dsh-agent-plugins-market 0.9.0 → 0.9.2

package/lib/types/{application → packages/market-mcp/src/application}/mcp-service.d.ts

@@ -1,32 +1,38 @@
 import type { McpStatusPayload } from './mcp/mcp-status.js';
-import type { ServerConfigPayload } from '../contracts/market.js';
-import type { Suite } from '../model/types.js';
-import type { McpBackend } from '../contracts/mcp.js';
-import type { McpMountDiagnostic } from '../contracts/mcp.js';
+import type { ServerConfigPayload } from '../../../market-contracts/src/contracts/market.js';
+import type { Suite } from '../../../market-contracts/src/model/types.js';
+import type { McpBackend } from '../../../market-contracts/src/contracts/mcp.js';
+import type { McpMountDiagnostic } from '../../../market-contracts/src/contracts/mcp.js';
 import { type McpServerOverride, type McpSuiteOverrides } from './mcp/mcp-overrides.js';
-import type { CatalogContext } from './catalog-context.js';
-import type { CatalogPorts, McpBackendInfo } from './ports.js';
-import type { SourceStore } from './source-store.js';
+import type { CatalogContext } from '../../../market-catalog/src/index.js';
+import type { CatalogPorts, LocalizeFields, McpBackendInfo } from '../../../market-contracts/src/ports/ports.js';
+import type { SourceStore } from '../../../market-catalog/src/index.js';
 export declare class McpService {
     private readonly context;
     private readonly ports;
     private readonly sources;
+    private readonly localizeFields;
     /** Latest MCP mount diagnostics (suiteId -> reasons), fed by host reconcile. */
     diagnostics: McpMountDiagnostic[];
-    constructor(context: CatalogContext, ports: CatalogPorts, sources: SourceStore);
+    constructor(context: CatalogContext, ports: CatalogPorts, sources: SourceStore, localizeFields: LocalizeFields);
     /** Build the flat MCP service inventory for the status surface. */
     status(): Promise<McpStatusPayload>;
-    /** Persist a user-owned MCP service and reconcile its bridge mount. */
-    addServer(name: string, server: unknown): Promise<void>;
-    /** Read effective service configuration without exposing credential literals. */
-    serverConfig(kind: 'mcp' | 'lsp', id: string): Promise<ServerConfigPayload>;
+    /**
+     * Validate configuration and policy before publishing a user-owned service.
+     * Policy is saved first: interruption can leave an unused override, never a
+     * declaration missing its requested policy. A failed declaration write restores
+     * the previous override; the two files are not a cross-file transaction.
+     */
+    addServer(name: string, server: unknown, policy?: unknown): Promise<void>;
+    /** Read one MCP service without credential literals, or an unsaved creation template. */
+    serverConfig(id: string, create?: boolean): Promise<ServerConfigPayload>;
     /**
      * Validate a complete replacement before writing; plugin checkouts remain
      * untouched. `policy` carries what the portable document has no seat for —
      * the two timeouts, the user's tool denials and the OAuth opt-in; an absent
      * field keeps its stored value, `null` clears it.
      */
-    saveServerConfig(kind: 'mcp' | 'lsp', id: string, config: unknown, policy?: unknown): Promise<void>;
+    saveServerConfig(id: string, config: unknown, policy?: unknown): Promise<void>;
     /** One suite's persisted MCP overrides, addressed by qualified suite id. */
     overrides(sourceId: string, suiteId: string): Promise<McpSuiteOverrides>;
     /**
@@ -91,9 +97,9 @@ export declare class McpService {
     /** MCP overrides for a supplied runtime selection, or the full market catalog when omitted. */
     allOverrides(suites?: readonly Suite[]): Promise<Map<string, McpSuiteOverrides>>;
     /**
-     * Resolve one editable server: its key, owning suite, root, and the service
-     * document the editor renders. An MCP document carries the portable shape
-     * only; the client policy behind it rides `policy`.
+     * Resolve one editable MCP server: its key, owning suite, root, and the
+     * service document the editor renders. An MCP document carries the portable
+     * shape only; the client policy behind it rides `policy`.
      */
     private resolveServerConfig;
 }

package/lib/types/packages/market-mcp/src/index.d.ts

@@ -0,0 +1,12 @@
+/** Explicit cross-domain entry surface. Internal modules are not import targets for siblings. */
+export { McpConfigError, restoreRedactedConfig, validateServerMcp, type McpFieldError } from './application/mcp/validation.js';
+export type { McpStatusPayload } from './application/mcp/mcp-status.js';
+export { USER_MCP_SOURCE, USER_MCP_SUITE, loadUserMcpSuite } from './application/mcp/mcp-direct-config.js';
+export { applyOverride, loadSuiteOverrides, sanitizeOverridePatch } from './application/mcp/mcp-overrides.js';
+export type { McpServerOverride, McpSuiteOverrides } from './application/mcp/mcp-overrides.js';
+export { McpService } from './application/mcp-service.js';
+export { credentialRefsInServer, deriveServerName } from './application/mcp/mcp-config.js';
+export { buildMcpStatus } from './application/mcp/mcp-status.js';
+export { deleteMcpAuthGrant } from './runtime/mcp/mcp-auth-record.js';
+export { platformBrowserOpener } from './runtime/mcp/bridge/oauth.js';
+export { McpMountRegistry } from './runtime/mcp/mcp-mounts.js';

package/lib/types/packages/market-mcp/src/runtime/mcp/bridge/tool-ownership.d.ts

@@ -0,0 +1,14 @@
+import type { Context } from '@deepseek-ai/cordis';
+export interface BridgeToolRegistration {
+    definition: {
+        readonly name: string;
+    };
+    serverName: string;
+    scope: object | undefined;
+}
+/** Publish identity before tools/change can expose a new definition; remove it after unregistering. */
+export declare function registerOwnedBridgeTool(ctx: Context, serverName: string, definition: {
+    readonly name: string;
+}, register: () => () => void): () => void;
+/** Exact definitions owned by bridge instances in this registration scope, independent of presentation mode. */
+export declare function bridgeToolRegistrations(ctx: Context): BridgeToolRegistration[];

package/lib/types/{runtime → packages/market-mcp/src/runtime}/mcp/mcp-auth-record.d.ts

@@ -16,6 +16,10 @@ export declare const MCP_AUTH_RECORD_SCOPE = "mcp-auth";
  * `__` separators (e.g. `cloudflare__cloudflare-api`), and the key grammar
  * admits only `[a-z0-9-]`, so non-conforming characters collapse to `-` —
  * deterministic, so the same server always reads and writes one record.
+ *
+ * One pass over the characters: a name arrives from a third-party suite, and
+ * the previous `[^a-z0-9-]+` replace with an anchored trim cost time quadratic
+ * in the length of a separator-only name.
  */
 export declare function mcpAuthRecordId(serverName: string): string;
 /** The credential record key one MCP server's OAuth grant is stored under. */

package/lib/types/{runtime → packages/market-mcp/src/runtime}/mcp/mcp-mounts.d.ts

@@ -9,11 +9,14 @@
  * the manager's diagnostic list.
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { McpBackend } from '../../contracts/mcp.js';
+import type { ExtensionMcpTool } from '../../../../market-runtime/src/index.js';
+import type { McpBackend } from '../../../../market-contracts/src/contracts/mcp.js';
 import type { McpSuiteOverrides } from '../../application/mcp/mcp-overrides.js';
-import type { Suite } from '../../model/types.js';
-import type { McpMountDiagnostic } from '../../contracts/mcp.js';
+import type { Suite } from '../../../../market-contracts/src/model/types.js';
+import type { McpMountDiagnostic } from '../../../../market-contracts/src/contracts/mcp.js';
 export type { McpMountDiagnostic };
+/** Host compatibility has no exact registration-ownership callback and remains globally managed. */
+export declare function supportsMcpSessionControl(backend: McpBackend): boolean;
 export declare class McpMountRegistry {
     private readonly ctx;
     private readonly pluginDataRoot;
@@ -25,6 +28,8 @@ export declare class McpMountRegistry {
     private toolNamesProvider;
     /** The active MCP mount backend ('builtin' bridge or host client compat mode). */
     private backendProvider;
+    /** Per-workspace entry filter; an absent provider mounts everything wanted. */
+    private entryFilter;
     /** Serialize mount and unmount passes so a disable cannot race an in-flight spawn. */
     private readonly passes;
     /** Delayed re-attempts for mounts that are not live yet. */
@@ -48,6 +53,15 @@ export declare class McpMountRegistry {
     setToolNamesProvider(provider: () => string[]): void;
     /** Install the backend provider deciding which client mounts each server. */
     setBackendProvider(provider: () => Promise<McpBackend>): void;
+    /**
+     * Install the per-workspace entry filter read at wanted-row time. A filtered
+     * server simply never becomes wanted, which is the same unmount path a
+     * removed suite takes; the registry stays attached and reconciles normally
+     * when the filter changes.
+     */
+    setEntryFilter(filter: () => {
+        allows(face: 'mcp', entryId: string): boolean;
+    }): void;
     /** Whether the last catalog snapshot uses one credential reference. */
     usesCredential(ref: string): boolean;
     /**
@@ -68,6 +82,8 @@ export declare class McpMountRegistry {
         suiteId: string;
         serverKey: string;
     } | undefined;
+    /** Current exact definitions, including an initializing bridge, independent of Native/PTC presentation. */
+    toolOwnership(): ExtensionMcpTool[];
     /** Queue one reconciliation behind any in-flight mount/unmount pass. */
     reconcile(enabledSuites: Suite[]): Promise<McpMountDiagnostic[]>;
     /** Mount/unmount MCP servers to match the enabled suites exactly. */

package/lib/types/packages/market-runtime/src/adapter-contracts.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The mount adapters the runtime coordinator drives, stated as structural ports.
+ *
+ * The coordinator owns ordering, containment and disposal; the MCP and LSP
+ * registries own their transports. Each port below lists exactly the members its
+ * consumer calls, with the signatures those registries already carry, so the
+ * composition root injects the implementations and no runtime module imports a
+ * transport package. Diagnostic values cross the seam as the shared wire
+ * contracts both registries re-export, so one failure keeps one type.
+ *
+ * @module adapter-contracts
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { McpBackend, McpMountDiagnostic } from '../../market-contracts/src/contracts/mcp.js';
+import type { LspMountDiagnostic } from '../../market-contracts/src/contracts/lsp.js';
+import type { LspMountStatusSource } from '../../market-contracts/src/ports/ports.js';
+import type { LspServerSpec, Suite } from '../../market-contracts/src/model/types.js';
+import type { ExtensionLspProvider, ExtensionMcpTool } from './runtime/host/extension-tool-gates.js';
+/**
+ * One suite's MCP override table, narrowed to what the coordinator reads: it
+ * only marks a demanded server enabled. Every field of the registry's own row
+ * type is optional, so this port and `McpSuiteOverrides` stay mutually
+ * assignable and no cast is needed in either direction.
+ */
+export type McpOverridesPort = Record<string, {
+    enabled?: boolean;
+}>;
+/** The MCP mount surface the agent-scoped contributor drives over one context. */
+export interface McpMountPort {
+    setOverridesProvider(provider: () => Promise<Map<string, McpOverridesPort>>): void;
+    setBackendProvider(provider: () => Promise<McpBackend>): void;
+    setToolNamesProvider(provider: () => string[]): void;
+    reconcile(enabledSuites: Suite[]): Promise<McpMountDiagnostic[]>;
+    disposeAll(): Promise<void>;
+    toolOwnership(): ExtensionMcpTool[];
+}
+/** The complete MCP mount adapter the shared-service coordinator drives. */
+export interface SharedMcpMountPort extends McpMountPort {
+    setEntryFilter(filter: () => {
+        allows(face: 'mcp', entryId: string): boolean;
+    }): void;
+    usesCredential(ref: string): boolean;
+    forceRemount(suiteId: string, serverKey: string): void;
+    forceRemountAll(): void;
+    serverOwner(serverName: string): {
+        suiteId: string;
+        serverKey: string;
+    } | undefined;
+    /**
+     * Prove one suite's demanded servers are mounted by this adapter.
+     *
+     * Lives here rather than in the coordinator because the proof needs the mount
+     * key this adapter derives for a server, which is transport knowledge.
+     * @param suite - the suite whose demanded servers must be live.
+     * @param diagnostics - the mount diagnostics of the pass that just ran.
+     * @param failed - whether that pass already recorded an MCP mount error.
+     * @throws when a demanded server is not the exact live owner of its key.
+     */
+    assertMounted(suite: Suite, diagnostics: readonly McpMountDiagnostic[], failed: boolean): void;
+}
+/** The LSP mount adapter the coordinator drives and the status surfaces read. */
+export interface LspMountPort extends LspMountStatusSource {
+    setPluginDataRoot(root: string): void;
+    setDirectProvider(provider: () => Promise<Record<string, LspServerSpec>>): void;
+    setDisabledProvider(provider: () => Promise<Set<string>>): void;
+    setEntryFilter(filter: () => {
+        allows(face: 'lsp', entryId: string): boolean;
+    }): void;
+    setDemandedProviderIdsProvider(provider: () => ReadonlySet<string>): void;
+    /** Current global disabled ids, without merging session demand. */
+    globalDisabledProviderIds(): Promise<ReadonlySet<string>>;
+    providerOwnership(): ExtensionLspProvider[];
+    ownsTool(): boolean;
+    reconcile(enabledSuites: Suite[]): Promise<LspMountDiagnostic[]>;
+    disposeAll(): Promise<void>;
+}
+/** The mount adapters one reconciler drives; the composition root builds both. */
+export interface RuntimeMounts {
+    readonly mcp: SharedMcpMountPort;
+    readonly lsp: LspMountPort;
+}
+/**
+ * Create one MCP mount over a caller-supplied context.
+ *
+ * The agent-scoped contributor mounts project servers and the workspace-pooled
+ * host bridge into contexts it does not own, so it takes the factory rather than
+ * an instance; the composition root closes over the concrete registry.
+ */
+export type McpMountFactory = (ctx: Context, dataRoot: string) => McpMountPort;

package/lib/types/{application → packages/market-runtime/src/application}/agent-roles.d.ts

@@ -6,6 +6,8 @@ export interface AgentRoleEntry {
     path: string;
     description: string;
     disabled: boolean;
+    /** Server-owned grant from the current parent's selected-role reader, never accepted from tool input. Revalidated before spawn. */
+    selectionEnabled?: boolean;
     title?: string;
     rawText?: string;
     /** Suite checkout root the card's `${PLUGIN_ROOT}` variables resolve to; absent for project-native files. */

package/lib/types/packages/market-runtime/src/application/command-resources.d.ts

@@ -0,0 +1,26 @@
+import type { SuiteMarkdownResource } from '../../../market-contracts/src/model/types.js';
+export interface CommandSpec {
+    name: string;
+    description: string;
+    body: string;
+    hint?: string;
+    /**
+     * The resource name as authored, before it was flattened into
+     * {@link CommandSpec.name} (`git/commit` where the call name is
+     * `git-commit`). The panel addresses the same document by this spelling, so
+     * it is the id the two surfaces have to agree on.
+     */
+    resourceName: string;
+    /** Set when the command file belongs to a suite with a plugin root; absent for project-native files. */
+    suiteRoot?: string;
+    /** The suite's `${PLUGIN_DATA}` directory; absent for project-native files. */
+    suiteData?: string;
+}
+export interface CommandReadOptions {
+    /** Preserve valid disabled declarations without changing their document or the default runtime policy. */
+    includeDisabled?: boolean;
+}
+/** Parse one declared resource; resourceName retains its identity before call-name flattening. */
+export declare function parseCommandResource(entry: SuiteMarkdownResource, text: string, options?: CommandReadOptions): CommandSpec | undefined;
+/** Read declared commands, or discover the conventional directory when resources is omitted. */
+export declare function readCommands(root: string, resources?: SuiteMarkdownResource[], options?: CommandReadOptions): Promise<CommandSpec[]>;

package/lib/types/packages/market-runtime/src/application/extension-authorization.d.ts

@@ -0,0 +1,12 @@
+import type { ExtensionResource, ExtensionSelection } from '../../../market-contracts/src/contracts/extension-presets.js';
+/**
+ * A resource must remain available and its suite must also be selected.
+ *
+ * A configuration parent (a `configuration` row, or any id in
+ * CONFIGURATION_PARENT_IDS) publishes no card anywhere, so a preset never
+ * carries its id: the grant is derived instead. When the row in question is
+ * the parent itself, any selected child grants it; when the row's parent is a
+ * configuration parent, the parent's availability and selection halves are
+ * skipped and the child's own id alone decides.
+ */
+export declare function extensionResourceEnabled(resource: ExtensionResource, selection: ExtensionSelection, resources: readonly ExtensionResource[]): boolean;

package/lib/types/packages/market-runtime/src/application/extension-hook-selection.d.ts

@@ -0,0 +1,23 @@
+import type { ProjectHooks, Suite } from '../../../market-contracts/src/model/types.js';
+/**
+ * The suites whose session inventory exposes one selectable row per command hook.
+ *
+ * Project-dimension suites and the user hooks configuration suite are the ones
+ * the session window lists hook rows for. An installed suite publishes no
+ * individual row, so its hooks stay governed by the parent suite grant.
+ * @param suite - the suite to classify.
+ * @returns whether this suite's hooks are addressed individually.
+ */
+export declare function exposesIndividualHooks(suite: Pick<Suite, 'sourceId' | 'id' | 'dimension'>): boolean;
+/**
+ * Whether one declaration admits any hook under the exact published identities.
+ *
+ * A stale identity — an event the declaration no longer carries, or a position
+ * past the end of its hook list — admits nothing, so a preset saved against an
+ * older declaration grants no capability it does not name.
+ * @param suite - the suite whose declaration is being projected.
+ * @param hooks - the validated declaration, when it has one.
+ * @param enabledIds - the session selection's resource ids.
+ * @returns whether at least one command hook of the declaration is named.
+ */
+export declare function admitsAnyHook(suite: Pick<Suite, 'sourceId' | 'id'>, hooks: ProjectHooks | undefined, enabledIds: readonly string[]): boolean;

package/lib/types/packages/market-runtime/src/application/extension-suite-declarations.d.ts

@@ -0,0 +1,10 @@
+/** Validate local suite declarations without applying global enablement or mutating source files. */
+import type { Suite } from '../../../market-contracts/src/model/types.js';
+import type { ExtensionSuiteCandidate } from './extension-suite-selection.js';
+/**
+ * Callers supply installed/local suites from catalog snapshots with validated skill, MCP, LSP and hook declarations.
+ * Markdown is revalidated from explicit resource lists; absent lists never trigger discovery.
+ * Returns detached declarations with valid disabled entries retained. Missing files and invalid markdown are omitted;
+ * other I/O failures reject the read rather than publishing a partial replacement.
+ */
+export declare function readExtensionSuiteDeclarations(suites: readonly Suite[]): Promise<ExtensionSuiteCandidate[]>;

package/lib/types/packages/market-runtime/src/application/extension-suite-selection.d.ts

@@ -0,0 +1,30 @@
+import type { ExtensionSelection } from '../../../market-contracts/src/contracts/extension-presets.js';
+import type { Suite, SuiteSurfaceKey } from '../../../market-contracts/src/model/types.js';
+export interface ExtensionSuiteCandidate {
+    /** Already installed/local declarations, including parser-validated system prompts and materialized valid markdown lists. */
+    suite: Suite;
+    /** Evidence from the existing parse owner, not global toggles or an all-true fallback. Unknown/invalid surfaces are false. */
+    validSurfaces: Readonly<Record<SuiteSurfaceKey, boolean>>;
+}
+export interface ExtensionSuiteProjection {
+    suite: Suite;
+    globalEnabled: boolean;
+    globalSurfaces: Record<SuiteSurfaceKey, boolean>;
+}
+/**
+ * Whether one resource id belongs to this suite's own selectable surface.
+ *
+ * The inventory addresses a suite's children with these exact spellings, so
+ * this one predicate decides both "the suite is selected" (the parent id, or
+ * any child id for a configuration parent whose card no client renders) and
+ * "this child is selected". It is the single derivation point the session
+ * selection and the shared reconciler share.
+ */
+export declare function suiteOwnsResourceId(suite: Pick<Suite, 'sourceId' | 'id'>, resourceId: string): boolean;
+/**
+ * Project validated declarations without scanning, mounting, or changing global defaults.
+ * Callers retain credential, tool-policy and execution checks; this is not shared-service union ownership.
+ * Unmaterialized markdown is empty rather than a request for downstream filesystem discovery.
+ * Surface counts remain declaration metadata; activeSurfaces and filtered tables govern execution.
+ */
+export declare function projectExtensionSuites(candidates: readonly ExtensionSuiteCandidate[], selection: ExtensionSelection): ExtensionSuiteProjection[];

package/lib/types/packages/market-runtime/src/application/fs-probe.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Whether a path is confirmed absent rather than unreadable.
+ *
+ * An error code alone cannot separate a removed entry from an unreadable
+ * source, because a platform can report `ENOENT` for a child of a file. The
+ * path ancestors answer the question instead: when the nearest existing
+ * ancestor is a directory, the entry is genuinely gone, and when it is not a
+ * directory, the source cannot be read and the caller must fail closed.
+ * @param path - the path to classify.
+ * @returns `true` only when the path is confirmed absent.
+ */
+export declare function isAbsentPath(path: string): Promise<boolean>;

package/lib/types/packages/market-runtime/src/application/panel-resources.d.ts

@@ -0,0 +1,100 @@
+import type { UserPanelEntryWire, UserPanelKind } from '../../../market-contracts/src/contracts/market.js';
+import type { DocumentTranslation } from '../../../market-contracts/src/contracts/translation.js';
+/**
+ * The user-panel store surface the panel resources drive (structural).
+ *
+ * The store always reads whole documents, and only the single-entry read hands
+ * one back over the wire; the raw text stays inside this module so the list
+ * view never serializes it.
+ */
+interface UserPanelEntries {
+    list(strict?: boolean): Promise<PanelEntryRecord[]>;
+    create(name: string, text: string): Promise<UserPanelEntryWire>;
+    update(name: string, text: string): Promise<void>;
+    remove(name: string): Promise<void>;
+}
+import type { CatalogPort as Catalog } from '../catalog-port.js';
+/** One panel entry with its document, as this module keeps it in memory. */
+interface PanelEntryRecord extends UserPanelEntryWire {
+    rawText: string;
+}
+/** The routes consume this structural surface, also implemented by user-only stores in tests. */
+/** One panel read: the entries, and how many description fields it left in flight. */
+export interface PanelRead {
+    entries: UserPanelEntryWire[];
+    /** Fields this read queued that have not landed yet; 0 means the text is settled. */
+    translationPending: number;
+}
+export interface PanelResourceStore {
+    /**
+     * Entries plus the translation work this read queued. A reader that wants the
+     * translated text polls this until the count reaches zero; one that only
+     * needs the rows calls {@link PanelResourceStore.list}.
+     *
+     * The rows carry no document text: it was the bulk of the response, and only
+     * the one entry a reader opens needs it — {@link PanelResourceStore.get}.
+     * @param strict - propagate I/O failures instead of skipping the entry.
+     * @param force - re-derive every row instead of answering from the row cache;
+     * the panel's Refresh button is what a user presses when they want the
+     * working tree as it stands now.
+     */
+    read(strict?: boolean, force?: boolean): Promise<PanelRead>;
+    /** Strict runtime reads propagate I/O failures so catalogs cannot publish partial replacements. */
+    list(strict?: boolean): Promise<UserPanelEntryWire[]>;
+    /**
+     * One entry with the file's current document, for the surface that reads or
+     * rewrites it. Every field the document itself supplies comes from one read of
+     * it, so the answer is one revision of the entry rather than a fresh document
+     * beside cached metadata.
+     */
+    get(id: string): Promise<UserPanelEntryWire | undefined>;
+    /**
+     * One entry's document translated for the panel's locale, chunk by chunk.
+     *
+     * The entry is re-read here rather than accepted from the caller: the route
+     * above it only names an entry, so a page cannot hand this layer arbitrary
+     * text to spend the operator's translation quota on. The body is split and
+     * the chunks this read could not answer for are queued; the caller polls
+     * until `pending` reaches zero.
+     */
+    translateDocument(id: string, retry?: boolean): Promise<DocumentTranslation>;
+    create(name: string, text: string): Promise<UserPanelEntryWire>;
+    update(id: string, text: string): Promise<void>;
+    remove(id: string): Promise<void>;
+}
+/**
+ * Id of one suite-owned document, whichever surface addresses it. The leading
+ * `[` is what distinguishes a plugin entry from a user-authored one;
+ * `update`/`remove` use {@link isPluginResourceId} to tell them apart, and the
+ * market detail page keys its document translations by the same value so one
+ * file stays one cache entry across both surfaces.
+ */
+export declare function pluginResourceId(sourceId: string, suiteId: string, kind: UserPanelKind, name: string): string;
+/** Whether a panel entry id addresses a file inside an installed suite. */
+export declare function isPluginResourceId(id: string): boolean;
+/**
+ * How long one set of scanned rows may be reused.
+ *
+ * The memo exists to collapse the reads one interaction produces — the re-read
+ * after a mutation, the detail open, the next panel's read — and to absorb one
+ * tick of the client's 1.5 s translation poll. It must not outlive that: the
+ * scan reads file contents, so an out-of-band edit stays invisible to a reused
+ * row for as long as the bound allows. Ageing the rows on the snapshot object
+ * alone would inherit the user snapshot's 30 s TTL — the keep-warm refresh
+ * replaces that object only every 0.8 of it — leaving a hand edit invisible for
+ * tens of seconds. Two seconds is one poll interval plus the slack a slow read
+ * needs, so a poll landing a tick after the read that armed it is still free,
+ * while a hand edit is visible by the next poll at the latest — and Refresh
+ * re-reads unconditionally.
+ */
+export declare const ROW_CACHE_MAX_AGE_MS = 2000;
+/**
+ * Build the three panel stores over one catalog.
+ *
+ * Translation reaches the panels as a callback rather than a direct
+ * collaborator: the catalog owns the localizer, and a panel only needs the
+ * resolved field set for one entry. Each panel binds its own kind, which is
+ * also the translation surface its entries belong to.
+ */
+export declare function createPanelResources(catalog: Catalog, users: Record<UserPanelKind, UserPanelEntries>, projectCwd?: string): Record<UserPanelKind, PanelResourceStore>;
+export {};

package/lib/types/{application → packages/market-runtime/src/application}/panels/user-hooks.d.ts

@@ -1,4 +1,4 @@
-import { type Suite } from '../../model/types.js';
+import { type Suite } from '../../../../market-contracts/src/model/types.js';
 export declare const USER_HOOKS_SOURCE = "@user-hooks";
 export declare const USER_HOOKS_SUITE = "user-hooks";
 /**

package/lib/types/packages/market-runtime/src/application/project-agent-roles.d.ts

@@ -0,0 +1,10 @@
+import { type AgentRoleEntry } from './agent-roles.js';
+import type { CatalogPort as Catalog } from '../catalog-port.js';
+import type { Suite } from '../../../market-contracts/src/model/types.js';
+export interface ProjectAgentRoleOptions {
+    /** Validated selected clones; absence preserves ordinary project discovery. */
+    suites?: () => Promise<Suite[]>;
+    /** Current parent-scoped grant, checked after parsing each document. */
+    selected?: (entry: AgentRoleEntry) => boolean;
+}
+export declare function projectAgentRoles(catalog: Catalog, parent: unknown, options?: ProjectAgentRoleOptions): Promise<AgentRoleEntry[]>;

package/lib/types/packages/market-runtime/src/application/state/extension-presets.d.ts

@@ -0,0 +1,24 @@
+import { type ExtensionPresetInput, type ExtensionPresetLibrary } from '../../../../market-contracts/src/contracts/extension-presets.js';
+export declare class ExtensionPresetError extends Error {
+    readonly code: 'preset-conflict' | 'preset-not-found' | 'preset-name-conflict' | 'preset-state-invalid';
+    constructor(code: 'preset-conflict' | 'preset-not-found' | 'preset-name-conflict' | 'preset-state-invalid', message: string);
+}
+/** The workspace path is validated and hashed; names and clipboard data never determine a path. */
+export declare function extensionPresetLibraryPath(dataRoot: string, workspace: string): string;
+export declare class ExtensionPresetStore {
+    private readonly dataRoot;
+    constructor(dataRoot: string);
+    /** Read current disk state; corruption and access failures reject rather than erasing saved choices. */
+    read(workspace: string): Promise<ExtensionPresetLibrary>;
+    /** Create a named preset at the caller's observed library revision; configuration parents never persist. */
+    create(workspace: string, expectedRevision: number, input: ExtensionPresetInput): Promise<ExtensionPresetLibrary>;
+    /** Replace one preset and advance its revision; existing session snapshots are not touched. */
+    update(workspace: string, expectedRevision: number, id: string, input: ExtensionPresetInput): Promise<ExtensionPresetLibrary>;
+    /** Choose only the default for future sessions. Null captures global choices for new sessions. */
+    setDefault(workspace: string, expectedRevision: number, id: string | null): Promise<ExtensionPresetLibrary>;
+    /** Delete a preset and clear its default pointer atomically; sessions retain their copies. */
+    delete(workspace: string, expectedRevision: number, id: string): Promise<ExtensionPresetLibrary>;
+    private requirePreset;
+    private assertName;
+    private mutate;
+}

package/lib/types/packages/market-runtime/src/application/state/resource-favorites.d.ts

@@ -0,0 +1,9 @@
+import { type ResourceFavoriteInput, type ResourceFavoriteWire } from '../../../../market-contracts/src/contracts/resource-window.js';
+/** The favorites file lives at the data root, beside the surface-toggles directory. */
+export declare function resourceFavoritesPath(dataRoot: string): string;
+/** Load the global favorite list; absent or malformed means none. */
+export declare function loadResourceFavorites(dataRoot: string): Promise<ResourceFavoriteWire[]>;
+/** Append one favorite and return the stored row. */
+export declare function saveResourceFavorite(dataRoot: string, input: ResourceFavoriteInput): Promise<ResourceFavoriteWire>;
+/** Drop one favorite by id; a missing id is a no-op. */
+export declare function deleteResourceFavorite(dataRoot: string, id: string): Promise<void>;

package/lib/types/packages/market-runtime/src/application/state/resource-filters.d.ts

@@ -0,0 +1,2 @@
+/** Compatibility entry for workspace policy storage. The document has one mutation owner. */
+export { allFiltersOn, loadResourceFilters, saveResourceFilters, resolveOffEntries, type ResourceFilters, type FilterFace } from './workspace-policy.js';

package/lib/types/packages/market-runtime/src/application/state/surface-toggles.d.ts

@@ -0,0 +1,6 @@
+/** Legacy surface view over the canonical workspace policy document. */
+import type { SurfaceToggles } from '../../../../market-contracts/src/contracts/surface-toggles.js';
+export { surfaceTogglesPath } from './workspace-policy.js';
+export declare function loadSurfaceToggles(dataRoot: string, workspace: string): Promise<SurfaceToggles>;
+/** Replace surface choices while preserving the latest committed entry choices. */
+export declare function saveSurfaceToggles(dataRoot: string, workspace: string, toggles: SurfaceToggles): Promise<void>;

package/lib/types/packages/market-runtime/src/application/state/workspace-policy.d.ts

@@ -0,0 +1,19 @@
+import { type SurfaceToggleKey, type SurfaceToggles } from '../../../../market-contracts/src/contracts/surface-toggles.js';
+export type FilterFace = SurfaceToggleKey;
+export interface ResourceFilters {
+    toggles: SurfaceToggles;
+    offEntries: Partial<Record<FilterFace, string[]>>;
+}
+export declare function allFiltersOn(): ResourceFilters;
+/** Preserve the existing workspace hash and file location. */
+export declare function surfaceTogglesPath(dataRoot: string, workspace: string): string;
+export declare function resolveOffEntries(value: unknown): Partial<Record<FilterFace, string[]>>;
+/** v1 and v2 share field names. Invalid JSON and access failures still reject. */
+export declare function loadResourceFilters(dataRoot: string, workspace: string): Promise<ResourceFilters>;
+/**
+ * Re-read under the published host file lock, persist once, then return the committed snapshot.
+ * The mutation stays synchronous; no runtime refresh or caller callback runs under the file lock.
+ */
+export declare function mutateResourceFilters(dataRoot: string, workspace: string, mutate: (current: ResourceFilters) => ResourceFilters): Promise<ResourceFilters>;
+/** Replace both policy sections as one transaction. */
+export declare function saveResourceFilters(dataRoot: string, workspace: string, filters: ResourceFilters): Promise<void>;

package/lib/types/packages/market-runtime/src/catalog-port.d.ts

@@ -0,0 +1,30 @@
+/** Read-only product queries required by session and content contributors. */
+import type { CatalogSnapshot } from '../../market-catalog/src/index.js';
+import type { Suite } from '../../market-contracts/src/model/types.js';
+import type { OverviewPayload, SuiteDocumentText, UserPanelKind } from '../../market-contracts/src/contracts/market.js';
+import type { McpStatusPayload } from '../../market-contracts/src/contracts/mcp-status.js';
+import type { LspStatusPayload } from '../../market-contracts/src/contracts/lsp-status.js';
+import type { McpBackend } from '../../market-contracts/src/contracts/mcp.js';
+import type { LocalizeFields, LocalizeDocument } from '../../market-contracts/src/ports/ports.js';
+import type { DocumentTranslation } from '../../market-contracts/src/contracts/translation.js';
+import type { McpSuiteOverrides } from '../../market-contracts/src/contracts/mcp-overrides.js';
+export interface CatalogPort {
+    readonly userRoot: string;
+    readonly dataRoot: string;
+    readonly agentsRoot: string;
+    readonly localePreference: string;
+    now(): number;
+    isInstalled(sourceId: string, suiteId: string): boolean;
+    readUserCatalog(): Promise<CatalogSnapshot>;
+    readProjectCatalog(cwd: string): Promise<CatalogSnapshot>;
+    enabledUserSuites(): Promise<Suite[]>;
+    overview(): Promise<OverviewPayload>;
+    mcpStatus(): Promise<McpStatusPayload>;
+    lspStatus(): Promise<LspStatusPayload>;
+    mcpBackend(): Promise<McpBackend>;
+    allMcpOverrides(suites?: readonly Suite[]): Promise<Map<string, McpSuiteOverrides>>;
+    translateFields: LocalizeFields;
+    translateDocument: LocalizeDocument;
+    suiteDocument(sourceId: string, suiteId: string, kind: UserPanelKind, name: string, cwd?: string): Promise<SuiteDocumentText>;
+    suiteDocumentTranslation(sourceId: string, suiteId: string, kind: UserPanelKind, name: string, retry?: boolean, cwd?: string): Promise<DocumentTranslation>;
+}

package/lib/types/packages/market-runtime/src/extension-service.d.ts

@@ -0,0 +1,14 @@
+import type { ExtensionHookRunInput, ExtensionHookRunResult, ExtensionHooksOverview, ExtensionWindowPayload, ExtensionPresetInput } from '../../market-contracts/src/contracts/extension-presets.js';
+export interface ExtensionRouteService {
+    window(sessionId: string): Promise<ExtensionWindowPayload>;
+    create(sessionId: string, revision: number, input: ExtensionPresetInput): Promise<void>;
+    update(sessionId: string, revision: number, id: string, input: ExtensionPresetInput): Promise<void>;
+    delete(sessionId: string, revision: number, id: string): Promise<void>;
+    setDefault(sessionId: string, revision: number, id: string | null): Promise<void>;
+    select(sessionId: string, revision: number, id: string | null): Promise<void>;
+    recover?(sessionId: string, revision: number): Promise<void>;
+    /** The settings Hooks tab reads the configured declarations; no session owns them. */
+    hooksOverview?(): Promise<ExtensionHooksOverview>;
+    /** Run one declared hook as a dry run; the declaration is resolved server-side. */
+    hookRun?(input: ExtensionHookRunInput): Promise<ExtensionHookRunResult>;
+}