@askdkc/dsh-cli 0.11.3

package/node_modules/@askdkc/dsh-auth/README.md

@@ -0,0 +1,163 @@
+# @askdkc/dsh-auth
+
+English | [日本語](README.ja.md)
+
+> Provider authentication for [dsh-TUI](https://github.com/ccch1mneyyy/dsh-TUI) and
+> [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
+
+Use **ChatGPT, Claude, SuperGrok, OpenCode Zen/Go, OrcaRouter, OpenRouter,
+Nous Portal, and Infron** as model providers with OAuth, device code, or an
+API key according to the provider. No dsh source patch is needed. This plugin is developed alongside (and
+bundled into) [dsh-TUI](https://github.com/ccch1mneyyy/dsh-TUI), the
+Claude Code style terminal front door for DeepSeek Harness; it also installs
+standalone into any dsh profile.
+
+```
+dsh-tui → /provider → Provider authentication → sign in
+          /auth login openai-codex                     ← the plugin command
+          /model → OpenAI Codex → gpt-5.6-sol          ← routes & models
+```
+
+**Status: experimental.** Catalog OAuth flows are
+[pi-ai](https://www.npmjs.com/package/@earendil-works/pi-ai)'s shipped
+implementations (device-code and loopback callback included); this plugin
+adds the hosting: credential storage, automatic token refresh, adapter
+registration, and a login surface over the `userQuestions` seam that works in
+the TUI, the web client, and refuses cleanly on headless hosts.
+
+## Install
+
+**With dsh-TUI** — nothing to do: dsh-auth ships inside the dsh-tui package
+(bundled dependency). Update dsh-tui and the `/provider` wizard gains its
+provider authentication branch automatically.
+
+**Standalone, into any dsh profile:**
+
+```sh
+dsh plugin --profile <name> add @askdkc/dsh-auth
+```
+
+Then restart the host; `/` lists `auth`, and every model picker gains the
+signed-in providers' catalogs (credential-gated — see below).
+
+## What it does
+
+- Mounts pi-ai catalog providers as `llm` registry routes:
+  `openai-codex`, `anthropic`, `xai`, `opencode`, `opencode-go`, and `openrouter`.
+  **Models appear in a picker
+  only after that provider is signed in** (credential-gated listing) — sign
+  in and the catalog appears, sign out and it disappears; model ids already
+  saved in sessions stay resolvable either way.
+- Loads those Provider objects from the exact pi-ai dependency owned by the
+  installed `dsh-llm-pi-ai`. rc and alpha hosts therefore keep their supported
+  pi-ai versions without passing Provider objects across package instances.
+- `/auth login [provider]` runs the selected authentication method interactively. The
+  waiting panel behaves the way pi's host does: the authorization URL is
+  **opened in your browser automatically** (never hand-copied — the URL is
+  hundreds of characters and wrap artifacts corrupt its `redirect_uri`),
+  and the panel offers *Copy authorization link* / *Open browser again* /
+  *Cancel sign-in*. Device-code flows open the verification page and make
+  the short code the copy target. OpenAI Codex also offers a device-code
+  login method — the most robust path on headless or locked-down machines
+  (no localhost:1455 callback needed).
+- OpenCode Zen/Go accept API keys. OpenRouter offers pi-ai's OAuth PKCE flow
+  or a manual API key. `orcarouter`, `nous`, and `infron` use Chat Completions;
+  their `/models` listings must provide capacity and pricing metadata before
+  a model is selectable. `nous` offers device-code OAuth and an explicitly
+  selected manual Bearer token compatibility path. The latter has not been
+  validated against a real Nous account.
+- Stored access tokens refresh automatically before each request, serialized
+  per provider under the credential store's lock — concurrent requests never
+  double-refresh a rotated token.
+- `/auth status` / `/auth logout <provider>`; the `ctx.dshAuth` service
+  exposes the same api for UIs (the dsh-tui `/provider` wizard and `/login`
+  ride it).
+
+## Usage
+
+```
+/auth                          # status: which providers are signed in
+/auth login                    # pick a provider interactively
+/auth login openai-codex       # ChatGPT (Plus/Pro)
+/auth login anthropic          # Claude (Pro/Max)
+/auth login xai                # SuperGrok / X Premium
+/auth login opencode           # OpenCode Zen API key
+/auth login opencode-go        # OpenCode Go API key
+/auth login orcarouter         # OrcaRouter API key
+/auth login openrouter         # OAuth PKCE or API key
+/auth login nous               # device code or manual Bearer
+/auth login infron             # Infron API key
+/auth logout anthropic
+```
+
+Model requests against a provider you have not signed in to fail loudly with
+the `/auth login <provider>` hint — never silently.
+
+## Configuration
+
+```yaml
+- id: dsh-auth
+  name: '@askdkc/dsh-auth'
+  config:
+    providers: [openai-codex, anthropic, xai, opencode, opencode-go, orcarouter, openrouter, nous, infron]
+    nous:
+      clientId: hermes-cli
+    # credentialsFile: /secure/path/credentials.json
+```
+
+- `credentialsFile` defaults to `$DSH_HOME/dsh-auth/credentials.json`
+  (`~/.dsh/dsh-auth/credentials.json`), overridable with the
+  `DSH_AUTH_CREDENTIALS` environment variable. The directory is created
+  `0700`, the file `0600` (best-effort on Windows), and every write is
+  atomic (temp file + rename).
+- Aliases `opencode-zen`, `hermes`, and `infron.ai` resolve to `opencode`,
+  `nous`, and `infron`. Credentials are stored under canonical IDs.
+- The Nous client ID defaults to `hermes-cli`; third-party reuse of this ID is
+  not guaranteed by Nous. Set `nous.clientId` if your deployment has its own.
+- A route another adapter family already owns — an `llm-pi-ai` settings
+  profile naming the same provider — is refused by the registry; the plugin
+  logs the refusal and mounts the remaining routes. Keep one provider on one
+  adapter.
+
+## Security notes
+
+- The credential file holds **API keys and long-lived refresh tokens**. It is never
+  logged, never echoed through status surfaces (`/auth status` shows expiry
+  metadata only), and a corrupt file fails loudly instead of being
+  overwritten.
+- dsh-TUI masks API-key input and redacts it from questionnaire summaries.
+- Login refuses to run where no interactive surface is registered (no
+  browser/GUI assumptions — remote and headless hosts get a clear error,
+  per the ecosystem spec's remote-determinism rule, TUI-RUN-001).
+- Subscription authentication and API-key access are different products:
+  ChatGPT Codex and Claude Pro/Max use their subscription backends; the new
+  API-key routes use each service's API backend.
+
+## Development
+
+```sh
+pnpm install
+pnpm verify     # build + headless smoke (credential store, refresh
+                # serialization, prompt bridging, gating, service api)
+```
+
+The smoke suite runs without cordis or a harness: the pure modules are
+exercised directly. Real end-to-end login needs an interactive host
+(dsh-tui) and is verified manually per release. The plugin is developed in
+the [dsh-TUI repository](https://github.com/ccch1mneyyy/dsh-TUI) as the
+`dsh-auth/` submodule and mirrors to this repository.
+
+## Roadmap
+
+- **M2** *(landed)* — dsh-tui integration: `/provider` OAuth branch, `/login`
+  account section, two-level `/model` picker with a pinned recently-used
+  group.
+- **M3** — `dsh-ecosystem-spec` conformance (manifest validation, admission
+  fixtures) plus the remaining pi-ai OAuth providers (GitHub Copilot,
+  Kimi); community list entry.
+- **M4** — Gemini: a custom Google device-code flow (pi-ai ships none; this
+  is the one wheel this project plans to build itself).
+
+## License
+
+MIT

package/node_modules/@askdkc/dsh-auth/cordis.patch.yml

@@ -0,0 +1,11 @@
+# @askdkc/dsh-auth bundle patch: mounts provider authentication
+# provider routes and the /auth command as a profile layer
+# (`dsh plugin --profile <name> add @askdkc/dsh-auth`).
+#
+# Entry-level inject — never a code-level one (see the plugin module's
+# `inject` export): a stale patch must not deadlock a composition whose
+# llm/commands services arrive later or are absent entirely.
+- insert:
+    - id: dsh-auth
+      name: '@askdkc/dsh-auth'
+      inject: [llm, commands]

package/node_modules/@askdkc/dsh-auth/dsh-plugin.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://dsh.community/schemas/dsh-plugin-0.15.json",
+  "id": "com.dsh-tui.dsh-auth",
+  "name": "dsh-auth",
+  "version": "0.1.0",
+  "manifestVersion": "0.15",
+  "description": "Subscription OAuth sign-in (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as LLM provider routes for DeepSeek Harness. Registers llm adapter routes through the cordis llm registry; interactive login runs over the user-questions seam and degrades to a clear refusal when no interactive surface is present.",
+  "facets": {
+    "host": {
+      "entry": "lib/index.js",
+      "apiVersion": "v1alpha1"
+    }
+  },
+  "requires": {
+    "contracts": [
+      {
+        "apiVersion": "commands.dsh/v1alpha1",
+        "kind": "Command"
+      },
+      {
+        "apiVersion": "user-questions.dsh/v1alpha1",
+        "kind": "UserQuestions",
+        "optional": true,
+        "fallback": "login refuses with guidance instead of assuming a browser or GUI is present (TUI-RUN-001)"
+      }
+    ]
+  },
+  "contributes": {
+    "commands": [
+      {
+        "id": "dsh.auth",
+        "title": "Sign in with a provider subscription (OAuth)"
+      }
+    ]
+  },
+  "permissions": [
+    {
+      "name": "commands.invoke",
+      "scope": "dsh.auth",
+      "reason": "run /auth status|login|logout from any composed command surface"
+    }
+  ],
+  "license": "MIT"
+}

package/node_modules/@askdkc/dsh-auth/lib/command.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The `/auth` command: a textual veneer over the {@link DshAuthApi} — status
+ * listing, login (optionally picking the provider interactively), logout.
+ *
+ * @module dsh-auth/command
+ */
+import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands';
+import type { DshAuthApi } from './service.js';
+/**
+ * Build the `/auth` handler. Every failure returns a `CommandResult`, never a
+ * rejection the host would have to translate; unexpected throws still
+ * propagate for the host's own error surface.
+ */
+export declare function createAuthCommandHandler(api: DshAuthApi): (invocation: CommandInvocation) => Promise<CommandResult>;

package/node_modules/@askdkc/dsh-auth/lib/command.js

@@ -0,0 +1,70 @@
+/**
+ * The `/auth` command: a textual veneer over the {@link DshAuthApi} — status
+ * listing, login (optionally picking the provider interactively), logout.
+ *
+ * @module dsh-auth/command
+ */
+const USAGE = 'Usage: /auth [status] | /auth login [provider] | /auth logout <provider>';
+function renderStatus(rows) {
+    const lines = rows.map(row => {
+        const state = row.signedIn
+            ? `signed in (${row.credentialKind ?? 'credential'})${row.expiresAt === undefined ? '' : ` — token expires ${new Date(row.expiresAt).toISOString()}`}`
+            : row.expired
+                ? 'signed in, token expired — /auth login to refresh'
+                : 'not signed in';
+        return `  ${row.provider.padEnd(14)} ${state}`;
+    });
+    return ['dsh-auth providers:', ...lines].join('\n');
+}
+/** Split the raw input into at most two lowercase words: verb and target. */
+function parseArgs(raw) {
+    const words = raw.trim().split(/\s+/u).filter(word => word !== '');
+    const verb = words[0]?.toLowerCase();
+    const target = words[1];
+    return { verb: words.length === 0 ? undefined : verb, target, extra: words.length > 2 };
+}
+/**
+ * Build the `/auth` handler. Every failure returns a `CommandResult`, never a
+ * rejection the host would have to translate; unexpected throws still
+ * propagate for the host's own error surface.
+ */
+export function createAuthCommandHandler(api) {
+    return async (invocation) => {
+        const { verb, target, extra } = parseArgs(invocation.rawInput);
+        if (extra)
+            return { kind: 'error', text: USAGE };
+        if (verb === undefined || verb === 'status') {
+            if (target !== undefined)
+                return { kind: 'error', text: USAGE };
+            return { kind: 'success', text: renderStatus(await api.providers()) };
+        }
+        if (verb === 'login') {
+            try {
+                const result = await api.login(target, invocation.signal);
+                return {
+                    kind: 'success',
+                    text: `Signed in to ${result.oauthLabel} (${result.provider}) with ${result.credentialKind}`
+                        + `${result.expiresAt === undefined ? '' : `; token expires ${new Date(result.expiresAt).toISOString()}`}.`
+                        + `${result.modelWarning === undefined ? ' Select a model via /model.' : ` Credential saved, but models are unavailable: ${result.modelWarning}`}`,
+                };
+            }
+            catch (error) {
+                return { kind: 'error', text: `dsh-auth: ${error instanceof Error ? error.message : String(error)}` };
+            }
+        }
+        if (verb === 'logout') {
+            if (target === undefined)
+                return { kind: 'error', text: USAGE };
+            try {
+                const removed = await api.logout(target);
+                return removed
+                    ? { kind: 'success', text: `Signed out of ${target}; its stored credential was removed.` }
+                    : { kind: 'error', text: `${target} was not signed in.` };
+            }
+            catch (error) {
+                return { kind: 'error', text: `dsh-auth: ${error instanceof Error ? error.message : String(error)}` };
+            }
+        }
+        return { kind: 'error', text: USAGE };
+    };
+}

package/node_modules/@askdkc/dsh-auth/lib/credentials.d.ts

@@ -0,0 +1,63 @@
+/**
+ * File-backed credential persistence: a pi-ai `CredentialStore` over
+ * one JSON document, one credential per provider id.
+ *
+ * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
+ * permissions best-effort on every platform. All mutations go through
+ * {@link CredentialFile.modify}, which serializes read-modify-write cycles
+ * across processes — pi-ai runs its OAuth refresh *inside* `modify`, so the
+ * exclusion keeps concurrent requests from double-refreshing a rotated
+ * token. The file is the single source of truth;
+ * nothing here ever logs token material, and {@link CredentialFile.describe}
+ * reports only non-secret metadata for status surfaces.
+ *
+ * @module dsh-auth/credentials
+ */
+import type { PiAiCredential, PiAiCredentialInfo, PiAiCredentialStore } from './pi-ai.js';
+/** The stored credential shapes from pi-ai. */
+export type StoredOAuthCredential = Extract<PiAiCredential, {
+    type: 'oauth';
+}>;
+export type StoredApiKeyCredential = Extract<PiAiCredential, {
+    type: 'api_key';
+}>;
+/** Narrow an unknown parsed value into a stored credential, or reject it. */
+export declare function asStoredCredential(value: unknown): PiAiCredential | undefined;
+/** Default credential file location: `$DSH_HOME/dsh-auth/credentials.json` (or `~/.dsh/…`). */
+export declare function defaultCredentialsFile(): string;
+/**
+ * The credential file. IO failures throw (loud, naming the path) rather than
+ * degrading to an empty store: silently treating a corrupt or unreadable
+ * credential file as "signed out everywhere" would strand every route behind
+ * a fresh login for no reason.
+ */
+export declare class CredentialFile implements PiAiCredentialStore {
+    readonly path: string;
+    /** Serialize all updates in this process; the file lock covers other processes. */
+    private chainTail;
+    constructor(path: string);
+    /** The stored credential for one provider, possibly expired. */
+    read(providerId: string): Promise<PiAiCredential | undefined>;
+    /** Stored credential metadata without resolving or exposing secrets. */
+    list(): Promise<readonly PiAiCredentialInfo[]>;
+    /**
+     * Serialized read-modify-write for one provider. `fn` sees the current
+     * credential; returning a new credential persists it, returning
+     * `undefined` leaves the entry unchanged. Resolves with the post-write
+     * credential. Rejections from `fn` propagate without touching the file.
+     */
+    modify(providerId: string, fn: (current: PiAiCredential | undefined) => Promise<PiAiCredential | undefined>): Promise<PiAiCredential | undefined>;
+    /** Remove one provider's credential (logout). */
+    delete(providerId: string): Promise<void>;
+    /** Non-secret metadata for every stored credential, for status surfaces. */
+    describe(): Promise<readonly {
+        provider: string;
+        credentialKind: 'oauth-token' | 'api-key';
+        expiresAt: number | undefined;
+        expired: boolean;
+    }[]>;
+    /** Hold a process-wide lock through reread, refresh/mutation, and atomic save. */
+    private withLock;
+    private load;
+    private save;
+}

package/node_modules/@askdkc/dsh-auth/lib/credentials.js

@@ -0,0 +1,204 @@
+/**
+ * File-backed credential persistence: a pi-ai `CredentialStore` over
+ * one JSON document, one credential per provider id.
+ *
+ * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
+ * permissions best-effort on every platform. All mutations go through
+ * {@link CredentialFile.modify}, which serializes read-modify-write cycles
+ * across processes — pi-ai runs its OAuth refresh *inside* `modify`, so the
+ * exclusion keeps concurrent requests from double-refreshing a rotated
+ * token. The file is the single source of truth;
+ * nothing here ever logs token material, and {@link CredentialFile.describe}
+ * reports only non-secret metadata for status surfaces.
+ *
+ * @module dsh-auth/credentials
+ */
+import { mkdirSync, readFileSync, renameSync, rmdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+/** Narrow an unknown parsed value into a stored credential, or reject it. */
+export function asStoredCredential(value) {
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const record = value;
+    if (record['type'] === 'api_key') {
+        return typeof record['key'] === 'string' && record['key'].length > 0
+            ? value
+            : undefined;
+    }
+    if (record['type'] !== 'oauth')
+        return undefined;
+    if (typeof record['access'] !== 'string' || typeof record['refresh'] !== 'string')
+        return undefined;
+    if (typeof record['expires'] !== 'number' || !Number.isFinite(record['expires']))
+        return undefined;
+    return value;
+}
+/** Default credential file location: `$DSH_HOME/dsh-auth/credentials.json` (or `~/.dsh/…`). */
+export function defaultCredentialsFile() {
+    const override = process.env['DSH_AUTH_CREDENTIALS'];
+    if (override !== undefined && override !== '')
+        return override;
+    const root = process.env['DSH_HOME'] ?? join(homedir(), '.dsh');
+    return join(root, 'dsh-auth', 'credentials.json');
+}
+const EMPTY_DOCUMENT = { version: 1, providers: {} };
+/**
+ * The credential file. IO failures throw (loud, naming the path) rather than
+ * degrading to an empty store: silently treating a corrupt or unreadable
+ * credential file as "signed out everywhere" would strand every route behind
+ * a fresh login for no reason.
+ */
+export class CredentialFile {
+    path;
+    /** Serialize all updates in this process; the file lock covers other processes. */
+    chainTail = Promise.resolve();
+    constructor(path) {
+        this.path = path;
+    }
+    /** The stored credential for one provider, possibly expired. */
+    async read(providerId) {
+        return (await this.load()).providers[providerId];
+    }
+    /** Stored credential metadata without resolving or exposing secrets. */
+    async list() {
+        const document = await this.load();
+        return Object.entries(document.providers).map(([providerId, credential]) => ({
+            providerId,
+            type: credential.type,
+        }));
+    }
+    /**
+     * Serialized read-modify-write for one provider. `fn` sees the current
+     * credential; returning a new credential persists it, returning
+     * `undefined` leaves the entry unchanged. Resolves with the post-write
+     * credential. Rejections from `fn` propagate without touching the file.
+     */
+    async modify(providerId, fn) {
+        return this.withLock(async () => {
+            const document = await this.load();
+            const current = document.providers[providerId];
+            const replacement = await fn(current);
+            if (replacement === undefined || replacement === current)
+                return current;
+            if (asStoredCredential(replacement) === undefined) {
+                throw new Error(`dsh-auth: refusing to store an invalid credential for "${providerId}"`);
+            }
+            await this.save({ ...document, providers: { ...document.providers, [providerId]: replacement } });
+            return replacement;
+        });
+    }
+    /** Remove one provider's credential (logout). */
+    async delete(providerId) {
+        await this.withLock(async () => {
+            const document = await this.load();
+            if (!(providerId in document.providers))
+                return;
+            const providers = { ...document.providers };
+            delete providers[providerId];
+            await this.save({ ...document, providers });
+        });
+    }
+    /** Non-secret metadata for every stored credential, for status surfaces. */
+    async describe() {
+        const document = await this.load();
+        const now = Date.now();
+        return Object.entries(document.providers).map(([provider, credential]) => {
+            const expiresAt = credential.type === 'oauth' && provider !== 'openrouter'
+                && credential.expires < 8_640_000_000_000_000
+                ? credential.expires
+                : undefined;
+            return {
+                provider,
+                credentialKind: credential.type === 'api_key' || provider === 'openrouter' ? 'api-key' : 'oauth-token',
+                expiresAt,
+                expired: expiresAt !== undefined && expiresAt <= now,
+            };
+        });
+    }
+    /** Hold a process-wide lock through reread, refresh/mutation, and atomic save. */
+    async withLock(operation) {
+        const previous = this.chainTail;
+        let releaseLocal;
+        this.chainTail = new Promise(resolve => { releaseLocal = resolve; });
+        await previous;
+        const lockPath = `${this.path}.lock`;
+        const deadline = Date.now() + 120_000;
+        try {
+            mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+            while (true) {
+                try {
+                    mkdirSync(lockPath, { mode: 0o700 });
+                    break;
+                }
+                catch (error) {
+                    if (error?.code !== 'EEXIST')
+                        throw error;
+                    if (Date.now() >= deadline) {
+                        throw new Error(`dsh-auth: timed out waiting for credential file lock ${lockPath}`);
+                    }
+                    await new Promise(resolve => setTimeout(resolve, 100));
+                }
+            }
+            try {
+                return await operation();
+            }
+            finally {
+                rmdirSync(lockPath);
+            }
+        }
+        finally {
+            releaseLocal();
+        }
+    }
+    async load() {
+        let text;
+        try {
+            text = readFileSync(this.path, 'utf8');
+        }
+        catch (error) {
+            if (error?.code === 'ENOENT') {
+                return EMPTY_DOCUMENT;
+            }
+            throw new Error(`dsh-auth: cannot read credential file ${this.path}: ${String(error)}`);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (error) {
+            throw new Error(`dsh-auth: credential file ${this.path} is not valid JSON (${String(error)}); `
+                + 'fix or remove the file by hand — it will not be overwritten silently');
+        }
+        if (typeof parsed !== 'object' || parsed === null) {
+            throw new Error(`dsh-auth: credential file ${this.path} has an unexpected shape; fix or remove it by hand`);
+        }
+        const record = parsed;
+        if (record['version'] !== 1 || typeof record['providers'] !== 'object'
+            || record['providers'] === null || Array.isArray(record['providers'])) {
+            throw new Error(`dsh-auth: credential file ${this.path} has an unexpected shape; fix or remove it by hand`);
+        }
+        const providers = Object.create(null);
+        for (const [provider, value] of Object.entries(record['providers'])) {
+            const credential = asStoredCredential(value);
+            if (credential === undefined) {
+                throw new Error(`dsh-auth: credential file ${this.path} holds an invalid entry for "${provider}"; fix or remove it by hand`);
+            }
+            providers[provider] = credential;
+        }
+        return { version: 1, providers };
+    }
+    async save(document) {
+        const text = JSON.stringify(document, null, 2) + '\n';
+        const directory = dirname(this.path);
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+        const temporary = join(directory, `.${Math.random().toString(36).slice(2)}.tmp`);
+        try {
+            writeFileSync(temporary, text, { mode: 0o600 });
+            renameSync(temporary, this.path);
+        }
+        catch (error) {
+            throw new Error(`dsh-auth: cannot write credential file ${this.path}: ${String(error)}`);
+        }
+    }
+}

package/node_modules/@askdkc/dsh-auth/lib/custom-profiles.d.ts

@@ -0,0 +1,26 @@
+import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+import { type ModelOverride } from './profiles.js';
+declare const CUSTOM: {
+    readonly orcarouter: {
+        readonly name: "OrcaRouter";
+        readonly baseURL: "https://api.orcarouter.ai/v1";
+    };
+    readonly nous: {
+        readonly name: "Hermes Agent / Nous Portal";
+        readonly baseURL: "https://inference-api.nousresearch.com/v1";
+    };
+    readonly infron: {
+        readonly name: "Infron";
+        readonly baseURL: "https://llm.onerouter.pro/v1";
+    };
+};
+export type CustomProviderId = keyof typeof CUSTOM;
+export declare const CUSTOM_PROVIDER_IDS: CustomProviderId[];
+export interface CustomProfile {
+    profile: ResolvedPiAiProviderProfile;
+    clear(): void;
+    refresh(key: string, signal?: AbortSignal): Promise<number>;
+}
+/** A strict catalog: missing capacity/pricing/endpoint evidence leaves a model unselectable. */
+export declare function createCustomProfile(id: CustomProviderId, overrides?: Readonly<Record<string, ModelOverride>>): CustomProfile;
+export {};