dsh-coding-subscription-oauth 0.6.4 → 0.7.0

package/src/codex-usage.ts

@@ -1,263 +0,0 @@
-/**
- * Optional ChatGPT Codex quota reader (`GET /backend-api/wham/usage`).
- * Normalizes unknown/malformed optional fields instead of failing the card.
- *
- * Cache semantics:
- * - A successful `read()` stores the projection until `ttlMs` elapses.
- * - Concurrent non-force `read()` calls share one in-flight GET.
- * - `read({ force: true })` always issues a new GET and never joins an
- *   existing in-flight read (forced or not). A later completion of the
- *   abandoned in-flight GET cannot overwrite the forced result.
- * - `clear()` drops the stored projection and detaches any in-flight GET so
- *   its later completion cannot repopulate the cache.
- *
- * @module dsh-coding-subscription-oauth/codex-usage
- */
-
-import { LlmError } from "@deepseek-ai/dsh-llm";
-import {
-	type CodexAuthSession,
-	type CodexFetch,
-	type CodexHttpClient,
-	createCodexHttpClient,
-	isRecord,
-	optionalNonEmptyString,
-} from "./codex-http.ts";
-
-/** Official ChatGPT rate-limit usage endpoint used by the Codex client. */
-export const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
-
-export interface CodexRateLimitWindow {
-	readonly usedPercent: number;
-	readonly remainingPercent: number;
-	readonly windowSeconds: number;
-	readonly resetsAt?: number;
-}
-
-export interface CodexRateLimit {
-	readonly id: string;
-	readonly name?: string;
-	readonly windows: readonly CodexRateLimitWindow[];
-}
-
-export interface CodexCredits {
-	readonly unlimited: boolean;
-	readonly balance?: string;
-}
-
-export interface CodexIndividualLimit {
-	readonly limit: string;
-	readonly used: string;
-	readonly remaining?: string;
-	readonly remainingPercent: number;
-	readonly resetsAt?: number;
-}
-
-export interface CodexUsage {
-	readonly rateLimits: readonly CodexRateLimit[];
-	readonly credits?: CodexCredits;
-	readonly individualLimit?: CodexIndividualLimit;
-	readonly spendControlReached?: boolean;
-	readonly resetCredits?: { readonly availableCount: number };
-	readonly fetchedAt: number;
-}
-
-export interface CodexUsageReaderOptions {
-	readonly auth: CodexAuthSession;
-	readonly http?: CodexHttpClient;
-	readonly fetchImpl?: CodexFetch;
-	readonly originator?: string;
-	readonly userAgent?: string;
-	readonly sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
-	readonly now?: () => number;
-	readonly ttlMs?: number;
-}
-
-export interface CodexUsageReader {
-	read(options?: { force?: boolean; signal?: AbortSignal }): Promise<CodexUsage>;
-	clear(): void;
-}
-
-const DEFAULT_TTL_MS = 60_000;
-
-function finitePercent(value: unknown): number | undefined {
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 100 ? value : undefined;
-}
-
-function positiveInt(value: unknown): number | undefined {
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
-}
-
-function epochSeconds(value: unknown): number | undefined {
-	if (value === undefined || value === null || value === 0) return undefined;
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
-}
-
-function decimalAmount(value: unknown): string | undefined {
-	return typeof value === "string" && value.length > 0 && value.length <= 64 && /^-?\d+(?:\.\d+)?$/u.test(value)
-		? value
-		: undefined;
-}
-
-function parseWindow(value: unknown): CodexRateLimitWindow | undefined {
-	if (!isRecord(value)) return undefined;
-	const usedPercent = finitePercent(value["used_percent"]);
-	const windowSeconds = positiveInt(value["limit_window_seconds"]);
-	if (usedPercent === undefined || windowSeconds === undefined) return undefined;
-	const resetsAt = epochSeconds(value["reset_at"]);
-	return {
-		usedPercent,
-		remainingPercent: 100 - usedPercent,
-		windowSeconds,
-		...(resetsAt === undefined ? {} : { resetsAt }),
-	};
-}
-
-function parseLimit(id: string, name: string | undefined, value: unknown): CodexRateLimit | undefined {
-	if (!isRecord(value)) return undefined;
-	const windows = [parseWindow(value["primary_window"]), parseWindow(value["secondary_window"])].filter(
-		(window): window is CodexRateLimitWindow => window !== undefined,
-	);
-	if (windows.length === 0) return undefined;
-	return { id, ...(name === undefined ? {} : { name }), windows };
-}
-
-function parseCredits(value: unknown): CodexCredits | undefined {
-	if (!isRecord(value) || value["has_credits"] !== true || typeof value["unlimited"] !== "boolean") return undefined;
-	const balance = decimalAmount(value["balance"]);
-	return {
-		unlimited: value["unlimited"],
-		...(balance === undefined ? {} : { balance }),
-	};
-}
-
-function parseIndividualLimit(value: unknown): CodexIndividualLimit | undefined {
-	if (!isRecord(value)) return undefined;
-	const individual = value["individual_limit"];
-	if (!isRecord(individual)) return undefined;
-	const remainingPercent = finitePercent(individual["remaining_percent"]);
-	const limit = decimalAmount(individual["limit"]);
-	const used = decimalAmount(individual["used"]);
-	if (remainingPercent === undefined || limit === undefined || used === undefined) return undefined;
-	const remaining = decimalAmount(individual["remaining"]);
-	const resetsAt = epochSeconds(individual["reset_at"]);
-	return {
-		limit,
-		used,
-		remainingPercent,
-		...(remaining === undefined ? {} : { remaining }),
-		...(resetsAt === undefined ? {} : { resetsAt }),
-	};
-}
-
-function copyUsage(usage: CodexUsage): CodexUsage {
-	return { ...usage, rateLimits: [...usage.rateLimits] };
-}
-
-/**
- * Reduce an opaque `wham/usage` payload to a secret-free quota projection.
- * Unknown extra fields are ignored; malformed optional buckets are skipped.
- */
-export function normalizeCodexUsage(value: unknown, fetchedAt = Date.now()): CodexUsage {
-	if (!isRecord(value)) {
-		throw new LlmError("Codex returned a malformed usage response", "SERVER");
-	}
-	const rateLimits: CodexRateLimit[] = [];
-	const seen = new Set<string>();
-	const add = (limit: CodexRateLimit | undefined): void => {
-		if (limit === undefined || seen.has(limit.id)) return;
-		seen.add(limit.id);
-		rateLimits.push(limit);
-	};
-	add(parseLimit("codex", "Codex", value["rate_limit"]));
-	const additional = value["additional_rate_limits"];
-	if (Array.isArray(additional)) {
-		for (const entry of additional) {
-			if (!isRecord(entry)) continue;
-			const id = optionalNonEmptyString(entry["metered_feature"]);
-			if (id === undefined) continue;
-			const name = optionalNonEmptyString(entry["limit_name"]);
-			add(parseLimit(id, name, entry["rate_limit"]));
-		}
-	}
-	add(parseLimit("code_review", "Code review", value["code_review_rate_limit"]));
-	const credits = parseCredits(value["credits"]);
-	const individualLimit = parseIndividualLimit(value["spend_control"]);
-	const spendControlReached =
-		isRecord(value["spend_control"]) && typeof value["spend_control"]["reached"] === "boolean"
-			? value["spend_control"]["reached"]
-			: undefined;
-	const resetRaw = value["rate_limit_reset_credits"];
-	const resetCount = isRecord(resetRaw) ? resetRaw["available_count"] : undefined;
-	const resetCredits =
-		typeof resetCount === "number" && Number.isSafeInteger(resetCount) && resetCount >= 0
-			? { availableCount: resetCount }
-			: undefined;
-	return {
-		rateLimits,
-		fetchedAt,
-		...(credits === undefined ? {} : { credits }),
-		...(individualLimit === undefined ? {} : { individualLimit }),
-		...(spendControlReached === undefined ? {} : { spendControlReached }),
-		...(resetCredits === undefined ? {} : { resetCredits }),
-	};
-}
-
-/**
- * Cached, injectable usage reader. Failures do not invent quota numbers.
- *
- * See the module doc for `force` / `clear` cache semantics.
- */
-export function createCodexUsageReader(options: CodexUsageReaderOptions): CodexUsageReader {
-	const http =
-		options.http ??
-		createCodexHttpClient({
-			auth: options.auth,
-			...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
-			...(options.originator === undefined ? {} : { originator: options.originator }),
-			...(options.userAgent === undefined ? {} : { userAgent: options.userAgent }),
-			...(options.sleep === undefined ? {} : { sleep: options.sleep }),
-			...(options.now === undefined ? {} : { now: options.now }),
-		});
-	const now = options.now ?? Date.now;
-	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
-	let cached: CodexUsage | undefined;
-	let inFlight: Promise<CodexUsage> | undefined;
-	let epoch = 0;
-
-	const load = async (signal?: AbortSignal): Promise<CodexUsage> => {
-		const payload = await http.requestJson({
-			url: CODEX_USAGE_URL,
-			method: "GET",
-			headers: { "cache-control": "no-store" },
-			...(signal === undefined ? {} : { signal }),
-		});
-		return normalizeCodexUsage(payload, now());
-	};
-
-	return {
-		read({ force = false, signal } = {}) {
-			if (!force && cached !== undefined && now() - cached.fetchedAt < ttlMs) {
-				return Promise.resolve(copyUsage(cached));
-			}
-			if (!force && inFlight !== undefined) return inFlight;
-			if (force) epoch += 1;
-			const started = epoch;
-			const current = load(signal)
-				.then((value) => {
-					if (started === epoch) cached = value;
-					return value;
-				})
-				.finally(() => {
-					if (inFlight === current) inFlight = undefined;
-				});
-			inFlight = current;
-			return current;
-		},
-		clear() {
-			epoch += 1;
-			cached = undefined;
-			inFlight = undefined;
-		},
-	};
-}

package/src/compatibility.ts

@@ -1,55 +0,0 @@
-/** Stable compatibility contracts for standalone and future co-installation. */
-
-import type { DshHostCapability, OwnerAccessMode } from "dsh-coding-oauth-core";
-
-export interface DshCompatibilityDiagnostic {
-	readonly id: string;
-	readonly component: "host" | "client" | "owner-request" | "runtime";
-	readonly level: "info" | "warning" | "error";
-	readonly message: string;
-	readonly expected?: string;
-	readonly actual?: string;
-}
-
-export interface CodingOAuthParticipantDiagnosticSource {
-	readonly participantId: "coding-subscription-oauth";
-	diagnostics(): readonly DshCompatibilityDiagnostic[];
-}
-
-export interface DshCompatibility {
-	readonly coreAbi: string;
-	readonly dshVersion: string | null;
-	readonly status: "healthy" | "degraded" | "incompatible";
-	readonly uiOwner: "hub" | "standalone" | null;
-	readonly accessMode: OwnerAccessMode;
-	readonly capabilities: Readonly<Record<string, DshHostCapability>>;
-	readonly diagnostics: readonly string[];
-}
-
-export const DSH_EXACT_BOM = Object.freeze({
-	"@deepseek-ai/cordis": "4.0.1",
-	"@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
-	"@deepseek-ai/dsh-tools": "0.1.1-rc.2",
-	"@deepseek-ai/schemastery": "3.18.1",
-	"@earendil-works/pi-ai": "0.84.2",
-	react: "18.3.1",
-	"react-dom": "18.3.1",
-} as const);
-
-export function incompatibleDiagnostics(
-	diagnostics: readonly DshCompatibilityDiagnostic[],
-): DshCompatibilityDiagnostic[] {
-	return diagnostics.filter((diagnostic) => diagnostic.level === "error");
-}

package/src/dsh-host-adapter.ts

@@ -1,173 +0,0 @@
-/** Narrow adapter around the DSH host API used by the standalone participant. */
-
-import { createRequire } from "node:module";
-import type { Context } from "@deepseek-ai/cordis";
-import {
-	CODING_OAUTH_CORE_ABI,
-	type DshHostCapability,
-	type OwnerAccessMode,
-	resolveCodingOAuthScope,
-} from "dsh-coding-oauth-core";
-import type {
-	CodingOAuthParticipantDiagnosticSource,
-	DshCompatibility,
-	DshCompatibilityDiagnostic,
-} from "./compatibility.ts";
-import { incompatibleDiagnostics } from "./compatibility.ts";
-import type { OwnerRequestPolicy } from "./web-origin.ts";
-
-const require = createRequire(import.meta.url);
-
-export interface DshHostAdapter extends CodingOAuthParticipantDiagnosticSource {
-	readonly context: Context;
-	scope(): object;
-	ownerRequestPolicy(): OwnerRequestPolicy | undefined;
-	compatibility(options?: {
-		readonly accessMode?: OwnerAccessMode;
-		readonly uiOwner?: "hub" | "standalone" | null;
-		readonly diagnostics?: readonly DshCompatibilityDiagnostic[];
-	}): DshCompatibility;
-	assertCompatible(): void;
-}
-
-interface CompatibilityOptions {
-	readonly accessMode?: OwnerAccessMode;
-	readonly uiOwner?: "hub" | "standalone" | null;
-	readonly diagnostics?: readonly DshCompatibilityDiagnostic[];
-}
-
-function record(value: unknown): Record<string, unknown> | undefined {
-	return value !== null && (typeof value === "object" || typeof value === "function")
-		? (value as Record<string, unknown>)
-		: undefined;
-}
-
-function service(context: Context, name: string): unknown {
-	try {
-		const value = context.get(name);
-		if (value !== undefined && value !== null) return value;
-	} catch {}
-	try {
-		return record(context)?.[name];
-	} catch {
-		return undefined;
-	}
-}
-
-function capability(value: unknown, contract: string, methods: readonly string[]): DshHostCapability {
-	if (value === undefined || value === null) return { state: "missing", contract };
-	const candidate = record(value);
-	if (candidate === undefined || methods.some((method) => typeof candidate[method] !== "function")) {
-		return { state: "incompatible", contract, reason: "service shape does not match the verified contract" };
-	}
-	return { state: "available", contract };
-}
-
-function asOwnerRequestPolicy(value: unknown): OwnerRequestPolicy | undefined {
-	const candidate = record(value);
-	return candidate !== undefined &&
-		typeof candidate["authorize"] === "function" &&
-		typeof candidate["diagnostics"] === "function"
-		? (value as OwnerRequestPolicy)
-		: undefined;
-}
-
-function dshVersion(): string | null {
-	try {
-		const manifest = require("@deepseek-ai/dsh/package.json") as { version?: unknown };
-		return typeof manifest.version === "string" ? manifest.version : null;
-	} catch {
-		return null;
-	}
-}
-
-export function createDshHostAdapter(context: Context): DshHostAdapter {
-	const candidate = context as unknown as Record<string, unknown>;
-	const diagnostics: DshCompatibilityDiagnostic[] = [];
-	for (const method of ["effect", "inject", "get", "logger"] as const) {
-		if (typeof candidate[method] !== "function") {
-			diagnostics.push({
-				id: `host.api.${method}`,
-				component: "host",
-				level: "error",
-				message: `DSH host Context.${method} is unavailable`,
-				expected: "function",
-				actual: typeof candidate[method],
-			});
-		}
-	}
-	const llm = record(service(context, "llm"));
-	if (llm === undefined || typeof llm["registerAdapter"] !== "function") {
-		diagnostics.push({
-			id: "host.api.llm.registerAdapter",
-			component: "host",
-			// OAuth account management and its same-origin routes stay usable while
-			// Cordis is waiting for the optional LLM registry. The LLM child fiber
-			// still treats this as a hard activation requirement before it registers
-			// adapters.
-			level: "warning",
-			message: "DSH host LLM adapter registry is unavailable",
-			expected: "function",
-			actual: typeof llm?.["registerAdapter"],
-		});
-	}
-	const frozenDiagnostics = Object.freeze([...diagnostics]);
-
-	return Object.freeze({
-		participantId: "coding-subscription-oauth" as const,
-		context,
-		scope: () => resolveCodingOAuthScope(context),
-		ownerRequestPolicy: () => asOwnerRequestPolicy(service(context, "ownerRequestPolicy")),
-		diagnostics: () => frozenDiagnostics,
-		compatibility(options: CompatibilityOptions = {}) {
-			const capabilities: Readonly<Record<string, DshHostCapability>> = {
-				webServer: capability(service(context, "webServer"), "exact-route-v1", ["register"]),
-				settings: capability(service(context, "settings"), "settings-register-v1", ["register"]),
-				credentials: capability(service(context, "credentials"), "credential-resolver-v1", ["resolve"]),
-				llm: capability(service(context, "llm"), "llm-adapter-registry-v1", ["registerAdapter"]),
-				ownerRequestPolicy: capability(service(context, "ownerRequestPolicy"), "owner-request-policy-v1", [
-					"authorize",
-					"diagnostics",
-				]),
-			};
-			const capabilityDiagnostics: DshCompatibilityDiagnostic[] = Object.entries(capabilities).flatMap(([id, value]) =>
-				typeof value === "object" && value !== null && "state" in value && value.state !== "available"
-					? [
-							{
-								id: `host.capability.${id}`,
-								component: "host" as const,
-								level: value.state === "incompatible" ? ("error" as const) : ("warning" as const),
-								message: `${id} is ${value.state}`,
-							},
-						]
-					: [],
-			);
-			const merged = Object.freeze([...frozenDiagnostics, ...capabilityDiagnostics, ...(options.diagnostics ?? [])]);
-			const status: DshCompatibility["status"] = merged.some(
-				(item: DshCompatibilityDiagnostic) => item.level === "error",
-			)
-				? "incompatible"
-				: merged.some((item: DshCompatibilityDiagnostic) => item.level === "warning")
-					? "degraded"
-					: "healthy";
-			return {
-				coreAbi: CODING_OAUTH_CORE_ABI,
-				dshVersion: dshVersion(),
-				status,
-				uiOwner: options.uiOwner ?? "standalone",
-				accessMode: options.accessMode ?? "loopback",
-				capabilities,
-				diagnostics: merged.map((item: DshCompatibilityDiagnostic) => `${item.id}: ${item.message}`),
-			};
-		},
-		assertCompatible() {
-			const incompatible = [
-				...incompatibleDiagnostics(diagnostics),
-				...diagnostics.filter((item) => item.id === "host.api.llm.registerAdapter"),
-			];
-			if (incompatible.length > 0) {
-				throw new Error(`incompatible DSH host API: ${incompatible.map((item) => item.id).join(", ")}`);
-			}
-		},
-	});
-}

package/src/gateway-anthropic-messages.ts

@@ -1,84 +0,0 @@
-/**
- * Anthropic Messages API subset for the local gateway.
- * @module dsh-coding-subscription-oauth/gateway-anthropic-messages
- */
-
-import type { IncomingMessage, ServerResponse } from "node:http";
-import { type GatewayBackend, gatewayErrorEnvelope } from "./gateway-backend.ts";
-import { beginGatewaySse, readGatewayJsonBody, writeGatewayJson } from "./gateway-body.ts";
-import { anthropicMaxTokens, parseAnthropicMessagesRequest } from "./gateway-parse.ts";
-
-export async function handleAnthropicMessages(
-	req: IncomingMessage,
-	res: ServerResponse,
-	backend: GatewayBackend,
-): Promise<void> {
-	const payload = await readGatewayJsonBody(req);
-	const request = parseAnthropicMessagesRequest(payload);
-	const maxTokens = anthropicMaxTokens(payload);
-	const stream = payload["stream"] === true;
-	const id = `msg_gateway_${Date.now().toString(36)}`;
-	if (!stream) {
-		let text = "";
-		const toolUses: Array<{ id: string; name: string; input: unknown }> = [];
-		let stop = "end_turn";
-		for await (const part of backend.stream(request)) {
-			if (part.type === "text") text += part.text;
-			if (part.type === "tool_call") {
-				let input: unknown = {};
-				try {
-					input = JSON.parse(part.arguments) as unknown;
-				} catch {
-					input = { value: part.arguments };
-				}
-				toolUses.push({ id: part.id, name: part.name, input });
-			}
-			if (part.type === "done" && part.finish === "tool_calls") stop = "tool_use";
-		}
-		writeGatewayJson(res, 200, {
-			id,
-			type: "message",
-			role: "assistant",
-			model: request.model,
-			content: [
-				...(text.length === 0 ? [] : [{ type: "text", text }]),
-				...toolUses.map((tool) => ({ type: "tool_use", id: tool.id, name: tool.name, input: tool.input })),
-			],
-			stop_reason: stop,
-			usage: { input_tokens: 0, output_tokens: 0 },
-			max_tokens: maxTokens,
-		});
-		return;
-	}
-	beginGatewaySse(res);
-	try {
-		res.write(
-			`event: message_start\ndata: ${JSON.stringify({ type: "message_start", message: { id, type: "message", role: "assistant", model: request.model, content: [] } })}\n\n`,
-		);
-		let started = false;
-		for await (const part of backend.stream(request)) {
-			if (part.type === "text") {
-				if (!started) {
-					res.write(
-						`event: content_block_start\ndata: ${JSON.stringify({ type: "content_block_start", index: 0, content_block: { type: "text", text: "" } })}\n\n`,
-					);
-					started = true;
-				}
-				res.write(
-					`event: content_block_delta\ndata: ${JSON.stringify({ type: "content_block_delta", index: 0, delta: { type: "text_delta", text: part.text } })}\n\n`,
-				);
-			}
-		}
-		if (started) {
-			res.write(`event: content_block_stop\ndata: ${JSON.stringify({ type: "content_block_stop", index: 0 })}\n\n`);
-		}
-		res.write(
-			`event: message_delta\ndata: ${JSON.stringify({ type: "message_delta", delta: { stop_reason: "end_turn" } })}\n\n`,
-		);
-		res.write(`event: message_stop\ndata: ${JSON.stringify({ type: "message_stop" })}\n\n`);
-		res.end();
-	} catch (error) {
-		res.write(`event: error\ndata: ${JSON.stringify(gatewayErrorEnvelope(error).body)}\n\n`);
-		res.end();
-	}
-}

package/src/gateway-auth.ts

@@ -1,102 +0,0 @@
-/**
- * Owner-only gateway API key file.
- * @module dsh-coding-subscription-oauth/gateway-auth
- */
-
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { mkdir } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { GATEWAY_KEY_FILENAME } from "./ids.ts";
-import { OAuthSourceError, readHardenedOAuthSourceFile } from "./oauth-sources.ts";
-
-export { GATEWAY_KEY_FILENAME } from "./ids.ts";
-
-const KEY_FORMAT_VERSION = 1;
-
-export interface GatewayKeyDocument {
-	version: typeof KEY_FORMAT_VERSION;
-	apiKey: string;
-	enabled?: boolean;
-	port?: number;
-}
-
-export function gatewayKeyPath(dshHome?: string): string {
-	return resolve(join(resolveDshHome(dshHome), GATEWAY_KEY_FILENAME));
-}
-
-export function generateGatewayApiKey(): string {
-	return randomBytes(32).toString("base64url");
-}
-
-export function gatewayKeysEqual(left: string, right: string): boolean {
-	const a = Buffer.from(left);
-	const b = Buffer.from(right);
-	return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
-}
-
-export function maskGatewayApiKey(apiKey: string): string {
-	if (apiKey.length <= 4) return "****";
-	return `****${apiKey.slice(-4)}`;
-}
-
-export async function loadGatewayKeyDocument(path: string): Promise<GatewayKeyDocument | undefined> {
-	try {
-		const text = (await readHardenedOAuthSourceFile(path)).text;
-		const value = JSON.parse(text) as unknown;
-		if (typeof value !== "object" || value === null || Array.isArray(value)) {
-			throw new Error("gateway key file must contain an object");
-		}
-		const document = value as Record<string, unknown>;
-		if (
-			document["version"] !== KEY_FORMAT_VERSION ||
-			typeof document["apiKey"] !== "string" ||
-			document["apiKey"].length === 0
-		) {
-			throw new Error("gateway key file is invalid");
-		}
-		const port = document["port"];
-		return {
-			version: KEY_FORMAT_VERSION,
-			apiKey: document["apiKey"],
-			...(typeof document["enabled"] === "boolean" ? { enabled: document["enabled"] } : {}),
-			...(typeof port === "number" && Number.isSafeInteger(port) && port >= 1024 && port <= 65_535 ? { port } : {}),
-		};
-	} catch (error) {
-		if (error instanceof OAuthSourceError && error.code === "not_found") return undefined;
-		throw error;
-	}
-}
-
-export async function loadOrCreateGatewayApiKey(path: string, configured?: string): Promise<string> {
-	const existing = await loadGatewayKeyDocument(path);
-	if (configured !== undefined) {
-		await persistGatewayKeyDocument(path, {
-			version: KEY_FORMAT_VERSION,
-			apiKey: configured,
-			...(existing?.enabled === undefined ? {} : { enabled: existing.enabled }),
-			...(existing?.port === undefined ? {} : { port: existing.port }),
-		});
-		return configured;
-	}
-	if (existing !== undefined) return existing.apiKey;
-	const created = generateGatewayApiKey();
-	await persistGatewayKeyDocument(path, { version: KEY_FORMAT_VERSION, apiKey: created });
-	return created;
-}
-
-export async function persistGatewayApiKey(path: string, apiKey: string): Promise<void> {
-	const existing = await loadGatewayKeyDocument(path);
-	await persistGatewayKeyDocument(path, {
-		version: KEY_FORMAT_VERSION,
-		apiKey,
-		...(existing?.enabled === undefined ? {} : { enabled: existing.enabled }),
-		...(existing?.port === undefined ? {} : { port: existing.port }),
-	});
-}
-
-export async function persistGatewayKeyDocument(path: string, document: GatewayKeyDocument): Promise<void> {
-	await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-	await writeFileAtomic(path, `${JSON.stringify(document)}\n`, { mode: 0o600 });
-}