@yadsh/dsh-qa-surface 0.13.0 → 0.14.0

package/lib/types/client/settings-extensions/user-session.d.ts

@@ -3,7 +3,7 @@ import type { QaAccountsController } from "../QaAccountsController.js";
  * The signed-in QA account, as a client service.
  *
  * A QA panel plugin receives the account token through its panel props. A card
- * mounted in the host's own settings (`settings.plugin.item`) has no panel to
+ * seated on the Host's Plugins panel (`plugins.row.config`) has no panel to
  * read it from, so this service is the one place such a surface asks whether a
  * QA account is signed in and obtains the bearer credential the
  * principal-scoped QA remotes authorize with.

package/lib/types/client/theme-preference.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The palette the surface paints with. The Host owns the same three
+ * preferences and applies the one it stores; its settings surface is not
+ * reachable from `/qa` — the overlay suppresses the native shell, and the
+ * kiosk never mounts it — so the QA page carries its own choice.
+ *
+ * The choice is browser-local on purpose: it is written to this deployment's
+ * localStorage namespace, never to the Host user-settings document, because a
+ * stand is shared by everyone who opens it and one visitor's eyes are not a
+ * deployment setting.
+ */
+/** The preferences the control offers — the same vocabulary the Host uses. */
+export declare const QA_THEME_PREFERENCES: readonly ["light", "dark", "system"];
+export type QaThemePreference = (typeof QA_THEME_PREFERENCES)[number];
+/** Body attribute that selects the dark palette in the Host token sheet. */
+export declare const QA_DARK_THEME_ATTRIBUTE = "data-ds-dark-theme";
+/** `light`/`dark` are themselves; `system` is whatever the OS asks for. */
+export declare function resolveQaThemeScheme(preference: QaThemePreference, systemDark: boolean): "light" | "dark";
+/** The stored choice, or null when this browser never picked one. */
+export declare function readQaThemePreference(storage: Pick<Storage, "getItem">, key: string): QaThemePreference | null;
+export declare function writeQaThemePreference(storage: Pick<Storage, "setItem">, key: string, preference: QaThemePreference): void;
+/**
+ * What the control shows while this browser has no choice of its own: the
+ * palette the document is already painted with, read through the Host's own
+ * contract. The Host publishes its *preference* nowhere in the DOM — only the
+ * resolved palette — so an untouched stand is reported as the palette it
+ * shows, never as a preference this browser did not pick.
+ */
+export declare function readQaThemeScheme(target: Pick<QaThemeDocument, "body">): Exclude<QaThemePreference, "system">;
+/** The two document nodes the palette hangs on, injectable for tests. */
+export interface QaThemeDocument {
+    readonly documentElement: {
+        style: {
+            colorScheme: string;
+        };
+    };
+    readonly body: {
+        hasAttribute: (name: string) => boolean;
+        setAttribute: (name: string, value: string) => void;
+        removeAttribute: (name: string) => void;
+    };
+}
+/**
+ * Project one preference onto the document, writing exactly the two fields the
+ * Host's own presenter owns for the same choice: the native-chrome scheme on
+ * the root and the palette attribute on the body. Nothing else — the font-size
+ * axis and the theme token overrides stay the Host's.
+ */
+export declare function applyQaThemePreference(target: QaThemeDocument, preference: QaThemePreference, systemDark: boolean): void;
+export interface QaThemePreferenceState {
+    /** The choice this browser owns, or the palette it is looking at. */
+    readonly preference: QaThemePreference;
+    readonly select: (preference: QaThemePreference) => void;
+}
+export interface UseQaThemePreferenceOptions {
+    /** Whether the surface is what the visitor is looking at right now. */
+    readonly active: boolean;
+    readonly storage: Pick<Storage, "getItem" | "setItem">;
+    readonly storageKey: string;
+}
+/**
+ * Own the palette for as long as the surface is what the visitor sees, and only
+ * for as long as this browser actually asked for one: an explicit choice is
+ * written to storage and projected onto the document, `system` keeps answering
+ * the OS, and a visitor who never touches the control leaves the Host's own
+ * palette in force — the surface writes nothing at all in that case.
+ */
+export declare function useQaThemePreference({ active, storage, storageKey, }: UseQaThemePreferenceOptions): QaThemePreferenceState;
+//# sourceMappingURL=theme-preference.d.ts.map

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaIssuedServiceToken, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaWorkspaceFile, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminSkillScope, QaAdminSkillsView, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
+import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaIssuedServiceToken, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaWorkspaceFile, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminSkillScope, QaAdminSkillsView, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -30,6 +30,12 @@ export type QaSecureSession = (token: string, sessionId: string) => Promise<{
 }>;
 /** Host-authoritative creation: identity, cwd and policy never come from the browser. */
 export type QaCreateSession = (token: string, subroleId: string | null, adminPreview: boolean) => Promise<RemoteResult<string>>;
+/**
+ * The Host's live read of the request ceiling (`qaSurface/queueStatus`), asked
+ * per send: how many questions the stand is answering and whether one more
+ * fits.
+ */
+export type QaQueueStatusRemote = () => Promise<RemoteResult<QaQueueStatus>>;
 /** Role selector plus administrator mutation channel. */
 export interface QaAccessApi {
     current(token: string): Promise<RemoteResult<QaCurrentAccess>>;
@@ -100,6 +106,18 @@ export interface QaAdminApi {
     deleteSkill(token: string, scope: QaAdminSkillScope, name: string, expectedRevision: string | null): Promise<RemoteResult<QaSkillRemoval>>;
     validateSkill(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<RemoteResult<QaSkillValidation>>;
     skillTools(token: string, scope: QaAdminSkillScope): Promise<RemoteResult<readonly QaSkillToolDescriptor[]>>;
+    /**
+     * What the domain experts remembered.
+     *
+     * The namespaces come from the experts' own definitions, so a namespace the
+     * console can list is one an expert claims; `memory.read` opens the list and
+     * `memory.manage` the corrections.
+     */
+    memoryScopes(token: string): Promise<RemoteResult<readonly QaExpertMemoryScope[]>>;
+    memoryRecords(token: string, namespace: string, query: string, limit: number | null, offset: number): Promise<RemoteResult<QaExpertMemoryPage>>;
+    correctMemory(token: string, namespace: string, key: string, draft: QaExpertMemoryDraft): Promise<RemoteResult<QaExpertMemoryRecord>>;
+    forgetMemory(token: string, namespace: string, keys: readonly string[]): Promise<RemoteResult<number>>;
+    wipeMemory(token: string, namespace: string, expectedRecords: number | null): Promise<RemoteResult<number>>;
 }
 /**
  * Browser file-upload service (`ctx.fileUpload`), described structurally on
@@ -333,6 +351,12 @@ export interface QaAccountsApi {
     accountsUpdateProfile(token: string, input: QaAccountProfileInput): Promise<RemoteResult<QaAccountUserPublic>>;
     /** Replace the caller's own starter buttons; the token is the identity. */
     accountsUpdateStarters(token: string, input: QaAccountStartersInput): Promise<RemoteResult<QaAccountUserPublic>>;
+    /**
+     * Replace the caller's own notification channels; the token is the identity.
+     * The stand's switches are applied when a notice is planned, not here, so
+     * this write can only ever narrow what the deployment allows.
+     */
+    accountsUpdateNotifications(token: string, input: QaAccountNotificationsInput): Promise<RemoteResult<QaAccountUserPublic>>;
     /**
      * Replace the caller's own password. The answer carries a fresh token: the
      * write bumps the account's token version, so without it the browser that

package/lib/types/client/use-session-ui-state.d.ts

@@ -33,9 +33,11 @@ export interface QaSessionUiState {
 }
 /**
  * Per-chat UI state: composer attachments, variant offsets, the rail mark and
- * the drawers. Everything here describes the chat it was made in, so a
- * session change clears it instead of leaking a draft, an attachment or a
- * drawer from one conversation into the next.
+ * the drawers. Everything here describes the chat it was made in, so a chat
+ * change clears it instead of leaking a draft, an attachment or a drawer from
+ * one conversation into the next. The key is the surface's chat identity, not
+ * the session id: a new chat only creates its session on the first prompt, and
+ * the attachments of that prompt must survive the hand-off.
  */
-export declare function useSessionUiState(sessionId: string | null): QaSessionUiState;
+export declare function useSessionUiState(chatKey: number): QaSessionUiState;
 //# sourceMappingURL=use-session-ui-state.d.ts.map

package/lib/types/client/user-settings/GeneralSettingsPage.d.ts

@@ -5,11 +5,11 @@ export interface QaGeneralSettingsPageProps {
 }
 /**
  * Placeholder with a purpose: the section exists so the dialog has a home for
- * the user-scoped preferences that follow (notifications, privacy), and so the
- * thing it must not become is written down — deployment and chat policy live in
- * the Host settings, not here. It shows the account facts a user can act on
- * today and nothing invented, and it names only what is still missing: a
- * preference that already has its own tab does not belong on this list.
+ * the user-scoped preferences that follow (privacy), and so the thing it must
+ * not become is written down — deployment and chat policy live in the Host
+ * settings, not here. It shows the account facts a user can act on today and
+ * nothing invented, and it names only what is still missing: a preference that
+ * already has its own tab does not belong on this list.
  */
 export declare function QaGeneralSettingsPage(props: QaGeneralSettingsPageProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=GeneralSettingsPage.d.ts.map

package/lib/types/client/user-settings/NotificationSettingsPage.d.ts

@@ -0,0 +1,40 @@
+import type { QaAccountNotifications, QaAccountNotificationsInput, ResolvedQaSurfaceConfig } from "../../types.js";
+export interface QaNotificationSettingsPageProps {
+    /** The channels this account has chosen. */
+    readonly notifications: QaAccountNotifications;
+    /** `config.notifications`: what the stand allows whatever the reader picks. */
+    readonly switches: ResolvedQaSurfaceConfig["notifications"];
+    /** Persist the edited pair; resolves to refusal copy, or null. */
+    readonly onSave: (input: QaAccountNotificationsInput) => Promise<string | null>;
+}
+export declare const QA_NOTIFICATION_SETTINGS_COPY: Readonly<{
+    title: "Уведомления";
+    lead: "Напоминание о завершённом ходе доходит до вас, даже когда вы читаете другой чат.";
+    inApp: "Строка «Ход завершён» на странице";
+    inAppHint: "Появляется, когда ход закончился в чате, который вы сейчас не читаете; клик открывает его.";
+    desktop: "Системные уведомления";
+    desktopHint: "Приходят, когда эта вкладка свёрнута или закрыта другим окном. В самом чате, который открыт перед вами, ничего не появляется.";
+    offOnStand: "Уведомления о завершённых ходах выключены на этом стенде администратором.";
+    desktopOffOnStand: "Системные уведомления выключены на этом стенде: строка на странице остаётся.";
+    unsupported: "Браузер этого устройства не умеет системные уведомления: напоминание останется на странице.";
+    denied: "Браузер запретил уведомления для этого адреса. Разрешите их в его собственных настройках — до этого напоминание останется только на странице.";
+    askAction: "Разрешить в браузере";
+    askHint: "Браузер спросит разрешение один раз, по этому нажатию; больше вопрос не вернётся.";
+    granted: "Браузер разрешил уведомления для этого адреса.";
+    saved: "Настройки уведомлений сохранены.";
+}>;
+/**
+ * The signed-in reader's own answer about the channels a finished turn may use.
+ *
+ * Two switches, because that is how many the feature has: the line inside the
+ * page and the notice the page hands to the operating system. What the stand
+ * allows is a third voice over each of them and is shown rather than hidden —
+ * a control that silently does nothing reads as a bug, and the reader is the
+ * one person who should not have to guess whose decision it was.
+ *
+ * Same full-replace contract as the starters form: the pair is seeded from the
+ * stored record whenever that record changes, so a write from another tab never
+ * leaves a stale edit on screen.
+ */
+export declare function QaNotificationSettingsPage(props: QaNotificationSettingsPageProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=NotificationSettingsPage.d.ts.map

package/lib/types/client/user-settings/UserSettingsDialog.d.ts

@@ -1,8 +1,8 @@
-import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountStarters, QaAccountStartersInput } from "../../types.js";
+import type { QaAccountIdentityField, QaAccountNotifications, QaAccountNotificationsInput, QaAccountProfile, QaAccountProfileInput, QaAccountStarters, QaAccountStartersInput, ResolvedQaSurfaceConfig } from "../../types.js";
 import type { QaBoundSkillApi, QaIntegrationTokenApi } from "../types.js";
 import type { QaUserSettingsSections } from "../settings-extensions/index.js";
 /** Sections of the user-facing settings dialog. */
-export type QaSettingsSectionId = "profile" | "password" | "starters" | "tokens" | "general" | "skills" | (string & {});
+export type QaSettingsSectionId = "profile" | "password" | "starters" | "notifications" | "tokens" | "general" | "skills" | (string & {});
 export interface QaUserSettingsDialogProps {
     readonly open: boolean;
     /** Section to show when the dialog opens. */
@@ -30,6 +30,16 @@ export interface QaUserSettingsDialogProps {
         readonly starters: QaAccountStarters;
         readonly onSave: (input: QaAccountStartersInput) => Promise<string | null>;
     };
+    /**
+     * Self-service notification channels. Absent only where there is no account
+     * to hold the choice: an anonymous stand keeps its mute switch in the
+     * browser, and the notices read it from there.
+     */
+    readonly notifications?: {
+        readonly notifications: QaAccountNotifications;
+        readonly switches: ResolvedQaSurfaceConfig["notifications"];
+        readonly onSave: (input: QaAccountNotificationsInput) => Promise<string | null>;
+    };
     /** Integration tokens; absent when accounts are off altogether. */
     readonly integrationTokens?: QaIntegrationTokenApi;
     /** Personal skills; absent when the deployment cannot host them. */

package/lib/types/client/user-settings/draft.d.ts

@@ -38,7 +38,10 @@ export interface QaSkillDraftDiagnostics {
 export declare function draftDiagnostics(draft: QaSkillDraft, options: QaSkillDraftDiagnostics): readonly QaSkillDiagnostic[];
 /** Whether the draft is complete enough to send. */
 export declare function draftIsSavable(draft: QaSkillDraft): boolean;
-export declare function draftInput(draft: QaSkillDraft, revision: string | null): QaSkillDraftInput;
+export declare function draftInput(draft: QaSkillDraft, revision: string | null, options?: {
+    /** Say so when saving over a file the Host could not read whole. */
+    readonly confirmPartialOverwrite?: boolean;
+}): QaSkillDraftInput;
 /** The terse line under a catalog row: invocation, command, tool count. */
 export declare function skillMetaLine(skill: QaSkillSummary): string;
 /** Tools the catalog cannot use right now, as the row's warning text. */

package/lib/types/client/user-settings/fields.d.ts

@@ -7,6 +7,8 @@ import type { ReactNode } from "react";
  * the deployment settings.
  */
 export interface QaSettingsFieldProps {
+    /** Handle this instance is addressed by from a browser run. */
+    readonly testId: string;
     readonly label: string;
     /** Secondary line under the control; not part of the field's name. */
     readonly hint?: string;
@@ -14,11 +16,13 @@ export interface QaSettingsFieldProps {
 }
 export declare function QaSettingsField(props: QaSettingsFieldProps): import("react/jsx-runtime").JSX.Element;
 export declare function QaSettingsSection(props: {
+    readonly testId: string;
     readonly title: string;
     readonly aside?: ReactNode;
     readonly children: ReactNode;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function QaSettingsToggle(props: {
+    readonly testId: string;
     readonly label: string;
     readonly checked: boolean;
     readonly disabled?: boolean;
@@ -26,6 +30,7 @@ export declare function QaSettingsToggle(props: {
     readonly onChange: (checked: boolean) => void;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function QaSettingsNotice(props: {
+    readonly testId: string;
     readonly tone: "info" | "warn" | "error";
     readonly children: ReactNode;
 }): import("react/jsx-runtime").JSX.Element;
@@ -33,6 +38,8 @@ export declare function QaSettingsActions(props: {
     readonly children: ReactNode;
 }): import("react/jsx-runtime").JSX.Element;
 export declare function QaSettingsButton(props: {
+    /** Omitted for a button the settings dialog does not own, such as the sidebar's. */
+    readonly testId?: string;
     readonly label: string;
     readonly tone?: "primary" | "plain" | "danger";
     readonly type?: "button" | "submit";

package/lib/types/config-resolvers/notifications.d.ts

@@ -0,0 +1,10 @@
+import type { QaSurfaceConfig, ResolvedQaSurfaceConfig } from "../types.js";
+type NotificationsSlice = ResolvedQaSurfaceConfig["notifications"];
+/**
+ * Resolve the notification domain: the deployment's two switches over the
+ * notices a finished turn may raise. Which chats a notice is allowed to speak
+ * about is not a configuration question — it is the browser's own chat list.
+ */
+export declare function resolveNotifications(input: QaSurfaceConfig): NotificationsSlice;
+export {};
+//# sourceMappingURL=notifications.d.ts.map

package/lib/types/config-resolvers/session.d.ts

@@ -1,5 +1,11 @@
 import type { QaSurfaceConfig, ResolvedQaSurfaceConfig } from "../types.js";
 type SessionSlice = ResolvedQaSurfaceConfig["session"];
+/**
+ * Ceiling of `session.maxActiveRequests`. The floor is 0 — "no ceiling" — and
+ * the cap only keeps a mistyped value from becoming a silently meaningless
+ * one: a stand that answers sixty chat turns at once has no queue to configure.
+ */
+export declare const QA_MAX_ACTIVE_REQUESTS_MAX = 50;
 /** Resolve the session domain: policy, pinning, and model selection. */
 export declare function resolveSession(input: QaSurfaceConfig): SessionSlice;
 export {};

package/lib/types/config.d.ts

@@ -1,3 +1,4 @@
+import type { Volatile } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
 import type { QaSurfaceConfig } from "./types.js";
 /**
@@ -10,6 +11,24 @@ import type { QaSurfaceConfig } from "./types.js";
  * `../package.json` resolves at.
  */
 export declare function qaSurfaceVersion(): string;
-export declare const ConfigSchema: z<QaSurfaceConfig>;
+/**
+ * Every top-level field of {@link QaSurfaceConfig}, as the Host delivers it.
+ *
+ * A field whose schema node carries `.volatile()` arrives as a stable reference
+ * whose snapshot the Host swaps in place, so a plugin keeps one reference for
+ * its whole lifetime and reads the current value through it.
+ */
+export type QaSurfaceConfigRefs = {
+    readonly [K in keyof Required<QaSurfaceConfig>]: Volatile<NonNullable<QaSurfaceConfig[K]>>;
+};
+/**
+ * Fold one Host-delivered Config into the plain data `resolveConfig` reads.
+ *
+ * The schema mints a volatile reference for every field it declares volatile, so
+ * the object the plugin is constructed with carries references and each read
+ * here answers with the value the Host currently holds.
+ */
+export declare function readConfigRefs(config: Partial<QaSurfaceConfigRefs>): QaSurfaceConfig;
+export declare const ConfigSchema: z<QaSurfaceConfigRefs>;
 export { DEFAULT_QA_SURFACE_CONFIG, normalizeRoutePath, resolveConfig, } from "./resolve-config.js";
 //# sourceMappingURL=config.d.ts.map

package/lib/types/index.d.ts

@@ -1,12 +1,14 @@
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
+import type { QaSurfaceConfigRefs } from "./config.js";
+import type { QaAccountNotificationsInput } from "./types.js";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaIssuedServiceToken, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaAdminSkillScope, QaAdminSkillsView, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackHarvestEntry, QaFeedbackHarvestResult, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaIssuedServiceToken, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig, QaAdminSkillScope, QaAdminSkillsView, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackHarvestEntry, QaFeedbackHarvestResult, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
 export { QA_SURFACE_SETTINGS_NAMESPACE };
-export declare const Config: import("@deepseek-ai/schemastery").default<QaSurfaceConfig>;
+export declare const Config: import("@deepseek-ai/schemastery").default<QaSurfaceConfigRefs>;
 declare module "@deepseek-ai/cordis" {
     interface Context {
         qaSurface: QaSurface;
@@ -15,8 +17,8 @@ declare module "@deepseek-ai/cordis" {
 /** Host companion: validates config, owns the admission boundary and the route. */
 export declare class QaSurface extends TypertRemoteService {
     static inject: string[];
-    static Config: import("@deepseek-ai/schemastery").default<QaSurfaceConfig>;
-    private source;
+    static Config: import("@deepseek-ai/schemastery").default<QaSurfaceConfigRefs>;
+    private readonly source;
     private readonly logger;
     private readonly admission;
     private readonly approvals;
@@ -64,7 +66,7 @@ export declare class QaSurface extends TypertRemoteService {
      * opens the admin console never grows one.
      */
     private qualityStore;
-    constructor(ctx: Context, entry?: QaSurfaceConfig);
+    constructor(ctx: Context, entry?: Partial<QaSurfaceConfigRefs>);
     /** The quality store, opening its file the first time anyone needs it. */
     private quality;
     /**
@@ -75,6 +77,9 @@ export declare class QaSurface extends TypertRemoteService {
      * the preset composes it but starts no agent, no session and no turn;
      * without a pinned preset there is nothing to borrow, and the read stays
      * global.
+     *
+     * The registry answers with a lease on one preset revision, so the scope is
+     * handed to the caller that reads with it and released when that read ends.
      */
     private qaPresetScope;
     /**
@@ -157,6 +162,13 @@ export declare class QaSurface extends TypertRemoteService {
      * deployment's limits are enforced in the store before anything is written.
      */
     accountsUpdateStarters(token: string, input: QaAccountStartersInput): QaAccountUserPublic;
+    /**
+     * Replace the caller's own notification channels. The account the token
+     * authenticates is the only one editable, and the answer is the whole public
+     * record, so the settings form re-reads what the stand now holds rather than
+     * what it meant to send.
+     */
+    accountsUpdateNotifications(token: string, input: QaAccountNotificationsInput): QaAccountUserPublic;
     /**
      * The caller's own integration tokens. The list is the account's own: the
      * token names it, and a secret is never part of a summary, so reading this
@@ -188,6 +200,20 @@ export declare class QaSurface extends TypertRemoteService {
      * boundary stays in {@link secureSession}.
      */
     describe(): ResolvedQaSurfaceConfig;
+    /**
+     * Report how much of the deployment's request ceiling the stand is using, so
+     * a browser holds its question back instead of opening another turn on a
+     * model that is busy answering the ones it allows.
+     *
+     * The count is the Host's, not the browser's: a visitor cannot see another
+     * account's chats, and the HTTP API's questions are invisible to every chat
+     * view. Read-only, and a ceiling rather than a lock — a prompt rides the
+     * native session RPC this plugin does not own, so the boundary is the
+     * browser's own courtesy, and two questions sent in the same instant can
+     * still overshoot by one. What the ceiling buys is that steady state, not a
+     * strict bound.
+     */
+    queueStatus(): QaQueueStatus;
     /**
      * Create a QA session from Host-owned inputs. With account workspaces on,
      * cwd is `<configured workspace>/.qa-users/<account UUID>` and the child is
@@ -232,6 +258,28 @@ export declare class QaSurface extends TypertRemoteService {
     adminSkillTools(token: string, scope: QaAdminSkillScope): Promise<{
         readonly tools: readonly QaSkillToolDescriptor[];
     }>;
+    /**
+     * Which experts hold memory, and how much.
+     *
+     * Reads the domain-experts service on the host plane rather than its remotes:
+     * those answer a trusted in-Harness caller and check no token, while this
+     * console answers a browser, so the permission check lives here.
+     */
+    adminMemoryScopes(token: string): Promise<readonly QaExpertMemoryScope[]>;
+    /** One page of one namespace, newest first, with the filter's match count. */
+    adminMemoryRecords(token: string, namespace: string, query: string, limit: number | null, offset: number): Promise<QaExpertMemoryPage>;
+    /** Rewrite one remembered line; the audit trail keeps both images. */
+    adminMemoryCorrect(token: string, namespace: string, key: string, draft: QaExpertMemoryDraft): Promise<QaExpertMemoryRecord>;
+    /** Drop one or several remembered lines of one namespace. */
+    adminMemoryForget(token: string, namespace: string, keys: readonly string[]): Promise<number>;
+    /**
+     * Empty one namespace, confirming the count the operator was shown.
+     *
+     * The check is the console's, not the store's: what the operator clicked was
+     * a number on a screen, and memory an expert wrote in the meantime is not
+     * memory they agreed to erase.
+     */
+    adminMemoryWipe(token: string, namespace: string, expectedRecords: number | null): Promise<number>;
     /**
      * Counters, attention lines and the newest quality signals.
      *

package/lib/types/integration/answer.d.ts

@@ -20,6 +20,15 @@ export interface QaTurnAnswer {
     /** Durable seq of the message the answer came from, when there was one. */
     readonly seq: number | null;
 }
+/** One request's answer, additionally attributed to the turn it came from. */
+export interface QaRequestAnswer extends QaTurnAnswer {
+    /**
+     * The harness turn number the answer was read out of, or null when the log
+     * named no turn for the request's own row. The provenance bundle of a turn is
+     * the evidence of its answer, so the caller cites the same number.
+     */
+    readonly turn: number | null;
+}
 /** The empty answer: what a turn that committed nothing readable looks like. */
 export declare const QA_EMPTY_ANSWER: QaTurnAnswer;
 /**
@@ -35,6 +44,24 @@ export declare const QA_EMPTY_ANSWER: QaTurnAnswer;
  * @returns the publishable answer and whether the turn was interrupted.
  */
 export declare function answerAfter(events: readonly StoredSessionEvent[], afterSeq: number): QaTurnAnswer;
+/**
+ * Project the answer of the turn one request's own prompt opened.
+ *
+ * The harness stamps the prompt's rpc id onto the durable user row it claims,
+ * so the row is found by id rather than guessed from the newest human message:
+ * two questions in flight on one chat open two turns, and a selection by
+ * "latest" answers each caller with the other's turn. The turn that answers a
+ * request is the one its row was claimed into — `turn/start` opens a turn and
+ * the claimed rows follow it — so the answer is read out of that turn's
+ * assistant messages only, and its number travels with it for the citation.
+ *
+ * @param events - durable events, in any order.
+ * @param requestId - the rpc id the prompt was submitted with.
+ * @returns the answer of this request's turn, or `undefined` when the log
+ * holds no row for the request (an unflushed prompt, or a harness that does not
+ * echo the id), which leaves the choice of cursor to the caller.
+ */
+export declare function answerForRequest(events: readonly StoredSessionEvent[], requestId: string): QaRequestAnswer | undefined;
 /**
  * Cut an answer down to the size the caller publishes.
  *

package/lib/types/integration/expert-memory.d.ts

@@ -0,0 +1,49 @@
+import type { QaExpertMemoryRecord, QaExpertMemoryScope } from "../types.js";
+/**
+ * The slice of `@yadsh/dsh-domain-experts` the QA console uses.
+ *
+ * Declared structurally instead of imported, for the same reason the audit
+ * remote is: the QA surface has to load on a stand where the experts plugin is
+ * not composed at all, and a package dependency would turn "not installed" into
+ * "does not boot".
+ *
+ * What is reached is the plugin's `memoryAdmin` seam — not its `@Remote`
+ * methods. A domain-experts remote takes no token and checks no permission,
+ * because inside the Harness its caller is already a trusted component; the QA
+ * console answers a browser on a LAN port, so it carries the identity itself
+ * and goes through the host-plane seam instead.
+ */
+export interface QaExpertMemoryAdmin {
+    scopes(): Promise<readonly QaExpertMemoryScope[]>;
+    search(namespace: string, query: string, limit: number, offset: number): Promise<{
+        readonly records: readonly QaExpertMemoryRecord[];
+        readonly total: number;
+    }>;
+    correct(input: QaExpertMemoryRecordInput): Promise<QaExpertMemoryRecord>;
+    remove(namespace: string, key: string): Promise<boolean>;
+    removeMany(namespace: string, keys: readonly string[]): Promise<number>;
+    wipe(namespace: string): Promise<number>;
+}
+/** What a correction says one record should hold. The key is the address. */
+export interface QaExpertMemoryRecordInput {
+    readonly namespace: string;
+    readonly key: string;
+    readonly text: string;
+    readonly tags?: readonly string[];
+}
+/** The part of the domain-experts service the console addresses. */
+export interface QaDomainExpertsFace {
+    readonly memoryAdmin: QaExpertMemoryAdmin;
+}
+/**
+ * Why a memory call failed, in the coarse vocabulary the console's copy table
+ * speaks.
+ *
+ * The refusal is read off the plugin's stable `code` field rather than its
+ * message: a message is written for a log and gets reworded, and matching one
+ * here would mean a rename in another package silently turns a refusal into an
+ * unhandled fault. `cause` is checked too, because the storage seam wraps what
+ * the backend threw.
+ */
+export declare function expertMemoryReasonOf(error: unknown): "forbidden" | "memory-record-unknown" | "memory-unavailable" | "invalid-memory" | undefined;
+//# sourceMappingURL=expert-memory.d.ts.map

package/lib/types/notifications.d.ts

@@ -0,0 +1,32 @@
+import type { QaAccountNotifications, QaAccountNotificationsInput } from "./types.js";
+/**
+ * What an account that never opened the notifications form gets.
+ *
+ * The in-page line is the shipped default of the feature itself, so an
+ * untouched account keeps behaving as it did before the form existed. The
+ * desktop channel stays off until asked for: raising an operating-system notice
+ * is the one choice that leaves the page, and a stand where the browser was
+ * never asked must not make it on the account's behalf.
+ */
+export declare function emptyNotifications(): QaAccountNotifications;
+/**
+ * Read one stored (or wire-delivered) notifications record into its public
+ * shape. Unknown or hand-edited input degrades to the readable subset rather
+ * than throwing, mirroring the starters read path: a malformed record must
+ * never cost the account its session.
+ */
+export declare function normalizeNotifications(value: unknown): QaAccountNotifications;
+export type QaNotificationsWriteResult = {
+    readonly ok: true;
+    readonly value: QaAccountNotificationsInput;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/**
+ * Validate one full-replace notifications write. Both channels are required: a
+ * payload that names only one would silently reset the other, and the form
+ * always sends the pair it was rendered with.
+ */
+export declare function validateNotificationsWrite(input: unknown): QaNotificationsWriteResult;
+//# sourceMappingURL=notifications.d.ts.map

package/lib/types/personal-skills/errors.d.ts

@@ -3,7 +3,7 @@
  * `(reason: <code>)` marker the account remotes established: the browser maps
  * them to audience-safe copy, while the precise cause stays in the Host log.
  */
-export type QaPersonalSkillErrorReason = "skills-disabled" | "workspace-unavailable" | "skill-not-found" | "skill-exists" | "skill-conflict" | "skill-name-invalid" | "skill-invalid" | "storage-unavailable";
+export type QaPersonalSkillErrorReason = "skills-disabled" | "workspace-unavailable" | "skill-not-found" | "skill-exists" | "skill-conflict" | "skill-truncated" | "skill-name-invalid" | "skill-invalid" | "storage-unavailable";
 export declare class QaPersonalSkillError extends Error {
     readonly reason: QaPersonalSkillErrorReason;
     constructor(reason: QaPersonalSkillErrorReason, message: string);

package/lib/types/personal-skills/service.d.ts

@@ -55,6 +55,12 @@ export interface QaStoredSkill {
     readonly contents: QaSkillFileContents | undefined;
     readonly diagnostics: readonly QaSkillDiagnostic[];
     readonly resourceCount: number;
+    /**
+     * True when `raw` is only the head of the file: an oversized `SKILL.md` is
+     * read up to the ceiling, and what follows it was never loaded. A write must
+     * not overwrite such a document without saying so out loud.
+     */
+    readonly truncated: boolean;
 }
 export interface QaPersonalSkillsOptions {
     readonly getConfig: () => ResolvedQaSurfaceConfig;