@eddyskywalker/dsh-chatgpt-subscription 0.2.21 → 0.3.1

package/lib/types/host/kimi-code/oauth.d.ts

@@ -0,0 +1,133 @@
+import { FileCredentialStore, type KimiCodeCredentials } from './token-store.ts';
+import type { KimiCodeLoginFlowStatus, KimiCodeRegion } from '../../shared/kimi-code-contracts.ts';
+/** Raised when the stored refresh token was rejected and a new login is required. */
+export declare class KimiCodeUnauthorizedError extends Error {
+    constructor(message: string);
+}
+/** Raised when a transient failure outlived its retry budget. */
+export declare class KimiCodeRetryableError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/** Raised when the user denied the device authorization request. */
+export declare class KimiCodeAccessDeniedError extends Error {
+    constructor(message: string);
+}
+/** Test seam: forget every remembered rejection. */
+export declare function resetRefreshRejections(): void;
+/**
+ * Whether the given refresh token was recently rejected by the service.
+ *
+ * The settings card uses this to say "sign in again" instead of showing an
+ * account that merely looks signed in while every call is failing.
+ */
+export declare function isRefreshTokenRejected(refreshToken: string): boolean;
+/**
+ * Read the stable device id, creating it exactly once.
+ *
+ * The managed service treats this as the installation's identity. It is not a
+ * secret; it only has to stay stable, so a failed write degrades to a
+ * per-process value instead of failing the login.
+ */
+export declare function getDeviceId(): Promise<string>;
+/** Identity headers every Kimi Code OAuth and account request carries. */
+export declare function kimiIdentityHeaders(extra?: Record<string, string>): Promise<Record<string, string>>;
+/** Parsed device authorization response. */
+export interface DeviceAuthorization {
+    userCode: string;
+    deviceCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+}
+/**
+ * Start a device authorization (RFC 8628 section 3.1).
+ *
+ * A public client sends only its `client_id`; no scope, no PKCE.
+ */
+export declare function requestDeviceAuthorization(options?: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    region?: KimiCodeRegion;
+}): Promise<{
+    authorization: DeviceAuthorization;
+    host: string;
+}>;
+/** Identity claims a Kimi token carries about the signed-in account. */
+export interface KimiTokenIdentity {
+    userId?: string;
+    email?: string;
+}
+/**
+ * Decode one JWT payload without verifying it.
+ *
+ * Kimi's access and refresh tokens are JWTs whose payload names the account,
+ * and there is NO account-profile endpoint on the coding API — the identity
+ * exists only inside the token. The claims are read for display only and the
+ * token itself is what authenticates, so no signature check applies here.
+ */
+export declare function decodeJwtPayload(token: string): Record<string, unknown> | undefined;
+/**
+ * Account identity carried by a token pair.
+ *
+ * `user_id` is preferred across BOTH tokens before `sub` is considered: the two
+ * claims share an issuer namespace but `sub` is the weaker one, so a refresh
+ * token's `user_id` must beat an access token's `sub`.
+ */
+export declare function identityFromTokens(accessToken: string, refreshToken?: string): KimiTokenIdentity;
+/** OAuth token response, in the shape the rest of the plugin stores. */
+export interface OAuthToken {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    expiresIn: number;
+    scope: string;
+    tokenType: string;
+}
+/** How long before expiry a token must be replaced, from its own lifetime. */
+export declare function refreshThresholdMs(expiresIn: number): number;
+/**
+ * Refresh an access token, with the official client's bounded retry.
+ *
+ * Only a transient status or a transport failure is retried; a 401/403 (or an
+ * `invalid_grant` body) is a verdict that the refresh token is dead and stops
+ * immediately, because retrying it can never succeed.
+ */
+export declare function refreshAccessToken(refreshToken: string, options?: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    host?: string;
+    region?: KimiCodeRegion;
+}): Promise<OAuthToken>;
+export interface EnsureTokenOptions {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    /** Refresh even when the current token is not near expiry. */
+    force?: boolean;
+}
+/**
+ * Return a usable access token, refreshing and persisting when needed.
+ *
+ * Concurrent callers share one refresh request: a subscription is rate limited,
+ * and a burst of tool calls at token expiry would otherwise each try to rotate
+ * the same refresh token.
+ */
+export declare function ensureAccessToken(store: FileCredentialStore, options?: EnsureTokenOptions): Promise<KimiCodeCredentials>;
+export declare function getWebLoginStatus(): KimiCodeLoginFlowStatus;
+/** Reset the flow so a cancelled attempt cannot keep a later one from starting. */
+export declare function resetWebLogin(): void;
+export declare function openBrowser(url: string): void;
+/**
+ * Start the browser sign-in.
+ *
+ * Resolves immediately with the flow state the settings card polls; the device
+ * code is fetched, opened, and polled in the background so the HTTP request
+ * behind the button never has to stay open for the whole authorization.
+ */
+export declare function beginWebLogin(store: FileCredentialStore, options?: {
+    fetchFn?: typeof fetch;
+    openBrowser?: (url: string) => void;
+    region?: KimiCodeRegion;
+}): Promise<KimiCodeLoginFlowStatus>;
+//# sourceMappingURL=oauth.d.ts.map

package/lib/types/host/kimi-code/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/host/kimi-code/oauth.ts"],"names":[],"mappings":"AA+BA,OAAO,EACL,mBAAmB,EAInB,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AAclG,qFAAqF;AACrF,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,iEAAiE;AACjE,qBAAa,sBAAuB,SAAQ,KAAK;IAClB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAED,oEAAoE;AACpE,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AA0BD,oDAAoD;AACpD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAEpE;AAwBD;;;;;;GAMG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAgBnD;AAED,0EAA0E;AAC1E,wBAAsB,mBAAmB,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkB7G;AA4CD,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,GAAE;IACxD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,MAAM,CAAC,EAAE,cAAc,CAAA;CACnB,GAAG,OAAO,CAAC;IAAE,aAAa,EAAE,mBAAmB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCrE;AAuDD,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAanF;AAMD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAYhG;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAmBD,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5D;AAoBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CAAO,GACrG,OAAO,CAAC,UAAU,CAAC,CA6CrB;AASD,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAmD9B;AASD,wBAAgB,iBAAiB,IAAI,uBAAuB,CAE3D;AAED,mFAAmF;AACnF,wBAAgB,aAAa,IAAI,IAAI,CAIpC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAgB7C;AAyFD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CAAO,GACrG,OAAO,CAAC,uBAAuB,CAAC,CAiClC"}

package/lib/types/host/kimi-code/routes.d.ts

@@ -0,0 +1,26 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { PROVIDER_ID, PROVIDER_NAME } from './types.ts';
+import { FileCredentialStore, FileModelSettingsStore, type KimiCodeCatalogModel, type KimiCodePreferenceStore } from './token-store.ts';
+import { type KimiCodeWebStatus } from '../../shared/kimi-code-contracts.ts';
+/**
+ * The selection the card should show.
+ *
+ * A stored list that still equals the shipped default has never been edited, so
+ * it cannot know about models the live catalog has since added; treating it as
+ * "everything currently offered" keeps a first run from hiding the whole
+ * catalog behind an unedited default. Any explicit edit is honoured exactly.
+ */
+export declare function resolveEnabledModelIds(stored: readonly string[], catalog: readonly KimiCodeCatalogModel[]): string[];
+export interface KimiCodeStatusOptions {
+    fetchFn?: typeof fetch;
+    /** Whether this plugin currently owns the provider route; re-read on every status. */
+    serving?: boolean | (() => boolean);
+    /** Diagnostic when another plugin owns the provider route; re-read on every status. */
+    conflict?: string | null | (() => string | null);
+}
+/** Everything the settings card renders: account, quota, and the model catalog. */
+export declare function getKimiCodeWebStatus(store: FileCredentialStore, modelSettings: FileModelSettingsStore, preferences?: KimiCodePreferenceStore, options?: KimiCodeStatusOptions): Promise<KimiCodeWebStatus>;
+/** Register the Kimi Code settings routes under `/kimi-code/api`. */
+export declare function registerKimiCodeRoutes(ctx: Context, store: FileCredentialStore, modelSettings: FileModelSettingsStore, preferences?: KimiCodePreferenceStore, options?: KimiCodeStatusOptions): () => void;
+export { PROVIDER_ID, PROVIDER_NAME };
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/host/kimi-code/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../src/host/kimi-code/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAEL,WAAW,EACX,aAAa,EAId,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EAEtB,KAAK,oBAAoB,EAEzB,KAAK,uBAAuB,EAC7B,MAAM,kBAAkB,CAAA;AAazB,OAAO,EAML,KAAK,iBAAiB,EACvB,MAAM,qCAAqC,CAAA;AAqE5C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,OAAO,EAAE,SAAS,oBAAoB,EAAE,GACvC,MAAM,EAAE,CAYV;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IACnC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;CACjD;AAMD,mFAAmF;AACnF,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,sBAAsB,EACrC,WAAW,CAAC,EAAE,uBAAuB,EACrC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,iBAAiB,CAAC,CA0C5B;AAQD,qEAAqE;AACrE,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,mBAAmB,EAC1B,aAAa,EAAE,sBAAsB,EACrC,WAAW,CAAC,EAAE,uBAAuB,EACrC,OAAO,GAAE,qBAA0B,GAClC,MAAM,IAAI,CA+JZ;AAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA"}

package/lib/types/host/kimi-code/token-store.d.ts

@@ -0,0 +1,135 @@
+import type { SettingsProvider } from '@deepseek-ai/dsh-settings';
+import type { KimiCodeReasoningEffort, KimiCodeRegion } from '../../shared/kimi-code-contracts.ts';
+import type { CredentialStore } from '../token-store.ts';
+import { DEFAULT_OAUTH_HOST } from './types.ts';
+export declare const KIMI_CODE_PREFERENCES_NAMESPACE = "dsh-kimi-code";
+export type { KimiCodeReasoningEffort };
+/**
+ * One stored Kimi Code credential.
+ *
+ * Kimi Code is an OAuth subscription: the bearer pair rotates, so both tokens
+ * are kept and the access token is refreshed shortly before it expires. The
+ * remaining fields are non-secret account facts the settings card renders
+ * without another round trip.
+ */
+export interface KimiCodeCredentials {
+    /** Bearer access token for the coding API. Host-only; never sent to a browser. */
+    accessToken: string;
+    /** Rotating refresh token. Host-only. */
+    refreshToken: string;
+    /** Unix milliseconds the access token stops being valid. */
+    expiresAt: number;
+    /** Lifetime the token endpoint reported, in seconds. */
+    expiresIn: number;
+    scope?: string;
+    tokenType?: string;
+    /** Region the credential was issued in; decides which hosts are used. */
+    region: KimiCodeRegion;
+    /** OAuth host the credential came from, so a refresh targets the same one. */
+    oauthHost: string;
+    /** Coding API base URL the credential was issued for, without /v1. */
+    baseUrl: string;
+    userId?: string;
+    nickname?: string;
+    email?: string;
+    planName?: string;
+    /** Unix milliseconds the credential was obtained. */
+    authenticatedAt?: number;
+}
+export interface KimiCodeCatalogModel {
+    id: string;
+    name?: string;
+    contextWindow?: number;
+    reasoningEfforts?: string[];
+    defaultReasoningEffort?: string;
+    inputModalities?: Array<'text' | 'image' | 'video'>;
+    protocol?: 'openai' | 'anthropic';
+    /** Whether the model also accepts video input (reported; DSH cannot send it). */
+    supportsVideo?: boolean;
+    /** One-line description from the official model table. */
+    description?: string;
+    /** Subscription tier the model needs, when not every member has it. */
+    minimumPlan?: string | null;
+    /**
+     * Whether the model supports dynamically loaded tools.
+     *
+     * K3 advertises this: extra tool definitions can be injected mid-conversation
+     * as a system message carrying a `tools` array, keeping the top-level list
+     * small and stable. DSH has no equivalent concept, so this is reported for
+     * information rather than acted on.
+     */
+    supportsDynamicTools?: boolean;
+}
+export interface KimiCodeModelSettings {
+    enabledModelIds: string[];
+    catalogModels: KimiCodeCatalogModel[];
+    contextWindowOverrides: Record<string, number>;
+    defaultReasoningEffort: KimiCodeReasoningEffort | null;
+}
+export interface KimiCodePreferenceStore {
+    status(): KimiCodeModelSettings;
+    update(patch: {
+        enabledModelIds?: string[];
+        contextWindowOverrides?: Record<string, number>;
+        defaultReasoningEffort?: KimiCodeReasoningEffort | null;
+    }): Promise<KimiCodeModelSettings>;
+}
+/**
+ * Bind the model selection to the DSH settings document, which is what the
+ * settings service can persist durably; the JSON file beside it remains the
+ * store used when the plugin runs without a settings provider (headless tests).
+ */
+export declare function registerKimiCodePreferenceStore(settings?: SettingsProvider, fallbackStore?: FileModelSettingsStore): KimiCodePreferenceStore;
+export declare function credentialPath(): string;
+export declare function modelSettingsPath(): string;
+/** File the install channel uses to pin a region before the first login. */
+export declare function regionMarkerPath(): string;
+/**
+ * Stable per-installation device id the managed service expects.
+ *
+ * The official client writes this once and reuses it; it is not a secret, only
+ * an identity marker, so it lives beside the other plugin state.
+ */
+export declare function deviceIdPath(): string;
+export declare function parseKimiCodeCredentials(value: unknown): KimiCodeCredentials;
+/** Encrypted credential store; the plaintext JSON is only a migration source. */
+export declare class FileCredentialStore {
+    private readonly filePath;
+    private readonly backend;
+    constructor(filePath?: string, backend?: CredentialStore<KimiCodeCredentials>);
+    path(): string;
+    private serialize;
+    private removeLegacy;
+    private saveVerified;
+    read(): Promise<KimiCodeCredentials | null>;
+    write(credentials: KimiCodeCredentials): Promise<void>;
+    delete(): Promise<void>;
+}
+/** Plain-JSON model settings used when the settings service is unavailable. */
+export declare class FileModelSettingsStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    path(): string;
+    read(): Promise<KimiCodeModelSettings>;
+    write(settings: KimiCodeModelSettings): Promise<void>;
+    updateSettings(patch: {
+        enabledModelIds?: string[];
+        contextWindowOverrides?: Record<string, number>;
+        defaultReasoningEffort?: KimiCodeReasoningEffort | null;
+    }): Promise<KimiCodeModelSettings>;
+    setCatalogModels(catalogModels: KimiCodeCatalogModel[], options?: {
+        enabledModelIds?: string[];
+    }): Promise<KimiCodeModelSettings>;
+}
+/**
+ * Resolve the region this installation belongs to.
+ *
+ * Read locally, never probed: an environment pin wins, then the marker file the
+ * install channel may have written, then the default. A region only selects
+ * hosts, so an unknown marker is ignored rather than fatal.
+ */
+export declare function resolveRegion(env?: NodeJS.ProcessEnv): Promise<KimiCodeRegion>;
+/** Remember a region choice so a later status call reports the same one. */
+export declare function persistRegion(region: KimiCodeRegion): Promise<void>;
+export { DEFAULT_OAUTH_HOST };
+//# sourceMappingURL=token-store.d.ts.map

package/lib/types/host/kimi-code/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/host/kimi-code/token-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAiB,MAAM,2BAA2B,CAAA;AAGhF,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAA;AAElG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAKxD,OAAO,EAAE,kBAAkB,EAAwE,MAAM,YAAY,CAAA;AAErH,eAAO,MAAM,+BAA+B,kBAAkB,CAAA;AAE9D,YAAY,EAAE,uBAAuB,EAAE,CAAA;AAOvC;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,cAAc,CAAA;IACtB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAA;IACjB,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,CAAA;IACnD,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAA;IACjC,iFAAiF;IACjF,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,aAAa,EAAE,oBAAoB,EAAE,CAAA;IACrC,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,sBAAsB,EAAE,uBAAuB,GAAG,IAAI,CAAA;CACvD;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,IAAI,qBAAqB,CAAA;IAC/B,MAAM,CAAC,KAAK,EAAE;QACZ,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;QAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/C,sBAAsB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;KACxD,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CACnC;AAID;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,aAAa,yBAA+B,GAC3C,uBAAuB,CA0DzB;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAaD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAyC5E;AAoCD,iFAAiF;AACjF,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,QAAQ,SAAmB,EAC3B,OAAO,GAAE,eAAe,CAAC,mBAAmB,CAAqC;IAGpG,IAAI,IAAI,MAAM;IAMd,OAAO,CAAC,SAAS;YAWH,YAAY;YAUZ,YAAY;IAS1B,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IA8B3C,KAAK,CAAC,WAAW,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAOxB;AAED,+EAA+E;AAC/E,qBAAa,sBAAsB;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAsB;IAE3D,IAAI,IAAI,MAAM;IAIR,IAAI,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAgCtC,KAAK,CAAC,QAAQ,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrD,cAAc,CAAC,KAAK,EAAE;QAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;QAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/C,sBAAsB,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;KACxD,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAgB5B,gBAAgB,CACpB,aAAa,EAAE,oBAAoB,EAAE,EACrC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACvC,OAAO,CAAC,qBAAqB,CAAC;CAUlC;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBjG;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzE;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAA"}

package/lib/types/host/kimi-code/types.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Static facts about the Kimi Code provider API.
+ *
+ * Kimi Code is the subscription product (https://www.kimi.com/code); it is a
+ * different system from the pay-as-you-go Moonshot Open Platform, and its keys
+ * and base URLs are not interchangeable. The facts below are transcribed from
+ * the official CLI sources and documentation:
+ *
+ * - the OAuth device flow lives on auth.kimi.com and is implemented by
+ *   MoonshotAI/kimi-cli in src/kimi_cli/auth/oauth.py;
+ * - the managed provider is configured as type "kimi", an OpenAI-compatible
+ *   client, against https://api.kimi.com/coding/v1;
+ * - the same service documents https://api.kimi.com/coding/ as an Anthropic
+ *   Messages base URL for third-party tools;
+ * - account quota comes from GET /coding/v1/usages.
+ *
+ * See https://www.kimi.com/code/docs/en/kimi-code/models.html and
+ * https://www.kimi.com/code/docs/en/kimi-code/error-reference.html
+ */
+import type { KimiCodeReasoningEffort, KimiCodeRegion, KimiCodeWire } from '../../shared/kimi-code-contracts.ts';
+export declare const PROVIDER_ID = "kimi-code";
+export declare const PROVIDER_NAME = "Kimi Code";
+/**
+ * OAuth client id the official Kimi CLI registers.
+ *
+ * The device flow has no client secret: the client id alone identifies the
+ * public client, exactly as RFC 8628 intends for a device that cannot keep one.
+ */
+export declare const KIMI_CODE_CLIENT_ID = "17e5f671-d194-4dfb-9706-5516cb48c098";
+/** OAuth host serving /api/oauth/device_authorization and /api/oauth/token. */
+export declare const DEFAULT_OAUTH_HOST = "https://auth.kimi.com";
+/** Device authorization endpoint (RFC 8628 section 3.1). */
+export declare const DEVICE_AUTHORIZATION_PATH = "/api/oauth/device_authorization";
+/** Token endpoint for both the device-code grant and refresh (RFC 8628 section 3.4). */
+export declare const OAUTH_TOKEN_PATH = "/api/oauth/token";
+/** Grant type the device-code polling request declares. */
+export declare const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+/** Host set per region; a global account is served by the .ai properties. */
+export declare const REGION_HOSTS: Record<KimiCodeRegion, {
+    oauth: string;
+    coding: string;
+}>;
+/** OpenAI-compatible prefix; append /chat/completions or /models. */
+export declare const OPENAI_API_PREFIX = "/v1";
+export declare const USER_AGENT = "dsh-chatgpt-subscription (+https://github.com/Aa728848/dsh-chatgpt-subscription)";
+/**
+ * Product markers the managed service recognizes.
+ *
+ * The official client identifies itself as kimi_cli and reports a stable
+ * per-installation device id; sending the same vocabulary keeps the subscription
+ * endpoints answering the way they do for the official CLI.
+ */
+export declare const MSH_PLATFORM = "kimi_code_cli";
+export declare const HEADER_MSH_PLATFORM = "x-msh-platform";
+export declare const HEADER_MSH_VERSION = "x-msh-version";
+export declare const HEADER_MSH_DEVICE_NAME = "x-msh-device-name";
+export declare const HEADER_MSH_DEVICE_MODEL = "x-msh-device-model";
+export declare const HEADER_MSH_OS_VERSION = "x-msh-os-version";
+export declare const HEADER_MSH_DEVICE_ID = "x-msh-device-id";
+/** Version the plugin reports to the managed service's telemetry headers. */
+export declare const MSH_VERSION = "1.0.0";
+/**
+ * Refresh timing, copied from the official client.
+ *
+ * A token is refreshed once it is within max(300s, expires_in * 0.5) of expiry,
+ * so a short-lived token is replaced early enough to never be used while stale.
+ */
+export declare const MIN_REFRESH_THRESHOLD_SECONDS = 300;
+export declare const REFRESH_THRESHOLD_RATIO = 0.5;
+/** How long a rejected refresh token is remembered before a new attempt. */
+export declare const UNAUTHORIZED_REFRESH_RETRY_COOLDOWN_MS = 300000;
+/** Attempts one refresh gets before the stored credential is declared dead. */
+export declare const REFRESH_MAX_RETRIES = 3;
+/** Exponential backoff base for a retryable refresh failure. */
+export declare const REFRESH_BACKOFF_BASE_MS = 1000;
+/** Device-flow polling defaults when the service omits them. */
+export declare const DEFAULT_DEVICE_INTERVAL_SECONDS = 5;
+export declare const DEFAULT_DEVICE_EXPIRES_SECONDS = 600;
+/** Local timeouts and cache lifetimes. */
+export declare const DISCOVERY_TIMEOUT_MS = 15000;
+export declare const LOGIN_TIMEOUT_MS: number;
+export declare const QUOTA_CACHE_TTL_MS: number;
+export declare const CATALOG_CACHE_TTL_MS: number;
+/** Output cap used when neither the registry nor the live catalog states one. */
+export declare const DEFAULT_MAX_TOKENS = 32768;
+export declare const DEFAULT_CONTEXT_WINDOW = 262144;
+export declare const STREAM_IDLE_TIMEOUT_MS = 300000;
+export declare const STREAM_IDLE_TIMEOUT_CODE = "LLM_STREAM_IDLE_TIMEOUT";
+/**
+ * Resolve the managed OAuth host.
+ *
+ * The official client lets an environment variable pin the host for testing or
+ * for a private deployment; the region then supplies the default.
+ */
+export declare function oauthHost(region?: KimiCodeRegion): string;
+/**
+ * Resolve the coding API base URL without a trailing slash or version.
+ *
+ * The official client reads KIMI_CODE_BASE_URL, which already includes /v1;
+ * this plugin keeps the prefix separate so both dialects can be built from one
+ * value. An override that carries /v1 has it stripped exactly once.
+ */
+export declare function codingBaseUrl(region?: KimiCodeRegion): string;
+/** OpenAI-compatible request URL for one endpoint suffix. */
+export declare function openAIUrl(suffix: string, region?: KimiCodeRegion): string;
+/** Anthropic-compatible request URL for one endpoint suffix, such as /v1/messages. */
+export declare function anthropicUrl(suffix: string, region?: KimiCodeRegion): string;
+/**
+ * Path the Anthropic-compatible Messages endpoint is posted to.
+ *
+ * The managed service exposes its Anthropic surface behind the beta gateway,
+ * exactly as the official client's `client.beta.messages.create` call does.
+ */
+export declare const ANTHROPIC_MESSAGES_PATH = "/v1/messages?beta=true";
+/** Anthropic protocol revision the managed service documents. */
+export declare const ANTHROPIC_VERSION = "2023-06-01";
+/**
+ * Which wire dialect a model id is served over.
+ *
+ * The managed service speaks both protocols for every model, so the choice is a
+ * client preference rather than a per-model constraint. The OpenAI dialect is
+ * the default because that is what the official CLI configures for the managed
+ * provider.
+ */
+export declare function wireForModel(_modelId: string): KimiCodeWire;
+/** Thinking levels one model advertises, from the static registry. */
+export declare function reasoningEffortsFor(modelId: string): string[];
+/**
+ * Accepted request modalities for one model.
+ *
+ * An unknown model falls back to text-only, matching the sibling routes: DSH
+ * turns a false "no images" into a visible placeholder the user can correct,
+ * while a false "images accepted" sends bytes to an endpoint that rejects the
+ * whole request.
+ */
+export declare function inputModalitiesFor(modelId: string): Array<'text' | 'image' | 'video'>;
+/**
+ * Room a request must leave below its context window.
+ *
+ * The service rejects a request whose prompt plus requested output exceeds the
+ * model's window ("Your request exceeded model token limit: 262144"), so the
+ * output cap is derived from the window rather than fixed. 4,096 tokens is the
+ * headroom reserved for the prompt on a request that declares no size — the same
+ * shape the official client's completion budgeting uses.
+ */
+export declare const CONTEXT_HEADROOM_TOKENS = 4096;
+/**
+ * Output cap one request asks for when the caller omits one.
+ *
+ * The K3 family reasons by default and `reasoning_content` is billed as output,
+ * so a fixed 32K cap silently truncates a long `max`-effort turn mid-thought and
+ * returns a `length` finish — the official client instead caps output at the
+ * model's context window (clamped to window − prompt). The declared floor is
+ * kept as a minimum so a small window cannot starve the answer.
+ */
+export declare function maxOutputTokensFor(modelId: string, contextWindow?: number): number;
+/**
+ * Reduce the requested output cap so prompt + output fit the window.
+ *
+ * `estimatedInputTokens` is the caller's own size estimate; when it is absent
+ * the cap is left alone rather than guessed at, because under-asking truncates
+ * reasoning while over-asking is rejected outright — the service is the final
+ * authority and only it knows the real prompt size.
+ */
+export declare function clampOutputToContext(requested: number, contextWindow: number, estimatedInputTokens?: number): number;
+/** Reasoning levels the whole route understands, for route-level validation. */
+export declare function isKimiCodeReasoningEffort(value: unknown): value is KimiCodeReasoningEffort;
+/** Context window used before the live catalog has answered. */
+export declare const FALLBACK_MODELS: ReadonlyArray<{
+    id: string;
+    name: string;
+    contextWindow: number;
+}>;
+//# sourceMappingURL=types.d.ts.map

package/lib/types/host/kimi-code/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/host/kimi-code/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAA;AAGhH,eAAO,MAAM,WAAW,cAAc,CAAA;AACtC,eAAO,MAAM,aAAa,cAAc,CAAA;AAExC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,yCAAyC,CAAA;AAEzE,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,0BAA0B,CAAA;AAEzD,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,oCAAoC,CAAA;AAC1E,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,qBAAqB,CAAA;AAClD,2DAA2D;AAC3D,eAAO,MAAM,sBAAsB,iDAAiD,CAAA;AAEpF,6EAA6E;AAC7E,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CASlF,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,QAAQ,CAAA;AAEtC,eAAO,MAAM,UAAU,qFAAqF,CAAA;AAE5G;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,kBAAkB,CAAA;AAC3C,eAAO,MAAM,mBAAmB,mBAAmB,CAAA;AACnD,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AACjD,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,uBAAuB,uBAAuB,CAAA;AAC3D,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AACvD,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AAErD,6EAA6E;AAC7E,eAAO,MAAM,WAAW,UAAU,CAAA;AAElC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAA;AAChD,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAC1C,4EAA4E;AAC5E,eAAO,MAAM,sCAAsC,SAAU,CAAA;AAC7D,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,IAAI,CAAA;AACpC,gEAAgE;AAChE,eAAO,MAAM,uBAAuB,OAAQ,CAAA;AAE5C,gEAAgE;AAChE,eAAO,MAAM,+BAA+B,IAAI,CAAA;AAChD,eAAO,MAAM,8BAA8B,MAAM,CAAA;AAEjD,0CAA0C;AAC1C,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAC1C,eAAO,MAAM,gBAAgB,QAAiB,CAAA;AAC9C,eAAO,MAAM,kBAAkB,QAAgB,CAAA;AAC/C,eAAO,MAAM,oBAAoB,QAAiB,CAAA;AAElD,iFAAiF;AACjF,eAAO,MAAM,kBAAkB,QAAS,CAAA;AACxC,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAE7C,eAAO,MAAM,sBAAsB,SAAU,CAAA;AAC7C,eAAO,MAAM,wBAAwB,4BAA4B,CAAA;AAEjE;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAE,cAA8B,GAAG,MAAM,CAIxE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,cAA8B,GAAG,MAAM,CAI5E;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,cAA8B,GAAG,MAAM,CAExF;AAED,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,cAA8B,GAAG,MAAM,CAE3F;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,2BAA2B,CAAA;AAC/D,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,eAAe,CAAA;AAE7C;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAE3D;AAED,sEAAsE;AACtE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,CAKrF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,OAAQ,CAAA;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAKlF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,oBAAoB,CAAC,EAAE,MAAM,GAC5B,MAAM,CAKR;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,uBAAuB,CAE1F;AAED,gEAAgE;AAChE,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CACY,CAAA"}

package/lib/types/host/kimi-code/video-store.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Local store for videos this plugin attaches to a Kimi Code request.
+ *
+ * DSH's attachment service normalizes and stores images only, and no DSH
+ * surface can produce a video block, so the route owns its own store rather
+ * than pretending DSH issued these references. The store is deliberately
+ * narrow: a tool ingests bytes, a reader hands them back for one request.
+ *
+ * The identifier is the sha256 of the stored bytes, so re-ingesting the same
+ * file is idempotent and a reference cannot silently point at different bytes.
+ */
+import { type VideoAttachmentRef } from './modalities.ts';
+/**
+ * Largest single video this route will carry.
+ *
+ * Two independent published limits bound this, and the smaller wins:
+ *
+ * - the official Kimi video integration encodes a local file as
+ *   `data:video/...;base64,...` and caps that payload at about 50 MB;
+ * - the VS Code client caps a picked video file at 20 MB.
+ *
+ * The integration figure is the one that describes what the MODEL accepts
+ * over this exact wire, so the cap is set just under it rather than at the
+ * editor's more conservative picker limit. Note this is an encoded payload
+ * limit: base64 grows bytes by 4/3, so the raw file must stay under 3/4 of it.
+ */
+export declare const MAX_VIDEO_FILE_BYTES: number;
+/** Maximum base64 payload derived from {@link MAX_VIDEO_FILE_BYTES}. */
+export declare const MAX_VIDEO_BASE64_BYTES: number;
+/** Directory the ingested videos live in. */
+export declare function videoStoreDir(): string;
+/**
+ * Media type for one path, from its extension.
+ *
+ * A local file rarely carries a usable declared type, so the extension is the
+ * signal; an unknown one yields undefined rather than a guess, so the caller
+ * can refuse instead of sending a type the service will reject.
+ */
+export declare function mediaTypeForPath(filePath: string): string | undefined;
+/**
+ * Whether this route will actually send this container.
+ *
+ * The ingress accepts exactly what the mapper can put on the wire, so a file
+ * is either accepted and sent or refused with a reason. An earlier revision
+ * also stored Matroska (.mkv), which some third-party integrations accept but
+ * the vision guide does not list; that produced a video reported as "attached"
+ * which the mapper then silently downgraded to a placeholder. Accepting only
+ * {@link KIMI_VIDEO_MEDIA_TYPES} keeps the tool's promise and the wire's
+ * behaviour the same thing.
+ */
+export declare function isStorableVideoType(mediaType: string): boolean;
+/** Raised when an ingest cannot produce a usable reference. */
+export declare class VideoIngestError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/**
+ * Commit one video's bytes and return the reference a request can cite.
+ *
+ * @param data - complete encoded file bytes.
+ * @param declaredType - media type from the source (extension or Content-Type).
+ * @param name - display name; never interpreted as a path.
+ * @param declaredBytes - total the source advertised, when it did, so an
+ *   oversized file is refused before its bytes are buffered.
+ */
+export declare function saveVideo(input: {
+    data: Uint8Array;
+    declaredType: string | undefined;
+    name: string;
+    declaredBytes?: number;
+}): Promise<VideoAttachmentRef>;
+/**
+ * Total bytes the store may occupy before it prunes itself.
+ *
+ * Videos are content-addressed and re-attaching an identical file costs nothing,
+ * but nothing ever removed an old clip, so the directory only grew. The budget
+ * is deliberately generous (a few large clips) and enforced only on write, so a
+ * prune never runs during a read of the clip about to be sent.
+ */
+export declare const VIDEO_STORE_BUDGET_BYTES: number;
+/**
+ * Drop the least recently used objects until the store fits its budget.
+ *
+ * Recency is the object's mtime, which writing refreshes, so a clip that was
+ * just re-attached is not the one evicted. Failure is swallowed: a store that
+ * cannot be pruned must not fail the attachment the caller asked for.
+ */
+export declare function pruneVideoStore(budgetBytes?: number): Promise<number>;
+/** Path of the stored object for a reference, or undefined when it is gone. */
+export declare function storedPathFor(ref: VideoAttachmentRef): string | undefined;
+/**
+ * Read the bytes one reference points at.
+ *
+ * The reference is re-verified against the stored bytes: a file whose digest
+ * no longer matches its name is refused rather than sent, so a tampered or
+ * truncated object cannot reach the model as if it were the original.
+ */
+export declare function readVideoBytes(ref: VideoAttachmentRef): Promise<Uint8Array>;
+//# sourceMappingURL=video-store.d.ts.map

package/lib/types/host/kimi-code/video-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"video-store.d.ts","sourceRoot":"","sources":["../../../../src/host/kimi-code/video-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEjF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAA;AAEpD,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,QAA0C,CAAA;AAE7E,6CAA6C;AAC7C,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AA+BD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,+DAA+D;AAC/D,qBAAa,gBAAiB,SAAQ,KAAK;IACZ,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAtC,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM;CAInD;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE;IACrC,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8C9B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAoB,CAAA;AAEzD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,WAAW,SAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B7F;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC,CAgBjF"}

package/lib/types/host/kimi-code/video-tool.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Tool that attaches a video for the next Kimi Code request.
+ *
+ * DSH's attachment service stores images only and no DSH surface can produce a
+ * video block, so this route supplies its own ingress. The bytes are committed
+ * to the plugin's video store and then injected into the conversation as a
+ * plugin-sourced user message, which is the same mechanism this plugin already
+ * uses to return a generated image to the model.
+ *
+ * Two sources are accepted:
+ *
+ * - an absolute local path, read straight from disk;
+ * - an http(s) URL, fetched through the deployment's proxy-aware fetch and
+ *   checked against the same public-address policy the search/fetch provider
+ *   uses, so this cannot become an SSRF primitive against the local network.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const KIMI_VIDEO_TOOL_NAME = "kimi_attach_video";
+type FetchLike = typeof fetch;
+export interface KimiVideoToolOptions {
+    fetchFn?: FetchLike;
+}
+export declare function createKimiVideoTool(ctx: Context, options?: KimiVideoToolOptions): import("@deepseek-ai/dsh-tools").ToolDefinition;
+export {};
+//# sourceMappingURL=video-tool.d.ts.map

package/lib/types/host/kimi-code/video-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"video-tool.d.ts","sourceRoot":"","sources":["../../../../src/host/kimi-code/video-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAOlD,eAAO,MAAM,oBAAoB,sBAAsB,CAAA;AAEvD,KAAK,SAAS,GAAG,OAAO,KAAK,CAAA;AAE7B,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,SAAS,CAAA;CACpB;AAwID,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,oBAAyB,mDAwGnF"}