dsh-github-copilot 0.4.0-alpha.18

package/lib/types/account-model-auth.d.ts

@@ -0,0 +1,15 @@
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { GitHubCopilotOAuthCredential } from './copilot-grant.ts';
+import type { AccountModelSourceDependencies } from './account-model-source.ts';
+/** Native getAuth renews within five minutes; reserve another thirty seconds for metadata preparation. */
+export declare const ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS: number;
+/** An opaque, process-local account key. Never a substitute for request credentials. */
+export declare function copilotAccountKey(grant: GitHubCopilotOAuthCredential): string;
+/** Compare normalized permission snapshots without retaining model credentials. */
+export declare function copilotEntitlementKey(grant: Pick<GitHubCopilotOAuthCredential, 'availableModelIds'>): string;
+/**
+ * Bind model discovery to the existing native OAuth lifecycle. No model catalog,
+ * login, environment fallback or separate credential record is introduced here.
+ */
+export declare function createAccountModelAuth(credentials: CredentialStore): Pick<AccountModelSourceDependencies, 'resolveAuth' | 'assertAuthCurrent'>;
+//# sourceMappingURL=account-model-auth.d.ts.map

package/lib/types/account-model-catalog.d.ts

@@ -0,0 +1,67 @@
+/** Pure normalization of account /models metadata; no transport, credentials, or model-name rules. */
+export declare const ACCOUNT_MODEL_CATALOG_LIMITS: Readonly<{
+    maxBytes: number;
+    maxModels: 512;
+    maxIdLength: 200;
+    maxNameLength: 256;
+    maxEndpoints: 16;
+    maxEndpointLength: 128;
+    maxEfforts: 32;
+    maxEffortLength: 64;
+    maxMediaTypes: 32;
+}>;
+export type AccountModelApi = 'anthropic-messages' | 'openai-responses' | 'openai-completions';
+export type AccountModelHttpEndpoint = '/v1/messages' | '/responses' | '/chat/completions';
+type RecognizedEndpoint = AccountModelHttpEndpoint | 'ws:/responses';
+/** Advertised data only; consumers must not turn unfamiliar labels into supported Core controls. */
+export interface AccountModelReasoning {
+    readonly advertisedEfforts: readonly string[];
+    readonly unmappedEfforts: readonly string[];
+    readonly adaptiveThinking?: boolean;
+    readonly minThinkingBudget?: number;
+    readonly maxThinkingBudget?: number;
+}
+export interface AccountModelDescriptor {
+    readonly id: string;
+    readonly name: string;
+    readonly api: AccountModelApi;
+    readonly contextWindow: number;
+    /** Independent server prompt limit; absence is not replaced with the context window. */
+    readonly maxInputTokens?: number;
+    readonly maxTokens: number;
+    readonly input: readonly ('text' | 'image')[];
+    readonly reasoning: AccountModelReasoning;
+    readonly evidence: {
+        /** Recognized endpoint literals only, never arbitrary URLs or query strings. */
+        readonly endpoints: readonly RecognizedEndpoint[];
+        readonly unsupportedEndpointCount: number;
+        readonly selectedEndpoint: AccountModelHttpEndpoint;
+        readonly apiSource: 'advertised-native' | 'advertised-priority';
+        readonly policySource: 'server-enabled' | 'account-available-id';
+        readonly contextWindowSource: 'max_context_window_tokens' | 'max_prompt_tokens';
+        readonly visionMediaTypes?: readonly string[];
+    };
+}
+export interface AccountModelRejection {
+    readonly id?: string;
+    readonly code: string;
+}
+export interface AccountModelCatalog {
+    readonly models: readonly AccountModelDescriptor[];
+    readonly rejected: readonly AccountModelRejection[];
+}
+export interface AccountModelCatalogOptions {
+    readonly nativeApis?: ReadonlyMap<string, string>;
+    /** Proof supplied by the account-bound caller; used only when policy is absent. */
+    readonly availableModelIds?: ReadonlySet<string>;
+}
+/**
+ * Normalize an account-bound /models response without model-name inference.
+ * JSON text is byte-bounded before parsing. Already-parsed objects have a
+ * bounded known-field work budget; unknown fields are deliberately not visited,
+ * so callers accepting objects must also bound the original transport body.
+ * Returned candidates do not replace request-time OAuth/account checks.
+ */
+export declare function normalizeAccountModelCatalog(raw: unknown, options?: AccountModelCatalogOptions): AccountModelCatalog;
+export {};
+//# sourceMappingURL=account-model-catalog.d.ts.map

package/lib/types/account-model-source.d.ts

@@ -0,0 +1,85 @@
+import type { AccountModelCatalog } from './account-model-catalog.ts';
+/** Transient native OAuth result. Only accountKey is permitted in a published snapshot. */
+export interface AccountModelAuth {
+    readonly apiKey: string;
+    /** Already trust-validated by the native credential owner; this source additionally requires an HTTPS root. */
+    readonly baseURL: string;
+    readonly accountKey: string;
+    readonly availableModelIds?: readonly string[] | ReadonlySet<string>;
+}
+export interface AccountModelSourceDependencies {
+    resolveAuth(signal: AbortSignal): Promise<AccountModelAuth>;
+    /** Must reject if the account/token is no longer current. This callback must not perform OAuth refresh. */
+    assertAuthCurrent(auth: AccountModelAuth, signal: AbortSignal): void | Promise<void>;
+    fetch?: typeof globalThis.fetch;
+    /** Public static request headers only; credential/routing/framing headers are refused. */
+    headers?: Readonly<Record<string, string>>;
+    nativeApis?: ReadonlyMap<string, string>;
+    now?: () => number;
+    ttlMs?: number | (() => number);
+    /** Failure backoff for non-force discovery only; never a background retry timer. */
+    failureCooldownMs?: number | (() => number);
+    timeoutMs?: number;
+}
+export interface AccountModelSnapshot extends AccountModelCatalog {
+    readonly accountKey: string;
+    readonly fetchedAt: number;
+    readonly generation: number;
+}
+export interface AccountModelSourceView {
+    readonly state: 'idle' | 'loading' | 'ready' | 'stale' | 'error' | 'disposed';
+    readonly generation: number;
+    readonly modelCount: number;
+    readonly rejectedCount: number;
+    readonly fetchedAt?: number;
+    readonly error?: AccountModelSourceErrorCode;
+}
+export interface AccountModelLoadOptions {
+    readonly force?: boolean;
+    readonly signal?: AbortSignal;
+}
+declare const codes: readonly ["COPILOT_MODEL_SOURCE_INVALID_CONFIG", "COPILOT_MODEL_SOURCE_INVALID_AUTH", "COPILOT_MODEL_SOURCE_AUTH_FAILED", "COPILOT_MODEL_SOURCE_AUTH_CHANGED", "COPILOT_MODEL_SOURCE_FETCH_FAILED", "COPILOT_MODEL_SOURCE_HTTP_ERROR", "COPILOT_MODEL_SOURCE_REDIRECTED_RESPONSE", "COPILOT_MODEL_SOURCE_BODY_FAILED", "COPILOT_MODEL_SOURCE_RESPONSE_TOO_LARGE", "COPILOT_MODEL_SOURCE_INVALID_RESPONSE", "COPILOT_MODEL_SOURCE_INVALID_CATALOG", "COPILOT_MODEL_SOURCE_INVALIDATED", "COPILOT_MODEL_SOURCE_ABORTED", "COPILOT_MODEL_SOURCE_TIMEOUT", "COPILOT_MODEL_SOURCE_DISPOSED"];
+export type AccountModelSourceErrorCode = typeof codes[number];
+export declare class AccountModelSourceError extends Error {
+    readonly code: AccountModelSourceErrorCode;
+    constructor(code: AccountModelSourceErrorCode);
+}
+/**
+ * Lazy account metadata, not model-call authorization. The owner must invalidate
+ * on credential/account changes and validate the account again before model wire.
+ * Cache reads do not refresh OAuth or claim authority over a separate Core catalog.
+ */
+export declare class AccountModelSource {
+    private readonly dependencies;
+    private readonly timeoutMs;
+    private readonly now;
+    private readonly fetch;
+    private readonly headers;
+    private readonly nativeApis;
+    private generation;
+    private disposed;
+    private cache;
+    private flight;
+    private failure;
+    private failedAt;
+    private readonly operations;
+    constructor(dependencies: AccountModelSourceDependencies);
+    private cacheDuration;
+    /** Display only: TTL expiry is allowed, but invalidation and clock guards still apply.
+     * The owner must additionally validate its account/token/entitlement proof before display. */
+    readDisplaySnapshot(): AccountModelSnapshot | undefined;
+    readSnapshot(): AccountModelSnapshot | undefined;
+    getView(): AccountModelSourceView;
+    load(options?: AccountModelLoadOptions): Promise<AccountModelSnapshot>;
+    /** Revoke definitively rejected metadata and back off passive reuse/recovery. */
+    rejectSnapshot(snapshot: AccountModelSnapshot): boolean;
+    invalidate(): void;
+    dispose(): void;
+    private start;
+    private current;
+    private validateCurrent;
+    private perform;
+}
+export declare function createAccountModelSource(dependencies: AccountModelSourceDependencies): AccountModelSource;
+export {};
+//# sourceMappingURL=account-model-source.d.ts.map

package/lib/types/authorization-controller.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Host-side bridge between the Models-page companion UI and DSH's neutral
+ * authorization, credential-record, and settings seams.
+ */
+import { Context } from '@deepseek-ai/cordis';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import { type GitHubCopilotMigrationStatus } from './migration-status.ts';
+export { GITHUB_COPILOT_CREDENTIAL_KEY, GITHUB_COPILOT_PROVIDER_ID } from './copilot-identity.ts';
+export declare const LLM_PI_AI_SETTINGS_NAMESPACE = "llm-pi-ai";
+export type GitHubCopilotModelCatalogState = 'current' | 'partially-outdated' | 'outdated';
+export interface GitHubCopilotModelCatalogView {
+    readonly state: GitHubCopilotModelCatalogState;
+    readonly accountModelCount: number;
+    readonly supportedModelCount: number;
+    readonly unknownModelIds: readonly string[];
+    readonly temporarilyUnavailableModelIds?: readonly string[];
+    /** Exact models served by the plugin-owned route, not canonical Core metadata. */
+    readonly previewModelIds?: readonly string[];
+}
+export interface GitHubCopilotProviderProfileResult {
+    readonly changed: boolean;
+    /** Legacy result field retained for consumers; canonical repair does not project a catalog. */
+    readonly catalog?: GitHubCopilotModelCatalogView;
+}
+export interface AuthorizationNoticeView {
+    readonly message: string;
+    readonly url?: string;
+    readonly code?: string;
+}
+export type GitHubCopilotAuthorizationPhase = 'signed-out' | 'authorizing' | 'signed-in' | 'error';
+export interface GitHubCopilotRouteView {
+    /** Legacy canonical configuration only; intentional absence is not an OAuth or managed-route failure. */
+    readonly state: 'ready' | 'needs-repair' | 'not-configured' | 'conflict' | 'error';
+    readonly diagnosticCode?: 'ROUTE_READ_FAILED' | 'RECONCILIATION_FAILED' | 'ROUTE_CONFLICT';
+}
+export interface GitHubCopilotAccountModelsView {
+    readonly state: 'idle' | 'loading' | 'ready' | 'stale' | 'error' | 'disposed' | 'unconfigured' | 'unavailable';
+    readonly models: readonly {
+        readonly id: string;
+        readonly name: string;
+        readonly api: string;
+    }[];
+    readonly rejected: readonly {
+        readonly id?: string;
+        readonly code: string;
+    }[];
+    readonly warnings?: readonly {
+        readonly id: string;
+        readonly code: string;
+    }[];
+    readonly discoveredAt?: number;
+    readonly error?: string;
+}
+export interface GitHubCopilotAuthorizationView {
+    readonly phase: GitHubCopilotAuthorizationPhase;
+    readonly configured: boolean;
+    readonly writable: boolean;
+    readonly inFlight: boolean;
+    readonly notices: readonly AuthorizationNoticeView[];
+    readonly catalog?: GitHubCopilotModelCatalogView;
+    readonly route?: GitHubCopilotRouteView;
+    readonly accountModels?: GitHubCopilotAccountModelsView;
+    readonly error?: string;
+}
+/** Read-only legacy configuration planning; not-configured permits managed-only use and never requests creation. */
+export declare function describeGitHubCopilotProviderProfile(ctx: Context): Promise<{
+    state: 'ready' | 'needs-repair' | 'not-configured' | 'conflict';
+    catalog?: GitHubCopilotModelCatalogView;
+}>;
+export declare function inspectGitHubCopilotProviderProfile(ctx: Context): Promise<GitHubCopilotProviderProfileResult>;
+export declare function ensureGitHubCopilotProviderProfile(ctx: Context): Promise<boolean>;
+/**
+ * Remote owner for the browser companion. No credential payload crosses this
+ * service: status uses record descriptions, sign-in delegates to the
+ * registered llm-pi-ai flow, and sign-out asks the credential seam to delete
+ * only llm-pi-ai's Copilot record.
+ */
+export declare class GitHubCopilotAuthorizationController extends TypertRemoteService {
+    private notices;
+    private failure;
+    private reconciliationFailed;
+    private attempt;
+    constructor(ctx: Context);
+    /** No-argument Ops evidence; deliberately independent of ordinary account status. */
+    migrationStatus(): GitHubCopilotMigrationStatus;
+    status(): Promise<GitHubCopilotAuthorizationView>;
+    /** Explicit model discovery: may refresh OAuth and GET the account catalog, never changes selection. */
+    discoverModels(): Promise<GitHubCopilotAuthorizationView>;
+    /** Ensure metadata for a visible account view, honoring shared cache and failure cooldown. */
+    ensureModels(): Promise<GitHubCopilotAuthorizationView>;
+    private loadAccountModels;
+    /** Explicit route repair over the stored account snapshot; never forces OAuth or a network probe. */
+    reconcile(): Promise<GitHubCopilotAuthorizationView>;
+    start(): Promise<GitHubCopilotAuthorizationView>;
+    cancel(): Promise<GitHubCopilotAuthorizationView>;
+    signOut(): Promise<GitHubCopilotAuthorizationView>;
+    private ensureProviderProfile;
+}
+export default GitHubCopilotAuthorizationController;
+//# sourceMappingURL=authorization-controller.d.ts.map

package/lib/types/client.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Browser companion for the Models provider-card slot.
+ */
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+import { createElement } from 'react';
+import { createCompactAccount } from './compact-account.ts';
+import type { CSSProperties, ReactElement } from 'react';
+import type { GitHubCopilotAuthorizationView } from './authorization-controller.ts';
+import type { ProviderCardExtrasOwnerProps, SettingsSectionOwnerProps } from './dsh-supported-types.ts';
+export { WebSearchRoutingCard } from './web-search-routing-card.ts';
+export declare const inject: string[];
+interface GitHubCopilotProviderCardProps extends ProviderCardExtrasOwnerProps {
+    readonly remote: ClientContext['remote']['githubCopilot'];
+}
+interface GitHubCopilotSettingsSectionProps extends SettingsSectionOwnerProps {
+    readonly remote: ClientContext['remote']['githubCopilot'];
+}
+/** Older Remote clients may not decode results: project known fields before validating our own copy. */
+export declare function authorizationViewFrom(value: unknown): GitHubCopilotAuthorizationView | undefined;
+export declare function catalogWarningOf(status: GitHubCopilotAuthorizationView | undefined): string | undefined;
+/** Account allocation is not a claim that a route is loaded or a model request succeeded. */
+export declare function previewAssignmentMessage(status: GitHubCopilotAuthorizationView | undefined): string | undefined;
+export declare function routeStatusMessage(status: GitHubCopilotAuthorizationView | undefined): string | undefined;
+export declare function activeAuthorizationNotice(status: GitHubCopilotAuthorizationView | undefined): GitHubCopilotAuthorizationView['notices'][number] | undefined;
+type ClipboardWriter = Pick<Clipboard, 'writeText'>;
+type CopyState = 'idle' | 'copying' | 'copied' | 'failed';
+/** Copy a one-time authorization code through the browser clipboard boundary. */
+export declare function copyAuthorizationCode(code: string, clipboard?: ClipboardWriter): Promise<void>;
+interface AuthorizationNoticeProps {
+    readonly message: string;
+    readonly url?: string;
+    readonly code?: string;
+    readonly copyState: CopyState;
+    readonly onCopy: () => void;
+    readonly buttonStyle?: CSSProperties;
+}
+/** Pure presentation for the in-flight GitHub device-code handoff. */
+export declare function GitHubCopilotAuthorizationNotice(props: AuthorizationNoticeProps): ReactElement;
+/** Shared account authorization controls, mounted by the account footer or its fallback only. */
+export declare function GitHubCopilotProviderCard(props: GitHubCopilotProviderCardProps): ReturnType<typeof createElement> | null;
+type AccountModelsSnapshot = NonNullable<GitHubCopilotAuthorizationView['accountModels']>;
+export interface AccountModelsUpdatedAt {
+    readonly text: string;
+    readonly dateTime: string;
+    readonly title: string;
+    readonly ariaLabel: string;
+}
+/** Pure presentation of the Host's last successful cache update; never invent freshness evidence. */
+export declare function formatAccountModelsUpdatedAt(discoveredAt: number | undefined, now: number, locales?: Intl.LocalesArgument): AccountModelsUpdatedAt | undefined;
+/** Display-only clock: no Remote, status, discovery, or controller lifecycle ownership. */
+export declare function GitHubCopilotAccountModelsUpdatedAt(props: {
+    readonly discoveredAt: number | undefined;
+}): ReactElement | null;
+/** A discovery snapshot is metadata evidence, not proof of a successful model call. */
+export declare function GitHubCopilotAccountModelsSummary(props: {
+    readonly snapshot: AccountModelsSnapshot;
+}): ReactElement;
+/** Explicit account discovery only: no mount-time request, polling, or automatic retry. */
+export declare function GitHubCopilotAccountModelsPanel(props: {
+    readonly remote: ClientContext['remote']['githubCopilot'];
+}): ReactElement;
+interface GitHubCopilotPreviewFooterProps {
+    readonly remote: ClientContext['remote']['githubCopilot'];
+    /** A slot coordinator owns this controller's attachment across surface handoffs. */
+    readonly account?: ReturnType<typeof createCompactAccount>;
+    readonly embedded?: boolean;
+}
+/** One lifecycle owner; disclosure toggles never mount another status or discovery controller. */
+export declare function GitHubCopilotCompactAccount(props: GitHubCopilotPreviewFooterProps): ReactElement;
+/** Standalone footer presentation; registered Models seats use the shared surface coordinator. */
+export declare function GitHubCopilotPreviewFooter(props: GitHubCopilotPreviewFooterProps): ReactElement;
+type AccountSurfaceKind = 'provider' | 'footer' | 'settings';
+interface AccountSurfaceSeat {
+    readonly kind: AccountSurfaceKind;
+    active: boolean;
+}
+type AccountController = ReturnType<typeof createCompactAccount>;
+type AccountSurfaceOwner = {
+    readonly token: symbol;
+    readonly account: AccountController;
+};
+/** Only the mounted canonical row owns embedded controls. Credential presence is not row presence. */
+export declare function isGitHubCopilotAccountRow(props: ProviderCardExtrasOwnerProps): boolean;
+/** Plugin-owned mounted-seat leases, not a view into Core's settings or provider store.
+ * One controller follows the winning surface, retaining in-flight work during a
+ * handoff. Slot disposal revokes its leases even before React unmounts the rows.
+ */
+export declare function createAccountSurfaces(): {
+    getSnapshot: () => AccountSurfaceOwner | undefined;
+    invalidate(): void;
+    subscribe(listener: () => void): () => void;
+    mount(seat: AccountSurfaceSeat, token: symbol, remote: GitHubCopilotPreviewFooterProps["remote"]): () => void;
+    revoke(seat: AccountSurfaceSeat): void;
+    dispose(): void;
+};
+/** Arbitration happens in committed layout effects, never during speculative render. */
+export declare function GitHubCopilotAccountSurface(props: GitHubCopilotPreviewFooterProps & {
+    readonly surfaces: ReturnType<typeof createAccountSurfaces>;
+    readonly seat: AccountSurfaceSeat;
+    readonly eligible?: boolean;
+}): ReactElement | null;
+/** Unified fallback when the Models footer extension is absent or incompatible. */
+export declare function GitHubCopilotSettingsSection(props: GitHubCopilotSettingsSectionProps): ReturnType<typeof createElement>;
+/** Mount the plugin-owned Remote namespace and register the Models card seat. */
+export declare function apply(ctx: ClientContext): Promise<() => Promise<void>>;
+//# sourceMappingURL=client.d.ts.map

package/lib/types/compact-account.d.ts

@@ -0,0 +1,42 @@
+import type { GitHubCopilotAuthorizationView as View } from './authorization-controller.ts';
+export interface CompactAccountRemote {
+    status(): Promise<unknown>;
+    start(): Promise<unknown>;
+    cancel(): Promise<unknown>;
+    signOut(): Promise<unknown>;
+    discoverModels(): Promise<unknown>;
+    ensureModels(): Promise<unknown>;
+    reconcile(): Promise<unknown>;
+}
+type Operation = 'start' | 'cancel' | 'signOut' | 'discoverModels' | 'reconcile';
+export declare const AUTHORIZATION_POLL_INITIAL_MS = 500;
+export declare const AUTHORIZATION_POLL_MAX_MS = 2000;
+export interface CompactAccountSnapshot {
+    readonly view: View | undefined;
+    readonly checking: boolean;
+    readonly operation: Operation | undefined;
+    readonly error: string | undefined;
+    readonly copyState: 'idle' | 'copying' | 'copied' | 'failed';
+}
+/** One mounted account's snapshot, bounded freshness check and explicit actions.
+ * Initial signed-in status ensures missing/idle/stale/error metadata once or
+ * joins loading metadata; the Host owns single flight and failure cooldown.
+ * A confirmed user Start earns one forced discovery after sign-in completes.
+ * No Remote call occurs during construction. Every await is fenced by lifetime
+ * and request generation; UI disclosure changes never reconstruct this owner.
+ */
+export declare function createCompactAccount(remote: CompactAccountRemote, decode: (value: unknown) => View | undefined, copy: (code: string) => Promise<void>): {
+    getSnapshot: () => CompactAccountSnapshot;
+    subscribe(listener: () => void): () => void;
+    attach(): () => void;
+    invalidate(): void;
+    retryStatus: () => Promise<void>;
+    start: () => Promise<void>;
+    cancel: () => Promise<void>;
+    signOut: () => Promise<void>;
+    refreshModels: () => Promise<void>;
+    reconcile: () => Promise<void>;
+    copyCode(): Promise<void>;
+};
+export {};
+//# sourceMappingURL=compact-account.d.ts.map

package/lib/types/compatibility.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Fail-closed runtime validation for the DSH service APIs this integration
+ * consumes. Version ranges are validated by the deployment baseline; this
+ * check protects source and unpacked installs from API-shape drift.
+ * @module dsh-github-copilot/compatibility
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const DSH_COMPATIBILITY: {
+    readonly release: "0.1.5-alpha.2";
+    readonly developmentRelease: "0.1.2-rc.1";
+    readonly peerRange: "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2";
+    readonly supportedReleases: readonly ["0.1.1-rc.2", "0.1.2-rc.1", "0.1.3-alpha.1", "0.1.5-alpha.1", "0.1.5-alpha.2", "0.1.5-rc.1", "0.1.5-rc.2"];
+    readonly requiredApis: readonly ["agentDefaultModel.currentSelection", "authorization.describe", "authorization.begin", "authorization.cancel", "credentials.describeRecord", "credentials.readRecord", "credentials.listRecords", "credentials.modifyRecord", "credentials.deleteRecord", "settings.get", "settings.describe", "settings.mutate", "settings.installSection", "web.registerSearchProvider", "systemPrompt.section", "context.on", "context.effect", "context.plugin"];
+};
+/** Assert every required Core service shape before registering any effects. */
+export declare function assertDshCompatibility(ctx: Context): void;
+//# sourceMappingURL=compatibility.d.ts.map

package/lib/types/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Settings section of the inline web-search plugin: the narrow-gate switch,
+ * provider whitelist, wire controls, and probe bounds. Everything is
+ * configurable through the settings seam; defaults follow the chat route.
+ * @module dsh-github-copilot/config
+ */
+import z from '@deepseek-ai/schemastery';
+/** Plugin configuration. Defaults make the current chat route decide. */
+export interface InlineConfig {
+    /** Master switch; false sends every request down the normal adapter path. */
+    enabled: boolean;
+    /**
+     * Provider whitelist (llm-pi-ai route keys). Empty = follow the current
+     * chat route, whose candidates decide whether the plugin can serve.
+     */
+    providers: string[];
+    /** Append `include: ['web_search_call.action.sources']` to wire requests. */
+    includeSources: boolean;
+    /** Strip function-tool variants of the server-side web tools from the wire. */
+    stripServerTools: boolean;
+    /** Idle bound for one inline request, in milliseconds. */
+    idleTimeoutMs: number;
+    /** Verify the endpoint executes native search before serving. */
+    probe: boolean;
+    /** Bound on one probe request, in milliseconds. */
+    probeTimeoutMs: number;
+    /** Maximum reuse of account model metadata; credential proof guards still take precedence. */
+    accountModelTtlMs?: number;
+    /** Minimum delay after failed passive discovery; explicit Refresh bypasses it. */
+    accountModelFailureCooldownMs?: number;
+    /** Route the official web-search consumer by initiating Session when the bundle isolate is mounted. */
+    routeWebSearch?: boolean;
+    /** Automatic fallback, disclosed in results; no per-search approval dialog. */
+    searchFallback?: 'none' | 'deepseek';
+    /** Copilot model used when `github-copilot-hosted` serves independently of the initiating chat model. */
+    searchModel?: string;
+    /** Internal JSON backup of route leaves temporarily owned by the GPT-6 overlay. */
+    temporaryRouteBackup?: string;
+}
+/** Schema of the plugin's settings section. */
+export declare const Config: z<InlineConfig>;
+//# sourceMappingURL=config.d.ts.map

package/lib/types/content-file.d.ts

@@ -0,0 +1,10 @@
+/** File-content detection shared by the hosted-search preflight. */
+/** Structural signature of Core's recursive file-content helper. */
+export type ContentHasFile = (content: readonly unknown[]) => boolean;
+/**
+ * Prefer Core's official recursive predicate when the installed release exports
+ * it. The structural fallback retains rc.2/rc.1 compatibility and follows the
+ * same `tool-result.content` recursion so file context always fails closed.
+ */
+export declare function contentHasFileCompat(content: readonly unknown[], official?: ContentHasFile | undefined): boolean;
+//# sourceMappingURL=content-file.d.ts.map

package/lib/types/copilot-auth.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Provider-side GitHub Copilot auth resolution over the same credential record
+ * that DSH's built-in llm-pi-ai adapter owns.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type CredentialStore } from '@earendil-works/pi-ai';
+import { GITHUB_COPILOT_PROVIDER_ID, GITHUB_COPILOT_PREVIEW_PROVIDER_ID } from './copilot-identity.ts';
+export { normalizeGitHubCopilotOAuthCredential } from './copilot-grant.ts';
+/** Bind exactly one logical route to the canonical Host-owned credential record. */
+export declare function createGitHubCopilotCredentialStore(ctx: Context, logicalProviderId?: typeof GITHUB_COPILOT_PROVIDER_ID | typeof GITHUB_COPILOT_PREVIEW_PROVIDER_ID): CredentialStore;
+/**
+ * Build one resolver whose pi-ai collection refreshes OAuth credentials inside
+ * the DSH record's serialized modify operation before exposing request auth.
+ */
+export declare function createGitHubCopilotTokenResolver(ctx: Context, onCredentialChanged?: () => Promise<void>): (modelId: string) => Promise<GitHubCopilotRequestAuth | undefined>;
+export interface GitHubCopilotRequestAuth {
+    readonly apiKey: string;
+    readonly baseURL: string;
+    readonly headers?: Readonly<Record<string, string | null>>;
+}
+/** Validate an OAuth-derived endpoint without disclosing its value or credential payload. */
+export declare function trustedGitHubCopilotBaseUrl(value: string | undefined, grant: unknown): string;
+//# sourceMappingURL=copilot-auth.d.ts.map

package/lib/types/copilot-grant.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthCredential } from '@earendil-works/pi-ai';
+export interface GitHubCopilotOAuthCredential extends OAuthCredential {
+    readonly enterpriseUrl?: string;
+    readonly availableModelIds?: readonly string[];
+}
+/**
+ * Rebuild pi-ai's GitHub Copilot grant as the exact JSON-safe provider shape.
+ * Prototype and unrelated extension members are intentionally not preserved.
+ */
+export declare function normalizeGitHubCopilotOAuthCredential(credential: unknown): GitHubCopilotOAuthCredential;
+//# sourceMappingURL=copilot-grant.d.ts.map

package/lib/types/copilot-identity.d.ts

@@ -0,0 +1,6 @@
+/** Native OAuth ownership and the sole plugin-owned, account-discovered route. */
+export declare const GITHUB_COPILOT_CREDENTIAL_KEY = "llm-pi-ai/github-copilot";
+export declare const GITHUB_COPILOT_PROVIDER_ID = "github-copilot";
+export declare const GITHUB_COPILOT_PREVIEW_PROVIDER_ID = "github-copilot-preview";
+export declare const GITHUB_COPILOT_PREVIEW_MODEL_ID = "gpt-6-astra";
+//# sourceMappingURL=copilot-identity.d.ts.map

package/lib/types/copilot-request.d.ts

@@ -0,0 +1,11 @@
+import type { SearchPlanCandidate } from './plan.ts';
+export interface ResolvedRequestAuth {
+    readonly apiKey: string;
+    readonly baseURL?: string;
+    readonly headers?: Readonly<Record<string, string | null>>;
+}
+export declare function normalizeRequestAuth(auth: string | ResolvedRequestAuth | undefined): ResolvedRequestAuth | undefined;
+export declare function applyRequestAuth(candidate: SearchPlanCandidate, auth: ResolvedRequestAuth): SearchPlanCandidate;
+/** Materialize pi-ai catalog headers and Copilot's per-request metadata. */
+export declare function providerRequestHeaders(candidate: SearchPlanCandidate, initiator: 'agent' | 'user'): Readonly<Record<string, string>>;
+//# sourceMappingURL=copilot-request.d.ts.map

package/lib/types/current-provider.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Detection of an operation's provider route: the initiating Agent or explicit
+ * request names a route and model, the `llm-pi-ai` settings
+ * section carries the route's profile, and the pi-ai catalog supplies the
+ * defaults (wire protocol, base URL) a profile that overrides nothing inherits.
+ * The probe and plan modules read this to decide which search-capable
+ * protocol to use without any configuration.
+ * @module dsh-github-copilot/current-provider
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+/** The resolved chat-route facts this package consumes. */
+export interface CurrentChatRoute {
+    /** Registered provider route key (the llm-pi-ai `providers` dict key). */
+    readonly provider: string;
+    /** Provider-owned model id. */
+    readonly model: string;
+    /** Wire protocol the route speaks, when determinable. */
+    readonly api?: string;
+    /** Endpoint base the route's requests go to. */
+    readonly baseURL?: string;
+    /** Credential reference the route resolves its key through. */
+    readonly apiKeyEnv?: string;
+    /** All interactive APIs advertised by this route's selected model. */
+    readonly supportedApis?: readonly string[];
+    /** Static provider/model request headers from pi-ai's catalog. */
+    readonly headers?: Readonly<Record<string, string | null>>;
+}
+/**
+ * Read the public asynchronous initiator seam when supported by Core.
+ * Older Core and agentless callers have no session selection; never substitute
+ * the default-model service or an arbitrary registered Agent.
+ * @param ctx - Host context with the optional Agent registry.
+ * @returns the initiating Agent, or undefined when the capability/caller is absent.
+ */
+export declare function currentSearchInitiator(ctx: Context): Agent | undefined;
+/**
+ * Capture the initiating Session's effective request route. Agent.options is
+ * only an activation seed; Core model-selection waterfalls need not update it.
+ * @param agent - initiating Agent recovered at the operation entry.
+ * @returns provider/model leaves from the last committed request header, or none.
+ */
+export declare function currentSearchSelection(agent: Agent | undefined): {
+    provider: string;
+    model: string;
+} | undefined;
+/**
+ * Resolve one operation's route. Explicit GenerateOptions fields are already
+ * resolved by Core and take precedence; otherwise use the initiating Session's
+ * effective request header. Missing request evidence fails closed.
+ * @param ctx - context used for public initiator, settings and catalog reads.
+ * @param explicit - explicit request selection, captured at operation entry.
+ * @returns owned route facts, or undefined without a usable selection.
+ */
+export declare function currentChatRoute(ctx: Context, explicit?: {
+    readonly provider?: string;
+    readonly model?: string;
+}): CurrentChatRoute | undefined;
+//# sourceMappingURL=current-provider.d.ts.map

package/lib/types/deepseek-search-fallback.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { WebSearchProvider } from '@deepseek-ai/dsh-web';
+/**
+ * Compose a known official fallback only when permitted. The public native class
+ * owns transport, redirects and parsing. A per-operation instance keeps backend
+ * disclosure aligned with that operation's options even during concurrent calls.
+ * canContinue must be the initiating router's captured operation-local guard.
+ */
+export declare function createDeepSeekSearchFallback(ctx: Context, owner: Agent | undefined, canContinue: () => boolean): Promise<WebSearchProvider>;
+//# sourceMappingURL=deepseek-search-fallback.d.ts.map