@agi-fans/dsh-tui 0.20.0 → 0.22.0

package/lib/commands/auth-input.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Parsing and validation for credential and provider input.
+ *
+ * These functions used to live beside the login flows in `commands/auth.ts`,
+ * which made that file 1265 lines and mixed three jobs: turning what the reader
+ * typed into a value, discovering which providers exist, and orchestrating a
+ * login. Only the first is pure — no `Context`, no terminal, no credential
+ * store — so it is the part that can be read and tested on its own.
+ *
+ * @module @agi-fans/dsh-tui/commands/auth-input
+ */
+import { type CredentialRef } from '@deepseek-ai/dsh-credentials';
+import { CUSTOM_PROVIDER_VALUE } from './auth-ids.ts';
+export { CUSTOM_PROVIDER_VALUE };
+/** DeepSeek's own API-key console. */
+export declare const DEEPSEEK_API_KEYS_URL = "https://platform.deepseek.com/api_keys";
+/** The listing used to validate a key without reading its body. */
+export declare const DEEPSEEK_MODELS_URL = "https://api.deepseek.com/v1/models";
+/** Protocols a custom provider may speak. */
+export declare const CUSTOM_PROTOCOLS: readonly ["openai-completions", "openai-responses", "anthropic-messages"];
+/** Match DeepSeek's own login normalization without accepting an empty Bearer value. */
+export declare function normalizeDeepSeekApiKey(raw: string): string;
+/** Trim a pasted key and reject an empty Bearer value. */
+export declare function normalizeApiKey(raw: string, providerLabel: string): string;
+/** omdsh-managed credential reference for one catalog provider route. */
+export declare function managedProviderCredentialRef(provider: string): CredentialRef;
+/** Lowercase kebab-case route id used as the permanent provider key. */
+export declare function parseProviderId(raw: string): string;
+/** Absolute http(s) prefix the adapter will call. */
+export declare function parseBaseURL(raw: string): string;
+/** One or more model ids from a comma- or whitespace-separated list. */
+export declare function parseModelIds(raw: string): string[];
+/** Validate a candidate without ever reading or returning a response body. */
+export declare function validateDeepSeekApiKey(apiKey: string, signal: AbortSignal, fetchImpl?: typeof fetch): Promise<void>;

package/lib/commands/auth-input.js

@@ -0,0 +1,96 @@
+/**
+ * Parsing and validation for credential and provider input.
+ *
+ * These functions used to live beside the login flows in `commands/auth.ts`,
+ * which made that file 1265 lines and mixed three jobs: turning what the reader
+ * typed into a value, discovering which providers exist, and orchestrating a
+ * login. Only the first is pure — no `Context`, no terminal, no credential
+ * store — so it is the part that can be read and tested on its own.
+ *
+ * @module @agi-fans/dsh-tui/commands/auth-input
+ */
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+import { CUSTOM_PROVIDER_VALUE } from "./auth-ids.js";
+export { CUSTOM_PROVIDER_VALUE };
+/** DeepSeek's own API-key console. */
+export const DEEPSEEK_API_KEYS_URL = 'https://platform.deepseek.com/api_keys';
+/** The listing used to validate a key without reading its body. */
+export const DEEPSEEK_MODELS_URL = 'https://api.deepseek.com/v1/models';
+/** Accepted provider ids: lowercase kebab-case, starting with a letter. */
+const PROVIDER_ID = /^[a-z][a-z0-9-]*$/u;
+/** Protocols a custom provider may speak. */
+export const CUSTOM_PROTOCOLS = ['openai-completions', 'openai-responses', 'anthropic-messages'];
+/** Match DeepSeek's own login normalization without accepting an empty Bearer value. */
+export function normalizeDeepSeekApiKey(raw) {
+    return normalizeApiKey(raw, 'DeepSeek');
+}
+/** Trim a pasted key and reject an empty Bearer value. */
+export function normalizeApiKey(raw, providerLabel) {
+    const normalized = raw.trim().replace(/^bearer\b\s*/iu, '');
+    if (normalized === '')
+        throw new Error(`Paste a non-empty ${providerLabel} API key.`);
+    return normalized;
+}
+/** omdsh-managed credential reference for one catalog provider route. */
+export function managedProviderCredentialRef(provider) {
+    return credentialRef(`OMDSH_${provider.toUpperCase().replace(/[^A-Z0-9]+/gu, '_')}_API_KEY`);
+}
+/** Lowercase kebab-case route id used as the permanent provider key. */
+export function parseProviderId(raw) {
+    const id = raw.trim().toLowerCase();
+    if (!PROVIDER_ID.test(id)) {
+        throw new Error('Provider id must start with a letter and use only lowercase letters, digits, and hyphens.');
+    }
+    if (id === 'custom' || id === CUSTOM_PROVIDER_VALUE) {
+        throw new Error('Choose a different provider id.');
+    }
+    return id;
+}
+/** Absolute http(s) prefix the adapter will call. */
+export function parseBaseURL(raw) {
+    const value = raw.trim().replace(/\/+$/u, '');
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error('Base URL must be an absolute http or https URL.');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error('Base URL must be an http or https URL.');
+    }
+    return value;
+}
+/** One or more model ids from a comma- or whitespace-separated list. */
+export function parseModelIds(raw) {
+    const ids = [...new Set(raw.split(/[,\s]+/u).map(item => item.trim()).filter(item => item !== ''))];
+    if (ids.length === 0)
+        throw new Error('Enter at least one model id.');
+    return ids;
+}
+/** Validate a candidate without ever reading or returning a response body. */
+export async function validateDeepSeekApiKey(apiKey, signal, fetchImpl = globalThis.fetch) {
+    let response;
+    try {
+        response = await fetchImpl(DEEPSEEK_MODELS_URL, {
+            method: 'GET',
+            headers: {
+                accept: 'application/json',
+                authorization: `Bearer ${apiKey}`,
+            },
+            signal,
+        });
+    }
+    catch {
+        if (signal.aborted)
+            throw new Error('DeepSeek login was cancelled.');
+        throw new Error('Could not reach DeepSeek to validate the API key. Check your network and try again.');
+    }
+    if (response.ok)
+        return;
+    if (response.status === 401 || response.status === 403) {
+        throw new Error('DeepSeek rejected this API key. Copy a valid key from the DeepSeek dashboard and try again.');
+    }
+    throw new Error(`DeepSeek could not validate the API key (HTTP ${response.status}). Try again later.`);
+}
+//# sourceMappingURL=auth-input.js.map

package/lib/commands/auth-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-input.js","sourceRoot":"","sources":["../../src/commands/auth-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAsB,MAAM,8BAA8B,CAAA;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAErD,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC,sCAAsC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,wCAAwC,CAAA;AAC7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,oCAAoC,CAAA;AAEvE,2EAA2E;AAC3E,MAAM,WAAW,GAAG,oBAAoB,CAAA;AAExC,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,CAAU,CAAA;AAEzG,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,OAAO,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;AACzC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,aAAqB;IAChE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,aAAa,WAAW,CAAC,CAAA;IACrF,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,OAAO,aAAa,CAAC,SAAS,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;AAC9F,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACnC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAA;IAC9G,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,qBAAqB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IAC7C,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;IACnG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACrE,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,MAAmB,EACnB,YAA0B,UAAU,CAAC,KAAK;IAE1C,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACpE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAM;IACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAA;IAChH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAA;AACxG,CAAC"}

package/lib/commands/auth-providers.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Which providers omdsh can sign in to, and how they are classified.
+ *
+ * `commands/auth.ts` was 1265 lines because it held three jobs at once: what the
+ * reader typed (now `auth-input.ts`), which providers exist, and the login flows
+ * themselves. This module is the middle one. It reads the Harness roster and the
+ * authorization registry and answers questions about it — "what may be listed",
+ * "what is this flow", "does this provider have a stored profile" — without
+ * showing anything or changing anything.
+ *
+ * Keeping it separate matters for the same reason the whole TUI is being thinned:
+ * a provider rule that lives inside a login prompt can only be tested by driving
+ * a terminal. Every function here is a plain Context query.
+ *
+ * @module @agi-fans/dsh-tui/commands/auth-providers
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { AuthorizationEntry } from '@deepseek-ai/dsh-authorization';
+import { type CredentialKey } from '@deepseek-ai/dsh-credentials';
+import type { LlmConfigurableProvider } from '@deepseek-ai/dsh-llm';
+export declare function isDeepSeek(entry: LlmConfigurableProvider): boolean;
+export declare function isPiAiLoginable(entry: LlmConfigurableProvider): boolean;
+export declare function providerListId(entry: LlmConfigurableProvider): string;
+export declare function fallbackDeepSeekEntry(): LlmConfigurableProvider;
+export declare function loginableProviders(ctx: Context): LlmConfigurableProvider[];
+export declare function authorizationFlows(ctx: Context): readonly AuthorizationEntry[];
+export declare function isPiAiDeepSeekFlow(flow: AuthorizationEntry): boolean;
+export declare function isAccountFlow(flow: AuthorizationEntry): boolean;
+export declare function loginAuthorizationFlows(ctx: Context): readonly AuthorizationEntry[];
+export declare function catalogAuthorizationFlow(ctx: Context, provider: string): AuthorizationEntry | undefined;
+export declare function catalogProvidersWithoutFlows(ctx: Context): LlmConfigurableProvider[];
+export declare function flowChoiceValue(key: CredentialKey): string;
+export declare function parseFlowChoice(raw: string): CredentialKey | undefined;
+export declare function sectionValue(ctx: Context, namespace: string): unknown;
+export declare function walkPath(root: unknown, path: readonly string[]): unknown;
+export declare function profileApiKeyEnv(ctx: Context, entry: LlmConfigurableProvider): string | undefined;
+export declare function hasStoredProfile(ctx: Context, entry: LlmConfigurableProvider): boolean;
+export declare function logoutableProviders(ctx: Context): LlmConfigurableProvider[];
+export declare function catalogForRecord(ctx: Context, key: CredentialKey): LlmConfigurableProvider | undefined;

package/lib/commands/auth-providers.js

@@ -0,0 +1,125 @@
+/**
+ * Which providers omdsh can sign in to, and how they are classified.
+ *
+ * `commands/auth.ts` was 1265 lines because it held three jobs at once: what the
+ * reader typed (now `auth-input.ts`), which providers exist, and the login flows
+ * themselves. This module is the middle one. It reads the Harness roster and the
+ * authorization registry and answers questions about it — "what may be listed",
+ * "what is this flow", "does this provider have a stored profile" — without
+ * showing anything or changing anything.
+ *
+ * Keeping it separate matters for the same reason the whole TUI is being thinned:
+ * a provider rule that lives inside a login prompt can only be tested by driving
+ * a terminal. Every function here is a plain Context query.
+ *
+ * @module @agi-fans/dsh-tui/commands/auth-providers
+ */
+import { credentialKey, credentialKeyId, credentialKeyScope, isCredentialKeySegment, parseCredentialKey, } from '@deepseek-ai/dsh-credentials';
+import { DEEPSEEK_API_KEY, DEEPSEEK_PROVIDER, FLOW_VALUE_PREFIX, PI_AI_RECORD_SCOPE, PI_AI_SETTINGS, } from "./auth-ids.js";
+export function isDeepSeek(entry) {
+    return entry.provider === DEEPSEEK_PROVIDER;
+}
+export function isPiAiLoginable(entry) {
+    return entry.settingsNs === 'llm-pi-ai' && entry.provider !== 'deepseek';
+}
+export function providerListId(entry) {
+    return isDeepSeek(entry) ? 'DeepSeek' : entry.provider;
+}
+export function fallbackDeepSeekEntry() {
+    return {
+        provider: DEEPSEEK_PROVIDER,
+        displayName: 'DeepSeek',
+        settingsNs: 'llm-deepseek',
+        settingsPath: [],
+    };
+}
+export function loginableProviders(ctx) {
+    const listed = ctx.llm.listConfigurableProviders();
+    const loginable = listed.filter(entry => isDeepSeek(entry) || isPiAiLoginable(entry));
+    return loginable.length > 0 ? loginable : [fallbackDeepSeekEntry()];
+}
+export function authorizationFlows(ctx) {
+    return ctx.get('authorization')?.list() ?? [];
+}
+export function isPiAiDeepSeekFlow(flow) {
+    return credentialKeyScope(flow.key) === PI_AI_RECORD_SCOPE && credentialKeyId(flow.key) === 'deepseek';
+}
+export function isAccountFlow(flow) {
+    return credentialKeyScope(flow.key) === 'deepseek-account-platform';
+}
+export function loginAuthorizationFlows(ctx) {
+    return authorizationFlows(ctx).flatMap(flow => {
+        if (isAccountFlow(flow))
+            return [];
+        if (!isPiAiDeepSeekFlow(flow))
+            return [flow];
+        const profile = walkPath(sectionValue(ctx, PI_AI_SETTINGS), ['providers', 'deepseek']);
+        if (typeof profile !== 'object' || profile === null || Array.isArray(profile))
+            return [];
+        return [{ ...flow, label: 'DeepSeek (pi-ai compatibility)' }];
+    });
+}
+export function catalogAuthorizationFlow(ctx, provider) {
+    const authorization = ctx.get('authorization');
+    if (authorization === undefined || !isCredentialKeySegment(provider))
+        return undefined;
+    return authorization.describe(credentialKey(PI_AI_RECORD_SCOPE, provider));
+}
+export function catalogProvidersWithoutFlows(ctx) {
+    return loginableProviders(ctx).filter(entry => isDeepSeek(entry) || catalogAuthorizationFlow(ctx, entry.provider) === undefined);
+}
+export function flowChoiceValue(key) {
+    return FLOW_VALUE_PREFIX + key;
+}
+export function parseFlowChoice(raw) {
+    if (!raw.startsWith(FLOW_VALUE_PREFIX))
+        return undefined;
+    try {
+        return parseCredentialKey(raw.slice(FLOW_VALUE_PREFIX.length));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function sectionValue(ctx, namespace) {
+    // A provider's configured fields are the live volatile config of its own
+    // profile entry, so the roster reads the same values a form would show.
+    return ctx.settings.describe().find(row => String(row.ns) === namespace)?.value;
+}
+export function walkPath(root, path) {
+    let cursor = root;
+    for (const key of path) {
+        if (typeof cursor !== 'object' || cursor === null || Array.isArray(cursor))
+            return undefined;
+        cursor = cursor[key];
+    }
+    return cursor;
+}
+export function profileApiKeyEnv(ctx, entry) {
+    const profile = walkPath(sectionValue(ctx, entry.settingsNs), entry.settingsPath);
+    if (isDeepSeek(entry)) {
+        if (typeof profile !== 'object' || profile === null || Array.isArray(profile))
+            return String(DEEPSEEK_API_KEY);
+        const apiKeyEnv = profile['apiKeyEnv'];
+        return typeof apiKeyEnv === 'string' && apiKeyEnv.trim() !== '' ? apiKeyEnv : String(DEEPSEEK_API_KEY);
+    }
+    if (typeof profile !== 'object' || profile === null || Array.isArray(profile))
+        return undefined;
+    const apiKeyEnv = profile['apiKeyEnv'];
+    return typeof apiKeyEnv === 'string' && apiKeyEnv.trim() !== '' ? apiKeyEnv : undefined;
+}
+export function hasStoredProfile(ctx, entry) {
+    if (isDeepSeek(entry))
+        return true;
+    const profile = walkPath(sectionValue(ctx, entry.settingsNs), entry.settingsPath);
+    return typeof profile === 'object' && profile !== null && !Array.isArray(profile);
+}
+export function logoutableProviders(ctx) {
+    return loginableProviders(ctx).filter(entry => isDeepSeek(entry) || hasStoredProfile(ctx, entry));
+}
+export function catalogForRecord(ctx, key) {
+    const id = credentialKeyId(key);
+    const scope = credentialKeyScope(key);
+    return loginableProviders(ctx).find(entry => entry.provider === id && entry.settingsNs === scope);
+}
+//# sourceMappingURL=auth-providers.js.map

package/lib/commands/auth-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.js","sourceRoot":"","sources":["../../src/commands/auth-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EACL,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,GAEnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAA;AAEtB,MAAM,UAAU,UAAU,CAAC,KAA8B;IACvD,OAAO,KAAK,CAAC,QAAQ,KAAK,iBAAiB,CAAA;AAC7C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA8B;IAC5D,OAAO,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA8B;IAC3D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,QAAQ,EAAE,iBAAiB;QAC3B,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,cAAc;QAC1B,YAAY,EAAE,EAAE;KACjB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAA;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IACrF,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,OAAO,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,kBAAkB,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,UAAU,CAAA;AACxG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,2BAA2B,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC5C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAA;QAClC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAA;QAE5C,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAA;QACtF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAA;QACxF,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAY,EAAE,QAAgB;IACrE,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9C,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACtF,OAAO,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAA;AAClI,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAkB;IAChD,OAAO,iBAAiB,GAAG,GAAG,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,SAAS,CAAA;IACxD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY,EAAE,SAAiB;IAC1D,yEAAyE;IACzE,wEAAwE;IACxE,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,EAAE,KAAK,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAa,EAAE,IAAuB;IAC7D,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAA;QAC5F,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,KAA8B;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACjF,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC9G,MAAM,SAAS,GAAI,OAAmC,CAAC,WAAW,CAAC,CAAA;QACnE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACxG,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/F,MAAM,SAAS,GAAI,OAAmC,CAAC,WAAW,CAAC,CAAA;IACnE,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AACzF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,KAA8B;IAC3E,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACjF,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,GAAkB;IAC/D,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,CAAA;AACnG,CAAC"}

package/lib/commands/auth.d.ts

@@ -1,38 +1,32 @@
 /** Interactive credential commands backed by the Harness credential and settings seams. */
 import type { Context } from '@deepseek-ai/cordis';
-import { type CredentialRef } from '@deepseek-ai/dsh-credentials';
+import { type CredentialKey, type CredentialRef } from '@deepseek-ai/dsh-credentials';
 import type { LlmConfigurableProvider } from '@deepseek-ai/dsh-llm';
+import { CUSTOM_PROTOCOLS, CUSTOM_PROVIDER_VALUE, DEEPSEEK_API_KEYS_URL, DEEPSEEK_MODELS_URL, managedProviderCredentialRef, normalizeApiKey, normalizeDeepSeekApiKey, parseBaseURL, parseModelIds, parseProviderId, validateDeepSeekApiKey } from './auth-input.ts';
+export { CUSTOM_PROTOCOLS, CUSTOM_PROVIDER_VALUE, DEEPSEEK_API_KEYS_URL, DEEPSEEK_MODELS_URL, managedProviderCredentialRef, normalizeApiKey, normalizeDeepSeekApiKey, parseBaseURL, parseModelIds, parseProviderId, validateDeepSeekApiKey, };
 export declare const name = "omdsh-command-auth";
 export declare const inject: string[];
 export interface Config {
     /** Open the DeepSeek API-key dashboard when `/login` starts for DeepSeek. */
     openDashboard?: boolean;
+    /** Open the browser for a DeepSeek account sign-in. Defaults to true. */
+    openBrowser?: boolean;
 }
 export declare const DEEPSEEK_PROVIDER = "deepseek-official";
 export declare const DEEPSEEK_API_KEY: CredentialRef;
-export declare const OMDSH_DEEPSEEK_API_KEY: CredentialRef;
 export declare const DEEPSEEK_SETTINGS = "llm-deepseek";
 export declare const PI_AI_SETTINGS = "llm-pi-ai";
-export declare const DEEPSEEK_API_KEYS_URL = "https://platform.deepseek.com/api_keys";
-export declare const DEEPSEEK_MODELS_URL = "https://api.deepseek.com/v1/models";
-export declare const CUSTOM_PROVIDER_VALUE = "__omdsh_custom__";
+/** Sentinel the provider picker returns for "sign in to the DeepSeek account". */
+export declare const DEEPSEEK_ACCOUNT_CHOICE = "__omdsh_deepseek_account__";
+/** Prefix a picker value carries when it names an authorization flow. */
 export declare const FLOW_VALUE_PREFIX = "__omdsh_flow__:";
-/** Match DeepSeek's own login normalization without accepting an empty Bearer value. */
-export declare function normalizeDeepSeekApiKey(raw: string): string;
-/** Trim a pasted key and reject an empty Bearer value. */
-export declare function normalizeApiKey(raw: string, providerLabel: string): string;
-/** omdsh-managed credential reference for one catalog provider route. */
-export declare function managedProviderCredentialRef(provider: string): CredentialRef;
-/** Lowercase kebab-case route id used as the permanent provider key. */
-export declare function parseProviderId(raw: string): string;
-/** Absolute http(s) prefix the adapter will call. */
-export declare function parseBaseURL(raw: string): string;
-/** One or more model ids from a comma- or whitespace-separated list. */
-export declare function parseModelIds(raw: string): string[];
-/** Validate a candidate without ever reading or returning a response body. */
-export declare function validateDeepSeekApiKey(apiKey: string, signal: AbortSignal, fetchImpl?: typeof fetch): Promise<void>;
-/** Picker labels are route ids; the official adapter keeps the DeepSeek product name. */
-export declare function providerListId(entry: LlmConfigurableProvider): string;
-/** Best-effort browser launch; the prompt always retains the full URL as a fallback. */
+interface FlowRecordLogout {
+    key: CredentialKey;
+    label: string;
+    writable: boolean;
+}
+type LogoutChoice = LlmConfigurableProvider | FlowRecordLogout | typeof DEEPSEEK_ACCOUNT_CHOICE;
+export declare function isFlowRecordLogout(choice: LogoutChoice): choice is FlowRecordLogout;
+/** Best-effort browser launch for the DeepSeek key dashboard. */
 export declare function openDeepSeekDashboard(): void;
 export declare function apply(ctx: Context, config?: Config): void;