dsh-connect 0.7.2 → 0.9.0

package/lib/settings/credential-store.js

@@ -0,0 +1,142 @@
+/**
+ * Host-side credential store for dsh-connect channels. Adapts the DSH
+ * `credentials` provider (`resolve/describe/set/unset`, env-style refs) into a
+ * per-channel interface, so secrets live in the DSH credential store instead of
+ * the plugin config (mirroring dsh-im's `credential-store.mjs`). The web
+ * settings pane reports `configured` booleans and may echo store-backed secret
+ * values (e.g. an appId) so an upgraded user can confirm them, but secrets
+ * never persist to the settings state file — the credential store is the only
+ * place secret values are held.
+ *
+ * @module dsh-connect/settings/credential-store
+ */
+import { CHANNELS } from "./channels.js";
+/** Unwrap either resolution shape to a non-empty string, else undefined. */
+function resolveValue(resolved) {
+    const value = typeof resolved === "string" ? resolved : resolved?.value;
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/** Maps each channel's secret *config key* to its credential ref, so the
+ * settings service and activation can enrich a channel config from the store.
+ *
+ * This is the **authoritative list of refs a channel owns**: every ref that
+ * `save` can write appears here. A ref reachable only through
+ * {@link CREDENTIAL_GROUPS} would be writable-but-unclearable — `save` and
+ * `clear` both derive from this table for exactly that reason. */
+export const CHANNEL_SECRET_KEYS = Object.freeze({
+    feishu: { appId: "DSH_CONNECT_FEISHU_APP_ID", appSecret: "DSH_CONNECT_FEISHU_APP_SECRET" },
+    telegram: { botToken: "DSH_CONNECT_TELEGRAM_BOT_TOKEN" },
+    dingtalk: {
+        webhookUrl: "DSH_CONNECT_DINGTALK_WEBHOOK_URL",
+        secret: "DSH_CONNECT_DINGTALK_SECRET",
+        clientId: "DSH_CONNECT_DINGTALK_CLIENT_ID",
+        clientSecret: "DSH_CONNECT_DINGTALK_CLIENT_SECRET",
+    },
+    web: {},
+});
+/**
+ * Credential sets that satisfy a channel, as groups-of-refs.
+ *
+ * Within a group every ref must be configured; between groups any one group
+ * being complete is enough. The grouping exists for DingTalk, which has two
+ * mutually exclusive transports — webhook push (url + signing secret) and
+ * stream mode (client id + secret). A flat all-of list would report a
+ * webhook-only user as "未配置凭据" because their stream refs are empty.
+ *
+ * An empty group list means the channel needs no credentials at all, so it is
+ * always satisfied — `web` mirrors the DSH Web UI in-process and holds no
+ * secret. Reporting that as unconfigured was pure noise in the pane's badge.
+ */
+export const CREDENTIAL_GROUPS = Object.freeze({
+    feishu: [["DSH_CONNECT_FEISHU_APP_ID", "DSH_CONNECT_FEISHU_APP_SECRET"]],
+    telegram: [["DSH_CONNECT_TELEGRAM_BOT_TOKEN"]],
+    dingtalk: [
+        ["DSH_CONNECT_DINGTALK_WEBHOOK_URL", "DSH_CONNECT_DINGTALK_SECRET"],
+        ["DSH_CONNECT_DINGTALK_CLIENT_ID", "DSH_CONNECT_DINGTALK_CLIENT_SECRET"],
+    ],
+    web: [],
+});
+/**
+ * Flat, de-duplicated view of every ref named by {@link CREDENTIAL_GROUPS},
+ * in declaration order. Kept because existing callers and tests import it;
+ * new code should prefer `CHANNEL_SECRET_KEYS` for the refs a channel owns.
+ */
+export const CREDENTIAL_REFS = Object.freeze(Object.fromEntries(CHANNELS.map((channel) => [channel, groupRefs(channel)])));
+/** De-duplicated union of every ref named by a channel's groups. */
+function groupRefs(channel) {
+    const seen = new Set();
+    for (const group of CREDENTIAL_GROUPS[channel] ?? []) {
+        for (const ref of group)
+            seen.add(ref);
+    }
+    return Object.freeze([...seen]);
+}
+/**
+ * Every ref a channel may have written, i.e. the union of the refs named by its
+ * groups and its config-key table. `clear` uses this so it cannot leave behind
+ * a ref that `save` was able to write.
+ */
+function ownedRefs(channel) {
+    const seen = new Set(groupRefs(channel));
+    for (const ref of Object.values(CHANNEL_SECRET_KEYS[channel] ?? {}))
+        seen.add(ref);
+    return [...seen];
+}
+function assertProvider(provider) {
+    for (const method of ["resolve", "describe", "set", "unset"]) {
+        if (typeof provider[method] !== "function") {
+            throw new TypeError(`A DSH credential provider with ${method}() is required`);
+        }
+    }
+}
+/** Build a per-channel credential store over a DSH `credentials` provider. */
+export function createCredentialStore(provider) {
+    assertProvider(provider);
+    return Object.freeze({
+        async configured(channel) {
+            const groups = CREDENTIAL_GROUPS[channel] ?? [];
+            // No credential requirement at all (e.g. the in-process Web mirror):
+            // nothing to be missing, so the channel counts as configured.
+            if (groups.length === 0)
+                return true;
+            for (const group of groups) {
+                const described = await Promise.all(group.map((ref) => provider.describe(ref)));
+                if (described.every((d) => d.configured === true))
+                    return true;
+            }
+            return false;
+        },
+        async save(channel, values) {
+            // Iterate the config-key table, not the group union: it is the complete
+            // list of refs this channel owns. Deriving the write set from the groups
+            // silently dropped DingTalk's stream credentials, because only the
+            // webhook group was represented there — the pane reported `ok: true`
+            // while the clientId/clientSecret the user typed were never stored.
+            for (const ref of Object.values(CHANNEL_SECRET_KEYS[channel] ?? {})) {
+                const value = values[ref];
+                if (value !== undefined)
+                    await provider.set(ref, value);
+            }
+        },
+        async get(channel) {
+            const map = CHANNEL_SECRET_KEYS[channel] ?? {};
+            const entries = await Promise.all(Object.entries(map).map(async ([configKey, ref]) => {
+                const value = resolveValue(await provider.resolve(ref));
+                return [configKey, value];
+            }));
+            const out = {};
+            for (const [configKey, value] of entries) {
+                if (value !== undefined)
+                    out[configKey] = value;
+            }
+            return out;
+        },
+        async clear(channel) {
+            const outcomes = await Promise.allSettled(ownedRefs(channel).map((ref) => provider.unset(ref)));
+            if (outcomes.some((o) => o.status === "rejected")) {
+                throw new Error(`Unable to clear ${channel} credentials.`);
+            }
+        },
+    });
+}
+//# sourceMappingURL=credential-store.js.map

package/lib/settings/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../src/settings/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAoB,MAAM,eAAe,CAAC;AA4B3D,4EAA4E;AAC5E,SAAS,YAAY,CAAC,QAAwD;IAC5E,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC;IACxE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED;;;;;;kEAMkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAgD,MAAM,CAAC,MAAM,CAAC;IAC5F,MAAM,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,+BAA+B,EAAE;IAC1F,QAAQ,EAAE,EAAE,QAAQ,EAAE,gCAAgC,EAAE;IACxD,QAAQ,EAAE;QACR,UAAU,EAAE,kCAAkC;QAC9C,MAAM,EAAE,6BAA6B;QACrC,QAAQ,EAAE,gCAAgC;QAC1C,YAAY,EAAE,oCAAoC;KACnD;IACD,GAAG,EAAE,EAAE;CACR,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwD,MAAM,CAAC,MAAM,CAAC;IAClG,MAAM,EAAE,CAAC,CAAC,2BAA2B,EAAE,+BAA+B,CAAC,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,gCAAgC,CAAC,CAAC;IAC9C,QAAQ,EAAE;QACR,CAAC,kCAAkC,EAAE,6BAA6B,CAAC;QACnE,CAAC,gCAAgC,EAAE,oCAAoC,CAAC;KACzE;IACD,GAAG,EAAE,EAAE;CACR,CAAwD,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAA2C,MAAM,CAAC,MAAM,CAClF,MAAM,CAAC,WAAW,CAChB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CACzD,CACwC,CAAC;AAE5C,oEAAoE;AACpE,SAAS,SAAS,CAAC,OAAoB;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAoB;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAiBD,SAAS,cAAc,CAAC,QAA6B;IACnD,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAU,EAAE,CAAC;QACtE,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,kCAAkC,MAAM,gBAAgB,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,QAA6B;IACjE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,UAAU,CAAC,OAAoB;YACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,qEAAqE;YACrE,8DAA8D;YAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChF,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACjE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,MAA8B;YAC7D,wEAAwE;YACxE,yEAAyE;YACzE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAoB;YAC5B,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE;gBACjD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxD,OAAO,CAAC,SAAS,EAAE,KAAK,CAAU,CAAC;YACrC,CAAC,CAAC,CACH,CAAC;YACF,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;gBACzC,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,OAAoB;YAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,eAAe,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/lib/settings/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Barrel for the dsh-connect web-settings stack: channel orchestration, the DSH
+ * credential-store adapter, the host RPC facade, the persistence service, and
+ * the client-side model/RPC helpers. Imported by the merged entry; also the
+ * `dsh-connect/settings` subpath export.
+ * @module dsh-connect/settings
+ */
+export * from "./channels.js";
+export * from "./credential-store.js";
+export * from "./settings-rpc.js";
+export * from "./settings-service.js";
+export * from "./settings-model.js";
+export * from "./rpc-client.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/settings/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}

package/lib/settings/index.js

@@ -0,0 +1,14 @@
+/**
+ * Barrel for the dsh-connect web-settings stack: channel orchestration, the DSH
+ * credential-store adapter, the host RPC facade, the persistence service, and
+ * the client-side model/RPC helpers. Imported by the merged entry; also the
+ * `dsh-connect/settings` subpath export.
+ * @module dsh-connect/settings
+ */
+export * from "./channels.js";
+export * from "./credential-store.js";
+export * from "./settings-rpc.js";
+export * from "./settings-service.js";
+export * from "./settings-model.js";
+export * from "./rpc-client.js";
+//# sourceMappingURL=index.js.map

package/lib/settings/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/settings/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}

package/lib/settings/namespace.d.ts

@@ -0,0 +1,175 @@
+/**
+ * The `dsh-connect` user-settings namespace.
+ *
+ * DSH ships a first-party user-settings seam (`ctx.settings`, backed by
+ * `$DSH_HOME/settings.yaml` via `@deepseek-ai/dsh-settings-file`, hot-reloaded,
+ * atomic, file-locked, comment-preserving). Registering a namespace is how a
+ * plugin makes its configuration user-editable *and effective*: the official
+ * Plugins page renders the fields from the schema, writes go through the
+ * provider, and `scope.watch()` tells the plugin to re-read.
+ *
+ * Two properties of that seam shape this module:
+ *
+ * - **`installSection` is the consumer entry point.** It registers the plugin's
+ *   own composition entry as the schema's *base* layer while the settings
+ *   service is present, and falls back to that entry if the service detaches.
+ *   Bare `register` would make `$DSH_HOME/settings.yaml` the only source and
+ *   silently drop a YAML-configured profile.
+ * - **The schema is applied to `mergeLayers(base, userSection)` at registration
+ *   time**, so a stored section that fails validation throws out of
+ *   `installSection`. Every install here is therefore guarded: a hand-edited
+ *   `settings.yaml` with a typo must degrade to the plugin config, not abort
+ *   the plugin's `apply`.
+ *
+ * **Secrets are deliberately not part of this schema.** They live in the DSH
+ * credential store (`ctx.credentials`), which is where the onboarding flow and
+ * the `FEISHU_*`-style env layering already put them; `settings.yaml` is a
+ * plain document users are invited to paste into bug reports. `sectionOf()`
+ * projects secret keys *out* of the base for the same reason — schemastery
+ * preserves undeclared keys verbatim, so anything left in the base rides out
+ * through `describe()` and the settings RPC. The same projection guards the
+ * write path (`LiveConnectSection.write`), which is the mirror hazard: an
+ * undeclared key in a *submitted* section would be preserved into the document.
+ *
+ * `installSection` returns nothing, so the write handle it hands back is built
+ * here: `setSource` already wires a thunk onto `scope.get()`, which reads the
+ * registration's resolved value at call time — live in both directions.
+ *
+ * @module dsh-connect/settings/namespace
+ */
+import z from "@deepseek-ai/schemastery";
+import { type ChannelName, type ChannelsConfig, type LoggerLike } from "./channels.js";
+/** The settings namespace this plugin owns. */
+export declare const CONNECT_SETTINGS_NS = "dsh-connect";
+/** Channel-agnostic defaults section of the namespace. */
+export type ConnectSectionDefaults = Record<string, unknown> & {
+    language?: string;
+    notifyLevel?: string;
+};
+/**
+ * The resolved namespace value. Every field is optional: a user who only ever
+ * edits `channels` leaves the rest absent, and each adapter applies its own
+ * default for anything missing.
+ */
+export interface ConnectSection {
+    channels?: ChannelName[];
+    channelDefaults?: ConnectSectionDefaults;
+    feishu?: Record<string, unknown>;
+    telegram?: Record<string, unknown>;
+    dingtalk?: Record<string, unknown>;
+    web?: Record<string, unknown>;
+}
+/**
+ * The namespace schema, derived from the same field tables the settings pane
+ * renders. Deriving rather than restating them is the point: a field added to
+ * `CHANNEL_CONFIG_FIELDS` becomes user-editable and hot-appliable in one edit,
+ * and a field that the pane exposes can never be silently unrepresentable in
+ * `settings.yaml`.
+ *
+ * `required(false)` on every field means an absent key stays absent — it does
+ * *not* materialize a default. That matters for `dmMode`, whose first option is
+ * the permissive one: a schema-provided default would silently open DMs for
+ * every user who never touched the field.
+ */
+export declare const ConnectSectionSchema: z<Schemastery.ObjectS<{
+    channels: z<ChannelName[], ChannelName[]>;
+    channelDefaults: z<any, any>;
+    feishu: z<any, any>;
+    telegram: z<any, any>;
+    dingtalk: z<any, any>;
+    web: z<any, any>;
+}>, Schemastery.ObjectT<{
+    channels: z<ChannelName[], ChannelName[]>;
+    channelDefaults: z<any, any>;
+    feishu: z<any, any>;
+    telegram: z<any, any>;
+    dingtalk: z<any, any>;
+    web: z<any, any>;
+}>>;
+/**
+ * Project a channel config onto the namespace's schema: only declared,
+ * non-secret keys, with `channels` always present.
+ *
+ * `channels` is emitted unconditionally because an absent array resolves to
+ * `[]` (schemastery's array default), which would read as "activate nothing".
+ *
+ * Secret keys are dropped here, not by the schema: `redactSecrets` only strips
+ * nodes declared with `role("secret")`, and we declare none — so the projection
+ * is what keeps an `appSecret` from a legacy profile out of the settings
+ * document and off the RPC.
+ *
+ * The argument is typed `unknown` because this doubles as the *write* guard:
+ * a section submitted through the settings RPC is untrusted JSON, and it must
+ * go through the same projection before it can reach the document.
+ */
+export declare function sectionOf(config: unknown): ConnectSection;
+/**
+ * The slice of the settings service this module calls. Declared structurally so
+ * the plugin keeps no dependency on `@deepseek-ai/dsh-settings` — the service is
+ * a `dsh-base` row, present whenever dsh-connect loads, and a missing method
+ * degrades to "no settings support" rather than a crash.
+ */
+export interface SettingsProviderLike {
+    installSection?(owner: unknown, ns: string, schema: unknown, entry: unknown, hooks: {
+        setSource: (source: () => unknown) => void;
+        onChange: () => void;
+    }): void;
+    /** Resolved value of a registered namespace, `undefined` while unregistered. */
+    get?(ns: string): unknown;
+    /**
+     * Replace a registered namespace's *user* section wholesale (validated by the
+     * provider, persisted by whichever file provider is wired up). Resolves after
+     * the new value is committed, so a read straight after it is fresh.
+     *
+     * Replace rather than merge, because the settings pane always submits its
+     * complete visible config: a merge would make a cleared field un-clearable
+     * (the stale value stays in the user layer and reappears on the next read).
+     * The declared-key set is identical for both writers of this namespace (this
+     * plugin's pane and the host's own Plugins page, which renders the same
+     * schema), so a replace cannot drop anything either surface can produce.
+     */
+    replace?(ns: string, section: unknown, expectedRevision?: number): Promise<unknown>;
+}
+/** A live handle onto the installed namespace: read the effective section, write a new one. */
+export interface LiveConnectSection {
+    /** The section in force right now (base layered under the user's section). */
+    read(): ConnectSection;
+    /**
+     * Replace the user's section with the declared-key projection of `config`.
+     * Rejects if the provider's schema refuses the result — the caller is
+     * expected to surface that rather than swallow it.
+     */
+    write(config: unknown): Promise<void>;
+}
+/** Outcome of wiring the namespace. */
+export interface InstallConnectSectionResult {
+    /** True when this fiber owns the namespace and receives live updates. */
+    live: boolean;
+    /** The section in force at install time (resolved, or the entry fallback). */
+    section: ConnectSection;
+    /**
+     * Read/write onto the registration. Present only when this fiber owns a live
+     * namespace *and* the provider exposes a write method; otherwise the caller
+     * keeps its own fallback (the plugin config, or the legacy state file).
+     */
+    handle?: LiveConnectSection;
+}
+export interface InstallConnectSectionOptions<Ctx extends LoggerLike> {
+    /** Context whose unload releases the registration. */
+    owner: Ctx;
+    settings: SettingsProviderLike | undefined;
+    /** The plugin's own config: the schema's `base` layer and the fallback. */
+    entry: ChannelsConfig | null | undefined;
+    /** Called with the in-force section now and on every change. */
+    onChange: (section: ConnectSection) => void;
+}
+/**
+ * Register `dsh-connect` and report the section in force.
+ *
+ * Never throws: a missing settings service, an already-claimed namespace, or a
+ * `settings.yaml` section that fails validation all fall back to the plugin's
+ * own config with a warning. A user's typo in a settings document must not be
+ * able to stop the bridge from starting.
+ */
+export declare function installConnectSection<Ctx extends LoggerLike>(options: InstallConnectSectionOptions<Ctx>): InstallConnectSectionResult;
+//# sourceMappingURL=namespace.d.ts.map

package/lib/settings/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/settings/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAY,KAAK,WAAW,EAAE,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAOjG,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3G;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAyBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;GAO/B,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,CAoBzD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,CACb,KAAK,EAAE,OAAO,EACd,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,OAAO,EACd,KAAK,EAAE;QAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,IAAI,CAAA;KAAE,GAC1E,IAAI,CAAC;IACR,gFAAgF;IAChF,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrF;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,IAAI,IAAI,cAAc,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,uCAAuC;AACvC,MAAM,WAAW,2BAA2B;IAC1C,yEAAyE;IACzE,IAAI,EAAE,OAAO,CAAC;IACd,8EAA8E;IAC9E,OAAO,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA4B,CAAC,GAAG,SAAS,UAAU;IAClE,sDAAsD;IACtD,KAAK,EAAE,GAAG,CAAC;IACX,QAAQ,EAAE,oBAAoB,GAAG,SAAS,CAAC;IAC3C,2EAA2E;IAC3E,KAAK,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC;IACzC,gEAAgE;IAChE,QAAQ,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;CAC7C;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,SAAS,UAAU,EAC1D,OAAO,EAAE,4BAA4B,CAAC,GAAG,CAAC,GACzC,2BAA2B,CAmE7B"}

package/lib/settings/namespace.js

@@ -0,0 +1,200 @@
+/**
+ * The `dsh-connect` user-settings namespace.
+ *
+ * DSH ships a first-party user-settings seam (`ctx.settings`, backed by
+ * `$DSH_HOME/settings.yaml` via `@deepseek-ai/dsh-settings-file`, hot-reloaded,
+ * atomic, file-locked, comment-preserving). Registering a namespace is how a
+ * plugin makes its configuration user-editable *and effective*: the official
+ * Plugins page renders the fields from the schema, writes go through the
+ * provider, and `scope.watch()` tells the plugin to re-read.
+ *
+ * Two properties of that seam shape this module:
+ *
+ * - **`installSection` is the consumer entry point.** It registers the plugin's
+ *   own composition entry as the schema's *base* layer while the settings
+ *   service is present, and falls back to that entry if the service detaches.
+ *   Bare `register` would make `$DSH_HOME/settings.yaml` the only source and
+ *   silently drop a YAML-configured profile.
+ * - **The schema is applied to `mergeLayers(base, userSection)` at registration
+ *   time**, so a stored section that fails validation throws out of
+ *   `installSection`. Every install here is therefore guarded: a hand-edited
+ *   `settings.yaml` with a typo must degrade to the plugin config, not abort
+ *   the plugin's `apply`.
+ *
+ * **Secrets are deliberately not part of this schema.** They live in the DSH
+ * credential store (`ctx.credentials`), which is where the onboarding flow and
+ * the `FEISHU_*`-style env layering already put them; `settings.yaml` is a
+ * plain document users are invited to paste into bug reports. `sectionOf()`
+ * projects secret keys *out* of the base for the same reason — schemastery
+ * preserves undeclared keys verbatim, so anything left in the base rides out
+ * through `describe()` and the settings RPC. The same projection guards the
+ * write path (`LiveConnectSection.write`), which is the mirror hazard: an
+ * undeclared key in a *submitted* section would be preserved into the document.
+ *
+ * `installSection` returns nothing, so the write handle it hands back is built
+ * here: `setSource` already wires a thunk onto `scope.get()`, which reads the
+ * registration's resolved value at call time — live in both directions.
+ *
+ * @module dsh-connect/settings/namespace
+ */
+import z from "@deepseek-ai/schemastery";
+import { CHANNELS } from "./channels.js";
+import { CHANNEL_CONFIG_FIELDS, CHANNEL_DEFAULT_FIELDS, } from "./settings-model.js";
+/** The settings namespace this plugin owns. */
+export const CONNECT_SETTINGS_NS = "dsh-connect";
+/** schemastery schema for one non-secret config field. */
+function fieldSchema(field) {
+    switch (field.kind) {
+        case "number":
+            return z.number().required(false);
+        case "boolean":
+            return z.boolean().required(false);
+        case "select":
+            return field.options !== undefined && field.options.length > 0
+                ? z.union(field.options.map((option) => z.const(option))).required(false)
+                : z.string().required(false);
+        default:
+            return z.string().required(false);
+    }
+}
+/** Build an object schema from a field table (unknown keys pass through). */
+function objectSchema(fields) {
+    return z.object(Object.fromEntries(fields.map((field) => [field.key, fieldSchema(field)])));
+}
+/**
+ * The namespace schema, derived from the same field tables the settings pane
+ * renders. Deriving rather than restating them is the point: a field added to
+ * `CHANNEL_CONFIG_FIELDS` becomes user-editable and hot-appliable in one edit,
+ * and a field that the pane exposes can never be silently unrepresentable in
+ * `settings.yaml`.
+ *
+ * `required(false)` on every field means an absent key stays absent — it does
+ * *not* materialize a default. That matters for `dmMode`, whose first option is
+ * the permissive one: a schema-provided default would silently open DMs for
+ * every user who never touched the field.
+ */
+export const ConnectSectionSchema = z.object({
+    channels: z.array(z.union(CHANNELS.map((name) => z.const(name)))).required(false),
+    channelDefaults: objectSchema(CHANNEL_DEFAULT_FIELDS).required(false),
+    feishu: objectSchema(CHANNEL_CONFIG_FIELDS.feishu).required(false),
+    telegram: objectSchema(CHANNEL_CONFIG_FIELDS.telegram).required(false),
+    dingtalk: objectSchema(CHANNEL_CONFIG_FIELDS.dingtalk).required(false),
+    web: objectSchema(CHANNEL_CONFIG_FIELDS.web).required(false),
+});
+/**
+ * Project a channel config onto the namespace's schema: only declared,
+ * non-secret keys, with `channels` always present.
+ *
+ * `channels` is emitted unconditionally because an absent array resolves to
+ * `[]` (schemastery's array default), which would read as "activate nothing".
+ *
+ * Secret keys are dropped here, not by the schema: `redactSecrets` only strips
+ * nodes declared with `role("secret")`, and we declare none — so the projection
+ * is what keeps an `appSecret` from a legacy profile out of the settings
+ * document and off the RPC.
+ *
+ * The argument is typed `unknown` because this doubles as the *write* guard:
+ * a section submitted through the settings RPC is untrusted JSON, and it must
+ * go through the same projection before it can reach the document.
+ */
+export function sectionOf(config) {
+    const source = (config !== null && typeof config === "object" ? config : {});
+    const section = { channels: (source.channels ?? CHANNELS) };
+    const defaults = {};
+    const rawDefaults = (source.channelDefaults ?? {});
+    for (const field of CHANNEL_DEFAULT_FIELDS) {
+        if (rawDefaults[field.key] !== undefined)
+            defaults[field.key] = rawDefaults[field.key];
+    }
+    if (Object.keys(defaults).length > 0)
+        section.channelDefaults = defaults;
+    for (const name of CHANNELS) {
+        const raw = (source[name] ?? {});
+        const projected = {};
+        for (const field of CHANNEL_CONFIG_FIELDS[name]) {
+            if (raw[field.key] !== undefined)
+                projected[field.key] = raw[field.key];
+        }
+        if (Object.keys(projected).length > 0)
+            section[name] = projected;
+    }
+    return section;
+}
+/**
+ * Register `dsh-connect` and report the section in force.
+ *
+ * Never throws: a missing settings service, an already-claimed namespace, or a
+ * `settings.yaml` section that fails validation all fall back to the plugin's
+ * own config with a warning. A user's typo in a settings document must not be
+ * able to stop the bridge from starting.
+ */
+export function installConnectSection(options) {
+    const { settings, entry, onChange } = options;
+    const entrySection = sectionOf(entry);
+    const warn = (message) => {
+        options.owner.logger?.warn?.(`connect: ${message}`);
+    };
+    if (settings?.installSection === undefined) {
+        // No settings service: the plugin config is the only source, as it was
+        // before this namespace existed.
+        onChange(entrySection);
+        return { live: false, section: entrySection };
+    }
+    let source = () => entrySection;
+    try {
+        settings.installSection(options.owner, CONNECT_SETTINGS_NS, ConnectSectionSchema, entrySection, {
+            setSource: (fn) => {
+                source = () => fn();
+            },
+            onChange: () => onChange(source()),
+        });
+    }
+    catch (error) {
+        // Two reachable causes, both handled the same way:
+        //   - a stored section that fails the schema (a hand-edited settings.yaml);
+        //   - the namespace is already registered by an earlier fiber. `register`
+        //     is an effect on the *settings service*, which outlives a plugin
+        //     reload, so a live config reload lands here.
+        // `get()` returns the previously resolved value in the second case, which
+        // keeps the user's saved settings effective — only the live watch is gone
+        // until the process restarts.
+        const resolved = readRegistered(settings);
+        if (resolved !== undefined) {
+            warn(`settings namespace "${CONNECT_SETTINGS_NS}" is already registered ` +
+                `(the plugin reloaded without a host restart); using the saved section — ` +
+                `restart dsh to re-enable live settings updates`);
+            onChange(resolved);
+            return { live: false, section: resolved };
+        }
+        warn(`settings namespace "${CONNECT_SETTINGS_NS}" unavailable (${String(error)}); ` +
+            `falling back to the plugin config`);
+        onChange(entrySection);
+        return { live: false, section: entrySection };
+    }
+    // `source` is reassigned (not rebound) by `setSource`, so a thunk closing
+    // over the variable reads whatever the provider's `scope.get()` returns now.
+    const read = () => source();
+    const replace = settings.replace?.bind(settings);
+    return {
+        live: true,
+        section: source(),
+        ...(replace === undefined
+            ? {}
+            : {
+                handle: {
+                    read,
+                    write: async (config) => {
+                        await replace(CONNECT_SETTINGS_NS, sectionOf(config));
+                    },
+                },
+            }),
+    };
+}
+/** Read a namespace an earlier fiber registered, if any. */
+function readRegistered(settings) {
+    const value = settings.get?.(CONNECT_SETTINGS_NS);
+    if (value === null || typeof value !== "object")
+        return undefined;
+    return value;
+}
+//# sourceMappingURL=namespace.js.map

package/lib/settings/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/settings/namespace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAC;AACzC,OAAO,EAAE,QAAQ,EAA0D,MAAM,eAAe,CAAC;AACjG,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GAEvB,MAAM,qBAAqB,CAAC;AAE7B,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAmBjD,0DAA0D;AAC1D,SAAS,WAAW,CAAC,KAAkB;IACrC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAC5D,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACzE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC;YACE,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,MAA8B;IAClD,OAAO,CAAC,CAAC,MAAM,CACb,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACjF,eAAe,EAAE,YAAY,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACrE,MAAM,EAAE,YAAY,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IAClE,QAAQ,EAAE,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACtE,QAAQ,EAAE,YAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACtE,GAAG,EAAE,YAAY,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;CAC7D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe;IACvC,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACxG,MAAM,OAAO,GAAmB,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAkB,EAAE,CAAC;IAE7F,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAA4B,CAAC;IAC9E,KAAK,MAAM,KAAK,IAAI,sBAAsB,EAAE,CAAC;QAC3C,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,eAAe,GAAG,QAAkC,CAAC;IAEnG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAqED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAA0C;IAE1C,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE,cAAc,KAAK,SAAS,EAAE,CAAC;QAC3C,uEAAuE;QACvE,iCAAiC;QACjC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,GAAyB,GAAG,EAAE,CAAC,YAAY,CAAC;IACtD,IAAI,CAAC;QACH,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,YAAY,EAAE;YAC9F,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE;gBAChB,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,EAAoB,CAAC;YACxC,CAAC;YACD,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mDAAmD;QACnD,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,kDAAkD;QAClD,0EAA0E;QAC1E,0EAA0E;QAC1E,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CACF,uBAAuB,mBAAmB,0BAA0B;gBAClE,0EAA0E;gBAC1E,gDAAgD,CACnD,CAAC;YACF,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,CACF,uBAAuB,mBAAmB,kBAAkB,MAAM,CAAC,KAAK,CAAC,KAAK;YAC5E,mCAAmC,CACtC,CAAC;QACF,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,GAAmB,EAAE,CAAC,MAAM,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,MAAM,EAAE;QACjB,GAAG,CAAC,OAAO,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EAAE;oBACN,IAAI;oBACJ,KAAK,EAAE,KAAK,EAAE,MAAe,EAAiB,EAAE;wBAC9C,MAAM,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;oBACxD,CAAC;iBACF;aACF,CAAC;KACP,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,SAAS,cAAc,CAAC,QAA8B;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,KAAuB,CAAC;AACjC,CAAC"}

package/lib/settings/rpc-client.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Client-side RPC helper for the dsh-connect web settings pane.
+ *
+ * The frontend talks to the host over the `/dsh-connect` channel; the channel
+ * returns `{ ok, value }`/`{ ok:false, error }` envelopes (see `settings-rpc.js`).
+ * This helper unwraps the envelope and throws a typed error on failure, so the
+ * UI can catch it and render a message. Pure + dependency-free for easy testing.
+ *
+ * @module dsh-connect/settings/rpc-client
+ */
+import type { SettingsSnapshot } from "./settings-rpc.js";
+/** The `ctx.connection.rpc.call` signature the settings pane uses. */
+export type RpcCall = (endpoint: string, payload?: unknown, signal?: AbortSignal) => Promise<{
+    ok: boolean;
+    value?: unknown;
+    error?: {
+        code: string;
+        message: string;
+    };
+}>;
+/** A typed RPC failure, surfaced to the settings UI. */
+export declare class RpcError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Invoke one endpoint and unwrap the envelope (throws `RpcError` on failure). */
+export declare function callRpc<T = unknown>(rpcCall: RpcCall, endpoint: string, payload?: unknown, signal?: AbortSignal): Promise<T>;
+/** Load the current settings snapshot via `settings.get`. */
+export declare function loadSettings(rpcCall: RpcCall): Promise<SettingsSnapshot>;
+/** Persist the settings via `settings.save`. */
+export declare function saveSettings(rpcCall: RpcCall, config: Record<string, unknown>): Promise<SettingsSnapshot>;
+/** Persist channel secrets to the credential store via `credentials.save`. */
+export declare function saveCredentials(rpcCall: RpcCall, channel: string, values: Record<string, string>): Promise<SettingsSnapshot>;
+/** Ask the host for a fresh status snapshot via `settings.status`. */
+export declare function loadStatus(rpcCall: RpcCall): Promise<SettingsSnapshot>;
+//# sourceMappingURL=rpc-client.d.ts.map

package/lib/settings/rpc-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-client.d.ts","sourceRoot":"","sources":["../../src/settings/rpc-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,sEAAsE;AACtE,MAAM,MAAM,OAAO,GAAG,CACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC;AAE1F,wDAAwD;AACxD,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,kFAAkF;AAClF,wBAAgB,OAAO,CAAC,CAAC,GAAG,OAAO,EACjC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAExE;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEzG;AAED,8EAA8E;AAC9E,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAE3B;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEtE"}