kiokuko-dsh 0.2.1 → 0.2.3

package/dist/dsh/models/surface.js

@@ -0,0 +1,162 @@
+import { installModelSelection } from "@deepseek-ai/dsh-agent";
+import { join } from "node:path";
+import { KiokukoModelsService } from "./service.js";
+import { ModelsConfigStore } from "./config-store.js";
+import { CredentialFile, defaultCredentialsFile, } from "./vendor/credentials.js";
+const mounted = new WeakMap();
+export const MODELS_PATH = "/api/kiokuko.models";
+/** Secret operations are POST-only and never reflect input or provider response bodies. */
+export async function modelsResponse(service, request) {
+    const headers = { "cache-control": "no-store" }, url = new URL(request.url);
+    try {
+        if (request.method === "GET") {
+            const op = url.searchParams.get("op"), id = url.searchParams.get("id") ?? "";
+            return Response.json(op === "auth"
+                ? service.authStatus(id)
+                : op === "models"
+                    ? await service.models(id)
+                    : await service.list(), { headers });
+        }
+        if (request.method !== "POST")
+            return new Response(null, { status: 405, headers });
+        // The native connection transport validates its token. Also refuse cross-origin form posts.
+        // The bridge normalizes Request.url to its internal authority. Host retains
+        // the browser authority, which the native transport already authenticates.
+        const origin = request.headers.get("origin"), host = request.headers.get("host");
+        if (request.headers.get("sec-fetch-site") === "cross-site" ||
+            (origin && new URL(origin).host !== (host ?? url.host)))
+            return Response.json({ error: "Origin mismatch" }, { status: 403, headers });
+        if (!request.headers.get("content-type")?.startsWith("application/json"))
+            return Response.json({ error: "JSON required" }, { status: 415, headers });
+        const text = await request.text();
+        if (text.length > 512_000)
+            throw new Error("Request exceeds limit");
+        const body = JSON.parse(text), id = typeof body.id === "string" ? body.id : "";
+        if (body.op === "save") {
+            await service.save(body.connection, body.revision);
+        }
+        else if (body.op === "key") {
+            await service.setKey(id, body.key);
+        }
+        else if (body.op === "logout") {
+            await service.logout(id);
+        }
+        else if (body.op === "refresh") {
+            await service.refresh(id);
+        }
+        else if (body.op === "login") {
+            return Response.json({ operationId: service.startLogin(id) }, { headers });
+        }
+        else if (body.op === "answer") {
+            service.answer(id, body.answer);
+        }
+        else if (body.op === "cancel") {
+            service.cancel(id);
+        }
+        else if (body.op === "select") {
+            if (body.scope !== "current" && body.scope !== "default")
+                throw new Error("Invalid selection scope");
+            await service.select(id, body.model, body.scope, body.sessionId);
+        }
+        else
+            throw new Error("Unknown operation");
+        return Response.json({ ok: true }, { headers });
+    }
+    catch (error) {
+        // Only locally generated, bounded diagnostics; validation/provider/token errors are not wire-safe.
+        const message = error instanceof Error ? error.message : "";
+        const safe = /^(Unknown |Connection |Configuration |Model discovery |No models |No authentication |Authentication |OAuth |Codex |Saving the default |Open a chat |Model is not available |This connection |Enter a valid |Origin |JSON |Request exceeds|Installed adapter|Kiokuko Models)/.test(message)
+            ? message.slice(0, 300)
+            : "Operation failed; check configuration, permissions or authentication and retry";
+        return Response.json({ error: safe }, { status: 400, headers });
+    }
+}
+/** Web-only management; the TUI's /auth remains owned by its existing plugin. */
+export async function mountKiokukoModels(ctx) {
+    const get = (name) => ctx.get(name, false), profile = get("profileContext"), connection = get("connection"), llm = get("llm");
+    if (!profile ||
+        ["dsh-cli", "dsh-tui"].includes(profile.name) ||
+        !connection?.fetch ||
+        !llm)
+        return async () => { };
+    if (mounted.has(llm))
+        return async () => { };
+    const agents = get("agents"), defaults = get("agentDefaultModel");
+    const selections = new Map();
+    const service = new KiokukoModelsService({
+        llm,
+        config: new ModelsConfigStore(join(profile.dir, "kiokuko-models.json")),
+        credentials: new CredentialFile(defaultCredentialsFile()),
+        attachments: () => get("attachments"),
+        selectCurrent: async (sessionId, binding) => {
+            const agent = agents?.get(sessionId);
+            if (!agent)
+                throw new Error("Open a chat before selecting its model");
+            if (agent.status === "running")
+                throw new Error("Connection selection must wait until this chat is idle");
+            await llm.resolveCallConfig(binding);
+            let selection = selections.get(agent);
+            if (!selection) {
+                const ref = {
+                    current: undefined,
+                    assembled: undefined,
+                };
+                selection = { ...ref, dispose: () => { } };
+                selection.dispose = installModelSelection(agent.ctx, selection);
+                selections.set(agent, selection);
+            }
+            agent.session.append("model/selection", binding);
+            selection.current = binding;
+        },
+        saveDefault: async (binding) => {
+            if (!defaults)
+                throw new Error("Saving the default is unavailable");
+            await defaults.saveSelection(binding);
+        },
+    });
+    await service.start();
+    mounted.set(llm, service);
+    const releases = [];
+    try {
+        releases.push(ctx.on("agent/request", async (payload, next) => {
+            const binding = await next();
+            service.bindRequest(payload.signal, binding, payload.turn, payload.step);
+            return binding;
+        }, { prepend: true }));
+        releases.push(connection.fetch.register({
+            path: MODELS_PATH,
+            methods: ["GET", "POST"],
+            requestBody: "buffered",
+            fetch: (r) => modelsResponse(service, r),
+        }));
+        const commands = get("commands");
+        if (commands)
+            releases.push(commands.register({
+                name: "kiokuko",
+                input: { hint: "model" },
+                recordInput: false,
+                description: "Open Kiokuko Models: /kiokuko model",
+                handler: async (invocation) => invocation.rawInput.trim() === "model"
+                    ? { kind: "success", text: "Kiokuko Models" }
+                    : {
+                        kind: "error",
+                        text: "Use /kiokuko model. Credentials belong in the masked Settings form.",
+                    },
+            }));
+    }
+    catch (error) {
+        mounted.delete(llm);
+        await Promise.allSettled(releases.reverse().map(async (release) => release()));
+        await service.close();
+        throw error;
+    }
+    return async () => {
+        mounted.delete(llm);
+        for (const release of releases.reverse())
+            release();
+        for (const selection of selections.values())
+            selection.dispose();
+        await service.close();
+    };
+}
+//# sourceMappingURL=surface.js.map

package/dist/dsh/models/surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface.js","sourceRoot":"","sources":["../../../src/dsh/models/surface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,cAAc,EACd,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAgC,CAAC;AAC5D,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AACjD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA6B,EAC7B,OAAgB;IAEhB,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,EAC7C,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EACnC,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,MAAM;gBACX,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxB,CAAC,CAAC,EAAE,KAAK,QAAQ;oBACf,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,EAC1B,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAC3B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,4FAA4F;QAC5F,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC1C,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IACE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,YAAY;YACtD,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;YAEvD,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAC5B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAC;QACJ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC;YACtE,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,eAAe,EAAE,EAC1B,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAQ,EAClC,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,EACvC,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBACtD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mGAAmG;QACnG,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GACR,6QAA6Q,CAAC,IAAI,CAChR,OAAO,CACR;YACC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YACvB,CAAC,CAAC,gFAAgF,CAAC;QACvF,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AACD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY;IAEZ,MAAM,GAAG,GAAG,CAAC,IAAY,EAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EACrD,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAC/B,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,EAC9B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,IACE,CAAC,OAAO;QACR,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;QAC7C,CAAC,UAAU,EAAE,KAAK;QAClB,CAAC,GAAG;QAEJ,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IACxB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,EAC1B,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAOvB,CAAC;IACJ,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC;QACvC,GAAG;QACH,MAAM,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACvE,WAAW,EAAE,IAAI,cAAc,CAAC,sBAAsB,EAAE,CAAC;QACzD,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;QACrC,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAC5B,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;YACJ,MAAM,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG;oBACV,OAAO,EAAE,SAA4D;oBACrE,SAAS,EAAE,SACsC;iBAClD,CAAC;gBACF,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;gBAC1C,SAAS,CAAC,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAChE,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACjD,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;QAC9B,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACpE,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,EAAE,CACJ,eAAsB,EACtB,KAAK,EAAE,OAAY,EAAE,IAAwB,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;YAC7B,OAAO,CAAC,WAAW,CACjB,OAAO,CAAC,MAAM,EACd,OAAO,EACP,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,IAAI,CACb,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CACF,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;YACxB,WAAW,EAAE,UAAU;YACvB,KAAK,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;SAClD,CAAC,CACH,CAAC;QACF,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,QAAQ;YACV,QAAQ,CAAC,IAAI,CACX,QAAQ,CAAC,QAAQ,CAAC;gBAChB,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gBACxB,WAAW,EAAE,KAAK;gBAClB,WAAW,EAAE,qCAAqC;gBAClD,OAAO,EAAE,KAAK,EAAE,UAAgC,EAAE,EAAE,CAClD,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,OAAO;oBACpC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE;oBAC7C,CAAC,CAAC;wBACE,IAAI,EAAE,OAAO;wBACb,IAAI,EAAE,qEAAqE;qBAC5E;aACR,CAAC,CACH,CAAC;IACN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC/E,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,EAAE;YAAE,SAAS,CAAC,OAAO,EAAE,CAAC;QACjE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dsh/models/vendor/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,134 @@
+@ai-sdk/provider@4.0.21 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+zod@4.5.4 (MIT)
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+---
+
+eventsource-parser@3.1.1 (MIT)
+MIT License
+
+Copyright (c) 2026 Espen Hovlandsdal <espen@hovlandsdal.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+---
+
+@ai-sdk/anthropic@4.0.71 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/openai@4.0.83 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/openai-compatible@3.0.62 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+---
+
+@ai-sdk/google@4.0.87 (Apache-2.0)
+Copyright 2023 Vercel, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/dist/dsh/models/vendor/abortable.d.ts

@@ -0,0 +1,3 @@
+/** Bound async I/O even when a reader or fixture does not honor fetch cancellation. */
+export declare function abortable<T>(operation: PromiseLike<T>, signal: AbortSignal): Promise<T>;
+//# sourceMappingURL=abortable.d.ts.map

package/dist/dsh/models/vendor/abortable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"abortable.d.ts","sourceRoot":"","sources":["../../../../src/dsh/models/vendor/abortable.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAOvF"}

package/dist/dsh/models/vendor/abortable.js

@@ -0,0 +1,10 @@
+/** Bound async I/O even when a reader or fixture does not honor fetch cancellation. */
+export function abortable(operation, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener('abort', abort, { once: true });
+        Promise.resolve(operation).then(resolve, reject).finally(() => signal.removeEventListener('abort', abort));
+    });
+}
+//# sourceMappingURL=abortable.js.map

package/dist/dsh/models/vendor/abortable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abortable.js","sourceRoot":"","sources":["../../../../src/dsh/models/vendor/abortable.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAI,SAAyB,EAAE,MAAmB;IACzE,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAC5G,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/dsh/models/vendor/auth-contract.d.ts

@@ -0,0 +1,67 @@
+/** Auth-owned persistence and interaction contracts; pi routes adapt structurally. */
+export interface StoredOAuthCredential {
+    type: 'oauth';
+    access: string;
+    refresh: string;
+    expires: number;
+    [key: string]: unknown;
+}
+export interface StoredApiKeyCredential {
+    type: 'api_key';
+    key?: string;
+    env?: Record<string, string>;
+}
+export type StoredCredential = StoredOAuthCredential | StoredApiKeyCredential;
+export interface CredentialInfo {
+    providerId: string;
+    type: StoredCredential['type'];
+}
+export interface AuthInteraction {
+    signal: AbortSignal;
+    prompt(prompt: AuthPrompt): Promise<string>;
+    notify(event: AuthEvent): void;
+}
+export type AuthPrompt = {
+    signal?: AbortSignal;
+} & ({
+    type: 'text' | 'secret' | 'manual_code';
+    message: string;
+    placeholder?: string;
+} | {
+    type: 'select';
+    message: string;
+    options: readonly {
+        id: string;
+        label: string;
+        description?: string;
+    }[];
+});
+export type AuthEvent = {
+    type: 'info';
+    message: string;
+    links?: readonly {
+        url: string;
+        label?: string;
+    }[];
+} | {
+    type: 'auth_url';
+    url: string;
+    instructions?: string;
+} | {
+    type: 'device_code';
+    userCode: string;
+    verificationUri: string;
+    intervalSeconds?: number;
+    expiresInSeconds?: number;
+} | {
+    type: 'progress';
+    message: string;
+};
+export interface OAuthFlow {
+    name: string;
+    loginLabel?: string;
+    login(interaction: AuthInteraction, options?: {
+        getDeviceId?: () => string;
+    }): Promise<StoredOAuthCredential>;
+}
+//# sourceMappingURL=auth-contract.d.ts.map

package/dist/dsh/models/vendor/auth-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contract.d.ts","sourceRoot":"","sources":["../../../../src/dsh/models/vendor/auth-contract.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IAAG,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE;AAClI,MAAM,WAAW,sBAAsB;IAAG,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE;AACvG,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,sBAAsB,CAAA;AAC7E,MAAM,WAAW,cAAc;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAA;CAAE;AACtF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI,CAAA;CAC/B;AACD,MAAM,MAAM,UAAU,GAAG;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GAAG,CAChD;IAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAClF;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAC/G,CAAA;AACD,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GACvH;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AACzC,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IACjC,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAC9G"}

package/dist/dsh/models/vendor/auth-contract.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-contract.js.map

package/dist/dsh/models/vendor/auth-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-contract.js","sourceRoot":"","sources":["../../../../src/dsh/models/vendor/auth-contract.ts"],"names":[],"mappings":""}

package/dist/dsh/models/vendor/credentials.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Auth-owned credential persistence, structurally compatible with pi stores, over
+ * one JSON document, one credential per provider id.
+ *
+ * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
+ * permissions best-effort on every platform. All mutations go through
+ * {@link CredentialFile.modify}, which serializes read-modify-write cycles
+ * across processes — pi-ai runs its OAuth refresh *inside* `modify`, so the
+ * exclusion keeps concurrent requests from double-refreshing a rotated
+ * token. The file is the single source of truth;
+ * nothing here ever logs token material, and {@link CredentialFile.describe}
+ * reports only non-secret metadata for status surfaces.
+ *
+ * @module dsh-auth/credentials
+ */
+import type { StoredCredential, CredentialInfo } from './auth-contract.js';
+export type { StoredOAuthCredential, StoredApiKeyCredential } from './auth-contract.js';
+/** Narrow an unknown parsed value into a stored credential, or reject it. */
+export declare function asStoredCredential(value: unknown): StoredCredential | undefined;
+/** Default credential file location: `$DSH_HOME/dsh-auth/credentials.json` (or `~/.dsh/…`). */
+export declare function defaultCredentialsFile(): string;
+/**
+ * The credential file. IO failures throw (loud, naming the path) rather than
+ * degrading to an empty store: silently treating a corrupt or unreadable
+ * credential file as "signed out everywhere" would strand every route behind
+ * a fresh login for no reason.
+ */
+export declare class CredentialFile {
+    readonly path: string;
+    /** Serialize all updates in this process; the file lock covers other processes. */
+    private chainTail;
+    constructor(path: string);
+    /** The stored credential for one provider, possibly expired. */
+    read(providerId: string): Promise<StoredCredential | undefined>;
+    /** Stored credential metadata without resolving or exposing secrets. */
+    list(): Promise<readonly CredentialInfo[]>;
+    /**
+     * Serialized read-modify-write for one provider. `fn` sees the current
+     * credential; returning a new credential persists it, returning
+     * `undefined` leaves the entry unchanged. Resolves with the post-write
+     * credential. Rejections from `fn` propagate without touching the file.
+     */
+    modify(providerId: string, fn: (current: StoredCredential | undefined) => Promise<StoredCredential | undefined>): Promise<StoredCredential | undefined>;
+    /** Remove one provider's credential (logout). */
+    delete(providerId: string): Promise<void>;
+    /** Non-secret metadata for every stored credential, for status surfaces. */
+    describe(): Promise<readonly {
+        provider: string;
+        credentialKind: 'oauth-token' | 'api-key';
+        expiresAt: number | undefined;
+        expired: boolean;
+    }[]>;
+    /** Hold a process-wide lock through reread, refresh/mutation, and atomic save. */
+    private withLock;
+    private load;
+    private save;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/dsh/models/vendor/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../src/dsh/models/vendor/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC1E,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAQvF,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAY/E;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,IAAI,MAAM,CAK/C;AAID;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,mFAAmF;IACnF,OAAO,CAAC,SAAS,CAAmC;gBAExC,IAAI,EAAE,MAAM;IAIxB,gEAAgE;IAC1D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAIrE,wEAAwE;IAClE,IAAI,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAQhD;;;;;OAKG;IACG,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,KAAK,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,GACnF,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAcxC,iDAAiD;IAC3C,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C,4EAA4E;IACtE,QAAQ,IAAI,OAAO,CAAC,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,aAAa,GAAG,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAiBtJ,kFAAkF;YACpE,QAAQ;YA+BR,IAAI;YAwCJ,IAAI;CAYnB"}