yarramate 0.23.0 → 1.0.0

package/dist/adapters/visual/protocol-contract.d.ts

@@ -10,8 +10,19 @@
  */
 import type { CanvasGraph } from "../../graph-projection.js";
 import type { YarramateApplyResult, YarramateOperation } from "../../operations.js";
-import type { ProjectionDefinition, ProjectionQuery } from "../../projection.js";
-export declare const VISUAL_PROTOCOL_VERSION: "yarramate/visual-protocol/v3";
+import type { ProjectionDefinition, ProjectionExclusion, ProjectionQuery } from "../../projection.js";
+/**
+ * The wire this adapter speaks. v5 makes a view a staged change rather than an
+ * immediate write (ADR 0103): a commit carries `viewOperations` beside its
+ * model operations, a model frame carries the projection digests those
+ * operations pin against, and the `view.save` event that wrote a projection
+ * the moment it was composed is gone. A v4 peer and a v5 peer refuse each
+ * other at the first document exchanged.
+ *
+ * v4 retyped every path-carrying field from a bare native string to a
+ * canonical local `file:` URI (ADR 0096).
+ */
+export declare const VISUAL_PROTOCOL_VERSION: "yarramate/visual-protocol/v5";
 export declare const VISUAL_LIMITS: {
     readonly messageBytes: number;
     readonly modelBytes: number;
@@ -29,6 +40,18 @@ export interface VisualDiagnostic {
     readonly pointer: string;
     readonly line: number;
     readonly column: number;
+    /**
+     * The subjects this diagnostic is about, most relevant first, when its
+     * pointer names one (ADR 0102, extending the derivation Core added for
+     * exactly this consumer).
+     *
+     * Absence is meaningful and is not "not yet populated": a diagnostic with no
+     * subject belongs to no subject, such as a YAML parse failure, a
+     * whole-document schema violation, a projection's own definition, or a
+     * manifest. That is what lets a canvas route one to an element and the other
+     * to a lane of its own, rather than showing a failure with nothing marked.
+     */
+    readonly subjects?: readonly string[];
 }
 export interface VisualDiagnosticResult {
     readonly format: "yarramate/visual-diagnostic-result/v1";
@@ -56,7 +79,7 @@ export interface VisualSessionRequest {
     readonly initialModel: VisualModel;
 }
 export interface VisualSessionStarted {
-    readonly format: "yarramate/visual-session-started/v1";
+    readonly format: "yarramate/visual-session-started/v2";
     readonly protocolVersion: typeof VISUAL_PROTOCOL_VERSION;
     readonly sessionId: string;
     readonly authority: VisualAuthority;
@@ -65,18 +88,25 @@ export interface VisualSessionStarted {
     readonly browserUrl: string;
     readonly webSocketUrl: string;
     readonly origin: string;
+    /** Canonical local `file:` URI. Copy it back verbatim as the argument to
+     * `wait`/`respond`/`status`/`recover`/`stop`; it is never hand-typed as a
+     * native path. Minted by `toWireFileUri`, read by `fromWireFileUri`. */
     readonly descriptorPath: string;
+    /** Canonical local `file:` URI, as `descriptorPath`. */
     readonly sessionRoot: string;
     readonly capabilities: VisualCapabilities;
     readonly startedAt: string;
 }
 export interface VisualSessionDescriptor {
-    readonly format: "yarramate/visual-session-descriptor/v1";
+    readonly format: "yarramate/visual-session-descriptor/v2";
     readonly protocolVersion: typeof VISUAL_PROTOCOL_VERSION;
     readonly sessionId: string;
     readonly origin: string;
     readonly agentCapability: string;
+    /** Canonical local `file:` URI. Proven against the session actually opened
+     * before `agentCapability` is ever spent. */
     readonly sessionRoot: string;
+    /** Canonical local `file:` URI, as `sessionRoot`. */
     readonly journalPath: string;
     readonly createdAt: string;
 }
@@ -97,10 +127,39 @@ export interface VisualViewSummary {
     readonly description: string;
     readonly query: ProjectionQuery;
     readonly presentation: ProjectionDefinition["presentation"];
+    /**
+     * Manifest-relative path of the projection document this view was read from,
+     * as `VisualRenderedModel.documents` names a document — not the `file:` URI
+     * ADR 0096 mints for the descriptor and session root, which name things
+     * outside the workspace.
+     *
+     * The tree derives its folders from these paths, so a workspace that keeps
+     * `current/` and `target/` projections in directories gets a foldered view
+     * list without the projection format gaining a folder concept of its own.
+     */
+    readonly path: string;
+    /**
+     * How many subjects this view's query matches, resolved by the runtime the
+     * way `filter.query` is: a `ProjectionQuery` needs the semantic graph, which
+     * the browser does not have. Recomputed and re-sent whenever the workspace
+     * recompiles, since landing a changeset moves these counts.
+     */
+    readonly subjectCount: number;
 }
 export interface VisualKindOption {
     readonly id: string;
     readonly label: string;
+    /**
+     * The nearest core-profile kind this one descends from, as a label — the
+     * same resolution `CanvasNode.coreKindLabel` and `CanvasEdge.coreKindLabel`
+     * carry, for a kind nothing has been authored with yet.
+     *
+     * Without it a browser can read a palette but cannot judge it: the ArchiMate
+     * table is keyed on core kinds, so an editor offering an extension kind has
+     * no way to ask whether the pairing permits what that kind descends from,
+     * and can put a `YM404` one click away. Equal to `label` for a core kind.
+     */
+    readonly coreLabel: string;
 }
 export interface VisualFilterQueryPayload {
     readonly query: ProjectionQuery;
@@ -108,6 +167,23 @@ export interface VisualFilterQueryPayload {
 export interface VisualFilterResultPayload {
     readonly query: ProjectionQuery;
     readonly matchedIds: readonly string[];
+    /**
+     * Every concept this query DROPPED, each with the facet that dropped it, as
+     * `explainProjection` reports it. The editor needs it to say why a subject
+     * is not on the canvas: a query that quietly drops the one subject the
+     * reviewer was looking for is otherwise indistinguishable from a model that
+     * does not hold it.
+     *
+     * A frame field, not a document field. `yarramate/projection-result/v1` is
+     * `additionalProperties: false` and this is a question about a query rather
+     * than part of what a projection IS, so the exclusions ride on the answer to
+     * the question that asked for them and nowhere else.
+     *
+     * Relationships are absent by construction: they enter a view through their
+     * endpoints rather than by matching a facet, so "why" for a relationship is
+     * a statement about the concepts it joins.
+     */
+    readonly excluded: readonly ProjectionExclusion[];
 }
 export interface VisualViewSavePayload {
     readonly id?: string;
@@ -122,8 +198,37 @@ export interface VisualLayoutPositions {
         readonly y: number;
     };
 }
+/**
+ * A change to a projection document, staged rather than written (ADR 0103).
+ *
+ * These ride beside the model's operations rather than inside them: Core holds
+ * that a projection is never an operation's own target, and a view is
+ * presentation rather than semantics. Atomicity does not come from sharing a
+ * list - it comes from the runtime planning both and issuing one
+ * `SourceStore.writeAll`, so a view and the subjects it shows land together or
+ * not at all.
+ *
+ * `path` is manifest-relative, the way `VisualViewSummary.path` names it. A
+ * `write-view` at a path the manifest's patterns do not cover is refused
+ * rather than written, because a projection nothing loads is worse than a
+ * refusal (ADR 0043).
+ */
+export type VisualViewOperation = {
+    readonly op: "write-view";
+    readonly path: string;
+    readonly projection: ProjectionDefinition;
+} | {
+    readonly op: "delete-view";
+    readonly path: string;
+};
 export interface VisualChangesetCommitPayload {
     readonly operations: readonly YarramateOperation[];
+    /**
+     * Projection writes and removals landing in the same batch as `operations`.
+     * Required, not optional, for the same reason `sourceDigests` is: a browser
+     * that may omit it is one whose commits mean two different things.
+     */
+    readonly viewOperations: readonly VisualViewOperation[];
     /**
      * What the browser believed each targeted document held when the rows were
      * staged — sha256 keyed by manifest-relative path, pinned at staging time and
@@ -134,6 +239,11 @@ export interface VisualChangesetCommitPayload {
      * Required, not optional: a browser that omits it is exactly the browser that
      * cannot detect the conflict, which is why this field is what makes the
      * protocol `v3`.
+     *
+     * One map covers both lists. On the model frame the two are kept apart,
+     * because there they mean different things — what the graph was compiled
+     * from, and what the views are — but a pin means the same thing for either:
+     * what the browser expected to find on disk.
      */
     readonly sourceDigests: Readonly<Record<string, string>>;
 }
@@ -187,10 +297,6 @@ export type VisualBrowserInput = {
     readonly type: "filter.query";
     readonly lastAcknowledgedSequence: number;
     readonly payload: VisualFilterQueryPayload;
-} | {
-    readonly type: "view.save";
-    readonly lastAcknowledgedSequence: number;
-    readonly payload: VisualViewSavePayload;
 } | {
     readonly type: "changeset.commit";
     readonly lastAcknowledgedSequence: number;
@@ -213,7 +319,7 @@ interface VisualEventEnvelope<Type extends string, Payload> {
     readonly timestamp: string;
     readonly payload: Payload;
 }
-export type VisualEvent = VisualEventEnvelope<"chat.message", VisualChatMessagePayload> | VisualEventEnvelope<"choice.selected", VisualChoiceSelectedPayload> | VisualEventEnvelope<"view.navigate", VisualViewNavigatePayload> | VisualEventEnvelope<"session.end", VisualSessionEndPayload> | VisualEventEnvelope<"browser.connected", VisualBrowserConnectedPayload> | VisualEventEnvelope<"browser.disconnected", VisualBrowserDisconnectedPayload> | VisualEventEnvelope<"filter.query", VisualFilterQueryPayload> | VisualEventEnvelope<"view.save", VisualViewSavePayload> | VisualEventEnvelope<"changeset.commit", VisualChangesetCommitPayload> | VisualEventEnvelope<"layout.save", VisualLayoutSavePayload>;
+export type VisualEvent = VisualEventEnvelope<"chat.message", VisualChatMessagePayload> | VisualEventEnvelope<"choice.selected", VisualChoiceSelectedPayload> | VisualEventEnvelope<"view.navigate", VisualViewNavigatePayload> | VisualEventEnvelope<"session.end", VisualSessionEndPayload> | VisualEventEnvelope<"browser.connected", VisualBrowserConnectedPayload> | VisualEventEnvelope<"browser.disconnected", VisualBrowserDisconnectedPayload> | VisualEventEnvelope<"filter.query", VisualFilterQueryPayload> | VisualEventEnvelope<"changeset.commit", VisualChangesetCommitPayload> | VisualEventEnvelope<"layout.save", VisualLayoutSavePayload>;
 /**
  * The filter a chat turn resolved to. The agent states `query` and nothing
  * else: the runtime evaluates it against the same graph a `filter.query`
@@ -258,6 +364,13 @@ export type VisualViewSaveResultPayload = {
     readonly ok: true;
     readonly id: string;
     readonly path: string;
+    /**
+     * What the saved query matches, stated by the side that can count it.
+     * The browser builds the new view's summary from what it sent plus this
+     * result, and a `ProjectionQuery` needs the semantic graph to resolve —
+     * without this the row would join the tree claiming zero subjects.
+     */
+    readonly subjectCount: number;
 } | {
     readonly ok: false;
     readonly diagnostics: readonly VisualDiagnostic[];
@@ -289,12 +402,13 @@ export type VisualResponse = VisualResponseEnvelope<"chat.response", VisualChatR
 export type VisualHandoffDecision = "completed" | "cancelled" | "failed";
 export type VisualTerminationReason = "user-ended" | "child-failed" | "browser-timeout" | "main-cancelled" | "server-failed" | "compiler-failed";
 export interface VisualHandoff extends VisualHandoffSummary {
-    readonly format: "yarramate/visual-handoff/v1";
+    readonly format: "yarramate/visual-handoff/v2";
     readonly sessionId: string;
     readonly authority: VisualAuthority;
     readonly decision: VisualHandoffDecision;
     readonly terminationReason: VisualTerminationReason;
     readonly lastSequence: number;
+    /** Canonical local `file:` URI. */
     readonly transcriptPath: string;
     readonly transcript?: readonly (VisualEvent | VisualResponse)[];
     readonly completedAt: string;

package/dist/adapters/visual/protocol-contract.js

@@ -1,4 +1,15 @@
-export const VISUAL_PROTOCOL_VERSION = "yarramate/visual-protocol/v3";
+/**
+ * The wire this adapter speaks. v5 makes a view a staged change rather than an
+ * immediate write (ADR 0103): a commit carries `viewOperations` beside its
+ * model operations, a model frame carries the projection digests those
+ * operations pin against, and the `view.save` event that wrote a projection
+ * the moment it was composed is gone. A v4 peer and a v5 peer refuse each
+ * other at the first document exchanged.
+ *
+ * v4 retyped every path-carrying field from a bare native string to a
+ * canonical local `file:` URI (ADR 0096).
+ */
+export const VISUAL_PROTOCOL_VERSION = "yarramate/visual-protocol/v5";
 export const VISUAL_LIMITS = {
     messageBytes: 64 * 1024,
     modelBytes: 5 * 1024 * 1024,

package/dist/adapters/visual/protocol.d.ts

@@ -9,8 +9,71 @@ export * from './protocol-contract.js';
  * mints them for the initial model, the session server re-mints them on every
  * recompile and checks a commit's pins against the files on disk, and all three
  * are the same hash by construction rather than by three matching literals.
+ *
+ * There is a fourth, and it is not by construction. A commit's pins become the
+ * `expected` revisions a `SourceStore` compares before it writes (ADR 0100),
+ * and a store's revision is opaque: what `createFileSystemStore` mints happens
+ * to be this same sha256, which is the only reason a pin can be handed to it
+ * directly. The visual runtime only ever addresses a local filesystem, so that
+ * coincidence is safe today and a protocol version spent on carrying opaque
+ * revisions instead would buy nothing. It is held by a test rather than by a
+ * comment: `visual-protocol.test.ts` asserts the two agree, so a change to
+ * either side fails rather than silently making every commit's precondition
+ * unsatisfiable. That failure is when the protocol bump earns its cost.
  */
 export declare const digestOf: (source: string) => string;
+/**
+ * Encode a native absolute path for the wire.
+ *
+ * Every filesystem path a protocol document carries is a canonical local
+ * `file:` URI, minted by Node's own `pathToFileURL`. A URI is invertible
+ * where the forward-slash string transform it replaces was not: a POSIX
+ * directory whose own name contains a literal backslash percent-encodes to
+ * `%5C` and stays distinguishable from a Windows separator, and a UNC path
+ * grows a non-empty host rather than passing as an ordinary POSIX-rooted
+ * path.
+ *
+ * Encoding cannot fail. `pathToFileURL` has no error path for an
+ * already-absolute native string, and every caller holds a `resolve`/`join`
+ * result it produced itself. A relative path reaching here is a programming
+ * error rather than a protocol fault, and throws as one.
+ */
+export declare const toWireFileUri: (native: string) => string;
+/** Why one wire path was refused. Each shape is reported as `YMVS414`. */
+export type WireFileUriRefusal = 'malformed' | 'nonlocal' | 'noncanonical';
+export type WireFileUriResult = {
+    readonly ok: true;
+    readonly value: string;
+} | {
+    readonly ok: false;
+    readonly reason: WireFileUriRefusal;
+};
+/**
+ * Decode a wire path back to native, the way untrusted input has to be read.
+ *
+ * A descriptor's bearer capabilities are never spent on a document whose path
+ * fields have not passed this first, so the three refusals are checked in a
+ * fixed order and none of them is ever quietly repaired:
+ *
+ * - `malformed` — not a parseable `file:` URI, or one `fileURLToPath` itself
+ *   rejects (`ERR_INVALID_URL`, `ERR_INVALID_URL_SCHEME`,
+ *   `ERR_INVALID_FILE_URL_PATH`). A bare native path lands here too: it has
+ *   no scheme, or, for a Windows drive root, one that is not `file:`.
+ * - `nonlocal` — a non-empty host, which `pathToFileURL` never produces for a
+ *   local path: `file://server/share/x` names a network share. The host is
+ *   read off the parsed URL rather than inferred from a `fileURLToPath`
+ *   failure, because that call refuses a foreign host on POSIX but resolves
+ *   one to a UNC path on Windows, and reading it directly is the only way one
+ *   URI earns the same refusal on both.
+ * - `noncanonical` — decodes, host is empty, but re-encoding the decoded path
+ *   does not reproduce the input byte-for-byte. Two spellings of one target is
+ *   the aliasing this representation exists to close, so the other spelling is
+ *   refused rather than normalized into the canonical one. `file://localhost/x`
+ *   lands here rather than in `nonlocal`: WHATWG `URL` normalizes a
+ *   `localhost` file host away, leaving a URI that is simply not the spelling
+ *   this codec mints for `/x`.
+ */
+export declare const fromWireFileUri: (uri: string) => WireFileUriResult;
 export declare const parseVisualModel: (input: unknown) => ParseResult<VisualModel>;
 export declare const parseVisualSessionRequest: (input: unknown) => ParseResult<VisualSessionRequest>;
 export declare const parseVisualSessionStarted: (input: unknown) => ParseResult<VisualSessionStarted>;

package/dist/adapters/visual/protocol.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
-import { posix } from 'node:path';
+import { isAbsolute, posix } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import Ajv2020Module from 'ajv/dist/2020.js';
 import { describeSchemaViolation, readableSchemaErrors, } from '../../source-document.js';
 import visualDiagnosticResultSchema from '../../../schema/yarramate-visual-diagnostic-result.schema.json' with { type: 'json'
@@ -67,6 +68,17 @@ ajv.addSchema([
  * mints them for the initial model, the session server re-mints them on every
  * recompile and checks a commit's pins against the files on disk, and all three
  * are the same hash by construction rather than by three matching literals.
+ *
+ * There is a fourth, and it is not by construction. A commit's pins become the
+ * `expected` revisions a `SourceStore` compares before it writes (ADR 0100),
+ * and a store's revision is opaque: what `createFileSystemStore` mints happens
+ * to be this same sha256, which is the only reason a pin can be handed to it
+ * directly. The visual runtime only ever addresses a local filesystem, so that
+ * coincidence is safe today and a protocol version spent on carrying opaque
+ * revisions instead would buy nothing. It is held by a test rather than by a
+ * comment: `visual-protocol.test.ts` asserts the two agree, so a change to
+ * either side fails rather than silently making every commit's precondition
+ * unsatisfiable. That failure is when the protocol bump earns its cost.
  */
 export const digestOf = (source) => createHash('sha256').update(source).digest('hex');
 // Diagnostics report the document they came from rather than a source file,
@@ -81,8 +93,8 @@ const visualValidator = (document, reference = `https://yarramate.org/schema/${d
 };
 const validateVisualModel = visualValidator('visual-model/v1');
 const validateVisualSessionRequest = visualValidator('visual-session-request/v1');
-const validateVisualSessionStarted = visualValidator('visual-session-started/v1');
-const validateVisualSessionDescriptor = visualValidator('visual-session-descriptor/v1');
+const validateVisualSessionStarted = visualValidator('visual-session-started/v2');
+const validateVisualSessionDescriptor = visualValidator('visual-session-descriptor/v2');
 const BROWSER_INPUT_REFERENCE = 'https://yarramate.org/schema/visual-event/v1#/$defs/browserInput';
 const validateVisualBrowserInput = visualValidator('visual-browser-input/v1', BROWSER_INPUT_REFERENCE);
 /**
@@ -101,7 +113,7 @@ const browserInputBranches = new Map(visualEventSchema.$defs.browserInput.oneOf.
 ]));
 const validateVisualEvent = visualValidator('visual-event/v1');
 const validateVisualResponse = visualValidator('visual-response/v1');
-const validateVisualHandoff = visualValidator('visual-handoff/v1');
+const validateVisualHandoff = visualValidator('visual-handoff/v2');
 const validateVisualStatus = visualValidator('visual-status/v1');
 const validateVisualDiagnosticResult = visualValidator('visual-diagnostic-result/v1');
 /**
@@ -151,6 +163,85 @@ const isConfinedRelativePath = (candidate) => {
         .split('/')
         .every((segment) => segment.length > 0 && segment !== '.' && segment !== '..');
 };
+/**
+ * Encode a native absolute path for the wire.
+ *
+ * Every filesystem path a protocol document carries is a canonical local
+ * `file:` URI, minted by Node's own `pathToFileURL`. A URI is invertible
+ * where the forward-slash string transform it replaces was not: a POSIX
+ * directory whose own name contains a literal backslash percent-encodes to
+ * `%5C` and stays distinguishable from a Windows separator, and a UNC path
+ * grows a non-empty host rather than passing as an ordinary POSIX-rooted
+ * path.
+ *
+ * Encoding cannot fail. `pathToFileURL` has no error path for an
+ * already-absolute native string, and every caller holds a `resolve`/`join`
+ * result it produced itself. A relative path reaching here is a programming
+ * error rather than a protocol fault, and throws as one.
+ */
+export const toWireFileUri = (native) => {
+    if (!isAbsolute(native)) {
+        throw new Error(`A visual wire path must be absolute, not "${native}"`);
+    }
+    return pathToFileURL(native).href;
+};
+/**
+ * Decode a wire path back to native, the way untrusted input has to be read.
+ *
+ * A descriptor's bearer capabilities are never spent on a document whose path
+ * fields have not passed this first, so the three refusals are checked in a
+ * fixed order and none of them is ever quietly repaired:
+ *
+ * - `malformed` — not a parseable `file:` URI, or one `fileURLToPath` itself
+ *   rejects (`ERR_INVALID_URL`, `ERR_INVALID_URL_SCHEME`,
+ *   `ERR_INVALID_FILE_URL_PATH`). A bare native path lands here too: it has
+ *   no scheme, or, for a Windows drive root, one that is not `file:`.
+ * - `nonlocal` — a non-empty host, which `pathToFileURL` never produces for a
+ *   local path: `file://server/share/x` names a network share. The host is
+ *   read off the parsed URL rather than inferred from a `fileURLToPath`
+ *   failure, because that call refuses a foreign host on POSIX but resolves
+ *   one to a UNC path on Windows, and reading it directly is the only way one
+ *   URI earns the same refusal on both.
+ * - `noncanonical` — decodes, host is empty, but re-encoding the decoded path
+ *   does not reproduce the input byte-for-byte. Two spellings of one target is
+ *   the aliasing this representation exists to close, so the other spelling is
+ *   refused rather than normalized into the canonical one. `file://localhost/x`
+ *   lands here rather than in `nonlocal`: WHATWG `URL` normalizes a
+ *   `localhost` file host away, leaving a URI that is simply not the spelling
+ *   this codec mints for `/x`.
+ */
+export const fromWireFileUri = (uri) => {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    if (parsed.protocol !== 'file:')
+        return { ok: false, reason: 'malformed' };
+    if (parsed.hostname !== '')
+        return { ok: false, reason: 'nonlocal' };
+    let native;
+    try {
+        native = fileURLToPath(parsed);
+    }
+    catch {
+        return { ok: false, reason: 'malformed' };
+    }
+    let canonical;
+    try {
+        canonical = toWireFileUri(native);
+    }
+    catch {
+        // `fileURLToPath` answering with something this platform does not call
+        // absolute is not a path this runtime can act on, whatever the URI meant.
+        return { ok: false, reason: 'malformed' };
+    }
+    if (canonical !== uri)
+        return { ok: false, reason: 'noncanonical' };
+    return { ok: true, value: native };
+};
 const modelSemantics = (input, path, prefix) => {
     const fields = documentFields(input);
     const diagnostics = [];
@@ -237,7 +328,7 @@ const semanticsByDocument = {
     'visual-browser-input/v1': chatCarryingSemantics,
     'visual-event/v1': chatCarryingSemantics,
     'visual-response/v1': responseSemantics,
-    'visual-handoff/v1': handoffSemantics,
+    'visual-handoff/v2': handoffSemantics,
 };
 const schemaDiagnostics = (errors, code, path) => errors.map((error) => {
     const property = error.keyword === 'additionalProperties'

package/dist/adapters/visual/session-server.d.ts

@@ -1,13 +1,8 @@
 import { type VisualDiagnostic, type VisualEvent, type VisualFreezeReason, type VisualHandoff, type VisualLifecycle, type VisualSessionRequest, type VisualSessionStarted, type VisualStatus, type VisualTerminationReason } from "./protocol.js";
 import { type TerminalEventDependencies, type VisualSessionPaths } from "./session-store.js";
+export { VISUAL_SERVER_DOCUMENT } from "./workspace-model.js";
 import type { VisualRenderedModel, VisualServerFrame, VisualSessionSnapshot, VisualTranscriptRecord } from "./wire.js";
 export type { VisualRenderedModel, VisualServerFrame, VisualSessionSnapshot, VisualTranscriptRecord, };
-/**
- * Document name reported by diagnostics the server itself raises — a refused
- * frame, a frozen queue, or a transport violation that no protocol document
- * owns.
- */
-export declare const VISUAL_SERVER_DOCUMENT = "visual-session-server";
 /**
  * Returned on every response. The policy admits no external origin at all, so
  * neither a compromised model nor a hostile chat message can reach the network,