@sparkelf/dsh-dataops-managed 0.3.11 → 0.3.12

package/lib/index.js

@@ -14,17 +14,17 @@ function modelIdOf(entry) {
 	return typeof id === "string" && id.trim() !== "" ? id : null;
 }
 /** Narrow an unknown value to a plain object. */
-function asRecord$2(value) {
+function asRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 /** Read provider profiles out of a settings value. */
 function providersOf(value) {
-	const root = asRecord$2(value);
-	const providers = root === null ? null : asRecord$2(root[PROVIDERS_FIELD]);
+	const root = asRecord$3(value);
+	const providers = root === null ? null : asRecord$3(root[PROVIDERS_FIELD]);
 	if (providers === null) return {};
 	const result = {};
 	for (const [providerId, profile] of Object.entries(providers)) {
-		const narrowed = asRecord$2(profile);
+		const narrowed = asRecord$3(profile);
 		if (narrowed !== null) result[providerId] = narrowed;
 	}
 	return result;
@@ -58,7 +58,7 @@ function modelIdsByProvider(providers) {
 	for (const [providerId, profile] of Object.entries(providers)) {
 		const models = profile[MODELS_FIELD];
 		if (!Array.isArray(models)) continue;
-		result[providerId] = models.map((entry) => asRecord$2(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null);
+		result[providerId] = models.map((entry) => asRecord$3(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null);
 	}
 	return result;
 }
@@ -79,7 +79,7 @@ function selectSharedModels(providers, sharedModelIds) {
 		const models = profile[MODELS_FIELD];
 		if (!Array.isArray(models)) continue;
 		const kept = models.filter((entry) => {
-			const narrowed = asRecord$2(entry);
+			const narrowed = asRecord$3(entry);
 			const id = narrowed === null ? null : modelIdOf(narrowed);
 			return id !== null && offered.has(id);
 		});
@@ -113,9 +113,9 @@ function mergeProviders(local, adopted) {
 			continue;
 		}
 		const localModels = Array.isArray(localProfile[MODELS_FIELD]) ? localProfile[MODELS_FIELD] : [];
-		const localIds = new Set(localModels.map((entry) => asRecord$2(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null));
+		const localIds = new Set(localModels.map((entry) => asRecord$3(entry)).filter((entry) => entry !== null).map((entry) => modelIdOf(entry)).filter((id) => id !== null));
 		const missing = adoptedModels.filter((entry) => {
-			const narrowed = asRecord$2(entry);
+			const narrowed = asRecord$3(entry);
 			const id = narrowed === null ? null : modelIdOf(narrowed);
 			return id !== null && !localIds.has(id);
 		});
@@ -147,7 +147,7 @@ async function writeModels(ctx, providers, revision) {
 //#endregion
 //#region src/model-sync.ts
 /** Narrow an unknown value to a plain object. */
-function asRecord$1(value) {
+function asRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 /**
@@ -190,10 +190,10 @@ var ModelSync = class {
 		});
 		if (response.status === 401) return void 0;
 		if (!response.ok) throw new Error(`Shared model read failed with HTTP ${String(response.status)}`);
-		const body = asRecord$1(await response.json());
+		const body = asRecord$2(await response.json());
 		if (body === null) return void 0;
-		const payload = asRecord$1(body.payload);
-		const providers = payload === null ? null : asRecord$1(payload.providers);
+		const payload = asRecord$2(body.payload);
+		const providers = payload === null ? null : asRecord$2(payload.providers);
 		return {
 			sharingEnabled: body.sharingEnabled === true,
 			payload: {
@@ -238,7 +238,8 @@ var ModelSync = class {
 			body: JSON.stringify({
 				sharingEnabled,
 				providers: current.providers,
-				sharedModelIds: this.offeredModelIds(current.providers, state.privateModelIds)
+				sharedModelIds: this.offeredModelIds(current.providers, state.privateModelIds),
+				sections: await this.config.collectSections?.() ?? []
 			})
 		});
 		if (!response.ok) throw new Error(`Shared model publish failed with HTTP ${String(response.status)}`);
@@ -256,7 +257,7 @@ var ModelSync = class {
 		const response = await fetch(new URL("/api/ai/shared-models/publication", this.apiBase()), { headers: { authorization: `Bearer ${token}` } });
 		if (response.status === 401) return null;
 		if (!response.ok) throw new Error(`Shared model status read failed with HTTP ${String(response.status)}`);
-		const body = asRecord$1(await response.json());
+		const body = asRecord$2(await response.json());
 		return {
 			sharingEnabled: body?.sharingEnabled === true,
 			canPublish: body?.canPublish === true
@@ -335,6 +336,23 @@ var ModelSync = class {
 		});
 	}
 	/**
+	* Read the settings sections the current publication offers.
+	*
+	* Separate from `adopt`, which owns the models: a workspace adopts models and settings from one
+	* publication but keeps separate bookkeeping for each, because a user who changed the permission
+	* default has not thereby chosen their own models.
+	* @returns The offered sections, or an empty list when nobody publishes or none are offered.
+	*/
+	async readPublishedSections() {
+		try {
+			const published = await this.fetchPublished();
+			if (published === void 0 || !published.sharingEnabled) return [];
+			return published.payload.sections ?? [];
+		} catch (error) {
+			return [];
+		}
+	}
+	/**
 	* Follow the publisher again, adopting its models on the next pass.
 	*/
 	async resumeFollowing() {
@@ -369,6 +387,151 @@ var ModelSync = class {
 	}
 };
 //#endregion
+//#region src/settings-sync.ts
+/** Default state before this workspace stored anything. */
+const SECTION_SYNC_DEFAULT = { sections: {} };
+/** Narrow an unknown value to a plain object. */
+function asRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+/**
+* A stable rendering of one section's values.
+*
+* Key order is normalized so two reads of the same values match, and a publication that only
+* reordered its keys does not read as a change the user made.
+* @param value - Section values.
+* @returns A fingerprint comparable across reads.
+*/
+function fingerprintSection(value) {
+	const keys = Object.keys(value).sort();
+	const normalized = {};
+	for (const key of keys) normalized[key] = value[key];
+	return JSON.stringify(normalized);
+}
+/**
+* Own the distributed settings one workspace keeps.
+*
+* The state lives in this workspace rather than in DataOps because whether a user has written
+* their own values is a fact about this workspace, and keeping it here is what makes the promise
+* hold across restarts: a user who chose their own settings is not adopted again.
+*/
+var SettingsSync = class {
+	ctx;
+	store;
+	constructor(ctx, store) {
+		this.ctx = ctx;
+		this.store = store;
+	}
+	/**
+	* Read one namespace as this workspace currently holds it.
+	* @param ns - Settings namespace to read.
+	* @returns The values and revision, or undefined when no plugin owns that namespace.
+	*/
+	readSection(ns) {
+		const descriptor = this.ctx.settings.describe().find((entry) => entry.ns === ns);
+		if (descriptor === void 0) return void 0;
+		const value = asRecord$1(descriptor.value);
+		if (value === null) return void 0;
+		return {
+			value,
+			revision: descriptor.revision
+		};
+	}
+	/** Read this workspace's per-namespace bookkeeping. */
+	recordOf(state, ns) {
+		return state.sections[ns] ?? {
+			detached: false,
+			adoptedFingerprint: null
+		};
+	}
+	/**
+	* Take the published values for every namespace this workspace has not already diverged from.
+	*
+	* A namespace the user has written is skipped and marked detached, so a local edit is never
+	* replaced. A namespace whose current values match what adoption last wrote is still following,
+	* so the publisher's newer values replace them. Everything else is a default a user may change.
+	* @param sections - Sections the publisher offers.
+	* @returns Namespaces that were written, for logging.
+	*/
+	async adopt(sections) {
+		const state = this.store.read();
+		const next = { sections: { ...state.sections } };
+		const written = [];
+		let stateChanged = false;
+		for (const section of sections) {
+			const record = this.recordOf(state, section.ns);
+			if (record.detached) continue;
+			const current = this.readSection(section.ns);
+			if (current === void 0) continue;
+			const currentFingerprint = fingerprintSection(current.value);
+			const publishedFingerprint = fingerprintSection(section.value);
+			if (record.adoptedFingerprint !== null && currentFingerprint !== record.adoptedFingerprint) {
+				next.sections[section.ns] = {
+					detached: true,
+					adoptedFingerprint: record.adoptedFingerprint
+				};
+				stateChanged = true;
+				continue;
+			}
+			if (currentFingerprint === publishedFingerprint) {
+				if (record.adoptedFingerprint !== publishedFingerprint) {
+					next.sections[section.ns] = {
+						detached: false,
+						adoptedFingerprint: publishedFingerprint
+					};
+					stateChanged = true;
+				}
+				continue;
+			}
+			await this.ctx.settings.update(section.ns, section.value);
+			next.sections[section.ns] = {
+				detached: false,
+				adoptedFingerprint: publishedFingerprint
+			};
+			stateChanged = true;
+			written.push(section.ns);
+		}
+		if (stateChanged) await this.store.write(next);
+		return written;
+	}
+	/**
+	* Describe the distributed settings for the settings UI.
+	*
+	* Reports every namespace the deployment offers, whether this workspace still follows the
+	* publisher for it, and whether a plugin here owns it. A namespace no plugin owns cannot be
+	* applied, so a panel marks that row rather than offering a control that would do nothing.
+	* @param namespaces - Namespaces the deployment distributes.
+	* @returns One entry per namespace, in the order given.
+	*/
+	status(namespaces) {
+		const state = this.store.read();
+		return namespaces.map((ns) => {
+			const record = this.recordOf(state, ns);
+			return {
+				ns,
+				followState: record.detached ? "detached" : "following",
+				applied: record.adoptedFingerprint !== null,
+				mounted: this.readSection(ns) !== void 0
+			};
+		});
+	}
+	/**
+	* Stop following the publisher for one namespace and keep what this workspace holds now.
+	* @param ns - Settings namespace to detach.
+	*/
+	async detach(ns) {
+		const state = this.store.read();
+		const record = this.recordOf(state, ns);
+		await this.store.write({ sections: {
+			...state.sections,
+			[ns]: {
+				...record,
+				detached: true
+			}
+		} });
+	}
+};
+//#endregion
 //#region src/skill-plaza.ts
 /** Narrow an unknown value to a plain object. */
 function asRecord(value) {
@@ -549,6 +712,12 @@ function currentSkillPlaza() {
 function currentModelSync() {
 	return modelSyncRef;
 }
+/** The live settings-sync instance, once this plugin activated. */
+let settingsSyncRef;
+/** @returns The live instance, or undefined before this plugin activated. */
+function currentSettingsSync() {
+	return settingsSyncRef;
+}
 /** Schemastery parser for managed DataOps configuration. */
 const Config = z.object({
 	baseUrl: z.string().default("http://host.docker.internal:3101"),
@@ -563,7 +732,14 @@ const Config = z.object({
 		detached: false,
 		adoptedModelIds: [],
 		privateModelIds: []
-	}).volatile()
+	}).volatile(),
+	/** Volatile for the same reason as `modelSync`: it is this plugin's own record. */
+	settingsSync: z.any().default(SECTION_SYNC_DEFAULT).volatile(),
+	/**
+	* Namespaces offered in a publication. Validated as strings so a malformed profile entry fails
+	* at load rather than producing a publication no reader can apply.
+	*/
+	distributedSettingsNamespaces: z.array(z.string()).default([]).description("Settings namespaces offered to other workspaces when this one publishes.")
 });
 function bearerToken(request) {
 	const authorization = request.headers.authorization?.trim() ?? "";
@@ -606,10 +782,11 @@ async function apply(ctx, config) {
 		if (fiber !== void 0 && fiber.uid !== null) await fiber.dispose();
 	}, "dataops-managed: MCP lifecycle");
 	if (await ctx.credentials.resolve(accessRef) !== void 0) await ensureMcp();
-	const modelSync = new ModelSync(ctx, {
-		baseUrl,
-		credentialRef: config.credentialRef
-	}, {
+	/**
+	* The sync state lives in this plugin's own Config, so the settings service persists it in
+	* the workspace document and it survives a restart.
+	*/
+	const syncStore = {
 		read: () => ({
 			detached: config.modelSync?.detached === true,
 			adoptedModelIds: Array.isArray(config.modelSync?.adoptedModelIds) ? config.modelSync.adoptedModelIds : [],
@@ -618,7 +795,49 @@ async function apply(ctx, config) {
 		write: async (next) => {
 			await ctx.settings.update(MANAGED_PLUGIN_ID, { modelSync: next });
 		}
+	};
+	const settingsSync = new SettingsSync(ctx, {
+		read: () => ({ sections: typeof config.settingsSync?.sections === "object" && config.settingsSync.sections !== null ? config.settingsSync.sections : {} }),
+		write: async (next) => {
+			await ctx.settings.update(MANAGED_PLUGIN_ID, { settingsSync: next });
+		}
 	});
+	settingsSyncRef = settingsSync;
+	/**
+	* The namespaces this deployment distributes.
+	*
+	* Listed here rather than inside the sync because what a deployment offers is its own choice:
+	* the sync knows how to carry a section, and this decides which ones travel.
+	*/
+	const distributedNamespaces = () => {
+		const configured = config.distributedSettingsNamespaces;
+		return Array.isArray(configured) ? configured.filter((ns) => typeof ns === "string" && ns !== "") : [];
+	};
+	/**
+	* Read the sections this workspace would publish.
+	*
+	* A namespace no plugin owns is skipped: publishing a section this deployment cannot apply
+	* would offer readers values nothing on their side reads.
+	*/
+	const collectSections = async () => {
+		const collected = [];
+		for (const ns of distributedNamespaces()) {
+			const descriptor = ctx.settings.describe().find((entry) => entry.ns === ns);
+			if (descriptor === void 0) continue;
+			const value = descriptor.value;
+			if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+			collected.push({
+				ns,
+				value
+			});
+		}
+		return collected;
+	};
+	const modelSync = new ModelSync(ctx, {
+		baseUrl,
+		credentialRef: config.credentialRef,
+		collectSections
+	}, syncStore);
 	modelSyncRef = modelSync;
 	skillPlazaRef = new SkillPlaza(ctx, {
 		baseUrl,
@@ -637,6 +856,13 @@ async function apply(ctx, config) {
 			ctx.logger.warn("dataops-managed: model sync could not adopt the published models");
 			ctx.logger.warn(error);
 		}
+		try {
+			const published = await modelSync.readPublishedSections();
+			if (published.length > 0) await settingsSync.adopt(published);
+		} catch (error) {
+			ctx.logger.warn("dataops-managed: distributed settings could not be adopted");
+			ctx.logger.warn(error);
+		}
 	};
 	if (await ctx.credentials.resolve(accessRef) !== void 0) await adoptNow();
 	ctx.effect(() => ctx.webServer.register({
@@ -682,7 +908,10 @@ async function apply(ctx, config) {
 			}
 			try {
 				if (request.method === "GET") {
-					writeJson(response, 200, await sync.status());
+					writeJson(response, 200, {
+						...await sync.status(),
+						sections: settingsSyncRef === void 0 ? [] : settingsSyncRef.status(distributedNamespaces())
+					});
 					return;
 				}
 				if (request.method !== "POST") {
@@ -701,11 +930,32 @@ async function apply(ctx, config) {
 					writeJson(response, 200, await sync.status());
 					return;
 				}
+				if (action === "publish-defaults") {
+					await sync.publish(true);
+					writeJson(response, 200, {
+						...await sync.status(),
+						sections: settingsSyncRef === void 0 ? [] : settingsSyncRef.status(distributedNamespaces())
+					});
+					return;
+				}
 				if (action === "detach") {
 					await sync.detach();
 					writeJson(response, 200, await sync.status());
 					return;
 				}
+				if (action === "detach-section") {
+					const ns = typeof body?.ns === "string" ? body.ns.trim() : "";
+					if (ns === "") {
+						writeJson(response, 400, { error: "detach-section needs a namespace" });
+						return;
+					}
+					await settingsSyncRef?.detach(ns);
+					writeJson(response, 200, {
+						...await sync.status(),
+						sections: settingsSyncRef === void 0 ? [] : settingsSyncRef.status(distributedNamespaces())
+					});
+					return;
+				}
 				if (action === "resume") {
 					await sync.resumeFollowing();
 					await sync.adopt();
@@ -825,4 +1075,4 @@ function writeJson(response, status, body) {
 	response.end(payload);
 }
 //#endregion
-export { Config, MANAGED_AUTH_PATH, MANAGED_PLUGIN_ID, MODEL_SYNC_PATH, SKILL_PLAZA_PATH, apply, currentModelSync, currentSkillPlaza, inject, name };
+export { Config, MANAGED_AUTH_PATH, MANAGED_PLUGIN_ID, MODEL_SYNC_PATH, SKILL_PLAZA_PATH, apply, currentModelSync, currentSettingsSync, currentSkillPlaza, inject, name };

package/lib/types/client/locales.d.ts

@@ -14,20 +14,14 @@ export declare const en: {
     readonly modelsTitle: "Model configuration";
     readonly modelsDescription: "Share the models configured here with other users, and choose which of them they may use.";
     readonly modelsUnavailable: "Model configuration is unavailable until this workspace is connected to DataOps.";
-    readonly syncTitle: "Share models with other users";
-    readonly syncDescription: "Other users who have not configured their own models get the models configured here.";
-    readonly syncToggle: "Share models with other users";
-    readonly followTitle: "Using the shared model configuration";
-    readonly followDescription: "The models shared by an administrator are available here. Change them and this workspace keeps your version instead.";
-    readonly detachedTitle: "Using your own model configuration";
-    readonly detachedDescription: "This workspace keeps the models configured here and no longer follows the shared configuration.";
-    readonly resume: "Use the shared configuration again";
-    readonly resuming: "Switching…";
-    readonly noPublisher: "No administrator is sharing models right now.";
-    readonly modelsListTitle: "Models other users may use";
-    readonly modelsListDescription: "A model turned off here stays available in this workspace and is not offered to other users.";
-    readonly modelShareLabel: "Available to other users";
-    readonly modelsEmpty: "No models are configured in this workspace yet. Add them in Models settings first.";
+    readonly defaultsTitle: "Default configuration";
+    readonly defaultsDescription: "Publish the configuration this workspace holds — models, permissions, and general settings — as the values other users start from. Their workspace takes that copy once and may then change anything, and a change they make is never overwritten.";
+    readonly defaultsActionTitle: "Publish as the default";
+    readonly defaultsNotAdmin: "Only an administrator may publish the default configuration.";
+    readonly defaultsNeverPublished: "Not published yet.";
+    readonly defaultsPublishedAt: "Last published:";
+    readonly defaultsPublish: "Publish default configuration";
+    readonly defaultsPublishing: "Publishing…";
     readonly loadFailed: "The model configuration could not be loaded. Try again.";
     readonly plazaTitle: "Skill plaza";
     readonly plazaIntro: "Skills other users shared. Install one to use it in this workspace, or share a skill of your own.";

package/lib/types/client/model-sync-client.d.ts

@@ -24,6 +24,23 @@ export interface ModelSyncStatus {
     canPublish: boolean;
     /** Models this workspace holds. */
     models: ModelSyncModel[];
+    /**
+     * Settings namespaces this deployment distributes.
+     *
+     * Present with the models in one response, so the two rows describe the same publication.
+     */
+    sections: DistributedSection[];
+}
+/** One settings namespace the deployment distributes. */
+export interface DistributedSection {
+    /** DSH settings namespace, such as `permission`. */
+    ns: string;
+    /** Whether this workspace still takes the publisher's values for it. */
+    followState: 'following' | 'detached';
+    /** Whether adoption has applied values for it. */
+    applied: boolean;
+    /** Whether a plugin here owns the namespace, so stopping would affect this workspace. */
+    mounted: boolean;
 }
 /**
  * Read the current model sharing state.

package/lib/types/index.d.ts

@@ -2,6 +2,7 @@
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import { ModelSync } from './model-sync.ts';
+import { SettingsSync, type SectionSyncState } from './settings-sync.ts';
 import { SkillPlaza } from './skill-plaza.ts';
 /** Cordis plugin name for the DataOps-managed integration. */
 export declare const name = "dataops-managed";
@@ -18,6 +19,8 @@ export declare const SKILL_PLAZA_PATH = "/integrations/dataops/skill-plaza";
 export declare function currentSkillPlaza(): SkillPlaza | undefined;
 /** The live model-sync instance, once this plugin activated. */
 export declare function currentModelSync(): ModelSync | undefined;
+/** @returns The live instance, or undefined before this plugin activated. */
+export declare function currentSettingsSync(): SettingsSync | undefined;
 /** Configuration for the DataOps-managed MCP connection. */
 export interface Config {
     /** DataOps browser/API origin reachable from the DSH Host. */
@@ -36,6 +39,20 @@ export interface Config {
      * their own models, which is a fact about this workspace.
      */
     modelSync: ModelSyncState;
+    /**
+     * Settings-distribution state this workspace keeps.
+     *
+     * Volatile, like the model-sync state beside it, and for the same reason: it records whether
+     * the user here wrote their own values, which is a fact about this workspace.
+     */
+    settingsSync: SectionSyncState;
+    /**
+     * Settings namespaces this deployment distributes to other workspaces.
+     *
+     * Empty by default: a deployment that publishes nothing offers no defaults, and a reader takes
+     * its own values. Naming a namespace here is what puts it in every publication.
+     */
+    distributedSettingsNamespaces: string[];
 }
 /** What this workspace remembers about sharing model configuration. */
 export interface ModelSyncState {

package/lib/types/model-sync.d.ts

@@ -1,5 +1,6 @@
 /** Adopt, publish, and stop following the model configuration another workspace offers. */
 import type { Context } from '@deepseek-ai/cordis';
+import type { PublishedSection } from './settings-sync.ts';
 /** This plugin's own profile entry id, which owns the sync state. */
 export declare const SYNC_NAMESPACE = "dataops-managed";
 /** Whether this workspace follows the publisher, or keeps what its user wrote. */
@@ -26,6 +27,14 @@ export interface SyncConfig {
     baseUrl: string;
     /** DSH credential reference holding the current DataOps access JWT. */
     credentialRef: string;
+    /**
+     * Collect the settings sections this workspace offers to others.
+     *
+     * Injected rather than read here because which namespaces travel is a deployment decision:
+     * this class carries a publication, and the deployment decides what belongs in one.
+     * @returns The sections to publish, in the order they should be applied.
+     */
+    collectSections?: () => Promise<PublishedSection[]>;
 }
 /** What the settings UI reads to describe the current state. */
 export interface SyncStatus {
@@ -133,6 +142,15 @@ export declare class ModelSync {
      * survives the next start.
      */
     detach(): Promise<void>;
+    /**
+     * Read the settings sections the current publication offers.
+     *
+     * Separate from `adopt`, which owns the models: a workspace adopts models and settings from one
+     * publication but keeps separate bookkeeping for each, because a user who changed the permission
+     * default has not thereby chosen their own models.
+     * @returns The offered sections, or an empty list when nobody publishes or none are offered.
+     */
+    readPublishedSections(): Promise<PublishedSection[]>;
     /**
      * Follow the publisher again, adopting its models on the next pass.
      */

package/lib/types/settings-sync.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Settings the workspace takes as defaults from an administrator's publication.
+ *
+ * The model sync owns the models. This module owns every other namespace the deployment chooses
+ * to distribute, and it follows the same contract: a workspace takes the published values once,
+ * and from the first value its user writes it keeps its own and is never overwritten again.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+/** One settings namespace offered by a publication. */
+export interface PublishedSection {
+    /** DSH settings namespace, such as `permission`. */
+    ns: string;
+    /** The section's values at publication time. */
+    value: Record<string, unknown>;
+}
+/** Whether this workspace still follows the publisher for one namespace. */
+export type SectionFollowState = 'following' | 'detached';
+/** One distributed namespace as the settings UI reads it. */
+export interface DistributedSectionStatus {
+    /** DSH settings namespace. */
+    ns: string;
+    /** Whether this workspace still takes the publisher's values for it. */
+    followState: SectionFollowState;
+    /** Whether adoption has applied values for it. */
+    applied: boolean;
+    /** Whether a plugin in this workspace owns the namespace, so applying it would do something. */
+    mounted: boolean;
+}
+/** Per-namespace bookkeeping this workspace keeps. */
+export interface SectionSyncRecord {
+    /** Whether the user here wrote this namespace, so adoption stops for it. */
+    detached: boolean;
+    /** A fingerprint of what adoption last wrote, so a later edit can be told apart from it. */
+    adoptedFingerprint: string | null;
+}
+/** What this workspace remembers about distributed settings. */
+export interface SectionSyncState {
+    /** Bookkeeping keyed by settings namespace. */
+    sections: Record<string, SectionSyncRecord>;
+}
+/** Default state before this workspace stored anything. */
+export declare const SECTION_SYNC_DEFAULT: SectionSyncState;
+/** Read and write this workspace's section-sync state. */
+export interface SectionSyncStore {
+    /** @returns The stored state, or defaults before anything was stored. */
+    read(): SectionSyncState;
+    /** @param next - State to store. */
+    write(next: SectionSyncState): Promise<void>;
+}
+/**
+ * A stable rendering of one section's values.
+ *
+ * Key order is normalized so two reads of the same values match, and a publication that only
+ * reordered its keys does not read as a change the user made.
+ * @param value - Section values.
+ * @returns A fingerprint comparable across reads.
+ */
+export declare function fingerprintSection(value: Record<string, unknown>): string;
+/**
+ * Own the distributed settings one workspace keeps.
+ *
+ * The state lives in this workspace rather than in DataOps because whether a user has written
+ * their own values is a fact about this workspace, and keeping it here is what makes the promise
+ * hold across restarts: a user who chose their own settings is not adopted again.
+ */
+export declare class SettingsSync {
+    private readonly ctx;
+    private readonly store;
+    constructor(ctx: Context, store: SectionSyncStore);
+    /**
+     * Read one namespace as this workspace currently holds it.
+     * @param ns - Settings namespace to read.
+     * @returns The values and revision, or undefined when no plugin owns that namespace.
+     */
+    private readSection;
+    /** Read this workspace's per-namespace bookkeeping. */
+    private recordOf;
+    /**
+     * Take the published values for every namespace this workspace has not already diverged from.
+     *
+     * A namespace the user has written is skipped and marked detached, so a local edit is never
+     * replaced. A namespace whose current values match what adoption last wrote is still following,
+     * so the publisher's newer values replace them. Everything else is a default a user may change.
+     * @param sections - Sections the publisher offers.
+     * @returns Namespaces that were written, for logging.
+     */
+    adopt(sections: readonly PublishedSection[]): Promise<string[]>;
+    /**
+     * Describe the distributed settings for the settings UI.
+     *
+     * Reports every namespace the deployment offers, whether this workspace still follows the
+     * publisher for it, and whether a plugin here owns it. A namespace no plugin owns cannot be
+     * applied, so a panel marks that row rather than offering a control that would do nothing.
+     * @param namespaces - Namespaces the deployment distributes.
+     * @returns One entry per namespace, in the order given.
+     */
+    status(namespaces: readonly string[]): DistributedSectionStatus[];
+    /**
+     * Stop following the publisher for one namespace and keep what this workspace holds now.
+     * @param ns - Settings namespace to detach.
+     */
+    detach(ns: string): Promise<void>;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sparkelf/dsh-dataops-managed",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "DataOps JWT intake and credential-backed MCP tools for managed DeepSeek Harness workspaces.",
   "type": "module",
   "main": "./lib/index.js",