@tnnevol/dsh-codex-auth 0.1.0-rc.7

package/lib/index.d.ts

@@ -0,0 +1,126 @@
+import { CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH } from "./auth-paths.js";
+import { a as CODEX_AUTH_FILENAME, c as codexAuthPath, i as logoutCodex, n as codexAuthStatus, o as CODEX_PROVIDER, r as loginCodex, s as CodexCredentialStore, t as CodexAuthStatus } from "./auth-BBBeI24-.js";
+import { CredentialProvider } from "@deepseek-ai/dsh-credentials";
+import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { Context } from "@deepseek-ai/cordis";
+import { IncomingMessage } from "node:http";
+//#region src/credential-mirror.d.ts
+/** Credential reference exposed to the official `llm-pi-ai` model settings UI. */
+declare const CODEX_API_KEY_ENV = "OPENAI_CODEX_AUTH_TOKEN";
+declare const CODEX_API_KEY_REF: import("@deepseek-ai/dsh-credentials").CredentialRef;
+/**
+ * Makes the plugin-owned OAuth token visible to the generic dsh adapter.
+ *
+ * `llm-pi-ai` deliberately resolves named credentials through `ctx.credentials`
+ * on every request. The OAuth document remains the source of truth; this class
+ * only mirrors the short-lived access token so the official Models page can
+ * show its configured state and the generic adapter can send Codex requests.
+ */
+declare class CodexCredentialMirror {
+  private readonly credentials;
+  private readonly store;
+  private readonly models;
+  private operation;
+  constructor(credentials: CredentialProvider, store: CodexCredentialStore);
+  /** Refresh OAuth when needed, then update the generic dsh credential seam. */
+  sync(): Promise<void>;
+  /** Remove the mirrored token after the plugin-owned account signs out. */
+  clear(): Promise<void>;
+  private syncNow;
+}
+//#endregion
+//#region src/adapter.d.ts
+/** Keep the Codex stream open while the provider is still producing output. */
+declare const CODEX_STREAM_IDLE_TIMEOUT_MS = 300000;
+/** Create the dsh LLM adapter for the provider-native OpenAI Codex catalog. */
+declare function createCodexAdapter(credentials: CodexCredentialStore, resolveAttachments: () => AttachmentStore | undefined): PiAiAdapter;
+//#endregion
+//#region src/usage.d.ts
+interface CodexUsageWindow {
+  remainingPercent?: number;
+  limitWindowSeconds?: number;
+  resetAfterSeconds?: number;
+  resetAt?: number;
+}
+interface CodexUsageCredits {
+  hasCredits?: boolean;
+  unlimited?: boolean;
+  balance?: string;
+}
+/** Deliberately excludes the OAuth token and other upstream response fields. */
+interface CodexUsage {
+  planType?: string;
+  allowed?: boolean;
+  limitReached?: boolean;
+  primaryWindow?: CodexUsageWindow;
+  secondaryWindow?: CodexUsageWindow;
+  credits?: CodexUsageCredits;
+}
+/** Normalize the evolving private WHAM response into a small UI-safe shape. */
+declare function normalizeCodexUsagePayload(value: unknown): CodexUsage;
+/** Resolves OAuth (including refresh) before making the quota request. */
+declare class CodexUsageService {
+  private readonly store;
+  private readonly models;
+  private operation;
+  constructor(store: CodexCredentialStore);
+  read(): Promise<CodexUsage | undefined>;
+  private readNow;
+}
+//#endregion
+//#region src/auth-routes.d.ts
+type CodexWebAuthStatus = {
+  status: 'signed-out';
+} | {
+  status: 'signing-in';
+} | {
+  status: 'signed-in';
+  expiresAt?: Date;
+} | {
+  status: 'error';
+  message: string;
+};
+/** One-time code generated by the Codex device authorization flow. */
+interface CodexLoginChallenge {
+  type: 'device_code';
+  userCode: string;
+  verificationUri: string;
+  intervalSeconds?: number;
+  expiresInSeconds?: number;
+}
+/** Owns one device-code login operation and prevents duplicate auth requests. */
+declare class CodexWebAuth {
+  private readonly store;
+  private readonly challengeTimeoutMs;
+  private readonly mirror?;
+  private state;
+  private operation;
+  private cancellation;
+  private challenge;
+  private challengeWaiters;
+  private challengeTimer;
+  constructor(store: CodexCredentialStore, challengeTimeoutMs?: number, mirror?: CodexCredentialMirror | undefined);
+  status(): Promise<CodexWebAuthStatus>;
+  signIn(): Promise<CodexLoginChallenge>;
+  signOut(): Promise<void>;
+  dispose(): Promise<void>;
+  private start;
+  private onEvent;
+  private rejectChallenge;
+  private clearChallengeTimer;
+  private cancelSignIn;
+}
+/** Protect mutating routes while allowing the NAS app's loopback proxy. */
+declare function trustedRequest(req: IncomingMessage): boolean;
+/** Register the auth endpoints when the DSH Web server is available. */
+declare function registerCodexAuthRoutes(ctx: Context, store: CodexCredentialStore, mirror?: CodexCredentialMirror): void;
+//#endregion
+//#region src/index.d.ts
+/** Stable Host bundle name. */
+declare const name = "dsh-codex-auth-plugin";
+/** Host services required by the routes, settings card, and credential mirror. */
+declare const inject: string[];
+declare function apply(ctx: Context): void;
+//#endregion
+export { CODEX_API_KEY_ENV, CODEX_API_KEY_REF, CODEX_AUTH_FILENAME, CODEX_AUTH_LOGIN_PATH, CODEX_AUTH_LOGOUT_PATH, CODEX_AUTH_SETTINGS_NAMESPACE, CODEX_AUTH_STATUS_PATH, CODEX_PROVIDER, CODEX_STREAM_IDLE_TIMEOUT_MS, type CodexAuthStatus, CodexCredentialMirror, CodexCredentialStore, type CodexLoginChallenge, CodexUsageService, CodexWebAuth, type CodexWebAuthStatus, apply, codexAuthPath, codexAuthStatus, createCodexAdapter, inject, loginCodex, logoutCodex, name, normalizeCodexUsagePayload, registerCodexAuthRoutes, trustedRequest };