@mstar-harness/dsh 3.7.3 → 3.8.0

package/dist/engine-status-endpoint.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Host half of the panel's engine-status channel: the `mstar/engineStatus`
+ * endpoint on the host's SHARED `/api` typert gateway.
+ *
+ * WHY this shape: a plugin cannot own a route. The host's typertGateway owns
+ * the single `/api` interceptor (`connection.rpc.intercept('/api')` would
+ * throw), and a third-party `connection.rpc.handle(...)` channel mounts through
+ * `webServer` on the CALLING fiber — which would force `webServer` into this
+ * plugin's static inject and pend the row on a base-only profile. The working
+ * third-party pattern is therefore a cordis service extending
+ * `TypertRemoteService` (the namespace IS the service key) whose endpoint
+ * descriptors are contributed with `ctx.typert.register(...)` from an OPTIONAL
+ * child (`ctx.inject(['typert'], …)`): a composition without a typert registry
+ * simply has no `/api` endpoints, and the plugin's runtime keeps working.
+ *
+ * The browser half calls `connection.rpc.call('/api', 'mstar/engineStatus',
+ * { args: { sessionId, cwd } })` — the payload contract is exactly one
+ * plain-object `args` field keyed by the declared parameter names.
+ *
+ * HARD constraint — headless boot safety: this module is reachable from
+ * `apply`, and it must never make the host row statically inject `connection`
+ * or `webServer`. Everything web-only is inside the optional inject child; the
+ * endpoint's own reads (`ctx.get('sessions')`, `ctx.get('sessionController')`)
+ * are structural and degrade when the service is absent.
+ *
+ * VALIDATION CHAIN — the endpoint serves ONE session's snapshot and answers
+ * otherwise. In order:
+ *  1. argument shape (non-empty ids, an absolute traversal-free `cwd`);
+ *  2. the session is resolved SERVER-side — the live `ctx.sessions.get(id)`
+ *     first, then the session controller's persisted `inspect(id)` fallback;
+ *  3. the `{HARNESS_DIR}` comes from the SERVER-side session cwd (or the
+ *     boot-resolved config root) — never from client-asserted input;
+ *  4. the store entry for that session must exist;
+ *  5. the client-asserted `cwd` must EQUAL the record's `cwd`, and the record's
+ *     `cwd` must equal the resolved session's cwd.
+ * Every failure returns the explicit unavailable state WITH a reason: never
+ * another session's data, never a silently-close match, never a path built from
+ * unvalidated input.
+ *
+ * @module @mstar-harness/dsh/engine-status-endpoint
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { TypertContribution } from '@deepseek-ai/dsh-typert-registry';
+import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
+import type { HarnessResolver } from './gates/_shared.ts';
+import { MSTAR_ENGINE_STATUS_METHOD, MSTAR_ENGINE_STATUS_NAMESPACE } from './engine-status-wire.ts';
+export { MSTAR_ENGINE_STATUS_METHOD, MSTAR_ENGINE_STATUS_NAMESPACE };
+/** The served snapshot (the stored emission, echoed back with its identity). */
+export interface MstarEngineStatusOk {
+    readonly status: 'ok';
+    readonly sessionId: string;
+    readonly cwd: string;
+    /** ISO timestamp of the emission the entry records. */
+    readonly at: string;
+    /** The agent turn the row was emitted for. */
+    readonly turn: number;
+    /** The exact catalog payload emitted to that session's model. */
+    readonly payload: Record<string, unknown>;
+}
+/**
+ * The explicit "no answer" result. `reason` is machine-readable and always
+ * present — a degraded path is never silent.
+ */
+export interface MstarEngineStatusUnavailableResult {
+    readonly status: 'unavailable';
+    readonly reason: string;
+}
+/** The endpoint's wire result. */
+export type MstarEngineStatusResult = MstarEngineStatusOk | MstarEngineStatusUnavailableResult;
+/** Options the endpoint needs from the plugin's apply scope. */
+export interface MstarEngineStatusEndpointOptions {
+    /** The per-workspace `{HARNESS_DIR}` resolver (the same one the gates use). */
+    readonly resolver: HarnessResolver;
+    /** The boot-resolved config root when an explicit `harnessDir` is configured. */
+    readonly bootHarnessDir: string | null;
+}
+/**
+ * Host-side `mstar/engineStatus` service: `/api/mstar/engineStatus` serves the
+ * stored snapshot of the session the caller asserts.
+ */
+export declare class MstarEngineStatusGateway extends TypertRemoteService {
+    private readonly resolver;
+    private readonly bootHarnessDir;
+    /**
+     * @param ctx - owning Cordis context.
+     * @param options - the apply-scoped resolver + boot root.
+     */
+    constructor(ctx: Context, options: MstarEngineStatusEndpointOptions);
+    /**
+     * Serve one session's stored engine-status snapshot after the validation
+     * chain documented in the module header.
+     * @param sessionId - the session whose snapshot is requested (client-asserted).
+     * @param cwd - the session workspace the client believes it is reading (client-asserted).
+     * @returns the stored emission, or the explicit unavailable state with a reason.
+     */
+    engineStatus(sessionId: string, cwd: string): Promise<MstarEngineStatusResult>;
+    /** The validation chain itself (contained by {@link engineStatus}). */
+    private serve;
+    /**
+     * Resolve the authoritative cwd of one session: the LIVE session first
+     * (`ctx.sessions.get(id)`), then the session controller's persisted
+     * `inspect(id)` fallback for a session that is not currently attached.
+     * A missing service, a missing session or a cwd-less header is an explicit
+     * unavailable reason, never a guess.
+     */
+    private resolveSessionCwd;
+}
+/**
+ * The generated-style invocation descriptor for `/api/mstar/engineStatus`.
+ *
+ * Registered EXPLICITLY (not through `@Remote` SRC markers): the host gateway
+ * checks its own `ctx.typert.local` table FIRST, while SRC discovery reads a
+ * module-private marker table that a locally-resolved plugin copy can never
+ * share with the host installation.
+ */
+export declare function mstarEngineStatusContribution(): TypertContribution;
+/**
+ * Install the host half of the channel on one apply scope.
+ *
+ * Two optional units, never a static inject on the plugin row:
+ *  - the `mstar` service — `engineStatusServicePresent` above is the admission
+ *    test, so a second apply on the same context (a sibling fiber, an HMR
+ *    re-apply) does not construct a second gateway and keeps the FIRST instance
+ *    with its own resolver/boot root. Constructing a second one would make the
+ *    service's `provide` find the name taken and throw out of the child effect,
+ *    so the present-check is the primary dedupe and the `has been registered`
+ *    catch arm below covers what it cannot see: the concurrent-apply window, and
+ *    an unreadable registry (the helper falls through in both cases);
+ *  - the endpoint contribution, registered inside `ctx.inject(['typert'], …)`
+ *    and returning that registration's own disposer — so the endpoints withdraw
+ *    with the child fiber (or when the typert service goes away).
+ *
+ * DESCRIPTOR DEDUPE RESTS ON THE CATCH ARM. The registry does serve a presence
+ * probe — `local.get(endpoint)` answers the LIVE descriptor, or `undefined` when
+ * absent — but a pre-flight check cannot close the concurrent-apply window (two
+ * applies can both read it absent before either registers), so the registration
+ * itself stays the authoritative test. `local.hasSeen(endpoint)` is no
+ * substitute: it is a HISTORY probe, `true` for an endpoint registered at least
+ * once and staying `true` after it is withdrawn, so as a presence test it would
+ * skip re-registration for the endpoint a reload withdrew. A duplicate makes
+ * `register` throw, the arm swallows exactly that error and returns a no-op
+ * disposer, so a deduped apply can never withdraw another fiber's endpoint. The
+ * cost of that is the dependency on typert's error text (`already registered`);
+ * a `get`-based pre-check is the way to drop the dependency — it precedes the
+ * arm, but cannot replace it.
+ *
+ * Withdrawal follows ownership: the endpoint lives exactly as long as its OWNER
+ * fiber does. A deduped sibling that disposes withdraws nothing (it registered
+ * nothing); the owner disposing withdraws the service and the endpoints, and a
+ * later apply on a live context registers them afresh.
+ * @param ctx - the plugin's apply context.
+ * @param options - the apply-scoped resolver + boot root.
+ */
+export declare function installEngineStatusEndpoint(ctx: Context, options: MstarEngineStatusEndpointOptions): void;

package/dist/engine-status-store.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Durable engine-status snapshot store — the edge-safe catalog source that a
+ * web-only reader (panel/endpoint) can serve WITHOUT re-running the in-process
+ * resolution that produces the step catalog.
+ *
+ * WHY a snapshot: the composed catalog payload is only available at the
+ * digest-gated `agent/pre-step` emission; a later reader (a different fiber,
+ * or the host endpoint answering a browser request) cannot rebuild it — it
+ * would re-resolve `{HARNESS_DIR}`, re-scan status/compass/residual, and could
+ * answer with state that never reached the model. Persisting the EXACT emitted
+ * payload at the emission site makes the served value a record of what the
+ * model actually saw, keyed by the session that saw it.
+ *
+ * File: `{HARNESS_DIR}/snapshots/engine-status.json`
+ *
+ * ```json
+ * {
+ *   "sv": 1,
+ *   "entries": { "<session id>": [ { "rv": 1, "cwd": "/proj", "at": "…", "turn": 3, "payload": { … } } ] }
+ * }
+ * ```
+ *
+ * `sv` is the envelope schema version and `rv` the per-entry record version:
+ * a reader that does not recognize EITHER must answer "unavailable" rather
+ * than parse a shape it does not understand — and (write rule below) a writer
+ * must refuse rather than replace one.
+ *
+ * Durability discipline (same as the agent-flow ledger):
+ * - every write runs under the per-directory inter-process write lock
+ *   ({@link withWorkflowDirLock} — atomic `mkdir` lockdir, the package's
+ *   single lock primitive);
+ * - the file itself is replaced by `writeFileSync(<writer-unique>.tmp)` +
+ *   `renameSync` (atomic replace — concurrent readers never observe a torn
+ *   file, and the failure cleanup can only ever remove its own temp file);
+ * - retention is enforced on EVERY write: newest
+ *   {@link ENGINE_STATUS_SNAPSHOT_MAX_PER_SESSION} entries per session,
+ *   nothing older than {@link ENGINE_STATUS_SNAPSHOT_MAX_AGE_MS}, and the whole
+ *   envelope under {@link ENGINE_STATUS_SNAPSHOT_MAX_BYTES}.
+ *
+ * READ RULE (HARD): `sv !== 1`, an unknown shape, an unreadable file, or an
+ * absent file all yield the explicit {@link EngineStatusUnavailable} result.
+ * A best-effort parse is never returned — a reader must not present guessed
+ * state as the model's state.
+ *
+ * WRITE RULE (HARD): the same rule governs the writer. An existing envelope
+ * whose `sv` is unknown, whose JSON is torn, or that cannot be read is NOT
+ * replaceable: the write refuses with the explicit `degraded` reason and
+ * leaves the bytes untouched. Every session's snapshots live in that one file,
+ * so "start from an empty envelope" would silently destroy the snapshots of
+ * every other session sharing this `{HARNESS_DIR}` — a store the writer does
+ * not understand is never the writer's to overwrite (a version flap between
+ * two plugin builds, or a hand-truncated file, must not become data loss).
+ *
+ * BOUNDS: retention is per-session ({@link ENGINE_STATUS_SNAPSHOT_MAX_PER_SESSION}
+ * + {@link ENGINE_STATUS_SNAPSHOT_MAX_AGE_MS}) AND global
+ * ({@link ENGINE_STATUS_SNAPSHOT_MAX_BYTES}): a store above the byte ceiling
+ * sheds its least-recently-written session buckets — oldest first, never the
+ * writing session — and the write path reports the oversize condition ONCE per
+ * store so the host can log the one warning the containment contract promises
+ * instead of a warning per turn.
+ *
+ * KEYING (HARD): both session maps are prototype-less (`Object.create(null)`),
+ * and the read path gates on `Object.hasOwn`. The session id is caller-chosen
+ * on the host's `session.create` (a branded string with no shape validation),
+ * so an id equal to an `Object.prototype` member (`__proto__`, `constructor`,
+ * `toString`, …) must be an ordinary key: on a plain object literal it would
+ * instead read an inherited member (a non-array → `TypeError`) or hit the
+ * `__proto__` setter (reported `written` while persisting nothing).
+ *
+ * @module @mstar-harness/dsh/engine-status-store
+ */
+/** Envelope schema version carried by the snapshot file (`sv`). */
+export declare const ENGINE_STATUS_SNAPSHOT_VERSION = 1;
+/** Per-entry record version carried by every stored entry (`rv`). */
+export declare const ENGINE_STATUS_SNAPSHOT_ENTRY_VERSION = 1;
+/** Retention: newest entries kept per session (older ones are pruned on write). */
+export declare const ENGINE_STATUS_SNAPSHOT_MAX_PER_SESSION = 50;
+/** Retention: maximum entry age (30 days) — older entries are pruned on write. */
+export declare const ENGINE_STATUS_SNAPSHOT_MAX_AGE_MS: number;
+/**
+ * Retention: global byte ceiling for one store — the bound the per-session
+ * numbers above cannot express, since every session in a workspace shares this
+ * one file. Calibrated on the measured emission payload (≈19 KB per entry,
+ * ≈0.9 MB per session at the 50-entry cap) to ≈16 MB, i.e. ≈17 sessions before
+ * the oldest buckets are evicted; the writing session is never the one evicted.
+ */
+export declare const ENGINE_STATUS_SNAPSHOT_MAX_BYTES: number;
+/**
+ * Lock-acquisition budget (ms) for the advisory snapshot write. The write runs
+ * synchronously on the per-turn `agent/pre-step` emission path, so it may never
+ * inherit the ledger's 30 s deadline: contention (or a stale lockdir left by a
+ * killed host) must degrade the advisory write quickly instead of stalling the
+ * agent step — and, in the same process, the `/api` gateway that serves the
+ * panel.
+ */
+export declare const ENGINE_STATUS_SNAPSHOT_LOCK_TIMEOUT_MS = 250;
+/** Snapshot file location relative to `{HARNESS_DIR}`. */
+export declare const ENGINE_STATUS_SNAPSHOT_RELATIVE_PATH = "snapshots/engine-status.json";
+/**
+ * One stored emission: the payload the model saw, plus the identity needed to
+ * validate a later reader's claim (`cwd` is the session workspace the payload
+ * was resolved for).
+ */
+export interface EngineStatusSnapshotEntry {
+    /** Record version — a reader must see {@link ENGINE_STATUS_SNAPSHOT_ENTRY_VERSION}. */
+    readonly rv: number;
+    /** The session workspace the payload was resolved for (validation anchor). */
+    readonly cwd: string;
+    /** ISO timestamp of the emission. */
+    readonly at: string;
+    /** The agent turn the payload was emitted for. */
+    readonly turn: number;
+    /** The exact catalog payload object handed to the step messages. */
+    readonly payload: Record<string, unknown>;
+}
+/** Why a snapshot read could not produce the stored entry (every path explicit). */
+export type EngineStatusSnapshotUnavailableReason = 'no-harness-dir' | 'absent' | 'unreadable' | 'invalid-json' | 'envelope-schema' | 'no-session-entry' | 'entry-schema';
+/** The explicit "no answer" result — never a best-effort parse. */
+export interface EngineStatusUnavailable {
+    readonly kind: 'unavailable';
+    readonly reason: EngineStatusSnapshotUnavailableReason;
+}
+/** Read outcome: the stored entry, or the explicit unavailable state. */
+export type EngineStatusSnapshotRead = {
+    readonly kind: 'ok';
+    readonly entry: EngineStatusSnapshotEntry;
+} | EngineStatusUnavailable;
+/** Write outcome: written, or the degraded reason (never throws for I/O faults). */
+export type EngineStatusSnapshotWrite = {
+    readonly kind: 'written';
+    readonly path: string;
+    readonly entries: number;
+    /** Session buckets shed to stay under the global byte ceiling (0 when none). */
+    readonly evicted: number;
+    /**
+     * Present ONLY on the first oversize write for this store in this process —
+     * the caller logs it. One warning per store, never one per turn.
+     */
+    readonly warn?: string;
+} | {
+    readonly kind: 'degraded';
+    readonly reason: string;
+};
+/** One write request — the emission site's payload plus its session identity. */
+export interface EngineStatusSnapshotWriteInput {
+    /** The session whose catalog row this payload is (`session.header.id`). */
+    readonly sessionId: string;
+    /** The session workspace the payload was resolved for (`session.header.cwd`). */
+    readonly cwd: string;
+    /** The agent turn the row was emitted for. */
+    readonly turn: number;
+    /** The exact payload object handed to the step messages. */
+    readonly payload: object;
+    /** Emission timestamp (test seam; production uses `new Date()`). */
+    readonly now?: Date;
+    /** Global byte ceiling override (test seam; production uses the constant). */
+    readonly maxBytes?: number;
+}
+/** Absolute snapshot file path for one `{HARNESS_DIR}`. */
+export declare function engineStatusSnapshotPath(harnessDir: string): string;
+/** The explicit unavailable result (single constructor — one shape everywhere). */
+export declare function engineStatusUnavailable(reason: EngineStatusSnapshotUnavailableReason): EngineStatusUnavailable;
+/**
+ * Read the newest stored snapshot entry for one session.
+ *
+ * Every failure path is explicit: `{HARNESS_DIR}` unresolved (`no-harness-dir`),
+ * file absent (`absent`), unreadable (`unreadable`), not JSON (`invalid-json`),
+ * wrong envelope shape/`sv` (`envelope-schema`), no entries for the session
+ * (`no-session-entry`), or an unreadable entry record (`entry-schema`).
+ * @param harnessDir - the resolved `{HARNESS_DIR}` (null when none resolved).
+ * @param sessionId - the session whose snapshot is requested.
+ * @returns the newest stored entry, or the explicit unavailable state.
+ */
+export declare function readEngineStatusSnapshot(harnessDir: string | null, sessionId: string): EngineStatusSnapshotRead;
+/**
+ * Persist one emission: append the entry for `sessionId`, prune (age + per
+ * session cap + the global byte ceiling), and atomically replace the file — the
+ * whole read-modify-write under the directory write lock.
+ *
+ * Contained by design: a lock timeout, a missing/unwritable directory, a failed
+ * replace, or an existing store this build does not understand returns
+ * `{kind:'degraded', reason}` (the advisory emission path must never abort the
+ * step it observes, and must never destroy what it cannot read). The in-memory
+ * payload is unaffected either way.
+ * @param harnessDir - the resolved `{HARNESS_DIR}` (null when none resolved).
+ * @param input - the emission's session identity + payload.
+ * @returns written (with the entry count, the evicted-bucket count and — once
+ *   per store — the oversize warning) or the degraded reason.
+ */
+export declare function writeEngineStatusSnapshot(harnessDir: string | null, input: EngineStatusSnapshotWriteInput): EngineStatusSnapshotWrite;

package/dist/engine-status-wire.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The ONE declaration of the engine-status wire address, shared by both halves
+ * of the channel: the host half composes the `/api` typert endpoint descriptor
+ * from these literals, and the browser half calls the same address through
+ * `connection.rpc.call(...)`.
+ *
+ * WHY a separate module: the two halves live in two bundle graphs (the host
+ * runs from `dist/index.js`, the panel from the closure-factory
+ * `dist/client.js`), and a rename on either side used to leave both suites
+ * green while the panel silently degraded to `transport-error` — each half's
+ * spec pinned only its own copy of the literals. Importing one module makes the
+ * rename impossible to land half-done, and `engine-status-wire.spec.ts` pins the
+ * descriptor the host registers against the address the client calls.
+ *
+ * CLIENT-SAFE BY CONSTRUCTION: no imports, no `node:` builtins, no side effects
+ * — only string literals and types. The client bundle's purity gate rejects
+ * non-inline-safe `@deepseek-ai/*` value imports; this module has nothing to
+ * inline but the two constants.
+ *
+ * @module @mstar-harness/dsh/engine-status-wire
+ */
+/** The gateway channel the endpoint is served on (the host's shared `/api`). */
+export declare const ENGINE_STATUS_CHANNEL = "/api";
+/** The endpoint path on that channel (namespace + method of the descriptor). */
+export declare const ENGINE_STATUS_ENDPOINT = "mstar/engineStatus";
+/** Wire namespace of the invocation (the cordis service key mirrors it). */
+export declare const MSTAR_ENGINE_STATUS_NAMESPACE = "mstar";
+/** Wire method of the invocation → `/api/mstar/engineStatus`. */
+export declare const MSTAR_ENGINE_STATUS_METHOD = "engineStatus";

package/dist/gates/_shared.d.ts

@@ -305,6 +305,15 @@ export declare class HarnessResolver {
 }
 /** The workspace root of one agent — the session cwd (structural read; never trusts the runtime shape). */
 export declare function sessionCwdOf(agent: unknown): string | undefined;
+/**
+ * The stable session id of one agent — `session.header.id` (structural read).
+ *
+ * The SAME identity a later reader asserts when it asks the host endpoint for
+ * a session's engine-status snapshot: without a real id there is nothing to key
+ * a stored snapshot by, so an agent stub answers undefined and the write site
+ * skips the persist instead of inventing a key.
+ */
+export declare function sessionHeaderIdOf(agent: unknown): string | undefined;
 /** The tool-execution actor of one fs-intent event, when it carries an agent. */
 export declare function actorAgentOf(actor: object | undefined): unknown;
 /**

package/dist/gates/catalog.d.ts

@@ -1,15 +1,15 @@
 import { type Context } from '@deepseek-ai/cordis';
 import { type UserMessage } from '@deepseek-ai/dsh-llm';
 import type { PreStepDecision } from '@deepseek-ai/dsh-agent';
-import type { MstarEngineStatusSource } from '../types.ts';
+import type { MstarEngineStatusPayload } from '../types.ts';
 import { HarnessResolver } from './_shared.ts';
 /** Default catalog cache refresh interval (ms) — see Config `catalogTtlMs`. */
 export declare const DEFAULT_CATALOG_TTL_MS = 60000;
 /** Catalog cache key for the explicit-`harnessDir` app-wide entry (one entry for every session). */
 export declare const EXPLICIT_CACHE_KEY = "\0explicit";
-/** One TTL cache entry: the unified source plus the build timestamp. */
+/** One TTL cache entry: the unified payload plus the build timestamp. */
 export interface CatalogCacheEntry {
-    sources: MstarEngineStatusSource;
+    payload: MstarEngineStatusPayload;
     builtAt: number;
 }
 /**
@@ -27,7 +27,7 @@ export interface CatalogCacheEntry {
 export interface CatalogInvalidation {
     /**
      * Register `key` as the cache key of `harnessDir` — called by
-     * `catalogSourcesFor` on cache hit AND build, and pre-registered by the
+     * `catalogPayloadFor` on cache hit AND build, and pre-registered by the
      * entry at apply for the explicit-config boot entry (a ledger record
      * between apply and the first pre-step must still invalidate the
      * pre-seeded entry). A null harness dir (no `{HARNESS_DIR}` resolved) has
@@ -47,15 +47,15 @@ export interface CatalogInvalidation {
 /** Create the apply-scoped invalidation bound to ONE catalog cache (entry-internal wiring — see {@link CatalogInvalidation}). */
 export declare function createCatalogInvalidation(cache: Map<string, CatalogCacheEntry>): CatalogInvalidation;
 /**
- * Build the unified catalog source for one harness dir (boot for the
+ * Build the unified catalog payload for one harness dir (boot for the
  * explicit config, first-use per workspace otherwise, then TTL-refreshed —
- * see `catalogSourcesFor`). Logs the manifest fallback once per build — a
+ * see `catalogPayloadFor`). Logs the manifest fallback once per build — a
  * '0.0.0' version would watermark every catalog row wrongly, so the
  * fallback is never silent.
  * @param ctx - registrant context (logger for the manifest fallback).
  * @param harnessDir - the resolved `{HARNESS_DIR}` (null when none found).
  */
-export declare function buildCatalogSources(ctx: Context, harnessDir: string | null): MstarEngineStatusSource;
+export declare function buildCatalogPayload(ctx: Context, harnessDir: string | null): MstarEngineStatusPayload;
 /**
  * Advisory `agent/pre-step` waterfall listener (agent
  * catalog): delegates through `next()` (never `reject` — that would block the

package/dist/gates/system-prompt.d.ts

@@ -35,7 +35,7 @@
  *   compass soft/hard flip lands on the next assembly without
  *   re-registration, in zero-config and explicit-config deployments alike.
  * - The context provider reuses the catalog's unified machine-summary
- *   source (`buildCatalogSources` — the SAME builder the engine-status
+ *   payload (`buildCatalogPayload` — the SAME builder the engine-status
  *   pre-step catalog row uses) and projects the SLIM digest: the version watermark
  *   ALWAYS, plus ONE `workflow … | plans: …` line only when the active set
  *   selects a lifecycle (`state.selection.kind === 'active'`). Harness dir

package/dist/index.d.ts

@@ -16,7 +16,7 @@ import { DshHostAdapter } from './gates/adapter.ts';
 import type { DispatchGateAdvisory } from './gates/dispatch.ts';
 export { DshMstar } from './service.ts';
 export type { DshMstarOptions } from './service.ts';
-export type { MstarEngineStatusSource, MstarHarnessState, MstarIterationGateView, AgentFlowEventView, AgentFlowSummaryRow, AgentFlowView, WorkflowSelectionView, } from './types.ts';
+export type { MstarEngineStatusSource, MstarEngineStatusPayload, MstarHarnessState, MstarIterationGateView, AgentFlowEventView, AgentFlowSummaryRow, AgentFlowView, WorkflowSelectionView, } from './types.ts';
 export { AGENT_FLOW_FILE, AGENT_FLOW_MAX_EVENTS, SETTLE_SEAM, readAgentFlow, recordDispatch, recordSettle, recordWorkflowVerdict, } from './gates/agent-flow.ts';
 export type { AgentFlowEvent, DispatchVerdict, SettleOutcome, WorkflowGateMode, WorkflowVerdict, WorkflowVerdictInput, } from './gates/agent-flow.ts';
 export { Config, HarnessResolver, skillLocalConfig } from './gates/_shared.ts';