@deepseek-ai/dsh-settings 0.1.6-alpha.2 → 0.1.7-alpha.2

package/lib/types/redact.d.ts

@@ -27,10 +27,8 @@ export interface RedactedValue {
 }
 /**
  * Remove every `role('secret')` field a schema declares from a value. The
- * walker follows `object`, `dict`, and `array` containers; a secret must be
- * declared directly on a field reachable through those containers (a secret
- * buried inside a union branch or transform is not reachable and must not be
- * modeled that way). The input is never mutated.
+ * walker visits every union branch, conservatively removing any field declared
+ * secret by a branch. The input is never mutated.
  * @param schema - live schemastery schema describing the value.
  * @param value - the value to strip; `undefined` yields an empty record with
  *   object-property secret slots still enumerated.

package/lib/types/redact.js

@@ -52,19 +52,19 @@ function walk(node, value, path, secrets) {
                 return value;
             return value.map((entry, index) => walk(node.inner, entry, [...path, String(index)], secrets));
         }
+        case 'union':
+        case 'intersect':
+            return (node.list ?? []).reduce((current, child) => walk(child, current, path, secrets), value);
+        case 'transform':
+            return walk(node.inner, value, path, secrets);
         default:
-            // TODO(settings-wire-redaction): Fail closed instead — a secret reachable
-            // only through a union, intersection, or transform is returned verbatim
-            // here, with nothing recording that it was missed.
             return value;
     }
 }
 /**
  * Remove every `role('secret')` field a schema declares from a value. The
- * walker follows `object`, `dict`, and `array` containers; a secret must be
- * declared directly on a field reachable through those containers (a secret
- * buried inside a union branch or transform is not reachable and must not be
- * modeled that way). The input is never mutated.
+ * walker visits every union branch, conservatively removing any field declared
+ * secret by a branch. The input is never mutated.
  * @param schema - live schemastery schema describing the value.
  * @param value - the value to strip; `undefined` yields an empty record with
  *   object-property secret slots still enumerated.
@@ -73,6 +73,12 @@ function walk(node, value, path, secrets) {
 export function redactSecrets(schema, value) {
     const secrets = [];
     const stripped = walk(schema, value, [], secrets);
-    return { value: stripped, secrets };
+    const positions = new Map();
+    for (const secret of secrets) {
+        const key = JSON.stringify(secret.path);
+        const previous = positions.get(key);
+        positions.set(key, { ...secret, set: secret.set || previous?.set === true });
+    }
+    return { value: stripped, secrets: [...positions.values()] };
 }
 //# sourceMappingURL=redact.js.map

package/lib/types/schema.d.ts

@@ -0,0 +1,24 @@
+import z from '@deepseek-ai/schemastery';
+/** Remove runtime references from a configuration snapshot.
+ * @param value Parsed Config output.
+ * @returns Detached ordinary values suitable for redaction and forms.
+ */
+export declare function plainConfig(value: unknown): unknown;
+/** Select fields whose nearest volatile ancestor makes them editable without remounting.
+ * @param schema The plugin's Config schema.
+ * @returns A plain form schema, or undefined when no field is live.
+ */
+export declare function volatileForm(schema: z): z | undefined;
+/** Project only schema-declared fields, excluding ordinary configuration.
+ * @param schema The filtered form schema.
+ * @param value Plain raw or resolved config.
+ * @returns The fields visible to this form.
+ */
+export declare function projectForm(schema: z, value: unknown): unknown;
+/** Check that a field path lies beneath a declared volatile node.
+ * @param schema Complete plugin Config schema.
+ * @param path Field path addressed by a form edit.
+ * @returns Whether the path can be edited live.
+ */
+export declare function isVolatilePath(schema: z, path: readonly string[]): boolean;
+//# sourceMappingURL=schema.d.ts.map

package/lib/types/schema.js

@@ -0,0 +1,85 @@
+/** Derive editable forms and plain values from plugin Config schemas. */
+import { redactSecrets } from "./redact.js";
+import z from '@deepseek-ai/schemastery';
+import { isVolatile } from '@deepseek-ai/cosmokit';
+/** Remove runtime references from a configuration snapshot.
+ * @param value Parsed Config output.
+ * @returns Detached ordinary values suitable for redaction and forms.
+ */
+export function plainConfig(value) {
+    if (isVolatile(value))
+        return plainConfig(value.get());
+    if (Array.isArray(value))
+        return value.map(plainConfig);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, plainConfig(child)]));
+    }
+    return value;
+}
+function plainSchema(schema) {
+    const result = new z(schema.toJSON());
+    const walk = (node) => {
+        delete node.meta.volatile;
+        if (node.meta.role === 'secret') {
+            delete node.meta.default;
+            delete node.meta.required;
+        }
+        else if (node.meta.default !== undefined)
+            node.meta.default = redactSecrets(node, node.meta.default).value;
+        for (const child of Object.values(node.dict ?? {}))
+            walk(child);
+        if (node.inner)
+            walk(node.inner);
+        for (const child of node.list ?? [])
+            walk(child);
+    };
+    walk(result);
+    return result;
+}
+/** Select fields whose nearest volatile ancestor makes them editable without remounting.
+ * @param schema The plugin's Config schema.
+ * @returns A plain form schema, or undefined when no field is live.
+ */
+export function volatileForm(schema) {
+    if (schema.meta.volatile)
+        return plainSchema(schema);
+    if (schema.type === 'object') {
+        const dict = Object.fromEntries(Object.entries(schema.dict ?? {}).flatMap(([key, child]) => {
+            const field = volatileForm(child);
+            return field === undefined ? [] : [[key, field]];
+        }));
+        return Object.keys(dict).length === 0 ? undefined : z.object(dict);
+    }
+    return undefined;
+}
+/** Whether a raw config node is an unevaluated `!!js` expression, kept whole rather than projected field by field. */
+function isExpression(value) {
+    return Object.keys(value).length === 1 && typeof Reflect.get(value, '__jsExpr') === 'string';
+}
+/** Project only schema-declared fields, excluding ordinary configuration.
+ * @param schema The filtered form schema.
+ * @param value Plain raw or resolved config.
+ * @returns The fields visible to this form.
+ */
+export function projectForm(schema, value) {
+    if (schema.type === 'object' && value !== null && typeof value === 'object' && !isExpression(value)) {
+        return Object.fromEntries(Object.entries(schema.dict ?? {}).flatMap(([key, child]) => {
+            const field = Reflect.get(value, key);
+            return field === undefined ? [] : [[key, projectForm(child, field)]];
+        }));
+    }
+    return value;
+}
+/** Check that a field path lies beneath a declared volatile node.
+ * @param schema Complete plugin Config schema.
+ * @param path Field path addressed by a form edit.
+ * @returns Whether the path can be edited live.
+ */
+export function isVolatilePath(schema, path) {
+    if (schema.meta.volatile)
+        return true;
+    const [key, ...rest] = path;
+    const child = key === undefined ? undefined : schema.dict?.[key];
+    return child !== undefined && isVolatilePath(child, rest);
+}
+//# sourceMappingURL=schema.js.map

package/lib/types/types.d.ts

@@ -1,18 +1,8 @@
-/**
- * Client-safe type surface of the user-settings seam: the namespace brand, the
- * commit-origin union, the redacted views a configuration surface reads over
- * the Remote wire, and the seam's Cordis event declarations. Types only — no
- * runtime code, and nothing here reaches a Host-only symbol, so a Client
- * compilation face reads exactly the signatures the Host emits.
- *
- * @module @deepseek-ai/dsh-settings/types
- */
+/** Client-safe configuration form views and change notifications. */
 import type { Branded } from '@deepseek-ai/dsh-brand';
 import type { JsonValue } from '@deepseek-ai/dsh-util-values';
-/** Nominal id of one registered settings namespace. */
+/** Nominal id of one profile plugin entry. */
 export type SettingsNamespace = Branded<'SettingsNamespace'>;
-/** Origin of one committed settings change. */
-export type SettingsUpdateSource = 'update' | 'provider';
 /** One schema-declared secret slot inside a redacted namespace value. */
 export interface SettingsSecretView {
     /** Path from the section root to the removed field. */
@@ -21,27 +11,29 @@ export interface SettingsSecretView {
     set: boolean;
 }
 /**
- * Wire view of one registered namespace, always read under `redactSecrets`. The
+ * Wire view of one profile plugin entry, always read under `redactSecrets`. The
  * JSON-valued fields are `JsonValue` rather than the descriptor's `unknown`
  * because the Remote boundary admits no unconstrained data.
  */
 export interface SettingsNamespaceView {
+    /** Generate a page if no custom page is registered for this instance. */
+    autoGenerate: boolean;
     /** Namespace key (`llm-deepseek`, `llm-pi-ai`, …). */
     ns: string;
     /** Serialized schemastery schema envelope (`schema.toJSON()`); rehydrate with `new Schema(json)`. */
     schema: JsonValue;
     /** Redacted resolved value (schema defaults → composition base → user layer). */
     value: JsonValue;
-    /** Redacted composition base layer, when the registrant declared one. */
+    /** Redacted composition base layer, with defaults resolved. */
     base?: JsonValue;
     /** Redacted raw user section, when one exists; a field's presence here marks it user-overridden. */
     user?: JsonValue;
     /** When the owner applies changes. */
-    applies: 'live' | 'restart';
+    applies: 'live';
     /** Every schema-declared secret slot with its configured state. */
     secrets: SettingsSecretView[];
     /**
-     * Monotonic revision of the raw user section this view was read at. Send it
+     * Monotonic revision of the raw entry configuration this view was read at. Send it
      * back as `expectedRevision` on a write so a stale editor is refused rather
      * than silently overwriting a concurrent change.
      */
@@ -60,42 +52,22 @@ export type SettingsPathOpView = {
     op: 'unset';
     path: string[];
 };
-/** Every registered namespace with the deployment facts a configuration page renders around them. */
+/** Every profile plugin entry with the deployment facts a configuration page renders around them. */
 export interface SettingsDescribeValue {
-    /** Whether the provider accepts writes; `false` disables every write control. */
+    /** Whether the profile accepts writes; `false` disables every write control. */
     writable: boolean;
-    /** Whether a file-backed provider owns a local document, without exposing its Host path. */
+    /** Whether the configuration editor owns a local document, without exposing its Host path. */
     hasDocument: boolean;
-    /** One view per registered namespace. */
+    /** One view per profile plugin entry. */
     namespaces: SettingsNamespaceView[];
 }
 declare module '@deepseek-ai/cordis' {
     interface Events {
         /**
-         * Committed change to one registered namespace's resolved value. Emitted
-         * after the provider persisted (for `update`) or published (`provider`)
-         * the change; never emitted when the resolved value is deep-equal.
-         * Listener failures are contained and logged — a sync throw and an async
-         * rejection alike — except `INVARIANT`-coded failures, which rethrow
-         * after every listener ran; that rethrow reaches the emitter only from
-         * synchronous listeners, so invariant checks on this event must not be
-         * async functions.
-         * @param ns - the namespace whose resolved value changed.
-         * @param next - the new resolved value.
-         * @param prev - the previous resolved value.
-         * @param source - whether the change entered through `update()` or the provider.
-         * @mode emit
-         */
-        'settings/updated'(ns: SettingsNamespace, next: unknown, prev: unknown, source: SettingsUpdateSource): void;
-        /**
-         * One registered namespace's RAW user section changed, whether or not the
-         * resolved value did. `settings/updated` is the consumer-facing event and
-         * stays deep-equal-gated; this one exists for configuration surfaces,
-         * which must learn that a field went from inherited to overridden (same
-         * resolved value, different meaning) and that their held revision is
-         * stale. Listener containment matches `settings/updated`.
-         * @param ns - the namespace whose stored section changed.
-         * @param revision - the namespace's new revision.
+         * One profile entry's form values, availability, or page policy changed.
+         * Form clients re-read its schema, resolved values, and revision.
+         * @param ns Profile entry id.
+         * @param revision The entry's new revision.
          * @mode emit
          */
         'settings/document-updated'(ns: SettingsNamespace, revision: number): void;

package/lib/types/types.js

@@ -1,11 +1,3 @@
-/**
- * Client-safe type surface of the user-settings seam: the namespace brand, the
- * commit-origin union, the redacted views a configuration surface reads over
- * the Remote wire, and the seam's Cordis event declarations. Types only — no
- * runtime code, and nothing here reaches a Host-only symbol, so a Client
- * compilation face reads exactly the signatures the Host emits.
- *
- * @module @deepseek-ai/dsh-settings/types
- */
+/** Client-safe configuration form views and change notifications. */
 export {};
 //# sourceMappingURL=types.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-settings",
   "description": "Abstract user-settings seam (ctx.settings) for the DeepSeek Harness",
-  "version": "0.1.6-alpha.2",
+  "version": "0.1.7-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -18,10 +18,6 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
-    "./invariant": {
-      "types": "./lib/types/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
     "./types": {
       "types": "./lib/types/types.d.ts",
       "default": "./lib/types/types.js"
@@ -31,26 +27,34 @@
   },
   "files": [
     "lib/index.js",
-    "lib/invariant.js",
     "lib/types/**/*.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-invariants": "^0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
-    "@deepseek-ai/dsh-brand": "^0.1.6-alpha.2"
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-session": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-brand": "0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.4",
+    "@deepseek-ai/dsh-invariants": "0.1.7-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-brand": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-invariants": "^0.1.6-alpha.2",
-    "@deepseek-ai/dsh-session": "^0.1.6-alpha.2",
-    "@deepseek-ai/schemastery": "^3.18.2"
+    "yaml": "^2.8.1",
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-brand": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-invariants": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-session": "0.1.7-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.4",
+    "@deepseek-ai/cordis-plugin-timer": "~1.1.6",
+    "@deepseek-ai/dsh-app-boot": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-hmr": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.7-alpha.2"
   },
   "dependencies": {
-    "@deepseek-ai/dsh-util-values": "^0.1.6-alpha.2"
+    "yaml": "^2.8.1",
+    "@deepseek-ai/dsh-util-values": "0.1.7-alpha.2",
+    "@deepseek-ai/dsh-config-editor": "0.1.7-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
+    "@deepseek-ai/cosmokit": "~1.8.5"
   }
 }

package/lib/invariant.js

@@ -1,35 +0,0 @@
-import { deepEqualJson } from "@deepseek-ai/dsh-util-values";
-//#region lib/types/invariant.js
-/**
-* Package-owned invariant companion for `@deepseek-ai/dsh-settings`.
-* @module @deepseek-ai/dsh-settings/invariant
-*/
-const PACKAGE_NAME = "@deepseek-ai/dsh-settings";
-/** Cordis companion plugin name. */
-const name = "settings-invariant";
-/** Service required before the companion can reserve package ownership. */
-const inject = ["invariants"];
-/**
-* Install the commit-event contract: `settings/updated` fires only for a
-* currently registered namespace, only when the resolved value changed, and
-* only with the service's authoritative resolved value — all judged with the
-* seam's own equality predicate.
-*/
-const install = (ctx, fail) => {
-	ctx.on("settings/updated", (ns, next, prev) => {
-		const settings = ctx.get("settings");
-		if (settings === void 0) fail(`settings/updated for "${ns}" emitted without a live settings service`);
-		const current = settings.get(ns);
-		if (current === void 0) fail(`settings/updated for "${ns}" emitted while the namespace is unregistered`);
-		if (!deepEqualJson(current, next)) fail(`settings/updated for "${ns}" does not match the authoritative resolved value`);
-		if (deepEqualJson(next, prev)) fail(`settings/updated for "${ns}" emitted without a resolved-value change`);
-	});
-};
-/**
-* Register this package's invariant companion.
-* @param ctx - Cordis context carrying the invariant service.
-* @returns the installed registration's disposer after setup succeeds.
-*/
-const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//#endregion
-export { apply, inject, name };

package/lib/types/invariant.d.ts

@@ -1,16 +0,0 @@
-/**
- * Package-owned invariant companion for `@deepseek-ai/dsh-settings`.
- * @module @deepseek-ai/dsh-settings/invariant
- */
-import type { Context } from '@deepseek-ai/cordis';
-/** Cordis companion plugin name. */
-export declare const name = "settings-invariant";
-/** Service required before the companion can reserve package ownership. */
-export declare const inject: string[];
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns the installed registration's disposer after setup succeeds.
- */
-export declare const apply: (ctx: Context) => Promise<() => void>;
-//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -1,41 +0,0 @@
-/**
- * Package-owned invariant companion for `@deepseek-ai/dsh-settings`.
- * @module @deepseek-ai/dsh-settings/invariant
- */
-import { deepEqualJson } from '@deepseek-ai/dsh-util-values';
-const PACKAGE_NAME = '@deepseek-ai/dsh-settings';
-/** Cordis companion plugin name. */
-export const name = 'settings-invariant';
-/** Service required before the companion can reserve package ownership. */
-export const inject = ['invariants'];
-/**
- * Install the commit-event contract: `settings/updated` fires only for a
- * currently registered namespace, only when the resolved value changed, and
- * only with the service's authoritative resolved value — all judged with the
- * seam's own equality predicate.
- */
-const install = (ctx, fail) => {
-    ctx.on('settings/updated', (ns, next, prev) => {
-        const settings = ctx.get('settings');
-        if (settings === undefined) {
-            fail(`settings/updated for "${ns}" emitted without a live settings service`);
-        }
-        const current = settings.get(ns);
-        if (current === undefined) {
-            fail(`settings/updated for "${ns}" emitted while the namespace is unregistered`);
-        }
-        if (!deepEqualJson(current, next)) {
-            fail(`settings/updated for "${ns}" does not match the authoritative resolved value`);
-        }
-        if (deepEqualJson(next, prev)) {
-            fail(`settings/updated for "${ns}" emitted without a resolved-value change`);
-        }
-    });
-};
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns the installed registration's disposer after setup succeeds.
- */
-export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//# sourceMappingURL=invariant.js.map