zevairouter 1.0.35 → 1.0.36

package/src/lib/oauth/services/fiveSimClient.js

@@ -0,0 +1,370 @@
+/**
+ * 5sim.net SMS verification service client.
+ *
+ * Used by the CodeBuddy CN bulk auto-registration flow to order virtual phone
+ * numbers (default region: Hong Kong / +852) and poll for the SMS verification
+ * code delivered to them.
+ *
+ * API docs: https://docs.5sim.net/
+ * Base URL:  https://5sim.net/v1
+ * Auth:      Bearer token (API key from dashboard → Profile → API)
+ *
+ * Rating system (no hard RPS limit):
+ *   +0.5 receive SMS + finish before timeout
+ *   -0.1 cancel, -0.1 ban, -0.15 timeout
+ *   Rating → 0 triggers a 24h ordering lock, then resets to 96.
+ * Poll /user/check no faster than ~5s. We default to 6s.
+ */
+
+import { proxyAwareFetch } from "../../../../open-sse/utils/proxyFetch.js";
+
+const FIVESIM_BASE_URL = "https://5sim.net/v1";
+const nativeFetch = globalThis.fetch;
+const DEFAULT_POLL_INTERVAL_MS = 6000; // >5s safe floor per 5sim guidance
+const DEFAULT_POLL_TIMEOUT_MS = 15 * 60_000; // 15 min (5sim number expiry is ~20 min)
+const MAX_TRANSIENT_ERRORS = 5;
+
+// Terminal 5sim order statuses that mean "no more SMS will arrive"
+const TERMINAL_STATUSES = new Set([
+  "a timeout",
+  "is cancelled",
+  "is complete",
+  "number banned, when number already used",
+]);
+
+/**
+ * Custom error types so callers can branch on the failure reason.
+ */
+export class FiveSimError extends Error {
+  constructor(message, { status, body } = {}) {
+    super(message);
+    this.name = "FiveSimError";
+    this.status = status;
+    this.body = body;
+  }
+}
+
+export class FiveSimTimeoutError extends FiveSimError {
+  constructor(orderId) {
+    super(`5sim order ${orderId} timed out waiting for SMS`);
+    this.name = "FiveSimTimeoutError";
+    this.orderId = orderId;
+  }
+}
+
+export class FiveSimCancelledError extends FiveSimError {
+  constructor(orderId, reason) {
+    super(`5sim order ${orderId} cancelled: ${reason}`);
+    this.name = "FiveSimCancelledError";
+    this.orderId = orderId;
+  }
+}
+
+export class FiveSimBannedError extends FiveSimError {
+  constructor(orderId) {
+    super(`5sim order ${orderId} number was already used (banned)`);
+    this.name = "FiveSimBannedError";
+    this.orderId = orderId;
+  }
+}
+
+/**
+ * 5sim REST client.
+ *
+ * @param {object} opts
+ * @param {string} opts.apiKey        5sim Bearer API key (required)
+ * @param {object} [opts.proxyOptions] Passed to proxyAwareFetch (respect outbound proxy / per-connection proxy)
+ */
+export class FiveSimClient {
+  constructor({ apiKey, proxyOptions = null } = {}) {
+    if (!apiKey || typeof apiKey !== "string" || !apiKey.trim()) {
+      throw new FiveSimError("5sim API key is required");
+    }
+    this.apiKey = apiKey.trim();
+    this.proxyOptions = proxyOptions;
+  }
+
+  _headers(extra = {}) {
+    return {
+      Authorization: `Bearer ${this.apiKey}`,
+      Accept: "application/json",
+      ...extra,
+    };
+  }
+
+  async _get(path, { headers, ...fetchOpts } = {}) {
+    const url = `${FIVESIM_BASE_URL}${path}`;
+    // Use native fetch for 5sim API — proxyAwareFetch's MITM DNS bypass logic
+    // can interfere with 5sim.net resolution and cause silent poll failures.
+    // Proxy support is still available via proxyOptions if explicitly configured.
+    const fetchFn = this.proxyOptions?.enabled ? proxyAwareFetch : nativeFetch;
+    const res = await fetchFn(url, {
+      method: "GET",
+      headers: this._headers(headers),
+      ...fetchOpts,
+    }, this.proxyOptions);
+
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      // 404 "no free phones" is a common, recoverable condition — surface it
+      throw new FiveSimError(
+        `5sim request to ${path} failed (HTTP ${res.status}): ${text.slice(0, 200)}`,
+        { status: res.status, body: text },
+      );
+    }
+
+    // Some 5sim endpoints return plain text errors with 200 (e.g. "no free phones")
+    const text = await res.text();
+    try {
+      return JSON.parse(text);
+    } catch {
+      // Non-JSON 200 response — treat as an error message
+      if (text && !text.startsWith("{")) {
+        throw new FiveSimError(`5sim ${path} returned non-JSON: ${text.slice(0, 200)}`, {
+          status: res.status,
+          body: text,
+        });
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Order a virtual phone number for SMS activation.
+   *
+   * Default: single buy of product "codebuddy" only (~$0.13). No automatic
+   * fallback to generic "other" (~$0.70) — that double-path wasted balance
+   * when "codebuddy" was out of stock and "other" still got attempted.
+   *
+   * @param {object} opts
+   * @param {string} [opts.country="hongkong"]  5sim country code (hongkong, china, any, ...)
+   * @param {string} [opts.operator="any"]      Operator filter (any, or specific like virtual54)
+   * @param {string} [opts.product="codebuddy"]  5sim product code
+   * @param {boolean} [opts.allowProductFallback=false]  If true and product is "codebuddy",
+   *   also try "other" on no-stock. Off by default to protect balance.
+   * @returns {Promise<{id:number, phone:string, status:string, expires:string, sms:Array, country:string}>}
+   */
+  async buyNumber({
+    country = "hongkong",
+    operator = "any",
+    product = "codebuddy",
+    allowProductFallback = false,
+  } = {}) {
+    const products =
+      product === "codebuddy" && allowProductFallback
+        ? ["codebuddy", "other"]
+        : [product];
+    let lastError = null;
+
+    for (const candidate of products) {
+      const path = `/user/buy/activation/${encodeURIComponent(country)}/${encodeURIComponent(operator)}/${encodeURIComponent(candidate)}`;
+      try {
+        const data = await this._get(path);
+        if (!data || !data.id || !data.phone) {
+          throw new FiveSimError(`5sim buyNumber returned unexpected shape: ${JSON.stringify(data).slice(0, 200)}`, {
+            body: data,
+          });
+        }
+        return data;
+      } catch (error) {
+        lastError = error;
+        // Optional only: fall back from "codebuddy" → "other" when explicitly enabled.
+        const status = error?.status;
+        const body = String(error?.body || error?.message || "").toLowerCase();
+        const shouldFallback =
+          allowProductFallback
+          && candidate === "codebuddy"
+          && products.includes("other")
+          && (
+            status === 400
+            || status === 404
+            || body.includes("no free")
+            || body.includes("not enough")
+            || body.includes("no product")
+          );
+        if (!shouldFallback) throw error;
+      }
+    }
+
+    throw lastError || new FiveSimError("5sim buyNumber failed for all product candidates");
+  }
+
+  /**
+   * Check an order for received SMS. Returns the raw order object.
+   *
+   * @param {number} id  Order ID from buyNumber
+   * @returns {Promise<object>}  Order shape: { id, phone, sms:[{code,text,sender,...}], status }
+   */
+  async checkOrder(id) {
+    return this._get(`/user/check/${id}`);
+  }
+
+  /**
+   * Poll an order until an SMS code arrives or a terminal status is reached.
+   *
+   * @param {number} id                  Order ID
+   * @param {object} [opts]
+   * @param {number} [opts.timeoutMs]    Max wait (default 15 min)
+   * @param {number} [opts.intervalMs]   Poll interval (default 6s, min 5s enforced)
+   * @param {AbortSignal} [opts.signal]  Abort to cancel the poll (e.g. job cancelled)
+   * @returns {Promise<string>}          The SMS verification code (digits)
+   * @throws {FiveSimTimeoutError|FiveSimCancelledError|FiveSimBannedError|FiveSimError}
+   */
+  async pollCode(id, { timeoutMs = DEFAULT_POLL_TIMEOUT_MS, intervalMs = DEFAULT_POLL_INTERVAL_MS, signal } = {}) {
+    const interval = Math.max(5000, intervalMs); // enforce 5sim's 5s floor
+    const deadline = Date.now() + timeoutMs;
+    let transientErrors = 0;
+
+    while (Date.now() < deadline) {
+      if (signal?.aborted) {
+        throw new FiveSimCancelledError(id, "aborted by caller");
+      }
+
+      let order;
+      try {
+        order = await this.checkOrder(id);
+      } catch (err) {
+        // Transient network/server errors — retry up to a limit
+        if (err instanceof FiveSimError && err.status >= 500) {
+          transientErrors++;
+          if (transientErrors > MAX_TRANSIENT_ERRORS) throw err;
+          await sleep(interval);
+          continue;
+        }
+        throw err;
+      }
+      transientErrors = 0; // reset on success
+
+      // Check for received SMS
+      if (Array.isArray(order.sms) && order.sms.length > 0) {
+        const lastSms = order.sms[order.sms.length - 1];
+        const code = extractCode(lastSms);
+        if (code) return code;
+        // SMS received but no code parsed — keep polling (rare)
+      }
+
+      // Check terminal statuses
+      if (order.status && TERMINAL_STATUSES.has(order.status)) {
+        if (order.status === "a timeout") throw new FiveSimTimeoutError(id);
+        if (order.status === "number banned, when number already used") throw new FiveSimBannedError(id);
+        if (order.status === "is cancelled") throw new FiveSimCancelledError(id, order.status);
+        if (order.status === "is complete") {
+          // Complete but we didn't find a code — check all SMS again
+          const code = findCodeInSmsList(order.sms);
+          if (code) return code;
+          throw new FiveSimError(`5sim order ${id} completed but no SMS code found`, { body: order });
+        }
+      }
+
+      await sleep(interval);
+    }
+
+    throw new FiveSimTimeoutError(id);
+  }
+
+  /**
+   * Finish an order after successfully using the SMS code. (+0.5 rating)
+   * Best-effort — errors are swallowed (the code was already used).
+   */
+  async finishOrder(id) {
+    try {
+      await this._get(`/user/finish/${id}`);
+      return true;
+    } catch (err) {
+      console.warn(`[5sim] finishOrder(${id}) failed (best-effort): ${err.message}`);
+      return false;
+    }
+  }
+
+  /**
+   * Cancel an order before any SMS arrives. (-0.1 rating)
+   * Best-effort — errors are swallowed.
+   */
+  async cancelOrder(id) {
+    try {
+      await this._get(`/user/cancel/${id}`);
+      return true;
+    } catch (err) {
+      console.warn(`[5sim] cancelOrder(${id}) failed (best-effort): ${err.message}`);
+      return false;
+    }
+  }
+
+  /**
+   * Ban an order's number (mark as already used). (-0.1 rating)
+   * Best-effort.
+   */
+  async banOrder(id) {
+    try {
+      await this._get(`/user/ban/${id}`);
+      return true;
+    } catch (err) {
+      console.warn(`[5sim] banOrder(${id}) failed (best-effort): ${err.message}`);
+      return false;
+    }
+  }
+
+  /**
+   * Get account balance/profile. Optional, for UI display.
+   * @returns {Promise<{balance:number, rating:number}>}
+   */
+  async getBalance() {
+    try {
+      const data = await this._get("/user/profile");
+      return {
+        balance: data?.balance ?? null,
+        rating: data?.rating ?? null,
+      };
+    } catch (err) {
+      console.warn(`[5sim] getBalance failed: ${err.message}`);
+      return { balance: null, rating: null };
+    }
+  }
+}
+
+/**
+ * Extract a numeric verification code from an 5sim SMS object.
+ * 5sim sometimes provides a pre-parsed `code` field; otherwise extract digits from `text`.
+ */
+function extractCode(sms) {
+  if (!sms) return null;
+  if (sms.code && /\d{4,8}/.test(String(sms.code))) {
+    return String(sms.code).match(/\d{4,8}/)[0];
+  }
+  if (sms.text) {
+    return findCodeInText(sms.text);
+  }
+  return null;
+}
+
+function findCodeInSmsList(smsList) {
+  if (!Array.isArray(smsList)) return null;
+  // Search newest-first
+  for (let i = smsList.length - 1; i >= 0; i--) {
+    const code = extractCode(smsList[i]);
+    if (code) return code;
+  }
+  return null;
+}
+
+/**
+ * Extract a 4-8 digit code from an SMS text body.
+ * Tries to find standalone digit groups (common OTP format).
+ */
+function findCodeInText(text) {
+  if (!text) return null;
+  // Match 4-8 consecutive digits, possibly surrounded by non-digits
+  const match = String(text).match(/\b(\d{4,8})\b/);
+  return match ? match[1] : null;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export const __test__ = {
+  extractCode,
+  findCodeInText,
+  TERMINAL_STATUSES,
+  FIVESIM_BASE_URL,
+};

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -28,7 +28,7 @@ const KIRO_BULK_IMPORT_DIR = path.join(DATA_DIR, "kiro-bulk-import");
 const KIRO_BULK_IMPORT_META_FILE = path.join(KIRO_BULK_IMPORT_DIR, "meta.json");
 const ACTIVE_JOB_STATUSES = new Set(["queued", "running", "needs_manual"]);
 
-function nowIso() {
+export function nowIso() {
   return new Date().toISOString();
 }
 
@@ -154,7 +154,7 @@ function writePersistedLatestJobId(jobId, metaFile = KIRO_BULK_IMPORT_META_FILE)
   });
 }
 
-function clampConcurrency(value) {
+export function clampConcurrency(value) {
   if (isAutoConcurrencyValue(value)) {
     const optimal = getOptimalWorkerCount();
     return Math.min(KIRO_BULK_IMPORT_MAX_CONCURRENCY, Math.max(KIRO_BULK_IMPORT_MIN_CONCURRENCY, optimal));
@@ -236,7 +236,7 @@ function buildSummary(accounts) {
   };
 }
 
-function createLogEntry(step, message, level = "info") {
+export function createLogEntry(step, message, level = "info") {
   return {
     id: randomUUID(),
     at: nowIso(),
@@ -362,8 +362,30 @@ async function defaultSocialExchange(args) {
   return exchangeAndSaveKiroSocialConnection(args);
 }
 
+import { parsePlaywrightProxy } from "./proxyUtils.js";
+export { parsePlaywrightProxy };
+
 export async function createFreshContext(browser, proxy) {
-  const contextOptions = proxy ? { proxy: { server: proxy } } : {};
+  let effectiveProxy = proxy;
+  let socksBridge = null;
+
+  // Chromium cannot authenticate SOCKS5 — bridge to local HTTP proxy first
+  if (proxy) {
+    try {
+      const { ensureSocksHttpBridge, isSocksProxyUrl } = await import("./socksHttpBridge.js");
+      if (isSocksProxyUrl(proxy)) {
+        socksBridge = await ensureSocksHttpBridge(proxy);
+        if (socksBridge?.httpProxyUrl) {
+          effectiveProxy = socksBridge.httpProxyUrl;
+        }
+      }
+    } catch (error) {
+      console.warn("[bulk-import] SOCKS bridge unavailable:", error?.message || error);
+    }
+  }
+
+  const parsedProxy = parsePlaywrightProxy(effectiveProxy);
+  const contextOptions = parsedProxy ? { proxy: parsedProxy } : {};
   // Camoufox (driven via firefox.launch) ships a juggler build whose
   // Browser.setDefaultViewport rejects the isMobile field newer playwright-core
   // sends, so newContext() throws "not described in this scheme". Passing
@@ -371,9 +393,47 @@ export async function createFreshContext(browser, proxy) {
   // viewport/fingerprint itself. Chromium keeps playwright's default viewport.
   let engineName = "";
   try { engineName = browser.browserType().name(); } catch {}
-  if (engineName === "firefox") contextOptions.viewport = null;
+  // Headed CN runs use a small fixed viewport so the OS window stays compact.
+  // Camoufox juggler still rejects isMobile; only skip viewport when truly headless firefox.
+  let isHeadless = true;
+  try {
+    const opts = browser._options || browser._initializer || {};
+    if (typeof opts.headless === "boolean") isHeadless = opts.headless;
+  } catch { /* ignore */ }
+  if (engineName === "firefox" && isHeadless) {
+    contextOptions.viewport = null;
+  } else if (!contextOptions.viewport) {
+    contextOptions.viewport = { width: 900, height: 700 };
+  }
+  // Ignore HTTPS errors common through residential proxies / MITM chains
+  contextOptions.ignoreHTTPSErrors = true;
   const context = await browser.newContext(contextOptions);
+
+  // Release the SOCKS bridge when the context closes
+  if (socksBridge) {
+    const originalClose = context.close.bind(context);
+    context.close = async (...args) => {
+      try {
+        return await originalClose(...args);
+      } finally {
+        await socksBridge.release().catch(() => null);
+      }
+    };
+  }
+
   const page = await context.newPage();
+  // Residential proxies often hang on third-party trackers; abort so SPA can boot
+  try {
+    await page.route("**/*", (route) => {
+      const u = route.request().url();
+      if (/googletagmanager|googleadservices|google-analytics|doubleclick|facebook\.net|hotjar|clarity\.ms|hm\.baidu|sentry\.io|browser\.sentry-cdn/i.test(u)) {
+        return route.abort();
+      }
+      return route.continue();
+    });
+  } catch {
+    // ignore if route fails
+  }
   return { context, page };
 }
 
@@ -902,7 +962,8 @@ export class KiroBulkImportManager {
       });
 
       return {
-        email: previewAccount.email,
+        email: previewAccount.email || null,
+        phone: previewAccount.phone || null,
         workerId: previewAccount.workerId || null,
         status: previewAccount.status,
         step: previewAccount.currentStep || null,
@@ -911,7 +972,8 @@ export class KiroBulkImportManager {
       };
     } catch {
       return {
-        email: previewAccount.email,
+        email: previewAccount.email || null,
+        phone: previewAccount.phone || null,
         workerId: previewAccount.workerId || null,
         status: previewAccount.status,
         step: previewAccount.currentStep || null,

package/src/lib/oauth/services/proxyUtils.js

@@ -0,0 +1,26 @@
+/**
+ * Shared proxy helpers for bulk-import browser automation.
+ */
+
+/**
+ * Parse a proxy URL into Playwright's proxy option shape.
+ * Supports http(s)://user:pass@host:port and socks5://user:pass@host:port.
+ * Chromium cannot authenticate SOCKS5 natively — use socksHttpBridge first.
+ */
+export function parsePlaywrightProxy(proxyUrl) {
+  if (!proxyUrl) return null;
+  const raw = String(proxyUrl).trim();
+  if (!raw) return null;
+  try {
+    const url = new URL(raw);
+    const protocol = (url.protocol || "http:").replace(/:$/, "") || "http";
+    const server = `${protocol}://${url.hostname}${url.port ? `:${url.port}` : ""}`;
+    const proxy = { server };
+    if (url.username) proxy.username = decodeURIComponent(url.username);
+    if (url.password) proxy.password = decodeURIComponent(url.password);
+    return proxy;
+  } catch {
+    // Already a bare server string (e.g. "http://host:port")
+    return { server: raw };
+  }
+}

package/src/lib/oauth/services/socksHttpBridge.js

@@ -0,0 +1,157 @@
+/**
+ * Local SOCKS5-to-HTTP proxy bridge for Playwright/Chromium.
+ *
+ * Chromium cannot authenticate SOCKS5 natively. This module spins up a local
+ * unauthenticated HTTP proxy that forwards CONNECT tunnels through an
+ * authenticated SOCKS5 upstream via the `socks` package.
+ *
+ * Usage:
+ *   const handle = await ensureSocksHttpBridge("socks5://user:pass@host:port");
+ *   // use handle.httpProxyUrl as Playwright proxy server (no auth)
+ *   // ...
+ *   await handle.release();
+ */
+
+import http from "node:http";
+import { SocksClient } from "socks";
+
+const bridges = new Map(); // key -> { server, port, refCount, httpProxyUrl, closePromise }
+
+function parseSocksUrl(proxyUrl) {
+  const url = new URL(String(proxyUrl).trim());
+  const protocol = (url.protocol || "").replace(/:$/, "").toLowerCase();
+  if (!protocol.startsWith("socks")) {
+    return null;
+  }
+  return {
+    host: url.hostname,
+    port: Number(url.port) || (protocol.includes("4") ? 1080 : 1080),
+    type: protocol.includes("4") ? 4 : 5,
+    userId: url.username ? decodeURIComponent(url.username) : undefined,
+    password: url.password ? decodeURIComponent(url.password) : undefined,
+    key: `${protocol}://${url.username}@${url.hostname}:${url.port || 1080}`,
+  };
+}
+
+function socksConnect(socks, host, port) {
+  return SocksClient.createConnection({
+    proxy: {
+      host: socks.host,
+      port: socks.port,
+      type: socks.type,
+      userId: socks.userId,
+      password: socks.password,
+    },
+    command: "connect",
+    destination: { host, port: Number(port) },
+    timeout: 25_000,
+  });
+}
+
+function pipe(a, b) {
+  a.pipe(b);
+  b.pipe(a);
+  const close = () => {
+    a.destroy();
+    b.destroy();
+  };
+  a.on("error", close);
+  b.on("error", close);
+  a.on("close", () => b.destroy());
+  b.on("close", () => a.destroy());
+}
+
+async function startBridge(socks) {
+  const server = http.createServer((req, res) => {
+    // Plain HTTP requests are uncommon for Playwright (uses CONNECT for HTTPS).
+    res.writeHead(405, { "Content-Type": "text/plain" });
+    res.end("CONNECT only");
+  });
+
+  server.on("connect", async (req, clientSocket, head) => {
+    try {
+      const [host, portStr] = String(req.url || "").split(":");
+      const port = Number(portStr) || 443;
+      if (!host) {
+        clientSocket.write("HTTP/1.1 400 Bad Request\r\n\r\n");
+        clientSocket.destroy();
+        return;
+      }
+      const info = await socksConnect(socks, host, port);
+      const remote = info.socket;
+      clientSocket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+      if (head && head.length) remote.write(head);
+      pipe(clientSocket, remote);
+    } catch (error) {
+      try {
+        clientSocket.write("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+      } catch {
+        // ignore
+      }
+      clientSocket.destroy();
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    // port 0 = ephemeral
+    server.listen(0, "127.0.0.1", () => resolve());
+  });
+
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  const httpProxyUrl = `http://127.0.0.1:${port}`;
+
+  return {
+    server,
+    port,
+    httpProxyUrl,
+    refCount: 0,
+    async close() {
+      await new Promise((resolve) => server.close(() => resolve()));
+    },
+  };
+}
+
+/**
+ * Ensure a local HTTP proxy bridge for the given SOCKS5 URL.
+ * Returns { httpProxyUrl, release } — call release() when the browser context closes.
+ */
+export async function ensureSocksHttpBridge(proxyUrl) {
+  const socks = parseSocksUrl(proxyUrl);
+  if (!socks) return null;
+
+  // No auth needed for socks without credentials — Playwright can use it directly
+  if (!socks.userId && !socks.password) return null;
+
+  let entry = bridges.get(socks.key);
+  if (!entry) {
+    entry = await startBridge(socks);
+    bridges.set(socks.key, entry);
+  }
+  entry.refCount += 1;
+
+  let released = false;
+  return {
+    httpProxyUrl: entry.httpProxyUrl,
+    async release() {
+      if (released) return;
+      released = true;
+      entry.refCount = Math.max(0, entry.refCount - 1);
+      if (entry.refCount === 0) {
+        bridges.delete(socks.key);
+        await entry.close().catch(() => null);
+      }
+    },
+  };
+}
+
+export function isSocksProxyUrl(proxyUrl) {
+  if (!proxyUrl) return false;
+  try {
+    const protocol = new URL(String(proxyUrl).trim()).protocol.replace(/:$/, "").toLowerCase();
+    return protocol.startsWith("socks");
+  } catch {
+    return /^socks/i.test(String(proxyUrl));
+  }
+}

package/src/lib/usage/quotaService.js

@@ -79,10 +79,18 @@ export async function refreshAndUpdateCredentials(connection, force = false, pro
   return { connection: updatedConnection, refreshed: true };
 }
 
+function normalizeAuthType(authType) {
+  const t = String(authType || "").toLowerCase().trim();
+  // Accept legacy "api-key" / "api_key" as apikey (bulk-import once saved "api-key")
+  if (t === "api-key" || t === "api_key" || t === "api key") return "apikey";
+  return t;
+}
+
 function isUsageEligible(connection) {
   if (!connection) return false;
-  if (connection.authType === "oauth") return true;
-  return connection.authType === "apikey" && USAGE_APIKEY_PROVIDERS.includes(connection.provider);
+  const authType = normalizeAuthType(connection.authType);
+  if (authType === "oauth") return true;
+  return authType === "apikey" && USAGE_APIKEY_PROVIDERS.includes(connection.provider);
 }
 
 /**