feat(api-remotes): enforce the forwardable shape and resolve the invariant companion

The allowlist's satisfies assertion is active again, so a name that is not a
declared event, binds a Scope, or is not one-way fails at the allowlist rather
than on the wire; the owner packages' ./types imports are what give it a real
event vocabulary to judge. The companion's own paths entry lets its test resolve
it from source instead of a built artifact, matching the api-gateway entry.

packages/api/remotes/src/index.ts

@@ -1,15 +1,15 @@
 /** Host BFF entry and Loader shell for the Remote contribution assembly. */
 
-// import type { TypeRTForwardableEvent } from '@deepseek-ai/dsh-type-meta'
-// import { API_REMOTE_FORWARDED_EVENTS } from './types.ts'
+import type { TypeRTForwardableEvent } from '@deepseek-ai/dsh-type-meta'
+import { API_REMOTE_FORWARDED_EVENTS } from './types.ts'
 
-// // The owner packages' client-safe `./types` exports carry the cordis `Events`
-// // declarations for every allowlisted event. Pulling them into this face is what
-// // makes the shape assertion below judge real signatures rather than an empty
-// // event vocabulary.
-// import type {} from '@deepseek-ai/dsh-commands/types'
-// import type {} from '@deepseek-ai/dsh-credentials/types'
-// import type {} from '@deepseek-ai/dsh-settings/types'
+// The owner packages' client-safe `./types` exports carry the cordis `Events`
+// declarations for every allowlisted event. Pulling them into this face is what
+// makes the shape assertion below judge real signatures rather than an empty
+// event vocabulary.
+import type {} from '@deepseek-ai/dsh-commands/types'
+import type {} from '@deepseek-ai/dsh-credentials/types'
+import type {} from '@deepseek-ai/dsh-settings/types'
 
 export {
   ApiRemoteSessionNotFound,
@@ -35,7 +35,7 @@ export type { ApiRemoteForwardedEvent } from './types.ts'
 // and every entry is ONE-WAY (a waterfall or bail shape returns something other
 // than void and is excluded). Widening the array to an event that fails any of
 // these fails here, not on the wire.
-// API_REMOTE_FORWARDED_EVENTS satisfies readonly TypeRTForwardableEvent[]
+API_REMOTE_FORWARDED_EVENTS satisfies readonly TypeRTForwardableEvent[]
 
 /** Host plugin body; the selected contributions mount only in Client environments. */
 export function apply(): void {}

tsconfig.base.json

@@ -77,6 +77,7 @@
       "@deepseek-ai/dsh-credentials/types": ["./packages/credentials/credentials/src/types.ts"],
       "@deepseek-ai/dsh-settings/types": ["./packages/settings/settings/src/types.ts"],
       "@deepseek-ai/dsh-api-remotes/types": ["./packages/api/remotes/src/types.ts"],
+      "@deepseek-ai/dsh-api-remotes/invariant": ["./packages/api/remotes/src/invariant.ts"],
       "@deepseek-ai/dsh-compact/checkpoint": ["./packages/compact/compact/src/checkpoint.ts"],
       "@deepseek-ai/dsh-compact/types": ["./packages/compact/compact/src/types.ts"],
       "@deepseek-ai/dsh-tools/presentation": ["./packages/core/tools/src/presentation.ts"],