@openvulcan/dsh-vulcancode 0.0.0-stage → 0.4.0

package/node_modules/@openvulcan/dsh-vulcan-style/lib/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Host half of the VulcanCode look for dsh. The look itself runs in the browser (`client/`); the
+ * Host only owns the settings, because dsh persists third-party theme choices nowhere else.
+ */
+import type { Context, Volatile } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "vulcan-style";
+/**
+ * What the user chose; mirrored by `THEME_CHOICES` in `client/shared.ts`.
+ *
+ * - `vulcan-auto`: Vulcan light or dark, following the system colour scheme.
+ * - `vulcan-light` / `vulcan-dark` / `vulcan-command`: that Vulcan theme.
+ * - `dsh`: leave the theme to dsh's own Appearance setting. Picking a dsh theme in dsh's Appearance
+ *   row records this choice.
+ */
+export declare const THEME_CHOICES: readonly ["vulcan-auto", "vulcan-light", "vulcan-dark", "vulcan-command", "dsh"];
+export type ThemeChoice = typeof THEME_CHOICES[number];
+/**
+ * Every field is volatile: dsh's settings forms expose only volatile fields, and the browser applies
+ * a change without restarting the plugin.
+ */
+export interface Config {
+    theme: Volatile<ThemeChoice>;
+    squareCorners: Volatile<boolean>;
+}
+export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    theme: Schema<"vulcan-auto" | "vulcan-light" | "vulcan-dark" | "vulcan-command" | "dsh", "vulcan-auto" | "vulcan-light" | "vulcan-dark" | "vulcan-command" | "dsh", "volatile-defined">;
+    squareCorners: Schema<boolean, boolean, "volatile-defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    theme: Schema<"vulcan-auto" | "vulcan-light" | "vulcan-dark" | "vulcan-command" | "dsh", "vulcan-auto" | "vulcan-light" | "vulcan-dark" | "vulcan-command" | "dsh", "volatile-defined">;
+    squareCorners: Schema<boolean, boolean, "volatile-defined">;
+}>>, "plain">;
+/** Nothing runs on the Host; the browser half reads and writes this plugin's settings. */
+export declare function apply(_ctx: Context, _config: Config): void;

package/node_modules/@openvulcan/dsh-vulcan-style/lib/index.js

@@ -0,0 +1,42 @@
+/**
+ * Host half of the VulcanCode look for dsh. The look itself runs in the browser (`client/`); the
+ * Host only owns the settings, because dsh persists third-party theme choices nowhere else.
+ */
+import Schema from '@deepseek-ai/schemastery';
+export const name = 'vulcan-style';
+/**
+ * What the user chose; mirrored by `THEME_CHOICES` in `client/shared.ts`.
+ *
+ * - `vulcan-auto`: Vulcan light or dark, following the system colour scheme.
+ * - `vulcan-light` / `vulcan-dark` / `vulcan-command`: that Vulcan theme.
+ * - `dsh`: leave the theme to dsh's own Appearance setting. Picking a dsh theme in dsh's Appearance
+ *   row records this choice.
+ */
+export const THEME_CHOICES = ['vulcan-auto', 'vulcan-light', 'vulcan-dark', 'vulcan-command', 'dsh'];
+export const Config = Schema.object({
+    theme: Schema.union(THEME_CHOICES)
+        .default('vulcan-auto')
+        .description('Interface theme.')
+        .volatile(),
+    squareCorners: Schema.boolean()
+        .default(true)
+        .description('Square corners.')
+        .volatile(),
+}).i18n({
+    en: {
+        theme: {
+            $desc: 'Interface theme. vulcan-auto follows the system light or dark scheme; dsh leaves the theme to dsh\'s Appearance setting.',
+            $inner: ['Vulcan, following the system', 'Vulcan light', 'Vulcan dark', 'Vulcan command', 'dsh theme'],
+        },
+        squareCorners: 'Square corners; works with any theme, dsh\'s own included.',
+    },
+    zh: {
+        theme: {
+            $desc: '界面主题。vulcan-auto 跟随系统明暗；dsh 表示由 dsh 的「外观」设置决定。',
+            $inner: ['Vulcan，跟随系统', 'Vulcan 亮色', 'Vulcan 暗色', 'Vulcan 指挥舱', 'dsh 主题'],
+        },
+        squareCorners: '直角外观，可与任何主题搭配，包括 dsh 自带主题。',
+    },
+});
+/** Nothing runs on the Host; the browser half reads and writes this plugin's settings. */
+export function apply(_ctx, _config) { }

package/node_modules/@openvulcan/dsh-vulcan-style/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@openvulcan/dsh-vulcan-style",
+  "version": "0.4.0",
+  "description": "The VulcanCode look for DeepSeek Harness: Vulcan light, dark and command themes with square corners.",
+  "license": "MIT",
+  "icon": "./assets/style-icon.png",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OpenVulcan/dsh-vulcancode.git",
+    "directory": "packages/dsh-vulcan-style"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "!lib/**/*.test.*",
+    "assets"
+  ],
+  "engines": {
+    "dsh": ">=0.2.1-rc.2 <0.3.0"
+  },
+  "dsh": {
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-settings-general",
+        "@deepseek-ai/dsh-client-ui-theme"
+      ]
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/schemastery": "^3.18.5"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/node_modules/@openvulcan/openvulcan-account/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenVulcan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@openvulcan/openvulcan-account/lib/account.d.ts

@@ -0,0 +1,140 @@
+/**
+ * The OpenVulcan account of this device.
+ *
+ * Signing in is a PKCE (S256) flow with a loopback callback: the host opens the approval page in a
+ * browser, the user approves, the browser is sent back to `http://127.0.0.1:<port>/vulcancode/auth/callback`
+ * and the code is exchanged once for a device credential. The credential is an opaque token sent as
+ * `Authorization: Auth <token>` to the site's own auth host only. It lasts 14 days and is rotated
+ * by a single-use refresh once less than a day remains; a rotation that may have been interrupted
+ * forces a fresh sign-in instead of guessing which token is current.
+ *
+ * Where the credential is kept is up to the host: dsh keeps it in its credential store, the command
+ * line in an owner-only file. This module never logs or returns the token itself.
+ */
+/** The account cannot supply a usable credential: not signed in, expired, or the sign-in failed. */
+export declare class AccountError extends Error {
+    readonly code = "not_signed_in";
+    constructor(message: string);
+}
+/** OpenVulcan deployments. The account's site is fixed when it signs in. */
+export declare const SITES: {
+    readonly cn: {
+        readonly auth: "https://auth.openvulcan.cn";
+        readonly api: "https://api.openvulcan.cn";
+    };
+    readonly global: {
+        readonly auth: "https://auth.openvulcan.com";
+        readonly api: "https://api.openvulcan.com";
+    };
+};
+export type Site = keyof typeof SITES;
+export declare function isSite(value: unknown): value is Site;
+/** The stored device credential. */
+export interface Credential {
+    readonly site: Site;
+    /** Origin of the auth host, kept so tests can sign in against a local authority. */
+    readonly auth_origin: string;
+    readonly access_token: string;
+    readonly authorization_id: string;
+    /** RFC 3339. */
+    readonly expires_at: string;
+    /** Set while a refresh is in flight; still set afterwards means the rotation was interrupted. */
+    readonly rotation_pending?: boolean;
+}
+/** Where a host keeps the credential. */
+export interface CredentialStore {
+    read(): Promise<Credential | undefined>;
+    write(credential: Credential): Promise<void>;
+    delete(): Promise<void>;
+}
+/** An owner-only JSON file, for the command line. */
+export declare class FileCredentialStore implements CredentialStore {
+    private readonly file;
+    constructor(file: string);
+    read(): Promise<Credential | undefined>;
+    write(credential: Credential): Promise<void>;
+    delete(): Promise<void>;
+}
+/** Accept a stored credential only when every field has its expected shape. */
+export declare function parseCredential(value: unknown): Credential | undefined;
+/** Refresh once less than this remains. */
+export declare const REFRESH_AHEAD_MS: number;
+/** What the user sees about the device on the approval page. */
+export interface DeviceInfo {
+    readonly display_name: string;
+    readonly client_version: string;
+}
+/** The account as a host shows it; never contains the token. */
+export interface AccountStatus {
+    readonly signedIn: boolean;
+    readonly site?: Site;
+    readonly authorizationId?: string;
+    readonly expiresAt?: string;
+    /** A refresh was interrupted; the user has to sign in again. */
+    readonly reauthRequired?: boolean;
+}
+/** A sign-in waiting for the user's approval. */
+export interface PendingSignIn {
+    readonly approvalUrl: string;
+    readonly expiresAt: string;
+    /** Settles when the user approved (the credential is stored) or the sign-in failed. */
+    readonly done: Promise<AccountStatus>;
+    /** Stop waiting; a credential that already arrived is revoked. */
+    cancel(): void;
+}
+/** The signed-in user as OpenVulcan names them, and the plan in force. */
+export interface AccountProfile {
+    /** Decimal public user id, kept as a string. */
+    readonly id: string;
+    readonly username: string;
+    readonly nickname: string;
+    /** The membership tier, or the free tier when not subscribed. */
+    readonly plan: string;
+}
+/** What a judge needs from an account: its state and a usable credential. */
+export interface AccountSource {
+    status(): Promise<AccountStatus>;
+    /** @throws AccountError when there is no usable credential. */
+    credential(): Promise<Credential>;
+}
+export declare class OpenVulcanAccount implements AccountSource {
+    private readonly store;
+    private readonly device;
+    /** Overrides the auth origin of every site; tests point it at a local authority. */
+    private readonly authOrigin?;
+    private refreshing;
+    constructor(store: CredentialStore, device: DeviceInfo, 
+    /** Overrides the auth origin of every site; tests point it at a local authority. */
+    authOrigin?: string | undefined);
+    status(): Promise<AccountStatus>;
+    /** Begin signing in to `site`. */
+    signIn(site: Site): Promise<PendingSignIn>;
+    /**
+     * Who is signed in, read from `GET /api/v1/vulcancode/account`; an answer for another device
+     * authorization is refused.
+     * @throws AccountError when nobody is signed in or the answer breaks the contract.
+     */
+    profile(): Promise<AccountProfile>;
+    /** Revoke the credential on the server and forget it here. */
+    signOut(): Promise<void>;
+    /**
+     * A usable credential, refreshed first when less than a day remains.
+     * @throws AccountError when there is none or it can no longer be trusted.
+     */
+    credential(): Promise<Credential>;
+    private refresh;
+}
+/** An HTTP answer outside 2xx. */
+export declare class HttpError extends Error {
+    readonly status: number;
+    readonly code: string | undefined;
+    readonly retryAfterMs?: number | undefined;
+    constructor(status: number, code: string | undefined, message: string, retryAfterMs?: number | undefined);
+}
+/** POST JSON, with `Authorization: Auth <token>` when a token is given. */
+export declare function postJson(url: string, token: string | undefined, body: unknown): Promise<unknown>;
+export declare function requestJson(url: string, token: string | undefined, init: {
+    method: string;
+    body?: string;
+}): Promise<unknown>;
+export declare function retryAfter(header: string | null): number | undefined;

package/node_modules/@openvulcan/openvulcan-account/lib/account.js

@@ -0,0 +1,347 @@
+/**
+ * The OpenVulcan account of this device.
+ *
+ * Signing in is a PKCE (S256) flow with a loopback callback: the host opens the approval page in a
+ * browser, the user approves, the browser is sent back to `http://127.0.0.1:<port>/vulcancode/auth/callback`
+ * and the code is exchanged once for a device credential. The credential is an opaque token sent as
+ * `Authorization: Auth <token>` to the site's own auth host only. It lasts 14 days and is rotated
+ * by a single-use refresh once less than a day remains; a rotation that may have been interrupted
+ * forces a fresh sign-in instead of guessing which token is current.
+ *
+ * Where the credential is kept is up to the host: dsh keeps it in its credential store, the command
+ * line in an owner-only file. This module never logs or returns the token itself.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+/** The account cannot supply a usable credential: not signed in, expired, or the sign-in failed. */
+export class AccountError extends Error {
+    code = 'not_signed_in';
+    constructor(message) {
+        super(message);
+        this.name = 'AccountError';
+    }
+}
+/** OpenVulcan deployments. The account's site is fixed when it signs in. */
+export const SITES = {
+    cn: { auth: 'https://auth.openvulcan.cn', api: 'https://api.openvulcan.cn' },
+    global: { auth: 'https://auth.openvulcan.com', api: 'https://api.openvulcan.com' },
+};
+export function isSite(value) {
+    return value === 'cn' || value === 'global';
+}
+/** An owner-only JSON file, for the command line. */
+export class FileCredentialStore {
+    file;
+    constructor(file) {
+        this.file = file;
+    }
+    async read() {
+        try {
+            return parseCredential(JSON.parse(fs.readFileSync(this.file, 'utf8')));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async write(credential) {
+        writeFileAtomic(this.file, `${JSON.stringify(credential, null, 2)}\n`);
+    }
+    async delete() {
+        fs.rmSync(this.file, { force: true });
+    }
+}
+function writeFileAtomic(file, text) {
+    const temporary = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(temporary, text, { mode: 0o600 });
+    fs.renameSync(temporary, file);
+}
+/** Accept a stored credential only when every field has its expected shape. */
+export function parseCredential(value) {
+    const record = value;
+    if (typeof record !== 'object' || record === null)
+        return undefined;
+    if (!isSite(record.site) || typeof record.auth_origin !== 'string' || typeof record.access_token !== 'string'
+        || typeof record.authorization_id !== 'string' || typeof record.expires_at !== 'string' || Number.isNaN(Date.parse(record.expires_at))) {
+        return undefined;
+    }
+    return {
+        site: record.site, auth_origin: record.auth_origin, access_token: record.access_token,
+        authorization_id: record.authorization_id, expires_at: record.expires_at,
+        ...record.rotation_pending === true ? { rotation_pending: true } : {},
+    };
+}
+/** Refresh once less than this remains. */
+export const REFRESH_AHEAD_MS = 24 * 60 * 60_000;
+const CALLBACK_PATH = '/vulcancode/auth/callback';
+const ACCESS_TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const REQUEST_TIMEOUT_MS = 15_000;
+export class OpenVulcanAccount {
+    store;
+    device;
+    authOrigin;
+    refreshing;
+    constructor(store, device, 
+    /** Overrides the auth origin of every site; tests point it at a local authority. */
+    authOrigin) {
+        this.store = store;
+        this.device = device;
+        this.authOrigin = authOrigin;
+    }
+    async status() {
+        const credential = await this.store.read();
+        if (credential === undefined)
+            return { signedIn: false };
+        return {
+            signedIn: credential.rotation_pending !== true && Date.parse(credential.expires_at) > Date.now(),
+            site: credential.site,
+            authorizationId: credential.authorization_id,
+            expiresAt: credential.expires_at,
+            ...credential.rotation_pending === true ? { reauthRequired: true } : {},
+        };
+    }
+    /** Begin signing in to `site`. */
+    async signIn(site) {
+        const origin = this.authOrigin ?? SITES[site].auth;
+        const state = base64url(randomBytes(32));
+        const verifier = base64url(randomBytes(32));
+        const challenge = base64url(createHash('sha256').update(verifier).digest());
+        let settle;
+        const callback = new Promise((resolve, reject) => {
+            settle = { resolve, reject };
+        });
+        const server = http.createServer((request, response) => {
+            const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+            const keys = [...url.searchParams.keys()].sort();
+            if (request.method !== 'GET' || url.pathname !== CALLBACK_PATH || keys.join(',') !== 'code,state' || url.searchParams.get('state') !== state) {
+                response.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' }).end('Invalid sign-in callback.');
+                return;
+            }
+            response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+                .end('<!doctype html><meta charset="utf-8"><title>Vulcan Decision</title><p>Signed in. You can close this page.</p>');
+            settle.resolve(url.searchParams.get('code') ?? '');
+        });
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', () => resolve());
+        });
+        const port = server.address().port;
+        const close = () => server.close();
+        let begin;
+        try {
+            begin = await postJson(`${origin}/api/v1/vulcancode/authorize`, undefined, {
+                callback_uri: `http://127.0.0.1:${port}${CALLBACK_PATH}`,
+                state,
+                code_challenge: challenge,
+                code_challenge_method: 'S256',
+                device: {
+                    display_name: this.device.display_name.slice(0, 64),
+                    operating_system: operatingSystem(),
+                    architecture: architecture(),
+                    client_version: this.device.client_version.slice(0, 32),
+                },
+            });
+            checkApprovalUrl(begin.approval_url, origin, state);
+        }
+        catch (error) {
+            close();
+            throw error;
+        }
+        let cancelled = false;
+        const timeout = setTimeout(() => settle.reject(new AccountError('the sign-in request expired')), Math.max(0, Date.parse(begin.expires_at) - Date.now()) || 600_000);
+        const done = (async () => {
+            try {
+                const code = await callback;
+                const answer = await postJson(`${origin}/api/v1/vulcancode/token`, undefined, { code, code_verifier: verifier });
+                const credential = tokenAnswer(answer, site, origin);
+                if (cancelled) {
+                    await revoke(credential);
+                    throw new AccountError('the sign-in was cancelled');
+                }
+                await this.store.write(credential);
+                return await this.status();
+            }
+            finally {
+                clearTimeout(timeout);
+                close();
+            }
+        })();
+        done.catch(() => { });
+        return {
+            approvalUrl: begin.approval_url,
+            expiresAt: begin.expires_at,
+            done,
+            cancel: () => {
+                cancelled = true;
+                settle.reject(new AccountError('the sign-in was cancelled'));
+            },
+        };
+    }
+    /**
+     * Who is signed in, read from `GET /api/v1/vulcancode/account`; an answer for another device
+     * authorization is refused.
+     * @throws AccountError when nobody is signed in or the answer breaks the contract.
+     */
+    async profile() {
+        const credential = await this.credential();
+        const answer = await requestJson(`${credential.auth_origin}/api/v1/vulcancode/account`, credential.access_token, { method: 'GET' });
+        const user = answer?.user;
+        const tier = answer?.quota?.member?.tier ?? answer?.quota?.free?.tier;
+        if (typeof user?.id !== 'string' || typeof user.username !== 'string' || typeof user.nickname !== 'string' || typeof tier !== 'string') {
+            throw new AccountError('OpenVulcan answered a malformed account');
+        }
+        if (answer.authorization_id !== credential.authorization_id)
+            throw new AccountError('OpenVulcan answered the account of another device authorization');
+        return { id: user.id, username: user.username, nickname: user.nickname, plan: tier };
+    }
+    /** Revoke the credential on the server and forget it here. */
+    async signOut() {
+        const credential = await this.store.read();
+        await this.store.delete();
+        if (credential !== undefined)
+            await revoke(credential);
+    }
+    /**
+     * A usable credential, refreshed first when less than a day remains.
+     * @throws AccountError when there is none or it can no longer be trusted.
+     */
+    async credential() {
+        const credential = await this.store.read();
+        if (credential === undefined)
+            throw new AccountError('not signed in to OpenVulcan');
+        if (credential.rotation_pending === true)
+            throw new AccountError('a credential rotation was interrupted; sign in to OpenVulcan again');
+        const remaining = Date.parse(credential.expires_at) - Date.now();
+        if (remaining <= 0)
+            throw new AccountError('the OpenVulcan sign-in expired; sign in again');
+        if (remaining > REFRESH_AHEAD_MS)
+            return credential;
+        this.refreshing ??= this.refresh(credential).finally(() => {
+            this.refreshing = undefined;
+        });
+        return await this.refreshing;
+    }
+    async refresh(credential) {
+        await this.store.write({ ...credential, rotation_pending: true });
+        let answer;
+        try {
+            answer = await postJson(`${credential.auth_origin}/api/v1/vulcancode/token/refresh`, credential.access_token, {});
+        }
+        catch (error) {
+            // A refusal means the credential is gone; anything else leaves the rotation pending.
+            if (error instanceof HttpError && (error.status === 401 || error.status === 403))
+                await this.store.delete();
+            throw new AccountError(`refreshing the OpenVulcan sign-in failed: ${error.message}`);
+        }
+        const next = tokenAnswer(answer, credential.site, credential.auth_origin);
+        if (next.authorization_id !== credential.authorization_id) {
+            await this.store.delete();
+            throw new AccountError('the refreshed credential belongs to another device authorization');
+        }
+        await this.store.write(next);
+        return next;
+    }
+}
+async function revoke(credential) {
+    try {
+        await postJson(`${credential.auth_origin}/api/v1/vulcancode/logout`, credential.access_token, {});
+    }
+    catch (error) {
+        // An already invalid credential is as good as revoked.
+        if (!(error instanceof HttpError && error.status === 401))
+            throw error;
+    }
+}
+function tokenAnswer(value, site, origin) {
+    const answer = value;
+    if (typeof answer?.access_token !== 'string' || !ACCESS_TOKEN.test(answer.access_token) || answer.token_type !== 'Auth'
+        || typeof answer.expires_at !== 'string' || Number.isNaN(Date.parse(answer.expires_at))
+        || typeof answer.authorization_id !== 'string' || answer.authorization_id === '') {
+        throw new AccountError('OpenVulcan answered a malformed credential');
+    }
+    if (answer.site !== undefined && answer.site !== site)
+        throw new AccountError('OpenVulcan answered for another site');
+    return { site, auth_origin: origin, access_token: answer.access_token, authorization_id: answer.authorization_id, expires_at: answer.expires_at };
+}
+function checkApprovalUrl(value, origin, state) {
+    if (typeof value !== 'string')
+        throw new AccountError('OpenVulcan answered no approval page');
+    const url = new URL(value);
+    const keys = [...url.searchParams.keys()].sort().join(',');
+    if (url.origin !== origin || url.pathname !== '/authorize' || keys !== 'request_id,state' || url.searchParams.get('state') !== state) {
+        throw new AccountError('OpenVulcan answered an unexpected approval page');
+    }
+}
+/** An HTTP answer outside 2xx. */
+export class HttpError extends Error {
+    status;
+    code;
+    retryAfterMs;
+    constructor(status, code, message, retryAfterMs) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.retryAfterMs = retryAfterMs;
+        this.name = 'HttpError';
+    }
+}
+/** POST JSON, with `Authorization: Auth <token>` when a token is given. */
+export async function postJson(url, token, body) {
+    return await requestJson(url, token, { method: 'POST', body: JSON.stringify(body) });
+}
+export async function requestJson(url, token, init) {
+    const response = await fetch(url, {
+        method: init.method,
+        redirect: 'error',
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        headers: {
+            'Accept': 'application/json',
+            ...init.body === undefined ? {} : { 'Content-Type': 'application/json' },
+            ...token === undefined ? {} : { Authorization: `Auth ${token}` },
+        },
+        ...init.body === undefined ? {} : { body: init.body },
+    });
+    const text = await response.text();
+    if (!response.ok) {
+        let code;
+        let message = `HTTP ${response.status}`;
+        try {
+            const envelope = JSON.parse(text);
+            if (typeof envelope.error === 'object' && envelope.error !== null) {
+                code = typeof envelope.error.code === 'string' ? envelope.error.code : undefined;
+                if (typeof envelope.error.message === 'string')
+                    message += `: ${envelope.error.message}`;
+            }
+            else if (typeof envelope.error === 'string') {
+                code = envelope.error;
+                if (typeof envelope.message === 'string')
+                    message += `: ${envelope.message}`;
+            }
+        }
+        catch {
+            // A non-JSON error body carries nothing more.
+        }
+        throw new HttpError(response.status, code, code === undefined ? message : `${message} (${code})`, retryAfter(response.headers.get('Retry-After')));
+    }
+    return text === '' ? {} : JSON.parse(text);
+}
+export function retryAfter(header) {
+    if (header === null)
+        return undefined;
+    const seconds = Number(header);
+    if (Number.isFinite(seconds) && seconds >= 0)
+        return seconds * 1000;
+    const date = Date.parse(header);
+    return Number.isNaN(date) ? undefined : Math.max(0, date - Date.now());
+}
+function base64url(bytes) {
+    return bytes.toString('base64url');
+}
+function operatingSystem() {
+    const name = { win32: 'Windows', darwin: 'macOS', linux: 'Linux' }[process.platform] ?? process.platform;
+    return `${name} ${os.release()}`.slice(0, 64);
+}
+function architecture() {
+    return process.arch === 'arm64' ? 'arm64' : 'x86_64';
+}

package/node_modules/@openvulcan/openvulcan-account/lib/index.d.ts

@@ -0,0 +1 @@
+export * from './account.js';

package/node_modules/@openvulcan/openvulcan-account/lib/index.js

@@ -0,0 +1 @@
+export * from './account.js';

package/node_modules/@openvulcan/openvulcan-account/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@openvulcan/openvulcan-account",
+  "version": "0.4.0",
+  "description": "OpenVulcan account: device sign-in, credential storage and refresh, shared by the Vulcan tools.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OpenVulcan/dsh-vulcancode.git",
+    "directory": "packages/openvulcan-account"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "!lib/**/*.test.*"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}