dsh-coding-subscription-oauth 0.5.0

package/lib/codex-images.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Optional Codex image generation/edits against the private ChatGPT backend.
+ * Fixed model `gpt-image-2` with `auto` size/quality/background defaults.
+ * Always requests `response_format: b64_json`. Only `b64_json` items are
+ * accepted after an encoded-size precheck and strict base64/base64url decode.
+ * Edit IDs resolve solely from canonical image attachment refs that are
+ * visibly present in the current session's top-level message content (max 5).
+ *
+ * @module dsh-coding-subscription-oauth/codex-images
+ */
+import type { ImageAttachmentRef, ImageMediaType, SaveImageAttachment, StoredImageAttachment } from "@deepseek-ai/dsh-attachment";
+import { type CodexAuthSession, type CodexFetch, type CodexHttpClient } from "./codex-http.js";
+export declare const CODEX_IMAGE_GENERATION_URL = "https://chatgpt.com/backend-api/codex/images/generations";
+export declare const CODEX_IMAGE_EDIT_URL = "https://chatgpt.com/backend-api/codex/images/edits";
+export declare const CODEX_IMAGE_MODEL = "gpt-image-2";
+export declare const CODEX_IMAGE_AUTO = "auto";
+export declare const CODEX_IMAGE_RESPONSE_FORMAT = "b64_json";
+export declare const CODEX_IMAGE_MAX_REFERENCES = 5;
+export declare const CODEX_IMAGE_PROMPT_MAX_LENGTH = 4000;
+export declare const CODEX_IMAGE_CAPABLE_PROVIDERS: readonly ["codex-oauth", "openai-codex", "codex-oauth-fast"];
+export type CodexImageCapableProvider = (typeof CODEX_IMAGE_CAPABLE_PROVIDERS)[number];
+export declare const CODEX_IMAGE_SIZES: readonly ["auto", "1024x1024", "1536x1024", "1024x1536"];
+export type CodexImageSize = (typeof CODEX_IMAGE_SIZES)[number];
+export declare const CODEX_IMAGE_QUALITIES: readonly ["auto", "low", "medium", "high"];
+export type CodexImageQuality = (typeof CODEX_IMAGE_QUALITIES)[number];
+export declare const CODEX_IMAGE_BACKGROUNDS: readonly ["auto", "opaque", "transparent"];
+export type CodexImageBackground = (typeof CODEX_IMAGE_BACKGROUNDS)[number];
+export interface CodexImageAttachmentStore {
+    readonly imageLimits: {
+        readonly maxImageBytes: number;
+        readonly maxImagesPerMessage: number;
+        readonly maxMessageImageBytes: number;
+        readonly mediaTypes: readonly ImageMediaType[];
+    };
+    validateImage(input: SaveImageAttachment): Promise<void>;
+    saveImage(input: SaveImageAttachment): Promise<ImageAttachmentRef>;
+    readImage(ref: ImageAttachmentRef, signal?: AbortSignal): Promise<StoredImageAttachment>;
+}
+export interface CodexDerivedMessage {
+    readonly content?: readonly unknown[];
+}
+export interface CodexImageRoute {
+    readonly provider?: string;
+    readonly model?: string;
+    readonly inputModalities?: readonly string[];
+}
+export interface CodexImageSessionContext {
+    deriveMessages(): readonly CodexDerivedMessage[];
+    route?: CodexImageRoute;
+}
+export interface CodexImageGenerateInput {
+    readonly prompt: string;
+    readonly n?: number;
+    readonly size?: CodexImageSize;
+    readonly quality?: CodexImageQuality;
+    readonly background?: CodexImageBackground;
+}
+export interface CodexImageEditInput extends CodexImageGenerateInput {
+    readonly imageIds: readonly string[];
+}
+export interface CodexImageWarning {
+    readonly index: number;
+    readonly code: string;
+    readonly message: string;
+}
+export interface CodexImageResult {
+    readonly operation: "generate" | "edit";
+    readonly model: typeof CODEX_IMAGE_MODEL;
+    readonly images: readonly ImageAttachmentRef[];
+    readonly references: readonly ImageAttachmentRef[];
+    readonly warnings: readonly CodexImageWarning[];
+}
+export interface CodexImageControllerOptions {
+    readonly auth: CodexAuthSession;
+    readonly attachments: CodexImageAttachmentStore;
+    readonly session: CodexImageSessionContext;
+    readonly http?: CodexHttpClient;
+    readonly fetchImpl?: CodexFetch;
+    readonly originator?: string;
+    readonly userAgent?: string;
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    readonly now?: () => number;
+}
+export interface CodexImageController {
+    generate(input: CodexImageGenerateInput, signal?: AbortSignal): Promise<CodexImageResult>;
+    edit(input: CodexImageEditInput, signal?: AbortSignal): Promise<CodexImageResult>;
+}
+/** True only for a Codex OAuth route that explicitly declares image input. */
+export declare function isCodexImageCapableRoute(route: CodexImageRoute | undefined): boolean;
+export declare function assertCodexImageCapableRoute(route: CodexImageRoute | undefined): void;
+/**
+ * Collect canonical image attachment refs visibly present in current session
+ * message content. Nested tool-results and arbitrary objects are ignored.
+ */
+export declare function collectCanonicalImageRefs(messages: readonly CodexDerivedMessage[]): Map<string, ImageAttachmentRef>;
+/**
+ * Resolve edit IDs only against canonical refs visibly present in `deriveMessages()`.
+ * Unknown IDs, HTTP URLs, nested-only objects, and more than
+ * {@link CODEX_IMAGE_MAX_REFERENCES} are rejected (fail closed).
+ */
+export declare function resolveSessionImageRefs(deriveMessages: () => readonly CodexDerivedMessage[], imageIds: readonly string[]): ImageAttachmentRef[];
+export declare function detectImageMediaType(data: Uint8Array): ImageMediaType | undefined;
+/** Encoded-size precheck. `undefined` means the payload is not valid base64/base64url. */
+export declare function estimateDecodedBase64Bytes(value: string): number | undefined;
+/** Decode standard base64 or base64url. Rejects invalid alphabets and length mismatches. */
+export declare function decodeImageBase64(value: string): Uint8Array | undefined;
+/** Factory for generate/edit controllers. Parent registers tools only when the feature is enabled. */
+export declare function createCodexImageController(options: CodexImageControllerOptions): CodexImageController;
+//# sourceMappingURL=codex-images.d.ts.map

package/lib/codex-images.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-images.d.ts","sourceRoot":"","sources":["../../src/codex-images.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EAGpB,MAAM,iBAAiB,CAAC;AAEzB,eAAO,MAAM,0BAA0B,6DAA6D,CAAC;AACrG,eAAO,MAAM,oBAAoB,uDAAuD,CAAC;AACzF,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,eAAO,MAAM,gBAAgB,SAAS,CAAC;AACvC,eAAO,MAAM,2BAA2B,aAAa,CAAC;AACtD,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAC5C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD,eAAO,MAAM,6BAA6B,8DAA+D,CAAC;AAC1G,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvF,eAAO,MAAM,iBAAiB,0DAA2D,CAAC;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB,4CAA6C,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,eAAO,MAAM,uBAAuB,4CAA6C,CAAC;AAClF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;KAC/C,CAAC;IACF,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,SAAS,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACxC,cAAc,IAAI,SAAS,mBAAmB,EAAE,CAAC;IACjD,KAAK,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,OAAO,iBAAiB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAClF;AAID,8EAA8E;AAC9E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAOpF;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAIrF;AAaD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,mBAAmB,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAanH;AAMD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACtC,cAAc,EAAE,MAAM,SAAS,mBAAmB,EAAE,EACpD,QAAQ,EAAE,SAAS,MAAM,EAAE,GACzB,kBAAkB,EAAE,CAiCtB;AAMD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAkBjF;AAUD,0FAA0F;AAC1F,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM5E;AAED,4FAA4F;AAC5F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAcvE;AAuLD,sGAAsG;AACtG,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,2BAA2B,GAAG,oBAAoB,CAiCrG"}

package/lib/codex-model-capabilities.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Live Codex model service-tier cache and composable fast-route payload helpers.
+ *
+ * Fetches `GET /backend-api/codex/models?client_version=…`, caches `service_tiers`,
+ * and never invents eligibility when the live catalog is missing or stale.
+ * A stale TTL is unknown: Fast is default-deny until a live, non-stale catalog
+ * explicitly lists `priority` for that model. `isEligible` is required and
+ * fail-closed — omitting it or returning false injects nothing.
+ *
+ * Ordinary inference stays unchanged: the unwrapped provider is never mutated.
+ * A wrapper may use a distinct profile provider id (`codex-oauth-fast`) while
+ * restoring native `model.provider` for the base wire call and the same catalog.
+ *
+ * @module dsh-coding-subscription-oauth/codex-model-capabilities
+ */
+import { type CodexAuthSession, type CodexFetch, type CodexHttpClient } from "./codex-http.js";
+import { CODEX_OAUTH_FAST_ROUTE } from "./ids.js";
+/** Distinct optional Harness route; parent owns dynamic registration. */
+export { CODEX_OAUTH_FAST_ROUTE };
+export declare const CODEX_MODELS_URL = "https://chatgpt.com/backend-api/codex/models";
+export declare const DEFAULT_CODEX_CLIENT_VERSION = "0.144.0";
+export declare const DEFAULT_CODEX_SERVICE_TIER = "priority";
+export declare const CODEX_ROUTING_HINT_HEADER = "x-codex-routing-hint";
+export interface CodexModelCapability {
+    readonly id: string;
+    readonly serviceTiers: readonly string[];
+}
+export interface CodexModelCapabilitiesOptions {
+    readonly auth: CodexAuthSession;
+    readonly http?: CodexHttpClient;
+    readonly fetchImpl?: CodexFetch;
+    readonly clientVersion?: string;
+    readonly originator?: string;
+    readonly userAgent?: string;
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    readonly now?: () => number;
+    readonly ttlMs?: number;
+}
+export interface CodexModelCapabilities {
+    refresh(signal?: AbortSignal): Promise<readonly CodexModelCapability[]>;
+    clear(): void;
+    getCached(): readonly CodexModelCapability[] | undefined;
+    serviceTiers(modelId: string): readonly string[];
+    isPriorityEligible(modelId: string): boolean;
+    isTierEligible(modelId: string, tier: string): boolean;
+}
+export type CodexOnPayload = (payload: unknown, model: unknown) => unknown | undefined | Promise<unknown | undefined>;
+export interface CodexFastStreamOptions {
+    onPayload?: CodexOnPayload;
+    headers?: Record<string, string | null>;
+    [key: string]: unknown;
+}
+/**
+ * Fast-route composition is default-deny.
+ * `isEligible` is required; missing or false means no header and no `service_tier`.
+ */
+export interface CodexFastRoutingOptions {
+    readonly isEligible: (modelId: string) => boolean;
+    readonly serviceTier?: string;
+    /** Distinct profile/route id for the wrapper (e.g. {@link CODEX_OAUTH_FAST_ROUTE}). */
+    readonly profileProviderId?: string;
+    /** Native provider id restored on `model.provider` before the base wire call. */
+    readonly nativeProviderId?: string;
+}
+export interface CodexStreamModel {
+    readonly id: string;
+    readonly provider?: string;
+    readonly [key: string]: unknown;
+}
+/** Structural pi-ai provider face; `never` parameters keep native Provider assignable. */
+export interface CodexStreamableProvider {
+    readonly id: string;
+    readonly headers?: Record<string, string | null>;
+    stream: (model: never, context: never, options?: never) => unknown;
+    streamSimple: (model: never, context: never, options?: never) => unknown;
+}
+/** Wrapper face with callable stream methods and a possibly distinct profile id. */
+export type CodexFastWrappedProvider<P extends CodexStreamableProvider> = Omit<P, "id" | "headers" | "stream" | "streamSimple"> & {
+    readonly id: string;
+    readonly headers?: Record<string, string | null>;
+    stream: (model: CodexStreamModel, context: unknown, options?: CodexFastStreamOptions) => unknown;
+    streamSimple: (model: CodexStreamModel, context: unknown, options?: CodexFastStreamOptions) => unknown;
+};
+/** Parse the live models envelope. Unknown shapes yield an empty catalog, never a hardcoded fallback. */
+export declare function parseCodexModelCapabilities(value: unknown): CodexModelCapability[];
+export declare function codexModelsUrl(clientVersion: string): string;
+/** Exact per-model Fast header value. Never a bare static `priority`. */
+export declare function codexRoutingHint(modelId: string, tier?: string): string;
+/**
+ * Compose an existing `onPayload` with service_tier injection.
+ * Does not override a payload that already set `service_tier`.
+ * Fail-closed: injection happens only when `isEligible(modelId)` is exactly true.
+ */
+export declare function composeCodexFastOnPayload(inner: CodexOnPayload | undefined, options: CodexFastRoutingOptions): CodexOnPayload;
+/** Merge `x-codex-routing-hint=model=<slug>;tier=<tier>` without dropping existing keys. */
+export declare function composeCodexFastHeaders(headers: Record<string, string | null> | undefined, modelId: string, tier?: string): Record<string, string | null>;
+/** Apply fast-route payload + per-model header composition to one stream-options object. */
+export declare function applyCodexFastStreamOptions<T extends CodexFastStreamOptions>(options: T | undefined, config: CodexFastRoutingOptions, modelId: string): T;
+/**
+ * Wrap a pi-ai provider for a future `codex-oauth-fast` route.
+ * The original provider object is not mutated. The wrapper may advertise a
+ * distinct profile provider id while restoring native `model.provider` so the
+ * base wire call and model catalog stay on the native provider.
+ */
+export declare function withCodexFastRouting<P extends CodexStreamableProvider>(provider: P, options: CodexFastRoutingOptions): CodexFastWrappedProvider<P>;
+/**
+ * Live `/codex/models` cache. Fetch failures leave ordinary inference alone.
+ * Eligibility is false until a live, non-stale catalog explicitly lists the tier.
+ * A stale TTL is treated as unknown, not as the last known catalog.
+ */
+export declare function createCodexModelCapabilities(options: CodexModelCapabilitiesOptions): CodexModelCapabilities;
+//# sourceMappingURL=codex-model-capabilities.d.ts.map

package/lib/codex-model-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-model-capabilities.d.ts","sourceRoot":"","sources":["../../src/codex-model-capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EAIpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD,yEAAyE;AACzE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAElC,eAAO,MAAM,gBAAgB,iDAAiD,CAAC;AAC/E,eAAO,MAAM,4BAA4B,YAAY,CAAC;AACtD,eAAO,MAAM,0BAA0B,aAAa,CAAC;AACrD,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAIhE,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IACxE,KAAK,IAAI,IAAI,CAAC;IACd,SAAS,IAAI,SAAS,oBAAoB,EAAE,GAAG,SAAS,CAAC;IACzD,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACjD,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7C,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACvD;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;AAEtH,MAAM,WAAW,sBAAsB;IACtC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,KAAK,OAAO,CAAC;IACnE,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,KAAK,OAAO,CAAC;CACzE;AAED,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,uBAAuB,IAAI,IAAI,CAC7E,CAAC,EACD,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAC5C,GAAG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC;IACjG,YAAY,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC;CACvG,CAAC;AAoBF,yGAAyG;AACzG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,CAclF;AAED,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAA6B,GAAG,MAAM,CAE3F;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,OAAO,EAAE,uBAAuB,GAC9B,cAAc,CAWhB;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,EAClD,OAAO,EAAE,MAAM,EACf,IAAI,SAA6B,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAE/B;AAED,4FAA4F;AAC5F,wBAAgB,2BAA2B,CAAC,CAAC,SAAS,sBAAsB,EAC3E,OAAO,EAAE,CAAC,GAAG,SAAS,EACtB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,MAAM,GACb,CAAC,CAYH;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,uBAAuB,EACrE,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,uBAAuB,GAC9B,wBAAwB,CAAC,CAAC,CAAC,CAqB7B;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,sBAAsB,CA8D3G"}

package/lib/codex-search.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Optional Codex subscription search against the private ChatGPT backend.
+ * Default-off: parent registers the returned provider only when the user enables it.
+ *
+ * @module dsh-coding-subscription-oauth/codex-search
+ */
+import { type CodexAuthSession, type CodexFetch, type CodexHttpClient } from "./codex-http.js";
+/** Stable search-provider id. Parent must not write this into `web.searchProvider` by default. */
+export declare const CODEX_SEARCH_PROVIDER_ID = "codex-oauth-search";
+/** Official Codex standalone search endpoint. */
+export declare const CODEX_SEARCH_URL = "https://chatgpt.com/backend-api/codex/alpha/search";
+export declare const CODEX_SEARCH_CONTEXT_SIZES: readonly ["low", "medium", "high"];
+export type CodexSearchContextSize = (typeof CODEX_SEARCH_CONTEXT_SIZES)[number];
+export declare const CODEX_SEARCH_MODES: readonly ["live", "cached", "indexed"];
+export type CodexSearchMode = (typeof CODEX_SEARCH_MODES)[number];
+export type CodexExternalWebAccess = true | false | "indexed";
+export interface CodexSearchSource {
+    readonly url: string;
+    readonly title?: string;
+    readonly snippet?: string;
+}
+export interface CodexSearchRequest {
+    readonly query: string;
+    readonly maxResults?: number;
+}
+export interface CodexSearchResult {
+    readonly content?: string;
+    readonly sources: readonly CodexSearchSource[];
+    readonly truncated: boolean;
+}
+export interface CodexSearchRequestBody {
+    readonly id: string;
+    readonly model: string;
+    readonly input: readonly [
+        {
+            readonly type: "message";
+            readonly role: "user";
+            readonly content: readonly [{
+                readonly type: "input_text";
+                readonly text: string;
+            }];
+        }
+    ];
+    readonly commands: {
+        readonly search_query: readonly [{
+            readonly q: string;
+        }];
+    };
+    readonly settings: {
+        readonly search_context_size: CodexSearchContextSize;
+        readonly allowed_callers: readonly ["direct"];
+        readonly external_web_access: CodexExternalWebAccess;
+    };
+    readonly max_output_tokens: number;
+}
+export interface CodexSearchProviderOptions {
+    readonly auth: CodexAuthSession;
+    readonly http?: CodexHttpClient;
+    readonly fetchImpl?: CodexFetch;
+    /** Current visible Codex model, or a live resolver for catalog/login changes. */
+    readonly model: string | (() => string);
+    readonly mode?: CodexSearchMode;
+    readonly contextSize?: CodexSearchContextSize;
+    readonly maxOutputTokens?: number;
+    readonly resolveRequestId?: () => string;
+    readonly originator?: string;
+    readonly userAgent?: string;
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+}
+/** Structural `WebSearchProvider` so parent can register without this module importing dsh-web. */
+export interface CodexSearchProvider {
+    readonly id: typeof CODEX_SEARCH_PROVIDER_ID;
+    available(): boolean;
+    search(request: CodexSearchRequest, signal?: AbortSignal): Promise<CodexSearchResult>;
+}
+/** Map configured search mode onto the verified `external_web_access` field. */
+export declare function externalWebAccess(mode: CodexSearchMode): CodexExternalWebAccess;
+/** Accept only citeable http(s) URLs. */
+export declare function citeableHttpUrl(value: unknown): string | undefined;
+/** Reject `<1` / non-finite `maxResults` rather than treating them as unlimited. */
+export declare function assertCodexSearchMaxResults(maxResults: number | undefined): void;
+/**
+ * Map the standalone endpoint's forward-compatible result DTOs.
+ * Only `type === "text_result"` items with valid http(s) URLs are kept; URLs are de-duplicated.
+ */
+export declare function mapCodexSearchResponse(value: unknown, maxResults?: number): CodexSearchResult;
+export declare function buildCodexSearchRequestBody(query: string, options: {
+    id: string;
+    model: string;
+    mode: CodexSearchMode;
+    contextSize: CodexSearchContextSize;
+    maxOutputTokens: number;
+}): CodexSearchRequestBody;
+/** Factory for an injectable, default-off Codex search provider. */
+export declare function createCodexSearchProvider(options: CodexSearchProviderOptions): CodexSearchProvider;
+//# sourceMappingURL=codex-search.d.ts.map

package/lib/codex-search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-search.d.ts","sourceRoot":"","sources":["../../src/codex-search.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EAIpB,MAAM,iBAAiB,CAAC;AAEzB,kGAAkG;AAClG,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,uDAAuD,CAAC;AAErF,eAAO,MAAM,0BAA0B,oCAAqC,CAAC;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,kBAAkB,wCAAyC,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAAG,IAAI,GAAG,KAAK,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS;QACxB;YACC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;gBAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;gBAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SACpF;KACD,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC;YAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACzD,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QAClB,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;QACrD,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;KACrD,CAAC;IACF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,mGAAmG;AACnG,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,wBAAwB,CAAC;IAC7C,SAAS,IAAI,OAAO,CAAC;IACrB,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtF;AAMD,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,sBAAsB,CAS/E;AAED,yCAAyC;AACzC,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAUlE;AAED,oFAAoF;AACpF,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAKhF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,iBAAiB,CA+B7F;AAED,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IACR,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;IACpC,eAAe,EAAE,MAAM,CAAC;CACxB,GACC,sBAAsB,CAmBxB;AAED,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CAgDlG"}

package/lib/codex-usage.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Optional ChatGPT Codex quota reader (`GET /backend-api/wham/usage`).
+ * Normalizes unknown/malformed optional fields instead of failing the card.
+ *
+ * Cache semantics:
+ * - A successful `read()` stores the projection until `ttlMs` elapses.
+ * - Concurrent non-force `read()` calls share one in-flight GET.
+ * - `read({ force: true })` always issues a new GET and never joins an
+ *   existing in-flight read (forced or not). A later completion of the
+ *   abandoned in-flight GET cannot overwrite the forced result.
+ * - `clear()` drops the stored projection and detaches any in-flight GET so
+ *   its later completion cannot repopulate the cache.
+ *
+ * @module dsh-coding-subscription-oauth/codex-usage
+ */
+import { type CodexAuthSession, type CodexFetch, type CodexHttpClient } from "./codex-http.js";
+/** Official ChatGPT rate-limit usage endpoint used by the Codex client. */
+export declare const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+export interface CodexRateLimitWindow {
+    readonly usedPercent: number;
+    readonly remainingPercent: number;
+    readonly windowSeconds: number;
+    readonly resetsAt?: number;
+}
+export interface CodexRateLimit {
+    readonly id: string;
+    readonly name?: string;
+    readonly windows: readonly CodexRateLimitWindow[];
+}
+export interface CodexCredits {
+    readonly unlimited: boolean;
+    readonly balance?: string;
+}
+export interface CodexIndividualLimit {
+    readonly limit: string;
+    readonly used: string;
+    readonly remaining?: string;
+    readonly remainingPercent: number;
+    readonly resetsAt?: number;
+}
+export interface CodexUsage {
+    readonly rateLimits: readonly CodexRateLimit[];
+    readonly credits?: CodexCredits;
+    readonly individualLimit?: CodexIndividualLimit;
+    readonly spendControlReached?: boolean;
+    readonly resetCredits?: {
+        readonly availableCount: number;
+    };
+    readonly fetchedAt: number;
+}
+export interface CodexUsageReaderOptions {
+    readonly auth: CodexAuthSession;
+    readonly http?: CodexHttpClient;
+    readonly fetchImpl?: CodexFetch;
+    readonly originator?: string;
+    readonly userAgent?: string;
+    readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+    readonly now?: () => number;
+    readonly ttlMs?: number;
+}
+export interface CodexUsageReader {
+    read(options?: {
+        force?: boolean;
+        signal?: AbortSignal;
+    }): Promise<CodexUsage>;
+    clear(): void;
+}
+/**
+ * Reduce an opaque `wham/usage` payload to a secret-free quota projection.
+ * Unknown extra fields are ignored; malformed optional buckets are skipped.
+ */
+export declare function normalizeCodexUsage(value: unknown, fetchedAt?: number): CodexUsage;
+/**
+ * Cached, injectable usage reader. Failures do not invent quota numbers.
+ *
+ * See the module doc for `force` / `clear` cache semantics.
+ */
+export declare function createCodexUsageReader(options: CodexUsageReaderOptions): CodexUsageReader;
+//# sourceMappingURL=codex-usage.d.ts.map

package/lib/codex-usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-usage.d.ts","sourceRoot":"","sources":["../../src/codex-usage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,eAAe,EAIpB,MAAM,iBAAiB,CAAC;AAEzB,2EAA2E;AAC3E,eAAO,MAAM,eAAe,+CAA+C,CAAC;AAE5E,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,KAAK,IAAI,IAAI,CAAC;CACd;AA8ED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAa,GAAG,UAAU,CA2CtF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CAoDzF"}

package/lib/gateway-anthropic-messages.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Anthropic Messages API subset for the local gateway.
+ * @module dsh-coding-subscription-oauth/gateway-anthropic-messages
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type GatewayBackend } from "./gateway-backend.js";
+export declare function handleAnthropicMessages(req: IncomingMessage, res: ServerResponse, backend: GatewayBackend): Promise<void>;
+//# sourceMappingURL=gateway-anthropic-messages.d.ts.map

package/lib/gateway-anthropic-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-anthropic-messages.d.ts","sourceRoot":"","sources":["../../src/gateway-anthropic-messages.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AAIjF,wBAAsB,uBAAuB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAqEf"}

package/lib/gateway-auth.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Owner-only gateway API key file.
+ * @module dsh-coding-subscription-oauth/gateway-auth
+ */
+export declare const GATEWAY_KEY_FILENAME = ".coding-oauth-gateway.json";
+declare const KEY_FORMAT_VERSION = 1;
+export interface GatewayKeyDocument {
+    version: typeof KEY_FORMAT_VERSION;
+    apiKey: string;
+    enabled?: boolean;
+    port?: number;
+}
+export declare function gatewayKeyPath(dshHome?: string): string;
+export declare function generateGatewayApiKey(): string;
+export declare function gatewayKeysEqual(left: string, right: string): boolean;
+export declare function maskGatewayApiKey(apiKey: string): string;
+export declare function loadGatewayKeyDocument(path: string): Promise<GatewayKeyDocument | undefined>;
+export declare function loadOrCreateGatewayApiKey(path: string, configured?: string): Promise<string>;
+export declare function persistGatewayApiKey(path: string, apiKey: string): Promise<void>;
+export declare function persistGatewayKeyDocument(path: string, document: GatewayKeyDocument): Promise<void>;
+export {};
+//# sourceMappingURL=gateway-auth.d.ts.map

package/lib/gateway-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-auth.d.ts","sourceRoot":"","sources":["../../src/gateway-auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,eAAO,MAAM,oBAAoB,+BAA+B,CAAC;AACjE,QAAA,MAAM,kBAAkB,IAAI,CAAC;AAE7B,MAAM,WAAW,kBAAkB;IAClC,OAAO,EAAE,OAAO,kBAAkB,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAIrE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CA0BlG;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAelG;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtF;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzG"}

package/lib/gateway-backend.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Session-backed model listing and event streaming for the local gateway.
+ * @module dsh-coding-subscription-oauth/gateway-backend
+ */
+import type { Api, Context, Message, Model, ThinkingLevel } from "@earendil-works/pi-ai";
+import { type GatewayChatMessage, type GatewayCompletionRequest, type GatewayStreamPart, type GatewayTool } from "./gateway-protocol.js";
+import type { OAuthProviderSession } from "./oauth-session.js";
+import type { GrokBuildSession } from "./session.js";
+export interface GatewayListedModel {
+    id: string;
+    owned_by: string;
+}
+export interface GatewayBackend {
+    listModels(): Promise<readonly GatewayListedModel[]>;
+    stream(request: GatewayCompletionRequest): AsyncIterable<GatewayStreamPart>;
+    streamText(modelId: string, messages: readonly GatewayChatMessage[]): AsyncIterable<string>;
+}
+export declare class GatewayRequestError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+interface OwnedModel {
+    owned_by: string;
+    model: Model<Api>;
+    stream: (model: Model<Api>, context: Context, options?: {
+        reasoning?: ThinkingLevel;
+    }) => AsyncIterable<{
+        type: string;
+        delta?: string;
+        errorMessage?: string;
+        reason?: string;
+        toolCall?: {
+            id: string;
+            name: string;
+            arguments?: unknown;
+        };
+        partial?: {
+            content?: readonly {
+                type?: string;
+                id?: string;
+                name?: string;
+            }[];
+        };
+    }>;
+}
+export declare function createSessionGatewayBackend(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[]): GatewayBackend;
+export declare function selectOwnedModel(owned: readonly OwnedModel[], modelId: string): OwnedModel;
+export declare function buildGatewayContext(messages: readonly GatewayChatMessage[], tools?: readonly GatewayTool[]): Context;
+export declare function assistantReplay(message: GatewayChatMessage): Message;
+export declare function gatewayErrorEnvelope(error: unknown): {
+    status: number;
+    body: {
+        error: {
+            message: string;
+            type: string;
+            code: string;
+        };
+    };
+};
+export {};
+//# sourceMappingURL=gateway-backend.d.ts.map

package/lib/gateway-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-backend.d.ts","sourceRoot":"","sources":["../../src/gateway-backend.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAQ,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAEhB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC9B,UAAU,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAC5E,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,kBAAkB,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5F;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAIhB;AAED,UAAU,UAAU;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,EAAE,CACP,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,aAAa,CAAA;KAAE,KACnC,aAAa,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC7D,OAAO,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,SAAS;gBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;gBAAC,EAAE,CAAC,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,EAAE,CAAA;SAAE,CAAC;KACjF,CAAC,CAAC;CACH;AAWD,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC5C,cAAc,CAuDhB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAQ1F;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EAAE,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CA4BpH;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CA8BpE;AAiED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACjE,CAWA"}

package/lib/gateway-body.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Shared JSON body reader for isolated gateway endpoints.
+ * @module dsh-coding-subscription-oauth/gateway-body
+ */
+import type { IncomingMessage } from "node:http";
+export declare function readGatewayJsonBody(req: IncomingMessage): Promise<Record<string, unknown>>;
+export declare function writeGatewayJson(res: import("node:http").ServerResponse, status: number, value: unknown): void;
+export declare function beginGatewaySse(res: import("node:http").ServerResponse): void;
+//# sourceMappingURL=gateway-body.d.ts.map

package/lib/gateway-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-body.d.ts","sourceRoot":"","sources":["../../src/gateway-body.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAKjD,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAoBhG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAQ9G;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,WAAW,EAAE,cAAc,GAAG,IAAI,CAM7E"}

package/lib/gateway-config.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Opt-in local API gateway configuration.
+ * @module dsh-coding-subscription-oauth/gateway-config
+ */
+import z from "@deepseek-ai/schemastery";
+export declare const GATEWAY_DEFAULT_BIND = "127.0.0.1";
+export declare const GATEWAY_DEFAULT_PORT = 18080;
+export declare const GATEWAY_MIN_PORT = 1024;
+export declare const GATEWAY_MAX_PORT = 65535;
+export declare const GATEWAY_RANDOM_PORT_MIN = 18100;
+export declare const GATEWAY_RANDOM_PORT_MAX = 18999;
+export interface GatewayConfig {
+    readonly enabled: boolean;
+    readonly bind: string;
+    readonly port: number;
+    readonly apiKey?: string;
+    readonly rateLimit: number;
+}
+export declare const GatewayConfigSchema: z<Partial<GatewayConfig>>;
+export declare function resolveGatewayConfig(raw?: Partial<GatewayConfig>): GatewayConfig;
+export declare function isLoopbackBind(bind: string): boolean;
+export declare function assertGatewayPort(port: number): number;
+export declare function randomGatewayPort(exclude?: number | readonly number[]): number;
+//# sourceMappingURL=gateway-config.d.ts.map

package/lib/gateway-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-config.d.ts","sourceRoot":"","sources":["../../src/gateway-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAC;AAEzC,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAC3C,eAAO,MAAM,gBAAgB,OAAO,CAAC;AACrC,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAC9C,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAG9C,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAMxD,CAAC;AAEH,wBAAgB,oBAAoB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAmBhF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,MAAM,GAAG,SAAS,MAAM,EAAO,GAAG,MAAM,CAUlF"}

package/lib/gateway-http.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Isolated node:http server for the opt-in local gateway.
+ * @module dsh-coding-subscription-oauth/gateway-http
+ */
+import { type Server } from "node:http";
+import { type GatewayBackend } from "./gateway-backend.js";
+import { type GatewayConfig } from "./gateway-config.js";
+export interface GatewayHttpOptions {
+    config: GatewayConfig;
+    apiKey: string;
+    backend: GatewayBackend;
+}
+export declare function createGatewayHttpServer(options: GatewayHttpOptions): Server;
+export declare function listenGateway(server: Server, config: GatewayConfig): Promise<void>;
+export declare function closeGateway(server: Server): Promise<void>;
+//# sourceMappingURL=gateway-http.d.ts.map

package/lib/gateway-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-http.d.ts","sourceRoot":"","sources":["../../src/gateway-http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,qBAAqB,CAAC;AAIzE,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAc3E;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAQlF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1D"}

package/lib/gateway-openai-chat.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OpenAI-compatible chat completions for the local gateway.
+ * @module dsh-coding-subscription-oauth/gateway-openai-chat
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type GatewayBackend } from "./gateway-backend.js";
+export declare function handleOpenAiChatCompletions(req: IncomingMessage, res: ServerResponse, backend: GatewayBackend): Promise<void>;
+//# sourceMappingURL=gateway-openai-chat.d.ts.map

package/lib/gateway-openai-chat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-openai-chat.d.ts","sourceRoot":"","sources":["../../src/gateway-openai-chat.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AAKjF,wBAAsB,2BAA2B,CAChD,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/lib/gateway-openai-responses.d.ts

@@ -0,0 +1,8 @@
+/**
+ * OpenAI Responses API subset for the local gateway.
+ * @module dsh-coding-subscription-oauth/gateway-openai-responses
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type GatewayBackend } from "./gateway-backend.js";
+export declare function handleOpenAiResponses(req: IncomingMessage, res: ServerResponse, backend: GatewayBackend): Promise<void>;
+//# sourceMappingURL=gateway-openai-responses.d.ts.map

package/lib/gateway-openai-responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-openai-responses.d.ts","sourceRoot":"","sources":["../../src/gateway-openai-responses.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AAIjF,wBAAsB,qBAAqB,CAC1C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAsCf"}