@yadsh/dsh-qa-surface 0.2.0 → 0.3.0

package/lib/types/accounts/store.d.ts

@@ -0,0 +1,121 @@
+import type { QaAccountRole, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult } from "../types.js";
+/**
+ * Coarse, wire-safe account failure codes. They ride the `(reason: <code>)`
+ * marker pattern the attestation path established; the browser maps them to
+ * audience-safe copy and the precise cause stays in the Host logs.
+ */
+export type QaAccountsErrorReason = "auth-required" | "admin-required" | "invalid-credentials" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere";
+export declare class QaAccountsError extends Error {
+    readonly reason: QaAccountsErrorReason;
+    constructor(reason: QaAccountsErrorReason, message: string);
+}
+interface StoredUser {
+    readonly id: string;
+    readonly email: string;
+    readonly displayName: string;
+    readonly role: QaAccountRole;
+    /** scrypt material: hex salt + hex hash. */
+    readonly passwordHash: {
+        readonly salt: string;
+        readonly hash: string;
+    };
+    readonly createdAt: string;
+    lastLoginAt: string | null;
+    /** Disabled accounts are refused at login and lose their live tokens. */
+    disabled?: boolean;
+    /**
+     * Bumped to invalidate every token ever issued to the account: the value
+     * rides the token payload and must match at verification time.
+     */
+    tokenVersion?: number;
+}
+export interface QaAccountsOptions {
+    readonly sessionTtlDays: number;
+    readonly allowRegistration: boolean;
+    /** Login/registration attempts accepted per rolling minute, store-wide. */
+    readonly maxAuthAttemptsPerMinute?: number;
+}
+/** The accounts file lives next to the DSH home the launcher exports. */
+export declare function defaultAccountsFilePath(): string;
+/**
+ * Host authority for QA accounts: the file-backed user list, the session
+ * ownership map and the HMAC account tokens. All mutations are synchronous
+ * and persisted atomically (temp file + rename); LAN scale keeps this trivial.
+ */
+export declare class QaAccounts {
+    readonly filePath: string;
+    private file;
+    private readonly authAttempts;
+    private readonly maxAuthAttemptsPerMinute;
+    private readonly sessionTtlDays;
+    private readonly allowRegistration;
+    /** mtime+size of the file as of the last load; the external-change probe. */
+    private lastLoadStamp;
+    constructor(filePath: string | undefined, options: QaAccountsOptions);
+    /**
+     * The qa-accounts CLI runs in its own process against the same file. Re-read
+     * it whenever it changed on disk, before every read or read-modify-write:
+     * without this a running Host would keep honoring tokens the CLI revoked
+     * and its next save would resurrect the CLI's change from a stale snapshot.
+     * One file, one writer at a time remains the deployment's discipline; LAN
+     * scale keeps the stat per operation trivial.
+     */
+    private reloadIfChanged;
+    private load;
+    private persist;
+    private save;
+    private pruneAuthAttempts;
+    private assertAuthBudget;
+    private userByEmail;
+    register(email: string, password: string, displayName?: string): QaAccountSession;
+    login(email: string, password: string): QaAccountSession;
+    whoami(token: string): QaWhoamiResult;
+    /** Resolve a token to its user, or null for absent/invalid/expired ones. */
+    verifyToken(token: string): string | null;
+    private mintToken;
+    /** The account behind a token, or an auth-required refusal. */
+    requireUser(token: string): StoredUser;
+    /**
+     * Ownership gate for one session: claim unowned sessions for the requesting
+     * user (first come, first served — the pre-accounts migration path), refuse
+     * foreign sessions unless the caller administers the deployment.
+     */
+    ensureSessionAccess(token: string, sessionId: string): QaAccountUserPublic;
+    /** Bulk-claim a browser's local chat index; foreign ids come back as conflicts. */
+    claimSessions(token: string, sessionIds: readonly string[]): QaClaimResult;
+    /** Session ids owned by the token's user, most recently claimed first. */
+    ownedSessionIds(token: string): readonly string[];
+    /**
+     * Every ownership entry with the owner's display name resolved at read
+     * time, oldest claim first. Admin-only: this is the cross-user view the
+     * admin sidebar groups chats by; ordinary accounts get a dedicated refusal.
+     */
+    listOwnership(token: string): readonly QaOwnershipEntry[];
+    /** Every account, file order; for `qa-accounts list`. */
+    listUsers(): readonly {
+        readonly email: string;
+        readonly displayName: string;
+        readonly role: QaAccountRole;
+        readonly disabled: boolean;
+        readonly createdAt: string;
+        readonly lastLoginAt: string | null;
+    }[];
+    /** Create an account outside the self-registration gate. */
+    addUser(email: string, password: string, options?: {
+        displayName?: string;
+        role?: QaAccountRole;
+    }): QaAccountUserPublic;
+    private editUser;
+    /** Grant or revoke the admin role. */
+    setUserRole(email: string, role: QaAccountRole): QaAccountUserPublic;
+    /**
+     * Disable an account: future logins are refused and every live token is
+     * invalidated (the token version bumps). `enable` does not resurrect old
+     * tokens — the account signs in again.
+     */
+    setUserDisabled(email: string, disabled: boolean): QaAccountUserPublic;
+    /** Invalidate every token of the account (password-leak response). */
+    revokeTokens(email: string): QaAccountUserPublic;
+}
+export {};
+//# sourceMappingURL=store.d.ts.map

package/lib/types/attestation.d.ts

@@ -8,7 +8,7 @@
  * audience, precise enough for an operator reading the browser console to
  * know which class of mismatch to look for in the Host logs.
  */
-export type QaAttestationReason = "agent-unavailable" | "workspace-unavailable" | "composition-mismatch" | "permission-preset" | "adoption-refused" | "unknown-tools" | "attestation-failed";
+export type QaAttestationReason = "agent-unavailable" | "workspace-unavailable" | "composition-mismatch" | "permission-preset" | "adoption-refused" | "unknown-tools" | "auth-required" | "session-owned-elsewhere" | "attestation-failed";
 /** Host rejection whose wire message carries the coarse reason marker. */
 export declare class QaAttestationError extends Error {
     readonly reason: QaAttestationReason;

package/lib/types/cli.d.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+export interface CliIo {
+    out(line: string): void;
+    err(line: string): void;
+}
+/** Execute one management command; returns the process exit code. */
+export declare function run(argv: readonly string[], io: CliIo, readPassword?: () => string): number;
+export declare function main(argv: readonly string[], io?: CliIo, readPassword?: () => string): number;
+//# sourceMappingURL=cli.d.ts.map

package/lib/types/client/QaAccountsController.d.ts

@@ -0,0 +1,95 @@
+import type { QaAccountUserPublic, QaOwnershipEntry, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaAccountsApi, StorageLike } from "./types.js";
+export type QaAccountsSnapshot = {
+    readonly stage: "checking";
+} | {
+    readonly stage: "gate";
+    readonly mode: "login" | "register";
+    readonly busy: boolean;
+    readonly error: string | null;
+} | {
+    readonly stage: "authed";
+    readonly user: QaAccountUserPublic;
+    /**
+     * Server-known chat ids; the sidebar list authority. Own chats always,
+     * plus every mapped chat for an admin (the cross-user grouping view).
+     */
+    readonly ownedIds: readonly string[];
+    /**
+     * The full ownership map; admins only, empty for ordinary accounts and
+     * whenever the admin listing was refused or unavailable.
+     */
+    readonly ownership: readonly QaOwnershipEntry[];
+    /** Bumped whenever ownedIds or ownership changes; re-projects lists. */
+    readonly ownedRevision: number;
+};
+/**
+ * Audience-safe copy for the coarse account refusal codes; anything unknown
+ * falls back to the generic line.
+ */
+export declare function accountsErrorMessage(code: string | null): string;
+/** Extract the coarse account reason code from a Host wire failure. */
+export declare function accountsReasonOf(failure: unknown): string | null;
+export interface QaAccountsControllerOptions {
+    readonly remote: QaAccountsApi;
+    readonly storage: StorageLike | undefined;
+    /** Config snapshot getter; the token key follows the deployment identity. */
+    readonly config: () => ResolvedQaSurfaceConfig;
+    /**
+     * The legacy per-browser chat index at login time, for the one-shot
+     * ownership migration; conflicts are dropped through {@link forgetChat}.
+     */
+    readonly legacyChatIds?: () => readonly string[];
+    readonly forgetChat?: (sessionId: string) => void;
+}
+/**
+ * Browser-side account lifecycle: token persistence, the checking → gate →
+ * authed state machine, and the ownership bookkeeping the sidebar list is
+ * built from. Anonymous/failed identity never blocks a deployment with
+ * accounts disabled — the caller simply does not mount this controller.
+ */
+export declare class QaAccountsController {
+    private readonly options;
+    private readonly listeners;
+    private snapshot;
+    private tokenValue;
+    private disposed;
+    constructor(options: QaAccountsControllerOptions);
+    getSnapshot: () => QaAccountsSnapshot;
+    subscribe: (listener: () => void) => (() => void);
+    dispose(): void;
+    /** The bearer token threaded into gated remotes; null while anonymous. */
+    /** The bearer token threaded into gated remotes; null while anonymous. */
+    token(): string | null;
+    /** Server-owned chat ids (empty until authed); falls back to nothing. */
+    ownedIds(): readonly string[];
+    /** Boot probe: restore the stored token and ask the Host who it is. */
+    start(): Promise<void>;
+    login(email: string, password: string): Promise<void>;
+    register(email: string, password: string): Promise<void>;
+    setMode(mode: "login" | "register"): void;
+    /** Drop the token and return to the gate (logout or expired identity). */
+    signOut(): void;
+    /** Claim one freshly created chat so the ownership map stays current. */
+    claimNewSession(sessionId: string): Promise<void>;
+    private authenticate;
+    /** Own the account, migrate the legacy index, then project authed. */
+    private enterSession;
+    /** Refresh the owned list after index changes; cheap enough to re-pull. */
+    refreshOwned(): Promise<void>;
+    /** The admin cross-user ownership view; failures degrade to an empty map. */
+    private fetchOwnership;
+    /** Session id → owner display name; empty unless an admin is signed in. */
+    ownerNames(): ReadonlyMap<string, string>;
+    /**
+     * The chat owner's display name for author labels: admins see it on
+     * foreign chats only; the owner themself and ordinary accounts see none.
+     */
+    messageAuthorOf(sessionId: string): string | undefined;
+    private readStoredToken;
+    private saveStoredToken;
+    private clearStoredToken;
+    private tokenKey;
+    private publish;
+}
+//# sourceMappingURL=QaAccountsController.d.ts.map

package/lib/types/client/QaConfigController.d.ts

@@ -1,4 +1,4 @@
-import type { SettingsScope } from "@deepseek-ai/dsh-client-runtime/client";
+import type { SettingsScope } from "@deepseek-ai/dsh-client-ui-settings/client";
 import type { QaSurfaceConfig, ResolvedQaSurfaceConfig } from "../types.js";
 export interface QaConfigSnapshot {
     readonly status: "loading" | "ready" | "unavailable" | "error";

package/lib/types/client/QaSessionController.d.ts

@@ -1,13 +1,33 @@
-import type { HostDescriptionSource } from "@deepseek-ai/dsh-client-connection/client";
+import type { ConnectionGenerationState } from "@deepseek-ai/dsh-client-connection/client";
 import type { QaImageDraft, QaSessionState, ResolvedQaSurfaceConfig } from "../types.js";
-import type { QaSecureSession, QaSessions, QaSessionsApi, StorageLike } from "./types.js";
+import type { QaConversation, QaSecureSession, QaSessions, QaSessionsApi, QaSourceApi, StorageLike } from "./types.js";
+export interface QaAccountsFacade {
+    /** The account bearer token, or null while anonymous. */
+    readonly token: () => string | null;
+    /** Server-owned chat ids; the list authority while accounts are on. */
+    readonly ownedIds: () => readonly string[];
+    /**
+     * The chat owner's display name for author labels; admins see it on
+     * foreign chats only, everyone else gets undefined.
+     */
+    readonly messageAuthorOf: (sessionId: string) => string | undefined;
+    /** Called after a new chat binds, so ownership stays current. */
+    readonly onSessionCreated: (sessionId: string) => void;
+    /** Called when the Host refuses with auth-required (expired/rotated). */
+    readonly onAuthRequired: () => void;
+}
 export interface QaSessionControllerOptions {
     readonly sessions: QaSessions;
     readonly api: QaSessionsApi;
-    readonly connection: HostDescriptionSource;
+    /** Conversation assembly feeding the transcript projection. */
+    readonly conversation: QaConversation;
+    readonly connection: ConnectionGenerationState;
     readonly config: ResolvedQaSurfaceConfig;
     readonly secureSession: QaSecureSession;
+    readonly sourceApi?: QaSourceApi;
     readonly storage?: StorageLike;
+    /** Present while the deployment gates QA users with accounts. */
+    readonly accounts?: QaAccountsFacade;
     readonly timeoutMs?: number;
     /**
      * Minimum spacing between projections of a running turn's stream frames.
@@ -26,15 +46,22 @@ export declare class QaSessionController {
     private readonly listeners;
     private readonly sessions;
     private readonly api;
+    private readonly conversation;
     private readonly connection;
     private readonly config;
     private readonly secureSessionRemote;
+    private readonly sourceApi;
     private readonly chats;
+    private readonly accounts;
+    /** Per-chat attachment URL cache; blob URLs die with the chat binding. */
+    private readonly assets;
     private readonly timeoutMs;
     private readonly streamIntervalMs;
     private state;
     private session;
+    private conversationBinding;
     private unsubscribeSession;
+    private unsubscribeChat;
     private readonly unsubscribeConnection;
     private ensuring;
     private materializing;
@@ -50,6 +77,8 @@ export declare class QaSessionController {
     private disposed;
     private generation;
     private chatsRevision;
+    /** Host-side provenance of the bound chat, merged into the projection. */
+    private readonly hostSources;
     constructor(options: QaSessionControllerOptions);
     getSnapshot: () => QaSessionState;
     subscribe: (listener: () => void) => (() => void);
@@ -93,15 +122,19 @@ export declare class QaSessionController {
     viewSubagent(id: string, title: string): Promise<void>;
     /** Leave the subagent transcript and re-open the chat it was launched from. */
     closeSubagent(): Promise<void>;
-    /** This browser's indexed chat ids, most recently used first. */
+    /** This browser's chat ids: the owned list when accounts are on, else the
+     * local index. Both intersect the host session list at projection time. */
     chatIds(): readonly string[];
     /** The bound session id, or null while no chat is bound. */
     activeSessionId(): string | null;
     /**
      * Resolve one durable image attachment of the bound session into a
-     * browser-usable URL. The caller caches; failures surface as broken views.
+     * browser-usable URL. Resolutions are cached per chat in the asset
+     * repository (attachment ids repeat across chats) and revoked when the chat
+     * is unbound; failures surface as broken views and retry on demand.
      */
     readImage(attachmentId: string): Promise<string>;
+    private readAttachmentUrl;
     /**
      * Remove one chat from this browser's index. Deleting the chat that is
      * currently open also forgets the persisted id and starts a fresh attested
@@ -120,10 +153,10 @@ export declare class QaSessionController {
      * re-opening re-materializes it. Step 2 — when that refused session is
      * still blank (it never received the prompt, so there is nothing to lose) —
      * starts a fresh attested session instead. A session with history is left
-     * alone: recreating it would silently drop the conversation.
+     * alone: recreating it would silently drop the conversation. Returns the
+     * attested session id, or null when nothing was attested.
      */
     private recoverForSend;
-    private createSession;
     private bind;
     private unbind;
     private waitForConnection;
@@ -140,6 +173,12 @@ export declare class QaSessionController {
     private clearStreamFlush;
     private publish;
     private fail;
+    /**
+     * Attest the currently bound session. `ok` carries the session id the proof
+     * was issued for; `stale` means the binding changed while the request was
+     * in flight, so nothing was written — the newer binding manages its own
+     * attestation; `refused` is a genuine admission refusal of this binding.
+     */
     private attestPolicy;
     private emit;
 }

package/lib/types/client/QaSurface.d.ts

@@ -1,15 +1,20 @@
-import type { HostDescriptionSource } from "@deepseek-ai/dsh-client-connection/client";
+import type { ConnectionGenerationState } from "@deepseek-ai/dsh-client-connection/client";
 import type { InjectFace, PropsRuntime } from "@deepseek-ai/dsh-client-ui-slots";
 import type { QaConfigController } from "./QaConfigController.js";
 import type { QaRouteController } from "./QaRouteController.js";
-import type { QaSecureSession, QaSessions, QaSessionsApi } from "./types.js";
+import type { QaAccountsController } from "./QaAccountsController.js";
+import type { QaConversation, QaSecureSession, QaSessions, QaSessionsApi, QaSourceApi } from "./types.js";
 export interface QaSurfaceFace {
     readonly route: QaRouteController;
     readonly config: QaConfigController;
     readonly sessions: QaSessions;
+    readonly conversation: QaConversation;
     readonly api: QaSessionsApi;
-    readonly connection: HostDescriptionSource;
+    readonly connection: ConnectionGenerationState;
     readonly secureSession: QaSecureSession;
+    readonly sourceApi: QaSourceApi;
+    /** Present when the deployment mounts the QA account gate. */
+    readonly accounts?: QaAccountsController;
 }
 type QaSurfaceProps = PropsRuntime<"shell.overlay"> & InjectFace<QaSurfaceFace>;
 export declare function QaSurface(props: QaSurfaceProps): import("react/jsx-runtime").JSX.Element | null;

package/lib/types/client/QaTranscriptAdapter.d.ts

@@ -1,5 +1,5 @@
-import type { ConversationSnapshot } from "@deepseek-ai/dsh-client-runtime/client";
-import type { QaMessage, QaSource } from "../types.js";
+import type { ConversationSnapshot } from "@deepseek-ai/dsh-client-ui-conversation/client";
+import type { QaMessage } from "../types.js";
 /**
  * The hidden regeneration prompt. Regenerate sends this as an ordinary
  * prompt — the session has no truncation seam, so a "variant" is a real
@@ -8,15 +8,10 @@ import type { QaMessage, QaSource } from "../types.js";
  */
 export declare const QA_REGENERATE_MARKER = "\u041F\u0435\u0440\u0435\u0433\u0435\u043D\u0435\u0440\u0438\u0440\u0443\u0439 \u0441\u0432\u043E\u0439 \u043F\u0440\u0435\u0434\u044B\u0434\u0443\u0449\u0438\u0439 \u043E\u0442\u0432\u0435\u0442 \u2014 \u0434\u0430\u0439 \u043D\u043E\u0432\u044B\u0439 \u0432\u0430\u0440\u0438\u0430\u043D\u0442, \u043D\u0435 \u043F\u043E\u0432\u0442\u043E\u0440\u044F\u044F \u043F\u0440\u0435\u0434\u044B\u0434\u0443\u0449\u0438\u0439.";
 /** Project end-user messages plus optional operator-approved work detail. */
-export declare function projectTranscript(snapshot: ConversationSnapshot, options?: {
+export declare function projectTranscript(snapshot: ConversationSnapshot | undefined, options?: {
+    /** Live turn lifecycle from the bound Session (drives running-row status). */
+    readonly running?: boolean;
     readonly showToolActivity?: boolean;
     readonly showReasoning?: boolean;
 }): readonly QaMessage[];
-/**
- * Collect the sources this chat has actually touched, in first-use order:
- * fetched pages, searches, and files read. This is the same tool activity the
- * work groups render, projected as a flat citation-style list, so it carries
- * no information beyond `ui.showToolActivity`.
- */
-export declare function projectSources(snapshot: ConversationSnapshot): readonly QaSource[];
 //# sourceMappingURL=QaTranscriptAdapter.d.ts.map

package/lib/types/client/components/Markdown.d.ts

@@ -1,9 +1,19 @@
+import type { QaSource } from "../../types.js";
+import { type QaSourceRefs } from "./source-refs.js";
+/** Inline source awareness handed down from the owning assistant message. */
+export interface MarkdownSourceContext {
+    readonly refs?: QaSourceRefs;
+    /** Open a path-backed source in the sources drawer's detail view. */
+    readonly onSourceOpen?: (source: QaSource) => void;
+}
 /**
  * Deliberately small, HTML-free Markdown renderer for assistant-visible text.
  * Memoized on the text value: stream updates re-render only the message whose
  * text actually changed, so committed history is never re-parsed.
  */
-export declare const Markdown: import("react").MemoExoticComponent<({ text, }: {
+export declare const Markdown: import("react").MemoExoticComponent<({ text, sourceRefs, onSourceOpen, }: {
     readonly text: string;
+    readonly sourceRefs?: QaSourceRefs;
+    readonly onSourceOpen?: (source: QaSource) => void;
 }) => import("react/jsx-runtime").JSX.Element>;
 //# sourceMappingURL=Markdown.d.ts.map

package/lib/types/client/components/QaAgentsDrawer.d.ts

@@ -1,4 +1,4 @@
-import type { SessionSummary } from "@deepseek-ai/dsh-client-runtime/client";
+import type { SessionSummary } from "@deepseek-ai/dsh-api-session-controller/client";
 /** One row of the agents panel: a subagent session of the open chat. */
 export interface QaSubagentRow {
     readonly id: string;

package/lib/types/client/components/QaAuthGate.d.ts

@@ -0,0 +1,15 @@
+import type { QaAccountsController, QaAccountsSnapshot } from "../QaAccountsController.js";
+export interface QaAuthGateProps {
+    readonly accounts: QaAccountsController;
+    readonly snapshot: QaAccountsSnapshot;
+    readonly title: string;
+    readonly logoUrl: string | null;
+    readonly allowRegistration: boolean;
+}
+/**
+ * The full-frame login/registration card shown instead of the chat while the
+ * deployment has accounts enabled and the browser holds no valid identity.
+ * Errors are the Host's coarse codes rendered as audience-safe copy.
+ */
+export declare function QaAuthGate(props: QaAuthGateProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QaAuthGate.d.ts.map

package/lib/types/client/components/QaChangelog.d.ts

@@ -0,0 +1,21 @@
+export declare const QA_VERSION: string;
+export interface QaChangelogEntry {
+    readonly version: string;
+    readonly date: string;
+    readonly sections: readonly {
+        readonly title: string;
+        readonly items: readonly string[];
+    }[];
+}
+export declare const QA_CHANGELOG: readonly QaChangelogEntry[];
+/** Props of the {@link QaChangelogModal} dialog. */
+export interface QaChangelogModalProps {
+    readonly open: boolean;
+    readonly onClose: () => void;
+}
+/**
+ * The version/changelog dialog opened from the sidebar footer. Rendering is
+ * a no-op while closed; Escape and a backdrop click close it.
+ */
+export declare function QaChangelogModal(props: QaChangelogModalProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=QaChangelog.d.ts.map

package/lib/types/client/components/QaMessage.d.ts

@@ -1,14 +1,21 @@
-import type { QaMessage as QaMessageModel } from "../../types.js";
+import type { QaMessage as QaMessageModel, QaSource, QaTurnSources } from "../../types.js";
 export interface QaMessageProps {
     readonly message: QaMessageModel;
     readonly renderMarkdown: boolean;
     readonly showTimestamp: boolean;
-    /** Storage prefix persisted message ratings live under. */
+    /**
+     * Storage prefix persisted message ratings live under. Callers scope it to
+     * the chat: message ids repeat across chats (`assistant:<seq>`).
+     */
     readonly stateKey?: string;
     /** Ask for a fresh variant of this answer; omit to hide the control. */
     readonly onRegenerate?: () => void;
     /** Resolve one durable attachment into a viewable URL. */
     readonly resolveImage?: (attachmentId: string) => Promise<string>;
+    /** Open the drawer at the exact canonical snapshot shown in this footer. */
+    readonly onOpenSources?: (sources: readonly QaSource[], complete: boolean, incompleteOrigins: QaTurnSources["incompleteOrigins"]) => void;
+    /** Open one path-backed source's detail (an inline footnote click). */
+    readonly onSourceDetail?: (source: QaSource) => void;
 }
 /**
  * Whether two transcript messages render identically. The transcript
@@ -17,5 +24,5 @@ export interface QaMessageProps {
  * comparison is by value, which keeps fresh copies cheap to recognize.
  */
 export declare function sameMessage(a: QaMessageModel, b: QaMessageModel): boolean;
-export declare const QaMessage: import("react").MemoExoticComponent<({ message, renderMarkdown, showTimestamp, stateKey, onRegenerate, resolveImage, }: QaMessageProps) => import("react/jsx-runtime").JSX.Element>;
+export declare const QaMessage: import("react").MemoExoticComponent<({ message, renderMarkdown, showTimestamp, stateKey, onRegenerate, resolveImage, onOpenSources, onSourceDetail, }: QaMessageProps) => import("react/jsx-runtime").JSX.Element>;
 //# sourceMappingURL=QaMessage.d.ts.map

package/lib/types/client/components/QaSidebar.d.ts

@@ -1,4 +1,4 @@
-import type { SessionSummary } from "@deepseek-ai/dsh-client-runtime/client";
+import type { SessionSummary } from "@deepseek-ai/dsh-api-session-controller/client";
 /** One renderable row of the chat-history sidebar. */
 export interface QaChatRow {
     readonly id: string;
@@ -7,6 +7,8 @@ export interface QaChatRow {
     readonly active: boolean;
     readonly meta: string;
     readonly updatedAt: number;
+    /** Chat owner's display name; present in the admin ownership view only. */
+    readonly ownerName?: string;
 }
 /**
  * Project this browser's indexed chat ids onto the host session list, most
@@ -14,9 +16,29 @@ export interface QaChatRow {
  * `updatedAt` (fresh messages) orders the list. Ids the host no longer lists
  * are skipped (the controller prunes them on switch).
  */
-export declare function buildChatRows(chatIds: readonly string[], byId: Readonly<Record<string, SessionSummary>>, activeId: string | null, now?: number): readonly QaChatRow[];
+export declare function buildChatRows(chatIds: readonly string[], byId: Readonly<Record<string, SessionSummary>>, activeId: string | null, ownerNameOf?: (sessionId: string) => string | undefined, now?: number): readonly QaChatRow[];
+/** One per-owner section of the admin sidebar grouping. */
+export interface QaSidebarSection {
+    /**
+     * Section header; chats nobody claimed group under "Без владельца". An
+     * empty name renders no header (the flat, non-grouped mode).
+     */
+    readonly name: string;
+    readonly rows: readonly QaChatRow[];
+}
+/**
+ * Group rows into per-owner sections for the admin view. Sections order by
+ * their freshest row so the busiest users float up; unclaimed chats go last.
+ * Row order inside a section is already the global updatedAt order.
+ */
+export declare function buildOwnerSections(rows: readonly QaChatRow[]): readonly QaSidebarSection[];
 export interface QaSidebarProps {
     readonly rows: readonly QaChatRow[];
+    /**
+     * Render per-owner sections instead of the flat list; the admin ownership
+     * view. Rows without an owner name fall into a trailing section.
+     */
+    readonly groupByOwner?: boolean;
     /** Deployment brand shown next to the logo (also while collapsed). */
     readonly title: string;
     /** Optional image logo; a built-in mark is drawn when null. */
@@ -29,6 +51,12 @@ export interface QaSidebarProps {
     readonly onNewChat: () => void;
     /** Removes a chat from this browser's index; omit to hide the control. */
     readonly onDelete?: (sessionId: string) => void;
+    /** The signed-in account; omit when accounts are disabled. */
+    readonly account?: {
+        readonly email: string;
+        readonly role: string;
+        readonly onLogout: () => void;
+    };
 }
 /**
  * Whether two sidebar row lists show the same thing. Rows are rebuilt on

package/lib/types/client/components/QaSourcesDrawer.d.ts

@@ -1,8 +1,20 @@
-import type { QaSource } from "../../types.js";
+import type { QaSource, QaTurnSources, ResolvedQaSurfaceConfig } from "../../types.js";
+import type { QaBoundSourceApi } from "../types.js";
+export declare function SourceIcon({ kind }: {
+    readonly kind: QaSource["kind"];
+}): import("react/jsx-runtime").JSX.Element;
 export interface QaSourcesDrawerProps {
     readonly sources: readonly QaSource[];
+    readonly complete: boolean;
+    readonly incompleteOrigins?: QaTurnSources["incompleteOrigins"];
+    readonly sessionId: string | null;
+    readonly sourceApi: QaBoundSourceApi;
+    readonly display: ResolvedQaSurfaceConfig["sources"]["display"];
+    readonly filePreview: ResolvedQaSurfaceConfig["sources"]["filePreview"];
+    /** Open straight onto this source's detail (an inline footnote click). */
+    readonly initialDetail?: QaSource | null;
     readonly onClose: () => void;
 }
-/** Right-hand panel listing tool-derived sources with a detail pane. */
-export declare function QaSourcesDrawer({ sources, onClose }: QaSourcesDrawerProps): import("react/jsx-runtime").JSX.Element;
+/** Canonical grouped source panel and safe local-file preview. */
+export declare function QaSourcesDrawer({ sources, complete, incompleteOrigins, sessionId, sourceApi, display, filePreview, initialDetail, onClose, }: QaSourcesDrawerProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaSourcesDrawer.d.ts.map

package/lib/types/client/components/QaTurnRail.d.ts

@@ -0,0 +1,59 @@
+import { type RefObject } from "react";
+import type { QaMessage } from "../../types.js";
+/**
+ * One mark of the turn rail: the user prompt that opens the turn, a bounded
+ * answer preview for the hover tooltip, and the message id that anchors the
+ * jump (the prompt's message slot in the transcript).
+ */
+export interface QaTurnRailItem {
+    /** 1-based position in the visible transcript; also the React key. */
+    readonly turn: number;
+    /** The user message id that opens the turn (scroll anchor). */
+    readonly id: string;
+    readonly prompt: string;
+    readonly response: string;
+}
+/** Transcript attribute marking the message slot that opens a turn. */
+export declare const QA_TURN_ANCHOR_ATTRIBUTE = "data-dsh-qa-turn-anchor";
+/** Scroll distance from the floor at which the rail still calls it "at bottom". */
+export declare const QA_TURN_FOLLOW_PX = 96;
+/** The reading line: reading offset from the scrollport top while scrolling. */
+export declare const QA_TURN_READING_PX = 96;
+/**
+ * Rail ladder of the visible transcript: every user prompt opens a turn, the
+ * first non-empty answer after it fills the response preview. Hidden variant
+ * answers never reach this list because callers pass the already-filtered
+ * messages.
+ */
+export declare function buildTurnRailItems(messages: readonly QaMessage[]): readonly QaTurnRailItem[];
+/** Deep equality guard so the memoized rail skips streaming commits. */
+export declare function sameTurnRailItems(left: readonly QaTurnRailItem[], right: readonly QaTurnRailItem[]): boolean;
+/**
+ * Turn owning the transcript's reading line, or the newest one while the
+ * reader follows the live tail. Anchors above the line are scanned in flow
+ * order; the last one at or above it owns the mark.
+ */
+export declare function computeActiveTurn(scroller: HTMLElement, items: readonly QaTurnRailItem[]): number | null;
+export interface QaTurnRailProps {
+    readonly items: readonly QaTurnRailItem[];
+    readonly activeTurn: number | null;
+    /** Turn still generating; its mark pulses. */
+    readonly busyTurn: number | null;
+    /** The transcript scroller the rail floats over and measures its band from. */
+    readonly scrollerRef: RefObject<HTMLDivElement | null>;
+    readonly onNavigate: (item: QaTurnRailItem) => void;
+}
+declare function QaTurnRailView({ items, activeTurn, busyTurn, scrollerRef, onNavigate, }: QaTurnRailProps): import("react/jsx-runtime").JSX.Element | null;
+/**
+ * Fixed-pitch rail of every turn of the visible transcript, floating over the
+ * transcript's right gutter: the active mark follows the reading line, a
+ * hover/focus preview shows the prompt and answer, and a click lands the
+ * transcript on that turn. Memoized like the harness rail — the transcript
+ * re-renders on every streaming delta, and the rail only changes when a turn
+ * is added or becomes active.
+ */
+export declare const QaTurnRail: import("react").MemoExoticComponent<typeof QaTurnRailView>;
+/** Land the transcript on a turn's prompt row, harness-style. */
+export declare function turnScrollTarget(scroller: HTMLElement, row: HTMLElement): number;
+export {};
+//# sourceMappingURL=QaTurnRail.d.ts.map