@dmh2002/dsh-connect-qoder 0.0.0-stage → 0.4.0

package/lib/status-paths-w2WDUPVS.js

@@ -0,0 +1,218 @@
+//#region src/status-paths.ts
+/**
+* Node-free constants and types shared by the Host and browser halves.
+*
+* 参考：dsh-connect-workbuddy（MIT，Copyright (c) 2026 LaoDing）的
+*   `status-paths.ts` ——「同源路由常量 + 区域参数 + 与浏览器共享的
+*   node-free DTO + 配置读取 helper（volatile 解包）」的 host↔client
+*   桥梁形态整体沿用；其又上承 dingminhua/dsh-connect-trae（MIT）与
+*   corrinehu/dsh-workbuddy-connect（MIT）的 status-route 模式。
+* 改动（按 Qoder 上游的实际能力）：
+*   1. 凭据是 PAT，不是桌面端登录文件——没有 searched-paths 诊断，
+*      账号来源是 settings / 环境变量 / 插件自有保险库三种；
+*   2. 每日签到走 Qoder 的 campaigns 端点（CN 与国际版都已接通），池的批量动作
+*      因此是 checkin / test 两个；`checkinSupported` 仍按区域可判，字段保留；
+*   3. 扫码登录换成「添加 PAT」：accounts 路由的 add/remove 动作；
+*   4. 积分模型是「基础/附加/组织」三个额度桶，聚合成与家族一致的
+*      packages 形状；模型字段是倍率/上下文档位/推理与多模态标记。
+*
+* @module dsh-connect-qoder/status-paths
+*/
+/** Plugin-owned usage endpoint consumed by its browser half. */
+const QODER_USAGE_PATH = "/plugins/dsh-connect-qoder/usage";
+/**
+* Per-account credit balances for one region, read ONLY while the composer
+* panel is open.
+*
+* Separate from {@link QODER_USAGE_PATH} because its cost is different in
+* kind: the usage document is one upstream read for the selected account,
+* while this is one read PER account in the region. Folding it into the usage
+* route would make every 5-minute refresh pay for a table nobody is looking
+* at, so it is fetched on demand instead — the same principle the pool
+* applies to its per-account figures.
+*/
+const QODER_ACCOUNT_CREDITS_PATH = "/plugins/dsh-connect-qoder/account-credits";
+/**
+* The project's public repository.
+*
+* Lives here rather than beside one component because TWO sections link to it
+* — the model section and the account pool — and a second copy of a URL is a
+* second thing to forget when it moves. Node-free and side-effect free, so it
+* costs nothing on the Host side either.
+*/
+const QODER_GITHUB_URL = "https://github.com/dingminhua/dsh-connect-qoder";
+/** Plugin-owned live model refresh endpoint. */
+const QODER_MODELS_REFRESH_PATH = "/plugins/dsh-connect-qoder/models/refresh";
+/** Plugin-owned account rescan endpoint (re-reads settings / env / vault). */
+const QODER_ACCOUNTS_REFRESH_PATH = "/plugins/dsh-connect-qoder/accounts/refresh";
+/**
+* Plugin-owned account mutation endpoint: add or remove one account.
+*
+* `?action=add` POSTs `{ pat, name? }`: the Host validates the PAT against
+* the region's gateway (a jobToken exchange doubles as the cheapest
+* authenticated check and yields the account's display name) and stores it in
+* the plugin-owned vault. `?action=remove` POSTs `{ accountId }` and deletes
+* the vault entry. POST + loopback-only: both carry token material or mutate
+* stored credentials.
+*/
+const QODER_ACCOUNTS_PATH = "/plugins/dsh-connect-qoder/accounts";
+/**
+* Plugin-owned model probe endpoint.
+*
+* Sends one minimal chat request per named model so the card can answer "is
+* this model usable right now, and if it is limited, when can it be used
+* again?". Lives on the Host because the credential must never reach the
+* browser half.
+*/
+const QODER_PROBE_PATH = "/plugins/dsh-connect-qoder/probe";
+/**
+* Plugin-owned account-pool endpoint: one batch action per call.
+*
+* `?action=test` probes every checked account against the region's target
+* model; `?action=remove` drops one account's membership. Both are POST and
+* loopback-only because a probe spends credits and removal mutates a
+* preference.
+*
+* Deliberately ONE endpoint rather than two: the actions share every guard
+* (method, origin, region) and differ only in the work, so splitting them
+* would duplicate the guards and invite them to drift apart.
+*/
+const QODER_POOL_PATH = "/plugins/dsh-connect-qoder/pool";
+/**
+* Plugin-owned account transfer endpoint: the batch export / import of PAT
+* credentials between machines.
+*
+* `?action=export` POSTs account ids, answers a JSON ARRAY of credential
+* records; `?action=preview` POSTs file text, answers a token-free listing;
+* `?action=import` POSTs file text plus selected indexes, merges into the
+* vault. POST + loopback-only like every other mutation: the file content is
+* arbitrary user data and export carries token material.
+*/
+const QODER_TRANSFER_PATH = "/plugins/dsh-connect-qoder/transfer";
+/**
+* Plugin-owned settings write fallback: the card's writes go through the
+* settings mirror when it is healthy, and through this Host-side endpoint
+* when the mirror refuses or lags (a measured 0.1.7 behaviour the sibling
+* plugin hit: `settings/mutate` from the browser can leave the mirror stale
+* while the Host accepted the write).
+*/
+const QODER_SAVE_PATH = "/plugins/dsh-connect-qoder/__save";
+/** Query parameter naming the region a card request addresses. */
+const QODER_REGION_PARAM = "region";
+/** Every region, in card tab order. */
+const QODER_REGIONS = ["cn", "global"];
+/**
+* Read the region parameter off a status-route URL. Absent means the domestic
+* tab (`cn`); a present-but-unknown value returns undefined so the route can
+* answer 400 instead of guessing.
+*/
+function regionOfStatusUrl(url) {
+	const at = url.indexOf("?");
+	const value = at === -1 ? null : new URLSearchParams(url.slice(at + 1)).get(QODER_REGION_PARAM);
+	if (value === null || value === "") return "cn";
+	return QODER_REGIONS.includes(value) ? value : void 0;
+}
+/** Query parameter selecting which action a request means. */
+const QODER_ACTION_PARAM = "action";
+/** Read the pool action off a request URL; unknown/absent means undefined. */
+function poolActionOf(url) {
+	const value = actionParamOf(url);
+	return value === "checkin" || value === "test" || value === "remove" ? value : void 0;
+}
+/** Read the account action off a request URL; unknown/absent means undefined. */
+function accountActionOf(url) {
+	const value = actionParamOf(url);
+	return value === "add" || value === "remove" ? value : void 0;
+}
+/** Read the transfer action off a request URL; unknown/absent means undefined. */
+function transferActionOf(url) {
+	const value = actionParamOf(url);
+	return value === "export" || value === "preview" || value === "import" ? value : void 0;
+}
+/** Read the shared action parameter; unknown/absent means undefined. */
+function actionParamOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(QODER_ACTION_PARAM);
+	return value === null || value === "" ? void 0 : value;
+}
+/** Query parameter naming ONE pool account a per-row request addresses. */
+const QODER_POOL_ACCOUNT_PARAM = "accountId";
+/** Read the per-row account id off a request URL, when the action takes one. */
+function poolAccountIdOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(QODER_POOL_ACCOUNT_PARAM);
+	return value !== null && value !== "" ? value : void 0;
+}
+/** All region keys, in display order. The single source for region loops. */
+const QODER_WEB_REGIONS = ["cn", "global"];
+/** Every domain {@link knownQoderRegionOfDomain} admits, i.e. the transfer domains. */
+const TRANSFER_DOMAINS = ["qoder.com.cn", "qoder.sh"];
+/**
+* The login domain a transfer record must carry to belong to a region.
+*
+* Qoder has two gateways with distinct hosts, so a transferred PAT identifies
+* its region by the host it was minted against — `qoder.com.cn` is the CN
+* gateway's domain, `qoder.sh` the international one.
+*/
+function knownQoderRegionOfDomain(domain) {
+	if (domain === "qoder.com.cn") return "cn";
+	if (domain === "qoder.sh") return "global";
+}
+/**
+* 该区域的**传输域名**：导出账号时写进 transfer 文件的 `domain` 字段。
+*
+* 与 {@link knownQoderRegionOfDomain}（域名 → 区域）是同一组事实的**反向读法**，
+* 所以在这里定义、并从那张反查表**推导**出来，而不是再手抄一遍域名 —— 手抄才是
+* 这两处漂移过一次就很难被发现的原因。推导失败即抛错，让漏登记的区域在编译期
+* 与首屏就暴露，而不是等到用户导出才发现。
+*
+* 注意这与 {@link QODER_CONSOLE_DOMAIN} **不是同一个域名**：那边是用户浏览器里
+* 申请 PAT 的控制台（国际版是 `qoder.com`），这边是 PAT 实际发证方所在的网关域
+* （国际版是 `qoder.sh`），导入时的区域门只认后者。
+*/
+const QODER_REGION_TRANSFER_DOMAIN = (() => {
+	const table = {};
+	for (const region of QODER_WEB_REGIONS) table[region] = "";
+	for (const domain of TRANSFER_DOMAINS) {
+		const region = knownQoderRegionOfDomain(domain);
+		if (region === void 0) throw new Error(`transfer domain is not a known Qoder region: ${domain}`);
+		table[region] = domain;
+	}
+	for (const region of QODER_WEB_REGIONS) if (table[region] === "") throw new Error(`region has no transfer domain: ${region}`);
+	return table;
+})();
+/**
+* Deep copy of a settings value with every `{get(): T}` live reference
+* replaced by the value it resolves to.
+*
+* `regions` is declared `asVolatile(...)`, and schemastery resolves a volatile
+* field to a live reference. A live reference is still `typeof === 'object'`,
+* so `{ ...reference }` does NOT read the field: it produces
+* `{ get: <function> }`. Any caller that spreads the resolved field to
+* preserve its siblings would otherwise DROP every sibling and leak a
+* function into the document. Both halves therefore unwrap before touching a
+* resolved field.
+*/
+function unwrapVolatileDeep(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (typeof value.get === "function") return unwrapVolatileDeep(value.get());
+	if (Array.isArray(value)) return value.map((entry) => unwrapVolatileDeep(entry));
+	const source = value;
+	const out = {};
+	for (const key of Object.keys(source)) out[key] = unwrapVolatileDeep(source[key]);
+	return out;
+}
+/**
+* The plugin's DECLARED settings namespace — the fallback name, not the value
+* the host necessarily serves.
+*
+* On 0.1.7 the settings service keys every form by the plugin's Loader entry
+* id (`describe()` returns `ns: entry.options.id`), and the harness resolves
+* a provider's namespace by EXACT match. The entry id is chosen by the
+* profile patch (`cordis.patch.yml`), so the declared id mirrors it.
+*/
+const QODER_SETTINGS_NS = "dsh-connect-qoder";
+//#endregion
+export { regionOfStatusUrl as _, QODER_MODELS_REFRESH_PATH as a, QODER_REGIONS as c, QODER_SETTINGS_NS as d, QODER_TRANSFER_PATH as f, poolActionOf as g, poolAccountIdOf as h, QODER_GITHUB_URL as i, QODER_REGION_TRANSFER_DOMAIN as l, accountActionOf as m, QODER_ACCOUNTS_REFRESH_PATH as n, QODER_POOL_PATH as o, QODER_USAGE_PATH as p, QODER_ACCOUNT_CREDITS_PATH as r, QODER_PROBE_PATH as s, QODER_ACCOUNTS_PATH as t, QODER_SAVE_PATH as u, transferActionOf as v, unwrapVolatileDeep as y };

package/lib/transfer-CUNaVvmi.js

@@ -0,0 +1,172 @@
+import { g as qoderAccountId } from "./host-heartbeat-BNuj6Lt_.js";
+import { l as QODER_REGION_TRANSFER_DOMAIN } from "./status-paths-w2WDUPVS.js";
+//#region src/transfer.ts
+/**
+* Account transfer: the export / import file format shared with sibling
+* credential managers for the same upstream.
+*
+* 参考：dsh-connect-workbuddy（MIT，Copyright (c) 2026 LaoDing）的
+*   `src/transfer.ts` —— 传输文件格式（JSON 数组、snake_case 字段、去重、
+*   预览不回明文、解析不依赖文件系统、区域门放在纯函数里以便无 UI 单测）
+*   的形态整体沿用；工作清单上又是家族内各 DSH 插件的既有互操作约定。
+* 改动（按 Qoder 上游的实际能力）：
+*   1. 凭据是 PAT，不是桌面端登录文件——记录只承载 `access_token`（即
+*      PAT）、`uid`（PAT 派生的账号 id）、`nickname`、`email`、`domain`，
+*      没有 refresh_token / expiresAt 一族字段（PAT 一般无过期）；
+*   2. domain 只取两个上游区域值——`qoder.com.cn`（cn）/ `qoder.sh`
+*      （global）——区域门用白名单正匹配：值不属于目标区域的记录一律跳过，
+*      不做「当作哪个区域都行」的默认，避免跨区导入交叉计费或收进伪装域；
+*   3. 账号 id 由 PAT 单向散列派生（`credentials.ts` 的 `qoderAccountId`），
+*      合并按 id 去重、以同 id 覆盖；import 落库由 Host 侧的
+*      `QoderAccountStore.add(pat, accountName)` 完成，`nickname` → accountName。
+*
+* @module dsh-connect-qoder/transfer
+*/
+/**
+* Parse transfer-file text: a JSON array, every element an object.
+*
+* The error strings carry the position (1-based item number) because a file
+* from another tool can be big, and "第 N 项" is what lets the user find the
+* broken record in their editor.
+*/
+function parseTransferFile(text) {
+	if (text.trim() === "") throw new Error("transfer file is empty");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		throw new Error("transfer file is not valid JSON: " + (error instanceof Error ? error.message : String(error)));
+	}
+	if (!Array.isArray(parsed)) throw new Error("transfer file must be a JSON array of account records");
+	for (const [index, item] of parsed.entries()) if (typeof item !== "object" || item === null || Array.isArray(item)) throw new Error("transfer file item " + (index + 1) + " is not an account object");
+	return parsed;
+}
+/** One string field of a record, tolerating the sibling format's odd shapes. */
+function displayString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+/** Whether a record carries a usable token, envelope-shaped or plain. */
+function hasToken(record) {
+	const token = record["access_token"];
+	return typeof token === "string" && token !== "";
+}
+/**
+* The transfer file's desensitized preview: display fields only.
+*
+* Fields come from EXTERNAL files, so a display field may hold an object or an
+* array (a sibling tool can store the desktop app's encrypted-wrapper nickname
+* verbatim); every preview field is normalized to a string or emptied rather
+* than letting a non-renderable value reach the card.
+*/
+function previewTransferFile(text) {
+	const records = parseTransferFile(text);
+	return {
+		accounts: records.map((record, index) => ({
+			index,
+			uid: displayString(record["uid"]),
+			nickname: displayString(record["nickname"]),
+			email: displayString(record["email"]),
+			hasToken: hasToken(record)
+		})),
+		total: records.length
+	};
+}
+/**
+* Project one stored vault account into the shared transfer record shape.
+*
+* `regionDomain` is the target region's login domain (`qoder.com.cn` for cn,
+* `qoder.sh` for global); the export caller passes it so the imported file
+* self-describes which region each record belongs to. `uid` is the PAT-derived
+* account id so a re-import converges on the SAME vault key. `nickname` is
+* dropped — never set to empty/undefined — when the account has no name, and
+* `access_token` carries the PAT itself.
+*/
+function transferRecordOf(account, regionDomain) {
+	return {
+		access_token: account.pat,
+		uid: account.id,
+		...account.accountName !== "" ? { nickname: account.accountName } : {},
+		domain: regionDomain
+	};
+}
+/**
+* Project a region's whole vault into the exported transfer document.
+*
+* This is the ONE place the export path turns vault accounts into records;
+* the `exportAccounts` dep (`index.ts`) MUST go through it. It used to be
+* written inline in `exportAccounts` as a raw `{pat, accountName, id}` map,
+* which is what produced files that could never be re-imported: the region
+* gate (`mergeTransferRecords`) reads `domain`, and the raw vault shape has
+* none. Keeping the projection here — rather than in the Host wiring — is what
+* lets a test export through it and immediately import the result.
+*/
+function transferRecordsFor(region, accounts) {
+	const domain = QODER_REGION_TRANSFER_DOMAIN[region];
+	return accounts.map((account) => transferRecordOf(account, domain));
+}
+/**
+* Positive-match a record's login domain to a region.
+*
+* Distinct from any upstream-side registry: `domain` is whatever the FILE'S
+* author wrote, so only an exactly-known Qoder domain counts. `qoder.com.cn`
+* and `qoder.sh` are the plugin's two per-region domains; an empty, misspelled,
+* spoofed, or registrable-domain-lookalike value classifies as undecidable and
+* is refused rather than being filed under either region.
+*/
+function knownRegionOfDomain(domain) {
+	if (domain === "qoder.com.cn") return "cn";
+	if (domain === "qoder.sh") return "global";
+}
+/**
+* Pure merge: fold the selected records of a transfer file into a CHANGES map.
+*
+* Mirrors the sibling merger's contract: a record with the same account id
+* OVERWRITES the stored entry (the imported PAT replaces what is stored —
+* re-importing a rotated PAT must refresh it; the write layer stores the record
+* atomically, so "overwrite" needs no knowledge of the incumbent), and a
+* record without a token is skipped. The region gate lives HERE rather than in
+* the route so it is testable without a Host: a record whose login domain maps
+* to the other region's tab is skipped, because the two regions' providers are
+* parallel stacks and a cross-region import would cross-bill.
+*
+* The caller persists each map entry via `QoderAccountStore.add`; an importing
+* selection that is already stored rewrites those entries with identical
+* content — idempotent, and the steady state of importing the same file twice.
+*/
+function mergeTransferRecords(region, text, indexes) {
+	const records = parseTransferFile(text);
+	const changes = /* @__PURE__ */ new Map();
+	let imported = 0;
+	let skipped = 0;
+	for (const index of indexes) {
+		const record = records[index];
+		if (record === void 0) {
+			skipped += 1;
+			continue;
+		}
+		const accessToken = record["access_token"];
+		if (typeof accessToken !== "string" || accessToken === "") {
+			skipped += 1;
+			continue;
+		}
+		if (knownRegionOfDomain(record["domain"]) !== region) {
+			skipped += 1;
+			continue;
+		}
+		const id = qoderAccountId(accessToken);
+		changes.set(id, {
+			pat: accessToken,
+			accountName: displayString(record["nickname"])
+		});
+		imported += 1;
+	}
+	return {
+		changes,
+		imported,
+		skipped
+	};
+}
+//#endregion
+export { mergeTransferRecords, previewTransferFile, transferRecordsFor };

package/package.json

@@ -1,6 +1,137 @@
 {
   "name": "@dmh2002/dsh-connect-qoder",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "displayName": "DSH Connect Qoder",
+  "description": "把 Qoder（通义灵码国内版 / 国际版）接入 DeepSeek Harness：PAT 多账号池、每日签到、积分读数与模型管理。",
+  "version": "0.4.0",
+  "author": "dingminhua",
+  "copyright": "Copyright (c) 2026 LaoDing",
+  "license": "MIT",
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "qoder",
+    "lingma",
+    "model-provider",
+    "credits",
+    "account-pool",
+    "check-in"
+  ],
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "bin": {
+    "dsh-connect-qoder": "lib/bin.js"
+  },
+  "icon": "icons/dsh-connect-qoder-128.png",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.4"
+  },
+  "files": [
+    "lib",
+    "icons",
+    "docs/assets",
+    "docs/PAT.md",
+    "docs/DESIGN.md",
+    "screenshots.json",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "CHANGELOG.md",
+    "THIRD_PARTY_NOTICES.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "prepack": "npm run build",
+    "build": "tsdown",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.client.json",
+    "check": "pnpm run typecheck && pnpm run test && pnpm run build",
+    "probe:cosy": "node scripts/probe-cosy.mjs",
+    "probe:vault": "node scripts/dump-vault.mjs"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings-plugins",
+        "@deepseek-ai/dsh-client-locale"
+      ],
+      "platform": "web"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dingminhua/dsh-connect-qoder.git"
+  },
+  "homepage": "https://github.com/dingminhua/dsh-connect-qoder#readme",
+  "bugs": {
+    "url": "https://github.com/dingminhua/dsh-connect-qoder/issues"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.1-rc.1 <5.0.0 || >=4.0.2 <5.0.0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-attachment": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/schemastery": ">=3.18.1-rc.1 <4.0.0 || >=3.18.2 <4.0.0",
+    "@earendil-works/pi-ai": ">=0.85.0 <0.88.0",
+    "react": "^18.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.1 <5.0.0 || >=4.0.2 <5.0.0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-attachment": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1 <0.2.0-0 || >=0.2.0-rc.1 <0.3.0-0",
+    "@deepseek-ai/schemastery": ">=3.18.1 <4.0.0 || >=3.18.2 <4.0.0",
+    "@earendil-works/pi-ai": ">=0.85.0 <0.88.0",
+    "@types/node": "^22.20.0",
+    "@types/react": "~18.3.31",
+    "@types/react-dom": "18.3.7",
+    "@types/semver": "^7.8.0",
+    "jsdom": "^29.1.1",
+    "react": "^18.3.1",
+    "react-dom": "18.3.1",
+    "semver": "^7.8.5",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.8"
+  }
+}

package/screenshots.json

@@ -0,0 +1,6 @@
+[
+  "docs/assets/dsh-connect-qoder-usage-card.png",
+  "docs/assets/dsh-connect-qoder-model-management.png",
+  "docs/assets/dsh-connect-qoder-composer-credits.png",
+  "docs/assets/dsh-connect-qoder-model-picker.png"
+]