dsh-vault 0.1.0

package/lib/password.js

@@ -0,0 +1,80 @@
+/**
+ * Cryptographically strong random password generator with character-class
+ * guarantees (at least one of each selected class) and optional separator
+ * grouping (e.g. `XKCD`-style word-free random groups like `vK7-mQ2-zt9`).
+ *
+ * Zero dependencies — randomness comes from `node:crypto`.
+ *
+ * @module dsh-vault/password
+ */
+import { randomInt } from 'node:crypto';
+const LOWERCASE = 'abcdefghijklmnopqrstuvwxyz';
+const UPPERCASE = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+const DIGITS = '0123456789';
+const SYMBOLS = '!@#$%^&*()-_=+[]{};:,.<>?/~';
+function filterPool(options) {
+    const pools = [];
+    if (options.lowercase)
+        pools.push(LOWERCASE);
+    if (options.uppercase)
+        pools.push(UPPERCASE);
+    if (options.digits)
+        pools.push(DIGITS);
+    if (options.symbols)
+        pools.push(SYMBOLS);
+    // Filter each class independently so the per-class guarantee below never
+    // draws an ambiguous character when excludeAmbiguous is on: the guarantee
+    // samples from `classes`, and `merged` only feeds the fill.
+    const classes = options.excludeAmbiguous
+        ? pools.map(pool => [...pool].filter(char => !AMBIGUOUS_CHARS.has(char)).join(''))
+        : pools;
+    return { merged: classes.join(''), classes };
+}
+/** Visually ambiguous characters excluded when `excludeAmbiguous` is set. */
+const AMBIGUOUS_CHARS = new Set('0O1lI');
+/**
+ * Generate a random password. At least one character from every selected class
+ * is guaranteed; the rest are drawn uniformly from the merged pool. Uses
+ * rejection sampling against `node:crypto`'s `randomInt` (no modulo bias).
+ * @throws when no character class is selected, or when the requested length is
+ * shorter than the number of selected classes.
+ */
+export function generatePassword(options = {}) {
+    const length = options.length ?? 20;
+    const config = {
+        lowercase: options.lowercase ?? true,
+        uppercase: options.uppercase ?? true,
+        digits: options.digits ?? true,
+        symbols: options.symbols ?? true,
+        excludeAmbiguous: options.excludeAmbiguous ?? false,
+    };
+    const { merged, classes } = filterPool(config);
+    const selected = classes.filter(pool => pool.length > 0);
+    if (selected.length === 0)
+        throw new Error('password generation requires at least one character class');
+    if (!Number.isInteger(length) || length < 1)
+        throw new Error('password length must be a positive integer');
+    if (length < selected.length) {
+        throw new Error(`password length ${length} is shorter than the ${selected.length} selected character classes`);
+    }
+    if (options.group !== undefined && (!Number.isInteger(options.group) || options.group < 2)) {
+        throw new Error('password group must be an integer >= 2 when provided');
+    }
+    // Guarantee one of each class first.
+    const chars = selected.map(pool => pool[randomInt(pool.length)]);
+    // Fill the rest from the merged pool (or the only class, if one was selected).
+    const source = merged.length > 0 ? merged : selected[0];
+    while (chars.length < length) {
+        chars.push(source[randomInt(source.length)]);
+    }
+    // Fisher-Yates shuffle so the guaranteed classes land anywhere.
+    for (let i = chars.length - 1; i > 0; i--) {
+        const j = randomInt(i + 1);
+        [chars[i], chars[j]] = [chars[j], chars[i]];
+    }
+    let password = chars.join('');
+    if (options.group !== undefined && options.group > 1 && password.length > options.group) {
+        password = password.match(new RegExp(`.{1,${options.group}}`, 'g')).join('-');
+    }
+    return password;
+}

package/lib/store.js

@@ -0,0 +1,318 @@
+/**
+ * The encrypted vault store: a single JSON document on disk holding the KDF
+ * parameters and one authenticated-encryption envelope per entry. The whole
+ * document is atomically replaced on every mutation (`writeFileAtomic` from
+ * `@deepseek-ai/dsh-atomic-write`) and cross-process writers serialize through
+ * its companion file lock.
+ *
+ * All secrets live inside AES-256-GCM envelopes keyed by scrypt(master
+ * password). The on-disk document never contains plaintext secrets; the key
+ * is never persisted and must be re-derived from the master password on every
+ * load.
+ *
+ * KDF parameters are fixed for the life of a vault (chosen when the document
+ * is first created), so loading and persisting always derive the same key.
+ *
+ * @module dsh-vault/store
+ */
+import { chmod, mkdir, readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { withFileLock, writeFileAtomic } from '@deepseek-ai/dsh-atomic-write';
+import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
+import { decrypt, deriveKey, encrypt, newKdfParams, safeEqual, VAULT_FORMAT_VERSION, } from "./crypto.js";
+/** Fixed plaintext inside the verification envelope. */
+const VERIFY_PLAINTEXT = 'dsh-vault:password-ok';
+/** Derive the default on-disk path for a named vault. */
+export function defaultVaultPath(vaultName = 'default') {
+    return join(dshHomePath('vault'), `${vaultName}.json`);
+}
+/**
+ * Open (or lazily create) a vault and return a ready-to-use store. Loading
+ * decrypts the whole document up front so search and reads are pure in-memory
+ * operations.
+ */
+export async function openVault(options) {
+    if (options.masterPassword.length === 0) {
+        throw new Error('vault master password must not be empty');
+    }
+    const path = options.path ?? defaultVaultPath(options.name);
+    const store = new VaultStore(path, options.masterPassword);
+    await store.load();
+    return store;
+}
+/**
+ * In-memory vault handle. Mutations persist atomically under the file lock;
+ * reads never touch the disk again until a reload.
+ */
+export class VaultStore {
+    entries = new Map();
+    path;
+    masterPassword;
+    /** KDF parameters fixed for this vault's life; set on first load/create. */
+    kdf;
+    /** Cached derived key; derived once after load and reused for every persist. */
+    key;
+    /** Serializes in-process persist calls so concurrent mutations never
+     * contend for the cross-process file lock and every write sees the latest
+     * in-memory state. */
+    persistChain = Promise.resolve();
+    constructor(path, masterPassword) {
+        this.path = path;
+        this.masterPassword = masterPassword;
+    }
+    /**
+     * Load the vault document from disk (creating an empty one on first use)
+     * and derive the vault key from the document's fixed KDF parameters.
+     */
+    async load() {
+        // Ensure the vault directory exists before any lock-file or document
+        // write, so first use never fails with ENOENT on a fresh install.
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        // Tighten a pre-existing directory (mkdir leaves existing dirs untouched)
+        // so the vault tree stays owner-only even when a parent created it wider.
+        await chmod(dirname(this.path), 0o700).catch(() => { });
+        const { file, created } = await this.readDocument();
+        this.kdf = file.kdf;
+        this.key = await deriveKey(this.masterPassword, file.kdf);
+        if (created) {
+            // First run: persist the empty document so the file exists with the
+            // chosen KDF (and its verify envelope) before any entry is added.
+            await this.persist();
+            return;
+        }
+        for (const blob of file.entries) {
+            const plaintext = decrypt(blob, this.key);
+            const entry = JSON.parse(plaintext.toString('utf8'));
+            this.entries.set(entry.id, entry);
+        }
+        // Verify the password even when the vault has no entries yet.
+        const verify = decrypt(file.verify, this.key);
+        if (!safeEqual(verify, Buffer.from(VERIFY_PLAINTEXT, 'utf8'))) {
+            throw new Error('vault master password is incorrect');
+        }
+    }
+    /** The vault file path (useful for messages and debugging). */
+    get filePath() {
+        return this.path;
+    }
+    /** All entries, in insertion order. */
+    list() {
+        return [...this.entries.values()];
+    }
+    /** Read one entry by id. */
+    get(id) {
+        return this.entries.get(id);
+    }
+    /** Search entries across text fields; returns summaries without secrets. */
+    search(query, limit = 20) {
+        const needle = query.trim().toLowerCase();
+        if (needle.length === 0)
+            return [];
+        const results = [];
+        for (const entry of this.list()) {
+            if (results.length >= limit)
+                break;
+            if (matches(entry, needle))
+                results.push(toSummary(entry));
+        }
+        return results;
+    }
+    /** Add a new entry; returns the stored entry with its assigned id. Empty
+     * strings and empty arrays from the client form are dropped (a blank form
+     * field means "not provided", not "store an empty value"). */
+    async add(patch) {
+        const now = Date.now();
+        const entry = {
+            id: randomUUID(),
+            title: patch.title,
+            ...pickDefined(patch, { skipEmpty: true }),
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.entries.set(entry.id, entry);
+        await this.persist();
+        return entry;
+    }
+    /** Update an existing entry's fields; returns the updated entry or undefined.
+     * Every defined field in `patch` replaces the stored value; an empty string
+     * clears (removes) that field. `id`/`createdAt` can never change. */
+    async update(id, patch) {
+        const current = this.entries.get(id);
+        if (!current)
+            return undefined;
+        // A title must never be blanked out: an empty-string title is an error
+        // rather than a request to remove the entry's identity.
+        if ('title' in patch && (patch.title ?? '').trim().length === 0) {
+            throw new Error('vault: title must not be empty');
+        }
+        const updated = {
+            ...current,
+            ...pickDefined(patch, { allowTitle: true }),
+            updatedAt: Date.now(),
+        };
+        // An empty string means "clear this field": drop it entirely instead of
+        // storing a blank value, so search and summaries never surface it.
+        const record = updated;
+        for (const key of Object.keys(patch)) {
+            if (patch[key] === '') {
+                delete record[key];
+            }
+        }
+        this.entries.set(id, updated);
+        await this.persist();
+        return updated;
+    }
+    /** Delete an entry; returns true when it existed. */
+    async delete(id) {
+        const existed = this.entries.delete(id);
+        if (existed)
+            await this.persist();
+        return existed;
+    }
+    /** Number of entries. */
+    get size() {
+        return this.entries.size;
+    }
+    /** Whether the vault is unlocked (loaded) with a usable key. */
+    get unlocked() {
+        return this.key !== undefined;
+    }
+    /**
+     * Persist the current in-memory state: encrypt every entry under the vault
+     * key, then atomically replace the document under the cross-process lock.
+     * Calls are serialized through an in-process chain so concurrent mutations
+     * never contend for the lock and each write snapshots the entries visible
+     * when it runs — the final file always reflects every completed mutation.
+     * The derived key is cached after load and reused, so a mutation does not
+     * re-run scrypt; only a fresh vault (no cached key yet) derives once.
+     */
+    persist() {
+        const run = async () => {
+            const kdf = this.kdf ?? newKdfParams();
+            this.kdf = kdf;
+            if (this.key === undefined) {
+                this.key = await deriveKey(this.masterPassword, kdf);
+            }
+            const key = this.key;
+            // `withFileLock` creates the `<file>.lock` sibling with exclusive create,
+            // which fails when the parent directory is absent, so ensure the directory
+            // exists before taking the lock.
+            await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+            await withFileLock(this.path, async () => {
+                const file = {
+                    version: VAULT_FORMAT_VERSION,
+                    kdf,
+                    verify: encrypt(Buffer.from(VERIFY_PLAINTEXT, 'utf8'), key),
+                    entries: [...this.entries.values()].map(entry => ({
+                        id: entry.id,
+                        ...encrypt(Buffer.from(JSON.stringify(entry), 'utf8'), key),
+                    })),
+                };
+                await writeFileAtomic(this.path, JSON.stringify(file), {
+                    mode: 0o600,
+                    dirMode: 0o700,
+                });
+            });
+        };
+        // Append to the chain; a rejected write must not stall later writes, so
+        // the chain continues with the next operation regardless of outcome.
+        const next = this.persistChain.then(run, run);
+        this.persistChain = next.catch(() => { });
+        return next;
+    }
+    /** Read and parse the vault document, tolerating first-run absence. */
+    async readDocument() {
+        let raw;
+        try {
+            raw = await readFile(this.path, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return { file: { version: VAULT_FORMAT_VERSION, kdf: newKdfParams(), verify: EMPTY_BLOB, entries: [] }, created: true };
+            }
+            throw error;
+        }
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== VAULT_FORMAT_VERSION) {
+            throw new Error(`unsupported vault format version ${parsed.version} (expected ${VAULT_FORMAT_VERSION})`);
+        }
+        if (!parsed.kdf || parsed.kdf.algo !== 'scrypt' || !parsed.kdf.saltHex) {
+            throw new Error('vault document is missing valid KDF parameters');
+        }
+        if (!parsed.verify) {
+            throw new Error('vault document is missing its password-verification envelope');
+        }
+        return { file: parsed, created: false };
+    }
+}
+/** Placeholder envelope for a not-yet-persisted vault; replaced on first persist. */
+const EMPTY_BLOB = { ivHex: '', tagHex: '', dataHex: '' };
+/** Case-insensitive substring match across the entry's searchable fields. */
+function matches(entry, needle) {
+    const fieldValues = [];
+    collectSearchable(entry.fields ?? {}, fieldValues);
+    return [
+        entry.title,
+        entry.kind,
+        entry.username,
+        entry.email,
+        entry.phone,
+        entry.host,
+        entry.port,
+        entry.url,
+        entry.notes,
+        ...(entry.tags ?? []),
+        ...fieldValues,
+    ].some(value => value?.toLowerCase().includes(needle));
+}
+/** Recursively collect every scalar string from a fields value (numbers and
+ * booleans stringified so they are searchable too). */
+function collectSearchable(value, out) {
+    if (typeof value === 'string') {
+        out.push(value);
+    }
+    else if (typeof value === 'number' || typeof value === 'boolean') {
+        out.push(String(value));
+    }
+    else if (Array.isArray(value)) {
+        for (const item of value)
+            collectSearchable(item, out);
+    }
+    else if (value !== null && typeof value === 'object') {
+        for (const item of Object.values(value))
+            collectSearchable(item, out);
+    }
+}
+/** Project an entry to its non-secret summary shape. */
+function toSummary(entry) {
+    return {
+        id: entry.id,
+        title: entry.title,
+        ...(entry.kind !== undefined ? { kind: entry.kind } : {}),
+        ...(entry.username !== undefined ? { username: entry.username } : {}),
+        ...(entry.email !== undefined ? { email: entry.email } : {}),
+        ...(entry.phone !== undefined ? { phone: entry.phone } : {}),
+        ...(entry.host !== undefined ? { host: entry.host } : {}),
+        ...(entry.port !== undefined ? { port: entry.port } : {}),
+        ...(entry.url !== undefined ? { url: entry.url } : {}),
+        ...(entry.tags !== undefined ? { tags: entry.tags } : {}),
+    };
+}
+/** Copy only the defined properties of a patch, excluding identity fields.
+ * `title` is excluded by default (add sets it explicitly); pass
+ * `{ allowTitle: true }` for updates, which may rename an entry. With
+ * `{ skipEmpty: true }` (adds) empty strings and empty arrays are dropped so
+ * blank form fields never land in storage. */
+function pickDefined(patch, options = {}) {
+    const result = {};
+    for (const [key, value] of Object.entries(patch)) {
+        const identityField = key === 'id' || key === 'createdAt' || key === 'updatedAt' || (!options.allowTitle && key === 'title');
+        if (value === undefined || identityField)
+            continue;
+        if (options.skipEmpty && (value === '' || (Array.isArray(value) && value.length === 0)))
+            continue;
+        result[key] = value;
+    }
+    return result;
+}

package/lib/totp.js

@@ -0,0 +1,161 @@
+/**
+ * RFC 6238 TOTP (Time-based One-Time Password) with RFC 4648 Base32 secrets,
+ * implemented directly on `node:crypto` (HMAC-SHA1) with zero dependencies.
+ *
+ * Supports both raw Base32 secrets and `otpauth://totp/...?secret=...` URIs
+ * so users can paste either the secret their 2FA setup page shows or the full
+ * provisioning URI a QR code encodes.
+ *
+ * @module dsh-vault/totp
+ */
+import { createHmac, randomBytes } from 'node:crypto';
+/** Default time step in seconds (RFC 6238 default, used by Google Authenticator etc.). */
+export const DEFAULT_PERIOD_SECONDS = 30;
+/** Default number of digits (RFC 6238 default). */
+export const DEFAULT_DIGITS = 6;
+/** Characters used by RFC 4648 Base32 (no padding in secrets). */
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+/**
+ * Decode an RFC 4648 Base32 string (case-insensitive, optional padding and
+ * whitespace tolerated) into bytes.
+ * @throws on characters outside the Base32 alphabet.
+ */
+export function base32Decode(input) {
+    const cleaned = input.replace(/[\s-]/g, '').replace(/=+$/, '').toUpperCase();
+    if (!/^[A-Z2-7]+$/.test(cleaned)) {
+        throw new Error('invalid Base32 secret: contains characters outside A-Z2-7');
+    }
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const char of cleaned) {
+        const index = BASE32_ALPHABET.indexOf(char);
+        if (index < 0)
+            throw new Error(`invalid Base32 character: ${char}`);
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+}
+/** RFC 3986 query-string parser sufficient for otpauth URIs. */
+function parseQuery(query) {
+    const result = {};
+    for (const pair of query.split('&')) {
+        if (!pair)
+            continue;
+        const eq = pair.indexOf('=');
+        if (eq < 0) {
+            result[decodeURIComponent(pair)] = '';
+        }
+        else {
+            result[decodeURIComponent(pair.slice(0, eq))] = decodeURIComponent(pair.slice(eq + 1));
+        }
+    }
+    return result;
+}
+/** Extract the numeric `digits` query parameter when present and valid. */
+function digitsOf(raw) {
+    if (raw === undefined)
+        return DEFAULT_DIGITS;
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isInteger(parsed) && parsed >= 6 && parsed <= 10)
+        return parsed;
+    return DEFAULT_DIGITS;
+}
+/** Extract the numeric `period` query parameter when present and valid. */
+function periodOf(raw) {
+    if (raw === undefined)
+        return DEFAULT_PERIOD_SECONDS;
+    const parsed = Number.parseInt(raw, 10);
+    if (Number.isInteger(parsed) && parsed >= 5)
+        return parsed;
+    return DEFAULT_PERIOD_SECONDS;
+}
+/**
+ * Parse a TOTP secret from either a bare Base32 string or a full
+ * `otpauth://totp/...` provisioning URI. If a bare string has an explicit
+ * trailing `?digits=` or `?period=` (unusual), it is ignored; use a URI for
+ * non-default parameters.
+ */
+export function parseTotpSecret(input) {
+    const trimmed = input.trim();
+    if (trimmed.startsWith('otpauth://')) {
+        const url = new URL(trimmed);
+        if (url.protocol !== 'otpauth:' || url.host !== 'totp') {
+            throw new Error('unsupported otpauth URI: only otpauth://totp is supported');
+        }
+        const secret = url.searchParams.get('secret');
+        if (!secret)
+            throw new Error('otpauth URI is missing the secret parameter');
+        // Labels: "issuer:account" for otpauth://totp/Issuer:account
+        const label = decodeURIComponent(url.pathname.replace(/^\//, ''));
+        const colon = label.indexOf(':');
+        const issuer = url.searchParams.get('issuer') ?? (colon >= 0 ? label.slice(0, colon) : undefined);
+        const account = colon >= 0 ? label.slice(colon + 1) : label;
+        return {
+            secret,
+            periodSeconds: periodOf(url.searchParams.get('period') ?? undefined),
+            digits: digitsOf(url.searchParams.get('digits') ?? undefined),
+            ...(issuer !== undefined ? { issuer } : {}),
+            ...(account !== undefined && account.length > 0 ? { account } : {}),
+        };
+    }
+    return {
+        secret: trimmed,
+        periodSeconds: DEFAULT_PERIOD_SECONDS,
+        digits: DEFAULT_DIGITS,
+    };
+}
+/** HOTP (RFC 4226) — the building block TOTP is defined on. */
+export function hotp(secret, counter, digits) {
+    const counterBuffer = Buffer.alloc(8);
+    counterBuffer.writeBigUInt64BE(BigInt(Math.floor(counter)));
+    const hmac = createHmac('sha1', secret).update(counterBuffer).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const binary = ((hmac[offset] & 0x7f) << 24) |
+        ((hmac[offset + 1] & 0xff) << 16) |
+        ((hmac[offset + 2] & 0xff) << 8) |
+        (hmac[offset + 3] & 0xff);
+    return (binary % 10 ** digits).toString().padStart(digits, '0');
+}
+/**
+ * Compute the current TOTP code for `input` (bare Base32 secret or otpauth
+ * URI). `nowMs` defaults to the current time; pass it explicitly for tests.
+ */
+export function totp(input, nowMs = Date.now()) {
+    const parsed = parseTotpSecret(input);
+    const key = base32Decode(parsed.secret);
+    const counter = Math.floor(nowMs / 1000 / parsed.periodSeconds);
+    return hotp(key, counter, parsed.digits);
+}
+/**
+ * Build a Base32 string from raw bytes (RFC 4648), no padding.
+ */
+export function bytesToBase32(bytes) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            output += BASE32_ALPHABET[(value >>> (bits - 5)) & 0x1f];
+            bits -= 5;
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f];
+    }
+    return output;
+}
+/**
+ * Generate a fresh random TOTP secret (160-bit Base32, the RFC 4226
+ * recommended length), e.g. for enrolling a new 2FA account.
+ */
+export function generateTotpSecret() {
+    return bytesToBase32(randomBytes(20));
+}

package/package.json

@@ -0,0 +1,81 @@
+{
+  "name": "dsh-vault",
+  "version": "0.1.0",
+  "description": "Encrypted credential vault for DeepSeek Harness: store and retrieve usernames, emails, phone numbers, passwords, TOTP secrets, SSH/API-key/OAuth developer credentials through model tools and a Settings UI page.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Ox0400",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ox0400/dsh-vault.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Ox0400/dsh-vault/issues"
+  },
+  "homepage": "https://github.com/Ox0400/dsh-vault#readme",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {},
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.0",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.0-rc.6",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.6",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.0-rc.6",
+    "@deepseek-ai/schemastery": ">=3.0.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.0-rc.6",
+    "@deepseek-ai/schemastery": "3.18.1",
+    "@types/node": "^22.0.0",
+    "lightningcss": "^1.32.0",
+    "react": "^18.3.1",
+    "tsdown": "^0.22.0",
+    "typescript": "^6.0.0",
+    "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "build": "npm run build:host && npm run build:client",
+    "build:host": "tsc -p tsconfig.host.json",
+    "build:client": "tsdown",
+    "prepare": "npm run build",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}