@yadsh/dsh-qa-surface 0.16.0 → 0.18.0

package/lib/types/secure-session.d.ts

@@ -71,6 +71,7 @@ export declare class QaPolicyAdmission {
      * one set answers for the whole chat.
      */
     private readonly attested;
+    private readonly questionWarnings;
     private readonly workspaceAccess;
     /**
      * Removers of the document input roots granted per session, so a grant lives

package/lib/types/shared/documents.d.ts

@@ -17,4 +17,6 @@ export declare const QA_PDF_MEDIA_TYPE = "application/pdf";
  * previewable (Markdown as text, PDF through the browser's own viewer).
  */
 export declare function isConvertibleDocument(mediaType: string): boolean;
+export declare function isSpreadsheetDocument(mediaType: string): boolean;
+export declare function isPreviewableDocument(mediaType: string): boolean;
 //# sourceMappingURL=documents.d.ts.map

package/lib/types/types/accounts.d.ts

@@ -1,6 +1,8 @@
 import type { QaAccountRole } from "./policy.js";
 /** The account fields projected to browsers; never includes credentials. */
 export interface QaAccountUserPublic {
+    /** Corporate passwords are managed outside QA. Absent on legacy/local accounts. */
+    readonly authMethod?: "oidc";
     readonly id: string;
     readonly email: string;
     readonly displayName: string;
@@ -134,8 +136,10 @@ export type QaServiceTokenScope = "ask" | "sessions:read";
 export interface QaServiceTokenCreateInput {
     /** A note the operator's list shows; empty becomes a generic label. */
     readonly label?: string;
-    /** Requested scopes; unknown ones are dropped, empty falls back to `ask`. */
+    /** Requested scopes; unknown ones are dropped, explicit empty grants none. */
     readonly scopes?: readonly string[];
+    /** Whether API turns may ask clarifying questions; omitted preserves existing behavior. */
+    readonly allowClarifications?: boolean;
     /** How long the token lives, in days; bounded server-side. */
     readonly ttlDays?: number;
 }
@@ -148,6 +152,8 @@ export interface QaServiceTokenSummary {
     readonly id: string;
     readonly label: string;
     readonly scopes: readonly QaServiceTokenScope[];
+    /** Older Hosts omit this field and keep clarifications enabled. */
+    readonly allowClarifications?: boolean;
     readonly createdAt: string;
     readonly expiresAt: string;
     readonly lastUsedAt: string | null;

package/lib/types/types/admin.d.ts

@@ -196,6 +196,12 @@ export interface QaQualityTrendPoint {
     readonly negative: number;
 }
 export interface QaQualityMetrics {
+    /** Counts derived from journals are incomplete until every journal was read. */
+    readonly coverage?: {
+        readonly complete: boolean;
+        readonly readConversations: number;
+        readonly totalConversations: number;
+    };
     readonly conversations: number;
     readonly activeUsers: number;
     readonly assistantMessages: number;

package/lib/types/types/answer-review.d.ts

@@ -0,0 +1,11 @@
+/** Host-recorded review of one immutable assistant message. */
+export interface QaAnswerReview {
+    readonly version: 1;
+    readonly candidateSeq: number;
+    readonly candidateHash: string;
+    readonly requestSeq: number | null;
+    readonly round: number;
+    readonly status: "reviewing" | "recovering" | "pass" | "revise" | "failure" | "cancelled" | "waived";
+    readonly at: number;
+}
+//# sourceMappingURL=answer-review.d.ts.map

package/lib/types/types/config.d.ts

@@ -38,6 +38,8 @@ export interface QaSourcesConfig {
     readonly filePreview?: {
         readonly enabled?: boolean;
         readonly markdownRenderedByDefault?: boolean;
+        /** Render a leading YAML mapping as a document metadata card. */
+        readonly renderFrontmatter?: boolean;
         readonly allowRawToggle?: boolean;
         readonly maxBytes?: number;
         readonly maxMarkdownRenderBytes?: number;
@@ -92,6 +94,7 @@ export interface QaNotesConfig {
     };
 }
 export interface QaSurfaceConfig {
+    readonly forms?: Partial<import("../forms/types.js").QaFormPolicy>;
     readonly enabled?: boolean;
     readonly route?: {
         readonly path?: string;
@@ -235,6 +238,8 @@ export interface QaSurfaceConfig {
         readonly frameAncestors?: string | null;
     };
     readonly accounts?: {
+        readonly localLogin?: boolean;
+        readonly oidc?: import("./oidc.js").QaOidcConfig;
         /** Opt-in; the QA gate stays off until the deployment turns this on. */
         readonly enabled?: boolean;
         readonly allowRegistration?: boolean;
@@ -370,6 +375,7 @@ export interface QaAttachmentsConfig {
     readonly extensions?: readonly string[];
 }
 export interface ResolvedQaSurfaceConfig {
+    readonly forms: Readonly<import("../forms/types.js").QaFormPolicy>;
     readonly enabled: boolean;
     readonly route: {
         readonly path: string;
@@ -439,6 +445,8 @@ export interface ResolvedQaSurfaceConfig {
         readonly frameAncestors: string | null;
     };
     readonly accounts: {
+        readonly localLogin: boolean;
+        readonly oidc: import("./oidc.js").ResolvedQaOidcConfig;
         readonly enabled: boolean;
         readonly allowRegistration: boolean;
         readonly sessionTtlDays: number;
@@ -534,6 +542,7 @@ export interface ResolvedQaSurfaceConfig {
         readonly filePreview: {
             readonly enabled: boolean;
             readonly markdownRenderedByDefault: boolean;
+            readonly renderFrontmatter: boolean;
             readonly allowRawToggle: boolean;
             readonly maxBytes: number;
             readonly maxMarkdownRenderBytes: number;

package/lib/types/types/oidc.d.ts

@@ -0,0 +1,36 @@
+/** Server OIDC configuration. Secrets are referenced by environment name only. */
+export interface QaOidcConfig {
+    readonly enabled?: boolean;
+    readonly issuer?: string;
+    readonly clientId?: string;
+    readonly clientSecretEnv?: string;
+    /** Exact public HTTPS callback URL, including any reverse proxy prefix. */
+    readonly redirectUri?: string;
+    readonly buttonLabel?: string;
+    readonly autoProvision?: boolean;
+    /** Client roles included in the signed ID token's resource_access claim. */
+    readonly requiredRole?: string;
+    readonly adminRole?: string;
+    readonly reviewerRole?: string;
+    /** Upper bound on QA access before another OIDC authentication. */
+    readonly sessionTtlSeconds?: number;
+}
+export interface ResolvedQaOidcConfig {
+    readonly enabled: boolean;
+    readonly issuer: string;
+    readonly clientId: string;
+    readonly clientSecretEnv: string;
+    readonly redirectUri: string;
+    readonly buttonLabel: string;
+    readonly autoProvision: boolean;
+    readonly requiredRole: string;
+    readonly adminRole: string;
+    readonly reviewerRole: string;
+    readonly sessionTtlSeconds: number;
+}
+/** The browser retains completionKey in sessionStorage before leaving QA. */
+export interface QaOidcStart {
+    readonly authorizationUrl: string;
+    readonly completionKey: string;
+}
+//# sourceMappingURL=oidc.d.ts.map

package/lib/types/types/session.d.ts

@@ -9,18 +9,32 @@ export interface QaSourceFilePreview {
     readonly markdown: boolean;
     readonly renderableMarkdown: boolean;
     readonly document?: QaDocumentPreview;
+    readonly frontmatter?: import("../markdown-frontmatter.js").MarkdownFrontmatter;
 }
 /**
- * A file the panel renders by conversion rather than by bytes: the document
- * pipeline turned a Word file into PDF, and the browser shows that PDF.
+ * A PDF payload, including Word documents rendered by the document pipeline.
  */
-export interface QaDocumentPreview {
+export interface QaPdfPreview {
     readonly kind: "pdf";
     readonly base64: string;
     readonly mime: "application/pdf";
     readonly name: string;
     readonly bytes: number;
 }
+/** A bounded cell window; the complete workbook stays on the Host. */
+export interface QaSpreadsheetPreview {
+    readonly kind: "spreadsheet";
+    readonly name: string;
+    readonly bytes: number;
+    readonly inventory: import("@yadsh/dsh-documents").SpreadsheetInspectResult;
+    readonly page: import("@yadsh/dsh-documents").SpreadsheetReadResult;
+}
+export interface QaSpreadsheetPreviewSelection {
+    readonly sheet?: string;
+    readonly startRow?: number;
+    readonly startColumn?: number;
+}
+export type QaDocumentPreview = QaPdfPreview | QaSpreadsheetPreview;
 /** One directory entry of a chat's own workspace, as the files panel browses it. */
 export interface QaWorkspaceEntry {
     readonly name: string;
@@ -111,6 +125,7 @@ export type QaMessage = QaUserMessage | {
      * while the browser's own message id does not.
      */
     readonly seq?: number;
+    readonly review?: import("./answer-review.js").QaAnswerReview;
     /** Final text of a completed turn with a durable fork boundary. */
     readonly forkable?: boolean;
     /** Host turn this answer belongs to; groups regenerations into variants. */

package/lib/types/types.d.ts

@@ -1,13 +1,16 @@
 export type * from "./types/policy.js";
+export type * from "./forms/types.js";
 export type * from "./types/capability.js";
 export type * from "./types/access.js";
 export type * from "./types/accounts.js";
+export type * from "./types/oidc.js";
 export type * from "./types/skills.js";
 export type * from "./types/expert-memory.js";
 export type * from "./types/config.js";
 export type * from "./types/slash.js";
 export type * from "./types/documents.js";
 export type * from "./types/session.js";
+export type * from "./types/answer-review.js";
 export type * from "./types/quality.js";
 export type * from "./types/admin.js";
 export type { QaSourceEvidence, QaSourceKind, QaSourceLocation, QaSourceOrigin, QaSourceReference, QaTurnSources, } from "./provenance/types.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -104,73 +104,75 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-agent": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-agent-preset-registry": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-api-gateway": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-api-session-controller": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-theme": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-permission-presets": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-session": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-scope": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-skill": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-system-prompt": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-tools": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.7-rc.2 <0.2.0",
-    "@deepseek-ai/dsh-workspace": ">=0.1.7-rc.2 <0.2.0",
+    "@deepseek-ai/dsh-agent": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-agent-preset-registry": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-api-session-controller": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-theme": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-permission-presets": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-scope": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-session": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-skill": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-tools": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.7-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-workspace": ">=0.1.7-rc.2 <0.3.0-0",
     "@deepseek-ai/schemastery": "^3.18.4",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "dependencies": {
+    "openid-client": "6.8.8",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "@yadsh/dsh-audit-core": "^0.1.2",
-    "@yadsh/dsh-plugin-kit": "^0.5.1",
-    "@yadsh/dsh-documents": "^0.7.0",
     "@yadsh/dsh-audit-ui": "^0.1.3",
+    "@yadsh/dsh-documents": "^0.8.1",
+    "@yadsh/dsh-plugin-kit": "^0.6.0",
     "@yadsh/dsh-plugin-log": "^0.4.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.4",
-    "@deepseek-ai/dsh-agent": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-agent-preset-registry": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-api-gateway": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-api-workspace-controller": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-chat": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-theme": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-permission-presets": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-scope": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-settings": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-skill": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-typert-generator": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-workspace": "0.1.7-rc.2",
-    "@deepseek-ai/schemastery": "3.18.4",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-agent-preset-registry": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-api-gateway": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-api-workspace-controller": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-chat": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-client-ui-theme": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-permission-presets": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-skill": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-generator": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-util-values": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-workspace": "0.2.1-rc.3",
+    "@deepseek-ai/schemastery": "3.18.5",
     "@testing-library/react": "^16.3.0",
     "@types/node": "^26.4.0",
     "@types/react": "18.3.28",