@logictan/dsh-imagegen 2.0.1 → 2.0.3

package/lib/index.js

@@ -1,9 +1,65 @@
+import "@deepseek-ai/cordis";
 import * as settingsModule from "@deepseek-ai/dsh-settings";
 import { SettingsConflictError } from "@deepseek-ai/dsh-settings";
 import z from "@deepseek-ai/schemastery";
-import "@deepseek-ai/cordis";
 import { randomUUID } from "node:crypto";
 import { defineTool } from "@deepseek-ai/dsh-tools";
+//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-brand@0.2.0-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
+/**
+* Duplicate-install-safe nominal primitive helpers.
+*
+* A brand makes structurally identical strings or numbers non-interchangeable
+* at the type level: a `SessionId` cannot be passed where a `ToolCallId` is
+* expected, and an event sequence cannot be passed as a log offset. Comparison,
+* logging, and serialization retain the underlying primitive behavior.
+*
+* This package owns no concrete domain value and keeps no runtime identity or mutable
+* state, so independently installed copies produce interchangeable values.
+*
+* @module @deepseek-ai/dsh-brand
+*/
+/**
+* Apply a compile-time string brand without changing the value.
+* @param value - string admitted by the domain that owns the target brand.
+* @returns the same string with the requested compile-time brand.
+*/
+function brandString(value) {
+	return value;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-credentials@0.2.0-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-inva_13783eb73d2217c5a4a149b781a9cc49/node_modules/@deepseek-ai/dsh-credentials/lib/index.js
+/**
+* Service Definition for the credential-reference capability seam (`ctx.credentials`). Settings and composition files carry
+* *references* to secrets — environment-variable names — while providers own
+* the actual values and their storage. Consumers resolve a reference once per
+* operation, so a changed credential reaches the next operation without any
+* plugin restart, and configuration surfaces describe a reference without
+* ever seeing its value.
+* @module @deepseek-ai/dsh-credentials
+*/
+const REF_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Brand a raw string as a {@link CredentialRef}.
+* @param value - candidate reference; a POSIX shell identifier such as `DEEPSEEK_API_KEY`.
+* @returns the branded reference.
+*/
+function credentialRef(value) {
+	if (!isCredentialRefName(value)) throw new TypeError(`credential ref "${value}" must match ${String(REF_PATTERN)}`);
+	return brandString(value);
+}
+/**
+* Whether a raw string could name a reference at all. Consumers that receive
+* environment-variable names from somewhere else — a provider library's own
+* ambient discovery, a hook payload — ask this before resolving, because a name
+* outside the grammar has no reference to miss and should read as "not set"
+* rather than as a thrown error.
+* @param value - candidate reference.
+* @returns true when {@link credentialRef} would accept it.
+*/
+function isCredentialRefName(value) {
+	return REF_PATTERN.test(value);
+}
+//#endregion
 //#region src/settings-compat.ts
 const compatModule = settingsModule;
 /** Strip volatile markers for the pre-0.1.7 settings providers. */
@@ -1697,6 +1753,55 @@ function subscriptionReferences(request) {
 	});
 }
 //#endregion
+//#region src/credential-refs.ts
+/**
+* The mapping from credential-backed settings paths to credential refs.
+*
+* This is a pure module on purpose. The settings bridge (`routes.ts`) must
+* classify a submitted path as credential-backed *before* it decides whether to
+* forward it to the settings seam, and it must reach the same verdict on a host
+* that composes no credential provider — otherwise a key write would fall
+* through to the settings document, which is exactly the plaintext leak this
+* mapping exists to prevent. So the mapping is a pure function that needs no
+* provider, and `routes.ts` can import it without a cycle back into `index.ts`.
+*
+* `role('secret')` is NOT protection: it redacts a value from settings *reads*,
+* while the plaintext still lands in `cordis.patch.yml`, which the config-sync
+* `plugins` adapter exports verbatim.
+*/
+/** Credential reference holding the prompt-enhancement endpoint's API key. */
+const PROMPT_KEY_REF = "DSH_IMAGEGEN_PROMPT_KEY";
+/**
+* The credential ref holding one channel's API key.
+*
+* The channel id is folded into the ref name because refs must match
+* `/^[A-Za-z_][A-Za-z0-9_]*$/` — a channel id is usually a UUID, whose hyphens
+* are outside that grammar. The fold is lossy in principle (two ids differing
+* only in punctuation collide), but ids are generated UUIDs, so the
+* transformation is injective over the values actually in use.
+*
+* @param channelId - the channel's stable id.
+* @returns the credential reference name.
+*/
+function channelKeyRef(channelId) {
+	return `DSH_IMAGEGEN_CHANNEL_${channelId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+}
+/**
+* The credential ref backing a settings path, or `undefined` when the path is an
+* ordinary config field that belongs in the settings document.
+*
+* Only the two key-bearing families are diverted. The legacy flat `apiKey` field
+* is deliberately NOT diverted: it is a plaintext field being retired, so its
+* `unset` must reach the settings seam to actually delete the stored value.
+*
+* @param path - a settings path op's path segments.
+* @returns the credential ref, or `undefined` for a config field.
+*/
+function credentialRefForPath(path) {
+	if (path.length === 1 && path[0] === "promptApiKey") return PROMPT_KEY_REF;
+	if (path.length === 2 && path[0] === "channelSecrets" && path[1] !== void 0 && path[1] !== "") return channelKeyRef(path[1]);
+}
+//#endregion
 //#region src/presets.ts
 /**
 * Built-in provider catalog (presets). A preset is an official or well-known
@@ -1951,17 +2056,18 @@ function imageDataUrl$1(value) {
 	};
 }
 /** Project one settings descriptor onto the bridge wire view. */
-function toView(descriptor, namespace = String(descriptor.ns)) {
+function toView(descriptor, namespace = String(descriptor.ns), extraSecrets = []) {
+	const secrets = [...(descriptor.secrets ?? []).map((secret) => ({
+		path: [...secret.path],
+		set: secret.set
+	})), ...extraSecrets];
 	return {
 		ns: namespace,
 		schema: descriptor.schema,
 		value: descriptor.value,
 		...descriptor.base === void 0 ? {} : { base: descriptor.base },
 		...descriptor.user === void 0 ? {} : { user: descriptor.user },
-		...descriptor.secrets === void 0 ? {} : { secrets: descriptor.secrets.map((secret) => ({
-			path: [...secret.path],
-			set: secret.set
-		})) },
+		...secrets.length === 0 ? {} : { secrets },
 		revision: descriptor.revision
 	};
 }
@@ -1985,6 +2091,80 @@ function failureOf(error) {
 		message: error instanceof Error ? error.message : String(error)
 	};
 }
+/** The path of a raw settings op, or `undefined` when it carries no string path. */
+function settingsOpPath(op) {
+	if (typeof op !== "object" || op === null) return void 0;
+	const path = op.path;
+	if (!Array.isArray(path)) return void 0;
+	return path.every((segment) => typeof segment === "string") ? path : void 0;
+}
+/**
+* Split submitted settings ops into config-field ops and credential ops.
+*
+* A credential path is never forwarded to the settings seam: the namespace root
+* is volatile, so a `set` there would be accepted and would persist the
+* plaintext key into `cordis.patch.yml` — the exact leak this split exists to
+* prevent. An empty (or whitespace-only) value decodes as a removal because the
+* credential store refuses to hold an empty string.
+*
+* @param ops - the raw ops from the bridge request body.
+* @returns the ops to forward to the settings seam, and the credential writes.
+* @throws {TypeError} when a credential path carries an undecodable op.
+*/
+function splitCredentialOps(ops) {
+	const settingsOps = [];
+	const credentialOps = [];
+	for (const op of ops) {
+		const path = settingsOpPath(op);
+		const ref = path === void 0 ? void 0 : credentialRefForPath(path);
+		if (path === void 0 || ref === void 0) {
+			settingsOps.push(op);
+			continue;
+		}
+		const kind = op.op;
+		if (kind === "unset") {
+			credentialOps.push({
+				ref,
+				value: void 0
+			});
+			continue;
+		}
+		const raw = op.value;
+		if (kind !== "set" || typeof raw !== "string") throw new TypeError(`settings op for credential field "${path.join(".")}" must be a string set or an unset`);
+		const value = raw.trim();
+		credentialOps.push({
+			ref,
+			value: value === "" ? void 0 : value
+		});
+	}
+	return {
+		settingsOps,
+		credentialOps
+	};
+}
+/**
+* The credential-backed secret entries the redacted view must carry.
+*
+* The client never receives a key value, so "is a key held?" is answered from
+* this sidecar. The schema no longer declares the key fields, so these entries
+* are synthesized from the credential store rather than walked off the schema.
+*
+* @param deps - the route dependencies.
+* @returns one entry per credential-backed path.
+*/
+async function credentialSecrets(deps) {
+	const credentials = deps.credentials?.();
+	if (credentials === void 0) return [];
+	const paths = [["promptApiKey"]];
+	for (const channel of deps.resolveChannels?.().channels ?? []) paths.push(["channelSecrets", channel.id]);
+	return Promise.all(paths.map(async (path) => {
+		const ref = credentialRefForPath(path);
+		return {
+			path,
+			set: ref === void 0 ? false : await credentials.holds(ref)
+		};
+	}));
+}
 /** Validate a submitted generation request (the browser's generate payload). */
 function parseGenerateRequest(body) {
 	const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
@@ -2276,7 +2456,7 @@ function makeRoutes(deps) {
 				writeJson(res, 200, {
 					ok: true,
 					value: {
-						namespaces: descriptor === void 0 ? [] : [toView(descriptor, IMAGEGEN_SETTINGS_NAMESPACE)],
+						namespaces: descriptor === void 0 ? [] : [toView(descriptor, IMAGEGEN_SETTINGS_NAMESPACE, await credentialSecrets(deps))],
 						writable: deps.settings.writable !== false
 					}
 				});
@@ -2305,8 +2485,27 @@ function makeRoutes(deps) {
 					return;
 				}
 				const expectedRevision = typeof body.expectedRevision === "number" ? body.expectedRevision : void 0;
+				let settingsOps;
+				let credentialOps;
 				try {
-					await deps.settings.mutate(settingsNamespace, body.ops, expectedRevision);
+					({settingsOps, credentialOps} = splitCredentialOps(body.ops));
+				} catch (error) {
+					writeJson(res, 200, failureOf(error));
+					return;
+				}
+				const credentials = deps.credentials?.();
+				if (credentialOps.length > 0 && credentials === void 0) {
+					writeJson(res, 200, {
+						ok: false,
+						code: "settings-rejected",
+						message: "this host composes no credential provider, so an API key cannot be stored"
+					});
+					return;
+				}
+				try {
+					if (settingsOps.length > 0) await deps.settings.mutate(settingsNamespace, settingsOps, expectedRevision);
+					for (const credential of credentialOps) if (credential.value === void 0) await credentials?.unset(credential.ref);
+					else await credentials?.set(credential.ref, credential.value);
 				} catch (error) {
 					writeJson(res, 200, failureOf(error));
 					return;
@@ -2322,7 +2521,7 @@ function makeRoutes(deps) {
 				}
 				writeJson(res, 200, {
 					ok: true,
-					value: toView(descriptor, IMAGEGEN_SETTINGS_NAMESPACE)
+					value: toView(descriptor, IMAGEGEN_SETTINGS_NAMESPACE, await credentialSecrets(deps))
 				});
 			}
 		},
@@ -3116,13 +3315,10 @@ const Config = z.object({
 			id: z.string()
 		})).default([])
 	})).default([]),
-	channelSecrets: z.dict(z.string().role("secret")).default({}),
 	defaultChannelId: z.string().default(""),
 	promptApiUrl: z.string().default(""),
-	promptApiKey: z.string().role("secret").default(""),
 	promptModel: z.string().default(""),
 	apiUrl: z.string().default(""),
-	apiKey: z.string().role("secret").default(""),
 	imageModels: z.array(z.string()).default([])
 }).volatile();
 /** Schema defaults, re-read for hand-built contexts (the loader applies them normally). */
@@ -3132,7 +3328,7 @@ const DEFAULT_ALLOW_AGENT_IMAGE_GENERATION = true;
 /** Order of the announcement section within the tool-guidance band. */
 const SECTION_ORDER = 150;
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-const IMAGEGEN_GUIDANCE = "本机已安装 dsh-imagegen 插件（DSH AI 生图）：通过「渠道」对接 OpenAI 兼容图像生成 API（每个渠道 = 一个 API 端点 + 各自的模型目录），支持文生图（/images/generations）与图生图（/images/edits，上传参考图，grok-imagine 模型按官方 JSON image_url 协议发送，nanobanana 系列按 aspect_ratio / image_size 参数协议发送；seedream 系列统一走 /images/generations，参考图以 JSON image 数组发送；智谱 `glm-image` 使用官方 `/api/paas/v4/images/generations`，当前仅支持文生图；qwen-image 系列使用阿里云 DashScope 原生接口（api_url 填 https://dashscope.aliyuncs.com/api/v1，不支持 OpenAI 兼容模式，该渠道不可复用于提示词增强，尺寸自动映射为宽*高）。MiniMax `image-01` 使用 MiniMax 原生 `/image_generation` 接口（api_url 填 https://api.minimax.io/v1 或国内站 https://api.minimaxi.com/v1，支持 1:1/16:9/4:3/3:2/2:3/3:4/9:16/21:9 宽高比，一次最多 9 张；图生图为单张 subject_reference 主体参考（保持人物/主体一致，非像素级局部编辑）；其 /models 只列聊天模型，图片模型需用预设目录）。API 地址与密钥在 GUI 设置中按渠道配置，密钥仅存于本机设置文档；生成请求由本地宿主代理转发，结果以 base64 返回。模型只能使用用户在各渠道配置目录中的模型；检测模型时会过滤聊天、Embedding 等非图片模型，但模型出现在 /models 中仍不等于其网关原生支持生图协议，遇到 Qwen、MiniMax、Gemini 等非 OpenAI 生图协议时应如实说明上游兼容性。Agent 可直接调用 `generate_image` 提交文生图，也可用 `edit_image` 图生图；默认保持工具调用等待直到任务完成，完成图片显示在工具调用对应的左侧结果区域，模型收到状态和附件引用，不会额外伪造用户消息。用户也可以使用 `/edit_image <修改描述>`，命令会直接读取当前对话最近图片并调用插件图片模型，不经过对话模型的图片能力检查。若明确需要后台执行，可传 `wait_for_completion: false`，之后再用 `get_image_generation_task` 查询；不要反复轮询。限制：生成消耗上游 API 额度；图片内容由上游模型生成，可能不符合预期或包含不适宜内容；api_key 以明文存储在设置文档中；参考图会发送至所配置的 API 服务。用户提到「生图 / 绘画 / 生成图片 / 文生图 / 图生图」时即指本插件，请据此协作。";
+const IMAGEGEN_GUIDANCE = "本机已安装 dsh-imagegen 插件（DSH AI 生图）：通过「渠道」对接 OpenAI 兼容图像生成 API（每个渠道 = 一个 API 端点 + 各自的模型目录），支持文生图（/images/generations）与图生图（/images/edits，上传参考图，grok-imagine 模型按官方 JSON image_url 协议发送，nanobanana 系列按 aspect_ratio / image_size 参数协议发送；seedream 系列统一走 /images/generations，参考图以 JSON image 数组发送；智谱 `glm-image` 使用官方 `/api/paas/v4/images/generations`，当前仅支持文生图；qwen-image 系列使用阿里云 DashScope 原生接口（api_url 填 https://dashscope.aliyuncs.com/api/v1，不支持 OpenAI 兼容模式，该渠道不可复用于提示词增强，尺寸自动映射为宽*高）。MiniMax `image-01` 使用 MiniMax 原生 `/image_generation` 接口（api_url 填 https://api.minimax.io/v1 或国内站 https://api.minimaxi.com/v1，支持 1:1/16:9/4:3/3:2/2:3/3:4/9:16/21:9 宽高比，一次最多 9 张；图生图为单张 subject_reference 主体参考（保持人物/主体一致，非像素级局部编辑）；其 /models 只列聊天模型，图片模型需用预设目录）。API 地址与密钥在 GUI 设置中按渠道配置，密钥存于 $DSH_HOME/.credentials.yaml 的 DSH_IMAGEGEN_CHANNEL_* 引用，不写入插件配置行；生成请求由本地宿主代理转发，结果以 base64 返回。模型只能使用用户在各渠道配置目录中的模型；检测模型时会过滤聊天、Embedding 等非图片模型，但模型出现在 /models 中仍不等于其网关原生支持生图协议，遇到 Qwen、MiniMax、Gemini 等非 OpenAI 生图协议时应如实说明上游兼容性。Agent 可直接调用 `generate_image` 提交文生图，也可用 `edit_image` 图生图；默认保持工具调用等待直到任务完成，完成图片显示在工具调用对应的左侧结果区域，模型收到状态和附件引用，不会额外伪造用户消息。用户也可以使用 `/edit_image <修改描述>`，命令会直接读取当前对话最近图片并调用插件图片模型，不经过对话模型的图片能力检查。若明确需要后台执行，可传 `wait_for_completion: false`，之后再用 `get_image_generation_task` 查询；不要反复轮询。限制：生成消耗上游 API 额度；图片内容由上游模型生成，可能不符合预期或包含不适宜内容；api_key 以明文存储在 $DSH_HOME/.credentials.yaml；参考图会发送至所配置的 API 服务。用户提到「生图 / 绘画 / 生成图片 / 文生图 / 图生图」时即指本插件，请据此协作。";
 /** Append the live channel × model table so an Agent can honor user choices. */
 function guidanceFor(channels, defaultChannelId) {
 	if (channels.length === 0) return `${IMAGEGEN_GUIDANCE} 尚未配置任何渠道：请先在「设置 → 插件 → AI 生图」添加渠道并填写 API 地址与密钥。`;
@@ -3184,28 +3380,56 @@ function normalizeChannels(value) {
 */
 function apply(ctx, config) {
 	let current = () => config?.get() ?? {};
+	/**
+	* Synchronous mirror of the credential values this plugin needs.
+	*
+	* `resolve()` is synchronous and is called from route handlers, the Agent
+	* tools and the runtime, while the credential seam resolves asynchronously.
+	* Rather than making every call site async, the values are read once into
+	* this map and refreshed on every credential change: the seam emits
+	* `credentials/reference-updated` after a write commits and after each file
+	* reload, so the mirror tracks the store without polling.
+	*
+	* A missing provider leaves the map empty, which reads as "no key" — the same
+	* outcome as an unset ref, and it keeps the plugin mountable on a deployment
+	* that composes no credential provider.
+	*/
+	const keyMirror = /* @__PURE__ */ new Map();
+	const credentials = () => ctx.get("credentials");
+	/** Re-read one reference into the mirror; a missing provider or ref clears it. */
+	const refreshKey = async (ref) => {
+		const provider = credentials();
+		if (provider === void 0) {
+			keyMirror.delete(ref);
+			return;
+		}
+		const value = (await provider.resolve(credentialRef(ref)))?.value ?? "";
+		if (value === "") keyMirror.delete(ref);
+		else keyMirror.set(ref, value);
+	};
+	/** Re-read every reference this plugin can name (all channels + the prompt key). */
+	const refreshAllKeys = async () => {
+		const refs = /* @__PURE__ */ new Set([PROMPT_KEY_REF]);
+		for (const channel of normalizeChannels(current()?.channels)) refs.add(channelKeyRef(channel.id));
+		await Promise.all([...refs].map((ref) => refreshKey(ref)));
+	};
 	const resolve = () => {
 		const value = current() ?? {};
 		let channels = normalizeChannels(value.channels);
-		const secrets = { ...value.channelSecrets ?? {} };
 		if (channels.length === 0) {
 			const legacyUrl = typeof value.apiUrl === "string" ? value.apiUrl.trim() : "";
 			const legacyModels = Array.isArray(value.imageModels) ? value.imageModels.filter((model) => typeof model === "string" && model.trim() !== "").map((model) => ({
 				alias: model.trim(),
 				id: model.trim()
 			})) : [];
-			if (legacyUrl !== "" || legacyModels.length > 0) {
-				channels = [{
-					id: "default",
-					preset: "",
-					name: "默认渠道",
-					apiUrl: legacyUrl,
-					apiUrlFull: false,
-					models: legacyModels
-				}];
-				const legacyKey = typeof value.apiKey === "string" ? value.apiKey.trim() : "";
-				if (legacyKey !== "") secrets["default"] = legacyKey;
-			}
+			if (legacyUrl !== "" || legacyModels.length > 0) channels = [{
+				id: "default",
+				preset: "",
+				name: "默认渠道",
+				apiUrl: legacyUrl,
+				apiUrlFull: false,
+				models: legacyModels
+			}];
 		}
 		const named = channels.map((channel) => ({
 			...channel,
@@ -3218,11 +3442,11 @@ function apply(ctx, config) {
 			allowAgentImageGeneration: value.allowAgentImageGeneration ?? DEFAULT_ALLOW_AGENT_IMAGE_GENERATION,
 			channels: named.map((channel) => ({
 				...channel,
-				apiKey: typeof secrets[channel.id] === "string" ? secrets[channel.id] : ""
+				apiKey: keyMirror.get(channelKeyRef(channel.id)) ?? ""
 			})),
 			defaultChannelId,
 			promptApiUrl: typeof value.promptApiUrl === "string" ? value.promptApiUrl.trim() : "",
-			promptApiKey: typeof value.promptApiKey === "string" ? value.promptApiKey.trim() : "",
+			promptApiKey: keyMirror.get("DSH_IMAGEGEN_PROMPT_KEY") ?? "",
 			promptModel: typeof value.promptModel === "string" ? value.promptModel.trim() : ""
 		};
 	};
@@ -3237,9 +3461,23 @@ function apply(ctx, config) {
 	const pendingConversationImages = /* @__PURE__ */ new Map();
 	ctx.inject(["settings", "attachments"], (sctx) => {
 		const seam = sctx.get("settings");
+		const credentialsSeam = () => {
+			const provider = credentials();
+			if (provider === void 0) return void 0;
+			return {
+				holds: async (ref) => (await provider.describe(credentialRef(ref))).configured,
+				set: async (ref, value) => {
+					await provider.set(credentialRef(ref), value);
+				},
+				unset: async (ref) => {
+					await provider.unset(credentialRef(ref));
+				}
+			};
+		};
 		sctx.effect(() => {
 			const disposers = makeRoutes({
 				settings: seam,
+				credentials: credentialsSeam,
 				resolve: () => {
 					const value = resolve();
 					const channel = value.channels.find((candidate) => candidate.id === value.defaultChannelId) ?? value.channels[0];
@@ -3316,11 +3554,22 @@ function apply(ctx, config) {
 	installSettingsSectionCompat(ctx, ImageGenSettingsNamespace, Config, config?.get() ?? {}, {
 		setSource: (source) => {
 			current = source;
-			sync();
+			refreshAllKeys().then(sync);
 		},
-		onChange: sync
+		onChange: () => {
+			refreshAllKeys().then(sync);
+		}
+	});
+	ctx.inject(["credentials"], (cctx) => {
+		cctx.effect(() => {
+			const dispose = cctx.on("credentials/reference-updated", () => {
+				refreshAllKeys().then(sync);
+			});
+			refreshAllKeys().then(sync);
+			return dispose;
+		}, "dsh-imagegen: credential mirror");
 	});
 	sync();
 }
 //#endregion
-export { Config, IMAGEGEN_GUIDANCE, ImageGenError, ImageGenSettingsNamespace, ImageGenerationRuntime, apply, generateImage, inject, latestSessionImage, makeRoutes, name, promptCharLimit, registerAgentImageTools, registerEditImageCommand };
+export { Config, IMAGEGEN_GUIDANCE, ImageGenError, ImageGenSettingsNamespace, ImageGenerationRuntime, PROMPT_KEY_REF, apply, channelKeyRef, generateImage, inject, latestSessionImage, makeRoutes, name, promptCharLimit, registerAgentImageTools, registerEditImageCommand };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@logictan/dsh-imagegen",
   "description": "Chat-invoked AI image generation for the dsh web GUI: text-to-image and image-to-image through configurable provider channels (gpt-image-2 / grok-imagine-image / nanobanana series / seedream-5.0-pro / dall-e-3, with native xAI Grok Imagine, Google Nano Banana and ByteDance Seedream request shaping) and per-channel model catalogs.",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -33,23 +33,23 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-attachment": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-store": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-commands": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-llm": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-settings": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.2-alpha.2",
-    "@deepseek-ai/dsh-tools": "0.1.2-alpha.2",
+    "@deepseek-ai/dsh-api-remotes": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-api-session-controller": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-attachment": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-store": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-commands": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.2.0-rc.2",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
     "@types/react-dom": "^18.3.5",
@@ -60,7 +60,7 @@
     "tsdown": "0.22.2",
     "typescript": "~5.7.2",
     "@deepseek-ai/schemastery": "^3.18.4",
-    "@deepseek-ai/dsh-credentials": "0.1.6-alpha.2"
+    "@deepseek-ai/dsh-credentials": "^0.2.0-rc.2"
   },
   "files": [
     "lib",