dsh-coding-subscription-oauth 0.6.5 → 0.7.0

package/lib/kimi-errors.d.ts

@@ -1,3 +1,3 @@
-/** Compatibility facade — implementation lives in `src/runtime/` (mirrored from Hub vendor core). */
-export { isMisclassifiedContextWindowError, remapAuthFailureIfContextOverflow, } from "./runtime/kimi-errors.js";
+/** Compatibility facade — implementation lives in published `dsh-coding-oauth-core`. */
+export { isMisclassifiedContextWindowError, remapAuthFailureIfContextOverflow, } from "dsh-coding-oauth-core/kimi-errors";
 //# sourceMappingURL=kimi-errors.d.ts.map

package/lib/kimi-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../src/kimi-errors.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAErG,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../src/kimi-errors.ts"],"names":[],"mappings":"AAAA,wFAAwF;AAExF,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,mCAAmC,CAAC"}

package/lib/oauth-session.d.ts

@@ -33,6 +33,8 @@ export declare class OAuthProviderSession {
      * Called after an upstream 401 rejected a locally-valid token.
      */
     invalidateAccessToken(): Promise<void>;
+    /** Refresh host discovery after an account switch/remove without a full logout. */
+    notifyCredentialChange(): void;
     storedCredential(): Promise<OAuthCredential | undefined>;
     logout(): Promise<void>;
     private writeCache;

package/lib/oauth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../../src/oauth-session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EACX,GAAG,EACH,eAAe,EACf,UAAU,EACV,KAAK,EACL,aAAa,EACb,eAAe,EACf,QAAQ,EACR,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAuB,MAAM,YAAY,CAAC;AAgC3E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAoB;IAQ/B,QAAQ,CAAC,UAAU,EAAE,uBAAuB;IAP7C,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,WAAW,CAAuB;gBAGhC,UAAU,EAAE,uBAAuB,EAC5C,eAAe,CAAC,EAAE,MAAM,IAAI,EAC5B,KAAK,GAAE,wBAIN,EACD,SAAS,GAAE,MAA6D;IAWzE,OAAO,CAAC,eAAe,CAA2B;IAElD,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAI/B,gBAAgB,IAAI,MAAM,EAAE,GAAG,SAAS;IAIxC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAS7B,QAAQ,IAAI,QAAQ;IAId,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQjC,iBAAiB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAMtC,KAAK,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOvD;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,gBAAgB,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAKxD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAaf,UAAU;CAWxB"}
+{"version":3,"file":"oauth-session.d.ts","sourceRoot":"","sources":["../../src/oauth-session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EACX,GAAG,EACH,eAAe,EACf,UAAU,EACV,KAAK,EACL,aAAa,EACb,eAAe,EACf,QAAQ,EACR,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAuB,MAAM,YAAY,CAAC;AAgC3E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,MAAM,WAAW,mBAAmB;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,oBAAoB;IAQ/B,QAAQ,CAAC,UAAU,EAAE,uBAAuB;IAP7C,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,WAAW,CAAuB;gBAGhC,UAAU,EAAE,uBAAuB,EAC5C,eAAe,CAAC,EAAE,MAAM,IAAI,EAC5B,KAAK,GAAE,wBAIN,EACD,SAAS,GAAE,MAA6D;IAWzE,OAAO,CAAC,eAAe,CAA2B;IAElD,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAI/B,gBAAgB,IAAI,MAAM,EAAE,GAAG,SAAS;IAIxC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAS7B,QAAQ,IAAI,QAAQ;IAId,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQjC,iBAAiB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD,MAAM,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAMtC,KAAK,CAAC,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOvD;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5C,mFAAmF;IACnF,sBAAsB,IAAI,IAAI;IAIxB,gBAAgB,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAKxD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAaf,UAAU;CAWxB"}

package/lib/session.d.ts

@@ -34,6 +34,8 @@ export declare class GrokBuildSession {
      * Called after an upstream 401 rejected a locally-valid token.
      */
     invalidateAccessToken(): Promise<void>;
+    /** Refresh host discovery after an account switch/remove without a full logout. */
+    notifyCredentialChange(): void;
     logout(): Promise<void>;
     private writeCache;
 }

package/lib/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EACN,KAAK,aAAa,EAKlB,MAAM,cAAc,CAAC;AAItB,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAsDtD,4EAA4E;AAC5E,qBAAa,gBAAgB;IAC5B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwB;IACxD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,UAAU,CAA6C;IAC/D,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,eAAe,CAA2B;gBAEtC,KAAK,GAAE,wBAAyD,EAAE,eAAe,CAAC,EAAE,MAAM,IAAI;IAW1G,4DAA4D;IAC5D,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,IAAI,aAAa,IAAI,aAAa,CAEjC;IAED,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAI/B,gBAAgB,IAAI,MAAM,EAAE,GAAG,SAAS;IAIxC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAO7B,kFAAkF;IAClF,QAAQ,IAAI,QAAQ;IASd,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBvD,iBAAiB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAiBf,UAAU;CAaxB"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAGjF,OAAO,EACN,KAAK,aAAa,EAKlB,MAAM,cAAc,CAAC;AAItB,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAsDtD,4EAA4E;AAC5E,qBAAa,gBAAgB;IAC5B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwB;IACxD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,UAAU,CAA6C;IAC/D,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,eAAe,CAA2B;gBAEtC,KAAK,GAAE,wBAAyD,EAAE,eAAe,CAAC,EAAE,MAAM,IAAI;IAW1G,4DAA4D;IAC5D,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAErC;IAED,IAAI,aAAa,IAAI,aAAa,CAEjC;IAED,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAI/B,gBAAgB,IAAI,MAAM,EAAE,GAAG,SAAS;IAIxC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE;IAO7B,kFAAkF;IAClF,QAAQ,IAAI,QAAQ;IASd,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAelC,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBvD,iBAAiB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D;;;OAGG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5C,mFAAmF;IACnF,sBAAsB,IAAI,IAAI;IAIxB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAiBf,UAAU;CAaxB"}

package/lib/store.d.ts

@@ -2,7 +2,43 @@
  * Owner-only persistent OAuth credential storage for coding-subscription routes.
  * @module dsh-coding-subscription-oauth/store
  */
-import type { Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+import type { Credential, CredentialInfo, CredentialStore, OAuthCredential } from "@earendil-works/pi-ai";
+/** On-disk multi-account format. Readers still accept v1 and migrate under lock. */
+declare const AUTH_FORMAT_VERSION: 2;
+/** Operator-owned account hard cap (Settings + store). Aligned with Hub. */
+export declare const OAUTH_MAX_ACCOUNTS = 8;
+/** How a login or import writes into the multi-account document. */
+export type LoginPersistMode = "add" | "overwrite-active";
+export interface LoginPersistOptions {
+    mode: LoginPersistMode;
+    confirmOverwrite?: boolean;
+}
+/** Non-empty account id; max 128; restricted charset for path-safe operator labels. */
+export type AccountId = string;
+export interface AccountRecord {
+    id: AccountId;
+    label?: string;
+    credential: OAuthCredential;
+    createdAt: number;
+}
+export interface AuthDocumentV2 {
+    version: typeof AUTH_FORMAT_VERSION;
+    activeAccountId: AccountId;
+    accounts: AccountRecord[];
+}
+/** Non-secret row for Settings account lists. Never includes tokens. */
+export interface AccountSummary {
+    id: AccountId;
+    label?: string;
+    expires: number;
+    accountId?: string;
+}
+export declare function isValidAccountId(value: unknown): value is AccountId;
+/**
+ * Prefer provider `credential.accountId` when path-safe; otherwise mint a unique
+ * operator id so multiple anonymous logins do not collide on `legacy`.
+ */
+export declare function resolveAccountIdForCredential(credential: OAuthCredential): AccountId;
 /** Resolve one private OAuth document path beneath DSH_HOME. */
 export declare function oauthCredentialPath(basename: string, dshHome?: string): string;
 /** Resolve the legacy Grok Build OAuth document path. */
@@ -10,11 +46,14 @@ export declare function grokBuildAuthPath(dshHome?: string): string;
 /**
  * File-backed pi-ai store scoped to exactly one provider id. Separate provider
  * files prevent one corrupted or rotated credential from affecting another.
+ * On disk the file may hold up to eight operator-owned accounts; CredentialStore
+ * methods always project the active account only.
  */
 export declare class OAuthCredentialFileStore implements CredentialStore {
     readonly providerId: string;
     private readonly label;
     readonly filename: string;
+    private loginPersist;
     constructor(providerId: string, filename: string, label: string);
     private readCurrent;
     /**
@@ -23,11 +62,22 @@ export declare class OAuthCredentialFileStore implements CredentialStore {
      * Unsafe/symlink/wrong-owner/too-large files still throw.
      */
     private loadCurrent;
+    private loadDocument;
     /** Refuse a dest that became unsafe after the lock was taken and before rename. */
     private assertDestinationReplaceable;
+    private writeDocument;
+    private nextDocumentAfterLogin;
+    private mutateDocument;
     read(providerId: string): Promise<Credential | undefined>;
     list(): Promise<readonly CredentialInfo[]>;
     modify(providerId: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+    /**
+     * Redirect `modify` writes (pi-ai `models.login`) through multi-account upsert
+     * semantics for the duration of `fn`.
+     */
+    runLoginPersist<T>(options: LoginPersistOptions, fn: () => Promise<T>): Promise<T>;
+    /** Persist a login/import credential without going through pi-ai `modify`. */
+    persistLoginCredential(credential: OAuthCredential, options: LoginPersistOptions): Promise<void>;
     /**
      * Force the next `getAuth()` to refresh by backdating `expires` into the past.
      * Used after an upstream 401: the stored access token was rejected even though
@@ -38,9 +88,31 @@ export declare class OAuthCredentialFileStore implements CredentialStore {
      */
     invalidate(providerId: string): Promise<boolean>;
     delete(providerId: string): Promise<void>;
+    /** Read-only account list for Settings / API. Never includes tokens. */
+    listAccounts(): Promise<readonly AccountSummary[]>;
+    getActiveAccountId(): Promise<string | undefined>;
+    /**
+     * Read one account's credential without changing activeAccountId.
+     * Used by the optional quota-aware pool proxy for sticky per-request routing.
+     */
+    readAccount(id: string): Promise<OAuthCredential | undefined>;
+    /**
+     * Serialized refresh/write for one account id. Does not move activeAccountId.
+     * Returns undefined when the account is absent (caller treats as missing credential).
+     */
+    modifyAccount(id: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+    setActiveAccount(id: string): Promise<void>;
+    upsertAccount(input: {
+        id: string;
+        label?: string;
+        credential: OAuthCredential;
+        makeActive?: boolean;
+    }): Promise<void>;
+    removeAccount(id: string): Promise<void>;
 }
 /** Legacy-named store retained for existing imports and credential migration. */
 export declare class GrokBuildCredentialStore extends OAuthCredentialFileStore {
     constructor(filename?: string);
 }
+export {};
 //# sourceMappingURL=store.d.ts.map

package/lib/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAmB,MAAM,uBAAuB,CAAC;AAgE1G,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAW9E;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,qBAAa,wBAAyB,YAAW,eAAe;IAI9D,QAAQ,CAAC,UAAU,EAAE,MAAM;IAE3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IALvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAGhB,UAAU,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,EACC,KAAK,EAAE,MAAM;YAKjB,WAAW;IAIzB;;;;OAIG;YACW,WAAW;IAmBzB,mFAAmF;YACrE,4BAA4B;IAYpC,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAIzD,IAAI,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAI1C,MAAM,CACX,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GACtE,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA0BlC;;;;;;;OAOG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK/C;AAED,iFAAiF;AACjF,qBAAa,wBAAyB,SAAQ,wBAAwB;gBACzD,QAAQ,GAAE,MAA4B;CAGlD"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI1G,oFAAoF;AACpF,QAAA,MAAM,mBAAmB,EAAG,CAAU,CAAC;AAEvC,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAMpC,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,kBAAkB,CAAC;AAE1D,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,mBAAmB,CAAC;IACpC,eAAe,EAAE,SAAS,CAAC;IAC3B,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAEnE;AAuJD;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,eAAe,GAAG,SAAS,CAIpF;AAqDD,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAW9E;AAED,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,YAAW,eAAe;IAK9D,QAAQ,CAAC,UAAU,EAAE,MAAM;IAE3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IANvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,YAAY,CAAkC;gBAG5C,UAAU,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,EACC,KAAK,EAAE,MAAM;YAKjB,WAAW;IAIzB;;;;OAIG;YACW,WAAW;YAKX,YAAY;IA0B1B,mFAAmF;YACrE,4BAA4B;YAY5B,aAAa;IAU3B,OAAO,CAAC,sBAAsB;YAyDhB,cAAc;IA2BtB,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAIzD,IAAI,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAI1C,MAAM,CACX,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GACtE,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAoBlC;;;OAGG;IACG,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAYxF,8EAA8E;IACxE,sBAAsB,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtG;;;;;;;OAOG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWhD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,wEAAwE;IAClE,YAAY,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IASlD,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAQvD;;;OAGG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAUnE;;;OAGG;IACG,aAAa,CAClB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GACtE,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAiC5B,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB3C,aAAa,CAAC,KAAK,EAAE;QAC1B,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,eAAe,CAAC;QAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2DX,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAmB9C;AAED,iFAAiF;AACjF,qBAAa,wBAAyB,SAAQ,wBAAwB;gBACzD,QAAQ,GAAE,MAA4B;CAGlD"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-coding-subscription-oauth",
   "description": "DeepSeek Harness coding-subscription OAuth: SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code, Claude Code. Fixes AUTH API key is invalid, INVALID_REPLAY_STATE, grok-4.6 xhigh, Kimi Bearer vs x-api-key.",
-  "version": "0.6.5",
+  "version": "0.7.0",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -42,7 +42,7 @@
   "scripts": {
     "check:bom": "node build/verify-dsh-bom.mjs",
     "assert:node": "node scripts/assert-node.mjs",
-    "assert:runtime-slice": "node scripts/assert-runtime-slice-sync.mjs",
+    "assert:oauth-core": "node scripts/assert-oauth-core.mjs",
     "clean": "node build/clean.mjs",
     "typecheck": "tsc -b tsconfig.host.json tsconfig.client.json",
     "build:server": "tsc -p tsconfig.build.json && tsc -p tsconfig.dts-bin.json && node build/build-server.mjs",
@@ -53,8 +53,8 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "lint": "biome check",
-    "check:next": "pnpm run assert:node && pnpm run assert:runtime-slice && pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
-    "check": "pnpm run assert:node && pnpm run assert:runtime-slice && pnpm run lint && pnpm run release:build && pnpm run test",
+    "check:next": "pnpm run assert:node && pnpm run assert:oauth-core && pnpm run check:bom && pnpm run lint && pnpm run typecheck && pnpm run test",
+    "check": "pnpm run assert:node && pnpm run assert:oauth-core && pnpm run lint && pnpm run release:build && pnpm run test",
     "release:promote": "node build/promote-release.mjs",
     "release:verify": "node build/verify-release.mjs",
     "release:build": "pnpm run build:artifacts && pnpm run release:promote",
@@ -64,6 +64,7 @@
     "release:publish": "node scripts/release-publish.mjs",
     "verify:deployed": "node scripts/verify-deployed-catalog.mjs",
     "smoke:deployed": "node scripts/smoke-deployed-routes.mjs",
+    "smoke:dsh-alpha": "node scripts/smoke-dsh-alpha.mjs",
     "prepack": "pnpm run release:build"
   },
   "exports": {
@@ -117,7 +118,6 @@
         "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
         "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
         "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-        "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
         "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
         "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
         "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
@@ -139,7 +139,6 @@
     },
     "client": {
       "inject": [
-        "@deepseek-ai/dsh-client-runtime",
         "@deepseek-ai/dsh-client-ui-settings",
         "@deepseek-ai/dsh-client-locale"
       ],
@@ -147,7 +146,7 @@
     }
   },
   "dependencies": {
-    "dsh-coding-oauth-core": "0.1.1",
+    "dsh-coding-oauth-core": "0.1.2",
     "undici": "7.29.0"
   },
   "peerDependencies": {
@@ -198,7 +197,6 @@
     "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
     "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",

package/lib/runtime/gateway-protocol.d.ts

@@ -1,47 +0,0 @@
-/**
- * Shared request/stream types for the local coding-subscription gateway.
- * @module dsh-coding-oauth-core/gateway-protocol
- */
-export interface GatewayToolCall {
-    id: string;
-    name: string;
-    arguments: string;
-}
-export interface GatewayTool {
-    name: string;
-    description: string;
-    parameters: Record<string, unknown>;
-}
-export interface GatewayChatMessage {
-    role: string;
-    content: string;
-    tool_calls?: readonly GatewayToolCall[];
-    reasoning_content?: string;
-    tool_call_id?: string;
-    tool_name?: string;
-}
-export interface GatewayCompletionRequest {
-    model: string;
-    messages: readonly GatewayChatMessage[];
-    tools?: readonly GatewayTool[];
-    reasoning?: string;
-}
-export type GatewayStreamPart = {
-    type: "text";
-    text: string;
-} | {
-    type: "thinking";
-    text: string;
-} | {
-    type: "tool_call";
-    index: number;
-    id: string;
-    name: string;
-    arguments: string;
-} | {
-    type: "done";
-    finish: "stop" | "tool_calls" | "length";
-};
-export type GatewayThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
-export declare function isThinkingLevel(value: string): value is GatewayThinkingLevel;
-//# sourceMappingURL=gateway-protocol.d.ts.map

package/lib/runtime/gateway-protocol.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"gateway-protocol.d.ts","sourceRoot":"","sources":["../../../src/runtime/gateway-protocol.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAEnG,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAU5E"}

package/lib/runtime/grok-errors.d.ts

@@ -1,13 +0,0 @@
-/**
- * xAI / Grok Build error remapping shared by Hub and Subscription.
- * @module dsh-coding-oauth-core/grok-errors
- */
-export declare function isXaiCapacityError(detail: string): boolean;
-export declare function remapXaiCapacityFailure(failure: {
-    message: string;
-    code: string;
-}): {
-    message: string;
-    code: string;
-};
-//# sourceMappingURL=grok-errors.d.ts.map

package/lib/runtime/grok-errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"grok-errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/grok-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACb,CAGA"}

package/lib/runtime/http-json.d.ts

@@ -1,10 +0,0 @@
-import type { IncomingMessage } from "node:http";
-export declare const JSON_BODY_LIMIT_BYTES: number;
-export declare class JsonRequestError extends Error {
-    readonly statusCode: 400 | 413;
-    constructor(statusCode: 400 | 413, message: string);
-}
-/** Read one JSON request body with a strict in-memory ceiling. */
-export declare function readJsonRequest(request: IncomingMessage, limit?: number): Promise<unknown>;
-export declare function requestErrorStatus(error: unknown, fallback: number): number;
-//# sourceMappingURL=http-json.d.ts.map

package/lib/runtime/http-json.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"http-json.d.ts","sourceRoot":"","sources":["../../../src/runtime/http-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,eAAO,MAAM,qBAAqB,QAAY,CAAC;AAE/C,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,GAAG,GAAG,GAAG,CAAC;gBAEnB,UAAU,EAAE,GAAG,GAAG,GAAG,EAAE,OAAO,EAAE,MAAM;CAKlD;AASD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,SAAwB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuDzG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3E"}

package/lib/runtime/kimi-errors.d.ts

@@ -1,13 +0,0 @@
-/**
- * Kimi Code error remapping shared by Hub and Subscription.
- * @module dsh-coding-oauth-core/kimi-errors
- */
-export declare function isMisclassifiedContextWindowError(detail: string): boolean;
-export declare function remapAuthFailureIfContextOverflow(failure: {
-    message: string;
-    code: string;
-}): {
-    message: string;
-    code: string;
-};
-//# sourceMappingURL=kimi-errors.d.ts.map

package/lib/runtime/kimi-errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kimi-errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/kimi-errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,wBAAgB,iCAAiC,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACb,CAGA"}