@yadsh/dsh-qa-surface 0.17.0 → 0.19.0

package/lib/types/client/types.d.ts

@@ -5,7 +5,10 @@ import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSessi
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
-export type QaSessions = ISessions;
+export type QaSessions = ISessions & {
+    /** Register an exact id admitted by authenticated QA create/read before retain. */
+    rememberAdmitted?(sessionId: string): void;
+};
 /** Narrow client API slice used to pin the preset and model of a fresh chat. */
 export type QaSessionsApi = {
     selectModel: ClientRemote["session"]["selectModel"];
@@ -34,10 +37,10 @@ export type QaCreateSession = (token: string, subroleId: string | null, adminPre
 export type QaForkSession = (token: string, sourceId: string, answerSeq: number) => Promise<RemoteResult<string>>;
 /**
  * The Host's live read of the request ceiling (`qaSurface/queueStatus`), asked
- * per send: how many questions the stand is answering and whether one more
- * fits.
+ * per send and for the current waiting chat. Supplying a session id requires
+ * current account read access; global reads expose counts only.
  */
-export type QaQueueStatusRemote = () => Promise<RemoteResult<QaQueueStatus>>;
+export type QaQueueStatusRemote = (token?: string, sessionId?: string) => Promise<RemoteResult<QaQueueStatus>>;
 /** Role selector plus administrator mutation channel. */
 export interface QaAccessApi {
     current(token: string): Promise<RemoteResult<QaCurrentAccess>>;
@@ -351,6 +354,9 @@ export interface QaAccountsApi {
     accountsSetServiceTokenClarifications?(token: string, tokenId: string, allowed: boolean): Promise<RemoteResult<{
         readonly updated: boolean;
     }>>;
+    accountsOidcStart?(): Promise<RemoteResult<import("../types.js").QaOidcStart>>;
+    accountsOidcComplete?(handoff: string, completionKey: string): Promise<RemoteResult<QaAccountSession>>;
+    accountsOidcLogout?(token: string): Promise<RemoteResult<string | null>>;
     chatVisible?(token: string): Promise<RemoteResult<readonly import("../chat-sharing/types.js").QaChatAccess[]>>;
     accountsWhoami(token: string): Promise<RemoteResult<QaWhoamiResult>>;
     accountsLogin(email: string, password: string): Promise<RemoteResult<QaAccountSession>>;

package/lib/types/config-resolvers/oidc.d.ts

@@ -0,0 +1,3 @@
+import type { QaSurfaceConfig, ResolvedQaOidcConfig } from "../types.js";
+export declare function resolveOidc(input: QaSurfaceConfig): ResolvedQaOidcConfig;
+//# sourceMappingURL=oidc.d.ts.map

package/lib/types/filesystem-intent.d.ts

@@ -0,0 +1,12 @@
+/** The Host tool contract, normalized once for path and storage policy. */
+export type QaFilesystemIntent = {
+    readonly kind: "read";
+    readonly path: string;
+    readonly fileOnlyGrant: boolean;
+} | {
+    readonly kind: "write";
+    readonly path: string;
+    readonly bytes: number;
+};
+export declare function qaFilesystemIntent(name: string, args: Record<string, unknown> | undefined): QaFilesystemIntent | undefined;
+//# sourceMappingURL=filesystem-intent.d.ts.map

package/lib/types/forms/attachments.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import type { QaFormService } from "./service.js";
+import type { QaFormRecord, QaFormSubmission } from "./types.js";
+declare const fileRef: z.ZodObject<{
+    attachmentId: z.ZodString;
+    name: z.ZodString;
+    bytes: z.ZodNumber;
+}, z.core.$strip>;
+type FileRef = z.infer<typeof fileRef>;
+/** Structural port to the installed Host; receipt data is runtime-validated. */
+export interface QaFormHostAttachments {
+    readonly root: string;
+    readFileStream(file: FileRef, signal?: AbortSignal): AsyncIterable<Uint8Array>;
+    saveFile(input: {
+        data: Uint8Array;
+        name: string;
+    }): Promise<unknown>;
+    fileHostPath(file: FileRef): string | undefined;
+    validateImage?(input: {
+        data: Uint8Array;
+        mediaType: "image/png" | "image/jpeg";
+        name: string;
+    }): Promise<void>;
+}
+export declare function validateFormFile(name: string, data: Buffer): string;
+/** Durable bytes belong to the form store; Host objects are verified reader projections. */
+export declare class QaFormAttachmentAdapter {
+    private readonly service;
+    private readonly host;
+    private readonly grantFile?;
+    constructor(service: () => QaFormService, host: () => QaFormHostAttachments | undefined, grantFile?: ((sessionId: string, file: string) => void) | undefined);
+    available(): boolean;
+    check(session: string, formId: string, uploadId: string): void;
+    claim(session: string, uploadId: string): {
+        record: QaFormRecord;
+        upload: QaFormRecord["uploads"][number];
+    };
+    complete(session: string, formId: string, uploadId: string, raw: unknown, signal: AbortSignal, authorize: () => void): Promise<QaFormRecord>;
+    fail(session: string, formId: string, uploadId: string): void;
+    /** Exact saved bytes are re-projected through the Host on each successful resume. */
+    readable(submission: QaFormSubmission, sessionId?: string): Promise<QaFormSubmission & {
+        resources: {
+            resource_id: string;
+            read_path: string;
+        }[];
+    }>;
+    /** Rebuild exact grants from this chat's persisted, verified submissions. */
+    restore(sessionId: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=attachments.d.ts.map

package/lib/types/forms/errors.d.ts

@@ -0,0 +1,11 @@
+import type { QaFormFieldError, QaFormResult } from "./types.js";
+export declare class QaFormError extends Error {
+    readonly code: string;
+    readonly revision?: number | undefined;
+    readonly fields?: QaFormFieldError[] | undefined;
+    constructor(code: string, message: string, revision?: number | undefined, fields?: QaFormFieldError[] | undefined);
+}
+/** Deliberately redact unexpected storage/Host exceptions at the wire boundary. */
+export declare function formFailure(error: unknown): QaFormResult<never>;
+export declare function formAssert(condition: unknown, code: string, message: string): asserts condition;
+//# sourceMappingURL=errors.d.ts.map

package/lib/types/forms/fingerprint.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Stable object-key ordering for schema and idempotency fingerprints.
+ *
+ * Lives apart from the sqlite store so every store implementation hashes the
+ * same way without importing the sqlite bridge: the client test graph mounts a
+ * store too, and a browser environment must not see `@yadsh/dsh-plugin-kit/sqlite`.
+ */
+export declare function fingerprint(value: unknown): string;
+//# sourceMappingURL=fingerprint.d.ts.map

package/lib/types/forms/gate.d.ts

@@ -0,0 +1,33 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { ToolExecution } from "@deepseek-ai/dsh-tools";
+import type { QaFormService } from "./service.js";
+import type { QaFormRecord, QaFormSubmission } from "./types.js";
+type Outcome = QaFormSubmission | {
+    status: "paused";
+    form_id: string;
+    reason: string;
+};
+/** A parked tool call is transient. Never reconstruct one from a saved draft. */
+export declare class QaFormGate {
+    readonly service: () => QaFormService;
+    private readonly rootOf;
+    private readonly busy;
+    private readonly allowed;
+    private readonly filesAvailable;
+    private readonly waiters;
+    private readonly disposers;
+    private closed;
+    private readonly clients;
+    constructor(service: () => QaFormService, rootOf: (id: string) => string | undefined, busy: (id: string) => boolean, allowed: (exec: ToolExecution) => boolean, filesAvailable?: () => boolean);
+    install(ctx: Context): void;
+    waiting(id: string): boolean;
+    touch(session: string): void;
+    hasSession(session: string): boolean;
+    request(raw: unknown, exec: ToolExecution): Promise<Outcome>;
+    notify(record: QaFormRecord, pause?: boolean): void;
+    cancel(session: string): void;
+    cancelAll(): void;
+    dispose(): void;
+}
+export {};
+//# sourceMappingURL=gate.d.ts.map

package/lib/types/forms/schema.d.ts

@@ -0,0 +1,72 @@
+import { z } from "zod";
+import type { QaFormPolicy, QaFormSchema } from "./types.js";
+export declare const DEFAULT_FORM_POLICY: Readonly<QaFormPolicy>;
+export declare const formSchemaParser: z.ZodObject<{
+    schema_version: z.ZodLiteral<1>;
+    title: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    submit_label: z.ZodOptional<z.ZodString>;
+    steps: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        items: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            answer: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"text">;
+                required: z.ZodBoolean;
+                placeholder: z.ZodOptional<z.ZodString>;
+                min_length: z.ZodOptional<z.ZodNumber>;
+                max_length: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"textarea">;
+                required: z.ZodBoolean;
+                placeholder: z.ZodOptional<z.ZodString>;
+                min_length: z.ZodOptional<z.ZodNumber>;
+                max_length: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"single_select">;
+                required: z.ZodBoolean;
+                options: z.ZodArray<z.ZodObject<{
+                    value: z.ZodString;
+                    label: z.ZodString;
+                    description: z.ZodOptional<z.ZodString>;
+                    recommended: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+                allow_other: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"multi_select">;
+                required: z.ZodBoolean;
+                options: z.ZodArray<z.ZodObject<{
+                    value: z.ZodString;
+                    label: z.ZodString;
+                    description: z.ZodOptional<z.ZodString>;
+                    recommended: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+                allow_other: z.ZodOptional<z.ZodBoolean>;
+                min_selected: z.ZodOptional<z.ZodNumber>;
+                max_selected: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>], "type">>;
+            files: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                requirement: z.ZodLiteral<"none">;
+            }, z.core.$strict>, z.ZodObject<{
+                max_count: z.ZodNumber;
+                accept: z.ZodArray<z.ZodString>;
+                max_file_size_bytes: z.ZodNumber;
+                requirement: z.ZodLiteral<"required">;
+                min_count: z.ZodNumber;
+            }, z.core.$strict>, z.ZodObject<{
+                max_count: z.ZodNumber;
+                accept: z.ZodArray<z.ZodString>;
+                max_file_size_bytes: z.ZodNumber;
+                requirement: z.ZodLiteral<"optional">;
+            }, z.core.$strict>], "requirement">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Shared by server and browser. No Node APIs or browser-supplied readiness. */
+export declare function parseFormSchema(input: unknown, policy: Readonly<QaFormPolicy>): QaFormSchema;
+export declare function resolveFormPolicy(input?: Partial<QaFormPolicy>): QaFormPolicy;
+//# sourceMappingURL=schema.d.ts.map

package/lib/types/forms/service.d.ts

@@ -0,0 +1,15 @@
+import type { QaFormPolicy, QaFormRecord, QaFormStoreApi, QaFormView } from "./types.js";
+export declare class QaFormService {
+    readonly store: QaFormStoreApi;
+    readonly policy: () => Readonly<QaFormPolicy>;
+    private readonly ownerOf;
+    constructor(store: QaFormStoreApi, policy: () => Readonly<QaFormPolicy>, ownerOf?: (session: string) => string);
+    enabled(): void;
+    create(session: string, key: string, input: unknown): QaFormRecord;
+    view(record: QaFormRecord, waiting?: boolean): QaFormView;
+    get(session: string, id: string): QaFormRecord;
+    step(session: string, id: string, stepId: string, revision: number): void;
+    command(session: string, raw: unknown): QaFormRecord;
+    private beginUpload;
+}
+//# sourceMappingURL=service.d.ts.map

package/lib/types/forms/store.d.ts

@@ -0,0 +1,25 @@
+import { SqliteDatabase } from "@yadsh/dsh-plugin-kit/sqlite";
+import type { QaFormRecord, QaFormStoreApi } from "./types.js";
+export { fingerprint } from "./fingerprint.js";
+/** Full synchronous commits: snapshot, revision and mutation receipt share one transaction. */
+export declare class QaFormStore implements QaFormStoreApi {
+    readonly storage: SqliteDatabase;
+    constructor(file: string);
+    list(session: string): QaFormRecord[];
+    get(session: string, id: string): QaFormRecord;
+    put(record: QaFormRecord): void;
+    create(session: string, key: string, schema: QaFormRecord["schema"], creator?: string): QaFormRecord;
+    editableOrSubmitted(record: QaFormRecord): void;
+    private mutationReceipt;
+    replayedMutation(formId: string, mutationId: string, input: unknown): QaFormRecord | null;
+    mutate(session: string, id: string, revision: number, mutationId: string, input: unknown, work: (r: QaFormRecord) => void): QaFormRecord;
+    /** Async work happens before this short final transaction; no revision captured at upload start. */
+    update(session: string, id: string, work: (r: QaFormRecord) => void): QaFormRecord;
+    resource(formId: string, id: string): Uint8Array;
+    saveResource(formId: string, id: string, data: Uint8Array): void;
+    storedBytes(session: string): number;
+    identityReservedBytes(creator: string): number;
+    cancelSession(session: string): void;
+    close(): void;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/types/forms/types.d.ts

@@ -0,0 +1,215 @@
+/** Browser-safe wire contract; storage and tool waiting have independent lifetimes. */
+export interface QaFormPolicy {
+    enabled: boolean;
+    maxSteps: number;
+    maxItemsPerForm: number;
+    maxOptionsPerItem: number;
+    maxSchemaBytes: number;
+    maxTextLength: number;
+    maxTotalAnswerBytes: number;
+    maxFilesPerItem: number;
+    maxFileSizeBytes: number;
+    maxTotalFileBytesPerForm: number;
+    maxConcurrentUploadsPerSession: number;
+    uploadIntentTtlSeconds: number;
+    allowedExtensions: readonly string[];
+}
+export interface QaFormOption {
+    value: string;
+    label: string;
+    description?: string | undefined;
+    recommended?: boolean | undefined;
+}
+export type QaFormAnswerSpec = {
+    type: "text" | "textarea";
+    required: boolean;
+    placeholder?: string | undefined;
+    min_length?: number | undefined;
+    max_length?: number | undefined;
+} | {
+    type: "single_select" | "multi_select";
+    required: boolean;
+    options: QaFormOption[];
+    allow_other?: boolean | undefined;
+    min_selected?: number | undefined;
+    max_selected?: number | undefined;
+};
+export type QaFormFilesSpec = {
+    requirement: "none";
+} | {
+    requirement: "required";
+    min_count: number;
+    max_count: number;
+    accept: string[];
+    max_file_size_bytes: number;
+} | {
+    requirement: "optional";
+    max_count: number;
+    accept: string[];
+    max_file_size_bytes: number;
+};
+export interface QaFormItem {
+    id: string;
+    title: string;
+    description?: string | undefined;
+    answer?: QaFormAnswerSpec | undefined;
+    files: QaFormFilesSpec;
+}
+export interface QaFormStep {
+    id: string;
+    title: string;
+    description?: string | undefined;
+    items: QaFormItem[];
+}
+export interface QaFormSchema {
+    schema_version: 1;
+    title: string;
+    description?: string | undefined;
+    submit_label?: string | undefined;
+    steps: QaFormStep[];
+}
+export type QaFormAnswer = {
+    type: "text" | "textarea";
+    text: string;
+} | {
+    type: "single_select" | "multi_select";
+    selected: string[];
+    other_text?: string | undefined;
+};
+export interface QaFormAttachment {
+    attachment_id: string;
+    version: number;
+    name: string;
+    size_bytes: number;
+    media_type: string;
+    sha256: string;
+    resource_id: string;
+}
+export interface QaFormUpload {
+    id: string;
+    item_id: string;
+    name: string;
+    size_bytes: number;
+    state: "pending" | "uploading" | "failed" | "ready" | "cancelled";
+    expires_at: number;
+    target?: {
+        attachment_id: string;
+        version: number;
+    } | undefined;
+    result?: QaFormAttachment;
+    error?: string;
+}
+export interface QaFormFieldError {
+    step_id: string;
+    item_id: string;
+    component: "answer" | "files";
+    code: string;
+    message: string;
+}
+export interface QaFormSubmission {
+    status: "submitted";
+    form_id: string;
+    submission_id: string;
+    schema_version: 1;
+    schema_hash: string;
+    form_revision: number;
+    submitted_at: string;
+    items: {
+        step_id: string;
+        item_id: string;
+        answer: QaFormAnswer | null;
+        files: QaFormAttachment[];
+    }[];
+    empty_optional_item_ids: string[];
+}
+export interface QaFormRecord {
+    storage_version: 1;
+    id: string;
+    session_id: string;
+    creator_id: string;
+    request_key: string;
+    schema: QaFormSchema;
+    schema_hash: string;
+    status: "draft" | "submitted" | "cancelled" | "expired";
+    revision: number;
+    created_at: string;
+    answers: Record<string, QaFormAnswer | null>;
+    attachments: Record<string, QaFormAttachment[]>;
+    uploads: QaFormUpload[];
+    step: number;
+    submission?: QaFormSubmission;
+}
+export type QaFormView = QaFormRecord & {
+    waiting: boolean;
+    field_errors: QaFormFieldError[];
+};
+export interface QaFormMutation {
+    form_id: string;
+    expected_revision: number;
+    mutation_id: string;
+}
+export type QaFormCommand = (QaFormMutation & {
+    action: "save";
+    answers: Record<string, QaFormAnswer | null>;
+    step: number;
+}) | (QaFormMutation & {
+    action: "submit" | "pause";
+}) | (QaFormMutation & {
+    action: "begin_upload";
+    item_id: string;
+    name: string;
+    size_bytes: number;
+    target?: {
+        attachment_id: string;
+        version: number;
+    } | undefined;
+}) | (QaFormMutation & {
+    action: "cancel_upload";
+    upload_id: string;
+}) | (QaFormMutation & {
+    action: "remove";
+    item_id: string;
+    attachment_id: string;
+    version: number;
+});
+export type QaFormResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+        form_revision?: number;
+        field_errors?: QaFormFieldError[];
+    };
+};
+/**
+ * The store surface the service programs against.
+ *
+ * The service must never reach into a concrete storage backend: the shipped
+ * store is sqlite (durable), and the client component tests mount an in-memory
+ * implementation, which a browser test environment could never load through
+ * the sqlite bridge.
+ */
+export interface QaFormStoreApi {
+    list(session: string): QaFormRecord[];
+    create(session: string, key: string, schema: QaFormRecord["schema"], creator?: string): QaFormRecord;
+    get(session: string, id: string): QaFormRecord;
+    editableOrSubmitted(record: QaFormRecord): void;
+    mutate(session: string, id: string, revision: number, mutationId: string, input: unknown, work: (r: QaFormRecord) => void): QaFormRecord;
+    update(session: string, id: string, work: (r: QaFormRecord) => void): QaFormRecord;
+    resource(formId: string, id: string): Uint8Array;
+    saveResource(formId: string, id: string, data: Uint8Array): void;
+    storedBytes(session: string): number;
+    identityReservedBytes(creator: string): number;
+    cancelSession(session: string): void;
+    /**
+     * Submit retries are idempotent: when this mutation identity was already
+     * applied, return its recorded result and refuse a reused identity that
+     * carries different data. `null` means the identity is unused.
+     */
+    replayedMutation(formId: string, mutationId: string, input: unknown): QaFormRecord | null;
+    close(): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/types/forms/validation.d.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import type { QaFormAnswer, QaFormAnswerSpec, QaFormFieldError, QaFormPolicy, QaFormRecord } from "./types.js";
+export declare const formAnswerParser: z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodEnum<{
+        text: "text";
+        textarea: "textarea";
+    }>;
+    text: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodEnum<{
+        multi_select: "multi_select";
+        single_select: "single_select";
+    }>;
+    selected: z.ZodArray<z.ZodString>;
+    other_text: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+/** Requiredness is checked at navigation/submit; invalid supplied values fail even if optional. */
+export declare function normalizeFormAnswer(spec: QaFormAnswerSpec | undefined, raw: unknown, policy: Readonly<QaFormPolicy>, requireComplete?: boolean): QaFormAnswer | null;
+export declare function validateForm(record: QaFormRecord, policy: Readonly<QaFormPolicy>, stepId?: string): QaFormFieldError[];
+//# sourceMappingURL=validation.d.ts.map

package/lib/types/index.d.ts

@@ -3,6 +3,7 @@ import type { SessionPageRequest, SessionFollowRequest, SessionPromptRequest, Se
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaSurfaceConfigRefs } from "./config.js";
+import type { QaFormCommand, QaFormResult, QaFormView } from "./forms/types.js";
 import type { QaAccountNotificationsInput } from "./types.js";
 import type { QaTurnSources } from "./provenance/types.js";
 import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaSpreadsheetPreviewSelection, QaDocumentWorkflowStatus, QaIssuedServiceToken, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaQueueStatus, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig, QaAdminSkillScope, QaAdminSkillsView, QaExpertMemoryDraft, QaExpertMemoryPage, QaExpertMemoryRecord, QaExpertMemoryScope, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceFileChunk, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackHarvestEntry, QaFeedbackHarvestResult, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaModelCatalogEntry, QaModelPair, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
@@ -26,6 +27,10 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly approvals;
     private readonly fileDeleteGate;
     private readonly userQuestions;
+    private formService?;
+    private readonly formGate;
+    private readonly formAttachments;
+    private forms;
     private readonly provenance;
     private readonly notes;
     /** Assigned after the admission gate; that gate only reads it per execution. */
@@ -54,6 +59,9 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly integrationPrincipals;
     private webServer;
     private disposeRoute;
+    private readonly oidc;
+    private disposeOidcRoute;
+    private oidcRouteKey;
     private routeKey;
     /**
      * The HTTP API an external application asks questions through. Constructed
@@ -71,6 +79,7 @@ export declare class QaSurface extends TypertRemoteService {
     private chatSharingStore;
     private readonly chatTransport;
     private readonly chatTurnGuard;
+    private readonly requestScheduler;
     private sharing;
     constructor(ctx: Context, entry?: Partial<QaSurfaceConfigRefs>);
     /** The quality store, opening its file the first time anyone needs it. */
@@ -142,6 +151,9 @@ export declare class QaSurface extends TypertRemoteService {
      */
     accountsRegister(email: string, password: string): QaAccountSession;
     accountsLogin(email: string, password: string): QaAccountSession;
+    accountsOidcStart(): Promise<import("./types.js").QaOidcStart>;
+    accountsOidcComplete(handoff: string, completionKey: string): QaAccountSession;
+    accountsOidcLogout(token: string): Promise<string | null>;
     /** Identity probe; safe to call with an empty or expired token. */
     accountsChangePassword(token: string, currentPassword: string, nextPassword: string): QaAccountSession;
     /**
@@ -226,19 +238,11 @@ export declare class QaSurface extends TypertRemoteService {
      */
     describe(): ResolvedQaSurfaceConfig;
     /**
-     * Report how much of the deployment's request ceiling the stand is using, so
-     * a browser holds its question back instead of opening another turn on a
-     * model that is busy answering the ones it allows.
-     *
-     * The count is the Host's, not the browser's: a visitor cannot see another
-     * account's chats, and the HTTP API's questions are invisible to every chat
-     * view. Read-only, and a ceiling rather than a lock — a prompt rides the
-     * native session RPC this plugin does not own, so the boundary is the
-     * browser's own courtesy, and two questions sent in the same instant can
-     * still overshoot by one. What the ceiling buys is that steady state, not a
-     * strict bound.
+     * Report server admission. Global reads expose counts only; a chat's FIFO
+     * position requires that account's current read access to the chat. The
+     * scheduler gates every root turn, including native and integration sends.
      */
-    queueStatus(): QaQueueStatus;
+    queueStatus(token?: string, sessionId?: string): QaQueueStatus;
     /**
      * Create a QA session from Host-owned inputs. With account workspaces on,
      * cwd is `<configured workspace>/.qa-users/<account UUID>` and the child is
@@ -391,6 +395,22 @@ export declare class QaSurface extends TypertRemoteService {
      * deployment with unsupported questions answers with an empty list.
      */
     pendingQuestions(token: string, sessionId: string): Promise<readonly QaPendingQuestion[]>;
+    /** Forms stay owner-scoped; UUIDs and a browser-supplied session never grant access. */
+    private admitForm;
+    listForms(token: string, sessionId: string): Promise<QaFormResult<QaFormView[]>>;
+    getForm(token: string, sessionId: string, formId: string): Promise<QaFormResult<QaFormView>>;
+    mutateForm(token: string, sessionId: string, command: QaFormCommand): Promise<QaFormResult<QaFormView>>;
+    validateFormStep(token: string, sessionId: string, formId: string, stepId: string, revision: number): Promise<QaFormResult<null>>;
+    formCapabilities(): Promise<{
+        enabled: boolean;
+        schemaVersion: number;
+        upload: boolean;
+    }>;
+    readFormAttachment(token: string, sessionId: string, formId: string, resourceId: string): Promise<QaFormResult<{
+        name: string;
+        media_type: string;
+        data: string;
+    }>>;
     /**
      * Apply the operator's answers to one parked question request. Every question
      * of the request must be present in `answers`; one the browser omits reads as
@@ -511,6 +531,7 @@ export declare class QaSurface extends TypertRemoteService {
      * immediately rather than at the next restart.
      */
     private refreshIntegrationRoutes;
+    private refreshOidcRoute;
     private refreshRoute;
     /**
      * A deployment that set `lockdown.allowSlashCommands: true` before this

package/lib/types/oidc/http.d.ts

@@ -0,0 +1,5 @@
+import type { WebServer } from "@deepseek-ai/dsh-host-webserver";
+import type { ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaOidcService } from "./service.js";
+export declare function registerQaOidcRoute(webServer: Pick<WebServer, "register">, config: ResolvedQaSurfaceConfig, service: QaOidcService): () => void;
+//# sourceMappingURL=http.d.ts.map

package/lib/types/oidc/service.d.ts

@@ -0,0 +1,30 @@
+import * as oidc from "openid-client";
+import type { QaAccounts } from "../accounts/store.js";
+import type { QaAccountSession, QaOidcStart, ResolvedQaSurfaceConfig } from "../types.js";
+/** A coarse refusal never carries provider responses, codes or tokens. */
+export declare function oidcRefusal(): Error;
+/** Authorization Code + PKCE with a browser-bound, single-use QA handoff. */
+export declare class QaOidcService {
+    private readonly options;
+    private generation;
+    private key;
+    private discovery;
+    private readonly transactions;
+    private readonly handoffs;
+    private attempts;
+    constructor(options: {
+        config: () => ResolvedQaSurfaceConfig;
+        accounts: () => QaAccounts | undefined;
+        discover?: typeof oidc.discovery;
+    });
+    private sync;
+    clear(): void;
+    private prune;
+    private client;
+    start(): Promise<QaOidcStart>;
+    /** Callback is reconstructed from configured origin, never Host/Forwarded headers. */
+    callback(requestUrl: string): Promise<string>;
+    complete(handoff: string, completionKey: string): QaAccountSession;
+    logout(token: string): Promise<string | null>;
+}
+//# sourceMappingURL=service.d.ts.map

package/lib/types/oidc.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oidc.js.map

package/lib/types/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/types/oidc.ts"],"names":[],"mappings":""}