@gestaltrun/dsh-im-runtime 0.1.0 → 0.1.5

package/lib/tools.js

@@ -1,2 +1,2 @@
-import { n as registerImAgentTools, r as registerSimulationTools } from "./runtime-C0-S-_CC.js";
+import { a as registerSimulationTools, i as registerImAgentTools } from "./runtime-Bm6iSEpv.js";
 export { registerImAgentTools, registerSimulationTools };

package/lib/types/account-placement.d.ts

@@ -0,0 +1,22 @@
+import { WorkspaceId } from '@deepseek-ai/dsh-workspace';
+import { type ImAccountAggregate } from './schema.ts';
+import { type ImDeliveryAccountSlice } from './placement-slice.ts';
+/** 当前账号在客服内置 Workspace 的传输事实；credentialKey 只引用本端 Credentials。 */
+export interface ImAccountPlacementSlice {
+    readonly version: 1;
+    readonly workspaceId: WorkspaceId;
+    readonly account: ImAccountAggregate;
+    readonly delivery: ImDeliveryAccountSlice;
+}
+/** 交接状态或来源归属不满足时拒绝，调用者保留停止状态。 */
+export declare class ImPlacementStateError extends Error {
+    readonly code: 'IM_PLACEMENT_ALREADY_STOPPED' | 'IM_PLACEMENT_SCOPE_INVALID' | 'IM_PLACEMENT_NOT_PAUSED' | 'IM_PLACEMENT_STOP_UNKNOWN' | 'IM_PLACEMENT_STANDBY_REQUIRED';
+    /** @param code - 不携带账号正文或底层响应的稳定代码。 */
+    constructor(code: 'IM_PLACEMENT_ALREADY_STOPPED' | 'IM_PLACEMENT_SCOPE_INVALID' | 'IM_PLACEMENT_NOT_PAUSED' | 'IM_PLACEMENT_STOP_UNKNOWN' | 'IM_PLACEMENT_STANDBY_REQUIRED');
+}
+/**
+ * 校验账号、凭据命名空间和路由的共同归属。
+ * @param value - 已通过控制面授权并限制大小的交接 JSON。
+ * @returns 真实旺旺账号的切片；当前路由和任务只属于声明的内置 Workspace，所有任务代次保持不变。
+ */
+export declare function parseImAccountPlacementSlice(value: unknown): ImAccountPlacementSlice;

package/lib/types/admission-annotations.d.ts

@@ -0,0 +1,40 @@
+/** Host-owned admission annotations; registration lifetime is separate from durable batch identity. */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ImAdmissionAnnotation, ImAdmissionAnnotationId, ImAdmissionAnnotatorId, ImAdmissionId, ImDeliveryScope, ImInboundMessageView, ImScopeId } from './delivery-types.ts';
+/** Frozen messages and route identity offered to an annotation provider. */
+export interface ImAdmissionAnnotationInput {
+    readonly admissionId: ImAdmissionId;
+    readonly scopeId: ImScopeId;
+    readonly scope: ImDeliveryScope;
+    readonly controller?: string | undefined;
+    readonly messages: readonly ImInboundMessageView[];
+}
+/** One product's optional analysis before a batch reaches an Agent. */
+export interface ImAdmissionAnnotator {
+    readonly id: ImAdmissionAnnotatorId;
+    readonly version: string;
+    readonly deadlineMs: number;
+    /** Defaults to true; false runs analysis for its owner without adding text or audit metadata to Agent input. */
+    readonly inject?: boolean;
+    /** @param input - Frozen batch. @returns Whether this provider owns the requested analysis. */
+    accepts(input: ImAdmissionAnnotationInput): boolean;
+    /** @param input - Frozen batch and stable annotation identity. @param signal - Admission, deadline and registration cancellation. @returns Analysis text; providers must settle after cancellation and never publish late results. */
+    annotate(input: ImAdmissionAnnotationInput & {
+        readonly annotationId: ImAdmissionAnnotationId;
+    }, signal: AbortSignal): Promise<string>;
+}
+/** Instance-local registry used by the ordinary and busy-Agent admission paths. */
+export declare class ImAdmissionAnnotations {
+    private readonly ctx;
+    private readonly providers;
+    private closed;
+    /** @param ctx - Runtime owner of registrations. */
+    constructor(ctx: Context);
+    /** @param provider - Product-owned analysis. @returns Idempotent disposer that cancels and joins outstanding provider work. */
+    register(provider: ImAdmissionAnnotator): () => Promise<void>;
+    /** Cancel providers before joining their work; no registration or new analysis is accepted afterwards. */
+    dispose(): Promise<void>;
+    /** @param input - Frozen admission. @param signal - Coordinator lifetime. @returns Ordered analysis results for durable attribution; provider failures never prevent reception. */
+    annotate(input: ImAdmissionAnnotationInput, signal: AbortSignal): Promise<readonly ImAdmissionAnnotation[]>;
+    private run;
+}

package/lib/types/agent-coordinator.d.ts

@@ -1,10 +1,16 @@
 import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { ImExecutionAggregate } from './delivery-schema.ts';
 import type { ImDeliveryScope } from './delivery-types.ts';
 import type { ImRuntime } from './runtime.ts';
 /** Runtime-owned coordinator; one serialized driver and one timer exist per complete scope. */
 export declare class ImAgentCoordinator {
     private readonly ctx;
     private readonly runtime;
+    private readonly startup;
+    private readonly restartTasks;
+    private readonly ownershipWaits;
+    private readonly failedRestarts;
     private readonly tails;
     private readonly timers;
     private readonly handles;
@@ -14,21 +20,36 @@ export declare class ImAgentCoordinator {
     private readonly shutdown;
     private readonly bundleLeases;
     private readonly bundleLeaseDisposers;
+    private readonly modelHolds;
+    private stopModelWatch;
     private disposed;
     private disposeCreated;
     private disposeDisposed;
     /** @param ctx - injected Agent, Workspace, preset, tools, Session, and persistence scope. @param runtime - IM authority. */
     constructor(ctx: Context, runtime: ImRuntime);
     /** Recover existing pending conversations and pending Session evidence. */
-    start(scopes: readonly ImDeliveryScope[]): void;
+    start(scopes: readonly ImDeliveryScope[]): Promise<void>;
+    /** 重开准入或产品状态变化后重试尚未提交的重启跟进。 */
+    notifyRestarts(): void;
     /** Queue one post-commit scope observation without inheriting an Agent initiator. */
     notify(scope: ImDeliveryScope): void;
     /** Close one simulation driver, cancel its Agent, and await only its derived work. */
     stopScope(scope: ImDeliveryScope): Promise<void>;
+    /**
+     * Release drained account Agents before replacing their persisted Sessions.
+     * @param scopes - Current scopes of the account whose reception is stopped.
+     * @returns Owned Agent handles and their persistence locks have been released; other accounts remain active.
+     */
+    releasePlacement(scopes: readonly ImDeliveryScope[]): Promise<void>;
     /** Stop timers, drain admission drivers, and dispose every Agent this coordinator owns. */
     dispose(): Promise<void>;
     /** Evaluate current durable input and submit one eligible batch. */
     private drive;
+    private driveAdmitted;
+    private reportRestartFailure;
+    private restartRoute;
+    /** 准入策略仍控制恢复；模型暂不可用时保留日志证据，等待配置通知。 */
+    private recoverRestart;
     /** Continue one frozen admission after checking its Session log for an earlier append. */
     private submitAdmission;
     /** Pending pause and epoch changes revoke a batch, including during asynchronous policy or Agent setup. */
@@ -70,11 +91,35 @@ export declare class ImAgentCoordinator {
     private scheduleInterval;
     /** Store the exact batch and reasons before Agent lifecycle work starts. */
     private freezeAdmission;
+    /** Keep a blocked shop-cloud batch pending and retry it when the admission changes. */
+    private holdForShopModel;
+    /**
+     * Resume an existing placement task; a missing or foreign Session never creates a replacement.
+     * @param task - Current account task selected while reception is paused.
+     * @param prepare - Preparation of the same idle Agent.
+     * @param signal - Activation and Host lifetime.
+     */
+    preparePersistedPlacement(task: ImExecutionAggregate, prepare: (agent: Agent) => Promise<void>, signal: AbortSignal): Promise<void>;
+    /**
+     * 在启动暂停期间恢复已导入的当前任务，由调用者准备同一 Agent 的首轮输入。
+     * @param task - 当前账号会话的最后一个任务代次。
+     * @param prepare - 仅给已恢复且仍空闲的 Agent 添加已记录准备输入。
+     * @param signal - 交接激活和 Host 寿命。
+     */
+    preparePlacement(task: ImExecutionAggregate, prepare: (agent: Agent) => Promise<void>, signal: AbortSignal): Promise<void>;
     /** Reuse a live Agent or resume/create its frozen Session and scoped preset. */
     private agentFor;
     /** GUI resume uses preset-only setup; attach the frozen conversation tools then. */
     private attachTools;
-    /** Build one identified Session message whose source reconstructs the whole batch. */
+    /**
+     * Build one identified Session message whose source reconstructs the whole batch.
+     * Text returns before the caller yields. An image batch returns a promise that stores attachment bytes first.
+     * @param agent - Session whose attachment storage receives image bytes.
+     * @param task - admitted execution.
+     * @param admission - frozen batch identity.
+     * @param messages - ordered stored rows.
+     * @returns the Session message, or a promise for it when image bytes must be stored.
+     */
     private admissionMessage;
     /** Await the exact Session append and its persistence barrier before returning. */
     private submit;

package/lib/types/agent-media.d.ts

@@ -0,0 +1,46 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { FileAttachmentRef } from '@deepseek-ai/dsh-attachment';
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+import type { ImRuntime } from './runtime.ts';
+import type { ImDeliveryScope, ImOutboundRequestId, ImOutboundRouteBinding } from './delivery-types.ts';
+interface Delivery {
+    readonly requestId: string;
+    readonly status: string;
+    readonly kind: 'image' | 'file' | 'text';
+    readonly errorCode?: string;
+    readonly file?: FileAttachmentRef;
+}
+interface Unsubmitted {
+    readonly kind: 'image' | 'file' | 'text';
+    readonly path?: string;
+    readonly referenceId?: string;
+}
+/** One attachment, either a Session path or knowledge-image bytes already read by the Host. */
+export interface AgentMediaFile {
+    /** `image` or `file` for a path; knowledge images are `image`. */
+    readonly kind: 'image' | 'file';
+    /** Session-world path. Absent for a knowledge image. */
+    readonly path?: string;
+    /** Knowledge-image reference, when this part was not read from a path. */
+    readonly referenceId?: string;
+    /** Display name for prepared bytes. */
+    readonly name?: string;
+    /** MIME type for prepared bytes. */
+    readonly mime?: string;
+    /** Exact image bytes. Mutually exclusive with `path`. */
+    readonly bytes?: Uint8Array;
+}
+interface BatchResult {
+    requestId: string;
+    status: string;
+    errorCode?: string;
+    message?: string;
+    deliveries: Delivery[];
+    unsubmitted?: Unsubmitted[];
+}
+/** @param ctx - Agent context providing its filesystem and durable attachments. @param runtime - outbox and authorization owner. @param scope - admitted conversation. @param routeBinding - frozen automatic authority. @param files - ordered paths visible in the Session execution world or prepared knowledge images. Path-image MIME comes from file headers; only missing filename suffixes are added. @param text - optional text sent last. @param execution - cancellation and Agent directory owner. @param sendText - existing text-channel operation. @returns ordered terminal results; unsupported path-image headers yield IM_MEDIA_INVALID before new submissions. Processing stops after the first non-success; no automatic resubmission. Exceptions after partial submission retain delivery evidence and identify unsubmitted items; a thrown submission is reconciled with its outbox record before reporting. */
+export declare function sendAgentMedia(ctx: Context, runtime: ImRuntime, scope: ImDeliveryScope, routeBinding: ImOutboundRouteBinding, files: readonly AgentMediaFile[], text: string, execution: ToolExecution, sendText: (requestId: ImOutboundRequestId) => Promise<{
+    requestId: string;
+    status: string;
+}>): Promise<BatchResult>;
+export {};

package/lib/types/agent-prompt.d.ts

@@ -1,13 +1,17 @@
 /** Model-facing IM takeover labels and the scoped system-prompt section. */
+import type { ContentBlock } from '@deepseek-ai/dsh-llm';
 import type { Context } from '@deepseek-ai/cordis';
 import type { ImDeliveryScope, ImInboundMessageView } from './delivery-types.ts';
 import type { ImRuntime } from './runtime.ts';
+/** @param ctx - attachment owner for the admitted Session. @param messages - ordered stored IM rows. @param text - labeled text with inline image bytes removed. @returns logged text and durable image blocks; invalid images reject admission through the attachment provider. */
+export declare function admitImContent(ctx: Context, messages: readonly ImInboundMessageView[], text: string): Promise<ContentBlock[]>;
 /**
  * Render one inbound row for Agent admission or history.
  * @param message - stored inbound with classified sender evidence.
- * @returns one labeled line; counterpart is platform-neutral. The role marker is `[role] body`, never `[role]: body`.
+ * @param timeZone - IANA shop time zone; defaults to Asia/Shanghai.
+ * @returns one receipt-time-prefixed labeled line; counterpart is platform-neutral. The role marker is `[role] body`, never `[role]: body`.
  */
-export declare function formatInbound(message: ImInboundMessageView): string;
+export declare function formatInbound(message: ImInboundMessageView, timeZone?: string): string;
 /**
  * Register the takeover standing rules on one Agent context.
  * @param ctx - unpublished Agent context that owns the section.
@@ -16,3 +20,5 @@ export declare function formatInbound(message: ImInboundMessageView): string;
  * @returns disposer for the section.
  */
 export declare function registerImTakeoverPrompt(ctx: Context, runtime: ImRuntime, scope: ImDeliveryScope): () => void;
+/** 服务重启后的普通跟进输入；先核对副作用，再继续并回复顾客。 */
+export declare const IM_RESTART_PROMPT = "\u670D\u52A1\u521A\u521A\u91CD\u542F\uFF0C\u4E0A\u4E00\u8F6E\u5DE5\u4F5C\u88AB\u4E2D\u65AD\u3002\u8BF7\u68C0\u67E5\u5C1A\u672A\u5B8C\u6210\u7684\u5DE5\u5177\u8C03\u7528\u3001\u6301\u4E45\u5B50\u4F1A\u8BDD\uFF08subagent\uFF09\u548C\u540E\u53F0\u4EFB\u52A1\uFF0C\u9700\u8981\u65F6\u7EE7\u7EED\u5904\u7406\uFF0C\u5E76\u901A\u8FC7 im_send_message \u56DE\u590D\u987E\u5BA2\u3002\u5DF2\u8BB0\u5F55\u5F00\u59CB\u4F46\u6CA1\u6709\u7ED3\u679C\u7684\u5DE5\u5177\u8C03\u7528\uFF0C\u5176\u5916\u90E8\u7ED3\u679C\u672A\u77E5\uFF1A\u8BF7\u5148\u6838\u5BF9\u5B9E\u9645\u72B6\u6001\uFF0C\u53EA\u91CD\u8BD5\u53EA\u8BFB\u6216\u5E42\u7B49\u64CD\u4F5C\uFF0C\u4E0D\u8981\u76F2\u76EE\u91CD\u590D\u6709\u526F\u4F5C\u7528\u7684\u64CD\u4F5C\u3002\u6301\u4E45\u5B50\u4F1A\u8BDD\u53EF\u4EE5\u7EE7\u7EED\uFF1B\u8FDB\u7A0B\u5185\u540E\u53F0\u4EFB\u52A1\u53EF\u80FD\u5DF2\u4E22\u5931\uFF0C\u8BF7\u68C0\u67E5\u540E\u51B3\u5B9A\u5982\u4F55\u6062\u590D\u3002";

package/lib/types/checkpoint-recovery.d.ts

@@ -0,0 +1,32 @@
+/** Cursor-only recovery from a cloud Host whose live Session is unavailable. */
+import type { Branded } from '@deepseek-ai/dsh-brand';
+import type { ImCheckpointCursor } from './checkpoint.ts';
+/** Facts already parsed and authorized by the placement owner; no message bodies are available. */
+export interface ImAccountCheckpointRecovery {
+    readonly checkpoint: {
+        readonly epoch: number;
+        readonly streamCursors: readonly ImCheckpointCursor[];
+        readonly pendingCount: number;
+        readonly unknownSendCount: number;
+        readonly session: {
+            readonly eventCount: number;
+            readonly digest: string;
+        } | null;
+    };
+    /**
+     * The placement owner verified this completed outbound handoff is the last local writer, its target
+     * is the checkpoint's cloud holder, and local automatic reception remained fenced continuously.
+     * Opaque local cursors must also match the checkpoint; this fence alone does not authorize rewind.
+     */
+    readonly sourceFence: {
+        readonly handoffId: Branded<'PlacementHandoffId'>;
+        readonly sourceEpoch: number;
+        readonly committedEpoch: number;
+    };
+}
+/** Recovery cannot reconstruct missing pending input or determine unknown cloud sends. */
+export declare class ImCheckpointRecoveryError extends Error {
+    readonly code: 'IM_CHECKPOINT_BODIES_UNAVAILABLE' | 'IM_CHECKPOINT_STREAM_MISSING' | 'IM_CHECKPOINT_CURSOR_CONFLICT';
+    /** @param code - Safe reason that prevents cursor-only activation. */
+    constructor(code: 'IM_CHECKPOINT_BODIES_UNAVAILABLE' | 'IM_CHECKPOINT_STREAM_MISSING' | 'IM_CHECKPOINT_CURSOR_CONFLICT');
+}

package/lib/types/checkpoint.d.ts

@@ -0,0 +1,127 @@
+/** Throttled hosting checkpoint facts. The report has no message body and no credential. */
+import type { ImAccountId } from './types.ts';
+import type { ImAccountListener } from './types.ts';
+/** Safe machine failure details; error messages, stacks and server payloads are excluded. */
+export interface ImCheckpointDiagnostic {
+    readonly code?: string;
+    readonly status?: number;
+    readonly reason?: 'network' | 'timeout' | 'max-bytes';
+    readonly cause?: ImCheckpointDiagnostic;
+}
+/**
+ * Project thrown failures or server refusals without copying free text.
+ * @param error - failure from fact construction, transport, or the server.
+ * @param seen - visited causes, capped at eight objects.
+ * @returns bounded machine codes, HTTP statuses and enumerated transport reasons only.
+ */
+export declare function checkpointFailureDiagnostic(error: unknown, seen?: Set<object>): ImCheckpointDiagnostic;
+/** One opaque provider cursor. `streamId` and `cursor` contain no message text. */
+export interface ImCheckpointCursor {
+    readonly streamId: string;
+    readonly cursor: string;
+}
+/** Latest durable hosting facts for one account. `session` stays null until an account-level event digest exists. */
+export interface ImCheckpointFacts {
+    readonly streamCursors: readonly ImCheckpointCursor[];
+    readonly session: null;
+    readonly pendingCount: number;
+    readonly unknownSendCount: number;
+    readonly status: 'running' | 'draining' | 'stopped' | 'unavailable';
+}
+/** Safe report outcome. Retry categories omit server payloads; `epoch-rejected` stops this generation until `resume`. */
+export type ImCheckpointReportResult = {
+    readonly kind: 'accepted';
+} | {
+    readonly kind: 'epoch-rejected';
+} | {
+    readonly kind: 'retry';
+    readonly reason: 'NETWORK' | 'TIMEOUT' | 'SERVER_REJECTED' | 'INVALID_RESPONSE' | 'SESSION_EXPIRED' | 'HOST_VERSION_UNAVAILABLE';
+    readonly diagnostic?: ImCheckpointDiagnostic;
+} | {
+    readonly kind: 'skip';
+};
+/** Sends one account's facts. The implementation owns the lease epoch and the server revision. */
+export interface ImCheckpointTransport {
+    /**
+     * Report the latest facts for one account.
+     * @param accountId - Wangwang account that owns the cursors.
+     * @param facts - runtime status and cursors after local persistence.
+     * @param signal - cancelled when the runtime stops.
+     * @returns acceptance, safe retry category, epoch refusal, or no report for an unheld account.
+     */
+    report(accountId: ImAccountId, facts: ImCheckpointFacts, signal: AbortSignal): Promise<ImCheckpointReportResult>;
+}
+/** Why a local snapshot cannot become a checkpoint body. */
+export type ImCheckpointFactsResult = {
+    readonly kind: 'ready';
+    readonly facts: ImCheckpointFacts;
+} | {
+    readonly kind: 'invalid';
+    readonly reason: 'too-many-streams' | 'cursor-not-opaque' | 'count-out-of-range';
+};
+/** Product reception facts; listening for history does not imply automatic reception. */
+export interface ImCheckpointActivity {
+    readonly intent: boolean;
+    readonly admitted: boolean;
+    readonly modelReady: boolean;
+    readonly inFlight: boolean;
+}
+/**
+ * Choose automatic reception status independently of history synchronization.
+ * @param listener - provider inbox listener state.
+ * @param paused - operator account pause.
+ * @param activity - current product intent, admission, model availability, and active processing.
+ * @returns status of automatic reception, rather than inbox connectivity.
+ */
+export declare function checkpointStatus(listener: ImAccountListener | undefined, paused: boolean, activity: ImCheckpointActivity): ImCheckpointFacts['status'];
+/**
+ * Build checkpoint facts from cursors and counts. Message text passed beside those fields is ignored.
+ * @param input - durable cursors and counts for one account. Extra text is not copied.
+ */
+export declare function checkpointFacts(input: {
+    readonly cursors: readonly ImCheckpointCursor[];
+    readonly pendingCount: number;
+    readonly unknownSendCount: number;
+    readonly status: ImCheckpointFacts['status'];
+}): ImCheckpointFactsResult;
+interface Timer {
+    clear(): void;
+}
+/** Coalesces cursor advances into one report per account per interval. */
+export declare class ImCheckpointReporter {
+    private readonly intervalMs;
+    private readonly facts;
+    private readonly transport;
+    private readonly warn;
+    private readonly schedule;
+    private readonly dirty;
+    private readonly halted;
+    private readonly generations;
+    private readonly abort;
+    private timer;
+    private flushing;
+    private disposed;
+    private readonly failures;
+    /**
+     * @param intervalMs - minimum time between reports while facts stay dirty.
+     * @param facts - reads the latest durable facts. It must not include message text.
+     * @param transport - server report. It owns epoch and revision.
+     * @param warn - JSON diagnostic and a separate fixed summary for logger fallbacks; duplicates are suppressed per account until category change or recovery.
+     * @param schedule - timer factory. Tests pass a manual timer.
+     */
+    constructor(intervalMs: number, facts: (accountId: ImAccountId, signal: AbortSignal) => ImCheckpointFactsResult | Promise<ImCheckpointFactsResult>, transport: ImCheckpointTransport, warn: (message: string, summary: string) => void, schedule?: (ms: number, run: () => void) => Timer);
+    /** Record a durable cursor or automatic reception state change. Halted accounts stay local. */
+    note(accountId: ImAccountId): void;
+    /**
+     * Allow reports again after the held lease epoch changes.
+     * The next send uses that new epoch. It does not reuse the rejected epoch.
+     */
+    resume(accountId: ImAccountId): void;
+    /** Stop timers and the in-flight report. Local sqlite rows stay. */
+    dispose(): void;
+    private arm;
+    private diagnose;
+    private recovered;
+    private flush;
+}
+export {};

package/lib/types/consumer-chat-links.d.ts

@@ -0,0 +1,59 @@
+/** Host-owned consumer conversation links, resolved from the current IM account directory. */
+import { Context, Service } from '@deepseek-ai/cordis';
+import type { ImAccountId, ImAccountView, ImPlatform } from './types.ts';
+/** Account and platform selected by the Host; callers cannot supply platform nicknames. */
+export interface ImConsumerChatLinkQuery {
+    readonly accountId: ImAccountId;
+    readonly platform: ImPlatform;
+}
+/** Safe link facts; absence of an identity is distinct from absence of a provider. */
+export type ImConsumerChatLinkResolution = {
+    readonly status: 'ready';
+    readonly accountId: ImAccountId;
+    readonly platform: ImPlatform;
+    readonly url: string;
+} | {
+    readonly status: 'unavailable';
+    readonly reason: 'unsupported' | 'identity-unavailable';
+};
+/** One platform's Host implementation; the signal ends caller or registration ownership. */
+export interface ImConsumerChatLinkProvider {
+    readonly platform: ImPlatform;
+    /** @param request - account obtained from the current directory. @param signal - cancellation of this read. @returns a link or unavailable identity; failures reject. */
+    resolve(request: {
+        readonly account: ImAccountView;
+    }, signal: AbortSignal): Promise<ImConsumerChatLinkResolution>;
+}
+/** Stable failures for link lookup and platform identity reads. */
+export type ImConsumerChatLinkErrorCode = 'IM_CONSUMER_CHAT_LINK_ACCOUNT_NOT_FOUND' | 'IM_CONSUMER_CHAT_LINK_PLATFORM_MISMATCH' | 'IM_CONSUMER_CHAT_LINK_PROVIDER_CONFLICT' | 'IM_CONSUMER_CHAT_LINK_IDENTITY_MISMATCH' | 'IM_CONSUMER_CHAT_LINK_REQUEST_FAILED';
+/** Structured failure; callers report localized copy without exposing the diagnostic cause. */
+export declare class ImConsumerChatLinkError extends Error {
+    readonly code: ImConsumerChatLinkErrorCode;
+    /** @param code - stable failure. @param cause - private underlying error, when available. */
+    constructor(code: ImConsumerChatLinkErrorCode, cause?: unknown);
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        imConsumerChatLinks: ImConsumerChatLinks;
+    }
+    interface Events {
+        /**
+         * A link provider registered or was revoked; previously resolved links must be discarded.
+         * @param platform - changed platform.
+         * @mode emit
+         */
+        'imConsumerChatLinks/changed'(platform: ImPlatform): void;
+    }
+}
+/** Registry with one provider per platform and cancellable reads scoped to each registration. */
+export declare class ImConsumerChatLinks extends Service {
+    private readonly accounts;
+    private readonly providers;
+    /** @param ctx - owning Host. @param accounts - current authoritative account directory, without credentials. */
+    constructor(ctx: Context, accounts: () => readonly ImAccountView[]);
+    /** @param provider - platform implementation. @returns an idempotent disposer that cancels its outstanding reads before notifying consumers. */
+    register(provider: ImConsumerChatLinkProvider): () => void;
+    /** @param query - current account and its platform. @param signal - caller cancellation. @returns a provider result, or unsupported without a provider; unknown accounts, platform mismatch and read failures reject. */
+    resolve(query: ImConsumerChatLinkQuery, signal: AbortSignal): Promise<ImConsumerChatLinkResolution>;
+    private publish;
+}

package/lib/types/delivery-schema.d.ts

@@ -1,20 +1,98 @@
-import { type ZodType } from 'zod';
-import type { ImAdmissionId, ImAgentTaskView, ImInboundOperationResult, ImDeliveryScope, ImInboundMessageInput, ImInboundMessageView, ImMessageId, ImOutboundView, ImScopeId, ImProviderCursorCommitResult, ImProviderCursorId, ImProviderCursorOwner, ImTriggerReason } from './delivery-types.ts';
+import { z, type ZodType } from 'zod';
+import type { ImAdmissionId, ImAdmissionAnnotation, ImAdmissionAnnotationId, ImAdmissionAnnotatorId, ImAgentTaskView, ImInboundOperationResult, ImDeliveryScope, ImInboundMessageInput, ImInboundMessageView, ImMessageId, ImOutboundView, ImScopeId, ImProviderCursorCommitResult, ImProviderCursorId, ImProviderCursorOwner, ImTriggerReason } from './delivery-types.ts';
+import type { ImUploadTarget, ImUploadObservation } from './upload-types.ts';
+/** Captured platform identities; legacy observations omit the whole value. */
+export declare const imUploadIdentitySchema: z.ZodObject<{
+    senderAccountId: z.ZodNullable<z.ZodString>;
+    senderDisplayName: z.ZodNullable<z.ZodString>;
+    senderDomain: z.ZodNullable<z.ZodString>;
+    assignedAccountId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
 export declare const imDeliveryScopeSchema: ZodType<ImDeliveryScope>;
 /** Parser for provider and JSONL inbound records. */
 export declare const imInboundMessageInputSchema: ZodType<ImInboundMessageInput>;
+/** Server V2 control-result fields shared by the journal and queue parsers. */
+export declare const imUploadConversationEventSchema: z.ZodObject<{
+    eventId: z.ZodString;
+    conversationKey: z.ZodString;
+    accountId: z.ZodString;
+    kind: z.ZodEnum<{
+        ai_to_human: "ai_to_human";
+        hosting_disabled: "hosting_disabled";
+        hosting_resumed: "hosting_resumed";
+    }>;
+    occurredAt: z.ZodISODateTime;
+    controlRevision: z.ZodString;
+    relatedMessageIds: z.ZodArray<z.ZodString>;
+    sourceOperationId: z.ZodString;
+    sourceKind: z.ZodLiteral<"dsh-control-result">;
+    payloadHash: z.ZodString;
+}, z.core.$strip>;
+export declare const imUploadObservationSchema: z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./upload-types.ts").ImUploadObservationId, string>>;
+    target: z.ZodObject<{
+        serverOrigin: z.ZodURL;
+        tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<import("@deepseek-ai/dsh-brand").Branded<"MerchantTenantId">, string>>;
+        shopAccountId: z.ZodString;
+        traffic: z.ZodEnum<{
+            formal: "formal";
+            test: "test";
+            simulation: "simulation";
+        }>;
+        testRunId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    scope: z.ZodType<ImDeliveryScope, unknown, z.core.$ZodTypeInternals<ImDeliveryScope, unknown>>;
+    observedAt: z.ZodISODateTime;
+    identity: z.ZodOptional<z.ZodObject<{
+        senderAccountId: z.ZodNullable<z.ZodString>;
+        senderDisplayName: z.ZodNullable<z.ZodString>;
+        senderDomain: z.ZodNullable<z.ZodString>;
+        assignedAccountId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    message: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"inbound">;
+        value: z.ZodType<ImInboundMessageView, unknown, z.core.$ZodTypeInternals<ImInboundMessageView, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"outbound">;
+        value: z.ZodType<ImOutboundView, unknown, z.core.$ZodTypeInternals<ImOutboundView, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"conversation-event">;
+        value: z.ZodObject<{
+            eventId: z.ZodString;
+            conversationKey: z.ZodString;
+            accountId: z.ZodString;
+            kind: z.ZodEnum<{
+                ai_to_human: "ai_to_human";
+                hosting_disabled: "hosting_disabled";
+                hosting_resumed: "hosting_resumed";
+            }>;
+            occurredAt: z.ZodISODateTime;
+            controlRevision: z.ZodString;
+            relatedMessageIds: z.ZodArray<z.ZodString>;
+            sourceOperationId: z.ZodString;
+            sourceKind: z.ZodLiteral<"dsh-control-result">;
+            payloadHash: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>], "kind">;
+}, z.core.$strip>;
 interface StoredDeliveryOperation {
     readonly fingerprint: string;
     readonly result: ImInboundOperationResult;
 }
 /** One durable record per complete conversation scope. */
 export interface ImDeliveryAggregate {
+    readonly uploadIdentities?: Readonly<Record<string, import('./upload-types.ts').ImUploadIdentity>>;
     readonly scope: ImDeliveryScope;
     readonly scopeId: ImScopeId;
+    readonly uploadTargets?: Readonly<Record<string, ImUploadTarget>>;
+    readonly uploadPending?: readonly ImUploadObservation[];
+    readonly uploadObservedAt?: string;
     readonly nextMessageSequenceNumber: number;
     readonly nextOutboundSequenceNumber: number;
     readonly cursor: import('./delivery-types.ts').ImConversationCursor;
     readonly presentation?: import('./delivery-types.ts').ImConversationPresentation;
+    /** Latest platform-provided direct peer identity. Older records omit it. */
+    readonly directRecipient?: import('./types.ts').ImDirectRecipient;
     readonly messages: Readonly<Record<string, ImInboundMessageView>>;
     readonly messageIdsByExternalId: Readonly<Record<string, ImMessageId>>;
     readonly operations: Readonly<Record<string, StoredDeliveryOperation>>;
@@ -36,6 +114,8 @@ export interface ImProviderCursorAggregate {
 export declare const imProviderCursorAggregateSchema: ZodType<ImProviderCursorAggregate>;
 /** Batch frozen before Agent creation or steering begins. */
 export interface ImPendingAdmission {
+    /** Analysis frozen for append/recovery; absence means it has not been attempted. */
+    readonly annotations?: readonly ImAdmissionAnnotation[];
     /** Customer pause generation frozen before asynchronous admission work. */
     readonly handlingEpoch?: number;
     readonly admissionId: ImAdmissionId;
@@ -47,6 +127,50 @@ export interface ImPendingAdmission {
 export interface ImExecutionAggregate extends ImAgentTaskView {
     readonly pendingAdmission?: ImPendingAdmission;
 }
+/** Frozen analysis parse path, shared by JSON records and compatibility fixtures. */
+export declare const imAdmissionAnnotationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotationId, string>>;
+    annotatorId: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotatorId, string>>;
+    version: z.ZodString;
+    status: z.ZodLiteral<"success">;
+    text: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    id: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotationId, string>>;
+    annotatorId: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotatorId, string>>;
+    version: z.ZodString;
+    status: z.ZodEnum<{
+        timeout: "timeout";
+        failed: "failed";
+    }>;
+}, z.core.$strip>], "status">;
+/** Parser for the frozen batch retained until its exact Session append commits. */
+export declare const imPendingAdmissionSchema: z.ZodObject<{
+    annotations: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotationId, string>>;
+        annotatorId: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotatorId, string>>;
+        version: z.ZodString;
+        status: z.ZodLiteral<"success">;
+        text: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        id: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotationId, string>>;
+        annotatorId: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionAnnotatorId, string>>;
+        version: z.ZodString;
+        status: z.ZodEnum<{
+            timeout: "timeout";
+            failed: "failed";
+        }>;
+    }, z.core.$strip>], "status">>>;
+    handlingEpoch: z.ZodOptional<z.ZodNumber>;
+    admissionId: z.ZodPipe<z.ZodString, z.ZodTransform<ImAdmissionId, string>>;
+    messageIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<ImMessageId, string>>>;
+    triggerReasons: z.ZodArray<z.ZodEnum<{
+        direct: "direct";
+        mention: "mention";
+        "every-n": "every-n";
+        "fixed-interval": "fixed-interval";
+    }>>;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strip>;
 /** Parser for one route-bound Agent task generation. */
 export declare const imExecutionAggregateSchema: ZodType<ImExecutionAggregate>;
 export {};