dsh-hub-oauth-gateway 1.5.0

package/CHANGELOG.md

@@ -0,0 +1,195 @@
+# Changelog
+
+All notable changes to `dsh-hub-oauth-gateway` are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
+[Semantic Versioning](https://semver.org/). Release and publication rules are
+defined in [`docs/00-project-rules.md`](docs/00-project-rules.md).
+
+## Unreleased
+
+### Changed
+
+- Verification policy: Docker sandbox is no longer required. Agents and
+  contributors verify in the Cursor Cloud environment with `pnpm` gates and an
+  isolated DeepSeek Harness (`DSH_HOME`) install for plugin smoke tests.
+  Documented in `AGENTS.md`, `docs/00-project-rules.md`, and `CONTRIBUTING.md`.
+
+### Added
+
+- Integrate coding-subscription OAuth (Grok Build, Codex, Kimi Code, Claude Code),
+  CLI Pull, optional Codex/Imagine capabilities, and the opt-in local API gateway
+  into this plugin. Compatibility routes, credential files, and CLI names are
+  preserved.
+- Add a unified provider catalog at `GET /api/usage-stats/v1/providers` and a
+  Settings provider-management view with independent connection, auth, model, and
+  quota states.
+
+## 1.5.0
+
+### Changed
+
+- Full dashboard and Settings → Usage Center use top tabs (one panel at a time),
+  following the coding-subscription OAuth settings pattern, so modules and
+  settings no longer stack as a long waterfall.
+- Quick Peek and the full dashboard use content height with `max-height` instead
+  of fixed 760px / 900px frames; Peek account cards keep a compact scroll cap.
+
+## 1.4.0
+
+### Added
+
+#### Wave 2 — account coverage
+
+- `volcengine-coding-plan` adapter via signed OpenAPI `GetCodingPlanUsage`
+  (no chat-completion probe).
+- `zai-team-plan` adapter (`open.bigmodel.cn` quota `type=2`) isolated from
+  personal `zai-token-plan`.
+- lastGood hardening: consecutive transient failures keep stale last-good data
+  until a configurable limit, then clear; Account UI shows last-good time.
+- Multi-profile monitors (`accounts.monitors.*.profiles[]`) with snapshot key
+  `(providerId, profileId)` (schema v3) and fee `profileId` attachment.
+
+#### Wave 3 — ops / optional
+
+- Adaptive account refresh (`refresh.accountMode: fixed | adaptive`, default
+  `fixed`); ordinary GET still does not credential-refresh.
+- Breakdown table expands input/output/cacheRead/cacheWrite columns (local data
+  only).
+- Opt-in local-directory auto export (absolute path; refused in CI/sandbox;
+  never writes credentials/sessions).
+- Opt-in `antigravity-quota` (external credential + usage URL only) and
+  `ollama-cloud` (requires `allowCookieSession: true`, host pinned to
+  `ollama.com`).
+
+## 1.2.0
+
+### Added
+
+- Activity heatmap and streak over a rolling 370-day window in the configured
+  time zone (`GET /api/usage-stats/v1/activity`), independent of the dashboard
+  range filter.
+- Dashboard module composition: preference-backed order/hidden list, preset
+  templates, and a Settings reset that clears customization.
+- Local subscription/top-up fee ledger (`account_fees`, schema v2) with
+  `GET`/`PUT /api/usage-stats/v1/fees`, Settings editing, and payback tooltips on
+  account cards when currency and monthly cost coverage match.
+- Export layouts: `layout=filtered` (default), `daily` CSV (date × provider), and
+  `bundle` JSON; fee rows remain excluded from exports.
+
+### Changed
+
+- User preferences keep `version: 1` while defaulting new Wave 1 fields
+  (`modules`, `modulesCustomized`, `streakMinTokens`) for older saved payloads.
+
+## 1.1.0
+
+### Added
+
+- Add public project governance, contribution, conduct, and release-inspection
+  rules adapted to this repository's local-first security and committed-build
+  model.
+- Add a Docker-only sandbox pipeline for dependency installation, lint,
+  type-checking, tests, release builds, artifact/lockfile export, reproducibility
+  checks, and npm package inspection; project code runs without network or host
+  bind mounts, and CI uses the same sandbox.
+
+### Changed
+
+- **Breaking:** rename the package and repository from `dsh-usage-stats`
+  (`Ychris12138/dsh-usage-stats`) to `dsh-hub-oauth-gateway`
+  (`lninghaha/dsh-hub-oauth-gateway`) ahead of the planned coding-plan OAuth
+  and API gateway work. The plugin/bundle identity and install/update contract
+  change with the name: `dsh plugin update dsh-usage-stats` no longer resolves,
+  and the old npm/GitHub package name will not receive updates. Existing
+  installations must remove the old entry and install the new package name.
+  Local data files (`usage-stats-v1.sqlite`, legacy JSON caches), the internal
+  `usage-stats` Cordis entry id, and the `/api/usage-stats/*` wire paths are
+  unchanged, so historical statistics are picked up in place.
+
+### Fixed
+
+- Accept direct loopback and same-origin HTTPS reverse-proxy browser requests
+  without confusing the browser-facing origin with the proxy's rewritten backend
+  Host. Forwarded mode requires loopback transport, canonical single-value
+  `X-Forwarded-Host`/`X-Forwarded-Proto`, the plugin marker, and an exact client
+  target authority; every presented Origin/Referer must match either the backend
+  or forwarded origin, while hostile preflight remains blocked without CORS.
+- Preserve structured API failure codes so the bilingual client can show
+  actionable local browser-context recovery guidance instead of exposing a
+  misleading raw guard message.
+- Add bounded browser-guard rejection classifications to local warning logs and
+  failure details without recording raw headers, URLs, cookies, or authorization
+  data.
+- Prioritize accounts with real balance or quota windows in Quick Peek instead
+  of letting unconfigured compatibility cards consume the four compact slots.
+- Query MiniMax Token Plan quota on the provider `api.*` host instead of the
+  browser-facing `www.*` host, then fall back to the legacy first-party path only
+  after an explicit zero-status response with no usable quota fields. Accept
+  non-video model labels and current reset-time fields while keeping HTTP,
+  provider-level, and malformed responses fail-closed without a second request.
+
+## 1.0.0
+
+### Added
+
+- Rebuild the plugin in TypeScript around a versioned local SQLite store for
+  session usage facts, account snapshots, preferences, pricing, and sanitized
+  migration state.
+- Add Quick Peek and Full Dashboard views with time ranges, provider/model
+  breakdowns, calendar-correct trends, bounded forecasts, alerts, and CSV/JSON
+  export.
+- Add user-owned price rules with separate input, output, cache-read, and
+  cache-write prices plus explicit estimate coverage.
+- Add normalized balance and subscription monitoring through 21 built-in
+  adapters and a constrained declarative JSON monitor.
+- Add server-side credential metadata/write/import endpoints and an optional
+  GitHub Copilot device flow without a bundled third-party OAuth client ID.
+- Add bilingual Simplified Chinese/English UI and configurable presentation,
+  provider visibility, aliases, colors, density, privacy, and alert settings.
+- Add Vitest coverage for storage, migration, time zones/DST, projection,
+  pricing, forecasts, account transport, API guards, credentials, export,
+  bundles, installer behavior, and React components.
+
+### Changed
+
+- Make GET endpoints local-snapshot reads; projection and credential-bearing
+  account refresh happen at startup, on schedule, or through explicit
+  mutations.
+- Produce standalone server and classic-script client bundles, publish TypeScript
+  declarations, and commit deterministic `lib/` artifacts for Git-host
+  installation.
+- Use pnpm with a committed lockfile and support Node.js `^22.19.0 || >=24.0.0`.
+- Move monitor configuration under `accounts.monitors` while preserving the
+  legacy root `monitors` compatibility transform.
+- Make fallback installation stage, verify, and atomically replace a complete
+  package; it refuses a duplicate manual mount when DSH bundles already manage
+  the plugin.
+
+### Removed
+
+- Remove the undocumented v0.3 JavaScript subpath exports and stale split
+  runtime files. The stable integration surface is the root Cordis plugin,
+  `./client`, and the versioned HTTP API.
+
+### Security
+
+- Enforce loopback peer and Host checks, same-origin/request-context guards,
+  a plugin request header, JSON-only mutations, and request/body limits.
+- Centralize outbound HTTPS/origin/DNS/private-address/redirect/timeout/size
+  validation and pin the validated DNS result into the connection.
+- Keep credential values, prompts, responses, working directories, local
+  credential paths, and raw provider responses out of SQLite and browser APIs.
+- Add restrictive storage permissions, session anonymization, export redaction,
+  and spreadsheet-formula escaping.
+
+## 0.3.0
+
+### Added
+
+- Add credential management and nine additional provider adapters.
+
+## 0.2.0
+
+### Added
+
+- Add multi-provider account monitoring alongside token-usage analytics.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,46 @@
+# Code of Conduct
+
+## Our commitment
+
+We are committed to a welcoming, harassment-free, and technically constructive
+community for everyone, regardless of background, identity, experience level,
+or preferred tools.
+
+## Expected behavior
+
+- Be respectful, patient, and specific.
+- Critique ideas and code, not people.
+- Assume good intent while accepting correction.
+- Make reviews actionable and acknowledge trade-offs.
+- Respect privacy. Never ask someone to post credentials, private account data,
+  prompts, responses, production databases, or identifying logs.
+- Disclose conflicts of interest and distinguish personal opinion from project
+  policy or verified provider behavior.
+
+## Unacceptable behavior
+
+- Harassment, threats, discrimination, insults, or sustained disruption;
+- publishing another person's private information or credentials;
+- pressuring maintainers or reporters to expose sensitive vulnerability
+  details publicly;
+- impersonating a vendor, contributor, or maintainer;
+- knowingly making deceptive claims about usage, cost, provider support, or
+  project endorsement.
+
+## Scope and enforcement
+
+This policy applies in repository issues, pull requests, reviews, discussions,
+release channels, and other spaces where someone represents this project.
+Report conduct concerns privately to a maintainer. For a software
+vulnerability, use the process in [`SECURITY.md`](SECURITY.md) instead.
+
+Maintainers may edit or remove comments, reject contributions, temporarily
+limit participation, or ban participants when behavior threatens people, the
+project, or user safety. Enforcement decisions should be proportionate,
+private where possible, and free from retaliation.
+
+## Attribution
+
+This concise policy is inspired by the principles of the Contributor Covenant
+2.1, while using project-specific wording. The Contributor Covenant is
+available at <https://www.contributor-covenant.org/version/2/1/code_of_conduct/>.

package/CONTRIBUTING.md

@@ -0,0 +1,150 @@
+# Contributing to dsh-hub-oauth-gateway
+
+Thank you for helping improve `dsh-hub-oauth-gateway`. Bug reports, documentation,
+tests, accessibility improvements, adapters, and focused pull requests are
+welcome.
+
+Before contributing, read:
+
+- [project rules](docs/00-project-rules.md) for publication, compatibility, and
+  release requirements;
+- [security policy](SECURITY.md) for the supported deployment and private
+  vulnerability reporting;
+- [code of conduct](CODE_OF_CONDUCT.md) for community expectations.
+
+By submitting a contribution, you agree that it may be distributed under this
+repository's [MIT License](LICENSE).
+
+## Before opening an issue
+
+1. Search existing issues and the changelog.
+2. Reproduce on a supported Node.js/DSH version when possible.
+3. Remove credentials, account details, session identifiers, prompts,
+   responses, raw provider payloads, local paths, and host information.
+4. For a security vulnerability, **do not open a public issue**. Follow
+   `SECURITY.md`.
+
+A useful bug report includes expected and actual behavior, minimal sanitized
+configuration, version information, and deterministic reproduction steps. Do
+not attach a production database or credential-bearing log. Feature requests
+should explain the user problem and trust/data-flow impact rather than only a
+proposed UI.
+
+## Development setup
+
+Verify in the **Cursor Cloud / local cloud workspace** with the declared Node.js
+and pnpm versions. Docker is optional, not required.
+
+```bash
+node -v   # ^22.19 || >=24
+pnpm -v   # packageManager in package.json
+pnpm install --frozen-lockfile
+pnpm run check:next
+```
+
+For plugin smoke tests, use an **isolated** `DSH_HOME` (never the operator’s
+personal profile), install `@deepseek-ai/dsh`, add this package to the web
+profile, and start `dsh web` on loopback.
+
+Automated tests use mocks and sanitized fixtures. They must not read a
+personal DSH profile, local CLI login, credential store, production SQLite, or
+require live provider access.
+
+## Repository model
+
+- Edit runtime behavior under `src/`.
+- Add or update tests under `tests/v1/`.
+- Do not edit `lib/` manually. It is a committed installation artifact rebuilt
+  from `src/` in the cloud/dev environment, reviewed, then committed.
+- `.next/`, `output/`, coverage, optional Docker exports, images, and TypeScript
+  build info are local/rebuildable outputs.
+- Put private machine-specific research in ignored `docs/local/`, never in a
+  pull request. Public reusable research belongs in a reviewed public doc.
+- Use pnpm only. Dependency changes include `pnpm-lock.yaml` and must not add
+  `package-lock.json`.
+
+Architecture and configuration contracts are documented in
+[`docs/architecture.md`](docs/architecture.md) and
+[`docs/configuration.md`](docs/configuration.md).
+
+## Change workflow
+
+1. Discuss a large or compatibility-affecting change in an issue first.
+2. Branch from the default branch and keep the change focused.
+3. Use a conventional commit prefix where practical:
+   - `feat:` backward-compatible capability;
+   - `fix:` bug or security fix;
+   - `docs:` public documentation;
+   - `test:` test-only change;
+   - `refactor:` behavior-preserving cleanup;
+   - `build:` build/dependency/release tooling;
+   - `chore:` repository maintenance.
+4. Add regression tests for fixes and negative tests for security boundaries.
+5. Update public documentation when behavior, API, configuration, installation,
+   migration, compatibility, or trust assumptions change.
+6. Add a concise user/operator-facing entry under `Unreleased` in
+   `CHANGELOG.md`.
+7. For runtime changes, regenerate `lib/` from `src/`, review the diff, commit
+   it, run `pnpm run check`, and smoke-test with an isolated DSH install when
+   UI or install behavior changed.
+
+User-visible copy must remain available in Simplified Chinese and English.
+Usage and costs must stay clearly identified as analytics/estimates; an
+unpriced token category is unknown, not free.
+
+## Required checks
+
+Fast source gate:
+
+```bash
+pnpm install --frozen-lockfile
+pnpm run check:next
+```
+
+After a runtime source change, rebuild and review `lib/`, then run:
+
+```bash
+pnpm run check
+npm pack --dry-run --json --ignore-scripts
+```
+
+Optional UI smoke (isolated `DSH_HOME` only):
+
+```bash
+export DSH_HOME=/tmp/dsh-verify-$USER
+# install @deepseek-ai/dsh, then:
+dsh plugin --profile web add "$PWD"
+dsh web --host 127.0.0.1 --port 3080
+```
+
+Never use a live credential or provider call as evidence that replaces an
+automated regression test.
+
+## Pull requests
+
+A pull request should include:
+
+- the problem and scope;
+- compatibility, migration, security, and privacy impact;
+- tests and exact commands run;
+- screenshots only when useful and fully synthetic/sanitized;
+- linked issues and remaining follow-ups.
+
+Reviewers will check correctness, failure isolation, accessibility, public API
+compatibility, privacy boundaries, docs/changelog synchronization, generated
+artifacts, and npm package contents. Maintainers may ask to split unrelated
+changes.
+
+At least one maintainer approval and green required CI are expected before
+merge. Authors should not rewrite shared history after review without warning.
+
+## Releases
+
+Maintainers perform releases according to
+[`docs/00-project-rules.md`](docs/00-project-rules.md). Release preparation and
+inspection are local; version bumps, tags, pushes, registry publication, and
+GitHub Releases require an explicit human decision. Contributors should not
+include an unsolicited version bump or tag in a feature pull request.
+
+Installing or developing the plugin never authorizes a tool or contributor to
+restart DSH Web. A user chooses when to restart the service.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-hub-oauth-gateway contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/LICENSES/Apache-2.0.txt

@@ -0,0 +1,179 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+Copyright 2026 dsh-xai contributors
+Copyright 2026 dsh-coding-subscription-oauth contributors
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/NOTICE

@@ -0,0 +1,16 @@
+NOTICE
+======
+
+dsh-hub-oauth-gateway
+Copyright 2026 dsh-hub-oauth-gateway contributors
+
+This product is licensed under MIT AND Apache-2.0.
+
+This product includes software derived from dsh-coding-subscription-oauth
+(formerly dsh-grok-build), licensed under the Apache License, Version 2.0.
+See LICENSES/Apache-2.0.txt and docs/oauth-provenance.md.
+
+That OAuth implementation includes software developed by the dsh-xai project
+(https://github.com/MirDie/dsh-xai), licensed under the Apache License,
+Version 2.0. Portions of the coding-oauth store, session, grok-import, redact,
+invariant, adapter, auth, and CLI modules are derived from that work.