@deepseek-ai/dsh-llm-deepseek-account 0.1.7-rc.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,46 @@
+# Bilingual-pair consistency record for README.md (docs/i18n/README.md): per heading
+# section, a hash of its English and Chinese blocks outside code blocks and generated regions.
+# After editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/llm/llm-deepseek-account/README.md
+/:
+  en: 5bbc9f976d7dcfda
+  zh: 5de13a931c992603
+/deepseek-ai-dsh-llm-deepseek-account:
+  en: 8fa1148e0ee9d351
+  zh: 634ec9d79d5ffbf0
+/deepseek-ai-dsh-llm-deepseek-account/summary:
+  en: d859ec7a1db8a41b
+  zh: b05ff7d19cb94667
+/deepseek-ai-dsh-llm-deepseek-account/table-of-contents:
+  en: 23386452a66b2fbd
+  zh: 4cf93c4bf17b3da2
+/deepseek-ai-dsh-llm-deepseek-account/use-this-package:
+  en: 4fde33a269d60030
+  zh: 22e522f4a3e25e8c
+/deepseek-ai-dsh-llm-deepseek-account/understand-the-implementation:
+  en: 695b9c7263f6f3b5
+  zh: 84d5fc9d958c4fe7
+/deepseek-ai-dsh-llm-deepseek-account/further-exploration:
+  en: e8bf99d78aa7035f
+  zh: e4a74d2d48b6d271
+/deepseek-ai-dsh-llm-deepseek-account/model-experience:
+  en: 215e7ba838619b7b
+  zh: a311da3843709f90
+/deepseek-ai-dsh-llm-deepseek-account/model-experience/authenticated-model-requests:
+  en: 5cf024f0d3370159
+  zh: ed480db8f348a42f
+/deepseek-ai-dsh-llm-deepseek-account/model-experience/authenticated-model-requests/what-the-model-sees:
+  en: bd62360e6e6965ab
+  zh: 519626fc34672187
+/deepseek-ai-dsh-llm-deepseek-account/model-experience/authenticated-model-requests/token-effect:
+  en: fecefb75b719c317
+  zh: f0c2322f657c5914
+/deepseek-ai-dsh-llm-deepseek-account/model-experience/authenticated-model-requests/kv-cache-effect:
+  en: 2004df60d997da79
+  zh: a215a6586b44746b
+/deepseek-ai-dsh-llm-deepseek-account/known-limitations-and-deferred-work:
+  en: d5880c883b1b678f
+  zh: bf7a4da24ba75280
+/deepseek-ai-dsh-llm-deepseek-account/known-limitations-and-deferred-work/dev-note:
+  en: 0525041e573e96b6
+  zh: b05ed8d852498e6b

package/README.md

@@ -0,0 +1,79 @@
+---
+description: "DeepSeek account authentication and model discovery."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-llm-deepseek-account
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Register authentication and model discovery for `deepseek-account`. This plugin shares the [Messages transport](../llm-deepseek/README.md) and owns credential resolution and catalog availability.
+
+Authentication resolution returns `x-dsh-auth-token` and a failure callback capturing the same token. HTTP 401 classification and rejection stay in this provider; a rejected older request cannot clear a replacement login.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+<a id="use-this-package"></a>
+## Use this package
+
+Only `deepseekAccount.resolveToken(baseURL)` supplies the token; the account service validates the destination. Signed-out or ineligible requests fail with `ACCOUNT_SIGN_IN_REQUIRED` and discovery returns an empty catalog. The route never falls back to an API key. Other credential lookup errors propagate.
+
+```yaml
+- id: llm-deepseek-account
+  name: '@deepseek-ai/dsh-llm-deepseek-account'
+  config:
+    reasoningEffort: high
+```
+
+An account request HTTP 401 maps to `ACCOUNT_TOKEN_INVALID` independently of the response body. The account service removes the credential only if it still matches the request token. HTTP 403 and other failures do not clear the login. The account module owns task cancellation after sign-out; this plugin does not inspect Agents.
+
+`models` is an independently configurable catalog for this provider; defaults and protocol capabilities come from the shared transport. Discovery does not probe inference endpoints. The settings namespace is the Cordis entry id, or the plugin name without an entry. Product profiles retain the official entry id `llm-deepseek` and use `llm-deepseek-account` for the account route.
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+Registrations and listeners dispose with the plugin. Shared Host wiring supplies attachments, request extensions, anonymous identity, and atomic retry-policy updates; this plugin registers only its own route. No invariant companion is published: discovery derives directly from configuration and credentials without an independent copy.
+
+A failed request the shared transport classifies as `QUOTA` is rewritten to `ACCOUNT_QUOTA` before it leaves this provider, covering an HTTP 402 response and an in-band SSE error alike. The shared transport and the `deepseek-official` route keep `QUOTA`, so the account route's top-up action never appears for an API-key or third-party failure.
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+[LLM streaming](../../../docs/subsystems/llm-streaming.md) · [Messages](../llm-deepseek/README.md)
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Authenticated model requests
+
+#### What the model sees
+
+Requests on `deepseek-account` add no model-visible text from this plugin; the shared Messages transport serializes requests.
+
+#### Token effect
+
+Authentication and discovery add no input tokens; the selected model and request content determine actual usage.
+
+#### KV Cache effect
+
+Credentials and catalog availability do not enter model input; the protocol transport owns request-prefix serialization.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- The catalog is configuration metadata, not remote validation that a model is accepted; actual calls can still fail.
+
+<a id="dev-note"></a>
+### Dev Note
+
+Registration and authentication tests also cover the Loader composition in the shared transport package.

package/README.zh.md

@@ -0,0 +1,79 @@
+---
+description: "DeepSeek 账号 authentication and model discovery."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-llm-deepseek-account
+
+[English](README.md) | 中文
+
+## 概述
+
+为 `deepseek-account` 注册独立的鉴权和模型发现插件。通过 [llm-deepseek](../llm-deepseek/README.zh.md) 共用 Messages 请求实现；本包拥有凭据解析和目录可用性判断。
+
+鉴权解析返回 `x-dsh-auth-token` 和捕获同一 token 的失败回调。HTTP 401 的分类和凭据失效处理由此提供方负责；被拒绝的旧请求不能清除替换后的登录。
+
+## 目录
+
+- [使用此包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [进一步探索](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与后续工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+<a id="use-this-package"></a>
+## 使用此包
+
+账号 token 仅由 `deepseekAccount.resolveToken(baseURL)` 提供，目标地址必须满足账号服务的来源校验。未登录或目标不允许账号鉴权时，请求以 `ACCOUNT_SIGN_IN_REQUIRED` 失败，目录为空；不会回退到 API key。其他凭据查询错误继续向调用者报告。
+
+```yaml
+- id: llm-deepseek-account
+  name: '@deepseek-ai/dsh-llm-deepseek-account'
+  config:
+    reasoningEffort: high
+```
+
+账号请求的 HTTP 401 与响应正文无关：映射为 `ACCOUNT_TOKEN_INVALID`，并要求账号服务仅在当前 token 仍与请求所用 token 相同时清除凭据。403 和其他错误不会触发清除。账号模块负责退登后打断任务，本插件不遍历 Agent。
+
+`models` 是该 provider 独立的可配置目录；默认值和协议能力来自共享传输包。目录判断不探测推理端点。设置命名空间采用 Cordis entry id，没有 entry 时采用插件名。产品保留 official 的 `llm-deepseek` entry id，账号使用 `llm-deepseek-account`。
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+注册和监听随插件生命周期释放。共享 Host 绑定提供附件访问、请求扩展、匿名标识和重试策略的原子更新；本包只注册自己的路由。无需 invariant companion：目录直接由同一次配置和凭据读取派生，不维护独立副本。
+
+共享传输判定为 `QUOTA` 的失败请求离开本提供方前会被改写为 `ACCOUNT_QUOTA`，HTTP 402 响应与流内 SSE 错误都适用。共享传输与 `deepseek-official` 路由保留 `QUOTA`，因此账号路由的充值操作不会出现在 API Key 或第三方失败上。
+
+<a id="further-exploration"></a>
+## 进一步探索
+
+[LLM streaming](../../../docs/subsystems/llm-streaming.zh.md) · [Messages](../llm-deepseek/README.zh.md)
+
+<a id="model-experience"></a>
+## 模型体验
+
+### 已鉴权的模型请求
+
+#### What the model sees
+
+`deepseek-account` 请求不包含本插件添加的模型可见文本；请求由共享 Messages 传输序列化。
+
+#### Token effect
+
+鉴权和目录过滤不增加输入 token；实际调用的 token 由所选模型与请求内容决定。
+
+#### KV Cache effect
+
+凭据与目录可用性不进入模型输入；协议传输拥有请求前缀的序列化。
+
+## 已知限制与后续工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- 目录是配置元数据，不验证远端是否接受模型；实际调用仍可能失败。
+
+<a id="dev-note"></a>
+### 开发备注
+
+注册与鉴权的测试也覆盖共享传输包中的 Loader 组合场景。

package/lib/index.js

@@ -0,0 +1,62 @@
+import { ACCOUNT_QUOTA_EXCEEDED_CODE, LlmError, QUOTA_EXCEEDED_CODE } from "@deepseek-ai/dsh-llm";
+import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
+import { Config as Config$1, catalogModelInfo, plainOptions, registerDeepSeekProvider, resolveAdapterOptions } from "@deepseek-ai/dsh-llm-deepseek";
+//#region lib/types/config.js
+/** Account providers expose protocol settings without an API-key reference. */
+const Config = Config$1;
+//#endregion
+//#region lib/types/index.js
+const name = "llm-deepseek-account";
+const inject = ["llm"];
+const PROVIDER = "deepseek-account";
+function apply(ctx, config) {
+	const options = () => resolveAdapterOptions(plainOptions(config), launchEnvironmentOf(ctx));
+	options();
+	const resolveAuth = async (connection) => {
+		const account = ctx.get("deepseekAccount");
+		const token = await account?.resolveToken(connection.baseURL);
+		if (token === void 0) throw new LlmError("Sign in to DeepSeek to use the account provider. The request destination must allow account authentication.", "ACCOUNT_SIGN_IN_REQUIRED");
+		return {
+			headers: { "x-dsh-auth-token": token },
+			onRequestError: async (error) => {
+				if (!(error instanceof LlmError)) return error;
+				if (error.code === QUOTA_EXCEEDED_CODE) return new LlmError(error.message, ACCOUNT_QUOTA_EXCEEDED_CODE, {
+					...error.failure,
+					cause: error
+				});
+				if (error.failure.status !== 401) return error;
+				const rejected = new LlmError(error.message, "ACCOUNT_TOKEN_INVALID", {
+					...error.failure,
+					cause: error
+				});
+				try {
+					await account?.rejectToken(token);
+				} catch (_credentialRemovalFailed) {}
+				return rejected;
+			}
+		};
+	};
+	ctx.llm.registerConfigurableProviders([{
+		provider: PROVIDER,
+		displayName: "DeepSeek Account",
+		settingsNs: ctx.fiber.entry?.options.id ?? "llm-deepseek-account",
+		settingsPath: []
+	}]);
+	registerDeepSeekProvider(ctx, PROVIDER, {
+		options,
+		resolveAuth,
+		providerName: "DeepSeek Account",
+		discoverModels: async (provider) => {
+			const connection = options();
+			try {
+				await resolveAuth(connection);
+			} catch (error) {
+				if (error instanceof LlmError && error.code === "ACCOUNT_SIGN_IN_REQUIRED") return [];
+				throw error;
+			}
+			return connection.models.map((model) => catalogModelInfo(provider, model));
+		}
+	});
+}
+//#endregion
+export { Config, apply, inject, name };

package/lib/types/config.d.ts

@@ -0,0 +1,44 @@
+/** Account providers expose protocol settings without an API-key reference. */
+import { Config as ProtocolConfig } from '@deepseek-ai/dsh-llm-deepseek';
+/** Account route configuration; authentication comes exclusively from the account service. */
+export type Config = ProtocolConfig;
+export declare const Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
+    baseURL: import("@deepseek-ai/schemastery").default<string, string, "volatile">;
+    thinking: import("@deepseek-ai/schemastery").default<"enabled" | "disabled", "enabled" | "disabled", "volatile">;
+    reasoningEffort: import("@deepseek-ai/schemastery").default<"low" | "off" | "high" | "max", "low" | "off" | "high" | "max", "volatile">;
+    maxTokens: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    defaultContextWindow: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    models: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, "volatile-defined">;
+    streamIdleTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    maxRequestFilesBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    maxInlineRequestImageBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    maxImagesPerRequest: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    imageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    inlineImageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    imageOffloadCountQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    filesApiTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    fileExpiresAfterSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    fileRefreshMarginSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    fileQuotaCleanupBatch: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    retryPolicy: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, "volatile">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    baseURL: import("@deepseek-ai/schemastery").default<string, string, "volatile">;
+    thinking: import("@deepseek-ai/schemastery").default<"enabled" | "disabled", "enabled" | "disabled", "volatile">;
+    reasoningEffort: import("@deepseek-ai/schemastery").default<"low" | "off" | "high" | "max", "low" | "off" | "high" | "max", "volatile">;
+    maxTokens: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    defaultContextWindow: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    models: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, "volatile-defined">;
+    streamIdleTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    maxRequestFilesBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    maxInlineRequestImageBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    maxImagesPerRequest: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    imageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    inlineImageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    imageOffloadCountQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    filesApiTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    fileExpiresAfterSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    fileRefreshMarginSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    fileQuotaCleanupBatch: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
+    retryPolicy: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, "volatile">;
+}>>, "plain">;
+//# sourceMappingURL=config.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,7 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { Config } from './config.ts';
+export { Config } from './config.ts';
+export declare const name = "llm-deepseek-account";
+export declare const inject: string[];
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@deepseek-ai/dsh-llm-deepseek-account",
+  "description": "DeepSeek account provider authentication and discovery",
+  "version": "0.1.7-rc.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/llm/llm-deepseek-account"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-llm": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-deepseek-account": "0.1.7-rc.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-llm": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-deepseek-account": "0.1.7-rc.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.1.7-rc.2"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-deepseek-account": {
+      "optional": true
+    },
+    "@deepseek-ai/cordis-plugin-loader": {
+      "optional": true
+    }
+  }
+}