tokentracker-cli 0.90.2 → 0.91.3

package/src/lib/source-metadata.js

@@ -1,4 +1,4 @@
-const ACCOUNT_LEVEL_SOURCES = new Set(["cursor"]);
+const ACCOUNT_LEVEL_SOURCES = new Set(["cursor", "trae-cn"]);
 
 function normalizeSource(value) {
   return String(value || "").trim().toLowerCase();

package/src/lib/trae-cn-config.js

@@ -0,0 +1,539 @@
+"use strict";
+
+/**
+ * TRAE Work CN (国内版) config + usage fetch. Phase A: macOS + test-injected
+ * paths only. Resolves the CN home, reads the `iCubeAuthInfo://icube.cloudide`
+ * blob from User/globalStorage/storage.json (plaintext JSON or Base64 tc v5),
+ * and talks to the TRAE CN usage API. JWTs / refresh tokens are never
+ * persisted, never logged, and never put into error messages; a
+ * present-but-unreadable blob fails closed with a generic error.
+ *
+ * tc v5 blob: [6-byte magic "tc\x05\x10\x00\x00"][32-byte salt][AES-128-CBC ct]
+ *   kdf_buf  = SHA-512(salt) || (JG xor KG)   // 128 bytes
+ *   kdf_out  = SHA-512(kdf_buf)               // 64 bytes
+ *   key = kdf_out[0..16], iv = kdf_out[16..32]
+ *   plaintext = [SHA-512(json)][json]   // integrity prefix stripped
+ */
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const TRAE_CN_HOME_ENV = "TOKENTRACKER_TRAE_CN_HOME";
+// The TRAE CN usage read transmits the locally stored sign-in JWT to TRAE's
+// official endpoint, so it is strictly opt-in: nothing is sent unless the
+// user explicitly sets this flag. Any value other than 1/true keeps it off.
+const TRAE_CN_USAGE_ENV = "TOKENTRACKER_TRAE_CN_USAGE";
+
+function isTraeCnUsageEnabled(env = process.env) {
+  const value = env ? env[TRAE_CN_USAGE_ENV] : undefined;
+  const normalized = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return normalized === "1" || normalized === "true";
+}
+const TRAE_CN_APP_DIR = "TRAE SOLO CN";
+const TRAE_CN_AUTH_KEY = "iCubeAuthInfo://icube.cloudide";
+
+const TRAE_CN_USAGE_URL = "https://api.trae.cn/trae/api/v1/pay/query_user_usage_group_by_session";
+// usage_type [7] mirrors the constant the official TRAE client sends when its
+// usage page queries this endpoint (observed in the client's outbound
+// requests; the enum is undocumented server-side). Other values unverified.
+const TRAE_CN_USAGE_TYPE = [7];
+const TRAE_CN_USAGE_PAGE_SIZE = 20;
+const TRAE_CN_USAGE_MAX_PAGES = 100;
+const TRAE_CN_USAGE_DELAY_MS = 300;
+const TRAE_CN_USAGE_TIMEOUT_MS = 30 * 1000;
+// Capacity-adaptive window splitting: 30 days halves at most 8 times
+// (finest sub-window ~2.8h, aggregate ceiling ~512k sessions/30d). A window
+// still over capacity at that depth fails closed — never a partial import.
+const TRAE_CN_USAGE_MAX_SPLIT_DEPTH = 8;
+
+const TRAE_CN_MAGIC = Buffer.from([0x74, 0x63, 0x05, 0x10, 0x00, 0x00]);
+const TRAE_CN_SALT_LEN = 32;
+const TRAE_CN_HASH_LEN = 64;
+const TRAE_CN_AES_KEY_LEN = 16;
+const TRAE_CN_IV_LEN = 16;
+
+// JG / KG — the two halves of the hardcoded (obfuscated) password in the TRAE
+// client's byteCrypto.js (XOR the pair to recover the KDF secret). Failure
+// signature when TRAE ships a new key: readTraeCnAuthFromStorage throws
+// "Trae CN auth payload is malformed", sync skips the source, and
+// `tokentracker status` reports auth "malformed" — re-extract the pair
+// from the updated client to restore decryption.
+const TRAE_CN_JG = Buffer.from([
+  82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215, 251, 124, 227, 57, 130,
+  155, 47, 255, 135, 52, 142, 67, 68, 196, 222, 233, 203, 84, 123, 148, 50, 166, 194, 35, 61,
+  238, 76, 149, 11, 66, 250, 195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73,
+  109, 139, 209, 37,
+]);
+const TRAE_CN_KG = Buffer.from([
+  31, 221, 168, 51, 136, 7, 199, 49, 177, 18, 16, 89, 39, 128, 236, 95, 96, 81, 127, 169, 25,
+  181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160, 224, 59, 77, 174, 42, 245, 176,
+  200, 235, 187, 60, 131, 83, 153, 97, 23, 43, 4, 126, 186, 119, 214, 38, 225, 105, 20, 99,
+  85, 33, 12, 125,
+]);
+
+// ---------------------------------------------------------------------------
+// Path resolution
+// ---------------------------------------------------------------------------
+
+function resolveTraeCnHome({ env = process.env, home = os.homedir(), platform = process.platform } = {}) {
+  const override = env[TRAE_CN_HOME_ENV];
+  if (typeof override === "string" && override.trim()) {
+    return path.resolve(override.trim());
+  }
+  if (platform === "darwin") {
+    return path.join(home, "Library", "Application Support", TRAE_CN_APP_DIR);
+  }
+  // ponytail: this phase is macOS + test-injected paths only.
+  return null;
+}
+
+function resolveTraeCnStoragePath(options = {}) {
+  const home = resolveTraeCnHome(options);
+  return home ? path.join(home, "User", "globalStorage", "storage.json") : null;
+}
+
+// ---------------------------------------------------------------------------
+// tc v5 decryption
+// ---------------------------------------------------------------------------
+
+function traeCnHardcodedKdfSecret() {
+  const secret = Buffer.alloc(64);
+  for (let i = 0; i < 64; i++) secret[i] = TRAE_CN_JG[i] ^ TRAE_CN_KG[i];
+  return secret;
+}
+
+function deriveTraeCnKeyIv(salt) {
+  if (!Buffer.isBuffer(salt) || salt.length !== TRAE_CN_SALT_LEN) {
+    throw new Error("Trae CN auth salt is malformed.");
+  }
+  const kdfBuf = Buffer.concat([
+    crypto.createHash("sha512").update(salt).digest(),
+    traeCnHardcodedKdfSecret(),
+  ]);
+  // Vendor tc-v5 compatibility KDF, not password storage.
+  const kdfOut = crypto.createHash("sha512").update(kdfBuf).digest();
+  return {
+    key: kdfOut.subarray(0, TRAE_CN_AES_KEY_LEN),
+    iv: kdfOut.subarray(TRAE_CN_AES_KEY_LEN, TRAE_CN_AES_KEY_LEN + TRAE_CN_IV_LEN),
+  };
+}
+
+/** Decrypt a raw tc v5 blob; returns the JSON bytes (integrity prefix stripped). */
+function decryptTraeCnBlob(blob) {
+  const minLen = TRAE_CN_MAGIC.length + TRAE_CN_SALT_LEN + 16;
+  if (!Buffer.isBuffer(blob) || blob.length < minLen) {
+    throw new Error("Trae CN auth blob is too short.");
+  }
+  if (!blob.subarray(0, TRAE_CN_MAGIC.length).equals(TRAE_CN_MAGIC)) {
+    throw new Error("Trae CN auth blob has an unknown format.");
+  }
+  const salt = blob.subarray(TRAE_CN_MAGIC.length, TRAE_CN_MAGIC.length + TRAE_CN_SALT_LEN);
+  const ciphertext = blob.subarray(TRAE_CN_MAGIC.length + TRAE_CN_SALT_LEN);
+  if (ciphertext.length % 16 !== 0) {
+    throw new Error("Trae CN auth blob is not block-aligned.");
+  }
+  const { key, iv } = deriveTraeCnKeyIv(salt);
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, iv); // PKCS7 default
+  let plaintext;
+  try {
+    plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch (_error) {
+    throw new Error("Trae CN auth blob could not be decrypted.");
+  }
+  if (plaintext.length < TRAE_CN_HASH_LEN) {
+    throw new Error("Trae CN auth blob is missing its integrity digest.");
+  }
+  const expected = plaintext.subarray(0, TRAE_CN_HASH_LEN);
+  const data = plaintext.subarray(TRAE_CN_HASH_LEN);
+  const actual = crypto.createHash("sha512").update(data).digest();
+  if (expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+    throw new Error("Trae CN auth blob failed its integrity check.");
+  }
+  return data;
+}
+
+/** Decrypt a Base64-encoded tc v5 blob and return the plaintext UTF-8 string. */
+function decryptTraeCnBase64(value) {
+  const blob = Buffer.from(String(value).trim(), "base64");
+  return decryptTraeCnBlob(blob).toString("utf8");
+}
+
+// ---------------------------------------------------------------------------
+// Credential reading
+// ---------------------------------------------------------------------------
+
+/**
+ * Parse a stored auth value: a plaintext JSON object / JSON string, or a
+ * Base64-encoded tc v5 blob. Fails closed with a credential-safe error.
+ */
+function parseTraeCnAuthValue(value) {
+  if (value && typeof value === "object") {
+    return value;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (!trimmed) {
+      throw new Error("Trae CN auth data is empty.");
+    }
+    if (trimmed.startsWith("{")) {
+      let parsed;
+      try {
+        parsed = JSON.parse(trimmed);
+      } catch (_error) {
+        throw new Error("Trae CN auth JSON is malformed.");
+      }
+      if (!parsed || typeof parsed !== "object") {
+        throw new Error("Trae CN auth JSON is malformed.");
+      }
+      return parsed;
+    }
+    let decrypted;
+    try {
+      decrypted = decryptTraeCnBase64(trimmed);
+    } catch (error) {
+      if (error && error.message.startsWith("Trae CN auth")) throw error;
+      throw new Error("Trae CN auth payload is malformed.");
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(decrypted);
+    } catch (_error) {
+      throw new Error("Trae CN auth payload is malformed.");
+    }
+    if (!parsed || typeof parsed !== "object") {
+      throw new Error("Trae CN auth payload is malformed.");
+    }
+    return parsed;
+  }
+  throw new Error("Trae CN auth data is missing or malformed.");
+}
+
+/**
+ * Read + decrypt the auth object from storage.json. Returns null when the
+ * file or the auth key is absent (not signed in). Throws a credential-safe
+ * error when present data is malformed, and a distinct unreadable error for
+ * real IO failures (permission denied, I/O error) - an unreadable storage
+ * file must not be reported as "not signed in".
+ */
+function readTraeCnAuthFromStorage({ env, home, platform, fsModule = fs } = {}) {
+  const storagePath = resolveTraeCnStoragePath({ env, home, platform });
+  if (!storagePath) return null;
+  let raw;
+  try {
+    raw = fsModule.readFileSync(storagePath, "utf8");
+  } catch (error) {
+    // A missing file (or missing path component) simply means the app is not
+    // installed / not signed in. Any other failure - EACCES, EISDIR, a real
+    // I/O error - fails closed with a generic, credential-safe error. Only a
+    // stable machine-readable code is attached, never the OS detail, so
+    // storage contents cannot leak through logs or error messages.
+    if (error && (error.code === "ENOENT" || error.code === "ENOTDIR")) {
+      return null;
+    }
+    const unreadable = new Error("Trae CN storage.json could not be read.");
+    unreadable.code = "TRAE_CN_STORAGE_UNREADABLE";
+    throw unreadable;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (_error) {
+    throw new Error("Trae CN storage.json is not valid JSON.");
+  }
+  const value = parsed && typeof parsed === "object" ? parsed[TRAE_CN_AUTH_KEY] : undefined;
+  if (value === undefined || value === null) return null;
+  return parseTraeCnAuthValue(value);
+}
+
+/** Extract a nonempty JWT from a parsed auth object. */
+function extractTraeCnToken(auth) {
+  const token = auth && typeof auth === "object" ? auth.token : undefined;
+  if (typeof token === "string" && token.trim()) {
+    return token.trim();
+  }
+  throw new Error("Trae CN auth data has no token.");
+}
+
+// ---------------------------------------------------------------------------
+// Usage API
+// ---------------------------------------------------------------------------
+
+function usageError(message, { status, apiCode } = {}) {
+  const error = new Error(message);
+  if (status !== undefined) error.status = status;
+  if (apiCode !== undefined) error.apiCode = apiCode;
+  if (status === 401 || status === 403) error.code = "AUTH_EXPIRED";
+  return error;
+}
+
+function assertUsageParams({ start_time, end_time, page_size }) {
+  if (!Number.isInteger(start_time) || start_time <= 0) {
+    throw new Error("Trae CN usage start_time must be a positive integer epoch second.");
+  }
+  if (!Number.isInteger(end_time) || end_time <= 0) {
+    throw new Error("Trae CN usage end_time must be a positive integer epoch second.");
+  }
+  if (start_time > end_time) {
+    throw new Error("Trae CN usage start_time must not be after end_time.");
+  }
+  if (!Number.isInteger(page_size) || page_size <= 0 || page_size > TRAE_CN_USAGE_PAGE_SIZE) {
+    throw new Error(
+      `Trae CN usage page_size must be a positive integer no greater than ${TRAE_CN_USAGE_PAGE_SIZE}.`,
+    );
+  }
+}
+
+/**
+ * Fetch one page of TRAE CN usage. Returns { sessions, total, page_num, page_size }
+ * where `total` is null when the API omits it. Errors never contain the JWT
+ * or the raw request/response body.
+ */
+async function fetchTraeCnUsagePage({
+  jwt,
+  start_time,
+  end_time,
+  page_num,
+  page_size = TRAE_CN_USAGE_PAGE_SIZE,
+  fetchImpl = fetch,
+  timeoutMs = TRAE_CN_USAGE_TIMEOUT_MS,
+} = {}) {
+  if (typeof jwt !== "string" || !jwt.trim()) {
+    throw new Error("Trae CN usage request requires a token.");
+  }
+  if (!Number.isInteger(page_num) || page_num < 1) {
+    throw new Error("Trae CN usage page_num must be a positive integer.");
+  }
+  assertUsageParams({ start_time, end_time, page_size });
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let response;
+    try {
+      // Security note (CodeQL "File data -> outbound network request"):
+      // the credential read from TRAE's local storage.json is sent ONLY to
+      // TRAE_CN_USAGE_URL, a compile-time constant HTTPS endpoint of the
+      // official API - callers cannot redirect the destination (the url
+      // parameter is ignored; pinned by the "sends the exact request" test).
+      // The whole flow is behind the explicit TOKENTRACKER_TRAE_CN_USAGE
+      // opt-in, the JWT is never logged, never written to the queue/cursor
+      // state, and never uploaded to the TokenTracker cloud (queue rows carry
+      // token counters only; transport exceptions are sanitized).
+      response = await fetchImpl(TRAE_CN_USAGE_URL, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Cloud-IDE-JWT ${jwt.trim()}`,
+        },
+        body: JSON.stringify({
+          usage_type: TRAE_CN_USAGE_TYPE,
+          start_time,
+          end_time,
+          page_num,
+          page_size,
+        }),
+        signal: controller.signal,
+      });
+    } catch (_error) {
+      throw new Error("Trae CN usage API request failed.");
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw usageError(`Trae CN usage API returned HTTP ${response.status}.`, { status: response.status });
+    }
+    if (!response.ok) {
+      throw usageError(`Trae CN usage API returned HTTP ${response.status}.`, { status: response.status });
+    }
+    let parsed;
+    try {
+      parsed = await response.json();
+    } catch (_error) {
+      throw new Error("Trae CN usage API returned a non-JSON response.");
+    }
+    const apiCode = parsed?.data?.code ?? parsed?.code;
+    if (apiCode !== undefined && Number(apiCode) !== 0) {
+      throw usageError(`Trae CN usage API returned error code ${apiCode}.`, {
+        status: response.status,
+        apiCode: Number(apiCode),
+      });
+    }
+    // Documented wrapper: data.user_usage_group_by_sessions, or the top-level
+    // equivalent. Only this module parses the wrapper; token rows/buckets are
+    // normalized elsewhere. A body without the session-array wrapper fails
+    // closed as a schema error instead of being misread as an empty result;
+    // an explicit empty array remains valid.
+    const data = parsed?.data && typeof parsed.data === "object" ? parsed.data : parsed;
+    if (!Array.isArray(data?.user_usage_group_by_sessions)) {
+      throw new Error("Trae CN usage API response is missing the session list.");
+    }
+    const sessions = data.user_usage_group_by_sessions;
+    // The declared total gates pagination termination (sessions.length >=
+    // total stops the walk), so a malformed value must fail closed as a
+    // schema error - never be coerced into a legal-looking stop condition.
+    // A negative, fractional, non-finite, or non-number total (the API
+    // speaks JSON numbers; a quoted digit string is a schema anomaly) would
+    // otherwise silently truncate the snapshot after page 1 and still look
+    // authoritative.
+    const rawTotal = data?.total;
+    let total = null;
+    if (rawTotal !== undefined && rawTotal !== null) {
+      if (
+        typeof rawTotal !== "number" ||
+        !Number.isSafeInteger(rawTotal) ||
+        rawTotal < 0
+      ) {
+        throw new Error("Trae CN usage API returned an invalid total.");
+      }
+      total = rawTotal;
+    }
+    return { sessions, total, page_num, page_size };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Fetch usage across pages serially. Starts at the 1-based page_num, at most
+ * maxPages pages, with a delay between pages (pass delayMs = 0 to disable in
+ * tests). Stops at the stated total when present, otherwise on an empty page.
+ * Throws if maxPages is reached while another page would still be needed.
+ */
+async function fetchTraeCnUsage({
+  jwt,
+  start_time,
+  end_time,
+  page_num = 1,
+  page_size = TRAE_CN_USAGE_PAGE_SIZE,
+  fetchImpl = fetch,
+  maxPages = TRAE_CN_USAGE_MAX_PAGES,
+  delayMs = TRAE_CN_USAGE_DELAY_MS,
+  pageFetcher = fetchTraeCnUsagePage,
+} = {}) {
+  const sessions = [];
+  let total = null;
+  let pagesFetched = 0;
+  let page = page_num;
+  for (;;) {
+    if (pagesFetched >= maxPages) {
+      // A further page would be needed but the cap prevents it: fail closed
+      // rather than return a partial snapshot that looks authoritative. Cap
+      // exhaustion is the same over-capacity signal as the declared-total
+      // check below (which the API may omit) — tag it identically so window
+      // splitting engages either way.
+      const error = new Error("Trae CN usage pagination exceeded the maximum page count.");
+      error.code = "TRAE_CN_USAGE_CAPACITY_EXCEEDED";
+      throw error;
+    }
+    const result = await pageFetcher({ jwt, start_time, end_time, page_num: page, page_size, fetchImpl });
+    pagesFetched += 1;
+    total = result.total ?? null;
+    if (pagesFetched === 1 && Number.isFinite(total) && total > page_size * maxPages) {
+      const error = new Error("Trae CN usage snapshot exceeds the supported capacity.");
+      error.code = "TRAE_CN_USAGE_CAPACITY_EXCEEDED";
+      throw error;
+    }
+    if (Array.isArray(result.sessions)) sessions.push(...result.sessions);
+    if (result.sessions.length === 0) break;
+    if (total !== null && sessions.length >= total) break;
+    if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
+    page += 1;
+  }
+  return { sessions, total, pages_fetched: pagesFetched };
+}
+
+/**
+ * Capacity-adaptive window fetch. Probing the official API confirmed the
+ * start_time/end_time range is closed on both ends ([a,b] and [b,c] both
+ * return the row at b) and that a row returned by two overlapping windows is
+ * byte-identical (idempotent duplicate, never cumulative). Splitting therefore
+ * staggers adjacent sub-windows by one second ([start,mid] + [mid+1,end]) so
+ * the union equals the full window exactly; any residual duplicate would be
+ * absorbed by the session-level reconciliation. On TRAE_CN_USAGE_CAPACITY_
+ * EXCEEDED the window halves recursively up to maxSplitDepth levels; a window
+ * still over capacity at the finest allowed granularity re-throws so the
+ * caller keeps its fail-closed guarantee.
+ */
+async function fetchTraeCnUsageWindowed(options = {}, depth = 0) {
+  const { start_time, end_time } = options;
+  try {
+    return await fetchTraeCnUsage(options);
+  } catch (error) {
+    if (error?.code !== "TRAE_CN_USAGE_CAPACITY_EXCEEDED") throw error;
+    if (end_time - start_time < 1 || depth >= TRAE_CN_USAGE_MAX_SPLIT_DEPTH) throw error;
+    const mid = start_time + Math.floor((end_time - start_time) / 2);
+    const left = await fetchTraeCnUsageWindowed({ ...options, end_time: mid }, depth + 1);
+    const right = await fetchTraeCnUsageWindowed({ ...options, start_time: mid + 1 }, depth + 1);
+    const total =
+      Number.isFinite(left.total) && Number.isFinite(right.total) ? left.total + right.total : null;
+    return {
+      sessions: [...left.sessions, ...right.sessions],
+      total,
+      pages_fetched: left.pages_fetched + right.pages_fetched,
+    };
+  }
+}
+
+/**
+ * High-level storage-backed fetch: read the JWT from storage.json, fetch
+ * usage, and on a 401/403 re-read + re-decrypt storage.json and retry exactly
+ * once. Never persists or logs the JWT / refresh token; no refreshToken flow.
+ */
+async function fetchTraeCnUsageWithAuth({
+  start_time,
+  end_time,
+  page_num = 1,
+  page_size = TRAE_CN_USAGE_PAGE_SIZE,
+  fetchImpl = fetch,
+  delayMs = TRAE_CN_USAGE_DELAY_MS,
+  maxPages = TRAE_CN_USAGE_MAX_PAGES,
+  readAuth = readTraeCnAuthFromStorage,
+  usageFetcher = fetchTraeCnUsageWindowed,
+  ...storageOptions
+} = {}) {
+  let auth = readAuth(storageOptions);
+  let jwt = auth ? extractTraeCnToken(auth) : null;
+  if (!jwt) {
+    throw new Error("Trae CN credentials are not configured.");
+  }
+  const run = () =>
+    usageFetcher({ jwt, start_time, end_time, page_num, page_size, fetchImpl, delayMs, maxPages });
+  try {
+    return await run();
+  } catch (error) {
+    const authFailure =
+      error?.code === "AUTH_EXPIRED" || error?.status === 401 || error?.status === 403;
+    if (!authFailure) throw error;
+    // Session may have rotated since the first read; re-read storage once.
+    auth = readAuth(storageOptions);
+    jwt = auth ? extractTraeCnToken(auth) : null;
+    if (!jwt) throw error;
+    return await run();
+  }
+}
+
+module.exports = {
+  TRAE_CN_HOME_ENV,
+  TRAE_CN_USAGE_ENV,
+  isTraeCnUsageEnabled,
+  TRAE_CN_APP_DIR,
+  TRAE_CN_AUTH_KEY,
+  TRAE_CN_USAGE_URL,
+  TRAE_CN_USAGE_TYPE,
+  TRAE_CN_USAGE_PAGE_SIZE,
+  TRAE_CN_USAGE_MAX_PAGES,
+  TRAE_CN_USAGE_DELAY_MS,
+  TRAE_CN_MAGIC,
+  resolveTraeCnHome,
+  resolveTraeCnStoragePath,
+  traeCnHardcodedKdfSecret,
+  deriveTraeCnKeyIv,
+  decryptTraeCnBlob,
+  decryptTraeCnBase64,
+  parseTraeCnAuthValue,
+  readTraeCnAuthFromStorage,
+  extractTraeCnToken,
+  fetchTraeCnUsagePage,
+  fetchTraeCnUsage,
+  fetchTraeCnUsageWindowed,
+  fetchTraeCnUsageWithAuth,
+};

package/dashboard/dist/assets/DialogDescription-M_lg2jhD.js

@@ -1 +0,0 @@
-import{r as n,z as a}from"./__vite-browser-external-CRvi_9hb.js";import{u as p}from"./DialogTitle-DyvhHV1-.js";import{u as c}from"./useScrollLock-sLkmam8C.js";const x=n.forwardRef(function(e,r){const{render:l,className:u,style:m,id:s,...t}=e,i=p(),o=c(s);return i.useSyncedValueWithCleanup("descriptionElementId",o),a("p",e,{ref:r,props:[{id:o},t]})});export{x as D};

package/dashboard/dist/assets/LoginCard-j5HVFRdP.js

@@ -1 +0,0 @@
-import{m as re,a2 as ce,a as ge,r as o,c as a,j as e,e as h}from"./__vite-browser-external-CRvi_9hb.js";const ue=[["path",{d:"m12 19-7-7 7-7",key:"1l729n"}],["path",{d:"M19 12H5",key:"x3x0zl"}]],me=re("arrow-left",ue);const xe=[["path",{d:"m22 7-8.991 5.727a2 2 0 0 1-2.009 0L2 7",key:"132q7q"}],["rect",{x:"2",y:"4",width:"20",height:"16",rx:"2",key:"izxlao"}]],he=re("mail",xe),be=e.jsxs("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"none",children:[e.jsx("path",{d:"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1Z",fill:"#4285F4"}),e.jsx("path",{d:"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23Z",fill:"#34A853"}),e.jsx("path",{d:"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18A10.96 10.96 0 0 0 1 12c0 1.77.42 3.44 1.18 4.93l3.66-2.84Z",fill:"#FBBC05"}),e.jsx("path",{d:"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53Z",fill:"#EA4335"})]}),fe=e.jsx("svg",{width:"18",height:"18",viewBox:"0 0 24 24",fill:"currentColor",children:e.jsx("path",{d:"M12 0C5.37 0 0 5.37 0 12c0 5.31 3.435 9.795 8.205 11.385.6.105.825-.255.825-.57 0-.285-.015-1.23-.015-2.235-3.015.555-3.795-.735-4.035-1.41-.135-.345-.72-1.41-1.23-1.695-.42-.225-1.02-.78-.015-.795.945-.015 1.62.87 1.845 1.23 1.08 1.815 2.805 1.305 3.495.99.105-.78.42-1.305.765-1.605-2.67-.3-5.46-1.335-5.46-5.925 0-1.305.465-2.385 1.23-3.225-.12-.3-.54-1.53.12-3.18 0 0 1.005-.315 3.3 1.23.96-.27 1.98-.405 3-.405s2.04.135 3 .405c2.295-1.56 3.3-1.23 3.3-1.23.66 1.65.24 2.88.12 3.18.765.84 1.23 1.905 1.23 3.225 0 4.605-2.805 5.625-5.475 5.925.435.375.81 1.095.81 2.22 0 1.605-.015 2.895-.015 3.3 0 .315.225.69.825.57A12.02 12.02 0 0 0 24 12c0-6.63-5.37-12-12-12Z"})}),pe={google:be,github:fe},ye={google:"Google",github:"GitHub",microsoft:"Microsoft",discord:"Discord",apple:"Apple"};function we(i){return ye[i]||String(i||"").replace(/-/g," ")}function ke(i){if(typeof i=="string"&&i.trim())return i.trim();if(i&&typeof i=="object"){if(typeof i.token=="string"&&i.token.trim())return i.token.trim();if(typeof i.otp=="string"&&i.otp.trim())return i.otp.trim()}return""}function je({title:i,subtitle:H,className:ae="",onSuccess:S,hideLogo:D=!1,initialMode:p="signin",tokenFromUrl:P="",initialEmail:y="",initialCode:v=""}){ce();const{enabled:w,signedIn:j,refreshUser:E,signInWithPassword:G,signUp:Z,signInWithOAuth:T,getPublicAuthConfig:V,sendResetPasswordEmail:$,exchangeResetPasswordToken:U,resetPassword:W}=ge(),[n,u]=o.useState(p),[c,k]=o.useState(y),[m,N]=o.useState(""),[A,L]=o.useState(""),[M,te]=o.useState(""),[q,z]=o.useState(v),[_,x]=o.useState(!1),[J,s]=o.useState(null),[C,b]=o.useState(null),[F,O]=o.useState(!1),[oe,se]=o.useState(!!(p!=="signin"||y)),[R,K]=o.useState(!0),[I,Q]=o.useState([]),[X,ie]=o.useState(8);o.useEffect(()=>{p&&u(p)},[p]),o.useEffect(()=>{y&&k(y)},[y]),o.useEffect(()=>{v&&z(v)},[v]),o.useEffect(()=>{if(!w)return;let r=!0;return K(!0),(async()=>{const{data:t,error:l}=await V();if(r){if(l||!t)Q(["google","github"]);else{const d=Array.isArray(t.oAuthProviders)?t.oAuthProviders:[],f=Array.isArray(t.customOAuthProviders)?t.customOAuthProviders:[];Q([...d,...f]),typeof t.passwordMinLength=="number"&&t.passwordMinLength>0&&ie(t.passwordMinLength)}K(!1)}})(),()=>{r=!1}},[w,V]),o.useEffect(()=>{j&&S&&S()},[j,S]);const Y=o.useMemo(()=>typeof window>"u"?"":!!window.webkit?.messageHandlers?.nativeOAuth?`${window.location.origin}/auth/callback`:`${window.location.origin}/`,[]),ee=o.useMemo(()=>typeof window>"u"?"/reset-password":`${window.location.origin}/reset-password`,[]),B=o.useCallback(async r=>{s(null),x(!0);try{const{error:t}=await T(r,Y);t&&s(t.message||String(t))}finally{x(!1)}},[T,Y]);o.useEffect(()=>{if(!w||R||j||typeof window>"u")return;const r=window.location.search;if(!r)return;const t=new URLSearchParams(r),l=t.get("native")==="1",d=t.get("provider");l&&d&&[...I].includes(d)&&B(d)},[w,R,j,I,B]);const ne=o.useCallback(async r=>{r.preventDefault(),s(null),x(!0);try{if(n==="signup"){const{data:l,error:d}=await Z({email:c.trim(),password:m,name:M.trim()||void 0});if(d){s(d.message||String(d));return}if(l?.requireEmailVerification){b(a("login.verify_email_pending")),u("signin");return}await E();return}const{error:t}=await G({email:c.trim(),password:m});if(t){s(t.message||String(t));return}await E()}finally{x(!1)}},[n,c,m,M,Z,G,E]),le=o.useCallback(async r=>{r.preventDefault(),s(null),x(!0);try{const t=c.trim(),{error:l}=await $({email:t,redirectTo:ee});if(l){s(l.message||String(l));return}k(t),b(a("reset_password.request.sent")),u("reset_confirm")}finally{x(!1)}},[c,ee,$]),de=o.useCallback(async r=>{if(r.preventDefault(),s(null),m!==A){s(a("reset_password.error.password_mismatch"));return}x(!0);try{let t=P;if(!t){const{data:d,error:f}=await U({email:c.trim(),code:q.trim()});if(f){s(f.message||String(f));return}if(t=ke(d),!t){s(a("reset_password.error.missing_token"));return}}const{error:l}=await W({newPassword:m,otp:t});if(l){s(l.message||String(l));return}O(!0),b(a("reset_password.success"))}finally{x(!1)}},[q,A,c,U,m,W,P]);if(!w)return null;const g=n==="reset_email"||n==="reset_confirm";return e.jsxs("div",{className:h("w-full bg-white dark:bg-oai-gray-950 p-6 transition-colors duration-200",ae),children:[g&&e.jsxs("button",{type:"button",onClick:()=>{u("signin"),b(null),s(null),O(!1),N(""),L("")},className:"flex items-center gap-1.5 text-xs font-medium text-oai-gray-500 hover:text-oai-black dark:hover:text-white transition-colors mb-4 focus:outline-none",children:[e.jsx(me,{className:"h-3.5 w-3.5"}),a("reset_password.back_to_sign_in")]}),e.jsxs("div",{className:h("mb-6",g?"text-left":"text-center"),children:[!D&&!g&&e.jsxs("div",{className:"flex items-center justify-center gap-2 mb-2",children:[e.jsx("img",{src:"/app-icon.png",alt:"",width:28,height:28,className:"rounded-md"}),e.jsx("span",{className:"text-lg font-semibold text-oai-black dark:text-white font-oai tracking-tight",children:a("shared.app_name")})]}),e.jsx("h2",{className:h("text-sm font-semibold text-oai-black dark:text-white tracking-tight mb-1",(D||g)&&"text-base font-bold md:text-lg"),children:g?a("reset_password.title"):i||a("login_modal.subtitle")}),!g&&H&&e.jsx("p",{className:"text-xs text-oai-gray-500 dark:text-oai-gray-400 mt-1.5 leading-relaxed max-w-[320px] mx-auto",children:H}),g&&e.jsx("p",{className:"text-xs text-oai-gray-500 dark:text-oai-gray-400 mt-1.5 leading-relaxed max-w-[320px]",children:C&&n==="reset_confirm"&&!F?C:a("reset_password.subtitle")})]}),C&&(!g||F)&&e.jsx("div",{className:"mb-4 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900/50 px-3 py-2 text-xs text-oai-gray-700 dark:text-oai-gray-300",children:C}),J&&e.jsx("p",{className:"mb-4 text-sm text-red-500 dark:text-red-400 text-center",role:"alert",children:J}),n==="reset_email"&&e.jsxs("form",{onSubmit:le,className:"space-y-3",children:[e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-reset-email",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("login.field.email")}),e.jsx("input",{id:"card-reset-email",type:"email",autoComplete:"email",required:!0,value:c,onChange:r=>k(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"})]}),e.jsx("button",{type:"submit",disabled:_,className:"w-full h-10 rounded-lg bg-oai-gray-900 dark:bg-white text-white dark:text-oai-gray-950 text-sm font-semibold hover:bg-oai-gray-800 dark:hover:bg-oai-gray-100 transition-colors disabled:opacity-50",children:a("reset_password.request.submit")})]}),n==="reset_confirm"&&(F?e.jsx("button",{type:"button",onClick:()=>{u("signin"),O(!1),b(null),s(null),N(""),L("")},className:"w-full h-10 rounded-lg bg-oai-gray-900 dark:bg-white text-white dark:text-oai-gray-950 text-sm font-semibold hover:bg-oai-gray-800 dark:hover:bg-oai-gray-100 transition-colors text-center shadow-sm",children:a("reset_password.success_cta")}):e.jsxs("form",{onSubmit:de,className:"space-y-3",children:[!P&&e.jsxs(e.Fragment,{children:[e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-reset-email-confirm",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("login.field.email")}),e.jsx("input",{id:"card-reset-email-confirm",type:"email",autoComplete:"email",required:!0,value:c,onChange:r=>k(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"})]}),e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-reset-code",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("reset_password.field.code")}),e.jsx("input",{id:"card-reset-code",type:"text",inputMode:"numeric",autoComplete:"one-time-code",required:!0,value:q,onChange:r=>z(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"})]})]}),e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-reset-password",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("reset_password.field.new_password")}),e.jsx("input",{id:"card-reset-password",type:"password",autoComplete:"new-password",required:!0,minLength:8,value:m,onChange:r=>N(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"})]}),e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-reset-password-confirm",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("reset_password.field.confirm_password")}),e.jsx("input",{id:"card-reset-password-confirm",type:"password",autoComplete:"new-password",required:!0,minLength:8,value:A,onChange:r=>L(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"})]}),e.jsx("button",{type:"submit",disabled:_,className:"w-full h-10 rounded-lg bg-oai-gray-900 dark:bg-white text-white dark:text-oai-gray-950 text-sm font-semibold hover:bg-oai-gray-800 dark:hover:bg-oai-gray-100 transition-colors disabled:opacity-50",children:a("reset_password.reset.submit")})]})),!g&&e.jsxs(e.Fragment,{children:[e.jsx("div",{className:"space-y-2.5 mb-5",children:R?e.jsxs("div",{className:"space-y-2.5",children:[e.jsx("div",{className:"h-10 rounded-lg bg-oai-gray-100 dark:bg-oai-gray-900/50 animate-pulse"}),e.jsx("div",{className:"h-10 rounded-lg bg-oai-gray-100 dark:bg-oai-gray-900/50 animate-pulse"})]}):I.map(r=>e.jsxs("button",{type:"button",disabled:_,onClick:()=>B(r),className:h("w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-700 bg-oai-gray-50 dark:bg-oai-gray-900 text-sm font-medium text-oai-black dark:text-white","hover:bg-oai-gray-100 dark:hover:bg-oai-gray-800 hover:border-oai-gray-300 dark:hover:border-oai-gray-600 transition-colors disabled:opacity-50","flex items-center justify-center gap-2.5"),children:[pe[r]||null,a("login.oauth.continue",{provider:we(r)})]},r))}),oe?e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"relative mb-5",children:[e.jsx("div",{className:"absolute inset-0 flex items-center",children:e.jsx("span",{className:"w-full border-t border-oai-gray-200 dark:border-oai-gray-800"})}),e.jsx("div",{className:"relative flex justify-center text-xs uppercase tracking-wider",children:e.jsx("span",{className:"bg-white dark:bg-oai-gray-950 px-3 text-oai-gray-400 dark:text-oai-gray-600",children:a("login_modal.divider_email")})})]}),e.jsxs("div",{className:"flex rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 p-0.5 bg-oai-gray-50 dark:bg-oai-gray-900/50 mb-4",children:[e.jsx("button",{type:"button",className:h("flex-1 py-1.5 text-xs font-medium rounded-md transition-colors",n==="signin"?"bg-white dark:bg-oai-gray-800 text-oai-black dark:text-white shadow-sm":"text-oai-gray-500 hover:text-oai-gray-700 dark:hover:text-oai-gray-300"),onClick:()=>{u("signin"),s(null)},children:a("login.tab.sign_in")}),e.jsx("button",{type:"button",className:h("flex-1 py-1.5 text-xs font-medium rounded-md transition-colors",n==="signup"?"bg-white dark:bg-oai-gray-800 text-oai-black dark:text-white shadow-sm":"text-oai-gray-500 hover:text-oai-gray-700 dark:hover:text-oai-gray-300"),onClick:()=>{u("signup"),s(null)},children:a("login.tab.sign_up")})]}),e.jsxs("form",{onSubmit:ne,className:"space-y-3",children:[n==="signup"&&e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-name",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("login.field.name")}),e.jsx("input",{id:"card-name",type:"text",autoComplete:"name",value:M,onChange:r=>te(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500",placeholder:a("login.field.name_placeholder")})]}),e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-email",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("login.field.email")}),e.jsx("input",{id:"card-email",type:"email",autoComplete:"email",required:!0,value:c,onChange:r=>k(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"})]}),e.jsxs("div",{children:[e.jsx("label",{htmlFor:"card-password",className:"block text-xs font-medium text-oai-gray-500 mb-1",children:a("login.field.password")}),e.jsx("input",{id:"card-password",type:"password",autoComplete:n==="signup"?"new-password":"current-password",required:!0,minLength:n==="signup"?X:void 0,value:m,onChange:r=>N(r.target.value),className:"w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-800 bg-oai-gray-50 dark:bg-oai-gray-900 px-3 text-sm text-oai-black dark:text-white placeholder-oai-gray-400 dark:placeholder-oai-gray-600 focus:outline-none focus:ring-2 focus:ring-oai-brand-500"}),n==="signup"&&e.jsx("p",{className:"mt-1 text-xs text-oai-gray-400 dark:text-oai-gray-600",children:a("login.password_hint",{min:String(X)})}),n==="signin"&&e.jsx("div",{className:"mt-1 text-right",children:e.jsx("button",{type:"button",onClick:()=>{u("reset_email"),s(null),b(null)},className:"text-xs font-medium text-oai-gray-500 hover:text-oai-black dark:hover:text-white no-underline bg-transparent border-0 p-0 cursor-pointer focus:outline-none",children:a("login.forgot_password")})})]}),e.jsx("button",{type:"submit",disabled:_,className:"w-full h-10 rounded-lg bg-oai-gray-900 dark:bg-white text-white dark:text-oai-gray-950 text-sm font-semibold hover:bg-oai-gray-800 dark:hover:bg-oai-gray-100 transition-colors disabled:opacity-50",children:n==="signup"?a("login.submit.sign_up"):a("login.submit.sign_in")})]})]}):e.jsxs(e.Fragment,{children:[e.jsxs("div",{className:"relative mb-5",children:[e.jsx("div",{className:"absolute inset-0 flex items-center",children:e.jsx("span",{className:"w-full border-t border-oai-gray-200 dark:border-oai-gray-800"})}),e.jsx("div",{className:"relative flex justify-center text-xs uppercase tracking-wider",children:e.jsx("span",{className:"bg-white dark:bg-oai-gray-950 px-3 text-oai-gray-400 dark:text-oai-gray-600",children:a("login.divider")})})]}),e.jsxs("button",{type:"button",onClick:()=>se(!0),className:h("w-full h-10 rounded-lg border border-oai-gray-200 dark:border-oai-gray-700 bg-oai-gray-50 dark:bg-oai-gray-900 text-sm font-medium text-oai-black dark:text-white","hover:bg-oai-gray-100 dark:hover:bg-oai-gray-800 hover:border-oai-gray-300 dark:hover:border-oai-gray-600 transition-colors","flex items-center justify-center gap-2.5"),children:[e.jsx(he,{className:"h-[18px] w-[18px] text-oai-gray-500 dark:text-oai-gray-400",strokeWidth:1.75}),a("login_modal.continue_email")]})]})]})]})}export{je as L};