@askdkc/dsh-cli 0.11.3

package/node_modules/@askdkc/dsh-auth/lib/service.d.ts

@@ -0,0 +1,80 @@
+/**
+ * The `ctx.dshAuth` service: the programmatic surface over this plugin's
+ * mounted provider routes. UIs (the dsh-tui /provider wizard, a web settings
+ * page) enumerate providers with masked sign-in state and drive login/logout
+ * without touching the credential file or the pi-ai flow objects; the `/auth`
+ * command in `command.ts` is a thin textual veneer over the same api.
+ *
+ * @module dsh-auth/service
+ */
+import { Service } from '@deepseek-ai/cordis';
+import type { Context } from '@deepseek-ai/cordis';
+import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+import { asStoredCredential, CredentialFile } from './credentials.js';
+import { type AskFn } from './interaction.js';
+/** One provider's sign-in state; never carries token material. */
+export interface DshAuthSignInStatus {
+    provider: string;
+    /** Route display name (selectors, pickers). */
+    label: string;
+    /** The OAuth flow's own name, e.g. "OpenAI (ChatGPT Plus/Pro)". */
+    oauthLabel: string;
+    /** The flow's login-call-to-action label, when it ships one. */
+    loginLabel: string | undefined;
+    authMethods: readonly ('oauth' | 'api-key' | 'device-code' | 'bearer')[];
+    credentialKind: 'oauth-token' | 'api-key' | undefined;
+    signedIn: boolean;
+    expiresAt?: number;
+    /** Signed in, but the stored access token has expired (refresh may still work). */
+    expired: boolean;
+}
+/** The outcome of a successful login. */
+export interface DshAuthLoginResult {
+    provider: string;
+    oauthLabel: string;
+    authMethods: readonly ('oauth' | 'api-key' | 'device-code' | 'bearer')[];
+    credentialKind: 'oauth-token' | 'api-key';
+    expiresAt?: number;
+    modelWarning?: string;
+}
+/** The service api consumed by commands and UIs. */
+export interface DshAuthApi {
+    /** Every mounted provider with masked sign-in state. */
+    providers(): Promise<readonly DshAuthSignInStatus[]>;
+    /**
+     * Run one provider's login. `provider` omitted asks the interactive
+     * surface to choose among providers not currently signed in.
+     * @throws Error when no interactive surface is present, the provider is
+     *   unknown, a login is already running, or the flow itself fails.
+     */
+    login(provider?: string, signal?: AbortSignal): Promise<DshAuthLoginResult>;
+    /** Remove one provider's stored credential; resolves whether one existed. */
+    logout(provider: string): Promise<boolean>;
+    /** Register a callback for successful credential mutations. */
+    onCredentialChange?(listener: (provider: string) => void): () => void;
+    /** Signal that a previously stored credential's model catalog finished loading. */
+    notifyModelsChanged?(provider: string): void;
+}
+/** Cordis service holder; `api` is set by the plugin's apply. */
+export declare class DshAuthService extends Service {
+    api: DshAuthApi | undefined;
+    constructor(ctx: Context);
+}
+/** Everything the api factory needs; all cordis surface is injected, so tests run without a host. */
+export interface DshAuthApiDeps {
+    profiles: ReadonlyMap<string, ResolvedPiAiProviderProfile>;
+    store: CredentialFile;
+    /** The interactive ask surface, resolved per call so mounting order never matters. */
+    resolveAsk: () => AskFn | undefined;
+    logger: {
+        warn(message: string): void;
+    };
+    nousClientId?: string;
+    credentialChanged?: (provider: string, credential: ReturnType<typeof asStoredCredential> | undefined) => Promise<void>;
+}
+/**
+ * The api implementation. One login runs per provider at a time (an in-flight
+ * map, not a global lock: providers sign in independently); a second login
+ * attempt for the same provider fails fast instead of stacking two flows.
+ */
+export declare function createDshAuthApi(deps: DshAuthApiDeps): DshAuthApi;

package/node_modules/@askdkc/dsh-auth/lib/service.js

@@ -0,0 +1,224 @@
+/**
+ * The `ctx.dshAuth` service: the programmatic surface over this plugin's
+ * mounted provider routes. UIs (the dsh-tui /provider wizard, a web settings
+ * page) enumerate providers with masked sign-in state and drive login/logout
+ * without touching the credential file or the pi-ai flow objects; the `/auth`
+ * command in `command.ts` is a thin textual veneer over the same api.
+ *
+ * @module dsh-auth/service
+ */
+import { Service } from '@deepseek-ai/cordis';
+import { asStoredCredential } from './credentials.js';
+import { canonicalProvider, oauthOf } from './profiles.js';
+import { QuestionBridge } from './interaction.js';
+import { loginNous } from './nous-oauth.js';
+/**
+ * The constructed catalog provider one mounted route carries. 0.1.5 made
+ * `ResolvedPiAiProviderProfile.piProvider` optional (a stored route that
+ * cannot be constructed stays editable without one); this plugin mounts only
+ * constructible routes, so an absent provider here is a mount defect —
+ * surfaced loudly rather than as an `undefined` dereference mid-flow.
+ */
+function mountedProvider(profile) {
+    if (profile.piProvider === undefined) {
+        throw new Error(`dsh-auth: provider "${profile.provider}" mounted without a constructed catalog provider`);
+    }
+    return profile.piProvider;
+}
+/** Cordis service holder; `api` is set by the plugin's apply. */
+export class DshAuthService extends Service {
+    api;
+    constructor(ctx) {
+        super(ctx, 'dshAuth');
+    }
+}
+/** Select a provider interactively among `candidates`. */
+async function chooseProvider(ask, candidates, signal) {
+    const answer = await ask({
+        questions: [{
+                id: 'dsh-auth-provider',
+                header: 'dsh-auth',
+                question: 'Sign in with which provider?',
+                options: candidates.map(row => ({ label: row.oauthLabel, description: row.provider })),
+            }],
+        signal,
+    });
+    const row = answer.answers[0];
+    const label = row?.selected[0];
+    const chosen = candidates.find(candidate => candidate.oauthLabel === label);
+    if (chosen === undefined)
+        throw new Error('dsh-auth: no provider was chosen');
+    return chosen.provider;
+}
+/**
+ * The api implementation. One login runs per provider at a time (an in-flight
+ * map, not a global lock: providers sign in independently); a second login
+ * attempt for the same provider fails fast instead of stacking two flows.
+ */
+export function createDshAuthApi(deps) {
+    const inflight = new Map();
+    const statusOf = async () => {
+        const described = new Map((await deps.store.describe()).map(row => [row.provider, row]));
+        return [...deps.profiles.entries()].map(([id, profile]) => {
+            const methods = authMethodsOf(id);
+            const oauth = methods.includes('oauth') ? oauthOf(mountedProvider(profile)) : undefined;
+            const row = described.get(id);
+            return {
+                provider: id,
+                label: profile.displayName,
+                oauthLabel: oauth?.name ?? profile.displayName,
+                loginLabel: oauth?.loginLabel,
+                authMethods: methods,
+                credentialKind: row?.credentialKind,
+                signedIn: row !== undefined && !row.expired,
+                ...(row?.expiresAt === undefined ? {} : { expiresAt: row.expiresAt }),
+                expired: row?.expired ?? false,
+            };
+        });
+    };
+    const generations = new Map();
+    const listeners = new Set();
+    const changed = (provider) => {
+        for (const listener of listeners) {
+            try {
+                listener(provider);
+            }
+            catch {
+                deps.logger.warn('dsh-auth: a credential-change subscriber failed');
+            }
+        }
+    };
+    const loginOne = async (provider, ask, signal) => {
+        const profile = deps.profiles.get(provider);
+        if (profile === undefined) {
+            throw new Error(`dsh-auth: unknown provider "${provider}" (mounted: ${[...deps.profiles.keys()].join(', ')})`);
+        }
+        const methods = authMethodsOf(provider);
+        const generation = generations.get(provider) ?? 0;
+        const runAbort = new AbortController();
+        if (signal !== undefined) {
+            if (signal.aborted)
+                runAbort.abort(signal.reason);
+            else
+                signal.addEventListener('abort', () => runAbort.abort(signal.reason), { once: true });
+        }
+        const bridge = new QuestionBridge(ask, runAbort);
+        try {
+            let method = methods[0];
+            if (methods.length > 1) {
+                const answer = await ask({
+                    questions: [{
+                            id: 'dsh-auth-method', header: 'dsh-auth', question: `Sign in to ${profile.displayName} using:`,
+                            options: methods.map(item => ({ label: item })),
+                        }], signal: runAbort.signal,
+                });
+                method = methods.find(item => item === answer.answers[0]?.selected[0]);
+                if (method === undefined)
+                    throw new Error('dsh-auth: no authentication method was chosen');
+            }
+            if (runAbort.signal.aborted)
+                throw new Error('dsh-auth: sign-in cancelled');
+            let credential;
+            if (method === 'oauth') {
+                const oauth = oauthOf(mountedProvider(profile));
+                credential = asStoredCredential(await oauth.login(bridge));
+                if (credential?.type !== 'oauth')
+                    throw new Error(`dsh-auth: the ${oauth.name} flow returned an unusable credential`);
+            }
+            else if (method === 'api-key' || method === 'bearer') {
+                const key = await bridge.prompt({ type: 'secret', message: `Enter ${profile.displayName} ${method === 'bearer' ? 'Bearer token' : 'API key'}` });
+                credential = { type: 'api_key', key };
+            }
+            else if (method === 'device-code' && provider === 'nous') {
+                credential = await loginNous(bridge, deps.nousClientId ?? 'hermes-cli');
+            }
+            else {
+                throw new Error('dsh-auth: device-code authentication is unavailable');
+            }
+            if (credential === undefined)
+                throw new Error('dsh-auth: sign-in returned no credential');
+            if (runAbort.signal.aborted || generation !== (generations.get(provider) ?? 0)) {
+                throw new Error('dsh-auth: sign-in cancelled');
+            }
+            const stored = await deps.store.modify(provider, async () => generation === (generations.get(provider) ?? 0) ? credential : undefined);
+            if (generation !== (generations.get(provider) ?? 0) || stored !== credential) {
+                throw new Error('dsh-auth: sign-in cancelled');
+            }
+            let modelWarning;
+            try {
+                await deps.credentialChanged?.(provider, credential);
+            }
+            catch (error) {
+                modelWarning = error instanceof Error ? error.message : 'model discovery failed';
+            }
+            if (generation !== (generations.get(provider) ?? 0)) {
+                await deps.credentialChanged?.(provider, undefined);
+                throw new Error('dsh-auth: sign-in cancelled');
+            }
+            changed(provider);
+            const expiresAt = credential.type === 'oauth' && provider !== 'openrouter' ? credential.expires : undefined;
+            return { provider, oauthLabel: method === 'oauth' ? oauthOf(mountedProvider(profile)).name : profile.displayName, authMethods: methods,
+                credentialKind: credential.type === 'api_key' || provider === 'openrouter' ? 'api-key' : 'oauth-token',
+                ...(expiresAt === undefined ? {} : { expiresAt }),
+                ...(modelWarning === undefined ? {} : { modelWarning }) };
+        }
+        finally {
+            await bridge.settle();
+        }
+    };
+    return {
+        providers: statusOf,
+        login: async (provider, signal) => {
+            const ask = deps.resolveAsk();
+            let target = provider === undefined ? undefined : canonicalProvider(provider);
+            if (target === undefined) {
+                if (ask === undefined) {
+                    throw new Error('dsh-auth: provider selection needs an interactive surface; name the provider: /auth login <provider>');
+                }
+                const statuses = await statusOf();
+                const candidates = statuses.filter(row => !row.signedIn);
+                if (candidates.length === 0)
+                    throw new Error('dsh-auth: every mounted provider is already signed in');
+                target = await chooseProvider(ask, candidates, signal);
+            }
+            else if (!deps.profiles.has(target)) {
+                throw new Error(`dsh-auth: unknown provider "${target}" (mounted: ${[...deps.profiles.keys()].join(', ')})`);
+            }
+            if (ask === undefined) {
+                throw new Error(`dsh-auth: signing in to "${target}" needs an interactive surface (run inside dsh-tui or the web client); `
+                    + 'this plugin refuses to assume a browser on this machine');
+            }
+            const existing = inflight.get(target);
+            if (existing !== undefined) {
+                throw new Error(`dsh-auth: a login for "${target}" is already running`);
+            }
+            const run = loginOne(target, ask, signal).finally(() => { inflight.delete(target); });
+            inflight.set(target, run);
+            return run;
+        },
+        logout: async (provider) => {
+            const target = canonicalProvider(provider);
+            if (!deps.profiles.has(target)) {
+                throw new Error(`dsh-auth: unknown provider "${provider}" (mounted: ${[...deps.profiles.keys()].join(', ')})`);
+            }
+            generations.set(target, (generations.get(target) ?? 0) + 1);
+            const existed = (await deps.store.read(target)) !== undefined;
+            await deps.store.delete(target);
+            await deps.credentialChanged?.(target, undefined);
+            if (existed)
+                changed(target);
+            return existed;
+        },
+        onCredentialChange: listener => { listeners.add(listener); return () => { listeners.delete(listener); }; },
+        notifyModelsChanged: changed,
+    };
+}
+function authMethodsOf(provider) {
+    if (provider === 'openrouter')
+        return ['oauth', 'api-key'];
+    if (provider === 'nous')
+        return ['device-code', 'bearer'];
+    if (provider === 'opencode' || provider === 'opencode-go' || provider === 'orcarouter' || provider === 'infron')
+        return ['api-key'];
+    return ['oauth'];
+}

package/node_modules/@askdkc/dsh-auth/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@askdkc/dsh-auth",
+  "version": "0.1.0",
+  "description": "Provider authentication and model routes for DeepSeek Harness — no dsh source patch, bundled with dsh-tui",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/askdkc/dsh-auth-fork.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "dsh-plugin.json",
+    "cordis.patch.yml",
+    "README.md",
+    "README.ja.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "engines": {
+    "node": "^22.19 || >=24"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "clean": "node -e \"require('node:fs').rmSync('lib', { recursive: true, force: true })\"",
+    "smoke": "node scripts/smoke.mjs",
+    "verify": "npm run build && npm run smoke"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-attachment": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-user-questions": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-attachment": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-attachment": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/dsh-user-questions": "^0.1.0-rc.6 || ^0.1.1-rc.1 || 0.1.2-alpha.3 || 0.1.2-alpha.4 || 0.1.2-alpha.5 || 0.1.2-rc.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.7-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@types/node": "^22.0.0",
+    "typescript": "^6.0.3"
+  }
+}

package/node_modules/@dsh-std/command/CHANGELOG.md

@@ -0,0 +1,8 @@
+# Changelog
+
+Changes to `@dsh-std/command` are recorded here.
+
+## 0.1.0 (draft)
+
+- Defined portable command trees, arguments, options, catalogs, and invocation.
+- Added owner-aware command resource and runtime capability definitions.

package/node_modules/@dsh-std/command/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DSH Standard contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@dsh-std/command/README.md

@@ -0,0 +1,26 @@
+# @dsh-std/command
+
+English | [中文](README.zh.md)
+
+Named human-command resources and their shared callable Runtime dispatcher.
+
+## Contract
+
+A `Command` resource describes one root command and its nested subcommands. Nodes provide a title, localized titles, description, aliases, positional arguments, options, and child nodes. Arguments may be required, variadic, or restricted to documented values. Options declare every literal spelling and may accept one value.
+
+`CommandRuntime` defines the generic `catalog` and `execute` operations once for every command extension. A runtime adapter joins extensions published by active facets with its authoritative command registry and implements that capability. The execution context id remains opaque to the standard; a DSH adapter maps it to a session. Results contain only the command outcome. Invocation-scoped UI work uses typed clients from `@dsh-std/presentation`.
+
+`commandRuntime()` wraps a consumer-scoped `CapabilityClient` with typed methods, and `commandRuntimeImplementation()` builds the operation dispatcher for an adapter. Consumers and adapters do not repeat operation strings or payload validation.
+
+Presentation clients can build completion trees and forms without importing the owning component. A component such as dsh-codex declares `Command/codex`; its selected facet publishes the handler in its local runtime and never defines a connection-specific method.
+
+Names and aliases are single tokens. Sibling names and aliases, argument names, option spellings, and enumerated values must be unique. A variadic argument must be last.
+
+## Extension points
+
+Fields prefixed with `x-` may carry experimental metadata. Portable clients ignore extensions they do not understand. Incompatible command semantics require a new contract major version rather than redefining an existing field.
+
+## Known Limitations and Deferred Work
+
+- The contract does not define a command-line parser or quoting rules.
+- Dynamic completion is not part of `v1alpha1`; declared values are static.

package/node_modules/@dsh-std/command/README.zh.md

@@ -0,0 +1,28 @@
+# @dsh-std/command
+
+[English](README.md) | 中文
+
+拟议设计见 [Command Resources and Runtime](../../docs/proposals/command.zh.md)。
+
+具名用户命令资源及其共享的可调用 Runtime 分派器。
+
+## 协议
+
+一项 `Command` 资源描述一个根命令及其嵌套子命令。节点可以提供标题、本地化标题、说明、别名、位置参数、选项和子节点。参数可以是必需、可变长或受已声明值限制；选项声明全部字面拼写，并可接收一个值。
+
+`CommandRuntime` 为全部命令 extension 统一定义 `catalog` 与 `execute` 操作。运行时适配器把 active facets 发布的 extension 与自身权威命令注册表关联，并实现该能力。执行上下文 id 对标准保持不透明；DSH 适配器将其映射为会话。结果只包含命令结果；调用作用域内的 UI 操作使用 `@dsh-std/presentation` 的类型化 client。
+
+`commandRuntime()` 用类型化方法包装按消费方隔离的 `CapabilityClient`，`commandRuntimeImplementation()` 为适配器创建操作分派器。消费方与适配器都无需重复操作字符串或载荷校验。
+
+表现客户端无需导入所属 component，即可构建补全树和表单。dsh-codex 之类的 component 声明 `Command/codex`，由选中的 facet 在本地运行时发布 handler；它不定义 connection 专用方法。
+
+名称与别名必须是单个 token。同级名称与别名、参数名、选项拼写和枚举值必须唯一。可变长参数必须位于末尾。
+
+## 扩展点
+
+以 `x-` 开头的字段可以承载实验性元数据。可移植客户端忽略无法理解的扩展。不兼容的命令语义需要新的协议主版本，不能重新定义现有字段。
+
+## 已知限制与暂缓事项
+
+- 协议不定义命令行解析器或引号规则。
+- `v1alpha1` 不包含动态补全；已声明值是静态的。

package/node_modules/@dsh-std/command/lib/index.d.ts

@@ -0,0 +1,144 @@
+import { CapabilityCall, CapabilityClient, CapabilityHandlerContext, CapabilityImplementation } from "@dsh-std/connection";
+import { PresentationClients, PresentationDescriptor } from "@dsh-std/presentation";
+import { ProtocolCatalog, ProtocolDefinition, ProtocolSupport } from "@dsh-std/core";
+import { ManifestDefinitionCatalog, ManifestExtension } from "@dsh-std/manifest";
+//#region src/index.d.ts
+declare const API_VERSION = "commands.dsh/v1alpha1";
+declare const KIND = "Command";
+declare const RUNTIME_KIND = "CommandRuntime";
+/** Stable reference to one declared command path. */
+interface CommandReference {
+  readonly name: string;
+  readonly path?: readonly string[];
+}
+interface CommandValueSpec {
+  readonly value: string;
+  readonly title?: string;
+  readonly titles?: Readonly<Record<string, string>>;
+}
+interface CommandArgumentSpec {
+  readonly name: string;
+  readonly title?: string;
+  readonly titles?: Readonly<Record<string, string>>;
+  readonly required?: boolean;
+  readonly variadic?: boolean;
+  readonly values?: readonly CommandValueSpec[];
+}
+interface CommandOptionSpec {
+  /** Literal spellings such as `--verbose` and `-v`. */
+  readonly names: readonly string[];
+  readonly title: string;
+  readonly titles?: Readonly<Record<string, string>>;
+  readonly value?: CommandArgumentSpec;
+}
+interface CommandNodeSpec {
+  readonly title: string;
+  readonly titles?: Readonly<Record<string, string>>;
+  readonly description?: string;
+  readonly aliases?: readonly string[];
+  readonly arguments?: readonly CommandArgumentSpec[];
+  readonly options?: readonly CommandOptionSpec[];
+  readonly children?: readonly CommandNode[];
+}
+interface CommandNode {
+  readonly name: string;
+  readonly spec: CommandNodeSpec;
+}
+type CommandSpec = CommandNodeSpec;
+type CommandResource = ManifestExtension<CommandSpec>;
+interface CommandOwnerReference {
+  readonly component: string;
+  readonly facet: string;
+  readonly participantId?: string;
+}
+interface CommandDescriptor {
+  readonly name: string;
+  readonly description: string;
+  readonly input?: {
+    readonly hint: string;
+  };
+  readonly owner: CommandOwnerReference;
+  readonly resource: CommandResource;
+  readonly available: boolean;
+  readonly missingPresentation: readonly ProtocolSupport[];
+  readonly issues: readonly {
+    readonly code: string;
+    readonly message: string;
+  }[];
+}
+interface CommandCatalog {
+  readonly apiVersion: typeof API_VERSION;
+  readonly commands: readonly CommandDescriptor[];
+}
+interface CommandCatalogInput {
+  /** Opaque execution context selected by the consuming product. */
+  readonly contextId: string;
+  readonly presentation?: PresentationDescriptor;
+}
+interface CommandExecutionInput extends CommandCatalogInput {
+  readonly line: string;
+}
+interface CommandExecution {
+  readonly apiVersion: typeof API_VERSION;
+  readonly commandId: string;
+  readonly result: {
+    readonly kind: 'success' | 'error';
+    readonly text?: string;
+    readonly sourceEventSeq?: number;
+  };
+}
+type CommandRuntimeCall = {
+  readonly operation: 'catalog';
+  readonly input: CommandCatalogInput;
+  readonly output: CommandCatalog;
+} | {
+  readonly operation: 'execute';
+  readonly input: CommandExecutionInput;
+  readonly output: CommandExecution | undefined;
+};
+interface CommandRuntimeClient {
+  catalog(input: CommandCatalogInput, options?: {
+    readonly signal?: AbortSignal;
+  }): CapabilityCall<CommandCatalog>;
+  execute(input: CommandExecutionInput, options?: {
+    readonly signal?: AbortSignal;
+  }): CapabilityCall<CommandExecution | undefined>;
+}
+interface CommandRuntimeHandler {
+  catalog(input: CommandCatalogInput, context: CapabilityHandlerContext): CommandCatalog | Promise<CommandCatalog>;
+  execute(input: CommandExecutionInput, context: CapabilityHandlerContext): CommandExecution | undefined | Promise<CommandExecution | undefined>;
+}
+interface CommandHandlerInput {
+  readonly rawInput: string;
+}
+interface CommandHandlerContext {
+  readonly signal: AbortSignal;
+  /** Host-bound clients for Presentation agreements active in this invocation. */
+  readonly presentation?: PresentationClients;
+}
+interface CommandHandler {
+  execute(input: CommandHandlerInput, context: CommandHandlerContext): CommandExecution['result'] | Promise<CommandExecution['result']>;
+}
+declare function assertCommandHandler(value: unknown): asserts value is CommandHandler;
+declare const extensionDefinition: Readonly<{
+  apiVersion: "commands.dsh/v1alpha1";
+  kind: "Command";
+  validateMetadata(metadata: {
+    readonly name: string;
+  }): void;
+  validateSpec(value: unknown): void;
+}>;
+/** Host support for accepting and owning Command resource publications. */
+declare const resourceProtocol: ProtocolDefinition;
+declare const resourceSupport: ProtocolSupport;
+/** Callable, resource-keyed command dispatcher implemented once by a Runtime adapter. */
+declare const runtimeProtocol: ProtocolDefinition<unknown, unknown, unknown, unknown>;
+declare const runtimeSupport: ProtocolSupport;
+/** Bind the typed CommandRuntime operations to a consumer-scoped connection client. */
+declare function commandRuntime(client: CapabilityClient): CommandRuntimeClient;
+/** Create the sole Runtime-side dispatcher implementation for every Command resource. */
+declare function commandRuntimeImplementation(participantId: string, handler: CommandRuntimeHandler): CapabilityImplementation;
+declare function register(protocols: ProtocolCatalog, manifest?: ManifestDefinitionCatalog): () => void;
+//#endregion
+export { API_VERSION, CommandArgumentSpec, CommandCatalog, CommandCatalogInput, CommandDescriptor, CommandExecution, CommandExecutionInput, CommandHandler, CommandHandlerContext, CommandHandlerInput, CommandNode, CommandNodeSpec, CommandOptionSpec, CommandOwnerReference, CommandReference, CommandResource, CommandRuntimeCall, CommandRuntimeClient, CommandRuntimeHandler, CommandSpec, CommandValueSpec, KIND, RUNTIME_KIND, assertCommandHandler, commandRuntime, commandRuntimeImplementation, extensionDefinition, register, resourceProtocol, resourceSupport, runtimeProtocol, runtimeSupport };
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@dsh-std/command/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;cAoBa;cACA;cACA;;UAGI;WACN;WACA;;UAGM;WACN;WACA;WACA,SAAS,SAAS;;UAGZ;WACN;WACA;WACA,SAAS,SAAS;WAClB;WACA;WACA,kBAAkB;;UAGZ;;WAEN;WACA;WACA,SAAS,SAAS;WAClB,QAAQ;;UAGF;WACN;WACA,SAAS,SAAS;WAClB;WACA;WACA,qBAAqB;WACrB,mBAAmB;WACnB,oBAAoB;;UAGd;WACN;WACA,MAAM;;KAGL,cAAc;KAEd,kBAAkB,kBAAkB;UAE/B;WACN;WACA;WACA;;UAGM;WACN;WACA;WACA;aAAmB;;WACnB,OAAO;WACP,UAAU;WACV;WACA,8BAA8B;WAC9B;aAA4B;aAAuB;;;UAG7C;WACN,mBAAmB;WACnB,mBAAmB;;UAGb;;WAEN;WACA,eAAe;;UAGT,8BAA8B;WACpC;;UAGM;WACN,mBAAmB;WACnB;WACA;aACE;aACA;aACA;;;KAID;WACG;WAA+B,OAAO;WAA8B,QAAQ;;WAC5E;WAA+B,OAAO;WAAgC,QAAQ;;UAE5E;EACf,QAAQ,OAAO,qBAAqB;aAAqB,SAAS;MAAgB,eAAe;EACjG,QAAQ,OAAO,uBAAuB;aAAqB,SAAS;MAAgB,eAAe;;UAGpF;EACf,QAAQ,OAAO,qBAAqB,SAAS,2BAA2B,iBAAiB,QAAQ;EACjG,QACE,OAAO,uBACP,SAAS,2BACR,+BAA+B,QAAQ;;UAG3B;WACN;;UAGM;WACN,QAAQ;;WAER,eAAe;;UAGT;EACf,QACE,OAAO,qBACP,SAAS,wBACR,6BAA6B,QAAQ;;iBAG1B,qBAAqB,yBAAyB,SAAS;cAM1D,qBAAmB;;;EAGH,iBAAA;aAAW;;EAGlB,aAAA;;;cAMT,kBAAkB;cAuBlB,iBAAiB;;cAMjB,iBAAe;cAKf,gBAAgB;;iBAMb,eAAe,QAAQ,mBAAmB;;iBAY1C,6BACd,uBACA,SAAS,wBACR;iBAYa,SAAS,WAAW,iBAAiB,WAAW"}