@wingsky-1/dsh-decision-gateway 0.2.6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wingsky-1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,56 @@
+# dsh-decision-gateway
+
+General-purpose assistant decision gateway (JEV is the first provider): frozen asking guides (English) + dual-track keys + local secret-shape precheck + official SystemOne calls (transport via the official `@typesafe-ai/sdk`, inlined at build time; base URL and model are both pinned, zero runtime dependencies).
+
+Scope: suited for agent decisions needing calibrated binary / score / risk verdicts, secret-shaped text prechecked locally before egress, and auditable switches/history; not suited for auto-execution (advisory levels only, no executors), open-ended reasoning (frozen templates only), or reliable queues/transactional writes.
+
+One-click install (restart `dsh web` afterwards to activate):
+
+```sh
+dsh plugin --profile web add @wingsky-1/dsh-decision-gateway
+```
+
+- Model tools: `ws_request_verdict` (decide), `ws_list_verdict_guides` (read-only).
+- Loopback routes: `/api/dsh-decision-gateway/health|config|presets|history|test-connection`.
+- 5 frozen asking guides (templateVersion always 1, English prose, zero preset questions): general / secret-leak (disabled by default) / plan-review / risk-check / custom. Callers bring the full question set per call via `questions_override` (1-20 questions, required; the first question drives the verdict, extra questions travel as context). Wording note: general changed from binary/two to a 2-10-candidate choice, custom changed from three to first-question-driven; templateVersion stays 1; stored history templateVersion remains observably 1. Tool params: `preset_id` is one of the 5 frozen ids or a custom id (custom:true entries from `ws_list_verdict_guides`); `state.lang` is en/zh/unknown and defaults to unknown when omitted; score questions carry no options but may carry 2-10 levels (default 1-5 when omitted, e.g. five levels 1-5 or two levels low-high rescaled to 1-5).
+- Custom presets (`custom-presets.json`, absent means empty): incremental `PUT /config` key `customPresets` (full replace; ids must not collide with frozen, cap 0|1|2); custom ids are directly decidable (same switch/cap semantics); history stores a redacted snapshot of the called questions, and `GET /history` enriches display titles (only ids are stored).
+
+## Quick start
+
+1. Install and restart `dsh web` (command at the top); the dsh-decision-gateway card appears in settings, and service-available on the connection tab means the host side is mounted.
+2. Set the key (either): put an exported ENV name in `apiKeyRef` (recommended, the value never lands on disk); or unfold the plaintext section and paste the key (no double confirmation).
+3. Hit test-connection (`POST /test-connection`, empty body is legal): `ok` + `latencyMs` means end-to-end works; on `NO_KEY`, check the ENV export or whether the plaintext was saved.
+
+## Configuration
+
+Three files under `~/.dsh/@wingsky-1/dsh-decision-gateway/` (`DSH_HOME`-aware, dirs 0700 / files 0600 / atomic writes):
+
+- `config.json`: `{version:1, connection:{apiKeyRef?,hasPlaintextKey,timeoutMs:8000,maxConcurrency:4,truncBudget:32000}, presets:[5 ids+enabled+automationCap(0|1|2)], history:{perSession:200,totalSessions:50}}`;
+- `presets.json`: switch overlay; `secrets.json`: the only plaintext location; `VERSION`: storage version tick.
+
+PUT `/config`: `apiKeyRef` must match `^[A-Z][A-Z0-9_]{1,63}$`; mutually exclusive with `apiKeyPlaintext`; plaintext needs no confirmation (a `confirm` field is ignored when present); shape rejections are 400 with category only; retired keys like `baseUrl` are 400.
+
+## Security model
+
+- **Off-device data**: truncated text + questions leave the device only when the local secret-shape precheck misses and a key is available; on hit (e.g. `sk-…`, `AKIA…`, `ghp_…`, private-key blocks, `password=`) nothing leaves and the decision routes to human (`appliedSource: local-precheck`, `choice: human`); a first-answer Noul (abstention) likewise forces tier none and routes to human.
+- **Dual-track keys**: ENV reference (`apiKeyRef`) wins over plaintext; switching to ENV folds (clears) `secrets.json`; plaintext writes need no confirmation; mutual exclusion is still enforced server-side.
+- **0600/0700**: namespace dir 0700, files 0600, temp-file + rename atomic writes.
+- **Masked surface**: GET `/config` returns only the `apiKeyRef` name and `hasPlaintextKey`; key material is never echoed; shape rejections return only an `empty|too-short|charset` category.
+- **secret preset warning**: `secret-leak` is disabled by default, enable it only when you must check untrusted text for real secrets (local precheck still runs first when enabled); history `snippetRedacted` is redacted-then-truncated to ≤200 chars; raw keys are never stored.
+- **Pinned BaseURL**: `https://api.typesafe.ai/v1/systemone` is a load-asserted constant, never configurable; PUT with `baseUrl`-like keys is 400. The model is pinned to `jev-latest` under the same treatment; score floats rescale to 1..5 by sent level count (default five levels behave as round+1, all clamped; custom 2-10 levels travel in `levels`, e.g. five levels 1-5 or two levels low-high), tiers derive from confidence at ≥0.8 high/≥0.5 low (else none).
+
+## History
+
+One jsonl file per (workdir rootHash, sessionId) (workdir comes from the session store, falling back to the caller directory): 200 entries per session rotation, 50 sessions total (count semantics only; no pinning on mtime ties). Stored entries carry templateVersion (always 1, observable; wording revisions do not bump the version). Query `root` accepts a full path, a `rootHash`, or a bare basename (matched against `rootDisplay`); deletion is single-session only (`root` + `sessionId` both required, ambiguous basenames are 400). Session titles enrich at read time for live sessions only (`sessionTitle`, falling back to the short id, never persisted).
+
+## Verification and troubleshooting
+
+- Liveness: `GET /api/dsh-decision-gateway/health` returns `ok` / `version` / `templateVersion`.
+- Fence: non-loopback callers always get 403, off-table methods get 405 (403 is checked first).
+- Common failures: `NO_KEY` (no usable key), `PRESET_DISABLED` (preset switched off), `MUTUALLY_EXCLUSIVE` (`apiKeyRef` sent together with plaintext), key-shape 400s return only an `empty|too-short|charset` category.
+- Missing history: prefer a full path or `rootHash` for `root` (basenames match against `rootDisplay`, ambiguous delete is 400); `GET /history` defaults to 100 entries, max 500.
+
+## Follow-ups (deferred, not in this version)
+
+- **Startup self-check migration**: the assembly-time chain currently only anchors versions (seed when missing / no-op when anchored / refuse future versions); config self-checks and legacy migrations arrive with future steps. Plaintext double confirmation was removed with explicit user approval.
+- **Non-grouped three-file writes**: config/presets/secrets are three independent atomic writes, not one transaction; a crash between writes may leave mixed old/new state (read side converges with fill-defaults). That crash window is tolerated, no WAL.

package/README.md

@@ -0,0 +1,56 @@
+# dsh-decision-gateway
+
+通用辅助决策网关（JEV 为首个 provider）：frozen 出题规范（英文） + 双轨密钥 + 本地密形预检 + SystemOne 官方调用（经官方 `@typesafe-ai/sdk` 构建期内联传输，基址与模型双冻结，零运行时依赖）。
+
+适用：需要校准二选一 / 评分 / 风险二值建议的 agent 决策、密钥文本先本地预检再出境、开关与历史需审计留痕的场景；不适用：自动执行（本包只给建议等级，不持执行器）、开放式推理（只跑 frozen 模板题目）、可靠消息队列或事务组写。
+
+一键安装（安装后重启 `dsh web` 生效）：
+
+```sh
+dsh plugin --profile web add @wingsky-1/dsh-decision-gateway
+```
+
+- 模型工具：`ws_request_verdict`（决议）、`ws_list_verdict_guides`（只读清单）。
+- 回环路由：`/api/dsh-decision-gateway/health|config|presets|history|test-connection`。
+- 5 预设 frozen 出题规范（templateVersion 恒为 1，英文描述，零考题）：general / secret-leak（默认关闭）/ plan-review / risk-check / custom。调用方每次经 `questions_override` 自带全量题目（1-20 题，必填；首题驱动输出，多题仅首题决议）。措辞注：general 已由 binary/two 改为 2-10-candidate choice，custom 由 three 改为首题驱动，templateVersion 仍为 1；落史 templateVersion 可观测仍为 1。工具参数：`preset_id` 为 5 frozen id 或自建 id（`ws_list_verdict_guides` 的 custom:true 项）；`state.lang` 为 en/zh/unknown，缺席默认为 unknown；score 题禁 options、可带 2-10 levels（缺席默认 1-5，如五档 1-5 或两档 low-high 重缩放到 1-5）。
+- 自建预设（`custom-presets.json`，缺席即空）：`PUT /config` 增量键 `customPresets` 全量替换（id 不可与 frozen 重名，cap 0|1|2）；自建 id 可直接决议（开关/cap 同 frozen 语义）；落史存调用题目快照（脱敏），`GET /history` enrich 展示标题（只存 id）。
+
+## 最短上手
+
+1. 安装并重启 `dsh web`（见顶部命令）；设置页出现 dsh-decision-gateway 卡片，连接 tab 显示服务可用即宿主端已挂载。
+2. 配密钥（二选一）：把已导出的 ENV 名填入 `apiKeyRef`（推荐，值永不落盘）；或展开明文折叠，直接输入密钥保存（免二次确认）。
+3. 点测试连接（`POST /test-connection`，空体合法）：回 `ok` + `latencyMs` 即端到端可用；报 `NO_KEY` 先检查 ENV 是否导出或明文是否保存。
+
+## 配置
+
+三文件独立存放于 `~/.dsh/@wingsky-1/dsh-decision-gateway/`（感知 `DSH_HOME`，目录 0700 / 文件 0600 / 原子写）：
+
+- `config.json`：`{version:1, connection:{apiKeyRef?,hasPlaintextKey,timeoutMs:8000,maxConcurrency:4,truncBudget:32000}, presets:[5 个 id+enabled+automationCap(0|1|2)], history:{perSession:200,totalSessions:50}}`；
+- `presets.json`：开关覆盖层；`secrets.json`：明文密钥唯一落盘处；`VERSION`：存储版本刻度。
+
+PUT `/config`：`apiKeyRef` 须匹配 `^[A-Z][A-Z0-9_]{1,63}$`；与 `apiKeyPlaintext` 互斥；明文免二次确认（`confirm` 字段若出现则忽略）；形状拒收 400 仅回类别；`baseUrl` 等退役键 400。
+
+## 安全模型
+
+- **离境数据**：仅当本地密形预检未命中且密钥可用时，才向官方基址发送截断后正文 + 题目；命中密形（如 `sk-…`、`AKIA…`、`ghp_…`、私钥块、`password=`）即不离境、直转人工（`appliedSource: local-precheck`，`choice: human`）；首题答案为 Noul（弃权）同样不分级、直转人工（tier none）。
+- **双轨密钥**：ENV 引用（`apiKeyRef`）优先于明文；切到 ENV 轨即折叠清空 `secrets.json`；明文写入免二次确认，服务端仍校验互斥。
+- **0600/0700**：命名空间目录 0700，三文件 0600，经临时文件 + rename 原子写入。
+- **掩码面**：GET `/config` 只回 `apiKeyRef` 名与 `hasPlaintextKey`，密钥原文永不回显；形状拒收 400 仅回 `empty|too-short|charset` 类别。
+- **secret 预设警告**：`secret-leak` 默认关闭，仅在需检查不可信文本是否含真密钥时启用（启用后仍先过本地预检）；历史 `snippetRedacted` 先脱敏后截断 ≤200 字，原始密钥永不入库。
+- **BaseURL 写死**：`https://api.typesafe.ai/v1/systemone` 为加载断言常量，不接受任何配置覆盖；PUT 遇 `baseUrl` 类键直接 400。模型冻结为 `jev-latest`（同等 pin 待遇）；score 回浮点按发送档数重缩放回 1..5（默认五档即 round+1，均钳制；自带 levels 用 `levels` 字段 2-10 档，如五档 1-5 或两档 low-high），tier 按置信度 ≥0.8 high/≥0.5 low 派生（其余 none）。
+
+## 历史
+
+按（工作目录指纹 rootHash，sessionId）分文件 jsonl（工作目录取自会话 store，取不到回落调用方目录）：每会话 200 条轮转，总会话 50（只保数量语义，mtime 并列时不钉删谁）。落史条目含 templateVersion（恒为 1，可观测；措辞修订不 bump 版本）。查询 `root` 可传完整路径、`rootHash`，或仅传 basename（按 `rootDisplay` 匹配）；删除仅支持单会话（`root` 与 `sessionId` 双必填，basename 多命中即 400）。会话标题仅活会话在读取时 enrich 显示（`sessionTitle`，无标题回落短 id，永不落盘）。
+
+## 验证与排障
+
+- 存活：`GET /api/dsh-decision-gateway/health` 回 `ok` / `version` / `templateVersion`。
+- 围栏：非本机回环一律 403，方法不在表里 405（先判 403 再判 405）。
+- 常见失败：`NO_KEY`（无可用密钥）、`PRESET_DISABLED`（预设被关）、`MUTUALLY_EXCLUSIVE`（`apiKeyRef` 与明文同传）、密钥形状 400 仅回 `empty|too-short|charset` 类别。
+- 历史查不到：`root` 传完整路径或 `rootHash` 最稳（basename 按 `rootDisplay` 匹配，删除多命中即 400）；`GET /history` 缺省 100 条、上限 500。
+
+## 后续项（deferred，非本版实现）
+
+- **启动自检迁移**：装配期升级链现只做版本锚定（缺席播种/已锚定空转/未来版本拒绝启动）；配置形态自检与旧盘迁移留待加步骤时再写。明文写入免二次确认（用户已明确批准移除该 friction）。
+- **三文件非组写**：config/presets/secrets 三次独立原子写，非事务组写；进程在写盘间隙崩溃可能留下新旧混搭（读侧以“缺口补默认”收敛），该崩溃窗口被容忍，不做预写日志。

package/cordis.patch.yml

@@ -0,0 +1,7 @@
+# dsh-decision-gateway bundle patch：向 web profile 名册插入通用辅助决策网关（JEV 为首个 provider）。
+# 主机端（exports "."）在宿主进程运行：注册 ws_request_verdict / ws_list_verdict_guides
+# 两个 agent 工具，并提供 /api/dsh-decision-gateway/* 回环路由；
+# 浏览器端（exports "./client"）为占位干净模块（本包能力在宿主端，见 README 安全模型）。
+- insert:
+    - id: dsh-decision-gateway
+      name: "@wingsky-1/dsh-decision-gateway"

package/lib/THIRD-PARTY-LICENSES

@@ -0,0 +1,35 @@
+THIRD-PARTY LICENSES
+===================
+
+本发布物遵循「运行时依赖 = 构建期内联」模型，将下列第三方库打包进产物
+（随包分发的 vendored 裸二进制单列一段并标出来源）；
+依其许可证条款随附许可文本与版权声明。
+生成：scripts/collect-licenses.ts（issue #13）。本仓库自身以 MIT 许可发布。
+
+
+=====================================================================
+@typesafe-ai/sdk@0.6.0 — MIT
+来源：https://www.npmjs.com/package/@typesafe-ai/sdk
+=====================================================================
+
+MIT License
+
+Copyright (c) 2026 TypeSafe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/lib/client/api/contract.d.ts

@@ -0,0 +1,37 @@
+/**
+ * dsh-decision-gateway — 客户端契约消费层（api/ 域内模块，经 interface.ts 门面引用）。
+ *
+ * 类型直接复用共享 ConfigV1/HistoryEntry/DecisionLang/DecisionTier/AutomationCap/AutomationLevel；
+ * 解析/归一/校验为纯函数（可单测直连）。主代理裁决：automationCap 三档 0|1|2；
+ * GET /config 裸 v1 掩码体并兼容 {config}/{data} 包装；失败体含 errorCode + category。
+ * 零 bare import。
+ */
+import type { AutomationCap, AutomationLevel, ConfigV1 as SharedConfigV1, HistoryEntry as SharedHistoryEntry, DecisionLang, DecisionTier } from "../../shared/interface.js";
+/** 共享类型复出（子模块经 api/interface.ts 消费）。 */
+export type { AutomationCap, AutomationLevel, DecisionLang, DecisionTier };
+export type DecisionConfigV1 = SharedConfigV1;
+export type DecisionHistoryEntry = SharedHistoryEntry;
+/** 预设开关项（配置 v1.presets 元素形态）。 */
+export type DecisionPresetConfigEntry = SharedConfigV1["presets"][number];
+/** 模板库目录项（GET /presets 元素形态；服务端字段缺失时容错）。 */
+export interface DecisionPresetInfo {
+    readonly id: string;
+    readonly templateVersion?: number;
+    readonly label?: string;
+    readonly description?: string;
+    readonly custom?: boolean;
+}
+export declare function failureCategory(status: number, body: unknown): string;
+/** automationCap 归一到 0|1|2（非法回 0=none）。 */
+export declare function normalizeCap(v: unknown): AutomationCap;
+export declare function capLabel(cap: AutomationCap): string;
+/** 防御式解析 GET /config（裸 v1 或 {config}/{data} 包装均接受）。 */
+export declare function parseConfigPayload(payload: unknown): DecisionConfigV1 | null;
+/** 防御式解析 GET /presets（裸数组或 {presets} 包装均接受）。 */
+export declare function parsePresetsPayload(payload: unknown): DecisionPresetInfo[];
+export declare function toHistoryEntry(it: unknown): DecisionHistoryEntry | null;
+export declare function parseHistoryPayload(payload: unknown): DecisionHistoryEntry[];
+/** ENV 名本地校验（与共享 API_KEY_REF_RE 同正则）。 */
+export declare function validApiKeyRef(name: string): boolean;
+/** 0..1 概率钳制（概率条宽度与文案同源；与 automationCap 三档无关）。 */
+export declare function clamp01(v: unknown): number;

package/lib/client/api/interface.d.ts

@@ -0,0 +1,9 @@
+/**
+ * dsh-decision-gateway — api 域门面（域内跨文件唯一入口；本文件只转出、不放实现）。
+ *
+ * 传输（routes.ts）+ 契约消费（contract.ts）经此门面被 panes / index 消费；
+ * 禁止绕过门面直引域内实现。
+ */
+export { APP_ROUTES, CLIENT_FETCH_TIMEOUT_MS, fetchTimeout } from "./routes.js";
+export { capLabel, clamp01, failureCategory, normalizeCap, parseConfigPayload, parseHistoryPayload, parsePresetsPayload, validApiKeyRef, } from "./contract.js";
+export type { AutomationCap, AutomationLevel, DecisionConfigV1, DecisionHistoryEntry, DecisionLang, DecisionPresetConfigEntry, DecisionPresetInfo, DecisionTier, } from "./contract.js";

package/lib/client/api/routes.d.ts

@@ -0,0 +1,11 @@
+/** 卡片实际使用的路由表（注入优先，共享兜底）。 */
+export declare const APP_ROUTES: {
+    readonly health: string;
+    readonly config: string;
+    readonly presets: string;
+    readonly history: string;
+    readonly testConnection: string;
+};
+/** 客户端 fetch 默认超时（浏览器→dsh web 一跳；与 provider-usage 10s 先例对齐）。 */
+export declare const CLIENT_FETCH_TIMEOUT_MS = 10000;
+export declare function fetchTimeout(url: string, init?: RequestInit, timeoutMs?: number): Promise<Response>;

package/lib/client/index.d.ts

@@ -0,0 +1,8 @@
+/** 浏览器端上下文窄面（实际使用的面：get + effect；与 inject 对齐）。 */
+interface ClientContext {
+    get: (name: string) => unknown;
+    effect: (execute: () => () => void, label?: string) => unknown;
+}
+export declare function apply(ctx: ClientContext): void;
+export declare const inject: string[];
+export {};

package/lib/client/locale.d.ts

@@ -0,0 +1,31 @@
+/**
+ * dsh-decision-gateway — 客户端文案绑定（零依赖纯函数，可被 node 单测直测）。
+ *
+ * 语言判定：浏览器 locale 以 zh 开头即中文，其余英文（含缺 navigator 的 node 环境
+ * 回落英文——与 JEV 英文问答更擅长一致）。单测经 setLang 锁定语言。
+ *
+ * 宿主 locale 服务（notifier 同款）：apply 期 register 字典 + bind 装配，订阅回调重绑，
+ * 切语言免刷新跟随；未装配（旧运行时 / 单测直调）回落本地字典——界面照常渲染中文案。
+ */
+import { zh } from "./locales.js";
+export type DecisionLocale = "zh" | "en";
+export type DecisionTextKey = keyof typeof zh;
+/** 宿主装配的翻译函数（官方 ctx.locale.bind(ns) 产物；key 即本包字典键）。 */
+export type HostTranslate = (key: string, params?: Record<string, unknown>) => string;
+/** 装配 / 重绑宿主翻译函数（apply 期与 locale 订阅回调调用）。
+ * 守住 bound 恒可调用：宿主异常实现可能返回非函数（命名空间未命中等），
+ * 此时忽略装配、t() 回落本地字典（此前本地路径永不抛错，回归面见评审）。 */
+export declare function bindTranslate(next: HostTranslate): void;
+/** 摘除宿主绑定、回落本地字典（卸载 / 单测隔离用）。 */
+export declare function unbindTranslate(): void;
+/** 解析当前语言（浏览器 zh 开头即 zh，否则 en）。 */
+export declare function resolveLang(): DecisionLocale;
+/** 锁定语言（单测用；正常渲染走模块加载期解析）。 */
+export declare function setLang(next: DecisionLocale): void;
+/** 当前语言。 */
+export declare function lang(): DecisionLocale;
+/** 取文案（key 即 zh 源；缺 key 永不发生——en 由 Record<keyof typeof zh> 锁死）。
+ * 支持 {n} 数字插值（中英语序不同，禁止空串 key 占位）。 */
+export declare function t(key: DecisionTextKey, params?: {
+    readonly n?: number;
+}): string;

package/lib/client/locales.d.ts

@@ -0,0 +1,122 @@
+/**
+ * dsh-decision-gateway — 客户端文案字典（中英双语，零运行时依赖）。
+ *
+ * 双语平衡：`zh` 为 key 源；`en` 必须覆盖全部 key（编译期锁平衡：
+ * `EnDict = Record<keyof typeof zh, string>`，缺 key 即 tsc 红）。
+ * 不进字典：console 日志、frozen 出题规范英文原文（数据不翻译）、
+ * 服务端动态值（tier/automation/resultKind/errorCode/置信度数字）。
+ */
+/** 简体中文文案（key 源）。 */
+export declare const zh: {
+    readonly tabLabel: "JEV 决策";
+    readonly cardName: "JEV 决策（dsh-decision-gateway）";
+    readonly cardDesc: "连接 / 模板库 / 历史：密钥掩码显示，原文永不回显。";
+    readonly tabsAria: "JEV 决策设置";
+    readonly tabConnection: "连接";
+    readonly tabPresets: "模板库";
+    readonly tabHistory: "历史";
+    readonly healthChecking: "自检中…";
+    readonly healthOk: "服务可用";
+    readonly healthBad: "服务异常 ";
+    readonly healthUnreachable: "服务不可达";
+    readonly notLoaded: "未加载";
+    readonly loading: "加载中…";
+    readonly save: "保存";
+    readonly retry: "重试";
+    readonly exportJson: "导出 JSON";
+    readonly detail: "详情";
+    readonly copyCustom: "复制为自定义";
+    readonly copyCustomNote: "复制为自定义走新增接口（P1），当前仅展示规范。";
+    readonly refresh: "刷新";
+    readonly clearSession: "清空本会话";
+    readonly testOffline: "离线自检";
+    readonly testing: "自检中…";
+    readonly testOk: "自检通过";
+    readonly testFail: "自检失败：";
+    readonly enabledOn: "已启用";
+    readonly enabledOff: "已关闭";
+    readonly enablePresetAria: "启用预设 ";
+    readonly emptyPresets: "暂无预设。";
+    readonly emptyHistory: "暂无历史。";
+    readonly emptySpec: "暂无规范。";
+    readonly truncBadge: "截断";
+    readonly errPrefix: "错误：";
+    readonly noProb: "无概率";
+    readonly highLine: "high 线 80%";
+    readonly capNone: "none（仅人工）";
+    readonly capLabel: "自动化上限";
+    readonly tplVersion: "模板版本 v";
+    readonly frozenNote: "（frozen，恒为 1）";
+    readonly countEntries: "共 {n} 条";
+    readonly keyMode: "密钥方式（二选一，互斥）";
+    readonly keyEnv: "ENV 引用";
+    readonly keyPlain: "明文密钥";
+    readonly modeEnvNote: "当前 ENV 引用：明文侧已隐藏。";
+    readonly modePlainNote: "当前明文密钥：ENV 侧已隐藏。保存明文将清除已存的 ENV 引用（切轨）；切回 ENV 即清空明文。";
+    readonly maskDotsAria: "已配置明文密钥掩码（定长八点，与原文长度无关）";
+    readonly envLabel: "ENV 变量名（apiKeyRef）";
+    readonly envAria: "ENV 变量名";
+    readonly envPlaceholder: "大写字母开头，如 JEV_API_KEY（留空不改）";
+    readonly envRule: "规则：^[A-Z][A-Z0-9_]{1,63}$；与明文密钥互斥，只提交其一。";
+    readonly envBad: "ENV 名非法：须满足 ^[A-Z][A-Z0-9_]{1,63}$（如 JEV_API_KEY）。";
+    readonly plainAria: "明文密钥";
+    readonly plainPlaceholder: "输入新的明文密钥以替换（留空不改）";
+    readonly plainFoldTitle: "输入明文密钥…";
+    readonly plainNote: "密钥原文永不回显；已配置仅显示“已配置”。占位符不含任何真密钥示例。";
+    readonly maskOn: "密钥：已配置";
+    readonly maskOff: "密钥：未配置";
+    readonly maskEnv: "ENV：";
+    readonly loadedNote: "已加载配置 v1。明文框恒空：已配置仅显示“已配置”。";
+    readonly loadFail: "加载失败：";
+    readonly loadFailShort: "加载失败";
+    readonly mutualError: "明文与 ENV 引用互斥：请先清空 ENV 输入框（留空）再提交明文。";
+    readonly nanError: "高级参数须为数字。";
+    readonly saving: "保存中…（明文仅本次提交，不回显）";
+    readonly savedReload: "已保存。重新加载掩码态…";
+    readonly saveFail: "保存失败：";
+    readonly advTitle: "高级…";
+    readonly advTimeout: "请求超时 timeoutMs";
+    readonly advTimeoutHint: "默认 8000（毫秒，上限 120000）";
+    readonly advConcurrency: "最大并发 maxConcurrency";
+    readonly advConcurrencyHint: "默认 4";
+    readonly advTrunc: "截断预算 truncBudget";
+    readonly advTruncHint: "默认 32000（字符）";
+    readonly advPerSession: "单会话历史 perSession";
+    readonly advPerSessionHint: "默认 200（上限 1000）";
+    readonly advTotalSessions: "总会话数 totalSessions";
+    readonly advTotalSessionsHint: "默认 50（上限 200）";
+    readonly filterTitle: "过滤…";
+    readonly wsLabel: "工作目录";
+    readonly wsFilterAria: "工作目录过滤";
+    readonly sessLabel: "会话";
+    readonly sessFilterAria: "会话过滤";
+    readonly allWs: "全部工作目录";
+    readonly allSess: "全部会话";
+    readonly historyOrderNote: "倒序排列（含概率条 + tier + 截断徽标 + 错误行）。";
+    readonly clearing: "清空中…（仅单会话）";
+    readonly clearOk: "已清空本会话。重新加载…";
+    readonly clearFail: "清空失败：";
+    readonly confirmClear: "确认清空本会话？";
+    readonly confirmClearAgain: "再次点击确认清空当前会话历史（仅单会话 DELETE）。";
+    readonly clearScopeNote: "仅清空当前选中会话（DELETE 单会话），无批量清空";
+    readonly presetsMergedNote: "目录与开关位已合并。阈值微调即 automationCap 三档（0=none/1=low/2=high）。";
+    readonly presetsCount: "预设 {n} 个";
+    readonly presetsExported: "已导出 {n} 个预设（JSON 下载）。";
+    readonly presetsSaved: "已保存 {n} 个预设开关与阈值。";
+    readonly noImportNote: "无导入按钮：模板库只出不进。secret-leak 默认关闭（frozen 模板）。";
+    readonly customBadge: "自建";
+    readonly addCustom: "新建自建预设";
+    readonly deleteCustom: "删除";
+    readonly confirmDelete: "确认删除？";
+    readonly confirmDeleteCustom: "再次点击确认删除该自建预设（仅删本条）。";
+    readonly customIdLabel: "自建 id（小写字母/数字/连字符，不可与 frozen 重名）";
+    readonly customLabelLabel: "展示名（英文）";
+    readonly customDescLabel: "出题规范（英文自由文本，可抄模板写法）";
+    readonly customDraftNote: "保存后默认关闭，需手动启用；题目永随调用传入，不存模板。";
+    readonly cancelCustom: "取消";
+    readonly createCustom: "创建";
+    readonly customSaved: "自建预设已保存。";
+    readonly customFormInvalid: "id/展示名/规范均不能为空。";
+};
+/** 英文文案（必须覆盖 zh 全部 key）。 */
+export declare const en: Record<keyof typeof zh, string>;

package/lib/client/settings/card.d.ts

@@ -0,0 +1,7 @@
+/**
+ * dsh-decision-gateway — 设置独立页卡片（React，宿主 settings.section 插槽渲染）。
+ *
+ * 三 tab（连接/模板库/历史，一 tab 一主焦点）+ 健康徽标。样式独立 style.css。
+ */
+import * as React from "react";
+export declare function DecisionCard(): React.ReactElement;

package/lib/client/settings/connection.d.ts

@@ -0,0 +1,10 @@
+/**
+ * dsh-decision-gateway — 连接 tab（React，settings.section 独立页）。
+ *
+ * 要素：密钥二选一卡（radio 互斥，未选中轨整体隐藏；切轨保存自动清对方）/
+ * 离线自检 / 高级折叠 / 保存。Key 永不回显原文；placeholder 禁真密钥示例。
+ * 保存语义与 vanilla 一致：互斥阻断、ENV 形状校验、明文免二次确认、
+ * 未知键永不发送、保存后清空明文框并重载掩码态。
+ */
+import * as React from "react";
+export declare function ConnectionPane(): React.ReactElement;

package/lib/client/settings/format.d.ts

@@ -0,0 +1,4 @@
+/** dsh-decision-gateway — 纯显示格式函数（零依赖，可单测直连）。 */
+export declare function fmtTime(ts: number): string;
+/** 短 id（超长截断；完整值放 title）。 */
+export declare function shortId(id: string, len?: number): string;

package/lib/client/settings/history.d.ts

@@ -0,0 +1,9 @@
+/**
+ * dsh-decision-gateway — 历史 tab（React，settings.section 独立页）。
+ *
+ * 要素：工作目录下拉 + 会话下拉过滤，条目倒序含概率条 + tier + 截断徽标 + 错误行，
+ * 会话级清空两步确认仅调 DELETE 单会话。概率条细条 + 80% 阈值线（仅展示，判定以服务端
+ * tier 为准）+ 数字；无图表库，手写 div。
+ */
+import * as React from "react";
+export declare function HistoryPane(): React.ReactElement;

package/lib/client/settings/presets.d.ts

@@ -0,0 +1,9 @@
+/**
+ * dsh-decision-gateway — 模板库 tab（React，settings.section 独立页）。
+ *
+ * 要素：5 出题规范开关 + automationCap 三档（0=none/1=low/2=high，绝非百分比滑杆）
+ * + 导出 JSON，无导入。行内详情单开（aria-expanded），复制为自定义走新增接口（P1 占位）。
+ * 出题规范英文原文直排（数据不翻译）。保存携带快照 connection/history 原值回写。
+ */
+import * as React from "react";
+export declare function PresetsPane(): React.ReactElement;

package/lib/client/settings/prob.d.ts

@@ -0,0 +1,10 @@
+/** dsh-decision-gateway — 概率条小组件（React；无图表库，手写 div）。 */
+import * as React from "react";
+import type { DecisionHistoryEntry } from "../api/interface.js";
+/** 高置信阈值线（展示用；判定以服务端 tier 为准，本线仅视觉参考）。 */
+export declare const HIGH_LINE = 0.8;
+export declare function tierBadge(tier: DecisionHistoryEntry["tier"]): React.ReactElement;
+export declare function probPercent(entry: DecisionHistoryEntry): number;
+export declare function ProbBar({ entry }: {
+    readonly entry: DecisionHistoryEntry;
+}): React.ReactElement;