@addozhang/dsh-discord 0.1.0

package/lib/features/model-control.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `/model show` and the guarded `/model select` (design.md §7, tasks 10.2 +
+ * 10.3). A successful `session.selectModel` changes the addressed session AND
+ * attempts to persist that choice as the host default for future sessions, so
+ * mutation is restricted to the explicit global Host-operator allowlist —
+ * Guild-local administrators are denied. The confirmation states BOTH facts
+ * and nothing more: `applied-with-host-default`, `partial-session-only` (the
+ * session changed but persistence did not land), or a plain rejection/unknown.
+ * Catalog and reasoning-effort validation happen before any DSH call.
+ */
+import type { AccessDecision } from '../policy/authorization.js';
+export interface DshModelPort {
+    catalog(): Promise<{
+        outcome: 'completed';
+        providers: ReadonlyArray<{
+            provider: string;
+            models: ReadonlyArray<{
+                id: string;
+                reasonings: readonly string[];
+            }>;
+        }>;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+    selectModel(request: {
+        sessionId: string;
+        modelId: string;
+        reasoning?: string;
+    }): Promise<{
+        outcome: 'completed';
+        sessionApplied: boolean;
+        defaultPersisted: boolean;
+    } | {
+        outcome: 'rejected';
+        reason: string;
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export type ModelCatalogView = {
+    outcome: 'ok';
+    providers: ReadonlyArray<{
+        provider: string;
+        models: ReadonlyArray<{
+            id: string;
+            reasonings: readonly string[];
+        }>;
+    }>;
+} | {
+    outcome: 'failed';
+    reason: 'model-catalog-unavailable' | 'model-catalog-unknown';
+};
+export declare function showModelCatalog(port: DshModelPort, _request: {
+    sessionId: string;
+}): Promise<ModelCatalogView>;
+export type ModelSelectResult = {
+    outcome: 'applied-with-host-default';
+    sessionApplied: boolean;
+    defaultPersisted: boolean;
+} | {
+    outcome: 'partial-session-only';
+    sessionApplied: boolean;
+    defaultPersisted: boolean;
+} | {
+    outcome: 'rejected';
+} | {
+    outcome: 'unknown';
+} | {
+    outcome: 'refused';
+    reason: 'not-host-operator' | 'model-not-in-catalog' | 'invalid-reasoning-effort';
+};
+export declare function selectModel(port: DshModelPort, request: {
+    decision: AccessDecision;
+    sessionId: string;
+    modelId: string;
+    reasoning?: string | undefined;
+}): Promise<ModelSelectResult>;

package/lib/features/model-control.js

@@ -0,0 +1,51 @@
+/**
+ * `/model show` and the guarded `/model select` (design.md §7, tasks 10.2 +
+ * 10.3). A successful `session.selectModel` changes the addressed session AND
+ * attempts to persist that choice as the host default for future sessions, so
+ * mutation is restricted to the explicit global Host-operator allowlist —
+ * Guild-local administrators are denied. The confirmation states BOTH facts
+ * and nothing more: `applied-with-host-default`, `partial-session-only` (the
+ * session changed but persistence did not land), or a plain rejection/unknown.
+ * Catalog and reasoning-effort validation happen before any DSH call.
+ */
+export async function showModelCatalog(port, _request) {
+    const catalog = await port.catalog();
+    if (catalog.outcome === 'failed')
+        return { outcome: 'failed', reason: 'model-catalog-unavailable' };
+    if (catalog.outcome === 'unknown')
+        return { outcome: 'failed', reason: 'model-catalog-unknown' };
+    return { outcome: 'ok', providers: catalog.providers };
+}
+export async function selectModel(port, request) {
+    // Host-operator authority ONLY: a Guild administrator is not enough,
+    // because the selection attempts to persist a host-wide default.
+    if (!request.decision.allowed || request.decision.level !== 'host-operator') {
+        return { outcome: 'refused', reason: 'not-host-operator' };
+    }
+    const catalog = await port.catalog();
+    if (catalog.outcome !== 'completed') {
+        return { outcome: 'refused', reason: 'model-not-in-catalog' };
+    }
+    const model = catalog.providers
+        .flatMap(provider => provider.models)
+        .find(candidate => candidate.id === request.modelId);
+    if (model === undefined) {
+        return { outcome: 'refused', reason: 'model-not-in-catalog' };
+    }
+    if (request.reasoning !== undefined && !model.reasonings.includes(request.reasoning)) {
+        return { outcome: 'refused', reason: 'invalid-reasoning-effort' };
+    }
+    const selected = await port.selectModel({
+        sessionId: request.sessionId,
+        modelId: request.modelId,
+        ...(request.reasoning === undefined ? {} : { reasoning: request.reasoning }),
+    });
+    if (selected.outcome !== 'completed') {
+        return selected.outcome === 'rejected' ? { outcome: 'rejected' } : { outcome: 'unknown' };
+    }
+    // State exactly what DSH proved — both facts, never overstated.
+    if (selected.sessionApplied && selected.defaultPersisted) {
+        return { outcome: 'applied-with-host-default', sessionApplied: true, defaultPersisted: true };
+    }
+    return { outcome: 'partial-session-only', sessionApplied: selected.sessionApplied, defaultPersisted: selected.defaultPersisted };
+}

package/lib/features/preset-control.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Project-channel Agent Preset control (design.md §7, task 10.1). A preset is
+ * a complete Agent composition: the channel default persists independently of
+ * the workspace binding and is passed EXPLICITLY to future `session.create`
+ * calls only — existing sessions never change. Resetting omits the field so
+ * DSH applies its current host default. Selection validates against the host
+ * catalog; a missing or broken catalog refuses without writing.
+ */
+export interface DshPresetPort {
+    listPresets(): Promise<{
+        outcome: 'completed';
+        presets: ReadonlyArray<{
+            id: string;
+            name: string;
+        }>;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+    hostDefaultPreset(): Promise<{
+        outcome: 'completed';
+        presetId: string | undefined;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export interface PresetChannelStore {
+    get(key: string): {
+        presetId: string;
+    } | undefined;
+    put(key: string, value: {
+        presetId: string;
+    }): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+export interface PresetControlDeps {
+    presets: DshPresetPort;
+    channelStore: PresetChannelStore;
+}
+export type PresetSelectResult = {
+    outcome: 'selected';
+    presetId: string;
+} | {
+    outcome: 'failed';
+    reason: 'preset-not-in-catalog' | 'preset-catalog-unavailable';
+};
+export type PresetShowResult = {
+    outcome: 'ok';
+    channelPreset: string | undefined;
+    hostDefault: string | undefined;
+} | {
+    outcome: 'failed';
+    reason: 'preset-catalog-unavailable';
+};
+export type PresetResetResult = {
+    outcome: 'reset';
+};
+export declare function createPresetControl(deps: PresetControlDeps): {
+    show(input: {
+        guildId: string;
+        channelId: string;
+    }): Promise<PresetShowResult>;
+    select(input: {
+        guildId: string;
+        channelId: string;
+        presetId: string;
+    }): Promise<PresetSelectResult>;
+    reset(input: {
+        guildId: string;
+        channelId: string;
+    }): Promise<PresetResetResult>;
+    /** Merge the channel default into a future session.create request, if set. */
+    applyToSessionCreate<T extends {
+        sessionId: string;
+    }>(scope: {
+        guildId: string;
+        channelId: string;
+    }, createRequest: T): T & {
+        presetId?: string;
+    };
+};

package/lib/features/preset-control.js

@@ -0,0 +1,43 @@
+/**
+ * Project-channel Agent Preset control (design.md §7, task 10.1). A preset is
+ * a complete Agent composition: the channel default persists independently of
+ * the workspace binding and is passed EXPLICITLY to future `session.create`
+ * calls only — existing sessions never change. Resetting omits the field so
+ * DSH applies its current host default. Selection validates against the host
+ * catalog; a missing or broken catalog refuses without writing.
+ */
+const storeKey = (guildId, channelId) => `${guildId}:${channelId}`;
+export function createPresetControl(deps) {
+    return {
+        async show(input) {
+            const hostDefault = await deps.presets.hostDefaultPreset();
+            if (hostDefault.outcome !== 'completed') {
+                return { outcome: 'failed', reason: 'preset-catalog-unavailable' };
+            }
+            return {
+                outcome: 'ok',
+                channelPreset: deps.channelStore.get(storeKey(input.guildId, input.channelId))?.presetId,
+                hostDefault: hostDefault.presetId,
+            };
+        },
+        async select(input) {
+            const catalog = await deps.presets.listPresets();
+            if (catalog.outcome !== 'completed') {
+                return { outcome: 'failed', reason: 'preset-catalog-unavailable' };
+            }
+            if (!catalog.presets.some(preset => preset.id === input.presetId)) {
+                return { outcome: 'failed', reason: 'preset-not-in-catalog' };
+            }
+            await deps.channelStore.put(storeKey(input.guildId, input.channelId), { presetId: input.presetId });
+            return { outcome: 'selected', presetId: input.presetId };
+        },
+        async reset(input) {
+            await deps.channelStore.delete(storeKey(input.guildId, input.channelId));
+            return { outcome: 'reset' };
+        },
+        applyToSessionCreate(scope, createRequest) {
+            const presetId = deps.channelStore.get(storeKey(scope.guildId, scope.channelId))?.presetId;
+            return presetId === undefined ? { ...createRequest } : { ...createRequest, presetId };
+        },
+    };
+}

package/lib/features/project-bind.d.ts

@@ -0,0 +1,69 @@
+/**
+ * `/project bind <workspace>` (design.md §4, §13). Workspace administrators
+ * bind the current project channel to a registered DSH Workspace. The flow is
+ * two-phase: `plan` authorizes, resolves the selection against the live
+ * catalog (a since-deleted Workspace is reported stale), and snapshots the
+ * existing binding's revision; `commit` writes through the revision-fenced
+ * store only after explicit confirmation. Everything is a value: a refused
+ * member, a stale workspace, a cancelled confirmation, and a lost race never
+ * leave a partial write behind.
+ */
+import { type AccessDecision } from '../policy/authorization.js';
+import type { ChannelBinding } from '../state/records.js';
+import type { ChannelBindingScope } from '../state/domain.js';
+import type { ChannelBindingStore } from '../state/bindings.js';
+/** How the feature verifies a selection still exists in the DSH catalog. */
+export interface WorkspaceResolver {
+    resolve(reference: string): Promise<{
+        outcome: 'found';
+        workspace: {
+            id: string;
+            title: string;
+        };
+    } | {
+        outcome: 'stale';
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export interface ProjectBindDeps {
+    resolver: WorkspaceResolver;
+    bindings: ChannelBindingStore;
+}
+export interface ProjectBindPlanRequest {
+    decision: AccessDecision;
+    scope: ChannelBindingScope;
+    /** Discord user id performing the bind (recorded as `boundBy`). */
+    actorId: string;
+    /** The opaque selection value (`ws:<id>`) chosen in the list. */
+    reference: string;
+    /** Whether the confirmation control was already answered affirmatively. */
+    confirmed: boolean;
+}
+export type ProjectBindPlan = {
+    outcome: 'planned';
+    scope: ChannelBindingScope;
+    actorId: string;
+    workspaceId: string;
+    /** Revision the commit must fence against; undefined for a fresh bind. */
+    previousRevision: number | undefined;
+} | {
+    outcome: 'refused';
+    reason: 'not-authorized' | 'workspace-no-longer-registered' | 'workspace-catalog-unavailable';
+};
+export type ProjectBindResult = {
+    outcome: 'bound';
+    binding: ChannelBinding;
+} | {
+    outcome: 'cancelled';
+} | {
+    outcome: 'stale-revision';
+};
+export declare function createProjectBindFlow(deps: ProjectBindDeps): {
+    plan(request: ProjectBindPlanRequest): Promise<ProjectBindPlan>;
+    commit(plan: ProjectBindPlan, options?: {
+        cancelled?: boolean;
+    }): Promise<ProjectBindResult>;
+};

package/lib/features/project-bind.js

@@ -0,0 +1,57 @@
+/**
+ * `/project bind <workspace>` (design.md §4, §13). Workspace administrators
+ * bind the current project channel to a registered DSH Workspace. The flow is
+ * two-phase: `plan` authorizes, resolves the selection against the live
+ * catalog (a since-deleted Workspace is reported stale), and snapshots the
+ * existing binding's revision; `commit` writes through the revision-fenced
+ * store only after explicit confirmation. Everything is a value: a refused
+ * member, a stale workspace, a cancelled confirmation, and a lost race never
+ * leave a partial write behind.
+ */
+import { levelAtLeast } from '../policy/authorization.js';
+export function createProjectBindFlow(deps) {
+    const channelKey = (scope) => `app:${scope.applicationId}:guild:${scope.guildId}:channel:${scope.channelId}`;
+    async function plan(request) {
+        // Authorization precedes every other step, including the catalog read.
+        if (!request.decision.allowed || !levelAtLeast(request.decision.level, 'workspace-administrator')) {
+            return { outcome: 'refused', reason: 'not-authorized' };
+        }
+        const resolved = await deps.resolver.resolve(request.reference);
+        if (resolved.outcome === 'stale') {
+            return { outcome: 'refused', reason: 'workspace-no-longer-registered' };
+        }
+        if (resolved.outcome !== 'found') {
+            return { outcome: 'refused', reason: 'workspace-catalog-unavailable' };
+        }
+        const current = deps.bindings.get(channelKey(request.scope));
+        return {
+            outcome: 'planned',
+            scope: request.scope,
+            actorId: request.actorId,
+            workspaceId: resolved.workspace.id,
+            previousRevision: current?.revision,
+        };
+    }
+    async function commit(plan, options = {}) {
+        if (plan.outcome !== 'planned')
+            return { outcome: 'cancelled' };
+        if (options.cancelled === true)
+            return { outcome: 'cancelled' };
+        const key = channelKey(plan.scope);
+        const record = {
+            workspaceId: plan.workspaceId,
+            boundBy: plan.actorId,
+            boundAtMs: Date.now(),
+        };
+        const result = plan.previousRevision === undefined
+            ? await deps.bindings.bind(key, record)
+            : await deps.bindings.bind(key, record, { expectedRevision: plan.previousRevision });
+        if (!result.ok) {
+            // already-bound cannot occur across a fenced expectedRevision commit;
+            // a lost race surfaces as stale-revision for the caller to re-plan.
+            return { outcome: 'stale-revision' };
+        }
+        return { outcome: 'bound', binding: result.binding };
+    }
+    return { plan, commit };
+}

package/lib/features/project-info.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `/project info` (design.md §3, §13). Any authorized member sees the
+ * Workspace identity and its canonical path — paths are not treated as
+ * sensitive for this self-hosted, trusted-Guild product — and the response
+ * is always ephemeral. A path never lands in durable channel metadata.
+ */
+import type { AccessDecision } from '../policy/authorization.js';
+import { type WorkspaceDetail, type WorkspaceEntry } from '../policy/disclosure.js';
+export type ProjectInfoView = {
+    outcome: 'info';
+    workspace: WorkspaceDetail;
+    response: 'ephemeral';
+} | {
+    outcome: 'refused';
+    reason: 'not-authorized';
+};
+/**
+ * Build the info view for one workspace. Authorization proves membership;
+ * the disclosure policy owns the exact rendered shape, and the response is
+ * always ephemeral.
+ */
+export declare function projectInfo(input: {
+    decision: AccessDecision;
+    workspace: WorkspaceEntry;
+}): ProjectInfoView;

package/lib/features/project-info.js

@@ -0,0 +1,22 @@
+/**
+ * `/project info` (design.md §3, §13). Any authorized member sees the
+ * Workspace identity and its canonical path — paths are not treated as
+ * sensitive for this self-hosted, trusted-Guild product — and the response
+ * is always ephemeral. A path never lands in durable channel metadata.
+ */
+import { describeWorkspace } from '../policy/disclosure.js';
+/**
+ * Build the info view for one workspace. Authorization proves membership;
+ * the disclosure policy owns the exact rendered shape, and the response is
+ * always ephemeral.
+ */
+export function projectInfo(input) {
+    if (!input.decision.allowed) {
+        return { outcome: 'refused', reason: 'not-authorized' };
+    }
+    return {
+        outcome: 'info',
+        workspace: describeWorkspace(input.workspace, { includePath: true }),
+        response: 'ephemeral',
+    };
+}

package/lib/features/project-list.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `/project list` discovery (design.md §3, §13). The feature talks to DSH
+ * through one narrow port (satisfied by the apiProxy adapter in production,
+ * by fakes in tests): every registered Workspace is selectable, labels come
+ * from the least-disclosure policy (safe titles, opaque `ws:` references,
+ * duplicate disambiguation); per amended design §3 the bind autocomplete
+ * appends the abbreviated canonical path to each candidate label. This
+ * surface renders plain text, so it has no navigation: large catalogs are
+ * reported honestly — first page items plus the total count for the caller's
+ * truncation note — while the selector pagination helpers stay available to
+ * select-based surfaces.
+ * Catalog failures surface as sanitized outcomes — no raw provider detail
+ * ever reaches Discord.
+ */
+import { type SelectorOption } from '../discord/selector.js';
+/** How the feature reads the DSH Workspace catalog. */
+export interface ProjectListPort {
+    listWorkspaces(): Promise<{
+        outcome: 'completed';
+        workspaces: ReadonlyArray<{
+            id: string;
+            title: string;
+            path?: string | undefined;
+        }>;
+    } | {
+        outcome: 'failed';
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export interface ProjectListRequest {
+    /** The unique id of this interaction, scoping page navigation values. */
+    selectionId: string;
+    query?: string | undefined;
+    page?: number | undefined;
+}
+export type ProjectListView = {
+    outcome: 'ok';
+    items: SelectorOption[];
+    /** The whole (query-filtered) catalog size, for truncation copy. */
+    totalCount: number;
+    pageIndex: number;
+    pageCount: number;
+    hasPrev: boolean;
+    hasNext: boolean;
+    navValues: {
+        prev?: string;
+        next?: string;
+    };
+} | {
+    outcome: 'failed';
+    reason: 'workspace-catalog-unavailable' | 'workspace-catalog-unknown';
+};
+/**
+ * Build the `/project list` view: fetch the catalog, sanitize and
+ * disambiguate labels, apply the query, and page the result.
+ */
+export declare function createProjectListView(port: ProjectListPort, request: ProjectListRequest): Promise<ProjectListView>;
+/** One Discord autocomplete choice: display label plus the opaque value. */
+export interface AutocompleteChoice {
+    name: string;
+    value: string;
+}
+/**
+ * Build the autocomplete choices for a workspace reference option (the
+ * Live-candidates pattern: the option lists live candidates as you type,
+ * so no id is ever copy-pasted). Labels carry the same sanitized base as
+ * `/project list` plus the abbreviated canonical path when the
+ * Host supplies one; the query narrows via the shared filter and matches
+ * path text too. Labels exceeding Discord's 100-character choice-name
+ * limit fall back to the bare sanitized label rather than truncating.
+ */
+export declare function workspaceAutocompleteChoices(catalog: ReadonlyArray<{
+    id: string;
+    title: string;
+    path?: string | undefined;
+}>, query: string, options?: {
+    home?: string;
+}): AutocompleteChoice[];

package/lib/features/project-list.js

@@ -0,0 +1,93 @@
+/**
+ * `/project list` discovery (design.md §3, §13). The feature talks to DSH
+ * through one narrow port (satisfied by the apiProxy adapter in production,
+ * by fakes in tests): every registered Workspace is selectable, labels come
+ * from the least-disclosure policy (safe titles, opaque `ws:` references,
+ * duplicate disambiguation); per amended design §3 the bind autocomplete
+ * appends the abbreviated canonical path to each candidate label. This
+ * surface renders plain text, so it has no navigation: large catalogs are
+ * reported honestly — first page items plus the total count for the caller's
+ * truncation note — while the selector pagination helpers stay available to
+ * select-based surfaces.
+ * Catalog failures surface as sanitized outcomes — no raw provider detail
+ * ever reaches Discord.
+ */
+import { filterAutocomplete, paginateSelector } from '../discord/selector.js';
+import { abbreviatePath, safeTitle, workspaceLabels, workspaceReference } from '../policy/disclosure.js';
+/**
+ * Build the `/project list` view: fetch the catalog, sanitize and
+ * disambiguate labels, apply the query, and page the result.
+ */
+export async function createProjectListView(port, request) {
+    const catalog = await port.listWorkspaces();
+    if (catalog.outcome === 'failed') {
+        return { outcome: 'failed', reason: 'workspace-catalog-unavailable' };
+    }
+    if (catalog.outcome === 'unknown') {
+        return { outcome: 'failed', reason: 'workspace-catalog-unknown' };
+    }
+    // Down-project to the two display fields before any label work, so the
+    // canonical path is structurally out of every label below.
+    const entries = catalog.workspaces.map(workspace => ({
+        id: workspace.id,
+        title: safeTitle(workspace.title),
+    }));
+    const labeled = workspaceLabels(entries);
+    const query = request.query ?? '';
+    const selectable = labeled.map(entry => ({
+        label: entry.label,
+        value: entry.id,
+    }));
+    const matches = query.trim() === ''
+        ? selectable
+        : filterAutocomplete(selectable, query.trim(), Number.POSITIVE_INFINITY);
+    const byId = new Map(labeled.map(entry => [entry.id, entry]));
+    const options = [];
+    for (const match of matches) {
+        const entry = byId.get(match.value);
+        if (entry === undefined)
+            continue;
+        options.push({ label: entry.label, value: workspaceReference(entry.id) });
+    }
+    const page = paginateSelector(options, request.page ?? 0, `${request.selectionId}:page`);
+    return {
+        outcome: 'ok',
+        items: page.items,
+        totalCount: options.length,
+        pageIndex: page.pageIndex,
+        pageCount: page.pageCount,
+        hasPrev: page.hasPrev,
+        hasNext: page.hasNext,
+        navValues: page.navValues,
+    };
+}
+/**
+ * Build the autocomplete choices for a workspace reference option (the
+ * Live-candidates pattern: the option lists live candidates as you type,
+ * so no id is ever copy-pasted). Labels carry the same sanitized base as
+ * `/project list` plus the abbreviated canonical path when the
+ * Host supplies one; the query narrows via the shared filter and matches
+ * path text too. Labels exceeding Discord's 100-character choice-name
+ * limit fall back to the bare sanitized label rather than truncating.
+ */
+export function workspaceAutocompleteChoices(catalog, query, options = {}) {
+    const entries = catalog.map(workspace => ({
+        id: workspace.id,
+        title: safeTitle(workspace.title),
+    }));
+    const labeled = workspaceLabels(entries);
+    const selectable = labeled.map((entry, index) => ({
+        label: withAbbreviatedPath(entry.label, catalog[index]?.path, options.home),
+        value: workspaceReference(entry.id),
+    }));
+    const matches = filterAutocomplete(selectable, query, Number.POSITIVE_INFINITY);
+    return matches.map(match => ({ name: match.label, value: match.value }));
+}
+/** Discord caps autocomplete choice names at 100 characters. */
+const DISCORD_CHOICE_NAME_MAX = 100;
+function withAbbreviatedPath(label, path, home) {
+    if (path === undefined || path === '')
+        return label;
+    const candidate = `${label} (${abbreviatePath(path, home)})`;
+    return candidate.length <= DISCORD_CHOICE_NAME_MAX ? candidate : label;
+}

package/lib/features/prompt-submission.d.ts

@@ -0,0 +1,53 @@
+/**
+ * At-most-once prompt submission (design.md §5, §10, task 8.4). Every prompt
+ * carries a stable request id claimed before the DSH call. A same-id/same-
+ * hash delivery never resubmits; a different hash conflicts. A rejection ends
+ * that intent — an explicit user retry mints a NEW intent. An unknown
+ * admission is recorded as `unknown` and NEVER retried automatically; the
+ * reconciler checks DSH history/queue evidence, and an explicit retry (new
+ * intent) is the user's deliberate act.
+ */
+import { type IntentStore } from '../state/intents.js';
+/** The DSH prompt surface the flow needs (session.prompt in production). */
+export interface DshPromptPort {
+    submit(request: {
+        requestId: string;
+        sessionId: string;
+        prompt: string;
+        mode: 'queue';
+    }): Promise<{
+        outcome: 'accepted';
+    } | {
+        outcome: 'rejected';
+        reason: string;
+    } | {
+        outcome: 'unknown';
+    }>;
+}
+export interface PromptSubmissionDeps {
+    prompts: DshPromptPort;
+    intents: IntentStore;
+    nowMs: () => number;
+}
+export type PromptSubmissionResult = {
+    outcome: 'accepted';
+} | {
+    outcome: 'rejected';
+} | {
+    outcome: 'unknown';
+} | {
+    outcome: 'already-submitted';
+} | {
+    outcome: 'conflict';
+};
+export interface PromptRequest {
+    requestId: string;
+    sessionId: string;
+    prompt: string;
+}
+export declare function createPromptSubmissionFlow(deps: PromptSubmissionDeps): {
+    submitOnce(request: PromptRequest): Promise<PromptSubmissionResult>;
+    retry(request: PromptRequest, options: {
+        newRequestId: string;
+    }): Promise<PromptSubmissionResult>;
+};