@yadsh/dsh-qa-surface 0.9.0 → 0.11.0

package/lib/types/access/service.d.ts

@@ -4,7 +4,7 @@ import type { ScopeKey } from "@deepseek-ai/dsh-scope";
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import type { QaAccounts } from "../accounts/store.js";
 import type { QaAgentToolGrants } from "../enforcement/tool-grants.js";
-import type { QaAccessAdminSnapshot, QaCapabilityConfig, QaCapabilityDescriptor, QaCapabilitySelection, QaClaimResult, QaCurrentAccess, QaEffectiveCapabilityPolicy, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, ResolvedQaSurfaceConfig } from "../types.js";
+import type { QaAccessAdminSnapshot, QaAccountUserPublic, QaCapabilityConfig, QaCapabilityDescriptor, QaCapabilitySelection, QaClaimResult, QaCurrentAccess, QaEffectiveCapabilityPolicy, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, ResolvedQaSurfaceConfig } from "../types.js";
 import type { QaSessionLogReader } from "../admin/session-log.js";
 import { QaCapabilityCatalog, type CapabilityCatalogSnapshot } from "./capability-catalog.js";
 import { QaRoleRepository } from "./role-repository.js";
@@ -128,7 +128,38 @@ export declare class QaAccessService {
     private maybeSweepDelegatedSessions;
     current(token: string): QaCurrentAccess;
     session(token: string, sessionId: string): QaSessionAccess;
-    reserveSession(token: string, sessionId: string, requestedSubrole: string | null, adminPreview: boolean): import("../types.js").QaAccountUserPublic;
+    reserveSession(token: string, sessionId: string, requestedSubrole: string | null, adminPreview: boolean): QaAccountUserPublic;
+    /**
+     * The same reservation for a chat opened by an already-authenticated
+     * account — the integration API's path. The subrole is the account's own
+     * default: an external caller is never offered a choice of capabilities,
+     * and an administrator's preview flag stays a browser-only affordance.
+     *
+     * @param user - the account the chat belongs to.
+     * @param sessionId - the Host-generated session id to reserve.
+     * @returns the account, as the browser path returns it.
+     */
+    reserveSessionForUser(user: QaAccountUserPublic, sessionId: string): QaAccountUserPublic;
+    private reserveForUser;
+    /**
+     * The policy of one session, addressed by its authenticated account.
+     *
+     * Split from {@link policyForSession} so the integration API — whose caller
+     * proved an account with a service token instead of a browser one — freezes
+     * exactly the same capability snapshot. What the two entry points share is
+     * everything after identity; the identity check itself is the only part that
+     * differs, and it stays with whoever holds the credential.
+     *
+     * @param owner - the account that owns the session, or undefined when the
+     *   deployment has no accounts service at all.
+     * @param sessionId - the session being admitted.
+     * @param agent - its live agent, for the tool catalog the policy resolves against.
+     * @returns the policy, or undefined without an accounts service.
+     */
+    policyForSessionOwner(owner: {
+        readonly id: string;
+    } | undefined, sessionId: string, agent: Agent): Promise<QaResolvedSessionPolicy | undefined>;
+    /** The browser's entry point: the token resolves the owning account. */
     policyForSession(token: string, sessionId: string, agent: Agent): Promise<QaResolvedSessionPolicy | undefined>;
     /** Activation history of one session, for review and quality analysis. */
     skillActivations(token: string, sessionId: string): readonly QaSkillActivationRecord[];

package/lib/types/account-remotes.d.ts

@@ -1,6 +1,6 @@
 import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import { QaAccounts } from "./accounts/store.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaOwnershipEntry, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaIssuedServiceToken, QaOwnershipEntry, QaServiceTokenCreateInput, QaServiceTokenSummary, QaWhoamiResult, ResolvedQaSurfaceConfig } from "./types.js";
 /**
  * Host-side bodies of the account remotes the `QaSurface` service exposes.
  * The `@Remote`-decorated signatures stay on the service class (typert code
@@ -21,6 +21,18 @@ export interface QaAccountRemotes {
     runAsync<T>(operation: () => Promise<T>, sessionIdForLog?: string): Promise<T>;
     register(email: string, password: string): QaAccountSession;
     login(email: string, password: string): QaAccountSession;
+    /**
+     * Replace the token account's own password. The token is the identity, so a
+     * browser can only ever change its own credential; the returned session
+     * carries the fresh token that keeps this browser signed in.
+     */
+    changePassword(token: string, currentPassword: string, nextPassword: string): QaAccountSession;
+    /**
+     * File a forgotten-password request for the operator queue. The answer is
+     * deliberately the same for every address, so the sign-in screen cannot be
+     * used to learn which accounts exist.
+     */
+    requestPasswordReset(email: string): void;
     /** Identity probe; safe to call with an empty or expired token. */
     whoami(token: string): QaWhoamiResult;
     /**
@@ -45,6 +57,23 @@ export interface QaAccountRemotes {
     updateProfile(token: string, input: QaAccountProfileInput): QaAccountUserPublic;
     /** Replace the caller's own starter buttons; the token is the identity. */
     updateStarters(token: string, input: QaAccountStartersInput): QaAccountUserPublic;
+    /**
+     * The caller's own integration tokens, newest last. Never a secret: the
+     * plaintext exists only in the answer that minted it.
+     */
+    listServiceTokens(token: string): {
+        readonly tokens: readonly QaServiceTokenSummary[];
+    };
+    /**
+     * Mint one integration token for the caller. Refused while the integration
+     * API is off: a credential that authenticates nothing is a credential that
+     * only leaks.
+     */
+    createServiceToken(token: string, input: QaServiceTokenCreateInput): QaIssuedServiceToken;
+    /** Revoke one of the caller's own integration tokens, by id. */
+    revokeServiceToken(token: string, tokenId: string): {
+        readonly revoked: boolean;
+    };
 }
 /** Build the account-remotes context for one `QaSurface` service instance. */
 export declare function createQaAccountRemotes(options: {

package/lib/types/accounts/database.d.ts

@@ -1,6 +1,30 @@
 import { SqliteDatabase } from "@yadsh/dsh-plugin-kit/sqlite";
 import type { QaSkillActivationRecord } from "../types.js";
 import { type AccountsFile, type StoredOwnership, type StoredUser } from "./file.js";
+interface PasswordResetRow {
+    readonly user_id: string;
+    readonly requested_at: string;
+    readonly last_requested_at: string;
+    readonly request_count: number;
+}
+/**
+ * One integration token as it is written. The digest is the only form of the
+ * credential storage ever holds; the plaintext exists in the mint call and
+ * nowhere else.
+ */
+export interface StoredServiceToken {
+    readonly id: string;
+    readonly userId: string;
+    readonly label: string;
+    /** SHA-256 of the token's secret, hex encoded. */
+    readonly hash: string;
+    readonly scopes: readonly string[];
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly lastUsedAt: string | null;
+    readonly revokedAt: string | null;
+    readonly useCount: number;
+}
 /** One ownership record as it is written, before it becomes a row. */
 export interface OwnershipWrite {
     readonly sessionId: string;
@@ -39,6 +63,16 @@ export declare class QaAccountsDatabase {
     insertUser(user: StoredUser): void;
     /** Replace one account's row in place. */
     updateUser(user: StoredUser): void;
+    /**
+     * Record one forgotten-password request. A repeat from the same account
+     * moves the row up the queue and counts up, so the console shows "asked
+     * again" rather than an identical-looking pile of rows.
+     */
+    recordPasswordReset(userId: string, at: string): void;
+    /** Every pending request, newest first. */
+    listPasswordResets(): readonly PasswordResetRow[];
+    /** Drop an account's pending request: it was answered, or it is moot. */
+    clearPasswordReset(userId: string): void;
     /** Record a successful sign-in without rewriting the account. */
     touchLogin(userId: string, at: string): void;
     /** Claim one chat for an account. */
@@ -49,6 +83,24 @@ export declare class QaAccountsDatabase {
     updateOwnership(sessionId: string, owner: StoredOwnership): void;
     /** Forget chats: a rolled-back reservation, or a chat the Harness lost. */
     deleteOwnership(sessionIds: readonly string[]): void;
+    /** Record one freshly minted integration token (digest only, never a secret). */
+    insertServiceToken(token: StoredServiceToken): void;
+    /**
+     * One integration token by id, revoked and expired ones included.
+     *
+     * The caller needs the revoked ones: presenting a revoked token must be a
+     * refusal, not a lookup miss, and the two are only distinguishable when the
+     * row still answers.
+     */
+    serviceToken(tokenId: string): StoredServiceToken | undefined;
+    /** Every integration token of one account, oldest first. */
+    serviceTokensOf(userId: string): readonly StoredServiceToken[];
+    /** Record that one token was used, without rewriting its row. */
+    touchServiceToken(tokenId: string, at: string): void;
+    /** Revoke one token; already-revoked tokens keep their first timestamp. */
+    revokeServiceToken(tokenId: string, at: string): boolean;
+    /** Revoke every token of one account; returns how many were still live. */
+    revokeServiceTokensOf(userId: string, at: string): number;
     /**
      * Append one skill activation and keep the newest `limit` of them. The list
      * is bounded because a long session may activate skills many times, and the
@@ -81,4 +133,5 @@ export declare class QaAccountsDatabase {
     private gcSnapshots;
     private parseLegacyFile;
 }
+export {};
 //# sourceMappingURL=database.d.ts.map

package/lib/types/accounts/errors.d.ts

@@ -3,7 +3,11 @@
  * marker pattern the attestation path established; the browser maps them to
  * audience-safe copy and the precise cause stays in the Host logs.
  */
-export type QaAccountsErrorReason = "auth-required" | "admin-required" | "forbidden" | "invalid-credentials" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-profile" | "profile-disabled" | "invalid-starters" | "starters-disabled" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere"
+export type QaAccountsErrorReason = "auth-required" | "admin-required" | "forbidden" | "invalid-credentials"
+/** The signed-in user typed a current password that does not match. */
+ | "invalid-current-password" | "account-disabled" | "email-taken" | "invalid-email" | "invalid-display-name" | "invalid-profile" | "profile-disabled" | "invalid-starters" | "starters-disabled"
+/** The endpoint this credential is for is switched off on this deployment. */
+ | "integration-disabled" | "invalid-role" | "weak-password" | "registration-disabled" | "rate-limited" | "session-owned-elsewhere"
 /** The conversation a deletion names is not one this deployment knows. */
  | "conversation-unknown"
 /** The Harness still holds the conversation open, so its log would come back. */

package/lib/types/accounts/service-token.d.ts

@@ -0,0 +1,70 @@
+import { QA_SERVICE_TOKEN_DEFAULT_SCOPES, QA_SERVICE_TOKEN_LABEL_MAX, QA_SERVICE_TOKEN_SCOPES, QA_SERVICE_TOKEN_TTL_DAYS_MAX, QA_SERVICE_TOKEN_TTL_DAYS_MIN } from "../shared/integration-tokens.js";
+import type { QaServiceTokenScope } from "../types.js";
+export { QA_SERVICE_TOKEN_DEFAULT_SCOPES, QA_SERVICE_TOKEN_LABEL_MAX, QA_SERVICE_TOKEN_SCOPES, QA_SERVICE_TOKEN_TTL_DAYS_MAX, QA_SERVICE_TOKEN_TTL_DAYS_MIN, };
+export type { QaServiceTokenScope };
+/**
+ * Integration tokens: the credential a non-browser application presents to the
+ * QA HTTP API.
+ *
+ * They are deliberately a second, separate credential from the browser auth
+ * token (`accounts/token.ts`). The browser token is an HMAC over a payload that
+ * carries the account's `tokenVersion`; bumping that version — what a password
+ * change does — signs every browser out. An integration token must survive
+ * that: a service that keeps a Jira bridge running cannot be logged out by a
+ * human editing their profile. What it *does* share is the accounts database,
+ * so a disabled account and the operator's "revoke every token" command still
+ * reach it.
+ *
+ * The plaintext is minted once and never stored. What rests in the database is
+ * a SHA-256 digest of the secret, so a leaked database is not a leaked
+ * credential, and the token id in front of the secret makes verification one
+ * indexed lookup instead of a scan over every account's digests.
+ */
+/** Marks a credential as an integration token in a log line, a paste or a grep. */
+export declare const QA_SERVICE_TOKEN_PREFIX = "qsat";
+/** One minted token: the plaintext to hand over, plus what storage keeps. */
+export interface MintedQaServiceToken {
+    /** Shown once and never recoverable. */
+    readonly token: string;
+    readonly tokenId: string;
+    /** The digest the store persists. */
+    readonly hash: string;
+}
+/** The parts a presented token splits into, or null when it is not our shape. */
+export interface ParsedQaServiceToken {
+    readonly tokenId: string;
+    readonly secret: string;
+}
+/**
+ * Normalize a scope list: known scopes only, duplicates dropped, declared
+ * order preserved. An unknown scope is not an error the caller can see
+ * through — it is simply not granted.
+ * @param values - scope tokens as configured or requested.
+ * @returns the accepted scopes.
+ */
+export declare function normalizeServiceTokenScopes(values: readonly string[]): readonly QaServiceTokenScope[];
+/** The digest of one secret, hex encoded, in the one shape verification expects. */
+export declare function serviceTokenHash(secret: string): string;
+/**
+ * Mint one token. The id is a UUID so the operator can name a token in a
+ * revocation request without ever holding its plaintext again.
+ * @returns the plaintext, its id and the digest storage keeps.
+ */
+export declare function mintServiceToken(): MintedQaServiceToken;
+/**
+ * Split a presented token. Anything that is not exactly
+ * `qsat.<uuid>.<secret>` is refused here rather than looked up: a malformed
+ * credential must not reach the database at all.
+ * @param token - the raw `Authorization: Bearer` value.
+ * @returns the id and secret, or null.
+ */
+export declare function parseServiceToken(token: string): ParsedQaServiceToken | null;
+/**
+ * Constant-time digest comparison. Both sides are hex digests of a fixed
+ * length, so the length check leaks nothing beyond "this is not a digest".
+ * @param secret - the presented secret.
+ * @param hash - the digest storage holds.
+ * @returns whether they are the same secret.
+ */
+export declare function serviceTokenMatches(secret: string, hash: string): boolean;
+//# sourceMappingURL=service-token.d.ts.map

package/lib/types/accounts/store.d.ts

@@ -1,8 +1,10 @@
-import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountRole, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaAccessUser, QaAdminAccountRow, QaClaimResult, QaEffectiveCapabilityPolicy, QaOwnershipEntry, QaSkillActivationRecord, QaUserAccess, QaWhoamiResult } from "../types.js";
+import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountRole, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaAccessUser, QaAdminAccountRow, QaClaimResult, QaEffectiveCapabilityPolicy, QaOwnershipEntry, QaIssuedServiceToken, QaPasswordResetRequest, QaServiceTokenSummary, QaSkillActivationRecord, QaUserAccess, QaWhoamiResult } from "../types.js";
 import { type StoredOwnership, type StoredUser } from "./file.js";
+import { type QaServiceTokenScope } from "./service-token.js";
 export { QaAccountsError } from "./errors.js";
 export type { QaAccountsErrorReason } from "./errors.js";
 export { defaultAccountsFilePath } from "./file.js";
+export type { QaIssuedServiceToken, QaServiceTokenSummary } from "../types.js";
 export interface QaAccountsOptions {
     readonly sessionTtlDays: number;
     readonly allowRegistration: boolean;
@@ -35,6 +37,27 @@ export interface QaSessionFacts {
     /** True when the session is a delegated child of another chat. */
     readonly hasParent?: boolean;
 }
+/** What a caller asks for when it mints an integration token. */
+export interface QaServiceTokenIssueInput {
+    /** A note for the operator's token list; empty becomes a generic label. */
+    readonly label?: string;
+    /** Requested scopes; unknown ones are dropped, empty falls back to `ask`. */
+    readonly scopes?: readonly string[];
+    /** How long the token lives; bounded, and the session TTL when omitted. */
+    readonly ttlDays?: number;
+    /**
+     * The account the token belongs to. An administrator may name somebody
+     * else; everybody else is refused, so an integration credential is always
+     * issued with an explicit owner.
+     */
+    readonly userId?: string;
+}
+/** What a presented integration token resolved to. */
+export interface QaVerifiedServiceToken {
+    readonly tokenId: string;
+    readonly userId: string;
+    readonly scopes: readonly QaServiceTokenScope[];
+}
 /**
  * How long an unowned session stays claimable at access time. Mirrors the
  * admission bootstrap window: a session older than this has either user
@@ -117,6 +140,23 @@ export declare class QaAccounts {
         readonly subroleId: string;
         readonly adminPreview?: boolean;
     }): QaAccountUserPublic;
+    /**
+     * The same reservation for an account resolved by another credential.
+     *
+     * The caller has authenticated the account already — the integration API
+     * checks its service token before it gets here — so this entry point takes
+     * the account rather than a token. It is deliberately not reachable from a
+     * remote: nothing a browser can send may name somebody else's account.
+     *
+     * @param user - the authenticated account the chat belongs to.
+     * @param sessionId - the Host-generated session id to reserve.
+     * @param access - the pinned subrole and preview flag, when the path has them.
+     * @returns the account, as the token-shaped entry returns it.
+     */
+    reserveSessionForUser(user: QaAccountUserPublic, sessionId: string, access?: {
+        readonly subroleId: string;
+        readonly adminPreview?: boolean;
+    }): QaAccountUserPublic;
     /** Roll back a reservation if Host creation failed before a chat existed. */
     releaseSessionReservation(userId: string, sessionId: string): void;
     /** Bulk-claim a browser's local chat index; foreign ids come back as conflicts. */
@@ -278,6 +318,34 @@ export declare class QaAccounts {
      * still theirs after signing in again.
      */
     setPassword(email: string, password: string): QaAccountUserPublic;
+    /**
+     * Self-service password change: verify the caller's current password, then
+     * replace it. The token version bumps, so every other browser holding this
+     * account's token is signed out — that is the point of a change after a leak
+     * — but the caller's own session must not die from its own write, so a fresh
+     * token minted on the bumped version comes back with the account.
+     */
+    changePassword(token: string, currentPassword: string, nextPassword: string): QaAccountSession;
+    /**
+     * A forgotten-password request from the sign-in screen. The caller learns
+     * nothing: a known address, an unknown one and a disabled account all take
+     * the same path out of here, and only the operator-visible queue records the
+     * one real request. The attempt still spends the authentication budget, so
+     * the screen cannot be used to flood that queue.
+     */
+    requestPasswordReset(email: string): void;
+    /**
+     * Pending requests, newest first. A request whose account no longer exists is
+     * dropped rather than listed: the console has no account to act on.
+     */
+    passwordResetRequests(): readonly QaPasswordResetRequest[];
+    /**
+     * Operator write: set a new password for an account addressed by id — the
+     * console works in ids, not addresses — and answer its pending request. Same
+     * token-version bump as {@link setPassword}, so every live session of that
+     * account dies and the user signs in with the new password.
+     */
+    resetUserPassword(userId: string, password: string): QaAccountUserPublic;
     /**
      * Disable an account: future logins are refused and every live token is
      * invalidated (the token version bumps). `enable` does not resurrect old
@@ -286,6 +354,60 @@ export declare class QaAccounts {
     setUserDisabled(email: string, disabled: boolean): QaAccountUserPublic;
     /** Invalidate every token of the account (password-leak response). */
     revokeTokens(email: string): QaAccountUserPublic;
+    /**
+     * Mint one integration token for an account.
+     *
+     * The caller may mint for itself; naming somebody else is an administrative
+     * act and carries the same check as every other cross-account operation.
+     *
+     * @param token - the caller's browser token.
+     * @param input - label, scopes, lifetime and the optional target account.
+     * @returns the token with the scopes and expiry that were actually granted.
+     */
+    mintServiceToken(token: string, input?: QaServiceTokenIssueInput): QaIssuedServiceToken;
+    /**
+     * Mint one integration token for an account the caller has established.
+     *
+     * The operator CLI takes this path: it runs in its own process, against the
+     * accounts database, with the deployment's file access as its only
+     * authority — there is no browser token to present. The browser path above
+     * keeps its own check, so nothing a page can send reaches this entry point.
+     *
+     * @param target - the account the credential belongs to.
+     * @param input - label, scopes and lifetime.
+     * @returns the token, with the plaintext shown exactly once.
+     */
+    mintServiceTokenFor(target: QaAccountUserPublic, input?: QaServiceTokenIssueInput): QaIssuedServiceToken;
+    /**
+     * Verify a presented integration token.
+     *
+     * Every refusal is the same null: unknown id, bad secret, expired, revoked,
+     * disabled account. An unauthenticated caller must not learn which of those
+     * it hit, and a caller holding a stale token does not need to.
+     *
+     * @param presented - the raw credential from the request.
+     * @returns the token's identity, or null.
+     */
+    verifyServiceToken(presented: string): QaVerifiedServiceToken | null;
+    /**
+     * The caller's own integration tokens, newest last.
+     * @param token - the caller's browser token.
+     * @returns summaries; the secrets are not recoverable and are not listed.
+     */
+    listServiceTokens(token: string): readonly QaServiceTokenSummary[];
+    /** The integration tokens of an account the caller has established. */
+    listServiceTokensFor(user: QaAccountUserPublic): readonly QaServiceTokenSummary[];
+    /**
+     * Revoke one of the caller's own integration tokens.
+     * @param token - the caller's browser token.
+     * @param tokenId - the token to revoke.
+     * @returns true when a live token was revoked.
+     */
+    revokeServiceToken(token: string, tokenId: string): boolean;
+    /** Revoke one integration token of an account the caller has established. */
+    revokeServiceTokenFor(user: QaAccountUserPublic, tokenId: string): boolean;
+    /** The caller if it administers the deployment, or a refusal. */
+    private requireAdmin;
     /**
      * The account that owns one session, or undefined while nobody claimed it.
      * The prompt renderer resolves a chat's owner through this map, so a session
@@ -302,6 +424,14 @@ export declare class QaAccounts {
         readonly profile: QaAccountProfile;
     } | undefined;
     /** One account in its public shape; undefined when the address is unknown. */
+    /**
+     * One account's public identity by id.
+     *
+     * Host paths that authenticated the account themselves — the integration
+     * API, which resolves its own service token — need the public shape the
+     * token-shaped entries return, without a browser token to hand.
+     */
+    accountById(userId: string): QaAccountUserPublic | undefined;
     findUser(email: string): QaAccountUserPublic | undefined;
     /**
      * Operator write: replace one account's profile, addressed by email. The

package/lib/types/admin/conversation-log.d.ts

@@ -30,6 +30,18 @@ export interface QaProjectedTranscript {
     /** Newest event time in the log, when the log carried one. */
     readonly lastActivity?: number;
 }
+/**
+ * Flatten one message's content blocks into text. Non-text blocks are named
+ * rather than dropped: a reviewer judging "the answer ignored my screenshot"
+ * needs to see that an image was attached.
+ *
+ * Exported because the integration API publishes an assistant message as the
+ * answer to an external application, and the flattening rule (skip reasoning
+ * and tool calls, keep text, name attachments) must be the same one the
+ * transcript shows. Two readers of one message that flatten it differently
+ * would be two answers to the same question.
+ */
+export declare function messageContentText(content: unknown): string;
 /**
  * Project one log into the review transcript. Unknown event types are skipped,
  * not refused: a deployment may carry plugin events this package has never

package/lib/types/admin/service.d.ts

@@ -2,7 +2,8 @@ import type { PluginLogger } from "@yadsh/dsh-plugin-log";
 import type { QaAccounts } from "../accounts/store.js";
 import type { QaAccessService } from "../access/service.js";
 import type { QaRoleRepository } from "../access/role-repository.js";
-import type { QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaUserQuery } from "../types.js";
+import type { QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminSkillScope, QaAdminSkillsView, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaPasswordResetRequest, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillToolDescriptor, QaSkillValidation, QaUserQuery } from "../types.js";
+import type { QaPersonalSkills } from "../personal-skills/index.js";
 import type { QaQualityStore } from "./quality-store.js";
 import type { QaAdminRedactor } from "./redaction.js";
 import type { QaSessionLogReader, QaStoredSessionEraser } from "./session-log.js";
@@ -37,6 +38,11 @@ export interface QaAdminServiceOptions {
      * pretending it did.
      */
     readonly sessionFiles?: QaStoredSessionEraser;
+    /**
+     * The skill store both scopes read and write, resolved lazily so the console
+     * never constructs storage before someone opens its skills page.
+     */
+    readonly skills: () => QaPersonalSkills;
     /** Drops the sources a conversation collected, when the deployment keeps any. */
     readonly dropSources?: (sessionId: string) => void;
     readonly logger: PluginLogger;
@@ -79,6 +85,21 @@ export declare class QaAdminService {
     users(token: string, query: QaUserQuery, cursor: string | undefined, limit: number | undefined): Promise<QaAdminPage<QaAdminUserRow>>;
     user(token: string, userId: string): Promise<QaAdminUserDetail>;
     updateUser(token: string, userId: string, update: QaAdminUserUpdate): Promise<QaAdminUserDetail>;
+    /**
+     * Accounts that asked for a password reset from the sign-in screen. Reading
+     * the list takes `users.read` — a reviewer has no business seeing who is
+     * locked out; answering one takes `users.manage`, since a reset is a write
+     * to a credential.
+     */
+    passwordResetRequests(token: string): Promise<readonly QaPasswordResetRequest[]>;
+    /**
+     * Answer one forgotten-password request: set a new password for the account
+     * and clear its queue row. Every live session of that account dies with the
+     * token-version bump, so the user signs in with the password the operator
+     * handed over. Audited, because an operator setting somebody else's
+     * credential must leave a trace.
+     */
+    resetUserPassword(token: string, userId: string, password: string): Promise<QaAdminUserDetail>;
     /**
      * Refuse a write that would leave the deployment without a usable admin.
      * Granting the admin role carries no such risk; demoting or disabling the
@@ -124,6 +145,40 @@ export declare class QaAdminService {
     queueConversation(token: string, conversationId: string, messageId: string | undefined): QaReviewQueueItem;
     /** Save a reviewer's verdict, and take the item out of the queue when done. */
     saveReview(token: string, input: QaConversationReviewInput): QaConversationReview;
+    /**
+     * Resolve one requested scope into what the storage service understands.
+     * The account id arrives from the browser, so an unknown one is refused
+     * here: deriving a directory for it would create storage for nobody.
+     */
+    private skillTarget;
+    /**
+     * One audit image of a skill. The body is deliberately not part of it: the
+     * trail records who changed which skill and to what revision, and a stored
+     * transcript of a person's instructions belongs in the skill, not doubled in
+     * every audit row.
+     */
+    private skillImage;
+    /** The catalog of one scope with the facts the console names it by. */
+    skills(token: string, scope: QaAdminSkillScope): Promise<QaAdminSkillsView>;
+    /** One skill file with its body and the revision a save must echo. */
+    skill(token: string, scope: QaAdminSkillScope, name: string): Promise<QaSkillDocument>;
+    /**
+     * Check an unsaved draft against the target scope: the file a save would
+     * write, and every diagnostic for it.
+     */
+    validateSkill(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<QaSkillValidation>;
+    /** The tool catalog the picker offers for one scope. */
+    skillTools(token: string, scope: QaAdminSkillScope): Promise<readonly QaSkillToolDescriptor[]>;
+    /**
+     * Create (`name` null) or replace one skill. The write is marked as this
+     * administrator's, so the owner reads it as an administrator's edit rather
+     * than as a silent substitution, and it is audited with both images.
+     */
+    saveSkill(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<QaSkillDocument>;
+    /** Remove one skill into the trash beside its own skills root. */
+    removeSkill(token: string, scope: QaAdminSkillScope, name: string, expectedRevision: string | null): Promise<QaSkillRemoval>;
+    /** One skill as it exists now; a missing one is the service's refusal. */
+    private existingSkill;
     /**
      * The audit trail as one table. Two writers keep records — the capability
      * service, whose repository predates the console, and the quality store —

package/lib/types/admin/session-log.d.ts

@@ -60,6 +60,27 @@ export interface QaSessionLogReader {
      * next flush would put its log back.
      */
     live(sessionId: string): boolean;
+    /**
+     * The events of a session this process is holding, without touching storage.
+     *
+     * This is a *probe*, not a read: it never fails and never waits, and
+     * `undefined` means only that this process does not hold the session — not
+     * that the session has no log. What it is good for is the one question a
+     * warm reader has to ask on every page: has anything been appended since the
+     * seq I already projected? A session the Harness holds is appended in this
+     * process, so its in-memory events answer that without a stored read, and
+     * the answer is strictly *newer* than what storage has flushed.
+     *
+     * `after` is that cursor: events at or below it are not materialized, so a
+     * reader that already knows a prefix pays for the pass over the session's
+     * event references and not for the events it has already seen. The snapshot
+     * can still be partial (a session that existed in an earlier run of the
+     * process, or a long one), which is why a caller may use it to extend what it
+     * already knows and never to replace it.
+     */
+    snapshot(sessionId: string, options?: {
+        readonly after?: number | undefined;
+    }): readonly StoredSessionEvent[] | undefined;
 }
 /** What one storage-removal call did, id by id. */
 export interface QaSessionEraseOutcome {

package/lib/types/attachment-rules.d.ts

@@ -9,6 +9,21 @@
  * lowercase and without the leading dot; an entry is a suffix, not a glob.
  */
 export declare const DEFAULT_QA_TEXT_EXTENSIONS: readonly string[];
+/**
+ * Document extensions the stand's document pipeline can read, accepted on top
+ * of the text files. A visitor who has the spec in Word should be able to hand
+ * it over instead of retyping it, and a deployment that renders and converts
+ * those formats is the one that can answer for them: this list is what stops
+ * `attachments.extensions` from being text-only by construction.
+ */
+export declare const DEFAULT_QA_DOCUMENT_EXTENSIONS: readonly string[];
+/**
+ * What a visitor may attach to one message out of the box: the text files plus
+ * the documents the pipeline reads. An operator names whatever their stand can
+ * actually work with — the list is a ceiling, not a guarantee that the model
+ * has a tool for every entry.
+ */
+export declare const DEFAULT_QA_ATTACHMENT_EXTENSIONS: readonly string[];
 /** Bounds the resolver and the settings card agree on. */
 export declare const QA_PASTED_TEXT_LINES_MIN = 0;
 export declare const QA_PASTED_TEXT_LINES_MAX = 10000;
@@ -24,16 +39,24 @@ export declare const QA_MAX_PENDING_MAX = 40;
  * @param values - raw extension tokens from configuration.
  * @returns the normalized token list.
  */
-export declare function normalizeTextExtensions(values: readonly string[]): readonly string[];
+export declare function normalizeAcceptedExtensions(values: readonly string[]): readonly string[];
+/**
+ * The extension one file name carries, lowercase and without the dot. A name
+ * without a dot, or with a hidden-file dot only (`.gitignore`), reports the
+ * whole leaf, which no configured extension can match.
+ * @param name - display file name.
+ * @returns the extension token, or the leaf when there is none.
+ */
+export declare function fileExtensionOf(name: string): string;
 /**
- * Whether one file name carries an accepted text extension. The comparison is
+ * Whether one file name carries an accepted extension. The comparison is
  * case-insensitive; a name without a dot, or with a hidden-file dot only
  * (`.gitignore`), is matched against the whole leaf.
  * @param name - display file name.
  * @param extensions - normalized accepted extensions.
  * @returns whether the name matches one accepted extension.
  */
-export declare function hasTextExtension(name: string, extensions: readonly string[]): boolean;
+export declare function hasAcceptedExtension(name: string, extensions: readonly string[]): boolean;
 /**
  * Count the lines of a pasted blob the way a reader counts them: a single
  * trailing newline does not open a new line, and CRLF counts once.