@askdkc/dsh-cli 0.11.3

package/node_modules/@askdkc/dsh-auth/lib/interaction.js

@@ -0,0 +1,193 @@
+/**
+ * The `AuthInteraction` bridge: pi-ai OAuth flows speak prompts and events;
+ * every interactive surface in this ecosystem speaks `ctx.userQuestions`.
+ *
+ * `prompt()` maps one pi-ai prompt onto one question — `select` prompts carry
+ * their options, text/secret/manual-code prompts expect the custom-answer
+ * input row.
+ *
+ * `notify()` restores the host contract pi-ai's browser flows assume: the
+ * `auth_url` / `device_code` events expect the *host* to open the browser
+ * (their authorize URLs run hundreds of characters — wrapped across panel
+ * lines they are unclickable, and hand-copying picks up wrap artifacts that
+ * corrupt the encoded `redirect_uri`, which the provider then rejects). So
+ * the bridge opens the URL itself, then shows one waiting panel carrying
+ * copy / reopen / cancel actions until the flow settles. The device-code
+ * path gets the same treatment: its short code is the thing to copy, and
+ * the verification page is auto-opened too.
+ *
+ * One `AbortController` owns the whole run: pi-ai reads `interaction.signal`
+ * to abort the flow, every ask request carries it so surfaces close their
+ * panels, and the waiting panel's cancel action fires it.
+ *
+ * Nothing here assumes a browser or GUI *exists* (TUI-RUN-001): when no
+ * opener or clipboard helper is available the panel degrades to showing the
+ * URL / code verbatim with a clear note, and where no question provider is
+ * registered at all, `ask` rejects and the login command turns that into a
+ * clear refusal.
+ *
+ * @module dsh-auth/interaction
+ */
+import { copyToClipboard, openInBrowser } from './opener.js';
+/** Human-readable copy for one notify event. */
+export function describeEvent(event) {
+    switch (event.type) {
+        case 'auth_url':
+            return `Open this URL to authorize (a local callback completes sign-in):\n${event.url}`;
+        case 'device_code':
+            return `Visit ${event.verificationUri} and enter this code:\n  ${event.userCode}`;
+        case 'info':
+        case 'progress':
+            return event.message;
+    }
+}
+const CANCEL = 'Cancel sign-in';
+const OPEN_AGAIN = 'Open browser again';
+const COPY_LINK = 'Copy authorization link';
+const COPY_CODE = 'Copy code';
+/** One answer row, or a thrown error when the surface returned nothing usable. */
+function singleAnswer(answer) {
+    const row = answer.answers[0];
+    if (row === undefined)
+        throw new Error('dsh-auth: the question surface returned no answer');
+    return { selected: row.selected[0], custom: row.custom };
+}
+function authUrlView(url, instructions, opened) {
+    const lead = opened
+        ? 'Authorization page opened in your browser — complete the sign-in there.\n'
+            + 'If it did not open, copy the link below and open it by hand.'
+        : `Open this URL to authorize${instructions === undefined ? '' : ` — ${instructions}`}\n`
+            + 'Copy the link below (it is too long to select reliably once wrapped):';
+    return { body: `${lead}\n${url}`, copyLabel: COPY_LINK, copyText: url, reopenUrl: url };
+}
+function deviceCodeView(userCode, verificationUri, opened) {
+    const lead = opened
+        ? `Enter this code on the page opened in your browser (${verificationUri}):`
+        : `Visit ${verificationUri} and enter this code:`;
+    return { body: `${lead}\n  ${userCode}`, copyLabel: COPY_CODE, copyText: userCode, reopenUrl: verificationUri };
+}
+/**
+ * The bridge for one login run. At most one waiting panel exists at a time;
+ * `settle()` retires it when the flow ends (any outcome), so a completed or
+ * failed login never leaves an interactive dead end on screen.
+ */
+export class QuestionBridge {
+    ask;
+    runAbort;
+    signal;
+    openUrl;
+    copy;
+    waiting;
+    waitingClosed = false;
+    constructor(ask, runAbort, helpers = {}) {
+        this.ask = ask;
+        this.runAbort = runAbort;
+        this.signal = runAbort.signal;
+        this.openUrl = helpers.openUrl ?? openInBrowser;
+        this.copy = helpers.copyText ?? copyToClipboard;
+    }
+    async prompt(prompt) {
+        const question = prompt.type === 'select'
+            ? {
+                id: 'dsh-auth-prompt',
+                header: 'dsh-auth',
+                question: prompt.message,
+                options: prompt.options.map(option => ({
+                    label: option.label,
+                    ...(option.description === undefined ? {} : { description: option.description }),
+                })),
+            }
+            : {
+                id: prompt.type === 'secret' ? 'dsh-auth-secret' : 'dsh-auth-prompt',
+                header: 'dsh-auth',
+                question: prompt.message,
+                ...(prompt.placeholder === undefined ? {} : { detail: prompt.placeholder }),
+            };
+        const answer = singleAnswer(await this.ask({
+            questions: [question],
+            signal: prompt.signal === undefined ? this.signal : AbortSignal.any([prompt.signal, this.signal]),
+        }));
+        if (prompt.type === 'select') {
+            const label = answer.selected;
+            const option = label === undefined ? undefined : prompt.options.find(candidate => candidate.label === label);
+            if (option === undefined) {
+                if (answer.custom !== undefined && answer.custom !== '')
+                    return answer.custom;
+                throw new Error('dsh-auth: the selection answer did not match an offered option');
+            }
+            return option.id;
+        }
+        const custom = answer.custom?.trim();
+        if (custom === undefined || custom === '')
+            throw new Error('dsh-auth: the text answer was empty');
+        return custom;
+    }
+    notify(event) {
+        if (event.type === 'auth_url') {
+            if (this.waiting !== undefined)
+                return;
+            const opened = this.openUrl(event.url);
+            void this.runWaitingPanel(authUrlView(event.url, event.instructions, opened));
+            return;
+        }
+        if (event.type === 'device_code') {
+            if (this.waiting !== undefined)
+                return;
+            const opened = this.openUrl(event.verificationUri);
+            void this.runWaitingPanel(deviceCodeView(event.userCode, event.verificationUri, opened));
+        }
+        // info / progress lines are transient; the waiting panel already tells
+        // the user what to do, and the flow's next prompt carries its own copy.
+    }
+    /** Close the waiting panel (if any) and stop answering for this run. */
+    async settle() {
+        this.waitingClosed = true;
+        this.waiting?.controller.abort();
+        await this.waiting?.answer;
+        this.waiting = undefined;
+    }
+    /**
+     * Show the waiting panel until the flow settles or the user cancels,
+     * re-asking after a copy/reopen action with a one-line status prefix.
+     */
+    async runWaitingPanel(view) {
+        let body = view.body;
+        while (!this.waitingClosed) {
+            const controller = new AbortController();
+            const answer = this.ask({
+                questions: [{
+                        id: 'dsh-auth-waiting',
+                        header: 'dsh-auth',
+                        question: 'Waiting for authorization…',
+                        detail: body,
+                        options: [
+                            { label: view.copyLabel },
+                            ...(view.reopenUrl === undefined ? [] : [{ label: OPEN_AGAIN }]),
+                            { label: CANCEL },
+                        ],
+                    }],
+                signal: controller.signal,
+            })
+                .then(response => singleAnswer(response).selected)
+                .catch(() => undefined);
+            this.waiting = { controller, answer };
+            const picked = await answer;
+            this.waiting = undefined;
+            if (picked === undefined || this.waitingClosed)
+                return;
+            if (picked === CANCEL) {
+                this.runAbort.abort('user cancelled sign-in');
+                return;
+            }
+            if (picked === view.copyLabel) {
+                const copied = await this.copy(view.copyText);
+                body = `${copied ? 'Copied — paste it where you need it.' : 'Copy failed — no clipboard helper answered; select the text manually.'}\n${view.body}`;
+                continue;
+            }
+            if (picked === OPEN_AGAIN && view.reopenUrl !== undefined) {
+                this.openUrl(view.reopenUrl);
+                body = `Reopened in your browser.\n${view.body}`;
+            }
+        }
+    }
+}

package/node_modules/@askdkc/dsh-auth/lib/nous-oauth.d.ts

@@ -0,0 +1,5 @@
+import type { StoredOAuthCredential } from './credentials.js';
+import type { QuestionBridge } from './interaction.js';
+export declare function loginNous(bridge: QuestionBridge, clientId: string): Promise<StoredOAuthCredential>;
+/** Called only while CredentialFile.modify holds the cross-process lock. */
+export declare function refreshNous(current: StoredOAuthCredential, clientId: string): Promise<StoredOAuthCredential>;

package/node_modules/@askdkc/dsh-auth/lib/nous-oauth.js

@@ -0,0 +1,112 @@
+const PORTAL = 'https://portal.nousresearch.com';
+const DEVICE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+function object(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value : undefined;
+}
+async function post(path, fields, signal, headers = {}) {
+    let response;
+    try {
+        response = await fetch(`${PORTAL}${path}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded', ...headers },
+            body: new URLSearchParams(fields),
+            signal,
+        });
+    }
+    catch (error) {
+        if (signal.aborted) {
+            if (signal.reason?.name === 'TimeoutError') {
+                throw new Error('dsh-auth: Nous Portal request timed out');
+            }
+            throw new Error('dsh-auth: Nous sign-in cancelled');
+        }
+        throw new Error(`dsh-auth: Nous Portal request failed: ${error instanceof Error ? error.name : 'network error'}`);
+    }
+    let parsed;
+    try {
+        parsed = await response.json();
+    }
+    catch {
+        parsed = undefined;
+    }
+    return { response, data: object(parsed) ?? {} };
+}
+function credential(data) {
+    if (typeof data.access_token !== 'string' || data.access_token.length === 0
+        || typeof data.refresh_token !== 'string' || data.refresh_token.length === 0) {
+        throw new Error('dsh-auth: Nous Portal returned an incomplete token response');
+    }
+    const ttl = Number(data.expires_in);
+    if (!Number.isFinite(ttl) || ttl <= 0)
+        throw new Error('dsh-auth: Nous Portal returned an invalid token lifetime');
+    return { type: 'oauth', access: data.access_token, refresh: data.refresh_token, expires: Date.now() + ttl * 1000 };
+}
+function delay(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new Error('dsh-auth: Nous sign-in cancelled'));
+            return;
+        }
+        const timer = setTimeout(() => { signal.removeEventListener('abort', cancel); resolve(); }, ms);
+        const cancel = () => { clearTimeout(timer); reject(new Error('dsh-auth: Nous sign-in cancelled')); };
+        signal.addEventListener('abort', cancel, { once: true });
+    });
+}
+export async function loginNous(bridge, clientId) {
+    const requestSignal = () => AbortSignal.any([bridge.signal, AbortSignal.timeout(15_000)]);
+    const initial = await post('/api/oauth/device/code', { client_id: clientId, scope: 'inference:invoke' }, requestSignal());
+    if (!initial.response.ok)
+        throw new Error(`dsh-auth: Nous device authorization failed (HTTP ${initial.response.status})`);
+    const { data } = initial;
+    if (typeof data.device_code !== 'string' || typeof data.user_code !== 'string'
+        || typeof data.verification_uri !== 'string' || typeof data.verification_uri_complete !== 'string') {
+        throw new Error('dsh-auth: Nous Portal returned an invalid device authorization response');
+    }
+    const expiresIn = Number(data.expires_in);
+    if (!Number.isFinite(expiresIn) || expiresIn <= 0)
+        throw new Error('dsh-auth: Nous Portal returned an invalid device-code lifetime');
+    let interval = Number(data.interval);
+    interval = Number.isFinite(interval) && interval > 0 ? Math.min(interval, 30) : 5;
+    const deadline = Date.now() + expiresIn * 1000;
+    bridge.notify({ type: 'device_code', userCode: data.user_code, verificationUri: data.verification_uri_complete });
+    while (Date.now() < deadline) {
+        if (bridge.signal.aborted)
+            throw new Error('dsh-auth: Nous sign-in cancelled');
+        const next = await post('/api/oauth/token', {
+            grant_type: DEVICE_GRANT, client_id: clientId, device_code: data.device_code,
+        }, requestSignal());
+        if (next.response.ok)
+            return credential(next.data);
+        const code = next.data.error;
+        if (code === 'authorization_pending') {
+            await delay(interval * 1000, bridge.signal);
+            continue;
+        }
+        if (code === 'slow_down') {
+            interval = Math.min(interval + 1, 30);
+            await delay(interval * 1000, bridge.signal);
+            continue;
+        }
+        if (code === 'access_denied')
+            throw new Error('dsh-auth: Nous device authorization was denied');
+        if (code === 'expired_token')
+            throw new Error('dsh-auth: Nous device authorization expired; sign in again');
+        throw new Error(`dsh-auth: Nous device authorization failed (HTTP ${next.response.status})`);
+    }
+    throw new Error('dsh-auth: Nous device authorization expired; sign in again');
+}
+/** Called only while CredentialFile.modify holds the cross-process lock. */
+export async function refreshNous(current, clientId) {
+    const result = await post('/api/oauth/token', { grant_type: 'refresh_token', client_id: clientId }, AbortSignal.timeout(15_000), {
+        'x-nous-refresh-token': current.refresh,
+    });
+    if (!result.response.ok) {
+        const code = result.data.error;
+        if (code === 'invalid_grant' || code === 'refresh_token_reused' || result.response.status === 401) {
+            throw new Error('dsh-auth: Nous token expired or was revoked; run /auth login nous');
+        }
+        throw new Error(`dsh-auth: Nous token refresh failed (HTTP ${result.response.status})`);
+    }
+    return credential(result.data);
+}

package/node_modules/@askdkc/dsh-auth/lib/opener.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Best-effort host-side conveniences for OAuth flows: opening the default
+ * browser and copying short text to the clipboard.
+ *
+ * pi-ai's flows emit an `auth_url` event whose instructions assume the host
+ * opens the browser itself ("A browser window should open…"), because the
+ * authorize URL is hundreds of characters — unclickable and practically
+ * uncopyable once a terminal panel wraps it (wrap artifacts inside the
+ * encoded `redirect_uri` are exactly how hand-copied URLs die with
+ * `invalid_authorize_request`). These helpers restore that host contract.
+ * Every path is best-effort and never throws: a missing opener or clipboard
+ * degrades to the URL staying on screen with a copy action.
+ *
+ * @module dsh-auth/opener
+ */
+/** The browser-opening command for this platform, or undefined when unknown. */
+export declare function openerFor(url: string): {
+    command: string;
+    args: readonly string[];
+    verbatim: boolean;
+} | undefined;
+/**
+ * Open `url` in the default browser, detached; the TUI keeps running.
+ * @returns whether the opener process could be spawned at all (not whether
+ *   a browser eventually appeared — that is not observable here).
+ */
+export declare function openInBrowser(url: string): boolean;
+/**
+ * Copy `text` to the system clipboard, trying this platform's helpers in
+ * order. Resolves whether one succeeded; never rejects.
+ */
+export declare function copyToClipboard(text: string): Promise<boolean>;

package/node_modules/@askdkc/dsh-auth/lib/opener.js

@@ -0,0 +1,101 @@
+/**
+ * Best-effort host-side conveniences for OAuth flows: opening the default
+ * browser and copying short text to the clipboard.
+ *
+ * pi-ai's flows emit an `auth_url` event whose instructions assume the host
+ * opens the browser itself ("A browser window should open…"), because the
+ * authorize URL is hundreds of characters — unclickable and practically
+ * uncopyable once a terminal panel wraps it (wrap artifacts inside the
+ * encoded `redirect_uri` are exactly how hand-copied URLs die with
+ * `invalid_authorize_request`). These helpers restore that host contract.
+ * Every path is best-effort and never throws: a missing opener or clipboard
+ * degrades to the URL staying on screen with a copy action.
+ *
+ * @module dsh-auth/opener
+ */
+import { spawn } from 'node:child_process';
+/** The browser-opening command for this platform, or undefined when unknown. */
+export function openerFor(url) {
+    if (process.platform === 'win32') {
+        // cmd.exe parses `&` as a command separator, so an unquoted authorize
+        // URL (hundreds of chars of `?a=1&b=2…`) is truncated at the first `&`
+        // and the browser opens a param-less page — OpenAI answers "missing
+        // required parameter". Node only quotes argv containing spaces/quotes,
+        // which a URL has neither of, so the protection must be explicit: the
+        // whole `start` command rides as ONE verbatim argv token, with the URL
+        // double-quoted inside it (`start` treats a leading quoted arg as the
+        // window title, hence the empty "" first).
+        return {
+            command: 'cmd.exe',
+            args: ['/d', '/s', '/c', `start "" "${url}"`],
+            verbatim: true,
+        };
+    }
+    if (process.platform === 'darwin')
+        return { command: 'open', args: [url], verbatim: false };
+    return { command: 'xdg-open', args: [url], verbatim: false };
+}
+/**
+ * Open `url` in the default browser, detached; the TUI keeps running.
+ * @returns whether the opener process could be spawned at all (not whether
+ *   a browser eventually appeared — that is not observable here).
+ */
+export function openInBrowser(url) {
+    const opener = openerFor(url);
+    if (opener === undefined)
+        return false;
+    try {
+        const child = spawn(opener.command, [...opener.args], {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+            ...(opener.verbatim ? { windowsVerbatimArguments: true } : {}),
+        });
+        child.on('error', () => undefined);
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Feed `text` to one clipboard helper's stdin; resolves whether it exited 0. */
+function pipeTo(command, args, text) {
+    return new Promise(resolve => {
+        let child;
+        try {
+            child = spawn(command, [...args], { stdio: ['pipe', 'ignore', 'ignore'], windowsHide: true });
+        }
+        catch {
+            resolve(false);
+            return;
+        }
+        child.on('error', () => resolve(false));
+        child.on('close', code => resolve(code === 0));
+        child.stdin.on('error', () => resolve(false));
+        child.stdin.end(text);
+    });
+}
+/** Clipboard helper candidates per platform, in try order. */
+function clipboardCandidates() {
+    if (process.platform === 'win32')
+        return [{ command: 'clip.exe', args: [] }];
+    if (process.platform === 'darwin')
+        return [{ command: 'pbcopy', args: [] }];
+    return [
+        { command: 'wl-copy', args: [] },
+        { command: 'xclip', args: ['-selection', 'clipboard'] },
+        { command: 'xsel', args: ['--clipboard', '--input'] },
+    ];
+}
+/**
+ * Copy `text` to the system clipboard, trying this platform's helpers in
+ * order. Resolves whether one succeeded; never rejects.
+ */
+export async function copyToClipboard(text) {
+    for (const candidate of clipboardCandidates()) {
+        if (await pipeTo(candidate.command, candidate.args, text))
+            return true;
+    }
+    return false;
+}

package/node_modules/@askdkc/dsh-auth/lib/pi-ai.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The pi-ai instance owned by the installed dsh-llm-pi-ai adapter.
+ *
+ * dsh-llm-pi-ai rc.2 depends on pi-ai 0.82.x while alpha.1 depends on 0.84.x.
+ * Loading a second catalog from dsh-auth and handing its Provider objects to
+ * the adapter crosses package instances and is neither type- nor runtime-safe.
+ * Resolve the adapter's own dependency instead, and derive every public type
+ * from the adapter contract so this package owns no pi-ai version.
+ */
+import type { PiAiAdapterOptions, ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+export type PiAiProvider = NonNullable<ResolvedPiAiProviderProfile['piProvider']>;
+type PiAiAuth = PiAiAdapterOptions['auth'];
+export type PiAiAuthContext = PiAiAuth['authContext'];
+export type PiAiCredentialStore = PiAiAuth['credentials'];
+export type PiAiCredential = NonNullable<Awaited<ReturnType<PiAiCredentialStore['read']>>>;
+export type PiAiCredentialInfo = Awaited<ReturnType<PiAiCredentialStore['list']>>[number];
+type PiAiOAuth = NonNullable<PiAiProvider['auth']['oauth']>;
+export type PiAiAuthInteraction = Parameters<PiAiOAuth['login']>[0];
+export type PiAiAuthPrompt = Parameters<PiAiAuthInteraction['prompt']>[0];
+export type PiAiAuthEvent = Parameters<PiAiAuthInteraction['notify']>[0];
+/** Fresh Provider objects from the exact pi-ai module used by dsh-llm-pi-ai. */
+export declare const adapterBuiltinProviders: () => readonly PiAiProvider[];
+export {};

package/node_modules/@askdkc/dsh-auth/lib/pi-ai.js

@@ -0,0 +1,27 @@
+/**
+ * The pi-ai instance owned by the installed dsh-llm-pi-ai adapter.
+ *
+ * dsh-llm-pi-ai rc.2 depends on pi-ai 0.82.x while alpha.1 depends on 0.84.x.
+ * Loading a second catalog from dsh-auth and handing its Provider objects to
+ * the adapter crosses package instances and is neither type- nor runtime-safe.
+ * Resolve the adapter's own dependency instead, and derive every public type
+ * from the adapter contract so this package owns no pi-ai version.
+ */
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+/** Locate the first pi-ai catalog Node would resolve from dsh-llm-pi-ai. */
+function adapterCatalogUrl() {
+    const adapterManifest = import.meta.resolve('@deepseek-ai/dsh-llm-pi-ai/package.json');
+    const require = createRequire(adapterManifest);
+    for (const root of require.resolve.paths('@earendil-works/pi-ai') ?? []) {
+        const catalog = join(root, '@earendil-works', 'pi-ai', 'dist', 'providers', 'all.js');
+        if (existsSync(catalog))
+            return pathToFileURL(catalog).href;
+    }
+    throw new Error('dsh-auth: dsh-llm-pi-ai has no resolvable pi-ai provider catalog');
+}
+const catalog = await import(adapterCatalogUrl());
+/** Fresh Provider objects from the exact pi-ai module used by dsh-llm-pi-ai. */
+export const adapterBuiltinProviders = catalog.builtinProviders;

package/node_modules/@askdkc/dsh-auth/lib/profiles.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Catalog provider routes this plugin owns, mounted with their catalog
+ * models, wire implementations, and authentication methods intact.
+ *
+ * The hand-built profile mirrors what an empty llm-pi-ai settings profile
+ * resolves to for a catalog route, including the image-request defaults
+ * (llm-pi-ai's own `DEFAULT_*` constants are not exported; the values below
+ * are those constants, and the comment on each says so).
+ *
+ * @module dsh-auth/profiles
+ */
+import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+import { type PiAiProvider } from './pi-ai.js';
+/** Provider routes this build mounts, in picker order. */
+export declare const OAUTH_PROVIDER_IDS: readonly ["openai-codex", "anthropic", "xai"];
+export declare const CATALOG_PROVIDER_IDS: readonly ["openai-codex", "anthropic", "xai", "opencode", "opencode-go", "openrouter"];
+export declare const AUTH_PROVIDER_IDS: readonly ["openai-codex", "anthropic", "xai", "opencode", "opencode-go", "openrouter", "orcarouter", "nous", "infron"];
+export declare const PROVIDER_ALIASES: Readonly<Record<string, string>>;
+export declare function canonicalProvider(id: string): string;
+/** One routable provider id. */
+export type OAuthProviderId = (typeof OAUTH_PROVIDER_IDS)[number];
+/**
+ * One per-model catalog override a deployment may name, keyed by model id.
+ * Every field is optional; an absent field keeps the installed catalog's
+ * value, so one model's capacity can be tuned without restating the rest.
+ */
+export interface ModelOverride {
+    /** Override the installed catalog's context window, in tokens. */
+    contextWindow?: number;
+    /** Override the installed catalog's max output tokens. */
+    maxTokens?: number;
+}
+/** The OAuth flow object for one mounted route (login/refresh/toAuth live here). */
+export declare function oauthOf(route: PiAiProvider): NonNullable<PiAiProvider['auth']['oauth']>;
+/**
+ * Build the resolved profile one route registers under. Mirrors the fields
+ * `PiAiAdapter` reads: identity for selectors, the idle timeout, retry
+ * policy, and image budgets it forwards per request, and the catalog provider
+ * with its own models. Everything optional stays absent — the adapter treats
+ * absence as "provider defaults" exactly as an empty llm-pi-ai profile would.
+ * @param id - the OAuth provider route to mount.
+ * @param modelOverrides - optional per-model catalog overrides (see
+ *   {@link ModelOverride}); `undefined` serves the installed catalog unchanged.
+ */
+export declare function buildOAuthProfile(id: string, modelOverrides?: Readonly<Record<string, ModelOverride>>): ResolvedPiAiProviderProfile;

package/node_modules/@askdkc/dsh-auth/lib/profiles.js

@@ -0,0 +1,110 @@
+/**
+ * Catalog provider routes this plugin owns, mounted with their catalog
+ * models, wire implementations, and authentication methods intact.
+ *
+ * The hand-built profile mirrors what an empty llm-pi-ai settings profile
+ * resolves to for a catalog route, including the image-request defaults
+ * (llm-pi-ai's own `DEFAULT_*` constants are not exported; the values below
+ * are those constants, and the comment on each says so).
+ *
+ * @module dsh-auth/profiles
+ */
+import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
+import { adapterBuiltinProviders } from './pi-ai.js';
+/** Provider routes this build mounts, in picker order. */
+export const OAUTH_PROVIDER_IDS = ['openai-codex', 'anthropic', 'xai'];
+export const CATALOG_PROVIDER_IDS = [...OAUTH_PROVIDER_IDS, 'opencode', 'opencode-go', 'openrouter'];
+export const AUTH_PROVIDER_IDS = [...CATALOG_PROVIDER_IDS, 'orcarouter', 'nous', 'infron'];
+export const PROVIDER_ALIASES = {
+    hermes: 'nous',
+    'infron.ai': 'infron',
+    'opencode-zen': 'opencode',
+};
+export function canonicalProvider(id) {
+    return PROVIDER_ALIASES[id] ?? id;
+}
+/** llm-pi-ai `DEFAULT_MAX_REQUEST_IMAGE_BYTES` (20 MiB, base64 payload bound). */
+const MAX_REQUEST_IMAGE_BYTES = 20 * 1024 * 1024;
+/** llm-pi-ai `DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET` (2048×2048 pixels). */
+const REQUEST_IMAGE_PIXEL_BUDGET = 2048 * 2048;
+/** llm-pi-ai `DEFAULT_REQUEST_IMAGE_MAX_BYTES` (1 MiB per image). */
+const REQUEST_IMAGE_MAX_BYTES = 1024 * 1024;
+/** llm-pi-ai `DEFAULT_STREAM_IDLE_TIMEOUT_MS` (5 minutes). */
+const STREAM_IDLE_TIMEOUT_MS = 300_000;
+/** The installed pi-ai catalog provider for one route, whose OAuth flow we mount. */
+function catalogProviderOf(id) {
+    const found = adapterBuiltinProviders().find(provider => provider.id === id);
+    if (found === undefined) {
+        throw new Error(`dsh-auth: the installed pi-ai catalog ships no provider "${id}"; `
+            + 'remove it from this plugin\'s providers config or update pi-ai');
+    }
+    return found;
+}
+/** The OAuth flow object for one mounted route (login/refresh/toAuth live here). */
+export function oauthOf(route) {
+    const oauth = route.auth.oauth;
+    if (oauth === undefined) {
+        throw new Error(`dsh-auth: pi-ai provider "${route.id}" ships no OAuth flow`);
+    }
+    return oauth;
+}
+/**
+ * Apply per-model overrides to one catalog provider. Only the touched model
+ * entries are cloned — the installed catalog objects are shared module state
+ * and must never be mutated in place — and a miss is refused, never skipped,
+ * so a typo lands as a boot error instead of a silently unchanged model.
+ * @param catalog - the installed pi-ai catalog provider for one route.
+ * @param overrides - per-model field overrides, keyed by model id.
+ * @returns the catalog provider, or a shallow clone carrying overridden models.
+ */
+function withModelOverrides(catalog, overrides) {
+    if (overrides === undefined || Object.keys(overrides).length === 0)
+        return catalog;
+    const catalogModels = new Map(catalog.getModels().map(model => [model.id, model]));
+    for (const id of Object.keys(overrides)) {
+        if (!catalogModels.has(id)) {
+            throw new Error(`dsh-auth: modelOverrides names "${id}", which provider "${catalog.id}" does not ship in the installed catalog`);
+        }
+    }
+    const models = catalog.getModels().map(model => {
+        const override = overrides[model.id];
+        if (override === undefined)
+            return model;
+        return { ...model, ...override };
+    });
+    return {
+        ...catalog,
+        getModels: () => models,
+    };
+}
+/**
+ * Build the resolved profile one route registers under. Mirrors the fields
+ * `PiAiAdapter` reads: identity for selectors, the idle timeout, retry
+ * policy, and image budgets it forwards per request, and the catalog provider
+ * with its own models. Everything optional stays absent — the adapter treats
+ * absence as "provider defaults" exactly as an empty llm-pi-ai profile would.
+ * @param id - the OAuth provider route to mount.
+ * @param modelOverrides - optional per-model catalog overrides (see
+ *   {@link ModelOverride}); `undefined` serves the installed catalog unchanged.
+ */
+export function buildOAuthProfile(id, modelOverrides) {
+    if (!CATALOG_PROVIDER_IDS.includes(id)) {
+        throw new Error(`dsh-auth: "${id}" is not a catalog provider this build mounts (${CATALOG_PROVIDER_IDS.join(', ')})`);
+    }
+    const catalog = withModelOverrides(catalogProviderOf(id), modelOverrides);
+    return {
+        provider: id,
+        displayName: catalog.name,
+        streamIdleTimeoutMs: STREAM_IDLE_TIMEOUT_MS,
+        retryPolicy: resolveRetryPolicy(undefined, `dsh-auth: provider "${id}" retryPolicy`),
+        configuredMaxTokens: new Map(),
+        piProvider: catalog,
+        // Required since 0.1.5 (per-model pre-request diagnostics); this build
+        // reports none. Older adapters never read the field, so carrying it is
+        // harmless on a pre-0.1.5 host.
+        modelErrors: new Map(),
+        maxRequestImageBytes: MAX_REQUEST_IMAGE_BYTES,
+        requestImagePixelBudget: REQUEST_IMAGE_PIXEL_BUDGET,
+        requestImageMaxBytes: REQUEST_IMAGE_MAX_BYTES,
+    };
+}