@deepseek-harness-tui/dsh-tui 0.11.1 → 0.12.0

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/credentials.d.ts

@@ -3,15 +3,15 @@
  * one JSON document, one credential per provider id.
  *
  * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
- * permissions best-effort on every platform. All mutations go through
- * {@link CredentialFile.modify}, which serializes read-modify-write cycles
- * per provider in-process — pi-ai runs its OAuth refresh *inside* `modify`,
- * so the exclusion here is what keeps concurrent requests from
- * double-refreshing a rotated token. The file is the single source of truth;
+ * permissions best-effort on every platform. Mutations share an in-process
+ * queue and a cross-process file lock; pi-ai runs its OAuth refresh *inside*
+ * {@link CredentialFile.modify}, so the exclusion also keeps concurrent
+ * requests from double-refreshing a rotated token. The file is the single
+ * source of truth;
  * nothing here ever logs token material, and {@link CredentialFile.describe}
  * reports only non-secret metadata for status surfaces.
  *
- * @module dsh-auth/credentials
+ * @module @deepseek-harness-tui/dsh-tui/oauth/credentials
  */
 import type { PiAiCredential, PiAiCredentialInfo, PiAiCredentialStore } from './pi-ai.js';
 /** The stored credential shape: a pi-ai `OAuthCredential`. */
@@ -30,10 +30,12 @@ export declare function defaultCredentialsFile(): string;
  */
 export declare class CredentialFile implements PiAiCredentialStore {
     readonly path: string;
-    /** Per-provider operation chains: modify/delete never overlap for one id. */
-    private readonly chains;
-    private cache;
+    /** One document needs one read-modify-write queue, regardless of provider. */
+    private pending;
+    private deviceId;
     constructor(path: string);
+    /** Stable per-store UUID for pi-ai's OpenAI ChatGPT agent-host identity. */
+    getOrCreateDeviceId(): string;
     /** The stored credential for one provider, possibly expired. */
     read(providerId: string): Promise<PiAiCredential | undefined>;
     /** Stored credential metadata without resolving or exposing secrets. */
@@ -53,8 +55,9 @@ export declare class CredentialFile implements PiAiCredentialStore {
         expiresAt: number;
         expired: boolean;
     }[]>;
-    /** Run one operation after every earlier operation for the same provider. */
+    /** Keep the entire read-modify-rename cycle exclusive across processes. */
     private chain;
     private load;
     private save;
 }
+//# sourceMappingURL=credentials.d.ts.map

package/lib/types/dsh-adapter/oauth/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEzF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAAA;AAQ9E,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,SAAS,CAOpF;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,IAAI,MAAM,CAK/C;AAKD;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,mBAAmB;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAmC;IAClD,OAAO,CAAC,QAAQ,CAAoB;gBAExB,IAAI,EAAE,MAAM;IAIxB,4EAA4E;IAC5E,mBAAmB,IAAI,MAAM;IAiC7B,gEAAgE;IAC1D,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAInE,wEAAwE;IAClE,IAAI,IAAI,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC;IAQpD;;;;;OAKG;IACG,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,GAAG,SAAS,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,GAC/E,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IActC,iDAAiD;IAC3C,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU/C,4EAA4E;IACtE,QAAQ,IAAI,OAAO,CAAC,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAY/F,2EAA2E;IAC3E,OAAO,CAAC,KAAK;YAUC,IAAI;YAuCJ,IAAI;CAWnB"}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/credentials.js

@@ -3,19 +3,21 @@
  * one JSON document, one credential per provider id.
  *
  * Writes are atomic (temp file + rename) with 0700 directory / 0600 file
- * permissions best-effort on every platform. All mutations go through
- * {@link CredentialFile.modify}, which serializes read-modify-write cycles
- * per provider in-process — pi-ai runs its OAuth refresh *inside* `modify`,
- * so the exclusion here is what keeps concurrent requests from
- * double-refreshing a rotated token. The file is the single source of truth;
+ * permissions best-effort on every platform. Mutations share an in-process
+ * queue and a cross-process file lock; pi-ai runs its OAuth refresh *inside*
+ * {@link CredentialFile.modify}, so the exclusion also keeps concurrent
+ * requests from double-refreshing a rotated token. The file is the single
+ * source of truth;
  * nothing here ever logs token material, and {@link CredentialFile.describe}
  * reports only non-secret metadata for status surfaces.
  *
- * @module dsh-auth/credentials
+ * @module @deepseek-harness-tui/dsh-tui/oauth/credentials
  */
+import { randomUUID } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
+import { withFileLock } from '@deepseek-ai/dsh-atomic-write';
 /** Narrow an unknown parsed value into a stored credential, or reject it. */
 export function asStoredCredential(value) {
     if (typeof value !== 'object' || value === null)
@@ -38,6 +40,7 @@ export function defaultCredentialsFile() {
     return join(root, 'dsh-auth', 'credentials.json');
 }
 const EMPTY_DOCUMENT = { version: 1, providers: {} };
+const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 /**
  * The credential file. IO failures throw (loud, naming the path) rather than
  * degrading to an empty store: silently treating a corrupt or unreadable
@@ -46,12 +49,49 @@ const EMPTY_DOCUMENT = { version: 1, providers: {} };
  */
 export class CredentialFile {
     path;
-    /** Per-provider operation chains: modify/delete never overlap for one id. */
-    chains = new Map();
-    cache;
+    /** One document needs one read-modify-write queue, regardless of provider. */
+    pending = Promise.resolve();
+    deviceId;
     constructor(path) {
         this.path = path;
     }
+    /** Stable per-store UUID for pi-ai's OpenAI ChatGPT agent-host identity. */
+    getOrCreateDeviceId() {
+        if (this.deviceId !== undefined)
+            return this.deviceId;
+        const path = join(dirname(this.path), 'device-id');
+        let value;
+        try {
+            value = readFileSync(path, 'utf8');
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT') {
+                throw new Error(`dsh-auth: cannot read device ID file ${path}: ${String(error)}`);
+            }
+            mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+            try {
+                writeFileSync(path, `${randomUUID()}\n`, { flag: 'wx', mode: 0o600 });
+            }
+            catch (writeError) {
+                // A second process may have created the same installation ID first.
+                if (writeError?.code !== 'EEXIST') {
+                    throw new Error(`dsh-auth: cannot write device ID file ${path}: ${String(writeError)}`);
+                }
+            }
+            try {
+                value = readFileSync(path, 'utf8');
+            }
+            catch (readError) {
+                throw new Error(`dsh-auth: cannot read device ID file ${path}: ${String(readError)}`);
+            }
+        }
+        const id = value.trim();
+        if (!DEVICE_ID_PATTERN.test(id)) {
+            throw new Error(`dsh-auth: device ID file ${path} is not a UUID; fix or remove it by hand`);
+        }
+        this.deviceId = id;
+        return id;
+    }
     /** The stored credential for one provider, possibly expired. */
     async read(providerId) {
         return (await this.load()).providers[providerId];
@@ -71,7 +111,7 @@ export class CredentialFile {
      * credential. Rejections from `fn` propagate without touching the file.
      */
     async modify(providerId, fn) {
-        return this.chain(providerId, async () => {
+        return this.chain(async () => {
             const document = await this.load();
             const current = document.providers[providerId];
             const replacement = await fn(current);
@@ -86,7 +126,7 @@ export class CredentialFile {
     }
     /** Remove one provider's credential (logout). */
     async delete(providerId) {
-        await this.chain(providerId, async () => {
+        await this.chain(async () => {
             const document = await this.load();
             if (!(providerId in document.providers))
                 return;
@@ -107,23 +147,24 @@ export class CredentialFile {
             expired: credential.expires <= now,
         }));
     }
-    /** Run one operation after every earlier operation for the same provider. */
-    chain(provider, operation) {
-        const run = (this.chains.get(provider) ?? Promise.resolve()).then(operation, operation);
-        this.chains.set(provider, run.then(() => undefined, () => undefined));
+    /** Keep the entire read-modify-rename cycle exclusive across processes. */
+    chain(operation) {
+        const run = this.pending.then(() => {
+            mkdirSync(dirname(this.path), { recursive: true, mode: 0o700 });
+            // pi-ai may refresh a token over the network while holding this lock.
+            return withFileLock(this.path, operation, { waitMs: 120_000 });
+        });
+        this.pending = run.then(() => undefined, () => undefined);
         return run;
     }
     async load() {
-        if (this.cache !== undefined)
-            return this.cache;
         let text;
         try {
             text = readFileSync(this.path, 'utf8');
         }
         catch (error) {
             if (error?.code === 'ENOENT') {
-                this.cache = EMPTY_DOCUMENT;
-                return this.cache;
+                return EMPTY_DOCUMENT;
             }
             throw new Error(`dsh-auth: cannot read credential file ${this.path}: ${String(error)}`);
         }
@@ -150,13 +191,11 @@ export class CredentialFile {
             }
             providers[provider] = credential;
         }
-        this.cache = { version: 1, providers };
-        return this.cache;
+        return { version: 1, providers };
     }
     async save(document) {
         const text = JSON.stringify(document, null, 2) + '\n';
         const directory = dirname(this.path);
-        mkdirSync(directory, { recursive: true, mode: 0o700 });
         const temporary = join(directory, `.${Math.random().toString(36).slice(2)}.tmp`);
         try {
             writeFileSync(temporary, text, { mode: 0o600 });
@@ -165,6 +204,5 @@ export class CredentialFile {
         catch (error) {
             throw new Error(`dsh-auth: cannot write credential file ${this.path}: ${String(error)}`);
         }
-        this.cache = document;
     }
 }

package/lib/types/dsh-adapter/oauth/deepseek.d.ts

@@ -0,0 +1,39 @@
+/**
+ * TUI interaction for the Host-owned DeepSeek account authorization flow.
+ *
+ * The Host owns PKCE, its callback route, credential persistence, and the
+ * `deepseek-account` LLM route. This module supplies a loopback callback
+ * origin, mounts the official Host listener when an older bundle patch omits
+ * it, and displays the Host's safe attempt state through the existing question
+ * panel. It never reads or writes the account grant.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { AccountClientMetadata, DeepSeekAccount } from '@deepseek-ai/dsh-deepseek-account';
+import { type AskFn, type QuestionBridgeHelpers } from './interaction.js';
+export declare const DEEPSEEK_ACCOUNT_PROVIDER = "deepseek-account";
+/** Only the account operations this interaction surface consumes. */
+export type DeepSeekAccountAuth = Pick<DeepSeekAccount, 'getState' | 'startSignIn' | 'cancelSignIn' | 'signOut' | 'watch'> & Partial<Pick<DeepSeekAccount, 'getUnnotifiedBonuses' | 'ackBonusNotified'>>;
+/** Resolve late: the account provider is absent on older DSH hosts. */
+export declare function deepSeekAccountFrom(ctx: Context): DeepSeekAccountAuth | undefined;
+/** The Host webServer may be shared, supplied by the TUI row, or mounted as a fallback. */
+export declare function deepSeekCallbackOrigin(ctx: Context): string;
+/**
+ * Keep DeepSeek login usable after a profile-only update from a global TUI
+ * whose older bundle patch still mounts `dsh-tui-auth` but has no webserver
+ * row. The official Host listener is mounted only on the first login that
+ * needs it; an existing Web or user-owned listener is never replaced.
+ */
+export declare function createDeepSeekCallbackOriginResolver(ctx: Context): {
+    resolve(): Promise<string>;
+    dispose(): Promise<void>;
+};
+/** Platform request identity is supplied by the current TUI, not cached by the Host. */
+export declare function deepSeekClientMetadata(): AccountClientMetadata;
+/**
+ * Start (or join) the upstream browser attempt, display its URL, and wait for
+ * the upstream state stream. Esc/external abort cancels the exact attempt;
+ * a commit that won that race is reported as success instead of a false
+ * cancellation. The question panel is always retired before returning.
+ */
+export declare function loginDeepSeekAccount(account: DeepSeekAccountAuth, callbackOrigin: string, ask: AskFn, signal?: AbortSignal, helpers?: QuestionBridgeHelpers): Promise<void>;
+//# sourceMappingURL=deepseek.d.ts.map

package/lib/types/dsh-adapter/oauth/deepseek.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deepseek.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/deepseek.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,qBAAqB,EAAe,eAAe,EAAmB,MAAM,mCAAmC,CAAA;AAG7H,OAAO,EAAkB,KAAK,KAAK,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AAEzF,eAAO,MAAM,yBAAyB,qBAAqB,CAAA;AAE3D,qEAAqE;AACrE,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC,GACtH,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,sBAAsB,GAAG,kBAAkB,CAAC,CAAC,CAAA;AAE/E,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,SAAS,CAEjF;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAO3D;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG;IAClE,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB,CA0DA;AAWD,wFAAwF;AACxF,wBAAgB,sBAAsB,IAAI,qBAAqB,CAM9D;AAMD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,mBAAmB,EAC5B,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,KAAK,EACV,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAyDf"}

package/lib/types/dsh-adapter/oauth/deepseek.js

@@ -0,0 +1,189 @@
+/**
+ * TUI interaction for the Host-owned DeepSeek account authorization flow.
+ *
+ * The Host owns PKCE, its callback route, credential persistence, and the
+ * `deepseek-account` LLM route. This module supplies a loopback callback
+ * origin, mounts the official Host listener when an older bundle patch omits
+ * it, and displays the Host's safe attempt state through the existing question
+ * panel. It never reads or writes the account grant.
+ */
+import { readFileSync } from 'node:fs';
+import { getLang } from '../../i18n.js';
+import { QuestionBridge } from './interaction.js';
+export const DEEPSEEK_ACCOUNT_PROVIDER = 'deepseek-account';
+/** Resolve late: the account provider is absent on older DSH hosts. */
+export function deepSeekAccountFrom(ctx) {
+    return ctx.get('deepseekAccount');
+}
+/** The Host webServer may be shared, supplied by the TUI row, or mounted as a fallback. */
+export function deepSeekCallbackOrigin(ctx) {
+    const server = ctx.get('webServer');
+    const port = server?.port;
+    if (port === undefined || !Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error('DeepSeek sign-in needs an active Host webServer for the browser callback');
+    }
+    return `http://127.0.0.1:${port}`;
+}
+/**
+ * Keep DeepSeek login usable after a profile-only update from a global TUI
+ * whose older bundle patch still mounts `dsh-tui-auth` but has no webserver
+ * row. The official Host listener is mounted only on the first login that
+ * needs it; an existing Web or user-owned listener is never replaced.
+ */
+export function createDeepSeekCallbackOriginResolver(ctx) {
+    let fallback;
+    let mounting;
+    let disposed = false;
+    const mountFallback = async () => {
+        const { WebServer } = await import('@deepseek-ai/dsh-host-webserver');
+        if (disposed)
+            throw new Error('dsh-auth: callback listener owner was disposed');
+        // Another Host row may have become available while the import resolved.
+        if (ctx.get('webServer') !== undefined)
+            return;
+        const fiber = ctx.root.plugin(WebServer, { host: '127.0.0.1', port: 0 });
+        fallback = fiber;
+        try {
+            await fiber;
+        }
+        catch (error) {
+            fallback = undefined;
+            try {
+                await fiber.dispose();
+            }
+            catch (disposeError) {
+                throw new AggregateError([error, disposeError], 'DeepSeek callback listener failed to start and dispose');
+            }
+            throw error;
+        }
+    };
+    return {
+        resolve: async () => {
+            if (disposed)
+                throw new Error('dsh-auth: callback listener owner was disposed');
+            if (ctx.get('webServer') === undefined) {
+                // A declared but unavailable listener is a composition decision or
+                // failure, not the missing row of an older global TUI patch.
+                const loader = ctx.get('loader');
+                for (const entry of loader?.entries() ?? []) {
+                    if (entry.options.id === 'dsh-tui-webserver'
+                        || entry.options.name === '@deepseek-ai/dsh-host-webserver') {
+                        return deepSeekCallbackOrigin(ctx);
+                    }
+                }
+                mounting ??= mountFallback().finally(() => { mounting = undefined; });
+                try {
+                    await mounting;
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    throw new Error(`DeepSeek sign-in could not start a Host webServer callback listener: ${message}`, { cause: error });
+                }
+            }
+            if (disposed)
+                throw new Error('dsh-auth: callback listener owner was disposed');
+            return deepSeekCallbackOrigin(ctx);
+        },
+        dispose: async () => {
+            disposed = true;
+            await mounting?.catch(() => undefined);
+            await fallback?.dispose();
+            fallback = undefined;
+        },
+    };
+}
+const tuiVersion = (() => {
+    try {
+        const manifest = JSON.parse(readFileSync(new URL(import.meta.resolve('@deepseek-harness-tui/dsh-tui/package.json')), 'utf8'));
+        return typeof manifest.version === 'string' ? manifest.version : '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
+/** Platform request identity is supplied by the current TUI, not cached by the Host. */
+export function deepSeekClientMetadata() {
+    return {
+        version: tuiVersion,
+        locale: getLang() === 'zh' ? 'zh-CN' : 'en-US',
+        timezoneOffsetSeconds: -new Date().getTimezoneOffset() * 60,
+    };
+}
+function succeeded(state, id) {
+    return state.attempt?.id === id && state.attempt.phase === 'succeeded' && state.status === 'credential-stored';
+}
+/**
+ * Start (or join) the upstream browser attempt, display its URL, and wait for
+ * the upstream state stream. Esc/external abort cancels the exact attempt;
+ * a commit that won that race is reported as success instead of a false
+ * cancellation. The question panel is always retired before returning.
+ */
+export async function loginDeepSeekAccount(account, callbackOrigin, ask, signal, helpers = {}) {
+    const runAbort = new AbortController();
+    const forwardAbort = () => runAbort.abort(signal?.reason);
+    if (signal !== undefined) {
+        if (signal.aborted)
+            forwardAbort();
+        else
+            signal.addEventListener('abort', forwardAbort, { once: true });
+    }
+    const bridge = new QuestionBridge(ask, runAbort, helpers);
+    let id;
+    let active = false;
+    try {
+        runAbort.signal.throwIfAborted();
+        // Match Desktop's login_source for Platform-side promotion eligibility.
+        const initial = await account.startSignIn(deepSeekClientMetadata(), callbackOrigin, 'desktop');
+        id = initial.attempt?.id;
+        if (id === undefined)
+            throw new Error('DeepSeek sign-in returned no attempt');
+        active = true;
+        runAbort.signal.throwIfAborted();
+        let shownUrl;
+        try {
+            for await (const state of account.watch(runAbort.signal)) {
+                const attempt = state.attempt;
+                if (attempt?.id !== id)
+                    throw new Error('DeepSeek sign-in attempt was replaced');
+                if (attempt.phase === 'waiting-browser' && attempt.authorizeUrl !== undefined
+                    && attempt.authorizeUrl !== shownUrl) {
+                    shownUrl = attempt.authorizeUrl;
+                    bridge.notify({ type: 'auth_url', url: shownUrl });
+                }
+                if (attempt.phase === 'succeeded') {
+                    active = false;
+                    if (!succeeded(state, id))
+                        throw new Error('DeepSeek sign-in succeeded without a stored credential');
+                    return;
+                }
+                if (attempt.phase === 'failed' || attempt.phase === 'expired' || attempt.phase === 'cancelled') {
+                    active = false;
+                    throw new Error(`DeepSeek sign-in ${attempt.phase}${attempt.errorCode === undefined ? '' : ` (${attempt.errorCode})`}`);
+                }
+            }
+        }
+        catch (error) {
+            if (!runAbort.signal.aborted)
+                throw error;
+        }
+        if (runAbort.signal.aborted) {
+            const afterCancel = await account.cancelSignIn(id);
+            active = false;
+            if (succeeded(afterCancel, id))
+                return;
+            throw new Error('DeepSeek sign-in cancelled');
+        }
+        throw new Error('DeepSeek sign-in state stream ended before completion');
+    }
+    finally {
+        signal?.removeEventListener('abort', forwardAbort);
+        runAbort.abort();
+        try {
+            if (active && id !== undefined)
+                await account.cancelSignIn(id);
+        }
+        finally {
+            await bridge.settle();
+        }
+    }
+}

package/{node_modules/@deepseek-harness-tui/dsh-auth/lib → lib/types/dsh-adapter/oauth}/index.d.ts

@@ -1,21 +1,27 @@
 /**
- * dsh-auth — subscription OAuth sign-in as LLM provider routes.
+ * Built-in subscription OAuth sign-in as LLM provider routes.
  *
- * One cordis plugin mounts the pi-ai catalog providers that ship OAuth flows
- * (ChatGPT/Codex, Claude Pro/Max, SuperGrok) as `llm` registry routes, so
- * their models appear in every model picker the moment the plugin loads —
- * signing in is the only missing credential. `PiAiAdapter` runs with this
- * plugin's file-backed pi-ai `CredentialStore` injected
+ * One internal Cordis module mounts supported subscription routes from the
+ * installed pi-ai catalog (ChatGPT/Codex, Claude, Grok, and newer flows when
+ * available) as `llm` registry routes. Signed-in models appear in model
+ * pickers; unsigned routes remain addressable for saved sessions. When the
+ * Host supplies `deepseekAccount`, the same sign-in surface also delegates
+ * DeepSeek browser authorization to that service; the Host owns its model
+ * route, callback, and credential store.
+ * `PiAiAdapter` runs with this
+ * module's file-backed pi-ai `CredentialStore` injected
  * (`PiAiAuthInjection`): requests resolve the stored OAuth credential through
  * the provider's own auth and rotate refresh tokens under the store's lock.
  * Login/logout run over the `userQuestions` seam, so they work on any
  * interactive surface and refuse cleanly where none exists (TUI-RUN-001).
  *
  * ```yaml
- * - id: dsh-auth
- *   name: 'dsh-auth'
+ * - id: dsh-tui-auth
+ *   name: '@deepseek-harness-tui/dsh-tui/oauth'
+ *   inject: [llm, commands]
  *   config:
- *     providers: [openai-codex, anthropic, xai]   # subset of the mounted set
+ *     # providers: [openai-codex, anthropic, xai]  # optional catalog subset;
+ *     # newer pi-ai also offers openai and meta
  *     # credentialsFile: /secure/path/credentials.json   # default $DSH_HOME/dsh-auth/
  *     # Per-provider catalog overrides, keyed by provider id then model id:
  *     # any optional field keeps the installed catalog's value. The example
@@ -30,7 +36,7 @@
  * (an llm-pi-ai settings profile for the same provider) is refused by the
  * registry — that refusal is logged and the remaining routes still mount.
  *
- * @module dsh-auth
+ * @module @deepseek-harness-tui/dsh-tui/oauth
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
@@ -43,15 +49,14 @@ export declare const name = "dsh-auth";
  * Deliberately empty. A hard code-level inject would deadlock any
  * composition lacking the `llm`/`commands` services at boot ("pending
  * (waiting for service: …)") — the failure mode dsh-tui documented for its
- * own optional rows (#183). Both services resolve per call through
- * `ctx.get` in {@link apply}; compositions that guarantee them (the
- * dsh-tui patch row, this package's bundle patch) declare the inject at the
- * *entry* level, where a stale patch cannot deadlock a newer boot.
+ * optional rows (#183). Both services resolve per call through `ctx.get` in
+ * {@link apply}; the profile patch declares the inject at the *entry* level,
+ * where a stale patch cannot deadlock a newer boot.
  */
 export declare const inject: readonly string[];
 /** Plugin configuration. */
 export interface Config {
-    /** Provider routes to mount; every entry must ship an OAuth flow in the installed pi-ai catalog. */
+    /** Provider routes to mount; omitted means every supported flow in the installed pi-ai catalog. */
     providers?: string[];
     /** Credential file override; default `$DSH_HOME/dsh-auth/credentials.json`. */
     credentialsFile?: string;
@@ -70,7 +75,9 @@ export { QuestionBridge, describeEvent } from './interaction.js';
 export type { AskFn, QuestionBridgeHelpers } from './interaction.js';
 export { copyToClipboard, openInBrowser, openerFor } from './opener.js';
 export { CredentialFile, defaultCredentialsFile } from './credentials.js';
-export { OAUTH_PROVIDER_IDS, buildOAuthProfile, type ModelOverride } from './profiles.js';
+export { OAUTH_PROVIDER_IDS, availableOAuthProviderIds, buildOAuthProfile, type ModelOverride } from './profiles.js';
+export { DEEPSEEK_ACCOUNT_PROVIDER, deepSeekAccountFrom, deepSeekCallbackOrigin, deepSeekClientMetadata, loginDeepSeekAccount } from './deepseek.js';
+export { WhaleCouponStore } from './bonus.js';
 /**
  * The adapter the plugin registers: a {@link PiAiAdapter} whose *advisory
  * catalog* is credential-gated. A provider with no stored OAuth credential
@@ -92,3 +99,4 @@ export declare class CredentialGatedAdapter extends PiAiAdapter {
 }
 /** Mount the routes, the service, and the command. */
 export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/dsh-adapter/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/dsh-adapter/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,OAAO,KAAK,EAAc,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,EAAoE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AAOpH,eAAO,MAAM,IAAI,aAAa,CAAA;AAC9B;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,EAAE,SAAS,MAAM,EAAO,CAAA;AAgB3C,4BAA4B;AAC5B,MAAM,WAAW,MAAM;IACrB,mGAAmG;IACnG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;CAC/D;AAOD,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAI3B,CAAA;AAEF,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACvG,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAA;AACpH,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpJ,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAkB7C;;;;;;;;;;;;;GAaG;AACH,qBAAa,sBAAuB,SAAQ,WAAW;IAGnD,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAD9B,OAAO,EAAE,kBAAkB,EACV,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;IAKzD,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC;CAI9E;AAED,sDAAsD;AACtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAuHxD"}