dsh-coding-subscription-oauth 0.5.0

package/docs/02-architecture.zh-CN.md

@@ -0,0 +1,128 @@
+# 02 · 架构设计
+
+## 1. 路由与原生 provider
+
+```text
+Harness route          pi-ai provider        请求认证
+────────────────────────────────────────────────────────────
+grok-build             grok-build            xAI access token + Grok CLI headers
+codex-oauth             openai-codex          OAuth token → apiKey override
+kimi-code-oauth         kimi-coding           OAuth token → Authorization: Bearer
+claude-code-oauth       anthropic             sk-ant-oat token → Claude Code headers
+agy                     dsh-agy external      dsh-agy 自有账号池
+```
+
+外部 route 和 pi-ai 原生 id 由 `AliasLlmAdapter` 分隔。`PiAiAdapter` 始终看到原生 provider id，因此 Codex 工具调用、Claude compatibility 判断和 Kimi Anthropic transport 不因 route 改名而失效。
+
+模型发现里的“已认证”定义为存在可读、结构有效且可刷新的 OAuth credential；不会在每次打开选择器时向上游做在线探测。已被上游撤销但本地仍有效的 credential 会在 token refresh 或推理时被识别，避免目录加载产生额外网络请求。
+
+## 2. 主机数据流
+
+```text
+Settings / CLI
+  │
+  ├─ GrokBuildWebAuth ── Grok custom PKCE/device
+  │                      └─ .grok-build-auth.json
+  │
+  ├─ SubscriptionWebAuth ── pi-ai OAuth login/refresh
+  │         ├─ Codex  ── .codex-oauth-auth.json
+  │         ├─ Kimi   ── .kimi-code-oauth-auth.json
+  │         └─ Claude ── .claude-code-oauth-auth.json
+  │
+  └─ OAuthImportSession ── 白名单 CLI 只读发现
+            └─ 显式单向拉取（预览票据 → 目标 store）
+               从不写入官方 CLI 文件
+
+OAuthProviderSession.resolveAccessToken()
+  └─ Models.getAuth(native id)        # refresh-under-lock
+       └─ OAuthCredentialFileStore    # 0600 + atomic write + cross-process lock
+
+CapabilitySettingsController（默认关闭，applies: live）
+  └─ CapabilityRuntimeState
+       ├─ Codex 搜索 / 用量 / gpt-image-2 图像
+       ├─ codex-oauth-fast（仅在最新 priority catalog 之后）
+       └─ Grok Imagine（api.x.ai + DSH 凭据 XAI_API_KEY）
+
+ctx.llm route
+  └─ AliasLlmAdapter
+       └─ PiAiAdapter
+            └─ native pi-ai Provider.streamSimple()
+```
+
+## 3. 模块职责
+
+- `store.ts`：一个文件只拥有一个 provider credential；保留旧 Grok store API；`invalidate()` 在上游 AUTH 拒绝后把 `expires` 回写到过去。
+- `oauth-providers.ts`：Codex/Kimi/Claude 定义、route metadata、请求 token bridge。
+- `oauth-session.ts`：登录、刷新、静态模型目录和模型选择缓存。
+- `oauth-sources.ts`：白名单官方 Grok/Codex/Kimi/Claude CLI 发现；加固的 lstat/`O_NOFOLLOW`/属主/权限/普通文件/大小读取；一次性预览票据（五分钟、最多 32 张）；从不写入官方 CLI 文件。
+- `oauth-import-routes.ts`：同源拉取 HTTP API（发现 → 预览 → 提交/取消），写入发生在目标 store 锁内。
+- `alias-adapter.ts`：转换 Harness route、不修改 pi-ai model.provider，并在 `listModels()` 前执行 credential gate；未认证或凭据读取失败返回空目录，provider group 名使用 `(OAuth)`。AUTH finish 时作废本地令牌，让 harness 重试先刷新。
+- `adapter.ts`：组合 Grok 与三个 subscription profile；向 pi-ai 要求至少 60 秒剩余有效期，并注册包含 AUTH 与瞬时故障码的 retryPolicy。可选包装 `codex-oauth-fast`，显示为 **已请求 Fast**。
+- `auth-routes.ts`：旧 Grok API + 新统一 `/plugins/dsh-grok-build/oauth/*`；JSON 写请求使用 64 KiB 有界读取器，无效/超限 body 分别返回 400/413。
+- `capability-settings.ts`：默认关闭、立即生效的开关与限制（搜索 1–20、图像 1–4、产物 TTL 1 小时–7 天）。
+- `capability-routes.ts`：无密钥的能力快照，以及可选的 Codex 用量和 Imagine 凭据状态路由。
+- `capability-runtime.ts`：按 live 开关绑定/解绑搜索、工具，以及仅在最新 priority catalog 后发布 Fast 路由。
+- `capability-tools.ts`：可选 Codex / Grok Imagine 工具定义；执行时重新读取开关。
+- `codex-http.ts`：需打开的私有 `chatgpt.com/backend-api` 客户端（仅 HTTPS、仅第一方主机）。
+- `codex-search.ts` / `codex-usage.ts` / `codex-images.ts`：可选搜索、配额，以及固定 `gpt-image-2` 生成/编辑（编辑要求当前会话顶层附件所有权）。
+- `codex-model-capabilities.ts`：live Codex service-tier 缓存；Fast 资格失败关闭；注入 `service_tier: priority` 与路由提示。
+- `grok-imagine.ts`：官方 `api.x.ai` Imagine 客户端（`grok-imagine-image-2.0` / `grok-imagine-video-1.5`）；`XAI_API_KEY` 只通过 DSH 凭据；MIME/大小/超时/重定向/DNS 下载控制；冻结主机 `imgen.x.ai`、`videogen.x.ai`、`vidgen.x.ai`。
+- `imagine-routes.ts`：生成图像与视频产物的同源 loopback GET 路由。
+- `media-store.ts`：属主私有产物库（单件与唯一对象总量均硬限 256 MiB，最长七天）。
+- `client/`：四个原生账号卡片、CLI 拉取、能力开关、网关控制，以及外部 Antigravity 状态卡片。
+- `proxy.ts`：process-wide undici dispatcher，但只代理审核过的域名白名单。
+- `gateway*.ts`：可选的隔离 loopback OpenAI/Anthropic 兼容 HTTP 服务（默认关；独立于 DSH web 端口）。
+
+## 4. Web API
+
+统一接口：
+
+```text
+GET  /plugins/dsh-grok-build/oauth/status
+POST /plugins/dsh-grok-build/oauth/login
+POST /plugins/dsh-grok-build/oauth/code
+POST /plugins/dsh-grok-build/oauth/cancel
+POST /plugins/dsh-grok-build/oauth/logout
+POST /plugins/dsh-grok-build/oauth/models
+
+GET  /plugins/dsh-grok-build/oauth/sources
+POST /plugins/dsh-grok-build/oauth/sources/preview
+POST /plugins/dsh-grok-build/oauth/sources/commit
+POST /plugins/dsh-grok-build/oauth/sources/cancel
+
+GET    /plugins/dsh-grok-build/capabilities
+PATCH  /plugins/dsh-grok-build/capabilities
+PUT    /plugins/dsh-grok-build/capabilities
+GET    /plugins/dsh-grok-build/codex/usage
+GET    /plugins/dsh-grok-build/imagine/credential-status
+GET    /plugins/dsh-grok-build/imagine/images/<id>
+GET    /plugins/dsh-grok-build/imagine/media/<id>
+GET    /plugins/dsh-grok-build/gateway
+PATCH  /plugins/dsh-grok-build/gateway
+POST   /plugins/dsh-grok-build/gateway/rotate
+```
+
+写接口请求体带 `provider: grok|codex|kimi|claude`。响应只包含状态、授权 URL、device user code、模型 id 和非敏感 expiry；绝不包含 access/refresh token。JSON 请求体在解析前限制为 64 KiB。
+
+`/oauth/sources` 是只读发现。预览/提交是显式单向拉取（票据一次性、五分钟、最多 32 张）。能力写入位于 `coding-subscription-oauth` 设置区，是无密钥的 compare-and-swap 快照并立即生效。七项开关默认关闭；`searchResults` 为 1–20（默认 5），`imageCount` 为 1–4（默认 1），`videoArtifactTtlMs` 为 1 小时–7 天（默认 7 天；界面显示 1–168 小时）；降低时立即改写/清理已有 expiry，提高只影响新产物。Imagine 下载路由是同源 loopback GET，从不返回上游签名 URL。
+
+旧 `/plugins/dsh-grok-build/auth/*` 继续注册并复用同一个 Grok 控制器。
+
+## 5. Antigravity
+
+本项目不复制 Google Antigravity 私有协议。profile 单独安装 `dsh-agy@0.1.2`，提供 `agy` route。由于该版本的 `/agy` dashboard 含无自身认证的 export API，trusted-host 部署应在 profile 最终 `cordis.patch.yml` 中禁用 `dsh-agy-web`（见 `INSTALL.md`），只保留 host adapter 和 CLI。profile 使用带 lockfile hash 的 pnpm patch：无 Google session 时 `listModels()` 返回空，认证后 provider group 名为 `Google Antigravity (OAuth)`。
+
+## 6. 兼容性
+
+正式包名与仓库名是 **`dsh-coding-subscription-oauth`**。旧 GitHub 地址仍指向同一条 `main`，因此旧的 `dsh plugin add github:lninghaha/dsh-grok-build` 仍会安装更名后的包。第一次公开 npm / GitHub Release 是 **`0.4.1`**。当前版本是 **`0.5.0`**（`dsh plugin --profile web add dsh-coding-subscription-oauth@0.5.0`）。GitHub 与本地 tarball 安装仍然有效。
+
+以下标识保持稳定（无迁移方案前不要改名）：
+
+- Cordis id：`llm-grok-build-oauth`
+- 设置页 HTTP API：`/plugins/dsh-grok-build/oauth/*`、`/plugins/dsh-grok-build/capabilities`、`/plugins/dsh-grok-build/codex/usage`、`/plugins/dsh-grok-build/imagine/*`，以及旧的 `/plugins/dsh-grok-build/auth/*`
+- 凭据文件：`$DSH_HOME/.grok-build-auth.json` 及其他 `*-oauth-auth.json`
+- Imagine 凭据：DSH 凭据引用 `XAI_API_KEY`（不用 Grok OAuth，不回退进程环境变量）
+- CLI：`dsh-coding-oauth`（主命令）与 `dsh-grok-build`（别名）
+- LLM 路由：`grok-build`、`codex-oauth`、`kimi-code-oauth`、`claude-code-oauth`；可选 `codex-oauth-fast`（v0.4.0，仅在最新 live catalog 列出 `priority` 后发布）
+
+新 route 使用 `*-oauth` alias，不占用 `openai`、`xai`、`kimi-coding`。v0.3.0 将 `grok-build` fallback/default 更新为 `grok-4.6`，已有用户默认设置仍优先。

package/lib/adapter.d.ts

@@ -0,0 +1,24 @@
+/** Coding-subscription adapter assembled from public dsh-llm-pi-ai extension points. */
+import type { AttachmentStore } from "@deepseek-ai/dsh-attachment";
+import type { RetryPolicyConfig } from "@deepseek-ai/dsh-llm";
+import { type LlmAdapter } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import type { OAuthProviderSession } from "./oauth-session.js";
+import type { GrokBuildSession } from "./session.js";
+/** Prefer grok-4.6 when the current (live or baseline) list has it. */
+export declare function preferredGrokBuildModel(models?: readonly {
+    id: string;
+}[]): string;
+/** Existing Grok-only constructor retained for public API compatibility. */
+export declare function createGrokBuildAdapter(session: GrokBuildSession, resolveAttachments: () => AttachmentStore | undefined): PiAiAdapter;
+/** Opt-in Codex Fast wiring; ordinary `codex-oauth` is unchanged when this is omitted. */
+export interface CodingOAuthAdapterOptions {
+    retryPolicy?: RetryPolicyConfig;
+    codexFast?: {
+        isEligible(modelId: string): boolean;
+    };
+}
+/** Create the four-route OAuth adapter while preserving each pi-ai native id. */
+export declare function createCodingOAuthAdapter(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[], resolveAttachments: () => AttachmentStore | undefined, retryPolicy?: RetryPolicyConfig, options?: CodingOAuthAdapterOptions): LlmAdapter;
+export declare function createCodingOAuthAdapter(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[], resolveAttachments: () => AttachmentStore | undefined, options?: CodingOAuthAdapterOptions): LlmAdapter;
+//# sourceMappingURL=adapter.d.ts.map

package/lib/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/adapter.ts"],"names":[],"mappings":"AAAA,wFAAwF;AAExF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,KAAK,UAAU,EAAgC,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAkBzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAErD,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAA8B,GAAG,MAAM,CAE7G;AAyDD,4EAA4E;AAC5E,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,gBAAgB,EACzB,kBAAkB,EAAE,MAAM,eAAe,GAAG,SAAS,GACnD,WAAW,CAgBb;AAED,0FAA0F;AAC1F,MAAM,WAAW,yBAAyB;IACzC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,SAAS,CAAC,EAAE;QAAE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;CACrD;AAwBD,iFAAiF;AACjF,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,SAAS,oBAAoB,EAAE,EAC9C,kBAAkB,EAAE,MAAM,eAAe,GAAG,SAAS,EACrD,WAAW,CAAC,EAAE,iBAAiB,EAC/B,OAAO,CAAC,EAAE,yBAAyB,GACjC,UAAU,CAAC;AACd,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,gBAAgB,EACtB,aAAa,EAAE,SAAS,oBAAoB,EAAE,EAC9C,kBAAkB,EAAE,MAAM,eAAe,GAAG,SAAS,EACrD,OAAO,CAAC,EAAE,yBAAyB,GACjC,UAAU,CAAC"}

package/lib/alias-adapter.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Harness route aliases over a native-id PiAiAdapter.
+ * @module dsh-coding-subscription-oauth/alias-adapter
+ */
+import type { GenerateOptions, LlmModelInfo, LlmProviderInfo, LlmResolvedModelInfo, ResolvedRetryPolicy, StreamChunk } from "@deepseek-ai/dsh-llm";
+import { LlmAdapter } from "@deepseek-ai/dsh-llm";
+export interface AliasLlmRoutePolicy {
+    /** User-facing provider name shown above models in the model selector. */
+    displayName?: string;
+    /** Return false to hide every model for this route from discovery. */
+    isAuthenticated?: () => Promise<boolean>;
+    /**
+     * After authentication, keep only models this predicate accepts.
+     * Used by opt-in routes (e.g. Codex Fast) so ineligible ids stay hidden
+     * without hiding the whole authenticated catalog.
+     */
+    includeModel?: (modelId: string) => boolean;
+    /**
+     * Called once when a stream for this route finishes with an AUTH failure
+     * (upstream rejected a locally-valid token). Implementations backdate the
+     * stored credential's expiry so the retried step refreshes before reuse.
+     * Awaiting it here keeps invalidation ordered before the retry executor
+     * reruns the step; failures are swallowed so the original AUTH surfaces.
+     */
+    onAuthFailure?: () => Promise<void>;
+}
+/**
+ * Keeps pi-ai model.provider identities native while exposing collision-free
+ * Harness route names. Every public operation translates exactly once.
+ */
+export declare class AliasLlmAdapter extends LlmAdapter {
+    private readonly inner;
+    private readonly aliases;
+    private readonly policies;
+    constructor(inner: LlmAdapter, aliases: ReadonlyMap<string, string>, policies?: ReadonlyMap<string, AliasLlmRoutePolicy>);
+    private nativeProvider;
+    providerInfo(provider: string): LlmProviderInfo;
+    providerRetryPolicy(provider: string): ResolvedRetryPolicy | undefined;
+    listModels(provider: string): Promise<readonly LlmModelInfo[]>;
+    resolveModel(provider: string, model: string, signal?: AbortSignal): Promise<LlmResolvedModelInfo>;
+    stream(options: GenerateOptions): AsyncIterable<StreamChunk>;
+}
+//# sourceMappingURL=alias-adapter.d.ts.map

package/lib/alias-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-adapter.d.ts","sourceRoot":"","sources":["../../src/alias-adapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACX,eAAe,EACf,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAY,MAAM,sBAAsB,CAAC;AAG5D,MAAM,WAAW,mBAAmB;IACnC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAwBD;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,UAAU;IAE7C,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAFR,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAa;IAKhF,OAAO,CAAC,cAAc;IAMtB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe;IAO/C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAIhE,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;IAiB9D,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAKjG,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,aAAa,CAAC,WAAW,CAAC;CAwCnE"}

package/lib/auth-routes.d.ts

@@ -0,0 +1,155 @@
+/** Same-origin Web settings routes for Grok Build OAuth. */
+import type { Context } from "@deepseek-ai/cordis";
+import type { CatalogSource } from "./catalog.js";
+import { ANTIGRAVITY_ROUTE, type CodingOAuthProviderSlug } from "./ids.js";
+import type { SubscriptionLoginMethod } from "./oauth-providers.js";
+import type { OAuthProviderSession } from "./oauth-session.js";
+import type { GrokBuildSession } from "./session.js";
+export declare const GROK_BUILD_AUTH_STATUS_PATH = "/plugins/dsh-grok-build/auth/status";
+export declare const GROK_BUILD_AUTH_LOGIN_PATH = "/plugins/dsh-grok-build/auth/login";
+export declare const GROK_BUILD_AUTH_LOGIN_CODE_PATH = "/plugins/dsh-grok-build/auth/login/code";
+export declare const GROK_BUILD_AUTH_LOGIN_CANCEL_PATH = "/plugins/dsh-grok-build/auth/login/cancel";
+export declare const GROK_BUILD_AUTH_IMPORT_PATH = "/plugins/dsh-grok-build/auth/import";
+export declare const GROK_BUILD_AUTH_LOGOUT_PATH = "/plugins/dsh-grok-build/auth/logout";
+export declare const GROK_BUILD_AUTH_MODELS_PATH = "/plugins/dsh-grok-build/auth/models";
+export declare const CODING_OAUTH_STATUS_PATH = "/plugins/dsh-grok-build/oauth/status";
+export declare const CODING_OAUTH_LOGIN_PATH = "/plugins/dsh-grok-build/oauth/login";
+export declare const CODING_OAUTH_LOGIN_CODE_PATH = "/plugins/dsh-grok-build/oauth/code";
+export declare const CODING_OAUTH_LOGIN_CANCEL_PATH = "/plugins/dsh-grok-build/oauth/cancel";
+export declare const CODING_OAUTH_LOGOUT_PATH = "/plugins/dsh-grok-build/oauth/logout";
+export declare const CODING_OAUTH_MODELS_PATH = "/plugins/dsh-grok-build/oauth/models";
+export type GrokBuildLoginMethod = "pkce" | "device";
+export type GrokBuildWebAuthStatus = {
+    status: "signed-out";
+    grokImportAvailable: boolean;
+} | {
+    status: "signing-in";
+    method: GrokBuildLoginMethod;
+    url?: string;
+    userCode?: string;
+    grokImportAvailable: boolean;
+} | {
+    status: "signed-in";
+    models: string[];
+    available: string[];
+    selected: string[];
+    catalogSource: CatalogSource;
+    catalogError?: string;
+    grokImportAvailable: boolean;
+} | {
+    status: "error";
+    message: string;
+    grokImportAvailable: boolean;
+};
+export interface LoginChallenge {
+    method: GrokBuildLoginMethod;
+    url: string;
+    userCode?: string;
+}
+/**
+ * One lifecycle owner for the pending login (PKCE or device), the published
+ * challenge, the pasted-code channel, and the public status.
+ */
+export declare class GrokBuildWebAuth {
+    private readonly session;
+    private state;
+    private operation;
+    private cancellation;
+    private method;
+    private challenge;
+    private challengeWaiters;
+    private codeResolver;
+    constructor(session: GrokBuildSession);
+    status(): Promise<GrokBuildWebAuthStatus>;
+    /** Start (or join) a login. A different method aborts and restarts the flow. */
+    signIn(method: GrokBuildLoginMethod): Promise<LoginChallenge>;
+    /** Hand a pasted authorization code (or redirect URL) to a pending PKCE login. */
+    submitCode(code: string): Promise<void>;
+    /** Abort a pending login without touching any stored credential. */
+    cancel(): Promise<void>;
+    importGrok(): Promise<void>;
+    setModels(ids: readonly string[]): Promise<void>;
+    signOut(): Promise<void>;
+    dispose(): Promise<void>;
+    private start;
+    private runPkce;
+    private runDevice;
+    private onEvent;
+    private acceptChallenge;
+    private readStoredStatus;
+    private rejectChallenge;
+}
+export type SubscriptionWebAuthStatus = {
+    provider: Exclude<CodingOAuthProviderSlug, "grok">;
+    route: string;
+    displayName: string;
+    loginMethods: readonly SubscriptionLoginMethod[];
+    recommendedLoginMethod: SubscriptionLoginMethod;
+    models: string[];
+    available: string[];
+    selected: string[];
+} & ({
+    status: "signed-out";
+} | {
+    status: "signing-in";
+    method: SubscriptionLoginMethod;
+    url?: string;
+    userCode?: string;
+} | {
+    status: "signed-in";
+    expiresAt?: number;
+} | {
+    status: "error";
+    message: string;
+});
+export interface SubscriptionLoginChallenge {
+    method: SubscriptionLoginMethod;
+    url: string;
+    userCode?: string;
+}
+/** Web lifecycle for one pi-ai subscription OAuth provider. */
+export declare class SubscriptionWebAuth {
+    readonly session: OAuthProviderSession;
+    private readonly challengeTimeoutMs;
+    private state;
+    private operation;
+    private cancellation;
+    private method;
+    private challenge;
+    private challengeWaiters;
+    private codeResolver;
+    constructor(session: OAuthProviderSession, challengeTimeoutMs?: number);
+    status(): Promise<SubscriptionWebAuthStatus>;
+    signIn(method: SubscriptionLoginMethod): Promise<SubscriptionLoginChallenge>;
+    submitCode(code: string): Promise<void>;
+    cancel(): Promise<void>;
+    setModels(ids: readonly string[]): Promise<void>;
+    signOut(): Promise<void>;
+    dispose(): Promise<void>;
+    private baseStatus;
+    private readStoredStatus;
+    private start;
+    private run;
+    private awaitCode;
+    private onEvent;
+    private acceptChallenge;
+    private rejectChallenge;
+}
+/** Register the plugin-owned OAuth routes when the Web server is composed. */
+export declare function registerGrokBuildAuthRoutes(ctx: Context, session: GrokBuildSession, existingAuth?: GrokBuildWebAuth): void;
+export interface CodingOAuthWebStatus {
+    providers: {
+        grok: GrokBuildWebAuthStatus;
+        codex: SubscriptionWebAuthStatus;
+        kimi: SubscriptionWebAuthStatus;
+        claude: SubscriptionWebAuthStatus;
+    };
+    antigravity: {
+        installed: boolean;
+        route: typeof ANTIGRAVITY_ROUTE;
+        management: "cli";
+    };
+}
+/** Register the unified Coding OAuth API plus the compatibility Grok routes. */
+export declare function registerCodingOAuthRoutes(ctx: Context, grokSession: GrokBuildSession, subscriptionSessions: readonly OAuthProviderSession[]): void;
+//# sourceMappingURL=auth-routes.d.ts.map

package/lib/auth-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../../src/auth-routes.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAG5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAKnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAmB,MAAM,UAAU,CAAC;AAE5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIrD,eAAO,MAAM,2BAA2B,wCAAwC,CAAC;AACjF,eAAO,MAAM,0BAA0B,uCAAuC,CAAC;AAC/E,eAAO,MAAM,+BAA+B,4CAA4C,CAAC;AACzF,eAAO,MAAM,iCAAiC,8CAA8C,CAAC;AAC7F,eAAO,MAAM,2BAA2B,wCAAwC,CAAC;AACjF,eAAO,MAAM,2BAA2B,wCAAwC,CAAC;AACjF,eAAO,MAAM,2BAA2B,wCAAwC,CAAC;AAEjF,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAC/E,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAC7E,eAAO,MAAM,4BAA4B,uCAAuC,CAAC;AACjF,eAAO,MAAM,8BAA8B,yCAAyC,CAAC;AACrF,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAC/E,eAAO,MAAM,wBAAwB,yCAAyC,CAAC;AAE/E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,MAAM,sBAAsB,GAC/B;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,GACtD;IACA,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;CAC5B,GACD;IACA,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,OAAO,CAAC;CAC5B,GACD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtE,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAqBD;;;GAGG;AACH,qBAAa,gBAAgB;IAShB,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,OAAO,CAAC,KAAK,CAAgF;IAC7F,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,gBAAgB,CAAqF;IAC7G,OAAO,CAAC,YAAY,CAAuC;gBAE9B,OAAO,EAAE,gBAAgB;IAEhD,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAQ/C,gFAAgF;IAC1E,MAAM,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;IAWnE,kFAAkF;IAC5E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS7C,oEAAoE;IAC9D,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,SAAS,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IASxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAS9B,OAAO,CAAC,KAAK;YAwBC,OAAO;YAyBP,SAAS;IAkBvB,OAAO,CAAC,OAAO;IAcf,OAAO,CAAC,eAAe;YA0BT,gBAAgB;IAgB9B,OAAO,CAAC,eAAe;CAGvB;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACjD,sBAAsB,EAAE,uBAAuB,CAAC;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB,GAAG,CACD;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,uBAAuB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1F;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CACtC,CAAC;AAEF,MAAM,WAAW,0BAA0B;IAC1C,MAAM,EAAE,uBAAuB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAeD,+DAA+D;AAC/D,qBAAa,mBAAmB;IAW9B,QAAQ,CAAC,OAAO,EAAE,oBAAoB;IACtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAXpC,OAAO,CAAC,KAAK,CAAwC;IACrD,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,gBAAgB,CACpB;IACJ,OAAO,CAAC,YAAY,CAAuC;gBAGjD,OAAO,EAAE,oBAAoB,EACrB,kBAAkB,SAAS;IAKvC,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC;IAK5C,MAAM,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IA8B5E,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvB,SAAS,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IASxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAO9B,OAAO,CAAC,UAAU;YAkBJ,gBAAgB;IAY9B,OAAO,CAAC,KAAK;YAyBC,GAAG;IAcjB,OAAO,CAAC,SAAS;IAoBjB,OAAO,CAAC,OAAO;IAYf,OAAO,CAAC,eAAe;IAqBvB,OAAO,CAAC,eAAe;CAGvB;AAgBD,8EAA8E;AAC9E,wBAAgB,2BAA2B,CAC1C,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,gBAAgB,EACzB,YAAY,CAAC,EAAE,gBAAgB,GAC7B,IAAI,CAqGN;AAED,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE;QACV,IAAI,EAAE,sBAAsB,CAAC;QAC7B,KAAK,EAAE,yBAAyB,CAAC;QACjC,IAAI,EAAE,yBAAyB,CAAC;QAChC,MAAM,EAAE,yBAAyB,CAAC;KAClC,CAAC;IACF,WAAW,EAAE;QACZ,SAAS,EAAE,OAAO,CAAC;QACnB,KAAK,EAAE,OAAO,iBAAiB,CAAC;QAChC,UAAU,EAAE,KAAK,CAAC;KAClB,CAAC;CACF;AAeD,gFAAgF;AAChF,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,gBAAgB,EAC7B,oBAAoB,EAAE,SAAS,oBAAoB,EAAE,GACnD,IAAI,CAuKN"}

package/lib/auth.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Grok Build OAuth orchestration shared by the plugin and standalone CLI.
+ * @module dsh-coding-subscription-oauth/auth
+ */
+import type { AuthInteraction } from "@earendil-works/pi-ai";
+import type { GrokBuildSession } from "./session.js";
+import { GrokBuildCredentialStore } from "./store.js";
+/** Non-secret login state shown by the launcher. */
+export interface GrokBuildAuthStatus {
+    authenticated: boolean;
+    expiresAt?: Date;
+}
+/**
+ * Complete the xAI device-code OAuth flow and persist the credential.
+ * The Grok Build backend accepts the same auth.x.ai tokens (scope
+ * `grok-cli:access`); the PKCE authorization-code flow lands in a later
+ * milestone as the primary path.
+ */
+export declare function loginGrokBuild(interaction: AuthInteraction, store?: GrokBuildCredentialStore): Promise<void>;
+/** Copy ~/.grok/auth.json into the dsh store. Does not modify the Grok file. */
+export declare function importGrokBuildFromGrok(store?: GrokBuildCredentialStore, filename?: string): Promise<void>;
+/** Remove the stored Grok Build credential. */
+export declare function logoutGrokBuild(store?: GrokBuildCredentialStore): Promise<void>;
+/** Read non-secret login state without refreshing the token. */
+export declare function grokBuildAuthStatus(store?: GrokBuildCredentialStore): Promise<GrokBuildAuthStatus>;
+/** Login then refresh the account model list when a session is available. */
+export declare function loginGrokBuildSession(interaction: AuthInteraction, session: GrokBuildSession): Promise<void>;
+export declare function importGrokBuildSession(session: GrokBuildSession, filename?: string): Promise<void>;
+//# sourceMappingURL=auth.d.ts.map

package/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAK7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CACnC,WAAW,EAAE,eAAe,EAC5B,KAAK,GAAE,wBAAyD,GAC9D,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,gFAAgF;AAChF,wBAAsB,uBAAuB,CAC5C,KAAK,GAAE,wBAAyD,EAChE,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,+CAA+C;AAC/C,wBAAsB,eAAe,CAAC,KAAK,GAAE,wBAAyD,GAAG,OAAO,CAAC,IAAI,CAAC,CAErH;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CACxC,KAAK,GAAE,wBAAyD,GAC9D,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED,6EAA6E;AAC7E,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlH;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxG"}

package/lib/bin.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/** Standalone credential CLI for the coding-subscription bundle. */
+export type CliAction = "login" | "logout" | "status" | "import";
+export type CliProvider = "all" | "grok" | "codex" | "kimi" | "claude";
+export declare function run(argv: readonly string[]): Promise<number>;
+//# sourceMappingURL=bin.d.ts.map

package/lib/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../../src/bin.ts"],"names":[],"mappings":";AACA,oEAAoE;AAoBpE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AACjE,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAqPvE,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA8ElE"}