iobroker.ai-usage 0.2.0 → 0.3.0

package/build/lib/providers/gemini-auth.js

@@ -0,0 +1,135 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var gemini_auth_exports = {};
+__export(gemini_auth_exports, {
+  GEMINI_OAUTH: () => GEMINI_OAUTH,
+  buildGeminiAuthorizeUrl: () => buildGeminiAuthorizeUrl,
+  exchangeGeminiCode: () => exchangeGeminiCode,
+  extractGeminiCode: () => extractGeminiCode,
+  generateGeminiPkce: () => generateGeminiPkce,
+  refreshGeminiTokens: () => refreshGeminiTokens
+});
+module.exports = __toCommonJS(gemini_auth_exports);
+var import_node_crypto = require("node:crypto");
+var import_provider = require("../provider");
+const GEMINI_OAUTH = {
+  clientId: "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com",
+  clientSecret: "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",
+  authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+  tokenUrl: "https://oauth2.googleapis.com/token",
+  redirectUri: "http://localhost:51121/oauth-callback",
+  scopes: [
+    "https://www.googleapis.com/auth/cloud-platform",
+    "https://www.googleapis.com/auth/userinfo.email",
+    "https://www.googleapis.com/auth/userinfo.profile",
+    "https://www.googleapis.com/auth/cclog",
+    "https://www.googleapis.com/auth/experimentsandconfigs"
+  ],
+  fallbackLifetimeMs: 60 * 6e4
+};
+function generateGeminiPkce() {
+  const verifier = (0, import_node_crypto.randomBytes)(32).toString("base64url");
+  return {
+    verifier,
+    challenge: (0, import_node_crypto.createHash)("sha256").update(verifier).digest("base64url"),
+    state: (0, import_node_crypto.randomBytes)(16).toString("hex")
+  };
+}
+function buildGeminiAuthorizeUrl(pkce) {
+  const params = new URLSearchParams({
+    client_id: GEMINI_OAUTH.clientId,
+    redirect_uri: GEMINI_OAUTH.redirectUri,
+    response_type: "code",
+    scope: GEMINI_OAUTH.scopes.join(" "),
+    code_challenge: pkce.challenge,
+    code_challenge_method: "S256",
+    state: pkce.state,
+    access_type: "offline",
+    prompt: "consent"
+  });
+  return `${GEMINI_OAUTH.authorizeUrl}?${params.toString()}`;
+}
+function extractGeminiCode(pasted, expectedState) {
+  const trimmed = pasted.trim();
+  if (!trimmed) {
+    throw new import_provider.FetchError("auth", "nothing pasted");
+  }
+  if (!trimmed.includes("?") && !trimmed.includes("&")) {
+    return trimmed;
+  }
+  const query = trimmed.slice(trimmed.indexOf("?") + 1);
+  const params = new URLSearchParams(query);
+  const error = params.get("error");
+  if (error) {
+    throw new import_provider.FetchError("auth", `Google reported "${error}"`);
+  }
+  const code = params.get("code");
+  if (!code) {
+    throw new import_provider.FetchError("auth", "the pasted address carries no code");
+  }
+  const state = params.get("state");
+  if (state && state !== expectedState) {
+    throw new import_provider.FetchError("auth", "the pasted address belongs to a different sign-in attempt");
+  }
+  return code;
+}
+async function exchangeGeminiCode(code, pkce, post, now) {
+  const body = await post(GEMINI_OAUTH.tokenUrl, {
+    grant_type: "authorization_code",
+    client_id: GEMINI_OAUTH.clientId,
+    client_secret: GEMINI_OAUTH.clientSecret,
+    code,
+    code_verifier: pkce.verifier,
+    redirect_uri: GEMINI_OAUTH.redirectUri
+  });
+  return toTokenSet(body, now, "");
+}
+async function refreshGeminiTokens(tokens, post, now) {
+  const body = await post(GEMINI_OAUTH.tokenUrl, {
+    grant_type: "refresh_token",
+    client_id: GEMINI_OAUTH.clientId,
+    client_secret: GEMINI_OAUTH.clientSecret,
+    refresh_token: tokens.refreshToken
+  });
+  return toTokenSet(body, now, tokens.refreshToken, tokens.accountRef);
+}
+function toTokenSet(body, now, previousRefresh, previousAccount) {
+  const raw = typeof body === "object" && body !== null ? body : {};
+  const accessToken = typeof raw.access_token === "string" ? raw.access_token : "";
+  if (!accessToken) {
+    throw new import_provider.FetchError("auth", "no access token in the answer");
+  }
+  const lifetime = Number(raw.expires_in);
+  return {
+    accessToken,
+    refreshToken: typeof raw.refresh_token === "string" && raw.refresh_token ? raw.refresh_token : previousRefresh,
+    expiresAt: now + (Number.isFinite(lifetime) && lifetime > 0 ? lifetime * 1e3 : GEMINI_OAUTH.fallbackLifetimeMs),
+    accountRef: previousAccount
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GEMINI_OAUTH,
+  buildGeminiAuthorizeUrl,
+  exchangeGeminiCode,
+  extractGeminiCode,
+  generateGeminiPkce,
+  refreshGeminiTokens
+});
+//# sourceMappingURL=gemini-auth.js.map

package/build/lib/providers/gemini-auth.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/providers/gemini-auth.ts"],
+  "sourcesContent": ["import { createHash, randomBytes } from \"node:crypto\";\nimport { FetchError, type TokenSet } from \"../provider\";\nimport type { FormPost } from \"./chatgpt-auth\";\n\n/**\n * Constants of the Google sign-in that actually works for consumer subscriptions.\n *\n * The Gemini-CLI client is switched off for individuals (\"no longer supported for\n * Gemini Code Assist for individuals\"), so the Antigravity client is the only one\n * left. Its secret is public in the open source of an installed application \u2014 that\n * is normal for this OAuth flow and not a leak.\n *\n * MEASURED 2026-08-26 against Google (with a control probe, so the test proves\n * something): the device-code flow answers `invalid_client` for BOTH clients, and\n * the paste-code page `codeassist.google.com/authcode` is rejected exactly like an\n * unregistered address. Only the loopback redirect is accepted \u2014 which is why the\n * user has to copy the address of the browser error page back into the admin.\n */\nexport const GEMINI_OAUTH = {\n  clientId: \"1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com\",\n  clientSecret: \"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\",\n  authorizeUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n  tokenUrl: \"https://oauth2.googleapis.com/token\",\n  redirectUri: \"http://localhost:51121/oauth-callback\",\n  scopes: [\n    \"https://www.googleapis.com/auth/cloud-platform\",\n    \"https://www.googleapis.com/auth/userinfo.email\",\n    \"https://www.googleapis.com/auth/userinfo.profile\",\n    \"https://www.googleapis.com/auth/cclog\",\n    \"https://www.googleapis.com/auth/experimentsandconfigs\",\n  ],\n  fallbackLifetimeMs: 60 * 60_000,\n} as const;\n\n/** The one-time secrets of a running sign-in \u2014 kept in memory only. */\nexport interface GeminiPkce {\n  /** The secret half, sent only when redeeming the code. */\n  verifier: string;\n  /** The public half, sent in the sign-in link. */\n  challenge: string;\n  /** Ties the pasted answer to this attempt (cross-site check). */\n  state: string;\n}\n\n/**\n * Create the PKCE pair and the state for one sign-in attempt.\n *\n * @returns the pair\n */\nexport function generateGeminiPkce(): GeminiPkce {\n  const verifier = randomBytes(32).toString(\"base64url\");\n  return {\n    verifier,\n    challenge: createHash(\"sha256\").update(verifier).digest(\"base64url\"),\n    state: randomBytes(16).toString(\"hex\"),\n  };\n}\n\n/**\n * Build the sign-in link the user opens in a browser.\n *\n * @param pkce the attempt's secrets\n * @returns the authorize URL\n */\nexport function buildGeminiAuthorizeUrl(pkce: GeminiPkce): string {\n  const params = new URLSearchParams({\n    client_id: GEMINI_OAUTH.clientId,\n    redirect_uri: GEMINI_OAUTH.redirectUri,\n    response_type: \"code\",\n    scope: GEMINI_OAUTH.scopes.join(\" \"),\n    code_challenge: pkce.challenge,\n    code_challenge_method: \"S256\",\n    state: pkce.state,\n    access_type: \"offline\",\n    prompt: \"consent\",\n  });\n  return `${GEMINI_OAUTH.authorizeUrl}?${params.toString()}`;\n}\n\n/**\n * Pull code and state out of whatever the user pasted back.\n *\n * Google redirects to a local address where nothing listens, so the browser shows\n * an error page \u2014 the ADDRESS still carries the result. Users paste the whole\n * address; some paste only the code. Both are accepted, but a wrong state is not:\n * that is the cross-site check.\n *\n * @param pasted the pasted address or bare code\n * @param expectedState the state of the running attempt\n * @returns the authorization code\n */\nexport function extractGeminiCode(pasted: string, expectedState: string): string {\n  const trimmed = pasted.trim();\n  if (!trimmed) {\n    throw new FetchError(\"auth\", \"nothing pasted\");\n  }\n  if (!trimmed.includes(\"?\") && !trimmed.includes(\"&\")) {\n    return trimmed;\n  }\n  const query = trimmed.slice(trimmed.indexOf(\"?\") + 1);\n  const params = new URLSearchParams(query);\n  const error = params.get(\"error\");\n  if (error) {\n    throw new FetchError(\"auth\", `Google reported \"${error}\"`);\n  }\n  const code = params.get(\"code\");\n  if (!code) {\n    throw new FetchError(\"auth\", \"the pasted address carries no code\");\n  }\n  const state = params.get(\"state\");\n  if (state && state !== expectedState) {\n    throw new FetchError(\"auth\", \"the pasted address belongs to a different sign-in attempt\");\n  }\n  return code;\n}\n\n/**\n * Redeem the code for tokens.\n *\n * @param code the authorization code\n * @param pkce the attempt's secrets\n * @param post the form POST seam\n * @param now current time in ms\n * @returns the token set\n */\nexport async function exchangeGeminiCode(\n  code: string,\n  pkce: GeminiPkce,\n  post: FormPost,\n  now: number,\n): Promise<TokenSet> {\n  const body = await post(GEMINI_OAUTH.tokenUrl, {\n    grant_type: \"authorization_code\",\n    client_id: GEMINI_OAUTH.clientId,\n    client_secret: GEMINI_OAUTH.clientSecret,\n    code,\n    code_verifier: pkce.verifier,\n    redirect_uri: GEMINI_OAUTH.redirectUri,\n  });\n  return toTokenSet(body, now, \"\");\n}\n\n/**\n * Get a fresh access token; Google often omits a new refresh token, then the old stays.\n *\n * @param tokens the current tokens\n * @param post the form POST seam\n * @param now current time in ms\n * @returns the refreshed token set\n */\nexport async function refreshGeminiTokens(tokens: TokenSet, post: FormPost, now: number): Promise<TokenSet> {\n  const body = await post(GEMINI_OAUTH.tokenUrl, {\n    grant_type: \"refresh_token\",\n    client_id: GEMINI_OAUTH.clientId,\n    client_secret: GEMINI_OAUTH.clientSecret,\n    refresh_token: tokens.refreshToken,\n  });\n  return toTokenSet(body, now, tokens.refreshToken, tokens.accountRef);\n}\n\n/**\n * Build a token set from a Google token answer.\n *\n * @param body the parsed answer\n * @param now current time in ms\n * @param previousRefresh refresh token to keep when the answer omits one\n * @param previousAccount project id to keep\n * @returns the token set\n */\nfunction toTokenSet(body: unknown, now: number, previousRefresh: string, previousAccount?: string): TokenSet {\n  const raw = (typeof body === \"object\" && body !== null ? body : {}) as Record<string, unknown>;\n  const accessToken = typeof raw.access_token === \"string\" ? raw.access_token : \"\";\n  if (!accessToken) {\n    throw new FetchError(\"auth\", \"no access token in the answer\");\n  }\n  const lifetime = Number(raw.expires_in);\n  return {\n    accessToken,\n    refreshToken: typeof raw.refresh_token === \"string\" && raw.refresh_token ? raw.refresh_token : previousRefresh,\n    expiresAt: now + (Number.isFinite(lifetime) && lifetime > 0 ? lifetime * 1000 : GEMINI_OAUTH.fallbackLifetimeMs),\n    accountRef: previousAccount,\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAwC;AACxC,sBAA0C;AAiBnC,MAAM,eAAe;AAAA,EAC1B,UAAU;AAAA,EACV,cAAc;AAAA,EACd,cAAc;AAAA,EACd,UAAU;AAAA,EACV,aAAa;AAAA,EACb,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,oBAAoB,KAAK;AAC3B;AAiBO,SAAS,qBAAiC;AAC/C,QAAM,eAAW,gCAAY,EAAE,EAAE,SAAS,WAAW;AACrD,SAAO;AAAA,IACL;AAAA,IACA,eAAW,+BAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,WAAW;AAAA,IACnE,WAAO,gCAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACvC;AACF;AAQO,SAAS,wBAAwB,MAA0B;AAChE,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,WAAW,aAAa;AAAA,IACxB,cAAc,aAAa;AAAA,IAC3B,eAAe;AAAA,IACf,OAAO,aAAa,OAAO,KAAK,GAAG;AAAA,IACnC,gBAAgB,KAAK;AAAA,IACrB,uBAAuB;AAAA,IACvB,OAAO,KAAK;AAAA,IACZ,aAAa;AAAA,IACb,QAAQ;AAAA,EACV,CAAC;AACD,SAAO,GAAG,aAAa,YAAY,IAAI,OAAO,SAAS,CAAC;AAC1D;AAcO,SAAS,kBAAkB,QAAgB,eAA+B;AAC/E,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,2BAAW,QAAQ,gBAAgB;AAAA,EAC/C;AACA,MAAI,CAAC,QAAQ,SAAS,GAAG,KAAK,CAAC,QAAQ,SAAS,GAAG,GAAG;AACpD,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,QAAQ,MAAM,QAAQ,QAAQ,GAAG,IAAI,CAAC;AACpD,QAAM,SAAS,IAAI,gBAAgB,KAAK;AACxC,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,OAAO;AACT,UAAM,IAAI,2BAAW,QAAQ,oBAAoB,KAAK,GAAG;AAAA,EAC3D;AACA,QAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,2BAAW,QAAQ,oCAAoC;AAAA,EACnE;AACA,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,MAAI,SAAS,UAAU,eAAe;AACpC,UAAM,IAAI,2BAAW,QAAQ,2DAA2D;AAAA,EAC1F;AACA,SAAO;AACT;AAWA,eAAsB,mBACpB,MACA,MACA,MACA,KACmB;AACnB,QAAM,OAAO,MAAM,KAAK,aAAa,UAAU;AAAA,IAC7C,YAAY;AAAA,IACZ,WAAW,aAAa;AAAA,IACxB,eAAe,aAAa;AAAA,IAC5B;AAAA,IACA,eAAe,KAAK;AAAA,IACpB,cAAc,aAAa;AAAA,EAC7B,CAAC;AACD,SAAO,WAAW,MAAM,KAAK,EAAE;AACjC;AAUA,eAAsB,oBAAoB,QAAkB,MAAgB,KAAgC;AAC1G,QAAM,OAAO,MAAM,KAAK,aAAa,UAAU;AAAA,IAC7C,YAAY;AAAA,IACZ,WAAW,aAAa;AAAA,IACxB,eAAe,aAAa;AAAA,IAC5B,eAAe,OAAO;AAAA,EACxB,CAAC;AACD,SAAO,WAAW,MAAM,KAAK,OAAO,cAAc,OAAO,UAAU;AACrE;AAWA,SAAS,WAAW,MAAe,KAAa,iBAAyB,iBAAoC;AAC3G,QAAM,MAAO,OAAO,SAAS,YAAY,SAAS,OAAO,OAAO,CAAC;AACjE,QAAM,cAAc,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAC9E,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,2BAAW,QAAQ,+BAA+B;AAAA,EAC9D;AACA,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL;AAAA,IACA,cAAc,OAAO,IAAI,kBAAkB,YAAY,IAAI,gBAAgB,IAAI,gBAAgB;AAAA,IAC/F,WAAW,OAAO,OAAO,SAAS,QAAQ,KAAK,WAAW,IAAI,WAAW,MAAO,aAAa;AAAA,IAC7F,YAAY;AAAA,EACd;AACF;",
+  "names": []
+}

package/build/lib/providers/gemini-sub.js

@@ -0,0 +1,147 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var gemini_sub_exports = {};
+__export(gemini_sub_exports, {
+  GEMINI_HOSTS: () => GEMINI_HOSTS,
+  GEMINI_IDENTITY: () => GEMINI_IDENTITY,
+  geminiSubProvider: () => geminiSubProvider,
+  parseCodeAssist: () => parseCodeAssist,
+  parseGeminiQuota: () => parseGeminiQuota
+});
+module.exports = __toCommonJS(gemini_sub_exports);
+var import_provider = require("../provider");
+var import_gemini_auth = require("./gemini-auth");
+var import_pure_helpers = require("../pure-helpers");
+const GEMINI_HOSTS = [
+  "https://daily-cloudcode-pa.googleapis.com/v1internal",
+  "https://cloudcode-pa.googleapis.com/v1internal"
+];
+const GEMINI_IDENTITY = {
+  ideType: "ANTIGRAVITY",
+  userAgent: "antigravity/1.11.3"
+};
+async function callCodeAssist(method, body, accessToken, post) {
+  const headers = {
+    Authorization: `Bearer ${accessToken}`,
+    "User-Agent": GEMINI_IDENTITY.userAgent
+  };
+  let lastError;
+  for (const host of GEMINI_HOSTS) {
+    try {
+      return await post(`${host}:${method}`, body, headers);
+    } catch (e) {
+      if (e instanceof import_provider.FetchError && e.kind === "auth") {
+        throw e;
+      }
+      lastError = e;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new import_provider.FetchError("network", "no Code-Assist host answered");
+}
+function parseCodeAssist(body) {
+  var _a, _b;
+  const raw = typeof body === "object" && body !== null ? body : {};
+  const project = typeof raw.cloudaicompanionProject === "string" ? raw.cloudaicompanionProject : "";
+  const paid = (_a = raw.paidTier) != null ? _a : {};
+  const current = (_b = raw.currentTier) != null ? _b : {};
+  const tier = typeof paid.name === "string" && paid.name || typeof current.name === "string" && current.name || typeof paid.id === "string" && paid.id || typeof current.id === "string" && current.id || "";
+  return { project, tier };
+}
+function parseGeminiQuota(body) {
+  if (typeof body !== "object" || body === null) {
+    throw new import_provider.FetchError("network", "unexpected quota response");
+  }
+  const raw = body;
+  const buckets = Array.isArray(raw.buckets) ? raw.buckets : [];
+  const limits = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of buckets) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
+    }
+    const bucket = entry;
+    const fraction = Number(bucket.remainingFraction);
+    if (!Number.isFinite(fraction)) {
+      continue;
+    }
+    const model = typeof bucket.modelId === "string" ? bucket.modelId : "";
+    const kind = typeof bucket.tokenType === "string" ? bucket.tokenType.toLowerCase() : "";
+    const name = (0, import_pure_helpers.sanitizeId)(model || kind || "quota");
+    if (!name || seen.has(name)) {
+      continue;
+    }
+    seen.add(name);
+    const window = {
+      name,
+      label: model || kind || "Quota",
+      percent: Math.round((1 - Math.min(Math.max(fraction, 0), 1)) * 1e3) / 10
+    };
+    if (typeof bucket.resetTime === "string" && bucket.resetTime) {
+      window.resetAt = bucket.resetTime;
+    }
+    limits.push(window);
+  }
+  return limits.length ? { limits } : {};
+}
+function geminiSubProvider(store, post, postForm, now = Date.now) {
+  let cached = null;
+  return {
+    kind: "gemini-sub",
+    fetch: async () => {
+      cached != null ? cached : cached = await store.load();
+      if (!cached) {
+        throw new import_provider.FetchError("auth", "not signed in \u2014 start the Google sign-in in the instance settings");
+      }
+      if (now() >= cached.expiresAt - 6e4) {
+        cached = await (0, import_gemini_auth.refreshGeminiTokens)(cached, postForm, now());
+        await store.save(cached);
+      }
+      if (!cached.accountRef) {
+        const info = parseCodeAssist(
+          await callCodeAssist(
+            "loadCodeAssist",
+            { metadata: { ideType: GEMINI_IDENTITY.ideType } },
+            cached.accessToken,
+            post
+          )
+        );
+        if (!info.project) {
+          throw new import_provider.FetchError(
+            "auth",
+            "Google returned no project for this account \u2014 a Google AI subscription (Pro/Ultra) is required"
+          );
+        }
+        cached = { ...cached, accountRef: info.project };
+        await store.save(cached);
+      }
+      return parseGeminiQuota(
+        await callCodeAssist("retrieveUserQuota", { project: cached.accountRef }, cached.accessToken, post)
+      );
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GEMINI_HOSTS,
+  GEMINI_IDENTITY,
+  geminiSubProvider,
+  parseCodeAssist,
+  parseGeminiQuota
+});
+//# sourceMappingURL=gemini-sub.js.map

package/build/lib/providers/gemini-sub.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/providers/gemini-sub.ts"],
+  "sourcesContent": ["import {\n  FetchError,\n  type LimitWindow,\n  type TokenSet,\n  type TokenStore,\n  type UsageProvider,\n  type UsageSnapshot,\n} from \"../provider\";\nimport type { FormPost } from \"./chatgpt-auth\";\nimport { refreshGeminiTokens } from \"./gemini-auth\";\nimport { sanitizeId } from \"../pure-helpers\";\n\n/**\n * Google's internal Code-Assist endpoints. The `daily-` host is tried first:\n * two independent measurements report 429 on the plain host and 200 on `daily-`,\n * so the plain one stays as a fallback rather than as the default.\n */\nexport const GEMINI_HOSTS = [\n  \"https://daily-cloudcode-pa.googleapis.com/v1internal\",\n  \"https://cloudcode-pa.googleapis.com/v1internal\",\n] as const;\n\n/**\n * The identity that decides WHICH quota buckets Google returns. Sending the\n * Gemini-CLI identity to a paid account yields the retired free-tier set, where\n * every bucket sits at 100 % forever \u2014 a counter that never moves is worse than\n * an error, so both calls must carry this one identity.\n */\nexport const GEMINI_IDENTITY = {\n  ideType: \"ANTIGRAVITY\",\n  userAgent: \"antigravity/1.11.3\",\n} as const;\n\n/** A JSON POST seam that also reports which host answered. */\nexport type GeminiPost = (\n  url: string,\n  body: Record<string, unknown>,\n  headers?: Record<string, string>,\n) => Promise<unknown>;\n\n/**\n * Call a Code-Assist method, falling back to the second host on failure.\n *\n * @param method the method name (loadCodeAssist, retrieveUserQuota)\n * @param body the request body\n * @param accessToken the bearer token\n * @param post the POST seam\n * @returns the parsed answer\n */\nasync function callCodeAssist(\n  method: string,\n  body: Record<string, unknown>,\n  accessToken: string,\n  post: GeminiPost,\n): Promise<unknown> {\n  const headers = {\n    Authorization: `Bearer ${accessToken}`,\n    \"User-Agent\": GEMINI_IDENTITY.userAgent,\n  };\n  let lastError: unknown;\n  for (const host of GEMINI_HOSTS) {\n    try {\n      return await post(`${host}:${method}`, body, headers);\n    } catch (e) {\n      // An auth failure is the same on every host \u2014 only retry transport trouble.\n      if (e instanceof FetchError && e.kind === \"auth\") {\n        throw e;\n      }\n      lastError = e;\n    }\n  }\n  throw lastError instanceof Error ? lastError : new FetchError(\"network\", \"no Code-Assist host answered\");\n}\n\n/**\n * Read the project id and the tier out of a `loadCodeAssist` answer.\n *\n * @param body the parsed answer\n * @returns project id and tier label\n */\nexport function parseCodeAssist(body: unknown): { project: string; tier: string } {\n  const raw = (typeof body === \"object\" && body !== null ? body : {}) as Record<string, unknown>;\n  const project = typeof raw.cloudaicompanionProject === \"string\" ? raw.cloudaicompanionProject : \"\";\n  const paid = (raw.paidTier ?? {}) as Record<string, unknown>;\n  const current = (raw.currentTier ?? {}) as Record<string, unknown>;\n  const tier =\n    (typeof paid.name === \"string\" && paid.name) ||\n    (typeof current.name === \"string\" && current.name) ||\n    (typeof paid.id === \"string\" && paid.id) ||\n    (typeof current.id === \"string\" && current.id) ||\n    \"\";\n  return { project, tier };\n}\n\n/**\n * Turn a `retrieveUserQuota` answer into limit windows.\n *\n * Google reports what is LEFT (`remainingFraction` 0\u20261); the tree shows utilisation,\n * so it is inverted here. A bucket without a usable fraction is skipped rather than\n * guessed \u2014 an invented 0 % would read as \"nothing used yet\".\n *\n * @param body the parsed answer\n * @returns the snapshot\n */\nexport function parseGeminiQuota(body: unknown): UsageSnapshot {\n  if (typeof body !== \"object\" || body === null) {\n    throw new FetchError(\"network\", \"unexpected quota response\");\n  }\n  const raw = body as Record<string, unknown>;\n  const buckets = Array.isArray(raw.buckets) ? raw.buckets : [];\n  const limits: LimitWindow[] = [];\n  const seen = new Set<string>();\n  for (const entry of buckets) {\n    if (typeof entry !== \"object\" || entry === null) {\n      continue;\n    }\n    const bucket = entry as Record<string, unknown>;\n    const fraction = Number(bucket.remainingFraction);\n    if (!Number.isFinite(fraction)) {\n      continue;\n    }\n    const model = typeof bucket.modelId === \"string\" ? bucket.modelId : \"\";\n    const kind = typeof bucket.tokenType === \"string\" ? bucket.tokenType.toLowerCase() : \"\";\n    const name = sanitizeId(model || kind || \"quota\");\n    if (!name || seen.has(name)) {\n      continue;\n    }\n    seen.add(name);\n    const window: LimitWindow = {\n      name,\n      label: model || kind || \"Quota\",\n      percent: Math.round((1 - Math.min(Math.max(fraction, 0), 1)) * 1000) / 10,\n    };\n    if (typeof bucket.resetTime === \"string\" && bucket.resetTime) {\n      window.resetAt = bucket.resetTime;\n    }\n    limits.push(window);\n  }\n  return limits.length ? { limits } : {};\n}\n\n/**\n * The Google/Gemini subscription provider.\n *\n * @param store where the tokens live\n * @param post the JSON POST seam\n * @param postForm the form POST seam (token refresh)\n * @param now clock (ms)\n * @returns the provider\n */\nexport function geminiSubProvider(\n  store: TokenStore,\n  post: GeminiPost,\n  postForm: FormPost,\n  now: () => number = Date.now,\n): UsageProvider {\n  let cached: TokenSet | null = null;\n  return {\n    kind: \"gemini-sub\",\n    fetch: async (): Promise<UsageSnapshot> => {\n      cached ??= await store.load();\n      if (!cached) {\n        throw new FetchError(\"auth\", \"not signed in \u2014 start the Google sign-in in the instance settings\");\n      }\n      if (now() >= cached.expiresAt - 60_000) {\n        cached = await refreshGeminiTokens(cached, postForm, now());\n        await store.save(cached);\n      }\n      // The project id is stable per account \u2014 look it up once, then reuse it.\n      if (!cached.accountRef) {\n        const info = parseCodeAssist(\n          await callCodeAssist(\n            \"loadCodeAssist\",\n            { metadata: { ideType: GEMINI_IDENTITY.ideType } },\n            cached.accessToken,\n            post,\n          ),\n        );\n        if (!info.project) {\n          throw new FetchError(\n            \"auth\",\n            \"Google returned no project for this account \u2014 a Google AI subscription (Pro/Ultra) is required\",\n          );\n        }\n        cached = { ...cached, accountRef: info.project };\n        await store.save(cached);\n      }\n      return parseGeminiQuota(\n        await callCodeAssist(\"retrieveUserQuota\", { project: cached.accountRef }, cached.accessToken, post),\n      );\n    },\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAOO;AAEP,yBAAoC;AACpC,0BAA2B;AAOpB,MAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AACF;AAQO,MAAM,kBAAkB;AAAA,EAC7B,SAAS;AAAA,EACT,WAAW;AACb;AAkBA,eAAe,eACb,QACA,MACA,aACA,MACkB;AAClB,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,WAAW;AAAA,IACpC,cAAc,gBAAgB;AAAA,EAChC;AACA,MAAI;AACJ,aAAW,QAAQ,cAAc;AAC/B,QAAI;AACF,aAAO,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,IAAI,MAAM,OAAO;AAAA,IACtD,SAAS,GAAG;AAEV,UAAI,aAAa,8BAAc,EAAE,SAAS,QAAQ;AAChD,cAAM;AAAA,MACR;AACA,kBAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,qBAAqB,QAAQ,YAAY,IAAI,2BAAW,WAAW,8BAA8B;AACzG;AAQO,SAAS,gBAAgB,MAAkD;AAhFlF;AAiFE,QAAM,MAAO,OAAO,SAAS,YAAY,SAAS,OAAO,OAAO,CAAC;AACjE,QAAM,UAAU,OAAO,IAAI,4BAA4B,WAAW,IAAI,0BAA0B;AAChG,QAAM,QAAQ,SAAI,aAAJ,YAAgB,CAAC;AAC/B,QAAM,WAAW,SAAI,gBAAJ,YAAmB,CAAC;AACrC,QAAM,OACH,OAAO,KAAK,SAAS,YAAY,KAAK,QACtC,OAAO,QAAQ,SAAS,YAAY,QAAQ,QAC5C,OAAO,KAAK,OAAO,YAAY,KAAK,MACpC,OAAO,QAAQ,OAAO,YAAY,QAAQ,MAC3C;AACF,SAAO,EAAE,SAAS,KAAK;AACzB;AAYO,SAAS,iBAAiB,MAA8B;AAC7D,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,UAAM,IAAI,2BAAW,WAAW,2BAA2B;AAAA,EAC7D;AACA,QAAM,MAAM;AACZ,QAAM,UAAU,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,UAAU,CAAC;AAC5D,QAAM,SAAwB,CAAC;AAC/B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C;AAAA,IACF;AACA,UAAM,SAAS;AACf,UAAM,WAAW,OAAO,OAAO,iBAAiB;AAChD,QAAI,CAAC,OAAO,SAAS,QAAQ,GAAG;AAC9B;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;AACpE,UAAM,OAAO,OAAO,OAAO,cAAc,WAAW,OAAO,UAAU,YAAY,IAAI;AACrF,UAAM,WAAO,gCAAW,SAAS,QAAQ,OAAO;AAChD,QAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG;AAC3B;AAAA,IACF;AACA,SAAK,IAAI,IAAI;AACb,UAAM,SAAsB;AAAA,MAC1B;AAAA,MACA,OAAO,SAAS,QAAQ;AAAA,MACxB,SAAS,KAAK,OAAO,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,GAAI,IAAI;AAAA,IACzE;AACA,QAAI,OAAO,OAAO,cAAc,YAAY,OAAO,WAAW;AAC5D,aAAO,UAAU,OAAO;AAAA,IAC1B;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AACA,SAAO,OAAO,SAAS,EAAE,OAAO,IAAI,CAAC;AACvC;AAWO,SAAS,kBACd,OACA,MACA,UACA,MAAoB,KAAK,KACV;AACf,MAAI,SAA0B;AAC9B,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO,YAAoC;AACzC,yCAAW,MAAM,MAAM,KAAK;AAC5B,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,2BAAW,QAAQ,wEAAmE;AAAA,MAClG;AACA,UAAI,IAAI,KAAK,OAAO,YAAY,KAAQ;AACtC,iBAAS,UAAM,wCAAoB,QAAQ,UAAU,IAAI,CAAC;AAC1D,cAAM,MAAM,KAAK,MAAM;AAAA,MACzB;AAEA,UAAI,CAAC,OAAO,YAAY;AACtB,cAAM,OAAO;AAAA,UACX,MAAM;AAAA,YACJ;AAAA,YACA,EAAE,UAAU,EAAE,SAAS,gBAAgB,QAAQ,EAAE;AAAA,YACjD,OAAO;AAAA,YACP;AAAA,UACF;AAAA,QACF;AACA,YAAI,CAAC,KAAK,SAAS;AACjB,gBAAM,IAAI;AAAA,YACR;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,iBAAS,EAAE,GAAG,QAAQ,YAAY,KAAK,QAAQ;AAC/C,cAAM,MAAM,KAAK,MAAM;AAAA,MACzB;AACA,aAAO;AAAA,QACL,MAAM,eAAe,qBAAqB,EAAE,SAAS,OAAO,WAAW,GAAG,OAAO,aAAa,IAAI;AAAA,MACpG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/build/lib/pure-helpers.js

@@ -20,6 +20,9 @@ var pure_helpers_exports = {};
 __export(pure_helpers_exports, {
   PROVIDER_KINDS: () => PROVIDER_KINDS,
   RESERVED_ROOT_IDS: () => RESERVED_ROOT_IDS,
+  SUBSCRIPTION_IDS: () => SUBSCRIPTION_IDS,
+  SUBSCRIPTION_KINDS: () => SUBSCRIPTION_KINDS,
+  accountId: () => accountId,
   clampPollInterval: () => clampPollInterval,
   parseAccounts: () => parseAccounts,
   sanitizeId: () => sanitizeId,
@@ -29,8 +32,30 @@ module.exports = __toCommonJS(pure_helpers_exports);
 function sanitizeId(name) {
   return name.trim().replace(/[^a-zA-Z0-9_-]/g, "_").replace(/_{2,}/g, "_").replace(/^_+|_+$/g, "");
 }
-const PROVIDER_KINDS = ["claude-sub", "openrouter", "deepseek", "openai", "anthropic-api"];
-const RESERVED_ROOT_IDS = ["info", "total", "auth"];
+const PROVIDER_KINDS = [
+  "claude-sub",
+  "chatgpt-sub",
+  "gemini-sub",
+  "openrouter",
+  "deepseek",
+  "openai",
+  "anthropic-api"
+];
+const SUBSCRIPTION_KINDS = ["claude-sub", "chatgpt-sub", "gemini-sub"];
+const SUBSCRIPTION_IDS = {
+  "claude-sub": "claude",
+  "chatgpt-sub": "chatgpt",
+  "gemini-sub": "gemini"
+};
+const RESERVED_ROOT_IDS = ["info", "total"];
+function accountId(provider, credentialId) {
+  const fixed = SUBSCRIPTION_IDS[provider];
+  if (fixed) {
+    return fixed;
+  }
+  const suffix = sanitizeId(credentialId.replace(/^system\.credentials\./, ""));
+  return suffix ? `${suffix}-api` : "";
+}
 function parseAccounts(raw) {
   if (!Array.isArray(raw)) {
     return [];
@@ -45,9 +70,10 @@ function parseAccounts(raw) {
     if (row.enabled === false) {
       continue;
     }
-    const name = typeof row.name === "string" ? row.name.trim() : "";
-    const id = sanitizeId(name);
     const provider = typeof row.provider === "string" ? row.provider : "";
+    const credentialId = typeof row.credentialId === "string" ? row.credentialId : "";
+    const id = accountId(provider, credentialId);
+    const name = (typeof row.name === "string" ? row.name.trim() : "") || id;
     if (!id || RESERVED_ROOT_IDS.includes(id) || !PROVIDER_KINDS.includes(provider) || seen.has(id)) {
       continue;
     }
@@ -57,7 +83,7 @@ function parseAccounts(raw) {
       name,
       id,
       provider,
-      credentialId: typeof row.credentialId === "string" ? row.credentialId : "",
+      credentialId,
       warnThreshold: Number.isFinite(threshold) && threshold >= 10 && threshold <= 100 ? threshold : 80
     });
   }
@@ -73,7 +99,10 @@ function validAccountIds(raw) {
       continue;
     }
     const row = entry;
-    const id = sanitizeId(typeof row.name === "string" ? row.name : "");
+    const id = accountId(
+      typeof row.provider === "string" ? row.provider : "",
+      typeof row.credentialId === "string" ? row.credentialId : ""
+    );
     if (id && !RESERVED_ROOT_IDS.includes(id) && !ids.includes(id)) {
       ids.push(id);
     }
@@ -91,6 +120,9 @@ function clampPollInterval(raw) {
 0 && (module.exports = {
   PROVIDER_KINDS,
   RESERVED_ROOT_IDS,
+  SUBSCRIPTION_IDS,
+  SUBSCRIPTION_KINDS,
+  accountId,
   clampPollInterval,
   parseAccounts,
   sanitizeId,

package/build/lib/pure-helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/pure-helpers.ts"],
-  "sourcesContent": ["/** One configured AI account, validated from the admin table (API boundary). */\nexport interface AccountConfig {\n  /** Display name from the table. */\n  name: string;\n  /** Id-safe object id derived from the name. */\n  id: string;\n  /** Provider kind. */\n  provider: string;\n  /** Central credential id (system.credentials.*); empty for claude-sub. */\n  credentialId: string;\n  /** Warn threshold in percent. */\n  warnThreshold: number;\n}\n\n/**\n * Make a string safe as an ioBroker object-id segment.\n *\n * @param name the raw name\n * @returns the sanitized id segment\n */\nexport function sanitizeId(name: string): string {\n  return name\n    .trim()\n    .replace(/[^a-zA-Z0-9_-]/g, \"_\")\n    .replace(/_{2,}/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\n/** The provider kinds the adapter knows. */\nexport const PROVIDER_KINDS = [\"claude-sub\", \"openrouter\", \"deepseek\", \"openai\", \"anthropic-api\"];\n\n/** Top-level object roots the adapter owns \u2014 no account may use them as id. */\nexport const RESERVED_ROOT_IDS = [\"info\", \"total\", \"auth\"];\n\n/**\n * Parse and validate the admin accounts table. Rows without a usable name or with an\n * unknown provider are skipped (type-guarded \u2014 the table is external input); disabled\n * rows are skipped too. Duplicate ids keep the first row.\n *\n * @param raw the native.accounts value\n * @returns the validated, enabled accounts\n */\nexport function parseAccounts(raw: unknown): AccountConfig[] {\n  if (!Array.isArray(raw)) {\n    return [];\n  }\n  const accounts: AccountConfig[] = [];\n  const seen = new Set<string>();\n  for (const entry of raw) {\n    if (typeof entry !== \"object\" || entry === null) {\n      continue;\n    }\n    const row = entry as Record<string, unknown>;\n    if (row.enabled === false) {\n      continue;\n    }\n    const name = typeof row.name === \"string\" ? row.name.trim() : \"\";\n    const id = sanitizeId(name);\n    const provider = typeof row.provider === \"string\" ? row.provider : \"\";\n    if (!id || RESERVED_ROOT_IDS.includes(id) || !PROVIDER_KINDS.includes(provider) || seen.has(id)) {\n      continue;\n    }\n    seen.add(id);\n    const threshold = Number(row.warnThreshold);\n    accounts.push({\n      name,\n      id,\n      provider,\n      credentialId: typeof row.credentialId === \"string\" ? row.credentialId : \"\",\n      warnThreshold: Number.isFinite(threshold) && threshold >= 10 && threshold <= 100 ? threshold : 80,\n    });\n  }\n  return accounts;\n}\n\n/**\n * The ids of ALL valid table rows \u2014 including disabled ones. Used by the stale-object\n * cleanup: a disabled account is paused, not deleted; only rows removed from the\n * table lose their tree.\n *\n * @param raw the native.accounts value\n * @returns the id-safe ids of every valid row\n */\nexport function validAccountIds(raw: unknown): string[] {\n  if (!Array.isArray(raw)) {\n    return [];\n  }\n  const ids: string[] = [];\n  for (const entry of raw) {\n    if (typeof entry !== \"object\" || entry === null) {\n      continue;\n    }\n    const row = entry as Record<string, unknown>;\n    const id = sanitizeId(typeof row.name === \"string\" ? row.name : \"\");\n    if (id && !RESERVED_ROOT_IDS.includes(id) && !ids.includes(id)) {\n      ids.push(id);\n    }\n  }\n  return ids;\n}\n\n/**\n * Clamp the poll interval to the safe range: minimum 60 s (provider throttling locks\n * whole accounts), default 300 s for anything unusable.\n *\n * @param raw the configured value\n * @returns the effective interval in seconds\n */\nexport function clampPollInterval(raw: unknown): number {\n  const value = Number(raw);\n  if (!Number.isFinite(value) || value <= 0) {\n    return 300;\n  }\n  return Math.min(3600, Math.max(60, Math.round(value)));\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBO,SAAS,WAAW,MAAsB;AAC/C,SAAO,KACJ,KAAK,EACL,QAAQ,mBAAmB,GAAG,EAC9B,QAAQ,UAAU,GAAG,EACrB,QAAQ,YAAY,EAAE;AAC3B;AAGO,MAAM,iBAAiB,CAAC,cAAc,cAAc,YAAY,UAAU,eAAe;AAGzF,MAAM,oBAAoB,CAAC,QAAQ,SAAS,MAAM;AAUlD,SAAS,cAAc,KAA+B;AAC3D,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,WAA4B,CAAC;AACnC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,KAAK;AACvB,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C;AAAA,IACF;AACA,UAAM,MAAM;AACZ,QAAI,IAAI,YAAY,OAAO;AACzB;AAAA,IACF;AACA,UAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,KAAK,IAAI;AAC9D,UAAM,KAAK,WAAW,IAAI;AAC1B,UAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AACnE,QAAI,CAAC,MAAM,kBAAkB,SAAS,EAAE,KAAK,CAAC,eAAe,SAAS,QAAQ,KAAK,KAAK,IAAI,EAAE,GAAG;AAC/F;AAAA,IACF;AACA,SAAK,IAAI,EAAE;AACX,UAAM,YAAY,OAAO,IAAI,aAAa;AAC1C,aAAS,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,MACxE,eAAe,OAAO,SAAS,SAAS,KAAK,aAAa,MAAM,aAAa,MAAM,YAAY;AAAA,IACjG,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAUO,SAAS,gBAAgB,KAAwB;AACtD,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,KAAK;AACvB,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C;AAAA,IACF;AACA,UAAM,MAAM;AACZ,UAAM,KAAK,WAAW,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,EAAE;AAClE,QAAI,MAAM,CAAC,kBAAkB,SAAS,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,GAAG;AAC9D,UAAI,KAAK,EAAE;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,kBAAkB,KAAsB;AACtD,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;AACvD;",
+  "sourcesContent": ["/** One configured AI account, validated from the admin table (API boundary). */\nexport interface AccountConfig {\n  /** Display name from the table. */\n  name: string;\n  /** Id-safe object id derived from the name. */\n  id: string;\n  /** Provider kind. */\n  provider: string;\n  /** Central credential id (system.credentials.*); empty for claude-sub. */\n  credentialId: string;\n  /** Warn threshold in percent. */\n  warnThreshold: number;\n}\n\n/**\n * Make a string safe as an ioBroker object-id segment.\n *\n * @param name the raw name\n * @returns the sanitized id segment\n */\nexport function sanitizeId(name: string): string {\n  return name\n    .trim()\n    .replace(/[^a-zA-Z0-9_-]/g, \"_\")\n    .replace(/_{2,}/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n}\n\n/** The provider kinds the adapter knows. */\nexport const PROVIDER_KINDS = [\n  \"claude-sub\",\n  \"chatgpt-sub\",\n  \"gemini-sub\",\n  \"openrouter\",\n  \"deepseek\",\n  \"openai\",\n  \"anthropic-api\",\n];\n\n/** The subscription kinds: signed in with the user's account, no key involved. */\nexport const SUBSCRIPTION_KINDS = [\"claude-sub\", \"chatgpt-sub\", \"gemini-sub\"];\n\n/** Fixed object id per subscription \u2014 adapter-owned, never derived from a display name. */\nexport const SUBSCRIPTION_IDS: Record<string, string> = {\n  \"claude-sub\": \"claude\",\n  \"chatgpt-sub\": \"chatgpt\",\n  \"gemini-sub\": \"gemini\",\n};\n\n/** Top-level object roots the adapter owns \u2014 no account may use them as id. */\nexport const RESERVED_ROOT_IDS = [\"info\", \"total\"];\n\n/**\n * The object id of one account. Deterministic and stable: a subscription always owns\n * its provider id, a key-based account always carries the \"-api\" suffix. Neither\n * depends on a display name, so an id never moves when the user renames something\n * or adds an unrelated credential later.\n *\n * @param provider the provider kind\n * @param credentialId the central credential id (key-based accounts)\n * @returns the id-safe object id, or \"\" when it cannot be formed\n */\nexport function accountId(provider: string, credentialId: string): string {\n  const fixed = SUBSCRIPTION_IDS[provider];\n  if (fixed) {\n    return fixed;\n  }\n  const suffix = sanitizeId(credentialId.replace(/^system\\.credentials\\./, \"\"));\n  return suffix ? `${suffix}-api` : \"\";\n}\n\n/**\n * Parse and validate the admin accounts table. Rows without a usable name or with an\n * unknown provider are skipped (type-guarded \u2014 the table is external input); disabled\n * rows are skipped too. Duplicate ids keep the first row.\n *\n * @param raw the native.accounts value\n * @returns the validated, enabled accounts\n */\nexport function parseAccounts(raw: unknown): AccountConfig[] {\n  if (!Array.isArray(raw)) {\n    return [];\n  }\n  const accounts: AccountConfig[] = [];\n  const seen = new Set<string>();\n  for (const entry of raw) {\n    if (typeof entry !== \"object\" || entry === null) {\n      continue;\n    }\n    const row = entry as Record<string, unknown>;\n    if (row.enabled === false) {\n      continue;\n    }\n    const provider = typeof row.provider === \"string\" ? row.provider : \"\";\n    const credentialId = typeof row.credentialId === \"string\" ? row.credentialId : \"\";\n    const id = accountId(provider, credentialId);\n    const name = (typeof row.name === \"string\" ? row.name.trim() : \"\") || id;\n    if (!id || RESERVED_ROOT_IDS.includes(id) || !PROVIDER_KINDS.includes(provider) || seen.has(id)) {\n      continue;\n    }\n    seen.add(id);\n    const threshold = Number(row.warnThreshold);\n    accounts.push({\n      name,\n      id,\n      provider,\n      credentialId,\n      warnThreshold: Number.isFinite(threshold) && threshold >= 10 && threshold <= 100 ? threshold : 80,\n    });\n  }\n  return accounts;\n}\n\n/**\n * The ids of ALL valid table rows \u2014 including disabled ones. Used by the stale-object\n * cleanup: a disabled account is paused, not deleted; only rows removed from the\n * table lose their tree.\n *\n * @param raw the native.accounts value\n * @returns the id-safe ids of every valid row\n */\nexport function validAccountIds(raw: unknown): string[] {\n  if (!Array.isArray(raw)) {\n    return [];\n  }\n  const ids: string[] = [];\n  for (const entry of raw) {\n    if (typeof entry !== \"object\" || entry === null) {\n      continue;\n    }\n    const row = entry as Record<string, unknown>;\n    const id = accountId(\n      typeof row.provider === \"string\" ? row.provider : \"\",\n      typeof row.credentialId === \"string\" ? row.credentialId : \"\",\n    );\n    if (id && !RESERVED_ROOT_IDS.includes(id) && !ids.includes(id)) {\n      ids.push(id);\n    }\n  }\n  return ids;\n}\n\n/**\n * Clamp the poll interval to the safe range: minimum 60 s (provider throttling locks\n * whole accounts), default 300 s for anything unusable.\n *\n * @param raw the configured value\n * @returns the effective interval in seconds\n */\nexport function clampPollInterval(raw: unknown): number {\n  const value = Number(raw);\n  if (!Number.isFinite(value) || value <= 0) {\n    return 300;\n  }\n  return Math.min(3600, Math.max(60, Math.round(value)));\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBO,SAAS,WAAW,MAAsB;AAC/C,SAAO,KACJ,KAAK,EACL,QAAQ,mBAAmB,GAAG,EAC9B,QAAQ,UAAU,GAAG,EACrB,QAAQ,YAAY,EAAE;AAC3B;AAGO,MAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,MAAM,qBAAqB,CAAC,cAAc,eAAe,YAAY;AAGrE,MAAM,mBAA2C;AAAA,EACtD,cAAc;AAAA,EACd,eAAe;AAAA,EACf,cAAc;AAChB;AAGO,MAAM,oBAAoB,CAAC,QAAQ,OAAO;AAY1C,SAAS,UAAU,UAAkB,cAA8B;AACxE,QAAM,QAAQ,iBAAiB,QAAQ;AACvC,MAAI,OAAO;AACT,WAAO;AAAA,EACT;AACA,QAAM,SAAS,WAAW,aAAa,QAAQ,0BAA0B,EAAE,CAAC;AAC5E,SAAO,SAAS,GAAG,MAAM,SAAS;AACpC;AAUO,SAAS,cAAc,KAA+B;AAC3D,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,WAA4B,CAAC;AACnC,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,KAAK;AACvB,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C;AAAA,IACF;AACA,UAAM,MAAM;AACZ,QAAI,IAAI,YAAY,OAAO;AACzB;AAAA,IACF;AACA,UAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AACnE,UAAM,eAAe,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAC/E,UAAM,KAAK,UAAU,UAAU,YAAY;AAC3C,UAAM,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,KAAK,IAAI,OAAO;AACtE,QAAI,CAAC,MAAM,kBAAkB,SAAS,EAAE,KAAK,CAAC,eAAe,SAAS,QAAQ,KAAK,KAAK,IAAI,EAAE,GAAG;AAC/F;AAAA,IACF;AACA,SAAK,IAAI,EAAE;AACX,UAAM,YAAY,OAAO,IAAI,aAAa;AAC1C,aAAS,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,OAAO,SAAS,SAAS,KAAK,aAAa,MAAM,aAAa,MAAM,YAAY;AAAA,IACjG,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAUO,SAAS,gBAAgB,KAAwB;AACtD,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,KAAK;AACvB,QAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C;AAAA,IACF;AACA,UAAM,MAAM;AACZ,UAAM,KAAK;AAAA,MACT,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,MAClD,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,IAC5D;AACA,QAAI,MAAM,CAAC,kBAAkB,SAAS,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,GAAG;AAC9D,UAAI,KAAK,EAAE;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AASO,SAAS,kBAAkB,KAAsB;AACtD,QAAM,QAAQ,OAAO,GAAG;AACxB,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACzC,WAAO;AAAA,EACT;AACA,SAAO,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC;AACvD;",
   "names": []
 }

package/build/lib/sign-in.js

@@ -0,0 +1,38 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sign_in_exports = {};
+__export(sign_in_exports, {
+  SIGN_IN_FLOWS: () => SIGN_IN_FLOWS,
+  attemptExpired: () => attemptExpired
+});
+module.exports = __toCommonJS(sign_in_exports);
+const SIGN_IN_FLOWS = {
+  "claude-sub": "paste-code",
+  "chatgpt-sub": "device-code",
+  "gemini-sub": "paste-url"
+};
+function attemptExpired(expiresAt, now) {
+  return now >= expiresAt;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SIGN_IN_FLOWS,
+  attemptExpired
+});
+//# sourceMappingURL=sign-in.js.map

package/build/lib/sign-in.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/lib/sign-in.ts"],
+  "sourcesContent": ["import type { SignInFlow } from \"./provider\";\n\n/** Which sign-in flow a subscription uses \u2014 see {@link SignInFlow} for why they differ. */\nexport const SIGN_IN_FLOWS: Record<string, SignInFlow> = {\n  \"claude-sub\": \"paste-code\",\n  \"chatgpt-sub\": \"device-code\",\n  \"gemini-sub\": \"paste-url\",\n};\n\n/** The live state of one subscription row, as the admin panel renders it. */\nexport type SignInState =\n  /** Signed in, tokens usable. */\n  | { status: \"signed-in\" }\n  /** Nothing started yet. */\n  | { status: \"signed-out\" }\n  /** Claude/Gemini: the user has to open the link and paste something back. */\n  | { status: \"awaiting-paste\"; url: string; flow: SignInFlow }\n  /** ChatGPT: the user types this code on the provider's page; the adapter waits. */\n  | { status: \"awaiting-device\"; userCode: string; verificationUrl: string; expiresAt: number }\n  /** The last attempt failed \u2014 reason is user-facing. */\n  | { status: \"failed\"; reason: string };\n\n/**\n * Whether a running sign-in attempt is over.\n *\n * @param expiresAt end of the attempt window (ms since epoch)\n * @param now current time (ms)\n * @returns true when the attempt can no longer succeed\n */\nexport function attemptExpired(expiresAt: number, now: number): boolean {\n  return now >= expiresAt;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGO,MAAM,gBAA4C;AAAA,EACvD,cAAc;AAAA,EACd,eAAe;AAAA,EACf,cAAc;AAChB;AAsBO,SAAS,eAAe,WAAmB,KAAsB;AACtE,SAAO,OAAO;AAChB;",
+  "names": []
+}