@yadsh/dsh-qa-surface 0.6.0 → 0.7.0

package/lib/types/admin/queue.d.ts

@@ -0,0 +1,21 @@
+import type { QaConversationReview, QaMessageFeedback, QaReviewQueueItem } from "../types.js";
+import type { QaManualQueueEntry } from "./quality-store.js";
+/** A tool call that failed inside one conversation, found while projecting it. */
+export interface QaToolFailureSignal {
+    readonly conversationId: string;
+    readonly messageId?: string;
+    readonly at: string;
+}
+export interface QaQueueInput {
+    readonly feedback: readonly QaMessageFeedback[];
+    readonly reviews: readonly QaConversationReview[];
+    readonly manual: readonly QaManualQueueEntry[];
+    readonly failures?: readonly QaToolFailureSignal[];
+}
+/**
+ * Build queue rows, newest signal first within a priority band. A conversation
+ * reached by several signals appears once per answered target, so a reviewer
+ * can see that the same chat was rated down twice.
+ */
+export declare function deriveQueue({ feedback, reviews, manual, failures, }: QaQueueInput): readonly QaReviewQueueItem[];
+//# sourceMappingURL=queue.d.ts.map

package/lib/types/admin/redaction.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The redaction seam of the review console.
+ *
+ * Review work needs user prompts, tool arguments and tool results — the exact
+ * material most likely to carry credentials, customer data or internal
+ * knowledge. The default implementation does not pretend to be a DLP engine; it
+ * bounds every preview and masks the credential shapes that appear in tool
+ * traffic. A deployment that needs more replaces this object, which is why the
+ * projection takes a redactor rather than reading the environment.
+ */
+export interface QaAdminRedactor {
+    /** One user or assistant message text, as the reviewer reads it. */
+    redactMessage(text: string): string;
+    /** One tool call's raw argument JSON. */
+    redactToolArguments(value: string): string;
+    /** One tool result preview. */
+    redactToolResult(value: string): string;
+}
+/**
+ * Preview bounds. A review needs enough to judge a call, not a full dump: a
+ * large result would otherwise dominate the transcript and the wire payload.
+ */
+export declare const QA_ADMIN_TEXT_LIMIT = 8000;
+export declare const QA_ADMIN_ARGUMENTS_LIMIT = 2000;
+export declare const QA_ADMIN_RESULT_LIMIT = 6000;
+export declare function maskSecrets(value: string): string;
+/** The deployment default: bounded previews with credential shapes masked. */
+export declare const defaultAdminRedactor: QaAdminRedactor;
+//# sourceMappingURL=redaction.d.ts.map

package/lib/types/admin/service.d.ts

@@ -0,0 +1,105 @@
+import type { PluginLogger } from "@yadsh/dsh-plugin-log";
+import type { QaAccounts } from "../accounts/store.js";
+import type { QaAccessService } from "../access/service.js";
+import type { QaRoleRepository } from "../access/role-repository.js";
+import type { QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaUserQuery } from "../types.js";
+import type { QaQualityStore } from "./quality-store.js";
+import type { QaAdminRedactor } from "./redaction.js";
+import type { QaSessionLogReader } from "./session-log.js";
+/**
+ * The administrative console's server side.
+ *
+ * Every entry point takes the caller's token and names the permission it
+ * needs; there is no `isAdmin` shortcut and no client-supplied identity. The
+ * browser may only ever read what a role grants, and every write lands in the
+ * audit trail with its before and after images.
+ */
+export declare const QA_ADMIN_PAGE_DEFAULT = 25;
+export declare const QA_ADMIN_PAGE_MAX = 100;
+/**
+ * How many conversations one metrics or search pass will open. Reading every
+ * stored log is unbounded work, so the aggregation covers the newest logs and
+ * says so; moving these counters onto a real index is the next iteration.
+ */
+export declare const QA_ADMIN_SCAN_LIMIT = 200;
+interface QaServiceClock {
+    now(): number;
+}
+export interface QaAdminServiceOptions {
+    readonly accounts: () => QaAccounts | undefined;
+    readonly quality: () => QaQualityStore;
+    readonly roles: () => QaRoleRepository;
+    readonly access: () => QaAccessService;
+    readonly sessionLog: QaSessionLogReader;
+    readonly logger: PluginLogger;
+    readonly redactor?: QaAdminRedactor;
+    readonly clock?: QaServiceClock;
+}
+export declare class QaAdminService {
+    private readonly options;
+    private readonly redactor;
+    private readonly transcripts;
+    constructor(options: QaAdminServiceOptions);
+    private requireAccounts;
+    /**
+     * Resolve the caller and check one permission. The refusal carries the shared
+     * `forbidden` reason, so a browser shows the same audience-safe copy for
+     * every administrative surface it may not open.
+     */
+    private require;
+    /**
+     * The deployment's conversation index: one row per reserved QA session,
+     * enriched with the stored header when the deployment can list one. A chat
+     * that exists but has no readable log still appears — the reviewer must see
+     * that it happened.
+     */
+    private index;
+    /** One conversation's projected log, cached for the TTL unless asked fresh. */
+    private transcript;
+    private facts;
+    overview(token: string): Promise<QaAdminOverview>;
+    metrics(token: string): Promise<QaQualityMetrics>;
+    private metricsOf;
+    /** One attention line per condition worth an administrator's time. */
+    private alertsOf;
+    users(token: string, query: QaUserQuery, cursor: string | undefined, limit: number | undefined): Promise<QaAdminPage<QaAdminUserRow>>;
+    user(token: string, userId: string): Promise<QaAdminUserDetail>;
+    updateUser(token: string, userId: string, update: QaAdminUserUpdate): Promise<QaAdminUserDetail>;
+    /**
+     * Refuse a write that would leave the deployment without a usable admin.
+     * Granting the admin role carries no such risk; demoting or disabling the
+     * last enabled administrator locks everyone out of the console.
+     */
+    private assertAdminSurvives;
+    /** Validate an assignment against the enabled roles before storing it. */
+    private exactAssignment;
+    conversations(token: string, query: QaConversationQuery, cursor: string | undefined, limit: number | undefined): Promise<QaAdminPage<QaConversationSummary>>;
+    private summaryOf;
+    conversation(token: string, conversationId: string): Promise<QaConversationDetail>;
+    private failuresOf;
+    private failureSignals;
+    /**
+     * Record the caller's verdict on one assistant message. The conversation must
+     * be the caller's own: a rating is the user's own signal, and nobody rates
+     * someone else's answer on their behalf.
+     */
+    rateMessage(token: string, conversationId: string, messageId: string, input: QaMessageFeedbackInput): QaMessageFeedback;
+    feedback(token: string, query: QaFeedbackQuery, cursor: string | undefined, limit: number | undefined): Promise<QaAdminPage<QaFeedbackRow>>;
+    private feedbackRows;
+    private queueRows;
+    reviewQueue(token: string, cursor: string | undefined, limit: number | undefined): Promise<QaAdminPage<QaReviewQueueRow>>;
+    /** Park a conversation for review without rating it. */
+    queueConversation(token: string, conversationId: string, messageId: string | undefined): QaReviewQueueItem;
+    /** Save a reviewer's verdict, and take the item out of the queue when done. */
+    saveReview(token: string, input: QaConversationReviewInput): QaConversationReview;
+    /**
+     * The audit trail as one table. Two writers keep records — the capability
+     * service, whose repository predates the console, and the quality store —
+     * and an administrator expects one timeline, so both are normalized here.
+     */
+    audit(token: string, query: QaAuditQuery, cursor: string | undefined, limit: number | undefined): Promise<QaAdminPage<QaAdminAuditEvent>>;
+    /** Capability-policy events, reshaped into the console's audit vocabulary. */
+    private accessAuditEvents;
+}
+export {};
+//# sourceMappingURL=service.d.ts.map

package/lib/types/admin/session-log.d.ts

@@ -0,0 +1,53 @@
+import type { Context } from "@deepseek-ai/cordis";
+import type { QaTranscriptUnavailableReason } from "../types.js";
+import type { StoredSessionEvent } from "./conversation-log.js";
+/**
+ * Read access to the deployment's conversations.
+ *
+ * Two sources, because neither alone is complete:
+ *
+ * - Durable storage (`ctx.sessionQuery`) owns history — every conversation a
+ *   deployment ever had, including the ones this process never opened. Its
+ *   concrete backend is a deployment choice, so the service is read off the
+ *   context at call time and described structurally: the QA bundle must keep
+ *   loading on a deployment that serves no query engine.
+ * - The live session store (`ctx.sessions`) owns the chats running right now.
+ *   It is the one source that always exists, and it is what a chat becomes the
+ *   moment its first message is appended.
+ *
+ * Reads never throw for an unavailable backend: the caller gets a reason, so
+ * the review viewer can say why a transcript is missing instead of failing the
+ * whole page.
+ */
+export interface QaStoredSessionHeader {
+    readonly id: string;
+    /** Epoch milliseconds, as the session header records it. */
+    readonly createdAt: number;
+    readonly cwd?: string;
+    /** Set on a subagent's session; such sessions are not conversations. */
+    readonly parentSessionId?: string;
+    readonly agentPreset?: string;
+}
+export type QaSessionReadResult = {
+    readonly ok: true;
+    readonly events: readonly StoredSessionEvent[];
+} | {
+    readonly ok: false;
+    readonly reason: QaTranscriptUnavailableReason;
+};
+export interface QaSessionLogReader {
+    list(): Promise<readonly QaStoredSessionHeader[]>;
+    read(sessionId: string): Promise<QaSessionReadResult>;
+}
+/**
+ * Build the reader for one plugin instance. The services are looked up per
+ * call rather than captured: a cordis provider is only visible once its fiber
+ * is active, and a reference taken at construction time would stay dead.
+ */
+export declare function createSessionLogReader(ctx: Context): QaSessionLogReader;
+/** A reader over an explicit set of logs; the tests' seam, and the empty default. */
+export declare function staticSessionLogReader(input: {
+    readonly sessions?: readonly QaStoredSessionHeader[];
+    readonly events?: Readonly<Record<string, readonly StoredSessionEvent[]>>;
+}): QaSessionLogReader;
+//# sourceMappingURL=session-log.d.ts.map

package/lib/types/attestation.d.ts

@@ -14,4 +14,6 @@ export declare class QaAttestationError extends Error {
     readonly reason: QaAttestationReason;
     constructor(reason: QaAttestationReason, message: string);
 }
+/** Keep deployment details in Host logs while preserving a stable wire hint. */
+export declare function qaAttestationFailureMessage(message: string, error: unknown): string;
 //# sourceMappingURL=attestation.d.ts.map

package/lib/types/client/QaSessionController.d.ts

@@ -46,6 +46,9 @@ export interface QaSessionControllerOptions {
     readonly fileUpload?: () => QaFileUpload | undefined;
     /** Present while the deployment gates QA users with accounts. */
     readonly accounts?: QaAccountsFacade;
+    /** Server-validated role requested for newly materialized sessions. */
+    readonly initialSubrole?: string | null;
+    readonly adminPreview?: boolean;
     readonly timeoutMs?: number;
     /**
      * Minimum spacing between projections of a running turn's stream frames.
@@ -91,6 +94,8 @@ export declare class QaSessionController {
     private pendingSubmission;
     private pendingSequence;
     private policyReady;
+    /** Historical transcript retained after the Host classifies policy drift. */
+    private compatibilityReadOnly;
     private drafting;
     /** The chat session to return to when a subagent view closes. */
     private chatSessionId;
@@ -99,6 +104,8 @@ export declare class QaSessionController {
     private disposed;
     private generation;
     private chatsRevision;
+    private selectedSubrole;
+    private adminPreview;
     /** Host-side provenance of the bound chat, merged into the projection. */
     private readonly hostSources;
     /** Host-side approvals of the bound chat waiting for the operator. */
@@ -111,6 +118,12 @@ export declare class QaSessionController {
     getSnapshot: () => QaSessionState;
     subscribe: (listener: () => void) => (() => void);
     ensureSession(): Promise<void>;
+    /**
+     * Select a different capability profile for the next agent. The current
+     * agent is never mutated: even a blank materialized chat is abandoned in
+     * favor of a fresh Host-owned session.
+     */
+    selectSubrole(subroleId: string, adminPreview?: boolean): Promise<void>;
     send(text: string, attachments?: readonly QaAttachmentDraft[]): Promise<boolean>;
     /** Publish a browser-only copy before any network or Host admission awaits. */
     private beginSubmission;
@@ -129,7 +142,7 @@ export declare class QaSessionController {
      * until the first prompt is actually sent, which materializes the session
      * lazily ({@link materializeDraft}). Fixed-policy deployments cannot draft.
      */
-    startDraft(): Promise<void>;
+    startDraft(policyChange?: boolean): Promise<void>;
     /**
      * Turn the current draft into a real attested session. Runs inside the
      * send flow; concurrent sends share one materialization. A refusal here is

package/lib/types/client/QaSurface.d.ts

@@ -3,7 +3,7 @@ import type { InjectFace, PropsRenderSlots, PropsRuntime } from "@deepseek-ai/ds
 import type { QaConfigController } from "./QaConfigController.js";
 import type { QaRouteController } from "./QaRouteController.js";
 import type { QaAccountsController } from "./QaAccountsController.js";
-import type { QaApprovalApi, QaConversation, QaCreateSession, QaFileUpload, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSkillApi, QaSourceApi } from "./types.js";
+import type { QaApprovalApi, QaAccessApi, QaAdminApi, QaConversation, QaCreateSession, QaFileUpload, QaSecureSession, QaSessions, QaSessionsApi, QaQuestionApi, QaSkillApi, QaSourceApi } from "./types.js";
 import type { QaSurfacePanelRegistry } from "./panels/registry.js";
 import type { QaUserSettingsSections } from "./settings-extensions/index.js";
 export interface QaSurfaceFace {
@@ -15,6 +15,12 @@ export interface QaSurfaceFace {
     readonly connection: ConnectionGenerationState;
     readonly secureSession: QaSecureSession;
     readonly createSession: QaCreateSession;
+    readonly accessApi: QaAccessApi;
+    /**
+     * The administrative console's surface. Optional so an older Host that does
+     * not answer it still renders the capability editors.
+     */
+    readonly adminApi?: QaAdminApi;
     readonly sourceApi: QaSourceApi;
     /**
      * Personal-skill half of the plugin's namespace. Absent on a page whose Host

package/lib/types/client/admin/QaAdmin.d.ts

@@ -0,0 +1,17 @@
+import type { QaAccountRole, QaSubrole } from "../../types.js";
+import type { QaAccessApi, QaAdminApi } from "../types.js";
+export declare function QaAdmin(props: {
+    /** Capability administration; the access service's own wire surface. */
+    readonly api: QaAccessApi;
+    /**
+     * The console's own surface. A deployment that serves only the chat surface
+     * has no accounts, so the console falls back to the role editors.
+     */
+    readonly adminApi?: QaAdminApi;
+    readonly token: string;
+    readonly routePath: string;
+    /** The signed-in account's role, used only to filter the navigation. */
+    readonly role?: QaAccountRole;
+    readonly onPreview: (role: QaSubrole) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=QaAdmin.d.ts.map

package/lib/types/client/admin/format.d.ts

@@ -0,0 +1,43 @@
+import type { QaAccountRole, QaFeedbackReason, QaQualityIssueType, QaQualitySeverity, QaRemediationTarget, QaReviewPriority, QaReviewStatus, QaTranscriptUnavailableReason } from "../../types.js";
+/**
+ * Russian copy for the console's vocabulary. Kept in one module so the pages
+ * stay about layout, and so the wording an operator sees is edited in one
+ * place rather than hunted across components.
+ */
+export declare const ADMIN_ROLE_LABELS: Readonly<Record<QaAccountRole, string>>;
+export declare const FEEDBACK_RATING_LABELS: {
+    readonly positive: "Полезно";
+    readonly negative: "Проблема";
+};
+export declare const FEEDBACK_REASON_LABELS: Readonly<Record<QaFeedbackReason, string>>;
+export declare const REVIEW_STATUS_LABELS: Readonly<Record<QaReviewStatus, string>>;
+export declare const REVIEW_PRIORITY_LABELS: Readonly<Record<QaReviewPriority, string>>;
+export declare const REVIEW_REASON_LABELS: {
+    readonly negative_feedback: "Негативная оценка";
+    readonly manual: "Отправлено на разбор";
+    readonly tool_failure: "Сбой инструмента";
+    readonly automatic: "Автоматически";
+};
+export declare const SEVERITY_LABELS: Readonly<Record<QaQualitySeverity, string>>;
+/**
+ * Issue labels grouped by the taxonomy's own branches (spec §21). The groups
+ * are only a rendering concern: issue ids stay flat so aggregations never walk
+ * a tree.
+ */
+export declare const ISSUE_GROUPS: readonly {
+    readonly title: string;
+    readonly issues: readonly QaQualityIssueType[];
+}[];
+export declare const ISSUE_LABELS: Readonly<Record<QaQualityIssueType, string>>;
+export declare const TARGET_LABELS: Readonly<Record<QaRemediationTarget, string>>;
+export declare const TRANSCRIPT_UNAVAILABLE_LABELS: Readonly<Record<QaTranscriptUnavailableReason, string>>;
+/** Percent, or a dash when there is nothing to take a share of. */
+export declare function formatRate(value: number | null): string;
+/** Local date and time of an ISO stamp, or a dash for an unusable value. */
+export declare function formatStamp(iso: string | undefined): string;
+/** Coarse "how long ago", which is what a triage list needs. */
+export declare function formatRelative(iso: string, now?: number): string;
+/** Milliseconds as a short duration; tool timings are second-scale. */
+export declare function formatDuration(ms: number | undefined): string;
+export declare function formatCount(value: number): string;
+//# sourceMappingURL=format.d.ts.map

package/lib/types/client/admin/pages/Conversations.d.ts

@@ -0,0 +1,21 @@
+import type { QaAdminApi } from "../../types.js";
+export declare function AdminConversations(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly userId?: string;
+    readonly onOpenConversation: (conversationId: string, messageId?: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+/**
+ * The review viewer: the conversation as it happened, next to the reviewer's
+ * form. Tool calls collapse by default — a reviewer looking for "the tool
+ * failed" should not have to scroll past every argument to find it.
+ */
+export declare function AdminConversation(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly conversationId: string;
+    readonly messageId?: string;
+    readonly canReview: boolean;
+    readonly onBack: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Conversations.d.ts.map

package/lib/types/client/admin/pages/Overview.d.ts

@@ -0,0 +1,13 @@
+import type { QaReviewQueueRow } from "../../../types.js";
+import type { QaAdminApi } from "../../types.js";
+export declare function AdminOverview(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly onOpenConversation: (conversationId: string, messageId?: string) => void;
+    readonly onOpenQueue: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function QueuePreview(props: {
+    readonly rows: readonly QaReviewQueueRow[];
+    readonly onOpenConversation: (conversationId: string, messageId?: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Overview.d.ts.map

package/lib/types/client/admin/pages/Quality.d.ts

@@ -0,0 +1,18 @@
+import type { QaAdminApi } from "../../types.js";
+/** The feedback table: every rating against the exact answer it judged. */
+export declare function AdminFeedback(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly onOpenConversation: (conversationId: string, messageId?: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+/** Issue distribution, per-subrole satisfaction and the trend over time. */
+export declare function AdminQuality(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+}): import("react/jsx-runtime").JSX.Element;
+/** Every administrative action, newest first, from both writers. */
+export declare function AdminAudit(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Quality.d.ts.map

package/lib/types/client/admin/pages/Review.d.ts

@@ -0,0 +1,15 @@
+import type { QaConversationDetail } from "../../../types.js";
+import type { QaAdminApi } from "../../types.js";
+export declare function AdminReviewQueue(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly onOpenConversation: (conversationId: string, messageId?: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function ReviewPanel(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly detail: QaConversationDetail;
+    readonly canReview: boolean;
+    readonly onSaved: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Review.d.ts.map

package/lib/types/client/admin/pages/Users.d.ts

@@ -0,0 +1,22 @@
+import type { QaAdminApi, QaAccessApi } from "../../types.js";
+/**
+ * Users: the table an administrator triages from, and the detail page that
+ * separates authorization from the QA subrole assignment — an admin may work
+ * as an analyst without that saying anything about their administrative reach.
+ */
+export declare function AdminUsers(props: {
+    readonly api: QaAdminApi;
+    readonly token: string;
+    readonly onOpenUser: (userId: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+/** Authorization, assignment and the activity counters of one account. */
+export declare function AdminUserDetail(props: {
+    readonly api: QaAdminApi;
+    readonly accessApi: QaAccessApi;
+    readonly token: string;
+    readonly userId: string;
+    readonly onBack: () => void;
+    readonly onOpenAudit: () => void;
+    readonly onOpenConversations: (userId: string) => void;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=Users.d.ts.map

package/lib/types/client/admin/routes.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The admin console's route model.
+ *
+ * The console lives under one host route (`/qa/admin`) and gives every entity
+ * with its own identity its own path, because a review finding is something
+ * people paste into a chat. Parsing and serializing live here, away from the
+ * components, so the mapping is testable without a DOM.
+ */
+export type QaAdminRoute = {
+    readonly page: "overview";
+} | {
+    readonly page: "users";
+} | {
+    readonly page: "user";
+    readonly userId: string;
+} | {
+    readonly page: "subroles";
+} | {
+    readonly page: "skills";
+} | {
+    readonly page: "common";
+} | {
+    readonly page: "conversations";
+} | {
+    readonly page: "conversation";
+    readonly conversationId: string;
+    /** Deep link to one message inside the conversation (spec §34). */
+    readonly messageId?: string;
+} | {
+    readonly page: "review";
+} | {
+    readonly page: "feedback";
+} | {
+    readonly page: "quality";
+} | {
+    readonly page: "audit";
+};
+/** Path segments after `/qa/admin`, without the leading slash. */
+export declare function adminSegments(pathname: string, routePath: string): string[];
+/**
+ * Resolve a pathname into a console route. Unknown segments fall back to the
+ * section they live under rather than to an error page: a stale link should
+ * still land the reviewer somewhere useful.
+ */
+export declare function parseAdminRoute(pathname: string, routePath: string): QaAdminRoute;
+/** The pathname for one console route; the inverse of {@link parseAdminRoute}. */
+export declare function adminPath(routePath: string, route: QaAdminRoute, search?: string): string;
+/** Which navigation entry is current for one route. */
+export declare function adminSectionOf(route: QaAdminRoute): "overview" | "users" | "access" | "conversations" | "review" | "feedback" | "quality" | "audit";
+//# sourceMappingURL=routes.d.ts.map

package/lib/types/client/admin/shared.d.ts

@@ -0,0 +1,53 @@
+import type { RemoteResult } from "../types.js";
+/** The audience-safe text of a refused Remote call. */
+export declare function errorMessage(error: unknown): string;
+/**
+ * The refusal copy a console page shows. The Host sends a coarse reason code
+ * on the wire and nothing else, so the wording lives here — one place to edit,
+ * and no deployment detail leaks into the browser.
+ */
+export declare function adminErrorMessage(error: unknown): string;
+/**
+ * Load one administrative resource, keeping the previous value visible while
+ * it refreshes. Reviewers page through lists while new conversations arrive;
+ * blanking the table on every reload would make that unusable.
+ */
+export declare function useAdminResource<T>(load: () => Promise<RemoteResult<T>>, deps: readonly unknown[]): {
+    readonly data: T | undefined;
+    readonly error: string | undefined;
+    readonly loading: boolean;
+    reload: () => Promise<void>;
+};
+/** A status chip; the modifier class carries the semantic colour. */
+export declare function Badge(props: {
+    readonly tone?: "neutral" | "positive" | "negative" | "warning";
+    readonly children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function Empty(props: {
+    readonly children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+/** A relative timestamp with the exact one available on hover. */
+export declare function Stamp(props: {
+    readonly value: string | undefined;
+}): import("react/jsx-runtime").JSX.Element;
+export declare function ErrorLine(props: {
+    readonly message: string | undefined;
+}): import("react/jsx-runtime").JSX.Element | null;
+/**
+ * Cursor paging controls. The cursor is opaque to the browser by design: only
+ * the Host knows how a page was cut.
+ */
+export declare function Pager(props: {
+    readonly total: number;
+    readonly shown: number;
+    readonly hasMore: boolean;
+    readonly loading: boolean;
+    readonly onMore: () => void;
+    readonly onReset: () => void;
+}): import("react/jsx-runtime").JSX.Element;
+/** One labeled filter control in a table toolbar. */
+export declare function FilterField(props: {
+    readonly label: string;
+    readonly children: React.ReactNode;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=shared.d.ts.map

package/lib/types/client/admin/styles.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The administrative console's stylesheet. Colors come only from the QA
+ * palette tokens or the host's themed aliases, so light, dark and system themes
+ * stay coherent; the stylesheet test enforces that rule.
+ *
+ * Layout intent: a dense table surface for triage, a side panel for the review
+ * form, and no modal windows — the console is a place to work through a list,
+ * not a wizard.
+ */
+export declare const QA_ADMIN_CONSOLE_STYLES: string;
+//# sourceMappingURL=styles.d.ts.map

package/lib/types/client/attestation.d.ts

@@ -6,8 +6,15 @@ import type { QaLockdownProof, ResolvedQaSurfaceConfig } from "../types.js";
  * reason class and an operator hint.
  */
 export declare class QaPolicyAttestationError extends Error {
-    constructor();
+    readonly reason: string | null;
+    constructor(reason?: string | null);
 }
+/**
+ * Refusals that classify an existing chat as belonging to an older deployment
+ * composition. Keeping only its transcript is safe: policyReady stays false,
+ * so no prompt, cancel, approval or question reaches the Host.
+ */
+export declare function canOpenAsCompatibilityReadOnly(reason: string | null): boolean;
 /**
  * Extract the coarse attestation reason code from a Host wire failure, if the
  * failure carries the marker.

package/lib/types/client/components/QaHeader.d.ts

@@ -21,6 +21,10 @@ export interface QaHeaderProps {
     readonly viewingSubagent: boolean;
     readonly onCloseSubagent: () => void;
     readonly agentPreset: string | null;
+    readonly roleSelector?: ReactNode;
+    readonly administration?: {
+        readonly onOpen: () => void;
+    };
     readonly agentCount: number;
     readonly agentsOpen: boolean;
     /** Toggles the agents drawer; also closes the right rail. */
@@ -39,5 +43,5 @@ export interface QaHeaderProps {
     readonly resetDisabled: boolean;
     readonly onReset: () => void;
 }
-export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
+export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, roleSelector, administration, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaHeader.d.ts.map

package/lib/types/client/components/QaMessage.d.ts

@@ -1,4 +1,5 @@
 import type { QaMessage as QaMessageModel, QaSource, QaTurnSources } from "../../types.js";
+import type { QaFeedbackReason } from "../../types.js";
 export interface QaMessageProps {
     readonly message: QaMessageModel;
     readonly renderMarkdown: boolean;
@@ -18,6 +19,18 @@ export interface QaMessageProps {
     readonly onSourceDetail?: (source: QaSource) => void;
     /** Operator-configured running phrases; omitted reads the built-in list. */
     readonly thinkingPhrases?: readonly string[];
+    /**
+     * Persist a rating for this answer. Omitted on a surface with no accounts or
+     * no durable message identity: the control then only records the choice
+     * locally, which is what the standalone QA surface has always done.
+     */
+    readonly onRateFeedback?: (input: {
+        /** Durable log position of this answer, when the transcript knows it. */
+        readonly messageId?: number;
+        readonly rating: "positive" | "negative";
+        readonly reasons?: readonly QaFeedbackReason[];
+        readonly comment?: string;
+    }) => void;
 }
 /**
  * Whether two transcript messages render identically. The transcript
@@ -26,5 +39,5 @@ export interface QaMessageProps {
  * comparison is by value, which keeps fresh copies cheap to recognize.
  */
 export declare function sameMessage(a: QaMessageModel, b: QaMessageModel): boolean;
-export declare const QaMessage: import("react").MemoExoticComponent<({ message, renderMarkdown, showTimestamp, stateKey, onRegenerate, resolveImage, onOpenSources, onSourceDetail, thinkingPhrases, }: QaMessageProps) => import("react/jsx-runtime").JSX.Element>;
+export declare const QaMessage: import("react").MemoExoticComponent<({ message, renderMarkdown, showTimestamp, stateKey, onRegenerate, resolveImage, onOpenSources, onSourceDetail, thinkingPhrases, onRateFeedback, }: QaMessageProps) => import("react/jsx-runtime").JSX.Element>;
 //# sourceMappingURL=QaMessage.d.ts.map

package/lib/types/client/create-session.d.ts

@@ -9,5 +9,7 @@ import type { QaCreateSession } from "./types.js";
 export declare function createQaSession(args: {
     readonly createSession: QaCreateSession;
     readonly token: string;
+    readonly subroleId: string | null;
+    readonly adminPreview: boolean;
 }): Promise<string>;
 //# sourceMappingURL=create-session.d.ts.map