@huaweidevtools/aishell-dsh-llm 0.0.6 → 0.0.8

package/LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2024 Huawei Cloud AI Shell
+   Copyright 2026 Huawei Cloud AI Shell
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -15,7 +15,7 @@ User selects aishell/<model>
   → GatewayAdapter.stream(options)
 
   Every request is signed directly with AK/SK (SDK-HMAC-SHA256):
-    → credential store reads HW_ACCESS_KEY + HW_SECRET_KEY (+ optional HW_SECURITY_TOKEN)
+    → credential store reads the AK/SK pair (one record; optional STS token)
     → sign(POST, host, /chat/completions, query, body) → signed headers
     → POST {baseUrl}/chat/completions  (signed headers, OpenAI wire format)
     → parseSse → translate → StreamChunks
@@ -70,8 +70,7 @@ dsh plugin --profile <name> add @huaweidevtools/aishell-dsh-base
 
 | Field | Type | Default | Description |
 |---|---|---|---|
-| `baseUrl` | `string?` | `https://api.aishell.openbuildlab.com/v1` | Chat API base URL. `/chat/completions` and `/models` are appended, so a base carrying its own path segment is signed and requested in full. |
-| `keyringService` | `string?` | `aishell-dsh` | Credential store service name. |
+| `baseUrl` | `string?` | `https://openai.aishell.openbuildlab.com/v1` | Chat API base URL. `/chat/completions` and `/models` are appended, so a base carrying its own path segment is signed and requested in full. |
 | `requestImagePixelBudget` | `number?` | `4194304` | Total-pixel cap one request image is scaled into. |
 | `requestImageMaxBytes` | `number?` | `1048576` | Encoded-byte target for one request image. |
 | `maxRequestImageBytes` | `number?` | `20971520` | Accumulated base64 image bytes one request accepts before the oldest images must be offloaded. |
@@ -87,11 +86,14 @@ The three image fields share `dsh-llm-pi-ai`'s defaults: the gateway publishes n
 ```sh
 node --input-type=module -e "
 import { createCredentialsStore } from '@huaweidevtools/aishell-dsh-credentials-store';
-const s = createCredentialsStore();
-s.set('HW_ACCESS_KEY', 'your-ak');
-s.set('HW_SECRET_KEY', 'your-sk');
-// Optional: temporary security token (STS)
-s.set('HW_SECURITY_TOKEN', 'your-token');
+import { writeHuaweiCloud } from '@huaweidevtools/aishell-dsh-credentials-store/accounts';
+
+// One record, one write. The pair and its optional STS token go in together.
+writeHuaweiCloud(createCredentialsStore(), {
+  ak: 'your-ak',
+  sk: 'your-sk',
+  // securityToken: 'your-token',   // only for temporary credentials
+});
 "
 ```
 

package/lib/index.js

@@ -4,6 +4,7 @@ import { requestImageDimensions } from "@deepseek-ai/dsh-attachment";
 import { brandString } from "@deepseek-ai/dsh-brand";
 import { EventSourceParserStream } from "eventsource-parser/stream";
 import { sign } from "@huaweidevtools/aishell-dsh-credentials-store/signer";
+import { readStoredPair } from "@huaweidevtools/aishell-dsh-credentials-store/accounts";
 
 //#region ../../node_modules/.pnpm/@deepseek-ai+cosmokit@1.8.5/node_modules/@deepseek-ai/cosmokit/lib/index.js
 /** Return true when a value is `null` or `undefined`. */
@@ -1425,10 +1426,6 @@ const PROVIDER_DISPLAY_NAME = "AI Shell";
 
 //#endregion
 //#region src/adapter.ts
-/** Credential store account names for Huawei Cloud credentials. */
-const AK_ACCOUNT = "HW_ACCESS_KEY";
-const SK_ACCOUNT = "HW_SECRET_KEY";
-const TOKEN_ACCOUNT = "HW_SECURITY_TOKEN";
 /**
 * Whether a gateway error body reports an id the gateway does not carry.
 *
@@ -1546,17 +1543,19 @@ var GatewayAdapter = class GatewayAdapter extends LlmAdapter {
 	hasCredentials() {
 		return this.readCredentials() !== void 0;
 	}
-	/** Read AK/SK (and optional SecurityToken) from the credential store. */
+	/**
+	* Read the AK/SK pair from the credential store.
+	*
+	* Delegates to the shared reader: this adapter, `aishell-e2b`,
+	* `aishell-credentials` and `aishell-deploy` all read the same record, and a
+	* local copy of that rule is how two of them end up disagreeing about what
+	* "credentials are configured" means.
+	*
+	* Read per request, never captured — that is what makes a rotation in the
+	* credential form apply to the very next call.
+	*/
 	readCredentials() {
-		const ak = this.opts.keyring.get(AK_ACCOUNT);
-		const sk = this.opts.keyring.get(SK_ACCOUNT);
-		if (!ak || !sk) return void 0;
-		const securityToken = this.opts.keyring.get(TOKEN_ACCOUNT);
-		return {
-			ak,
-			sk,
-			...securityToken ? { securityToken } : {}
-		};
+		return readStoredPair(this.opts.keyring);
 	}
 	/**
 	* Read credentials or throw `MISSING_CREDENTIAL` — every signing code path
@@ -1658,7 +1657,7 @@ GatewayAdapter.MODELS_TTL_MS = 6e4;
 //#endregion
 //#region src/index.ts
 /** Default chat API base URL. Both `/chat/completions` and `/models` hang below `/v1`. */
-const DEFAULT_BASE_URL = "https://api.aishell.openbuildlab.com/v1";
+const DEFAULT_BASE_URL = "https://openai.aishell.openbuildlab.com/v1";
 /**
 * Default total-pixel cap one request image is scaled into, and the encoded
 * byte target the encoder aims for. Both match the pi-ai defaults, for the
@@ -1686,7 +1685,6 @@ const DEFAULT_MAX_REQUEST_IMAGE_BYTES = 20971520;
 */
 const Config = Schema.object({
 	baseUrl: Schema.string().default(DEFAULT_BASE_URL).volatile(),
-	keyringService: Schema.string().volatile(),
 	requestImagePixelBudget: Schema.number().step(1).min(1).default(DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET).volatile(),
 	requestImageMaxBytes: Schema.number().step(1).min(1).default(DEFAULT_REQUEST_IMAGE_MAX_BYTES).volatile(),
 	maxRequestImageBytes: Schema.number().step(1).min(1).default(DEFAULT_MAX_REQUEST_IMAGE_BYTES).volatile()
@@ -1696,8 +1694,7 @@ const inject = ["llm"];
 /** The provider route this plugin owns. */
 const PROVIDER = "aishell";
 function apply(ctx, config) {
-	const keyringService = config.keyringService.get();
-	const store = createCredentialsStore(keyringService === void 0 || keyringService === "" ? {} : { service: keyringService });
+	const store = createCredentialsStore();
 	const adapter = new GatewayAdapter({
 		resolveBaseUrl: () => config.baseUrl.get(),
 		keyring: store,

package/lib/types/adapter.d.ts

@@ -16,7 +16,7 @@ import { type ImageRequestBudget } from './images.ts';
 /** Adapter construction options. */
 export interface GatewayAdapterOptions {
     /**
-     * Resolve the current chat API base URL (e.g. `https://api.aishell.openbuildlab.com/v1`).
+     * Resolve the current chat API base URL (e.g. `https://openai.aishell.openbuildlab.com/v1`).
      *
      * A reader, not a value, for the same reason `resolveAttachments` is: this
      * plugin's whole Config is `Volatile`, so a settings edit is a
@@ -75,7 +75,17 @@ export declare class GatewayAdapter extends LlmAdapter {
      * @returns whether both halves of the signing credential are present.
      */
     hasCredentials(): boolean;
-    /** Read AK/SK (and optional SecurityToken) from the credential store. */
+    /**
+     * Read the AK/SK pair from the credential store.
+     *
+     * Delegates to the shared reader: this adapter, `aishell-e2b`,
+     * `aishell-credentials` and `aishell-deploy` all read the same record, and a
+     * local copy of that rule is how two of them end up disagreeing about what
+     * "credentials are configured" means.
+     *
+     * Read per request, never captured — that is what makes a rotation in the
+     * credential form apply to the very next call.
+     */
     private readCredentials;
     /**
      * Read credentials or throw `MISSING_CREDENTIAL` — every signing code path

package/lib/types/index.d.ts

@@ -27,8 +27,6 @@ export type { GatewayAdapter, GatewayAdapterOptions } from './adapter.ts';
 export interface Config {
     /** Chat API base URL. Default: the public aishell gateway. */
     readonly baseUrl: Volatile<string>;
-    /** Credential store service name; empty selects the default `'aishell-dsh'`. */
-    readonly keyringService: Volatile<string | undefined>;
     /** Total-pixel cap one request image is projected into. */
     readonly requestImagePixelBudget: Volatile<number>;
     /** Encoded-byte target for one request image. */
@@ -47,13 +45,11 @@ export interface Config {
  */
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     baseUrl: z<string, string, "volatile-defined">;
-    keyringService: z<string, string, "volatile">;
     requestImagePixelBudget: z<number, number, "volatile-defined">;
     requestImageMaxBytes: z<number, number, "volatile-defined">;
     maxRequestImageBytes: z<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     baseUrl: z<string, string, "volatile-defined">;
-    keyringService: z<string, string, "volatile">;
     requestImagePixelBudget: z<number, number, "volatile-defined">;
     requestImageMaxBytes: z<number, number, "volatile-defined">;
     maxRequestImageBytes: z<number, number, "volatile-defined">;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@huaweidevtools/aishell-dsh-llm",
   "description": "aishell LLM gateway adapter for DSH — OpenAI-compatible, Huawei Cloud AK/SK auth via credential store",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "publishConfig": {
     "access": "public"
   },
@@ -33,7 +33,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "eventsource-parser": "^3.0.0",
-    "@huaweidevtools/aishell-dsh-credentials-store": "0.0.6"
+    "@huaweidevtools/aishell-dsh-credentials-store": "0.0.8"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",