dsh-coding-subscription-oauth 0.5.7 → 0.6.0

package/src/dsh-host-adapter.ts

@@ -0,0 +1,171 @@
+/** Narrow adapter around the DSH host API used by the standalone participant. */
+
+import { createRequire } from "node:module";
+import type { Context } from "@deepseek-ai/cordis";
+import {
+	CODING_OAUTH_CORE_ABI,
+	type DshHostCapability,
+	type OwnerAccessMode,
+	resolveCodingOAuthScope,
+} from "dsh-coding-oauth-core";
+import type {
+	CodingOAuthParticipantDiagnosticSource,
+	DshCompatibility,
+	DshCompatibilityDiagnostic,
+} from "./compatibility.ts";
+import { incompatibleDiagnostics } from "./compatibility.ts";
+import type { OwnerRequestPolicy } from "./web-origin.ts";
+
+const require = createRequire(import.meta.url);
+
+export interface DshHostAdapter extends CodingOAuthParticipantDiagnosticSource {
+	readonly context: Context;
+	scope(): object;
+	ownerRequestPolicy(): OwnerRequestPolicy | undefined;
+	compatibility(options?: {
+		readonly accessMode?: OwnerAccessMode;
+		readonly uiOwner?: "hub" | "standalone" | null;
+		readonly diagnostics?: readonly DshCompatibilityDiagnostic[];
+	}): DshCompatibility;
+	assertCompatible(): void;
+}
+
+interface CompatibilityOptions {
+	readonly accessMode?: OwnerAccessMode;
+	readonly uiOwner?: "hub" | "standalone" | null;
+	readonly diagnostics?: readonly DshCompatibilityDiagnostic[];
+}
+
+function record(value: unknown): Record<string, unknown> | undefined {
+	return value !== null && (typeof value === "object" || typeof value === "function")
+		? (value as Record<string, unknown>)
+		: undefined;
+}
+
+function service(context: Context, name: string): unknown {
+	try {
+		return context.get(name);
+	} catch {
+		return record(context)?.[name];
+	}
+}
+
+function capability(value: unknown, contract: string, methods: readonly string[]): DshHostCapability {
+	if (value === undefined || value === null) return { state: "missing", contract };
+	const candidate = record(value);
+	if (candidate === undefined || methods.some((method) => typeof candidate[method] !== "function")) {
+		return { state: "incompatible", contract, reason: "service shape does not match the verified contract" };
+	}
+	return { state: "available", contract };
+}
+
+function asOwnerRequestPolicy(value: unknown): OwnerRequestPolicy | undefined {
+	const candidate = record(value);
+	return candidate !== undefined &&
+		typeof candidate["authorize"] === "function" &&
+		typeof candidate["diagnostics"] === "function"
+		? (value as OwnerRequestPolicy)
+		: undefined;
+}
+
+function dshVersion(): string | null {
+	try {
+		const manifest = require("@deepseek-ai/dsh/package.json") as { version?: unknown };
+		return typeof manifest.version === "string" ? manifest.version : null;
+	} catch {
+		return null;
+	}
+}
+
+export function createDshHostAdapter(context: Context): DshHostAdapter {
+	const candidate = context as unknown as Record<string, unknown>;
+	const diagnostics: DshCompatibilityDiagnostic[] = [];
+	for (const method of ["effect", "inject", "get", "logger"] as const) {
+		if (typeof candidate[method] !== "function") {
+			diagnostics.push({
+				id: `host.api.${method}`,
+				component: "host",
+				level: "error",
+				message: `DSH host Context.${method} is unavailable`,
+				expected: "function",
+				actual: typeof candidate[method],
+			});
+		}
+	}
+	const llm = record(service(context, "llm")) ?? (candidate["llm"] as Record<string, unknown> | undefined);
+	if (llm === undefined || typeof llm["registerAdapter"] !== "function") {
+		diagnostics.push({
+			id: "host.api.llm.registerAdapter",
+			component: "host",
+			// OAuth account management and its same-origin routes stay usable while
+			// Cordis is waiting for the optional LLM registry. The LLM child fiber
+			// still treats this as a hard activation requirement before it registers
+			// adapters.
+			level: "warning",
+			message: "DSH host LLM adapter registry is unavailable",
+			expected: "function",
+			actual: typeof llm?.["registerAdapter"],
+		});
+	}
+	const frozenDiagnostics = Object.freeze([...diagnostics]);
+
+	return Object.freeze({
+		participantId: "coding-subscription-oauth" as const,
+		context,
+		scope: () => resolveCodingOAuthScope(context),
+		ownerRequestPolicy: () => asOwnerRequestPolicy(service(context, "ownerRequestPolicy")),
+		diagnostics: () => frozenDiagnostics,
+		compatibility(options: CompatibilityOptions = {}) {
+			const capabilities: Readonly<Record<string, DshHostCapability>> = {
+				webServer: capability(service(context, "webServer"), "exact-route-v1", ["register"]),
+				settings: capability(service(context, "settings"), "settings-register-v1", ["register"]),
+				credentials: capability(service(context, "credentials"), "credential-resolver-v1", ["resolve"]),
+				llm: capability(service(context, "llm") ?? record(context)?.["llm"], "llm-adapter-registry-v1", [
+					"registerAdapter",
+				]),
+				ownerRequestPolicy: capability(service(context, "ownerRequestPolicy"), "owner-request-policy-v1", [
+					"authorize",
+					"diagnostics",
+				]),
+			};
+			const capabilityDiagnostics: DshCompatibilityDiagnostic[] = Object.entries(capabilities).flatMap(([id, value]) =>
+				typeof value === "object" && value !== null && "state" in value && value.state !== "available"
+					? [
+							{
+								id: `host.capability.${id}`,
+								component: "host" as const,
+								level: value.state === "incompatible" ? ("error" as const) : ("warning" as const),
+								message: `${id} is ${value.state}`,
+							},
+						]
+					: [],
+			);
+			const merged = Object.freeze([...frozenDiagnostics, ...capabilityDiagnostics, ...(options.diagnostics ?? [])]);
+			const status: DshCompatibility["status"] = merged.some(
+				(item: DshCompatibilityDiagnostic) => item.level === "error",
+			)
+				? "incompatible"
+				: merged.some((item: DshCompatibilityDiagnostic) => item.level === "warning")
+					? "degraded"
+					: "healthy";
+			return {
+				coreAbi: CODING_OAUTH_CORE_ABI,
+				dshVersion: dshVersion(),
+				status,
+				uiOwner: options.uiOwner ?? "standalone",
+				accessMode: options.accessMode ?? "loopback",
+				capabilities,
+				diagnostics: merged.map((item: DshCompatibilityDiagnostic) => `${item.id}: ${item.message}`),
+			};
+		},
+		assertCompatible() {
+			const incompatible = [
+				...incompatibleDiagnostics(diagnostics),
+				...diagnostics.filter((item) => item.id === "host.api.llm.registerAdapter"),
+			];
+			if (incompatible.length > 0) {
+				throw new Error(`incompatible DSH host API: ${incompatible.map((item) => item.id).join(", ")}`);
+			}
+		},
+	});
+}

package/src/gateway-anthropic-messages.ts

@@ -1,84 +1,84 @@
-/**
- * Anthropic Messages API subset for the local gateway.
- * @module dsh-coding-subscription-oauth/gateway-anthropic-messages
- */
-
-import type { IncomingMessage, ServerResponse } from "node:http";
-import { type GatewayBackend, gatewayErrorEnvelope } from "./gateway-backend.ts";
-import { beginGatewaySse, readGatewayJsonBody, writeGatewayJson } from "./gateway-body.ts";
-import { anthropicMaxTokens, parseAnthropicMessagesRequest } from "./gateway-parse.ts";
-
-export async function handleAnthropicMessages(
-	req: IncomingMessage,
-	res: ServerResponse,
-	backend: GatewayBackend,
-): Promise<void> {
-	const payload = await readGatewayJsonBody(req);
-	const request = parseAnthropicMessagesRequest(payload);
-	const maxTokens = anthropicMaxTokens(payload);
-	const stream = payload["stream"] === true;
-	const id = `msg_gateway_${Date.now().toString(36)}`;
-	if (!stream) {
-		let text = "";
-		const toolUses: Array<{ id: string; name: string; input: unknown }> = [];
-		let stop = "end_turn";
-		for await (const part of backend.stream(request)) {
-			if (part.type === "text") text += part.text;
-			if (part.type === "tool_call") {
-				let input: unknown = {};
-				try {
-					input = JSON.parse(part.arguments) as unknown;
-				} catch {
-					input = { value: part.arguments };
-				}
-				toolUses.push({ id: part.id, name: part.name, input });
-			}
-			if (part.type === "done" && part.finish === "tool_calls") stop = "tool_use";
-		}
-		writeGatewayJson(res, 200, {
-			id,
-			type: "message",
-			role: "assistant",
-			model: request.model,
-			content: [
-				...(text.length === 0 ? [] : [{ type: "text", text }]),
-				...toolUses.map((tool) => ({ type: "tool_use", id: tool.id, name: tool.name, input: tool.input })),
-			],
-			stop_reason: stop,
-			usage: { input_tokens: 0, output_tokens: 0 },
-			max_tokens: maxTokens,
-		});
-		return;
-	}
-	beginGatewaySse(res);
-	try {
-		res.write(
-			`event: message_start\ndata: ${JSON.stringify({ type: "message_start", message: { id, type: "message", role: "assistant", model: request.model, content: [] } })}\n\n`,
-		);
-		let started = false;
-		for await (const part of backend.stream(request)) {
-			if (part.type === "text") {
-				if (!started) {
-					res.write(
-						`event: content_block_start\ndata: ${JSON.stringify({ type: "content_block_start", index: 0, content_block: { type: "text", text: "" } })}\n\n`,
-					);
-					started = true;
-				}
-				res.write(
-					`event: content_block_delta\ndata: ${JSON.stringify({ type: "content_block_delta", index: 0, delta: { type: "text_delta", text: part.text } })}\n\n`,
-				);
-			}
-		}
-		if (started) {
-			res.write(`event: content_block_stop\ndata: ${JSON.stringify({ type: "content_block_stop", index: 0 })}\n\n`);
-		}
-		res.write(
-			`event: message_delta\ndata: ${JSON.stringify({ type: "message_delta", delta: { stop_reason: "end_turn" } })}\n\n`,
-		);
-		res.write(`event: message_stop\ndata: ${JSON.stringify({ type: "message_stop" })}\n\n`);
-		res.end();
-	} catch (error) {
-		res.write(`event: error\ndata: ${JSON.stringify(gatewayErrorEnvelope(error).body)}\n\n`);
-		res.end();
-	}
-}
+/**
+ * Anthropic Messages API subset for the local gateway.
+ * @module dsh-coding-subscription-oauth/gateway-anthropic-messages
+ */
+
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type GatewayBackend, gatewayErrorEnvelope } from "./gateway-backend.ts";
+import { beginGatewaySse, readGatewayJsonBody, writeGatewayJson } from "./gateway-body.ts";
+import { anthropicMaxTokens, parseAnthropicMessagesRequest } from "./gateway-parse.ts";
+
+export async function handleAnthropicMessages(
+	req: IncomingMessage,
+	res: ServerResponse,
+	backend: GatewayBackend,
+): Promise<void> {
+	const payload = await readGatewayJsonBody(req);
+	const request = parseAnthropicMessagesRequest(payload);
+	const maxTokens = anthropicMaxTokens(payload);
+	const stream = payload["stream"] === true;
+	const id = `msg_gateway_${Date.now().toString(36)}`;
+	if (!stream) {
+		let text = "";
+		const toolUses: Array<{ id: string; name: string; input: unknown }> = [];
+		let stop = "end_turn";
+		for await (const part of backend.stream(request)) {
+			if (part.type === "text") text += part.text;
+			if (part.type === "tool_call") {
+				let input: unknown = {};
+				try {
+					input = JSON.parse(part.arguments) as unknown;
+				} catch {
+					input = { value: part.arguments };
+				}
+				toolUses.push({ id: part.id, name: part.name, input });
+			}
+			if (part.type === "done" && part.finish === "tool_calls") stop = "tool_use";
+		}
+		writeGatewayJson(res, 200, {
+			id,
+			type: "message",
+			role: "assistant",
+			model: request.model,
+			content: [
+				...(text.length === 0 ? [] : [{ type: "text", text }]),
+				...toolUses.map((tool) => ({ type: "tool_use", id: tool.id, name: tool.name, input: tool.input })),
+			],
+			stop_reason: stop,
+			usage: { input_tokens: 0, output_tokens: 0 },
+			max_tokens: maxTokens,
+		});
+		return;
+	}
+	beginGatewaySse(res);
+	try {
+		res.write(
+			`event: message_start\ndata: ${JSON.stringify({ type: "message_start", message: { id, type: "message", role: "assistant", model: request.model, content: [] } })}\n\n`,
+		);
+		let started = false;
+		for await (const part of backend.stream(request)) {
+			if (part.type === "text") {
+				if (!started) {
+					res.write(
+						`event: content_block_start\ndata: ${JSON.stringify({ type: "content_block_start", index: 0, content_block: { type: "text", text: "" } })}\n\n`,
+					);
+					started = true;
+				}
+				res.write(
+					`event: content_block_delta\ndata: ${JSON.stringify({ type: "content_block_delta", index: 0, delta: { type: "text_delta", text: part.text } })}\n\n`,
+				);
+			}
+		}
+		if (started) {
+			res.write(`event: content_block_stop\ndata: ${JSON.stringify({ type: "content_block_stop", index: 0 })}\n\n`);
+		}
+		res.write(
+			`event: message_delta\ndata: ${JSON.stringify({ type: "message_delta", delta: { stop_reason: "end_turn" } })}\n\n`,
+		);
+		res.write(`event: message_stop\ndata: ${JSON.stringify({ type: "message_stop" })}\n\n`);
+		res.end();
+	} catch (error) {
+		res.write(`event: error\ndata: ${JSON.stringify(gatewayErrorEnvelope(error).body)}\n\n`);
+		res.end();
+	}
+}

package/src/gateway-auth.ts

@@ -1,100 +1,102 @@
-/**
- * Owner-only gateway API key file.
- * @module dsh-coding-subscription-oauth/gateway-auth
- */
-
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { mkdir } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
-import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
-import { OAuthSourceError, readHardenedOAuthSourceFile } from "./oauth-sources.ts";
-
-export const GATEWAY_KEY_FILENAME = ".coding-oauth-gateway.json";
-const KEY_FORMAT_VERSION = 1;
-
-export interface GatewayKeyDocument {
-	version: typeof KEY_FORMAT_VERSION;
-	apiKey: string;
-	enabled?: boolean;
-	port?: number;
-}
-
-export function gatewayKeyPath(dshHome?: string): string {
-	return resolve(join(resolveDshHome(dshHome), GATEWAY_KEY_FILENAME));
-}
-
-export function generateGatewayApiKey(): string {
-	return randomBytes(32).toString("base64url");
-}
-
-export function gatewayKeysEqual(left: string, right: string): boolean {
-	const a = Buffer.from(left);
-	const b = Buffer.from(right);
-	return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
-}
-
-export function maskGatewayApiKey(apiKey: string): string {
-	if (apiKey.length <= 4) return "****";
-	return `****${apiKey.slice(-4)}`;
-}
-
-export async function loadGatewayKeyDocument(path: string): Promise<GatewayKeyDocument | undefined> {
-	try {
-		const text = (await readHardenedOAuthSourceFile(path)).text;
-		const value = JSON.parse(text) as unknown;
-		if (typeof value !== "object" || value === null || Array.isArray(value)) {
-			throw new Error("gateway key file must contain an object");
-		}
-		const document = value as Record<string, unknown>;
-		if (
-			document["version"] !== KEY_FORMAT_VERSION ||
-			typeof document["apiKey"] !== "string" ||
-			document["apiKey"].length === 0
-		) {
-			throw new Error("gateway key file is invalid");
-		}
-		const port = document["port"];
-		return {
-			version: KEY_FORMAT_VERSION,
-			apiKey: document["apiKey"],
-			...(typeof document["enabled"] === "boolean" ? { enabled: document["enabled"] } : {}),
-			...(typeof port === "number" && Number.isSafeInteger(port) && port >= 1024 && port <= 65_535 ? { port } : {}),
-		};
-	} catch (error) {
-		if (error instanceof OAuthSourceError && error.code === "not_found") return undefined;
-		throw error;
-	}
-}
-
-export async function loadOrCreateGatewayApiKey(path: string, configured?: string): Promise<string> {
-	const existing = await loadGatewayKeyDocument(path);
-	if (configured !== undefined) {
-		await persistGatewayKeyDocument(path, {
-			version: KEY_FORMAT_VERSION,
-			apiKey: configured,
-			...(existing?.enabled === undefined ? {} : { enabled: existing.enabled }),
-			...(existing?.port === undefined ? {} : { port: existing.port }),
-		});
-		return configured;
-	}
-	if (existing !== undefined) return existing.apiKey;
-	const created = generateGatewayApiKey();
-	await persistGatewayKeyDocument(path, { version: KEY_FORMAT_VERSION, apiKey: created });
-	return created;
-}
-
-export async function persistGatewayApiKey(path: string, apiKey: string): Promise<void> {
-	const existing = await loadGatewayKeyDocument(path);
-	await persistGatewayKeyDocument(path, {
-		version: KEY_FORMAT_VERSION,
-		apiKey,
-		...(existing?.enabled === undefined ? {} : { enabled: existing.enabled }),
-		...(existing?.port === undefined ? {} : { port: existing.port }),
-	});
-}
-
-export async function persistGatewayKeyDocument(path: string, document: GatewayKeyDocument): Promise<void> {
-	await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-	await writeFileAtomic(path, `${JSON.stringify(document)}\n`, { mode: 0o600 });
-}
+/**
+ * Owner-only gateway API key file.
+ * @module dsh-coding-subscription-oauth/gateway-auth
+ */
+
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { mkdir } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
+import { GATEWAY_KEY_FILENAME } from "./ids.ts";
+import { OAuthSourceError, readHardenedOAuthSourceFile } from "./oauth-sources.ts";
+
+export { GATEWAY_KEY_FILENAME } from "./ids.ts";
+
+const KEY_FORMAT_VERSION = 1;
+
+export interface GatewayKeyDocument {
+	version: typeof KEY_FORMAT_VERSION;
+	apiKey: string;
+	enabled?: boolean;
+	port?: number;
+}
+
+export function gatewayKeyPath(dshHome?: string): string {
+	return resolve(join(resolveDshHome(dshHome), GATEWAY_KEY_FILENAME));
+}
+
+export function generateGatewayApiKey(): string {
+	return randomBytes(32).toString("base64url");
+}
+
+export function gatewayKeysEqual(left: string, right: string): boolean {
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+
+export function maskGatewayApiKey(apiKey: string): string {
+	if (apiKey.length <= 4) return "****";
+	return `****${apiKey.slice(-4)}`;
+}
+
+export async function loadGatewayKeyDocument(path: string): Promise<GatewayKeyDocument | undefined> {
+	try {
+		const text = (await readHardenedOAuthSourceFile(path)).text;
+		const value = JSON.parse(text) as unknown;
+		if (typeof value !== "object" || value === null || Array.isArray(value)) {
+			throw new Error("gateway key file must contain an object");
+		}
+		const document = value as Record<string, unknown>;
+		if (
+			document["version"] !== KEY_FORMAT_VERSION ||
+			typeof document["apiKey"] !== "string" ||
+			document["apiKey"].length === 0
+		) {
+			throw new Error("gateway key file is invalid");
+		}
+		const port = document["port"];
+		return {
+			version: KEY_FORMAT_VERSION,
+			apiKey: document["apiKey"],
+			...(typeof document["enabled"] === "boolean" ? { enabled: document["enabled"] } : {}),
+			...(typeof port === "number" && Number.isSafeInteger(port) && port >= 1024 && port <= 65_535 ? { port } : {}),
+		};
+	} catch (error) {
+		if (error instanceof OAuthSourceError && error.code === "not_found") return undefined;
+		throw error;
+	}
+}
+
+export async function loadOrCreateGatewayApiKey(path: string, configured?: string): Promise<string> {
+	const existing = await loadGatewayKeyDocument(path);
+	if (configured !== undefined) {
+		await persistGatewayKeyDocument(path, {
+			version: KEY_FORMAT_VERSION,
+			apiKey: configured,
+			...(existing?.enabled === undefined ? {} : { enabled: existing.enabled }),
+			...(existing?.port === undefined ? {} : { port: existing.port }),
+		});
+		return configured;
+	}
+	if (existing !== undefined) return existing.apiKey;
+	const created = generateGatewayApiKey();
+	await persistGatewayKeyDocument(path, { version: KEY_FORMAT_VERSION, apiKey: created });
+	return created;
+}
+
+export async function persistGatewayApiKey(path: string, apiKey: string): Promise<void> {
+	const existing = await loadGatewayKeyDocument(path);
+	await persistGatewayKeyDocument(path, {
+		version: KEY_FORMAT_VERSION,
+		apiKey,
+		...(existing?.enabled === undefined ? {} : { enabled: existing.enabled }),
+		...(existing?.port === undefined ? {} : { port: existing.port }),
+	});
+}
+
+export async function persistGatewayKeyDocument(path: string, document: GatewayKeyDocument): Promise<void> {
+	await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+	await writeFileAtomic(path, `${JSON.stringify(document)}\n`, { mode: 0o600 });
+}