dsh-quick-actions 0.1.0-rc.3

package/lib/types/client/controller.d.ts

@@ -0,0 +1,207 @@
+import type { CustomActionId, PresetActionId, PresetCatalog, QuickActionDraft, QuickActionLayout, QuickActionMutationRejection, QuickActionProjection, QuickActionRef, QuickActionSettingsV1 } from '../model/index.js';
+/**
+ * One path-addressed edit inside a namespace section. The transport also accepts
+ * an `unset` form; this plugin writes the whole section field by field and never
+ * clears one, so only the form it submits is declared.
+ */
+export interface SettingsSetOp {
+    readonly op: 'set';
+    readonly path: readonly string[];
+    readonly value: unknown;
+}
+/** One bound namespace as the scope publishes it. */
+export interface SettingsScopeSnapshot {
+    /** `loading` until the shared document answers; `unavailable` when the namespace is not served. */
+    readonly status: 'loading' | 'ready' | 'unavailable';
+    /** Resolved section: schema defaults, then composition base, then the user layer. */
+    readonly value?: unknown;
+    /** Composition base layer, where an author-owned layer such as the catalog rides. */
+    readonly base?: unknown;
+    /** Revision of the raw user section, sent back to fence a write. */
+    readonly revision?: number;
+    /** Whether the provider accepts writes at all. */
+    readonly writable: boolean;
+    /** `memory` on a page this Client keeps process-local; no write ever crosses the wire. */
+    readonly mode: 'host' | 'memory';
+}
+/** The namespace contract handed to `bind`. */
+export interface SettingsScopeSpec {
+    readonly namespace: string;
+    /** Narrows the resolved value; returning `undefined` publishes no value at all. */
+    readonly decode?: (value: unknown) => unknown;
+}
+/** One namespace scope: a derived read plus that namespace's serialized writes. */
+export interface BoundSettingsScope {
+    getSnapshot(): SettingsScopeSnapshot;
+    subscribe(listener: () => void): () => void;
+    mutate(ops: readonly SettingsSetOp[], expectedRevision?: number): Promise<void>;
+}
+/** The shared settings document as the mirror holds it. */
+export interface SettingsMirrorSnapshot {
+    /** Whether any document answer is held at all; absent while no read has succeeded. */
+    readonly view?: unknown;
+    /** The last read's failure message, or `null` when it answered. */
+    readonly error: string | null;
+}
+/**
+ * The shared describe mirror's read face. A bound scope publishes nothing at all
+ * while the document is unanswered, so a read that *failed* is only visible here
+ * — which is what tells a first catalog read failure apart from one still in
+ * flight (spec 10).
+ */
+export interface SettingsMirror {
+    getSnapshot(): SettingsMirrorSnapshot;
+    subscribe(listener: () => void): () => void;
+    load(): Promise<void>;
+}
+/** `ctx.settingsScope`. */
+export interface SettingsScopeService {
+    bind(spec: SettingsScopeSpec): BoundSettingsScope;
+    describe(): SettingsMirror;
+}
+/** Connection lifecycle as `ctx.connection` publishes it; `undefined` before the loop starts. */
+export type ConnectionState = 'connected' | 'connecting' | 'disconnected' | undefined;
+/** `ctx.connection`, narrowed to the observable state this controller reads. */
+export interface ConnectionLike {
+    readonly state: {
+        getSnapshot(): ConnectionState;
+        subscribe(listener: () => void): () => void;
+    };
+}
+/** Why the authoritative catalog cannot be shown (spec 10). */
+export type CatalogErrorReason = 
+/** The settings document could not be read at all; retrying is the remedy. */
+'unreadable'
+/** The Host serves no catalog namespace, or published no `base` layer on it. */
+ | 'unavailable'
+/** A `base` layer this release cannot read in full; never a truncated catalog (spec 5.1). */
+ | 'undecodable';
+/** The authoritative Preset Catalog as the Client currently knows it. */
+export type CatalogState = {
+    readonly status: 'loading';
+} | {
+    readonly status: 'ready';
+    readonly catalog: PresetCatalog;
+} | {
+    readonly status: 'error';
+    readonly reason: CatalogErrorReason;
+};
+/** The last Host-confirmed user state, and the fence a write against it must carry. */
+export type SettingsState = {
+    readonly status: 'loading';
+}
+/** No namespace to read or write: unserved, or a page kept process-local. */
+ | {
+    readonly status: 'unavailable';
+} | {
+    readonly status: 'ready';
+    readonly settings: QuickActionSettingsV1;
+    readonly revision: number;
+    readonly writable: boolean;
+};
+/** Why a write did not reach the stored state. */
+export type QuickActionWriteFailure = 
+/** No catalog or no readable namespace yet, or the controller is disposed. */
+{
+    readonly kind: 'not-ready';
+}
+/** The provider accepts no writes, or the connection is not current (spec 10). */
+ | {
+    readonly kind: 'read-only';
+}
+/** The shared model refused the plan; nothing crossed the wire. */
+ | {
+    readonly kind: 'rejected';
+    readonly rejection: QuickActionMutationRejection;
+}
+/** The Host refused the write itself; the authoritative snapshot was re-read. */
+ | {
+    readonly kind: 'refused';
+}
+/** The revision fence was lost: refresh, then ask the user to confirm again (spec 10). */
+ | {
+    readonly kind: 'conflict';
+}
+/** The write never settled against the Host. Never retried automatically. */
+ | {
+    readonly kind: 'failed';
+    readonly message: string;
+};
+/**
+ * The structured result every mutation answers with (spec 15, decision 4).
+ *
+ * The shipped `SettingsScope.mutate` resolves to `void`, and this release adds no
+ * DSH core interface (spec 16.4), so success, refusal and conflict are told apart
+ * here, from the authoritative snapshot the scope publishes after the write: the
+ * write committed when the stored state now reads back as the plan, the fence was
+ * lost when the namespace revision moved elsewhere, and anything else is a Host
+ * refusal. Each failing case leaves the caller's form content untouched — the
+ * caller owns the draft — and the recovery read has already happened by the time
+ * this resolves.
+ */
+export type QuickActionWriteOutcome = {
+    readonly ok: true;
+    readonly changed: boolean;
+} | {
+    readonly ok: false;
+    readonly failure: QuickActionWriteFailure;
+};
+/** The global management panel's own state (spec 7.1). */
+export interface QuickActionManagerState {
+    readonly open: boolean;
+}
+/** Everything the Quick Action surfaces render from. */
+export interface QuickActionsClientState {
+    readonly catalog: CatalogState;
+    readonly settings: SettingsState;
+    /**
+     * What the surfaces list, or `undefined` while no catalog is readable. With a
+     * catalog but no readable user state it projects the defaults, so the
+     * authoritative presets still render while management stays read-only (spec 10).
+     */
+    readonly projection: QuickActionProjection | undefined;
+    /** Whether any write may be attempted right now. */
+    readonly readOnly: boolean;
+    /** The connection is not current, so the held snapshot may have moved on (spec 10). */
+    readonly stale: boolean;
+    readonly manager: QuickActionManagerState;
+    /** A write is in flight; the panel disables its controls rather than queueing clicks. */
+    readonly writing: boolean;
+    /** The last failure, until it is dismissed or superseded by the next write. */
+    readonly failure?: QuickActionWriteFailure;
+}
+/** The controller as the surfaces consume it. */
+export interface QuickActionsController {
+    /** Current state; the same reference until something actually changes. */
+    getSnapshot(): QuickActionsClientState;
+    subscribe(listener: () => void): () => void;
+    /** Re-read the shared settings document — the retry behind a catalog error (spec 10). */
+    refresh(): Promise<void>;
+    openManager(): void;
+    closeManager(): void;
+    dismissFailure(): void;
+    createCustomAction(draft: QuickActionDraft): Promise<QuickActionWriteOutcome>;
+    clonePreset(presetId: PresetActionId): Promise<QuickActionWriteOutcome>;
+    updateCustomAction(id: CustomActionId, draft: QuickActionDraft): Promise<QuickActionWriteOutcome>;
+    setCustomActionEnabled(id: CustomActionId, enabled: boolean): Promise<QuickActionWriteOutcome>;
+    deleteCustomAction(id: CustomActionId): Promise<QuickActionWriteOutcome>;
+    setPresetHidden(presetId: PresetActionId, hidden: boolean): Promise<QuickActionWriteOutcome>;
+    reorderActions(order: readonly QuickActionRef[]): Promise<QuickActionWriteOutcome>;
+    moveAction(ref: QuickActionRef, toIndex: number): Promise<QuickActionWriteOutcome>;
+    setLayout(layout: QuickActionLayout): Promise<QuickActionWriteOutcome>;
+    /** Release the scope subscriptions and the connection listener. */
+    dispose(): void;
+}
+/** What the controller is built over. */
+export interface QuickActionsControllerOptions {
+    readonly settingsScope: SettingsScopeService;
+    readonly connection: ConnectionLike;
+    /** Mints one Custom Action ID. Defaults to `crypto.randomUUID()`. */
+    readonly mintCustomActionId?: () => string;
+}
+/**
+ * Create the controller. Both bindings are made on the calling fiber, so the
+ * scope disposers the binder registers are withdrawn with it; `dispose()`
+ * releases what this module owns on top of that.
+ */
+export declare function createQuickActionsController(options: QuickActionsControllerOptions): QuickActionsController;

package/lib/types/client/dsh.d.ts

@@ -0,0 +1,171 @@
+/**
+ * The DSH Client faces the Composer surfaces and the per-session execution layer
+ * consume, declared structurally and no wider than this plugin actually reads.
+ *
+ * Every shape here is transcribed from a published declaration of the target
+ * DSH release (0.1.5-rc.1) rather than guessed:
+ *
+ * - `InputState`, `InputActions`, `Occurrence`
+ *   → `@deepseek-ai/dsh-client-ui-conversation/lib/types/client/contract/input.d.ts`
+ * - `SessionSnapshot`
+ *   → `@deepseek-ai/dsh-api-session-controller/lib/types/client/contract/snapshot.d.ts`
+ * - the two dock Slot contracts and their standard props
+ *   → `@deepseek-ai/dsh-client-ui-conversation/lib/types/client/contract/slots.d.ts`
+ *     and the generated Slot ledger in `@deepseek-ai/dsh-cordis-client-runner`
+ * - `ComposerBlock` / `ComposerBlocks`
+ *   → `@deepseek-ai/dsh-client-ui-conversation/lib/types/client/contract/composer-blocks.d.ts`
+ * - `slots.inject` / `slots.register` and `locale.register` / `locale.bind`
+ *   → the generated Service ledger in `@deepseek-ai/dsh-cordis-client-runner`
+ *
+ * They are declared here instead of imported because the plugin ships against a
+ * DSH it does not depend on at build time: the Client bundle may only `require`
+ * specifiers the build adapter lists as externals (`react` and
+ * `react/jsx-runtime`), and every DSH face arrives as a Slot prop or a Cordis
+ * service on `ctx`. Declaring them narrowly also keeps the compiler honest about
+ * spec 9.1: nothing outside these shapes is reachable, so no DOM, Lexical,
+ * private shell, private event or private keyboard path can be typed into
+ * existence by accident.
+ */
+import type { ComponentType, ReactNode } from 'react';
+export type { ComponentType };
+/** Browser-runtime identity of one unsent attachment draft. */
+export type DraftAttachmentId = string;
+/**
+ * One reference occurrence projected from the editor's chip nodes. Only the
+ * fields this plugin reads are declared; an occurrence's presence is what
+ * matters here, never its content.
+ */
+export interface InputOccurrence {
+    readonly occurrenceId: number;
+    readonly source: string;
+    readonly ref: string;
+}
+/** One row of the read-only transient queue projection. */
+export interface InputQueueRow {
+    readonly placement: 'queued' | 'steering' | 'context';
+}
+/**
+ * The published per-Session input state — the whole public snapshot, listed
+ * field by field because spec 9.5 makes this exact set the only evidence the
+ * send single-flight may be judged from.
+ */
+export interface InputState {
+    /** Clipboard-text projection of the editor document (chips expanded). */
+    readonly draft: string;
+    /** Ordered runtime-only attachment ids. */
+    readonly attachmentIds: readonly DraftAttachmentId[];
+    /** Monotonic editor revision; bumps once per content-changing editor commit. */
+    readonly draftRev: number;
+    /** Submit-plane phase; `plain` is the only phase that accepts a new submission. */
+    readonly phase: 'plain' | 'adjudicating' | 'claimed' | 'submitting';
+    /** Present exactly while claimed/submitting. */
+    readonly claim?: {
+        readonly token: string;
+        readonly hint?: string;
+        readonly attachments?: boolean;
+    };
+    /** Reference chips currently in the draft, sorted by offset. */
+    readonly occurrences: readonly InputOccurrence[];
+    /** Read-only transient inbox projection from Session control. */
+    readonly queue: readonly InputQueueRow[];
+}
+/**
+ * The public input action face handed to every session-scope Slot component.
+ *
+ * Only the two members spec 9.4 allows are declared. The shipped object also
+ * carries `addAttachments`, `removeAttachment` and `pruneAttachments`; leaving
+ * them out is deliberate — this plugin owns no draft attachment and must never
+ * touch one.
+ */
+export interface InputActions {
+    /** Replace the whole draft. */
+    setDraft(text: string): void;
+    /** Enter submission: the same official path the composer's send button takes. */
+    submit(): void;
+}
+/** The Session lifecycle fields the composer's own send guard reads. */
+export interface SessionSnapshot {
+    readonly sessionId: string;
+    readonly removed: boolean;
+    readonly running: boolean;
+    readonly subagent: {
+        readonly address: {
+            readonly mode: string;
+        };
+        readonly parentAvailable?: boolean;
+    } | null;
+}
+/** Why one session's composer is inert (a feature-owned block). */
+export interface ComposerBlock {
+    readonly reason: string;
+}
+/** An observable value as the DSH stores publish it. */
+export interface ObservableSnapshot<T> {
+    getSnapshot(): T;
+    subscribe(listener: () => void): () => void;
+}
+/**
+ * `ctx.conversation.blocks` — documented as "the registry face other plugins
+ * reach": how a plugin the composer cannot import makes a session's input
+ * inert. Reading it is the only public way to honour the `blocked` guard of
+ * spec 9.2. The Client reaches it through `ctx.get`, the documented read
+ * "without the inject requirement", so the declared dependency list stays
+ * exactly the four of spec 7.3, and degrades to "not blocked" when absent.
+ */
+export interface ComposerBlocks {
+    storeFor(sessionId: string): ObservableSnapshot<ComposerBlock | undefined>;
+}
+/** The narrow slice of `ctx.conversation` this plugin reads. */
+export interface ConversationLike {
+    readonly blocks: ComposerBlocks;
+}
+/** `SnapshotSelectorHook<T>`: a `useSyncExternalStoreWithSelector` binding. */
+export type SnapshotSelectorHook<T> = <S>(selector: (value: T) => S, equality?: (a: S, b: S) => boolean) => S;
+/** Point-in-time owner values of `conversation.input.dock`. */
+export interface InputZoneOwnerProps {
+    readonly session: SessionSnapshot;
+    readonly input: InputState;
+}
+/** Translation function bound to one locale namespace. */
+export type Translate = (key: string, params?: Record<string, string | number>) => string;
+/** The standard props both dock Slots hand every session-scoped entry. */
+export interface SessionSlotProps {
+    readonly sessionId: string;
+    readonly useSession: SnapshotSelectorHook<SessionSnapshot>;
+    readonly useInput: SnapshotSelectorHook<InputState>;
+    readonly inputActions: InputActions;
+    readonly t: Translate;
+}
+/** Props of the `conversation.input.dock` entry (standard props plus the zone). */
+export type InputDockProps = SessionSlotProps & InputZoneOwnerProps;
+/** Props of the `conversation.composer.dock` entry (this Slot declares no owner props). */
+export type ComposerDockProps = SessionSlotProps;
+/** Registration options both dock Slots accept. */
+export interface SlotRegisterOptions {
+    readonly name: 'conversation.input.dock' | 'conversation.composer.dock';
+    /** Cell key; a fresh id is added beside the shipped entries. */
+    readonly id: string;
+    /** Position among the entries, ascending. */
+    readonly order?: number;
+    /** Locale namespace backing the entry's `t` prop. */
+    readonly locale?: string;
+}
+/** One synchronous effect installed while an injected Slot declaration is live. */
+export type SlotInjectionEffect = (() => void) | Iterable<() => void>;
+/** `ctx.slots`, narrowed to the two calls this plugin makes. */
+export interface SlotsService {
+    /**
+     * Install an effect for each declaration lifetime of a Slot. The controller
+     * belongs to the caller's fiber, so plugin unload removes the contribution.
+     */
+    inject(key: string, callback: () => SlotInjectionEffect): () => void;
+    /** Register one entry; disposal runs through the caller's `ctx.effect`. */
+    register(options: SlotRegisterOptions, component: ComponentType<never>): () => void;
+}
+/** `ctx.locale`, narrowed to dictionary registration and namespace binding. */
+export interface LocaleService {
+    register(ns: string, dictionaries: Record<string, Record<string, string>>): () => void;
+    bind(ns: string): Translate;
+}
+/** A React element, kept as a type alias so surfaces need no React value import. */
+export type SurfaceNode = ReactNode;

package/lib/types/client/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Client composition entry for Composer Quick Actions.
+ *
+ * This fiber owns everything the feature holds in the browser: one global
+ * `QuickActionsController` over the two Settings namespaces, the per-Session
+ * execution registry, the Resident Composer registry, the locale dictionaries,
+ * the stylesheet, and the two dock Slot registrations. All of it is installed
+ * through `ctx.effect` and `ctx.slots.inject`, so unloading the plugin leaves
+ * no listener, registration, namespace, style tag or subscription behind
+ * (spec 7.3).
+ *
+ * `settingsScope` is how this Client reaches Host-authoritative state at all — it
+ * never writes a file, never treats browser storage as a source of truth, and
+ * never reaches past Settings to a provider (spec 6.3). `connection` supplies the
+ * generation state the read-only-while-disconnected rule needs (spec 10).
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ConnectionLike, SettingsScopeService } from './controller.js';
+import type { ConversationLike, LocaleService, SlotsService } from './dsh.js';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        settingsScope: SettingsScopeService;
+        connection: ConnectionLike;
+        slots: SlotsService;
+        locale: LocaleService;
+        conversation: ConversationLike;
+    }
+}
+export declare const name = "composer-quick-actions";
+/**
+ * The services this Client requires (spec 7.3). `conversation` is deliberately
+ * absent: its Composer-block registry is read through `ctx.get`, the documented
+ * read "without the inject requirement", because the service is guaranteed
+ * present wherever the two dock Slots it declares are rendered.
+ */
+export declare const inject: readonly string[];
+/**
+ * Start the feature and tie every piece of it to this fiber.
+ *
+ * Nothing is returned and no internal type is re-exported: the controller, the
+ * execution engine and the surfaces are internal to this package (spec 14).
+ */
+export declare function apply(ctx: Context): void;

package/lib/types/client/manager/ActionForm.d.ts

@@ -0,0 +1,20 @@
+import type { ReactElement } from 'react';
+import type { ManagerWriteGate } from './press.js';
+import type { QuickActionDraft } from '../../model/index.js';
+import type { Translate } from '../dsh.js';
+export interface ActionFormProps {
+    /** `new` for a creation, `edit` for an existing Custom Quick Action. */
+    readonly mode: 'new' | 'edit';
+    readonly draft: QuickActionDraft;
+    /**
+     * Whether the user has already tried to save. Blank fields only report
+     * themselves after that, so a freshly opened form does not open shouting.
+     */
+    readonly attempted: boolean;
+    readonly gate: ManagerWriteGate;
+    readonly t: Translate;
+    readonly onChange: (draft: QuickActionDraft) => void;
+    readonly onSave: () => void;
+    readonly onCancel: () => void;
+}
+export declare function ActionForm(props: ActionFormProps): ReactElement;

package/lib/types/client/manager/ActionPanel.d.ts

@@ -0,0 +1,15 @@
+import type { ReactElement } from 'react';
+import type { QuickActionSessionState } from '../session/execution.js';
+import type { ProjectedQuickAction } from '../../model/index.js';
+import type { Translate } from '../dsh.js';
+export interface ActionPanelProps {
+    /** The actions this entry offers, already in the shared order. */
+    readonly actions: readonly ProjectedQuickAction[];
+    readonly session: QuickActionSessionState;
+    readonly t: Translate;
+    /** Id of the element naming this dialog. */
+    readonly labelledBy: string;
+    readonly onActivate: (action: ProjectedQuickAction) => void;
+    readonly onClose: () => void;
+}
+export declare function ActionPanel(props: ActionPanelProps): ReactElement;

package/lib/types/client/manager/ManagedRow.d.ts

@@ -0,0 +1,40 @@
+/**
+ * One row of the management list: what the action is, and everything the user
+ * may do to it (spec 3, 5.1, 5.2, 8.3).
+ *
+ * The two sources differ in exactly the way spec 5.1 says they must: a Preset
+ * Quick Action may be reordered, hidden, restored and cloned — never edited or
+ * deleted, because its definition is the author's — while a Custom Quick Action
+ * has its whole life cycle here.
+ *
+ * A hidden or disabled action is rendered, dimmed and labelled, never removed:
+ * removal from the Composer is the Hidden Quick Action projection, and this
+ * panel is where it stays recoverable (spec 3).
+ */
+import type { ReactElement } from 'react';
+import type { ManagerWriteGate } from './press.js';
+import type { ProjectedQuickAction, QuickActionRef } from '../../model/index.js';
+import type { Translate } from '../dsh.js';
+/** Everything one row can ask the panel to do. */
+export interface ManagedRowHandlers {
+    readonly onMove: (ref: QuickActionRef, toIndex: number) => void;
+    readonly onEdit: () => void;
+    readonly onClone: () => void;
+    readonly onToggleHidden: () => void;
+    readonly onToggleEnabled: () => void;
+    readonly onAskDelete: () => void;
+    readonly onCancelDelete: () => void;
+    readonly onConfirmDelete: () => void;
+}
+export interface ManagedRowProps {
+    readonly action: ProjectedQuickAction;
+    /** Position in the shared order, which is what the move controls address. */
+    readonly index: number;
+    readonly total: number;
+    readonly gate: ManagerWriteGate;
+    /** Whether this row has already been asked about deleting. */
+    readonly deleting: boolean;
+    readonly t: Translate;
+    readonly on: ManagedRowHandlers;
+}
+export declare function ManagedRow({ action, index, total, gate, deleting, t, on }: ManagedRowProps): ReactElement;

package/lib/types/client/manager/ManagerPanel.d.ts

@@ -0,0 +1,9 @@
+import type { ReactElement } from 'react';
+import type { QuickActionsClientState, QuickActionsController } from '../controller.js';
+import type { Translate } from '../dsh.js';
+export interface ManagerPanelProps {
+    readonly client: QuickActionsClientState;
+    readonly controller: QuickActionsController;
+    readonly t: Translate;
+}
+export declare function ManagerPanel({ client, controller, t }: ManagerPanelProps): ReactElement;

package/lib/types/client/manager/press.d.ts

@@ -0,0 +1,38 @@
+/**
+ * When a mutating control in the management panel may be pressed, and how it
+ * says so (spec 5.4, 8.4, 10).
+ *
+ * ## Why two ways of saying "no"
+ *
+ * Only sustained, externally-imposed unavailability — a read-only namespace, or a
+ * connection that can no longer vouch for the held snapshot — uses a real
+ * `disabled`, which takes the control out of the tab order entirely.
+ *
+ * Everything else uses `aria-disabled` plus a guarded handler, because
+ * everything else can become true *as a result of the press itself*: the write
+ * this control just started, the row that just reached an end of the list, the
+ * layout it just selected becoming current, the clone that just filled the last
+ * slot. A real `disabled` there would drop the keyboard caret to the document
+ * body mid-reorder — and focus handling is a hard gate of spec 8.4, not a nicety.
+ */
+/** What every mutating control in the panel is gated on. */
+export interface ManagerWriteGate {
+    /** Sustained and external: the panel is genuinely inert and must not be tabbable. */
+    readonly readOnly: boolean;
+    /** A write is in flight; transient, and usually started by the focused control. */
+    readonly busy: boolean;
+    /** Whether creating or cloning is allowed at all right now (spec 5.4). */
+    readonly canAdd: boolean;
+}
+/** The props one mutating control spreads onto its `<button>`. */
+export interface PressProps {
+    readonly disabled: boolean;
+    readonly 'aria-disabled': boolean;
+    readonly onClick: () => void;
+}
+/**
+ * Gate one control. `blocked` is its own extra condition — an end of the list,
+ * the ceiling, the choice already made; the gate's own `busy` is folded in here
+ * so no caller has to remember it.
+ */
+export declare function pressProps(gate: ManagerWriteGate, blocked: boolean, onPress: () => void): PressProps;

package/lib/types/client/manager/search.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The shared action panel's search rule (spec 8.1).
+ *
+ * Spec 8.1 requires the search to *actually* filter — the prototype's
+ * "shows everything" placeholder is explicitly forbidden — to keep matches in
+ * their `actionOrder` relative order, and to have one stated policy for which
+ * fields are searched, how case is handled and how Unicode is normalized.
+ *
+ * That policy is:
+ *
+ * - **Fields**: the label and the static text, and nothing else. Those are the
+ *   two things the user wrote and can read; the icon is decoration and never an
+ *   accessible or searchable name (spec 8.4), and the Command badge is derived
+ *   from the text that is already searched.
+ * - **Case**: folded with `toLowerCase()`, which is the locale-independent
+ *   Unicode default mapping. `toLocaleLowerCase()` is deliberately avoided: it
+ *   would make the same query behave differently for a Turkish `i` depending on
+ *   the UI language, and a filter that depends on the locale cannot be pinned.
+ * - **Unicode**: NFKC. It folds the compatibility forms a CJK IME actually
+ *   produces — full-width Latin and full-width punctuation above all — so a
+ *   query typed with the IME still finds half-width text.
+ * - **Whitespace**: every run collapses to one space, on both sides, so a
+ *   one-line query can match a multi-line action text. The run definition is
+ *   the regex `\s`, which is the same ECMAScript whitespace `trim()` uses, so
+ *   this stays consistent with the blank rules of spec 4.3.
+ *
+ * Matching is per field and by substring: an action matches when the normalized
+ * query appears in its normalized label or in its normalized text. Fields are
+ * never concatenated first, which would let a query match across a boundary
+ * that does not exist.
+ *
+ * The comparison is deliberately not locale-collated (`Intl.Collator`): a
+ * collator answers "are these equal", not "does this contain that", and a
+ * substring search is what a filter box means.
+ */
+import type { ProjectedQuickAction } from '../../model/index.js';
+/**
+ * The one normalization both sides of a comparison go through. Applying it to
+ * the query and to the haystack through the same function is what keeps the two
+ * from drifting apart.
+ */
+export declare function normalizeQuickActionSearchText(value: string): string;
+/**
+ * Whether a query asks for anything at all. A whitespace-only box is an empty
+ * one, and telling the two apart is what lets a panel say "nothing matched"
+ * rather than "nothing to run".
+ */
+export declare function hasQuickActionQuery(query: string): boolean;
+/**
+ * The actions matching `query`, in their original relative order.
+ *
+ * An empty or whitespace-only query hands the same array back by identity: an
+ * unsearched panel is not a filtered panel, and returning a copy would remount
+ * every row for nothing.
+ */
+export declare function filterQuickActions(actions: readonly ProjectedQuickAction[], query: string): readonly ProjectedQuickAction[];

package/lib/types/client/manager/status.d.ts

@@ -0,0 +1,23 @@
+import type { QuickActionsClientState, QuickActionWriteFailure } from '../controller.js';
+import type { Translate } from '../dsh.js';
+/** Why every write is refused right now, or `undefined` when none is. */
+export type ManagerReadOnlyReason = 
+/** The connection cannot vouch for the held snapshot, so it must not be written over. */
+'offline'
+/** No writable namespace: an unreadable first read, or a process-local page. */
+ | 'storage';
+/**
+ * Report read-only state, and only read-only state.
+ *
+ * Spec 10 keeps two first-read failures apart: a catalog that could not be read
+ * shows a retryable catalog error, while a *readable* catalog whose user
+ * namespace failed shows "storage unavailable". Without the projection guard
+ * below, a loading or failed catalog also reads as read-only — the write gate
+ * refuses on `not-ready` — and the panel would print both notices at once,
+ * telling the user their storage is broken when it is the catalog that is
+ * missing. With no catalog there is nothing to be read-only *about*: the catalog
+ * notice is the whole story.
+ */
+export declare function managerReadOnlyReason(client: QuickActionsClientState): ManagerReadOnlyReason | undefined;
+/** One write failure as a sentence, with the recovery it implies (spec 10). */
+export declare function managerFailureMessage(failure: QuickActionWriteFailure, t: Translate): string;