@deepseek-ai/dsh-llm-deepseek-account 0.2.1-alpha.2 → 0.2.1-alpha.4

package/README.i18n.yaml

@@ -3,26 +3,26 @@
 # After editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/llm/llm-deepseek-account/README.md
 /:
-  en: 5bbc9f976d7dcfda
-  zh: 5de13a931c992603
+  en: fc1ff226d5dca691
+  zh: 770a99ef368c4767
 /deepseek-ai-dsh-llm-deepseek-account:
   en: 8fa1148e0ee9d351
   zh: 634ec9d79d5ffbf0
 /deepseek-ai-dsh-llm-deepseek-account/summary:
-  en: d859ec7a1db8a41b
-  zh: b05ff7d19cb94667
+  en: b80e34cdfb51009d
+  zh: eda44bcc181793d8
 /deepseek-ai-dsh-llm-deepseek-account/table-of-contents:
   en: 23386452a66b2fbd
   zh: 4cf93c4bf17b3da2
 /deepseek-ai-dsh-llm-deepseek-account/use-this-package:
-  en: 4fde33a269d60030
-  zh: 22e522f4a3e25e8c
+  en: f0ac16310ce5a5c4
+  zh: 6929f80d830c18df
 /deepseek-ai-dsh-llm-deepseek-account/understand-the-implementation:
-  en: c9ba244b5df11b97
-  zh: d8016c03bfcb3eef
+  en: 8e8d8e4f786e03c3
+  zh: 7b32d8cea29d2b1a
 /deepseek-ai-dsh-llm-deepseek-account/further-exploration:
-  en: e8bf99d78aa7035f
-  zh: e4a74d2d48b6d271
+  en: 30a69b9c66d89580
+  zh: fcc026a6373c1bee
 /deepseek-ai-dsh-llm-deepseek-account/model-experience:
   en: 215e7ba838619b7b
   zh: a311da3843709f90
@@ -33,14 +33,14 @@
   en: bd62360e6e6965ab
   zh: 519626fc34672187
 /deepseek-ai-dsh-llm-deepseek-account/model-experience/authenticated-model-requests/token-effect:
-  en: fecefb75b719c317
-  zh: f0c2322f657c5914
+  en: b0f531baf29daf52
+  zh: c89837e35981c318
 /deepseek-ai-dsh-llm-deepseek-account/model-experience/authenticated-model-requests/kv-cache-effect:
-  en: 2004df60d997da79
-  zh: a215a6586b44746b
+  en: db6aea22ebba25e1
+  zh: caf4817596204df4
 /deepseek-ai-dsh-llm-deepseek-account/known-limitations-and-deferred-work:
-  en: d5880c883b1b678f
-  zh: bf7a4da24ba75280
+  en: ee8b7ff23c806e18
+  zh: bd26832c8d455012
 /deepseek-ai-dsh-llm-deepseek-account/known-limitations-and-deferred-work/dev-note:
   en: 0525041e573e96b6
   zh: b05ed8d852498e6b

package/README.md

@@ -1,5 +1,5 @@
 ---
-description: "DeepSeek account authentication and model discovery."
+description: "DeepSeek account authentication, model listing, and model gating."
 kind: "package-reference"
 ---
 
@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-Register authentication and model discovery for `deepseek-account`. This plugin shares the [Messages transport](../llm-deepseek/README.md) and owns credential resolution and catalog availability.
+Register authentication, the account model listing, and model gating for `deepseek-account`. This plugin shares the [Messages transport](../llm-deepseek/README.md) and owns credential resolution, the account catalog, and model admission.
 
 Authentication resolution returns `x-dsh-auth-token` and a failure callback capturing the same token. HTTP 401 classification and rejection stay in this provider; a rejected older request cannot clear a replacement login.
 
@@ -25,30 +25,50 @@ Authentication resolution returns `x-dsh-auth-token` and a failure callback capt
 <a id="use-this-package"></a>
 ## Use this package
 
-Only `deepseekAccount.resolveToken(baseURL)` supplies the token; the account service validates the destination. Signed-out or ineligible requests fail with `ACCOUNT_SIGN_IN_REQUIRED` and discovery returns an empty catalog. The route never falls back to an API key. Other credential lookup errors propagate.
+Only `deepseekAccount.resolveToken(url)` supplies the token; the account service validates the destination. Signed-out or ineligible requests fail with `ACCOUNT_SIGN_IN_REQUIRED` and discovery returns an empty catalog. The route never falls back to an API key. Other credential lookup errors propagate.
+
+The route's catalog comes from the account's `GET /models` listing at the origin of the Messages `baseURL` (`https://api.deepseek.com/models` for the official endpoint); the listing endpoint is not configurable. Listing requests carry the account token in `x-dsh-auth-token` and the harness `User-Agent`, and reject redirects.
+
+The first access of a credential waits for the listing up to `modelsTimeoutMs`. Later accesses use the loaded listing and refresh it in the background once it is older than `modelsMaxAgeMs`. A failed or empty listing keeps the previous one; before any listing loads, the route serves the built-in catalog of the current version (`deepseek-flash` and `deepseek-v4-pro`). A listing HTTP 401 does not remove the stored login. Each loaded listing, the first failure of a failing streak with the catalog it falls back to, and each hidden listing entry are written to the console with the `[llm-deepseek-account]` tag; secrets are never logged. Each account token has its own listing, so the service can roll a model out to some accounts first.
+
+A listed model is offered only when the current DeepSeek Harness version can serve it. A model that declares `client_requirements["deepseek-harness"].min_version` is offered when the current version is at least that version in semantic-version order, including prerelease tags such as `0.2.0-alpha.1` and `0.2.0-rc.1`. A prerelease orders below its release: `min_version: 0.2.1` refuses `0.2.1-alpha.2`, so a listing that admits prereleases declares the earliest one it admits, such as `0.2.1-alpha.0`. A model without that declaration is offered only when the built-in catalog knows its id; other listed models stay hidden. A request for a listed model the current version cannot serve fails before network I/O with `CLIENT_UPGRADE_REQUIRED`, which names the required and current versions, or with `MODEL_UNSUPPORTED`. Model ids the listing does not name pass through unchanged.
+
+Offered models take the listing's name, `context_window`, input modalities, and Messages system prompt mode over the bundled entry for the same id, which keeps its tool-update mode, image budgets, and description. `max_output_tokens` bounds the request default: a request that names no cap sends the smaller of `maxTokens` and that capability. The listing's effort levels are not read; every model offers `off`, `low`, `high`, and `max`.
+
+`modelOverrides` adjusts single models without replacing the catalog. Keys are model ids; values take the fields of a [Messages `models` entry](../llm-deepseek/README.md#minimal-configuration), and unset fields inherit. Overrides apply over the listing and the bundled catalog; they cannot add models or make a refused model available. Listed capabilities do not bound an override: an override `maxTokens` above the listed `max_output_tokens` is sent as written, and the service rejects requests beyond its limits. An override that names a model neither the listing nor the built-in catalog describes, or that the listed model rejects, becomes the provider diagnostic on the Models page, which has no editor for this route. An override for a refused model that the built-in catalog does not describe is checked only once the current version can serve that model. The route has no `models` field; a configuration that still sets it fails at load and names `modelOverrides`. Edit `$DSH_HOME/profiles/<profile>/cordis.patch.yml`; the next request uses the change.
 
 ```yaml
 - id: llm-deepseek-account
   name: '@deepseek-ai/dsh-llm-deepseek-account'
   config:
     reasoningEffort: high
+    modelOverrides:
+      deepseek-flash:
+        contextWindow: 524288
+        maxTokens: 131072
 ```
 
+| Field | Default | Meaning |
+|---|---|---|
+| `modelsTimeoutMs` | `5,000` | Deadline of one listing request and of a first-access wait |
+| `modelsMaxAgeMs` | `600,000` | Listing age after which the next access refreshes it; a failed load retries after the same age |
+| `modelOverrides` | `{}` | Field overrides by model id |
+
 An account request HTTP 401 maps to `ACCOUNT_TOKEN_INVALID` independently of the response body. The account service removes the credential only if it still matches the request token. HTTP 403 and other failures do not clear the login. The account module owns task cancellation after sign-out; this plugin does not inspect Agents.
 
-`models` is an independently configurable catalog for this provider; defaults and protocol capabilities come from the shared transport. Discovery does not probe inference endpoints. The settings namespace is the Cordis entry id, or the plugin name without an entry. Product profiles retain the official entry id `llm-deepseek` and use `llm-deepseek-account` for the account route.
+The settings namespace is the Cordis entry id, or the plugin name without an entry. Product profiles retain the official entry id `llm-deepseek` and use `llm-deepseek-account` for the account route.
 
 <a id="understand-the-implementation"></a>
 ## Understand the implementation
 
-Registrations and listeners dispose with the plugin. Shared Host wiring supplies attachments, request extensions, anonymous identity, and atomic retry-policy updates; this plugin registers only its own route.
+Registrations and listeners dispose with the plugin, and disposal aborts an in-flight listing request. Shared Host wiring supplies attachments, request extensions, anonymous identity, and atomic retry-policy updates; this plugin registers only its own route and uses the transport's `connect` and `admit` hooks for the catalog and the gate. The listing cache lives in memory and is keyed by endpoint and a SHA-256 of the token.
 
 A failed request the shared transport classifies as `QUOTA` is rewritten to `ACCOUNT_QUOTA` before it leaves this provider, covering an HTTP 402 response and an in-band SSE error alike. The shared transport and the `deepseek-official` route keep `QUOTA`, so the account route's top-up action never appears for an API-key or third-party failure.
 
 <a id="further-exploration"></a>
 ## Further Exploration
 
-[LLM streaming](../../../docs/subsystems/llm-streaming.md) · [Messages](../llm-deepseek/README.md)
+[LLM streaming](../../../docs/subsystems/llm-streaming.md) · [Messages](../llm-deepseek/README.md) · [Account catalog decision](../../../.agents/notes/implemented/architecture/2026-09-24-deepseek-account-remote-model-catalog.md)
 
 <a id="model-experience"></a>
 ## Model Experience
@@ -61,17 +81,22 @@ Requests on `deepseek-account` add no model-visible text from this plugin; the s
 
 #### Token effect
 
-Authentication and discovery add no input tokens; the selected model and request content determine actual usage.
+Authentication and the listing add no input tokens. The resolved catalog sets each model's context window and default output cap, which each request's logged context and header record.
 
 #### KV Cache effect
 
-Credentials and catalog availability do not enter model input; the protocol transport owns request-prefix serialization.
+Credentials and catalog availability do not enter model input; the protocol transport owns request-prefix serialization. A catalog change to a model's system prompt mode changes how later system prompt updates are serialized.
 
 ## Known Limitations and Deferred Work
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- The catalog is configuration metadata, not remote validation that a model is accepted; actual calls can still fail.
+- The listing cache lives in memory; a start without network serves bundled capabilities until a listing loads.
+- A listing change during a running process reaches the Web model picker at its next catalog refresh; the plugin does not announce it.
+- The gate runs in this client; a modified client can still request any id unless the service rejects it.
+- The listing's effort levels are ignored.
+- When the current version can serve no listed model, the account offers no models, and model selectors show their generic empty state rather than an upgrade prompt.
+- An override can set but not remove `systemPromptUpdate` and `toolUpdate` declarations.
 
 <a id="dev-note"></a>
 ### Dev Note

package/README.zh.md

@@ -1,5 +1,5 @@
 ---
-description: "DeepSeek 账号 authentication and model discovery."
+description: "DeepSeek 账号鉴权、模型列表与模型门控。"
 kind: "package-reference"
 ---
 
@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-为 `deepseek-account` 注册独立的鉴权和模型发现插件。通过 [llm-deepseek](../llm-deepseek/README.zh.md) 共用 Messages 请求实现；本包拥有凭据解析和目录可用性判断。
+为 `deepseek-account` 注册鉴权、账号模型列表和模型门控。通过 [llm-deepseek](../llm-deepseek/README.zh.md) 共用 Messages 请求实现；本包负责凭据解析、账号目录和模型准入。
 
 鉴权解析返回 `x-dsh-auth-token` 和捕获同一 token 的失败回调。HTTP 401 的分类和凭据失效处理由此提供方负责；被拒绝的旧请求不能清除替换后的登录。
 
@@ -25,30 +25,50 @@ kind: "package-reference"
 <a id="use-this-package"></a>
 ## 使用此包
 
-账号 token 仅由 `deepseekAccount.resolveToken(baseURL)` 提供，目标地址必须满足账号服务的来源校验。未登录或目标不允许账号鉴权时，请求以 `ACCOUNT_SIGN_IN_REQUIRED` 失败，目录为空；不会回退到 API key。其他凭据查询错误继续向调用者报告。
+账号 token 仅由 `deepseekAccount.resolveToken(url)` 提供，目标地址必须通过账号服务的来源校验。未登录或目标不允许账号鉴权时，请求以 `ACCOUNT_SIGN_IN_REQUIRED` 失败，目录为空；不会回退到 API key。其他凭据查询错误继续向调用者报告。
+
+路由的目录来自账号的 `GET /models` 列表，地址为 Messages `baseURL` 的 origin 加 `/models`（官方端点即 `https://api.deepseek.com/models`），不可配置。列表请求用 `x-dsh-auth-token` 携带账号 token，带上 harness 的 `User-Agent`，并拒绝重定向。
+
+同一凭据的第一次访问会等待列表，最长 `modelsTimeoutMs`。之后的访问直接使用已加载的列表，列表超过 `modelsMaxAgeMs` 后在后台刷新。获取失败或得到空列表时保留上一份；还没有加载到任何列表时，路由提供当前版本内置的目录（`deepseek-flash` 与 `deepseek-v4-pro`）。列表请求返回 HTTP 401 不会清除已保存的登录。每次加载成功、连续失败中的第一次失败及其退回的目录、以及每个被隐藏的列表条目，都会以 `[llm-deepseek-account]` 标签写到控制台日志；不记录任何密钥。每个账号 token 有自己的列表，因此服务端可以先对部分账号开放某个模型。
+
+只有当前版本的 DeepSeek Harness 能用的模型才会出现在目录里。声明了 `client_requirements["deepseek-harness"].min_version` 的模型，在当前版本号按 semver 顺序不低于该版本时提供，预发布号（如 `0.2.0-alpha.1`、`0.2.0-rc.1`）同样参与比较。预发布版本低于同号的正式版本：`min_version: 0.2.1` 会拒绝 `0.2.1-alpha.2`，因此要放行预发布版本的列表应声明它允许的最早一个，如 `0.2.1-alpha.0`。没有这个声明的模型，只有内置目录认识它的 id 时才提供；其余列出的模型保持隐藏。请求一个当前版本不能用的已列出模型时，会在网络请求之前失败：`CLIENT_UPGRADE_REQUIRED` 会写明所需版本和当前版本，否则为 `MODEL_UNSUPPORTED`。列表没有列出的模型 id 照常透传。
+
+提供的模型以列表中的名称、`context_window`、输入模态和 Messages system prompt 模式覆盖同 id 的内置条目，内置条目保留工具更新模式、图片预算和描述。`max_output_tokens` 限制请求默认值：请求没有指定上限时，发送 `maxTokens` 与该能力上限中较小的一个。列表中的推理档位不被读取；每个模型都提供 `off`、`low`、`high`、`max`。
+
+`modelOverrides` 调整单个模型而不替换整个目录。键是模型 id；值的字段与 [Messages `models` 条目](../llm-deepseek/README.zh.md#minimal-configuration)相同，未设置的字段沿用下层的值。覆盖作用在列表和内置目录之上；不能新增模型，也不能让被拒绝的模型变得可用。列表声明的能力不约束覆盖：覆盖的 `maxTokens` 高于列表的 `max_output_tokens` 时按覆盖值发送，超出服务端限制的请求由服务端拒绝。覆盖指向的模型既不在列表里、内置目录也不认识，或者被列出的模型拒绝时，会成为模型页上该提供方的诊断信息；模型页不为此路由提供编辑器。被拒绝且内置目录不认识的模型，其覆盖要等当前版本能用该模型时才校验。此路由没有 `models` 字段；配置里仍写了它时，加载即失败并提示改用 `modelOverrides`。修改 `$DSH_HOME/profiles/<profile>/cordis.patch.yml`，下一次请求即生效。
 
 ```yaml
 - id: llm-deepseek-account
   name: '@deepseek-ai/dsh-llm-deepseek-account'
   config:
     reasoningEffort: high
+    modelOverrides:
+      deepseek-flash:
+        contextWindow: 524288
+        maxTokens: 131072
 ```
 
+| 字段 | 默认值 | 含义 |
+|---|---|---|
+| `modelsTimeoutMs` | `5,000` | 单次列表请求以及首次访问等待的上限 |
+| `modelsMaxAgeMs` | `600,000` | 列表超过这个时长后，下一次访问时刷新；获取失败后同样在这个时长后重试 |
+| `modelOverrides` | `{}` | 按模型 id 的字段覆盖 |
+
 账号请求的 HTTP 401 与响应正文无关：映射为 `ACCOUNT_TOKEN_INVALID`，并要求账号服务仅在当前 token 仍与请求所用 token 相同时清除凭据。403 和其他错误不会触发清除。账号模块负责退登后打断任务，本插件不遍历 Agent。
 
-`models` 是该 provider 独立的可配置目录；默认值和协议能力来自共享传输包。目录判断不探测推理端点。设置命名空间采用 Cordis entry id，没有 entry 时采用插件名。产品保留 official 的 `llm-deepseek` entry id，账号使用 `llm-deepseek-account`。
+设置命名空间采用 Cordis entry id，没有 entry 时采用插件名。产品保留 official 的 `llm-deepseek` entry id，账号使用 `llm-deepseek-account`。
 
 <a id="understand-the-implementation"></a>
 ## 理解实现
 
-注册和监听随插件生命周期释放。共享 Host 绑定提供附件访问、请求扩展、匿名标识和重试策略的原子更新；本包只注册自己的路由。
+注册和监听随插件生命周期释放，释放时会中止进行中的列表请求。共享 Host 绑定提供附件访问、请求扩展、匿名标识和重试策略的原子更新；本包只注册自己的路由，并通过传输层的 `connect` 与 `admit` 钩子接入目录和门控。列表缓存只在内存中，以端点和 token 的 SHA-256 为键。
 
 共享传输判定为 `QUOTA` 的失败请求离开本提供方前会被改写为 `ACCOUNT_QUOTA`，HTTP 402 响应与流内 SSE 错误都适用。共享传输与 `deepseek-official` 路由保留 `QUOTA`，因此账号路由的充值操作不会出现在 API Key 或第三方失败上。
 
 <a id="further-exploration"></a>
 ## 进一步探索
 
-[LLM streaming](../../../docs/subsystems/llm-streaming.zh.md) · [Messages](../llm-deepseek/README.zh.md)
+[LLM streaming](../../../docs/subsystems/llm-streaming.zh.md) · [Messages](../llm-deepseek/README.zh.md) · [账号目录决策](../../../.agents/notes/implemented/architecture/2026-09-24-deepseek-account-remote-model-catalog.zh.md)
 
 <a id="model-experience"></a>
 ## 模型体验
@@ -61,17 +81,22 @@ kind: "package-reference"
 
 #### Token effect
 
-鉴权和目录过滤不增加输入 token；实际调用的 token 由所选模型与请求内容决定。
+鉴权和列表不增加输入 token。解析后的目录决定每个模型的上下文窗口和默认输出上限，每次请求记录的上下文与请求头会记下这些值。
 
 #### KV Cache effect
 
-凭据与目录可用性不进入模型输入；协议传输拥有请求前缀的序列化。
+凭据与目录可用性不进入模型输入；协议传输拥有请求前缀的序列化。目录中某个模型的 system prompt 模式变化，会改变之后 system prompt 更新的序列化方式。
 
 ## 已知限制与后续工作
 
 <a id="known-limitations-and-deferred-work"></a>
 
-- 目录是配置元数据，不验证远端是否接受模型；实际调用仍可能失败。
+- 列表缓存只在内存中；没有网络时启动，在加载到列表之前使用内置能力。
+- 进程运行中途的列表变化，要等 Web 模型选择器下一次刷新目录时才会显示；插件不会主动通知。
+- 门控在客户端执行；改过的客户端仍可以请求任意 id，除非服务端拒绝。
+- 列表中的推理档位被忽略。
+- 当前版本能用的已列出模型一个都没有时，账号不提供任何模型，模型选择器显示通用的空状态，而不是升级提示。
+- 覆盖可以设置、但不能移除 `systemPromptUpdate` 与 `toolUpdate` 声明。
 
 <a id="dev-note"></a>
 ### 开发备注

package/lib/index.js

@@ -1,23 +1,457 @@
-import { ACCOUNT_QUOTA_EXCEEDED_CODE, LlmError, QUOTA_EXCEEDED_CODE } from "@deepseek-ai/dsh-llm";
+import { ACCOUNT_QUOTA_EXCEEDED_CODE, APP_IDENTITY, LlmError, QUOTA_EXCEEDED_CODE, attributionHeaders } from "@deepseek-ai/dsh-llm";
 import { launchEnvironmentOf } from "@deepseek-ai/dsh-launch-environment";
-import { Config as Config$1, catalogModelInfo, plainOptions, registerDeepSeekProvider, resolveAdapterOptions } from "@deepseek-ai/dsh-llm-deepseek";
+import { assertNever } from "@deepseek-ai/dsh-util-values";
+import { catalogModelFields, catalogModelInfo, deepSeekConfigFields, registerDeepSeekProvider, resolveAdapterOptions } from "@deepseek-ai/dsh-llm-deepseek";
+import { createHash } from "node:crypto";
+import { MAX_TIMER_DELAY_MS, deadline, timeoutOf } from "@deepseek-ai/dsh-timeout";
+import z from "@deepseek-ai/schemastery";
+import { isVolatile } from "@deepseek-ai/cosmokit";
+import semver from "semver";
+//#region lib/types/listing.js
+/** DeepSeek `GET /models` listing: one authenticated request and per-entry decoding. */
+const LISTED_MODALITIES = ["text", "image"];
+/** Code of a listing deadline's timeout reason; {@link requestModelListing} reports it as `TIMEOUT`. */
+const LISTING_TIMEOUT = "MODEL_LISTING_TIMEOUT";
+function fieldsOf(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/** Listed modalities this build sends, in listing order without repeats; `undefined` when the value is not an array. */
+function knownModalities(value) {
+	if (!Array.isArray(value)) return void 0;
+	const listed = value;
+	return LISTED_MODALITIES.filter((modality) => listed.includes(modality)).toSorted((left, right) => listed.indexOf(left) - listed.indexOf(right));
+}
+/** A declared capacity: `undefined` when absent, `false` when not a positive safe integer. */
+function capacity(value) {
+	if (value === void 0) return void 0;
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : false;
+}
+function requirementOf(entry) {
+	if (entry.client_requirements === void 0) return { kind: "none" };
+	const requirements = fieldsOf(entry.client_requirements);
+	if (requirements === void 0) return { kind: "invalid" };
+	const declared = requirements[APP_IDENTITY.product];
+	if (declared === void 0) return { kind: "none" };
+	const own = fieldsOf(declared);
+	if (own === void 0) return { kind: "invalid" };
+	if (own.min_version === void 0) return { kind: "none" };
+	return typeof own.min_version === "string" && own.min_version.length > 0 ? {
+		kind: "min-version",
+		version: own.min_version
+	} : { kind: "invalid" };
+}
+function capabilitiesOf(entry) {
+	const messages = fieldsOf(fieldsOf(entry.api_capabilities)?.anthropic_messages);
+	if (messages === void 0) return {
+		usable: false,
+		reason: "declares no api_capabilities.anthropic_messages"
+	};
+	if ((entry.output_modalities === void 0 ? ["text"] : knownModalities(entry.output_modalities))?.includes("text") !== true) return {
+		usable: false,
+		reason: "declares no text output"
+	};
+	const inputs = entry.input_modalities === void 0 ? ["text"] : knownModalities(entry.input_modalities);
+	if (inputs === void 0 || inputs.length === 0) return {
+		usable: false,
+		reason: "declares no input modality DeepSeek Harness supports"
+	};
+	const contextWindow = capacity(entry.context_window);
+	const maxOutputTokens = capacity(entry.max_output_tokens);
+	if (contextWindow === false || maxOutputTokens === false) return {
+		usable: false,
+		reason: "declares an invalid context_window or max_output_tokens"
+	};
+	const update = messages.system_prompt_update;
+	return {
+		usable: true,
+		facts: {
+			inputModalities: inputs,
+			...contextWindow === void 0 ? {} : { contextWindow },
+			...maxOutputTokens === void 0 ? {} : { maxOutputTokens },
+			...update === void 0 ? {} : { systemPromptUpdate: update === "in-history" ? "in-history" : "leading-only" }
+		}
+	};
+}
+/**
+* Decode one `/models` body entry by entry.
+* @param body - parsed JSON response.
+* @returns the entries with a usable id, in listing order.
+* @throws LlmError `INVALID_RESPONSE` when the body has no `data` array or no usable entry.
+*/
+function parseModelListing(body) {
+	const data = fieldsOf(body)?.data;
+	if (!Array.isArray(data)) throw new LlmError("DeepSeek model listing has no \"data\" array", "INVALID_RESPONSE");
+	const rows = data;
+	const entries = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const row of rows) {
+		const entry = fieldsOf(row);
+		const id = entry?.id;
+		if (entry === void 0 || typeof id !== "string" || id.length === 0 || seen.has(id)) continue;
+		seen.add(id);
+		entries.push({
+			id,
+			...typeof entry.name === "string" && entry.name.length > 0 ? { name: entry.name } : {},
+			requirement: requirementOf(entry),
+			capabilities: capabilitiesOf(entry)
+		});
+	}
+	if (entries.length === 0) throw new LlmError("DeepSeek model listing contains no model entry", "INVALID_RESPONSE");
+	return {
+		entries,
+		skipped: rows.length - entries.length
+	};
+}
+/**
+* Request and decode one model listing. Redirects fail, so credentials stay on the requested origin.
+* @param url - listing endpoint.
+* @param headers - authentication headers for this endpoint.
+* @param signal - cancellation and deadline of the whole exchange.
+* @returns the decoded listing.
+* @throws LlmError `TIMEOUT` when a {@link LISTING_TIMEOUT} deadline elapses before a complete body, `ABORTED` for
+*   another abort, `TRANSPORT` for a network failure, `HTTP_<status>` for a non-2xx answer,
+*   and `INVALID_RESPONSE` for a body that is not a JSON listing.
+*/
+async function requestModelListing(url, headers, signal) {
+	let response;
+	let text;
+	try {
+		response = await fetch(url, {
+			method: "GET",
+			redirect: "error",
+			signal,
+			headers: {
+				...attributionHeaders(),
+				accept: "application/json",
+				...headers
+			}
+		});
+		text = await response.text();
+	} catch (error) {
+		const expired = timeoutOf(signal, LISTING_TIMEOUT);
+		if (expired !== void 0) throw new LlmError(`DeepSeek model listing request to ${url} timed out after ${expired.timeoutMs} ms`, "TIMEOUT", { cause: error });
+		throw signal.aborted ? new LlmError(`DeepSeek model listing request to ${url} was aborted`, "ABORTED", { cause: error }) : new LlmError(`could not reach ${url}`, "TRANSPORT", { cause: error });
+	}
+	if (!response.ok) throw new LlmError(`${url} answered HTTP ${response.status}`, `HTTP_${response.status}`, { status: response.status });
+	let body;
+	try {
+		body = JSON.parse(text);
+	} catch (error) {
+		throw new LlmError(`${url} did not answer with JSON`, "INVALID_RESPONSE", { cause: error });
+	}
+	return parseModelListing(body);
+}
+//#endregion
+//#region lib/types/catalog.js
+/** Credential-scoped `/models` cache with single-flight loads, background refresh, and last-known-good retention. */
+/** Wait for `task` unless `signal` aborts first; the task keeps running. */
+async function abandonable(task, signal) {
+	if (signal === void 0) return task;
+	const abandoned = Promise.withResolvers();
+	const abandon = () => {
+		abandoned.reject(signal.reason);
+	};
+	signal.addEventListener("abort", abandon, { once: true });
+	try {
+		await Promise.race([task, abandoned.promise]);
+	} finally {
+		signal.removeEventListener("abort", abandon);
+	}
+}
+/** One account route's listing cache; each endpoint and credential pair has its own scope. */
+var AccountModelCatalog = class {
+	dependencies;
+	scope;
+	listing;
+	/** Settle time of the latest load in this scope; `undefined` before the first one settles. */
+	settledAt;
+	inflight;
+	request;
+	generation = 0;
+	failing = false;
+	closed = false;
+	/** @param dependencies - settings, credential, transport, clock, and diagnostic callbacks. */
+	constructor(dependencies) {
+		this.dependencies = dependencies;
+	}
+	/**
+	* The last published view, without I/O.
+	* @returns the signed-in state and listing of the current scope.
+	*/
+	current() {
+		return {
+			signedIn: this.scope !== void 0,
+			listing: this.listing
+		};
+	}
+	/**
+	* Resolve the view for the current credential. The first access of a scope
+	* waits for its load, which the request deadline bounds; later accesses
+	* return at once and refresh a stale listing in the background.
+	* @param signal - abandons this wait only; the shared load continues.
+	* @returns the view after any first load of the scope settles.
+	*/
+	async view(signal) {
+		const settings = this.dependencies.settings();
+		const token = await this.dependencies.token(settings.url);
+		signal?.throwIfAborted();
+		if (this.closed) return this.current();
+		const scope = token === void 0 ? void 0 : `${settings.url}\n${createHash("sha256").update(token).digest("hex")}`;
+		if (scope !== this.scope) this.rescope(scope);
+		if (token !== void 0) {
+			if (this.settledAt === void 0) await abandonable(this.start(settings, token), signal);
+			else if (this.dependencies.now() - this.settledAt >= settings.maxAgeMs) this.start(settings, token);
+		}
+		return this.current();
+	}
+	/** Abort in-flight loads; later results and accesses change nothing. */
+	dispose() {
+		this.closed = true;
+		this.generation += 1;
+		this.request?.abort();
+	}
+	rescope(scope) {
+		this.request?.abort();
+		this.scope = scope;
+		this.listing = void 0;
+		this.settledAt = void 0;
+		this.inflight = void 0;
+		this.failing = false;
+		this.generation += 1;
+	}
+	start(settings, token) {
+		if (this.inflight !== void 0) return this.inflight;
+		this.generation += 1;
+		const generation = this.generation;
+		const request = new AbortController();
+		this.request = request;
+		const limit = deadline(request.signal, settings.timeoutMs, LISTING_TIMEOUT);
+		const run = this.dependencies.load(settings.url, token, limit.signal).then((listing) => {
+			if (generation !== this.generation) return;
+			this.listing = listing;
+			this.settledAt = this.dependencies.now();
+			this.failing = false;
+			this.dependencies.info(`model listing from ${settings.url} loaded ${listing.entries.length} model(s), skipped ${listing.skipped} row(s)`);
+		}, (error) => {
+			if (generation !== this.generation) return;
+			if (!this.failing) {
+				const fallback = this.listing === void 0 ? "using the bundled catalog" : "keeping the previous catalog";
+				this.dependencies.warn(`model listing from ${settings.url} failed (${String(error)}); ${fallback}`);
+			}
+			this.settledAt = this.dependencies.now();
+			this.failing = true;
+		}).finally(() => {
+			limit[Symbol.dispose]();
+			if (this.inflight === run) this.inflight = void 0;
+		});
+		this.inflight = run;
+		return run;
+	}
+};
+//#endregion
 //#region lib/types/config.js
-/** Account providers expose protocol settings without an API-key reference. */
-const Config = Config$1;
+/** Default deadline of one model-listing request and of a first-use wait. */
+const DEFAULT_MODELS_TIMEOUT_MS = 5e3;
+/** Default listing age after which the next access refreshes it in the background. */
+const DEFAULT_MODELS_MAX_AGE_MS = 6e5;
+const { models: _protocolCatalog, ...protocolFields } = deepSeekConfigFields;
+const modelOverride = z.object({
+	...catalogModelFields,
+	inputModalities: z.array(z.union(["text", "image"]))
+});
+const Config = z.object({
+	...protocolFields,
+	modelsTimeoutMs: z.number().min(Number.MIN_VALUE).max(MAX_TIMER_DELAY_MS).default(DEFAULT_MODELS_TIMEOUT_MS).volatile(),
+	modelsMaxAgeMs: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER).default(DEFAULT_MODELS_MAX_AGE_MS).volatile(),
+	modelOverrides: z.dict(modelOverride).default({}).volatile()
+});
+/**
+* Read the current value behind every reference of a validated Config.
+* @param config - parsed plugin Config.
+* @returns plain options for {@link resolveAccountOptions}.
+*/
+function plainAccountOptions(config) {
+	return Object.fromEntries(Object.entries(config).map(([key, value]) => [key, isVolatile(value) ? value.get() : value]));
+}
+/** The listing endpoint: `/models` at the Messages origin, the only origin that receives the account token. */
+function listingEndpoint(baseURL) {
+	return new URL("/models", new URL(baseURL).origin).href;
+}
+/** Keep an override's declared fields: parsed configuration carries unset fields as `undefined` and unset arrays as `[]`. */
+function resolveOverride(id, override) {
+	if (id.length === 0) throw new Error("llm-deepseek-account: modelOverrides keys must be non-empty model ids");
+	if (Object.hasOwn(override, "id")) throw new Error(`llm-deepseek-account: modelOverrides.${id} sets "id", which is its key`);
+	const declared = {};
+	for (const [key, value] of Object.entries(override)) {
+		if (value === void 0 || Array.isArray(value) && value.length === 0) continue;
+		Reflect.set(declared, key, value);
+	}
+	try {
+		resolveAdapterOptions({ models: [{
+			inputModalities: ["text", "image"],
+			...declared,
+			id
+		}] });
+	} catch (error) {
+		throw new Error(`llm-deepseek-account: modelOverrides.${id} is invalid: ${String(error)}`, { cause: error });
+	}
+	return declared;
+}
+/**
+* The one explicit resolve step from raw account settings to validated facts.
+* Settings updates can reach it without schema validation, so every bound is judged here.
+* @param options - plain account options.
+* @param environment - this run's environment layers, or `undefined` outside the product CLI.
+* @returns Messages settings, listing settings, and validated overrides.
+*/
+function resolveAccountOptions(options, environment) {
+	if (Object.hasOwn(options, "models")) throw new Error("llm-deepseek-account: models is no longer configurable; the account /models listing supplies the catalog. Remove models from this entry and adjust single models with modelOverrides.<model id>");
+	const { modelsTimeoutMs = DEFAULT_MODELS_TIMEOUT_MS, modelsMaxAgeMs = DEFAULT_MODELS_MAX_AGE_MS, modelOverrides = {}, ...protocolOptions } = options;
+	if (!Number.isFinite(modelsTimeoutMs) || modelsTimeoutMs <= 0 || modelsTimeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`llm-deepseek-account: modelsTimeoutMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);
+	if (!Number.isSafeInteger(modelsMaxAgeMs) || modelsMaxAgeMs < 0) throw new Error("llm-deepseek-account: modelsMaxAgeMs must be a non-negative safe integer");
+	const protocol = resolveAdapterOptions(protocolOptions, environment);
+	return {
+		protocol,
+		catalog: {
+			url: listingEndpoint(protocol.baseURL),
+			timeoutMs: modelsTimeoutMs,
+			maxAgeMs: modelsMaxAgeMs
+		},
+		modelOverrides: Object.fromEntries(Object.entries(modelOverrides).map(([id, override]) => [id, resolveOverride(id, override)]))
+	};
+}
+//#endregion
+//#region lib/types/resolve-catalog.js
+/** The account catalog: version gating, this build's model knowledge, and deployment overrides. */
+/** Replace fields of an entry; a text-only result drops the image limits it inherited. */
+function layered(model, layer) {
+	const merged = {
+		...model,
+		...layer
+	};
+	if (merged.inputModalities?.includes("image") !== true) {
+		if (layer.imagePixelBudget === void 0) delete merged.imagePixelBudget;
+		if (layer.imageMaxBytes === void 0) delete merged.imageMaxBytes;
+	}
+	return merged;
+}
+/** Layer one usable listing entry over this build's entry for the same id. */
+function listed(base, entry, facts, routeMaxTokens) {
+	const { systemPromptUpdate: _replaced, ...leadingOnly } = base;
+	return layered(facts.systemPromptUpdate === "leading-only" ? leadingOnly : base, {
+		...entry.name === void 0 ? {} : { name: entry.name },
+		...facts.contextWindow === void 0 ? {} : { contextWindow: facts.contextWindow },
+		...facts.maxOutputTokens === void 0 ? {} : { maxTokens: Math.min(routeMaxTokens, facts.maxOutputTokens) },
+		...facts.systemPromptUpdate === "in-history" ? { systemPromptUpdate: "in-history" } : {},
+		inputModalities: [...facts.inputModalities]
+	});
+}
+function gateOf(entry, known, clientVersion, problems) {
+	const requirement = entry.requirement;
+	switch (requirement.kind) {
+		case "none": return known ? void 0 : { kind: "unsupported" };
+		case "min-version":
+			if (semver.valid(requirement.version) === null) break;
+			return semver.gte(clientVersion, requirement.version) ? void 0 : {
+				kind: "upgrade-required",
+				requiredVersion: requirement.version
+			};
+		case "invalid": break;
+		/* v8 ignore next 2 -- listing decoding produces only the closed requirement union */
+		default: return assertNever(requirement, "model listing client requirement");
+	}
+	problems.push(`model "${entry.id}" declares an unreadable client requirement`);
+	return { kind: "unsupported" };
+}
+/**
+* Resolve the account catalog. A declared minimum client version decides a
+* listed model's availability; without one, only models this build supports
+* are offered and the other listed models stay hidden.
+* @param input - listing, supported models, overrides, route cap, and this build's version.
+* @returns offered models, request-resolution entries, refusals, and diagnostics.
+*/
+function resolveAccountCatalog(input) {
+	const supported = new Map(input.supported.map((model) => [model.id, model]));
+	const problems = [];
+	const overrideErrors = [];
+	const withOverride = (model) => {
+		const override = input.overrides[model.id];
+		if (override === void 0) return model;
+		const candidate = layered(model, override);
+		try {
+			resolveAdapterOptions({ models: [candidate] });
+		} catch (error) {
+			overrideErrors.push(`modelOverrides.${model.id} does not apply (${String(error)})`);
+			return model;
+		}
+		return candidate;
+	};
+	if (input.listing === void 0) {
+		const resolution = resolveAdapterOptions({ models: input.supported.map(withOverride) }).models;
+		return {
+			offered: resolution,
+			resolution,
+			refusals: /* @__PURE__ */ new Map(),
+			problems,
+			overrideErrors
+		};
+	}
+	const offered = [];
+	const refusals = /* @__PURE__ */ new Map();
+	for (const entry of input.listing) {
+		const refusal = gateOf(entry, supported.has(entry.id), input.clientVersion, problems);
+		if (refusal !== void 0) {
+			refusals.set(entry.id, refusal);
+			continue;
+		}
+		if (!entry.capabilities.usable) {
+			problems.push(`model "${entry.id}" ${entry.capabilities.reason}`);
+			refusals.set(entry.id, { kind: "unsupported" });
+			continue;
+		}
+		offered.push(withOverride(listed(supported.get(entry.id) ?? { id: entry.id }, entry, entry.capabilities.facts, input.routeMaxTokens)));
+	}
+	const offeredIds = new Set(offered.map((model) => model.id));
+	const listedIds = new Set(input.listing.map((entry) => entry.id));
+	for (const id of Object.keys(input.overrides)) if (!listedIds.has(id) && !supported.has(id)) overrideErrors.push(`modelOverrides names "${id}", which neither the account listing nor the built-in catalog describes`);
+	const resolution = resolveAdapterOptions({ models: [...offered, ...input.supported.filter((model) => !offeredIds.has(model.id)).map(withOverride)] }).models;
+	return {
+		offered: resolution.slice(0, offered.length),
+		resolution,
+		refusals,
+		problems,
+		overrideErrors
+	};
+}
 //#endregion
 //#region lib/types/index.js
 const name = "llm-deepseek-account";
 const inject = ["llm"];
 const PROVIDER = "deepseek-account";
+/** Header carrying the account token on Messages, Files, and model-listing requests. */
+const TOKEN_HEADER = "x-dsh-auth-token";
+/** Console tag of listing diagnostics; product profiles mount no console exporter for `ctx.logger`. */
+const LOG_TAG = "[llm-deepseek-account]";
+function refuse(model, refusal) {
+	if (refusal === void 0) return;
+	switch (refusal.kind) {
+		case "upgrade-required": throw new LlmError(`DeepSeek model "${model}" requires DeepSeek Harness ${refusal.requiredVersion} or later; current version is ${APP_IDENTITY.version}`, "CLIENT_UPGRADE_REQUIRED");
+		case "unsupported": throw new LlmError(`DeepSeek model "${model}" is not supported by DeepSeek Harness; current version is ${APP_IDENTITY.version}`, "MODEL_UNSUPPORTED");
+		/* v8 ignore next 2 -- catalog resolution produces only the closed refusal union */
+		default: assertNever(refusal, "account catalog refusal");
+	}
+}
 function apply(ctx, config) {
-	const options = () => resolveAdapterOptions(plainOptions(config), launchEnvironmentOf(ctx));
-	options();
+	const environment = launchEnvironmentOf(ctx);
+	const settings = () => resolveAccountOptions(plainAccountOptions(config), environment);
+	settings();
+	const supported = resolveAdapterOptions({}).models;
+	const account = () => ctx.get("deepseekAccount");
 	const resolveAuth = async (connection) => {
-		const account = ctx.get("deepseekAccount");
-		const token = await account?.resolveToken(connection.baseURL);
+		const token = await account()?.resolveToken(connection.baseURL);
 		if (token === void 0) throw new LlmError("Sign in to DeepSeek to use the account provider. The request destination must allow account authentication.", "ACCOUNT_SIGN_IN_REQUIRED");
 		return {
-			headers: { "x-dsh-auth-token": token },
+			headers: { [TOKEN_HEADER]: token },
 			onRequestError: async (error) => {
 				if (!(error instanceof LlmError)) return error;
 				if (error.code === QUOTA_EXCEEDED_CODE) return new LlmError(error.message, ACCOUNT_QUOTA_EXCEEDED_CODE, {
@@ -30,33 +464,82 @@ function apply(ctx, config) {
 					cause: error
 				});
 				try {
-					await account?.rejectToken(token);
+					await account()?.rejectToken(token);
 				} catch (_credentialRemovalFailed) {}
 				return rejected;
 			}
 		};
 	};
-	ctx.llm.registerConfigurableProviders([{
+	const catalog = new AccountModelCatalog({
+		settings: () => settings().catalog,
+		token: async (url) => account()?.resolveToken(url),
+		load: (url, token, signal) => requestModelListing(url, { [TOKEN_HEADER]: token }, signal),
+		now: () => Date.now(),
+		info: (message) => {
+			console.info(LOG_TAG, message);
+		},
+		warn: (message) => {
+			console.warn(LOG_TAG, message);
+		}
+	});
+	let loggedListing;
+	/** Resolve the catalog for one view, logging the listing's hidden entries once per listing. */
+	const connectionOf = (view) => {
+		const resolved = settings();
+		const result = resolveAccountCatalog({
+			listing: view.listing?.entries,
+			supported,
+			overrides: resolved.modelOverrides,
+			routeMaxTokens: resolved.protocol.maxTokens,
+			clientVersion: APP_IDENTITY.version
+		});
+		if (view.listing !== loggedListing) {
+			loggedListing = view.listing;
+			for (const problem of result.problems) console.warn(LOG_TAG, problem);
+		}
+		return {
+			...resolved.protocol,
+			models: result.resolution,
+			catalog: result
+		};
+	};
+	const entry = {
 		provider: PROVIDER,
 		displayName: "DeepSeek Account",
 		settingsNs: ctx.fiber.entry?.options.id ?? "llm-deepseek-account",
 		settingsPath: []
-	}]);
+	};
+	const directory = ctx.llm.registerConfigurableProviders([entry]);
+	let reportedError;
+	/** Publish override diagnostics on the provider directory. */
+	const discovered = (view) => {
+		const connection = connectionOf(view);
+		const error = connection.catalog.overrideErrors.length === 0 ? void 0 : connection.catalog.overrideErrors.join("; ");
+		if (error !== reportedError) {
+			reportedError = error;
+			directory.replace([error === void 0 ? entry : {
+				...entry,
+				error
+			}]);
+		}
+		return connection;
+	};
 	registerDeepSeekProvider(ctx, PROVIDER, {
-		options,
-		resolveAuth,
 		providerName: "DeepSeek Account",
+		options: () => connectionOf(catalog.current()),
+		connect: async (signal) => connectionOf(await catalog.view(signal)),
+		resolveAuth,
+		admit: (connection, model) => {
+			refuse(model, connection.catalog.refusals.get(model));
+		},
 		discoverModels: async (provider) => {
-			const connection = options();
-			try {
-				await resolveAuth(connection);
-			} catch (error) {
-				if (error instanceof LlmError && error.code === "ACCOUNT_SIGN_IN_REQUIRED") return [];
-				throw error;
-			}
-			return connection.models.map((model) => catalogModelInfo(provider, model));
+			const view = await catalog.view();
+			return view.signedIn ? discovered(view).catalog.offered.map((model) => catalogModelInfo(provider, model)) : [];
 		}
 	});
+	ctx.effect(() => () => {
+		catalog.dispose();
+	}, "llm-deepseek-account: model catalog");
 }
 //#endregion
 export { Config, apply, inject, name };

package/lib/types/catalog.d.ts

@@ -0,0 +1,57 @@
+import type { CatalogSettings } from './config.ts';
+import type { ModelListing } from './listing.ts';
+/** Host-owned inputs of one catalog instance. */
+export interface CatalogDependencies {
+    /** Current endpoint settings, re-read on every access. */
+    readonly settings: () => CatalogSettings;
+    /** The account token allowed for `url`, or `undefined` while signed out. */
+    readonly token: (url: string) => Promise<string | undefined>;
+    /** Perform one listing request authenticated with `token`; `signal` carries the {@link LISTING_TIMEOUT} request deadline. */
+    readonly load: (url: string, token: string, signal: AbortSignal) => Promise<ModelListing>;
+    /** Wall clock used for listing age. */
+    readonly now: () => number;
+    /** Report a loaded listing. */
+    readonly info: (message: string) => void;
+    /** Report the first failure of a failing streak. */
+    readonly warn: (message: string) => void;
+}
+/** What request resolution reads. */
+export interface CatalogView {
+    /** Whether an account token is available for the listing endpoint. */
+    readonly signedIn: boolean;
+    /** Last successful listing for this credential and endpoint; `undefined` until one succeeds. */
+    readonly listing: ModelListing | undefined;
+}
+/** One account route's listing cache; each endpoint and credential pair has its own scope. */
+export declare class AccountModelCatalog {
+    private readonly dependencies;
+    private scope;
+    private listing;
+    /** Settle time of the latest load in this scope; `undefined` before the first one settles. */
+    private settledAt;
+    private inflight;
+    private request;
+    private generation;
+    private failing;
+    private closed;
+    /** @param dependencies - settings, credential, transport, clock, and diagnostic callbacks. */
+    constructor(dependencies: CatalogDependencies);
+    /**
+     * The last published view, without I/O.
+     * @returns the signed-in state and listing of the current scope.
+     */
+    current(): CatalogView;
+    /**
+     * Resolve the view for the current credential. The first access of a scope
+     * waits for its load, which the request deadline bounds; later accesses
+     * return at once and refresh a stale listing in the background.
+     * @param signal - abandons this wait only; the shared load continues.
+     * @returns the view after any first load of the scope settles.
+     */
+    view(signal?: AbortSignal): Promise<CatalogView>;
+    /** Abort in-flight loads; later results and accesses change nothing. */
+    dispose(): void;
+    private rescope;
+    private start;
+}
+//# sourceMappingURL=catalog.d.ts.map

package/lib/types/config.d.ts

@@ -1,44 +1,105 @@
-/** Account providers expose protocol settings without an API-key reference. */
-import { Config as ProtocolConfig } from '@deepseek-ai/dsh-llm-deepseek';
+/** Account route configuration: Messages settings, the model-listing endpoint, and per-model overrides. */
+import type { Volatile } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import type { LaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment';
+import type { Config as ProtocolConfig, DeepSeekCatalogModel, Options as ProtocolOptions, ResolvedDeepSeekOptions } from '@deepseek-ai/dsh-llm-deepseek';
+/** Default deadline of one model-listing request and of a first-use wait. */
+export declare const DEFAULT_MODELS_TIMEOUT_MS = 5000;
+/** Default listing age after which the next access refreshes it in the background. */
+export declare const DEFAULT_MODELS_MAX_AGE_MS = 600000;
+/** Field overrides for one model; unset fields and empty lists inherit the underlying entry. */
+export type ModelOverride = Omit<DeepSeekCatalogModel, 'id'>;
 /** Account route configuration; authentication comes exclusively from the account service. */
-export type Config = ProtocolConfig;
-export declare const Config: import("@deepseek-ai/schemastery").default<Schemastery.ObjectS<NoInfer<{
-    baseURL: import("@deepseek-ai/schemastery").default<string, string, "volatile">;
-    thinking: import("@deepseek-ai/schemastery").default<"enabled" | "disabled", "enabled" | "disabled", "volatile">;
-    reasoningEffort: import("@deepseek-ai/schemastery").default<"low" | "off" | "high" | "max", "low" | "off" | "high" | "max", "volatile">;
-    maxTokens: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    defaultContextWindow: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    models: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, "volatile-defined">;
-    streamIdleTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    maxRequestFilesBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    maxInlineRequestImageBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    maxImagesPerRequest: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    imageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    inlineImageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    imageOffloadCountQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    filesApiTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    fileExpiresAfterSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    fileRefreshMarginSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    fileQuotaCleanupBatch: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    retryPolicy: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, "volatile">;
+export interface Config extends Omit<ProtocolConfig, 'models'> {
+    /** Deadline of one listing request, which also bounds a first-use wait (default five seconds). */
+    modelsTimeoutMs: Volatile<number>;
+    /**
+     * Listing age after which the next access refreshes it in the background;
+     * a failed load retries after the same age (default ten minutes).
+     */
+    modelsMaxAgeMs: Volatile<number>;
+    /** Field overrides by model id, layered over the account listing and the built-in catalog. */
+    modelOverrides: Volatile<Record<string, ModelOverride>>;
+}
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    modelsTimeoutMs: z<number, number, "volatile-defined">;
+    modelsMaxAgeMs: z<number, number, "volatile-defined">;
+    modelOverrides: z<NoInfer<import("@deepseek-ai/cosmokit").Dict<ModelOverride, string>>, NoInfer<import("@deepseek-ai/cosmokit").Dict<ModelOverride, string>>, "volatile-defined">;
+    baseURL: z<string, string, "volatile">;
+    thinking: z<"enabled" | "disabled", "enabled" | "disabled", "volatile">;
+    reasoningEffort: z<"low" | "off" | "high" | "max", "low" | "off" | "high" | "max", "volatile">;
+    maxTokens: z<number, number, "volatile-defined">;
+    defaultContextWindow: z<number, number, "volatile-defined">;
+    streamIdleTimeoutMs: z<number, number, "volatile-defined">;
+    maxRequestFilesBytes: z<number, number, "volatile-defined">;
+    maxInlineRequestImageBytes: z<number, number, "volatile-defined">;
+    maxImagesPerRequest: z<number, number, "volatile-defined">;
+    imageOffloadByteQuantum: z<number, number, "volatile-defined">;
+    inlineImageOffloadByteQuantum: z<number, number, "volatile-defined">;
+    imageOffloadCountQuantum: z<number, number, "volatile-defined">;
+    filesApiTimeoutMs: z<number, number, "volatile-defined">;
+    fileExpiresAfterSeconds: z<number, number, "volatile-defined">;
+    fileRefreshMarginSeconds: z<number, number, "volatile-defined">;
+    fileQuotaCleanupBatch: z<number, number, "volatile-defined">;
+    retryPolicy: z<NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, "volatile">;
 }>>, Schemastery.ObjectT<NoInfer<{
-    baseURL: import("@deepseek-ai/schemastery").default<string, string, "volatile">;
-    thinking: import("@deepseek-ai/schemastery").default<"enabled" | "disabled", "enabled" | "disabled", "volatile">;
-    reasoningEffort: import("@deepseek-ai/schemastery").default<"low" | "off" | "high" | "max", "low" | "off" | "high" | "max", "volatile">;
-    maxTokens: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    defaultContextWindow: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    models: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, NoInfer<import("@deepseek-ai/dsh-llm-deepseek").DeepSeekCatalogModel[]>, "volatile-defined">;
-    streamIdleTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    maxRequestFilesBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    maxInlineRequestImageBytes: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    maxImagesPerRequest: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    imageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    inlineImageOffloadByteQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    imageOffloadCountQuantum: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    filesApiTimeoutMs: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    fileExpiresAfterSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    fileRefreshMarginSeconds: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    fileQuotaCleanupBatch: import("@deepseek-ai/schemastery").default<number, number, "volatile-defined">;
-    retryPolicy: import("@deepseek-ai/schemastery").default<NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, "volatile">;
+    modelsTimeoutMs: z<number, number, "volatile-defined">;
+    modelsMaxAgeMs: z<number, number, "volatile-defined">;
+    modelOverrides: z<NoInfer<import("@deepseek-ai/cosmokit").Dict<ModelOverride, string>>, NoInfer<import("@deepseek-ai/cosmokit").Dict<ModelOverride, string>>, "volatile-defined">;
+    baseURL: z<string, string, "volatile">;
+    thinking: z<"enabled" | "disabled", "enabled" | "disabled", "volatile">;
+    reasoningEffort: z<"low" | "off" | "high" | "max", "low" | "off" | "high" | "max", "volatile">;
+    maxTokens: z<number, number, "volatile-defined">;
+    defaultContextWindow: z<number, number, "volatile-defined">;
+    streamIdleTimeoutMs: z<number, number, "volatile-defined">;
+    maxRequestFilesBytes: z<number, number, "volatile-defined">;
+    maxInlineRequestImageBytes: z<number, number, "volatile-defined">;
+    maxImagesPerRequest: z<number, number, "volatile-defined">;
+    imageOffloadByteQuantum: z<number, number, "volatile-defined">;
+    inlineImageOffloadByteQuantum: z<number, number, "volatile-defined">;
+    imageOffloadCountQuantum: z<number, number, "volatile-defined">;
+    filesApiTimeoutMs: z<number, number, "volatile-defined">;
+    fileExpiresAfterSeconds: z<number, number, "volatile-defined">;
+    fileRefreshMarginSeconds: z<number, number, "volatile-defined">;
+    fileQuotaCleanupBatch: z<number, number, "volatile-defined">;
+    retryPolicy: z<NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, NoInfer<import("@deepseek-ai/dsh-llm").RetryPolicyConfig>, "volatile">;
 }>>, "plain">;
+/** Plain account options accepted by {@link resolveAccountOptions}. */
+export type AccountOptions = Omit<ProtocolOptions, 'models'> & {
+    modelsTimeoutMs?: number;
+    modelsMaxAgeMs?: number;
+    modelOverrides?: Record<string, ModelOverride>;
+};
+/** Model-listing endpoint and cache timing of one configuration generation. */
+export interface CatalogSettings {
+    /** Listing endpoint; it always shares the Messages origin. */
+    readonly url: string;
+    /** Deadline of one listing request. */
+    readonly timeoutMs: number;
+    /** Listing age after which the next access refreshes it. */
+    readonly maxAgeMs: number;
+}
+/** One validated configuration generation of the account route. */
+export interface ResolvedAccountOptions {
+    /** Messages settings; request resolution replaces `models` with the resolved account catalog. */
+    readonly protocol: ResolvedDeepSeekOptions;
+    /** Listing endpoint and cache timing. */
+    readonly catalog: CatalogSettings;
+    /** Overrides by model id, holding only the fields each one declares. */
+    readonly modelOverrides: Readonly<Record<string, ModelOverride>>;
+}
+/**
+ * Read the current value behind every reference of a validated Config.
+ * @param config - parsed plugin Config.
+ * @returns plain options for {@link resolveAccountOptions}.
+ */
+export declare function plainAccountOptions(config: Config): AccountOptions;
+/**
+ * The one explicit resolve step from raw account settings to validated facts.
+ * Settings updates can reach it without schema validation, so every bound is judged here.
+ * @param options - plain account options.
+ * @param environment - this run's environment layers, or `undefined` outside the product CLI.
+ * @returns Messages settings, listing settings, and validated overrides.
+ */
+export declare function resolveAccountOptions(options: AccountOptions, environment?: LaunchEnvironmentSnapshot): ResolvedAccountOptions;
 //# sourceMappingURL=config.d.ts.map

package/lib/types/listing.d.ts

@@ -0,0 +1,68 @@
+import type { ModelModality } from '@deepseek-ai/dsh-llm';
+/** Code of a listing deadline's timeout reason; {@link requestModelListing} reports it as `TIMEOUT`. */
+export declare const LISTING_TIMEOUT = "MODEL_LISTING_TIMEOUT";
+/** The requirement one listing entry declares under this client's product token. */
+export type ClientRequirement = {
+    readonly kind: 'none';
+} | {
+    readonly kind: 'min-version';
+    readonly version: string;
+} | {
+    readonly kind: 'invalid';
+};
+/** Capabilities a usable listing entry declares, in catalog vocabulary. */
+export interface ListedFacts {
+    /** Accepted request modalities this build sends. */
+    readonly inputModalities: readonly ModelModality[];
+    /** Combined request and response context, when declared. */
+    readonly contextWindow?: number;
+    /** Output capability, when declared. */
+    readonly maxOutputTokens?: number;
+    /** Messages system prompt mode, when declared; any value other than `in-history` reads as `leading-only`. */
+    readonly systemPromptUpdate?: 'in-history' | 'leading-only';
+}
+/** Declared capabilities, or why the Messages transport cannot drive the model. */
+export type ListedCapabilities = {
+    readonly usable: true;
+    readonly facts: ListedFacts;
+} | {
+    readonly usable: false;
+    readonly reason: string;
+};
+/** One decoded listing entry; unusable capabilities never hide its id, name, or requirement. */
+export interface ListingEntry {
+    /** Wire model id. */
+    readonly id: string;
+    /** Display name, when the entry declares a non-empty one. */
+    readonly name?: string;
+    /** Requirement declared under `client_requirements[APP_IDENTITY.product]`. */
+    readonly requirement: ClientRequirement;
+    /** Declared capabilities. */
+    readonly capabilities: ListedCapabilities;
+}
+/** A decoded listing with at least one entry. */
+export interface ModelListing {
+    /** Entries in listing order. */
+    readonly entries: readonly ListingEntry[];
+    /** Rows without a usable id, and repeated ids. */
+    readonly skipped: number;
+}
+/**
+ * Decode one `/models` body entry by entry.
+ * @param body - parsed JSON response.
+ * @returns the entries with a usable id, in listing order.
+ * @throws LlmError `INVALID_RESPONSE` when the body has no `data` array or no usable entry.
+ */
+export declare function parseModelListing(body: unknown): ModelListing;
+/**
+ * Request and decode one model listing. Redirects fail, so credentials stay on the requested origin.
+ * @param url - listing endpoint.
+ * @param headers - authentication headers for this endpoint.
+ * @param signal - cancellation and deadline of the whole exchange.
+ * @returns the decoded listing.
+ * @throws LlmError `TIMEOUT` when a {@link LISTING_TIMEOUT} deadline elapses before a complete body, `ABORTED` for
+ *   another abort, `TRANSPORT` for a network failure, `HTTP_<status>` for a non-2xx answer,
+ *   and `INVALID_RESPONSE` for a body that is not a JSON listing.
+ */
+export declare function requestModelListing(url: string, headers: Readonly<Record<string, string>>, signal: AbortSignal): Promise<ModelListing>;
+//# sourceMappingURL=listing.d.ts.map

package/lib/types/resolve-catalog.d.ts

@@ -0,0 +1,45 @@
+import type { DeepSeekCatalogModel } from '@deepseek-ai/dsh-llm-deepseek';
+import type { ModelOverride } from './config.ts';
+import type { ListingEntry } from './listing.ts';
+/** Why this build refuses one listed model before network I/O. */
+export type CatalogRefusal = {
+    readonly kind: 'upgrade-required';
+    readonly requiredVersion: string;
+} | {
+    readonly kind: 'unsupported';
+};
+/** Inputs of one catalog resolution. */
+export interface AccountCatalogInput {
+    /** Entries of the last successful listing, or `undefined` before one succeeds. */
+    readonly listing: readonly ListingEntry[] | undefined;
+    /** Validated models this build supports, carrying its client-side knowledge. */
+    readonly supported: readonly DeepSeekCatalogModel[];
+    /** Overrides by model id, holding only the fields each one declares. */
+    readonly overrides: Readonly<Record<string, ModelOverride>>;
+    /** Route output cap that a listed output capability bounds. */
+    readonly routeMaxTokens: number;
+    /** This build's semantic version. */
+    readonly clientVersion: string;
+}
+/** One resolved account catalog. */
+export interface AccountCatalog {
+    /** Selectable models in listing order, or this build's models when no listing succeeded. */
+    readonly offered: readonly DeepSeekCatalogModel[];
+    /** Entries request resolution consults: offered models, then supported models the listing does not offer. */
+    readonly resolution: readonly DeepSeekCatalogModel[];
+    /** Listed models refused before network I/O, by id. */
+    readonly refusals: ReadonlyMap<string, CatalogRefusal>;
+    /** Listing entries hidden because their declarations are unreadable or unusable. */
+    readonly problems: readonly string[];
+    /** Configuration diagnostics for `modelOverrides`. */
+    readonly overrideErrors: readonly string[];
+}
+/**
+ * Resolve the account catalog. A declared minimum client version decides a
+ * listed model's availability; without one, only models this build supports
+ * are offered and the other listed models stay hidden.
+ * @param input - listing, supported models, overrides, route cap, and this build's version.
+ * @returns offered models, request-resolution entries, refusals, and diagnostics.
+ */
+export declare function resolveAccountCatalog(input: AccountCatalogInput): AccountCatalog;
+//# sourceMappingURL=resolve-catalog.d.ts.map

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "llm-deepseek-account"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "DeepSeek 账号模型接入",
+    "description": "使用已登录的 DeepSeek 账号连接模型服务。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-llm-deepseek-account",
   "description": "DeepSeek account provider authentication and discovery",
-  "version": "0.2.1-alpha.2",
+  "version": "0.2.1-alpha.4",
   "publishConfig": {
     "access": "public"
   },
@@ -19,29 +19,40 @@
       "default": "./lib/index.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "files": [
+    "locale/*.json",
     "lib/index.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
+  "dependencies": {
+    "@deepseek-ai/cosmokit": "~1.8.6-alpha.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.4",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2",
+    "semver": "^7.8.5"
+  },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-launch-environment": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-deepseek-account": "0.2.1-alpha.2",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-deepseek-account": "0.2.1-alpha.4",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.2",
+    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.4"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-launch-environment": "0.2.1-alpha.2",
-    "@deepseek-ai/dsh-deepseek-account": "0.2.1-alpha.2",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
-    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-alpha.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-deepseek-account": "0.2.1-alpha.4",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.2",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-alpha.4",
+    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.4",
+    "@types/semver": "^7.8.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-deepseek-account": {