dsh-better-copilot 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+## 0.1.0 — consolidated Copilot plugin
+
+First release of `dsh-better-copilot`, merging three independently installable
+plugins into one package with one bundle row (`better-copilot`) and one combined
+configuration object:
+
+- `dsh-copilot-catalog@0.2.9` — account-aware model discovery, Copilot wire
+  identity and the pi-ai adapter wrapper.
+- `dsh-copilot-search@0.1.5` — the `github-copilot-search` Responses web-search
+  provider.
+- `dsh-copilot-tool-schema@0.1.3` — the Copilot Gemini tool-declaration guard.
+
+Behaviour is preserved:
+
+- the wrapper still disables and replaces `llm-pi-ai`, still preserves the
+  adapter's own provider schema, and still installs the wire-identity
+  interceptor best-effort;
+- search still resolves credentials through the adapter's public pi-ai surface,
+  still keeps a search-owned guarded refresh clone, and still refuses untrusted
+  origins and redirects;
+- the guard still only adds a missing root `properties` bucket for configured
+  provider/model families and leaves every other declaration untouched.
+
+Changed:
+
+- one plugin row and one config object: `providers` (unchanged adapter schema),
+  `search` (was the search plugin's row config) and `toolSchema` (was the guard's
+  row config);
+- subpath exports are now `.`, `./catalog`, `./discovery`, `./identity`,
+  `./search` and `./guard`; the predecessor subpaths are removed;
+- the colliding `CopilotAuthOptions` type is exported as `CatalogAuthOptions`
+  and `SearchAuthOptions`;
+- a missing `web` service, a throwing guard registration, a throwing search
+  registration and a throwing identity installer are contained: they degrade
+  only their own capability instead of failing the mount.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-copilot-catalog contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,132 @@
-# Temporary Holding Version
+# dsh-better-copilot
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+One DeepSeek Harness plugin for GitHub Copilot:
+
+- **Account-aware model discovery** — reads the stored Copilot OAuth grant (or an
+  explicit API-key reference), lists the account's models, and keeps the bundled
+  catalog only as a fallback.
+- **Copilot-compatible wire identity** — installs a refcounted `fetch` header
+  interceptor while mounted so the pi-ai adapter presents Copilot client
+  identity headers.
+- **Native Responses web search** — registers the `github-copilot-search`
+  provider for the ordinary `web_search` tool.
+- **Gemini tool-declaration guard** — adds a missing root `properties` bucket to
+  tool parameter schemas for configured Copilot routes.
+
+The plugin is a replacement for, and superset of, the earlier separate
+`dsh-copilot-catalog`, `dsh-copilot-search` and `dsh-copilot-tool-schema`
+packages. Their behaviour is consolidated here; see the migration notes below.
+
+## Compatibility
+
+- DSH and DSH peer packages: `0.2.1-rc.5`.
+- `@earendil-works/pi-ai`: `^1.1.0` (host-aligned peer range; tested at `1.1.0` and `1.3.0`).
+- Node.js: `>=22.19.0`.
+
+The plugin resolves the same public pi-ai runtime the DSH adapter uses, including
+nested pnpm layouts. It vendors neither DSH nor pi-ai and does not modify
+signed applications. This is an experimental third-party integration, not
+affiliated with GitHub, DeepSeek or the pi-ai maintainers.
+
+## Installation
+
+Install or link this leaf package, not the monorepo root. The package is
+published as `dsh-better-copilot`; until a registry release exists, install the
+packed tarball or link the workspace directory. Restart the DSH host after
+installing or removing a host plugin.
+
+The bundle patch:
+
+- disables the stock `llm-pi-ai` row and mounts this plugin in its place (the
+  merged plugin is the adapter wrapper), so never enable two adapters for the
+  same route;
+- selects `github-copilot-search` for the `web` row and keeps the HTTP fetch
+  provider;
+- inserts one `better-copilot` row whose config names a `github-copilot` provider
+  profile (an empty profile, `{}`) plus default `search`/`toolSchema` settings.
+
+## Configuration
+
+```yaml
+- id: better-copilot
+  name: dsh-better-copilot
+  config:
+    providers:
+      # The pi-ai adapter's own provider profile: baseURL, apiKeyEnv, models, ...
+      github-copilot: {}
+    search:
+      model: gpt-6.1-sol
+      maxTokens: 4096
+      timeoutMs: 60000
+      maxResponseBytes: 2097152
+      includeSources: true
+      searchMode: default
+      forceSearch: false
+      # apiKeyEnv / baseURL are optional credential and endpoint overrides
+    toolSchema:
+      providers: [github-copilot]
+      families: [gemini]
+      logFixes: false
+```
+
+`providers` is the pi-ai adapter's own schema, reused unchanged, so every
+provider setting behaves exactly as it does with the stock adapter. `search`
+configures the web-search provider; `toolSchema` configures the Gemini guard.
+
+Loader patches replace a row's `config` wholesale, not key by key: an override
+must restate `providers`, `search` and `toolSchema` together.
+
+## Wire identity
+
+While mounted, the plugin installs a refcounted `fetch` header interceptor that
+rewrites Copilot request headers to a VS Code/`copilot-chat` identity. Set
+`DSH_COPILOT_WIRE_IDENTITY=basic` to avoid local VS Code IDs, or `0` to disable
+the interceptor entirely.
+
+## Search
+
+Search uses the stored `llm-pi-ai/github-copilot` credential — inference may use
+either the stock adapter or this wrapper. Sign in through DSH's normal Copilot
+flow. `web_search` is an ordinary tool independent of the conversation model; the
+existing Web search settings card is DeepSeek-specific and is not a chooser.
+
+## Guard
+
+The guard is an additive `system-prompt/assemble` listener. For a route whose
+provider is listed and whose model id contains one of the configured families it
+adds an empty root `properties` bucket to object tool schemas that lack one, and
+leaves every other schema byte-identical. It never replaces an adapter or
+another plugin's settings.
+
+## Migration from the three predecessor packages
+
+| Was | Now |
+| --- | --- |
+| package `dsh-copilot-catalog`, row `llm-pi-ai-catalog` | package `dsh-better-copilot`, row `better-copilot` |
+| package `dsh-copilot-search`, row `web-search-copilot` | same row `better-copilot`; `model` became `search.model` |
+| package `dsh-copilot-tool-schema`, row `copilot-tool-schema` | same row `better-copilot`; guard fields moved under `toolSchema.*` |
+| `@deepseek-ai/dsh-llm-pi-ai` disabled by the catalog bundle | still disabled by this bundle |
+| `web.searchProvider: github-copilot-search` | still selected by this bundle |
+
+Subpath exports also changed: the predecessor specifiers `…/provider`,
+`…/responses`, `…/auth`, `…/plugin`, `…/schema` and `…/types` are gone. Use the
+merged package root, `dsh-better-copilot/catalog`, `/discovery`, `/identity`,
+`/search` and `/guard` instead. The colliding `CopilotAuthOptions` type is
+exported as `CatalogAuthOptions` and `SearchAuthOptions`.
+
+The predecessor npm versions remain published; this repository no longer builds
+them and treats them as superseded.
+
+## Limits
+
+- Discovery is one read-only, bounded startup request; failures keep the bundled
+  catalog and log only a controlled reason code.
+- Search requests never forward credentials to redirects or untrusted origins.
+- The guard only supplies a missing `properties` bucket; it does not rewrite
+  references, unions or nested schemas.
+
+The full field mapping is: the search plugin's row-level `apiKeyEnv`, `baseURL`,
+`model`, `maxTokens`, `timeoutMs`, `maxResponseBytes`, `includeSources`,
+`searchMode` and `forceSearch` are now `search.*`; the guard's `providers`,
+`families` and `logFixes` are now `toolSchema.*`; and every adapter provider
+setting stays under `providers.*` unchanged.

package/cordis.patch.yml

@@ -0,0 +1,21 @@
+# This bundle replaces the pi-ai adapter and adds the Copilot search and guard
+# behaviours: never enable another adapter for the same route.
+# Copy any other provider configuration into the replacement before enabling.
+- id: llm-pi-ai
+  name: '@deepseek-ai/dsh-llm-pi-ai'
+  disabled: true
+# Select the search provider explicitly: the base profile pins DeepSeek search.
+# This does not replace an LLM adapter or change its model/provider configuration.
+- id: web
+  name: '@deepseek-ai/dsh-web'
+  config:
+    searchProvider: github-copilot-search
+    fetchProvider: http
+- insert:
+    - id: better-copilot
+      name: dsh-better-copilot
+      config:
+        providers:
+          github-copilot: {}
+        search: {}
+        toolSchema: {}

package/dist/auth.d.ts

@@ -0,0 +1,31 @@
+import { type CredentialKey, type CredentialProvider } from '@deepseek-ai/dsh-credentials';
+import { WebError } from '@deepseek-ai/dsh-web';
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { CopilotAuthOptions, ResolvedCopilotAuth, SearchContext, SearchRuntime } from './search-types.js';
+/** Caller cancellation of the refresh in progress on this async chain, if any. */
+export declare function callerSignal(): AbortSignal | undefined;
+export type CopilotCredentialService = Pick<CredentialProvider, 'readRecord' | 'modifyRecord' | 'resolve'>;
+declare const AUTH_FAILURES: {
+    readonly aborted: readonly ["Copilot search authentication aborted", "WEB_ABORTED"];
+    readonly invalid: readonly ["The stored Copilot credential is invalid; sign in again", "WEB_PROVIDER_AUTH_INVALID"];
+    readonly writeRefused: readonly ["Copilot search only persists refreshes of existing OAuth grants", "WEB_PROVIDER_AUTH_WRITE_REFUSED"];
+    readonly badReference: readonly ["Invalid Copilot credential reference", "WEB_PROVIDER_AUTH_INVALID"];
+    readonly missingReference: readonly ["The configured Copilot credential reference is unset", "WEB_PROVIDER_CREDENTIAL_MISSING"];
+    readonly badToken: readonly ["Copilot authentication returned an unusable token", "WEB_PROVIDER_AUTH_INVALID"];
+    readonly missingEndpoint: readonly ["An opaque Copilot API key requires an explicit trusted baseURL", "WEB_PROVIDER_ENDPOINT_MISSING"];
+    readonly failed: readonly ["Copilot search authentication failed; check credentials or sign in again", "WEB_PROVIDER_AUTH_ERROR"];
+};
+type AuthFailure = keyof typeof AUTH_FAILURES;
+/** Closed messages, even if an injected dependency constructs or mutates an owned error. */
+export declare class CopilotAuthError extends WebError {
+    readonly kind: AuthFailure;
+    constructor(kind: AuthFailure);
+}
+/**
+ * Share the adapter's serialized, cross-process record lock for refresh only.
+ * Search has no login/logout capability and cannot create or replace API-key records.
+ */
+export declare function createCopilotCredentialStore(credentials: Pick<CredentialProvider, 'readRecord' | 'modifyRecord'> | undefined, key: CredentialKey, caller?: AbortSignal): CredentialStore;
+/** Public pi-ai auth resolution on the same DSH credential record used for inference. */
+export declare function createCopilotAuthResolver(ctx: SearchContext, runtime: SearchRuntime): (options: CopilotAuthOptions, signal: AbortSignal) => Promise<ResolvedCopilotAuth | undefined>;
+export {};

package/dist/auth.js

@@ -0,0 +1,232 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { credentialRef, isCredentialRefName } from '@deepseek-ai/dsh-credentials';
+import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment';
+import { WebError } from '@deepseek-ai/dsh-web';
+import { CopilotEndpointError, trustedCopilotOrigin } from './endpoint.js';
+const PROVIDER = 'github-copilot';
+/** The installed SDK's refresh hook receives its own signal, never the caller's.
+ * Carry the caller's cancellation across the public getAuth() call so a cancelled
+ * operation cannot dispatch later requests or commit a refreshed grant.
+ */
+const callerSignals = new AsyncLocalStorage();
+/** Caller cancellation of the refresh in progress on this async chain, if any. */
+export function callerSignal() { return callerSignals.getStore(); }
+const AUTH_FAILURES = {
+    aborted: ['Copilot search authentication aborted', 'WEB_ABORTED'],
+    invalid: ['The stored Copilot credential is invalid; sign in again', 'WEB_PROVIDER_AUTH_INVALID'],
+    writeRefused: ['Copilot search only persists refreshes of existing OAuth grants', 'WEB_PROVIDER_AUTH_WRITE_REFUSED'],
+    badReference: ['Invalid Copilot credential reference', 'WEB_PROVIDER_AUTH_INVALID'],
+    missingReference: ['The configured Copilot credential reference is unset', 'WEB_PROVIDER_CREDENTIAL_MISSING'],
+    badToken: ['Copilot authentication returned an unusable token', 'WEB_PROVIDER_AUTH_INVALID'],
+    missingEndpoint: ['An opaque Copilot API key requires an explicit trusted baseURL', 'WEB_PROVIDER_ENDPOINT_MISSING'],
+    failed: ['Copilot search authentication failed; check credentials or sign in again', 'WEB_PROVIDER_AUTH_ERROR'],
+};
+/** Closed messages, even if an injected dependency constructs or mutates an owned error. */
+export class CopilotAuthError extends WebError {
+    kind;
+    constructor(kind) {
+        const safeKind = typeof kind === 'string' && Object.hasOwn(AUTH_FAILURES, kind) ? kind : 'failed';
+        const [message, code] = AUTH_FAILURES[safeKind];
+        super(message, code);
+        this.kind = safeKind;
+    }
+}
+function aborted(signal) {
+    if (signal?.aborted)
+        throw new CopilotAuthError('aborted');
+}
+function invalidCredential() {
+    throw new CopilotAuthError('invalid');
+}
+function oauthCredential(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype)
+        return invalidCredential();
+    const grant = value;
+    if (grant.type !== 'oauth' || typeof grant.access !== 'string' || !grant.access.trim() || grant.access.length > 16_384 ||
+        typeof grant.refresh !== 'string' || !grant.refresh.trim() || grant.refresh.length > 16_384 ||
+        /[\u0000-\u0020\u007f-\u009f]/u.test(grant.access) || /[\u0000-\u0020\u007f-\u009f]/u.test(grant.refresh) ||
+        typeof grant.expires !== 'number' || !Number.isFinite(grant.expires) || grant.expires < 0)
+        return invalidCredential();
+    return structuredClone(grant);
+}
+/** Read only the credential family owned by the original pi-ai adapter. */
+function fromRecord(record) {
+    if (record === undefined)
+        return undefined;
+    if (record.kind === 'grant')
+        return oauthCredential(record.payload);
+    if (record.kind !== 'api-key')
+        return invalidCredential();
+    if (record.key !== undefined && (typeof record.key !== 'string' || !record.key.trim()))
+        return invalidCredential();
+    if (record.env !== undefined && (typeof record.env !== 'object' || record.env === null ||
+        Array.isArray(record.env) || Object.entries(record.env).some(([key, value]) => !isCredentialRefName(key) || typeof value !== 'string'))) {
+        return invalidCredential();
+    }
+    return {
+        type: 'api_key',
+        ...(record.key === undefined ? {} : { key: record.key }),
+        ...(record.env === undefined ? {} : { env: { ...record.env } }),
+    };
+}
+/** Match the adapter's JSON image without laundering nonfinite values or foreign prototypes. */
+function jsonImage(value) {
+    if (Array.isArray(value))
+        return value.map((entry) => entry === undefined ? null : jsonImage(entry));
+    if (value !== null && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) {
+        return Object.fromEntries(Object.entries(value).filter(([, member]) => member !== undefined)
+            .map(([key, member]) => [key, jsonImage(member)]));
+    }
+    return value;
+}
+/**
+ * Share the adapter's serialized, cross-process record lock for refresh only.
+ * Search has no login/logout capability and cannot create or replace API-key records.
+ */
+export function createCopilotCredentialStore(credentials, key, caller) {
+    // Checked before the transaction and again before it commits; the SDK's refresh hook
+    // no longer receives the caller's signal, so cancellation must be honoured here.
+    const cancelled = () => caller?.aborted === true || callerSignal()?.aborted === true;
+    const read = async (providerId, options) => {
+        aborted(options?.signal);
+        if (providerId !== PROVIDER)
+            return undefined;
+        const record = await credentials?.readRecord(key);
+        aborted(options?.signal);
+        return fromRecord(record);
+    };
+    return {
+        read,
+        async list(options) {
+            const current = await read(PROVIDER, options);
+            return current === undefined ? [] : [{ providerId: PROVIDER, type: current.type }];
+        },
+        async modify(providerId, mutate, options) {
+            aborted(options?.signal);
+            if (providerId !== PROVIDER || credentials === undefined) {
+                throw new CopilotAuthError('writeRefused');
+            }
+            const record = await credentials.modifyRecord(key, async (current) => {
+                // DSH's lock wait is not cancellable: check again once it actually acquired the lock.
+                aborted(options?.signal);
+                // The SDK's refresh hook no longer receives the caller's signal, so a refresh that
+                // finished after cancellation must not commit through this managed record write.
+                if (cancelled())
+                    throw new CopilotAuthError('aborted');
+                const previous = fromRecord(current);
+                // Capture eligibility and account authority before passing a mutable clone to the SDK.
+                const wasOAuth = current?.kind === 'grant' && previous?.type === 'oauth';
+                const refreshOwner = previous?.type === 'oauth' ? previous.refresh : undefined;
+                const enterpriseOwner = previous?.type === 'oauth' ? previous.enterpriseUrl : undefined;
+                const next = await mutate(previous);
+                aborted(options?.signal);
+                // The SDK calls this mutator with the refresh inside it, so gate the commit
+                // itself: a refresh that finished after caller cancellation must not persist.
+                if (cancelled())
+                    throw new CopilotAuthError('aborted');
+                if (next === undefined)
+                    return undefined;
+                if (!wasOAuth || next.type !== 'oauth')
+                    throw new CopilotAuthError('writeRefused');
+                const refreshed = oauthCredential(next);
+                if (refreshed.refresh !== refreshOwner || refreshed.enterpriseUrl !== enterpriseOwner) {
+                    throw new CopilotAuthError('writeRefused');
+                }
+                const payload = jsonImage(refreshed);
+                aborted(options?.signal);
+                return { kind: 'grant', payload };
+            });
+            aborted(options?.signal);
+            return fromRecord(record);
+        },
+        async delete() {
+            throw new CopilotAuthError('writeRefused');
+        },
+    };
+}
+/** Observe late settlement while caller cancellation releases the request promptly. */
+function abortable(operation, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(new CopilotAuthError('aborted'));
+        signal.addEventListener('abort', onAbort, { once: true });
+        operation.then((value) => {
+            signal.removeEventListener('abort', onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener('abort', onAbort);
+            reject(error);
+        });
+        if (signal.aborted)
+            onAbort();
+    });
+}
+/** Public pi-ai auth resolution on the same DSH credential record used for inference. */
+export function createCopilotAuthResolver(ctx, runtime) {
+    return async (options, signal) => {
+        aborted(signal);
+        const work = async () => {
+            const explicitOrigin = options.baseURL === undefined ? undefined : trustedCopilotOrigin(options.baseURL);
+            if (options.apiKeyEnv !== undefined && !isCredentialRefName(options.apiKeyEnv)) {
+                throw new CopilotAuthError('badReference');
+            }
+            // Snapshot both storage and launch environment for this operation, not startup.
+            const credentials = ctx.get('credentials');
+            const environment = launchEnvironmentOf(ctx);
+            const readReference = async (name) => {
+                aborted(signal);
+                if (!isCredentialRefName(name))
+                    return undefined;
+                const hit = await credentials?.resolve(credentialRef(name));
+                aborted(signal);
+                return hit?.value ?? environment.get(name)?.value;
+            };
+            const apiKey = options.apiKeyEnv === undefined ? undefined : await readReference(options.apiKeyEnv);
+            aborted(signal);
+            if (options.apiKeyEnv !== undefined && (typeof apiKey !== 'string' || !apiKey.trim())) {
+                throw new CopilotAuthError('missingReference');
+            }
+            const models = runtime.createModels({
+                credentials: createCopilotCredentialStore(credentials, runtime.recordKeyFor(PROVIDER), signal),
+                authContext: { env: readReference, fileExists: async () => false },
+            });
+            models.setProvider(runtime.provider);
+            const resolved = await callerSignals.run(signal, () => models.getAuth(PROVIDER, { signal, ...(apiKey === undefined ? {} : { apiKey }) }));
+            aborted(signal);
+            if (resolved === undefined)
+                return undefined;
+            const token = resolved.auth.apiKey;
+            if (typeof token !== 'string' || !token.trim() || token.length > 16_384 || /[\u0000-\u0020\u007f-\u009f]/u.test(token)) {
+                throw new CopilotAuthError('badToken');
+            }
+            // OAuth's account endpoint owns routing; an explicit origin is an API-key setting only.
+            let baseUrl = resolved.auth.baseUrl ?? explicitOrigin;
+            if (baseUrl === undefined && /(?:^|;)proxy-ep=[^;]+/u.test(token)) {
+                const derived = await runtime.oauth.toAuth({ type: 'oauth', access: token, refresh: '', expires: 0 });
+                aborted(signal);
+                baseUrl = derived.baseUrl;
+            }
+            if (baseUrl === undefined) {
+                throw new CopilotAuthError('missingEndpoint');
+            }
+            const origin = trustedCopilotOrigin(baseUrl);
+            aborted(signal);
+            return { apiKey: token, baseUrl: origin, headers: runtime.headers };
+        };
+        try {
+            return await abortable(work(), signal);
+        }
+        catch (error) {
+            aborted(signal);
+            // Error classification and getters can themselves throw; never expose that exception.
+            let controlled;
+            try {
+                if (error instanceof CopilotAuthError)
+                    controlled = new CopilotAuthError(error.kind);
+                else if (error instanceof CopilotEndpointError)
+                    controlled = new CopilotEndpointError();
+            }
+            catch { /* malformed host dependency errors degrade to the fixed auth failure */ }
+            throw controlled ?? new CopilotAuthError('failed');
+        }
+    };
+}

package/dist/catalog-types.d.ts

@@ -0,0 +1,54 @@
+import type { Api, Model, OAuthAuth, OAuthCredential } from '@earendil-works/pi-ai';
+export type OriginalAdapter = Pick<typeof import('@deepseek-ai/dsh-llm-pi-ai'), 'name' | 'Config' | 'inject' | 'apply' | 'recordKeyFor'>;
+export type PluginContext = Parameters<OriginalAdapter['apply']>[0];
+export type PluginConfig = Parameters<OriginalAdapter['apply']>[1];
+export type CredentialKey = ReturnType<OriginalAdapter['recordKeyFor']>;
+export type ModelCatalog = Record<string, Model<Api>>;
+export type CopilotOAuth = Pick<OAuthAuth, 'refresh' | 'toAuth'>;
+export type CopilotGrant = OAuthCredential;
+/** Only the read seam is accepted; discovery has no credential write capability. */
+export interface CredentialReader {
+    readRecord(key: CredentialKey): Promise<unknown>;
+}
+export interface AccountSelection {
+    models: ModelCatalog;
+    unsupported: string[];
+}
+export type SyncResult = {
+    status: 'no Copilot credential';
+} | {
+    status: 'synced';
+    count: number;
+    unsupported: string[];
+};
+export interface CopilotAuthOptions {
+    /** Explicit API-key route endpoint; OAuth grants still own their derived endpoint. */
+    baseUrl?: string;
+    /** An explicit apiKeyEnv reference wins over the stored account grant, as in pi-ai. */
+    resolveApiKey?: () => Promise<string | undefined>;
+    /** Read-only ambient lookup, consulted only when no OAuth grant owns the route. */
+    resolveAmbientApiKey?: () => Promise<string | undefined>;
+}
+export interface DiscoveryOptions extends CopilotAuthOptions {
+    catalog: ModelCatalog;
+    oauth: CopilotOAuth;
+    recordKey: CredentialKey;
+    fetcher?: typeof globalThis.fetch;
+    timeoutMs?: number;
+    now?: () => number;
+    /** Routing may adopt a validated account endpoint even if model listing later fails. */
+    onEndpoint?: (baseUrl: string) => void;
+}
+export interface PluginDependencies extends Omit<DiscoveryOptions, 'recordKey'> {
+    original: OriginalAdapter;
+    /** Test seam for the process-wide wire-identity installer; defaults to the real interceptor. */
+    installIdentity?: () => () => void;
+}
+export interface CatalogPlugin {
+    name: OriginalAdapter['name'];
+    Config: OriginalAdapter['Config'];
+    inject: string[];
+    sync(credentials?: CredentialReader, authOptions?: CopilotAuthOptions): Promise<SyncResult>;
+    apply(ctx: PluginContext, config: PluginConfig): Promise<void>;
+}
+export declare function asRecord(value: unknown): Record<string, unknown> | undefined;

package/dist/catalog-types.js

@@ -0,0 +1,4 @@
+export function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+}

package/dist/catalog.d.ts

@@ -0,0 +1,15 @@
+import type { ModelCost } from '@earendil-works/pi-ai';
+import { type AccountSelection, type ModelCatalog } from './catalog-types.js';
+export declare const DEFAULT_COPILOT_BASE_URL = "https://api.individual.githubcopilot.com";
+export interface AccountModelOptions {
+    /** Trusted account API root. Startup discovery supplies the validated OAuth origin. */
+    baseUrl?: string;
+}
+/** Copy only provider identity headers; never inherit Authorization or API keys. */
+export declare function copilotHeaders(catalog: ModelCatalog): Record<string, string>;
+/** Convert cents per million tokens only when every required price is valid. */
+export declare function liveCost(billing: unknown, fallback: ModelCost): ModelCost;
+/** Pure selection: preserve known descriptors; build any new ID from endpoint/capability metadata. */
+export declare function selectAccountModels(response: unknown, catalog: ModelCatalog, { baseUrl, }?: AccountModelOptions): AccountSelection;
+/** Validate mutability before touching a shared upstream catalog. */
+export declare function replaceCatalog(catalog: ModelCatalog, models: ModelCatalog): void;