@dmh2002/dsh-connect-qoder 0.0.0-stage → 0.4.0

package/lib/index.js

@@ -0,0 +1,3093 @@
+import { _ as piAiRuntimeInfo, a as writeHostHeartbeat, b as QoderUpstreamError, c as writePoolProbes, h as patFromEnv, l as QODER_CONNECT_VERSION, m as maskPat, p as isQoderAccountId, s as readPoolProbes, t as clearHostHeartbeat, u as QoderAccountStore, x as isQoderUpstreamError, y as QoderUpstreamClient } from "./host-heartbeat-BNuj6Lt_.js";
+import { _ as regionOfStatusUrl, a as QODER_MODELS_REFRESH_PATH, c as QODER_REGIONS, d as QODER_SETTINGS_NS, f as QODER_TRANSFER_PATH, g as poolActionOf, h as poolAccountIdOf, i as QODER_GITHUB_URL, m as accountActionOf, n as QODER_ACCOUNTS_REFRESH_PATH, o as QODER_POOL_PATH, p as QODER_USAGE_PATH, r as QODER_ACCOUNT_CREDITS_PATH, s as QODER_PROBE_PATH, t as QODER_ACCOUNTS_PATH, u as QODER_SAVE_PATH, v as transferActionOf, y as unwrapVolatileDeep } from "./status-paths-w2WDUPVS.js";
+import z from "@deepseek-ai/schemastery";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { createProvider } from "@earendil-works/pi-ai";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
+import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+//#region src/catalog.ts
+const QODER_FALLBACK_MODELS = [
+	{
+		key: "qmodel_latest",
+		displayName: "Qwen3.7-Max",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "qmodel_preview",
+		displayName: "Qwen3.8-Max-Preview",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "qmodel",
+		displayName: "Qwen3.7-Plus",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "q36fmodel",
+		displayName: "Qwen3.6-Flash",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "dmodel",
+		displayName: "DeepSeek-V4-Pro",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "dfmodel",
+		displayName: "DeepSeek-V4-Flash",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "gm51model",
+		displayName: "GLM-5.2",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	},
+	{
+		key: "kmodel",
+		displayName: "Kimi-K2.7-Code",
+		isVl: true,
+		isReasoning: true,
+		maxInputTokens: 256e3
+	},
+	{
+		key: "mmodel",
+		displayName: "MiniMax-M2.7",
+		isVl: false,
+		isReasoning: true,
+		maxInputTokens: 2e5
+	}
+];
+/** 从 context_config 档位表提取升序 token 档位（无档位返回 undefined）。 */
+function contextTiersOf(raw) {
+	const cc = raw.context_config;
+	if (!cc) return void 0;
+	const counts = Object.values(cc).map((v) => v.token_count).filter(Number.isFinite);
+	if (counts.length === 0) return void 0;
+	return [...new Set(counts)].sort((a, b) => a - b);
+}
+/** 强度语义排序用的序表（`max` 与 `xhigh` 同属"最强"档，都排最后）。 */
+const EFFORT_ORDER = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/**
+* 从 `thinking_config` 提取可选档位。
+*
+* 实测形状（qmodel_38max）：
+*   `{ disabled: {}, enabled: { is_default: true,
+*      efforts: { xhigh: {}, low: {}, medium: { is_default: true } } } }`
+*
+* 两个要点：
+* - **键序不可信**：上游给的顺序是 `xhigh, low, medium`，直接显示会让用户
+*   以为 xhigh 是最弱档。按语义序表排。
+* - **不是每个模型都有档位**：`auto`、`qmodel_latest` 等 `efforts` 缺失，
+*   此时返回空对象（字段缺席），卡片据此不渲染这一项——而不是渲染一个空标签。
+*/
+function thinkingOf(config) {
+	const enabled = config?.["enabled"];
+	if (enabled === null || enabled === void 0 || typeof enabled !== "object") return {};
+	const efforts = enabled["efforts"];
+	if (efforts === null || typeof efforts !== "object" || Array.isArray(efforts)) return {};
+	const names = Object.keys(efforts);
+	if (names.length === 0) return {};
+	const sorted = [...names].sort((a, b) => {
+		const ia = EFFORT_ORDER.indexOf(a);
+		const ib = EFFORT_ORDER.indexOf(b);
+		if (ia === -1 && ib === -1) return a.localeCompare(b);
+		if (ia === -1) return 1;
+		if (ib === -1) return -1;
+		return ia - ib;
+	});
+	const declared = sorted.find((name) => {
+		const entry = efforts[name];
+		return entry !== null && typeof entry === "object" && entry["is_default"] === true;
+	});
+	return {
+		thinkingEfforts: sorted,
+		...declared === void 0 ? {} : { defaultThinkingEffort: declared }
+	};
+}
+/** 把上游 snake_case 条目解析成 DSH 侧模型信息。 */
+function parseUpstreamModel(raw) {
+	const contextWindow = pickDefaultContextWindow(raw) ?? raw.max_input_tokens ?? 2e5;
+	const canDisable = raw.thinking_config?.disabled !== void 0;
+	const reasoning = thinkingOf(raw.thinking_config);
+	return {
+		key: raw.key,
+		displayName: raw.display_name,
+		priceFactor: raw.price_factor ?? 1,
+		contextWindow,
+		maxOutputTokens: raw.max_output_tokens ?? 32768,
+		supportsImages: raw.is_vl,
+		supportsThinking: raw.is_reasoning,
+		canDisableThinking: canDisable || raw.is_reasoning === false,
+		...reasoning,
+		isDefault: raw.is_default,
+		isFree: raw.is_free === true,
+		isNew: false,
+		...tiersField(contextTiersOf(raw))
+	};
+}
+/** 从 context_config 档位表选默认档（is_default=true，否则取 token_count 最小者）。 */
+function pickDefaultContextWindow(raw) {
+	const cc = raw.context_config;
+	if (!cc) return void 0;
+	const entries = Object.entries(cc);
+	if (entries.length === 0) return void 0;
+	const def = entries.find(([, v]) => v.is_default === true);
+	if (def) return def[1].token_count;
+	return Math.min(...entries.map(([, v]) => v.token_count));
+}
+/** `contextTiers` 的可选字段投影（undefined 时略去字段，避免写入 undefined）。 */
+function tiersField(tiers) {
+	return tiers === void 0 || tiers.length <= 1 ? {} : { contextTiers: tiers };
+}
+/** 把 fallback 条目解析成模型信息。 */
+function fallbackModelInfo(m) {
+	return {
+		key: m.key,
+		displayName: m.displayName,
+		priceFactor: m.priceFactor ?? 1,
+		contextWindow: m.maxInputTokens ?? 2e5,
+		maxOutputTokens: m.maxOutputTokens ?? 32768,
+		supportsImages: m.isVl,
+		supportsThinking: m.isReasoning,
+		canDisableThinking: true,
+		isDefault: false,
+		isFree: false,
+		isNew: false
+	};
+}
+/**
+* 应用用户保存的每模型上下文档位。
+*
+* Qoder 的窗口是**档位选择**而非任意上限：一模型说得出几个 `context_config`
+* 档，用户保存的预算就只能在档位里挑（选了不在档位里的值没有效果，保持原生）。
+* 这样卡片渲染的 `<select>` 选项与运行期生效的窗口永远一致 —— 不会出现存档里
+* 存了 200K 而该模型根本没这个档的时候，运行期悄悄用别的东西。
+*
+* `contextWindow` 不降反升的情形只可能发生在档位表的**原生档**高于默认窗口时
+* （例如默认档 96K、另有一档 400K），此时按档位选择是诚实的用户决定。
+*/
+function applyContextBudgets(catalog, budgets = {}) {
+	return catalog.map((model) => {
+		const chosen = budgets[model.key];
+		if (model.contextTiers === void 0 || chosen === void 0) return model;
+		return model.contextTiers.includes(chosen) ? {
+			...model,
+			contextWindow: chosen
+		} : model;
+	});
+}
+/**
+* 模型显示名：内嵌积分倍率（与 Qoder 自身菜单格式一致——倍率为 1 也照写，
+* `Qwen3.7-Max · x1.00`）。workbuddy 的选择器同名规则同样不省略 1。
+*/
+function modelDisplayName(info) {
+	return `${info.displayName} · x${info.priceFactor.toFixed(2)}`;
+}
+/**
+* 目录派生：目录 ∩ 勾选（workbuddy 的 `deriveCatalog` 同规）。
+*
+* **注册给 DSH 的模型 = 用户勾选的那些**。此前实现是「一律全部保留」，于是
+* 无论用户在卡片里勾了几个，DSH 的模型选择器里都躺着整份上游目录（用户实拍：
+* 「保存的模型，还是那么多」）——勾选形同虚设。
+*
+* `enabled` 为空是特例：**全不勾不等于全不选**，而是「还没选过」——此时把整份
+* 目录交出去，否则新用户的选择器会是空的。这与 workbuddy 的
+* `enabled.size === 0 ? catalog : catalog.filter(...)` 逐字同义。
+*
+* 卡片自己的模型列表走的是另一条路（`catalog.current()`，始终是完整目录），
+* 所以「未勾选的也要看得见、才勾得上」不受影响。
+*/
+function deriveCatalog(models, enabledKeys) {
+	return enabledKeys.size === 0 ? models : models.filter((model) => enabledKeys.has(model.key));
+}
+/** 初始勾选集合：目录中的默认模型 + 免费模型；其余不勾。 */
+function initialEnabledKeys(models) {
+	return new Set(models.filter((m) => m.isDefault || m.isFree).map((m) => m.key));
+}
+/**
+* 一区域的当前目录。启动时以静态 fallback 填充（离线也能立刻有 provider），
+* 上游目录拉取成功后整表替换；空结果不覆盖已有表。
+*/
+var QoderCatalog = class {
+	models;
+	constructor(initial) {
+		this.models = initial;
+	}
+	current() {
+		return this.models;
+	}
+	set(models) {
+		if (models.length > 0) this.models = models;
+	}
+	/** 按 key 或显示名查找模型。 */
+	find(selector) {
+		return this.models.find((m) => m.key === selector || m.displayName === selector);
+	}
+	/** key 解析：优先内部 key，其次显示名；未知返回 undefined。 */
+	keyOf(selector) {
+		return this.find(selector)?.key;
+	}
+	supportsImagesOf(selector) {
+		return this.find(selector)?.supportsImages ?? false;
+	}
+	isReasoningOf(selector) {
+		return this.find(selector)?.supportsThinking ?? false;
+	}
+};
+//#endregion
+//#region src/off-thinking.ts
+/**
+* 已观察到**拒绝** `reasoning_effort: "off"`（HTTP 400）的模型 id，
+* 即使它们声明了「可关闭思考」。
+*
+* 按精确 model id 键控，且刻意**不**按区域分：拒绝与否跟模型家族走，不跟网关走。
+* 代价是不对称的——提供一个必然失败的档位，代价是用户该模型的**每一次**请求；
+* 而藏起一个本可用的档位，代价只是少一个选项——所以本表宁可多藏。
+* 知道得更清楚的用户可以显式覆盖（见 {@link effectiveOff}）。
+*
+* 现状为空：本项目尚未在 Qoder 网关上实测到拒绝样本。留空即「只信上游声明」，
+* 这与本插件 0.1.0 的行为一致，属于**不倒退**的默认；一旦有实测样本，按上面的
+* 键控规则补条目即可。
+*/
+const REFUSES_OFF_MODEL_IDS = /* @__PURE__ */ new Set([]);
+/**
+* 在用户没有表态时，是否应当为某模型提供 `off` 档：上游声明减去已知拒绝的 id。
+*
+* 只有上游**显式**声明可关闭（`canDisableThinking === true`）才开启该档；
+* 缺失视为「未知」，保持不提供——与本插件对其它未声明能力的一贯处理一致。
+*/
+function offDefaultFor(info) {
+	return info.canDisableThinking === true && !REFUSES_OFF_MODEL_IDS.has(info.key);
+}
+/**
+* 默认应当提供 `off` 档的模型 id 集合。
+*
+* 用户的勾选框是一个普通集合：勾上=提供，取消=撤回。这里是**种子**——集合
+* 第一次被读取时填入的内容——让从未保存过的 profile 立刻显示正确默认值，
+* 而不必先保存一次。
+*/
+function defaultOffModelIds(models) {
+	return models.filter(offDefaultFor).map((model) => model.key);
+}
+/**
+* 把用户保存的 `off` 选择**盖印**到模型列表上，供**运行时**目录使用。
+*
+* 运行时描述符由适配器的 `qoderThinkingLevelMap` 构建，它只读模型自报的声明；
+* 因此校正后的答案必须在模型抵达适配器之前写到模型上。放在这里可以让适配器
+* 保持「声明进、档位表出」的纯函数，也让这张表紧挨着它所服务的规则。
+*
+* 这里**覆盖**声明字段而不是新增兄弟字段：该声明只有这一个消费者（同一张档位
+* 表），且从不被持久化到卡片能看到的地方（`toWebModel` 会丢掉
+* `canDisableThinking`，卡片的 `lastCatalog` 来自上游原始发现，而非这份盖印
+* 结果）。未声明推理的模型原样返回——没有档位需要校正。
+*/
+function withEffectiveOff(models, selection) {
+	return models.map((model) => {
+		if (model.supportsThinking !== true) return model;
+		return {
+			...model,
+			canDisableThinking: selection.has(model.key)
+		};
+	});
+}
+/** 便捷投影：把目录条目转成本模块需要的两个字段。 */
+function offCapabilityOf(info) {
+	return {
+		key: info.key,
+		supportsThinking: info.supportsThinking,
+		canDisableThinking: info.canDisableThinking
+	};
+}
+//#endregion
+//#region src/native-modality.ts
+/**
+* 已核对的厂商分类，按**精确 model id**（绝不用前缀匹配）键控。
+* 不在本表中的 id 一律 `unknown` —— 见 {@link nativeModalityOf}。
+*
+* 现状：仅登记本插件内置目录里那些「模型名即厂商模型名」且模态可从名字
+* 判定的条目；Qoder 内部的 `q*model` / `d*model` 短 id 无公开文档可依，
+* 一律保持 unknown，宁可不勾选也不猜。
+*/
+const NATIVE_MODALITY_BY_MODEL_ID = {
+	"kimi-k2.7-code": "text",
+	"qwen3.7-max": "multimodal",
+	"qwen3.8-max-preview": "multimodal",
+	"qwen3.7-plus": "multimodal",
+	"qwen3.6-flash": "multimodal"
+};
+/**
+* 一次模型刷新是否应当**预勾选**该模型的图片开关。
+*
+* 只有文档确认的 `multimodal` 会被预勾选。`text` 已写明不能读图，而
+* `unknown` 是刻意留空而非猜测——这张表存在的全部理由就是平台标记猜错过。
+* 平台的 `supportsImages: false` 仍然拥有一票否决权，所以一个文档上
+* multimodal 的 id 也不会在平台明确说「不支持」时被预勾选。
+*
+* 用户始终可以手动勾选；这里只决定**默认值**，运行时生效的仍是用户保存的
+* `imageModelKeys` 之类的持久选择。
+*/
+function imageDefaultFor(info) {
+	if (info.supportsImages === false) return false;
+	return NATIVE_MODALITY_BY_MODEL_ID[normalizeModelId(info.id)] === "multimodal";
+}
+/**
+* 把 Qoder 的内部短 id（`qmodel_latest` 等）或显示名归一到本表键。
+*
+* 内置目录里 `key` 是短 id、`displayName` 是厂商模型名，两处都可能被当成
+* 「模型 id」传进来；先按原样查表，查不到再用显示名的小写连字符形式兜底。
+* 仍然查不到就是 unknown——兜底只是多给一次**精确**匹配机会，绝不做模糊匹配。
+*/
+function normalizeModelId(modelId) {
+	return modelId.trim().toLowerCase();
+}
+//#endregion
+//#region src/shim.ts
+/**
+* Qoder 回环 shim：进程内 HTTP 服务（127.0.0.1 随机端口）。
+*
+* 安全模型与 dsh-connect-workbuddy 一致（参考其 `src/shim.ts`）：
+* - 随机端口 + 进程内 32 字节随机 secret（pi-ai 只拿到 secret 当 apiKey，
+*   真实的 Qoder 凭据绝不交给 pi-ai）；
+* - Host / Origin / Content-Type 三重入站校验（必须在路由判定之前），
+*   请求体有 64MB 上限；
+* - 常量时间比对 Authorization。
+*
+* 职责：把 pi-ai 的 OpenAI 聊天请求翻译成 Qoder 网关请求，并把 Qoder 的
+* OpenAI 形状 SSE 原样转发为 OpenAI chunks；错误分类映射为 DSH 可判定的
+* HTTP 状态 + error.code。
+*
+* 首字节之前的失败一律回 **非 200 的 JSON 错误**（不是 SSE 错误帧）：pi-ai
+* 的 openai-completions 客户端只认非 2xx 响应体的 `error.message/code`，
+* 对 200 流里的 `error` 字段完全不读（chunk 循环只取 `choices[0]`，
+* `finish_reason:"error"` 会被塌缩成一句无信息的 "Provider finish_reason:
+* error"）。只有 JSON 错误能把真实的 kind/code 送进宿主的分类器。
+*
+* 账号池故障转移（参考 dsh-connect-workbuddy 的 `src/shim.ts` 相同模式）：
+* - 每次请求先 `resolveServing()` 解析**本次该买单的账号**（账号池排序结果或
+*   用户显式选择；缺省落到 `credential()` 的默认解析）；
+* - 首块字节写出前若上游硬拒（auth / 限流 / 额度 / 瞬时），记录该账号的失败
+*   （`onServingFailure` → live-request 写回账号池），间隔
+*   `failoverGapMs`（默认 2s，可中断）后再 `failoverAccount()` 取下一个候选
+*   重试 —— **只在未写任何 SSE 前重试**，一旦首个 delta 已转发，之后的错误
+*   原样进流（不回放、不换号）；策略层若重复返回已试过的账号，shim 侧也刹车；
+* - 客户端中途断开（响应流 close）会中止上游请求，且**不**为该次失败记测量
+*   （那是断开，不是账号的错）；
+* - 被账号池接管时，首个内容帧以引用块前缀说明「本次由账号池账号 X 服务」
+*   （必须走 `choices[0].delta.content`——空 choices 的自定义帧会被 pi-ai
+*   直接跳过，用户将完全看不到换号）。
+*
+* @module dsh-connect-qoder/shim
+*/
+const CONTENT_TYPE_JSON = "application/json";
+/** 请求体上限（workbuddy 同值）：长对话体可以很大，但必须有界。 */
+const REQUEST_BODY_LIMIT = 67108864;
+/**
+* 换号重试前的间隔（workbuddy 同值）。
+*
+* 上游限流按请求体积触发：零间隔连环重试会让每个候选账号都撞上同一堵墙
+* （4 个账号一秒内全部失败）。批量测试已在账号间等 400ms
+* （`POOL_BATCH_GAP_MS`）；故障转移重试是用户正在等的真实请求，给上游窗口
+* 更多喘息空间。等待是可中断的：客户端断开就立刻停，而不是睡满全程。
+*/
+const FAILOVER_ACCOUNT_GAP_MS = 2e3;
+/**
+* 浏览器 Origin（存在时）必须指向回环。非浏览器客户端（插件自己的 fetch、
+* pi-ai）根本不发 Origin，直接放行；DNS-rebinding 页面的 Host 可以伪造，
+* 但 Origin 会暴露它的真实域名。
+*/
+function originIsLoopback(origin) {
+	if (origin === void 0 || origin.trim() === "") return true;
+	try {
+		const { hostname } = new URL(origin);
+		return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "::1" || hostname === "[::1]";
+	} catch {
+		return false;
+	}
+}
+/**
+* 写给宿主的 `code` 翻译表。
+*
+* 宿主（`@deepseek-ai/dsh-llm` + llm-pi-ai）从失败文案里读英文短语来决定
+* 「原地重试（默认 5 次指数退避）」还是「跨供应商故障转移」：`RATE_LIMIT` /
+* `SERVER` / `TIMEOUT` / `TRANSPORT` / `EMPTY_RESPONSE` 在原地重试集里。
+*
+* `rate-limited` 是那个被字面翻译害惨的 kind：上游 429 的冷却常常以小时计
+* （探针从响应体里解析恢复时间），若按 `rate_limit_exceeded` 送达，宿主会把
+* 整个重试预算烧在一个不可能在退避窗口内恢复的端点上。翻成 `quota_exceeded`
+* 是宿主认得的词，也符合上游「此刻不可用」的实际语义；HTTP 状态保持 429
+* 不动（那是上游真实返回的），上游自己的消息仍原文透传给人读。
+*/
+const KIND_HOST_CODE = { "rate-limited": "quota_exceeded" };
+/** 首字节前失败写给宿主的 code（宿主按它分类）；流内错误帧仍用原 code。 */
+function hostErrorCode(kind) {
+	return KIND_HOST_CODE[kind] ?? ERROR_MAP[kind].code;
+}
+/** HTTP 状态 + error.code 双映射表（DSH 依据 code 判定原地重试 vs failover）。 */
+const ERROR_MAP = {
+	network: {
+		status: 502,
+		code: "connection_error"
+	},
+	auth: {
+		status: 401,
+		code: "invalid_api_key"
+	},
+	"rate-limited": {
+		status: 429,
+		code: "rate_limit_exceeded"
+	},
+	"invalid-request": {
+		status: 400,
+		code: "invalid_request_error"
+	},
+	"content-policy": {
+		status: 400,
+		code: "content_policy_rejected"
+	},
+	"quota-exhausted": {
+		status: 429,
+		code: "quota_exceeded"
+	},
+	transient: {
+		status: 502,
+		code: "upstream_error"
+	},
+	unknown: {
+		status: 500,
+		code: "upstream_error"
+	}
+};
+/**
+* Round about which upstream failures are worth spending a failover attempt
+* on. A request never starts, wait / fix input / the model is gone, a
+* content-policy refusal is about THIS message (the next account would be
+* refused the same way), and a mid-stream error has already committed bytes.
+* Only a failure where the serving account was the problem and nothing has
+* been written yet deserves to move to the next account.
+*/
+function isFailoverEligible(kind) {
+	return kind === "auth" || kind === "rate-limited" || kind === "quota-exhausted" || kind === "network" || kind === "transient";
+}
+/** 可中断的等待：signal 中止时立即结束，而不是睡满全程。 */
+function sleepAbortable(ms, signal) {
+	return new Promise((resolve) => {
+		if (ms <= 0 || signal.aborted) return resolve();
+		const timer = setTimeout(resolve, ms);
+		signal.addEventListener("abort", () => {
+			clearTimeout(timer);
+			resolve();
+		}, { once: true });
+	});
+}
+function createQoderShim(options) {
+	const { upstream } = options;
+	const logger = options.logger ?? (() => {});
+	const secret = randomBytes(32).toString("base64url");
+	const secretBuf = Buffer.from(secret);
+	let baseUrlValue = "";
+	let portValue = 0;
+	let closeFn = async () => {};
+	const ready = new Promise((resolveReady, rejectReady) => {
+		const server = createServer((req, res) => {
+			handleRequest(req, res).catch((error) => {
+				const status = isQoderUpstreamError(error) ? ERROR_MAP[error.kind].status : 500;
+				const code = isQoderUpstreamError(error) ? hostErrorCode(error.kind) : "internal_error";
+				writeJson(res, status, { error: {
+					message: String(error.message ?? "internal error"),
+					code,
+					type: "qoder_error"
+				} });
+			});
+		});
+		server.on("error", (error) => {
+			rejectReady(error);
+		});
+		server.listen(0, "127.0.0.1", () => {
+			const addr = server.address();
+			baseUrlValue = `http://127.0.0.1:${addr.port}`;
+			portValue = addr.port;
+			resolveReady();
+		});
+		closeFn = () => new Promise((resolve, reject) => {
+			server.close((error) => error ? reject(error) : resolve());
+		});
+	});
+	async function handleRequest(req, res) {
+		if (!checkHost(req)) {
+			writeJson(res, 403, { error: {
+				message: "bad host",
+				code: "host_not_allowed"
+			} });
+			return;
+		}
+		if (!originIsLoopback(req.headers.origin)) {
+			writeJson(res, 403, { error: {
+				message: "Origin must be a loopback origin",
+				code: "origin_not_allowed"
+			} });
+			return;
+		}
+		if (!checkAuthorization(req, secretBuf)) {
+			writeJson(res, 401, { error: {
+				message: "invalid api key",
+				code: "invalid_api_key"
+			} });
+			return;
+		}
+		if (!checkContentType(req)) {
+			writeJson(res, 415, { error: {
+				message: "unsupported media type",
+				code: "invalid_request_error"
+			} });
+			return;
+		}
+		const url = new URL(req.url ?? "/", "http://127.0.0.1");
+		if (req.method === "GET" && (url.pathname === "/healthz" || url.pathname === "/healthz/")) {
+			writeJson(res, 200, { ok: true });
+			return;
+		}
+		if (req.method === "GET" && url.pathname === "/v1/models") {
+			await handleModels(res);
+			return;
+		}
+		if (req.method === "POST" && url.pathname === "/v1/chat/completions") {
+			await handleChat(req, res);
+			return;
+		}
+		writeJson(res, 404, { error: {
+			message: "not found",
+			code: "invalid_request_error"
+		} });
+	}
+	function checkHost(req) {
+		const host = req.headers.host ?? "";
+		return /^127\.0\.0\.1:\d+$/.test(host);
+	}
+	function checkAuthorization(req, expected) {
+		const header = req.headers.authorization;
+		if (typeof header !== "string") return false;
+		const match = /^Bearer (.+)$/.exec(header);
+		if (!match) return false;
+		const actual = Buffer.from(match[1] ?? "");
+		if (actual.length !== expected.length) return false;
+		return timingSafeEqual(actual, expected);
+	}
+	function checkContentType(req) {
+		if (req.method === "GET") return true;
+		return (req.headers["content-type"] ?? "").startsWith(CONTENT_TYPE_JSON);
+	}
+	function resolveFallbackCredential() {
+		const pat = options.credential();
+		if (!pat) throw new QoderUpstreamError("auth", "未配置 Qoder PAT：请在插件设置里填写，或设置环境变量", 401);
+		return pat;
+	}
+	async function handleModels(res) {
+		writeJson(res, 200, {
+			object: "list",
+			data: listModelIds().map((id) => ({
+				id,
+				object: "model",
+				owned_by: "qoder"
+			}))
+		});
+	}
+	function listModelIds() {
+		return [];
+	}
+	async function handleChat(req, res) {
+		let raw;
+		try {
+			raw = await readBody(req, options.requestBodyLimit ?? REQUEST_BODY_LIMIT);
+		} catch (error) {
+			if (error.message === "request body too large") {
+				writeJson(res, 413, { error: {
+					message: "request body too large",
+					code: "invalid_request_error"
+				} });
+				return;
+			}
+			throw error;
+		}
+		let body;
+		try {
+			body = JSON.parse(raw);
+		} catch {
+			writeJson(res, 400, { error: {
+				message: "invalid JSON body",
+				code: "invalid_request_error"
+			} });
+			return;
+		}
+		const model = typeof body.model === "string" ? body.model : "";
+		const messages = Array.isArray(body.messages) ? body.messages : [];
+		const stream = body.stream !== false;
+		if (messages.length === 0) {
+			writeJson(res, 400, { error: {
+				message: "messages is required",
+				code: "invalid_request_error"
+			} });
+			return;
+		}
+		const key = options.modelKeyOf ? options.modelKeyOf(model) ?? model : model;
+		const supportsImages = options.supportsImagesOf ? options.supportsImagesOf(model) : false;
+		const savedEffort = options.reasoningEffortOf ? options.reasoningEffortOf(model) : void 0;
+		if (messages.some((m) => Array.isArray(m.content) && m.content.some((p) => p?.type === "image_url")) && !supportsImages) {
+			writeJson(res, 400, { error: {
+				message: `模型 ${model} 不支持图像输入`,
+				code: "invalid_request_error"
+			} });
+			return;
+		}
+		if (!stream) {
+			writeJson(res, 400, { error: {
+				message: "only streaming is supported",
+				code: "invalid_request_error"
+			} });
+			return;
+		}
+		const tools = body.tool_choice === "none" || !Array.isArray(body.tools) ? void 0 : body.tools;
+		const requestedOff = body.reasoning_effort === "off";
+		const isReasoning = savedEffort !== void 0 && !requestedOff ? true : isReasoningRequested(body);
+		const reasoningEffort = requestedOff ? void 0 : savedEffort;
+		const controller = new AbortController();
+		res.on("close", () => controller.abort());
+		if (res.destroyed) controller.abort();
+		let serving;
+		try {
+			serving = await (options.resolveServing ? options.resolveServing() : Promise.resolve(void 0));
+			if (serving === void 0) serving = {
+				accountId: "default",
+				accountName: "",
+				pat: resolveFallbackCredential()
+			};
+		} catch (error) {
+			const mapped = isQoderUpstreamError(error) ? ERROR_MAP[error.kind] : {
+				status: 500,
+				code: "upstream_error"
+			};
+			writeJson(res, mapped.status, { error: {
+				message: error.message,
+				code: mapped.code,
+				type: "qoder_error"
+			} });
+			return;
+		}
+		const requestId = `chatcmpl-${randomBytes(12).toString("hex")}`;
+		const created = Math.floor(Date.now() / 1e3);
+		const tried = [];
+		const gapMs = options.failoverGapMs ?? FAILOVER_ACCOUNT_GAP_MS;
+		for (;;) {
+			let wroteAny = false;
+			let hasToolCalls = false;
+			let inputTokens = 0;
+			let outputTokens = 0;
+			let notice = options.poolServingNotice ? options.poolServingNotice(serving.accountId) : void 0;
+			try {
+				await upstream.chatStream(serving.pat, key, messages, {
+					...tools === void 0 ? {} : { tools },
+					isReasoning,
+					...reasoningEffort === void 0 ? {} : { reasoningEffort },
+					isVl: supportsImages,
+					signal: controller.signal,
+					onDelta: (delta) => {
+						if (!wroteAny) {
+							res.writeHead(200, {
+								"Content-Type": "text/event-stream",
+								"Cache-Control": "no-cache",
+								"Connection": "keep-alive",
+								"X-Accel-Buffering": "no"
+							});
+							if (notice !== void 0) {
+								writeNoticeChunk(res, requestId, created, model, notice);
+								notice = void 0;
+							}
+							wroteAny = true;
+						}
+						if (delta.inputTokens > 0) inputTokens = delta.inputTokens;
+						if (delta.outputTokens > 0) outputTokens = delta.outputTokens;
+						if (delta.toolCalls !== void 0) hasToolCalls = true;
+						writeDeltaChunk(res, requestId, created, model, delta);
+					}
+				});
+				if (res.destroyed) return;
+				const done = makeChunk(requestId, created, model);
+				done.choices[0].finish_reason = hasToolCalls ? "tool_calls" : "stop";
+				if (inputTokens > 0 || outputTokens > 0) done.usage = {
+					prompt_tokens: inputTokens,
+					completion_tokens: outputTokens,
+					total_tokens: inputTokens + outputTokens
+				};
+				res.write(`data: ${JSON.stringify(done)}\n\n`);
+				res.write("data: [DONE]\n\n");
+				res.end();
+				return;
+			} catch (error) {
+				if (wroteAny) {
+					writeErrorChunk(res, requestId, created, model, error);
+					return;
+				}
+				if (isQoderUpstreamError(error) && isFailoverEligible(error.kind) && !controller.signal.aborted) {
+					options.onServingFailure?.(serving.accountId, error.kind, error.message);
+					tried.push(serving.accountId);
+					let next;
+					try {
+						next = options.failoverAccount ? await options.failoverAccount(tried) : void 0;
+					} catch {
+						next = void 0;
+					}
+					if (next !== void 0 && !tried.includes(next.accountId)) {
+						logger(`shim failover: ${serving.accountId} → ${next.accountId} (${error.kind})`);
+						serving = next;
+						await sleepAbortable(gapMs, controller.signal);
+						if (controller.signal.aborted) return;
+						continue;
+					}
+				}
+				if (isQoderUpstreamError(error)) {
+					const note = tried.length > 1 ? ` (after trying ${tried.length} accounts)` : "";
+					const mapped = ERROR_MAP[error.kind];
+					writeJson(res, mapped.status, { error: {
+						message: `qoder upstream ${error.kind} (http ${error.status})${note}: ${error.message.slice(0, 400)}`,
+						code: hostErrorCode(error.kind),
+						type: "qoder_error"
+					} });
+					return;
+				}
+				throw error;
+			}
+		}
+	}
+	/** 从请求体决定本次的 `is_reasoning`（见在线路上的注释）。 */
+	function isReasoningRequested(body) {
+		const effort = typeof body.reasoning_effort === "string" ? body.reasoning_effort : void 0;
+		if (effort === "off") return false;
+		if (effort !== void 0 && effort !== "") return true;
+		return body.stream_options?.include_reasoning === true;
+	}
+	/** 池接管的通知帧：一段以引用块前缀开头的**内容**帧（pi-ai 可见）。 */
+	function writeNoticeChunk(res, id, created, model, notice) {
+		const chunk = makeChunk(id, created, model);
+		chunk.choices[0].delta.content = `\n\n> [dsh-connect-qoder] ${notice}\n\n`;
+		res.write(`data: ${JSON.stringify(chunk)}\n\n`);
+	}
+	function writeDeltaChunk(res, id, created, model, delta) {
+		const chunk = makeChunk(id, created, model);
+		const choice = chunk.choices[0];
+		if (delta.role !== "") choice.delta.role = delta.role;
+		if (delta.content !== "") choice.delta.content = delta.content;
+		if (delta.reasoningContent !== "") choice.delta.reasoning_content = delta.reasoningContent;
+		if (delta.toolCalls !== void 0) choice.delta.tool_calls = delta.toolCalls;
+		res.write(`data: ${JSON.stringify(chunk)}\n\n`);
+	}
+	function writeErrorChunk(res, id, created, model, error) {
+		if (res.destroyed) return;
+		const errChunk = makeChunk(id, created, model);
+		errChunk.choices[0].finish_reason = "error";
+		const code = isQoderUpstreamError(error) ? ERROR_MAP[error.kind].code : "upstream_error";
+		errChunk.error = {
+			message: String(error.message ?? "internal error"),
+			code,
+			type: "qoder_error"
+		};
+		res.write(`data: ${JSON.stringify(errChunk)}\n\n`);
+		res.write("data: [DONE]\n\n");
+		res.end();
+	}
+	function makeChunk(id, created, model) {
+		return {
+			id,
+			object: "chat.completion.chunk",
+			created,
+			model,
+			choices: [{
+				index: 0,
+				delta: {},
+				finish_reason: null
+			}]
+		};
+	}
+	function writeJson(res, status, body) {
+		if (res.writableEnded || res.destroyed) return;
+		const text = JSON.stringify(body);
+		res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+		res.end(text);
+	}
+	function readBody(req, limit) {
+		return new Promise((resolve, reject) => {
+			const chunks = [];
+			let size = 0;
+			let over = false;
+			req.on("data", (chunk) => {
+				if (over) return;
+				size += chunk.length;
+				if (size > limit) {
+					over = true;
+					reject(/* @__PURE__ */ new Error("request body too large"));
+					req.resume();
+					return;
+				}
+				chunks.push(chunk);
+			});
+			req.on("end", () => {
+				if (!over) resolve(Buffer.concat(chunks).toString("utf8"));
+			});
+			req.on("error", reject);
+		});
+	}
+	return {
+		ready,
+		get baseUrl() {
+			return baseUrlValue;
+		},
+		get port() {
+			return portValue;
+		},
+		secret,
+		close: async () => {
+			await closeFn();
+		}
+	};
+}
+/** The provider id each region registers as. */
+const QODER_PROVIDERS = {
+	cn: "qoder",
+	global: "qoder-global"
+};
+/** Region a provider route id belongs to. */
+function regionOfProvider(provider) {
+	for (const [region, id] of Object.entries(QODER_PROVIDERS)) if (id === provider) return region;
+}
+/** Human-readable provider name, shown in the DSH model picker. */
+const QODER_PROVIDER_DISPLAY_NAMES = {
+	cn: "Qoder",
+	global: "Qoder Global"
+};
+/** Provider idle ceiling while one stream read is outstanding. */
+const QODER_STREAM_IDLE_TIMEOUT_MS = 3e5;
+const NO_COST = {
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0
+};
+/** Image-request budgets at the dsh-llm-pi-ai defaults. */
+const REQUEST_IMAGE_BUDGETS = {
+	maxRequestImageBytes: 20971520,
+	requestImagePixelBudget: 4194304,
+	requestImageMaxBytes: 1048576
+};
+/** Inert pi-ai auth plane: the route authenticates only through the shim secret. */
+const INERT_AUTH = {
+	credentials: {
+		async read() {},
+		async list() {
+			return [];
+		},
+		async modify() {}
+	},
+	authContext: {}
+};
+const THINKING_LEVELS = [
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/** pi-ai input modalities: images only when Qoder advertises them. */
+function qoderModelInput(info) {
+	return info.supportsImages === true ? ["text", "image"] : ["text"];
+}
+/**
+* The DSH-facing thinking level map for one Qoder model.
+*
+* **只映射上游真正声明的档位**（workbuddy 的 `workBuddyThinkingLevelMap` 同规）。
+* Qoder 的 `thinking_config.enabled.efforts` 会逐模型声明档位，且**不统一**：
+* Qwen 系是 `xhigh / low / medium`，DeepSeek/GLM 系是 `high / low / max`。
+* 把六个 DSH 档位全部置 null 会让 DSH 的模型设置里出现一排「可选但无效」的
+* 档位 —— 用户选了也不起作用。正确做法是：声明了的档位映射到**同名**的真实档位，
+* 没声明的映射为 `null`（DSH 据此不提供该档）。
+*
+* 上游声明可以关闭思考时额外提供 `off`；不能关闭则 `off` 映射为 null（DSH
+* 不提供「关闭」）。非推理模型没有 map。
+*
+* 注意：这与「请求线怎么带档位」是两件事 —— shim 侧按
+* `reasoningEffort` + `parameters.reasoning_effort` 发送（见 shim.ts）。
+*/
+function qoderThinkingLevelMap(info) {
+	if (!info.supportsThinking) return void 0;
+	const declared = info.thinkingEfforts ?? [];
+	const supported = THINKING_LEVELS.filter((level) => declared.includes(level));
+	if (supported.length === 0) return void 0;
+	const map = {};
+	for (const level of THINKING_LEVELS) map[level] = supported.includes(level) ? level : null;
+	if (info.canDisableThinking === true) map.off = "off";
+	return map;
+}
+/** Build one pi-ai model descriptor pointing at the loopback shim. */
+function toPiModel(info, baseUrl, providerId) {
+	const thinkingLevelMap = qoderThinkingLevelMap(info);
+	return {
+		id: info.key,
+		name: modelDisplayName(info),
+		api: "openai-completions",
+		provider: providerId,
+		baseUrl,
+		input: qoderModelInput(info),
+		cost: NO_COST,
+		contextWindow: info.contextWindow,
+		maxTokens: info.maxOutputTokens,
+		reasoning: thinkingLevelMap !== void 0,
+		...thinkingLevelMap === void 0 ? {} : { thinkingLevelMap },
+		compat: {
+			supportsReasoningEffort: thinkingLevelMap !== void 0,
+			supportsDeveloperRole: false
+		}
+	};
+}
+/**
+* Rewrite a pi-ai 0.87-shaped transcript into the 0.85 shape this plugin's
+* pi-ai understands — prompt AND tools.
+*
+* WHY THIS EXISTS: pi-ai 0.87's `normalizeContext` moves the system prompt
+* INTO `messages` as `{ role: 'system', content }`, and 0.85's own `Message`
+* union has no `system` variant — its token estimator then throws inside the
+* library. This plugin cannot patch the library, so it must not hand a 0.87
+* transcript to a 0.85 API object.
+*
+* The 0.87 transcript also carries the tool declarations on that leading
+* system message (`toolsAdded`/`toolsRemoved`) — the only place they live —
+* so the fold promotes them too, exactly the merge pi-ai 0.87's own
+* `getCurrentTools` performs, and leaves an existing top-level `tools` array
+* untouched.
+*
+* Unlike the sibling plugin, Qoder needs NO fallback system prompt: the Qoder
+* gateway accepts user-first conversations (there is no "first message must be
+* the system prompt" rule), so a transcript with no system message is passed
+* through as-is. All the 0.87-vs-0.85 shape work above is identical.
+*
+* Deliberately SHAPE-based within the legacy branch, not version-based, and
+* `withLegacyContext` generation-gates which API object consumes the result.
+*/
+function adaptLegacyPiAiContext(context) {
+	if (context === null || typeof context !== "object") return context;
+	if (context.systemPrompt) return context;
+	const messages = Array.isArray(context.messages) ? context.messages : void 0;
+	if (messages === void 0) return context;
+	const systemTexts = [];
+	const rest = [];
+	const toolState = /* @__PURE__ */ new Map();
+	let sawSystemMessage = false;
+	for (const message of messages) {
+		if (message?.role !== "system") {
+			rest.push(message);
+			continue;
+		}
+		sawSystemMessage = true;
+		const text = systemTextOf(message);
+		if (text !== "") systemTexts.push(text);
+		replayToolState(message, toolState);
+	}
+	if (!sawSystemMessage) return context;
+	const systemPrompt = systemTexts.length > 0 ? systemTexts.join("\n\n") : void 0;
+	const tools = Array.isArray(context.tools) ? void 0 : [...toolState.values()];
+	return {
+		...context,
+		...systemPrompt === void 0 ? {} : { systemPrompt },
+		...tools !== void 0 && tools.length > 0 ? { tools } : {},
+		messages: rest
+	};
+}
+/** Replay one 0.87 system message's tool deltas into `state`. */
+function replayToolState(message, state) {
+	const removed = message.toolsRemoved;
+	if (Array.isArray(removed)) for (const tool of removed) {
+		const name = tool?.name;
+		if (typeof name === "string") state.delete(name);
+	}
+	const added = message.toolsAdded;
+	if (Array.isArray(added)) for (const tool of added) {
+		const name = tool?.name;
+		if (typeof name === "string") state.set(name, tool);
+	}
+}
+/** The text of one system message, whether it is a string or text blocks. */
+function systemTextOf(message) {
+	const content = message.content;
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	const texts = [];
+	for (const block of content) {
+		if (typeof block !== "object" || block === null) continue;
+		const candidate = block;
+		if (candidate.type === "text" && typeof candidate.text === "string") texts.push(candidate.text);
+	}
+	return texts.join("\n\n");
+}
+/**
+* Wrap one pi-ai API module so both stream entry points receive a context this
+* build can consume — but only when the module RESOLVED for this plugin is the
+* legacy generation.
+*
+* The gate is the plugin's own module, resolved via {@link piAiRuntimeInfo}: a
+* modern (0.87+) api consumes the normalized transcript natively, so folding
+* for it would delete its only carrier of prompt and tools. The unwrapped
+* modern api is passed through as-is.
+*/
+function withLegacyContext(api, generation) {
+	if (generation === "modern") return api;
+	return {
+		...api,
+		stream: (model, context, options) => api.stream(model, adaptLegacyPiAiContext(context), options),
+		streamSimple: (model, context, options) => api.streamSimple(model, adaptLegacyPiAiContext(context), options)
+	};
+}
+/**
+* Assemble the adapter. The provider's `getModels` reads the live catalog,
+* and every model's `baseUrl` is re-resolved per read so the shim's
+* ephemeral port applies from the first snapshot after startup.
+*/
+function createQoderAdapter(options) {
+	const { shim, catalog } = options;
+	const providerId = options.provider ?? "qoder";
+	const providerName = options.displayName ?? QODER_PROVIDER_DISPLAY_NAMES.cn;
+	const generation = options.piAiGeneration ?? piAiRuntimeInfo()?.generation ?? "modern";
+	const api = withLegacyContext(openAICompletionsApi(), generation);
+	const buildModels = () => {
+		const baseUrl = `${shim.baseUrl}/v1`;
+		return catalog.current().map((info) => toPiModel(info, baseUrl, providerId));
+	};
+	const provider = {
+		...createProvider({
+			id: providerId,
+			name: providerName,
+			auth: { apiKey: {
+				name: "Qoder shim token",
+				async resolve({ credential }) {
+					const apiKey = credential?.key;
+					return {
+						auth: apiKey === void 0 || apiKey.length === 0 ? {} : { apiKey },
+						source: "Qoder shim token"
+					};
+				}
+			} },
+			models: buildModels(),
+			api
+		}),
+		getModels: () => buildModels()
+	};
+	const profile = {
+		provider: providerId,
+		displayName: providerName,
+		streamIdleTimeoutMs: QODER_STREAM_IDLE_TIMEOUT_MS,
+		retryPolicy: resolveRetryPolicy(void 0, "dsh-connect-qoder retryPolicy"),
+		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		modelErrors: /* @__PURE__ */ new Map(),
+		...REQUEST_IMAGE_BUDGETS,
+		piProvider: provider
+	};
+	let profiles = /* @__PURE__ */ new Map([[providerId, profile]]);
+	return {
+		adapter: new PiAiAdapter({
+			profiles: () => profiles,
+			auth: INERT_AUTH,
+			resolveApiKey: async () => shim.secret,
+			...options.resolveAttachments === void 0 ? {} : { resolveAttachments: options.resolveAttachments }
+		}),
+		invalidate: () => {
+			profiles = /* @__PURE__ */ new Map([[providerId, profile]]);
+		},
+		piAiGeneration: generation
+	};
+}
+//#endregion
+//#region src/probe.ts
+/** The family's default probe input, in tokens (a realistic conversation size). */
+const DEFAULT_PROBE_INPUT_TOKENS = 25e3;
+/**
+* The probe sizes the card offers, in tokens — carried from the sibling plugin
+* so the two cards read one family set.
+*/
+const PROBE_INPUT_TOKEN_CHOICES = [
+	1e4,
+	2e4,
+	3e4,
+	5e4,
+	1e5
+];
+/**
+* A requested probe size reduced to a size this build will send.
+*/
+function resolveProbeInputTokens(requested) {
+	return requested !== void 0 && PROBE_INPUT_TOKEN_CHOICES.includes(requested) ? requested : DEFAULT_PROBE_INPUT_TOKENS;
+}
+/** Characters per token for the filler text (family estimate, 4.5 c/tok). */
+const CHARS_PER_TOKEN = 4.5;
+/** Neutral filler; carries no user content, only volume. */
+const FILLER_LINE = "The quick brown fox jumps over the lazy dog. ";
+/**
+* Build the user message a probe carries: a padded filler (for volume) plus
+* the actual prompt. Qoder's gateway takes user-first messages (no system
+* requirement), so no PROBE_SYSTEM_PROMPT is needed.
+*/
+function probeUserMessage(inputTokens = DEFAULT_PROBE_INPUT_TOKENS) {
+	const targetChars = Math.ceil(resolveProbeInputTokens(inputTokens) * CHARS_PER_TOKEN);
+	return `${FILLER_LINE.repeat(Math.ceil(targetChars / 45))}Reply with a single word.`;
+}
+/**
+* Parse a `Retry-After` header value into an absolute time.
+*
+* Both RFC 9110 forms are accepted: delay-seconds (`120`) and an HTTP-date.
+* Returns undefined for anything else, including negative/zero delays.
+*/
+function parseRetryAfter(value, nowMs) {
+	if (value === null) return void 0;
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	if (/^\d+$/u.test(trimmed)) {
+		const seconds = Number(trimmed);
+		if (!Number.isFinite(seconds) || seconds <= 0) return void 0;
+		return nowMs + seconds * 1e3;
+	}
+	const parsed = Date.parse(trimmed);
+	if (Number.isNaN(parsed)) return void 0;
+	if (parsed <= nowMs) return void 0;
+	return parsed;
+}
+/**
+* The upstream's reset sentence, as Qoder's gateways write it in Chinese —
+* e.g. `您的使用量已超出频率限制，将在 2026-09-30 02:30:30 UTC+8 重置，…`.
+* Loose around the wording, strict about the parts that must not be guessed:
+* the keyword 重置, the timestamp shape, and an explicit UTC offset.
+*/
+const UPSTREAM_RESET_PATTERN = /将在?\s*(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})\s*UTC\s*([+-])(\d{1,2})(?::?(\d{2}))?[\s\S]*?重置/u;
+/**
+* Parse the reset time out of an upstream failure message.
+*
+* The offset is honoured, not assumed: `Date.UTC` with the stated offset
+* subtracted, returned as epoch ms. A whole-second resolution is what the
+* upstream prints.
+*/
+function parseUpstreamResetAt(message) {
+	const match = UPSTREAM_RESET_PATTERN.exec(message);
+	if (match === null) return void 0;
+	const [, year, month, day, hour, minute, second, sign, offsetHours, offsetMinutes] = match;
+	const offsetTotalMinutes = (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes ?? "0"));
+	const utcMs = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour), Number(minute), Number(second));
+	const parsed = new Date(utcMs);
+	if (parsed.getUTCFullYear() !== Number(year) || parsed.getUTCMonth() !== Number(month) - 1 || parsed.getUTCDate() !== Number(day) || parsed.getUTCHours() !== Number(hour) || parsed.getUTCMinutes() !== Number(minute) || parsed.getUTCSeconds() !== Number(second)) return;
+	if (Math.abs(offsetTotalMinutes) > 840) return void 0;
+	return utcMs - offsetTotalMinutes * 6e4;
+}
+/**
+* The cooldown the upstream stated, if it stated one.
+*
+* Three sources, in order of authority: `Retry-After` on the failure response;
+* the reset time written into the failure body (the case that actually fires —
+* a 429 carries `将在 … 重置`, no header); and the region's quota refresh point
+* ONLY for an out-of-credit outcome. None of these → `{}`, which the card
+* renders as "the upstream did not say when".
+*/
+function cooldownOf(input) {
+	const fromHeader = parseRetryAfter(input.retryAfter, input.nowMs);
+	if (fromHeader !== void 0) return {
+		retryAtMs: fromHeader,
+		retrySource: "retry-after"
+	};
+	const fromBody = input.body === void 0 ? void 0 : parseUpstreamResetAt(input.body);
+	if (fromBody !== void 0) return {
+		retryAtMs: fromBody,
+		retrySource: "upstream-message"
+	};
+	if (input.outcome === "out-of-credit" && input.quotaRefreshAtMs !== void 0) return {
+		retryAtMs: input.quotaRefreshAtMs,
+		retrySource: "quota-refresh"
+	};
+	return {};
+}
+/**
+* Classify one failed probe into the card's outcome vocabulary, from the
+* upstream error kind rather than raw status codes, so a probe and a real chat
+* request never disagree about the same answer.
+*/
+function outcomeOfFailure(error) {
+	switch (error.kind) {
+		case "auth": return { outcome: "credential-rejected" };
+		case "rate-limited": return { outcome: "rate-limited" };
+		case "quota-exhausted": return { outcome: "out-of-credit" };
+		case "content-policy": return { outcome: "policy-rejected" };
+		case "invalid-request": return error.status === 400 && /model/i.test(error.message) ? { outcome: "not-found" } : { outcome: "failed" };
+		case "not-found-model": return { outcome: "not-found" };
+		case "network":
+		case "transient": return { outcome: "unavailable" };
+		case "unknown": return error.status === 0 || error.status >= 500 ? { outcome: "unavailable" } : { outcome: "failed" };
+	}
+}
+/** Max characters of upstream text kept for display, after redaction. */
+const PROBE_MESSAGE_LIMIT = 300;
+/**
+* Redact token-shaped content out of upstream text before it is stored or sent.
+*
+* Lives here because this module is the one that reads raw failure bodies, so
+* the redaction belongs at the point of capture. Also used by the pool's
+* `recordAccountFailure` path so the two writers cannot drift apart.
+*/
+function redactUpstreamText(text) {
+	return text.replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^\s&,]+/giu, "$1[redacted]").replace(/\bpt-[A-Za-z0-9_-]{6,}\b/giu, "[redacted credential]").slice(0, PROBE_MESSAGE_LIMIT);
+}
+/**
+* Run one probe for one model and reduce it to a result row.
+*
+* Never throws: a probe is a diagnostic the user asked for, so every failure is
+* a RESULT — one dead model must not abort a batch and hide the other rows.
+*/
+async function probeModel(input) {
+	const startedAt = Date.now();
+	let answer;
+	try {
+		answer = await input.client.probeChat(input.credential, input.modelKey, {
+			...input.inputTokens === void 0 ? {} : { inputTokens: input.inputTokens },
+			...input.signal === void 0 ? {} : { signal: input.signal }
+		});
+	} catch (error) {
+		return {
+			modelId: input.modelKey,
+			outcome: "unavailable",
+			message: redactUpstreamText(error instanceof Error ? error.message : String(error))
+		};
+	}
+	const elapsedMs = Date.now() - startedAt;
+	if (answer.ok) return {
+		modelId: input.modelKey,
+		outcome: "ok",
+		elapsedMs,
+		status: answer.status,
+		...cooldownOf({
+			outcome: "ok",
+			retryAfter: answer.retryAfter,
+			nowMs: input.nowMs,
+			...input.quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs: input.quotaRefreshAtMs }
+		})
+	};
+	const error = answer.error;
+	if (error === void 0) return {
+		modelId: input.modelKey,
+		outcome: "failed",
+		elapsedMs,
+		status: answer.status
+	};
+	const { outcome } = outcomeOfFailure(error);
+	const body = answer.body ?? "";
+	return {
+		modelId: input.modelKey,
+		outcome,
+		elapsedMs,
+		status: answer.status,
+		...body === "" ? {} : { message: redactUpstreamText(body) },
+		...cooldownOf({
+			outcome,
+			retryAfter: answer.retryAfter,
+			nowMs: input.nowMs,
+			body,
+			...input.quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs: input.quotaRefreshAtMs }
+		})
+	};
+}
+/**
+* Whether one account can be billed at `nowMs`.
+*
+* Returns the exclusion reason, or undefined when the account is a candidate.
+* The order matters and is NOT arbitrary:
+*
+* - A `credential-rejected` / `not-found` account is excluded regardless of any
+*   cooldown: the token is refused / the model is gone, so waiting cannot help
+*   and the user must act.
+* - A limited, unreachable or failed outcome is checked against its stated (or
+*   fallback) cooldown, so an account whose limit has already reset — or whose
+*   gateway blipped once — is back in the pool without another test first.
+* - An `ok` measurement, and no measurement at all, are both candidates.
+*
+* WHY TRANSIENT OUTCOMES GET A COOLDOWN: a transport failure (DNS blip, a 5xx,
+* a cancelled request) says nothing about the ACCOUNT, so excluding it
+* permanently would idle a good account and drain the pool of candidates. The
+* cooldown is what makes the pool RECOVER instead of staying broken.
+*/
+function exclusionOf(probe, nowMs) {
+	if (probe === void 0) return void 0;
+	switch (probe.outcome) {
+		case "ok": return;
+		case "credential-rejected": return "credential-rejected";
+		case "not-found": return "not-found";
+		case "unavailable": return retryDue(probe, nowMs) ? void 0 : "unavailable";
+		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
+		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
+		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
+		case "policy-rejected": return;
+		default: return "unusable";
+	}
+}
+/** Whether an account's cooldown has elapsed (or was never stated). */
+function retryDue(probe, nowMs) {
+	return nowMs >= (probe.retryAtMs ?? probe.atMs + 18e5);
+}
+/**
+* Rank a pool's members best-first.
+*
+* The rule, in priority order — this is the whole feature:
+*
+* 1. **Usability.** Only accounts that can be billed right now are candidates.
+* 2. **Credits, highest first.** Spend the account that has the most.
+* 3. **Credits expiring soonest first.** Points about to expire are worth zero
+*    after they do.
+* 4. **Account id.** Final tie-break, making the order TOTAL.
+*
+* Excluded accounts are still RETURNED (sorted after the candidates) so the
+* card can explain why each is out.
+*
+* Pure and total: the same input always yields the same order, and it never
+* throws on missing data (an account with no credits is ranked as 0).
+*/
+function rankPool(members, nowMs) {
+	const rows = members.map((member) => {
+		const excludedBy = exclusionOf(member.probe, nowMs);
+		return {
+			account: member.account,
+			score: scoreOf(member),
+			...excludedBy === void 0 ? {} : { excludedBy },
+			_usable: excludedBy === void 0,
+			_expiring: member.credits?.nearestExpiryMs ?? Number.POSITIVE_INFINITY
+		};
+	});
+	rows.sort((left, right) => {
+		if (left._usable !== right._usable) return left._usable ? -1 : 1;
+		if (left.score !== right.score) return right.score - left.score;
+		if (left._expiring !== right._expiring) return left._expiring - right._expiring;
+		return left.account.id < right.account.id ? -1 : left.account.id > right.account.id ? 1 : 0;
+	});
+	return rows.map(({ account, score, excludedBy }) => ({
+		account,
+		score,
+		...excludedBy === void 0 ? {} : { excludedBy }
+	}));
+}
+/** The credit figure used for ordering. Absent credits rank as zero. */
+function scoreOf(member) {
+	return member.credits?.total ?? 0;
+}
+/**
+* Resolve the model the pool should test against.
+*
+* A user-specified id always wins (it is a preference, not a computed default),
+* and is returned even when it is a PAID model: the card says so explicitly.
+* The choice is VALIDATED against the region's catalog: a saved id no longer
+* offered is reported as `stale` — never silently replaced by the free model —
+* and a catalog that has not loaded yet reads as `stale` too (the safe
+* direction: no credits are spent while the roster is unknown).
+*/
+function resolveTargetModel(catalog, preferredId) {
+	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
+		modelId: preferredId,
+		source: "preferred"
+	} : {
+		staleModelId: preferredId,
+		source: "stale"
+	};
+	const free = pickFreeModel(catalog);
+	return free === void 0 ? { source: "none" } : {
+		modelId: free.id,
+		source: "free"
+	};
+}
+/**
+* Pick the free model to test against, from one region's projected catalog.
+*
+* "Free" means `creditMultiplier === 0` EXACTLY. An absent multiplier is NOT
+* free — the Host only folds `is_free` to 0 when it positively knows the model
+* is free, so an absent multiplier stays a non-free (unknown) model rather than
+* silently billing real credits on a probe. Among the free candidates the
+* LARGEST context window wins, because the probe sends a real-sized payload.
+*
+* Returns undefined when there is no free model, which the caller must render
+* as "none available" — never as a fallback to a paid model.
+*/
+function pickFreeModel(catalog) {
+	let best;
+	for (const model of catalog) {
+		if (model.creditMultiplier !== 0) continue;
+		if (best === void 0 || model.contextWindow > best.contextWindow) best = model;
+	}
+	return best;
+}
+//#endregion
+//#region src/web-status.ts
+function json(res, status, body) {
+	if (res.writableEnded || res.destroyed) return;
+	const text = JSON.stringify(body);
+	res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+	res.end(text);
+}
+function safeMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function loopbackOrigin(req) {
+	const origin = req.headers.origin;
+	if (origin === void 0) return true;
+	return /^http:\/\/127\.0\.0\.1:\d+$/.test(origin) || /^http:\/\/localhost:\d+$/.test(origin);
+}
+async function readBody(req) {
+	return new Promise((resolve, reject) => {
+		let total = 0;
+		const chunks = [];
+		req.on("data", (chunk) => {
+			total += chunk.length;
+			if (total > 1048576) {
+				reject(/* @__PURE__ */ new Error("request body too large"));
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+		req.on("error", reject);
+	});
+}
+/** Narrow the region on a route URL; 400 when absent/unknown. */
+function requiredRegion(res, url) {
+	const region = regionOfStatusUrl(url);
+	if (region === void 0) {
+		json(res, 400, { error: "unknown region" });
+		return;
+	}
+	return region;
+}
+/** Project one model into the card's web row. */
+function webModelOf(m) {
+	return {
+		key: m.key,
+		name: m.displayName,
+		contextWindow: m.contextWindow,
+		nativeContextWindow: m.contextWindow,
+		maxTokens: m.maxOutputTokens,
+		creditMultiplier: m.priceFactor,
+		...m.supportsImages === true ? { supportsImages: true } : {},
+		supportsThinking: m.supportsThinking,
+		...m.canDisableThinking === true ? { canDisableThinking: true } : {},
+		...m.thinkingEfforts === void 0 ? {} : { thinkingEfforts: m.thinkingEfforts },
+		...m.defaultThinkingEffort === void 0 ? {} : { defaultThinkingEffort: m.defaultThinkingEffort },
+		...m.isDefault === true ? { isDefault: true } : {},
+		...m.isFree === true ? { isFree: true } : {},
+		...m.isNew === true ? { isNew: true } : {},
+		...m.contextTiers === void 0 ? {} : { contextTiers: m.contextTiers }
+	};
+}
+/** Redact upstream failure text for safe display/storage. */
+function redactQoderText(text) {
+	return text.replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/\b(pt-|eyJ)[A-Za-z0-9_\-]{6,}\b/giu, "[redacted credential]").slice(0, 300);
+}
+/** Project one model into the pool's target picker shape. */
+function poolModelOf(m) {
+	return {
+		id: m.key,
+		name: m.displayName,
+		creditMultiplier: m.isFree === true ? 0 : m.priceFactor,
+		contextWindow: m.contextWindow
+	};
+}
+/**
+* Mount the web routes for dsh-connect-qoder. Returns the status builder so
+* the Host can also answer from a cache (the route itself re-derives it).
+*/
+function registerQoderWebRoutes(ctx, deps) {
+	const disposers = [];
+	const regionOf = requiredRegion;
+	const mount = (path, handler) => {
+		try {
+			const dispose = ctx.webServer.register({
+				kind: "exact",
+				path,
+				handler
+			});
+			if (typeof dispose === "function") disposers.push(dispose);
+		} catch {}
+	};
+	mount(QODER_USAGE_PATH, async (req, res) => {
+		if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+		const region = regionOfStatusUrl(req.url ?? "");
+		if (region === void 0) return json(res, 400, { error: "unknown region" });
+		return json(res, 200, await buildWebUsage(deps, region));
+	});
+	mount(QODER_ACCOUNT_CREDITS_PATH, async (req, res) => {
+		if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		if (deps.accountCredits === void 0) return json(res, 503, {
+			reason: "credits-unavailable",
+			error: "account credits unavailable"
+		});
+		try {
+			return json(res, 200, await deps.accountCredits(region));
+		} catch (error) {
+			return json(res, 502, { error: safeMessage(error) });
+		}
+	});
+	mount(QODER_MODELS_REFRESH_PATH, async (req, res) => {
+		if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		const refresh = deps.refreshModels ?? deps.discoverModels;
+		if (refresh === void 0) return json(res, 503, {
+			reason: "refresh-unavailable",
+			error: "model discovery unavailable"
+		});
+		try {
+			return json(res, 200, { models: (await refresh(region)).map(webModelOf) });
+		} catch (error) {
+			return json(res, 502, { error: safeMessage(error) });
+		}
+	});
+	mount(QODER_ACCOUNTS_REFRESH_PATH, async (req, res) => {
+		if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		return json(res, 200, (await deps.store(region).accounts(deps.credentialSources(region))).map(webAccountOf(deps, region)));
+	});
+	mount(QODER_ACCOUNTS_PATH, async (req, res) => {
+		if (!loopbackOrigin(req)) return json(res, 403, { error: "forbidden" });
+		if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		const action = accountActionOf(req.url ?? "");
+		if (action === void 0) return json(res, 400, { error: "action is required (add|remove)" });
+		const body = await readBody(req);
+		let parsed;
+		try {
+			parsed = JSON.parse(body || "{}");
+		} catch {
+			return json(res, 400, { error: "invalid JSON body" });
+		}
+		if (action === "add") {
+			const pat = typeof parsed.pat === "string" ? parsed.pat.trim() : "";
+			if (pat === "") return json(res, 400, { error: "pat is required" });
+			const preferred = typeof parsed.name === "string" ? parsed.name.trim() : "";
+			if (deps.accountValidation === void 0) return json(res, 503, {
+				reason: "validation-unavailable",
+				error: "account validation unavailable"
+			});
+			try {
+				const { name } = await deps.accountValidation.validateForRegion(region, pat);
+				const displayName = preferred !== "" ? preferred : name;
+				const stored = await deps.store(region).add(pat, displayName);
+				if (displayName !== stored.accountName) await deps.store(region).rename(stored.id, displayName);
+				return json(res, 200, {
+					accountId: stored.id,
+					accountName: displayName
+				});
+			} catch (error) {
+				return json(res, 502, { error: safeMessage(error) });
+			}
+		}
+		const accountId = typeof parsed.accountId === "string" ? parsed.accountId : "";
+		if (accountId === "") return json(res, 400, { error: "accountId is required" });
+		return json(res, 200, { removed: await deps.store(region).remove(accountId) });
+	});
+	mount(QODER_PROBE_PATH, async (req, res) => {
+		if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		const model = new URL(req.url ?? "", "http://127.0.0.1").searchParams.get("model") ?? "";
+		if (model === "") return json(res, 400, { error: "model is required" });
+		if (deps.probeModel === void 0) return json(res, 503, {
+			reason: "probe-unavailable",
+			error: "probe unavailable"
+		});
+		try {
+			return json(res, 200, await deps.probeModel(region, model));
+		} catch (error) {
+			return json(res, 502, { error: safeMessage(error) });
+		}
+	});
+	mount(QODER_POOL_PATH, async (req, res) => {
+		if (!loopbackOrigin(req)) return json(res, 403, { error: "forbidden" });
+		if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		const action = poolActionOf(req.url ?? "");
+		if (action === void 0) return json(res, 400, { error: "action is required (checkin|test|remove)" });
+		if (deps.pool === void 0) return json(res, 503, {
+			reason: "pool-unavailable",
+			error: "pool unavailable"
+		});
+		const pool = deps.pool;
+		if (action === "checkin") {
+			if (pool.checkinSupported(region) !== true) return json(res, 409, {
+				reason: "checkin-unsupported",
+				error: "this region does not offer a daily check-in"
+			});
+			if (pool.checkin === void 0) return json(res, 503, {
+				reason: "pool-unavailable",
+				error: "pool check-in unavailable"
+			});
+			return json(res, 200, {
+				action: "checkin",
+				rows: await pool.checkin(region)
+			});
+		}
+		if (action === "test") {
+			const target = resolveTargetModel(pool.catalog(region).map(poolModelOf), pool.preferences(region).targetModelId);
+			if (target.modelId === void 0) return json(res, 200, {
+				action: "test",
+				rows: [],
+				modelId: void 0
+			});
+			const rows = await pool.test(region, target.modelId);
+			return json(res, 200, {
+				action: "test",
+				modelId: target.modelId,
+				rows
+			});
+		}
+		const accountId = poolAccountIdOf(req.url ?? "");
+		if (accountId === void 0) return json(res, 400, { error: "accountId is required" });
+		if (!isQoderAccountId(accountId)) return json(res, 400, { error: "accountId is not a well-formed account id" });
+		const store = deps.store(region);
+		if ((await store.vaultAccounts()).find((entry) => entry.id === accountId) === void 0) return json(res, 409, {
+			reason: "account-not-deletable",
+			error: "only accounts added by this plugin can be deleted"
+		});
+		const removed = await store.remove(accountId);
+		if (deps.selectedAccountId(region) === accountId) await deps.clearSelection?.(region);
+		const prefs = pool.preferences(region);
+		if (prefs.memberAccountIds.includes(accountId)) pool.updateMembership(region, prefs.memberAccountIds.filter((id) => id !== accountId), prefs.enabled);
+		return json(res, 200, { removed });
+	});
+	mount(QODER_TRANSFER_PATH, async (req, res) => {
+		if (!loopbackOrigin(req)) return json(res, 403, { error: "forbidden" });
+		if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+		const region = regionOf(res, req.url ?? "");
+		if (region === void 0) return;
+		const action = transferActionOf(req.url ?? "");
+		if (action === void 0) return json(res, 400, { error: "action is required (export|preview|import)" });
+		if (deps.transfer === void 0) return json(res, 503, {
+			reason: "transfer-unavailable",
+			error: "transfer unavailable"
+		});
+		const transfer = deps.transfer;
+		const body = await readBody(req);
+		let parsed = {};
+		try {
+			parsed = JSON.parse(body || "{}");
+		} catch {
+			return json(res, 400, { error: "invalid JSON body" });
+		}
+		if (action === "export") return json(res, 200, await transfer.exportAccounts(region));
+		if (action === "preview") {
+			const text = typeof parsed.text === "string" ? parsed.text : "";
+			return json(res, 200, await transfer.previewImport(region, text));
+		}
+		const text = typeof parsed.text === "string" ? parsed.text : "";
+		const indexes = Array.isArray(parsed.indexes) ? parsed.indexes.filter((i) => typeof i === "number" && Number.isFinite(i)) : [];
+		return json(res, 200, await transfer.importAccounts(region, text, indexes));
+	});
+	mount(QODER_SAVE_PATH, async (req, res) => {
+		if (!loopbackOrigin(req)) return json(res, 403, { error: "forbidden" });
+		if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+		const bodyText = await readBody(req);
+		let body;
+		try {
+			body = JSON.parse(bodyText);
+		} catch {
+			return json(res, 400, { error: "invalid JSON body" });
+		}
+		const field = body.field;
+		if (typeof field !== "string" || field === "") return json(res, 400, { error: "field is required" });
+		try {
+			await deps.settings.set(field, mergeSlotWise(field, deps.settings.describe(), body.value));
+			return json(res, 200, { ok: true });
+		} catch (error) {
+			return json(res, 500, { error: safeMessage(error) });
+		}
+	});
+	const mounted = { status: (region) => buildWebUsage(deps, region) };
+	ctx.effect(() => () => {
+		for (const dispose of disposers) try {
+			dispose();
+		} catch {}
+	});
+	return mounted;
+}
+/** Project one account entry to its web shape with the selection flag. */
+function webAccountOf(deps, region) {
+	return (account) => ({
+		id: account.id,
+		accountName: account.accountName,
+		source: account.source,
+		selected: account.id === deps.selectedAccountId(region) || account.source !== "vault" && deps.selectedAccountId(region) === void 0
+	});
+}
+/**
+* 按区域槽位合并一次 settings 写入。
+*
+* 客户端只带它要写的那一个区域（`{ [region]: value }`）——它没有另一侧的当前
+* 状态，无法自己做合并；而宿主有 `describe()`，所以合并必须发生在这里。
+*
+* 规则：
+*   - `regions.<region>` 是**槽位级**的：请求里出现的槽位整份替换（槽位内部的
+*     字段级合并已经在客户端完成——`nextRegionModels` 从现槽位起 merge），未出现
+*     的槽位**原样保留**；
+*   - 若宿主当前没有这个槽位，则整份采用请求值。
+*
+* 这条规则是必须的，不是优化：缺了它，保存任一区域都会静默删除另一区域的全部
+* 配置（用户实拍「保存模型保存不了」）。
+*/
+function mergeSlotWise(field, described, incoming) {
+	if (field !== "regions") return incoming;
+	if (!isRecord(incoming)) return incoming;
+	const current = described.find((entry) => entry.value !== void 0)?.value;
+	const currentRegions = isRecord(current) && isRecord(current["regions"]) ? current["regions"] : void 0;
+	if (currentRegions === void 0) return incoming;
+	const merged = { ...currentRegions };
+	for (const [region, value] of Object.entries(incoming)) merged[region] = isRecord(value) && isRecord(currentRegions[region]) ? {
+		...currentRegions[region],
+		...value
+	} : value;
+	return {
+		...isRecord(current) ? current : {},
+		regions: merged
+	};
+}
+/** Whether a value is a plain (non-array, non-null) object. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Build one region's main usage document. */
+async function buildWebUsage(deps, region) {
+	const sources = deps.credentialSources(region);
+	const store = deps.store(region);
+	const accounts = await store.accounts(sources);
+	const selectedId = deps.selectedAccountId(region);
+	let serving = await store.resolve(sources, selectedId);
+	if (serving === void 0) {
+		const selectionExplicit = selectedId !== void 0 && selectedId !== "";
+		const selectionLost = selectionExplicit && accounts.length > 0;
+		deps.regionUsable?.(region, false);
+		const pool = deps.pool === void 0 ? void 0 : await buildPoolView(deps, region, accounts, deps.catalogs[region].current(), void 0);
+		return {
+			status: "signed-out",
+			accounts: accounts.map(webAccountOf(deps, region)),
+			enabled: deps.regionEnabled(region),
+			showCreditsInMainUi: deps.regionCreditsShown(region),
+			message: selectionLost ? "所选账号已不存在，请重新选择或填写 PAT" : "请填写 Qoder PAT（或设置环境变量）",
+			selectionLost,
+			selectionExplicit,
+			...pool === void 0 ? {} : { pool }
+		};
+	}
+	deps.regionUsable?.(region, true);
+	const catalog = deps.catalogs[region].current();
+	const enabledKeys = new Set(deps.enabledModelKeys(region));
+	const budgets = deps.contextBudgets(region);
+	const models = catalog.map((model) => {
+		const budget = budgets[model.key];
+		const effectiveWindow = budget !== void 0 && model.contextTiers?.includes(budget) ? {
+			contextWindow: budget,
+			nativeContextWindow: model.contextWindow
+		} : {
+			contextWindow: model.contextWindow,
+			nativeContextWindow: model.contextWindow
+		};
+		return {
+			...webModelOf(model),
+			...effectiveWindow
+		};
+	});
+	const usageEntry = deps.usage(region);
+	const offKeysRaw = deps.offModelKeys(region);
+	const offModelKeys = catalog.filter((m) => offKeysRaw.includes(m.key) || !m.supportsThinking).map((m) => m.key);
+	const credentialRejected = usageEntry?.error === "credential-rejected";
+	let recovery;
+	if (credentialRejected) recovery = deps.credentialRecovery === void 0 ? { reloginRequired: accounts.length <= 1 } : await deps.credentialRecovery(region, serving.id);
+	let pool;
+	if (deps.pool !== void 0) pool = await buildPoolView(deps, region, accounts, catalog, serving.id);
+	return {
+		status: "signed-in",
+		accountId: serving.id,
+		accountName: serving.accountName,
+		region,
+		enabled: deps.regionEnabled(region),
+		showCreditsInMainUi: deps.regionCreditsShown(region),
+		source: serving.source,
+		selectionExplicit: selectedId !== void 0 && selectedId !== "",
+		accounts: accounts.map(webAccountOf(deps, region)),
+		models,
+		enabledModelKeys: models.filter((m) => enabledKeys.has(m.key)).map((m) => m.key),
+		offModelKeys,
+		imageModelKeys: deps.imageModelKeys(region).filter((key) => catalog.some((m) => m.key === key)),
+		...usageEntry?.usage?.credits === void 0 ? {} : { credits: usageEntry.usage.credits },
+		...usageEntry?.error !== void 0 ? { creditsError: redactQoderText(usageEntry.error) } : {},
+		...credentialRejected && recovery ? {
+			credentialRejected: true,
+			recovery
+		} : {},
+		contextBudgets: budgets,
+		thinkingEfforts: deps.thinkingEfforts(region),
+		...pool === void 0 ? {} : { pool }
+	};
+}
+/** Build the pool's web view, including per-account rows tied to the probes. */
+async function buildPoolView(deps, region, accounts, catalog, servingAccountId) {
+	const pool = deps.pool;
+	const prefs = pool.preferences(region);
+	const probes = pool.poolProbes(region);
+	const now = Date.now();
+	const memberSet = new Set(prefs.memberAccountIds);
+	prefs.targetModelId;
+	const targetModels = catalog.map((m) => ({
+		id: m.key,
+		name: m.displayName,
+		creditMultiplier: m.isFree === true ? 0 : m.priceFactor,
+		contextWindow: m.contextWindow
+	}));
+	const target = resolveTargetModel(targetModels, prefs.targetModelId);
+	const checkinSupported = pool.checkinSupported(region);
+	const checkinSnapshot = pool.checkinSnapshot?.(region) ?? {};
+	const checkinLegacy = pool.checkinState?.(region) ?? {};
+	const effectiveIds = [];
+	const rows = [];
+	const memberCredits = await pool.memberCredits?.(region, prefs.memberAccountIds).catch(() => void 0);
+	for (const account of accounts) {
+		const member = memberSet.has(account.id);
+		const probe = probes[account.id];
+		const excludedBy = exclusionOf(probe, now);
+		const isCurrent = servingAccountId !== void 0 && account.id === servingAccountId;
+		if (member) {
+			if (await pool.credentialFor(region, account.id) !== void 0) effectiveIds.push(account.id);
+		}
+		const reading = member === true ? memberCredits?.get(account.id) : void 0;
+		rows.push({
+			accountId: account.id,
+			accountName: account.accountName,
+			source: account.source,
+			...reading === void 0 ? {} : {
+				credits: reading.total,
+				expiringSoon: reading.expiringSoon,
+				...reading.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: reading.nearestExpiryMs }
+			},
+			...probe === void 0 ? {} : { probe: {
+				outcome: probe.outcome,
+				atMs: probe.atMs,
+				...probe.source === void 0 ? {} : { source: probe.source },
+				...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
+				...probe.message === void 0 ? {} : { message: probe.message }
+			} },
+			...excludedBy === void 0 ? {} : { excludedBy },
+			...checkinSupported && checkinSnapshot[account.id] !== void 0 ? {
+				checkedInToday: checkinSnapshot[account.id].claimed,
+				...checkinSnapshot[account.id].refreshAtMs === void 0 ? {} : { checkinRefreshAtMs: checkinSnapshot[account.id].refreshAtMs }
+			} : checkinSupported && checkinLegacy[account.id] !== void 0 ? { checkedInToday: checkinLegacy[account.id] === true } : {},
+			current: isCurrent,
+			member
+		});
+	}
+	return {
+		enabled: prefs.enabled,
+		checkinSupported: pool.checkinSupported(region),
+		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
+		...target.source === "stale" && target.staleModelId !== void 0 ? { staleTargetModelId: target.staleModelId } : {},
+		targetModelSource: target.source,
+		memberAccountIds: prefs.memberAccountIds,
+		...prefs.probeInputTokens && prefs.probeInputTokens > 0 ? { probeInputTokens: prefs.probeInputTokens } : {},
+		effectiveMemberAccountIds: effectiveIds,
+		accounts: rows,
+		catalog: targetModels
+	};
+}
+/**
+* Test every account against one model, one at a time.
+*
+* The model is resolved by the caller (see `resolveTargetModel`) so this
+* function never has to decide "free or not". Never throws: a failed probe is
+* a ROW, not an aborted batch.
+*
+* `onRow` fires the moment one account's row exists, so a caller can report
+* progress instead of waiting for the SLOWEST member.
+*/
+async function testAllAccounts(targets, modelId, deps, onRow) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		const row = await testOne(target, modelId, deps);
+		rows.push(row);
+		onRow?.(row);
+	}
+	return rows;
+}
+/** One account's probe, reduced to its row. */
+async function testOne(target, modelId, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			result: {
+				modelId,
+				outcome: "credential-rejected",
+				message: messageOf(error)
+			}
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		result: {
+			modelId,
+			outcome: "credential-rejected",
+			message: "no stored credential for this account"
+		}
+	};
+	return {
+		...base,
+		result: await deps.probe(credential, modelId)
+	};
+}
+/** The default inter-account pause. */
+function defaultWait(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** A safe message from an unknown throwable, bounded in length. */
+function messageOf(error) {
+	return (error instanceof Error ? error.message : String(error)).slice(0, 300);
+}
+//#endregion
+//#region src/index.ts
+const name = "dsh-connect-qoder";
+/** The model registry and settings service required before providers register. */
+const inject = ["llm", "settings"];
+/** The namespace the HOST actually serves this plugin under (workbuddy probe). */
+function settingsNamespaceOf(ctx) {
+	const id = ctx?.fiber?.entry?.options?.id;
+	return typeof id === "string" && id !== "" ? id : QODER_SETTINGS_NS;
+}
+function asVolatile(schema) {
+	if (typeof schema.volatile === "function") return schema.volatile();
+	return schema;
+}
+/** Unwrap a schemastery volatile's reactive `.get()` into a plain snapshot. */
+function unwrapVolatile(value) {
+	if (value !== null && typeof value === "object" && "get" in value && typeof value.get === "function") return value.get();
+	return value;
+}
+const modelConfig = z.object({
+	key: z.string(),
+	displayName: z.string(),
+	priceFactor: z.number(),
+	contextWindow: z.number(),
+	maxOutputTokens: z.number(),
+	supportsImages: z.boolean(),
+	supportsThinking: z.boolean(),
+	canDisableThinking: z.boolean(),
+	isDefault: z.boolean(),
+	isFree: z.boolean(),
+	isNew: z.boolean(),
+	/**
+	* 该模型声明的思考强度档位（`['xhigh','low','medium']` 之类，已按强度升序）。
+	*
+	* 必须在这里声明，否则 zod 解析保存的 `lastCatalog` 时会**静默剥掉**它 ——
+	* 客户端明明写进了 payload，宿主读回来却没有，思考强度选择器于是整个不渲染
+	* （用户实拍「拉取的思考模式又不见了」）。`contextTiers` 同理：它在客户端被
+	* 写入，但同样没被声明，于是上下文预算选择器也会随之失效。
+	*/
+	thinkingEfforts: z.array(z.string()).required(false),
+	defaultThinkingEffort: z.string().required(false),
+	contextTiers: z.array(z.number()).required(false)
+});
+const poolConfig = z.object({
+	enabled: z.boolean().default(false),
+	targetModelId: z.string().default(""),
+	probeInputTokens: z.number().default(0),
+	memberAccountIds: z.array(z.string()).default([])
+});
+const regionConfig = z.object({
+	/** 本区域 PAT。留空读环境变量；env 与 vault 承接连带选择。 */
+	pat: z.string().default("").description("Qoder PAT（留空时读取环境变量）"),
+	/** 本区域 provider 是否启用；显式 false 才停用（opt-out）。 */
+	enabled: z.boolean().default(true),
+	/** 用户显式选择的账号 id（'' = 自动：settings → env → vault）。 */
+	accountId: z.string().default(""),
+	/** 是否在主界面展示积分（composer 面板）；opt-out。 */
+	showCreditsInMainUi: z.boolean().default(true),
+	/** 用户勾选的模型 key 集合。 */
+	enabledModelKeys: z.array(z.string()).default([]),
+	/**
+	* 用户**显式**开启图片输入的模型 key 集合。
+	*
+	* 图像能力只来自这里，绝不从上游的 `is_vl` 平台标记推断（见
+	* src/native-modality.ts：平台标记几乎对每个模型都是 true，含纯文本模型）。
+	* 与 lastCatalog 分开存储，使勾选状态不随目录重写而耦合丢失。
+	*/
+	imageModelKeys: z.array(z.string()).default([]),
+	/** 用户关闭的模型 key 集合（独立于硬性关闭）。 */
+	offModelKeys: z.array(z.string()).default([]),
+	/** 每个模型的显式上下文预算（必须是模型声明的 tier，否则用原生值）。 */
+	contextBudgets: z.dict(z.number()).default({}),
+	/**
+	* 每个模型保存的思考强度（档位名，如 `low` / `medium` / `xhigh`）。
+	*
+	* 「设置里选好、之后每个请求自动带上」——与 Qoder 客户端同形态（它的事件
+	* 名就叫 `reasoning-effort-changed`）。缺省表示用模型自己声明的默认档。
+	* 键是模型 key：不同模型的档位名不统一（Qwen 系 low/medium/xhigh，
+	* DeepSeek/GLM 系 low/high/max），所以必须逐模型存。
+	*/
+	thinkingEfforts: z.dict(z.string()).default({}),
+	/** 账号池偏好。 */
+	pool: poolConfig.default({
+		enabled: false,
+		targetModelId: "",
+		probeInputTokens: 0,
+		memberAccountIds: []
+	}),
+	/** 保存的模型目录（卡片“保存”时写入）。 */
+	lastCatalog: z.array(modelConfig).default([])
+});
+const Config = z.object({ regions: asVolatile(z.dict(regionConfig).default({}).description("Per-region Qoder settings, keyed cn | global")) });
+/**
+* 一份目录是否**声明了**思考档位。
+*
+* 「一个模型都没有档位」有两种完全不同的含义，必须分开：
+* 1. 上游当前没声明（`thinkingEfforts` 字段缺席或为空）—— 那它是「上游没
+*    档位」的诚实答案；
+* 2. 这份目录来自一次没拉到档位的时刻 —— 本机实测 14 个 cn 模型的
+*    `thinkingEfforts` 全是 `[]`，是旧 schema 把字段剥掉时的产物。用它当答案，
+*    卡片就不渲染档位选择器（用户实拍「思考强度有时候有、有时候没有」：点一次
+*    「从 Qoder 刷新」就有，重启后就没）。
+*
+* 两种情况从数据上分不开（空数组与缺席都判「没声明」），要不要重拉由**目录的
+* 来源**决定：调用方只在「本进程还没成功拉到实时目录」时才据此触发重拉（见
+* displayModels）—— 实时目录没档位是上游的诚实答案，重拉多少次都一样。
+*
+* 判据用 `length > 0` 而不是「字段在不在」：旧 schema 留下的是**空数组**而不是
+* 缺席，所以「字段在」恰恰不能作为「声明过」的证据。
+*/
+function catalogSnapshotDeclaresEfforts(models) {
+	return models.some((model) => (model.thinkingEfforts?.length ?? 0) > 0);
+}
+/**
+* 「手上的目录能不能当档位答案」——**判据与动作打包在一起**。
+*
+* 拆开成两个函数（判据一个、调用处自己判）会留下一条没被测试覆盖的接线：把调用处
+* 变异掉，单测仍然全绿（第一版就是这么自我欺骗的）。这里让规则自己执行动作并
+* 返回结论，于是「动作有没有真的发生」也能被断言。
+*
+* 检测到「一个档位都没声明」时**不改动要服务的模型列表**：模型不能从卡片上
+* 消失，缺的只是档位 —— 后台拉回来之后的下一次读取自然补上。返回 `stale`
+* 标记这次调用有没有触发过拉取。
+*/
+function serveSavedCatalog(models, onStale) {
+	if (catalogSnapshotDeclaresEfforts(models)) return {
+		models,
+		stale: false
+	};
+	onStale();
+	return {
+		models,
+		stale: true
+	};
+}
+/** 某区域的配置状态（缺省返回空对象）。 */
+function regionStateOf(config, region) {
+	const stored = unwrapVolatile(config.regions)?.[region];
+	if (stored !== void 0 && stored !== null && typeof stored === "object") return stored;
+	return {};
+}
+/** 某区域是否启用（opt-out）。 */
+function regionEnabled(config, region) {
+	return regionStateOf(config, region).enabled !== false;
+}
+/** 某区域是否在主界面显示积分（opt-out）。 */
+function regionCreditsShown(config, region) {
+	return regionStateOf(config, region).showCreditsInMainUi !== false;
+}
+/** 某区域是否配置了凭据（设置 PAT 或环境变量其一）。 */
+function regionHasCredential(config, region) {
+	const state = regionStateOf(config, region);
+	if ((typeof state.pat === "string" ? state.pat.trim() : "") !== "") return true;
+	return patFromEnv(region) !== void 0;
+}
+/** 某区域显式选择的账号 id（undefined = 自动）。 */
+function selectedAccountId(config, region) {
+	const id = regionStateOf(config, region).accountId;
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
+/** 某区域保存的 contextBudgets。 */
+function contextBudgetsOf(config, region) {
+	const raw = regionStateOf(config, region).contextBudgets;
+	if (raw === null || raw === void 0 || typeof raw !== "object") return {};
+	const out = {};
+	for (const [key, value] of Object.entries(raw)) if (typeof value === "number" && Number.isFinite(value)) out[key] = value;
+	return out;
+}
+/** 某区域保存的 offModelKeys。 */
+function offModelKeysOf(config, region) {
+	const state = regionStateOf(config, region);
+	return Array.isArray(state.offModelKeys) ? state.offModelKeys : [];
+}
+/** 某区域保存的逐模型思考强度（模型 key → 档位名）。 */
+function thinkingEffortsOf(config, region) {
+	const raw = regionStateOf(config, region).thinkingEfforts;
+	if (raw === null || raw === void 0 || typeof raw !== "object") return {};
+	const out = {};
+	for (const [key, value] of Object.entries(raw)) if (typeof value === "string" && value !== "") out[key] = value;
+	return out;
+}
+/** 某区域保存的 imageModelKeys（用户显式开启图片输入的模型）。 */
+function imageModelKeysOf(config, region) {
+	const state = regionStateOf(config, region);
+	return Array.isArray(state.imageModelKeys) ? state.imageModelKeys : [];
+}
+/**
+* 把用户的**显式**图片 opt-in 盖印到模型列表上——这是 `supportsImages`
+* 在运行时的**唯一**来源，上游的 `is_vl` 平台标记一律不采信。
+*
+* 与 workbuddy 的 `withImageSelection` 同构：所有运行时目录路径（启动种子、
+* 刷新、保存）都经过它，保证同一模型在三条路径上得到一致的图像能力答案。
+* 用户从未保存过（集合为空）时，用 `imageDefaultFor` 的厂商表结论作种子，
+* 使首次打开就能显示正确默认，而不必先保存一次。
+*/
+function withImageSelection(models, images, seeded) {
+	return models.map((model) => ({
+		...model,
+		supportsImages: images.has(model.key) ? true : seeded ? false : imageDefaultFor({
+			id: model.key,
+			...model.supportsImages === void 0 ? {} : { supportsImages: model.supportsImages }
+		})
+	}));
+}
+/**
+* 把用户保存的「可关闭思考」选择盖印到运行时目录上。
+*
+* 上游声明的 `canDisableThinking` 并不可全信（见 src/off-thinking.ts）。运行时
+* 适配器只读模型自报的该字段，所以必须在此之前把校正后的答案写上去。用户尚未
+* 保存过（选择为空）时用 `defaultOffModelIds` 作为种子——只对上游显式声明可关闭、
+* 且不在已知拒绝集里的模型提供 off。
+*/
+function stampOffSelection(config, region, models) {
+	const saved = new Set(offModelKeysOf(config, region));
+	return withEffectiveOff(models, saved.size > 0 ? saved : new Set(defaultOffModelIds(models.map(offCapabilityOf))));
+}
+/**
+* 把用户的两项显式选择（图片输入、可关闭思考）盖印到运行时目录上。
+*
+* 两者机制相同：上游声明不可全信，用户的选择是唯一权威；未保存过时用厂商表/
+* 内置规则作种子。合在一处便于所有运行时目录路径（启动、刷新、保存）一次盖齐，
+* 避免漏盖导致「某条路径上模型能力与另一条不一致」。
+*/
+function stampRuntimeCatalog(config, region, models) {
+	const images = new Set(imageModelKeysOf(config, region));
+	return stampOffSelection(config, region, withImageSelection(models, images, images.size > 0));
+}
+/** 某区域保存的 enabledModelKeys。 */
+function enabledModelKeysOf(config, region) {
+	const state = regionStateOf(config, region);
+	return Array.isArray(state.enabledModelKeys) ? state.enabledModelKeys : [];
+}
+/** 某区域保存的 pool 偏好。 */
+function poolPreferencesOf(config, region) {
+	const raw = regionStateOf(config, region).pool ?? {};
+	return {
+		enabled: raw.enabled === true,
+		targetModelId: typeof raw.targetModelId === "string" ? raw.targetModelId : "",
+		probeInputTokens: typeof raw.probeInputTokens === "number" ? raw.probeInputTokens : 0,
+		memberAccountIds: Array.isArray(raw.memberAccountIds) ? raw.memberAccountIds : []
+	};
+}
+/** 把保存的目录条目解析为模型信息（历史兼容）。 */
+function modelFromStored(raw) {
+	if (typeof raw.key !== "string" || typeof raw.displayName !== "string") return void 0;
+	return {
+		key: raw.key,
+		displayName: raw.displayName,
+		priceFactor: typeof raw.priceFactor === "number" ? raw.priceFactor : 1,
+		contextWindow: typeof raw.contextWindow === "number" ? raw.contextWindow : 2e5,
+		maxOutputTokens: typeof raw.maxOutputTokens === "number" ? raw.maxOutputTokens : 32768,
+		supportsImages: raw.supportsImages === true,
+		supportsThinking: raw.supportsThinking === true,
+		canDisableThinking: raw.canDisableThinking === true,
+		isDefault: raw.isDefault === true,
+		isFree: raw.isFree === true,
+		isNew: raw.isNew === true,
+		...Array.isArray(raw.contextTiers) ? { contextTiers: raw.contextTiers.filter((v) => typeof v === "number") } : {},
+		...Array.isArray(raw.thinkingEfforts) && raw.thinkingEfforts.length > 0 ? { thinkingEfforts: raw.thinkingEfforts.filter((v) => typeof v === "string") } : {},
+		...typeof raw.defaultThinkingEffort === "string" && raw.defaultThinkingEffort !== "" ? { defaultThinkingEffort: raw.defaultThinkingEffort } : {}
+	};
+}
+/** 某区域当前应展示的目录（保存 → 运行期 → fallback）。 */
+function configuredModels(config, region, live) {
+	const saved = regionStateOf(config, region).lastCatalog;
+	if (Array.isArray(saved) && saved.length > 0) {
+		const parsed = saved.map((item) => modelFromStored(item ?? {})).filter((m) => m !== void 0);
+		if (parsed.length > 0) return parsed;
+	}
+	return live.length > 0 ? live : QODER_FALLBACK_MODELS.map(fallbackModelInfo);
+}
+/** 把一次用量解析成卡片可渲染的积分包。 */
+function creditsOf(usage) {
+	const packages = [];
+	let total = 0;
+	let expiringSoon = 0;
+	let nearestExpiryMs;
+	const SOON_MS = 2592e5;
+	const add = (packageName, remaining, size, expiresAtMs) => {
+		if (size <= 0) return;
+		total += remaining;
+		if (expiresAtMs !== void 0 && remaining > 0) {
+			nearestExpiryMs = nearestExpiryMs === void 0 ? expiresAtMs : Math.min(nearestExpiryMs, expiresAtMs);
+			if (expiresAtMs - Date.now() < SOON_MS) expiringSoon += 1;
+		}
+		packages.push({
+			packageName,
+			remain: remaining,
+			size,
+			monthly: false,
+			...expiresAtMs === void 0 ? {} : { expiresAtMs }
+		});
+	};
+	const userQuota = usage.userQuota;
+	if (userQuota !== void 0 && typeof userQuota.total === "number") add("base", Math.max(userQuota.total - (userQuota.used ?? 0), 0), userQuota.total);
+	const addOnQuota = usage.addOnQuota;
+	if (addOnQuota !== void 0 && typeof addOnQuota.total === "number") add("addon", Math.max(addOnQuota.total - (addOnQuota.used ?? 0), 0), addOnQuota.total, usage.expiresAt);
+	const org = usage.orgResourcePackage;
+	if (org !== void 0 && typeof org.cap === "number") add("org", Math.max(org.cap - (org.used ?? 0), 0), org.cap);
+	return {
+		total,
+		packages,
+		expiringSoon,
+		...nearestExpiryMs === void 0 ? {} : { nearestExpiryMs }
+	};
+}
+function apply(ctx, config) {
+	const settingsNs = settingsNamespaceOf(ctx);
+	const log = (message) => ctx.logger.warn(`dsh-connect-qoder: ${message}`);
+	let stopped = false;
+	const stacks = {};
+	const usageCache = {};
+	const registration = {
+		cn: {},
+		global: {}
+	};
+	/**
+	* 今日签到状态快照（区域 → 成员 id → 是否已领）。签到批次回写、成员表读取。
+	* 进程内即可：它描述的是「今天」，重启后由下一次签到重新写入。
+	*/
+	const checkinState = {
+		cn: {},
+		global: {}
+	};
+	/**
+	* 每区域的签到快照：每个成员「是否已领」+「下一窗何时刷新」（epoch 毫秒，
+	* 来自上游活动行的 `endAt`）。
+	*
+	* 为什么不能只留 `checkinState` 那个布尔表：「已领取」这句话离开「还有多久
+	* 刷新」是不完整的 —— 领取不是「今天到此为止」，只是这一窗从 `CLAIMABLE`
+	* 变成 `CLAIMED`，下一窗什么时候开上游早就写在 `endAt` 里了（实测活动窗是
+	* 当天 10:00 → 次日 09:59 UTC+8）。用户实拍里官网页面上那个 `09:22:23`
+	* 就是这个 `endAt − 当前时间`。
+	*
+	* 同样只在进程内：它描述的是「今天」，重启后由下一次签到重新写入。
+	*/
+	const checkinSnapshots = {
+		cn: {},
+		global: {}
+	};
+	/**
+	* 每区域最近一次**实时**拉到的完整目录（含上游声明的思考档位），未过滤。
+	*
+	* 为什么要单独存：`stacks[region].catalog` 装的是**过滤后**（只含勾选模型）
+	* 的运行时目录，卡片不能用它；而保存的 `lastCatalog` 可能是**旧快照**，
+	* 上游新声明的思考档位会缺失（用户实拍「还是没有思考强度」——即使刚刚
+	* 「从 Qoder 刷新」成功过，卡片读的仍是那份没有档位的旧快照）。
+	* 实时目录优先于保存快照，才能反映上游当前声明了什么。
+	*/
+	const fullCatalog = {
+		cn: [],
+		global: []
+	};
+	/**
+	* 卡片展示用的模型列表（workbuddy 的 `displayModels` 同规）。
+	*
+	* 与运行时目录（`stacks[region].catalog`）的区别只有一条，但它是关键：
+	* **运行时目录只含用户勾选的模型**（DSH 的选择器读它），而卡片必须看到**完整
+	* 目录**，否则未勾选的模型根本不出现在卡片里，用户再也勾不上它们。
+	*
+	* 实时目录（`fullCatalog`）优先于运行时目录：实时目录反映上游**当前**声明了
+	* 什么（含思考档位），而运行时目录是启动时由保存的 lastCatalog 装配的 ——
+	* 那是上一次保存时的旧快照（issue #32 的教训：保存槽位丢了目录时必须显示
+	* 实时目录，否则卡片会把用户正在用的模型报成「已下架」）。
+	*
+	* 「思考强度有时候有、有时候没有」（用户实拍）的机制也在这条读路径上：
+	* `fullCatalog` 是纯内存的、只在启动时拉一次；启动那次失败的话，卡片每次
+	* 读到的都是启动装配的旧快照 —— 一个档位都没有，直到用户手动点一次
+	* 「从 Qoder 刷新」。所以读到「本进程还没成功拉过实时目录 + 手上的目录一个
+	* 档位都没声明」时，**触发一次后台重拉**（fire-and-forget，见
+	* ensureCatalogRefresh）并且**继续服务手上的目录** —— 模型不能从卡片上消失，
+	* 缺的只是档位，拉回来之后下一次读取自然补上。
+	*/
+	function displayModels(region) {
+		const full = fullCatalog[region];
+		const live = full.length > 0 ? full : stacks[region].catalog.current();
+		if (full.length === 0) serveSavedCatalog(live, () => {
+			ensureCatalogRefresh(region);
+		});
+		return live;
+	}
+	/**
+	* 幂等地触发一次该区域的目录拉取（**不等待**）。
+	*
+	* 为什么不等待：`displayModels` 是**读**路径，被 `/usage` 路由同步调用；在里面
+	* await 网络会让「卡片读一次快照」这个纯读动作每次都等一次上游。改为
+	* fire-and-forget + 在飞标记去重，拉取完成后下一次读取自然拿到新目录。
+	*
+	* 为什么需要它：目录此前**只在启动时拉一次**（`refreshModels`），而 `fullCatalog`
+	* 是纯内存的。于是「思考强度」在重启后必然退化成那份空快照 —— 除非用户恰好
+	* 去点一次「从 Qoder 刷新」。有没有点过刷新、以及进程活多久，就是「有时候有、
+	* 有时候没有」的全部来源。
+	*/
+	const catalogRefreshInFlight = {};
+	const ensureCatalogRefresh = (region) => {
+		if (catalogRefreshInFlight[region] === true) return;
+		catalogRefreshInFlight[region] = true;
+		refreshModels(region).finally(() => {
+			catalogRefreshInFlight[region] = false;
+		});
+	};
+	let invalidateCatalog = () => {};
+	for (const region of QODER_REGIONS) {
+		const upstream = new QoderUpstreamClient(region, { logger: log });
+		const catalog = new QoderCatalog(QODER_FALLBACK_MODELS.map(fallbackModelInfo));
+		const store = new QoderAccountStore(region);
+		let poolRuntime = {};
+		readPoolProbes(region).then((probes) => {
+			poolRuntime = probes;
+		});
+		stacks[region] = {
+			upstream,
+			catalog,
+			shim: createQoderShim({
+				upstream,
+				credential: () => resolveServingPat(region),
+				modelKeyOf: (selector) => catalog.keyOf(selector),
+				supportsImagesOf: (selector) => catalog.supportsImagesOf(selector),
+				reasoningEffortOf: (selector) => {
+					const key = catalog.keyOf(selector);
+					if (key === void 0) return void 0;
+					return thinkingEffortsOf(config, region)[key];
+				},
+				logger: log,
+				resolveServing: async () => {
+					const serving = await resolveServing(region);
+					return serving === void 0 ? void 0 : {
+						accountId: serving.id,
+						accountName: serving.accountName,
+						pat: serving.pat
+					};
+				},
+				failoverAccount: async (tried) => nextFailoverCredential(region, tried),
+				onServingFailure: (accountId, kind, _message) => {
+					const outcome = FAIL_OVER_OUTCOME[kind];
+					if (outcome !== void 0 && accountId !== "") {
+						poolRuntime[accountId] = {
+							outcome,
+							atMs: Date.now(),
+							source: "live-request"
+						};
+						writePoolProbes(region, { [accountId]: poolRuntime[accountId] });
+						log(`pool ${region}: ${maskPat(accountId)} marked ${outcome} by live request`);
+					}
+				}
+			}),
+			store,
+			probeClient: buildProbeClient(region),
+			poolRuntime
+		};
+	}
+	/** The region's source PATs (settings + env). */
+	function sourcesOf(region) {
+		const state = regionStateOf(config, region);
+		const settingsPat = typeof state.pat === "string" ? state.pat.trim() : "";
+		const envPat = patFromEnv(region);
+		return {
+			...settingsPat === "" ? {} : { settingsPat },
+			...envPat === void 0 ? {} : { envPat }
+		};
+	}
+	/** The region's auto-resolved serving PAT (settings → env). Vault is async. */
+	function resolveServingPat(region) {
+		const sources = sourcesOf(region);
+		if (sources.settingsPat) return sources.settingsPat;
+		if (sources.envPat) return sources.envPat;
+	}
+	/** Full serving credential via the store (honors selection + vault). */
+	async function resolveServing(region) {
+		return stacks[region].store.resolve(sourcesOf(region), selectedAccountId(config, region));
+	}
+	/** Next usable PAT for failover: rankPool over members, skip tried. */
+	async function nextFailoverCredential(region, tried) {
+		const store = stacks[region].store;
+		const memberIds = poolPreferencesOf(config, region).memberAccountIds;
+		const probes = stacks[region].poolRuntime;
+		const now = Date.now();
+		const snapshot = now - (poolCreditsSnapshotAt[region] ?? 0) <= POOL_CREDITS_SNAPSHOT_MS ? poolCreditsSnapshot[region] : void 0;
+		const candidates = [];
+		for (const accountId of memberIds) {
+			if (tried.includes(accountId)) continue;
+			const credit = await store.credentialFor(accountId, sourcesOf(region));
+			if (credit === void 0) continue;
+			const probe = probes[accountId];
+			const reading = snapshot?.get(accountId);
+			candidates.push({
+				account: {
+					id: credit.id,
+					accountName: credit.accountName
+				},
+				...reading === void 0 ? {} : { credits: reading },
+				...probe === void 0 ? {} : { probe }
+			});
+		}
+		const chosen = rankPool(candidates, now)[0];
+		if (chosen === void 0 || chosen.excludedBy !== void 0) return void 0;
+		const credit = await store.credentialFor(chosen.account.id, sourcesOf(region));
+		return credit === void 0 ? void 0 : {
+			accountId: credit.id,
+			accountName: credit.accountName,
+			pat: credit.pat
+		};
+	}
+	/** 成员积分快照：请求路径不能上网，排名用卡片路由最近一次的读数。 */
+	const poolCreditsSnapshot = {};
+	const POOL_CREDITS_SNAPSHOT_MS = 6e5;
+	const poolCreditsSnapshotAt = {};
+	/**
+	* 池成员的最新积分（每成员一次 usage 读数）。由卡片路由付费——卡片正在看的
+	* 数字与排名快照同一次读取（workbuddy 的 poolMembersOf 同规），单个账号失败
+	* 只让那一行显示「—」，不拖垮整张表。
+	*/
+	async function poolMemberCredits(region, accountIds) {
+		const store = stacks[region].store;
+		const SOON_MS = 2592e5;
+		const entries = await Promise.all(accountIds.map(async (accountId) => {
+			const credit = await store.credentialFor(accountId, sourcesOf(region)).catch(() => void 0);
+			if (credit === void 0) return void 0;
+			const usage = await stacks[region].upstream.fetchUsage(credit.pat).catch(() => void 0);
+			if (usage === void 0) return void 0;
+			const view = creditsOf(usage);
+			const expiringSoon = view.packages.reduce((sum, pkg) => pkg.expiresAtMs !== void 0 && pkg.expiresAtMs - Date.now() < SOON_MS ? sum + pkg.remain : sum, 0);
+			return [accountId, {
+				total: view.total,
+				expiringSoon,
+				...view.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: view.nearestExpiryMs }
+			}];
+		}));
+		const map = new Map(entries.filter((entry) => entry !== void 0));
+		poolCreditsSnapshot[region] = map;
+		poolCreditsSnapshotAt[region] = Date.now();
+		return map;
+	}
+	/** A probe client for one region backed by chatStream. */
+	function buildProbeClient(region) {
+		return { probeChat: async (credential, modelKey, opts) => {
+			let firstBytes = 0;
+			let error;
+			try {
+				await stacks[region].upstream.chatStream(credential.pat, modelKey, [{
+					role: "user",
+					content: probeUserMessage(opts.inputTokens)
+				}], {
+					...opts.signal === void 0 ? {} : { signal: opts.signal },
+					isReasoning: false,
+					isVl: false,
+					onDelta: (delta) => {
+						if (firstBytes === 0) firstBytes = cheapProbeLength(delta);
+					}
+				});
+			} catch (caught) {
+				if (isQoderUpstreamError(caught)) error = caught;
+				else throw caught;
+			}
+			if (error !== void 0) {
+				const probeError = {
+					kind: error.kind,
+					status: error.status,
+					message: error.message
+				};
+				return {
+					ok: false,
+					status: error.status,
+					retryAfter: null,
+					body: error.message,
+					error: probeError
+				};
+			}
+			return {
+				ok: true,
+				status: 200,
+				retryAfter: null
+			};
+		} };
+	}
+	/** Cheap text length of a delta for probe first-byte accounting. */
+	function cheapProbeLength(delta) {
+		let length = delta.content.length;
+		if (delta.reasoningContent.length > 0) length += delta.reasoningContent.length;
+		if (delta.toolCalls !== void 0) length += delta.toolCalls.length;
+		return length;
+	}
+	/** One real probe of one model through one credential. Never throws. */
+	async function probeThrough(region, credential, modelId, signal) {
+		return probeModel({
+			client: stacks[region].probeClient,
+			credential,
+			modelKey: modelId,
+			nowMs: Date.now(),
+			...signal === void 0 ? {} : { signal }
+		});
+	}
+	/**
+	* 对一个区域勾选的成员逐个签到（领取当日 Credits）。
+	*
+	* 与 `test` 批次同构：只跑**真的有凭据**的成员（幽灵 id 跳过，见 test 里那段
+	* 注释），逐个之间留间隔避免撞限流。每个成员独立成败——一个账号失败不影响
+	* 其余账号，结果逐行回报（workbuddy 的 checkin 批次同规）。
+	*
+	* 三种状态分得很清：`claimed`（这次领到）/ `already`（今天已领，幂等，
+	* **不是**失败）/ `failed`（真的失败：凭据被拒、上游报错）。
+	*/
+	async function runCheckinBatch(region) {
+		const store = stacks[region].store;
+		const prefs = poolPreferencesOf(config, region);
+		const client = stacks[region].upstream;
+		const rows = [];
+		let first = true;
+		for (const accountId of prefs.memberAccountIds) {
+			const credit = await store.credentialFor(accountId, sourcesOf(region));
+			if (credit === void 0) continue;
+			if (!first) await new Promise((resolve) => setTimeout(resolve, 400));
+			first = false;
+			const base = {
+				accountId,
+				accountName: credit.accountName
+			};
+			try {
+				const outcome = await client.claimDailyCredits(credit.pat);
+				const refresh = outcome.status === "unavailable" ? {} : outcome.nextRefreshAtMs === void 0 ? {} : { refreshAtMs: outcome.nextRefreshAtMs };
+				if (outcome.status === "claimed") rows.push({
+					...base,
+					status: "claimed",
+					...outcome.amount === void 0 ? {} : { credit: outcome.amount },
+					...outcome.validityDays === void 0 ? {} : { validityDays: outcome.validityDays },
+					...refresh
+				});
+				else if (outcome.status === "already-claimed") rows.push({
+					...base,
+					status: "already",
+					...refresh
+				});
+				else rows.push({
+					...base,
+					status: "failed",
+					message: outcome.message
+				});
+			} catch (error) {
+				rows.push({
+					...base,
+					status: "failed",
+					message: error instanceof Error ? error.message : String(error)
+				});
+			}
+		}
+		const next = { ...checkinState[region] ?? {} };
+		const nextSnapshot = { ...checkinSnapshots[region] ?? {} };
+		for (const row of rows) if (row.status === "claimed" || row.status === "already") {
+			next[row.accountId] = true;
+			nextSnapshot[row.accountId] = {
+				claimed: true,
+				...row.refreshAtMs === void 0 ? {} : { refreshAtMs: row.refreshAtMs }
+			};
+		} else if (row.status === "failed") {
+			next[row.accountId] = false;
+			nextSnapshot[row.accountId] = { claimed: false };
+		}
+		checkinState[region] = next;
+		checkinSnapshots[region] = nextSnapshot;
+		await refreshUsage(region).catch(() => {});
+		return rows;
+	}
+	/** Cached usage read for one region. */
+	function usageEntryOf(region) {
+		const entry = usageCache[region];
+		if (entry === void 0) return void 0;
+		return {
+			...entry.usage === void 0 ? {} : { usage: {
+				credits: creditsOf(entry.usage),
+				atMs: entry.atMs
+			} },
+			...entry.error === void 0 ? {} : { error: entry.error }
+		};
+	}
+	const refreshUsage = async (region) => {
+		const serving = await resolveServing(region);
+		if (!serving) return;
+		try {
+			const usage = await stacks[region].upstream.fetchUsage(serving.pat);
+			usageCache[region] = {
+				usage,
+				atMs: Date.now()
+			};
+		} catch (error) {
+			const kind = isQoderUpstreamError(error) ? error.kind : void 0;
+			usageCache[region] = {
+				usage: void 0,
+				atMs: Date.now(),
+				error: kind === "auth" ? "credential-rejected" : kind ?? "unknown"
+			};
+		}
+	};
+	/** The region's catalog projected into the pool target picker's shape. */
+	function poolModelsOf(region) {
+		return stacks[region].catalog.current().map((m) => ({
+			id: m.key,
+			name: m.displayName,
+			creditMultiplier: m.isFree === true ? 0 : m.priceFactor,
+			contextWindow: m.contextWindow
+		}));
+	}
+	/** On-demand model read for discovery + refresh. */
+	async function discoverModels(region, signal) {
+		const serving = await resolveServing(region);
+		if (!serving) return [];
+		return applyContextBudgets((await stacks[region].upstream.fetchModels(serving.pat, signal)).map(parseUpstreamModel), contextBudgetsOf(config, region));
+	}
+	/**
+	* 拉取并安装一个区域的动态目录。返回安装后的目录；拉取失败抛错——
+	* 路由层据此答 500，启动路径自己吞掉落回兜底目录。
+	*/
+	async function refreshRegionCatalog(region, pat) {
+		const stamped = stampRuntimeCatalog(config, region, applyContextBudgets((await stacks[region].upstream.fetchModels(pat)).map(parseUpstreamModel), contextBudgetsOf(config, region)));
+		const saved = new Set(enabledModelKeysOf(config, region));
+		fullCatalog[region] = stamped;
+		stacks[region].catalog.set(deriveCatalog(stamped, saved));
+		invalidateCatalog();
+		return stamped;
+	}
+	/**
+	* 路由层（卡片「从 Qoder 刷新」按钮）用的完整刷新：装目录 + 刷积分。
+	* 此前的路由只调只读的 discoverModels——返回了新模型给卡片，却从不写入
+	* 运行时目录，卡片随后重取 usage 文档看到的仍是旧目录，刷了个寂寞。
+	*/
+	async function refreshRegionForRoute(region) {
+		const serving = await resolveServing(region);
+		if (!serving) throw new Error(`no PAT configured for ${region}`);
+		const models = await refreshRegionCatalog(region, serving.pat);
+		refreshUsage(region);
+		return models;
+	}
+	const refreshModels = (region) => {
+		return (async () => {
+			const serving = await resolveServing(region);
+			if (!serving) {
+				log(`models refresh skipped for ${region}: no PAT configured`);
+				return;
+			}
+			try {
+				await refreshRegionCatalog(region, serving.pat);
+			} catch (error) {
+				log(`dynamic ${region} model catalog unavailable; serving the static fallback list: ${String(error?.message ?? error)}`);
+			}
+			refreshUsage(region);
+		})();
+	};
+	const syncRegionRegistration = (value) => {
+		for (const region of QODER_REGIONS) {
+			const enabled = regionEnabled(value, region);
+			const handle = registration[region].adapter;
+			if (handle === void 0) continue;
+			try {
+				handle.replace(enabled ? [QODER_PROVIDERS[region]] : []);
+			} catch (error) {
+				log(`region ${region} adapter sync failed: ${String(error?.message ?? error)}`);
+			}
+		}
+		const dirHandle = registration.cn.directory;
+		if (dirHandle === void 0) return;
+		try {
+			dirHandle.replace(QODER_REGIONS.filter((region) => regionEnabled(value, region)).map((region) => ({
+				provider: QODER_PROVIDERS[region],
+				displayName: QODER_PROVIDER_DISPLAY_NAMES[region],
+				settingsNs,
+				settingsPath: [],
+				declared: false
+			})));
+		} catch (error) {
+			log(`provider directory sync failed: ${String(error?.message ?? error)}`);
+		}
+	};
+	const applySelection = (value) => {
+		for (const region of QODER_REGIONS) {
+			const stamped = stampRuntimeCatalog(value, region, applyContextBudgets(configuredModels(value, region, stacks[region].catalog.current()), contextBudgetsOf(value, region)));
+			const saved = new Set(enabledModelKeysOf(value, region));
+			stacks[region].catalog.set(deriveCatalog(stamped, saved));
+		}
+		invalidateCatalog();
+		syncRegionRegistration(value);
+		for (const region of QODER_REGIONS) refreshUsage(region);
+	};
+	applySelection(config);
+	const accountDeps = (region) => {
+		const store = stacks[region].store;
+		return {
+			accounts: (sources) => store.accounts(sources ?? sourcesOf(region)),
+			credentialFor: (accountId, sources) => store.credentialFor(accountId, sources ?? sourcesOf(region)),
+			resolve: (sources, selectedId) => store.resolve(sources ?? sourcesOf(region), selectedId ?? selectedAccountId(config, region)),
+			add: (pat, name) => store.add(pat, name),
+			vaultAccounts: () => store.vaultAccounts(),
+			remove: (accountId) => store.remove(accountId),
+			rename: (accountId, name) => store.rename(accountId, name)
+		};
+	};
+	const accountValidationDeps = { validateForRegion: async (region, pat) => {
+		return { name: (await stacks[region].upstream.exchangeJobToken(pat)).name || "" };
+	} };
+	/** Region-dispatch table for the single pool deps the route gets. */
+	function poolFor(region) {
+		const store = stacks[region].store;
+		return {
+			preferences: (reg) => poolPreferencesOf(config, reg),
+			catalog: (reg) => stacks[reg].catalog.current(),
+			poolProbes: (reg) => stacks[reg].poolRuntime,
+			credentialFor: (reg, accountId) => store.credentialFor(accountId, sourcesOf(reg)),
+			probeOne: (reg, credit, modelId) => probeThrough(reg, credit, modelId),
+			checkinSupported: () => true,
+			checkin: async (reg) => runCheckinBatch(reg),
+			test: async (reg) => {
+				const prefs = poolPreferencesOf(config, reg);
+				const target = resolveTargetModel(poolModelsOf(reg), prefs.targetModelId);
+				if (target.modelId === void 0) return [];
+				const deps = {
+					credentialFor: (accountId) => store.credentialFor(accountId, sourcesOf(reg)),
+					probe: (credit, modelId) => probeThrough(reg, credit, modelId)
+				};
+				const targets = [];
+				for (const accountId of prefs.memberAccountIds) {
+					const credit = await store.credentialFor(accountId, sourcesOf(reg));
+					if (credit === void 0) continue;
+					targets.push({
+						accountId,
+						accountName: credit.accountName
+					});
+				}
+				const rows = await testAllAccounts(targets, target.modelId, deps);
+				const probes = {};
+				for (const row of rows) {
+					const p = poolProbeFromResult(row.result);
+					if (p) probes[row.accountId] = p;
+				}
+				stacks[reg].poolRuntime = {
+					...stacks[reg].poolRuntime,
+					...probes
+				};
+				writePoolProbes(reg, probes);
+				return rows;
+			},
+			applyProbes: async (reg, probes) => {
+				stacks[reg].poolRuntime = {
+					...stacks[reg].poolRuntime,
+					...probes
+				};
+				writePoolProbes(reg, probes);
+			},
+			updateMembership: (reg, memberAccountIds, enabled) => {
+				submitRegionSettings(reg, { pool: {
+					...poolPreferencesOf(config, reg),
+					memberAccountIds,
+					...enabled === void 0 ? {} : { enabled }
+				} });
+			}
+		};
+	}
+	function buildPoolDeps() {
+		return {
+			preferences: (region) => poolPreferencesOf(config, region),
+			catalog: (region) => stacks[region].catalog.current(),
+			poolProbes: (region) => stacks[region].poolRuntime,
+			memberCredits: (region, accountIds) => poolMemberCredits(region, accountIds),
+			credentialFor: (region, accountId) => stacks[region].store.credentialFor(accountId, sourcesOf(region)),
+			probeOne: (region, credit, modelId) => probeThrough(region, credit, modelId),
+			test: (region, modelId) => poolFor(region).test(region, modelId),
+			checkinSupported: (region) => poolFor(region).checkinSupported(region),
+			checkin: (region) => poolFor(region).checkin(region),
+			checkinState: (region) => checkinState[region],
+			checkinSnapshot: (region) => checkinSnapshots[region],
+			applyProbes: async (region, probes) => poolFor(region).applyProbes(region, probes),
+			updateMembership: (region, memberAccountIds, enabled) => poolFor(region).updateMembership(region, memberAccountIds, enabled)
+		};
+	}
+	/** Build the transfer deps once (region-dispatched). */
+	const transferDeps = {
+		exportAccounts: async (region) => {
+			const { transferRecordsFor } = await import("./transfer-CUNaVvmi.js");
+			return { accounts: transferRecordsFor(region, await stacks[region].store.vaultAccounts()) };
+		},
+		previewImport: async (_region, text) => {
+			const { previewTransferFile } = await import("./transfer-CUNaVvmi.js");
+			return previewTransferFile(text);
+		},
+		importAccounts: async (region, text, indexes) => {
+			const { mergeTransferRecords } = await import("./transfer-CUNaVvmi.js");
+			const { changes, imported, skipped } = mergeTransferRecords(region, text, indexes);
+			for (const entry of changes.values()) await stacks[region].store.add(entry.pat, entry.accountName);
+			return {
+				imported,
+				skipped
+			};
+		}
+	};
+	let settingsService;
+	ctx.inject(["settings"], (sctx) => {
+		settingsService = sctx.settings;
+	});
+	const pluginRow = () => {
+		if (settingsService === void 0) return void 0;
+		return settingsService.describe().find((row) => String(row.ns).includes("dsh-connect-qoder"));
+	};
+	/**
+	* Two-level merge a settings field write, then `mutate` it (workbuddy's
+	* `__save` contract, so a partial payload never deletes sibling regions).
+	*/
+	async function mutateField(field, incoming) {
+		const row = pluginRow();
+		if (row === void 0) throw new Error("settings namespace not yet available");
+		const current = unwrapVolatileDeep(row.value?.[field] ?? {});
+		const patch = incoming ?? {};
+		const merged = { ...current };
+		for (const [key, slot] of Object.entries(patch)) {
+			const prior = current[key];
+			const isPlain = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+			merged[key] = isPlain(prior) && isPlain(slot) ? {
+				...prior,
+				...slot
+			} : slot;
+		}
+		await settingsService.mutate(row.ns, [{
+			op: "set",
+			path: [field],
+			value: merged
+		}], void 0);
+	}
+	const settingsDeps = {
+		describe: () => settingsService === void 0 ? [] : settingsService.describe(),
+		set: async (field, value) => {
+			if (field !== "regions") throw new Error(`unsupported settings field: ${String(field)}`);
+			await mutateField(field, value);
+		}
+	};
+	/** Write one region's settings patch (whole `regions` dict replace). */
+	function submitRegionSettings(region, patch) {
+		const regions = unwrapVolatile(config.regions) ?? {};
+		mutateField("regions", {
+			...regions,
+			[region]: {
+				...regions[region] ?? {},
+				...patch
+			}
+		});
+	}
+	/** Fresh per-account credit balances for the composer panel. */
+	async function accountCreditsOf(region, signal) {
+		const store = stacks[region].store;
+		const accounts = await store.accounts(sourcesOf(region));
+		const out = [];
+		for (const account of accounts) {
+			const pat = (await store.credentialFor(account.id, sourcesOf(region)))?.pat;
+			if (!pat) continue;
+			let usage;
+			try {
+				usage = await stacks[region].upstream.fetchUsage(pat, signal);
+			} catch {
+				usage = void 0;
+			}
+			out.push({
+				id: account.id,
+				accountName: account.accountName || account.source,
+				selected: account.id === selectedAccountId(config, region) || account.source !== "vault" && selectedAccountId(config, region) === void 0,
+				...usage === void 0 ? {} : { credits: creditsOf(usage).total }
+			});
+		}
+		return out;
+	}
+	/** The serving credential for a probe route (region's selection). */
+	async function probeModelOf(region, modelId, signal) {
+		const serving = await resolveServing(region);
+		if (!serving) return {
+			modelId,
+			outcome: "credential-rejected",
+			message: "未配置凭据"
+		};
+		return probeThrough(region, {
+			pat: serving.pat,
+			accountName: serving.accountName
+		}, modelId, signal);
+	}
+	writeHostHeartbeat();
+	ctx.inject(["webServer"], (ctxWithWeb) => {
+		registerQoderWebRoutes(ctxWithWeb, {
+			regionEnabled: (region) => regionEnabled(config, region),
+			regionCreditsShown: (region) => regionCreditsShown(config, region),
+			regionUsable: (region, usable) => {
+				if (!usable) log(`region ${region} is signed out`);
+			},
+			store: accountDeps,
+			credentialSources: sourcesOf,
+			selectedAccountId: (region) => selectedAccountId(config, region),
+			clearSelection: (region) => {
+				submitRegionSettings(region, { accountId: "" });
+			},
+			catalogs: {
+				cn: { current: () => [...displayModels("cn")] },
+				global: { current: () => [...displayModels("global")] }
+			},
+			contextBudgets: (region) => contextBudgetsOf(config, region),
+			thinkingEfforts: (region) => thinkingEffortsOf(config, region),
+			offModelKeys: (region) => offModelKeysOf(config, region),
+			imageModelKeys: (region) => imageModelKeysOf(config, region),
+			enabledModelKeys: (region) => enabledModelKeysOf(config, region),
+			discoverModels,
+			refreshModels: refreshRegionForRoute,
+			usage: usageEntryOf,
+			probeModel: probeModelOf,
+			accountCredits: accountCreditsOf,
+			pool: buildPoolDeps(),
+			transfer: transferDeps,
+			accountValidation: accountValidationDeps,
+			settings: settingsDeps,
+			logger: log
+		});
+	});
+	ctx.on("loader/volatile-update", () => applySelection(config));
+	let disposed = false;
+	ctx.effect(() => () => {
+		if (disposed) return;
+		disposed = true;
+		stopped = true;
+		for (const region of QODER_REGIONS) stacks[region].shim.close();
+		clearHostHeartbeat();
+	});
+	Promise.all(QODER_REGIONS.map((region) => stacks[region].shim.ready)).then(async () => {
+		if (stopped) return;
+		try {
+			const adapters = {};
+			for (const region of QODER_REGIONS) {
+				adapters[region] = createQoderAdapter({
+					shim: stacks[region].shim,
+					catalog: stacks[region].catalog,
+					provider: QODER_PROVIDERS[region],
+					displayName: QODER_PROVIDER_DISPLAY_NAMES[region],
+					resolveAttachments: () => ctx.get("attachments")
+				});
+				stacks[region].adapter = adapters[region];
+			}
+			invalidateCatalog = () => {
+				for (const region of QODER_REGIONS) adapters[region].invalidate();
+			};
+			const releaseAdapter = {};
+			let releaseDirectory;
+			try {
+				for (const region of QODER_REGIONS) releaseAdapter[region] = registration[region].adapter = ctx.llm.registerAdapter([QODER_PROVIDERS[region]], adapters[region].adapter);
+				releaseDirectory = registration.cn.directory = ctx.llm.registerConfigurableProviders(QODER_REGIONS.map((region) => ({
+					provider: QODER_PROVIDERS[region],
+					displayName: QODER_PROVIDER_DISPLAY_NAMES[region],
+					settingsNs,
+					settingsPath: [],
+					declared: false
+				})));
+			} finally {
+				if (QODER_REGIONS.some((region) => releaseAdapter[region] === void 0) || releaseDirectory === void 0) {
+					for (const region of QODER_REGIONS) releaseAdapter[region]?.();
+					releaseDirectory?.();
+				}
+			}
+			ctx.effect(() => () => {
+				for (const region of QODER_REGIONS) releaseAdapter[region]?.();
+				releaseDirectory?.();
+			});
+			syncRegionRegistration(config);
+			ctx.llm.registerModelDiscovery(settingsNs, async (request, signal) => {
+				const region = regionOfProvider(request.provider ?? "");
+				if (region === void 0) return [];
+				if (!regionEnabled(config, region)) return [];
+				try {
+					const models = await discoverModels(region, signal);
+					const saved = new Set(enabledModelKeysOf(config, region));
+					return deriveCatalog(models, saved.size > 0 ? saved : initialEnabledKeys(models)).map((model) => ({
+						id: model.key,
+						name: modelDisplayName(model),
+						contextWindow: model.contextWindow,
+						maxTokens: model.maxOutputTokens,
+						inputModalities: model.supportsImages ? ["text", "image"] : ["text"]
+					}));
+				} catch {
+					return [];
+				}
+			});
+		} catch (error) {
+			ctx.logger.error("dsh-connect-qoder: provider registration failed", error);
+			return;
+		}
+		for (const region of QODER_REGIONS) refreshModels(region);
+	}).catch((error) => {
+		ctx.logger.error("dsh-connect-qoder: loopback endpoint failed to start; providers not registered", error);
+	});
+	/** One batch result → a persisted pool probe. */
+	function poolProbeFromResult(result) {
+		return {
+			outcome: result.outcome,
+			atMs: Date.now(),
+			source: "test-batch",
+			...result.retryAtMs === void 0 ? {} : { retryAtMs: result.retryAtMs },
+			...result.message === void 0 ? {} : { message: result.message }
+		};
+	}
+}
+const FAIL_OVER_OUTCOME = {
+	auth: "credential-rejected",
+	"rate-limited": "rate-limited",
+	"quota-exhausted": "out-of-credit",
+	network: "unavailable",
+	transient: "unavailable"
+};
+//#endregion
+export { Config, QODER_CONNECT_VERSION, QODER_GITHUB_URL, apply, asVolatile, catalogSnapshotDeclaresEfforts, inject, name, regionEnabled, regionHasCredential, regionStateOf, serveSavedCatalog, settingsNamespaceOf, unwrapVolatile };