@eddyskywalker/dsh-chatgpt-subscription 0.46.1 → 0.48.0

package/lib/types/host/workbuddy/atrest.d.ts

@@ -0,0 +1,98 @@
+/**
+ * `$wbEncrypted` at-rest credential envelope.
+ *
+ * The CodeBuddy/WorkBuddy desktop client stopped writing plaintext tokens on
+ * 2026-09-24: `auth.accessToken` / `auth.refreshToken` became
+ * `{"$wbEncrypted": 1, "envelope": base64}` (the domestic build also seals
+ * `nickname` / `phoneNumber`). Reading such a file the way this plugin used to
+ * yields the envelope TEXT as the bearer token, so every request answers 401 —
+ * the adoption path has to decrypt before it can use the credential.
+ *
+ * The scheme below is transcribed from the client's `packages/at-rest-crypto`
+ * as reimplemented by workbuddy2api-hub (`wb_atrest.py`, MIT); the framing
+ * constants are the part that must match byte for byte:
+ *
+ *     key      = sha256(atRestSecretKey as an ASCII string)   # the protector key
+ *     keyId    = sha256(key).hex[0..16]                       # `protectorKeyId`
+ *     AAD      = "WB-AAD\0" | 0x01 | LP(fileMagic) | LP("sym-v1")
+ *                | u32(suite) | LP(keyId) | framingCode | 0x00 | 0x00
+ *     envelope = base64(JSON{suite, keyId, nonce, authTag, ciphertext})  # AES-256-GCM
+ *     framing  : the keyblob's wrapped master key is `WBEF1`/1, a sealed `.info`
+ *                field is `WBEV1`/2 — the SAME protector key opens both.
+ *
+ * Key material never leaves the process and is never logged: the user pastes it
+ * once, it is stored through the platform credential store (DPAPI / Keychain /
+ * Secret Service), and every read re-validates it against the client's own
+ * keyblob when that file exists.
+ */
+/** Field name the client uses to mark a sealed value. */
+export declare const ENVELOPE_KEY = "$wbEncrypted";
+/** Framing kinds and the code each carries in the AAD. */
+declare const FRAMING: {
+    readonly file: {
+        readonly magic: "WBEF1";
+        readonly code: 1;
+    };
+    readonly field: {
+        readonly magic: "WBEV1";
+        readonly code: 2;
+    };
+};
+type Framing = keyof typeof FRAMING;
+/** Every failure the at-rest path can report to a user. */
+export declare class AtRestError extends Error {
+    constructor(message: string);
+}
+/** The GCM associated data, byte-identical to the client's. */
+export declare function associatedData(keyId: string, suite: number, framing: Framing): Buffer;
+/** `protectorKeyId` / `envelope.keyId`: the first 16 hex characters of sha256(key). */
+export declare function deriveKeyId(key: Buffer): string;
+/**
+ * Whether a value is a sealed envelope rather than plaintext.
+ *
+ * Older clients sometimes stored the whole envelope as a JSON STRING in the
+ * field, so that shape is recognised too.
+ */
+export declare function isSealedValue(value: unknown): boolean;
+interface SealedEnvelope {
+    suite: number;
+    keyId: string;
+    nonce: Buffer;
+    authTag: Buffer;
+    ciphertext: Buffer;
+}
+/** Split one envelope into its GCM parts. */
+export declare function parseEnvelope(value: unknown): SealedEnvelope;
+/** Open one envelope with the protector key, returning the plaintext bytes. */
+export declare function openEnvelope(key: Buffer, value: unknown, framing: Framing): Buffer;
+/** Decrypt a field that may be sealed, leaving plaintext values untouched. */
+export declare function openSealedField(key: Buffer, value: unknown): string;
+/**
+ * Normalise a pasted secret into the 32-byte protector key.
+ *
+ * Two spellings are accepted, neither requiring the user to compute anything:
+ * a 64-character hex protector key (used as-is), or the 44-character base64
+ * `atRestSecretKey` the client carries in its payload — that one is hashed as
+ * the STRING, which is what produces the protector key.
+ */
+export declare function parseKeyText(text: string): Buffer;
+/** Path of the client's keyblob, or null when the client is not installed here. */
+export declare function keyBlobPath(): string | null;
+/**
+ * Validate a protector key against the client's own keyblob.
+ *
+ * This is the check that turns a typo into an error instead of a mystery: the
+ * key must match the `static-v1` slot's `protectorKeyId` and must unwrap a
+ * 32-byte master whose derived id matches the blob's own `keyId`. Returns
+ * `false` when there is no keyblob to check against (the desktop client is not
+ * installed on this machine) — absence of evidence, not evidence of a bad key.
+ */
+export declare function verifyKeyAgainstKeyBlob(key: Buffer): Promise<boolean>;
+/** Install the protector key for this process (already persisted by the caller). */
+export declare function setActiveAtRestKey(key: Buffer | null): void;
+/** The protector key this process holds, if any. */
+export declare function activeAtRestKey(): Buffer | null;
+/** Whether sealed credentials can be opened right now. */
+export declare function hasAtRestKey(): boolean;
+export {};
+//# sourceMappingURL=atrest.d.ts.map

package/lib/types/host/workbuddy/atrest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atrest.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/atrest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAQH,yDAAyD;AACzD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,0DAA0D;AAC1D,QAAA,MAAM,OAAO;;;;;;;;;CAGH,CAAC;AAEX,KAAK,OAAO,GAAG,MAAM,OAAO,OAAO,CAAC;AAQpC,2DAA2D;AAC3D,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAeD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAWrF;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUrD;AAED,UAAU,cAAc;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAOD,6CAA6C;AAC7C,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAsB5D;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAkBlF;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAKnE;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjD;AAUD,mFAAmF;AACnF,wBAAgB,WAAW,IAAI,MAAM,GAAG,IAAI,CAM3C;AAwBD;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkB3E;AAID,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE3D;AAED,oDAAoD;AACpD,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/lib/types/host/workbuddy/checkin.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Daily check-in scheduler for the CN-region billing activity.
+ *
+ * Ported from workbuddy2api's `daily_checkin.py` and adapted to this host:
+ * the cron job becomes an in-process timer (the plugin runs inside the DSH
+ * host, so a day the host never runs is a day nothing signs in — accepted and
+ * documented), and the per-file state JSON becomes one state document under
+ * the harness home. The semantics are kept exactly:
+ *
+ * - **CN only.** The international deployment exposes no check-in surface, so
+ *   those accounts are skipped rather than failing daily.
+ * - **Idempotent.** The activity status is queried first; an account already
+ *   signed in (by anyone) is only recorded. An account whose activity reports
+ *   no entitlement is parked (see {@link CHECKIN_INACTIVE_RECHECK_MS}) rather
+ *   than abandoned for the day: the host often starts before the activity's
+ *   daily opening, and treating that first answer as final cost the account its
+ *   only chance to sign in. Once everyone is settled, a tick sends no requests.
+ * - **Bounded.** A failing account is retried at most {@link CHECKIN_ATTEMPT_CAP}
+ *   times a day, so a broken account cannot turn the ten-minute tick into a
+ *   request loop. A manual run ignores the cap and the window, like the
+ *   reference script's `--now`, and is queued behind an in-flight run rather
+ *   than dropped into it (a click must actually mean "try again now").
+ *
+ * Tokens stay host-side: the only write beyond the state file is the existing
+ * credential store's refresh write-back, reused here unchanged.
+ */
+import { type FileCredentialStore } from './token-store.ts';
+import type { WorkBuddyCheckinSettings, WorkBuddyCheckinSummary } from '../../shared/workbuddy-contracts.ts';
+/** Activity status surface; answers whether today is signed in already. */
+export declare const CHECKIN_STATUS_PATH = "/billing/meter/checkin-activity-status";
+/** Check-in surface; credits are granted by posting here once a day. */
+export declare const CHECKIN_PATH = "/billing/meter/daily-checkin";
+/**
+ * Scheduler cadence. The first tick at host startup is the daily run; the
+ * interval keeps a long-lived process signing in on later days without a
+ * restart. Idle ticks cost no requests — the day state short-circuits them.
+ */
+export declare const CHECKIN_TICK_MS: number;
+/** Daily retry ceiling for one account after a failed attempt. */
+export declare const CHECKIN_ATTEMPT_CAP = 3;
+export declare const CHECKIN_TIMEOUT_MS = 20000;
+/**
+ * How long an unentitled account waits before the activity is polled again.
+ *
+ * The activity opens on its own schedule, so the first inactive answer of the
+ * day is frequently 'not open yet' rather than 'no entitlement today'. Hourly
+ * re-checks keep a host that booted early from missing the day, while still
+ * costing at most one status request per hour per account.
+ */
+export declare const CHECKIN_INACTIVE_RECHECK_MS: number;
+/**
+ * Random pause between two accounts in one pass.
+ *
+ * Sequential accounts already serialise their requests, but they still arrive as
+ * one tight cluster from one outbound IP; a dozen-account pool doing that at the
+ * same minute is the burst pattern the sibling gateway added jitter for after
+ * seeing upstream rate-limit whole pools.
+ */
+export declare const CHECKIN_JITTER_MIN_MS = 2000;
+export declare const CHECKIN_JITTER_MAX_MS = 5000;
+/** State document the scheduler keeps beside the other plugin stores. */
+export declare function checkinStatePath(): string;
+/** Local calendar day an instant belongs to; state entries are keyed by it. */
+export declare function localDateString(nowMs: number): string;
+export interface WorkBuddyCheckinServiceOptions {
+    fetchFn?: typeof fetch;
+    /** State document path; tests redirect it, production uses {@link checkinStatePath}. */
+    statePath?: string;
+    /** Live preferences, re-read on every tick so the toggle applies at once. */
+    settings: () => WorkBuddyCheckinSettings;
+    /**
+     * Resolves once the preference store has read its stored document.
+     *
+     * Optional for callers whose settings are already in memory; the host passes
+     * the preference store's own warmup so the startup pass cannot act on a
+     * default that the stored document is about to overwrite.
+     */
+    ready?: () => Promise<void>;
+    /** Clock injection for tests. */
+    now?: () => number;
+    /** Wait between two accounts in one pass; injected so tests run without delays. */
+    pause?: (ms: number) => Promise<void>;
+    /** Jitter source; injected so a test can pin the delay it caused. */
+    random?: () => number;
+    logger?: {
+        info(message: string): void;
+        warn(message: string): void;
+    };
+}
+/**
+ * The check-in scheduler. One instance per plugin load; the host owns the
+ * interval and clears it from the same `ctx.effect` that created it.
+ */
+export declare class WorkBuddyCheckinService {
+    private readonly store;
+    private readonly options;
+    private readonly fetchFn;
+    private readonly statePath;
+    private readonly now;
+    private readonly pause;
+    private readonly random;
+    private readonly logger;
+    private state;
+    private loaded;
+    /** Passes waiting to run, in order; `true` marks a manual pass. */
+    private readonly queue;
+    /** The drain loop currently working the queue, if any. */
+    private draining;
+    private lastRunAt;
+    /** Memoized preference warmup, so it is awaited once however many passes run. */
+    private readyWait;
+    constructor(store: FileCredentialStore, options: WorkBuddyCheckinServiceOptions);
+    /**
+     * One scheduler pass. Automatic passes honour the toggle and the retry cap;
+     * a manual pass (`manual: true`, the card's "check in now") ignores both
+     * but still respects an account already signed in today.
+     *
+     * A manual pass that lands while a run is already in flight is *queued*, not
+     * absorbed: joining the running pass would silently discard the one thing the
+     * button promises, that the retry cap and the toggle are bypassed now.
+     */
+    tick(manual?: boolean): Promise<void>;
+    /** Run queued passes one after another until the queue empties. */
+    private drain;
+    private runQueue;
+    private run;
+    /** Wait for the preference store's warmup read, once. */
+    private ready;
+    /** Check one account in, recording the outcome in its today's entry. */
+    private checkinOne;
+    /** Record a confirmed sign-in, clearing the transient failure bookkeeping. */
+    private markSignedIn;
+    /**
+     * Refresh a token the server rejected, bypassing the store's expiry check.
+     *
+     * `ensureFresh` only acts on a locally expired token, so a session the server
+     * revoked early would otherwise fail every retry until the file's own clock
+     * caught up. The rotation is written back through the store either way.
+     */
+    private forceRefresh;
+    /**
+     * The aggregate the settings card renders. Reads only local state and the
+     * account list; it never spends a network request.
+     */
+    summary(): Promise<WorkBuddyCheckinSummary>;
+    private load;
+    private save;
+    private post;
+}
+//# sourceMappingURL=checkin.d.ts.map

package/lib/types/host/workbuddy/checkin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkin.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/checkin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAOH,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,qCAAqC,CAAA;AAE5C,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,2CAA2C,CAAA;AAC3E,wEAAwE;AACxE,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAC1D;;;;GAIG;AACH,eAAO,MAAM,eAAe,QAAiB,CAAA;AAC7C,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,eAAO,MAAM,kBAAkB,QAAS,CAAA;AACxC;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,QAAiB,CAAA;AAEzD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAC1C,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAE1C,yEAAyE;AACzE,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AA2GD,MAAM,WAAW,8BAA8B;IAC7C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,wBAAwB,CAAA;IACxC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,mFAAmF;IACnF,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B,CAAA;CACF;AAED;;;GAGG;AACH,qBAAa,uBAAuB;IAmBhC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAnB1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,KAAK,CAA0C;IACvD,OAAO,CAAC,MAAM,CAAQ;IACtB,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAA6B;IAE7C,OAAO,CAAC,SAAS,CAAsB;IACvC,iFAAiF;IACjF,OAAO,CAAC,SAAS,CAA6B;gBAG3B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE,8BAA8B;IAU1D;;;;;;;;OAQG;IACG,IAAI,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzC,mEAAmE;IACnE,OAAO,CAAC,KAAK;YAUC,QAAQ;YAoBR,GAAG;IA6CjB,yDAAyD;YAC3C,KAAK;IAOnB,wEAAwE;YAC1D,UAAU;IAkExB,8EAA8E;IAC9E,OAAO,CAAC,YAAY;IAWpB;;;;;;OAMG;YACW,YAAY;IAgB1B;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,uBAAuB,CAAC;YA+BnC,IAAI;YAuBJ,IAAI;YAaJ,IAAI;CAwBnB"}

package/lib/types/host/workbuddy/client.d.ts

@@ -0,0 +1,214 @@
+import type { WorkBuddyAccount, WorkBuddyAccountQuota, WorkBuddyMeter } from '../../shared/workbuddy-contracts.ts';
+import { type WorkBuddyOutboundProduct } from './outbound-identity.ts';
+import { PROVIDER_ID, PROVIDER_NAME } from './types.ts';
+import { FileCredentialStore, type WorkBuddyCredentials } from './token-store.ts';
+import type { WorkBuddyTokenIdentity } from './identity.ts';
+import { type WorkBuddyModelEntry } from './model-catalog.ts';
+export interface WorkBuddyRequestOptions {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+}
+/**
+ * Which chat surface a call is, for the headers only that surface needs.
+ *
+ * Passing this opts the request into the conversation header group. It is
+ * deliberately a separate argument rather than a consequence of `sessionId`
+ * being present: the group belongs to the chat endpoint's channel check, and
+ * the config, billing, refresh and check-in surfaces keep the exact header set
+ * they already worked with.
+ */
+export interface WorkBuddyChannelOptions {
+    /**
+     * Which client identity this request presents.
+     *
+     * Omitted means the line's shipped identity (`cli`). Only the chat call ever
+     * sets it: the config, billing and refresh surfaces are the ones measured to
+     * accept the CLI identity, and the choice exists for the chat fingerprint.
+     */
+    product?: WorkBuddyOutboundProduct;
+    /**
+     * Harness session the chat call belongs to.
+     *
+     * Omit it for a call with no conversation behind it (the connection-test
+     * probe). The group is still sent — the gateway requires it either way — but
+     * the scoped ids fall back to random values.
+     */
+    sessionId?: string;
+    /**
+     * Stable per-account key the conversation ids are derived from.
+     *
+     * Load-bearing for the pool: two accounts sending the SAME conversation id
+     * would present one device signing in as two identities, which is exactly
+     * what the gateway's channel check exists to catch. Naming the account here is
+     * what keeps every account's ids its own.
+     */
+    accountKey?: string;
+    /**
+     * One user send, as `userTurnKey` in `mapper.ts` derives it.
+     *
+     * Every tool step, retry and renewal replay of the SAME user turn keeps this
+     * value, so the gateway reads one send rather than N unrelated requests; the
+     * user's next message changes it. Absent or empty means "no turn to name" and
+     * degrades to a fresh id, which is the behaviour every non-chat surface keeps.
+     */
+    turnKey?: string;
+    /**
+     * This call goes to the Anthropic Messages surface.
+     *
+     * Adds its protocol headers. Deliberately explicit rather than inferred from
+     * the URL: the two surfaces want different header sets, and a call that
+     * guessed wrong would be refused for a reason the caller could have stated.
+     */
+    messages?: boolean;
+}
+/**
+ * Attribution and identity headers for one backend request.
+ *
+ * The gateway gates on this header set: the international deployment answers
+ * 401 without the CLI user agent and matching `Origin`/`Referer`, and both
+ * deployments read the account identity headers rather than deriving it from
+ * the bearer token alone.
+ *
+ * `channel` marks a request to the chat endpoint, which is the only surface
+ * whose channel check wants the {@link conversationHeaders} group.
+ */
+export declare function workBuddyHeaders(credentials: Pick<WorkBuddyCredentials, 'accessToken' | 'domain' | 'uid' | 'enterpriseId' | 'backend'>, extra?: Record<string, string>, channel?: WorkBuddyChannelOptions): Record<string, string>;
+/**
+ * Content coding a chat request's body is sent with.
+ *
+ * Measured: the official CLI's `GzipRequestProcessor` compresses each POST's
+ * body and sets `Content-Encoding: gzip`, and both builds turn that feature on.
+ * The saving is not marginal — a long agent conversation re-sends its whole
+ * history on every step, which plain-JSON uploads made bytes-on-the-wire the
+ * dominant cost of using this route.
+ *
+ * Only a chat completion is compressed: the same fetch also serves surfaces
+ * whose parser reads plain JSON (the images API answers 400 `code 11101`
+ * "invalid character '\\x1f'" to a gzipped body), so the caller opts in by
+ * calling this rather than every request getting it.
+ */
+export declare const GZIP_CONTENT_ENCODING = "gzip";
+/** One chat body, compact JSON, gzipped for the wire. */
+export declare function gzipChatBody(body: string): Uint8Array;
+/** Header set that declares one request's body coding. */
+export declare function encodedBodyHeaders(encoding: string | undefined): Record<string, string>;
+/**
+ * Refresh an access token against the endpoint the official IDE uses.
+ *
+ * The response carries a whole new `auth` block rather than just a token, so it
+ * is merged over the current one: fields the endpoint omits (the domain, the
+ * refresh lifetime) must survive, or the next refresh would lose its target.
+ */
+export declare function refreshCredentials(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions): Promise<WorkBuddyCredentials>;
+/** Public account facts for the settings card. */
+export declare function accountFromCredentials(credentials: WorkBuddyCredentials): WorkBuddyAccount;
+/**
+ * Read the signed-in account for a credential.
+ *
+ * The browser-authorization token response states the access token and the
+ * refresh token but **not** which account they belong to, so a login that
+ * relied on it alone could only key the account by the display name it also
+ * did not have — which is where the duplicate row and the `账号 1` label came
+ * from. The official client reads the account from this same endpoint right
+ * after polling the token; measured live, it returns the uid, the nickname,
+ * the UIN and the enterprise id for a valid bearer.
+ *
+ * A failure is not fatal to the sign-in: the token is usable, so the caller
+ * keeps the credential it has and lets the token's own claims fill in what
+ * they can.
+ */
+export declare function fetchAccountIdentity(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions): Promise<WorkBuddyTokenIdentity | null>;
+/**
+ * Parse one `/v3/config` payload's model list.
+ *
+ * Each entry carries the facts this route needs directly, so nothing is
+ * inferred from the model's name. Image-generation tools (`tags` naming
+ * `text-to-image`/`image-to-image`) are skipped: they are not chat models and
+ * carry no context window.
+ *
+ * `credits` is read here rather than left to the shipped table because a
+ * reachable gateway **replaces** that table entirely: a multiplier transcribed
+ * offline would be the only one a signed-in user ever saw, and it would stay
+ * wrong the moment the subscription repriced a model. A string this route cannot
+ * turn into a number (`''`, which `default-model` publishes, or a value a
+ * future gateway invents) leaves the field off the entry altogether instead of
+ * writing a plausible-looking `0` — see `parseWorkBuddyCreditMultiplier`.
+ */
+export declare function parseConfigModels(payload: unknown, region: WorkBuddyCredentials['region']): WorkBuddyModelEntry[];
+export declare function getCachedCatalog(): WorkBuddyModelEntry[];
+export declare function clearCachedCatalog(): void;
+/**
+ * Fetch the live catalog for one account.
+ *
+ * The gateway is the authority on capabilities, so a successful read replaces
+ * the shipped table entirely; a failure returns an empty list and the caller
+ * falls back, which keeps a first run usable before sign-in.
+ */
+export declare function fetchConfigCatalog(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions): Promise<WorkBuddyModelEntry[]>;
+/** Cached catalog with a TTL; a failed refresh keeps the previous snapshot.
+ *
+ * On the first cache miss of a process the persisted snapshot is rehydrated
+ * first, so a restart serves the previous listing without waiting on the
+ * network. An expired snapshot still answers immediately (stale) while a
+ * refresh runs in the background — the catalog is not fast-moving data, and
+ * waiting on an unreachable gateway turned a restart into the full discovery
+ * timeout on every model resolution.
+ */
+export declare function loadConfigCatalog(credentials: WorkBuddyCredentials, options?: WorkBuddyRequestOptions & {
+    force?: boolean;
+}): Promise<WorkBuddyModelEntry[]>;
+/** Parse one `Capacity*` account record into the public quota shape. */
+export interface ParsedBilling {
+    packageName: string | null;
+    totalCredits: number | null;
+    remainingCredits: number | null;
+    cycleUsedCredits: number | null;
+    cycleCredits: number | null;
+    cycleStartsAt: number | null;
+    cycleEndsAt: number | null;
+}
+/**
+ * Parse the billing payload's account list.
+ *
+ * The response nests as `data.Response.Data.Accounts[]`; each entry describes
+ * one purchased package with its own capacity counters. The first entry is the
+ * active subscription, and the totals are summed across all of them because a
+ * user can hold several packages at once.
+ */
+export declare function parseBilling(payload: unknown): ParsedBilling;
+/**
+ * Parse a cycle boundary.
+ *
+ * The service sends these as local-time strings without a zone
+ * (`2026-09-01 00:00:00`), which `Date.parse` reads as local time — the same
+ * reading the IDE's own panel uses, so the card agrees with it.
+ */
+export declare function parseCycleTime(value: unknown): number | null;
+/** Turn a parsed billing snapshot into the meters the card renders. */
+export declare function billingMeters(billing: ParsedBilling): WorkBuddyMeter[];
+/**
+ * The snapshot read most recently, whichever account it belongs to.
+ *
+ * Kept with a no-argument signature for backward compatibility; the page-level
+ * facts use {@link getCachedQuotaFor} instead, because they describe one
+ * account and must never be another account's numbers.
+ */
+export declare function getCachedQuota(): WorkBuddyAccountQuota | undefined;
+/**
+ * The snapshot remembered for one account, if it was read before.
+ *
+ * This is the lookup the account pool calls while it builds its summaries: a
+ * pure memory read, never a fetch. Passing no account keeps the pre-pool
+ * behavior of returning whatever was fetched last.
+ */
+export declare function getCachedQuotaFor(accountId?: string | null): WorkBuddyAccountQuota | undefined;
+export declare function clearCachedQuota(): void;
+/**
+ * Read the account's credit allowance.
+ *
+ * Only one billing route exists here, so a failure is a real failure rather
+ * than a partially-answered snapshot: the caller decides whether to surface it.
+ */
+export declare function fetchAccountQuota(store?: FileCredentialStore, fetchFn?: typeof fetch, force?: boolean, accountId?: string | null, hiddenAccountIds?: readonly string[]): Promise<WorkBuddyAccountQuota>;
+export { PROVIDER_ID, PROVIDER_NAME };
+//# sourceMappingURL=client.d.ts.map

package/lib/types/host/workbuddy/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/client.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACf,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAsBL,WAAW,EACX,aAAa,EAKd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,mBAAmB,EAAsB,KAAK,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAErG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC3D,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAQpF,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AA4CD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAA;IAClC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAwDD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,aAAa,GAAG,QAAQ,GAAG,KAAK,GAAG,cAAc,GAAG,SAAS,CAAC,EACtG,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAClC,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA+BxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,SAAS,CAAA;AAE3C,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAIrD;AAED,0DAA0D;AAC1D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAoD/B;AAED,kDAAkD;AAClD,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,oBAAoB,GAAG,gBAAgB,CAiB1F;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAyBxC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,GAAG,mBAAmB,EAAE,CA8EjH;AAkBD,wBAAgB,gBAAgB,IAAI,mBAAmB,EAAE,CAExD;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAMzC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,oBAAoB,EACjC,OAAO,GAAE,uBAAuB,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1D,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAyDhC;AAiDD,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAwC5D;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAQ5D;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,EAAE,CAmCtE;AA4CD;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,qBAAqB,GAAG,SAAS,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,qBAAqB,GAAG,SAAS,CAG9F;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAKvC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,sBAA4B,EACjC,OAAO,GAAE,OAAO,KAAa,EAC7B,KAAK,UAAQ,EACb,SAAS,GAAE,MAAM,GAAG,IAAW,EAC/B,gBAAgB,GAAE,SAAS,MAAM,EAAO,GACvC,OAAO,CAAC,qBAAqB,CAAC,CAmEhC;AAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA"}

package/lib/types/host/workbuddy/dsml.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Recovery of tool calls the model PRINTED instead of emitting structurally.
+ *
+ * Measured upstream behaviour (and the reason workbuddy2api-hub has the same
+ * recovery, `wb_proxy.py` "Printed tool calls on the Chat Completions path"):
+ * a tools request sometimes answers with the call spelled out inside `content`
+ * — either the full-width DSML form
+ *
+ *     <||DSML|| calls><||DSML|| invoke name="run_code">
+ *       <||DSML|| parameter name="code">print(1)</||DSML|| parameter>
+ *     </||DSML|| invoke></||DSML|| calls>
+ *
+ * or a hybrid the model mixes on its own: a plain opening tag closed by DSML
+ * tags, with the first parameter's close tag swallowed. Forwarded verbatim the
+ * client sees prose, finds no call, and the turn simply ends — reported by
+ * users as "it keeps stopping by itself".
+ *
+ * A structured `tool_calls` delta always wins; this only runs for text, which
+ * is why the recovery is a pure function over the accumulated content.
+ */
+/** One recovered call, in the shape the mapper emits. */
+export interface PrintedToolCall {
+    id: string;
+    name: string;
+    arguments: string;
+}
+/** A successful recovery: the calls plus the prose left behind. */
+export interface PrintedRecovery {
+    calls: PrintedToolCall[];
+    clean: string;
+}
+/** Recover the full-width `<||DSML|| …>` spelling. */
+export declare function parseDsmlToolCalls(text: string): PrintedRecovery | null;
+/**
+ * Recover the hybrid spelling, driven by the `<parameter>` elements.
+ *
+ * Parameter elements are spelled the same way in both shapes and a parameter
+ * name is the one thing a call cannot do without, so they are the anchor; the
+ * nearest preceding opening tag that is neither a wrapper nor a parameter names
+ * the tool.
+ */
+export declare function parseLeakedToolCalls(text: string): PrintedRecovery | null;
+/** Recover a printed call under either spelling. */
+export declare function recoverPrintedToolCalls(text: string): PrintedRecovery | null;
+/**
+ * Index from which a streaming text buffer must be held back.
+ *
+ * The earliest `<` that either opens a recognisable tag or could still grow
+ * into one (a delta may split `<parameter` across frames), or -1 when the
+ * whole buffer is safe to emit as prose.
+ */
+export declare function printedCallHoldIndex(text: string): number;
+/** Whether a held buffer has already reached a closing tag. */
+export declare function printedCallLooksComplete(text: string): boolean;
+//# sourceMappingURL=dsml.d.ts.map

package/lib/types/host/workbuddy/dsml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsml.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/dsml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AA2CD,sDAAsD;AACtD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAiBvE;AAiBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAyFzE;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAE5E;AAgBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,+DAA+D;AAC/D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D"}

package/lib/types/host/workbuddy/guardrails.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Local quota guardrails for the WorkBuddy line.
+ *
+ * The subscription meters an account × model over a 24h window (429 `code
+ * 6004`), but it only says so AFTER the window is gone — and on the shared
+ * account that window is minutes of a large model or a day of a small one. These
+ * guardrails stop serving BEFORE that happens, so an exhausted window never has
+ * to be discovered by a user staring at a 429.
+ *
+ * Three of the four guardrails workbuddy2api-hub ships are reproduced here, and
+ * all three are EXACT — they read numbers this plugin already has:
+ *
+ *   reserveCredits    stop the account when its remaining credits fall below N
+ *                     (the billing snapshot already reports the remainder)
+ *   dailyTokens       stop the account for the rest of the local day at N tokens
+ *   modelDailyTokens  stop ONE model for the rest of the local day at N tokens
+ *
+ * The fourth one there — a daily CREDITS budget — is deliberately NOT
+ * reproduced: a request's credit cost is not on the wire this route reads, and
+ * deriving it from the catalog multiplier × tokens would invent a number that
+ * silently diverges from the bill. A guardrail that lies is worse than none.
+ *
+ * `0` means OFF for every field, and the default is all-off: an install that
+ * never opens this setting behaves exactly as before.
+ */
+import type { WorkBuddyGuardrailsDto } from '../../shared/workbuddy-contracts.ts';
+/**
+ * The three exact guardrails.
+ *
+ * The shape has ONE definition — the shared wire contract — so the card and the
+ * enforcement can never disagree about a field name.
+ */
+export type WorkBuddyGuardrails = WorkBuddyGuardrailsDto;
+/** Shipped default: every guardrail off. */
+export declare const DEFAULT_GUARDRAILS: WorkBuddyGuardrails;
+/** Narrow a stored or patched value into guardrails; anything unusable means off. */
+export declare function normalizeGuardrails(value: unknown): WorkBuddyGuardrails;
+/** Whether any guardrail is armed; a no-op check must stay cheap. */
+export declare function guardrailsArmed(guardrails: WorkBuddyGuardrails): boolean;
+/**
+ * The local calendar day a counter belongs to.
+ *
+ * Local, not UTC, because the reset the user reasons about is their own
+ * midnight — the same choice this line makes for the CN check-in day.
+ */
+export declare function localDayKey(now?: number): string;
+/** Per-account counters for one day. */
+export interface UsageLedgerEntry {
+    tokens: number;
+    perModel: Record<string, number>;
+}
+/** Where the local usage counters live. */
+export declare function usageLedgerPath(): string;
+/**
+ * Token counters per account per local day.
+ *
+ * Deliberately a small persisted document rather than an accounting system: it
+ * exists to answer one question ("has this account / model used its day?") and a
+ * restart must not forget it, or a guardrail would reset by restarting DSH.
+ */
+export declare class WorkBuddyUsageLedger {
+    private readonly filePath;
+    private readonly now;
+    private document;
+    private loaded;
+    private writing;
+    constructor(filePath?: string, now?: () => number);
+    /** Read the counters once; a missing or unreadable file starts a fresh day. */
+    load(): Promise<void>;
+    /** Drop yesterday's counters the moment a read notices the day changed. */
+    private rollIfNewDay;
+    /** Tokens one account has used today, across models. */
+    tokensToday(accountId: string): number;
+    /** Tokens one account has used today on one model. */
+    modelTokensToday(accountId: string, model: string): number;
+    /** Today's counters, for the settings card and for tests. */
+    snapshot(): Readonly<Record<string, UsageLedgerEntry>>;
+    /**
+     * Add one request's tokens.
+     *
+     * Serialized through a promise chain: two concurrent requests on different
+     * accounts would otherwise read the same document, add their own counts and
+     * write, losing one of them.
+     */
+    record(accountId: string, model: string, tokens: number): Promise<void>;
+    private persist;
+}
+/** Why an account may not serve a request. */
+export type GuardrailReason = 'reserve-credits' | 'daily-tokens' | 'model-daily-tokens';
+/** The verdict for one account on one model. */
+export type GuardrailVerdict = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: GuardrailReason;
+    detail: string;
+};
+/**
+ * Decide whether one account may serve one model right now.
+ *
+ * Pure on purpose: every number it reads is passed in, so the decision can be
+ * tested without a pool, a clock or a network.
+ */
+export declare function evaluateGuardrails(input: {
+    guardrails: WorkBuddyGuardrails;
+    tokensToday: number;
+    modelTokensToday: number;
+    /** Remaining credits from the billing snapshot; null when never read. */
+    remainingCredits: number | null | undefined;
+}): GuardrailVerdict;
+//# sourceMappingURL=guardrails.d.ts.map

package/lib/types/host/workbuddy/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,sBAAsB,CAAA;AAExD,4CAA4C;AAC5C,eAAO,MAAM,kBAAkB,EAAE,mBAIhC,CAAA;AAOD,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAQvE;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,SAAa,GAAG,MAAM,CAKpD;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC;AAQD,2CAA2C;AAC3C,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAmE;IACnF,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,OAAO,CAAmC;gBAG/B,QAAQ,SAAoB,EAC5B,GAAG,GAAE,MAAM,MAAyB;IAGvD,+EAA+E;IACzE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC3B,2EAA2E;IAC3E,OAAO,CAAC,YAAY;IAMpB,wDAAwD;IACxD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAKtC,sDAAsD;IACtD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAK1D,6DAA6D;IAC7D,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAKtD;;;;;;OAMG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAY/D,OAAO;CAMtB;AAED,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,cAAc,GAAG,oBAAoB,CAAA;AAEvF,gDAAgD;AAChD,MAAM,MAAM,gBAAgB,GACxB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,UAAU,EAAE,mBAAmB,CAAA;IAC/B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAC5C,GAAG,gBAAgB,CA4BnB"}