@young1lin/dsh-gpt-sub 0.1.0

package/lib/proxy-routing.js

@@ -0,0 +1,171 @@
+/**
+ * Host-scoped proxy routing for the process-wide undici dispatcher.
+ *
+ * pi-ai issues its own requests through the global `fetch`, so this plugin
+ * cannot hand it a dispatcher the way it hands one to `TokenStore`. The only
+ * seam is undici's global dispatcher -- but replacing that wholesale would
+ * push every provider in the harness through the proxy, including endpoints
+ * that must not go near it.
+ *
+ * So route by hostname: the Codex hosts go through the proxy, everything else
+ * continues to whatever dispatcher was installed before. Reaching
+ * `chatgpt.com` from an unproxied address here answers 403 with a Cloudflare
+ * block page, which surfaces as an unreadable HTML body rather than an API
+ * error, so this is the difference between working and not.
+ *
+ * @module dsh-gpt-sub/proxy-routing
+ */
+import { Dispatcher, ProxyAgent, getGlobalDispatcher, interceptors, setGlobalDispatcher } from 'undici';
+/**
+ * Transport failures worth retrying: the link to this proxy drops connections
+ * at random, and each drop surfaces to DSH as a bare `fetch failed`.
+ *
+ * Measured direct to chatgpt.com through the same proxy, the failure is
+ * non-monotonic in payload size, so it is a random connection failure rather
+ * than a threshold -- which is exactly the shape a retry fixes.
+ */
+const RETRYABLE_ERROR_CODES = [
+    'ECONNRESET',
+    'ECONNREFUSED',
+    'ENOTFOUND',
+    'ENETDOWN',
+    'ENETUNREACH',
+    'EHOSTDOWN',
+    'EHOSTUNREACH',
+    'EPIPE',
+    'ETIMEDOUT',
+    'UND_ERR_SOCKET',
+    'UND_ERR_CONNECT_TIMEOUT',
+];
+/**
+ * Hosts that must egress through the proxy: the Codex API and the OAuth token
+ * endpoint the refresh calls. Subdomains match too.
+ */
+export const PROXIED_HOSTS = ['chatgpt.com', 'auth.openai.com', 'api.openai.com'];
+/**
+ * Whether a hostname belongs to one of `hosts`, matching the host itself and
+ * any subdomain of it.
+ *
+ * @param hostname - the hostname to test.
+ * @param hosts - the suffixes to match against.
+ * @returns true when the hostname should be proxied.
+ */
+export function shouldProxy(hostname, hosts = PROXIED_HOSTS) {
+    const lower = hostname.toLowerCase();
+    return hosts.some((host) => lower === host || lower.endsWith(`.${host}`));
+}
+/**
+ * A dispatcher that sends matching hosts to one delegate and everything else
+ * to another.
+ *
+ * Only the proxy delegate is owned: `close`/`destroy` never touch the
+ * fallback, because that dispatcher belongs to the host and outlives this
+ * plugin.
+ */
+export class HostRoutingDispatcher extends Dispatcher {
+    #proxy;
+    #fallback;
+    #hosts;
+    constructor(proxy, fallback, hosts = PROXIED_HOSTS) {
+        super();
+        this.#proxy = proxy;
+        this.#fallback = fallback;
+        this.#hosts = hosts;
+    }
+    /**
+     * Route one request by its origin's hostname.
+     *
+     * An origin that cannot be parsed is sent to the fallback: defaulting to the
+     * proxy would silently divert unrelated traffic.
+     *
+     * @param options - undici dispatch options.
+     * @param handler - undici dispatch handler.
+     * @returns whatever the chosen delegate returns.
+     */
+    dispatch(options, handler) {
+        let hostname = '';
+        try {
+            const origin = options.origin;
+            hostname = new URL(typeof origin === 'string' ? origin : String(origin?.href ?? '')).hostname;
+        }
+        catch {
+            hostname = '';
+        }
+        const delegate = hostname !== '' && shouldProxy(hostname, this.#hosts) ? this.#proxy : this.#fallback;
+        return delegate.dispatch(options, handler);
+    }
+    /** Close only the proxy delegate; the fallback belongs to the host. */
+    async close() {
+        await this.#proxy.close();
+    }
+    /** Destroy only the proxy delegate; the fallback belongs to the host. */
+    async destroy() {
+        await this.#proxy.destroy();
+    }
+}
+/**
+ * Retry options that absorb a dropped connection without taking on any
+ * HTTP-level retry policy.
+ *
+ * `statusCodes: []` is deliberate: an upstream 429 or 500 carries a body DSH
+ * knows how to read and surface, and retrying here would swallow it. This
+ * dispatcher's job is narrow -- make the flaky link look reliable -- and every
+ * HTTP semantic stays with the harness.
+ *
+ * `POST` is listed even though undici omits it by default, because undici
+ * omits it for non-idempotency: a POST that may have been received must not be
+ * replayed. That does not apply to what is retried here. A connection error
+ * arrives before any response, and undici refuses to replay a request whose
+ * body was already consumed; a partially streamed response is caught by
+ * undici's own range check rather than silently concatenated. Model calls are
+ * POSTs, so without this the retry would never fire at all.
+ *
+ * @param maxRetries - how many extra attempts a single request may make.
+ * @returns options for undici's retry interceptor.
+ */
+export function connectionRetryOptions(maxRetries) {
+    return {
+        maxRetries,
+        methods: ['GET', 'HEAD', 'OPTIONS', 'PUT', 'DELETE', 'TRACE', 'POST'],
+        statusCodes: [],
+        errorCodes: [...RETRYABLE_ERROR_CODES],
+        // 0.5s, 1s, 2s -- fast enough that a recovered connection still feels like
+        // one request, slow enough to let a flapping tunnel settle.
+        minTimeout: 500,
+        maxTimeout: 8_000,
+        timeoutFactor: 2,
+    };
+}
+/**
+ * Install host-scoped proxy routing as the global dispatcher.
+ *
+ * @param proxyUrl - the proxy to route the Codex hosts through.
+ * @param options - hosts to proxy and how hard to retry a dropped connection.
+ * @returns the proxy dispatcher and the function that restores the previous global.
+ */
+export function installProxyRouting(proxyUrl, options = {}) {
+    const hosts = options.hosts ?? PROXIED_HOSTS;
+    const maxRetries = options.maxRetries ?? 3;
+    const proxy = new ProxyAgent(proxyUrl);
+    // `compose` returns a proxy over the same agent with only `dispatch`
+    // replaced, so `close()` on the result still closes the agent underneath --
+    // and only requests routed here are retried. Nothing else in the harness
+    // changes behaviour.
+    const dispatcher = maxRetries > 0 ? proxy.compose(interceptors.retry(connectionRetryOptions(maxRetries))) : proxy;
+    const previous = getGlobalDispatcher();
+    setGlobalDispatcher(new HostRoutingDispatcher(dispatcher, previous, hosts));
+    return {
+        dispatcher,
+        uninstall: async () => {
+            // Restore first, so nothing dispatches into a closing agent.
+            setGlobalDispatcher(previous);
+            try {
+                await proxy.close();
+            }
+            catch {
+                // Disposal must not hinge on the agent shutting down cleanly.
+            }
+        },
+    };
+}
+//# sourceMappingURL=proxy-routing.js.map

package/lib/proxy-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-routing.js","sourceRoot":"","sources":["../src/proxy-routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,mBAAmB,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAA;AAEvG;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,WAAW;IACX,UAAU;IACV,aAAa;IACb,WAAW;IACX,cAAc;IACd,OAAO;IACP,WAAW;IACX,gBAAgB;IAChB,yBAAyB;CAC1B,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAsB,CAAC,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAA;AAEpG;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,QAA2B,aAAa;IACpF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,UAAU;IAC1C,MAAM,CAAY;IAClB,SAAS,CAAY;IACrB,MAAM,CAAmB;IAElC,YAAY,KAAiB,EAAE,QAAoB,EAAE,QAA2B,aAAa;QAC3F,KAAK,EAAE,CAAA;QACP,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED;;;;;;;;;OASG;IACM,QAAQ,CAAC,OAAmC,EAAE,OAAmC;QACxF,IAAI,QAAQ,GAAG,EAAE,CAAA;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;YAC7B,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,CAAA;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,KAAK,EAAE,IAAI,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAA;QACrG,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,uEAAuE;IAC9D,KAAK,CAAC,KAAK;QAClB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IAC3B,CAAC;IAED,yEAAyE;IAChE,KAAK,CAAC,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IASvD,OAAO;QACL,UAAU;QACV,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QACrE,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,CAAC,GAAG,qBAAqB,CAAC;QACtC,2EAA2E;QAC3E,4DAA4D;QAC5D,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,CAAC;KACjB,CAAA;AACH,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,UAA+B,EAAE;IACrF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAA;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;IACtC,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,qBAAqB;IACrB,MAAM,UAAU,GACd,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAChG,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAA;IACtC,mBAAmB,CAAC,IAAI,qBAAqB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;IAE3E,OAAO;QACL,UAAU;QACV,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,6DAA6D;YAC7D,mBAAmB,CAAC,QAAQ,CAAC,CAAA;YAC7B,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;YACrB,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/lib/quota-route.d.ts

@@ -0,0 +1,85 @@
+/**
+ * The host half of the quota panel: one cached JSON endpoint the browser polls.
+ *
+ * Every quota semantic lives here rather than in the client bundle -- which
+ * windows count, how often upstream may be asked, what a failure looks like --
+ * so the browser half stays a renderer.
+ *
+ * @module dsh-gpt-sub/quota-route
+ */
+import type { Dispatcher } from 'undici';
+import { type ReportedWindow } from './usage.ts';
+/** One rate-limit window as the endpoint serves it to the panel. */
+export interface QuotaWindowState {
+    /** Percent of the window consumed. */
+    usedPercent: number;
+    /** Length of the window, in hours. */
+    windowHours: number;
+    /** Epoch seconds at which the window resets. */
+    resetAt?: number;
+}
+/** What the endpoint serves. */
+export interface QuotaState {
+    /** 'ready' once a reading has been taken, 'error' when none ever succeeded. */
+    phase: 'ready' | 'error';
+    /** Subscription plan, when upstream reported one. */
+    plan?: string;
+    /**
+     * The short rolling window -- 5 hours on every plan that reports one. A
+     * plan without it (pro currently) simply omits the field, and the panel
+     * says so instead of drawing an empty bar.
+     */
+    fiveHour?: QuotaWindowState;
+    /** The weekly window, alone or beside the 5-hour one. */
+    weekly?: QuotaWindowState;
+    /**
+     * On-demand usage resets the account can still spend, when the plan
+     * reports them -- each clears a capped window without waiting out its
+     * timer.
+     */
+    resetsRemaining?: number;
+    /** Every reported window, primary first; one panel row each. */
+    windows?: ReportedWindow[];
+    /** Epoch milliseconds this reading was taken. */
+    fetchedAt?: number;
+    /** True when the reading is older than the refresh interval and a retry failed. */
+    stale?: boolean;
+    /** Human-readable failure note; present on error, or beside a stale reading. */
+    message?: string;
+}
+/** Construction options. */
+export interface QuotaSourceOptions {
+    /** Returns a live access token. */
+    readonly accessToken: () => Promise<string>;
+    /** Dispatcher for the upstream call. */
+    readonly dispatcher?: Dispatcher;
+    /** Minimum gap between upstream reads; a poll inside it is served from cache. */
+    readonly minIntervalMs?: number;
+    /** Injectable clock, defaulting to Date.now. */
+    readonly now?: () => number;
+}
+/**
+ * A throttled quota reader.
+ *
+ * The browser polls far more often than the account's usage changes, so an
+ * unthrottled endpoint would turn one open settings page into a steady stream
+ * of upstream requests.
+ */
+export declare class QuotaSource {
+    #private;
+    constructor(options: QuotaSourceOptions);
+    /**
+     * Point later upstream reads at a different dispatcher, as a proxy switch does.
+     *
+     * @param dispatcher - the dispatcher future reads use; undefined for the global.
+     */
+    setDispatcher(dispatcher: Dispatcher | undefined): void;
+    /**
+     * Return the current reading, refreshing when the throttle allows.
+     *
+     * @param force - ignore the throttle, as the panel's refresh button does.
+     * @returns the reading to serve.
+     */
+    read(force?: boolean): Promise<QuotaState>;
+}
+//# sourceMappingURL=quota-route.d.ts.map

package/lib/quota-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-route.d.ts","sourceRoot":"","sources":["../src/quota-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAA+D,KAAK,cAAc,EAAoB,MAAM,YAAY,CAAA;AAE/H,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,GAAG,OAAO,CAAA;IACxB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gEAAgE;IAChE,OAAO,CAAC,EAAE,cAAc,EAAE,CAAA;IAC1B,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mFAAmF;IACnF,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAiBD,4BAA4B;AAC5B,MAAM,WAAW,kBAAkB;IACjC,mCAAmC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,wCAAwC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,WAAW;;gBAUV,OAAO,EAAE,kBAAkB;IAOvC;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,SAAS,GAAG,IAAI;IAIvD;;;;;OAKG;IACG,IAAI,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;CA2C/C"}

package/lib/quota-route.js

@@ -0,0 +1,105 @@
+/**
+ * The host half of the quota panel: one cached JSON endpoint the browser polls.
+ *
+ * Every quota semantic lives here rather than in the client bundle -- which
+ * windows count, how often upstream may be asked, what a failure looks like --
+ * so the browser half stays a renderer.
+ *
+ * @module dsh-gpt-sub/quota-route
+ */
+import { fetchUsage, reportWindows, reportedWindows, resetsRemaining } from "./usage.js";
+/** Windows shorter than a day are the 5-hour-style rolling limit. */
+const DAY_SECONDS = 24 * 3600;
+/**
+ * Fold one upstream window into the shape the panel renders.
+ *
+ * @param window - a window as the usage endpoint reported it.
+ * @returns the same figures in the panel's vocabulary.
+ */
+const toWindowState = (window) => ({
+    usedPercent: window.used_percent,
+    windowHours: Math.round(window.limit_window_seconds / 3600),
+    ...(window.reset_at === undefined ? {} : { resetAt: window.reset_at }),
+});
+/**
+ * A throttled quota reader.
+ *
+ * The browser polls far more often than the account's usage changes, so an
+ * unthrottled endpoint would turn one open settings page into a steady stream
+ * of upstream requests.
+ */
+export class QuotaSource {
+    #accessToken;
+    #dispatcher;
+    #minIntervalMs;
+    #now;
+    #state = { phase: 'error', message: 'not read yet' };
+    #lastAttempt = 0;
+    /** The in-flight read, shared by every caller that arrives during it. */
+    #inFlight;
+    constructor(options) {
+        this.#accessToken = options.accessToken;
+        this.#dispatcher = options.dispatcher;
+        this.#minIntervalMs = options.minIntervalMs ?? 60_000;
+        this.#now = options.now ?? (() => Date.now());
+    }
+    /**
+     * Point later upstream reads at a different dispatcher, as a proxy switch does.
+     *
+     * @param dispatcher - the dispatcher future reads use; undefined for the global.
+     */
+    setDispatcher(dispatcher) {
+        this.#dispatcher = dispatcher;
+    }
+    /**
+     * Return the current reading, refreshing when the throttle allows.
+     *
+     * @param force - ignore the throttle, as the panel's refresh button does.
+     * @returns the reading to serve.
+     */
+    async read(force = false) {
+        const elapsed = this.#now() - this.#lastAttempt;
+        if (!force && this.#state.phase === 'ready' && elapsed < this.#minIntervalMs)
+            return this.#state;
+        this.#inFlight ??= this.#refresh().finally(() => {
+            this.#inFlight = undefined;
+        });
+        return this.#inFlight;
+    }
+    /**
+     * Take one upstream reading and fold it into the cached state.
+     *
+     * A failure never discards a previous good reading: the panel shows the last
+     * known figure marked stale, which is more useful than an empty panel.
+     *
+     * @returns the new state.
+     */
+    async #refresh() {
+        this.#lastAttempt = this.#now();
+        try {
+            const usage = await fetchUsage(await this.#accessToken(), this.#dispatcher);
+            const reported = reportedWindows(usage);
+            const fiveHour = reported.find((window) => window.limit_window_seconds < DAY_SECONDS);
+            const weekly = reported.find((window) => window.limit_window_seconds >= DAY_SECONDS);
+            const resets = resetsRemaining(usage);
+            const windows = reportWindows(usage);
+            this.#state = {
+                phase: 'ready',
+                ...(usage.plan_type === undefined ? {} : { plan: usage.plan_type }),
+                ...(fiveHour === undefined ? {} : { fiveHour: toWindowState(fiveHour) }),
+                ...(weekly === undefined ? {} : { weekly: toWindowState(weekly) }),
+                ...(resets === undefined ? {} : { resetsRemaining: resets }),
+                ...(windows.length === 0 ? {} : { windows }),
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.#state =
+                this.#state.phase === 'ready'
+                    ? { ...this.#state, stale: true, message }
+                    : { phase: 'error', message };
+        }
+        return this.#state;
+    }
+}
+//# sourceMappingURL=quota-route.js.map

package/lib/quota-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-route.js","sourceRoot":"","sources":["../src/quota-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAyC,MAAM,YAAY,CAAA;AA0C/H,qEAAqE;AACrE,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAA;AAE7B;;;;;GAKG;AACH,MAAM,aAAa,GAAG,CAAC,MAAmB,EAAoB,EAAE,CAAC,CAAC;IAChE,WAAW,EAAE,MAAM,CAAC,YAAY;IAChC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC3D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;CACvE,CAAC,CAAA;AAcF;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACb,YAAY,CAAuB;IAC5C,WAAW,CAAwB;IAC1B,cAAc,CAAQ;IACtB,IAAI,CAAc;IAC3B,MAAM,GAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;IAChE,YAAY,GAAG,CAAC,CAAA;IAChB,yEAAyE;IACzE,SAAS,CAAiC;IAE1C,YAAY,OAA2B;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAA;QACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAA;QACrC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAA;QACrD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,UAAkC;QAC9C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,YAAY,CAAA;QAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,MAAM,CAAA;QAChG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC5B,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YAC3E,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;YACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,oBAAoB,GAAG,WAAW,CAAC,CAAA;YACrF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,oBAAoB,IAAI,WAAW,CAAC,CAAA;YACpF,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;YACrC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;YACpC,IAAI,CAAC,MAAM,GAAG;gBACZ,KAAK,EAAE,OAAO;gBACd,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBACnE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;gBAC5D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aAC7C,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,IAAI,CAAC,MAAM;gBACT,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO;oBAC3B,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;oBAC1C,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;CACF"}

package/lib/reset-credits.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Rate-limit reset credits: list the redeemable credits on the account and
+ * consume one, against the same wham host the usage endpoint lives on.
+ *
+ * Mirrors the codex CLI's backend-client contract
+ * (codex-rs/backend-client/src/client/rate_limit_resets.rs): GET
+ * .../rate-limit-reset-credits lists credits, POST .../consume redeems one
+ * with a caller-chosen idempotency key (`redeem_request_id`) and an optional
+ * `credit_id`. Same Bearer auth as every other wham call.
+ *
+ * @module dsh-gpt-sub/reset-credits
+ */
+import { fetch as undiciFetch, type Dispatcher } from 'undici';
+/** One redeemable credit as the list endpoint reports it. */
+export interface ResetCredit {
+    id: string;
+    reset_type: string;
+    status: string;
+    granted_at: string;
+    expires_at?: string;
+    title?: string;
+    description?: string;
+}
+/** The list endpoint's reply. */
+export interface ResetCreditsDetails {
+    credits: ResetCredit[];
+    available_count: number;
+}
+/** The consume endpoint's machine-readable outcomes. */
+export type ConsumeCode = 'reset' | 'nothing_to_reset' | 'no_credit' | 'already_redeemed';
+/** The consume endpoint's reply. */
+export interface ConsumeReply {
+    code: ConsumeCode;
+    windows_reset?: number;
+}
+/**
+ * List the account's rate-limit reset credits.
+ *
+ * @param accessToken - a live Codex access token.
+ * @param dispatcher - undici dispatcher; omit to use the global one.
+ * @param fetchImpl - injectable fetch, for tests.
+ * @param signal - abort signal bounding the call.
+ * @returns the parsed credit list.
+ */
+export declare function listResetCredits(accessToken: string, dispatcher?: Dispatcher, fetchImpl?: typeof undiciFetch, signal?: AbortSignal): Promise<ResetCreditsDetails>;
+/**
+ * Consume one rate-limit reset credit, resetting the eligible window.
+ *
+ * @param accessToken - a live Codex access token.
+ * @param redeemRequestId - caller-chosen idempotency key; retries with the same
+ *   key cannot double-redeem.
+ * @param creditId - consume this specific credit; omit for any available one.
+ * @param dispatcher - undici dispatcher; omit to use the global one.
+ * @param fetchImpl - injectable fetch, for tests.
+ * @param signal - abort signal bounding the call.
+ * @returns the outcome and how many windows were reset.
+ */
+export declare function consumeResetCredit(accessToken: string, redeemRequestId: string, options?: {
+    creditId?: string;
+    dispatcher?: Dispatcher;
+    fetchImpl?: typeof undiciFetch;
+    signal?: AbortSignal;
+}): Promise<ConsumeReply>;
+//# sourceMappingURL=reset-credits.d.ts.map

package/lib/reset-credits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-credits.d.ts","sourceRoot":"","sources":["../src/reset-credits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE9D,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,iCAAiC;AACjC,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,wDAAwD;AACxD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,kBAAkB,GAAG,WAAW,GAAG,kBAAkB,CAAA;AAEzF,oCAAoC;AACpC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,WAAW,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AA2BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,UAAU,EACvB,SAAS,GAAE,OAAO,WAAyB,EAC3C,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAO9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,GAAE;IACP,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,OAAO,WAAW,CAAA;IAC9B,MAAM,CAAC,EAAE,WAAW,CAAA;CAChB,GACL,OAAO,CAAC,YAAY,CAAC,CAiBvB"}

package/lib/reset-credits.js

@@ -0,0 +1,84 @@
+/**
+ * Rate-limit reset credits: list the redeemable credits on the account and
+ * consume one, against the same wham host the usage endpoint lives on.
+ *
+ * Mirrors the codex CLI's backend-client contract
+ * (codex-rs/backend-client/src/client/rate_limit_resets.rs): GET
+ * .../rate-limit-reset-credits lists credits, POST .../consume redeems one
+ * with a caller-chosen idempotency key (`redeem_request_id`) and an optional
+ * `credit_id`. Same Bearer auth as every other wham call.
+ *
+ * @module dsh-gpt-sub/reset-credits
+ */
+import { fetch as undiciFetch } from 'undici';
+/** The list endpoint, on the same host as the model calls. */
+const CREDITS_URL = 'https://chatgpt.com/backend-api/wham/rate-limit-reset-credits';
+/** The consume endpoint, beside the list one. */
+const CONSUME_URL = CREDITS_URL + '/consume';
+/**
+ * Decode a wham JSON reply or throw with the status attached.
+ *
+ * @param response - the undici response.
+ * @param what - names the endpoint in error messages.
+ * @returns the parsed body.
+ */
+async function decode(response, what) {
+    const body = await response.text();
+    if (!response.ok) {
+        throw new Error(`${what} answered ${String(response.status)}: ${body.slice(0, 200)}`);
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        throw new Error(`${what} did not answer with JSON`);
+    }
+}
+/**
+ * List the account's rate-limit reset credits.
+ *
+ * @param accessToken - a live Codex access token.
+ * @param dispatcher - undici dispatcher; omit to use the global one.
+ * @param fetchImpl - injectable fetch, for tests.
+ * @param signal - abort signal bounding the call.
+ * @returns the parsed credit list.
+ */
+export async function listResetCredits(accessToken, dispatcher, fetchImpl = undiciFetch, signal) {
+    const response = await fetchImpl(CREDITS_URL, {
+        headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json' },
+        ...(dispatcher === undefined ? {} : { dispatcher }),
+        ...(signal === undefined ? {} : { signal }),
+    });
+    return decode(response, 'reset credits list');
+}
+/**
+ * Consume one rate-limit reset credit, resetting the eligible window.
+ *
+ * @param accessToken - a live Codex access token.
+ * @param redeemRequestId - caller-chosen idempotency key; retries with the same
+ *   key cannot double-redeem.
+ * @param creditId - consume this specific credit; omit for any available one.
+ * @param dispatcher - undici dispatcher; omit to use the global one.
+ * @param fetchImpl - injectable fetch, for tests.
+ * @param signal - abort signal bounding the call.
+ * @returns the outcome and how many windows were reset.
+ */
+export async function consumeResetCredit(accessToken, redeemRequestId, options = {}) {
+    const { creditId, dispatcher, fetchImpl = undiciFetch, signal } = options;
+    const response = await fetchImpl(CONSUME_URL, {
+        method: 'POST',
+        headers: {
+            authorization: `Bearer ${accessToken}`,
+            'content-type': 'application/json',
+            accept: 'application/json',
+        },
+        body: JSON.stringify({
+            redeem_request_id: redeemRequestId,
+            ...(creditId === undefined ? {} : { credit_id: creditId }),
+        }),
+        ...(dispatcher === undefined ? {} : { dispatcher }),
+        ...(signal === undefined ? {} : { signal }),
+    });
+    return decode(response, 'reset credit consume');
+}
+//# sourceMappingURL=reset-credits.js.map

package/lib/reset-credits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-credits.js","sourceRoot":"","sources":["../src/reset-credits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,IAAI,WAAW,EAAmB,MAAM,QAAQ,CAAA;AA4B9D,8DAA8D;AAC9D,MAAM,WAAW,GAAG,+DAA+D,CAAA;AAEnF,iDAAiD;AACjD,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,CAAA;AAE5C;;;;;;GAMG;AACH,KAAK,UAAU,MAAM,CAAI,QAAkB,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAA;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,UAAuB,EACvB,YAAgC,WAAW,EAC3C,MAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;QAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC/E,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAA;IACF,OAAO,MAAM,CAAsB,QAAQ,EAAE,oBAAoB,CAAC,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,eAAuB,EACvB,UAKI,EAAE;IAEN,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACzE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,iBAAiB,EAAE,eAAe;YAClC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SAC3D,CAAC;QACF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC,CAAA;IACF,OAAO,MAAM,CAAe,QAAQ,EAAE,sBAAsB,CAAC,CAAA;AAC/D,CAAC"}

package/lib/token-store.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Codex OAuth credential access. Reads the Codex CLI's own auth.json so both
+ * tools share one login, and refreshes the access token before it expires.
+ *
+ * Expiry is judged solely from the access_token's exp claim. The id_token
+ * carries identity claims, lives one hour, and is routinely expired while the
+ * access token remains valid for days -- treating it as an expiry signal would
+ * trigger a refresh on nearly every request.
+ *
+ * @module dsh-gpt-sub/token-store
+ */
+/** The subset of a token-endpoint response the refresh path reads. */
+export interface RefreshResponse {
+    ok: boolean;
+    status: number;
+    text: () => Promise<string>;
+    json: () => Promise<unknown>;
+}
+/**
+ * The injectable token-endpoint call; undici's `fetch` satisfies this shape.
+ *
+ * The global `fetch` is deliberately not used: it has no `dispatcher` option,
+ * so a refresh through it ignores the proxy and cannot connect on a machine
+ * that reaches OpenAI only through one.
+ */
+export type RefreshFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    dispatcher?: unknown;
+}) => Promise<RefreshResponse>;
+/** What {@link TokenStore.inspect} reports: file-only facts, no network. */
+export interface TokenInspection {
+    /** Access-token expiry in epoch ms, when the JWT carries a decodable exp. */
+    accessTokenExpiresAt?: number;
+}
+/** The credential fields the shim needs for one upstream request. */
+export interface CodexTokens {
+    accessToken: string;
+    refreshToken: string;
+    accountId: string;
+}
+/** Construction options; the injectable seams exist for tests. */
+export interface TokenStoreOptions {
+    /** Path to the Codex CLI credential file. */
+    authFile: string;
+    /** Refresh once the access token has less than this many ms of life left. */
+    refreshMarginMs: number;
+    /** undici Dispatcher (the same ProxyAgent the plugin's routing uses, in production). */
+    dispatcher?: unknown;
+    /** Injectable token-endpoint call, defaulting to undici's fetch. */
+    fetchImpl?: RefreshFetch;
+    /** Injectable clock, defaulting to Date.now. */
+    now?: () => number;
+}
+export declare class TokenStore {
+    #private;
+    constructor(options: TokenStoreOptions);
+    /**
+     * Return usable credentials, refreshing first when the access token is
+     * inside the configured margin.
+     *
+     * @returns credentials valid at the moment of the call.
+     */
+    getTokens(): Promise<CodexTokens>;
+    /**
+     * Report the current access token's expiry without touching the network.
+     *
+     * Reads and parses the file only -- no refresh, no matter how close to the
+     * margin the token is -- so the status endpoint can show when the next
+     * automatic refresh will happen without triggering it.
+     *
+     * @returns file-derived facts about the stored credentials.
+     */
+    inspect(): Promise<TokenInspection>;
+    /**
+     * Point later reads at a different credential file, as a page-side switch
+     * does. The caller validates the new path before switching.
+     *
+     * @param authFile - the replacement credential file's path.
+     */
+    setAuthFile(authFile: string): void;
+    /**
+     * Point later refreshes at a different dispatcher, as a proxy switch does.
+     *
+     * @param dispatcher - the dispatcher future refresh calls use; undefined for the global.
+     */
+    setDispatcher(dispatcher: unknown): void;
+    /**
+     * Check that the credential file is readable and carries the fields the shim
+     * needs, without spending a refresh on it.
+     *
+     * Called at plugin start so a missing or unparseable auth.json fails there
+     * naming the path, as the spec's error table requires, instead of surfacing
+     * on the first request. Deliberately does not call getTokens(): that would
+     * put a network refresh on the startup path.
+     */
+    verify(): Promise<void>;
+    /**
+     * Refresh regardless of remaining lifetime. Used when the upstream rejects a
+     * token that local expiry math believed was still good.
+     *
+     * @returns freshly issued credentials.
+     */
+    forceRefresh(): Promise<CodexTokens>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/lib/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3B,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,KAC1F,OAAO,CAAC,eAAe,CAAC,CAAA;AAE7B,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAA;IACvB,wFAAwF;IACxF,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,oEAAoE;IACpE,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,gDAAgD;IAChD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAcD,qBAAa,UAAU;;gBAST,OAAO,EAAE,iBAAiB;IAUtC;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC;IAUvC;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC;IAMzC;;;;;OAKG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAInC;;;;OAIG;IACH,aAAa,CAAC,UAAU,EAAE,OAAO,GAAG,IAAI;IAIxC;;;;;;;;OAQG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC7B;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,WAAW,CAAC;CA+G3C"}