@goodandready/dsh-subscriptions 0.7.10 → 0.7.11

package/bin/dsh-subscriptions.mjs

@@ -6,11 +6,12 @@ import { readFile } from 'node:fs/promises'
 export function parseArgs(argv) {
   const args = Array.isArray(argv) ? argv.slice() : []
   const command = args.shift() || 'status'
-  const options = { command, csv: false, json: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
+  const options = { command, csv: false, json: false, once: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i]
     if (arg === '--csv') options.csv = true
     else if (arg === '--json') options.json = true
+    else if (arg === '--once') options.once = true
     else if (arg === '--help' || arg === '-h') options.help = true
     else if (arg === '--type') options.type = args[++i] || 'accounts'
     else if (arg === '--session') options.sessionId = args[++i] || ''
@@ -125,6 +126,36 @@ export function formatPacks(packs) {
   return JSON.stringify((Array.isArray(packs) ? packs : []).map(sanitizePack), null, 2) + '\\n'
 }
 
+export function renderTui(data, { color = false } = {}) {
+  const health = (data && data.health) || {}
+  const checks = health.checks || {}
+  const sources = (data && data.sources) || {}
+  const snapshots = (data && data.snapshots && data.snapshots.stats) || {}
+  const accounts = Array.isArray(data && data.accounts) ? data.accounts : []
+  const dim = (text) => color ? '\x1b[2m' + text + '\x1b[0m' : text
+  const green = (text) => color ? '\x1b[32m' + text + '\x1b[0m' : text
+  const red = (text) => color ? '\x1b[31m' + text + '\x1b[0m' : text
+  const lines = []
+  lines.push('DSH Subscriptions' + (health.version ? ' ' + health.version : '') + '  ' + (health.status === 'healthy' ? green('healthy') : red(health.status || 'unknown')))
+  lines.push(dim('accounts: ' + (checks.connectedAccounts || 0) + ' configured · key-rotation: ' + (checks.keyRotation ? 'yes' : 'no') + ' · ollama: ' + (checks.ollama ? 'yes' : 'no') + ' · webhook: ' + (checks.webhook ? 'yes' : 'no')))
+  lines.push('')
+  lines.push('ACCOUNTS')
+  for (const account of accounts) {
+    if (!account || !account.provider) continue
+    const usage = account.usagePercent == null ? '-' : Math.round(account.usagePercent) + '%'
+    lines.push('  ' + String(account.provider).padEnd(14) + '#' + (account.index || 1) + '  ' + (account.configured ? green('ok') : dim('off')) + '  ' + usage)
+  }
+  lines.push('')
+  lines.push('SOURCES')
+  for (const row of (sources.providers || [])) lines.push('  ' + String(row.provider).padEnd(14) + (row.selected || dim('none')))
+  lines.push('')
+  lines.push('VAULT')
+  lines.push('  snapshots: ' + (snapshots.count || 0) + ' · ' + (snapshots.bytes || 0) + ' bytes')
+  lines.push('')
+  lines.push(dim('r refresh · q quit'))
+  return lines.join('\n')
+}
+
 export function formatSnapshotStatus(payload) {
   const stats = (payload && payload.stats) || {}
   return 'snapshots: ' + (stats.count || 0) + '  bytes: ' + (stats.bytes || 0) + '  path: ' + (stats.path || '-')
@@ -176,6 +207,21 @@ export function buildSetRequest(options, configPayload, env = process.env) {
 export async function run(argv = process.argv.slice(2), env = process.env, fetchImpl = fetch) {
   const options = parseArgs(argv)
   if (options.help) return { help: true }
+  if (options.command === 'tui') {
+    const base = String(env.DSH_SUBS_URL || 'http://127.0.0.1:3080/dsh-subscriptions').replace(/\/$/, '')
+    const headers = { Accept: 'application/json' }
+    if (env.DSH_AUTH_TOKEN) headers.Authorization = 'Bearer ' + env.DSH_AUTH_TOKEN
+    const get = (path) => fetchImpl(base + path, { method: 'GET', headers }).then(async (res) => {
+      const text = await res.text()
+      if (!res.ok) throw new Error('HTTP ' + res.status + ': ' + text.slice(0, 300))
+      return JSON.parse(text || '{}')
+    })
+    const [health, sources, snapshots, config] = await Promise.all([
+      get('/health'), get('/sources'), get('/vault/snapshots'), get('/config'),
+    ])
+    const data = { health, sources, snapshots, accounts: (config && config.accounts) || [] }
+    return { text: renderTui(data, { color: false }), tuiData: data, contentType: 'text/plain' }
+  }
   if (options.command === 'doctor') {
     const diagReq = buildRequest({ command: 'diagnostics' }, env)
     const srcReq = buildRequest({ command: 'sources' }, env)
@@ -242,12 +288,41 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
   return { text, contentType: res.headers.get('content-type') || '' }
 }
 
+async function runTui(initial) {
+  let cleanup = () => {}
+  const paint = (data) => process.stdout.write('\x1b[2J\x1b[H' + renderTui(data, { color: true }) + '\n')
+  paint(initial)
+  const onKey = async (buf) => {
+    const key = String(buf)
+    if (key === 'q' || key === '\u0003') { cleanup(); process.exit(0) }
+    if (key === 'r') {
+      try {
+        const next = await run(['tui', '--once'])
+        if (next.tuiData) paint(next.tuiData)
+      } catch (err) { process.stdout.write('\n' + String(err && err.message || err) + '\n') }
+    }
+  }
+  if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {
+    process.stdin.setRawMode(true)
+    process.stdin.resume()
+    process.stdin.on('data', onKey)
+    cleanup = () => {
+      process.stdin.removeListener('data', onKey)
+      process.stdin.setRawMode(false)
+      process.stdin.pause()
+    }
+  }
+}
+
 async function main() {
-  const result = await run()
+  const argv = process.argv.slice(2)
+  const options = parseArgs(argv)
+  const result = await run(argv)
   if (result.help) {
-    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  doctor [--json]\n')
+    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|tui|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  tui [--once]\n  doctor [--json]\n')
     return
   }
+  if (result.tuiData && !options.once) { await runTui(result.tuiData); return }
   process.stdout.write(result.text.endsWith('\n') ? result.text : result.text + '\n')
   if (result.code) process.exitCode = result.code
 }

package/lib/alerts.js

@@ -16,6 +16,7 @@ try {
 const MAX_ALERTS = 100
 let defaultWebhookSecret = ''
 let defaultAllowPrivate = false
+let defaultWebhookFormat = 'native'
 
 export function setWebhookSecret(secret) {
   defaultWebhookSecret = String(secret || '')
@@ -24,6 +25,35 @@ export function setWebhookSecret(secret) {
 export function setWebhookAllowPrivate(allow) {
   defaultAllowPrivate = Boolean(allow)
 }
+
+export function setWebhookFormat(format) {
+  defaultWebhookFormat = format === 'notify' ? 'notify' : 'native'
+}
+
+export function toNotifyPayload(body) {
+  const sentAt = new Date().toISOString()
+  if (body && body.alert) {
+    return {
+      kind: body.alert.severity === 'info' ? 'task_done' : 'error',
+      title: 'DSH Subscriptions',
+      sessionId: 'dsh-subscriptions',
+      summary: body.alert.message || body.alert.type || 'subscription alert',
+      reason: body.alert.type || null,
+      source: 'dsh-subscriptions',
+      sentAt,
+    }
+  }
+  const digest = (body && body.digest) || { total: 0 }
+  return {
+    kind: digest.total > 0 ? 'error' : 'task_done',
+    title: 'DSH Subscriptions digest',
+    sessionId: 'dsh-subscriptions',
+    summary: String(digest.total || 0) + ' alerts in the digest',
+    reason: 'digest',
+    source: 'dsh-subscriptions',
+    sentAt,
+  }
+}
 const DEDUP_WINDOW_MS = 10 * 60 * 1000 // 10 minutes cooldown per (ref + type)
 
 const alertBuffer = []
@@ -106,10 +136,13 @@ async function dispatchNotification(body, webhookUrl, fetchImpl, options) {
   const { retries = 1, timeoutMs = 5000, sleep } = opts
   const secret = opts.secret == null ? defaultWebhookSecret : opts.secret
   const allowPrivate = opts.allowPrivate == null ? defaultAllowPrivate : Boolean(opts.allowPrivate)
+  const format = opts.format == null ? defaultWebhookFormat : opts.format
   const checked = validateWebhookUrl(webhookUrl, { allowPrivate })
   if (!checked.ok) return false
   webhookUrl = checked.url
-  const payload = { ...body, source: 'dsh-subscriptions', sentAt: new Date().toISOString() }
+  const payload = format === 'notify'
+    ? toNotifyPayload(body)
+    : { ...body, source: 'dsh-subscriptions', sentAt: new Date().toISOString() }
   const raw = JSON.stringify(payload)
   const headers = {
     'content-type': 'application/json',

package/lib/client.js

@@ -1885,6 +1885,17 @@ window.__ModuleLoader__.load({
             }),
           ),
           h('div', { className: 'dsub-sub' }, 'Signed POST target for quota, session and billing alerts.'),
+          h('div', { className: 'dsub-row' },
+            h('span', { className: 'dsub-h' }, 'Webhook format'),
+            h('select', {
+              className: 'dsub-select',
+              value: draft.webhookFormat || 'native',
+              onChange: (e) => setDraft((d) => Object.assign({}, d, { webhookFormat: e.target.value })),
+            },
+              h('option', { value: 'native' }, 'Native'),
+              h('option', { value: 'notify' }, 'dsh-plugin-notify compatible'),
+            ),
+          ),
           h('div', { className: 'dsub-row' },
             h('span', { className: 'dsub-h' }, 'Webhook secret'),
             h('input', {

package/lib/config-schema.js

@@ -161,6 +161,8 @@ export const Config = z.object({
     .description('#720 HMAC-SHA256 secret used to sign webhook payloads.'),
   webhookAllowPrivate: z.boolean().volatile().default(false)
     .description('#729 Allow webhook URLs that resolve to private or loopback hosts.'),
+  webhookFormat: z.string().volatile().default('native')
+    .description('#751 Webhook payload format: native or notify (dsh-plugin-notify compatible).'),
   digestIntervalHours: z.number().volatile().default(0)
     .description('#720 Send an alert digest every N hours (0 disables digests).'),
   alertThresholds: z.array(z.number()).volatile().default([80, 90, 95])
@@ -189,6 +191,12 @@ export const Config = z.object({
     .description('#562 Remote storage backend: webdav, gist, or s3.'),
   vaultSyncPassphrase: z.string().role('secret').default('')
     .description('#562 Passphrase used to encrypt/decrypt the remote vault archive.'),
+  vaultDeviceId: z.string().volatile().default('')
+    .description('#749 Stable per-device vault id. Empty derives one from the host.'),
+  vaultDeviceLabel: z.string().volatile().default('')
+    .description('#749 Human-readable device label for vault metadata.'),
+  vaultPerDeviceKeys: z.boolean().volatile().default(true)
+    .description('#749 Derive a per-device passphrase and remote object; legacy shared vault stays readable.'),
   vaultSyncProviders: z.array(z.string()).volatile().default([])
     .description('#691 Optional provider allowlist for selective vault sync. Empty means all providers.'),
   vaultSyncIntervalHours: z.number().volatile().default(24)

package/lib/device-identity.js

@@ -0,0 +1,41 @@
+// #749: stable per-device identity. The passphrase is derived per device so
+// one device cannot decrypt another device's remote object with only the base
+// passphrase; the legacy shared object remains readable as a fallback.
+import { createHash } from 'node:crypto'
+import { hostname, platform, arch } from 'node:os'
+
+export function resolveDeviceIdentity({ id = '', label = '' } = {}) {
+  const host = hostname()
+  const derived = createHash('sha256').update(host + '|' + platform() + '|' + arch()).digest('hex').slice(0, 12)
+  const clean = String(id || derived).replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 32)
+  return { id: clean || derived, label: String(label || host) }
+}
+
+export function devicePassphrase(passphrase, deviceId) {
+  return deviceId ? String(passphrase) + '#' + String(deviceId) : String(passphrase)
+}
+
+export function withDeviceSuffix(name, deviceId) {
+  if (!deviceId) return name
+  const match = String(name).match(/^(.*?)(.[^./]+)?$/)
+  return (match && match[1] ? match[1] : String(name)) + '.' + deviceId + (match && match[2] ? match[2] : '')
+}
+
+export function deviceWebdavUrl(url, deviceId) {
+  if (!url || !deviceId) return url
+  try {
+    const parsed = new URL(url)
+    parsed.pathname = withDeviceSuffix(parsed.pathname, deviceId)
+    return parsed.toString()
+  } catch {
+    return url
+  }
+}
+
+export function deviceGistName(deviceId) {
+  return withDeviceSuffix('dsh-subscriptions-vault.enc', deviceId)
+}
+
+export function deviceS3Key(key, deviceId) {
+  return withDeviceSuffix(key || 'dsh-subscriptions-vault.enc', deviceId)
+}

package/lib/index.js

@@ -28,7 +28,7 @@ import { createAccountsView } from './accounts-view.js'
 import { inspectScopes } from './scope-inspector.js'
 import { createAdapterManager } from './adapter-manager.js'
 import { pickAccount, isAuthError } from './rotate.js'
-import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate } from './alerts.js'
+import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate, setWebhookFormat } from './alerts.js'
 import { isDigestDue } from './notification-scheduler.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
@@ -95,6 +95,7 @@ export function apply(ctx, rawConfig) {
   const live = () => {
     setWebhookSecret(cachedConfig.webhookSecret)
     setWebhookAllowPrivate(cachedConfig.webhookAllowPrivate)
+    setWebhookFormat(cachedConfig.webhookFormat)
     return cachedConfig
   }
 
@@ -616,7 +617,7 @@ export function apply(ctx, rawConfig) {
       const cfg = live()
       const alerts = getRecentAlerts(100)
       if (!isDigestDue({ lastDigestAt, nowMs: Date.now(), intervalHours: cfg.digestIntervalHours, alertCount: alerts.length })) return
-      dispatchNotificationDigest(alerts, cfg.webhookUrl, fetch, { secret: cfg.webhookSecret, allowPrivate: cfg.webhookAllowPrivate })
+      dispatchNotificationDigest(alerts, cfg.webhookUrl, fetch, { secret: cfg.webhookSecret, allowPrivate: cfg.webhookAllowPrivate, format: cfg.webhookFormat })
         .then((ok) => { if (ok) lastDigestAt = Date.now() })
         .catch(() => {})
     }

package/lib/vault-sync.js

@@ -7,6 +7,7 @@ import { normalizeSlots } from './accounts.js'
 import { Config, plainConfig, revisionOf } from './config-schema.js'
 import { validateCredentialBlob } from './blob.js'
 import { defaultSnapshotStore } from './vault-snapshots.js'
+import { resolveDeviceIdentity, devicePassphrase, deviceWebdavUrl, deviceGistName, deviceS3Key } from './device-identity.js'
 
 let syncStatus = {
   enabled: false,
@@ -75,7 +76,7 @@ export async function pullFromWebdav({ url, username, password, fetchFn = fetch
 
 // --- Driver: Gist (GitHub / Gitea) ---
 
-export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fetchFn = fetch }) {
+export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fileName = 'dsh-subscriptions-vault.enc', fetchFn = fetch }) {
   if (!token) throw new Error('Gist access token is required')
   const cleanBase = baseUrl.replace(/\/+$/, '')
   const headers = {
@@ -86,7 +87,7 @@ export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, t
   }
 
   const files = {
-    'dsh-subscriptions-vault.enc': { content: encryptedData },
+    [fileName]: { content: encryptedData },
   }
 
   if (gistId) {
@@ -118,7 +119,7 @@ export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, t
   return { ok: true, gistId: json.id }
 }
 
-export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fetchFn = fetch }) {
+export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fileName = 'dsh-subscriptions-vault.enc', fetchFn = fetch }) {
   if (!gistId) throw new Error('Gist ID is required')
   const cleanBase = baseUrl.replace(/\/+$/, '')
   const headers = {
@@ -133,9 +134,9 @@ export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId,
   })
   if (!res.ok) throw new Error(`Gist pull failed: HTTP ${res.status} ${res.statusText}`)
   const json = await res.json()
-  const file = json.files && json.files['dsh-subscriptions-vault.enc']
+  const file = json.files && json.files[fileName]
   if (!file || !file.content) {
-    throw new Error('dsh-subscriptions-vault.enc not found in Gist')
+    throw new Error(fileName + ' not found in Gist')
   }
   return file.content
 }
@@ -308,12 +309,15 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
       } catch { /* ignore */ }
     }
 
-    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, passphrase)
+    const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
+    const perDevice = cfg.vaultPerDeviceKeys !== false
+    const activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, activePass)
     const backend = cfg.vaultSyncBackend || 'webdav'
 
     if (backend === 'webdav') {
       await pushToWebdav({
-        url: cfg.vaultSyncWebdavUrl,
+        url: perDevice ? deviceWebdavUrl(cfg.vaultSyncWebdavUrl, device.id) : cfg.vaultSyncWebdavUrl,
         username: cfg.vaultSyncWebdavUsername,
         password: cfg.vaultSyncWebdavPassword,
         encryptedData: vault,
@@ -325,6 +329,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
         gistId: cfg.vaultSyncGistId,
         token: cfg.vaultSyncGistToken,
         encryptedData: vault,
+        fileName: perDevice ? deviceGistName(device.id) : undefined,
         fetchFn,
       })
       if (res.gistId && !cfg.vaultSyncGistId) {
@@ -334,7 +339,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
       await pushToS3({
         endpoint: cfg.vaultSyncS3Endpoint,
         bucket: cfg.vaultSyncS3Bucket,
-        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        key: perDevice ? deviceS3Key(cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc', device.id) : (cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc'),
         region: cfg.vaultSyncS3Region || 'us-east-1',
         accessKey: cfg.vaultSyncS3AccessKey,
         secretKey: cfg.vaultSyncS3SecretKey,
@@ -376,38 +381,53 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
 
   try {
     const backend = cfg.vaultSyncBackend || 'webdav'
-    let encryptedData = ''
-
-    if (backend === 'webdav') {
-      encryptedData = await pullFromWebdav({
-        url: cfg.vaultSyncWebdavUrl,
-        username: cfg.vaultSyncWebdavUsername,
-        password: cfg.vaultSyncWebdavPassword,
-        fetchFn,
-      })
-    } else if (backend === 'gist') {
-      encryptedData = await pullFromGist({
-        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
-        gistId: cfg.vaultSyncGistId,
-        token: cfg.vaultSyncGistToken,
-        fetchFn,
-      })
-    } else if (backend === 's3') {
-      encryptedData = await pullFromS3({
-        endpoint: cfg.vaultSyncS3Endpoint,
-        bucket: cfg.vaultSyncS3Bucket,
-        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
-        region: cfg.vaultSyncS3Region || 'us-east-1',
-        accessKey: cfg.vaultSyncS3AccessKey,
-        secretKey: cfg.vaultSyncS3SecretKey,
-        fetchFn,
-      })
-    } else {
+    const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
+    const perDevice = cfg.vaultPerDeviceKeys !== false
+    let activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    let usedLegacy = false
+    const load = async (deviceMode) => {
+      if (backend === 'webdav') {
+        return pullFromWebdav({
+          url: deviceMode ? deviceWebdavUrl(cfg.vaultSyncWebdavUrl, device.id) : cfg.vaultSyncWebdavUrl,
+          username: cfg.vaultSyncWebdavUsername,
+          password: cfg.vaultSyncWebdavPassword,
+          fetchFn,
+        })
+      }
+      if (backend === 'gist') {
+        return pullFromGist({
+          baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+          gistId: cfg.vaultSyncGistId,
+          token: cfg.vaultSyncGistToken,
+          fileName: deviceMode ? deviceGistName(device.id) : undefined,
+          fetchFn,
+        })
+      }
+      if (backend === 's3') {
+        return pullFromS3({
+          endpoint: cfg.vaultSyncS3Endpoint,
+          bucket: cfg.vaultSyncS3Bucket,
+          key: deviceMode ? deviceS3Key(cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc', device.id) : (cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc'),
+          region: cfg.vaultSyncS3Region || 'us-east-1',
+          accessKey: cfg.vaultSyncS3AccessKey,
+          secretKey: cfg.vaultSyncS3SecretKey,
+          fetchFn,
+        })
+      }
       throw new Error(`unsupported vault sync backend: ${backend}`)
     }
+    let encryptedData
+    try {
+      encryptedData = await load(perDevice)
+    } catch (err) {
+      if (!perDevice) throw err
+      encryptedData = await load(false)
+      activePass = passphrase
+      usedLegacy = true
+    }
 
-    try { capturePrePullSnapshot(cfg.slots || [], passphrase) } catch { /* snapshot is best-effort */ }
-    const result = importVault(encryptedData, passphrase)
+    try { capturePrePullSnapshot(cfg.slots || [], activePass) } catch { /* snapshot is best-effort */ }
+    const result = importVault(encryptedData, activePass)
     const providerFilter = new Set((cfg.vaultSyncProviders || []).map((p) => String(p)))
     const remoteSlots = providerFilter.size
       ? result.slots.filter((slot) => providerFilter.has(String(slot && slot.provider)))
@@ -447,6 +467,9 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
       slotCount: result.slots.length,
       blobCount,
       conflicts: conflicts.length,
+      deviceId: device.id,
+      perDevice,
+      legacy: usedLegacy,
       exportedAt: result.exportedAt,
       timestamp: syncStatus.lastPullAt,
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.10",
+  "version": "0.7.11",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",