@ai-ecoverse/slicc-agent 3.52.1 → 4.0.0

package/dist/secrets/fetch.js

@@ -0,0 +1,160 @@
+import { VaultRefusal } from "./vault.js";
+const BODYLESS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const MIN_PART = 8;
+function absent(vault) {
+  return !vault.connected && !vault.needed;
+}
+async function outgoing(request) {
+  const body = BODYLESS.has(request.method) ? void 0 : new Uint8Array(await request.arrayBuffer());
+  return {
+    method: request.method,
+    url: request.url,
+    headers: [...request.headers],
+    ...body ? { body } : {}
+  };
+}
+function refusal(error) {
+  const code = error instanceof VaultRefusal ? error.code : void 0;
+  const status = code === "EACCES" ? 403 : code === "EINVAL" ? 400 : 503;
+  const text = error instanceof Error ? error.message : String(error);
+  return new Response(text, {
+    status,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+async function prepared(op, request) {
+  try {
+    return await op.prepare(request);
+  } catch (error) {
+    if (error instanceof VaultRefusal && error.code === "EAGAIN") return op.prepare(request);
+    throw error;
+  }
+}
+function filled(original, ready) {
+  const sent2 = new Set(original.headers.map(([, value]) => value));
+  const values = ready.headers.map(([, value]) => value).filter((value) => !sent2.has(value));
+  if (ready.url !== original.url) values.push(ready.url, decodeURIComponent(ready.url));
+  return values.flatMap((value) => [
+    value,
+    ...value.split(/[\s=&?]+/).filter((part) => part.length >= MIN_PART)
+  ]);
+}
+function safeError(error, original, ready) {
+  if (error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError"))
+    return error;
+  const text = error instanceof Error ? error.message : String(error);
+  const parts = filled(original, ready);
+  const shown = parts.some((part) => text.includes(part)) ? "the request failed" : text;
+  return new TypeError(`${ready.method} ${new URL(ready.url).origin}: ${shown}`);
+}
+async function sent(inner, request, original, ready) {
+  const init = {
+    method: ready.method,
+    headers: ready.headers,
+    signal: request.signal,
+    redirect: request.redirect,
+    credentials: request.credentials,
+    ...ready.body === void 0 ? {} : { body: ready.body }
+  };
+  try {
+    return await inner(ready.url, init);
+  } catch (error) {
+    throw safeError(error, original, ready);
+  }
+}
+async function through(op, inner, request) {
+  const original = await outgoing(request);
+  let refreshed = false;
+  for (; ; ) {
+    let ready;
+    try {
+      ready = await prepared(op, original);
+    } catch (error) {
+      return refusal(error);
+    }
+    const response = await sent(inner, request, original, ready);
+    if (response.status !== 401 || refreshed || !op.refresh) return response;
+    refreshed = true;
+    if (!await op.refresh().then(
+      () => true,
+      () => false
+    ))
+      return response;
+    await response.body?.cancel().catch(() => void 0);
+  }
+}
+function vaultFetch(vault, inner, route) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const provider = absent(vault) ? void 0 : route(request);
+    if (provider === void 0) return inner(request);
+    const target = provider === null ? void 0 : { provider };
+    return through(
+      {
+        prepare: (outgoing2) => vault.model(provider ?? void 0, outgoing2),
+        ...target ? { refresh: () => vault.refresh(target) } : {}
+      },
+      inner,
+      request
+    );
+  };
+}
+function mcpFetch(vault, inner, server) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    if (absent(vault)) return inner(request);
+    return through(
+      {
+        prepare: (outgoing2) => vault.mcp(server, outgoing2),
+        refresh: () => vault.refresh({ server })
+      },
+      inner,
+      request
+    );
+  };
+}
+const NO_VAULT_SIGN_IN = "MCP sign-in needs seven's vault: update seven";
+function oauthOf(url, params) {
+  const scope = params.get("scope");
+  const resource = params.get("resource");
+  return {
+    tokenUrl: url,
+    clientId: params.get("client_id") ?? "",
+    ...scope ? { scope } : {},
+    ...resource ? { resource } : {}
+  };
+}
+function grantFetch(vault, server, base) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const params = request.method === "POST" ? new URLSearchParams(await request.clone().text()) : void 0;
+    if (params?.get("grant_type") !== "authorization_code") return base(request);
+    if (absent(vault)) throw new Error(NO_VAULT_SIGN_IN);
+    const response = await base(request);
+    if (!response.ok) return response;
+    const raw = new Uint8Array(await response.arrayBuffer());
+    try {
+      const granted = await vault.grant(server, raw, oauthOf(request.url, params));
+      return new Response(granted.response, {
+        status: response.status,
+        headers: { "content-type": "application/json" }
+      });
+    } catch (error) {
+      throw new Error(
+        `the vault didn't keep the sign-in: ${error instanceof Error ? error.message : String(error)}`
+      );
+    } finally {
+      raw.fill(0);
+    }
+  };
+}
+export {
+  NO_VAULT_SIGN_IN,
+  absent,
+  grantFetch,
+  mcpFetch,
+  refusal,
+  safeError,
+  vaultFetch
+};
+//# sourceMappingURL=fetch.js.map

package/dist/secrets/fetch.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/fetch.ts"],
+  "sourcesContent": ["import type { OAuthConfig, OutgoingRequest } from '@ai-ecoverse/slicc-vault';\nimport { type RefreshTarget, type Vault, VaultRefusal } from './vault.ts';\n\ntype Fetch = typeof fetch;\n\ntype Port = Pick<Vault, 'connected' | 'needed' | 'model' | 'mcp' | 'refresh' | 'grant'>;\n\nexport type ModelRoute = (request: Request) => string | null | undefined;\n\ninterface Op {\n  prepare(request: OutgoingRequest): Promise<OutgoingRequest>;\n  refresh?(): Promise<unknown>;\n}\n\nconst BODYLESS = new Set(['GET', 'HEAD']);\nconst MIN_PART = 8;\n\nexport function absent(vault: Pick<Vault, 'connected' | 'needed'>): boolean {\n  return !vault.connected && !vault.needed;\n}\n\nasync function outgoing(request: Request): Promise<OutgoingRequest> {\n  const body = BODYLESS.has(request.method)\n    ? undefined\n    : new Uint8Array(await request.arrayBuffer());\n  return {\n    method: request.method,\n    url: request.url,\n    headers: [...request.headers],\n    ...(body ? { body } : {}),\n  };\n}\n\nexport function refusal(error: unknown): Response {\n  const code = error instanceof VaultRefusal ? error.code : undefined;\n  const status = code === 'EACCES' ? 403 : code === 'EINVAL' ? 400 : 503;\n  const text = error instanceof Error ? error.message : String(error);\n  return new Response(text, {\n    status,\n    headers: { 'content-type': 'text/plain; charset=utf-8' },\n  });\n}\n\nasync function prepared(op: Op, request: OutgoingRequest): Promise<OutgoingRequest> {\n  try {\n    return await op.prepare(request);\n  } catch (error) {\n    if (error instanceof VaultRefusal && error.code === 'EAGAIN') return op.prepare(request);\n    throw error;\n  }\n}\n\nfunction filled(original: OutgoingRequest, ready: OutgoingRequest): string[] {\n  const sent = new Set(original.headers.map(([, value]) => value));\n  const values = ready.headers.map(([, value]) => value).filter((value) => !sent.has(value));\n  if (ready.url !== original.url) values.push(ready.url, decodeURIComponent(ready.url));\n  return values.flatMap((value) => [\n    value,\n    ...value.split(/[\\s=&?]+/).filter((part) => part.length >= MIN_PART),\n  ]);\n}\n\nexport function safeError(error: unknown, original: OutgoingRequest, ready: OutgoingRequest) {\n  if (\n    error instanceof DOMException &&\n    (error.name === 'AbortError' || error.name === 'TimeoutError')\n  )\n    return error;\n  const text = error instanceof Error ? error.message : String(error);\n  const parts = filled(original, ready);\n  const shown = parts.some((part) => text.includes(part)) ? 'the request failed' : text;\n  return new TypeError(`${ready.method} ${new URL(ready.url).origin}: ${shown}`);\n}\n\nasync function sent(\n  inner: Fetch,\n  request: Request,\n  original: OutgoingRequest,\n  ready: OutgoingRequest\n) {\n  const init: RequestInit = {\n    method: ready.method,\n    headers: ready.headers,\n    signal: request.signal,\n    redirect: request.redirect,\n    credentials: request.credentials,\n    ...(ready.body === undefined ? {} : { body: ready.body as BodyInit }),\n  };\n  try {\n    return await inner(ready.url, init);\n  } catch (error) {\n    throw safeError(error, original, ready);\n  }\n}\n\nasync function through(op: Op, inner: Fetch, request: Request): Promise<Response> {\n  const original = await outgoing(request);\n  let refreshed = false;\n  for (;;) {\n    let ready: OutgoingRequest;\n    try {\n      ready = await prepared(op, original);\n    } catch (error) {\n      return refusal(error);\n    }\n    const response = await sent(inner, request, original, ready);\n    if (response.status !== 401 || refreshed || !op.refresh) return response;\n    refreshed = true;\n    if (\n      !(await op.refresh().then(\n        () => true,\n        () => false\n      ))\n    )\n      return response;\n    await response.body?.cancel().catch(() => undefined);\n  }\n}\n\nexport function vaultFetch(vault: Port, inner: Fetch, route: ModelRoute): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const provider = absent(vault) ? undefined : route(request);\n    if (provider === undefined) return inner(request);\n    const target: RefreshTarget | undefined = provider === null ? undefined : { provider };\n    return through(\n      {\n        prepare: (outgoing) => vault.model(provider ?? undefined, outgoing),\n        ...(target ? { refresh: () => vault.refresh(target) } : {}),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport function mcpFetch(vault: Port, inner: Fetch, server: string): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    if (absent(vault)) return inner(request);\n    return through(\n      {\n        prepare: (outgoing) => vault.mcp(server, outgoing),\n        refresh: () => vault.refresh({ server }),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport const NO_VAULT_SIGN_IN = \"MCP sign-in needs seven's vault: update seven\";\n\nfunction oauthOf(url: string, params: URLSearchParams): OAuthConfig {\n  const scope = params.get('scope');\n  const resource = params.get('resource');\n  return {\n    tokenUrl: url,\n    clientId: params.get('client_id') ?? '',\n    ...(scope ? { scope } : {}),\n    ...(resource ? { resource } : {}),\n  };\n}\n\nexport function grantFetch(vault: Port, server: string, base: Fetch): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const params =\n      request.method === 'POST' ? new URLSearchParams(await request.clone().text()) : undefined;\n    if (params?.get('grant_type') !== 'authorization_code') return base(request);\n    if (absent(vault)) throw new Error(NO_VAULT_SIGN_IN);\n    const response = await base(request);\n    if (!response.ok) return response;\n    const raw = new Uint8Array(await response.arrayBuffer());\n    try {\n      const granted = await vault.grant(server, raw, oauthOf(request.url, params));\n      return new Response(granted.response as BodyInit, {\n        status: response.status,\n        headers: { 'content-type': 'application/json' },\n      });\n    } catch (error) {\n      throw new Error(\n        `the vault didn't keep the sign-in: ${error instanceof Error ? error.message : String(error)}`\n      );\n    } finally {\n      raw.fill(0);\n    }\n  };\n}\n"],
+  "mappings": "AACA,SAAyC,oBAAoB;AAa7D,MAAM,WAAW,oBAAI,IAAI,CAAC,OAAO,MAAM,CAAC;AACxC,MAAM,WAAW;AAEV,SAAS,OAAO,OAAqD;AAC1E,SAAO,CAAC,MAAM,aAAa,CAAC,MAAM;AACpC;AAEA,eAAe,SAAS,SAA4C;AAClE,QAAM,OAAO,SAAS,IAAI,QAAQ,MAAM,IACpC,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,QAAQ;AAAA,IACb,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,IAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,EACzB;AACF;AAEO,SAAS,QAAQ,OAA0B;AAChD,QAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO;AAC1D,QAAM,SAAS,SAAS,WAAW,MAAM,SAAS,WAAW,MAAM;AACnE,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,gBAAgB,4BAA4B;AAAA,EACzD,CAAC;AACH;AAEA,eAAe,SAAS,IAAQ,SAAoD;AAClF,MAAI;AACF,WAAO,MAAM,GAAG,QAAQ,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,iBAAiB,gBAAgB,MAAM,SAAS,SAAU,QAAO,GAAG,QAAQ,OAAO;AACvF,UAAM;AAAA,EACR;AACF;AAEA,SAAS,OAAO,UAA2B,OAAkC;AAC3E,QAAMA,QAAO,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAC/D,QAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,EAAE,OAAO,CAAC,UAAU,CAACA,MAAK,IAAI,KAAK,CAAC;AACzF,MAAI,MAAM,QAAQ,SAAS,IAAK,QAAO,KAAK,MAAM,KAAK,mBAAmB,MAAM,GAAG,CAAC;AACpF,SAAO,OAAO,QAAQ,CAAC,UAAU;AAAA,IAC/B;AAAA,IACA,GAAG,MAAM,MAAM,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU,QAAQ;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,UAAU,OAAgB,UAA2B,OAAwB;AAC3F,MACE,iBAAiB,iBAChB,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAE/C,WAAO;AACT,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,QAAM,QAAQ,OAAO,UAAU,KAAK;AACpC,QAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,uBAAuB;AACjF,SAAO,IAAI,UAAU,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE;AAC/E;AAEA,eAAe,KACb,OACA,SACA,UACA,OACA;AACA,QAAM,OAAoB;AAAA,IACxB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,aAAa,QAAQ;AAAA,IACrB,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAiB;AAAA,EACrE;AACA,MAAI;AACF,WAAO,MAAM,MAAM,MAAM,KAAK,IAAI;AAAA,EACpC,SAAS,OAAO;AACd,UAAM,UAAU,OAAO,UAAU,KAAK;AAAA,EACxC;AACF;AAEA,eAAe,QAAQ,IAAQ,OAAc,SAAqC;AAChF,QAAM,WAAW,MAAM,SAAS,OAAO;AACvC,MAAI,YAAY;AAChB,aAAS;AACP,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,SAAS,IAAI,QAAQ;AAAA,IACrC,SAAS,OAAO;AACd,aAAO,QAAQ,KAAK;AAAA,IACtB;AACA,UAAM,WAAW,MAAM,KAAK,OAAO,SAAS,UAAU,KAAK;AAC3D,QAAI,SAAS,WAAW,OAAO,aAAa,CAAC,GAAG,QAAS,QAAO;AAChE,gBAAY;AACZ,QACE,CAAE,MAAM,GAAG,QAAQ,EAAE;AAAA,MACnB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,aAAO;AACT,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACrD;AACF;AAEO,SAAS,WAAW,OAAa,OAAc,OAA0B;AAC9E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,WAAW,OAAO,KAAK,IAAI,SAAY,MAAM,OAAO;AAC1D,QAAI,aAAa,OAAW,QAAO,MAAM,OAAO;AAChD,UAAM,SAAoC,aAAa,OAAO,SAAY,EAAE,SAAS;AACrF,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACC,cAAa,MAAM,MAAM,YAAY,QAAWA,SAAQ;AAAA,QAClE,GAAI,SAAS,EAAE,SAAS,MAAM,MAAM,QAAQ,MAAM,EAAE,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,SAAS,OAAa,OAAc,QAAuB;AACzE,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,MAAM,OAAO;AACvC,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACA,cAAa,MAAM,IAAI,QAAQA,SAAQ;AAAA,QACjD,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mBAAmB;AAEhC,SAAS,QAAQ,KAAa,QAAsC;AAClE,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,OAAO,IAAI,WAAW,KAAK;AAAA,IACrC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACF;AAEO,SAAS,WAAW,OAAa,QAAgB,MAAoB;AAC1E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,SACJ,QAAQ,WAAW,SAAS,IAAI,gBAAgB,MAAM,QAAQ,MAAM,EAAE,KAAK,CAAC,IAAI;AAClF,QAAI,QAAQ,IAAI,YAAY,MAAM,qBAAsB,QAAO,KAAK,OAAO;AAC3E,QAAI,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,gBAAgB;AACnD,UAAM,WAAW,MAAM,KAAK,OAAO;AACnC,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,MAAM,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,CAAC;AAC3E,aAAO,IAAI,SAAS,QAAQ,UAAsB;AAAA,QAChD,QAAQ,SAAS;AAAA,QACjB,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC9F;AAAA,IACF,UAAE;AACA,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACF;",
+  "names": ["sent", "outgoing"]
+}

package/dist/secrets/records.js

@@ -0,0 +1,35 @@
+import { replicatedState } from "@earendil-works/chord";
+function vaultRecords(vault) {
+  const state = replicatedState([]);
+  let version = vault.state.value.version;
+  let port = vault.state.value.port;
+  let lock = Promise.resolve();
+  const read = async () => vault.connected || vault.needed ? vault.records() : [];
+  const refresh = (context) => {
+    const run = lock.then(async () => state.replace(context, await read()));
+    lock = run.catch(() => void 0);
+    return run;
+  };
+  const off = vault.state.subscribe((value, context) => {
+    const bumped = value.version !== version || port === "none" && value.port !== "none";
+    version = value.version;
+    port = value.port;
+    if (bumped) void refresh(context).catch(() => void 0);
+  });
+  const of = (kind) => state.value.filter((record) => record.kind === kind);
+  return {
+    state,
+    refresh,
+    model: (provider) => of("model").find((record) => record.provider === provider),
+    mcp: (server, name) => {
+      const own = of("mcp").filter((record) => record.server === server);
+      if (name === void 0) return own[0];
+      return own.find((record) => record.name === name) ?? of("mcp").find((record) => record.server === void 0 && record.name === name);
+    },
+    close: off
+  };
+}
+export {
+  vaultRecords
+};
+//# sourceMappingURL=records.js.map

package/dist/secrets/records.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/records.ts"],
+  "sourcesContent": ["import type { AgentRecord } from '@ai-ecoverse/slicc-vault';\nimport { type Context, type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport type { Vault } from './vault.ts';\n\nexport type { AgentRecord } from '@ai-ecoverse/slicc-vault';\n\nexport interface VaultRecords {\n  readonly state: MutableReplicatedState<AgentRecord[]>;\n  refresh(context: Context): Promise<void>;\n  model(provider: string): AgentRecord | undefined;\n  mcp(server: string, name?: string): AgentRecord | undefined;\n  close(): void;\n}\n\ntype Source = Pick<Vault, 'state' | 'records' | 'connected' | 'needed'>;\n\nexport function vaultRecords(vault: Source): VaultRecords {\n  const state = replicatedState<AgentRecord[]>([]);\n  let version = vault.state.value.version;\n  let port = vault.state.value.port;\n  let lock: Promise<unknown> = Promise.resolve();\n  const read = async () => (vault.connected || vault.needed ? vault.records() : []);\n  const refresh = (context: Context) => {\n    const run = lock.then(async () => state.replace(context, await read()));\n    lock = run.catch(() => undefined);\n    return run;\n  };\n  const off = vault.state.subscribe((value, context) => {\n    const bumped = value.version !== version || (port === 'none' && value.port !== 'none');\n    version = value.version;\n    port = value.port;\n    if (bumped) void refresh(context).catch(() => undefined);\n  });\n  const of = (kind: AgentRecord['kind']) => state.value.filter((record) => record.kind === kind);\n  return {\n    state,\n    refresh,\n    model: (provider) => of('model').find((record) => record.provider === provider),\n    mcp: (server, name) => {\n      const own = of('mcp').filter((record) => record.server === server);\n      if (name === undefined) return own[0];\n      return (\n        own.find((record) => record.name === name) ??\n        of('mcp').find((record) => record.server === undefined && record.name === name)\n      );\n    },\n    close: off,\n  };\n}\n"],
+  "mappings": "AACA,SAAoD,uBAAuB;AAepE,SAAS,aAAa,OAA6B;AACxD,QAAM,QAAQ,gBAA+B,CAAC,CAAC;AAC/C,MAAI,UAAU,MAAM,MAAM,MAAM;AAChC,MAAI,OAAO,MAAM,MAAM,MAAM;AAC7B,MAAI,OAAyB,QAAQ,QAAQ;AAC7C,QAAM,OAAO,YAAa,MAAM,aAAa,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC;AAC/E,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,MAAM,KAAK,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC;AACtE,WAAO,IAAI,MAAM,MAAM,MAAS;AAChC,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAM,MAAM,UAAU,CAAC,OAAO,YAAY;AACpD,UAAM,SAAS,MAAM,YAAY,WAAY,SAAS,UAAU,MAAM,SAAS;AAC/E,cAAU,MAAM;AAChB,WAAO,MAAM;AACb,QAAI,OAAQ,MAAK,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD,CAAC;AACD,QAAM,KAAK,CAAC,SAA8B,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,SAAS,IAAI;AAC7F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,CAAC,aAAa,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,OAAO,aAAa,QAAQ;AAAA,IAC9E,KAAK,CAAC,QAAQ,SAAS;AACrB,YAAM,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM;AACjE,UAAI,SAAS,OAAW,QAAO,IAAI,CAAC;AACpC,aACE,IAAI,KAAK,CAAC,WAAW,OAAO,SAAS,IAAI,KACzC,GAAG,KAAK,EAAE,KAAK,CAAC,WAAW,OAAO,WAAW,UAAa,OAAO,SAAS,IAAI;AAAA,IAElF;AAAA,IACA,OAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/secrets/store.js

@@ -0,0 +1,50 @@
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+function memoryStore() {
+  const values = /* @__PURE__ */ new Map();
+  return {
+    get: async (key) => structuredClone(values.get(key)),
+    async set(key, value) {
+      if (value === void 0) values.delete(key);
+      else values.set(key, structuredClone(value));
+    }
+  };
+}
+function fileStore(env, path) {
+  let cache;
+  let writes = Promise.resolve();
+  const load = () => {
+    cache ??= env.readTextFile(path, BACKGROUND_CONTEXT).then((read) => {
+      if (!read.ok) return {};
+      try {
+        const parsed = JSON.parse(read.value);
+        return parsed && typeof parsed === "object" ? parsed : {};
+      } catch {
+        return {};
+      }
+    });
+    return cache;
+  };
+  return {
+    async get(key) {
+      await writes;
+      return structuredClone((await load())[key]);
+    },
+    set(key, value) {
+      const write = writes.then(async () => {
+        const all = { ...await load() };
+        if (value === void 0) delete all[key];
+        else all[key] = structuredClone(value);
+        cache = Promise.resolve(all);
+        const wrote = await env.writeFile(path, JSON.stringify(all), BACKGROUND_CONTEXT);
+        if (!wrote.ok) throw new Error(`can't write ${path}`);
+      });
+      writes = write.catch(() => void 0);
+      return write;
+    }
+  };
+}
+export {
+  fileStore,
+  memoryStore
+};
+//# sourceMappingURL=store.js.map

package/dist/secrets/store.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/store.ts"],
+  "sourcesContent": ["import { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ExecutionEnv } from '@earendil-works/pi-durable/env';\n\nexport interface PlainStore {\n  get(key: string): Promise<unknown>;\n  set(key: string, value: unknown): Promise<void>;\n}\n\nexport function memoryStore(): PlainStore {\n  const values = new Map<string, unknown>();\n  return {\n    get: async (key) => structuredClone(values.get(key)),\n    async set(key, value) {\n      if (value === undefined) values.delete(key);\n      else values.set(key, structuredClone(value));\n    },\n  };\n}\n\nexport function fileStore(env: ExecutionEnv, path: string): PlainStore {\n  let cache: Promise<Record<string, unknown>> | undefined;\n  let writes: Promise<unknown> = Promise.resolve();\n  const load = () => {\n    cache ??= env.readTextFile(path, BACKGROUND_CONTEXT).then((read) => {\n      if (!read.ok) return {};\n      try {\n        const parsed: unknown = JSON.parse(read.value);\n        return parsed && typeof parsed === 'object' ? (parsed as Record<string, unknown>) : {};\n      } catch {\n        return {};\n      }\n    });\n    return cache;\n  };\n  return {\n    async get(key) {\n      await writes;\n      return structuredClone((await load())[key]);\n    },\n    set(key, value) {\n      const write = writes.then(async () => {\n        const all = { ...(await load()) };\n        if (value === undefined) delete all[key];\n        else all[key] = structuredClone(value);\n        cache = Promise.resolve(all);\n        const wrote = await env.writeFile(path, JSON.stringify(all), BACKGROUND_CONTEXT);\n        if (!wrote.ok) throw new Error(`can't write ${path}`);\n      });\n      writes = write.catch(() => undefined);\n      return write;\n    },\n  };\n}\n"],
+  "mappings": "AAAA,SAAS,0BAA0B;AAQ5B,SAAS,cAA0B;AACxC,QAAM,SAAS,oBAAI,IAAqB;AACxC,SAAO;AAAA,IACL,KAAK,OAAO,QAAQ,gBAAgB,OAAO,IAAI,GAAG,CAAC;AAAA,IACnD,MAAM,IAAI,KAAK,OAAO;AACpB,UAAI,UAAU,OAAW,QAAO,OAAO,GAAG;AAAA,UACrC,QAAO,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAEO,SAAS,UAAU,KAAmB,MAA0B;AACrE,MAAI;AACJ,MAAI,SAA2B,QAAQ,QAAQ;AAC/C,QAAM,OAAO,MAAM;AACjB,cAAU,IAAI,aAAa,MAAM,kBAAkB,EAAE,KAAK,CAAC,SAAS;AAClE,UAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAI;AACF,cAAM,SAAkB,KAAK,MAAM,KAAK,KAAK;AAC7C,eAAO,UAAU,OAAO,WAAW,WAAY,SAAqC,CAAC;AAAA,MACvF,QAAQ;AACN,eAAO,CAAC;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,MAAM,IAAI,KAAK;AACb,YAAM;AACN,aAAO,iBAAiB,MAAM,KAAK,GAAG,GAAG,CAAC;AAAA,IAC5C;AAAA,IACA,IAAI,KAAK,OAAO;AACd,YAAM,QAAQ,OAAO,KAAK,YAAY;AACpC,cAAM,MAAM,EAAE,GAAI,MAAM,KAAK,EAAG;AAChC,YAAI,UAAU,OAAW,QAAO,IAAI,GAAG;AAAA,YAClC,KAAI,GAAG,IAAI,gBAAgB,KAAK;AACrC,gBAAQ,QAAQ,QAAQ,GAAG;AAC3B,cAAM,QAAQ,MAAM,IAAI,UAAU,MAAM,KAAK,UAAU,GAAG,GAAG,kBAAkB;AAC/E,YAAI,CAAC,MAAM,GAAI,OAAM,IAAI,MAAM,eAAe,IAAI,EAAE;AAAA,MACtD,CAAC;AACD,eAAS,MAAM,MAAM,MAAM,MAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/secrets/vault.js

@@ -3,6 +3,14 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { vaultHold } from "./view.js";
 const WAITING_MS = 2e3;
 const WAITING = "waiting for the vault";
+class VaultRefusal extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "VaultRefusal";
+    this.code = code;
+  }
+}
 const LOCKS = ["no", "scrubbing", "passkey"];
 const EMPTY = new Uint8Array();
 function pairOf(value) {
@@ -23,6 +31,7 @@ class Vault {
   #seen = 0;
   #serial = 0;
   #streamSerial = 0;
+  #tag = Math.random().toString(36).slice(2, 10);
   constructor(now = Date.now) {
     this.#now = now;
     this.state = replicatedState(this.#snapshot());
@@ -30,9 +39,13 @@ class Vault {
   get needed() {
     return this.#pair.needed || this.#seen > this.#pair.version;
   }
-  connect(port, scrub) {
+  get connected() {
+    return this.#port !== void 0;
+  }
+  connect(port, scrub, locked) {
     const pair = scrub === void 0 ? void 0 : pairOf(scrub);
     if (pair) this.#pair = pair;
+    if (typeof locked === "boolean") this.#locked = locked ? "passkey" : "no";
     if (port && port !== this.#port) {
       if (this.#port) this.#port.onmessage = null;
       this.#port = port;
@@ -57,21 +70,45 @@ class Vault {
     const answer = await this.#call("redact", { texts: [...texts] });
     return answer.texts;
   }
+  async model(provider, request) {
+    const fields = provider === void 0 ? { request } : { provider, request };
+    return (await this.#call("model", fields)).request;
+  }
+  async mcp(server, request) {
+    return (await this.#call("mcp", { server, request })).request;
+  }
+  async records() {
+    return (await this.#call("records", {})).records;
+  }
+  async grant(server, response, oauth, name) {
+    const fields = { server, response, oauth, ...name === void 0 ? {} : { name } };
+    const { response: shown, records, expiresAt } = await this.#call("grant", fields);
+    return { response: shown, records, ...expiresAt === void 0 ? {} : { expiresAt } };
+  }
+  async refresh(target, name) {
+    const fields = { ...target, ...name === void 0 ? {} : { name } };
+    return (await this.#call("refresh", fields)).state;
+  }
+  async endpoints(set) {
+    await this.#call("endpoints", { model: set.model, mcp: set.mcp });
+  }
   stream() {
     let stream;
     return {
       push: (chunk) => {
         if (stream === void 0 && !this.needed) return Promise.resolve(chunk);
         if (stream === void 0) {
-          stream = ++this.#streamSerial;
+          stream = `${this.#tag}-${++this.#streamSerial}`;
           this.#streams.add(stream);
           void this.#call("redactStream", { stream });
         }
-        return this.#call("push", { stream, chunk });
+        return this.#call("push", { stream, chunk }).then(
+          (answer) => answer.chunk
+        );
       },
       end: async () => {
         if (stream === void 0) return EMPTY;
-        const tail = await this.#call("end", { stream });
+        const { chunk: tail } = await this.#call("end", { stream });
         this.#streams.delete(stream);
         return tail;
       },
@@ -82,14 +119,14 @@ class Vault {
         for (const [id, item] of this.#pending)
           if (item.message.stream === dropped && item.message.op !== "redactStream") {
             this.#pending.delete(id);
-            item.resolve(EMPTY);
+            item.resolve({ chunk: EMPTY });
           }
         void this.#call("drop", { stream: dropped });
       }
     };
   }
   #call(op, fields) {
-    const message = { id: ++this.#serial, op, ...fields };
+    const message = { v: 1, id: ++this.#serial, op, ...fields };
     const result = new Promise((resolve, reject) => {
       this.#pending.set(message.id, { message, at: this.#now(), resolve, reject });
     });
@@ -103,16 +140,23 @@ class Vault {
     const pair = "scrub" in data ? pairOf(data.scrub) : void 0;
     if (pair) this.#pair = pair;
     if (LOCKS.includes(data.locked)) this.#locked = data.locked;
+    if (data.op === "welcome") this.#welcome(data.status);
     const item = typeof data.id === "number" ? this.#pending.get(data.id) : void 0;
     if (item) {
       this.#pending.delete(data.id);
-      const version = data.ok?.version;
-      if (typeof version === "number") this.#seen = Math.max(this.#seen, version);
-      if (data.error) item.reject(new Error(data.error.message ?? "the vault refused"));
-      else item.resolve(data.ok);
+      if (typeof data.version === "number") this.#seen = Math.max(this.#seen, data.version);
+      if (data.error)
+        item.reject(new VaultRefusal(data.error.code, data.error.message ?? "the vault refused"));
+      else item.resolve(data);
     }
     this.#refresh();
   }
+  #welcome(status) {
+    const given = status;
+    const pair = given && "scrub" in given ? pairOf(given.scrub) : void 0;
+    if (pair) this.#pair = pair;
+    if (typeof given?.locked === "boolean") this.#locked = given.locked ? "passkey" : "no";
+  }
   #waiting() {
     const now = this.#now();
     return [...this.#pending.values()].some((item) => now - item.at >= WAITING_MS);
@@ -147,13 +191,14 @@ function holdText(state) {
 function listenVault(scope, vault) {
   scope.addEventListener("message", ({ data }) => {
     const message = data;
-    if (!message || typeof message !== "object" || !("vault" in message || "scrub" in message))
-      return;
-    vault.connect(message.vault, message.scrub);
+    if (!message || typeof message !== "object") return;
+    if (!("vault" in message || "scrub" in message || "locked" in message)) return;
+    vault.connect(message.vault, message.scrub, message.locked);
   });
 }
 export {
   Vault,
+  VaultRefusal,
   WAITING,
   WAITING_MS,
   holdText,

package/dist/secrets/vault.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/secrets/vault.ts"],
-  "sourcesContent": ["import { type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Scrub, Scrubbable, ScrubStream } from './scrub.ts';\nimport { vaultHold } from './view.ts';\n\nexport type ScrubPair = { needed: boolean; version: number };\nexport type Locked = 'no' | 'scrubbing' | 'passkey';\n\nexport interface VaultState {\n  port: 'none' | 'ready' | 'waiting';\n  needed: boolean;\n  version: number;\n  locked: Locked;\n  held: number;\n}\n\nexport const WAITING_MS = 2000;\nexport const WAITING = 'waiting for the vault';\n\ntype Message = Record<string, unknown> & { id: number; op: string };\n\ninterface Pending {\n  message: Message;\n  at: number;\n  resolve(value: unknown): void;\n  reject(error: Error): void;\n}\n\ntype Answer = {\n  id?: unknown;\n  ok?: unknown;\n  error?: { message?: string };\n  scrub?: unknown;\n  locked?: unknown;\n};\n\nconst LOCKS: readonly unknown[] = ['no', 'scrubbing', 'passkey'];\n\nconst EMPTY = new Uint8Array();\n\nfunction pairOf(value: unknown): ScrubPair | undefined {\n  const pair = value as Partial<ScrubPair> | null;\n  if (pair === null) return { needed: false, version: 0 };\n  if (typeof pair?.needed !== 'boolean' || typeof pair.version !== 'number') return undefined;\n  return { needed: pair.needed, version: pair.version };\n}\n\nexport class Vault implements Scrub {\n  readonly state: MutableReplicatedState<VaultState>;\n  readonly #pending = new Map<number, Pending>();\n  readonly #streams = new Set<number>();\n  readonly #waiters = new Set<() => void>();\n  readonly #now: () => number;\n  #port: MessagePort | undefined;\n  #pair: ScrubPair = { needed: false, version: 0 };\n  #locked: Locked = 'no';\n  #seen = 0;\n  #serial = 0;\n  #streamSerial = 0;\n\n  constructor(now: () => number = Date.now) {\n    this.#now = now;\n    this.state = replicatedState<VaultState>(this.#snapshot());\n  }\n\n  get needed(): boolean {\n    return this.#pair.needed || this.#seen > this.#pair.version;\n  }\n\n  connect(port: MessagePort | undefined, scrub: unknown): void {\n    const pair = scrub === undefined ? undefined : pairOf(scrub);\n    if (pair) this.#pair = pair;\n    if (port && port !== this.#port) {\n      if (this.#port) this.#port.onmessage = null;\n      this.#port = port;\n      port.onmessage = (event) => this.#answer(event.data as Answer);\n      port.start?.();\n      const resend = [...this.#pending.values()];\n      const opening = new Set(\n        resend\n          .filter((item) => item.message.op === 'redactStream')\n          .map((item) => item.message.stream)\n      );\n      for (const stream of this.#streams)\n        if (!opening.has(stream)) void this.#call('redactStream', { stream });\n      for (const item of resend) port.postMessage(item.message);\n    }\n    this.#refresh();\n  }\n\n  ready(): Promise<void> {\n    if (!this.#holding()) return Promise.resolve();\n    return new Promise((resolve) => this.#waiters.add(resolve));\n  }\n\n  async texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]> {\n    if (!this.needed) return [...texts];\n    const answer = (await this.#call('redact', { texts: [...texts] })) as {\n      texts: T[];\n      version?: number;\n    };\n    return answer.texts;\n  }\n\n  stream(): ScrubStream {\n    let stream: number | undefined;\n    return {\n      push: (chunk) => {\n        if (stream === undefined && !this.needed) return Promise.resolve(chunk);\n        if (stream === undefined) {\n          stream = ++this.#streamSerial;\n          this.#streams.add(stream);\n          void this.#call('redactStream', { stream });\n        }\n        return this.#call('push', { stream, chunk }) as Promise<Uint8Array>;\n      },\n      end: async () => {\n        if (stream === undefined) return EMPTY;\n        const tail = (await this.#call('end', { stream })) as Uint8Array;\n        this.#streams.delete(stream);\n        return tail;\n      },\n      drop: () => {\n        if (stream === undefined) return;\n        const dropped = stream;\n        this.#streams.delete(dropped);\n        for (const [id, item] of this.#pending)\n          if (item.message.stream === dropped && item.message.op !== 'redactStream') {\n            this.#pending.delete(id);\n            item.resolve(EMPTY);\n          }\n        void this.#call('drop', { stream: dropped });\n      },\n    };\n  }\n\n  #call(op: string, fields: Record<string, unknown>): Promise<unknown> {\n    const message: Message = { id: ++this.#serial, op, ...fields };\n    const result = new Promise((resolve, reject) => {\n      this.#pending.set(message.id, { message, at: this.#now(), resolve, reject });\n    });\n    this.#port?.postMessage(message);\n    setTimeout(() => this.#refresh(), WAITING_MS);\n    this.#refresh();\n    return result;\n  }\n\n  #answer(data: Answer): void {\n    if (!data || typeof data !== 'object') return;\n    const pair = 'scrub' in data ? pairOf(data.scrub) : undefined;\n    if (pair) this.#pair = pair;\n    if (LOCKS.includes(data.locked)) this.#locked = data.locked as Locked;\n    const item = typeof data.id === 'number' ? this.#pending.get(data.id) : undefined;\n    if (item) {\n      this.#pending.delete(data.id as number);\n      const version = (data.ok as { version?: unknown } | undefined)?.version;\n      if (typeof version === 'number') this.#seen = Math.max(this.#seen, version);\n      if (data.error) item.reject(new Error(data.error.message ?? 'the vault refused'));\n      else item.resolve(data.ok);\n    }\n    this.#refresh();\n  }\n\n  #waiting(): boolean {\n    const now = this.#now();\n    return [...this.#pending.values()].some((item) => now - item.at >= WAITING_MS);\n  }\n\n  #holding(): boolean {\n    return this.needed && (!this.#port || this.#waiting() || this.#locked === 'passkey');\n  }\n\n  #snapshot(): VaultState {\n    return {\n      port: !this.#port ? 'none' : this.#waiting() ? 'waiting' : 'ready',\n      needed: this.needed,\n      version: this.#pair.version,\n      locked: this.#locked,\n      held: this.#pending.size,\n    };\n  }\n\n  #refresh(): void {\n    const next = this.#snapshot();\n    const before = this.state.value;\n    if (Object.entries(next).some(([key, value]) => before[key as keyof VaultState] !== value))\n      this.state.replace(BACKGROUND_CONTEXT, next);\n    if (this.#holding()) return;\n    for (const resolve of this.#waiters) resolve();\n    this.#waiters.clear();\n  }\n}\n\nexport function holdText(state: VaultState): string | undefined {\n  const hold = vaultHold(state);\n  if (!hold) return undefined;\n  return hold.reason === 'locked' ? 'unlock the vault to continue' : WAITING;\n}\n\nexport function listenVault(\n  scope: { addEventListener(type: 'message', listener: (event: MessageEvent) => void): void },\n  vault: Vault\n): void {\n  scope.addEventListener('message', ({ data }) => {\n    const message = data as { vault?: MessagePort; scrub?: unknown } | null;\n    if (!message || typeof message !== 'object' || !('vault' in message || 'scrub' in message))\n      return;\n    vault.connect(message.vault, message.scrub);\n  });\n}\n"],
-  "mappings": "AAAA,SAAsC,uBAAuB;AAC7D,SAAS,0BAA0B;AAEnC,SAAS,iBAAiB;AAanB,MAAM,aAAa;AACnB,MAAM,UAAU;AAmBvB,MAAM,QAA4B,CAAC,MAAM,aAAa,SAAS;AAE/D,MAAM,QAAQ,IAAI,WAAW;AAE7B,SAAS,OAAO,OAAuC;AACrD,QAAM,OAAO;AACb,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,OAAO,SAAS,EAAE;AACtD,MAAI,OAAO,MAAM,WAAW,aAAa,OAAO,KAAK,YAAY,SAAU,QAAO;AAClF,SAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,KAAK,QAAQ;AACtD;AAEO,MAAM,MAAuB;AAAA,EACzB;AAAA,EACA,WAAW,oBAAI,IAAqB;AAAA,EACpC,WAAW,oBAAI,IAAY;AAAA,EAC3B,WAAW,oBAAI,IAAgB;AAAA,EAC/B;AAAA,EACT;AAAA,EACA,QAAmB,EAAE,QAAQ,OAAO,SAAS,EAAE;AAAA,EAC/C,UAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,gBAAgB;AAAA,EAEhB,YAAY,MAAoB,KAAK,KAAK;AACxC,SAAK,OAAO;AACZ,SAAK,QAAQ,gBAA4B,KAAK,UAAU,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI,SAAkB;AACpB,WAAO,KAAK,MAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AAAA,EACtD;AAAA,EAEA,QAAQ,MAA+B,OAAsB;AAC3D,UAAM,OAAO,UAAU,SAAY,SAAY,OAAO,KAAK;AAC3D,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,QAAQ,SAAS,KAAK,OAAO;AAC/B,UAAI,KAAK,MAAO,MAAK,MAAM,YAAY;AACvC,WAAK,QAAQ;AACb,WAAK,YAAY,CAAC,UAAU,KAAK,QAAQ,MAAM,IAAc;AAC7D,WAAK,QAAQ;AACb,YAAM,SAAS,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;AACzC,YAAM,UAAU,IAAI;AAAA,QAClB,OACG,OAAO,CAAC,SAAS,KAAK,QAAQ,OAAO,cAAc,EACnD,IAAI,CAAC,SAAS,KAAK,QAAQ,MAAM;AAAA,MACtC;AACA,iBAAW,UAAU,KAAK;AACxB,YAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,MAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AACtE,iBAAW,QAAQ,OAAQ,MAAK,YAAY,KAAK,OAAO;AAAA,IAC1D;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,QAAuB;AACrB,QAAI,CAAC,KAAK,SAAS,EAAG,QAAO,QAAQ,QAAQ;AAC7C,WAAO,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,MAA4B,OAAmC;AACnE,QAAI,CAAC,KAAK,OAAQ,QAAO,CAAC,GAAG,KAAK;AAClC,UAAM,SAAU,MAAM,KAAK,MAAM,UAAU,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;AAIhE,WAAO,OAAO;AAAA,EAChB;AAAA,EAEA,SAAsB;AACpB,QAAI;AACJ,WAAO;AAAA,MACL,MAAM,CAAC,UAAU;AACf,YAAI,WAAW,UAAa,CAAC,KAAK,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AACtE,YAAI,WAAW,QAAW;AACxB,mBAAS,EAAE,KAAK;AAChB,eAAK,SAAS,IAAI,MAAM;AACxB,eAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AAAA,QAC5C;AACA,eAAO,KAAK,MAAM,QAAQ,EAAE,QAAQ,MAAM,CAAC;AAAA,MAC7C;AAAA,MACA,KAAK,YAAY;AACf,YAAI,WAAW,OAAW,QAAO;AACjC,cAAM,OAAQ,MAAM,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC;AAChD,aAAK,SAAS,OAAO,MAAM;AAC3B,eAAO;AAAA,MACT;AAAA,MACA,MAAM,MAAM;AACV,YAAI,WAAW,OAAW;AAC1B,cAAM,UAAU;AAChB,aAAK,SAAS,OAAO,OAAO;AAC5B,mBAAW,CAAC,IAAI,IAAI,KAAK,KAAK;AAC5B,cAAI,KAAK,QAAQ,WAAW,WAAW,KAAK,QAAQ,OAAO,gBAAgB;AACzE,iBAAK,SAAS,OAAO,EAAE;AACvB,iBAAK,QAAQ,KAAK;AAAA,UACpB;AACF,aAAK,KAAK,MAAM,QAAQ,EAAE,QAAQ,QAAQ,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,IAAY,QAAmD;AACnE,UAAM,UAAmB,EAAE,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,OAAO;AAC7D,UAAM,SAAS,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9C,WAAK,SAAS,IAAI,QAAQ,IAAI,EAAE,SAAS,IAAI,KAAK,KAAK,GAAG,SAAS,OAAO,CAAC;AAAA,IAC7E,CAAC;AACD,SAAK,OAAO,YAAY,OAAO;AAC/B,eAAW,MAAM,KAAK,SAAS,GAAG,UAAU;AAC5C,SAAK,SAAS;AACd,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,MAAoB;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,OAAO,WAAW,OAAO,OAAO,KAAK,KAAK,IAAI;AACpD,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,MAAM,SAAS,KAAK,MAAM,EAAG,MAAK,UAAU,KAAK;AACrD,UAAM,OAAO,OAAO,KAAK,OAAO,WAAW,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI;AACxE,QAAI,MAAM;AACR,WAAK,SAAS,OAAO,KAAK,EAAY;AACtC,YAAM,UAAW,KAAK,IAA0C;AAChE,UAAI,OAAO,YAAY,SAAU,MAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,OAAO;AAC1E,UAAI,KAAK,MAAO,MAAK,OAAO,IAAI,MAAM,KAAK,MAAM,WAAW,mBAAmB,CAAC;AAAA,UAC3E,MAAK,QAAQ,KAAK,EAAE;AAAA,IAC3B;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,WAAoB;AAClB,UAAM,MAAM,KAAK,KAAK;AACtB,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,EAC/E;AAAA,EAEA,WAAoB;AAClB,WAAO,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,SAAS,KAAK,KAAK,YAAY;AAAA,EAC5E;AAAA,EAEA,YAAwB;AACtB,WAAO;AAAA,MACL,MAAM,CAAC,KAAK,QAAQ,SAAS,KAAK,SAAS,IAAI,YAAY;AAAA,MAC3D,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK,MAAM;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,UAAM,OAAO,KAAK,UAAU;AAC5B,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,OAAO,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,GAAuB,MAAM,KAAK;AACvF,WAAK,MAAM,QAAQ,oBAAoB,IAAI;AAC7C,QAAI,KAAK,SAAS,EAAG;AACrB,eAAW,WAAW,KAAK,SAAU,SAAQ;AAC7C,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAEO,SAAS,SAAS,OAAuC;AAC9D,QAAM,OAAO,UAAU,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,WAAW,WAAW,iCAAiC;AACrE;AAEO,SAAS,YACd,OACA,OACM;AACN,QAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,UAAM,UAAU;AAChB,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,EAAE,WAAW,WAAW,WAAW;AAChF;AACF,UAAM,QAAQ,QAAQ,OAAO,QAAQ,KAAK;AAAA,EAC5C,CAAC;AACH;",
+  "sourcesContent": ["import type { Hit } from '@ai-ecoverse/slicc-scrub';\nimport type {\n  AgentRecord,\n  ErrorCode,\n  McpServerEntry,\n  ModelEndpoint,\n  OAuthConfig,\n  OutgoingRequest,\n} from '@ai-ecoverse/slicc-vault';\nimport { type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Scrub, Scrubbable, ScrubStream } from './scrub.ts';\nimport { vaultHold } from './view.ts';\n\nexport type ScrubPair = { needed: boolean; version: number };\nexport type Locked = 'no' | 'scrubbing' | 'passkey';\n\nexport interface VaultState {\n  port: 'none' | 'ready' | 'waiting';\n  needed: boolean;\n  version: number;\n  locked: Locked;\n  held: number;\n}\n\nexport const WAITING_MS = 2000;\nexport const WAITING = 'waiting for the vault';\n\ntype Message = Record<string, unknown> & { v: 1; id: number; op: string };\n\nexport class VaultRefusal extends Error {\n  readonly code: ErrorCode | undefined;\n\n  constructor(code: ErrorCode | undefined, message: string) {\n    super(message);\n    this.name = 'VaultRefusal';\n    this.code = code;\n  }\n}\n\nexport type RefreshTarget = { server: string } | { provider: string };\n\nexport interface Granted {\n  response: string | Uint8Array;\n  records: { kind: string; name: string; placeholder: string }[];\n  expiresAt?: number;\n}\n\nexport interface EndpointSet {\n  model: ModelEndpoint[];\n  mcp: McpServerEntry[];\n}\n\ninterface Pending {\n  message: Message;\n  at: number;\n  resolve(value: unknown): void;\n  reject(error: Error): void;\n}\n\ntype Answer = Record<string, unknown> & {\n  id?: unknown;\n  error?: { code?: ErrorCode; message?: string };\n  scrub?: unknown;\n  locked?: unknown;\n  version?: unknown;\n};\n\nconst LOCKS: readonly unknown[] = ['no', 'scrubbing', 'passkey'];\n\nconst EMPTY = new Uint8Array();\n\nfunction pairOf(value: unknown): ScrubPair | undefined {\n  const pair = value as Partial<ScrubPair> | null;\n  if (pair === null) return { needed: false, version: 0 };\n  if (typeof pair?.needed !== 'boolean' || typeof pair.version !== 'number') return undefined;\n  return { needed: pair.needed, version: pair.version };\n}\n\nexport class Vault implements Scrub {\n  readonly state: MutableReplicatedState<VaultState>;\n  readonly #pending = new Map<number, Pending>();\n  readonly #streams = new Set<string>();\n  readonly #waiters = new Set<() => void>();\n  readonly #now: () => number;\n  #port: MessagePort | undefined;\n  #pair: ScrubPair = { needed: false, version: 0 };\n  #locked: Locked = 'no';\n  #seen = 0;\n  #serial = 0;\n  #streamSerial = 0;\n  readonly #tag = Math.random().toString(36).slice(2, 10);\n\n  constructor(now: () => number = Date.now) {\n    this.#now = now;\n    this.state = replicatedState<VaultState>(this.#snapshot());\n  }\n\n  get needed(): boolean {\n    return this.#pair.needed || this.#seen > this.#pair.version;\n  }\n\n  get connected(): boolean {\n    return this.#port !== undefined;\n  }\n\n  connect(port: MessagePort | undefined, scrub: unknown, locked?: unknown): void {\n    const pair = scrub === undefined ? undefined : pairOf(scrub);\n    if (pair) this.#pair = pair;\n    if (typeof locked === 'boolean') this.#locked = locked ? 'passkey' : 'no';\n    if (port && port !== this.#port) {\n      if (this.#port) this.#port.onmessage = null;\n      this.#port = port;\n      port.onmessage = (event) => this.#answer(event.data as Answer);\n      port.start?.();\n      const resend = [...this.#pending.values()];\n      const opening = new Set(\n        resend\n          .filter((item) => item.message.op === 'redactStream')\n          .map((item) => item.message.stream)\n      );\n      for (const stream of this.#streams)\n        if (!opening.has(stream)) void this.#call('redactStream', { stream });\n      for (const item of resend) port.postMessage(item.message);\n    }\n    this.#refresh();\n  }\n\n  ready(): Promise<void> {\n    if (!this.#holding()) return Promise.resolve();\n    return new Promise((resolve) => this.#waiters.add(resolve));\n  }\n\n  async texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]> {\n    if (!this.needed) return [...texts];\n    const answer = (await this.#call('redact', { texts: [...texts] })) as {\n      texts: T[];\n      hits: Hit[];\n      version: number;\n    };\n    return answer.texts;\n  }\n\n  async model(provider: string | undefined, request: OutgoingRequest): Promise<OutgoingRequest> {\n    const fields = provider === undefined ? { request } : { provider, request };\n    return ((await this.#call('model', fields)) as { request: OutgoingRequest }).request;\n  }\n\n  async mcp(server: string, request: OutgoingRequest): Promise<OutgoingRequest> {\n    return ((await this.#call('mcp', { server, request })) as { request: OutgoingRequest }).request;\n  }\n\n  async records(): Promise<AgentRecord[]> {\n    return ((await this.#call('records', {})) as { records: AgentRecord[] }).records;\n  }\n\n  async grant(\n    server: string,\n    response: string | Uint8Array,\n    oauth: OAuthConfig,\n    name?: string\n  ): Promise<Granted> {\n    const fields = { server, response, oauth, ...(name === undefined ? {} : { name }) };\n    const { response: shown, records, expiresAt } = (await this.#call('grant', fields)) as Granted;\n    return { response: shown, records, ...(expiresAt === undefined ? {} : { expiresAt }) };\n  }\n\n  async refresh(target: RefreshTarget, name?: string): Promise<string> {\n    const fields = { ...target, ...(name === undefined ? {} : { name }) };\n    return ((await this.#call('refresh', fields)) as { state: string }).state;\n  }\n\n  async endpoints(set: EndpointSet): Promise<void> {\n    await this.#call('endpoints', { model: set.model, mcp: set.mcp });\n  }\n\n  stream(): ScrubStream {\n    let stream: string | undefined;\n    return {\n      push: (chunk) => {\n        if (stream === undefined && !this.needed) return Promise.resolve(chunk);\n        if (stream === undefined) {\n          stream = `${this.#tag}-${++this.#streamSerial}`;\n          this.#streams.add(stream);\n          void this.#call('redactStream', { stream });\n        }\n        return this.#call('push', { stream, chunk }).then(\n          (answer) => (answer as { chunk: Uint8Array }).chunk\n        );\n      },\n      end: async () => {\n        if (stream === undefined) return EMPTY;\n        const { chunk: tail } = (await this.#call('end', { stream })) as { chunk: Uint8Array };\n        this.#streams.delete(stream);\n        return tail;\n      },\n      drop: () => {\n        if (stream === undefined) return;\n        const dropped = stream;\n        this.#streams.delete(dropped);\n        for (const [id, item] of this.#pending)\n          if (item.message.stream === dropped && item.message.op !== 'redactStream') {\n            this.#pending.delete(id);\n            item.resolve({ chunk: EMPTY });\n          }\n        void this.#call('drop', { stream: dropped });\n      },\n    };\n  }\n\n  #call(op: string, fields: Record<string, unknown>): Promise<unknown> {\n    const message: Message = { v: 1, id: ++this.#serial, op, ...fields };\n    const result = new Promise((resolve, reject) => {\n      this.#pending.set(message.id, { message, at: this.#now(), resolve, reject });\n    });\n    this.#port?.postMessage(message);\n    setTimeout(() => this.#refresh(), WAITING_MS);\n    this.#refresh();\n    return result;\n  }\n\n  #answer(data: Answer): void {\n    if (!data || typeof data !== 'object') return;\n    const pair = 'scrub' in data ? pairOf(data.scrub) : undefined;\n    if (pair) this.#pair = pair;\n    if (LOCKS.includes(data.locked)) this.#locked = data.locked as Locked;\n    if (data.op === 'welcome') this.#welcome(data.status);\n    const item = typeof data.id === 'number' ? this.#pending.get(data.id) : undefined;\n    if (item) {\n      this.#pending.delete(data.id as number);\n      if (typeof data.version === 'number') this.#seen = Math.max(this.#seen, data.version);\n      if (data.error)\n        item.reject(new VaultRefusal(data.error.code, data.error.message ?? 'the vault refused'));\n      else item.resolve(data);\n    }\n    this.#refresh();\n  }\n\n  #welcome(status: unknown): void {\n    const given = status as { scrub?: unknown; locked?: unknown } | null;\n    const pair = given && 'scrub' in given ? pairOf(given.scrub) : undefined;\n    if (pair) this.#pair = pair;\n    if (typeof given?.locked === 'boolean') this.#locked = given.locked ? 'passkey' : 'no';\n  }\n\n  #waiting(): boolean {\n    const now = this.#now();\n    return [...this.#pending.values()].some((item) => now - item.at >= WAITING_MS);\n  }\n\n  #holding(): boolean {\n    return this.needed && (!this.#port || this.#waiting() || this.#locked === 'passkey');\n  }\n\n  #snapshot(): VaultState {\n    return {\n      port: !this.#port ? 'none' : this.#waiting() ? 'waiting' : 'ready',\n      needed: this.needed,\n      version: this.#pair.version,\n      locked: this.#locked,\n      held: this.#pending.size,\n    };\n  }\n\n  #refresh(): void {\n    const next = this.#snapshot();\n    const before = this.state.value;\n    if (Object.entries(next).some(([key, value]) => before[key as keyof VaultState] !== value))\n      this.state.replace(BACKGROUND_CONTEXT, next);\n    if (this.#holding()) return;\n    for (const resolve of this.#waiters) resolve();\n    this.#waiters.clear();\n  }\n}\n\nexport function holdText(state: VaultState): string | undefined {\n  const hold = vaultHold(state);\n  if (!hold) return undefined;\n  return hold.reason === 'locked' ? 'unlock the vault to continue' : WAITING;\n}\n\nexport function listenVault(\n  scope: { addEventListener(type: 'message', listener: (event: MessageEvent) => void): void },\n  vault: Vault\n): void {\n  scope.addEventListener('message', ({ data }) => {\n    const message = data as { vault?: MessagePort; scrub?: unknown; locked?: unknown } | null;\n    if (!message || typeof message !== 'object') return;\n    if (!('vault' in message || 'scrub' in message || 'locked' in message)) return;\n    vault.connect(message.vault, message.scrub, message.locked);\n  });\n}\n"],
+  "mappings": "AASA,SAAsC,uBAAuB;AAC7D,SAAS,0BAA0B;AAEnC,SAAS,iBAAiB;AAanB,MAAM,aAAa;AACnB,MAAM,UAAU;AAIhB,MAAM,qBAAqB,MAAM;AAAA,EAC7B;AAAA,EAET,YAAY,MAA6B,SAAiB;AACxD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AA8BA,MAAM,QAA4B,CAAC,MAAM,aAAa,SAAS;AAE/D,MAAM,QAAQ,IAAI,WAAW;AAE7B,SAAS,OAAO,OAAuC;AACrD,QAAM,OAAO;AACb,MAAI,SAAS,KAAM,QAAO,EAAE,QAAQ,OAAO,SAAS,EAAE;AACtD,MAAI,OAAO,MAAM,WAAW,aAAa,OAAO,KAAK,YAAY,SAAU,QAAO;AAClF,SAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,KAAK,QAAQ;AACtD;AAEO,MAAM,MAAuB;AAAA,EACzB;AAAA,EACA,WAAW,oBAAI,IAAqB;AAAA,EACpC,WAAW,oBAAI,IAAY;AAAA,EAC3B,WAAW,oBAAI,IAAgB;AAAA,EAC/B;AAAA,EACT;AAAA,EACA,QAAmB,EAAE,QAAQ,OAAO,SAAS,EAAE;AAAA,EAC/C,UAAkB;AAAA,EAClB,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,gBAAgB;AAAA,EACP,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,EAAE;AAAA,EAEtD,YAAY,MAAoB,KAAK,KAAK;AACxC,SAAK,OAAO;AACZ,SAAK,QAAQ,gBAA4B,KAAK,UAAU,CAAC;AAAA,EAC3D;AAAA,EAEA,IAAI,SAAkB;AACpB,WAAO,KAAK,MAAM,UAAU,KAAK,QAAQ,KAAK,MAAM;AAAA,EACtD;AAAA,EAEA,IAAI,YAAqB;AACvB,WAAO,KAAK,UAAU;AAAA,EACxB;AAAA,EAEA,QAAQ,MAA+B,OAAgB,QAAwB;AAC7E,UAAM,OAAO,UAAU,SAAY,SAAY,OAAO,KAAK;AAC3D,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,OAAO,WAAW,UAAW,MAAK,UAAU,SAAS,YAAY;AACrE,QAAI,QAAQ,SAAS,KAAK,OAAO;AAC/B,UAAI,KAAK,MAAO,MAAK,MAAM,YAAY;AACvC,WAAK,QAAQ;AACb,WAAK,YAAY,CAAC,UAAU,KAAK,QAAQ,MAAM,IAAc;AAC7D,WAAK,QAAQ;AACb,YAAM,SAAS,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC;AACzC,YAAM,UAAU,IAAI;AAAA,QAClB,OACG,OAAO,CAAC,SAAS,KAAK,QAAQ,OAAO,cAAc,EACnD,IAAI,CAAC,SAAS,KAAK,QAAQ,MAAM;AAAA,MACtC;AACA,iBAAW,UAAU,KAAK;AACxB,YAAI,CAAC,QAAQ,IAAI,MAAM,EAAG,MAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AACtE,iBAAW,QAAQ,OAAQ,MAAK,YAAY,KAAK,OAAO;AAAA,IAC1D;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,QAAuB;AACrB,QAAI,CAAC,KAAK,SAAS,EAAG,QAAO,QAAQ,QAAQ;AAC7C,WAAO,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,MAA4B,OAAmC;AACnE,QAAI,CAAC,KAAK,OAAQ,QAAO,CAAC,GAAG,KAAK;AAClC,UAAM,SAAU,MAAM,KAAK,MAAM,UAAU,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;AAKhE,WAAO,OAAO;AAAA,EAChB;AAAA,EAEA,MAAM,MAAM,UAA8B,SAAoD;AAC5F,UAAM,SAAS,aAAa,SAAY,EAAE,QAAQ,IAAI,EAAE,UAAU,QAAQ;AAC1E,YAAS,MAAM,KAAK,MAAM,SAAS,MAAM,GAAoC;AAAA,EAC/E;AAAA,EAEA,MAAM,IAAI,QAAgB,SAAoD;AAC5E,YAAS,MAAM,KAAK,MAAM,OAAO,EAAE,QAAQ,QAAQ,CAAC,GAAoC;AAAA,EAC1F;AAAA,EAEA,MAAM,UAAkC;AACtC,YAAS,MAAM,KAAK,MAAM,WAAW,CAAC,CAAC,GAAkC;AAAA,EAC3E;AAAA,EAEA,MAAM,MACJ,QACA,UACA,OACA,MACkB;AAClB,UAAM,SAAS,EAAE,QAAQ,UAAU,OAAO,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK,EAAG;AAClF,UAAM,EAAE,UAAU,OAAO,SAAS,UAAU,IAAK,MAAM,KAAK,MAAM,SAAS,MAAM;AACjF,WAAO,EAAE,UAAU,OAAO,SAAS,GAAI,cAAc,SAAY,CAAC,IAAI,EAAE,UAAU,EAAG;AAAA,EACvF;AAAA,EAEA,MAAM,QAAQ,QAAuB,MAAgC;AACnE,UAAM,SAAS,EAAE,GAAG,QAAQ,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,KAAK,EAAG;AACpE,YAAS,MAAM,KAAK,MAAM,WAAW,MAAM,GAAyB;AAAA,EACtE;AAAA,EAEA,MAAM,UAAU,KAAiC;AAC/C,UAAM,KAAK,MAAM,aAAa,EAAE,OAAO,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC;AAAA,EAClE;AAAA,EAEA,SAAsB;AACpB,QAAI;AACJ,WAAO;AAAA,MACL,MAAM,CAAC,UAAU;AACf,YAAI,WAAW,UAAa,CAAC,KAAK,OAAQ,QAAO,QAAQ,QAAQ,KAAK;AACtE,YAAI,WAAW,QAAW;AACxB,mBAAS,GAAG,KAAK,IAAI,IAAI,EAAE,KAAK,aAAa;AAC7C,eAAK,SAAS,IAAI,MAAM;AACxB,eAAK,KAAK,MAAM,gBAAgB,EAAE,OAAO,CAAC;AAAA,QAC5C;AACA,eAAO,KAAK,MAAM,QAAQ,EAAE,QAAQ,MAAM,CAAC,EAAE;AAAA,UAC3C,CAAC,WAAY,OAAiC;AAAA,QAChD;AAAA,MACF;AAAA,MACA,KAAK,YAAY;AACf,YAAI,WAAW,OAAW,QAAO;AACjC,cAAM,EAAE,OAAO,KAAK,IAAK,MAAM,KAAK,MAAM,OAAO,EAAE,OAAO,CAAC;AAC3D,aAAK,SAAS,OAAO,MAAM;AAC3B,eAAO;AAAA,MACT;AAAA,MACA,MAAM,MAAM;AACV,YAAI,WAAW,OAAW;AAC1B,cAAM,UAAU;AAChB,aAAK,SAAS,OAAO,OAAO;AAC5B,mBAAW,CAAC,IAAI,IAAI,KAAK,KAAK;AAC5B,cAAI,KAAK,QAAQ,WAAW,WAAW,KAAK,QAAQ,OAAO,gBAAgB;AACzE,iBAAK,SAAS,OAAO,EAAE;AACvB,iBAAK,QAAQ,EAAE,OAAO,MAAM,CAAC;AAAA,UAC/B;AACF,aAAK,KAAK,MAAM,QAAQ,EAAE,QAAQ,QAAQ,CAAC;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,IAAY,QAAmD;AACnE,UAAM,UAAmB,EAAE,GAAG,GAAG,IAAI,EAAE,KAAK,SAAS,IAAI,GAAG,OAAO;AACnE,UAAM,SAAS,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9C,WAAK,SAAS,IAAI,QAAQ,IAAI,EAAE,SAAS,IAAI,KAAK,KAAK,GAAG,SAAS,OAAO,CAAC;AAAA,IAC7E,CAAC;AACD,SAAK,OAAO,YAAY,OAAO;AAC/B,eAAW,MAAM,KAAK,SAAS,GAAG,UAAU;AAC5C,SAAK,SAAS;AACd,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,MAAoB;AAC1B,QAAI,CAAC,QAAQ,OAAO,SAAS,SAAU;AACvC,UAAM,OAAO,WAAW,OAAO,OAAO,KAAK,KAAK,IAAI;AACpD,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,MAAM,SAAS,KAAK,MAAM,EAAG,MAAK,UAAU,KAAK;AACrD,QAAI,KAAK,OAAO,UAAW,MAAK,SAAS,KAAK,MAAM;AACpD,UAAM,OAAO,OAAO,KAAK,OAAO,WAAW,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI;AACxE,QAAI,MAAM;AACR,WAAK,SAAS,OAAO,KAAK,EAAY;AACtC,UAAI,OAAO,KAAK,YAAY,SAAU,MAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,KAAK,OAAO;AACpF,UAAI,KAAK;AACP,aAAK,OAAO,IAAI,aAAa,KAAK,MAAM,MAAM,KAAK,MAAM,WAAW,mBAAmB,CAAC;AAAA,UACrF,MAAK,QAAQ,IAAI;AAAA,IACxB;AACA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,SAAS,QAAuB;AAC9B,UAAM,QAAQ;AACd,UAAM,OAAO,SAAS,WAAW,QAAQ,OAAO,MAAM,KAAK,IAAI;AAC/D,QAAI,KAAM,MAAK,QAAQ;AACvB,QAAI,OAAO,OAAO,WAAW,UAAW,MAAK,UAAU,MAAM,SAAS,YAAY;AAAA,EACpF;AAAA,EAEA,WAAoB;AAClB,UAAM,MAAM,KAAK,KAAK;AACtB,WAAO,CAAC,GAAG,KAAK,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,MAAM,KAAK,MAAM,UAAU;AAAA,EAC/E;AAAA,EAEA,WAAoB;AAClB,WAAO,KAAK,WAAW,CAAC,KAAK,SAAS,KAAK,SAAS,KAAK,KAAK,YAAY;AAAA,EAC5E;AAAA,EAEA,YAAwB;AACtB,WAAO;AAAA,MACL,MAAM,CAAC,KAAK,QAAQ,SAAS,KAAK,SAAS,IAAI,YAAY;AAAA,MAC3D,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK,MAAM;AAAA,MACpB,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK,SAAS;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,WAAiB;AACf,UAAM,OAAO,KAAK,UAAU;AAC5B,UAAM,SAAS,KAAK,MAAM;AAC1B,QAAI,OAAO,QAAQ,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,OAAO,GAAuB,MAAM,KAAK;AACvF,WAAK,MAAM,QAAQ,oBAAoB,IAAI;AAC7C,QAAI,KAAK,SAAS,EAAG;AACrB,eAAW,WAAW,KAAK,SAAU,SAAQ;AAC7C,SAAK,SAAS,MAAM;AAAA,EACtB;AACF;AAEO,SAAS,SAAS,OAAuC;AAC9D,QAAM,OAAO,UAAU,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,WAAW,WAAW,iCAAiC;AACrE;AAEO,SAAS,YACd,OACA,OACM;AACN,QAAM,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAAM;AAC9C,UAAM,UAAU;AAChB,QAAI,CAAC,WAAW,OAAO,YAAY,SAAU;AAC7C,QAAI,EAAE,WAAW,WAAW,WAAW,WAAW,YAAY,SAAU;AACxE,UAAM,QAAQ,QAAQ,OAAO,QAAQ,OAAO,QAAQ,MAAM;AAAA,EAC5D,CAAC;AACH;",
   "names": []
 }

package/dist/services.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/services.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  defineService,\n  type JsonValue,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { SendAttachment, ShownAttachment } from './attachments.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope, MemoryTag } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\n\nexport type SendMode = 'steer' | 'followUp' | 'reject';\n\nexport interface SendRequest {\n  text: string;\n  whenBusy: SendMode;\n  requestId: string | null;\n  agentId?: string | null;\n  attachments?: SendAttachment[];\n}\n\nexport interface OperationError {\n  code: string;\n  message: string;\n}\n\nexport type SendResponse =\n  | { accepted: true; submissionId: string; error: null }\n  | { accepted: false; submissionId: null; error: OperationError };\n\nexport type PromptResult =\n  | { status: 'done'; text: string; reason: null }\n  | { status: 'unanswered'; text: null; reason: string };\n\nexport interface AgentControl {\n  send(request: SendRequest, context: Context): Promise<SendResponse>;\n  wait(submissionId: string, context: Context): Promise<PromptResult>;\n  withdraw(\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  abort(context: Context): Promise<void>;\n  compact(instructions: string | null, context: Context): Promise<SendResponse>;\n  compactAgent(\n    agentId: string,\n    instructions: string | null,\n    context: Context\n  ): Promise<SendResponse>;\n  reset(handoff: string | null, context: Context): Promise<void>;\n  configure(change: AgentSettingsChange, context: Context): Promise<void>;\n  rewind(messageId: string | null, context: Context): Promise<Rewound>;\n  rewindAgent(agentId: string, messageId: string | null, context: Context): Promise<Rewound>;\n  resolveLick(\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  resolveAgentLick(\n    agentId: string,\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  webhook(\n    name: string,\n    delivery: WebhookRequest,\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  stopAgent(agentId: string, context: Context): Promise<void>;\n  selectCone(agentId: string, context: Context): Promise<void>;\n  createCone(name: string, context: Context): Promise<Created>;\n  createScoop(parentId: string, name: string, context: Context): Promise<Created>;\n  drop(agentId: string, context: Context): Promise<Created>;\n  unqueue(\n    agentId: string | null,\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  sprinkleSend(\n    sprinkleId: string,\n    payload: { action: string; data: JsonValue | null; target: string | null },\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  sprinkleCall(\n    sprinkleId: string,\n    method: string,\n    args: JsonValue[],\n    context: Context\n  ): Promise<JsonValue>;\n  memorySave(draft: MemoryDraft, context: Context): Promise<MemoryEntry>;\n  memoryRemove(id: string, context: Context): Promise<{ removed: boolean }>;\n  freeze(agentId: string, context: Context): Promise<Created>;\n  newChat(agentId: string, context: Context): Promise<Created>;\n  thaw(frozenId: string, context: Context): Promise<Created>;\n  discard(frozenId: string, context: Context): Promise<Created>;\n  changesOpen(context: Context): Promise<void>;\n  changeAccept(path: string, context: Context): Promise<Created>;\n  changeRevert(path: string, context: Context): Promise<Created>;\n  monitorOpen(lease: string | null, resync: boolean, context: Context): Promise<MonitorLease>;\n  monitorClose(lease: string, context: Context): Promise<void>;\n  image(ref: ImageRef, context: Context): Promise<StoredImage>;\n}\n\nexport interface ImageRef {\n  entry: number;\n  message: number;\n  part: number;\n}\n\nexport type StoredImage = { data: string; mimeType: string } | { data: null; mimeType: null };\n\nexport interface MonitorLease {\n  lease: string;\n  ttlMs: number;\n}\n\nexport interface MonitorAgent {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  model: string | null;\n  running: boolean;\n  queued: number;\n  tool: string | null;\n  retry: { attempt: number; since: number; error: string } | null;\n  failed: string | null;\n  context: number | null;\n  cpu?: number | null;\n}\n\nexport interface MonitorTask {\n  id: string;\n  kind: string;\n  detail: string | null;\n  agentId: string | null;\n  owner: string | null;\n  status: 'pending' | 'running' | 'waiting' | 'completing';\n  phase: string;\n  background: boolean;\n  aborting: number | null;\n  since: number;\n  waits: number;\n}\n\nexport interface MonitorProcess {\n  pid: number;\n  ppid: number;\n  pgid: number;\n  user: string | null;\n  agentId: string | null;\n  command: string;\n  state: 'S' | 'Z';\n  started: number;\n  zombie: number | null;\n  tty: boolean;\n  rss: number | null;\n  utime?: number;\n  stime?: number;\n  cpu?: number | null;\n}\n\nexport interface MonitorProblem {\n  id: string;\n  at: number;\n  agentId: string | null;\n  kind: 'task' | 'retry' | 'turn';\n  message: string;\n}\n\nexport interface MonitorFeed {\n  open: boolean;\n  at: number;\n  usage: { tokens: number; cost: number; free: boolean } | null;\n  agents: MonitorAgent[];\n  tasks: MonitorTask[];\n  processes: MonitorProcess[] | null;\n  kernel: 'checking' | 'ok' | 'unreachable';\n  problems: MonitorProblem[];\n  paused: boolean;\n}\n\nexport interface MemoryDraft {\n  id: string | null;\n  scope: string;\n  section: string;\n  title: string;\n  body: string;\n  tag: MemoryTag | null;\n}\n\nexport type Created = { id: string; error: null } | { id: null; error: string };\n\nexport interface AgentSummary {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  role: string | null;\n}\n\nexport interface AgentsSummary {\n  active: string;\n  agents: AgentSummary[];\n}\n\nexport type LickResolved =\n  | { done: true; text: string; error: null }\n  | { done: false; text: null; error: string };\n\nexport interface WebhookRequest {\n  id: string | null;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport type Rewound =\n  | { done: true; text: string; reason: null; attachments?: ShownAttachment[] }\n  | { done: false; text: null; reason: 'busy' | 'no-turn' };\n\nexport interface AgentSettingsChange {\n  model: { provider: string; modelId: string } | null;\n  thinkingLevel: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | null;\n  agentId?: string | null;\n}\n\nexport const AgentControl = defineService<AgentControl>('slicc.agent.control');\n\nexport type Delivered = 'run' | 'steer' | 'follow-up';\n\nexport interface AgentTranscript {\n  readonly state: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents: ReplicatedState<AgentsSummary>;\n  readonly views: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands: ReplicatedState<Command[]>;\n  readonly sprinkles: ReplicatedState<Sprinkle[]>;\n  readonly memories: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes: ReplicatedState<MemoryScope[]>;\n  readonly frozen: ReplicatedState<FrozenCone[]>;\n  readonly changes: ReplicatedState<ChangesView>;\n  readonly monitor: ReplicatedState<MonitorFeed>;\n  readonly vault: ReplicatedState<VaultState>;\n}\n\nexport interface Command {\n  name: string;\n  description: string;\n  kind: 'prompt' | 'skill' | 'action';\n}\n\nexport const AgentTranscript = defineService<AgentTranscript>('slicc.agent.transcript');\n\nexport interface AgentSessions {\n  attach(sessionId: string, context: Context): Promise<void>;\n  detach(context: Context): Promise<void>;\n}\n\nexport const AgentSessions = defineService<AgentSessions>('slicc.agent.sessions');\n\nexport const AgentRemoteService = defineService<AgentRemote>('slicc.agent.remote');\n\nexport const AgentPagesService = defineService<AgentPages>('slicc.agent.pages');\n\nexport const AGENT_SESSION = 'agent';\n\nexport interface ModelChoice {\n  id: string;\n  label: string;\n  provider: string;\n  kind: 'chat' | 'classifier';\n  reasoning: boolean;\n  images?: boolean;\n  contextWindow: number;\n}\n\nexport interface AccountState {\n  id: string;\n  provider: string;\n  identity: string;\n  status: 'connected' | 'disconnected' | 'expired';\n  auth: 'api-key' | 'oauth';\n  needs: 'cors-free-transport' | null;\n  group?: 'providers' | 'mcp';\n  secret?: 'api-key' | 'token';\n}\n\nexport interface BudgetState {\n  provider: string;\n  percent: number;\n  window: 'weekly';\n  resets: string;\n}\n\nexport interface SignIn {\n  clientId: string;\n  scopes: string;\n  imsEnvironment: string;\n}\n\nexport interface McpSignIn {\n  url: string;\n  state: string;\n}\n\nexport interface SettingsState {\n  models: ModelChoice[];\n  accounts: AccountState[];\n  budget?: BudgetState | null;\n}\n\nexport interface AgentSettings {\n  readonly state: ReplicatedState<SettingsState>;\n  connect(\n    providerId: string,\n    secret: string,\n    region: string | null,\n    context: Context\n  ): Promise<void>;\n  disconnect(providerId: string, context: Context): Promise<void>;\n  signIn(providerId: string, context: Context): Promise<SignIn | McpSignIn | null>;\n}\n\nexport const AgentSettings = defineService<AgentSettings>('slicc.agent.settings');\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,OAGK;AAkOA,MAAM,eAAe,cAA4B,qBAAqB;AAyBtE,MAAM,kBAAkB,cAA+B,wBAAwB;AAO/E,MAAM,gBAAgB,cAA6B,sBAAsB;AAEzE,MAAM,qBAAqB,cAA2B,oBAAoB;AAE1E,MAAM,oBAAoB,cAA0B,mBAAmB;AAEvE,MAAM,gBAAgB;AA2DtB,MAAM,gBAAgB,cAA6B,sBAAsB;",
+  "sourcesContent": ["import {\n  type Context,\n  defineService,\n  type JsonValue,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { SendAttachment, ShownAttachment } from './attachments.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { MemoryEntry, MemoryScope, MemoryTag } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\n\nexport type SendMode = 'steer' | 'followUp' | 'reject';\n\nexport interface SendRequest {\n  text: string;\n  whenBusy: SendMode;\n  requestId: string | null;\n  agentId?: string | null;\n  attachments?: SendAttachment[];\n}\n\nexport interface OperationError {\n  code: string;\n  message: string;\n}\n\nexport type SendResponse =\n  | { accepted: true; submissionId: string; error: null }\n  | { accepted: false; submissionId: null; error: OperationError };\n\nexport type PromptResult =\n  | { status: 'done'; text: string; reason: null }\n  | { status: 'unanswered'; text: null; reason: string };\n\nexport interface AgentControl {\n  send(request: SendRequest, context: Context): Promise<SendResponse>;\n  wait(submissionId: string, context: Context): Promise<PromptResult>;\n  withdraw(\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  abort(context: Context): Promise<void>;\n  compact(instructions: string | null, context: Context): Promise<SendResponse>;\n  compactAgent(\n    agentId: string,\n    instructions: string | null,\n    context: Context\n  ): Promise<SendResponse>;\n  reset(handoff: string | null, context: Context): Promise<void>;\n  configure(change: AgentSettingsChange, context: Context): Promise<void>;\n  rewind(messageId: string | null, context: Context): Promise<Rewound>;\n  rewindAgent(agentId: string, messageId: string | null, context: Context): Promise<Rewound>;\n  resolveLick(\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  resolveAgentLick(\n    agentId: string,\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  webhook(\n    name: string,\n    delivery: WebhookRequest,\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  stopAgent(agentId: string, context: Context): Promise<void>;\n  selectCone(agentId: string, context: Context): Promise<void>;\n  createCone(name: string, context: Context): Promise<Created>;\n  createScoop(parentId: string, name: string, context: Context): Promise<Created>;\n  drop(agentId: string, context: Context): Promise<Created>;\n  unqueue(\n    agentId: string | null,\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  sprinkleSend(\n    sprinkleId: string,\n    payload: { action: string; data: JsonValue | null; target: string | null },\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  sprinkleCall(\n    sprinkleId: string,\n    method: string,\n    args: JsonValue[],\n    context: Context\n  ): Promise<JsonValue>;\n  memorySave(draft: MemoryDraft, context: Context): Promise<MemoryEntry>;\n  memoryRemove(id: string, context: Context): Promise<{ removed: boolean }>;\n  freeze(agentId: string, context: Context): Promise<Created>;\n  newChat(agentId: string, context: Context): Promise<Created>;\n  thaw(frozenId: string, context: Context): Promise<Created>;\n  discard(frozenId: string, context: Context): Promise<Created>;\n  changesOpen(context: Context): Promise<void>;\n  changeAccept(path: string, context: Context): Promise<Created>;\n  changeRevert(path: string, context: Context): Promise<Created>;\n  monitorOpen(lease: string | null, resync: boolean, context: Context): Promise<MonitorLease>;\n  monitorClose(lease: string, context: Context): Promise<void>;\n  image(ref: ImageRef, context: Context): Promise<StoredImage>;\n}\n\nexport interface ImageRef {\n  entry: number;\n  message: number;\n  part: number;\n}\n\nexport type StoredImage = { data: string; mimeType: string } | { data: null; mimeType: null };\n\nexport interface MonitorLease {\n  lease: string;\n  ttlMs: number;\n}\n\nexport interface MonitorAgent {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  model: string | null;\n  running: boolean;\n  queued: number;\n  tool: string | null;\n  retry: { attempt: number; since: number; error: string } | null;\n  failed: string | null;\n  context: number | null;\n  cpu?: number | null;\n}\n\nexport interface MonitorTask {\n  id: string;\n  kind: string;\n  detail: string | null;\n  agentId: string | null;\n  owner: string | null;\n  status: 'pending' | 'running' | 'waiting' | 'completing';\n  phase: string;\n  background: boolean;\n  aborting: number | null;\n  since: number;\n  waits: number;\n}\n\nexport interface MonitorProcess {\n  pid: number;\n  ppid: number;\n  pgid: number;\n  user: string | null;\n  agentId: string | null;\n  command: string;\n  state: 'S' | 'Z';\n  started: number;\n  zombie: number | null;\n  tty: boolean;\n  rss: number | null;\n  utime?: number;\n  stime?: number;\n  cpu?: number | null;\n}\n\nexport interface MonitorProblem {\n  id: string;\n  at: number;\n  agentId: string | null;\n  kind: 'task' | 'retry' | 'turn';\n  message: string;\n}\n\nexport interface MonitorFeed {\n  open: boolean;\n  at: number;\n  usage: { tokens: number; cost: number; free: boolean } | null;\n  agents: MonitorAgent[];\n  tasks: MonitorTask[];\n  processes: MonitorProcess[] | null;\n  kernel: 'checking' | 'ok' | 'unreachable';\n  problems: MonitorProblem[];\n  paused: boolean;\n}\n\nexport interface MemoryDraft {\n  id: string | null;\n  scope: string;\n  section: string;\n  title: string;\n  body: string;\n  tag: MemoryTag | null;\n}\n\nexport type Created = { id: string; error: null } | { id: null; error: string };\n\nexport interface AgentSummary {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  role: string | null;\n}\n\nexport interface AgentsSummary {\n  active: string;\n  agents: AgentSummary[];\n}\n\nexport type LickResolved =\n  | { done: true; text: string; error: null }\n  | { done: false; text: null; error: string };\n\nexport interface WebhookRequest {\n  id: string | null;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport type Rewound =\n  | { done: true; text: string; reason: null; attachments?: ShownAttachment[] }\n  | { done: false; text: null; reason: 'busy' | 'no-turn' };\n\nexport interface AgentSettingsChange {\n  model: { provider: string; modelId: string } | null;\n  thinkingLevel: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | null;\n  agentId?: string | null;\n}\n\nexport const AgentControl = defineService<AgentControl>('slicc.agent.control');\n\nexport type Delivered = 'run' | 'steer' | 'follow-up';\n\nexport interface AgentTranscript {\n  readonly state: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents: ReplicatedState<AgentsSummary>;\n  readonly views: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands: ReplicatedState<Command[]>;\n  readonly sprinkles: ReplicatedState<Sprinkle[]>;\n  readonly memories: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes: ReplicatedState<MemoryScope[]>;\n  readonly frozen: ReplicatedState<FrozenCone[]>;\n  readonly changes: ReplicatedState<ChangesView>;\n  readonly monitor: ReplicatedState<MonitorFeed>;\n  readonly vault: ReplicatedState<VaultState>;\n}\n\nexport interface Command {\n  name: string;\n  description: string;\n  kind: 'prompt' | 'skill' | 'action';\n}\n\nexport const AgentTranscript = defineService<AgentTranscript>('slicc.agent.transcript');\n\nexport interface AgentSessions {\n  attach(sessionId: string, context: Context): Promise<void>;\n  detach(context: Context): Promise<void>;\n}\n\nexport const AgentSessions = defineService<AgentSessions>('slicc.agent.sessions');\n\nexport const AgentRemoteService = defineService<AgentRemote>('slicc.agent.remote');\n\nexport const AgentPagesService = defineService<AgentPages>('slicc.agent.pages');\n\nexport const AGENT_SESSION = 'agent';\n\nexport interface ModelChoice {\n  id: string;\n  label: string;\n  provider: string;\n  kind: 'chat' | 'classifier';\n  reasoning: boolean;\n  images?: boolean;\n  contextWindow: number;\n}\n\nexport interface AccountState {\n  id: string;\n  provider: string;\n  identity: string;\n  status: 'connected' | 'disconnected' | 'expired';\n  auth: 'api-key' | 'oauth';\n  needs: 'cors-free-transport' | null;\n  group?: 'providers' | 'mcp';\n  secret?: 'api-key' | 'token';\n  store?: 'vault';\n  fields?: AccountField[];\n}\n\nexport interface AccountField {\n  name: string;\n  label: string;\n  required?: boolean;\n}\n\nexport interface BudgetState {\n  provider: string;\n  percent: number;\n  window: 'weekly';\n  resets: string;\n}\n\nexport interface SignIn {\n  clientId: string;\n  scopes: string;\n  imsEnvironment: string;\n}\n\nexport interface McpSignIn {\n  url: string;\n  state: string;\n}\n\nexport interface SettingsState {\n  models: ModelChoice[];\n  accounts: AccountState[];\n  budget?: BudgetState | null;\n}\n\nexport interface AgentSettings {\n  readonly state: ReplicatedState<SettingsState>;\n  connect(\n    providerId: string,\n    secret: string | null,\n    fields: Record<string, string> | null,\n    context: Context\n  ): Promise<void>;\n  disconnect(providerId: string, context: Context): Promise<void>;\n  signIn(providerId: string, context: Context): Promise<SignIn | McpSignIn | null>;\n}\n\nexport const AgentSettings = defineService<AgentSettings>('slicc.agent.settings');\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,OAGK;AAkOA,MAAM,eAAe,cAA4B,qBAAqB;AAyBtE,MAAM,kBAAkB,cAA+B,wBAAwB;AAO/E,MAAM,gBAAgB,cAA6B,sBAAsB;AAEzE,MAAM,qBAAqB,cAA2B,oBAAoB;AAE1E,MAAM,oBAAoB,cAA0B,mBAAmB;AAEvE,MAAM,gBAAgB;AAmEtB,MAAM,gBAAgB,cAA6B,sBAAsB;",
   "names": []
 }