@yadsh/dsh-qa-surface 0.16.0 → 0.18.0

package/lib/types/account-remotes.d.ts

@@ -81,6 +81,9 @@ export interface QaAccountRemotes {
     revokeServiceToken(token: string, tokenId: string): {
         readonly revoked: boolean;
     };
+    setServiceTokenClarifications(token: string, tokenId: string, allowed: boolean): {
+        readonly updated: boolean;
+    };
 }
 /** Build the account-remotes context for one `QaSurface` service instance. */
 export declare function createQaAccountRemotes(options: {

package/lib/types/accounts/database.d.ts

@@ -13,6 +13,7 @@ interface PasswordResetRow {
  * nowhere else.
  */
 export interface StoredServiceToken {
+    readonly allowClarifications: boolean;
     readonly id: string;
     readonly userId: string;
     readonly label: string;
@@ -73,6 +74,14 @@ export declare class QaAccountsDatabase {
     insertUser(user: StoredUser): void;
     /** Replace one account's row in place. */
     updateUser(user: StoredUser): void;
+    oidcUserId(issuer: string, subject: string): string | undefined;
+    isOidcUser(userId: string): boolean;
+    /** Account creation and identity attachment must commit together. */
+    attachOidcIdentity(issuer: string, subject: string, user: StoredUser, create: boolean): void;
+    /** Re-read and update authentication facts under the same write transaction. */
+    authenticateOidc(userId: string, email: string, displayName: string, role: StoredUser["role"], sid: string, expiresAt: number): StoredUser | undefined;
+    oidcSessionActive(id: string, userId: string): boolean;
+    revokeOidcSession(id: string): void;
     /**
      * Record one forgotten-password request. A repeat from the same account
      * moves the row up the queue and counts up, so the console shows "asked
@@ -95,6 +104,10 @@ export declare class QaAccountsDatabase {
     deleteOwnership(sessionIds: readonly string[]): void;
     /** Record one freshly minted integration token (digest only, never a secret). */
     insertServiceToken(token: StoredServiceToken): void;
+    /** Store the authenticated token policy before admitting its request to the inbox. */
+    recordIntegrationRequestPolicy(sessionId: string, requestId: string, allowed: boolean): void;
+    integrationClarificationsAllowed(sessionId: string, requestId: string): boolean;
+    setServiceTokenClarifications(userId: string, tokenId: string, allowed: boolean): boolean;
     /**
      * One integration token by id, revoked and expired ones included.
      *

package/lib/types/accounts/file.d.ts

@@ -25,6 +25,8 @@ export interface StoredNotifications {
     desktop?: boolean;
 }
 export interface StoredUser {
+    /** Derived from the identity table when the database is loaded. */
+    readonly authMethod?: "oidc";
     readonly id: string;
     readonly email: string;
     readonly displayName: string;

package/lib/types/accounts/store.d.ts

@@ -6,6 +6,8 @@ export type { QaAccountsErrorReason } from "./errors.js";
 export { defaultAccountsFilePath } from "./file.js";
 export type { QaIssuedServiceToken, QaServiceTokenSummary } from "../types.js";
 export interface QaAccountsOptions {
+    readonly oidcEnabled?: boolean;
+    readonly localLogin?: boolean;
     readonly sessionTtlDays: number;
     readonly allowRegistration: boolean;
     /** Login/registration attempts accepted per rolling minute, store-wide. */
@@ -41,8 +43,9 @@ export interface QaSessionFacts {
 export interface QaServiceTokenIssueInput {
     /** A note for the operator's token list; empty becomes a generic label. */
     readonly label?: string;
-    /** Requested scopes; unknown ones are dropped, empty falls back to `ask`. */
+    /** Requested scopes; unknown ones are dropped, explicit empty grants none. */
     readonly scopes?: readonly string[];
+    readonly allowClarifications?: boolean;
     /** How long the token lives; bounded, and the session TTL when omitted. */
     readonly ttlDays?: number;
     /**
@@ -54,6 +57,7 @@ export interface QaServiceTokenIssueInput {
 }
 /** What a presented integration token resolved to. */
 export interface QaVerifiedServiceToken {
+    readonly allowClarifications: boolean;
     readonly tokenId: string;
     readonly userId: string;
     readonly scopes: readonly QaServiceTokenScope[];
@@ -83,6 +87,8 @@ export declare class QaAccounts {
     private readonly maxAuthAttemptsPerMinute;
     private readonly sessionTtlDays;
     private readonly allowRegistration;
+    private readonly oidcEnabled;
+    private readonly localLogin;
     /** Character cap on a stored profile's agent guidance. */
     private readonly instructionsMaxLength;
     /** Whether a deployment declares which identity handles an account may hold. */
@@ -124,6 +130,19 @@ export declare class QaAccounts {
     /** Resolve a token to its user, or null for absent/invalid/expired ones. */
     verifyToken(token: string): string | null;
     private mintToken;
+    /** Only the server OIDC verifier calls this with authenticated claims. */
+    loginOidc(identity: {
+        issuer: string;
+        subject: string;
+        email: string;
+        displayName: string;
+        role: QaAccountRole;
+        expiresAt: number;
+        autoProvision: boolean;
+    }): QaAccountSession;
+    /** Operator-confirmed attachment preserves ownership and revokes old credentials. */
+    linkOidcIdentity(email: string, issuer: string, subject: string): QaAccountUserPublic;
+    logoutOidc(token: string): boolean;
     /**
      * The account behind a token, or an auth-required refusal.
      *
@@ -421,6 +440,9 @@ export declare class QaAccounts {
      * @returns true when a live token was revoked.
      */
     revokeServiceToken(token: string, tokenId: string): boolean;
+    recordIntegrationRequestPolicy(sessionId: string, requestId: string, allowed: boolean): void;
+    setServiceTokenClarifications(token: string, tokenId: string, allowed: boolean): boolean;
+    integrationClarificationsAllowed(sessionId: string, requestId: string): boolean;
     /** Revoke one integration token of an account the caller has established. */
     revokeServiceTokenFor(user: QaAccountUserPublic, tokenId: string): boolean;
     /** The caller if it administers the deployment, or a refusal. */

package/lib/types/accounts/token.d.ts

@@ -5,6 +5,8 @@ interface TokenUser {
 }
 /** The claims carried by a v1 account token payload. */
 export interface TokenPayload {
+    /** OIDC-backed QA session; checked against the account database on every use. */
+    readonly sid?: string;
     readonly uid: string;
     /** Expiry, epoch milliseconds. */
     readonly exp: number;
@@ -26,6 +28,6 @@ export declare function mintToken(secret: string, payload: TokenPayload): string
  * timingSafeEqual) so a signature guess cannot be accelerated by measuring
  * HMAC rejection time.
  */
-export declare function verifyToken(secret: string, token: string, users: readonly TokenUser[]): string | null;
+export declare function verifyToken(secret: string, token: string, users: readonly TokenUser[], sessionActive?: (id: string, userId: string) => boolean): string | null;
 export {};
 //# sourceMappingURL=token.d.ts.map

package/lib/types/admin/metrics.d.ts

@@ -13,6 +13,8 @@ export interface QaConversationFact {
     readonly userId: string;
     readonly subroleId: string;
     readonly assistantMessages: number;
+    readonly readable?: boolean;
+    readonly assistantMessageIds?: readonly string[];
     /** Epoch ms of the conversation's creation, for the activity window. */
     readonly createdAt: number;
 }
@@ -22,8 +24,10 @@ export interface QaAggregationInput {
     readonly reviews: readonly QaConversationReview[];
     /** Days of feedback history the trend shows; older buckets are dropped. */
     readonly trendDays?: number;
+    /** False when the request could not read every conversation in its population. */
+    readonly complete?: boolean;
 }
-export declare function aggregateQuality({ conversations, feedback, reviews, trendDays, }: QaAggregationInput): QaQualityMetrics;
+export declare function aggregateQuality({ conversations, feedback, reviews, trendDays, complete, }: QaAggregationInput): QaQualityMetrics;
 /** One rating's contribution to a conversation row, without re-reading logs. */
 export declare function countRatings(feedback: readonly QaMessageFeedback[]): Readonly<Record<QaFeedbackRating, number>>;
 //# sourceMappingURL=metrics.d.ts.map

package/lib/types/admin/read-budget.d.ts

@@ -0,0 +1,8 @@
+/** One deadline shared by every storage phase of an administrative request. */
+export interface QaReadBudget {
+    remaining(): number;
+    read<T>(work: () => Promise<T>, fallback: T): Promise<T>;
+}
+export declare const QA_ADMIN_REQUEST_BUDGET_MS = 15000;
+export declare function readBudget(now: () => number, ms?: number): QaReadBudget;
+//# sourceMappingURL=read-budget.d.ts.map

package/lib/types/admin/service.d.ts

@@ -24,6 +24,18 @@ export declare const QA_ADMIN_PAGE_MAX = 100;
  * says so; moving these counters onto a real index is the next iteration.
  */
 export declare const QA_ADMIN_SCAN_LIMIT = 200;
+/**
+ * How long one page may spend reading conversation logs before it answers with
+ * what it already has. The newest logs are read until this budget is spent; the
+ * rest of the rows are marked unread instead of the page waiting for a store
+ * that may never answer. Without this,
+ * one conversation whose log cannot be read — a blank chat its process holds
+ * open is the usual case on a stand — parked the page for as long as the
+ * deployment runs.
+ */
+export declare const QA_ADMIN_PAGE_BUDGET_MS = 10000;
+/** The same budget for the aggregate window the overview and metrics read. */
+export declare const QA_ADMIN_SCAN_BUDGET_MS = 10000;
 interface QaServiceClock {
     now(): number;
 }
@@ -101,6 +113,7 @@ export declare class QaAdminService {
      * reads the log — and what the aggregate pages show instead is the newest
      * projection of every finished conversation, which is the cheaper lie.
      */
+    private now;
     private transcript;
     /** Insert or re-touch one projection, keeping the cache inside its budget. */
     private retain;
@@ -121,6 +134,10 @@ export declare class QaAdminService {
      * up between two reads once every caller has left, so a reviewer who abandons a
      * page that has not answered does not keep the deployment reading logs for an
      * answer nobody will see.
+     *
+     * `within` is the pass's read budget. A log the budget no longer covers is not
+     * opened: the conversation keeps its row and is marked unread. Metrics then
+     * disclose the incomplete population instead of treating it as zero answers.
      */
     private walk;
     overview(token: string, signal?: AbortSignal): Promise<QaAdminOverview>;

package/lib/types/admin/session-log.d.ts

@@ -36,7 +36,27 @@ export type QaSessionReadResult = {
 } | {
     readonly ok: false;
     readonly reason: QaTranscriptUnavailableReason;
+    /**
+     * True when the answer is "storage did not answer in time" rather than a
+     * verdict about the log. A caller that scans many logs skips such a
+     * conversation and keeps the rest of its rows; the wire reason stays one
+     * of the shared three, so no page learns a new word.
+     */
+    readonly timedOut?: boolean;
 };
+/**
+ * How long one stored log may take before the console stops waiting for it.
+ *
+ * The durable backend answers a read by listing every session the deployment
+ * keeps and replaying the log; a log whose owning process is mid-flush — a
+ * blank chat created and left open is the usual case on a stand — can hold that
+ * answer indefinitely. The console is a reading surface, so a conversation it
+ * cannot read in this budget is reported and skipped rather than allowed to
+ * park the whole page.
+ */
+export declare const QA_SESSION_READ_TIMEOUT_MS = 5000;
+/** The same budget for the one listing every administrative page needs. */
+export declare const QA_SESSION_LIST_TIMEOUT_MS = 8000;
 /**
  * One listing of the deployment's sessions together with what the answer
  * covers. The distinction is load-bearing: on a deployment that serves no
@@ -111,8 +131,17 @@ export interface QaStoredSessionEraser {
  * Build the reader for one plugin instance. The services are looked up per
  * call rather than captured: a cordis provider is only visible once its fiber
  * is active, and a reference taken at construction time would stay dead.
+ *
+ * Every call that reaches storage is bounded. The bounded answer is a shape the
+ * callers already understand — a listing that answers only for the live store,
+ * a log that is "storage-unavailable" — so a store that never replies costs a
+ * page its detail instead of its whole payload. The budgets are options only so
+ * a test can watch the transition without waiting five seconds for it.
  */
-export declare function createSessionLogReader(ctx: Context): QaSessionLogReader;
+export declare function createSessionLogReader(ctx: Context, options?: {
+    readonly readTimeoutMs?: number;
+    readonly listTimeoutMs?: number;
+}): QaSessionLogReader;
 /** A reader over an explicit set of logs; the tests' seam, and the empty default. */
 export declare function staticSessionLogReader(input: {
     readonly sessions?: readonly QaStoredSessionHeader[];

package/lib/types/answer-review.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=answer-review.js.map

package/lib/types/answer-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer-review.js","sourceRoot":"","sources":["../../src/types/answer-review.ts"],"names":[],"mappings":""}

package/lib/types/chat-sharing/store.d.ts

@@ -7,6 +7,7 @@ export declare class QaChatSharingStore {
     readonly storage: SqliteDatabase;
     constructor(filePath: string, accounts: () => QaAccounts);
     access(token: string, sessionId: string): QaChatAccess;
+    private accessForActor;
     owner(token: string, sessionId: string): QaChatAccess;
     write(token: string, sessionId: string): QaChatAccess;
     /** Exact address lookup after ownership, never an account directory. */

package/lib/types/chat-sharing/transport.d.ts

@@ -10,6 +10,7 @@ export declare class QaChatTransport {
     private readonly locks;
     constructor(ctx: Context, store: () => QaChatSharingStore, admit: (token: string, id: string) => Promise<unknown>, participantPolicy?: ((userId: string, id: string) => Promise<unknown>) | undefined);
     list(token: string, signal: AbortSignal): Promise<SessionListValue>;
+    private filterListing;
     page(token: string, request: SessionPageRequest, signal: AbortSignal): Promise<SessionPage>;
     search(token: string, request: SessionSearchRequest, signal: AbortSignal): Promise<SessionSearchValue>;
     projections(token: string, id: string, signal: AbortSignal): Promise<SessionProjectionsValue>;

package/lib/types/chat-sharing/uploads.d.ts

@@ -1,5 +1,6 @@
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaChatSharingStore } from "./store.js";
+import type { QaFormAttachmentAdapter } from "../forms/attachments.js";
 /** Authenticate before transferring the body, and fence every uploaded chunk. */
-export declare function installQaChatUploads(ctx: Context, store: () => QaChatSharingStore, admit: (token: string, id: string) => Promise<unknown>): () => Promise<void>;
+export declare function installQaChatUploads(ctx: Context, store: () => QaChatSharingStore, admit: (token: string, id: string) => Promise<unknown>, forms?: QaFormAttachmentAdapter): () => Promise<void>;
 //# sourceMappingURL=uploads.d.ts.map

package/lib/types/client/QaAccountsController.d.ts

@@ -1,4 +1,5 @@
 import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaOidcBrowser } from "./oidc-browser.js";
 import type { QaAccountsApi, QaIntegrationTokenResult, StorageLike } from "./types.js";
 /**
  * What the sign-in card says after a forgotten-password request. It names the
@@ -49,6 +50,7 @@ export declare function accountsErrorMessage(code: string | null): string;
 /** Extract the coarse account reason code from a Host wire failure. */
 export declare function accountsReasonOf(failure: unknown): string | null;
 export interface QaAccountsControllerOptions {
+    readonly oidcBrowser?: QaOidcBrowser;
     readonly remote: QaAccountsApi;
     readonly storage: StorageLike | undefined;
     /** Config snapshot getter; the token key follows the deployment identity. */
@@ -79,6 +81,7 @@ export interface QaAccountsControllerOptions {
  */
 export declare class QaAccountsController {
     private readonly options;
+    private logoutGeneration;
     private readonly listeners;
     private snapshot;
     private tokenValue;
@@ -101,6 +104,7 @@ export declare class QaAccountsController {
     /** Boot probe: restore the stored token and ask the Host who it is. */
     start(): Promise<void>;
     login(email: string, password: string): Promise<void>;
+    loginOidc(): Promise<void>;
     register(email: string, password: string): Promise<void>;
     setMode(mode: "login" | "register" | "reset"): void;
     /**
@@ -181,6 +185,7 @@ export declare class QaAccountsController {
      * authority on whose token it is; a refusal is shown as it arrives.
      */
     revokeServiceToken(tokenId: string): Promise<QaIntegrationTokenResult<null>>;
+    setServiceTokenClarifications(tokenId: string, allowed: boolean): Promise<QaIntegrationTokenResult<null>>;
     private authenticate;
     /** Own the account, migrate the legacy index, replay held ratings, then auth. */
     private enterSession;

package/lib/types/client/QaRouteController.d.ts

@@ -11,6 +11,7 @@ interface NavigationWindow {
     readonly location: {
         readonly pathname: string;
         readonly search?: string;
+        readonly hash?: string;
     };
     readonly history: NavigationHistory;
     addEventListener(type: "popstate", listener: () => void): void;

package/lib/types/client/QaSessionController.d.ts

@@ -120,7 +120,10 @@ export declare class QaSessionController {
     private readonly unsubscribeConnection;
     private ensuring;
     private materializing;
+    /** A successful create survives a failed adoption; retry must not create again. */
+    private draftSessionId;
     private operationError;
+    private operationDiagnostic;
     private admissionPending;
     private pendingSubmission;
     private pendingSequence;
@@ -161,9 +164,9 @@ export declare class QaSessionController {
      * both a failed adoption and {@link unbind} take it back. The converse does
      * not hold: a held session may name nothing, which is the transcript of an
      * attestation this chat could not pass and whose caller still reads it. So a
-     * chat whose first send fell short keeps its identity while naming no session,
-     * and the retry — which brings a fresh id — stays in the composer the question
-     * was typed into instead of reading as a move to another chat.
+     * chat whose first send fell short keeps its identity while naming no session;
+     * a retry adopts the successful create it already holds and preserves the
+     * composer the question was typed into.
      */
     private namedSession;
     /**
@@ -212,6 +215,12 @@ export declare class QaSessionController {
     getSnapshot: () => QaSessionState;
     subscribe: (listener: () => void) => (() => void);
     ensureSession(): Promise<void>;
+    /** Retry opening a failed draft without abandoning its successful create. */
+    retrySession(): Promise<void>;
+    failureDiagnostic(): {
+        readonly reason: string;
+        readonly id: string;
+    } | null;
     /**
      * Select a different capability profile for the next agent. The current
      * agent is never mutated: even a blank materialized chat is abandoned in

package/lib/types/client/QaSurface.d.ts

@@ -4,6 +4,7 @@ import type { QaConfigController } from "./QaConfigController.js";
 import type { QaRouteController } from "./QaRouteController.js";
 import type { QaAccountsController } from "./QaAccountsController.js";
 import type { QaApprovalApi, QaAccessApi, QaAdminApi, QaConversation, QaCreateSession, QaForkSession, QaFileUpload, QaQueueStatusRemote, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSkillApi, QaSlashApi, QaSourceApi } from "./types.js";
+import type { QaFormApi } from "./forms.js";
 import type { QaSurfacePanelRegistry } from "./panels/registry.js";
 import type { QaUserSettingsSections } from "./settings-extensions/index.js";
 import type { QaAuditController } from "./audit/controller.js";
@@ -40,6 +41,7 @@ export interface QaSurfaceFace {
     readonly approvalApi?: QaApprovalApi;
     /** Question half of the plugin's namespace, when the Host answers it. */
     readonly questionApi?: QaQuestionApi;
+    readonly formApi?: QaFormApi;
     /**
      * Slash half of the plugin's namespace. Absent on a Host build that predates
      * it: the composer then never opens a palette and ordinary prompts are

package/lib/types/client/admin/CapabilityPicker.d.ts

@@ -0,0 +1,14 @@
+import type { QaCapabilityDescriptor, QaSkillAccess } from "../../types.js";
+import type { CapabilityType } from "./capability-selection.js";
+export declare function CapabilityPicker(props: {
+    readonly type: CapabilityType;
+    /** The zone this picker is mounted in, so its rows stay addressable. */
+    readonly testId?: string;
+    readonly catalog: readonly QaCapabilityDescriptor[];
+    readonly selected: readonly string[];
+    readonly inherited?: readonly string[];
+    readonly system?: readonly string[];
+    readonly skillDetails?: readonly QaSkillAccess[];
+    readonly onChange?: (next: readonly string[]) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=CapabilityPicker.d.ts.map

package/lib/types/client/admin/CoverageNotice.d.ts

@@ -0,0 +1,6 @@
+import type { QaQualityMetrics } from "../../types.js";
+/** A missing journal cannot be presented as a conversation with no answers. */
+export declare function CoverageNotice({ metrics, }: {
+    readonly metrics: QaQualityMetrics;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=CoverageNotice.d.ts.map

package/lib/types/client/admin/RoleEditor.d.ts

@@ -0,0 +1,15 @@
+import type { QaCapabilityDescriptor, QaCapabilitySelection, QaSkillAccess, QaSubrole } from "../../types.js";
+import type { QaAccessApi } from "../types.js";
+export declare function RoleEditor(props: {
+    readonly role: QaSubrole | null;
+    readonly api: QaAccessApi;
+    readonly token: string;
+    readonly catalog: readonly QaCapabilityDescriptor[];
+    readonly common: QaCapabilitySelection;
+    readonly system: QaCapabilitySelection;
+    readonly skills: readonly QaSkillAccess[];
+    readonly subroles: readonly QaSubrole[];
+    readonly onCancel: () => void;
+    readonly onSave: (role: QaSubrole) => Promise<void>;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=RoleEditor.d.ts.map

package/lib/types/client/admin/capability-selection.d.ts

@@ -0,0 +1,27 @@
+import type { QaCapabilitySelection, QaSkillAccess, QaSubrole } from "../../types.js";
+export type CapabilityType = "tool" | "skill";
+/**
+ * The three tool classes: visible immediately, reachable through a loaded
+ * skill, or withdrawn from the profile whatever grants them.
+ */
+export type ToolBucket = "always" | "skillGrantable" | "deny";
+export declare const TOOL_BUCKET_LABELS: Record<ToolBucket, string>;
+export declare function unique(values: readonly string[]): string[];
+export declare function bucketOf(selection: QaCapabilitySelection, bucket: ToolBucket): readonly string[];
+export declare function emptySelection(): QaCapabilitySelection;
+export declare function emptyRole(): QaSubrole;
+/** Tools and skills one role would receive, and where each one comes from. */
+export declare function roleEffective(props: {
+    readonly system: QaCapabilitySelection;
+    readonly common: QaCapabilitySelection;
+    readonly role: QaCapabilitySelection;
+    readonly skills: readonly QaSkillAccess[];
+}, roleId: string): {
+    alwaysTools: string[];
+    grantable: string[];
+    denied: string[];
+    via: Map<string, string[]>;
+    managed: string[];
+    declared: string[];
+};
+//# sourceMappingURL=capability-selection.d.ts.map

package/lib/types/client/admin/shared.d.ts

@@ -19,6 +19,37 @@ export declare function useRequestSlot(): {
     readonly start: () => AbortController;
     readonly cancel: () => void;
 };
+/**
+ * How long a page waits for one Host answer before it stops waiting.
+ *
+ * The aggregate pages read conversation logs on the Host, and a log the store
+ * cannot answer for used to leave the request pending forever: the page then sat
+ * on «Загружаю…» with nothing to click. The Host bounds its own reads well
+ * inside this budget, so hitting it means the answer is lost, not that the
+ * deployment is merely slow.
+ */
+export declare const ADMIN_REQUEST_TIMEOUT_MS = 20000;
+/** The copy a page shows once its deadline has passed. */
+export declare function adminTimeoutMessage(timeoutMs?: number): string;
+/** What one Host call did inside its deadline. */
+export type BoundedOutcome<T> = {
+    readonly status: "ok";
+    readonly value: T;
+} | {
+    readonly status: "timeout";
+} | {
+    readonly status: "aborted";
+};
+/**
+ * Run one Host call under a deadline.
+ *
+ * A promise that never settles is the shape of the hang this exists for, so the
+ * deadline is a race rather than an abort alone: aborting the request is what
+ * asks the Host to stop working, and the timer is what lets the page go on
+ * without an answer. The abandoned call keeps running on its own; its eventual
+ * rejection is observed here so it never surfaces as an unhandled one.
+ */
+export declare function callWithDeadline<T>(call: (signal: AbortSignal) => Promise<T>, outer: AbortSignal, timeoutMs?: number): Promise<BoundedOutcome<T>>;
 /**
  * Load one administrative resource, keeping the previous value visible while
  * it refreshes. Reviewers page through lists while new conversations arrive;
@@ -26,8 +57,15 @@ export declare function useRequestSlot(): {
  *
  * `load` receives the cancellation of the call it is making: pass it on to the
  * Remote, and a page the reviewer left stops being read on the server.
+ *
+ * The call is bounded by {@link ADMIN_REQUEST_TIMEOUT_MS}: a Host that does not
+ * answer leaves a stated error and a retry instead of an endless «Загружаю…».
+ * Whatever this page already held stays on screen — a partial answer is what a
+ * reviewer can still work with.
  */
-export declare function useAdminResource<T>(load: (signal: AbortSignal) => Promise<RemoteResult<T>>, deps: readonly unknown[]): {
+export declare function useAdminResource<T>(load: (signal: AbortSignal) => Promise<RemoteResult<T>>, deps: readonly unknown[], options?: {
+    readonly timeoutMs?: number;
+}): {
     readonly data: T | undefined;
     readonly error: string | undefined;
     readonly loading: boolean;

package/lib/types/client/answer-review.d.ts

@@ -0,0 +1,16 @@
+import type { SessionEventLike } from "@deepseek-ai/dsh-api-session-controller/client";
+import type { ConversationNodeDefinition, ConversationSnapshot } from "@deepseek-ai/dsh-client-ui-conversation/client";
+import type { QaAnswerReview } from "../types/answer-review.js";
+export declare const QA_REVIEW_NODE = "qa-answer-review";
+declare module "@deepseek-ai/dsh-client-ui-chat/client" {
+    interface ChatNodeDataMap {
+        "qa-answer-review": QaAnswerReview;
+    }
+}
+/** Read only the gate's producer metadata; answer prose never supplies a verdict. */
+export declare function readAnswerReview(event: SessionEventLike): QaAnswerReview | null;
+export declare function parseAnswerReview(receipt: unknown): QaAnswerReview | null;
+/** One current result per human request, with the latest answer's anchor. */
+export declare const answerReviewConversationDefinition: ConversationNodeDefinition<QaAnswerReview>;
+export declare function answerReviewsOf(snapshot: ConversationSnapshot | undefined): ReadonlyMap<number, QaAnswerReview>;
+//# sourceMappingURL=answer-review.d.ts.map

package/lib/types/client/components/QaAnswerReviewStatus.d.ts

@@ -0,0 +1,8 @@
+import type { PropsRuntime } from "@deepseek-ai/dsh-client-ui-slots";
+import type { QaAnswerReview } from "../../types/answer-review.js";
+export declare function QaAnswerReviewStatus({ review, }: {
+    readonly review: QaAnswerReview;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function QaNativeAnswerReviewStatus({ node, }: PropsRuntime<"conversation.chat.node", "qa-answer-review">): import("react/jsx-runtime").JSX.Element;
+export declare const QA_REVIEW_STYLES = "\n.dsh-qa-review-row{padding:4px 0 12px}\n.dsh-qa-review{display:inline-flex;align-items:center;gap:6px;max-width:100%;margin:8px 0 0;padding:4px 9px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-layer-2);font-size:12px;line-height:18px}\n.dsh-qa-review svg{width:14px;height:14px;flex:none;fill:none;stroke:currentColor;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round}\n.dsh-qa-review[data-status=pass]{color:var(--dsw-alias-state-success-primary,var(--dsw-alias-label-primary))}\n";
+//# sourceMappingURL=QaAnswerReviewStatus.d.ts.map

package/lib/types/client/components/QaAuthGate.d.ts

@@ -5,6 +5,8 @@ export interface QaAuthGateProps {
     readonly title: string;
     readonly logoUrl: string | null;
     readonly allowRegistration: boolean;
+    readonly localLogin?: boolean;
+    readonly oidcLabel?: string | null;
 }
 /**
  * The full-frame login/registration card shown instead of the chat while the

package/lib/types/client/components/QaChatActions.d.ts

@@ -0,0 +1,7 @@
+/** Quiet actions attached to one owned chat, outside the conversation header. */
+export declare function QaChatActions(props: {
+    name: string;
+    onShare: () => void;
+    onDelete?: (trigger: HTMLButtonElement) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QaChatActions.d.ts.map

package/lib/types/client/components/QaChatSharing.d.ts

@@ -5,6 +5,8 @@ export declare function QaChatSharing(props: {
     access: QaChatAccess;
     token: string;
     api: QaSharingApi;
-}): import("react/jsx-runtime").JSX.Element;
-export declare const QA_SHARING_STYLES = "\n.dsh-qa-sharing{padding:8px 20px;color:var(--dsw-alias-label-secondary);font-size:13px;border-bottom:1px solid var(--dsw-alias-border-l2);display:flex;gap:12px;align-items:center;flex-wrap:wrap}\n.dsh-qa-sharing__notice{margin:0;color:var(--dsw-alias-label-tertiary)}\n.dsh-qa-sharing>span{overflow-wrap:anywhere;min-width:0}\n.dsh-qa-sharing>button,.dsh-qa-sharing__body .dsh-qa-btn{appearance:none;cursor:pointer;min-height:40px;font:inherit;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px 12px}\n.dsh-qa-sharing>button:hover,.dsh-qa-sharing__body .dsh-qa-btn:hover{background:var(--dsw-alias-bg-layer-3)}\n.dsh-qa-sharing>button:disabled,.dsh-qa-sharing__body .dsh-qa-btn:disabled{cursor:default;opacity:.55}\n.dsh-qa-sharing>button:focus-visible,.dsh-qa-sharing__body .dsh-qa-btn:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-brand-primary));outline-offset:2px}\n.dsh-qa-sharing__form{display:grid;gap:12px;margin:16px 0}\n.dsh-qa-sharing__body label{display:flex;flex-direction:column;gap:6px}\n.dsh-qa-sharing__body input,.dsh-qa-sharing__body select{font:inherit;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px;min-width:0;max-width:100%}\n.dsh-qa-sharing__people{list-style:none;padding:0;margin:16px 0}\n.dsh-qa-sharing__people li{display:flex;gap:10px;align-items:center;flex-wrap:wrap;padding:12px 0;border-top:1px solid var(--dsw-alias-border-l2)}\n.dsh-qa-sharing__people span{flex:1;min-width:140px;overflow-wrap:anywhere}\n.dsh-qa-sharing__people small{display:block;color:var(--dsw-alias-label-tertiary)}\n";
+    open: boolean;
+    onClose: () => void;
+}): import("react/jsx-runtime").JSX.Element | null;
+export declare const QA_SHARING_STYLES = "\n.dsh-qa-sharing__body{font-size:13px;color:var(--dsw-alias-label-secondary)}\n.dsh-qa-sharing__intro{margin:0 0 8px;line-height:1.5}\n.dsh-qa-sharing__details{color:var(--dsw-alias-label-tertiary);font-size:12px;line-height:1.5}\n.dsh-qa-sharing__details summary{cursor:pointer}\n.dsh-qa-sharing__body .dsh-qa-btn{appearance:none;cursor:pointer;min-height:36px;font:inherit;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:7px 12px}\n.dsh-qa-sharing__body .dsh-qa-btn:hover{background:var(--dsw-alias-bg-layer-3)}\n.dsh-qa-sharing__body .dsh-qa-btn:disabled{cursor:default;opacity:.55}\n.dsh-qa-sharing__body .dsh-qa-btn:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-brand-primary));outline-offset:2px}\n.dsh-qa-sharing__form{display:grid;grid-template-columns:minmax(0,1fr) minmax(0,160px);gap:12px;margin:20px 0}\n.dsh-qa-sharing__form>.dsh-qa-btn{grid-column:1/-1;justify-self:start}\n.dsh-qa-sharing__body label{display:flex;flex-direction:column;gap:6px}\n.dsh-qa-sharing__body input,.dsh-qa-sharing__body select{font:inherit;color:var(--dsw-alias-label-primary);background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px;min-width:0;max-width:100%}\n.dsh-qa-sharing__people{list-style:none;padding:0;margin:16px 0}\n.dsh-qa-sharing__people li{display:flex;gap:10px;align-items:center;flex-wrap:wrap;padding:12px 0;border-top:1px solid var(--dsw-alias-border-l2)}\n.dsh-qa-sharing__people span{flex:1;min-width:140px;overflow-wrap:anywhere}\n.dsh-qa-sharing__people small{display:block;color:var(--dsw-alias-label-tertiary)}\n@media(max-width:480px){.dsh-qa-sharing__form{grid-template-columns:minmax(0,1fr)}}\n";
 //# sourceMappingURL=QaChatSharing.d.ts.map

package/lib/types/client/components/QaFormItem.d.ts

@@ -0,0 +1,20 @@
+import type { QaFormAnswer, QaFormItem as Item, QaFormAttachment, QaFormUpload } from "../../forms/types.js";
+interface Props {
+    item: Item;
+    answer: QaFormAnswer | null;
+    files: QaFormAttachment[];
+    uploads: QaFormUpload[];
+    disabled: boolean;
+    onAnswer(answer: QaFormAnswer | null): void;
+    onUpload(file: File, target?: {
+        attachment_id: string;
+        version: number;
+    }): void;
+    onRemove(file: QaFormAttachment): void;
+    onCancel(upload: QaFormUpload): void;
+    onOpen(file: QaFormAttachment): void;
+}
+/** Input requirements are separate from file requirements, including in the labels. */
+export declare function QaFormItem(props: Props): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=QaFormItem.d.ts.map

package/lib/types/client/components/QaInputForm.d.ts

@@ -0,0 +1,18 @@
+import type { QaFormView } from "../../forms/types.js";
+import { type QaFormApi } from "../forms.js";
+interface Props {
+    policy?: Readonly<import("../../forms/types.js").QaFormPolicy>;
+    api: QaFormApi;
+    session: string;
+    token: string;
+    form: QaFormView;
+    canStop: boolean;
+    onStop(): Promise<void>;
+    onResume(id: string): void;
+    onTakeover(active: boolean): void;
+}
+export declare function QaInputForm(props: Props): import("react/jsx-runtime").JSX.Element;
+/** Session/identity-keyed parent discards account-local state and aborts transfers on switch. */
+export declare function QaInputForms(props: Omit<Props, "form">): import("react/jsx-runtime").JSX.Element | null;
+export {};
+//# sourceMappingURL=QaInputForm.d.ts.map

package/lib/types/client/components/QaMarkdownPreview.d.ts

@@ -0,0 +1,13 @@
+import type { ReactNode } from "react";
+import type { MarkdownFrontmatter } from "../../markdown-frontmatter.js";
+/** Source-only rendering: original file line numbers survive frontmatter removal. */
+export declare function QaMarkdownPreview({ text, renderFrontmatter, frontmatter, lineStart, lineEnd, renderImage, requestKey, }: {
+    readonly text: string;
+    readonly renderFrontmatter: boolean;
+    readonly frontmatter?: MarkdownFrontmatter;
+    readonly lineStart?: number;
+    readonly lineEnd?: number;
+    readonly renderImage?: (src: string, alt: string) => ReactNode;
+    readonly requestKey?: unknown;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QaMarkdownPreview.d.ts.map