@yadsh/dsh-qa-surface 0.18.0 → 0.20.0

package/lib/types/access/model-choices.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { QaModelOptions } from "../types.js";
+import type { SessionSelectModelRequest, SessionSelectModelValue } from "@deepseek-ai/dsh-api-session-controller/types";
+import type { QaAccessService } from "./service.js";
+import { type QaSessionModelPolicy } from "./model-policy.js";
+/** Only explicit policy grants are exposed to an ordinary account. */
+export declare function userModelOptions(ctx: Context, access: QaAccessService, token: string, sessionId: string | null, subroleId: string | null, preview: boolean): Promise<QaModelOptions>;
+/** Validate both policy membership and live availability before a user mutation. */
+export declare function assertUserModelSelection(ctx: Context, policy: () => QaSessionModelPolicy, request: {
+    readonly provider?: string;
+    readonly model?: string;
+    readonly reasoningEffort?: string | null;
+}): Promise<void>;
+/** Native durable per-session selection, without the operator-wide default save. */
+export declare function selectUserModel(ctx: Context, access: QaAccessService, token: string, request: SessionSelectModelRequest): Promise<SessionSelectModelValue>;
+//# sourceMappingURL=model-choices.d.ts.map

package/lib/types/access/model-policy.d.ts

@@ -1,20 +1,23 @@
-import type { QaModelCatalogEntry, QaModelPair, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaModelCatalogEntry, QaModelPair, QaModelReplacement, ResolvedQaSurfaceConfig } from "../types.js";
 /** The layer a resolved pair came from; the journal names it with the pair. */
 export type QaModelPolicyLayer = "account" | "subrole" | "deployment";
 /**
  * The model policy of one session: the pair its chats open on and the layer
  * that fixed it.
  *
- * That pair is what the fixed-model lockdown holds the session to. It is no
- * longer the deployment's pair, and it is not the model the visitor picked: a
- * role with a pair of its own is served by that pair, while a chat left on a
- * layer some policy has since replaced is outside its policy — exactly as a chat
- * left off the single global pair used to be.
+ * The fixed-model lockdown permits that default and explicitly granted
+ * alternatives. A user choice never changes the default for new chats.
  */
 export interface QaSessionModelPolicy {
     readonly pair: QaModelPair | undefined;
     readonly layer: QaModelPolicyLayer | undefined;
+    readonly redirectedFrom?: QaModelPair;
+    readonly allowedModels?: readonly QaModelPair[];
 }
+/** Preserve an explicit empty override and reject malformed or excessive grants. */
+export declare function normalizeAllowedModels(value: readonly QaModelPair[] | undefined, label: string): readonly QaModelPair[] | undefined;
+/** Add explicit grants without changing which model a new chat starts on. */
+export declare function withAllowedModels(policy: QaSessionModelPolicy, models: readonly QaModelPair[] | undefined, replacements: readonly QaModelReplacement[]): QaSessionModelPolicy;
 /** The session fields of the resolved config, as the policy reads them. */
 type SessionSlice = ResolvedQaSurfaceConfig["session"];
 /**
@@ -38,7 +41,10 @@ export declare function deploymentModelPair(session: Pick<SessionSlice, "provide
  * @param layers - the layers in priority order, `undefined` where a layer keeps
  *   no opinion.
  */
-export declare function resolveModelPolicy(layers: Partial<Record<QaModelPolicyLayer, QaModelPair | undefined>>): QaSessionModelPolicy;
+export declare function resolveModelPolicy(layers: Partial<Record<QaModelPolicyLayer, QaModelPair | undefined>>, replacements?: readonly QaModelReplacement[]): QaSessionModelPolicy;
+/** Resolve only explicitly configured exact redirects; never guess from catalog order. */
+export declare function replaceModelPair(pair: QaModelPair | undefined, replacements: readonly QaModelReplacement[]): QaModelPair | undefined;
+export declare function normalizeModelReplacements(input: readonly QaModelReplacement[] | undefined): readonly QaModelReplacement[];
 /**
  * The provider, model and reasoning effort a live agent carries, as the
  * lockdown reads them off `agent.options`.

package/lib/types/access/model.d.ts

@@ -1,4 +1,13 @@
 import type { QaCapabilityConfig, QaCapabilityDescriptor, QaCapabilitySelection, QaEffectiveCapabilityPolicy, QaSkillAccess, QaSkillAssignmentOverride, QaSkillDescriptor, QaSubrole, QaToolSelection, QaUserAccess } from "../types.js";
+/**
+ * Normalize one queue-slots override.
+ *
+ * An absent field keeps no opinion and the layer below it speaks. 0 is a real
+ * value — it lifts the ceiling for this role or account — while anything that
+ * is not an integer from 0 to {@link QA_MAX_ACTIVE_REQUESTS_MAX} is refused,
+ * the same range the deployment's own field accepts.
+ */
+export declare function normalizeQueueSlots(value: number | undefined, label: string): number | undefined;
 /**
  * Normalize one Tool selection, accepting the pre-split flat list.
  *

package/lib/types/access/queue-policy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The request-ceiling chain, folded where a turn is admitted.
+ *
+ * The deployment's `session.maxActiveRequests` is the profile's default, and a
+ * role or an account may override it — the same three layers the model policy
+ * folds, read per turn rather than once at boot, so a settings write reaches
+ * the next admission without reloading the plugin.
+ */
+/** The layer an effective ceiling came from; diagnostics name it with the value. */
+export type QaQueueSlotsLayer = "account" | "subrole" | "deployment";
+export interface QaQueueSlotsPolicy {
+    readonly limit: number;
+    readonly layer: QaQueueSlotsLayer;
+}
+/**
+ * Fold the named layers into one effective ceiling.
+ *
+ * The first layer that names a value wins outright: an account that overrides
+ * its role says how many slots it means, and a role that keeps no opinion
+ * defers to the deployment below it. 0 is a real value — a layer may drop the
+ * ceiling for its own principal even when the deployment sets one.
+ * @param layers - the layers in priority order; only `deployment` is required,
+ *   because the profile default always speaks.
+ */
+export declare function resolveQueueSlots(layers: {
+    readonly account?: number | undefined;
+    readonly subrole?: number | undefined;
+    readonly deployment: number;
+}): QaQueueSlotsPolicy;
+//# sourceMappingURL=queue-policy.d.ts.map

package/lib/types/access/service.d.ts

@@ -223,6 +223,32 @@ export declare class QaAccessService {
      * @param sessionId - the chat being opened.
      */
     modelPolicyFor(sessionId: string): QaSessionModelPolicy;
+    /** Authorize a draft role before exposing its model grants. */
+    draftModelPolicy(token: string, requested: string | null, preview: boolean): QaSessionModelPolicy;
+    /** Model mutations and their choices belong to the chat owner, including for admins. */
+    userSessionModelPolicy(token: string, sessionId: string): QaSessionModelPolicy;
+    private modelPolicyForAssignment;
+    /**
+     * The request ceiling one chat's turns fill against: the account's override,
+     * else the role the chat runs under, else the deployment's — the same layers
+     * {@link modelPolicyFor} folds, read per admission rather than once at boot.
+     * @param sessionId - the chat whose turn is being admitted or reported.
+     */
+    queueSlotsFor(sessionId: string): number;
+    /**
+     * The request ceiling one account's not-yet-created chats ask against: the
+     * pre-send read has a token but no chat to name, so the role layer is the
+     * account's default role.
+     * @param userId - the account the read is for; without one the deployment
+     *   default speaks.
+     */
+    queueSlotsForUser(userId: string): number;
+    /**
+     * The named layers behind one chat's ceiling, for the resolver.
+     * @param sessionId - the chat, or nothing for the account-only read.
+     * @param userId - the account whose own chain answers when no chat exists.
+     */
+    private queueLayersFor;
     /**
      * Refuse a policy the Host cannot serve before it is stored.
      * @param pair - the pair as edited, before normalization.
@@ -242,6 +268,7 @@ export declare class QaAccessService {
     deleteSubrole(token: string, id: string, replacementId: string | null): void;
     updateCommon(token: string, input: QaCapabilitySelection): QaCapabilitySelection;
     updateAssignment(token: string, userId: string, input: QaUserAccess): Promise<QaUserAccess>;
+    assertAlternativesServable(input: readonly QaModelPair[] | undefined): Promise<void>;
     /** The accounts store, or the refusal this operation names. */
     private requireAccounts;
     /**

package/lib/types/account-remotes.d.ts

@@ -1,6 +1,6 @@
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import { QaAccounts } from "./accounts/store.js";
-import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
+import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaHistoryFolderTarget, QaOwnedSessionsResult, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
 /**
  * Host-side bodies of the account remotes the `QaSurface` service exposes.
  * The `@Remote`-decorated signatures stay on the service class (typert code
@@ -42,9 +42,7 @@ export interface QaAccountRemotes {
      * delegated session, which takes session lineage, and that lives in
      * `QaAccessService.claimSessions` — one entry point, no path around it.
      */
-    ownedSessions(token: string): {
-        readonly ids: readonly string[];
-    };
+    ownedSessions(token: string): QaOwnedSessionsResult;
     /**
      * Every chat-ownership entry with owner display names; the cross-user view
      * admin browsers group the sidebar by. Ordinary accounts are refused with
@@ -84,6 +82,9 @@ export interface QaAccountRemotes {
     setServiceTokenClarifications(token: string, tokenId: string, allowed: boolean): {
         readonly updated: boolean;
     };
+    setServiceTokenHistoryFolder(token: string, tokenId: string, folder: QaHistoryFolderTarget | null): {
+        readonly updated: boolean;
+    };
 }
 /** Build the account-remotes context for one `QaSurface` service instance. */
 export declare function createQaAccountRemotes(options: {

package/lib/types/accounts/database.d.ts

@@ -1,3 +1,4 @@
+import type { QaHistoryFolderTarget } from "../types/accounts.js";
 import { SqliteDatabase } from "@yadsh/dsh-plugin-kit/sqlite";
 import type { QaSkillActivationRecord } from "../types.js";
 import { type AccountsFile, type StoredOwnership, type StoredUser } from "./file.js";
@@ -13,6 +14,7 @@ interface PasswordResetRow {
  * nowhere else.
  */
 export interface StoredServiceToken {
+    readonly historyFolder?: QaHistoryFolderTarget;
     readonly allowClarifications: boolean;
     readonly id: string;
     readonly userId: string;
@@ -108,6 +110,9 @@ export declare class QaAccountsDatabase {
     recordIntegrationRequestPolicy(sessionId: string, requestId: string, allowed: boolean): void;
     integrationClarificationsAllowed(sessionId: string, requestId: string): boolean;
     setServiceTokenClarifications(userId: string, tokenId: string, allowed: boolean): boolean;
+    setServiceTokenHistoryFolder(userId: string, tokenId: string, folder: QaHistoryFolderTarget | null): boolean;
+    recordIntegrationSessionFolder(userId: string, sessionId: string, folder: QaHistoryFolderTarget): void;
+    integrationSessionFolders(userId: string): Readonly<Record<string, QaHistoryFolderTarget>>;
     /**
      * One integration token by id, revoked and expired ones included.
      *

package/lib/types/accounts/store.d.ts

@@ -1,4 +1,5 @@
 import type { QaAccountIdentityField, QaAccountNotificationsInput, QaAccountProfile, QaAccountProfileInput, QaAccountRole, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaAccessUser, QaAdminAccountRow, QaClaimResult, QaEffectiveCapabilityPolicy, QaOwnershipEntry, QaIssuedServiceToken, QaPasswordResetRequest, QaServiceTokenSummary, QaSkillActivationRecord, QaUserAccess, QaWhoamiResult } from "../types.js";
+import type { QaHistoryFolderTarget, QaOwnedSessionsResult } from "../types/accounts.js";
 import { type StoredOwnership, type StoredUser } from "./file.js";
 import { type QaServiceTokenScope } from "./service-token.js";
 export { QaAccountsError } from "./errors.js";
@@ -41,6 +42,7 @@ export interface QaSessionFacts {
 }
 /** What a caller asks for when it mints an integration token. */
 export interface QaServiceTokenIssueInput {
+    readonly historyFolder?: QaHistoryFolderTarget | null;
     /** A note for the operator's token list; empty becomes a generic label. */
     readonly label?: string;
     /** Requested scopes; unknown ones are dropped, explicit empty grants none. */
@@ -57,6 +59,7 @@ export interface QaServiceTokenIssueInput {
 }
 /** What a presented integration token resolved to. */
 export interface QaVerifiedServiceToken {
+    readonly historyFolder?: QaHistoryFolderTarget;
     readonly allowClarifications: boolean;
     readonly tokenId: string;
     readonly userId: string;
@@ -443,6 +446,9 @@ export declare class QaAccounts {
     recordIntegrationRequestPolicy(sessionId: string, requestId: string, allowed: boolean): void;
     setServiceTokenClarifications(token: string, tokenId: string, allowed: boolean): boolean;
     integrationClarificationsAllowed(sessionId: string, requestId: string): boolean;
+    setServiceTokenHistoryFolder(token: string, tokenId: string, input: QaHistoryFolderTarget | null): boolean;
+    recordIntegrationSessionFolder(userId: string, sessionId: string, folder: QaHistoryFolderTarget): void;
+    ownedSessionsWithFolders(token: string): QaOwnedSessionsResult;
     /** Revoke one integration token of an account the caller has established. */
     revokeServiceTokenFor(user: QaAccountUserPublic, tokenId: string): boolean;
     /** The caller if it administers the deployment, or a refusal. */

package/lib/types/attachment-access.d.ts

@@ -0,0 +1,29 @@
+import type { Context } from "@deepseek-ai/cordis";
+interface SessionSource {
+    readonly id: unknown;
+    snapshotEvents?(): readonly unknown[];
+}
+export interface QaAttachmentRecovery {
+    readonly readEvents?: (sessionId: string) => Promise<readonly unknown[]>;
+    readonly restoreFiles?: (sessionId: string) => Promise<void>;
+}
+/** Exact attachment capabilities, owned by one admitted conversation. */
+export declare class QaAttachmentAccess {
+    private readonly ctx;
+    private readonly recovery;
+    private readonly bindings;
+    constructor(ctx: Context, recovery?: QaAttachmentRecovery);
+    root(): string | undefined;
+    admit(session: SessionSource): Promise<void>;
+    inherit(session: SessionSource, parentId: string): void;
+    /** Only Host-admitted file blocks are authority; text and tool output are not. */
+    observe(sessionId: string, events: readonly unknown[]): void;
+    /** Called only after a durable form's bytes and session ownership are verified. */
+    grantFile(sessionId: string, file: string): void;
+    files(sessionId: string): readonly string[];
+    private publish;
+    revoke(sessionId: string): void;
+    dispose(): void;
+}
+export {};
+//# sourceMappingURL=attachment-access.d.ts.map

package/lib/types/chat-sharing/search.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { SessionSearchValue } from "@deepseek-ai/dsh-api-session-controller/types";
+/** Apply account scope before the provider's ranking/limit, then recheck each read. */
+export declare function searchQaChats(ctx: Context, query: string, visible: () => Promise<ReadonlySet<string>>, signal: AbortSignal): Promise<SessionSearchValue>;
+//# sourceMappingURL=search.d.ts.map

package/lib/types/chat-sharing/transport.d.ts

@@ -20,7 +20,7 @@ export declare class QaChatTransport {
     prompt(token: string, request: SessionPromptRequest, signal: AbortSignal): Promise<SessionPromptValue>;
     attachment(token: string, request: SessionAttachmentRequest): Promise<SessionAttachmentValue>;
     rename(token: string, request: SessionRenameRequest): Promise<SessionRenameValue>;
-    selectModel(token: string, request: SessionSelectModelRequest): Promise<SessionSelectModelValue>;
+    selectModel(token: string, request: SessionSelectModelRequest, select?: () => Promise<SessionSelectModelValue>): Promise<SessionSelectModelValue>;
     cancel(token: string, id: string): Promise<SessionCancelValue>;
     updateQueue(token: string, request: SessionUpdateQueueRequest): Promise<SessionUpdateQueueValue>;
     private ownerOperation;

package/lib/types/client/QaAccountsController.d.ts

@@ -1,4 +1,4 @@
-import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaAccountNotificationsInput, QaAccountProfileInput, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaHistoryFolderTarget, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, ResolvedQaSurfaceConfig } from "../types.js";
 import type { QaOidcBrowser } from "./oidc-browser.js";
 import type { QaAccountsApi, QaIntegrationTokenResult, StorageLike } from "./types.js";
 /**
@@ -31,6 +31,7 @@ export type QaAccountsSnapshot = {
      * by this list rather than by the sidebar's.
      */
     readonly ownIds: readonly string[];
+    readonly integrationFolders?: Readonly<Record<string, QaHistoryFolderTarget>>;
     /**
      * The full ownership map; admins only, empty for ordinary accounts and
      * whenever the admin listing was refused or unavailable.
@@ -186,6 +187,7 @@ export declare class QaAccountsController {
      */
     revokeServiceToken(tokenId: string): Promise<QaIntegrationTokenResult<null>>;
     setServiceTokenClarifications(tokenId: string, allowed: boolean): Promise<QaIntegrationTokenResult<null>>;
+    setServiceTokenHistoryFolder(tokenId: string, folder: QaHistoryFolderTarget | null): Promise<QaIntegrationTokenResult<null>>;
     private authenticate;
     /** Own the account, migrate the legacy index, replay held ratings, then auth. */
     private enterSession;

package/lib/types/client/QaSessionController.d.ts

@@ -1,8 +1,9 @@
 import type { ConnectionGenerationState } from "@deepseek-ai/dsh-client-connection/client";
 import type { QaSharingApi } from "./chat-sharing-api.js";
 import type { QaAttachmentDraft, QaQueueOperation, QaSessionState, ResolvedQaSurfaceConfig } from "../types.js";
+import { type QaFormApi } from "./forms.js";
 import type { QaApprovalApi, QaConversation, QaCreateSession, QaForkSession, QaFileUpload, QaQueueStatusRemote, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSlashApi, QaSourceApi, StorageLike } from "./types.js";
-import type { QaApprovalDecision, QaQuestionAnswerItem } from "../types.js";
+import type { QaApprovalDecision, QaQuestionAnswerItem, QaModelPair } from "../types.js";
 declare module "@deepseek-ai/dsh-api-session-controller/client" {
     interface SessionReferenceSourceMap {
         /** The QA surface holds the Session of the chat it is showing. */
@@ -25,6 +26,8 @@ export interface QaAccountsFacade {
     readonly onAuthRequired: () => void;
 }
 export interface QaSessionControllerOptions {
+    /** Persist a draft's source choice before it can submit its first prompt. */
+    readonly prepareSession?: (sessionId: string) => Promise<void>;
     readonly sharingApi?: QaSharingApi;
     readonly sessions: QaSessions;
     readonly api: QaSessionsApi;
@@ -47,6 +50,8 @@ export interface QaSessionControllerOptions {
      * does not answer questions: the surface then only renders what it can.
      */
     readonly questionApi?: QaQuestionApi;
+    /** Confirm this owner's form renderer before a prompt can request input. */
+    readonly formApi?: Pick<QaFormApi, "list">;
     /**
      * The slash half of the Host namespace. Absent on a page whose Host build
      * predates it: the palette then never appears and ordinary prompts keep
@@ -54,13 +59,13 @@ export interface QaSessionControllerOptions {
      */
     readonly slashApi?: QaSlashApi;
     /**
-     * The Host's live read of the request ceiling. Absent on a Host build that
-     * predates it — and unanswered, or answered by a deployment that sets no
-     * ceiling — the surface sends the way it always did: the ceiling is an
-     * arrangement between browsers about how much this stand can take, never a
-     * reason a question cannot be asked.
+     * Global admission snapshot. Managed queues accept sends even while full;
+     * legacy Hosts retain the courtesy refusal. A failed read still submits the
+     * prompt through the server's own admission boundary.
      */
     readonly queueStatus?: QaQueueStatusRemote;
+    /** Authorized per-chat queue status, polled while the Host driver is live. */
+    readonly requestStatus?: QaQueueStatusRemote;
     readonly storage?: StorageLike;
     /**
      * Browser file-upload service, resolved lazily: the page may not serve the
@@ -89,7 +94,9 @@ export interface QaSessionControllerOptions {
 export declare class QaSessionController {
     private readonly listeners;
     private readonly sessions;
+    private readonly modelApi;
     private readonly createSessionRemote;
+    private readonly prepareSession?;
     private readonly forkSessionRemote?;
     private forking;
     private inheritedThroughSeq;
@@ -97,6 +104,7 @@ export declare class QaSessionController {
     private readonly connection;
     private readonly config;
     private readonly secureSessionRemote;
+    private readonly formApi;
     private readonly sourceApi;
     private readonly chats;
     private readonly accounts;
@@ -187,6 +195,10 @@ export declare class QaSessionController {
     /** Host-side question requests of the bound chat waiting for the operator. */
     private readonly hostQuestions;
     private readonly queueRemote;
+    private readonly requestRemote;
+    private requestWaitStatus;
+    private requestReadRevision;
+    private requestReading;
     /** Last send the stand had no room for; drives the request-ceiling dialog. */
     private requestQueueNotice;
     /** Set while a running turn is polled for parked requests. */
@@ -227,6 +239,8 @@ export declare class QaSessionController {
      * favor of a fresh Host-owned session.
      */
     selectSubrole(subroleId: string, adminPreview?: boolean): Promise<void>;
+    /** Materialize a draft on demand and change only that chat's model. */
+    selectModel(pair: QaModelPair): Promise<string>;
     /**
      * The attested live session a submission may ride, or `undefined` when the
      * caller must abort. Materializing a draft chat, attesting policy and
@@ -244,12 +258,11 @@ export declare class QaSessionController {
     /**
      * What the stand answers about its load, or null when it does not answer.
      *
-     * Every failure here sends the question anyway. The ceiling exists to keep a
-     * weak model from drowning, not to be a door a browser cannot open: an
-     * unreadable count says nothing about the load, and refusing a visitor on
-     * that would be a worse answer than the one they would have got.
+     * A failed status read does not bypass the server queue. Submit normally;
+     * the Host owns admission even when the browser cannot read its load.
      */
     private readQueueStatus;
+    private refreshRequestStatus;
     /**
      * Close the request-ceiling dialog. Nothing is retried and nothing is
      * dropped: the held-back question is still the composer's own text, so asking
@@ -321,10 +334,14 @@ export declare class QaSessionController {
      * lazily ({@link materializeDraft}). Fixed-policy deployments cannot draft.
      *
      * A draft is a chat of its own, so entering one takes the screen the way
-     * {@link switchTo} does; see the note where the generation moves. Stopping the
-     * turn that was running first takes a round-trip, and a chat opened through it
-     * keeps the screen: the draft is what the visitor asked for before that click,
-     * so this call gives up rather than taking the chat back from under them.
+     * {@link switchTo} does; see the note where the generation moves. The turn
+     * another chat is answering keeps answering: the deployment's slots and its
+     * FIFO queue exist so a visitor can open a fresh chat — or send into one —
+     * without stopping the turn that is still working. This method used to stop
+     * it first, which is how «Новый чат» came to abort the running turn of the
+     * chat it left (every second send of the 28.10 acceptance wave died exactly
+     * there); a stopped turn is now the stop button's own gesture and nothing
+     * else.
      */
     startDraft(policyChange?: boolean): Promise<void>;
     /**

package/lib/types/client/QaSurface.d.ts

@@ -5,6 +5,7 @@ import type { QaRouteController } from "./QaRouteController.js";
 import type { QaAccountsController } from "./QaAccountsController.js";
 import type { QaApprovalApi, QaAccessApi, QaAdminApi, QaConversation, QaCreateSession, QaForkSession, QaFileUpload, QaQueueStatusRemote, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSkillApi, QaSlashApi, QaSourceApi } from "./types.js";
 import type { QaFormApi } from "./forms.js";
+import type { QaChatCodeSourceApi } from "./types.js";
 import type { QaSurfacePanelRegistry } from "./panels/registry.js";
 import type { QaUserSettingsSections } from "./settings-extensions/index.js";
 import type { QaAuditController } from "./audit/controller.js";
@@ -29,6 +30,7 @@ export interface QaSurfaceFace {
      */
     readonly adminApi?: QaAdminApi;
     readonly sourceApi: QaSourceApi;
+    readonly codeSourceApi?: QaChatCodeSourceApi;
     /**
      * Personal-skill half of the plugin's namespace. Absent on a page whose Host
      * build does not answer it; the settings dialog then has no skills section.

package/lib/types/client/admin/ModelPolicyEditor.d.ts

@@ -19,5 +19,7 @@ export declare function ModelPolicyEditor(props: {
     /** Prefix of the test ids, so one component serves both editors. */
     readonly testId: string;
     readonly onChange: (value: QaModelPair | undefined) => void;
+    readonly allowedModels?: readonly QaModelPair[];
+    readonly onAllowedModelsChange?: (value: readonly QaModelPair[] | undefined) => void;
 }): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=ModelPolicyEditor.d.ts.map

package/lib/types/client/code-source-styles.d.ts

@@ -0,0 +1,2 @@
+export declare const codeSourceStyles: string;
+//# sourceMappingURL=code-source-styles.d.ts.map

package/lib/types/client/components/QaChatActions.d.ts

@@ -1,7 +1,9 @@
+import type { QaHistoryRowActions } from "./QaHistoryCatalog.js";
 /** Quiet actions attached to one owned chat, outside the conversation header. */
 export declare function QaChatActions(props: {
     name: string;
-    onShare: () => void;
+    onShare?: () => void;
     onDelete?: (trigger: HTMLButtonElement) => void;
+    organization?: QaHistoryRowActions;
 }): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaChatActions.d.ts.map

package/lib/types/client/components/QaCodeSourcePicker.d.ts

@@ -0,0 +1,9 @@
+import type { QaChatCodeSources } from "../../types/code-sources.js";
+export declare function QaCodeSourcePicker(props: {
+    readonly value: QaChatCodeSources;
+    readonly pending: boolean;
+    readonly error: string | null;
+    readonly disabled: boolean;
+    readonly onSelect: (source: string | null) => Promise<void>;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=QaCodeSourcePicker.d.ts.map

package/lib/types/client/components/QaComposer.d.ts

@@ -1,7 +1,9 @@
+import type { ReactNode } from "react";
 import type { QaAttachmentDraft, QaSlashView, ResolvedQaSlashCommands } from "../../types.js";
 import { type QaAttachmentLimits } from "../attachments.js";
 import type { QaQuickQuestion } from "../types.js";
 export interface QaComposerProps {
+    readonly modelSelector?: ReactNode;
     readonly fastMode?: boolean;
     readonly onFastModeChange?: (enabled: boolean) => void;
     readonly placeholder: string;

package/lib/types/client/components/QaComposerSettings.d.ts

@@ -0,0 +1,16 @@
+import type { QaChatCodeSources } from "../../types/code-sources.js";
+import { type QaModelSelectionProps } from "../use-model-selection.js";
+export interface QaComposerSettingsProps {
+    readonly model?: QaModelSelectionProps | undefined;
+    readonly code?: {
+        readonly value: QaChatCodeSources;
+        readonly pending: boolean;
+        readonly error: string | null;
+        readonly disabled: boolean;
+        readonly defaultLabel?: string | undefined;
+        readonly onSelect: (source: string | null) => Promise<boolean>;
+    } | undefined;
+}
+/** A single quiet trigger; model and source choices keep their own Host boundaries. */
+export declare function QaComposerSettings(props: QaComposerSettingsProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=QaComposerSettings.d.ts.map

package/lib/types/client/components/QaFormItem.d.ts

@@ -1,9 +1,10 @@
-import type { QaFormAnswer, QaFormItem as Item, QaFormAttachment, QaFormUpload } from "../../forms/types.js";
+import type { QaFormAnswer, QaFormItem as Item, QaFormAttachment, QaFormUpload, QaFormFieldError } from "../../forms/types.js";
 interface Props {
     item: Item;
     answer: QaFormAnswer | null;
     files: QaFormAttachment[];
     uploads: QaFormUpload[];
+    errors?: QaFormFieldError[];
     disabled: boolean;
     onAnswer(answer: QaFormAnswer | null): void;
     onUpload(file: File, target?: {
@@ -14,7 +15,8 @@ interface Props {
     onCancel(upload: QaFormUpload): void;
     onOpen(file: QaFormAttachment): void;
 }
-/** Input requirements are separate from file requirements, including in the labels. */
+export declare function formFileSize(bytes: number): string;
+/** Each item's answers, file requirements and validation stay in one visual group. */
 export declare function QaFormItem(props: Props): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=QaFormItem.d.ts.map

package/lib/types/client/components/QaHistoryCatalog.d.ts

@@ -0,0 +1,19 @@
+import { type ReactNode } from "react";
+import type { QaChatRow, QaSidebarSection } from "./QaSidebar.js";
+export interface QaHistoryRowActions {
+    readonly pinned: boolean;
+    readonly onTogglePin: () => void;
+    readonly onMove: () => void;
+    readonly onEarlier?: () => void;
+    readonly onLater?: () => void;
+}
+/** Presentation only: no native workspace or session mutation is issued here. */
+export declare function QaHistoryCatalog(props: {
+    readonly storageKey: string;
+    readonly rows: readonly QaChatRow[];
+    readonly query: string;
+    readonly integrationFolders?: Readonly<Record<string, import("../../types/accounts.js").QaHistoryFolderTarget>>;
+    readonly sectionsOf: (rows: readonly QaChatRow[]) => readonly QaSidebarSection[];
+    readonly renderRow: (row: QaChatRow, actions: QaHistoryRowActions) => ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QaHistoryCatalog.d.ts.map

package/lib/types/client/components/QaInputForm.d.ts

@@ -10,9 +10,10 @@ interface Props {
     onStop(): Promise<void>;
     onResume(id: string): void;
     onTakeover(active: boolean): void;
+    onDismiss?(): void;
 }
-export declare function QaInputForm(props: Props): import("react/jsx-runtime").JSX.Element;
+export declare function QaInputForm(props: Props): import("react/jsx-runtime").JSX.Element | null;
 /** Session/identity-keyed parent discards account-local state and aborts transfers on switch. */
-export declare function QaInputForms(props: Omit<Props, "form">): import("react/jsx-runtime").JSX.Element | null;
+export declare function QaInputForms(props: Omit<Props, "form">): import("react/jsx-runtime").JSX.Element;
 export {};
 //# sourceMappingURL=QaInputForm.d.ts.map

package/lib/types/client/components/QaModelSelector.d.ts

@@ -0,0 +1,4 @@
+import { type QaModelSelectionProps } from "../use-model-selection.js";
+/** The server filters choices and persists selection on the native session. */
+export declare function QaModelSelector(props: QaModelSelectionProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=QaModelSelector.d.ts.map

package/lib/types/client/components/QaRequestWait.d.ts

@@ -0,0 +1,6 @@
+import type { QaQueueStatus } from "../../types.js";
+/** A queued turn belongs to the Host and starts without resending the question. */
+export declare function QaRequestWait({ status, }: {
+    readonly status: QaQueueStatus | null;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=QaRequestWait.d.ts.map

package/lib/types/client/components/QaSidebar.d.ts

@@ -54,6 +54,9 @@ export interface QaSidebarProps {
     readonly logoUrl: string | null;
     /** Storage prefix used to remember the collapsed state across reloads. */
     readonly stateKey: string;
+    /** Deployment and account scoped key for virtual history metadata. */
+    readonly organizationKey?: string;
+    readonly integrationFolders?: Readonly<Record<string, import("../../types/accounts.js").QaHistoryFolderTarget>>;
     readonly showNewChat: boolean;
     readonly busy: boolean;
     readonly onSwitch: (sessionId: string) => void;

package/lib/types/client/composer-settings-styles.d.ts

@@ -0,0 +1,2 @@
+export declare const composerSettingsStyles: string;
+//# sourceMappingURL=composer-settings-styles.d.ts.map