dsh-coding-subscription-oauth 0.5.0

package/lib/invariant.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Package-owned invariant companion for `dsh-coding-subscription-oauth`.
+ * @module dsh-coding-subscription-oauth/invariant
+ */
+import type { Context } from "@deepseek-ai/cordis";
+export declare const name = "grok-build-invariant";
+export declare const inject: string[];
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/lib/invariant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariant.d.ts","sourceRoot":"","sources":["../../src/invariant.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAKnD,eAAO,MAAM,IAAI,yBAAyB,CAAC;AAC3C,eAAO,MAAM,MAAM,UAAiB,CAAC;AAIrC,eAAO,MAAM,KAAK,GAAI,KAAK,OAAO,KAAG,OAAO,CAAC,MAAM,IAAI,CACS,CAAC"}

package/lib/invariant.js

@@ -0,0 +1,14 @@
+/** dsh-coding-subscription-oauth invariant entry */
+
+// src/invariant.ts
+var PACKAGE_NAME = "dsh-coding-subscription-oauth";
+var name = "grok-build-invariant";
+var inject = ["invariants"];
+var install = () => {
+};
+var apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+export {
+  apply,
+  inject,
+  name
+};

package/lib/invariant.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/invariant.ts"],
+  "sourcesContent": ["/**\n * Package-owned invariant companion for `dsh-coding-subscription-oauth`.\n * @module dsh-coding-subscription-oauth/invariant\n */\n\nimport type { Context } from \"@deepseek-ai/cordis\";\nimport type { InvariantInstaller } from \"@deepseek-ai/dsh-invariants\";\n\nconst PACKAGE_NAME = \"dsh-coding-subscription-oauth\";\n\nexport const name = \"grok-build-invariant\";\nexport const inject = [\"invariants\"];\n\nconst install: InvariantInstaller = () => {};\n\nexport const apply = (ctx: Context): Promise<() => void> =>\n\tPromise.resolve(ctx.invariants.register(PACKAGE_NAME, install));\n"],
+  "mappings": ";;;AAQA,IAAM,eAAe;AAEd,IAAM,OAAO;AACb,IAAM,SAAS,CAAC,YAAY;AAEnC,IAAM,UAA8B,MAAM;AAAC;AAEpC,IAAM,QAAQ,CAAC,QACrB,QAAQ,QAAQ,IAAI,WAAW,SAAS,cAAc,OAAO,CAAC;",
+  "names": []
+}

package/lib/kimi-errors.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Kimi Code error remapping.
+ * @module dsh-coding-subscription-oauth/kimi-errors
+ */
+export declare function isMisclassifiedContextWindowError(detail: string): boolean;
+export declare function remapAuthFailureIfContextOverflow(failure: {
+    message: string;
+    code: string;
+}): {
+    message: string;
+    code: string;
+};
+//# sourceMappingURL=kimi-errors.d.ts.map

package/lib/kimi-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../src/kimi-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACb,CAGA"}

package/lib/media-store.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Owner-private content-addressed store for Grok Imagine video artifacts.
+ * Public identifiers are opaque; callers never receive a filesystem path,
+ * content hash, or a signed upstream URL.
+ * @module dsh-coding-subscription-oauth/media-store
+ */
+/** Hard ceiling for one artifact and for aggregate stored object bytes. */
+export declare const MEDIA_STORE_MAX_BYTES: number;
+/** Hard ceiling for artifact retention. Callers cannot raise this. */
+export declare const MEDIA_STORE_RETENTION_MS: number;
+export declare const MEDIA_STORE_DIR_MODE = 448;
+export declare const MEDIA_STORE_FILE_MODE = 384;
+export declare const MEDIA_STORE_INDEX_VERSION = 1;
+export declare const MEDIA_STORE_INDEX_MAX_BYTES: number;
+/** Opaque public id: 32 lowercase hex characters. */
+export declare const MEDIA_ARTIFACT_ID_PATTERN: RegExp;
+export declare const IMAGINE_MEDIA_ROUTE_PREFIX = "/plugins/dsh-grok-build/imagine/media/";
+declare const TRUSTED_IMAGINE: unique symbol;
+export type MediaStoreVideoType = "video/mp4" | "video/webm";
+export type MediaStoreErrorCode = "INVALID_ID" | "INVALID_INPUT" | "TOO_LARGE" | "NOT_FOUND" | "EXPIRED" | "CORRUPT" | "UNSUPPORTED_TYPE" | "FORBIDDEN";
+export declare class MediaStoreError extends Error {
+    readonly code: MediaStoreErrorCode;
+    constructor(code: MediaStoreErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface MediaArtifactMeta {
+    /** Opaque public identifier. Never a path, hash, or bearer URL. */
+    artifactId: string;
+    mediaType: MediaStoreVideoType;
+    bytes: number;
+    createdAt: number;
+    expiresAt: number;
+    name?: string;
+}
+export interface SaveMediaInput {
+    data: Uint8Array;
+    mediaType: MediaStoreVideoType;
+    name?: string;
+}
+export interface StoredMedia {
+    meta: MediaArtifactMeta;
+    data: Uint8Array;
+}
+export interface MediaCleanupReport {
+    expiredArtifacts: number;
+    removedObjects: number;
+}
+export interface MediaStoreOptions {
+    now?: () => number;
+    /** Per-artifact ceiling, capped at {@link MEDIA_STORE_MAX_BYTES}. */
+    maxBytes?: number;
+    /** Aggregate unique-object ceiling, capped at {@link MEDIA_STORE_MAX_BYTES}. */
+    maxTotalBytes?: number;
+    retentionMs?: number;
+    randomId?: () => string;
+}
+export interface MediaDownloadHeaders {
+    "Content-Type": string;
+    "Content-Length": string;
+    "Content-Disposition": string;
+    "Cache-Control": string;
+    "X-Content-Type-Options": "nosniff";
+}
+export interface MediaDownloadView {
+    meta: MediaArtifactMeta;
+    body: Uint8Array;
+    headers: MediaDownloadHeaders;
+}
+/** Runtime token proving a route already authorized this download. */
+export interface TrustedImagineAuthz {
+    readonly [TRUSTED_IMAGINE]: true;
+}
+export interface CreateTrustedImagineAuthzInput {
+    readonly remoteAddress?: string;
+    readonly authorized?: boolean;
+}
+/** Reject anything that is not a 32-char lowercase hex artifact id. */
+export declare function parseMediaArtifactId(value: string): string | undefined;
+export declare function isSafeMediaArtifactId(value: string): boolean;
+/** Trusted same-origin path for one stored video artifact. */
+export declare function imagineMediaPath(artifactId: string): string;
+/** Extract a safe artifact id from a same-origin media route. */
+export declare function parseImagineMediaPath(pathname: string): string | undefined;
+export declare function mediaDownloadHeaders(meta: MediaArtifactMeta): MediaDownloadHeaders;
+/** Loopback-only peer check for the parent route gate. */
+export declare function isTrustedImaginePeer(remoteAddress: string | undefined): boolean;
+/** Build a runtime authz token. Raw objects are not accepted by openTrusted helpers. */
+export declare function createTrustedImagineAuthz(input: CreateTrustedImagineAuthzInput): TrustedImagineAuthz;
+export declare function assertTrustedImagineAuthz(authz: TrustedImagineAuthz): void;
+/**
+ * Content-addressed video store. Directories are 0700; objects and index
+ * documents are 0600. Public lookup uses an opaque id, never the digest.
+ */
+export declare class MediaStore {
+    readonly root: string;
+    readonly maxBytes: number;
+    readonly maxTotalBytes: number;
+    retentionMs: number;
+    private readonly now;
+    private readonly randomId;
+    private tail;
+    private retentionReconciled;
+    constructor(root: string, options?: MediaStoreOptions);
+    /**
+     * Apply a live retention ceiling under the store lock. Lowering it rewrites
+     * existing index expiries and deletes newly expired objects before resolving;
+     * raising it affects only artifacts saved after this call.
+     */
+    applyRetentionMs(retentionMs: number): Promise<MediaCleanupReport>;
+    save(input: SaveMediaInput): Promise<MediaArtifactMeta>;
+    lookup(artifactId: string): Promise<MediaArtifactMeta | undefined>;
+    read(artifactId: string): Promise<StoredMedia>;
+    delete(artifactId: string): Promise<boolean>;
+    cleanup(): Promise<MediaCleanupReport>;
+    /** Trusted same-origin download primitive. Never returns an upstream URL. */
+    openDownload(artifactId: string, authz: TrustedImagineAuthz): Promise<MediaDownloadView>;
+    private effectiveExpiresAt;
+    private effectiveMeta;
+    private runExclusive;
+    private saveUnlocked;
+    private deleteUnlocked;
+    private cleanupUnlocked;
+    private readIndex;
+    private removeObjectIfUnreferenced;
+}
+/** Open a trusted same-origin download. Requires an explicit authz token. */
+export declare function openTrustedMediaDownload(store: MediaStore, artifactId: string, authz: TrustedImagineAuthz): Promise<MediaDownloadView>;
+export {};
+//# sourceMappingURL=media-store.d.ts.map

package/lib/media-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-store.d.ts","sourceRoot":"","sources":["../../src/media-store.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,QAAoB,CAAC;AAEvD,sEAAsE;AACtE,eAAO,MAAM,wBAAwB,QAA0B,CAAC;AAEhE,eAAO,MAAM,oBAAoB,MAAQ,CAAC;AAC1C,eAAO,MAAM,qBAAqB,MAAQ,CAAC;AAC3C,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,2BAA2B,QAAY,CAAC;AAErD,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAE1D,eAAO,MAAM,0BAA0B,2CAA2C,CAAC;AAGnF,QAAA,MAAM,eAAe,eAA8D,CAAC;AAEpF,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE7D,MAAM,MAAM,mBAAmB,GAC5B,YAAY,GACZ,eAAe,GACf,WAAW,GACX,WAAW,GACX,SAAS,GACT,SAAS,GACT,kBAAkB,GAClB,WAAW,CAAC;AAEf,qBAAa,eAAgB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAEvB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKrF;AAED,MAAM,WAAW,iBAAiB;IACjC,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IACjC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,oBAAoB,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC9B;AAqCD,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AA4YD,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAI3D;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK1E;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,oBAAoB,CAUlF;AAED,0DAA0D;AAC1D,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE/E;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,GAAG,mBAAmB,CAKpG;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAI1E;AAED;;;GAGG;AACH,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,mBAAmB,CAAS;gBAExB,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB;IAYzD;;;;OAIG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwBlE,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIvD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAQlE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAyB9C,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5C,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAa5C,6EAA6E;IACvE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAU9F,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,YAAY;YASN,YAAY;YAgFZ,cAAc;YAkBd,eAAe;YA6Cf,SAAS;YAmBT,0BAA0B;CAgBxC;AAED,6EAA6E;AAC7E,wBAAsB,wBAAwB,CAC7C,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAM5B"}

package/lib/oauth-import-routes.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Same-origin Web API for allowlisted CLI OAuth source discovery and
+ * two-phase import into destination stores. Preview tickets live only in the
+ * process-local session; `peekPreview` supplies ticket.kind as the destination
+ * authority before the store lock. Persist happens inside that lock.
+ * @module dsh-coding-subscription-oauth/oauth-import-routes
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type OAuthImportCommitAction, type OAuthImportSessionOptions, type OAuthSourceCredential, type OAuthSourceDiscovery, type OAuthSourceKind, type OAuthSourcePathOptions } from "./oauth-sources.js";
+export declare const OAUTH_IMPORT_SOURCES_PATH = "/plugins/dsh-grok-build/oauth/sources";
+export declare const OAUTH_IMPORT_PREVIEW_PATH = "/plugins/dsh-grok-build/oauth/sources/preview";
+export declare const OAUTH_IMPORT_COMMIT_PATH = "/plugins/dsh-grok-build/oauth/sources/commit";
+export declare const OAUTH_IMPORT_CANCEL_PATH = "/plugins/dsh-grok-build/oauth/sources/cancel";
+export interface OAuthImportRouteContext {
+    webServer: {
+        register(route: {
+            kind: "exact";
+            path: string;
+            handler: (request: IncomingMessage, response: ServerResponse) => void | Promise<void>;
+        }): () => void;
+    };
+    effect?(setup: () => () => void | Promise<void>, label?: string): void;
+}
+export interface OAuthImportDestinationStore {
+    readonly filename: string;
+    modify(providerId: string, fn: (current: OAuthSourceCredential | undefined) => Promise<OAuthSourceCredential | undefined>): Promise<OAuthSourceCredential | undefined>;
+}
+export interface OAuthImportDestination {
+    providerId: string;
+    store: OAuthImportDestinationStore;
+}
+export type OAuthImportDestinations = {
+    [K in OAuthSourceKind]: OAuthImportDestination;
+};
+export interface OAuthImportAppliedEvent {
+    kind: OAuthSourceKind;
+    action: Extract<OAuthImportCommitAction, "imported" | "overwritten">;
+}
+export interface OAuthImportRouteOptions extends OAuthImportSessionOptions, OAuthSourcePathOptions {
+    onImported?: (event: OAuthImportAppliedEvent) => void | Promise<void>;
+}
+export interface OAuthImportSourcesResponse {
+    sources: OAuthSourceDiscovery[];
+}
+export interface OAuthImportCancelResult {
+    ok: true;
+    cancelled: boolean;
+}
+/** Register same-origin CLI source import routes when the Web server is composed. */
+export declare function registerOAuthImportRoutes(ctx: OAuthImportRouteContext, destinations: OAuthImportDestinations, options?: OAuthImportRouteOptions): () => void;
+export declare function oauthImportErrorStatus(error: unknown): number;
+//# sourceMappingURL=oauth-import-routes.d.ts.map

package/lib/oauth-import-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-import-routes.d.ts","sourceRoot":"","sources":["../../src/oauth-import-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE,OAAO,EAIN,KAAK,uBAAuB,EAI5B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAGzB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,MAAM,oBAAoB,CAAC;AAK5B,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AACjF,eAAO,MAAM,yBAAyB,kDAAkD,CAAC;AACzF,eAAO,MAAM,wBAAwB,iDAAiD,CAAC;AACvF,eAAO,MAAM,wBAAwB,iDAAiD,CAAC;AAEvF,MAAM,WAAW,uBAAuB;IACvC,SAAS,EAAE;QACV,QAAQ,CAAC,KAAK,EAAE;YACf,IAAI,EAAE,OAAO,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACtF,GAAG,MAAM,IAAI,CAAC;KACf,CAAC;IACF,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,MAAM,CACL,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,qBAAqB,GAAG,SAAS,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,GAC5F,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,sBAAsB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,2BAA2B,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG;KAAG,CAAC,IAAI,eAAe,GAAG,sBAAsB;CAAE,CAAC;AAEzF,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC,uBAAuB,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,EAAE,sBAAsB;IACjG,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,qFAAqF;AACrF,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,uBAAuB,EAC5B,YAAY,EAAE,uBAAuB,EACrC,OAAO,GAAE,uBAA4B,GACnC,MAAM,IAAI,CAiGZ;AAwED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAsB7D"}

package/lib/oauth-providers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Native pi-ai OAuth providers and their stable Harness route aliases.
+ * @module dsh-coding-subscription-oauth/oauth-providers
+ */
+import type { Api, Provider } from "@earendil-works/pi-ai";
+import { type CodingOAuthProviderSlug } from "./ids.js";
+export type SubscriptionProviderSlug = Exclude<CodingOAuthProviderSlug, "grok">;
+export type SubscriptionLoginMethod = "browser" | "device";
+export interface OAuthProviderDefinition {
+    slug: SubscriptionProviderSlug;
+    route: string;
+    nativeProviderId: string;
+    displayName: string;
+    authFilename: string;
+    modelsCacheFilename: string;
+    loginMethods: readonly SubscriptionLoginMethod[];
+    recommendedLoginMethod: SubscriptionLoginMethod;
+    providerFactory(): Provider<Api>;
+    requestProvider(selectedIds?: readonly string[]): Provider<Api>;
+}
+export declare const CODEX_OAUTH_PROVIDER: OAuthProviderDefinition;
+export declare const KIMI_CODE_OAUTH_PROVIDER: OAuthProviderDefinition;
+export declare const CLAUDE_CODE_OAUTH_PROVIDER: OAuthProviderDefinition;
+export declare const OAUTH_PROVIDER_DEFINITIONS: readonly [OAuthProviderDefinition, OAuthProviderDefinition, OAuthProviderDefinition];
+export declare function oauthProviderDefinition(slug: string): OAuthProviderDefinition | undefined;
+//# sourceMappingURL=oauth-providers.d.ts.map

package/lib/oauth-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-providers.d.ts","sourceRoot":"","sources":["../../src/oauth-providers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAc,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAIvE,OAAO,EASN,KAAK,uBAAuB,EAK5B,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACjD,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,eAAe,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,eAAe,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;CAChE;AA6DD,eAAO,MAAM,oBAAoB,EAAE,uBAYlC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,uBActC,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,uBAWxC,CAAC;AAEF,eAAO,MAAM,0BAA0B,sFAI7B,CAAC;AAEX,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAEzF"}

package/lib/oauth-session.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Persistent OAuth session and static model selection for one subscription provider.
+ * @module dsh-coding-subscription-oauth/oauth-session
+ */
+import type { Api, AuthInteraction, Credential, Model, MutableModels, OAuthCredential, Provider } from "@earendil-works/pi-ai";
+import type { OAuthProviderDefinition } from "./oauth-providers.js";
+import { OAuthCredentialFileStore } from "./store.js";
+export declare function oauthModelsCachePath(basename: string, dshHome?: string): string;
+export interface OAuthProviderStatus {
+    authenticated: boolean;
+    expiresAt?: number;
+}
+export declare class OAuthProviderSession {
+    readonly definition: OAuthProviderDefinition;
+    readonly store: OAuthCredentialFileStore;
+    readonly models: MutableModels;
+    private readonly catalog;
+    private readonly cacheFile;
+    private selectedIds;
+    constructor(definition: OAuthProviderDefinition, onCatalogChange?: () => void, store?: OAuthCredentialFileStore, cacheFile?: string);
+    private onCatalogChange;
+    availableModels(): Model<Api>[];
+    selectedModelIds(): string[] | undefined;
+    visibleModels(): Model<Api>[];
+    provider(): Provider;
+    loadCachedModels(): Promise<void>;
+    setSelectedModels(ids: readonly string[]): Promise<void>;
+    status(): Promise<OAuthProviderStatus>;
+    login(interaction: AuthInteraction): Promise<Credential>;
+    resolveAccessToken(): Promise<string | undefined>;
+    /**
+     * Backdate the stored token's expiry so the next `getAuth()` refreshes.
+     * Called after an upstream 401 rejected a locally-valid token.
+     */
+    invalidateAccessToken(): Promise<void>;
+    storedCredential(): Promise<OAuthCredential | undefined>;
+    logout(): Promise<void>;
+    private writeCache;
+}
+//# sourceMappingURL=oauth-session.d.ts.map

package/lib/oauth-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../../src/oauth-session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EACX,GAAG,EACH,eAAe,EACf,UAAU,EACV,KAAK,EACL,aAAa,EACb,eAAe,EACf,QAAQ,EACR,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAuB,MAAM,YAAY,CAAC;AAgC3E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAoB;IAQ/B,QAAQ,CAAC,UAAU,EAAE,uBAAuB;IAP7C,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,WAAW,CAAuB;gBAGhC,UAAU,EAAE,uBAAuB,EAC5C,eAAe,CAAC,EAAE,MAAM,IAAI,EAC5B,KAAK,GAAE,wBAIN,EACD,SAAS,GAAE,MAA6D;IAWzE,OAAO,CAAC,eAAe,CAA2B;IAElD,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAI/B,gBAAgB,IAAI,MAAM,EAAE,GAAG,SAAS;IAIxC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAS7B,QAAQ,IAAI,QAAQ;IAId,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQjC,iBAAiB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAMtC,KAAK,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOvD;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,gBAAgB,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAKxD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAaf,UAAU;CAWxB"}

package/lib/oauth-sources.d.ts

@@ -0,0 +1,205 @@
+/**
+ * Allowlisted CLI OAuth source discovery, hardened reads, exact parsers, and
+ * two-phase preview/commit primitives. The HTTP routes and destination stores
+ * stay outside this module so the parent can wire them later.
+ * @module dsh-coding-subscription-oauth/oauth-sources
+ */
+import { type CodingOAuthProviderSlug } from "./ids.js";
+/** Hard ceiling for a CLI source or destination document. */
+export declare const OAUTH_SOURCE_MAX_BYTES: number;
+/** In-memory preview tickets are one-use and live five minutes. */
+export declare const OAUTH_IMPORT_PREVIEW_TTL_MS: number;
+/** Bound credential-bearing preview material retained by one process. */
+export declare const OAUTH_IMPORT_MAX_PREVIEW_TICKETS = 32;
+export type OAuthSourceKind = CodingOAuthProviderSlug;
+export declare const OAUTH_SOURCE_KINDS: readonly ["grok", "codex", "kimi", "claude"];
+export type OAuthImportConflict = "none" | "same_credential" | "same_account" | "different_account" | "unknown_account" | "unreadable_destination" | "unsafe_destination";
+export type OAuthImportPreviewAction = "import" | "reuse" | "overwrite" | "blocked";
+export type OAuthImportCommitAction = "imported" | "unchanged" | "overwritten";
+export type OAuthSourceErrorCode = "not_found" | "unsafe_source" | "too_large" | "invalid_document" | "unsupported" | "preview_expired" | "preview_invalid" | "source_changed" | "destination_changed" | "confirm_required" | "unsafe_destination";
+export type OAuthSourceUnavailableReason = "missing" | "unsafe" | "invalid" | "too_large";
+export type OAuthDestinationStatus = "missing" | "readable" | "unreadable" | "unsafe";
+export interface OAuthSourceCredential {
+    type: "oauth";
+    access: string;
+    refresh: string;
+    expires: number;
+    accountId?: string;
+}
+export interface OAuthSourceSpec {
+    kind: OAuthSourceKind;
+    envHome: "GROK_HOME" | "CODEX_HOME" | "KIMI_SHARE_DIR" | "CLAUDE_CONFIG_DIR";
+    defaultDir: string;
+    relativeFile: string;
+    providerId: string;
+}
+export interface OAuthSourcePathOptions {
+    env?: NodeJS.Dict<string>;
+    home?: string;
+}
+export interface OAuthSourceFileIdentity {
+    dev: number;
+    ino: number;
+    size: number;
+    uid: number;
+    mode: number;
+}
+export interface HardenedOAuthSourceRead {
+    path: string;
+    text: string;
+    identity: OAuthSourceFileIdentity;
+}
+export interface OAuthSourceDiscovery {
+    kind: OAuthSourceKind;
+    displayPath: string;
+    available: boolean;
+    expiresAt?: number;
+    reason?: OAuthSourceUnavailableReason;
+}
+export interface OAuthSourceProbe {
+    kind: OAuthSourceKind;
+    available: boolean;
+    displayPath: string;
+    expiresAt?: number;
+    reason?: OAuthSourceUnavailableReason;
+}
+export interface OAuthImportDestinationView {
+    path?: string;
+    status?: OAuthDestinationStatus;
+    credential?: OAuthSourceCredential;
+    revision?: string;
+}
+export interface OAuthDestinationInspection {
+    status: OAuthDestinationStatus;
+    identity?: OAuthSourceFileIdentity;
+    /** Internal. Never serialize this field to a client. */
+    credential?: OAuthSourceCredential;
+    /** Internal digest of unreadable dest bytes. Never serialize this field to a client. */
+    payloadMac?: string;
+}
+export interface OAuthImportPreview {
+    previewId: string;
+    kind: OAuthSourceKind;
+    displayPath: string;
+    expiresAt: number;
+    ticketExpiresAt: number;
+    conflict: OAuthImportConflict;
+    action: OAuthImportPreviewAction;
+    warnings: string[];
+    confirmOverwriteRequired: boolean;
+}
+export interface OAuthImportCommitResult {
+    action: OAuthImportCommitAction;
+    displayPath: string;
+    expiresAt: number;
+    warnings: string[];
+}
+export interface OAuthImportSessionOptions {
+    now?: () => number;
+    ttlMs?: number;
+}
+export interface OAuthImportPreviewInput extends OAuthSourcePathOptions {
+    kind: OAuthSourceKind;
+    destination?: OAuthImportDestinationView;
+}
+export interface OAuthImportCommitInput extends OAuthSourcePathOptions {
+    previewId: string;
+    /** When set, must match the ticket kind; a mismatch does not consume the ticket. */
+    kind?: OAuthSourceKind;
+    confirmOverwrite?: boolean;
+    destination?: OAuthImportDestinationView;
+}
+/** Secret-free preview claim used to route a ticket to its destination store. */
+export interface OAuthImportPreviewClaim {
+    kind: OAuthSourceKind;
+    ticketExpiresAt: number;
+}
+/** Stable allowlist metadata for parent route/store wiring. */
+export declare const OAUTH_SOURCE_SPECS: readonly OAuthSourceSpec[];
+/** Secret-free failure from discovery, parse, preview, or commit. */
+export declare class OAuthSourceError extends Error {
+    readonly code: OAuthSourceErrorCode;
+    constructor(code: OAuthSourceErrorCode, message: string);
+}
+export declare function isOAuthSourceError(error: unknown): error is OAuthSourceError;
+export declare function isOAuthSourceKind(value: string): value is OAuthSourceKind;
+export declare function oauthSourceSpec(kind: OAuthSourceKind): OAuthSourceSpec;
+export declare function oauthSourceProviderId(kind: OAuthSourceKind): string;
+/** Resolve one allowlisted CLI auth document. Env/home are injectable for tests. */
+export declare function resolveOAuthSourcePath(kind: OAuthSourceKind, options?: OAuthSourcePathOptions): string;
+/**
+ * Client-safe display path. Never returns an absolute filesystem location.
+ * Env overrides render as `$GROK_HOME/auth.json`; defaults as `~/.grok/auth.json`.
+ */
+export declare function oauthSourceDisplayPath(kind: OAuthSourceKind, options?: OAuthSourcePathOptions): string;
+export declare function oauthImportRequiresConfirm(conflict: OAuthImportConflict): boolean;
+export declare function oauthImportPreviewAction(conflict: OAuthImportConflict): OAuthImportPreviewAction;
+/**
+ * lstat → O_NOFOLLOW open → fstat. Rejects symlinks, non-regular files, non-owner
+ * files, group/other access, TOCTOU identity changes, and payloads over 64KiB.
+ * POSIX fails closed if O_NOFOLLOW or the process uid is unavailable. Windows
+ * skips POSIX uid/mode owner checks but still applies identity and size limits.
+ * Never chmod()s or writes the path.
+ */
+export declare function readHardenedOAuthSourceFile(filename: string): Promise<HardenedOAuthSourceRead>;
+/** Inspect a destination store file with the same hardened reader. Never follows dest. */
+export declare function inspectOAuthDestinationFile(filename: string): Promise<OAuthDestinationInspection>;
+export declare function parseOAuthSourceDocument(kind: OAuthSourceKind, text: string): OAuthSourceCredential;
+/**
+ * Grok CLI scope map. Selects the auth.x.ai OIDC entry (`key` + `refresh_token`).
+ * Expiry must be a valid RFC3339 `expires_at`. Multiple matching entries pick
+ * the latest valid expiry.
+ */
+export declare function parseGrokCliAuthDocument(text: string): OAuthSourceCredential;
+/**
+ * Codex CLI `tokens` object. Requires id/access/refresh, JWT `exp` in seconds.
+ * Account id prefers official `tokens.account_id`, then top-level `account_id`
+ * for compatibility, then the full ChatGPT account id from the access JWT.
+ * Rejects API-key documents.
+ */
+export declare function parseCodexCliAuthDocument(text: string): OAuthSourceCredential;
+/** Kimi Code CLI document. Snake_case `access_token` / `refresh_token` / `expires_at` seconds. */
+export declare function parseKimiCliAuthDocument(text: string): OAuthSourceCredential;
+/** Claude Code CLI document. `claudeAiOauth` camelCase `accessToken` / `refreshToken` / `expiresAt` ms. */
+export declare function parseClaudeCliAuthDocument(text: string): OAuthSourceCredential;
+export declare function probeOAuthSource(kind: OAuthSourceKind, options?: OAuthSourcePathOptions): Promise<OAuthSourceProbe>;
+export declare function discoverOAuthSources(options?: OAuthSourcePathOptions): Promise<OAuthSourceDiscovery[]>;
+/**
+ * In-memory two-phase import controller. Preview IDs are random, one-use, and
+ * expire after five minutes. `peekPreview` exposes only kind + ticket expiry so
+ * routes can bind a destination without a second ticket map. HMAC fingerprints
+ * and persist material stay internal.
+ */
+export declare class OAuthImportSession {
+    #private;
+    constructor(options?: OAuthImportSessionOptions);
+    discover(options?: OAuthSourcePathOptions): Promise<OAuthSourceDiscovery[]>;
+    /**
+     * Secret-free peek. Does not consume a live ticket. An expired ticket is
+     * deleted and reported as {@link OAuthSourceError} `preview_expired` once.
+     */
+    peekPreview(previewId: string): OAuthImportPreviewClaim;
+    preview(input: OAuthImportPreviewInput): Promise<OAuthImportPreview>;
+    /**
+     * Consume the preview, reopen the allowlisted source, and compare the
+     * destination revision. Call this from inside the destination store lock.
+     * Use {@link OAuthImportCommitOutcome.takePersist} for the write material.
+     */
+    commit(input: OAuthImportCommitInput): Promise<OAuthImportCommitOutcome>;
+    cancel(previewId: string): boolean;
+}
+/** Public commit result plus hidden persist material. */
+export declare class OAuthImportCommitOutcome {
+    #private;
+    readonly result: OAuthImportCommitResult;
+    constructor(result: OAuthImportCommitResult, persist: OAuthSourceCredential | undefined);
+    /** Internal. Write this through the destination store; omit to keep dest canonical. */
+    takePersist(): OAuthSourceCredential | undefined;
+    toJSON(): OAuthImportCommitResult;
+}
+export declare function createOAuthImportSession(options?: OAuthImportSessionOptions): OAuthImportSession;
+export declare function classifyOAuthImportConflict(incoming: OAuthSourceCredential, destination: {
+    status?: OAuthDestinationStatus;
+    credential?: OAuthSourceCredential;
+}): OAuthImportConflict;
+//# sourceMappingURL=oauth-sources.d.ts.map

package/lib/oauth-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-sources.d.ts","sourceRoot":"","sources":["../../src/oauth-sources.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAGN,KAAK,uBAAuB,EAG5B,MAAM,UAAU,CAAC;AAElB,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAEhD,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAuCnD,MAAM,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEtD,eAAO,MAAM,kBAAkB,8CAAoF,CAAC;AAEpH,MAAM,MAAM,mBAAmB,GAC5B,MAAM,GACN,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,iBAAiB,GACjB,wBAAwB,GACxB,oBAAoB,CAAC;AAExB,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC;AAE/E,MAAM,MAAM,oBAAoB,GAC7B,WAAW,GACX,eAAe,GACf,WAAW,GACX,kBAAkB,GAClB,aAAa,GACb,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,GACrB,kBAAkB,GAClB,oBAAoB,CAAC;AAExB,MAAM,MAAM,4BAA4B,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAC1F,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEtF,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,uBAAuB,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,4BAA4B,CAAC;CACtC;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC,wDAAwD;IACxD,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wBAAwB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACvC,MAAM,EAAE,uBAAuB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAwB,SAAQ,sBAAsB;IACtE,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,CAAC,EAAE,0BAA0B,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,0BAA0B,CAAC;CACzC;AAED,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;CACxB;AA+CD,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EAAyD,CAAC;AAEnH,qEAAqE;AACrE,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAExB,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CAKvD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,eAAe,CAEzE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,eAAe,CAEtE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAEnE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAO1G;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,EAAE,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAO1G;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAEjF;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,wBAAwB,CAKhG;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqCpG;AAED,0FAA0F;AAC1F,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAiBvG;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAWnG;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAgB5E;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CA+B7E;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAgB5E;AAED,2GAA2G;AAC3G,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,CAuB9E;AAED,wBAAsB,gBAAgB,CACrC,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,sBAA2B,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAU3B;AAED,wBAAsB,oBAAoB,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAMhH;AAED;;;;;GAKG;AACH,qBAAa,kBAAkB;;gBAMlB,OAAO,GAAE,yBAA8B;IAK7C,QAAQ,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAKrF;;;OAGG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,uBAAuB;IAIjD,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoC1E;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAqD9E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;CAuGlC;AAED,yDAAyD;AACzD,qBAAa,wBAAwB;;IACpC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;gBAG7B,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,qBAAqB,GAAG,SAAS;IAKvF,uFAAuF;IACvF,WAAW,IAAI,qBAAqB,GAAG,SAAS;IAIhD,MAAM,IAAI,uBAAuB;CAGjC;AAED,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAEpG;AAED,wBAAgB,2BAA2B,CAC1C,QAAQ,EAAE,qBAAqB,EAC/B,WAAW,EAAE;IAAE,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAAC,UAAU,CAAC,EAAE,qBAAqB,CAAA;CAAE,GAClF,mBAAmB,CAarB"}

package/lib/oauth.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Grok Build OAuth authorization-code + PKCE flow (primary login path).
+ *
+ * Mirrors the official Grok CLI: OIDC discovery, S256 PKCE, dual-channel code
+ * capture (loopback listener + manual paste), form POST token exchange.
+ * The device-code flow remains the fallback (see auth.ts / bin.ts).
+ * @module dsh-coding-subscription-oauth/oauth
+ */
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+/** OIDC issuer for both Grok CLI and Grok Build. */
+export declare const GROK_BUILD_OAUTH_ISSUER = "https://auth.x.ai";
+/**
+ * Public client id known to work for the device flow; reused as the default
+ * for the authorization-code flow until the official CLI's own id is
+ * confirmed (T2.1). Override with GROK_OAUTH2_CLIENT_ID.
+ */
+export declare const GROK_BUILD_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+/** Scopes the official CLI requests (grok-cli:access = CLI inference pass). */
+export declare const GROK_BUILD_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+/** Default loopback port observed for the official CLI (codex-app-transfer). */
+export declare const GROK_BUILD_OAUTH_DEFAULT_PORT = 56121;
+export type GrokBuildOAuthErrorCode = "discovery" | "loopback" | "state_mismatch" | "token_exchange" | "cancelled" | "timeout";
+/** OAuth failure with a stable, secret-free machine code. */
+export declare class GrokBuildOAuthError extends Error {
+    readonly code: GrokBuildOAuthErrorCode;
+    constructor(code: GrokBuildOAuthErrorCode, message: string);
+}
+export interface GrokBuildOAuthParams {
+    issuer: string;
+    clientId: string;
+    scope: string;
+    /** Loopback port for the redirect URI; falls forward on EADDRINUSE. */
+    port: number;
+    /** Optional xAI extension parameter. */
+    referrer?: string;
+}
+/** Resolve OAuth parameters from overrides then GROK_OAUTH2_* env vars. */
+export declare function resolveOAuthParams(overrides?: Partial<GrokBuildOAuthParams>): GrokBuildOAuthParams;
+interface DiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+}
+export interface DiscoveryFetchOptions {
+    /** Loopback-only test override: permit `http://127.0.0.1`/`http://[::1]` issuers. */
+    readonly allowInsecureLoopbackIssuer?: boolean;
+}
+/** Fetch (and cache for the process) the issuer's discovery document. */
+export declare function discoverOAuthEndpoints(issuer: string, signal?: AbortSignal, options?: DiscoveryFetchOptions): Promise<DiscoveryDocument>;
+/** Generate an S256 PKCE verifier/challenge pair (Web Crypto compatible). */
+export declare function generatePkce(): {
+    verifier: string;
+    challenge: string;
+};
+/** Build the authorization URL for one login attempt. */
+export declare function buildAuthorizeUrl(endpoints: DiscoveryDocument, params: GrokBuildOAuthParams, redirectUri: string, challenge: string, state: string, nonce: string): string;
+/** Exchange a refresh token for a fresh credential (rotation-tolerant). */
+export declare function refreshGrokBuildToken(refreshToken: string, overrides?: Partial<GrokBuildOAuthParams>, signal?: AbortSignal, discoveryOptions?: DiscoveryFetchOptions): Promise<OAuthCredential>;
+export interface PkceLoginCallbacks {
+    /** Invoked with the authorization URL to display/open for the user. */
+    onAuthorizeUrl(url: string): void;
+    /**
+     * Manual-paste channel: resolve with the code (or full redirect URL) the
+     * user pasted. Return undefined to disable this channel. Rejects on cancel.
+     */
+    awaitCode?: (signal: AbortSignal) => Promise<string | undefined>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+/** Extract a bare code from user input that may be a full redirect URL. */
+export declare function extractCode(input: string): string;
+/**
+ * Run the authorization-code + PKCE login. The code arrives via the loopback
+ * listener or the manual-paste channel, whichever wins. The caller persists
+ * the returned credential (store.modify under the file lock).
+ */
+export declare function loginGrokBuildPkce(callbacks: PkceLoginCallbacks, overrides?: Partial<GrokBuildOAuthParams & DiscoveryFetchOptions>): Promise<OAuthCredential>;
+export {};
+//# sourceMappingURL=oauth.d.ts.map

package/lib/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,oDAAoD;AACpD,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAY3D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,yCAAyC,CAAC;AAEjF,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,mEAAmE,CAAC;AAEvG,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,QAAQ,CAAC;AAMnD,MAAM,MAAM,uBAAuB,GAChC,WAAW,GACX,UAAU,GACV,gBAAgB,GAChB,gBAAgB,GAChB,WAAW,GACX,SAAS,CAAC;AAEb,6DAA6D;AAC7D,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;gBAE3B,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM;CAK1D;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,GAAG,oBAAoB,CAatG;AAED,UAAU,iBAAiB;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;CACvB;AAmED,MAAM,WAAW,qBAAqB;IACrC,qFAAqF;IACrF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAC/C;AAED,yEAAyE;AACzE,wBAAsB,sBAAsB,CAC3C,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAgG5B;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAItE;AAMD,yDAAyD;AACzD,wBAAgB,iBAAiB,CAChC,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACX,MAAM,CAYR;AA+LD,2EAA2E;AAC3E,wBAAsB,qBAAqB,CAC1C,YAAY,EAAE,MAAM,EACpB,SAAS,GAAE,OAAO,CAAC,oBAAoB,CAAM,EAC7C,MAAM,CAAC,EAAE,WAAW,EACpB,gBAAgB,GAAE,qBAA0B,GAC1C,OAAO,CAAC,eAAe,CAAC,CAa1B;AAED,MAAM,WAAW,kBAAkB;IAClC,uEAAuE;IACvE,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBjD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACvC,SAAS,EAAE,kBAAkB,EAC7B,SAAS,GAAE,OAAO,CAAC,oBAAoB,GAAG,qBAAqB,CAAM,GACnE,OAAO,CAAC,eAAe,CAAC,CAiE1B"}