dsh-subscriptions 0.1.5 → 0.2.2

package/lib/providers/common.d.ts

@@ -46,6 +46,13 @@ export declare function validateModels(models: readonly ModelEntry[], label: str
  * @throws SyntaxError with the local origin and a fixed omission marker.
  */
 export declare function parseProviderJson<T = unknown>(input: Response | string, origin: string): Promise<T>;
+/**
+ * Read a bounded JSON body; oversized or malformed payloads fail loudly.
+ * Bytes accumulate per chunk and the stream is cancelled past the cap, so
+ * the bound limits memory even when the body has no end; a declared
+ * over-cap `content-length` fails before the first read.
+ */
+export declare function readBoundedJson(response: Response, label: string, maxBytes: number): Promise<unknown>;
 /** Optional per-call hooks {@link httpLlmError} uses to read a rate-limit window. */
 export interface HttpLlmErrorOptions {
     /**
@@ -212,6 +219,13 @@ export interface UsageWindow {
     windowDurationMs?: number;
     /** Provider-verified fixed interval; permits deriving start from end and duration. */
     fixedWindow?: boolean;
+    /**
+     * Display-only start the reader assumed (kind or label based, clamped
+     * to now). The time marker may ride it; pace and color must never —
+     * it is not evidence of when the window opened. Mutually exclusive
+     * with `startsAt`.
+     */
+    displayStartsAt?: number;
 }
 /** One banked reset credit (Codex), or one grant containing resets (Claude). */
 export interface ResetCredit {

package/lib/providers/common.js

@@ -22,19 +22,22 @@ export function validateModels(models, label) {
         if (model.name !== undefined && model.name.length === 0) {
             throw new Error(`${label}: catalog model "${model.id}" has an empty name`);
         }
-        if (model.contextWindow !== undefined
-            && (!Number.isInteger(model.contextWindow) || model.contextWindow <= 0)) {
+        if (model.contextWindow !== undefined &&
+            (!Number.isInteger(model.contextWindow) || model.contextWindow <= 0)) {
             throw new Error(`${label}: catalog model "${model.id}" contextWindow must be a positive integer`);
         }
-        if (model.maxTokens !== undefined && (!Number.isInteger(model.maxTokens) || model.maxTokens <= 0)) {
+        if (model.maxTokens !== undefined &&
+            (!Number.isInteger(model.maxTokens) || model.maxTokens <= 0)) {
             throw new Error(`${label}: catalog model "${model.id}" maxTokens must be a positive integer`);
         }
-        if (model.inputModalities !== undefined
-            && (model.inputModalities.length === 0
-                || model.inputModalities.some(modality => modality !== 'text' && modality !== 'image'))) {
+        if (model.inputModalities !== undefined &&
+            (model.inputModalities.length === 0 ||
+                model.inputModalities.some((modality) => modality !== 'text' && modality !== 'image'))) {
             throw new Error(`${label}: catalog model "${model.id}" inputModalities must be a non-empty list of "text"/"image"`);
         }
-        if (model.wire !== undefined && model.wire !== 'chat-completions' && model.wire !== 'responses') {
+        if (model.wire !== undefined &&
+            model.wire !== 'chat-completions' &&
+            model.wire !== 'responses') {
             throw new Error(`${label}: catalog model "${model.id}" wire must be "chat-completions" or "responses"`);
         }
         if (seen.has(model.id))
@@ -42,11 +45,15 @@ export function validateModels(models, label) {
         seen.add(model.id);
         return {
             id: model.id,
-            ...model.name === undefined ? {} : { name: model.name },
-            ...model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow },
-            ...model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens },
-            ...model.inputModalities === undefined ? {} : { inputModalities: [...model.inputModalities] },
-            ...model.wire === undefined ? {} : { wire: model.wire },
+            ...(model.name === undefined ? {} : { name: model.name }),
+            ...(model.contextWindow === undefined
+                ? {}
+                : { contextWindow: model.contextWindow }),
+            ...(model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens }),
+            ...(model.inputModalities === undefined
+                ? {}
+                : { inputModalities: [...model.inputModalities] }),
+            ...(model.wire === undefined ? {} : { wire: model.wire }),
         };
     });
 }
@@ -80,9 +87,61 @@ export async function parseProviderJson(input, origin) {
     catch (error) {
         if (!(error instanceof SyntaxError))
             throw error;
+        // Do not attach the original SyntaxError: Node's message quotes the input, and the host renders cause.
+        // eslint-disable-next-line preserve-caught-error -- the replacement omits the provider excerpt on purpose
         throw new SyntaxError(providerDiagnostic(`${origin}: invalid JSON`, true));
     }
 }
+/**
+ * Read a bounded JSON body; oversized or malformed payloads fail loudly.
+ * Bytes accumulate per chunk and the stream is cancelled past the cap, so
+ * the bound limits memory even when the body has no end; a declared
+ * over-cap `content-length` fails before the first read.
+ */
+export async function readBoundedJson(response, label, maxBytes) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        // Stop the socket too: the headers arrived, but the body must never flow.
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error(`${label} response exceeds ${String(maxBytes)} bytes`);
+    }
+    if (response.body === null)
+        throw new Error(`${label} response has no body`);
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let bytes = 0;
+    let text = '';
+    try {
+        for (;;) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > maxBytes) {
+                // Cancel before throwing so the live stream does not linger behind
+                // a rejection the caller already stopped listening to.
+                await reader.cancel().catch(() => undefined);
+                throw new Error(`${label} response exceeds ${String(maxBytes)} bytes`);
+            }
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+        text += decoder.decode();
+    }
+    finally {
+        try {
+            reader.releaseLock();
+        }
+        catch {
+            /* best effort */
+        }
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${label} response is not JSON`);
+    }
+}
 /**
  * Build an LlmError from a non-2xx provider response, mapping the status to a
  * stable code and, for a rate-limited request, the disclosed reset instant to
@@ -139,7 +198,9 @@ export async function httpLlmError(response, label, options = {}) {
     // re-hitting the same closed window.
     const rateLimited = response.status === 429;
     const reset = rateLimited
-        ? options.rateLimitReset?.(response, body, now) ?? googleQuotaReset(body, now) ?? retryAfterInstant(response, now)
+        ? (options.rateLimitReset?.(response, body, now) ??
+            googleQuotaReset(body, now) ??
+            retryAfterInstant(response, now))
         : retryAfterInstant(response, now);
     if (reset === undefined && rateLimited) {
         // Header names and values are provider-controlled too; none are displayed.
@@ -147,7 +208,9 @@ export async function httpLlmError(response, label, options = {}) {
     }
     return new LlmError(message, code, {
         status: response.status,
-        ...reset === undefined ? {} : { providerRetryAfterMs: waitFromReset(reset, now) },
+        ...(reset === undefined
+            ? {}
+            : { providerRetryAfterMs: waitFromReset(reset, now) }),
     });
 }
 /**
@@ -236,9 +299,13 @@ export function idleWatchdog(caller, timeoutMs) {
  */
 export function mapFetchFailure(label, error, watchdog, caller) {
     if (watchdog.timedOut())
-        return new LlmError(`${label} stream idle timeout`, 'TIMEOUT', { cause: error });
+        return new LlmError(`${label} stream idle timeout`, 'TIMEOUT', {
+            cause: error,
+        });
     if (caller?.aborted === true)
-        return new LlmError(`${label} request aborted by caller`, 'ABORTED', { cause: error });
+        return new LlmError(`${label} request aborted by caller`, 'ABORTED', {
+            cause: error,
+        });
     if (error instanceof LlmError)
         return error;
     return new LlmError(`${label} request failed`, 'TRANSPORT', { cause: error });
@@ -339,10 +406,11 @@ export class TokenManager {
     async session(forceRefresh = false) {
         const session = await this.options.load();
         if (session === undefined) {
-            throw new LlmError(`dsh-subscriptions: not logged in to ${this.options.displayName}; `
-                + 'log in via Settings → Subscriptions in the dsh web app', 'MISSING_CREDENTIAL');
+            throw new LlmError(`dsh-subscriptions: not logged in to ${this.options.displayName}; ` +
+                'log in via Settings → Subscriptions in the dsh web app', 'MISSING_CREDENTIAL');
         }
-        if (!forceRefresh && session.expiresAt - Date.now() > this.options.preemptMs) {
+        if (!forceRefresh &&
+            session.expiresAt - Date.now() > this.options.preemptMs) {
             return session;
         }
         this.inflight ??= this.doRefresh(session).finally(() => {
@@ -358,7 +426,9 @@ export class TokenManager {
                 // log out an account that just signed in. Serve it instead.
                 const attempted = this.attempted;
                 const stored = await this.options.load();
-                if (stored !== undefined && attempted !== undefined && stored.refreshToken !== attempted.refreshToken) {
+                if (stored !== undefined &&
+                    attempted !== undefined &&
+                    stored.refreshToken !== attempted.refreshToken) {
                     return stored;
                 }
                 await this.options.remove();
@@ -378,9 +448,9 @@ export class TokenManager {
         // A concurrent caller may have refreshed while this one waited: re-read
         // the store and skip the round trip when the stored session is fresh.
         const current = await this.options.load();
-        if (current !== undefined
-            && current.accessToken !== session.accessToken
-            && current.expiresAt - Date.now() > this.options.preemptMs) {
+        if (current !== undefined &&
+            current.accessToken !== session.accessToken &&
+            current.expiresAt - Date.now() > this.options.preemptMs) {
             return current;
         }
         const attempted = current ?? session;
@@ -398,14 +468,14 @@ export const DISCOVERY_TIMEOUT_MS = 10_000;
  */
 export function withTimeout(work, timeoutMs) {
     const signal = AbortSignal.timeout(timeoutMs);
-    const aborted = new Promise(resolve => {
+    const aborted = new Promise((resolve) => {
         if (signal.aborted)
             resolve(undefined);
         else
             signal.addEventListener('abort', () => resolve(undefined), { once: true });
     });
     return Promise.race([
-        work(signal).then(value => (signal.aborted ? undefined : value), (error) => {
+        work(signal).then((value) => (signal.aborted ? undefined : value), (error) => {
             if (signal.aborted)
                 return undefined;
             throw error;
@@ -415,7 +485,9 @@ export function withTimeout(work, timeoutMs) {
 }
 /** Display name for a wire reasoning-effort identifier. */
 export function effortDisplayName(effort) {
-    return effort === 'xhigh' ? 'Extra High' : effort.charAt(0).toUpperCase() + effort.slice(1);
+    return effort === 'xhigh'
+        ? 'Extra High'
+        : effort.charAt(0).toUpperCase() + effort.slice(1);
 }
 /**
  * Fold a configured per-model default effort into a reasoning block, keeping
@@ -444,7 +516,9 @@ export function mergeReasoning(configuredDefault, base, options) {
         ? undefined
         : {
             efforts: [...base.efforts],
-            ...(base.defaultEffort === undefined ? {} : { defaultEffort: base.defaultEffort }),
+            ...(base.defaultEffort === undefined
+                ? {}
+                : { defaultEffort: base.defaultEffort }),
         };
     if (configuredDefault === undefined)
         return detached;
@@ -454,10 +528,13 @@ export function mergeReasoning(configuredDefault, base, options) {
         // catalog does not cover). Inventing a reasoning block here would claim a
         // capability nobody advertised; only a fallback-based provider may.
         return options?.extendable === true
-            ? { efforts: [{ id: effort, name: effortDisplayName(effort) }], defaultEffort: effort }
+            ? {
+                efforts: [{ id: effort, name: effortDisplayName(effort) }],
+                defaultEffort: effort,
+            }
             : undefined;
     }
-    if (base.efforts.some(entry => entry.id === effort)) {
+    if (base.efforts.some((entry) => entry.id === effort)) {
         return { efforts: [...base.efforts], defaultEffort: effort };
     }
     if (options?.extendable !== true)
@@ -536,7 +613,9 @@ export class ModelCatalogCache {
         if (this.persistence === undefined)
             return Promise.resolve();
         this.seeded ??= this.persistence.load().then((snapshot) => {
-            if (snapshot !== undefined && this.entry === undefined && !this.seedDisabled) {
+            if (snapshot !== undefined &&
+                this.entry === undefined &&
+                !this.seedDisabled) {
                 this.entry = snapshot;
             }
         }, () => undefined);
@@ -612,8 +691,8 @@ export class ModelCatalogCache {
 }
 /** Whether discovery failed because the stored login is gone. */
 export function isMissingOrInvalidCredential(error) {
-    return error instanceof LlmError
-        && (error.code === 'MISSING_CREDENTIAL' || error.code === 'INVALID_CREDENTIAL');
+    return (error instanceof LlmError &&
+        (error.code === 'MISSING_CREDENTIAL' || error.code === 'INVALID_CREDENTIAL'));
 }
 /** Whether discovery stopped because the caller cancelled or the timeout fired. */
 export function isDiscoveryAborted(error, signal) {
@@ -621,9 +700,9 @@ export function isDiscoveryAborted(error, signal) {
         return true;
     // Only treat abort-shaped errors as cancellation when this call had a signal;
     // a refresh TimeoutError must not fail the whole picker union.
-    return signal !== undefined
-        && error instanceof Error
-        && (error.name === 'AbortError' || error.name === 'TimeoutError');
+    return (signal !== undefined &&
+        error instanceof Error &&
+        (error.name === 'AbortError' || error.name === 'TimeoutError'));
 }
 /**
  * Whether discovery failed because the access token was rejected. After
@@ -632,8 +711,8 @@ export function isDiscoveryAborted(error, signal) {
  * the refresh grant still answers, so the store keeps the session.
  */
 export function isDiscoveryAuthFailure(error) {
-    return (error instanceof OAuthEndpointError && error.status === 401)
-        || (error instanceof LlmError && error.code === 'AUTH');
+    return ((error instanceof OAuthEndpointError && error.status === 401) ||
+        (error instanceof LlmError && error.code === 'AUTH'));
 }
 /**
  * Run a catalog fetch, retrying once after a forced token refresh when the
@@ -653,7 +732,8 @@ export async function discoverOrRetryAuth(session, catalog, run) {
             return await run();
         }
         catch (retryError) {
-            if (!isMissingOrInvalidCredential(retryError) && isDiscoveryAuthFailure(retryError)) {
+            if (!isMissingOrInvalidCredential(retryError) &&
+                isDiscoveryAuthFailure(retryError)) {
                 catalog.invalidate();
             }
             throw retryError;