@sqdr2/dsh-fusion 0.0.0-stage → 0.3.2

package/lib/types/host/native-task-context.d.ts

@@ -0,0 +1,39 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { GenerateOptions, UserMessage } from '@deepseek-ai/dsh-llm';
+import type { Role, TaskId } from '../contracts.js';
+import type { SqliteFusionStore } from '../task/sqlite-store.js';
+import type { SessionBinding } from './bindings.js';
+export declare const FUSION_TASK_CONTEXT = "fusion:task";
+export type ContextDetail = 'compact' | 'full';
+/** Programmatic facts travel as native user-role context, never as system instructions. */
+export declare class NativeTaskContext {
+    #private;
+    readonly store: SqliteFusionStore;
+    readonly parent: (id: string) => Agent | undefined;
+    constructor(store: SqliteFusionStore, parent: (id: string) => Agent | undefined);
+    /**
+     * Record where this task's user instructions begin. A task created by an automatic
+     * rollover continues the same conversation, so it inherits the boundary of the task
+     * it replaces: the user's instructions belong to the conversation, not to one
+     * accounting task. Narrowing it to the rollover point silently hid every earlier
+     * user message from `fusion_delegate`'s verbatim requirement check, which then
+     * rejected the Lead's own true quotes as fabricated.
+     */
+    begin(agent: Agent, taskId: TaskId, firstSeq?: number): void;
+    /** The recorded user-instruction boundary of a task, when it has one. */
+    originSeq(taskId: TaskId): number | undefined;
+    /**
+     * `compact` is appended on every changed step: it carries only state the
+     * native history does not already hold, so the expensive Lead does not
+     * re-read its own brief, the delivered report or the user's messages on
+     * every request. `full` restores everything after compaction, when those
+     * native messages may have been summarized away.
+     */
+    render(binding: SessionBinding, role: Role, detail?: ContextDetail): string;
+    /** Run after native pre-step handlers, including the existing compaction owner. */
+    message(agent: Agent, binding: SessionBinding, role: Role, detail?: ContextDetail): UserMessage | undefined;
+    /** The final frozen request must contain the snapshot that was actually assembled. */
+    assertPresent(agent: Agent, binding: SessionBinding, role: Role, request: GenerateOptions): void;
+    prepareCompaction(agent: Agent, binding: SessionBinding, role: Role, sourceSurfaceSeqs: readonly number[]): string;
+    restoreCompaction(agent: Agent, binding: SessionBinding, role: Role, id: string, compactionId: string): void;
+}

package/lib/types/host/native-usage.d.ts

@@ -0,0 +1,46 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { TokenUsage } from '@deepseek-ai/dsh-llm';
+import type { Role, TaskId } from '../contracts.js';
+import type { CanonicalBill, UsageLedgerV2 } from '../usage/ledger.js';
+import type { SqliteFusionStore } from '../task/sqlite-store.js';
+import type { NativeAuxiliaryRequests } from './native-auxiliary.js';
+export interface UsageOwner {
+    readonly taskId: TaskId;
+    readonly role: Role;
+}
+/**
+ * DSH counters are disjoint; missing provider fields retain unknown applicability.
+ *
+ * A counter is known only when the provider reported a real finite number.
+ * Gateways that omit completion_tokens_details send reasoningTokens as null
+ * (seen on some claude-opus-5.5 routes). known(null) throws INVALID_TOKEN_COUNT
+ * inside the llm/stream hook and aborts the turn, so null and NaN stay unknown.
+ */
+export declare function billFromNativeUsage(usage: TokenUsage | undefined): CanonicalBill;
+export interface NativeUsageRecord {
+    schemaVersion: 1;
+    taskId: TaskId;
+    sessionId: string;
+    role: Role;
+    purpose: 'conversation' | 'compaction' | 'session-title' | 'cache-keepalive';
+    /** Effective request envelope; Host compaction markers can retain their pre-routing cap. */
+    maxOutputTokens: number | null;
+    reasoningEffort?: string;
+    auxiliary?: {
+        seriesId: string;
+        iteration: number;
+    };
+    nativeInvocationId: string;
+    startedAt: string;
+    endedAt: string | null;
+    /** Entering a Host stream is observable; the adapter's HTTP retry count is not. */
+    nativeStreamInvocations: 1;
+    upstreamHttpCalls: null;
+    outcome: 'entered' | 'stop' | 'tool-calls' | 'max-tokens' | 'aborted' | 'error' | 'unknown';
+    ledger: UsageLedgerV2;
+    actualSubscriptionChargeUsd: null;
+    apiEquivalentCostUsd: null;
+}
+/** Read-only stream observer. It neither changes requests nor orchestrates agents. */
+export declare function observeNativeUsage(ctx: Context, store: SqliteFusionStore, ownerOf: (agent: Agent) => UsageOwner | undefined, auxiliary?: NativeAuxiliaryRequests): () => void;

package/lib/types/host/native-worker-brief.d.ts

@@ -0,0 +1,74 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { ToolExecution } from '@deepseek-ai/dsh-tools';
+import type { GenerateOptions } from '@deepseek-ai/dsh-llm';
+import type { TaskId } from '../contracts.js';
+import type { SqliteFusionStore } from '../task/sqlite-store.js';
+/** Durable Lead-authored refinements survive native compaction and request races. */
+export declare function workerBriefs(store: SqliteFusionStore, taskId: TaskId): {
+    revision: number;
+    deliveryId: string;
+    source: "lead-tool-feedback";
+    nativeCallId: string;
+    payloadRef: string;
+    feedback: string;
+}[];
+/**
+ * Pin a bounded projection, including the first handoff, on both native roles.
+ * The complete owned outbox, journal and artifact bytes remain durable. Original
+ * user input and the frozen work order are retained separately by NativeTaskContext.
+ */
+export declare function workerHandoffProjection(store: SqliteFusionStore, taskId: TaskId): {
+    latestBriefRevision: number;
+    historyDigest: import("../contracts.js").Digest;
+    policy: "recent-whole-records-utf8-v1";
+    contentByteBudget: number;
+    totalRecords: number;
+    omittedRecords: number;
+    totalContentBytes: number;
+    retainedContentBytes: number;
+    records: {
+        revision: number;
+        source: "lead-tool-handoff" | "lead-tool-feedback";
+        sourceId: string;
+        payloadRef: string;
+        content: string;
+    }[];
+    schemaVersion: 1;
+};
+/** Brief bodies already arrive as native messages; the snapshot pins only their identity and digests. */
+export declare function compactHandoffs(projection: ReturnType<typeof workerHandoffProjection>): {
+    records: {
+        contentDigest: import("../contracts.js").Digest;
+        revision: number;
+        source: "lead-tool-handoff" | "lead-tool-feedback";
+        sourceId: string;
+        payloadRef: string;
+    }[];
+    latestBriefRevision: number;
+    historyDigest: import("../contracts.js").Digest;
+    policy: "recent-whole-records-utf8-v1";
+    contentByteBudget: number;
+    totalRecords: number;
+    omittedRecords: number;
+    totalContentBytes: number;
+    retainedContentBytes: number;
+    schemaVersion: 1;
+};
+export declare function assertWorkerBriefRequest(store: SqliteFusionStore, taskId: TaskId, request: GenerateOptions): void;
+/** Bind model-generated tools to the brief that their exact native request saw. */
+export declare function captureWorkerBrief(store: SqliteFusionStore, taskId: TaskId, agent: Agent, turn: number, step: number, revision: number): void;
+/**
+ * Bind one non-read Worker tool to the brief its own request saw.
+ *
+ * A native call is identified by `rootCallId`, which is the id of the block the
+ * assistant message emitted. A bridge route (Antigravity's `agy`) instead runs
+ * the call inside its OWN loop and reports the step through its transport, so
+ * the bridged dispatch carries a bridge-local call id that never appears in this
+ * session (`agy-mcp-N`). Refusing it as "no native request" refused the one tool
+ * a bridge Worker exists to call — `fusion_submit_result` — and stranded the
+ * task (session-1d65b1d0). Such a call is still owned by a native request: it
+ * is dispatched synchronously while the transport call runs, so the enclosing
+ * assistant message is the one that emitted the transport. `transport` carries
+ * that name only for a role whose route really is a bridge.
+ */
+export declare function workerToolBriefProblem(store: SqliteFusionStore, taskId: TaskId, exec: ToolExecution, revision: number, transport?: string): string | undefined;

package/lib/types/host/native-worker-notices.d.ts

@@ -0,0 +1,15 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
+import type { SqliteFusionStore } from '../task/sqlite-store.js';
+import type { SessionBinding } from './bindings.js';
+/** Reduce only our Worker's runtime closing notice, never its structured report. */
+export declare class NativeWorkerNotices {
+    readonly store: SqliteFusionStore;
+    constructor(store: SqliteFusionStore);
+    project(agent: Agent, binding: SessionBinding, original: UserMessage): UserMessage;
+    /** Replace retained legacy notices before the native compactor reads history.
+     * Public surface replacement preserves the original append-only event and
+     * cites it. Already compacted prose cannot be safely reverse-transformed.
+     */
+    projectHistory(agent: Agent, binding: SessionBinding): void;
+}

package/lib/types/host/native-worker.d.ts

@@ -0,0 +1,44 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { MessageId } from '@deepseek-ai/dsh-llm';
+import type { PhysicalRoute } from '../contracts.js';
+export interface NativeWorkerRequest {
+    readonly childId: string;
+    readonly label: string;
+    /** Model-authored brief from the Lead's native tool call. */
+    readonly brief: string;
+    readonly route: PhysicalRoute;
+    /** 0.2.0 startContinuable persona. 0.2.1 rejects it; the role scope carries the prompt. */
+    readonly persona: string;
+    /** 0.2.0 start-time tool ceiling. 0.2.1 rejects toolFilter; the role scope narrows tools. */
+    readonly allowedTools: readonly string[];
+}
+export interface NativeWorkerAcceptance {
+    readonly childId: string;
+    readonly messageId: MessageId;
+}
+/** Version-pinned public API adapter. It never calls an LLM adapter or runs a shell itself. */
+export declare class NativeWorkerTransport {
+    #private;
+    private readonly ctx;
+    private readonly provider;
+    constructor(ctx: Context, provider?: string);
+    assertAvailable(): void;
+    /** Caller durably reserves the child and operation before entering this method. */
+    start(parent: Agent, request: NativeWorkerRequest, signal: AbortSignal): Promise<NativeWorkerAcceptance>;
+    /** Only Lead-authored feedback is sent through this public model-message API. */
+    continue(parent: Agent, childId: string, feedback: string, signal: AbortSignal): Promise<NativeWorkerAcceptance>;
+    /**
+     * Replace an in-flight generation through public cancellation, then deliver
+     * to the same durable child. The caller must first exclude live/unknown
+     * effectful tools. Otherwise use continue(), which steers at a step boundary.
+     */
+    interruptAndContinue(parent: Agent, childId: string, feedback: string, signal: AbortSignal): Promise<NativeWorkerAcceptance>;
+    /** Interrupt acceptance is insufficient: wait for the exact native Agent to settle and flush. */
+    settle(parent: Agent, childId: string, signal: AbortSignal): Promise<Agent>;
+    /** Yield a blocking tool to native user steering without canceling or releasing the Worker. */
+    settle(parent: Agent, childId: string, signal: AbortSignal, yieldToSteering: true): Promise<Agent | undefined>;
+    stop(parent: Agent, childId: string): Promise<Agent>;
+    /** Native release owns quiescence, persistence and handle disposal across HMR. */
+    release(parent: Agent, childId: string): Promise<void>;
+}

package/lib/types/host/native-workflow.d.ts

@@ -0,0 +1,41 @@
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { ToolExecution, ToolExecutionResult } from '@deepseek-ai/dsh-tools';
+import type { Role } from '../contracts.js';
+import type { SqliteFusionStore } from '../task/sqlite-store.js';
+import type { SessionBinding } from './bindings.js';
+export declare const enforcedWorkflow: (binding: SessionBinding) => boolean;
+/** v3 keeps every v2 mechanism and adds role separation (see native-role-sandbox). */
+export declare const adaptiveWorkflow: (binding: SessionBinding) => boolean;
+export interface ProgressWindow {
+    schemaVersion: 1;
+    milestone: string;
+    recent: string[];
+    tinyRead?: {
+        path: string;
+        count: number;
+    };
+}
+export interface ProgressObservation {
+    milestone: string;
+    fingerprint?: string;
+    tinyPath?: string;
+    role: Role;
+}
+/** Results, not model explanations, drive this bounded and persistable detector. */
+export declare function advanceProgress(previous: ProgressWindow | undefined, observation: ProgressObservation): {
+    window: ProgressWindow;
+    stalled: boolean;
+};
+/** Only public execution results and durable task facts enter the workflow controller. */
+export declare class NativeWorkflow {
+    readonly store: SqliteFusionStore;
+    constructor(store: SqliteFusionStore);
+    milestone(binding: SessionBinding): string;
+    observe(exec: Readonly<ToolExecution>, result: Readonly<ToolExecutionResult>, binding: SessionBinding, role: Role, read: boolean): boolean;
+    /** One local replanning opportunity, not an immediate request for user intervention. */
+    repairProgress(agent: Agent, binding: SessionBinding, role: Role): boolean;
+    denyEffect(binding: SessionBinding): string;
+    deniedEffect(binding: SessionBinding): boolean;
+    /** At most one repair generation per role and durable milestone, surviving reloads. */
+    repairStop(agent: Agent, binding: SessionBinding, role: Role, instruction: string): boolean;
+}

package/lib/types/host/route-transport.d.ts

@@ -0,0 +1,22 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** The transport name this provider route needs, registered or not. */
+export declare function routeTransportName(provider: string): string | undefined;
+/**
+ * Whether `name` is a bridge-route transport. Such a tool only replays a step
+ * the route already executed in its own loop: it is presentation, not an effect
+ * this Host authorizes, bills or holds a write lease for.
+ */
+export declare function isRouteTransportName(name: string): boolean;
+/**
+ * The transport this route needs AND this Host can actually accept. An
+ * unregistered name is skipped, because a call naming it is rejected as
+ * `unknown tool` — the adapter must never invent one either.
+ *
+ * The lookup is the GLOBAL view on purpose. A bridge registers its transport at
+ * the host layer, while an agent scope's own restriction hides inherited tools:
+ * reading through the Worker's restricted scope would report "absent" on the
+ * very next refresh and shrink the ceiling that had just been widened.
+ */
+export declare function registeredRouteTransport(ctx: Context, provider: string): string | undefined;
+/** Add the route's transport to a capability ceiling without duplicating a configured entry. */
+export declare function withRouteTransport(ceiling: readonly string[], transport: string | undefined): readonly string[];

package/lib/types/host/settings.d.ts

@@ -0,0 +1,39 @@
+import type { PairProfile, PhysicalRoute } from '../contracts.js';
+export interface PairChoice {
+    lead: PhysicalRoute;
+    worker: PhysicalRoute;
+    outputTokens?: Partial<Record<'lead' | 'worker', number>>;
+    cacheKeepalive?: PairProfile['cacheKeepalive'];
+    compactor?: PairProfile['compactor'];
+}
+export interface SettingsCatalog {
+    groups: readonly {
+        id: string;
+        name: string;
+        models: readonly {
+            id: string;
+            name: string;
+            reasoning?: {
+                efforts: readonly {
+                    id: string;
+                    name: string;
+                }[];
+                defaultEffort?: string;
+            };
+        }[];
+    }[];
+}
+/** Saved Lead route from a raw settings or profile document, or undefined when unconfigured or pointed at Fusion itself. */
+export declare function savedLeadRoute(value: unknown): {
+    provider: string;
+    model: string;
+} | undefined;
+/** Configuration chooses registered physical models; it cannot create adapters. */
+export declare function validatePairChoice(value: unknown, catalog: SettingsCatalog): PairChoice;
+/** New sessions can opt into this Worker cap. Frozen sessions keep their saved profile. */
+export declare const WORKER_IMPLEMENTATION_OUTPUT_TOKENS = 128000;
+export declare function profileFromChoice(pair: PairChoice): Record<string, unknown>;
+/** Product defaults; explicit legacy/benchmark profiles retain their old contract. */
+export declare function modelProfileFromChoice(pair: PairChoice): Record<string, unknown>;
+/** Keep existing default settings stable; expose explicit larger/smaller limits on reload. */
+export declare function choiceFromProfile(profile: PairProfile): PairChoice;

package/lib/types/host/shell.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The native shell tool the Host mounts on this platform. cordis.patch.yml
+ * disables tool-bash on win32 and mounts tool-pwsh instead; elsewhere the
+ * bash tool is the native shell. Safety gates must apply to whichever shell
+ * tool issued the call, so checks use {@link isShellTool}, while defaults
+ * and probes use {@link nativeShellTool} — the tool that actually exists.
+ */
+export declare const nativeShellTool: 'bash' | 'pwsh';
+export declare const isShellTool: (name: string) => name is "bash" | "pwsh";
+/** Command text the prompt layer names for the platform's native shell. */
+export declare const nativeShellDescription: string;

package/lib/types/host/status.d.ts

@@ -0,0 +1,7 @@
+import type { TaskState } from '../task/state.js';
+import type { SqliteFusionStore } from '../task/sqlite-store.js';
+import type { FusionStatus } from '../status.js';
+export declare function taskStage(state: TaskState, checking: boolean, workerStepLimitReached?: boolean, workerQuotaExhausted?: boolean): Pick<NonNullable<FusionStatus['task']>, 'stage' | 'detail' | 'attention'>;
+/** Reads existing durable facts only. Polling never constructs a runtime or calls a model. */
+export declare function readFusionStatus(store: SqliteFusionStore, sessionId: string): FusionStatus;
+export declare function readFusionStatusAsync(store: SqliteFusionStore, sessionId: string, signal?: AbortSignal): Promise<FusionStatus>;

package/lib/types/host/subagent-seam.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Runtime detection for the DSH subagent seam.
+ * 0.2.1-rc.2 renamed continuable start/drain and removed `ctx.subagents.start`.
+ * 0.2.0-rc.2 still has the old names. Callers branch on the function that is
+ * actually present. They do not read a version string.
+ */
+export declare const supportedDshVersions = "0.2.0-rc.2 and 0.2.1-rc.2";
+export declare function hasStartActivation(subagents: object): boolean;
+/** Prefer `primary` (the 0.2.1 name) when both exist. */
+export declare function requireSubagentMethod(subagents: object, primary: string, fallback: string): string;

package/lib/types/host/tool-table.d.ts

@@ -0,0 +1,35 @@
+/** A model-facing tool, identified by the name the request will advertise. */
+export interface NamedTool {
+    name: string;
+}
+export interface ProjectedTools<T extends NamedTool> {
+    tools: T[];
+    /** Fusion tools this role must see that neither the assembled table nor the registry still has. */
+    missing: string[];
+}
+/**
+ * Rebuild one role's request tool table after another plugin replaces `assembled.tools`.
+ *
+ * The allowlist is a capability ceiling, not a list of mandatory registrations.
+ * It filters the assembled table, then permitted names are copied back from this
+ * agent's own registry: allowlisted tools (such as `job_output`) and Fusion's own
+ * `fusion_*` registrations. An undefined allowlist keeps the assembled table and only
+ * unions Fusion's registrations, so a writing role is not narrowed.
+ *
+ * A Fusion tool is required only when this agent actually registered it and the role
+ * may see it. `fusion_read_state` and `fusion_delegate_text` are registered only for
+ * model-like profiles; a legacy allowlist that merely names them is not incomplete.
+ * Restore copies every permitted registry tool before the gap is measured, so `missing`
+ * stays empty for every table this function itself builds. The field remains so a later
+ * change that stops restoring a registered tool fails closed instead of sending a
+ * silently smaller catalog.
+ */
+export declare function projectRoleTools<T extends NamedTool>(input: {
+    assembled: readonly T[];
+    allowlist: readonly string[] | undefined;
+    registry: readonly T[];
+    /** Names this role keeps even when the allowlist omits them. */
+    always?: readonly string[];
+}): ProjectedTools<T>;
+/** Shown when the role's Fusion tools cannot be restored. The request must not proceed as a normal completion. */
+export declare function fusionToolDiagnostic(missing: readonly string[]): string;

package/lib/types/host/worker-terminal.d.ts

@@ -0,0 +1,68 @@
+/** What fusion_wait should do once the resident Worker handle is already gone. */
+export declare function absentWorkerOutcome(input: {
+    pendingEffects: number;
+    outcomeUnknown: boolean;
+    submitted: boolean;
+}): {
+    kind: 'recovery';
+    reason: string;
+} | {
+    kind: 'collect-report';
+} | {
+    kind: 'incomplete';
+};
+/** Settlement notice text. It must match whether a report was persisted, and must not send the Lead back to a disposed Worker. */
+export declare function workerSettlementGuidance(submitted: boolean): string;
+/**
+ * How to describe a Worker model-control wait to the Lead.
+ * WORKFLOW_INCOMPLETE and NO_PROGRESS are missing work, not an unavailable provider.
+ */
+export declare function workerStopExplanation(code: string): {
+    reasonCode: string;
+    next: string;
+};
+/**
+ * Why a quiescent Worker produced no report.
+ *
+ * A Worker that was offered a tool table but never dispatched one tool call of it
+ * did not "run out of steps" or lose work: its route could not call those tools at
+ * all. Adapters that drive their own execution loop (for example an external CLI
+ * agent) only surface tool calls when the request also carries their own transport
+ * tool, so `fusion_submit_result` stays unreachable even though this plugin did
+ * advertise it. That is a configuration mismatch the Lead must report accurately
+ * instead of retrying or blaming the model.
+ *
+ * Both counts are read from the Worker's own session log, so a text assignment —
+ * offered the Worker Fusion tools and nothing else — is judged the same way. An
+ * unreadable log yields no evidence and therefore keeps the generic verdict.
+ */
+export declare function workerNoReportCause(input: {
+    requestedTools: number;
+    dispatchedToolCalls: number;
+}): 'unreachable-tools' | 'no-report';
+/**
+ * Whether the recorded unreachable route still speaks for the current order.
+ *
+ * The verdict is per work order: a new order must be judged on its own dispatch,
+ * so a replacement route is never refused on a predecessor's evidence. The task
+ * is only wedged while the same order that failed still owns the handoff.
+ */
+export declare function workerUnreachableFor(order: {
+    id?: string;
+} | undefined, record: {
+    workOrderId?: string;
+} | undefined): boolean;
+/**
+ * The one wording for a route that cannot reach Host tools, shared by every entry
+ * point that can rediscover the verdict, so a later `fusion_wait` says the same
+ * thing as the delegation that first failed.
+ */
+export declare function workerUnreachableReply(childId: string | undefined, route: {
+    provider: string;
+    model: string;
+}): string;
+/** Continue/switch is refused before the route is written. Say so when a switch was requested. */
+export declare function unsettledContinuationError(switching: boolean): {
+    zh: string;
+    en: string;
+};

package/lib/types/host/workspace-guard.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Workspace write mutual exclusion for agents Fusion owns.
+ * Ordinary sessions are not governed: a foreign lease does not make them read-only.
+ * `exempt` covers read tools, Fusion's own control tools, and `run_code`.
+ * The caller passes the lease for this call's cwd only, so another directory is isolated.
+ */
+export declare function workspaceWriterDenial(input: {
+    fusionOwned: boolean;
+    exempt: boolean;
+    cwd?: string;
+    leaseHolder?: string;
+    agentId: string;
+}): string | undefined;

package/lib/types/host/workspace.d.ts

@@ -0,0 +1,52 @@
+import { SnapshotId } from '../contracts.js';
+export declare const SNAPSHOT_EXCLUSIONS: readonly [".git", "node_modules", "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache"];
+export declare const FALLBACK_EXCLUSIONS: readonly [".git", "node_modules", "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache", ".venv", "venv", ".tox", ".nox", ".eggs", ".gradle", ".next", ".turbo", ".cache"];
+export interface WorkspaceEntry {
+    path: string;
+    kind: 'file' | 'symlink';
+    digest: string;
+    executable: boolean;
+}
+export interface WorkspaceSnapshot {
+    schemaVersion: 1;
+    root: string;
+    excludedDirectoryNames: readonly string[];
+    /** Present when the entry list came from git (tracked + untracked, minus the repository's ignore rules). */
+    ignoreRules?: 'git-exclude-standard';
+    entries: readonly WorkspaceEntry[];
+    id: SnapshotId;
+}
+export declare function workspacePath(root: string, path: string): string;
+/**
+ * The root-relative form of a model-supplied path ('' for the root itself), or undefined outside the workspace.
+ * `root` is the canonical (realpath) workspace, but models write the session's own spelling of it: macOS
+ * `/tmp/x` for `/private/tmp/x`, a symlinked checkout, another drive-letter case. So an absolute path is
+ * matched by the filesystem identity of its ancestors, not by string. The shortest ancestor that is the root
+ * wins, so a link below the root is never followed here; workspacePath still refuses one.
+ */
+export declare function workspaceRelative(root: string, path: string): string | undefined;
+export declare function snapshotWorkspace(cwd: string): WorkspaceSnapshot;
+export declare function changedPaths(before: WorkspaceSnapshot, after: WorkspaceSnapshot): string[];
+/**
+ * Workspace-relative allowlist check. `/` always separates segments; `\` is a
+ * separator only on Windows — on POSIX it is a legal filename character, so
+ * `src\file.ts` must not match a `src` grant there. `.`/`..` segments then
+ * resolve lexically, so `src/../outside` (and its backslash form on Windows)
+ * never matches a `src` grant. workspacePath only bounds a path to the
+ * workspace root; membership in allowedPaths is decided here. Absolute paths
+ * (`/x`, `C:\x`, drive-relative `C:x`, UNC), empty paths and NUL are not
+ * workspace-relative and never normalize.
+ */
+export declare function normalizeRelativePath(path: string): string | undefined;
+/**
+ * One `allowedPaths` entry → the prefix it grants. `dir/**` is the conventional spelling of
+ * "this directory and everything under it", so it grants exactly what `dir` grants.
+ *
+ * A grant that matches nothing is not a narrow scope, it is an unrecoverable deadlock: the
+ * Host freezes it, the Worker's writes then fail the freeze check forever, and widening the
+ * scope needs the delegation-time bytes those writes already replaced (session-daa71a4a: a
+ * `lib/types/**` grant authorized nothing while the task's own build rewrote exactly those
+ * declarations). So a wildcard the Host cannot honour is refused when the Lead grants it.
+ */
+export declare function grantOf(raw: string): string;
+export declare function pathAllowed(path: string, allowed: readonly string[]): boolean;

package/lib/types/identity.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The identity this plugin registers under.
+ *
+ * Both halves import this module, so the provider route, the model entry and
+ * the durable producers keep one spelling. It deliberately has no imports: the
+ * browser bundle inlines it and must not pull a Host module in.
+ */
+/** The HTTP path the panel's own views and actions are served from. */
+export declare const FUSION_API_PATH = "/api/fusion";
+/**
+ * The path this plugin served before the rename. The host keeps answering it
+ * so a browser tab holding the previous client bundle keeps working until its
+ * next reload; nothing in the current bundle requests it.
+ */
+export declare const LEGACY_FUSION_API_PATH = "/api/model-fusion";
+/**
+ * The npm package this project publishes under.
+ *
+ * Distinct from {@link PLUGIN_NAME}: the package name is the registry identity
+ * and the module specifier a profile's patch resolves, while the plugin id is
+ * the runtime identity that names the state directory, the bundle patch row and
+ * the log marker. Keeping them apart is what lets the package move into a scope
+ * without moving anyone's data.
+ */
+export declare const PACKAGE_NAME = "@sqdr2/dsh-fusion";
+/** The plugin id this project registers under, and the name of its state directory. */
+export declare const PLUGIN_NAME = "dsh-fusion";
+/** The plugin id and package name this project used before the rename. */
+export declare const LEGACY_PLUGIN_NAME = "dsh-model-fusion";
+/** Registered provider route for the Fusion model entry. */
+export declare const FUSION_PROVIDER = "dsh-fusion";
+/** The single model id the Fusion entry advertises. */
+export declare const FUSION_MODEL = "auto";
+/**
+ * The provider route this plugin registered before it was renamed from
+ * `dsh-model-fusion`. Sessions created then still name it in their durable
+ * `model/selection` event, so reading it as Fusion is what keeps those
+ * sessions working; writing it is never correct.
+ */
+export declare const LEGACY_FUSION_PROVIDER = "dsh-model-fusion";
+/** Whether a provider route belongs to this plugin, under either name. */
+export declare const isFusionProvider: (provider: string | undefined) => boolean;
+/** Whether a route names the Fusion entry, under either name. */
+export declare const isFusionSelection: (route: {
+    provider?: string;
+    model?: string;
+} | undefined) => boolean;
+/**
+ * How a native model-switch notice names this entry (`provider/model`).
+ *
+ * Both spellings are listed: a session that switched to Fusion before the
+ * rename carries the old one in its durable log, and the notice is the same
+ * non-change on every Fusion step either way.
+ */
+export declare const FUSION_SELECTION_LABELS: readonly ["dsh-fusion/auto", "dsh-model-fusion/auto"];
+/**
+ * Whether a route already names the entry under its current name. A durable
+ * intent that fails this is rewritten before the next request is assembled;
+ * the legacy spelling is a read-side alias, not a route that still dispatches.
+ */
+export declare const isCurrentFusionSelection: (route: {
+    provider?: string;
+    model?: string;
+} | undefined) => boolean;

package/lib/types/index.d.ts

@@ -0,0 +1,34 @@
+export { FusionError, FUSION_CONTEXT_BUDGET, NEEDS_REPAIR, OUTCOME_UNKNOWN, SPEND_UNAUTHORIZED, STORE_MIGRATION_REQUIRED, USAGE_LEDGER_REQUIRED, WORK_ORDER_CONFLICT } from './errors.js';
+export * from './contracts.js';
+export { digestOf, sha256Hex } from './digest.js';
+export { reduce, reduceAll } from './task/reducer.js';
+export { FileFusionStore, failingRenameIo, requireStorageProjectionVersion, STORE_PROJECTION_VERSION } from './task/store.js';
+export type { FusionStore } from './task/store.js';
+export { SqliteFusionStore } from './task/sqlite-store.js';
+export type { TaskState } from './task/state.js';
+export { normalizeUsage, observationFromNormalized, apiEquivalentUsd, priceUsage } from './usage/normalize.js';
+export type { UsageObservationMeta, UsagePrice, UsagePriceStatus } from './usage/normalize.js';
+export { ingestDurable, ingestObservation, newLedger, projectLedger, restoreLedger, splitInput, } from './usage/ledger.js';
+export type { CanonicalBill, UsageLedgerV2, UsageObservation, UsageProjection, UsageRequestKey } from './usage/ledger.js';
+export { quoteLedger } from './usage/pricing.js';
+export type { PriceRates, RequestQuote } from './usage/pricing.js';
+export { BudgetLedger, loadSpendingAuthorization } from './usage/budget.js';
+export { WorkspaceWriteLease, classifyEffect } from './execution/write-lease.js';
+export { resolveProfile, completeProfile, loadJsonObject, promptDigests } from './profile/resolve.js';
+export { assertFinalBudget, measureRequest, inputBudget, boundedOverflowRecovery } from './context/guard.js';
+export { consumeApproval, answerApproval, neverMeansDeny, pendingDoesNotExpire } from './approval/logical.js';
+export { evaluateReport, DEFAULT_TEST_VERIFIERS } from './evidence/gate.js';
+export type { TrustedEvidenceRegistry, RegisteredVerifier, EvaluateReportOptions } from './evidence/gate.js';
+export { assertPlannedCheck, invocationHeader, memoryVerificationRegistry, resolveInvocation, checkPlanDigest } from './evidence/receipts.js';
+export type { CheckPlan, InvocationHeader, PlannedReceipt, VerificationRegistry } from './evidence/receipts.js';
+export { assertCurrentSubject, captureTicket, createReviewTicket, resultFromCapturedTicket, reviewOutboxRow, reportSubject, reviewReadinessReceipt, reviewRequestedEvent, } from './review/ticket.js';
+export { appendCapturedReviewResult, loadReviewOutboxByRequestId, persistReviewRequest } from './review/dispatch.js';
+export { classifyReview, reviewAttemptFields, normalizeTermination, toReducerReviewDecision } from './review/protocol.js';
+export type { ReviewClassification, ReviewDecision, ReviewStatus, ReviewTermination } from './review/protocol.js';
+export { reconcile } from './recovery/reconcile.js';
+export { loadPromptBundle, promptManifest } from './prompts.js';
+export { runNativeBenchmark, NativeRequestBudget } from './benchmark/native-run.js';
+export type { NativeBenchmarkOptions } from './benchmark/native-run.js';
+export { resolveBenchmarkOutputLimits } from './benchmark/output-limits.js';
+export type { BenchmarkOutputLimits } from './benchmark/output-limits.js';
+export { snapshotWorkspace } from './host/workspace.js';