@yadsh/dsh-qa-surface 0.3.0 → 0.4.0

package/lib/typert.remote-client.js

@@ -29,6 +29,12 @@ const _yadsh_dsh_qa_surface_qaSurface_accountsLogin_result$schema = z.object({
   'createdAt': z.string().readonly(),
   'lastLoginAt': z.union([z.literal(null), z.string()]).readonly(),
   'disabled': z.boolean().readonly(),
+  'profile': z.object({
+  'fullName': z.string().readonly(),
+  'identities': z.record(z.string(), z.string()).readonly().readonly(),
+  'instructions': z.string().readonly(),
+  'updatedAt': z.union([z.literal(null), z.string()]).readonly(),
+}).readonly(),
 }).readonly(),
 })
 const _yadsh_dsh_qa_surface_qaSurface_accountsOwnedSessions_parameter_0$schema = z.string()
@@ -47,6 +53,33 @@ const _yadsh_dsh_qa_surface_qaSurface_accountsRegister_result$schema = z.object(
   'createdAt': z.string().readonly(),
   'lastLoginAt': z.union([z.literal(null), z.string()]).readonly(),
   'disabled': z.boolean().readonly(),
+  'profile': z.object({
+  'fullName': z.string().readonly(),
+  'identities': z.record(z.string(), z.string()).readonly().readonly(),
+  'instructions': z.string().readonly(),
+  'updatedAt': z.union([z.literal(null), z.string()]).readonly(),
+}).readonly(),
+}).readonly(),
+})
+const _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_parameter_0$schema = z.string()
+const _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_parameter_1$schema = z.object({
+  'fullName': z.string().readonly(),
+  'identities': z.record(z.string(), z.string()).readonly().readonly(),
+  'instructions': z.string().readonly(),
+})
+const _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_result$schema = z.object({
+  'id': z.string().readonly(),
+  'email': z.string().readonly(),
+  'displayName': z.string().readonly(),
+  'role': z.union([z.literal("user"), z.literal("admin")]).readonly(),
+  'createdAt': z.string().readonly(),
+  'lastLoginAt': z.union([z.literal(null), z.string()]).readonly(),
+  'disabled': z.boolean().readonly(),
+  'profile': z.object({
+  'fullName': z.string().readonly(),
+  'identities': z.record(z.string(), z.string()).readonly().readonly(),
+  'instructions': z.string().readonly(),
+  'updatedAt': z.union([z.literal(null), z.string()]).readonly(),
 }).readonly(),
 })
 const _yadsh_dsh_qa_surface_qaSurface_accountsWhoami_parameter_0$schema = z.string()
@@ -62,8 +95,16 @@ const _yadsh_dsh_qa_surface_qaSurface_accountsWhoami_result$schema = z.union([z.
   'createdAt': z.string().readonly(),
   'lastLoginAt': z.union([z.literal(null), z.string()]).readonly(),
   'disabled': z.boolean().readonly(),
+  'profile': z.object({
+  'fullName': z.string().readonly(),
+  'identities': z.record(z.string(), z.string()).readonly().readonly(),
+  'instructions': z.string().readonly(),
+  'updatedAt': z.union([z.literal(null), z.string()]).readonly(),
+}).readonly(),
 }).readonly(),
 })])
+const _yadsh_dsh_qa_surface_qaSurface_createSession_parameter_0$schema = z.string()
+const _yadsh_dsh_qa_surface_qaSurface_createSession_result$schema = z.string()
 const _yadsh_dsh_qa_surface_qaSurface_describe_result$schema = z.object({
   'enabled': z.boolean().readonly(),
   'route': z.object({
@@ -97,10 +138,11 @@ const _yadsh_dsh_qa_surface_qaSurface_describe_result$schema = z.object({
   'showToolActivity': z.boolean().readonly(),
   'showReasoning': z.boolean().readonly(),
   'renderMarkdown': z.boolean().readonly(),
-  'maxContentWidth': z.number().readonly(),
+  'minContentWidth': z.number().readonly(),
   'showSessionList': z.boolean().readonly(),
 }).readonly(),
   'suggestedQuestions': z.array(z.string()).readonly(),
+  'thinkingPhrases': z.array(z.string()).readonly(),
   'interaction': z.object({
   'approvals': z.literal("blocked").readonly(),
   'questions': z.literal("unsupported").readonly(),
@@ -110,7 +152,7 @@ const _yadsh_dsh_qa_surface_qaSurface_describe_result$schema = z.object({
   'enforceFixedAgentPreset': z.boolean().readonly(),
   'enforceFixedWorkspace': z.boolean().readonly(),
   'enforceFixedModel': z.boolean().readonly(),
-  'sandboxMode': z.literal("read-only").readonly(),
+  'sandboxMode': z.union([z.literal("read-only"), z.literal("workspace-write")]).readonly(),
   'approvalPolicy': z.literal("never").readonly(),
   'permissionPreset': z.string().readonly(),
   'allowPermissionChanges': z.literal(false).readonly(),
@@ -133,6 +175,16 @@ const _yadsh_dsh_qa_surface_qaSurface_describe_result$schema = z.object({
   'allowRegistration': z.boolean().readonly(),
   'sessionTtlDays': z.number().readonly(),
   'showOtherUsersChats': z.boolean().readonly(),
+  'perUserWorkspace': z.boolean().readonly(),
+  'profile': z.object({
+  'enabled': z.boolean().readonly(),
+  'inject': z.boolean().readonly(),
+  'identities': z.array(z.object({
+  'key': z.string().readonly(),
+  'label': z.string().readonly(),
+})).readonly(),
+  'instructionsMaxLength': z.number().readonly(),
+}).readonly(),
 }).readonly(),
   'entry': z.object({
   'redirectNonLoopback': z.boolean().readonly(),
@@ -177,6 +229,13 @@ const _yadsh_dsh_qa_surface_qaSurface_describe_result$schema = z.object({
   'legacy': z.object({
   'parseAssistantSourcesBlock': z.boolean().readonly(),
 }).readonly(),
+}).readonly(),
+  'attachments': z.object({
+  'textFiles': z.boolean().readonly(),
+  'pastedTextLines': z.number().readonly(),
+  'maxFileBytes': z.number().readonly(),
+  'maxPending': z.number().readonly(),
+  'extensions': z.array(z.string()).readonly(),
 }).readonly(),
 })
 const _yadsh_dsh_qa_surface_qaSurface_readSourceFile_parameter_0$schema = z.string()
@@ -198,7 +257,7 @@ const _yadsh_dsh_qa_surface_qaSurface_secureSession_result$schema = z.object({
   'agentPresetMatches': z.boolean().readonly(),
   'workspaceMatches': z.boolean().readonly(),
   'modelMatches': z.boolean().readonly(),
-  'sandboxIsReadOnly': z.boolean().readonly(),
+  'sandboxModeMatches': z.boolean().readonly(),
   'approvalIsNever': z.boolean().readonly(),
   'permissionPreset': z.string().readonly(),
   'toolPolicyLoaded': z.boolean().readonly(),
@@ -314,7 +373,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#QaClaimResult',
         schema: _yadsh_dsh_qa_surface_qaSurface_accountsClaimSessions_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":256,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":230,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/accountsListOwnership',
@@ -339,7 +398,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface#qaSurface/accountsListOwnership:result',
         schema: _yadsh_dsh_qa_surface_qaSurface_accountsListOwnership_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":280,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":249,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/accountsLogin',
@@ -374,7 +433,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#QaAccountSession',
         schema: _yadsh_dsh_qa_surface_qaSurface_accountsLogin_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":241,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":218,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/accountsOwnedSessions',
@@ -399,7 +458,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface#qaSurface/accountsOwnedSessions:result',
         schema: _yadsh_dsh_qa_surface_qaSurface_accountsOwnedSessions_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":266,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":239,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/accountsRegister',
@@ -434,7 +493,42 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#QaAccountSession',
         schema: _yadsh_dsh_qa_surface_qaSurface_accountsRegister_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":235,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":213,"column":3},
+    },
+    {
+      id: '@yadsh/dsh-qa-surface#qaSurface/accountsUpdateProfile',
+      service: 'qaSurface',
+      namespace: 'qaSurface',
+      method: 'accountsUpdateProfile',
+      invocation: { kind: 'direct' },
+      parameters: [
+        {
+          name: 'token',
+          wire: 'token',
+          source: 'json',
+          codec: {
+            mode: 'strict',
+            typeSymbol: '@yadsh/dsh-qa-surface#qaSurface/accountsUpdateProfile:token',
+            schema: _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_parameter_0$schema,
+          },
+        },
+        {
+          name: 'input',
+          wire: 'input',
+          source: 'json',
+          codec: {
+            mode: 'strict',
+            typeSymbol: '@yadsh/dsh-qa-surface/types#QaAccountProfileInput',
+            schema: _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_parameter_1$schema,
+          },
+        },
+      ],
+      result: {
+        mode: 'strict',
+        typeSymbol: '@yadsh/dsh-qa-surface/types#QaAccountUserPublic',
+        schema: _yadsh_dsh_qa_surface_qaSurface_accountsUpdateProfile_result$schema,
+      },
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":262,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/accountsWhoami',
@@ -459,7 +553,32 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#QaWhoamiResult',
         schema: _yadsh_dsh_qa_surface_qaSurface_accountsWhoami_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":248,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":224,"column":3},
+    },
+    {
+      id: '@yadsh/dsh-qa-surface#qaSurface/createSession',
+      service: 'qaSurface',
+      namespace: 'qaSurface',
+      method: 'createSession',
+      invocation: { kind: 'direct' },
+      parameters: [
+        {
+          name: 'token',
+          wire: 'token',
+          source: 'json',
+          codec: {
+            mode: 'strict',
+            typeSymbol: '@yadsh/dsh-qa-surface#qaSurface/createSession:token',
+            schema: _yadsh_dsh_qa_surface_qaSurface_createSession_parameter_0$schema,
+          },
+        },
+      ],
+      result: {
+        mode: 'strict',
+        typeSymbol: '@yadsh/dsh-qa-surface#qaSurface/createSession:result',
+        schema: _yadsh_dsh_qa_surface_qaSurface_createSession_result$schema,
+      },
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":287,"column":9},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/describe',
@@ -474,7 +593,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#ResolvedQaSurfaceConfig',
         schema: _yadsh_dsh_qa_surface_qaSurface_describe_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":298,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":277,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/readSourceFile',
@@ -519,7 +638,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#QaSourceFilePreview',
         schema: _yadsh_dsh_qa_surface_qaSurface_readSourceFile_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":337,"column":9},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":394,"column":9},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/secureSession',
@@ -554,7 +673,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface/types#QaLockdownProof',
         schema: _yadsh_dsh_qa_surface_qaSurface_secureSession_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":304,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":361,"column":3},
     },
     {
       id: '@yadsh/dsh-qa-surface#qaSurface/sources',
@@ -589,7 +708,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@yadsh/dsh-qa-surface#qaSurface/sources:result',
         schema: _yadsh_dsh_qa_surface_qaSurface_sources_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":330,"column":3},
+      sourceLocation: {"file":"packages/dsh-qa-surface/src/index.ts","line":387,"column":3},
     },
   ],
 }

package/lib/types/account-remotes.d.ts

@@ -0,0 +1,42 @@
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import { QaAccounts } from "./accounts/store.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
+/**
+ * Host-side bodies of the account remotes the `QaSurface` service exposes.
+ * The `@Remote`-decorated signatures stay on the service class (typert code
+ * generation reads the class shape); this context carries everything behind
+ * them: store construction and memoization, the disabled refusal, and the
+ * error mapping onto the shared `(reason: <code>)` wire marker.
+ */
+export interface QaAccountRemotes {
+    /** The accounts store behind the runtime toggle, or undefined while off. */
+    resolve(config: ResolvedQaSurfaceConfig): QaAccounts | undefined;
+    /** Map a store failure onto the shared `(reason: <code>)` wire marker. */
+    run<T>(operation: () => T, sessionIdForLog?: string): T;
+    register(email: string, password: string): QaAccountSession;
+    login(email: string, password: string): QaAccountSession;
+    /** Identity probe; safe to call with an empty or expired token. */
+    whoami(token: string): QaWhoamiResult;
+    /** Migrate a browser's local chat index into server-side ownership. */
+    claimSessions(token: string, sessionIds: readonly string[]): QaClaimResult;
+    /** The token user's owned session ids; the sidebar list authority. */
+    ownedSessions(token: string): {
+        readonly ids: readonly string[];
+    };
+    /**
+     * Every chat-ownership entry with owner display names; the cross-user view
+     * admin browsers group the sidebar by. Ordinary accounts are refused with
+     * the dedicated reason, anonymous ones with auth-required.
+     */
+    listOwnership(token: string): {
+        readonly entries: readonly QaOwnershipEntry[];
+    };
+    /** Replace the caller's own self-declared profile; the token is the identity. */
+    updateProfile(token: string, input: QaAccountProfileInput): QaAccountUserPublic;
+}
+/** Build the account-remotes context for one `QaSurface` service instance. */
+export declare function createQaAccountRemotes(options: {
+    getConfig: () => ResolvedQaSurfaceConfig;
+    logger: PluginLogger;
+}): QaAccountRemotes;
+//# sourceMappingURL=account-remotes.d.ts.map

package/lib/types/accounts/credentials.d.ts

@@ -0,0 +1,14 @@
+/** An account request after normalization, ready to become a stored user. */
+export interface ValidatedCredentials {
+    readonly email: string;
+    /** Trimmed display name; empty means "derive one from the address". */
+    readonly displayName: string;
+}
+/**
+ * The email/password/display-name gate shared by self-registration and the
+ * operator's addUser, so both paths reject unusable input with the same
+ * errors and messages, in the same order. Returns the normalized address and
+ * trimmed display name; the caller still decides uniqueness and role.
+ */
+export declare function validateCredentials(email: string, password: string, displayName: string | undefined): ValidatedCredentials;
+//# sourceMappingURL=credentials.d.ts.map

package/lib/types/accounts/errors.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Coarse, wire-safe account failure codes. They ride the `(reason: <code>)`
+ * marker pattern the attestation path established; the browser maps them to
+ * audience-safe copy and the precise cause stays in the Host logs.
+ */
+export type QaAccountsErrorReason = "auth-required" | "admin-required" | "invalid-credentials" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-profile" | "profile-disabled" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere";
+export declare class QaAccountsError extends Error {
+    readonly reason: QaAccountsErrorReason;
+    constructor(reason: QaAccountsErrorReason, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/lib/types/accounts/file.d.ts

@@ -0,0 +1,82 @@
+import type { Stats } from "node:fs";
+import type { QaAccountRole } from "../types.js";
+/** One account's self-declared profile as it rests in the accounts file. */
+export interface StoredProfile {
+    fullName?: string;
+    identities?: Record<string, string>;
+    instructions?: string;
+    updatedAt?: string;
+}
+export interface StoredUser {
+    readonly id: string;
+    readonly email: string;
+    readonly displayName: string;
+    readonly role: QaAccountRole;
+    /** scrypt material: hex salt + hex hash. */
+    readonly passwordHash: {
+        readonly salt: string;
+        readonly hash: string;
+    };
+    readonly createdAt: string;
+    lastLoginAt: string | null;
+    /** Disabled accounts are refused at login and lose their live tokens. */
+    disabled?: boolean;
+    /**
+     * Bumped to invalidate every token ever issued to the account: the value
+     * rides the token payload and must match at verification time.
+     */
+    tokenVersion?: number;
+    /** Absent until the owner fills the profile form for the first time. */
+    profile?: StoredProfile;
+}
+export interface AccountsFile {
+    readonly version: 1;
+    /** HMAC key for account tokens; rotated on password change by rewriting it. */
+    readonly secret: string;
+    readonly users: StoredUser[];
+    readonly ownership: Record<string, {
+        readonly userId: string;
+        readonly claimedAt: string;
+    }>;
+}
+/** mtime+size pair identifying one on-disk version of the accounts file. */
+export interface FileStamp {
+    readonly mtimeMs: number;
+    readonly size: number;
+}
+/**
+ * Where the last-seen stamp lives. Load and persist keep it current in place,
+ * so a caller holds one mutable ref instead of threading the stamp through
+ * every read-modify-write.
+ */
+export interface FileStampRef {
+    current: FileStamp;
+}
+/** A stamp no real file can match, so the first load always reads the disk. */
+export declare function createFileStampRef(): FileStampRef;
+export declare function stampOf(stat: Stats): FileStamp;
+/** The accounts file lives next to the DSH home the launcher exports. */
+export declare function defaultAccountsFilePath(): string;
+/**
+ * Read the accounts file, or create it on first run with a fresh token
+ * secret. The stamp ref is left pointing at the version just read.
+ */
+export declare function loadAccountsFile(filePath: string, stamp: FileStampRef): AccountsFile;
+/**
+ * Persist the accounts file atomically (temp file + rename) and leave the
+ * stamp ref pointing at the freshly written version.
+ */
+export declare function persistAccountsFile(filePath: string, file: AccountsFile, stamp: FileStampRef): void;
+/**
+ * The qa-accounts CLI runs in its own process against the same file. Re-read
+ * it whenever it changed on disk, before every read or read-modify-write:
+ * without this a running Host would keep honoring tokens the CLI revoked
+ * and its next save would resurrect the CLI's change from a stale snapshot.
+ * One file, one writer at a time remains the deployment's discipline; LAN
+ * scale keeps the stat per operation trivial.
+ *
+ * Returns the freshly loaded file, or undefined when the caller should keep
+ * serving its in-memory state.
+ */
+export declare function reloadAccountsFileIfChanged(filePath: string, stamp: FileStampRef): AccountsFile | undefined;
+//# sourceMappingURL=file.d.ts.map

package/lib/types/accounts/store.d.ts

@@ -1,46 +1,30 @@
-import type { QaAccountRole, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult } from "../types.js";
-/**
- * Coarse, wire-safe account failure codes. They ride the `(reason: <code>)`
- * marker pattern the attestation path established; the browser maps them to
- * audience-safe copy and the precise cause stays in the Host logs.
- */
-export type QaAccountsErrorReason = "auth-required" | "admin-required" | "invalid-credentials" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere";
-export declare class QaAccountsError extends Error {
-    readonly reason: QaAccountsErrorReason;
-    constructor(reason: QaAccountsErrorReason, message: string);
-}
-interface StoredUser {
-    readonly id: string;
-    readonly email: string;
-    readonly displayName: string;
-    readonly role: QaAccountRole;
-    /** scrypt material: hex salt + hex hash. */
-    readonly passwordHash: {
-        readonly salt: string;
-        readonly hash: string;
-    };
-    readonly createdAt: string;
-    lastLoginAt: string | null;
-    /** Disabled accounts are refused at login and lose their live tokens. */
-    disabled?: boolean;
-    /**
-     * Bumped to invalidate every token ever issued to the account: the value
-     * rides the token payload and must match at verification time.
-     */
-    tokenVersion?: number;
-}
+import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountRole, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult } from "../types.js";
+import type { StoredUser } from "./file.js";
+export { QaAccountsError } from "./errors.js";
+export type { QaAccountsErrorReason } from "./errors.js";
+export { defaultAccountsFilePath } from "./file.js";
 export interface QaAccountsOptions {
     readonly sessionTtlDays: number;
     readonly allowRegistration: boolean;
     /** Login/registration attempts accepted per rolling minute, store-wide. */
     readonly maxAuthAttemptsPerMinute?: number;
+    /** Character cap on a stored profile's agent guidance. */
+    readonly instructionsMaxLength?: number;
+    /**
+     * Fields the deployment declares. Self-service writes may name only these;
+     * omitting the list (the operator CLI) checks the key shape alone.
+     */
+    readonly identityFields?: readonly QaAccountIdentityField[];
 }
-/** The accounts file lives next to the DSH home the launcher exports. */
-export declare function defaultAccountsFilePath(): string;
 /**
  * Host authority for QA accounts: the file-backed user list, the session
  * ownership map and the HMAC account tokens. All mutations are synchronous
  * and persisted atomically (temp file + rename); LAN scale keeps this trivial.
+ *
+ * The class is the facade: token mechanics live in token.ts, the file format
+ * and its atomic persistence plus the external-change probe in file.ts, and
+ * the credential rules shared by registration and the operator CLI in
+ * credentials.ts.
  */
 export declare class QaAccounts {
     readonly filePath: string;
@@ -49,20 +33,19 @@ export declare class QaAccounts {
     private readonly maxAuthAttemptsPerMinute;
     private readonly sessionTtlDays;
     private readonly allowRegistration;
+    /** Character cap on a stored profile's agent guidance. */
+    private readonly instructionsMaxLength;
+    /** Declared handle fields; undefined lets an operator write any shape-valid key. */
+    private readonly identityFields;
     /** mtime+size of the file as of the last load; the external-change probe. */
-    private lastLoadStamp;
+    private readonly fileStamp;
     constructor(filePath: string | undefined, options: QaAccountsOptions);
     /**
-     * The qa-accounts CLI runs in its own process against the same file. Re-read
-     * it whenever it changed on disk, before every read or read-modify-write:
-     * without this a running Host would keep honoring tokens the CLI revoked
-     * and its next save would resurrect the CLI's change from a stale snapshot.
-     * One file, one writer at a time remains the deployment's discipline; LAN
-     * scale keeps the stat per operation trivial.
+     * Re-read the accounts file when it changed on disk, before every read or
+     * read-modify-write. The probe itself and its cross-process rationale live
+     * with the file layer (reloadAccountsFileIfChanged).
      */
     private reloadIfChanged;
-    private load;
-    private persist;
     private save;
     private pruneAuthAttempts;
     private assertAuthBudget;
@@ -81,6 +64,14 @@ export declare class QaAccounts {
      * foreign sessions unless the caller administers the deployment.
      */
     ensureSessionAccess(token: string, sessionId: string): QaAccountUserPublic;
+    /**
+     * Atomically reserve a Host-generated session id for the token user before
+     * the Session exists. Browser callers therefore never get a race window in
+     * which they can claim another user's newly created chat.
+     */
+    reserveSession(token: string, sessionId: string): QaAccountUserPublic;
+    /** Roll back a reservation if Host creation failed before a chat existed. */
+    releaseSessionReservation(userId: string, sessionId: string): void;
     /** Bulk-claim a browser's local chat index; foreign ids come back as conflicts. */
     claimSessions(token: string, sessionIds: readonly string[]): QaClaimResult;
     /** Session ids owned by the token's user, most recently claimed first. */
@@ -116,6 +107,38 @@ export declare class QaAccounts {
     setUserDisabled(email: string, disabled: boolean): QaAccountUserPublic;
     /** Invalidate every token of the account (password-leak response). */
     revokeTokens(email: string): QaAccountUserPublic;
+    /**
+     * The account that owns one session, or undefined while nobody claimed it.
+     * The prompt renderer resolves a chat's owner through this map, so a session
+     * that predates accounts simply carries no identity.
+     */
+    ownerIdOf(sessionId: string): string | undefined;
+    /**
+     * Email plus profile of one account, for the prompt renderer. A disabled
+     * account resolves to nothing: its identity leaves the prompt together with
+     * its access, so a revoked user is no longer addressed by name.
+     */
+    identityOf(userId: string): {
+        readonly email: string;
+        readonly profile: QaAccountProfile;
+    } | undefined;
+    /** One account in its public shape; undefined when the address is unknown. */
+    findUser(email: string): QaAccountUserPublic | undefined;
+    /**
+     * Operator write: replace one account's profile, addressed by email. The
+     * CLI merges field-level flags into a full profile before calling this.
+     */
+    setProfile(email: string, input: QaAccountProfileInput): QaAccountUserPublic;
+    /**
+     * Self-service write for the token's own account. The token is verified
+     * first, so a browser can only ever edit the profile it is signed in as.
+     */
+    updateOwnProfile(token: string, input: QaAccountProfileInput): QaAccountUserPublic;
+    /**
+     * Validate one profile write and stamp it onto the account. Throws before
+     * anything is mutated, so a rejected write leaves the stored profile, and
+     * the address it is keyed to, exactly as they were.
+     */
+    private stampedProfile;
 }
-export {};
 //# sourceMappingURL=store.d.ts.map

package/lib/types/accounts/token.d.ts

@@ -0,0 +1,31 @@
+/** The account facts token verification needs: identity plus token version. */
+interface TokenUser {
+    readonly id: string;
+    readonly tokenVersion?: number;
+}
+/** The claims carried by a v1 account token payload. */
+export interface TokenPayload {
+    readonly uid: string;
+    /** Expiry, epoch milliseconds. */
+    readonly exp: number;
+    /** The account's token version at mint time. */
+    readonly ver: number;
+}
+export declare function base64Url(value: Buffer | string): string;
+/**
+ * Mint a v1 account token: a base64url JSON payload plus an HMAC-SHA256
+ * signature keyed with the accounts file secret.
+ */
+export declare function mintToken(secret: string, payload: TokenPayload): string;
+/**
+ * Verify a v1 account token against the current secret and account list and
+ * return its user id, or null for anything malformed, foreign-signed,
+ * expired or superseded. Signature computation, the length check and the
+ * payload decode share one try, so a hostile token can only ever resolve to
+ * null; the comparison is timing-safe (equal length first, then
+ * timingSafeEqual) so a signature guess cannot be accelerated by measuring
+ * HMAC rejection time.
+ */
+export declare function verifyToken(secret: string, token: string, users: readonly TokenUser[]): string | null;
+export {};
+//# sourceMappingURL=token.d.ts.map

package/lib/types/attachment-rules.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Attachment vocabulary shared by the Host configuration and the browser
+ * composer. The module stays free of Node and DOM imports: the client bundle
+ * imports it directly, and the Host resolver uses it to normalize the
+ * operator's configuration.
+ */
+/**
+ * Text-file extensions the composer accepts out of the box. Compared
+ * lowercase and without the leading dot; an entry is a suffix, not a glob.
+ */
+export declare const DEFAULT_QA_TEXT_EXTENSIONS: readonly string[];
+/** Bounds the resolver and the settings card agree on. */
+export declare const QA_PASTED_TEXT_LINES_MIN = 0;
+export declare const QA_PASTED_TEXT_LINES_MAX = 10000;
+export declare const QA_MAX_FILE_BYTES_MIN = 1024;
+export declare const QA_MAX_FILE_BYTES_MAX = 52428800;
+export declare const QA_MAX_PENDING_MIN = 1;
+export declare const QA_MAX_PENDING_MAX = 40;
+/**
+ * Normalize an operator-authored extension list: lowercase, leading dots
+ * stripped, malformed entries and duplicates dropped, order preserved.
+ * An empty result means no extension is accepted by name — the composer then
+ * still accepts whatever the browser reports as `text/*`.
+ * @param values - raw extension tokens from configuration.
+ * @returns the normalized token list.
+ */
+export declare function normalizeTextExtensions(values: readonly string[]): readonly string[];
+/**
+ * Whether one file name carries an accepted text extension. The comparison is
+ * case-insensitive; a name without a dot, or with a hidden-file dot only
+ * (`.gitignore`), is matched against the whole leaf.
+ * @param name - display file name.
+ * @param extensions - normalized accepted extensions.
+ * @returns whether the name matches one accepted extension.
+ */
+export declare function hasTextExtension(name: string, extensions: readonly string[]): boolean;
+/**
+ * Count the lines of a pasted blob the way a reader counts them: a single
+ * trailing newline does not open a new line, and CRLF counts once.
+ * @param text - pasted plain text.
+ * @returns the line count, at least 1 for any non-empty text.
+ */
+export declare function countTextLines(text: string): number;
+//# sourceMappingURL=attachment-rules.d.ts.map

package/lib/types/cli.d.ts

@@ -4,6 +4,6 @@ export interface CliIo {
     err(line: string): void;
 }
 /** Execute one management command; returns the process exit code. */
-export declare function run(argv: readonly string[], io: CliIo, readPassword?: () => string): number;
-export declare function main(argv: readonly string[], io?: CliIo, readPassword?: () => string): number;
+export declare function run(argv: readonly string[], io: CliIo, readStdin?: () => string): number;
+export declare function main(argv: readonly string[], io?: CliIo, readStdin?: () => string): number;
 //# sourceMappingURL=cli.d.ts.map