dsh-coding-subscription-oauth 0.5.0

package/lib/gateway-parse.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Parse OpenAI / Anthropic request bodies into the gateway completion shape.
+ * @module dsh-coding-subscription-oauth/gateway-parse
+ */
+import type { GatewayCompletionRequest } from "./gateway-protocol.js";
+export declare function parseOpenAiChatRequest(payload: Record<string, unknown>): GatewayCompletionRequest;
+export declare function parseOpenAiResponsesRequest(payload: Record<string, unknown>): GatewayCompletionRequest;
+export declare function parseAnthropicMessagesRequest(payload: Record<string, unknown>): GatewayCompletionRequest;
+export declare function anthropicMaxTokens(payload: Record<string, unknown>): number;
+//# sourceMappingURL=gateway-parse.d.ts.map

package/lib/gateway-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-parse.d.ts","sourceRoot":"","sources":["../../src/gateway-parse.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAsB,wBAAwB,EAAgC,MAAM,uBAAuB,CAAC;AAExH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,wBAAwB,CAUjG;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,wBAAwB,CAiBtG;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,wBAAwB,CAexG;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAI3E"}

package/lib/gateway-protocol.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Shared request/stream types for the local coding-subscription gateway.
+ * @module dsh-coding-subscription-oauth/gateway-protocol
+ */
+export interface GatewayToolCall {
+    id: string;
+    name: string;
+    arguments: string;
+}
+export interface GatewayTool {
+    name: string;
+    description: string;
+    parameters: Record<string, unknown>;
+}
+export interface GatewayChatMessage {
+    role: string;
+    content: string;
+    tool_calls?: readonly GatewayToolCall[];
+    reasoning_content?: string;
+    tool_call_id?: string;
+    tool_name?: string;
+}
+export interface GatewayCompletionRequest {
+    model: string;
+    messages: readonly GatewayChatMessage[];
+    tools?: readonly GatewayTool[];
+    reasoning?: string;
+}
+export type GatewayStreamPart = {
+    type: "text";
+    text: string;
+} | {
+    type: "thinking";
+    text: string;
+} | {
+    type: "tool_call";
+    index: number;
+    id: string;
+    name: string;
+    arguments: string;
+} | {
+    type: "done";
+    finish: "stop" | "tool_calls" | "length";
+};
+export type GatewayThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
+export declare function isThinkingLevel(value: string): value is GatewayThinkingLevel;
+//# sourceMappingURL=gateway-protocol.d.ts.map

package/lib/gateway-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-protocol.d.ts","sourceRoot":"","sources":["../../src/gateway-protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEnG,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAU5E"}

package/lib/gateway-routes.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Settings-facing routes for the opt-in local API gateway.
+ * @module dsh-coding-subscription-oauth/gateway-routes
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { CodingOAuthGatewayController } from "./gateway.js";
+export declare const GATEWAY_SETTINGS_PATH = "/plugins/dsh-grok-build/gateway";
+export declare const GATEWAY_REVEAL_PATH = "/plugins/dsh-grok-build/gateway/reveal";
+export declare const GATEWAY_ROTATE_PATH = "/plugins/dsh-grok-build/gateway/rotate";
+export interface GatewayRouteContext {
+    readonly webServer: {
+        register(route: {
+            kind: "exact" | "prefix";
+            path: string;
+            handler: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+        }): () => void;
+    };
+    effect(callback: () => () => void | Promise<void>, label?: string): unknown;
+}
+export declare function registerGatewayRoutes(ctx: GatewayRouteContext, controller: CodingOAuthGatewayController): () => void;
+//# sourceMappingURL=gateway-routes.d.ts.map

package/lib/gateway-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-routes.d.ts","sourceRoot":"","sources":["../../src/gateway-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAOjE,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AACvE,eAAO,MAAM,mBAAmB,2CAA2C,CAAC;AAC5E,eAAO,MAAM,mBAAmB,2CAA2C,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE;YACf,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;YACzB,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SAC7E,GAAG,MAAM,IAAI,CAAC;KACf,CAAC;IACF,MAAM,CAAC,QAAQ,EAAE,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5E;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,EAAE,UAAU,EAAE,4BAA4B,GAAG,MAAM,IAAI,CAuBpH"}

package/lib/gateway.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Start, stop, and rotate the opt-in local coding-subscription API gateway.
+ * @module dsh-coding-subscription-oauth/gateway
+ */
+import { type GatewayBackend } from "./gateway-backend.js";
+import { type GatewayConfig } from "./gateway-config.js";
+import type { OAuthProviderSession } from "./oauth-session.js";
+import type { GrokBuildSession } from "./session.js";
+export declare const GATEWAY_TOS_WARNING = "local API gateway is enabled; exposing a subscription as a local API can violate provider ToS and consumes your quota";
+export interface StartGatewayOptions {
+    config?: Partial<GatewayConfig>;
+    dshHome?: string;
+    backend?: GatewayBackend;
+    grok?: GrokBuildSession;
+    subscriptions?: readonly OAuthProviderSession[];
+    onError?: (error: unknown) => void;
+}
+export interface StartedGateway {
+    close(): Promise<void>;
+    readonly bind: string;
+    readonly port: number;
+}
+export interface GatewayPublicStatus {
+    enabled: boolean;
+    running: boolean;
+    bind: string;
+    port: number;
+    keyHint: string;
+    warning: string;
+}
+export interface CodingOAuthGatewayController {
+    status(): Promise<GatewayPublicStatus>;
+    startIfEnabled(): Promise<StartedGateway | undefined>;
+    setEnabled(enabled: boolean): Promise<GatewayPublicStatus>;
+    setPort(port: number): Promise<GatewayPublicStatus>;
+    revealKey(): Promise<{
+        apiKey: string;
+        keyHint: string;
+    }>;
+    rotateKey(): Promise<{
+        apiKey: string;
+        keyHint: string;
+    }>;
+    stop(): Promise<void>;
+}
+export declare function startCodingOAuthGateway(options: StartGatewayOptions): Promise<StartedGateway | undefined>;
+export declare function createCodingOAuthGatewayController(options: StartGatewayOptions): CodingOAuthGatewayController;
+//# sourceMappingURL=gateway.d.ts.map

package/lib/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/gateway.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAqB,KAAK,aAAa,EAAwB,MAAM,qBAAqB,CAAC;AAElG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,eAAO,MAAM,mBAAmB,0HACwF,CAAC;AAEzH,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,aAAa,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC5C,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvC,cAAc,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtD,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpD,SAAS,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,SAAS,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAG/G;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,mBAAmB,GAAG,4BAA4B,CAmL7G"}

package/lib/grok-imagine.d.ts

@@ -0,0 +1,271 @@
+/**
+ * Official xAI Imagine client. Talks only to https://api.x.ai with a
+ * per-operation API-key resolver. Generated remote media is fetched under a
+ * pinned HTTPS/host/DNS allowlist and persisted locally; results never include
+ * a signed upstream URL.
+ * @module dsh-coding-subscription-oauth/grok-imagine
+ */
+import { IMAGINE_MEDIA_ROUTE_PREFIX, imagineMediaPath, isTrustedImaginePeer, type MediaArtifactMeta, type MediaStore, type MediaStoreVideoType, type TrustedImagineAuthz } from "./media-store.js";
+export declare const XAI_API_ORIGIN = "https://api.x.ai";
+export declare const GROK_IMAGINE_IMAGE_PATH = "/v1/images/generations";
+export declare const GROK_IMAGINE_VIDEO_START_PATH = "/v1/videos/generations";
+export declare const GROK_IMAGINE_IMAGE_MODEL = "grok-imagine-image-2.0";
+export declare const GROK_IMAGINE_VIDEO_MODEL = "grok-imagine-video-1.5";
+export declare const GROK_IMAGINE_IMAGE_TOOL = "grok_imagine_image";
+export declare const GROK_IMAGINE_VIDEO_TOOL = "grok_imagine_video";
+export declare const GROK_IMAGINE_VIDEO_STATUS_TOOL = "grok_imagine_video_status";
+export declare const IMAGINE_IMAGE_ROUTE_PREFIX = "/plugins/dsh-grok-build/imagine/images/";
+/** Frozen xAI output hosts. Callers cannot widen this list. */
+export declare const XAI_OUTPUT_HOSTS: readonly ["imgen.x.ai", "videogen.x.ai", "vidgen.x.ai"];
+export declare const IMAGINE_IMAGE_RESOLUTIONS: readonly ["1k", "2k"];
+export declare const IMAGINE_VIDEO_RESOLUTIONS: readonly ["480p", "720p", "1080p"];
+export declare const IMAGINE_IMAGE_ASPECT_RATIOS: readonly ["1:1", "3:4", "4:3", "9:16", "16:9", "2:3", "3:2", "9:19.5", "19.5:9", "9:20", "20:9", "1:2", "2:1", "auto"];
+export declare const IMAGINE_VIDEO_ASPECT_RATIOS: readonly ["1:1", "16:9", "9:16", "4:3", "3:4", "3:2", "2:3"];
+export declare const IMAGINE_VIDEO_MIN_DURATION_SECONDS = 1;
+export declare const IMAGINE_VIDEO_MAX_DURATION_SECONDS = 15;
+export declare const IMAGINE_IMAGE_MAX_N = 10;
+/**
+ * Hard ceilings enforced both at the tool boundary (consumer guard) and inside
+ * the Imagine client (defence-in-depth). The prompt ceiling uses UTF-16 code
+ * units because that is what the JSON wire format bounds; the image-id arrays
+ * are bounded so a runaway caller cannot exhaust the bounded body reader.
+ */
+export declare const IMAGINE_PROMPT_MAX_LENGTH = 4000;
+export declare const IMAGINE_IMAGE_IDS_MIN = 1;
+export declare const IMAGINE_IMAGE_IDS_MAX = 5;
+export declare const DEFAULT_IMAGE_DOWNLOAD_MAX_BYTES: number;
+export declare const DEFAULT_API_TIMEOUT_MS = 30000;
+export declare const DEFAULT_IMAGE_DOWNLOAD_TIMEOUT_MS = 15000;
+export declare const DEFAULT_VIDEO_DOWNLOAD_TIMEOUT_MS = 60000;
+export declare const DEFAULT_MAX_REDIRECTS = 3;
+export declare const DEFAULT_API_JSON_MAX_BYTES: number;
+export declare const MAX_CACHED_VIDEO_JOBS = 256;
+export type ImagineOperation = "image.generate" | "video.start" | "video.status";
+export type ImagineImageResolution = (typeof IMAGINE_IMAGE_RESOLUTIONS)[number];
+export type ImagineVideoResolution = (typeof IMAGINE_VIDEO_RESOLUTIONS)[number];
+export type ImagineImageAspectRatio = (typeof IMAGINE_IMAGE_ASPECT_RATIOS)[number];
+export type ImagineVideoAspectRatio = (typeof IMAGINE_VIDEO_ASPECT_RATIOS)[number];
+export type ImagineApiKeyResolver = (operation: ImagineOperation) => Promise<string>;
+export type ImagineFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+export type ImagineDnsLookup = (hostname: string) => Promise<readonly string[]>;
+export type ImagineImageMediaType = "image/png" | "image/jpeg" | "image/webp" | "image/gif";
+export interface ImagineMediaHopRequest {
+    timeoutMs: number;
+    maxBytes: number;
+    accept: string;
+    signal?: AbortSignal;
+}
+export interface ImagineMediaHop {
+    status: number;
+    location?: string;
+    contentType?: string;
+    data?: Uint8Array;
+}
+/** Single-hop GET. Must not follow redirects or attach credentials. */
+export interface ImagineMediaTransport {
+    get(url: URL, request: ImagineMediaHopRequest): Promise<ImagineMediaHop>;
+}
+export interface ImagineDownloadRequest {
+    url: string;
+    timeoutMs: number;
+    maxBytes: number;
+    accept: string;
+    signal?: AbortSignal;
+}
+export interface ImagineDownloadResult {
+    data: Uint8Array;
+    contentType?: string;
+}
+/** Full download including redirect revalidation. Production default is pinned. */
+export interface ImagineDownloader {
+    download(request: ImagineDownloadRequest): Promise<ImagineDownloadResult>;
+}
+export type GrokImagineErrorCode = "MISSING_CREDENTIAL" | "AUTH" | "QUOTA" | "RATE_LIMIT" | "SSRF" | "INVALID_INPUT" | "UPSTREAM" | "TIMEOUT" | "MEDIA";
+export declare class GrokImagineError extends Error {
+    readonly code: GrokImagineErrorCode;
+    readonly status?: number;
+    constructor(code: GrokImagineErrorCode, message: string, options?: {
+        cause?: unknown;
+        status?: number;
+    });
+}
+export interface ImagineImageAttachmentRef {
+    attachmentId: string;
+    mediaType: ImagineImageMediaType;
+    bytes: number;
+    width: number;
+    height: number;
+    name?: string;
+}
+export interface ImagineImageLimits {
+    maxImageBytes?: number;
+    mediaTypes?: readonly string[];
+}
+/** Structural AttachmentStore surface used by Imagine. */
+export interface ImagineAttachmentStore {
+    imageLimits?: ImagineImageLimits;
+    saveImage(input: {
+        data: Uint8Array;
+        mediaType: ImagineImageMediaType;
+        name?: string;
+    }): Promise<ImagineImageAttachmentRef>;
+    readImage?(ref: ImagineImageAttachmentRef, signal?: AbortSignal): Promise<{
+        ref: ImagineImageAttachmentRef;
+        data: Uint8Array;
+    }>;
+}
+export interface GenerateImagineImageInput {
+    prompt: string;
+    model?: string;
+    n?: number;
+    aspectRatio?: string;
+    resolution?: string;
+    name?: string;
+}
+export interface ImagineImageResult {
+    model: string;
+    images: readonly ImaginePersistedImage[];
+    attachment: ImagineImageAttachmentRef;
+    path: string;
+}
+export interface ImaginePersistedImage {
+    attachment: ImagineImageAttachmentRef;
+    path: string;
+}
+export interface StartImagineVideoInput {
+    prompt: string;
+    model?: string;
+    duration?: number;
+    aspectRatio?: string;
+    resolution?: string;
+    name?: string;
+}
+export interface ImagineVideoStartResult {
+    model: string;
+    requestId: string;
+    status: "pending";
+}
+export type ImagineVideoJobStatus = "pending" | "completed" | "failed";
+export interface ImagineVideoStatusResult {
+    requestId: string;
+    status: ImagineVideoJobStatus;
+    artifact?: MediaArtifactMeta;
+    path?: string;
+    error?: string;
+}
+export interface GrokImagineClientOptions {
+    resolveApiKey: ImagineApiKeyResolver;
+    attachments: ImagineAttachmentStore;
+    media: MediaStore;
+    /** API-only test seam. Never used for media and never a production default. */
+    fetch?: ImagineFetch;
+    /** Media downloads. Production default pins DNS at connect time via undici. */
+    downloader?: ImagineDownloader;
+    now?: () => number;
+    imageDownloadTimeoutMs?: number;
+    videoDownloadTimeoutMs?: number;
+    apiTimeoutMs?: number;
+    maxRedirects?: number;
+    imageMaxBytes?: number;
+    apiJsonMaxBytes?: number;
+}
+export interface ImagineImageDownloadHeaders {
+    "Content-Type": string;
+    "Content-Length": string;
+    "Content-Disposition": string;
+    "Cache-Control": string;
+    "X-Content-Type-Options": "nosniff";
+}
+export interface ImagineImageDownloadView {
+    ref: ImagineImageAttachmentRef;
+    body: Uint8Array;
+    headers: ImagineImageDownloadHeaders;
+}
+export declare function redactImagineMessage(error: unknown): string;
+/** True when an address is loopback, private, reserved, documentation, or an embedded special form. */
+export declare function isBlockedIp(address: string): boolean;
+export declare function isAllowlistedImagineHost(hostname: string): boolean;
+export declare function grokImagineVideoStatusPath(requestId: string): string;
+export declare function isSafeImagineAttachmentId(attachmentId: string): boolean;
+export declare function imagineImagePath(attachmentId: string): string;
+export declare function parseImagineImagePath(pathname: string): string | undefined;
+export declare function imagineImageDownloadHeaders(ref: ImagineImageAttachmentRef): ImagineImageDownloadHeaders;
+export { IMAGINE_MEDIA_ROUTE_PREFIX, imagineMediaPath, isTrustedImaginePeer };
+export declare function detectImageMediaType(data: Uint8Array): ImagineImageMediaType | undefined;
+export declare function detectVideoMediaType(data: Uint8Array): MediaStoreVideoType | undefined;
+export declare function defaultImagineLookup(hostname: string): Promise<readonly string[]>;
+export declare function assertSafeRemoteMediaUrl(raw: string, lookup: ImagineDnsLookup): Promise<URL>;
+export declare function createPinnedMediaTransport(lookup?: ImagineDnsLookup): ImagineMediaTransport;
+export declare function createPinnedApiFetch(lookup?: ImagineDnsLookup, maxBytes?: number): ImagineFetch;
+export declare function downloadRemoteImagineMedia(initialUrl: string, transport: ImagineMediaTransport, options: {
+    lookup: ImagineDnsLookup;
+    timeoutMs: number;
+    maxBytes: number;
+    accept: string;
+    maxRedirects: number;
+    signal?: AbortSignal;
+}): Promise<ImagineDownloadResult>;
+export declare function createPinnedImagineDownloader(options?: {
+    lookup?: ImagineDnsLookup;
+    maxRedirects?: number;
+}): ImagineDownloader;
+/**
+ * Test-only adapter around an injected fetch. Ordinary mock fetch is not
+ * production-safe: it cannot pin DNS at connect time.
+ */
+export declare function createImagineDownloaderFromFetch(fetchImpl: ImagineFetch, options: {
+    trustedTestTransport: true;
+    lookup?: ImagineDnsLookup;
+    maxRedirects?: number;
+}): ImagineDownloader;
+/**
+ * Validate a tool-supplied Imagine video `requestId`. Returns the id unchanged
+ * on success or throws an `INVALID_INPUT` error. Exposed so capability tools
+ * fail closed at the boundary instead of dispatching a malformed id to the
+ * internal client.
+ */
+export declare function parseVideoRequestId(value: unknown): string;
+/** Enforce min/max bounds on a candidate image-id array. */
+export declare function clampImagineImageIds(ids: readonly unknown[]): readonly string[];
+export declare class GrokImagineClient {
+    private readonly resolveApiKey;
+    private readonly attachments;
+    private readonly media;
+    private readonly apiFetch;
+    private readonly downloader;
+    private readonly imageDownloadTimeoutMs;
+    private readonly videoDownloadTimeoutMs;
+    private readonly apiTimeoutMs;
+    private readonly maxRedirects;
+    private readonly imageMaxBytes;
+    private readonly apiJsonMaxBytes;
+    private readonly videoResults;
+    private readonly videoInflight;
+    private readonly disposeController;
+    private disposed;
+    constructor(options: GrokImagineClientOptions);
+    /**
+     * Permanently retire this client. In-flight API calls, downloads, and
+     * media persistence operations are aborted; subsequent operations fail
+     * closed with an `INVALID_INPUT` error until callers construct a new client.
+     */
+    dispose(): void;
+    /** @returns true once {@link dispose} has been called. */
+    get isDisposed(): boolean;
+    private assertWritable;
+    generateImage(input: GenerateImagineImageInput, signal?: AbortSignal): Promise<ImagineImageResult>;
+    startVideo(input: StartImagineVideoInput, signal?: AbortSignal): Promise<ImagineVideoStartResult>;
+    videoStatus(requestId: string, options?: {
+        name?: string;
+        signal?: AbortSignal;
+    }): Promise<ImagineVideoStatusResult>;
+    private pollVideo;
+    private rememberVideo;
+    private persistGeneratedImage;
+    private resolveCredential;
+    private apiJson;
+}
+export declare function createGrokImagineClient(options: GrokImagineClientOptions): GrokImagineClient;
+/** Gate a same-origin image download. Requires an explicit trusted/authz token. */
+export declare function openTrustedImagineImageDownload(attachments: ImagineAttachmentStore, ref: ImagineImageAttachmentRef, authz: TrustedImagineAuthz): Promise<ImagineImageDownloadView>;
+//# sourceMappingURL=grok-imagine.d.ts.map

package/lib/grok-imagine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-imagine.d.ts","sourceRoot":"","sources":["../../src/grok-imagine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAEN,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAG1B,eAAO,MAAM,cAAc,qBAAqB,CAAC;AACjD,eAAO,MAAM,uBAAuB,2BAA2B,CAAC;AAChE,eAAO,MAAM,6BAA6B,2BAA2B,CAAC;AACtE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AACjE,eAAO,MAAM,wBAAwB,2BAA2B,CAAC;AAEjE,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E,eAAO,MAAM,0BAA0B,4CAA4C,CAAC;AAEpF,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,yDAA0D,CAAC;AAExF,eAAO,MAAM,yBAAyB,uBAAwB,CAAC;AAC/D,eAAO,MAAM,yBAAyB,oCAAqC,CAAC;AAC5E,eAAO,MAAM,2BAA2B,wHAe9B,CAAC;AACX,eAAO,MAAM,2BAA2B,8DAA+D,CAAC;AACxG,eAAO,MAAM,kCAAkC,IAAI,CAAC;AACpD,eAAO,MAAM,kCAAkC,KAAK,CAAC;AACrD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAC9C,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,eAAO,MAAM,gCAAgC,QAAkB,CAAC;AAChE,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,eAAO,MAAM,qBAAqB,IAAI,CAAC;AACvC,eAAO,MAAM,0BAA0B,QAAc,CAAC;AACtD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,aAAa,GAAG,cAAc,CAAC;AACjF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AACnF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF,MAAM,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAErF,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE1F,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAEhF,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC;AAE5F,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC1E;AAED,MAAM,MAAM,oBAAoB,GAC7B,oBAAoB,GACpB,MAAM,GACN,OAAO,GACP,YAAY,GACZ,MAAM,GACN,eAAe,GACf,UAAU,GACV,SAAS,GACT,OAAO,CAAC;AAEX,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;CAMvG;AAED,MAAM,WAAW,yBAAyB;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,qBAAqB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACtC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,UAAU,CAAC;QACjB,SAAS,EAAE,qBAAqB,CAAC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;KACd,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACvC,SAAS,CAAC,CACT,GAAG,EAAE,yBAAyB,EAC9B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,GAAG,EAAE,yBAAyB,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACzC,UAAU,EAAE,yBAAyB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,yBAAyB,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,wBAAwB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACxC,aAAa,EAAE,qBAAqB,CAAC;IACrC,WAAW,EAAE,sBAAsB,CAAC;IACpC,KAAK,EAAE,UAAU,CAAC;IAClB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACxC,GAAG,EAAE,yBAAyB,CAAC;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,2BAA2B,CAAC;CACrC;AAiDD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM3D;AA4ED,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAWpD;AAkBD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAavE;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAc1E;AAsCD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,yBAAyB,GAAG,2BAA2B,CAgBvG;AAED,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAE9E,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,qBAAqB,GAAG,SAAS,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,mBAAmB,GAAG,SAAS,CAQtF;AAOD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAGvF;AAED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAiClG;AA8JD,wBAAgB,0BAA0B,CAAC,MAAM,GAAE,gBAAuC,GAAG,qBAAqB,CA2CjH;AAED,wBAAgB,oBAAoB,CACnC,MAAM,GAAE,gBAAuC,EAC/C,QAAQ,SAA6B,GACnC,YAAY,CA6Cd;AAED,wBAAsB,0BAA0B,CAC/C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,qBAAqB,EAChC,OAAO,EAAE;IACR,MAAM,EAAE,gBAAgB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GACC,OAAO,CAAC,qBAAqB,CAAC,CA4BhC;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,iBAAiB,CAenB;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAC/C,SAAS,EAAE,YAAY,EACvB,OAAO,EAAE;IAAE,oBAAoB,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACvF,iBAAiB,CAqDnB;AAeD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAW1D;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,MAAM,EAAE,CAgB/E;AA0KD,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IACrD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAS;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+C;IAC5E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwD;IACtF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyB;IAC3D,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,EAAE,wBAAwB;IAe7C;;;;OAIG;IACH,OAAO,IAAI,IAAI;IAUf,0DAA0D;IAC1D,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,OAAO,CAAC,cAAc;IAShB,aAAa,CAAC,KAAK,EAAE,yBAAyB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiDlG,UAAU,CAAC,KAAK,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA0BjG,WAAW,CAChB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACnD,OAAO,CAAC,wBAAwB,CAAC;YAsCtB,SAAS;IAsEvB,OAAO,CAAC,aAAa;YAOP,qBAAqB;YAgErB,iBAAiB;YAcjB,OAAO;CA2DrB;AAUD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CAE5F;AAED,mFAAmF;AACnF,wBAAsB,+BAA+B,CACpD,WAAW,EAAE,sBAAsB,EACnC,GAAG,EAAE,yBAAyB,EAC9B,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC"}

package/lib/grok-import.d.ts

@@ -0,0 +1,21 @@
+/**
+ * One-shot import of Grok CLI credentials into the dsh-owned store.
+ * The source file is never written. Refresh tokens rotate, so later dsh
+ * refresh may invalidate ~/.grok/auth.json — that is documented, not a bug.
+ * @module dsh-coding-subscription-oauth/grok-import
+ */
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+import type { GrokBuildCredentialStore } from "./store.js";
+export interface GrokImportProbe {
+    available: boolean;
+    path: string;
+}
+/** Resolve the Grok CLI auth document. */
+export declare function grokAuthPath(home?: string): string;
+/** Parse a Grok CLI / generic OAuth document into a pi-ai credential. */
+export declare function parseGrokAuthDocument(text: string, filename: string): OAuthCredential;
+/** Whether ~/.grok/auth.json exists and looks importable. Never returns secrets. */
+export declare function probeGrokAuth(filename?: string): Promise<GrokImportProbe>;
+/** Copy Grok CLI tokens into the dsh store. Does not write the Grok file. */
+export declare function importGrokAuth(store: GrokBuildCredentialStore, filename?: string): Promise<OAuthCredential>;
+//# sourceMappingURL=grok-import.d.ts.map

package/lib/grok-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grok-import.d.ts","sourceRoot":"","sources":["../../src/grok-import.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAI3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACb;AA4ED,0CAA0C;AAC1C,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAgBrF;AAED,oFAAoF;AACpF,wBAAsB,aAAa,CAAC,QAAQ,GAAE,MAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAU/F;AAED,6EAA6E;AAC7E,wBAAsB,cAAc,CACnC,KAAK,EAAE,wBAAwB,EAC/B,QAAQ,GAAE,MAAuB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAc1B"}

package/lib/http-json.d.ts

@@ -0,0 +1,10 @@
+import type { IncomingMessage } from "node:http";
+export declare const JSON_BODY_LIMIT_BYTES: number;
+export declare class JsonRequestError extends Error {
+    readonly statusCode: 400 | 413;
+    constructor(statusCode: 400 | 413, message: string);
+}
+/** Read one JSON request body with a strict in-memory ceiling. */
+export declare function readJsonRequest(request: IncomingMessage, limit?: number): Promise<unknown>;
+export declare function requestErrorStatus(error: unknown, fallback: number): number;
+//# sourceMappingURL=http-json.d.ts.map

package/lib/http-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-json.d.ts","sourceRoot":"","sources":["../../src/http-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;gBAEnB,UAAU,EAAE,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM;CAKlD;AASD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,SAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuDzG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/lib/ids.d.ts

@@ -0,0 +1,33 @@
+/** pi-ai provider ids used by login, refresh, and credential storage. */
+export declare const XAI_PI_PROVIDER = "xai";
+export declare const CODEX_PI_PROVIDER = "openai-codex";
+export declare const KIMI_PI_PROVIDER = "kimi-coding";
+export declare const CLAUDE_PI_PROVIDER = "anthropic";
+/** Harness LLM routes. OAuth aliases avoid the user's API-key route ids. */
+export declare const GROK_BUILD_ROUTE = "grok-build";
+export declare const CODEX_OAUTH_ROUTE = "codex-oauth";
+export declare const CODEX_OAUTH_FAST_ROUTE = "codex-oauth-fast";
+export declare const KIMI_CODE_OAUTH_ROUTE = "kimi-code-oauth";
+export declare const CLAUDE_CODE_OAUTH_ROUTE = "claude-code-oauth";
+export declare const ANTIGRAVITY_ROUTE = "agy";
+export declare const CODING_OAUTH_ROUTES: readonly ["grok-build", "codex-oauth", "kimi-code-oauth", "claude-code-oauth"];
+/** Opt-in routes the adapter can expose; not registered by the default plugin apply(). */
+export declare const CODING_OAUTH_OPTIONAL_ROUTES: readonly ["codex-oauth-fast"];
+export type CodingOAuthRoute = (typeof CODING_OAUTH_ROUTES)[number];
+export type CodingOAuthOptionalRoute = (typeof CODING_OAUTH_OPTIONAL_ROUTES)[number];
+export type CodingOAuthProviderSlug = "grok" | "codex" | "kimi" | "claude";
+/** Basenames of private OAuth documents inside the Harness home. */
+export declare const GROK_BUILD_AUTH_FILENAME = ".grok-build-auth.json";
+export declare const CODEX_OAUTH_AUTH_FILENAME = ".codex-oauth-auth.json";
+export declare const KIMI_CODE_OAUTH_AUTH_FILENAME = ".kimi-code-oauth-auth.json";
+export declare const CLAUDE_CODE_OAUTH_AUTH_FILENAME = ".claude-code-oauth-auth.json";
+/** Basenames of model selection/catalog caches inside the Harness home. */
+export declare const GROK_BUILD_MODELS_CACHE_FILENAME = ".grok-build-models.json";
+export declare const CODEX_OAUTH_MODELS_CACHE_FILENAME = ".codex-oauth-models.json";
+export declare const KIMI_CODE_OAUTH_MODELS_CACHE_FILENAME = ".kimi-code-oauth-models.json";
+export declare const CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME = ".claude-code-oauth-models.json";
+/** Fallback model when no live Grok catalog listing is available. */
+export declare const DEFAULT_GROK_BUILD_MODEL = "grok-4.6";
+/** Provider idle ceiling used by every composite route. */
+export declare const GROK_BUILD_STREAM_IDLE_TIMEOUT_MS = 300000;
+//# sourceMappingURL=ids.d.ts.map

package/lib/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/ids.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,eAAe,QAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAChD,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAC9C,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AACzD,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AACvD,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC,eAAO,MAAM,mBAAmB,gFAKtB,CAAC;AAEX,0FAA0F;AAC1F,eAAO,MAAM,4BAA4B,+BAAoC,CAAC;AAE9E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AACrF,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3E,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAChE,eAAO,MAAM,yBAAyB,2BAA2B,CAAC;AAClE,eAAO,MAAM,6BAA6B,+BAA+B,CAAC;AAC1E,eAAO,MAAM,+BAA+B,iCAAiC,CAAC;AAE9E,2EAA2E;AAC3E,eAAO,MAAM,gCAAgC,4BAA4B,CAAC;AAC1E,eAAO,MAAM,iCAAiC,6BAA6B,CAAC;AAC5E,eAAO,MAAM,qCAAqC,iCAAiC,CAAC;AACpF,eAAO,MAAM,uCAAuC,mCAAmC,CAAC;AAExF,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,2DAA2D;AAC3D,eAAO,MAAM,iCAAiC,SAAU,CAAC"}

package/lib/imagine-routes.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Same-origin GET routes for generated Imagine images and video artifacts.
+ * The Host webServer only accepts exact paths, so this registrar keeps a
+ * bounded table of opaque ids and registers one exact disposer per remembered
+ * image ref or media artifact.
+ * @module dsh-coding-subscription-oauth/imagine-routes
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { ImageAttachmentRef } from "@deepseek-ai/dsh-attachment";
+import { type ImagineImageAttachmentRef } from "./grok-imagine.js";
+import { type MediaArtifactMeta, type MediaDownloadView, type TrustedImagineAuthz } from "./media-store.js";
+/** Hard ceiling for live exact download routes. Callers cannot raise this. */
+export declare const IMAGINE_ROUTE_MAX_ENTRIES = 64;
+/** Hard ceiling for remembered image routes. Callers cannot raise this. */
+export declare const IMAGINE_IMAGE_ROUTE_TTL_MS: number;
+/** Structural `ctx.webServer` + optional `ctx.effect` surface used by the registrar. */
+export interface ImagineRouteContext {
+    readonly webServer: {
+        register(route: {
+            kind: "exact";
+            path: string;
+            handler: (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+        }): () => void;
+    };
+    effect?(setup: () => () => void | Promise<void>, label?: string): unknown;
+}
+/** Attachment seam used at GET time. Only metadata is retained in the registry. */
+export interface ImagineRouteAttachmentStore {
+    readonly imageLimits?: {
+        readonly maxImageBytes?: number;
+    };
+    readImage(ref: ImagineImageAttachmentRef, signal?: AbortSignal): Promise<{
+        ref: ImagineImageAttachmentRef;
+        data: Uint8Array;
+    }>;
+}
+/** Structural media download seam. Production adapts `MediaStore.openDownload`. */
+export interface ImagineMediaDownloadStore {
+    readForDownload(artifactId: string, authz: TrustedImagineAuthz): Promise<MediaDownloadView>;
+}
+export interface ImagineRouteOptions {
+    readonly attachments: ImagineRouteAttachmentStore;
+    readonly media: ImagineMediaDownloadStore;
+    readonly now?: () => number;
+    /** Capped at {@link IMAGINE_ROUTE_MAX_ENTRIES}. */
+    readonly maxEntries?: number;
+    /** Capped at {@link IMAGINE_IMAGE_ROUTE_TTL_MS}. */
+    readonly imageTtlMs?: number;
+}
+export interface ImagineRouteRegistry {
+    rememberImages(refs: readonly ImageAttachmentRef[] | readonly ImagineImageAttachmentRef[]): void;
+    rememberArtifact(meta: MediaArtifactMeta): void;
+    revokeImages(): void;
+    revokeArtifacts(): void;
+    dispose(): void;
+}
+/** Register the bounded exact-path Imagine download registry. */
+export declare function registerImagineRoutes(ctx: ImagineRouteContext, options: ImagineRouteOptions): ImagineRouteRegistry;
+//# sourceMappingURL=imagine-routes.d.ts.map

package/lib/imagine-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imagine-routes.d.ts","sourceRoot":"","sources":["../../src/imagine-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAEN,KAAK,yBAAyB,EAM9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAKN,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EAKtB,KAAK,mBAAmB,EACxB,MAAM,kBAAkB,CAAC;AAG1B,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAKzD,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,SAAS,EAAE;QACnB,QAAQ,CAAC,KAAK,EAAE;YACf,IAAI,EAAE,OAAO,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SAC7E,GAAG,MAAM,IAAI,CAAC;KACf,CAAC;IACF,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1E;AAED,mFAAmF;AACnF,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,SAAS,CACR,GAAG,EAAE,yBAAyB,EAC9B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC;QAAE,GAAG,EAAE,yBAAyB,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,CAAC;CACjE;AAED,mFAAmF;AACnF,MAAM,WAAW,yBAAyB;IACzC,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC5F;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACpC,cAAc,CAAC,IAAI,EAAE,SAAS,kBAAkB,EAAE,GAAG,SAAS,yBAAyB,EAAE,GAAG,IAAI,CAAC;IACjG,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAChD,YAAY,IAAI,IAAI,CAAC;IACrB,eAAe,IAAI,IAAI,CAAC;IACxB,OAAO,IAAI,IAAI,CAAC;CAChB;AA0BD,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,mBAAmB,GAAG,oBAAoB,CAuMlH"}