build: admit pure message projection leaves in browser bundles

packages/client/connection/package.json

@@ -36,8 +36,7 @@
   "dependencies": {
     "@deepseek-ai/dsh-credentials": "workspace:^",
     "@deepseek-ai/schemastery": "workspace:^",
-    "zod": "^4.4.3",
-    "@deepseek-ai/dsh-session-format-catalog": "workspace:^"
+    "zod": "^4.4.3"
   },
   "files": [
     "lib/index.js",
@@ -57,6 +56,7 @@
     "@deepseek-ai/dsh-host-webserver": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",
     "@deepseek-ai/dsh-session": "workspace:^",
+    "@deepseek-ai/dsh-session-format-catalog": "workspace:^",
     "@deepseek-ai/dsh-settings": "workspace:^",
     "@deepseek-ai/dsh-tool-todo": "workspace:^",
     "@deepseek-ai/dsh-util-values": "workspace:^"

packages/client/tsdown.client.ts

@@ -58,7 +58,7 @@ function styleInjectionModule(
  * Everything else under @deepseek-ai/* is either a module-table entry
  * (external) or a leak the purity gate rejects.
  */
-export const INLINE_SAFE = /^(?:@deepseek-ai\/dsh-(?:file-reference|session|llm|tools|brand|deque|output-retention|typert-protocol|util-crypto|util-values|util-workspace-path)(?:\/|$)|@deepseek-ai\/dsh-token-meter\/client$|@deepseek-ai\/dsh-host-open-in-app\/shared$|@deepseek-ai\/dsh-agent-presets\/display$|@deepseek-ai\/dsh-spill-policy\/notice$)/
+export const INLINE_SAFE = /^(?:@deepseek-ai\/dsh-(?:file-reference|session|llm|tools|brand|deque|output-retention|typert-protocol|util-crypto|util-values|util-workspace-path)(?:\/|$)|@deepseek-ai\/dsh-token-meter\/client$|@deepseek-ai\/dsh-host-open-in-app\/shared$|@deepseek-ai\/dsh-agent-presets\/display$|@deepseek-ai\/dsh-spill-policy\/notice$|@deepseek-ai\/dsh-session-format-catalog\/message-projections$|@deepseek-ai\/dsh-compaction-image-offload\/projection$)/
 
 /**
  * Vendored framework libraries: rescoped into @deepseek-ai, so the gate below

packages/compaction/compaction-image-offload/package.json

@@ -26,8 +26,8 @@
   },
   "files": [
     "lib/index.js",
-    "lib/types/**/*.d.ts",
-    "lib/types/**/*.js"
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {

packages/session/session-format-catalog/package.json

@@ -27,8 +27,8 @@
   },
   "files": [
     "lib/index.js",
-    "lib/types/**/*.d.ts",
-    "lib/types/**/*.js"
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "dependencies": {

pnpm-lock.yaml

@@ -2016,9 +2016,6 @@ importers:
       '@deepseek-ai/dsh-credentials':
         specifier: workspace:^
         version: link:../../credentials/credentials
-      '@deepseek-ai/dsh-session-format-catalog':
-        specifier: workspace:^
-        version: link:../../session/session-format-catalog
       '@deepseek-ai/schemastery':
         specifier: link:../../../vendor/schemastery
         version: link:../../../vendor/schemastery
@@ -2053,6 +2050,9 @@ importers:
       '@deepseek-ai/dsh-session':
         specifier: workspace:^
         version: link:../../core/session
+      '@deepseek-ai/dsh-session-format-catalog':
+        specifier: workspace:^
+        version: link:../../session/session-format-catalog
       '@deepseek-ai/dsh-settings':
         specifier: workspace:^
         version: link:../../settings/settings

scripts/client-bundle-purity.spec.ts

@@ -110,6 +110,15 @@ describe('client bundle purity gate', () => {
     expect(() => resolveId('@deepseek-ai/dsh-spill-policy/notice/internal')).toThrow(/purity/)
   })
 
+  it('admits only pure message projection entries, not recovery plugins or format codecs', () => {
+    expect(resolveId('@deepseek-ai/dsh-session-format-catalog/message-projections')).toBeNull()
+    expect(resolveId('@deepseek-ai/dsh-compaction-image-offload/projection')).toBeNull()
+    expect(() => resolveId('@deepseek-ai/dsh-session-format-catalog')).toThrow(/purity/)
+    expect(() => resolveId('@deepseek-ai/dsh-compaction-image-offload')).toThrow(/purity/)
+    expect(() => resolveId('@deepseek-ai/dsh-session-format-catalog/message-projections/internal')).toThrow(/purity/)
+    expect(() => resolveId('@deepseek-ai/dsh-compaction-image-offload/projection/internal')).toThrow(/purity/)
+  })
+
   it('lets exact generated Remote contributions inline without admitting their package implementation', () => {
     expect(resolveId('@deepseek-ai/dsh-goal/remote')).toBeNull()
     expect(() => resolveId('@deepseek-ai/dsh-goal')).toThrow(/purity/)