@eddyskywalker/dsh-chatgpt-subscription 0.46.1 → 0.47.0

package/lib/types/host/compaction-prompt.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Replace the compaction directive DSH ships with one that reads better.
+ *
+ * DSH's `compaction-basic` delivers its summarization directive as the FINAL
+ * user message of the replayed conversation (see its `summarizer.ts`): keeping
+ * the conversation's own prefix in front of it is what makes the auxiliary call
+ * a genuine prefix of the last routed request, so the provider's KV cache is
+ * reused instead of invalidated. That directive is a private constant of the
+ * harness, not a setting, and no preset may edit it.
+ *
+ * The replacement below keeps that property: it is spliced into the SAME final
+ * message, so every earlier message — the system prompt, the tools, the whole
+ * conversation — is byte-identical and the cache prefix still matches. Only the
+ * trailing instruction differs, which is the part a compaction request was
+ * never going to cache-hit anyway.
+ *
+ * Three things the shipped directive gets wrong, each learned from the official
+ * `MoonshotAI/kimi-code` agent (`fullCompaction/compaction-instruction.md`):
+ *
+ * 1. **Language.** It demands "concise English engineering prose" even when the
+ *    conversation is not English, so a Chinese session's checkpoint comes back
+ *    in English and the resumed turn has to translate its own history. The
+ *    official instruction says to keep the conversation's own language.
+ * 2. **Rigid sections.** It fixes nine headings. When a conversation is mostly
+ *    one long debugging thread, forcing it into nine buckets spends the budget
+ *    on empty sections and starves the one that matters. The official
+ *    instruction lets the shape follow the task.
+ * 3. **Values, not commands.** It says to preserve "commands and error strings"
+ *    but not the VALUES those commands returned. A resumed turn that knows
+ *    `grep -n foo` ran, but not what it printed, re-runs it — and the file may
+ *    have changed since.
+ *
+ * What is deliberately kept from DSH's version: the instruction to fold a prior
+ * `<compacted-summary>` block forward rather than copy it, because without it
+ * each compaction restates the previous checkpoint and the history grows a
+ * summary of a summary.
+ *
+ * @module dsh-chatgpt-subscription/compaction-prompt
+ */
+/**
+ * First line of the directive DSH ships.
+ *
+ * Matched as a prefix rather than the whole text: the harness owns that
+ * constant and may reword its later sections without warning, and a matcher
+ * pinned to the full string would silently stop replacing anything.
+ */
+export declare const SHIPPED_INSTRUCTION_OPENING = "You are now acting as a compaction engine for this AI coding assistant.";
+/** Marker the harness wraps a prior checkpoint in; the replacement must keep folding it. */
+export declare const PRIOR_CHECKPOINT_OPEN_TAG = "<compacted-summary>";
+/** The replacement directive. */
+export declare const COMPACTION_INSTRUCTION: string;
+/** One text-bearing content block, as the splice reads it. */
+export interface PromptBlock {
+    readonly type?: string | undefined;
+    readonly text?: string | undefined;
+}
+/** One request message, narrowed to what the splice needs. */
+export interface PromptMessage {
+    readonly role?: string | undefined;
+    readonly content?: readonly PromptBlock[] | undefined;
+}
+/**
+ * Whether one message carries DSH's shipped directive.
+ * @param message - one request message.
+ * @returns whether its text opens with {@link SHIPPED_INSTRUCTION_OPENING}.
+ */
+export declare function carriesShippedInstruction(message: PromptMessage): boolean;
+/**
+ * Splice the replacement directive into the conversation's final message.
+ *
+ * Every earlier message is returned by reference, unchanged: that is the whole
+ * cache argument for doing this at the last message instead of rebuilding the
+ * request. Returns the original array when no message carries the shipped
+ * directive, so a host that reworded it (or a call that is not a compaction)
+ * costs nothing and stays on the harness's own text.
+ * @param messages - the compaction request's messages.
+ * @returns messages whose final shipped directive is replaced, or the input.
+ */
+export declare function replaceCompactionInstruction<M extends PromptMessage>(messages: readonly M[]): readonly M[];
+/** The `llm/stream` options this splice reads and rewrites. */
+export interface PromptStreamOptions {
+    /** `compaction` on an auxiliary summary call; absent on a conversation turn. */
+    readonly purpose?: string | undefined;
+    /**
+     * Ordered request messages; the last one carries the summarization directive.
+     *
+     * Deliberately NOT readonly: assigning it is how the splice hands the
+     * rewritten request downstream, because `next()` takes no arguments. The
+     * harness types the same field as a mutable array for the same reason.
+     */
+    messages?: readonly PromptMessage[];
+}
+/** A chunk as it crosses the stream boundary; the splice never inspects one. */
+export interface PromptChunk {
+    readonly type: string;
+}
+/** The `llm/stream` waterfall listener this module registers. */
+export type PromptStreamListener = (options: PromptStreamOptions, next: () => AsyncIterable<PromptChunk>) => AsyncIterable<PromptChunk>;
+/** The context surface this splice needs, declared structurally per harness generation. */
+export interface PromptContext {
+    on?(event: 'llm/stream', listener: PromptStreamListener, options?: {
+        readonly global?: boolean;
+    }): unknown;
+    logger?: {
+        warn(message: string): void;
+    } | undefined;
+}
+/** Live handle: teardown for the registered listener. */
+export interface PromptHandle {
+    dispose(): void;
+}
+/**
+ * Install the `llm/stream` listener that swaps the directive in place.
+ *
+ * The rewrite happens on the request object the waterfall already carries,
+ * because `next()` takes no arguments: there is no way to hand a modified
+ * request downstream, and re-entering `stream()` to pass one would put this
+ * listener back in its own path. Assigning `messages` is therefore the only
+ * seam that leaves every other field — provider, model, tools, session — exactly
+ * as the harness built them.
+ *
+ * A frozen request is skipped rather than forced: a host that freezes its
+ * options is telling callers not to rewrite them, and keeping the shipped
+ * directive is a correct outcome, not a failure.
+ * @param ctx - structural context: the event bus and a logger.
+ * @returns the live handle, or undefined on a host with no event bus.
+ */
+export declare function installCompactionPrompt(ctx: PromptContext): PromptHandle | undefined;
+//# sourceMappingURL=compaction-prompt.d.ts.map

package/lib/types/host/compaction-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compaction-prompt.d.ts","sourceRoot":"","sources":["../../../src/host/compaction-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,4EACmC,CAAA;AAE3E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,wBAAwB,CAAA;AAE9D,iCAAiC;AACjC,eAAO,MAAM,sBAAsB,QAqBvB,CAAA;AAEZ,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,SAAS,CAAA;CACtD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAQzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,aAAa,EAClE,QAAQ,EAAE,SAAS,CAAC,EAAE,GACrB,SAAS,CAAC,EAAE,CAad;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CACpC;AAED,gFAAgF;AAChF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,iEAAiE;AACjE,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,mBAAmB,EAC5B,IAAI,EAAE,MAAM,aAAa,CAAC,WAAW,CAAC,KACnC,aAAa,CAAC,WAAW,CAAC,CAAA;AAE/B,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,CACD,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,oBAAoB,EAC9B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAA;IACV,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,SAAS,CAAA;CACrD;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,OAAO,IAAI,IAAI,CAAA;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,GAAG,SAAS,CA4BpF"}

package/lib/types/host/preset-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preset-sync.d.ts","sourceRoot":"","sources":["../../../src/host/preset-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAElE,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAiB,CAAA;AAsEjE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,GAAE,MAAM,GAAG,SAA2B,GAAG,MAAM,EAAE,CAyBjG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,SAAS,MAAM,EAA4B,GACjD,OAAO,CAsBT;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAW3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAUvG;AA6CD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAEjG;AAED,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;AAEjF,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,iBACY,CAAA;AAE5C,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,iEAAiE;IACjE,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACvC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAQpC;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GAChD,QAAQ,GAAG,SAAS,CA+CtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,SAAS,MAAM,EAAO,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,gBAAgB,CAiClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,IAAI,CAiB1F"}
+{"version":3,"file":"preset-sync.d.ts","sourceRoot":"","sources":["../../../src/host/preset-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAElE,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAiB,CAAA;AA6EjE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,GAAE,MAAM,GAAG,SAA2B,GAAG,MAAM,EAAE,CAyBjG;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,SAAS,MAAM,EAA4B,GACjD,OAAO,CAsBT;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAW3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAUvG;AA6CD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,MAAM,CAEjG;AAED,sEAAsE;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;AAEjF,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,EAAE,iBACY,CAAA;AAE5C,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,iEAAiE;IACjE,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IACvC,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAQpC;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AA0FD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GAChD,QAAQ,GAAG,SAAS,CA+CtB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,SAAS,MAAM,EAAO,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,gBAAgB,CAiClB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,IAAI,CAiB1F"}

package/lib/types/host/workbuddy/account-pool.d.ts

@@ -0,0 +1,389 @@
+/**
+ * WorkBuddy's account pool.
+ *
+ * This line is the one that adopts accounts it does not own: alongside the
+ * accounts a user signs in through this plugin, it reads the CodeBuddy desktop
+ * client's own `*.info` credentials so an existing IDE sign-in needs no second
+ * login. Both kinds take part in scheduling through the shared
+ * {@link AccountPoolCore}, and the difference is enforced here:
+ *
+ * - **managed** accounts were signed in through this plugin. They live in the
+ *   pool's encrypted storage and may be deleted.
+ * - **desktop** accounts belong to the IDE. Their credential is re-read from the
+ *   IDE's file on every pick, because the IDE rotates it on its own schedule and
+ *   a cached copy would go stale; they are never deleted, only hidden.
+ */
+import { LlmError } from '@deepseek-ai/dsh-llm';
+import { AccountPoolCore, type PoolAccountShape, type PoolData } from '../common/account-pool.ts';
+import type { CredentialStore } from '../token-store.ts';
+import { FileCredentialStore, type WorkBuddyCredentials } from './token-store.ts';
+import type { PoolAccountQuotaDto } from '../../shared/account-pool-contracts.ts';
+import { type WorkBuddyAccountQuota, type WorkBuddyAccountRestrictionDto, type WorkBuddyAccountSummaryDto, type WorkBuddyPoolStateDto, type WorkBuddyRegion } from '../../shared/workbuddy-contracts.ts';
+/** One pooled WorkBuddy account: the credential plus the facts the card renders. */
+export interface WorkBuddyPoolAccount extends PoolAccountShape<WorkBuddyCredentials> {
+    region: WorkBuddyRegion;
+    nickname?: string;
+    uin?: string;
+    /** Which store owns the credential; only managed accounts may be deleted. */
+    source: 'desktop' | 'managed';
+    /** IDE file a desktop account came from; absent for managed accounts. */
+    sourceFile?: string;
+}
+/** Encrypted pool file this line owns. */
+export declare function workBuddyPoolPath(): string;
+/**
+ * Error code the adapter routes on when the WHOLE pool is paused.
+ *
+ * Deliberately not `RATE_LIMIT`: a pause says the pool will not be served at
+ * all — the upstream barred accounts, it did not answer 429 for one request —
+ * and confusing the two would send the user to wait out a window that has
+ * nothing to do with their accounts. The pause lifts by itself and the RESTRICTED
+ * accounts do not, so the remedy is also different.
+ */
+export declare const WORKBUDDY_POOL_PAUSED_CODE: "WORKBUDDY_POOL_PAUSED";
+/**
+ * Thrown instead of selecting an account while the whole pool is paused.
+ *
+ * Exported so the protocol worker's caller can tell "upstream barred two
+ * accounts" (wait for the pause, then sign the restricted ones in again) from
+ * "this request was rate limited". It is never reported as an upstream 429.
+ */
+export declare class WorkBuddyPoolPausedError extends LlmError {
+    /** Unix milliseconds the pause lifts on its own; absent when nothing named one. */
+    readonly pausedUntil: number | undefined;
+    constructor(message: string, pausedUntil?: number);
+}
+/**
+ * How long a second barred account stops the whole pool.
+ *
+ * Thirty minutes is the confirmed Wave 2A policy: long enough that an upstream
+ * refusing every account is not hammered once per turn, short enough that a
+ * transient bar does not take the line offline for a working day. When it
+ * passes the pool resumes by itself — the restricted accounts do not, because
+ * nothing upstream said they may serve again.
+ */
+export declare const WORKBUDDY_POOL_PAUSE_MS: number;
+/**
+ * Window in which a second, DIFFERENT barred account stops the whole pool.
+ *
+ * Measured from each refusal to the next. One barred account is that account's
+ * problem and the rest still serve; two different accounts barred inside this
+ * window is the pool's problem, because the same thing is about to happen to
+ * the third.
+ */
+export declare const WORKBUDDY_RESTRICTION_ESCALATION_WINDOW_MS: number;
+/** One account's `11140` as this pool's own document keeps it. */
+export interface WorkBuddyPoolRestrictionRecord {
+    /** Gateway code; {@link WORKBUDDY_RESTRICTED_ACCOUNT_CODE} is the only one recorded. */
+    code: number;
+    /** Upstream `msg` when one came with the code. Never a credential. */
+    message?: string;
+    /** Instant the gateway named, when it named one. Reported, never enforced. */
+    until?: number;
+    /** When this pool observed the refusal; drives the escalation window. */
+    observedAt: number;
+}
+/** A pause of the WHOLE pool, as its own document keeps it. */
+export interface WorkBuddyPoolPauseRecord {
+    /** Composed sentence for the card; never a token. */
+    reason: string;
+    pausedSince: number;
+    /** Unix milliseconds the pause lifts by itself. */
+    pausedUntil: number;
+    /** Account ids whose `11140` caused the pause, in observation order. */
+    triggeredBy: string[];
+}
+/** Whole-pool state kept inside the pool document. */
+export interface WorkBuddyPoolDocumentState {
+    /** Account id → its `11140`. A restricted account is out of rotation. */
+    restrictions: Record<string, WorkBuddyPoolRestrictionRecord>;
+    pause?: WorkBuddyPoolPauseRecord;
+}
+/**
+ * This line's pool document: the shared shape plus the pool-wide state.
+ *
+ * The state lives in the SAME document rather than a second store, so one
+ * encrypted write keeps "which account may serve" and "may the pool serve at
+ * all" in step: two documents could be observed half-updated, and the pool
+ * would then select an account its own restriction record bars.
+ */
+export interface WorkBuddyPoolData extends PoolData<WorkBuddyPoolAccount> {
+    pool?: WorkBuddyPoolDocumentState;
+}
+/**
+ * Read whole-pool state out of a stored document.
+ *
+ * Absent means "no pool-wide state", which is exactly what a document written
+ * before Wave 2A holds — and what an untouched pool still writes, so an install
+ * that never met `11140` carries no extra keys at all. A malformed ENTRY is
+ * dropped rather than failing the document: losing one memory of a refusal must
+ * not make the accounts unreadable, while silently keeping an unparseable pause
+ * could take the line offline forever.
+ */
+export declare function parseWorkBuddyPoolState(value: unknown): WorkBuddyPoolDocumentState | undefined;
+/**
+ * Validate and normalize one whole pool document.
+ *
+ * A record whose credential is unusable is dropped rather than repaired: the
+ * account can always be adopted again from its file or by signing in again, and
+ * keeping a credential-less row would offer the user an account nothing can use.
+ */
+export declare function parseWorkBuddyPoolData(value: unknown): WorkBuddyPoolData;
+/**
+ * One cached snapshot as the shared account card renders it.
+ *
+ * Only what the DTO states is published: every meter that measured a share
+ * becomes a window, and a meter that measured none is dropped rather than drawn
+ * at 0 — which would claim an unspent allowance no reading supports.
+ *
+ * Exported for the pool's regression tests; the card only reaches it through
+ * the summary hook.
+ */
+export declare function workBuddyPoolQuota(snapshot: WorkBuddyAccountQuota): PoolAccountQuotaDto | undefined;
+export interface WorkBuddyAccountPoolOptions {
+    /** Credential store the desktop scan reads through; the pool owns scheduling. */
+    store?: FileCredentialStore;
+    /** Test seam; production builds the platform backend from the pool path. */
+    backend?: CredentialStore<PoolData<WorkBuddyPoolAccount>>;
+    maxAccounts?: number;
+    /**
+     * The settings selection: the account the user pinned and the ones hidden.
+     *
+     * Read on every pick rather than captured once, because both change from the
+     * settings card while the adapter is serving requests.
+     */
+    selection?: () => {
+        selectedAccountId: string | null;
+        hiddenAccountIds: readonly string[];
+    };
+}
+/**
+ * WorkBuddy's account pool.
+ *
+ * Desktop accounts are adopted into the pool so they can be scheduled and
+ * cooled down like any other, but they stay owned by the IDE: the pool refreshes
+ * their credential from the IDE's own file on every pick, and deletion is
+ * refused for them.
+ */
+export declare class WorkBuddyAccountPool extends AccountPoolCore<WorkBuddyCredentials, WorkBuddyPoolAccount, WorkBuddyAccountSummaryDto> {
+    private readonly store;
+    private readonly options_selection;
+    /**
+     * Older settings key → the id the account has now.
+     *
+     * A pin or a hide written before the identity fix names its account by the
+     * old name-derived key. Kept in step by {@link read}, which every routing
+     * decision goes through, so the mapping is never stale when it is consulted.
+     */
+    private readonly legacyIds;
+    /**
+     * Per-model parks, in memory only: account id → model → the instant it lifts.
+     *
+     * The subscription meters an account × MODEL over a 24h window (429 `code
+     * 6004` names when it lifts), so cooling the whole ACCOUNT for one exhausted
+     * model throws away every other model that account can still serve. Process
+     * local on purpose, like the sibling gateway's model cooldowns: the window is
+     * short, and a restart re-measures it with the first request rather than
+     * trusting a stale timestamp.
+     */
+    private readonly modelCooldowns;
+    /**
+     * Whole-pool state as of the LAST load through {@link loadPoolData}.
+     *
+     * A cache rather than a read per check: eligibility runs once per account per
+     * pick, and asking the encrypted store each time would pay a DPAPI unprotect
+     * per candidate. Every read and every mutation loads the document first, so
+     * this cannot be stale for longer than one storage round trip.
+     */
+    private restrictions;
+    private pause;
+    constructor(options?: WorkBuddyAccountPoolOptions);
+    /**
+     * Load the pool, refreshing the legacy-key index on the way.
+     *
+     * Every routing decision and mutation goes through this method before it
+     * consults the settings selection, so building the index here is what keeps
+     * a pin written before the identity fix resolvable when
+     * {@link resolveSelectionId} is asked for it.
+     */
+    protected loadPoolData(): Promise<PoolData<WorkBuddyPoolAccount>>;
+    /** Keep the pool-wide cache in step with the document just loaded. */
+    private observePoolState;
+    /** This account's live `11140`, matched through every key it answers to. */
+    private restrictionFor;
+    /** The pause that is still running, or undefined when it lifted or never began. */
+    private activePause;
+    /** The error every selection raises while the pool is paused. */
+    private pausedError;
+    /**
+     * Record an account-scoped refusal reported by the protocol worker.
+     *
+     * This is the ONE entry point for `11140`, and the policy it implements is
+     * the confirmed Wave 2A one:
+     *
+     * - the first barred account leaves rotation immediately and its restriction
+     *   is PERSISTED (in the pool document, so a second pool instance over the
+     *   same store sees it), while every other account keeps serving;
+     * - a SECOND, different account barred within
+     *   {@link WORKBUDDY_RESTRICTION_ESCALATION_WINDOW_MS} pauses the whole pool
+     *   for {@link WORKBUDDY_POOL_PAUSE_MS} — during which no account is selected
+     *   at all — and that pause is persisted too;
+     * - the pause lifts by itself, the restricted accounts do NOT: only a
+     *   completed sign-in ({@link addAccount}) puts one back in rotation.
+     *
+     * Only {@link WORKBUDDY_RESTRICTED_ACCOUNT_CODE} is accepted. `11128` is the
+     * channel/request-shape block and `11158` is one model an account has no
+     * entitlement for; neither says the ACCOUNT may not serve, so recording either
+     * would take a working account out of rotation and — with two inside the
+     * window — stop the whole pool over a request-shape mistake. The call is
+     * therefore refused loudly, which keeps that misrouting visible in a test or a
+     * log instead of silently barring a healthy account.
+     */
+    markAccountRestriction(accountId: string, restriction: WorkBuddyAccountRestrictionDto): Promise<void>;
+    /** Clear one account's restriction; a completed sign-in is what does this. */
+    private clearRestriction;
+    /**
+     * Whole-pool state for the wire: whether the pool is paused, why, until when,
+     * which accounts are barred, and where this document lives.
+     *
+     * `pausedUntil` is the pause's remaining time in absolute form, which is what
+     * a card can count down and a route can answer without a second call. An
+     * expired pause is reported as not paused — it never needs a write to lift.
+     */
+    poolState(): Promise<WorkBuddyPoolStateDto>;
+    /** Map a settings key from before the identity fix onto the account's real id. */
+    private resolveSelectionId;
+    /**
+     * Adopt any desktop credential the pool does not know yet.
+     *
+     * The IDE's directory is the source of truth for its own accounts, so a
+     * credential that appears there joins the pool. Nothing is ever removed: a
+     * file that disappears (the IDE signed out, a profile was moved) leaves the
+     * account in place, where the user can hide or delete the managed ones.
+     */
+    syncDesktopAccounts(): Promise<WorkBuddyAccountSummaryDto[]>;
+    /**
+     * A stale `authStatus` is cleared once the credential in force has moved on.
+     *
+     * The marker records that ONE token was refused; it does not record that the
+     * sign-in is gone. This line can still produce it from a token-endpoint
+     * refusal, and the copy that refusal was about can be replaced afterwards by
+     * whoever owns it — the IDE rotates a desktop account's token on its own
+     * schedule, and the daily check-in renews a managed one and writes it back to
+     * this plugin's store. Nothing else in the system ever revisits an
+     * `authStatus`, so without this a row stays out of rotation for good and the
+     * card keeps saying "需要重新登录" for an account that is signed in.
+     *
+     * The verdict is re-checked against what the store holds NOW: a row whose
+     * account has a DIFFERENT, unexpired token is routable again and adopts it,
+     * while a row still holding the refused token keeps its marker — that one
+     * really does need a sign-in.
+     */
+    private healStaleAuthFailures;
+    /** Account summaries, with a marker the credentials have outlived cleared. */
+    listAccounts(): Promise<WorkBuddyAccountSummaryDto[]>;
+    /**
+     * Pick an account, healing a stale marker first.
+     *
+     * The healing belongs on the request path, not only on the card: an account
+     * marked expired is excluded by the core's eligibility rule, so until the
+     * marker is gone the next request is answered with "全部 N 个账号都需要重新登录"
+     * for a credential the store has already replaced.
+     */
+    getEffectiveAccount(excludeIds?: ReadonlySet<string>, fetchFn?: typeof fetch, forceRefresh?: boolean): Promise<{
+        account: WorkBuddyPoolAccount;
+        credentials: WorkBuddyCredentials;
+    }>;
+    /**
+     * Pick the account for the next request.
+     *
+     * A desktop account's credential is re-read from the IDE's file first: the IDE
+     * refreshes its own token, so the copy the pool adopted can be older than what
+     * is on disk.
+     */
+    getEffectiveCredential(excludeIds?: ReadonlySet<string>, fetchFn?: typeof fetch, model?: string): Promise<{
+        account: WorkBuddyPoolAccount;
+        credentials: WorkBuddyCredentials;
+    }>;
+    /**
+     * Park ONE model on one account; every other model keeps serving.
+     *
+     * Returns the instant the park lifts, or undefined for a non-positive
+     * duration (which clears any existing park rather than extending it).
+     */
+    markModelCooldown(accountId: string, model: string, durationMs: number): number | undefined;
+    /** When this account's park on this model lifts, or undefined when it may serve. */
+    modelCooldownUntil(accountId: string, model: string, now?: number): number | undefined;
+    /**
+     * The models this account is parked on right now, with the instant each park
+     * lifts.
+     *
+     * Only LIVE parks are reported: a window that has passed is dropped here, so
+     * the card never shows a model that may already serve. The lift instant is
+     * the one the upstream named, stored verbatim by
+     * {@link markModelCooldown}; it is never recomputed from a duration that has
+     * since drifted, because a re-derived instant would drift with it.
+     */
+    private liveModelCooldowns;
+    /**
+     * Clear one account's cooldown AND the models it is parked on.
+     *
+     * The card's "reset cooldown" button promises the account is usable again. A
+     * model park is a cooldown too — the account stays eligible, but it still
+     * refuses the model the request wants — so leaving the park behind would
+     * report a reset that did not happen, and the park would outlive the only
+     * control the user has over it.
+     *
+     * The base write comes first: it is the half that can fail, and a failed
+     * write must leave the account's state as it was rather than half-cleared.
+     */
+    clearCooldown(accountId: string): Promise<void>;
+    /** Accounts currently parked on one model, with lifted entries pruned on the way. */
+    private parkedAccountIds;
+    /**
+     * Whether another account besides `triedAccountIds` can serve THIS model.
+     *
+     * The plain {@link hasAnotherAvailableAccount} answers for any model, so a
+     * rotation loop that consulted it would keep trying while every remaining
+     * account is parked on the model it is asking for — turning one exhausted
+     * window into a burst of refused requests.
+     */
+    hasAnotherAvailableAccountFor(triedAccountIds: ReadonlySet<string>, model: string): Promise<boolean>;
+    /**
+     * Whether another account may serve right now.
+     *
+     * Answered from ONE read that also carries the pool-wide state, and false
+     * while the pool is paused: the rotation loop consults this before retrying,
+     * so a pause has to end the loop there rather than after another selection it
+     * would only refuse.
+     */
+    hasAnotherAvailableAccount(triedAccountIds: ReadonlySet<string>): Promise<boolean>;
+    /**
+     * Whether an account may serve a request.
+     *
+     * A hidden account keeps its place, its alias and its history, but the user
+     * has taken it out of this plugin's rotation, so it is not eligible.
+     */
+    protected isEligible(account: WorkBuddyPoolAccount, now: number, triedAccountIds?: ReadonlySet<string>): boolean;
+    private selection;
+    /**
+     * Add or re-authorize one account, settling its identity first.
+     *
+     * A completed browser sign-in states the display name but not always the uid,
+     * while the IDE's own file for the same account states the uid. Passing the
+     * raw response through would key the login under the name and the file under
+     * the uid, so the pool would hold the same account twice — the duplicate this
+     * fix exists to remove. Resolving from the credential's own token before the
+     * dedupe key is computed is what makes the two paths agree.
+     */
+    addAccount(credentials: WorkBuddyCredentials, alias?: string): Promise<WorkBuddyPoolAccount>;
+    /**
+     * Remove one account inside a transaction.
+     *
+     * A desktop account is refused: the plugin does not own that credential file,
+     * so removing it from the pool would strand the IDE's session while telling
+     * the user their account was deleted. Hiding is the supported action there.
+     */
+    protected deleteAccountFromPool(data: PoolData<WorkBuddyPoolAccount>, accountId: string): void;
+}
+//# sourceMappingURL=account-pool.d.ts.map

package/lib/types/host/workbuddy/account-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-pool.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/account-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EACL,eAAe,EAGf,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACd,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EAInB,KAAK,oBAAoB,EAC1B,MAAM,kBAAkB,CAAA;AAKzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AACjF,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAG/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACrB,MAAM,qCAAqC,CAAA;AAE5C,oFAAoF;AACpF,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB,CAAC,oBAAoB,CAAC;IAClF,MAAM,EAAE,eAAe,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,6EAA6E;IAC7E,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;IAC7B,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,0CAA0C;AAC1C,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAG,uBAAgC,CAAA;AAE1E;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ;IACpD,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;gBAE5B,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;CAKlD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,QAAiB,CAAA;AAErD;;;;;;;GAOG;AACH,eAAO,MAAM,0CAA0C,QAAiB,CAAA;AAExE,kEAAkE;AAClE,MAAM,WAAW,8BAA8B;IAC7C,wFAAwF;IACxF,IAAI,EAAE,MAAM,CAAA;IACZ,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAA;IACnB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;IAC5D,KAAK,CAAC,EAAE,wBAAwB,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CAAC,oBAAoB,CAAC;IACvE,IAAI,CAAC,EAAE,0BAA0B,CAAA;CAClC;AASD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,GAAG,SAAS,CAmC9F;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAmGxE;AAkED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,mBAAmB,GAAG,SAAS,CAsBnG;AAgBD,MAAM,WAAW,2BAA2B;IAC1C,iFAAiF;IACjF,KAAK,CAAC,EAAE,mBAAmB,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAA;IACzD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM;QAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAA;CAC5F;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,eAAe,CACvD,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA0C;IAC5E;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;IACtD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY,CAAqD;IACzE,OAAO,CAAC,KAAK,CAAsC;gBAEvC,OAAO,GAAE,2BAAgC;IAuGrD;;;;;;;OAOG;cACsB,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAYhF,sEAAsE;IACtE,OAAO,CAAC,gBAAgB;IAMxB,4EAA4E;IAC5E,OAAO,CAAC,cAAc;IAQtB,mFAAmF;IACnF,OAAO,CAAC,WAAW;IAKnB,iEAAiE;IACjE,OAAO,CAAC,WAAW;IAQnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD3G,8EAA8E;IAC9E,OAAO,CAAC,gBAAgB;IASxB;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAejD,kFAAkF;IAClF,OAAO,CAAC,kBAAkB;IAK1B;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAmClE;;;;;;;;;;;;;;;;OAgBG;YACW,qBAAqB;IA4BnC,8EAA8E;IAC/D,YAAY,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAOpE;;;;;;;OAOG;IACY,mBAAmB,CAChC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,OAAO,GAAE,OAAO,KAAa,EAC7B,YAAY,UAAQ,GACnB,OAAO,CAAC;QAAE,OAAO,EAAE,oBAAoB,CAAC;QAAC,WAAW,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAahF;;;;;;OAMG;IACG,sBAAsB,CAC1B,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAChC,OAAO,GAAE,OAAO,KAAa,EAC7B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,oBAAoB,CAAC;QAAC,WAAW,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAgChF;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAY3F,oFAAoF;IACpF,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS;IAK1F;;;;;;;;;OASG;IACH,OAAO,CAAC,kBAAkB;IAc1B;;;;;;;;;;;OAWG;IACY,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,qFAAqF;IACrF,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;OAOG;IACG,6BAA6B,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU1G;;;;;;;OAOG;IACY,0BAA0B,CAAC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAOjG;;;;;OAKG;cACgB,UAAU,CAC3B,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,MAAM,EACX,eAAe,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACpC,OAAO;IAcV,OAAO,CAAC,SAAS;IAIjB;;;;;;;;;OASG;IACY,UAAU,CAAC,WAAW,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAU3G;;;;;;OAMG;cACgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;CAMxG"}