@yadsh/dsh-qa-surface 0.9.0 → 0.11.0

package/lib/types/client/markdown/render.d.ts

@@ -7,7 +7,8 @@ import { type MarkdownSourceContext } from "./source-chip.js";
  * instead of a plain link or code token.
  * @param text - Assistant-authored markdown.
  * @param context - Source resolution handed down by the owning message.
- * @returns The document's blocks.
+ * @returns The document's blocks, plus the footnote section when the document
+ * references a defined footnote.
  */
 export declare function renderMarkdown(text: string, context: MarkdownSourceContext): ReactNode[];
 //# sourceMappingURL=render.d.ts.map

package/lib/types/client/settings/sections/notes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Model notes: the ambient plugin messages the injector writes into a QA chat
+ * (who the user is, the source-provenance rules, delegation naming, which
+ * reader an attached document belongs to, where an answer should come from).
+ * Each note has a switch and an optional wording override; an empty template
+ * keeps the built-in text, so the fields double as a wording editor and a mute
+ * switch.
+ */
+import { type ConfigProps } from "./common.js";
+/** The ambient notes the Host writes into QA chats as hidden user messages. */
+export declare function NotesSection(props: ConfigProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=notes.d.ts.map

package/lib/types/client/settings/sections.d.ts

@@ -18,6 +18,7 @@ export { BrandingSection } from "./sections/branding.js";
 export { EmbeddingSection } from "./sections/embedding.js";
 export { InterfaceSection } from "./sections/interface.js";
 export { LockdownSection } from "./sections/lockdown.js";
+export { NotesSection } from "./sections/notes.js";
 export { SessionSection } from "./sections/session.js";
 export { SlashSection } from "./sections/slash.js";
 export { SourcesSection } from "./sections/sources.js";

package/lib/types/client/settlement.d.ts

@@ -13,7 +13,10 @@ export declare function parseSettlement(text: string): SettledSubagent | undefin
 export interface SettlementView {
     readonly title: string;
     readonly body: string;
-    /** Muted correlation line above the body; absent when the title says it all. */
+    /**
+     * Muted correlation lines above the body, one fact per line; absent when
+     * the title says it all.
+     */
     readonly meta?: string;
 }
 /**

package/lib/types/client/styles.d.ts

@@ -2,12 +2,25 @@
 export declare const QA_BRAND_TOKEN_NAMES: readonly string[];
 export declare const QA_SURFACE_STYLES: string;
 /**
- * Everything the QA overlay paints, as one sheet for one `<style>` tag.
+ * Everything the QA surface paints, as one sheet for one `<style>` tag — the
+ * kiosk form, with no host-hiding rules: in the kiosk composition the native
+ * shell never mounts, so the sheet carries nothing aimed at it.
  *
  * The shared audit components keep their own stylesheet in
- * `@yadsh/dsh-audit-ui`; it is folded in here so the overlay is self-contained
+ * `@yadsh/dsh-audit-ui`; it is folded in here so the surface is self-contained
  * — the audit dialog must look right whether or not the audit plugin's own
  * client bundle happens to have injected the same rules into the document.
+ *
+ * The math styles and their fonts come from the bundled KaTeX copy the same
+ * way: the data-URI fonts resolve whatever the Host page loads, and identical
+ * rules from its own KaTeX stylesheet are harmless.
+ */
+export declare const QA_ROOT_STYLES: string;
+/**
+ * The overlay-composition sheet: the same rules as {@link QA_ROOT_STYLES}
+ * plus the host-column mask. Deployed into hosts without the kiosk patches,
+ * where the surface still covers a mounted native shell and the mask is what
+ * a deleted overlay element uncovers — a blank page instead of the shell.
  */
 export declare const QA_OVERLAY_STYLES: string;
 //# sourceMappingURL=styles.d.ts.map

package/lib/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { ClientRemote } from "@deepseek-ai/dsh-api-gateway/client";
 import type { ISessions, SessionFace } from "@deepseek-ai/dsh-api-session-controller/client";
 import type { UiConversation } from "@deepseek-ai/dsh-client-ui-conversation/client";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountStarter, QaAccountUserPublic, QaAccessAdminSnapshot, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaIssuedServiceToken, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSessionState, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaTurnSources, QaWhoamiResult, QaDocumentPreview, QaWorkspaceFile, QaWorkspaceListing, QaCapabilitySelection, QaCurrentAccess, QaSessionAccess, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminSkillScope, QaAdminSkillsView, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaUserQuery } from "../types.js";
 /** Wire content one prompt carries: text plus base64 image uploads. */
 export type QaPromptContent = Parameters<SessionFace["prompt"]>[0];
 /** DSH session runtime surface the QA controller is allowed to touch. */
@@ -56,6 +56,16 @@ export interface QaAdminApi {
     users(token: string, query: QaUserQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaAdminUserRow>>>;
     user(token: string, userId: string): Promise<RemoteResult<QaAdminUserDetail>>;
     updateUser(token: string, userId: string, update: QaAdminUserUpdate): Promise<RemoteResult<QaAdminUserDetail>>;
+    /**
+     * Accounts that asked for a password reset from the sign-in screen, newest
+     * first. Reading takes `users.read`; answering one takes `users.manage`.
+     */
+    passwordResetRequests(token: string): Promise<RemoteResult<readonly QaPasswordResetRequest[]>>;
+    /**
+     * Answer one request: set that account's new password and drop its row. The
+     * account's live sessions end with the token-version bump.
+     */
+    resetPassword(token: string, userId: string, password: string): Promise<RemoteResult<QaAdminUserDetail>>;
     conversations(token: string, query: QaConversationQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaConversationSummary>>>;
     conversation(token: string, conversationId: string): Promise<RemoteResult<QaConversationDetail>>;
     /**
@@ -71,6 +81,18 @@ export interface QaAdminApi {
     saveReview(token: string, input: QaConversationReviewInput): Promise<RemoteResult<QaConversationReview>>;
     metrics(token: string): Promise<RemoteResult<QaQualityMetrics>>;
     audit(token: string, query: QaAuditQuery, cursor: string | null, limit: number | null): Promise<RemoteResult<QaAdminPage<QaAdminAuditEvent>>>;
+    /**
+     * Skill files an administrator may edit: the deployment's shared store, or
+     * one named account's own. These are the same files the owner edits from
+     * their settings dialog, opened here with the authorization to leave a mark
+     * the owner sees.
+     */
+    skills(token: string, scope: QaAdminSkillScope): Promise<RemoteResult<QaAdminSkillsView>>;
+    skill(token: string, scope: QaAdminSkillScope, name: string): Promise<RemoteResult<QaSkillDocument>>;
+    saveSkill(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<RemoteResult<QaSkillDocument>>;
+    deleteSkill(token: string, scope: QaAdminSkillScope, name: string, expectedRevision: string | null): Promise<RemoteResult<QaSkillRemoval>>;
+    validateSkill(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<RemoteResult<QaSkillValidation>>;
+    skillTools(token: string, scope: QaAdminSkillScope): Promise<RemoteResult<readonly QaSkillToolDescriptor[]>>;
 }
 /**
  * Browser file-upload service (`ctx.fileUpload`), described structurally on
@@ -111,6 +133,34 @@ export interface QaSourceApi {
         readonly ok: false;
         readonly error: unknown;
     }>;
+    /** One directory of the chat's own workspace, for the files panel. */
+    listWorkspaceFiles(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceListing;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    /** One file of that workspace: decoded text, or bytes when it is binary. */
+    readWorkspaceFile(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceFile;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    /**
+     * A Word document of that workspace rendered as PDF by the deployment's
+     * document pipeline; the panel shows the PDF the browser already knows how
+     * to draw instead of uploading the bytes anywhere.
+     */
+    previewWorkspaceDocument(token: string, sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaDocumentPreview;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
 }
 /**
  * The slash half of the Host namespace. The catalog comes back already cut
@@ -138,6 +188,27 @@ export type QaBoundSourceApi = {
         readonly ok: false;
         readonly error: unknown;
     }>;
+    listWorkspaceFiles(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceListing;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    readWorkspaceFile(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaWorkspaceFile;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
+    previewWorkspaceDocument(sessionId: string, path: string): Promise<{
+        readonly ok: true;
+        readonly value: QaDocumentPreview;
+    } | {
+        readonly ok: false;
+        readonly error: unknown;
+    }>;
 };
 /**
  * Approval remotes of this plugin's namespace. Read-only listing plus the one
@@ -214,6 +285,31 @@ export interface QaBoundSkillApi {
     tools(): Promise<RemoteResult<readonly QaSkillToolDescriptor[]>>;
     validate(name: string | null, input: QaSkillDraftInput): Promise<RemoteResult<QaSkillValidation>>;
 }
+/**
+ * Outcome of one integration-token operation as the settings page sees it:
+ * the value, or the audience-safe copy for the refusal. The page renders the
+ * copy and never has to know a reason code.
+ */
+export type QaIntegrationTokenResult<Value> = {
+    readonly ok: true;
+    readonly value: Value;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** The integration-token section with the account token bound at the call site. */
+export interface QaIntegrationTokenApi {
+    /**
+     * Whether this deployment can mint at all. A token is a credential for the
+     * HTTP API, so when that API is off the page explains the state instead of
+     * offering a button that only ever refuses — while listing and revoking stay
+     * available, because a credential has to remain revocable.
+     */
+    readonly canCreate: boolean;
+    list(): Promise<QaIntegrationTokenResult<readonly QaServiceTokenSummary[]>>;
+    create(input: QaServiceTokenCreateInput): Promise<QaIntegrationTokenResult<QaIssuedServiceToken>>;
+    revoke(tokenId: string): Promise<QaIntegrationTokenResult<null>>;
+}
 /** Account remotes exposed by the plugin's own typert namespace. */
 export interface QaAccountsApi {
     accountsWhoami(token: string): Promise<RemoteResult<QaWhoamiResult>>;
@@ -230,6 +326,29 @@ export interface QaAccountsApi {
     accountsUpdateProfile(token: string, input: QaAccountProfileInput): Promise<RemoteResult<QaAccountUserPublic>>;
     /** Replace the caller's own starter buttons; the token is the identity. */
     accountsUpdateStarters(token: string, input: QaAccountStartersInput): Promise<RemoteResult<QaAccountUserPublic>>;
+    /**
+     * Replace the caller's own password. The answer carries a fresh token: the
+     * write bumps the account's token version, so without it the browser that
+     * made the change would sign itself out.
+     */
+    accountsChangePassword(token: string, currentPassword: string, nextPassword: string): Promise<RemoteResult<QaAccountSession>>;
+    /**
+     * File a forgotten-password request for the operator queue. The answer is
+     * the same for every address, so it reveals nothing about the account.
+     */
+    accountsRequestPasswordReset(email: string): Promise<RemoteResult<{
+        readonly accepted: true;
+    }>>;
+    /** The caller's own integration tokens; never a secret. */
+    accountsListServiceTokens(token: string): Promise<RemoteResult<{
+        readonly tokens: readonly QaServiceTokenSummary[];
+    }>>;
+    /** Mint one integration token for the caller; the plaintext comes back once. */
+    accountsCreateServiceToken(token: string, input: QaServiceTokenCreateInput): Promise<RemoteResult<QaIssuedServiceToken>>;
+    /** Revoke one of the caller's own integration tokens. */
+    accountsRevokeServiceToken(token: string, tokenId: string): Promise<RemoteResult<{
+        readonly revoked: boolean;
+    }>>;
 }
 /** One button above an empty composer: what it reads and what it sends. */
 export type QaQuickQuestion = QaAccountStarter;

package/lib/types/client/user-settings/IntegrationTokensPage.d.ts

@@ -0,0 +1,21 @@
+import type { QaIntegrationTokenApi } from "../types.js";
+/**
+ * The integration tokens of the signed-in account: mint, read the secret once,
+ * and revoke.
+ *
+ * An integration token is the credential a non-browser application presents to
+ * the QA HTTP API, and it is deliberately a second, separate credential from
+ * the browser session: it survives a password change, it carries its own
+ * scopes and expiry, and it is revoked here rather than by signing anybody out.
+ * The page therefore says what the token is *for* before it offers to mint one
+ * — handing a long-lived key to a service is not a preference toggle.
+ *
+ * The plaintext exists in exactly one place: the answer that minted it. It is
+ * shown once, with the warning that this is the only time, and the list that
+ * follows carries no secret in any state — a list that could repeat a
+ * credential would be a list that leaks it.
+ */
+export declare function QaIntegrationTokensPage(props: {
+    readonly api: QaIntegrationTokenApi;
+}): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=IntegrationTokensPage.d.ts.map

package/lib/types/client/user-settings/PasswordSettingsPage.d.ts

@@ -0,0 +1,19 @@
+export interface QaPasswordSettingsPageProps {
+    /**
+     * Replace the signed-in user's password; resolves to refusal copy, or to
+     * null once the Host accepted it. The controller keeps this browser signed
+     * in with the token that answer carries.
+     */
+    readonly onChange: (currentPassword: string, nextPassword: string) => Promise<string | null>;
+}
+/**
+ * The password section of the settings dialog: current, new, repeat. The
+ * repeat field is client-side only — it exists to catch a typo in the field
+ * that, unlike a name, cannot be read back later.
+ *
+ * The consequence is stated rather than discovered: changing a password ends
+ * every *other* session of this account, which is exactly the point after a
+ * leak and exactly what looks like a bug when nobody said so.
+ */
+export declare function QaPasswordSettingsPage(props: QaPasswordSettingsPageProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=PasswordSettingsPage.d.ts.map

package/lib/types/client/user-settings/UserSettingsDialog.d.ts

@@ -1,8 +1,8 @@
 import type { QaAccountIdentityField, QaAccountProfile, QaAccountProfileInput, QaAccountStarters, QaAccountStartersInput } from "../../types.js";
-import type { QaBoundSkillApi } from "../types.js";
+import type { QaBoundSkillApi, QaIntegrationTokenApi } from "../types.js";
 import type { QaUserSettingsSections } from "../settings-extensions/index.js";
 /** Sections of the user-facing settings dialog. */
-export type QaSettingsSectionId = "profile" | "starters" | "general" | "skills" | (string & {});
+export type QaSettingsSectionId = "profile" | "password" | "starters" | "tokens" | "general" | "skills" | (string & {});
 export interface QaUserSettingsDialogProps {
     readonly open: boolean;
     /** Section to show when the dialog opens. */
@@ -18,11 +18,20 @@ export interface QaUserSettingsDialogProps {
         readonly instructionsMaxLength: number;
         readonly onSave: (input: QaAccountProfileInput) => Promise<string | null>;
     };
+    /**
+     * Self-service password change. Absent only where the surface runs without
+     * accounts at all, in which case this dialog is not shown either.
+     */
+    readonly password?: {
+        readonly onChange: (currentPassword: string, nextPassword: string) => Promise<string | null>;
+    };
     /** Self-service starter buttons; absent when the deployment turns them off. */
     readonly starters?: {
         readonly starters: QaAccountStarters;
         readonly onSave: (input: QaAccountStartersInput) => Promise<string | null>;
     };
+    /** Integration tokens; absent when accounts are off altogether. */
+    readonly integrationTokens?: QaIntegrationTokenApi;
     /** Personal skills; absent when the deployment cannot host them. */
     readonly skills?: QaBoundSkillApi;
     /** Additive pages contributed by separately shipped QA plugins. */

package/lib/types/client/user-settings/copy.d.ts

@@ -1,4 +1,4 @@
-import type { QaSkillDiagnostic } from "../../types.js";
+import type { QaSkillAdminEdit, QaSkillDiagnostic } from "../../types.js";
 /**
  * Audience-facing copy for the settings dialog. The Host sends stable codes
  * and never Russian prose, so every message a user reads is written here.
@@ -11,6 +11,15 @@ export declare function diagnosticMessage(diagnostic: QaSkillDiagnostic): string
  * fault, an unknown code — reads as the generic failure.
  */
 export declare function skillFailureCopy(error: unknown): string;
+/**
+ * The badge line for a skill an administrator last wrote.
+ *
+ * It names the role, not the person: the row already carries a date, and who
+ * administers a deployment is not a fact a personal settings page should
+ * depend on. The mark itself comes from the Host, which only reports one while
+ * the stored bytes are still the administrator's.
+ */
+export declare function adminEditMessage(edit: QaSkillAdminEdit): string;
 /** Whether a failure is the optimistic-concurrency refusal. */
 export declare function isSkillConflict(error: unknown): boolean;
 export declare const SKILLS_EMPTY_COPY: {

package/lib/types/config-resolvers/integration.d.ts

@@ -0,0 +1,47 @@
+import type { QaIntegrationConfig, ResolvedQaSurfaceConfig } from "../types.js";
+type ResolvedIntegration = ResolvedQaSurfaceConfig["integration"];
+/** Operator-tunable bounds; the values the settings card shows as hard limits. */
+export declare const QA_INTEGRATION_TTL_DAYS_MIN = 1;
+export declare const QA_INTEGRATION_TTL_DAYS_MAX = 3650;
+export declare const QA_INTEGRATION_TIMEOUT_MS_MIN = 5000;
+export declare const QA_INTEGRATION_TIMEOUT_MS_MAX = 600000;
+export declare const QA_INTEGRATION_CONCURRENCY_MIN = 1;
+export declare const QA_INTEGRATION_CONCURRENCY_MAX = 16;
+export declare const QA_INTEGRATION_RATE_MIN = 1;
+export declare const QA_INTEGRATION_RATE_MAX = 600;
+export declare const QA_INTEGRATION_BODY_BYTES_MIN = 1048576;
+export declare const QA_INTEGRATION_BODY_BYTES_MAX = 67108864;
+export declare const QA_INTEGRATION_ATTACHMENT_BYTES_MIN = 1024;
+export declare const QA_INTEGRATION_ANSWER_CHARS_MIN = 256;
+export declare const QA_INTEGRATION_ANSWER_CHARS_MAX = 65536;
+/**
+ * Normalize the integration API's base path.
+ *
+ * It is a route namespace rather than a page: it may live under `/qa` (the
+ * default does), because the web server tries its exact table before the QA
+ * navigation's prefix, so `/qa/api/ask` never falls into the page route. What
+ * it may not do is claim the operator root, the first-party `/api` namespace
+ * or the plugin asset namespace.
+ * @param value - the configured path.
+ * @returns the path without a trailing slash.
+ */
+export declare function normalizeIntegrationBasePath(value: string): string;
+/**
+ * The integration API's slice of the resolved configuration.
+ *
+ * The endpoint is off unless a deployment asks for it: it is a network
+ * surface reachable by anything that holds a token, and a QA stand that never
+ * integrates anything must not grow one by accident.
+ *
+ * It also needs accounts. Integration tokens are issued to an account and
+ * verified against it, so a deployment with `accounts.enabled: false` has
+ * nothing to authenticate a caller with; switching the API on there is a
+ * configuration mistake, and it is refused rather than served open.
+ *
+ * @param input - raw integration config.
+ * @param accounts - the resolved accounts domain, for the cross-check.
+ * @returns the frozen resolved slice.
+ */
+export declare function resolveIntegration(input: QaIntegrationConfig | undefined, accounts: ResolvedQaSurfaceConfig["accounts"]): ResolvedIntegration;
+export {};
+//# sourceMappingURL=integration.d.ts.map

package/lib/types/config-resolvers/notes.d.ts

@@ -0,0 +1,10 @@
+import type { QaNotesConfig, ResolvedQaSurfaceConfig } from "../types.js";
+type ResolvedNotes = ResolvedQaSurfaceConfig["notes"];
+/**
+ * The ambient model notes. Notes are advisory text, not capability: the
+ * default is the current behavior (every note on, built-in wording), and an
+ * empty template always resolves to the built-in text.
+ */
+export declare function resolveNotes(input: QaNotesConfig | undefined): ResolvedNotes;
+export {};
+//# sourceMappingURL=notes.d.ts.map

package/lib/types/config.d.ts

@@ -1,5 +1,15 @@
 import z from "@deepseek-ai/schemastery";
 import type { QaSurfaceConfig } from "./types.js";
+/**
+ * Version this build reports to the integration API's health endpoint.
+ *
+ * Read from the package manifest rather than written as a constant, so a
+ * release bump cannot drift away from it. Resolved on first use so importing
+ * the module never touches the filesystem, and this module is the right home
+ * for it: it is bundled one level under the package root, which is the depth
+ * `../package.json` resolves at.
+ */
+export declare function qaSurfaceVersion(): string;
 export declare const ConfigSchema: z<QaSurfaceConfig>;
 export { DEFAULT_QA_SURFACE_CONFIG, normalizeRoutePath, resolveConfig, } from "./resolve-config.js";
 //# sourceMappingURL=config.d.ts.map

package/lib/types/index.d.ts

@@ -1,7 +1,7 @@
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import type { Context } from "@deepseek-ai/cordis";
 import type { QaTurnSources } from "./provenance/types.js";
-import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaLockdownProof, QaOwnershipEntry, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
+import type { QaAccountProfileInput, QaAccountSession, QaAccountStartersInput, QaAccountUserPublic, QaApprovalDecision, QaClaimResult, QaDocumentPreview, QaIssuedServiceToken, QaLockdownProof, QaOwnershipEntry, QaPasswordResetRequest, QaPendingApproval, QaPendingQuestion, QaQuestionAnswerItem, QaServiceTokenCreateInput, QaServiceTokenSummary, QaSurfaceConfig, ResolvedQaSurfaceConfig, QaAdminSkillScope, QaAdminSkillsView, QaSkillDocument, QaSkillDraftInput, QaSkillRemoval, QaSkillSummary, QaSkillToolDescriptor, QaSkillValidation, QaSourceFilePreview, QaWhoamiResult, QaWorkspaceFile, QaWorkspaceListing, QaPrincipal, QaAccessAdminSnapshot, QaAdminAuditEvent, QaAdminOverview, QaAdminPage, QaAdminUserDetail, QaAdminUserRow, QaAdminUserUpdate, QaAuditQuery, QaCapabilitySelection, QaConversationDetail, QaConversationDeletion, QaConversationQuery, QaConversationReview, QaConversationReviewInput, QaConversationSummary, QaCurrentAccess, QaFeedbackQuery, QaFeedbackRow, QaMessageFeedback, QaMessageFeedbackInput, QaQualityMetrics, QaReviewQueueItem, QaReviewQueueRow, QaSessionAccess, QaSlashCatalog, QaSlashExecution, QaSlashSubmitAttachment, QaSkillActivationRecord, QaSkillAssignmentOverride, QaSubrole, QaUserAccess, QaUserQuery } from "./types.js";
 export declare const name = "qa-surface";
 export declare const inject: string[];
 import { QA_SURFACE_SETTINGS_NAMESPACE } from "./shared/settings.js";
@@ -20,6 +20,7 @@ export declare class QaSurface extends TypertRemoteService {
     private readonly logger;
     private readonly admission;
     private readonly approvals;
+    private readonly fileDeleteGate;
     private readonly userQuestions;
     private readonly provenance;
     private readonly notes;
@@ -50,6 +51,14 @@ export declare class QaSurface extends TypertRemoteService {
     private webServer;
     private disposeRoute;
     private routeKey;
+    /**
+     * The HTTP API an external application asks questions through. Constructed
+     * always — it is cheap and stateless until a request arrives — and exposed
+     * on the network only while the deployment turns it on.
+     */
+    private readonly integration;
+    private disposeIntegrationRoutes;
+    private integrationRouteKey;
     /**
      * The quality store opens its file on first use, so a deployment that never
      * opens the admin console never grows one.
@@ -107,6 +116,15 @@ export declare class QaSurface extends TypertRemoteService {
     accountsRegister(email: string, password: string): QaAccountSession;
     accountsLogin(email: string, password: string): QaAccountSession;
     /** Identity probe; safe to call with an empty or expired token. */
+    accountsChangePassword(token: string, currentPassword: string, nextPassword: string): QaAccountSession;
+    /**
+     * The sign-in screen's "забыли пароль?" path. It answers the same way for
+     * every address: whether an account exists is not something this endpoint
+     * tells a caller.
+     */
+    accountsRequestPasswordReset(email: string): {
+        readonly accepted: true;
+    };
     accountsWhoami(token: string): QaWhoamiResult;
     /**
      * Migrate a browser's local chat index into server-side ownership. The
@@ -139,6 +157,29 @@ export declare class QaSurface extends TypertRemoteService {
      * deployment's limits are enforced in the store before anything is written.
      */
     accountsUpdateStarters(token: string, input: QaAccountStartersInput): QaAccountUserPublic;
+    /**
+     * The caller's own integration tokens. The list is the account's own: the
+     * token names it, and a secret is never part of a summary, so reading this
+     * cannot repeat a credential that was already handed over.
+     */
+    accountsListServiceTokens(token: string): {
+        readonly tokens: readonly QaServiceTokenSummary[];
+    };
+    /**
+     * Mint one integration token for the caller. The answer carries the
+     * plaintext exactly once — nothing stores it, so nothing can repeat it — and
+     * the account is always the authenticated one: there is no owner field on
+     * the wire.
+     */
+    accountsCreateServiceToken(token: string, input: QaServiceTokenCreateInput): QaIssuedServiceToken;
+    /**
+     * Revoke one of the caller's own integration tokens. This is the immediate
+     * kill switch the profile page offers: the next request that presents the
+     * credential is refused, without waiting for its expiry.
+     */
+    accountsRevokeServiceToken(token: string, tokenId: string): {
+        readonly revoked: boolean;
+    };
     /**
      * Serve the effective QA configuration to the browser. The DSH gateway pins
      * settings RPCs to loopback, so a browser served over the LAN always sees
@@ -170,12 +211,35 @@ export declare class QaSurface extends TypertRemoteService {
     accessUpdateSkillOverride(token: string, input: QaSkillAssignmentOverride): readonly QaSkillAssignmentOverride[];
     /** What each skill activation actually granted in this session. */
     accessSkillActivations(token: string, sessionId: string): readonly QaSkillActivationRecord[];
+    /**
+     * The skill catalog of one scope: the deployment's shared skills, or the
+     * personal skills of the account the scope names. Reading another account's
+     * skills is an administrative act, so it needs `skills.manage`.
+     */
+    adminSkills(token: string, scope: QaAdminSkillScope): Promise<QaAdminSkillsView>;
+    /** One skill file with the body, revision and administrator mark. */
+    adminSkill(token: string, scope: QaAdminSkillScope, name: string): Promise<QaSkillDocument>;
+    /**
+     * Create (`name` null) or replace one skill in place. The write is recorded
+     * as this administrator's, and the owner sees that it was.
+     */
+    adminSkillSave(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<QaSkillDocument>;
+    /** Remove one skill into the trash beside its own skills root. */
+    adminSkillDelete(token: string, scope: QaAdminSkillScope, name: string, expectedRevision: string | null): Promise<QaSkillRemoval>;
+    /** The file a save would write, plus every diagnostic for the draft. */
+    adminSkillValidate(token: string, scope: QaAdminSkillScope, name: string | null, input: QaSkillDraftInput): Promise<QaSkillValidation>;
+    /** The tool catalog the picker offers for one scope. */
+    adminSkillTools(token: string, scope: QaAdminSkillScope): Promise<{
+        readonly tools: readonly QaSkillToolDescriptor[];
+    }>;
     /** Counters, attention lines and the newest quality signals. */
     adminOverview(token: string): Promise<QaAdminOverview>;
     adminUsers(token: string, query: QaUserQuery, cursor: string | null, limit: number | null): Promise<QaAdminPage<QaAdminUserRow>>;
     adminUser(token: string, userId: string): Promise<QaAdminUserDetail>;
     /** Authorization role, status and subrole assignment of one account. */
     adminUpdateUser(token: string, userId: string, update: QaAdminUserUpdate): Promise<QaAdminUserDetail>;
+    adminPasswordResetRequests(token: string): Promise<readonly QaPasswordResetRequest[]>;
+    adminResetPassword(token: string, userId: string, password: string): Promise<QaAdminUserDetail>;
     adminConversations(token: string, query: QaConversationQuery, cursor: string | null, limit: number | null): Promise<QaAdminPage<QaConversationSummary>>;
     /** One conversation with its messages, tool calls and review state. */
     adminConversation(token: string, conversationId: string): Promise<QaConversationDetail>;
@@ -235,6 +299,43 @@ export declare class QaSurface extends TypertRemoteService {
      * the per-account scratch directory — could never be opened in the panel.
      */
     readSourceFile(token: string, sessionId: string, sourcePath: string): Promise<QaSourceFilePreview>;
+    /**
+     * List one directory of the chat's own workspace for the files panel.
+     *
+     * Browsing is deliberately narrower than the source preview: it stays inside
+     * the chat's own directory tree, so a visitor can look at what their
+     * conversation produced and at nothing else of the deployment.
+     * `readWorkspaceFile` opens one entry of such a listing.
+     */
+    listWorkspaceFiles(token: string, sessionId: string, path: string): Promise<QaWorkspaceListing>;
+    /**
+     * Read one file of the chat's workspace: text when it decodes as UTF-8, bytes
+     * when it does not, so a document the agent produced can be downloaded while
+     * a note previews inline. The readable roots are the ones the model itself
+     * may read; unlike the source preview this does not require the file to be
+     * recorded evidence, because the panel is browsing a tree rather than
+     * reopening a cited source.
+     */
+    readWorkspaceFile(token: string, sessionId: string, path: string): Promise<QaWorkspaceFile>;
+    /**
+     * Render one Word document of the chat's workspace as a PDF for the panel.
+     *
+     * The conversion is the document pipeline's own, reached through the service
+     * `@yadsh/dsh-documents` publishes for its Host siblings — the panel gets the
+     * same providers, limits and refusals the `document_*` tools see, and a
+     * deployment without that plugin refuses instead of showing a guess. The
+     * produced PDF is read back here and travels as base64, so the audience never
+     * reaches an unfenced byte route.
+     */
+    previewWorkspaceDocument(token: string, sessionId: string, path: string): Promise<QaDocumentPreview>;
+    /**
+     * Shared admission facts of both browse methods: the preview switch is what
+     * opens the panel's file reading at all, and the chat's cwd is the tree that
+     * browsing is confined to.
+     */
+    private browseContext;
+    /** One browse refusal, logged with its coarse reason and rethrown for the wire. */
+    private browseRefusal;
     /** Every personal skill of the token's account, sorted by name. */
     skillsList(token: string): {
         readonly skills: readonly QaSkillSummary[];
@@ -284,6 +385,15 @@ export declare class QaSurface extends TypertRemoteService {
      * the transcript row is read from.
      */
     slashExecute(token: string, sessionId: string, line: string, attachments: readonly QaSlashSubmitAttachment[]): Promise<QaSlashExecution>;
+    /**
+     * Register (or drop) the integration API's routes for the current config.
+     *
+     * The key is the whole registration decision — whether the API is on and
+     * where it lives — so a config change that does not move the endpoints
+     * leaves the live routes alone, and turning the API off disposes them
+     * immediately rather than at the next restart.
+     */
+    private refreshIntegrationRoutes;
     private refreshRoute;
     /**
      * A deployment that set `lockdown.allowSlashCommands: true` before this