@eddyskywalker/dsh-chatgpt-subscription 0.46.1 → 0.47.0

package/lib/types/host/workbuddy/client.d.ts

@@ -0,0 +1,214 @@
+import type { WorkBuddyAccount, WorkBuddyAccountQuota, WorkBuddyMeter } from '../../shared/workbuddy-contracts.ts';
+import { type WorkBuddyOutboundProduct } from './outbound-identity.ts';
+import { PROVIDER_ID, PROVIDER_NAME } from './types.ts';
+import { FileCredentialStore, type WorkBuddyCredentials } from './token-store.ts';
+import type { WorkBuddyTokenIdentity } from './identity.ts';
+import { type WorkBuddyModelEntry } from './model-catalog.ts';
+export interface WorkBuddyRequestOptions {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+}
+/**
+ * Which chat surface a call is, for the headers only that surface needs.
+ *
+ * Passing this opts the request into the conversation header group. It is
+ * deliberately a separate argument rather than a consequence of `sessionId`
+ * being present: the group belongs to the chat endpoint's channel check, and
+ * the config, billing, refresh and check-in surfaces keep the exact header set
+ * they already worked with.
+ */
+export interface WorkBuddyChannelOptions {
+    /**
+     * Which client identity this request presents.
+     *
+     * Omitted means the line's shipped identity (`cli`). Only the chat call ever
+     * sets it: the config, billing and refresh surfaces are the ones measured to
+     * accept the CLI identity, and the choice exists for the chat fingerprint.
+     */
+    product?: WorkBuddyOutboundProduct;
+    /**
+     * Harness session the chat call belongs to.
+     *
+     * Omit it for a call with no conversation behind it (the connection-test
+     * probe). The group is still sent — the gateway requires it either way — but
+     * the scoped ids fall back to random values.
+     */
+    sessionId?: string;
+    /**
+     * Stable per-account key the conversation ids are derived from.
+     *
+     * Load-bearing for the pool: two accounts sending the SAME conversation id
+     * would present one device signing in as two identities, which is exactly
+     * what the gateway's channel check exists to catch. Naming the account here is
+     * what keeps every account's ids its own.
+     */
+    accountKey?: string;
+    /**
+     * One user send, as `userTurnKey` in `mapper.ts` derives it.
+     *
+     * Every tool step, retry and renewal replay of the SAME user turn keeps this
+     * value, so the gateway reads one send rather than N unrelated requests; the
+     * user's next message changes it. Absent or empty means "no turn to name" and
+     * degrades to a fresh id, which is the behaviour every non-chat surface keeps.
+     */
+    turnKey?: string;
+    /**
+     * This call goes to the Anthropic Messages surface.
+     *
+     * Adds its protocol headers. Deliberately explicit rather than inferred from
+     * the URL: the two surfaces want different header sets, and a call that
+     * guessed wrong would be refused for a reason the caller could have stated.
+     */
+    messages?: boolean;
+}
+/**
+ * Attribution and identity headers for one backend request.
+ *
+ * The gateway gates on this header set: the international deployment answers
+ * 401 without the CLI user agent and matching `Origin`/`Referer`, and both
+ * deployments read the account identity headers rather than deriving it from
+ * the bearer token alone.
+ *
+ * `channel` marks a request to the chat endpoint, which is the only surface
+ * whose channel check wants the {@link conversationHeaders} group.
+ */
+export declare function workBuddyHeaders(credentials: Pick<WorkBuddyCredentials, 'accessToken' | 'domain' | 'uid' | 'enterpriseId' | 'backend'>, extra?: Record<string, string>, channel?: WorkBuddyChannelOptions): Record<string, string>;
+/**
+ * Content coding a chat request's body is sent with.
+ *
+ * Measured: the official CLI's `GzipRequestProcessor` compresses each POST's
+ * body and sets `Content-Encoding: gzip`, and both builds turn that feature on.
+ * The saving is not marginal — a long agent conversation re-sends its whole
+ * history on every step, which plain-JSON uploads made bytes-on-the-wire the
+ * dominant cost of using this route.
+ *
+ * Only a chat completion is compressed: the same fetch also serves surfaces
+ * whose parser reads plain JSON (the images API answers 400 `code 11101`
+ * "invalid character '\\x1f'" to a gzipped body), so the caller opts in by
+ * calling this rather than every request getting it.
+ */
+export declare const GZIP_CONTENT_ENCODING = "gzip";
+/** One chat body, compact JSON, gzipped for the wire. */
+export declare function gzipChatBody(body: string): Uint8Array;
+/** Header set that declares one request's body coding. */
+export declare function encodedBodyHeaders(encoding: string | undefined): Record<string, string>;
+/**
+ * Refresh an access token against the endpoint the official IDE uses.
+ *
+ * The response carries a whole new `auth` block rather than just a token, so it
+ * is merged over the current one: fields the endpoint omits (the domain, the
+ * refresh lifetime) must survive, or the next refresh would lose its target.
+ */
+export declare function refreshCredentials(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions): Promise<WorkBuddyCredentials>;
+/** Public account facts for the settings card. */
+export declare function accountFromCredentials(credentials: WorkBuddyCredentials): WorkBuddyAccount;
+/**
+ * Read the signed-in account for a credential.
+ *
+ * The browser-authorization token response states the access token and the
+ * refresh token but **not** which account they belong to, so a login that
+ * relied on it alone could only key the account by the display name it also
+ * did not have — which is where the duplicate row and the `账号 1` label came
+ * from. The official client reads the account from this same endpoint right
+ * after polling the token; measured live, it returns the uid, the nickname,
+ * the UIN and the enterprise id for a valid bearer.
+ *
+ * A failure is not fatal to the sign-in: the token is usable, so the caller
+ * keeps the credential it has and lets the token's own claims fill in what
+ * they can.
+ */
+export declare function fetchAccountIdentity(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions): Promise<WorkBuddyTokenIdentity | null>;
+/**
+ * Parse one `/v3/config` payload's model list.
+ *
+ * Each entry carries the facts this route needs directly, so nothing is
+ * inferred from the model's name. Image-generation tools (`tags` naming
+ * `text-to-image`/`image-to-image`) are skipped: they are not chat models and
+ * carry no context window.
+ *
+ * `credits` is read here rather than left to the shipped table because a
+ * reachable gateway **replaces** that table entirely: a multiplier transcribed
+ * offline would be the only one a signed-in user ever saw, and it would stay
+ * wrong the moment the subscription repriced a model. A string this route cannot
+ * turn into a number (`''`, which `default-model` publishes, or a value a
+ * future gateway invents) leaves the field off the entry altogether instead of
+ * writing a plausible-looking `0` — see `parseWorkBuddyCreditMultiplier`.
+ */
+export declare function parseConfigModels(payload: unknown, region: WorkBuddyCredentials['region']): WorkBuddyModelEntry[];
+export declare function getCachedCatalog(): WorkBuddyModelEntry[];
+export declare function clearCachedCatalog(): void;
+/**
+ * Fetch the live catalog for one account.
+ *
+ * The gateway is the authority on capabilities, so a successful read replaces
+ * the shipped table entirely; a failure returns an empty list and the caller
+ * falls back, which keeps a first run usable before sign-in.
+ */
+export declare function fetchConfigCatalog(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions): Promise<WorkBuddyModelEntry[]>;
+/** Cached catalog with a TTL; a failed refresh keeps the previous snapshot.
+ *
+ * On the first cache miss of a process the persisted snapshot is rehydrated
+ * first, so a restart serves the previous listing without waiting on the
+ * network. An expired snapshot still answers immediately (stale) while a
+ * refresh runs in the background — the catalog is not fast-moving data, and
+ * waiting on an unreachable gateway turned a restart into the full discovery
+ * timeout on every model resolution.
+ */
+export declare function loadConfigCatalog(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions & {
+    force?: boolean;
+}): Promise<WorkBuddyModelEntry[]>;
+/** Parse one `Capacity*` account record into the public quota shape. */
+export interface ParsedBilling {
+    packageName: string | null;
+    totalCredits: number | null;
+    remainingCredits: number | null;
+    cycleUsedCredits: number | null;
+    cycleCredits: number | null;
+    cycleStartsAt: number | null;
+    cycleEndsAt: number | null;
+}
+/**
+ * Parse the billing payload's account list.
+ *
+ * The response nests as `data.Response.Data.Accounts[]`; each entry describes
+ * one purchased package with its own capacity counters. The first entry is the
+ * active subscription, and the totals are summed across all of them because a
+ * user can hold several packages at once.
+ */
+export declare function parseBilling(payload: unknown): ParsedBilling;
+/**
+ * Parse a cycle boundary.
+ *
+ * The service sends these as local-time strings without a zone
+ * (`2026-09-01 00:00:00`), which `Date.parse` reads as local time — the same
+ * reading the IDE's own panel uses, so the card agrees with it.
+ */
+export declare function parseCycleTime(value: unknown): number | null;
+/** Turn a parsed billing snapshot into the meters the card renders. */
+export declare function billingMeters(billing: ParsedBilling): WorkBuddyMeter[];
+/**
+ * The snapshot read most recently, whichever account it belongs to.
+ *
+ * Kept with a no-argument signature for backward compatibility; the page-level
+ * facts use {@link getCachedQuotaFor} instead, because they describe one
+ * account and must never be another account's numbers.
+ */
+export declare function getCachedQuota(): WorkBuddyAccountQuota | undefined;
+/**
+ * The snapshot remembered for one account, if it was read before.
+ *
+ * This is the lookup the account pool calls while it builds its summaries: a
+ * pure memory read, never a fetch. Passing no account keeps the pre-pool
+ * behavior of returning whatever was fetched last.
+ */
+export declare function getCachedQuotaFor(accountId?: string | null): WorkBuddyAccountQuota | undefined;
+export declare function clearCachedQuota(): void;
+/**
+ * Read the account's credit allowance.
+ *
+ * Only one billing route exists here, so a failure is a real failure rather
+ * than a partially-answered snapshot: the caller decides whether to surface it.
+ */
+export declare function fetchAccountQuota(store?: FileCredentialStore, fetchFn?: typeof fetch, force?: boolean, accountId?: string | null, hiddenAccountIds?: readonly string[]): Promise<WorkBuddyAccountQuota>;
+export { PROVIDER_ID, PROVIDER_NAME };
+//# sourceMappingURL=client.d.ts.map

package/lib/types/host/workbuddy/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACf,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAsBL,WAAW,EACX,aAAa,EAKd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,mBAAmB,EAAsB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAErG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAQpF,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AA4CD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAA;IAClC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAwDD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,QAAQ,GAAG,KAAK,GAAG,cAAc,GAAG,SAAS,CAAC,EACtG,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAClC,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA+BxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,SAAS,CAAA;AAE3C,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAIrD;AAED,0DAA0D;AAC1D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAoD/B;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,oBAAoB,GAAG,gBAAgB,CAiB1F;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAyBxC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,mBAAmB,EAAE,CA8EjH;AAkBD,wBAAgB,gBAAgB,IAAI,mBAAmB,EAAE,CAExD;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAMzC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAAuB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1D,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAyDhC;AAiDD,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAwC5D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQ5D;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,EAAE,CAmCtE;AA4CD;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,qBAAqB,GAAG,SAAS,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,qBAAqB,GAAG,SAAS,CAG9F;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,sBAA4B,EACjC,OAAO,GAAE,OAAO,KAAa,EAC7B,KAAK,UAAQ,EACb,SAAS,GAAE,MAAM,GAAG,IAAW,EAC/B,gBAAgB,GAAE,SAAS,MAAM,EAAO,GACvC,OAAO,CAAC,qBAAqB,CAAC,CAmEhC;AAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA"}

package/lib/types/host/workbuddy/dsml.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Recovery of tool calls the model PRINTED instead of emitting structurally.
+ *
+ * Measured upstream behaviour (and the reason workbuddy2api-hub has the same
+ * recovery, `wb_proxy.py` "Printed tool calls on the Chat Completions path"):
+ * a tools request sometimes answers with the call spelled out inside `content`
+ * — either the full-width DSML form
+ *
+ *     <||DSML|| calls><||DSML|| invoke name="run_code">
+ *       <||DSML|| parameter name="code">print(1)</||DSML|| parameter>
+ *     </||DSML|| invoke></||DSML|| calls>
+ *
+ * or a hybrid the model mixes on its own: a plain opening tag closed by DSML
+ * tags, with the first parameter's close tag swallowed. Forwarded verbatim the
+ * client sees prose, finds no call, and the turn simply ends — reported by
+ * users as "it keeps stopping by itself".
+ *
+ * A structured `tool_calls` delta always wins; this only runs for text, which
+ * is why the recovery is a pure function over the accumulated content.
+ */
+/** One recovered call, in the shape the mapper emits. */
+export interface PrintedToolCall {
+    id: string;
+    name: string;
+    arguments: string;
+}
+/** A successful recovery: the calls plus the prose left behind. */
+export interface PrintedRecovery {
+    calls: PrintedToolCall[];
+    clean: string;
+}
+/** Recover the full-width `<||DSML|| …>` spelling. */
+export declare function parseDsmlToolCalls(text: string): PrintedRecovery | null;
+/**
+ * Recover the hybrid spelling, driven by the `<parameter>` elements.
+ *
+ * Parameter elements are spelled the same way in both shapes and a parameter
+ * name is the one thing a call cannot do without, so they are the anchor; the
+ * nearest preceding opening tag that is neither a wrapper nor a parameter names
+ * the tool.
+ */
+export declare function parseLeakedToolCalls(text: string): PrintedRecovery | null;
+/** Recover a printed call under either spelling. */
+export declare function recoverPrintedToolCalls(text: string): PrintedRecovery | null;
+/**
+ * Index from which a streaming text buffer must be held back.
+ *
+ * The earliest `<` that either opens a recognisable tag or could still grow
+ * into one (a delta may split `<parameter` across frames), or -1 when the
+ * whole buffer is safe to emit as prose.
+ */
+export declare function printedCallHoldIndex(text: string): number;
+/** Whether a held buffer has already reached a closing tag. */
+export declare function printedCallLooksComplete(text: string): boolean;
+//# sourceMappingURL=dsml.d.ts.map

package/lib/types/host/workbuddy/dsml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsml.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/dsml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AA2CD,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAiBvE;AAiBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAyFzE;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAE5E;AAgBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,+DAA+D;AAC/D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D"}

package/lib/types/host/workbuddy/guardrails.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Local quota guardrails for the WorkBuddy line.
+ *
+ * The subscription meters an account × model over a 24h window (429 `code
+ * 6004`), but it only says so AFTER the window is gone — and on the shared
+ * account that window is minutes of a large model or a day of a small one. These
+ * guardrails stop serving BEFORE that happens, so an exhausted window never has
+ * to be discovered by a user staring at a 429.
+ *
+ * Three of the four guardrails workbuddy2api-hub ships are reproduced here, and
+ * all three are EXACT — they read numbers this plugin already has:
+ *
+ *   reserveCredits    stop the account when its remaining credits fall below N
+ *                     (the billing snapshot already reports the remainder)
+ *   dailyTokens       stop the account for the rest of the local day at N tokens
+ *   modelDailyTokens  stop ONE model for the rest of the local day at N tokens
+ *
+ * The fourth one there — a daily CREDITS budget — is deliberately NOT
+ * reproduced: a request's credit cost is not on the wire this route reads, and
+ * deriving it from the catalog multiplier × tokens would invent a number that
+ * silently diverges from the bill. A guardrail that lies is worse than none.
+ *
+ * `0` means OFF for every field, and the default is all-off: an install that
+ * never opens this setting behaves exactly as before.
+ */
+import type { WorkBuddyGuardrailsDto } from '../../shared/workbuddy-contracts.ts';
+/**
+ * The three exact guardrails.
+ *
+ * The shape has ONE definition — the shared wire contract — so the card and the
+ * enforcement can never disagree about a field name.
+ */
+export type WorkBuddyGuardrails = WorkBuddyGuardrailsDto;
+/** Shipped default: every guardrail off. */
+export declare const DEFAULT_GUARDRAILS: WorkBuddyGuardrails;
+/** Narrow a stored or patched value into guardrails; anything unusable means off. */
+export declare function normalizeGuardrails(value: unknown): WorkBuddyGuardrails;
+/** Whether any guardrail is armed; a no-op check must stay cheap. */
+export declare function guardrailsArmed(guardrails: WorkBuddyGuardrails): boolean;
+/**
+ * The local calendar day a counter belongs to.
+ *
+ * Local, not UTC, because the reset the user reasons about is their own
+ * midnight — the same choice this line makes for the CN check-in day.
+ */
+export declare function localDayKey(now?: number): string;
+/** Per-account counters for one day. */
+export interface UsageLedgerEntry {
+    tokens: number;
+    perModel: Record<string, number>;
+}
+/** Where the local usage counters live. */
+export declare function usageLedgerPath(): string;
+/**
+ * Token counters per account per local day.
+ *
+ * Deliberately a small persisted document rather than an accounting system: it
+ * exists to answer one question ("has this account / model used its day?") and a
+ * restart must not forget it, or a guardrail would reset by restarting DSH.
+ */
+export declare class WorkBuddyUsageLedger {
+    private readonly filePath;
+    private readonly now;
+    private document;
+    private loaded;
+    private writing;
+    constructor(filePath?: string, now?: () => number);
+    /** Read the counters once; a missing or unreadable file starts a fresh day. */
+    load(): Promise<void>;
+    /** Drop yesterday's counters the moment a read notices the day changed. */
+    private rollIfNewDay;
+    /** Tokens one account has used today, across models. */
+    tokensToday(accountId: string): number;
+    /** Tokens one account has used today on one model. */
+    modelTokensToday(accountId: string, model: string): number;
+    /** Today's counters, for the settings card and for tests. */
+    snapshot(): Readonly<Record<string, UsageLedgerEntry>>;
+    /**
+     * Add one request's tokens.
+     *
+     * Serialized through a promise chain: two concurrent requests on different
+     * accounts would otherwise read the same document, add their own counts and
+     * write, losing one of them.
+     */
+    record(accountId: string, model: string, tokens: number): Promise<void>;
+    private persist;
+}
+/** Why an account may not serve a request. */
+export type GuardrailReason = 'reserve-credits' | 'daily-tokens' | 'model-daily-tokens';
+/** The verdict for one account on one model. */
+export type GuardrailVerdict = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: GuardrailReason;
+    detail: string;
+};
+/**
+ * Decide whether one account may serve one model right now.
+ *
+ * Pure on purpose: every number it reads is passed in, so the decision can be
+ * tested without a pool, a clock or a network.
+ */
+export declare function evaluateGuardrails(input: {
+    guardrails: WorkBuddyGuardrails;
+    tokensToday: number;
+    modelTokensToday: number;
+    /** Remaining credits from the billing snapshot; null when never read. */
+    remainingCredits: number | null | undefined;
+}): GuardrailVerdict;
+//# sourceMappingURL=guardrails.d.ts.map

package/lib/types/host/workbuddy/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,CAAA;AAExD,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,mBAIhC,CAAA;AAOD,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAQvE;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,SAAa,GAAG,MAAM,CAKpD;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAQD,2CAA2C;AAC3C,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAmE;IACnF,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAmC;gBAG/B,QAAQ,SAAoB,EAC5B,GAAG,GAAE,MAAM,MAAyB;IAGvD,+EAA+E;IACzE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC3B,2EAA2E;IAC3E,OAAO,CAAC,YAAY;IAMpB,wDAAwD;IACxD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAKtC,sDAAsD;IACtD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAK1D,6DAA6D;IAC7D,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAKtD;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAY/D,OAAO;CAMtB;AAED,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,GAAG,oBAAoB,CAAA;AAEvF,gDAAgD;AAChD,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAC5C,GAAG,gBAAgB,CA4BnB"}

package/lib/types/host/workbuddy/identity.d.ts

@@ -0,0 +1,71 @@
+/**
+ * WorkBuddy account identity, resolved from the credential itself.
+ *
+ * The defect this exists to prevent: {@link workBuddyAccountId} falls back to
+ * `nickname` when no uid is present, and the browser-login response carries the
+ * display name but no uid — so signing in to an account that the IDE already
+ * holds produced `intl:<e-mail>` from the login while the very same account
+ * scanned from the IDE's own `*.info` file produced `intl:<uuid>`. Two ids
+ * meant two pool rows, two entries in `/accounts` and two cards for one
+ * account, which is exactly what users reported as "the same account appears
+ * twice". The same fallback is why a credential that carried no display name at
+ * all was labelled "账号 1".
+ *
+ * A display name is not an identity. The access token is a Keycloak JWT whose
+ * `sub` is the account's stable uid on both deployments (measured against a
+ * live domestic and international token), so the identity is read from there
+ * and the file's or response's own fields are used only for what the token
+ * cannot supply.
+ */
+import type { WorkBuddyCredentials } from './token-store.ts';
+/** Identity facts a token or a login response can state about one account. */
+export interface WorkBuddyTokenIdentity {
+    uid?: string;
+    nickname?: string;
+    uin?: string;
+    enterpriseId?: string;
+}
+/**
+ * Decode a JWT's payload without verifying it.
+ *
+ * Nothing here is a security decision: the claims only name the account so the
+ * plugin can tell two credentials apart. The token is still validated by the
+ * gateway on every request, so an unverified claim cannot grant anything — it
+ * can at most make two accounts look alike, which the request path would then
+ * reject on its own.
+ *
+ * Returns null for an opaque or malformed token rather than throwing: a
+ * non-JWT access token is a legitimate shape this route must keep working with.
+ */
+export declare function decodeAccessTokenClaims(accessToken: string): Record<string, unknown> | null;
+/** Read the identity facts one decoded claim set states. */
+export declare function identityFromClaims(claims: Record<string, unknown>): WorkBuddyTokenIdentity;
+/** Identity facts an access token states, or an empty object when it states none. */
+export declare function identityFromAccessToken(accessToken: string): WorkBuddyTokenIdentity;
+/**
+ * Whether a credential names its own account.
+ *
+ * {@link workBuddyAccountId} falls back to the auth domain, which is a property
+ * of the deployment rather than of the account: two accounts on one deployment
+ * would share it. A credential that states no uid, UIN or display name
+ * therefore has no identity to derive, and a caller holding a meaningful key
+ * already — a row the pool stored under one — must keep it instead of
+ * replacing it with a domain-derived key.
+ */
+export declare function hasStableIdentity(credentials: Pick<WorkBuddyCredentials, 'uid' | 'uin' | 'nickname'>): boolean;
+/**
+ * Backfill a credential's identity from its own access token.
+ *
+ * The token's `sub` is the account's uid, so it wins over a stored value that
+ * disagrees with it: that stored value can only have come from the login path
+ * that promoted a display name into `uid`, which is the record this function
+ * exists to heal. The displaced value is kept as the nickname when nothing else
+ * names the account, so a healed row still reads as something a person
+ * recognizes instead of an opaque uuid.
+ *
+ * Every other field is only filled in when the credential does not state it:
+ * what the IDE's file or the login response already records is not second
+ * guessed from a token.
+ */
+export declare function withResolvedIdentity<T extends WorkBuddyCredentials>(credentials: T): T;
+//# sourceMappingURL=identity.d.ts.map

package/lib/types/host/workbuddy/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAa3F;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,CAoB1F;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,CAGnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,OAAO,CAI9G;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,oBAAoB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,CA2BtF"}