dsh-opendesign-corouter 0.1.3 → 0.1.5

package/lib/login.d.ts

@@ -1,74 +1,12 @@
-/** Console origin and dashboard entry the official desktop uses. */
-export declare const CONSOLE_ORIGIN = "https://open-design.ai";
-export declare const CONSOLE_DASHBOARD_URL = "https://open-design.ai/cloud/dashboard";
-/** The API host whose cookies matter; `context.cookies()` uses it to pick the right ones. */
-export declare const API_COOKIE_URL = "https://amr-api.open-design.ai/api/v1/workspaces/current";
-export interface RawCookie {
-    name?: string;
-    value?: string;
-    expires?: number;
-}
-/** One usable console session: the exact `Cookie` header a browser would send. */
-export interface ExtractedCookie {
-    cookie: string;
-    expiresAt: number;
-}
-/**
- * Pick the session cookies by **URL scope**, never by name. The real cookie is
- * better-auth's `__Secure-better-auth.session_token` today, but it can be renamed at any
- * time and no third party can enumerate the alternatives; joining every unexpired cookie
- * that applies to the API URL reproduces exactly what the browser itself sends. Before
- * login completes this may also collect non-auth cookies (`od_attr`, `__cf_bm`), which is
- * harmless: such a bundle fails `verify` and is therefore never saved.
- */
-export declare function extractConsoleSession(cookies: readonly RawCookie[], now?: number): ExtractedCookie | null;
-export interface LoginSite {
-    origin: string;
-    loginUrl: string;
-    cookieUrls: readonly string[];
-    extract(cookies: readonly RawCookie[], now: number): ExtractedCookie | null;
-}
-/** Site parameters, overridable so a rebrand (for example a new console origin) needs no code fork. */
-export declare function consoleSite(overrides?: {
-    origin?: string;
-    loginUrl?: string;
-    cookieUrls?: readonly string[];
-}): LoginSite;
-export interface VerifyResult {
-    /** Whether the account was read at all; a read-but-quota-unknown result still verifies. */
-    balanceOk: boolean;
-    /** Set when the quota endpoint failed; the cookie itself is still valid, so the host may still save it. */
-    usageError?: {
-        code: string;
-    } | undefined;
-    /**
-     * Caller-supplied context, echoed nowhere and used only for the success message. The Host
-     * re-reads the real quota after commit, so these are never trusted as state.
-     */
-    coverage?: string | undefined;
-    windows?: readonly unknown[] | undefined;
-}
-/** Host-supplied operations. No Host type is imported: the caller wires these. */
+import { type DeviceTokens } from './device-auth.js';
+export type { DeviceTokens } from './device-auth.js';
+/** Host operations. No quota verification: the authorization server issues the identity. */
 export interface LoginCallbacks {
-    /** Snapshot the state a commit must not overwrite, keyed by the revision the caller saw. */
     capture(expectedRevision: string): unknown | Promise<unknown>;
-    /** Prove the cookie works. Any throw means "not usable yet"; abort is a cancel. */
-    verify(cookie: string, signal: AbortSignal): Promise<VerifyResult>;
-    /**
-     * Persist the verified cookie. The Host's store must run its write inside a mutex and call
-     * `signal.throwIfAborted()` there, so a cancel that landed before the mutex was acquired
-     * wins, and one that lands afterwards does not.
-     *
-     * `expiresAt` is the cookie bundle's earliest declared expiry in epoch ms, or `0` when the
-     * console declared none (a session cookie). It is passed through so the Host can store it and
-     * let `resolveSession` expire a stale grant proactively instead of waiting for a 401.
-     */
-    commit(cookie: string, captured: unknown, signal: AbortSignal, expiresAt: number): Promise<unknown>;
+    /** Re-check signal under the Host's atomic store mutex before accepting the write.
+     * Once accepted, resolve: success is the linearization point, even after cancellation. */
+    commit(tokens: DeviceTokens, captured: unknown, signal: AbortSignal): Promise<unknown>;
 }
-/**
- * Attempt phases, matching the shared wire contract (`LoginPhase` in `remote.ts`) exactly;
- * `success`/`cancelled`/`error` are terminal. The Host maps `status()` onto the wire type.
- */
 export type LoginPhase = 'idle' | 'launching' | 'waiting' | 'verifying' | 'success' | 'cancelled' | 'error';
 export interface LoginStatus {
     jobId: string | null;
@@ -77,8 +15,9 @@ export interface LoginStatus {
     finishedAt?: string;
     message?: string;
     errorCode?: string;
-    /** The page could not be opened; the UI may offer the URL instead. */
-    browserOpenFailed?: boolean;
+    activationUrl?: string;
+    userCode?: string;
+    expiresAt?: string;
 }
 export interface LoginStartRequest {
     expectedRevision: string;
@@ -86,90 +25,49 @@ export interface LoginStartRequest {
 export interface LoginJobRequest {
     jobId: string;
 }
-/** Minimal structural browser surface, so tests need no Playwright and Host wiring stays loose. */
-export interface BrowserLike {
-    on?(event: 'disconnected', listener: () => void): void;
-    newContext(): Promise<ContextLike>;
-    close(): Promise<void>;
-}
-export interface ContextLike {
-    newPage(): Promise<PageLike>;
-    cookies(urls: readonly string[]): Promise<readonly RawCookie[]>;
-}
-export interface PageLike {
-    on?(event: 'close', listener: () => void): void;
-    goto(url: string, options?: {
-        waitUntil?: string;
-        timeout?: number;
-    }): Promise<unknown>;
-}
-export type Launcher = (signal: AbortSignal) => Promise<BrowserLike | null>;
 export interface LoginOptions {
-    site?: LoginSite;
-    /** Total life of one login attempt. Default five minutes. */
-    timeoutMs?: number;
-    pollMs?: number;
+    fetcher?: typeof fetch;
     now?: () => number;
-    /** Injected browser launcher; the default uses `playwright-core` and a real Chrome window. */
-    launch?: Launcher;
-    /** Injected sleep, for tests. */
     delay?: (ms: number, signal: AbortSignal) => Promise<void>;
+    /** May shorten, but cannot extend, the local five-minute maximum. */
+    timeoutMs?: number;
+    /**
+     * Called once whenever an approval job leaves `waiting` — success, cancel, expiry or
+     * failure — including on a timer with nobody polling. Resource cleanup lives here
+     * instead of in a status getter, whose side effect depends on someone reading it.
+     */
+    onSettled?: () => void;
 }
 export declare class LoginError extends Error {
     readonly code: 'opendesign/login-state' | 'opendesign/login-disposed' | 'opendesign/login-capture';
     constructor(code: 'opendesign/login-state' | 'opendesign/login-disposed' | 'opendesign/login-capture');
 }
-/**
- * Chrome flags that let a *human* pass the console's bot check. The console looks at
- * `navigator.webdriver` when its Cloudflare challenge is submitted; `headless: false` alone
- * leaves it `true`, and this blink switch is what the official Playwright browser tool
- * appends for chromium. This is not a challenge bypass — the user still solves it — it only
- * avoids announcing automation before they can act. `ignoreDefaultArgs` is a no-op on
- * 1.63.0 and stays for forward compatibility.
- */
-export declare const CHROME_LAUNCH_OPTIONS: {
-    readonly channel: "chrome";
-    readonly headless: false;
-    readonly ignoreDefaultArgs: readonly ["--enable-automation"];
-    readonly args: readonly ["--disable-blink-features=AutomationControlled"];
-};
 export declare class ConsoleLogin {
-    private job;
-    private disposed;
     private readonly callbacks;
     private readonly options;
+    private job;
+    private disposed;
     private readonly now;
     private readonly delay;
+    private readonly fetcher;
     constructor(callbacks: LoginCallbacks, options?: LoginOptions);
-    /** Idempotent, credential-free view of the current attempt. */
+    /** Explicit public allowlist. Codes are never available after waiting or expiry. */
     status(): LoginStatus;
-    /**
-     * Queue one attempt and return immediately: the RPC that starts a login must not wait on a
-     * browser window or on a human. Re-entrant calls while an attempt is live return that
-     * attempt's status instead of opening a second browser.
-     */
+    /** Host-only: the live approval link, so the Host can open it in a bounded window. */
+    activationLink(): string | undefined;
+    /** Synchronous/non-blocking and idempotent while capture/network/commit is pending. */
     start(request: LoginStartRequest): LoginStatus;
-    /**
-     * Abandon the attempt. While `commit` is in flight this only aborts the signal and records
-     * the request: the Host's atomic store decides, because the commit is the linearization
-     * point. A cancel that wins that race reports `cancelled`; one that loses reports `success`
-     * and the cookie really is stored.
-     */
     cancel(request: LoginJobRequest): LoginStatus;
-    /** Plugin teardown: abort the attempt and close the browser. */
     dispose(): void;
-    /** Every cancellation source must let an in-flight atomic store decide the final outcome. */
-    private requestCancellation;
     private alive;
     private stopTimer;
-    private close;
+    private armExpiry;
+    private clearCode;
+    private expire;
+    private requestCancellation;
     private finish;
-    private resolveBrowser;
+    /** Report one terminal transition per job, exactly once. */
+    private settle;
     private run;
-    /**
-     * Persist the verified session; `commit` resolving is the linearization point. Returns
-     * `retry` when the store rejected the write transiently, so the caller decides when to try
-     * again instead of claiming a success that did not happen.
-     */
     private commit;
 }

package/lib/quota.d.ts

@@ -2,10 +2,12 @@ export declare const API_BASE = "https://amr-api.open-design.ai/api/v1";
 export declare const CURRENT_URL = "https://amr-api.open-design.ai/api/v1/workspaces/current";
 export declare const SUMMARY_URL = "https://amr-api.open-design.ai/api/v1/billing/summary";
 export declare const usageUrl: (workspace: string) => string;
+export declare const preflightUrl: (workspace: string) => string;
 export type SessionSource = 'desktop' | 'login' | 'environment';
 export interface Session {
     headers: Record<string, string>;
     source: SessionSource;
+    credentialType?: 'device';
 }
 export interface QuotaWindow {
     durationSeconds: number;
@@ -57,4 +59,8 @@ export declare function normalizeQuota(body: unknown, summary?: unknown): Pick<Q
 /** Billing period of the subscription pool; absent fields stay unknown, never derived. */
 export declare function normalizeSubscription(summary: unknown): Pick<QuotaSnapshot, 'subscriptionPeriodStart' | 'subscriptionPeriodEnd'>;
 export declare function normalizeBalances(summary: unknown): QuotaSnapshot['balances'];
+/** Device contract: opencode-opendesign-auth 0.1.4, workspace preflight + personal summary.
+ * Unlike desktop reads, this path never invokes vela or borrows desktop account data.
+ */
+export declare function readDeviceQuota(session: Session, signal?: AbortSignal, fetcher?: typeof fetch): Promise<QuotaSnapshot>;
 export declare function readQuota(session: Session, signal?: AbortSignal, fetcher?: typeof fetch): Promise<QuotaSnapshot>;

package/lib/remote.d.ts

@@ -39,6 +39,10 @@ export interface LoginState {
     message?: string;
     startedAt?: string;
     finishedAt?: string;
+    /** Public device approval information; available only while waiting. */
+    activationUrl?: string;
+    userCode?: string;
+    expiresAt?: string;
 }
 /** Everything the settings/usage surface may read; no field is derived from a secret. */
 export interface Status {
@@ -66,6 +70,11 @@ export interface SaveApiKeyRequest {
     value: string;
     expectedRevision: string;
 }
+/** Outcome of asking the Host to show the approval page in a temporary window. */
+export interface ActivationOpenState {
+    code: 'opened' | 'no-link' | 'invalid-url' | 'unavailable' | 'failed';
+    opened: boolean;
+}
 /** Rebuild a `QuotaSnapshot` from an allowlist; unknown keys are dropped. */
 export declare function parseQuotaSnapshot(value: unknown): QuotaSnapshot;
 /** Rebuild a `LoginState` from an allowlist; the job's secret material never had a field here. */
@@ -85,3 +94,5 @@ export declare function parseCancelLoginRequest(value: unknown): CancelLoginRequ
  * names a UTF-16 code point instead of the setting to fix.
  */
 export declare function parseSaveApiKeyRequest(value: unknown): SaveApiKeyRequest;
+/** The opener reports one public code; an unknown value is refused, never guessed. */
+export declare function parseActivationOpenState(value: unknown): ActivationOpenState;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-opendesign-corouter",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "OpenDesign CoRouter：套餐赠送与付费模型双 Provider、桌面登录态额度及独立登录",
   "type": "module",
   "license": "MIT",