aweshare 0.5.6 → 0.5.8

package/apps/hub/dist/admin.d.ts

@@ -1,8 +1,9 @@
 import type Database from 'better-sqlite3';
 import type { Logger } from 'pino';
 import type { AuthContext } from './auth.js';
+import { type ModelWatch } from './consumer.js';
 import { type Router } from './http.js';
-import type { AliasSlots, AliasUsers } from './limiter.js';
+import type { AliasSlots, AliasUsers, RejectionCounter } from './limiter.js';
 import type { LocalProducer } from './local.js';
 import type { Tunnel } from './tunnel.js';
 export interface AdminDeps {
@@ -15,6 +16,9 @@ export interface AdminDeps {
      * view reports in-flight occupancy from it. */
     slots: AliasSlots;
     users: AliasUsers;
+    /** Admission rejections since process start — the throttling-pressure view. */
+    rejections: Pick<RejectionCounter, 'snapshot'>;
+    watch: Pick<ModelWatch, 'reset'>;
 }
 /** Audit and governance: rosters, usage, per-consumer limits. Admission is
  * invite-only — see invites.ts; every identity therefore carries an invite

package/apps/hub/dist/admin.js

@@ -1,7 +1,7 @@
 import { roleForToken } from '../../../packages/protocol/dist/index.js';
 import { requireAdmin, requireConsumer, requireProducer } from './auth.js';
-import { offeringView, serializeOffering } from './consumer.js';
-import { getConsumerByName, getProducerByName, LOCAL_PRODUCER_ID, listOfferings, listTokens, queryUsage, setConsumerConfig, summarizeUsage, } from './db.js';
+import { DEFAULT_DAILY_TOKENS, offeringView, serializeOffering, } from './consumer.js';
+import { blockOffering, dailyBonusOf, dailyWindowStart, getConsumerByName, getProducerByName, LOCAL_PRODUCER_ID, listOfferings, listOfferingsByAlias, listTokens, nextBeijingMidnight, queryUsage, refreshOfferingQuota, restoreOffering, setConsumerConfig, summarizeUsage, sumTokensForAliasSince, } from './db.js';
 import { extractCredential, HttpError, readJson, sendJson } from './http.js';
 import { parseLimits, safeParseLimits } from './limits.js';
 /** Audit and governance: rosters, usage, per-consumer limits. Admission is
@@ -29,6 +29,18 @@ export function registerAdminRoutes(router, deps) {
             throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown producer: ${name}`);
         return producer.id;
     };
+    /** ?alias=ns/model for the block/restore endpoints — required, and it must
+     * name a registered offering (0 protocol rows = unknown alias). */
+    const offeringAliasFromQuery = (query) => {
+        const alias = query.get('alias');
+        if (!alias) {
+            throw new HttpError(400, 'ALIAS_REQUIRED', 'query parameter alias is required (ns/model)');
+        }
+        if (listOfferingsByAlias(db, alias).length === 0) {
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown offering alias: ${alias}`);
+        }
+        return alias;
+    };
     router.add('GET', '/admin/v1/tokens', (ctx) => {
         requireAdmin(ctx.req, auth);
         const { producers, consumers } = listTokens(db);
@@ -60,6 +72,96 @@ export function registerAdminRoutes(router, deps) {
         requireAdmin(ctx.req, auth);
         sendJson(ctx.res, 200, offeringsPayload(deps));
     });
+    // The per-alias scalpel between "do nothing" and revoking the whole
+    // producer: block one offering (every protocol row of the alias) and its
+    // requests fail with 503 OFFERING_BLOCKED while the producer's honest
+    // offerings keep serving. Reversible. The alias rides the query string —
+    // it contains a '/', which path params can't carry.
+    router.add('POST', '/admin/v1/offerings/block', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const alias = offeringAliasFromQuery(ctx.query);
+        const rows = blockOffering(db, alias, 'manual');
+        deps.log.info({ alias, rows }, 'offering blocked (operator)');
+        sendJson(ctx.res, 200, { alias, blocked: true, offerings: rows });
+    });
+    router.add('POST', '/admin/v1/offerings/restore', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const alias = offeringAliasFromQuery(ctx.query);
+        const rows = restoreOffering(db, alias);
+        deps.watch.reset(alias);
+        deps.log.info({ alias, rows }, 'offering restored (operator)');
+        sendJson(ctx.res, 200, { alias, blocked: false, offerings: rows });
+    });
+    // Owner-side quota refresh, the expand-side counterpart to block: re-anchor
+    // today's window at now, raise today's cap by ?add=N until Beijing
+    // midnight, or ?clear=true both. Authority follows ownership — the producer
+    // key refreshes only its own offerings, the admin key only the hub-hosted
+    // ones (the hub may restrict a producer's model, never spend more of its
+    // upstream quota for it). The alias rides the query string like block.
+    router.add('POST', '/admin/v1/offerings/refresh', (ctx) => {
+        const producerCaller = roleForToken(extractCredential(ctx.req) ?? '') === 'producer';
+        let owner;
+        if (producerCaller) {
+            owner = requireProducer(ctx.req, auth).row.id;
+        }
+        else {
+            requireAdmin(ctx.req, auth);
+            owner = LOCAL_PRODUCER_ID;
+        }
+        const alias = offeringAliasFromQuery(ctx.query);
+        const rows = listOfferingsByAlias(db, alias);
+        if (rows.some((r) => r.producer_id !== owner)) {
+            throw new HttpError(403, 'ALIAS_NOT_OWNED', producerCaller
+                ? `alias ${alias} is not one of your offerings — a producer refreshes only its own models`
+                : `alias ${alias} belongs to a producer — the hub side refreshes only its own hub/... models; that producer runs 'aweshare producer refresh ${alias}' itself`);
+        }
+        const declared = rows[0]?.daily_tokens;
+        if (declared === 0) {
+            throw new HttpError(400, 'NO_DAILY_CAP', `alias ${alias} sets dailyTokens = 0 (unlimited) — there is no daily budget to refresh`);
+        }
+        const clear = ctx.query.get('clear') === 'true';
+        const rawAdd = ctx.query.get('add');
+        if (clear && rawAdd !== null) {
+            throw new HttpError(400, 'INVALID_ACTION', 'add and clear are separate actions — pass one');
+        }
+        let add;
+        if (rawAdd !== null) {
+            add = Number(rawAdd);
+            if (!Number.isSafeInteger(add) || add <= 0) {
+                throw new HttpError(400, 'INVALID_BONUS', `add must be a positive integer, got '${rawAdd}'`);
+            }
+        }
+        const offerings = refreshOfferingQuota(db, alias, { add, clear });
+        // re-read the row the markers just landed on: the reply reports the
+        // resulting effective budget, whichever action ran
+        const row = listOfferingsByAlias(db, alias)[0];
+        if (!row)
+            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown offering alias: ${alias}`);
+        const cap = (declared ?? DEFAULT_DAILY_TOKENS) + dailyBonusOf(row);
+        const used = sumTokensForAliasSince(db, alias, dailyWindowStart(row));
+        deps.log.info({ alias, owner, add, clear }, 'offering quota refreshed');
+        sendJson(ctx.res, 200, {
+            alias,
+            reset: add === undefined && !clear,
+            bonus: add ?? null,
+            bonusUntil: row.quota_bonus_until,
+            offerings,
+            quota: {
+                cap,
+                used,
+                remaining: Math.max(0, cap - used),
+                resetsAt: nextBeijingMidnight(),
+            },
+        });
+    });
+    // Throttling pressure since hub start: every admission 429 by code, alias
+    // and consumer. In-memory like the limiters it reports on — a restart zeros
+    // the view, never any limit. The operator's evidence for tuning
+    // maxConcurrentUsers / maxConcurrencyPerUser / consumer rps.
+    router.add('GET', '/admin/v1/rejections', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        sendJson(ctx.res, 200, deps.rejections.snapshot());
+    });
     // Detail log and aggregate summary share the same slice semantics: admin
     // sees everything, a producer key its own registrations, a consumer key its
     // own requests. Rows carry joined consumer/producer names so callers never

package/apps/hub/dist/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIhD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC/D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAe,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzF,OAAO,EAAuB,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAgB/E;;qCAEqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAe;IACjE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IAEzB;4DACwD;IACxD,MAAM,mBAAmB,GAAG,CAAC,KAAsB,EAAsB,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAA;QACvF,OAAO,QAAQ,CAAC,EAAE,CAAA;IACpB,CAAC,CAAA;IACD,MAAM,mBAAmB,GAAG,CAAC,KAAsB,EAAsB,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAA;QACvF,OAAO,QAAQ,CAAC,EAAE,CAAA;IACpB,CAAC,CAAA;IAED,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;QAC/C,iEAAiE;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC;YACJ,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS;SACvF,CAAC,CAAC,CAAA;QACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,oEAAoE;IACpE,6EAA6E;IAC7E,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/C,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAA;YAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;gBACb,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;gBACb,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,sEAAsE;QACtE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3D,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;YACb,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAC1C,KAAK;SACN,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,+DAA+D;IAC/D,yEAAyE;IACzE,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAA;QACxD,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC5E,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,eAAe,EACf,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QAC/C,IAAI,KAAyB,CAAA;QAC7B,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAA;YACvF,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAC9D,CAAC,CAAC,CAAC,CAA0B,CAC9B,CAAA;YACD,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAA;YAC9E,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,cAAc,CAAC,EAAE,EAAE;gBACjB,KAAK;gBACL,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,cAAc,CAAC,EAAE,EAAE;gBACjB,KAAK;gBACL,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3D,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,cAAc,CAAC,EAAE,EAAE;YACjB,KAAK;YACL,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAC1C,KAAK;SACN,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5D,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,IAAI,QAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAA;QACnE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/D,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,CAAC,CAAA;QACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;0EAC0E;AAC1E,SAAS,gBAAgB,CAAC,IAAe,EAAE,UAAmB;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC;SACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAA;IACL,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;AAC3C,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIhD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC1E,OAAO,EACL,oBAAoB,EAEpB,YAAY,EACZ,iBAAiB,GAClB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,mBAAmB,EACnB,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,sBAAsB,GACvB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAe,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEzF,OAAO,EAAuB,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAmB/E;;qCAEqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAe;IACjE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAA;IAEzB;4DACwD;IACxD,MAAM,mBAAmB,GAAG,CAAC,KAAsB,EAAsB,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAA;QACvF,OAAO,QAAQ,CAAC,EAAE,CAAA;IACpB,CAAC,CAAA;IACD,MAAM,mBAAmB,GAAG,CAAC,KAAsB,EAAsB,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAA;QACvF,OAAO,QAAQ,CAAC,EAAE,CAAA;IACpB,CAAC,CAAA;IAED;uEACmE;IACnE,MAAM,sBAAsB,GAAG,CAAC,KAAsB,EAAU,EAAE;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,8CAA8C,CAAC,CAAA;QAC5F,CAAC;QACD,IAAI,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IAED,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5C,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;QAC/C,iEAAiE;QACjE,uEAAuE;QACvE,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,CAAC;YACJ,MAAM,EAAE,CAAC,CAAC,EAAE,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS;SACvF,CAAC,CAAC,CAAA;QACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,oEAAoE;IACpE,6EAA6E;IAC7E,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,qBAAqB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/C,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9C,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAA;YAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;YACrD,OAAM;QACR,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,2BAA2B,EAAE,CAAC,GAAG,EAAE,EAAE;QACtD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,6BAA6B,CAAC,CAAA;QAC7D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,GAAG,EAAE,EAAE;QACxD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,8BAA8B,CAAC,CAAA;QAC9D,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,mEAAmE;IACnE,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,GAAG,EAAE,EAAE;QACxD,MAAM,cAAc,GAAG,YAAY,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,UAAU,CAAA;QACpF,IAAI,KAAa,CAAA;QACjB,IAAI,cAAc,EAAE,CAAC;YACnB,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAA;QAC/C,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,KAAK,GAAG,iBAAiB,CAAA;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5C,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,iBAAiB,EACjB,cAAc;gBACZ,CAAC,CAAC,SAAS,KAAK,0EAA0E;gBAC1F,CAAC,CAAC,SAAS,KAAK,8HAA8H,KAAK,UAAU,CAChK,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAA;QACtC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,cAAc,EACd,SAAS,KAAK,yEAAyE,CACxF,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAA;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,KAAK,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAA;QAC7F,CAAC;QACD,IAAI,GAAuB,CAAA;QAC3B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YACpB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,wCAAwC,MAAM,GAAG,CAAC,CAAA;YAC9F,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;QACjE,oEAAoE;QACpE,mDAAmD;QACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,2BAA2B,KAAK,EAAE,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,oBAAoB,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAClE,MAAM,IAAI,GAAG,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAA;QACvE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,KAAK;YACL,KAAK,EAAE,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK;YAClC,KAAK,EAAE,GAAG,IAAI,IAAI;YAClB,UAAU,EAAE,GAAG,CAAC,iBAAiB;YACjC,SAAS;YACT,KAAK,EAAE;gBACL,GAAG;gBACH,IAAI;gBACJ,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC;gBAClC,QAAQ,EAAE,mBAAmB,EAAE;aAChC;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,6DAA6D;IAC7D,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,sBAAsB,EAAE,CAAC,GAAG,EAAE,EAAE;QAChD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAA;QAC1F,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;gBACb,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;gBACb,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,sEAAsE;QACtE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3D,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,UAAU,CAAC,EAAE,EAAE;YACb,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAC1C,KAAK;SACN,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,+DAA+D;IAC/D,yEAAyE;IACzE,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,yBAAyB,EAAE,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,gBAAgB,CAAA;QACxD,IAAI,KAAK,KAAK,gBAAgB,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YAC5E,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,eAAe,EACf,uDAAuD,CACxD,CAAA;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAA;QAC/C,IAAI,KAAyB,CAAA;QAC7B,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,0CAA0C,CAAC,CAAA;YACvF,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAC9D,CAAC,CAAC,CAAC,CAA0B,CAC9B,CAAA;YACD,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;YACvD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAA;YAC9E,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC3B,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,cAAc,CAAC,EAAE,EAAE;gBACjB,KAAK;gBACL,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC9C,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,cAAc,CAAC,EAAE,EAAE;gBACjB,KAAK;gBACL,UAAU,EAAE,GAAG,CAAC,EAAE;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;gBAC1C,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC1C,KAAK;aACN,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3D,QAAQ,CACN,GAAG,CAAC,GAAG,EACP,GAAG,EACH,cAAc,CAAC,EAAE,EAAE;YACjB,KAAK;YACL,UAAU,EAAE,WAAW,CAAC,EAAE;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YAC1C,KAAK;SACN,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5D,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,kCAAkC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClE,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,IAAI,QAAwB,CAAA;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAG,GAAa,CAAC,OAAO,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAA;QACnE,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC1D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/D,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,CAAA;QACjE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,EAAE,qBAAqB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QACrF,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,CAAC,CAAA;QACrE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;0EAC0E;AAC1E,SAAS,gBAAgB,CAAC,IAAe,EAAE,UAAmB;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,UAAU,CAAC;SACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,cAAc;QAC/B,SAAS,EAAE,CAAC,CAAC,UAAU;KACxB,CAAC,CAAC,CAAA;IACL,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAA;AAC3C,CAAC"}

package/apps/hub/dist/auth.js

@@ -15,7 +15,7 @@ export function requireProducer(req, auth) {
     if (!row)
         throw new HttpError(401, 'INVALID_KEY', 'invalid producer token');
     if (row.revoked_at) {
-        throw new HttpError(401, 'TOKEN_REVOKED', 'producer token was suspended by the operator — ask them to restore it (aweshare hub restore)');
+        throw new HttpError(401, 'TOKEN_REVOKED', 'producer token was suspended by the operator — ask them to restore it (aweshare hub invite restore N)');
     }
     if (isExpired(row.expires_at))
         throw expiredError('producer token');

package/apps/hub/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,SAAS,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAQlD,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,IAAiB;IAClE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,IAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,eAAe,EACf,8FAA8F,CAC/F,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,IAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACzE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,eAAe,EACf,iFAAiF,CAClF,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,YAAY,CAAC,cAAc,CAAC,CAAA;IACjE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACvB,CAAC;AAED;8EAC8E;AAC9E,SAAS,SAAS,CAAC,SAAwB;IACzC,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,SAAS,CAClB,GAAG,EACH,eAAe,EACf,GAAG,IAAI,6FAA6F,CACrG,CAAA;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,SAAS,CAAA;AACpG,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAQlD,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,IAAiB;IAClE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,IAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,yBAAyB,CAAC,CAAA;IAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,wBAAwB,CAAC,CAAA;IAC3E,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,eAAe,EACf,uGAAuG,CACxG,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,YAAY,CAAC,gBAAgB,CAAC,CAAA;IACnE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,IAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,aAAa,EAAE,sBAAsB,CAAC,CAAA;IACzE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,eAAe,EACf,iFAAiF,CAClF,CAAA;IACH,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,MAAM,YAAY,CAAC,cAAc,CAAC,CAAA;IACjE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACvB,CAAC;AAED;8EAC8E;AAC9E,SAAS,SAAS,CAAC,SAAwB;IACzC,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,SAAS,CAClB,GAAG,EACH,eAAe,EACf,GAAG,IAAI,6FAA6F,CACrG,CAAA;AACH,CAAC"}

package/apps/hub/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { fmtDate } from '../../../packages/protocol/dist/index.js';
 import { ensureDataDir, HUB_CONFIG_TEMPLATE, initHubProduceFiles, loadHubConfig, readAdminToken, resolvePaths, } from './config.js';
 import { createHubServer, installConfigReloader } from './server.js';
 import { renderHubStatus, renderInvites, renderUsage, renderUsageSummary, } from './table.js';
@@ -17,13 +18,13 @@ Options:
 Commands:
   init     Create the data dir, pepper, and admin token.
   serve    Run the hub server.
-  produce  Run the hub serving its own models too (alias namespace hub/...).
-  invite   Mint one-time invite codes (producers or consumers).
+  produce  Run the hub serving its own models too (hub/...); 'refresh'
+           re-anchors or raises one hub model's daily token budget.
+  invite   Mint invite codes (default); revoke or restore one by id.
   list     Read hub state: invites (the ledger) or usage (consumption).
   limits   Show, set or clear one consumer's limit overrides.
-  status   Live state: capacity, producer/consumer rosters, offering health.
-  revoke   Kill an invite: pending stops pairing, redeemed suspends its identity.
-  restore  Undo a revoke: pending pairs again, redeemed revives its identity.`;
+  status   Live state: capacity, offering health; rosters print with --all.
+  offering Block or restore one offering alias (the per-alias scalpel).`;
 const COMMAND_HELP = {
     init: `Usage: aweshare hub init
 
@@ -43,7 +44,7 @@ Options:
   --host ADDR  Address to listen on (default from AWESHARE_HUB_HOST, else 0.0.0.0).
   --port N     Port to listen on, 1..65535 (default from AWESHARE_HUB_PORT, else 8787).
   -h, --help   Show this message and exit.`,
-    produce: `Usage: aweshare hub produce [init] [OPTIONS]
+    produce: `Usage: aweshare hub produce [init|refresh] [OPTIONS]
 
   Run the hub with its own models attached. Identical to 'serve'; the
   difference is intent: define [[backends]] and [[offerings]] in the data
@@ -58,27 +59,56 @@ Options:
   owner-only secrets.json without replacing either existing file. It also
   initializes the Hub data directory, database, pepper and admin token.
 
+  ` +
+        '`refresh ALIAS`' +
+        ` works on a running hub, no restart: re-anchor the daily token
+  budget of one hub/... model at this moment (past usage today stops
+  counting), or raise it for the rest of today. Producer-registered models
+  (ns/...) are not the hub's to refresh — that producer runs
+  'aweshare producer refresh' itself. A permanent raise belongs in
+  config.produce.toml (dailyTokens), which hot-reloads.
+
+  Examples:
+    aweshare hub produce refresh glm-5.3                # today restarts now
+    aweshare hub produce refresh glm-5.3 --add 2000000  # today's cap +2M
+    aweshare hub produce refresh glm-5.3 --clear        # drop both markers
+
 Options:
   --host ADDR  Address to listen on (default from AWESHARE_HUB_HOST, else 0.0.0.0).
   --port N     Port to listen on, 1..65535 (default from AWESHARE_HUB_PORT, else 8787).
+  --add N      refresh only: raise today's cap by N tokens until Beijing midnight.
+  --clear      refresh only: drop the refresh marker and any bonus.
+  --json       refresh only: print the raw API response.
   -h, --help   Show this message and exit.`,
-    invite: `Usage: aweshare hub invite [OPTIONS]
+    invite: `Usage: aweshare hub invite [mint|revoke|restore] [ARGS] [OPTIONS]
 
-  Mint one-time invite codes (printed once; recover with: aweshare hub list
-  invites --reveal). Listing lives under 'list invites' on purpose — minting
-  sends real codes, reading the ledger never should.
+  The invite lifecycle. One code, one identity — and the invite is the
+  operator's handle from mint to suspension: revoking a redeemed code
+  suspends the producer or consumer it minted (a producer's tunnel closes,
+  a consumer's key stops working); restoring brings both back.
 
-Options:
-  --role ROLE     producer (default) or consumer — a consumer code redeems into
-                  an asc_ token the consumer pastes into their SDK env vars.
-  --name NAME     Bind the codes to one name (required for --role consumer;
-                  producers may leave it for redeem-time name + email).
-  --count N       Mint N codes, 1..100 (default 1; producer codes only).
-  --expires-in D  How long codes stay usable: 30m, 12h or 7d (default 7d) —
-                  since identity expiry landed, this also bounds the minted
-                  token's lifetime; 'none' mints a code (and identity) that
-                  never expires.
-  -h, --help      Show this message and exit.`,
+  Commands:
+    mint      Mint one-time invite codes (default). Printed once; recover
+              with: aweshare hub list invites --reveal. Listing lives under
+              'list invites' on purpose — minting sends real codes, reading
+              the ledger never should.
+    revoke N  Kill invite N: a pending code stops pairing, a redeemed one
+              suspends its identity (find ids with: aweshare hub list invites).
+    restore N Undo a revoke: pending pairs again, redeemed revives its
+              identity. Restoring a redeemed producer needs a free slot
+              (403 HUB_FULL at AWESHARE_MAX_PRODUCERS).
+
+  Options (mint only):
+    --role ROLE     producer (default) or consumer — a consumer code redeems into
+                    an asc_ token the consumer pastes into their SDK env vars.
+    --name NAME     Bind the codes to one name (required for --role consumer;
+                    producers may leave it for redeem-time name + email).
+    --count N       Mint N codes, 1..100 (default 1; producer codes only).
+    --expires-in D  How long codes stay usable: 30m, 12h or 7d (default 7d) —
+                    since identity expiry landed, this also bounds the minted
+                    token's lifetime; 'none' mints a code (and identity) that
+                    never expires.
+    -h, --help      Show this message and exit.`,
     list: `Usage: aweshare hub list [invites|usage] [OPTIONS]
 
   Read hub state (default: invites). The rosters and offering health live in
@@ -121,32 +151,33 @@ Options:
     --clear               Drop every override (back to hub-wide defaults).
     --json                Print the raw API response instead of text.
     -h, --help            Show this message and exit.`,
-    status: `Usage: aweshare hub status
+    status: `Usage: aweshare hub status [OPTIONS]
 
-  The hub's live state: capacity, the producer and consumer rosters, offering
-  health and the effective hub-wide consumer defaults. No tokens or request
-  contents appear. Offerings are counted per deduplicated alias (one alias,
-  several protocols, one verdict — the worst); the alias table uses the same
-  columns as 'consumer list' and 'producer list', sorted worst status first,
-  with live occupancy (IN USE n/max) and today's remaining daily tokens.
-  The last-5m health line comes from the usage summary — admission 429s are
-  never metered, so it reflects relayed outcomes only.
+  The hub's live state: capacity, offering health and the effective hub-wide
+  consumer defaults. No tokens or request contents appear. Offerings are
+  counted per deduplicated alias (one alias, several protocols, one verdict —
+  the worst); the alias table uses the same columns as 'consumer list' and
+  'producer list', sorted worst status first, with live occupancy (IN USE
+  n/max) and today's remaining daily tokens. The last-5m health line comes
+  from the usage summary — admission 429s are never metered, so it reflects
+  relayed outcomes only. The producer/consumer rosters are counts here; pass
+  --all to print them in full.
 
 Options:
+  --all       Also print the producer and consumer rosters (name, status,
+              online state, last seen).
   -h, --help  Show this message and exit.`,
-    revoke: `Usage: aweshare hub revoke [OPTIONS]
+    offering: `Usage: aweshare hub offering block|restore ALIAS
 
-  Kill an invite: pending stops pairing, redeemed suspends its identity.
+  Block one offering alias (every protocol row of it) or bring it back — the
+  scalpel between doing nothing and revoking the whole producer. A block 503s
+  new requests with OFFERING_BLOCKED while the producer's other offerings
+  keep serving; status shows 'blocked'. Manual blocks survive producer
+  re-registers; auto blocks (repeated model mismatch, only when
+  autoBlockModelMismatch is enabled) clear once the producer re-declares a
+  different upstreamModel.
 
 Options:
-  --id N      The invite id (see: aweshare hub list invites).
-  -h, --help  Show this message and exit.`,
-    restore: `Usage: aweshare hub restore [OPTIONS]
-
-  Undo a revoke: pending pairs again, redeemed revives its identity.
-
-Options:
-  --id N      The invite id (see: aweshare hub list invites).
   -h, --help  Show this message and exit.`,
 };
 function parseArgs(argv) {
@@ -236,12 +267,6 @@ function noPositionals(cmd, positional) {
     if (arg)
         fail(`unexpected argument '${arg}' — this command takes flags only (see: aweshare hub ${cmd} -h)`);
 }
-function requireId(flags) {
-    const id = flags.get('id');
-    if (!id)
-        fail('--id is required (find ids with: aweshare hub list invites)');
-    return id;
-}
 /** CLI flag name -> API key of the sparse limit override object. */
 const LIMIT_FLAGS = [
     ['rps', 'rps'],
@@ -325,6 +350,46 @@ async function main() {
                 console.log('next: add [[backends]] / [[offerings]] to config.produce.toml, fill secrets.json, then run: aweshare hub produce');
                 return;
             }
+            if (positional[0] === 'refresh') {
+                const raw = positional[1];
+                if (!raw)
+                    fail('produce refresh: alias is required (hub/model — the hub/ prefix is optional)');
+                if (positional[2])
+                    fail(`unexpected argument '${positional[2]}' (see: aweshare hub produce -h)`);
+                // hub-hosted offerings live in the reserved hub/ namespace — accept
+                // the bare name too; anything else the hub rejects as not its own
+                const alias = raw.includes('/') ? raw : `hub/${raw}`;
+                const params = new URLSearchParams({ alias });
+                const add = flags.get('add');
+                if (add !== undefined) {
+                    const n = Number(add);
+                    if (!Number.isSafeInteger(n) || n <= 0)
+                        fail(`--add must be a positive integer, got '${add}'`);
+                    params.set('add', String(n));
+                }
+                if (flags.get('clear') === 'true') {
+                    if (add !== undefined)
+                        fail('--clear drops both markers — drop --add too');
+                    params.set('clear', 'true');
+                }
+                const api = adminApi();
+                const out = (await api('POST', `/admin/v1/offerings/refresh?${params}`));
+                if (flags.get('json') === 'true') {
+                    console.log(JSON.stringify(out, null, 2));
+                    return;
+                }
+                const fmt = (n) => n.toLocaleString('en-US');
+                if (out.reset)
+                    console.log(`✓ ${out.alias} — today's window restarts now`);
+                else if (out.bonus !== null)
+                    console.log(`✓ ${out.alias} — today's cap +${fmt(out.bonus)} until ${out.bonusUntil}`);
+                else
+                    console.log(`✓ ${out.alias} — refresh markers cleared, the declared budget applies`);
+                console.log(`  today: ${fmt(out.quota.remaining)} of ${fmt(out.quota.cap)} left (${fmt(out.quota.used)} used) — resets ${out.quota.resetsAt}`);
+                if (out.reset)
+                    console.log(`  undo: aweshare hub produce refresh ${out.alias} --clear`);
+                return;
+            }
             // same runner as serve — 'produce' names the intent; the local catalog
             // is config-driven and loads either way.
             noPositionals('produce', positional);
@@ -339,13 +404,57 @@ async function main() {
             return;
         }
         case 'invite': {
-            noPositionals(cmd, positional);
+            // the invite lifecycle: mint (default), revoke, restore — one code, one
+            // identity, and every suspension travels through the invite that minted it
+            const sub = positional[0] ?? 'mint';
+            if (sub !== 'mint' && sub !== 'revoke' && sub !== 'restore') {
+                fail(`unknown invite action '${sub}' — expected mint, revoke or restore`);
+            }
+            const api = adminApi();
+            if (sub === 'revoke' || sub === 'restore') {
+                const id = positional[1];
+                if (!id)
+                    fail(`invite ${sub}: id is required (find ids with: aweshare hub list invites)`);
+                if (positional[2])
+                    fail(`unexpected argument '${positional[2]}' (see: aweshare hub invite -h)`);
+                if (sub === 'revoke') {
+                    const out = (await api('DELETE', `/admin/v1/invites/${id}`));
+                    if (!out.revoked && !out.suspended) {
+                        console.log(`invite ${id} was already revoked — nothing to do`);
+                        return;
+                    }
+                    if (out.suspended) {
+                        console.log(`✓ invite ${id} revoked — ${out.suspended.role} '${out.suspended.name}' suspended, its token no longer works`);
+                    }
+                    else {
+                        console.log(`✓ invite ${id} revoked — the code no longer pairs`);
+                    }
+                    console.log(`  undo: aweshare hub invite restore ${id}`);
+                    return;
+                }
+                const out = (await api('POST', `/admin/v1/invites/${id}/restore`));
+                if (!out.restored) {
+                    console.log(`invite ${id} was not revoked — nothing to restore`);
+                    return;
+                }
+                if (out.restoredProducer) {
+                    console.log(`✓ invite ${id} restored — producer '${out.restoredProducer.name}' is back`);
+                }
+                else if (out.restoredConsumer) {
+                    console.log(`✓ invite ${id} restored — consumer '${out.restoredConsumer.name}' is back`);
+                }
+                else {
+                    console.log(`✓ invite ${id} restored — the code pairs again (its original expiry still applies)`);
+                }
+                return;
+            }
+            if (positional[1])
+                fail(`unexpected argument '${positional[1]}' (see: aweshare hub invite -h)`);
             // minting is the one state-changing read-adjacent verb — refuse the old
             // ledger flag loudly instead of silently minting a code
             if (flags.has('list')) {
                 fail("'hub invite --list' became its own command — the ledger is: aweshare hub list invites");
             }
-            const api = adminApi();
             const body = {};
             const role = flags.get('role') ?? 'producer';
             if (role !== 'producer' && role !== 'consumer')
@@ -448,7 +557,7 @@ async function main() {
                 }
                 const window = since === 'all'
                     ? 'all time'
-                    : `since ${new Date(Date.now() - parseDuration(since)).toISOString().slice(0, 10)} (${since})`;
+                    : `since ${fmtDate(new Date(Date.now() - parseDuration(since)))} (${since})`;
                 const grouping = group === 'alias' ? 'alias' : group === 'consumer' ? 'consumer' : 'consumer × model';
                 console.log(`usage ${window} — group: ${grouping}`);
                 console.log(renderUsageSummary(rows, group));
@@ -533,65 +642,71 @@ async function main() {
         case 'status': {
             noPositionals(cmd, positional);
             const api = adminApi();
-            const [roster, offeringsRes, usageRes] = await Promise.all([
+            const [roster, offeringsRes, usageRes, rejectionsRes] = await Promise.all([
                 api('GET', '/admin/v1/tokens'),
                 // the endpoint wraps its rows: {object: "offerings", offerings: [...]}
                 api('GET', '/admin/v1/offerings'),
-                // last-5m health: reuse the usage summary (admission 429s are never
-                // metered, so this reflects relayed outcomes only)
-                api('GET', '/admin/v1/usage?since=5m&group-by=alias').catch(() => []),
+                // last-5m health: the usage SUMMARY endpoint (the details endpoint's
+                // rows carry no request counts — summing them printed NaN); admission
+                // 429s are never metered, so this reflects relayed outcomes only
+                api('GET', '/admin/v1/usage/summary?since=5m&group=alias').catch(() => []),
+                // throttling pressure since hub start; older hubs lack the endpoint
+                api('GET', '/admin/v1/rejections').catch(() => null),
             ]);
             const recent = {
-                requests: usageRes.reduce((n, r) => n + r.requests, 0),
-                errors: usageRes.reduce((n, r) => n + r.errors, 0),
+                requests: usageRes.reduce((n, r) => n + (r.requests ?? 0), 0),
+                errors: usageRes.reduce((n, r) => n + (r.errors ?? 0), 0),
             };
+            const consumerName = new Map(roster.consumers.map((c) => [c.id, c.name]));
+            const rejections = rejectionsRes && rejectionsRes.total > 0
+                ? {
+                    total: rejectionsRes.total,
+                    top: rejectionsRes.entries.slice(0, 5).map((e) => ({
+                        code: e.code,
+                        alias: e.alias,
+                        consumer: consumerName.get(e.consumerId) ?? `#${e.consumerId}`,
+                        count: e.count,
+                    })),
+                }
+                : null;
             console.log(renderHubStatus({
                 ...loadHubConfig(),
                 producers: roster.producers,
                 consumers: roster.consumers,
                 offerings: offeringsRes.offerings,
                 recent,
+                rejections,
+                all: flags.get('all') === 'true',
             }));
             return;
         }
-        case 'revoke': {
-            noPositionals(cmd, positional);
-            const api = adminApi();
-            const id = requireId(flags);
-            const out = (await api('DELETE', `/admin/v1/invites/${id}`));
-            if (!out.revoked && !out.suspended) {
-                console.log(`invite ${id} was already revoked — nothing to do`);
-                return;
-            }
-            if (out.suspended) {
-                console.log(`✓ invite ${id} revoked — ${out.suspended.role} '${out.suspended.name}' suspended, its token no longer works`);
-            }
-            else {
-                console.log(`✓ invite ${id} revoked — the code no longer pairs`);
+        case 'offering': {
+            const action = positional[0];
+            if (action !== 'block' && action !== 'restore') {
+                fail(`expected 'block' or 'restore' (see: aweshare hub offering -h), got '${action ?? ''}'`);
             }
-            console.log(`  undo: aweshare hub restore --id ${id}`);
-            return;
-        }
-        case 'restore': {
-            noPositionals(cmd, positional);
+            const alias = positional[1];
+            if (!alias)
+                fail(`offering ${action}: alias is required (ns/model)`);
+            if (positional[2])
+                fail(`unexpected argument '${positional[2]}' (see: aweshare hub offering -h)`);
             const api = adminApi();
-            const id = requireId(flags);
-            const out = (await api('POST', `/admin/v1/invites/${id}/restore`));
-            if (!out.restored) {
-                console.log(`invite ${id} was not revoked — nothing to restore`);
+            if (action === 'block') {
+                const out = (await api('POST', `/admin/v1/offerings/block?alias=${encodeURIComponent(alias)}`));
+                console.log(`✓ ${alias} blocked (${out.offerings} protocol row(s)) — new requests get 503 OFFERING_BLOCKED`);
+                console.log(`  undo: aweshare hub offering restore ${alias}`);
                 return;
             }
-            if (out.restoredProducer) {
-                console.log(`✓ invite ${id} restored — producer '${out.restoredProducer.name}' is back`);
-            }
-            else if (out.restoredConsumer) {
-                console.log(`✓ invite ${id} restored — consumer '${out.restoredConsumer.name}' is back`);
-            }
-            else {
-                console.log(`✓ invite ${id} restored — the code pairs again (its original expiry still applies)`);
-            }
+            const out = (await api('POST', `/admin/v1/offerings/restore?alias=${encodeURIComponent(alias)}`));
+            console.log(`✓ ${alias} restored (${out.offerings} protocol row(s)) — requests flow again`);
             return;
         }
+        case 'revoke':
+            // revoke/restore became `invite` subcommands — the invite is the
+            // lifecycle handle, same shape as `offering block|restore`
+            return fail("'hub revoke --id N' moved — it is 'aweshare hub invite revoke N' now");
+        case 'restore':
+            return fail("'hub restore --id N' moved — it is 'aweshare hub invite restore N' now");
         default:
             fail(`unknown command: ${cmd}\n\n${USAGE}`);
     }