@morlay/ui-conversation-message-actions 0.0.19-alpha.4 → 0.0.19-alpha.6

package/dist/testing.d.mts

@@ -25,6 +25,16 @@ declare namespace Binary {
 /** String/symbol keyed dictionary type. */
 type Dict<T = any, K extends string | symbol = string> = { [key in K]: T; };
 //#endregion
+//#region ../../../vendor/deepseek-harness/vendor/cosmokit/lib/types/volatile.d.ts
+/** Shared config references used by schema validators and plugin runtimes. */
+/** Recursively readonly data returned by a volatile config reference. */
+type VolatileSnapshot<T> = T extends object ? { readonly [K in keyof T]: VolatileSnapshot<T[K]>; } : T;
+/** A stable reference; keep the reference, or capture its value for one operation only. */
+interface Volatile<T> {
+  /** @returns the current immutable snapshot, including undefined for an absent value. */
+  get(): VolatileSnapshot<T>;
+}
+//#endregion
 //#region ../../../node_modules/.pnpm/@standard-schema+spec@1.1.0/node_modules/@standard-schema/spec/dist/index.d.ts
 /** The Standard Typed interface. This is a base type extended by other specs. */
 interface StandardTypedV1$1<Input = unknown, Output = Input> {
@@ -107,9 +117,9 @@ declare const kSchema: unique symbol;
 declare global {
   namespace Schemastery {
     /** Convert primitive constructors, constants, and existing schemas into a schema type. */
-    type From<X> = X extends string | number | boolean ? Schema<X> : X extends Schema ? X : X extends typeof String ? Schema<string> : X extends typeof Number ? Schema<number> : X extends typeof Boolean ? Schema<boolean> : X extends typeof Function ? Schema<Function, (...args: any[]) => any> : X extends Constructor<infer S> ? Schema<S> : never;
-    type TypeS1<X> = X extends Schema<infer S, unknown> ? S : never;
-    type Inverse<X> = X extends Schema<any, infer Y> ? (arg: Y) => void : never;
+    type From<X> = X extends string | number | boolean ? Schema<X> : X extends Schema<any, any, SchemaMode> ? X : X extends typeof String ? Schema<string> : X extends typeof Number ? Schema<number> : X extends typeof Boolean ? Schema<boolean> : X extends typeof Function ? Schema<Function, (...args: any[]) => any> : X extends Constructor<infer S> ? Schema<S> : never;
+    type TypeS1<X> = X extends Schema<infer S, infer _T, infer _M> ? S : never;
+    type Inverse<X> = X extends Schema<infer _S, infer T, infer M> ? (arg: SchemaOutput<T, M>) => void : never;
     /** Input type accepted by a schema-like value. */
     type TypeS<X> = TypeS1<From<X>>;
     /** Output type returned by a schema-like value after validation. */
@@ -117,7 +127,7 @@ declare global {
     /** Resolver callback used by custom schema types registered with `Schema.extend()`. */
     type Resolve = (data: any, schema: Schema, options: Options, strict?: boolean) => [any, any?];
     /** Input type accepted by one schema in an intersection. */
-    type IntersectS<X> = From<X> extends Schema<infer S, unknown> ? S : never;
+    type IntersectS<X> = From<X> extends Schema<infer S, infer _T, infer _M> ? S : never;
     /** Output type returned by one schema in an intersection. */
     type IntersectT<X> = Inverse<From<X>> extends ((arg: infer T) => void) ? T : never;
     type TupleS<X extends readonly any[]> = X extends readonly [infer L, ...infer R] ? [TypeS<L>?, ...TupleS<R>] : any[];
@@ -172,8 +182,8 @@ declare global {
       dict<X, Y extends Schema<any, string> = Schema<string>>(inner: X, sKey?: Y): Schema<Dict<TypeS<X>, TypeS<Y>>, Dict<TypeT<X>, TypeT<Y>>>;
       /** Accept tuple arrays where each index matches the corresponding schema. */
       tuple<const X extends readonly any[]>(list: X): Schema<TupleS<X>, TupleT<X>>;
-      /** Accept plain objects whose declared properties match the schema dictionary. */
-      object<X extends Dict>(dict: X): Schema<ObjectS<X>, ObjectT<X>>;
+      /** Accept plain objects; infer fields from the dictionary, not the enclosing schema's output type. */
+      object<X extends Dict>(dict: X): Schema<ObjectS<NoInfer<X>>, ObjectT<NoInfer<X>>>;
       /** Accept values matching at least one schema in `list`. */
       union<const X>(list: readonly X[]): Schema<TypeS<X>, TypeT<X>>;
       /** Accept values matching every schema in `list`, merging object outputs. */
@@ -181,7 +191,7 @@ declare global {
       /** Validate with `inner`, then convert the result with `callback`. */
       transform<X, T>(inner: X, callback: (value: TypeS<X>, options: Schemastery.Options) => T, preserve?: boolean): Schema<TypeS<X>, T>;
       /** Defer construction of a recursive schema until validation or serialization. */
-      lazy<X extends Schema>(callback: () => X): X;
+      lazy<X extends Schema<any, any, SchemaMode>>(callback: () => X): X;
       ValidationError: typeof ValidationError;
     }
     /** Runtime validation options shared by all schema calls. */
@@ -197,6 +207,8 @@ declare global {
     interface Meta<T = any> {
       default?: T extends {} ? Partial<T> : T;
       required?: boolean;
+      /** Parse this node as a stable config reference; its type and UI metadata remain unchanged. */
+      volatile?: boolean;
       disabled?: boolean;
       collapse?: boolean;
       badges?: {
@@ -220,9 +232,9 @@ declare global {
     }
   }
   /** Callable schema instance that validates input and returns normalized output. */
-  interface Schemastery<S = any, T = S> {
-    (data?: S | null, options?: Schemastery.Options): T;
-    new (data?: S | null, options?: Schemastery.Options): T;
+  interface Schemastery<S = any, T = S, Mode extends SchemaMode = 'plain'> {
+    (data?: S | null, options?: Schemastery.Options): SchemaOutput<T, Mode>;
+    new (data?: S | null, options?: Schemastery.Options): SchemaOutput<T, Mode>;
     [kSchema]: true;
     uid: number;
     meta: Schemastery.Meta<T>;
@@ -242,49 +254,54 @@ declare global {
     /** Format this schema as a compact TypeScript-like type string. */
     toString(inline?: boolean): string;
     /** Serialize this schema, preserving shared and recursive references. */
-    toJSON(): Schema<S, T>;
+    toJSON(): Schema<S, T, Mode>;
     /** Mark nullable input as invalid unless a default supplies a fallback. */
-    required(value?: boolean): Schema<S, T>;
+    required<R extends boolean = true>(value?: R): Schema<S, T, SetRequired<Mode, R>>;
+    /**
+     * Parse this config field as a stable reference containing immutable data.
+     * @returns a schema whose output supports get(), including when the field is absent.
+     */
+    volatile(): Schema<NoInfer<S>, NoInfer<T>, Mode extends 'defined' | 'volatile-defined' ? 'volatile-defined' : 'volatile'>;
     /** Hide this schema node from UI renderers. */
-    hidden(value?: boolean): Schema<S, T>;
+    hidden(value?: boolean): Schema<S, T, Mode>;
     /** Return the default value instead of throwing when validation fails. */
-    loose(value?: boolean): Schema<S, T>;
+    loose(value?: boolean): Schema<S, T, Mode>;
     /** Attach a renderer role and optional role-specific metadata. */
-    role(text: string, extra?: any): Schema<S, T>;
+    role(text: string, extra?: any): Schema<S, T, Mode>;
     /** Attach an external documentation link. */
-    link(link: string): Schema<S, T>;
+    link(link: string): Schema<S, T, Mode>;
     /** Set the fallback value used for nullable input. */
-    default(value: T): Schema<S, T>;
+    default(value: T | NoInfer<Partial<S>>): Schema<S, T, SetRequired<Mode, true>>;
     /** Attach an auxiliary comment for documentation or form UIs. */
-    comment(text: string): Schema<S, T>;
+    comment(text: string): Schema<S, T, Mode>;
     /** Attach a localized or plain description for documentation or form UIs. */
-    description(text: string): Schema<S, T>;
+    description(text: string): Schema<S, T, Mode>;
     /** Mark this schema node as disabled for form UIs. */
-    disabled(value?: boolean): Schema<S, T>;
+    disabled(value?: boolean): Schema<S, T, Mode>;
     /** Request collapsed rendering for nested form UIs. */
-    collapse(value?: boolean): Schema<S, T>;
+    collapse(value?: boolean): Schema<S, T, Mode>;
     /** Add a deprecated badge to this schema node. */
-    deprecated(): Schema<S, T>;
+    deprecated(): Schema<S, T, Mode>;
     /** Add an experimental badge to this schema node. */
-    experimental(): Schema<S, T>;
+    experimental(): Schema<S, T, Mode>;
     /** Require strings to match a regular expression. */
-    pattern(regexp: RegExp): Schema<S, T>;
+    pattern(regexp: RegExp): Schema<S, T, Mode>;
     /** Set an inclusive maximum for numbers or collection lengths. */
-    max(value: number): Schema<S, T>;
+    max(value: number): Schema<S, T, Mode>;
     /** Set an inclusive minimum for numbers or collection lengths. */
-    min(value: number): Schema<S, T>;
+    min(value: number): Schema<S, T, Mode>;
     /** Set the numeric increment constraint. */
-    step(value: number): Schema<S, T>;
+    step(value: number): Schema<S, T, Mode>;
     /** Add or replace an object property schema. */
-    set(key: string, value: Schema): Schema<S, T>;
+    set(key: string, value: Schema): Schema<S, T, Mode>;
     /** Append a tuple, union, or intersection member schema. */
-    push(value: Schema): Schema<S, T>;
+    push(value: Schema): Schema<S, T, Mode>;
     /** Remove values equal to schema defaults from normalized output. */
     simplify(value?: any): any;
     /** Return a schema clone with descriptions merged from locale messages. */
-    i18n(messages: Dict): Schema<S, T>;
+    i18n(messages: Dict): Schema<S, T, Mode>;
     /** Attach arbitrary metadata consumed by form renderers and downstream tools. */
-    extra<K extends keyof Schemastery.Meta>(key: K, value: Schemastery.Meta[K]): Schema<S, T>;
+    extra<K extends keyof Schemastery.Meta>(key: K, value: Schemastery.Meta[K]): Schema<S, T, Mode>;
   }
 }
 declare class ValidationError extends TypeError {
@@ -293,7 +310,10 @@ declare class ValidationError extends TypeError {
   constructor(message: string, options: Schemastery.Options);
   static is(error: any): error is ValidationError;
 }
-type Schema<S = any, T = S> = Schemastery<S, T>;
+type SchemaMode = 'plain' | 'defined' | 'volatile' | 'volatile-defined';
+type SchemaOutput<T, M extends SchemaMode> = M extends 'volatile' ? Volatile<T | undefined> : M extends 'volatile-defined' ? Volatile<T> : T;
+type SetRequired<M extends SchemaMode, R extends boolean> = M extends 'volatile' | 'volatile-defined' ? R extends true ? 'volatile-defined' : 'volatile' : R extends true ? 'defined' : 'plain';
+type Schema<S = any, T = S, Mode extends SchemaMode = 'plain'> = Schemastery<S, T, Mode>;
 declare const Schema: Schemastery.Static;
 //#endregion
 //#region ../../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema.d.cts
@@ -2511,20 +2531,24 @@ declare class SessionProjectionCache extends Service {
   private recordFor;
   /**
    * The zero-I/O listing read: whole values viewed straight from the stored
-   * rows (version-matching keys only), each cut carried with its watermark so
-   * a client value store can seed under its higher-seq-wins rule — as stale
-   * as the last durable checkpoint but never wrong, and never from an
-   * unrelated log (the caller's header is the identity witness). Fresher
-   * paths (the history tail baseline) supersede these values whenever a
-   * session is actually opened.
+   * rows (version-matching keys only) of the record bound to the caller's
+   * lifecycle. The header is the only identity witness a listing holds, so
+   * this face matches the lifecycle identity (`formatVersion`, `createdAt`,
+   * `cwd`, `isSeeded`) and not the inherited cut: within one format
+   * generation the cut is fixed at fork time, so it distinguishes no
+   * lifecycle the other fields do not, and a viewed value never seeds a fold.
+   * The view is as stale as the last durable checkpoint but never wrong and
+   * never from an unrelated log. Its `asOfSeq` is the lowest watermark among
+   * the served rows: the stored record's own position, which the header
+   * cannot relate to the log the caller later opens. The Session list
+   * therefore labels the block as cached, and the client lets every value the
+   * connected Session produces supersede it whatever this number says.
    * @param meta - the listed session's header (identity witness; no log read).
-   * @param inheritedEventCount - exact inherited prefix length that completes
-   * the checkpoint identity.
    * @param keys - optional projection keys required by the caller's audience.
-   * @returns the cut (`asOfSeq` = lowest served-row watermark), or
-   *   `undefined` when no usable row exists for this lifecycle.
+   * @returns the viewed block, or `undefined` when no usable row exists for
+   *   this lifecycle at the current Session format.
    */
-  cachedSnapshot(meta: SessionHeader$1, inheritedEventCount: SessionLogOffset, keys?: readonly Extract<keyof SessionProjectionMap, string>[]): ProjectionSnapshot | undefined;
+  cachedSnapshot(meta: SessionHeader$1, keys?: readonly Extract<keyof SessionProjectionMap, string>[]): ProjectionSnapshot | undefined;
   /**
    * Read only a predecessor checkpoint's title as a zero-I/O listing hint.
    *
@@ -2534,16 +2558,20 @@ declare class SessionProjectionCache extends Service {
    * fact from this Session. The registry still requires the current title
    * projection's row version and schema. No other predecessor projection is
    * exposed: format normalization can change their current meaning, and the
-   * strict {@link cachedSnapshot} / hydration paths continue to reject them.
+   * {@link cachedSnapshot} / hydration paths continue to reject them.
    * @param meta - authoritative listed Session header.
-   * @param inheritedEventCount - exact inherited cut completing the lifecycle identity.
-   * @returns a title-only checkpoint view with `asOfSeq: -1`, or `undefined`
-   *   when the record is current, newer, unrelated, missing, or incompatible
-   *   with the title unit. The sentinel avoids reusing a sequence that a
-   *   cardinality-changing Session migration may have remapped.
-   */
-  cachedPredecessorTitle(meta: SessionHeader$1, inheritedEventCount: SessionLogOffset): ProjectionSnapshot | undefined;
-  /** View selected wire rows and bind them to their lowest served watermark. */
+   * @returns a title-only block at the stored title row's watermark, or
+   *   `undefined` when the record is current, newer, unrelated, missing, or
+   *   incompatible with the title unit.
+   */
+  cachedPredecessorTitle(meta: SessionHeader$1): ProjectionSnapshot | undefined;
+  /**
+   * View selected wire rows as one block bound to the lowest served
+   * watermark: the seq every served value has folded through at least. The
+   * number is the record's own; whether a consumer may compare it with a
+   * live Session's seqs is decided by the face that serves the block, not
+   * here.
+   */
   private viewRecord;
   /**
    * Hydrate projection cells for an already-prepared Session without another
@@ -2627,6 +2655,34 @@ declare module '@deepseek-ai/dsh-typert-protocol' {
     };
   }
 }
+/**
+ * Activity families a `workspace/session-activity` listener may report. This
+ * package declares none: each provider merges its own key from a module both
+ * its Host and Client faces import, so a consumer that renders the families
+ * sees exactly the keys its program compiled and falls through to a generic
+ * description for any other. The shipped providers merge `turn` (the Agent
+ * registry), `job` (the job registry seam), `subagent` (the Subagent
+ * runtime), and `schedule` (the Schedule plugin).
+ */
+interface SessionActivityKindMap {}
+/** One activity family key. */
+type SessionActivityKind = keyof SessionActivityKindMap;
+/** One active item of a family that has per-item identity. */
+interface SessionActivityItem {
+  /** Family-specific identity: a session id, a job id, or a schedule id. */
+  readonly id: string;
+  /** Display label when the family carries one (a job label, a subagent label). */
+  readonly label?: string;
+}
+/**
+ * One reason a session counts as active for archive admission. Families with
+ * per-item identity list their items so a caller can name what must stop.
+ */
+interface SessionActivity {
+  readonly kind: SessionActivityKind;
+  /** Active items of the family; absent for a family without per-item identity (`turn`). */
+  readonly items?: readonly SessionActivityItem[];
+}
 /**
  * One workspace: a stable id over an existing directory, a display title, and
  * an ordered candidate account of sessions. Membership requires both an id in
@@ -2715,10 +2771,52 @@ type WorkspaceId = WorkspaceId$1;
  * @returns the same string, branded at compile time.
  */
 declare function WorkspaceId(id: string): WorkspaceId;
+/** The session an archive request is about to write into the archive set. */
+interface SessionActivityRequest {
+  readonly sessionId: SessionId;
+}
+/** Caller choices for {@link WorkspaceRegistry.archiveSession}. */
+interface ArchiveSessionOptions {
+  /**
+   * Ask the composed providers to stop the session's running work instead of
+   * refusing the archive because of it. The archive is written first, then
+   * the stops are requested; running work is never awaited to settlement, and
+   * a provider failure is logged without undoing the archive.
+   */
+  readonly stopActivity?: boolean;
+}
 declare module '@deepseek-ai/cordis' {
   interface Context {
     workspaceRegistry: WorkspaceRegistry;
   }
+  interface Events {
+    /**
+     * Ask the composed providers what still runs for a session before it is
+     * archived. A listener prepends its own {@link SessionActivity} entries to
+     * the result of `next()`; the registry's innermost callback returns an
+     * empty list, so a composition without providers archives freely. Any
+     * non-empty result refuses the archive without a write.
+     * @param request - the session about to be archived.
+     * @param next - delegate to the remaining providers.
+     * @mode waterfall
+     */
+    'workspace/session-activity'(request: SessionActivityRequest, next: () => Promise<readonly SessionActivity[]>): Promise<readonly SessionActivity[]>;
+    /**
+     * Stop a session's running work because the caller archived it with
+     * `stopActivity`; the archive set is durable when this dispatches. Each
+     * provider stops its own families — cancelling a turn, its subagent
+     * descendants, owned jobs, or active schedules — through the same cancel
+     * paths the user's own stop actions use, so the session log ends every
+     * open turn regularly and a later unarchive can continue the
+     * conversation. Listeners issue their stop requests without waiting for
+     * running work to settle; a listener may await its own durability
+     * barrier. A rejection is logged by the registry and does not undo the
+     * archive.
+     * @param request - the session being archived.
+     * @mode parallel
+     */
+    'workspace/session-stop'(request: SessionActivityRequest): Promise<void> | void;
+  }
 }
 /**
  * Durable workspace registry. Startup waits for `sessionPersistence`, builds
@@ -2753,6 +2851,20 @@ declare class WorkspaceRegistry extends Service {
    * @returns the existing or newly durable workspace.
    */
   create(path: string, title?: string): Promise<Workspace>;
+  /**
+   * Initialize the default Workspace only while both the registry and Session
+   * history are empty. Repeated requests reuse its durable identity; deleting
+   * that registration permanently disables automatic creation.
+   * @param resolveDirectory - resolve the absolute directory and initial title;
+   * called only for eligible creation, inside the registry mutation queue.
+   * Missing directories are created recursively before registration.
+   * After resolution, caller cancellation does not roll back creation or registration.
+   * @returns the initialized Workspace, or undefined when automatic creation is ineligible.
+   */
+  initializeDefault(resolveDirectory: () => Promise<{
+    path: string;
+    title: string;
+  }>): Promise<Workspace | undefined>;
   /**
    * Look up a workspace by id.
    * @param id - Workspace id.
@@ -2793,11 +2905,21 @@ declare class WorkspaceRegistry extends Service {
   /**
    * Archive one session durably. The session must exist (live or in session
    * persistence); its workspace accounting — or lack of one — is irrelevant.
-   * An already archived id resolves without writing.
+   * Without `stopActivity` the session must also be inactive: the
+   * `workspace/session-activity` waterfall is asked once, and any reported
+   * activity rejects with {@link WorkspaceActiveSessionError} before anything
+   * is written. With `stopActivity` the archive is written without an
+   * activity check, and the `workspace/session-stop` providers are then asked
+   * to stop the session's work: the durable archive set is what a provider's
+   * `agent/pre-step` gate reads, so every wake the stops induce is already
+   * blocked. Archiving drops the session's pin in the same durable write
+   * (pinning and archival are mutually exclusive). An already archived id
+   * resolves without writing, asking, or stopping.
    * @param sessionId - The session to archive.
-   * @returns resolution after durability.
+   * @param options - Whether running work is stopped instead of refusing.
+   * @returns resolution after durability and, with `stopActivity`, after every stop request was issued.
    */
-  archiveSession(sessionId: SessionId): Promise<void>;
+  archiveSession(sessionId: SessionId, options?: ArchiveSessionOptions): Promise<void>;
   /**
    * Unarchive one session durably by dropping it from the registry-global
    * archive set; the accounting slot was never touched, so the session
@@ -2809,6 +2931,29 @@ declare class WorkspaceRegistry extends Service {
    * @returns resolution after durability.
    */
   unarchiveSession(sessionId: SessionId): Promise<void>;
+  /**
+   * The registry-global pin set: sessions surfaced ahead of every unpinned
+   * session on grouping surfaces. Pinning never touches workspace accounting.
+   * @returns Session ids in pin order (most recently pinned first).
+   */
+  get pinnedSessionIds(): readonly SessionId[];
+  /**
+   * Pin one session durably, prepending it to the registry-global pin set.
+   * The session must exist (live or in session persistence) and must not be
+   * archived. An already pinned id resolves without writing or reordering.
+   * @param sessionId - The session to pin.
+   * @returns resolution after durability.
+   */
+  pinSession(sessionId: SessionId): Promise<void>;
+  /**
+   * Unpin one session durably by dropping it from the registry-global pin
+   * set. Unpinning runs no session-existence check because removing an id
+   * cannot introduce an unknown one, so an entry whose session is gone still
+   * resolves. An id that is not pinned resolves without writing.
+   * @param sessionId - The session to unpin.
+   * @returns resolution after durability.
+   */
+  unpinSession(sessionId: SessionId): Promise<void>;
   /**
    * Whether a session is live, header-indexed, or present in a fresh
    * persistence listing. Only a definite miss returns false — a failing
@@ -2816,6 +2961,8 @@ declare class WorkspaceRegistry extends Service {
    * masquerade as an unknown session.
    */
   private sessionKnown;
+  /** Request every provider's stop; a failing provider is logged, never a reason to keep the session visible. */
+  private stopSessionActivity;
   /**
    * Resolve by canonical directory path without creating or mutating a
    * workspace. A missing path rejects during `realpath`; an existing unowned
@@ -2854,364 +3001,6 @@ declare function parseJsonlArtifact(content: string): SessionStorageMetadata & {
   events: SessionEvent$1[];
 };
 //#endregion
-//#region ../../../vendor/deepseek-harness/packages/settings/settings/lib/types/redact.d.ts
-/** One schema-declared secret position inside a redacted value. */
-interface RedactedSecret {
-  /** Path from the section root to the removed field (concrete dict keys and array indexes included). */
-  path: string[];
-  /** Whether the field held a value before redaction. */
-  set: boolean;
-}
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/settings/settings/lib/types/types.d.ts
-/** Nominal id of one registered settings namespace. */
-type SettingsNamespace = Branded<'SettingsNamespace'>;
-/** Origin of one committed settings change. */
-type SettingsUpdateSource = 'update' | 'provider';
-declare module '@deepseek-ai/cordis' {
-  interface Events {
-    /**
-     * Committed change to one registered namespace's resolved value. Emitted
-     * after the provider persisted (for `update`) or published (`provider`)
-     * the change; never emitted when the resolved value is deep-equal.
-     * Listener failures are contained and logged — a sync throw and an async
-     * rejection alike — except `INVARIANT`-coded failures, which rethrow
-     * after every listener ran; that rethrow reaches the emitter only from
-     * synchronous listeners, so invariant checks on this event must not be
-     * async functions.
-     * @param ns - the namespace whose resolved value changed.
-     * @param next - the new resolved value.
-     * @param prev - the previous resolved value.
-     * @param source - whether the change entered through `update()` or the provider.
-     * @mode emit
-     */
-    'settings/updated'(ns: SettingsNamespace, next: unknown, prev: unknown, source: SettingsUpdateSource): void;
-    /**
-     * One registered namespace's RAW user section changed, whether or not the
-     * resolved value did. `settings/updated` is the consumer-facing event and
-     * stays deep-equal-gated; this one exists for configuration surfaces,
-     * which must learn that a field went from inherited to overridden (same
-     * resolved value, different meaning) and that their held revision is
-     * stale. Listener containment matches `settings/updated`.
-     * @param ns - the namespace whose stored section changed.
-     * @param revision - the namespace's new revision.
-     * @mode emit
-     */
-    'settings/document-updated'(ns: SettingsNamespace, revision: number): void;
-  }
-}
-//#endregion
-//#region ../../../vendor/deepseek-harness/packages/settings/settings/lib/types/index.d.ts
-type LowercaseLetter = 'a' | 'b' | 'c' | 'd' | 'e' | 'f' | 'g' | 'h' | 'i' | 'j' | 'k' | 'l' | 'm' | 'n' | 'o' | 'p' | 'q' | 'r' | 's' | 't' | 'u' | 'v' | 'w' | 'x' | 'y' | 'z';
-type DecimalDigit = '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9';
-type NamespaceCharacter = LowercaseLetter | DecimalDigit | '-';
-type ValidNamespaceTail<Value extends string> = Value extends '' ? true : Value extends `${NamespaceCharacter}${infer Rest}` ? ValidNamespaceTail<Rest> : false;
-type SettingsNamespaceInput<Value extends string> = Value extends SettingsNamespace ? Value : string extends Value ? string : Value extends `${LowercaseLetter}${infer Rest}` ? ValidNamespaceTail<Rest> extends true ? Value : never : never;
-/** When a namespace's changes take effect for its owner. */
-type SettingsApplies = 'live' | 'restart';
-/** Registration options beyond the namespace schema. */
-interface SettingsRegisterOptions<T> {
-  /** Composition-layer values resolved below the user layer (entry-config subset). */
-  base?: Partial<T>;
-  /** Owner's effect timing, surfaced to configuration UIs; defaults to `live`. */
-  applies?: SettingsApplies;
-  /**
-   * Reject a resolved section the owner could not act on, for constraints its
-   * schema cannot express — a cross-field requirement, or one field's validity
-   * depending on another's. Throwing here refuses the *write* that produced the
-   * value, so a caller learns at `update`/`replace`/`mutate` instead of storing
-   * something that would silently disable the owner.
-   *
-   * Kept separate from the schema because the schema is also what a
-   * configuration surface renders and what an absent section resolves through;
-   * folding a cross-field check into it would change both.
-   *
-   * Once the owner is registered, a stored section that fails this keeps the
-   * namespace's last good value and warns, exactly as a schema failure does,
-   * so an externally edited document cannot strand a running owner. At
-   * registration there is no last good value yet, so a stored section that
-   * already fails rejects the registration itself — again exactly as a schema
-   * failure does.
-   * @param value - the resolved section, schema-valid by construction.
-   */
-  validate?: (value: T) => void;
-}
-/** One registered namespace as surfaced to configuration UIs. */
-interface SettingsDescriptor {
-  /** The registered namespace. */
-  ns: SettingsNamespace;
-  /** Serialized schemastery schema (`schema.toJSON()`). */
-  schema: unknown;
-  /** Current resolved value. */
-  value: unknown;
-  /**
-   * Monotonic revision of the raw user section this descriptor was read at.
-   * Send it back as `expectedRevision` on a write to refuse a stale one.
-   */
-  revision: number;
-  /** Registrant's composition `base` layer (detached), when one was declared. */
-  base?: unknown;
-  /**
-   * Raw user section from the stored document (detached), when one exists and
-   * is well-formed; a field's presence here is what marks it user-overridden.
-   */
-  user?: unknown;
-  /** Owner's declared effect timing. */
-  applies: SettingsApplies;
-  /** Schema-declared secret positions; present only under `redactSecrets`. */
-  secrets?: RedactedSecret[];
-}
-/** Options for {@link SettingsProvider.describe}. */
-interface SettingsDescribeOptions {
-  /**
-   * Strip `role('secret')` fields from `value`/`base`/`user` and enumerate
-   * them in each descriptor's `secrets`. Every wire surface MUST pass this;
-   * the verbatim default exists for same-process configuration UIs only.
-   */
-  redactSecrets?: boolean;
-}
-/** Owner-facing handle for one registered namespace. */
-interface SettingsScope<T> {
-  /** Current resolved value: schema defaults, then `base`, then the user layer. */
-  get(): T;
-  /**
-   * Observe committed changes to this namespace's resolved value. Invocations
-   * of one callback run asynchronously, one at a time, in commit order; a
-   * rejection is contained and logged like a sync throw. After the disposer
-   * returns, no further invocation starts — one already queued is skipped;
-   * one already started still settles, and service disposal waits for it.
-   * @param callback - invoked after each commit with the next and previous values.
-   * @returns the disposer removing this observer.
-   */
-  watch(callback: (next: T, prev: T) => void | Promise<void>): () => void;
-  /**
-   * Merge a partial patch into this namespace's user layer and persist it.
-   * @param patch - plain-object patch over the user section; JSON-compatible data
-   * only (non-JSON values reject with their path before anything persists).
-   */
-  update(patch: object): Promise<void>;
-  /**
-   * Replace this namespace's user section wholesale; absent keys re-inherit
-   * the composition `base` and schema defaults (`replace({})` resets all).
-   * @param section - the complete next user section; JSON-compatible data only,
-   * as for {@link update}.
-   */
-  replace(section: object): Promise<void>;
-}
-declare module '@deepseek-ai/cordis' {
-  interface Context {
-    settings: SettingsProvider;
-  }
-}
-/**
- * One path-addressed edit to a namespace's user section. Path mutation exists
- * for a caller holding an INCOMPLETE view of the section — a configuration UI
- * reads the redacted descriptor, which by construction never received the
- * `role('secret')` fields. Such a caller can name the field it means without
- * restating the section: a wholesale `replace` rebuilt from a redacted
- * document silently deletes every secret the wire never returned.
- */
-type SettingsPathOp = {
-  op: 'set';
-  path: readonly string[];
-  value: unknown;
-} | {
-  op: 'unset';
-  path: readonly string[];
-};
-/**
- * Abstract settings service. Providers implement raw-document storage
- * (`load`/`persist`) and push external changes through {@link Settings.publish};
- * the base class owns namespace registration, resolution, validation, change
- * detection, and the `settings/updated` commit event.
- */
-declare abstract class SettingsProvider extends Service {
-  private readonly registrations;
-  /** Latest published raw document; empty until the provider's first publish. */
-  private document;
-  /** Per-namespace write chains; settled tails, so a failure never poisons the queue. */
-  private readonly writeQueues;
-  /** In-flight watcher invocation segments, drained by the dispose teardown. */
-  private readonly pendingTails;
-  /** Set at service dispose: refuse new writes while queued ones drain. */
-  private stopped;
-  /** Opaque read of {@link stopped}: control flow cannot narrow it across awaits. */
-  private isStopped;
-  constructor(ctx: Context);
-  /**
-   * Load the provider's document once and publish it before the service
-   * becomes injectable, and register the write-drain teardown. Providers with
-   * their own init (watchers, connections) delegate here first via
-   * `yield* super[Service.init]()`; their disposers then run before the drain.
-   */
-  [Service.init](): AsyncGenerator<() => Promise<void> | void, void, void>;
-  /** Whether {@link update} may persist through this provider. */
-  abstract readonly writable: boolean;
-  /**
-   * Absolute path of the provider's user-editable document, when its storage
-   * is one local file. Configuration surfaces use this only as availability
-   * metadata; the guarded open operation resolves the path again Host-side.
-   * Non-file providers leave it undefined and expose no open-document affordance.
-   * @returns the absolute local document path, or undefined for non-file storage.
-   */
-  get documentPath(): string | undefined;
-  /**
-   * Prepare the provider's user-editable document for a native editor. File
-   * providers may materialize an absent document before returning its path;
-   * non-file providers return undefined.
-   * @returns the absolute local document path, or undefined for non-file storage.
-   */
-  prepareDocument(): Promise<string | undefined>;
-  /**
-   * Read the provider's current raw document (namespace to raw section).
-   * @returns the detached raw document.
-   */
-  protected abstract load(): Promise<Record<string, unknown>>;
-  /**
-   * Durably store one namespace's merged user section.
-   * @param ns - the namespace being written.
-   * @param section - the complete merged user section to store.
-   */
-  protected abstract persist(ns: SettingsNamespace, section: Record<string, unknown>): Promise<void>;
-  /**
-   * Register a namespace schema and receive its owner scope. The registration
-   * is an effect on the calling plugin's fiber: disposing that fiber removes
-   * the namespace and its observers. An invalid stored section fails the
-   * registration itself — the earliest point where the schema can judge it.
-   * @param ns - unique namespace; duplicate registration fails loud.
-   * @param schema - schemastery schema resolving this namespace's value.
-   * @param options - composition `base` layer and effect timing.
-   * @returns the owner scope for reads, observation, and updates.
-   * @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-   */
-  register<const Namespace extends string, T>(ns: Namespace & SettingsNamespaceInput<Namespace>, schema: Schema<T>, options?: SettingsRegisterOptions<T>): SettingsScope<T>;
-  /**
-   * Attach one optional-settings consumer to this provider. The consumer
-   * registers its composition entry as the base layer while this provider is
-   * present, then falls back to that entry if the provider detaches.
-   * @param owner - consumer context whose unload suppresses fallback work.
-   * @param ns - consumer-owned settings namespace.
-   * @param schema - schema resolving the namespace.
-   * @param entry - composition entry used as the base and fallback value.
-   * @param hooks - source sink, change notification, and optional validation.
-   * @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-   */
-  installSection<const Namespace extends string, T>(owner: Context, ns: Namespace & SettingsNamespaceInput<Namespace>, schema: Schema<T>, entry: T, hooks: SettingsSectionHooks<T>): void;
-  /**
-   * Describe every registered namespace for configuration surfaces, including
-   * the composition `base` and raw user layers so a form can mark which fields
-   * the user overrode (presence in `user`) and what a reset returns to.
-   * @param options - redaction switch; wire surfaces must redact.
-   * @returns one descriptor per registered namespace, in registration order.
-   */
-  describe(options?: SettingsDescribeOptions): SettingsDescriptor[];
-  /**
-   * Read one registered namespace's resolved value.
-   * @param ns - the namespace to read.
-   * @returns the resolved value, or `undefined` while unregistered.
-   * @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-   */
-  get<const Namespace extends string>(ns: Namespace & SettingsNamespaceInput<Namespace>): unknown;
-  /**
-   * Merge a patch into one registered namespace's user layer, validate the
-   * resolved candidate, persist through the provider, then commit and emit.
-   * A validation failure rejects before anything is persisted. Writes to one
-   * namespace are serialized: concurrent updates apply in call order, each
-   * merging over the previous write's committed section.
-   * @param ns - the registered namespace to update.
-   * @param patch - plain-object patch over the user section.
-   * @param expectedRevision - the descriptor `revision` the caller read; a
-   *   namespace that moved past it rejects with {@link SettingsConflictError}.
-   * @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-   */
-  update<const Namespace extends string>(ns: Namespace & SettingsNamespaceInput<Namespace>, patch: object, expectedRevision?: number): Promise<void>;
-  /**
-   * Replace one registered namespace's user section wholesale, validate,
-   * persist, then commit and emit. Keys absent from `section` fall back to the
-   * composition `base` and schema defaults — this is the removal/reset path a
-   * merge-only patch cannot express (`replace({})` re-inherits everything).
-   * @param ns - the registered namespace to replace.
-   * @param section - the complete next user section.
-   * @param expectedRevision - the descriptor `revision` the caller read; a
-   *   namespace that moved past it rejects with {@link SettingsConflictError}.
-   * @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-   */
-  replace<const Namespace extends string>(ns: Namespace & SettingsNamespaceInput<Namespace>, section: object, expectedRevision?: number): Promise<void>;
-  /**
-   * Apply path-addressed edits to one registered namespace's user section,
-   * validate, persist, then commit and emit. The ops are applied to the
-   * section as it stands when the write reaches the front of the queue, so a
-   * caller never has to restate fields it did not touch — and, crucially,
-   * cannot delete fields it never saw. This is the write path for any caller
-   * holding a redacted view; `replace` remains the wholesale reset.
-   * @param ns - the registered namespace to edit.
-   * @param ops - ordered path edits; later ops observe earlier ones.
-   * @param expectedRevision - the descriptor `revision` the caller read; a
-   *   namespace that moved past it rejects with {@link SettingsConflictError}.
-   * @throws {TypeError} when `ns` is not a lowercase hyphenated identifier.
-   */
-  mutate<const Namespace extends string>(ns: Namespace & SettingsNamespaceInput<Namespace>, ops: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>;
-  /** Validate a write, then queue it on the namespace's serialized write chain. */
-  private write;
-  /**
-   * Provider hook: commit a complete raw document observed in storage. Each
-   * registered namespace re-resolves; an invalid section keeps that
-   * namespace's last good value and warns, other namespaces still commit.
-   * @param doc - the detached raw document (unregistered sections preserved).
-   * @param source - change origin; defaults to `provider`.
-   */
-  protected publish(doc: Record<string, unknown>, source?: SettingsUpdateSource): void;
-  /** Read one namespace's raw user section, rejecting non-object sections. */
-  private section;
-  /** Resolve one namespace value: schema defaults, then `base`, then the user layer. */
-  private resolve;
-  /**
-   * Advance a namespace's revision when its RAW section changed, and announce
-   * it. Deliberately independent of {@link commit}'s resolved-value equality:
-   * storing an override equal to the composition base leaves the resolved
-   * value alone but changes what the document says, which is exactly what a
-   * configuration surface must re-read.
-   */
-  private bumpRevision;
-  /** Contained fan-out of `settings/document-updated`, mirroring {@link commit}'s. */
-  private emitDocumentUpdated;
-  /** Commit a resolved value when changed: swap, notify watchers, emit the event. */
-  private commit;
-  /** Contained-watcher diagnostic shared by the sync and async failure paths. */
-  private warnWatcherFailure;
-  /** Contained-listener diagnostic shared by the sync and async failure paths. */
-  private warnListenerFailure;
-}
-/** Hooks a consumer hands to {@link SettingsProvider.installSection}. */
-interface SettingsSectionHooks<T> {
-  /**
-   * Receive the active configuration source: the resolved settings scope
-   * while one is attached, the composition entry otherwise. Called before
-   * the matching `onChange` at attach and at detach.
-   * @param current - thunk returning the currently authoritative value.
-   */
-  setSource(current: () => T): void;
-  /**
-   * Re-judge anything derived from the source — registration-level facts,
-   * memoized resolutions — after an attach, a detach, or a committed change.
-   */
-  onChange(): void;
-  /**
-   * Reject a resolved section this consumer could not act on, for constraints
-   * its schema cannot express. See {@link SettingsRegisterOptions.validate}.
-   * @param value - the resolved section, schema-valid by construction.
-   */
-  validate?: (value: T) => void;
-}
-//#endregion
-//#region ../session-rdb/src/testing/helpers.d.ts
-declare class EmptySettings extends SettingsProvider {
-  constructor(ctx: Context);
-  get writable(): boolean;
-  protected load(): Promise<Record<string, unknown>>;
-  protected persist(_ns: SettingsNamespace, _section: Record<string, unknown>): Promise<void>;
-}
-//#endregion
 //#region ../session-rdb/src/testing/contract.d.ts
 declare function meta(id: string, cwd?: string): SessionHeader$1;
 declare function oneTurnLog(): SessionEvent$1[];
@@ -3239,4 +3028,4 @@ declare function turnLog(base: number, turn: number, opts?: {
   time?: number;
 }): SessionEvent[];
 //#endregion
-export { EmptySettings, Harness, SESSION_EDITOR_PATH, Session, type SessionEvent, type SessionHeader, SessionIdBrand, SessionSeq, SessionStore, TokenMeter, assistantMessage, createPersisted, harness, meta, oneTurnLog, parseJsonlArtifact, turnLog, twoTurnLog, userMessage };
+export { Harness, SESSION_EDITOR_PATH, Session, type SessionEvent, type SessionHeader, SessionIdBrand, SessionSeq, SessionStore, TokenMeter, assistantMessage, createPersisted, harness, meta, oneTurnLog, parseJsonlArtifact, turnLog, twoTurnLog, userMessage };