@eddyskywalker/dsh-chatgpt-subscription 0.46.1 → 0.48.0

package/lib/types/host/workbuddy/outbound-identity.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Outbound client identities this route can present.
+ *
+ * The subscription gateway gates on client identity, and it gates DIFFERENTLY
+ * per surface: measured on this route, `CodeBuddyIDE` is rejected by
+ * `/v3/config` with 400 `code 12403` ("check ua") and 401'd outright by the
+ * international chat endpoint, which is why the CLI identity is what the line
+ * ships and has always used.
+ *
+ * Two more identities exist on the same backend. Both were captured by sibling
+ * gateways that reverse-engineered the real clients' requests; this file's
+ * version block below names the exact source of every string it sends.
+ *
+ *   desktop   `WorkBuddy/<app> <appName>/<app> CLI/<cli>`, where `<app>` is
+ *             the desktop build, `<appName>` is `WorkBuddy` (domestic) or
+ *             `workbuddy-ai` (international) and `<cli>` is the CLI bundled
+ *             inside that build
+ *             + `X-IDE-Type/Name: WorkBuddy`, `X-IDE-Version`, `X-Agent-Intent: craft`
+ *             + `X-Agent-Purpose: conversation`, `X-Agent-Type: main`,
+ *             + `X-Agent-Runtime: local-agent` (the 5.9 client names where the
+ *               agent runs; the header is absent in 5.8), trace headers
+ *   vscode    `VSCode/<ide> WorkBuddy/<product>`
+ *             + `X-IDE-Type/Name: VSCode`, `X-IDE-Version`, `X-Product-Version`, `X-Env-ID`
+ *   cli       `CLI/2.63.2 CodeBuddy/2.63.2` + no overrides
+ *
+ * The `cli` literal is kept byte-identical to what this line has always sent,
+ * but it is NO LONGER the default: upstream now refuses any agent that is not a
+ * `WorkBuddy/<version>` one with error 10085, which is exactly what a bare
+ * `CLI/...` agent is. `DEFAULT_OUTBOUND_SETTING` therefore names `workbuddy`,
+ * and {@link migrateOutboundSettingDocument} moves a stored pre-marker document
+ * across without overriding a choice the user has since made.
+ *
+ * Quota is NOT per identity: the subscription meters an account × model over a
+ * 24h window (429 `code 6004`), so switching identity cannot create allowance.
+ * What it can do is give each account a stable, plausible client — the same
+ * reason the gateway projects one device per account.
+ */
+import type { WorkBuddyOutboundProduct, WorkBuddyOutboundSetting } from '../../shared/workbuddy-contracts.ts';
+export type { WorkBuddyOutboundProduct, WorkBuddyOutboundSetting };
+/** Everything the settings card may offer, in display order. */
+export declare const OUTBOUND_PRODUCTS: readonly WorkBuddyOutboundProduct[];
+/**
+ * Shipped default: the desktop identity.
+ *
+ * It used to be `cli`, because that literal is what this line measured working
+ * first. That is no longer true — upstream refuses any agent that is not a
+ * `WorkBuddy/<version>` one with error 10085, and a bare `CLI/...` agent is
+ * exactly such a request (see the version block below, which cites the source
+ * of both facts). The desktop identity is the shipped one because it is the
+ * identity that presents a `WorkBuddy/<version>` agent.
+ *
+ * A document written while `cli` was the default is moved across ONCE by
+ * {@link migrateOutboundSettingDocument}; a choice made after that is never
+ * revisited.
+ */
+export declare const DEFAULT_OUTBOUND_SETTING: WorkBuddyOutboundProduct;
+/** Narrow a stored or patched value into a supported preference. */
+export declare function normalizeOutboundSetting(value: unknown): WorkBuddyOutboundSetting;
+/**
+ * Which identity one account uses.
+ *
+ * `auto` assigns by hashing the account key, so an account keeps the same
+ * client for its whole life — the one property that matters for a device
+ * fingerprint — while a pool as a whole spreads over the available clients.
+ */
+export declare function resolveOutboundProduct(setting: WorkBuddyOutboundSetting, accountKey: string): WorkBuddyOutboundProduct;
+/**
+ * A stable pseudo-device id for one account.
+ *
+ * Same derivation as the measured clients (`derive_id`: md5 of `salt:uid`
+ * reshaped into a UUID), so the value is a well-formed v4-shaped machine id
+ * that never changes for an account and never collides between accounts. A
+ * per-PROCESS id would be worse than none here: it would present every account
+ * in the pool as the same machine.
+ */
+export declare function deriveMachineId(uid: string): string;
+/** Identity-specific headers and user agent for one request. */
+export interface OutboundIdentity {
+    product: WorkBuddyOutboundProduct;
+    userAgent: string;
+    /** Extra or overriding headers; `conversation` supplies the ids already minted. */
+    headers(conversation: Readonly<Record<string, string>>): Record<string, string>;
+}
+/** Resolve the identity block for one product on one region. */
+export declare function outboundIdentity(product: WorkBuddyOutboundProduct, region: 'cn' | 'intl', uid: string): OutboundIdentity;
+/**
+ * Version of the outbound-identity semantics one settings document carries.
+ *
+ * 1 (never written as a number) = the era whose shipped default was `cli`. That
+ *   era wrote `cli` into a document as soon as it normalised an unset
+ *   preference, so a stored `cli` from it cannot be told apart from "untouched".
+ * 2 = the desktop default.
+ *
+ * A document with no marker is version 1 — that direction is load-bearing. A
+ * register-backed scope whose schema defaulted the marker to the CURRENT version
+ * would declare every stale document already migrated, which is the same
+ * upgrade-breaks-everyone bug reached through the other storage path.
+ */
+export declare const OUTBOUND_IDENTITY_VERSION = 2;
+/** What an absent marker means. Deliberately not the current version. */
+export declare const LEGACY_OUTBOUND_IDENTITY_VERSION = 1;
+/** One stored preference, as {@link migrateOutboundSettingDocument} reads it. */
+export interface OutboundSettingDocument {
+    /** The stored preference, in whatever shape the document holds it. */
+    outboundIdentity?: unknown;
+    /** The marker; absent on a pre-marker document. */
+    outboundIdentityVersion?: unknown;
+}
+/** What a caller must use, and whether it must write the document back. */
+export interface MigratedOutboundSetting {
+    /** The identity this host is to present. */
+    outboundIdentity: WorkBuddyOutboundSetting;
+    /** Marker the document carries after this read. */
+    outboundIdentityVersion: number;
+    /** Whether the caller must persist the document (marker and/or new value). */
+    migrated: boolean;
+}
+/**
+ * Read one stored outbound preference, migrating the pre-marker default once.
+ *
+ * The rule, and the reason for each half:
+ *
+ * - `marker >= 2`: this document has been through the migration. Whatever it
+ *   holds is a choice now — `cli` included, which a deployment may pin on
+ *   purpose — so the value is returned untouched and nothing is written.
+ * - no marker and a stored `cli`: the era's default, indistinguishable from a
+ *   deliberate one, and a value upstream now refuses (10085). It becomes
+ *   {@link DEFAULT_OUTBOUND_SETTING} and the marker is stamped. The stamp is
+ *   what makes this idempotent AND what stops a genuine `cli` pinned AFTER the
+ *   migration from being flipped on the next read.
+ * - no marker and any other value (`auto`/`workbuddy`/`vscode`): a real user
+ *   setting, kept as-is; only the marker is stamped, so a later upgrade never
+ *   re-decides it.
+ *
+ * An unparseable stored value normalises to the shipped default, exactly as an
+ * absent one does, and is stamped: garbage is not a preference.
+ */
+export declare function migrateOutboundSettingDocument(document: OutboundSettingDocument): MigratedOutboundSetting;
+//# sourceMappingURL=outbound-identity.d.ts.map

package/lib/types/host/workbuddy/outbound-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-identity.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/outbound-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAGH,OAAO,KAAK,EACV,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,qCAAqC,CAAA;AAE5C,YAAY,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,CAAA;AAElE,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,EAAE,SAAS,wBAAwB,EAAmC,CAAA;AAEpG;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,EAAE,wBAAsC,CAAA;AAE7E,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAKjF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,wBAAwB,EACjC,UAAU,EAAE,MAAM,GACjB,wBAAwB,CAK1B;AAoFD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAoBD,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,wBAAwB,CAAA;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChF;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,IAAI,GAAG,MAAM,EACrB,GAAG,EAAE,MAAM,GACV,gBAAgB,CA6DlB;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,IAAI,CAAA;AAEjD,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,4CAA4C;IAC5C,gBAAgB,EAAE,wBAAwB,CAAA;IAC1C,mDAAmD;IACnD,uBAAuB,EAAE,MAAM,CAAA;IAC/B,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,uBAAuB,GAChC,uBAAuB,CAqBzB"}

package/lib/types/host/workbuddy/routes.d.ts

@@ -0,0 +1,56 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { DEFAULT_CONTEXT_WINDOW, PROVIDER_ID, PROVIDER_NAME } from './types.ts';
+import { FileCredentialStore, FileModelSettingsStore, type WorkBuddyAtRestKeyStore, type WorkBuddyPreferenceStore } from './token-store.ts';
+import { getCachedQuota } from './client.ts';
+import { type WorkBuddyModelEntry } from './model-catalog.ts';
+import type { WorkBuddyModelOption, WorkBuddyWebStatus } from '../../shared/workbuddy-contracts.ts';
+import type { WorkBuddyCheckinService } from './checkin.ts';
+import type { WorkBuddyAccountPool } from './account-pool.ts';
+/**
+ * The selection the card should show.
+ *
+ * A stored list that still equals the shipped default has never been edited, so
+ * it cannot know about models the catalog has since added; treating it as
+ * "everything this account can call" keeps a first run from hiding models
+ * behind an unedited default. Any explicit edit is honoured exactly.
+ */
+export declare function resolveEnabledModelIds(stored: readonly string[], available: readonly string[], enabled?: boolean): string[];
+/**
+ * Build the model options the settings card renders.
+ *
+ * Order comes from the caller, which passes a vendor-grouped list so a family
+ * is not interleaved with the next one; this preserves whatever order it is
+ * given rather than imposing a second one.
+ *
+ * `credits` is passed through whole, every region the entry carries. Trimming
+ * it to one account's region is tempting and wrong: this DTO is also read with
+ * no account in hand (the harness resolves a model list before a credential is
+ * chosen), and such a caller would be told nothing rather than everything. The
+ * region key the reader actually has is already on each entry as `regions`, so
+ * picking a value is the renderer's job, not this one's.
+ */
+export declare function buildModelOptions(catalog: readonly WorkBuddyModelEntry[], available: readonly string[], enabledModelIds: readonly string[], overrides: Record<string, number>): WorkBuddyModelOption[];
+export interface WorkBuddyStatusOptions {
+    fetchFn?: typeof fetch;
+    /** Whether this plugin currently owns the provider route; re-read on every status. */
+    serving?: boolean | (() => boolean);
+    /** Diagnostic when another plugin owns the provider route; re-read on every status. */
+    conflict?: string | null | (() => string | null);
+    /** Multi-account pool this line schedules through; absent keeps the single-account card. */
+    accountPool?: WorkBuddyAccountPool;
+    /** Daily check-in scheduler; absent leaves the card's check-in row empty. */
+    checkin?: Pick<WorkBuddyCheckinService, 'tick' | 'summary'>;
+    /**
+     * Storage for the `$wbEncrypted` at-rest key.
+     *
+     * Absent hides the whole control: without it a pasted key could not be
+     * remembered, and offering the field anyway would lose it on restart.
+     */
+    atRestKey?: Pick<WorkBuddyAtRestKeyStore, 'adopt' | 'clear' | 'load' | 'path'>;
+}
+/** Everything the settings card renders: account, quota, and the model catalog. */
+export declare function getWorkBuddyWebStatus(store: FileCredentialStore, modelSettings: FileModelSettingsStore, preferences?: WorkBuddyPreferenceStore, options?: WorkBuddyStatusOptions): Promise<WorkBuddyWebStatus>;
+/** Register the WorkBuddy settings routes under `/workbuddy/api`. */
+export declare function registerWorkBuddyRoutes(ctx: Context, store: FileCredentialStore, modelSettings: FileModelSettingsStore, preferences?: WorkBuddyPreferenceStore, options?: WorkBuddyStatusOptions): () => void;
+export { PROVIDER_ID, PROVIDER_NAME, DEFAULT_CONTEXT_WINDOW, getCachedQuota, type WorkBuddyModelOption, type WorkBuddyWebStatus, };
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/host/workbuddy/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAIlD,OAAO,EAGL,sBAAsB,EACtB,WAAW,EACX,aAAa,EAEd,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EAGtB,KAAK,uBAAuB,EAE5B,KAAK,wBAAwB,EAC9B,MAAM,kBAAkB,CAAA;AAIzB,OAAO,EAKL,cAAc,EAKf,MAAM,aAAa,CAAA;AACpB,OAAO,EAUL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EAIV,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAG3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AA6C7D;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,OAAO,UAAO,GACb,MAAM,EAAE,CASV;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,mBAAmB,EAAE,EACvC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,oBAAoB,EAAE,CA6BxB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IACnC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;IAChD,4FAA4F;IAC5F,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;IAC3D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,CAAA;CAC/E;AAMD,mFAAmF;AACnF,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,sBAAsB,EACrC,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,kBAAkB,CAAC,CAuF7B;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,sBAAsB,EACrC,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,sBAA2B,GACnC,MAAM,IAAI,CAkbZ;AAED,OAAO,EACL,WAAW,EACX,aAAa,EACb,sBAAsB,EACtB,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,GACxB,CAAA"}

package/lib/types/host/workbuddy/token-store.d.ts

@@ -0,0 +1,370 @@
+import type { WorkBuddyCheckinSettings, WorkBuddyReasoningEffort, WorkBuddyRegion } from '../../shared/workbuddy-contracts.ts';
+import { type ContextWindowOverridePatch } from '../common/context-window-overrides.ts';
+import { type WorkBuddyGuardrails } from './guardrails.ts';
+import { type WorkBuddyOutboundSetting } from './outbound-identity.ts';
+import type { CredentialStore } from '../token-store.ts';
+import { isIntlDomain } from './types.ts';
+export declare const WORKBUDDY_PREFERENCES_NAMESPACE = "dsh-workbuddy";
+export type { WorkBuddyReasoningEffort };
+/**
+ * One WorkBuddy credential, parsed from a CodeBuddy desktop `*.info` file.
+ *
+ * These files are the IDE's own credential store, not this plugin's: the plugin
+ * reads them so a user who is already signed in to the IDE needs no second
+ * login. A refreshed token is written back so both clients stay valid instead of
+ * racing each other with a rotating refresh token.
+ */
+export interface WorkBuddyCredentials {
+    /** Bearer token for the chat and billing APIs. Host-only. */
+    accessToken: string;
+    /** Rotating refresh token. Host-only. */
+    refreshToken: string;
+    /** Unix milliseconds the access token stops being valid. */
+    expiresAt: number;
+    /** Region the account belongs to; decides which backend serves it. */
+    region: WorkBuddyRegion;
+    /** Auth domain recorded in the file, e.g. `copilot.tencent.com`. */
+    domain: string;
+    /** Backend base URL derived from {@link domain}. */
+    backend: string;
+    uid?: string;
+    nickname?: string;
+    uin?: string;
+    accountType?: string;
+    enterpriseId?: string;
+    /** Absolute path of the `*.info` file this credential came from. */
+    sourceFile: string;
+    /** File modification time when it was read, so a stale cache is detectable. */
+    sourceMtimeMs: number;
+    /** Which store owns the secret; only managed credentials may be deleted. */
+    source: 'desktop' | 'managed';
+    /**
+     * Sealed token material, when the file holds `$wbEncrypted` envelopes.
+     *
+     * The desktop client stopped writing plaintext tokens on 2026-09-24, so a
+     * credential read from such a file has no usable `accessToken` until the
+     * at-rest key opens these. They are kept verbatim here — never logged, never
+     * sent anywhere — and resolved by {@link unsealCredentials}.
+     */
+    sealed?: {
+        accessToken?: unknown;
+        refreshToken?: unknown;
+    };
+}
+export interface WorkBuddyModelSettings {
+    enabled?: boolean;
+    enabledModelIds: string[];
+    contextWindowOverrides: Record<string, number>;
+    defaultReasoningEffort: WorkBuddyReasoningEffort | null;
+    /** Stable account key selected by the user; null keeps automatic selection. */
+    selectedAccountId: string | null;
+    /** Desktop accounts hidden from this plugin without deleting CodeBuddy files. */
+    hiddenAccountIds: string[];
+    /** Daily check-in scheduler preferences. */
+    checkin: WorkBuddyCheckinSettings;
+    /**
+     * Which outbound client identity requests present.
+     *
+     * `auto` assigns one product per account (stable for the account's life);
+     * anything else pins it line-wide.
+     */
+    outboundIdentity: WorkBuddyOutboundSetting;
+    /**
+     * Which `outboundIdentity` semantics this document was written under.
+     *
+     * Read, never guessed: a document without it predates the desktop default and
+     * is migrated once by {@link migrateOutboundSettingDocument}. Writing the
+     * marker is what makes that migration idempotent and what stops a later
+     * explicit `cli` from being moved again.
+     */
+    outboundIdentityVersion: number;
+    /** Local quota guardrails; all-off by default. */
+    guardrails: WorkBuddyGuardrails;
+}
+export interface WorkBuddyPreferenceStore {
+    /**
+     * Resolve once the store has read whatever it was going to read.
+     *
+     * The file-backed store warms up asynchronously, so `status()` answers from
+     * shipped defaults until that read settles. A caller that acts on a
+     * preference at startup — the check-in scheduler signing in on boot — must
+     * await this first, or it acts on the default instead of the user's choice.
+     * A register-backed store reads synchronously and resolves immediately.
+     */
+    ready(): Promise<void>;
+    status(): WorkBuddyModelSettings;
+    update(patch: {
+        enabled?: boolean;
+        enabledModelIds?: string[];
+        /** `null` deletes one override and falls back to the catalog default. */
+        contextWindowOverrides?: ContextWindowOverridePatch;
+        defaultReasoningEffort?: WorkBuddyReasoningEffort | null;
+        selectedAccountId?: string | null;
+        hiddenAccountIds?: string[];
+        checkin?: Partial<WorkBuddyCheckinSettings>;
+        outboundIdentity?: WorkBuddyOutboundSetting;
+        guardrails?: Partial<WorkBuddyGuardrails>;
+    }): Promise<WorkBuddyModelSettings>;
+}
+/** Shipped check-in default: on. */
+export declare const DEFAULT_CHECKIN_SETTINGS: WorkBuddyCheckinSettings;
+/**
+ * Narrow an unknown stored/patched value into valid check-in settings.
+ *
+ * Documents written while the window was still configurable may carry
+ * startHour/endHour; those keys are inert now and dropped on the next write.
+ */
+export declare function normalizeCheckinSettings(value: unknown): WorkBuddyCheckinSettings;
+/**
+ * Bind the model selection to the DSH settings document when the harness still
+ * offers one, and to the JSON file beside it otherwise: a harness without the
+ * register seam (0.1.7, and a headless test) reads that file back on boot.
+ */
+export declare function registerWorkBuddyPreferenceStore(settings?: unknown, fallbackStore?: FileModelSettingsStore): WorkBuddyPreferenceStore;
+/**
+ * Credential directory the CodeBuddy desktop client writes to.
+ *
+ * `CODEBUDDY_AUTH_DIR` overrides it, matching the environment variable the
+ * official tooling honours, which is also what makes the scan testable without
+ * touching a real profile.
+ */
+export declare function codeBuddyAuthDir(): string;
+/** Plugin settings file, used when no settings service is present. */
+export declare function modelSettingsPath(): string;
+/** Encrypted account pool for credentials added through this plugin. */
+export declare function managedCredentialsPath(): string;
+/** Platform-encrypted storage for the pasted at-rest key (never plaintext on disk). */
+export declare function atRestKeyPath(): string;
+/**
+ * Storage for the `$wbEncrypted` protector key.
+ *
+ * The key is the one secret that unlocks the desktop client's tokens, so it goes
+ * through the same platform store the managed pool uses (DPAPI / Keychain /
+ * Secret Service) and is installed into the process only after the client's own
+ * keyblob accepts it. A pasted value that fails that check never displaces a
+ * working key.
+ */
+export declare class WorkBuddyAtRestKeyStore {
+    private readonly filePath;
+    private readonly backend;
+    private cached;
+    constructor(filePath?: string, backend?: CredentialStore<{
+        version: 1;
+        keyHex: string;
+    }>);
+    /** Human-readable storage description, mirroring the managed pool's. */
+    path(): string;
+    /**
+     * Load the stored key into the process.
+     *
+     * Called once at startup: the credential readers consult the module-level
+     * slot, so a key that is only on disk would otherwise leave every sealed
+     * account unreadable until something else triggered a load.
+     */
+    load(): Promise<Buffer | null>;
+    /** Validate and persist a pasted secret; returns the key id for display. */
+    adopt(text: string): Promise<string>;
+    /** Forget the key, both on disk and in this process. */
+    clear(): Promise<void>;
+}
+/**
+ * Parse one CodeBuddy `*.info` payload.
+ *
+ * Only the fields this plugin needs are read; the file also carries the IDE's
+ * own account bookkeeping, which is deliberately left untouched. A file without
+ * a usable access token is rejected rather than half-accepted, so the scanner
+ * can move on to the next candidate.
+ */
+export declare function parseCredentialFile(value: unknown, sourceFile: string, sourceMtimeMs?: number): WorkBuddyCredentials;
+/** Whether a credential is at or near expiry; refreshed a minute early. */
+export declare function isExpired(credentials: WorkBuddyCredentials, now?: number): boolean;
+/**
+ * Stable public key for selecting an account without exposing a token or tying
+ * the preference to a timestamped snapshot filename.
+ *
+ * The chain is uid → uin → nickname → domain, and the reason it is safe is
+ * **ordering**: {@link withResolvedIdentity} settles a credential's uid from
+ * its own token before any id is derived, so a real sign-in and the IDE's file
+ * for the same account both reach the uid branch and agree. The nickname rung
+ * is only reached by a token whose claims cannot be read at all, and keeping it
+ * there is what stops two such accounts in one region from collapsing onto the
+ * shared deployment key below it.
+ *
+ * A nickname must therefore never be the *first* rung: that is what split one
+ * account into two pool rows, because the browser-login response states the
+ * display name while the IDE's file states the uid. Likewise the uid must be
+ * settled *before* the id is minted, which is why the heal runs inside the
+ * credential parsers and the pool's own account creation.
+ */
+export declare function workBuddyAccountId(credentials: Pick<WorkBuddyCredentials, 'region' | 'uid' | 'uin' | 'nickname' | 'domain'>): string;
+/**
+ * Every key one credential may have been addressable under.
+ *
+ * A settings document written before the identity fix pinned and hid accounts
+ * by the old chain (`uid → uin → nickname → domain`), so an account that only
+ * had a nickname stored was addressed as `region:<nickname>`. The heal moves
+ * that account to its uid, and without this alias the stored pointer would
+ * silently stop matching — a pinned account would fall back to automatic
+ * routing and a hidden one would reappear. Callers therefore accept either
+ * spelling; only the current one is ever written.
+ */
+export declare function workBuddyAccountIdAliases(credentials: Pick<WorkBuddyCredentials, 'region' | 'uid' | 'uin' | 'nickname' | 'domain'>): string[];
+/** Strict parser for credentials owned by the plugin's encrypted pool. */
+export declare function parseManagedCredentials(value: unknown): WorkBuddyCredentials[];
+/**
+ * Candidate ordering for the scanned credential files.
+ *
+ * A user's auth directory accumulates timestamped snapshots beside the live
+ * file, and the live one is not always the newest. Preference order is: the
+ * plain `workbuddy-desktop.info` / `codebuddy-desktop.info` files first, then
+ * the newest `expiresAt` among the timestamped snapshots. Picking purely by
+ * mtime selected a stale snapshot during development, so the token's own
+ * expiry is what decides.
+ */
+/** What the last credential scan observed about sealed (`$wbEncrypted`) files. */
+export interface SealedCredentialDiagnostics {
+    /** Sealed credential files the scan met. */
+    sealedFiles: number;
+    /** Of those, how many the held key opened. */
+    opened: number;
+    /** True when at least one sealed file was skipped because no key is held. */
+    missingKey: boolean;
+    /** Why the last sealed file refused to open, when it did. */
+    lastError: string | null;
+}
+/** Snapshot of the last scan's sealed-credential observations. */
+export declare function sealedCredentialDiagnostics(): SealedCredentialDiagnostics;
+/**
+ * Resolve a credential's sealed tokens into usable plaintext.
+ *
+ * Returns `null` when the credential is sealed and this process holds no key
+ * that opens it: such a file is not an error the caller can act on per-file, it
+ * is a missing key the settings card reports once.
+ */
+export declare function unsealCredentials<T extends WorkBuddyCredentials>(credentials: T): T | null;
+/**
+ * Scan the CodeBuddy auth directory for usable credentials.
+ *
+ * Every `*.info` file is considered; unreadable or malformed ones are skipped
+ * rather than failing the whole scan, because the directory routinely holds
+ * expired snapshots next to the live credential.
+ */
+export declare function scanCredentials(dir?: string): Promise<WorkBuddyCredentials[]>;
+/** Encrypted credentials added through the WorkBuddy settings page. */
+export declare class ManagedCredentialStore {
+    private readonly filePath;
+    private readonly backend;
+    constructor(filePath?: string, backend?: CredentialStore<{
+        version: 1;
+        accounts: WorkBuddyCredentials[];
+    }>);
+    path(): string;
+    private serialize;
+    list(): Promise<WorkBuddyCredentials[]>;
+    add(credentials: WorkBuddyCredentials): Promise<void>;
+    update(credentials: WorkBuddyCredentials): Promise<void>;
+    delete(accountId: string): Promise<boolean>;
+}
+/**
+ * Credential store backed by the CodeBuddy desktop client's own auth files.
+ *
+ * The plugin does not own these files, so there is nothing to encrypt here: the
+ * secret is the IDE's, already on disk, and the only write this store performs
+ * is an atomic write-back of a refreshed token so the IDE does not lose its
+ * session. Tokens are never sent to a browser.
+ */
+export declare class FileCredentialStore {
+    private readonly dir;
+    /** How long a scan result is reused before the directory is re-read. */
+    private readonly cacheTtlMs;
+    private readonly managed;
+    private cached;
+    private scannedAt;
+    /** Serializes refresh/write-back per account; different accounts never share a token. */
+    private readonly refreshInFlight;
+    constructor(dir?: string, 
+    /** How long a scan result is reused before the directory is re-read. */
+    cacheTtlMs?: number, managed?: ManagedCredentialStore);
+    /** Directory this store scans. */
+    directory(): string;
+    /** Human-readable storage description for the settings card. */
+    path(): string;
+    managedPath(): string;
+    /** Read the selected credential, or the best visible candidate in automatic mode. */
+    read(options?: {
+        force?: boolean;
+        accountId?: string | null;
+        hiddenAccountIds?: readonly string[];
+    }): Promise<WorkBuddyCredentials | null>;
+    /** Whether a cached credential's source file is unchanged on disk. */
+    private isStillCurrent;
+    /**
+     * All distinct usable accounts, best credential first.
+     *
+     * The desktop directory keeps historical snapshots. They are credentials for
+     * the same account, not additional account choices, so only the first (best)
+     * candidate for each stable account id is exposed.
+     */
+    list(): Promise<WorkBuddyCredentials[]>;
+    /**
+     * Desktop credentials only, best first.
+     *
+     * The account pool adopts these so the IDE's own sign-ins take part in
+     * scheduling. Unlike {@link list} this never mixes in managed accounts:
+     * only the desktop set is re-adopted when the IDE changes its directory.
+     */
+    discoverDesktopCredentials(): Promise<WorkBuddyCredentials[]>;
+    /**
+     * Re-read one desktop credential file.
+     *
+     * A pooled desktop account must serve the IDE's current token rather than
+     * the copy taken when it was adopted, because the IDE rotates that token on
+     * its own schedule. Returns null when the file is gone or unreadable.
+     */
+    readDesktopFile(filePath: string): Promise<WorkBuddyCredentials | null>;
+    addManaged(credentials: WorkBuddyCredentials): Promise<void>;
+    deleteManaged(accountId: string): Promise<boolean>;
+    /** Forget the cached scan; the next read re-reads the directory. */
+    invalidate(): void;
+    /**
+     * Return a credential whose access token is valid, refreshing it first when
+     * it is at or near expiry.
+     *
+     * Concurrent callers share one refresh: the refresh token rotates, so two
+     * simultaneous refreshes would invalidate each other.
+     */
+    ensureFresh(credentials: WorkBuddyCredentials, refresh: (current: WorkBuddyCredentials) => Promise<WorkBuddyCredentials>): Promise<WorkBuddyCredentials>;
+    /** Renew after an upstream 401, even when the local expiry still looks valid. */
+    renew(credentials: WorkBuddyCredentials, refresh: (current: WorkBuddyCredentials) => Promise<WorkBuddyCredentials>): Promise<WorkBuddyCredentials>;
+    /**
+     * Persist a refreshed token back into the IDE's own credential file.
+     *
+     * Only the `auth` block is rewritten, and the write is atomic so a crash
+     * cannot leave the IDE with a half-written file. A failure here is not fatal
+     * to the in-flight request: the refreshed token still works for this process,
+     * and the next scan simply finds the older token on disk.
+     */
+    writeBack(credentials: WorkBuddyCredentials): Promise<void>;
+}
+/** Plain-JSON model settings used when the settings service is unavailable. */
+export declare class FileModelSettingsStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    path(): string;
+    read(): Promise<WorkBuddyModelSettings>;
+    write(settings: WorkBuddyModelSettings): Promise<void>;
+    updateSettings(patch: {
+        enabled?: boolean;
+        enabledModelIds?: string[];
+        /** `null` deletes one override and falls back to the catalog default. */
+        contextWindowOverrides?: ContextWindowOverridePatch;
+        defaultReasoningEffort?: WorkBuddyReasoningEffort | null;
+        selectedAccountId?: string | null;
+        hiddenAccountIds?: string[];
+        checkin?: Partial<WorkBuddyCheckinSettings>;
+        outboundIdentity?: WorkBuddyOutboundSetting;
+        guardrails?: Partial<WorkBuddyGuardrails>;
+    }): Promise<WorkBuddyModelSettings>;
+}
+export { isIntlDomain };
+//# sourceMappingURL=token-store.d.ts.map

package/lib/types/host/workbuddy/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/host/workbuddy/token-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAA;AAI9H,OAAO,EAA+B,KAAK,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAGpH,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAML,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAA;AAW/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAIxD,OAAO,EAGL,YAAY,EAEb,MAAM,YAAY,CAAA;AAEnB,eAAO,MAAM,+BAA+B,kBAAkB,CAAA;AAE9D,YAAY,EAAE,wBAAwB,EAAE,CAAA;AAOxC;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,MAAM,EAAE,eAAe,CAAA;IACvB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAA;IAClB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC3D;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,sBAAsB,EAAE,wBAAwB,GAAG,IAAI,CAAA;IACvD,+EAA+E;IAC/E,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,iFAAiF;IACjF,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,4CAA4C;IAC5C,OAAO,EAAE,wBAAwB,CAAA;IACjC;;;;;OAKG;IACH,gBAAgB,EAAE,wBAAwB,CAAA;IAC1C;;;;;;;OAOG;IACH,uBAAuB,EAAE,MAAM,CAAA;IAC/B,kDAAkD;IAClD,UAAU,EAAE,mBAAmB,CAAA;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC;;;;;;;;OAQG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,IAAI,sBAAsB,CAAA;IAChC,MAAM,CAAC,KAAK,EAAE;QACZ,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;QAC1B,yEAAyE;QACzE,sBAAsB,CAAC,EAAE,0BAA0B,CAAA;QACnD,sBAAsB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;QACxD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACjC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC3B,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAC3C,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;QAC3C,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;KAC1C,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;CACpC;AAID,oCAAoC;AACpC,eAAO,MAAM,wBAAwB,EAAE,wBAA4C,CAAA;AAEnF;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,wBAAwB,CAGjF;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,CAAC,EAAE,OAAO,EAClB,aAAa,yBAA+B,GAC3C,wBAAwB,CAqJ1B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAazC;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,uFAAuF;AACvF,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAaD;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAIhC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,MAAM,CAAsB;gBAGjB,QAAQ,SAAkB,EAC1B,OAAO,GAAE,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAoC;IAG9G,wEAAwE;IACxE,IAAI,IAAI,MAAM;IAMd;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgBpC,4EAA4E;IACtE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW1C,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAK7B;AAaD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,SAAI,GAAG,oBAAoB,CAsD/G;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,SAAa,GAAG,OAAO,CAGtF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GACxF,MAAM,CAGR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAC,GACxF,MAAM,EAAE,CAeV;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,CA8B9E;AAED;;;;;;;;;GASG;AACH,kFAAkF;AAClF,MAAM,WAAW,2BAA2B;IAC1C,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAA;IACnB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AASD,kEAAkE;AAClE,wBAAgB,2BAA2B,IAAI,2BAA2B,CAEzE;AAOD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,oBAAoB,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAsB1F;AAMD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,GAAG,SAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAiC/F;AAgBD,uEAAuE;AACvE,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,QAAQ,SAA2B,EACnC,OAAO,GAAE,eAAe,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC;QAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAA;KAAE,CAA4C;IAGxI,IAAI,IAAI,MAAM;IAMd,OAAO,CAAC,SAAS;IAWX,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAUvC,GAAG,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBrD,MAAM,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlD;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,MAAM,CAAoC;IAClD,OAAO,CAAC,SAAS,CAAI;IACrB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;gBAGhE,GAAG,SAAqB;IACzC,wEAAwE;IACvD,UAAU,SAAS,EACnB,OAAO,yBAA+B;IAGzD,kCAAkC;IAClC,SAAS,IAAI,MAAM;IAInB,gEAAgE;IAChE,IAAI,IAAI,MAAM;IAId,WAAW,IAAI,MAAM;IAIrB,qFAAqF;IAC/E,IAAI,CAAC,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAO,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA0BpJ,sEAAsE;YACxD,cAAc;IAY5B;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAc7C;;;;;;OAMG;IACG,0BAA0B,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAInE;;;;;;OAMG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAWvE,UAAU,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK5D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMxD,oEAAoE;IACpE,UAAU,IAAI,IAAI;IAKlB;;;;;;OAMG;IACG,WAAW,CACf,WAAW,EAAE,oBAAoB,EACjC,OAAO,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,oBAAoB,CAAC,GACxE,OAAO,CAAC,oBAAoB,CAAC;IAKhC,iFAAiF;IAC3E,KAAK,CACT,WAAW,EAAE,oBAAoB,EACjC,OAAO,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,oBAAoB,CAAC,GACxE,OAAO,CAAC,oBAAoB,CAAC;IAsBhC;;;;;;;OAOG;IACG,SAAS,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;CAmClE;AAED,+EAA+E;AAC/E,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAsB;IAE3D,IAAI,IAAI,MAAM;IAIR,IAAI,IAAI,OAAO,CAAC,sBAAsB,CAAC;IA+DvC,KAAK,CAAC,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOtD,cAAc,CAAC,KAAK,EAAE;QAC1B,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;QAC1B,yEAAyE;QACzE,sBAAsB,CAAC,EAAE,0BAA0B,CAAA;QACnD,sBAAsB,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAA;QACxD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACjC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;QAC3B,OAAO,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAC3C,gBAAgB,CAAC,EAAE,wBAAwB,CAAA;QAC3C,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;KAC1C,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAiCpC;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}