dsh-over-ssh 0.1.0 → 0.2.0

package/lib/types/src/host/app/session-admin-contract.d.ts

@@ -1,214 +0,0 @@
-/**
- * 会话管理的**契约**：依赖注入形状、会话头、删除/恢复/清理结果与服务接口。
- *
- * 从 `session-admin-service.ts` 抽出（审计 0076）：上下文模块需要这些类型，留在 service 里会形成环。
- *
- * @module dsh-remote-workspace/app/session-admin-contract
- */
-import { type DeleteDecision, type SessionRecord, type SessionTrashEntry, type SessionTrashEntryId } from '../domain/session-admin.ts';
-export interface SessionDirEntry {
-    readonly name: string;
-    readonly isDirectory: boolean;
-    readonly bytes: number;
-    readonly mtimeMs: number;
-}
-/**
- * Everything the service needs from the outside world.
- *
- * `readHeader` is deliberately the **only** way to learn about a session: the directory name cannot be decoded
- * (see ADR-0009), so classification must come from the header.
- */
-export interface SessionAdminDeps {
-    /** The platform's sessions root (e.g. `~/.dsh/sessions`). */
-    readonly sessionsRoot: string;
-    /** The plugin's own bin root; must **not** be inside {@link sessionsRoot}. */
-    readonly binRoot: string;
-    /** List one directory's entries; a missing directory yields an empty list, not a failure. */
-    readonly listDir: (path: string) => Promise<readonly SessionDirEntry[]>;
-    /** Read a session header. `undefined` means the log is unreadable (corrupt/unsupported). */
-    readonly readHeader: (sessionDir: string) => Promise<SessionHeader | undefined>;
-    /**
-     * Display title of the workspace that owns a session directory, or `undefined` when none does.
-     *
-     * Injected because the mapping lives in the platform's workspace registry, which the domain layer must not
-     * import (see the repository's red lines). A listing without this resolver still answers: every row keeps
-     * its `cwd`, so a reader falls back to the directory's own leaf name.
-     */
-    readonly resolveWorkspaceTitle?: ((cwd: string | undefined) => string | undefined) | undefined;
-    /**
-     * The session's generated title, or `undefined` when it has none.
-     *
-     * The header carries no title (it is a projection, not header metadata), so this is the only way a listing
-     * can label a session by name. Injected for the same reason as {@link resolveWorkspaceTitle}; without it
-     * every row falls back to its id.
-     */
-    readonly resolveSessionTitle?: ((header: SessionHeader) => string | undefined) | undefined;
-    /** `stat`; `undefined` when the path does not exist. */
-    readonly stat: (path: string) => Promise<{
-        readonly isDirectory: boolean;
-        readonly bytes: number;
-    } | undefined>;
-    /** Read a text file. */
-    readonly readText: (path: string) => Promise<string>;
-    /** Write a text file (UTF-8, no BOM). */
-    readonly writeText: (path: string, text: string) => Promise<void>;
-    /**
-     * Replace a text file **atomically** (write a temp file, then rename over the target).
-     *
-     * Optional, and worth supplying: without it a process killed mid-write leaves a truncated JSON index,
-     * which the parser then rejects as a hard failure. Atomic replace makes the index either the old or the
-     * new document, never a fragment.
-     */
-    readonly writeTextAtomic?: (path: string, text: string) => Promise<void>;
-    /**
-     * Run `operation` while holding a **cross-process** lock for `key`.
-     *
-     * The in-process chain cannot see another DSH process; without this, two processes deleting at the same
-     * time can each read the old index and overwrite the other's entry — leaving bytes in the bin that no
-     * index mentions (invisible and unrestorable).
-     *
-     * A caller-supplied implementation must be **exclusive** and must not deadlock when the previous holder
-     * died (see `createSessionBinLock`, which reclaims a stale lock by age).
-     */
-    readonly withLock?: <T>(key: string, operation: () => Promise<T>) => Promise<T>;
-    /**
-     * Move a directory. Must be atomic on one filesystem; the caller supplies the cross-device fallback.
-     *
-     * Returning `'copy'` means the implementation copied (cross-device) and the source is already gone.
-     */
-    readonly moveDir: (from: string, to: string) => Promise<'rename' | 'copy'>;
-    /** Recursively remove a directory (used for purge and for rolling back a failed record). */
-    readonly removeDir: (path: string) => Promise<void>;
-    /** Copy a directory recursively (the cross-device fallback, when the deps implement it themselves). */
-    readonly copyDir?: (from: string, to: string) => Promise<void>;
-    /** Whether a session is currently held by a live agent; never deleted. */
-    readonly isLive: (sessionId: string) => boolean;
-    /** Remove a session from workspace bookkeeping (`detachSession`); optional where unavailable. */
-    readonly detachSession?: (sessionId: string) => Promise<void>;
-    /** Announce the removal so clients drop the row (`api-session/removed`). */
-    readonly emitRemoved?: (sessionId: string) => void;
-    /** Injected clock. */
-    readonly now: () => number;
-    /** Who confirmed, for the audit trail (FR-3.10); absent when the caller did not say. */
-    readonly confirmedBy?: string;
-}
-/** The parts of a session header this feature needs. */
-export interface SessionHeader {
-    readonly id: string;
-    /** `cwd` from the header; `undefined` for the platform's no-cwd bucket. */
-    readonly cwd: string | undefined;
-    readonly title: string | undefined;
-    readonly parentSessionId: string | undefined;
-    /**
-     * Session format generation, as stored in the log's first line.
-     *
-     * Together with {@link createdAt} and {@link isSeeded} this is the **lifecycle identity** a header alone
-     * witnesses, and it is what the platform's projection cache validates a stored title row against. A
-     * resolver that skipped it could serve a title from a different lifecycle that reused the same id.
-     */
-    readonly version?: number | undefined;
-    readonly createdAt?: number | undefined;
-    readonly isSeeded?: boolean | undefined;
-}
-/** Options shared by the destructive calls. */
-export interface SessionAdminOptions {
-    readonly signal?: AbortSignal;
-}
-/** Result of a session deletion. */
-export interface DeleteSessionResult {
-    readonly mode: 'recycle' | 'permanent';
-    /** The bin entry in `recycle` mode; `undefined` for `permanent`. */
-    readonly entry: SessionTrashEntry | undefined;
-    /** Whether the content can still be recovered. **Always `false` for `permanent`.** */
-    readonly recoverable: boolean;
-    /** True when the move was observed to have landed (store gone + bin present). */
-    readonly verified: boolean;
-    /** True when the bytes crossed a filesystem boundary and were copied. */
-    readonly copied: boolean;
-    /** Ids that were refused, with the reason (a partial deletion is reported, never hidden). */
-    readonly refusals: DeleteDecision['refusals'];
-    readonly bytes: number;
-}
-/** Result of a restore. */
-export interface RestoreSessionResult {
-    readonly entry: SessionTrashEntry;
-    /** Absolute path the session directory was moved back to. */
-    readonly restoredPath: string;
-    readonly movedBy: 'rename' | 'copy';
-}
-/** One purge outcome. */
-export interface PurgeSessionResult {
-    readonly id: SessionTrashEntryId;
-    readonly sessionId: string;
-    readonly purged: boolean;
-    /** True when the entry was removed physically but the index could not be updated afterwards. */
-    readonly indexStale: boolean;
-}
-/** A retention sweep outcome for the session bin. */
-export interface SweepSessionResult {
-    readonly purged: readonly PurgeSessionResult[];
-    readonly failed: readonly {
-        readonly id: SessionTrashEntryId;
-        readonly reason: string;
-    }[];
-    readonly remainingEntries: number;
-    readonly remainingBytes: number;
-}
-/** The session-bin retention policy (same three dimensions as the file-level bin). */
-export interface SessionBinPolicy {
-    readonly maxEntries: number;
-    readonly maxBytes: number;
-    readonly maxAgeMs: number;
-}
-export declare function joinPath(base: string, ...segments: readonly string[]): string;
-/** The service surface. */
-export interface SessionAdminService {
-    /** Inventory every session in the store (FR-3.3). */
-    inventory(options?: SessionAdminOptions): Promise<readonly SessionRecord[]>;
-    /** Preview a deletion without touching anything (FR-3.7). */
-    previewDelete(ids: readonly string[], options?: SessionAdminOptions & {
-        readonly keep?: readonly string[];
-    }): Promise<DeleteDecision>;
-    /** Delete sessions: into the bin (`recycle`) or irreversibly (`permanent`). */
-    deleteSession(ids: readonly string[], options?: SessionAdminOptions & {
-        readonly mode?: 'recycle' | 'permanent';
-        readonly keep?: readonly string[];
-    }): Promise<DeleteSessionResult>;
-    /**
-     * Delete every session that belongs to one workspace directory, and nothing else.
-     *
-     * The workspace itself is **left registered**: the user asked to clear the workspace's sessions, not to
-     * unregister the workspace (and the platform's `workspaceRegistry.delete` would also be a different,
-     * separately-confirmed action). Sessions are matched by their header's `cwd` against the given directory,
-     * folded the same way the label resolver folds paths, so a Windows case/separator difference still matches.
-     *
-     * Live sessions are refused by the same rules as {@link deleteSession} (they appear in `refusals`), so a
-     * workspace containing a running session is deleted **except** for that session rather than failing whole.
-     *
-     * @param cwd - the workspace directory whose sessions should go.
-     * @param options - deletion mode plus cancellation.
-     * @returns the ids deleted, the per-id refusals, and the bytes freed.
-     */
-    deleteWorkspaceSessions(cwd: string, options?: SessionAdminOptions & {
-        readonly mode?: 'recycle' | 'permanent';
-    }): Promise<DeleteSessionResult & {
-        readonly matched: number;
-    }>;
-    /** List the bin. */
-    list(options?: SessionAdminOptions): Promise<readonly SessionTrashEntry[]>;
-    /** Move one entry back to where it came from. */
-    restore(entryId: string, options?: SessionAdminOptions): Promise<RestoreSessionResult>;
-    /** Delete one entry physically (the irreversible step, after the retention period). */
-    purge(entryId: string, options?: SessionAdminOptions): Promise<PurgeSessionResult>;
-    /** Apply the retention policy. */
-    sweep(policy: SessionBinPolicy, options?: SessionAdminOptions): Promise<SweepSessionResult>;
-}
-/**
- * Build the session-administration service.
- *
- * @param deps - injected I/O.
- * @returns the service.
- * @throws SshDevError `ROOT_INVALID` when the bin root is inside the sessions root (that placement breaks the
- *   platform's session listing — see the module note and ADR-0009).
- */
-//# sourceMappingURL=session-admin-contract.d.ts.map

package/lib/types/src/host/app/session-admin-delete.d.ts

@@ -1,34 +0,0 @@
-/**
- * 会话管理的**删除族**：预览、物理删除、移入回收站、批量清理、按工作区删除。
- *
- * 从 `session-admin-service.ts` 的工厂里抽出（审计 0076）：只依赖上下文，不依赖列表/恢复/清扫。
- *
- * @module dsh-remote-workspace/app/session-admin-delete
- */
-import { type SessionTrashEntry, type SessionTrashEntryId } from '../domain/session-admin.ts';
-import { type SessionAdminContext } from './session-admin-context.ts';
-import type { PurgeSessionResult, DeleteSessionResult } from './session-admin-contract.ts';
-import type { DeleteDecision } from '../domain/session-admin.ts';
-export declare function createSessionAdminDelete(ctx: SessionAdminContext): {
-    previewDelete: (ids: readonly string[], options?: import("./session-admin-contract.ts").SessionAdminOptions & {
-        readonly keep?: readonly string[];
-    }) => Promise<DeleteDecision>;
-    deleteSession: (ids: readonly string[], options?: import("./session-admin-contract.ts").SessionAdminOptions & {
-        readonly mode?: "recycle" | "permanent";
-        readonly keep?: readonly string[];
-    }) => Promise<DeleteSessionResult>;
-    deleteWorkspaceSessions: (cwd: string, options?: import("./session-admin-contract.ts").SessionAdminOptions & {
-        readonly mode?: "recycle" | "permanent";
-    }) => Promise<DeleteSessionResult & {
-        readonly matched: number;
-    }>;
-    purgeEntry: (entryId: string) => Promise<PurgeSessionResult>;
-    purgeEntries: (doomed: readonly SessionTrashEntry[], known: readonly SessionTrashEntry[]) => Promise<{
-        readonly purged: readonly PurgeSessionResult[];
-        readonly failed: readonly {
-            readonly id: SessionTrashEntryId;
-            readonly reason: string;
-        }[];
-    }>;
-};
-//# sourceMappingURL=session-admin-delete.d.ts.map

package/lib/types/src/host/app/session-admin-service.d.ts

@@ -1,38 +0,0 @@
-/**
- * Session administration service: inventory, deletion into the session bin, restore, purge, retention.
- *
- * The domain decisions live in [`domain/session-admin.ts`](../domain/session-admin.ts); this module wires them to
- * injected I/O. Every filesystem and platform call arrives as a function (AGENTS.md 红线 3), so this module is
- * testable offline and a test can make a move fail.
- *
- * ## Three contracts matter more than the rest
- *
- *  1. **Move first, confirm, then record.** `deleteSession` reports success only after the session directory is
- *     observed inside the bin **and** gone from the store. A move that throws is confirmed before anything is
- *     claimed: if it actually landed (a lost response), that counts as success; otherwise the call fails and
- *     **nothing** is recorded. "Deleted but not in the bin" must never be reported as success.
- *  2. **The index write is never swallowed.** If the index cannot be written after a successful move, the move is
- *     rolled back and the failure is reported. A physical purge has no rollback, so that case is reported with
- *     `purged: true, indexStale: true` instead of being hidden.
- *  3. **Live sessions are never touched.** The decision layer refuses them; this layer re-checks before moving, so
- *     a session that went live between preview and confirm is refused rather than killed.
- *
- * ## Where the bin lives (and why not under `sessions/`)
- *
- * The platform enumerates **every** directory under the sessions root (`listProjectDirs` has no dot-directory
- * filter) and fails the whole listing when one session id appears twice. A bin inside `sessions/` that kept the
- * original log filename would therefore make deleted sessions reappear *and* break the session list. The bin
- * lives in the plugin's own storage instead — see ADR-0009.
- *
- * @module dsh-remote-workspace/integration/session-admin-service
- */
-import type { SessionAdminDeps, SessionAdminService } from './session-admin-contract.ts';
-export * from './session-admin-contract.ts';
-/**
- * Build the service.
- *
- * @param deps - injected platform services.
- * @returns the {@link SessionAdminService}.
- */
-export declare function createSessionAdminService(deps: SessionAdminDeps): SessionAdminService;
-//# sourceMappingURL=session-admin-service.d.ts.map

package/lib/types/src/host/app/takeover/takeover-plan.d.ts

@@ -1,227 +0,0 @@
-/**
- * 阶段 2「一键接管」的**纯模型**：四行的开关 → 组合状态 / 操作序列 / 运行态核对 / 手动改法。
- *
- * 本模块没有 I/O、不 import 任何 `@deepseek-ai/*`（AGENTS.md 红线 2），输入只是一张
- * `patchId → {enabled, readOnlyReason, fiberPhase}` 表，输出是纯数据。执行器在
- * `src/host/integration/takeover/takeover-service.ts`。
- *
- * ## 身份：`patchId` 才是本插件认识的那一行
- *
- * 宿主把两套 id 混在同一个行对象里，**不能互相顶替**（`plugin-manager/src/index.ts:256-272`）：
- *
- * | 字段 | 含义 | 真机上的例子 |
- * |---|---|---|
- * | `entryId` | **Loader 条目身份**。挂在 `include` 下的条目带前缀 | `include:fs-sandbox` |
- * | `patchId` | profile patch 里的**行 id**，即 `actual.options.id`（`index.ts:261,270`） | `fs-sandbox` |
- * | `moduleName` | 该条目 import 的模块说明符（`entry.options.name`） | `@deepseek-ai/dsh-fs-sandbox` |
- *
- * 用户在自己的 `cordis.patch.yml` 里看到、也需要改的是 **patchId**；`setPluginEnabled` 收的却是
- * **entryId**（宿主自己再去查 `patchId`）。所以：
- *
- *  - 本模块的常量、步骤、UI 一律用 **patchId**（`TAKEOVER_PATCH_IDS`）；
- *  - 真实 `entryId` 只作为诊断信息随行保存（`TakeoverRow.entryId`），**从不**用来判断身份 ——
- *    拿它跟 `fs-sandbox` 这种常量比，在真机上永远匹配不上（真值是 `include:fs-sandbox`）。
- *
- * ## 为什么顺序要单独建模
- *
- * `ctx.fs` / `ctx.fileReferences` 都是单例服务，两个提供方同时在场时后来者注册会抛
- * `service "fs" has been registered at …`（`doc/02-platform/fs-seam.md` §1）；而本插件的 `./fs`
- * 条目在核心行仍占用时会 warn 后 `return undefined`（`src/fs.ts:55-62`），并且**不会自己重试**。
- * 所以 apply 的顺序是正确性的一部分：
- *
- *   1. 先 enable 我们的两条 —— 核心仍占用时会被跳过（无害）；
- *   2. 再 disable 两条核心 —— 让出两个服务；
- *   3. 最后把我们的两条各做一次 disable + enable —— 强制在核心让位后重新 apply。
- *
- * revert 反向：先 disable 我们的两条，再 enable 两条核心。
- *
- * ## 三件它不假装的事
- *
- * 1. **`enabled` 是配置值，不是运行态。** 宿主 `PluginInfo.enabled` = `!entry.disabled`
- *    （`packages/host/plugin-inventory/src/index.ts:89-95`），只有 `fiberPhase` 才说明「提供方真的在跑」。
- *    两者不一致时 {@link liveMismatch} 会说出来，而不是让面板显示一个漂亮的谎。
- * 2. **只读行只挡它真正要碰的行**：`readOnlyReason` 非空的行不能通过 profile patch 改，必须在动第一行
- *    之前拒绝；但**已经满足的请求**（空序列）不算「要碰」。
- * 3. **幂等**：已处于目标态时步骤序列为空，执行器因此不会为了「确认一下」去写 profile patch。
- *
- * @module dsh-remote-workspace/app/takeover-plan
- */
-/** 我们自己的两行（`cordis.patch.yml` 里的 `remote-workspace-fs` 与 `remote-workspace-file-references`）。 */
-export declare const OUR_PATCH_IDS: readonly ["remote-workspace-fs", "remote-workspace-file-references"];
-/** 核心的两行（bundle patch 里的 `fs-sandbox` 与 `file-reference-local`）。 */
-export declare const CORE_PATCH_IDS: readonly ["fs-sandbox", "file-reference-local"];
-/** 接管涉及的全部四行，顺序固定：先我们的、后核心的（与 apply 的叙述顺序一致）。 */
-export declare const TAKEOVER_PATCH_IDS: readonly ["remote-workspace-fs", "remote-workspace-file-references", "fs-sandbox", "file-reference-local"];
-/** 一行属于哪一边。 */
-export type TakeoverSide = 'ours' | 'core';
-/** 宿主 `PluginInfo.fiberPhase` 的取值（`plugin-inventory/src/types.ts:8-14`）；`null` = 没有活着的根 fiber。 */
-export type TakeoverFiberPhase = 'pending' | 'loading' | 'active' | 'failed' | 'unloading' | null;
-/** 四行之一在宿主 `listPlugins()` 里的最小投影。 */
-export interface TakeoverRow {
-    /** **规范身份**：profile patch 里的行 id。内部判断与 UI 都用它。 */
-    readonly patchId: string;
-    /** Loader 条目的真实 id（如 `include:fs-sandbox`）。只作诊断，**不参与身份判断**。 */
-    readonly entryId?: string | undefined;
-    /** 该条目 import 的模块说明符，身份交叉校验用。 */
-    readonly moduleName?: string | undefined;
-    /** 该行当前是否启用：`PluginInfo.enabled`，即**配置/组合**的开关，不是「fiber 正在跑」。 */
-    readonly enabled: boolean;
-    /**
-     * 非空表示这一行**不能**通过 profile patch 修改（`'management-required'` | `'unaddressable'`）。
-     * 原样透传，不做枚举校验：宿主将来多一种原因时，这里要如实报告而不是把它当「没有原因」。
-     */
-    readonly readOnlyReason?: string | undefined;
-    /** 该行根 fiber 的运行状态；`undefined` = 宿主没给这个字段（无法判断）。 */
-    readonly fiberPhase?: TakeoverFiberPhase | undefined;
-}
-/** 四行组合起来的接管状态。 */
-export type TakeoverState = 
-/** 核心两行在、我们的两行不在：阶段 1（本插件没有接管）。 */
-'off'
-/** 我们的两行在、核心两行不在：阶段 2（本插件已接管）。 */
- | 'on'
-/** 其它组合（含两方同时在场、只有一行切换）。 */
- | 'mixed'
-/** 这台宿主上无法表达接管：没有 `pluginManager`，或插件清单里缺行。 */
- | 'unsupported';
-/** 一键接管的两个方向。 */
-export type TakeoverAction = 'apply' | 'revert';
-/** 一步为什么存在。 */
-export type TakeoverStepWhy = 
-/** apply 的第 1 段：预置我们自己的行。核心仍占用时这一步会被跳过，**按设计无害**。 */
-'enable-ours'
-/** apply 的第 2 段：让核心的两行让位。 */
- | 'disable-core'
-/** apply 的第 3 段：把我们自己的行各做一次 disable + enable，强制重新 apply。 */
- | 'reapply-ours'
-/** revert 的第 1 段：先撤掉我们自己的两行。 */
- | 'disable-ours'
-/** revert 的第 2 段：再把核心的两行恢复回来。 */
- | 'enable-core';
-/** 一条**原始**操作：对某一行调用一次 `setPluginEnabled`。 */
-export interface TakeoverStep {
-    /** 规范身份（patchId）。真正写盘时宿主还要用它自己的 `entryId` 换算，那是执行器的事。 */
-    readonly patchId: string;
-    /** 目标值：`true` = 启用，`false` = 禁用。 */
-    readonly enabled: boolean;
-    readonly why: TakeoverStepWhy;
-}
-/** 整次操作被拒绝的原因（在**动第一行之前**就判定，不留半成品）。 */
-export type TakeoverRefusal = 
-/** 计划要碰的行里有 `readOnlyReason` 非空的。 */
-'read-only'
-/** 插件清单里找不到四行中的某一行（或身份有歧义，按缺行处理）。 */
- | 'rows-missing';
-/** 规划结果：要么一串步骤，要么一个拒绝（附原因与涉及的行）。 */
-export type TakeoverPlan = {
-    readonly ok: true;
-    readonly action: TakeoverAction;
-    readonly steps: readonly TakeoverStep[];
-} | {
-    readonly ok: false;
-    readonly refusal: TakeoverRefusal;
-    /** 造成拒绝的行（patchId）。 */
-    readonly patchIds: readonly string[];
-    /** 面向用户的说明，直接可进 HTTP 的 `error` 字段。 */
-    readonly message: string;
-};
-/**
- * 一行属于哪一边。
- *
- * @param patchId - profile patch 行 id。
- * @returns `'ours'` / `'core'`，不认识的行返回 `undefined`。
- */
-export declare function sideOf(patchId: string): TakeoverSide | undefined;
-/**
- * 插件清单里缺了哪几行（按 {@link TAKEOVER_PATCH_IDS} 的顺序）。
- *
- * 「缺」也包括**身份有歧义**（两行都声称是 `fs-sandbox`）：识别层会把歧义行丢掉，
- * 于是这里如实报缺 —— 宁可说「没有这一行」，也不猜哪一行是真的。
- *
- * @param rows - 已投影的四行（可能不全）。
- * @returns 缺失的 `patchId` 列表；齐全时为空数组。
- */
-export declare function missingPatchIds(rows: readonly TakeoverRow[]): readonly string[];
-/**
- * 四行的当前组合属于哪种接管状态。
- *
- * @param rows - 已投影的四行（可能不全）。
- * @returns {@link TakeoverState}；行不齐时是 `'unsupported'`（无法表达，而不是猜一个）。
- */
-export declare function takeoverState(rows: readonly TakeoverRow[]): TakeoverState;
-/**
- * 规划一次 apply / revert。
- *
- * 步骤只包含**真正会改变状态**的操作（幂等），并且严格按模块头注释的顺序排列：
- *
- * - apply：`enable-ours*` → `disable-core*` → (`reapply-ours` 的 disable+enable)*
- *   —— 最后一段只在前面确实有动作时追加；已经 `on` 时整串为空。
- * - revert：`disable-ours*` → `enable-core*`；已经 `off` 时整串为空。
- *
- * @param rows - 四行的当前状态（`listPlugins()` 的投影）。
- * @param action - `'apply'` 或 `'revert'`。
- * @returns 步骤序列，或一个拒绝。
- */
-export declare function planTakeover(rows: readonly TakeoverRow[], action: TakeoverAction): TakeoverPlan;
-/**
- * 每一行在这次操作里的目标值。
- *
- * @param action - `'apply'`（接管）或 `'revert'`（交还）。
- * @returns `patchId → enabled` 的目标表。
- */
-export declare function targetEnabled(action: TakeoverAction): ReadonlyMap<string, boolean>;
-/**
- * 计划要碰的行里，哪些是只读的。
- *
- * 只读行不能被 profile patch 改，所以必须在**动第一行之前**拒绝；但只针对真的要改的行 —— 已经满足的
- * 请求（空序列）不该因为某行只读而失败。
- *
- * @param present - 按 `patchId` 索引的四行。
- * @param steps - 已排好的步骤。
- * @returns 只读且被计划碰到的 `patchId`（按步骤首次出现顺序，去重）。
- */
-export declare function readOnlyTouched(present: ReadonlyMap<string, TakeoverRow>, steps: readonly TakeoverStep[]): readonly string[];
-/**
- * 面向用户的拒绝说明（HTTP `error` 字段直接用这一段）。
- *
- * @param refusal - 拒绝原因。
- * @param patchIds - 涉及的行。
- * @returns 一句话，说明「为什么不行、下一步怎么办」。
- */
-export declare function refusalMessage(refusal: TakeoverRefusal, patchIds: readonly string[]): string;
-/** 一处「配置说这样、运行态不是这样」。 */
-export interface TakeoverLiveMismatch {
-    readonly patchId: string;
-    /** 组合状态要求它是什么：提供方该在跑，还是该没有 fiber。 */
-    readonly expected: 'active' | 'off';
-    /** 实际看到的 fiber 状态；`undefined` = 宿主没给这个字段（判断不了）。 */
-    readonly actual: TakeoverFiberPhase | undefined;
-}
-/**
- * 配置状态与运行态不一致的行。
- *
- * `enabled` 是**配置**（`PluginInfo.enabled` = `!entry.disabled`），`fiberPhase` 才是**运行**。两者不一致
- * 的典型场景：改完 profile patch 但没重启（或宿主没有 hmr）—— 面板若只看 `enabled`，会显示「已接管」
- * 而实际提供方根本没在跑。
- *
- * 只对 `on` / `off` 两个自洽形态回答；`mixed` / `unsupported` 没有「应有的运行态」可言，返回空。
- *
- * @param rows - 四行（含 `fiberPhase`）。
- * @returns 不一致的行；全部一致或状态不自洽时为空数组。
- */
-export declare function liveMismatch(rows: readonly TakeoverRow[]): readonly TakeoverLiveMismatch[];
-/**
- * 用户自己改 profile patch 时要写的行（YAML 片段，直接可粘贴）。
- *
- * 为什么需要它：宿主的写入口只接受「一行一个布尔值」，也没有批量/事务接口；本插件不替用户改文件
- * （见 `takeover-service.ts` 模块头）。所以这张表就是拒绝时交还给用户的东西 —— 行 id 用的是
- * **patchId**，正是他 `cordis.patch.yml` 里写的那一个。
- *
- * 只列出**需要改**的行：已经是目标值的行不出现（避免用户把无意义的覆盖写进自己的 patch）。
- *
- * @param rows - 四行的当前状态。
- * @param action - `'apply'` 或 `'revert'`。
- * @returns YAML 行；已经处于目标态时为空数组。
- */
-export declare function manualPatchRows(rows: readonly TakeoverRow[], action: TakeoverAction): readonly string[];
-//# sourceMappingURL=takeover-plan.d.ts.map

package/lib/types/src/host/app/takeover/takeover-rows.d.ts

@@ -1,55 +0,0 @@
-/**
- * `pluginManager.listPlugins()` 的答案 → 本插件认识的四行。
- *
- * 这一层唯一的职责是**认身份**，而身份在真机上是个坑：宿主行同时带 `entryId`（Loader 条目 id，
- * 挂在 `include` 下的条目带前缀，例如 `include:fs-sandbox`）与 `patchId`（profile patch 的行 id，
- * 例如 `fs-sandbox`）。用户 `cordis.patch.yml` 里写的是后者，`setPluginEnabled` 收的却是前者。
- * 拿 `entryId` 去跟常量比，在真机上**永远匹配不上** —— 那正是这一层要挡住的事。
- *
- * 识别规则（按顺序，全部 fail closed）：
- *
- *  1. **有 `patchId`**：必须是我们认识的四个之一，且 `moduleName` 与预期一致（防止别的插件复用了同一个
- *     行 id）；两行声称同一个 `patchId` → 有歧义，两行都不要。
- *  2. **没有 `patchId`**（宿主只在不可改的行上省略它）：只能靠 `moduleName` 认 —— 该模块名必须**恰好**
- *     出现在一行上，出现两行或零行都不认。
- *  3. 认不出来就是「缺行」，由上层报 `rows-missing` / `unsupported`，而不是猜一个。
- *
- * 纯逻辑、无 I/O（AGENTS.md 红线 2），因此可以离线逐字段断言。
- *
- * @module dsh-remote-workspace/app/takeover-rows
- */
-import { type TakeoverRow } from './takeover-plan.ts';
-/**
- * 每个 patch 行应该 import 的模块说明符。
- *
- * 出处：核心两行在 bundle patch 里声明（`packages/bundle/base/cordis.patch.yml:518-519` 的
- * `fs-sandbox`、`packages/bundle/web-app/cordis.patch.yml:97-98` 的 `file-reference-local`），
- * 我们两行在本仓库的 `cordis.patch.yml:34-37`。
- */
-export declare const EXPECTED_MODULE_NAMES: Readonly<Record<string, string>>;
-/** 一行离开宿主后允许携带的字段（wire 形态，与 `GET` 的 `rows` 元素一一对应）。 */
-export interface PublicTakeoverRow {
-    /** 规范身份：profile patch 的行 id，UI 显示这个。 */
-    readonly patchId: string;
-    /** Loader 条目的真实 id（`include:fs-sandbox`），只作诊断。 */
-    readonly loaderEntryId?: string;
-    readonly enabled: boolean;
-    readonly readOnlyReason?: string;
-}
-/**
- * 把宿主插件清单投影成四行。
- *
- * @param listed - `pluginManager.listPlugins()` 的返回值（形状未知，逐字段校验）。
- * @returns 认出来的那几行，按 {@link TAKEOVER_PATCH_IDS} 的顺序；认不出的、歧义的都丢掉。
- */
-export declare function readTakeoverRows(listed: unknown): readonly TakeoverRow[];
-/**
- * 一行的 wire 投影：规范 id + 可选诊断 id，`readOnlyReason` 缺省时不出现。
- *
- * `fiberPhase` 刻意不出去：客户端按 `enabled` 画开关，运行态差异由 `GET` 的 `reason` 说清楚。
- *
- * @param row - 内部行。
- * @returns `{ patchId, loaderEntryId?, enabled, readOnlyReason? }`。
- */
-export declare function publicTakeoverRow(row: TakeoverRow): PublicTakeoverRow;
-//# sourceMappingURL=takeover-rows.d.ts.map