@agimon-ai/po-session 0.0.0-alpha.37 → 0.0.0-alpha.38

package/README.md

@@ -34,6 +34,14 @@ A paired host is configured privately in `~/.po/session/peers.json`. The file mu
 
 Use `peer/<host-id>/<session-id>` as a qualified target. `allowedSessionIds` grants durable messages and acknowledgements. `allowedVoiceSessionIds` separately grants bounded Voice client-media relay operations. Neither grant exposes owner, `/host/*`, or `/hub/*` routes.
 
+## Host links
+
+`po/session-peers` owns the live peer configuration and atomic private writes. Host identity is stable across tunnel URL changes. The existing version-1 format accepts optional URL generations and revocation tombstones; existing allowlist readers remain compatible.
+
+The sealed API under `/api/plugins/session-peer` exposes `GET /links` and `POST /link/prepare`, `/link/accept`, `/link/unlink`, and `/link/hint`. Prepare, accept, and unlink require a fresh `peer.link` step-up. Quick-tunnel linking requires a native device-key session; named tunnels also accept passkeys. An invite expires after 60 seconds and is consumed once. The app relays public ECDH material, never the derived link secret.
+
+Links begin with empty messaging and Voice allowlists. They do not chain through a third host. Peer delivery is sealed using an authenticated handshake; a URL hint cannot bypass it. Signed rebinds must name the sender itself and advance its URL generation. Unlinking stores a tombstone. Removing a paired device does not remove a host link.
+
 ## Development
 
 ```bash

package/dist/extensions/server.cjs

@@ -2,13 +2,76 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_sessionDelivery = require("../sessionDelivery-BAXrVTum.cjs");
+const require_sessionGroupBridge = require("../sessionGroupBridge-DL3QTIaH.cjs");
 let node_path = require("node:path");
-node_path = require_sessionDelivery.__toESM(node_path, 1);
+node_path = require_sessionGroupBridge.__toESM(node_path, 1);
 let _agimon_ai_po_core_platform = require("@agimon-ai/po-core/platform");
 let _agimon_ai_po_core_piSettings = require("@agimon-ai/po-core/piSettings");
-let _agimon_ai_po_core_serverPlugin = require("@agimon-ai/po-core/serverPlugin");
 let _agimon_ai_po_core_extensionFile = require("@agimon-ai/po-core/extensionFile");
+let _agimon_ai_po_core_serverPlugin = require("@agimon-ai/po-core/serverPlugin");
+let _agimon_ai_po_core_hubChannel = require("@agimon-ai/po-core/hubChannel");
+let _agimon_ai_po_core_remoteOrigin = require("@agimon-ai/po-core/remoteOrigin");
+let _agimon_ai_po_core_packageApi = require("@agimon-ai/po-core/packageApi");
+//#region src/extensions/(backend)/root.server.ts
+var root_server_default$1 = (0, _agimon_ai_po_core_extensionFile.defineRoot)((plugin) => ({
+	value: void 0,
+	services: [async (context) => {
+		await context.inject([
+			_agimon_ai_po_core_platform.PO_FS_SERVICE,
+			_agimon_ai_po_core_platform.PO_SQLITE_SERVICE,
+			_agimon_ai_po_core_serverPlugin.PO_SERVER_SCOPE_SERVICE
+		], async (scoped) => {
+			const homeDirectory = plugin.host.context.homeDirectory;
+			if (!homeDirectory) throw new Error("Host links require an explicit host home directory.");
+			const peers = await require_sessionGroupBridge.createSessionPeers({
+				fs: (0, _agimon_ai_po_core_platform.requirePoFs)(scoped),
+				homeDirectory
+			});
+			await peers.identity();
+			const directory = node_path.default.join((0, _agimon_ai_po_core_piSettings.poHomeDirectory)(homeDirectory), "session");
+			await require_sessionGroupBridge.ensurePrivateDirectory((0, _agimon_ai_po_core_platform.requirePoFs)(scoped), directory, _agimon_ai_po_core_platform.BACKGROUND_CONTEXT);
+			const database = await (0, _agimon_ai_po_core_platform.requirePoSqlite)(scoped).open(node_path.default.join(directory, "groups.sqlite"), _agimon_ai_po_core_platform.BACKGROUND_CONTEXT);
+			const groups = await require_sessionGroupBridge.createSessionGroupStore({ database });
+			await database.run("DELETE FROM session_group_members WHERE group_id IN (SELECT group_id FROM session_groups WHERE owner_authority = 'session-group-bridge')");
+			await database.run("DELETE FROM session_groups WHERE owner_authority = 'session-group-bridge'");
+			const bridge = require_sessionGroupBridge.createSessionGroupBridge({
+				groups,
+				peers,
+				onError: (error) => plugin.host.context.onNotice(`Group bridge failed: ${String(error)}`),
+				send: async (hostId, advert) => {
+					const config = peers.current();
+					const peer = config?.peers.find((entry) => entry.hostId === hostId);
+					if (!config || !peer) return;
+					await require_sessionGroupBridge.authenticatedPeerPost({
+						config,
+						peer,
+						path: "/api/plugins/session-peer/control",
+						value: {
+							type: "groups",
+							groups: advert
+						}
+					});
+				}
+			});
+			const scope = (0, _agimon_ai_po_core_serverPlugin.requirePoServerScope)(scoped);
+			const releasePeers = plugin.host.scope === "global" ? await scope.provide(require_sessionGroupBridge.PO_SESSION_PEERS_CONTRACT, peers) : scoped.provide(require_sessionGroupBridge.PO_SESSION_PEERS_SERVICE, peers);
+			let releaseBridge;
+			try {
+				releaseBridge = plugin.host.scope === "global" ? await scope.provide(require_sessionGroupBridge.PO_SESSION_GROUP_BRIDGE_CONTRACT, bridge) : scoped.provide(require_sessionGroupBridge.PO_SESSION_GROUP_BRIDGE_SERVICE, bridge);
+			} catch (error) {
+				await Promise.resolve(releasePeers());
+				await bridge.close();
+				throw error;
+			}
+			return async () => {
+				await releaseBridge();
+				await Promise.resolve(releasePeers());
+				await bridge.close();
+			};
+		});
+	}]
+}));
+//#endregion
 //#region src/services/peerInbox/index.ts
 const inboxes = /* @__PURE__ */ new Map();
 /**
@@ -30,98 +93,145 @@ async function deliverSessionPeerEnvelope(targetSessionId, sourceKey, type, payl
 //#region src/extensions/workspaces/sessions/(backend)/root.server.ts
 var root_server_default = (0, _agimon_ai_po_core_extensionFile.defineRoot)((pluginContext) => ({
 	value: void 0,
-	services: [require_sessionDelivery.provideBackgroundWorkService, async (context) => {
-		const agent = pluginContext.agent;
-		const session = agent?.context.session;
-		const communication = pluginContext.host.context.sessionCommunication;
-		const homeDirectory = pluginContext.host.context.homeDirectory;
-		const sessionService = pluginContext.host.context.sessionService;
-		if (!agent || !session?.admitPrompt || !communication || !homeDirectory || !sessionService?.canCommunicate) throw new Error("Session delivery requires the headless agent, authenticated session communication, host home directory, and communication policy.");
-		const fs = (0, _agimon_ai_po_core_platform.requirePoFs)(pluginContext.context);
-		const sqlite = (0, _agimon_ai_po_core_platform.requirePoSqlite)(pluginContext.context);
-		const io = _agimon_ai_po_core_platform.BACKGROUND_CONTEXT;
-		const sessionDirectory = node_path.default.join((0, _agimon_ai_po_core_piSettings.poHomeDirectory)(homeDirectory), "session");
-		const deliveryDirectory = node_path.default.join(sessionDirectory, "delivery");
-		await require_sessionDelivery.ensurePrivateDirectory(fs, deliveryDirectory, io);
-		const peerConfig = await require_sessionDelivery.readSessionPeerConfigAsync(fs, homeDirectory, io);
-		const peerCommunication = require_sessionDelivery.createPeerCommunication({
-			local: communication,
-			config: peerConfig
-		});
-		const remotePeerIsGranted = (peerKey) => {
-			const peer = require_sessionDelivery.parseRemoteSessionReference(peerKey);
-			return peer !== void 0 && peerConfig?.peers.some((candidate) => candidate.hostId === peer.hostId && candidate.allowedSessionIds.includes(agent.context.sessionId)) === true;
-		};
-		const fallbackAuthorization = (peerKey) => sessionService.canCommunicate?.(agent.context.sessionId, peerKey) === true || remotePeerIsGranted(peerKey);
-		const groups = peerConfig ? await require_sessionDelivery.createSessionGroupStore({ database: await sqlite.open(node_path.default.join(sessionDirectory, "groups.sqlite"), io) }) : void 0;
-		const localHostId = peerConfig?.hostId;
-		const selfReference = localHostId ? require_sessionDelivery.peerSessionReference(localHostId, agent.context.sessionId) : void 0;
-		const groupAuthorization = groups && selfReference && localHostId ? require_sessionDelivery.createSessionGroupDeliveryAuthorizer({
-			selfReference,
-			groups,
-			peerReference: (peerKey) => require_sessionDelivery.parseRemoteSessionReference(peerKey) === void 0 ? require_sessionDelivery.peerSessionReference(localHostId, peerKey) : peerKey,
-			fallback: fallbackAuthorization
-		}) : void 0;
-		let delivery;
-		try {
-			delivery = await require_sessionDelivery.provideSessionDeliveryService(context, {
-				database: await sqlite.open(node_path.default.join(deliveryDirectory, `${agent.context.sessionId}.sqlite`), io),
-				recipientKey: agent.context.sessionId,
-				communication: peerCommunication,
-				authorizePeer: (peerKey, metadata) => groupAuthorization ? groupAuthorization(peerKey, metadata) : fallbackAuthorization(peerKey),
-				admitPrompt: (prompt, admission, requestId, metadata) => {
-					if (!metadata.customType) return session.admitPrompt(prompt, admission, void 0, requestId);
-					if (!session.admitMessage) throw new Error("The session cannot admit a custom delivery.");
-					return session.admitMessage({
-						type: metadata.customType,
-						text: prompt,
-						display: true,
-						details: metadata.customDetails === void 0 ? void 0 : JSON.parse(metadata.customDetails)
-					}, admission === "steer" ? "steer" : "followUp", requestId);
-				}
-			});
-		} catch (error) {
-			await groups?.close();
-			throw error;
-		}
-		const { service, close: closeDelivery } = delivery;
-		const unprovide = [];
-		if (groups && selfReference && peerConfig) {
-			const directory = require_sessionDelivery.createSessionDirectory({ authorizeDiscovery: async (caller, subject) => {
-				const reference = require_sessionDelivery.peerSessionReference(subject.hostId, subject.sessionId);
-				return (await groups.groupsFor(caller)).some((group) => group.members.includes(reference)) ? { capabilities: ["message"] } : void 0;
-			} });
-			for (const peer of peerConfig.peers) for (const sessionId of peer.allowedSessionIds) directory.observe({
-				hostId: peer.hostId,
-				sessionId,
-				hostIncarnation: "unknown",
-				sessionIncarnation: "unknown",
-				sequence: 0,
-				observedAt: 0,
-				staleAfterMs: 0,
-				deliveryTarget: require_sessionDelivery.peerSessionReference(peer.hostId, sessionId),
-				reachability: "unknown",
-				runtime: "unknown",
-				activity: "unknown",
-				voice: {
-					eligible: "unknown",
-					readiness: "unknown"
-				}
+	services: [require_sessionGroupBridge.provideBackgroundWorkService, (owner) => {
+		owner.inject([
+			require_sessionGroupBridge.PO_SESSION_PEERS_SERVICE,
+			require_sessionGroupBridge.PO_SESSION_GROUP_BRIDGE_SERVICE,
+			_agimon_ai_po_core_platform.PO_FS_SERVICE,
+			_agimon_ai_po_core_platform.PO_SQLITE_SERVICE
+		], async (context) => {
+			const agent = pluginContext.agent;
+			const session = agent?.context.session;
+			const communication = pluginContext.host.context.sessionCommunication;
+			const homeDirectory = pluginContext.host.context.homeDirectory;
+			const sessionService = pluginContext.host.context.sessionService;
+			if (!agent || !session?.admitPrompt || !communication || !homeDirectory || !sessionService?.canCommunicate) throw new Error("Session delivery requires the headless agent, authenticated session communication, host home directory, and communication policy.");
+			const fs = (0, _agimon_ai_po_core_platform.requirePoFs)(context);
+			const sqlite = (0, _agimon_ai_po_core_platform.requirePoSqlite)(context);
+			const io = _agimon_ai_po_core_platform.BACKGROUND_CONTEXT;
+			const sessionDirectory = node_path.default.join((0, _agimon_ai_po_core_piSettings.poHomeDirectory)(homeDirectory), "session");
+			const deliveryDirectory = node_path.default.join(sessionDirectory, "delivery");
+			await require_sessionGroupBridge.ensurePrivateDirectory(fs, deliveryDirectory, io);
+			const peers = require_sessionGroupBridge.requireSessionPeers(context);
+			const peerConfig = peers.current();
+			const peerCommunication = require_sessionGroupBridge.createPeerCommunication({
+				local: communication,
+				config: () => peers.current(),
+				canPublish: (target, type, payload) => {
+					if (type === "po/session-delivery/ack") return true;
+					const metadata = payload?.metadata;
+					return bridge?.peersFor(agent.context.sessionId).some((peer) => peer.sessionId === target && peer.sharedGroups.some((name) => require_sessionGroupBridge.namedSessionGroupId(name) === metadata?.groupId)) === true;
+				},
+				onError: (error) => pluginContext.host.context.onNotice(`Peer delivery failed: ${String(error)}`)
 			});
-			unprovide.push(context.provide(require_sessionDelivery.PO_SESSION_INTERCOM_SERVICE, require_sessionDelivery.createSessionIntercom({
+			const remotePeerIsGranted = (peerKey) => {
+				const peer = require_sessionGroupBridge.parseRemoteSessionReference(peerKey);
+				return peer !== void 0 && peers.current()?.peers.some((candidate) => candidate.hostId === peer.hostId && candidate.allowedSessionIds.includes(agent.context.sessionId)) === true;
+			};
+			const fallbackAuthorization = (peerKey) => sessionService.canCommunicate?.(agent.context.sessionId, peerKey) === true || remotePeerIsGranted(peerKey);
+			const bridge = require_sessionGroupBridge.readSessionGroupBridge(context);
+			const groups = bridge?.groups;
+			await bridge?.updateLocal(agent.context.sessionId, communication.sessionName ?? agent.context.sessionId, communication.groups ?? []);
+			const localHostId = peerConfig?.hostId;
+			const selfReference = localHostId ? require_sessionGroupBridge.peerSessionReference(localHostId, agent.context.sessionId) : void 0;
+			const groupAuthorization = groups && selfReference && localHostId ? require_sessionGroupBridge.createSessionGroupDeliveryAuthorizer({
 				selfReference,
-				directory,
 				groups,
-				delivery: service
-			})));
-		}
-		const unregister = registerSessionPeerInbox(agent.context.sessionId, (sourceKey, kind, payload) => service.receive?.(sourceKey, kind, payload));
-		return async () => {
-			unregister();
-			for (const release of unprovide.reverse()) release();
-			await closeDelivery();
-			await groups?.close();
-		};
+				peerReference: (peerKey) => require_sessionGroupBridge.parseRemoteSessionReference(peerKey) === void 0 ? require_sessionGroupBridge.peerSessionReference(localHostId, peerKey) : peerKey,
+				fallback: fallbackAuthorization
+			}) : void 0;
+			let delivery;
+			try {
+				delivery = await require_sessionGroupBridge.provideSessionDeliveryService(context, {
+					database: await sqlite.open(node_path.default.join(deliveryDirectory, `${agent.context.sessionId}.sqlite`), io),
+					recipientKey: agent.context.sessionId,
+					communication: peerCommunication,
+					authorizePeer: (peerKey, metadata) => {
+						const remote = require_sessionGroupBridge.parseRemoteSessionReference(peerKey);
+						if (remote && !peers.current()?.peers.some((peer) => peer.hostId === remote.hostId)) return false;
+						if (remote) {
+							if (!bridge?.metadataFor(agent.context.sessionId, peerKey) || !metadata?.groupId || !bridge?.peersFor(agent.context.sessionId).find((peer) => peer.sessionId === peerKey)?.sharedGroups.some((name) => require_sessionGroupBridge.namedSessionGroupId(name) === metadata.groupId)) return false;
+							return groupAuthorization ? groupAuthorization(peerKey, metadata) : false;
+						}
+						return groupAuthorization ? groupAuthorization(peerKey, metadata) : fallbackAuthorization(peerKey);
+					},
+					admitPrompt: async (prompt, admission, requestId, metadata) => {
+						if (!metadata.customType) {
+							await session.admitPrompt(prompt, admission, void 0, requestId);
+							return;
+						}
+						if (!session.admitMessage) throw new Error("The session cannot admit a custom delivery.");
+						await session.admitMessage({
+							type: metadata.customType,
+							text: prompt,
+							display: true,
+							details: metadata.customDetails === void 0 ? void 0 : JSON.parse(metadata.customDetails)
+						}, admission === "steer" ? "steer" : "followUp", requestId);
+					}
+				});
+			} catch (error) {
+				await bridge?.removeLocal(agent.context.sessionId);
+				throw error;
+			}
+			const { service, close: closeDelivery } = delivery;
+			const unprovide = [];
+			if (groups && selfReference && peerConfig) {
+				const directory = require_sessionGroupBridge.createSessionDirectory({ authorizeDiscovery: (_caller, subject) => {
+					const reference = require_sessionGroupBridge.peerSessionReference(subject.hostId, subject.sessionId);
+					return bridge?.peersFor(agent.context.sessionId).some((peer) => peer.sessionId === reference) ? { capabilities: ["message"] } : void 0;
+				} });
+				const observedHosts = /* @__PURE__ */ new Set();
+				let sequence = 0;
+				const observeRemote = () => {
+					const remotePeers = bridge?.peersFor(agent.context.sessionId) ?? [];
+					for (const peer of remotePeers) observedHosts.add(require_sessionGroupBridge.parseRemoteSessionReference(peer.sessionId).hostId);
+					sequence += 1;
+					for (const hostId of observedHosts) directory.replaceHostSnapshot(hostId, "linked", remotePeers.flatMap((peer) => {
+						const remote = require_sessionGroupBridge.parseRemoteSessionReference(peer.sessionId);
+						return remote.hostId !== hostId ? [] : [{
+							hostId,
+							sessionId: remote.sessionId,
+							label: peer.name,
+							hostIncarnation: "linked",
+							sessionIncarnation: "live",
+							sequence,
+							observedAt: Date.now(),
+							staleAfterMs: 12e4,
+							deliveryTarget: peer.sessionId,
+							reachability: "unknown",
+							runtime: "unknown",
+							activity: "unknown",
+							voice: {
+								eligible: "unknown",
+								readiness: "unknown"
+							}
+						}];
+					}));
+				};
+				observeRemote();
+				unprovide.push(bridge.subscribe(() => {
+					observeRemote();
+					service.reauthorize?.().catch((error) => pluginContext.host.context.onNotice(`Delivery reauthorization failed: ${String(error)}`));
+				}));
+				unprovide.push(context.provide(require_sessionGroupBridge.PO_SESSION_INTERCOM_SERVICE, require_sessionGroupBridge.createSessionIntercom({
+					selfReference,
+					directory,
+					groups,
+					delivery: service
+				})));
+			}
+			const releaseGroups = pluginContext.host.context.directEvents?.subscribe(_agimon_ai_po_core_hubChannel.PO_SESSION_ATTENTION_EVENT, agent.context.sessionId, () => {
+				bridge?.updateLocal(agent.context.sessionId, communication.sessionName ?? agent.context.sessionId, communication.groups ?? []).catch((error) => pluginContext.host.context.onNotice(`Group update failed: ${String(error)}`));
+			});
+			const unregister = registerSessionPeerInbox(agent.context.sessionId, (sourceKey, kind, payload) => service.receive?.(sourceKey, kind, payload));
+			return async () => {
+				unregister();
+				releaseGroups?.();
+				await bridge?.removeLocal(agent.context.sessionId);
+				for (const release of unprovide.reverse()) release();
+				await closeDelivery();
+			};
+		});
 	}]
 }));
 //#endregion
@@ -138,32 +248,108 @@ function createPeerInboxApi(platform) {
 		start(context) {
 			const homeDirectory = context.homeDirectory;
 			let opened;
+			const channels = require_sessionGroupBridge.createSealedPeerChannels();
+			let link;
+			let announcing = false;
+			const announce = () => {
+				if (!link || announcing) return;
+				announcing = true;
+				link.announce().catch((error) => context.onNotice(`Peer URL announcement failed: ${String(error)}`)).finally(() => {
+					announcing = false;
+				});
+			};
+			const timer = platform.peers && platform.origin ? setInterval(() => {
+				open().then(announce).catch((error) => context.onNotice(`Host links could not start: ${String(error)}`));
+			}, 1e3) : void 0;
+			timer?.unref?.();
 			const open = () => opened ??= (async () => {
 				if (homeDirectory === void 0) return {
 					config: void 0,
 					replay: void 0
 				};
-				const config = await require_sessionDelivery.readSessionPeerConfigAsync(platform.fs, homeDirectory, _agimon_ai_po_core_platform.BACKGROUND_CONTEXT);
-				const file = node_path.default.join(node_path.default.dirname(require_sessionDelivery.sessionPeerConfigPath(homeDirectory)), require_sessionDelivery.PEER_REPLAY_DATABASE_FILE);
-				await require_sessionDelivery.ensurePrivateDirectory(platform.fs, node_path.default.dirname(file), _agimon_ai_po_core_platform.BACKGROUND_CONTEXT);
+				const config = platform.peers ? platform.peers.current() : await require_sessionGroupBridge.readSessionPeerConfigAsync(platform.fs, homeDirectory, _agimon_ai_po_core_platform.BACKGROUND_CONTEXT);
+				const file = node_path.default.join(node_path.default.dirname(require_sessionGroupBridge.sessionPeerConfigPath(homeDirectory)), require_sessionGroupBridge.PEER_REPLAY_DATABASE_FILE);
+				await require_sessionGroupBridge.ensurePrivateDirectory(platform.fs, node_path.default.dirname(file), _agimon_ai_po_core_platform.BACKGROUND_CONTEXT);
+				const replay = await require_sessionGroupBridge.createPeerReplayGuardAsync(await platform.sqlite.open(file, _agimon_ai_po_core_platform.BACKGROUND_CONTEXT));
+				if (platform.peers) link = require_sessionGroupBridge.createPeerLink({
+					peers: platform.peers,
+					groups: platform.groups,
+					replay,
+					channels,
+					origin: platform.origin ?? (() => void 0),
+					fetch: platform.fetch
+				});
+				announce();
 				return {
 					config,
-					replay: await require_sessionDelivery.createPeerReplayGuardAsync(await platform.sqlite.open(file, _agimon_ai_po_core_platform.BACKGROUND_CONTEXT))
+					replay
 				};
 			})().catch((error) => {
 				opened = void 0;
 				throw error;
 			});
+			if (platform.peers) open().catch((error) => context.onNotice(`Host links could not start: ${String(error)}`));
 			return {
 				async fetch(request) {
-					if (request.method !== "POST" || new URL(request.url).pathname !== "/inbox") return response(404, "Not found.");
-					const { config, replay } = await open();
-					if (!config) return response(503, "Paired Session delivery is not configured.");
+					const pathname = new URL(request.url).pathname;
+					const openedState = await open();
+					const config = platform.peers ? platform.peers.current() : openedState.config;
+					const replay = openedState.replay;
+					if (request.method === "GET" && pathname === "/links" && platform.peers) {
+						if (!(0, _agimon_ai_po_core_packageApi.poApiCallerFrom)(request.headers)) return response(403, "An authenticated caller is required.");
+						return Response.json({
+							hostId: config?.hostId,
+							peers: config?.peers.map(({ hostId, url, urlGeneration }) => ({
+								hostId,
+								url,
+								urlGeneration
+							})) ?? []
+						});
+					}
+					if (request.method !== "POST" || ![
+						"/inbox",
+						"/control",
+						"/link/prepare",
+						"/link/accept",
+						"/link/unlink",
+						"/link/hint"
+					].includes(pathname)) return response(404, "Not found.");
 					const length = request.headers.get("content-length");
 					if (length !== null && (!/^\d+$/u.test(length) || Number(length) > MAX_BODY_BYTES)) return response(413, "Request body is too large.");
 					const body = await request.text();
 					if (Buffer.byteLength(body) > MAX_BODY_BYTES) return response(413, "Request body is too large.");
-					const peer = require_sessionDelivery.verifyPeerRequest(config, request, body);
+					if (pathname.startsWith("/link/")) {
+						const caller = (0, _agimon_ai_po_core_packageApi.poApiCallerFrom)(request.headers);
+						if (!caller || caller.locality === "remote" && pathname !== "/link/hint" && caller.stepUp !== "verified") return response(403, "Linking hosts needs a fresh peer.link step-up.");
+						if (!link) return response(503, "Host links are unavailable.");
+						try {
+							const input = body === "" ? {} : JSON.parse(body);
+							if (pathname === "/link/prepare") return Response.json(await link.prepare());
+							if (pathname === "/link/accept") {
+								await link.accept(input.invite);
+								return Response.json({ linked: true });
+							}
+							if (typeof input.hostId !== "string") return response(400, "A host identity is required.");
+							if (pathname === "/link/unlink") {
+								await link.unlink(input.hostId);
+								return Response.json({ unlinked: true });
+							}
+							if (typeof input.url !== "string") return response(400, "A URL hint is required.");
+							return Response.json({ rebound: await link.hint(input.hostId, input.url) });
+						} catch (error) {
+							return response(400, error instanceof Error ? error.message : "Host link failed.");
+						}
+					}
+					if (pathname === "/control") {
+						if (!link) return response(503, "Host links are unavailable.");
+						try {
+							return await link.control(request, body);
+						} catch (error) {
+							return response(400, error instanceof Error ? error.message : "Invalid peer control.");
+						}
+					}
+					if (!config) return response(503, "Paired Session delivery is not configured.");
+					const peer = require_sessionGroupBridge.verifyPeerRequest(config, request, body);
 					if (!peer) return response(401, "Paired Session request is unauthorized.");
 					if (!await replay?.admit(request)) return response(409, "Paired Session request was already received.");
 					let parsed;
@@ -172,17 +358,41 @@ function createPeerInboxApi(platform) {
 					} catch {
 						return response(400, "Paired Session request is malformed.");
 					}
-					const envelope = require_sessionDelivery.parseSessionPeerEnvelope(parsed);
+					let peerChannel;
+					if (peer.linkGeneration) {
+						const sealed = parsed;
+						peerChannel = typeof sealed?.epochId === "string" ? channels.take(peer, sealed.epochId) : void 0;
+						const opened = peerChannel?.open(sealed?.envelope);
+						if (!opened?.ok) return response(401, "A fresh sealed peer channel is required.");
+						try {
+							parsed = JSON.parse(Buffer.from(opened.plaintext).toString("utf8"));
+						} catch {
+							return response(400, "Invalid sealed peer envelope.");
+						}
+					}
+					const envelope = require_sessionGroupBridge.parseSessionPeerEnvelope(parsed);
 					if (!envelope || !DELIVERY_TYPES.has(envelope.type)) return response(400, "Paired Session envelope is invalid.");
-					if (!peer.allowedSessionIds.includes(envelope.targetSessionId)) return response(403, "Peer is not granted this session.");
-					const state = await deliverSessionPeerEnvelope(envelope.targetSessionId, require_sessionDelivery.peerSessionReference(peer.hostId, envelope.sourceSessionId), envelope.type, envelope.payload);
+					if (!peer.linkGeneration && !peer.allowedSessionIds.includes(envelope.targetSessionId)) return response(403, "Peer is not granted this session.");
+					const state = await deliverSessionPeerEnvelope(envelope.targetSessionId, require_sessionGroupBridge.peerSessionReference(peer.hostId, envelope.sourceSessionId), envelope.type, envelope.payload);
+					if (state !== void 0 && peerChannel) {
+						const sealed = peerChannel.seal(Buffer.from(JSON.stringify({
+							accepted: true,
+							state
+						})));
+						if (!sealed.ok) return response(503, "Peer acknowledgement could not be sealed.");
+						const text = JSON.stringify(sealed.envelope);
+						return new Response(text, { headers: require_sessionGroupBridge.peerRequestHeaders(config.hostId, peer, "RESPONSE", "/inbox", text) });
+					}
 					return state === void 0 ? response(404, "Target Session is unavailable.") : Response.json({
 						accepted: true,
 						state
 					}, { status: 202 });
 				},
 				async close() {
-					await (await opened?.catch(() => void 0))?.replay?.close();
+					if (timer) clearInterval(timer);
+					const state = await opened?.catch(() => void 0);
+					link?.close();
+					await state?.replay?.close();
 				}
 			};
 		}
@@ -190,33 +400,79 @@ function createPeerInboxApi(platform) {
 }
 //#endregion
 //#region src/extensions/(backend)/api/session-peer/route.server.ts
-var route_server_default = (0, _agimon_ai_po_core_extensionFile.defineRoute)(({ context }) => createPeerInboxApi({
-	fs: (0, _agimon_ai_po_core_platform.requirePoFs)(context),
-	sqlite: (0, _agimon_ai_po_core_platform.requirePoSqlite)(context)
-}));
+var route_server_default = (0, _agimon_ai_po_core_extensionFile.defineRoute)(({ context }) => {
+	let origin;
+	context.inject([_agimon_ai_po_core_remoteOrigin.PO_REMOTE_ORIGIN_SERVICE], (scoped) => {
+		origin = scoped.get(_agimon_ai_po_core_remoteOrigin.PO_REMOTE_ORIGIN_SERVICE);
+		return () => {
+			origin = void 0;
+		};
+	});
+	const hasOrigin = origin !== void 0;
+	return createPeerInboxApi({
+		fs: (0, _agimon_ai_po_core_platform.requirePoFs)(context),
+		sqlite: (0, _agimon_ai_po_core_platform.requirePoSqlite)(context),
+		peers: require_sessionGroupBridge.requireSessionPeers(context),
+		groups: () => require_sessionGroupBridge.readSessionGroupBridge(context),
+		...hasOrigin ? { origin: () => origin?.current() } : {}
+	});
+});
 //#endregion
 //#region generated/server.ts
 const at = (value, context) => typeof value === "function" ? value(context) : value;
+/* v8 ignore next -- generated normalization branch */
+const defined = (values) => values.filter((value) => value !== void 0);
 const serverPlugin = (0, _agimon_ai_po_core_serverPlugin.defineServerPlugin)({
 	name: "@agimon-ai/po-session",
-	providerOverrides: (0, _agimon_ai_po_core_serverPlugin.composeServerProviderOverrides)(root_server_default),
-	injects: (0, _agimon_ai_po_core_extensionFile.composeRootInjects)({ session: [root_server_default] }),
-	global: (context) => ({ get api() {
-		return [at(route_server_default, context)];
-	} }),
-	workspace: (context) => ({ get api() {
-		return [at(route_server_default, context)];
-	} }),
+	providerOverrides: (0, _agimon_ai_po_core_serverPlugin.composeServerProviderOverrides)(root_server_default$1, root_server_default),
+	injects: (0, _agimon_ai_po_core_extensionFile.composeRootInjects)({
+		global: [root_server_default$1],
+		workspace: [root_server_default$1],
+		session: [root_server_default$1, root_server_default]
+	}),
+	global: async (context) => {
+		const scopeGlobal = await context.scopeRoot("global", root_server_default$1, context);
+		const contextGlobal = {
+			...context,
+			root: scopeGlobal.value
+		};
+		return {
+			...(0, _agimon_ai_po_core_extensionFile.composeRootHooks)(scopeGlobal),
+			get api() {
+				return [at(route_server_default, contextGlobal)];
+			},
+			services: [...scopeGlobal.services ?? []]
+		};
+	},
+	workspace: async (context) => {
+		const scopeGlobal = await context.scopeRoot("global", root_server_default$1, context);
+		const contextGlobal = {
+			...context,
+			root: scopeGlobal.value
+		};
+		return {
+			...(0, _agimon_ai_po_core_extensionFile.composeRootHooks)(scopeGlobal),
+			get api() {
+				return defined([context.hosted("global") ? void 0 : at(route_server_default, contextGlobal)]);
+			},
+			services: [...scopeGlobal.services ?? []]
+		};
+	},
 	session: async (context) => {
-		const scopeSession = await context.scopeRoot("session", root_server_default, context);
+		const scopeGlobal = await context.scopeRoot("global", root_server_default$1, context);
+		const contextGlobal = {
+			...context,
+			root: scopeGlobal.value
+		};
+		const scopeSession = await context.scopeRoot("session", root_server_default, contextGlobal);
 		return {
-			...(0, _agimon_ai_po_core_extensionFile.composeRootHooks)(scopeSession),
+			...(0, _agimon_ai_po_core_extensionFile.composeRootHooks)(scopeGlobal, scopeSession),
 			get api() {
-				return [at(route_server_default, context)];
+				return defined([context.hosted("global") ? void 0 : at(route_server_default, contextGlobal)]);
 			},
-			services: [...scopeSession.services ?? []],
+			services: [...scopeGlobal.services ?? [], ...scopeSession.services ?? []],
 			get activities() {
-				return [...scopeSession.activities ?? []];
+				return [...scopeGlobal.activities ?? [], ...scopeSession.activities ?? []];
 			}
 		};
 	}