@deepwatch/dsh-client-remotes 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 oxbshw
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,79 @@
+# @deepwatch/dsh-client-remotes
+
+Client composition: mounts Watch's generated Typert Remote into ctx.remote
+
+Part of **DeepWatch** — the agent workspace built on the official
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)
+and powered by [Watch Skill](https://github.com/oxbshw/watch-skill) for perception, evidence, memory and
+independent verification.
+
+> **Browser half — runs in the workspace UI.**
+> Composed by the bundle and loaded by the DSH client loader.
+
+## Exports
+
+- `@deepwatch/dsh-client-remotes`
+- `@deepwatch/dsh-client-remotes/client`
+
+## Peers
+
+Provided by the host rather than installed here:
+
+- `@deepseek-ai/cordis@4.0.2`
+
+## Install
+
+> **Not on npm yet.** Nothing exists under the `@deepwatch` scope. This
+> package is published for the first time by the `deepwatch-v0.1.0`
+> release; until then the command below resolves nothing, and
+> [the workspace README](https://github.com/oxbshw/watch-skill/tree/main/workspace#readme) has the path
+> that works from a checkout.
+
+```sh
+npm install @deepwatch/dsh-client-remotes
+```
+
+Rarely on its own. [`@deepwatch/dsh-bundle`](https://github.com/oxbshw/watch-skill/tree/main/workspace/packages/watch/bundle#readme)
+composes this package with the rest of DeepWatch and is what a profile
+normally depends on; installing this one directly is for embedding a
+single piece in a composition you control.
+
+## Requirements
+
+- Node `^22.19.0 || >=24.0.0`
+- The peers above, supplied by the host composition
+
+## Stability
+
+`0.1.0` — a stable release.
+
+Stable means tested, documented and supported — not 1.0. This is a
+pre-1.0 line, and semantic versioning gives `0.x` no compatibility
+guarantee across minor versions: **a `0.MINOR` bump may change or remove
+surface, and a patch will not.** Depend on it with a tilde range
+(`~0.1.0`) if you want that difference enforced by your lockfile
+rather than by a changelog. The usual major-version promise starts at 1.0.
+
+## Side effects
+
+Importing a module from this package evaluates no side effects, so a
+bundler may drop what a build does not use. Mounting it in a host is a
+separate matter: what it then reads or writes is governed by the
+workspace boundary and the host's permissions, not by this flag.
+
+## Where this fits
+
+Mounts Watch's generated Typert Remote into `ctx.remote`, so every client call reaches the host through one generated, type-checked surface instead of hand-written fetches.
+
+The twenty packages and how they compose:
+[the package map](https://github.com/oxbshw/watch-skill/blob/main/workspace/docs/packages.md).
+Running DeepWatch, and the gates a change has to pass:
+[the workspace README](https://github.com/oxbshw/watch-skill/tree/main/workspace#readme).
+
+## Attribution
+
+Built on DeepSeek Harness · Powered by Watch Skill
+
+DeepWatch and Watch Skill are independent projects and are not affiliated
+with or endorsed by DeepSeek. MIT licensed; third-party notices are in
+[THIRD_PARTY_NOTICES.md](https://github.com/oxbshw/watch-skill/blob/main/workspace/THIRD_PARTY_NOTICES.md).

package/lib/client/index.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Watch's generated Remote, mounted into the Client's `ctx.remote`.
+ *
+ * This package exists to break a cycle, and the cycle is worth stating because
+ * the arrangement only makes sense against it. `@deepwatch/dsh-tools` is the
+ * Host: it owns `WatchQueryService`, and Typert generates the Remote from that
+ * Host program. It reads the Library's index, so tools depends on
+ * `@deepwatch/dsh-library`. When the Library's browser half also mounted the
+ * generated contribution, the Library depended on tools in return — a real
+ * cyclic workspace dependency that pnpm warned about, and a build order no
+ * staging can honestly satisfy, because the Library's client could not compile
+ * until a file generated *from* the Library's own dependent existed.
+ *
+ * So the mount moved out to a composition boundary. Nothing else lives here.
+ * The rule this package holds is one sentence: a package that owns a capability
+ * never also owns the transport that carries it.
+ *
+ * `ctx.remote.$mount` is how a distribution outside upstream's own assembly
+ * contributes a namespace — `@deepseek-ai/dsh-api-remotes` imports its seven
+ * contributions statically, and anything else mounts its own. What arrives is
+ * `@deepwatch/dsh-tools/remote`, generated from the Host service by Typert, so
+ * a surface calls `ctx.remote.watchQuery.librarySearch` against the same strict
+ * codecs the Host validates with.
+ *
+ * The artifact is client-safe by construction: it imports zod and nothing else,
+ * and carries descriptors rather than any Host implementation.
+ *
+ * @module @deepwatch/dsh-client-remotes/client
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { TypertDisposer, TypertRemoteNamespaceMap } from '@deepseek-ai/dsh-typert-protocol';
+import type { WatchQueryRemote } from '@deepwatch/dsh-library/read-plane';
+/**
+ * The Client Remote service, which the Gateway's browser half installs.
+ *
+ * Named as a service rather than as a package: `@deepseek-ai/dsh-api-remotes`
+ * is what the boot graph must materialise first, and that is declared in
+ * `dsh.client.inject`. This is the thing that has to exist before `apply` runs.
+ */
+export declare const inject: string[];
+/** Mutual assignability, so neither side may be wider than the other. */
+type Exact<A, B> = [A] extends [B] ? ([B] extends [A] ? true : false) : false;
+/**
+ * The Library's declared view of `watchQuery`, checked against the generated one.
+ *
+ * The Library cannot import the generated declaration — that is the edge this
+ * package exists to remove — so it describes the namespace from the shared wire
+ * contracts instead. Left unchecked that would be a hand-written copy free to
+ * drift the moment a Remote signature changes. Here both types are in scope, so
+ * the compiler compares them: regenerate the Remote with a different signature
+ * and this assignment stops compiling, naming the file that has to change.
+ */
+export declare const LIBRARY_MATCHES_THE_GENERATED_NAMESPACE: Exact<TypertRemoteNamespaceMap['watchQuery'], WatchQueryRemote>;
+/**
+ * Mount the generated contribution, and hand back the disposer that removes it.
+ *
+ * The disposer is returned rather than registered on an event: cordis unwinds a
+ * plugin by awaiting what its `apply` handed back, and a namespace that
+ * outlives the plugin that mounted it is a service pointing at a fiber that has
+ * gone.
+ *
+ * Nothing here is defensive about `ctx.remote`. `inject` above means cordis does
+ * not call this until the service exists, so a missing Remote parks the plugin
+ * instead of reaching `undefined.$mount` — the difference between a plugin that
+ * refuses and a mount that fails after the fact.
+ */
+export declare function apply(ctx: Context): Promise<TypertDisposer>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/lib/client/index.js

@@ -0,0 +1,66 @@
+/**
+ * Watch's generated Remote, mounted into the Client's `ctx.remote`.
+ *
+ * This package exists to break a cycle, and the cycle is worth stating because
+ * the arrangement only makes sense against it. `@deepwatch/dsh-tools` is the
+ * Host: it owns `WatchQueryService`, and Typert generates the Remote from that
+ * Host program. It reads the Library's index, so tools depends on
+ * `@deepwatch/dsh-library`. When the Library's browser half also mounted the
+ * generated contribution, the Library depended on tools in return — a real
+ * cyclic workspace dependency that pnpm warned about, and a build order no
+ * staging can honestly satisfy, because the Library's client could not compile
+ * until a file generated *from* the Library's own dependent existed.
+ *
+ * So the mount moved out to a composition boundary. Nothing else lives here.
+ * The rule this package holds is one sentence: a package that owns a capability
+ * never also owns the transport that carries it.
+ *
+ * `ctx.remote.$mount` is how a distribution outside upstream's own assembly
+ * contributes a namespace — `@deepseek-ai/dsh-api-remotes` imports its seven
+ * contributions statically, and anything else mounts its own. What arrives is
+ * `@deepwatch/dsh-tools/remote`, generated from the Host service by Typert, so
+ * a surface calls `ctx.remote.watchQuery.librarySearch` against the same strict
+ * codecs the Host validates with.
+ *
+ * The artifact is client-safe by construction: it imports zod and nothing else,
+ * and carries descriptors rather than any Host implementation.
+ *
+ * @module @deepwatch/dsh-client-remotes/client
+ */
+import TYPERT_REMOTE from '@deepwatch/dsh-tools/remote';
+/**
+ * The Client Remote service, which the Gateway's browser half installs.
+ *
+ * Named as a service rather than as a package: `@deepseek-ai/dsh-api-remotes`
+ * is what the boot graph must materialise first, and that is declared in
+ * `dsh.client.inject`. This is the thing that has to exist before `apply` runs.
+ */
+export const inject = ['remote'];
+/**
+ * The Library's declared view of `watchQuery`, checked against the generated one.
+ *
+ * The Library cannot import the generated declaration — that is the edge this
+ * package exists to remove — so it describes the namespace from the shared wire
+ * contracts instead. Left unchecked that would be a hand-written copy free to
+ * drift the moment a Remote signature changes. Here both types are in scope, so
+ * the compiler compares them: regenerate the Remote with a different signature
+ * and this assignment stops compiling, naming the file that has to change.
+ */
+export const LIBRARY_MATCHES_THE_GENERATED_NAMESPACE = true;
+/**
+ * Mount the generated contribution, and hand back the disposer that removes it.
+ *
+ * The disposer is returned rather than registered on an event: cordis unwinds a
+ * plugin by awaiting what its `apply` handed back, and a namespace that
+ * outlives the plugin that mounted it is a service pointing at a fiber that has
+ * gone.
+ *
+ * Nothing here is defensive about `ctx.remote`. `inject` above means cordis does
+ * not call this until the service exists, so a missing Remote parks the plugin
+ * instead of reaching `undefined.$mount` — the difference between a plugin that
+ * refuses and a mount that fails after the fact.
+ */
+export async function apply(ctx) {
+    return await ctx.remote.$mount(TYPERT_REMOTE);
+}
+//# sourceMappingURL=index.js.map

package/lib/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AASH,OAAO,aAAa,MAAM,6BAA6B,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;AAKhC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uCAAuC,GACc,IAAI,CAAA;AAEtE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY;IACtC,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;AAC/C,CAAC"}