactory = options.dbFactory ?? createDefaultQuotaSnapshotDb;\n  }\n\n  public async findFresh(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    now: Date;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const db = await this.dbForOwner(input.webId);\n    const row = await aiGatewayRepository.findFreshQuotaSnapshot(db as never, {\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: input.credentialIri,\n      now: input.now,\n    });\n    return row ? snapshotFromRow(row, false) : undefined;\n  }\n\n  public async findLatest(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const db = await this.dbForOwner(input.webId);\n    const row = await aiGatewayRepository.findLatestQuotaSnapshot(db as never, {\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: input.credentialIri,\n    });\n    return row ? snapshotFromRow(row, true) : undefined;\n  }\n\n  public async upsert(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    snapshot: NormalizedQuotaSnapshot;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const db = await this.dbForOwner(input.webId);\n    const snapshot = sanitizeSnapshot({\n      ...input.snapshot,\n      id: input.snapshot.id ?? buildQuotaSnapshotId({\n        owner: input.webId,\n        deployment: input.deployment,\n        provider: input.provider,\n        credential: input.snapshot.credential,\n      }),\n    });\n    await aiGatewayRepository.upsertQuotaSnapshot(db as never, {\n      id: snapshot.id!,\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: snapshot.credential,\n      status: snapshot.status,\n      balance: snapshot.balance,\n      windows: JSON.stringify(snapshot.windows),\n      observedAt: new Date(snapshot.observedAt),\n      expiresAt: new Date(snapshot.expiresAt),\n      source: snapshot.source,\n    } as never);\n    return { ...snapshot, stale: false };\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<QuotaSnapshotDb> {\n    const trustedFetch = await this.resolveTrustedFetch(owner);\n    const db = await this.dbFactory({ owner, auth, fetch: trustedFetch });\n    await db.init?.(quotaSnapshotResource);\n    return db;\n  }\n\n  private async resolveTrustedFetch(owner: string): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport function unsupportedQuotaSnapshot(\n  input: {\n    credential: string;\n    source: string;\n    now: Date;\n    ttlMs?: number;\n    metadata?: Record<string, unknown>;\n  },\n): NormalizedQuotaSnapshot {\n  return {\n    credential: input.credential,\n    status: 'unsupported',\n    windows: [],\n    observedAt: input.now.toISOString(),\n    expiresAt: new Date(input.now.getTime() + (input.ttlMs ?? 60 * 60_000)).toISOString(),\n    source: input.source,\n    metadata: input.metadata,\n  };\n}\n\nexport function errorQuotaSnapshot(\n  input: {\n    credential: string;\n    source: string;\n    now: Date;\n    status?: number;\n    retryAfter?: string | null;\n    ttlMs?: number;\n    metadata?: Record<string, unknown>;\n  },\n): NormalizedQuotaSnapshot {\n  return {\n    credential: input.credential,\n    status: 'error',\n    windows: [],\n    observedAt: input.now.toISOString(),\n    expiresAt: new Date(input.now.getTime() + (input.ttlMs ?? 5 * 60_000)).toISOString(),\n    source: input.source,\n    metadata: {\n      ...input.metadata,\n      ...(input.status ? { providerStatusCode: input.status } : {}),\n      ...(input.status === 429 ? {\n        cooldown: {\n          reason: 'rate_limited',\n          ...(retryAfterSeconds(input.retryAfter) !== undefined ? { retryAfterSeconds: retryAfterSeconds(input.retryAfter) } : {}),\n        },\n      } : {}),\n    },\n  };\n}\n\nexport function apiKeyFromSecret(secret: ProviderSecret): string | undefined {\n  const apiKey = secret.apiKey;\n  return typeof apiKey === 'string' && apiKey.trim() ? apiKey : undefined;\n}\n\nexport async function fetchJsonWithBearer(input: {\n  fetch: typeof fetch;\n  url: string;\n  apiKey: string;\n  signal?: AbortSignal;\n}): Promise<{ ok: true; body: unknown } | { ok: false; status: number; retryAfter?: string | null }> {\n  const headers = new Headers();\n  headers.set('Authorization', `Bearer ${input.apiKey}`);\n  const response = await input.fetch(input.url, {\n    method: 'GET',\n    headers,\n    signal: input.signal,\n  });\n  if (!response.ok) {\n    await response.text().catch(() => '');\n    return {\n      ok: false,\n      status: response.status,\n      retryAfter: response.headers.get('Retry-After') ?? response.headers.get('retry-after'),\n    };\n  }\n  return { ok: true, body: await response.json() };\n}\n\nexport function numeric(value: unknown): number | undefined {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n  return undefined;\n}\n\nexport function decimalAmount(value: unknown): {\n  exact?: string;\n  numeric?: number;\n  displayApprox?: boolean;\n} {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return {\n      exact: String(value),\n      numeric: value,\n      ...(Number.isSafeInteger(value) ? {} : { displayApprox: true }),\n    };\n  }\n  if (typeof value !== 'string') {\n    return {};\n  }\n  const exact = value.trim();\n  if (!exact) {\n    return {};\n  }\n  const parsed = Number(exact);\n  if (!Number.isFinite(parsed) || Math.abs(parsed) > Number.MAX_SAFE_INTEGER) {\n    return { exact };\n  }\n  return {\n    exact,\n    numeric: parsed,\n    ...(/[.eE]/u.test(exact) ? { displayApprox: true } : {}),\n  };\n}\n\nexport function normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nfunction retryAfterSeconds(value: string | null | undefined): number | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) {\n    return seconds;\n  }\n  const date = new Date(value);\n  if (Number.isNaN(date.getTime())) {\n    return undefined;\n  }\n  return Math.max(0, Math.ceil((date.getTime() - Date.now()) / 1000));\n}\n\nfunction quotaRefreshKey(input: {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  credentialIri: string;\n}): string {\n  return JSON.stringify([\n    input.webId,\n    input.deployment,\n    normalizeProvider(input.provider),\n    input.credentialIri,\n  ]);\n}\n\nfunction quotaErrorSource(provider: string): string {\n  switch (normalizeProvider(provider)) {\n    case 'kimi':\n      return 'kimi:/v1/users/me/balance';\n    case 'deepseek':\n      return 'deepseek:/user/balance';\n    case 'openai':\n      return 'openai:no-credential-quota-api';\n    case 'anthropic':\n      return 'anthropic:no-credential-quota-api';\n    case 'bailian':\n      return 'bailian:console-only';\n    default:\n      return `${normalizeProvider(provider)}:quota`;\n  }\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return Boolean(\n    error\n    && typeof error === 'object'\n    && 'name' in error\n    && (error as { name?: unknown }).name === 'AbortError',\n  );\n}\n\nfunction sanitizeSnapshot(snapshot: NormalizedQuotaSnapshot): NormalizedQuotaSnapshot {\n  return {\n    ...snapshot,\n    windows: snapshot.windows.map((window) => ({ ...window })),\n    metadata: snapshot.metadata ? sanitizeMetadata(snapshot.metadata) : undefined,\n  };\n}\n\nfunction sanitizeMetadata(metadata: Record<string, unknown>): Record<string, unknown> {\n  return JSON.parse(JSON.stringify(metadata, (_key, value) => {\n    if (typeof value === 'string' && /secret|sk-|api[_-]?key/i.test(value)) {\n      return '[redacted]';\n    }\n    return value;\n  })) as Record<string, unknown>;\n}\n\nfunction publicSnapshot(snapshot: NormalizedQuotaSnapshot): NormalizedQuotaSnapshot {\n  return sanitizeSnapshot(snapshot);\n}\n\nfunction snapshotFromRow(row: QuotaSnapshotRow, stale: boolean): NormalizedQuotaSnapshot {\n  return sanitizeSnapshot({\n    id: String(row.id),\n    credential: String(row.credential),\n    status: row.status === 'available' || row.status === 'unsupported' ? row.status : 'error',\n    balance: typeof row.balance === 'number' ? row.balance : undefined,\n    windows: parseWindows(row.windows),\n    observedAt: toIso(row.observedAt),\n    expiresAt: toIso(row.expiresAt),\n    source: typeof row.source === 'string' ? row.source : '',\n    stale,\n  });\n}\n\nfunction parseWindows(value: unknown): QuotaWindow[] {\n  if (typeof value !== 'string') {\n    return [];\n  }\n  try {\n    const parsed = JSON.parse(value);\n    return Array.isArray(parsed)\n      ? parsed.filter((item) => item && typeof item === 'object' && typeof item.name === 'string')\n      : [];\n  } catch {\n    return [];\n  }\n}\n\nfunction toIso(value: unknown): string {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    if (!Number.isNaN(parsed.getTime())) {\n      return parsed.toISOString();\n    }\n  }\n  return new Date(0).toISOString();\n}\n\nfunction createDefaultQuotaSnapshotDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n}): Promise<QuotaSnapshotDb> {\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        quotaSnapshot: quotaSnapshotResource,\n      },\n    },\n  ) as unknown as QuotaSnapshotDb);\n}\n"]}
+{"version":3,"file":"ProviderQuotaAdapter.js","sourceRoot":"","sources":["../../../../src/api/ai-gateway/quota/ProviderQuotaAdapter.ts"],"names":[],"mappings":";;;AA8fA,4DAkBC;AAED,gDA6BC;AAED,4CAGC;AAED,kDAsBC;AAED,0BASC;AAED,sCA4BC;AAED,8CAEC;AAznBD,gEAAuD;AACvD,kDAK+B;AAM/B,0FAAsF;AA0FtF,MAAa,oBAAoB;IAQ/B,YAAmB,OAAoC;QANtC,aAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;QAInD,sBAAiB,GAAG,IAAI,GAAG,EAA4C,CAAC;QAGvF,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAA+B;QACjD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,eAAe,CAAC;gBACjC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;gBACR,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC;gBACnC,KAAK;gBACL,QAAQ;gBACR,GAAG;aACJ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,uCAAuC,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,uCAAuC,CACnD,KAA+B,EAC/B,QAAgB,EAChB,GAAS;QAET,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;gBACR,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,GAAG;gBACH,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACrC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ;gBACR,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,aAAa,EAAE,UAAU,CAAC,aAAa;SACxC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ;YACR,UAAU;YACV,OAAO;YACP,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAI7B;QACC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YACxB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa;YACxC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YACxB,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU;YAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU;YACV,OAAO;YACP,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAS3B;QACC,MAAM,MAAM,GAAG,IAAA,sDAAyB,EAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM;gBACN,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,QAAQ,GAAG,kBAAkB,CAAC;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,aAAa;gBAC1C,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACxC,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,QAAQ,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAM/B;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAC5B,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eACzC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ;eACxD,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAChF,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,mBAAmB,CAAC;YAClE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,IACE,MAAM;eACH,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,CAAC,EACzE,CAAC;YACD,OAAO,MAA+B,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;CACF;AAnND,oDAmNC;AAED,MAAa,+BAA+B;IAA5C;QACkB,SAAI,GAIf,EAAE,CAAC;IA+DV,CAAC;IA7DQ,KAAK,CAAC,SAAS,CAAC,KAOtB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAMvB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI;aAClB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;eAC5B,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;eACzC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;eAC3E,SAAS,CAAC,UAAU,KAAK,KAAK,CAAC,aAAa,CAAC;aACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1F,OAAO,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAMnB;QACC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAA,wBAAoB,EAAC;YACnD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;SACtC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG;YACX,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACnC,EAAE;YACF,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE,KAAK;SACb,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF;AApED,0EAoEC;AA2BD,MAAa,0BAA0B;IAIrC,YAAmB,UAA6C,EAAE;QAChE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4BAA4B,CAAC;IACrE,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,KAOtB;QACC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,4BAAmB,CAAC,sBAAsB,CAAC,EAAW,EAAE;YACxE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,aAAa;YAC/B,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAMvB;QACC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,4BAAmB,CAAC,uBAAuB,CAAC,EAAW,EAAE;YACzE,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,aAAa;SAChC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,KAMnB;QACC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC;YAChC,GAAG,KAAK,CAAC,QAAQ;YACjB,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAA,wBAAoB,EAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU;aACtC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,4BAAmB,CAAC,mBAAmB,CAAC,EAAW,EAAE;YACzD,EAAE,EAAE,QAAQ,CAAC,EAAG;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YACzC,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACf,CAAC,CAAC;QACZ,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,IAAkB;QACxD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACtE,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,8BAAqB,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,IAAkB;QACjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC;IACJ,CAAC;CACF;AAlGD,gEAkGC;AAED,SAAgB,wBAAwB,CACtC,KAMC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QACrF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAChC,KAQC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;QACpF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE;YACR,GAAG,KAAK,CAAC,QAAQ;YACjB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC;gBACzB,QAAQ,EAAE;oBACR,MAAM,EAAE,cAAc;oBACtB,GAAG,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzH;aACF,CAAC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAsB;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,mBAAmB,CAAC,KAKzC;IACC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;QAC5C,MAAM,EAAE,KAAK;QACb,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,SAAgB,OAAO,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,aAAa,CAAC,KAAc;IAK1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YACpB,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IACD,OAAO;QACL,KAAK;QACL,OAAO,EAAE,MAAM;QACf,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,eAAe,CAAC,KAKxB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,KAAK;QACX,KAAK,CAAC,UAAU;QAChB,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,KAAK,CAAC,aAAa;KACpB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,QAAQ,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM;YACT,OAAO,2BAA2B,CAAC;QACrC,KAAK,UAAU;YACb,OAAO,wBAAwB,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,gCAAgC,CAAC;QAC1C,KAAK,WAAW;YACd,OAAO,mCAAmC,CAAC;QAC7C,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC;QAChC;YACE,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,CACZ,KAAK;WACF,OAAO,KAAK,KAAK,QAAQ;WACzB,MAAM,IAAI,KAAK;WACd,KAA4B,CAAC,IAAI,KAAK,YAAY,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiC;IACzD,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9E,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAiC;IACzD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAA4B,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,QAAiC;IACvD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,GAAqB,EAAE,KAAc;IAC5D,OAAO,gBAAgB,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACzF,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClE,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;QAClC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACxD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;YAC5F,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,4BAA4B,CAAC,KAIrC;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAA,uBAAO,EAC5B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE;KACxC,EACR;QACE,MAAM,EAAE;YACN,aAAa,EAAE,8BAAqB;SACrC;KACF,CAC4B,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import { drizzle } from '@undefineds.co/drizzle-solid';\nimport {\n  aiGatewayRepository,\n  quotaSnapshotId as buildQuotaSnapshotId,\n  quotaSnapshotResource,\n  type QuotaSnapshotRow,\n} from '@undefineds.co/models';\nimport type { AuthContext } from '../../auth/AuthContext';\nimport type { GatewayDeployment } from '../auth/InvocationTokenCodec';\nimport type { InternalPodAccessTokenProvider } from '../pod/HostedPodDataAccess';\nimport type { ConnectCredentialRecord, PodCredentialRepository } from '../connect';\nimport type { ProviderSecret } from '../credentials/CredentialVault';\nimport { decodePlaintextCredential } from '../credentials/PlaintextCredentialPayload';\n\nexport type QuotaSnapshotStatus = 'available' | 'unsupported' | 'error';\n\nexport interface QuotaWindow {\n  name: string;\n  used?: number;\n  usedExact?: string;\n  limit?: number;\n  limitExact?: string;\n  remaining?: number;\n  remainingExact?: string;\n  displayApprox?: boolean;\n  currency?: string;\n  resetsAt?: string;\n}\n\nexport interface NormalizedQuotaSnapshot {\n  id?: string;\n  credential: string;\n  status: QuotaSnapshotStatus;\n  balance?: number;\n  windows: QuotaWindow[];\n  observedAt: string;\n  expiresAt: string;\n  source: string;\n  stale?: boolean;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface QuotaCredentialRecord extends ConnectCredentialRecord {\n  baseUrl?: string;\n}\n\nexport interface ProviderQuotaFetchInput {\n  credential: QuotaCredentialRecord;\n  secret: ProviderSecret;\n  now: Date;\n  signal?: AbortSignal;\n}\n\nexport interface ProviderQuotaAdapter {\n  readonly provider: string;\n  fetch(input: ProviderQuotaFetchInput): Promise<NormalizedQuotaSnapshot>;\n}\n\nexport interface QuotaSnapshotRepository {\n  findFresh(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    now: Date;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot | undefined>;\n  findLatest(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot | undefined>;\n  upsert(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    snapshot: NormalizedQuotaSnapshot;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot>;\n}\n\nexport interface ProviderQuotaStatusInput {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  credentialIri?: string;\n  refresh?: boolean;\n  now?: Date;\n  signal?: AbortSignal;\n  auth?: AuthContext;\n}\n\nexport interface ProviderQuotaServiceOptions {\n  repository: QuotaSnapshotRepository;\n  adapters: ProviderQuotaAdapter[];\n  credentialRepository?: PodCredentialRepository;\n  credentials?: QuotaCredentialRecord[];\n  now?: () => Date;\n}\n\nexport class ProviderQuotaService {\n  private readonly repository: QuotaSnapshotRepository;\n  private readonly adapters = new Map<string, ProviderQuotaAdapter>();\n  private readonly credentialRepository?: PodCredentialRepository;\n  private readonly credentials: QuotaCredentialRecord[];\n  private readonly now: () => Date;\n  private readonly inFlightRefreshes = new Map<string, Promise<NormalizedQuotaSnapshot>>();\n\n  public constructor(options: ProviderQuotaServiceOptions) {\n    this.repository = options.repository;\n    this.credentialRepository = options.credentialRepository;\n    this.credentials = options.credentials ?? [];\n    this.now = options.now ?? (() => new Date());\n    for (const adapter of options.adapters) {\n      this.adapters.set(normalizeProvider(adapter.provider), adapter);\n    }\n  }\n\n  public async status(input: ProviderQuotaStatusInput): Promise<NormalizedQuotaSnapshot> {\n    const provider = normalizeProvider(input.provider);\n    const now = input.now ?? this.now();\n    if (input.refresh && input.credentialIri) {\n      const refreshKey = quotaRefreshKey({\n        webId: input.webId,\n        deployment: input.deployment,\n        provider,\n        credentialIri: input.credentialIri,\n      });\n      const inFlight = this.inFlightRefreshes.get(refreshKey);\n      if (inFlight) {\n        return inFlight;\n      }\n      const refresh = this.refreshAndCache({\n        input,\n        provider,\n        now,\n      }).finally(() => {\n        this.inFlightRefreshes.delete(refreshKey);\n      });\n      this.inFlightRefreshes.set(refreshKey, refresh);\n      return refresh;\n    }\n\n    return this.statusAfterImplicitCredentialResolution(input, provider, now);\n  }\n\n  private async statusAfterImplicitCredentialResolution(\n    input: ProviderQuotaStatusInput,\n    provider: string,\n    now: Date,\n  ): Promise<NormalizedQuotaSnapshot> {\n    const credential = await this.resolveCredential({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider,\n      credentialIri: input.credentialIri,\n      auth: input.auth,\n    });\n\n    if (!input.refresh) {\n      const cached = await this.repository.findFresh({\n        webId: input.webId,\n        deployment: input.deployment,\n        provider,\n        credentialIri: credential.credentialIri,\n        now,\n        auth: input.auth,\n      });\n      if (cached) {\n        return { ...cached, stale: false };\n      }\n      const latest = await this.repository.findLatest({\n        webId: input.webId,\n        deployment: input.deployment,\n        provider,\n        credentialIri: credential.credentialIri,\n        auth: input.auth,\n      });\n      if (latest) {\n        return { ...latest, stale: true };\n      }\n    }\n\n    const adapter = this.adapters.get(provider);\n    if (!adapter) {\n      throw new Error(`quota_adapter_not_found:${provider}`);\n    }\n    const refreshKey = quotaRefreshKey({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider,\n      credentialIri: credential.credentialIri,\n    });\n    const inFlight = this.inFlightRefreshes.get(refreshKey);\n    if (inFlight) {\n      return inFlight;\n    }\n\n    const refresh = this.fetchAndCache({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider,\n      credential,\n      adapter,\n      now,\n      signal: input.signal,\n      auth: input.auth,\n    }).finally(() => {\n      this.inFlightRefreshes.delete(refreshKey);\n    });\n    this.inFlightRefreshes.set(refreshKey, refresh);\n    return refresh;\n  }\n\n  private async refreshAndCache(input: {\n    input: ProviderQuotaStatusInput;\n    provider: string;\n    now: Date;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const credential = await this.resolveCredential({\n      webId: input.input.webId,\n      deployment: input.input.deployment,\n      provider: input.provider,\n      credentialIri: input.input.credentialIri,\n      auth: input.input.auth,\n    });\n    const adapter = this.adapters.get(input.provider);\n    if (!adapter) {\n      throw new Error(`quota_adapter_not_found:${input.provider}`);\n    }\n    return this.fetchAndCache({\n      webId: input.input.webId,\n      deployment: input.input.deployment,\n      provider: input.provider,\n      credential,\n      adapter,\n      now: input.now,\n      signal: input.input.signal,\n      auth: input.input.auth,\n    });\n  }\n\n  private async fetchAndCache(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credential: QuotaCredentialRecord;\n    adapter: ProviderQuotaAdapter;\n    now: Date;\n    signal?: AbortSignal;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const secret = decodePlaintextCredential(input.credential);\n    let snapshot: NormalizedQuotaSnapshot;\n    try {\n      snapshot = await input.adapter.fetch({\n        credential: input.credential,\n        secret,\n        now: input.now,\n        signal: input.signal,\n      });\n    } catch (error) {\n      if (isAbortError(error)) {\n        throw error;\n      }\n      snapshot = errorQuotaSnapshot({\n        credential: input.credential.credentialIri,\n        source: quotaErrorSource(input.provider),\n        now: input.now,\n        metadata: { reason: 'provider_quota_unavailable' },\n      });\n    }\n    return this.repository.upsert({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      snapshot,\n      auth: input.auth,\n    });\n  }\n\n  private async resolveCredential(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri?: string;\n    auth?: AuthContext;\n  }): Promise<QuotaCredentialRecord> {\n    const listed = this.credentials.find((candidate) =>\n      candidate.webId === input.webId\n      && candidate.deployment === input.deployment\n      && normalizeProvider(candidate.provider) === input.provider\n      && (!input.credentialIri || candidate.credentialIri === input.credentialIri));\n    if (listed) {\n      return listed;\n    }\n\n    const active = await this.credentialRepository?.getActiveCredential({\n      webId: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      auth: input.auth,\n    });\n    if (\n      active\n      && (!input.credentialIri || active.credentialIri === input.credentialIri)\n    ) {\n      return active as QuotaCredentialRecord;\n    }\n    throw new Error('quota_credential_not_found');\n  }\n}\n\nexport class InMemoryQuotaSnapshotRepository implements QuotaSnapshotRepository {\n  public readonly rows: Array<NormalizedQuotaSnapshot & {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n  }> = [];\n\n  public async findFresh(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    now: Date;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const latest = await this.findLatest(input);\n    if (!latest || new Date(latest.expiresAt).getTime() <= input.now.getTime()) {\n      return undefined;\n    }\n    return latest;\n  }\n\n  public async findLatest(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const row = this.rows\n      .filter((candidate) =>\n        candidate.webId === input.webId\n        && candidate.deployment === input.deployment\n        && normalizeProvider(candidate.provider) === normalizeProvider(input.provider)\n        && candidate.credential === input.credentialIri)\n      .sort((a, b) => new Date(b.observedAt).getTime() - new Date(a.observedAt).getTime())[0];\n    return row ? publicSnapshot(row) : undefined;\n  }\n\n  public async upsert(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    snapshot: NormalizedQuotaSnapshot;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const id = input.snapshot.id ?? buildQuotaSnapshotId({\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: input.snapshot.credential,\n    });\n    const next = {\n      ...sanitizeSnapshot(input.snapshot),\n      id,\n      webId: input.webId,\n      deployment: input.deployment,\n      provider: normalizeProvider(input.provider),\n      stale: false,\n    };\n    const index = this.rows.findIndex((row) => row.id === id);\n    if (index === -1) {\n      this.rows.push(next);\n    } else {\n      this.rows[index] = next;\n    }\n    return publicSnapshot(next);\n  }\n}\n\ntype QuotaSnapshotDb = {\n  init?: (...resources: unknown[]) => Promise<void>;\n  select(): {\n    from(resource: typeof quotaSnapshotResource): {\n      where(condition: unknown): { execute(): Promise<QuotaSnapshotRow[]> };\n    };\n  };\n  findById<TRow>(resource: typeof quotaSnapshotResource, id: string): Promise<TRow | null>;\n  findByIri<TRow>(resource: typeof quotaSnapshotResource, iri: string): Promise<TRow | null>;\n  updateById<TRow>(resource: typeof quotaSnapshotResource, id: string, patch: unknown): Promise<TRow | null>;\n  updateByIri<TRow>(resource: typeof quotaSnapshotResource, iri: string, patch: unknown): Promise<TRow | null>;\n  insert(resource: typeof quotaSnapshotResource): {\n    values(value: unknown): { execute(): Promise<QuotaSnapshotRow[]> };\n  };\n};\n\nexport interface PodQuotaSnapshotRepositoryOptions {\n  internalPodAccess?: InternalPodAccessTokenProvider;\n  dbFactory?: (input: {\n    owner: string;\n    auth?: AuthContext;\n    fetch: typeof fetch;\n  }) => Promise<QuotaSnapshotDb>;\n}\n\nexport class PodQuotaSnapshotRepository implements QuotaSnapshotRepository {\n  private readonly dbFactory: NonNullable<PodQuotaSnapshotRepositoryOptions['dbFactory']>;\n  private readonly internalPodAccess?: InternalPodAccessTokenProvider;\n\n  public constructor(options: PodQuotaSnapshotRepositoryOptions = {}) {\n    this.internalPodAccess = options.internalPodAccess;\n    this.dbFactory = options.dbFactory ?? createDefaultQuotaSnapshotDb;\n  }\n\n  public async findFresh(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    now: Date;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const db = await this.dbForOwner(input.webId, input.auth);\n    const row = await aiGatewayRepository.findFreshQuotaSnapshot(db as never, {\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: input.credentialIri,\n      now: input.now,\n    });\n    return row ? snapshotFromRow(row, false) : undefined;\n  }\n\n  public async findLatest(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    credentialIri: string;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot | undefined> {\n    const db = await this.dbForOwner(input.webId, input.auth);\n    const row = await aiGatewayRepository.findLatestQuotaSnapshot(db as never, {\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: input.credentialIri,\n    });\n    return row ? snapshotFromRow(row, true) : undefined;\n  }\n\n  public async upsert(input: {\n    webId: string;\n    deployment: GatewayDeployment;\n    provider: string;\n    snapshot: NormalizedQuotaSnapshot;\n    auth?: AuthContext;\n  }): Promise<NormalizedQuotaSnapshot> {\n    const db = await this.dbForOwner(input.webId, input.auth);\n    const snapshot = sanitizeSnapshot({\n      ...input.snapshot,\n      id: input.snapshot.id ?? buildQuotaSnapshotId({\n        owner: input.webId,\n        deployment: input.deployment,\n        provider: input.provider,\n        credential: input.snapshot.credential,\n      }),\n    });\n    await aiGatewayRepository.upsertQuotaSnapshot(db as never, {\n      id: snapshot.id!,\n      owner: input.webId,\n      deployment: input.deployment,\n      provider: input.provider,\n      credential: snapshot.credential,\n      status: snapshot.status,\n      balance: snapshot.balance,\n      windows: JSON.stringify(snapshot.windows),\n      observedAt: new Date(snapshot.observedAt),\n      expiresAt: new Date(snapshot.expiresAt),\n      source: snapshot.source,\n    } as never);\n    return { ...snapshot, stale: false };\n  }\n\n  private async dbForOwner(owner: string, auth?: AuthContext): Promise<QuotaSnapshotDb> {\n    const trustedFetch = await this.resolveTrustedFetch(owner, auth);\n    const db = await this.dbFactory({ owner, auth, fetch: trustedFetch });\n    await db.init?.(quotaSnapshotResource);\n    return db;\n  }\n\n  private async resolveTrustedFetch(owner: string, auth?: AuthContext): Promise<typeof fetch> {\n    const trustedFetch = await this.internalPodAccess?.getTrustedFetch(owner, auth);\n    if (!trustedFetch) {\n      throw new Error('AI Connection service identity is not configured');\n    }\n    return async (input, init) => {\n      const response = await trustedFetch(input, init);\n      if (response.status === 403) {\n        throw new Error('service_access_missing');\n      }\n      return response;\n    };\n  }\n}\n\nexport function unsupportedQuotaSnapshot(\n  input: {\n    credential: string;\n    source: string;\n    now: Date;\n    ttlMs?: number;\n    metadata?: Record<string, unknown>;\n  },\n): NormalizedQuotaSnapshot {\n  return {\n    credential: input.credential,\n    status: 'unsupported',\n    windows: [],\n    observedAt: input.now.toISOString(),\n    expiresAt: new Date(input.now.getTime() + (input.ttlMs ?? 60 * 60_000)).toISOString(),\n    source: input.source,\n    metadata: input.metadata,\n  };\n}\n\nexport function errorQuotaSnapshot(\n  input: {\n    credential: string;\n    source: string;\n    now: Date;\n    status?: number;\n    retryAfter?: string | null;\n    ttlMs?: number;\n    metadata?: Record<string, unknown>;\n  },\n): NormalizedQuotaSnapshot {\n  return {\n    credential: input.credential,\n    status: 'error',\n    windows: [],\n    observedAt: input.now.toISOString(),\n    expiresAt: new Date(input.now.getTime() + (input.ttlMs ?? 5 * 60_000)).toISOString(),\n    source: input.source,\n    metadata: {\n      ...input.metadata,\n      ...(input.status ? { providerStatusCode: input.status } : {}),\n      ...(input.status === 429 ? {\n        cooldown: {\n          reason: 'rate_limited',\n          ...(retryAfterSeconds(input.retryAfter) !== undefined ? { retryAfterSeconds: retryAfterSeconds(input.retryAfter) } : {}),\n        },\n      } : {}),\n    },\n  };\n}\n\nexport function apiKeyFromSecret(secret: ProviderSecret): string | undefined {\n  const apiKey = secret.apiKey;\n  return typeof apiKey === 'string' && apiKey.trim() ? apiKey : undefined;\n}\n\nexport async function fetchJsonWithBearer(input: {\n  fetch: typeof fetch;\n  url: string;\n  apiKey: string;\n  signal?: AbortSignal;\n}): Promise<{ ok: true; body: unknown } | { ok: false; status: number; retryAfter?: string | null }> {\n  const headers = new Headers();\n  headers.set('Authorization', `Bearer ${input.apiKey}`);\n  const response = await input.fetch(input.url, {\n    method: 'GET',\n    headers,\n    signal: input.signal,\n  });\n  if (!response.ok) {\n    await response.text().catch(() => '');\n    return {\n      ok: false,\n      status: response.status,\n      retryAfter: response.headers.get('Retry-After') ?? response.headers.get('retry-after'),\n    };\n  }\n  return { ok: true, body: await response.json() };\n}\n\nexport function numeric(value: unknown): number | undefined {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return value;\n  }\n  if (typeof value === 'string' && value.trim()) {\n    const parsed = Number(value);\n    return Number.isFinite(parsed) ? parsed : undefined;\n  }\n  return undefined;\n}\n\nexport function decimalAmount(value: unknown): {\n  exact?: string;\n  numeric?: number;\n  displayApprox?: boolean;\n} {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    return {\n      exact: String(value),\n      numeric: value,\n      ...(Number.isSafeInteger(value) ? {} : { displayApprox: true }),\n    };\n  }\n  if (typeof value !== 'string') {\n    return {};\n  }\n  const exact = value.trim();\n  if (!exact) {\n    return {};\n  }\n  const parsed = Number(exact);\n  if (!Number.isFinite(parsed) || Math.abs(parsed) > Number.MAX_SAFE_INTEGER) {\n    return { exact };\n  }\n  return {\n    exact,\n    numeric: parsed,\n    ...(/[.eE]/u.test(exact) ? { displayApprox: true } : {}),\n  };\n}\n\nexport function normalizeProvider(provider: string): string {\n  return provider.trim().toLowerCase();\n}\n\nfunction retryAfterSeconds(value: string | null | undefined): number | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const seconds = Number(value);\n  if (Number.isFinite(seconds)) {\n    return seconds;\n  }\n  const date = new Date(value);\n  if (Number.isNaN(date.getTime())) {\n    return undefined;\n  }\n  return Math.max(0, Math.ceil((date.getTime() - Date.now()) / 1000));\n}\n\nfunction quotaRefreshKey(input: {\n  webId: string;\n  deployment: GatewayDeployment;\n  provider: string;\n  credentialIri: string;\n}): string {\n  return JSON.stringify([\n    input.webId,\n    input.deployment,\n    normalizeProvider(input.provider),\n    input.credentialIri,\n  ]);\n}\n\nfunction quotaErrorSource(provider: string): string {\n  switch (normalizeProvider(provider)) {\n    case 'kimi':\n      return 'kimi:/v1/users/me/balance';\n    case 'deepseek':\n      return 'deepseek:/user/balance';\n    case 'openai':\n      return 'openai:no-credential-quota-api';\n    case 'anthropic':\n      return 'anthropic:no-credential-quota-api';\n    case 'bailian':\n      return 'bailian:console-only';\n    default:\n      return `${normalizeProvider(provider)}:quota`;\n  }\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return Boolean(\n    error\n    && typeof error === 'object'\n    && 'name' in error\n    && (error as { name?: unknown }).name === 'AbortError',\n  );\n}\n\nfunction sanitizeSnapshot(snapshot: NormalizedQuotaSnapshot): NormalizedQuotaSnapshot {\n  return {\n    ...snapshot,\n    windows: snapshot.windows.map((window) => ({ ...window })),\n    metadata: snapshot.metadata ? sanitizeMetadata(snapshot.metadata) : undefined,\n  };\n}\n\nfunction sanitizeMetadata(metadata: Record<string, unknown>): Record<string, unknown> {\n  return JSON.parse(JSON.stringify(metadata, (_key, value) => {\n    if (typeof value === 'string' && /secret|sk-|api[_-]?key/i.test(value)) {\n      return '[redacted]';\n    }\n    return value;\n  })) as Record<string, unknown>;\n}\n\nfunction publicSnapshot(snapshot: NormalizedQuotaSnapshot): NormalizedQuotaSnapshot {\n  return sanitizeSnapshot(snapshot);\n}\n\nfunction snapshotFromRow(row: QuotaSnapshotRow, stale: boolean): NormalizedQuotaSnapshot {\n  return sanitizeSnapshot({\n    id: String(row.id),\n    credential: String(row.credential),\n    status: row.status === 'available' || row.status === 'unsupported' ? row.status : 'error',\n    balance: typeof row.balance === 'number' ? row.balance : undefined,\n    windows: parseWindows(row.windows),\n    observedAt: toIso(row.observedAt),\n    expiresAt: toIso(row.expiresAt),\n    source: typeof row.source === 'string' ? row.source : '',\n    stale,\n  });\n}\n\nfunction parseWindows(value: unknown): QuotaWindow[] {\n  if (typeof value !== 'string') {\n    return [];\n  }\n  try {\n    const parsed = JSON.parse(value);\n    return Array.isArray(parsed)\n      ? parsed.filter((item) => item && typeof item === 'object' && typeof item.name === 'string')\n      : [];\n  } catch {\n    return [];\n  }\n}\n\nfunction toIso(value: unknown): string {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n  if (typeof value === 'string' || typeof value === 'number') {\n    const parsed = new Date(value);\n    if (!Number.isNaN(parsed.getTime())) {\n      return parsed.toISOString();\n    }\n  }\n  return new Date(0).toISOString();\n}\n\nfunction createDefaultQuotaSnapshotDb(input: {\n  owner: string;\n  auth?: AuthContext;\n  fetch: typeof fetch;\n}): Promise<QuotaSnapshotDb> {\n  return Promise.resolve(drizzle(\n    {\n      fetch: input.fetch,\n      info: { webId: input.owner, isLoggedIn: true },\n    } as any,\n    {\n      schema: {\n        quotaSnapshot: quotaSnapshotResource,\n      },\n    },\n  ) as unknown as QuotaSnapshotDb);\n}\n"]}

package/dist/api/ai-gateway/service-access/AiConnectionServiceAccess.d.ts

@@ -8,7 +8,7 @@ export interface AiConnectionServiceAccessDescriptor {
     resources: AiConnectionServiceAccessResource[];
 }
 export interface AiConnectionServiceAccessResource {
-    id: 'providerCredentials' | 'providerDefinitions' | 'gatewayAccessKeys' | 'quotaSnapshots';
+    id: 'providerCredentials' | 'providerDefinitions' | 'quotaSnapshots';
     url: string;
     mediaType: 'text/turtle';
     access: {

package/dist/api/ai-gateway/service-access/AiConnectionServiceAccess.js

@@ -8,7 +8,6 @@ exports.AI_CONNECTION_APPLET_ID = 'co.undefineds.ai-connection';
 const declaredResourceBases = new WeakMap([
     [models_1.credentialResource, declaredResourceBase(models_1.credentialResource)],
     [models_1.aiProviderResource, declaredResourceBase(models_1.aiProviderResource)],
-    [models_1.gatewayAccessKeyResource, declaredResourceBase(models_1.gatewayAccessKeyResource)],
     [models_1.quotaSnapshotResource, declaredResourceBase(models_1.quotaSnapshotResource)],
 ]);
 function createAiConnectionServiceAccess(input) {
@@ -21,7 +20,6 @@ function createAiConnectionServiceAccess(input) {
         resources: [
             ['providerCredentials', resourceUrl(input.ownerWebId, models_1.credentialResource)],
             ['providerDefinitions', resourceUrl(input.ownerWebId, models_1.aiProviderResource)],
-            ['gatewayAccessKeys', resourceUrl(input.ownerWebId, models_1.gatewayAccessKeyResource)],
             ['quotaSnapshots', resourceUrl(input.ownerWebId, models_1.quotaSnapshotResource)],
         ].map(([id, url]) => ({
             id,