@serviceme/devtools-shared 0.4.10 → 0.4.11

package/dist/index.d.mts

@@ -929,6 +929,67 @@ interface CertificateBundleEnvironmentSupport {
     defaultPassword: string;
 }
 
+/**
+ * Medalsoft-internal infrastructure addresses.
+ *
+ * These are **private-network only** endpoints — reachable from the
+ * company LAN/VPN, NOT from the public internet. External users must
+ * use the public equivalents (`nexus.servicemecloud.com`, …). Keeping
+ * them as named constants here (instead of inlined literals) gives a
+ * single place to update when the internal fleet moves, and makes the
+ * "this is an internal address" intent explicit at every use site.
+ *
+ * NOTE: `packages/serviceme-core` keeps its own copies of the ones it
+ * needs — ADL-003 forbids core → shared. Keep those in lock-step.
+ */
+/** Medalsoft 内网 LLM 网关（OpenAI-compatible `/v1`），仅办公网可达。 */
+declare const MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+/** Medalsoft 私有 NuGet 源，仅办公网可达。 */
+declare const MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
+/**
+ * Device-auth wire contract shared by the extension (signer) and the
+ * server (verifier).
+ *
+ * Single source of truth for the `x-ms-device-*` header names and the
+ * HMAC-SHA-256 request-signature algorithm. Previously the same
+ * constants + function were copy-pasted in three places
+ * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
+ * server `lib/auth/device-signature-guard.ts`) and kept in sync by
+ * comments alone. Server and extension now import from here.
+ *
+ * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
+ * copy — ADL-003 forbids core → shared (and shared → core) so the core
+ * copy is a documented boundary exception. Keep it in lock-step with
+ * this file. See `docs/architecture/phase-5-device-header-spec.md` §5
+ * for the wire format.
+ */
+/** Canonical header names — MUST match the server's verifier. */
+declare const DeviceAuthHeaders: {
+    readonly deviceId: "x-ms-device-id";
+    readonly deviceSecret: "x-ms-device-secret";
+    readonly signature: "x-ms-device-signature";
+    readonly timestamp: "x-ms-device-timestamp";
+    readonly secretVersion: "x-ms-device-secret-version";
+};
+interface DeviceRequestSignatureParams {
+    method: string;
+    path: string;
+    timestamp: number;
+    body: string;
+    secret: string;
+}
+/**
+ * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
+ * Output is lowercase hex SHA-256.
+ *
+ * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
+ * `node:crypto` so this module stays importable from the webview (the
+ * shared barrel is consumed by browser bundles — `node:crypto` breaks
+ * the vite/rollup build).
+ */
+declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+
 /**
  * Git URL Utilities
  *
@@ -1299,6 +1360,52 @@ interface BridgeRepoSyncPull {
     error?: string;
 }
 
+/**
+ * Webview ↔ extension message-contract types.
+ *
+ * These three payload shapes travel across the postMessage boundary
+ * (broadcast messages like `updateExternalTools` / `updateAzureProfiles`
+ * / `updateApiConfig`). They used to live in
+ * `apps/webview-ui/src/types` only — the extension-side handlers typed
+ * them implicitly via `data` destructuring, so the contract was
+ * duplicated by convention and drifted silently. Moving them here makes
+ * `@serviceme/devtools-shared` the single source of truth, and lets the
+ * `WebviewInboundMessage` discriminated union (messages.ts) type the
+ * corresponding broadcast variants without a `as` cast at the consumer.
+ *
+ * NOTE: `apps/webview-ui/src/types/index.ts` re-exports these so
+ * existing webview imports keep working unchanged.
+ */
+interface ExternalTool {
+    id: string;
+    name: string;
+    url: string;
+    description?: string;
+    icon?: string;
+    isDefault?: boolean;
+}
+interface AzureProfile {
+    id: string;
+    name: string;
+    method: "FTP" | "MSDeploy";
+    host: string;
+    username?: string;
+    password?: string;
+    remotePath?: string;
+    port?: number;
+}
+interface ApiConfig {
+    schemaPath: string;
+    requestLibPath?: string;
+    projectName?: string;
+    namespace?: string;
+    serversPath?: string;
+    apiPrefix?: string;
+    mock?: boolean;
+    templatesFolder?: string;
+    enumStyle?: "string-literal" | "enum";
+}
+
 declare enum WebviewMessageType {
     WebviewReady = "webviewReady",
     Ready = "ready",
@@ -1645,18 +1752,15 @@ interface ByomProviderToggles {
     cacheEnabled: boolean;
 }
 /**
- * Strict-typed shape for the inbound messages currently handled by
- * `useAppMessages`. Stage 1 deliberately covers ONLY the variants whose
- * payload types already live in `@serviceme/devtools-shared`
- * (re-exported from the package index via `types/protocol-contracts` as
- * `BridgeRepoEntry` / `BridgeSkillRepoEntry`) or here as named types
- * (`LinkedSkillPayloadEntry`). The variants whose payload types live in
- * `apps/webview-ui/src/types` (ExternalTool, AzureProfile, ApiConfig) stay
- * on the enum path for now — moving those types into `@serviceme/devtools-shared` is
- * its own refactor and not in scope.
+ * Strict-typed shape for the inbound messages handled by
+ * `useAppMessages`. Covers the 8 variants whose payload types now live
+ * in `@serviceme/devtools-shared` (`webview-contract.ts` holds the
+ * ExternalTool / AzureProfile / ApiConfig shapes). The string-keyed
+ * `WebviewMessageType` enum stays in place for the remaining enum-path
+ * call sites across `apps/webview-ui` and `apps/extension`.
  *
  * Each variant lists ONLY the fields the hook actually reads; optional
- * fields are explicit (`workspaceOpen` on `UpdateSkillRepoCatalog`).
+ * fields are explicit (`tools?` / `profiles?` / `workspaceOpen`).
  */
 type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateRepositoryList;
@@ -1672,6 +1776,18 @@ type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateLinkedSkills;
     links: LinkedSkillPayloadEntry[];
     kind: "skill" | "agent";
+} | {
+    type: typeof WebviewMessageType.UpdateExternalTools;
+    tools?: ExternalTool[];
+} | {
+    type: typeof WebviewMessageType.UpdateNgrokStatus;
+    isRunning: boolean;
+} | {
+    type: typeof WebviewMessageType.UpdateAzureProfiles;
+    profiles?: AzureProfile[];
+} | {
+    type: typeof WebviewMessageType.UpdateApiConfig;
+    config: ApiConfig;
 };
 /**
  * One entry inside the `UpdateLinkedSkills.links` array. Mirrors the
@@ -1744,4 +1860,4 @@ declare function asAbortSignal(input: unknown): AbortSignal | undefined;
  */
 declare function safeJson<T>(text: string, fallback: T): T;
 
-export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };
+export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, type ApiConfig, type AzureProfile, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, DeviceAuthHeaders, type DeviceRequestSignatureParams, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, type ExternalTool, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };

package/dist/index.d.ts

@@ -929,6 +929,67 @@ interface CertificateBundleEnvironmentSupport {
     defaultPassword: string;
 }
 
+/**
+ * Medalsoft-internal infrastructure addresses.
+ *
+ * These are **private-network only** endpoints — reachable from the
+ * company LAN/VPN, NOT from the public internet. External users must
+ * use the public equivalents (`nexus.servicemecloud.com`, …). Keeping
+ * them as named constants here (instead of inlined literals) gives a
+ * single place to update when the internal fleet moves, and makes the
+ * "this is an internal address" intent explicit at every use site.
+ *
+ * NOTE: `packages/serviceme-core` keeps its own copies of the ones it
+ * needs — ADL-003 forbids core → shared. Keep those in lock-step.
+ */
+/** Medalsoft 内网 LLM 网关（OpenAI-compatible `/v1`），仅办公网可达。 */
+declare const MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+/** Medalsoft 私有 NuGet 源，仅办公网可达。 */
+declare const MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
+/**
+ * Device-auth wire contract shared by the extension (signer) and the
+ * server (verifier).
+ *
+ * Single source of truth for the `x-ms-device-*` header names and the
+ * HMAC-SHA-256 request-signature algorithm. Previously the same
+ * constants + function were copy-pasted in three places
+ * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
+ * server `lib/auth/device-signature-guard.ts`) and kept in sync by
+ * comments alone. Server and extension now import from here.
+ *
+ * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
+ * copy — ADL-003 forbids core → shared (and shared → core) so the core
+ * copy is a documented boundary exception. Keep it in lock-step with
+ * this file. See `docs/architecture/phase-5-device-header-spec.md` §5
+ * for the wire format.
+ */
+/** Canonical header names — MUST match the server's verifier. */
+declare const DeviceAuthHeaders: {
+    readonly deviceId: "x-ms-device-id";
+    readonly deviceSecret: "x-ms-device-secret";
+    readonly signature: "x-ms-device-signature";
+    readonly timestamp: "x-ms-device-timestamp";
+    readonly secretVersion: "x-ms-device-secret-version";
+};
+interface DeviceRequestSignatureParams {
+    method: string;
+    path: string;
+    timestamp: number;
+    body: string;
+    secret: string;
+}
+/**
+ * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
+ * Output is lowercase hex SHA-256.
+ *
+ * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
+ * `node:crypto` so this module stays importable from the webview (the
+ * shared barrel is consumed by browser bundles — `node:crypto` breaks
+ * the vite/rollup build).
+ */
+declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+
 /**
  * Git URL Utilities
  *
@@ -1299,6 +1360,52 @@ interface BridgeRepoSyncPull {
     error?: string;
 }
 
+/**
+ * Webview ↔ extension message-contract types.
+ *
+ * These three payload shapes travel across the postMessage boundary
+ * (broadcast messages like `updateExternalTools` / `updateAzureProfiles`
+ * / `updateApiConfig`). They used to live in
+ * `apps/webview-ui/src/types` only — the extension-side handlers typed
+ * them implicitly via `data` destructuring, so the contract was
+ * duplicated by convention and drifted silently. Moving them here makes
+ * `@serviceme/devtools-shared` the single source of truth, and lets the
+ * `WebviewInboundMessage` discriminated union (messages.ts) type the
+ * corresponding broadcast variants without a `as` cast at the consumer.
+ *
+ * NOTE: `apps/webview-ui/src/types/index.ts` re-exports these so
+ * existing webview imports keep working unchanged.
+ */
+interface ExternalTool {
+    id: string;
+    name: string;
+    url: string;
+    description?: string;
+    icon?: string;
+    isDefault?: boolean;
+}
+interface AzureProfile {
+    id: string;
+    name: string;
+    method: "FTP" | "MSDeploy";
+    host: string;
+    username?: string;
+    password?: string;
+    remotePath?: string;
+    port?: number;
+}
+interface ApiConfig {
+    schemaPath: string;
+    requestLibPath?: string;
+    projectName?: string;
+    namespace?: string;
+    serversPath?: string;
+    apiPrefix?: string;
+    mock?: boolean;
+    templatesFolder?: string;
+    enumStyle?: "string-literal" | "enum";
+}
+
 declare enum WebviewMessageType {
     WebviewReady = "webviewReady",
     Ready = "ready",
@@ -1645,18 +1752,15 @@ interface ByomProviderToggles {
     cacheEnabled: boolean;
 }
 /**
- * Strict-typed shape for the inbound messages currently handled by
- * `useAppMessages`. Stage 1 deliberately covers ONLY the variants whose
- * payload types already live in `@serviceme/devtools-shared`
- * (re-exported from the package index via `types/protocol-contracts` as
- * `BridgeRepoEntry` / `BridgeSkillRepoEntry`) or here as named types
- * (`LinkedSkillPayloadEntry`). The variants whose payload types live in
- * `apps/webview-ui/src/types` (ExternalTool, AzureProfile, ApiConfig) stay
- * on the enum path for now — moving those types into `@serviceme/devtools-shared` is
- * its own refactor and not in scope.
+ * Strict-typed shape for the inbound messages handled by
+ * `useAppMessages`. Covers the 8 variants whose payload types now live
+ * in `@serviceme/devtools-shared` (`webview-contract.ts` holds the
+ * ExternalTool / AzureProfile / ApiConfig shapes). The string-keyed
+ * `WebviewMessageType` enum stays in place for the remaining enum-path
+ * call sites across `apps/webview-ui` and `apps/extension`.
  *
  * Each variant lists ONLY the fields the hook actually reads; optional
- * fields are explicit (`workspaceOpen` on `UpdateSkillRepoCatalog`).
+ * fields are explicit (`tools?` / `profiles?` / `workspaceOpen`).
  */
 type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateRepositoryList;
@@ -1672,6 +1776,18 @@ type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateLinkedSkills;
     links: LinkedSkillPayloadEntry[];
     kind: "skill" | "agent";
+} | {
+    type: typeof WebviewMessageType.UpdateExternalTools;
+    tools?: ExternalTool[];
+} | {
+    type: typeof WebviewMessageType.UpdateNgrokStatus;
+    isRunning: boolean;
+} | {
+    type: typeof WebviewMessageType.UpdateAzureProfiles;
+    profiles?: AzureProfile[];
+} | {
+    type: typeof WebviewMessageType.UpdateApiConfig;
+    config: ApiConfig;
 };
 /**
  * One entry inside the `UpdateLinkedSkills.links` array. Mirrors the
@@ -1744,4 +1860,4 @@ declare function asAbortSignal(input: unknown): AbortSignal | undefined;
  */
 declare function safeJson<T>(text: string, fallback: T): T;
 
-export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };
+export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, type ApiConfig, type AzureProfile, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, DeviceAuthHeaders, type DeviceRequestSignatureParams, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, type ExternalTool, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };

package/dist/index.js

@@ -24,6 +24,7 @@ __export(index_exports, {
   ByomSettingsResponse: () => ByomSettingsResponse,
   CERTIFICATE_BUNDLE_FORMATS: () => CERTIFICATE_BUNDLE_FORMATS,
   CachedServerUrlResponse: () => CachedServerUrlResponse,
+  DeviceAuthHeaders: () => DeviceAuthHeaders,
   GIT_REMOTE_HOST_ALIASES: () => GIT_REMOTE_HOST_ALIASES,
   GetByomSettings: () => GetByomSettings,
   GetCachedServerUrl: () => GetCachedServerUrl,
@@ -31,6 +32,8 @@ __export(index_exports, {
   GetUtilityModels: () => GetUtilityModels,
   LISTABLE_PRESET_MODELS: () => LISTABLE_PRESET_MODELS,
   LogLevel: () => LogLevel,
+  MEDALSOFT_NUGET_PRIVATE_SOURCE: () => MEDALSOFT_NUGET_PRIVATE_SOURCE,
+  MEDALSOFT_PRIVATE_GATEWAY_URL: () => MEDALSOFT_PRIVATE_GATEWAY_URL,
   MODEL_METADATA: () => MODEL_METADATA,
   NAMESPACE_ALIASES: () => NAMESPACE_ALIASES,
   NAMESPACE_ALIAS_FAMILY: () => NAMESPACE_ALIAS_FAMILY,
@@ -50,6 +53,7 @@ __export(index_exports, {
   buildPresetModel: () => buildPresetModel,
   checkGitHubOrgMembership: () => checkGitHubOrgMembership,
   createConsoleLogger: () => createConsoleLogger,
+  createDeviceRequestSignature: () => createDeviceRequestSignature,
   currencyForBaseUrl: () => currencyForBaseUrl,
   effectiveAdapterType: () => effectiveAdapterType,
   fetchGitHubUser: () => fetchGitHubUser,
@@ -89,6 +93,10 @@ function effectiveAdapterType(configuredType, baseUrl) {
   return configuredType;
 }
 
+// src/constants.ts
+var MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+var MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
 // src/ai/providers.base-url.ts
 var PROVIDER_BASE_URL_PRESETS = {
   "openai-compatible": [],
@@ -170,7 +178,11 @@ var PROVIDER_BASE_URL_PRESETS = {
     { label: "\u5168\u7403", baseUrl: "https://apihub.agnes-ai.com/v1" }
   ],
   // Medalsoft internal LLM gateway — single OpenAI-compatible endpoint.
-  medalsoft: [{ label: "\u5185\u90E8\u7F51\u5173", baseUrl: "https://nexus.servicemecloud.com/v1" }],
+  // 内网地址见 `constants.ts`（仅办公网可达）；外网走 nexus。
+  medalsoft: [
+    { label: "\u5185\u7F51", baseUrl: MEDALSOFT_PRIVATE_GATEWAY_URL },
+    { label: "\u5916\u7F51", baseUrl: "https://nexus.servicemecloud.com/v1" }
+  ],
   "vscode-builtin": []
 };
 function getProviderBaseUrlPresets(type) {
@@ -1607,6 +1619,26 @@ var CERTIFICATE_BUNDLE_FORMATS = [
   }
 ];
 
+// src/device-auth.ts
+var import_js_sha256 = require("js-sha256");
+var DeviceAuthHeaders = {
+  deviceId: "x-ms-device-id",
+  deviceSecret: "x-ms-device-secret",
+  signature: "x-ms-device-signature",
+  timestamp: "x-ms-device-timestamp",
+  secretVersion: "x-ms-device-secret-version"
+};
+function createDeviceRequestSignature(params) {
+  const basis = [
+    params.method.toUpperCase(),
+    params.path,
+    String(params.timestamp),
+    params.body,
+    params.secret
+  ].join("\n");
+  return (0, import_js_sha256.sha256)(basis);
+}
+
 // src/git-utils.ts
 var GIT_REMOTE_HOST_ALIASES = {
   "github-msc": "github.com"
@@ -2076,6 +2108,7 @@ function safeJson(text, fallback) {
   ByomSettingsResponse,
   CERTIFICATE_BUNDLE_FORMATS,
   CachedServerUrlResponse,
+  DeviceAuthHeaders,
   GIT_REMOTE_HOST_ALIASES,
   GetByomSettings,
   GetCachedServerUrl,
@@ -2083,6 +2116,8 @@ function safeJson(text, fallback) {
   GetUtilityModels,
   LISTABLE_PRESET_MODELS,
   LogLevel,
+  MEDALSOFT_NUGET_PRIVATE_SOURCE,
+  MEDALSOFT_PRIVATE_GATEWAY_URL,
   MODEL_METADATA,
   NAMESPACE_ALIASES,
   NAMESPACE_ALIAS_FAMILY,
@@ -2102,6 +2137,7 @@ function safeJson(text, fallback) {
   buildPresetModel,
   checkGitHubOrgMembership,
   createConsoleLogger,
+  createDeviceRequestSignature,
   currencyForBaseUrl,
   effectiveAdapterType,
   fetchGitHubUser,

package/dist/index.mjs

@@ -14,6 +14,10 @@ function effectiveAdapterType(configuredType, baseUrl) {
   return configuredType;
 }
 
+// src/constants.ts
+var MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+var MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
 // src/ai/providers.base-url.ts
 var PROVIDER_BASE_URL_PRESETS = {
   "openai-compatible": [],
@@ -95,7 +99,11 @@ var PROVIDER_BASE_URL_PRESETS = {
     { label: "\u5168\u7403", baseUrl: "https://apihub.agnes-ai.com/v1" }
   ],
   // Medalsoft internal LLM gateway — single OpenAI-compatible endpoint.
-  medalsoft: [{ label: "\u5185\u90E8\u7F51\u5173", baseUrl: "https://nexus.servicemecloud.com/v1" }],
+  // 内网地址见 `constants.ts`（仅办公网可达）；外网走 nexus。
+  medalsoft: [
+    { label: "\u5185\u7F51", baseUrl: MEDALSOFT_PRIVATE_GATEWAY_URL },
+    { label: "\u5916\u7F51", baseUrl: "https://nexus.servicemecloud.com/v1" }
+  ],
   "vscode-builtin": []
 };
 function getProviderBaseUrlPresets(type) {
@@ -1532,6 +1540,26 @@ var CERTIFICATE_BUNDLE_FORMATS = [
   }
 ];
 
+// src/device-auth.ts
+import { sha256 } from "js-sha256";
+var DeviceAuthHeaders = {
+  deviceId: "x-ms-device-id",
+  deviceSecret: "x-ms-device-secret",
+  signature: "x-ms-device-signature",
+  timestamp: "x-ms-device-timestamp",
+  secretVersion: "x-ms-device-secret-version"
+};
+function createDeviceRequestSignature(params) {
+  const basis = [
+    params.method.toUpperCase(),
+    params.path,
+    String(params.timestamp),
+    params.body,
+    params.secret
+  ].join("\n");
+  return sha256(basis);
+}
+
 // src/git-utils.ts
 var GIT_REMOTE_HOST_ALIASES = {
   "github-msc": "github.com"
@@ -2000,6 +2028,7 @@ export {
   ByomSettingsResponse,
   CERTIFICATE_BUNDLE_FORMATS,
   CachedServerUrlResponse,
+  DeviceAuthHeaders,
   GIT_REMOTE_HOST_ALIASES,
   GetByomSettings,
   GetCachedServerUrl,
@@ -2007,6 +2036,8 @@ export {
   GetUtilityModels,
   LISTABLE_PRESET_MODELS,
   LogLevel,
+  MEDALSOFT_NUGET_PRIVATE_SOURCE,
+  MEDALSOFT_PRIVATE_GATEWAY_URL,
   MODEL_METADATA,
   NAMESPACE_ALIASES,
   NAMESPACE_ALIAS_FAMILY,
@@ -2026,6 +2057,7 @@ export {
   buildPresetModel,
   checkGitHubOrgMembership,
   createConsoleLogger,
+  createDeviceRequestSignature,
   currencyForBaseUrl,
   effectiveAdapterType,
   fetchGitHubUser,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serviceme/devtools-shared",
-  "version": "0.4.10",
+  "version": "0.4.11",
   "description": "Shared webview↔extension message contracts and cross-package data models used by SERVICEME.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {
@@ -37,6 +37,9 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
+  "dependencies": {
+    "js-sha256": "^1.0.0"
+  },
   "scripts": {
     "watch": "tsup src/index.ts --format cjs,esm --dts --watch",
     "build": "tsup src/index.ts --format cjs,esm --dts",