@yadsh/dsh-qa-surface 0.10.0 → 0.11.0

package/lib/client.js

@@ -5232,6 +5232,24 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			array(lazy(() => QaSkillJsonValueRemoteCodec$schema3)),
 			record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema3)).readonly()
 		]);
+		const QaSkillJsonValueRemoteCodec$schema4 = union([
+			literal(null),
+			string(),
+			number(),
+			literal(false),
+			literal(true),
+			array(lazy(() => QaSkillJsonValueRemoteCodec$schema4)),
+			record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema4)).readonly()
+		]);
+		const QaSkillJsonValueRemoteCodec$schema5 = union([
+			literal(null),
+			string(),
+			number(),
+			literal(false),
+			literal(true),
+			array(lazy(() => QaSkillJsonValueRemoteCodec$schema5)),
+			record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema5)).readonly()
+		]);
 		const _yadsh_dsh_qa_surface_qaSurface_accessAdminSnapshot_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_accessAdminSnapshot_result$schema = object({
 			"config": object({
@@ -5606,12 +5624,61 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				"accent": string().readonly().optional()
 			}).readonly().optional()
 		});
+		const _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_parameter_1$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_parameter_2$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_result$schema = object({
+			"token": string().readonly(),
+			"user": object({
+				"id": string().readonly(),
+				"email": string().readonly(),
+				"displayName": string().readonly(),
+				"role": union([
+					literal("user"),
+					literal("reviewer"),
+					literal("admin")
+				]).readonly(),
+				"createdAt": string().readonly(),
+				"lastLoginAt": union([literal(null), string()]).readonly(),
+				"disabled": boolean().readonly(),
+				"profile": object({
+					"fullName": string().readonly(),
+					"identities": record$2(string(), string()).readonly().readonly(),
+					"instructions": string().readonly(),
+					"updatedAt": union([literal(null), string()]).readonly()
+				}).readonly(),
+				"starters": object({
+					"items": array(object({
+						"label": string().readonly(),
+						"prompt": string().readonly()
+					})).readonly(),
+					"hideDefaults": boolean().readonly()
+				}).readonly()
+			}).readonly()
+		});
 		const _yadsh_dsh_qa_surface_qaSurface_accountsClaimSessions_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_accountsClaimSessions_parameter_1$schema = array(string());
 		const _yadsh_dsh_qa_surface_qaSurface_accountsClaimSessions_result$schema = object({
 			"claimed": number().readonly(),
 			"conflicts": array(string()).readonly()
 		});
+		const _yadsh_dsh_qa_surface_qaSurface_accountsCreateServiceToken_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsCreateServiceToken_parameter_1$schema = object({
+			"label": string().readonly().optional(),
+			"scopes": array(string()).readonly().optional(),
+			"ttlDays": number().readonly().optional()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_accountsCreateServiceToken_result$schema = object({
+			"token": string().readonly(),
+			"id": string().readonly(),
+			"label": string().readonly(),
+			"scopes": array(union([literal("ask"), literal("sessions:read")])).readonly(),
+			"createdAt": string().readonly(),
+			"expiresAt": string().readonly(),
+			"lastUsedAt": union([literal(null), string()]).readonly(),
+			"revokedAt": union([literal(null), string()]).readonly(),
+			"useCount": number().readonly()
+		});
 		const _yadsh_dsh_qa_surface_qaSurface_accountsListOwnership_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_accountsListOwnership_result$schema = object({ "entries": array(object({
 			"sessionId": string().readonly(),
@@ -5619,6 +5686,17 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"displayName": string().readonly(),
 			"claimedAt": string().readonly()
 		})).readonly() });
+		const _yadsh_dsh_qa_surface_qaSurface_accountsListServiceTokens_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsListServiceTokens_result$schema = object({ "tokens": array(object({
+			"id": string().readonly(),
+			"label": string().readonly(),
+			"scopes": array(union([literal("ask"), literal("sessions:read")])).readonly(),
+			"createdAt": string().readonly(),
+			"expiresAt": string().readonly(),
+			"lastUsedAt": union([literal(null), string()]).readonly(),
+			"revokedAt": union([literal(null), string()]).readonly(),
+			"useCount": number().readonly()
+		})).readonly() });
 		const _yadsh_dsh_qa_surface_qaSurface_accountsLogin_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_accountsLogin_parameter_1$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_accountsLogin_result$schema = object({
@@ -5683,6 +5761,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				}).readonly()
 			}).readonly()
 		});
+		const _yadsh_dsh_qa_surface_qaSurface_accountsRequestPasswordReset_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsRequestPasswordReset_result$schema = object({ "accepted": literal(true).readonly() });
+		const _yadsh_dsh_qa_surface_qaSurface_accountsRevokeServiceToken_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsRevokeServiceToken_parameter_1$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_accountsRevokeServiceToken_result$schema = object({ "revoked": boolean().readonly() });
 		const _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_parameter_1$schema = object({
 			"fullName": string().readonly(),
@@ -5791,6 +5874,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				literal("user.updated"),
 				literal("user.enabled"),
 				literal("user.disabled"),
+				literal("user.password-reset"),
 				literal("authorization.changed"),
 				literal("subrole.assignment.changed"),
 				literal("common_capabilities.updated"),
@@ -5798,7 +5882,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				literal("conversation.deleted"),
 				literal("review.updated"),
 				literal("review.queued"),
-				literal("admin.settings.updated")
+				literal("admin.settings.updated"),
+				literal("skill.created"),
+				literal("skill.updated"),
+				literal("skill.deleted")
 			]).readonly().optional(),
 			"from": union([literal(null), string()]).readonly().optional(),
 			"to": union([literal(null), string()]).readonly().optional()
@@ -5818,6 +5905,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("user.updated"),
 					literal("user.enabled"),
 					literal("user.disabled"),
+					literal("user.password-reset"),
 					literal("authorization.changed"),
 					literal("subrole.assignment.changed"),
 					literal("common_capabilities.updated"),
@@ -5825,7 +5913,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("conversation.deleted"),
 					literal("review.updated"),
 					literal("review.queued"),
-					literal("admin.settings.updated")
+					literal("admin.settings.updated"),
+					literal("skill.created"),
+					literal("skill.updated"),
+					literal("skill.deleted")
 				]).readonly(),
 				"targetType": string().readonly().optional(),
 				"targetId": string().readonly().optional(),
@@ -6272,8 +6363,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			}).readonly(),
 			"alerts": array(object({
 				"level": union([
-					literal("critical"),
 					literal("warning"),
+					literal("critical"),
 					literal("info")
 				]).readonly(),
 				"code": union([
@@ -6373,6 +6464,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				"feedbackId": string().readonly().optional()
 			})).readonly()
 		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminPasswordResetRequests_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminPasswordResetRequests_result$schema = array(object({
+			"userId": string().readonly(),
+			"email": string().readonly(),
+			"displayName": string().readonly(),
+			"requestedAt": string().readonly(),
+			"lastRequestedAt": string().readonly(),
+			"requestCount": number().readonly(),
+			"disabled": boolean().readonly()
+		}));
 		const _yadsh_dsh_qa_surface_qaSurface_adminQueueConversation_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_adminQueueConversation_parameter_1$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_adminQueueConversation_parameter_2$schema = union([literal(null), string()]);
@@ -6439,6 +6540,45 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"createdAt": string().readonly(),
 			"updatedAt": string().readonly().optional()
 		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_parameter_1$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_parameter_2$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_result$schema = object({
+			"user": object({
+				"conversations": number().readonly(),
+				"feedbackGiven": number().readonly(),
+				"id": string().readonly(),
+				"email": string().readonly(),
+				"displayName": string().readonly(),
+				"fullName": string().readonly(),
+				"role": union([
+					literal("user"),
+					literal("reviewer"),
+					literal("admin")
+				]).readonly(),
+				"disabled": boolean().readonly(),
+				"createdAt": string().readonly(),
+				"lastLoginAt": union([literal(null), string()]).readonly(),
+				"access": object({
+					"allowedSubroles": array(string()).readonly(),
+					"defaultSubrole": string().readonly()
+				}).readonly()
+			}).readonly(),
+			"effective": array(object({
+				"subroleId": string().readonly(),
+				"name": string().readonly(),
+				"tools": number().readonly(),
+				"grantableTools": number().readonly(),
+				"deniedTools": number().readonly(),
+				"skills": number().readonly()
+			})).readonly(),
+			"activity": object({
+				"conversations": number().readonly(),
+				"messages": union([literal(null), number()]).readonly(),
+				"positiveRatings": number().readonly(),
+				"negativeRatings": number().readonly()
+			}).readonly()
+		});
 		const _yadsh_dsh_qa_surface_qaSurface_adminReviewQueue_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_adminReviewQueue_parameter_1$schema = union([literal(null), string()]);
 		const _yadsh_dsh_qa_surface_qaSurface_adminReviewQueue_parameter_2$schema = union([literal(null), number()]);
@@ -6601,6 +6741,268 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"createdAt": string().readonly(),
 			"updatedAt": string().readonly().optional()
 		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkill_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkill_parameter_1$schema = union([object({ "kind": literal("shared").readonly() }), object({
+			"kind": literal("user").readonly(),
+			"userId": string().readonly()
+		})]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkill_parameter_2$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkill_result$schema = object({
+			"body": string().readonly(),
+			"extraFrontmatter": record$2(string(), union([
+				literal(null),
+				string(),
+				number(),
+				literal(false),
+				literal(true),
+				array(lazy(() => QaSkillJsonValueRemoteCodec$schema)),
+				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema)).readonly()
+			])).readonly().readonly(),
+			"sourcePath": string().readonly(),
+			"preview": string().readonly(),
+			"name": string().readonly(),
+			"description": string().readonly(),
+			"whenToUse": union([literal(null), string()]).readonly(),
+			"modelInvocable": boolean().readonly(),
+			"userInvocable": boolean().readonly(),
+			"allowedTools": array(string()).readonly(),
+			"unavailableTools": array(string()).readonly(),
+			"resourceCount": number().readonly(),
+			"valid": boolean().readonly(),
+			"diagnostics": array(object({
+				"code": union([
+					literal("name-required"),
+					literal("name-invalid"),
+					literal("name-mismatch"),
+					literal("description-required"),
+					literal("description-too-long"),
+					literal("when-to-use-too-long"),
+					literal("field-type-invalid"),
+					literal("invocation-never"),
+					literal("invocation-invalid"),
+					literal("invocation-legacy-key"),
+					literal("allowed-tools-invalid"),
+					literal("tool-name-invalid"),
+					literal("tool-unavailable"),
+					literal("tools-too-many"),
+					literal("file-too-large"),
+					literal("frontmatter-missing"),
+					literal("skill-file-missing"),
+					literal("frontmatter-invalid"),
+					literal("unknown-field"),
+					literal("resource-unsupported")
+				]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
+				"field": union([literal(null), string()]).readonly(),
+				"detail": union([literal(null), string()]).readonly()
+			})).readonly(),
+			"updatedAt": union([literal(null), string()]).readonly(),
+			"revision": string().readonly(),
+			"adminEdit": union([literal(null), object({
+				"actorId": string().readonly(),
+				"at": string().readonly()
+			})]).readonly()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_1$schema = union([object({ "kind": literal("shared").readonly() }), object({
+			"kind": literal("user").readonly(),
+			"userId": string().readonly()
+		})]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_2$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_3$schema = union([literal(null), string()]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_result$schema = object({
+			"name": string().readonly(),
+			"trashed": boolean().readonly()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkills_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkills_parameter_1$schema = union([object({ "kind": literal("shared").readonly() }), object({
+			"kind": literal("user").readonly(),
+			"userId": string().readonly()
+		})]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkills_result$schema = object({
+			"scope": union([object({ "kind": literal("shared").readonly() }), object({
+				"kind": literal("user").readonly(),
+				"userId": string().readonly()
+			})]).readonly(),
+			"owner": union([literal(null), object({
+				"userId": string().readonly(),
+				"email": string().readonly(),
+				"displayName": string().readonly()
+			})]).readonly(),
+			"skills": array(object({
+				"name": string().readonly(),
+				"description": string().readonly(),
+				"whenToUse": union([literal(null), string()]).readonly(),
+				"modelInvocable": boolean().readonly(),
+				"userInvocable": boolean().readonly(),
+				"allowedTools": array(string()).readonly(),
+				"unavailableTools": array(string()).readonly(),
+				"resourceCount": number().readonly(),
+				"valid": boolean().readonly(),
+				"diagnostics": array(object({
+					"code": union([
+						literal("name-required"),
+						literal("name-invalid"),
+						literal("name-mismatch"),
+						literal("description-required"),
+						literal("description-too-long"),
+						literal("when-to-use-too-long"),
+						literal("field-type-invalid"),
+						literal("invocation-never"),
+						literal("invocation-invalid"),
+						literal("invocation-legacy-key"),
+						literal("allowed-tools-invalid"),
+						literal("tool-name-invalid"),
+						literal("tool-unavailable"),
+						literal("tools-too-many"),
+						literal("file-too-large"),
+						literal("frontmatter-missing"),
+						literal("skill-file-missing"),
+						literal("frontmatter-invalid"),
+						literal("unknown-field"),
+						literal("resource-unsupported")
+					]).readonly(),
+					"severity": union([literal("error"), literal("warning")]).readonly(),
+					"field": union([literal(null), string()]).readonly(),
+					"detail": union([literal(null), string()]).readonly()
+				})).readonly(),
+				"updatedAt": union([literal(null), string()]).readonly(),
+				"revision": string().readonly(),
+				"adminEdit": union([literal(null), object({
+					"actorId": string().readonly(),
+					"at": string().readonly()
+				})]).readonly()
+			})).readonly(),
+			"rootPath": string().readonly()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_1$schema = union([object({ "kind": literal("shared").readonly() }), object({
+			"kind": literal("user").readonly(),
+			"userId": string().readonly()
+		})]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_2$schema = union([literal(null), string()]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_3$schema = object({
+			"name": string().readonly(),
+			"description": string().readonly(),
+			"whenToUse": union([literal(null), string()]).readonly(),
+			"modelInvocable": boolean().readonly(),
+			"userInvocable": boolean().readonly(),
+			"allowedTools": array(string()).readonly(),
+			"body": string().readonly(),
+			"expectedRevision": union([literal(null), string()]).readonly()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_result$schema = object({
+			"body": string().readonly(),
+			"extraFrontmatter": record$2(string(), union([
+				literal(null),
+				string(),
+				number(),
+				literal(false),
+				literal(true),
+				array(lazy(() => QaSkillJsonValueRemoteCodec$schema2)),
+				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema2)).readonly()
+			])).readonly().readonly(),
+			"sourcePath": string().readonly(),
+			"preview": string().readonly(),
+			"name": string().readonly(),
+			"description": string().readonly(),
+			"whenToUse": union([literal(null), string()]).readonly(),
+			"modelInvocable": boolean().readonly(),
+			"userInvocable": boolean().readonly(),
+			"allowedTools": array(string()).readonly(),
+			"unavailableTools": array(string()).readonly(),
+			"resourceCount": number().readonly(),
+			"valid": boolean().readonly(),
+			"diagnostics": array(object({
+				"code": union([
+					literal("name-required"),
+					literal("name-invalid"),
+					literal("name-mismatch"),
+					literal("description-required"),
+					literal("description-too-long"),
+					literal("when-to-use-too-long"),
+					literal("field-type-invalid"),
+					literal("invocation-never"),
+					literal("invocation-invalid"),
+					literal("invocation-legacy-key"),
+					literal("allowed-tools-invalid"),
+					literal("tool-name-invalid"),
+					literal("tool-unavailable"),
+					literal("tools-too-many"),
+					literal("file-too-large"),
+					literal("frontmatter-missing"),
+					literal("skill-file-missing"),
+					literal("frontmatter-invalid"),
+					literal("unknown-field"),
+					literal("resource-unsupported")
+				]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
+				"field": union([literal(null), string()]).readonly(),
+				"detail": union([literal(null), string()]).readonly()
+			})).readonly(),
+			"updatedAt": union([literal(null), string()]).readonly(),
+			"revision": string().readonly(),
+			"adminEdit": union([literal(null), object({
+				"actorId": string().readonly(),
+				"at": string().readonly()
+			})]).readonly()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillTools_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillTools_parameter_1$schema = union([object({ "kind": literal("shared").readonly() }), object({
+			"kind": literal("user").readonly(),
+			"userId": string().readonly()
+		})]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillTools_result$schema = object({ "tools": array(object({
+			"name": string().readonly(),
+			"description": string().readonly(),
+			"available": boolean().readonly()
+		})).readonly() });
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_0$schema = string();
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_1$schema = union([object({ "kind": literal("shared").readonly() }), object({
+			"kind": literal("user").readonly(),
+			"userId": string().readonly()
+		})]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_2$schema = union([literal(null), string()]);
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_3$schema = object({
+			"name": string().readonly(),
+			"description": string().readonly(),
+			"whenToUse": union([literal(null), string()]).readonly(),
+			"modelInvocable": boolean().readonly(),
+			"userInvocable": boolean().readonly(),
+			"allowedTools": array(string()).readonly(),
+			"body": string().readonly(),
+			"expectedRevision": union([literal(null), string()]).readonly()
+		});
+		const _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_result$schema = object({
+			"preview": string().readonly(),
+			"diagnostics": array(object({
+				"code": union([
+					literal("name-required"),
+					literal("name-invalid"),
+					literal("name-mismatch"),
+					literal("description-required"),
+					literal("description-too-long"),
+					literal("when-to-use-too-long"),
+					literal("field-type-invalid"),
+					literal("invocation-never"),
+					literal("invocation-invalid"),
+					literal("invocation-legacy-key"),
+					literal("allowed-tools-invalid"),
+					literal("tool-name-invalid"),
+					literal("tool-unavailable"),
+					literal("tools-too-many"),
+					literal("file-too-large"),
+					literal("frontmatter-missing"),
+					literal("skill-file-missing"),
+					literal("frontmatter-invalid"),
+					literal("unknown-field"),
+					literal("resource-unsupported")
+				]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
+				"field": union([literal(null), string()]).readonly(),
+				"detail": union([literal(null), string()]).readonly()
+			})).readonly()
+		});
 		const _yadsh_dsh_qa_surface_qaSurface_adminUpdateUser_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_adminUpdateUser_parameter_1$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_adminUpdateUser_parameter_2$schema = object({
@@ -6960,7 +7362,26 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				"delegation": object({
 					"enabled": boolean().readonly(),
 					"template": string().readonly()
+				}).readonly(),
+				"documents": object({
+					"enabled": boolean().readonly(),
+					"template": string().readonly()
+				}).readonly(),
+				"sourcePriority": object({
+					"enabled": boolean().readonly(),
+					"template": string().readonly()
 				}).readonly()
+			}).readonly(),
+			"integration": object({
+				"enabled": boolean().readonly(),
+				"basePath": string().readonly(),
+				"tokenTtlDays": number().readonly(),
+				"requestTimeoutMs": number().readonly(),
+				"maxConcurrent": number().readonly(),
+				"requestsPerMinute": number().readonly(),
+				"maxRequestBytes": number().readonly(),
+				"maxAttachmentBytes": number().readonly(),
+				"maxAnswerCharacters": number().readonly()
 			}).readonly()
 		});
 		const _yadsh_dsh_qa_surface_qaSurface_listWorkspaceFiles_parameter_0$schema = string();
@@ -7070,8 +7491,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				number(),
 				literal(false),
 				literal(true),
-				array(lazy(() => QaSkillJsonValueRemoteCodec$schema2)),
-				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema2)).readonly()
+				array(lazy(() => QaSkillJsonValueRemoteCodec$schema4)),
+				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema4)).readonly()
 			])).readonly().readonly(),
 			"sourcePath": string().readonly(),
 			"preview": string().readonly(),
@@ -7107,12 +7528,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("unknown-field"),
 					literal("resource-unsupported")
 				]).readonly(),
-				"severity": union([literal("warning"), literal("error")]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
 				"field": union([literal(null), string()]).readonly(),
 				"detail": union([literal(null), string()]).readonly()
 			})).readonly(),
 			"updatedAt": union([literal(null), string()]).readonly(),
-			"revision": string().readonly()
+			"revision": string().readonly(),
+			"adminEdit": union([literal(null), object({
+				"actorId": string().readonly(),
+				"at": string().readonly()
+			})]).readonly()
 		});
 		const _yadsh_dsh_qa_surface_qaSurface_skillsGet_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_skillsGet_parameter_1$schema = string();
@@ -7124,8 +7549,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				number(),
 				literal(false),
 				literal(true),
-				array(lazy(() => QaSkillJsonValueRemoteCodec$schema)),
-				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema)).readonly()
+				array(lazy(() => QaSkillJsonValueRemoteCodec$schema3)),
+				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema3)).readonly()
 			])).readonly().readonly(),
 			"sourcePath": string().readonly(),
 			"preview": string().readonly(),
@@ -7161,12 +7586,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("unknown-field"),
 					literal("resource-unsupported")
 				]).readonly(),
-				"severity": union([literal("warning"), literal("error")]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
 				"field": union([literal(null), string()]).readonly(),
 				"detail": union([literal(null), string()]).readonly()
 			})).readonly(),
 			"updatedAt": union([literal(null), string()]).readonly(),
-			"revision": string().readonly()
+			"revision": string().readonly(),
+			"adminEdit": union([literal(null), object({
+				"actorId": string().readonly(),
+				"at": string().readonly()
+			})]).readonly()
 		});
 		const _yadsh_dsh_qa_surface_qaSurface_skillsList_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_skillsList_result$schema = object({ "skills": array(object({
@@ -7202,12 +7631,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("unknown-field"),
 					literal("resource-unsupported")
 				]).readonly(),
-				"severity": union([literal("warning"), literal("error")]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
 				"field": union([literal(null), string()]).readonly(),
 				"detail": union([literal(null), string()]).readonly()
 			})).readonly(),
 			"updatedAt": union([literal(null), string()]).readonly(),
-			"revision": string().readonly()
+			"revision": string().readonly(),
+			"adminEdit": union([literal(null), object({
+				"actorId": string().readonly(),
+				"at": string().readonly()
+			})]).readonly()
 		})).readonly() });
 		const _yadsh_dsh_qa_surface_qaSurface_skillsRemove_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_skillsRemove_parameter_1$schema = string();
@@ -7242,8 +7675,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				number(),
 				literal(false),
 				literal(true),
-				array(lazy(() => QaSkillJsonValueRemoteCodec$schema3)),
-				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema3)).readonly()
+				array(lazy(() => QaSkillJsonValueRemoteCodec$schema5)),
+				record$2(string(), lazy(() => QaSkillJsonValueRemoteCodec$schema5)).readonly()
 			])).readonly().readonly(),
 			"sourcePath": string().readonly(),
 			"preview": string().readonly(),
@@ -7279,12 +7712,16 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("unknown-field"),
 					literal("resource-unsupported")
 				]).readonly(),
-				"severity": union([literal("warning"), literal("error")]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
 				"field": union([literal(null), string()]).readonly(),
 				"detail": union([literal(null), string()]).readonly()
 			})).readonly(),
 			"updatedAt": union([literal(null), string()]).readonly(),
-			"revision": string().readonly()
+			"revision": string().readonly(),
+			"adminEdit": union([literal(null), object({
+				"actorId": string().readonly(),
+				"at": string().readonly()
+			})]).readonly()
 		});
 		const _yadsh_dsh_qa_surface_qaSurface_skillsValidate_parameter_0$schema = string();
 		const _yadsh_dsh_qa_surface_qaSurface_skillsValidate_parameter_1$schema = union([literal(null), string()]);
@@ -7323,7 +7760,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					literal("unknown-field"),
 					literal("resource-unsupported")
 				]).readonly(),
-				"severity": union([literal("warning"), literal("error")]).readonly(),
+				"severity": union([literal("error"), literal("warning")]).readonly(),
 				"field": union([literal(null), string()]).readonly(),
 				"detail": union([literal(null), string()]).readonly()
 			})).readonly()
@@ -7533,7 +7970,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 793,
+						"line": 907,
 						"column": 9
 					}
 				},
@@ -7569,7 +8006,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 804,
+						"line": 918,
 						"column": 3
 					}
 				},
@@ -7596,7 +8033,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 778,
+						"line": 892,
 						"column": 3
 					}
 				},
@@ -7645,7 +8082,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 818,
+						"line": 932,
 						"column": 3
 					}
 				},
@@ -7681,7 +8118,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 784,
+						"line": 898,
 						"column": 3
 					}
 				},
@@ -7717,7 +8154,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 863,
+						"line": 977,
 						"column": 3
 					}
 				},
@@ -7766,7 +8203,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 840,
+						"line": 954,
 						"column": 3
 					}
 				},
@@ -7802,7 +8239,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 830,
+						"line": 944,
 						"column": 3
 					}
 				},
@@ -7838,7 +8275,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 852,
+						"line": 966,
 						"column": 3
 					}
 				},
@@ -7887,7 +8324,56 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 811,
+						"line": 925,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/accountsChangePassword",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "accountsChangePassword",
+					invocation: { kind: "direct" },
+					parameters: [
+						{
+							name: "token",
+							wire: "token",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsChangePassword:token",
+								schema: _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_parameter_0$schema
+							}
+						},
+						{
+							name: "currentPassword",
+							wire: "currentPassword",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsChangePassword:currentPassword",
+								schema: _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_parameter_1$schema
+							}
+						},
+						{
+							name: "nextPassword",
+							wire: "nextPassword",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsChangePassword:nextPassword",
+								schema: _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_parameter_2$schema
+							}
+						}
+					],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaAccountSession",
+						schema: _yadsh_dsh_qa_surface_qaSurface_accountsChangePassword_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 648,
 						"column": 3
 					}
 				},
@@ -7923,7 +8409,43 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 607,
+						"line": 682,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/accountsCreateServiceToken",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "accountsCreateServiceToken",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "token",
+						wire: "token",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsCreateServiceToken:token",
+							schema: _yadsh_dsh_qa_surface_qaSurface_accountsCreateServiceToken_parameter_0$schema
+						}
+					}, {
+						name: "input",
+						wire: "input",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface/types#QaServiceTokenCreateInput",
+							schema: _yadsh_dsh_qa_surface_qaSurface_accountsCreateServiceToken_parameter_1$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaIssuedServiceToken",
+						schema: _yadsh_dsh_qa_surface_qaSurface_accountsCreateServiceToken_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 755,
 						"column": 3
 					}
 				},
@@ -7950,7 +8472,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 628,
+						"line": 703,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/accountsListServiceTokens",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "accountsListServiceTokens",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "token",
+						wire: "token",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsListServiceTokens:token",
+							schema: _yadsh_dsh_qa_surface_qaSurface_accountsListServiceTokens_parameter_0$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsListServiceTokens:result",
+						schema: _yadsh_dsh_qa_surface_qaSurface_accountsListServiceTokens_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 742,
 						"column": 3
 					}
 				},
@@ -7986,7 +8535,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 591,
+						"line": 642,
 						"column": 3
 					}
 				},
@@ -8013,7 +8562,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 618,
+						"line": 693,
 						"column": 3
 					}
 				},
@@ -8049,7 +8598,70 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 586,
+						"line": 637,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/accountsRequestPasswordReset",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "accountsRequestPasswordReset",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "email",
+						wire: "email",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsRequestPasswordReset:email",
+							schema: _yadsh_dsh_qa_surface_qaSurface_accountsRequestPasswordReset_parameter_0$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsRequestPasswordReset:result",
+						schema: _yadsh_dsh_qa_surface_qaSurface_accountsRequestPasswordReset_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 666,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/accountsRevokeServiceToken",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "accountsRevokeServiceToken",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "token",
+						wire: "token",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsRevokeServiceToken:token",
+							schema: _yadsh_dsh_qa_surface_qaSurface_accountsRevokeServiceToken_parameter_0$schema
+						}
+					}, {
+						name: "tokenId",
+						wire: "tokenId",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsRevokeServiceToken:tokenId",
+							schema: _yadsh_dsh_qa_surface_qaSurface_accountsRevokeServiceToken_parameter_1$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/accountsRevokeServiceToken:result",
+						schema: _yadsh_dsh_qa_surface_qaSurface_accountsRevokeServiceToken_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 768,
 						"column": 3
 					}
 				},
@@ -8085,7 +8697,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 641,
+						"line": 716,
 						"column": 3
 					}
 				},
@@ -8121,7 +8733,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 654,
+						"line": 729,
 						"column": 3
 					}
 				},
@@ -8148,7 +8760,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 597,
+						"line": 672,
 						"column": 3
 					}
 				},
@@ -8207,7 +8819,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1030,
+						"line": 1243,
 						"column": 3
 					}
 				},
@@ -8243,7 +8855,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 932,
+						"line": 1145,
 						"column": 3
 					}
 				},
@@ -8302,7 +8914,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 914,
+						"line": 1127,
 						"column": 3
 					}
 				},
@@ -8338,7 +8950,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 947,
+						"line": 1160,
 						"column": 3
 					}
 				},
@@ -8397,7 +9009,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 957,
+						"line": 1170,
 						"column": 3
 					}
 				},
@@ -8424,7 +9036,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1025,
+						"line": 1238,
 						"column": 3
 					}
 				},
@@ -8451,7 +9063,34 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 880,
+						"line": 1073,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminPasswordResetRequests",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminPasswordResetRequests",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "token",
+						wire: "token",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminPasswordResetRequests:token",
+							schema: _yadsh_dsh_qa_surface_qaSurface_adminPasswordResetRequests_parameter_0$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminPasswordResetRequests:result",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminPasswordResetRequests_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1107,
 						"column": 3
 					}
 				},
@@ -8500,7 +9139,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1002,
+						"line": 1215,
 						"column": 3
 					}
 				},
@@ -8559,7 +9198,56 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 978,
+						"line": 1191,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminResetPassword",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminResetPassword",
+					invocation: { kind: "direct" },
+					parameters: [
+						{
+							name: "token",
+							wire: "token",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminResetPassword:token",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_parameter_0$schema
+							}
+						},
+						{
+							name: "userId",
+							wire: "userId",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminResetPassword:userId",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_parameter_1$schema
+							}
+						},
+						{
+							name: "password",
+							wire: "password",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminResetPassword:password",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_parameter_2$schema
+							}
+						}
+					],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminUserDetail",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminResetPassword_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1116,
 						"column": 3
 					}
 				},
@@ -8608,7 +9296,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 990,
+						"line": 1203,
 						"column": 3
 					}
 				},
@@ -8644,7 +9332,305 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1017,
+						"line": 1230,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminSkill",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminSkill",
+					invocation: { kind: "direct" },
+					parameters: [
+						{
+							name: "token",
+							wire: "token",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkill:token",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkill_parameter_0$schema
+							}
+						},
+						{
+							name: "scope",
+							wire: "scope",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillScope",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkill_parameter_1$schema
+							}
+						},
+						{
+							name: "name",
+							wire: "name",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkill:name",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkill_parameter_2$schema
+							}
+						}
+					],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaSkillDocument",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminSkill_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1007,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminSkillDelete",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminSkillDelete",
+					invocation: { kind: "direct" },
+					parameters: [
+						{
+							name: "token",
+							wire: "token",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillDelete:token",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_0$schema
+							}
+						},
+						{
+							name: "scope",
+							wire: "scope",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillScope",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_1$schema
+							}
+						},
+						{
+							name: "name",
+							wire: "name",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillDelete:name",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_2$schema
+							}
+						},
+						{
+							name: "expectedRevision",
+							wire: "expectedRevision",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillDelete:expectedRevision",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_parameter_3$schema
+							}
+						}
+					],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaSkillRemoval",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillDelete_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1035,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminSkills",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminSkills",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "token",
+						wire: "token",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkills:token",
+							schema: _yadsh_dsh_qa_surface_qaSurface_adminSkills_parameter_0$schema
+						}
+					}, {
+						name: "scope",
+						wire: "scope",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillScope",
+							schema: _yadsh_dsh_qa_surface_qaSurface_adminSkills_parameter_1$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillsView",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminSkills_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 998,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminSkillSave",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminSkillSave",
+					invocation: { kind: "direct" },
+					parameters: [
+						{
+							name: "token",
+							wire: "token",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillSave:token",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_0$schema
+							}
+						},
+						{
+							name: "scope",
+							wire: "scope",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillScope",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_1$schema
+							}
+						},
+						{
+							name: "name",
+							wire: "name",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillSave:name",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_2$schema
+							}
+						},
+						{
+							name: "input",
+							wire: "input",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface/types#QaSkillDraftInput",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_parameter_3$schema
+							}
+						}
+					],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaSkillDocument",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillSave_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1022,
+						"column": 3
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminSkillTools",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminSkillTools",
+					invocation: { kind: "direct" },
+					parameters: [{
+						name: "token",
+						wire: "token",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillTools:token",
+							schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillTools_parameter_0$schema
+						}
+					}, {
+						name: "scope",
+						wire: "scope",
+						source: "json",
+						codec: {
+							mode: "strict",
+							typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillScope",
+							schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillTools_parameter_1$schema
+						}
+					}],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillTools:result",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillTools_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1061,
+						"column": 9
+					}
+				},
+				{
+					id: "@yadsh/dsh-qa-surface#qaSurface/adminSkillValidate",
+					service: "qaSurface",
+					namespace: "qaSurface",
+					method: "adminSkillValidate",
+					invocation: { kind: "direct" },
+					parameters: [
+						{
+							name: "token",
+							wire: "token",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillValidate:token",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_0$schema
+							}
+						},
+						{
+							name: "scope",
+							wire: "scope",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface/types#QaAdminSkillScope",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_1$schema
+							}
+						},
+						{
+							name: "name",
+							wire: "name",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface#qaSurface/adminSkillValidate:name",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_2$schema
+							}
+						},
+						{
+							name: "input",
+							wire: "input",
+							source: "json",
+							codec: {
+								mode: "strict",
+								typeSymbol: "@yadsh/dsh-qa-surface/types#QaSkillDraftInput",
+								schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_parameter_3$schema
+							}
+						}
+					],
+					result: {
+						mode: "strict",
+						typeSymbol: "@yadsh/dsh-qa-surface/types#QaSkillValidation",
+						schema: _yadsh_dsh_qa_surface_qaSurface_adminSkillValidate_result$schema
+					},
+					sourceLocation: {
+						"file": "packages/dsh-qa-surface/src/index.ts",
+						"line": 1048,
 						"column": 3
 					}
 				},
@@ -8693,7 +9679,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 903,
+						"line": 1096,
 						"column": 3
 					}
 				},
@@ -8729,7 +9715,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 897,
+						"line": 1090,
 						"column": 3
 					}
 				},
@@ -8788,7 +9774,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 885,
+						"line": 1078,
 						"column": 3
 					}
 				},
@@ -8847,7 +9833,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1106,
+						"line": 1319,
 						"column": 9
 					}
 				},
@@ -8906,7 +9892,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1135,
+						"line": 1348,
 						"column": 9
 					}
 				},
@@ -8955,7 +9941,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1147,
+						"line": 1360,
 						"column": 9
 					}
 				},
@@ -9004,7 +9990,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 679,
+						"line": 793,
 						"column": 9
 					}
 				},
@@ -9022,7 +10008,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 669,
+						"line": 783,
 						"column": 3
 					}
 				},
@@ -9071,7 +10057,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1215,
+						"line": 1428,
 						"column": 9
 					}
 				},
@@ -9107,7 +10093,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1092,
+						"line": 1305,
 						"column": 9
 					}
 				},
@@ -9143,7 +10129,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1121,
+						"line": 1334,
 						"column": 9
 					}
 				},
@@ -9192,7 +10178,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1276,
+						"line": 1489,
 						"column": 9
 					}
 				},
@@ -9241,7 +10227,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1166,
+						"line": 1379,
 						"column": 9
 					}
 				},
@@ -9290,7 +10276,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1242,
+						"line": 1455,
 						"column": 9
 					}
 				},
@@ -9326,7 +10312,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1043,
+						"line": 1256,
 						"column": 9
 					}
 				},
@@ -9362,7 +10348,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1346,
+						"line": 1559,
 						"column": 3
 					}
 				},
@@ -9398,7 +10384,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1340,
+						"line": 1553,
 						"column": 3
 					}
 				},
@@ -9425,7 +10411,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1334,
+						"line": 1547,
 						"column": 3
 					}
 				},
@@ -9474,7 +10460,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1365,
+						"line": 1578,
 						"column": 3
 					}
 				},
@@ -9501,7 +10487,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1391,
+						"line": 1604,
 						"column": 3
 					}
 				},
@@ -9550,7 +10536,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1355,
+						"line": 1568,
 						"column": 3
 					}
 				},
@@ -9599,7 +10585,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1378,
+						"line": 1591,
 						"column": 3
 					}
 				},
@@ -9635,7 +10621,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1408,
+						"line": 1621,
 						"column": 3
 					}
 				},
@@ -9694,7 +10680,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1423,
+						"line": 1636,
 						"column": 3
 					}
 				},
@@ -9730,7 +10716,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-qa-surface/src/index.ts",
-						"line": 1079,
+						"line": 1292,
 						"column": 9
 					}
 				}
@@ -10159,6 +11145,21 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"patch",
 			"diff"
 		]);
+		/**
+		* Document extensions the stand's document pipeline can read, accepted on top
+		* of the text files. A visitor who has the spec in Word should be able to hand
+		* it over instead of retyping it, and a deployment that renders and converts
+		* those formats is the one that can answer for them: this list is what stops
+		* `attachments.extensions` from being text-only by construction.
+		*/
+		const DEFAULT_QA_DOCUMENT_EXTENSIONS = Object.freeze(["docx", "pdf"]);
+		/**
+		* What a visitor may attach to one message out of the box: the text files plus
+		* the documents the pipeline reads. An operator names whatever their stand can
+		* actually work with — the list is a ceiling, not a guarantee that the model
+		* has a tool for every entry.
+		*/
+		const DEFAULT_QA_ATTACHMENT_EXTENSIONS = Object.freeze([...DEFAULT_QA_TEXT_EXTENSIONS, ...DEFAULT_QA_DOCUMENT_EXTENSIONS]);
 		const QA_PASTED_TEXT_LINES_MAX = 1e4;
 		const QA_MAX_FILE_BYTES_MIN = 1024;
 		const QA_MAX_FILE_BYTES_MAX = 52428800;
@@ -10172,7 +11173,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		* @param values - raw extension tokens from configuration.
 		* @returns the normalized token list.
 		*/
-		function normalizeTextExtensions(values) {
+		function normalizeAcceptedExtensions(values) {
 			const seen = /* @__PURE__ */ new Set();
 			const normalized = [];
 			for (const value of values) {
@@ -10184,19 +11185,29 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			return normalized;
 		}
 		/**
-		* Whether one file name carries an accepted text extension. The comparison is
+		* The extension one file name carries, lowercase and without the dot. A name
+		* without a dot, or with a hidden-file dot only (`.gitignore`), reports the
+		* whole leaf, which no configured extension can match.
+		* @param name - display file name.
+		* @returns the extension token, or the leaf when there is none.
+		*/
+		function fileExtensionOf(name) {
+			const leaf = name.trim().toLowerCase();
+			if (leaf === "") return "";
+			const dot = leaf.lastIndexOf(".");
+			return dot <= 0 ? leaf : leaf.slice(dot + 1);
+		}
+		/**
+		* Whether one file name carries an accepted extension. The comparison is
 		* case-insensitive; a name without a dot, or with a hidden-file dot only
 		* (`.gitignore`), is matched against the whole leaf.
 		* @param name - display file name.
 		* @param extensions - normalized accepted extensions.
 		* @returns whether the name matches one accepted extension.
 		*/
-		function hasTextExtension(name, extensions) {
-			const leaf = name.trim().toLowerCase();
-			if (leaf === "") return false;
-			const dot = leaf.lastIndexOf(".");
-			const suffix = dot <= 0 ? leaf : leaf.slice(dot + 1);
-			return extensions.includes(suffix);
+		function hasAcceptedExtension(name, extensions) {
+			if (name.trim().toLowerCase() === "") return false;
+			return extensions.includes(fileExtensionOf(name));
 		}
 		/**
 		* Count the lines of a pasted blob the way a reader counts them: a single
@@ -10481,7 +11492,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				pastedTextLines: 200,
 				maxFileBytes: 10485760,
 				maxPending: 8,
-				extensions: DEFAULT_QA_TEXT_EXTENSIONS
+				extensions: DEFAULT_QA_ATTACHMENT_EXTENSIONS
+			}),
+			integration: Object.freeze({
+				enabled: false,
+				basePath: "/qa/api",
+				tokenTtlDays: 90,
+				requestTimeoutMs: 9e4,
+				maxConcurrent: 4,
+				requestsPerMinute: 60,
+				maxRequestBytes: 33554432,
+				maxAttachmentBytes: 10485760,
+				maxAnswerCharacters: 4096
 			}),
 			notes: Object.freeze({
 				identity: Object.freeze({
@@ -10496,6 +11518,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				delegation: Object.freeze({
 					enabled: true,
 					template: ""
+				}),
+				documents: Object.freeze({
+					enabled: true,
+					template: ""
+				}),
+				sourcePriority: Object.freeze({
+					enabled: true,
+					template: ""
 				})
 			})
 		});
@@ -10615,7 +11645,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				pastedTextLines,
 				maxFileBytes,
 				maxPending,
-				extensions: normalizeTextExtensions(input.attachments?.extensions ?? DEFAULT_QA_SURFACE_CONFIG.attachments.extensions)
+				extensions: normalizeAcceptedExtensions(input.attachments?.extensions ?? DEFAULT_QA_SURFACE_CONFIG.attachments.extensions)
 			});
 		}
 		//#endregion
@@ -10665,6 +11695,80 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				})
 			};
 		}
+		const QA_INTEGRATION_TTL_DAYS_MAX = 3650;
+		const QA_INTEGRATION_TIMEOUT_MS_MIN = 5e3;
+		const QA_INTEGRATION_TIMEOUT_MS_MAX = 6e5;
+		const QA_INTEGRATION_BODY_BYTES_MIN = 1048576;
+		const QA_INTEGRATION_BODY_BYTES_MAX = 67108864;
+		const QA_INTEGRATION_ATTACHMENT_BYTES_MIN = 1024;
+		const QA_INTEGRATION_ANSWER_CHARS_MAX = 65536;
+		/**
+		* Normalize the integration API's base path.
+		*
+		* It is a route namespace rather than a page: it may live under `/qa` (the
+		* default does), because the web server tries its exact table before the QA
+		* navigation's prefix, so `/qa/api/ask` never falls into the page route. What
+		* it may not do is claim the operator root, the first-party `/api` namespace
+		* or the plugin asset namespace.
+		* @param value - the configured path.
+		* @returns the path without a trailing slash.
+		*/
+		function normalizeIntegrationBasePath(value) {
+			const trimmed = value.trim();
+			if (trimmed === "" || !trimmed.startsWith("/")) throw new TypeError("dsh-qa-surface: integration.basePath must start with /");
+			const path = trimmed.replace(/\/+$/u, "");
+			if (path === "" || path === "/") throw new TypeError("dsh-qa-surface: integration.basePath cannot claim the operator root");
+			if (path === "/api" || path.startsWith("/api/")) throw new TypeError("dsh-qa-surface: integration.basePath cannot claim /api");
+			if (path === "/plugins" || path.startsWith("/plugins/")) throw new TypeError("dsh-qa-surface: integration.basePath cannot claim /plugins");
+			return path;
+		}
+		/**
+		* The integration API's slice of the resolved configuration.
+		*
+		* The endpoint is off unless a deployment asks for it: it is a network
+		* surface reachable by anything that holds a token, and a QA stand that never
+		* integrates anything must not grow one by accident.
+		*
+		* It also needs accounts. Integration tokens are issued to an account and
+		* verified against it, so a deployment with `accounts.enabled: false` has
+		* nothing to authenticate a caller with; switching the API on there is a
+		* configuration mistake, and it is refused rather than served open.
+		*
+		* @param input - raw integration config.
+		* @param accounts - the resolved accounts domain, for the cross-check.
+		* @returns the frozen resolved slice.
+		*/
+		function resolveIntegration(input, accounts) {
+			const fallback = DEFAULT_QA_SURFACE_CONFIG.integration;
+			const enabled = input?.enabled ?? fallback.enabled;
+			const basePath = normalizeIntegrationBasePath(input?.basePath ?? fallback.basePath);
+			const tokenTtlDays = input?.tokenTtlDays ?? fallback.tokenTtlDays;
+			const requestTimeoutMs = input?.requestTimeoutMs ?? fallback.requestTimeoutMs;
+			const maxConcurrent = input?.maxConcurrent ?? fallback.maxConcurrent;
+			const requestsPerMinute = input?.requestsPerMinute ?? fallback.requestsPerMinute;
+			const maxRequestBytes = input?.maxRequestBytes ?? fallback.maxRequestBytes;
+			const maxAttachmentBytes = input?.maxAttachmentBytes ?? fallback.maxAttachmentBytes;
+			const maxAnswerCharacters = input?.maxAnswerCharacters ?? fallback.maxAnswerCharacters;
+			assertIntInRange("integration.tokenTtlDays", tokenTtlDays, 1, QA_INTEGRATION_TTL_DAYS_MAX);
+			assertIntInRange("integration.requestTimeoutMs", requestTimeoutMs, QA_INTEGRATION_TIMEOUT_MS_MIN, QA_INTEGRATION_TIMEOUT_MS_MAX);
+			assertIntInRange("integration.maxConcurrent", maxConcurrent, 1, 16);
+			assertIntInRange("integration.requestsPerMinute", requestsPerMinute, 1, 600);
+			assertIntInRange("integration.maxRequestBytes", maxRequestBytes, QA_INTEGRATION_BODY_BYTES_MIN, QA_INTEGRATION_BODY_BYTES_MAX);
+			assertIntInRange("integration.maxAttachmentBytes", maxAttachmentBytes, QA_INTEGRATION_ATTACHMENT_BYTES_MIN, maxRequestBytes);
+			assertIntInRange("integration.maxAnswerCharacters", maxAnswerCharacters, 256, QA_INTEGRATION_ANSWER_CHARS_MAX);
+			if (enabled && !accounts.enabled) throw new TypeError("dsh-qa-surface: integration.enabled requires accounts.enabled: the API authenticates with an account's integration token");
+			return Object.freeze({
+				enabled,
+				basePath,
+				tokenTtlDays,
+				requestTimeoutMs,
+				maxConcurrent,
+				requestsPerMinute,
+				maxRequestBytes,
+				maxAttachmentBytes,
+				maxAnswerCharacters
+			});
+		}
 		//#endregion
 		//#region src/config-resolvers/lockdown.ts
 		/** Tool allow-list names are capped so they stay legible in host echoes. */
@@ -10749,7 +11853,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					template: text$4(raw.sources?.template),
 					fallbackTemplate: text$4(raw.sources?.fallbackTemplate)
 				},
-				delegation: one(raw.delegation ?? {})
+				delegation: one(raw.delegation ?? {}),
+				documents: one(raw.documents ?? {}),
+				sourcePriority: one(raw.sourcePriority ?? {})
 			};
 		}
 		//#endregion
@@ -11001,7 +12107,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				sources,
 				attachments,
 				tools,
-				notes: resolveNotes(input.notes)
+				notes: resolveNotes(input.notes),
+				integration: resolveIntegration(input.integration, accounts)
 			});
 		}
 		//#endregion
@@ -11261,6 +12368,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		//#region src/client/QaAccountsController.ts
 		/** The `(reason: <code>)` marker the Host folds into account wire failures. */
 		const ACCOUNTS_REASON_MARKER = /\(reason: ([a-z-]+)\)/u;
+		/**
+		* What the sign-in card says after a forgotten-password request. It names the
+		* request, never the account: a real address and an unknown one get the same
+		* sentence, which is the whole point of the endpoint.
+		*/
+		const QA_RESET_FILED_NOTICE = "Заявка отправлена оператору. Если такой аккаунт есть, пароль сбросят — затем войдите с новым паролем.";
 		/** Union of the own chat ids and every mapped one, own ids first. */
 		function mergeOwnershipIds(ownedIds, ownership) {
 			if (ownership.length === 0) return ownedIds;
@@ -11273,6 +12386,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		function accountsErrorMessage(code) {
 			switch (code) {
 				case "invalid-credentials": return "Неверный email или пароль.";
+				case "invalid-current-password": return "Текущий пароль неверен.";
 				case "admin-required": return "Недостаточно прав: действие доступно администратору.";
 				case "account-disabled": return "Аккаунт отключён администратором.";
 				case "email-taken": return "Этот email уже зарегистрирован.";
@@ -11283,6 +12397,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				case "profile-disabled": return "Профиль отключён на этом сервере.";
 				case "invalid-starters": return "Проверьте подсказки: заполните название и промпт, текст не слишком длинный.";
 				case "starters-disabled": return "Свои подсказки отключены на этом сервере.";
+				case "integration-disabled": return "Интеграционный API выключен на этом стенде: такому токену некуда обращаться. Включите его в настройках стенда.";
+				case "auth-required": return "Сессия истекла. Войдите заново.";
+				case "forbidden": return "Этот токен принадлежит другой учётной записи или уже удалён.";
 				case "registration-disabled": return "Регистрация на этом сервере отключена.";
 				case "rate-limited": return "Слишком много попыток. Подождите минуту.";
 				default: return "Не удалось войти. Попробуйте ещё раз.";
@@ -11374,8 +12491,81 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				this.publish({
 					...this.snapshot,
 					mode,
-					error: null
+					error: null,
+					notice: null
+				});
+			}
+			/**
+			* File a forgotten-password request for the operator queue. The card says
+			* the same thing whether or not the address exists — the Host refuses to
+			* tell, and so does this controller.
+			*/
+			async requestPasswordReset(email) {
+				if (this.snapshot.stage !== "gate" || this.snapshot.busy || this.disposed) return;
+				const mode = this.snapshot.mode;
+				this.publish({
+					stage: "gate",
+					mode,
+					busy: true,
+					error: null,
+					notice: null
 				});
+				try {
+					const result = await this.options.remote.accountsRequestPasswordReset(email);
+					if (this.disposed) return;
+					if (!result.ok) {
+						this.publish({
+							stage: "gate",
+							mode,
+							busy: false,
+							error: accountsErrorMessage(accountsReasonOf(result.error)),
+							notice: null
+						});
+						return;
+					}
+					this.publish({
+						stage: "gate",
+						mode,
+						busy: false,
+						error: null,
+						notice: QA_RESET_FILED_NOTICE
+					});
+				} catch (error) {
+					if (this.disposed) return;
+					console.warn("dsh-qa-surface: password reset request failed", error);
+					this.publish({
+						stage: "gate",
+						mode,
+						busy: false,
+						error: accountsErrorMessage(null),
+						notice: null
+					});
+				}
+			}
+			/**
+			* Change the signed-in user's own password. The Host answers with a fresh
+			* token, because the write bumps the account's token version — this browser
+			* keeps its session only by storing that token. Resolves to audience-safe
+			* refusal copy, or to null once the snapshot carries the new account.
+			*/
+			async changePassword(currentPassword, nextPassword) {
+				const token = this.tokenValue;
+				if (this.disposed || token === null || this.snapshot.stage !== "authed") return accountsErrorMessage(null);
+				try {
+					const result = await this.options.remote.accountsChangePassword(token, currentPassword, nextPassword);
+					if (this.disposed || this.snapshot.stage !== "authed") return null;
+					if (!result.ok) return accountsErrorMessage(accountsReasonOf(result.error));
+					this.tokenValue = result.value.token;
+					this.saveStoredToken(result.value.token);
+					this.publish({
+						...this.snapshot,
+						user: result.value.user
+					});
+					return null;
+				} catch (error) {
+					console.warn("dsh-qa-surface: password change failed", error);
+					return accountsErrorMessage(null);
+				}
 			}
 			/** Drop the token and return to the gate (logout or expired identity). */
 			signOut() {
@@ -11388,14 +12578,48 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					error: null
 				});
 			}
-			/** Claim one freshly created chat so the ownership map stays current. */
+			/**
+			* Claim one freshly created chat so the ownership map stays current, and
+			* remember it in the owned list the sidebar shows.
+			*
+			* The claim runs on every bind — a chat created now and one reopened later
+			* both take this path. A chat the Host reports as taken by another account
+			* stays out of the list: the page then holds a binding whose ownership
+			* belongs to someone else, and showing it is exactly what the list must not
+			* do. A claim that never reached the Host still records the id, because the
+			* page opened this chat through the attendance boundary, which claims an
+			* unowned chat for whoever asks first and refuses another account's — so the
+			* binding is this account's either way, and hiding a chat the visitor is
+			* looking at would be the greater lie.
+			*/
 			async claimNewSession(sessionId) {
-				if (this.tokenValue === null || this.disposed) return;
+				const token = this.tokenValue;
+				if (token === null || this.disposed || this.snapshot.stage !== "authed") return;
+				let conflict = false;
 				try {
-					await this.options.remote.accountsClaimSessions(this.tokenValue, [sessionId]);
+					const claimed = await this.options.remote.accountsClaimSessions(token, [sessionId]);
+					conflict = claimed.ok && claimed.value.conflicts.includes(sessionId);
 				} catch (error) {
 					console.warn("dsh-qa-surface: session claim failed", error);
 				}
+				if (this.disposed || conflict) return;
+				this.noteOwnedSession(sessionId);
+			}
+			/**
+			* Add one chat this page holds to the owned list. The list is what the
+			* sidebar shows and what every cross-chat projection is scoped by, so a chat
+			* created or opened after login enters it here — the next login is not a
+			* reasonable price for a chat the visitor is looking at. Ids already known,
+			* and the ones an admin's cross-user view contributed, are left as they are.
+			*/
+			noteOwnedSession(sessionId) {
+				const snapshot = this.snapshot;
+				if (snapshot.stage !== "authed" || snapshot.ownedIds.includes(sessionId)) return;
+				this.publish({
+					...snapshot,
+					ownedIds: [...snapshot.ownedIds, sessionId],
+					ownedRevision: snapshot.ownedRevision + 1
+				});
 			}
 			/**
 			* Replace the signed-in user's own profile. Resolves to audience-safe
@@ -11442,6 +12666,92 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					return accountsErrorMessage(null);
 				}
 			}
+			/**
+			* The signed-in user's integration tokens. Resolves to the list, or to the
+			* copy the page renders when the Host refused the read; the tokens are not
+			* part of the account snapshot, because they are not part of the account.
+			*/
+			async serviceTokens() {
+				const token = this.tokenValue;
+				if (this.disposed || token === null || this.snapshot.stage !== "authed") return {
+					ok: false,
+					error: accountsErrorMessage(null)
+				};
+				try {
+					const result = await this.options.remote.accountsListServiceTokens(token);
+					if (!result.ok) return {
+						ok: false,
+						error: accountsErrorMessage(accountsReasonOf(result.error))
+					};
+					return {
+						ok: true,
+						value: result.value.tokens
+					};
+				} catch (error) {
+					console.warn("dsh-qa-surface: integration token list failed", error);
+					return {
+						ok: false,
+						error: accountsErrorMessage(null)
+					};
+				}
+			}
+			/**
+			* Mint one integration token for the signed-in user. The plaintext is in the
+			* answer and nowhere else — the caller has to hand it over now, because
+			* nothing can show it again.
+			*/
+			async createServiceToken(input) {
+				const token = this.tokenValue;
+				if (this.disposed || token === null || this.snapshot.stage !== "authed") return {
+					ok: false,
+					error: accountsErrorMessage(null)
+				};
+				try {
+					const result = await this.options.remote.accountsCreateServiceToken(token, input);
+					if (!result.ok) return {
+						ok: false,
+						error: accountsErrorMessage(accountsReasonOf(result.error))
+					};
+					return {
+						ok: true,
+						value: result.value
+					};
+				} catch (error) {
+					console.warn("dsh-qa-surface: integration token create failed", error);
+					return {
+						ok: false,
+						error: accountsErrorMessage(null)
+					};
+				}
+			}
+			/**
+			* Revoke one of the signed-in user's integration tokens. The Host is the
+			* authority on whose token it is; a refusal is shown as it arrives.
+			*/
+			async revokeServiceToken(tokenId) {
+				const token = this.tokenValue;
+				if (this.disposed || token === null || this.snapshot.stage !== "authed") return {
+					ok: false,
+					error: accountsErrorMessage(null)
+				};
+				try {
+					const result = await this.options.remote.accountsRevokeServiceToken(token, tokenId);
+					if (!result.ok) return {
+						ok: false,
+						error: accountsErrorMessage(accountsReasonOf(result.error))
+					};
+					return {
+						ok: true,
+						value: null
+					};
+				} catch (error) {
+					console.warn("dsh-qa-surface: integration token revoke failed", error);
+					return {
+						ok: false,
+						error: accountsErrorMessage(null)
+					};
+				}
+			}
 			async authenticate(mode, call) {
 				if (this.snapshot.stage !== "gate" || this.snapshot.busy || this.disposed) return;
 				this.publish({
@@ -11664,6 +12974,69 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			if (summary === void 0) return false;
 			return summary.origin === "subagent" || summary.parentId !== void 0;
 		}
+		/**
+		* The chat a session belongs to: itself when nothing delegated it, otherwise
+		* the root of its parent chain.
+		*
+		* A nested child names its own delegated parent in `parentId`, so one hop is
+		* not the chat. The walk stops at the first entry the host list does not know,
+		* which keeps a partially hydrated list from inventing a chat that is not
+		* there; a repeated id (a hostile or broken list) resolves to the id it
+		* repeated on instead of hanging.
+		*/
+		function chatRootOf(byId, sessionId) {
+			let current = sessionId;
+			const seen = /* @__PURE__ */ new Set();
+			while (!seen.has(current)) {
+				seen.add(current);
+				const parent = byId[current]?.parentId;
+				if (parent === void 0) return current;
+				current = String(parent);
+			}
+			return current;
+		}
+		/**
+		* Delegated sessions whose names a page may sign its notices with: the
+		* children of the chats it lists, catalog labels first and list titles after.
+		*
+		* `chats` is the visible chat set — the account's own chats while accounts are
+		* on, and `undefined` for a deployment without accounts, where every chat on
+		* the Host is the browser's own. Ownership is checked against the chat, never
+		* against the child: a delegated session has no owner of its own, so a child
+		* is visible exactly when the chat it belongs to is. Another account's chat
+		* therefore contributes no id and no label — a foreign chat can neither sign
+		* a notice nor be named by one.
+		*/
+		function visibleSubagentCandidates(byId, catalogs, chats) {
+			const visible = (chatId) => chats === void 0 || chats.has(chatId);
+			const candidates = [];
+			const seen = /* @__PURE__ */ new Set();
+			for (const [parentId, catalog] of Object.entries(catalogs)) {
+				if (!visible(parentId)) continue;
+				for (const entry of catalog?.entries ?? []) {
+					if (entry.kind !== "child") continue;
+					const id = entry.id;
+					if (id === void 0 || seen.has(id)) continue;
+					seen.add(id);
+					candidates.push({
+						id,
+						label: entry.label ?? ""
+					});
+				}
+			}
+			for (const [key, summary] of Object.entries(byId)) {
+				if (summary.origin !== "subagent") continue;
+				const id = String(summary.id ?? key);
+				if (seen.has(id)) continue;
+				if (!visible(chatRootOf(byId, id))) continue;
+				seen.add(id);
+				candidates.push({
+					id,
+					label: summary.displayTitle
+				});
+			}
+			return candidates;
+		}
 		//#endregion
 		//#region src/client/kiosk.ts
 		/**
@@ -14612,13 +15985,22 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				if (chat === null) return;
 				await this.switchTo(chat);
 			}
-			/** This browser's chat ids: the owned list when accounts are on, else the
-			* local index. Both intersect the host session list at projection time. */
+			/**
+			* This browser's chat ids: the account's owned chats while accounts are on,
+			* else the browser-local index. Either way they intersect the host session
+			* list at projection time.
+			*
+			* The local index is what this browser accumulated, not an identity: with
+			* accounts on it is the set the page *claims* at login, never one it lists.
+			* Unioning it in would show a chat another account started — its title, its
+			* timestamp, its live activity — on a shared browser, and a chat this page
+			* has yet to claim is added to the owned list by the claim itself, so the
+			* index has nothing left to supply.
+			*/
 			chatIds() {
-				const owned = this.accounts?.ownedIds() ?? [];
-				if (owned.length === 0) return this.chats.chatIds();
-				const local = this.chats.chatIds();
-				return [.../* @__PURE__ */ new Set([...owned, ...local])];
+				const accounts = this.accounts;
+				if (accounts === void 0) return this.chats.chatIds();
+				return accounts.ownedIds();
 			}
 			/** The bound session id, or null while no chat is bound. */
 			activeSessionId() {
@@ -14941,22 +16323,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			* delegation's description verbatim; a child the host listed without a
 			* catalog falls back to its own list title. Tolerates a host bundle older
 			* than either field: an absent snapshot piece just contributes no names.
+			*
+			* Only the chats this page lists contribute: the host list is the whole
+			* deployment's, so an unfiltered read would hand another account's
+			* delegation into this browser — and a notice signed with a name that is
+			* not the chat's own is exactly the leak the chat list itself is scoped
+			* against.
 			*/
 			subagentNames() {
 				const names = {};
 				const list = this.sessions.list.getSnapshot();
-				for (const catalog of Object.values(list.subagentsByParent ?? {})) for (const entry of catalog?.entries ?? []) {
-					if (entry.kind !== "child") continue;
-					const name = readableSubagentName(entry.label, entry.id);
-					if (name !== void 0) names[entry.id] = name;
-				}
-				for (const summary of Object.values(list.byId ?? {})) {
-					if (summary.origin !== "subagent" || names[summary.id] !== void 0) continue;
-					const name = readableSubagentName(summary.displayTitle, summary.id);
-					if (name !== void 0) names[summary.id] = name;
+				const chats = this.visibleChatIds();
+				const candidates = visibleSubagentCandidates(list.byId ?? {}, list.subagentsByParent ?? {}, chats);
+				for (const candidate of candidates) {
+					const name = readableSubagentName(candidate.label, candidate.id);
+					if (name !== void 0) names[candidate.id] = name;
 				}
 				return names;
 			}
+			/**
+			* The chats this page may show and name: the account's owned list while
+			* accounts are on, and `undefined` — every chat on the Host — for a
+			* deployment without accounts, where the list is the browser's own.
+			*/
+			visibleChatIds() {
+				if (this.accounts === void 0) return void 0;
+				return new Set(this.accounts.ownedIds());
+			}
 			fail(message, error) {
 				if (!(error instanceof QaPolicyAttestationError)) console.error("dsh-qa-surface: session operation failed", error);
 				if (this.disposed) return;
@@ -15340,8 +16733,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			};
 		}
 		/**
-		* The file picker's `accept` value: the raster formats plus either the
-		* configured text extensions or the browser's whole `text/*` family.
+		* The file picker's `accept` value: the raster formats plus either every
+		* configured extension and the browser's whole `text/*` family, or nothing
+		* when file attachments are off.
 		* @param limits - attachment policy in effect.
 		* @returns the accept attribute value.
 		*/
@@ -15369,10 +16763,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		function isTextMediaType(mediaType) {
 			return mediaType.toLowerCase().startsWith("text/");
 		}
-		/** Whether a dropped payload may be attached as a text file at all. */
-		function acceptsTextFile(name, mediaType, limits) {
+		/**
+		* Whether a dropped payload may be attached as a file at all. An extension the
+		* operator listed is enough on its own: the list is what the deployment can
+		* work with, and a stand whose pipeline reads Word documents lists `docx`
+		* rather than hoping the browser calls it text.
+		*/
+		function acceptsFileAttachment(name, mediaType, limits) {
 			if (!limits.textFiles) return false;
-			return hasTextExtension(name, limits.extensions) || isTextMediaType(mediaType);
+			return hasAcceptedExtension(name, limits.extensions) || isTextMediaType(mediaType);
+		}
+		/**
+		* Why one non-image file is refused, in the visitor's terms, or null when it is
+		* accepted. The copy used to name a fixed list ("md, txt, log и другие") that
+		* had nothing to do with the deployment's own setting, which is how a stand
+		* able to read Word documents ended up looking like a text-only one.
+		* @param name - display file name.
+		* @param mediaType - MIME type the browser reported.
+		* @param limits - attachment policy in effect.
+		* @returns the refusal message, or null.
+		*/
+		function fileAttachmentRefusal(name, mediaType, limits) {
+			if (acceptsFileAttachment(name, mediaType, limits)) return null;
+			if (!limits.textFiles) return "Файловые вложения выключены: можно приложить только изображения.";
+			const leaf = name.trim().toLowerCase();
+			const extension = fileExtensionOf(name);
+			if (extension === "" || extension === leaf) return "У файла нет расширения, а принять его можно только по расширению из списка разрешённых.";
+			return `Формат «.${extension}» не разрешён на этом стенде. Список разрешённых расширений задаёт оператор.`;
 		}
 		function imageDraftFromBlob(blob, name) {
 			return readAsArrayBuffer(blob).then((buffer) => ({
@@ -15396,7 +16813,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				if (file.size > 15728640) return `Изображение слишком большое (лимит ${formatFileSize(QA_MAX_IMAGE_BYTES)}).`;
 				return imageDraftFromBlob(file, file.name);
 			}
-			if (!acceptsTextFile(file.name, file.type, limits)) return limits.textFiles ? "Поддерживаются изображения и текстовые файлы (md, txt, log и другие)." : "Поддерживаются изображения PNG, JPEG, WebP и GIF.";
+			const refusal = fileAttachmentRefusal(file.name, file.type, limits);
+			if (refusal !== null) return refusal;
 			if (file.size > limits.maxFileBytes) return `Файл слишком большой (лимит ${formatFileSize(limits.maxFileBytes)}).`;
 			return {
 				kind: "file",
@@ -15466,15 +16884,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		*/
 		function QaAuthGate(props) {
 			const { snapshot, accounts } = props;
-			const mode = snapshot.stage === "gate" ? snapshot.mode : "login";
-			const busy = snapshot.stage === "gate" ? snapshot.busy : false;
+			const gate = snapshot.stage === "gate" ? snapshot : void 0;
+			const mode = gate?.mode ?? "login";
+			const busy = gate?.busy ?? false;
+			const notice = gate?.notice ?? null;
 			const [email, setEmail] = (0, react.useState)("");
 			const [password, setPassword] = (0, react.useState)("");
 			const showRegister = props.allowRegistration;
+			const reset = mode === "reset";
 			const submit = (event) => {
 				event.preventDefault();
 				if (busy) return;
-				mode === "register" ? accounts.register(email, password) : accounts.login(email, password);
+				reset ? accounts.requestPasswordReset(email) : mode === "register" ? accounts.register(email, password) : accounts.login(email, password);
 			};
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("main", {
 				className: "dsh-qa-surface dsh-qa-auth",
@@ -15487,7 +16908,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 							className: "dsh-qa-auth__brand",
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Logo, { logoUrl: props.logoUrl }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("h1", { children: props.title })]
 						}),
-						showRegister ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						reset ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dsh-qa-auth__lead",
+							children: "Укажите email: заявку увидит оператор и сбросит пароль. Почта с ссылкой на этом стенде не настроена."
+						}) : null,
+						showRegister && !reset ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: "dsh-qa-auth__tabs",
 							role: "tablist",
 							"aria-label": "Вход или регистрация",
@@ -15519,7 +16944,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 								onChange: (event) => setEmail(event.currentTarget.value)
 							})]
 						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						reset ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 							className: "dsh-qa-auth__field",
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "Пароль" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 								type: "password",
@@ -15532,16 +16957,28 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 								onChange: (event) => setPassword(event.currentTarget.value)
 							})]
 						}),
-						snapshot.stage === "gate" && snapshot.error !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						gate !== void 0 && gate.error !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							className: "dsh-qa-auth__error",
 							role: "alert",
-							children: snapshot.error
+							children: gate.error
 						}) : null,
+						notice === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dsh-qa-auth__notice",
+							role: "status",
+							children: notice
+						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 							type: "submit",
 							className: "dsh-qa-auth__submit",
 							disabled: busy,
-							children: busy ? "Подождите…" : mode === "register" ? "Зарегистрироваться" : "Войти"
+							children: busy ? "Подождите…" : reset ? "Отправить заявку" : mode === "register" ? "Зарегистрироваться" : "Войти"
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsh-qa-auth__link",
+							disabled: busy,
+							onClick: () => accounts.setMode(reset ? "login" : "reset"),
+							children: reset ? "Вернуться ко входу" : "Забыли пароль?"
 						})
 					]
 				})
@@ -48495,8 +49932,32 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		}
 		//#endregion
 		//#region src/client/components/QaChangelog.tsx
-		const QA_VERSION = "0.10.0";
+		const QA_VERSION = "0.11.0";
 		const QA_CHANGELOG = [
+			{
+				version: "0.11.0",
+				date: "2026-09-21",
+				sections: [{
+					title: "Новое",
+					items: [
+						"Правку чужого навыка видно. Администратор может отредактировать личный навык пользователя — это по-прежнему осознанное действие, но больше не бесшумное: пользователь видит в своём списке навыков пометку «Изменено администратором» с датой, пока в файле лежит именно та версия, которую записал администратор. Как только владелец сохраняет навык сам, пометка исчезает: она отвечает на вопрос «кто написал то, что я сейчас вижу», а не ведёт историю правок. Каждое изменение — создание, правка, удаление — попадает в аудит стенда с указанием администратора, навыка и хранилища, в которое он писал.",
+						"Вопрос помощнику можно задать по API — без браузера. У стенда появился адрес /qa/api/ask: другая программа отправляет вопрос, получает ответ в Markdown и может продолжить тот же диалог, отправив обратно полученный идентификатор чата. Так обращение из системы заявок попадает к помощнику автоматически, а ответ возвращается туда же, где живёт заявка, и человек решает, что публиковать клиенту. Рядом есть /qa/api/health, по нему внешняя программа проверяет, что стенд жив и какие модели ему доступны. По умолчанию этот адрес закрыт: его включает оператор стенда, а запросы принимаются только с интеграционным токеном. Ответ приходит не позже чем через 90 секунд — если ассистент не успел, вместо ожидания придёт отметка «нужен специалист» и тот же идентификатор чата, чтобы не потерять начатый разговор. Длинный ответ обрезается до размера, который помещается в комментарий заявки, причём по границе абзаца и с многоточием, чтобы в заявке не оказалось оборванной на полуслове фразы; размер настраивается оператором стенда. Картинки из обращения прикладываются к вопросу как есть, а файлы, которые к обращению приложил клиент, ассистент теперь тоже видит: текстовые (txt, csv, md) он читает как текст, а PDF, Word, Excel и PowerPoint — через конвейер документов стенда, тот же, которым пользуются инструменты работы с документами. Так вопрос «разберись по вложению» действительно опирается на вложение, а не отправляется специалисту только потому, что файл не картинка. Вложение, которое стенд прочитать не может (нет конвейера документов, нечитаемый файл), честно отклоняется: внешняя программа повторит вопрос без вложений и всё равно получит ответ — хуже ответить, не прочитав то, о чём спрашивают. Ничего лишнего при этом не остаётся: файл живёт во временном каталоге только на время чтения, а в вопрос попадает ограниченный по объёму текст с обрезкой и пометкой.",
+						"Интеграционные токены выдаются и отзываются прямо в настройках, в разделе «Интеграционные токены». Там же видно, какие токены уже есть: название, права, дата создания и срок, сколько раз им пользовались и когда в последний раз. Новый токен создаётся за один шаг — название, права и срок, — а его значение показывается ровно один раз: на стенде остаётся только отпечаток, поэтому скопируйте его сразу и передайте интеграции. Отзыв токена просит подтверждение, потому что отменить его нельзя, а работающая интеграция сразу теряет доступ; отозванный или истёкший токен остаётся в списке как запись. Пока интеграционный адрес выключен на стенде, раздел честно объясняет это вместо кнопки, которая всё равно отказала бы, но уже выданные токены по-прежнему можно отозвать. Токен всегда принадлежит вашей учётной записи: чужие токены не видны и не отзываются, а выдать токен другому человеку по-прежнему может только администратор командой qa-accounts token create.",
+						"Интеграционные токены: доступ для внешних программ выдаётся отдельно от паролей и браузерных сессий. Токен создаётся командой qa-accounts token create <почта> — секрет печатается один раз и больше не восстанавливается, а в базе остаётся только его отпечаток. Такой токен переживает смену пароля человеком (смена пароля не должна останавливать работающую интеграцию), имеет собственный срок жизни, отдельно отзывается командой qa-accounts token revoke и ограничен правами: по умолчанию он умеет только задавать вопросы. Отключение учётной записи и команда «отозвать все токены» закрывают его вместе с остальными доступами. Список выданных токенов с датами последнего использования — команда qa-accounts token list.",
+						"Внешняя программа может прочитать переписку своего диалога, а не только задавать вопросы. По адресу /qa/api/session она запрашивает историю чата по его идентификатору и получает сообщения по порядку: что спрашивал человек и что отвечал помощник, с тем же текстом, что и в самом ответе. Это нужно там, где обращение из системы заявок ушло специалисту: он видит, о чём уже говорили, и не должен задавать тот же вопрос заново — раньше единственным способом «прочитать» историю было повторить вопрос, потратив на это отдельный ответ. Чужой чат при этом недоступен: несуществующий идентификатор и разговор другой учётной записи отвечают одинаково, поэтому по одному идентификатору нельзя узнать, что чужая переписка существует. Чтение требует отдельного права, его выдаёт та же выдача интеграционных токенов: можно выдать право читать историю, не давая права задавать вопросы, — например, для отчётной интеграции. История отдаётся страницами от последних сообщений к предыдущим: программа запоминает, до какого места дочитала, и просит только новое, а если что-то осталось ниже страницы, ответ честно об этом говорит.",
+						"Ассистент ищет ответ в документации стенда, а не по памяти. Стенд публикует документацию в каталоге docs рабочего каталога чата, и инструмента, который бы это говорил, у ассистента не было: замечание ревьювера могло сослаться на конкретный путь в этом дереве, а ассистент вместо чтения перебирал рабочий каталог поиском по маске, уходил за контекстом в память и в итоге отвечал по чужим данным — промах читался как «документа нет», а не как «не то дерево». Теперь в наборе инструментов стенда есть поиск по документации (docs_search) и чтение её файла (docs_read). Поиск ищет фразу по строкам и показывает каждое попадание с путём, номером строки и пометкой модуля и версии, разобранными из раскладки docs/<модуль>/<версия>/…; фильтры «версия», «модуль» и «подкаталог» сужают поиск до одной редакции или одного раздела — известно, что вопрос про конкретную версию, значит перебирать все не нужно. Чтение открывает один документ окном строк, которое можно продолжить с нужного места. Оба инструмента ограничивают ответ — число попаданий и объём отчёта у поиска, число строк у чтения — и честно помечают ответ неполным, если что-то не поместилось, чтобы «правильный поиск» не отвечал простынёй. Оба читают только дерево документации: путь вне него, каталог вместо файла, файл, который не читается текстом, и путь, ушедший по символической ссылке за пределы дерева, отвергаются с понятной причиной, а причина не называет путь на диске стенда. В описаниях инструментов прямо сказано, что документация читается здесь, а не из памяти: у ассистента теперь есть куда идти за документацией, и угадывать путь ему не нужно.",
+						"Ассистент отвечает из того источника, который владеет вопросом, а не из памяти по умолчанию. В разделе «Заметки модели» появилась заметка о приоритете источников: сначала то, что уже есть в разговоре и во вложениях, затем документация продукта и доменный эксперт, и только потом память. Раньше порядок источников нигде не проговаривался, поэтому нехватка контекста читалась как повод идти в память: агент сериями вызывал поиск по воспоминаниям вместо того, чтобы открыть приложенный документ. Отдельно сказано, что пустой результат в памяти ничего не доказывает и что документы, страницы и факты о продукте ищут не там. Заметка включается и переписывается своими словами, как и остальные три, и работает в тех чатах, где другие заметки тоже доходят."
+					]
+				}, {
+					title: "Исправления",
+					items: [
+						"Приложенный документ теперь разбирается целиком — и помощником, и панелью «Файлы». Загруженный файл стенд хранит в отдельном хранилище вложений, вне рабочего каталога чата, и читать его помощнику разрешено: путь к нему стоит в самом вопросе. Но инструменты работы с документами об этом хранилище не знали и отказывались открывать файл, который помощнику как раз разрешили прочитать, — просьба разобрать приложенный документ заканчивалась ответом «файла нет», хотя файл на месте, а приложенный документ Word нельзя было посмотреть в панели «Файлы». Теперь хранилище вложений передаётся этим инструментам так же, как его знает остальная часть стенда: документ разбирается по тому же пути, что пришёл в вопросе, а доступ к остальному содержимому хранилища не открывается — читается ровно один названный файл, и только на чтение. Доступ выдаётся тому чату, который его получил, вместе с его дочерними помощниками, и снимается вместе с чатом.",
+						"Документ Word или PDF можно приложить к вопросу — раньше он отбивался прямо при перетаскивании. Список приложимых файлов был списком текстовых расширений: он так и назывался в настройках, и сообщение об отказе перечисляло свой набор «md, txt, log и другие», никак не связанный с настройкой стенда. Получалось несоответствие: стенд разбирает такие документы конвейером документов и показывает документ Word прямо в чате, а приложить его было нельзя. Теперь разрешённые расширения — это то, чем стенд действительно умеет работать: к текстовым файлам добавлены docx и pdf, а если формат всё-таки не разрешён, отказ называет само расширение и говорит, что список задаёт оператор стенда. Там, где список задан явно, он остаётся ровно таким, каким его задали, — добавление работает для стендов, которые полагаются на значения по умолчанию.",
+						"Приложенный документ Word или PDF читается своим инструментом, а не универсальным чтением файла. Документ из вложения лежит на диске путём, и универсальное чтение отказывает таким форматам как бинарным — «cannot read …docx: binary file». Этот отказ ничего не говорит о том, есть ли файл на месте, но читался он именно так: агент решал, что документа нет, начинал искать его по рабочим каталогам и сообщал пользователю, что до файла не дотянуться, хотя конвейер документов всё это время был доступен. В разделе «Заметки модели» появилась заметка о документах: она называет инструменты конвейера (document_inspect, document_to_markdown, а для вложения по ссылке — document_from_url), говорит, что отказ универсального чтения на офисных форматах — это ожидаемый ответ, а не повод искать файл в другом месте, и что отказ самого конвейера нужно назвать вместе с путём, который он назвал. Заметка включается и переписывается своими словами, как и остальные, — стенду без конвейера документов её стоит выключить.",
+						"Список чатов показывает только ваши чаты. Обычно список собирался и из ваших разговоров, и из того, что этот браузер запомнил раньше, поэтому на общем компьютере — в переговорке, у стенда, за одной учётной записью Windows — в него попадали разговоры, начатые до вас: с их названиями, временем и значком работы помощника в момент, когда чужой разговор шёл. Теперь список — это ровно ваши чаты: чужой разговор в нём не появится, а разговор, начатый или открытый после входа, виден сразу, без перезагрузки страницы. На стенде без учётных записей ничего не изменилось: список по-прежнему ваш собственный. Имена фоновых помощников в плашках о завершении берутся только из ваших разговоров."
+					]
+				}]
+			},
 			{
 				version: "0.10.0",
 				date: "2026-09-19",
@@ -48853,7 +50314,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 								className: "dsh-qa-changelog__date",
 								children: entry.date
 							}),
-							entry.version === "0.10.0" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							entry.version === "0.11.0" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 								className: "dsh-qa-changelog__current",
 								children: "текущая"
 							}) : null
@@ -51064,6 +52525,436 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			});
 		}
 		//#endregion
+		//#region src/shared/integration-tokens.ts
+		/**
+		* The integration-token vocabulary and its bounds, on the browser side too.
+		*
+		* Minting lives in `accounts/service-token.ts`, which is Host-only (it hashes a
+		* secret before storing it); the profile page has to name the same scopes and
+		* enforce the same limits without importing that. Dependency-free like every
+		* `src/shared` module, so both bundles inline it and there is exactly one copy
+		* of the numbers the two halves have to agree on.
+		*/
+		/**
+		* What an integration token may do. Scopes are checked per request rather than
+		* per deployment: the same bridge token that asks questions carries no
+		* permission to read back a conversation catalog it was not given.
+		*/
+		const QA_SERVICE_TOKEN_SCOPES = Object.freeze(["ask", "sessions:read"]);
+		/** A token that carries no scope is useless; `ask` is what the API is for. */
+		const QA_SERVICE_TOKEN_DEFAULT_SCOPES = Object.freeze(["ask"]);
+		const QA_SERVICE_TOKEN_TTL_DAYS_MAX = 3650;
+		//#endregion
+		//#region src/client/user-settings/IntegrationTokensPage.tsx
+		/** Scope names as the person choosing them reads them. */
+		const SCOPE_LABELS = {
+			ask: "Задавать вопросы",
+			"sessions:read": "Читать историю чатов"
+		};
+		/** The lifetimes a token is usually asked for; the Host bounds the real range. */
+		const TTL_CHOICES = [
+			30,
+			90,
+			180,
+			365
+		];
+		function scopeLabels(scopes) {
+			return scopes.length === 0 ? "без прав" : scopes.map((scope) => SCOPE_LABELS[scope]).join(", ");
+		}
+		/** `2026-09-21` for a stored ISO timestamp; the empty string when unparseable. */
+		function day(iso) {
+			const at = Date.parse(iso);
+			return Number.isFinite(at) ? new Date(at).toISOString().slice(0, 10) : "";
+		}
+		function tokenState(token, now) {
+			if (token.revokedAt !== null) return "revoked";
+			return Date.parse(token.expiresAt) <= now ? "expired" : "active";
+		}
+		/**
+		* The integration tokens of the signed-in account: mint, read the secret once,
+		* and revoke.
+		*
+		* An integration token is the credential a non-browser application presents to
+		* the QA HTTP API, and it is deliberately a second, separate credential from
+		* the browser session: it survives a password change, it carries its own
+		* scopes and expiry, and it is revoked here rather than by signing anybody out.
+		* The page therefore says what the token is *for* before it offers to mint one
+		* — handing a long-lived key to a service is not a preference toggle.
+		*
+		* The plaintext exists in exactly one place: the answer that minted it. It is
+		* shown once, with the warning that this is the only time, and the list that
+		* follows carries no secret in any state — a list that could repeat a
+		* credential would be a list that leaks it.
+		*/
+		function QaIntegrationTokensPage(props) {
+			const [tokens, setTokens] = (0, react.useState)([]);
+			const [loading, setLoading] = (0, react.useState)(true);
+			const [error, setError] = (0, react.useState)(null);
+			const [label, setLabel] = (0, react.useState)("");
+			const [days, setDays] = (0, react.useState)(TTL_CHOICES[1] ?? 90);
+			const [scopes, setScopes] = (0, react.useState)(QA_SERVICE_TOKEN_DEFAULT_SCOPES);
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [issued, setIssued] = (0, react.useState)(null);
+			const [copied, setCopied] = (0, react.useState)(false);
+			const [pendingRevoke, setPendingRevoke] = (0, react.useState)(null);
+			const [revoking, setRevoking] = (0, react.useState)(null);
+			(0, react.useEffect)(() => {
+				let live = true;
+				props.api.list().then((result) => {
+					if (!live) return;
+					setLoading(false);
+					if (result.ok) {
+						setTokens(result.value);
+						return;
+					}
+					setError(result.error);
+				});
+				return () => {
+					live = false;
+				};
+			}, [props.api]);
+			const reload = async () => {
+				const result = await props.api.list();
+				if (result.ok) {
+					setTokens(result.value);
+					setError(null);
+					return;
+				}
+				setError(result.error);
+			};
+			const submit = (event) => {
+				event.preventDefault();
+				if (busy) return;
+				setBusy(true);
+				setError(null);
+				setCopied(false);
+				props.api.create({
+					label: label.trim(),
+					scopes: [...scopes],
+					ttlDays: days
+				}).then(async (result) => {
+					setBusy(false);
+					if (!result.ok) {
+						setError(result.error);
+						return;
+					}
+					setIssued(result.value);
+					setLabel("");
+					await reload();
+				});
+			};
+			const toggleScope = (scope, checked) => {
+				setScopes((current) => checked ? QA_SERVICE_TOKEN_SCOPES.filter((candidate) => candidate === scope || current.includes(candidate)) : current.filter((candidate) => candidate !== scope));
+			};
+			const revoke = (tokenId) => {
+				if (revoking !== null) return;
+				setRevoking(tokenId);
+				setError(null);
+				props.api.revoke(tokenId).then(async (result) => {
+					setRevoking(null);
+					setPendingRevoke(null);
+					if (!result.ok) {
+						setError(result.error);
+						return;
+					}
+					await reload();
+				});
+			};
+			const copySecret = (secret) => {
+				const clipboard = navigator.clipboard;
+				if (clipboard === void 0) return;
+				clipboard.writeText(secret).then(() => setCopied(true), () => void 0);
+			};
+			const now = Date.now();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dsh-qa-settings__page",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+						className: "dsh-qa-settings__page-title",
+						children: "Интеграционные токены"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-settings__lead",
+						children: "Токен — это ключ для другой программы: она задаёт вопросы от имени вашей учётной записи, не открывая браузер. Выдавайте отдельный токен каждой интеграции и отзывайте его, когда она больше не нужна. Токен переживает смену вашего пароля, поэтому отзывается отдельно."
+					}),
+					issued === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(QaSettingsSection, {
+						title: "Токен создан",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsNotice, {
+								tone: "warn",
+								children: "Скопируйте значение сейчас и передайте его интеграции. Показать его повторно нельзя: на стенде хранится только отпечаток."
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsField, {
+								label: "Значение токена",
+								hint: "Передавайте его как заголовок Authorization: Bearer …",
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "dsh-qa-settings__code",
+									value: issued.token,
+									readOnly: true,
+									onFocus: (event) => event.currentTarget.select()
+								})
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(QaSettingsActions, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+								label: copied ? "Скопировано" : "Скопировать",
+								onClick: () => copySecret(issued.token)
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+								tone: "primary",
+								label: "Я сохранил токен",
+								onClick: () => {
+									setIssued(null);
+									setCopied(false);
+								}
+							})] })
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsSection, {
+						title: "Новый токен",
+						children: props.api.canCreate ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
+							className: "dsh-qa-settings__page",
+							onSubmit: submit,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsField, {
+									label: "Название",
+									hint: "По нему вы отличите токены в списке: например, «мост заявок».",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										value: label,
+										maxLength: 80,
+										placeholder: "мост заявок",
+										onChange: (event) => setLabel(event.currentTarget.value)
+									})
+								}),
+								QA_SERVICE_TOKEN_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "dsh-qa-settings__toggle-row",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										className: "dsh-qa-settings__toggle",
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+											type: "checkbox",
+											checked: scopes.includes(scope),
+											onChange: (event) => toggleScope(scope, event.currentTarget.checked)
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "dsh-qa-settings__toggle-label",
+											children: SCOPE_LABELS[scope]
+										})]
+									})
+								}, scope)),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: "dsh-qa-settings__field-hint",
+									children: "Права ограничивают токен, но не расширяют доступ вашей учётной записи: токен не может больше того, что можете вы."
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsField, {
+									label: "Срок, дней",
+									hint: `От ${String(1)} до ${String(QA_SERVICE_TOKEN_TTL_DAYS_MAX)}; по умолчанию — срок вашей сессии.`,
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("select", {
+										value: days,
+										onChange: (event) => setDays(Number(event.currentTarget.value)),
+										children: TTL_CHOICES.map((choice) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+											value: choice,
+											children: choice
+										}, choice))
+									})
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsActions, { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+									type: "submit",
+									tone: "primary",
+									disabled: busy,
+									label: busy ? "Создание…" : "Создать токен"
+								}) })
+							]
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsNotice, {
+							tone: "info",
+							children: "Интеграционный API выключен на этом стенде, поэтому создавать токены пока не для чего. Выданные ранее токены остаются в списке ниже — их можно отозвать."
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(QaSettingsSection, {
+						title: "Выданные токены",
+						children: [error === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsNotice, {
+							tone: "error",
+							children: error
+						}), loading ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dsh-qa-settings__field-hint",
+							children: "Загрузка…"
+						}) : tokens.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "dsh-qa-settings__field-hint",
+							children: "У вас пока нет интеграционных токенов."
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
+							className: "dsh-qa-settings__rows",
+							children: tokens.map((token) => {
+								const state = tokenState(token, now);
+								const confirming = pendingRevoke === token.id;
+								return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("li", {
+									className: "dsh-qa-settings__row",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "dsh-qa-settings__row-button",
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsh-qa-settings__row-title",
+												children: token.label
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsh-qa-settings__row-description",
+												children: scopeLabels(token.scopes)
+											}),
+											/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+												className: "dsh-qa-settings__row-meta",
+												children: [
+													"создан ",
+													day(token.createdAt),
+													" · до ",
+													day(token.expiresAt),
+													" ",
+													"· использований: ",
+													token.useCount,
+													token.lastUsedAt === null ? "" : ` · последний раз ${day(token.lastUsedAt)}`
+												]
+											}),
+											state === "active" ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: state === "revoked" ? "dsh-qa-settings__row-meta" : "dsh-qa-settings__row-warning",
+												children: state === "revoked" ? "отозван" : "истёк — интеграция больше не может им пользоваться"
+											}),
+											state === "active" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsActions, { children: confirming ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+												label: "Отмена",
+												onClick: () => setPendingRevoke(null)
+											}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+												tone: "danger",
+												disabled: revoking === token.id,
+												label: revoking === token.id ? "Отзываем…" : "Отозвать окончательно",
+												onClick: () => revoke(token.id)
+											})] }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+												tone: "danger",
+												label: "Отозвать",
+												title: `Отозвать токен «${token.label}»`,
+												onClick: () => setPendingRevoke(token.id)
+											}) }) : null
+										]
+									})
+								}, token.id);
+							})
+						})]
+					})
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/user-settings/PasswordSettingsPage.tsx
+		/** The Host's own floor; repeated here so the form refuses before the round trip. */
+		const MIN_PASSWORD_LENGTH$1 = 8;
+		/**
+		* The password section of the settings dialog: current, new, repeat. The
+		* repeat field is client-side only — it exists to catch a typo in the field
+		* that, unlike a name, cannot be read back later.
+		*
+		* The consequence is stated rather than discovered: changing a password ends
+		* every *other* session of this account, which is exactly the point after a
+		* leak and exactly what looks like a bug when nobody said so.
+		*/
+		function QaPasswordSettingsPage(props) {
+			const [current, setCurrent] = (0, react.useState)("");
+			const [next, setNext] = (0, react.useState)("");
+			const [repeat, setRepeat] = (0, react.useState)("");
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [error, setError] = (0, react.useState)(null);
+			const [saved, setSaved] = (0, react.useState)(false);
+			const tooShort = next !== "" && next.length < MIN_PASSWORD_LENGTH$1;
+			const mismatch = repeat !== "" && repeat !== next;
+			const incomplete = current === "" || next === "" || repeat === "";
+			const submit = (event) => {
+				event.preventDefault();
+				if (busy || incomplete || mismatch || tooShort) return;
+				setBusy(true);
+				setError(null);
+				setSaved(false);
+				props.onChange(current, next).then((refusal) => {
+					setBusy(false);
+					if (refusal !== null) {
+						setError(refusal);
+						return;
+					}
+					setCurrent("");
+					setNext("");
+					setRepeat("");
+					setSaved(true);
+				});
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("form", {
+				className: "dsh-qa-settings__page",
+				onSubmit: submit,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+						className: "dsh-qa-settings__page-title",
+						children: "Пароль"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-settings__lead",
+						children: "Смена пароля закрывает ваши сессии в других браузерах — там придётся войти заново. Текущая сессия сохранится."
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsField, {
+						label: "Текущий пароль",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							type: "password",
+							name: "current-password",
+							autoComplete: "current-password",
+							required: true,
+							disabled: busy,
+							value: current,
+							onChange: (event) => setCurrent(event.currentTarget.value)
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsField, {
+						label: "Новый пароль",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							type: "password",
+							name: "new-password",
+							autoComplete: "new-password",
+							required: true,
+							minLength: MIN_PASSWORD_LENGTH$1,
+							disabled: busy,
+							value: next,
+							onChange: (event) => setNext(event.currentTarget.value)
+						})
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsField, {
+						label: "Новый пароль ещё раз",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							type: "password",
+							name: "repeat-password",
+							autoComplete: "new-password",
+							required: true,
+							minLength: MIN_PASSWORD_LENGTH$1,
+							disabled: busy,
+							value: repeat,
+							onChange: (event) => setRepeat(event.currentTarget.value)
+						})
+					}),
+					tooShort ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+						className: "dsh-qa-settings__field-hint",
+						children: [
+							"Пароль должен быть не короче ",
+							MIN_PASSWORD_LENGTH$1,
+							" символов."
+						]
+					}) : null,
+					mismatch ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-settings__field-hint",
+						children: "Пароли не совпадают."
+					}) : null,
+					error === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsNotice, {
+						tone: "error",
+						children: error
+					}),
+					saved && error === null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsNotice, {
+						tone: "info",
+						children: "Пароль изменён. Другие сессии закрыты."
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsActions, { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSettingsButton, {
+						type: "submit",
+						tone: "primary",
+						disabled: busy || incomplete || mismatch || tooShort,
+						label: busy ? "Сохранение…" : "Сменить пароль"
+					}) })
+				]
+			});
+		}
+		//#endregion
 		//#region src/client/user-settings/ProfileSettingsPage.tsx
 		const FORM_ID$2 = "dsh-qa-settings-profile-form";
 		/**
@@ -51239,7 +53130,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"skill-name-invalid": "Название может содержать только строчные латинские буквы, цифры и дефисы.",
 			"skill-invalid": "Не удалось сохранить навык: проверьте поля ниже.",
 			"storage-unavailable": "Хранилище навыков недоступно. Обратитесь к администратору стенда.",
-			"workspace-unavailable": "Рабочий каталог вашего аккаунта недоступен. Обратитесь к администратору стенда."
+			"workspace-unavailable": "Рабочий каталог вашего аккаунта недоступен. Обратитесь к администратору стенда.",
+			forbidden: "У вашей роли нет прав на это действие."
 		};
 		const REASON_MARKER = /\(reason: ([a-z-]+)\)/u;
 		const GENERIC_FAILURE = "Не удалось выполнить действие. Попробуйте ещё раз.";
@@ -51254,6 +53146,23 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			if (reason === void 0) return GENERIC_FAILURE;
 			return REASON_COPY[reason] ?? GENERIC_FAILURE;
 		}
+		/**
+		* The badge line for a skill an administrator last wrote.
+		*
+		* It names the role, not the person: the row already carries a date, and who
+		* administers a deployment is not a fact a personal settings page should
+		* depend on. The mark itself comes from the Host, which only reports one while
+		* the stored bytes are still the administrator's.
+		*/
+		function adminEditMessage(edit) {
+			const at = Date.parse(edit.at);
+			if (Number.isNaN(at)) return "Изменено администратором";
+			return `Изменено администратором ${new Date(at).toLocaleDateString("ru-RU", {
+				day: "2-digit",
+				month: "2-digit",
+				year: "numeric"
+			})}`;
+		}
 		/** Whether a failure is the optimistic-concurrency refusal. */
 		function isSkillConflict(error) {
 			const message = typeof error === "object" && error !== null && "message" in error ? String(error.message) : typeof error === "string" ? error : "";
@@ -51477,6 +53386,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 											className: "dsh-qa-settings__row-meta",
 											children: skillMetaLine(skill)
 										}),
+										skill.adminEdit === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: "dsh-qa-settings__row-note",
+											children: adminEditMessage(skill.adminEdit)
+										}),
 										skillToolWarning(skill) === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 											className: "dsh-qa-settings__row-warning",
 											children: skillToolWarning(skill)
@@ -52303,10 +54216,18 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					id: "profile",
 					title: "Профиль"
 				});
+				if (props.password !== void 0) models.push({
+					id: "password",
+					title: "Пароль"
+				});
 				if (props.starters !== void 0) models.push({
 					id: "starters",
 					title: "Быстрые сообщения"
 				});
+				if (props.integrationTokens !== void 0) models.push({
+					id: "tokens",
+					title: "Интеграционные токены"
+				});
 				models.push({
 					id: "general",
 					title: "Общие"
@@ -52322,7 +54243,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				return models;
 			}, [
 				props.profile,
+				props.password,
 				props.starters,
+				props.integrationTokens,
 				props.skills,
 				extensionSnapshot.sections
 			]);
@@ -52359,10 +54282,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 								instructionsMaxLength: props.profile.instructionsMaxLength,
 								onSave: props.profile.onSave
 							}) : null,
+							active === "password" && props.password !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaPasswordSettingsPage, { onChange: props.password.onChange }) : null,
 							active === "starters" && props.starters !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaStartersSettingsPage, {
 								starters: props.starters.starters,
 								onSave: props.starters.onSave
 							}) : null,
+							active === "tokens" && props.integrationTokens !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaIntegrationTokensPage, { api: props.integrationTokens }) : null,
 							active === "general" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaGeneralSettingsPage, {
 								email: props.email,
 								role: props.role,
@@ -53145,7 +55070,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					if (rest[0] === "skills") return { page: "skills" };
 					return { page: "subroles" };
 				case "subroles": return { page: "subroles" };
-				case "skills": return { page: "skills" };
+				case "skills": return rest[0] === "editor" ? { page: "skill-files" } : { page: "skills" };
 				case "common": return { page: "common" };
 				case "conversations": return param === void 0 ? { page: "conversations" } : {
 					page: "conversation",
@@ -53169,6 +55094,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					case "user": return `/users/${encodeURIComponent(route.userId)}`;
 					case "subroles": return "/access/subroles";
 					case "skills": return "/access/skills";
+					case "skill-files": return "/skills/editor";
 					case "common": return "/access/common";
 					case "conversations": return "/conversations";
 					case "conversation": return `/conversations/${encodeURIComponent(route.conversationId)}${route.messageId === void 0 ? "" : `/${encodeURIComponent(route.messageId)}`}`;
@@ -53262,6 +55188,13 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				children: props.value === void 0 ? "—" : formatRelative(props.value)
 			});
 		}
+		function ErrorLine(props) {
+			return props.message === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+				className: "dsh-qa-admin__error",
+				role: "alert",
+				children: props.message
+			});
+		}
 		/**
 		* Cursor paging controls. The cursor is opaque to the browser by design: only
 		* the Host knows how a page was cut.
@@ -54551,8 +56484,271 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			});
 		}
 		//#endregion
+		//#region src/client/admin/pages/SkillFiles.tsx
+		function scopeOf(choice) {
+			return choice.kind === "shared" ? { kind: "shared" } : {
+				kind: "user",
+				userId: choice.userId ?? ""
+			};
+		}
+		/**
+		* What the header shows before a user has been chosen: no store is open yet,
+		* and the empty catalog says so without asking the Host for anything.
+		*/
+		function emptyView(choice) {
+			return {
+				scope: scopeOf(choice),
+				owner: null,
+				skills: [],
+				rootPath: ""
+			};
+		}
+		/** How many accounts the picker offers; a deployment's directory is small. */
+		const PICKER_LIMIT = 100;
+		/**
+		* Skill files: the deployment's shared skills, and the personal skills of one
+		* named account.
+		*
+		* The page is a scope picker around the very component a person edits their
+		* own skills with — there is no second editor, because a second editor is a
+		* second set of rules for what a `SKILL.md` may contain. What the console adds
+		* is the choice of store, the naming of its owner, and the fact that its writes
+		* are recorded as an administrator's.
+		*/
+		function AdminSkillFiles(props) {
+			const { api, token } = props;
+			const [choice, setChoice] = (0, react.useState)({ kind: "shared" });
+			const users = useAdminResource(() => api.users(token, {}, null, PICKER_LIMIT), [api, token]);
+			const personal = choice.kind === "user";
+			const chosen = personal && choice.userId !== null;
+			const view = useAdminResource(() => personal && !chosen ? Promise.resolve({
+				ok: true,
+				value: emptyView(choice)
+			}) : api.skills(token, scopeOf(choice)), [
+				api,
+				token,
+				choice,
+				personal,
+				chosen
+			]);
+			const skillApi = (0, react.useMemo)(() => {
+				const scope = scopeOf(choice);
+				return {
+					list: async () => {
+						const result = await api.skills(token, scope);
+						return result.ok ? {
+							ok: true,
+							value: result.value.skills
+						} : {
+							ok: false,
+							error: result.error
+						};
+					},
+					get: (name) => api.skill(token, scope, name),
+					create: (input) => api.saveSkill(token, scope, null, input),
+					update: (name, input) => api.saveSkill(token, scope, name, input),
+					remove: (name, revision) => api.deleteSkill(token, scope, name, revision),
+					tools: () => api.skillTools(token, scope),
+					validate: (name, input) => api.validateSkill(token, scope, name, input)
+				};
+			}, [
+				api,
+				token,
+				choice
+			]);
+			const failure = view.error ?? users.error;
+			const headerError = failure === void 0 ? void 0 : adminErrorMessage(failure);
+			const ready = headerError === void 0 && (chosen || !personal);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: "dsh-qa-admin__page",
+				"aria-label": "Редактор навыков",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsh-qa-admin__title-row",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h1", { children: "Редактор навыков" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: "Общие навыки видны на всём стенде. Личные навыки администратор правит от имени владельца — тот увидит пометку «изменено администратором». Каждая правка попадает в аудит." })] })
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsh-qa-admin__tabs",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							"aria-current": personal ? void 0 : "page",
+							onClick: () => setChoice({ kind: "shared" }),
+							children: "Общие навыки стенда"
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							"aria-current": personal ? "page" : void 0,
+							onClick: () => setChoice((current) => ({
+								kind: "user",
+								userId: current.kind === "user" ? current.userId : null
+							})),
+							children: "Личные навыки пользователя"
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ErrorLine, { message: headerError }),
+					personal ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						className: "dsh-qa-admin__filter",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: "Пользователь" }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
+							value: choice.userId ?? "",
+							onChange: (event) => setChoice({
+								kind: "user",
+								userId: event.currentTarget.value
+							}),
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
+								value: "",
+								children: "Выберите пользователя…"
+							}), (users.data?.items ?? []).map((row) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("option", {
+								value: row.id,
+								children: [
+									row.displayName === "" ? row.email : row.displayName,
+									" —",
+									" ",
+									row.email
+								]
+							}, row.id))]
+						})]
+					}) : null,
+					view.data === void 0 || view.data.rootPath === "" ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+						className: "dsh-qa-admin__facts",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: view.data.owner === null ? "Общее хранилище стенда" : `Личное хранилище ${view.data.owner.displayName === "" ? view.data.owner.email : view.data.owner.displayName}` }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsh-qa-admin__mono",
+							title: view.data.rootPath,
+							children: view.data.rootPath
+						})]
+					}),
+					personal && !chosen ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-admin__empty",
+						children: "Выберите пользователя, чтобы открыть его личные навыки."
+					}) : null,
+					ready ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(QaSkillsSettingsPage, { api: skillApi }, personal ? choice.userId ?? "personal" : "shared") : null
+				]
+			});
+		}
+		//#endregion
 		//#region src/client/admin/pages/Users.tsx
 		const PAGE_SIZE = 25;
+		/** The Host's floor; the form refuses a shorter password before the round trip. */
+		const MIN_PASSWORD_LENGTH = 8;
+		/**
+		* The forgotten-password queue: an account asked for a reset from the sign-in
+		* screen and nobody has answered it yet.
+		*
+		* It renders only while somebody is waiting. A permanently empty panel would
+		* teach operators to ignore it, and this one has to be noticed: answering a row
+		* signs every session of that account out, so the new password must be handed
+		* over deliberately.
+		*/
+		function PasswordResetQueue(props) {
+			const { api, token } = props;
+			const [requests, setRequests] = (0, react.useState)([]);
+			const [drafts, setDrafts] = (0, react.useState)({});
+			const [busy, setBusy] = (0, react.useState)();
+			const [error, setError] = (0, react.useState)();
+			const [notice, setNotice] = (0, react.useState)();
+			const load = (0, react.useCallback)(async () => {
+				const result = await api.passwordResetRequests(token);
+				if (!result.ok) {
+					setError(adminErrorMessage(result.error));
+					return;
+				}
+				setError(void 0);
+				setRequests(result.value);
+			}, [api, token]);
+			(0, react.useEffect)(() => {
+				load();
+			}, [load]);
+			const reset = async (userId) => {
+				const password = (drafts[userId] ?? "").trim();
+				if (password.length < MIN_PASSWORD_LENGTH) {
+					setNotice(void 0);
+					setError(`Пароль должен быть не короче ${MIN_PASSWORD_LENGTH} символов.`);
+					return;
+				}
+				setBusy(userId);
+				const result = await api.resetPassword(token, userId, password);
+				setBusy(void 0);
+				if (!result.ok) {
+					setNotice(void 0);
+					setError(adminErrorMessage(result.error));
+					return;
+				}
+				setError(void 0);
+				setNotice(`Новый пароль для ${result.value.user.email} установлен — передайте его пользователю. Заявка закрыта, его сессии завершены.`);
+				setDrafts((current) => ({
+					...current,
+					[userId]: ""
+				}));
+				await load();
+			};
+			if (requests.length === 0) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "dsh-qa-admin__panel",
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsh-qa-admin__panel-head",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", { children: "Заявки на сброс пароля" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Badge, {
+							tone: "warning",
+							children: requests.length === 1 ? "1 заявка" : `${String(requests.length)} заявок`
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-admin__panel-note",
+						children: "Пользователь не может войти и просит новый пароль. Сброс завершает все его сессии: старый пароль и выданные токены перестают действовать."
+					}),
+					error === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-admin__error",
+						role: "alert",
+						children: error
+					}),
+					notice === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "dsh-qa-admin__notice",
+						role: "status",
+						children: notice
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("table", {
+						className: "dsh-qa-admin__table",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("thead", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: "Пользователь" }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: "Запрошен" }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: "Заявок" }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", { children: "Новый пароль" }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("th", {})
+						] }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("tbody", { children: requests.map((request) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("tr", { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: request.displayName }),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", { children: request.email }),
+								request.disabled ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("small", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Badge, {
+									tone: "negative",
+									children: "Отключён"
+								}) }) : null
+							] }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("td", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Stamp, { value: request.lastRequestedAt }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("small", { children: ["первый запрос: ", formatStamp(request.requestedAt)] })] }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: formatCount$1(request.requestCount) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								type: "password",
+								autoComplete: "new-password",
+								minLength: MIN_PASSWORD_LENGTH,
+								placeholder: "не короче 8 символов",
+								disabled: busy === request.userId,
+								value: drafts[request.userId] ?? "",
+								onChange: (event) => {
+									const value = event.currentTarget.value;
+									setDrafts((current) => ({
+										...current,
+										[request.userId]: value
+									}));
+								}
+							}) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("td", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								disabled: busy === request.userId,
+								onClick: () => void reset(request.userId),
+								children: busy === request.userId ? "Сбрасываю…" : "Сбросить"
+							}) })
+						] }, request.userId)) })]
+					})
+				]
+			});
+		}
 		/**
 		* Users: the table an administrator triages from, and the detail page that
 		* separates authorization from the QA subrole assignment — an admin may work
@@ -54601,6 +56797,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						className: "dsh-qa-admin__title-row",
 						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h1", { children: "Пользователи" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: "Административная роль и профили агента настраиваются независимо. Удаления нет: историю разговоров сохраняет отключение." })] })
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(PasswordResetQueue, {
+						api: props.api,
+						token: props.token
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "dsh-qa-admin__filters",
 						children: [
@@ -54943,6 +57143,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				group: "Доступ",
 				permission: "roles.read"
 			},
+			{
+				page: "skill-files",
+				label: "Редактор навыков",
+				group: "Доступ",
+				permission: "skills.manage"
+			},
 			{
 				page: "conversations",
 				label: "Разговоры",
@@ -54979,6 +57185,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			"overview",
 			"users",
 			"user",
+			"skill-files",
 			"conversations",
 			"conversation",
 			"review",
@@ -55850,7 +58057,10 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 									})
 								]
 							}, role.id))
-						})] }) : page === "skills" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						})] }) : adminApi !== void 0 && page === "skill-files" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AdminSkillFiles, {
+							api: adminApi,
+							token: props.token
+						}) : page === "skills" ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "dsh-qa-admin__title-row",
 							children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h1", { children: "Навыки" }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: "SKILL.md сам объявляет свою аудиторию и необходимые инструменты. Администратор может расширить или отозвать доступ, не изменяя файл навыка." })] })
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SkillTable, {
@@ -56539,6 +58749,12 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				label: accountsSnapshot.user.profile.fullName === "" ? accountsSnapshot.user.email : accountsSnapshot.user.profile.fullName,
 				onOpen: () => setSettingsOpen(true)
 			} : void 0, [accountsSnapshot]);
+			const integrationTokens = (0, react.useMemo)(() => accounts === void 0 ? void 0 : {
+				canCreate: config.integration.enabled,
+				list: () => accounts.serviceTokens(),
+				create: (input) => accounts.createServiceToken(input),
+				revoke: (tokenId) => accounts.revokeServiceToken(tokenId)
+			}, [accounts, config.integration.enabled]);
 			const settingsDialog = (0, react.useMemo)(() => {
 				if (accounts === void 0 || accountsSnapshot.stage !== "authed") return;
 				return {
@@ -56548,17 +58764,20 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 						instructionsMaxLength: config.accounts.profile.instructionsMaxLength,
 						onSave: (input) => accounts.updateProfile(input)
 					} : void 0,
+					password: { onChange: (currentPassword, nextPassword) => accounts.changePassword(currentPassword, nextPassword) },
 					starters: config.accounts.starters.enabled ? {
 						starters: accountsSnapshot.user.starters,
 						onSave: (input) => accounts.updateStarters(input)
 					} : void 0,
-					skills: config.accounts.skills.enabled && boundSkillApi !== void 0 ? boundSkillApi : void 0
+					skills: config.accounts.skills.enabled && boundSkillApi !== void 0 ? boundSkillApi : void 0,
+					integrationTokens
 				};
 			}, [
 				accounts,
 				accountsSnapshot,
 				config,
-				boundSkillApi
+				boundSkillApi,
+				integrationTokens
 			]);
 			const busyTurn = state.phase === "running" ? railItems.at(-1)?.turn ?? null : null;
 			const chatRows = (0, react.useMemo)(() => buildChatRows(controller?.chatIds() ?? [], listState.byId, activeSessionId, (id) => ownerNames?.get(id)), [
@@ -56673,7 +58892,9 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					extensions: props.settingsSections,
 					token: accounts?.token() ?? "",
 					...settingsDialog.profile === void 0 ? {} : { profile: settingsDialog.profile },
+					...settingsDialog.password === void 0 ? {} : { password: settingsDialog.password },
 					...settingsDialog.starters === void 0 ? {} : { starters: settingsDialog.starters },
+					...settingsDialog.integrationTokens === void 0 ? {} : { integrationTokens: settingsDialog.integrationTokens },
 					...settingsDialog.skills === void 0 ? {} : { skills: settingsDialog.skills }
 				}),
 				/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("main", {
@@ -57045,6 +59266,8 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 .dsh-qa-admin__panel h2{margin:0;font-size:15px}
 .dsh-qa-admin__panel h3{margin:14px 0 6px;font-size:13px;color:var(--dsw-alias-label-secondary)}
 .dsh-qa-admin__panel-head{display:flex;align-items:center;justify-content:space-between;gap:12px}
+.dsh-qa-admin__panel-note{margin:0;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:17px}
+.dsh-qa-admin__notice{margin:0;color:var(--dsh-qa-success);font-size:12px;line-height:17px}
 .dsh-qa-admin__columns{display:grid;grid-template-columns:minmax(0,360px) minmax(0,1fr);gap:18px;align-items:start}
 .dsh-qa-admin__metrics{display:grid;grid-template-columns:repeat(auto-fit,minmax(190px,1fr));gap:12px}
 .dsh-qa-admin__metric{display:flex;flex-direction:column;gap:2px;padding:14px 16px;border:1px solid var(--dsw-alias-border-l2);border-radius:12px;background:var(--dsw-alias-bg-layer-3)}
@@ -57335,6 +59558,12 @@ body[data-dsh-qa-surface="active"] div:has(>[data-shell-overlay])>:not([data-she
 .dsh-qa-auth__submit:hover{background:var(--dsh-qa-accent-hover)}
 .dsh-qa-auth__submit:focus-visible{outline:2px solid var(--dsh-qa-accent);outline-offset:2px}
 .dsh-qa-auth__submit:disabled{opacity:.6;cursor:default}
+.dsh-qa-auth__lead{margin:0;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:17px}
+.dsh-qa-auth__notice{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:17px}
+.dsh-qa-auth__link{appearance:none;padding:0;border:0;background:0 0;color:var(--dsw-alias-label-secondary);font:inherit;font-size:12px;line-height:17px;text-align:center;text-decoration:underline;cursor:pointer}
+.dsh-qa-auth__link:hover{color:var(--dsw-alias-label-primary)}
+.dsh-qa-auth__link:focus-visible{outline:2px solid var(--dsh-qa-accent);outline-offset:2px}
+.dsh-qa-auth__link:disabled{opacity:.6;cursor:default}
 .dsh-qa-crash{align-items:center;justify-content:center;padding:24px}
 .dsh-qa-crash__card{display:flex;flex-direction:column;gap:12px;width:min(380px,100%);padding:28px;border:1px solid var(--dsw-alias-border-l2);border-radius:14px;background:var(--dsw-alias-bg-layer-2);box-shadow:0 18px 48px var(--dsh-qa-overlay);text-align:center}
 .dsh-qa-crash__card h1{margin:0;color:var(--dsw-alias-label-primary);font-size:19px;font-weight:600;line-height:26px}
@@ -57394,6 +59623,8 @@ body[data-dsh-qa-surface="active"] div:has(>[data-shell-overlay])>:not([data-she
 .dsh-qa-settings__field input,.dsh-qa-settings__field textarea{appearance:none;width:100%;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:9px;background:var(--dsw-alias-bg-base);color:var(--dsw-alias-label-primary);font:inherit;font-size:14px;line-height:20px}
 .dsh-qa-settings__field textarea{min-height:64px;line-height:19px;resize:vertical}
 .dsh-qa-settings__field input:focus,.dsh-qa-settings__field textarea:focus{outline:none;border-color:var(--dsh-qa-brand)}
+.dsh-qa-settings__field select{appearance:none;width:100%;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:9px;background:var(--dsw-alias-bg-base);color:var(--dsw-alias-label-primary);font:inherit;font-size:14px;line-height:20px}
+.dsh-qa-settings__field select:focus{outline:none;border-color:var(--dsh-qa-brand)}
 .dsh-qa-settings__field input:read-only{opacity:.6}
 .dsh-qa-settings__code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:13px;line-height:20px}
 .dsh-qa-settings__field-hint{margin:0;color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:17px}
@@ -57429,6 +59660,7 @@ body[data-dsh-qa-surface="active"] div:has(>[data-shell-overlay])>:not([data-she
 .dsh-qa-settings__row-title{color:var(--dsw-alias-label-primary);font-size:14px;font-weight:600;line-height:20px}
 .dsh-qa-settings__row-description{color:var(--dsw-alias-label-secondary);font-size:13px;line-height:19px}
 .dsh-qa-settings__row-meta{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:17px}
+.dsh-qa-settings__row-note{color:var(--dsh-qa-info,var(--dsw-alias-label-secondary));font-size:12px;line-height:17px}
 .dsh-qa-settings__row-warning{color:var(--dsh-qa-warning);font-size:12px;line-height:17px}
 .dsh-qa-settings__row-error{color:var(--dsh-qa-error);font-size:12px;line-height:17px}
 .dsh-qa-settings__chips{display:flex;flex-wrap:wrap;gap:6px;margin:0;padding:0;list-style:none}
@@ -58687,7 +60919,7 @@ ${QA_ROOT_STYLES}`;
 			const paths = [["attachments"]];
 			const modified = overriddenAny(props, paths);
 			const stored = attachments?.extensions;
-			const extensions = stored !== void 0 && stored.length > 0 ? stored : props.effective?.attachments.extensions ?? DEFAULT_QA_TEXT_EXTENSIONS;
+			const extensions = stored !== void 0 && stored.length > 0 ? stored : props.effective?.attachments.extensions ?? DEFAULT_QA_ATTACHMENT_EXTENSIONS;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Section, {
 				title: "Вложения",
 				modified,
@@ -58699,8 +60931,8 @@ ${QA_ROOT_STYLES}`;
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Toggle, {
 								checked: textFiles,
 								disabled,
-								label: "Текстовые файлы",
-								hint: "К изображениям можно прикладывать md, txt, log и другие текстовые файлы. Выключено — только изображения.",
+								label: "Файловые вложения",
+								hint: "К изображениям можно прикладывать файлы из списка расширений ниже — текстовые и документы. Выключено — только изображения.",
 								onChange: (value) => {
 									props.write(["attachments", "textFiles"], value);
 								}
@@ -58741,11 +60973,11 @@ ${QA_ROOT_STYLES}`;
 						]
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ListField, {
-						label: "Расширения текстовых файлов",
+						label: "Разрешённые расширения файлов",
 						value: extensions,
 						disabled: disabled || !textFiles,
-						placeholder: "md\\ntxt\\nlog",
-						hint: "По одному расширению на строку, без точки. Дополнительно принимается всё, что браузер помечает как text/*.",
+						placeholder: "md\\ntxt\\ndocx",
+						hint: "По одному расширению на строку, без точки: текстовые файлы и документы, которые стенд умеет читать (docx, pdf). Дополнительно принимается всё, что браузер помечает как text/*.",
 						parse: parseCommaList,
 						onCommit: (values) => {
 							props.write(["attachments", "extensions"], values);
@@ -58753,7 +60985,7 @@ ${QA_ROOT_STYLES}`;
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Notice, {
 						tone: "info",
-						children: "Файл сохраняется на сервере как есть, а в подсказке модели указывается путь к копии: содержимое читает инструмент чтения. Держите «read» в списке разрешённых инструментов, иначе вложение останется недоступным для модели."
+						children: "Файл сохраняется на сервере как есть, а в подсказке модели указывается путь к копии: текст читает инструмент чтения, документ — инструменты конвейера документов. Держите «read» (а для документов — инструменты документов) в списке разрешённых инструментов, иначе вложение останется недоступным для модели."
 					})
 				]
 			});
@@ -59210,9 +61442,11 @@ ${QA_ROOT_STYLES}`;
 		//#region src/client/settings/sections/notes.tsx
 		/**
 		* Model notes: the ambient plugin messages the injector writes into a QA chat
-		* (who the user is, the source-provenance rules, delegation naming). Each note
-		* has a switch and an optional wording override; an empty template keeps the
-		* built-in text, so the fields double as a wording editor and a mute switch.
+		* (who the user is, the source-provenance rules, delegation naming, which
+		* reader an attached document belongs to, where an answer should come from).
+		* Each note has a switch and an optional wording override; an empty template
+		* keeps the built-in text, so the fields double as a wording editor and a mute
+		* switch.
 		*/
 		const NOTE_PATHS = [
 			[
@@ -59249,6 +61483,26 @@ ${QA_ROOT_STYLES}`;
 				"notes",
 				"delegation",
 				"template"
+			],
+			[
+				"notes",
+				"documents",
+				"enabled"
+			],
+			[
+				"notes",
+				"documents",
+				"template"
+			],
+			[
+				"notes",
+				"sourcePriority",
+				"enabled"
+			],
+			[
+				"notes",
+				"sourcePriority",
+				"template"
 			]
 		];
 		/** The ambient notes the Host writes into QA chats as hidden user messages. */
@@ -59258,6 +61512,8 @@ ${QA_ROOT_STYLES}`;
 			const identity = config?.notes?.identity;
 			const sources = config?.notes?.sources;
 			const delegation = config?.notes?.delegation;
+			const documents = config?.notes?.documents;
+			const sourcePriority = config?.notes?.sourcePriority;
 			const paths = NOTE_PATHS;
 			const modified = overriddenAny(props, paths);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Section, {
@@ -59368,9 +61624,65 @@ ${QA_ROOT_STYLES}`;
 							], value);
 						}
 					}),
-					identity?.enabled === false && sources?.enabled === false && delegation?.enabled === false ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Notice, {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Toggle, {
+						label: "Документы во вложениях",
+						hint: "Напоминание читать приложенный документ Word или PDF конвейером документов (document_inspect, document_to_markdown), а не универсальным чтением файла: оно отказывает таким форматам как бинарным, и отказ читается как «файла нет».",
+						checked: documents?.enabled ?? true,
+						disabled,
+						onChange: (checked) => {
+							props.write([
+								"notes",
+								"documents",
+								"enabled"
+							], checked);
+						}
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
+						label: "Формулировка заметки о документах",
+						value: documents?.template ?? "",
+						disabled,
+						multiline: true,
+						rows: 4,
+						hint: "Пусто — встроенный текст. Выключите заметку, если на стенде нет конвейера документов.",
+						onChange: (value) => {
+							props.write([
+								"notes",
+								"documents",
+								"template"
+							], value);
+						}
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Toggle, {
+						label: "Приоритет источников",
+						hint: "Напоминание отвечать из того источника, который владеет вопросом: вложения и документация раньше памяти. Срабатывает там, где скилл плагина памяти не активировался.",
+						checked: sourcePriority?.enabled ?? true,
+						disabled,
+						onChange: (checked) => {
+							props.write([
+								"notes",
+								"sourcePriority",
+								"enabled"
+							], checked);
+						}
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TextField, {
+						label: "Формулировка заметки о приоритете источников",
+						value: sourcePriority?.template ?? "",
+						disabled,
+						multiline: true,
+						rows: 4,
+						hint: "Пусто — встроенный текст.",
+						onChange: (value) => {
+							props.write([
+								"notes",
+								"sourcePriority",
+								"template"
+							], value);
+						}
+					}),
+					identity?.enabled === false && sources?.enabled === false && delegation?.enabled === false && documents?.enabled === false && sourcePriority?.enabled === false ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Notice, {
 						tone: "warn",
-						children: "Все заметки выключены: новые чаты не получат ни контекста о пользователе, ни правил источников, ни имён делегаций."
+						children: "Все заметки выключены: новые чаты не получат ни контекста о пользователе, ни правил источников, ни имён делегаций, ни маршрутизации документов, ни напоминания о приоритете источников."
 					}) : null
 				]
 			});
@@ -60840,6 +63152,8 @@ textarea.qa-card-control{height:auto;padding:8px 12px;line-height:1.5;resize:ver
 					users: (token, query, cursor, limit) => policyRemote.adminUsers(token, query, cursor, limit),
 					user: (token, userId) => policyRemote.adminUser(token, userId),
 					updateUser: (token, userId, update) => policyRemote.adminUpdateUser(token, userId, update),
+					passwordResetRequests: (token) => policyRemote.adminPasswordResetRequests(token),
+					resetPassword: (token, userId, password) => policyRemote.adminResetPassword(token, userId, password),
 					conversations: (token, query, cursor, limit) => policyRemote.adminConversations(token, query, cursor, limit),
 					conversation: (token, conversationId) => policyRemote.adminConversation(token, conversationId),
 					deleteConversation: (token, conversationId) => policyRemote.adminDeleteConversation(token, conversationId),
@@ -60849,7 +63163,22 @@ textarea.qa-card-control{height:auto;padding:8px 12px;line-height:1.5;resize:ver
 					queueConversation: (token, conversationId, messageId) => policyRemote.adminQueueConversation(token, conversationId, messageId),
 					saveReview: (token, input) => policyRemote.adminSaveReview(token, input),
 					metrics: (token) => policyRemote.adminMetrics(token),
-					audit: (token, query, cursor, limit) => policyRemote.adminAudit(token, query, cursor, limit)
+					audit: (token, query, cursor, limit) => policyRemote.adminAudit(token, query, cursor, limit),
+					skills: (token, scope) => policyRemote.adminSkills(token, scope),
+					skill: (token, scope, name) => policyRemote.adminSkill(token, scope, name),
+					saveSkill: (token, scope, name, input) => policyRemote.adminSkillSave(token, scope, name, input),
+					deleteSkill: (token, scope, name, expectedRevision) => policyRemote.adminSkillDelete(token, scope, name, expectedRevision),
+					validateSkill: (token, scope, name, input) => policyRemote.adminSkillValidate(token, scope, name, input),
+					skillTools: async (token, scope) => {
+						const result = await policyRemote.adminSkillTools(token, scope);
+						return result.ok ? {
+							ok: true,
+							value: result.value.tools
+						} : {
+							ok: false,
+							error: result.error
+						};
+					}
 				};
 				const sourceApi = {
 					sources: (token, sessionId) => policyRemote.sources(token, sessionId),