dsh-quick-actions 0.1.0 → 0.2.0-rc.2

package/lib/index.js

@@ -263,6 +263,74 @@ function buildPresetCatalog(input) {
 	};
 }
 //#endregion
+//#region src/model/presets.ts
+/**
+* The package's built-in Preset Quick Action manifest — component 1 of the
+* Preset Catalog (spec 5.1), declared ahead of the Host composition's
+* `Config.presets`.
+*
+* It lives in the shared model because both faces merge it: the Host validates
+* the catalog at load, and the Client rebuilds the same catalog from this list
+* plus the `presets` form field it reads (spec 22.3). One list, so the two can
+* never disagree about what the built-ins are.
+*
+* These are author-facing product copy in one language; changing a label or a
+* text is a product decision, not an implementation one.
+*
+* Two rules bind any edit here:
+*
+* - A Preset Action ID is permanent. Label, icon and text may change under the
+*   same id, but `kind` and `confirm` are the immutable safety behaviour
+*   signature — changing either needs a new id (spec 5.1). Editing a text so it
+*   crosses the Command Send Action boundary counts as crossing that signature.
+* - Adding an entry is additive: a new id appends to the end of every existing
+*   user's order and rewrites no stored data (spec 5.3).
+*
+* `summarize` and `explain` carry new ids rather than reusing
+* `summarize-thread` and `explain-last-change`: those two shipped on the
+* default `confirm: true`, and turning confirmation off is exactly the
+* signature change the first rule reserves a new id for. The old ids simply
+* leave the catalog, which the model already handles — a stored preference for
+* an id no longer in the catalog is kept as a tombstone, neither shown nor
+* counted (spec 5.3).
+*/
+const BUILT_IN_PRESETS = Object.freeze([
+	Object.freeze({
+		id: "approve",
+		label: "确认",
+		text: "确认，按你刚才说的做。",
+		icon: "✅",
+		confirm: false
+	}),
+	Object.freeze({
+		id: "continue",
+		label: "继续",
+		text: "继续。",
+		icon: "▶️",
+		confirm: false
+	}),
+	Object.freeze({
+		id: "summarize",
+		label: "总结",
+		text: "总结当前对话：已确定的结论、仍未决的问题、下一步要做的事。",
+		icon: "📝",
+		confirm: false
+	}),
+	Object.freeze({
+		id: "explain",
+		label: "解释",
+		text: "解释你刚才的改动：为什么这样做，考虑过哪些替代方案，取舍是什么。",
+		icon: "🔍",
+		confirm: false
+	}),
+	Object.freeze({
+		id: "compact-context",
+		label: "压缩",
+		text: "/compact",
+		icon: "🧹"
+	})
+]);
+//#endregion
 //#region src/model/settings.ts
 /**
 * Settings V1 decoding (spec 4.2, 6.3). Decoding is defensive and lossless: it
@@ -271,17 +339,27 @@ function buildPresetCatalog(input) {
 * Catalog-aware canonicalization lives in `normalize.ts`.
 */
 /**
-* The one namespace holding user data (spec 4.2); renaming it orphans every
-* stored section. It lives in the shared model because both faces address it:
-* the Host registers it, the Client binds the same name.
+* The one namespace holding user data (spec 4.2, 22); renaming it orphans every
+* stored section. Since DSH 0.1.7 a Settings namespace *is* a profile entry id,
+* so this is also the Cordis loader entry id the bundle patch inserts — the two
+* can no longer drift apart. It lives in the shared model because both faces
+* address it: the Host describes and fences its canonical rewrite against it,
+* the Client reads and writes the same form.
 */
 const QUICK_ACTIONS_SETTINGS_NAMESPACE = "composer-quick-actions";
 /**
-* The read-only namespace carrying the Preset Catalog to Clients (spec 17.2).
-* The plugin never writes its user layer, so it holds no persisted section —
-* `composer-quick-actions` remains the only persisted namespace (spec 4.2).
+* The top-level fields of the stored section, in canonical order (spec 4.2).
+* Each is a separate volatile Config field (spec 22.2): the DSH legacy import
+* addresses a section by these exact top-level keys, and every write sets them
+* field by field so a write never reaches the author's `presets`.
 */
-const QUICK_ACTIONS_CATALOG_NAMESPACE = "composer-quick-actions-catalog";
+const QUICK_ACTION_STATE_FIELDS = Object.freeze([
+	"schemaVersion",
+	"layout",
+	"userActionsById",
+	"actionOrder",
+	"presetStateById"
+]);
 /** The state a fresh install starts from (spec 4.2). */
 const DEFAULT_QUICK_ACTION_SETTINGS = Object.freeze({
 	schemaVersion: 1,
@@ -466,69 +544,6 @@ function normalizeQuickActionSettings(settings, catalog) {
 	};
 }
 //#endregion
-//#region src/host/presets.ts
-/**
-* The package's built-in Preset Quick Action manifest — component 1 of the
-* Preset Catalog (spec 5.1), declared ahead of the Host composition's
-* `Config.presets`.
-*
-* These are author-facing product copy in one language; changing a label or a
-* text is a product decision, not an implementation one.
-*
-* Two rules bind any edit here:
-*
-* - A Preset Action ID is permanent. Label, icon and text may change under the
-*   same id, but `kind` and `confirm` are the immutable safety behaviour
-*   signature — changing either needs a new id (spec 5.1). Editing a text so it
-*   crosses the Command Send Action boundary counts as crossing that signature.
-* - Adding an entry is additive: a new id appends to the end of every existing
-*   user's order and rewrites no stored data (spec 5.3).
-*
-* `summarize` and `explain` carry new ids rather than reusing
-* `summarize-thread` and `explain-last-change`: those two shipped on the
-* default `confirm: true`, and turning confirmation off is exactly the
-* signature change the first rule reserves a new id for. The old ids simply
-* leave the catalog, which the model already handles — a stored preference for
-* an id no longer in the catalog is kept as a tombstone, neither shown nor
-* counted (spec 5.3).
-*/
-const BUILT_IN_PRESETS = Object.freeze([
-	Object.freeze({
-		id: "approve",
-		label: "确认",
-		text: "确认，按你刚才说的做。",
-		icon: "✅",
-		confirm: false
-	}),
-	Object.freeze({
-		id: "continue",
-		label: "继续",
-		text: "继续。",
-		icon: "▶️",
-		confirm: false
-	}),
-	Object.freeze({
-		id: "summarize",
-		label: "总结",
-		text: "总结当前对话：已确定的结论、仍未决的问题、下一步要做的事。",
-		icon: "📝",
-		confirm: false
-	}),
-	Object.freeze({
-		id: "explain",
-		label: "解释",
-		text: "解释你刚才的改动：为什么这样做，考虑过哪些替代方案，取舍是什么。",
-		icon: "🔍",
-		confirm: false
-	}),
-	Object.freeze({
-		id: "compact-context",
-		label: "压缩",
-		text: "/compact",
-		icon: "🧹"
-	})
-]);
-//#endregion
 //#region src/host/config.ts
 /**
 * Host composition config: the author-facing `presets` list, merged behind the
@@ -545,11 +560,20 @@ function describeIssue(issue) {
 	return `${issue.id === void 0 ? at : `${at} ("${issue.id}")`}: ${issue.field} is ${issue.reason}`;
 }
 /**
+* The plain value behind one Config field. A Loader-resolved config hands each
+* volatile field over as a `Volatile` reference (spec 22.2); a composition that
+* calls `apply` directly hands the plain value.
+*/
+function readVolatile(field) {
+	if (typeof field === "object" && field !== null && typeof field.get === "function") return field.get();
+	return field;
+}
+/**
 * Read one Host composition config into the authoritative catalog.
 * @param config - the composition entry's config, absent when nothing was declared.
 */
 function readComposerQuickActionsConfig(config) {
-	const declared = config?.presets;
+	const declared = readVolatile(config?.presets);
 	if (declared !== void 0 && !Array.isArray(declared)) return {
 		ok: false,
 		message: "composer-quick-actions: `presets` must be a list of preset quick actions"
@@ -570,39 +594,61 @@ function readComposerQuickActionsConfig(config) {
 //#endregion
 //#region src/host/settings.ts
 /**
-* The single persisted Settings namespace and the Host's canonical rewrite
-* (spec 4.2, 6.1, 6.3).
+* The plugin's Config — which since DSH 0.1.7 *is* its Settings form — and the
+* Host's canonical rewrite (spec 4.2, 6.1, 6.3, 22).
 *
-* The Host is the sole validation and migration authority, so the registered
-* schema is deliberately permissive: it fixes the shape of the section and its
-* defaults, and nothing else. A strict schema would refuse registration for a
-* section a higher version wrote — which is exactly the data spec 5.3 requires
-* to survive a downgrade untouched. The shared model decodes and normalizes what
-* the schema lets through, and it never rewrites content it cannot render.
+* The Host is the sole validation and migration authority, so the schema is
+* deliberately permissive: it fixes the shape of the section and its defaults,
+* and nothing else. A strict schema would refuse a section a higher version
+* wrote — which is exactly the data spec 5.3 requires to survive a downgrade
+* untouched. The shared model decodes and normalizes what the schema lets
+* through, and it never rewrites content it cannot render.
 */
 /**
-* Shape and defaults of the persisted section (spec 4.2). The three collections
-* stay unconstrained on purpose: a stricter schema would refuse registration for
-* a section this release cannot render, and refusing registration is how stored
-* data gets lost. The shared model is the validation gate — see the module note.
+* The plugin Config (spec 22.2). Every field is `volatile`, because DSH lets a
+* Settings form — and so the Client — reach volatile fields only.
+*
+* - The five user-state fields are top-level on purpose: the DSH legacy import
+*   moves an old `settings.yaml` section into the entry of the same id key by
+*   key, and refuses the whole section when any top-level key is not a volatile
+*   field. This exact shape is what lets that one-shot import land.
+* - `presets` is the author's list merged behind the built-ins (spec 5.1). It
+*   is volatile only so the Client can read it — a non-volatile field never
+*   reaches the browser — and nothing in this plugin ever writes it.
+*
+* The collections stay unconstrained: a stricter schema would refuse a section
+* this release cannot render, and refusing it is how stored data gets lost.
 */
-const quickActionSettingsSchema = Schema.object({
-	schemaVersion: Schema.number().default(1),
-	layout: Schema.string().default("ribbon"),
-	userActionsById: Schema.any().default({}),
-	actionOrder: Schema.any().default([]),
-	presetStateById: Schema.any().default({})
+const Config = Schema.object({
+	presets: Schema.any().default([]).volatile(),
+	schemaVersion: Schema.number().default(1).volatile(),
+	layout: Schema.string().default("ribbon").volatile(),
+	userActionsById: Schema.any().default({}).volatile(),
+	actionOrder: Schema.any().default([]).volatile(),
+	presetStateById: Schema.any().default({}).volatile()
 });
 /**
-* Shape of the catalog namespace. Its authoritative content is the composition
-* `base` layer the Host declares; a user layer is never written and, if one were
-* hand-written into the document, Clients would still read `base` (spec 17.2).
+* One write per user-state field, never touching `presets`: the author's list
+* shares the entry's config, and a write that restated it would pin whatever it
+* read into the profile layer.
 */
-const quickActionCatalogSchema = Schema.object({
-	schemaVersion: Schema.number().default(1),
-	revision: Schema.string().default(""),
-	presets: Schema.any().default([])
-});
+function stateOps(section) {
+	return QUICK_ACTION_STATE_FIELDS.map((field) => ({
+		op: "set",
+		path: [field],
+		value: section[field]
+	}));
+}
+/**
+* The user-state fields the profile layer actually sets, or `undefined` when it
+* sets none. The same layer may carry the author's `presets`; those are Config,
+* not stored state, so a profile holding only presets has nothing stored.
+*/
+function storedState(user) {
+	if (typeof user !== "object" || user === null || Array.isArray(user)) return void 0;
+	const fields = Object.entries(user).filter(([field]) => QUICK_ACTION_STATE_FIELDS.includes(field));
+	return fields.length === 0 ? void 0 : Object.fromEntries(fields);
+}
 /** Recognize a revision conflict by its stable code, never by prototype (realm copies). */
 function isConflict(error) {
 	return typeof error === "object" && error !== null && error.code === "SETTINGS_CONFLICT";
@@ -614,9 +660,9 @@ const REWRITE_ATTEMPTS = 3;
 * persist it behind the revision it was read at (spec 6.3).
 *
 * Nothing is written when nothing is stored: materializing the defaults into the
-* user layer would shadow the composition `base` and destroy what `replace({})`
-* resets to. Nothing is written for a higher `schemaVersion` either — that data
-* belongs to the version that wrote it.
+* profile layer would shadow every layer below it for good. Nothing is written
+* for a higher `schemaVersion` either — that data belongs to the version that
+* wrote it.
 *
 * A conflict means another writer won the race, so the rewrite refreshes the
 * authoritative snapshot and recomputes rather than replaying its own stale
@@ -628,7 +674,7 @@ async function rewriteCanonicalSettings(settings, catalog) {
 	for (let attempt = 1; attempt <= REWRITE_ATTEMPTS; attempt += 1) {
 		const descriptor = settings.describe().find((candidate) => candidate.ns === QUICK_ACTIONS_SETTINGS_NAMESPACE);
 		if (descriptor === void 0) return { status: "unregistered" };
-		const stored = descriptor.user;
+		const stored = storedState(descriptor.user);
 		if (stored === void 0) return { status: "nothing-stored" };
 		const storedVersion = storedSchemaVersion(stored);
 		if (storedVersion > 1) return {
@@ -638,7 +684,7 @@ async function rewriteCanonicalSettings(settings, catalog) {
 		const canonical = canonicalSettings(stored, catalog);
 		if (deepEqualJson(stored, canonical)) return { status: "unchanged" };
 		try {
-			await settings.replace(QUICK_ACTIONS_SETTINGS_NAMESPACE, canonical, descriptor.revision);
+			await settings.mutate(QUICK_ACTIONS_SETTINGS_NAMESPACE, stateOps(canonical), descriptor.revision);
 			return {
 				status: "rewritten",
 				revision: descriptor.revision
@@ -664,49 +710,52 @@ function canonicalSettings(stored, catalog) {
 //#endregion
 //#region src/host/index.ts
 /**
-* Host ownership of the Quick Action state (spec 6.1, 17.2): it merges and
-* validates the Preset Catalog, registers the user-state Settings namespace and
-* the read-only catalog namespace, canonicalizes the stored section behind a
+* Host ownership of the Quick Action state (spec 6.1, 22): it merges and
+* validates the Preset Catalog, canonicalizes the stored section behind a
 * revision fence, and serves the authoritative catalog snapshot.
 *
-* The Host never reaches past Settings to a file or a storage backend, and it
-* never substitutes its own storage when the provider is missing — the plugin
-* declares `settings` as a hard dependency and waits.
+* Since DSH 0.1.7 there is nothing to register: the plugin's own Config is its
+* Settings form (spec 22.1). The Host never reaches past Settings to a file or
+* a storage backend, and it never substitutes its own storage when the
+* provider is missing.
 */
 /** A copy nothing can reach the authoritative catalog through. */
 function detachedCatalog(catalog) {
 	return JSON.parse(JSON.stringify(catalog));
 }
 /**
-* Load the catalog, register both namespaces and canonicalize the stored section.
+* Load and validate the catalog.
 *
-* An invalid preset configuration throws before anything is registered: the
-* catalog is author-owned, so a mistake fails plugin loading rather than
-* silently shipping a partial catalog (spec 5.1).
+* An invalid preset configuration throws: the catalog is author-owned, so a
+* mistake fails plugin loading rather than silently shipping a partial catalog
+* (spec 5.1).
 *
-* @param settings - the Host settings provider.
 * @param config - the Host composition entry's config.
 */
-function startQuickActionsHost(settings, config) {
+function startQuickActionsHost(config) {
 	const loaded = readComposerQuickActionsConfig(config);
 	if (!loaded.ok) throw new Error(loaded.message);
 	const { catalog } = loaded;
-	settings.register(QUICK_ACTIONS_SETTINGS_NAMESPACE, quickActionSettingsSchema, { applies: "live" });
-	settings.register(QUICK_ACTIONS_CATALOG_NAMESPACE, quickActionCatalogSchema, {
-		base: detachedCatalog(catalog),
-		applies: "restart"
-	});
 	return {
-		ready: rewriteCanonicalSettings(settings, catalog),
-		describeCatalog: async () => detachedCatalog(catalog)
+		describeCatalog: async () => detachedCatalog(catalog),
+		canonicalize: (settings) => rewriteCanonicalSettings(settings, catalog)
 	};
 }
 //#endregion
 //#region src/index.ts
 const name = "composer-quick-actions";
-const inject = ["settings"];
 /**
-* Load the Preset Catalog, register the Settings namespace and canonicalize the
+* Settles once every profile entry has, which is when DSH serves this entry's
+* form at all: an entry is described only while its fiber is active, and the
+* legacy `settings.yaml` import waits on the same promise. A composition with
+* no Loader has nothing to wait for.
+*/
+function entriesSettled(ctx) {
+	const loader = ctx.get("loader");
+	return typeof loader?.await === "function" ? loader.await() : Promise.resolve();
+}
+/**
+* Load the Preset Catalog and, while Settings is present, canonicalize the
 * stored section. An invalid preset configuration throws here, failing plugin
 * loading loudly rather than shipping a partial catalog (spec 5.1).
 *
@@ -714,24 +763,27 @@ const inject = ["settings"];
 * can reach the catalog projection; the cordis loader ignores the value.
 */
 function apply(ctx, config) {
-	const settings = ctx.settings;
-	const host = startQuickActionsHost(settings, config);
+	const host = startQuickActionsHost(config);
 	const logger = ctx.logger("composer-quick-actions");
-	ctx.effect(() => {
-		let owned = true;
-		host.ready.then((outcome) => {
-			if (!owned) return;
-			if (outcome.status === "conflict") logger.warn("settings kept moving during the canonical rewrite after %d attempts; leaving the stored section as the concurrent writer left it", outcome.attempts);
-			else if (outcome.status === "read-only") logger.warn("settings are read-only; the stored section was left untouched");
-			else if (outcome.status === "newer-version") logger.warn("the stored section declares schemaVersion %d; leaving it untouched so downgrading loses nothing", outcome.schemaVersion);
-		}, (error) => {
-			if (owned) logger.error(error);
-		});
-		return () => {
-			owned = false;
-		};
-	}, "composer-quick-actions: canonical settings rewrite");
+	ctx.inject(["settings"], (scoped) => {
+		const settings = scoped.settings;
+		scoped.effect(() => scoped.settings.configure({ auto: false }, ctx.fiber), "composer-quick-actions: settings page policy");
+		scoped.effect(() => {
+			let owned = true;
+			entriesSettled(ctx).then(() => owned ? host.canonicalize(settings) : void 0).then((outcome) => {
+				if (!owned || outcome === void 0) return;
+				if (outcome.status === "conflict") logger.warn("settings kept moving during the canonical rewrite after %d attempts; leaving the stored section as the concurrent writer left it", outcome.attempts);
+				else if (outcome.status === "read-only") logger.warn("settings are read-only; the stored section was left untouched");
+				else if (outcome.status === "newer-version") logger.warn("the stored section declares schemaVersion %d; leaving it untouched so downgrading loses nothing", outcome.schemaVersion);
+			}, (error) => {
+				if (owned) logger.error(error);
+			});
+			return () => {
+				owned = false;
+			};
+		}, "composer-quick-actions: canonical settings rewrite");
+	});
 	return host;
 }
 //#endregion
-export { apply, inject, name };
+export { Config, apply, name };

package/lib/types/client/controller.d.ts

@@ -1,40 +1,41 @@
 import type { CustomActionId, PresetActionId, PresetCatalog, QuickActionDraft, QuickActionLayout, QuickActionMutationRejection, QuickActionProjection, QuickActionRef, QuickActionSettingsV1 } from '../model/index.js';
 /**
- * One path-addressed edit inside a namespace section. The transport also accepts
- * an `unset` form; this plugin writes the whole section field by field and never
- * clears one, so only the form it submits is declared.
+ * One path-addressed edit inside the form. The transport also accepts an `unset`
+ * form; this plugin writes the user state field by field and never clears one,
+ * so only the form it submits is declared.
  */
 export interface SettingsSetOp {
     readonly op: 'set';
-    readonly path: readonly string[];
-    readonly value: unknown;
+    readonly path: string[];
+    readonly value: SettingsJsonValue;
 }
-/** One bound namespace as the scope publishes it. */
-export interface SettingsScopeSnapshot {
-    /** `loading` until the shared document answers; `unavailable` when the namespace is not served. */
+/** A JSON value as the Settings wire carries it: the same data the model holds, minus `readonly`. */
+export type SettingsJsonValue = null | boolean | number | string | SettingsJsonValue[] | {
+    [key: string]: SettingsJsonValue;
+};
+/** The plugin entry's form as `ctx.configForms` publishes it. */
+export interface ConfigFormSnapshot {
+    /** `loading` until the shared document answers; `unavailable` when the entry is not served. */
     readonly status: 'loading' | 'ready' | 'unavailable';
-    /** Resolved section: schema defaults, then composition base, then the user layer. */
+    /** Resolved volatile fields: schema defaults, then the layers below the profile, then the profile. */
     readonly value?: unknown;
-    /** Composition base layer, where an author-owned layer such as the catalog rides. */
-    readonly base?: unknown;
-    /** Revision of the raw user section, sent back to fence a write. */
-    readonly revision?: number;
+    /** Revision of the raw entry configuration, sent back to fence a write. */
+    readonly revision?: number | undefined;
     /** Whether the provider accepts writes at all. */
     readonly writable: boolean;
     /** `memory` on a page this Client keeps process-local; no write ever crosses the wire. */
     readonly mode: 'host' | 'memory';
 }
-/** The namespace contract handed to `bind`. */
-export interface SettingsScopeSpec {
-    readonly namespace: string;
-    /** Narrows the resolved value; returning `undefined` publishes no value at all. */
-    readonly decode?: (value: unknown) => unknown;
-}
-/** One namespace scope: a derived read plus that namespace's serialized writes. */
-export interface BoundSettingsScope {
-    getSnapshot(): SettingsScopeSnapshot;
+/**
+ * One entry's form: a derived read plus that entry's serialized writes. A write
+ * answers whether the Host accepted it, but a refusal and a lost fence both
+ * answer `false`, so this controller never reads the answer — it classifies
+ * from the snapshot the form publishes after the write instead.
+ */
+export interface ConfigForm {
+    getSnapshot(): ConfigFormSnapshot;
     subscribe(listener: () => void): () => void;
-    mutate(ops: readonly SettingsSetOp[], expectedRevision?: number): Promise<void>;
+    mutate(ops: readonly SettingsSetOp[], expectedRevision?: number): Promise<unknown>;
 }
 /** The shared settings document as the mirror holds it. */
 export interface SettingsMirrorSnapshot {
@@ -44,19 +45,20 @@ export interface SettingsMirrorSnapshot {
     readonly error: string | null;
 }
 /**
- * The shared describe mirror's read face. A bound scope publishes nothing at all
- * while the document is unanswered, so a read that *failed* is only visible here
- * — which is what tells a first catalog read failure apart from one still in
+ * The shared describe mirror's read face. A form publishes nothing at all while
+ * the document is unanswered, so a read that *failed* is only visible here —
+ * which is what tells a first catalog read failure apart from one still in
  * flight (spec 10).
  */
 export interface SettingsMirror {
     getSnapshot(): SettingsMirrorSnapshot;
     subscribe(listener: () => void): () => void;
-    load(): Promise<void>;
+    /** Read the document if nothing holds or reads it — exactly the retry after a failed first read. */
+    ensure(): Promise<void>;
 }
-/** `ctx.settingsScope`. */
-export interface SettingsScopeService {
-    bind(spec: SettingsScopeSpec): BoundSettingsScope;
+/** `ctx.configForms`. */
+export interface ConfigFormsService {
+    get(entryId: string): ConfigForm;
     describe(): SettingsMirror;
 }
 /** Connection lifecycle as `ctx.connection` publishes it; `undefined` before the loop starts. */
@@ -72,10 +74,19 @@ export interface ConnectionLike {
 export type CatalogErrorReason = 
 /** The settings document could not be read at all; retrying is the remedy. */
 'unreadable'
-/** The Host serves no catalog namespace, or published no `base` layer on it. */
+/** The Host serves this page no form for the entry — it is not active, or the page is process-local. */
  | 'unavailable'
-/** A `base` layer this release cannot read in full; never a truncated catalog (spec 5.1). */
+/** The author `presets` field is not a list, or any entry is invalid; never a truncated catalog (spec 5.1, 22.3). */
  | 'undecodable';
+/**
+ * Whether a user retry can clear this catalog error (spec 10).
+ *
+ * Only a failed first read can: the mirror's public face re-reads only while it
+ * holds no document (`ensure()`, spec 22.4). The other two arrive with a held
+ * document and clear on their own when the Host's `settings/document-updated`
+ * broadcast or a reconnect refreshes it, so a retry there would do nothing.
+ */
+export declare function isRetryableCatalogError(reason: CatalogErrorReason): boolean;
 /** The authoritative Preset Catalog as the Client currently knows it. */
 export type CatalogState = {
     readonly status: 'loading';
@@ -130,9 +141,10 @@ export type QuickActionWriteFailure =
 /**
  * The structured result every mutation answers with (spec 15, decision 4).
  *
- * The shipped `SettingsScope.mutate` resolves to `void`, and this release adds no
- * DSH core interface (spec 16.4), so success, refusal and conflict are told apart
- * here, from the authoritative snapshot the scope publishes after the write: the
+ * The shipped `ConfigForm.mutate` answers a bare boolean that folds a refusal and
+ * a lost fence into one `false`, and this release adds no DSH core interface
+ * (spec 16.4), so success, refusal and conflict are told apart here, from the
+ * authoritative snapshot the form publishes after the write: the
  * write committed when the stored state now reads back as the plan, the fence was
  * lost when the namespace revision moved elsewhere, and anything else is a Host
  * refusal. Each failing case leaves the caller's form content untouched — the
@@ -194,14 +206,24 @@ export interface QuickActionsController {
 }
 /** What the controller is built over. */
 export interface QuickActionsControllerOptions {
-    readonly settingsScope: SettingsScopeService;
+    readonly configForms: ConfigFormsService;
     readonly connection: ConnectionLike;
     /** Mints one Custom Action ID. Defaults to `crypto.randomUUID()`. */
     readonly mintCustomActionId?: () => string;
+    /**
+     * The built-in manifest merged ahead of the `presets` field. Defaults to the
+     * package's own, the one the Host validated at load; the suite passes its own
+     * fixtures so that a catalog is exactly what a case declares.
+     */
+    readonly builtinPresets?: readonly unknown[];
 }
 /**
- * Create the controller. Both bindings are made on the calling fiber, so the
- * scope disposers the binder registers are withdrawn with it; `dispose()`
- * releases what this module owns on top of that.
+ * Create the controller. The form is owned by the settings provider and shared
+ * by every reader of this entry, so there is nothing to release for it;
+ * `dispose()` withdraws this module's own subscriptions.
+ *
+ * Both the catalog and the user state come off the same form. It is decoded
+ * here, by the shared model, rather than trusted as the transport validated
+ * it: the Client's reading of a confirmed snapshot is the model's.
  */
 export declare function createQuickActionsController(options: QuickActionsControllerOptions): QuickActionsController;

package/lib/types/client/dsh.d.ts

@@ -40,10 +40,14 @@ export interface InputOccurrence {
     readonly source: string;
     readonly ref: string;
 }
-/** One row of the read-only transient queue projection. */
-export interface InputQueueRow {
-    readonly placement: 'queued' | 'steering' | 'context';
-}
+/**
+ * One row of the read-only transient queue projection. Opaque on purpose: the
+ * plugin never reads a row — a send may join a running turn (spec 9.2) — and
+ * DSH 0.1.7 replaced the row shape outright (`placement` rows became the next
+ * turn's `UserMessage`s), so any field declared here would only be one more
+ * name to drift (spec 22.5).
+ */
+export type InputQueueRow = unknown;
 /**
  * The published per-Session input state — the whole public snapshot, listed
  * field by field because spec 9.5 makes this exact set the only evidence the

package/lib/types/client/index.d.ts

@@ -2,24 +2,24 @@
  * Client composition entry for Composer Quick Actions.
  *
  * This fiber owns everything the feature holds in the browser: one global
- * `QuickActionsController` over the two Settings namespaces, the per-Session
+ * `QuickActionsController` over the entry's Settings form, the per-Session
  * execution registry, the Resident Composer registry, the locale dictionaries,
  * the stylesheet, and the two dock Slot registrations. All of it is installed
  * through `ctx.effect` and `ctx.slots.inject`, so unloading the plugin leaves
  * no listener, registration, namespace, style tag or subscription behind
  * (spec 7.3).
  *
- * `settingsScope` is how this Client reaches Host-authoritative state at all — it
+ * `configForms` is how this Client reaches Host-authoritative state at all — it
  * never writes a file, never treats browser storage as a source of truth, and
  * never reaches past Settings to a provider (spec 6.3). `connection` supplies the
  * generation state the read-only-while-disconnected rule needs (spec 10).
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { ConnectionLike, SettingsScopeService } from './controller.js';
+import type { ConfigFormsService, ConnectionLike } from './controller.js';
 import type { ConversationLike, LocaleService, SlotsService } from './dsh.js';
 declare module '@deepseek-ai/cordis' {
     interface Context {
-        settingsScope: SettingsScopeService;
+        configForms: ConfigFormsService;
         connection: ConnectionLike;
         slots: SlotsService;
         locale: LocaleService;