@yadsh/dsh-qa-surface 0.4.0 → 0.6.0

package/lib/types/account-remotes.d.ts

@@ -1,6 +1,6 @@
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import { QaAccounts } from "./accounts/store.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
 /**
  * Host-side bodies of the account remotes the `QaSurface` service exposes.
  * The `@Remote`-decorated signatures stay on the service class (typert code
@@ -33,6 +33,8 @@ export interface QaAccountRemotes {
     };
     /** Replace the caller's own self-declared profile; the token is the identity. */
     updateProfile(token: string, input: QaAccountProfileInput): QaAccountUserPublic;
+    /** Replace the caller's own starter buttons; the token is the identity. */
+    updateStarters(token: string, input: QaAccountStartersInput): QaAccountUserPublic;
 }
 /** Build the account-remotes context for one `QaSurface` service instance. */
 export declare function createQaAccountRemotes(options: {

package/lib/types/accounts/credentials.d.ts

@@ -4,6 +4,12 @@ export interface ValidatedCredentials {
     /** Trimmed display name; empty means "derive one from the address". */
     readonly displayName: string;
 }
+/**
+ * The length gate every path that sets a password goes through — registration,
+ * the operator's addUser, and a reset — so a password good enough to register is
+ * exactly the one an operator can put back.
+ */
+export declare function validatePassword(password: string): void;
 /**
  * The email/password/display-name gate shared by self-registration and the
  * operator's addUser, so both paths reject unusable input with the same

package/lib/types/accounts/errors.d.ts

@@ -3,7 +3,7 @@
  * marker pattern the attestation path established; the browser maps them to
  * audience-safe copy and the precise cause stays in the Host logs.
  */
-export type QaAccountsErrorReason = "auth-required" | "admin-required" | "invalid-credentials" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-profile" | "profile-disabled" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere";
+export type QaAccountsErrorReason = "auth-required" | "admin-required" | "invalid-credentials" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-profile" | "profile-disabled" | "invalid-starters" | "starters-disabled" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere";
 export declare class QaAccountsError extends Error {
     readonly reason: QaAccountsErrorReason;
     constructor(reason: QaAccountsErrorReason, message: string);

package/lib/types/accounts/file.d.ts

@@ -7,6 +7,14 @@ export interface StoredProfile {
     instructions?: string;
     updatedAt?: string;
 }
+/** One account's starter buttons as they rest in the accounts file. */
+export interface StoredStarters {
+    items?: {
+        label?: string;
+        prompt?: string;
+    }[];
+    hideDefaults?: boolean;
+}
 export interface StoredUser {
     readonly id: string;
     readonly email: string;
@@ -28,6 +36,8 @@ export interface StoredUser {
     tokenVersion?: number;
     /** Absent until the owner fills the profile form for the first time. */
     profile?: StoredProfile;
+    /** Absent until the owner customizes the starter buttons. */
+    starters?: StoredStarters;
 }
 export interface AccountsFile {
     readonly version: 1;

package/lib/types/accounts/store.d.ts

@@ -1,4 +1,4 @@
-import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountRole, QaAccountSession, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult } from "../types.js";
+import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountRole, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaClaimResult, QaOwnershipEntry, QaWhoamiResult } from "../types.js";
 import type { StoredUser } from "./file.js";
 export { QaAccountsError } from "./errors.js";
 export type { QaAccountsErrorReason } from "./errors.js";
@@ -99,6 +99,14 @@ export declare class QaAccounts {
     private editUser;
     /** Grant or revoke the admin role. */
     setUserRole(email: string, role: QaAccountRole): QaAccountUserPublic;
+    /**
+     * Replace an account's password, which is what a forgotten one needs. The
+     * token version bumps with it, so every token minted under the old password
+     * dies server-side: a reset is also the response to a leaked credential.
+     * Ownership, profile and the account id survive, so the user's chats are
+     * still theirs after signing in again.
+     */
+    setPassword(email: string, password: string): QaAccountUserPublic;
     /**
      * Disable an account: future logins are refused and every live token is
      * invalidated (the token version bumps). `enable` does not resurrect old
@@ -134,6 +142,12 @@ export declare class QaAccounts {
      * first, so a browser can only ever edit the profile it is signed in as.
      */
     updateOwnProfile(token: string, input: QaAccountProfileInput): QaAccountUserPublic;
+    /**
+     * Replace the token account's starter buttons. Same self-service shape as
+     * {@link updateOwnProfile}: the token is the only identity, and a rejected
+     * write leaves the stored record untouched.
+     */
+    updateOwnStarters(token: string, input: QaAccountStartersInput): QaAccountUserPublic;
     /**
      * Validate one profile write and stamp it onto the account. Throws before
      * anything is mutated, so a rejected write leaves the stored profile, and

package/lib/types/approvals.d.ts

@@ -0,0 +1,65 @@
+import type { Agent } from "@deepseek-ai/dsh-agent";
+import type { Context } from "@deepseek-ai/cordis";
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { QaSessionOwnership } from "./session-ownership.js";
+import type { QaApprovalDecision, QaPendingApproval } from "./types.js";
+/**
+ * The slice of the `tools/pre-execute` execution record this gate reads. The
+ * listener is owned by the plugin context, so it is unfiltered: it also wraps
+ * the calls of a delegated child, whose scope chain never reaches the chat's
+ * own agent context.
+ */
+export interface QaApprovalExecution {
+    readonly name: string;
+    readonly agent?: Agent;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Interactive resolution of the tool policy `ask` decision.
+ *
+ * A composed gate — a content classifier, a hook rule — answers `ask` for a
+ * call it will not decide alone. On an attested QA agent that ask resolves
+ * against the deployment's pinned `approval=never` policy, so the model is told
+ * the user rejected a call the user never saw. This gate sits outside every
+ * other `tools/pre-execute` listener and hands the decision to the operator
+ * instead: the request is parked here, the QA view lists it over its own
+ * remote, and the answer becomes the decision the chain would have produced.
+ *
+ * `interaction.approvals: blocked` keeps the previous fail-closed behavior —
+ * the call is refused with the surface's own reason. Either way nothing is
+ * approved automatically, and the allow-list, the workspace fence and the
+ * read-only sandbox still run on the resolved call.
+ *
+ * Only sessions this deployment attested are touched. Any other session's ask
+ * is handed back to the chain untouched, so an operator instance that also
+ * serves ordinary chats keeps its own approval flow.
+ */
+export declare class QaApprovalGate {
+    private readonly ctx;
+    private readonly interactive;
+    private readonly ownership;
+    private readonly logger;
+    private readonly pending;
+    private readonly disposers;
+    constructor(ctx: Context, interactive: () => boolean, ownership: QaSessionOwnership, logger: PluginLogger);
+    /** Wrap every tool call; other gates compose inside this listener. */
+    install(): void;
+    /** Approvals of one chat, oldest first: what the QA view lists. */
+    list(sessionId: string): readonly QaPendingApproval[];
+    /** Apply the operator's answer; an unknown or foreign id is refused. */
+    answer(sessionId: string, requestId: string, decision: QaApprovalDecision): boolean;
+    /** Detach the listener and fail every parked request. Wired as an effect. */
+    dispose(): void;
+    private handle;
+    /**
+     * The chat a call belongs to, when this deployment attested it. A child of an
+     * attested chat answers under the chat the operator is looking at.
+     */
+    private ownerOf;
+    /** Park one call until the operator answers, the turn is cancelled, or … */
+    private request;
+    private resolve;
+    /** Fail the requests one session's agent owns; a child never holds the chat. */
+    private settleOwner;
+}
+//# sourceMappingURL=approvals.d.ts.map

package/lib/types/client/QaAccountsController.d.ts

@@ -1,4 +1,4 @@
-import type { QaAccountProfileInput, QaAccountUserPublic, QaOwnershipEntry, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaAccountProfileInput, QaAccountStartersInput, QaAccountUserPublic, QaOwnershipEntry, ResolvedQaSurfaceConfig } from "../types.js";
 import type { QaAccountsApi, StorageLike } from "./types.js";
 export type QaAccountsSnapshot = {
     readonly stage: "checking";
@@ -79,6 +79,12 @@ export declare class QaAccountsController {
      * rather than through the gate's state machine.
      */
     updateProfile(input: QaAccountProfileInput): Promise<string | null>;
+    /**
+     * Replace the signed-in user's own starter buttons, mirroring
+     * {@link updateProfile}: refusal copy on rejection, null once the snapshot
+     * carries the stored record, so the composer picks the new buttons up.
+     */
+    updateStarters(input: QaAccountStartersInput): Promise<string | null>;
     private authenticate;
     /** Own the account, migrate the legacy index, then project authed. */
     private enterSession;

package/lib/types/client/QaSessionController.d.ts

@@ -1,6 +1,7 @@
 import type { ConnectionGenerationState } from "@deepseek-ai/dsh-client-connection/client";
 import type { QaAttachmentDraft, QaSessionState, ResolvedQaSurfaceConfig } from "../types.js";
-import type { QaConversation, QaCreateSession, QaFileUpload, QaSecureSession, QaSessions, QaSessionsApi, QaSourceApi, StorageLike } from "./types.js";
+import type { QaApprovalApi, QaConversation, QaCreateSession, QaFileUpload, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSourceApi, StorageLike } from "./types.js";
+import type { QaApprovalDecision, QaQuestionAnswerItem } from "../types.js";
 export interface QaAccountsFacade {
     /** The account bearer token, or null while anonymous. */
     readonly token: () => string | null;
@@ -26,6 +27,17 @@ export interface QaSessionControllerOptions {
     readonly config: ResolvedQaSurfaceConfig;
     readonly secureSession: QaSecureSession;
     readonly sourceApi?: QaSourceApi;
+    /**
+     * The approval half of the Host namespace. Absent on a page built against a
+     * Host that does not answer approvals: the surface then never shows a
+     * request and keeps the composer as it is.
+     */
+    readonly approvalApi?: QaApprovalApi;
+    /**
+     * The question half of the Host namespace. Absent on a page whose Host build
+     * does not answer questions: the surface then only renders what it can.
+     */
+    readonly questionApi?: QaQuestionApi;
     readonly storage?: StorageLike;
     /**
      * Browser file-upload service, resolved lazily: the page may not serve the
@@ -76,6 +88,8 @@ export declare class QaSessionController {
     private materializing;
     private operationError;
     private admissionPending;
+    private pendingSubmission;
+    private pendingSequence;
     private policyReady;
     private drafting;
     /** The chat session to return to when a subagent view closes. */
@@ -87,11 +101,19 @@ export declare class QaSessionController {
     private chatsRevision;
     /** Host-side provenance of the bound chat, merged into the projection. */
     private readonly hostSources;
+    /** Host-side approvals of the bound chat waiting for the operator. */
+    private readonly hostApprovals;
+    /** Host-side question requests of the bound chat waiting for the operator. */
+    private readonly hostQuestions;
+    /** Set while a running turn is polled for parked requests. */
+    private pendingTimer;
     constructor(options: QaSessionControllerOptions);
     getSnapshot: () => QaSessionState;
     subscribe: (listener: () => void) => (() => void);
     ensureSession(): Promise<void>;
     send(text: string, attachments?: readonly QaAttachmentDraft[]): Promise<boolean>;
+    /** Publish a browser-only copy before any network or Host admission awaits. */
+    private beginSubmission;
     /**
      * Ask for a fresh variant of the previous answer. The session has no
      * truncation seam, so this sends the hidden regeneration instruction as an
@@ -172,6 +194,14 @@ export declare class QaSessionController {
      * (first frame at once, further frames absorbed) lives in the publisher. */
     private publishSessionUpdate;
     private publish;
+    /**
+     * Display names of the known subagent sessions keyed by session id, for
+     * settlement notices to sign with. The durable catalogs carry each
+     * delegation's description verbatim; a child the host listed without a
+     * catalog falls back to its own list title. Tolerates a host bundle older
+     * than either field: an absent snapshot piece just contributes no names.
+     */
+    private subagentNames;
     private fail;
     /**
      * Attest the currently bound session. `ok` carries the session id the proof
@@ -181,5 +211,24 @@ export declare class QaSessionController {
      */
     private attestPolicy;
     private emit;
+    /**
+     * Answer a request the Host parked for this chat. The Host re-checks the
+     * request against the chat, so an answer that lost its race is a no-op; the
+     * refresh that follows is what the surface renders.
+     */
+    answerApproval(requestId: string, decision: QaApprovalDecision): Promise<void>;
+    /** Send the operator's answers to one parked question request. */
+    answerQuestion(requestId: string, answers: readonly QaQuestionAnswerItem[]): Promise<void>;
+    /** Close a parked question request without answering it. */
+    cancelQuestion(requestId: string): Promise<void>;
+    /**
+     * Poll the Host for parked requests while a turn runs. A request only exists
+     * inside an open turn, and it is Host state: polling is how the page learns
+     * about it, and how it reappears after a reload. One timer serves both seams,
+     * and each is polled only where the deployment answers it.
+     */
+    private syncPendingPolling;
+    private stopPendingPolling;
+    private hostToken;
 }
 //# sourceMappingURL=QaSessionController.d.ts.map

package/lib/types/client/QaSurface.d.ts

@@ -1,9 +1,11 @@
 import type { ConnectionGenerationState } from "@deepseek-ai/dsh-client-connection/client";
-import type { InjectFace, PropsRuntime } from "@deepseek-ai/dsh-client-ui-slots";
+import type { InjectFace, PropsRenderSlots, PropsRuntime } from "@deepseek-ai/dsh-client-ui-slots";
 import type { QaConfigController } from "./QaConfigController.js";
 import type { QaRouteController } from "./QaRouteController.js";
 import type { QaAccountsController } from "./QaAccountsController.js";
-import type { QaConversation, QaCreateSession, QaFileUpload, QaSecureSession, QaSessions, QaSessionsApi, QaSourceApi } from "./types.js";
+import type { QaApprovalApi, QaConversation, QaCreateSession, QaFileUpload, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSkillApi, QaSourceApi } from "./types.js";
+import type { QaSurfacePanelRegistry } from "./panels/registry.js";
+import type { QaUserSettingsSections } from "./settings-extensions/index.js";
 export interface QaSurfaceFace {
     readonly route: QaRouteController;
     readonly config: QaConfigController;
@@ -14,6 +16,18 @@ export interface QaSurfaceFace {
     readonly secureSession: QaSecureSession;
     readonly createSession: QaCreateSession;
     readonly sourceApi: QaSourceApi;
+    /**
+     * Personal-skill half of the plugin's namespace. Absent on a page whose Host
+     * build does not answer it; the settings dialog then has no skills section.
+     */
+    readonly skillApi?: QaSkillApi;
+    /**
+     * Approval half of the plugin's namespace. Absent on a page whose Host build
+     * does not answer it; the surface then only blocks sends it cannot attest.
+     */
+    readonly approvalApi?: QaApprovalApi;
+    /** Question half of the plugin's namespace, when the Host answers it. */
+    readonly questionApi?: QaQuestionApi;
     /**
      * Browser file-upload service, when the page serves the upload plugin.
      * Resolved per send so a page that loads it later still gets file support.
@@ -21,8 +35,11 @@ export interface QaSurfaceFace {
     readonly fileUpload?: () => QaFileUpload | undefined;
     /** Present when the deployment mounts the QA account gate. */
     readonly accounts?: QaAccountsController;
+    /** Global client-only panel metadata and presentation navigation. */
+    readonly panels: QaSurfacePanelRegistry;
+    /** First-class settings pages registered by additive QA plugins. */
+    readonly settingsSections: QaUserSettingsSections;
 }
-type QaSurfaceProps = PropsRuntime<"shell.overlay"> & InjectFace<QaSurfaceFace>;
+export type QaSurfaceProps = PropsRuntime<"shell.overlay"> & PropsRenderSlots<"qa.surface.panel"> & InjectFace<QaSurfaceFace>;
 export declare function QaSurface(props: QaSurfaceProps): import("react/jsx-runtime").JSX.Element | null;
-export {};
 //# sourceMappingURL=QaSurface.d.ts.map

package/lib/types/client/QaSurfaceGuard.d.ts

@@ -0,0 +1,27 @@
+import { type ReactNode } from "react";
+import { type QaSurfaceProps } from "./QaSurface.js";
+/**
+ * The registered `shell.overlay` entry: the surface behind an error boundary
+ * the host never sees past. The host's per-slot isolation retires a crashed
+ * entry, which for this slot means the QA overlay disappears and the operator
+ * shell beneath it becomes reachable — a render crash must never be allowed
+ * to make that trade. The boundary keeps the overlay mounted and swaps the
+ * surface for a fullscreen failure card; the reload button is the recovery,
+ * because after a render crash the component state below (controllers,
+ * stores) is untrustworthy.
+ *
+ * The body mask (`data-dsh-qa-surface`) is owned here, above the boundary:
+ * React unmounts a crashed subtree, and the stylesheet that hides the host
+ * frame's own columns hangs off that attribute, so a crash unmounting the
+ * surface must not lift the mask with it. Deleting the overlay element in
+ * the browser then reveals a blank page, not the shell.
+ *
+ * The wrapper is a function component only because the slot contract types
+ * entries as call signatures; its render is trivial and cannot itself throw
+ * into the host boundary. It also covers a face that failed to assemble: the
+ * slot inject hands over an empty face in that case, a missing route reads
+ * as permanently active, and the surface's first hook read throws into the
+ * boundary below.
+ */
+export declare function QaSurfaceGuard(props: QaSurfaceProps): ReactNode;
+//# sourceMappingURL=QaSurfaceGuard.d.ts.map

package/lib/types/client/QaTranscriptAdapter.d.ts

@@ -13,5 +13,12 @@ export declare function projectTranscript(snapshot: ConversationSnapshot | undef
     readonly running?: boolean;
     readonly showToolActivity?: boolean;
     readonly showReasoning?: boolean;
+    /**
+     * The chat's subagent display names keyed by session id, read from the
+     * host list snapshot; settlement notices prefer them over the raw ids.
+     */
+    readonly subagentNames?: Readonly<Record<string, string>>;
+    /** Sign settlement titles with deterministic codenames. */
+    readonly subagentCodenames?: boolean;
 }): readonly QaMessage[];
 //# sourceMappingURL=QaTranscriptAdapter.d.ts.map

package/lib/types/client/approvals.d.ts

@@ -0,0 +1,39 @@
+import type { QaApprovalDecision, QaPendingApproval } from "../types.js";
+import type { QaApprovalApi } from "./types.js";
+/**
+ * The operator's side of a parked tool call.
+ *
+ * A composed gate's `ask` is answered on the Host, so the waiting request is
+ * Host state: it survives a page reload, and the surface learns about it by
+ * asking rather than by receiving an event. The bridge holds the last list it
+ * saw, refreshes it while a turn runs, and forwards an answer.
+ */
+export declare class QaHostApprovalBridge {
+    private readonly approvalApi;
+    private approvals;
+    private signature;
+    private refreshing;
+    private answering;
+    /** Bumped on reset so a stale in-flight response never lands. */
+    private generation;
+    constructor(approvalApi: QaApprovalApi | undefined);
+    /** Leave the chat: a chat switch drops the previous chat's requests. */
+    reset(): void;
+    /** The last list this bridge saw; empty when the deployment blocks them. */
+    list(): readonly QaPendingApproval[];
+    /** Whether this page can ask the Host about approvals at all. */
+    get available(): boolean;
+    /**
+     * Re-read the chat's pending requests; a changed list republishes through the
+     * callback. Overlapping calls coalesce, and a response that outlives its chat
+     * is dropped.
+     */
+    refresh(sessionId: string, token: string, onChanged: () => void): Promise<void>;
+    /**
+     * Answer one request and re-read the list. A refusal is not an error: the
+     * request was already settled (the turn was stopped, the call went away), so
+     * the refresh — not the answer — is what the surface shows.
+     */
+    answer(sessionId: string, token: string, requestId: string, decision: QaApprovalDecision): Promise<void>;
+}
+//# sourceMappingURL=approvals.d.ts.map

package/lib/types/client/components/QaApproval.d.ts

@@ -0,0 +1,13 @@
+import type { QaApprovalDecision, QaPendingApproval } from "../../types.js";
+export interface QaApprovalProps {
+    readonly approvals: readonly QaPendingApproval[];
+    readonly onAnswer: (requestId: string, decision: QaApprovalDecision) => Promise<void>;
+}
+/**
+ * The tool calls a composed gate parked for a person. One row per request, the
+ * gate's own reason on top, and the two answers stock DSH offers: refuse, or
+ * let this one call through. Nothing here decides on its own — an unanswered
+ * request simply keeps the turn waiting.
+ */
+export declare const QaApproval: import("react").MemoExoticComponent<(props: QaApprovalProps) => import("react/jsx-runtime").JSX.Element | null>;
+//# sourceMappingURL=QaApproval.d.ts.map

package/lib/types/client/components/QaComposer.d.ts

@@ -1,8 +1,10 @@
 import type { QaAttachmentDraft } from "../../types.js";
 import { type QaAttachmentLimits } from "../attachments.js";
+import type { QaQuickQuestion } from "../types.js";
 export interface QaComposerProps {
     readonly placeholder: string;
-    readonly quickQuestions?: readonly string[];
+    /** Shown while the chat is empty; the label reads, the prompt sends. */
+    readonly quickQuestions?: readonly QaQuickQuestion[];
     readonly canSend: boolean;
     readonly canStop: boolean;
     readonly running: boolean;

package/lib/types/client/components/QaHeader.d.ts

@@ -4,6 +4,7 @@
  * rendering — the badge counts move with the session state anyway, so
  * reference guards would never pay off here.
  */
+import type { ReactNode } from "react";
 /**
  * The subagent indication for headerless deployments: a slim status line
  * above the transcript with the way back to the parent chat. With a header,
@@ -33,9 +34,10 @@ export interface QaHeaderProps {
     readonly fileCount: number;
     readonly filesOpen: boolean;
     readonly onOpenFiles: () => void;
+    readonly panelLauncher?: ReactNode;
     readonly showReset: boolean;
     readonly resetDisabled: boolean;
     readonly onReset: () => void;
 }
-export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
+export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaHeader.d.ts.map

package/lib/types/client/components/QaModal.d.ts

@@ -9,12 +9,13 @@ export interface QaModalProps {
     readonly children: ReactNode;
     /** Actions pinned under the body; omit for a body-only dialog. */
     readonly footer?: ReactNode;
+    readonly wide?: boolean;
     /**
-     * Wider panel, for a dialog whose prose must not wrap mid-sentence: the
-     * profile form and the changelog both take it. The default width stays with
-     * the text-list dialogs it was sized for.
+     * Panel size: `wide` fits prose that must not wrap mid-sentence, and
+     * `settings` the sectioned user-settings dialog, which needs both a
+     * comfortable height and a two-column body.
      */
-    readonly wide?: boolean;
+    readonly size?: "default" | "wide" | "settings";
 }
 /**
  * The shared QA dialog shell: backdrop, panel, head with the close control,

package/lib/types/client/components/QaQuestions.d.ts

@@ -0,0 +1,13 @@
+import type { QaPendingQuestion, QaQuestionAnswerItem } from "../../types.js";
+export interface QaQuestionsProps {
+    readonly questions: readonly QaPendingQuestion[];
+    readonly onAnswer: (requestId: string, answers: readonly QaQuestionAnswerItem[]) => Promise<void>;
+    readonly onCancel: (requestId: string) => Promise<void>;
+}
+/**
+ * The questions a running turn waits on. Answers are the operator's own: the
+ * form refuses to submit a question left blank, and a question explicitly
+ * skipped is reported as skipped rather than answered by guesswork.
+ */
+export declare const QaQuestions: import("react").MemoExoticComponent<(props: QaQuestionsProps) => import("react/jsx-runtime").JSX.Element | null>;
+//# sourceMappingURL=QaQuestions.d.ts.map

package/lib/types/client/components/QaSidebar.d.ts

@@ -1,5 +1,4 @@
 import type { SessionSummary } from "@deepseek-ai/dsh-api-session-controller/client";
-import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput } from "../../types.js";
 /** One renderable row of the chat-history sidebar. */
 export interface QaChatRow {
     readonly id: string;
@@ -58,17 +57,15 @@ export interface QaSidebarProps {
         readonly role: string;
         readonly onLogout: () => void;
         /**
-         * Self-service profile editing. Omitted when the deployment turns the
-         * feature off, which also leaves the footer name as plain text. Memoized
-         * by the caller: this object is compared by reference.
+         * Entry point of the user-settings dialog: the name to show and the way to
+         * open it. Omitted when the deployment gives the account nothing to
+         * configure, which also leaves the footer name as plain text. Memoized by
+         * the caller: this object is compared by reference.
          */
-        readonly profileDialog?: {
-            readonly profile: QaAccountProfile;
-            /** Handle fields the dialog renders, in the deployment's order. */
-            readonly fields: readonly QaAccountIdentityField[];
-            readonly instructionsMaxLength: number;
-            /** Persist edited fields; resolves to refusal copy, or null. */
-            readonly onSave: (input: QaAccountProfileInput) => Promise<string | null>;
+        readonly settings?: {
+            /** Full name the user wrote, or the email when they wrote none. */
+            readonly label: string;
+            readonly onOpen: () => void;
         };
     };
 }

package/lib/types/client/components/QaWidthHandle.d.ts

@@ -6,6 +6,19 @@ import { type RefObject } from "react";
  * lets the transcript fill it.
  */
 export declare const QA_CONTENT_EDGE_BUDGET = 176;
+/**
+ * Band between the text column edge and the handle strip: the transcript keeps
+ * 16px of side padding and the strip's inner edge sits 24px outside the content
+ * box. A bled block that grows past this band slides under the 40px drag
+ * target, so the stylesheet holds the bleed inside it.
+ */
+export declare const QA_HANDLE_FREE_BAND = 40;
+/**
+ * Ceiling for the assistant bleed (fenced code blocks) per side. Eight pixels
+ * short of the free band, so both the strip and its glow stay on empty gutter
+ * at every width; the stylesheet caps it once more by the live side gutter.
+ */
+export declare const QA_BLEED_MAX_WIDTH: number;
 export declare function readQaContentWidth(storage: Pick<Storage, "getItem">, key: string): number | null;
 export declare function writeQaContentWidth(storage: Pick<Storage, "setItem">, key: string, width: number): void;
 /**

package/lib/types/client/index.d.ts

@@ -13,4 +13,5 @@ export { QaAccountsController } from "./QaAccountsController.js";
 export { QaRouteController, matchesQaRoute } from "./QaRouteController.js";
 export { QaSessionController } from "./QaSessionController.js";
 export { projectTranscript } from "./QaTranscriptAdapter.js";
+export type { QaSurfacePanelDefinition, QaSurfacePanelOpenOptions, QaSurfacePanelOwnerProps, QaSurfacePanelPresentation, QaSurfacePanels, } from "./panels/contract.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/types/client/panels/PanelHost.d.ts

@@ -0,0 +1,18 @@
+import type { PropsRenderSlots } from "@deepseek-ai/dsh-client-ui-slots";
+import type { QaSurfacePanelRegistry } from "./registry.js";
+export declare const QA_PANEL_DEFAULT_RATIO = 0.42;
+export declare const QA_PANEL_MIN_PX = 320;
+export declare const QA_CHAT_MIN_PX = 400;
+export declare const QA_PANEL_MAX_RATIO = 0.7;
+export declare const QA_PANEL_MOBILE_BREAKPOINT_PX = 768;
+type RenderPanelSlot = PropsRenderSlots<"qa.surface.panel">["renderSlot"];
+export declare function clampQaPanelWidth(width: number, available: number): number;
+export interface QaPanelHostProps {
+    readonly panels: QaSurfacePanelRegistry;
+    readonly sessionId: string | null;
+    readonly qaToken?: string;
+    readonly renderSlot: RenderPanelSlot;
+}
+export declare function QaPanelHost({ panels, sessionId, qaToken, renderSlot, }: QaPanelHostProps): import("react/jsx-runtime").JSX.Element | null;
+export {};
+//# sourceMappingURL=PanelHost.d.ts.map

package/lib/types/client/panels/PanelLauncher.d.ts

@@ -0,0 +1,5 @@
+import type { QaSurfacePanelRegistry } from "./registry.js";
+export declare function QaPanelLauncher({ panels, }: {
+    readonly panels: QaSurfacePanelRegistry;
+}): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=PanelLauncher.d.ts.map