dsh-plugin-model-proxy 0.1.0

package/lib/host/dispatcher.js

@@ -0,0 +1,167 @@
+/**
+ * Dispatcher factory: proxyUrl -> undici Dispatcher.
+ * One instance per proxyUrl (connection pooling), lazy-created.
+ *
+ * http(s) proxies use undici's native ProxyAgent.
+ * socks5/socks5h proxies need a bespoke undici Dispatcher: undici's fetch
+ * "dispatcher" option requires an undici Dispatcher (it only accepts
+ * http:// and https:// URLs in ProxyAgent), but a Node http.Agent such as
+ * socks-proxy-agent's SocksProxyAgent is NOT a valid undici Dispatcher
+ * ("agent.dispatch is not a function" -> Connection error). We therefore
+ * build an undici Agent whose `connect` tunnels the TCP socket through the
+ * socks server and returns the final socket (TLS-wrapped for https).
+ */
+import { ProxyAgent, Agent } from 'undici';
+import { createRequire } from 'node:module';
+import tls from 'node:tls';
+import { redactProxyUrl } from './config.js';
+const cache = new Map();
+/** IANA-assigned default port for SOCKS when the proxy URL omits one. */
+const DEFAULT_SOCKS_PORT = 1080;
+// The `connect` option undici passes to Agent is a buildConnector-like fn:
+//   connect(opts: { host, hostname, protocol, port, servername }, cb)
+// undici gives `port` as '' for default scheme ports, so we fill it in.
+function defaultPortFor(protocol) {
+    if (protocol === 'http:')
+        return 80;
+    if (protocol === 'https:')
+        return 443;
+    return 443;
+}
+/** Lazily require the optional `socks` dependency; throws with install guidance. */
+function loadSocksClient() {
+    try {
+        const require = createRequire(import.meta.url);
+        const mod = require('socks');
+        if (mod === null || typeof mod !== 'object')
+            throw new Error('no exports');
+        const SocksClient = mod.SocksClient;
+        if (typeof SocksClient?.createConnection !== 'function')
+            throw new Error('SocksClient.createConnection missing');
+        return SocksClient;
+    }
+    catch (e) {
+        // Deliberately no proxyUrl in this message: it may carry credentials.
+        throw new Error(`socks proxy requires dependency "socks" (pnpm add socks). Original: ${String(e)}`);
+    }
+}
+let socksProbe;
+/**
+ * Cheap availability probe for the optional `socks` dependency, memoized.
+ * Lets the host warn at configuration time instead of failing at first request.
+ */
+export function socksDependencyAvailable() {
+    if (socksProbe === undefined) {
+        try {
+            loadSocksClient();
+            socksProbe = true;
+        }
+        catch {
+            socksProbe = false;
+        }
+    }
+    return socksProbe;
+}
+/**
+ * Build an undici Dispatcher whose connections are tunnelled through a socks
+ * proxy. `socks` is an optional dependency loaded lazily so http-only installs
+ * still work.
+ *
+ * undici's custom `connect` connector is expected to return the FINAL socket
+ * (including TLS for https destinations), so we wrap the raw socks socket in
+ * TLS ourselves for https targets.
+ */
+function createSocksDispatcher(proxyUrl) {
+    const SocksClient = loadSocksClient();
+    const u = new URL(proxyUrl);
+    const proxyHost = u.hostname;
+    // A URL like `socks5://127.0.0.1` yields port '' -> Number('') === 0, which
+    // would dial port 0. Fall back to the IANA SOCKS default instead.
+    const proxyPort = Number(u.port) || DEFAULT_SOCKS_PORT;
+    // Returns a socket (TLS-wrapped for https) already connected to the target
+    // through the socks proxy.
+    const connectThroughSocks = (opts, callback) => {
+        const host = opts.hostname ?? opts.host ?? '';
+        const port = opts.port ? Number(opts.port) : defaultPortFor(opts.protocol ?? 'https:');
+        if (!host) {
+            callback(new Error('socks connect: missing destination host'));
+            return;
+        }
+        const finishRaw = (raw) => {
+            if (opts.protocol === 'https:' || port === 443) {
+                const secure = tls.connect({
+                    socket: raw,
+                    servername: opts.servername ?? host,
+                    host,
+                    port,
+                });
+                secure.once('secureConnect', () => callback(null, secure));
+                secure.once('error', (err) => callback(err));
+            }
+            else {
+                callback(null, raw);
+            }
+        };
+        SocksClient.createConnection({
+            proxy: { host: proxyHost, port: proxyPort, type: 5 },
+            command: 'connect',
+            destination: { host, port },
+        })
+            .then((info) => finishRaw(info.socket))
+            .catch((err) => callback(err));
+    };
+    return new Agent({ connect: connectThroughSocks });
+}
+/** A proxy URL may be reused by many rules; cache one Dispatcher per URL. */
+export function getOrCreateDispatcher(proxyUrl) {
+    const cached = cache.get(proxyUrl);
+    if (cached)
+        return cached;
+    let u;
+    try {
+        u = new URL(proxyUrl);
+    }
+    catch {
+        // Unparseable input: echo only a truncated prefix so a mistyped credential
+        // cannot land whole in logs, while still being recognizable to its author.
+        throw new Error(`invalid proxyUrl: ${JSON.stringify(proxyUrl.slice(0, 32))}…(truncated)`);
+    }
+    let d;
+    if (u.protocol === 'http:' || u.protocol === 'https:') {
+        d = new ProxyAgent(proxyUrl);
+    }
+    else if (u.protocol === 'socks5:' || u.protocol === 'socks5h:' || u.protocol === 'socks:') {
+        d = createSocksDispatcher(proxyUrl);
+    }
+    else {
+        throw new Error(`unsupported proxy protocol "${u.protocol}" for ${redactProxyUrl(proxyUrl)}`);
+    }
+    cache.set(proxyUrl, d);
+    return d;
+}
+/**
+ * Retire dispatchers: remove them from the cache and close their pooled
+ * sockets. `close()` is graceful — undici finishes in-flight requests before
+ * tearing down, so evicting a URL mid-config-change never kills an active
+ * stream. Best-effort: dispatcher instances without `close` are just dropped.
+ *
+ * Returns how many entries were removed (test seam).
+ */
+export function clearDispatcherCache(proxyUrl) {
+    const keys = proxyUrl !== undefined ? [proxyUrl] : [...cache.keys()];
+    let removed = 0;
+    for (const key of keys) {
+        const d = cache.get(key);
+        if (!cache.delete(key))
+            continue;
+        removed++;
+        const closer = d?.close;
+        if (typeof closer === 'function') {
+            // Fire-and-forget: teardown must stay synchronous; failures at pool
+            // retirement are irrelevant (sockets die with the process anyway).
+            void closer.call(d).catch(() => { });
+        }
+    }
+    return removed;
+}
+//# sourceMappingURL=dispatcher.js.map

package/lib/host/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../src/host/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,GAAG,MAAM,UAAU,CAAA;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAA;AAExC,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAE/B,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAA;IACnC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IACrC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAY,OAAO,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;QAC1E,MAAM,WAAW,GAAI,GAAiC,CAAC,WAE1C,CAAA;QACb,IAAI,OAAO,WAAW,EAAE,gBAAgB,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QAChH,OAAO,WAA6F,CAAA;IACtG,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sEAAsE;QACtE,MAAM,IAAI,KAAK,CAAC,uEAAuE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrG,CAAC;AACH,CAAC;AAED,IAAI,UAA+B,CAAA;AAEnC;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,eAAe,EAAE,CAAA;YACjB,UAAU,GAAG,IAAI,CAAA;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,KAAK,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,WAAW,GAAG,eAAe,EAAE,CAAA;IAErC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAA;IAC5B,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAA;IAEtD,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,mBAAmB,GAGb,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,QAAQ,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAA;YAC9D,OAAM;QACR,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,GAAyB,EAAE,EAAE;YAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;oBACzB,MAAM,EAAE,GAAG;oBACX,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;oBACnC,IAAI;oBACJ,IAAI;iBACL,CAAC,CAAA;gBACF,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;gBAC1D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YAC9C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YACrB,CAAC;QACH,CAAC,CAAA;QAED,WAAW,CAAC,gBAAgB,CAAC;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;YACpD,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SAC5B,CAAC;aACC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;aACtC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACzC,CAAC,CAAA;IAED,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,mBAA4B,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IAEzB,IAAI,CAAM,CAAA;IACV,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAA;IAC3F,CAAC;IAED,IAAI,CAAU,CAAA;IACd,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;SAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5F,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,QAAQ,SAAS,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACtB,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACpE,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAQ;QAChC,OAAO,EAAE,CAAA;QACT,MAAM,MAAM,GAAI,CAAoD,EAAE,KAAK,CAAA;QAC3E,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,oEAAoE;YACpE,mEAAmE;YACnE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/host/fetch-wrap.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Reversible global fetch wrapper.
+ * Only injects dispatcher when AsyncLocalStorage holds a proxyUrl.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+export interface ProxyContext {
+    proxyUrl?: string;
+    provider: string;
+    model: string;
+}
+export declare const als: AsyncLocalStorage<ProxyContext>;
+/**
+ * Whether the config state justifies touching globalThis.fetch at all.
+ *
+ * The wrapper is a process-wide side effect, so it must only be installed
+ * while some rule (or the default fallback) could actually route a request
+ * through a proxy. Globally disabled or fully-empty configs keep the global
+ * fetch untouched.
+ */
+export declare function shouldWrapFetch(config: {
+    enabled: boolean;
+    defaultProxy?: string;
+    rules?: ReadonlyArray<{
+        proxyUrl: string;
+        enabled?: boolean;
+    }>;
+}): boolean;
+/** Minimal logger face so the host can route diagnostics through ctx.logger. */
+export interface FetchWrapLogger {
+    error?(msg: string): void;
+}
+/**
+ * Install the wrapper around globalThis.fetch and return its disposer.
+ *
+ * Installation always wraps whatever is currently installed, even if that is
+ * already a model-proxy wrapper from another plugin instance. This matters for
+ * cordis-plugin-hmr: `partialReload` re-applies a plugin BEFORE the old fiber's
+ * disposers finish (they are started but not awaited), so a "detect and no-op"
+ * policy would let the dying twin's restore run last and leave fetch unwrapped
+ * entirely. Layered wrappers degrade gracefully instead: each layer only
+ * restores itself if it is still the outermost function at dispose time, and a
+ * superseded inner layer simply passes through (its ALS store is never set).
+ */
+export declare function installFetchWrapper(log?: FetchWrapLogger): () => void;
+//# sourceMappingURL=fetch-wrap.d.ts.map

package/lib/host/fetch-wrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-wrap.d.ts","sourceRoot":"","sources":["../../src/host/fetch-wrap.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAKpD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,eAAO,MAAM,GAAG,iCAAwC,CAAA;AAIxD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,KAAK,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAC/D,GAAG,OAAO,CAIV;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAQD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,eAA+B,GAAG,MAAM,IAAI,CAmEpF"}

package/lib/host/fetch-wrap.js

@@ -0,0 +1,100 @@
+/**
+ * Reversible global fetch wrapper.
+ * Only injects dispatcher when AsyncLocalStorage holds a proxyUrl.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { fetch as undiciFetch, Request as UndiciRequest } from 'undici';
+import { getOrCreateDispatcher } from './dispatcher.js';
+import { redactProxyUrl } from './config.js';
+export const als = new AsyncLocalStorage();
+/**
+ * Whether the config state justifies touching globalThis.fetch at all.
+ *
+ * The wrapper is a process-wide side effect, so it must only be installed
+ * while some rule (or the default fallback) could actually route a request
+ * through a proxy. Globally disabled or fully-empty configs keep the global
+ * fetch untouched.
+ */
+export function shouldWrapFetch(config) {
+    if (!config.enabled)
+        return false;
+    if (config.defaultProxy)
+        return true;
+    return (config.rules ?? []).some((r) => r.enabled !== false && r.proxyUrl !== '');
+}
+/** Fallback when no host logger is wired in (standalone smoke tests). */
+const consoleLogger = {
+    // eslint-disable-next-line no-console
+    error: (msg) => console.error(msg),
+};
+/**
+ * Install the wrapper around globalThis.fetch and return its disposer.
+ *
+ * Installation always wraps whatever is currently installed, even if that is
+ * already a model-proxy wrapper from another plugin instance. This matters for
+ * cordis-plugin-hmr: `partialReload` re-applies a plugin BEFORE the old fiber's
+ * disposers finish (they are started but not awaited), so a "detect and no-op"
+ * policy would let the dying twin's restore run last and leave fetch unwrapped
+ * entirely. Layered wrappers degrade gracefully instead: each layer only
+ * restores itself if it is still the outermost function at dispose time, and a
+ * superseded inner layer simply passes through (its ALS store is never set).
+ */
+export function installFetchWrapper(log = consoleLogger) {
+    const original = globalThis.fetch;
+    const wrapped = (async (input, init) => {
+        const store = als.getStore();
+        if (!store?.proxyUrl) {
+            return original(input, init);
+        }
+        // Only called inside llm/stream — safe to proxy all fetches in this context.
+        // If needed, add URL allowlist (e.g. only https://example.com etc.), but
+        // context-scoping already isolates from non-LLM fetches.
+        try {
+            const dispatcher = getOrCreateDispatcher(store.proxyUrl);
+            // undici's fetch brand-checks ITS OWN Request class, so a Request built
+            // by another realm (e.g. Node's global constructor) throws
+            // "Failed to parse URL from [object Request]". Adapters currently pass
+            // string URLs, but rebuild defensively so a future Request-passing
+            // caller degrades to working proxying instead of an opaque TypeError.
+            // Verified: `new undici.Request(foreignReq.url, foreignReq)` carries
+            // method/headers/body across realms; init.signal below still overrides
+            // per spec.
+            let proxiedInput = input;
+            if (typeof Request !== 'undefined' && input instanceof Request) {
+                proxiedInput = new UndiciRequest(input.url, input);
+            }
+            // NOTE: Node's native (built-in) global fetch forwards `dispatcher` to
+            // its internal undici copy, whose Dispatcher/handler protocol does not
+            // match instances of the standalone undici package ("invalid onError
+            // method"), so for proxied requests we delegate to undici's own fetch,
+            // which fully supports `dispatcher` (including the socks Agent built in
+            // dispatcher.ts). Direct (no-proxy) requests keep using the original
+            // global fetch unchanged.
+            const nextInit = { ...(init ?? {}), dispatcher };
+            return await undiciFetch(proxiedInput, nextInit);
+        }
+        catch (err) {
+            // Sync failures only (bad proxy URL scheme / missing socks dep);
+            // async transport errors propagate to the adapter untouched.
+            // Log the full cause chain so "Connection error" isn't opaque — with a
+            // REDACTED proxyUrl: credentials must never reach logs.
+            const causeChain = [];
+            let c = err;
+            while (c && causeChain.length < 6) {
+                causeChain.push(c?.message ?? String(c));
+                c = c?.cause;
+            }
+            log.error?.(`[model-proxy] proxied fetch failed (${store.provider}/${store.model} via ${redactProxyUrl(store.proxyUrl)}): ${causeChain.join(' → ')}`);
+            throw err;
+        }
+    });
+    globalThis.fetch = wrapped;
+    return () => {
+        // Only unwrap when we are still the outermost wrapper; otherwise another
+        // (newer) wrapper sits on top and owns the restore.
+        if (globalThis.fetch === wrapped) {
+            globalThis.fetch = original;
+        }
+    };
+}
+//# sourceMappingURL=fetch-wrap.js.map

package/lib/host/fetch-wrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-wrap.js","sourceRoot":"","sources":["../../src/host/fetch-wrap.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,QAAQ,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAQ5C,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,iBAAiB,EAAgB,CAAA;AAIxD;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAI/B;IACC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,MAAM,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IACpC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAA;AACnF,CAAC;AAOD,yEAAyE;AACzE,MAAM,aAAa,GAAoB;IACrC,sCAAsC;IACtC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;CACnC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAuB,aAAa;IACtE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAgB,CAAA;IAE5C,MAAM,OAAO,GAAY,CAAC,KAAK,EAAE,KAAwB,EAAE,IAA6C,EAAE,EAAE;QAC1G,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;YACrB,OAAQ,QAAoB,CAAC,KAA2B,EAAE,IAAmB,CAAC,CAAA;QAChF,CAAC;QAED,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAExD,wEAAwE;YACxE,2DAA2D;YAC3D,uEAAuE;YACvE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,YAAY;YACZ,IAAI,YAAY,GAAY,KAAK,CAAA;YACjC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;gBAC/D,YAAY,GAAG,IAAI,aAAa,CAAE,KAAiB,CAAC,GAAG,EAAE,KAAiC,CAAC,CAAA;YAC7F,CAAC;YAED,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,UAAU,EAA2C,CAAA;YACzF,OAAO,MAAO,WAAkC,CAC9C,YAAkC,EAClC,QAAkC,CACnC,CAAA;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,iEAAiE;YACjE,6DAA6D;YAC7D,uEAAuE;YACvE,wDAAwD;YACxD,MAAM,UAAU,GAAa,EAAE,CAAA;YAC/B,IAAI,CAAC,GAAY,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAE,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;gBACnD,CAAC,GAAI,CAAyB,EAAE,KAAK,CAAA;YACvC,CAAC;YACD,GAAG,CAAC,KAAK,EAAE,CACT,uCAAuC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,QAAQ,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACzI,CAAA;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAuB,CAAA;IAExB,UAAU,CAAC,KAAK,GAAG,OAA6C,CAAA;IAEhE,OAAO,GAAG,EAAE;QACV,yEAAyE;QACzE,oDAAoD;QACpD,IAAI,UAAU,CAAC,KAAK,KAAM,OAA8C,EAAE,CAAC;YACzE,UAAU,CAAC,KAAK,GAAG,QAA8C,CAAA;QACnE,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/lib/host/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Host plugin: dsh-plugin-model-proxy
+ *
+ * - Registers `model-proxy` settings namespace (live, no restart)
+ * - Wraps global fetch (reversible)
+ * - Intercepts `llm/stream` waterfall to route per (provider, model, purpose)
+ * - Composes credentialRef entries over rule proxyUrls (soft credentials dep)
+ * - Probes newly configured proxies without consuming model quota
+ *
+ * Zero invasion: only uses public seams (ctx.settings, ctx.llm waterfall,
+ * ctx.get('credentials'), global fetch dispatcher).
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type ModelProxyConfig as ConfigType } from './config.js';
+export declare const name = "dsh-plugin-model-proxy";
+export declare const inject: string[];
+export declare function apply(ctx: Context, entry: ConfigType): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/host/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,OAAO,EAAqE,KAAK,gBAAgB,IAAI,UAAU,EAAkB,MAAM,aAAa,CAAA;AAMpJ,eAAO,MAAM,IAAI,2BAA2B,CAAA;AAC5C,eAAO,MAAM,MAAM,UAAsB,CAAA;AAIzC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA2P3D"}

package/lib/host/index.js

@@ -0,0 +1,262 @@
+/**
+ * Host plugin: dsh-plugin-model-proxy
+ *
+ * - Registers `model-proxy` settings namespace (live, no restart)
+ * - Wraps global fetch (reversible)
+ * - Intercepts `llm/stream` waterfall to route per (provider, model, purpose)
+ * - Composes credentialRef entries over rule proxyUrls (soft credentials dep)
+ * - Probes newly configured proxies without consuming model quota
+ *
+ * Zero invasion: only uses public seams (ctx.settings, ctx.llm waterfall,
+ * ctx.get('credentials'), global fetch dispatcher).
+ */
+import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
+import { ModelProxyConfig, assertServiceable, resolveProxy, redactProxyUrl } from './config.js';
+import { als, installFetchWrapper, shouldWrapFetch } from './fetch-wrap.js';
+import { clearDispatcherCache, socksDependencyAvailable } from './dispatcher.js';
+import { composeProxyUrl, getCredentialsService } from './credentials.js';
+import { probeProxy } from './probe.js';
+export const name = 'dsh-plugin-model-proxy';
+export const inject = ['settings', 'llm'];
+const NS = settingsNamespace('model-proxy');
+export function apply(ctx, entry) {
+    // Normalize entry through schema defaults so bare {} works
+    let normalizedEntry;
+    try {
+        normalizedEntry = ModelProxyConfig(entry ?? {});
+        assertServiceable(normalizedEntry);
+    }
+    catch (err) {
+        ctx.logger.warn(`[model-proxy] composition config invalid: ${String(err)}`);
+        normalizedEntry = { enabled: true, rules: [], defaultProxy: '', debug: false };
+    }
+    // Authoritative config source: the composition entry until the settings
+    // layer attaches, then the resolved scope. installSettingsSection calls
+    // setSource before the matching onChange, so no polling or timers needed.
+    let current = () => normalizedEntry;
+    const credCache = new Map();
+    const warnedCredRefs = new Set();
+    function refreshCredential(lookup, ref) {
+        if (!lookup) {
+            credCache.set(ref, { status: 'error', message: 'credentials service not installed' });
+            return Promise.resolve();
+        }
+        return lookup
+            .resolve(ref)
+            .then((hit) => {
+            if (hit === undefined || typeof hit.value !== 'string' || hit.value.length === 0) {
+                credCache.set(ref, { status: 'error', message: `credential "${ref}" not found` });
+            }
+            else if (!hit.value.includes(':')) {
+                credCache.set(ref, { status: 'error', message: `credential "${ref}" must hold "user:password"` });
+            }
+            else {
+                credCache.set(ref, { status: 'ok', value: hit.value });
+            }
+        })
+            .catch((err) => {
+            credCache.set(ref, { status: 'error', message: String(err) });
+        });
+    }
+    /** Effective URL for a matched rule; sync — reads only the resolved cache. */
+    const effectiveRuleUrl = (r) => {
+        if (!r.proxyUrl)
+            return undefined;
+        const ref = r.credentialRef?.trim() || undefined;
+        if (!ref)
+            return r.proxyUrl;
+        const hit = credCache.get(ref);
+        if (hit?.status !== 'ok') {
+            if (!warnedCredRefs.has(ref)) {
+                warnedCredRefs.add(ref);
+                const why = hit?.status === 'error' ? hit.message : 'still resolving';
+                ctx.logger.warn(`[model-proxy] credential ${ref} unavailable (${why}); routing ${r.provider}/${r.model} with inline proxyUrl until it resolves`);
+            }
+            return r.proxyUrl;
+        }
+        return composeProxyUrl(r.proxyUrl, hit.value) ?? r.proxyUrl;
+    };
+    // ── dispatcher cache + socks warning lifecycle ──────────────────────────
+    let activeProxyUrls = new Set();
+    const warnedUnusableSchemes = new Set();
+    // ── probe scheduling (P3-a): one pass per never-probed URL, serialized ──
+    const probedUrls = new Set();
+    let probeChain = Promise.resolve();
+    const scheduleProbes = (urls) => {
+        for (const url of urls) {
+            if (probedUrls.has(url))
+                continue;
+            const isSocks = url.startsWith('socks5') || url.startsWith('socks:');
+            if (isSocks && !socksDependencyAvailable())
+                continue; // warn already emitted
+            probedUrls.add(url);
+            probeChain = probeChain.then(async () => {
+                const result = await probeProxy(url);
+                const via = redactProxyUrl(url);
+                if (result.ok) {
+                    ctx.logger.info(`[model-proxy] probe ${via} OK (${result.latencyMs}ms, ${result.detail})`);
+                }
+                else {
+                    ctx.logger.warn(`[model-proxy] probe ${via} FAILED (${result.latencyMs}ms): ${result.detail}`);
+                }
+            }).catch(() => { });
+        }
+    };
+    // Reconcile is async (credential resolution), onChange is sync — serialize
+    // runs and coalesce bursts of config writes into one trailing run.
+    let reconciling = false;
+    let pendingReconcile = false;
+    const runReconcile = async () => {
+        if (reconciling) {
+            pendingReconcile = true;
+            return;
+        }
+        reconciling = true;
+        try {
+            const cfg = current();
+            // refresh every referenced credential before computing effective URLs
+            const lookup = getCredentialsService(ctx);
+            const refs = [...new Set(cfg.rules.map((r) => r.credentialRef?.trim()).filter((v) => !!v))];
+            await Promise.all(refs.map((ref) => refreshCredential(lookup, ref)));
+            // eviction baseline must use EFFECTIVE urls: the dispatcher cache keys
+            // on composed URLs, so a rotated credential must retire the old pool
+            const next = new Set();
+            for (const r of cfg.rules) {
+                const u = effectiveRuleUrl(r);
+                if (u)
+                    next.add(u);
+            }
+            if (cfg.defaultProxy)
+                next.add(cfg.defaultProxy);
+            for (const url of activeProxyUrls) {
+                if (!next.has(url))
+                    clearDispatcherCache(url);
+            }
+            activeProxyUrls = next;
+            for (const url of activeProxyUrls) {
+                if (!url.startsWith('socks5') && !url.startsWith('socks:'))
+                    continue;
+                if (socksDependencyAvailable() || warnedUnusableSchemes.has(url))
+                    continue;
+                warnedUnusableSchemes.add(url);
+                ctx.logger.warn(`[model-proxy] ${redactProxyUrl(url)} needs the optional dependency "socks" — run: pnpm add socks`);
+            }
+            scheduleProbes(activeProxyUrls);
+        }
+        finally {
+            reconciling = false;
+            if (pendingReconcile) {
+                pendingReconcile = false;
+                void runReconcile();
+            }
+        }
+    };
+    const reconcileConfigSideEffects = () => {
+        void runReconcile();
+    };
+    // ── fetch wrapper lifecycle: installed only while routing is possible ──
+    // Wrapping globalThis.fetch is a process-wide side effect, so the wrapper
+    // exists exactly while shouldWrapFetch(config) holds: disabled or fully
+    // direct configs keep the global untouched. Kept in sync from the entry
+    // config and every settings change; the fiber disposer always unwinds.
+    let uninstallFetch;
+    const fetchLogger = { error: (msg) => ctx.logger.error(msg) };
+    const syncFetchWrapper = () => {
+        if (shouldWrapFetch(current())) {
+            if (!uninstallFetch) {
+                uninstallFetch = installFetchWrapper(fetchLogger);
+                ctx.logger.info('[model-proxy] fetch wrapper installed');
+            }
+        }
+        else if (uninstallFetch) {
+            try {
+                uninstallFetch();
+            }
+            catch { }
+            uninstallFetch = undefined;
+            ctx.logger.info('[model-proxy] fetch wrapper removed');
+        }
+    };
+    ctx.effect(() => {
+        syncFetchWrapper();
+        return () => {
+            try {
+                uninstallFetch?.();
+            }
+            catch { }
+            uninstallFetch = undefined;
+            ctx.logger.info('[model-proxy] fetch wrapper removed');
+        };
+    }, 'model-proxy: fetch wrapper');
+    // Dispatcher pools must not outlive the plugin fiber: on unload/HMR reload
+    // the reconcile loop stops running, so a full close-and-evict here is the
+    // only guarantee the sockets are retired.
+    ctx.effect(() => () => {
+        const n = clearDispatcherCache();
+        if (n > 0)
+            ctx.logger.info(`[model-proxy] closed ${n} dispatcher pool(s)`);
+    }, 'model-proxy: dispatcher cache');
+    // 1) Settings namespace — live, validated, layered over entry.
+    // Registered AFTER the wrapper/disposer effects above so a synchronous
+    // first onChange cannot touch a not-yet-initialized binding.
+    installSettingsSection(ctx, NS, ModelProxyConfig, entry, {
+        validate(value) {
+            assertServiceable(value);
+        },
+        setSource(next) {
+            current = next;
+        },
+        onChange() {
+            syncFetchWrapper();
+            reconcileConfigSideEffects();
+            const cfg = current();
+            if (!cfg.debug)
+                return;
+            const summary = cfg.rules
+                .map((r) => `${r.provider}/${r.model}→${r.proxyUrl ? redactProxyUrl(r.proxyUrl) : 'direct'}${r.purpose ? `@${r.purpose}` : ''}`)
+                .join(', ');
+            ctx.logger.info(`[model-proxy] config applied: enabled=${cfg.enabled} rules=${cfg.rules.length}${summary ? ` [${summary}]` : ''} defaultProxy=${cfg.defaultProxy ? redactProxyUrl(cfg.defaultProxy) : 'direct'}`);
+        },
+    });
+    // Kick initial reconciliation (entry-level config, credential cache warmup,
+    // first probes). Fire-and-forget: failures are logged inside. The fetch
+    // wrapper itself was already synced from the entry config by its effect.
+    reconcileConfigSideEffects();
+    // 3) llm/stream waterfall — per-request proxy decision
+    //    We use waterfall mode: decide, stash in ALS, then delegate.
+    //    The listener must be SYNC and return an AsyncIterable: cordis waterfall
+    //    composition does not await listener results, and downstream listeners
+    //    (e.g. session-checkpoint-policy) `yield* next()` — an `async` listener
+    //    hands them a Promise and iteration throws "not async iterable".
+    ctx.on('llm/stream', (opts, next) => {
+        const cfg = current();
+        const proxyUrl = resolveProxy(cfg, opts.provider, opts.model, opts.purpose, effectiveRuleUrl);
+        const label = `${opts.provider}/${opts.model}${opts.purpose ? `@${opts.purpose}` : ''}`;
+        // Routing decision is logged only when the user asked for debug output,
+        // and always redacted.
+        if (cfg.debug) {
+            ctx.logger.info(`[model-proxy] ${label} → ${proxyUrl ? redactProxyUrl(proxyUrl) : 'direct'}`);
+        }
+        // Fast path: globally disabled, nothing configured, or no match — pass
+        // through untouched without entering the ALS context.
+        if (!proxyUrl)
+            return next();
+        // AsyncLocalStorage does NOT propagate into a deferred async generator:
+        // the consumer resumes it from its own context, so a store set here would
+        // be gone by the time the adapter's fetch runs. Instead we re-enter the
+        // store per protocol call (next/return/throw), which keeps it alive across
+        // every await inside the adapter's stream.
+        const ctxData = { proxyUrl, provider: opts.provider, model: opts.model };
+        const iterator = next()[Symbol.asyncIterator]();
+        return {
+            [Symbol.asyncIterator]() {
+                return {
+                    next: () => als.run(ctxData, () => iterator.next()),
+                    return: (value) => als.run(ctxData, () => iterator.return ? iterator.return(value) : Promise.resolve({ done: true, value })),
+                    throw: (error) => als.run(ctxData, () => iterator.throw ? iterator.throw(error) : Promise.reject(error)),
+                };
+            },
+        };
+    });
+}
+//# sourceMappingURL=index.js.map

package/lib/host/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAErF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,cAAc,EAAuD,MAAM,aAAa,CAAA;AACpJ,OAAO,EAAE,GAAG,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAChF,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAyB,MAAM,kBAAkB,CAAA;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,MAAM,CAAC,MAAM,IAAI,GAAG,wBAAwB,CAAA;AAC5C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AAEzC,MAAM,EAAE,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAA;AAE3C,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,KAAiB;IACnD,2DAA2D;IAC3D,IAAI,eAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,eAAe,GAAG,gBAAgB,CAAC,KAAK,IAAK,EAAc,CAAe,CAAA;QAC1E,iBAAiB,CAAC,eAAe,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3E,eAAe,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAgB,CAAA;IAC9F,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,OAAO,GAAqB,GAAG,EAAE,CAAC,eAAe,CAAA;IAOrD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC5C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAA;IAExC,SAAS,iBAAiB,CAAC,MAAoC,EAAE,GAAW;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAA;YACrF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,MAAM;aACV,OAAO,CAAC,GAAG,CAAC;aACZ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjF,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,aAAa,EAAE,CAAC,CAAA;YACnF,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,GAAG,6BAA6B,EAAE,CAAC,CAAA;YACnG,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;YACxD,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;IACN,CAAC;IAED,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,CAAC,CAAY,EAAsB,EAAE;QAC5D,IAAI,CAAC,CAAC,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS,CAAA;QAChD,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAA;QAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACvB,MAAM,GAAG,GAAG,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAA;gBACrE,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,4BAA4B,GAAG,iBAAiB,GAAG,cAAc,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,yCAAyC,CAChI,CAAA;YACH,CAAC;YACD,OAAO,CAAC,CAAC,QAAQ,CAAA;QACnB,CAAC;QACD,OAAO,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAA;IAC7D,CAAC,CAAA;IAED,2EAA2E;IAC3E,IAAI,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAA;IAE/C,2EAA2E;IAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAA;IACpC,IAAI,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IACjD,MAAM,cAAc,GAAG,CAAC,IAAsB,EAAQ,EAAE;QACtD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;YACpE,IAAI,OAAO,IAAI,CAAC,wBAAwB,EAAE;gBAAE,SAAQ,CAAC,uBAAuB;YAC5E,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACnB,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBACtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;gBACpC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,QAAQ,MAAM,CAAC,SAAS,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;gBAC5F,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,YAAY,MAAM,CAAC,SAAS,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;gBAChG,CAAC;YACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpB,CAAC;IACH,CAAC,CAAA;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAC5B,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;QAC7C,IAAI,WAAW,EAAE,CAAC;YAChB,gBAAgB,GAAG,IAAI,CAAA;YACvB,OAAM;QACR,CAAC;QACD,WAAW,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;YAErB,sEAAsE;YACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAA;YACzC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACxG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAEpE,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAA;gBAC7B,IAAI,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACpB,CAAC;YACD,IAAI,GAAG,CAAC,YAAY;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YAEhD,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,oBAAoB,CAAC,GAAG,CAAC,CAAA;YAC/C,CAAC;YACD,eAAe,GAAG,IAAI,CAAA;YAEtB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACpE,IAAI,wBAAwB,EAAE,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAQ;gBAC1E,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,cAAc,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAA;YACrH,CAAC;YAED,cAAc,CAAC,eAAe,CAAC,CAAA;QACjC,CAAC;gBAAS,CAAC;YACT,WAAW,GAAG,KAAK,CAAA;YACnB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,gBAAgB,GAAG,KAAK,CAAA;gBACxB,KAAK,YAAY,EAAE,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC,CAAA;IACD,MAAM,0BAA0B,GAAG,GAAS,EAAE;QAC5C,KAAK,YAAY,EAAE,CAAA;IACrB,CAAC,CAAA;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,cAAwC,CAAA;IAC5C,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAA;IACrE,MAAM,gBAAgB,GAAG,GAAS,EAAE;QAClC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAA;gBACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;YAC1D,CAAC;QACH,CAAC;aAAM,IAAI,cAAc,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,cAAc,EAAE,CAAA;YAClB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,cAAc,GAAG,SAAS,CAAA;YAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC;IACH,CAAC,CAAA;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,gBAAgB,EAAE,CAAA;QAClB,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,cAAc,EAAE,EAAE,CAAA;YACpB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,cAAc,GAAG,SAAS,CAAA;YAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QACxD,CAAC,CAAA;IACH,CAAC,EAAE,4BAA4B,CAAC,CAAA;IAEhC,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAC1C,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE;QACpB,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAA;QAChC,IAAI,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAA;IAC5E,CAAC,EAAE,+BAA+B,CAAC,CAAA;IAEnC,+DAA+D;IAC/D,uEAAuE;IACvE,6DAA6D;IAC7D,sBAAsB,CAAC,GAAG,EAAE,EAAE,EAAE,gBAA2E,EAAE,KAAgB,EAAE;QAC7H,QAAQ,CAAC,KAAc;YACrB,iBAAiB,CAAC,KAAmB,CAAC,CAAA;QACxC,CAAC;QACD,SAAS,CAAC,IAAsB;YAC9B,OAAO,GAAG,IAAwB,CAAA;QACpC,CAAC;QACD,QAAQ;YACN,gBAAgB,EAAE,CAAA;YAClB,0BAA0B,EAAE,CAAA;YAC5B,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,OAAM;YACtB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK;iBACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;iBAC/H,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,yCAAyC,GAAG,CAAC,OAAO,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CACjM,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,4EAA4E;IAC5E,wEAAwE;IACxE,yEAAyE;IACzE,0BAA0B,EAAE,CAAA;IAE5B,uDAAuD;IACvD,iEAAiE;IACjE,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,IAAqB,EAAE,IAAkC,EAA0B,EAAE;QACzG,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;QAC7F,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAEvF,wEAAwE;QACxE,uBAAuB;QACvB,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC/F,CAAC;QAED,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,EAA0B,CAAA;QAEpD,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;QACxE,MAAM,QAAQ,GAAI,IAAI,EAA6B,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAA;QAC3E,OAAO;YACL,CAAC,MAAM,CAAC,aAAa,CAAC;gBACpB,OAAO;oBACL,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnD,MAAM,EAAE,CAAC,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CACjD,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpF,KAAK,EAAE,CAAC,KAAe,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAChD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;iBAClE,CAAA;YACH,CAAC;SACsB,CAAA;IAC3B,CAAC,CAAC,CAAA;AACJ,CAAC"}