@eddyskywalker/dsh-chatgpt-subscription 0.34.0 → 0.35.0

package/lib/types/host/workbuddy/token-store.d.ts

@@ -1,360 +0,0 @@
-import type { WorkBuddyCheckinSettings, WorkBuddyReasoningEffort, WorkBuddyRegion } from '../../shared/workbuddy-contracts.ts';
-import { type ContextWindowOverridePatch } from '../common/context-window-overrides.ts';
-import { type WorkBuddyGuardrails } from './guardrails.ts';
-import { type WorkBuddyOutboundSetting } from './outbound-identity.ts';
-import type { CredentialStore } from '../token-store.ts';
-import { isIntlDomain } from './types.ts';
-export declare const WORKBUDDY_PREFERENCES_NAMESPACE = "dsh-workbuddy";
-export type { WorkBuddyReasoningEffort };
-/**
- * One WorkBuddy credential, parsed from a CodeBuddy desktop `*.info` file.
- *
- * These files are the IDE's own credential store, not this plugin's: the plugin
- * reads them so a user who is already signed in to the IDE needs no second
- * login. A refreshed token is written back so both clients stay valid instead of
- * racing each other with a rotating refresh token.
- */
-export interface WorkBuddyCredentials {
-    /** Bearer token for the chat and billing APIs. Host-only. */
-    accessToken: string;
-    /** Rotating refresh token. Host-only. */
-    refreshToken: string;
-    /** Unix milliseconds the access token stops being valid. */
-    expiresAt: number;
-    /** Region the account belongs to; decides which backend serves it. */
-    region: WorkBuddyRegion;
-    /** Auth domain recorded in the file, e.g. `copilot.tencent.com`. */
-    domain: string;
-    /** Backend base URL derived from {@link domain}. */
-    backend: string;
-    uid?: string;
-    nickname?: string;
-    uin?: string;
-    accountType?: string;
-    enterpriseId?: string;
-    /** Absolute path of the `*.info` file this credential came from. */
-    sourceFile: string;
-    /** File modification time when it was read, so a stale cache is detectable. */
-    sourceMtimeMs: number;
-    /** Which store owns the secret; only managed credentials may be deleted. */
-    source: 'desktop' | 'managed';
-    /**
-     * Sealed token material, when the file holds `$wbEncrypted` envelopes.
-     *
-     * The desktop client stopped writing plaintext tokens on 2026-09-24, so a
-     * credential read from such a file has no usable `accessToken` until the
-     * at-rest key opens these. They are kept verbatim here — never logged, never
-     * sent anywhere — and resolved by {@link unsealCredentials}.
-     */
-    sealed?: {
-        accessToken?: unknown;
-        refreshToken?: unknown;
-    };
-}
-export interface WorkBuddyModelSettings {
-    enabled?: boolean;
-    enabledModelIds: string[];
-    contextWindowOverrides: Record<string, number>;
-    defaultReasoningEffort: WorkBuddyReasoningEffort | null;
-    /** Stable account key selected by the user; null keeps automatic selection. */
-    selectedAccountId: string | null;
-    /** Desktop accounts hidden from this plugin without deleting CodeBuddy files. */
-    hiddenAccountIds: string[];
-    /** Daily check-in scheduler preferences. */
-    checkin: WorkBuddyCheckinSettings;
-    /**
-     * Which outbound client identity requests present.
-     *
-     * `auto` assigns one product per account (stable for the account's life);
-     * anything else pins it line-wide. The default is the identity this line has
-     * always sent, so an untouched install behaves exactly as before.
-     */
-    outboundIdentity: WorkBuddyOutboundSetting;
-    /** Local quota guardrails; all-off by default. */
-    guardrails: WorkBuddyGuardrails;
-}
-export interface WorkBuddyPreferenceStore {
-    /**
-     * Resolve once the store has read whatever it was going to read.
-     *
-     * The file-backed store warms up asynchronously, so `status()` answers from
-     * shipped defaults until that read settles. A caller that acts on a
-     * preference at startup — the check-in scheduler signing in on boot — must
-     * await this first, or it acts on the default instead of the user's choice.
-     * A register-backed store reads synchronously and resolves immediately.
-     */
-    ready(): Promise<void>;
-    status(): WorkBuddyModelSettings;
-    update(patch: {
-        enabled?: boolean;
-        enabledModelIds?: string[];
-        /** `null` deletes one override and falls back to the catalog default. */
-        contextWindowOverrides?: ContextWindowOverridePatch;
-        defaultReasoningEffort?: WorkBuddyReasoningEffort | null;
-        selectedAccountId?: string | null;
-        hiddenAccountIds?: string[];
-        checkin?: Partial<WorkBuddyCheckinSettings>;
-        outboundIdentity?: WorkBuddyOutboundSetting;
-        guardrails?: Partial<WorkBuddyGuardrails>;
-    }): Promise<WorkBuddyModelSettings>;
-}
-/** Shipped check-in default: on. */
-export declare const DEFAULT_CHECKIN_SETTINGS: WorkBuddyCheckinSettings;
-/**
- * Narrow an unknown stored/patched value into valid check-in settings.
- *
- * Documents written while the window was still configurable may carry
- * startHour/endHour; those keys are inert now and dropped on the next write.
- */
-export declare function normalizeCheckinSettings(value: unknown): WorkBuddyCheckinSettings;
-/**
- * Bind the model selection to the DSH settings document when the harness still
- * offers one, and to the JSON file beside it otherwise: a harness without the
- * register seam (0.1.7, and a headless test) reads that file back on boot.
- */
-export declare function registerWorkBuddyPreferenceStore(settings?: unknown, fallbackStore?: FileModelSettingsStore): WorkBuddyPreferenceStore;
-/**
- * Credential directory the CodeBuddy desktop client writes to.
- *
- * `CODEBUDDY_AUTH_DIR` overrides it, matching the environment variable the
- * official tooling honours, which is also what makes the scan testable without
- * touching a real profile.
- */
-export declare function codeBuddyAuthDir(): string;
-/** Plugin settings file, used when no settings service is present. */
-export declare function modelSettingsPath(): string;
-/** Encrypted account pool for credentials added through this plugin. */
-export declare function managedCredentialsPath(): string;
-/** Platform-encrypted storage for the pasted at-rest key (never plaintext on disk). */
-export declare function atRestKeyPath(): string;
-/**
- * Storage for the `$wbEncrypted` protector key.
- *
- * The key is the one secret that unlocks the desktop client's tokens, so it goes
- * through the same platform store the managed pool uses (DPAPI / Keychain /
- * Secret Service) and is installed into the process only after the client's own
- * keyblob accepts it. A pasted value that fails that check never displaces a
- * working key.
- */
-export declare class WorkBuddyAtRestKeyStore {
-    private readonly filePath;
-    private readonly backend;
-    private cached;
-    constructor(filePath?: string, backend?: CredentialStore<{
-        version: 1;
-        keyHex: string;
-    }>);
-    /** Human-readable storage description, mirroring the managed pool's. */
-    path(): string;
-    /**
-     * Load the stored key into the process.
-     *
-     * Called once at startup: the credential readers consult the module-level
-     * slot, so a key that is only on disk would otherwise leave every sealed
-     * account unreadable until something else triggered a load.
-     */
-    load(): Promise<Buffer | null>;
-    /** Validate and persist a pasted secret; returns the key id for display. */
-    adopt(text: string): Promise<string>;
-    /** Forget the key, both on disk and in this process. */
-    clear(): Promise<void>;
-}
-/**
- * Parse one CodeBuddy `*.info` payload.
- *
- * Only the fields this plugin needs are read; the file also carries the IDE's
- * own account bookkeeping, which is deliberately left untouched. A file without
- * a usable access token is rejected rather than half-accepted, so the scanner
- * can move on to the next candidate.
- */
-export declare function parseCredentialFile(value: unknown, sourceFile: string, sourceMtimeMs?: number): WorkBuddyCredentials;
-/** Whether a credential is at or near expiry; refreshed a minute early. */
-export declare function isExpired(credentials: WorkBuddyCredentials, now?: number): boolean;
-/**
- * Stable public key for selecting an account without exposing a token or tying
- * the preference to a timestamped snapshot filename.
- *
- * The chain is uid → uin → nickname → domain, and the reason it is safe is
- * **ordering**: {@link withResolvedIdentity} settles a credential's uid from
- * its own token before any id is derived, so a real sign-in and the IDE's file
- * for the same account both reach the uid branch and agree. The nickname rung
- * is only reached by a token whose claims cannot be read at all, and keeping it
- * there is what stops two such accounts in one region from collapsing onto the
- * shared deployment key below it.
- *
- * A nickname must therefore never be the *first* rung: that is what split one
- * account into two pool rows, because the browser-login response states the
- * display name while the IDE's file states the uid. Likewise the uid must be
- * settled *before* the id is minted, which is why the heal runs inside the
- * credential parsers and the pool's own account creation.
- */
-export declare function workBuddyAccountId(credentials: Pick<WorkBuddyCredentials, 'region' | 'uid' | 'uin' | 'nickname' | 'domain'>): string;
-/**
- * Every key one credential may have been addressable under.
- *
- * A settings document written before the identity fix pinned and hid accounts
- * by the old chain (`uid → uin → nickname → domain`), so an account that only
- * had a nickname stored was addressed as `region:<nickname>`. The heal moves
- * that account to its uid, and without this alias the stored pointer would
- * silently stop matching — a pinned account would fall back to automatic
- * routing and a hidden one would reappear. Callers therefore accept either
- * spelling; only the current one is ever written.
- */
-export declare function workBuddyAccountIdAliases(credentials: Pick<WorkBuddyCredentials, 'region' | 'uid' | 'uin' | 'nickname' | 'domain'>): string[];
-/** Strict parser for credentials owned by the plugin's encrypted pool. */
-export declare function parseManagedCredentials(value: unknown): WorkBuddyCredentials[];
-/**
- * Candidate ordering for the scanned credential files.
- *
- * A user's auth directory accumulates timestamped snapshots beside the live
- * file, and the live one is not always the newest. Preference order is: the
- * plain `workbuddy-desktop.info` / `codebuddy-desktop.info` files first, then
- * the newest `expiresAt` among the timestamped snapshots. Picking purely by
- * mtime selected a stale snapshot during development, so the token's own
- * expiry is what decides.
- */
-/** What the last credential scan observed about sealed (`$wbEncrypted`) files. */
-export interface SealedCredentialDiagnostics {
-    /** Sealed credential files the scan met. */
-    sealedFiles: number;
-    /** Of those, how many the held key opened. */
-    opened: number;
-    /** True when at least one sealed file was skipped because no key is held. */
-    missingKey: boolean;
-    /** Why the last sealed file refused to open, when it did. */
-    lastError: string | null;
-}
-/** Snapshot of the last scan's sealed-credential observations. */
-export declare function sealedCredentialDiagnostics(): SealedCredentialDiagnostics;
-/**
- * Resolve a credential's sealed tokens into usable plaintext.
- *
- * Returns `null` when the credential is sealed and this process holds no key
- * that opens it: such a file is not an error the caller can act on per-file, it
- * is a missing key the settings card reports once.
- */
-export declare function unsealCredentials<T extends WorkBuddyCredentials>(credentials: T): T | null;
-/**
- * Scan the CodeBuddy auth directory for usable credentials.
- *
- * Every `*.info` file is considered; unreadable or malformed ones are skipped
- * rather than failing the whole scan, because the directory routinely holds
- * expired snapshots next to the live credential.
- */
-export declare function scanCredentials(dir?: string): Promise<WorkBuddyCredentials[]>;
-/** Encrypted credentials added through the WorkBuddy settings page. */
-export declare class ManagedCredentialStore {
-    private readonly filePath;
-    private readonly backend;
-    constructor(filePath?: string, backend?: CredentialStore<{
-        version: 1;
-        accounts: WorkBuddyCredentials[];
-    }>);
-    path(): string;
-    private serialize;
-    list(): Promise<WorkBuddyCredentials[]>;
-    add(credentials: WorkBuddyCredentials): Promise<void>;
-    update(credentials: WorkBuddyCredentials): Promise<void>;
-    delete(accountId: string): Promise<boolean>;
-}
-/**
- * Credential store backed by the CodeBuddy desktop client's own auth files.
- *
- * The plugin does not own these files, so there is nothing to encrypt here: the
- * secret is the IDE's, already on disk, and the only write this store performs
- * is an atomic write-back of a refreshed token so the IDE does not lose its
- * session. Tokens are never sent to a browser.
- */
-export declare class FileCredentialStore {
-    private readonly dir;
-    /** How long a scan result is reused before the directory is re-read. */
-    private readonly cacheTtlMs;
-    private readonly managed;
-    private cached;
-    private scannedAt;
-    /** Serializes refresh/write-back per account; different accounts never share a token. */
-    private readonly refreshInFlight;
-    constructor(dir?: string, 
-    /** How long a scan result is reused before the directory is re-read. */
-    cacheTtlMs?: number, managed?: ManagedCredentialStore);
-    /** Directory this store scans. */
-    directory(): string;
-    /** Human-readable storage description for the settings card. */
-    path(): string;
-    managedPath(): string;
-    /** Read the selected credential, or the best visible candidate in automatic mode. */
-    read(options?: {
-        force?: boolean;
-        accountId?: string | null;
-        hiddenAccountIds?: readonly string[];
-    }): Promise<WorkBuddyCredentials | null>;
-    /** Whether a cached credential's source file is unchanged on disk. */
-    private isStillCurrent;
-    /**
-     * All distinct usable accounts, best credential first.
-     *
-     * The desktop directory keeps historical snapshots. They are credentials for
-     * the same account, not additional account choices, so only the first (best)
-     * candidate for each stable account id is exposed.
-     */
-    list(): Promise<WorkBuddyCredentials[]>;
-    /**
-     * Desktop credentials only, best first.
-     *
-     * The account pool adopts these so the IDE's own sign-ins take part in
-     * scheduling. Unlike {@link list} this never mixes in managed accounts:
-     * only the desktop set is re-adopted when the IDE changes its directory.
-     */
-    discoverDesktopCredentials(): Promise<WorkBuddyCredentials[]>;
-    /**
-     * Re-read one desktop credential file.
-     *
-     * A pooled desktop account must serve the IDE's current token rather than
-     * the copy taken when it was adopted, because the IDE rotates that token on
-     * its own schedule. Returns null when the file is gone or unreadable.
-     */
-    readDesktopFile(filePath: string): Promise<WorkBuddyCredentials | null>;
-    addManaged(credentials: WorkBuddyCredentials): Promise<void>;
-    deleteManaged(accountId: string): Promise<boolean>;
-    /** Forget the cached scan; the next read re-reads the directory. */
-    invalidate(): void;
-    /**
-     * Return a credential whose access token is valid, refreshing it first when
-     * it is at or near expiry.
-     *
-     * Concurrent callers share one refresh: the refresh token rotates, so two
-     * simultaneous refreshes would invalidate each other.
-     */
-    ensureFresh(credentials: WorkBuddyCredentials, refresh: (current: WorkBuddyCredentials) => Promise<WorkBuddyCredentials>): Promise<WorkBuddyCredentials>;
-    /**
-     * Persist a refreshed token back into the IDE's own credential file.
-     *
-     * Only the `auth` block is rewritten, and the write is atomic so a crash
-     * cannot leave the IDE with a half-written file. A failure here is not fatal
-     * to the in-flight request: the refreshed token still works for this process,
-     * and the next scan simply finds the older token on disk.
-     */
-    writeBack(credentials: WorkBuddyCredentials): Promise<void>;
-}
-/** Plain-JSON model settings used when the settings service is unavailable. */
-export declare class FileModelSettingsStore {
-    private readonly filePath;
-    constructor(filePath?: string);
-    path(): string;
-    read(): Promise<WorkBuddyModelSettings>;
-    write(settings: WorkBuddyModelSettings): Promise<void>;
-    updateSettings(patch: {
-        enabled?: boolean;
-        enabledModelIds?: string[];
-        /** `null` deletes one override and falls back to the catalog default. */
-        contextWindowOverrides?: ContextWindowOverridePatch;
-        defaultReasoningEffort?: WorkBuddyReasoningEffort | null;
-        selectedAccountId?: string | null;
-        hiddenAccountIds?: string[];
-        checkin?: Partial<WorkBuddyCheckinSettings>;
-        outboundIdentity?: WorkBuddyOutboundSetting;
-        guardrails?: Partial<WorkBuddyGuardrails>;
-    }): Promise<WorkBuddyModelSettings>;
-}
-export { isIntlDomain };
-//# sourceMappingURL=token-store.d.ts.map

package/lib/types/host/workbuddy/token-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/token-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAI9H,OAAO,EAA+B,KAAK,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAGpH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAA;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAIxD,OAAO,EAGL,YAAY,EAEb,MAAM,YAAY,CAAA;AAEnB,eAAO,MAAM,+BAA+B,kBAAkB,CAAA;AAE9D,YAAY,EAAE,wBAAwB,EAAE,CAAA;AAOxC;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,MAAM,EAAE,eAAe,CAAA;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC3D;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,sBAAsB,EAAE,wBAAwB,GAAG,IAAI,CAAA;IACvD,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,iFAAiF;IACjF,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,4CAA4C;IAC5C,OAAO,EAAE,wBAAwB,CAAA;IACjC;;;;;;OAMG;IACH,gBAAgB,EAAE,wBAAwB,CAAA;IAC1C,kDAAkD;IAClD,UAAU,EAAE,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;OAQG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,IAAI,sBAAsB,CAAA;IAChC,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;QAC1B,yEAAyE;QACzE,sBAAsB,CAAC,EAAE,0BAA0B,CAAA;QACnD,sBAAsB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;QACxD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACjC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC3B,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAC3C,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;QAC3C,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;KAC1C,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;CACpC;AAID,oCAAoC;AACpC,eAAO,MAAM,wBAAwB,EAAE,wBAA4C,CAAA;AAEnF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAGjF;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,CAAC,EAAE,OAAO,EAClB,aAAa,yBAA+B,GAC3C,wBAAwB,CAgH1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAazC;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,uFAAuF;AACvF,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAaD;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAIhC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,MAAM,CAAsB;gBAGjB,QAAQ,SAAkB,EAC1B,OAAO,GAAE,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAoC;IAG9G,wEAAwE;IACxE,IAAI,IAAI,MAAM;IAMd;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBpC,4EAA4E;IACtE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW1C,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B;AAaD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,SAAI,GAAG,oBAAoB,CAsD/G;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,SAAa,GAAG,OAAO,CAGtF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GACxF,MAAM,CAGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GACxF,MAAM,EAAE,CAeV;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,CA8B9E;AAED;;;;;;;;;GASG;AACH,kFAAkF;AAClF,MAAM,WAAW,2BAA2B;IAC1C,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAA;IACnB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AASD,kEAAkE;AAClE,wBAAgB,2BAA2B,IAAI,2BAA2B,CAEzE;AAOD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,oBAAoB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAsB1F;AAMD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,GAAG,SAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAiC/F;AAgBD,uEAAuE;AACvE,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,QAAQ,SAA2B,EACnC,OAAO,GAAE,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC;QAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAA;KAAE,CAA4C;IAGxI,IAAI,IAAI,MAAM;IAMd,OAAO,CAAC,SAAS;IAWX,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAUvC,GAAG,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBrD,MAAM,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlD;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,SAAS,CAAI;IACrB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;gBAGhE,GAAG,SAAqB;IACzC,wEAAwE;IACvD,UAAU,SAAS,EACnB,OAAO,yBAA+B;IAGzD,kCAAkC;IAClC,SAAS,IAAI,MAAM;IAInB,gEAAgE;IAChE,IAAI,IAAI,MAAM;IAId,WAAW,IAAI,MAAM;IAIrB,qFAAqF;IAC/E,IAAI,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA0BpJ,sEAAsE;YACxD,cAAc;IAY5B;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAc7C;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAInE;;;;;;OAMG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAWvE,UAAU,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMxD,oEAAoE;IACpE,UAAU,IAAI,IAAI;IAKlB;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,oBAAoB,EACjC,OAAO,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,oBAAoB,CAAC,GACxE,OAAO,CAAC,oBAAoB,CAAC;IAuBhC;;;;;;;OAOG;IACG,SAAS,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;CAmClE;AAED,+EAA+E;AAC/E,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAsB;IAE3D,IAAI,IAAI,MAAM;IAIR,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAkDvC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,cAAc,CAAC,KAAK,EAAE;QAC1B,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;QAC1B,yEAAyE;QACzE,sBAAsB,CAAC,EAAE,0BAA0B,CAAA;QACnD,sBAAsB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;QACxD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACjC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC3B,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAC3C,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;QAC3C,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;KAC1C,GAAG,OAAO,CAAC,sBAAsB,CAAC;CA+BpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/lib/types/host/workbuddy/types.d.ts

@@ -1,161 +0,0 @@
-/**
- * Static facts about the WorkBuddy / CodeBuddy subscription backend.
- *
- * WorkBuddy is Tencent's CodeBuddy IDE subscription. Its model backend is a
- * plain OpenAI-compatible `/chat/completions` endpoint that the official IDE
- * calls directly; this plugin speaks the same wire instead of going through a
- * converter process.
- *
- * Everything asserted here was measured against a live subscription (see the
- * comments on each constant); the surprising constraints are that the endpoint
- * is **stream-only** and that the international region requires the first
- * message to be a system prompt.
- */
-import type { WorkBuddyRegion } from '../../shared/workbuddy-contracts.ts';
-export declare const PROVIDER_ID = "workbuddy-subscription";
-export declare const PROVIDER_NAME = "WorkBuddy\uFF08CodeBuddy \u8BA2\u9605\uFF09";
-/** Domestic backend. */
-export declare const CN_BACKEND = "https://copilot.tencent.com";
-/**
- * Domains whose accounts live on a region-specific backend.
- *
- * A credential's `auth.domain` decides both the backend host and the region:
- * `*.workbuddy.ai` / `*.codebuddy.ai` are international, anything else is the
- * domestic `copilot.tencent.com` deployment.
- */
-export declare const INTL_DOMAIN_SUFFIXES: readonly [".workbuddy.ai", ".codebuddy.ai"];
-/** Default auth domain when a credential does not record one. */
-export declare const DEFAULT_DOMAIN = "www.codebuddy.cn";
-/** Chat surface, appended to a region backend. */
-export declare const CHAT_PATH = "/v2/chat/completions";
-/**
- * Gateway configuration/catalog surface.
- *
- * This is where the real model list lives: the chat host answers 404 to
- * `/v1/models`, but `/v3/config` returns every model with its context window,
- * output cap, image support, and accepted reasoning ladder. The official CLI
- * reads it at startup.
- */
-export declare const CONFIG_PATH = "/v3/config";
-/** Token refresh surface; the official IDE posts the refresh token here. */
-export declare const REFRESH_PATH = "/v2/plugin/auth/token/refresh";
-/** Billing/allowance surface; answers the per-package credit picture. */
-export declare const BILLING_PATH = "/billing/meter/get-user-resource";
-/**
- * Current-account surface.
- *
- * The browser-authorization token response carries only the `auth` block, so
- * the signed-in account's uid / nickname / UIN come from here — the same
- * endpoint the official client reads its account from. Measured live on both
- * deployments: it answers with the full account record for a valid bearer.
- */
-export declare const ACCOUNT_PATH = "/v2/plugin/account";
-/** Browser authorization state and credential-poll surfaces used by the CLI. */
-export declare const LOGIN_STATE_PATH = "/v2/plugin/auth/state";
-export declare const LOGIN_TOKEN_PATH = "/v2/plugin/auth/token";
-export declare const LOGIN_PLATFORM = "cli";
-export declare const LOGIN_PENDING_CODE = 11217;
-export declare const LOGIN_POLL_INTERVAL_MS = 1500;
-export declare const LOGIN_TIMEOUT_MS: number;
-/**
- * User-Agent every request carries.
- *
- * Measured: `CodeBuddyIDE` is accepted by the chat endpoint but rejected by
- * `/v3/config` with 400 `code 12403` ("check ua, get coding copilot version
- * error"), and the international chat endpoint answers 401 to it outright. The
- * CLI identity is accepted by all three surfaces on both regions, so it is the
- * single identity this route uses rather than switching per endpoint.
- */
-export declare const CLIENT_USER_AGENT = "CLI/2.63.2 CodeBuddy/2.63.2";
-/** Client identity headers the gateway gates on. */
-export declare const HEADER_USER_ID = "x-user-id";
-export declare const HEADER_ENTERPRISE_ID = "x-enterprise-id";
-export declare const HEADER_TENANT_ID = "x-tenant-id";
-export declare const HEADER_DOMAIN = "x-domain";
-export declare const HEADER_PRODUCT = "x-product";
-export declare const HEADER_IDE_NAME = "x-ide-name";
-export declare const HEADER_REQUESTED_WITH = "x-requested-with";
-export declare const CLIENT_PRODUCT = "SaaS";
-/**
- * Conversation header group the international gateway gates on.
- *
- * Measured 2026-10 on `www.workbuddy.ai`: a request carrying the identity
- * headers alone answers 400 `code 11128` whatever its message shape, while
- * adding exactly these five answers 200 with a normal SSE body. The other
- * headers the official client sends (trace context, `X-Agent-Intent`,
- * `X-Agent-Purpose`, `x-codebuddy-request`, its own user agent) were added one
- * at a time and each left the outcome unchanged, so this group is the minimal
- * sufficient set rather than a copy of the whole client.
- */
-export declare const HEADER_CONVERSATION_ID = "x-conversation-id";
-export declare const HEADER_CONVERSATION_REQUEST_ID = "x-conversation-request-id";
-export declare const HEADER_CONVERSATION_MESSAGE_ID = "x-conversation-message-id";
-export declare const HEADER_REQUEST_ID = "x-request-id";
-export declare const HEADER_ACP_CONNECTION_ID = "acp-connection-id";
-/** Refresh-token header the token endpoint reads. */
-export declare const HEADER_REFRESH_TOKEN = "x-refresh-token";
-/** Refresh origin marker; `workbuddy` for the .ai domains, `plugin` otherwise. */
-export declare const HEADER_REFRESH_SOURCE = "x-auth-refresh-source";
-/** Timeouts and cache lifetimes. */
-export declare const DISCOVERY_TIMEOUT_MS = 20000;
-export declare const CHAT_TIMEOUT_MS = 300000;
-export declare const QUOTA_CACHE_TTL_MS: number;
-export declare const STREAM_IDLE_TIMEOUT_MS = 300000;
-export declare const STREAM_IDLE_TIMEOUT_CODE = "LLM_STREAM_IDLE_TIMEOUT";
-export declare const DEFAULT_MAX_TOKENS = 32768;
-export declare const DEFAULT_CONTEXT_WINDOW = 128000;
-/**
- * Output cap for the models the catalog does not pin individually.
- *
- * The subscription models are served by several upstream vendors whose own
- * published caps differ; this is the conservative ceiling the request builder
- * uses when nothing more specific is known.
- */
-export declare const FALLBACK_MAX_TOKENS = 32768;
-/** Subscription backend error codes, all measured. */
-export declare const ERROR_CODE: {
-    /** Request parameters rejected (bad image payload, unsupported field). */
-    readonly BAD_REQUEST: 11101;
-    /** Model not served in this region — a wrong-region request. */
-    readonly MODEL_UNAVAILABLE: 11102;
-    /**
-     * Gateway channel verification refused the request.
-     *
-     * The code is overloaded upstream, so the message — not the code — decides
-     * what it means. Measured 2026-09: the international chat endpoint answers it
-     * for a request that does not open with a system turn. Measured 2026-10: the
-     * same code, with `msg: "conversation id missing"`, is the answer to *every*
-     * request that omits the {@link HEADER_CONVERSATION_ID} group, whatever its
-     * message shape. Read `msg` before concluding the history is at fault.
-     */
-    readonly SECURITY_BLOCKED: 11128;
-    /** Provider rejected the parameters, e.g. an unsupported image for that model. */
-    readonly PROVIDER_REJECTED: 11133;
-    /** Upstream vendor error. */
-    readonly UPSTREAM_ERROR: 11134;
-    /** Image could not be decoded or is not an accepted format. */
-    readonly INVALID_IMAGE: 11135;
-    /** Unsupported reasoning effort value. */
-    readonly INVALID_REASONING: 11150;
-    /** Usage exceeds the frequency limit; the message carries the reset instant. */
-    readonly RATE_LIMITED: 6004;
-    /** Generic usage-limit signal seen alongside 429s. */
-    readonly USAGE_LIMIT: 14003;
-};
-/** Whether an auth domain belongs to the international deployment. */
-export declare function isIntlDomain(domain: string): boolean;
-/** Region one credential belongs to, decided by its auth domain. */
-export declare function regionForDomain(domain: string): WorkBuddyRegion;
-/**
- * Backend base URL for an auth domain.
- *
- * International accounts are served from the same apex as their auth domain
- * (`www.workbuddy.ai`, `www.codebuddy.ai`); everything else uses the domestic
- * gateway.
- */
-export declare function backendForDomain(domain: string): string;
-/** Refresh-source marker the token endpoint expects for one domain. */
-export declare function refreshSourceForDomain(domain: string): string;
-/** `www.workbuddy.ai` / `www.codebuddy.ai` origin used for CORS headers. */
-export declare function originForDomain(domain: string): string;
-//# sourceMappingURL=types.d.ts.map

package/lib/types/host/workbuddy/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAI1E,eAAO,MAAM,WAAW,2BAA2B,CAAA;AACnD,eAAO,MAAM,aAAa,gDAA4B,CAAA;AAEtD,wBAAwB;AACxB,eAAO,MAAM,UAAU,gCAAgC,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,6CAA8C,CAAA;AAE/E,iEAAiE;AACjE,eAAO,MAAM,cAAc,qBAAqB,CAAA;AAEhD,kDAAkD;AAClD,eAAO,MAAM,SAAS,yBAAyB,CAAA;AAC/C;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,eAAe,CAAA;AACvC,4EAA4E;AAC5E,eAAO,MAAM,YAAY,kCAAkC,CAAA;AAC3D,yEAAyE;AACzE,eAAO,MAAM,YAAY,qCAAqC,CAAA;AAC9D;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,uBAAuB,CAAA;AAChD,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,0BAA0B,CAAA;AACvD,eAAO,MAAM,gBAAgB,0BAA0B,CAAA;AACvD,eAAO,MAAM,cAAc,QAAQ,CAAA;AACnC,eAAO,MAAM,kBAAkB,QAAQ,CAAA;AACvC,eAAO,MAAM,sBAAsB,OAAQ,CAAA;AAC3C,eAAO,MAAM,gBAAgB,QAAgB,CAAA;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,gCAAgC,CAAA;AAE9D,oDAAoD;AACpD,eAAO,MAAM,cAAc,cAAc,CAAA;AACzC,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AACrD,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAC7C,eAAO,MAAM,aAAa,aAAa,CAAA;AACvC,eAAO,MAAM,cAAc,cAAc,CAAA;AACzC,eAAO,MAAM,eAAe,eAAe,CAAA;AAC3C,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,cAAc,SAAS,CAAA;AAEpC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,8BAA8B,8BAA8B,CAAA;AACzE,eAAO,MAAM,8BAA8B,8BAA8B,CAAA;AACzE,eAAO,MAAM,iBAAiB,iBAAiB,CAAA;AAC/C,eAAO,MAAM,wBAAwB,sBAAsB,CAAA;AAE3D,qDAAqD;AACrD,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AACrD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,0BAA0B,CAAA;AAE5D,oCAAoC;AACpC,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAC1C,eAAO,MAAM,eAAe,SAAU,CAAA;AACtC,eAAO,MAAM,kBAAkB,QAAgB,CAAA;AAC/C,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAC7C,eAAO,MAAM,wBAAwB,4BAA4B,CAAA;AAEjE,eAAO,MAAM,kBAAkB,QAAS,CAAA;AACxC,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,sDAAsD;AACtD,eAAO,MAAM,UAAU;IACrB,0EAA0E;;IAE1E,gEAAgE;;IAEhE;;;;;;;;;OASG;;IAEH,kFAAkF;;IAElF,6BAA6B;;IAE7B,+DAA+D;;IAE/D,0CAA0C;;IAE1C,gFAAgF;;IAEhF,sDAAsD;;CAE9C,CAAA;AAEV,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD"}