@young1lin/dsh-gpt-sub 0.1.0

package/lib/index.js

@@ -0,0 +1,581 @@
+/**
+ * Direct ChatGPT/Codex subscription access for DeepSeek Harness.
+ *
+ * This plugin owns no transport. pi-ai already ships an `openai-codex`
+ * provider that knows the Codex wire format -- it sets `store`, derives
+ * `chatgpt-account-id` from the access token's own JWT claim, and speaks the
+ * codex-responses protocol -- but it authenticates only through OAuth, and
+ * `dsh-llm-pi-ai` runs no login flow and holds no OAuth store. Naming a
+ * credential on the route grafts an api-key method beside the provider's own,
+ * which is the seam this plugin fills: it keeps a live Codex access token in
+ * the harness credential store, refreshing it from `~/.codex/auth.json` before
+ * it expires.
+ *
+ * The result needs no loopback port, no shared local key, and no external
+ * proxy binary. The `codex` CLI still owns the login.
+ *
+ * @module dsh-gpt-sub
+ */
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+import z from '@deepseek-ai/schemastery';
+import { readdir, stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { crossOrigin, loadStateOverride, readJsonObject, redactProxyUrl, saveStateOverride, validateProxyUrl, } from "./proxy-config.js";
+import { probeProxy } from "./proxy-probe.js";
+import { consumeResetCredit, listResetCredits } from "./reset-credits.js";
+import { installProxyRouting } from "./proxy-routing.js";
+import { QuotaSource } from "./quota-route.js";
+import { TokenStore } from "./token-store.js";
+import { fetchUsage, reportedWindows } from "./usage.js";
+/** Cordis plugin name. */
+export const name = 'gpt-sub';
+/**
+ * Required services. Without this declaration cordis's context proxy throws
+ * `cannot get property "credentials" without inject` the moment the plugin
+ * reads `ctx.credentials`, and the plugin sits dead with no retry.
+ */
+export const inject = ['credentials', 'webServer'];
+/** Where the browser half polls for the quota reading. */
+const QUOTA_ROUTE = '/gpt-sub/quota';
+/** Where the browser half reads auth/proxy status the panel renders. */
+const STATUS_ROUTE = '/gpt-sub/status';
+/** Where the browser half switches the live proxy at runtime. */
+const PROXY_ROUTE = '/gpt-sub/proxy';
+/** Where the browser half probes a candidate proxy before saving it. */
+const PROXY_TEST_ROUTE = '/gpt-sub/proxy/test';
+/** Where the browser half switches the credential file at runtime. */
+const AUTH_ROUTE = '/gpt-sub/auth';
+/** Where the browser half lists a directory to pick a credential file. */
+const AUTH_BROWSE_ROUTE = '/gpt-sub/auth/browse';
+/** Ceiling on one directory listing, so a huge folder cannot flood the page. */
+const BROWSE_LIMIT = 500;
+/** Ceiling on one connectivity probe. */
+const PROBE_TIMEOUT_MS = 15_000;
+/** Where the browser half lists rate-limit reset credits. */
+const RESET_CREDITS_ROUTE = '/gpt-sub/reset-credits';
+/** Where the browser half consumes one rate-limit reset credit. */
+const RESET_CREDITS_CONSUME_ROUTE = '/gpt-sub/reset-credits/consume';
+/** Ceiling on one reset-credit upstream call, matching the codex CLI's 10s. */
+const RESET_CREDITS_TIMEOUT_MS = 10_000;
+/**
+ * How a proxy URL appears in logs: credentials masked, direct named as such.
+ *
+ * @param url - the proxy URL as configured or saved.
+ * @returns the log-safe rendering.
+ */
+const displayProxy = (url) => (url === '' ? 'direct' : redactProxyUrl(url));
+/**
+ * Plugin config schema.
+ *
+ * Typed input-then-output: every field has a default, so a config document may
+ * supply any subset, and what comes back out is a fully resolved `ConfigShape`.
+ */
+export const Config = z.object({
+    // Empty means a direct connection. The token endpoint is as unreachable as
+    // the model endpoint on a machine that needs a proxy, so this covers both.
+    proxyUrl: z.string().default(''),
+    authFile: z.string().default('~/.codex/auth.json'),
+    refreshMarginMinutes: z.number().default(30),
+    // The credential the provider route names in settings.yaml. Both sides must
+    // agree, so it is configurable rather than hard-coded.
+    tokenRef: z.string().role('credential-ref').default('CODEX_NATIVE_TOKEN'),
+    // How often to re-read auth.json and republish. Well under the refresh
+    // margin, so a token nearing expiry is always renewed before a request needs
+    // it. Each tick is a file read; it reaches the network only to refresh.
+    syncIntervalMinutes: z.number().default(10),
+    // How many times a single request may be re-attempted after the connection
+    // drops. The link to the proxy fails at random, and each failure otherwise
+    // reaches the user as a bare `fetch failed` mid-conversation.
+    bootstrapRetries: z.number().default(3),
+    // Where the settings panel's proxy edits are persisted. When this file
+    // exists, its proxyUrl wins over the config's -- a page edit survives
+    // restarts without touching cordis config layers.
+    stateFile: z.string().default('~/.dsh/gpt-sub.json'),
+});
+/** Expand a leading `~` against the current user's home directory. */
+function expandHome(path) {
+    return path.startsWith('~/') ? join(homedir(), path.slice(2)) : path;
+}
+/**
+ * Publish the current Codex access token into the credential store, and keep
+ * publishing it for as long as the plugin is loaded.
+ *
+ * Async on purpose: cordis awaits a thenable returned from plugin startup and
+ * collects the function it resolves to as the fiber's disposer. A missing or
+ * unreadable `auth.json` therefore fails the fiber visibly at start instead of
+ * leaving a route configured against a credential nothing maintains.
+ *
+ * @param ctx - the cordis context.
+ * @param config - validated plugin configuration.
+ * @returns the teardown that stops the sync timer and closes the dispatcher.
+ */
+export async function apply(ctx, config) {
+    const stateFile = expandHome(config.stateFile);
+    // A panel-saved override wins over the config value; a corrupt file falls
+    // back to the config rather than failing the plugin over a status file.
+    // One state file carries both page-side choices; a field present in it wins
+    // over the config value, and a differing choice is logged at start.
+    const savedState = await loadStateOverride(stateFile);
+    const savedProxy = savedState?.proxyUrl;
+    if (savedProxy !== undefined && savedProxy !== config.proxyUrl) {
+        ctx.logger.info('gpt-sub: proxy override %s from %s replaces config proxyUrl %s', displayProxy(savedProxy), stateFile, displayProxy(config.proxyUrl));
+    }
+    let proxyUrl = savedProxy ?? config.proxyUrl;
+    let overridden = savedProxy !== undefined;
+    const savedAuthFile = savedState?.authFile;
+    if (savedAuthFile !== undefined && savedAuthFile !== config.authFile) {
+        ctx.logger.info('gpt-sub: credential file %s from %s replaces config authFile %s', savedAuthFile, stateFile, config.authFile);
+    }
+    let authFileDisplay = savedAuthFile ?? config.authFile;
+    let authOverridden = savedAuthFile !== undefined;
+    // Mirror of what the state file currently holds. Every save rewrites the
+    // whole object, so recording one choice never erases the other.
+    const persisted = {};
+    if (overridden)
+        persisted.proxyUrl = proxyUrl;
+    if (authOverridden)
+        persisted.authFile = authFileDisplay;
+    // pi-ai issues model calls through the global fetch, so the proxy has to be
+    // installed there rather than handed to a component. Scoped by hostname, so
+    // no other provider's traffic changes route.
+    let routing = proxyUrl === ''
+        ? undefined
+        : installProxyRouting(proxyUrl, { maxRetries: config.bootstrapRetries });
+    let dispatcher = routing?.dispatcher;
+    if (routing !== undefined) {
+        ctx.logger.info('gpt-sub: routing chatgpt.com and auth.openai.com through %s, retrying dropped connections %d times', displayProxy(proxyUrl), config.bootstrapRetries);
+    }
+    const tokens = new TokenStore({
+        authFile: expandHome(authFileDisplay),
+        refreshMarginMs: config.refreshMarginMinutes * 60_000,
+        ...(dispatcher === undefined ? {} : { dispatcher }),
+    });
+    const ref = credentialRef(config.tokenRef);
+    /** When the last successful sync finished; 0 before the first. */
+    let lastSyncAt = 0;
+    /**
+     * Read the current token -- refreshing first when it is inside the margin --
+     * and write it to the credential the provider route reads.
+     *
+     * @returns nothing; failures propagate to the caller.
+     */
+    const sync = async () => {
+        const current = await tokens.getTokens();
+        await ctx.credentials.set(ref, current.accessToken);
+        lastSyncAt = Date.now();
+    };
+    // Fail here, naming the path, rather than leaving the route pointed at a
+    // credential that will never be populated. A rejected apply() means cordis
+    // never receives the disposer below, so the global routing installed above
+    // has to be undone here too: a failed plugin must not leave the process
+    // dispatching through its still-open proxy agent.
+    try {
+        await tokens.verify();
+        await sync();
+    }
+    catch (error) {
+        await routing?.uninstall();
+        throw error;
+    }
+    ctx.logger.info('gpt-sub: published Codex access token to %s', config.tokenRef);
+    // Reachability probe. An unproxied egress answers 403 with a Cloudflare
+    // block page, and that failure is otherwise invisible until the first model
+    // call, where it surfaces as unreadable HTML. Log it loudly here instead.
+    // A probe failure must not fail the plugin: the network may simply be down,
+    // and the credential is published either way.
+    try {
+        const current = await tokens.getTokens();
+        // Bounded like the panel's own probe: a black-holed route must delay
+        // startup by seconds, not by the operating system's connect timeout.
+        const usage = await fetchUsage(current.accessToken, dispatcher, undefined, AbortSignal.timeout(PROBE_TIMEOUT_MS));
+        const windows = reportedWindows(usage);
+        if (windows.length === 0) {
+            ctx.logger.info('gpt-sub: reachable; plan %s, no rate-limit window reported', usage.plan_type ?? 'unknown');
+        }
+        else {
+            ctx.logger.info('gpt-sub: reachable; plan %s, %s', usage.plan_type ?? 'unknown', windows
+                .map((window) => window.used_percent + '% of the ' + Math.round(window.limit_window_seconds / 3600) + 'h window')
+                .join(', '));
+        }
+    }
+    catch (error) {
+        ctx.logger.warn('gpt-sub: reachability probe failed: %s', String(error));
+    }
+    // The quota panel's data source. Reads the same token the model calls use,
+    // through the same proxy routing, and throttles so one open settings page
+    // cannot turn into a stream of upstream requests.
+    const quota = new QuotaSource({
+        accessToken: async () => (await tokens.getTokens()).accessToken,
+        ...(dispatcher === undefined ? {} : { dispatcher }),
+    });
+    /**
+     * Swap the live proxy routing, serializing concurrent switches.
+     *
+     * Restores the pre-plugin global dispatcher before installing the next
+     * routing, so no request ever dispatches into a closing agent, and points
+     * the token store and quota source at the new dispatcher.
+     *
+     * @param nextUrl - the proxy URL to route through; empty string for direct.
+     * @returns nothing; failures propagate to the caller.
+     */
+    let switching = Promise.resolve();
+    const switchProxy = (nextUrl) => {
+        const run = async () => {
+            const previous = routing;
+            routing = undefined;
+            await previous?.uninstall();
+            routing =
+                nextUrl === '' ? undefined : installProxyRouting(nextUrl, { maxRetries: config.bootstrapRetries });
+            dispatcher = routing?.dispatcher;
+            tokens.setDispatcher(dispatcher);
+            quota.setDispatcher(dispatcher);
+            proxyUrl = nextUrl;
+        };
+        switching = switching.then(run, run);
+        return switching;
+    };
+    /**
+     * Swap the live credential file, serializing concurrent switches the way
+     * {@link switchProxy} does.
+     *
+     * The caller validates a non-empty candidate before calling; this persists,
+     * points the token store at the new file, and republishes immediately, so a
+     * model call cannot race the next sync tick with the previous file's token.
+     *
+     * @param rawPath - the path as typed on the page; empty restores the config.
+     * @returns the display path now in force, and whether the token republished.
+     */
+    let switchingAuth = Promise.resolve({
+        display: '',
+        published: true,
+    });
+    const switchAuthFile = (rawPath) => {
+        const run = async () => {
+            if (rawPath === '') {
+                delete persisted.authFile;
+                await saveStateOverride(stateFile, persisted);
+                authOverridden = false;
+                authFileDisplay = config.authFile;
+            }
+            else {
+                persisted.authFile = rawPath;
+                await saveStateOverride(stateFile, persisted);
+                authOverridden = true;
+                authFileDisplay = rawPath;
+            }
+            tokens.setAuthFile(expandHome(authFileDisplay));
+            try {
+                await sync();
+                return { display: authFileDisplay, published: true };
+            }
+            catch (error) {
+                // The switch itself succeeded; only the publish failed, and the sync
+                // timer retries it. Say so rather than failing a choice already made.
+                ctx.logger.warn('gpt-sub: token sync failed after switching to %s, retrying next tick: %s', authFileDisplay, String(error));
+                return { display: authFileDisplay, published: false };
+            }
+        };
+        switchingAuth = switchingAuth.then(run, run);
+        return switchingAuth;
+    };
+    /** Reply with JSON, never cached. */
+    const replyJson = (response, status, body) => {
+        response.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+        response.end(JSON.stringify(body));
+    };
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: QUOTA_ROUTE,
+        handler: async (request, response) => {
+            const force = new URL(request.url ?? '/', 'http://x').searchParams.get('refresh') === '1';
+            const state = await quota.read(force);
+            replyJson(response, 200, state);
+        },
+    }), `gpt-sub: GET ${QUOTA_ROUTE}`);
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: STATUS_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'GET') {
+                replyJson(response, 405, { message: 'method not allowed' });
+                return;
+            }
+            // inspect() is file-only, so a status poll never refreshes a token
+            // and never reaches the network.
+            const inspection = await tokens.inspect().then((value) => value, () => undefined);
+            const expiry = inspection?.accessTokenExpiresAt;
+            const syncIntervalMs = config.syncIntervalMinutes * 60_000;
+            replyJson(response, 200, {
+                authFile: authFileDisplay,
+                configAuthFile: config.authFile,
+                authOverridden,
+                proxyUrl,
+                configProxyUrl: config.proxyUrl,
+                overridden,
+                refreshMarginMinutes: config.refreshMarginMinutes,
+                syncIntervalMinutes: config.syncIntervalMinutes,
+                ...(lastSyncAt === 0 ? {} : { lastSyncAt, nextSyncAt: lastSyncAt + syncIntervalMs }),
+                ...(expiry === undefined
+                    ? {}
+                    : { tokenExpiresAt: expiry, refreshAt: expiry - config.refreshMarginMinutes * 60_000 }),
+            });
+        },
+    }), `gpt-sub: GET ${STATUS_ROUTE}`);
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: PROXY_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'POST') {
+                replyJson(response, 405, { message: 'method not allowed' });
+                return;
+            }
+            if (crossOrigin(request)) {
+                replyJson(response, 403, { ok: false, message: 'cross-origin request refused' });
+                return;
+            }
+            let nextUrl;
+            try {
+                nextUrl = validateProxyUrl((await readJsonObject(request))['proxyUrl']);
+            }
+            catch (error) {
+                replyJson(response, 400, { ok: false, message: error instanceof Error ? error.message : String(error) });
+                return;
+            }
+            try {
+                persisted.proxyUrl = nextUrl;
+                await saveStateOverride(stateFile, persisted);
+                overridden = true;
+                await switchProxy(nextUrl);
+                ctx.logger.info('gpt-sub: proxy switched to %s', displayProxy(nextUrl));
+                replyJson(response, 200, { ok: true, proxyUrl: nextUrl });
+            }
+            catch (error) {
+                replyJson(response, 500, { ok: false, message: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    }), `gpt-sub: POST ${PROXY_ROUTE}`);
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: PROXY_TEST_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'POST') {
+                replyJson(response, 405, { message: 'method not allowed' });
+                return;
+            }
+            if (crossOrigin(request)) {
+                replyJson(response, 403, { ok: false, message: 'cross-origin request refused' });
+                return;
+            }
+            let candidate = proxyUrl;
+            try {
+                const body = await readJsonObject(request);
+                if (body['proxyUrl'] !== undefined)
+                    candidate = validateProxyUrl(body['proxyUrl']);
+            }
+            catch (error) {
+                replyJson(response, 400, { ok: false, message: error instanceof Error ? error.message : String(error) });
+                return;
+            }
+            try {
+                const accessToken = (await tokens.getTokens()).accessToken;
+                const result = await probeProxy({
+                    proxyUrl: candidate,
+                    accessToken,
+                    timeoutMs: PROBE_TIMEOUT_MS,
+                });
+                replyJson(response, 200, result);
+            }
+            catch (error) {
+                replyJson(response, 500, { ok: false, message: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    }), `gpt-sub: POST ${PROXY_TEST_ROUTE}`);
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: AUTH_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'POST') {
+                replyJson(response, 405, { message: 'method not allowed' });
+                return;
+            }
+            if (crossOrigin(request)) {
+                replyJson(response, 403, { ok: false, message: 'cross-origin request refused' });
+                return;
+            }
+            // Absent or empty means "back to the configured default"; otherwise
+            // the trimmed string is the candidate path.
+            let candidate;
+            try {
+                const body = await readJsonObject(request);
+                const value = body['authFile'];
+                if (value !== undefined && value !== null) {
+                    if (typeof value !== 'string')
+                        throw new Error('authFile must be a string');
+                    candidate = value.trim();
+                }
+            }
+            catch (error) {
+                replyJson(response, 400, { ok: false, message: error instanceof Error ? error.message : String(error) });
+                return;
+            }
+            // Validate BEFORE persisting or switching: a path that cannot serve
+            // credentials must never become the live source, here or after a
+            // restart. verify() is file-only -- the check spends no refresh.
+            if (candidate !== undefined && candidate !== '') {
+                try {
+                    await new TokenStore({
+                        authFile: expandHome(candidate),
+                        refreshMarginMs: config.refreshMarginMinutes * 60_000,
+                    }).verify();
+                }
+                catch (error) {
+                    replyJson(response, 400, { ok: false, message: error instanceof Error ? error.message : String(error) });
+                    return;
+                }
+            }
+            try {
+                const result = await switchAuthFile(candidate ?? '');
+                ctx.logger.info('gpt-sub: credential file %s', candidate === undefined || candidate === ''
+                    ? `restored to configured ${result.display}`
+                    : `switched to ${result.display}`);
+                replyJson(response, 200, { ok: true, authFile: result.display, published: result.published });
+            }
+            catch (error) {
+                replyJson(response, 500, { ok: false, message: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    }), `gpt-sub: POST ${AUTH_ROUTE}`);
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: AUTH_BROWSE_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'GET') {
+                replyJson(response, 405, { message: 'method not allowed' });
+                return;
+            }
+            const requested = new URL(request.url ?? '/', 'http://x').searchParams.get('path') ?? '';
+            // Empty means start from the home directory, where ~/.codex lives.
+            // A listing carries names and paths only -- never file contents.
+            const target = requested.trim() === '' ? homedir() : expandHome(requested.trim());
+            try {
+                if (!(await stat(target)).isDirectory())
+                    throw new Error('not a directory');
+            }
+            catch {
+                replyJson(response, 400, { ok: false, message: `not a readable directory: ${target}` });
+                return;
+            }
+            try {
+                const dirents = await readdir(target, { withFileTypes: true });
+                const entries = dirents
+                    .slice(0, BROWSE_LIMIT)
+                    .map((entry) => ({
+                    name: entry.name,
+                    path: join(target, entry.name),
+                    dir: entry.isDirectory(),
+                }))
+                    .sort((a, b) => (a.dir === b.dir ? a.name.localeCompare(b.name) : a.dir ? -1 : 1));
+                // The root's parent is itself, so the panel hides the up-row
+                // rather than offering a dead link.
+                const parent = dirname(target);
+                replyJson(response, 200, {
+                    ok: true,
+                    dir: target,
+                    ...(parent !== target ? { parent } : {}),
+                    truncated: dirents.length > BROWSE_LIMIT,
+                    entries,
+                });
+            }
+            catch (error) {
+                replyJson(response, 400, { ok: false, message: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    }), `gpt-sub: GET ${AUTH_BROWSE_ROUTE}`);
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: RESET_CREDITS_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'GET') {
+                replyJson(response, 405, { ok: false, message: 'method not allowed' });
+                return;
+            }
+            try {
+                const accessToken = (await tokens.getTokens()).accessToken;
+                const details = await listResetCredits(accessToken, dispatcher, undefined, AbortSignal.timeout(RESET_CREDITS_TIMEOUT_MS));
+                replyJson(response, 200, { ok: true, ...details });
+            }
+            catch (error) {
+                replyJson(response, 200, { ok: false, message: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    }), `gpt-sub: GET ${RESET_CREDITS_ROUTE}`);
+    // Redeeming is destructive and idempotent only per key, so the host mints a
+    // fresh key per click; the page sends the credit id it means to spend.
+    ctx.effect(() => ctx.webServer.register({
+        kind: 'exact',
+        path: RESET_CREDITS_CONSUME_ROUTE,
+        handler: async (request, response) => {
+            if (request.method !== 'POST') {
+                replyJson(response, 405, { ok: false, message: 'method not allowed' });
+                return;
+            }
+            if (crossOrigin(request)) {
+                replyJson(response, 403, { ok: false, message: 'cross-origin request refused' });
+                return;
+            }
+            let creditId;
+            try {
+                const body = await readJsonObject(request);
+                const value = body['creditId'];
+                if (value === undefined || value === null)
+                    creditId = undefined;
+                else if (typeof value !== 'string' || value.trim() === '') {
+                    throw new Error('creditId must be a non-empty string when present');
+                }
+                else
+                    creditId = value.trim();
+            }
+            catch (error) {
+                replyJson(response, 400, { ok: false, message: error instanceof Error ? error.message : String(error) });
+                return;
+            }
+            try {
+                const accessToken = (await tokens.getTokens()).accessToken;
+                const result = await consumeResetCredit(accessToken, randomUUID(), {
+                    ...(creditId === undefined ? {} : { creditId }),
+                    ...(dispatcher === undefined ? {} : { dispatcher }),
+                    signal: AbortSignal.timeout(RESET_CREDITS_TIMEOUT_MS),
+                });
+                ctx.logger.info('gpt-sub: rate-limit reset credit consumed (code=%s, windows_reset=%d, credit=%s)', result.code, result.windows_reset ?? 0, creditId ?? 'any');
+                // The window just changed, so serve the next quota poll from a
+                // fresh upstream read instead of the throttle's cache.
+                await quota.read(true).catch(() => undefined);
+                replyJson(response, 200, { ok: true, ...result });
+            }
+            catch (error) {
+                replyJson(response, 500, { ok: false, message: error instanceof Error ? error.message : String(error) });
+            }
+        },
+    }), `gpt-sub: POST ${RESET_CREDITS_CONSUME_ROUTE}`);
+    const timer = setInterval(() => {
+        // A rejected timer callback would be an unhandled rejection, and DSH's
+        // handler exits the process. A transient refresh failure must cost a log
+        // line, not the harness: the next tick tries again, and the token in the
+        // store stays valid until its own expiry regardless.
+        void sync().catch((error) => {
+            ctx.logger.warn('gpt-sub: token sync failed, retrying next tick: %s', String(error));
+        });
+    }, config.syncIntervalMinutes * 60_000);
+    // Never let this timer be the reason the process stays alive.
+    timer.unref?.();
+    return async () => {
+        clearInterval(timer);
+        // Restores the previous global dispatcher before closing the agent, so a
+        // fiber restart never leaves the host dispatching into a closing proxy.
+        await switching.catch(() => undefined);
+        await routing?.uninstall();
+    };
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAC5D,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAIxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACzE,OAAO,EAAE,mBAAmB,EAAqB,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAMxD,0BAA0B;AAC1B,MAAM,CAAC,MAAM,IAAI,GAAG,SAAS,CAAA;AAE7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;AAElD,0DAA0D;AAC1D,MAAM,WAAW,GAAG,gBAAgB,CAAA;AAEpC,wEAAwE;AACxE,MAAM,YAAY,GAAG,iBAAiB,CAAA;AAEtC,iEAAiE;AACjE,MAAM,WAAW,GAAG,gBAAgB,CAAA;AAEpC,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAE9C,sEAAsE;AACtE,MAAM,UAAU,GAAG,eAAe,CAAA;AAElC,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAEhD,gFAAgF;AAChF,MAAM,YAAY,GAAG,GAAG,CAAA;AAExB,yCAAyC;AACzC,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,6DAA6D;AAC7D,MAAM,mBAAmB,GAAG,wBAAwB,CAAA;AAEpD,mEAAmE;AACnE,MAAM,2BAA2B,GAAG,gCAAgC,CAAA;AAEpE,+EAA+E;AAC/E,MAAM,wBAAwB,GAAG,MAAM,CAAA;AAEvC;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;AAE3F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAyC,CAAC,CAAC,MAAM,CAAC;IACnE,2EAA2E;IAC3E,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAClD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,4EAA4E;IAC5E,uDAAuD;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACzE,uEAAuE;IACvE,6EAA6E;IAC7E,wEAAwE;IACxE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,2EAA2E;IAC3E,2EAA2E;IAC3E,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACvC,uEAAuE;IACvE,sEAAsE;IACtE,kDAAkD;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;CACrD,CAAC,CAAA;AAEF,sEAAsE;AACtE,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY,EAAE,MAAmB;IAC3D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAE9C,0EAA0E;IAC1E,wEAAwE;IACxE,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,UAAU,EAAE,QAAQ,CAAA;IACvC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,gEAAgE,EAChE,YAAY,CAAC,UAAU,CAAC,EACxB,SAAS,EACT,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC9B,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,GAAG,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAA;IAC5C,IAAI,UAAU,GAAG,UAAU,KAAK,SAAS,CAAA;IAEzC,MAAM,aAAa,GAAG,UAAU,EAAE,QAAQ,CAAA;IAC1C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,iEAAiE,EACjE,aAAa,EACb,SAAS,EACT,MAAM,CAAC,QAAQ,CAChB,CAAA;IACH,CAAC;IACD,IAAI,eAAe,GAAG,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAA;IACtD,IAAI,cAAc,GAAG,aAAa,KAAK,SAAS,CAAA;IAEhD,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,SAAS,GAAkB,EAAE,CAAA;IACnC,IAAI,UAAU;QAAE,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC7C,IAAI,cAAc;QAAE,SAAS,CAAC,QAAQ,GAAG,eAAe,CAAA;IAExD,4EAA4E;IAC5E,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAI,OAAO,GACT,QAAQ,KAAK,EAAE;QACb,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAC5E,IAAI,UAAU,GAA2B,OAAO,EAAE,UAAU,CAAA;IAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,oGAAoG,EACpG,YAAY,CAAC,QAAQ,CAAC,EACtB,MAAM,CAAC,gBAAgB,CACxB,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC;QAC5B,QAAQ,EAAE,UAAU,CAAC,eAAe,CAAC;QACrC,eAAe,EAAE,MAAM,CAAC,oBAAoB,GAAG,MAAM;QACrD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE1C,kEAAkE;IAClE,IAAI,UAAU,GAAG,CAAC,CAAA;IAElB;;;;;OAKG;IACH,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;QACxC,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QACnD,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACzB,CAAC,CAAA;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAA;QACrB,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,EAAE,SAAS,EAAE,CAAA;QAC1B,MAAM,KAAK,CAAA;IACb,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE/E,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAA;QACxC,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACjH,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;QAC7G,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,iCAAiC,EACjC,KAAK,CAAC,SAAS,IAAI,SAAS,EAC5B,OAAO;iBACJ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,GAAG,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC;iBAChH,IAAI,CAAC,IAAI,CAAC,CACd,CAAA;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC;QAC5B,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW;QAC/D,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC,CAAA;IAEF;;;;;;;;;OASG;IACH,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAChD,MAAM,WAAW,GAAG,CAAC,OAAe,EAAiB,EAAE;QACrD,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,MAAM,QAAQ,GAAG,OAAO,CAAA;YACxB,OAAO,GAAG,SAAS,CAAA;YACnB,MAAM,QAAQ,EAAE,SAAS,EAAE,CAAA;YAC3B,OAAO;gBACL,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAA;YACpG,UAAU,GAAG,OAAO,EAAE,UAAU,CAAA;YAChC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;YAChC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAA;YAC/B,QAAQ,GAAG,OAAO,CAAA;QACpB,CAAC,CAAA;QACD,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC,CAAA;IAED;;;;;;;;;;OAUG;IACH,IAAI,aAAa,GAAqD,OAAO,CAAC,OAAO,CAAC;QACpF,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAoD,EAAE;QAC3F,MAAM,GAAG,GAAG,KAAK,IAAsD,EAAE;YACvE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBACnB,OAAO,SAAS,CAAC,QAAQ,CAAA;gBACzB,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBAC7C,cAAc,GAAG,KAAK,CAAA;gBACtB,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAA;YACnC,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAA;gBAC5B,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBAC7C,cAAc,GAAG,IAAI,CAAA;gBACrB,eAAe,GAAG,OAAO,CAAA;YAC3B,CAAC;YACD,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,EAAE,CAAA;gBACZ,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;YACtD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qEAAqE;gBACrE,sEAAsE;gBACtE,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,0EAA0E,EAC1E,eAAe,EACf,MAAM,CAAC,KAAK,CAAC,CACd,CAAA;gBACD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;YACvD,CAAC;QACH,CAAC,CAAA;QACD,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAC5C,OAAO,aAAa,CAAA;IACtB,CAAC,CAAA;IAED,qCAAqC;IACrC,MAAM,SAAS,GAAG,CAAC,QAA4C,EAAE,MAAc,EAAE,IAAa,EAAQ,EAAE;QACtG,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAA;QAC/F,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IACpC,CAAC,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,CAAA;YACzF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QACjC,CAAC;KACF,CAAC,EACJ,gBAAgB,WAAW,EAAE,CAC9B,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YACD,mEAAmE;YACnE,iCAAiC;YACjC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAC5C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAChB,GAAG,EAAE,CAAC,SAAS,CAChB,CAAA;YACD,MAAM,MAAM,GAAG,UAAU,EAAE,oBAAoB,CAAA;YAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAA;YAC1D,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACvB,QAAQ,EAAE,eAAe;gBACzB,cAAc,EAAE,MAAM,CAAC,QAAQ;gBAC/B,cAAc;gBACd,QAAQ;gBACR,cAAc,EAAE,MAAM,CAAC,QAAQ;gBAC/B,UAAU;gBACV,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,GAAG,cAAc,EAAE,CAAC;gBACpF,GAAG,CAAC,MAAM,KAAK,SAAS;oBACtB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,oBAAoB,GAAG,MAAM,EAAE,CAAC;aAC1F,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,EACJ,gBAAgB,YAAY,EAAE,CAC/B,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YACD,IAAI,OAAe,CAAA;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,gBAAgB,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACxG,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAA;gBAC5B,MAAM,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;gBAC7C,UAAU,GAAG,IAAI,CAAA;gBACjB,MAAM,WAAW,CAAC,OAAO,CAAC,CAAA;gBAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;gBACvE,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;KACF,CAAC,EACJ,iBAAiB,WAAW,EAAE,CAC/B,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YACD,IAAI,SAAS,GAAG,QAAQ,CAAA;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;gBAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS;oBAAE,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAA;YACpF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACxG,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAA;gBAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;oBAC9B,QAAQ,EAAE,SAAS;oBACnB,WAAW;oBACX,SAAS,EAAE,gBAAgB;iBAC5B,CAAC,CAAA;gBACF,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;KACF,CAAC,EACJ,iBAAiB,gBAAgB,EAAE,CACpC,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YACD,oEAAoE;YACpE,4CAA4C;YAC5C,IAAI,SAA6B,CAAA;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;oBAC3E,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;gBAC1B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACxG,OAAM;YACR,CAAC;YACD,oEAAoE;YACpE,iEAAiE;YACjE,iEAAiE;YACjE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,IAAI,UAAU,CAAC;wBACnB,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC;wBAC/B,eAAe,EAAE,MAAM,CAAC,oBAAoB,GAAG,MAAM;qBACtD,CAAC,CAAC,MAAM,EAAE,CAAA;gBACb,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;oBACxG,OAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,6BAA6B,EAC7B,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;oBACzC,CAAC,CAAC,0BAA0B,MAAM,CAAC,OAAO,EAAE;oBAC5C,CAAC,CAAC,eAAe,MAAM,CAAC,OAAO,EAAE,CACpC,CAAA;gBACD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAA;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;KACF,CAAC,EACJ,iBAAiB,UAAU,EAAE,CAC9B,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBAC3D,OAAM;YACR,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;YACxF,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;YACjF,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,6BAA6B,MAAM,EAAE,EAAE,CAAC,CAAA;gBACvF,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC9D,MAAM,OAAO,GAAG,OAAO;qBACpB,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;qBACtB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACf,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;oBAC9B,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE;iBACzB,CAAC,CAAC;qBACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBACpF,6DAA6D;gBAC7D,oCAAoC;gBACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;gBAC9B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACvB,EAAE,EAAE,IAAI;oBACR,GAAG,EAAE,MAAM;oBACX,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxC,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,YAAY;oBACxC,OAAO;iBACR,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;KACF,CAAC,EACJ,gBAAgB,iBAAiB,EAAE,CACpC,CAAA;IAED,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBACtE,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAA;gBAC1D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CACpC,WAAW,EACX,UAAU,EACV,SAAS,EACT,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAC9C,CAAA;gBACD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;KACF,CAAC,EACJ,gBAAgB,mBAAmB,EAAE,CACtC,CAAA;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,GAAG,CAAC,MAAM,CACR,GAAG,EAAE,CACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;gBACtE,OAAM;YACR,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAA;gBAChF,OAAM;YACR,CAAC;YACD,IAAI,QAA4B,CAAA;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAA;gBAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;gBAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;oBAAE,QAAQ,GAAG,SAAS,CAAA;qBAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;gBACrE,CAAC;;oBAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACxG,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,CAAA;gBAC1D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;oBACjE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;oBAC/C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;oBACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;iBACtD,CAAC,CAAA;gBACF,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,kFAAkF,EAClF,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,aAAa,IAAI,CAAC,EACzB,QAAQ,IAAI,KAAK,CAClB,CAAA;gBACD,+DAA+D;gBAC/D,uDAAuD;gBACvD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBAC7C,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1G,CAAC;QACH,CAAC;KACF,CAAC,EACJ,iBAAiB,2BAA2B,EAAE,CAC/C,CAAA;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,qDAAqD;QACrD,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACtF,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,CAAA;IACvC,8DAA8D;IAC9D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IAEf,OAAO,KAAK,IAAI,EAAE;QAChB,aAAa,CAAC,KAAK,CAAC,CAAA;QACpB,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,OAAO,EAAE,SAAS,EAAE,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC"}

package/lib/jwt.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Minimal JWT claim reader. Only the `exp` claim is needed, and signature
+ * verification is deliberately absent: these tokens are read from the user's
+ * own credential file, never accepted from a remote party.
+ *
+ * @module dsh-gpt-sub/jwt
+ */
+/**
+ * Read a JWT's expiry.
+ *
+ * @param token - a candidate JWT; opaque strings are tolerated.
+ * @returns expiry in epoch milliseconds, or undefined when absent or undecodable.
+ */
+export declare function jwtExpiryMs(token: string): number | undefined;
+//# sourceMappingURL=jwt.d.ts.map

package/lib/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW7D"}