@ai-ecoverse/slicc-agent 6.3.0 → 6.3.2

package/README.md

@@ -140,7 +140,7 @@ const owner = await startAgent({
 
 **Providers.** The first provider is AWS Bedrock with a Bedrock API key as the bearer token; the default model is `us.anthropic.claude-sonnet-5-5`. Requests go to `us-west-2` unless the account's `region` field names another one (`AWS_REGION`). The account publishes that field as `fields: [{ name: 'region', label: 'Region' }]`, and `connect` takes it. Bedrock sends no CORS headers, so it needs a CORS-free transport, and its account says so (`needs: 'cors-free-transport'`).
 
-**Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and seals the token in the vault itself (bios: `seal { kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }`), so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that resolves `{ sealed: true }`; the adapter then calls `connect('adobe')` with no secret. A `login` that still returns a token is refused with "Adobe sign-in needs seven's vault: update seven", and the token never reaches the worker. IMS gives no refresh token, so an expired record shows the account as `expired`, and Sign in (or Reconnect) runs `login` again. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state as `budget` (refreshed on connect and every five minutes), and the `tray` adapter shows it in spectrum's TrayStatus. Until the proxy allows `*.sliccy.ai` (vibemigration#228), Adobe needs a CORS-free transport like Bedrock. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
+**Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and seals the token in the vault itself (bios: `seal { kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }`), so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that resolves `{ sealed: true }`; the adapter then calls `connect('adobe')` with no secret. A `login` that still returns a token is refused with "Adobe sign-in needs seven's vault: update seven", and the token never reaches the worker. IMS gives no refresh token, so an expired record shows the account as `expired`, and Sign in (or Reconnect) runs `login` again. The worker derives that from each vault record (`records()`, any account kind, MCP rows included): a record that isn't `ready` or `refreshing` (such as `inert`), or whose `expiresAt` (epoch milliseconds, the vault's `EpochMs`) has passed, reads `expired`, and a timer flips it when the clock reaches `expiresAt`, so an open page needn't wait for the vault to change. A model request that still gets a 401 after the vault's one refresh marks the record it was sent with `expired` too, until that record changes (a new sign-in gives it a new `expiresAt`) or the account is connected again (`connect`), not when an unrelated record changes, so the error card's **Log in** lands on an account that offers Sign in. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state as `budget` (refreshed on connect and every five minutes), and the `tray` adapter shows it in spectrum's TrayStatus. Until the proxy allows `*.sliccy.ai` (vibemigration#228), Adobe needs a CORS-free transport like Bedrock. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
 
 **Classifiers.** The Adobe provider also registers Cloudflare's Clef classifiers as `adobe/clef` and `adobe/clef-flash` (`adobeClassifiers()`): `type: 'classifier'` models on pi-ai's `cloudflare-workers-ai-system-one` API with `baseUrl: <proxy>/v1/ai`, so `models.classify(model, { state, questions })` posts `{ model: '@cf/cloudflare/clef', input }` to the proxy's `/v1/ai/run` with the IMS token as the bearer. The provider maps its short ids to the Workers AI names, and pi parses the answers and prices the usage ($0.24 per million input tokens for Clef, $0.09 for Clef Flash, nothing for output), which counts against the same weekly budget. They are classifiers only: `models.getModels()`, the settings `models` and the picker list chat models, and `models.getAvailableOfType('classifier', 'adobe')` returns them only while an Adobe token is stored.
 

package/dist/main.js

@@ -190,7 +190,8 @@ async function modelsOf(scope, options, given) {
   scope.fetch = vaultFetch(
     vault,
     transport,
-    modelRoute(bases, () => records.state.value)
+    modelRoute(bases, () => records.state.value),
+    records.rejecting
   );
   const endpoints = vaultEndpoints(vault);
   void endpoints.models(bases()).catch(() => void 0);

package/dist/main.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/main.ts"],
-  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Provider } from '@earendil-works/pi-ai';\nimport type { Models } from '@earendil-works/pi-ai/models';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, type AgentOptions, openAgent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  approvalJudge,\n  judgeModelOf,\n  judgeSpender,\n  ownerIntent,\n  seedPolicy,\n  verdictRecorder,\n} from './approvals/index.ts';\nimport { browserGuard } from './browser/guard.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport { type AgentUsers, agentUsers, warnSupport } from './kernel/agent-users.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { AGENT_DIR, ROOT_HOME } from './layout.ts';\nimport { setupLicks } from './licks/index.ts';\nimport { lickTriage } from './licks/triage.ts';\nimport { type McpAccounts, setupMcp } from './mcp/index.ts';\nimport type { MemoryEntry } from './memory/format.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { pageOnly, type Transport, transportFetch } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { createPages } from './remote/pages.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport { vaultCredentials } from './secrets/credentials.ts';\nimport {\n  BEDROCK_ENDPOINTS,\n  type ModelBases,\n  modelRoute,\n  vaultEndpoints,\n} from './secrets/endpoints.ts';\nimport { secretsExtension, shellGrants } from './secrets/extension.ts';\nimport { grantFetch, mcpFetch, vaultFetch } from './secrets/fetch.ts';\nimport { keysMoved, type Wiped, wipeLegacy } from './secrets/legacy.ts';\nimport { secretNames } from './secrets/names.ts';\nimport { type VaultRecords, vaultRecords } from './secrets/records.ts';\nimport { scrubWith } from './secrets/scrub.ts';\nimport { fileStore, type PlainStore } from './secrets/store.ts';\nimport { listenVault, Vault, WAITING_MS } from './secrets/vault.ts';\nimport { type Choosable, unfreeze, unfreezeCreated } from './selection.ts';\nimport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  providerFields,\n  resolveDefaultModel,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { titlesExtension } from './titles/extension.ts';\nimport { labeler, settingsText, titler } from './titles/generate.ts';\nimport { attachLabels } from './titles/labels.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  store?: () => Promise<PlainStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n  approvalMs?: number;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\nexport const ACCOUNTS_FILE = `${STORE_DIR}/accounts.json`;\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const wiped = await wipeLegacy();\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  const users = usersOf(admin, options.users, attach);\n  await warnSupport(users, client, options.users);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  return {\n    client,\n    users,\n    home,\n    wiped,\n    at: { home: HOME, ...(users ? { agentDir: AGENT_DIR } : {}) },\n  };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra'],\n  dir = `${HOME}/.pi/agent`\n) {\n  const settings = await client.fs.readFile(`${dir}/settings.json`).catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport function seesImages(models: Pick<Models, 'getModel'>, ref: ModelRef | undefined): boolean {\n  const found = ref && models.getModel(ref.provider, ref.modelId);\n  return found ? found.input.includes('image') : true;\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function openUnfrozen(\n  options: AgentWorkerOptions,\n  { choosable: chosen }: { choosable: Choosable },\n  base: Omit<AgentOptions, 'storage' | 'beforeResume' | 'conversationCreated'>\n): Promise<Agent> {\n  const storage = await (options.storage ?? (() => openOpfsSqliteStorage()))();\n  return openAgent({\n    ...base,\n    storage,\n    conversationCreated: unfreezeCreated(chosen),\n    beforeResume: (harness, using) => unfreeze(harness, storage, chosen, using),\n  });\n}\n\nasync function secretsFor(home: SliccKernelEnv, vault: Vault) {\n  scrubWith(vault);\n  const names = secretNames(home, vault);\n  await names.refresh(BACKGROUND_CONTEXT);\n  return names;\n}\n\nexport function modelBases(\n  providers: readonly Provider[],\n  models: Pick<ReturnType<typeof createSliccModels>, 'getModels'>\n): ModelBases[] {\n  return providers.map((provider) => ({\n    provider: provider.id,\n    urls: [\n      ...new Set(\n        [\n          provider.baseUrl,\n          ...models.getModels(provider.id).map((model) => model.baseUrl),\n          ...(provider.id === BEDROCK ? BEDROCK_ENDPOINTS : []),\n        ].filter((url): url is string => typeof url === 'string' && url !== '')\n      ),\n    ],\n  }));\n}\n\nfunction mcpVault(\n  vault: Vault,\n  made: { store: PlainStore; records: VaultRecords; endpoints: ReturnType<typeof vaultEndpoints> }\n) {\n  const { store, records, endpoints } = made;\n  return {\n    store,\n    vault: {\n      records,\n      fetch: (server: string, base: typeof fetch) => mcpFetch(vault, base, server),\n      grant: (server: string, base: typeof fetch) => grantFetch(vault, server, base),\n      servers: endpoints.servers,\n      token: endpoints.token,\n    },\n  };\n}\n\nfunction hostSecrets(\n  vault: Vault,\n  names: Awaited<ReturnType<typeof secretsFor>>,\n  parts: readonly { close(): void }[]\n) {\n  return {\n    vault: vault.state,\n    list: () => names.state.value,\n    close: () => {\n      for (const part of parts) part.close();\n    },\n  };\n}\n\nasync function modelsOf(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions,\n  given: { vault: Vault; home: SliccKernelEnv; transport: typeof fetch; version: string }\n) {\n  const { vault, home, transport, version } = given;\n  const store = await (options.store ?? (async () => fileStore(home, ACCOUNTS_FILE)))();\n  const records = vaultRecords(vault);\n  const loaded = records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  const providers = options.providers ?? sliccProviders(version);\n  const fields = await providerFields(store, providers);\n  const credentials = vaultCredentials(records, fields.env);\n  const models = createSliccModels(credentials, providers);\n  const bases = () => modelBases(providers, models);\n  scope.fetch = vaultFetch(\n    vault,\n    transport,\n    modelRoute(bases, () => records.state.value)\n  );\n  const endpoints = vaultEndpoints(vault);\n  void endpoints.models(bases()).catch(() => undefined);\n  const defaultModel = async () => {\n    await Promise.race([loaded, new Promise((resolve) => setTimeout(resolve, WAITING_MS))]);\n    return resolveDefaultModel(credentials, providers, models);\n  };\n  return { store, records, providers, fields, models, bases, endpoints, defaultModel };\n}\n\nfunction baseRegistry(facts: Awaited<ReturnType<typeof factsOf>>, origin: string) {\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(browserGuard([origin]));\n  registry.install(sliccPrompt(facts));\n  const read = (CodingTools.tools as readonly ToolRegistration[]).find(\n    (tool) => tool.name === 'read'\n  ) as ToolRegistration;\n  registry.install(imageReads(read));\n  return registry;\n}\n\nasync function factsOf(client: KernelClient & { transport: Transport }, native: typeof fetch) {\n  return {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n}\n\nfunction routeFetch(scope: AgentWorkerScope, client: KernelClient & { transport: Transport }) {\n  const native = scope.fetch.bind(scope);\n  const loopback = client.loopbackFetch?.bind(client);\n  const transport = transportFetch(client.transport, scope.location.origin, native, loopback);\n  scope.fetch = transport;\n  return { native, transport };\n}\n\nasync function prepare(\n  scope: AgentWorkerScope,\n  kernel: { client: KernelClient & { transport: Transport }; home: SliccKernelEnv; vault: Vault },\n  options: AgentWorkerOptions\n) {\n  const names = await secretsFor(kernel.home, kernel.vault);\n  const { native, transport } = routeFetch(scope, kernel.client);\n  const facts = await factsOf(kernel.client, native);\n  const made = await modelsOf(scope, options, {\n    vault: kernel.vault,\n    home: kernel.home,\n    transport,\n    version: facts.version,\n  });\n  return {\n    names,\n    native,\n    transport,\n    facts,\n    ...made,\n    registry: baseRegistry(facts, scope.location.origin),\n  };\n}\n\nfunction modelsOfAgent(\n  agent: Agent,\n  settings: Awaited<ReturnType<typeof createAgentSettings>>,\n  catalog: Models,\n  vault: Vault\n) {\n  const locked = () => vault.state.value.locked !== 'no';\n  return modelsCommand({ agents: agent.agents, settings, catalog, locked });\n}\n\nasync function settingsOf(\n  made: Awaited<ReturnType<typeof modelsOf>>,\n  mcp: McpAccounts,\n  moved: { agent: Agent; vault: Vault; wiped: Wiped }\n) {\n  const { models, records, fields, providers, bases, endpoints } = made;\n  const keys = await keysMoved(moved.agent.harness, { records, vault: moved.vault }, moved.wiped);\n  const settings = await createAgentSettings(models, { records, fields }, providers, {\n    mcp,\n    moved: keys,\n  });\n  settings.state.subscribe(() => void endpoints.models(bases()).catch(() => undefined));\n  return settings;\n}\n\nasync function setupApprovals(\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  agent: Agent,\n  stored: { readonly value: readonly MemoryEntry[] | undefined },\n  options: Pick<AgentWorkerOptions, 'approvalMs'>\n) {\n  const memories = () => stored.value;\n  const { approvalMs } = options;\n  await seedPolicy(home, BACKGROUND_CONTEXT).catch(() => false);\n  const settings = settingsText(home, HOME, at.agentDir);\n  const intent = ownerIntent({ env: home, agents: agent.agents, memories });\n  const judge: ApprovalJudge = {\n    judge: approvalJudge({\n      models,\n      model: async (context) => judgeModelOf(await settings(context)),\n      intent,\n      spend: judgeSpender((agentId, context) => agent.agents.conversation(agentId, context)),\n    }),\n    record: verdictRecorder((agentId, context) => agent.agents.conversation(agentId, context)),\n  };\n  return { judge, intent, ...(approvalMs ? { approvalMs } : {}) };\n}\n\nfunction setupTitles(\n  registry: ReturnType<typeof createRegistry>,\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  opened: () => Agent | undefined\n) {\n  const settings = settingsText(home, HOME, at.agentDir);\n  const titleFn = titler(models, settings);\n  const titles = titlesExtension({\n    agents: () => opened()?.agents,\n    harness: () => opened()?.harness,\n    title: () => titleFn,\n  });\n  registry.install(titles.extension);\n  return { titleFn, cancel: titles.cancel, label: labeler(models, settings) };\n}\n\nfunction freezerOf(\n  agent: Agent,\n  parts: {\n    home: SliccKernelEnv;\n    memory: ReturnType<typeof setupMemory>;\n    titles: ReturnType<typeof setupTitles>;\n    people: AgentUsers | undefined;\n  }\n) {\n  const { home, memory, titles, people } = parts;\n  return attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titles.titleFn,\n    cancelTitle: titles.cancel,\n    ...(people ? { layout: people.layout } : {}),\n    imports: { env: home },\n  });\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions,\n  vault: Vault\n): Promise<AgentHost> {\n  const { client, users, home, at, wiped } = await attached(ports, options);\n  const ready = await prepare(scope, { client, home, vault }, options);\n  const { names, native, transport, facts, models, registry, records, endpoints } = ready;\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode, at.agentDir);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry, transport);\n  licks.licks.triage(lickTriage(models));\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  registry.install(secretsExtension({ names, vault }));\n  const titles = setupTitles(registry, models, home, at, () => opened);\n  const [activity, groups] = [createActivity(), processGroups(client)];\n  const model = options.model ?? (await ready.defaultModel());\n  let opened: Agent | undefined;\n  const people = users ? agentUsers(users, client, home, () => opened?.agents) : undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    identify: identity(() => opened?.agents, model),\n    scrub: vault,\n    spawn: shellGrants(names),\n    ...(people ? { route: people.route } : {}),\n  });\n  const agent = await openUnfrozen(options, scoops, { models, model, registry, env: environment });\n  opened = agent;\n  await people?.start(agent.agents);\n  const sources = licks.attach(agent, {\n    env: home,\n    home: HOME,\n    activity,\n    ...(people ? { dirs: () => people.lickDirs(), cronUser: people.cronUser.bind(people) } : {}),\n  });\n  await sources.start(BACKGROUND_CONTEXT);\n  const booted = { version: facts.version, boot: await kernelBoot(client) };\n  await sources.boot(booted, BACKGROUND_CONTEXT);\n  const skillsRuntime = await skills.attach(\n    {\n      env: home,\n      ...at,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people ? { people: people.people } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      ...at,\n      ...mcpVault(vault, ready),\n      licks: licks.licks,\n      fetch: transport,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: pageOnly(client.transport),\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people?.sprinkles() ?? {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  people?.follow([sources, skillsRuntime, sprinkles]);\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      ...at,\n      ...(people ? { home: ROOT_HOME } : {}),\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = freezerOf(agent, { home, memory, titles, people });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await settingsOf(ready, mcpRuntime, { agent, vault, wiped });\n  const pages = createPages({ claim: sprinkles.claim });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      envOf: async (conversationId, context) => environment({ conversationId }, context),\n      ...at,\n      ...(people\n        ? { layout: people.layout, spools: people.spools, enforced: people.enforced }\n        : {}),\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsOfAgent(agent, settings, models, vault),\n      panel: pages.command,\n      webhook: sources.webhook,\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    ...(await people?.gelatiere(home)),\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  return hostAgent(agent, {\n    ...(await setupApprovals(models, home, at, agent, memoryRuntime.memories, options)),\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes: attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS }),\n    pages,\n    labels: await attachLabels({ ...agent, label: titles.label, vault: vault.state }),\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n    secrets: hostSecrets(vault, names, [names, records, endpoints]),\n    uploads: {\n      env: environment,\n      sees: (ref) => seesImages(models, ref),\n    },\n    monitor: {\n      kernel: client,\n      groups,\n      ...(users ? { users: () => users.users.list() } : {}),\n    },\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const vault = new Vault();\n  listenVault(scope, vault);\n  const host = start(scope, kernelPorts(scope), options, vault);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAGnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAwC,iBAAiB;AACzD;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAC/B,SAA0B,YAAY,mBAAmB;AAEzD,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,WAAW,iBAAiB;AACrC,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAA2B,gBAAgB;AAE3C,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAS,UAA0B,sBAAsB;AACzD,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,mBAAmB;AAC9C,SAAS,YAAY,UAAU,kBAAkB;AACjD,SAAS,WAAuB,kBAAkB;AAClD,SAAS,mBAAmB;AAC5B,SAA4B,oBAAoB;AAChD,SAAS,iBAAiB;AAC1B,SAAS,iBAAkC;AAC3C,SAAS,aAAa,OAAO,kBAAkB;AAC/C,SAAyB,UAAU,uBAAuB;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,SAAS,cAAc,cAAc;AAC9C,SAAS,oBAAoB;AAC7B,SAA2B,aAAa,wBAA0C;AAwB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAClB,MAAM,gBAAgB,GAAG,SAAS;AAEzC,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,QAAQ,MAAM,WAAW;AAC/B,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,QAAQ,QAAQ,OAAO,QAAQ,OAAO,MAAM;AAClD,QAAM,YAAY,OAAO,QAAQ,QAAQ,KAAK;AAC9C,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,EAAE,MAAM,MAAM,GAAI,QAAQ,EAAE,UAAU,UAAU,IAAI,CAAC,EAAG;AAAA,EAC9D;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA,MAAM,GAAG,IAAI,cACb;AACA,QAAM,WAAW,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACvF,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,SAAS,WAAW,QAAkC,KAAoC;AAC/F,QAAM,QAAQ,OAAO,OAAO,SAAS,IAAI,UAAU,IAAI,OAAO;AAC9D,SAAO,QAAQ,MAAM,MAAM,SAAS,OAAO,IAAI;AACjD;AAEO,MAAM,eAAe;AAE5B,eAAe,aACb,SACA,EAAE,WAAW,OAAO,GACpB,MACgB;AAChB,QAAM,UAAU,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAC3E,SAAO,UAAU;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,qBAAqB,gBAAgB,MAAM;AAAA,IAC3C,cAAc,CAAC,SAAS,UAAU,SAAS,SAAS,SAAS,QAAQ,KAAK;AAAA,EAC5E,CAAC;AACH;AAEA,eAAe,WAAW,MAAsB,OAAc;AAC5D,YAAU,KAAK;AACf,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,MAAM,QAAQ,kBAAkB;AACtC,SAAO;AACT;AAEO,SAAS,WACd,WACA,QACc;AACd,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,UAAU,SAAS;AAAA,IACnB,MAAM;AAAA,MACJ,GAAG,IAAI;AAAA,QACL;AAAA,UACE,SAAS;AAAA,UACT,GAAG,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,UAC7D,GAAI,SAAS,OAAO,UAAU,oBAAoB,CAAC;AAAA,QACrD,EAAE,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF,EAAE;AACJ;AAEA,SAAS,SACP,OACA,MACA;AACA,QAAM,EAAE,OAAO,SAAS,UAAU,IAAI;AACtC,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,OAAO,CAAC,QAAgB,SAAuB,SAAS,OAAO,MAAM,MAAM;AAAA,MAC3E,OAAO,CAAC,QAAgB,SAAuB,WAAW,OAAO,QAAQ,IAAI;AAAA,MAC7E,SAAS,UAAU;AAAA,MACnB,OAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACF;AAEA,SAAS,YACP,OACA,OACA,OACA;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM,MAAM,MAAM;AAAA,IACxB,OAAO,MAAM;AACX,iBAAW,QAAQ,MAAO,MAAK,MAAM;AAAA,IACvC;AAAA,EACF;AACF;AAEA,eAAe,SACb,OACA,SACA,OACA;AACA,QAAM,EAAE,OAAO,MAAM,WAAW,QAAQ,IAAI;AAC5C,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,UAAU,MAAM,aAAa,IAAI;AACpF,QAAM,UAAU,aAAa,KAAK;AAClC,QAAM,SAAS,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACxE,QAAM,YAAY,QAAQ,aAAa,eAAe,OAAO;AAC7D,QAAM,SAAS,MAAM,eAAe,OAAO,SAAS;AACpD,QAAM,cAAc,iBAAiB,SAAS,OAAO,GAAG;AACxD,QAAM,SAAS,kBAAkB,aAAa,SAAS;AACvD,QAAM,QAAQ,MAAM,WAAW,WAAW,MAAM;AAChD,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,OAAO,MAAM,QAAQ,MAAM,KAAK;AAAA,EAC7C;AACA,QAAM,YAAY,eAAe,KAAK;AACtC,OAAK,UAAU,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACpD,QAAM,eAAe,YAAY;AAC/B,UAAM,QAAQ,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC,CAAC,CAAC;AACtF,WAAO,oBAAoB,aAAa,WAAW,MAAM;AAAA,EAC3D;AACA,SAAO,EAAE,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,WAAW,aAAa;AACrF;AAEA,SAAS,aAAa,OAA4C,QAAgB;AAChF,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,aAAa,CAAC,MAAM,CAAC,CAAC;AACvC,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,QAAM,OAAQ,YAAY,MAAsC;AAAA,IAC9D,CAAC,SAAS,KAAK,SAAS;AAAA,EAC1B;AACA,WAAS,QAAQ,WAAW,IAAI,CAAC;AACjC,SAAO;AACT;AAEA,eAAe,QAAQ,QAAiD,QAAsB;AAC5F,SAAO;AAAA,IACL,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACF;AAEA,SAAS,WAAW,OAAyB,QAAiD;AAC5F,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,WAAW,OAAO,eAAe,KAAK,MAAM;AAClD,QAAM,YAAY,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,QAAQ,QAAQ;AAC1F,QAAM,QAAQ;AACd,SAAO,EAAE,QAAQ,UAAU;AAC7B;AAEA,eAAe,QACb,OACA,QACA,SACA;AACA,QAAM,QAAQ,MAAM,WAAW,OAAO,MAAM,OAAO,KAAK;AACxD,QAAM,EAAE,QAAQ,UAAU,IAAI,WAAW,OAAO,OAAO,MAAM;AAC7D,QAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AACjD,QAAM,OAAO,MAAM,SAAS,OAAO,SAAS;AAAA,IAC1C,OAAO,OAAO;AAAA,IACd,MAAM,OAAO;AAAA,IACb;AAAA,IACA,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,UAAU,aAAa,OAAO,MAAM,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,SAAS,cACP,OACA,UACA,SACA,OACA;AACA,QAAM,SAAS,MAAM,MAAM,MAAM,MAAM,WAAW;AAClD,SAAO,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAC1E;AAEA,eAAe,WACb,MACA,KACA,OACA;AACA,QAAM,EAAE,QAAQ,SAAS,QAAQ,WAAW,OAAO,UAAU,IAAI;AACjE,QAAM,OAAO,MAAM,UAAU,MAAM,MAAM,SAAS,EAAE,SAAS,OAAO,MAAM,MAAM,GAAG,MAAM,KAAK;AAC9F,QAAM,WAAW,MAAM,oBAAoB,QAAQ,EAAE,SAAS,OAAO,GAAG,WAAW;AAAA,IACjF;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AACD,WAAS,MAAM,UAAU,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS,CAAC;AACpF,SAAO;AACT;AAEA,eAAe,eACb,QACA,MACA,IACA,OACA,QACA,SACA;AACA,QAAM,WAAW,MAAM,OAAO;AAC9B,QAAM,EAAE,WAAW,IAAI;AACvB,QAAM,WAAW,MAAM,kBAAkB,EAAE,MAAM,MAAM,KAAK;AAC5D,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,SAAS,YAAY,EAAE,KAAK,MAAM,QAAQ,MAAM,QAAQ,SAAS,CAAC;AACxE,QAAM,QAAuB;AAAA,IAC3B,OAAO,cAAc;AAAA,MACnB;AAAA,MACA,OAAO,OAAO,YAAY,aAAa,MAAM,SAAS,OAAO,CAAC;AAAA,MAC9D;AAAA,MACA,OAAO,aAAa,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,IACvF,CAAC;AAAA,IACD,QAAQ,gBAAgB,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,EAC3F;AACA,SAAO,EAAE,OAAO,QAAQ,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG;AAChE;AAEA,SAAS,YACP,UACA,QACA,MACA,IACA,QACA;AACA,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,UAAU,OAAO,QAAQ,QAAQ;AACvC,QAAM,SAAS,gBAAgB;AAAA,IAC7B,QAAQ,MAAM,OAAO,GAAG;AAAA,IACxB,SAAS,MAAM,OAAO,GAAG;AAAA,IACzB,OAAO,MAAM;AAAA,EACf,CAAC;AACD,WAAS,QAAQ,OAAO,SAAS;AACjC,SAAO,EAAE,SAAS,QAAQ,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAC5E;AAEA,SAAS,UACP,OACA,OAMA;AACA,QAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,IAAI;AACzC,SAAO,cAAc;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC1C,SAAS,EAAE,KAAK,KAAK;AAAA,EACvB,CAAC;AACH;AAEA,eAAe,MACb,OACA,OACA,SACA,OACoB;AACpB,QAAM,EAAE,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACxE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,QAAQ,MAAM,MAAM,GAAG,OAAO;AACnE,QAAM,EAAE,OAAO,QAAQ,WAAW,OAAO,QAAQ,UAAU,SAAS,UAAU,IAAI;AAClF,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,UAAU,GAAG,QAAQ;AACvF,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,UAAU,SAAS;AAC5C,QAAM,MAAM,OAAO,WAAW,MAAM,CAAC;AACrC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,WAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAAC;AACnD,QAAM,SAAS,YAAY,UAAU,QAAQ,MAAM,IAAI,MAAM,MAAM;AACnE,QAAM,CAAC,UAAU,MAAM,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC;AACnE,QAAM,QAAQ,QAAQ,SAAU,MAAM,MAAM,aAAa;AACzD,MAAI;AACJ,QAAM,SAAS,QAAQ,WAAW,OAAO,QAAQ,MAAM,MAAM,QAAQ,MAAM,IAAI;AAC/E,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO,YAAY,KAAK;AAAA,IACxB,GAAI,SAAS,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,QAAQ,EAAE,QAAQ,OAAO,UAAU,KAAK,YAAY,CAAC;AAC/F,WAAS;AACT,QAAM,QAAQ,MAAM,MAAM,MAAM;AAChC,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,SAAS,EAAE,MAAM,MAAM,OAAO,SAAS,GAAG,UAAU,OAAO,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EAC5F,CAAC;AACD,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,SAAS,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AACxE,QAAM,QAAQ,KAAK,QAAQ,kBAAkB;AAC7C,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAG,SAAS,OAAO,KAAK;AAAA,MACxB,OAAO,MAAM;AAAA,MACb,OAAO;AAAA,MACP,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,SAAS,OAAO,SAAS;AAAA,MAC/B,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,QAAQ,UAAU,KAAK,CAAC;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACA,UAAQ,OAAO,CAAC,SAAS,eAAe,SAAS,CAAC;AAClD,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAI,SAAS,EAAE,MAAM,UAAU,IAAI,CAAC;AAAA,MACpC,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AACjE,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,WAAW,OAAO,YAAY,EAAE,OAAO,OAAO,MAAM,CAAC;AAC5E,QAAM,QAAQ,YAAY,EAAE,OAAO,UAAU,MAAM,CAAC;AACpD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,OAAO,OAAO,gBAAgB,YAAY,YAAY,EAAE,eAAe,GAAG,OAAO;AAAA,MACjF,GAAG;AAAA,MACH,GAAI,SACA,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS,IAC1E,CAAC;AAAA,MACL,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,OAAO,UAAU,QAAQ,KAAK;AAAA,MACpD,OAAO,MAAM;AAAA,MACb,SAAS,QAAQ;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,GAAI,MAAM,QAAQ,UAAU,IAAI;AAAA,IAChC,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,SAAO,UAAU,OAAO;AAAA,IACtB,GAAI,MAAM,eAAe,QAAQ,MAAM,IAAI,OAAO,cAAc,UAAU,OAAO;AAAA,IACjF;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,SAAS,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AAAA,IAChF;AAAA,IACA,QAAQ,MAAM,aAAa,EAAE,GAAG,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM,CAAC;AAAA,IAChF,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,SAAS,YAAY,OAAO,OAAO,CAAC,OAAO,SAAS,SAAS,CAAC;AAAA,IAC9D,SAAS;AAAA,MACP,KAAK;AAAA,MACL,MAAM,CAAC,QAAQ,WAAW,QAAQ,GAAG;AAAA,IACvC;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,IACrD;AAAA,EACF,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,QAAQ,IAAI,MAAM;AACxB,cAAY,OAAO,KAAK;AACxB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,KAAK;AAC5D,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
+  "sourcesContent": ["import { attachKernel } from '@ai-ecoverse/slicc-kernel';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Provider } from '@earendil-works/pi-ai';\nimport type { Models } from '@earendil-works/pi-ai/models';\nimport {\n  createRegistry,\n  type ModelRef,\n  type Storage,\n  type ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport { CodingTools } from '@earendil-works/pi-durable/tools';\nimport { type Agent, type AgentOptions, openAgent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  approvalJudge,\n  judgeModelOf,\n  judgeSpender,\n  ownerIntent,\n  seedPolicy,\n  verdictRecorder,\n} from './approvals/index.ts';\nimport { browserGuard } from './browser/guard.ts';\nimport { attachChanges, CHANGES_MS } from './changes/index.ts';\nimport {\n  codemodeExtension,\n  codemodeTool,\n  disabledBySettings,\n  locateWasm,\n  sandboxFactory,\n} from './codemode/index.ts';\nimport { attachFreezer } from './freezer/index.ts';\nimport { lateGelatiere } from './gelatiere/index.ts';\nimport { type AgentHost, hostAgent } from './host.ts';\nimport { imageReads } from './images/index.ts';\nimport { createActivity } from './kernel/activity.ts';\nimport { type AgentUsers, agentUsers, warnSupport } from './kernel/agent-users.ts';\nimport type { KernelClient } from './kernel/client.ts';\nimport { HOME, kernelEnvironment, SliccKernelEnv } from './kernel/env.ts';\nimport { processGroups } from './kernel/groups.ts';\nimport { adminOver, type UserClient, type UserClients, userClients } from './kernel/users.ts';\nimport { AGENT_DIR, ROOT_HOME } from './layout.ts';\nimport { setupLicks } from './licks/index.ts';\nimport { lickTriage } from './licks/triage.ts';\nimport { type McpAccounts, setupMcp } from './mcp/index.ts';\nimport type { MemoryEntry } from './memory/format.ts';\nimport { setupMemory } from './memory/index.ts';\nimport { modelsCommand } from './models/index.ts';\nimport { pageOnly, type Transport, transportFetch } from './net.ts';\nimport { sliccPrompt } from './prompt.ts';\nimport { createPages } from './remote/pages.ts';\nimport { identity } from './scoops/identity.ts';\nimport { type Assets, packageAssets, type ScoopsRuntime, setupScoops } from './scoops/index.ts';\nimport { vaultCredentials } from './secrets/credentials.ts';\nimport {\n  BEDROCK_ENDPOINTS,\n  type ModelBases,\n  modelRoute,\n  vaultEndpoints,\n} from './secrets/endpoints.ts';\nimport { secretsExtension, shellGrants } from './secrets/extension.ts';\nimport { grantFetch, mcpFetch, vaultFetch } from './secrets/fetch.ts';\nimport { keysMoved, type Wiped, wipeLegacy } from './secrets/legacy.ts';\nimport { secretNames } from './secrets/names.ts';\nimport { type VaultRecords, vaultRecords } from './secrets/records.ts';\nimport { scrubWith } from './secrets/scrub.ts';\nimport { fileStore, type PlainStore } from './secrets/store.ts';\nimport { listenVault, Vault, WAITING_MS } from './secrets/vault.ts';\nimport { type Choosable, unfreeze, unfreezeCreated } from './selection.ts';\nimport {\n  BEDROCK,\n  createAgentSettings,\n  createSliccModels,\n  providerFields,\n  resolveDefaultModel,\n  sliccProviders,\n} from './settings.ts';\nimport { RELOAD_MS, setupSkills } from './skills/index.ts';\nimport { setupSprinkles } from './sprinkles/index.ts';\nimport { openOpfsSqliteStorage } from './sqlite.ts';\nimport {\n  agentVersion,\n  browserConnected,\n  commandsOnPath,\n  kernelBoot,\n  transportName,\n} from './system.ts';\nimport { titlesExtension } from './titles/extension.ts';\nimport { labeler, settingsText, titler } from './titles/generate.ts';\nimport { attachLabels } from './titles/labels.ts';\nimport { type KernelPorts, kernelPorts, serveConnections, type WorkerScope } from './worker.ts';\n\nexport interface AgentWorkerScope extends WorkerScope {\n  fetch: typeof fetch;\n  location: { origin: string };\n}\n\nexport type KernelAttach = (port: MessagePort) => Promise<KernelClient & { transport: Transport }>;\n\nexport interface AgentWorkerOptions {\n  model?: ModelRef;\n  providers?: Provider[];\n  attach?: KernelAttach;\n  store?: () => Promise<PlainStore>;\n  storage?: () => Promise<Storage>;\n  assets?: Assets;\n  codemodeWasm?: () => Promise<WebAssembly.Module | undefined>;\n  codemodeWorker?: string | URL;\n  catalog?: string;\n  users?: boolean;\n  mcpRedirect?: string;\n  approvalMs?: number;\n}\n\nexport function usersOf(\n  admin: MessagePort | undefined,\n  wanted: boolean | undefined,\n  attach: KernelAttach\n): UserClients | undefined {\n  if (!admin) return undefined;\n  if (wanted === false) {\n    admin.close();\n    return undefined;\n  }\n  return userClients(adminOver(admin), attach as (port: MessagePort) => Promise<UserClient>);\n}\n\nexport const STORE_DIR = '/.slicc';\nexport const ACCOUNTS_FILE = `${STORE_DIR}/accounts.json`;\n\nasync function attached(ports: Promise<KernelPorts>, options: AgentWorkerOptions) {\n  const wiped = await wipeLegacy();\n  const attach: KernelAttach = options.attach ?? attachKernel;\n  const { kernel, admin } = await ports;\n  const client = await attach(kernel);\n  const users = usersOf(admin, options.users, attach);\n  await warnSupport(users, client, options.users);\n  const home = new SliccKernelEnv(client, { cwd: HOME });\n  await privateStore(home);\n  return {\n    client,\n    users,\n    home,\n    wiped,\n    at: { home: HOME, ...(users ? { agentDir: AGENT_DIR } : {}) },\n  };\n}\n\nfunction privateStore(env: SliccKernelEnv): Promise<unknown> {\n  return env.exec(`mkdir -p ${STORE_DIR} && chmod 700 ${STORE_DIR}`, undefined, BACKGROUND_CONTEXT);\n}\n\nasync function codemodeTools(\n  client: KernelClient,\n  options: AgentWorkerOptions,\n  native: typeof fetch,\n  extra: Parameters<typeof codemodeTool>[0]['extra'],\n  dir = `${HOME}/.pi/agent`\n) {\n  const settings = await client.fs.readFile(`${dir}/settings.json`).catch(() => undefined);\n  if (disabledBySettings(settings === undefined ? undefined : new TextDecoder().decode(settings)))\n    return [];\n  const sandbox = sandboxFactory(\n    options.codemodeWasm ?? (() => locateWasm(native, new URL(import.meta.url))),\n    options.codemodeWorker\n  );\n  return [\n    codemodeTool({ declared: CodingTools.tools as readonly ToolRegistration[], sandbox, extra }),\n  ];\n}\n\nexport function seesImages(models: Pick<Models, 'getModel'>, ref: ModelRef | undefined): boolean {\n  const found = ref && models.getModel(ref.provider, ref.modelId);\n  return found ? found.input.includes('image') : true;\n}\n\nexport const MCP_CALLBACK = '/oauth/mcp-callback';\n\nasync function openUnfrozen(\n  options: AgentWorkerOptions,\n  { choosable: chosen }: { choosable: Choosable },\n  base: Omit<AgentOptions, 'storage' | 'beforeResume' | 'conversationCreated'>\n): Promise<Agent> {\n  const storage = await (options.storage ?? (() => openOpfsSqliteStorage()))();\n  return openAgent({\n    ...base,\n    storage,\n    conversationCreated: unfreezeCreated(chosen),\n    beforeResume: (harness, using) => unfreeze(harness, storage, chosen, using),\n  });\n}\n\nasync function secretsFor(home: SliccKernelEnv, vault: Vault) {\n  scrubWith(vault);\n  const names = secretNames(home, vault);\n  await names.refresh(BACKGROUND_CONTEXT);\n  return names;\n}\n\nexport function modelBases(\n  providers: readonly Provider[],\n  models: Pick<ReturnType<typeof createSliccModels>, 'getModels'>\n): ModelBases[] {\n  return providers.map((provider) => ({\n    provider: provider.id,\n    urls: [\n      ...new Set(\n        [\n          provider.baseUrl,\n          ...models.getModels(provider.id).map((model) => model.baseUrl),\n          ...(provider.id === BEDROCK ? BEDROCK_ENDPOINTS : []),\n        ].filter((url): url is string => typeof url === 'string' && url !== '')\n      ),\n    ],\n  }));\n}\n\nfunction mcpVault(\n  vault: Vault,\n  made: { store: PlainStore; records: VaultRecords; endpoints: ReturnType<typeof vaultEndpoints> }\n) {\n  const { store, records, endpoints } = made;\n  return {\n    store,\n    vault: {\n      records,\n      fetch: (server: string, base: typeof fetch) => mcpFetch(vault, base, server),\n      grant: (server: string, base: typeof fetch) => grantFetch(vault, server, base),\n      servers: endpoints.servers,\n      token: endpoints.token,\n    },\n  };\n}\n\nfunction hostSecrets(\n  vault: Vault,\n  names: Awaited<ReturnType<typeof secretsFor>>,\n  parts: readonly { close(): void }[]\n) {\n  return {\n    vault: vault.state,\n    list: () => names.state.value,\n    close: () => {\n      for (const part of parts) part.close();\n    },\n  };\n}\n\nasync function modelsOf(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions,\n  given: { vault: Vault; home: SliccKernelEnv; transport: typeof fetch; version: string }\n) {\n  const { vault, home, transport, version } = given;\n  const store = await (options.store ?? (async () => fileStore(home, ACCOUNTS_FILE)))();\n  const records = vaultRecords(vault);\n  const loaded = records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  const providers = options.providers ?? sliccProviders(version);\n  const fields = await providerFields(store, providers);\n  const credentials = vaultCredentials(records, fields.env);\n  const models = createSliccModels(credentials, providers);\n  const bases = () => modelBases(providers, models);\n  scope.fetch = vaultFetch(\n    vault,\n    transport,\n    modelRoute(bases, () => records.state.value),\n    records.rejecting\n  );\n  const endpoints = vaultEndpoints(vault);\n  void endpoints.models(bases()).catch(() => undefined);\n  const defaultModel = async () => {\n    await Promise.race([loaded, new Promise((resolve) => setTimeout(resolve, WAITING_MS))]);\n    return resolveDefaultModel(credentials, providers, models);\n  };\n  return { store, records, providers, fields, models, bases, endpoints, defaultModel };\n}\n\nfunction baseRegistry(facts: Awaited<ReturnType<typeof factsOf>>, origin: string) {\n  const registry = createRegistry();\n  registry.install(CodingTools);\n  registry.install(browserGuard([origin]));\n  registry.install(sliccPrompt(facts));\n  const read = (CodingTools.tools as readonly ToolRegistration[]).find(\n    (tool) => tool.name === 'read'\n  ) as ToolRegistration;\n  registry.install(imageReads(read));\n  return registry;\n}\n\nasync function factsOf(client: KernelClient & { transport: Transport }, native: typeof fetch) {\n  return {\n    version: await agentVersion((url) => native(url)),\n    commands: await commandsOnPath(client),\n    transport: transportName(client.transport),\n    browser: await browserConnected(client),\n  };\n}\n\nfunction routeFetch(scope: AgentWorkerScope, client: KernelClient & { transport: Transport }) {\n  const native = scope.fetch.bind(scope);\n  const loopback = client.loopbackFetch?.bind(client);\n  const transport = transportFetch(client.transport, scope.location.origin, native, loopback);\n  scope.fetch = transport;\n  return { native, transport };\n}\n\nasync function prepare(\n  scope: AgentWorkerScope,\n  kernel: { client: KernelClient & { transport: Transport }; home: SliccKernelEnv; vault: Vault },\n  options: AgentWorkerOptions\n) {\n  const names = await secretsFor(kernel.home, kernel.vault);\n  const { native, transport } = routeFetch(scope, kernel.client);\n  const facts = await factsOf(kernel.client, native);\n  const made = await modelsOf(scope, options, {\n    vault: kernel.vault,\n    home: kernel.home,\n    transport,\n    version: facts.version,\n  });\n  return {\n    names,\n    native,\n    transport,\n    facts,\n    ...made,\n    registry: baseRegistry(facts, scope.location.origin),\n  };\n}\n\nfunction modelsOfAgent(\n  agent: Agent,\n  settings: Awaited<ReturnType<typeof createAgentSettings>>,\n  catalog: Models,\n  vault: Vault\n) {\n  const locked = () => vault.state.value.locked !== 'no';\n  return modelsCommand({ agents: agent.agents, settings, catalog, locked });\n}\n\nasync function settingsOf(\n  made: Awaited<ReturnType<typeof modelsOf>>,\n  mcp: McpAccounts,\n  moved: { agent: Agent; vault: Vault; wiped: Wiped }\n) {\n  const { models, records, fields, providers, bases, endpoints } = made;\n  const keys = await keysMoved(moved.agent.harness, { records, vault: moved.vault }, moved.wiped);\n  const settings = await createAgentSettings(models, { records, fields }, providers, {\n    mcp,\n    moved: keys,\n  });\n  settings.state.subscribe(() => void endpoints.models(bases()).catch(() => undefined));\n  return settings;\n}\n\nasync function setupApprovals(\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  agent: Agent,\n  stored: { readonly value: readonly MemoryEntry[] | undefined },\n  options: Pick<AgentWorkerOptions, 'approvalMs'>\n) {\n  const memories = () => stored.value;\n  const { approvalMs } = options;\n  await seedPolicy(home, BACKGROUND_CONTEXT).catch(() => false);\n  const settings = settingsText(home, HOME, at.agentDir);\n  const intent = ownerIntent({ env: home, agents: agent.agents, memories });\n  const judge: ApprovalJudge = {\n    judge: approvalJudge({\n      models,\n      model: async (context) => judgeModelOf(await settings(context)),\n      intent,\n      spend: judgeSpender((agentId, context) => agent.agents.conversation(agentId, context)),\n    }),\n    record: verdictRecorder((agentId, context) => agent.agents.conversation(agentId, context)),\n  };\n  return { judge, intent, ...(approvalMs ? { approvalMs } : {}) };\n}\n\nfunction setupTitles(\n  registry: ReturnType<typeof createRegistry>,\n  models: Models,\n  home: SliccKernelEnv,\n  at: { home: string; agentDir?: string },\n  opened: () => Agent | undefined\n) {\n  const settings = settingsText(home, HOME, at.agentDir);\n  const titleFn = titler(models, settings);\n  const titles = titlesExtension({\n    agents: () => opened()?.agents,\n    harness: () => opened()?.harness,\n    title: () => titleFn,\n  });\n  registry.install(titles.extension);\n  return { titleFn, cancel: titles.cancel, label: labeler(models, settings) };\n}\n\nfunction freezerOf(\n  agent: Agent,\n  parts: {\n    home: SliccKernelEnv;\n    memory: ReturnType<typeof setupMemory>;\n    titles: ReturnType<typeof setupTitles>;\n    people: AgentUsers | undefined;\n  }\n) {\n  const { home, memory, titles, people } = parts;\n  return attachFreezer({\n    harness: agent.harness,\n    agents: agent.agents,\n    env: home,\n    extract: memory.extract,\n    title: titles.titleFn,\n    cancelTitle: titles.cancel,\n    ...(people ? { layout: people.layout } : {}),\n    imports: { env: home },\n  });\n}\n\nasync function start(\n  scope: AgentWorkerScope,\n  ports: Promise<KernelPorts>,\n  options: AgentWorkerOptions,\n  vault: Vault\n): Promise<AgentHost> {\n  const { client, users, home, at, wiped } = await attached(ports, options);\n  const ready = await prepare(scope, { client, home, vault }, options);\n  const { names, native, transport, facts, models, registry, records, endpoints } = ready;\n  const memory = setupMemory(registry);\n  const coding = CodingTools.tools as readonly ToolRegistration[];\n  const mcp = setupMcp(registry);\n  const codemode = await codemodeTools(client, options, native, mcp.codemode, at.agentDir);\n  registry.install(codemodeExtension(codemode));\n  const licks = setupLicks(registry, transport);\n  licks.licks.triage(lickTriage(models));\n  const scoops = setupScoops(registry, licks.licks, [...coding, ...codemode, ...memory.tools]);\n  const skills = setupSkills(registry, licks.licks);\n  registry.install(secretsExtension({ names, vault }));\n  const titles = setupTitles(registry, models, home, at, () => opened);\n  const [activity, groups] = [createActivity(), processGroups(client)];\n  const model = options.model ?? (await ready.defaultModel());\n  let opened: Agent | undefined;\n  const people = users ? agentUsers(users, client, home, () => opened?.agents) : undefined;\n  const environment = kernelEnvironment(client, {\n    activity,\n    groups,\n    identify: identity(() => opened?.agents, model),\n    scrub: vault,\n    spawn: shellGrants(names),\n    ...(people ? { route: people.route } : {}),\n  });\n  const agent = await openUnfrozen(options, scoops, { models, model, registry, env: environment });\n  opened = agent;\n  await people?.start(agent.agents);\n  const sources = licks.attach(agent, {\n    env: home,\n    home: HOME,\n    activity,\n    ...(people ? { dirs: () => people.lickDirs(), cronUser: people.cronUser.bind(people) } : {}),\n  });\n  await sources.start(BACKGROUND_CONTEXT);\n  const booted = { version: facts.version, boot: await kernelBoot(client) };\n  await sources.boot(booted, BACKGROUND_CONTEXT);\n  const skillsRuntime = await skills.attach(\n    {\n      env: home,\n      ...at,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people ? { people: people.people } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const mcpRuntime = await mcp.attach(\n    {\n      env: home,\n      ...at,\n      ...mcpVault(vault, ready),\n      licks: licks.licks,\n      fetch: transport,\n      version: facts.version,\n      reloadMs: RELOAD_MS,\n      codemode: codemode.length > 0,\n      cors: pageOnly(client.transport),\n      redirect: options.mcpRedirect ?? new URL(MCP_CALLBACK, scope.location.origin).href,\n    },\n    BACKGROUND_CONTEXT\n  );\n  const gelatiere = lateGelatiere();\n  const sprinkles = await setupSprinkles().attach(\n    {\n      intercept: gelatiere.intercept,\n      harness: agent.harness,\n      agents: agent.agents,\n      licks: licks.licks,\n      env: home,\n      assets: options.assets ?? packageAssets(),\n      reloadMs: RELOAD_MS,\n      ...(people?.sprinkles() ?? {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  people?.follow([sources, skillsRuntime, sprinkles]);\n  let roles: ScoopsRuntime | undefined;\n  const memoryRuntime = await memory.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      env: home,\n      ...at,\n      ...(people ? { home: ROOT_HOME } : {}),\n      reloadMs: RELOAD_MS,\n      roles: async (using) => roles?.roles(using),\n    },\n    BACKGROUND_CONTEXT\n  );\n  const freezer = freezerOf(agent, { home, memory, titles, people });\n  licks.licks.guard(freezer.frozenTarget);\n  const settings = await settingsOf(ready, mcpRuntime, { agent, vault, wiped });\n  const pages = createPages({ claim: sprinkles.claim });\n  const runtime = await scoops.attach(\n    {\n      harness: agent.harness,\n      agents: agent.agents,\n      groups,\n      env: home,\n      envOf: async (conversationId, context) => environment({ conversationId }, context),\n      ...at,\n      ...(people\n        ? { layout: people.layout, spools: people.spools, enforced: people.enforced }\n        : {}),\n      alive: alive(client),\n      reads: skillsRuntime.dirs,\n      memory: memoryRuntime.command,\n      gelatiere: gelatiere.command,\n      freezer: freezer.command,\n      models: modelsOfAgent(agent, settings, models, vault),\n      panel: pages.command,\n      webhook: sources.webhook,\n      mcp: mcp.direct,\n      ...(options.assets ? { assets: options.assets } : {}),\n    },\n    BACKGROUND_CONTEXT\n  );\n  roles = runtime;\n  gelatiere.attach({\n    agents: agent.agents,\n    licks: licks.licks,\n    env: home,\n    home: HOME,\n    ...(await people?.gelatiere(home)),\n    scoops: scoops.scoops,\n    roles: runtime.roles,\n    assets: options.assets ?? packageAssets(),\n    fetch: scope.fetch,\n    skills: skillsRuntime.skills,\n    ...(options.catalog ? { catalog: options.catalog } : {}),\n  });\n  await memoryRuntime.reload(BACKGROUND_CONTEXT).catch(() => undefined);\n  return hostAgent(agent, {\n    ...(await setupApprovals(models, home, at, agent, memoryRuntime.memories, options)),\n    settings,\n    licks: { licks: licks.licks, sources },\n    scoops: { scoops: scoops.scoops, runtime },\n    skills: skillsRuntime,\n    sprinkles,\n    memory: memoryRuntime,\n    freezer,\n    changes: attachChanges({ agents: agent.agents, env: home, reloadMs: CHANGES_MS }),\n    pages,\n    labels: await attachLabels({ ...agent, label: titles.label, vault: vault.state }),\n    mcp: mcpRuntime,\n    ...(users ? { users } : {}),\n    secrets: hostSecrets(vault, names, [names, records, endpoints]),\n    uploads: {\n      env: environment,\n      sees: (ref) => seesImages(models, ref),\n    },\n    monitor: {\n      kernel: client,\n      groups,\n      ...(users ? { users: () => users.users.list() } : {}),\n    },\n  });\n}\n\nexport function alive(client: KernelClient) {\n  return async (pid: number): Promise<boolean> => {\n    if (!client.ps) return true;\n    return (await client.ps()).some((process) => process.pid === pid);\n  };\n}\n\nexport function runAgentWorker(\n  scope: AgentWorkerScope,\n  options: AgentWorkerOptions = {}\n): Promise<AgentHost> {\n  const vault = new Vault();\n  listenVault(scope, vault);\n  const host = start(scope, kernelPorts(scope), options, vault);\n  host.catch(() => undefined);\n  serveConnections(scope, host);\n  return host;\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AAGnC;AAAA,EACE;AAAA,OAIK;AACP,SAAS,mBAAmB;AAC5B,SAAwC,iBAAiB;AACzD;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,eAAe,kBAAkB;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;AAC9B,SAAyB,iBAAiB;AAC1C,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAC/B,SAA0B,YAAY,mBAAmB;AAEzD,SAAS,MAAM,mBAAmB,sBAAsB;AACxD,SAAS,qBAAqB;AAC9B,SAAS,WAA8C,mBAAmB;AAC1E,SAAS,WAAW,iBAAiB;AACrC,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAA2B,gBAAgB;AAE3C,SAAS,mBAAmB;AAC5B,SAAS,qBAAqB;AAC9B,SAAS,UAA0B,sBAAsB;AACzD,SAAS,mBAAmB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB;AACzB,SAAsB,eAAmC,mBAAmB;AAC5E,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,mBAAmB;AAC9C,SAAS,YAAY,UAAU,kBAAkB;AACjD,SAAS,WAAuB,kBAAkB;AAClD,SAAS,mBAAmB;AAC5B,SAA4B,oBAAoB;AAChD,SAAS,iBAAiB;AAC1B,SAAS,iBAAkC;AAC3C,SAAS,aAAa,OAAO,kBAAkB;AAC/C,SAAyB,UAAU,uBAAuB;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,mBAAmB;AACvC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,SAAS,cAAc,cAAc;AAC9C,SAAS,oBAAoB;AAC7B,SAA2B,aAAa,wBAA0C;AAwB3E,SAAS,QACd,OACA,QACA,QACyB;AACzB,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,WAAW,OAAO;AACpB,UAAM,MAAM;AACZ,WAAO;AAAA,EACT;AACA,SAAO,YAAY,UAAU,KAAK,GAAG,MAAoD;AAC3F;AAEO,MAAM,YAAY;AAClB,MAAM,gBAAgB,GAAG,SAAS;AAEzC,eAAe,SAAS,OAA6B,SAA6B;AAChF,QAAM,QAAQ,MAAM,WAAW;AAC/B,QAAM,SAAuB,QAAQ,UAAU;AAC/C,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM;AAChC,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,QAAQ,QAAQ,OAAO,QAAQ,OAAO,MAAM;AAClD,QAAM,YAAY,OAAO,QAAQ,QAAQ,KAAK;AAC9C,QAAM,OAAO,IAAI,eAAe,QAAQ,EAAE,KAAK,KAAK,CAAC;AACrD,QAAM,aAAa,IAAI;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,EAAE,MAAM,MAAM,GAAI,QAAQ,EAAE,UAAU,UAAU,IAAI,CAAC,EAAG;AAAA,EAC9D;AACF;AAEA,SAAS,aAAa,KAAuC;AAC3D,SAAO,IAAI,KAAK,YAAY,SAAS,iBAAiB,SAAS,IAAI,QAAW,kBAAkB;AAClG;AAEA,eAAe,cACb,QACA,SACA,QACA,OACA,MAAM,GAAG,IAAI,cACb;AACA,QAAM,WAAW,MAAM,OAAO,GAAG,SAAS,GAAG,GAAG,gBAAgB,EAAE,MAAM,MAAM,MAAS;AACvF,MAAI,mBAAmB,aAAa,SAAY,SAAY,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AAC5F,WAAO,CAAC;AACV,QAAM,UAAU;AAAA,IACd,QAAQ,iBAAiB,MAAM,WAAW,QAAQ,IAAI,IAAI,YAAY,GAAG,CAAC;AAAA,IAC1E,QAAQ;AAAA,EACV;AACA,SAAO;AAAA,IACL,aAAa,EAAE,UAAU,YAAY,OAAsC,SAAS,MAAM,CAAC;AAAA,EAC7F;AACF;AAEO,SAAS,WAAW,QAAkC,KAAoC;AAC/F,QAAM,QAAQ,OAAO,OAAO,SAAS,IAAI,UAAU,IAAI,OAAO;AAC9D,SAAO,QAAQ,MAAM,MAAM,SAAS,OAAO,IAAI;AACjD;AAEO,MAAM,eAAe;AAE5B,eAAe,aACb,SACA,EAAE,WAAW,OAAO,GACpB,MACgB;AAChB,QAAM,UAAU,OAAO,QAAQ,YAAY,MAAM,sBAAsB,IAAI;AAC3E,SAAO,UAAU;AAAA,IACf,GAAG;AAAA,IACH;AAAA,IACA,qBAAqB,gBAAgB,MAAM;AAAA,IAC3C,cAAc,CAAC,SAAS,UAAU,SAAS,SAAS,SAAS,QAAQ,KAAK;AAAA,EAC5E,CAAC;AACH;AAEA,eAAe,WAAW,MAAsB,OAAc;AAC5D,YAAU,KAAK;AACf,QAAM,QAAQ,YAAY,MAAM,KAAK;AACrC,QAAM,MAAM,QAAQ,kBAAkB;AACtC,SAAO;AACT;AAEO,SAAS,WACd,WACA,QACc;AACd,SAAO,UAAU,IAAI,CAAC,cAAc;AAAA,IAClC,UAAU,SAAS;AAAA,IACnB,MAAM;AAAA,MACJ,GAAG,IAAI;AAAA,QACL;AAAA,UACE,SAAS;AAAA,UACT,GAAG,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,MAAM,OAAO;AAAA,UAC7D,GAAI,SAAS,OAAO,UAAU,oBAAoB,CAAC;AAAA,QACrD,EAAE,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,QAAQ,EAAE;AAAA,MACxE;AAAA,IACF;AAAA,EACF,EAAE;AACJ;AAEA,SAAS,SACP,OACA,MACA;AACA,QAAM,EAAE,OAAO,SAAS,UAAU,IAAI;AACtC,SAAO;AAAA,IACL;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA,OAAO,CAAC,QAAgB,SAAuB,SAAS,OAAO,MAAM,MAAM;AAAA,MAC3E,OAAO,CAAC,QAAgB,SAAuB,WAAW,OAAO,QAAQ,IAAI;AAAA,MAC7E,SAAS,UAAU;AAAA,MACnB,OAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACF;AAEA,SAAS,YACP,OACA,OACA,OACA;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,MAAM,MAAM,MAAM,MAAM;AAAA,IACxB,OAAO,MAAM;AACX,iBAAW,QAAQ,MAAO,MAAK,MAAM;AAAA,IACvC;AAAA,EACF;AACF;AAEA,eAAe,SACb,OACA,SACA,OACA;AACA,QAAM,EAAE,OAAO,MAAM,WAAW,QAAQ,IAAI;AAC5C,QAAM,QAAQ,OAAO,QAAQ,UAAU,YAAY,UAAU,MAAM,aAAa,IAAI;AACpF,QAAM,UAAU,aAAa,KAAK;AAClC,QAAM,SAAS,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACxE,QAAM,YAAY,QAAQ,aAAa,eAAe,OAAO;AAC7D,QAAM,SAAS,MAAM,eAAe,OAAO,SAAS;AACpD,QAAM,cAAc,iBAAiB,SAAS,OAAO,GAAG;AACxD,QAAM,SAAS,kBAAkB,aAAa,SAAS;AACvD,QAAM,QAAQ,MAAM,WAAW,WAAW,MAAM;AAChD,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,OAAO,MAAM,QAAQ,MAAM,KAAK;AAAA,IAC3C,QAAQ;AAAA,EACV;AACA,QAAM,YAAY,eAAe,KAAK;AACtC,OAAK,UAAU,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AACpD,QAAM,eAAe,YAAY;AAC/B,UAAM,QAAQ,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,UAAU,CAAC,CAAC,CAAC;AACtF,WAAO,oBAAoB,aAAa,WAAW,MAAM;AAAA,EAC3D;AACA,SAAO,EAAE,OAAO,SAAS,WAAW,QAAQ,QAAQ,OAAO,WAAW,aAAa;AACrF;AAEA,SAAS,aAAa,OAA4C,QAAgB;AAChF,QAAM,WAAW,eAAe;AAChC,WAAS,QAAQ,WAAW;AAC5B,WAAS,QAAQ,aAAa,CAAC,MAAM,CAAC,CAAC;AACvC,WAAS,QAAQ,YAAY,KAAK,CAAC;AACnC,QAAM,OAAQ,YAAY,MAAsC;AAAA,IAC9D,CAAC,SAAS,KAAK,SAAS;AAAA,EAC1B;AACA,WAAS,QAAQ,WAAW,IAAI,CAAC;AACjC,SAAO;AACT;AAEA,eAAe,QAAQ,QAAiD,QAAsB;AAC5F,SAAO;AAAA,IACL,SAAS,MAAM,aAAa,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAChD,UAAU,MAAM,eAAe,MAAM;AAAA,IACrC,WAAW,cAAc,OAAO,SAAS;AAAA,IACzC,SAAS,MAAM,iBAAiB,MAAM;AAAA,EACxC;AACF;AAEA,SAAS,WAAW,OAAyB,QAAiD;AAC5F,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK;AACrC,QAAM,WAAW,OAAO,eAAe,KAAK,MAAM;AAClD,QAAM,YAAY,eAAe,OAAO,WAAW,MAAM,SAAS,QAAQ,QAAQ,QAAQ;AAC1F,QAAM,QAAQ;AACd,SAAO,EAAE,QAAQ,UAAU;AAC7B;AAEA,eAAe,QACb,OACA,QACA,SACA;AACA,QAAM,QAAQ,MAAM,WAAW,OAAO,MAAM,OAAO,KAAK;AACxD,QAAM,EAAE,QAAQ,UAAU,IAAI,WAAW,OAAO,OAAO,MAAM;AAC7D,QAAM,QAAQ,MAAM,QAAQ,OAAO,QAAQ,MAAM;AACjD,QAAM,OAAO,MAAM,SAAS,OAAO,SAAS;AAAA,IAC1C,OAAO,OAAO;AAAA,IACd,MAAM,OAAO;AAAA,IACb;AAAA,IACA,SAAS,MAAM;AAAA,EACjB,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,UAAU,aAAa,OAAO,MAAM,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,SAAS,cACP,OACA,UACA,SACA,OACA;AACA,QAAM,SAAS,MAAM,MAAM,MAAM,MAAM,WAAW;AAClD,SAAO,cAAc,EAAE,QAAQ,MAAM,QAAQ,UAAU,SAAS,OAAO,CAAC;AAC1E;AAEA,eAAe,WACb,MACA,KACA,OACA;AACA,QAAM,EAAE,QAAQ,SAAS,QAAQ,WAAW,OAAO,UAAU,IAAI;AACjE,QAAM,OAAO,MAAM,UAAU,MAAM,MAAM,SAAS,EAAE,SAAS,OAAO,MAAM,MAAM,GAAG,MAAM,KAAK;AAC9F,QAAM,WAAW,MAAM,oBAAoB,QAAQ,EAAE,SAAS,OAAO,GAAG,WAAW;AAAA,IACjF;AAAA,IACA,OAAO;AAAA,EACT,CAAC;AACD,WAAS,MAAM,UAAU,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS,CAAC;AACpF,SAAO;AACT;AAEA,eAAe,eACb,QACA,MACA,IACA,OACA,QACA,SACA;AACA,QAAM,WAAW,MAAM,OAAO;AAC9B,QAAM,EAAE,WAAW,IAAI;AACvB,QAAM,WAAW,MAAM,kBAAkB,EAAE,MAAM,MAAM,KAAK;AAC5D,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,SAAS,YAAY,EAAE,KAAK,MAAM,QAAQ,MAAM,QAAQ,SAAS,CAAC;AACxE,QAAM,QAAuB;AAAA,IAC3B,OAAO,cAAc;AAAA,MACnB;AAAA,MACA,OAAO,OAAO,YAAY,aAAa,MAAM,SAAS,OAAO,CAAC;AAAA,MAC9D;AAAA,MACA,OAAO,aAAa,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,IACvF,CAAC;AAAA,IACD,QAAQ,gBAAgB,CAAC,SAAS,YAAY,MAAM,OAAO,aAAa,SAAS,OAAO,CAAC;AAAA,EAC3F;AACA,SAAO,EAAE,OAAO,QAAQ,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC,EAAG;AAChE;AAEA,SAAS,YACP,UACA,QACA,MACA,IACA,QACA;AACA,QAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ;AACrD,QAAM,UAAU,OAAO,QAAQ,QAAQ;AACvC,QAAM,SAAS,gBAAgB;AAAA,IAC7B,QAAQ,MAAM,OAAO,GAAG;AAAA,IACxB,SAAS,MAAM,OAAO,GAAG;AAAA,IACzB,OAAO,MAAM;AAAA,EACf,CAAC;AACD,WAAS,QAAQ,OAAO,SAAS;AACjC,SAAO,EAAE,SAAS,QAAQ,OAAO,QAAQ,OAAO,QAAQ,QAAQ,QAAQ,EAAE;AAC5E;AAEA,SAAS,UACP,OACA,OAMA;AACA,QAAM,EAAE,MAAM,QAAQ,QAAQ,OAAO,IAAI;AACzC,SAAO,cAAc;AAAA,IACnB,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,KAAK;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC1C,SAAS,EAAE,KAAK,KAAK;AAAA,EACvB,CAAC;AACH;AAEA,eAAe,MACb,OACA,OACA,SACA,OACoB;AACpB,QAAM,EAAE,QAAQ,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,SAAS,OAAO,OAAO;AACxE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,QAAQ,MAAM,MAAM,GAAG,OAAO;AACnE,QAAM,EAAE,OAAO,QAAQ,WAAW,OAAO,QAAQ,UAAU,SAAS,UAAU,IAAI;AAClF,QAAM,SAAS,YAAY,QAAQ;AACnC,QAAM,SAAS,YAAY;AAC3B,QAAM,MAAM,SAAS,QAAQ;AAC7B,QAAM,WAAW,MAAM,cAAc,QAAQ,SAAS,QAAQ,IAAI,UAAU,GAAG,QAAQ;AACvF,WAAS,QAAQ,kBAAkB,QAAQ,CAAC;AAC5C,QAAM,QAAQ,WAAW,UAAU,SAAS;AAC5C,QAAM,MAAM,OAAO,WAAW,MAAM,CAAC;AACrC,QAAM,SAAS,YAAY,UAAU,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,KAAK,CAAC;AAC3F,QAAM,SAAS,YAAY,UAAU,MAAM,KAAK;AAChD,WAAS,QAAQ,iBAAiB,EAAE,OAAO,MAAM,CAAC,CAAC;AACnD,QAAM,SAAS,YAAY,UAAU,QAAQ,MAAM,IAAI,MAAM,MAAM;AACnE,QAAM,CAAC,UAAU,MAAM,IAAI,CAAC,eAAe,GAAG,cAAc,MAAM,CAAC;AACnE,QAAM,QAAQ,QAAQ,SAAU,MAAM,MAAM,aAAa;AACzD,MAAI;AACJ,QAAM,SAAS,QAAQ,WAAW,OAAO,QAAQ,MAAM,MAAM,QAAQ,MAAM,IAAI;AAC/E,QAAM,cAAc,kBAAkB,QAAQ;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,UAAU,SAAS,MAAM,QAAQ,QAAQ,KAAK;AAAA,IAC9C,OAAO;AAAA,IACP,OAAO,YAAY,KAAK;AAAA,IACxB,GAAI,SAAS,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,QAAM,QAAQ,MAAM,aAAa,SAAS,QAAQ,EAAE,QAAQ,OAAO,UAAU,KAAK,YAAY,CAAC;AAC/F,WAAS;AACT,QAAM,QAAQ,MAAM,MAAM,MAAM;AAChC,QAAM,UAAU,MAAM,OAAO,OAAO;AAAA,IAClC,KAAK;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,GAAI,SAAS,EAAE,MAAM,MAAM,OAAO,SAAS,GAAG,UAAU,OAAO,SAAS,KAAK,MAAM,EAAE,IAAI,CAAC;AAAA,EAC5F,CAAC;AACD,QAAM,QAAQ,MAAM,kBAAkB;AACtC,QAAM,SAAS,EAAE,SAAS,MAAM,SAAS,MAAM,MAAM,WAAW,MAAM,EAAE;AACxE,QAAM,QAAQ,KAAK,QAAQ,kBAAkB;AAC7C,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,MAAM,IAAI;AAAA,IAC3B;AAAA,MACE,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAG,SAAS,OAAO,KAAK;AAAA,MACxB,OAAO,MAAM;AAAA,MACb,OAAO;AAAA,MACP,SAAS,MAAM;AAAA,MACf,UAAU;AAAA,MACV,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,SAAS,OAAO,SAAS;AAAA,MAC/B,UAAU,QAAQ,eAAe,IAAI,IAAI,cAAc,MAAM,SAAS,MAAM,EAAE;AAAA,IAChF;AAAA,IACA;AAAA,EACF;AACA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,MAAM,eAAe,EAAE;AAAA,IACvC;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,MACb,KAAK;AAAA,MACL,QAAQ,QAAQ,UAAU,cAAc;AAAA,MACxC,UAAU;AAAA,MACV,GAAI,QAAQ,UAAU,KAAK,CAAC;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACA,UAAQ,OAAO,CAAC,SAAS,eAAe,SAAS,CAAC;AAClD,MAAI;AACJ,QAAM,gBAAgB,MAAM,OAAO;AAAA,IACjC;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd,KAAK;AAAA,MACL,GAAG;AAAA,MACH,GAAI,SAAS,EAAE,MAAM,UAAU,IAAI,CAAC;AAAA,MACpC,UAAU;AAAA,MACV,OAAO,OAAO,UAAU,OAAO,MAAM,KAAK;AAAA,IAC5C;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,UAAU,OAAO,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AACjE,QAAM,MAAM,MAAM,QAAQ,YAAY;AACtC,QAAM,WAAW,MAAM,WAAW,OAAO,YAAY,EAAE,OAAO,OAAO,MAAM,CAAC;AAC5E,QAAM,QAAQ,YAAY,EAAE,OAAO,UAAU,MAAM,CAAC;AACpD,QAAM,UAAU,MAAM,OAAO;AAAA,IAC3B;AAAA,MACE,SAAS,MAAM;AAAA,MACf,QAAQ,MAAM;AAAA,MACd;AAAA,MACA,KAAK;AAAA,MACL,OAAO,OAAO,gBAAgB,YAAY,YAAY,EAAE,eAAe,GAAG,OAAO;AAAA,MACjF,GAAG;AAAA,MACH,GAAI,SACA,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS,IAC1E,CAAC;AAAA,MACL,OAAO,MAAM,MAAM;AAAA,MACnB,OAAO,cAAc;AAAA,MACrB,QAAQ,cAAc;AAAA,MACtB,WAAW,UAAU;AAAA,MACrB,SAAS,QAAQ;AAAA,MACjB,QAAQ,cAAc,OAAO,UAAU,QAAQ,KAAK;AAAA,MACpD,OAAO,MAAM;AAAA,MACb,SAAS,QAAQ;AAAA,MACjB,KAAK,IAAI;AAAA,MACT,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,IACA;AAAA,EACF;AACA,UAAQ;AACR,YAAU,OAAO;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,KAAK;AAAA,IACL,MAAM;AAAA,IACN,GAAI,MAAM,QAAQ,UAAU,IAAI;AAAA,IAChC,QAAQ,OAAO;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ,UAAU,cAAc;AAAA,IACxC,OAAO,MAAM;AAAA,IACb,QAAQ,cAAc;AAAA,IACtB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,cAAc,OAAO,kBAAkB,EAAE,MAAM,MAAM,MAAS;AACpE,SAAO,UAAU,OAAO;AAAA,IACtB,GAAI,MAAM,eAAe,QAAQ,MAAM,IAAI,OAAO,cAAc,UAAU,OAAO;AAAA,IACjF;AAAA,IACA,OAAO,EAAE,OAAO,MAAM,OAAO,QAAQ;AAAA,IACrC,QAAQ,EAAE,QAAQ,OAAO,QAAQ,QAAQ;AAAA,IACzC,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,SAAS,cAAc,EAAE,QAAQ,MAAM,QAAQ,KAAK,MAAM,UAAU,WAAW,CAAC;AAAA,IAChF;AAAA,IACA,QAAQ,MAAM,aAAa,EAAE,GAAG,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM,CAAC;AAAA,IAChF,KAAK;AAAA,IACL,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,SAAS,YAAY,OAAO,OAAO,CAAC,OAAO,SAAS,SAAS,CAAC;AAAA,IAC9D,SAAS;AAAA,MACP,KAAK;AAAA,MACL,MAAM,CAAC,QAAQ,WAAW,QAAQ,GAAG;AAAA,IACvC;AAAA,IACA,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,GAAI,QAAQ,EAAE,OAAO,MAAM,MAAM,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,IACrD;AAAA,EACF,CAAC;AACH;AAEO,SAAS,MAAM,QAAsB;AAC1C,SAAO,OAAO,QAAkC;AAC9C,QAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAQ,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,YAAY,QAAQ,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eACd,OACA,UAA8B,CAAC,GACX;AACpB,QAAM,QAAQ,IAAI,MAAM;AACxB,cAAY,OAAO,KAAK;AACxB,QAAM,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,KAAK;AAC5D,OAAK,MAAM,MAAM,MAAS;AAC1B,mBAAiB,OAAO,IAAI;AAC5B,SAAO;AACT;",
   "names": []
 }

package/dist/mcp/accounts.js

@@ -1,13 +1,13 @@
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { resolveHeaders, secretNames } from "./credentials.js";
+import { heldRecords, resolveHeaders, secretNames } from "./credentials.js";
 import { MCP_ACCOUNT } from "./label.js";
 import { beginSignIn, finishSignIn } from "./oauth.js";
 const TOKENS_IN_VAULT = "MCP tokens are kept in seven's vault: update seven";
 function kindOf(connection) {
   return secretNames(connection.entry.config).length ? "token" : "oauth";
 }
-function row(connection, kind, stored) {
-  const rejected = connection.state === "needs-auth";
+function row(connection, kind, stored, expired) {
+  const rejected = connection.state === "needs-auth" || stored && expired;
   return {
     id: `${MCP_ACCOUNT}${connection.name}`,
     provider: connection.name,
@@ -39,7 +39,10 @@ function mcpAccounts(catalog, sources, restart, listeners) {
         const kind = kindOf(connection);
         const stored = kind === "token" ? resolveHeaders(connection.name, connection.entry.config, records).ok : await sources.oauth(connection.entry).signedIn();
         if (kind === "oauth" && !stored && connection.state !== "needs-auth") continue;
-        rows.push(row(connection, kind, stored));
+        const expired = heldRecords(connection.name, connection.entry.config, records).some(
+          (record) => record?.state === "expired"
+        );
+        rows.push(row(connection, kind, stored, expired));
       }
       return rows;
     },

package/dist/mcp/accounts.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/accounts.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { McpFetch } from '@earendil-works/pi-mcp';\nimport type { AccountState } from '../services.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport type { McpServerEntry } from './config.ts';\nimport type { McpServerConnection } from './connection.ts';\nimport { type McpRecords, resolveHeaders, secretNames } from './credentials.ts';\nimport { MCP_ACCOUNT } from './label.ts';\nimport { beginSignIn, finishSignIn, type McpSignIn, type StoredOAuth } from './oauth.ts';\n\nexport const TOKENS_IN_VAULT = \"MCP tokens are kept in seven's vault: update seven\";\n\nexport interface McpAccounts {\n  accounts(): Promise<AccountState[]>;\n  signIn(id: string): Promise<McpSignIn>;\n  connect(id: string, secret: string | null): Promise<void>;\n  disconnect(id: string): Promise<void>;\n  onChange(listener: () => void): () => void;\n}\n\nexport interface AccountSources {\n  records: McpRecords & { refresh(context: Context): Promise<void> };\n  oauth: (entry: McpServerEntry) => StoredOAuth;\n  fetch: (server: string) => McpFetch;\n  grant: (server: string) => McpFetch;\n  register: (server: string, tokenUrl: string) => Promise<void>;\n}\n\ntype Kind = 'token' | 'oauth';\n\nfunction kindOf(connection: McpServerConnection): Kind {\n  return secretNames(connection.entry.config).length ? 'token' : 'oauth';\n}\n\nfunction row(connection: McpServerConnection, kind: Kind, stored: boolean): AccountState {\n  const rejected = connection.state === 'needs-auth';\n  return {\n    id: `${MCP_ACCOUNT}${connection.name}`,\n    provider: connection.name,\n    identity: new URL(connection.entry.config.url).host,\n    status:\n      rejected && (kind === 'token' || stored)\n        ? 'expired'\n        : stored && connection.live\n          ? 'connected'\n          : 'disconnected',\n    auth: kind === 'token' ? 'api-key' : 'oauth',\n    needs: null,\n    group: 'mcp',\n    store: 'vault',\n    ...(kind === 'token' ? { secret: 'token' as const } : {}),\n  };\n}\n\nexport function mcpAccounts(\n  catalog: McpCatalog,\n  sources: AccountSources,\n  restart: (connection: McpServerConnection) => void,\n  listeners: Set<() => void>\n): McpAccounts {\n  const { records } = sources;\n  const find = (id: string, want?: Kind) => {\n    const connection = id.startsWith(MCP_ACCOUNT)\n      ? catalog.connections.get(id.slice(MCP_ACCOUNT.length))\n      : undefined;\n    const kind = connection && kindOf(connection);\n    if (!connection || (want && kind !== want))\n      throw new Error(\n        `${id} is not an MCP server that ${want === 'oauth' ? 'signs in' : 'takes a token or a sign-in'}`\n      );\n    return { connection, kind: kind as Kind };\n  };\n  const reread = () => records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  return {\n    async accounts() {\n      const rows: AccountState[] = [];\n      for (const connection of catalog.connections.values()) {\n        const kind = kindOf(connection);\n        const stored =\n          kind === 'token'\n            ? resolveHeaders(connection.name, connection.entry.config, records).ok\n            : await sources.oauth(connection.entry).signedIn();\n        if (kind === 'oauth' && !stored && connection.state !== 'needs-auth') continue;\n        rows.push(row(connection, kind, stored));\n      }\n      return rows;\n    },\n    async signIn(id) {\n      const { connection } = find(id, 'oauth');\n      return beginSignIn(sources.oauth(connection.entry), connection.entry, {\n        fetch: sources.fetch(connection.name),\n        register: (tokenUrl) => sources.register(connection.name, tokenUrl),\n      });\n    },\n    async connect(id, secret) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') {\n        if (secret === null) throw new Error(`${id} needs a sign-in`);\n        await finishSignIn(\n          sources.oauth(connection.entry),\n          connection.entry,\n          secret,\n          sources.grant(connection.name)\n        );\n      } else if (secret !== null) throw new Error(TOKENS_IN_VAULT);\n      await reread();\n      restart(connection);\n    },\n    async disconnect(id) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') await sources.oauth(connection.entry).forget();\n      await reread();\n      restart(connection);\n    },\n    onChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n  };\n}\n"],
-  "mappings": "AACA,SAAS,0BAA0B;AAMnC,SAA0B,gBAAgB,mBAAmB;AAC7D,SAAS,mBAAmB;AAC5B,SAAS,aAAa,oBAAsD;AAErE,MAAM,kBAAkB;AAoB/B,SAAS,OAAO,YAAuC;AACrD,SAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SAAS,UAAU;AACjE;AAEA,SAAS,IAAI,YAAiC,MAAY,QAA+B;AACvF,QAAM,WAAW,WAAW,UAAU;AACtC,SAAO;AAAA,IACL,IAAI,GAAG,WAAW,GAAG,WAAW,IAAI;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,UAAU,IAAI,IAAI,WAAW,MAAM,OAAO,GAAG,EAAE;AAAA,IAC/C,QACE,aAAa,SAAS,WAAW,UAC7B,YACA,UAAU,WAAW,OACnB,cACA;AAAA,IACR,MAAM,SAAS,UAAU,YAAY;AAAA,IACrC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,GAAI,SAAS,UAAU,EAAE,QAAQ,QAAiB,IAAI,CAAC;AAAA,EACzD;AACF;AAEO,SAAS,YACd,SACA,SACA,SACA,WACa;AACb,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,OAAO,CAAC,IAAY,SAAgB;AACxC,UAAM,aAAa,GAAG,WAAW,WAAW,IACxC,QAAQ,YAAY,IAAI,GAAG,MAAM,YAAY,MAAM,CAAC,IACpD;AACJ,UAAM,OAAO,cAAc,OAAO,UAAU;AAC5C,QAAI,CAAC,cAAe,QAAQ,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,EAAE,8BAA8B,SAAS,UAAU,aAAa,4BAA4B;AAAA,MACjG;AACF,WAAO,EAAE,YAAY,KAAmB;AAAA,EAC1C;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AAC9E,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,OAAuB,CAAC;AAC9B,iBAAW,cAAc,QAAQ,YAAY,OAAO,GAAG;AACrD,cAAM,OAAO,OAAO,UAAU;AAC9B,cAAM,SACJ,SAAS,UACL,eAAe,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE,KAClE,MAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,SAAS;AACrD,YAAI,SAAS,WAAW,CAAC,UAAU,WAAW,UAAU,aAAc;AACtE,aAAK,KAAK,IAAI,YAAY,MAAM,MAAM,CAAC;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,IAAI;AACf,YAAM,EAAE,WAAW,IAAI,KAAK,IAAI,OAAO;AACvC,aAAO,YAAY,QAAQ,MAAM,WAAW,KAAK,GAAG,WAAW,OAAO;AAAA,QACpE,OAAO,QAAQ,MAAM,WAAW,IAAI;AAAA,QACpC,UAAU,CAAC,aAAa,QAAQ,SAAS,WAAW,MAAM,QAAQ;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,IACA,MAAM,QAAQ,IAAI,QAAQ;AACxB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,SAAS;AACpB,YAAI,WAAW,KAAM,OAAM,IAAI,MAAM,GAAG,EAAE,kBAAkB;AAC5D,cAAM;AAAA,UACJ,QAAQ,MAAM,WAAW,KAAK;AAAA,UAC9B,WAAW;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,WAAW,IAAI;AAAA,QAC/B;AAAA,MACF,WAAW,WAAW,KAAM,OAAM,IAAI,MAAM,eAAe;AAC3D,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,QAAS,OAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,OAAO;AACnE,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,SAAS,UAAU;AACjB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM,UAAU,OAAO,QAAQ;AAAA,IACxC;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { McpFetch } from '@earendil-works/pi-mcp';\nimport type { AccountState } from '../services.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport type { McpServerEntry } from './config.ts';\nimport type { McpServerConnection } from './connection.ts';\nimport { heldRecords, type McpRecords, resolveHeaders, secretNames } from './credentials.ts';\nimport { MCP_ACCOUNT } from './label.ts';\nimport { beginSignIn, finishSignIn, type McpSignIn, type StoredOAuth } from './oauth.ts';\n\nexport const TOKENS_IN_VAULT = \"MCP tokens are kept in seven's vault: update seven\";\n\nexport interface McpAccounts {\n  accounts(): Promise<AccountState[]>;\n  signIn(id: string): Promise<McpSignIn>;\n  connect(id: string, secret: string | null): Promise<void>;\n  disconnect(id: string): Promise<void>;\n  onChange(listener: () => void): () => void;\n}\n\nexport interface AccountSources {\n  records: McpRecords & { refresh(context: Context): Promise<void> };\n  oauth: (entry: McpServerEntry) => StoredOAuth;\n  fetch: (server: string) => McpFetch;\n  grant: (server: string) => McpFetch;\n  register: (server: string, tokenUrl: string) => Promise<void>;\n}\n\ntype Kind = 'token' | 'oauth';\n\nfunction kindOf(connection: McpServerConnection): Kind {\n  return secretNames(connection.entry.config).length ? 'token' : 'oauth';\n}\n\nfunction row(\n  connection: McpServerConnection,\n  kind: Kind,\n  stored: boolean,\n  expired: boolean\n): AccountState {\n  const rejected = connection.state === 'needs-auth' || (stored && expired);\n  return {\n    id: `${MCP_ACCOUNT}${connection.name}`,\n    provider: connection.name,\n    identity: new URL(connection.entry.config.url).host,\n    status:\n      rejected && (kind === 'token' || stored)\n        ? 'expired'\n        : stored && connection.live\n          ? 'connected'\n          : 'disconnected',\n    auth: kind === 'token' ? 'api-key' : 'oauth',\n    needs: null,\n    group: 'mcp',\n    store: 'vault',\n    ...(kind === 'token' ? { secret: 'token' as const } : {}),\n  };\n}\n\nexport function mcpAccounts(\n  catalog: McpCatalog,\n  sources: AccountSources,\n  restart: (connection: McpServerConnection) => void,\n  listeners: Set<() => void>\n): McpAccounts {\n  const { records } = sources;\n  const find = (id: string, want?: Kind) => {\n    const connection = id.startsWith(MCP_ACCOUNT)\n      ? catalog.connections.get(id.slice(MCP_ACCOUNT.length))\n      : undefined;\n    const kind = connection && kindOf(connection);\n    if (!connection || (want && kind !== want))\n      throw new Error(\n        `${id} is not an MCP server that ${want === 'oauth' ? 'signs in' : 'takes a token or a sign-in'}`\n      );\n    return { connection, kind: kind as Kind };\n  };\n  const reread = () => records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  return {\n    async accounts() {\n      const rows: AccountState[] = [];\n      for (const connection of catalog.connections.values()) {\n        const kind = kindOf(connection);\n        const stored =\n          kind === 'token'\n            ? resolveHeaders(connection.name, connection.entry.config, records).ok\n            : await sources.oauth(connection.entry).signedIn();\n        if (kind === 'oauth' && !stored && connection.state !== 'needs-auth') continue;\n        const expired = heldRecords(connection.name, connection.entry.config, records).some(\n          (record) => record?.state === 'expired'\n        );\n        rows.push(row(connection, kind, stored, expired));\n      }\n      return rows;\n    },\n    async signIn(id) {\n      const { connection } = find(id, 'oauth');\n      return beginSignIn(sources.oauth(connection.entry), connection.entry, {\n        fetch: sources.fetch(connection.name),\n        register: (tokenUrl) => sources.register(connection.name, tokenUrl),\n      });\n    },\n    async connect(id, secret) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') {\n        if (secret === null) throw new Error(`${id} needs a sign-in`);\n        await finishSignIn(\n          sources.oauth(connection.entry),\n          connection.entry,\n          secret,\n          sources.grant(connection.name)\n        );\n      } else if (secret !== null) throw new Error(TOKENS_IN_VAULT);\n      await reread();\n      restart(connection);\n    },\n    async disconnect(id) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') await sources.oauth(connection.entry).forget();\n      await reread();\n      restart(connection);\n    },\n    onChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n  };\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AAMnC,SAAS,aAA8B,gBAAgB,mBAAmB;AAC1E,SAAS,mBAAmB;AAC5B,SAAS,aAAa,oBAAsD;AAErE,MAAM,kBAAkB;AAoB/B,SAAS,OAAO,YAAuC;AACrD,SAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SAAS,UAAU;AACjE;AAEA,SAAS,IACP,YACA,MACA,QACA,SACc;AACd,QAAM,WAAW,WAAW,UAAU,gBAAiB,UAAU;AACjE,SAAO;AAAA,IACL,IAAI,GAAG,WAAW,GAAG,WAAW,IAAI;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,UAAU,IAAI,IAAI,WAAW,MAAM,OAAO,GAAG,EAAE;AAAA,IAC/C,QACE,aAAa,SAAS,WAAW,UAC7B,YACA,UAAU,WAAW,OACnB,cACA;AAAA,IACR,MAAM,SAAS,UAAU,YAAY;AAAA,IACrC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,GAAI,SAAS,UAAU,EAAE,QAAQ,QAAiB,IAAI,CAAC;AAAA,EACzD;AACF;AAEO,SAAS,YACd,SACA,SACA,SACA,WACa;AACb,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,OAAO,CAAC,IAAY,SAAgB;AACxC,UAAM,aAAa,GAAG,WAAW,WAAW,IACxC,QAAQ,YAAY,IAAI,GAAG,MAAM,YAAY,MAAM,CAAC,IACpD;AACJ,UAAM,OAAO,cAAc,OAAO,UAAU;AAC5C,QAAI,CAAC,cAAe,QAAQ,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,EAAE,8BAA8B,SAAS,UAAU,aAAa,4BAA4B;AAAA,MACjG;AACF,WAAO,EAAE,YAAY,KAAmB;AAAA,EAC1C;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AAC9E,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,OAAuB,CAAC;AAC9B,iBAAW,cAAc,QAAQ,YAAY,OAAO,GAAG;AACrD,cAAM,OAAO,OAAO,UAAU;AAC9B,cAAM,SACJ,SAAS,UACL,eAAe,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE,KAClE,MAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,SAAS;AACrD,YAAI,SAAS,WAAW,CAAC,UAAU,WAAW,UAAU,aAAc;AACtE,cAAM,UAAU,YAAY,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE;AAAA,UAC7E,CAAC,WAAW,QAAQ,UAAU;AAAA,QAChC;AACA,aAAK,KAAK,IAAI,YAAY,MAAM,QAAQ,OAAO,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,IAAI;AACf,YAAM,EAAE,WAAW,IAAI,KAAK,IAAI,OAAO;AACvC,aAAO,YAAY,QAAQ,MAAM,WAAW,KAAK,GAAG,WAAW,OAAO;AAAA,QACpE,OAAO,QAAQ,MAAM,WAAW,IAAI;AAAA,QACpC,UAAU,CAAC,aAAa,QAAQ,SAAS,WAAW,MAAM,QAAQ;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,IACA,MAAM,QAAQ,IAAI,QAAQ;AACxB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,SAAS;AACpB,YAAI,WAAW,KAAM,OAAM,IAAI,MAAM,GAAG,EAAE,kBAAkB;AAC5D,cAAM;AAAA,UACJ,QAAQ,MAAM,WAAW,KAAK;AAAA,UAC9B,WAAW;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,WAAW,IAAI;AAAA,QAC/B;AAAA,MACF,WAAW,WAAW,KAAM,OAAM,IAAI,MAAM,eAAe;AAC3D,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,QAAS,OAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,OAAO;AACnE,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,SAAS,UAAU;AACjB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM,UAAU,OAAO,QAAQ;AAAA,IACxC;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/mcp/credentials.js

@@ -13,10 +13,18 @@ function secretNames(config) {
     for (const name of placeholders(value)) names.add(name);
   return [...names];
 }
+function heldRecords(server, config, records) {
+  const names = secretNames(config);
+  if (!names.length) return [records.mcp(server)];
+  return names.map(
+    (name) => records.mcp(server, name) ?? (names.length === 1 ? records.mcp(server) : void 0)
+  );
+}
 function resolveHeaders(server, config, records) {
   const names = secretNames(config);
   if (!names.length) return { ok: true, headers: { ...config.headers } };
-  const placeholder = (name) => (records.mcp(server, name) ?? (names.length === 1 ? records.mcp(server) : void 0))?.placeholder;
+  const held = heldRecords(server, config, records);
+  const placeholder = (name) => held[names.indexOf(name)]?.placeholder;
   const missing = names.filter((name) => !placeholder(name));
   if (missing.length) return { ok: false, missing };
   const headers = {};
@@ -30,6 +38,7 @@ function resolveHeaders(server, config, records) {
 export {
   MCP_CREDENTIAL_PREFIX,
   credentialKey,
+  heldRecords,
   resolveHeaders,
   secretNames
 };

package/dist/mcp/credentials.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/credentials.ts"],
-  "sourcesContent": ["import { type McpServerConfig, placeholders } from './config.ts';\n\nexport const MCP_CREDENTIAL_PREFIX = 'mcp:';\n\nexport interface McpRecords {\n  mcp(server: string, name?: string): { placeholder: string } | undefined;\n}\n\nasync function digest(text: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));\n  return [...new Uint8Array(bytes).slice(0, 12)]\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport async function credentialKey(server: string, url: string): Promise<string> {\n  return `${MCP_CREDENTIAL_PREFIX}${server}|${await digest(new URL(url).href)}`;\n}\n\nexport function secretNames(config: McpServerConfig): string[] {\n  const names = new Set<string>();\n  for (const value of Object.values(config.headers ?? {}))\n    for (const name of placeholders(value)) names.add(name);\n  return [...names];\n}\n\nexport type Resolved =\n  | { ok: true; headers: Record<string, string> }\n  | { ok: false; missing: string[] };\n\nexport function resolveHeaders(\n  server: string,\n  config: McpServerConfig,\n  records: McpRecords\n): Resolved {\n  const names = secretNames(config);\n  if (!names.length) return { ok: true, headers: { ...config.headers } };\n  const placeholder = (name: string) =>\n    (records.mcp(server, name) ?? (names.length === 1 ? records.mcp(server) : undefined))\n      ?.placeholder;\n  const missing = names.filter((name) => !placeholder(name));\n  if (missing.length) return { ok: false, missing };\n  const headers: Record<string, string> = {};\n  for (const [header, text] of Object.entries(config.headers ?? {}))\n    headers[header] = text.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_, name: string) =>\n      String(placeholder(name))\n    );\n  return { ok: true, headers };\n}\n"],
-  "mappings": "AAAA,SAA+B,oBAAoB;AAE5C,MAAM,wBAAwB;AAMrC,eAAe,OAAO,MAA+B;AACnD,QAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAClF,SAAO,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,EAC1C,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAEA,eAAsB,cAAc,QAAgB,KAA8B;AAChF,SAAO,GAAG,qBAAqB,GAAG,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC;AAC7E;AAEO,SAAS,YAAY,QAAmC;AAC7D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO,OAAO,OAAO,WAAW,CAAC,CAAC;AACpD,eAAW,QAAQ,aAAa,KAAK,EAAG,OAAM,IAAI,IAAI;AACxD,SAAO,CAAC,GAAG,KAAK;AAClB;AAMO,SAAS,eACd,QACA,QACA,SACU;AACV,QAAM,QAAQ,YAAY,MAAM;AAChC,MAAI,CAAC,MAAM,OAAQ,QAAO,EAAE,IAAI,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ,EAAE;AACrE,QAAM,cAAc,CAAC,UAClB,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,IAAI,MAAM,IAAI,UACtE;AACN,QAAM,UAAU,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC;AACzD,MAAI,QAAQ,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ;AAChD,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC;AAC9D,YAAQ,MAAM,IAAI,KAAK;AAAA,MAAQ;AAAA,MAAmC,CAAC,GAAG,SACpE,OAAO,YAAY,IAAI,CAAC;AAAA,IAC1B;AACF,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;",
+  "sourcesContent": ["import { type McpServerConfig, placeholders } from './config.ts';\n\nexport const MCP_CREDENTIAL_PREFIX = 'mcp:';\n\nexport interface McpRecords {\n  mcp(server: string, name?: string): { placeholder: string; state?: string } | undefined;\n}\n\nasync function digest(text: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));\n  return [...new Uint8Array(bytes).slice(0, 12)]\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nexport async function credentialKey(server: string, url: string): Promise<string> {\n  return `${MCP_CREDENTIAL_PREFIX}${server}|${await digest(new URL(url).href)}`;\n}\n\nexport function secretNames(config: McpServerConfig): string[] {\n  const names = new Set<string>();\n  for (const value of Object.values(config.headers ?? {}))\n    for (const name of placeholders(value)) names.add(name);\n  return [...names];\n}\n\nexport function heldRecords(server: string, config: McpServerConfig, records: McpRecords) {\n  const names = secretNames(config);\n  if (!names.length) return [records.mcp(server)];\n  return names.map(\n    (name) => records.mcp(server, name) ?? (names.length === 1 ? records.mcp(server) : undefined)\n  );\n}\n\nexport type Resolved =\n  | { ok: true; headers: Record<string, string> }\n  | { ok: false; missing: string[] };\n\nexport function resolveHeaders(\n  server: string,\n  config: McpServerConfig,\n  records: McpRecords\n): Resolved {\n  const names = secretNames(config);\n  if (!names.length) return { ok: true, headers: { ...config.headers } };\n  const held = heldRecords(server, config, records);\n  const placeholder = (name: string) => held[names.indexOf(name)]?.placeholder;\n  const missing = names.filter((name) => !placeholder(name));\n  if (missing.length) return { ok: false, missing };\n  const headers: Record<string, string> = {};\n  for (const [header, text] of Object.entries(config.headers ?? {}))\n    headers[header] = text.replace(/\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}/g, (_, name: string) =>\n      String(placeholder(name))\n    );\n  return { ok: true, headers };\n}\n"],
+  "mappings": "AAAA,SAA+B,oBAAoB;AAE5C,MAAM,wBAAwB;AAMrC,eAAe,OAAO,MAA+B;AACnD,QAAM,QAAQ,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AAClF,SAAO,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC,EAC1C,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAEA,eAAsB,cAAc,QAAgB,KAA8B;AAChF,SAAO,GAAG,qBAAqB,GAAG,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC;AAC7E;AAEO,SAAS,YAAY,QAAmC;AAC7D,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,OAAO,OAAO,OAAO,WAAW,CAAC,CAAC;AACpD,eAAW,QAAQ,aAAa,KAAK,EAAG,OAAM,IAAI,IAAI;AACxD,SAAO,CAAC,GAAG,KAAK;AAClB;AAEO,SAAS,YAAY,QAAgB,QAAyB,SAAqB;AACxF,QAAM,QAAQ,YAAY,MAAM;AAChC,MAAI,CAAC,MAAM,OAAQ,QAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;AAC9C,SAAO,MAAM;AAAA,IACX,CAAC,SAAS,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,IAAI,MAAM,IAAI;AAAA,EACrF;AACF;AAMO,SAAS,eACd,QACA,QACA,SACU;AACV,QAAM,QAAQ,YAAY,MAAM;AAChC,MAAI,CAAC,MAAM,OAAQ,QAAO,EAAE,IAAI,MAAM,SAAS,EAAE,GAAG,OAAO,QAAQ,EAAE;AACrE,QAAM,OAAO,YAAY,QAAQ,QAAQ,OAAO;AAChD,QAAM,cAAc,CAAC,SAAiB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG;AACjE,QAAM,UAAU,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC;AACzD,MAAI,QAAQ,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ;AAChD,QAAM,UAAkC,CAAC;AACzC,aAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,WAAW,CAAC,CAAC;AAC9D,YAAQ,MAAM,IAAI,KAAK;AAAA,MAAQ;AAAA,MAAmC,CAAC,GAAG,SACpE,OAAO,YAAY,IAAI,CAAC;AAAA,IAC1B;AACF,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;",
   "names": []
 }

package/dist/memory/runtime.js

@@ -1,6 +1,7 @@
 import {
   replicatedState
 } from "@earendil-works/chord";
+import { awaitWithContext, withCancel } from "@earendil-works/chord/context";
 import { workspace } from "../scoops/service.js";
 import { MEMORY_FILE } from "./format.js";
 import { MEMORY_WRITE } from "./prompt.js";
@@ -134,6 +135,7 @@ async function attachMemory(options, connect, context) {
     const found = await listPlaces(options, using);
     const entries = [];
     for (const place of found) entries.push(...await files.entries(place, using));
+    if (using.abortSignal?.aborted) return;
     scopes.replace(
       using,
       found.map((place) => ({
@@ -144,11 +146,18 @@ async function attachMemory(options, connect, context) {
     );
     memories.replace(using, entries);
   };
-  let loading = Promise.resolve();
+  const life = withCancel(context);
+  let latest = Promise.resolve();
+  let stop = () => void 0;
   const reload = (using) => {
-    const next = loading.then(() => load(using));
-    loading = next.catch(() => void 0);
-    return next;
+    stop();
+    const run = withCancel(life.context);
+    stop = run.cancel;
+    const loading = awaitWithContext(load(run.context), run.context).catch(
+      (error) => life.context.abortSignal?.aborted || latest === loading ? Promise.reject(error) : latest
+    );
+    latest = loading;
+    return awaitWithContext(loading, using);
   };
   const parts = { options, files, memories, scopes, reload };
   connect({
@@ -203,6 +212,7 @@ async function attachMemory(options, connect, context) {
     async close(using) {
       offCones();
       clearTimeout(timer);
+      life.cancel();
       await watcher?.close(using);
     }
   };

package/dist/memory/runtime.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/memory/runtime.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  type MutableReplicatedState,\n  type ReplicatedState,\n  replicatedState,\n} from '@earendil-works/chord';\nimport type { Harness } from '@earendil-works/pi-durable';\nimport type { ExecutionEnv, FileWatcher } from '@earendil-works/pi-durable/env';\nimport type { Agents } from '../agents.ts';\nimport type { Role } from '../roles/roles.ts';\nimport { workspace } from '../scoops/service.ts';\nimport { MEMORY_FILE, type MemoryEntry, type MemoryScope, type MemoryTag } from './format.ts';\nimport type { Host } from './prompt.ts';\nimport { MEMORY_WRITE } from './prompt.ts';\nimport {\n  GLOBAL,\n  MemoryFiles,\n  memoryRoot,\n  type Place,\n  placeOf,\n  ROLE_PREFIX,\n  rolePlace,\n  roleRoot,\n} from './store.ts';\n\nexport type Answer = { code: number; out: string };\n\nexport interface MemoryDraft {\n  id?: string;\n  scope: string;\n  section: string;\n  title: string;\n  body: string;\n  tag: MemoryTag | null;\n}\n\nexport interface MemoryRuntime {\n  readonly memories: ReplicatedState<MemoryEntry[]>;\n  readonly scopes: ReplicatedState<MemoryScope[]>;\n  save(draft: MemoryDraft, context: Context): Promise<MemoryEntry>;\n  remove(id: string, context: Context): Promise<boolean>;\n  command(argv: readonly string[], caller: string | null, context: Context): Promise<Answer>;\n  reload(context: Context): Promise<void>;\n  close(context: Context): Promise<void>;\n}\n\nexport interface MemoryAttach {\n  harness: Harness;\n  agents: Agents;\n  env: ExecutionEnv;\n  home: string;\n  agentDir?: string;\n  reloadMs: number;\n  idleCheckMs?: number;\n  roles?: (context: Context) => Promise<{ roles: readonly Role[] } | undefined>;\n}\n\nexport const USAGE = `usage:\n  memory show [<scope>]   print a memory file (yours by default)\n  memory scopes           every memory scope, its entries and its file\n\nScopes: global (everyone), a cone's id, or role:<path> for a role's memory.\nAgents write memory with the ${MEMORY_WRITE} tool; the files are plain markdown you can edit.\n`;\n\ntype Listed = Place & { group?: 'cones' | 'roles'; name: string };\n\nasync function roleDirs(\n  env: ExecutionEnv,\n  dir: string,\n  prefix: string,\n  context: Context,\n  depth = 0\n): Promise<string[]> {\n  const listed = await env.listDir(dir, context);\n  if (!listed.ok || depth > 4) return [];\n  const out: string[] = [];\n  for (const info of listed.value) {\n    if (info.kind !== 'directory') continue;\n    const path = prefix ? `${prefix}/${info.name}` : info.name;\n    const found = await env.exists(`${dir}/${info.name}/${MEMORY_FILE}`, context);\n    if (found.ok && found.value) out.push(path);\n    out.push(...(await roleDirs(env, `${dir}/${info.name}`, path, context, depth + 1)));\n  }\n  return out;\n}\n\nexport async function listPlaces(options: MemoryAttach, context: Context): Promise<Listed[]> {\n  const { agents, env, home } = options;\n  const state = agents.state();\n  const out: Listed[] = [{ ...(placeOf(home, GLOBAL) as Place), name: 'Shared' }];\n  const cones = new Set(Object.keys(state.cones));\n  const stored = await env.listDir(memoryRoot(home), context);\n  if (stored.ok)\n    for (const info of stored.value) if (info.kind === 'directory') cones.add(info.name);\n  for (const id of cones) {\n    const place = placeOf(home, id);\n    if (place) out.push({ ...place, group: 'cones', name: state.cones[id]?.name ?? id });\n  }\n  const roles = new Set(await roleDirs(env, roleRoot(home), '', context));\n  const known = await options.roles?.(context).catch(() => undefined);\n  for (const role of known?.roles ?? [])\n    if (role.memory?.scope === 'user') roles.add(role.memory.path);\n  for (const path of [...roles].sort()) {\n    const place = placeOf(home, `${ROLE_PREFIX}${path}`);\n    if (place) out.push({ ...place, group: 'roles', name: path.split('/').at(-1) ?? path });\n  }\n  return out;\n}\n\nasync function callerPlace(\n  options: MemoryAttach,\n  caller: string | null,\n  context: Context\n): Promise<Place | { problem: string }> {\n  const { agents, env, home } = options;\n  const record = caller ? agents.state().scoops[caller] : undefined;\n  if (record?.memory)\n    return rolePlace(env, home, record.memory, record.origin ?? workspace(record.folder), context);\n  const cone = caller?.startsWith('cone:') ? caller.slice('cone:'.length) : agents.activeCone();\n  return placeOf(home, cone) ?? { problem: `there is no memory scope ${cone}` };\n}\n\ntype Parts = {\n  options: MemoryAttach;\n  files: MemoryFiles;\n  memories: MutableReplicatedState<MemoryEntry[]>;\n  scopes: MutableReplicatedState<MemoryScope[]>;\n  reload: (context: Context) => Promise<void>;\n};\n\nfunction placeFor(home: string, scope: string): Place {\n  const place = placeOf(home, scope);\n  if (!place) throw new Error(`there is no memory scope ${scope}`);\n  return place;\n}\n\nasync function save(parts: Parts, draft: MemoryDraft, context: Context): Promise<MemoryEntry> {\n  const { files, memories, options } = parts;\n  const place = placeFor(options.home, draft.scope);\n  const previous = draft.id ? memories.value.find((item) => item.id === draft.id) : undefined;\n  const moved = previous && previous.scope !== draft.scope;\n  try {\n    const written = await files.change(\n      place,\n      {\n        kind: 'save',\n        ...(previous && !moved ? { id: previous.id } : {}),\n        section: draft.section,\n        title: draft.title,\n        body: draft.body,\n        tag: draft.tag,\n      },\n      context\n    );\n    if (previous && moved)\n      await files.change(\n        placeFor(options.home, previous.scope),\n        { kind: 'remove', id: previous.id },\n        context\n      );\n    return written.entry as MemoryEntry;\n  } finally {\n    await parts.reload(context).catch(() => undefined);\n  }\n}\n\nasync function command(\n  parts: Parts,\n  argv: readonly string[],\n  caller: string | null,\n  context: Context\n): Promise<Answer> {\n  const { files, memories, scopes, options } = parts;\n  const verb = argv[0] ?? 'help';\n  if (verb === 'scopes') {\n    await parts.reload(context);\n    const rows = scopes.value.map((scope) => {\n      const count = memories.value.filter((item) => item.scope === scope.id).length;\n      const file = placeFor(options.home, scope.id).file;\n      return `${scope.id}\\t${scope.label}\\t${count} entr${count === 1 ? 'y' : 'ies'}\\t${file}`;\n    });\n    return { code: 0, out: `${rows.join('\\n')}\\n` };\n  }\n  if (verb !== 'show') return { code: verb === 'help' || verb === '--help' ? 0 : 2, out: USAGE };\n  const place = argv[1]\n    ? (placeOf(options.home, argv[1]) ?? { problem: `there is no memory scope ${argv[1]}` })\n    : await callerPlace(options, caller, context);\n  if ('problem' in place) return { code: 1, out: `memory: ${place.problem}\\n` };\n  const read = await files.read(place.file, context);\n  return {\n    code: 0,\n    out: read?.text.trim()\n      ? `# ${place.file}\\n\\n${read.text.trimEnd()}\\n`\n      : `${place.file} is empty\\n`,\n  };\n}\n\nexport async function attachMemory(\n  options: MemoryAttach,\n  connect: (host: Host) => void,\n  context: Context\n): Promise<MemoryRuntime> {\n  const { agents, env, home } = options;\n  const files = new MemoryFiles(env);\n  const memories = replicatedState<MemoryEntry[]>([]);\n  const scopes = replicatedState<MemoryScope[]>([]);\n  const load = async (using: Context) => {\n    const found = await listPlaces(options, using);\n    const entries: MemoryEntry[] = [];\n    for (const place of found) entries.push(...(await files.entries(place, using)));\n    scopes.replace(\n      using,\n      found.map((place) => ({\n        id: place.scope,\n        label: place.name,\n        ...(place.group ? { group: place.group } : {}),\n      }))\n    );\n    memories.replace(using, entries);\n  };\n  let loading: Promise<unknown> = Promise.resolve();\n  const reload = (using: Context) => {\n    const next = loading.then(() => load(using));\n    loading = next.catch(() => undefined);\n    return next;\n  };\n  const parts: Parts = { options, files, memories, scopes, reload };\n  connect({\n    harness: options.harness,\n    agents,\n    env,\n    home,\n    ...(options.agentDir ? { agentDir: options.agentDir } : {}),\n    files,\n    changed: reload,\n  });\n  await reload(context).catch(() => undefined);\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const schedule = () => {\n    clearTimeout(timer);\n    timer = setTimeout(() => void reload(context).catch(() => undefined), options.reloadMs);\n  };\n  const named = () =>\n    JSON.stringify(Object.entries(agents.state().cones).map(([id, cone]) => [id, cone.name]));\n  let cones = named();\n  const offCones = agents.onChange(() => {\n    const next = named();\n    if (next === cones) return;\n    cones = next;\n    schedule();\n  });\n  const watched = await env.watch(\n    [\n      { path: memoryRoot(home), recursive: true },\n      { path: roleRoot(home), recursive: true },\n    ],\n    schedule,\n    context\n  );\n  const watcher: FileWatcher | undefined = watched.ok ? watched.value : undefined;\n  return {\n    memories,\n    scopes,\n    save: (draft, using) => save(parts, draft, using),\n    async remove(id, using) {\n      const entry = memories.value.find((item) => item.id === id);\n      if (!entry) return false;\n      const written = await files.change(\n        placeFor(home, entry.scope),\n        { kind: 'remove', id },\n        using\n      );\n      await reload(using);\n      return written.found;\n    },\n    command: (argv, caller, using) => command(parts, argv, caller, using),\n    reload,\n    async close(using) {\n      offCones();\n      clearTimeout(timer);\n      await watcher?.close(using);\n    },\n  };\n}\n"],
-  "mappings": "AAAA;AAAA,EAIE;AAAA,OACK;AAKP,SAAS,iBAAiB;AAC1B,SAAS,mBAAuE;AAEhF,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAkCA,MAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,+BAKU,YAAY;AAAA;AAK3C,eAAe,SACb,KACA,KACA,QACA,SACA,QAAQ,GACW;AACnB,QAAM,SAAS,MAAM,IAAI,QAAQ,KAAK,OAAO;AAC7C,MAAI,CAAC,OAAO,MAAM,QAAQ,EAAG,QAAO,CAAC;AACrC,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO,OAAO;AAC/B,QAAI,KAAK,SAAS,YAAa;AAC/B,UAAM,OAAO,SAAS,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,KAAK;AACtD,UAAM,QAAQ,MAAM,IAAI,OAAO,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,WAAW,IAAI,OAAO;AAC5E,QAAI,MAAM,MAAM,MAAM,MAAO,KAAI,KAAK,IAAI;AAC1C,QAAI,KAAK,GAAI,MAAM,SAAS,KAAK,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,SAAS,QAAQ,CAAC,CAAE;AAAA,EACpF;AACA,SAAO;AACT;AAEA,eAAsB,WAAW,SAAuB,SAAqC;AAC3F,QAAM,EAAE,QAAQ,KAAK,KAAK,IAAI;AAC9B,QAAM,QAAQ,OAAO,MAAM;AAC3B,QAAM,MAAgB,CAAC,EAAE,GAAI,QAAQ,MAAM,MAAM,GAAa,MAAM,SAAS,CAAC;AAC9E,QAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,MAAM,KAAK,CAAC;AAC9C,QAAM,SAAS,MAAM,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;AAC1D,MAAI,OAAO;AACT,eAAW,QAAQ,OAAO,MAAO,KAAI,KAAK,SAAS,YAAa,OAAM,IAAI,KAAK,IAAI;AAAA;AACrF,aAAW,MAAM,OAAO;AACtB,UAAM,QAAQ,QAAQ,MAAM,EAAE;AAC9B,QAAI,MAAO,KAAI,KAAK,EAAE,GAAG,OAAO,OAAO,SAAS,MAAM,MAAM,MAAM,EAAE,GAAG,QAAQ,GAAG,CAAC;AAAA,EACrF;AACA,QAAM,QAAQ,IAAI,IAAI,MAAM,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC;AACtE,QAAM,QAAQ,MAAM,QAAQ,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AAClE,aAAW,QAAQ,OAAO,SAAS,CAAC;AAClC,QAAI,KAAK,QAAQ,UAAU,OAAQ,OAAM,IAAI,KAAK,OAAO,IAAI;AAC/D,aAAW,QAAQ,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG;AACpC,UAAM,QAAQ,QAAQ,MAAM,GAAG,WAAW,GAAG,IAAI,EAAE;AACnD,QAAI,MAAO,KAAI,KAAK,EAAE,GAAG,OAAO,OAAO,SAAS,MAAM,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAEA,eAAe,YACb,SACA,QACA,SACsC;AACtC,QAAM,EAAE,QAAQ,KAAK,KAAK,IAAI;AAC9B,QAAM,SAAS,SAAS,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI;AACxD,MAAI,QAAQ;AACV,WAAO,UAAU,KAAK,MAAM,OAAO,QAAQ,OAAO,UAAU,UAAU,OAAO,MAAM,GAAG,OAAO;AAC/F,QAAM,OAAO,QAAQ,WAAW,OAAO,IAAI,OAAO,MAAM,QAAQ,MAAM,IAAI,OAAO,WAAW;AAC5F,SAAO,QAAQ,MAAM,IAAI,KAAK,EAAE,SAAS,4BAA4B,IAAI,GAAG;AAC9E;AAUA,SAAS,SAAS,MAAc,OAAsB;AACpD,QAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4BAA4B,KAAK,EAAE;AAC/D,SAAO;AACT;AAEA,eAAe,KAAK,OAAc,OAAoB,SAAwC;AAC5F,QAAM,EAAE,OAAO,UAAU,QAAQ,IAAI;AACrC,QAAM,QAAQ,SAAS,QAAQ,MAAM,MAAM,KAAK;AAChD,QAAM,WAAW,MAAM,KAAK,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM,EAAE,IAAI;AAClF,QAAM,QAAQ,YAAY,SAAS,UAAU,MAAM;AACnD,MAAI;AACF,UAAM,UAAU,MAAM,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,GAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,SAAS,GAAG,IAAI,CAAC;AAAA,QAChD,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,KAAK,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF;AACA,QAAI,YAAY;AACd,YAAM,MAAM;AAAA,QACV,SAAS,QAAQ,MAAM,SAAS,KAAK;AAAA,QACrC,EAAE,MAAM,UAAU,IAAI,SAAS,GAAG;AAAA,QAClC;AAAA,MACF;AACF,WAAO,QAAQ;AAAA,EACjB,UAAE;AACA,UAAM,MAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD;AACF;AAEA,eAAe,QACb,OACA,MACA,QACA,SACiB;AACjB,QAAM,EAAE,OAAO,UAAU,QAAQ,QAAQ,IAAI;AAC7C,QAAM,OAAO,KAAK,CAAC,KAAK;AACxB,MAAI,SAAS,UAAU;AACrB,UAAM,MAAM,OAAO,OAAO;AAC1B,UAAM,OAAO,OAAO,MAAM,IAAI,CAAC,UAAU;AACvC,YAAM,QAAQ,SAAS,MAAM,OAAO,CAAC,SAAS,KAAK,UAAU,MAAM,EAAE,EAAE;AACvE,YAAM,OAAO,SAAS,QAAQ,MAAM,MAAM,EAAE,EAAE;AAC9C,aAAO,GAAG,MAAM,EAAE,IAAK,MAAM,KAAK,IAAK,KAAK,QAAQ,UAAU,IAAI,MAAM,KAAK,IAAK,IAAI;AAAA,IACxF,CAAC;AACD,WAAO,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,KAAK,IAAI,CAAC;AAAA,EAAK;AAAA,EAChD;AACA,MAAI,SAAS,OAAQ,QAAO,EAAE,MAAM,SAAS,UAAU,SAAS,WAAW,IAAI,GAAG,KAAK,MAAM;AAC7F,QAAM,QAAQ,KAAK,CAAC,IACf,QAAQ,QAAQ,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,SAAS,4BAA4B,KAAK,CAAC,CAAC,GAAG,IACpF,MAAM,YAAY,SAAS,QAAQ,OAAO;AAC9C,MAAI,aAAa,MAAO,QAAO,EAAE,MAAM,GAAG,KAAK,WAAW,MAAM,OAAO;AAAA,EAAK;AAC5E,QAAM,OAAO,MAAM,MAAM,KAAK,MAAM,MAAM,OAAO;AACjD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,KAAK,MAAM,KAAK,KAAK,IACjB,KAAK,MAAM,IAAI;AAAA;AAAA,EAAO,KAAK,KAAK,QAAQ,CAAC;AAAA,IACzC,GAAG,MAAM,IAAI;AAAA;AAAA,EACnB;AACF;AAEA,eAAsB,aACpB,SACA,SACA,SACwB;AACxB,QAAM,EAAE,QAAQ,KAAK,KAAK,IAAI;AAC9B,QAAM,QAAQ,IAAI,YAAY,GAAG;AACjC,QAAM,WAAW,gBAA+B,CAAC,CAAC;AAClD,QAAM,SAAS,gBAA+B,CAAC,CAAC;AAChD,QAAM,OAAO,OAAO,UAAmB;AACrC,UAAM,QAAQ,MAAM,WAAW,SAAS,KAAK;AAC7C,UAAM,UAAyB,CAAC;AAChC,eAAW,SAAS,MAAO,SAAQ,KAAK,GAAI,MAAM,MAAM,QAAQ,OAAO,KAAK,CAAE;AAC9E,WAAO;AAAA,MACL;AAAA,MACA,MAAM,IAAI,CAAC,WAAW;AAAA,QACpB,IAAI,MAAM;AAAA,QACV,OAAO,MAAM;AAAA,QACb,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C,EAAE;AAAA,IACJ;AACA,aAAS,QAAQ,OAAO,OAAO;AAAA,EACjC;AACA,MAAI,UAA4B,QAAQ,QAAQ;AAChD,QAAM,SAAS,CAAC,UAAmB;AACjC,UAAM,OAAO,QAAQ,KAAK,MAAM,KAAK,KAAK,CAAC;AAC3C,cAAU,KAAK,MAAM,MAAM,MAAS;AACpC,WAAO;AAAA,EACT;AACA,QAAM,QAAe,EAAE,SAAS,OAAO,UAAU,QAAQ,OAAO;AAChE,UAAQ;AAAA,IACN,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AACD,QAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,MAAI;AACJ,QAAM,WAAW,MAAM;AACrB,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS,GAAG,QAAQ,QAAQ;AAAA,EACxF;AACA,QAAM,QAAQ,MACZ,KAAK,UAAU,OAAO,QAAQ,OAAO,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC1F,MAAI,QAAQ,MAAM;AAClB,QAAM,WAAW,OAAO,SAAS,MAAM;AACrC,UAAM,OAAO,MAAM;AACnB,QAAI,SAAS,MAAO;AACpB,YAAQ;AACR,aAAS;AAAA,EACX,CAAC;AACD,QAAM,UAAU,MAAM,IAAI;AAAA,IACxB;AAAA,MACE,EAAE,MAAM,WAAW,IAAI,GAAG,WAAW,KAAK;AAAA,MAC1C,EAAE,MAAM,SAAS,IAAI,GAAG,WAAW,KAAK;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAmC,QAAQ,KAAK,QAAQ,QAAQ;AACtE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,CAAC,OAAO,UAAU,KAAK,OAAO,OAAO,KAAK;AAAA,IAChD,MAAM,OAAO,IAAI,OAAO;AACtB,YAAM,QAAQ,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE;AAC1D,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,UAAU,MAAM,MAAM;AAAA,QAC1B,SAAS,MAAM,MAAM,KAAK;AAAA,QAC1B,EAAE,MAAM,UAAU,GAAG;AAAA,QACrB;AAAA,MACF;AACA,YAAM,OAAO,KAAK;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,SAAS,CAAC,MAAM,QAAQ,UAAU,QAAQ,OAAO,MAAM,QAAQ,KAAK;AAAA,IACpE;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,eAAS;AACT,mBAAa,KAAK;AAClB,YAAM,SAAS,MAAM,KAAK;AAAA,IAC5B;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  type Context,\n  type MutableReplicatedState,\n  type ReplicatedState,\n  replicatedState,\n} from '@earendil-works/chord';\nimport { awaitWithContext, withCancel } from '@earendil-works/chord/context';\nimport type { Harness } from '@earendil-works/pi-durable';\nimport type { ExecutionEnv, FileWatcher } from '@earendil-works/pi-durable/env';\nimport type { Agents } from '../agents.ts';\nimport type { Role } from '../roles/roles.ts';\nimport { workspace } from '../scoops/service.ts';\nimport { MEMORY_FILE, type MemoryEntry, type MemoryScope, type MemoryTag } from './format.ts';\nimport type { Host } from './prompt.ts';\nimport { MEMORY_WRITE } from './prompt.ts';\nimport {\n  GLOBAL,\n  MemoryFiles,\n  memoryRoot,\n  type Place,\n  placeOf,\n  ROLE_PREFIX,\n  rolePlace,\n  roleRoot,\n} from './store.ts';\n\nexport type Answer = { code: number; out: string };\n\nexport interface MemoryDraft {\n  id?: string;\n  scope: string;\n  section: string;\n  title: string;\n  body: string;\n  tag: MemoryTag | null;\n}\n\nexport interface MemoryRuntime {\n  readonly memories: ReplicatedState<MemoryEntry[]>;\n  readonly scopes: ReplicatedState<MemoryScope[]>;\n  save(draft: MemoryDraft, context: Context): Promise<MemoryEntry>;\n  remove(id: string, context: Context): Promise<boolean>;\n  command(argv: readonly string[], caller: string | null, context: Context): Promise<Answer>;\n  reload(context: Context): Promise<void>;\n  close(context: Context): Promise<void>;\n}\n\nexport interface MemoryAttach {\n  harness: Harness;\n  agents: Agents;\n  env: ExecutionEnv;\n  home: string;\n  agentDir?: string;\n  reloadMs: number;\n  idleCheckMs?: number;\n  roles?: (context: Context) => Promise<{ roles: readonly Role[] } | undefined>;\n}\n\nexport const USAGE = `usage:\n  memory show [<scope>]   print a memory file (yours by default)\n  memory scopes           every memory scope, its entries and its file\n\nScopes: global (everyone), a cone's id, or role:<path> for a role's memory.\nAgents write memory with the ${MEMORY_WRITE} tool; the files are plain markdown you can edit.\n`;\n\ntype Listed = Place & { group?: 'cones' | 'roles'; name: string };\n\nasync function roleDirs(\n  env: ExecutionEnv,\n  dir: string,\n  prefix: string,\n  context: Context,\n  depth = 0\n): Promise<string[]> {\n  const listed = await env.listDir(dir, context);\n  if (!listed.ok || depth > 4) return [];\n  const out: string[] = [];\n  for (const info of listed.value) {\n    if (info.kind !== 'directory') continue;\n    const path = prefix ? `${prefix}/${info.name}` : info.name;\n    const found = await env.exists(`${dir}/${info.name}/${MEMORY_FILE}`, context);\n    if (found.ok && found.value) out.push(path);\n    out.push(...(await roleDirs(env, `${dir}/${info.name}`, path, context, depth + 1)));\n  }\n  return out;\n}\n\nexport async function listPlaces(options: MemoryAttach, context: Context): Promise<Listed[]> {\n  const { agents, env, home } = options;\n  const state = agents.state();\n  const out: Listed[] = [{ ...(placeOf(home, GLOBAL) as Place), name: 'Shared' }];\n  const cones = new Set(Object.keys(state.cones));\n  const stored = await env.listDir(memoryRoot(home), context);\n  if (stored.ok)\n    for (const info of stored.value) if (info.kind === 'directory') cones.add(info.name);\n  for (const id of cones) {\n    const place = placeOf(home, id);\n    if (place) out.push({ ...place, group: 'cones', name: state.cones[id]?.name ?? id });\n  }\n  const roles = new Set(await roleDirs(env, roleRoot(home), '', context));\n  const known = await options.roles?.(context).catch(() => undefined);\n  for (const role of known?.roles ?? [])\n    if (role.memory?.scope === 'user') roles.add(role.memory.path);\n  for (const path of [...roles].sort()) {\n    const place = placeOf(home, `${ROLE_PREFIX}${path}`);\n    if (place) out.push({ ...place, group: 'roles', name: path.split('/').at(-1) ?? path });\n  }\n  return out;\n}\n\nasync function callerPlace(\n  options: MemoryAttach,\n  caller: string | null,\n  context: Context\n): Promise<Place | { problem: string }> {\n  const { agents, env, home } = options;\n  const record = caller ? agents.state().scoops[caller] : undefined;\n  if (record?.memory)\n    return rolePlace(env, home, record.memory, record.origin ?? workspace(record.folder), context);\n  const cone = caller?.startsWith('cone:') ? caller.slice('cone:'.length) : agents.activeCone();\n  return placeOf(home, cone) ?? { problem: `there is no memory scope ${cone}` };\n}\n\ntype Parts = {\n  options: MemoryAttach;\n  files: MemoryFiles;\n  memories: MutableReplicatedState<MemoryEntry[]>;\n  scopes: MutableReplicatedState<MemoryScope[]>;\n  reload: (context: Context) => Promise<void>;\n};\n\nfunction placeFor(home: string, scope: string): Place {\n  const place = placeOf(home, scope);\n  if (!place) throw new Error(`there is no memory scope ${scope}`);\n  return place;\n}\n\nasync function save(parts: Parts, draft: MemoryDraft, context: Context): Promise<MemoryEntry> {\n  const { files, memories, options } = parts;\n  const place = placeFor(options.home, draft.scope);\n  const previous = draft.id ? memories.value.find((item) => item.id === draft.id) : undefined;\n  const moved = previous && previous.scope !== draft.scope;\n  try {\n    const written = await files.change(\n      place,\n      {\n        kind: 'save',\n        ...(previous && !moved ? { id: previous.id } : {}),\n        section: draft.section,\n        title: draft.title,\n        body: draft.body,\n        tag: draft.tag,\n      },\n      context\n    );\n    if (previous && moved)\n      await files.change(\n        placeFor(options.home, previous.scope),\n        { kind: 'remove', id: previous.id },\n        context\n      );\n    return written.entry as MemoryEntry;\n  } finally {\n    await parts.reload(context).catch(() => undefined);\n  }\n}\n\nasync function command(\n  parts: Parts,\n  argv: readonly string[],\n  caller: string | null,\n  context: Context\n): Promise<Answer> {\n  const { files, memories, scopes, options } = parts;\n  const verb = argv[0] ?? 'help';\n  if (verb === 'scopes') {\n    await parts.reload(context);\n    const rows = scopes.value.map((scope) => {\n      const count = memories.value.filter((item) => item.scope === scope.id).length;\n      const file = placeFor(options.home, scope.id).file;\n      return `${scope.id}\\t${scope.label}\\t${count} entr${count === 1 ? 'y' : 'ies'}\\t${file}`;\n    });\n    return { code: 0, out: `${rows.join('\\n')}\\n` };\n  }\n  if (verb !== 'show') return { code: verb === 'help' || verb === '--help' ? 0 : 2, out: USAGE };\n  const place = argv[1]\n    ? (placeOf(options.home, argv[1]) ?? { problem: `there is no memory scope ${argv[1]}` })\n    : await callerPlace(options, caller, context);\n  if ('problem' in place) return { code: 1, out: `memory: ${place.problem}\\n` };\n  const read = await files.read(place.file, context);\n  return {\n    code: 0,\n    out: read?.text.trim()\n      ? `# ${place.file}\\n\\n${read.text.trimEnd()}\\n`\n      : `${place.file} is empty\\n`,\n  };\n}\n\nexport async function attachMemory(\n  options: MemoryAttach,\n  connect: (host: Host) => void,\n  context: Context\n): Promise<MemoryRuntime> {\n  const { agents, env, home } = options;\n  const files = new MemoryFiles(env);\n  const memories = replicatedState<MemoryEntry[]>([]);\n  const scopes = replicatedState<MemoryScope[]>([]);\n  const load = async (using: Context) => {\n    const found = await listPlaces(options, using);\n    const entries: MemoryEntry[] = [];\n    for (const place of found) entries.push(...(await files.entries(place, using)));\n    if (using.abortSignal?.aborted) return;\n    scopes.replace(\n      using,\n      found.map((place) => ({\n        id: place.scope,\n        label: place.name,\n        ...(place.group ? { group: place.group } : {}),\n      }))\n    );\n    memories.replace(using, entries);\n  };\n  const life = withCancel(context);\n  let latest: Promise<void> = Promise.resolve();\n  let stop: (reason?: unknown) => void = () => undefined;\n  const reload = (using: Context) => {\n    stop();\n    const run = withCancel(life.context);\n    stop = run.cancel;\n    const loading: Promise<void> = awaitWithContext(load(run.context), run.context).catch(\n      (error: unknown) =>\n        life.context.abortSignal?.aborted || latest === loading ? Promise.reject(error) : latest\n    );\n    latest = loading;\n    return awaitWithContext(loading, using);\n  };\n  const parts: Parts = { options, files, memories, scopes, reload };\n  connect({\n    harness: options.harness,\n    agents,\n    env,\n    home,\n    ...(options.agentDir ? { agentDir: options.agentDir } : {}),\n    files,\n    changed: reload,\n  });\n  await reload(context).catch(() => undefined);\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const schedule = () => {\n    clearTimeout(timer);\n    timer = setTimeout(() => void reload(context).catch(() => undefined), options.reloadMs);\n  };\n  const named = () =>\n    JSON.stringify(Object.entries(agents.state().cones).map(([id, cone]) => [id, cone.name]));\n  let cones = named();\n  const offCones = agents.onChange(() => {\n    const next = named();\n    if (next === cones) return;\n    cones = next;\n    schedule();\n  });\n  const watched = await env.watch(\n    [\n      { path: memoryRoot(home), recursive: true },\n      { path: roleRoot(home), recursive: true },\n    ],\n    schedule,\n    context\n  );\n  const watcher: FileWatcher | undefined = watched.ok ? watched.value : undefined;\n  return {\n    memories,\n    scopes,\n    save: (draft, using) => save(parts, draft, using),\n    async remove(id, using) {\n      const entry = memories.value.find((item) => item.id === id);\n      if (!entry) return false;\n      const written = await files.change(\n        placeFor(home, entry.scope),\n        { kind: 'remove', id },\n        using\n      );\n      await reload(using);\n      return written.found;\n    },\n    command: (argv, caller, using) => command(parts, argv, caller, using),\n    reload,\n    async close(using) {\n      offCones();\n      clearTimeout(timer);\n      life.cancel();\n      await watcher?.close(using);\n    },\n  };\n}\n"],
+  "mappings": "AAAA;AAAA,EAIE;AAAA,OACK;AACP,SAAS,kBAAkB,kBAAkB;AAK7C,SAAS,iBAAiB;AAC1B,SAAS,mBAAuE;AAEhF,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAkCA,MAAM,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,+BAKU,YAAY;AAAA;AAK3C,eAAe,SACb,KACA,KACA,QACA,SACA,QAAQ,GACW;AACnB,QAAM,SAAS,MAAM,IAAI,QAAQ,KAAK,OAAO;AAC7C,MAAI,CAAC,OAAO,MAAM,QAAQ,EAAG,QAAO,CAAC;AACrC,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO,OAAO;AAC/B,QAAI,KAAK,SAAS,YAAa;AAC/B,UAAM,OAAO,SAAS,GAAG,MAAM,IAAI,KAAK,IAAI,KAAK,KAAK;AACtD,UAAM,QAAQ,MAAM,IAAI,OAAO,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,WAAW,IAAI,OAAO;AAC5E,QAAI,MAAM,MAAM,MAAM,MAAO,KAAI,KAAK,IAAI;AAC1C,QAAI,KAAK,GAAI,MAAM,SAAS,KAAK,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,SAAS,QAAQ,CAAC,CAAE;AAAA,EACpF;AACA,SAAO;AACT;AAEA,eAAsB,WAAW,SAAuB,SAAqC;AAC3F,QAAM,EAAE,QAAQ,KAAK,KAAK,IAAI;AAC9B,QAAM,QAAQ,OAAO,MAAM;AAC3B,QAAM,MAAgB,CAAC,EAAE,GAAI,QAAQ,MAAM,MAAM,GAAa,MAAM,SAAS,CAAC;AAC9E,QAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,MAAM,KAAK,CAAC;AAC9C,QAAM,SAAS,MAAM,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;AAC1D,MAAI,OAAO;AACT,eAAW,QAAQ,OAAO,MAAO,KAAI,KAAK,SAAS,YAAa,OAAM,IAAI,KAAK,IAAI;AAAA;AACrF,aAAW,MAAM,OAAO;AACtB,UAAM,QAAQ,QAAQ,MAAM,EAAE;AAC9B,QAAI,MAAO,KAAI,KAAK,EAAE,GAAG,OAAO,OAAO,SAAS,MAAM,MAAM,MAAM,EAAE,GAAG,QAAQ,GAAG,CAAC;AAAA,EACrF;AACA,QAAM,QAAQ,IAAI,IAAI,MAAM,SAAS,KAAK,SAAS,IAAI,GAAG,IAAI,OAAO,CAAC;AACtE,QAAM,QAAQ,MAAM,QAAQ,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AAClE,aAAW,QAAQ,OAAO,SAAS,CAAC;AAClC,QAAI,KAAK,QAAQ,UAAU,OAAQ,OAAM,IAAI,KAAK,OAAO,IAAI;AAC/D,aAAW,QAAQ,CAAC,GAAG,KAAK,EAAE,KAAK,GAAG;AACpC,UAAM,QAAQ,QAAQ,MAAM,GAAG,WAAW,GAAG,IAAI,EAAE;AACnD,QAAI,MAAO,KAAI,KAAK,EAAE,GAAG,OAAO,OAAO,SAAS,MAAM,KAAK,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,KAAK,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAEA,eAAe,YACb,SACA,QACA,SACsC;AACtC,QAAM,EAAE,QAAQ,KAAK,KAAK,IAAI;AAC9B,QAAM,SAAS,SAAS,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI;AACxD,MAAI,QAAQ;AACV,WAAO,UAAU,KAAK,MAAM,OAAO,QAAQ,OAAO,UAAU,UAAU,OAAO,MAAM,GAAG,OAAO;AAC/F,QAAM,OAAO,QAAQ,WAAW,OAAO,IAAI,OAAO,MAAM,QAAQ,MAAM,IAAI,OAAO,WAAW;AAC5F,SAAO,QAAQ,MAAM,IAAI,KAAK,EAAE,SAAS,4BAA4B,IAAI,GAAG;AAC9E;AAUA,SAAS,SAAS,MAAc,OAAsB;AACpD,QAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,4BAA4B,KAAK,EAAE;AAC/D,SAAO;AACT;AAEA,eAAe,KAAK,OAAc,OAAoB,SAAwC;AAC5F,QAAM,EAAE,OAAO,UAAU,QAAQ,IAAI;AACrC,QAAM,QAAQ,SAAS,QAAQ,MAAM,MAAM,KAAK;AAChD,QAAM,WAAW,MAAM,KAAK,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,MAAM,EAAE,IAAI;AAClF,QAAM,QAAQ,YAAY,SAAS,UAAU,MAAM;AACnD,MAAI;AACF,UAAM,UAAU,MAAM,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,GAAI,YAAY,CAAC,QAAQ,EAAE,IAAI,SAAS,GAAG,IAAI,CAAC;AAAA,QAChD,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,QACb,MAAM,MAAM;AAAA,QACZ,KAAK,MAAM;AAAA,MACb;AAAA,MACA;AAAA,IACF;AACA,QAAI,YAAY;AACd,YAAM,MAAM;AAAA,QACV,SAAS,QAAQ,MAAM,SAAS,KAAK;AAAA,QACrC,EAAE,MAAM,UAAU,IAAI,SAAS,GAAG;AAAA,QAClC;AAAA,MACF;AACF,WAAO,QAAQ;AAAA,EACjB,UAAE;AACA,UAAM,MAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACnD;AACF;AAEA,eAAe,QACb,OACA,MACA,QACA,SACiB;AACjB,QAAM,EAAE,OAAO,UAAU,QAAQ,QAAQ,IAAI;AAC7C,QAAM,OAAO,KAAK,CAAC,KAAK;AACxB,MAAI,SAAS,UAAU;AACrB,UAAM,MAAM,OAAO,OAAO;AAC1B,UAAM,OAAO,OAAO,MAAM,IAAI,CAAC,UAAU;AACvC,YAAM,QAAQ,SAAS,MAAM,OAAO,CAAC,SAAS,KAAK,UAAU,MAAM,EAAE,EAAE;AACvE,YAAM,OAAO,SAAS,QAAQ,MAAM,MAAM,EAAE,EAAE;AAC9C,aAAO,GAAG,MAAM,EAAE,IAAK,MAAM,KAAK,IAAK,KAAK,QAAQ,UAAU,IAAI,MAAM,KAAK,IAAK,IAAI;AAAA,IACxF,CAAC;AACD,WAAO,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,KAAK,IAAI,CAAC;AAAA,EAAK;AAAA,EAChD;AACA,MAAI,SAAS,OAAQ,QAAO,EAAE,MAAM,SAAS,UAAU,SAAS,WAAW,IAAI,GAAG,KAAK,MAAM;AAC7F,QAAM,QAAQ,KAAK,CAAC,IACf,QAAQ,QAAQ,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,SAAS,4BAA4B,KAAK,CAAC,CAAC,GAAG,IACpF,MAAM,YAAY,SAAS,QAAQ,OAAO;AAC9C,MAAI,aAAa,MAAO,QAAO,EAAE,MAAM,GAAG,KAAK,WAAW,MAAM,OAAO;AAAA,EAAK;AAC5E,QAAM,OAAO,MAAM,MAAM,KAAK,MAAM,MAAM,OAAO;AACjD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,KAAK,MAAM,KAAK,KAAK,IACjB,KAAK,MAAM,IAAI;AAAA;AAAA,EAAO,KAAK,KAAK,QAAQ,CAAC;AAAA,IACzC,GAAG,MAAM,IAAI;AAAA;AAAA,EACnB;AACF;AAEA,eAAsB,aACpB,SACA,SACA,SACwB;AACxB,QAAM,EAAE,QAAQ,KAAK,KAAK,IAAI;AAC9B,QAAM,QAAQ,IAAI,YAAY,GAAG;AACjC,QAAM,WAAW,gBAA+B,CAAC,CAAC;AAClD,QAAM,SAAS,gBAA+B,CAAC,CAAC;AAChD,QAAM,OAAO,OAAO,UAAmB;AACrC,UAAM,QAAQ,MAAM,WAAW,SAAS,KAAK;AAC7C,UAAM,UAAyB,CAAC;AAChC,eAAW,SAAS,MAAO,SAAQ,KAAK,GAAI,MAAM,MAAM,QAAQ,OAAO,KAAK,CAAE;AAC9E,QAAI,MAAM,aAAa,QAAS;AAChC,WAAO;AAAA,MACL;AAAA,MACA,MAAM,IAAI,CAAC,WAAW;AAAA,QACpB,IAAI,MAAM;AAAA,QACV,OAAO,MAAM;AAAA,QACb,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC9C,EAAE;AAAA,IACJ;AACA,aAAS,QAAQ,OAAO,OAAO;AAAA,EACjC;AACA,QAAM,OAAO,WAAW,OAAO;AAC/B,MAAI,SAAwB,QAAQ,QAAQ;AAC5C,MAAI,OAAmC,MAAM;AAC7C,QAAM,SAAS,CAAC,UAAmB;AACjC,SAAK;AACL,UAAM,MAAM,WAAW,KAAK,OAAO;AACnC,WAAO,IAAI;AACX,UAAM,UAAyB,iBAAiB,KAAK,IAAI,OAAO,GAAG,IAAI,OAAO,EAAE;AAAA,MAC9E,CAAC,UACC,KAAK,QAAQ,aAAa,WAAW,WAAW,UAAU,QAAQ,OAAO,KAAK,IAAI;AAAA,IACtF;AACA,aAAS;AACT,WAAO,iBAAiB,SAAS,KAAK;AAAA,EACxC;AACA,QAAM,QAAe,EAAE,SAAS,OAAO,UAAU,QAAQ,OAAO;AAChE,UAAQ;AAAA,IACN,SAAS,QAAQ;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACzD;AAAA,IACA,SAAS;AAAA,EACX,CAAC;AACD,QAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,MAAI;AACJ,QAAM,WAAW,MAAM;AACrB,iBAAa,KAAK;AAClB,YAAQ,WAAW,MAAM,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS,GAAG,QAAQ,QAAQ;AAAA,EACxF;AACA,QAAM,QAAQ,MACZ,KAAK,UAAU,OAAO,QAAQ,OAAO,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC1F,MAAI,QAAQ,MAAM;AAClB,QAAM,WAAW,OAAO,SAAS,MAAM;AACrC,UAAM,OAAO,MAAM;AACnB,QAAI,SAAS,MAAO;AACpB,YAAQ;AACR,aAAS;AAAA,EACX,CAAC;AACD,QAAM,UAAU,MAAM,IAAI;AAAA,IACxB;AAAA,MACE,EAAE,MAAM,WAAW,IAAI,GAAG,WAAW,KAAK;AAAA,MAC1C,EAAE,MAAM,SAAS,IAAI,GAAG,WAAW,KAAK;AAAA,IAC1C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAmC,QAAQ,KAAK,QAAQ,QAAQ;AACtE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,CAAC,OAAO,UAAU,KAAK,OAAO,OAAO,KAAK;AAAA,IAChD,MAAM,OAAO,IAAI,OAAO;AACtB,YAAM,QAAQ,SAAS,MAAM,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE;AAC1D,UAAI,CAAC,MAAO,QAAO;AACnB,YAAM,UAAU,MAAM,MAAM;AAAA,QAC1B,SAAS,MAAM,MAAM,KAAK;AAAA,QAC1B,EAAE,MAAM,UAAU,GAAG;AAAA,QACrB;AAAA,MACF;AACA,YAAM,OAAO,KAAK;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,SAAS,CAAC,MAAM,QAAQ,UAAU,QAAQ,OAAO,MAAM,QAAQ,KAAK;AAAA,IACpE;AAAA,IACA,MAAM,MAAM,OAAO;AACjB,eAAS;AACT,mBAAa,KAAK;AAClB,WAAK,OAAO;AACZ,YAAM,SAAS,MAAM,KAAK;AAAA,IAC5B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/secrets/fetch.js

@@ -83,13 +83,14 @@ async function through(op, inner, request) {
     await response.body?.cancel().catch(() => void 0);
   }
 }
-function vaultFetch(vault, inner, route) {
+function vaultFetch(vault, inner, route, rejecting = () => () => void 0) {
   return async (input, init) => {
     const request = new Request(input, init);
     const provider = absent(vault) ? void 0 : route(request);
     if (provider === void 0) return inner(request);
     const target = provider === null ? void 0 : { provider };
-    return through(
+    const rejected = provider === null ? void 0 : rejecting(provider);
+    const response = await through(
       {
         prepare: (outgoing2) => vault.model(provider ?? void 0, outgoing2),
         ...target ? { refresh: () => vault.refresh(target) } : {}
@@ -97,6 +98,8 @@ function vaultFetch(vault, inner, route) {
       inner,
       request
     );
+    if (response.status === 401) rejected?.();
+    return response;
   };
 }
 function mcpFetch(vault, inner, server) {

package/dist/secrets/fetch.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/secrets/fetch.ts"],
-  "sourcesContent": ["import type { OAuthConfig, OutgoingRequest } from '@ai-ecoverse/slicc-vault';\nimport { type RefreshTarget, type Vault, VaultRefusal } from './vault.ts';\n\ntype Fetch = typeof fetch;\n\ntype Port = Pick<Vault, 'connected' | 'needed' | 'model' | 'mcp' | 'refresh' | 'grant'>;\n\nexport type ModelRoute = (request: Request) => string | null | undefined;\n\ninterface Op {\n  prepare(request: OutgoingRequest): Promise<OutgoingRequest>;\n  refresh?(): Promise<unknown>;\n}\n\nconst BODYLESS = new Set(['GET', 'HEAD']);\nconst MIN_PART = 8;\n\nexport function absent(vault: Pick<Vault, 'connected' | 'needed'>): boolean {\n  return !vault.connected && !vault.needed;\n}\n\nasync function outgoing(request: Request): Promise<OutgoingRequest> {\n  const body = BODYLESS.has(request.method)\n    ? undefined\n    : new Uint8Array(await request.arrayBuffer());\n  return {\n    method: request.method,\n    url: request.url,\n    headers: [...request.headers],\n    ...(body ? { body } : {}),\n  };\n}\n\nexport function refusal(error: unknown): Response {\n  const code = error instanceof VaultRefusal ? error.code : undefined;\n  const status = code === 'EACCES' ? 403 : code === 'EINVAL' ? 400 : 503;\n  const text = error instanceof Error ? error.message : String(error);\n  return new Response(text, {\n    status,\n    headers: { 'content-type': 'text/plain; charset=utf-8' },\n  });\n}\n\nasync function prepared(op: Op, request: OutgoingRequest): Promise<OutgoingRequest> {\n  try {\n    return await op.prepare(request);\n  } catch (error) {\n    if (error instanceof VaultRefusal && error.code === 'EAGAIN') return op.prepare(request);\n    throw error;\n  }\n}\n\nfunction filled(original: OutgoingRequest, ready: OutgoingRequest): string[] {\n  const sent = new Set(original.headers.map(([, value]) => value));\n  const values = ready.headers.map(([, value]) => value).filter((value) => !sent.has(value));\n  if (ready.url !== original.url) values.push(ready.url, decodeURIComponent(ready.url));\n  return values.flatMap((value) => [\n    value,\n    ...value.split(/[\\s=&?]+/).filter((part) => part.length >= MIN_PART),\n  ]);\n}\n\nexport function safeError(error: unknown, original: OutgoingRequest, ready: OutgoingRequest) {\n  if (\n    error instanceof DOMException &&\n    (error.name === 'AbortError' || error.name === 'TimeoutError')\n  )\n    return error;\n  const text = error instanceof Error ? error.message : String(error);\n  const parts = filled(original, ready);\n  const shown = parts.some((part) => text.includes(part)) ? 'the request failed' : text;\n  return new TypeError(`${ready.method} ${new URL(ready.url).origin}: ${shown}`);\n}\n\nasync function sent(\n  inner: Fetch,\n  request: Request,\n  original: OutgoingRequest,\n  ready: OutgoingRequest\n) {\n  const init: RequestInit = {\n    method: ready.method,\n    headers: ready.headers,\n    signal: request.signal,\n    redirect: request.redirect,\n    credentials: request.credentials,\n    ...(ready.body === undefined ? {} : { body: ready.body as BodyInit }),\n  };\n  try {\n    return await inner(ready.url, init);\n  } catch (error) {\n    throw safeError(error, original, ready);\n  }\n}\n\nasync function through(op: Op, inner: Fetch, request: Request): Promise<Response> {\n  const original = await outgoing(request);\n  let refreshed = false;\n  for (;;) {\n    let ready: OutgoingRequest;\n    try {\n      ready = await prepared(op, original);\n    } catch (error) {\n      return refusal(error);\n    }\n    const response = await sent(inner, request, original, ready);\n    if (response.status !== 401 || refreshed || !op.refresh) return response;\n    refreshed = true;\n    if (\n      !(await op.refresh().then(\n        () => true,\n        () => false\n      ))\n    )\n      return response;\n    await response.body?.cancel().catch(() => undefined);\n  }\n}\n\nexport function vaultFetch(vault: Port, inner: Fetch, route: ModelRoute): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const provider = absent(vault) ? undefined : route(request);\n    if (provider === undefined) return inner(request);\n    const target: RefreshTarget | undefined = provider === null ? undefined : { provider };\n    return through(\n      {\n        prepare: (outgoing) => vault.model(provider ?? undefined, outgoing),\n        ...(target ? { refresh: () => vault.refresh(target) } : {}),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport function mcpFetch(vault: Port, inner: Fetch, server: string): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    if (absent(vault)) return inner(request);\n    return through(\n      {\n        prepare: (outgoing) => vault.mcp(server, outgoing),\n        refresh: () => vault.refresh({ server }),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport const NO_VAULT_SIGN_IN = \"MCP sign-in needs seven's vault: update seven\";\n\nfunction oauthOf(url: string, params: URLSearchParams): OAuthConfig {\n  const scope = params.get('scope');\n  const resource = params.get('resource');\n  return {\n    tokenUrl: url,\n    clientId: params.get('client_id') ?? '',\n    ...(scope ? { scope } : {}),\n    ...(resource ? { resource } : {}),\n  };\n}\n\nexport function grantFetch(vault: Port, server: string, base: Fetch): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const params =\n      request.method === 'POST' ? new URLSearchParams(await request.clone().text()) : undefined;\n    if (params?.get('grant_type') !== 'authorization_code') return base(request);\n    if (absent(vault)) throw new Error(NO_VAULT_SIGN_IN);\n    const response = await base(request);\n    if (!response.ok) return response;\n    const raw = new Uint8Array(await response.arrayBuffer());\n    try {\n      const granted = await vault.grant(server, raw, oauthOf(request.url, params));\n      return new Response(granted.response as BodyInit, {\n        status: response.status,\n        headers: { 'content-type': 'application/json' },\n      });\n    } catch (error) {\n      throw new Error(\n        `the vault didn't keep the sign-in: ${error instanceof Error ? error.message : String(error)}`\n      );\n    } finally {\n      raw.fill(0);\n    }\n  };\n}\n"],
-  "mappings": "AACA,SAAyC,oBAAoB;AAa7D,MAAM,WAAW,oBAAI,IAAI,CAAC,OAAO,MAAM,CAAC;AACxC,MAAM,WAAW;AAEV,SAAS,OAAO,OAAqD;AAC1E,SAAO,CAAC,MAAM,aAAa,CAAC,MAAM;AACpC;AAEA,eAAe,SAAS,SAA4C;AAClE,QAAM,OAAO,SAAS,IAAI,QAAQ,MAAM,IACpC,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,QAAQ;AAAA,IACb,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,IAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,EACzB;AACF;AAEO,SAAS,QAAQ,OAA0B;AAChD,QAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO;AAC1D,QAAM,SAAS,SAAS,WAAW,MAAM,SAAS,WAAW,MAAM;AACnE,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,gBAAgB,4BAA4B;AAAA,EACzD,CAAC;AACH;AAEA,eAAe,SAAS,IAAQ,SAAoD;AAClF,MAAI;AACF,WAAO,MAAM,GAAG,QAAQ,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,iBAAiB,gBAAgB,MAAM,SAAS,SAAU,QAAO,GAAG,QAAQ,OAAO;AACvF,UAAM;AAAA,EACR;AACF;AAEA,SAAS,OAAO,UAA2B,OAAkC;AAC3E,QAAMA,QAAO,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAC/D,QAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,EAAE,OAAO,CAAC,UAAU,CAACA,MAAK,IAAI,KAAK,CAAC;AACzF,MAAI,MAAM,QAAQ,SAAS,IAAK,QAAO,KAAK,MAAM,KAAK,mBAAmB,MAAM,GAAG,CAAC;AACpF,SAAO,OAAO,QAAQ,CAAC,UAAU;AAAA,IAC/B;AAAA,IACA,GAAG,MAAM,MAAM,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU,QAAQ;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,UAAU,OAAgB,UAA2B,OAAwB;AAC3F,MACE,iBAAiB,iBAChB,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAE/C,WAAO;AACT,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,QAAM,QAAQ,OAAO,UAAU,KAAK;AACpC,QAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,uBAAuB;AACjF,SAAO,IAAI,UAAU,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE;AAC/E;AAEA,eAAe,KACb,OACA,SACA,UACA,OACA;AACA,QAAM,OAAoB;AAAA,IACxB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,aAAa,QAAQ;AAAA,IACrB,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAiB;AAAA,EACrE;AACA,MAAI;AACF,WAAO,MAAM,MAAM,MAAM,KAAK,IAAI;AAAA,EACpC,SAAS,OAAO;AACd,UAAM,UAAU,OAAO,UAAU,KAAK;AAAA,EACxC;AACF;AAEA,eAAe,QAAQ,IAAQ,OAAc,SAAqC;AAChF,QAAM,WAAW,MAAM,SAAS,OAAO;AACvC,MAAI,YAAY;AAChB,aAAS;AACP,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,SAAS,IAAI,QAAQ;AAAA,IACrC,SAAS,OAAO;AACd,aAAO,QAAQ,KAAK;AAAA,IACtB;AACA,UAAM,WAAW,MAAM,KAAK,OAAO,SAAS,UAAU,KAAK;AAC3D,QAAI,SAAS,WAAW,OAAO,aAAa,CAAC,GAAG,QAAS,QAAO;AAChE,gBAAY;AACZ,QACE,CAAE,MAAM,GAAG,QAAQ,EAAE;AAAA,MACnB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,aAAO;AACT,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACrD;AACF;AAEO,SAAS,WAAW,OAAa,OAAc,OAA0B;AAC9E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,WAAW,OAAO,KAAK,IAAI,SAAY,MAAM,OAAO;AAC1D,QAAI,aAAa,OAAW,QAAO,MAAM,OAAO;AAChD,UAAM,SAAoC,aAAa,OAAO,SAAY,EAAE,SAAS;AACrF,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACC,cAAa,MAAM,MAAM,YAAY,QAAWA,SAAQ;AAAA,QAClE,GAAI,SAAS,EAAE,SAAS,MAAM,MAAM,QAAQ,MAAM,EAAE,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,SAAS,OAAa,OAAc,QAAuB;AACzE,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,MAAM,OAAO;AACvC,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACA,cAAa,MAAM,IAAI,QAAQA,SAAQ;AAAA,QACjD,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mBAAmB;AAEhC,SAAS,QAAQ,KAAa,QAAsC;AAClE,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,OAAO,IAAI,WAAW,KAAK;AAAA,IACrC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACF;AAEO,SAAS,WAAW,OAAa,QAAgB,MAAoB;AAC1E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,SACJ,QAAQ,WAAW,SAAS,IAAI,gBAAgB,MAAM,QAAQ,MAAM,EAAE,KAAK,CAAC,IAAI;AAClF,QAAI,QAAQ,IAAI,YAAY,MAAM,qBAAsB,QAAO,KAAK,OAAO;AAC3E,QAAI,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,gBAAgB;AACnD,UAAM,WAAW,MAAM,KAAK,OAAO;AACnC,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,MAAM,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,CAAC;AAC3E,aAAO,IAAI,SAAS,QAAQ,UAAsB;AAAA,QAChD,QAAQ,SAAS;AAAA,QACjB,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC9F;AAAA,IACF,UAAE;AACA,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { OAuthConfig, OutgoingRequest } from '@ai-ecoverse/slicc-vault';\nimport { type RefreshTarget, type Vault, VaultRefusal } from './vault.ts';\n\ntype Fetch = typeof fetch;\n\ntype Port = Pick<Vault, 'connected' | 'needed' | 'model' | 'mcp' | 'refresh' | 'grant'>;\n\nexport type ModelRoute = (request: Request) => string | null | undefined;\n\ninterface Op {\n  prepare(request: OutgoingRequest): Promise<OutgoingRequest>;\n  refresh?(): Promise<unknown>;\n}\n\nconst BODYLESS = new Set(['GET', 'HEAD']);\nconst MIN_PART = 8;\n\nexport function absent(vault: Pick<Vault, 'connected' | 'needed'>): boolean {\n  return !vault.connected && !vault.needed;\n}\n\nasync function outgoing(request: Request): Promise<OutgoingRequest> {\n  const body = BODYLESS.has(request.method)\n    ? undefined\n    : new Uint8Array(await request.arrayBuffer());\n  return {\n    method: request.method,\n    url: request.url,\n    headers: [...request.headers],\n    ...(body ? { body } : {}),\n  };\n}\n\nexport function refusal(error: unknown): Response {\n  const code = error instanceof VaultRefusal ? error.code : undefined;\n  const status = code === 'EACCES' ? 403 : code === 'EINVAL' ? 400 : 503;\n  const text = error instanceof Error ? error.message : String(error);\n  return new Response(text, {\n    status,\n    headers: { 'content-type': 'text/plain; charset=utf-8' },\n  });\n}\n\nasync function prepared(op: Op, request: OutgoingRequest): Promise<OutgoingRequest> {\n  try {\n    return await op.prepare(request);\n  } catch (error) {\n    if (error instanceof VaultRefusal && error.code === 'EAGAIN') return op.prepare(request);\n    throw error;\n  }\n}\n\nfunction filled(original: OutgoingRequest, ready: OutgoingRequest): string[] {\n  const sent = new Set(original.headers.map(([, value]) => value));\n  const values = ready.headers.map(([, value]) => value).filter((value) => !sent.has(value));\n  if (ready.url !== original.url) values.push(ready.url, decodeURIComponent(ready.url));\n  return values.flatMap((value) => [\n    value,\n    ...value.split(/[\\s=&?]+/).filter((part) => part.length >= MIN_PART),\n  ]);\n}\n\nexport function safeError(error: unknown, original: OutgoingRequest, ready: OutgoingRequest) {\n  if (\n    error instanceof DOMException &&\n    (error.name === 'AbortError' || error.name === 'TimeoutError')\n  )\n    return error;\n  const text = error instanceof Error ? error.message : String(error);\n  const parts = filled(original, ready);\n  const shown = parts.some((part) => text.includes(part)) ? 'the request failed' : text;\n  return new TypeError(`${ready.method} ${new URL(ready.url).origin}: ${shown}`);\n}\n\nasync function sent(\n  inner: Fetch,\n  request: Request,\n  original: OutgoingRequest,\n  ready: OutgoingRequest\n) {\n  const init: RequestInit = {\n    method: ready.method,\n    headers: ready.headers,\n    signal: request.signal,\n    redirect: request.redirect,\n    credentials: request.credentials,\n    ...(ready.body === undefined ? {} : { body: ready.body as BodyInit }),\n  };\n  try {\n    return await inner(ready.url, init);\n  } catch (error) {\n    throw safeError(error, original, ready);\n  }\n}\n\nasync function through(op: Op, inner: Fetch, request: Request): Promise<Response> {\n  const original = await outgoing(request);\n  let refreshed = false;\n  for (;;) {\n    let ready: OutgoingRequest;\n    try {\n      ready = await prepared(op, original);\n    } catch (error) {\n      return refusal(error);\n    }\n    const response = await sent(inner, request, original, ready);\n    if (response.status !== 401 || refreshed || !op.refresh) return response;\n    refreshed = true;\n    if (\n      !(await op.refresh().then(\n        () => true,\n        () => false\n      ))\n    )\n      return response;\n    await response.body?.cancel().catch(() => undefined);\n  }\n}\n\nexport function vaultFetch(\n  vault: Port,\n  inner: Fetch,\n  route: ModelRoute,\n  rejecting: (provider: string) => () => void = () => () => undefined\n): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const provider = absent(vault) ? undefined : route(request);\n    if (provider === undefined) return inner(request);\n    const target: RefreshTarget | undefined = provider === null ? undefined : { provider };\n    const rejected = provider === null ? undefined : rejecting(provider);\n    const response = await through(\n      {\n        prepare: (outgoing) => vault.model(provider ?? undefined, outgoing),\n        ...(target ? { refresh: () => vault.refresh(target) } : {}),\n      },\n      inner,\n      request\n    );\n    if (response.status === 401) rejected?.();\n    return response;\n  };\n}\n\nexport function mcpFetch(vault: Port, inner: Fetch, server: string): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    if (absent(vault)) return inner(request);\n    return through(\n      {\n        prepare: (outgoing) => vault.mcp(server, outgoing),\n        refresh: () => vault.refresh({ server }),\n      },\n      inner,\n      request\n    );\n  };\n}\n\nexport const NO_VAULT_SIGN_IN = \"MCP sign-in needs seven's vault: update seven\";\n\nfunction oauthOf(url: string, params: URLSearchParams): OAuthConfig {\n  const scope = params.get('scope');\n  const resource = params.get('resource');\n  return {\n    tokenUrl: url,\n    clientId: params.get('client_id') ?? '',\n    ...(scope ? { scope } : {}),\n    ...(resource ? { resource } : {}),\n  };\n}\n\nexport function grantFetch(vault: Port, server: string, base: Fetch): Fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const params =\n      request.method === 'POST' ? new URLSearchParams(await request.clone().text()) : undefined;\n    if (params?.get('grant_type') !== 'authorization_code') return base(request);\n    if (absent(vault)) throw new Error(NO_VAULT_SIGN_IN);\n    const response = await base(request);\n    if (!response.ok) return response;\n    const raw = new Uint8Array(await response.arrayBuffer());\n    try {\n      const granted = await vault.grant(server, raw, oauthOf(request.url, params));\n      return new Response(granted.response as BodyInit, {\n        status: response.status,\n        headers: { 'content-type': 'application/json' },\n      });\n    } catch (error) {\n      throw new Error(\n        `the vault didn't keep the sign-in: ${error instanceof Error ? error.message : String(error)}`\n      );\n    } finally {\n      raw.fill(0);\n    }\n  };\n}\n"],
+  "mappings": "AACA,SAAyC,oBAAoB;AAa7D,MAAM,WAAW,oBAAI,IAAI,CAAC,OAAO,MAAM,CAAC;AACxC,MAAM,WAAW;AAEV,SAAS,OAAO,OAAqD;AAC1E,SAAO,CAAC,MAAM,aAAa,CAAC,MAAM;AACpC;AAEA,eAAe,SAAS,SAA4C;AAClE,QAAM,OAAO,SAAS,IAAI,QAAQ,MAAM,IACpC,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,SAAO;AAAA,IACL,QAAQ,QAAQ;AAAA,IAChB,KAAK,QAAQ;AAAA,IACb,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,IAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,EACzB;AACF;AAEO,SAAS,QAAQ,OAA0B;AAChD,QAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO;AAC1D,QAAM,SAAS,SAAS,WAAW,MAAM,SAAS,WAAW,MAAM;AACnE,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,gBAAgB,4BAA4B;AAAA,EACzD,CAAC;AACH;AAEA,eAAe,SAAS,IAAQ,SAAoD;AAClF,MAAI;AACF,WAAO,MAAM,GAAG,QAAQ,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,QAAI,iBAAiB,gBAAgB,MAAM,SAAS,SAAU,QAAO,GAAG,QAAQ,OAAO;AACvF,UAAM;AAAA,EACR;AACF;AAEA,SAAS,OAAO,UAA2B,OAAkC;AAC3E,QAAMA,QAAO,IAAI,IAAI,SAAS,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,CAAC;AAC/D,QAAM,SAAS,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAK,EAAE,OAAO,CAAC,UAAU,CAACA,MAAK,IAAI,KAAK,CAAC;AACzF,MAAI,MAAM,QAAQ,SAAS,IAAK,QAAO,KAAK,MAAM,KAAK,mBAAmB,MAAM,GAAG,CAAC;AACpF,SAAO,OAAO,QAAQ,CAAC,UAAU;AAAA,IAC/B;AAAA,IACA,GAAG,MAAM,MAAM,UAAU,EAAE,OAAO,CAAC,SAAS,KAAK,UAAU,QAAQ;AAAA,EACrE,CAAC;AACH;AAEO,SAAS,UAAU,OAAgB,UAA2B,OAAwB;AAC3F,MACE,iBAAiB,iBAChB,MAAM,SAAS,gBAAgB,MAAM,SAAS;AAE/C,WAAO;AACT,QAAM,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAClE,QAAM,QAAQ,OAAO,UAAU,KAAK;AACpC,QAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,uBAAuB;AACjF,SAAO,IAAI,UAAU,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,MAAM,KAAK,KAAK,EAAE;AAC/E;AAEA,eAAe,KACb,OACA,SACA,UACA,OACA;AACA,QAAM,OAAoB;AAAA,IACxB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,aAAa,QAAQ;AAAA,IACrB,GAAI,MAAM,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,MAAM,KAAiB;AAAA,EACrE;AACA,MAAI;AACF,WAAO,MAAM,MAAM,MAAM,KAAK,IAAI;AAAA,EACpC,SAAS,OAAO;AACd,UAAM,UAAU,OAAO,UAAU,KAAK;AAAA,EACxC;AACF;AAEA,eAAe,QAAQ,IAAQ,OAAc,SAAqC;AAChF,QAAM,WAAW,MAAM,SAAS,OAAO;AACvC,MAAI,YAAY;AAChB,aAAS;AACP,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,SAAS,IAAI,QAAQ;AAAA,IACrC,SAAS,OAAO;AACd,aAAO,QAAQ,KAAK;AAAA,IACtB;AACA,UAAM,WAAW,MAAM,KAAK,OAAO,SAAS,UAAU,KAAK;AAC3D,QAAI,SAAS,WAAW,OAAO,aAAa,CAAC,GAAG,QAAS,QAAO;AAChE,gBAAY;AACZ,QACE,CAAE,MAAM,GAAG,QAAQ,EAAE;AAAA,MACnB,MAAM;AAAA,MACN,MAAM;AAAA,IACR;AAEA,aAAO;AACT,UAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACrD;AACF;AAEO,SAAS,WACd,OACA,OACA,OACA,YAA8C,MAAM,MAAM,QACnD;AACP,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,WAAW,OAAO,KAAK,IAAI,SAAY,MAAM,OAAO;AAC1D,QAAI,aAAa,OAAW,QAAO,MAAM,OAAO;AAChD,UAAM,SAAoC,aAAa,OAAO,SAAY,EAAE,SAAS;AACrF,UAAM,WAAW,aAAa,OAAO,SAAY,UAAU,QAAQ;AACnE,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,QACE,SAAS,CAACC,cAAa,MAAM,MAAM,YAAY,QAAWA,SAAQ;AAAA,QAClE,GAAI,SAAS,EAAE,SAAS,MAAM,MAAM,QAAQ,MAAM,EAAE,IAAI,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,SAAS,WAAW,IAAK,YAAW;AACxC,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,OAAa,OAAc,QAAuB;AACzE,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,MAAM,OAAO;AACvC,WAAO;AAAA,MACL;AAAA,QACE,SAAS,CAACA,cAAa,MAAM,IAAI,QAAQA,SAAQ;AAAA,QACjD,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mBAAmB;AAEhC,SAAS,QAAQ,KAAa,QAAsC;AAClE,QAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,OAAO,IAAI,WAAW,KAAK;AAAA,IACrC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,EACjC;AACF;AAEO,SAAS,WAAW,OAAa,QAAgB,MAAoB;AAC1E,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,SACJ,QAAQ,WAAW,SAAS,IAAI,gBAAgB,MAAM,QAAQ,MAAM,EAAE,KAAK,CAAC,IAAI;AAClF,QAAI,QAAQ,IAAI,YAAY,MAAM,qBAAsB,QAAO,KAAK,OAAO;AAC3E,QAAI,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,gBAAgB;AACnD,UAAM,WAAW,MAAM,KAAK,OAAO;AACnC,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,MAAM,IAAI,WAAW,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ,KAAK,MAAM,CAAC;AAC3E,aAAO,IAAI,SAAS,QAAQ,UAAsB;AAAA,QAChD,QAAQ,SAAS;AAAA,QACjB,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC9F;AAAA,IACF,UAAE;AACA,UAAI,KAAK,CAAC;AAAA,IACZ;AAAA,EACF;AACF;",
   "names": ["sent", "outgoing"]
 }

package/dist/secrets/records.js

@@ -1,12 +1,53 @@
 import { replicatedState } from "@earendil-works/chord";
-function vaultRecords(vault) {
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+const MAX_DELAY = 2 ** 31 - 1;
+function lapsed(record, now) {
+  if (record.state === "refreshing") return false;
+  return record.state !== "ready" || record.expiresAt !== void 0 && record.expiresAt <= now;
+}
+const keyOf = (record) => JSON.stringify([record.kind, record.name, record.placeholder, record.expiresAt ?? null]);
+function vaultRecords(vault, now = Date.now) {
   const state = replicatedState([]);
   let version = vault.state.value.version;
   let port = vault.state.value.port;
   let lock = Promise.resolve();
+  let raw = [];
+  let refused = /* @__PURE__ */ new Map();
+  let timer;
+  const derive = (records) => {
+    const at = now();
+    return records.map(
+      (record) => record.state !== "expired" && (lapsed(record, at) || refused.has(keyOf(record))) ? { ...record, state: "expired" } : record
+    );
+  };
+  const arm = () => {
+    if (timer !== void 0) clearTimeout(timer);
+    timer = void 0;
+    const at = now();
+    const due = state.value.filter((record) => record.state === "ready" && record.expiresAt !== void 0).map((record) => record.expiresAt);
+    if (!due.length) return;
+    timer = setTimeout(
+      () => {
+        timer = void 0;
+        apply(BACKGROUND_CONTEXT);
+        void refresh(BACKGROUND_CONTEXT).catch(() => void 0);
+      },
+      Math.min(MAX_DELAY, Math.max(0, Math.min(...due) - at))
+    );
+    timer.unref?.();
+  };
+  const apply = (context) => {
+    state.replace(context, derive(raw));
+    arm();
+  };
   const read = async () => vault.connected || vault.needed ? vault.records() : [];
   const refresh = (context) => {
-    const run = lock.then(async () => state.replace(context, await read()));
+    const run = lock.then(async () => {
+      raw = await read();
+      const held = new Set(raw.map(keyOf));
+      refused = new Map([...refused].filter(([key]) => held.has(key)));
+      apply(context);
+    });
     lock = run.catch(() => void 0);
     return run;
   };
@@ -17,19 +58,39 @@ function vaultRecords(vault) {
     if (bumped) void refresh(context).catch(() => void 0);
   });
   const of = (kind) => state.value.filter((record) => record.kind === kind);
+  const model = (provider) => of("model").find((record) => record.provider === provider);
   return {
     state,
     refresh,
-    model: (provider) => of("model").find((record) => record.provider === provider),
+    model,
     mcp: (server, name) => {
       const own = of("mcp").filter((record) => record.server === server);
       if (name === void 0) return own[0];
       return own.find((record) => record.name === name) ?? of("mcp").find((record) => record.server === void 0 && record.name === name);
     },
-    close: off
+    rejecting(provider) {
+      const seen = version;
+      const record = raw.find((item) => item.kind === "model" && item.provider === provider);
+      const key = record && keyOf(record);
+      return () => {
+        if (!key || version !== seen || refused.has(key)) return;
+        if (!raw.some((item) => keyOf(item) === key)) return;
+        refused.set(key, provider);
+        apply(BACKGROUND_CONTEXT);
+      };
+    },
+    reconnected(provider) {
+      refused = new Map([...refused].filter(([, owner]) => owner !== provider));
+    },
+    close() {
+      off();
+      if (timer !== void 0) clearTimeout(timer);
+      timer = void 0;
+    }
   };
 }
 export {
+  lapsed,
   vaultRecords
 };
 //# sourceMappingURL=records.js.map

package/dist/secrets/records.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/secrets/records.ts"],
-  "sourcesContent": ["import type { AgentRecord } from '@ai-ecoverse/slicc-vault';\nimport { type Context, type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport type { Vault } from './vault.ts';\n\nexport type { AgentRecord } from '@ai-ecoverse/slicc-vault';\n\nexport interface VaultRecords {\n  readonly state: MutableReplicatedState<AgentRecord[]>;\n  refresh(context: Context): Promise<void>;\n  model(provider: string): AgentRecord | undefined;\n  mcp(server: string, name?: string): AgentRecord | undefined;\n  close(): void;\n}\n\ntype Source = Pick<Vault, 'state' | 'records' | 'connected' | 'needed'>;\n\nexport function vaultRecords(vault: Source): VaultRecords {\n  const state = replicatedState<AgentRecord[]>([]);\n  let version = vault.state.value.version;\n  let port = vault.state.value.port;\n  let lock: Promise<unknown> = Promise.resolve();\n  const read = async () => (vault.connected || vault.needed ? vault.records() : []);\n  const refresh = (context: Context) => {\n    const run = lock.then(async () => state.replace(context, await read()));\n    lock = run.catch(() => undefined);\n    return run;\n  };\n  const off = vault.state.subscribe((value, context) => {\n    const bumped = value.version !== version || (port === 'none' && value.port !== 'none');\n    version = value.version;\n    port = value.port;\n    if (bumped) void refresh(context).catch(() => undefined);\n  });\n  const of = (kind: AgentRecord['kind']) => state.value.filter((record) => record.kind === kind);\n  return {\n    state,\n    refresh,\n    model: (provider) => of('model').find((record) => record.provider === provider),\n    mcp: (server, name) => {\n      const own = of('mcp').filter((record) => record.server === server);\n      if (name === undefined) return own[0];\n      return (\n        own.find((record) => record.name === name) ??\n        of('mcp').find((record) => record.server === undefined && record.name === name)\n      );\n    },\n    close: off,\n  };\n}\n"],
-  "mappings": "AACA,SAAoD,uBAAuB;AAepE,SAAS,aAAa,OAA6B;AACxD,QAAM,QAAQ,gBAA+B,CAAC,CAAC;AAC/C,MAAI,UAAU,MAAM,MAAM,MAAM;AAChC,MAAI,OAAO,MAAM,MAAM,MAAM;AAC7B,MAAI,OAAyB,QAAQ,QAAQ;AAC7C,QAAM,OAAO,YAAa,MAAM,aAAa,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC;AAC/E,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,MAAM,KAAK,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,KAAK,CAAC,CAAC;AACtE,WAAO,IAAI,MAAM,MAAM,MAAS;AAChC,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAM,MAAM,UAAU,CAAC,OAAO,YAAY;AACpD,UAAM,SAAS,MAAM,YAAY,WAAY,SAAS,UAAU,MAAM,SAAS;AAC/E,cAAU,MAAM;AAChB,WAAO,MAAM;AACb,QAAI,OAAQ,MAAK,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD,CAAC;AACD,QAAM,KAAK,CAAC,SAA8B,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,SAAS,IAAI;AAC7F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO,CAAC,aAAa,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,OAAO,aAAa,QAAQ;AAAA,IAC9E,KAAK,CAAC,QAAQ,SAAS;AACrB,YAAM,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM;AACjE,UAAI,SAAS,OAAW,QAAO,IAAI,CAAC;AACpC,aACE,IAAI,KAAK,CAAC,WAAW,OAAO,SAAS,IAAI,KACzC,GAAG,KAAK,EAAE,KAAK,CAAC,WAAW,OAAO,WAAW,UAAa,OAAO,SAAS,IAAI;AAAA,IAElF;AAAA,IACA,OAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import type { AgentRecord } from '@ai-ecoverse/slicc-vault';\nimport { type Context, type MutableReplicatedState, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { Vault } from './vault.ts';\n\nexport type { AgentRecord } from '@ai-ecoverse/slicc-vault';\n\nexport interface VaultRecords {\n  readonly state: MutableReplicatedState<AgentRecord[]>;\n  refresh(context: Context): Promise<void>;\n  model(provider: string): AgentRecord | undefined;\n  mcp(server: string, name?: string): AgentRecord | undefined;\n  rejecting(provider: string): () => void;\n  reconnected(provider: string): void;\n  close(): void;\n}\n\ntype Source = Pick<Vault, 'state' | 'records' | 'connected' | 'needed'>;\n\nconst MAX_DELAY = 2 ** 31 - 1;\n\nexport function lapsed(record: Pick<AgentRecord, 'state' | 'expiresAt'>, now: number): boolean {\n  if (record.state === 'refreshing') return false;\n  return record.state !== 'ready' || (record.expiresAt !== undefined && record.expiresAt <= now);\n}\n\nconst keyOf = (record: AgentRecord) =>\n  JSON.stringify([record.kind, record.name, record.placeholder, record.expiresAt ?? null]);\n\nexport function vaultRecords(vault: Source, now: () => number = Date.now): VaultRecords {\n  const state = replicatedState<AgentRecord[]>([]);\n  let version = vault.state.value.version;\n  let port = vault.state.value.port;\n  let lock: Promise<unknown> = Promise.resolve();\n  let raw: AgentRecord[] = [];\n  let refused = new Map<string, string>();\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const derive = (records: AgentRecord[]) => {\n    const at = now();\n    return records.map((record) =>\n      record.state !== 'expired' && (lapsed(record, at) || refused.has(keyOf(record)))\n        ? { ...record, state: 'expired' as const }\n        : record\n    );\n  };\n  const arm = () => {\n    if (timer !== undefined) clearTimeout(timer);\n    timer = undefined;\n    const at = now();\n    const due = state.value\n      .filter((record) => record.state === 'ready' && record.expiresAt !== undefined)\n      .map((record) => record.expiresAt as number);\n    if (!due.length) return;\n    timer = setTimeout(\n      () => {\n        timer = undefined;\n        apply(BACKGROUND_CONTEXT);\n        void refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n      },\n      Math.min(MAX_DELAY, Math.max(0, Math.min(...due) - at))\n    );\n    (timer as { unref?: () => void }).unref?.();\n  };\n  const apply = (context: Context) => {\n    state.replace(context, derive(raw));\n    arm();\n  };\n  const read = async () => (vault.connected || vault.needed ? vault.records() : []);\n  const refresh = (context: Context) => {\n    const run = lock.then(async () => {\n      raw = await read();\n      const held = new Set(raw.map(keyOf));\n      refused = new Map([...refused].filter(([key]) => held.has(key)));\n      apply(context);\n    });\n    lock = run.catch(() => undefined);\n    return run;\n  };\n  const off = vault.state.subscribe((value, context) => {\n    const bumped = value.version !== version || (port === 'none' && value.port !== 'none');\n    version = value.version;\n    port = value.port;\n    if (bumped) void refresh(context).catch(() => undefined);\n  });\n  const of = (kind: AgentRecord['kind']) => state.value.filter((record) => record.kind === kind);\n  const model = (provider: string) => of('model').find((record) => record.provider === provider);\n  return {\n    state,\n    refresh,\n    model,\n    mcp: (server, name) => {\n      const own = of('mcp').filter((record) => record.server === server);\n      if (name === undefined) return own[0];\n      return (\n        own.find((record) => record.name === name) ??\n        of('mcp').find((record) => record.server === undefined && record.name === name)\n      );\n    },\n    rejecting(provider) {\n      const seen = version;\n      const record = raw.find((item) => item.kind === 'model' && item.provider === provider);\n      const key = record && keyOf(record);\n      return () => {\n        if (!key || version !== seen || refused.has(key)) return;\n        if (!raw.some((item) => keyOf(item) === key)) return;\n        refused.set(key, provider);\n        apply(BACKGROUND_CONTEXT);\n      };\n    },\n    reconnected(provider) {\n      refused = new Map([...refused].filter(([, owner]) => owner !== provider));\n    },\n    close() {\n      off();\n      if (timer !== undefined) clearTimeout(timer);\n      timer = undefined;\n    },\n  };\n}\n"],
+  "mappings": "AACA,SAAoD,uBAAuB;AAC3E,SAAS,0BAA0B;AAiBnC,MAAM,YAAY,KAAK,KAAK;AAErB,SAAS,OAAO,QAAkD,KAAsB;AAC7F,MAAI,OAAO,UAAU,aAAc,QAAO;AAC1C,SAAO,OAAO,UAAU,WAAY,OAAO,cAAc,UAAa,OAAO,aAAa;AAC5F;AAEA,MAAM,QAAQ,CAAC,WACb,KAAK,UAAU,CAAC,OAAO,MAAM,OAAO,MAAM,OAAO,aAAa,OAAO,aAAa,IAAI,CAAC;AAElF,SAAS,aAAa,OAAe,MAAoB,KAAK,KAAmB;AACtF,QAAM,QAAQ,gBAA+B,CAAC,CAAC;AAC/C,MAAI,UAAU,MAAM,MAAM,MAAM;AAChC,MAAI,OAAO,MAAM,MAAM,MAAM;AAC7B,MAAI,OAAyB,QAAQ,QAAQ;AAC7C,MAAI,MAAqB,CAAC;AAC1B,MAAI,UAAU,oBAAI,IAAoB;AACtC,MAAI;AACJ,QAAM,SAAS,CAAC,YAA2B;AACzC,UAAM,KAAK,IAAI;AACf,WAAO,QAAQ;AAAA,MAAI,CAAC,WAClB,OAAO,UAAU,cAAc,OAAO,QAAQ,EAAE,KAAK,QAAQ,IAAI,MAAM,MAAM,CAAC,KAC1E,EAAE,GAAG,QAAQ,OAAO,UAAmB,IACvC;AAAA,IACN;AAAA,EACF;AACA,QAAM,MAAM,MAAM;AAChB,QAAI,UAAU,OAAW,cAAa,KAAK;AAC3C,YAAQ;AACR,UAAM,KAAK,IAAI;AACf,UAAM,MAAM,MAAM,MACf,OAAO,CAAC,WAAW,OAAO,UAAU,WAAW,OAAO,cAAc,MAAS,EAC7E,IAAI,CAAC,WAAW,OAAO,SAAmB;AAC7C,QAAI,CAAC,IAAI,OAAQ;AACjB,YAAQ;AAAA,MACN,MAAM;AACJ,gBAAQ;AACR,cAAM,kBAAkB;AACxB,aAAK,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AAAA,MACxD;AAAA,MACA,KAAK,IAAI,WAAW,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;AAAA,IACxD;AACA,IAAC,MAAiC,QAAQ;AAAA,EAC5C;AACA,QAAM,QAAQ,CAAC,YAAqB;AAClC,UAAM,QAAQ,SAAS,OAAO,GAAG,CAAC;AAClC,QAAI;AAAA,EACN;AACA,QAAM,OAAO,YAAa,MAAM,aAAa,MAAM,SAAS,MAAM,QAAQ,IAAI,CAAC;AAC/E,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,MAAM,KAAK,KAAK,YAAY;AAChC,YAAM,MAAM,KAAK;AACjB,YAAM,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;AACnC,gBAAU,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,CAAC,CAAC;AAC/D,YAAM,OAAO;AAAA,IACf,CAAC;AACD,WAAO,IAAI,MAAM,MAAM,MAAS;AAChC,WAAO;AAAA,EACT;AACA,QAAM,MAAM,MAAM,MAAM,UAAU,CAAC,OAAO,YAAY;AACpD,UAAM,SAAS,MAAM,YAAY,WAAY,SAAS,UAAU,MAAM,SAAS;AAC/E,cAAU,MAAM;AAChB,WAAO,MAAM;AACb,QAAI,OAAQ,MAAK,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACzD,CAAC;AACD,QAAM,KAAK,CAAC,SAA8B,MAAM,MAAM,OAAO,CAAC,WAAW,OAAO,SAAS,IAAI;AAC7F,QAAM,QAAQ,CAAC,aAAqB,GAAG,OAAO,EAAE,KAAK,CAAC,WAAW,OAAO,aAAa,QAAQ;AAC7F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK,CAAC,QAAQ,SAAS;AACrB,YAAM,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,WAAW,OAAO,WAAW,MAAM;AACjE,UAAI,SAAS,OAAW,QAAO,IAAI,CAAC;AACpC,aACE,IAAI,KAAK,CAAC,WAAW,OAAO,SAAS,IAAI,KACzC,GAAG,KAAK,EAAE,KAAK,CAAC,WAAW,OAAO,WAAW,UAAa,OAAO,SAAS,IAAI;AAAA,IAElF;AAAA,IACA,UAAU,UAAU;AAClB,YAAM,OAAO;AACb,YAAM,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,WAAW,KAAK,aAAa,QAAQ;AACrF,YAAM,MAAM,UAAU,MAAM,MAAM;AAClC,aAAO,MAAM;AACX,YAAI,CAAC,OAAO,YAAY,QAAQ,QAAQ,IAAI,GAAG,EAAG;AAClD,YAAI,CAAC,IAAI,KAAK,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG,EAAG;AAC9C,gBAAQ,IAAI,KAAK,QAAQ;AACzB,cAAM,kBAAkB;AAAA,MAC1B;AAAA,IACF;AAAA,IACA,YAAY,UAAU;AACpB,gBAAU,IAAI,IAAI,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,QAAQ,CAAC;AAAA,IAC1E;AAAA,IACA,QAAQ;AACN,UAAI;AACJ,UAAI,UAAU,OAAW,cAAa,KAAK;AAC3C,cAAQ;AAAA,IACV;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/settings.js

@@ -198,6 +198,7 @@ async function createAgentSettings(models, sources, providers = sliccProviders()
       if (secret !== null)
         throw new Error(signIn.has(providerId) ? SIGN_IN_NEEDS_VAULT : KEY_NEEDS_VAULT);
       if (given !== null) await fields.set(providerId, given);
+      records.reconnected(providerId);
       await reread(context);
       if (signIn.has(providerId)) await discover([providerId]);
       await refresh(context);

package/dist/settings.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/settings.ts"],
-  "sourcesContent": ["import { type Context, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport { createModels, type MutableModels } from '@earendil-works/pi-ai/models';\nimport { amazonBedrockProvider } from '@earendil-works/pi-ai/providers/amazon-bedrock';\nimport {\n  ADOBE,\n  ADOBE_PROXY,\n  adobeConfig,\n  adobeIdentity,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nimport { abortableBedrock } from './bedrock.ts';\nimport type { McpAccounts } from './mcp/index.ts';\nimport { MCP_ACCOUNT } from './mcp/label.ts';\nimport { BEDROCK, preferredModel } from './preferred.ts';\nimport type { KeysMoved } from './secrets/legacy.ts';\nimport type { VaultRecords } from './secrets/records.ts';\nimport type { PlainStore } from './secrets/store.ts';\nimport type {\n  AccountField,\n  AccountState,\n  AgentSettings,\n  ModelChoice,\n  SettingsState,\n} from './services.ts';\n\nexport { BEDROCK, PREFERRED_MODELS, preferredModel } from './preferred.ts';\n\nexport const DEFAULT_MODEL = { provider: BEDROCK, modelId: 'us.anthropic.claude-sonnet-5-5' };\nexport const DEFAULT_REGIONS: Readonly<Record<string, string>> = { [BEDROCK]: 'us-west-2' };\n\nexport const ACCOUNT_FIELDS: Readonly<Record<string, readonly AccountField[]>> = {\n  [BEDROCK]: [{ name: 'region', label: 'Region' }],\n};\nconst FIELD_ENV: Readonly<Record<string, string>> = { region: 'AWS_REGION' };\nexport const SIGN_IN_NEEDS_VAULT = \"Adobe sign-in needs seven's vault: update seven\";\nexport const KEY_NEEDS_VAULT = \"API keys are kept in seven's vault: update seven\";\n\nexport async function resolveDefaultModel(\n  credentials: CredentialStore,\n  providers: Provider[],\n  models: MutableModels\n): Promise<{ provider: string; modelId: string }> {\n  const stored = new Set((await credentials.list()).map((info) => info.providerId));\n  for (const provider of providers) {\n    if (!stored.has(provider.id)) continue;\n    if (!models.getModels(provider.id).length && provider.refreshModels) {\n      await models.refresh({ providers: [provider.id] }).catch(() => undefined);\n    }\n    const chosen = preferredModel(provider.id, models.getModels(provider.id));\n    if (chosen) return { provider: provider.id, modelId: chosen.id };\n  }\n  return DEFAULT_MODEL;\n}\n\nconst corsFree = new Set([BEDROCK, ADOBE]);\nconst signIn = new Set([ADOBE]);\nconst BUDGET_EVERY = 5 * 60 * 1000;\n\nexport function sliccProviders(version?: string): Provider[] {\n  return [amazonBedrockProvider() as Provider, adobeProvider({ version })];\n}\n\nexport function withDefaultRegions(credentials: CredentialStore): CredentialStore {\n  return {\n    async read(providerId, options) {\n      const credential = await credentials.read(providerId, options);\n      const region = DEFAULT_REGIONS[providerId];\n      if (credential?.type !== 'api_key' || !region || credential.env?.AWS_REGION) {\n        return credential;\n      }\n      return { ...credential, env: { ...credential.env, AWS_REGION: region } };\n    },\n    list: (options) => credentials.list(options),\n    modify: (providerId, fn, options) => credentials.modify(providerId, fn, options),\n    delete: (providerId, options) => credentials.delete(providerId, options),\n  };\n}\n\nexport function createSliccModels(\n  credentials: CredentialStore,\n  providers = sliccProviders()\n): MutableModels {\n  const models = createModels({ credentials: withDefaultRegions(credentials) });\n  for (const provider of providers) models.setProvider(abortableBedrock(provider));\n  return models;\n}\n\nconst SHORT: Record<string, string> = { [BEDROCK]: 'Bedrock', [ADOBE]: 'Adobe' };\n\nfunction labels(\n  models: MutableModels,\n  providers: Provider[],\n  stored: ReadonlySet<string>\n): Record<string, string> {\n  return Object.fromEntries(\n    providers\n      .filter((provider) => !stored.has(provider.id))\n      .flatMap((provider) =>\n        models\n          .getModels(provider.id)\n          .map((model) => [\n            `${provider.id}/${model.id}`,\n            `${model.name} on ${SHORT[provider.id] ?? provider.name ?? provider.id}`,\n          ])\n      )\n  );\n}\n\nfunction choices(\n  models: MutableModels,\n  providers: Provider[],\n  stored: ReadonlySet<string>\n): ModelChoice[] {\n  return providers\n    .filter((provider) => stored.has(provider.id))\n    .flatMap((provider) =>\n      models.getModels(provider.id).map((model) => ({\n        id: `${provider.id}/${model.id}`,\n        label: model.name,\n        provider: provider.name ?? provider.id,\n        kind: 'chat' as const,\n        reasoning: Boolean(model.reasoning),\n        images: model.input.includes('image'),\n        contextWindow: model.contextWindow,\n      }))\n    );\n}\n\nfunction accounts(records: Pick<VaultRecords, 'model'>, providers: Provider[]): AccountState[] {\n  return providers.map((provider) => {\n    const record = records.model(provider.id);\n    const fields = ACCOUNT_FIELDS[provider.id];\n    return {\n      id: provider.id,\n      provider: provider.name ?? provider.id,\n      identity: record ? (signIn.has(provider.id) ? 'Adobe ID' : 'API key') : '',\n      status: !record ? 'disconnected' : record.state === 'expired' ? 'expired' : 'connected',\n      auth: signIn.has(provider.id) ? 'oauth' : 'api-key',\n      needs: corsFree.has(provider.id) ? 'cors-free-transport' : null,\n      store: 'vault',\n      ...(fields ? { fields: fields.map((field) => ({ ...field })) } : {}),\n    };\n  });\n}\n\nexport interface ProviderFields {\n  get(providerId: string): Readonly<Record<string, string>> | undefined;\n  env(providerId: string): Readonly<Record<string, string>> | undefined;\n  set(providerId: string, fields: Record<string, string> | undefined): Promise<void>;\n}\n\nexport async function providerFields(\n  store: PlainStore,\n  providers: readonly Provider[]\n): Promise<ProviderFields> {\n  const known = new Map<string, Record<string, string>>();\n  for (const provider of providers) {\n    const saved = (await store.get(`model:${provider.id}`)) as Record<string, string> | undefined;\n    if (saved && typeof saved === 'object') known.set(provider.id, saved);\n  }\n  return {\n    get: (providerId) => known.get(providerId),\n    env(providerId) {\n      const fields = known.get(providerId);\n      if (!fields) return undefined;\n      return Object.fromEntries(\n        Object.entries(fields).flatMap(([name, value]) =>\n          FIELD_ENV[name] ? [[FIELD_ENV[name], value]] : []\n        )\n      );\n    },\n    async set(providerId, fields) {\n      const allowed = new Set((ACCOUNT_FIELDS[providerId] ?? []).map((field) => field.name));\n      const kept = Object.fromEntries(\n        Object.entries(fields ?? {}).filter(\n          ([name, value]) => allowed.has(name) && typeof value === 'string' && value.trim() !== ''\n        )\n      );\n      const next = Object.keys(kept).length ? kept : undefined;\n      if (next) known.set(providerId, next);\n      else known.delete(providerId);\n      await store.set(`model:${providerId}`, next);\n    },\n  };\n}\n\nexport type UsageReader = (token: string) => Promise<Budget | null>;\n\nasync function budget(records: Pick<VaultRecords, 'model'>, usage: UsageReader) {\n  const key = records.model(ADOBE)?.placeholder;\n  const found = key ? await usage(key).catch(() => null) : null;\n  return found ? { provider: ADOBE, ...found } : null;\n}\n\nexport interface SettingsSources {\n  records: VaultRecords;\n  fields: ProviderFields;\n}\n\nexport async function createAgentSettings(\n  models: MutableModels,\n  sources: SettingsSources,\n  providers = sliccProviders(),\n  options: { usage?: UsageReader; every?: number; mcp?: McpAccounts; moved?: KeysMoved } = {}\n): Promise<AgentSettings> {\n  const { mcp, moved } = options;\n  const { records, fields } = sources;\n  const routed = (providerId: string) => (providerId.startsWith(MCP_ACCOUNT) ? mcp : undefined);\n  const adobe = providers.find((provider) => provider.id === ADOBE);\n  const endpoint = adobe?.baseUrl ?? ADOBE_PROXY;\n  const identity = (adobe?.headers as Record<string, string> | undefined) ?? adobeIdentity();\n  const usage = options.usage ?? ((token: string) => adobeUsage(token, { endpoint, identity }));\n  const snapshot = async (): Promise<SettingsState> => {\n    const stored = new Set(\n      providers.filter((provider) => records.model(provider.id)).map((provider) => provider.id)\n    );\n    return {\n      models: choices(models, providers, stored),\n      labels: labels(models, providers, stored),\n      accounts: [...accounts(records, providers), ...((await mcp?.accounts()) ?? [])],\n      budget: await budget(records, usage),\n      ...(moved?.state.value?.length\n        ? { moved: moved.state.value.map((name) => ({ ...name })) }\n        : {}),\n    };\n  };\n  const state = replicatedState<SettingsState>(await snapshot());\n  let latest = Promise.resolve();\n  const refresh = (context: Context) => {\n    const next = latest.then(async () => state.replace(context, await snapshot()));\n    latest = next.catch(() => undefined);\n    return next;\n  };\n  const signedIn = providers\n    .filter((provider) => signIn.has(provider.id))\n    .map((provider) => provider.id);\n  const discover = (ids: string[]) =>\n    models.refresh({ providers: ids }).then(\n      () => undefined,\n      () => undefined\n    );\n  if (signedIn.length) {\n    const cycle = () =>\n      void discover(signedIn)\n        .then(() => refresh(BACKGROUND_CONTEXT))\n        .catch(() => undefined);\n    cycle();\n    const timer: unknown = setInterval(cycle, options.every ?? BUDGET_EVERY);\n    (timer as { unref?: () => void }).unref?.();\n  }\n  mcp?.onChange(() => void refresh(BACKGROUND_CONTEXT).catch(() => undefined));\n  moved?.state.subscribe((_value, context) => void refresh(context).catch(() => undefined));\n  const held = () => signedIn.filter((id) => records.model(id)).join(' ');\n  let seen = held();\n  records.state.subscribe(() => {\n    const now = held();\n    const added = now !== seen;\n    seen = now;\n    const discovered = added ? discover(signedIn) : Promise.resolve();\n    void discovered.then(() => refresh(BACKGROUND_CONTEXT)).catch(() => undefined);\n  });\n  const reread = (context: Context) => records.refresh(context).catch(() => undefined);\n  return {\n    state,\n    async connect(providerId, secret, given, context) {\n      const server = routed(providerId);\n      if (server) {\n        await server.connect(providerId, secret);\n        await refresh(context);\n        return;\n      }\n      if (secret !== null)\n        throw new Error(signIn.has(providerId) ? SIGN_IN_NEEDS_VAULT : KEY_NEEDS_VAULT);\n      if (given !== null) await fields.set(providerId, given);\n      await reread(context);\n      if (signIn.has(providerId)) await discover([providerId]);\n      await refresh(context);\n    },\n    async signIn(providerId) {\n      const server = routed(providerId);\n      if (server) return server.signIn(providerId);\n      if (providerId !== ADOBE) return null;\n      const { clientId, scopes, imsEnvironment } = await adobeConfig(\n        endpoint,\n        (input, init) => globalThis.fetch(input, init),\n        identity\n      );\n      return { clientId, scopes, imsEnvironment: imsEnvironment || 'prod' };\n    },\n    async dismissMoved(context) {\n      await moved?.dismiss(context);\n      await refresh(context);\n    },\n    async disconnect(providerId, context) {\n      const server = routed(providerId);\n      if (server) await server.disconnect(providerId);\n      else await fields.set(providerId, undefined);\n      await reread(context);\n      await refresh(context);\n    },\n  };\n}\n"],
-  "mappings": "AAAA,SAAuB,uBAAuB;AAC9C,SAAS,0BAA0B;AAEnC,SAAS,oBAAwC;AACjD,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,wBAAwB;AAEjC,SAAS,mBAAmB;AAC5B,SAAS,SAAS,sBAAsB;AAYxC,SAAS,WAAAA,UAAS,kBAAkB,kBAAAC,uBAAsB;AAEnD,MAAM,gBAAgB,EAAE,UAAU,SAAS,SAAS,iCAAiC;AACrF,MAAM,kBAAoD,EAAE,CAAC,OAAO,GAAG,YAAY;AAEnF,MAAM,iBAAoE;AAAA,EAC/E,CAAC,OAAO,GAAG,CAAC,EAAE,MAAM,UAAU,OAAO,SAAS,CAAC;AACjD;AACA,MAAM,YAA8C,EAAE,QAAQ,aAAa;AACpE,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AAE/B,eAAsB,oBACpB,aACA,WACA,QACgD;AAChD,QAAM,SAAS,IAAI,KAAK,MAAM,YAAY,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC;AAChF,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,OAAO,IAAI,SAAS,EAAE,EAAG;AAC9B,QAAI,CAAC,OAAO,UAAU,SAAS,EAAE,EAAE,UAAU,SAAS,eAAe;AACnE,YAAM,OAAO,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1E;AACA,UAAM,SAAS,eAAe,SAAS,IAAI,OAAO,UAAU,SAAS,EAAE,CAAC;AACxE,QAAI,OAAQ,QAAO,EAAE,UAAU,SAAS,IAAI,SAAS,OAAO,GAAG;AAAA,EACjE;AACA,SAAO;AACT;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,SAAS,KAAK,CAAC;AACzC,MAAM,SAAS,oBAAI,IAAI,CAAC,KAAK,CAAC;AAC9B,MAAM,eAAe,IAAI,KAAK;AAEvB,SAAS,eAAe,SAA8B;AAC3D,SAAO,CAAC,sBAAsB,GAAe,cAAc,EAAE,QAAQ,CAAC,CAAC;AACzE;AAEO,SAAS,mBAAmB,aAA+C;AAChF,SAAO;AAAA,IACL,MAAM,KAAK,YAAY,SAAS;AAC9B,YAAM,aAAa,MAAM,YAAY,KAAK,YAAY,OAAO;AAC7D,YAAM,SAAS,gBAAgB,UAAU;AACzC,UAAI,YAAY,SAAS,aAAa,CAAC,UAAU,WAAW,KAAK,YAAY;AAC3E,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,YAAY,KAAK,EAAE,GAAG,WAAW,KAAK,YAAY,OAAO,EAAE;AAAA,IACzE;AAAA,IACA,MAAM,CAAC,YAAY,YAAY,KAAK,OAAO;AAAA,IAC3C,QAAQ,CAAC,YAAY,IAAI,YAAY,YAAY,OAAO,YAAY,IAAI,OAAO;AAAA,IAC/E,QAAQ,CAAC,YAAY,YAAY,YAAY,OAAO,YAAY,OAAO;AAAA,EACzE;AACF;AAEO,SAAS,kBACd,aACA,YAAY,eAAe,GACZ;AACf,QAAM,SAAS,aAAa,EAAE,aAAa,mBAAmB,WAAW,EAAE,CAAC;AAC5E,aAAW,YAAY,UAAW,QAAO,YAAY,iBAAiB,QAAQ,CAAC;AAC/E,SAAO;AACT;AAEA,MAAM,QAAgC,EAAE,CAAC,OAAO,GAAG,WAAW,CAAC,KAAK,GAAG,QAAQ;AAE/E,SAAS,OACP,QACA,WACA,QACwB;AACxB,SAAO,OAAO;AAAA,IACZ,UACG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,EAC7C;AAAA,MAAQ,CAAC,aACR,OACG,UAAU,SAAS,EAAE,EACrB,IAAI,CAAC,UAAU;AAAA,QACd,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,QAC1B,GAAG,MAAM,IAAI,OAAO,MAAM,SAAS,EAAE,KAAK,SAAS,QAAQ,SAAS,EAAE;AAAA,MACxE,CAAC;AAAA,IACL;AAAA,EACJ;AACF;AAEA,SAAS,QACP,QACA,WACA,QACe;AACf,SAAO,UACJ,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C;AAAA,IAAQ,CAAC,aACR,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW;AAAA,MAC5C,IAAI,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,MAC9B,OAAO,MAAM;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,WAAW,QAAQ,MAAM,SAAS;AAAA,MAClC,QAAQ,MAAM,MAAM,SAAS,OAAO;AAAA,MACpC,eAAe,MAAM;AAAA,IACvB,EAAE;AAAA,EACJ;AACJ;AAEA,SAAS,SAAS,SAAsC,WAAuC;AAC7F,SAAO,UAAU,IAAI,CAAC,aAAa;AACjC,UAAM,SAAS,QAAQ,MAAM,SAAS,EAAE;AACxC,UAAM,SAAS,eAAe,SAAS,EAAE;AACzC,WAAO;AAAA,MACL,IAAI,SAAS;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,UAAU,SAAU,OAAO,IAAI,SAAS,EAAE,IAAI,aAAa,YAAa;AAAA,MACxE,QAAQ,CAAC,SAAS,iBAAiB,OAAO,UAAU,YAAY,YAAY;AAAA,MAC5E,MAAM,OAAO,IAAI,SAAS,EAAE,IAAI,UAAU;AAAA,MAC1C,OAAO,SAAS,IAAI,SAAS,EAAE,IAAI,wBAAwB;AAAA,MAC3D,OAAO;AAAA,MACP,GAAI,SAAS,EAAE,QAAQ,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACpE;AAAA,EACF,CAAC;AACH;AAQA,eAAsB,eACpB,OACA,WACyB;AACzB,QAAM,QAAQ,oBAAI,IAAoC;AACtD,aAAW,YAAY,WAAW;AAChC,UAAM,QAAS,MAAM,MAAM,IAAI,SAAS,SAAS,EAAE,EAAE;AACrD,QAAI,SAAS,OAAO,UAAU,SAAU,OAAM,IAAI,SAAS,IAAI,KAAK;AAAA,EACtE;AACA,SAAO;AAAA,IACL,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU;AAAA,IACzC,IAAI,YAAY;AACd,YAAM,SAAS,MAAM,IAAI,UAAU;AACnC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,OAAO;AAAA,QACZ,OAAO,QAAQ,MAAM,EAAE;AAAA,UAAQ,CAAC,CAAC,MAAM,KAAK,MAC1C,UAAU,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,YAAY,QAAQ;AAC5B,YAAM,UAAU,IAAI,KAAK,eAAe,UAAU,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AACrF,YAAM,OAAO,OAAO;AAAA,QAClB,OAAO,QAAQ,UAAU,CAAC,CAAC,EAAE;AAAA,UAC3B,CAAC,CAAC,MAAM,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,QACxF;AAAA,MACF;AACA,YAAM,OAAO,OAAO,KAAK,IAAI,EAAE,SAAS,OAAO;AAC/C,UAAI,KAAM,OAAM,IAAI,YAAY,IAAI;AAAA,UAC/B,OAAM,OAAO,UAAU;AAC5B,YAAM,MAAM,IAAI,SAAS,UAAU,IAAI,IAAI;AAAA,IAC7C;AAAA,EACF;AACF;AAIA,eAAe,OAAO,SAAsC,OAAoB;AAC9E,QAAM,MAAM,QAAQ,MAAM,KAAK,GAAG;AAClC,QAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,IAAI,IAAI;AACzD,SAAO,QAAQ,EAAE,UAAU,OAAO,GAAG,MAAM,IAAI;AACjD;AAOA,eAAsB,oBACpB,QACA,SACA,YAAY,eAAe,GAC3B,UAAyF,CAAC,GAClE;AACxB,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,SAAS,CAAC,eAAwB,WAAW,WAAW,WAAW,IAAI,MAAM;AACnF,QAAM,QAAQ,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,KAAK;AAChE,QAAM,WAAW,OAAO,WAAW;AACnC,QAAM,WAAY,OAAO,WAAkD,cAAc;AACzF,QAAM,QAAQ,QAAQ,UAAU,CAAC,UAAkB,WAAW,OAAO,EAAE,UAAU,SAAS,CAAC;AAC3F,QAAM,WAAW,YAAoC;AACnD,UAAM,SAAS,IAAI;AAAA,MACjB,UAAU,OAAO,CAAC,aAAa,QAAQ,MAAM,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,aAAa,SAAS,EAAE;AAAA,IAC1F;AACA,WAAO;AAAA,MACL,QAAQ,QAAQ,QAAQ,WAAW,MAAM;AAAA,MACzC,QAAQ,OAAO,QAAQ,WAAW,MAAM;AAAA,MACxC,UAAU,CAAC,GAAG,SAAS,SAAS,SAAS,GAAG,GAAK,MAAM,KAAK,SAAS,KAAM,CAAC,CAAE;AAAA,MAC9E,QAAQ,MAAM,OAAO,SAAS,KAAK;AAAA,MACnC,GAAI,OAAO,MAAM,OAAO,SACpB,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE,IACxD,CAAC;AAAA,IACP;AAAA,EACF;AACA,QAAM,QAAQ,gBAA+B,MAAM,SAAS,CAAC;AAC7D,MAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,OAAO,OAAO,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,SAAS,CAAC,CAAC;AAC7E,aAAS,KAAK,MAAM,MAAM,MAAS;AACnC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,UACd,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C,IAAI,CAAC,aAAa,SAAS,EAAE;AAChC,QAAM,WAAW,CAAC,QAChB,OAAO,QAAQ,EAAE,WAAW,IAAI,CAAC,EAAE;AAAA,IACjC,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACF,MAAI,SAAS,QAAQ;AACnB,UAAM,QAAQ,MACZ,KAAK,SAAS,QAAQ,EACnB,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EACtC,MAAM,MAAM,MAAS;AAC1B,UAAM;AACN,UAAM,QAAiB,YAAY,OAAO,QAAQ,SAAS,YAAY;AACvE,IAAC,MAAiC,QAAQ;AAAA,EAC5C;AACA,OAAK,SAAS,MAAM,KAAK,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS,CAAC;AAC3E,SAAO,MAAM,UAAU,CAAC,QAAQ,YAAY,KAAK,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS,CAAC;AACxF,QAAM,OAAO,MAAM,SAAS,OAAO,CAAC,OAAO,QAAQ,MAAM,EAAE,CAAC,EAAE,KAAK,GAAG;AACtE,MAAI,OAAO,KAAK;AAChB,UAAQ,MAAM,UAAU,MAAM;AAC5B,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,QAAQ;AACtB,WAAO;AACP,UAAM,aAAa,QAAQ,SAAS,QAAQ,IAAI,QAAQ,QAAQ;AAChE,SAAK,WAAW,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC/E,CAAC;AACD,QAAM,SAAS,CAAC,YAAqB,QAAQ,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AACnF,SAAO;AAAA,IACL;AAAA,IACA,MAAM,QAAQ,YAAY,QAAQ,OAAO,SAAS;AAChD,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,QAAQ;AACV,cAAM,OAAO,QAAQ,YAAY,MAAM;AACvC,cAAM,QAAQ,OAAO;AACrB;AAAA,MACF;AACA,UAAI,WAAW;AACb,cAAM,IAAI,MAAM,OAAO,IAAI,UAAU,IAAI,sBAAsB,eAAe;AAChF,UAAI,UAAU,KAAM,OAAM,OAAO,IAAI,YAAY,KAAK;AACtD,YAAM,OAAO,OAAO;AACpB,UAAI,OAAO,IAAI,UAAU,EAAG,OAAM,SAAS,CAAC,UAAU,CAAC;AACvD,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,IACA,MAAM,OAAO,YAAY;AACvB,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,QAAO,OAAO,OAAO,UAAU;AAC3C,UAAI,eAAe,MAAO,QAAO;AACjC,YAAM,EAAE,UAAU,QAAQ,eAAe,IAAI,MAAM;AAAA,QACjD;AAAA,QACA,CAAC,OAAO,SAAS,WAAW,MAAM,OAAO,IAAI;AAAA,QAC7C;AAAA,MACF;AACA,aAAO,EAAE,UAAU,QAAQ,gBAAgB,kBAAkB,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,IACA,MAAM,WAAW,YAAY,SAAS;AACpC,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,OAAM,OAAO,WAAW,UAAU;AAAA,UACzC,OAAM,OAAO,IAAI,YAAY,MAAS;AAC3C,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { type Context, replicatedState } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { CredentialStore, Provider } from '@earendil-works/pi-ai';\nimport { createModels, type MutableModels } from '@earendil-works/pi-ai/models';\nimport { amazonBedrockProvider } from '@earendil-works/pi-ai/providers/amazon-bedrock';\nimport {\n  ADOBE,\n  ADOBE_PROXY,\n  adobeConfig,\n  adobeIdentity,\n  adobeProvider,\n  adobeUsage,\n  type Budget,\n} from './adobe.ts';\nimport { abortableBedrock } from './bedrock.ts';\nimport type { McpAccounts } from './mcp/index.ts';\nimport { MCP_ACCOUNT } from './mcp/label.ts';\nimport { BEDROCK, preferredModel } from './preferred.ts';\nimport type { KeysMoved } from './secrets/legacy.ts';\nimport type { VaultRecords } from './secrets/records.ts';\nimport type { PlainStore } from './secrets/store.ts';\nimport type {\n  AccountField,\n  AccountState,\n  AgentSettings,\n  ModelChoice,\n  SettingsState,\n} from './services.ts';\n\nexport { BEDROCK, PREFERRED_MODELS, preferredModel } from './preferred.ts';\n\nexport const DEFAULT_MODEL = { provider: BEDROCK, modelId: 'us.anthropic.claude-sonnet-5-5' };\nexport const DEFAULT_REGIONS: Readonly<Record<string, string>> = { [BEDROCK]: 'us-west-2' };\n\nexport const ACCOUNT_FIELDS: Readonly<Record<string, readonly AccountField[]>> = {\n  [BEDROCK]: [{ name: 'region', label: 'Region' }],\n};\nconst FIELD_ENV: Readonly<Record<string, string>> = { region: 'AWS_REGION' };\nexport const SIGN_IN_NEEDS_VAULT = \"Adobe sign-in needs seven's vault: update seven\";\nexport const KEY_NEEDS_VAULT = \"API keys are kept in seven's vault: update seven\";\n\nexport async function resolveDefaultModel(\n  credentials: CredentialStore,\n  providers: Provider[],\n  models: MutableModels\n): Promise<{ provider: string; modelId: string }> {\n  const stored = new Set((await credentials.list()).map((info) => info.providerId));\n  for (const provider of providers) {\n    if (!stored.has(provider.id)) continue;\n    if (!models.getModels(provider.id).length && provider.refreshModels) {\n      await models.refresh({ providers: [provider.id] }).catch(() => undefined);\n    }\n    const chosen = preferredModel(provider.id, models.getModels(provider.id));\n    if (chosen) return { provider: provider.id, modelId: chosen.id };\n  }\n  return DEFAULT_MODEL;\n}\n\nconst corsFree = new Set([BEDROCK, ADOBE]);\nconst signIn = new Set([ADOBE]);\nconst BUDGET_EVERY = 5 * 60 * 1000;\n\nexport function sliccProviders(version?: string): Provider[] {\n  return [amazonBedrockProvider() as Provider, adobeProvider({ version })];\n}\n\nexport function withDefaultRegions(credentials: CredentialStore): CredentialStore {\n  return {\n    async read(providerId, options) {\n      const credential = await credentials.read(providerId, options);\n      const region = DEFAULT_REGIONS[providerId];\n      if (credential?.type !== 'api_key' || !region || credential.env?.AWS_REGION) {\n        return credential;\n      }\n      return { ...credential, env: { ...credential.env, AWS_REGION: region } };\n    },\n    list: (options) => credentials.list(options),\n    modify: (providerId, fn, options) => credentials.modify(providerId, fn, options),\n    delete: (providerId, options) => credentials.delete(providerId, options),\n  };\n}\n\nexport function createSliccModels(\n  credentials: CredentialStore,\n  providers = sliccProviders()\n): MutableModels {\n  const models = createModels({ credentials: withDefaultRegions(credentials) });\n  for (const provider of providers) models.setProvider(abortableBedrock(provider));\n  return models;\n}\n\nconst SHORT: Record<string, string> = { [BEDROCK]: 'Bedrock', [ADOBE]: 'Adobe' };\n\nfunction labels(\n  models: MutableModels,\n  providers: Provider[],\n  stored: ReadonlySet<string>\n): Record<string, string> {\n  return Object.fromEntries(\n    providers\n      .filter((provider) => !stored.has(provider.id))\n      .flatMap((provider) =>\n        models\n          .getModels(provider.id)\n          .map((model) => [\n            `${provider.id}/${model.id}`,\n            `${model.name} on ${SHORT[provider.id] ?? provider.name ?? provider.id}`,\n          ])\n      )\n  );\n}\n\nfunction choices(\n  models: MutableModels,\n  providers: Provider[],\n  stored: ReadonlySet<string>\n): ModelChoice[] {\n  return providers\n    .filter((provider) => stored.has(provider.id))\n    .flatMap((provider) =>\n      models.getModels(provider.id).map((model) => ({\n        id: `${provider.id}/${model.id}`,\n        label: model.name,\n        provider: provider.name ?? provider.id,\n        kind: 'chat' as const,\n        reasoning: Boolean(model.reasoning),\n        images: model.input.includes('image'),\n        contextWindow: model.contextWindow,\n      }))\n    );\n}\n\nfunction accounts(records: Pick<VaultRecords, 'model'>, providers: Provider[]): AccountState[] {\n  return providers.map((provider) => {\n    const record = records.model(provider.id);\n    const fields = ACCOUNT_FIELDS[provider.id];\n    return {\n      id: provider.id,\n      provider: provider.name ?? provider.id,\n      identity: record ? (signIn.has(provider.id) ? 'Adobe ID' : 'API key') : '',\n      status: !record ? 'disconnected' : record.state === 'expired' ? 'expired' : 'connected',\n      auth: signIn.has(provider.id) ? 'oauth' : 'api-key',\n      needs: corsFree.has(provider.id) ? 'cors-free-transport' : null,\n      store: 'vault',\n      ...(fields ? { fields: fields.map((field) => ({ ...field })) } : {}),\n    };\n  });\n}\n\nexport interface ProviderFields {\n  get(providerId: string): Readonly<Record<string, string>> | undefined;\n  env(providerId: string): Readonly<Record<string, string>> | undefined;\n  set(providerId: string, fields: Record<string, string> | undefined): Promise<void>;\n}\n\nexport async function providerFields(\n  store: PlainStore,\n  providers: readonly Provider[]\n): Promise<ProviderFields> {\n  const known = new Map<string, Record<string, string>>();\n  for (const provider of providers) {\n    const saved = (await store.get(`model:${provider.id}`)) as Record<string, string> | undefined;\n    if (saved && typeof saved === 'object') known.set(provider.id, saved);\n  }\n  return {\n    get: (providerId) => known.get(providerId),\n    env(providerId) {\n      const fields = known.get(providerId);\n      if (!fields) return undefined;\n      return Object.fromEntries(\n        Object.entries(fields).flatMap(([name, value]) =>\n          FIELD_ENV[name] ? [[FIELD_ENV[name], value]] : []\n        )\n      );\n    },\n    async set(providerId, fields) {\n      const allowed = new Set((ACCOUNT_FIELDS[providerId] ?? []).map((field) => field.name));\n      const kept = Object.fromEntries(\n        Object.entries(fields ?? {}).filter(\n          ([name, value]) => allowed.has(name) && typeof value === 'string' && value.trim() !== ''\n        )\n      );\n      const next = Object.keys(kept).length ? kept : undefined;\n      if (next) known.set(providerId, next);\n      else known.delete(providerId);\n      await store.set(`model:${providerId}`, next);\n    },\n  };\n}\n\nexport type UsageReader = (token: string) => Promise<Budget | null>;\n\nasync function budget(records: Pick<VaultRecords, 'model'>, usage: UsageReader) {\n  const key = records.model(ADOBE)?.placeholder;\n  const found = key ? await usage(key).catch(() => null) : null;\n  return found ? { provider: ADOBE, ...found } : null;\n}\n\nexport interface SettingsSources {\n  records: VaultRecords;\n  fields: ProviderFields;\n}\n\nexport async function createAgentSettings(\n  models: MutableModels,\n  sources: SettingsSources,\n  providers = sliccProviders(),\n  options: { usage?: UsageReader; every?: number; mcp?: McpAccounts; moved?: KeysMoved } = {}\n): Promise<AgentSettings> {\n  const { mcp, moved } = options;\n  const { records, fields } = sources;\n  const routed = (providerId: string) => (providerId.startsWith(MCP_ACCOUNT) ? mcp : undefined);\n  const adobe = providers.find((provider) => provider.id === ADOBE);\n  const endpoint = adobe?.baseUrl ?? ADOBE_PROXY;\n  const identity = (adobe?.headers as Record<string, string> | undefined) ?? adobeIdentity();\n  const usage = options.usage ?? ((token: string) => adobeUsage(token, { endpoint, identity }));\n  const snapshot = async (): Promise<SettingsState> => {\n    const stored = new Set(\n      providers.filter((provider) => records.model(provider.id)).map((provider) => provider.id)\n    );\n    return {\n      models: choices(models, providers, stored),\n      labels: labels(models, providers, stored),\n      accounts: [...accounts(records, providers), ...((await mcp?.accounts()) ?? [])],\n      budget: await budget(records, usage),\n      ...(moved?.state.value?.length\n        ? { moved: moved.state.value.map((name) => ({ ...name })) }\n        : {}),\n    };\n  };\n  const state = replicatedState<SettingsState>(await snapshot());\n  let latest = Promise.resolve();\n  const refresh = (context: Context) => {\n    const next = latest.then(async () => state.replace(context, await snapshot()));\n    latest = next.catch(() => undefined);\n    return next;\n  };\n  const signedIn = providers\n    .filter((provider) => signIn.has(provider.id))\n    .map((provider) => provider.id);\n  const discover = (ids: string[]) =>\n    models.refresh({ providers: ids }).then(\n      () => undefined,\n      () => undefined\n    );\n  if (signedIn.length) {\n    const cycle = () =>\n      void discover(signedIn)\n        .then(() => refresh(BACKGROUND_CONTEXT))\n        .catch(() => undefined);\n    cycle();\n    const timer: unknown = setInterval(cycle, options.every ?? BUDGET_EVERY);\n    (timer as { unref?: () => void }).unref?.();\n  }\n  mcp?.onChange(() => void refresh(BACKGROUND_CONTEXT).catch(() => undefined));\n  moved?.state.subscribe((_value, context) => void refresh(context).catch(() => undefined));\n  const held = () => signedIn.filter((id) => records.model(id)).join(' ');\n  let seen = held();\n  records.state.subscribe(() => {\n    const now = held();\n    const added = now !== seen;\n    seen = now;\n    const discovered = added ? discover(signedIn) : Promise.resolve();\n    void discovered.then(() => refresh(BACKGROUND_CONTEXT)).catch(() => undefined);\n  });\n  const reread = (context: Context) => records.refresh(context).catch(() => undefined);\n  return {\n    state,\n    async connect(providerId, secret, given, context) {\n      const server = routed(providerId);\n      if (server) {\n        await server.connect(providerId, secret);\n        await refresh(context);\n        return;\n      }\n      if (secret !== null)\n        throw new Error(signIn.has(providerId) ? SIGN_IN_NEEDS_VAULT : KEY_NEEDS_VAULT);\n      if (given !== null) await fields.set(providerId, given);\n      records.reconnected(providerId);\n      await reread(context);\n      if (signIn.has(providerId)) await discover([providerId]);\n      await refresh(context);\n    },\n    async signIn(providerId) {\n      const server = routed(providerId);\n      if (server) return server.signIn(providerId);\n      if (providerId !== ADOBE) return null;\n      const { clientId, scopes, imsEnvironment } = await adobeConfig(\n        endpoint,\n        (input, init) => globalThis.fetch(input, init),\n        identity\n      );\n      return { clientId, scopes, imsEnvironment: imsEnvironment || 'prod' };\n    },\n    async dismissMoved(context) {\n      await moved?.dismiss(context);\n      await refresh(context);\n    },\n    async disconnect(providerId, context) {\n      const server = routed(providerId);\n      if (server) await server.disconnect(providerId);\n      else await fields.set(providerId, undefined);\n      await reread(context);\n      await refresh(context);\n    },\n  };\n}\n"],
+  "mappings": "AAAA,SAAuB,uBAAuB;AAC9C,SAAS,0BAA0B;AAEnC,SAAS,oBAAwC;AACjD,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,wBAAwB;AAEjC,SAAS,mBAAmB;AAC5B,SAAS,SAAS,sBAAsB;AAYxC,SAAS,WAAAA,UAAS,kBAAkB,kBAAAC,uBAAsB;AAEnD,MAAM,gBAAgB,EAAE,UAAU,SAAS,SAAS,iCAAiC;AACrF,MAAM,kBAAoD,EAAE,CAAC,OAAO,GAAG,YAAY;AAEnF,MAAM,iBAAoE;AAAA,EAC/E,CAAC,OAAO,GAAG,CAAC,EAAE,MAAM,UAAU,OAAO,SAAS,CAAC;AACjD;AACA,MAAM,YAA8C,EAAE,QAAQ,aAAa;AACpE,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AAE/B,eAAsB,oBACpB,aACA,WACA,QACgD;AAChD,QAAM,SAAS,IAAI,KAAK,MAAM,YAAY,KAAK,GAAG,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC;AAChF,aAAW,YAAY,WAAW;AAChC,QAAI,CAAC,OAAO,IAAI,SAAS,EAAE,EAAG;AAC9B,QAAI,CAAC,OAAO,UAAU,SAAS,EAAE,EAAE,UAAU,SAAS,eAAe;AACnE,YAAM,OAAO,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,IAC1E;AACA,UAAM,SAAS,eAAe,SAAS,IAAI,OAAO,UAAU,SAAS,EAAE,CAAC;AACxE,QAAI,OAAQ,QAAO,EAAE,UAAU,SAAS,IAAI,SAAS,OAAO,GAAG;AAAA,EACjE;AACA,SAAO;AACT;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,SAAS,KAAK,CAAC;AACzC,MAAM,SAAS,oBAAI,IAAI,CAAC,KAAK,CAAC;AAC9B,MAAM,eAAe,IAAI,KAAK;AAEvB,SAAS,eAAe,SAA8B;AAC3D,SAAO,CAAC,sBAAsB,GAAe,cAAc,EAAE,QAAQ,CAAC,CAAC;AACzE;AAEO,SAAS,mBAAmB,aAA+C;AAChF,SAAO;AAAA,IACL,MAAM,KAAK,YAAY,SAAS;AAC9B,YAAM,aAAa,MAAM,YAAY,KAAK,YAAY,OAAO;AAC7D,YAAM,SAAS,gBAAgB,UAAU;AACzC,UAAI,YAAY,SAAS,aAAa,CAAC,UAAU,WAAW,KAAK,YAAY;AAC3E,eAAO;AAAA,MACT;AACA,aAAO,EAAE,GAAG,YAAY,KAAK,EAAE,GAAG,WAAW,KAAK,YAAY,OAAO,EAAE;AAAA,IACzE;AAAA,IACA,MAAM,CAAC,YAAY,YAAY,KAAK,OAAO;AAAA,IAC3C,QAAQ,CAAC,YAAY,IAAI,YAAY,YAAY,OAAO,YAAY,IAAI,OAAO;AAAA,IAC/E,QAAQ,CAAC,YAAY,YAAY,YAAY,OAAO,YAAY,OAAO;AAAA,EACzE;AACF;AAEO,SAAS,kBACd,aACA,YAAY,eAAe,GACZ;AACf,QAAM,SAAS,aAAa,EAAE,aAAa,mBAAmB,WAAW,EAAE,CAAC;AAC5E,aAAW,YAAY,UAAW,QAAO,YAAY,iBAAiB,QAAQ,CAAC;AAC/E,SAAO;AACT;AAEA,MAAM,QAAgC,EAAE,CAAC,OAAO,GAAG,WAAW,CAAC,KAAK,GAAG,QAAQ;AAE/E,SAAS,OACP,QACA,WACA,QACwB;AACxB,SAAO,OAAO;AAAA,IACZ,UACG,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,EAC7C;AAAA,MAAQ,CAAC,aACR,OACG,UAAU,SAAS,EAAE,EACrB,IAAI,CAAC,UAAU;AAAA,QACd,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,QAC1B,GAAG,MAAM,IAAI,OAAO,MAAM,SAAS,EAAE,KAAK,SAAS,QAAQ,SAAS,EAAE;AAAA,MACxE,CAAC;AAAA,IACL;AAAA,EACJ;AACF;AAEA,SAAS,QACP,QACA,WACA,QACe;AACf,SAAO,UACJ,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C;AAAA,IAAQ,CAAC,aACR,OAAO,UAAU,SAAS,EAAE,EAAE,IAAI,CAAC,WAAW;AAAA,MAC5C,IAAI,GAAG,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,MAC9B,OAAO,MAAM;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,WAAW,QAAQ,MAAM,SAAS;AAAA,MAClC,QAAQ,MAAM,MAAM,SAAS,OAAO;AAAA,MACpC,eAAe,MAAM;AAAA,IACvB,EAAE;AAAA,EACJ;AACJ;AAEA,SAAS,SAAS,SAAsC,WAAuC;AAC7F,SAAO,UAAU,IAAI,CAAC,aAAa;AACjC,UAAM,SAAS,QAAQ,MAAM,SAAS,EAAE;AACxC,UAAM,SAAS,eAAe,SAAS,EAAE;AACzC,WAAO;AAAA,MACL,IAAI,SAAS;AAAA,MACb,UAAU,SAAS,QAAQ,SAAS;AAAA,MACpC,UAAU,SAAU,OAAO,IAAI,SAAS,EAAE,IAAI,aAAa,YAAa;AAAA,MACxE,QAAQ,CAAC,SAAS,iBAAiB,OAAO,UAAU,YAAY,YAAY;AAAA,MAC5E,MAAM,OAAO,IAAI,SAAS,EAAE,IAAI,UAAU;AAAA,MAC1C,OAAO,SAAS,IAAI,SAAS,EAAE,IAAI,wBAAwB;AAAA,MAC3D,OAAO;AAAA,MACP,GAAI,SAAS,EAAE,QAAQ,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;AAAA,IACpE;AAAA,EACF,CAAC;AACH;AAQA,eAAsB,eACpB,OACA,WACyB;AACzB,QAAM,QAAQ,oBAAI,IAAoC;AACtD,aAAW,YAAY,WAAW;AAChC,UAAM,QAAS,MAAM,MAAM,IAAI,SAAS,SAAS,EAAE,EAAE;AACrD,QAAI,SAAS,OAAO,UAAU,SAAU,OAAM,IAAI,SAAS,IAAI,KAAK;AAAA,EACtE;AACA,SAAO;AAAA,IACL,KAAK,CAAC,eAAe,MAAM,IAAI,UAAU;AAAA,IACzC,IAAI,YAAY;AACd,YAAM,SAAS,MAAM,IAAI,UAAU;AACnC,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,OAAO;AAAA,QACZ,OAAO,QAAQ,MAAM,EAAE;AAAA,UAAQ,CAAC,CAAC,MAAM,KAAK,MAC1C,UAAU,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,YAAY,QAAQ;AAC5B,YAAM,UAAU,IAAI,KAAK,eAAe,UAAU,KAAK,CAAC,GAAG,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AACrF,YAAM,OAAO,OAAO;AAAA,QAClB,OAAO,QAAQ,UAAU,CAAC,CAAC,EAAE;AAAA,UAC3B,CAAC,CAAC,MAAM,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM;AAAA,QACxF;AAAA,MACF;AACA,YAAM,OAAO,OAAO,KAAK,IAAI,EAAE,SAAS,OAAO;AAC/C,UAAI,KAAM,OAAM,IAAI,YAAY,IAAI;AAAA,UAC/B,OAAM,OAAO,UAAU;AAC5B,YAAM,MAAM,IAAI,SAAS,UAAU,IAAI,IAAI;AAAA,IAC7C;AAAA,EACF;AACF;AAIA,eAAe,OAAO,SAAsC,OAAoB;AAC9E,QAAM,MAAM,QAAQ,MAAM,KAAK,GAAG;AAClC,QAAM,QAAQ,MAAM,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,IAAI,IAAI;AACzD,SAAO,QAAQ,EAAE,UAAU,OAAO,GAAG,MAAM,IAAI;AACjD;AAOA,eAAsB,oBACpB,QACA,SACA,YAAY,eAAe,GAC3B,UAAyF,CAAC,GAClE;AACxB,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,SAAS,CAAC,eAAwB,WAAW,WAAW,WAAW,IAAI,MAAM;AACnF,QAAM,QAAQ,UAAU,KAAK,CAAC,aAAa,SAAS,OAAO,KAAK;AAChE,QAAM,WAAW,OAAO,WAAW;AACnC,QAAM,WAAY,OAAO,WAAkD,cAAc;AACzF,QAAM,QAAQ,QAAQ,UAAU,CAAC,UAAkB,WAAW,OAAO,EAAE,UAAU,SAAS,CAAC;AAC3F,QAAM,WAAW,YAAoC;AACnD,UAAM,SAAS,IAAI;AAAA,MACjB,UAAU,OAAO,CAAC,aAAa,QAAQ,MAAM,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,aAAa,SAAS,EAAE;AAAA,IAC1F;AACA,WAAO;AAAA,MACL,QAAQ,QAAQ,QAAQ,WAAW,MAAM;AAAA,MACzC,QAAQ,OAAO,QAAQ,WAAW,MAAM;AAAA,MACxC,UAAU,CAAC,GAAG,SAAS,SAAS,SAAS,GAAG,GAAK,MAAM,KAAK,SAAS,KAAM,CAAC,CAAE;AAAA,MAC9E,QAAQ,MAAM,OAAO,SAAS,KAAK;AAAA,MACnC,GAAI,OAAO,MAAM,OAAO,SACpB,EAAE,OAAO,MAAM,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE,IACxD,CAAC;AAAA,IACP;AAAA,EACF;AACA,QAAM,QAAQ,gBAA+B,MAAM,SAAS,CAAC;AAC7D,MAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAM,UAAU,CAAC,YAAqB;AACpC,UAAM,OAAO,OAAO,KAAK,YAAY,MAAM,QAAQ,SAAS,MAAM,SAAS,CAAC,CAAC;AAC7E,aAAS,KAAK,MAAM,MAAM,MAAS;AACnC,WAAO;AAAA,EACT;AACA,QAAM,WAAW,UACd,OAAO,CAAC,aAAa,OAAO,IAAI,SAAS,EAAE,CAAC,EAC5C,IAAI,CAAC,aAAa,SAAS,EAAE;AAChC,QAAM,WAAW,CAAC,QAChB,OAAO,QAAQ,EAAE,WAAW,IAAI,CAAC,EAAE;AAAA,IACjC,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AACF,MAAI,SAAS,QAAQ;AACnB,UAAM,QAAQ,MACZ,KAAK,SAAS,QAAQ,EACnB,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EACtC,MAAM,MAAM,MAAS;AAC1B,UAAM;AACN,UAAM,QAAiB,YAAY,OAAO,QAAQ,SAAS,YAAY;AACvE,IAAC,MAAiC,QAAQ;AAAA,EAC5C;AACA,OAAK,SAAS,MAAM,KAAK,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS,CAAC;AAC3E,SAAO,MAAM,UAAU,CAAC,QAAQ,YAAY,KAAK,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS,CAAC;AACxF,QAAM,OAAO,MAAM,SAAS,OAAO,CAAC,OAAO,QAAQ,MAAM,EAAE,CAAC,EAAE,KAAK,GAAG;AACtE,MAAI,OAAO,KAAK;AAChB,UAAQ,MAAM,UAAU,MAAM;AAC5B,UAAM,MAAM,KAAK;AACjB,UAAM,QAAQ,QAAQ;AACtB,WAAO;AACP,UAAM,aAAa,QAAQ,SAAS,QAAQ,IAAI,QAAQ,QAAQ;AAChE,SAAK,WAAW,KAAK,MAAM,QAAQ,kBAAkB,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC/E,CAAC;AACD,QAAM,SAAS,CAAC,YAAqB,QAAQ,QAAQ,OAAO,EAAE,MAAM,MAAM,MAAS;AACnF,SAAO;AAAA,IACL;AAAA,IACA,MAAM,QAAQ,YAAY,QAAQ,OAAO,SAAS;AAChD,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,QAAQ;AACV,cAAM,OAAO,QAAQ,YAAY,MAAM;AACvC,cAAM,QAAQ,OAAO;AACrB;AAAA,MACF;AACA,UAAI,WAAW;AACb,cAAM,IAAI,MAAM,OAAO,IAAI,UAAU,IAAI,sBAAsB,eAAe;AAChF,UAAI,UAAU,KAAM,OAAM,OAAO,IAAI,YAAY,KAAK;AACtD,cAAQ,YAAY,UAAU;AAC9B,YAAM,OAAO,OAAO;AACpB,UAAI,OAAO,IAAI,UAAU,EAAG,OAAM,SAAS,CAAC,UAAU,CAAC;AACvD,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,IACA,MAAM,OAAO,YAAY;AACvB,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,QAAO,OAAO,OAAO,UAAU;AAC3C,UAAI,eAAe,MAAO,QAAO;AACjC,YAAM,EAAE,UAAU,QAAQ,eAAe,IAAI,MAAM;AAAA,QACjD;AAAA,QACA,CAAC,OAAO,SAAS,WAAW,MAAM,OAAO,IAAI;AAAA,QAC7C;AAAA,MACF;AACA,aAAO,EAAE,UAAU,QAAQ,gBAAgB,kBAAkB,OAAO;AAAA,IACtE;AAAA,IACA,MAAM,aAAa,SAAS;AAC1B,YAAM,OAAO,QAAQ,OAAO;AAC5B,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,IACA,MAAM,WAAW,YAAY,SAAS;AACpC,YAAM,SAAS,OAAO,UAAU;AAChC,UAAI,OAAQ,OAAM,OAAO,WAAW,UAAU;AAAA,UACzC,OAAM,OAAO,IAAI,YAAY,MAAS;AAC3C,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,OAAO;AAAA,IACvB;AAAA,EACF;AACF;",
   "names": ["BEDROCK", "preferredModel"]
 }

package/dist/types/mcp/credentials.d.ts

@@ -3,10 +3,15 @@ export declare const MCP_CREDENTIAL_PREFIX = "mcp:";
 export interface McpRecords {
     mcp(server: string, name?: string): {
         placeholder: string;
+        state?: string;
     } | undefined;
 }
 export declare function credentialKey(server: string, url: string): Promise<string>;
 export declare function secretNames(config: McpServerConfig): string[];
+export declare function heldRecords(server: string, config: McpServerConfig, records: McpRecords): ({
+    placeholder: string;
+    state?: string;
+} | undefined)[];
 export type Resolved = {
     ok: true;
     headers: Record<string, string>;

package/dist/types/secrets/fetch.d.ts

@@ -6,7 +6,7 @@ export type ModelRoute = (request: Request) => string | null | undefined;
 export declare function absent(vault: Pick<Vault, 'connected' | 'needed'>): boolean;
 export declare function refusal(error: unknown): Response;
 export declare function safeError(error: unknown, original: OutgoingRequest, ready: OutgoingRequest): DOMException | TypeError;
-export declare function vaultFetch(vault: Port, inner: Fetch, route: ModelRoute): Fetch;
+export declare function vaultFetch(vault: Port, inner: Fetch, route: ModelRoute, rejecting?: (provider: string) => () => void): Fetch;
 export declare function mcpFetch(vault: Port, inner: Fetch, server: string): Fetch;
 export declare const NO_VAULT_SIGN_IN = "MCP sign-in needs seven's vault: update seven";
 export declare function grantFetch(vault: Port, server: string, base: Fetch): Fetch;

package/dist/types/secrets/records.d.ts

@@ -7,7 +7,10 @@ export interface VaultRecords {
     refresh(context: Context): Promise<void>;
     model(provider: string): AgentRecord | undefined;
     mcp(server: string, name?: string): AgentRecord | undefined;
+    rejecting(provider: string): () => void;
+    reconnected(provider: string): void;
     close(): void;
 }
 type Source = Pick<Vault, 'state' | 'records' | 'connected' | 'needed'>;
-export declare function vaultRecords(vault: Source): VaultRecords;
+export declare function lapsed(record: Pick<AgentRecord, 'state' | 'expiresAt'>, now: number): boolean;
+export declare function vaultRecords(vault: Source, now?: () => number): VaultRecords;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "6.3.0",
+  "version": "6.3.2",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",