@vibedev-si/dsh-vibedev 0.2.7 → 0.3.0

package/README.md

@@ -6,7 +6,7 @@
 - **媒体生成**：Agent 可以生成图片、视频、音乐和播客，并把语音转成文字，结果保存在工作区的 `media/` 目录下；
 - **网页搜索**：提供走 VibeDev 网关的网页搜索，见下面的「网页搜索」。
 
-费用都从你的 VibeDev 余额里扣，DeepSeek 账号照常由 DeepSeek Harness 自己管理，两边互不影响。还没有 VibeDev 账号的话，可以在 [vibedev.jzsaas.com](https://vibedev.jzsaas.com) 注册。
+费用都从你的 VibeDev 余额里扣，DeepSeek 账号照常由 DeepSeek Harness 自己管理，两边互不影响。还没有 VibeDev 账号的话，可以在 [VibeDev](https://api.vibedev.studio) 注册。
 
 本插件由 `dsh-media` 改名而来，见下面的「从 dsh-media 升级」。
 
@@ -43,6 +43,12 @@
 
 ## VibeDev 的模型
 
+正式默认 API 为 `https://api.vibedev.studio`。从旧版升级后须重新登录，才会获取本站模型；登录仍使用 S256 PKCE、state、随机 localhost 回调和 app token，不使用共享 HMAC secret。充值、注册、用量链接跟随所选 API origin，网页搜索也使用该 API 的 `/v1/vibedev/web-search`。
+
+所有网关的凭据键、设备记录和媒体任务目录均按规范化 gateway origin 隔离，只接受带匹配 origin 标记的登录记录。原 `dsh-media/vibedev-session` 和未标注的数据目录保留在本地，但不再读取、导入或自动恢复、重新提交其中的旧视频、音频与上传状态。DeepSeek 等其它账号、聊天、工作区及历史媒体 URL 不改写；已有美国 origin 登录记录可继续使用。
+
+媒体创建、完成、刷新请求走所选 API；上传和下载使用服务器返回的完整签名 URL，保留 host、path、query，不携带 VibeDev app token。返回签名链接时下载不再先探测旧 `/content` 接口；未返回链接的旧接口仍可直接返回文件。API 和下载请求拒绝重定向，不把失败或503当作跨区域重发理由。现有同站同键重试、SSE、心跳和取消语义保留。默认不读取开发密钥，旧 `VIBEDEV_GATEWAY_API_KEY` 变量不再使用；开发调试需显式指定本站专用环境变量。本地验证版不解除服务器503挡板，不发送真实模型或付费媒体测试。
+
 - 模型列表来自 VibeDev 网关，按你的账号下发，所以**未登录时不显示**，登录后立即出现，不用重启。
 - 模型在选择器里的「VibeDev」组；默认模型仍是 DeepSeek Harness 原来的，想用 VibeDev 的模型就在选择器里选。
 - 没登录就用了 VibeDev 的模型，或登录已失效时，对话里会提示到侧边栏或设置里登录；余额不足时会提示并给出充值链接。这些提示和 DeepSeek 账号的登录、充值提示是分开的。
@@ -126,12 +132,14 @@ npm run build
 
 ## English
 
+**American API default**: production defaults to `https://api.vibedev.studio`. Upgrades from unscoped historical state require a new app-token login before listing models. Every origin has separate credentials, devices and durable media tasks; grants must carry a matching origin. Historical unmarked files and the old credential record stay intact but are never read, imported, resumed or resubmitted. Existing American-origin grants remain usable. Other accounts, chats, workspaces and historical media URLs are unchanged. API control requests, account web links and web search follow the selected origin; uploads/downloads preserve the server's complete signed URL without an app token. Redirects and cross-region fallback are refused. S256 PKCE, state, random localhost callback, SSE, heartbeats, cancellation and same-origin idempotency remain. Developer-key fallback is disabled by default and the old shared environment variable is ignored; development requires an explicitly named gateway-specific variable. Local verification neither removes the server's 503 gate nor sends real model or paid media tests.
+
 Sign in to VibeDev in DeepSeek Harness, next to the DeepSeek account:
 
 - **VibeDev models**: once signed in, the model picker gains a "VibeDev" group (Claude, GPT and the other models of the VibeDev gateway) next to DeepSeek's;
 - **Media generation**: the agent generates images, videos, music and podcasts and transcribes speech; results are saved in the workspace under `media/`.
 
-Everything is paid from your VibeDev balance; the DeepSeek account stays DeepSeek Harness's own, and the two do not affect each other. To create an account, register at [vibedev.jzsaas.com](https://vibedev.jzsaas.com). This plugin was renamed from `dsh-media`.
+Everything is paid from your VibeDev balance; the DeepSeek account stays DeepSeek Harness's own, and the two do not affect each other. To create an account, register at [VibeDev](https://api.vibedev.studio). This plugin was renamed from `dsh-media`.
 
 **Install**: install `@vibedev-si/dsh-vibedev` by package name on the Plugins page (the `@vibedev-si/` scope is required), or from the [VibeDev Plugin Center](https://github.com/VibeDev-Si/dsh-ecosystem); from the command line, `dsh plugin add @vibedev-si/dsh-vibedev`, or `dsh plugin --profile desktop add @vibedev-si/dsh-vibedev` for the desktop app (quit it fully first). The VibeDev app ships with the plugin built in, and there the VibeDev account is the main account (the bottom row of the sidebar and the first Settings section), with the DeepSeek account as the second one. Within 24 hours of a release, name the version (e.g. `@vibedev-si/dsh-vibedev@0.2.5`): pnpm does not install versions younger than a day by default.
 
@@ -159,6 +167,12 @@ Everything is paid from your VibeDev balance; the DeepSeek account stays DeepSee
 
 **Third-party code**: the model route in `src/llm/` is ported from the VibeDev app; `context.ts`, `replay.ts` and `stream.ts` are copied from DeepSeek Harness's `@deepseek-ai/dsh-llm-pi-ai` (MIT). The licences of the bundled pi-ai, Anthropic SDK, OpenAI SDK and their dependencies are in `THIRD-PARTY-NOTICES.txt`.
 
+## Login diagnostics (0.2.8-us.3) · 登录诊断
+
+登录状态区分等待浏览器、交换登录凭据、保存凭据与成功、失败、取消、过期；设置页面和新版 VibeDev Next 欢迎页显示网络、超时、授权拒绝、服务不可用、响应异常、本地存储或回调错误。折叠的诊断信息及 Host 日志只记录尝试编号、阶段、目标 origin、HTTP 状态和受控网络错误码，不记录账号密码、授权码、PKCE verifier、token、响应正文或完整回调链接。保持 PKCE、state 与随机 localhost 回调；交换失败不会自动重发或切换网关。美国网页公开配置仍需服务维护方单独核对。
+
+Login distinguishes waiting for the browser, exchanging credentials, saving credentials, and successful, failed, cancelled or expired outcomes. Settings and the updated VibeDev Next welcome page show classified failures. Collapsible support details and Host logs contain only the attempt reference, phase, origin, HTTP status and allowlisted network codes. Passwords, authorization codes, PKCE verifiers, tokens, response bodies and full callback URLs are excluded. PKCE, state and the random localhost callback remain; a failed exchange is never automatically repeated or sent to another gateway. The gateway operator must separately verify the American web page's public configuration.
+
 ## Maintainer releases
 
 Build, typecheck and test locally, pack the tested archive, tag the matching source version, and publish a GitHub Release with `vibedev-si-dsh-vibedev-<version>.tgz` attached. `.github/workflows/publish.yml` publishes that exact archive with npm OIDC; it does not rebuild the package. The job checks the source/tag/archive identities and Release asset digest, refuses an existing version with different bytes, and skips an identical already-published version. It verifies the complete npm tarball after publication. For a manual retry of an unpublished version, run the workflow on the version's tag ref.

package/THIRD-PARTY-NOTICES.txt

@@ -1,4 +1,4 @@
-THIRD-PARTY NOTICES · @vibedev-si/dsh-vibedev 0.2.7
+THIRD-PARTY NOTICES · @vibedev-si/dsh-vibedev 0.3.0
 
 This package bundles code from the projects below. Each is used under the licence that
 follows its name; the licence texts are reproduced as the projects ship them.

package/client/client.js

@@ -131,10 +131,10 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 					const body = await response.json().catch(() => void 0);
 					if (!response.ok || typeof body?.url !== "string") throw new Error(typeof body?.error?.message === "string" ? body.error.message : `HTTP ${response.status}`);
 					if (body.opened !== true) this.options.openWindow?.(body.url);
-				} catch (error) {
+				} catch {
 					this.set({ actionError: {
 						kind: "sign-in",
-						message: error instanceof Error ? error.message : String(error)
+						message: "Sign-in request failed."
 					} });
 				} finally {
 					this.set({ busy: void 0 });
@@ -179,6 +179,71 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 			}
 		};
 		//#endregion
+		//#region src/client/sign-in-presentation.ts
+		/** @param attempt - latest safe Host snapshot. @returns a locale key for a terminal login failure. */
+		function failureKey(attempt) {
+			if (attempt?.phase === "expired") return "signInExpired";
+			if (attempt?.phase !== "failed") return void 0;
+			const keys = {
+				network: "signInNetwork",
+				timeout: "signInTimeout",
+				"gateway-refused": "signInRefused",
+				"gateway-unavailable": "signInUnavailable",
+				protocol: "signInProtocol",
+				storage: "signInStorage",
+				callback: "signInCallback"
+			};
+			return attempt.errorCode !== void 0 && Object.hasOwn(keys, attempt.errorCode) ? keys[attempt.errorCode] : "signInUnknown";
+		}
+		/** @param attempt - latest snapshot. @returns support reference without query, body, credentials or raw error. */
+		function safeSupportDetails(attempt) {
+			if (attempt === void 0) return void 0;
+			const id = /^[a-zA-Z0-9_-]{1,80}$/.test(attempt.id) ? attempt.id : void 0;
+			let origin;
+			try {
+				const url = new URL(attempt.gatewayOrigin);
+				if (["https:", "http:"].includes(url.protocol) && !url.username && !url.password) origin = url.origin;
+			} catch {}
+			const stage = [
+				"listen",
+				"device",
+				"redeem",
+				"persist"
+			].includes(attempt.stage ?? "") ? attempt.stage : void 0;
+			return [
+				[
+					"network",
+					"timeout",
+					"gateway-refused",
+					"gateway-unavailable",
+					"protocol",
+					"storage",
+					"callback"
+				].includes(attempt.errorCode ?? "") ? attempt.errorCode : void 0,
+				stage,
+				Number.isInteger(attempt.httpStatus) && Number(attempt.httpStatus) >= 100 && Number(attempt.httpStatus) <= 599 ? `HTTP ${attempt.httpStatus}` : void 0,
+				[
+					"ECONNRESET",
+					"ECONNREFUSED",
+					"ETIMEDOUT",
+					"ENOTFOUND",
+					"EAI_AGAIN",
+					"ENETUNREACH",
+					"EHOSTUNREACH",
+					"UND_ERR_CONNECT_TIMEOUT",
+					"UND_ERR_HEADERS_TIMEOUT",
+					"UND_ERR_BODY_TIMEOUT",
+					"UND_ERR_SOCKET",
+					"CERT_HAS_EXPIRED",
+					"DEPTH_ZERO_SELF_SIGNED_CERT",
+					"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+					"ERR_TLS_CERT_ALTNAME_INVALID"
+				].includes(attempt.networkCode ?? "") ? attempt.networkCode : void 0,
+				origin,
+				id
+			].filter((value) => value !== void 0).join(" · ");
+		}
+		//#endregion
 		//#region src/client/locales.ts
 		/**
 		* Copy for the dsh-vibedev pages (the plugin's settings page, the VibeDev
@@ -239,6 +304,18 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 			signOut: "退出登录",
 			signOutFailed: "退出没有成功，请重试。",
 			signInFailed: "没能开始登录：{message}",
+			signInExchanging: "正在交换登录凭据…",
+			signInCommitting: "正在保存登录信息…",
+			signInExpired: "登录已超时，请重新登录。",
+			signInNetwork: "无法连接登录服务，请检查网络后重新登录。",
+			signInTimeout: "登录服务响应超时，请重新登录。",
+			signInRefused: "登录服务拒绝了本次授权，请重新发起登录。",
+			signInUnavailable: "登录服务暂时不可用，请稍后重试。",
+			signInProtocol: "登录服务返回内容异常，请将诊断信息提供给支持人员。",
+			signInStorage: "无法在本机保存登录信息，请检查应用数据目录的访问权限。",
+			signInCallback: "无法启动本地登录回调，请检查安全软件后重试。",
+			signInUnknown: "登录未完成，请重新登录。",
+			signInDiagnostic: "登录诊断信息",
 			loadFailed: "读取 VibeDev 账号状态失败，请稍后再试。",
 			sidebarSignedIn: "VibeDev 已登录",
 			sidebarSignedOut: "登录 VibeDev",
@@ -302,6 +379,18 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 			signOut: "Sign out",
 			signOutFailed: "Signing out did not work. Try again.",
 			signInFailed: "Could not start the sign-in: {message}",
+			signInExchanging: "Exchanging sign-in credentials…",
+			signInCommitting: "Saving sign-in credentials…",
+			signInExpired: "Sign-in expired. Please sign in again.",
+			signInNetwork: "Could not connect to the sign-in service. Check your network and try signing in again.",
+			signInTimeout: "The sign-in service did not respond in time. Please sign in again.",
+			signInRefused: "The sign-in service rejected this authorization. Please start a new sign-in.",
+			signInUnavailable: "The sign-in service is temporarily unavailable. Please try again later.",
+			signInProtocol: "The sign-in service returned an invalid response. Please share the diagnostic details with support.",
+			signInStorage: "Could not save the sign-in locally. Check access to the app data folder.",
+			signInCallback: "Could not start the local sign-in callback. Check local security software and try again.",
+			signInUnknown: "Could not complete sign-in. Please sign in again.",
+			signInDiagnostic: "Sign-in diagnostic details",
 			loadFailed: "The VibeDev account could not be read. Try again later.",
 			sidebarSignedIn: "VibeDev signed in",
 			sidebarSignedOut: "Sign in to VibeDev",
@@ -402,6 +491,7 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 		function statusDot(state) {
 			const view = state.view;
 			if (view === void 0) return "idle";
+			if (view.source === "none" && view.attempt?.phase === "failed") return "error";
 			if (view.pending !== void 0) return "ongoing";
 			return view.source === "none" ? "idle" : "done";
 		}
@@ -432,8 +522,8 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 			let actions = null;
 			if (view === void 0) status = state.loadFailed ? t("loadFailed") : t("loading");
 			else if (view.pending !== void 0) {
-				status = t("signingIn");
-				details = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+				status = view.attempt?.phase === "committing" ? t("signInCommitting") : view.attempt?.phase === "exchanging" ? t("signInExchanging") : t("signingIn");
+				details = /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_jsx_runtime.Fragment, { children: view.attempt === void 0 || view.attempt.phase === "waiting-browser" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 					style: styles$1.line,
 					children: t("pendingStatus")
 				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
@@ -443,10 +533,11 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 						store.openPending();
 					},
 					children: t("pendingLink")
-				})] });
+				})] }) : null });
 				actions = /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 					variant: "outline",
 					size: "sm",
+					disabled: view.attempt?.phase === "committing",
 					onClick: () => {
 						store.cancel();
 					},
@@ -529,7 +620,9 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 					}) : null
 				] });
 			}
-			const error = state.actionError === void 0 ? void 0 : state.actionError.kind === "sign-in" ? fill(t("signInFailed"), { message: state.actionError.message }) : t("signOutFailed");
+			const error = state.actionError === void 0 ? void 0 : state.actionError.kind === "sign-in" ? t("signInUnknown") : t("signOutFailed");
+			const loginFailure = view?.source === "none" ? failureKey(view.attempt) : void 0;
+			const supportDetails = loginFailure === void 0 ? void 0 : safeSupportDetails(view?.attempt);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: styles$1.page,
 				"data-dsh-vibedev-account": true,
@@ -562,6 +655,15 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 								style: styles$1.error,
 								role: "alert",
 								children: error
+							}),
+							loginFailure === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								style: styles$1.error,
+								role: "alert",
+								children: t(loginFailure)
+							}),
+							supportDetails === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("details", {
+								style: styles$1.quiet,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("summary", { children: t("signInDiagnostic") }), supportDetails]
 							})
 						]
 					})
@@ -636,8 +738,6 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 		* output folder, the pinned models, and how the account works. Edits are
 		* staged and written together by the save, like every settings page there.
 		*/
-		/** Where new users register and everyone tops up. */
-		const VIBEDEV_SITE = "https://vibedev.jzsaas.com";
 		const styles = {
 			section: {
 				padding: "12px 0",
@@ -714,11 +814,12 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 		}
 		/**
 		* Render the settings page.
-		* @param props - the dictionary, the form store and its actions.
+		* @param props - the dictionary, form store, actions and selected gateway account view.
 		* @returns the page.
 		*/
-		function MediaSettingsPage({ t, store, actions }) {
+		function MediaSettingsPage({ t, store, actions, account }) {
 			const state = (0, react.useSyncExternalStore)(store.subscribe, store.getSnapshot);
+			const site = (0, react.useSyncExternalStore)(account.subscribe, account.getSnapshot).view?.links.register;
 			if (state.status === "loading") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 				style: styles.quiet,
 				role: "status",
@@ -801,9 +902,9 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							style: styles.hint,
 							children: t("accountHint")
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+						}), site === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
 							style: styles.link,
-							href: VIBEDEV_SITE,
+							href: site,
 							target: "_blank",
 							rel: "noreferrer",
 							children: t("register")
@@ -960,15 +1061,16 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 				{
 					type: "label",
 					id: "pending",
-					text: t("pendingStatus")
+					text: view?.attempt?.phase === "committing" ? t("signInCommitting") : view?.attempt?.phase === "exchanging" ? t("signInExchanging") : t("pendingStatus")
 				},
-				{
+				...view?.attempt === void 0 || view.attempt.phase === "waiting-browser" ? [{
 					id: "open-pending",
 					label: t("pendingLink")
-				},
+				}] : [],
 				{
 					id: "cancel",
-					label: t("cancelSignIn")
+					label: t("cancelSignIn"),
+					disabled: view?.attempt?.phase === "committing"
 				},
 				{
 					type: "separator",
@@ -1136,15 +1238,16 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 				{
 					type: "label",
 					id: "pending",
-					text: t("pendingStatus")
+					text: view.attempt?.phase === "committing" ? t("signInCommitting") : view.attempt?.phase === "exchanging" ? t("signInExchanging") : t("pendingStatus")
 				},
-				{
+				...view.attempt === void 0 || view.attempt.phase === "waiting-browser" ? [{
 					id: "open-pending",
 					label: t("pendingLink")
-				},
+				}] : [],
 				{
 					id: "cancel",
-					label: t("cancelSignIn")
+					label: t("cancelSignIn"),
+					disabled: view.attempt?.phase === "committing"
 				}
 			] : [
 				{
@@ -1331,7 +1434,8 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 					}, (owner = {}) => owner.view === "summary" ? null : (0, react.createElement)(MediaSettingsPage, {
 						t,
 						store,
-						actions
+						actions,
+						account
 					})));
 					let section;
 					const placeSection = () => {
@@ -1345,7 +1449,8 @@ window.__ModuleLoader__.load({ id: "@vibedev-si/dsh-vibedev", factory: (require)
 						}, () => (0, react.createElement)(MediaSettingsPage, {
 							t,
 							store,
-							actions
+							actions,
+							account
 						}))));
 					};
 					const unsubscribe = account.subscribe(placeSection);

package/lib/account/index.d.ts

@@ -19,7 +19,7 @@
  */
 import type { ConnectionFetchRoute } from '@deepseek-ai/dsh-client-connection';
 import type { CredentialChain } from '../auth/credentials.js';
-import type { PluginLogin } from '../auth/login.js';
+import type { PluginLogin, SignInAttempt } from '../auth/login.js';
 /** Path prefix of the plugin's Host routes. */
 export declare const ACCOUNT_ROUTE_PREFIX = "/api/dsh-vibedev/account";
 /** Where the active credential comes from. */
@@ -43,6 +43,8 @@ export interface AccountView {
         readonly url: string;
         readonly expiresAt: number;
     };
+    /** Safe sign-in progress or the most recent terminal diagnostic. */
+    readonly attempt?: SignInAttempt;
     /** VibeDev chat models the pickers list now, and why there are none. */
     readonly models: {
         readonly count: number;

package/lib/auth/credentials.d.ts

@@ -36,13 +36,15 @@ export declare class CredentialChain {
      */
     reject(credential: GatewayCredential): Promise<void>;
 }
-export declare const GRANT_KEY: import("@deepseek-ai/dsh-credentials").CredentialKey;
+/** Credential identity for one gateway; never consult another gateway's record. */
+export declare function gatewayGrantKey(origin: string): import("@deepseek-ai/dsh-credentials").CredentialKey;
 /**
  * Grant storage: the host's credential store when one is loaded (a grant
  * record the store keeps verbatim), else a private file in the state
  * directory. The device id is not a secret and lives in the state directory.
- * @param stateDir - the plugin state directory.
+ * @param root - the plugin state root; the storage selects an origin-specific directory itself.
  * @param credentials - the host's credential store, when loaded.
+ * @param selectedOrigin - the issuing gateway; unmarked historical state is never adopted.
  * @returns the storage.
  */
-export declare function grantStorage(stateDir: string, credentials: () => CredentialProvider | undefined): GrantStorage;
+export declare function grantStorage(root: string, credentials: () => CredentialProvider | undefined, selectedOrigin?: string): GrantStorage;

package/lib/auth/login.d.ts

@@ -12,8 +12,12 @@
  * - `POST /api/v1/vibedev/app-token/revoke` (bearer or `{refresh_token}`): always 204
  * @module dsh-vibedev/auth/login
  */
+import type { SignInAttempt } from './sign-in-state.js';
+export type { SignInAttempt } from './sign-in-state.js';
 /** A stored plugin session. */
 export interface PluginGrant {
+    /** Origin that issued this stored app grant; legacy unmarked grants belong to the domestic gateway only. */
+    readonly gatewayOrigin?: string;
     readonly accessToken: string;
     readonly refreshToken: string;
     /** Epoch ms. */
@@ -57,7 +61,7 @@ export interface PluginLoginOptions {
     readonly now?: () => number;
     /** Open a URL in the system browser; resolves whether that was attempted successfully. */
     readonly openBrowser?: (url: string) => Promise<boolean>;
-    /** How long a started sign-in waits for the browser. Defaults to 5 minutes. */
+    /** Sign-in deadline through credential exchange, before the atomic write starts. Defaults to 5 minutes. */
     readonly signInTimeoutMs?: number;
     /** The client name the gateway records for the sign-in (it picks the key the usage is billed to). Defaults to `vibedev-plugin`. */
     readonly client?: string;
@@ -93,6 +97,7 @@ export declare class PluginLogin {
     private readFailureReported;
     private refreshing;
     private pending;
+    private attempt;
     private readonly listeners;
     private readonly now;
     private readonly origin;
@@ -106,6 +111,11 @@ export declare class PluginLogin {
     restore(): Promise<void>;
     /** Take a grant as current and tell listeners when it changed. */
     private adopt;
+    private notify;
+    /** A copied safe snapshot, retained after completion until the next sign-in. */
+    signInAttempt(): SignInAttempt | undefined;
+    private logAttempt;
+    private transition;
     private save;
     /**
      * Hear about sign-in and sign-out.
@@ -151,7 +161,7 @@ export declare class PluginLogin {
     }): Promise<PendingSignIn & {
         opened: boolean;
     }>;
-    private redeem;
+    private beginSignIn;
     /** Sign out: revoke the session at the gateway (best effort) and forget it. */
     signOut(): Promise<void>;
     /** Stop a waiting sign-in. */

package/lib/auth/sign-in-state.d.ts

@@ -0,0 +1,21 @@
+/** Safe host diagnostics: deliberately separate from authorization URLs and grants. */
+export interface SignInAttempt {
+    readonly id: string;
+    readonly phase: 'preparing' | 'waiting-browser' | 'exchanging' | 'committing' | 'succeeded' | 'failed' | 'cancelled' | 'expired';
+    readonly expiresAt: number;
+    readonly gatewayOrigin: string;
+    readonly stage?: 'listen' | 'device' | 'redeem' | 'persist';
+    readonly errorCode?: 'network' | 'timeout' | 'gateway-refused' | 'gateway-unavailable' | 'protocol' | 'storage' | 'callback';
+    readonly httpStatus?: number;
+    readonly networkCode?: string;
+}
+export declare const REDEEM_PATH = "/api/v1/vibedev/link/redeem";
+export type SignInFailure = Pick<SignInAttempt, 'errorCode' | 'httpStatus' | 'networkCode'>;
+/** Read only fixed transport codes, never error text, stack, body or arbitrary fields. */
+export declare function transportFailure(error: unknown): SignInFailure;
+/** A fixed bilingual explanation suitable for exposed rejection messages. */
+export declare function failureMessage(attempt: Pick<SignInAttempt, 'errorCode' | 'stage' | 'httpStatus'>): string;
+/** Only our fixed explanation and escaped safe enum/status fields reach the browser. */
+export declare function failurePage(attempt: SignInAttempt): string;
+/** Explicit log allowlist; adding fields to the public attempt never expands log output. */
+export declare function attemptLog(event: 'request' | 'phase' | 'response' | 'terminal', attempt: SignInAttempt): string;

package/lib/gateway/http.d.ts

@@ -21,7 +21,7 @@ export interface GatewayCredential {
 }
 /** Construction options; `fetch` and `sleep` are test seams. */
 export interface GatewayHttpOptions {
-    /** Gateway origin, such as `https://vibedev.jzsaas.com`. */
+    /** Gateway origin, such as `https://api.vibedev.studio`. */
     readonly origin: string;
     /** The credential for the next request; undefined while nobody is signed in. */
     readonly resolveCredential: () => Promise<GatewayCredential | undefined>;

package/lib/gateway/origin.d.ts

@@ -0,0 +1,10 @@
+/** Production API origin. Storage URLs are returned by the server, not derived from this address. */
+export declare const DEFAULT_GATEWAY_ORIGIN = "https://api.vibedev.studio";
+/** Validate a bare HTTP(S) origin and canonicalize default ports, casing and trailing slash. */
+export declare function normalizeGatewayOrigin(value: string): string;
+/** Stable, filesystem-safe identity; ports and schemes remain separate boundaries. */
+export declare function gatewayId(origin: string): string;
+/** Every gateway uses its own namespace; never read the unmarked historical root. */
+export declare function gatewayStateDirectory(root: string, origin: string): string;
+/** Ignore the old shared key variable; development requires an explicitly named, gateway-specific variable. */
+export declare function developmentKey(origin: string, name: string, env?: Readonly<Record<string, string | undefined>>): string | undefined;