@ai-ecoverse/slicc-agent 3.52.1 → 4.1.0

package/dist/secrets/endpoints.js

@@ -0,0 +1,111 @@
+const BEDROCK_ENDPOINTS = [
+  "https://bedrock-runtime.{region}.amazonaws.com",
+  "https://bedrock-runtime-fips.{region}.amazonaws.com"
+];
+const NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const KERNEL = /^(\d{1,5})\.kernel\.localhost$/;
+const FACADE = 9222;
+function plain(url) {
+  return !url.username && !url.password && (url.port === "" || url.port === "443");
+}
+function modelUrl(raw) {
+  const url = URL.parse(raw);
+  return !!url && url.protocol === "https:" && plain(url) && !raw.includes("{");
+}
+function kernelUrl(url) {
+  const port = Number(KERNEL.exec(url.hostname)?.[1] ?? 0);
+  return url.protocol === "http:" && url.port === "" && port >= 1 && port <= 65535 && port !== FACADE;
+}
+function mcpUrl(raw) {
+  const url = URL.parse(raw);
+  return !!url && !url.username && !url.password && (kernelUrl(url) || url.protocol === "https:" && plain(url));
+}
+const escaped = (text) => text.replace(/[.*+?^$()|[\]\\]/g, "\\$&");
+function pattern(base) {
+  const trimmed = base.replace(/\/+$/, "");
+  const source = trimmed.split(/(\{[^}]+\})/).map((part) => /^\{[^}]+\}$/.test(part) ? "[^./]+" : escaped(part)).join("");
+  return new RegExp(`^${source}(?:[/?#]|$)`, "i");
+}
+function modelRoute(bases, records) {
+  return (request) => {
+    const url = request.url;
+    const matched = bases().filter(({ urls }) => urls.some((base) => pattern(base).test(url))).map(({ provider }) => provider);
+    const head = [url, ...[...request.headers].map(([, value]) => value)].join("\n");
+    const held = records().filter((record) => record.kind === "model" && head.includes(record.placeholder)).map((record) => record.provider);
+    const owned = matched.filter((provider) => held.includes(provider));
+    if (owned.length === 1) return owned[0];
+    if (matched.length === 1 && !held.length) return matched[0];
+    return matched.length || held.length ? null : void 0;
+  };
+}
+function modelEndpoints(bases) {
+  const seen = /* @__PURE__ */ new Set();
+  return bases.flatMap(
+    ({ provider, urls }) => urls.filter(modelUrl).flatMap((url) => {
+      const key = `${provider} ${url}`;
+      if (seen.has(key)) return [];
+      seen.add(key);
+      return [{ provider, url }];
+    })
+  );
+}
+function mcpEndpoints(servers, tokens) {
+  return servers.filter((entry) => mcpUrl(entry.url)).map(({ server, url, names }) => {
+    const tokenUrl = tokens.get(server);
+    const valid = names.filter((name) => NAME.test(name));
+    return {
+      server,
+      url,
+      ...valid.length ? { names: valid } : {},
+      ...tokenUrl && modelUrl(tokenUrl) ? { tokenUrl } : {}
+    };
+  });
+}
+function vaultEndpoints(vault) {
+  let model = [];
+  let servers = [];
+  const tokens = /* @__PURE__ */ new Map();
+  let last = "";
+  const send = async (force = false) => {
+    const set = { model, mcp: mcpEndpoints(servers, tokens) };
+    const key = JSON.stringify(set);
+    if (!vault.connected || !force && key === last) return;
+    last = key;
+    await vault.endpoints(set).catch((error) => {
+      if (last === key) last = "";
+      throw error;
+    });
+  };
+  let port = vault.state.value.port;
+  const off = vault.state.subscribe((value) => {
+    const opened = port === "none" && value.port !== "none";
+    port = value.port;
+    if (opened) void send(true).catch(() => void 0);
+  });
+  return {
+    models(bases) {
+      model = modelEndpoints(bases);
+      return send();
+    },
+    servers(next) {
+      servers = next;
+      return send();
+    },
+    token(server, url) {
+      if (!tokens.has(server)) tokens.set(server, new URL(url).href);
+      return send();
+    },
+    close: off
+  };
+}
+export {
+  BEDROCK_ENDPOINTS,
+  mcpEndpoints,
+  mcpUrl,
+  modelEndpoints,
+  modelRoute,
+  modelUrl,
+  pattern,
+  vaultEndpoints
+};
+//# sourceMappingURL=endpoints.js.map

package/dist/secrets/endpoints.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/endpoints.ts"],
+  "sourcesContent": ["import type { McpServerEntry, ModelEndpoint } from '@ai-ecoverse/slicc-vault';\nimport type { ModelRoute } from './fetch.ts';\nimport type { AgentRecord } from './records.ts';\nimport type { Vault } from './vault.ts';\n\nexport const BEDROCK_ENDPOINTS = [\n  'https://bedrock-runtime.{region}.amazonaws.com',\n  'https://bedrock-runtime-fips.{region}.amazonaws.com',\n];\n\nconst NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst KERNEL = /^(\\d{1,5})\\.kernel\\.localhost$/;\nconst FACADE = 9222;\n\nfunction plain(url: URL): boolean {\n  return !url.username && !url.password && (url.port === '' || url.port === '443');\n}\n\nexport function modelUrl(raw: string): boolean {\n  const url = URL.parse(raw);\n  return !!url && url.protocol === 'https:' && plain(url) && !raw.includes('{');\n}\n\nfunction kernelUrl(url: URL): boolean {\n  const port = Number(KERNEL.exec(url.hostname)?.[1] ?? 0);\n  return (\n    url.protocol === 'http:' && url.port === '' && port >= 1 && port <= 65535 && port !== FACADE\n  );\n}\n\nexport function mcpUrl(raw: string): boolean {\n  const url = URL.parse(raw);\n  return (\n    !!url &&\n    !url.username &&\n    !url.password &&\n    (kernelUrl(url) || (url.protocol === 'https:' && plain(url)))\n  );\n}\n\nconst escaped = (text: string) => text.replace(/[.*+?^$()|[\\]\\\\]/g, '\\\\$&');\n\nexport function pattern(base: string): RegExp {\n  const trimmed = base.replace(/\\/+$/, '');\n  const source = trimmed\n    .split(/(\\{[^}]+\\})/)\n    .map((part) => (/^\\{[^}]+\\}$/.test(part) ? '[^./]+' : escaped(part)))\n    .join('');\n  return new RegExp(`^${source}(?:[/?#]|$)`, 'i');\n}\n\nexport interface ModelBases {\n  provider: string;\n  urls: readonly string[];\n}\n\nexport function modelRoute(\n  bases: () => readonly ModelBases[],\n  records: () => readonly AgentRecord[]\n): ModelRoute {\n  return (request) => {\n    const url = request.url;\n    const matched = bases()\n      .filter(({ urls }) => urls.some((base) => pattern(base).test(url)))\n      .map(({ provider }) => provider);\n    const head = [url, ...[...request.headers].map(([, value]) => value)].join('\\n');\n    const held = records()\n      .filter((record) => record.kind === 'model' && head.includes(record.placeholder))\n      .map((record) => record.provider);\n    const owned = matched.filter((provider) => held.includes(provider));\n    if (owned.length === 1) return owned[0];\n    if (matched.length === 1 && !held.length) return matched[0];\n    return matched.length || held.length ? null : undefined;\n  };\n}\n\nexport function modelEndpoints(bases: readonly ModelBases[]): ModelEndpoint[] {\n  const seen = new Set<string>();\n  return bases.flatMap(({ provider, urls }) =>\n    urls.filter(modelUrl).flatMap((url) => {\n      const key = `${provider} ${url}`;\n      if (seen.has(key)) return [];\n      seen.add(key);\n      return [{ provider, url }];\n    })\n  );\n}\n\nexport interface McpServerSource {\n  server: string;\n  url: string;\n  names: readonly string[];\n}\n\nexport function mcpEndpoints(\n  servers: readonly McpServerSource[],\n  tokens: ReadonlyMap<string, string>\n): McpServerEntry[] {\n  return servers\n    .filter((entry) => mcpUrl(entry.url))\n    .map(({ server, url, names }) => {\n      const tokenUrl = tokens.get(server);\n      const valid = names.filter((name) => NAME.test(name));\n      return {\n        server,\n        url,\n        ...(valid.length ? { names: valid } : {}),\n        ...(tokenUrl && modelUrl(tokenUrl) ? { tokenUrl } : {}),\n      };\n    });\n}\n\nexport interface Endpoints {\n  models(bases: readonly ModelBases[]): Promise<void>;\n  servers(servers: readonly McpServerSource[]): Promise<void>;\n  token(server: string, url: string): Promise<void>;\n  close(): void;\n}\n\nexport function vaultEndpoints(vault: Pick<Vault, 'state' | 'connected' | 'endpoints'>): Endpoints {\n  let model: ModelEndpoint[] = [];\n  let servers: readonly McpServerSource[] = [];\n  const tokens = new Map<string, string>();\n  let last = '';\n  const send = async (force = false) => {\n    const set = { model, mcp: mcpEndpoints(servers, tokens) };\n    const key = JSON.stringify(set);\n    if (!vault.connected || (!force && key === last)) return;\n    last = key;\n    await vault.endpoints(set).catch((error: unknown) => {\n      if (last === key) last = '';\n      throw error;\n    });\n  };\n  let port = vault.state.value.port;\n  const off = vault.state.subscribe((value) => {\n    const opened = port === 'none' && value.port !== 'none';\n    port = value.port;\n    if (opened) void send(true).catch(() => undefined);\n  });\n  return {\n    models(bases) {\n      model = modelEndpoints(bases);\n      return send();\n    },\n    servers(next) {\n      servers = next;\n      return send();\n    },\n    token(server, url) {\n      if (!tokens.has(server)) tokens.set(server, new URL(url).href);\n      return send();\n    },\n    close: off,\n  };\n}\n"],
+  "mappings": "AAKO,MAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AACF;AAEA,MAAM,OAAO;AACb,MAAM,SAAS;AACf,MAAM,SAAS;AAEf,SAAS,MAAM,KAAmB;AAChC,SAAO,CAAC,IAAI,YAAY,CAAC,IAAI,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;AAC5E;AAEO,SAAS,SAAS,KAAsB;AAC7C,QAAM,MAAM,IAAI,MAAM,GAAG;AACzB,SAAO,CAAC,CAAC,OAAO,IAAI,aAAa,YAAY,MAAM,GAAG,KAAK,CAAC,IAAI,SAAS,GAAG;AAC9E;AAEA,SAAS,UAAU,KAAmB;AACpC,QAAM,OAAO,OAAO,OAAO,KAAK,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC;AACvD,SACE,IAAI,aAAa,WAAW,IAAI,SAAS,MAAM,QAAQ,KAAK,QAAQ,SAAS,SAAS;AAE1F;AAEO,SAAS,OAAO,KAAsB;AAC3C,QAAM,MAAM,IAAI,MAAM,GAAG;AACzB,SACE,CAAC,CAAC,OACF,CAAC,IAAI,YACL,CAAC,IAAI,aACJ,UAAU,GAAG,KAAM,IAAI,aAAa,YAAY,MAAM,GAAG;AAE9D;AAEA,MAAM,UAAU,CAAC,SAAiB,KAAK,QAAQ,qBAAqB,MAAM;AAEnE,SAAS,QAAQ,MAAsB;AAC5C,QAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,QAAM,SAAS,QACZ,MAAM,aAAa,EACnB,IAAI,CAAC,SAAU,cAAc,KAAK,IAAI,IAAI,WAAW,QAAQ,IAAI,CAAE,EACnE,KAAK,EAAE;AACV,SAAO,IAAI,OAAO,IAAI,MAAM,eAAe,GAAG;AAChD;AAOO,SAAS,WACd,OACA,SACY;AACZ,SAAO,CAAC,YAAY;AAClB,UAAM,MAAM,QAAQ;AACpB,UAAM,UAAU,MAAM,EACnB,OAAO,CAAC,EAAE,KAAK,MAAM,KAAK,KAAK,CAAC,SAAS,QAAQ,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,EACjE,IAAI,CAAC,EAAE,SAAS,MAAM,QAAQ;AACjC,UAAM,OAAO,CAAC,KAAK,GAAG,CAAC,GAAG,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,IAAI;AAC/E,UAAM,OAAO,QAAQ,EAClB,OAAO,CAAC,WAAW,OAAO,SAAS,WAAW,KAAK,SAAS,OAAO,WAAW,CAAC,EAC/E,IAAI,CAAC,WAAW,OAAO,QAAQ;AAClC,UAAM,QAAQ,QAAQ,OAAO,CAAC,aAAa,KAAK,SAAS,QAAQ,CAAC;AAClE,QAAI,MAAM,WAAW,EAAG,QAAO,MAAM,CAAC;AACtC,QAAI,QAAQ,WAAW,KAAK,CAAC,KAAK,OAAQ,QAAO,QAAQ,CAAC;AAC1D,WAAO,QAAQ,UAAU,KAAK,SAAS,OAAO;AAAA,EAChD;AACF;AAEO,SAAS,eAAe,OAA+C;AAC5E,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,MAAM;AAAA,IAAQ,CAAC,EAAE,UAAU,KAAK,MACrC,KAAK,OAAO,QAAQ,EAAE,QAAQ,CAAC,QAAQ;AACrC,YAAM,MAAM,GAAG,QAAQ,IAAI,GAAG;AAC9B,UAAI,KAAK,IAAI,GAAG,EAAG,QAAO,CAAC;AAC3B,WAAK,IAAI,GAAG;AACZ,aAAO,CAAC,EAAE,UAAU,IAAI,CAAC;AAAA,IAC3B,CAAC;AAAA,EACH;AACF;AAQO,SAAS,aACd,SACA,QACkB;AAClB,SAAO,QACJ,OAAO,CAAC,UAAU,OAAO,MAAM,GAAG,CAAC,EACnC,IAAI,CAAC,EAAE,QAAQ,KAAK,MAAM,MAAM;AAC/B,UAAM,WAAW,OAAO,IAAI,MAAM;AAClC,UAAM,QAAQ,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC;AACpD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAI,MAAM,SAAS,EAAE,OAAO,MAAM,IAAI,CAAC;AAAA,MACvC,GAAI,YAAY,SAAS,QAAQ,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,IACvD;AAAA,EACF,CAAC;AACL;AASO,SAAS,eAAe,OAAoE;AACjG,MAAI,QAAyB,CAAC;AAC9B,MAAI,UAAsC,CAAC;AAC3C,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI,OAAO;AACX,QAAM,OAAO,OAAO,QAAQ,UAAU;AACpC,UAAM,MAAM,EAAE,OAAO,KAAK,aAAa,SAAS,MAAM,EAAE;AACxD,UAAM,MAAM,KAAK,UAAU,GAAG;AAC9B,QAAI,CAAC,MAAM,aAAc,CAAC,SAAS,QAAQ,KAAO;AAClD,WAAO;AACP,UAAM,MAAM,UAAU,GAAG,EAAE,MAAM,CAAC,UAAmB;AACnD,UAAI,SAAS,IAAK,QAAO;AACzB,YAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,OAAO,MAAM,MAAM,MAAM;AAC7B,QAAM,MAAM,MAAM,MAAM,UAAU,CAAC,UAAU;AAC3C,UAAM,SAAS,SAAS,UAAU,MAAM,SAAS;AACjD,WAAO,MAAM;AACb,QAAI,OAAQ,MAAK,KAAK,IAAI,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD,CAAC;AACD,SAAO;AAAA,IACL,OAAO,OAAO;AACZ,cAAQ,eAAe,KAAK;AAC5B,aAAO,KAAK;AAAA,IACd;AAAA,IACA,QAAQ,MAAM;AACZ,gBAAU;AACV,aAAO,KAAK;AAAA,IACd;AAAA,IACA,MAAM,QAAQ,KAAK;AACjB,UAAI,CAAC,OAAO,IAAI,MAAM,EAAG,QAAO,IAAI,QAAQ,IAAI,IAAI,GAAG,EAAE,IAAI;AAC7D,aAAO,KAAK;AAAA,IACd;AAAA,IACA,OAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/secrets/extension.js

@@ -5,6 +5,7 @@ import {
   section,
   ToolTask
 } from "@earendil-works/pi-durable";
+import { TITLES } from "../titles/extension.js";
 import { listedLine, SECRETS_KIND } from "./view.js";
 const SECRETS = "slicc-secrets";
 const SECRETS_COMMAND = "/secrets";
@@ -92,10 +93,12 @@ function secretsEntry(names) {
 function shellGrants(names) {
   return (argv) => names.state.value.some((name) => name.exec === "shell") ? [...SHELL_GRANTS, ...argv] : argv;
 }
+const missing = (list) => [SECRETS, TITLES].filter((name) => !list.some((extension) => extension.name === name));
 function pinned(change) {
   const list = change.extensions;
-  if (!Array.isArray(list) || list.some((extension) => extension.name === SECRETS)) return change;
-  return { ...change, extensions: [...list, { name: SECRETS }] };
+  if (!Array.isArray(list)) return change;
+  const added = missing(list);
+  return added.length ? { ...change, extensions: [...list, ...added.map((name) => ({ name }))] } : change;
 }
 async function repin(harness, storage, context) {
   let fixed = 0;
@@ -106,7 +109,7 @@ async function repin(harness, storage, context) {
       const conversation = await harness.conversation(record.id, context);
       if (!conversation) continue;
       const agent = await conversation.agent(context);
-      if (agent.extensions.some((extension) => extension.name === SECRETS)) continue;
+      if (!missing(agent.extensions).length) continue;
       await conversation.configure(pinned({ extensions: agent.extensions }), context);
       fixed++;
     }

package/dist/secrets/extension.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/secrets/extension.ts"],
-  "sourcesContent": ["import type { Context, JsonValue } from '@earendil-works/chord';\nimport {\n  type AgentChange,\n  type Cursor,\n  defineExtension,\n  type Extension,\n  GenerationTask,\n  type Harness,\n  hook,\n  type Storage,\n  section,\n  type ToolExecutionResult,\n  ToolTask,\n} from '@earendil-works/pi-durable';\nimport type { Names, SecretName } from './names.ts';\nimport type { Scrub } from './scrub.ts';\nimport type { Vault } from './vault.ts';\nimport { listedLine, SECRETS_KIND } from './view.ts';\n\nexport { listedLine, SECRETS_KIND };\n\nexport const SECRETS = 'slicc-secrets';\nexport const SECRETS_COMMAND = '/secrets';\nexport const SHELL_GRANTS = ['fnox', 'exec', '--shell-grants', '--'] as const;\n\nexport const MODEL_LINE =\n  \"Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.\";\n\ntype Leaf = { get(): string; set(text: string): void };\n\nfunction leaves(value: JsonValue, out: Leaf[], set: (next: JsonValue) => void): void {\n  if (typeof value === 'string') {\n    out.push({ get: () => value, set });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, at) => {\n      leaves(item, out, (next) => {\n        value[at] = next;\n      });\n    });\n    return;\n  }\n  if (value && typeof value === 'object')\n    for (const [key, item] of Object.entries(value))\n      leaves(item as JsonValue, out, (next) => {\n        (value as Record<string, JsonValue>)[key] = next;\n      });\n}\n\nexport async function scrubResult(\n  result: ToolExecutionResult,\n  scrub: Pick<Scrub, 'texts'>\n): Promise<ToolExecutionResult | undefined> {\n  const content = [...(result.content ?? [])];\n  const diagnostics = [...(result.diagnostics ?? [])];\n  const details =\n    result.details === undefined ? undefined : (structuredClone(result.details) as JsonValue);\n  const found: Leaf[] = [];\n  content.forEach((item, at) => {\n    if (item.type === 'text')\n      found.push({ get: () => item.text, set: (text) => void (content[at] = { ...item, text }) });\n  });\n  diagnostics.forEach((item, at) => {\n    found.push({\n      get: () => item.message,\n      set: (message) => void (diagnostics[at] = { ...item, message }),\n    });\n  });\n  let replaced = details;\n  if (details !== undefined)\n    leaves(details, found, (next) => {\n      replaced = next;\n    });\n  const before = found.map((leaf) => leaf.get());\n  const after = await scrub.texts(before);\n  if (after.every((text, at) => text === before[at])) return undefined;\n  found.forEach((leaf, at) => {\n    leaf.set(after[at] as string);\n  });\n  const kept = result.content as ToolExecutionResult['content'] & unknown[];\n  if (kept) kept.splice(0, kept.length, ...content);\n  return {\n    ...result,\n    ...(kept ? { content: kept } : {}),\n    ...(result.diagnostics ? { diagnostics } : {}),\n    ...(replaced === undefined ? {} : { details: replaced }),\n  };\n}\n\nfunction where(name: SecretName): string {\n  const rules = name.rules.map((rule) =>\n    [\n      rule.domain,\n      rule.header ? `header ${rule.header}` : '',\n      rule.methods?.length ? rule.methods.join(' ') : '',\n      rule.paths?.length ? rule.paths.join(' ') : '',\n    ]\n      .filter(Boolean)\n      .join(', ')\n  );\n  const shell = name.exec === 'shell' ? ['in every bash'] : [];\n  const parts = [...rules, ...shell];\n  return parts.length ? `: ${parts.join('; ')}` : '';\n}\n\nexport function renderSecrets(names: readonly SecretName[]): string | undefined {\n  if (!names.length) return undefined;\n  const lines = names.map((name) => `- ${name.name} = ${name.placeholder}${where(name)}`);\n  return [MODEL_LINE, '', ...lines].join('\\n');\n}\n\nexport function secretsEntry(names: readonly SecretName[]) {\n  return {\n    kind: SECRETS_KIND,\n    data: { names: structuredClone(names) as unknown as JsonValue },\n    model: [{ role: 'user' as const, content: listedLine(names), timestamp: Date.now() }],\n  };\n}\n\nexport function shellGrants(names: Pick<Names, 'state'>) {\n  return (argv: readonly string[]): readonly string[] =>\n    names.state.value.some((name) => name.exec === 'shell') ? [...SHELL_GRANTS, ...argv] : argv;\n}\n\nexport function pinned<T extends AgentChange>(change: T): T {\n  const list = change.extensions;\n  if (!Array.isArray(list) || list.some((extension) => extension.name === SECRETS)) return change;\n  return { ...change, extensions: [...list, { name: SECRETS }] };\n}\n\nexport async function repin(\n  harness: Pick<Harness, 'conversation'>,\n  storage: Pick<Storage, 'scanConversations'>,\n  context: Context\n): Promise<number> {\n  let fixed = 0;\n  let cursor: Cursor | undefined;\n  do {\n    const page = await storage.scanConversations({}, 100, cursor, context);\n    for (const record of page.items) {\n      const conversation = await harness.conversation(record.id, context);\n      if (!conversation) continue;\n      const agent = await conversation.agent(context);\n      if (agent.extensions.some((extension) => extension.name === SECRETS)) continue;\n      await conversation.configure(pinned({ extensions: agent.extensions }), context);\n      fixed++;\n    }\n    cursor = page.next;\n  } while (cursor);\n  return fixed;\n}\n\nexport function secretsExtension(deps: {\n  names: Pick<Names, 'state'>;\n  vault: Pick<Vault, 'ready' | 'texts'>;\n}): Extension {\n  return defineExtension({\n    name: SECRETS,\n    sections: [section('secrets', () => renderSecrets(deps.names.state.value))],\n    hooks: [\n      hook(ToolTask, { afterTool: (_call, result) => scrubResult(result, deps.vault) }),\n      hook(GenerationTask, {\n        beforeRequest: async () => {\n          await deps.vault.ready();\n          return undefined;\n        },\n      }),\n    ],\n  });\n}\n"],
-  "mappings": "AACA;AAAA,EAGE;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,YAAY,oBAAoB;AAIlC,MAAM,UAAU;AAChB,MAAM,kBAAkB;AACxB,MAAM,eAAe,CAAC,QAAQ,QAAQ,kBAAkB,IAAI;AAE5D,MAAM,aACX;AAIF,SAAS,OAAO,OAAkB,KAAa,KAAsC;AACnF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,KAAK,EAAE,KAAK,MAAM,OAAO,IAAI,CAAC;AAClC;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,aAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,cAAM,EAAE,IAAI;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD;AAAA,EACF;AACA,MAAI,SAAS,OAAO,UAAU;AAC5B,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK;AAC5C,aAAO,MAAmB,KAAK,CAAC,SAAS;AACvC,QAAC,MAAoC,GAAG,IAAI;AAAA,MAC9C,CAAC;AACP;AAEA,eAAsB,YACpB,QACA,OAC0C;AAC1C,QAAM,UAAU,CAAC,GAAI,OAAO,WAAW,CAAC,CAAE;AAC1C,QAAM,cAAc,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAClD,QAAM,UACJ,OAAO,YAAY,SAAY,SAAa,gBAAgB,OAAO,OAAO;AAC5E,QAAM,QAAgB,CAAC;AACvB,UAAQ,QAAQ,CAAC,MAAM,OAAO;AAC5B,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,MAAM,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,GAAG,CAAC;AAAA,EAC9F,CAAC;AACD,cAAY,QAAQ,CAAC,MAAM,OAAO;AAChC,UAAM,KAAK;AAAA,MACT,KAAK,MAAM,KAAK;AAAA,MAChB,KAAK,CAAC,YAAY,MAAM,YAAY,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACD,MAAI,WAAW;AACf,MAAI,YAAY;AACd,WAAO,SAAS,OAAO,CAAC,SAAS;AAC/B,iBAAW;AAAA,IACb,CAAC;AACH,QAAM,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAC7C,QAAM,QAAQ,MAAM,MAAM,MAAM,MAAM;AACtC,MAAI,MAAM,MAAM,CAAC,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC,EAAG,QAAO;AAC3D,QAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,SAAK,IAAI,MAAM,EAAE,CAAW;AAAA,EAC9B,CAAC;AACD,QAAM,OAAO,OAAO;AACpB,MAAI,KAAM,MAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,OAAO;AAChD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,IAChC,GAAI,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,IAC5C,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS;AAAA,EACxD;AACF;AAEA,SAAS,MAAM,MAA0B;AACvC,QAAM,QAAQ,KAAK,MAAM;AAAA,IAAI,CAAC,SAC5B;AAAA,MACE,KAAK;AAAA,MACL,KAAK,SAAS,UAAU,KAAK,MAAM,KAAK;AAAA,MACxC,KAAK,SAAS,SAAS,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA,MAChD,KAAK,OAAO,SAAS,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA,IAC9C,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,EACd;AACA,QAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,eAAe,IAAI,CAAC;AAC3D,QAAM,QAAQ,CAAC,GAAG,OAAO,GAAG,KAAK;AACjC,SAAO,MAAM,SAAS,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK;AAClD;AAEO,SAAS,cAAc,OAAkD;AAC9E,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,QAAM,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE;AACtF,SAAO,CAAC,YAAY,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AAC7C;AAEO,SAAS,aAAa,OAA8B;AACzD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,EAAE,OAAO,gBAAgB,KAAK,EAA0B;AAAA,IAC9D,OAAO,CAAC,EAAE,MAAM,QAAiB,SAAS,WAAW,KAAK,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EACtF;AACF;AAEO,SAAS,YAAY,OAA6B;AACvD,SAAO,CAAC,SACN,MAAM,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,OAAO,IAAI,CAAC,GAAG,cAAc,GAAG,IAAI,IAAI;AAC3F;AAEO,SAAS,OAA8B,QAAc;AAC1D,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,KAAK,CAAC,cAAc,UAAU,SAAS,OAAO,EAAG,QAAO;AACzF,SAAO,EAAE,GAAG,QAAQ,YAAY,CAAC,GAAG,MAAM,EAAE,MAAM,QAAQ,CAAC,EAAE;AAC/D;AAEA,eAAsB,MACpB,SACA,SACA,SACiB;AACjB,MAAI,QAAQ;AACZ,MAAI;AACJ,KAAG;AACD,UAAM,OAAO,MAAM,QAAQ,kBAAkB,CAAC,GAAG,KAAK,QAAQ,OAAO;AACrE,eAAW,UAAU,KAAK,OAAO;AAC/B,YAAM,eAAe,MAAM,QAAQ,aAAa,OAAO,IAAI,OAAO;AAClE,UAAI,CAAC,aAAc;AACnB,YAAM,QAAQ,MAAM,aAAa,MAAM,OAAO;AAC9C,UAAI,MAAM,WAAW,KAAK,CAAC,cAAc,UAAU,SAAS,OAAO,EAAG;AACtE,YAAM,aAAa,UAAU,OAAO,EAAE,YAAY,MAAM,WAAW,CAAC,GAAG,OAAO;AAC9E;AAAA,IACF;AACA,aAAS,KAAK;AAAA,EAChB,SAAS;AACT,SAAO;AACT;AAEO,SAAS,iBAAiB,MAGnB;AACZ,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,UAAU,CAAC,QAAQ,WAAW,MAAM,cAAc,KAAK,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IAC1E,OAAO;AAAA,MACL,KAAK,UAAU,EAAE,WAAW,CAAC,OAAO,WAAW,YAAY,QAAQ,KAAK,KAAK,EAAE,CAAC;AAAA,MAChF,KAAK,gBAAgB;AAAA,QACnB,eAAe,YAAY;AACzB,gBAAM,KAAK,MAAM,MAAM;AACvB,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import type { Context, JsonValue } from '@earendil-works/chord';\nimport {\n  type AgentChange,\n  type Cursor,\n  defineExtension,\n  type Extension,\n  GenerationTask,\n  type Harness,\n  hook,\n  type Storage,\n  section,\n  type ToolExecutionResult,\n  ToolTask,\n} from '@earendil-works/pi-durable';\nimport { TITLES } from '../titles/extension.ts';\nimport type { Names, SecretName } from './names.ts';\nimport type { Scrub } from './scrub.ts';\nimport type { Vault } from './vault.ts';\nimport { listedLine, SECRETS_KIND } from './view.ts';\n\nexport { listedLine, SECRETS_KIND };\n\nexport const SECRETS = 'slicc-secrets';\nexport const SECRETS_COMMAND = '/secrets';\nexport const SHELL_GRANTS = ['fnox', 'exec', '--shell-grants', '--'] as const;\n\nexport const MODEL_LINE =\n  \"Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.\";\n\ntype Leaf = { get(): string; set(text: string): void };\n\nfunction leaves(value: JsonValue, out: Leaf[], set: (next: JsonValue) => void): void {\n  if (typeof value === 'string') {\n    out.push({ get: () => value, set });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, at) => {\n      leaves(item, out, (next) => {\n        value[at] = next;\n      });\n    });\n    return;\n  }\n  if (value && typeof value === 'object')\n    for (const [key, item] of Object.entries(value))\n      leaves(item as JsonValue, out, (next) => {\n        (value as Record<string, JsonValue>)[key] = next;\n      });\n}\n\nexport async function scrubResult(\n  result: ToolExecutionResult,\n  scrub: Pick<Scrub, 'texts'>\n): Promise<ToolExecutionResult | undefined> {\n  const content = [...(result.content ?? [])];\n  const diagnostics = [...(result.diagnostics ?? [])];\n  const details =\n    result.details === undefined ? undefined : (structuredClone(result.details) as JsonValue);\n  const found: Leaf[] = [];\n  content.forEach((item, at) => {\n    if (item.type === 'text')\n      found.push({ get: () => item.text, set: (text) => void (content[at] = { ...item, text }) });\n  });\n  diagnostics.forEach((item, at) => {\n    found.push({\n      get: () => item.message,\n      set: (message) => void (diagnostics[at] = { ...item, message }),\n    });\n  });\n  let replaced = details;\n  if (details !== undefined)\n    leaves(details, found, (next) => {\n      replaced = next;\n    });\n  const before = found.map((leaf) => leaf.get());\n  const after = await scrub.texts(before);\n  if (after.every((text, at) => text === before[at])) return undefined;\n  found.forEach((leaf, at) => {\n    leaf.set(after[at] as string);\n  });\n  const kept = result.content as ToolExecutionResult['content'] & unknown[];\n  if (kept) kept.splice(0, kept.length, ...content);\n  return {\n    ...result,\n    ...(kept ? { content: kept } : {}),\n    ...(result.diagnostics ? { diagnostics } : {}),\n    ...(replaced === undefined ? {} : { details: replaced }),\n  };\n}\n\nfunction where(name: SecretName): string {\n  const rules = name.rules.map((rule) =>\n    [\n      rule.domain,\n      rule.header ? `header ${rule.header}` : '',\n      rule.methods?.length ? rule.methods.join(' ') : '',\n      rule.paths?.length ? rule.paths.join(' ') : '',\n    ]\n      .filter(Boolean)\n      .join(', ')\n  );\n  const shell = name.exec === 'shell' ? ['in every bash'] : [];\n  const parts = [...rules, ...shell];\n  return parts.length ? `: ${parts.join('; ')}` : '';\n}\n\nexport function renderSecrets(names: readonly SecretName[]): string | undefined {\n  if (!names.length) return undefined;\n  const lines = names.map((name) => `- ${name.name} = ${name.placeholder}${where(name)}`);\n  return [MODEL_LINE, '', ...lines].join('\\n');\n}\n\nexport function secretsEntry(names: readonly SecretName[]) {\n  return {\n    kind: SECRETS_KIND,\n    data: { names: structuredClone(names) as unknown as JsonValue },\n    model: [{ role: 'user' as const, content: listedLine(names), timestamp: Date.now() }],\n  };\n}\n\nexport function shellGrants(names: Pick<Names, 'state'>) {\n  return (argv: readonly string[]): readonly string[] =>\n    names.state.value.some((name) => name.exec === 'shell') ? [...SHELL_GRANTS, ...argv] : argv;\n}\n\nconst missing = (list: readonly { name: string }[]) =>\n  [SECRETS, TITLES].filter((name) => !list.some((extension) => extension.name === name));\n\nexport function pinned<T extends AgentChange>(change: T): T {\n  const list = change.extensions;\n  if (!Array.isArray(list)) return change;\n  const added = missing(list);\n  return added.length\n    ? { ...change, extensions: [...list, ...added.map((name) => ({ name }))] }\n    : change;\n}\n\nexport async function repin(\n  harness: Pick<Harness, 'conversation'>,\n  storage: Pick<Storage, 'scanConversations'>,\n  context: Context\n): Promise<number> {\n  let fixed = 0;\n  let cursor: Cursor | undefined;\n  do {\n    const page = await storage.scanConversations({}, 100, cursor, context);\n    for (const record of page.items) {\n      const conversation = await harness.conversation(record.id, context);\n      if (!conversation) continue;\n      const agent = await conversation.agent(context);\n      if (!missing(agent.extensions).length) continue;\n      await conversation.configure(pinned({ extensions: agent.extensions }), context);\n      fixed++;\n    }\n    cursor = page.next;\n  } while (cursor);\n  return fixed;\n}\n\nexport function secretsExtension(deps: {\n  names: Pick<Names, 'state'>;\n  vault: Pick<Vault, 'ready' | 'texts'>;\n}): Extension {\n  return defineExtension({\n    name: SECRETS,\n    sections: [section('secrets', () => renderSecrets(deps.names.state.value))],\n    hooks: [\n      hook(ToolTask, { afterTool: (_call, result) => scrubResult(result, deps.vault) }),\n      hook(GenerationTask, {\n        beforeRequest: async () => {\n          await deps.vault.ready();\n          return undefined;\n        },\n      }),\n    ],\n  });\n}\n"],
+  "mappings": "AACA;AAAA,EAGE;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,cAAc;AAIvB,SAAS,YAAY,oBAAoB;AAIlC,MAAM,UAAU;AAChB,MAAM,kBAAkB;AACxB,MAAM,eAAe,CAAC,QAAQ,QAAQ,kBAAkB,IAAI;AAE5D,MAAM,aACX;AAIF,SAAS,OAAO,OAAkB,KAAa,KAAsC;AACnF,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,KAAK,EAAE,KAAK,MAAM,OAAO,IAAI,CAAC;AAClC;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,aAAO,MAAM,KAAK,CAAC,SAAS;AAC1B,cAAM,EAAE,IAAI;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD;AAAA,EACF;AACA,MAAI,SAAS,OAAO,UAAU;AAC5B,eAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK;AAC5C,aAAO,MAAmB,KAAK,CAAC,SAAS;AACvC,QAAC,MAAoC,GAAG,IAAI;AAAA,MAC9C,CAAC;AACP;AAEA,eAAsB,YACpB,QACA,OAC0C;AAC1C,QAAM,UAAU,CAAC,GAAI,OAAO,WAAW,CAAC,CAAE;AAC1C,QAAM,cAAc,CAAC,GAAI,OAAO,eAAe,CAAC,CAAE;AAClD,QAAM,UACJ,OAAO,YAAY,SAAY,SAAa,gBAAgB,OAAO,OAAO;AAC5E,QAAM,QAAgB,CAAC;AACvB,UAAQ,QAAQ,CAAC,MAAM,OAAO;AAC5B,QAAI,KAAK,SAAS;AAChB,YAAM,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,KAAK,CAAC,SAAS,MAAM,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,GAAG,CAAC;AAAA,EAC9F,CAAC;AACD,cAAY,QAAQ,CAAC,MAAM,OAAO;AAChC,UAAM,KAAK;AAAA,MACT,KAAK,MAAM,KAAK;AAAA,MAChB,KAAK,CAAC,YAAY,MAAM,YAAY,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ;AAAA,IAC/D,CAAC;AAAA,EACH,CAAC;AACD,MAAI,WAAW;AACf,MAAI,YAAY;AACd,WAAO,SAAS,OAAO,CAAC,SAAS;AAC/B,iBAAW;AAAA,IACb,CAAC;AACH,QAAM,SAAS,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC;AAC7C,QAAM,QAAQ,MAAM,MAAM,MAAM,MAAM;AACtC,MAAI,MAAM,MAAM,CAAC,MAAM,OAAO,SAAS,OAAO,EAAE,CAAC,EAAG,QAAO;AAC3D,QAAM,QAAQ,CAAC,MAAM,OAAO;AAC1B,SAAK,IAAI,MAAM,EAAE,CAAW;AAAA,EAC9B,CAAC;AACD,QAAM,OAAO,OAAO;AACpB,MAAI,KAAM,MAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,OAAO;AAChD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC;AAAA,IAChC,GAAI,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,IAC5C,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS;AAAA,EACxD;AACF;AAEA,SAAS,MAAM,MAA0B;AACvC,QAAM,QAAQ,KAAK,MAAM;AAAA,IAAI,CAAC,SAC5B;AAAA,MACE,KAAK;AAAA,MACL,KAAK,SAAS,UAAU,KAAK,MAAM,KAAK;AAAA,MACxC,KAAK,SAAS,SAAS,KAAK,QAAQ,KAAK,GAAG,IAAI;AAAA,MAChD,KAAK,OAAO,SAAS,KAAK,MAAM,KAAK,GAAG,IAAI;AAAA,IAC9C,EACG,OAAO,OAAO,EACd,KAAK,IAAI;AAAA,EACd;AACA,QAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,eAAe,IAAI,CAAC;AAC3D,QAAM,QAAQ,CAAC,GAAG,OAAO,GAAG,KAAK;AACjC,SAAO,MAAM,SAAS,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK;AAClD;AAEO,SAAS,cAAc,OAAkD;AAC9E,MAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,QAAM,QAAQ,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE;AACtF,SAAO,CAAC,YAAY,IAAI,GAAG,KAAK,EAAE,KAAK,IAAI;AAC7C;AAEO,SAAS,aAAa,OAA8B;AACzD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,EAAE,OAAO,gBAAgB,KAAK,EAA0B;AAAA,IAC9D,OAAO,CAAC,EAAE,MAAM,QAAiB,SAAS,WAAW,KAAK,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EACtF;AACF;AAEO,SAAS,YAAY,OAA6B;AACvD,SAAO,CAAC,SACN,MAAM,MAAM,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,OAAO,IAAI,CAAC,GAAG,cAAc,GAAG,IAAI,IAAI;AAC3F;AAEA,MAAM,UAAU,CAAC,SACf,CAAC,SAAS,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,cAAc,UAAU,SAAS,IAAI,CAAC;AAEhF,SAAS,OAA8B,QAAc;AAC1D,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO;AACjC,QAAM,QAAQ,QAAQ,IAAI;AAC1B,SAAO,MAAM,SACT,EAAE,GAAG,QAAQ,YAAY,CAAC,GAAG,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,IACvE;AACN;AAEA,eAAsB,MACpB,SACA,SACA,SACiB;AACjB,MAAI,QAAQ;AACZ,MAAI;AACJ,KAAG;AACD,UAAM,OAAO,MAAM,QAAQ,kBAAkB,CAAC,GAAG,KAAK,QAAQ,OAAO;AACrE,eAAW,UAAU,KAAK,OAAO;AAC/B,YAAM,eAAe,MAAM,QAAQ,aAAa,OAAO,IAAI,OAAO;AAClE,UAAI,CAAC,aAAc;AACnB,YAAM,QAAQ,MAAM,aAAa,MAAM,OAAO;AAC9C,UAAI,CAAC,QAAQ,MAAM,UAAU,EAAE,OAAQ;AACvC,YAAM,aAAa,UAAU,OAAO,EAAE,YAAY,MAAM,WAAW,CAAC,GAAG,OAAO;AAC9E;AAAA,IACF;AACA,aAAS,KAAK;AAAA,EAChB,SAAS;AACT,SAAO;AACT;AAEO,SAAS,iBAAiB,MAGnB;AACZ,SAAO,gBAAgB;AAAA,IACrB,MAAM;AAAA,IACN,UAAU,CAAC,QAAQ,WAAW,MAAM,cAAc,KAAK,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,IAC1E,OAAO;AAAA,MACL,KAAK,UAAU,EAAE,WAAW,CAAC,OAAO,WAAW,YAAY,QAAQ,KAAK,KAAK,EAAE,CAAC;AAAA,MAChF,KAAK,gBAAgB;AAAA,QACnB,eAAe,YAAY;AACzB,gBAAM,KAAK,MAAM,MAAM;AACvB,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/secrets/fetch.js

@@ -0,0 +1,160 @@
+import { VaultRefusal } from "./vault.js";
+const BODYLESS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const MIN_PART = 8;
+function absent(vault) {
+  return !vault.connected && !vault.needed;
+}
+async function outgoing(request) {
+  const body = BODYLESS.has(request.method) ? void 0 : new Uint8Array(await request.arrayBuffer());
+  return {
+    method: request.method,
+    url: request.url,
+    headers: [...request.headers],
+    ...body ? { body } : {}
+  };
+}
+function refusal(error) {
+  const code = error instanceof VaultRefusal ? error.code : void 0;
+  const status = code === "EACCES" ? 403 : code === "EINVAL" ? 400 : 503;
+  const text = error instanceof Error ? error.message : String(error);
+  return new Response(text, {
+    status,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+async function prepared(op, request) {
+  try {
+    return await op.prepare(request);
+  } catch (error) {
+    if (error instanceof VaultRefusal && error.code === "EAGAIN") return op.prepare(request);
+    throw error;
+  }
+}
+function filled(original, ready) {
+  const sent2 = new Set(original.headers.map(([, value]) => value));
+  const values = ready.headers.map(([, value]) => value).filter((value) => !sent2.has(value));
+  if (ready.url !== original.url) values.push(ready.url, decodeURIComponent(ready.url));
+  return values.flatMap((value) => [
+    value,
+    ...value.split(/[\s=&?]+/).filter((part) => part.length >= MIN_PART)
+  ]);
+}
+function safeError(error, original, ready) {
+  if (error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError"))
+    return error;
+  const text = error instanceof Error ? error.message : String(error);
+  const parts = filled(original, ready);
+  const shown = parts.some((part) => text.includes(part)) ? "the request failed" : text;
+  return new TypeError(`${ready.method} ${new URL(ready.url).origin}: ${shown}`);
+}
+async function sent(inner, request, original, ready) {
+  const init = {
+    method: ready.method,
+    headers: ready.headers,
+    signal: request.signal,
+    redirect: request.redirect,
+    credentials: request.credentials,
+    ...ready.body === void 0 ? {} : { body: ready.body }
+  };
+  try {
+    return await inner(ready.url, init);
+  } catch (error) {
+    throw safeError(error, original, ready);
+  }
+}
+async function through(op, inner, request) {
+  const original = await outgoing(request);
+  let refreshed = false;
+  for (; ; ) {
+    let ready;
+    try {
+      ready = await prepared(op, original);
+    } catch (error) {
+      return refusal(error);
+    }
+    const response = await sent(inner, request, original, ready);
+    if (response.status !== 401 || refreshed || !op.refresh) return response;
+    refreshed = true;
+    if (!await op.refresh().then(
+      () => true,
+      () => false
+    ))
+      return response;
+    await response.body?.cancel().catch(() => void 0);
+  }
+}
+function vaultFetch(vault, inner, route) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const provider = absent(vault) ? void 0 : route(request);
+    if (provider === void 0) return inner(request);
+    const target = provider === null ? void 0 : { provider };
+    return through(
+      {
+        prepare: (outgoing2) => vault.model(provider ?? void 0, outgoing2),
+        ...target ? { refresh: () => vault.refresh(target) } : {}
+      },
+      inner,
+      request
+    );
+  };
+}
+function mcpFetch(vault, inner, server) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    if (absent(vault)) return inner(request);
+    return through(
+      {
+        prepare: (outgoing2) => vault.mcp(server, outgoing2),
+        refresh: () => vault.refresh({ server })
+      },
+      inner,
+      request
+    );
+  };
+}
+const NO_VAULT_SIGN_IN = "MCP sign-in needs seven's vault: update seven";
+function oauthOf(url, params) {
+  const scope = params.get("scope");
+  const resource = params.get("resource");
+  return {
+    tokenUrl: url,
+    clientId: params.get("client_id") ?? "",
+    ...scope ? { scope } : {},
+    ...resource ? { resource } : {}
+  };
+}
+function grantFetch(vault, server, base) {
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const params = request.method === "POST" ? new URLSearchParams(await request.clone().text()) : void 0;
+    if (params?.get("grant_type") !== "authorization_code") return base(request);
+    if (absent(vault)) throw new Error(NO_VAULT_SIGN_IN);
+    const response = await base(request);
+    if (!response.ok) return response;
+    const raw = new Uint8Array(await response.arrayBuffer());
+    try {
+      const granted = await vault.grant(server, raw, oauthOf(request.url, params));
+      return new Response(granted.response, {
+        status: response.status,
+        headers: { "content-type": "application/json" }
+      });
+    } catch (error) {
+      throw new Error(
+        `the vault didn't keep the sign-in: ${error instanceof Error ? error.message : String(error)}`
+      );
+    } finally {
+      raw.fill(0);
+    }
+  };
+}
+export {
+  NO_VAULT_SIGN_IN,
+  absent,
+  grantFetch,
+  mcpFetch,
+  refusal,
+  safeError,
+  vaultFetch
+};
+//# sourceMappingURL=fetch.js.map

package/dist/secrets/fetch.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/fetch.ts"],
+  "sourcesContent": ["import type { OAuthConfig, OutgoingRequest } from '@ai-ecoverse/slicc-vault';\nimport { type RefreshTarget, type Vault, VaultRefusal } from './vault.ts';\n\ntype Fetch = typeof fetch;\n\ntype Port = Pick<Vault, 'connected' | 'needed' | 'model' | 'mcp' | 'refresh' | 'grant'>;\n\nexport type ModelRoute = (request: Request) => string | null | undefined;\n\ninterface Op {\n  prepare(request: OutgoingRequest): Promise<OutgoingRequest>;\n  refresh?(): Promise<unknown>;\n}\n\nconst BODYLESS = new Set(['GET', 'HEAD']);\nconst MIN_PART = 8;\n\nexport function absent(vault: Pick<Vault, 'connected' | 'needed'>): boolean {\n  return !vault.connected && !vault.needed;\n}\n\nasync function outgoing(request: Request): Promise<OutgoingRequest> {\n  const body = BODYLESS.has(request.method)\n    ? undefined\n    : new Uint8Array(await request.arrayBuffer());\n  return {\n    method: request.method,\n    url: request.url,\n    headers: [...request.headers],\n    ...(body ? { body } : {}),\n  };\n}\n\nexport function refusal(error: unknown): Response {\n  const code = error instanceof VaultRefusal ? error.code : undefined;\n  const status = code === 'EACCES' ? 403 : code === 'EINVAL' ? 400 : 503;\n  const text = error instanceof Error ? error.message : String(error);\n  return new Response(text, {\n    status,\n    headers: { 'content-type': 'text/plain; charset=utf-8' },\n  });\n}\n\nasync function prepared(op: Op, request: OutgoingRequest): Promise<OutgoingRequest> {\n  try {\n    return await op.prepare(request);\n  } catch (error) {\n    if (error instanceof VaultRefusal && error.code === 'EAGAIN') return op.prepare(request);\n    throw error;\n  }\n}\n\nfunction filled(original: OutgoingRequest, ready: OutgoingRequest): string[] {\n  const sent = new Set(original.headers.map(([, value]) => value));\n  const values = ready.headers.map(([, value]) => value).filter((value) => !sent.has(value));\n  if (ready.url !== original.url) values.push(ready.url, decodeURIComponent(ready.url));\n  return values.flatMap((value) => [\n    value,\n    ...value.split(/[\\s=&?]+/).filter((part) => part.length >= MIN_PART),\n  ]);\n}\n\nexport function safeError(error: unknown, original: OutgoingRequest, ready: OutgoingRequest) {\n  if (\n    error instanceof DOMException &&\n    (error.name === 'AbortError' || error.name === 'TimeoutError')\n  )\n    return error;\n  const text = error instanceof Error ? error.message : String(error);\n  const parts = filled(original, ready);\n  const shown = parts.some((part) => text.includes(part)) ? 'the request failed' : text;\n  return new TypeError(`${ready.method} ${new URL(ready.url).origin}: ${shown}`);\n}\n\nasync function sent(\n  inner: Fetch,\n  request: Request,\n  original: OutgoingRequest,\n  ready: OutgoingRequest\n) {\n  const init: RequestInit = {\n    method: ready.method,\n    headers: ready.headers,\n    signal: request.signal,\n    redirect: request.redirect,\n    credentials: request.credentials,\n    ...(ready.body === undefined ? {} : { body: ready.body as BodyInit }),\n  };\n  try {\n    return await inner(ready.url, init);\n  } catch (error) {\n    throw safeError(error, original, ready);\n  }\n}\n\nasync function through(op: Op, inner: Fetch, request: Request): Promise<Response> {\n  const original = await outgoing(request);\n  let refreshed = false;\n  for (;;) {\n    let ready: OutgoingRequest;\n    try {\n      ready = await prepared(op, original);\n    } catch (error) {\n      return refusal(error);\n    }\n    const response = await sent(inner, request, original, ready);\n    if (response.status !== 401 || refreshed || !op.refresh) return response;\n    refreshed = true;\n    if (\n      !(await op.refresh().then(\n        () => true,\n        () => false\n      ))\n    )\n      return response;\n    await response.body?.cancel().catch(() => undefined);\n  }\n}\n\nexport function vaultFetch(vault: Port, inner: Fetch, route: ModelRoute): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const provider = absent(vault) ? undefined : route(request);\n    if (provider === undefined) return inner(request);\n    const target: RefreshTarget | undefined = provider === null ? undefined : { provider };\n    return through(\n      {\n        prepare: (outgoing) => vault.model(provider ?? undefined, outgoing),\n        ...(target ? { refresh: () => vault.refresh(target) } : {}),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport function mcpFetch(vault: Port, inner: Fetch, server: string): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    if (absent(vault)) return inner(request);\n    return through(\n      {\n        prepare: (outgoing) => vault.mcp(server, outgoing),\n        refresh: () => vault.refresh({ server }),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport const NO_VAULT_SIGN_IN = \"MCP sign-in needs seven's vault: update seven\";\n\nfunction oauthOf(url: string, params: URLSearchParams): OAuthConfig {\n  const scope = params.get('scope');\n  const resource = params.get('resource');\n  return {\n    tokenUrl: url,\n    clientId: params.get('client_id') ?? '',\n    ...(scope ? { scope } : {}),\n    ...(resource ? { resource } : {}),\n  };\n}\n\nexport function grantFetch(vault: Port, server: string, base: Fetch): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const params =\n      request.method === 'POST' ? new URLSearchParams(await request.clone().text()) : undefined;\n    if (params?.get('grant_type') !== 'authorization_code') return base(request);\n    if (absent(vault)) throw new Error(NO_VAULT_SIGN_IN);\n    const response = await base(request);\n    if (!response.ok) return response;\n    const raw = new Uint8Array(await response.arrayBuffer());\n    try {\n      const granted = await vault.grant(server, raw, oauthOf(request.url, params));\n      return new Response(granted.response as BodyInit, {\n        status: response.status,\n        headers: { 'content-type': 'application/json' },\n      });\n    } catch (error) {\n      throw new Error(\n        `the vault didn't keep the sign-in: ${error instanceof Error ? error.message : String(error)}`\n      );\n    } finally {\n      raw.fill(0);\n    }\n  };\n}\n"],
+  "mappings": "AACA,SAAyC,oBAAoB;AAa7D,MAAM,WAAW,oBAAI,IAAI,CAAC,OAAO,MAAM,CAAC;AACxC,MAAM,WAAW;AAEV,SAAS,OAAO,OAAqD;AAC1E,SAAO,CAAC,MAAM,aAAa,CAAC,MAAM;AACpC;AAEA,eAAe,SAAS,SAA4C;AAClE,QAAM,OAAO,SAAS,IAAI,QAAQ,MAAM,IACpC,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,QAAQ;AAAA,IACb,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,IAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,EACzB;AACF;AAEO,SAAS,QAAQ,OAA0B;AAChD,QAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO;AAC1D,QAAM,SAAS,SAAS,WAAW,MAAM,SAAS,WAAW,MAAM;AACnE,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,gBAAgB,4BAA4B;AAAA,EACzD,CAAC;AACH;AAEA,eAAe,SAAS,IAAQ,SAAoD;AAClF,MAAI;AACF,WAAO,MAAM,GAAG,QAAQ,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,iBAAiB,gBAAgB,MAAM,SAAS,SAAU,QAAO,GAAG,QAAQ,OAAO;AACvF,UAAM;AAAA,EACR;AACF;AAEA,SAAS,OAAO,UAA2B,OAAkC;AAC3E,QAAMA,QAAO,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAC/D,QAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,EAAE,OAAO,CAAC,UAAU,CAACA,MAAK,IAAI,KAAK,CAAC;AACzF,MAAI,MAAM,QAAQ,SAAS,IAAK,QAAO,KAAK,MAAM,KAAK,mBAAmB,MAAM,GAAG,CAAC;AACpF,SAAO,OAAO,QAAQ,CAAC,UAAU;AAAA,IAC/B;AAAA,IACA,GAAG,MAAM,MAAM,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU,QAAQ;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,UAAU,OAAgB,UAA2B,OAAwB;AAC3F,MACE,iBAAiB,iBAChB,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAE/C,WAAO;AACT,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,QAAM,QAAQ,OAAO,UAAU,KAAK;AACpC,QAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,uBAAuB;AACjF,SAAO,IAAI,UAAU,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE;AAC/E;AAEA,eAAe,KACb,OACA,SACA,UACA,OACA;AACA,QAAM,OAAoB;AAAA,IACxB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,aAAa,QAAQ;AAAA,IACrB,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAiB;AAAA,EACrE;AACA,MAAI;AACF,WAAO,MAAM,MAAM,MAAM,KAAK,IAAI;AAAA,EACpC,SAAS,OAAO;AACd,UAAM,UAAU,OAAO,UAAU,KAAK;AAAA,EACxC;AACF;AAEA,eAAe,QAAQ,IAAQ,OAAc,SAAqC;AAChF,QAAM,WAAW,MAAM,SAAS,OAAO;AACvC,MAAI,YAAY;AAChB,aAAS;AACP,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,SAAS,IAAI,QAAQ;AAAA,IACrC,SAAS,OAAO;AACd,aAAO,QAAQ,KAAK;AAAA,IACtB;AACA,UAAM,WAAW,MAAM,KAAK,OAAO,SAAS,UAAU,KAAK;AAC3D,QAAI,SAAS,WAAW,OAAO,aAAa,CAAC,GAAG,QAAS,QAAO;AAChE,gBAAY;AACZ,QACE,CAAE,MAAM,GAAG,QAAQ,EAAE;AAAA,MACnB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,aAAO;AACT,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACrD;AACF;AAEO,SAAS,WAAW,OAAa,OAAc,OAA0B;AAC9E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,WAAW,OAAO,KAAK,IAAI,SAAY,MAAM,OAAO;AAC1D,QAAI,aAAa,OAAW,QAAO,MAAM,OAAO;AAChD,UAAM,SAAoC,aAAa,OAAO,SAAY,EAAE,SAAS;AACrF,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACC,cAAa,MAAM,MAAM,YAAY,QAAWA,SAAQ;AAAA,QAClE,GAAI,SAAS,EAAE,SAAS,MAAM,MAAM,QAAQ,MAAM,EAAE,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,SAAS,OAAa,OAAc,QAAuB;AACzE,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,MAAM,OAAO;AACvC,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACA,cAAa,MAAM,IAAI,QAAQA,SAAQ;AAAA,QACjD,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mBAAmB;AAEhC,SAAS,QAAQ,KAAa,QAAsC;AAClE,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,OAAO,IAAI,WAAW,KAAK;AAAA,IACrC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACF;AAEO,SAAS,WAAW,OAAa,QAAgB,MAAoB;AAC1E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,SACJ,QAAQ,WAAW,SAAS,IAAI,gBAAgB,MAAM,QAAQ,MAAM,EAAE,KAAK,CAAC,IAAI;AAClF,QAAI,QAAQ,IAAI,YAAY,MAAM,qBAAsB,QAAO,KAAK,OAAO;AAC3E,QAAI,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,gBAAgB;AACnD,UAAM,WAAW,MAAM,KAAK,OAAO;AACnC,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,MAAM,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,CAAC;AAC3E,aAAO,IAAI,SAAS,QAAQ,UAAsB;AAAA,QAChD,QAAQ,SAAS;AAAA,QACjB,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC9F;AAAA,IACF,UAAE;AACA,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACF;",
+  "names": ["sent", "outgoing"]
+}

package/dist/secrets/records.js

@@ -0,0 +1,35 @@
+import { replicatedState } from "@earendil-works/chord";
+function vaultRecords(vault) {
+  const state = replicatedState([]);
+  let version = vault.state.value.version;
+  let port = vault.state.value.port;
+  let lock = Promise.resolve();
+  const read = async () => vault.connected || vault.needed ? vault.records() : [];
+  const refresh = (context) => {
+    const run = lock.then(async () => state.replace(context, await read()));
+    lock = run.catch(() => void 0);
+    return run;
+  };
+  const off = vault.state.subscribe((value, context) => {
+    const bumped = value.version !== version || port === "none" && value.port !== "none";
+    version = value.version;
+    port = value.port;
+    if (bumped) void refresh(context).catch(() => void 0);
+  });
+  const of = (kind) => state.value.filter((record) => record.kind === kind);
+  return {
+    state,
+    refresh,
+    model: (provider) => of("model").find((record) => record.provider === provider),
+    mcp: (server, name) => {
+      const own = of("mcp").filter((record) => record.server === server);
+      if (name === void 0) return own[0];
+      return own.find((record) => record.name === name) ?? of("mcp").find((record) => record.server === void 0 && record.name === name);
+    },
+    close: off
+  };
+}
+export {
+  vaultRecords
+};
+//# sourceMappingURL=records.js.map

package/dist/secrets/records.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/records.ts"],
+  "sourcesContent": ["import type { AgentRecord } from '@ai-ecoverse/slicc-vault';\nimport { type Context, type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport type { Vault } from './vault.ts';\n\nexport type { AgentRecord } from '@ai-ecoverse/slicc-vault';\n\nexport interface VaultRecords {\n  readonly state: MutableReplicatedState<AgentRecord[]>;\n  refresh(context: Context): Promise<void>;\n  model(provider: string): AgentRecord | undefined;\n  mcp(server: string, name?: string): AgentRecord | undefined;\n  close(): void;\n}\n\ntype Source = Pick<Vault, 'state' | 'records' | 'connected' | 'needed'>;\n\nexport function vaultRecords(vault: Source): VaultRecords {\n  const state = replicatedState<AgentRecord[]>([]);\n  let version = vault.state.value.version;\n  let port = vault.state.value.port;\n  let lock: Promise<unknown> = Promise.resolve();\n  const read = async () => (vault.connected || vault.needed ? vault.records() : []);\n  const refresh = (context: Context) => {\n    const run = lock.then(async () => state.replace(context, await read()));\n    lock = run.catch(() => undefined);\n    return run;\n  };\n  const off = vault.state.subscribe((value, context) => {\n    const bumped = value.version !== version || (port === 'none' && value.port !== 'none');\n    version = value.version;\n    port = value.port;\n    if (bumped) void refresh(context).catch(() => undefined);\n  });\n  const of = (kind: AgentRecord['kind']) => state.value.filter((record) => record.kind === kind);\n  return {\n    state,\n    refresh,\n    model: (provider) => of('model').find((record) => record.provider === provider),\n    mcp: (server, name) => {\n      const own = of('mcp').filter((record) => record.server === server);\n      if (name === undefined) return own[0];\n      return (\n        own.find((record) => record.name === name) ??\n        of('mcp').find((record) => record.server === undefined && record.name === name)\n      );\n    },\n    close: off,\n  };\n}\n"],
+  "mappings": "AACA,SAAoD,uBAAuB;AAepE,SAAS,aAAa,OAA6B;AACxD,QAAM,QAAQ,gBAA+B,CAAC,CAAC;AAC/C,MAAI,UAAU,MAAM,MAAM,MAAM;AAChC,MAAI,OAAO,MAAM,MAAM,MAAM;AAC7B,MAAI,OAAyB,QAAQ,QAAQ;AAC7C,QAAM,OAAO,YAAa,MAAM,aAAa,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC;AAC/E,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,MAAM,KAAK,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC;AACtE,WAAO,IAAI,MAAM,MAAM,MAAS;AAChC,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAM,MAAM,UAAU,CAAC,OAAO,YAAY;AACpD,UAAM,SAAS,MAAM,YAAY,WAAY,SAAS,UAAU,MAAM,SAAS;AAC/E,cAAU,MAAM;AAChB,WAAO,MAAM;AACb,QAAI,OAAQ,MAAK,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD,CAAC;AACD,QAAM,KAAK,CAAC,SAA8B,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,SAAS,IAAI;AAC7F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,CAAC,aAAa,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,OAAO,aAAa,QAAQ;AAAA,IAC9E,KAAK,CAAC,QAAQ,SAAS;AACrB,YAAM,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM;AACjE,UAAI,SAAS,OAAW,QAAO,IAAI,CAAC;AACpC,aACE,IAAI,KAAK,CAAC,WAAW,OAAO,SAAS,IAAI,KACzC,GAAG,KAAK,EAAE,KAAK,CAAC,WAAW,OAAO,WAAW,UAAa,OAAO,SAAS,IAAI;AAAA,IAElF;AAAA,IACA,OAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/secrets/store.js

@@ -0,0 +1,50 @@
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+function memoryStore() {
+  const values = /* @__PURE__ */ new Map();
+  return {
+    get: async (key) => structuredClone(values.get(key)),
+    async set(key, value) {
+      if (value === void 0) values.delete(key);
+      else values.set(key, structuredClone(value));
+    }
+  };
+}
+function fileStore(env, path) {
+  let cache;
+  let writes = Promise.resolve();
+  const load = () => {
+    cache ??= env.readTextFile(path, BACKGROUND_CONTEXT).then((read) => {
+      if (!read.ok) return {};
+      try {
+        const parsed = JSON.parse(read.value);
+        return parsed && typeof parsed === "object" ? parsed : {};
+      } catch {
+        return {};
+      }
+    });
+    return cache;
+  };
+  return {
+    async get(key) {
+      await writes;
+      return structuredClone((await load())[key]);
+    },
+    set(key, value) {
+      const write = writes.then(async () => {
+        const all = { ...await load() };
+        if (value === void 0) delete all[key];
+        else all[key] = structuredClone(value);
+        cache = Promise.resolve(all);
+        const wrote = await env.writeFile(path, JSON.stringify(all), BACKGROUND_CONTEXT);
+        if (!wrote.ok) throw new Error(`can't write ${path}`);
+      });
+      writes = write.catch(() => void 0);
+      return write;
+    }
+  };
+}
+export {
+  fileStore,
+  memoryStore
+};
+//# sourceMappingURL=store.js.map

package/dist/secrets/store.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/secrets/store.ts"],
+  "sourcesContent": ["import { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ExecutionEnv } from '@earendil-works/pi-durable/env';\n\nexport interface PlainStore {\n  get(key: string): Promise<unknown>;\n  set(key: string, value: unknown): Promise<void>;\n}\n\nexport function memoryStore(): PlainStore {\n  const values = new Map<string, unknown>();\n  return {\n    get: async (key) => structuredClone(values.get(key)),\n    async set(key, value) {\n      if (value === undefined) values.delete(key);\n      else values.set(key, structuredClone(value));\n    },\n  };\n}\n\nexport function fileStore(env: ExecutionEnv, path: string): PlainStore {\n  let cache: Promise<Record<string, unknown>> | undefined;\n  let writes: Promise<unknown> = Promise.resolve();\n  const load = () => {\n    cache ??= env.readTextFile(path, BACKGROUND_CONTEXT).then((read) => {\n      if (!read.ok) return {};\n      try {\n        const parsed: unknown = JSON.parse(read.value);\n        return parsed && typeof parsed === 'object' ? (parsed as Record<string, unknown>) : {};\n      } catch {\n        return {};\n      }\n    });\n    return cache;\n  };\n  return {\n    async get(key) {\n      await writes;\n      return structuredClone((await load())[key]);\n    },\n    set(key, value) {\n      const write = writes.then(async () => {\n        const all = { ...(await load()) };\n        if (value === undefined) delete all[key];\n        else all[key] = structuredClone(value);\n        cache = Promise.resolve(all);\n        const wrote = await env.writeFile(path, JSON.stringify(all), BACKGROUND_CONTEXT);\n        if (!wrote.ok) throw new Error(`can't write ${path}`);\n      });\n      writes = write.catch(() => undefined);\n      return write;\n    },\n  };\n}\n"],
+  "mappings": "AAAA,SAAS,0BAA0B;AAQ5B,SAAS,cAA0B;AACxC,QAAM,SAAS,oBAAI,IAAqB;AACxC,SAAO;AAAA,IACL,KAAK,OAAO,QAAQ,gBAAgB,OAAO,IAAI,GAAG,CAAC;AAAA,IACnD,MAAM,IAAI,KAAK,OAAO;AACpB,UAAI,UAAU,OAAW,QAAO,OAAO,GAAG;AAAA,UACrC,QAAO,IAAI,KAAK,gBAAgB,KAAK,CAAC;AAAA,IAC7C;AAAA,EACF;AACF;AAEO,SAAS,UAAU,KAAmB,MAA0B;AACrE,MAAI;AACJ,MAAI,SAA2B,QAAQ,QAAQ;AAC/C,QAAM,OAAO,MAAM;AACjB,cAAU,IAAI,aAAa,MAAM,kBAAkB,EAAE,KAAK,CAAC,SAAS;AAClE,UAAI,CAAC,KAAK,GAAI,QAAO,CAAC;AACtB,UAAI;AACF,cAAM,SAAkB,KAAK,MAAM,KAAK,KAAK;AAC7C,eAAO,UAAU,OAAO,WAAW,WAAY,SAAqC,CAAC;AAAA,MACvF,QAAQ;AACN,eAAO,CAAC;AAAA,MACV;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,MAAM,IAAI,KAAK;AACb,YAAM;AACN,aAAO,iBAAiB,MAAM,KAAK,GAAG,GAAG,CAAC;AAAA,IAC5C;AAAA,IACA,IAAI,KAAK,OAAO;AACd,YAAM,QAAQ,OAAO,KAAK,YAAY;AACpC,cAAM,MAAM,EAAE,GAAI,MAAM,KAAK,EAAG;AAChC,YAAI,UAAU,OAAW,QAAO,IAAI,GAAG;AAAA,YAClC,KAAI,GAAG,IAAI,gBAAgB,KAAK;AACrC,gBAAQ,QAAQ,QAAQ,GAAG;AAC3B,cAAM,QAAQ,MAAM,IAAI,UAAU,MAAM,KAAK,UAAU,GAAG,GAAG,kBAAkB;AAC/E,YAAI,CAAC,MAAM,GAAI,OAAM,IAAI,MAAM,eAAe,IAAI,EAAE;AAAA,MACtD,CAAC;AACD,eAAS,MAAM,MAAM,MAAM,MAAS;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AACF;",
+  "names": []
+}