@yadsh/dsh-qa-surface 0.17.0 → 0.18.0

package/lib/types/accounts/database.d.ts

@@ -74,6 +74,14 @@ export declare class QaAccountsDatabase {
     insertUser(user: StoredUser): void;
     /** Replace one account's row in place. */
     updateUser(user: StoredUser): void;
+    oidcUserId(issuer: string, subject: string): string | undefined;
+    isOidcUser(userId: string): boolean;
+    /** Account creation and identity attachment must commit together. */
+    attachOidcIdentity(issuer: string, subject: string, user: StoredUser, create: boolean): void;
+    /** Re-read and update authentication facts under the same write transaction. */
+    authenticateOidc(userId: string, email: string, displayName: string, role: StoredUser["role"], sid: string, expiresAt: number): StoredUser | undefined;
+    oidcSessionActive(id: string, userId: string): boolean;
+    revokeOidcSession(id: string): void;
     /**
      * Record one forgotten-password request. A repeat from the same account
      * moves the row up the queue and counts up, so the console shows "asked

package/lib/types/accounts/file.d.ts

@@ -25,6 +25,8 @@ export interface StoredNotifications {
     desktop?: boolean;
 }
 export interface StoredUser {
+    /** Derived from the identity table when the database is loaded. */
+    readonly authMethod?: "oidc";
     readonly id: string;
     readonly email: string;
     readonly displayName: string;

package/lib/types/accounts/store.d.ts

@@ -6,6 +6,8 @@ export type { QaAccountsErrorReason } from "./errors.js";
 export { defaultAccountsFilePath } from "./file.js";
 export type { QaIssuedServiceToken, QaServiceTokenSummary } from "../types.js";
 export interface QaAccountsOptions {
+    readonly oidcEnabled?: boolean;
+    readonly localLogin?: boolean;
     readonly sessionTtlDays: number;
     readonly allowRegistration: boolean;
     /** Login/registration attempts accepted per rolling minute, store-wide. */
@@ -85,6 +87,8 @@ export declare class QaAccounts {
     private readonly maxAuthAttemptsPerMinute;
     private readonly sessionTtlDays;
     private readonly allowRegistration;
+    private readonly oidcEnabled;
+    private readonly localLogin;
     /** Character cap on a stored profile's agent guidance. */
     private readonly instructionsMaxLength;
     /** Whether a deployment declares which identity handles an account may hold. */
@@ -126,6 +130,19 @@ export declare class QaAccounts {
     /** Resolve a token to its user, or null for absent/invalid/expired ones. */
     verifyToken(token: string): string | null;
     private mintToken;
+    /** Only the server OIDC verifier calls this with authenticated claims. */
+    loginOidc(identity: {
+        issuer: string;
+        subject: string;
+        email: string;
+        displayName: string;
+        role: QaAccountRole;
+        expiresAt: number;
+        autoProvision: boolean;
+    }): QaAccountSession;
+    /** Operator-confirmed attachment preserves ownership and revokes old credentials. */
+    linkOidcIdentity(email: string, issuer: string, subject: string): QaAccountUserPublic;
+    logoutOidc(token: string): boolean;
     /**
      * The account behind a token, or an auth-required refusal.
      *

package/lib/types/accounts/token.d.ts

@@ -5,6 +5,8 @@ interface TokenUser {
 }
 /** The claims carried by a v1 account token payload. */
 export interface TokenPayload {
+    /** OIDC-backed QA session; checked against the account database on every use. */
+    readonly sid?: string;
     readonly uid: string;
     /** Expiry, epoch milliseconds. */
     readonly exp: number;
@@ -26,6 +28,6 @@ export declare function mintToken(secret: string, payload: TokenPayload): string
  * timingSafeEqual) so a signature guess cannot be accelerated by measuring
  * HMAC rejection time.
  */
-export declare function verifyToken(secret: string, token: string, users: readonly TokenUser[]): string | null;
+export declare function verifyToken(secret: string, token: string, users: readonly TokenUser[], sessionActive?: (id: string, userId: string) => boolean): string | null;
 export {};
 //# sourceMappingURL=token.d.ts.map

package/lib/types/admin/metrics.d.ts

@@ -13,6 +13,8 @@ export interface QaConversationFact {
     readonly userId: string;
     readonly subroleId: string;
     readonly assistantMessages: number;
+    readonly readable?: boolean;
+    readonly assistantMessageIds?: readonly string[];
     /** Epoch ms of the conversation's creation, for the activity window. */
     readonly createdAt: number;
 }
@@ -22,8 +24,10 @@ export interface QaAggregationInput {
     readonly reviews: readonly QaConversationReview[];
     /** Days of feedback history the trend shows; older buckets are dropped. */
     readonly trendDays?: number;
+    /** False when the request could not read every conversation in its population. */
+    readonly complete?: boolean;
 }
-export declare function aggregateQuality({ conversations, feedback, reviews, trendDays, }: QaAggregationInput): QaQualityMetrics;
+export declare function aggregateQuality({ conversations, feedback, reviews, trendDays, complete, }: QaAggregationInput): QaQualityMetrics;
 /** One rating's contribution to a conversation row, without re-reading logs. */
 export declare function countRatings(feedback: readonly QaMessageFeedback[]): Readonly<Record<QaFeedbackRating, number>>;
 //# sourceMappingURL=metrics.d.ts.map

package/lib/types/admin/read-budget.d.ts

@@ -0,0 +1,8 @@
+/** One deadline shared by every storage phase of an administrative request. */
+export interface QaReadBudget {
+    remaining(): number;
+    read<T>(work: () => Promise<T>, fallback: T): Promise<T>;
+}
+export declare const QA_ADMIN_REQUEST_BUDGET_MS = 15000;
+export declare function readBudget(now: () => number, ms?: number): QaReadBudget;
+//# sourceMappingURL=read-budget.d.ts.map

package/lib/types/admin/service.d.ts

@@ -24,6 +24,18 @@ export declare const QA_ADMIN_PAGE_MAX = 100;
  * says so; moving these counters onto a real index is the next iteration.
  */
 export declare const QA_ADMIN_SCAN_LIMIT = 200;
+/**
+ * How long one page may spend reading conversation logs before it answers with
+ * what it already has. The newest logs are read until this budget is spent; the
+ * rest of the rows are marked unread instead of the page waiting for a store
+ * that may never answer. Without this,
+ * one conversation whose log cannot be read — a blank chat its process holds
+ * open is the usual case on a stand — parked the page for as long as the
+ * deployment runs.
+ */
+export declare const QA_ADMIN_PAGE_BUDGET_MS = 10000;
+/** The same budget for the aggregate window the overview and metrics read. */
+export declare const QA_ADMIN_SCAN_BUDGET_MS = 10000;
 interface QaServiceClock {
     now(): number;
 }
@@ -101,6 +113,7 @@ export declare class QaAdminService {
      * reads the log — and what the aggregate pages show instead is the newest
      * projection of every finished conversation, which is the cheaper lie.
      */
+    private now;
     private transcript;
     /** Insert or re-touch one projection, keeping the cache inside its budget. */
     private retain;
@@ -121,6 +134,10 @@ export declare class QaAdminService {
      * up between two reads once every caller has left, so a reviewer who abandons a
      * page that has not answered does not keep the deployment reading logs for an
      * answer nobody will see.
+     *
+     * `within` is the pass's read budget. A log the budget no longer covers is not
+     * opened: the conversation keeps its row and is marked unread. Metrics then
+     * disclose the incomplete population instead of treating it as zero answers.
      */
     private walk;
     overview(token: string, signal?: AbortSignal): Promise<QaAdminOverview>;

package/lib/types/admin/session-log.d.ts

@@ -36,7 +36,27 @@ export type QaSessionReadResult = {
 } | {
     readonly ok: false;
     readonly reason: QaTranscriptUnavailableReason;
+    /**
+     * True when the answer is "storage did not answer in time" rather than a
+     * verdict about the log. A caller that scans many logs skips such a
+     * conversation and keeps the rest of its rows; the wire reason stays one
+     * of the shared three, so no page learns a new word.
+     */
+    readonly timedOut?: boolean;
 };
+/**
+ * How long one stored log may take before the console stops waiting for it.
+ *
+ * The durable backend answers a read by listing every session the deployment
+ * keeps and replaying the log; a log whose owning process is mid-flush — a
+ * blank chat created and left open is the usual case on a stand — can hold that
+ * answer indefinitely. The console is a reading surface, so a conversation it
+ * cannot read in this budget is reported and skipped rather than allowed to
+ * park the whole page.
+ */
+export declare const QA_SESSION_READ_TIMEOUT_MS = 5000;
+/** The same budget for the one listing every administrative page needs. */
+export declare const QA_SESSION_LIST_TIMEOUT_MS = 8000;
 /**
  * One listing of the deployment's sessions together with what the answer
  * covers. The distinction is load-bearing: on a deployment that serves no
@@ -111,8 +131,17 @@ export interface QaStoredSessionEraser {
  * Build the reader for one plugin instance. The services are looked up per
  * call rather than captured: a cordis provider is only visible once its fiber
  * is active, and a reference taken at construction time would stay dead.
+ *
+ * Every call that reaches storage is bounded. The bounded answer is a shape the
+ * callers already understand — a listing that answers only for the live store,
+ * a log that is "storage-unavailable" — so a store that never replies costs a
+ * page its detail instead of its whole payload. The budgets are options only so
+ * a test can watch the transition without waiting five seconds for it.
  */
-export declare function createSessionLogReader(ctx: Context): QaSessionLogReader;
+export declare function createSessionLogReader(ctx: Context, options?: {
+    readonly readTimeoutMs?: number;
+    readonly listTimeoutMs?: number;
+}): QaSessionLogReader;
 /** A reader over an explicit set of logs; the tests' seam, and the empty default. */
 export declare function staticSessionLogReader(input: {
     readonly sessions?: readonly QaStoredSessionHeader[];

package/lib/types/chat-sharing/uploads.d.ts

@@ -1,5 +1,6 @@
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaChatSharingStore } from "./store.js";
+import type { QaFormAttachmentAdapter } from "../forms/attachments.js";
 /** Authenticate before transferring the body, and fence every uploaded chunk. */
-export declare function installQaChatUploads(ctx: Context, store: () => QaChatSharingStore, admit: (token: string, id: string) => Promise<unknown>): () => Promise<void>;
+export declare function installQaChatUploads(ctx: Context, store: () => QaChatSharingStore, admit: (token: string, id: string) => Promise<unknown>, forms?: QaFormAttachmentAdapter): () => Promise<void>;
 //# sourceMappingURL=uploads.d.ts.map

package/lib/types/client/QaAccountsController.d.ts

@@ -1,4 +1,5 @@
 import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaOidcBrowser } from "./oidc-browser.js";
 import type { QaAccountsApi, QaIntegrationTokenResult, StorageLike } from "./types.js";
 /**
  * What the sign-in card says after a forgotten-password request. It names the
@@ -49,6 +50,7 @@ export declare function accountsErrorMessage(code: string | null): string;
 /** Extract the coarse account reason code from a Host wire failure. */
 export declare function accountsReasonOf(failure: unknown): string | null;
 export interface QaAccountsControllerOptions {
+    readonly oidcBrowser?: QaOidcBrowser;
     readonly remote: QaAccountsApi;
     readonly storage: StorageLike | undefined;
     /** Config snapshot getter; the token key follows the deployment identity. */
@@ -79,6 +81,7 @@ export interface QaAccountsControllerOptions {
  */
 export declare class QaAccountsController {
     private readonly options;
+    private logoutGeneration;
     private readonly listeners;
     private snapshot;
     private tokenValue;
@@ -101,6 +104,7 @@ export declare class QaAccountsController {
     /** Boot probe: restore the stored token and ask the Host who it is. */
     start(): Promise<void>;
     login(email: string, password: string): Promise<void>;
+    loginOidc(): Promise<void>;
     register(email: string, password: string): Promise<void>;
     setMode(mode: "login" | "register" | "reset"): void;
     /**

package/lib/types/client/QaRouteController.d.ts

@@ -11,6 +11,7 @@ interface NavigationWindow {
     readonly location: {
         readonly pathname: string;
         readonly search?: string;
+        readonly hash?: string;
     };
     readonly history: NavigationHistory;
     addEventListener(type: "popstate", listener: () => void): void;

package/lib/types/client/QaSessionController.d.ts

@@ -120,7 +120,10 @@ export declare class QaSessionController {
     private readonly unsubscribeConnection;
     private ensuring;
     private materializing;
+    /** A successful create survives a failed adoption; retry must not create again. */
+    private draftSessionId;
     private operationError;
+    private operationDiagnostic;
     private admissionPending;
     private pendingSubmission;
     private pendingSequence;
@@ -161,9 +164,9 @@ export declare class QaSessionController {
      * both a failed adoption and {@link unbind} take it back. The converse does
      * not hold: a held session may name nothing, which is the transcript of an
      * attestation this chat could not pass and whose caller still reads it. So a
-     * chat whose first send fell short keeps its identity while naming no session,
-     * and the retry — which brings a fresh id — stays in the composer the question
-     * was typed into instead of reading as a move to another chat.
+     * chat whose first send fell short keeps its identity while naming no session;
+     * a retry adopts the successful create it already holds and preserves the
+     * composer the question was typed into.
      */
     private namedSession;
     /**
@@ -212,6 +215,12 @@ export declare class QaSessionController {
     getSnapshot: () => QaSessionState;
     subscribe: (listener: () => void) => (() => void);
     ensureSession(): Promise<void>;
+    /** Retry opening a failed draft without abandoning its successful create. */
+    retrySession(): Promise<void>;
+    failureDiagnostic(): {
+        readonly reason: string;
+        readonly id: string;
+    } | null;
     /**
      * Select a different capability profile for the next agent. The current
      * agent is never mutated: even a blank materialized chat is abandoned in

package/lib/types/client/QaSurface.d.ts

@@ -4,6 +4,7 @@ import type { QaConfigController } from "./QaConfigController.js";
 import type { QaRouteController } from "./QaRouteController.js";
 import type { QaAccountsController } from "./QaAccountsController.js";
 import type { QaApprovalApi, QaAccessApi, QaAdminApi, QaConversation, QaCreateSession, QaForkSession, QaFileUpload, QaQueueStatusRemote, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSkillApi, QaSlashApi, QaSourceApi } from "./types.js";
+import type { QaFormApi } from "./forms.js";
 import type { QaSurfacePanelRegistry } from "./panels/registry.js";
 import type { QaUserSettingsSections } from "./settings-extensions/index.js";
 import type { QaAuditController } from "./audit/controller.js";
@@ -40,6 +41,7 @@ export interface QaSurfaceFace {
     readonly approvalApi?: QaApprovalApi;
     /** Question half of the plugin's namespace, when the Host answers it. */
     readonly questionApi?: QaQuestionApi;
+    readonly formApi?: QaFormApi;
     /**
      * Slash half of the plugin's namespace. Absent on a Host build that predates
      * it: the composer then never opens a palette and ordinary prompts are

package/lib/types/client/admin/CapabilityPicker.d.ts

@@ -0,0 +1,14 @@
+import type { QaCapabilityDescriptor, QaSkillAccess } from "../../types.js";
+import type { CapabilityType } from "./capability-selection.js";
+export declare function CapabilityPicker(props: {
+    readonly type: CapabilityType;
+    /** The zone this picker is mounted in, so its rows stay addressable. */
+    readonly testId?: string;
+    readonly catalog: readonly QaCapabilityDescriptor[];
+    readonly selected: readonly string[];
+    readonly inherited?: readonly string[];
+    readonly system?: readonly string[];
+    readonly skillDetails?: readonly QaSkillAccess[];
+    readonly onChange?: (next: readonly string[]) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=CapabilityPicker.d.ts.map

package/lib/types/client/admin/CoverageNotice.d.ts

@@ -0,0 +1,6 @@
+import type { QaQualityMetrics } from "../../types.js";
+/** A missing journal cannot be presented as a conversation with no answers. */
+export declare function CoverageNotice({ metrics, }: {
+    readonly metrics: QaQualityMetrics;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=CoverageNotice.d.ts.map

package/lib/types/client/admin/RoleEditor.d.ts

@@ -0,0 +1,15 @@
+import type { QaCapabilityDescriptor, QaCapabilitySelection, QaSkillAccess, QaSubrole } from "../../types.js";
+import type { QaAccessApi } from "../types.js";
+export declare function RoleEditor(props: {
+    readonly role: QaSubrole | null;
+    readonly api: QaAccessApi;
+    readonly token: string;
+    readonly catalog: readonly QaCapabilityDescriptor[];
+    readonly common: QaCapabilitySelection;
+    readonly system: QaCapabilitySelection;
+    readonly skills: readonly QaSkillAccess[];
+    readonly subroles: readonly QaSubrole[];
+    readonly onCancel: () => void;
+    readonly onSave: (role: QaSubrole) => Promise<void>;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=RoleEditor.d.ts.map

package/lib/types/client/admin/capability-selection.d.ts

@@ -0,0 +1,27 @@
+import type { QaCapabilitySelection, QaSkillAccess, QaSubrole } from "../../types.js";
+export type CapabilityType = "tool" | "skill";
+/**
+ * The three tool classes: visible immediately, reachable through a loaded
+ * skill, or withdrawn from the profile whatever grants them.
+ */
+export type ToolBucket = "always" | "skillGrantable" | "deny";
+export declare const TOOL_BUCKET_LABELS: Record<ToolBucket, string>;
+export declare function unique(values: readonly string[]): string[];
+export declare function bucketOf(selection: QaCapabilitySelection, bucket: ToolBucket): readonly string[];
+export declare function emptySelection(): QaCapabilitySelection;
+export declare function emptyRole(): QaSubrole;
+/** Tools and skills one role would receive, and where each one comes from. */
+export declare function roleEffective(props: {
+    readonly system: QaCapabilitySelection;
+    readonly common: QaCapabilitySelection;
+    readonly role: QaCapabilitySelection;
+    readonly skills: readonly QaSkillAccess[];
+}, roleId: string): {
+    alwaysTools: string[];
+    grantable: string[];
+    denied: string[];
+    via: Map<string, string[]>;
+    managed: string[];
+    declared: string[];
+};
+//# sourceMappingURL=capability-selection.d.ts.map

package/lib/types/client/admin/shared.d.ts

@@ -19,6 +19,37 @@ export declare function useRequestSlot(): {
     readonly start: () => AbortController;
     readonly cancel: () => void;
 };
+/**
+ * How long a page waits for one Host answer before it stops waiting.
+ *
+ * The aggregate pages read conversation logs on the Host, and a log the store
+ * cannot answer for used to leave the request pending forever: the page then sat
+ * on «Загружаю…» with nothing to click. The Host bounds its own reads well
+ * inside this budget, so hitting it means the answer is lost, not that the
+ * deployment is merely slow.
+ */
+export declare const ADMIN_REQUEST_TIMEOUT_MS = 20000;
+/** The copy a page shows once its deadline has passed. */
+export declare function adminTimeoutMessage(timeoutMs?: number): string;
+/** What one Host call did inside its deadline. */
+export type BoundedOutcome<T> = {
+    readonly status: "ok";
+    readonly value: T;
+} | {
+    readonly status: "timeout";
+} | {
+    readonly status: "aborted";
+};
+/**
+ * Run one Host call under a deadline.
+ *
+ * A promise that never settles is the shape of the hang this exists for, so the
+ * deadline is a race rather than an abort alone: aborting the request is what
+ * asks the Host to stop working, and the timer is what lets the page go on
+ * without an answer. The abandoned call keeps running on its own; its eventual
+ * rejection is observed here so it never surfaces as an unhandled one.
+ */
+export declare function callWithDeadline<T>(call: (signal: AbortSignal) => Promise<T>, outer: AbortSignal, timeoutMs?: number): Promise<BoundedOutcome<T>>;
 /**
  * Load one administrative resource, keeping the previous value visible while
  * it refreshes. Reviewers page through lists while new conversations arrive;
@@ -26,8 +57,15 @@ export declare function useRequestSlot(): {
  *
  * `load` receives the cancellation of the call it is making: pass it on to the
  * Remote, and a page the reviewer left stops being read on the server.
+ *
+ * The call is bounded by {@link ADMIN_REQUEST_TIMEOUT_MS}: a Host that does not
+ * answer leaves a stated error and a retry instead of an endless «Загружаю…».
+ * Whatever this page already held stays on screen — a partial answer is what a
+ * reviewer can still work with.
  */
-export declare function useAdminResource<T>(load: (signal: AbortSignal) => Promise<RemoteResult<T>>, deps: readonly unknown[]): {
+export declare function useAdminResource<T>(load: (signal: AbortSignal) => Promise<RemoteResult<T>>, deps: readonly unknown[], options?: {
+    readonly timeoutMs?: number;
+}): {
     readonly data: T | undefined;
     readonly error: string | undefined;
     readonly loading: boolean;

package/lib/types/client/components/QaAuthGate.d.ts

@@ -5,6 +5,8 @@ export interface QaAuthGateProps {
     readonly title: string;
     readonly logoUrl: string | null;
     readonly allowRegistration: boolean;
+    readonly localLogin?: boolean;
+    readonly oidcLabel?: string | null;
 }
 /**
  * The full-frame login/registration card shown instead of the chat while the

package/lib/types/client/components/QaFormItem.d.ts

@@ -0,0 +1,20 @@
+import type { QaFormAnswer, QaFormItem as Item, QaFormAttachment, QaFormUpload } from "../../forms/types.js";
+interface Props {
+    item: Item;
+    answer: QaFormAnswer | null;
+    files: QaFormAttachment[];
+    uploads: QaFormUpload[];
+    disabled: boolean;
+    onAnswer(answer: QaFormAnswer | null): void;
+    onUpload(file: File, target?: {
+        attachment_id: string;
+        version: number;
+    }): void;
+    onRemove(file: QaFormAttachment): void;
+    onCancel(upload: QaFormUpload): void;
+    onOpen(file: QaFormAttachment): void;
+}
+/** Input requirements are separate from file requirements, including in the labels. */
+export declare function QaFormItem(props: Props): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=QaFormItem.d.ts.map

package/lib/types/client/components/QaInputForm.d.ts

@@ -0,0 +1,18 @@
+import type { QaFormView } from "../../forms/types.js";
+import { type QaFormApi } from "../forms.js";
+interface Props {
+    policy?: Readonly<import("../../forms/types.js").QaFormPolicy>;
+    api: QaFormApi;
+    session: string;
+    token: string;
+    form: QaFormView;
+    canStop: boolean;
+    onStop(): Promise<void>;
+    onResume(id: string): void;
+    onTakeover(active: boolean): void;
+}
+export declare function QaInputForm(props: Props): import("react/jsx-runtime").JSX.Element;
+/** Session/identity-keyed parent discards account-local state and aborts transfers on switch. */
+export declare function QaInputForms(props: Omit<Props, "form">): import("react/jsx-runtime").JSX.Element | null;
+export {};
+//# sourceMappingURL=QaInputForm.d.ts.map

package/lib/types/client/forms-styles.d.ts

@@ -0,0 +1,2 @@
+export declare const QA_FORM_STYLES = "\n.dsh-qa-form{background:var(--dsw-alias-bg-layer-2);border:1px solid var(--dsw-alias-border-l2);border-radius:12px;padding:16px;max-height:75vh;overflow:hidden;overflow-wrap:anywhere;color:var(--dsw-alias-label-primary);display:flex;flex-direction:column}\n.dsh-qa-form__content{overflow:auto;min-height:0;padding:0 2px}.dsh-qa-form>header,.dsh-qa-form>footer,.dsh-qa-form>nav,.dsh-qa-form>p{flex-shrink:0}.dsh-qa-form>footer{border-top:1px solid var(--dsw-alias-border-l2);padding-top:12px;margin-top:8px}\n.dsh-qa-form>header{max-height:96px;overflow:auto}\n.dsh-qa-form header,.dsh-qa-form footer,.dsh-qa-form nav{display:flex;gap:8px;align-items:center;flex-wrap:wrap}\n.dsh-qa-form header{justify-content:space-between}.dsh-qa-form nav{margin:12px 0}.dsh-qa-form h3{margin:12px 0}\n.dsh-qa-form button{font:inherit;color:inherit;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:8px 12px;cursor:pointer}\n.dsh-qa-form button:disabled{opacity:.55;cursor:default}.dsh-qa-form button:focus-visible,.dsh-qa-form input:focus-visible,.dsh-qa-form textarea:focus-visible{outline:var(--dsw-focus-ring-width,2px) solid var(--dsw-focus-ring-color,var(--dsw-alias-state-business-primary));outline-offset:2px}\n.dsh-qa-form__item{min-width:0;border:0;border-bottom:1px solid var(--dsw-alias-border-l2);padding:12px 0;margin:0 0 12px}.dsh-qa-form legend{font-weight:600}.dsh-qa-form small{font-weight:400;display:block;color:var(--dsw-alias-label-tertiary)}\n.dsh-qa-form__hint{font-size:13px;color:var(--dsw-alias-label-secondary)}.dsh-qa-form label{display:block}.dsh-qa-form input[type=text],.dsh-qa-form textarea{display:block;box-sizing:border-box;width:100%;font:inherit;color:inherit;background:var(--dsw-alias-bg-layer-3);border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px;margin:6px 0}\n.dsh-qa-form__choices>label{display:flex;gap:8px;align-items:baseline;margin:8px 0}.dsh-qa-form__files{border:1px dashed var(--dsw-alias-border-l2);border-radius:8px;padding:12px;margin-top:12px}.dsh-qa-form input[type=file]{max-width:100%;display:block;margin:8px 0}.dsh-qa-form__files ul{padding-left:18px}.dsh-qa-form__files li{margin:10px 0}.dsh-qa-form__files button{margin:4px}.dsh-qa-form__review>div{border-bottom:1px solid var(--dsw-alias-border-l2);margin-bottom:12px}.dsh-qa-form [role=alert]{color:var(--dsw-alias-label-primary);border:1px solid var(--dsw-alias-border-l2);padding:10px;border-radius:8px}\n@media(max-width:600px){.dsh-qa-form{padding:12px;max-height:80vh}.dsh-qa-form footer button{flex:1 1 auto}.dsh-qa-form nav button{font-size:12px}}\n";
+//# sourceMappingURL=forms-styles.d.ts.map

package/lib/types/client/forms.d.ts

@@ -0,0 +1,23 @@
+import type { QaFormCommand, QaFormResult, QaFormView } from "../forms/types.js";
+import type { RemoteResult } from "./types.js";
+import type { QaUploadCarrier } from "./account-upload.js";
+/** Typert adds an outer transport result; domain refusals remain stable codes. */
+export interface QaFormApi {
+    list(token: string, session: string): Promise<RemoteResult<QaFormResult<QaFormView[]>>>;
+    get(token: string, session: string, id: string): Promise<RemoteResult<QaFormResult<QaFormView>>>;
+    mutate(token: string, session: string, command: QaFormCommand): Promise<RemoteResult<QaFormResult<QaFormView>>>;
+    upload(token: string, session: string, id: string, file: File, signal: AbortSignal): Promise<void>;
+    file(token: string, session: string, formId: string, resourceId: string): Promise<RemoteResult<QaFormResult<{
+        name: string;
+        media_type: string;
+        data: string;
+    }>>>;
+}
+export declare class QaFormClientError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function unwrapForm<T>(result: RemoteResult<QaFormResult<T>>): T;
+/** Same protected carrier and route as ordinary QA uploads; no fabricated percentage. */
+export declare function uploadQaFormFile(carrier: QaUploadCarrier | undefined, token: string, session: string, uploadId: string, file: File, signal: AbortSignal): Promise<void>;
+//# sourceMappingURL=forms.d.ts.map

package/lib/types/client/oidc-browser.d.ts

@@ -0,0 +1,12 @@
+import type { QaOidcStart, ResolvedQaSurfaceConfig } from "../types.js";
+export interface QaOidcBrowser {
+    begin(start: QaOidcStart): void;
+    takeHandoff(): {
+        handoff: string;
+        completionKey: string;
+    } | null;
+    logout(url: string): void;
+}
+/** Completion proof is isolated to the initiating tab and never goes in a URL. */
+export declare function createQaOidcBrowser(browser: Pick<Window, "location" | "history" | "sessionStorage">, config: () => ResolvedQaSurfaceConfig): QaOidcBrowser;
+//# sourceMappingURL=oidc-browser.d.ts.map

package/lib/types/client/types.d.ts

@@ -5,7 +5,10 @@ import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSessi
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
-export type QaSessions = ISessions;
+export type QaSessions = ISessions & {
+    /** Register an exact id admitted by authenticated QA create/read before retain. */
+    rememberAdmitted?(sessionId: string): void;
+};
 /** Narrow client API slice used to pin the preset and model of a fresh chat. */
 export type QaSessionsApi = {
     selectModel: ClientRemote["session"]["selectModel"];
@@ -351,6 +354,9 @@ export interface QaAccountsApi {
     accountsSetServiceTokenClarifications?(token: string, tokenId: string, allowed: boolean): Promise<RemoteResult<{
         readonly updated: boolean;
     }>>;
+    accountsOidcStart?(): Promise<RemoteResult<import("../types.js").QaOidcStart>>;
+    accountsOidcComplete?(handoff: string, completionKey: string): Promise<RemoteResult<QaAccountSession>>;
+    accountsOidcLogout?(token: string): Promise<RemoteResult<string | null>>;
     chatVisible?(token: string): Promise<RemoteResult<readonly import("../chat-sharing/types.js").QaChatAccess[]>>;
     accountsWhoami(token: string): Promise<RemoteResult<QaWhoamiResult>>;
     accountsLogin(email: string, password: string): Promise<RemoteResult<QaAccountSession>>;

package/lib/types/config-resolvers/oidc.d.ts

@@ -0,0 +1,3 @@
+import type { QaSurfaceConfig, ResolvedQaOidcConfig } from "../types.js";
+export declare function resolveOidc(input: QaSurfaceConfig): ResolvedQaOidcConfig;
+//# sourceMappingURL=oidc.d.ts.map

package/lib/types/forms/attachments.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+import type { QaFormService } from "./service.js";
+import type { QaFormRecord, QaFormSubmission } from "./types.js";
+declare const fileRef: z.ZodObject<{
+    attachmentId: z.ZodString;
+    name: z.ZodString;
+    bytes: z.ZodNumber;
+}, z.core.$strip>;
+type FileRef = z.infer<typeof fileRef>;
+/** Structural port to the installed Host; receipt data is runtime-validated. */
+export interface QaFormHostAttachments {
+    readonly root: string;
+    readFileStream(file: FileRef, signal?: AbortSignal): AsyncIterable<Uint8Array>;
+    saveFile(input: {
+        data: Uint8Array;
+        name: string;
+    }): Promise<unknown>;
+    fileHostPath(file: FileRef): string | undefined;
+    validateImage?(input: {
+        data: Uint8Array;
+        mediaType: "image/png" | "image/jpeg";
+        name: string;
+    }): Promise<void>;
+}
+export declare function validateFormFile(name: string, data: Buffer): string;
+/** Durable bytes belong to the form store; Host objects are verified reader projections. */
+export declare class QaFormAttachmentAdapter {
+    private readonly service;
+    private readonly host;
+    constructor(service: () => QaFormService, host: () => QaFormHostAttachments | undefined);
+    available(): boolean;
+    check(session: string, formId: string, uploadId: string): void;
+    claim(session: string, uploadId: string): {
+        record: QaFormRecord;
+        upload: QaFormRecord["uploads"][number];
+    };
+    complete(session: string, formId: string, uploadId: string, raw: unknown, signal: AbortSignal, authorize: () => void): Promise<QaFormRecord>;
+    fail(session: string, formId: string, uploadId: string): void;
+    /** Exact saved bytes are re-projected through the Host on each successful resume. */
+    readable(submission: QaFormSubmission): Promise<QaFormSubmission & {
+        resources: {
+            resource_id: string;
+            read_path: string;
+        }[];
+    }>;
+}
+export {};
+//# sourceMappingURL=attachments.d.ts.map

package/lib/types/forms/errors.d.ts

@@ -0,0 +1,11 @@
+import type { QaFormFieldError, QaFormResult } from "./types.js";
+export declare class QaFormError extends Error {
+    readonly code: string;
+    readonly revision?: number | undefined;
+    readonly fields?: QaFormFieldError[] | undefined;
+    constructor(code: string, message: string, revision?: number | undefined, fields?: QaFormFieldError[] | undefined);
+}
+/** Deliberately redact unexpected storage/Host exceptions at the wire boundary. */
+export declare function formFailure(error: unknown): QaFormResult<never>;
+export declare function formAssert(condition: unknown, code: string, message: string): asserts condition;
+//# sourceMappingURL=errors.d.ts.map

package/lib/types/forms/fingerprint.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Stable object-key ordering for schema and idempotency fingerprints.
+ *
+ * Lives apart from the sqlite store so every store implementation hashes the
+ * same way without importing the sqlite bridge: the client test graph mounts a
+ * store too, and a browser environment must not see `@yadsh/dsh-plugin-kit/sqlite`.
+ */
+export declare function fingerprint(value: unknown): string;
+//# sourceMappingURL=fingerprint.d.ts.map