@serviceme/devtools-shared 0.4.10 → 0.4.12

package/dist/index.d.mts

@@ -929,6 +929,67 @@ interface CertificateBundleEnvironmentSupport {
     defaultPassword: string;
 }
 
+/**
+ * Medalsoft-internal infrastructure addresses.
+ *
+ * These are **private-network only** endpoints — reachable from the
+ * company LAN/VPN, NOT from the public internet. External users must
+ * use the public equivalents (`nexus.servicemecloud.com`, …). Keeping
+ * them as named constants here (instead of inlined literals) gives a
+ * single place to update when the internal fleet moves, and makes the
+ * "this is an internal address" intent explicit at every use site.
+ *
+ * NOTE: `packages/serviceme-core` keeps its own copies of the ones it
+ * needs — ADL-003 forbids core → shared. Keep those in lock-step.
+ */
+/** Medalsoft 内网 LLM 网关（OpenAI-compatible `/v1`），仅办公网可达。 */
+declare const MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+/** Medalsoft 私有 NuGet 源，仅办公网可达。 */
+declare const MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
+/**
+ * Device-auth wire contract shared by the extension (signer) and the
+ * server (verifier).
+ *
+ * Single source of truth for the `x-ms-device-*` header names and the
+ * HMAC-SHA-256 request-signature algorithm. Previously the same
+ * constants + function were copy-pasted in three places
+ * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
+ * server `lib/auth/device-signature-guard.ts`) and kept in sync by
+ * comments alone. Server and extension now import from here.
+ *
+ * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
+ * copy — ADL-003 forbids core → shared (and shared → core) so the core
+ * copy is a documented boundary exception. Keep it in lock-step with
+ * this file. See `docs/architecture/phase-5-device-header-spec.md` §5
+ * for the wire format.
+ */
+/** Canonical header names — MUST match the server's verifier. */
+declare const DeviceAuthHeaders: {
+    readonly deviceId: "x-ms-device-id";
+    readonly deviceSecret: "x-ms-device-secret";
+    readonly signature: "x-ms-device-signature";
+    readonly timestamp: "x-ms-device-timestamp";
+    readonly secretVersion: "x-ms-device-secret-version";
+};
+interface DeviceRequestSignatureParams {
+    method: string;
+    path: string;
+    timestamp: number;
+    body: string;
+    secret: string;
+}
+/**
+ * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
+ * Output is lowercase hex SHA-256.
+ *
+ * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
+ * `node:crypto` so this module stays importable from the webview (the
+ * shared barrel is consumed by browser bundles — `node:crypto` breaks
+ * the vite/rollup build).
+ */
+declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+
 /**
  * Git URL Utilities
  *
@@ -1299,6 +1360,52 @@ interface BridgeRepoSyncPull {
     error?: string;
 }
 
+/**
+ * Webview ↔ extension message-contract types.
+ *
+ * These three payload shapes travel across the postMessage boundary
+ * (broadcast messages like `updateExternalTools` / `updateAzureProfiles`
+ * / `updateApiConfig`). They used to live in
+ * `apps/webview-ui/src/types` only — the extension-side handlers typed
+ * them implicitly via `data` destructuring, so the contract was
+ * duplicated by convention and drifted silently. Moving them here makes
+ * `@serviceme/devtools-shared` the single source of truth, and lets the
+ * `WebviewInboundMessage` discriminated union (messages.ts) type the
+ * corresponding broadcast variants without a `as` cast at the consumer.
+ *
+ * NOTE: `apps/webview-ui/src/types/index.ts` re-exports these so
+ * existing webview imports keep working unchanged.
+ */
+interface ExternalTool {
+    id: string;
+    name: string;
+    url: string;
+    description?: string;
+    icon?: string;
+    isDefault?: boolean;
+}
+interface AzureProfile {
+    id: string;
+    name: string;
+    method: "FTP" | "MSDeploy";
+    host: string;
+    username?: string;
+    password?: string;
+    remotePath?: string;
+    port?: number;
+}
+interface ApiConfig {
+    schemaPath: string;
+    requestLibPath?: string;
+    projectName?: string;
+    namespace?: string;
+    serversPath?: string;
+    apiPrefix?: string;
+    mock?: boolean;
+    templatesFolder?: string;
+    enumStyle?: "string-literal" | "enum";
+}
+
 declare enum WebviewMessageType {
     WebviewReady = "webviewReady",
     Ready = "ready",
@@ -1645,18 +1752,15 @@ interface ByomProviderToggles {
     cacheEnabled: boolean;
 }
 /**
- * Strict-typed shape for the inbound messages currently handled by
- * `useAppMessages`. Stage 1 deliberately covers ONLY the variants whose
- * payload types already live in `@serviceme/devtools-shared`
- * (re-exported from the package index via `types/protocol-contracts` as
- * `BridgeRepoEntry` / `BridgeSkillRepoEntry`) or here as named types
- * (`LinkedSkillPayloadEntry`). The variants whose payload types live in
- * `apps/webview-ui/src/types` (ExternalTool, AzureProfile, ApiConfig) stay
- * on the enum path for now — moving those types into `@serviceme/devtools-shared` is
- * its own refactor and not in scope.
+ * Strict-typed shape for the inbound messages handled by
+ * `useAppMessages`. Covers the 8 variants whose payload types now live
+ * in `@serviceme/devtools-shared` (`webview-contract.ts` holds the
+ * ExternalTool / AzureProfile / ApiConfig shapes). The string-keyed
+ * `WebviewMessageType` enum stays in place for the remaining enum-path
+ * call sites across `apps/webview-ui` and `apps/extension`.
  *
  * Each variant lists ONLY the fields the hook actually reads; optional
- * fields are explicit (`workspaceOpen` on `UpdateSkillRepoCatalog`).
+ * fields are explicit (`tools?` / `profiles?` / `workspaceOpen`).
  */
 type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateRepositoryList;
@@ -1672,6 +1776,18 @@ type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateLinkedSkills;
     links: LinkedSkillPayloadEntry[];
     kind: "skill" | "agent";
+} | {
+    type: typeof WebviewMessageType.UpdateExternalTools;
+    tools?: ExternalTool[];
+} | {
+    type: typeof WebviewMessageType.UpdateNgrokStatus;
+    isRunning: boolean;
+} | {
+    type: typeof WebviewMessageType.UpdateAzureProfiles;
+    profiles?: AzureProfile[];
+} | {
+    type: typeof WebviewMessageType.UpdateApiConfig;
+    config: ApiConfig;
 };
 /**
  * One entry inside the `UpdateLinkedSkills.links` array. Mirrors the
@@ -1744,4 +1860,4 @@ declare function asAbortSignal(input: unknown): AbortSignal | undefined;
  */
 declare function safeJson<T>(text: string, fallback: T): T;
 
-export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };
+export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, type ApiConfig, type AzureProfile, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, DeviceAuthHeaders, type DeviceRequestSignatureParams, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, type ExternalTool, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };

package/dist/index.d.ts

@@ -929,6 +929,67 @@ interface CertificateBundleEnvironmentSupport {
     defaultPassword: string;
 }
 
+/**
+ * Medalsoft-internal infrastructure addresses.
+ *
+ * These are **private-network only** endpoints — reachable from the
+ * company LAN/VPN, NOT from the public internet. External users must
+ * use the public equivalents (`nexus.servicemecloud.com`, …). Keeping
+ * them as named constants here (instead of inlined literals) gives a
+ * single place to update when the internal fleet moves, and makes the
+ * "this is an internal address" intent explicit at every use site.
+ *
+ * NOTE: `packages/serviceme-core` keeps its own copies of the ones it
+ * needs — ADL-003 forbids core → shared. Keep those in lock-step.
+ */
+/** Medalsoft 内网 LLM 网关（OpenAI-compatible `/v1`），仅办公网可达。 */
+declare const MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+/** Medalsoft 私有 NuGet 源，仅办公网可达。 */
+declare const MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
+/**
+ * Device-auth wire contract shared by the extension (signer) and the
+ * server (verifier).
+ *
+ * Single source of truth for the `x-ms-device-*` header names and the
+ * HMAC-SHA-256 request-signature algorithm. Previously the same
+ * constants + function were copy-pasted in three places
+ * (extension `services/device/deviceAuth.ts`, core `device/deviceAuth.ts`,
+ * server `lib/auth/device-signature-guard.ts`) and kept in sync by
+ * comments alone. Server and extension now import from here.
+ *
+ * NOTE: `packages/serviceme-core/src/device/deviceAuth.ts` keeps its own
+ * copy — ADL-003 forbids core → shared (and shared → core) so the core
+ * copy is a documented boundary exception. Keep it in lock-step with
+ * this file. See `docs/architecture/phase-5-device-header-spec.md` §5
+ * for the wire format.
+ */
+/** Canonical header names — MUST match the server's verifier. */
+declare const DeviceAuthHeaders: {
+    readonly deviceId: "x-ms-device-id";
+    readonly deviceSecret: "x-ms-device-secret";
+    readonly signature: "x-ms-device-signature";
+    readonly timestamp: "x-ms-device-timestamp";
+    readonly secretVersion: "x-ms-device-secret-version";
+};
+interface DeviceRequestSignatureParams {
+    method: string;
+    path: string;
+    timestamp: number;
+    body: string;
+    secret: string;
+}
+/**
+ * Basis is `METHOD\nPATH\nTIMESTAMP\nBODY\nSECRET` (LF-joined, NOT JSON).
+ * Output is lowercase hex SHA-256.
+ *
+ * Uses `js-sha256` (pure JS, synchronous, browser + Node) instead of
+ * `node:crypto` so this module stays importable from the webview (the
+ * shared barrel is consumed by browser bundles — `node:crypto` breaks
+ * the vite/rollup build).
+ */
+declare function createDeviceRequestSignature(params: DeviceRequestSignatureParams): string;
+
 /**
  * Git URL Utilities
  *
@@ -1299,6 +1360,52 @@ interface BridgeRepoSyncPull {
     error?: string;
 }
 
+/**
+ * Webview ↔ extension message-contract types.
+ *
+ * These three payload shapes travel across the postMessage boundary
+ * (broadcast messages like `updateExternalTools` / `updateAzureProfiles`
+ * / `updateApiConfig`). They used to live in
+ * `apps/webview-ui/src/types` only — the extension-side handlers typed
+ * them implicitly via `data` destructuring, so the contract was
+ * duplicated by convention and drifted silently. Moving them here makes
+ * `@serviceme/devtools-shared` the single source of truth, and lets the
+ * `WebviewInboundMessage` discriminated union (messages.ts) type the
+ * corresponding broadcast variants without a `as` cast at the consumer.
+ *
+ * NOTE: `apps/webview-ui/src/types/index.ts` re-exports these so
+ * existing webview imports keep working unchanged.
+ */
+interface ExternalTool {
+    id: string;
+    name: string;
+    url: string;
+    description?: string;
+    icon?: string;
+    isDefault?: boolean;
+}
+interface AzureProfile {
+    id: string;
+    name: string;
+    method: "FTP" | "MSDeploy";
+    host: string;
+    username?: string;
+    password?: string;
+    remotePath?: string;
+    port?: number;
+}
+interface ApiConfig {
+    schemaPath: string;
+    requestLibPath?: string;
+    projectName?: string;
+    namespace?: string;
+    serversPath?: string;
+    apiPrefix?: string;
+    mock?: boolean;
+    templatesFolder?: string;
+    enumStyle?: "string-literal" | "enum";
+}
+
 declare enum WebviewMessageType {
     WebviewReady = "webviewReady",
     Ready = "ready",
@@ -1645,18 +1752,15 @@ interface ByomProviderToggles {
     cacheEnabled: boolean;
 }
 /**
- * Strict-typed shape for the inbound messages currently handled by
- * `useAppMessages`. Stage 1 deliberately covers ONLY the variants whose
- * payload types already live in `@serviceme/devtools-shared`
- * (re-exported from the package index via `types/protocol-contracts` as
- * `BridgeRepoEntry` / `BridgeSkillRepoEntry`) or here as named types
- * (`LinkedSkillPayloadEntry`). The variants whose payload types live in
- * `apps/webview-ui/src/types` (ExternalTool, AzureProfile, ApiConfig) stay
- * on the enum path for now — moving those types into `@serviceme/devtools-shared` is
- * its own refactor and not in scope.
+ * Strict-typed shape for the inbound messages handled by
+ * `useAppMessages`. Covers the 8 variants whose payload types now live
+ * in `@serviceme/devtools-shared` (`webview-contract.ts` holds the
+ * ExternalTool / AzureProfile / ApiConfig shapes). The string-keyed
+ * `WebviewMessageType` enum stays in place for the remaining enum-path
+ * call sites across `apps/webview-ui` and `apps/extension`.
  *
  * Each variant lists ONLY the fields the hook actually reads; optional
- * fields are explicit (`workspaceOpen` on `UpdateSkillRepoCatalog`).
+ * fields are explicit (`tools?` / `profiles?` / `workspaceOpen`).
  */
 type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateRepositoryList;
@@ -1672,6 +1776,18 @@ type WebviewInboundMessage = {
     type: typeof WebviewMessageType.UpdateLinkedSkills;
     links: LinkedSkillPayloadEntry[];
     kind: "skill" | "agent";
+} | {
+    type: typeof WebviewMessageType.UpdateExternalTools;
+    tools?: ExternalTool[];
+} | {
+    type: typeof WebviewMessageType.UpdateNgrokStatus;
+    isRunning: boolean;
+} | {
+    type: typeof WebviewMessageType.UpdateAzureProfiles;
+    profiles?: AzureProfile[];
+} | {
+    type: typeof WebviewMessageType.UpdateApiConfig;
+    config: ApiConfig;
 };
 /**
  * One entry inside the `UpdateLinkedSkills.links` array. Mirrors the
@@ -1744,4 +1860,4 @@ declare function asAbortSignal(input: unknown): AbortSignal | undefined;
  */
 declare function safeJson<T>(text: string, fallback: T): T;
 
-export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };
+export { type AIModelConfig, type AIModelInfo, type AgentPermissionSummary, type AgentToolPermission, type AgentToolRiskLevel, type ApiConfig, type AzureProfile, BUILTIN_PROVIDER_PRESETS, type BalanceEntry, type BridgeLinkMode, type BridgeLinkedSkill, type BridgeRepoEntry, type BridgeRepoSyncPull, type BridgeSkillKind, type BridgeSkillRepoEntry, type BridgeSkillRepoFile, type ByomProviderToggles, ByomSettingsResponse, type ByomSettingsSnapshot, type ByomTogglePayload, CERTIFICATE_BUNDLE_FORMATS, CachedServerUrlResponse, type CachedServerUrlSnapshot, type CertificateBundleEnvironmentSupport, type CertificateBundleFormat, type CertificateBundleFormatDescriptor, type CodingPlanUsage, type CommandPayload, type CuratedModelMetadata, type DeepseekBalanceEntry, type DeepseekUsage, DeviceAuthHeaders, type DeviceRequestSignatureParams, type DownloadCertificateBundleRequest, type DownloadCertificateBundleResponse, type ExternalTool, GIT_REMOTE_HOST_ALIASES, type GenericBalanceUsage, GetByomSettings, GetCachedServerUrl, GetServerProxyState, GetUtilityModels, type GitHubOrgMembershipCheckResult, type GitHubOrgMembershipStatus, type GitHubUser, type GithubCopilotCliPayload, type HttpRequestPayload, type ILogger, LISTABLE_PRESET_MODELS, type LinkedSkillPayloadEntry, LogLevel, MEDALSOFT_NUGET_PRIVATE_SOURCE, MEDALSOFT_PRIVATE_GATEWAY_URL, MODEL_METADATA, type MinimaxUsage, type ModelDetail, type ModelPriceCategory, type ModelPricing, type ModelThinkingSchema, NAMESPACE_ALIASES, NAMESPACE_ALIAS_FAMILY, PRESET_MODEL_FAMILIES, PROVIDER_BASE_URL_PRESETS, PROVIDER_CACHE_CONTROL_METADATA, type PresetModelFamilyGroup, type PresetModelListing, type ProviderBaseUrlPreset, type ProviderCacheControlMetadata, type ProviderConfig, type ProviderModel, type ProviderMutationPayload, type ProviderTestResult, type ProviderType, type ProviderUsageData, type ProviderUsageKind, type ProviderUsageResult, type ProviderVisionMode, type ProviderWireProtocol, type ProvidersResponsePayload, type PublicProvider, type ScheduledTask, type ScheduledTaskType, type ScheduledTaskV1, type ScheduledTasksConfig, type ScheduledTasksLogFile, type ServerProxyAllowOverridePayload, type ServerProxySnapshot, ServerProxyStateResponse, type ServerProxySupportMode, type ServerProxyTogglePayload, SetCacheControlEnabled, SetServerProxyAllowOverride, SetServerProxyEnabled, type ShellPayload, type TaskExecutionLog, type TaskExecutionState, type TaskExecutionStatus, type TaskPayload, type TaskRunStatus, type TaskWorkspaceRef, UpdateUtilityModels, type UpdateUtilityModelsPayload, type UsageWindow, type UtilityModelScope, type UtilityModelsEffective, UtilityModelsResponse, type UtilityModelsSnapshot, type UtilityModelsSource, type WebviewInboundMessage, WebviewMessageType, __internal, asAbortSignal, buildGitHubLocalEmail, buildPresetModel, checkGitHubOrgMembership, createConsoleLogger, createDeviceRequestSignature, currencyForBaseUrl, effectiveAdapterType, fetchGitHubUser, getBuiltinProviderPreset, getGitHubOrgMembership, getPresetModelDisplayName, getProviderBaseUrlPresets, isGitHubLocalEmail, isProviderCacheControlAware, isValidCanonicalSlug, listPresetModelGroups, lookupModelMetadata, normalizeCanonicalSlug, normalizeErrorForLog, normalizeGitUrl, parsePayload, protocolForBaseUrl, resolvePrimaryEmail, safeJson, unionProviderModelWithPreset };

package/dist/index.js

@@ -24,6 +24,7 @@ __export(index_exports, {
   ByomSettingsResponse: () => ByomSettingsResponse,
   CERTIFICATE_BUNDLE_FORMATS: () => CERTIFICATE_BUNDLE_FORMATS,
   CachedServerUrlResponse: () => CachedServerUrlResponse,
+  DeviceAuthHeaders: () => DeviceAuthHeaders,
   GIT_REMOTE_HOST_ALIASES: () => GIT_REMOTE_HOST_ALIASES,
   GetByomSettings: () => GetByomSettings,
   GetCachedServerUrl: () => GetCachedServerUrl,
@@ -31,6 +32,8 @@ __export(index_exports, {
   GetUtilityModels: () => GetUtilityModels,
   LISTABLE_PRESET_MODELS: () => LISTABLE_PRESET_MODELS,
   LogLevel: () => LogLevel,
+  MEDALSOFT_NUGET_PRIVATE_SOURCE: () => MEDALSOFT_NUGET_PRIVATE_SOURCE,
+  MEDALSOFT_PRIVATE_GATEWAY_URL: () => MEDALSOFT_PRIVATE_GATEWAY_URL,
   MODEL_METADATA: () => MODEL_METADATA,
   NAMESPACE_ALIASES: () => NAMESPACE_ALIASES,
   NAMESPACE_ALIAS_FAMILY: () => NAMESPACE_ALIAS_FAMILY,
@@ -50,6 +53,7 @@ __export(index_exports, {
   buildPresetModel: () => buildPresetModel,
   checkGitHubOrgMembership: () => checkGitHubOrgMembership,
   createConsoleLogger: () => createConsoleLogger,
+  createDeviceRequestSignature: () => createDeviceRequestSignature,
   currencyForBaseUrl: () => currencyForBaseUrl,
   effectiveAdapterType: () => effectiveAdapterType,
   fetchGitHubUser: () => fetchGitHubUser,
@@ -89,6 +93,10 @@ function effectiveAdapterType(configuredType, baseUrl) {
   return configuredType;
 }
 
+// src/constants.ts
+var MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+var MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
 // src/ai/providers.base-url.ts
 var PROVIDER_BASE_URL_PRESETS = {
   "openai-compatible": [],
@@ -170,7 +178,11 @@ var PROVIDER_BASE_URL_PRESETS = {
     { label: "\u5168\u7403", baseUrl: "https://apihub.agnes-ai.com/v1" }
   ],
   // Medalsoft internal LLM gateway — single OpenAI-compatible endpoint.
-  medalsoft: [{ label: "\u5185\u90E8\u7F51\u5173", baseUrl: "https://nexus.servicemecloud.com/v1" }],
+  // 内网地址见 `constants.ts`（仅办公网可达）；外网走 nexus。
+  medalsoft: [
+    { label: "\u5185\u7F51", baseUrl: MEDALSOFT_PRIVATE_GATEWAY_URL },
+    { label: "\u5916\u7F51", baseUrl: "https://nexus.servicemecloud.com/v1" }
+  ],
   "vscode-builtin": []
 };
 function getProviderBaseUrlPresets(type) {
@@ -1607,6 +1619,133 @@ var CERTIFICATE_BUNDLE_FORMATS = [
   }
 ];
 
+// ../../node_modules/.pnpm/js-sha256@1.0.0/node_modules/js-sha256/src/node.mjs
+var import_crypto = require("crypto");
+
+// ../../node_modules/.pnpm/js-sha256@1.0.0/node_modules/js-sha256/src/shared.mjs
+var INPUT_ERROR = "input is invalid type";
+var FINALIZE_ERROR = "finalize already called";
+var ARRAY_BUFFER = typeof ArrayBuffer !== "undefined";
+var formatMessage = function(message) {
+  var type = typeof message;
+  if (type === "string") {
+    return [message, true];
+  }
+  if (Array.isArray(message)) {
+    return [message, false];
+  }
+  if (ARRAY_BUFFER && message) {
+    if (message.constructor === ArrayBuffer) {
+      return [new Uint8Array(message), false];
+    } else if (ArrayBuffer.isView(message)) {
+      return [message, false];
+    }
+  }
+  throw new Error(INPUT_ERROR);
+};
+
+// ../../node_modules/.pnpm/js-sha256@1.0.0/node_modules/js-sha256/src/node.mjs
+function toNodeInput(message) {
+  const [msg, isString] = formatMessage(message);
+  return isString ? Buffer.from(msg, "utf8") : Buffer.from(msg);
+}
+var NodeHasher = class {
+  constructor(hash) {
+    this.hash = hash;
+    this.result = void 0;
+  }
+  update(message) {
+    if (this.result) {
+      throw new Error(FINALIZE_ERROR);
+    }
+    this.hash.update(toNodeInput(message));
+    return this;
+  }
+  finalize() {
+    if (!this.result) {
+      this.result = this.hash.digest();
+      this.hash = void 0;
+    }
+  }
+  hex() {
+    this.finalize();
+    return this.result.toString("hex");
+  }
+  toString() {
+    return this.hex();
+  }
+  array() {
+    this.finalize();
+    return Array.from(this.result);
+  }
+  digest() {
+    return this.array();
+  }
+  arrayBuffer() {
+    return Uint8Array.from(this.array()).buffer;
+  }
+};
+function addOutputMethods(method, createHasher) {
+  method.hex = method;
+  method.array = function(...args) {
+    return createHasher(...args.slice(0, -1)).update(args[args.length - 1]).array();
+  };
+  method.digest = method.array;
+  method.arrayBuffer = function(...args) {
+    return createHasher(...args.slice(0, -1)).update(args[args.length - 1]).arrayBuffer();
+  };
+  return method;
+}
+function createNodeMethod(algorithm) {
+  const createHasher = () => new NodeHasher((0, import_crypto.createHash)(algorithm));
+  const method = function(message) {
+    return createHasher().update(message).hex();
+  };
+  addOutputMethods(method, createHasher);
+  method.create = createHasher;
+  method.update = function(message) {
+    return method.create().update(message);
+  };
+  return method;
+}
+function createNodeHmacMethod(algorithm) {
+  const createHasher = (key) => new NodeHasher((0, import_crypto.createHmac)(algorithm, toNodeInput(key)));
+  const method = function(key, message) {
+    return createHasher(key).update(message).hex();
+  };
+  addOutputMethods(method, createHasher);
+  method.create = createHasher;
+  method.update = function(key, message) {
+    return method.create(key).update(message);
+  };
+  return method;
+}
+var sha256 = createNodeMethod("sha256");
+var sha224 = createNodeMethod("sha224");
+sha256.sha256 = sha256;
+sha256.sha224 = sha224;
+sha256.hmac = createNodeHmacMethod("sha256");
+sha224.hmac = createNodeHmacMethod("sha224");
+
+// src/device-auth.ts
+var DeviceAuthHeaders = {
+  deviceId: "x-ms-device-id",
+  deviceSecret: "x-ms-device-secret",
+  signature: "x-ms-device-signature",
+  timestamp: "x-ms-device-timestamp",
+  secretVersion: "x-ms-device-secret-version"
+};
+function createDeviceRequestSignature(params) {
+  const basis = [
+    params.method.toUpperCase(),
+    params.path,
+    String(params.timestamp),
+    params.body,
+    params.secret
+  ].join("\n");
+  return sha256(basis);
+}
+
 // src/git-utils.ts
 var GIT_REMOTE_HOST_ALIASES = {
   "github-msc": "github.com"
@@ -2076,6 +2215,7 @@ function safeJson(text, fallback) {
   ByomSettingsResponse,
   CERTIFICATE_BUNDLE_FORMATS,
   CachedServerUrlResponse,
+  DeviceAuthHeaders,
   GIT_REMOTE_HOST_ALIASES,
   GetByomSettings,
   GetCachedServerUrl,
@@ -2083,6 +2223,8 @@ function safeJson(text, fallback) {
   GetUtilityModels,
   LISTABLE_PRESET_MODELS,
   LogLevel,
+  MEDALSOFT_NUGET_PRIVATE_SOURCE,
+  MEDALSOFT_PRIVATE_GATEWAY_URL,
   MODEL_METADATA,
   NAMESPACE_ALIASES,
   NAMESPACE_ALIAS_FAMILY,
@@ -2102,6 +2244,7 @@ function safeJson(text, fallback) {
   buildPresetModel,
   checkGitHubOrgMembership,
   createConsoleLogger,
+  createDeviceRequestSignature,
   currencyForBaseUrl,
   effectiveAdapterType,
   fetchGitHubUser,

package/dist/index.mjs

@@ -14,6 +14,10 @@ function effectiveAdapterType(configuredType, baseUrl) {
   return configuredType;
 }
 
+// src/constants.ts
+var MEDALSOFT_PRIVATE_GATEWAY_URL = "http://10.10.10.249:3000/v1";
+var MEDALSOFT_NUGET_PRIVATE_SOURCE = "http://192.168.20.209:10010/nuget";
+
 // src/ai/providers.base-url.ts
 var PROVIDER_BASE_URL_PRESETS = {
   "openai-compatible": [],
@@ -95,7 +99,11 @@ var PROVIDER_BASE_URL_PRESETS = {
     { label: "\u5168\u7403", baseUrl: "https://apihub.agnes-ai.com/v1" }
   ],
   // Medalsoft internal LLM gateway — single OpenAI-compatible endpoint.
-  medalsoft: [{ label: "\u5185\u90E8\u7F51\u5173", baseUrl: "https://nexus.servicemecloud.com/v1" }],
+  // 内网地址见 `constants.ts`（仅办公网可达）；外网走 nexus。
+  medalsoft: [
+    { label: "\u5185\u7F51", baseUrl: MEDALSOFT_PRIVATE_GATEWAY_URL },
+    { label: "\u5916\u7F51", baseUrl: "https://nexus.servicemecloud.com/v1" }
+  ],
   "vscode-builtin": []
 };
 function getProviderBaseUrlPresets(type) {
@@ -1532,6 +1540,133 @@ var CERTIFICATE_BUNDLE_FORMATS = [
   }
 ];
 
+// ../../node_modules/.pnpm/js-sha256@1.0.0/node_modules/js-sha256/src/node.mjs
+import { createHash, createHmac } from "crypto";
+
+// ../../node_modules/.pnpm/js-sha256@1.0.0/node_modules/js-sha256/src/shared.mjs
+var INPUT_ERROR = "input is invalid type";
+var FINALIZE_ERROR = "finalize already called";
+var ARRAY_BUFFER = typeof ArrayBuffer !== "undefined";
+var formatMessage = function(message) {
+  var type = typeof message;
+  if (type === "string") {
+    return [message, true];
+  }
+  if (Array.isArray(message)) {
+    return [message, false];
+  }
+  if (ARRAY_BUFFER && message) {
+    if (message.constructor === ArrayBuffer) {
+      return [new Uint8Array(message), false];
+    } else if (ArrayBuffer.isView(message)) {
+      return [message, false];
+    }
+  }
+  throw new Error(INPUT_ERROR);
+};
+
+// ../../node_modules/.pnpm/js-sha256@1.0.0/node_modules/js-sha256/src/node.mjs
+function toNodeInput(message) {
+  const [msg, isString] = formatMessage(message);
+  return isString ? Buffer.from(msg, "utf8") : Buffer.from(msg);
+}
+var NodeHasher = class {
+  constructor(hash) {
+    this.hash = hash;
+    this.result = void 0;
+  }
+  update(message) {
+    if (this.result) {
+      throw new Error(FINALIZE_ERROR);
+    }
+    this.hash.update(toNodeInput(message));
+    return this;
+  }
+  finalize() {
+    if (!this.result) {
+      this.result = this.hash.digest();
+      this.hash = void 0;
+    }
+  }
+  hex() {
+    this.finalize();
+    return this.result.toString("hex");
+  }
+  toString() {
+    return this.hex();
+  }
+  array() {
+    this.finalize();
+    return Array.from(this.result);
+  }
+  digest() {
+    return this.array();
+  }
+  arrayBuffer() {
+    return Uint8Array.from(this.array()).buffer;
+  }
+};
+function addOutputMethods(method, createHasher) {
+  method.hex = method;
+  method.array = function(...args) {
+    return createHasher(...args.slice(0, -1)).update(args[args.length - 1]).array();
+  };
+  method.digest = method.array;
+  method.arrayBuffer = function(...args) {
+    return createHasher(...args.slice(0, -1)).update(args[args.length - 1]).arrayBuffer();
+  };
+  return method;
+}
+function createNodeMethod(algorithm) {
+  const createHasher = () => new NodeHasher(createHash(algorithm));
+  const method = function(message) {
+    return createHasher().update(message).hex();
+  };
+  addOutputMethods(method, createHasher);
+  method.create = createHasher;
+  method.update = function(message) {
+    return method.create().update(message);
+  };
+  return method;
+}
+function createNodeHmacMethod(algorithm) {
+  const createHasher = (key) => new NodeHasher(createHmac(algorithm, toNodeInput(key)));
+  const method = function(key, message) {
+    return createHasher(key).update(message).hex();
+  };
+  addOutputMethods(method, createHasher);
+  method.create = createHasher;
+  method.update = function(key, message) {
+    return method.create(key).update(message);
+  };
+  return method;
+}
+var sha256 = createNodeMethod("sha256");
+var sha224 = createNodeMethod("sha224");
+sha256.sha256 = sha256;
+sha256.sha224 = sha224;
+sha256.hmac = createNodeHmacMethod("sha256");
+sha224.hmac = createNodeHmacMethod("sha224");
+
+// src/device-auth.ts
+var DeviceAuthHeaders = {
+  deviceId: "x-ms-device-id",
+  deviceSecret: "x-ms-device-secret",
+  signature: "x-ms-device-signature",
+  timestamp: "x-ms-device-timestamp",
+  secretVersion: "x-ms-device-secret-version"
+};
+function createDeviceRequestSignature(params) {
+  const basis = [
+    params.method.toUpperCase(),
+    params.path,
+    String(params.timestamp),
+    params.body,
+    params.secret
+  ].join("\n");
+  return sha256(basis);
+}
+
 // src/git-utils.ts
 var GIT_REMOTE_HOST_ALIASES = {
   "github-msc": "github.com"
@@ -2000,6 +2135,7 @@ export {
   ByomSettingsResponse,
   CERTIFICATE_BUNDLE_FORMATS,
   CachedServerUrlResponse,
+  DeviceAuthHeaders,
   GIT_REMOTE_HOST_ALIASES,
   GetByomSettings,
   GetCachedServerUrl,
@@ -2007,6 +2143,8 @@ export {
   GetUtilityModels,
   LISTABLE_PRESET_MODELS,
   LogLevel,
+  MEDALSOFT_NUGET_PRIVATE_SOURCE,
+  MEDALSOFT_PRIVATE_GATEWAY_URL,
   MODEL_METADATA,
   NAMESPACE_ALIASES,
   NAMESPACE_ALIAS_FAMILY,
@@ -2026,6 +2164,7 @@ export {
   buildPresetModel,
   checkGitHubOrgMembership,
   createConsoleLogger,
+  createDeviceRequestSignature,
   currencyForBaseUrl,
   effectiveAdapterType,
   fetchGitHubUser,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serviceme/devtools-shared",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "Shared webview↔extension message contracts and cross-package data models used by SERVICEME.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {
@@ -37,14 +37,17 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
+  "dependencies": {
+    "js-sha256": "^1.0.0"
+  },
   "scripts": {
     "watch": "tsup src/index.ts --format cjs,esm --dts --watch",
     "build": "tsup src/index.ts --format cjs,esm --dts",
     "lint": "biome check src test",
     "format": "biome check --write src test",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm run build && node --test test/*.test.mjs",
-    "release:check": "pnpm run test && npm pack --dry-run",
+    "test": "pnpm run build && node scripts/check-bundle-deps.mjs && node --test test/*.test.mjs",
+    "release:check": "pnpm run test && node scripts/check-bundle-deps.mjs && npm pack --dry-run",
     "pack": "npm pack",
     "publish:npm": "pnpm publish --access public --no-git-checks"
   }