dsh-coding-subscription-oauth 0.5.8 → 0.6.2

package/src/grok-import.ts

@@ -1,151 +1,151 @@
-/**
- * One-shot import of Grok CLI credentials into the dsh-owned store.
- * The source file is never written. Refresh tokens rotate, so later dsh
- * refresh may invalidate ~/.grok/auth.json — that is documented, not a bug.
- * @module dsh-coding-subscription-oauth/grok-import
- */
-
-import { readFile, stat } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-import type { OAuthCredential } from "@earendil-works/pi-ai";
-import { XAI_PI_PROVIDER } from "./ids.ts";
-import type { GrokBuildCredentialStore } from "./store.ts";
-
-const DEFAULT_TOKEN_LIFETIME_MS = 60 * 60 * 1000;
-
-export interface GrokImportProbe {
-	available: boolean;
-	path: string;
-}
-
-function isENOENT(error: unknown): boolean {
-	return (error as NodeJS.ErrnoException | null)?.code === "ENOENT";
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function nonEmptyString(value: unknown): string | undefined {
-	return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-
-function firstString(record: Record<string, unknown>, keys: readonly string[]): string | undefined {
-	for (const key of keys) {
-		const value = nonEmptyString(record[key]);
-		if (value !== undefined) return value;
-	}
-	return undefined;
-}
-
-function parseTime(value: string): number {
-	const parsed = Date.parse(value);
-	if (Number.isFinite(parsed) && parsed > 0) return parsed;
-	const trimmed = value.replace(/(\.\d{3})\d+/, "$1");
-	const again = Date.parse(trimmed);
-	return Number.isFinite(again) && again > 0 ? again : Number.NaN;
-}
-
-function parseExpires(record: Record<string, unknown>): number {
-	const expiresAt = record["expires_at"];
-	if (typeof expiresAt === "string" && expiresAt.length > 0) {
-		const parsed = parseTime(expiresAt);
-		if (Number.isFinite(parsed)) return parsed;
-	}
-	if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
-		return expiresAt < 1_000_000_000_000 ? expiresAt * 1000 : expiresAt;
-	}
-	const expires = record["expires"];
-	if (typeof expires === "number" && Number.isFinite(expires) && expires > 0) {
-		return expires < 1_000_000_000_000 ? expires * 1000 : expires;
-	}
-	const expiresIn = record["expires_in"];
-	if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0) {
-		return Date.now() + expiresIn * 1000;
-	}
-	return Date.now() + DEFAULT_TOKEN_LIFETIME_MS;
-}
-
-interface Candidate {
-	credential: OAuthCredential;
-	preferred: boolean;
-}
-
-function walk(value: unknown, key: string): Candidate[] {
-	if (Array.isArray(value)) return value.flatMap((item, index) => walk(item, `${key}[${index}]`));
-	if (!isRecord(value)) return [];
-	const access = firstString(value, ["key", "access", "access_token"]);
-	const refresh = firstString(value, ["refresh_token", "refresh"]);
-	if (access !== undefined && refresh !== undefined) {
-		const issuer = firstString(value, ["oidc_issuer", "issuer"]);
-		const preferred = key.includes("auth.x.ai") || (issuer?.includes("auth.x.ai") ?? false);
-		const accountId = firstString(value, ["user_id", "accountId", "principal_id"]);
-		const credential: OAuthCredential = {
-			type: "oauth",
-			access,
-			refresh,
-			expires: parseExpires(value),
-			...(accountId === undefined ? {} : { accountId }),
-		};
-		return [{ credential, preferred }];
-	}
-	return Object.entries(value).flatMap(([child, nested]) => walk(nested, child));
-}
-
-/** Resolve the Grok CLI auth document. */
-export function grokAuthPath(home: string = homedir()): string {
-	return resolve(join(home, ".grok", "auth.json"));
-}
-
-/** Parse a Grok CLI / generic OAuth document into a pi-ai credential. */
-export function parseGrokAuthDocument(text: string, filename: string): OAuthCredential {
-	let value: unknown;
-	try {
-		value = JSON.parse(text);
-	} catch {
-		throw new Error(`grok-build: ${filename} is not valid JSON`);
-	}
-	const candidates = walk(value, "");
-	if (candidates.length === 0) {
-		throw new Error(`grok-build: ${filename} does not contain a Grok OAuth refresh token`);
-	}
-	const chosen = candidates.find((candidate) => candidate.preferred) ?? candidates[0];
-	if (chosen === undefined) {
-		throw new Error(`grok-build: ${filename} does not contain a Grok OAuth refresh token`);
-	}
-	return chosen.credential;
-}
-
-/** Whether ~/.grok/auth.json exists and looks importable. Never returns secrets. */
-export async function probeGrokAuth(filename: string = grokAuthPath()): Promise<GrokImportProbe> {
-	try {
-		await stat(filename);
-		const text = await readFile(filename, "utf8");
-		parseGrokAuthDocument(text, filename);
-		return { available: true, path: filename };
-	} catch (error) {
-		if (isENOENT(error)) return { available: false, path: filename };
-		return { available: false, path: filename };
-	}
-}
-
-/** Copy Grok CLI tokens into the dsh store. Does not write the Grok file. */
-export async function importGrokAuth(
-	store: GrokBuildCredentialStore,
-	filename: string = grokAuthPath(),
-): Promise<OAuthCredential> {
-	let text: string;
-	try {
-		text = await readFile(filename, "utf8");
-	} catch (error) {
-		if (isENOENT(error)) throw new Error(`grok-build: Grok CLI auth file not found at ${filename}`);
-		throw error;
-	}
-	const credential = parseGrokAuthDocument(text, filename);
-	const written = await store.modify(XAI_PI_PROVIDER, async () => credential);
-	if (written === undefined || written.type !== "oauth") {
-		throw new Error("grok-build: failed to persist the imported Grok credential");
-	}
-	return written;
-}
+/**
+ * One-shot import of Grok CLI credentials into the dsh-owned store.
+ * The source file is never written. Refresh tokens rotate, so later dsh
+ * refresh may invalidate ~/.grok/auth.json — that is documented, not a bug.
+ * @module dsh-coding-subscription-oauth/grok-import
+ */
+
+import { readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import type { OAuthCredential } from "@earendil-works/pi-ai";
+import { XAI_PI_PROVIDER } from "./ids.ts";
+import type { GrokBuildCredentialStore } from "./store.ts";
+
+const DEFAULT_TOKEN_LIFETIME_MS = 60 * 60 * 1000;
+
+export interface GrokImportProbe {
+	available: boolean;
+	path: string;
+}
+
+function isENOENT(error: unknown): boolean {
+	return (error as NodeJS.ErrnoException | null)?.code === "ENOENT";
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+	return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+function firstString(record: Record<string, unknown>, keys: readonly string[]): string | undefined {
+	for (const key of keys) {
+		const value = nonEmptyString(record[key]);
+		if (value !== undefined) return value;
+	}
+	return undefined;
+}
+
+function parseTime(value: string): number {
+	const parsed = Date.parse(value);
+	if (Number.isFinite(parsed) && parsed > 0) return parsed;
+	const trimmed = value.replace(/(\.\d{3})\d+/, "$1");
+	const again = Date.parse(trimmed);
+	return Number.isFinite(again) && again > 0 ? again : Number.NaN;
+}
+
+function parseExpires(record: Record<string, unknown>): number {
+	const expiresAt = record["expires_at"];
+	if (typeof expiresAt === "string" && expiresAt.length > 0) {
+		const parsed = parseTime(expiresAt);
+		if (Number.isFinite(parsed)) return parsed;
+	}
+	if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
+		return expiresAt < 1_000_000_000_000 ? expiresAt * 1000 : expiresAt;
+	}
+	const expires = record["expires"];
+	if (typeof expires === "number" && Number.isFinite(expires) && expires > 0) {
+		return expires < 1_000_000_000_000 ? expires * 1000 : expires;
+	}
+	const expiresIn = record["expires_in"];
+	if (typeof expiresIn === "number" && Number.isFinite(expiresIn) && expiresIn > 0) {
+		return Date.now() + expiresIn * 1000;
+	}
+	return Date.now() + DEFAULT_TOKEN_LIFETIME_MS;
+}
+
+interface Candidate {
+	credential: OAuthCredential;
+	preferred: boolean;
+}
+
+function walk(value: unknown, key: string): Candidate[] {
+	if (Array.isArray(value)) return value.flatMap((item, index) => walk(item, `${key}[${index}]`));
+	if (!isRecord(value)) return [];
+	const access = firstString(value, ["key", "access", "access_token"]);
+	const refresh = firstString(value, ["refresh_token", "refresh"]);
+	if (access !== undefined && refresh !== undefined) {
+		const issuer = firstString(value, ["oidc_issuer", "issuer"]);
+		const preferred = key.includes("auth.x.ai") || (issuer?.includes("auth.x.ai") ?? false);
+		const accountId = firstString(value, ["user_id", "accountId", "principal_id"]);
+		const credential: OAuthCredential = {
+			type: "oauth",
+			access,
+			refresh,
+			expires: parseExpires(value),
+			...(accountId === undefined ? {} : { accountId }),
+		};
+		return [{ credential, preferred }];
+	}
+	return Object.entries(value).flatMap(([child, nested]) => walk(nested, child));
+}
+
+/** Resolve the Grok CLI auth document. */
+export function grokAuthPath(home: string = homedir()): string {
+	return resolve(join(home, ".grok", "auth.json"));
+}
+
+/** Parse a Grok CLI / generic OAuth document into a pi-ai credential. */
+export function parseGrokAuthDocument(text: string, filename: string): OAuthCredential {
+	let value: unknown;
+	try {
+		value = JSON.parse(text);
+	} catch {
+		throw new Error(`grok-build: ${filename} is not valid JSON`);
+	}
+	const candidates = walk(value, "");
+	if (candidates.length === 0) {
+		throw new Error(`grok-build: ${filename} does not contain a Grok OAuth refresh token`);
+	}
+	const chosen = candidates.find((candidate) => candidate.preferred) ?? candidates[0];
+	if (chosen === undefined) {
+		throw new Error(`grok-build: ${filename} does not contain a Grok OAuth refresh token`);
+	}
+	return chosen.credential;
+}
+
+/** Whether ~/.grok/auth.json exists and looks importable. Never returns secrets. */
+export async function probeGrokAuth(filename: string = grokAuthPath()): Promise<GrokImportProbe> {
+	try {
+		await stat(filename);
+		const text = await readFile(filename, "utf8");
+		parseGrokAuthDocument(text, filename);
+		return { available: true, path: filename };
+	} catch (error) {
+		if (isENOENT(error)) return { available: false, path: filename };
+		return { available: false, path: filename };
+	}
+}
+
+/** Copy Grok CLI tokens into the dsh store. Does not write the Grok file. */
+export async function importGrokAuth(
+	store: GrokBuildCredentialStore,
+	filename: string = grokAuthPath(),
+): Promise<OAuthCredential> {
+	let text: string;
+	try {
+		text = await readFile(filename, "utf8");
+	} catch (error) {
+		if (isENOENT(error)) throw new Error(`grok-build: Grok CLI auth file not found at ${filename}`);
+		throw error;
+	}
+	const credential = parseGrokAuthDocument(text, filename);
+	const written = await store.modify(XAI_PI_PROVIDER, async () => credential);
+	if (written === undefined || written.type !== "oauth") {
+		throw new Error("grok-build: failed to persist the imported Grok credential");
+	}
+	return written;
+}

package/src/http-json.ts

@@ -1,82 +1,82 @@
-import type { IncomingMessage } from "node:http";
-
-export const JSON_BODY_LIMIT_BYTES = 64 * 1024;
-
-export class JsonRequestError extends Error {
-	readonly statusCode: 400 | 413;
-
-	constructor(statusCode: 400 | 413, message: string) {
-		super(message);
-		this.name = "JsonRequestError";
-		this.statusCode = statusCode;
-	}
-}
-
-function declaredLength(request: IncomingMessage): number | undefined {
-	const value = request.headers["content-length"];
-	if (typeof value !== "string" || !/^\d+$/u.test(value)) return undefined;
-	const length = Number(value);
-	return Number.isSafeInteger(length) ? length : undefined;
-}
-
-/** Read one JSON request body with a strict in-memory ceiling. */
-export function readJsonRequest(request: IncomingMessage, limit = JSON_BODY_LIMIT_BYTES): Promise<unknown> {
-	const length = declaredLength(request);
-	if (length !== undefined && length > limit) {
-		request.resume();
-		return Promise.reject(new JsonRequestError(413, "request body is too large"));
-	}
-	return new Promise<unknown>((resolve, reject) => {
-		const chunks: Buffer[] = [];
-		let size = 0;
-		let settled = false;
-		const cleanup = (): void => {
-			request.removeListener("data", onData);
-			request.removeListener("end", onEnd);
-			request.removeListener("error", onError);
-			request.removeListener("aborted", onAborted);
-		};
-		const fail = (error: Error): void => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			request.resume();
-			reject(error);
-		};
-		const onData = (value: Buffer | string): void => {
-			if (settled) return;
-			const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
-			size += chunk.byteLength;
-			if (size > limit) {
-				fail(new JsonRequestError(413, "request body is too large"));
-				return;
-			}
-			chunks.push(chunk);
-		};
-		const onEnd = (): void => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			const text = Buffer.concat(chunks, size).toString("utf8").trim();
-			if (text.length === 0) {
-				resolve({});
-				return;
-			}
-			try {
-				resolve(JSON.parse(text) as unknown);
-			} catch {
-				reject(new JsonRequestError(400, "request body must contain valid JSON"));
-			}
-		};
-		const onError = (): void => fail(new JsonRequestError(400, "request body could not be read"));
-		const onAborted = (): void => fail(new JsonRequestError(400, "request body was aborted"));
-		request.on("data", onData);
-		request.once("end", onEnd);
-		request.once("error", onError);
-		request.once("aborted", onAborted);
-	});
-}
-
-export function requestErrorStatus(error: unknown, fallback: number): number {
-	return error instanceof JsonRequestError ? error.statusCode : fallback;
-}
+import type { IncomingMessage } from "node:http";
+
+export const JSON_BODY_LIMIT_BYTES = 64 * 1024;
+
+export class JsonRequestError extends Error {
+	readonly statusCode: 400 | 413;
+
+	constructor(statusCode: 400 | 413, message: string) {
+		super(message);
+		this.name = "JsonRequestError";
+		this.statusCode = statusCode;
+	}
+}
+
+function declaredLength(request: IncomingMessage): number | undefined {
+	const value = request.headers["content-length"];
+	if (typeof value !== "string" || !/^\d+$/u.test(value)) return undefined;
+	const length = Number(value);
+	return Number.isSafeInteger(length) ? length : undefined;
+}
+
+/** Read one JSON request body with a strict in-memory ceiling. */
+export function readJsonRequest(request: IncomingMessage, limit = JSON_BODY_LIMIT_BYTES): Promise<unknown> {
+	const length = declaredLength(request);
+	if (length !== undefined && length > limit) {
+		request.resume();
+		return Promise.reject(new JsonRequestError(413, "request body is too large"));
+	}
+	return new Promise<unknown>((resolve, reject) => {
+		const chunks: Buffer[] = [];
+		let size = 0;
+		let settled = false;
+		const cleanup = (): void => {
+			request.removeListener("data", onData);
+			request.removeListener("end", onEnd);
+			request.removeListener("error", onError);
+			request.removeListener("aborted", onAborted);
+		};
+		const fail = (error: Error): void => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			request.resume();
+			reject(error);
+		};
+		const onData = (value: Buffer | string): void => {
+			if (settled) return;
+			const chunk = Buffer.isBuffer(value) ? value : Buffer.from(value);
+			size += chunk.byteLength;
+			if (size > limit) {
+				fail(new JsonRequestError(413, "request body is too large"));
+				return;
+			}
+			chunks.push(chunk);
+		};
+		const onEnd = (): void => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			const text = Buffer.concat(chunks, size).toString("utf8").trim();
+			if (text.length === 0) {
+				resolve({});
+				return;
+			}
+			try {
+				resolve(JSON.parse(text) as unknown);
+			} catch {
+				reject(new JsonRequestError(400, "request body must contain valid JSON"));
+			}
+		};
+		const onError = (): void => fail(new JsonRequestError(400, "request body could not be read"));
+		const onAborted = (): void => fail(new JsonRequestError(400, "request body was aborted"));
+		request.on("data", onData);
+		request.once("end", onEnd);
+		request.once("error", onError);
+		request.once("aborted", onAborted);
+	});
+}
+
+export function requestErrorStatus(error: unknown, fallback: number): number {
+	return error instanceof JsonRequestError ? error.statusCode : fallback;
+}

package/src/ids.ts

@@ -1,45 +1,59 @@
-/** pi-ai provider ids used by login, refresh, and credential storage. */
-export const XAI_PI_PROVIDER = "xai";
-export const CODEX_PI_PROVIDER = "openai-codex";
-export const KIMI_PI_PROVIDER = "kimi-coding";
-export const CLAUDE_PI_PROVIDER = "anthropic";
-
-/** Harness LLM routes. OAuth aliases avoid the user's API-key route ids. */
-export const GROK_BUILD_ROUTE = "grok-build";
-export const CODEX_OAUTH_ROUTE = "codex-oauth";
-export const CODEX_OAUTH_FAST_ROUTE = "codex-oauth-fast";
-export const KIMI_CODE_OAUTH_ROUTE = "kimi-code-oauth";
-export const CLAUDE_CODE_OAUTH_ROUTE = "claude-code-oauth";
-export const ANTIGRAVITY_ROUTE = "agy";
-
-export const CODING_OAUTH_ROUTES = [
-	GROK_BUILD_ROUTE,
-	CODEX_OAUTH_ROUTE,
-	KIMI_CODE_OAUTH_ROUTE,
-	CLAUDE_CODE_OAUTH_ROUTE,
-] as const;
-
-/** Opt-in routes the adapter can expose; not registered by the default plugin apply(). */
-export const CODING_OAUTH_OPTIONAL_ROUTES = [CODEX_OAUTH_FAST_ROUTE] as const;
-
-export type CodingOAuthRoute = (typeof CODING_OAUTH_ROUTES)[number];
-export type CodingOAuthOptionalRoute = (typeof CODING_OAUTH_OPTIONAL_ROUTES)[number];
-export type CodingOAuthProviderSlug = "grok" | "codex" | "kimi" | "claude";
-
-/** Basenames of private OAuth documents inside the Harness home. */
-export const GROK_BUILD_AUTH_FILENAME = ".grok-build-auth.json";
-export const CODEX_OAUTH_AUTH_FILENAME = ".codex-oauth-auth.json";
-export const KIMI_CODE_OAUTH_AUTH_FILENAME = ".kimi-code-oauth-auth.json";
-export const CLAUDE_CODE_OAUTH_AUTH_FILENAME = ".claude-code-oauth-auth.json";
-
-/** Basenames of model selection/catalog caches inside the Harness home. */
-export const GROK_BUILD_MODELS_CACHE_FILENAME = ".grok-build-models.json";
-export const CODEX_OAUTH_MODELS_CACHE_FILENAME = ".codex-oauth-models.json";
-export const KIMI_CODE_OAUTH_MODELS_CACHE_FILENAME = ".kimi-code-oauth-models.json";
-export const CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME = ".claude-code-oauth-models.json";
-
-/** Fallback model when no live Grok catalog listing is available. */
-export const DEFAULT_GROK_BUILD_MODEL = "grok-4.6";
-
-/** Provider idle ceiling used by every composite route. */
-export const GROK_BUILD_STREAM_IDLE_TIMEOUT_MS = 300_000;
+/** Compatibility facade for stable identifiers owned by dsh-coding-oauth-core. */
+
+export type {
+	CodingOAuthOptionalRoute,
+	CodingOAuthProviderSlug,
+	CodingOAuthRoute,
+} from "dsh-coding-oauth-core";
+export {
+	ANTIGRAVITY_ROUTE,
+	CAPABILITY_SETTINGS_NAMESPACE,
+	CAPABILITY_SETTINGS_PATH,
+	CLAUDE_CODE_OAUTH_AUTH_FILENAME,
+	CLAUDE_CODE_OAUTH_MODELS_CACHE_FILENAME,
+	CLAUDE_CODE_OAUTH_ROUTE,
+	CLAUDE_PI_PROVIDER,
+	CODEX_OAUTH_AUTH_FILENAME,
+	CODEX_OAUTH_FAST_ROUTE,
+	CODEX_OAUTH_MODELS_CACHE_FILENAME,
+	CODEX_OAUTH_ROUTE,
+	CODEX_PI_PROVIDER,
+	CODEX_USAGE_PATH,
+	CODING_OAUTH_LOGIN_CANCEL_PATH,
+	CODING_OAUTH_LOGIN_CODE_PATH,
+	CODING_OAUTH_LOGIN_PATH,
+	CODING_OAUTH_LOGOUT_PATH,
+	CODING_OAUTH_MANAGEMENT_PATHS,
+	CODING_OAUTH_MODELS_PATH,
+	CODING_OAUTH_OPTIONAL_ROUTES,
+	CODING_OAUTH_ROUTES,
+	CODING_OAUTH_STATE_SCHEMA_VERSION,
+	CODING_OAUTH_STATUS_PATH,
+	DEFAULT_GROK_BUILD_MODEL,
+	GATEWAY_KEY_FILENAME,
+	GATEWAY_REVEAL_PATH,
+	GATEWAY_ROTATE_PATH,
+	GATEWAY_SETTINGS_PATH,
+	GROK_BUILD_AUTH_FILENAME,
+	GROK_BUILD_AUTH_IMPORT_PATH,
+	GROK_BUILD_AUTH_LOGIN_CANCEL_PATH,
+	GROK_BUILD_AUTH_LOGIN_CODE_PATH,
+	GROK_BUILD_AUTH_LOGIN_PATH,
+	GROK_BUILD_AUTH_LOGOUT_PATH,
+	GROK_BUILD_AUTH_MODELS_PATH,
+	GROK_BUILD_AUTH_STATUS_PATH,
+	GROK_BUILD_MODELS_CACHE_FILENAME,
+	GROK_BUILD_ROUTE,
+	GROK_BUILD_STREAM_IDLE_TIMEOUT_MS,
+	IMAGINE_CREDENTIAL_STATUS_PATH,
+	IMAGINE_MEDIA_STORE_DIRNAME,
+	KIMI_CODE_OAUTH_AUTH_FILENAME,
+	KIMI_CODE_OAUTH_MODELS_CACHE_FILENAME,
+	KIMI_CODE_OAUTH_ROUTE,
+	KIMI_PI_PROVIDER,
+	OAUTH_IMPORT_CANCEL_PATH,
+	OAUTH_IMPORT_COMMIT_PATH,
+	OAUTH_IMPORT_PREVIEW_PATH,
+	OAUTH_IMPORT_SOURCES_PATH,
+	XAI_PI_PROVIDER,
+} from "dsh-coding-oauth-core";