@eddyskywalker/dsh-chatgpt-subscription 0.9.9 → 0.10.1

package/lib/types/host/minimax-code/oauth.d.ts

@@ -0,0 +1,204 @@
+/**
+ * OAuth for the MiniMax Code subscription.
+ *
+ * The flow is RFC 8628 device authorization with PKCE(S256) against a public
+ * client (`mcode-public`, no secret) — the shape the desktop app uses, and the
+ * only one that fits a plugin with no browser callback to receive.
+ *
+ * Measured facts that shape this file (brief section 2.5):
+ *
+ * - device authorization: POST `account.minimax.cn/oauth2/device/code`
+ * - token (device grant AND refresh): POST `account.minimax.cn/oauth2/token`
+ * - revocation: POST `account.minimax.cn/oauth2/revoke`
+ * - every call is `application/x-www-form-urlencoded` with `Accept: application/json`
+ * - the device grant carries `code_challenge`/`code_challenge_method=S256` and the
+ *   poll carries the matching `code_verifier`
+ * - the refresh carries `grant_type=refresh_token`, `refresh_token`, `client_id`,
+ *   `scope` and `audience`
+ *
+ * The refresh policy is the one the brief fixes at section 2.6: read the stored
+ * credential first and use it while it is valid, refresh only when it is not (or
+ * when the service has just rejected it), write the rotation back atomically, and
+ * never let a failed refresh damage the file MiniMax Code itself depends on.
+ */
+import type { MinimaxCodeAccount, MinimaxCodeRegion, MinimaxCodeWebLogin } from '../../shared/minimax-code-contracts.ts';
+import { accountHost } from './types.ts';
+import { type MinimaxCodeCredentialStore, type MinimaxCodeCredentials } from './token-store.ts';
+/** Raised when the stored credential was rejected and a new sign-in is required. */
+export declare class MinimaxCodeUnauthorizedError extends Error {
+    constructor(message: string);
+}
+/** Raised when a transient failure outlived its retry budget. */
+export declare class MinimaxCodeRetryableError extends Error {
+    constructor(message: string, cause?: unknown);
+}
+/** Raised when the user denied the device authorization request. */
+export declare class MinimaxCodeAccessDeniedError extends Error {
+    constructor(message: string);
+}
+/**
+ * One PKCE pair (RFC 7636).
+ *
+ * The verifier is a fresh random string per authorization; the challenge is its
+ * SHA-256 digest, both base64url encoded with no padding, which is what S256
+ * means on the wire.
+ */
+export declare function createPkcePair(): {
+    verifier: string;
+    challenge: string;
+};
+/** Parsed device authorization response. */
+export interface DeviceAuthorization {
+    userCode: string;
+    deviceCode: string;
+    verificationUri: string;
+    verificationUriComplete: string;
+    expiresIn: number;
+    interval: number;
+    /** PKCE verifier the matching poll must present. */
+    codeVerifier: string;
+    /** Region the authorization was requested in; decides every later host. */
+    region: MinimaxCodeRegion;
+}
+/**
+ * Start a device authorization (RFC 8628 section 3.1).
+ *
+ * A public client sends its `client_id`, the scope and audience it wants, and the
+ * PKCE challenge — no secret, which is the whole point of the device profile.
+ */
+export declare function requestDeviceAuthorization(options?: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    region?: MinimaxCodeRegion;
+}): Promise<DeviceAuthorization>;
+/** One token response, in the shape the store persists. */
+export interface MinimaxToken {
+    accessToken: string;
+    refreshToken: string;
+    tokenType: string;
+    expiresInSec: number;
+    expiresAtMs: number;
+    scope: string;
+}
+/** Outcome of one device-token poll. */
+export type DevicePollOutcome = {
+    kind: 'success';
+    token: MinimaxToken;
+} | {
+    kind: 'pending';
+    slowDown: boolean;
+} | {
+    kind: 'expired';
+};
+/**
+ * Poll the token endpoint once for one device code (RFC 8628 section 3.4).
+ *
+ * A 5xx is a transport-class failure rather than a verdict on the device code, so
+ * it is raised for the caller's retry loop instead of being read as "still
+ * pending" — treating it as pending would spin against a broken endpoint until the
+ * device code expired.
+ */
+export declare function pollDeviceToken(authorization: Pick<DeviceAuthorization, 'deviceCode' | 'codeVerifier' | 'region'>, options?: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<DevicePollOutcome>;
+/**
+ * Refresh an access token, with a bounded retry.
+ *
+ * Only a transient status or a transport failure is retried. A 400/401/403, or an
+ * `invalid_grant` body, is a verdict that the refresh token is dead and stops
+ * immediately: retrying it can never succeed, and every attempt is a request the
+ * subscription pays for.
+ */
+export declare function refreshAccessToken(refreshToken: string, options: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    region: MinimaxCodeRegion;
+}): Promise<MinimaxToken>;
+/**
+ * Revoke one token at the service.
+ *
+ * Best effort by design: a revocation that cannot reach the service must not stop
+ * a local sign-out, because the credential is already gone from this machine.
+ */
+export declare function revokeToken(token: string, options: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    region: MinimaxCodeRegion;
+}): Promise<boolean>;
+/** Start a device-code sign-in and hand the card what it must display. */
+export declare function beginWebLogin(options?: {
+    fetchFn?: typeof fetch;
+    region?: MinimaxCodeRegion;
+    signal?: AbortSignal;
+}): Promise<MinimaxCodeWebLogin>;
+/** The public projection of one live sign-in, for the status route. */
+export declare function getWebLogin(loginId: string): MinimaxCodeWebLogin | null;
+/** Cancel one sign-in, dropping the session so a later poll cannot resume it. */
+export declare function cancelWebLogin(loginId: string): boolean;
+/** Forget every session; used by the test seam and by a full sign-out. */
+export declare function resetWebLogins(): void;
+/** Build the account projection one credential yields. */
+export declare function accountFromCredentials(credentials: {
+    loginEpoch: string;
+    generation: number;
+    expiresAtMs: number;
+    region: MinimaxCodeRegion;
+}): MinimaxCodeAccount;
+export { accountHost };
+/** Whether the given refresh token was rejected recently. */
+export declare function isRefreshTokenRejected(refreshToken: string): boolean;
+/** Test seam: forget every remembered rejection. */
+export declare function resetRefreshRejections(): void;
+export interface EnsureTokenOptions {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    /** Refresh even when the stored token is not near expiry (used after a 401). */
+    force?: boolean;
+}
+/**
+ * Return a usable access token, refreshing and writing back only when needed.
+ *
+ * This is the whole of the contention discipline in one function:
+ *
+ * 1. read the stored credential and use it as-is while it is valid — the
+ *    common case, and the one that never touches the file or the network;
+ * 2. refresh only when it is not (or when `force` reports a 401 the service has
+ *    already issued);
+ * 3. share one rotation between concurrent callers, so a burst of tool calls at
+ *    expiry cannot each try to rotate the same refresh token;
+ * 4. write the result back through the store's atomic replacement, and remember a
+ *    rejected token so the next caller is told to sign in instead of retrying.
+ */
+export declare function ensureAccessToken(store: MinimaxCodeCredentialStore, options?: EnsureTokenOptions): Promise<MinimaxCodeCredentials>;
+/**
+ * Poll one live sign-in once and, on success, persist what it produced.
+ *
+ * The persisted credential is plugin-owned: a device-code sign-in started here
+ * has no record in the desktop app's `auth.json` (its record key embeds a hash
+ * this plugin cannot reproduce), so writing a fabricated entry there would leave
+ * the app with an entry it never reads.
+ */
+export declare function pollWebLogin(store: MinimaxCodeCredentialStore, loginId: string, options?: {
+    fetchFn?: typeof fetch;
+    signal?: AbortSignal;
+    /**
+     * Called with the credential a completed sign-in produced, after it has been
+     * persisted.
+     *
+     * The single-credential store cannot express a second account, so without this
+     * a sign-in started from the card would never join the pool: the pool would
+     * keep serving its existing accounts, and the user's new sign-in would exist
+     * only as the mirror file. The pool installs this hook and adds the credential
+     * as its own account.
+     *
+     * A failure here must not fail the sign-in: the credential is already durable,
+     * and the pool is a routing convenience on top of it. The caller receives the
+     * authenticated verdict either way.
+     */
+    onSave?: (credentials: MinimaxCodeCredentials) => Promise<void>;
+}): Promise<{
+    status: 'pending' | 'authenticated' | 'expired' | 'denied';
+    account?: MinimaxCodeAccount;
+}>;
+//# sourceMappingURL=oauth.d.ts.map

package/lib/types/host/minimax-code/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/host/minimax-code/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAA;AACxH,OAAO,EAgBL,WAAW,EAIZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAA;AAEzB,oFAAoF;AACpF,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAED,iEAAiE;AACjE,qBAAa,yBAA0B,SAAQ,KAAK;gBAGtC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAI7C;AAED,oEAAoE;AACpE,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,OAAO,EAAE,MAAM;CAI5B;AAuDD;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIxE;AAMD,4CAA4C;AAC5C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,uBAAuB,EAAE,MAAM,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,MAAM,EAAE,iBAAiB,CAAA;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,GAAE;IACxD,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,MAAM,CAAC,EAAE,iBAAiB,CAAA;CACtB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CpC;AAMD,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAqBD,wCAAwC;AACxC,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvB;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,aAAa,EAAE,IAAI,CAAC,mBAAmB,EAAE,YAAY,GAAG,cAAc,GAAG,QAAQ,CAAC,EAClF,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GAC7D,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AAoBD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACnF,OAAO,CAAC,YAAY,CAAC,CAiDvB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACnF,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAmCD,0EAA0E;AAC1E,wBAAsB,aAAa,CAAC,OAAO,GAAE;IAC3C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAA;CAChB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBpC;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CASvE;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,CACpC,WAAW,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GACtG,kBAAkB,CAQpB;AAGD,OAAO,EAAE,WAAW,EAAE,CAAA;AAsBtB,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAQpE;AAED,oDAAoD;AACpD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAKD,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAOD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAkDjC;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,0BAA0B,EACjC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3D,GACL,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,kBAAkB,CAAA;CAAE,CAAC,CA6DvG"}

package/lib/types/host/minimax-code/routes.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Web routes for the MiniMax Code line.
+ *
+ * The six routes below are the frozen contract the client half consumes (brief
+ * section 3). Their paths, request bodies and verdicts are therefore not free:
+ * this file implements them as specified rather than as this line might prefer.
+ *
+ * Response envelope: every route answers \`{ ok: true, value: <payload> }\`, which is
+ * what the sibling lines in this package use. The three routes whose contract names
+ * a top-level key as well (\`/login/start\` -> \`login\`, \`/login/poll\` -> \`status\` and
+ * \`account\`, \`/test\` -> \`ok\`/\`model\`/\`error\`) carry that key at the top level too,
+ * so a client written against either reading resolves. \`/test\` is the one route
+ * where the envelope's \`ok\` cannot double as the payload's: its contract defines
+ * \`ok\` as the probe verdict, so the envelope there is the verdict itself and the
+ * duplicate lives under \`value\`.
+ *
+ * Mounting: the routes are registered under BOTH the contract prefix and the
+ * sibling-line convention, because the two disagree in this repository and the
+ * client half must not be able to miss them for that reason alone.
+ *
+ * \`/models\` and \`/settings\` are the model-settings half every sibling line has and
+ * this one shipped without. They are two names for one route because the sibling
+ * cards disagree about which to call: kimi-code and claude call it \`/models\`,
+ * workbuddy and command-code call it \`/settings\`. Serving both costs one string
+ * comparison and removes a client-side special case.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { MINIMAX_CODE_PROVIDER_ID, type MinimaxCodeWebStatus } from '../../shared/minimax-code-contracts.ts';
+import { type MinimaxCodeAccountPool } from './account-pool.ts';
+import { MinimaxCodeCredentialStore, MinimaxCodeModelSettingsStore, type MinimaxCodeModelSettings, type MinimaxCodePreferenceStore, type MinimaxCodeSettingsPatch } from './token-store.ts';
+import { ensureAccessToken, getWebLogin } from './oauth.ts';
+/** The sub-path one request addresses, whichever prefix it arrived under. */
+export declare function subPathOf(requestUrl: string): string;
+/**
+ * The stored selection, however this deployment persists it.
+ *
+ * The routes accept either shape so a composition that still has the register
+ * settings seam and one that only has the file both work: the caller passes
+ * whichever it wired, and nothing in this file needs to know which it got. The
+ * patch type is the store's own, deliberately, so a field added to the settings
+ * document cannot become one this route accepts but the stores silently drop.
+ */
+export interface MinimaxCodeSettingsSource {
+    /** Current selection: a value on the register seam, a read on the file store. */
+    status(): Promise<MinimaxCodeModelSettings> | MinimaxCodeModelSettings;
+    update(patch: MinimaxCodeSettingsPatch): Promise<MinimaxCodeModelSettings>;
+}
+export interface MinimaxCodeStatusOptions {
+    fetchFn?: typeof fetch;
+    /** Whether this plugin currently owns the provider route; re-read on every status. */
+    serving?: boolean | (() => boolean);
+    /** Diagnostic when another plugin owns the provider route; re-read on every status. */
+    conflict?: string | null | (() => string | null);
+    /**
+     * Where the model selection lives.
+     *
+     * Omitted, the routes read the default settings file, which is what a caller
+     * that only wants the connection half of the card gets. The plugin entry
+     * supplies the same store the adapter was built with, so the card and the
+     * request path can never read two different selections.
+     */
+    settings?: MinimaxCodeSettingsSource;
+    /**
+     * The account pool, when this process installed one.
+     *
+     * Omitting it is a supported posture: the line then behaves as the
+     * single-credential route it was before the pool existed, and the status
+     * reports `poolInstalled: false` so the card can say so rather than render an
+     * empty account list that looks like a bug.
+     */
+    accountPool?: MinimaxCodeAccountPool;
+}
+/** Everything the settings card renders. */
+export declare function getMinimaxCodeWebStatus(store: MinimaxCodeCredentialStore, options?: MinimaxCodeStatusOptions, settingsSource?: MinimaxCodeSettingsSource): Promise<MinimaxCodeWebStatus>;
+export declare function registerMinimaxCodeRoutes(ctx: Context, store?: MinimaxCodeCredentialStore, options?: MinimaxCodeStatusOptions, modelSettings?: MinimaxCodeModelSettingsStore, preferences?: MinimaxCodePreferenceStore): () => void;
+/** Test seam: forget which sign-in the status route reports. */
+export declare function resetLatestLogin(): void;
+export { MINIMAX_CODE_PROVIDER_ID, getWebLogin, ensureAccessToken };
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/host/minimax-code/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../src/host/minimax-code/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAGlD,OAAO,EACL,wBAAwB,EAMxB,KAAK,oBAAoB,EAC1B,MAAM,wCAAwC,CAAA;AAG/C,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAE7B,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAIL,iBAAiB,EACjB,WAAW,EAKZ,MAAM,YAAY,CAAA;AAqDnB,6EAA6E;AAC7E,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,iFAAiF;IACjF,MAAM,IAAI,OAAO,CAAC,wBAAwB,CAAC,GAAG,wBAAwB,CAAA;IACtE,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAC3E;AAuBD,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;IACtB,sFAAsF;IACtF,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IACnC,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAA;IAChD;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,yBAAyB,CAAA;IACpC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,sBAAsB,CAAA;CACrC;AAOD,4CAA4C;AAC5C,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,wBAA6B,EACtC,cAAc,CAAC,EAAE,yBAAyB,GACzC,OAAO,CAAC,oBAAoB,CAAC,CA8D/B;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,OAAO,EACZ,KAAK,GAAE,0BAA6D,EACpE,OAAO,GAAE,wBAA6B,EACtC,aAAa,GAAE,6BAAmE,EAClF,WAAW,CAAC,EAAE,0BAA0B,GACvC,MAAM,IAAI,CAyOZ;AAED,gEAAgE;AAChE,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAA"}

package/lib/types/host/minimax-code/token-store.d.ts

@@ -0,0 +1,238 @@
+/**
+ * Credential storage for the MiniMax Code line.
+ *
+ * Unlike every other line in this package, this one does not own its credential
+ * format: MiniMax Code itself keeps the signed-in session in
+ * `~/.minimax/auth/<buildEnv>/<region>/mcode-public/auth.json`, and the whole
+ * point of reusing it is that a user who is already signed in to the desktop app
+ * does not sign in again here.
+ *
+ * That sharing is the design constraint:
+ *
+ * 1. READ-ONLY FIRST. Every call reads the file and uses the stored token when it
+ *    is still valid; the plugin never rotates a credential it does not have to.
+ * 2. WRITE-BACK IS ATOMIC. A rotated token replaces the file through a temporary
+ *    file plus `rename`, so a failed or interrupted refresh leaves the previous
+ *    `auth.json` byte-for-byte intact — the requirement the brief states at
+ *    section 2.6.4.
+ * 3. NO LOCK IS TAKEN. MiniMax Code holds `auth.lock` while it refreshes, and a
+ *    second process must not create, delete or wait on that file: doing so could
+ *    break the app's own refresh. Atomic replacement is what makes lock-free
+ *    sharing safe instead — a reader sees either the whole old file or the whole
+ *    new one, never a half-written one, and the record's key is preserved so the
+ *    app finds its own entry where it left it.
+ * 4. THE SHAPE IS PRESERVED. `schemaVersion` and every other record in
+ *    `records` survive a write untouched; only the `mcode-public` record and the
+ *    matching `auth-state.json` fields change.
+ *
+ * A credential this plugin obtained itself (device-code login with no native file
+ * present) is kept in the plugin's own store under `$DSH_HOME/storages`, so the
+ * two provenances never overwrite each other.
+ */
+import { type ContextWindowOverridePatch } from '../common/context-window-overrides.ts';
+import type { MinimaxCodeReasoningEffort, MinimaxCodeRegion } from '../../shared/minimax-code-contracts.ts';
+/** Where the credential and the token came from. */
+export type MinimaxCodeCredentialSource = 'minimax-native' | 'file';
+/**
+ * One MiniMax Code subscription credential.
+ *
+ * Field names follow `auth.json` exactly; nothing is renamed on the way in or
+ * out, so a round trip cannot lose a field the desktop app depends on.
+ */
+export interface MinimaxCodeCredentials {
+    /** Bearer access token for the agent API. Host-only; never sent to a browser. */
+    accessToken: string;
+    /** Rotating refresh token. Host-only. */
+    refreshToken: string;
+    /** Always "Bearer" in the measured file; kept verbatim. */
+    tokenType: string;
+    /** Public client the record belongs to. */
+    clientId: string;
+    /** Scopes the token was issued for. */
+    scopes: string[];
+    /** Audience the token was issued for. */
+    audience: string;
+    /** Unix milliseconds the access token stops being valid. */
+    expiresAtMs: number;
+    /** Rotations the credential has been through; incremented on every refresh. */
+    generation: number;
+    /** Identity of the sign-in that produced the credential. */
+    loginEpoch: string;
+    /** Build environment segment of the path the credential lives under. */
+    buildEnv: string;
+    /** Region the credential was issued in. */
+    region: MinimaxCodeRegion;
+    /** Record key inside `auth.json`, preserved verbatim so a write lands in place. */
+    recordKey: string | null;
+    /** Whether this credential is the desktop app's file or the plugin's own. */
+    source: MinimaxCodeCredentialSource;
+    /** Unix milliseconds this plugin read or wrote the credential. */
+    seenAt?: number;
+}
+/** The MiniMax home directory: the desktop app's data root. */
+export declare function minimaxHomeDir(env?: NodeJS.ProcessEnv): string;
+/** Directory holding one region's auth files. */
+export declare function authDirFor(region: MinimaxCodeRegion, buildEnv?: string): string;
+/** Path of the desktop app's credential file for one region. */
+export declare function authJsonPath(region: MinimaxCodeRegion, buildEnv?: string): string;
+/** Path of the desktop app's non-secret state file for one region. */
+export declare function authStateJsonPath(region: MinimaxCodeRegion, buildEnv?: string): string;
+/** Path of the plugin's own credential file, used when no native file exists. */
+export declare function pluginCredentialPath(): string;
+/**
+ * Validate and normalize one stored credential.
+ *
+ * A payload that is missing a token or an expiry is rejected rather than
+ * defaulted: a credential with an invented expiry would be presented to the
+ * service as valid when it is not, which is exactly the failure the refresh path
+ * exists to prevent.
+ */
+export declare function parseMinimaxCodeCredentials(value: unknown, fallback: {
+    region: MinimaxCodeRegion;
+    buildEnv?: string;
+    recordKey?: string | null;
+    source?: MinimaxCodeCredentialSource;
+}): MinimaxCodeCredentials;
+/** Whether a credential is valid for long enough to use as-is. */
+export declare function credentialIsFresh(credentials: MinimaxCodeCredentials, now?: number): boolean;
+/**
+ * The credential store for this line.
+ *
+ * `read()` prefers the desktop app's file and falls back to the plugin's own, so
+ * a user who signed in through either path is served. `write()` returns the
+ * credential to the file it came from, which is what keeps the two provenances
+ * from clobbering each other.
+ */
+export declare class MinimaxCodeCredentialStore {
+    private readonly region;
+    constructor(region?: MinimaxCodeRegion);
+    /** Path of the file the next read or write targets. */
+    path(): string;
+    private readNative;
+    private readPluginFile;
+    read(): Promise<MinimaxCodeCredentials | null>;
+    /**
+     * The credential in force plus where it came from, in one pass.
+     *
+     * A status response needs all three facts, and each of the targeted accessors
+     * re-reads and re-parses the native document (a file read plus a JSON parse per
+     * region probed). Reading once here keeps one /status call from doing that work
+     * three times, which matters because the settings card polls this route.
+     */
+    readWithProvenance(): Promise<{
+        credentials: MinimaxCodeCredentials | null;
+        source: MinimaxCodeCredentialSource;
+        path: string;
+    }>;
+    /** Which file the credential currently in force lives in. */
+    activeSource(): Promise<MinimaxCodeCredentialSource>;
+    /**
+     * Persist a credential back where it came from.
+     *
+     * A native credential is written into the existing record, preserving the
+     * document's `schemaVersion` and every other record; a plugin credential is
+     * written to the plugin's own file. Either way the write is atomic.
+     */
+    write(credentials: MinimaxCodeCredentials): Promise<void>;
+    /**
+     * Forget the credential this plugin owns.
+     *
+     * The desktop app's `auth.json` is deliberately left alone: it is not this
+     * plugin's to delete, and removing it would sign the user out of MiniMax Code
+     * itself. A credential this store is only *reading* from the app therefore
+     * remains in force after a sign-out, which the status route reports so the
+     * user is not told a session ended when it did not.
+     */
+    delete(): Promise<void>;
+}
+/** Namespace the model selection is registered under on a register-capable harness. */
+export declare const MINIMAX_CODE_PREFERENCES_NAMESPACE = "dsh-minimax-code";
+/**
+ * The model-selection half of this line's settings.
+ *
+ * The catalog (`MINIMAX_CODE_MODELS`) is deliberately not stored here. A shipped
+ * catalog changes with the code, so persisting a copy of it would leave a user
+ * whose file is a release behind reading a model list the build no longer serves;
+ * only the user's own choices live in this document.
+ */
+export interface MinimaxCodeModelSettings {
+    /** Line-wide switch. Absent means enabled: this line shipped enabled. */
+    enabled?: boolean;
+    /** Catalog ids DSH offers in the conversation model picker. */
+    enabledModelIds: string[];
+    /** Per-model context window, replacing the catalog's own number. */
+    contextWindowOverrides: Record<string, number>;
+    /** Level used when a conversation picks none; null means the model's own. */
+    defaultReasoningEffort: MinimaxCodeReasoningEffort | null;
+}
+/**
+ * One settings patch.
+ *
+ * `contextWindowOverrides` is a patch rather than the whole map because `null`
+ * has to survive as a value: it is the settings card's "restore the catalog
+ * default" and deletes exactly one key. A full replacement could not express
+ * that without the caller first reading the document it wants to edit.
+ */
+export interface MinimaxCodeSettingsPatch {
+    enabled?: boolean;
+    enabledModelIds?: string[];
+    contextWindowOverrides?: ContextWindowOverridePatch;
+    defaultReasoningEffort?: MinimaxCodeReasoningEffort | null;
+}
+/**
+ * The seam the routes and the adapter share.
+ *
+ * `status()` is synchronous on purpose: it is read on every model-picker query
+ * and on every settings-card poll, and both callers only need a snapshot. A
+ * promise-shaped reader here would make each of them await a file read on a hot
+ * path for a value that changes at human speed.
+ */
+export interface MinimaxCodePreferenceStore {
+    status(): MinimaxCodeModelSettings;
+    update(patch: MinimaxCodeSettingsPatch): Promise<MinimaxCodeModelSettings>;
+}
+/** Path of the settings file used when no settings service is present. */
+export declare function modelSettingsPath(): string;
+/**
+ * Apply one patch to one settings document.
+ *
+ * The merge lives outside both stores because the register-backed store has to
+ * normalize the scope's value through the same rules the file store applies; two
+ * copies of this logic is how the two storage paths drift apart the first time
+ * one of them learns a new field.
+ */
+export declare function mergeMinimaxCodeSettings(current: MinimaxCodeModelSettings, patch: MinimaxCodeSettingsPatch): MinimaxCodeModelSettings;
+/**
+ * The settings file beside the credentials.
+ *
+ * This is what a harness without the register seam (0.1.7, and a headless host)
+ * reads back on boot, so it is the store that has to survive a crash: the write
+ * is a temporary sibling plus `rename`, and the document just written is read
+ * back and compared before the write is reported as done. Without the read-back
+ * a partial write, or a filesystem that dropped the rename, would report a
+ * selection the next boot does not agree with — the card would show a model
+ * grid the adapter never applies.
+ */
+export declare class MinimaxCodeModelSettingsStore {
+    private readonly filePath;
+    constructor(filePath?: string);
+    path(): string;
+    read(): Promise<MinimaxCodeModelSettings>;
+    write(settings: MinimaxCodeModelSettings): Promise<void>;
+    /**
+     * Read-modify-write under the same per-path lock the credential writes use.
+     *
+     * Without it two patches landing together each read the same document and the
+     * second write silently discards the first — a lost model selection, with no
+     * error anywhere. The lock is shared with the credential paths because it is
+     * keyed by resolved path, and the two never name the same file.
+     */
+    updateSettings(patch: MinimaxCodeSettingsPatch): Promise<MinimaxCodeModelSettings>;
+}
+/**
+ * Bind the model selection to the DSH settings document when the harness still
+ * offers one, and to the JSON file beside it otherwise: a harness without the
+ * register seam (0.1.7, and a headless host) reads that file back on boot.
+ */
+export declare function registerMinimaxCodePreferenceStore(settings?: unknown, fallbackStore?: MinimaxCodeModelSettingsStore): MinimaxCodePreferenceStore;
+//# sourceMappingURL=token-store.d.ts.map

package/lib/types/host/minimax-code/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../../../src/host/minimax-code/token-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAUH,OAAO,EAA+B,KAAK,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAG3G,oDAAoD;AACpD,MAAM,MAAM,2BAA2B,GAAG,gBAAgB,GAAG,MAAM,CAAA;AAEnE;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAA;IACnB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAA;IACpB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAA;IAClB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,MAAM,EAAE,iBAAiB,CAAA;IACzB,mFAAmF;IACnF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,6EAA6E;IAC7E,MAAM,EAAE,2BAA2B,CAAA;IACnC,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI3E;AAED,iDAAiD;AACjD,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,GAAE,MAA+B,GAAG,MAAM,CAEvG;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,GAAE,MAA+B,GAAG,MAAM,CAEzG;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,GAAE,MAA+B,GAAG,MAAM,CAE9G;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAmBD;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE;IACR,MAAM,EAAE,iBAAiB,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,CAAC,EAAE,2BAA2B,CAAA;CACrC,GACA,sBAAsB,CA6BxB;AAOD,kEAAkE;AAClE,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,sBAAsB,EACnC,GAAG,GAAE,MAAmB,GACvB,OAAO,CAET;AAqHD;;;;;;;GAOG;AACH,qBAAa,0BAA0B;IAIrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;gBAE9B,MAAM,GAAE,iBAAwB;IAI5C,uDAAuD;IACvD,IAAI,IAAI,MAAM;YAIA,UAAU;YA2BV,cAAc;IAiB5B,IAAI,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAI9C;;;;;;;OAOG;IACH,kBAAkB,IAAI,OAAO,CAAC;QAC5B,WAAW,EAAE,sBAAsB,GAAG,IAAI,CAAA;QAC1C,MAAM,EAAE,2BAA2B,CAAA;QACnC,IAAI,EAAE,MAAM,CAAA;KACb,CAAC;IAUF,6DAA6D;IACvD,YAAY,IAAI,OAAO,CAAC,2BAA2B,CAAC;IAI1D;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmDzD;;;;;;;;OAQG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAKxB;AAMD,uFAAuF;AACvF,eAAO,MAAM,kCAAkC,qBAAqB,CAAA;AAOpE;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,yEAAyE;IACzE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,+DAA+D;IAC/D,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,oEAAoE;IACpE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,6EAA6E;IAC7E,sBAAsB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,sBAAsB,CAAC,EAAE,0BAA0B,CAAA;IACnD,sBAAsB,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAA;CAC3D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,MAAM,IAAI,wBAAwB,CAAA;IAClC,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAC3E;AAeD,0EAA0E;AAC1E,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAwCD;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,wBAAwB,EACjC,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAW1B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,6BAA6B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,QAAQ,GAAE,MAA4B;IAIlD,IAAI,IAAI,MAAM;IAIR,IAAI,IAAI,OAAO,CAAC,wBAAwB,CAAC;IASzC,KAAK,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9D;;;;;;;OAOG;IACH,cAAc,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAOnF;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,CAAC,EAAE,OAAO,EAClB,aAAa,GAAE,6BAAmE,GACjF,0BAA0B,CAgE5B"}