@edge-sky/dsh-oauth-adapter 0.1.2-beta.1 → 0.1.2-dev.2

package/lib/index.js

@@ -3,45 +3,31 @@
  * `dsh-llm-pi-ai` plugin.
  * @module @edge-sky/dsh-oauth-adapter
  */
+import { OAuthModelService } from './model-service.js';
+import { ModelOperationError } from './model-discovery.js';
 import { randomUUID } from 'node:crypto';
 import { inspect } from 'node:util';
-import { settingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from '@deepseek-ai/schemastery';
 import WebSocket, { WebSocketServer } from 'ws';
 import { MAX_FRAME_BYTES, OAUTH_SOCKET_PATH, OAUTH_SOCKET_PROTOCOL, PROVIDERS, parseClientCommand, } from './protocol.js';
 /** Runtime-validated plugin configuration. */
 export const Config = z.object({
     debug: z.boolean().default(false),
+    modelSyncTimeoutMs: z.number().min(1).max(2147483647).step(1).default(30000),
+    modelSyncMaxResponseBytes: z.number().min(1024).step(1).default(4194304),
+    modelSyncMaxPages: z.number().min(1).max(1000).step(1).default(100),
+    codexClientVersion: z.string().default('0.149.0'),
 });
 /** Cordis plugin name. */
 export const name = 'dsh-oauth-adapter';
 /** Official services required by the OAuth account surface. */
-export const inject = ['authorization', 'credentials', 'settings', 'webServer'];
-const MODEL_SETTINGS_NS = settingsNamespace('llm-pi-ai');
+export const inject = ['authorization', 'credentials', 'settings', 'webServer', 'llm'];
 function providerMeta(providerId) {
     const provider = PROVIDERS.find(candidate => candidate.id === providerId);
     if (provider === undefined)
         throw new Error(`unsupported provider: ${providerId}`);
     return provider;
 }
-function isRecord(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function modelRouteEnabled(settings, provider) {
-    const section = settings.get(MODEL_SETTINGS_NS);
-    if (!isRecord(section) || !isRecord(section.providers))
-        return false;
-    return Object.hasOwn(section.providers, provider);
-}
-function pluginOwnsModelRoute(settings, provider) {
-    const descriptor = settings.describe().find(candidate => candidate.ns === MODEL_SETTINGS_NS);
-    if (!isRecord(descriptor?.user) || !isRecord(descriptor.user.providers))
-        return false;
-    const profile = descriptor.user.providers[provider.id];
-    return isRecord(profile)
-        && Object.keys(profile).length === 1
-        && profile.displayName === provider.modelGroupLabel;
-}
 const GITHUB_DOMAIN_PROMPT = 'GitHub Enterprise URL/domain (blank for github.com)';
 function promptView(prompt, provider) {
     if (prompt.kind === 'select') {
@@ -176,14 +162,17 @@ class OAuthConnection {
     socket;
     debug;
     changed;
+    models;
     active;
     queue = Promise.resolve();
     closed = false;
-    constructor(ctx, socket, debug, changed) {
+    tasks = new Set();
+    constructor(ctx, socket, debug, changed, models) {
         this.ctx = ctx;
         this.socket = socket;
         this.debug = debug;
         this.changed = changed;
+        this.models = models;
         socket.on('message', (raw, isBinary) => {
             if (isBinary || rawLength(raw) > MAX_FRAME_BYTES) {
                 this.sendError('invalid-message', 'message must be bounded UTF-8 JSON');
@@ -207,16 +196,23 @@ class OAuthConnection {
         this.debug('connection=opened');
         void this.sendSnapshot();
     }
+    modelChanged(provider) { this.send({ type: 'models-changed', provider }); }
     refresh() {
         void this.sendSnapshot();
     }
-    dispose() {
+    track(task) {
+        this.tasks.add(task);
+        void task.finally(() => this.tasks.delete(task)).catch(() => { });
+    }
+    async dispose() {
         this.closed = true;
         this.withdrawActive('OAuth surface stopped');
         this.socket.terminate();
+        await this.queue;
+        await Promise.allSettled([...this.tasks]);
     }
     send(message) {
-        if (this.socket.readyState === WebSocket.OPEN)
+        if (!this.closed && this.socket.readyState === WebSocket.OPEN)
             this.socket.send(JSON.stringify(message));
     }
     sendError(code, message, requestId, attemptId, detail) {
@@ -228,6 +224,8 @@ class OAuthConnection {
         });
     }
     async receive(raw) {
+        if (this.closed)
+            return;
         const parsed = parseClientCommand(raw);
         if (!parsed.ok) {
             this.sendError(parsed.message === 'provider is unsupported' ? 'unsupported-provider' : 'invalid-message', parsed.message, parsed.requestId);
@@ -236,6 +234,10 @@ class OAuthConnection {
         await this.handle(parsed.value);
     }
     async handle(command) {
+        if (command.type.startsWith('models-')) {
+            this.track(this.handleModels(command));
+            return;
+        }
         switch (command.type) {
             case 'refresh':
                 await this.sendSnapshot(command.requestId);
@@ -253,41 +255,45 @@ class OAuthConnection {
                 await this.forget(command);
         }
     }
+    async handleModels(command) {
+        try {
+            switch (command.type) {
+                case 'models-list': break;
+                case 'models-sync':
+                    await this.models.sync(command.provider, command.revision);
+                    break;
+                case 'models-migrate':
+                    await this.models.migrate(command.provider, command.revision);
+                    break;
+                case 'models-save':
+                    await this.models.saveManual(command.provider, command.model, command.revision);
+                    break;
+                case 'models-delete':
+                    await this.models.deleteManual(command.provider, command.id, command.revision);
+                    break;
+            }
+            if (!this.closed)
+                this.send({ type: 'models-page', requestId: command.requestId,
+                    page: await this.models.page(command.provider, command.type === 'models-list' ? command.offset : 0) });
+        }
+        catch (error) {
+            if (!this.closed)
+                this.send({ type: 'models-error', requestId: command.requestId, provider: command.provider,
+                    code: error instanceof ModelOperationError ? error.code : 'operation-failed',
+                    message: error instanceof ModelOperationError ? error.message : 'The model operation failed. Refresh and retry.' });
+        }
+    }
     async account(provider) {
+        await this.models.ready;
         const entry = this.ctx.authorization.describe(provider.key);
         const credential = await this.ctx.credentials.describeRecord(provider.key);
-        let modelsEnabled = modelRouteEnabled(this.ctx.settings, provider.id);
-        if (credential.configured && !modelsEnabled && this.ctx.settings.writable) {
-            try {
-                modelsEnabled = await this.enableModelRoute(provider);
-            }
-            catch (error) {
-                this.ctx.logger.warn('dsh-oauth-adapter: model route activation failed for %s', provider.id);
-                this.ctx.logger.warn(error);
-            }
-        }
         return {
-            provider: provider.id,
-            label: entry?.label ?? provider.fallbackLabel,
+            provider: provider.id, label: entry?.label ?? provider.fallbackLabel,
             available: entry?.methods.some(method => method.id === 'oauth') === true,
-            configured: credential.configured,
-            modelsEnabled,
-            writable: credential.writable,
-            inFlight: entry?.inFlight ?? false,
+            configured: credential.configured, modelsEnabled: this.models.isManaged(provider.id),
+            writable: credential.writable, inFlight: entry?.inFlight ?? false,
         };
     }
-    async enableModelRoute(provider) {
-        if (modelRouteEnabled(this.ctx.settings, provider.id))
-            return true;
-        if (!this.ctx.settings.writable)
-            return false;
-        await this.ctx.settings.mutate(MODEL_SETTINGS_NS, [{
-                op: 'set',
-                path: ['providers', provider.id],
-                value: { displayName: provider.modelGroupLabel },
-            }]);
-        return modelRouteEnabled(this.ctx.settings, provider.id);
-    }
     async sendSnapshot(requestId) {
         try {
             const accounts = await Promise.all(PROVIDERS.map(provider => this.account(provider)));
@@ -318,11 +324,12 @@ class OAuthConnection {
             id: randomUUID(), provider: command.provider, key: provider.key,
             controller: new AbortController(), prompts: new Map(),
         };
+        this.models.loginStarted(provider.id);
         this.active = attempt;
         this.changed();
         this.send({ type: 'started', requestId: command.requestId, attemptId: attempt.id, provider: attempt.provider });
         this.debug(`provider=${attempt.provider} stage=started`);
-        void this.ctx.authorization.begin({
+        this.track(this.ctx.authorization.begin({
             key: attempt.key,
             method: 'oauth',
             signal: attempt.controller.signal,
@@ -338,26 +345,20 @@ class OAuthConnection {
                 prompt: prompt => this.openPrompt(attempt, prompt),
             },
         }).then(async (outcome) => {
-            if (outcome.status === 'authorized') {
-                try {
-                    const enabled = await this.enableModelRoute(provider);
-                    if (!enabled) {
-                        this.sendError('model-route-unavailable', 'sign-in completed, but the OAuth model route could not be enabled', undefined, attempt.id);
-                    }
-                }
-                catch (error) {
-                    this.ctx.logger.warn('dsh-oauth-adapter: model route activation failed for %s', provider.id);
-                    this.ctx.logger.warn(error);
-                    this.sendError('model-route-unavailable', 'sign-in completed, but the OAuth model route could not be enabled', undefined, attempt.id, formatErrorDetail(error));
-                }
+            try {
+                await this.models.loginFinished(provider.id, outcome.status === 'authorized');
+            }
+            catch (error) {
+                this.sendError('model-route-unavailable', 'Sign-in completed, but model synchronization did not complete. Open Models to retry.', undefined, attempt.id, formatErrorDetail(error));
             }
             this.finish(attempt, outcome.status);
-        }, (error) => {
+        }, async (error) => {
+            await this.models.loginFinished(provider.id, false).catch(() => { });
             this.ctx.logger.warn('dsh-oauth-adapter: provider sign-in failed for %s', attempt.provider);
             this.ctx.logger.warn(error);
             this.sendError('sign-in-failed', 'sign-in failed', undefined, attempt.id, formatErrorDetail(error));
             this.finish(attempt, 'failed');
-        });
+        }));
     }
     openPrompt(attempt, prompt) {
         if (this.active !== attempt || this.closed)
@@ -428,12 +429,7 @@ class OAuthConnection {
             return;
         }
         try {
-            await this.ctx.credentials.deleteRecord(provider.key);
-            if (pluginOwnsModelRoute(this.ctx.settings, provider)) {
-                await this.ctx.settings.mutate(MODEL_SETTINGS_NS, [{
-                        op: 'unset', path: ['providers', provider.id],
-                    }]);
-            }
+            await this.models.forget(provider.id);
             this.send({ type: 'ack', requestId: command.requestId });
             await this.sendSnapshot();
         }
@@ -466,21 +462,28 @@ class OAuthConnection {
         attempt.prompts.clear();
     }
 }
-/** Mount the loopback-only OAuth WebSocket over official rc2 services. */
+/** Mount the loopback-only OAuth WebSocket over official rc services. */
 export function apply(ctx, config) {
     const debug = config.debug === true
         ? (message) => { ctx.logger.debug('dsh-oauth-adapter: %s', message); }
         : () => { };
     const connections = new Set();
+    const models = new OAuthModelService(ctx, {
+        timeoutMs: config.modelSyncTimeoutMs ?? 30000,
+        maxResponseBytes: config.modelSyncMaxResponseBytes ?? 4194304,
+        maxPages: config.modelSyncMaxPages ?? 100,
+        codexClientVersion: config.codexClientVersion ?? '0.149.0',
+    }, provider => { for (const connection of connections)
+        connection.modelChanged(provider); });
     const server = new WebSocketServer({
         noServer: true,
         maxPayload: MAX_FRAME_BYTES,
         handleProtocols: protocols => protocols.has(OAUTH_SOCKET_PROTOCOL) ? OAUTH_SOCKET_PROTOCOL : false,
     });
     server.on('connection', (socket) => {
-        const connection = new OAuthConnection(ctx, socket, debug, refresh);
+        const connection = new OAuthConnection(ctx, socket, debug, refresh, models);
         connections.add(connection);
-        socket.once('close', () => { connections.delete(connection); });
+        socket.once('close', () => { void connection.dispose().then(() => { connections.delete(connection); }); });
     });
     server.on('error', (error) => {
         ctx.logger.warn('dsh-oauth-adapter: WebSocket server failed');
@@ -507,9 +510,10 @@ export function apply(ctx, config) {
     return async () => {
         credentialDisposer();
         unregister();
-        for (const connection of connections)
-            connection.dispose();
+        const closing = [...connections].map(connection => connection.dispose());
         connections.clear();
+        await models.dispose();
+        await Promise.allSettled(closing);
         await new Promise((resolve) => { server.close(() => { resolve(); }); });
     };
 }

package/lib/model-auth.d.ts

@@ -0,0 +1,8 @@
+import type { Credential, CredentialStore } from '@earendil-works/pi-ai';
+import type { CredentialProvider, CredentialRecord } from '@deepseek-ai/dsh-credentials';
+export declare function fromRecord(record: CredentialRecord | undefined): Credential | undefined;
+/** Every refresh checks its cancellation generation while holding the credential writer lock. */
+export declare function credentialBridge(credentials: CredentialProvider, check: (provider: string) => void): CredentialStore;
+/** Only provider-authored stable account identifiers are persisted, as a one-way hash. */
+export declare function accountIdentity(provider: string, credential: Credential | undefined): string | undefined;
+//# sourceMappingURL=model-auth.d.ts.map

package/lib/model-auth.js

@@ -0,0 +1,48 @@
+/** Bridge public pi-ai authentication to DSH's existing credential records. */
+import { createHash } from 'node:crypto';
+import { recordKeyFor } from '@deepseek-ai/dsh-llm-pi-ai';
+import { ModelOperationError } from './model-discovery.js';
+export function fromRecord(record) {
+    if (!record)
+        return undefined;
+    if (record.kind === 'api-key')
+        return { type: 'api_key', ...(record.key === undefined ? {} : { key: record.key }), ...(record.env === undefined ? {} : { env: record.env }) };
+    const value = record.payload;
+    if (!value || typeof value !== 'object' || Array.isArray(value) || !('type' in value) || value.type !== 'oauth')
+        throw new ModelOperationError('credential-format', 'The stored OAuth credential is not supported; reconnect this account.');
+    return value;
+}
+function toRecord(value) {
+    if (value.type === 'api_key')
+        return { kind: 'api-key', ...(value.key === undefined ? {} : { key: value.key }), ...(value.env === undefined ? {} : { env: value.env }) };
+    // pi-ai includes undefined optional properties; the durable record is JSON.
+    return { kind: 'grant', payload: JSON.parse(JSON.stringify(value)) };
+}
+/** Every refresh checks its cancellation generation while holding the credential writer lock. */
+export function credentialBridge(credentials, check) {
+    return {
+        async read(provider) { check(provider); return fromRecord(await credentials.readRecord(recordKeyFor(provider))); },
+        async list() { return []; },
+        async modify(provider, mutate) {
+            check(provider);
+            return fromRecord(await credentials.modifyRecord(recordKeyFor(provider), async (current) => {
+                check(provider);
+                if (!current)
+                    throw new ModelOperationError('not-connected', 'This account was disconnected.');
+                const next = await mutate(fromRecord(current));
+                check(provider);
+                return next === undefined ? undefined : toRecord(next);
+            }));
+        },
+        async delete(provider) { check(provider); await credentials.deleteRecord(recordKeyFor(provider)); },
+    };
+}
+/** Only provider-authored stable account identifiers are persisted, as a one-way hash. */
+export function accountIdentity(provider, credential) {
+    if (credential?.type !== 'oauth')
+        return undefined;
+    const value = credential;
+    const id = value.accountId ?? value.userId ?? value.email;
+    return typeof id === 'string' && id.length > 0 ? createHash('sha256').update(`${provider}:${id}`).digest('hex') : undefined;
+}
+//# sourceMappingURL=model-auth.js.map

package/lib/model-catalog.d.ts

@@ -0,0 +1,27 @@
+import type { Provider } from '@earendil-works/pi-ai';
+import type { PiAiProviderProfile, ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+import { type ProviderId } from './protocol.js';
+import { type ManualModel, type DiscoveredModel, type ModelRow } from './model-types.js';
+export declare const providerFactories: Record<ProviderId, () => Provider>;
+export interface ProviderModels {
+    phase: 'pending' | 'managed';
+    restoredFromLegacy?: boolean;
+    legacy: PiAiProviderProfile;
+    manual: ManualModel[];
+    discovered?: DiscoveredModel[];
+    syncedAt?: string;
+    /** A hash of a stable provider account identity; never an access/refresh token. */
+    account?: string;
+}
+export interface ModelStore {
+    version: 1;
+    providers: Partial<Record<ProviderId, ProviderModels>>;
+}
+/** Validate data loaded from the settings file, including the opaque legacy profile. */
+export declare function validateModelStore(value: unknown): ModelStore;
+/** Exact IDs only: unrelated providers and display-name similarities confer no compatibility. */
+export declare function materialize(provider: ProviderId, state: ProviderModels, catalog?: Provider): {
+    profile: ResolvedPiAiProviderProfile;
+    rows: ModelRow[];
+};
+//# sourceMappingURL=model-catalog.d.ts.map

package/lib/model-catalog.js

@@ -0,0 +1,145 @@
+/** Build immutable pi-ai profiles from account discovery and explicitly authored models. */
+import { createProvider } from '@earendil-works/pi-ai';
+import { anthropicMessagesApi } from '@earendil-works/pi-ai/api/anthropic-messages.lazy';
+import { openAICompletionsApi } from '@earendil-works/pi-ai/api/openai-completions.lazy';
+import { githubCopilotProvider } from '@earendil-works/pi-ai/providers/github-copilot';
+import { openaiCodexProvider } from '@earendil-works/pi-ai/providers/openai-codex';
+import { anthropicProvider } from '@earendil-works/pi-ai/providers/anthropic';
+import { kimiCodingProvider } from '@earendil-works/pi-ai/providers/kimi-coding';
+import { openrouterProvider } from '@earendil-works/pi-ai/providers/openrouter';
+import { xaiProvider } from '@earendil-works/pi-ai/providers/xai';
+import { Config as PiConfig } from '@deepseek-ai/dsh-llm-pi-ai';
+import { resolveRetryPolicy } from '@deepseek-ai/dsh-llm';
+import { PROVIDERS } from './protocol.js';
+import { MODEL_PROTOCOLS, modelText, validManual } from './model-types.js';
+import { ModelOperationError } from './model-discovery.js';
+export const providerFactories = {
+    'github-copilot': githubCopilotProvider, 'openai-codex': openaiCodexProvider,
+    anthropic: anthropicProvider, 'kimi-coding': kimiCodingProvider,
+    openrouter: openrouterProvider, xai: xaiProvider,
+};
+/** Validate data loaded from the settings file, including the opaque legacy profile. */
+export function validateModelStore(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Invalid oauth-models settings');
+    const store = value;
+    if (store.version !== 1 || !store.providers || typeof store.providers !== 'object' || Array.isArray(store.providers))
+        throw new Error('Unsupported oauth-models format');
+    for (const [id, entry] of Object.entries(store.providers)) {
+        if (!PROVIDERS.some(p => p.id === id) || !entry || !['pending', 'managed'].includes(entry.phase))
+            throw new Error('Invalid OAuth model provider');
+        if (!Array.isArray(entry.manual) || entry.manual.some(m => !validManual(id, m)))
+            throw new Error('Invalid manual OAuth model');
+        if (new Set(entry.manual.map(m => m.id)).size !== entry.manual.length)
+            throw new Error('Duplicate manual OAuth model');
+        if (entry.discovered !== undefined && (!Array.isArray(entry.discovered) || entry.discovered.some(m => !m || !modelText(m.id) || (m.name !== undefined && !modelText(m.name)))))
+            throw new Error('Invalid discovered OAuth model');
+        if (entry.syncedAt !== undefined && (typeof entry.syncedAt !== 'string' || !Number.isFinite(Date.parse(entry.syncedAt))))
+            throw new Error('Invalid synchronization time');
+        if (entry.account !== undefined && (typeof entry.account !== 'string' || !/^[a-f0-9]{64}$/.test(entry.account)))
+            throw new Error('Invalid account identity');
+        if (!entry.legacy || typeof entry.legacy !== 'object' || Array.isArray(entry.legacy))
+            throw new Error('Invalid legacy profile');
+        PiConfig({ providers: { [id]: entry.legacy } });
+    }
+    return store;
+}
+/** Exact IDs only: unrelated providers and display-name similarities confer no compatibility. */
+export function materialize(provider, state, catalog = providerFactories[provider]()) {
+    const defaults = new Map(catalog.getModels().map(m => [m.id, m]));
+    const parsed = PiConfig({ providers: { [provider]: state.legacy } }).providers?.[provider];
+    if (!parsed)
+        throw new Error('Missing provider profile');
+    const manual = new Map(state.manual.map(m => [m.id, m]));
+    const configured = new Map((parsed.models ?? []).map(m => [m.id, m]));
+    const candidates = state.discovered ?? (configured.size ? [...configured.values()] : [...defaults.values()]);
+    const ids = new Set([...candidates.map(m => m.id), ...manual.keys()]);
+    const rows = [];
+    const models = [];
+    const caps = new Map();
+    for (const id of ids) {
+        const base = defaults.get(id);
+        const authored = manual.get(id);
+        const previous = configured.get(id) ?? parsed.modelOverrides?.[id];
+        const candidate = candidates.find(m => m.id === id);
+        if (!base && !authored) {
+            rows.push({ id, name: candidate?.name ?? id, source: 'pending' });
+            continue;
+        }
+        const choices = MODEL_PROTOCOLS[provider];
+        const api = authored ? authored.api ?? (choices.length === 1 ? choices[0] : base?.api) : parsed.api ?? base?.api;
+        if (!api)
+            throw new ModelOperationError('model-protocol', `Model ${id} needs a protocol.`);
+        const peers = [...defaults.values()].filter(m => m.api === api);
+        // Only provider-wide shared transport metadata can default an unknown model.
+        const shared = (items) => {
+            const first = items[0];
+            if (!first)
+                return undefined;
+            return Object.fromEntries(Object.entries(first).filter(([k, v]) => items.every(item => item && JSON.stringify(item[k]) === JSON.stringify(v))));
+        };
+        const headers = shared(peers.map(m => m.headers));
+        const compat = shared(peers.map(m => m.compat));
+        const generic = {
+            id, name: id, provider, api: api, baseUrl: parsed.baseURL ?? (provider === 'openrouter' && api === 'anthropic-messages' ? 'https://openrouter.ai/api' : catalog.baseUrl) ?? '',
+            reasoning: false, input: ['text'], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+            contextWindow: parsed.defaultContextWindow ?? 262144, maxTokens: parsed.defaultMaxTokens ?? 32768,
+            ...(headers ? { headers } : {}), ...(compat ? { compat } : {}),
+        };
+        const model = {
+            ...(base?.api === api ? base : { ...generic, ...(base ? { input: base.input, reasoning: base.reasoning, contextWindow: base.contextWindow, maxTokens: base.maxTokens, cost: base.cost } : {}) }), ...previous, id, provider, api: api,
+            name: authored ? authored.name ?? id : previous?.name ?? base?.name ?? candidate?.name ?? id,
+            ...(parsed.baseURL === undefined ? {} : { baseUrl: parsed.baseURL }),
+        };
+        const accepted = api === 'openai-completions' ? ['supportsStore', 'supportsDeveloperRole', 'supportsReasoningEffort', 'supportsUsageInStreaming', 'supportsFinishReason', 'maxTokensField', 'requiresToolResultName', 'requiresAssistantAfterToolResult', 'requiresThinkingAsText', 'requiresReasoningContentOnAssistantMessages', 'thinkingFormat', 'chatTemplateKwargs', 'chatTemplateArgs', 'supportsThinkingTokenBudget', 'supportsStrictMode', 'cacheControlFormat', 'supportsLongCacheRetention'] : api === 'anthropic-messages' ? ['supportsEagerToolInputStreaming', 'supportsLongCacheRetention', 'supportsCacheControlOnTools', 'supportsTemperature', 'forceAdaptiveThinking', 'allowEmptySignature', 'supportsStrictTools'] : ['supportsDeveloperRole', 'supportsStrictMode', 'supportsLongCacheRetention'];
+        const routeCompat = Object.fromEntries(Object.entries(parsed.compat ?? {}).filter(([key]) => accepted.includes(key)));
+        for (const key of Object.keys(previous?.compat ?? {}))
+            if (!accepted.includes(key))
+                throw new ModelOperationError('model-compat', `Model ${id} has an incompatible ${key} option.`);
+        if (Object.keys(routeCompat).length || previous?.compat)
+            model.compat = { ...(base?.api === api ? base.compat : generic.compat), ...routeCompat, ...previous?.compat };
+        if (previous?.reasoningEfforts !== undefined) {
+            model.reasoning = previous.reasoningEfforts !== false;
+            if (previous.reasoningEfforts !== false) {
+                const efforts = previous.reasoningEfforts;
+                if (!Object.entries(efforts).some(([level, value]) => level !== 'off' && typeof value === 'string' && value.length))
+                    throw new ModelOperationError('model-reasoning', `Model ${id} needs explicit reasoning levels.`);
+                model.thinkingLevelMap = Object.fromEntries(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'].flatMap(level => level === 'off' && efforts.off === null ? [] : [[level, efforts[level] ?? null]]));
+            }
+        }
+        if (!model.baseUrl)
+            throw new ModelOperationError('model-endpoint', `Provider ${provider} has no endpoint.`);
+        if (previous?.maxTokens !== undefined)
+            caps.set(id, previous.maxTokens);
+        models.push(freezeModel(model));
+        rows.push({ id, name: model.name, api, source: authored ? 'manual' : state.discovered ? 'matched' : 'catalog' });
+    }
+    const { models: _models, displayName: _displayName, apiKeyEnv: _key, retryPolicy: _retry, ...rest } = parsed;
+    const piProvider = provider === 'openrouter' ? createProvider({
+        id: provider, name: catalog.name, baseUrl: catalog.baseUrl, auth: catalog.auth, models,
+        api: { 'openai-completions': openAICompletionsApi(), 'anthropic-messages': anthropicMessagesApi() },
+    }) : { ...catalog, getModels: () => models, filterModels: (current) => current };
+    return {
+        rows,
+        profile: {
+            ...rest, provider, displayName: parsed.displayName ?? PROVIDERS.find(p => p.id === provider).modelGroupLabel,
+            streamIdleTimeoutMs: parsed.streamIdleTimeoutMs ?? 300000,
+            maxRequestImageBytes: parsed.maxRequestImageBytes ?? 20971520,
+            requestImagePixelBudget: parsed.requestImagePixelBudget ?? 4194304,
+            requestImageMaxBytes: parsed.requestImageMaxBytes ?? 1048576,
+            retryPolicy: resolveRetryPolicy(parsed.retryPolicy, `oauth-models/${provider}`),
+            configuredMaxTokens: caps,
+            piProvider,
+        },
+    };
+}
+/** Freeze JSON model metadata recursively; prepared calls retain their captured descriptions. */
+function freezeModel(value) {
+    if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+        for (const child of Object.values(value))
+            freezeModel(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+//# sourceMappingURL=model-catalog.js.map

package/lib/model-discovery.d.ts

@@ -0,0 +1,22 @@
+/** Account-scoped model discovery. Each provider owns its endpoint and response parser. */
+import type { ModelAuth } from '@earendil-works/pi-ai';
+import type { ProviderId } from './protocol.js';
+import { type DiscoveredModel } from './model-types.js';
+export declare class ModelOperationError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface DiscoveryOptions {
+    signal: AbortSignal;
+    maxBytes: number;
+    maxPages: number;
+    codexClientVersion: string;
+    fetch?: typeof globalThis.fetch;
+}
+export interface DiscoveryAuth {
+    auth: ModelAuth;
+    accountId?: string;
+}
+/** Fetch complete account-visible results; never substitute the public OpenRouter catalog. */
+export declare function discoverAccountModels(provider: ProviderId, resolved: DiscoveryAuth, options: DiscoveryOptions): Promise<DiscoveredModel[]>;
+//# sourceMappingURL=model-discovery.d.ts.map