@ai-ecoverse/slicc-agent 3.52.1 → 4.0.0

package/dist/settings.js

@@ -14,6 +14,12 @@ import { MCP_ACCOUNT } from "./mcp/label.js";
 const BEDROCK = "amazon-bedrock";
 const DEFAULT_MODEL = { provider: BEDROCK, modelId: "us.anthropic.claude-sonnet-5-5" };
 const DEFAULT_REGIONS = { [BEDROCK]: "us-west-2" };
+const ACCOUNT_FIELDS = {
+  [BEDROCK]: [{ name: "region", label: "Region" }]
+};
+const FIELD_ENV = { region: "AWS_REGION" };
+const SIGN_IN_NEEDS_VAULT = "Adobe sign-in needs seven's vault: update seven";
+const KEY_NEEDS_VAULT = "API keys are kept in seven's vault: update seven";
 const corsFree = /* @__PURE__ */ new Set([BEDROCK, ADOBE]);
 const signIn = /* @__PURE__ */ new Set([ADOBE]);
 const BUDGET_EVERY = 5 * 60 * 1e3;
@@ -53,15 +59,52 @@ function choices(models, providers, stored) {
     }))
   );
 }
-function accounts(stored, providers) {
-  return providers.map((provider) => ({
-    id: provider.id,
-    provider: provider.name ?? provider.id,
-    identity: stored.has(provider.id) ? signIn.has(provider.id) ? "Adobe ID" : "API key" : "",
-    status: stored.has(provider.id) ? "connected" : "disconnected",
-    auth: signIn.has(provider.id) ? "oauth" : "api-key",
-    needs: corsFree.has(provider.id) ? "cors-free-transport" : null
-  }));
+function accounts(records, providers) {
+  return providers.map((provider) => {
+    const record = records.model(provider.id);
+    const fields = ACCOUNT_FIELDS[provider.id];
+    return {
+      id: provider.id,
+      provider: provider.name ?? provider.id,
+      identity: record ? signIn.has(provider.id) ? "Adobe ID" : "API key" : "",
+      status: !record ? "disconnected" : record.state === "expired" ? "expired" : "connected",
+      auth: signIn.has(provider.id) ? "oauth" : "api-key",
+      needs: corsFree.has(provider.id) ? "cors-free-transport" : null,
+      store: "vault",
+      ...fields ? { fields: fields.map((field) => ({ ...field })) } : {}
+    };
+  });
+}
+async function providerFields(store, providers) {
+  const known = /* @__PURE__ */ new Map();
+  for (const provider of providers) {
+    const saved = await store.get(`model:${provider.id}`);
+    if (saved && typeof saved === "object") known.set(provider.id, saved);
+  }
+  return {
+    get: (providerId) => known.get(providerId),
+    env(providerId) {
+      const fields = known.get(providerId);
+      if (!fields) return void 0;
+      return Object.fromEntries(
+        Object.entries(fields).flatMap(
+          ([name, value]) => FIELD_ENV[name] ? [[FIELD_ENV[name], value]] : []
+        )
+      );
+    },
+    async set(providerId, fields) {
+      const allowed = new Set((ACCOUNT_FIELDS[providerId] ?? []).map((field) => field.name));
+      const kept = Object.fromEntries(
+        Object.entries(fields ?? {}).filter(
+          ([name, value]) => allowed.has(name) && typeof value === "string" && value.trim() !== ""
+        )
+      );
+      const next = Object.keys(kept).length ? kept : void 0;
+      if (next) known.set(providerId, next);
+      else known.delete(providerId);
+      await store.set(`model:${providerId}`, next);
+    }
+  };
 }
 async function shown(run) {
   try {
@@ -73,25 +116,27 @@ async function shown(run) {
     );
   }
 }
-async function budget(credentials, usage) {
-  const credential = await credentials.read(ADOBE);
-  const key = credential?.type === "api_key" ? credential.key : void 0;
+async function budget(records, usage) {
+  const key = records.model(ADOBE)?.placeholder;
   const found = key ? await usage(key).catch(() => null) : null;
   return found ? { provider: ADOBE, ...found } : null;
 }
-async function createAgentSettings(models, credentials, providers = sliccProviders(), options = {}) {
+async function createAgentSettings(models, sources, providers = sliccProviders(), options = {}) {
   const { mcp } = options;
+  const { records, fields } = sources;
   const routed = (providerId) => providerId.startsWith(MCP_ACCOUNT) ? mcp : void 0;
   const adobe = providers.find((provider) => provider.id === ADOBE);
   const endpoint = adobe?.baseUrl ?? ADOBE_PROXY;
   const identity = adobe?.headers ?? adobeIdentity();
   const usage = options.usage ?? ((token) => adobeUsage(token, { endpoint, identity }));
   const snapshot = async () => {
-    const stored = new Set((await credentials.list()).map((info) => info.providerId));
+    const stored = new Set(
+      providers.filter((provider) => records.model(provider.id)).map((provider) => provider.id)
+    );
     return {
       models: choices(models, providers, stored),
-      accounts: [...accounts(stored, providers), ...await mcp?.accounts() ?? []],
-      budget: await budget(credentials, usage)
+      accounts: [...accounts(records, providers), ...await mcp?.accounts() ?? []],
+      budget: await budget(records, usage)
     };
   };
   const state = replicatedState(await snapshot());
@@ -113,20 +158,32 @@ async function createAgentSettings(models, credentials, providers = sliccProvide
     timer.unref?.();
   }
   mcp?.onChange(() => void refresh(BACKGROUND_CONTEXT).catch(() => void 0));
+  const held = () => signedIn.filter((id) => records.model(id)).join(" ");
+  let seen = held();
+  records.state.subscribe(() => {
+    const now = held();
+    const added = now !== seen;
+    seen = now;
+    const discovered = added ? discover(signedIn) : Promise.resolve();
+    void discovered.then(() => refresh(BACKGROUND_CONTEXT)).catch(() => void 0);
+  });
+  const reread = (context) => records.refresh(context).catch(() => void 0);
   return {
     state,
-    async connect(providerId, secret, region, context) {
+    async connect(providerId, secret, given, context) {
       const server = routed(providerId);
       if (server) {
         await shown(() => server.connect(providerId, secret));
         await refresh(context);
         return;
       }
-      await credentials.modify(providerId, async () => ({
-        type: "api_key",
-        key: secret,
-        ...region ? { env: { AWS_REGION: region } } : {}
-      }));
+      if (secret !== null)
+        throw new RemoteServiceError(
+          "service_invalid_value",
+          signIn.has(providerId) ? SIGN_IN_NEEDS_VAULT : KEY_NEEDS_VAULT
+        );
+      if (given !== null) await fields.set(providerId, given);
+      await reread(context);
       if (signIn.has(providerId)) await discover([providerId]);
       await refresh(context);
     },
@@ -144,17 +201,22 @@ async function createAgentSettings(models, credentials, providers = sliccProvide
     async disconnect(providerId, context) {
       const server = routed(providerId);
       if (server) await server.disconnect(providerId);
-      else await credentials.delete(providerId);
+      else await fields.set(providerId, void 0);
+      await reread(context);
       await refresh(context);
     }
   };
 }
 export {
+  ACCOUNT_FIELDS,
   BEDROCK,
   DEFAULT_MODEL,
   DEFAULT_REGIONS,
+  KEY_NEEDS_VAULT,
+  SIGN_IN_NEEDS_VAULT,
   createAgentSettings,
   createSliccModels,
+  providerFields,
   shown,
   sliccProviders,
   withDefaultRegions

package/dist/settings.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/settings.ts"],
-  "sourcesContent": ["import { type Context, RemoteServiceError, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport { createModels, type MutableModels } from '@earendil-works/pi-ai/models';\nimport { amazonBedrockProvider } from '@earendil-works/pi-ai/providers/amazon-bedrock';\nimport {\n  ADOBE,\n  ADOBE_PROXY,\n  adobeConfig,\n  adobeIdentity,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nimport type { McpAccounts } from './mcp/index.ts';\nimport { MCP_ACCOUNT } from './mcp/label.ts';\nimport type { AccountState, AgentSettings, ModelChoice, SettingsState } from './services.ts';\n\nexport const BEDROCK = 'amazon-bedrock';\nexport const DEFAULT_MODEL = { provider: BEDROCK, modelId: 'us.anthropic.claude-sonnet-5-5' };\nexport const DEFAULT_REGIONS: Readonly<Record<string, string>> = { [BEDROCK]: 'us-west-2' };\n\nconst corsFree = new Set([BEDROCK, ADOBE]);\nconst signIn = new Set([ADOBE]);\nconst BUDGET_EVERY = 5 * 60 * 1000;\n\nexport function sliccProviders(version?: string): Provider[] {\n  return [amazonBedrockProvider() as Provider, adobeProvider({ version })];\n}\n\nexport function withDefaultRegions(credentials: CredentialStore): CredentialStore {\n  return {\n    async read(providerId, options) {\n      const credential = await credentials.read(providerId, options);\n      const region = DEFAULT_REGIONS[providerId];\n      if (credential?.type !== 'api_key' || !region || credential.env?.AWS_REGION) {\n        return credential;\n      }\n      return { ...credential, env: { ...credential.env, AWS_REGION: region } };\n    },\n    list: (options) => credentials.list(options),\n    modify: (providerId, fn, options) => credentials.modify(providerId, fn, options),\n    delete: (providerId, options) => credentials.delete(providerId, options),\n  };\n}\n\nexport function createSliccModels(\n  credentials: CredentialStore,\n  providers = sliccProviders()\n): MutableModels {\n  const models = createModels({ credentials: withDefaultRegions(credentials) });\n  for (const provider of providers) models.setProvider(provider);\n  return models;\n}\n\nfunction choices(\n  models: MutableModels,\n  providers: Provider[],\n  stored: ReadonlySet<string>\n): ModelChoice[] {\n  return providers\n    .filter((provider) => stored.has(provider.id))\n    .flatMap((provider) =>\n      models.getModels(provider.id).map((model) => ({\n        id: `${provider.id}/${model.id}`,\n        label: model.name,\n        provider: provider.name ?? provider.id,\n        kind: 'chat' as const,\n        reasoning: Boolean(model.reasoning),\n        images: model.input.includes('image'),\n        contextWindow: model.contextWindow,\n      }))\n    );\n}\n\nfunction accounts(stored: ReadonlySet<string>, providers: Provider[]): AccountState[] {\n  return providers.map((provider) => ({\n    id: provider.id,\n    provider: provider.name ?? provider.id,\n    identity: stored.has(provider.id) ? (signIn.has(provider.id) ? 'Adobe ID' : 'API key') : '',\n    status: stored.has(provider.id) ? 'connected' : 'disconnected',\n    auth: signIn.has(provider.id) ? 'oauth' : 'api-key',\n    needs: corsFree.has(provider.id) ? 'cors-free-transport' : null,\n  }));\n}\n\nexport async function shown<T>(run: () => Promise<T>): Promise<T> {\n  try {\n    return await run();\n  } catch (error) {\n    throw new RemoteServiceError(\n      'service_invalid_value',\n      error instanceof Error ? error.message : String(error)\n    );\n  }\n}\n\nexport type UsageReader = (token: string) => Promise<Budget | null>;\n\nasync function budget(credentials: CredentialStore, usage: UsageReader) {\n  const credential = await credentials.read(ADOBE);\n  const key = credential?.type === 'api_key' ? credential.key : undefined;\n  const found = key ? await usage(key).catch(() => null) : null;\n  return found ? { provider: ADOBE, ...found } : null;\n}\n\nexport async function createAgentSettings(\n  models: MutableModels,\n  credentials: CredentialStore,\n  providers = sliccProviders(),\n  options: { usage?: UsageReader; every?: number; mcp?: McpAccounts } = {}\n): Promise<AgentSettings> {\n  const { mcp } = options;\n  const routed = (providerId: string) => (providerId.startsWith(MCP_ACCOUNT) ? mcp : undefined);\n  const adobe = providers.find((provider) => provider.id === ADOBE);\n  const endpoint = adobe?.baseUrl ?? ADOBE_PROXY;\n  const identity = (adobe?.headers as Record<string, string> | undefined) ?? adobeIdentity();\n  const usage = options.usage ?? ((token: string) => adobeUsage(token, { endpoint, identity }));\n  const snapshot = async (): Promise<SettingsState> => {\n    const stored = new Set((await credentials.list()).map((info) => info.providerId));\n    return {\n      models: choices(models, providers, stored),\n      accounts: [...accounts(stored, providers), ...((await mcp?.accounts()) ?? [])],\n      budget: await budget(credentials, usage),\n    };\n  };\n  const state = replicatedState<SettingsState>(await snapshot());\n  let latest = Promise.resolve();\n  const refresh = (context: Context) => {\n    const next = latest.then(async () => state.replace(context, await snapshot()));\n    latest = next.catch(() => undefined);\n    return next;\n  };\n  const signedIn = providers\n    .filter((provider) => signIn.has(provider.id))\n    .map((provider) => provider.id);\n  const discover = (ids: string[]) =>\n    models.refresh({ providers: ids }).then(\n      () => undefined,\n      () => undefined\n    );\n  if (signedIn.length) {\n    const cycle = () =>\n      void discover(signedIn)\n        .then(() => refresh(BACKGROUND_CONTEXT))\n        .catch(() => undefined);\n    cycle();\n    const timer: unknown = setInterval(cycle, options.every ?? BUDGET_EVERY);\n    (timer as { unref?: () => void }).unref?.();\n  }\n  mcp?.onChange(() => void refresh(BACKGROUND_CONTEXT).catch(() => undefined));\n  return {\n    state,\n    async connect(providerId, secret, region, context) {\n      const server = routed(providerId);\n      if (server) {\n        await shown(() => server.connect(providerId, secret));\n        await refresh(context);\n        return;\n      }\n      await credentials.modify(providerId, async () => ({\n        type: 'api_key',\n        key: secret,\n        ...(region ? { env: { AWS_REGION: region } } : {}),\n      }));\n      if (signIn.has(providerId)) await discover([providerId]);\n      await refresh(context);\n    },\n    async signIn(providerId) {\n      const server = routed(providerId);\n      if (server) return shown(() => server.signIn(providerId));\n      if (providerId !== ADOBE) return null;\n      const { clientId, scopes, imsEnvironment } = await adobeConfig(\n        endpoint,\n        (input, init) => globalThis.fetch(input, init),\n        identity\n      );\n      return { clientId, scopes, imsEnvironment: imsEnvironment || 'prod' };\n    },\n    async disconnect(providerId, context) {\n      const server = routed(providerId);\n      if (server) await server.disconnect(providerId);\n      else await credentials.delete(providerId);\n      await refresh(context);\n    },\n  };\n}\n"],
-  "mappings": "AAAA,SAAuB,oBAAoB,uBAAuB;AAClE,SAAS,0BAA0B;AAEnC,SAAS,oBAAwC;AACjD,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,mBAAmB;AAGrB,MAAM,UAAU;AAChB,MAAM,gBAAgB,EAAE,UAAU,SAAS,SAAS,iCAAiC;AACrF,MAAM,kBAAoD,EAAE,CAAC,OAAO,GAAG,YAAY;AAE1F,MAAM,WAAW,oBAAI,IAAI,CAAC,SAAS,KAAK,CAAC;AACzC,MAAM,SAAS,oBAAI,IAAI,CAAC,KAAK,CAAC;AAC9B,MAAM,eAAe,IAAI,KAAK;AAEvB,SAAS,eAAe,SAA8B;AAC3D,SAAO,CAAC,sBAAsB,GAAe,cAAc,EAAE,QAAQ,CAAC,CAAC;AACzE;AAEO,SAAS,mBAAmB,aAA+C;AAChF,SAAO;AAAA,IACL,MAAM,KAAK,YAAY,SAAS;AAC9B,YAAM,aAAa,MAAM,YAAY,KAAK,YAAY,OAAO;AAC7D,YAAM,SAAS,gBAAgB,UAAU;AACzC,UAAI,YAAY,SAAS,aAAa,CAAC,UAAU,WAAW,KAAK,YAAY;AAC3E,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,YAAY,KAAK,EAAE,GAAG,WAAW,KAAK,YAAY,OAAO,EAAE;AAAA,IACzE;AAAA,IACA,MAAM,CAAC,YAAY,YAAY,KAAK,OAAO;AAAA,IAC3C,QAAQ,CAAC,YAAY,IAAI,YAAY,YAAY,OAAO,YAAY,IAAI,OAAO;AAAA,IAC/E,QAAQ,CAAC,YAAY,YAAY,YAAY,OAAO,YAAY,OAAO;AAAA,EACzE;AACF;AAEO,SAAS,kBACd,aACA,YAAY,eAAe,GACZ;AACf,QAAM,SAAS,aAAa,EAAE,aAAa,mBAAmB,WAAW,EAAE,CAAC;AAC5E,aAAW,YAAY,UAAW,QAAO,YAAY,QAAQ;AAC7D,SAAO;AACT;AAEA,SAAS,QACP,QACA,WACA,QACe;AACf,SAAO,UACJ,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C;AAAA,IAAQ,CAAC,aACR,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW;AAAA,MAC5C,IAAI,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,MAC9B,OAAO,MAAM;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,WAAW,QAAQ,MAAM,SAAS;AAAA,MAClC,QAAQ,MAAM,MAAM,SAAS,OAAO;AAAA,MACpC,eAAe,MAAM;AAAA,IACvB,EAAE;AAAA,EACJ;AACJ;AAEA,SAAS,SAAS,QAA6B,WAAuC;AACpF,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,IAAI,SAAS;AAAA,IACb,UAAU,SAAS,QAAQ,SAAS;AAAA,IACpC,UAAU,OAAO,IAAI,SAAS,EAAE,IAAK,OAAO,IAAI,SAAS,EAAE,IAAI,aAAa,YAAa;AAAA,IACzF,QAAQ,OAAO,IAAI,SAAS,EAAE,IAAI,cAAc;AAAA,IAChD,MAAM,OAAO,IAAI,SAAS,EAAE,IAAI,UAAU;AAAA,IAC1C,OAAO,SAAS,IAAI,SAAS,EAAE,IAAI,wBAAwB;AAAA,EAC7D,EAAE;AACJ;AAEA,eAAsB,MAAS,KAAmC;AAChE,MAAI;AACF,WAAO,MAAM,IAAI;AAAA,EACnB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAIA,eAAe,OAAO,aAA8B,OAAoB;AACtE,QAAM,aAAa,MAAM,YAAY,KAAK,KAAK;AAC/C,QAAM,MAAM,YAAY,SAAS,YAAY,WAAW,MAAM;AAC9D,QAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,IAAI,IAAI;AACzD,SAAO,QAAQ,EAAE,UAAU,OAAO,GAAG,MAAM,IAAI;AACjD;AAEA,eAAsB,oBACpB,QACA,aACA,YAAY,eAAe,GAC3B,UAAsE,CAAC,GAC/C;AACxB,QAAM,EAAE,IAAI,IAAI;AAChB,QAAM,SAAS,CAAC,eAAwB,WAAW,WAAW,WAAW,IAAI,MAAM;AACnF,QAAM,QAAQ,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,KAAK;AAChE,QAAM,WAAW,OAAO,WAAW;AACnC,QAAM,WAAY,OAAO,WAAkD,cAAc;AACzF,QAAM,QAAQ,QAAQ,UAAU,CAAC,UAAkB,WAAW,OAAO,EAAE,UAAU,SAAS,CAAC;AAC3F,QAAM,WAAW,YAAoC;AACnD,UAAM,SAAS,IAAI,KAAK,MAAM,YAAY,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC;AAChF,WAAO;AAAA,MACL,QAAQ,QAAQ,QAAQ,WAAW,MAAM;AAAA,MACzC,UAAU,CAAC,GAAG,SAAS,QAAQ,SAAS,GAAG,GAAK,MAAM,KAAK,SAAS,KAAM,CAAC,CAAE;AAAA,MAC7E,QAAQ,MAAM,OAAO,aAAa,KAAK;AAAA,IACzC;AAAA,EACF;AACA,QAAM,QAAQ,gBAA+B,MAAM,SAAS,CAAC;AAC7D,MAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,OAAO,OAAO,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,SAAS,CAAC,CAAC;AAC7E,aAAS,KAAK,MAAM,MAAM,MAAS;AACnC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,UACd,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C,IAAI,CAAC,aAAa,SAAS,EAAE;AAChC,QAAM,WAAW,CAAC,QAChB,OAAO,QAAQ,EAAE,WAAW,IAAI,CAAC,EAAE;AAAA,IACjC,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACF,MAAI,SAAS,QAAQ;AACnB,UAAM,QAAQ,MACZ,KAAK,SAAS,QAAQ,EACnB,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EACtC,MAAM,MAAM,MAAS;AAC1B,UAAM;AACN,UAAM,QAAiB,YAAY,OAAO,QAAQ,SAAS,YAAY;AACvE,IAAC,MAAiC,QAAQ;AAAA,EAC5C;AACA,OAAK,SAAS,MAAM,KAAK,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS,CAAC;AAC3E,SAAO;AAAA,IACL;AAAA,IACA,MAAM,QAAQ,YAAY,QAAQ,QAAQ,SAAS;AACjD,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,QAAQ;AACV,cAAM,MAAM,MAAM,OAAO,QAAQ,YAAY,MAAM,CAAC;AACpD,cAAM,QAAQ,OAAO;AACrB;AAAA,MACF;AACA,YAAM,YAAY,OAAO,YAAY,aAAa;AAAA,QAChD,MAAM;AAAA,QACN,KAAK;AAAA,QACL,GAAI,SAAS,EAAE,KAAK,EAAE,YAAY,OAAO,EAAE,IAAI,CAAC;AAAA,MAClD,EAAE;AACF,UAAI,OAAO,IAAI,UAAU,EAAG,OAAM,SAAS,CAAC,UAAU,CAAC;AACvD,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,IACA,MAAM,OAAO,YAAY;AACvB,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,QAAO,MAAM,MAAM,OAAO,OAAO,UAAU,CAAC;AACxD,UAAI,eAAe,MAAO,QAAO;AACjC,YAAM,EAAE,UAAU,QAAQ,eAAe,IAAI,MAAM;AAAA,QACjD;AAAA,QACA,CAAC,OAAO,SAAS,WAAW,MAAM,OAAO,IAAI;AAAA,QAC7C;AAAA,MACF;AACA,aAAO,EAAE,UAAU,QAAQ,gBAAgB,kBAAkB,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,WAAW,YAAY,SAAS;AACpC,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,OAAM,OAAO,WAAW,UAAU;AAAA,UACzC,OAAM,YAAY,OAAO,UAAU;AACxC,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { type Context, RemoteServiceError, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport { createModels, type MutableModels } from '@earendil-works/pi-ai/models';\nimport { amazonBedrockProvider } from '@earendil-works/pi-ai/providers/amazon-bedrock';\nimport {\n  ADOBE,\n  ADOBE_PROXY,\n  adobeConfig,\n  adobeIdentity,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nimport type { McpAccounts } from './mcp/index.ts';\nimport { MCP_ACCOUNT } from './mcp/label.ts';\nimport type { VaultRecords } from './secrets/records.ts';\nimport type { PlainStore } from './secrets/store.ts';\nimport type {\n  AccountField,\n  AccountState,\n  AgentSettings,\n  ModelChoice,\n  SettingsState,\n} from './services.ts';\n\nexport const BEDROCK = 'amazon-bedrock';\nexport const DEFAULT_MODEL = { provider: BEDROCK, modelId: 'us.anthropic.claude-sonnet-5-5' };\nexport const DEFAULT_REGIONS: Readonly<Record<string, string>> = { [BEDROCK]: 'us-west-2' };\n\nexport const ACCOUNT_FIELDS: Readonly<Record<string, readonly AccountField[]>> = {\n  [BEDROCK]: [{ name: 'region', label: 'Region' }],\n};\nconst FIELD_ENV: Readonly<Record<string, string>> = { region: 'AWS_REGION' };\nexport const SIGN_IN_NEEDS_VAULT = \"Adobe sign-in needs seven's vault: update seven\";\nexport const KEY_NEEDS_VAULT = \"API keys are kept in seven's vault: update seven\";\n\nconst corsFree = new Set([BEDROCK, ADOBE]);\nconst signIn = new Set([ADOBE]);\nconst BUDGET_EVERY = 5 * 60 * 1000;\n\nexport function sliccProviders(version?: string): Provider[] {\n  return [amazonBedrockProvider() as Provider, adobeProvider({ version })];\n}\n\nexport function withDefaultRegions(credentials: CredentialStore): CredentialStore {\n  return {\n    async read(providerId, options) {\n      const credential = await credentials.read(providerId, options);\n      const region = DEFAULT_REGIONS[providerId];\n      if (credential?.type !== 'api_key' || !region || credential.env?.AWS_REGION) {\n        return credential;\n      }\n      return { ...credential, env: { ...credential.env, AWS_REGION: region } };\n    },\n    list: (options) => credentials.list(options),\n    modify: (providerId, fn, options) => credentials.modify(providerId, fn, options),\n    delete: (providerId, options) => credentials.delete(providerId, options),\n  };\n}\n\nexport function createSliccModels(\n  credentials: CredentialStore,\n  providers = sliccProviders()\n): MutableModels {\n  const models = createModels({ credentials: withDefaultRegions(credentials) });\n  for (const provider of providers) models.setProvider(provider);\n  return models;\n}\n\nfunction choices(\n  models: MutableModels,\n  providers: Provider[],\n  stored: ReadonlySet<string>\n): ModelChoice[] {\n  return providers\n    .filter((provider) => stored.has(provider.id))\n    .flatMap((provider) =>\n      models.getModels(provider.id).map((model) => ({\n        id: `${provider.id}/${model.id}`,\n        label: model.name,\n        provider: provider.name ?? provider.id,\n        kind: 'chat' as const,\n        reasoning: Boolean(model.reasoning),\n        images: model.input.includes('image'),\n        contextWindow: model.contextWindow,\n      }))\n    );\n}\n\nfunction accounts(records: Pick<VaultRecords, 'model'>, providers: Provider[]): AccountState[] {\n  return providers.map((provider) => {\n    const record = records.model(provider.id);\n    const fields = ACCOUNT_FIELDS[provider.id];\n    return {\n      id: provider.id,\n      provider: provider.name ?? provider.id,\n      identity: record ? (signIn.has(provider.id) ? 'Adobe ID' : 'API key') : '',\n      status: !record ? 'disconnected' : record.state === 'expired' ? 'expired' : 'connected',\n      auth: signIn.has(provider.id) ? 'oauth' : 'api-key',\n      needs: corsFree.has(provider.id) ? 'cors-free-transport' : null,\n      store: 'vault',\n      ...(fields ? { fields: fields.map((field) => ({ ...field })) } : {}),\n    };\n  });\n}\n\nexport interface ProviderFields {\n  get(providerId: string): Readonly<Record<string, string>> | undefined;\n  env(providerId: string): Readonly<Record<string, string>> | undefined;\n  set(providerId: string, fields: Record<string, string> | undefined): Promise<void>;\n}\n\nexport async function providerFields(\n  store: PlainStore,\n  providers: readonly Provider[]\n): Promise<ProviderFields> {\n  const known = new Map<string, Record<string, string>>();\n  for (const provider of providers) {\n    const saved = (await store.get(`model:${provider.id}`)) as Record<string, string> | undefined;\n    if (saved && typeof saved === 'object') known.set(provider.id, saved);\n  }\n  return {\n    get: (providerId) => known.get(providerId),\n    env(providerId) {\n      const fields = known.get(providerId);\n      if (!fields) return undefined;\n      return Object.fromEntries(\n        Object.entries(fields).flatMap(([name, value]) =>\n          FIELD_ENV[name] ? [[FIELD_ENV[name], value]] : []\n        )\n      );\n    },\n    async set(providerId, fields) {\n      const allowed = new Set((ACCOUNT_FIELDS[providerId] ?? []).map((field) => field.name));\n      const kept = Object.fromEntries(\n        Object.entries(fields ?? {}).filter(\n          ([name, value]) => allowed.has(name) && typeof value === 'string' && value.trim() !== ''\n        )\n      );\n      const next = Object.keys(kept).length ? kept : undefined;\n      if (next) known.set(providerId, next);\n      else known.delete(providerId);\n      await store.set(`model:${providerId}`, next);\n    },\n  };\n}\n\nexport async function shown<T>(run: () => Promise<T>): Promise<T> {\n  try {\n    return await run();\n  } catch (error) {\n    throw new RemoteServiceError(\n      'service_invalid_value',\n      error instanceof Error ? error.message : String(error)\n    );\n  }\n}\n\nexport type UsageReader = (token: string) => Promise<Budget | null>;\n\nasync function budget(records: Pick<VaultRecords, 'model'>, usage: UsageReader) {\n  const key = records.model(ADOBE)?.placeholder;\n  const found = key ? await usage(key).catch(() => null) : null;\n  return found ? { provider: ADOBE, ...found } : null;\n}\n\nexport interface SettingsSources {\n  records: VaultRecords;\n  fields: ProviderFields;\n}\n\nexport async function createAgentSettings(\n  models: MutableModels,\n  sources: SettingsSources,\n  providers = sliccProviders(),\n  options: { usage?: UsageReader; every?: number; mcp?: McpAccounts } = {}\n): Promise<AgentSettings> {\n  const { mcp } = options;\n  const { records, fields } = sources;\n  const routed = (providerId: string) => (providerId.startsWith(MCP_ACCOUNT) ? mcp : undefined);\n  const adobe = providers.find((provider) => provider.id === ADOBE);\n  const endpoint = adobe?.baseUrl ?? ADOBE_PROXY;\n  const identity = (adobe?.headers as Record<string, string> | undefined) ?? adobeIdentity();\n  const usage = options.usage ?? ((token: string) => adobeUsage(token, { endpoint, identity }));\n  const snapshot = async (): Promise<SettingsState> => {\n    const stored = new Set(\n      providers.filter((provider) => records.model(provider.id)).map((provider) => provider.id)\n    );\n    return {\n      models: choices(models, providers, stored),\n      accounts: [...accounts(records, providers), ...((await mcp?.accounts()) ?? [])],\n      budget: await budget(records, usage),\n    };\n  };\n  const state = replicatedState<SettingsState>(await snapshot());\n  let latest = Promise.resolve();\n  const refresh = (context: Context) => {\n    const next = latest.then(async () => state.replace(context, await snapshot()));\n    latest = next.catch(() => undefined);\n    return next;\n  };\n  const signedIn = providers\n    .filter((provider) => signIn.has(provider.id))\n    .map((provider) => provider.id);\n  const discover = (ids: string[]) =>\n    models.refresh({ providers: ids }).then(\n      () => undefined,\n      () => undefined\n    );\n  if (signedIn.length) {\n    const cycle = () =>\n      void discover(signedIn)\n        .then(() => refresh(BACKGROUND_CONTEXT))\n        .catch(() => undefined);\n    cycle();\n    const timer: unknown = setInterval(cycle, options.every ?? BUDGET_EVERY);\n    (timer as { unref?: () => void }).unref?.();\n  }\n  mcp?.onChange(() => void refresh(BACKGROUND_CONTEXT).catch(() => undefined));\n  const held = () => signedIn.filter((id) => records.model(id)).join(' ');\n  let seen = held();\n  records.state.subscribe(() => {\n    const now = held();\n    const added = now !== seen;\n    seen = now;\n    const discovered = added ? discover(signedIn) : Promise.resolve();\n    void discovered.then(() => refresh(BACKGROUND_CONTEXT)).catch(() => undefined);\n  });\n  const reread = (context: Context) => records.refresh(context).catch(() => undefined);\n  return {\n    state,\n    async connect(providerId, secret, given, context) {\n      const server = routed(providerId);\n      if (server) {\n        await shown(() => server.connect(providerId, secret));\n        await refresh(context);\n        return;\n      }\n      if (secret !== null)\n        throw new RemoteServiceError(\n          'service_invalid_value',\n          signIn.has(providerId) ? SIGN_IN_NEEDS_VAULT : KEY_NEEDS_VAULT\n        );\n      if (given !== null) await fields.set(providerId, given);\n      await reread(context);\n      if (signIn.has(providerId)) await discover([providerId]);\n      await refresh(context);\n    },\n    async signIn(providerId) {\n      const server = routed(providerId);\n      if (server) return shown(() => server.signIn(providerId));\n      if (providerId !== ADOBE) return null;\n      const { clientId, scopes, imsEnvironment } = await adobeConfig(\n        endpoint,\n        (input, init) => globalThis.fetch(input, init),\n        identity\n      );\n      return { clientId, scopes, imsEnvironment: imsEnvironment || 'prod' };\n    },\n    async disconnect(providerId, context) {\n      const server = routed(providerId);\n      if (server) await server.disconnect(providerId);\n      else await fields.set(providerId, undefined);\n      await reread(context);\n      await refresh(context);\n    },\n  };\n}\n"],
+  "mappings": "AAAA,SAAuB,oBAAoB,uBAAuB;AAClE,SAAS,0BAA0B;AAEnC,SAAS,oBAAwC;AACjD,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,mBAAmB;AAWrB,MAAM,UAAU;AAChB,MAAM,gBAAgB,EAAE,UAAU,SAAS,SAAS,iCAAiC;AACrF,MAAM,kBAAoD,EAAE,CAAC,OAAO,GAAG,YAAY;AAEnF,MAAM,iBAAoE;AAAA,EAC/E,CAAC,OAAO,GAAG,CAAC,EAAE,MAAM,UAAU,OAAO,SAAS,CAAC;AACjD;AACA,MAAM,YAA8C,EAAE,QAAQ,aAAa;AACpE,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AAE/B,MAAM,WAAW,oBAAI,IAAI,CAAC,SAAS,KAAK,CAAC;AACzC,MAAM,SAAS,oBAAI,IAAI,CAAC,KAAK,CAAC;AAC9B,MAAM,eAAe,IAAI,KAAK;AAEvB,SAAS,eAAe,SAA8B;AAC3D,SAAO,CAAC,sBAAsB,GAAe,cAAc,EAAE,QAAQ,CAAC,CAAC;AACzE;AAEO,SAAS,mBAAmB,aAA+C;AAChF,SAAO;AAAA,IACL,MAAM,KAAK,YAAY,SAAS;AAC9B,YAAM,aAAa,MAAM,YAAY,KAAK,YAAY,OAAO;AAC7D,YAAM,SAAS,gBAAgB,UAAU;AACzC,UAAI,YAAY,SAAS,aAAa,CAAC,UAAU,WAAW,KAAK,YAAY;AAC3E,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,YAAY,KAAK,EAAE,GAAG,WAAW,KAAK,YAAY,OAAO,EAAE;AAAA,IACzE;AAAA,IACA,MAAM,CAAC,YAAY,YAAY,KAAK,OAAO;AAAA,IAC3C,QAAQ,CAAC,YAAY,IAAI,YAAY,YAAY,OAAO,YAAY,IAAI,OAAO;AAAA,IAC/E,QAAQ,CAAC,YAAY,YAAY,YAAY,OAAO,YAAY,OAAO;AAAA,EACzE;AACF;AAEO,SAAS,kBACd,aACA,YAAY,eAAe,GACZ;AACf,QAAM,SAAS,aAAa,EAAE,aAAa,mBAAmB,WAAW,EAAE,CAAC;AAC5E,aAAW,YAAY,UAAW,QAAO,YAAY,QAAQ;AAC7D,SAAO;AACT;AAEA,SAAS,QACP,QACA,WACA,QACe;AACf,SAAO,UACJ,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C;AAAA,IAAQ,CAAC,aACR,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW;AAAA,MAC5C,IAAI,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,MAC9B,OAAO,MAAM;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,WAAW,QAAQ,MAAM,SAAS;AAAA,MAClC,QAAQ,MAAM,MAAM,SAAS,OAAO;AAAA,MACpC,eAAe,MAAM;AAAA,IACvB,EAAE;AAAA,EACJ;AACJ;AAEA,SAAS,SAAS,SAAsC,WAAuC;AAC7F,SAAO,UAAU,IAAI,CAAC,aAAa;AACjC,UAAM,SAAS,QAAQ,MAAM,SAAS,EAAE;AACxC,UAAM,SAAS,eAAe,SAAS,EAAE;AACzC,WAAO;AAAA,MACL,IAAI,SAAS;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,UAAU,SAAU,OAAO,IAAI,SAAS,EAAE,IAAI,aAAa,YAAa;AAAA,MACxE,QAAQ,CAAC,SAAS,iBAAiB,OAAO,UAAU,YAAY,YAAY;AAAA,MAC5E,MAAM,OAAO,IAAI,SAAS,EAAE,IAAI,UAAU;AAAA,MAC1C,OAAO,SAAS,IAAI,SAAS,EAAE,IAAI,wBAAwB;AAAA,MAC3D,OAAO;AAAA,MACP,GAAI,SAAS,EAAE,QAAQ,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACpE;AAAA,EACF,CAAC;AACH;AAQA,eAAsB,eACpB,OACA,WACyB;AACzB,QAAM,QAAQ,oBAAI,IAAoC;AACtD,aAAW,YAAY,WAAW;AAChC,UAAM,QAAS,MAAM,MAAM,IAAI,SAAS,SAAS,EAAE,EAAE;AACrD,QAAI,SAAS,OAAO,UAAU,SAAU,OAAM,IAAI,SAAS,IAAI,KAAK;AAAA,EACtE;AACA,SAAO;AAAA,IACL,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU;AAAA,IACzC,IAAI,YAAY;AACd,YAAM,SAAS,MAAM,IAAI,UAAU;AACnC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,OAAO;AAAA,QACZ,OAAO,QAAQ,MAAM,EAAE;AAAA,UAAQ,CAAC,CAAC,MAAM,KAAK,MAC1C,UAAU,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,YAAY,QAAQ;AAC5B,YAAM,UAAU,IAAI,KAAK,eAAe,UAAU,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AACrF,YAAM,OAAO,OAAO;AAAA,QAClB,OAAO,QAAQ,UAAU,CAAC,CAAC,EAAE;AAAA,UAC3B,CAAC,CAAC,MAAM,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,QACxF;AAAA,MACF;AACA,YAAM,OAAO,OAAO,KAAK,IAAI,EAAE,SAAS,OAAO;AAC/C,UAAI,KAAM,OAAM,IAAI,YAAY,IAAI;AAAA,UAC/B,OAAM,OAAO,UAAU;AAC5B,YAAM,MAAM,IAAI,SAAS,UAAU,IAAI,IAAI;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,eAAsB,MAAS,KAAmC;AAChE,MAAI;AACF,WAAO,MAAM,IAAI;AAAA,EACnB,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAIA,eAAe,OAAO,SAAsC,OAAoB;AAC9E,QAAM,MAAM,QAAQ,MAAM,KAAK,GAAG;AAClC,QAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,IAAI,IAAI;AACzD,SAAO,QAAQ,EAAE,UAAU,OAAO,GAAG,MAAM,IAAI;AACjD;AAOA,eAAsB,oBACpB,QACA,SACA,YAAY,eAAe,GAC3B,UAAsE,CAAC,GAC/C;AACxB,QAAM,EAAE,IAAI,IAAI;AAChB,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,SAAS,CAAC,eAAwB,WAAW,WAAW,WAAW,IAAI,MAAM;AACnF,QAAM,QAAQ,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,KAAK;AAChE,QAAM,WAAW,OAAO,WAAW;AACnC,QAAM,WAAY,OAAO,WAAkD,cAAc;AACzF,QAAM,QAAQ,QAAQ,UAAU,CAAC,UAAkB,WAAW,OAAO,EAAE,UAAU,SAAS,CAAC;AAC3F,QAAM,WAAW,YAAoC;AACnD,UAAM,SAAS,IAAI;AAAA,MACjB,UAAU,OAAO,CAAC,aAAa,QAAQ,MAAM,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,aAAa,SAAS,EAAE;AAAA,IAC1F;AACA,WAAO;AAAA,MACL,QAAQ,QAAQ,QAAQ,WAAW,MAAM;AAAA,MACzC,UAAU,CAAC,GAAG,SAAS,SAAS,SAAS,GAAG,GAAK,MAAM,KAAK,SAAS,KAAM,CAAC,CAAE;AAAA,MAC9E,QAAQ,MAAM,OAAO,SAAS,KAAK;AAAA,IACrC;AAAA,EACF;AACA,QAAM,QAAQ,gBAA+B,MAAM,SAAS,CAAC;AAC7D,MAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,OAAO,OAAO,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,SAAS,CAAC,CAAC;AAC7E,aAAS,KAAK,MAAM,MAAM,MAAS;AACnC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,UACd,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C,IAAI,CAAC,aAAa,SAAS,EAAE;AAChC,QAAM,WAAW,CAAC,QAChB,OAAO,QAAQ,EAAE,WAAW,IAAI,CAAC,EAAE;AAAA,IACjC,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACF,MAAI,SAAS,QAAQ;AACnB,UAAM,QAAQ,MACZ,KAAK,SAAS,QAAQ,EACnB,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EACtC,MAAM,MAAM,MAAS;AAC1B,UAAM;AACN,UAAM,QAAiB,YAAY,OAAO,QAAQ,SAAS,YAAY;AACvE,IAAC,MAAiC,QAAQ;AAAA,EAC5C;AACA,OAAK,SAAS,MAAM,KAAK,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS,CAAC;AAC3E,QAAM,OAAO,MAAM,SAAS,OAAO,CAAC,OAAO,QAAQ,MAAM,EAAE,CAAC,EAAE,KAAK,GAAG;AACtE,MAAI,OAAO,KAAK;AAChB,UAAQ,MAAM,UAAU,MAAM;AAC5B,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,QAAQ;AACtB,WAAO;AACP,UAAM,aAAa,QAAQ,SAAS,QAAQ,IAAI,QAAQ,QAAQ;AAChE,SAAK,WAAW,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC/E,CAAC;AACD,QAAM,SAAS,CAAC,YAAqB,QAAQ,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AACnF,SAAO;AAAA,IACL;AAAA,IACA,MAAM,QAAQ,YAAY,QAAQ,OAAO,SAAS;AAChD,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,QAAQ;AACV,cAAM,MAAM,MAAM,OAAO,QAAQ,YAAY,MAAM,CAAC;AACpD,cAAM,QAAQ,OAAO;AACrB;AAAA,MACF;AACA,UAAI,WAAW;AACb,cAAM,IAAI;AAAA,UACR;AAAA,UACA,OAAO,IAAI,UAAU,IAAI,sBAAsB;AAAA,QACjD;AACF,UAAI,UAAU,KAAM,OAAM,OAAO,IAAI,YAAY,KAAK;AACtD,YAAM,OAAO,OAAO;AACpB,UAAI,OAAO,IAAI,UAAU,EAAG,OAAM,SAAS,CAAC,UAAU,CAAC;AACvD,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,IACA,MAAM,OAAO,YAAY;AACvB,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,QAAO,MAAM,MAAM,OAAO,OAAO,UAAU,CAAC;AACxD,UAAI,eAAe,MAAO,QAAO;AACjC,YAAM,EAAE,UAAU,QAAQ,eAAe,IAAI,MAAM;AAAA,QACjD;AAAA,QACA,CAAC,OAAO,SAAS,WAAW,MAAM,OAAO,IAAI;AAAA,QAC7C;AAAA,MACF;AACA,aAAO,EAAE,UAAU,QAAQ,gBAAgB,kBAAkB,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,WAAW,YAAY,SAAS;AACpC,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,OAAM,OAAO,WAAW,UAAU;AAAA,UACzC,OAAM,OAAO,IAAI,YAAY,MAAS;AAC3C,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/spectrum/settings-port.js

@@ -11,6 +11,7 @@ const defaults = {
   showThinking: false,
   diffStyle: "unified"
 };
+const SIGN_IN_NEEDS_VAULT = "Adobe sign-in needs seven's vault: update seven";
 class SettingsAdapter extends Emitter {
   #settings;
   #agent;
@@ -67,13 +68,29 @@ class SettingsAdapter extends Emitter {
       return needs ? { ...shown, needs } : shown;
     });
   }
-  async connect(id, secret, options = {}) {
+  async connect(id, secret, fields) {
     const account = this.#state().accounts.find((candidate) => candidate.id === id);
-    const login = account?.auth !== "oauth" ? null : account.group === "mcp" ? this.#mcpLogin : this.#login;
-    const key = secret ?? (login ? await this.#signIn(id, login) : void 0);
-    if (!key)
-      throw new Error(`${id} needs ${account?.auth === "oauth" ? "a sign-in" : "an API key"}`);
-    await this.#settings.connect(id, key, options.region ?? null, BACKGROUND_CONTEXT);
+    const mcp = account?.group === "mcp";
+    const login = account?.auth !== "oauth" ? null : mcp ? this.#mcpLogin : this.#login;
+    const given = fields ? { ...fields } : null;
+    if (secret !== void 0) {
+      await this.#settings.connect(id, secret, given, BACKGROUND_CONTEXT);
+      return;
+    }
+    if (account?.auth === "oauth" && !login) throw new Error(`${id} needs a sign-in`);
+    if (!login) {
+      if (account?.store !== "vault") throw new Error(`${id} needs an API key`);
+      await this.#settings.connect(id, null, given, BACKGROUND_CONTEXT);
+      return;
+    }
+    const answer = await this.#signIn(id, login);
+    if (typeof answer === "string") {
+      if (!mcp) throw new Error(SIGN_IN_NEEDS_VAULT);
+      await this.#settings.connect(id, answer, given, BACKGROUND_CONTEXT);
+      return;
+    }
+    if (answer?.sealed !== true) throw new Error(`${id}'s sign-in didn't finish`);
+    await this.#settings.connect(id, null, given, BACKGROUND_CONTEXT);
   }
   async #signIn(id, login) {
     const controller = new AbortController();
@@ -112,6 +129,7 @@ class SettingsAdapter extends Emitter {
 }
 export {
   SETTINGS_KEY,
+  SIGN_IN_NEEDS_VAULT,
   SettingsAdapter
 };
 //# sourceMappingURL=settings-port.js.map

package/dist/spectrum/settings-port.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/spectrum/settings-port.ts"],
-  "sourcesContent": ["import type {\n  Account,\n  ModelOption,\n  Settings,\n  SettingsEvents,\n  SettingsPort,\n} from '@ai-ecoverse/slicc-spectrum/ui';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { AgentSettings, SettingsState, SignIn } from '../services.ts';\nimport type { AgentAdapter } from './agent-port.ts';\nimport { attempt } from './attempt.ts';\nimport { Emitter } from './emitter.ts';\nimport { mcpLogin } from './mcp-login.ts';\n\nexport const SETTINGS_KEY = 'slicc-agent.settings';\n\nconst defaults: Settings = {\n  color: 'system',\n  model: '',\n  thinking: 'off',\n  sendOnEnter: true,\n  showThinking: false,\n  diffStyle: 'unified',\n};\n\ntype Local = Omit<Settings, 'model' | 'thinking'>;\n\nexport type Login = (\n  providerId: string,\n  signIn: () => Promise<SignIn | null>,\n  options: { signal: AbortSignal }\n) => Promise<string>;\n\nexport class SettingsAdapter extends Emitter<SettingsEvents> implements SettingsPort {\n  readonly #settings: AgentSettings;\n  readonly #agent: AgentAdapter;\n  readonly #storage: Pick<Storage, 'getItem' | 'setItem'> | null;\n  readonly #login: Login | null;\n  readonly #mcpLogin: Login;\n  readonly #signing = new Map<string, AbortController>();\n  #local: Local;\n\n  constructor(\n    settings: AgentSettings,\n    agent: AgentAdapter,\n    storage: Pick<Storage, 'getItem' | 'setItem'> | null,\n    login: Login | null = null,\n    mcp: Login = mcpLogin() as Login\n  ) {\n    super();\n    this.#mcpLogin = mcp;\n    this.#settings = settings;\n    this.#agent = agent;\n    this.#storage = storage;\n    this.#login = login;\n    const saved = JSON.parse(storage?.getItem(SETTINGS_KEY) ?? '{}') as Partial<Local>;\n    const { model: _model, thinking: _thinking, ...local } = { ...defaults, ...saved };\n    this.#local = local;\n    settings.state.subscribe(() => {\n      this.emit('accounts', this.accounts());\n      this.emit('settings', this.get());\n    });\n    agent.on('agents', () => this.emit('settings', this.get()));\n  }\n\n  #state(): SettingsState {\n    return this.#settings.state.value ?? { models: [], accounts: [] };\n  }\n\n  get(): Settings {\n    const cone = this.#agent.list()[0];\n    return { ...this.#local, model: cone?.model ?? '', thinking: cone?.thinking ?? 'off' };\n  }\n\n  update(patch: Partial<Settings>): void {\n    const { model, thinking, ...local } = patch;\n    const id = this.#agent.active();\n    if (model !== undefined) this.#agent.setModel(id, model);\n    if (thinking !== undefined) this.#agent.setThinking(id, thinking);\n    this.#local = { ...this.#local, ...local };\n    this.#storage?.setItem(SETTINGS_KEY, JSON.stringify(this.#local));\n    this.emit('settings', this.get());\n  }\n\n  models(): readonly ModelOption[] {\n    return this.#state().models.map(({ id, label, provider, kind, reasoning, images }) => ({\n      id,\n      label,\n      provider,\n      kind,\n      reasoning,\n      ...(images === undefined ? {} : { images }),\n    }));\n  }\n\n  accounts(): readonly Account[] {\n    return this.#state().accounts.map(({ needs, ...account }) => {\n      const shown = this.#signing.has(account.id)\n        ? { ...account, status: 'signing-in' as const }\n        : account;\n      return needs ? { ...shown, needs } : shown;\n    });\n  }\n\n  async connect(id: string, secret?: string, options: { region?: string } = {}): Promise<void> {\n    const account = this.#state().accounts.find((candidate) => candidate.id === id);\n    const login =\n      account?.auth !== 'oauth' ? null : account.group === 'mcp' ? this.#mcpLogin : this.#login;\n    const key = secret ?? (login ? await this.#signIn(id, login) : undefined);\n    if (!key)\n      throw new Error(`${id} needs ${account?.auth === 'oauth' ? 'a sign-in' : 'an API key'}`);\n    await this.#settings.connect(id, key, options.region ?? null, BACKGROUND_CONTEXT);\n  }\n\n  async #signIn(id: string, login: Login): Promise<string> {\n    const controller = new AbortController();\n    this.#signing\n      .get(id)\n      ?.abort(new DOMException('A newer sign-in replaced this one.', 'AbortError'));\n    this.#signing.set(id, controller);\n    this.emit('accounts', this.accounts());\n    try {\n      const key = await login(\n        id,\n        () => this.#settings.signIn(id, BACKGROUND_CONTEXT) as Promise<SignIn | null>,\n        {\n          signal: controller.signal,\n        }\n      );\n      controller.signal.throwIfAborted();\n      return key;\n    } finally {\n      if (this.#signing.get(id) === controller) this.#signing.delete(id);\n      this.emit('accounts', this.accounts());\n    }\n  }\n\n  cancel(id: string): void {\n    const controller = this.#signing.get(id);\n    if (!controller) return;\n    this.#signing.delete(id);\n    controller.abort(new DOMException('The sign-in was cancelled.', 'AbortError'));\n    this.emit('accounts', this.accounts());\n  }\n\n  disconnect(id: string): void {\n    attempt(this.#settings.disconnect(id, BACKGROUND_CONTEXT), 'disconnect accounts', (text) =>\n      this.#agent.notify(text)\n    );\n  }\n}\n"],
-  "mappings": "AAOA,SAAS,0BAA0B;AAGnC,SAAS,eAAe;AACxB,SAAS,eAAe;AACxB,SAAS,gBAAgB;AAElB,MAAM,eAAe;AAE5B,MAAM,WAAqB;AAAA,EACzB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AACb;AAUO,MAAM,wBAAwB,QAAgD;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,oBAAI,IAA6B;AAAA,EACrD;AAAA,EAEA,YACE,UACA,OACA,SACA,QAAsB,MACtB,MAAa,SAAS,GACtB;AACA,UAAM;AACN,SAAK,YAAY;AACjB,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,WAAW;AAChB,SAAK,SAAS;AACd,UAAM,QAAQ,KAAK,MAAM,SAAS,QAAQ,YAAY,KAAK,IAAI;AAC/D,UAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,MAAM,IAAI,EAAE,GAAG,UAAU,GAAG,MAAM;AACjF,SAAK,SAAS;AACd,aAAS,MAAM,UAAU,MAAM;AAC7B,WAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AACrC,WAAK,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,IAClC,CAAC;AACD,UAAM,GAAG,UAAU,MAAM,KAAK,KAAK,YAAY,KAAK,IAAI,CAAC,CAAC;AAAA,EAC5D;AAAA,EAEA,SAAwB;AACtB,WAAO,KAAK,UAAU,MAAM,SAAS,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,EAClE;AAAA,EAEA,MAAgB;AACd,UAAM,OAAO,KAAK,OAAO,KAAK,EAAE,CAAC;AACjC,WAAO,EAAE,GAAG,KAAK,QAAQ,OAAO,MAAM,SAAS,IAAI,UAAU,MAAM,YAAY,MAAM;AAAA,EACvF;AAAA,EAEA,OAAO,OAAgC;AACrC,UAAM,EAAE,OAAO,UAAU,GAAG,MAAM,IAAI;AACtC,UAAM,KAAK,KAAK,OAAO,OAAO;AAC9B,QAAI,UAAU,OAAW,MAAK,OAAO,SAAS,IAAI,KAAK;AACvD,QAAI,aAAa,OAAW,MAAK,OAAO,YAAY,IAAI,QAAQ;AAChE,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,MAAM;AACzC,SAAK,UAAU,QAAQ,cAAc,KAAK,UAAU,KAAK,MAAM,CAAC;AAChE,SAAK,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,EAClC;AAAA,EAEA,SAAiC;AAC/B,WAAO,KAAK,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,IAAI,OAAO,UAAU,MAAM,WAAW,OAAO,OAAO;AAAA,MACrF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IAC3C,EAAE;AAAA,EACJ;AAAA,EAEA,WAA+B;AAC7B,WAAO,KAAK,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,MAAM;AAC3D,YAAM,QAAQ,KAAK,SAAS,IAAI,QAAQ,EAAE,IACtC,EAAE,GAAG,SAAS,QAAQ,aAAsB,IAC5C;AACJ,aAAO,QAAQ,EAAE,GAAG,OAAO,MAAM,IAAI;AAAA,IACvC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAQ,IAAY,QAAiB,UAA+B,CAAC,GAAkB;AAC3F,UAAM,UAAU,KAAK,OAAO,EAAE,SAAS,KAAK,CAAC,cAAc,UAAU,OAAO,EAAE;AAC9E,UAAM,QACJ,SAAS,SAAS,UAAU,OAAO,QAAQ,UAAU,QAAQ,KAAK,YAAY,KAAK;AACrF,UAAM,MAAM,WAAW,QAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,IAAI;AAC/D,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,GAAG,EAAE,UAAU,SAAS,SAAS,UAAU,cAAc,YAAY,EAAE;AACzF,UAAM,KAAK,UAAU,QAAQ,IAAI,KAAK,QAAQ,UAAU,MAAM,kBAAkB;AAAA,EAClF;AAAA,EAEA,MAAM,QAAQ,IAAY,OAA+B;AACvD,UAAM,aAAa,IAAI,gBAAgB;AACvC,SAAK,SACF,IAAI,EAAE,GACL,MAAM,IAAI,aAAa,sCAAsC,YAAY,CAAC;AAC9E,SAAK,SAAS,IAAI,IAAI,UAAU;AAChC,SAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AACrC,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,MAAM,KAAK,UAAU,OAAO,IAAI,kBAAkB;AAAA,QAClD;AAAA,UACE,QAAQ,WAAW;AAAA,QACrB;AAAA,MACF;AACA,iBAAW,OAAO,eAAe;AACjC,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,SAAS,IAAI,EAAE,MAAM,WAAY,MAAK,SAAS,OAAO,EAAE;AACjE,WAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,OAAO,IAAkB;AACvB,UAAM,aAAa,KAAK,SAAS,IAAI,EAAE;AACvC,QAAI,CAAC,WAAY;AACjB,SAAK,SAAS,OAAO,EAAE;AACvB,eAAW,MAAM,IAAI,aAAa,8BAA8B,YAAY,CAAC;AAC7E,SAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AAAA,EACvC;AAAA,EAEA,WAAW,IAAkB;AAC3B;AAAA,MAAQ,KAAK,UAAU,WAAW,IAAI,kBAAkB;AAAA,MAAG;AAAA,MAAuB,CAAC,SACjF,KAAK,OAAO,OAAO,IAAI;AAAA,IACzB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type {\n  Account,\n  ModelOption,\n  Settings,\n  SettingsEvents,\n  SettingsPort,\n} from '@ai-ecoverse/slicc-spectrum/ui';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { AgentSettings, SettingsState, SignIn } from '../services.ts';\nimport type { AgentAdapter } from './agent-port.ts';\nimport { attempt } from './attempt.ts';\nimport { Emitter } from './emitter.ts';\nimport { mcpLogin } from './mcp-login.ts';\n\nexport const SETTINGS_KEY = 'slicc-agent.settings';\n\nconst defaults: Settings = {\n  color: 'system',\n  model: '',\n  thinking: 'off',\n  sendOnEnter: true,\n  showThinking: false,\n  diffStyle: 'unified',\n};\n\ntype Local = Omit<Settings, 'model' | 'thinking'>;\n\nexport type Sealed = { sealed: true };\n\nexport type Login = (\n  providerId: string,\n  signIn: () => Promise<SignIn | null>,\n  options: { signal: AbortSignal }\n) => Promise<string | Sealed>;\n\nexport const SIGN_IN_NEEDS_VAULT = \"Adobe sign-in needs seven's vault: update seven\";\n\nexport class SettingsAdapter extends Emitter<SettingsEvents> implements SettingsPort {\n  readonly #settings: AgentSettings;\n  readonly #agent: AgentAdapter;\n  readonly #storage: Pick<Storage, 'getItem' | 'setItem'> | null;\n  readonly #login: Login | null;\n  readonly #mcpLogin: Login;\n  readonly #signing = new Map<string, AbortController>();\n  #local: Local;\n\n  constructor(\n    settings: AgentSettings,\n    agent: AgentAdapter,\n    storage: Pick<Storage, 'getItem' | 'setItem'> | null,\n    login: Login | null = null,\n    mcp: Login = mcpLogin() as Login\n  ) {\n    super();\n    this.#mcpLogin = mcp;\n    this.#settings = settings;\n    this.#agent = agent;\n    this.#storage = storage;\n    this.#login = login;\n    const saved = JSON.parse(storage?.getItem(SETTINGS_KEY) ?? '{}') as Partial<Local>;\n    const { model: _model, thinking: _thinking, ...local } = { ...defaults, ...saved };\n    this.#local = local;\n    settings.state.subscribe(() => {\n      this.emit('accounts', this.accounts());\n      this.emit('settings', this.get());\n    });\n    agent.on('agents', () => this.emit('settings', this.get()));\n  }\n\n  #state(): SettingsState {\n    return this.#settings.state.value ?? { models: [], accounts: [] };\n  }\n\n  get(): Settings {\n    const cone = this.#agent.list()[0];\n    return { ...this.#local, model: cone?.model ?? '', thinking: cone?.thinking ?? 'off' };\n  }\n\n  update(patch: Partial<Settings>): void {\n    const { model, thinking, ...local } = patch;\n    const id = this.#agent.active();\n    if (model !== undefined) this.#agent.setModel(id, model);\n    if (thinking !== undefined) this.#agent.setThinking(id, thinking);\n    this.#local = { ...this.#local, ...local };\n    this.#storage?.setItem(SETTINGS_KEY, JSON.stringify(this.#local));\n    this.emit('settings', this.get());\n  }\n\n  models(): readonly ModelOption[] {\n    return this.#state().models.map(({ id, label, provider, kind, reasoning, images }) => ({\n      id,\n      label,\n      provider,\n      kind,\n      reasoning,\n      ...(images === undefined ? {} : { images }),\n    }));\n  }\n\n  accounts(): readonly Account[] {\n    return this.#state().accounts.map(({ needs, ...account }) => {\n      const shown = this.#signing.has(account.id)\n        ? { ...account, status: 'signing-in' as const }\n        : account;\n      return needs ? { ...shown, needs } : shown;\n    });\n  }\n\n  async connect(id: string, secret?: string, fields?: Record<string, string>): Promise<void> {\n    const account = this.#state().accounts.find((candidate) => candidate.id === id);\n    const mcp = account?.group === 'mcp';\n    const login = account?.auth !== 'oauth' ? null : mcp ? this.#mcpLogin : this.#login;\n    const given = fields ? { ...fields } : null;\n    if (secret !== undefined) {\n      await this.#settings.connect(id, secret, given, BACKGROUND_CONTEXT);\n      return;\n    }\n    if (account?.auth === 'oauth' && !login) throw new Error(`${id} needs a sign-in`);\n    if (!login) {\n      if (account?.store !== 'vault') throw new Error(`${id} needs an API key`);\n      await this.#settings.connect(id, null, given, BACKGROUND_CONTEXT);\n      return;\n    }\n    const answer = await this.#signIn(id, login);\n    if (typeof answer === 'string') {\n      if (!mcp) throw new Error(SIGN_IN_NEEDS_VAULT);\n      await this.#settings.connect(id, answer, given, BACKGROUND_CONTEXT);\n      return;\n    }\n    if (answer?.sealed !== true) throw new Error(`${id}'s sign-in didn't finish`);\n    await this.#settings.connect(id, null, given, BACKGROUND_CONTEXT);\n  }\n\n  async #signIn(id: string, login: Login): Promise<string | Sealed> {\n    const controller = new AbortController();\n    this.#signing\n      .get(id)\n      ?.abort(new DOMException('A newer sign-in replaced this one.', 'AbortError'));\n    this.#signing.set(id, controller);\n    this.emit('accounts', this.accounts());\n    try {\n      const key = await login(\n        id,\n        () => this.#settings.signIn(id, BACKGROUND_CONTEXT) as Promise<SignIn | null>,\n        {\n          signal: controller.signal,\n        }\n      );\n      controller.signal.throwIfAborted();\n      return key;\n    } finally {\n      if (this.#signing.get(id) === controller) this.#signing.delete(id);\n      this.emit('accounts', this.accounts());\n    }\n  }\n\n  cancel(id: string): void {\n    const controller = this.#signing.get(id);\n    if (!controller) return;\n    this.#signing.delete(id);\n    controller.abort(new DOMException('The sign-in was cancelled.', 'AbortError'));\n    this.emit('accounts', this.accounts());\n  }\n\n  disconnect(id: string): void {\n    attempt(this.#settings.disconnect(id, BACKGROUND_CONTEXT), 'disconnect accounts', (text) =>\n      this.#agent.notify(text)\n    );\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,0BAA0B;AAGnC,SAAS,eAAe;AACxB,SAAS,eAAe;AACxB,SAAS,gBAAgB;AAElB,MAAM,eAAe;AAE5B,MAAM,WAAqB;AAAA,EACzB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AACb;AAYO,MAAM,sBAAsB;AAE5B,MAAM,wBAAwB,QAAgD;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,oBAAI,IAA6B;AAAA,EACrD;AAAA,EAEA,YACE,UACA,OACA,SACA,QAAsB,MACtB,MAAa,SAAS,GACtB;AACA,UAAM;AACN,SAAK,YAAY;AACjB,SAAK,YAAY;AACjB,SAAK,SAAS;AACd,SAAK,WAAW;AAChB,SAAK,SAAS;AACd,UAAM,QAAQ,KAAK,MAAM,SAAS,QAAQ,YAAY,KAAK,IAAI;AAC/D,UAAM,EAAE,OAAO,QAAQ,UAAU,WAAW,GAAG,MAAM,IAAI,EAAE,GAAG,UAAU,GAAG,MAAM;AACjF,SAAK,SAAS;AACd,aAAS,MAAM,UAAU,MAAM;AAC7B,WAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AACrC,WAAK,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,IAClC,CAAC;AACD,UAAM,GAAG,UAAU,MAAM,KAAK,KAAK,YAAY,KAAK,IAAI,CAAC,CAAC;AAAA,EAC5D;AAAA,EAEA,SAAwB;AACtB,WAAO,KAAK,UAAU,MAAM,SAAS,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE;AAAA,EAClE;AAAA,EAEA,MAAgB;AACd,UAAM,OAAO,KAAK,OAAO,KAAK,EAAE,CAAC;AACjC,WAAO,EAAE,GAAG,KAAK,QAAQ,OAAO,MAAM,SAAS,IAAI,UAAU,MAAM,YAAY,MAAM;AAAA,EACvF;AAAA,EAEA,OAAO,OAAgC;AACrC,UAAM,EAAE,OAAO,UAAU,GAAG,MAAM,IAAI;AACtC,UAAM,KAAK,KAAK,OAAO,OAAO;AAC9B,QAAI,UAAU,OAAW,MAAK,OAAO,SAAS,IAAI,KAAK;AACvD,QAAI,aAAa,OAAW,MAAK,OAAO,YAAY,IAAI,QAAQ;AAChE,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,MAAM;AACzC,SAAK,UAAU,QAAQ,cAAc,KAAK,UAAU,KAAK,MAAM,CAAC;AAChE,SAAK,KAAK,YAAY,KAAK,IAAI,CAAC;AAAA,EAClC;AAAA,EAEA,SAAiC;AAC/B,WAAO,KAAK,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,IAAI,OAAO,UAAU,MAAM,WAAW,OAAO,OAAO;AAAA,MACrF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO;AAAA,IAC3C,EAAE;AAAA,EACJ;AAAA,EAEA,WAA+B;AAC7B,WAAO,KAAK,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,MAAM;AAC3D,YAAM,QAAQ,KAAK,SAAS,IAAI,QAAQ,EAAE,IACtC,EAAE,GAAG,SAAS,QAAQ,aAAsB,IAC5C;AACJ,aAAO,QAAQ,EAAE,GAAG,OAAO,MAAM,IAAI;AAAA,IACvC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAQ,IAAY,QAAiB,QAAgD;AACzF,UAAM,UAAU,KAAK,OAAO,EAAE,SAAS,KAAK,CAAC,cAAc,UAAU,OAAO,EAAE;AAC9E,UAAM,MAAM,SAAS,UAAU;AAC/B,UAAM,QAAQ,SAAS,SAAS,UAAU,OAAO,MAAM,KAAK,YAAY,KAAK;AAC7E,UAAM,QAAQ,SAAS,EAAE,GAAG,OAAO,IAAI;AACvC,QAAI,WAAW,QAAW;AACxB,YAAM,KAAK,UAAU,QAAQ,IAAI,QAAQ,OAAO,kBAAkB;AAClE;AAAA,IACF;AACA,QAAI,SAAS,SAAS,WAAW,CAAC,MAAO,OAAM,IAAI,MAAM,GAAG,EAAE,kBAAkB;AAChF,QAAI,CAAC,OAAO;AACV,UAAI,SAAS,UAAU,QAAS,OAAM,IAAI,MAAM,GAAG,EAAE,mBAAmB;AACxE,YAAM,KAAK,UAAU,QAAQ,IAAI,MAAM,OAAO,kBAAkB;AAChE;AAAA,IACF;AACA,UAAM,SAAS,MAAM,KAAK,QAAQ,IAAI,KAAK;AAC3C,QAAI,OAAO,WAAW,UAAU;AAC9B,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,mBAAmB;AAC7C,YAAM,KAAK,UAAU,QAAQ,IAAI,QAAQ,OAAO,kBAAkB;AAClE;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,KAAM,OAAM,IAAI,MAAM,GAAG,EAAE,0BAA0B;AAC5E,UAAM,KAAK,UAAU,QAAQ,IAAI,MAAM,OAAO,kBAAkB;AAAA,EAClE;AAAA,EAEA,MAAM,QAAQ,IAAY,OAAwC;AAChE,UAAM,aAAa,IAAI,gBAAgB;AACvC,SAAK,SACF,IAAI,EAAE,GACL,MAAM,IAAI,aAAa,sCAAsC,YAAY,CAAC;AAC9E,SAAK,SAAS,IAAI,IAAI,UAAU;AAChC,SAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AACrC,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB;AAAA,QACA,MAAM,KAAK,UAAU,OAAO,IAAI,kBAAkB;AAAA,QAClD;AAAA,UACE,QAAQ,WAAW;AAAA,QACrB;AAAA,MACF;AACA,iBAAW,OAAO,eAAe;AACjC,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,SAAS,IAAI,EAAE,MAAM,WAAY,MAAK,SAAS,OAAO,EAAE;AACjE,WAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AAAA,IACvC;AAAA,EACF;AAAA,EAEA,OAAO,IAAkB;AACvB,UAAM,aAAa,KAAK,SAAS,IAAI,EAAE;AACvC,QAAI,CAAC,WAAY;AACjB,SAAK,SAAS,OAAO,EAAE;AACvB,eAAW,MAAM,IAAI,aAAa,8BAA8B,YAAY,CAAC;AAC7E,SAAK,KAAK,YAAY,KAAK,SAAS,CAAC;AAAA,EACvC;AAAA,EAEA,WAAW,IAAkB;AAC3B;AAAA,MAAQ,KAAK,UAAU,WAAW,IAAI,kBAAkB;AAAA,MAAG;AAAA,MAAuB,CAAC,SACjF,KAAK,OAAO,OAAO,IAAI;AAAA,IACzB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/types/host.d.ts

@@ -46,7 +46,7 @@ export declare function hostAgent(agent: Agent, options?: {
     changes?: ChangesRuntime;
     mcp?: Pick<McpRuntime, 'close'>;
     users?: UserClients;
-    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users' | 'secrets'>;
+    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users'>;
     pages?: Pages;
     secrets?: HostSecrets;
     uploads?: Uploads;

package/dist/types/index.d.ts

@@ -3,7 +3,6 @@ export { type Agent, type AgentOptions, answerText, openAgent } from './agent.ts
 export { FILE_LIMIT, IMAGE_LIMIT, type SendAttachment, type ShownAttachment, splitUser, TOTAL_LIMIT, userParts, } from './attachments.ts';
 export { type AgentConnection, connectAgent } from './client.ts';
 export { createAgentControl } from './control.ts';
-export { CREDENTIALS_DATABASE, EncryptedCredentialStore } from './credentials.ts';
 export { type AgentHost, type ConnectOptions, hostAgent } from './host.ts';
 export type { KernelClient, KernelFs, KernelProcess, KernelStat, SpawnOptions, } from './kernel/client.ts';
 export { HOME, type KernelEnvOptions, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';

package/dist/types/main.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialStore, Provider } from '@earendil-works/pi-ai';
+import type { Provider } from '@earendil-works/pi-ai';
 import type { Models } from '@earendil-works/pi-ai/models';
 import { type ModelRef, type Storage } from '@earendil-works/pi-durable';
 import { type AgentHost } from './host.ts';
@@ -6,6 +6,9 @@ import type { KernelClient } from './kernel/client.ts';
 import { type UserClients } from './kernel/users.ts';
 import { type Transport } from './net.ts';
 import { type Assets } from './scoops/index.ts';
+import { type ModelBases } from './secrets/endpoints.ts';
+import { type PlainStore } from './secrets/store.ts';
+import { createSliccModels } from './settings.ts';
 import { type WorkerScope } from './worker.ts';
 export interface AgentWorkerScope extends WorkerScope {
     fetch: typeof fetch;
@@ -20,7 +23,7 @@ export interface AgentWorkerOptions {
     model?: ModelRef;
     providers?: Provider[];
     attach?: KernelAttach;
-    credentials?: () => Promise<CredentialStore>;
+    store?: () => Promise<PlainStore>;
     storage?: () => Promise<Storage>;
     assets?: Assets;
     codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;
@@ -31,7 +34,9 @@ export interface AgentWorkerOptions {
 }
 export declare function usersOf(admin: MessagePort | undefined, wanted: boolean | undefined, attach: KernelAttach): UserClients | undefined;
 export declare const STORE_DIR = "/.slicc";
+export declare const ACCOUNTS_FILE = "/.slicc/accounts.json";
 export declare function seesImages(models: Pick<Models, 'getModel'>, ref: ModelRef | undefined): boolean;
 export declare const MCP_CALLBACK = "/oauth/mcp-callback";
+export declare function modelBases(providers: readonly Provider[], models: Pick<ReturnType<typeof createSliccModels>, 'getModels'>): ModelBases[];
 export declare function alive(client: KernelClient): (pid: number) => Promise<boolean>;
 export declare function runAgentWorker(scope: AgentWorkerScope, options?: AgentWorkerOptions): Promise<AgentHost>;

package/dist/types/mcp/accounts.d.ts

@@ -1,20 +1,26 @@
-import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { Context } from '@earendil-works/chord';
 import type { McpFetch } from '@earendil-works/pi-mcp';
 import type { AccountState } from '../services.ts';
 import type { McpCatalog } from './catalog.ts';
 import type { McpServerEntry } from './config.ts';
 import type { McpServerConnection } from './connection.ts';
+import { type McpRecords } from './credentials.ts';
 import { type McpSignIn, type StoredOAuth } from './oauth.ts';
+export declare const TOKENS_IN_VAULT = "MCP tokens are kept in seven's vault: update seven";
 export interface McpAccounts {
     accounts(): Promise<AccountState[]>;
     signIn(id: string): Promise<McpSignIn>;
-    connect(id: string, secret: string): Promise<void>;
+    connect(id: string, secret: string | null): Promise<void>;
     disconnect(id: string): Promise<void>;
     onChange(listener: () => void): () => void;
 }
 export interface AccountSources {
-    credentials: CredentialStore;
+    records: McpRecords & {
+        refresh(context: Context): Promise<void>;
+    };
     oauth: (entry: McpServerEntry) => StoredOAuth;
-    fetch: McpFetch;
+    fetch: (server: string) => McpFetch;
+    grant: (server: string) => McpFetch;
+    register: (server: string, tokenUrl: string) => Promise<void>;
 }
 export declare function mcpAccounts(catalog: McpCatalog, sources: AccountSources, restart: (connection: McpServerConnection) => void, listeners: Set<() => void>): McpAccounts;

package/dist/types/mcp/connection.d.ts

@@ -3,7 +3,6 @@ import { type McpServerEntry } from './config.ts';
 export type ServerState = 'connecting' | 'connected' | 'needs-auth' | 'needs-secret' | 'failed' | 'closed';
 export type TransportFactory = (entry: McpServerEntry) => Promise<{
     transport: McpTransport;
-    secrets: string[];
 } | {
     missing: string[];
 }>;
@@ -36,7 +35,6 @@ export declare class McpServerConnection {
     resources: Resource[];
     resourceTemplates: ResourceTemplate[];
     instructions: string | undefined;
-    secrets: string[];
     constructor(options: ConnectionOptions);
     get name(): string;
     get timeoutMs(): number;

package/dist/types/mcp/credentials.d.ts

@@ -1,15 +1,17 @@
-import type { CredentialStore } from '@earendil-works/pi-ai';
 import { type McpServerConfig } from './config.ts';
 export declare const MCP_CREDENTIAL_PREFIX = "mcp:";
+export interface McpRecords {
+    mcp(server: string, name?: string): {
+        placeholder: string;
+    } | undefined;
+}
 export declare function credentialKey(server: string, url: string): Promise<string>;
 export declare function secretNames(config: McpServerConfig): string[];
 export type Resolved = {
     ok: true;
     headers: Record<string, string>;
-    secrets: string[];
 } | {
     ok: false;
     missing: string[];
 };
-export declare function resolveHeaders(server: string, config: McpServerConfig, credentials: CredentialStore): Promise<Resolved>;
-export declare function scrub(text: string, secrets: readonly string[]): string;
+export declare function resolveHeaders(server: string, config: McpServerConfig, records: McpRecords): Resolved;

package/dist/types/mcp/oauth.d.ts

@@ -1,6 +1,6 @@
-import type { CredentialStore } from '@earendil-works/pi-ai';
 import type { AuthProvider, McpFetch } from '@earendil-works/pi-mcp';
 import { authorizeMcp, McpOAuthAuthorizationRequiredError, type McpOAuthState } from '@earendil-works/pi-mcp/oauth';
+import type { PlainStore } from '../secrets/store.ts';
 import type { McpSignIn } from '../services.ts';
 import type { McpServerConfig } from './config.ts';
 type Provider = Parameters<typeof authorizeMcp>[0];
@@ -25,7 +25,7 @@ export declare class StoredOAuth implements Provider {
     #private;
     readonly redirectUrl: string;
     readonly clientMetadata: Provider['clientMetadata'];
-    constructor(server: OAuthServer, credentials: CredentialStore, redirectUrl: string);
+    constructor(server: OAuthServer, store: PlainStore, redirectUrl: string);
     get serverUrl(): string;
     load(): Promise<McpOAuthState>;
     update(change: (state: McpOAuthState) => McpOAuthState): Promise<void>;
@@ -47,6 +47,7 @@ export type { McpSignIn } from '../services.ts';
 export declare function beginSignIn(provider: StoredOAuth, server: OAuthServer, options: {
     fetch: McpFetch;
     resourceMetadataUrl?: URL;
+    register(tokenUrl: string): Promise<void>;
 }): Promise<McpSignIn>;
 export interface Callback {
     code?: string;

package/dist/types/mcp/runtime.d.ts

@@ -1,20 +1,35 @@
 import type { Context } from '@earendil-works/chord';
-import type { CredentialStore } from '@earendil-works/pi-ai';
 import type { Registry } from '@earendil-works/pi-durable';
 import type { ExecutionEnv } from '@earendil-works/pi-durable/env';
 import type { LickEvent, Licks } from '../licks/licks.ts';
+import type { McpServerSource } from '../secrets/endpoints.ts';
+import type { PlainStore } from '../secrets/store.ts';
 import { type McpAccounts } from './accounts.ts';
 import { McpCatalog } from './catalog.ts';
 import { type McpConfigProblem } from './config.ts';
 import { McpServerConnection } from './connection.ts';
+import { type McpRecords } from './credentials.ts';
 export declare const MCP_LOG_MAX_BYTES: number;
 export { configPath, logPath, shown } from './paths.ts';
+export interface McpVault {
+    records: McpRecords & {
+        refresh(context: Context): Promise<void>;
+        state: {
+            subscribe(listener: () => void): () => void;
+        };
+    };
+    fetch(server: string, base: typeof fetch): typeof fetch;
+    grant(server: string, base: typeof fetch): typeof fetch;
+    servers(list: readonly McpServerSource[]): Promise<void>;
+    token(server: string, url: string): Promise<void>;
+}
 export interface McpAttach {
     licks: Licks;
     env: ExecutionEnv;
     home: string;
     agentDir?: string;
-    credentials: CredentialStore;
+    store: PlainStore;
+    vault: McpVault;
     fetch: typeof fetch;
     version: string;
     reloadMs: number;
@@ -31,14 +46,13 @@ export interface ServerStatus {
 export type { McpAccounts } from './accounts.ts';
 export interface McpRuntime extends McpAccounts {
     status(): ServerStatus[];
-    secrets(): string[];
     reload(context: Context): Promise<void>;
     close(context: Context): Promise<void>;
 }
 export declare function problemLick(problem: McpConfigProblem, home: string, dir?: string): LickEvent;
 export declare function stateLick(connection: McpServerConnection, cors: boolean): LickEvent | undefined;
 export declare function connectedLick(connection: McpServerConnection): LickEvent;
-export declare function logLine(server: string, params: unknown, secrets: readonly string[], at: Date): string;
+export declare function logLine(server: string, params: unknown, at: Date): string;
 export declare function attachMcp(catalog: McpCatalog, options: McpAttach, context: Context): Promise<McpRuntime>;
 export declare function startMcp(registry: Registry, options: McpAttach, context: Context): Promise<{
     catalog: McpCatalog;

package/dist/types/models/index.d.ts

@@ -11,6 +11,8 @@ export interface ModelsOptions {
     agents: Agents;
     settings: Pick<AgentSettings, 'state'>;
     catalog: Pick<Models, 'getProviders' | 'getModels'>;
+    locked?: () => boolean;
 }
+export declare const LOCKED_NOTE = "the vault is locked: unlock it to use these accounts";
 export declare function closest(wanted: string, ids: readonly string[], count?: number): string[];
 export declare function modelsCommand(options: ModelsOptions): (argv: readonly string[], caller: string | null, context: Context) => Promise<Answer>;

package/dist/types/monitor/index.d.ts

@@ -47,7 +47,6 @@ export interface MonitorOptions {
         name: string;
         uid: number;
     }[]>;
-    secrets?: () => readonly string[];
     now?: () => number;
     timers?: Timers;
     ttlMs?: number;

package/dist/types/monitor/redact.d.ts

@@ -1,5 +1,5 @@
 export declare const TEXT_MAX = 160;
 export declare function cut(text: string, max?: number): string;
-export declare function redacted(text: string, secrets: readonly string[]): string;
-export declare function commandLine(argv: readonly string[], secrets: readonly string[]): string;
+export declare function redacted(text: string): string;
+export declare function commandLine(argv: readonly string[]): string;
 export declare function program(argv: readonly string[]): string;

package/dist/types/secrets/credentials.d.ts

@@ -0,0 +1,5 @@
+import type { CredentialStore } from '@earendil-works/pi-ai';
+import type { VaultRecords } from './records.ts';
+export declare const KEYS_IN_VAULT = "model keys are kept in seven's vault: enter them in Settings \u203A Accounts";
+export type FieldsOf = (providerId: string) => Readonly<Record<string, string>> | undefined;
+export declare function vaultCredentials(records: Pick<VaultRecords, 'model' | 'state'>, env?: FieldsOf): CredentialStore;

package/dist/types/secrets/endpoints.d.ts

@@ -0,0 +1,27 @@
+import type { McpServerEntry, ModelEndpoint } from '@ai-ecoverse/slicc-vault';
+import type { ModelRoute } from './fetch.ts';
+import type { AgentRecord } from './records.ts';
+import type { Vault } from './vault.ts';
+export declare const BEDROCK_ENDPOINTS: string[];
+export declare function modelUrl(raw: string): boolean;
+export declare function mcpUrl(raw: string): boolean;
+export declare function pattern(base: string): RegExp;
+export interface ModelBases {
+    provider: string;
+    urls: readonly string[];
+}
+export declare function modelRoute(bases: () => readonly ModelBases[], records: () => readonly AgentRecord[]): ModelRoute;
+export declare function modelEndpoints(bases: readonly ModelBases[]): ModelEndpoint[];
+export interface McpServerSource {
+    server: string;
+    url: string;
+    names: readonly string[];
+}
+export declare function mcpEndpoints(servers: readonly McpServerSource[], tokens: ReadonlyMap<string, string>): McpServerEntry[];
+export interface Endpoints {
+    models(bases: readonly ModelBases[]): Promise<void>;
+    servers(servers: readonly McpServerSource[]): Promise<void>;
+    token(server: string, url: string): Promise<void>;
+    close(): void;
+}
+export declare function vaultEndpoints(vault: Pick<Vault, 'state' | 'connected' | 'endpoints'>): Endpoints;