dsh-over-ssh 0.1.0 → 0.2.0

package/lib/types/src/host/app/roots-api-support.d.ts

@@ -1,182 +0,0 @@
-/**
- * roots-api-support
- *
- * 请求/响应工具、公共投影与 body 读取——被分发器与三个 handler 家族共用。
- *
- * 从 `roots-api.ts` 的 `serveAction`（543 行 / 15 个 case）拆出（审计 0076）：
- * case 体逐字搬移，只把 `return;` 改成 `return true;`，未命中时返回 `false` 由分发器报 400。
- *
- * @module dsh-remote-workspace/app/roots-api-support
- */
-import { type ConnectionPatch, type UserRootEntry, type UserRootsState } from './user-roots.ts';
-import type { RootsApiRequest, RootsApiResponse, RootsApiDeps } from './roots-api-contract.ts';
-export declare function readBody(req: RootsApiRequest): Promise<string>;
-export declare function toBytes(chunk: unknown): Uint8Array;
-/**
- * Whitelist one live root, dropping everything else it carries (argv, anchor paths, transports).
- *
- * Both spellings the Lead may hand over are accepted: a bare `RootRef` and a `RootRecord`
- * (`{ key, root, backend }` — what `RootRegistry.records` returns). Reading the nested `root` here is what
- * keeps a wiring mistake from showing every root as `location: "unknown", path: ""`.
- */
-export declare function publicRoot(raw: unknown): PublicRoot;
-/**
- * The live registry's own key for one persisted entry, or `undefined` when it is not live.
- *
- * The comparison goes through `sameUserRootKey` rather than `===`: the registry lower-cases Windows local
- * paths (`domain/root.ts`'s `rootKey`), the persisted file keeps the caller's case, and the client rebuilds
- * the key from the `path` the answer carried. Comparing them verbatim made a Windows local root impossible to
- * remove - the file entry went, the live root stayed, and the row then had no delete button because it was no
- * longer in the file.
- *
- * @param deps - the injected seams (only `listRoots` is read).
- * @param entry - the entry to look for.
- * @returns the key the registry holds it under, or `undefined`.
- */
-export declare function matchedLiveKey(deps: RootsApiDeps, entry: UserRootEntry): Promise<string | undefined>;
-/**
- * Read one live record as a root key, matching it against `entry`.
- *
- * @param raw - a `RootRecord` (key + root) or a bare `RootRef`.
- * @param entry - the entry to match.
- * @returns the record's own key when it names `entry`, else `undefined`.
- */
-export declare function liveKeyOfRecord(raw: unknown, entry: UserRootEntry): string | undefined;
-/**
- * Whitelist one live connection.
- *
- * This is the only place the host's connection profiles are turned into wire data, so it is the one place
- * that must never copy a field it was not explicitly told to copy: `auth`, `keyPath`, `credentialKey`,
- * `password`, `alias`, `proxyJump` and everything added later stay behind.
- */
-export declare function publicConnection(raw: unknown): PublicConnection;
-/** The machine-readable reason for one local listing failure, or `undefined` when it is not the caller's fault. */
-export declare function localFailureReason(error: unknown): LocalFailureReason | undefined;
-/** The human text for one {@link LocalFailureReason}; the path is always named so the message is actionable. */
-export declare function localFailureMessage(reason: LocalFailureReason, path: string): string;
-/**
- * Narrow a whitelisted body down to the fields of a {@link ConnectionPatch} (never the id: see
- * {@link UPDATE_CONNECTION_FIELDS}).
- *
- * **Absent means "keep what is there"** for every field, and this function is what makes that true rather than
- * accidental: only keys the body actually carries are copied, so a body that names three fields cannot blank
- * the four it did not mention.
- *
- * `port: ''`/`null` becomes `null`, which is the one value that means **drop the field** (back to the ssh
- * default). Every other value is passed through untouched and judged by `normalizeConnectionEntry`; nothing is
- * coerced here, because a bad port must be reported, not silently rounded.
- *
- * @param source - the whitelisted fields of the request body.
- * @returns the patch.
- */
-export declare function connectionPatchOf(source: Record<string, unknown>): Omit<ConnectionPatch, 'id'>;
-/**
- * The one body field this route refuses outright, whatever the action.
- *
- * `passphrase` has no representation anywhere in this feature, so accepting it would be a lie — and silently
- * dropping it would tell the user their passphrase was stored.
- *
- * `password` is **not** refused any more: `add-connection` and `update-connection` take it, write it into the
- * credential store and keep only the reference (FR-2.1.2). `credentialKey` is a *name*, not a secret, and
- * travels normally.
- */
-export declare function firstCredentialField(body: Record<string, unknown>, action: string): string | undefined;
-/** One required non-empty string field of a body. */
-export declare function requiredString(value: unknown, field: string): string;
-export declare function asRecord(value: unknown): Record<string, unknown> | undefined;
-export declare function isValidationFailure(error: unknown): boolean;
-export declare function messageOf(error: unknown): string;
-/** The machine-readable reason a refusal carries in its details, when it has one. */
-export declare function reasonOf(error: unknown): string | undefined;
-export declare function send(req: RootsApiRequest, res: RootsApiResponse, status: number, value: unknown): void;
-/**
- * The wire shape of one tracked transfer.
- *
- * Whitelisted field by field, like every other projection on this route: the tracker's own object is a
- * host-side value, and a field added there must be a deliberate decision to publish, not a leak.
- *
- * @param value - one entry from the tracker.
- * @returns the row the client may see.
- */
-export declare function publicTransfer(value: unknown): Record<string, unknown>;
-/**
- * Turn an alias into a connection id that passes {@link isValidConnectionId}.
- *
- * `~/.ssh/config` aliases routinely contain characters this plugin's ids reject (`@`, `:`, `/`, spaces) —
- * `deploy@bastion` is a perfectly normal alias. Importing one verbatim would be refused by
- * {@link normalizeConnectionEntry} with a message about id grammar, which reads as "the import is broken".
- * The alias is therefore **kept as the ssh target** (`alias`), and only the *id* is sanitised.
- *
- * @param alias - the literal alias from the config.
- * @returns a valid id, or `undefined` when sanitising leaves nothing usable.
- */
-export declare function connectionIdFromAlias(alias: string): string | undefined;
-/** The persisted state as the panel may see it: same connection projection, so `keyPath` never travels. */
-export declare function publicUserState(state: UserRootsState): {
-    readonly version: number;
-    readonly roots: readonly UserRootEntry[];
-    readonly connections: readonly PublicConnection[];
-};
-/**
- * The optional `path` field of a `list-local` body.
- *
- * Absent and empty (or blank) both mean "the host default", which is the user's home directory. Anything else
- * that is not a string — `null` included — is the caller's fault and is refused before a directory is chosen:
- * silently browsing the home directory because a client sent `null` would look like the request succeeded.
- */
-export declare function optionalPath(value: unknown): string | undefined;
-/** One root as the panel may see it: no credential can appear in a root, but the shape is still fixed. */
-export interface PublicRoot {
-    readonly key?: string;
-    readonly location: string;
-    readonly connectionId?: string;
-    readonly path: string;
-    readonly label?: string;
-    readonly writable?: boolean;
-}
-/**
- * One connection as the panel may see it. **Deliberately without `keyPath`.**
- *
- * `transport` **is** projected, and it has to be: the edit form is filled from this answer and submits what it
- * was filled with, so omitting the field silently rewrote every `alias`/`ssh2` connection to the default
- * (`agent`) on the next save - even when the operator only changed the host.
- */
-export interface PublicConnection {
-    readonly id: string;
-    readonly host: string;
-    readonly user: string;
-    readonly port?: number;
-    readonly authKind: string;
-    /** The transport this connection asks for; absent only for a record that names none. */
-    readonly transport?: string;
-}
-/** The reasons a local listing of a syntactically valid path can be refused with. */
-type LocalFailureReason = 'not-found' | 'not-a-directory' | 'unreadable';
-/**
- * The absolute chain from the filesystem root down to `absolute`, inclusive.
- *
- * The client renders "up" and "home" from this instead of composing a parent path itself: drive letters, UNC
- * shares and `/` are exactly the dialects a web client gets wrong, and one wrong guess sends `list-local` to a
- * directory the user never asked for. Every element is an ancestor of the path the answer already carries, so
- * the field discloses nothing the `path` field did not.
- *
- * @param absolute - an absolute, resolved path (what the handler answers with).
- * @returns the chain, root first; empty when the platform reports no root (impossible for a resolved path).
- */
-export declare function localPathCrumbs(absolute: string): readonly string[];
-/** The persisted state, read fresh for every check (the file is the source of truth, not a cache). */
-export declare function currentUserState(deps: RootsApiDeps): Promise<UserRootsState>;
-/**
- * Converge the persisted state on a target shape and return it.
- *
- * The handler never assumes who persisted what: it consults the file **after** the live seam ran, computes
- * the state the request implies, and writes only when that differs. So a wiring whose `registerRoot` already
- * persists produces no second write, and a wiring that only touches the live registry still ends with a file
- * that matches reality.
- */
-export declare function reconcile(deps: RootsApiDeps, transition: (state: UserRootsState) => UserRootsState): Promise<UserRootsState>;
-/** Take only the named fields from a body; the body itself is never handed to a seam. */
-export declare function pick(source: Record<string, unknown>, fields: readonly string[]): Record<string, unknown>;
-export declare function requiredKey(value: unknown): string;
-export {};
-//# sourceMappingURL=roots-api-support.d.ts.map

package/lib/types/src/host/app/roots-api-transfers.d.ts

@@ -1,13 +0,0 @@
-/**
- * roots-api-transfers
- *
- * 传输面板的 2 个 action：列表与清空。
- *
- * 从 `roots-api.ts` 的 `serveAction`（543 行 / 15 个 case）拆出（审计 0076）：
- * case 体逐字搬移，只把 `return;` 改成 `return true;`，未命中时返回 `false` 由分发器报 400。
- *
- * @module dsh-remote-workspace/app/roots-api-transfers
- */
-import type { RootsApiRequest, RootsApiResponse, RootsApiDeps } from './roots-api-contract.ts';
-export declare function handleTransferActions(action: string, body: Record<string, unknown>, req: RootsApiRequest, res: RootsApiResponse, deps: RootsApiDeps): Promise<boolean>;
-//# sourceMappingURL=roots-api-transfers.d.ts.map

package/lib/types/src/host/app/roots-api.d.ts

@@ -1,55 +0,0 @@
-/**
- * The same-origin HTTP route a client panel uses to **edit** roots and connections.
- *
- * Why a plain HTTP route instead of a Typert `@Remote` service (the shape audit 0021 used for reads):
- *
- *  - every action here carries **parameters**, and a Client Remote descriptor with parameters requires a
- *    generated strict codec that this repository cannot produce (`doc/02-platform/client-plugin.md` §4);
- *  - the panel is served from the GUI's own origin, so a relative `fetch` is same-origin: no CORS
- *    concession, no code generation, no `@Remote` registration — exactly the shape the third-party
- *    `dsh-plugin-stock-market` uses (`ctx.webServer.register({ kind: 'exact', path, handler })`).
- *
- * This module is a **handler factory decoupled from cordis**: everything it needs arrives through
- * {@link RootsApiDeps}, so it can be unit-tested with fake dependencies and fake request/response objects.
- * The Lead performs the actual registration:
- *
- * ```ts
- * const api = createRootsApi({ ... })
- * disposers.push(webServer.register({ kind: 'exact', path: ROOTS_API_PATH, handler: api.handle }))
- * ```
- *
- * Contract:
- *
- * | Request | Answer |
- * |---|---|
- * | `GET` | `200 { ok: true, roots, connections, userRoots, warnings }` |
- * | `POST` `{ action: 'add-root' \| 'remove-root' \| 'add-connection' \| 'update-connection' \| 'remove-connection', ... }` | `200 { ok: true, action, state }` |
- * | `POST` `{ action: 'add-root', location, path, connectionId?, workspaces?, reuseExisting? }` | `200 { ok: true, action, state, anchorPath? }` — `reuseExisting: true` makes an already-persisted root idempotent and answers its anchor instead of `400 该根已存在` |
- * | `POST` `{ action: 'remove-root', key, workspace? }` | `200 { ok: true, action, state }` — `workspace` removes the root from that workspace only; the root disappears when the last one drops it |
- * | `POST` `{ action: 'update-connection', id, newId?, host?, user?, port?, authKind?, keyPath?, credentialKey?, transport?, password? }` | `200 { ok: true, action, state }` — absent fields keep their value; `newId` renames and migrates the connection's roots (keeping their anchors) |
- * | `POST` `{ action: 'list-remote', connectionId, path }` | `200 { ok: true, action, connectionId, path, entries: [{ name, kind }], truncated }` |
- * | `POST` `{ action: 'list-local', path? }` | `200 { ok: true, action, path, entries: [{ name, kind }], crumbs, truncated }` |
- * | `POST` `{ action: 'list-ssh-config' }` | `200 { ok: true, action, candidates: [{ alias, host, user?, port?, hasIdentityFile, hasProxyJump, suggestedId }], skipped: [{ pattern, reason, line }] }` (FR-2.1.4) |
- * | `POST` `{ action: 'import-ssh-config', aliases: [alias, …] }` | `200 { ok: true, action, imported: [id, …], refused: [{ alias, reason }], state }` — the body names **aliases**, never ids/hosts/paths: every field is re-derived from the config |
- * | any validation / trust / body failure | `400`/`403` `{ ok: false, error, reason? }` |
- * | any other method | `405` `{ ok: false, error }` + `Allow: GET, HEAD, POST` |
- *
- * Two invariants this layer owns:
- *
- *  1. **Credentials never come back out.** `connections` (live and persisted), the `state` echoed by
- *     `POST` and every directory row (`list-remote` and `list-local`) are whitelist projections:
- *     `{ id, host, user, port, authKind, transport? }` and `{ name, kind }` respectively. `keyPath`, `password`,
- *     `passphrase`, `credentialKey`, `alias`, `proxyJump`, sizes, times, modes and symlink targets are
- *     never serialised, and no file content is readable through this route at all.
- *  2. **Parameters are taken from a whitelist, one field at a time** — the body is never spread into a
- *     call. A field the UI does not own cannot reach the seam, however the body is shaped.
- *
- * @module dsh-remote-workspace/integration/roots-api
- */
-import type { RootsApiDeps, RootsApi } from './roots-api-contract.ts';
-export * from './roots-api-contract.ts';
-export { localPathCrumbs } from './roots-api-projections.ts';
-export { connectionIdFromAlias } from './roots-api-http.ts';
-export type { PublicRoot, PublicConnection } from './roots-api-projections.ts';
-export declare function createRootsApi(deps: RootsApiDeps): RootsApi;
-//# sourceMappingURL=roots-api.d.ts.map

package/lib/types/src/host/app/routed-fs.d.ts

@@ -1,239 +0,0 @@
-/**
- * The routed file system: one workspace, many roots, local and remote side by side.
- *
- * Responsibilities, in order:
- *
- *  1. **Resolve** a model-facing path to exactly one root plus a backend-absolute path
- *     (all rules live in `domain/route-table.ts`; this module only applies the result).
- *     One addition lives here rather than in the table: the **implicit session root**, so the session's own
- *     working directory is always usable even when no registered root covers it (see {@link
- *     RoutedFileSystem.tryResolve}).
- *  2. **Namespace** target keys as `{backendId}\0{absolute path}` — the same file spelled locally
- *     and remotely must never collide, because core components key their state by target key.
- *  3. **Fence writes**: resolution already rejects paths outside every root, so `workspace-write`
- *     means "inside the roots"; `read-only` denies every write; `danger-full-access` allows.
- *     This is the plugin's own multi-root confinement (the core's single-root fence cannot express
- *     several roots, see `doc/02-platform/fs-seam.md` §4).
- *  4. Keep the operations the model's tools need: stat / list / read / write / edit.
- *
- * @module dsh-over-ssh/app/routed-fs
- */
-import type { Backend, BackendEntry, BackendRead, BackendSandboxMode, BackendStat, BackendText } from './backend.ts';
-import { SshDevError } from '../domain/errors.ts';
-import { type RootRef } from '../domain/roots/root.ts';
-import { type RouteOptions } from '../domain/roots/route-table.ts';
-/** A resolved path: one root, one backend, one backend-absolute location. */
-export interface RoutedTarget {
-    readonly root: RootRef;
-    readonly backend: Backend;
-    /** Key of the root, also the router's backend key. */
-    readonly backendKey: string;
-    /** Absolute path in the backend's own spelling. */
-    readonly absolute: string;
-    /** Namespaced identity: `{backendId}\0{absolute}`. */
-    readonly targetKey: string;
-    readonly relativePath: string;
-    /** Model-facing spelling (`ssh://…` for remote roots). */
-    readonly displayPath: string;
-}
-/** Resolution outcome with a resolved target, or the reason it failed. */
-export type RoutedResolution = {
-    readonly ok: true;
-    readonly target: RoutedTarget;
-} | {
-    readonly ok: false;
-    readonly error: SshDevError;
-};
-/** A directory entry with its resolved identity. */
-export interface RoutedEntry extends BackendEntry {
-    readonly targetKey: string;
-    readonly displayPath: string;
-}
-/** Options for {@link RoutedFileSystem}. */
-export interface RoutedFileSystemOptions {
-    readonly roots: readonly RootRef[];
-    /** Backends keyed by `rootKey(root)`. */
-    readonly backends: ReadonlyMap<string, Backend>;
-    readonly caseInsensitive?: boolean;
-    /** Cap for a single read; defaults to 8 MiB. */
-    readonly maxReadBytes?: number;
-    /**
-     * Builds the backend for the **implicit session root** — the session's own cwd (see {@link
-     * RoutedFileSystem.tryResolve}).
-     *
-     * Injected rather than imported because building a local backend needs `node:fs`, and this layer must not
-     * reach a concrete adapter (架构测试: `app` only depends on `infra` port modules). Omitting it **disables**
-     * the implicit root, which is the honest default: a router that was given no way to serve host paths keeps
-     * reporting `ROOT_OUTSIDE` for them.
-     */
-    readonly createLocalBackend?: (root: RootRef) => Backend;
-}
-/** Write options. */
-export interface RoutedWriteOptions {
-    readonly cwd?: string;
-    /** Version token that must match before the write proceeds. */
-    readonly expectedVersion?: string;
-    /** Policy the caller is operating under. */
-    readonly sandbox?: BackendSandboxMode;
-    readonly signal?: AbortSignal;
-}
-/** Literal edit request, mirroring the core's `editText` semantics. */
-export interface RoutedEdit {
-    readonly find: string;
-    readonly replace: string;
-    /** Replace every occurrence instead of requiring a unique one. */
-    readonly all?: boolean;
-}
-/** Multi-root file system over a set of backends. */
-export declare class RoutedFileSystem {
-    #private;
-    constructor(options: RoutedFileSystemOptions);
-    /** Registered roots, in registration order. */
-    get roots(): readonly RootRef[];
-    /** Confinement the router enforces itself. */
-    get sandboxMode(): BackendSandboxMode;
-    /** Register a root together with the backend that serves it. */
-    addRoot(root: RootRef, backend: Backend): void;
-    /** Remove a root and its backend binding. */
-    removeRoot(key: string): boolean;
-    /** Replace every root and backend binding at once. */
-    setRoots(entries: readonly {
-        readonly root: RootRef;
-        readonly backend: Backend;
-    }[]): void;
-    /**
-     * Resolve a path.
-     *
-     * @param input - model-facing path (host path, `ssh://…`, or relative to `cwd`).
-     * @param options - session cwd and case folding.
-     * @returns the resolved target.
-     * @throws SshDevError `ROOT_OUTSIDE` / `ROOT_AMBIGUOUS` / `ROOT_INVALID`.
-     */
-    resolve(input: string, options?: RouteOptions): RoutedTarget;
-    /**
-     * Non-throwing resolution for UI code.
-     *
-     * A registered root is always asked first, so it wins over the implicit session root — the implicit root only
-     * answers paths the table refused.
-     */
-    tryResolve(input: string, options?: RouteOptions): RoutedResolution;
-    /** Metadata for a path. */
-    stat(input: string, options?: RouteOptions & {
-        readonly signal?: AbortSignal;
-    }): Promise<BackendStat & {
-        readonly target: RoutedTarget;
-    }>;
-    /** Direct children of a directory, with resolved identities. */
-    list(input: string, options?: RouteOptions & {
-        readonly signal?: AbortSignal;
-    }): Promise<readonly RoutedEntry[]>;
-    /**
-     * List an already-resolved directory.
-     *
-     * Takes the target so callers that hold one (the core `FsTarget` contract hands one to every
-     * operation) do not pay for a second resolution.
-     *
-     * @param target - resolved directory.
-     * @param signal - cancellation.
-     * @returns direct children with resolved identities.
-     */
-    listTarget(target: RoutedTarget, signal?: AbortSignal): Promise<readonly RoutedEntry[]>;
-    /**
-     * Stat an already-resolved target.
-     *
-     * @param target - resolved target.
-     * @param options - when `followSymlink` is false and the backend supports it, the link itself is
-     *   inspected instead of its target.
-     * @returns metadata (never content).
-     */
-    statTarget(target: RoutedTarget, options?: {
-        readonly followSymlink?: boolean;
-        readonly signal?: AbortSignal;
-    }): Promise<BackendStat>;
-    /**
-     * Resolve an opaque target key back to the root, backend and backend-absolute path that own it.
-     *
-     * Every operation after {@link resolve} arrives this way (the core hands back only the target key), so an
-     * implicit session root must be found here too: it is not in the table, but its backend id is what its target
-     * keys carry.
-     */
-    targetFromKey(targetKey: string): RoutedTarget;
-    /** Whether a path exists. */
-    exists(input: string, options?: RouteOptions & {
-        readonly signal?: AbortSignal;
-    }): Promise<boolean>;
-    /** Read bytes, capped by the router's limit. */
-    readBytes(input: string, options?: RouteOptions & {
-        readonly maxBytes?: number;
-        readonly signal?: AbortSignal;
-    }): Promise<BackendRead & {
-        readonly target: RoutedTarget;
-    }>;
-    /** Read text. */
-    readText(input: string, options?: RouteOptions & {
-        readonly maxBytes?: number;
-        readonly signal?: AbortSignal;
-    }): Promise<BackendText & {
-        readonly target: RoutedTarget;
-    }>;
-    /**
-     * Write text after enforcing the router's own confinement.
-     *
-     * @param input - destination path.
-     * @param text - content to write.
-     * @param options - policy, version guard and cancellation.
-     * @returns the write outcome plus the resolved target.
-     */
-    writeText(input: string, text: string, options?: RoutedWriteOptions): Promise<{
-        readonly bytes: number;
-        readonly version: string;
-        readonly target: RoutedTarget;
-    }>;
-    /**
-     * Apply a unified diff to one file, atomically.
-     *
-     * Forwarded rather than reimplemented: the backend owns the hunk matching, and a second implementation
-     * here would be a second set of edge cases to keep in sync.
-     */
-    patchText(input: string, diff: string, options?: RoutedWriteOptions): Promise<{
-        readonly bytes: number;
-        readonly version: string;
-        readonly hunks: number;
-        readonly target: RoutedTarget;
-    }>;
-    /**
-     * Replace a literal string inside a file.
-     *
-     * Mirrors the core's semantics: an absent pattern and an ambiguous match without `all` are both
-     * errors, and a version guard can refuse the whole edit.
-     *
-     * @param input - file to edit.
-     * @param edit - find/replace plus the `all` flag.
-     * @param options - policy, version guard, cwd and cancellation.
-     * @returns the new version and the number of replacements.
-     */
-    editText(input: string, edit: RoutedEdit, options?: RoutedWriteOptions): Promise<{
-        readonly replacements: number;
-        readonly version: string;
-        readonly target: RoutedTarget;
-    }>;
-    /**
-     * Whether one target is inside another.
-     *
-     * Both targets must belong to the same backend; across backends the answer is always `false`
-     * (a local path can never contain a remote path).
-     */
-    contains(parent: RoutedTarget, child: RoutedTarget): boolean;
-    /** Host path for a child process in the target's world, when that world has one. */
-    processPath(target: RoutedTarget): string | undefined;
-    /** `file:` URL in the target's world. */
-    fileUrl(target: RoutedTarget): string | undefined;
-}
-/** Namespaced identity of one file; the backend id prevents local/remote collisions. */
-export declare function makeTargetKey(backend: Backend, absolute: string): string;
-/** Split a target key back into its parts (diagnostics and tests only). */
-export declare function splitTargetKey(targetKey: string): {
-    readonly backendId: string;
-    readonly absolute: string;
-} | undefined;
-//# sourceMappingURL=routed-fs.d.ts.map

package/lib/types/src/host/app/serialize.d.ts

@@ -1,37 +0,0 @@
-/**
- * Run asynchronous file work one operation at a time, in call order.
- *
- * Two places needed this and each carried its own copy of the same six lines: the panel-owned root/connection
- * file (`app/roots/user-roots.ts`) and the session trash index (`app/session-admin/session-admin-context.ts`).
- * Both are read-modify-write over one document, and in both the read is asynchronous, so two overlapping
- * requests would read the same state and the second write would silently discard the first one's change — a
- * lost update with no error anywhere. The idiom is small enough to look harmless and subtle enough to get
- * wrong, which is exactly the case for one implementation (audit 2026-10-31 P3).
- *
- * The queue is **within one process** only. Two DSH processes writing the same file are still last-writer-wins;
- * that needs a cross-process lock and is out of scope here.
- *
- * @module dsh-over-ssh/app/serialize
- */
-/** A serial queue: `run` one task at a time, and `settled` to wait for what is already queued. */
-export interface SerialQueue {
-    /**
-     * Queue `task`; it starts after every earlier task has settled.
-     *
-     * A rejection does **not** wedge the queue: the chain continues after it, so one failed write cannot stop
-     * every later one.
-     *
-     * @param task - the work to run alone.
-     * @returns the task's own result or rejection.
-     */
-    run<T>(task: () => Promise<T>): Promise<T>;
-    /** Resolves once everything queued so far has settled — how a test waits without sleeping. */
-    settled(): Promise<void>;
-}
-/**
- * Create one serial queue.
- *
- * @returns the queue (see {@link SerialQueue}).
- */
-export declare function createSerialQueue(): SerialQueue;
-//# sourceMappingURL=serialize.d.ts.map

package/lib/types/src/host/app/session-admin/session-admin-context.d.ts

@@ -1,36 +0,0 @@
-/**
- * 会话管理的**上下文**：bin 根、索引读写、跨进程串行化、会话清单。
- *
- * 从 `session-admin-service.ts` 的工厂里抽出（审计 0076）：所有方法族的公共底座。
- *
- * @module dsh-over-ssh/app/session-admin-context
- */
-import { type SessionRecord, type SessionTrashEntry } from '../../domain/session/session-admin.ts';
-import type { SessionAdminDeps, SessionAdminOptions } from './session-admin-contract.ts';
-/** Whether a thrown error means "the path does not exist". */
-export declare function isMissing(error: unknown): boolean;
-export declare function createSessionAdminContext(deps: SessionAdminDeps): {
-    deps: SessionAdminDeps;
-    sessionsRoot: string;
-    binRoot: string;
-    indexePath: () => string;
-    serialized: <T>(operation: () => Promise<T>) => Promise<T>;
-    entryDir: (segment: string) => string;
-    readIndex: () => Promise<readonly SessionTrashEntry[]>;
-    writeIndex: (entries: readonly SessionTrashEntry[]) => Promise<void>;
-    inventory: (options?: SessionAdminOptions) => Promise<readonly SessionRecord[]>;
-};
-export type SessionAdminContext = ReturnType<typeof createSessionAdminContext>;
-/**
- * Fold a path to a comparison key: forward slashes, no trailing separator, lower case.
- *
- * The same fold the label resolver uses (`session-labels.ts`), duplicated here because this module must not
- * import the resolver: the resolver reads platform services, this one is pure. Windows paths are
- * case-insensitive and a header's `cwd` is the raw spawn directory while a workspace record's path is
- * canonicalized, so an exact compare would miss real matches.
- *
- * @param path - a path in either spelling.
- * @returns the comparison key.
- */
-export declare function normalizePathKey(path: string): string;
-//# sourceMappingURL=session-admin-context.d.ts.map

package/lib/types/src/host/app/session-admin/session-admin-delete.d.ts

@@ -1,34 +0,0 @@
-/**
- * 会话管理的**删除族**：预览、物理删除、移入回收站、批量清理、按工作区删除。
- *
- * 从 `session-admin-service.ts` 的工厂里抽出（审计 0076）：只依赖上下文，不依赖列表/恢复/清扫。
- *
- * @module dsh-over-ssh/app/session-admin-delete
- */
-import { type SessionTrashEntry, type SessionTrashEntryId } from '../../domain/session/session-admin.ts';
-import { type SessionAdminContext } from './session-admin-context.ts';
-import type { PurgeSessionResult, DeleteSessionResult } from './session-admin-contract.ts';
-import type { DeleteDecision } from '../../domain/session/session-admin.ts';
-export declare function createSessionAdminDelete(ctx: SessionAdminContext): {
-    previewDelete: (ids: readonly string[], options?: import("./session-admin-contract.ts").SessionAdminOptions & {
-        readonly keep?: readonly string[];
-    }) => Promise<DeleteDecision>;
-    deleteSession: (ids: readonly string[], options?: import("./session-admin-contract.ts").SessionAdminOptions & {
-        readonly mode?: "recycle" | "permanent";
-        readonly keep?: readonly string[];
-    }) => Promise<DeleteSessionResult>;
-    deleteWorkspaceSessions: (cwd: string, options?: import("./session-admin-contract.ts").SessionAdminOptions & {
-        readonly mode?: "recycle" | "permanent";
-    }) => Promise<DeleteSessionResult & {
-        readonly matched: number;
-    }>;
-    purgeEntry: (entryId: string) => Promise<PurgeSessionResult>;
-    purgeEntries: (doomed: readonly SessionTrashEntry[], known: readonly SessionTrashEntry[]) => Promise<{
-        readonly purged: readonly PurgeSessionResult[];
-        readonly failed: readonly {
-            readonly id: SessionTrashEntryId;
-            readonly reason: string;
-        }[];
-    }>;
-};
-//# sourceMappingURL=session-admin-delete.d.ts.map

package/lib/types/src/host/app/session-admin-context.d.ts

@@ -1,36 +0,0 @@
-/**
- * 会话管理的**上下文**：bin 根、索引读写、跨进程串行化、会话清单。
- *
- * 从 `session-admin-service.ts` 的工厂里抽出（审计 0076）：所有方法族的公共底座。
- *
- * @module dsh-remote-workspace/app/session-admin-context
- */
-import { type SessionRecord, type SessionTrashEntry } from '../domain/session-admin.ts';
-import type { SessionAdminDeps, SessionAdminOptions } from './session-admin-contract.ts';
-/** Whether a thrown error means "the path does not exist". */
-export declare function isMissing(error: unknown): boolean;
-export declare function createSessionAdminContext(deps: SessionAdminDeps): {
-    deps: SessionAdminDeps;
-    sessionsRoot: string;
-    binRoot: string;
-    indexePath: () => string;
-    serialized: <T>(operation: () => Promise<T>) => Promise<T>;
-    entryDir: (segment: string) => string;
-    readIndex: () => Promise<readonly SessionTrashEntry[]>;
-    writeIndex: (entries: readonly SessionTrashEntry[]) => Promise<void>;
-    inventory: (options?: SessionAdminOptions) => Promise<readonly SessionRecord[]>;
-};
-export type SessionAdminContext = ReturnType<typeof createSessionAdminContext>;
-/**
- * Fold a path to a comparison key: forward slashes, no trailing separator, lower case.
- *
- * The same fold the label resolver uses (`session-labels.ts`), duplicated here because this module must not
- * import the resolver: the resolver reads platform services, this one is pure. Windows paths are
- * case-insensitive and a header's `cwd` is the raw spawn directory while a workspace record's path is
- * canonicalized, so an exact compare would miss real matches.
- *
- * @param path - a path in either spelling.
- * @returns the comparison key.
- */
-export declare function normalizePathKey(path: string): string;
-//# sourceMappingURL=session-admin-context.d.ts.map