ft-scout 1.0.9 → 1.1.0

package/bin/src/utils/auth.js

@@ -0,0 +1,679 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+const AUTH_DIR = path.join(os.homedir(), '.ft');
+const AUTH_FILE = path.join(AUTH_DIR, 'auth.json');
+const DEFAULT_AUTH_CONFIG = {
+    token: null,
+    refreshToken: null,
+    tenantId: null,
+    provider: null,
+    user: null,
+    loggedInAt: null,
+    creditsUsed: 0,
+    creditsTotal: 100,
+    currentTier: 'free',
+    renewAt: null,
+    cancelAtPeriodEnd: false,
+    pendingDowngrade: null,
+    paidTier: null,
+    byokEnabled: false,
+    customLlmProvider: 'nvidia',
+    customApiKey: undefined,
+    customBaseUrl: undefined,
+};
+const ACCOUNTS_FILE = path.join(AUTH_DIR, 'accounts.json');
+const SYSTEM_PEPPER = 'ft_scout_ledger_integrity_pepper_v1_9a8b7c';
+export const TIER_RANK = {
+    free: 0,
+    pro: 1,
+    enterprise: 2,
+};
+export const TIER_CREDIT_LIMITS = {
+    free: 100,
+    pro: 1000,
+    enterprise: 10000,
+};
+export const TIER_SESSION_LIMITS = {
+    free: 1,
+    pro: 5,
+    enterprise: Infinity,
+};
+function ensureAuthDir() {
+    if (!fs.existsSync(AUTH_DIR)) {
+        fs.mkdirSync(AUTH_DIR, { recursive: true });
+    }
+}
+function getDeviceIntegrityKey() {
+    const machineFingerprint = `${os.hostname()}:${os.platform()}:${os.arch()}:${os.homedir()}:${SYSTEM_PEPPER}`;
+    return crypto.createHash('sha256').update(machineFingerprint).digest('hex');
+}
+export function generateRecordSignature(record) {
+    const key = getDeviceIntegrityKey();
+    const payload = [
+        record.userId || '',
+        (record.email || '').toLowerCase().trim(),
+        record.currentTier || 'free',
+        record.creditsUsed,
+        record.creditsTotal,
+        record.renewAt,
+        record.transactionId || '',
+    ].join('|');
+    return crypto.createHmac('sha256', key).update(payload).digest('hex');
+}
+export function verifyRecordIntegrity(record) {
+    if (!record._sig || typeof record._sig !== 'string')
+        return false;
+    const cleanRecord = { ...record };
+    delete cleanRecord._sig;
+    const expected = generateRecordSignature(cleanRecord);
+    try {
+        const a = Buffer.from(record._sig, 'hex');
+        const b = Buffer.from(expected, 'hex');
+        return a.length === b.length && crypto.timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+export function generateAuthSignature(config) {
+    const key = getDeviceIntegrityKey();
+    const userId = config.user?.id || '';
+    const email = (config.user?.email || '').toLowerCase().trim();
+    const payload = [
+        userId,
+        email,
+        config.currentTier || 'free',
+        config.creditsUsed ?? 0,
+        config.creditsTotal ?? 100,
+        config.renewAt || '',
+        config.transactionId || '',
+    ].join('|');
+    return crypto.createHmac('sha256', key).update(payload).digest('hex');
+}
+export function verifyAuthIntegrity(config) {
+    if (!config.user)
+        return true; // Unauthenticated default state is safe
+    if (!config._sig || typeof config._sig !== 'string')
+        return false;
+    const cleanConfig = { ...config };
+    delete cleanConfig._sig;
+    const expected = generateAuthSignature(cleanConfig);
+    try {
+        const a = Buffer.from(config._sig, 'hex');
+        const b = Buffer.from(expected, 'hex');
+        return a.length === b.length && crypto.timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+export function loadAccountsLedger() {
+    if (!fs.existsSync(ACCOUNTS_FILE)) {
+        return {};
+    }
+    try {
+        const raw = fs.readFileSync(ACCOUNTS_FILE, 'utf-8');
+        const ledger = JSON.parse(raw);
+        let hasTampered = false;
+        for (const key of Object.keys(ledger)) {
+            const record = ledger[key];
+            if (!verifyRecordIntegrity(record)) {
+                hasTampered = true;
+                console.warn(`\x1b[33m[Scout Security Guard] Tampering detected in account ledger for ${record.email || key}! Reverting to secure defaults.\x1b[0m`);
+                record.currentTier = 'free';
+                record.creditsTotal = 100;
+                // Clamping usage so they cannot reset usage by tampering
+                record.creditsUsed = 100;
+                delete record.transactionId;
+                delete record._sig;
+                record._sig = generateRecordSignature(record);
+            }
+            else {
+                const allowedMax = TIER_CREDIT_LIMITS[record.currentTier] || 100;
+                if (record.creditsTotal > allowedMax) {
+                    record.creditsTotal = allowedMax;
+                    delete record._sig;
+                    record._sig = generateRecordSignature(record);
+                    hasTampered = true;
+                }
+            }
+        }
+        if (hasTampered) {
+            fs.writeFileSync(ACCOUNTS_FILE, JSON.stringify(ledger, null, 2), 'utf-8');
+        }
+        return ledger;
+    }
+    catch {
+        return {};
+    }
+}
+export function saveAccountsLedger(ledger) {
+    ensureAuthDir();
+    for (const key of Object.keys(ledger)) {
+        const record = ledger[key];
+        const allowedMax = TIER_CREDIT_LIMITS[record.currentTier] || 100;
+        record.creditsTotal = Math.min(record.creditsTotal, allowedMax);
+        delete record._sig;
+        record._sig = generateRecordSignature(record);
+    }
+    fs.writeFileSync(ACCOUNTS_FILE, JSON.stringify(ledger, null, 2), 'utf-8');
+}
+function getUserAccountKey(user) {
+    if (!user)
+        return null;
+    if (user.email && user.email.trim()) {
+        return user.email.trim().toLowerCase();
+    }
+    if (user.id && user.id.trim()) {
+        return user.id.trim().toLowerCase();
+    }
+    return null;
+}
+function computeNextRenewalDate(fromDate) {
+    const d = new Date(fromDate || new Date());
+    d.setMonth(d.getMonth() + 1);
+    return d;
+}
+export function loadAuthConfig() {
+    if (!fs.existsSync(AUTH_FILE)) {
+        return { ...DEFAULT_AUTH_CONFIG };
+    }
+    try {
+        const raw = fs.readFileSync(AUTH_FILE, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const user = parsed.user && typeof parsed.user === 'object' ? parsed.user : null;
+        const userKey = getUserAccountKey(user);
+        const isAuthTampered = user && !verifyAuthIntegrity(parsed);
+        let creditsUsed = typeof parsed.creditsUsed === 'number' ? parsed.creditsUsed : 0;
+        let creditsTotal = typeof parsed.creditsTotal === 'number' ? parsed.creditsTotal : 100;
+        let currentTier = typeof parsed.currentTier === 'string' ? parsed.currentTier : 'free';
+        let renewAt = typeof parsed.renewAt === 'string' ? parsed.renewAt : null;
+        let transactionId = typeof parsed.transactionId === 'string' ? parsed.transactionId : undefined;
+        if (userKey && user) {
+            const ledger = loadAccountsLedger();
+            const record = ledger[userKey];
+            if (isAuthTampered) {
+                console.warn(`\x1b[33m[Scout Security Guard] Tampering detected in auth session! Restoring verified ledger state.\x1b[0m`);
+            }
+            if (record) {
+                const now = new Date();
+                const renewDate = new Date(record.renewAt);
+                const isRenewalDue = !Number.isNaN(renewDate.getTime()) && now >= renewDate;
+                // Auto-promote tier if a paidTier is active and not expired
+                if (record.paidTier && record.paidTier !== 'free' && record.currentTier === 'free') {
+                    if (isRenewalDue) {
+                        record.paidTier = null;
+                        ledger[userKey] = record;
+                        saveAccountsLedger(ledger);
+                    }
+                    else {
+                        record.currentTier = record.paidTier;
+                        record.creditsTotal = TIER_CREDIT_LIMITS[record.paidTier] || 1000;
+                        ledger[userKey] = record;
+                        saveAccountsLedger(ledger);
+                    }
+                }
+                if (isRenewalDue) {
+                    if (record.currentTier !== 'free') {
+                        // Paid plan has reached its expiration time: automatically shift to Free tier
+                        record.currentTier = 'free';
+                        record.creditsTotal = TIER_CREDIT_LIMITS['free'] || 100;
+                        record.creditsUsed = 0;
+                        record.cancelAtPeriodEnd = false;
+                        record.pendingDowngrade = null;
+                        record.paidTier = null;
+                        delete record.transactionId;
+                        const nextRenewal = new Date(now.getFullYear(), now.getMonth() + 1, 1);
+                        record.renewAt = nextRenewal.toISOString();
+                        record.lastResetAt = now.toISOString();
+                        ledger[userKey] = record;
+                        saveAccountsLedger(ledger);
+                        creditsUsed = 0;
+                        creditsTotal = record.creditsTotal;
+                        currentTier = record.currentTier;
+                        renewAt = record.renewAt;
+                        transactionId = undefined;
+                    }
+                    else {
+                        // Renewal date has arrived for free tier: reset credits for the new month cycle
+                        const nextRenewal = new Date(renewDate);
+                        while (nextRenewal <= now) {
+                            nextRenewal.setMonth(nextRenewal.getMonth() + 1);
+                        }
+                        record.creditsUsed = 0;
+                        record.renewAt = nextRenewal.toISOString();
+                        record.lastResetAt = now.toISOString();
+                        ledger[userKey] = record;
+                        saveAccountsLedger(ledger);
+                        creditsUsed = 0;
+                        renewAt = record.renewAt;
+                    }
+                }
+                else {
+                    // Before renewal date: strictly enforce accumulated creditsUsed
+                    creditsUsed = record.creditsUsed;
+                    creditsTotal = record.creditsTotal || creditsTotal;
+                    currentTier = record.currentTier || currentTier;
+                    renewAt = record.renewAt || renewAt;
+                    transactionId = record.transactionId;
+                }
+            }
+            else if (isAuthTampered) {
+                // No ledger record and tampered auth session: revert to free tier with 0 credits
+                currentTier = 'free';
+                creditsTotal = 100;
+                creditsUsed = 100;
+            }
+        }
+        const allowedMax = TIER_CREDIT_LIMITS[currentTier] || 100;
+        creditsTotal = Math.min(creditsTotal, allowedMax);
+        const record = (userKey && user) ? loadAccountsLedger()[userKey] : undefined;
+        const config = {
+            token: typeof parsed.token === 'string' ? parsed.token : null,
+            refreshToken: typeof parsed.refreshToken === 'string' ? parsed.refreshToken : null,
+            tenantId: typeof parsed.tenantId === 'string' ? parsed.tenantId : null,
+            provider: typeof parsed.provider === 'string' ? parsed.provider : 'firebase',
+            user,
+            loggedInAt: typeof parsed.loggedInAt === 'string' ? parsed.loggedInAt : null,
+            creditsUsed,
+            creditsTotal,
+            currentTier,
+            renewAt,
+            cancelAtPeriodEnd: record ? Boolean(record.cancelAtPeriodEnd) : (typeof parsed.cancelAtPeriodEnd === 'boolean' ? parsed.cancelAtPeriodEnd : false),
+            pendingDowngrade: record ? (record.pendingDowngrade || undefined) : (typeof parsed.pendingDowngrade === 'string' ? parsed.pendingDowngrade : undefined),
+            paidTier: record ? (record.paidTier || undefined) : (typeof parsed.paidTier === 'string' ? parsed.paidTier : undefined),
+            transactionId,
+            byokEnabled: typeof parsed.byokEnabled === 'boolean' ? parsed.byokEnabled : false,
+            customLlmProvider: typeof parsed.customLlmProvider === 'string' ? parsed.customLlmProvider : 'nvidia',
+            customApiKey: typeof parsed.customApiKey === 'string' ? parsed.customApiKey : undefined,
+            customBaseUrl: typeof parsed.customBaseUrl === 'string' ? parsed.customBaseUrl : undefined,
+        };
+        if (isAuthTampered && user) {
+            saveAuthConfig(config);
+        }
+        return config;
+    }
+    catch {
+        return { ...DEFAULT_AUTH_CONFIG };
+    }
+}
+export function saveAuthConfig(config) {
+    ensureAuthDir();
+    const ledger = loadAccountsLedger();
+    const userKey = getUserAccountKey(config.user);
+    let finalConfig = { ...config };
+    if (userKey && config.user) {
+        const existing = ledger[userKey];
+        const now = new Date();
+        if (existing) {
+            const effectiveRenewAt = config.renewAt || existing.renewAt;
+            const renewDate = new Date(effectiveRenewAt);
+            const isRenewalDue = !Number.isNaN(renewDate.getTime()) && now >= renewDate;
+            if (isRenewalDue) {
+                if (existing.currentTier !== 'free') {
+                    // Paid plan has expired / is revoked on its expiration time: automatically shift to free tier
+                    const nextRenewal = new Date(now.getFullYear(), now.getMonth() + 1, 1);
+                    const updatedRecord = {
+                        ...existing,
+                        creditsUsed: 0,
+                        renewAt: nextRenewal.toISOString(),
+                        lastResetAt: now.toISOString(),
+                        currentTier: 'free',
+                        creditsTotal: TIER_CREDIT_LIMITS['free'] || 100,
+                        cancelAtPeriodEnd: false,
+                        pendingDowngrade: null,
+                        paidTier: null,
+                        transactionId: undefined,
+                    };
+                    ledger[userKey] = updatedRecord;
+                    finalConfig.creditsUsed = 0;
+                    finalConfig.renewAt = updatedRecord.renewAt;
+                    finalConfig.currentTier = 'free';
+                    finalConfig.creditsTotal = 100;
+                    finalConfig.cancelAtPeriodEnd = false;
+                    finalConfig.pendingDowngrade = null;
+                    finalConfig.paidTier = null;
+                    delete finalConfig.transactionId;
+                }
+                else {
+                    // Monthly cycle reached for free tier: Reset credits to 0 and calculate next renewal
+                    const nextRenewal = new Date(renewDate);
+                    while (nextRenewal <= now) {
+                        nextRenewal.setMonth(nextRenewal.getMonth() + 1);
+                    }
+                    const updatedRecord = {
+                        ...existing,
+                        creditsUsed: 0,
+                        renewAt: nextRenewal.toISOString(),
+                        lastResetAt: now.toISOString(),
+                        currentTier: 'free',
+                        creditsTotal: 100,
+                        cancelAtPeriodEnd: false,
+                        pendingDowngrade: null,
+                    };
+                    ledger[userKey] = updatedRecord;
+                    finalConfig.creditsUsed = 0;
+                    finalConfig.renewAt = updatedRecord.renewAt;
+                    finalConfig.currentTier = 'free';
+                    finalConfig.creditsTotal = 100;
+                    finalConfig.cancelAtPeriodEnd = false;
+                    finalConfig.pendingDowngrade = null;
+                }
+            }
+            else if (config.resetCredits === true) {
+                // Explicit verified plan upgrade / subscription purchase
+                // Ensure users cannot downgrade paid plans even with resetCredits
+                const incomingTier = config.currentTier || existing.currentTier || 'free';
+                const existingTierRank = TIER_RANK[existing.currentTier] ?? 0;
+                const incomingTierRank = TIER_RANK[incomingTier] ?? 0;
+                const resolvedTier = incomingTierRank < existingTierRank ? existing.currentTier : incomingTier;
+                const resolvedTotal = TIER_CREDIT_LIMITS[resolvedTier] || 100;
+                const resolvedRenewAt = config.renewAt || existing.renewAt || computeNextRenewalDate().toISOString();
+                const updatedRecord = {
+                    ...existing,
+                    creditsUsed: 0,
+                    currentTier: resolvedTier,
+                    creditsTotal: resolvedTotal,
+                    renewAt: resolvedRenewAt,
+                    lastResetAt: now.toISOString(),
+                    transactionId: config.transactionId || existing.transactionId,
+                    cancelAtPeriodEnd: false,
+                    pendingDowngrade: null,
+                    paidTier: resolvedTier,
+                };
+                ledger[userKey] = updatedRecord;
+                finalConfig.creditsUsed = 0;
+                finalConfig.currentTier = resolvedTier;
+                finalConfig.creditsTotal = resolvedTotal;
+                finalConfig.renewAt = resolvedRenewAt;
+                finalConfig.transactionId = updatedRecord.transactionId;
+                finalConfig.cancelAtPeriodEnd = false;
+                finalConfig.pendingDowngrade = null;
+                finalConfig.paidTier = resolvedTier;
+            }
+            else {
+                // Before renewal date: strictly maintain consumed credits
+                const candidateUsed = typeof config.creditsUsed === 'number' ? config.creditsUsed : 0;
+                const resolvedUsed = Math.max(existing.creditsUsed, candidateUsed);
+                // DO NOT ALLOW DOWNGRADING PAID PLANS:
+                // If existing is on a paid plan, prevent manual downgrade to Free or a lower paid plan
+                const existingTierRank = TIER_RANK[existing.currentTier] ?? 0;
+                const candidateTier = config.currentTier || existing.currentTier || 'free';
+                const candidateTierRank = TIER_RANK[candidateTier] ?? 0;
+                // If candidate tier is lower than existing paid tier, ignore downgrade and keep existing
+                let resolvedTier = existing.currentTier;
+                if (candidateTierRank >= existingTierRank) {
+                    resolvedTier = candidateTier;
+                }
+                const resolvedTotal = TIER_CREDIT_LIMITS[resolvedTier] || existing.creditsTotal || 100;
+                const resolvedRenewAt = config.renewAt || existing.renewAt || computeNextRenewalDate().toISOString();
+                const resolvedPaidTier = resolvedTier !== 'free' ? resolvedTier : null;
+                const updatedRecord = {
+                    ...existing,
+                    userId: config.user.id || existing.userId,
+                    email: config.user.email || existing.email,
+                    creditsUsed: resolvedUsed,
+                    creditsTotal: resolvedTotal,
+                    currentTier: resolvedTier,
+                    renewAt: resolvedRenewAt,
+                    cancelAtPeriodEnd: false,
+                    pendingDowngrade: null,
+                    paidTier: resolvedPaidTier,
+                    transactionId: config.transactionId || existing.transactionId,
+                    byokEnabled: config.byokEnabled !== undefined ? config.byokEnabled : existing.byokEnabled,
+                    customLlmProvider: config.customLlmProvider || existing.customLlmProvider,
+                    customApiKey: config.customApiKey !== undefined ? config.customApiKey : existing.customApiKey,
+                    customBaseUrl: config.customBaseUrl !== undefined ? config.customBaseUrl : existing.customBaseUrl,
+                };
+                ledger[userKey] = updatedRecord;
+                finalConfig.creditsUsed = resolvedUsed;
+                finalConfig.currentTier = resolvedTier;
+                finalConfig.creditsTotal = resolvedTotal;
+                finalConfig.renewAt = resolvedRenewAt;
+                finalConfig.cancelAtPeriodEnd = false;
+                finalConfig.pendingDowngrade = null;
+                finalConfig.paidTier = resolvedPaidTier;
+                finalConfig.transactionId = updatedRecord.transactionId;
+            }
+        }
+        else {
+            // First time user registration / first login
+            const renewAt = config.renewAt || computeNextRenewalDate().toISOString();
+            const initialRecord = {
+                userId: config.user.id,
+                email: config.user.email,
+                currentTier: config.currentTier || 'free',
+                creditsUsed: config.creditsUsed ?? 0,
+                creditsTotal: config.creditsTotal ?? 100,
+                renewAt,
+                lastResetAt: now.toISOString(),
+                transactionId: config.transactionId,
+                cancelAtPeriodEnd: config.cancelAtPeriodEnd ?? false,
+                pendingDowngrade: config.pendingDowngrade ?? null,
+                paidTier: config.paidTier ?? (config.currentTier !== 'free' ? config.currentTier : null),
+                byokEnabled: config.byokEnabled ?? false,
+                customLlmProvider: config.customLlmProvider,
+                customApiKey: config.customApiKey,
+                customBaseUrl: config.customBaseUrl,
+            };
+            ledger[userKey] = initialRecord;
+            finalConfig.creditsUsed = initialRecord.creditsUsed;
+            finalConfig.creditsTotal = initialRecord.creditsTotal;
+            finalConfig.currentTier = initialRecord.currentTier;
+            finalConfig.renewAt = initialRecord.renewAt;
+            finalConfig.cancelAtPeriodEnd = initialRecord.cancelAtPeriodEnd;
+            finalConfig.pendingDowngrade = initialRecord.pendingDowngrade;
+            finalConfig.paidTier = initialRecord.paidTier;
+            finalConfig.transactionId = initialRecord.transactionId;
+        }
+        saveAccountsLedger(ledger);
+    }
+    const cleanConfig = { ...finalConfig };
+    delete cleanConfig._sig;
+    finalConfig._sig = generateAuthSignature(cleanConfig);
+    fs.writeFileSync(AUTH_FILE, JSON.stringify(finalConfig, null, 2), 'utf-8');
+}
+export function clearAuthConfig() {
+    ensureAuthDir();
+    try {
+        if (fs.existsSync(AUTH_FILE)) {
+            const current = loadAuthConfig();
+            const userKey = getUserAccountKey(current.user);
+            if (userKey && current.user) {
+                const ledger = loadAccountsLedger();
+                const existing = ledger[userKey];
+                ledger[userKey] = {
+                    userId: current.user.id,
+                    email: current.user.email,
+                    currentTier: current.currentTier || existing?.currentTier || 'free',
+                    creditsUsed: current.creditsUsed ?? existing?.creditsUsed ?? 0,
+                    creditsTotal: current.creditsTotal ?? existing?.creditsTotal ?? 100,
+                    renewAt: current.renewAt || existing?.renewAt || computeNextRenewalDate().toISOString(),
+                    lastResetAt: existing?.lastResetAt || new Date().toISOString(),
+                    byokEnabled: current.byokEnabled,
+                    customLlmProvider: current.customLlmProvider,
+                    customApiKey: current.customApiKey,
+                    customBaseUrl: current.customBaseUrl,
+                };
+                saveAccountsLedger(ledger);
+            }
+        }
+    }
+    catch { }
+    fs.writeFileSync(AUTH_FILE, JSON.stringify(DEFAULT_AUTH_CONFIG, null, 2), 'utf-8');
+}
+export function isLoggedIn() {
+    const config = loadAuthConfig();
+    return Boolean(config.token && config.user);
+}
+export function getAuthToken() {
+    const config = loadAuthConfig();
+    return config.token;
+}
+export function getCurrentUser() {
+    const config = loadAuthConfig();
+    return config.user;
+}
+export function getNextRenewalDate(config) {
+    const cfg = config || loadAuthConfig();
+    const baseDateStr = cfg.renewAt || cfg.user?.createdAt || cfg.loggedInAt;
+    const now = new Date();
+    if (baseDateStr) {
+        const baseDate = new Date(baseDateStr);
+        if (!Number.isNaN(baseDate.getTime())) {
+            const renewal = new Date(baseDate);
+            const renewalDay = renewal.getDate();
+            while (renewal <= now) {
+                renewal.setDate(1);
+                renewal.setMonth(renewal.getMonth() + 1);
+                const lastDayOfMonth = new Date(renewal.getFullYear(), renewal.getMonth() + 1, 0).getDate();
+                renewal.setDate(Math.min(renewalDay, lastDayOfMonth));
+            }
+            return renewal;
+        }
+    }
+    // Default fallback: 1st of next month
+    return new Date(now.getFullYear(), now.getMonth() + 1, 1);
+}
+export function formatRenewalDate(date) {
+    const formatted = date.toLocaleDateString('en-US', {
+        month: 'short',
+        day: 'numeric',
+        year: 'numeric',
+    });
+    const now = new Date();
+    const diffMs = date.getTime() - now.getTime();
+    const diffDays = Math.ceil(diffMs / (1000 * 60 * 60 * 24));
+    if (diffDays <= 0) {
+        return `${formatted} (resets today)`;
+    }
+    else if (diffDays === 1) {
+        return `${formatted} (resets tomorrow)`;
+    }
+    else {
+        return `${formatted} (in ${diffDays} days)`;
+    }
+}
+export function consumeCredit(amount = 1) {
+    const config = loadAuthConfig();
+    if (config.byokEnabled) {
+        return {
+            success: true,
+            isByok: true,
+            remaining: Infinity,
+            isLowCredit: false,
+            reason: 'BYOK Mode Active (Custom API / Proxy Endpoint used)',
+        };
+    }
+    const used = config.creditsUsed ?? 0;
+    const total = config.creditsTotal ?? 100;
+    const remaining = total - used;
+    if (remaining < amount) {
+        const renewalDate = getNextRenewalDate(config);
+        const renewalFormatted = formatRenewalDate(renewalDate);
+        return {
+            success: false,
+            isByok: false,
+            remaining: Math.max(0, remaining),
+            isLowCredit: true,
+            reason: `Credit limit reached for ${config.currentTier || 'Free'} plan (${used}/${total} credits consumed).`,
+            renewalFormatted,
+            renewalDate,
+        };
+    }
+    const remainingAfter = total - (used + amount);
+    const isLowCredit = remainingAfter <= Math.ceil(total * 0.15);
+    const updatedConfig = {
+        ...config,
+        creditsUsed: used + amount,
+    };
+    saveAuthConfig(updatedConfig);
+    return {
+        success: true,
+        isByok: false,
+        remaining: remainingAfter,
+        isLowCredit,
+    };
+}
+export function checkTierAccess(feature) {
+    const config = loadAuthConfig();
+    if (config.byokEnabled) {
+        return { allowed: true };
+    }
+    const used = config.creditsUsed ?? 0;
+    const total = config.creditsTotal ?? 100;
+    if (used >= total) {
+        const renewalDate = getNextRenewalDate(config);
+        const renewalFormatted = formatRenewalDate(renewalDate);
+        return {
+            allowed: false,
+            reason: `Credit quota exhausted (${used}/${total} credits used). Upgrade your plan or enable BYOK mode in dashboard.`,
+            renewalFormatted,
+            renewalDate,
+        };
+    }
+    return { allowed: true };
+}
+export function getTierSessionLimit(tier) {
+    const current = (tier || loadAuthConfig().currentTier || 'free').toLowerCase();
+    return TIER_SESSION_LIMITS[current] ?? 1;
+}
+export function canStartNewSession(currentActiveCount, tier) {
+    const limit = getTierSessionLimit(tier);
+    if (currentActiveCount >= limit) {
+        return {
+            allowed: false,
+            limit,
+            current: currentActiveCount,
+            reason: `Concurrent session limit reached (${currentActiveCount}/${limit === Infinity ? 'Unlimited' : limit} active slots). Upgrade your plan to unlock more concurrent slots.`
+        };
+    }
+    return {
+        allowed: true,
+        limit,
+        current: currentActiveCount
+    };
+}
+export function checkTierFeatureCapability(capability, tierOverride) {
+    const config = loadAuthConfig();
+    const currentTier = (tierOverride || config.currentTier || 'free').toLowerCase();
+    const capabilities = {
+        autonomous_features: { minTier: 'pro', name: 'Autonomous Multi-Step Computer & Browser Automation' },
+        scratchpad: { minTier: 'pro', name: 'AI Scratchpad Reasoning & Working Memory' },
+        continuous_screen: { minTier: 'pro', name: 'Continuous Visual Aura HUD' },
+        audit_logging: { minTier: 'pro', name: 'Compliance & Activity Audit Logging' },
+        nvidia_inception_models: { minTier: 'pro', name: 'NVIDIA Inception NIM High-Throughput Reasoning' },
+        window_isolation: { minTier: 'enterprise', name: 'Per-Window Isolation & Privacy Masking' },
+        unlimited_sessions: { minTier: 'enterprise', name: 'Unlimited Concurrent Session Slots' },
+    };
+    const cap = capabilities[capability];
+    if (!cap) {
+        return { allowed: true, requiredTier: 'free', currentTier };
+    }
+    const tierRank = { free: 0, pro: 1, enterprise: 2 };
+    const userRank = tierRank[currentTier] ?? 0;
+    const requiredRank = tierRank[cap.minTier] ?? 0;
+    if (userRank >= requiredRank) {
+        return { allowed: true, requiredTier: cap.minTier, currentTier };
+    }
+    return {
+        allowed: false,
+        requiredTier: cap.minTier,
+        currentTier,
+        reason: `${cap.name} is exclusive to ${cap.minTier.toUpperCase()} and higher plans. Your current plan is ${currentTier.toUpperCase()}. Free developers can perform basic code editing, creating files and folders, and running commands.`
+    };
+}
+export function isProOrHigher(tierOverride) {
+    const config = loadAuthConfig();
+    const current = (tierOverride || config.currentTier || 'free').toLowerCase();
+    return current === 'pro' || current === 'enterprise';
+}
+export function canUseAutonomousFeatures(tierOverride) {
+    return isProOrHigher(tierOverride);
+}
+export function canUseScratchpad(tierOverride) {
+    return isProOrHigher(tierOverride);
+}
+//# sourceMappingURL=auth.js.map