@huaqiu/dsh-auth 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 深圳华秋智联股份有限公司
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,22 @@
+# @huaqiu/dsh-auth
+
+Huaqiu account plugin: browser↔node credential flow for the Huaqiu PCB EDA tool set.
+
+- Dual-face package. Browser half: auth.eda.cn overlay iframe + strict-origin postMessage
+  handling + localStorage cache + push to node. Node half: `huaqiuAuth` capability
+  (`getAccessToken` / `getUserInfo`) backed by an in-memory cache fed over the
+  plugin-owned `webServer` route `/api/v1/huaqiu/auth`.
+- **HQ Edge host mode.** When the plugin is loaded with a `config.hqEdgeBaseUrl`
+  (injected by the HQ Edge supervisor as overlay entry `config`), the node half
+  fetches the operator credential directly from HQ Edge's
+  `GET /api/v1/auth/token` and is authoritative on boot — no browser login
+  required. Resolution order inside `getUserInfo()`: host session → pushed
+  (browser) session → persisted file (`~/.dsh/auth/session.json`) → null.
+  Env fallback (`HQ_EDGE_BASE_URL` / `HQ_EDGE_AUTH_PATH` / `HQ_EDGE_HOST_TTL_SECONDS`)
+  covers installs without a supervisor. See `src/host.ts`.
+- Node-side persistence: the last known session is written to `~/.dsh/auth/session.json`
+  on every `setCredentials`, so standalone auth survives a process restart (previously
+  the in-memory cache was empty until the next browser login).
+- Phase 0A POC. The chosen browser→host channel is a `webServer` route
+  (`apiProxy`'s dispatch table is closed — see `docs/tasks/phase0-implementation-spec.md` §7).
+- Status: host mode + persistence implemented (spec `docs/tasks/dsh-auth-artifact.md`).

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+# DSH bundle patch: inserts the Huaqiu account/auth plugin.
+# The webServer route is the browser→node credential channel (the smallest
+# supported extension point — see phase0-implementation-spec.md §7).
+- insert:
+    - id: huaqiu-auth
+      name: '@huaqiu/dsh-auth'
+      inject: ['webServer']