@ai-ecoverse/slicc-agent 6.8.1 → 6.11.0

package/README.md

@@ -138,9 +138,9 @@ const owner = await startAgent({
 
 `runAgentWorker(self, options)` is the same with its parts replaceable (model, providers, kernel attach, the account store, storage).
 
-**Providers.** `sliccProviders()` registers Bedrock, Adobe and every pi-ai provider that takes a plain API key: Anthropic, OpenAI, Mistral, Groq, DeepSeek, Together, Hugging Face, Xiaomi and its three token plans, Cerebras, OpenRouter, Fireworks, Baseten, Moonshot AI and its China platform, xAI, Meta, Vercel AI Gateway, MiniMax and MiniMax CN, Z.AI and Z.AI Coding CN, NVIDIA, Kimi For Coding, Ant Ling, OpenCode Zen and Go, and the three Qwen token plans (`KEY_PROVIDERS` in `src/providers.ts`, each with its id, pi-ai factory, pi-ai env name, a description, a key URL and whether it answers browsers). Three more take a key and non-secret fields (`auth: 'fields'`), each checked in `connect` and mapped to pi-ai's env: Azure (`endpoint`, required: a resource name becomes `AZURE_OPENAI_RESOURCE_NAME`, an `https:` URL without a port or user name `AZURE_OPENAI_BASE_URL`; `deployments`, optional `model=deployment` pairs, `AZURE_OPENAI_DEPLOYMENT_NAME_MAP`), Cloudflare Workers AI (`account`, 32 hex characters, `CLOUDFLARE_ACCOUNT_ID`) and Cloudflare AI Gateway (`account` and `gateway`, `CLOUDFLARE_GATEWAY_ID`). Bedrock's `region` is on the same mechanism. A bad value rejects `connect` with a sentence, a required field left out keeps its stored value or rejects with “{label} can’t be empty.”, and a stored value that no longer passes is left out of the env. A fields provider whose required fields are missing or no longer pass shows as not connected, gives pi-ai no credential and offers no models, even with its key already in the vault (spectrum puts the key before `connect` checks the fields). Bedrock's region is any AWS region name (`eusc-de-east-1` and `us-gov-west-1` included), and stored values are trimmed. OpenCode Zen and OpenCode Go need seven's vault 1.12.2 or later, whose built-in table has their `/inference` endpoints; their descriptions say so. Azure's `endpoint` field says `customBase: true`: when its value is a full URL, spectrum registers it with the vault (the page's `endpoints`) before `connect`, since the agent never registers model endpoints for pi-ai providers; a resource name needs nothing, as `*.openai.azure.com` is built into the vault. The worker routes requests to an Azure account's base URL as Azure's. Google and Google Vertex wait for slicc-bios to stop removing `@google/genai`; the sign-ins come later. A provider's preferred model is pi-coding-agent 1.3.0's `defaultModelPerProvider` (Bedrock keeps `us.anthropic.claude-sonnet-5-5`), and the first model when that one is missing. Providers that don't answer a browser's preflight with the headers pi-ai sends (`x-api-key`, `anthropic-version`, the SDK's `x-stainless-*`, or `Authorization` under a bare `*`) say `needs: 'cors-free-transport'`; the direct ones are Anthropic, OpenAI, Mistral, Groq, DeepSeek, Together, Hugging Face and the four Xiaomi providers.
+**Providers.** `sliccProviders()` registers Bedrock, Adobe and every pi-ai provider that takes a plain API key: Anthropic, OpenAI, Mistral, Groq, DeepSeek, Together, Hugging Face, Xiaomi and its three token plans, Cerebras, OpenRouter, Fireworks, Baseten, Moonshot AI and its China platform, xAI, Meta, Vercel AI Gateway, MiniMax and MiniMax CN, Z.AI and Z.AI Coding CN, NVIDIA, Kimi For Coding, Ant Ling, OpenCode Zen and Go, and the three Qwen token plans (`KEY_PROVIDERS` in `src/providers.ts`, each with its id, pi-ai factory, pi-ai env name, a description, a key URL and whether it answers browsers). Three more take a key and non-secret fields (`auth: 'fields'`), each checked in `connect` and mapped to pi-ai's env: Azure (`endpoint`, required: a resource name becomes `AZURE_OPENAI_RESOURCE_NAME`, an `https:` URL without a port or user name `AZURE_OPENAI_BASE_URL`; `deployments`, optional `model=deployment` pairs, `AZURE_OPENAI_DEPLOYMENT_NAME_MAP`), Cloudflare Workers AI (`account`, 32 hex characters, `CLOUDFLARE_ACCOUNT_ID`) and Cloudflare AI Gateway (`account` and `gateway`, `CLOUDFLARE_GATEWAY_ID`). Bedrock's `region` is on the same mechanism. A bad value rejects `connect` with a sentence, a required field left out keeps its stored value or rejects with “{label} can’t be empty.”, and a stored value that no longer passes is left out of the env. A fields provider whose required fields are missing or no longer pass shows as not connected, gives pi-ai no credential and offers no models, even with its key already in the vault (spectrum puts the key before `connect` checks the fields). Bedrock's region is any AWS region name (`eusc-de-east-1` and `us-gov-west-1` included), and stored values are trimmed. OpenCode Zen and OpenCode Go need seven's vault 1.12.2 or later, whose built-in table has their `/inference` endpoints; their descriptions say so. Azure's `endpoint` field says `customBase: true`: when its value is a full URL, spectrum registers it with the vault (the page's `endpoints`) before `connect`, since the agent never registers model endpoints for pi-ai providers; a resource name needs nothing, as `*.openai.azure.com` is built into the vault. The worker routes requests to an Azure account's base URL as Azure's. Google and Google Vertex wait for slicc-bios to stop removing `@google/genai`; the sign-ins come later. A provider's preferred model is pi-coding-agent 1.3.0's `defaultModelPerProvider` (Bedrock keeps `us.anthropic.claude-sonnet-5-5`), and the first model when that one is missing. Providers that don't answer a browser's preflight with the headers pi-ai sends (`x-api-key`, `anthropic-version`, the SDK's `x-stainless-*`, or `Authorization` under a bare `*`) say `needs: 'cors-free-transport'`; the direct ones are Anthropic, OpenAI, Mistral, Groq, DeepSeek, Together, Hugging Face, Baseten, both Moonshot AI platforms, Azure and the four Xiaomi providers. The worker's transport fetch drops the Stainless SDKs' `x-stainless-*` telemetry headers from every request it sends, which is what Baseten's and Moonshot AI's preflights refuse.
 
-The first provider is AWS Bedrock with a Bedrock API key as the bearer token; the default model is `us.anthropic.claude-sonnet-5-5`. Requests go to `us-west-2` unless the account's `region` field names another one (`AWS_REGION`). The account publishes that field as `fields: [{ name: 'region', label: 'Region', placeholder, help }]`, and `connect` takes it. Bedrock sends no CORS headers, so it needs a CORS-free transport, and its account says so (`needs: 'cors-free-transport'`).
+The first provider is AWS Bedrock with a Bedrock API key as the bearer token; the default model is `us.anthropic.claude-sonnet-5-5`. Requests go to `us-west-2` unless the account's `region` field names another one (`AWS_REGION`). The account publishes that field as `fields: [{ name: 'region', label: 'Region', help, options, value }]`, and `connect` takes it. Bedrock sends no CORS headers, so it needs a CORS-free transport, and its account says so (`needs: 'cors-free-transport'`).
 
 **Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and seals the token in the vault itself (bios: `seal { kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }`), so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that resolves `{ sealed: true }`; the adapter then calls `connect('adobe')` with no secret. A `login` that still returns a token is refused with "Adobe sign-in needs seven's vault: update seven", and the token never reaches the worker. IMS gives no refresh token, so an expired record shows the account as `expired`, and Sign in (or Reconnect) runs `login` again. The worker derives that from each vault record (`records()`, any account kind, MCP rows included): a record that isn't `ready` or `refreshing` (such as `inert`), or whose `expiresAt` (epoch milliseconds, the vault's `EpochMs`) has passed, reads `expired`, and a timer flips it when the clock reaches `expiresAt`, so an open page needn't wait for the vault to change. A model request that still gets a 401 after the vault's one refresh marks the record it was sent with `expired` too, until that record changes (a new sign-in gives it a new `expiresAt`) or the account is connected again (`connect`), not when an unrelated record changes, so the error card's **Log in** lands on an account that offers Sign in. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state as `budget` (refreshed on connect and every five minutes), and the `tray` adapter shows it in spectrum's TrayStatus. Until the proxy allows `*.sliccy.ai` (vibemigration#228), Adobe needs a CORS-free transport like Bedrock. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**, reads “Log in again to continue.” (the raw error goes to the console once, already scrubbed, never onto the card) and names its account (`account: 'adobe'`, spectrum ≥ 1.88.0), so Log in calls `settings.connect('adobe')` inside the click and spectrum's card follows the sign-in (its own copy while signing in, then “Signed in to Adobe again.”, from the account's `provider`), or shows the failure as a sentence (a `login` that rejects with “the sign-in timed out” reads “The sign-in timed out.”; a cancel stays an `AbortError`, which shows nothing). A rejected or missing key's card, and the “isn't connected” error, name their account too, so spectrum opens Settings at that row; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
 
@@ -150,7 +150,7 @@ The first provider is AWS Bedrock with a Bedrock API key as the bearer token; th
 
 **Settings.** The `slicc.agent.settings` service shows the models and accounts and takes `connect(providerId, secret, fields)`, `disconnect(providerId)` and `remove(providerId)`. An account's `id` is its lookup key: the pi-ai provider id for model accounts (the vault record's `provider`), and `mcp:<server>` for MCP servers (the record's `server` is the `mcp.json` key); `provider` is only the display name. Accounts whose key the agent reads from the vault carry `store: 'vault'`: spectrum (SPEC-S4) `put`s the key into the vault itself, then calls `connect(id)` with no secret, and the agent rereads `records()`. `fields` holds an account's non-secret settings (`Account.fields`, unknown names ignored), kept in `/.slicc/accounts.json`. Removing the key is spectrum's `vault.remove(name, kind)`, since the agent port can't remove records.
 
-**Adding providers.** The settings state's `providers` lists every provider seven can add (`ProviderOption`: `id`, `name`, `description`, `auth`, `keyUrl`, `needs`, `fields` and `vaultName`, sorted by name), and the spectrum adapter serves it as `providers()` with a `providers` event when it changes. `accounts` then lists only the added ones: Bedrock and Adobe start as added, `connect` adds a provider, and one with a vault record or stored fields counts as added too. The added list is `providers` in `/.slicc/accounts.json`. `vaultName` is the record name spectrum `put`s the key under: pi-ai's env name, or `<ID>_API_KEY` for providers that share one (Moonshot AI, OpenCode and the Qwen token plans), since a `put` under another provider's name would rebind that record; Bedrock's is `AWS_BEARER_TOKEN_BEDROCK` and Adobe's `ADOBE_IMS_TOKEN`. The agent finds a provider's record by its `provider`, never by name. Each provider has at most one secret, its key; `fields` are the non-secret inputs (`name`, `label`, `required`, `placeholder`, `help` and `customBase`). `disconnect(id)` keeps the row and its fields, so connecting again needs only the key, and `remove(id)` drops the row and its fields; for both, spectrum removes the vault record first. On an MCP row, `remove` disconnects it. `connect` with a secret is refused for every model account ("API keys are kept in seven's vault: update seven"); the only secret it still takes is an MCP sign-in's callback answer.
+**Adding providers.** The settings state's `providers` lists every provider seven can add (`ProviderOption`: `id`, `name`, `description`, `auth`, `keyUrl`, `needs`, `fields` and `vaultName`, sorted by name), and the spectrum adapter serves it as `providers()` with a `providers` event when it changes. `accounts` then lists only the added ones: Bedrock and Adobe start as added, `connect` adds a provider, and one with a vault record or stored fields counts as added too. The added list is `providers` in `/.slicc/accounts.json`. `vaultName` is the record name spectrum `put`s the key under: pi-ai's env name, or `<ID>_API_KEY` for providers that share one (Moonshot AI, OpenCode and the Qwen token plans), since a `put` under another provider's name would rebind that record; Bedrock's is `AWS_BEARER_TOKEN_BEDROCK` and Adobe's `ADOBE_IMS_TOKEN`. The agent finds a provider's record by its `provider`, never by name. Each provider has at most one secret, its key; `fields` are the non-secret inputs (`name`, `label`, `required`, `placeholder`, `help`, `customBase`, `options` and `value`). On an added account each field's `value` is its stored value, trimmed, so Settings can show it and knows a custom base URL to unregister after a reload; a field with a default carries that instead (Bedrock's `us-west-2`). Bedrock's `region` has `options`, the 21 regions where AWS supports Bedrock API keys (the bearer token seven uses; AWS's “Supported Regions … for Amazon Bedrock API keys”), labelled with AWS's names (`Europe (Frankfurt), eu-central-1`); a stored region outside the list comes first, under its own name, so a select never shows a region the account doesn't use. `disconnect(id)` keeps the row and its fields, so connecting again needs only the key, and `remove(id)` drops the row and its fields; for both, spectrum removes the vault record first. On an MCP row, `remove` disconnects it. `connect` with a secret is refused for every model account ("API keys are kept in seven's vault: update seven"); the only secret it still takes is an MCP sign-in's callback answer.
 
 ### In slicc-spectrum
 
@@ -359,7 +359,7 @@ MCP servers reachable over Streamable HTTP become native agent tools. The client
 
 **Secrets.** `${NAME}` placeholders resolve to the vault's placeholders for that server (`records()`: an `mcp` record with `server` equal to the `mcp.json` key and that name, else the server's only record when the headers use one name, else an unbound record of that name, which covers mcpcat's `${MCP_<NAME>_TOKEN}` bridge tokens). The headers go out holding placeholders, and the vault fills them in its `mcp` op, only for that server's registered URL. A server whose record is missing comes up as needing one, with a lick, and reconnects when the record appears. The worker never holds a value; server log lines are scrubbed through the vault before they reach `~/.pi/agent/mcp.log`. **OAuth.** A server without an `Authorization` header that answers 401 needs a sign-in, as in pi. Its row in Settings › MCP servers offers Connect, which opens a pop-up on the authorization server, found through the server's protected-resource metadata (RFC 9728) or `oauth.authServerMetadataUrl`. SLICC registers itself dynamically as a public client named `SLICC` (`oauth.clientName` changes it), or uses `oauth.clientId`, with PKCE S256 and the redirect URI `https://<origin>/oauth/mcp-callback`. slicc-bios serves that path from `dist/oauth/mcp-callback.html` in this package. The callback page hands the code back over the `slicc-mcp-oauth` BroadcastChannel and clears it from its address. Before the pop-up opens, the worker registers the server's `tokenUrl` (the discovered `token_endpoint`, else `<authServer>/token`) with the vault. It exchanges the code, checking `state` and `iss`, as a prepared `mcp` request to that `tokenUrl`, and hands the token response straight to the vault's `grant`; the raw response is dropped, and pi-mcp keeps only the reply, which holds placeholders, with the client and discovery state in `/.slicc/accounts.json` under the server's name and URL. When the server answers 401, the worker asks the vault to `refresh` once and sends again; pi-mcp's own refresh is off, because the refresh token is a placeholder. When that fails, the row shows the sign-in as expired. Disconnect deletes the local state; spectrum removes the vault records. Without a vault, the exchange is refused ("MCP sign-in needs seven's vault: update seven") before any token is issued. `oauth.scope` sets the scopes, else the server's advertised ones are used. `clientSecret`, `callbackPort`, `callbackUrl` and `clientRegistration` are refused, because SLICC signs in as a public client through its own page.
 
-**Settings › MCP servers** lists each server whose headers use a placeholder, under its own heading below Accounts, with the URL host. Connect takes the token, which fills every placeholder of a server that uses one name; a server whose headers use several different names can't be filled from Settings yet. The server then reconnects. A server that answers 401 shows as **Rejected**, with Reconnect, and Disconnect deletes the token. Tool cards and remote summaries label MCP calls `server · tool`, unless the name is ambiguous (a server name that starts or ends with `_`, or a name with more than two `__` separators); then they show the raw name.
+**Settings › MCP servers** lists each server whose headers use a placeholder, under its own heading below Accounts, with the URL host. The page can ask for a server's URL, the `mcp.json` URL without user name, password, query or fragment, with `serverUrl('mcp:<server>')`, so it can register it with the vault (its `endpoints` op) before it connects a token it put there; from slicc-vault 1.13.0 a page-sealed token is filled only on a URL the page registered. The URL is never in the replicated settings state, since a path can carry a token and view-only principals read that state; `serverUrl` is a settings method, which view-only principals don't get, and it answers `null` for model accounts. The spectrum adapter fills each MCP account's `url` from it. Connect takes the token, which fills every placeholder of a server that uses one name; a server whose headers use several different names can't be filled from Settings yet. The server then reconnects. A server that answers 401 shows as **Rejected**, with Reconnect, and Disconnect deletes the token. Tool cards and remote summaries label MCP calls `server · tool`, unless the name is ambiguous (a server name that starts or ends with `_`, or a name with more than two `__` separators); then they show the raw name.
 
 **Tools.** Tools are named `mcp__<server>__<tool>` (pi's names: everything but letters, digits and `_` becomes `_`, cut to 64 characters with a hash suffix on a collision). Their exposure follows pi:
 - `codemode` (the default): callable from codemode scripts as `tools.mcp__docs__search(args)`, which resolves to the whole `CallToolResult`, but not declared to the model. The `mcp_servers` section lists these servers with their description or the first line of the server's instructions. It also says that MCP results are data from the server, not instructions.

package/dist/client.js

@@ -48,6 +48,7 @@ function lastingSettings(settings, hold) {
     connect: (providerId, secret, fields, context) => settings.connect(providerId, secret, fields, context),
     disconnect: (providerId, context) => settings.disconnect(providerId, context),
     remove: (providerId, context) => settings.remove(providerId, context),
+    serverUrl: (providerId, context) => settings.serverUrl(providerId, context),
     signIn: (providerId, context) => settings.signIn(providerId, context),
     dismissMoved: (context) => settings.dismissMoved(context)
   };

package/dist/client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/client.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createHost,\n  type Host,\n  isChordError,\n  type Readable,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ApprovalPolicy } from './approvals/policy.ts';\nimport type { Approval } from './approvals/record.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { ImportProgress } from './freezer/v6.ts';\nimport type { GuestSeat } from './guests/seats.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport { controlAnswer, pageAnswer, remoteAnswer, settingsAnswer } from './readonly.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  CONTROL_METHODS,\n  type Command,\n  type Delivered,\n  type GuestProposal,\n  type GuestShown,\n  type MonitorFeed,\n  PAGE_METHODS,\n  type PrivateRevision,\n  REMOTE_METHODS,\n  SETTINGS_METHODS,\n  type SendMode,\n  type SettingsState,\n  TRANSCRIPT_STATES,\n} from './services.ts';\nimport { type AgentPrincipal, bound, type Remote, type Root, replicated, SELF } from './serving.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { otherVersion, type PortEndpoint, PortLink } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly privateRevision?: ReplicatedState<PrivateRevision>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly importing?: ReplicatedState<ImportProgress>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly vault?: ReplicatedState<VaultState>;\n  readonly labels?: ReplicatedState<Record<string, string>>;\n  readonly guests?: ReplicatedState<GuestSeat[]>;\n  readonly viewOnly?: boolean;\n  readonly guest?: GuestShown;\n  readonly proposals?: ReplicatedState<GuestProposal[]>;\n  readonly owner?: boolean;\n  readonly approvals?: ReplicatedState<Approval[]>;\n  readonly approvalPolicy?: ReplicatedState<ApprovalPolicy>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  readonly readOnly?: boolean;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, fields, context) =>\n      settings.connect(providerId, secret, fields, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    remove: (providerId, context) => settings.remove(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n    dismissMoved: (context) => settings.dismissMoved(context),\n  };\n}\n\nconst VERSIONS = new Set(['upgrade_required', 'contract_mismatch']);\n\nexport const final = (error: unknown): unknown =>\n  isChordError(error) && VERSIONS.has(error.code) ? otherVersion(error) : error;\n\nexport const ended = (link: PortLink): Promise<never> =>\n  link.ended.then((reason) => {\n    throw reason ?? new Error('the agent closed the link');\n  });\n\ntype Contract = Parameters<Host<AgentPrincipal>['get']>[0];\n\nexport function clientHost(link: PortLink, name: string): Host<AgentPrincipal> {\n  const host = createHost<AgentPrincipal>({\n    name: `${name}:${crypto.randomUUID()}`,\n    kind: 'client',\n    self: SELF,\n  });\n  host.connect(link, { principal: SELF, onProtocolMismatch: () => link.mismatched() });\n  return host;\n}\n\nexport async function holding(\n  host: Host<AgentPrincipal>,\n  link: PortLink,\n  contracts: readonly Contract[]\n): Promise<Remote[]> {\n  const stop = new AbortController();\n  const getting = contracts.map(\n    (contract) =>\n      host.get(contract, {}, { signal: stop.signal }) as Promise<unknown> as Promise<Remote>\n  );\n  try {\n    return await Promise.race([Promise.all(getting), ended(link)]);\n  } catch (error) {\n    stop.abort();\n    for (const got of getting)\n      void got.then(\n        (ref) => ref.release(),\n        () => undefined\n      );\n    link.close('handshake failed');\n    void host.close().catch(() => undefined);\n    throw error;\n  }\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const link = new PortLink(endpoint);\n  const serverId = await link.hello;\n  const host = clientHost(link, 'follower');\n  const handles = await holding(host, link, [\n    AgentControl,\n    AgentTranscript,\n    AgentSettings,\n    AgentRemoteService,\n    AgentPagesService,\n  ]).catch((error: unknown) => {\n    throw final(error);\n  });\n  const [controlHandle, transcriptHandle, settingsHandle, remoteHandle, pagesHandle] = handles as [\n    Remote,\n    Remote,\n    Remote,\n    Remote,\n    Remote,\n  ];\n  const release = () => {\n    for (const handle of handles) handle.release();\n  };\n  const root: Root = (run, rootOptions) => host.root(run, rootOptions);\n  const control = bound<AgentControl>(controlHandle, root, CONTROL_METHODS, controlAnswer);\n  const members = Object.fromEntries(\n    TRANSCRIPT_STATES.map((name) => [name, transcriptHandle[name] as Readable<unknown>])\n  ) as Record<(typeof TRANSCRIPT_STATES)[number], Readable<unknown>>;\n  const settingsState = settingsHandle.state as Readable<SettingsState>;\n  const settings: AgentSettings = {\n    ...bound<Omit<AgentSettings, 'state'>>(settingsHandle, root, SETTINGS_METHODS, settingsAnswer),\n    state: replicated(settingsState),\n  };\n  const remote = bound<AgentRemote>(remoteHandle, root, REMOTE_METHODS, remoteAnswer);\n  const pages = bound<AgentPages>(pagesHandle, root, PAGE_METHODS, pageAnswer);\n  const state = <K extends keyof typeof members>(name: K) =>\n    replicated(members[name] as Readable<never>);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  let open = true;\n  const finish = () => {\n    if (!open) return;\n    open = false;\n    for (const kept of held) kept.freeze();\n    release();\n  };\n  const closed = link.ended.then((reason) => {\n    finish();\n    return reason;\n  });\n  return {\n    serverId,\n    readOnly: controlHandle.variant === 'view',\n    control,\n    transcript: hold<ConversationView>(state('state')),\n    deliveries: hold<Record<string, Delivered>>(state('deliveries')),\n    agents: hold<AgentsSummary>(state('agents')),\n    views: hold<Record<string, ConversationView>>(state('views')),\n    commands: hold<Command[]>(state('commands')),\n    privateRevision: hold<PrivateRevision>(state('privateRevision')),\n    sprinkles: hold<Sprinkle[]>(state('sprinkles')),\n    memories: hold<MemoryEntry[]>(state('memories')),\n    memoryScopes: hold<MemoryScope[]>(state('memoryScopes')),\n    frozen: hold<FrozenCone[]>(state('frozen')),\n    importing: hold<ImportProgress>(state('importing')),\n    changes: hold<ChangesView>(state('changes')),\n    monitor: hold<MonitorFeed>(state('monitor')),\n    vault: hold<VaultState>(state('vault')),\n    labels: hold<Record<string, string>>(state('labels')),\n    guests: hold<GuestSeat[]>(state('guests')),\n    viewOnly: controlHandle.variant === 'view',\n    owner: pagesHandle.variant === 'pages',\n    approvals: hold<Approval[]>(state('approvals')),\n    approvalPolicy: hold<ApprovalPolicy>(state('approvalPolicy')),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      finish();\n      link.close('closed');\n      await closed;\n      await host.close();\n    },\n  };\n}\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,EAEA;AAAA,OAGK;AACP,SAAS,0BAA0B;AASnC,SAAS,eAAe,YAAY,cAAc,sBAAsB;AAIxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAMA;AAAA,EAEA;AAAA,EACA;AAAA,EAGA;AAAA,OACK;AACP,SAA8B,OAA+B,YAAY,YAAY;AAErF,SAAS,cAAiC,gBAAgB;AA6CnD,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,IACpE,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,IACpE,cAAc,CAAC,YAAY,SAAS,aAAa,OAAO;AAAA,EAC1D;AACF;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,oBAAoB,mBAAmB,CAAC;AAE3D,MAAM,QAAQ,CAAC,UACpB,aAAa,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,aAAa,KAAK,IAAI;AAEnE,MAAM,QAAQ,CAAC,SACpB,KAAK,MAAM,KAAK,CAAC,WAAW;AAC1B,QAAM,UAAU,IAAI,MAAM,2BAA2B;AACvD,CAAC;AAII,SAAS,WAAW,MAAgB,MAAoC;AAC7E,QAAM,OAAO,WAA2B;AAAA,IACtC,MAAM,GAAG,IAAI,IAAI,OAAO,WAAW,CAAC;AAAA,IACpC,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,OAAK,QAAQ,MAAM,EAAE,WAAW,MAAM,oBAAoB,MAAM,KAAK,WAAW,EAAE,CAAC;AACnF,SAAO;AACT;AAEA,eAAsB,QACpB,MACA,MACA,WACmB;AACnB,QAAM,OAAO,IAAI,gBAAgB;AACjC,QAAM,UAAU,UAAU;AAAA,IACxB,CAAC,aACC,KAAK,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EAClD;AACA,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,QAAQ,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC;AAAA,EAC/D,SAAS,OAAO;AACd,SAAK,MAAM;AACX,eAAW,OAAO;AAChB,WAAK,IAAI;AAAA,QACP,CAAC,QAAQ,IAAI,QAAQ;AAAA,QACrB,MAAM;AAAA,MACR;AACF,SAAK,MAAM,kBAAkB;AAC7B,SAAK,KAAK,MAAM,EAAE,MAAM,MAAM,MAAS;AACvC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,QAAM,WAAW,MAAM,KAAK;AAC5B,QAAM,OAAO,WAAW,MAAM,UAAU;AACxC,QAAM,UAAU,MAAM,QAAQ,MAAM,MAAM;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC3B,UAAM,MAAM,KAAK;AAAA,EACnB,CAAC;AACD,QAAM,CAAC,eAAe,kBAAkB,gBAAgB,cAAc,WAAW,IAAI;AAOrF,QAAM,UAAU,MAAM;AACpB,eAAW,UAAU,QAAS,QAAO,QAAQ;AAAA,EAC/C;AACA,QAAM,OAAa,CAAC,KAAK,gBAAgB,KAAK,KAAK,KAAK,WAAW;AACnE,QAAM,UAAU,MAAoB,eAAe,MAAM,iBAAiB,aAAa;AACvF,QAAM,UAAU,OAAO;AAAA,IACrB,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,iBAAiB,IAAI,CAAsB,CAAC;AAAA,EACrF;AACA,QAAM,gBAAgB,eAAe;AACrC,QAAM,WAA0B;AAAA,IAC9B,GAAG,MAAoC,gBAAgB,MAAM,kBAAkB,cAAc;AAAA,IAC7F,OAAO,WAAW,aAAa;AAAA,EACjC;AACA,QAAM,SAAS,MAAmB,cAAc,MAAM,gBAAgB,YAAY;AAClF,QAAM,QAAQ,MAAkB,aAAa,MAAM,cAAc,UAAU;AAC3E,QAAM,QAAQ,CAAiC,SAC7C,WAAW,QAAQ,IAAI,CAAoB;AAC7C,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAIA,WAAkD;AACjE,UAAM,OAAO,QAAQA,MAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,MAAI,OAAO;AACX,QAAM,SAAS,MAAM;AACnB,QAAI,CAAC,KAAM;AACX,WAAO;AACP,eAAW,QAAQ,KAAM,MAAK,OAAO;AACrC,YAAQ;AAAA,EACV;AACA,QAAM,SAAS,KAAK,MAAM,KAAK,CAAC,WAAW;AACzC,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,UAAU,cAAc,YAAY;AAAA,IACpC;AAAA,IACA,YAAY,KAAuB,MAAM,OAAO,CAAC;AAAA,IACjD,YAAY,KAAgC,MAAM,YAAY,CAAC;AAAA,IAC/D,QAAQ,KAAoB,MAAM,QAAQ,CAAC;AAAA,IAC3C,OAAO,KAAuC,MAAM,OAAO,CAAC;AAAA,IAC5D,UAAU,KAAgB,MAAM,UAAU,CAAC;AAAA,IAC3C,iBAAiB,KAAsB,MAAM,iBAAiB,CAAC;AAAA,IAC/D,WAAW,KAAiB,MAAM,WAAW,CAAC;AAAA,IAC9C,UAAU,KAAoB,MAAM,UAAU,CAAC;AAAA,IAC/C,cAAc,KAAoB,MAAM,cAAc,CAAC;AAAA,IACvD,QAAQ,KAAmB,MAAM,QAAQ,CAAC;AAAA,IAC1C,WAAW,KAAqB,MAAM,WAAW,CAAC;AAAA,IAClD,SAAS,KAAkB,MAAM,SAAS,CAAC;AAAA,IAC3C,SAAS,KAAkB,MAAM,SAAS,CAAC;AAAA,IAC3C,OAAO,KAAiB,MAAM,OAAO,CAAC;AAAA,IACtC,QAAQ,KAA6B,MAAM,QAAQ,CAAC;AAAA,IACpD,QAAQ,KAAkB,MAAM,QAAQ,CAAC;AAAA,IACzC,UAAU,cAAc,YAAY;AAAA,IACpC,OAAO,YAAY,YAAY;AAAA,IAC/B,WAAW,KAAiB,MAAM,WAAW,CAAC;AAAA,IAC9C,gBAAgB,KAAqB,MAAM,gBAAgB,CAAC;AAAA,IAC5D,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,WAAK,MAAM,QAAQ;AACnB,YAAM;AACN,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import {\n  type Context,\n  createHost,\n  type Host,\n  isChordError,\n  type Readable,\n  type ReplicatedState,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { ApprovalPolicy } from './approvals/policy.ts';\nimport type { Approval } from './approvals/record.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { ImportProgress } from './freezer/v6.ts';\nimport type { GuestSeat } from './guests/seats.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport { controlAnswer, pageAnswer, remoteAnswer, settingsAnswer } from './readonly.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AgentControl,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSettings,\n  type AgentsSummary,\n  AgentTranscript,\n  CONTROL_METHODS,\n  type Command,\n  type Delivered,\n  type GuestProposal,\n  type GuestShown,\n  type MonitorFeed,\n  PAGE_METHODS,\n  type PrivateRevision,\n  REMOTE_METHODS,\n  SETTINGS_METHODS,\n  type SendMode,\n  type SettingsState,\n  TRANSCRIPT_STATES,\n} from './services.ts';\nimport { type AgentPrincipal, bound, type Remote, type Root, replicated, SELF } from './serving.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { otherVersion, type PortEndpoint, PortLink } from './wire.ts';\n\nexport interface AgentConnection {\n  readonly serverId: string;\n  readonly control: AgentControl;\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents?: ReplicatedState<AgentsSummary>;\n  readonly views?: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands?: ReplicatedState<Command[]>;\n  readonly privateRevision?: ReplicatedState<PrivateRevision>;\n  readonly sprinkles?: ReplicatedState<Sprinkle[]>;\n  readonly memories?: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes?: ReplicatedState<MemoryScope[]>;\n  readonly frozen?: ReplicatedState<FrozenCone[]>;\n  readonly importing?: ReplicatedState<ImportProgress>;\n  readonly changes?: ReplicatedState<ChangesView>;\n  readonly monitor?: ReplicatedState<MonitorFeed>;\n  readonly vault?: ReplicatedState<VaultState>;\n  readonly labels?: ReplicatedState<Record<string, string>>;\n  readonly guests?: ReplicatedState<GuestSeat[]>;\n  readonly viewOnly?: boolean;\n  readonly guest?: GuestShown;\n  readonly proposals?: ReplicatedState<GuestProposal[]>;\n  readonly owner?: boolean;\n  readonly approvals?: ReplicatedState<Approval[]>;\n  readonly approvalPolicy?: ReplicatedState<ApprovalPolicy>;\n  readonly settings: AgentSettings;\n  readonly remote?: AgentRemote;\n  readonly pages?: AgentPages;\n  readonly closed: Promise<Error | undefined>;\n  readonly readOnly?: boolean;\n  prompt(text: string, whenBusy?: SendMode): Promise<string>;\n  webhook(\n    name: string,\n    delivery: { id?: string | null; headers?: Record<string, string>; body: string }\n  ): Promise<{ delivered: boolean }>;\n  close(): Promise<void>;\n}\n\nexport interface Lasting<T> {\n  readonly state: ReplicatedState<T>;\n  freeze(): void;\n}\n\nexport function lasting<T>(state: ReplicatedState<T>): Lasting<T> {\n  let last: T | undefined;\n  let frozen = false;\n  const read = () => {\n    if (frozen) return last;\n    try {\n      last = state.value;\n    } catch {}\n    return last;\n  };\n  return {\n    state: {\n      get value() {\n        return read();\n      },\n      subscribe: (listener) => (frozen ? () => undefined : state.subscribe(listener)),\n    },\n    freeze() {\n      read();\n      frozen = true;\n    },\n  };\n}\n\nfunction lastingSettings(\n  settings: AgentSettings,\n  hold: <T>(state: ReplicatedState<T>) => ReplicatedState<T>\n): AgentSettings {\n  return {\n    state: hold(settings.state),\n    connect: (providerId, secret, fields, context) =>\n      settings.connect(providerId, secret, fields, context),\n    disconnect: (providerId, context) => settings.disconnect(providerId, context),\n    remove: (providerId, context) => settings.remove(providerId, context),\n    serverUrl: (providerId, context) => settings.serverUrl(providerId, context),\n    signIn: (providerId, context) => settings.signIn(providerId, context),\n    dismissMoved: (context) => settings.dismissMoved(context),\n  };\n}\n\nconst VERSIONS = new Set(['upgrade_required', 'contract_mismatch']);\n\nexport const final = (error: unknown): unknown =>\n  isChordError(error) && VERSIONS.has(error.code) ? otherVersion(error) : error;\n\nexport const ended = (link: PortLink): Promise<never> =>\n  link.ended.then((reason) => {\n    throw reason ?? new Error('the agent closed the link');\n  });\n\ntype Contract = Parameters<Host<AgentPrincipal>['get']>[0];\n\nexport function clientHost(link: PortLink, name: string): Host<AgentPrincipal> {\n  const host = createHost<AgentPrincipal>({\n    name: `${name}:${crypto.randomUUID()}`,\n    kind: 'client',\n    self: SELF,\n  });\n  host.connect(link, { principal: SELF, onProtocolMismatch: () => link.mismatched() });\n  return host;\n}\n\nexport async function holding(\n  host: Host<AgentPrincipal>,\n  link: PortLink,\n  contracts: readonly Contract[]\n): Promise<Remote[]> {\n  const stop = new AbortController();\n  const getting = contracts.map(\n    (contract) =>\n      host.get(contract, {}, { signal: stop.signal }) as Promise<unknown> as Promise<Remote>\n  );\n  try {\n    return await Promise.race([Promise.all(getting), ended(link)]);\n  } catch (error) {\n    stop.abort();\n    for (const got of getting)\n      void got.then(\n        (ref) => ref.release(),\n        () => undefined\n      );\n    link.close('handshake failed');\n    void host.close().catch(() => undefined);\n    throw error;\n  }\n}\n\nexport async function connectAgent(\n  endpoint: PortEndpoint,\n  options: { context?: Context } = {}\n): Promise<AgentConnection> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const link = new PortLink(endpoint);\n  const serverId = await link.hello;\n  const host = clientHost(link, 'follower');\n  const handles = await holding(host, link, [\n    AgentControl,\n    AgentTranscript,\n    AgentSettings,\n    AgentRemoteService,\n    AgentPagesService,\n  ]).catch((error: unknown) => {\n    throw final(error);\n  });\n  const [controlHandle, transcriptHandle, settingsHandle, remoteHandle, pagesHandle] = handles as [\n    Remote,\n    Remote,\n    Remote,\n    Remote,\n    Remote,\n  ];\n  const release = () => {\n    for (const handle of handles) handle.release();\n  };\n  const root: Root = (run, rootOptions) => host.root(run, rootOptions);\n  const control = bound<AgentControl>(controlHandle, root, CONTROL_METHODS, controlAnswer);\n  const members = Object.fromEntries(\n    TRANSCRIPT_STATES.map((name) => [name, transcriptHandle[name] as Readable<unknown>])\n  ) as Record<(typeof TRANSCRIPT_STATES)[number], Readable<unknown>>;\n  const settingsState = settingsHandle.state as Readable<SettingsState>;\n  const settings: AgentSettings = {\n    ...bound<Omit<AgentSettings, 'state'>>(settingsHandle, root, SETTINGS_METHODS, settingsAnswer),\n    state: replicated(settingsState),\n  };\n  const remote = bound<AgentRemote>(remoteHandle, root, REMOTE_METHODS, remoteAnswer);\n  const pages = bound<AgentPages>(pagesHandle, root, PAGE_METHODS, pageAnswer);\n  const state = <K extends keyof typeof members>(name: K) =>\n    replicated(members[name] as Readable<never>);\n  const held: Lasting<unknown>[] = [];\n  const hold = <T>(state: ReplicatedState<T>): ReplicatedState<T> => {\n    const kept = lasting(state);\n    held.push(kept as Lasting<unknown>);\n    return kept.state;\n  };\n  let open = true;\n  const finish = () => {\n    if (!open) return;\n    open = false;\n    for (const kept of held) kept.freeze();\n    release();\n  };\n  const closed = link.ended.then((reason) => {\n    finish();\n    return reason;\n  });\n  return {\n    serverId,\n    readOnly: controlHandle.variant === 'view',\n    control,\n    transcript: hold<ConversationView>(state('state')),\n    deliveries: hold<Record<string, Delivered>>(state('deliveries')),\n    agents: hold<AgentsSummary>(state('agents')),\n    views: hold<Record<string, ConversationView>>(state('views')),\n    commands: hold<Command[]>(state('commands')),\n    privateRevision: hold<PrivateRevision>(state('privateRevision')),\n    sprinkles: hold<Sprinkle[]>(state('sprinkles')),\n    memories: hold<MemoryEntry[]>(state('memories')),\n    memoryScopes: hold<MemoryScope[]>(state('memoryScopes')),\n    frozen: hold<FrozenCone[]>(state('frozen')),\n    importing: hold<ImportProgress>(state('importing')),\n    changes: hold<ChangesView>(state('changes')),\n    monitor: hold<MonitorFeed>(state('monitor')),\n    vault: hold<VaultState>(state('vault')),\n    labels: hold<Record<string, string>>(state('labels')),\n    guests: hold<GuestSeat[]>(state('guests')),\n    viewOnly: controlHandle.variant === 'view',\n    owner: pagesHandle.variant === 'pages',\n    approvals: hold<Approval[]>(state('approvals')),\n    approvalPolicy: hold<ApprovalPolicy>(state('approvalPolicy')),\n    settings: lastingSettings(settings, hold),\n    remote,\n    pages,\n    closed,\n    webhook(name, delivery) {\n      return control.webhook(\n        name,\n        { id: delivery.id ?? null, headers: delivery.headers ?? {}, body: delivery.body },\n        context\n      );\n    },\n    async prompt(text, whenBusy = 'followUp') {\n      const sent = await control.send({ text, whenBusy, requestId: null }, context);\n      if (!sent.accepted) throw new Error(`${sent.error.code}: ${sent.error.message}`);\n      const settled = await control.wait(sent.submissionId, context);\n      if (settled.status !== 'done') throw new Error(`unanswered: ${settled.reason}`);\n      return settled.text;\n    },\n    async close() {\n      finish();\n      link.close('closed');\n      await closed;\n      await host.close();\n    },\n  };\n}\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,EAEA;AAAA,OAGK;AACP,SAAS,0BAA0B;AASnC,SAAS,eAAe,YAAY,cAAc,sBAAsB;AAIxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAMA;AAAA,EAEA;AAAA,EACA;AAAA,EAGA;AAAA,OACK;AACP,SAA8B,OAA+B,YAAY,YAAY;AAErF,SAAS,cAAiC,gBAAgB;AA6CnD,SAAS,QAAW,OAAuC;AAChE,MAAI;AACJ,MAAI,SAAS;AACb,QAAM,OAAO,MAAM;AACjB,QAAI,OAAQ,QAAO;AACnB,QAAI;AACF,aAAO,MAAM;AAAA,IACf,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO;AAAA,MACL,IAAI,QAAQ;AACV,eAAO,KAAK;AAAA,MACd;AAAA,MACA,WAAW,CAAC,aAAc,SAAS,MAAM,SAAY,MAAM,UAAU,QAAQ;AAAA,IAC/E;AAAA,IACA,SAAS;AACP,WAAK;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAEA,SAAS,gBACP,UACA,MACe;AACf,SAAO;AAAA,IACL,OAAO,KAAK,SAAS,KAAK;AAAA,IAC1B,SAAS,CAAC,YAAY,QAAQ,QAAQ,YACpC,SAAS,QAAQ,YAAY,QAAQ,QAAQ,OAAO;AAAA,IACtD,YAAY,CAAC,YAAY,YAAY,SAAS,WAAW,YAAY,OAAO;AAAA,IAC5E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,IACpE,WAAW,CAAC,YAAY,YAAY,SAAS,UAAU,YAAY,OAAO;AAAA,IAC1E,QAAQ,CAAC,YAAY,YAAY,SAAS,OAAO,YAAY,OAAO;AAAA,IACpE,cAAc,CAAC,YAAY,SAAS,aAAa,OAAO;AAAA,EAC1D;AACF;AAEA,MAAM,WAAW,oBAAI,IAAI,CAAC,oBAAoB,mBAAmB,CAAC;AAE3D,MAAM,QAAQ,CAAC,UACpB,aAAa,KAAK,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,aAAa,KAAK,IAAI;AAEnE,MAAM,QAAQ,CAAC,SACpB,KAAK,MAAM,KAAK,CAAC,WAAW;AAC1B,QAAM,UAAU,IAAI,MAAM,2BAA2B;AACvD,CAAC;AAII,SAAS,WAAW,MAAgB,MAAoC;AAC7E,QAAM,OAAO,WAA2B;AAAA,IACtC,MAAM,GAAG,IAAI,IAAI,OAAO,WAAW,CAAC;AAAA,IACpC,MAAM;AAAA,IACN,MAAM;AAAA,EACR,CAAC;AACD,OAAK,QAAQ,MAAM,EAAE,WAAW,MAAM,oBAAoB,MAAM,KAAK,WAAW,EAAE,CAAC;AACnF,SAAO;AACT;AAEA,eAAsB,QACpB,MACA,MACA,WACmB;AACnB,QAAM,OAAO,IAAI,gBAAgB;AACjC,QAAM,UAAU,UAAU;AAAA,IACxB,CAAC,aACC,KAAK,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EAClD;AACA,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,QAAQ,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,CAAC;AAAA,EAC/D,SAAS,OAAO;AACd,SAAK,MAAM;AACX,eAAW,OAAO;AAChB,WAAK,IAAI;AAAA,QACP,CAAC,QAAQ,IAAI,QAAQ;AAAA,QACrB,MAAM;AAAA,MACR;AACF,SAAK,MAAM,kBAAkB;AAC7B,SAAK,KAAK,MAAM,EAAE,MAAM,MAAM,MAAS;AACvC,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,aACpB,UACA,UAAiC,CAAC,GACR;AAC1B,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,QAAM,WAAW,MAAM,KAAK;AAC5B,QAAM,OAAO,WAAW,MAAM,UAAU;AACxC,QAAM,UAAU,MAAM,QAAQ,MAAM,MAAM;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC3B,UAAM,MAAM,KAAK;AAAA,EACnB,CAAC;AACD,QAAM,CAAC,eAAe,kBAAkB,gBAAgB,cAAc,WAAW,IAAI;AAOrF,QAAM,UAAU,MAAM;AACpB,eAAW,UAAU,QAAS,QAAO,QAAQ;AAAA,EAC/C;AACA,QAAM,OAAa,CAAC,KAAK,gBAAgB,KAAK,KAAK,KAAK,WAAW;AACnE,QAAM,UAAU,MAAoB,eAAe,MAAM,iBAAiB,aAAa;AACvF,QAAM,UAAU,OAAO;AAAA,IACrB,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,iBAAiB,IAAI,CAAsB,CAAC;AAAA,EACrF;AACA,QAAM,gBAAgB,eAAe;AACrC,QAAM,WAA0B;AAAA,IAC9B,GAAG,MAAoC,gBAAgB,MAAM,kBAAkB,cAAc;AAAA,IAC7F,OAAO,WAAW,aAAa;AAAA,EACjC;AACA,QAAM,SAAS,MAAmB,cAAc,MAAM,gBAAgB,YAAY;AAClF,QAAM,QAAQ,MAAkB,aAAa,MAAM,cAAc,UAAU;AAC3E,QAAM,QAAQ,CAAiC,SAC7C,WAAW,QAAQ,IAAI,CAAoB;AAC7C,QAAM,OAA2B,CAAC;AAClC,QAAM,OAAO,CAAIA,WAAkD;AACjE,UAAM,OAAO,QAAQA,MAAK;AAC1B,SAAK,KAAK,IAAwB;AAClC,WAAO,KAAK;AAAA,EACd;AACA,MAAI,OAAO;AACX,QAAM,SAAS,MAAM;AACnB,QAAI,CAAC,KAAM;AACX,WAAO;AACP,eAAW,QAAQ,KAAM,MAAK,OAAO;AACrC,YAAQ;AAAA,EACV;AACA,QAAM,SAAS,KAAK,MAAM,KAAK,CAAC,WAAW;AACzC,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,UAAU,cAAc,YAAY;AAAA,IACpC;AAAA,IACA,YAAY,KAAuB,MAAM,OAAO,CAAC;AAAA,IACjD,YAAY,KAAgC,MAAM,YAAY,CAAC;AAAA,IAC/D,QAAQ,KAAoB,MAAM,QAAQ,CAAC;AAAA,IAC3C,OAAO,KAAuC,MAAM,OAAO,CAAC;AAAA,IAC5D,UAAU,KAAgB,MAAM,UAAU,CAAC;AAAA,IAC3C,iBAAiB,KAAsB,MAAM,iBAAiB,CAAC;AAAA,IAC/D,WAAW,KAAiB,MAAM,WAAW,CAAC;AAAA,IAC9C,UAAU,KAAoB,MAAM,UAAU,CAAC;AAAA,IAC/C,cAAc,KAAoB,MAAM,cAAc,CAAC;AAAA,IACvD,QAAQ,KAAmB,MAAM,QAAQ,CAAC;AAAA,IAC1C,WAAW,KAAqB,MAAM,WAAW,CAAC;AAAA,IAClD,SAAS,KAAkB,MAAM,SAAS,CAAC;AAAA,IAC3C,SAAS,KAAkB,MAAM,SAAS,CAAC;AAAA,IAC3C,OAAO,KAAiB,MAAM,OAAO,CAAC;AAAA,IACtC,QAAQ,KAA6B,MAAM,QAAQ,CAAC;AAAA,IACpD,QAAQ,KAAkB,MAAM,QAAQ,CAAC;AAAA,IACzC,UAAU,cAAc,YAAY;AAAA,IACpC,OAAO,YAAY,YAAY;AAAA,IAC/B,WAAW,KAAiB,MAAM,WAAW,CAAC;AAAA,IAC9C,gBAAgB,KAAqB,MAAM,gBAAgB,CAAC;AAAA,IAC5D,UAAU,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,UAAU;AACtB,aAAO,QAAQ;AAAA,QACb;AAAA,QACA,EAAE,IAAI,SAAS,MAAM,MAAM,SAAS,SAAS,WAAW,CAAC,GAAG,MAAM,SAAS,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,OAAO,MAAM,WAAW,YAAY;AACxC,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,UAAU,WAAW,KAAK,GAAG,OAAO;AAC5E,UAAI,CAAC,KAAK,SAAU,OAAM,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,OAAO,EAAE;AAC/E,YAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,cAAc,OAAO;AAC7D,UAAI,QAAQ,WAAW,OAAQ,OAAM,IAAI,MAAM,eAAe,QAAQ,MAAM,EAAE;AAC9E,aAAO,QAAQ;AAAA,IACjB;AAAA,IACA,MAAM,QAAQ;AACZ,aAAO;AACP,WAAK,MAAM,QAAQ;AACnB,YAAM;AACN,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AACF;",
   "names": ["state"]
 }

package/dist/guests/client.js

@@ -94,6 +94,7 @@ async function connectGuest(endpoint) {
     connect: refuse,
     disconnect: refuse,
     remove: refuse,
+    serverUrl: refuse,
     signIn: refuse,
     dismissMoved: refuse
   };

package/dist/guests/client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/guests/client.ts"],
-  "sourcesContent": ["import { isChordError, type Readable, replicatedState } from '@earendil-works/chord';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport { type AgentConnection, clientHost, final, holding, lasting } from '../client.ts';\nimport {\n  type AgentControl,\n  AgentGuestService,\n  type AgentSettings,\n  CONTROL_METHODS,\n  type GUEST_METHODS,\n  type GuestProposal,\n  type GuestShown,\n  type SendResponse,\n} from '../services.ts';\nimport { plain, type Remote, replicated } from '../serving.ts';\nimport { type PortEndpoint, PortLink } from '../wire.ts';\nimport type { GuestOpened, Proposed, ProposeRequest } from './index.ts';\n\nexport const GUEST_ONLY = 'a guest can only watch and send messages';\nexport const SEAT_REFUSED = \"This guest link isn't valid any more.\";\n\nconst SAID: Record<string, string> = {\n  revoked: 'This guest seat was revoked.',\n  empty: 'There is nothing to send.',\n  'too-long': 'That message is too long for a guest seat.',\n  gone: 'The cone this seat shares is gone.',\n  unavailable: \"Messages from guests need a review, and this agent can't review them yet.\",\n  overflow: 'Too many of your messages are waiting for approval. Try again once one is answered.',\n};\n\nexport const proposedSentence = (reason: string): string =>\n  SAID[reason] ?? 'The message was not delivered.';\n\nconst refusal = (message: string, code = 'EACCES') => Object.assign(new Error(message), { code });\n\nexport interface GuestConnection extends AgentConnection {\n  readonly guest: GuestShown;\n  propose(request: ProposeRequest): Promise<Proposed>;\n}\n\nexport async function connectGuest(endpoint: PortEndpoint): Promise<GuestConnection> {\n  const link = new PortLink(endpoint);\n  let serverId: string;\n  try {\n    serverId = await link.hello;\n  } catch {\n    throw refusal(SEAT_REFUSED);\n  }\n  const host = clientHost(link, 'guest');\n  const [handle] = (await holding(host, link, [AgentGuestService]).catch((error: unknown) => {\n    const code = (error as { code?: unknown } | null)?.code;\n    if (code === 'EVERSION') throw error;\n    throw isChordError(error) && error.code !== 'forbidden' ? final(error) : refusal(SEAT_REFUSED);\n  })) as [Remote];\n  if (handle.variant !== 'guest') {\n    handle.release();\n    link.close('handshake failed');\n    await host.close();\n    throw refusal(SEAT_REFUSED);\n  }\n  const transcriptMember = handle.transcript as Readable<ConversationView>;\n  const seatMember = handle.seat as Readable<GuestShown>;\n  const proposalsMember = handle.proposals as Readable<GuestProposal[]>;\n  const through =\n    <T>(name: (typeof GUEST_METHODS)[number]) =>\n    async (...args: unknown[]): Promise<T> => {\n      const call = handle[name] as (args: unknown[], ctx: unknown) => Promise<T>;\n      try {\n        return await host.root((ctx) => call(args, ctx), {});\n      } catch (error) {\n        throw plain(error);\n      }\n    };\n  const propose = (request: ProposeRequest) => through<Proposed>('propose')(request);\n  const guest = seatMember.value as GuestShown;\n  const refuse = () => Promise.reject(refusal(GUEST_ONLY));\n  const control = Object.fromEntries(\n    CONTROL_METHODS.map((name) => [name, refuse])\n  ) as unknown as AgentControl;\n  control.guestOpen = (draft) => through<GuestOpened>('guestOpen')(draft);\n  control.guestRevoke = (id) => through<{ revoked: boolean }>('guestRevoke')(id);\n  control.send = async (request): Promise<SendResponse> => {\n    if (request.attachments?.length)\n      return {\n        accepted: false,\n        submissionId: null,\n        error: { code: 'EACCES', message: \"A guest can't attach files.\" },\n      };\n    const proposed = await propose({ text: request.text, requestId: request.requestId });\n    if (proposed.state === 'submitted')\n      return { accepted: true, submissionId: proposed.submissionId, error: null };\n    if (proposed.state === 'queued')\n      return { accepted: true, submissionId: proposed.review, error: null };\n    return {\n      accepted: false,\n      submissionId: null,\n      error: { code: 'EACCES', message: proposedSentence(proposed.reason) },\n    };\n  };\n  const transcript = lasting(replicated(transcriptMember));\n  const proposals = lasting(replicated(proposalsMember));\n  let open = true;\n  const finish = () => {\n    if (!open) return;\n    open = false;\n    transcript.freeze();\n    proposals.freeze();\n    handle.release();\n  };\n  const closed = link.ended.then((reason) => {\n    finish();\n    return reason;\n  });\n  const settings: AgentSettings = {\n    state: replicatedState({ models: [], accounts: [] }),\n    connect: refuse,\n    disconnect: refuse,\n    remove: refuse,\n    signIn: refuse,\n    dismissMoved: refuse,\n  };\n  return {\n    serverId,\n    guest,\n    control,\n    transcript: transcript.state,\n    proposals: proposals.state,\n    deliveries: replicatedState({}),\n    agents: replicatedState({\n      active: guest.agentId,\n      agents: [\n        { id: guest.agentId, name: guest.name, kind: 'cone' as const, parentId: null, role: null },\n      ],\n    }),\n    settings,\n    closed,\n    propose,\n    prompt: refuse,\n    webhook: refuse,\n    async close() {\n      finish();\n      link.close('closed');\n      await closed;\n      await host.close();\n    },\n  };\n}\n"],
-  "mappings": "AAAA,SAAS,cAA6B,uBAAuB;AAE7D,SAA+B,YAAY,OAAO,SAAS,eAAe;AAC1E;AAAA,EAEE;AAAA,EAEA;AAAA,OAKK;AACP,SAAS,OAAoB,kBAAkB;AAC/C,SAA4B,gBAAgB;AAGrC,MAAM,aAAa;AACnB,MAAM,eAAe;AAE5B,MAAM,OAA+B;AAAA,EACnC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AACZ;AAEO,MAAM,mBAAmB,CAAC,WAC/B,KAAK,MAAM,KAAK;AAElB,MAAM,UAAU,CAAC,SAAiB,OAAO,aAAa,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC;AAOhG,eAAsB,aAAa,UAAkD;AACnF,QAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,QAAQ,YAAY;AAAA,EAC5B;AACA,QAAM,OAAO,WAAW,MAAM,OAAO;AACrC,QAAM,CAAC,MAAM,IAAK,MAAM,QAAQ,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,UAAmB;AACzF,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,WAAY,OAAM;AAC/B,UAAM,aAAa,KAAK,KAAK,MAAM,SAAS,cAAc,MAAM,KAAK,IAAI,QAAQ,YAAY;AAAA,EAC/F,CAAC;AACD,MAAI,OAAO,YAAY,SAAS;AAC9B,WAAO,QAAQ;AACf,SAAK,MAAM,kBAAkB;AAC7B,UAAM,KAAK,MAAM;AACjB,UAAM,QAAQ,YAAY;AAAA,EAC5B;AACA,QAAM,mBAAmB,OAAO;AAChC,QAAM,aAAa,OAAO;AAC1B,QAAM,kBAAkB,OAAO;AAC/B,QAAM,UACJ,CAAI,SACJ,UAAU,SAAgC;AACxC,UAAM,OAAO,OAAO,IAAI;AACxB,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,CAAC,QAAQ,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,IACrD,SAAS,OAAO;AACd,YAAM,MAAM,KAAK;AAAA,IACnB;AAAA,EACF;AACF,QAAM,UAAU,CAAC,YAA4B,QAAkB,SAAS,EAAE,OAAO;AACjF,QAAM,QAAQ,WAAW;AACzB,QAAM,SAAS,MAAM,QAAQ,OAAO,QAAQ,UAAU,CAAC;AACvD,QAAM,UAAU,OAAO;AAAA,IACrB,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC;AAAA,EAC9C;AACA,UAAQ,YAAY,CAAC,UAAU,QAAqB,WAAW,EAAE,KAAK;AACtE,UAAQ,cAAc,CAAC,OAAO,QAA8B,aAAa,EAAE,EAAE;AAC7E,UAAQ,OAAO,OAAO,YAAmC;AACvD,QAAI,QAAQ,aAAa;AACvB,aAAO;AAAA,QACL,UAAU;AAAA,QACV,cAAc;AAAA,QACd,OAAO,EAAE,MAAM,UAAU,SAAS,8BAA8B;AAAA,MAClE;AACF,UAAM,WAAW,MAAM,QAAQ,EAAE,MAAM,QAAQ,MAAM,WAAW,QAAQ,UAAU,CAAC;AACnF,QAAI,SAAS,UAAU;AACrB,aAAO,EAAE,UAAU,MAAM,cAAc,SAAS,cAAc,OAAO,KAAK;AAC5E,QAAI,SAAS,UAAU;AACrB,aAAO,EAAE,UAAU,MAAM,cAAc,SAAS,QAAQ,OAAO,KAAK;AACtE,WAAO;AAAA,MACL,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO,EAAE,MAAM,UAAU,SAAS,iBAAiB,SAAS,MAAM,EAAE;AAAA,IACtE;AAAA,EACF;AACA,QAAM,aAAa,QAAQ,WAAW,gBAAgB,CAAC;AACvD,QAAM,YAAY,QAAQ,WAAW,eAAe,CAAC;AACrD,MAAI,OAAO;AACX,QAAM,SAAS,MAAM;AACnB,QAAI,CAAC,KAAM;AACX,WAAO;AACP,eAAW,OAAO;AAClB,cAAU,OAAO;AACjB,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,SAAS,KAAK,MAAM,KAAK,CAAC,WAAW;AACzC,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,QAAM,WAA0B;AAAA,IAC9B,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,IACnD,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB,YAAY,gBAAgB,CAAC,CAAC;AAAA,IAC9B,QAAQ,gBAAgB;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,QACN,EAAE,IAAI,MAAM,SAAS,MAAM,MAAM,MAAM,MAAM,QAAiB,UAAU,MAAM,MAAM,KAAK;AAAA,MAC3F;AAAA,IACF,CAAC;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,MAAM,QAAQ;AACZ,aAAO;AACP,WAAK,MAAM,QAAQ;AACnB,YAAM;AACN,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { isChordError, type Readable, replicatedState } from '@earendil-works/chord';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport { type AgentConnection, clientHost, final, holding, lasting } from '../client.ts';\nimport {\n  type AgentControl,\n  AgentGuestService,\n  type AgentSettings,\n  CONTROL_METHODS,\n  type GUEST_METHODS,\n  type GuestProposal,\n  type GuestShown,\n  type SendResponse,\n} from '../services.ts';\nimport { plain, type Remote, replicated } from '../serving.ts';\nimport { type PortEndpoint, PortLink } from '../wire.ts';\nimport type { GuestOpened, Proposed, ProposeRequest } from './index.ts';\n\nexport const GUEST_ONLY = 'a guest can only watch and send messages';\nexport const SEAT_REFUSED = \"This guest link isn't valid any more.\";\n\nconst SAID: Record<string, string> = {\n  revoked: 'This guest seat was revoked.',\n  empty: 'There is nothing to send.',\n  'too-long': 'That message is too long for a guest seat.',\n  gone: 'The cone this seat shares is gone.',\n  unavailable: \"Messages from guests need a review, and this agent can't review them yet.\",\n  overflow: 'Too many of your messages are waiting for approval. Try again once one is answered.',\n};\n\nexport const proposedSentence = (reason: string): string =>\n  SAID[reason] ?? 'The message was not delivered.';\n\nconst refusal = (message: string, code = 'EACCES') => Object.assign(new Error(message), { code });\n\nexport interface GuestConnection extends AgentConnection {\n  readonly guest: GuestShown;\n  propose(request: ProposeRequest): Promise<Proposed>;\n}\n\nexport async function connectGuest(endpoint: PortEndpoint): Promise<GuestConnection> {\n  const link = new PortLink(endpoint);\n  let serverId: string;\n  try {\n    serverId = await link.hello;\n  } catch {\n    throw refusal(SEAT_REFUSED);\n  }\n  const host = clientHost(link, 'guest');\n  const [handle] = (await holding(host, link, [AgentGuestService]).catch((error: unknown) => {\n    const code = (error as { code?: unknown } | null)?.code;\n    if (code === 'EVERSION') throw error;\n    throw isChordError(error) && error.code !== 'forbidden' ? final(error) : refusal(SEAT_REFUSED);\n  })) as [Remote];\n  if (handle.variant !== 'guest') {\n    handle.release();\n    link.close('handshake failed');\n    await host.close();\n    throw refusal(SEAT_REFUSED);\n  }\n  const transcriptMember = handle.transcript as Readable<ConversationView>;\n  const seatMember = handle.seat as Readable<GuestShown>;\n  const proposalsMember = handle.proposals as Readable<GuestProposal[]>;\n  const through =\n    <T>(name: (typeof GUEST_METHODS)[number]) =>\n    async (...args: unknown[]): Promise<T> => {\n      const call = handle[name] as (args: unknown[], ctx: unknown) => Promise<T>;\n      try {\n        return await host.root((ctx) => call(args, ctx), {});\n      } catch (error) {\n        throw plain(error);\n      }\n    };\n  const propose = (request: ProposeRequest) => through<Proposed>('propose')(request);\n  const guest = seatMember.value as GuestShown;\n  const refuse = () => Promise.reject(refusal(GUEST_ONLY));\n  const control = Object.fromEntries(\n    CONTROL_METHODS.map((name) => [name, refuse])\n  ) as unknown as AgentControl;\n  control.guestOpen = (draft) => through<GuestOpened>('guestOpen')(draft);\n  control.guestRevoke = (id) => through<{ revoked: boolean }>('guestRevoke')(id);\n  control.send = async (request): Promise<SendResponse> => {\n    if (request.attachments?.length)\n      return {\n        accepted: false,\n        submissionId: null,\n        error: { code: 'EACCES', message: \"A guest can't attach files.\" },\n      };\n    const proposed = await propose({ text: request.text, requestId: request.requestId });\n    if (proposed.state === 'submitted')\n      return { accepted: true, submissionId: proposed.submissionId, error: null };\n    if (proposed.state === 'queued')\n      return { accepted: true, submissionId: proposed.review, error: null };\n    return {\n      accepted: false,\n      submissionId: null,\n      error: { code: 'EACCES', message: proposedSentence(proposed.reason) },\n    };\n  };\n  const transcript = lasting(replicated(transcriptMember));\n  const proposals = lasting(replicated(proposalsMember));\n  let open = true;\n  const finish = () => {\n    if (!open) return;\n    open = false;\n    transcript.freeze();\n    proposals.freeze();\n    handle.release();\n  };\n  const closed = link.ended.then((reason) => {\n    finish();\n    return reason;\n  });\n  const settings: AgentSettings = {\n    state: replicatedState({ models: [], accounts: [] }),\n    connect: refuse,\n    disconnect: refuse,\n    remove: refuse,\n    serverUrl: refuse,\n    signIn: refuse,\n    dismissMoved: refuse,\n  };\n  return {\n    serverId,\n    guest,\n    control,\n    transcript: transcript.state,\n    proposals: proposals.state,\n    deliveries: replicatedState({}),\n    agents: replicatedState({\n      active: guest.agentId,\n      agents: [\n        { id: guest.agentId, name: guest.name, kind: 'cone' as const, parentId: null, role: null },\n      ],\n    }),\n    settings,\n    closed,\n    propose,\n    prompt: refuse,\n    webhook: refuse,\n    async close() {\n      finish();\n      link.close('closed');\n      await closed;\n      await host.close();\n    },\n  };\n}\n"],
+  "mappings": "AAAA,SAAS,cAA6B,uBAAuB;AAE7D,SAA+B,YAAY,OAAO,SAAS,eAAe;AAC1E;AAAA,EAEE;AAAA,EAEA;AAAA,OAKK;AACP,SAAS,OAAoB,kBAAkB;AAC/C,SAA4B,gBAAgB;AAGrC,MAAM,aAAa;AACnB,MAAM,eAAe;AAE5B,MAAM,OAA+B;AAAA,EACnC,SAAS;AAAA,EACT,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AACZ;AAEO,MAAM,mBAAmB,CAAC,WAC/B,KAAK,MAAM,KAAK;AAElB,MAAM,UAAU,CAAC,SAAiB,OAAO,aAAa,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC;AAOhG,eAAsB,aAAa,UAAkD;AACnF,QAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,QAAQ,YAAY;AAAA,EAC5B;AACA,QAAM,OAAO,WAAW,MAAM,OAAO;AACrC,QAAM,CAAC,MAAM,IAAK,MAAM,QAAQ,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,UAAmB;AACzF,UAAM,OAAQ,OAAqC;AACnD,QAAI,SAAS,WAAY,OAAM;AAC/B,UAAM,aAAa,KAAK,KAAK,MAAM,SAAS,cAAc,MAAM,KAAK,IAAI,QAAQ,YAAY;AAAA,EAC/F,CAAC;AACD,MAAI,OAAO,YAAY,SAAS;AAC9B,WAAO,QAAQ;AACf,SAAK,MAAM,kBAAkB;AAC7B,UAAM,KAAK,MAAM;AACjB,UAAM,QAAQ,YAAY;AAAA,EAC5B;AACA,QAAM,mBAAmB,OAAO;AAChC,QAAM,aAAa,OAAO;AAC1B,QAAM,kBAAkB,OAAO;AAC/B,QAAM,UACJ,CAAI,SACJ,UAAU,SAAgC;AACxC,UAAM,OAAO,OAAO,IAAI;AACxB,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,CAAC,QAAQ,KAAK,MAAM,GAAG,GAAG,CAAC,CAAC;AAAA,IACrD,SAAS,OAAO;AACd,YAAM,MAAM,KAAK;AAAA,IACnB;AAAA,EACF;AACF,QAAM,UAAU,CAAC,YAA4B,QAAkB,SAAS,EAAE,OAAO;AACjF,QAAM,QAAQ,WAAW;AACzB,QAAM,SAAS,MAAM,QAAQ,OAAO,QAAQ,UAAU,CAAC;AACvD,QAAM,UAAU,OAAO;AAAA,IACrB,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC;AAAA,EAC9C;AACA,UAAQ,YAAY,CAAC,UAAU,QAAqB,WAAW,EAAE,KAAK;AACtE,UAAQ,cAAc,CAAC,OAAO,QAA8B,aAAa,EAAE,EAAE;AAC7E,UAAQ,OAAO,OAAO,YAAmC;AACvD,QAAI,QAAQ,aAAa;AACvB,aAAO;AAAA,QACL,UAAU;AAAA,QACV,cAAc;AAAA,QACd,OAAO,EAAE,MAAM,UAAU,SAAS,8BAA8B;AAAA,MAClE;AACF,UAAM,WAAW,MAAM,QAAQ,EAAE,MAAM,QAAQ,MAAM,WAAW,QAAQ,UAAU,CAAC;AACnF,QAAI,SAAS,UAAU;AACrB,aAAO,EAAE,UAAU,MAAM,cAAc,SAAS,cAAc,OAAO,KAAK;AAC5E,QAAI,SAAS,UAAU;AACrB,aAAO,EAAE,UAAU,MAAM,cAAc,SAAS,QAAQ,OAAO,KAAK;AACtE,WAAO;AAAA,MACL,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO,EAAE,MAAM,UAAU,SAAS,iBAAiB,SAAS,MAAM,EAAE;AAAA,IACtE;AAAA,EACF;AACA,QAAM,aAAa,QAAQ,WAAW,gBAAgB,CAAC;AACvD,QAAM,YAAY,QAAQ,WAAW,eAAe,CAAC;AACrD,MAAI,OAAO;AACX,QAAM,SAAS,MAAM;AACnB,QAAI,CAAC,KAAM;AACX,WAAO;AACP,eAAW,OAAO;AAClB,cAAU,OAAO;AACjB,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,SAAS,KAAK,MAAM,KAAK,CAAC,WAAW;AACzC,WAAO;AACP,WAAO;AAAA,EACT,CAAC;AACD,QAAM,WAA0B;AAAA,IAC9B,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,IACnD,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,EAChB;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB,YAAY,gBAAgB,CAAC,CAAC;AAAA,IAC9B,QAAQ,gBAAgB;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,QACN,EAAE,IAAI,MAAM,SAAS,MAAM,MAAM,MAAM,MAAM,QAAiB,UAAU,MAAM,MAAM,KAAK;AAAA,MAC3F;AAAA,IACF,CAAC;AAAA,IACD;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,MAAM,QAAQ;AACZ,aAAO;AACP,WAAK,MAAM,QAAQ;AACnB,YAAM;AACN,YAAM,KAAK,MAAM;AAAA,IACnB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/host.js

@@ -57,6 +57,7 @@ const noSettings = {
   },
   remove: async () => {
   },
+  serverUrl: async () => null,
   signIn: async () => null,
   dismissMoved: async () => {
   }

package/dist/host.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/host.ts"],
-  "sourcesContent": ["import {\n  type Context,\n  createHost,\n  forbidden,\n  type Host,\n  type Readable,\n  type ReplicatedState,\n  replicatedState,\n  type Self,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { Agent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  type Approvals,\n  attachApprovals,\n  type Decider,\n} from './approvals/index.ts';\nimport { type ApprovalPolicies, alwaysFor, attachApprovalPolicy } from './approvals/policy.ts';\nimport { type AgentSudo, createSudo, ownedSudo } from './approvals/sudo.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport { IDLE, type ImportProgress } from './freezer/v6.ts';\nimport { createGuests, type Guests } from './guests/index.ts';\nimport type { ScoopReviewHost } from './guests/scoop.ts';\nimport { admitGuest, guestOpener } from './guests/serve.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { createMonitor, type MonitorOptions } from './monitor/index.ts';\nimport { viewRemote } from './readonly.ts';\nimport { type AgentRemote, createRemote } from './remote/host.ts';\nimport { createPages, ownedPages, type Pages } from './remote/pages.ts';\nimport type { SecretName } from './secrets/names.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AgentControl,\n  type AgentGuest,\n  AgentGuestService,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSettings,\n  AgentSudoService,\n  AgentTranscript,\n  CONTROL_METHODS,\n  CONTROL_READS,\n  type Command,\n  GUEST_METHODS,\n  OWNER_DEVICE_METHODS,\n  PAGE_METHODS,\n  type PrivateRevision,\n  REMOTE_METHODS,\n  REMOTE_READS,\n  SETTINGS_METHODS,\n  SUDO_METHODS,\n} from './services.ts';\nimport {\n  AGENT_HOST,\n  type AgentPrincipal,\n  type GuestPrincipal,\n  principalKey,\n  readable,\n  readablesOf,\n  SELF,\n  type Seat,\n  served,\n} from './serving.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { slimmer, type Thumbnail, thumbnail } from './thumbs.ts';\nimport { type LabelsRuntime, visibleLabels, watchLabel } from './titles/labels.ts';\nimport type { Uploads } from './uploads.ts';\nimport { agentViews } from './views.ts';\nimport { type PortEndpoint, PortLink } from './wire.ts';\n\nexport interface ConnectOptions {\n  readOnly?: boolean;\n  pages?: boolean;\n  guest?: { id: string; label: string };\n  device?: string;\n}\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  readonly pages: Pages;\n  readonly guests: Guests;\n  readonly approvals: Approvals;\n  connect(endpoint: PortEndpoint, options?: ConnectOptions): void;\n  close(): Promise<void>;\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  remove: async () => {},\n  signIn: async () => null,\n  dismissMoved: async () => {},\n};\n\nasync function follow(\n  agent: Agent,\n  context: Context,\n  slim: (view: ConversationView) => ConversationView\n) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(slim(attached.value));\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, slim(value));\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, slim(next.value));\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    refresh: () => state.replace(context, slim(attached.value)),\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport interface HostSecrets {\n  vault: ReplicatedState<VaultState>;\n  list(): readonly SecretName[];\n  close?(): void;\n}\n\nconst idleVault = replicatedState<VaultState>({\n  port: 'none',\n  needed: false,\n  version: 0,\n  locked: 'no',\n  held: 0,\n});\n\nfunction gatedControls(\n  control: AgentControl,\n  shown: (entry: number) => boolean,\n  views: () => readonly ConversationView[],\n  labels: ReplicatedState<Record<string, string>>\n) {\n  const visible = (entry: number) =>\n    views().some((view) => view.entries.some((item) => item.id === entry));\n  const gated =\n    (allowed: (entry: number) => boolean): AgentControl['image'] =>\n    async (ref, using) =>\n      allowed(ref.entry) ? control.image(ref, using) : { data: null, mimeType: null };\n  const trusted: AgentControl = { ...control, image: gated(shown) };\n  const viewed: AgentControl = { ...control, image: gated(visible), toolLabel: watchLabel(labels) };\n  return { trusted, viewed };\n}\n\nasync function approving(\n  agent: Agent,\n  policy: ApprovalPolicies,\n  options: { judge?: ApprovalJudge; intent?: ScoopReviewHost['intent']; approvalMs?: number },\n  context: Context\n): Promise<Approvals> {\n  const approvals = await attachApprovals(\n    {\n      harness: agent.harness,\n      guestAlways: alwaysFor(policy),\n      sudoApprover: () => policy.current().sudo.approver,\n      scoops: agent.scoopReviews,\n      ...(options.judge ? { judge: options.judge } : {}),\n      ...(options.approvalMs ? { ttlMs: options.approvalMs } : {}),\n    },\n    context\n  );\n  agent.scoopReviews.bind({\n    approvals,\n    agents: agent.agents,\n    harness: agent.harness,\n    ...(options.intent ? { intent: options.intent } : {}),\n  });\n  return approvals;\n}\n\nasync function guestsOf(\n  agent: Agent,\n  approvals: Approvals,\n  policy: ApprovalPolicies,\n  context: Context\n): Promise<Guests> {\n  const guests = await createGuests({\n    harness: agent.harness,\n    agents: agent.agents,\n    approvals,\n    policy,\n    reviews: agent.reviews,\n    context,\n  });\n  agent.gate.bind({ approvals, policy: () => guests.policy() });\n  return guests;\n}\n\nconst noRevision = () => replicatedState<PrivateRevision>({ revision: 0 });\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users'>;\n    pages?: Pages;\n    secrets?: HostSecrets;\n    uploads?: Uploads;\n    thumbnail?: Thumbnail;\n    labels?: LabelsRuntime;\n    approvals?: Approvals;\n    judge?: ApprovalJudge;\n    intent?: ScoopReviewHost['intent'];\n    approvalMs?: number;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  let refresh = () => {};\n  const slims = slimmer(options.thumbnail ?? thumbnail, () => refresh());\n  const transcript = await follow(agent, context, slims.slim);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context, slims.slim);\n  refresh = () => {\n    transcript.refresh();\n    mounted.refresh();\n  };\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const pages = options.pages ?? createPages();\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const policy = await attachApprovalPolicy(agent.harness, context);\n  const approvals = options.approvals ?? (await approving(agent, policy, options, context));\n  const monitor = createMonitor({\n    ...options.monitor,\n    harness: agent.harness,\n    agents: agent.agents,\n    views: mounted.views,\n    context,\n  });\n  const guests = await guestsOf(agent, approvals, policy, context);\n  const control: AgentControl = {\n    ...createAgentControl(\n      agent.harness,\n      agent,\n      deliveries,\n      options.licks,\n      options.scoops,\n      options.skills,\n      options.sprinkles,\n      options.memory,\n      options.freezer,\n      options.changes,\n      monitor,\n      options.secrets?.list,\n      options.uploads,\n      options.labels,\n      guests\n    ),\n    approvalPolicySet: (change, using) => policy.set(change, using),\n  };\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    vault: options.secrets?.vault ?? idleVault,\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  const shownViews = () => [state.value, ...Object.values(mounted.views.value)];\n  const kept = options.labels?.labels ?? replicatedState<Record<string, string>>({});\n  const labels = visibleLabels(kept, [state, mounted.views], shownViews);\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    privateRevision: options.skills?.privateRevision ?? noRevision(),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    importing: options.freezer?.importing ?? replicatedState<ImportProgress>(IDLE),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n    monitor: monitor.state,\n    vault: options.secrets?.vault ?? idleVault,\n    labels: labels.state,\n    guests: guests.seats,\n    approvals: approvals.state,\n    approvalPolicy: policy.state,\n  };\n  const sudo = createSudo({\n    approvals,\n    agents: () => agent.agents.state(),\n    ...(options.licks ? { licks: options.licks.licks } : {}),\n  });\n  const settings = options.settings ?? noSettings;\n  const gates = gatedControls(control, slims.shown, shownViews, transcriptService.labels);\n  const { trusted, viewed } = gates;\n  const host = serveAgent({\n    trusted,\n    viewed,\n    transcript: transcriptService,\n    viewMonitor: monitor.viewState,\n    sudo,\n    settings,\n    remote,\n    pages,\n    guest: guestOpener(guests, agent.agents, mounted.views, context),\n    decide: (by) => (id, decision, reason, using) =>\n      approvals.decide(id, decision, reason, by, using),\n  });\n  const offGuests = guests.onEnd((id) => {\n    void host.invalidatePrincipal(\n      (principal) => principal.seat === 'guest' && principal.guest.id === id\n    );\n  });\n  let links = 0;\n  return {\n    serverId,\n    agent,\n    pages,\n    guests,\n    approvals,\n    ...(options.users ? { users: options.users } : {}),\n    connect(endpoint, connectOptions) {\n      if (connectOptions?.guest) {\n        links += 1;\n        admitGuest(guests, endpoint, connectOptions.guest, serverId, links, host);\n        return;\n      }\n      const seat: Exclude<Seat, 'guest'> = connectOptions?.readOnly\n        ? 'view'\n        : connectOptions?.pages === false\n          ? 'control'\n          : 'owner';\n      links += 1;\n      const link = new PortLink(endpoint);\n      link.greet(serverId);\n      const device = connectOptions?.device ? { device: connectOptions.device } : {};\n      host.accept(link, {\n        principal: { seat, link: links, ...device } satisfies AgentPrincipal,\n      });\n    },\n    async close() {\n      offGuests();\n      await host.close();\n      guests.dispose();\n      await pages.dispose();\n      await monitor.dispose();\n      await remote.dispose();\n      deliveries.dispose();\n      sudo.close();\n      approvals.close();\n      transcript.dispose();\n      mounted.dispose();\n      labels.dispose();\n      slims.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      options.secrets?.close?.();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n\ninterface Served {\n  trusted: AgentControl;\n  viewed: AgentControl;\n  transcript: Record<keyof AgentTranscript, ReplicatedState<unknown>>;\n  viewMonitor: ReplicatedState<unknown>;\n  sudo?: AgentSudo;\n  settings: AgentSettings;\n  remote: AgentRemote;\n  pages: Pages;\n  guest?: (principal: GuestPrincipal) => { value: AgentGuest; dispose(): void } | undefined;\n  decide: (by: Decider) => AgentControl['decide'];\n}\n\nexport const CLOSED_TO_GUESTS = 'a guest seat has only its transcript and propose';\n\nconst opened = new WeakSet<object>();\n\nexport const openToGuests = <F extends object>(factory: F): F => {\n  opened.add(factory);\n  return factory;\n};\n\nexport function closedToGuests(host: Host<AgentPrincipal>): Host<AgentPrincipal> {\n  const serve = ((type: never, factory: (...args: unknown[]) => unknown, options?: never) =>\n    host.serve(\n      type,\n      (opened.has(factory)\n        ? factory\n        : (input: unknown, principal: AgentPrincipal, self: unknown) => {\n            if (principal.seat === 'guest') throw forbidden(CLOSED_TO_GUESTS);\n            return factory(input, principal, self);\n          }) as never,\n      options\n    )) as Host<AgentPrincipal>['serve'];\n  return new Proxy(host, {\n    get(target, key) {\n      if (key === 'serve') return serve;\n      const value = Reflect.get(target, key, target) as unknown;\n      return typeof value === 'function' ? value.bind(target) : value;\n    },\n  });\n}\n\nexport function lazily<T>(state: () => ReplicatedState<T>): Readable<T> {\n  return {\n    get value() {\n      return readable(state()).value;\n    },\n    subscribe: (listener) => readable(state()).subscribe(listener),\n    events: (listener) => readable(state()).events(listener),\n  };\n}\n\nconst seated = (serving: Served, principal: AgentPrincipal): AgentControl => ({\n  ...(principal.seat === 'view' ? serving.viewed : serving.trusted),\n  decide: serving.decide({\n    by: principal.seat === 'owner' ? 'owner' : 'follower',\n    ...('device' in principal && principal.device ? { device: principal.device } : {}),\n  }),\n});\n\nconst VIEW_METHODS = [...CONTROL_READS, ...OWNER_DEVICE_METHODS];\n\nexport function serveAgent(serving: Served): Host<AgentPrincipal> {\n  const host = closedToGuests(\n    createHost<AgentPrincipal>({ name: AGENT_HOST, self: SELF, principalKey })\n  );\n  const viewing = { ...serving.transcript, monitor: serving.viewMonitor };\n  host.serve(AgentControl, (_input, principal) => {\n    const control = seated(serving, principal);\n    return principal.seat === 'view'\n      ? { variant: 'view', ...served(() => control, VIEW_METHODS) }\n      : { variant: 'control', ...served(() => control, CONTROL_METHODS) };\n  });\n  host.serve(AgentTranscript, (_input, principal) => ({\n    variant: 'transcript',\n    ...readablesOf(principal.seat === 'view' ? viewing : serving.transcript),\n  }));\n  host.serve(AgentSettings, (_input, principal) =>\n    principal.seat === 'view'\n      ? { variant: 'view', state: readable(serving.settings.state) }\n      : {\n          variant: 'settings',\n          state: readable(serving.settings.state),\n          ...served(() => serving.settings, SETTINGS_METHODS),\n        }\n  );\n  host.serve(AgentRemoteService, (_input, principal) => {\n    if (principal.seat !== 'view')\n      return { variant: 'remote', ...served(() => serving.remote, REMOTE_METHODS) };\n    const scoped = viewRemote(serving.remote);\n    return { variant: 'watch', ...served(() => scoped, REMOTE_READS) };\n  });\n  host.serve(AgentPagesService, (_input, principal, self) => {\n    if (principal.seat !== 'owner') return { variant: 'none' };\n    const mine = self.resource('mine', {\n      version: 1,\n      open: () => ownedPages(serving.pages),\n      close: (owned) => owned.release(),\n    });\n    return { variant: 'pages', ...served(() => mine.value, PAGE_METHODS) };\n  });\n  host.serve(\n    AgentGuestService,\n    openToGuests((_input: unknown, principal: AgentPrincipal, self: Self<AgentPrincipal>) => {\n      if (principal.seat !== 'guest') return { variant: 'none' };\n      const opening = serving.guest?.(principal.guest);\n      if (!opening) throw forbidden(CLOSED_TO_GUESTS);\n      const seat = self.resource('seat', {\n        version: 1,\n        open: () => opening,\n        close: (made) => made.dispose(),\n      });\n      const later = (name: 'transcript' | 'seat' | 'proposals') =>\n        lazily(() => seat.value.value[name] as ReplicatedState<unknown>);\n      return {\n        variant: 'guest',\n        transcript: later('transcript'),\n        seat: later('seat'),\n        proposals: later('proposals'),\n        ...served(() => seat.value.value, GUEST_METHODS),\n      };\n    })\n  );\n  host.serve(AgentSudoService, (_input, principal, self) => {\n    const sudo = serving.sudo;\n    if (principal.seat !== 'owner' || !sudo) return { variant: 'none' };\n    const mine = self.resource('mine', {\n      version: 1,\n      open: () => ownedSudo(sudo),\n      close: (owned) => owned.release(),\n    });\n    return {\n      variant: 'sudo',\n      approvals: readable(sudo.approvals),\n      ...served(() => mine.value, SUDO_METHODS),\n    };\n  });\n  return host;\n}\n"],
-  "mappings": "AAAA;AAAA,EAEE;AAAA,EACA;AAAA,EAIA;AAAA,OAEK;AACP,SAAS,0BAA0B;AAGnC;AAAA,EAGE;AAAA,OAEK;AACP,SAAgC,WAAW,4BAA4B;AACvE,SAAyB,YAAY,iBAAiB;AAGtD,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAEhC,SAAS,YAAiC;AAC1C,SAAS,oBAAiC;AAE1C,SAAS,YAAY,mBAAmB;AAKxC,SAAS,qBAA0C;AACnD,SAAS,kBAAkB;AAC3B,SAA2B,oBAAoB;AAC/C,SAAS,aAAa,kBAA8B;AAGpD;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,SAAyB,iBAAiB;AACnD,SAA6B,eAAe,kBAAkB;AAE9D,SAAS,kBAAkB;AAC3B,SAA4B,gBAAgB;AAoB5C,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AAAA,EAAC;AAAA,EACrB,QAAQ,YAAY;AAAA,EACpB,cAAc,YAAY;AAAA,EAAC;AAC7B;AAEA,eAAe,OACb,OACA,SACA,MACA;AACA,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,KAAK,SAAS,KAAK,CAAC;AACpE,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC;AAC1F,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK,KAAK,CAAC;AACvC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM,MAAM,QAAQ,SAAS,KAAK,SAAS,KAAK,CAAC;AAAA,IAC1D,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAQA,MAAM,YAAY,gBAA4B;AAAA,EAC5C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,MAAM;AACR,CAAC;AAED,SAAS,cACP,SACA,OACA,OACA,QACA;AACA,QAAM,UAAU,CAAC,UACf,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,QAAQ,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK,CAAC;AACvE,QAAM,QACJ,CAAC,YACD,OAAO,KAAK,UACV,QAAQ,IAAI,KAAK,IAAI,QAAQ,MAAM,KAAK,KAAK,IAAI,EAAE,MAAM,MAAM,UAAU,KAAK;AAClF,QAAM,UAAwB,EAAE,GAAG,SAAS,OAAO,MAAM,KAAK,EAAE;AAChE,QAAM,SAAuB,EAAE,GAAG,SAAS,OAAO,MAAM,OAAO,GAAG,WAAW,WAAW,MAAM,EAAE;AAChG,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,eAAe,UACb,OACA,QACA,SACA,SACoB;AACpB,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,MACE,SAAS,MAAM;AAAA,MACf,aAAa,UAAU,MAAM;AAAA,MAC7B,cAAc,MAAM,OAAO,QAAQ,EAAE,KAAK;AAAA,MAC1C,QAAQ,MAAM;AAAA,MACd,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAChD,GAAI,QAAQ,aAAa,EAAE,OAAO,QAAQ,WAAW,IAAI,CAAC;AAAA,IAC5D;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,KAAK;AAAA,IACtB;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,EACrD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,SACb,OACA,WACA,QACA,SACiB;AACjB,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd;AAAA,IACA;AAAA,IACA,SAAS,MAAM;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,KAAK,KAAK,EAAE,WAAW,QAAQ,MAAM,OAAO,OAAO,EAAE,CAAC;AAC5D,SAAO;AACT;AAEA,MAAM,aAAa,MAAM,gBAAiC,EAAE,UAAU,EAAE,CAAC;AAEzE,eAAsB,UACpB,OACA,UAuBI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,QAAQ,QAAQ,QAAQ,aAAa,WAAW,MAAM,QAAQ,CAAC;AACrE,QAAM,aAAa,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI;AAC1D,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,IAAI;AAC3D,YAAU,MAAM;AACd,eAAW,QAAQ;AACnB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,QAAQ,QAAQ,SAAS,YAAY;AAC3C,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,SAAS,MAAM,qBAAqB,MAAM,SAAS,OAAO;AAChE,QAAM,YAAY,QAAQ,aAAc,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO;AACvF,QAAM,UAAU,cAAc;AAAA,IAC5B,GAAG,QAAQ;AAAA,IACX,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,QAAQ;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,SAAS,MAAM,SAAS,OAAO,WAAW,QAAQ,OAAO;AAC/D,QAAM,UAAwB;AAAA,IAC5B,GAAG;AAAA,MACD,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,IACA,mBAAmB,CAAC,QAAQ,UAAU,OAAO,IAAI,QAAQ,KAAK;AAAA,EAChE;AACA,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,QAAM,aAAa,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC;AAC5E,QAAM,OAAO,QAAQ,QAAQ,UAAU,gBAAwC,CAAC,CAAC;AACjF,QAAM,SAAS,cAAc,MAAM,CAAC,OAAO,QAAQ,KAAK,GAAG,UAAU;AACrE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,iBAAiB,QAAQ,QAAQ,mBAAmB,WAAW;AAAA,IAC/D,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,WAAW,QAAQ,SAAS,aAAa,gBAAgC,IAAI;AAAA,IAC7E,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,IAC1F,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,WAAW,UAAU;AAAA,IACrB,gBAAgB,OAAO;AAAA,EACzB;AACA,QAAM,OAAO,WAAW;AAAA,IACtB;AAAA,IACA,QAAQ,MAAM,MAAM,OAAO,MAAM;AAAA,IACjC,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,MAAM,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,QAAQ,cAAc,SAAS,MAAM,OAAO,YAAY,kBAAkB,MAAM;AACtF,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,OAAO,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,YAAY,QAAQ,MAAM,QAAQ,QAAQ,OAAO,OAAO;AAAA,IAC/D,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,QAAQ,UACrC,UAAU,OAAO,IAAI,UAAU,QAAQ,IAAI,KAAK;AAAA,EACpD,CAAC;AACD,QAAM,YAAY,OAAO,MAAM,CAAC,OAAO;AACrC,SAAK,KAAK;AAAA,MACR,CAAC,cAAc,UAAU,SAAS,WAAW,UAAU,MAAM,OAAO;AAAA,IACtE;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,QAAQ,UAAU,gBAAgB;AAChC,UAAI,gBAAgB,OAAO;AACzB,iBAAS;AACT,mBAAW,QAAQ,UAAU,eAAe,OAAO,UAAU,OAAO,IAAI;AACxE;AAAA,MACF;AACA,YAAM,OAA+B,gBAAgB,WACjD,SACA,gBAAgB,UAAU,QACxB,YACA;AACN,eAAS;AACT,YAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,WAAK,MAAM,QAAQ;AACnB,YAAM,SAAS,gBAAgB,SAAS,EAAE,QAAQ,eAAe,OAAO,IAAI,CAAC;AAC7E,WAAK,OAAO,MAAM;AAAA,QAChB,WAAW,EAAE,MAAM,MAAM,OAAO,GAAG,OAAO;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU;AACV,YAAM,KAAK,MAAM;AACjB,aAAO,QAAQ;AACf,YAAM,MAAM,QAAQ;AACpB,YAAM,QAAQ,QAAQ;AACtB,YAAM,OAAO,QAAQ;AACrB,iBAAW,QAAQ;AACnB,WAAK,MAAM;AACX,gBAAU,MAAM;AAChB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,aAAO,QAAQ;AACf,YAAM,QAAQ;AACd,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,cAAQ,SAAS,QAAQ;AACzB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAClB,YAAM,QAAQ,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAeO,MAAM,mBAAmB;AAEhC,MAAM,SAAS,oBAAI,QAAgB;AAE5B,MAAM,eAAe,CAAmB,YAAkB;AAC/D,SAAO,IAAI,OAAO;AAClB,SAAO;AACT;AAEO,SAAS,eAAe,MAAkD;AAC/E,QAAM,SAAS,CAAC,MAAa,SAA0C,YACrE,KAAK;AAAA,IACH;AAAA,IACC,OAAO,IAAI,OAAO,IACf,UACA,CAAC,OAAgB,WAA2B,SAAkB;AAC5D,UAAI,UAAU,SAAS,QAAS,OAAM,UAAU,gBAAgB;AAChE,aAAO,QAAQ,OAAO,WAAW,IAAI;AAAA,IACvC;AAAA,IACJ;AAAA,EACF;AACF,SAAO,IAAI,MAAM,MAAM;AAAA,IACrB,IAAI,QAAQ,KAAK;AACf,UAAI,QAAQ,QAAS,QAAO;AAC5B,YAAM,QAAQ,QAAQ,IAAI,QAAQ,KAAK,MAAM;AAC7C,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAEO,SAAS,OAAU,OAA8C;AACtE,SAAO;AAAA,IACL,IAAI,QAAQ;AACV,aAAO,SAAS,MAAM,CAAC,EAAE;AAAA,IAC3B;AAAA,IACA,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC,EAAE,UAAU,QAAQ;AAAA,IAC7D,QAAQ,CAAC,aAAa,SAAS,MAAM,CAAC,EAAE,OAAO,QAAQ;AAAA,EACzD;AACF;AAEA,MAAM,SAAS,CAAC,SAAiB,eAA6C;AAAA,EAC5E,GAAI,UAAU,SAAS,SAAS,QAAQ,SAAS,QAAQ;AAAA,EACzD,QAAQ,QAAQ,OAAO;AAAA,IACrB,IAAI,UAAU,SAAS,UAAU,UAAU;AAAA,IAC3C,GAAI,YAAY,aAAa,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,CAAC;AAAA,EAClF,CAAC;AACH;AAEA,MAAM,eAAe,CAAC,GAAG,eAAe,GAAG,oBAAoB;AAExD,SAAS,WAAW,SAAuC;AAChE,QAAM,OAAO;AAAA,IACX,WAA2B,EAAE,MAAM,YAAY,MAAM,MAAM,aAAa,CAAC;AAAA,EAC3E;AACA,QAAM,UAAU,EAAE,GAAG,QAAQ,YAAY,SAAS,QAAQ,YAAY;AACtE,OAAK,MAAM,cAAc,CAAC,QAAQ,cAAc;AAC9C,UAAM,UAAU,OAAO,SAAS,SAAS;AACzC,WAAO,UAAU,SAAS,SACtB,EAAE,SAAS,QAAQ,GAAG,OAAO,MAAM,SAAS,YAAY,EAAE,IAC1D,EAAE,SAAS,WAAW,GAAG,OAAO,MAAM,SAAS,eAAe,EAAE;AAAA,EACtE,CAAC;AACD,OAAK,MAAM,iBAAiB,CAAC,QAAQ,eAAe;AAAA,IAClD,SAAS;AAAA,IACT,GAAG,YAAY,UAAU,SAAS,SAAS,UAAU,QAAQ,UAAU;AAAA,EACzE,EAAE;AACF,OAAK;AAAA,IAAM;AAAA,IAAe,CAAC,QAAQ,cACjC,UAAU,SAAS,SACf,EAAE,SAAS,QAAQ,OAAO,SAAS,QAAQ,SAAS,KAAK,EAAE,IAC3D;AAAA,MACE,SAAS;AAAA,MACT,OAAO,SAAS,QAAQ,SAAS,KAAK;AAAA,MACtC,GAAG,OAAO,MAAM,QAAQ,UAAU,gBAAgB;AAAA,IACpD;AAAA,EACN;AACA,OAAK,MAAM,oBAAoB,CAAC,QAAQ,cAAc;AACpD,QAAI,UAAU,SAAS;AACrB,aAAO,EAAE,SAAS,UAAU,GAAG,OAAO,MAAM,QAAQ,QAAQ,cAAc,EAAE;AAC9E,UAAM,SAAS,WAAW,QAAQ,MAAM;AACxC,WAAO,EAAE,SAAS,SAAS,GAAG,OAAO,MAAM,QAAQ,YAAY,EAAE;AAAA,EACnE,CAAC;AACD,OAAK,MAAM,mBAAmB,CAAC,QAAQ,WAAW,SAAS;AACzD,QAAI,UAAU,SAAS,QAAS,QAAO,EAAE,SAAS,OAAO;AACzD,UAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,MACjC,SAAS;AAAA,MACT,MAAM,MAAM,WAAW,QAAQ,KAAK;AAAA,MACpC,OAAO,CAAC,UAAU,MAAM,QAAQ;AAAA,IAClC,CAAC;AACD,WAAO,EAAE,SAAS,SAAS,GAAG,OAAO,MAAM,KAAK,OAAO,YAAY,EAAE;AAAA,EACvE,CAAC;AACD,OAAK;AAAA,IACH;AAAA,IACA,aAAa,CAAC,QAAiB,WAA2B,SAA+B;AACvF,UAAI,UAAU,SAAS,QAAS,QAAO,EAAE,SAAS,OAAO;AACzD,YAAM,UAAU,QAAQ,QAAQ,UAAU,KAAK;AAC/C,UAAI,CAAC,QAAS,OAAM,UAAU,gBAAgB;AAC9C,YAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,QACjC,SAAS;AAAA,QACT,MAAM,MAAM;AAAA,QACZ,OAAO,CAAC,SAAS,KAAK,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,QAAQ,CAAC,SACb,OAAO,MAAM,KAAK,MAAM,MAAM,IAAI,CAA6B;AACjE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,YAAY,MAAM,YAAY;AAAA,QAC9B,MAAM,MAAM,MAAM;AAAA,QAClB,WAAW,MAAM,WAAW;AAAA,QAC5B,GAAG,OAAO,MAAM,KAAK,MAAM,OAAO,aAAa;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH;AACA,OAAK,MAAM,kBAAkB,CAAC,QAAQ,WAAW,SAAS;AACxD,UAAM,OAAO,QAAQ;AACrB,QAAI,UAAU,SAAS,WAAW,CAAC,KAAM,QAAO,EAAE,SAAS,OAAO;AAClE,UAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,MACjC,SAAS;AAAA,MACT,MAAM,MAAM,UAAU,IAAI;AAAA,MAC1B,OAAO,CAAC,UAAU,MAAM,QAAQ;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,SAAS,KAAK,SAAS;AAAA,MAClC,GAAG,OAAO,MAAM,KAAK,OAAO,YAAY;AAAA,IAC1C;AAAA,EACF,CAAC;AACD,SAAO;AACT;",
+  "sourcesContent": ["import {\n  type Context,\n  createHost,\n  forbidden,\n  type Host,\n  type Readable,\n  type ReplicatedState,\n  replicatedState,\n  type Self,\n} from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { ConversationView } from '@earendil-works/pi-durable';\nimport type { Agent } from './agent.ts';\nimport {\n  type ApprovalJudge,\n  type Approvals,\n  attachApprovals,\n  type Decider,\n} from './approvals/index.ts';\nimport { type ApprovalPolicies, alwaysFor, attachApprovalPolicy } from './approvals/policy.ts';\nimport { type AgentSudo, createSudo, ownedSudo } from './approvals/sudo.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { ChangesRuntime } from './changes/index.ts';\nimport { createAgentControl, type HostLicks, type HostScoops } from './control.ts';\nimport { trackDeliveries } from './deliveries.ts';\nimport type { FreezerRuntime, FrozenCone } from './freezer/index.ts';\nimport { IDLE, type ImportProgress } from './freezer/v6.ts';\nimport { createGuests, type Guests } from './guests/index.ts';\nimport type { ScoopReviewHost } from './guests/scoop.ts';\nimport { admitGuest, guestOpener } from './guests/serve.ts';\nimport type { UserClients } from './kernel/users.ts';\nimport type { McpRuntime } from './mcp/index.ts';\nimport type { MemoryEntry, MemoryScope } from './memory/format.ts';\nimport type { MemoryRuntime } from './memory/index.ts';\nimport { createMonitor, type MonitorOptions } from './monitor/index.ts';\nimport { viewRemote } from './readonly.ts';\nimport { type AgentRemote, createRemote } from './remote/host.ts';\nimport { createPages, ownedPages, type Pages } from './remote/pages.ts';\nimport type { SecretName } from './secrets/names.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport {\n  AgentControl,\n  type AgentGuest,\n  AgentGuestService,\n  AgentPagesService,\n  AgentRemoteService,\n  AgentSettings,\n  AgentSudoService,\n  AgentTranscript,\n  CONTROL_METHODS,\n  CONTROL_READS,\n  type Command,\n  GUEST_METHODS,\n  OWNER_DEVICE_METHODS,\n  PAGE_METHODS,\n  type PrivateRevision,\n  REMOTE_METHODS,\n  REMOTE_READS,\n  SETTINGS_METHODS,\n  SUDO_METHODS,\n} from './services.ts';\nimport {\n  AGENT_HOST,\n  type AgentPrincipal,\n  type GuestPrincipal,\n  principalKey,\n  readable,\n  readablesOf,\n  SELF,\n  type Seat,\n  served,\n} from './serving.ts';\nimport type { SkillsRuntime } from './skills/index.ts';\nimport type { SprinklesRuntime } from './sprinkles/index.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\nimport { slimmer, type Thumbnail, thumbnail } from './thumbs.ts';\nimport { type LabelsRuntime, visibleLabels, watchLabel } from './titles/labels.ts';\nimport type { Uploads } from './uploads.ts';\nimport { agentViews } from './views.ts';\nimport { type PortEndpoint, PortLink } from './wire.ts';\n\nexport interface ConnectOptions {\n  readOnly?: boolean;\n  pages?: boolean;\n  guest?: { id: string; label: string };\n  device?: string;\n}\n\nexport interface AgentHost {\n  readonly serverId: string;\n  readonly agent: Agent;\n  readonly users?: UserClients;\n  readonly pages: Pages;\n  readonly guests: Guests;\n  readonly approvals: Approvals;\n  connect(endpoint: PortEndpoint, options?: ConnectOptions): void;\n  close(): Promise<void>;\n}\n\nconst noSettings: AgentSettings = {\n  state: replicatedState({ models: [], accounts: [] }),\n  connect: async () => {\n    throw new Error('this agent has no accounts');\n  },\n  disconnect: async () => {},\n  remove: async () => {},\n  serverUrl: async () => null,\n  signIn: async () => null,\n  dismissMoved: async () => {},\n};\n\nasync function follow(\n  agent: Agent,\n  context: Context,\n  slim: (view: ConversationView) => ConversationView\n) {\n  let attached = await agent.cone().viewState(context);\n  const state = replicatedState<ConversationView>(slim(attached.value));\n  const mirror = (value: ConversationView, from: Context) => state.replace(from, slim(value));\n  let off = attached.subscribe(mirror);\n  const stop = agent.onCone(async (conversation) => {\n    const next = await conversation.viewState(context);\n    off();\n    attached.dispose();\n    attached = next;\n    state.replace(context, slim(next.value));\n    off = next.subscribe(mirror);\n  });\n  return {\n    state,\n    refresh: () => state.replace(context, slim(attached.value)),\n    dispose() {\n      stop();\n      off();\n      attached.dispose();\n    },\n  };\n}\n\nexport interface HostSecrets {\n  vault: ReplicatedState<VaultState>;\n  list(): readonly SecretName[];\n  close?(): void;\n}\n\nconst idleVault = replicatedState<VaultState>({\n  port: 'none',\n  needed: false,\n  version: 0,\n  locked: 'no',\n  held: 0,\n});\n\nfunction gatedControls(\n  control: AgentControl,\n  shown: (entry: number) => boolean,\n  views: () => readonly ConversationView[],\n  labels: ReplicatedState<Record<string, string>>\n) {\n  const visible = (entry: number) =>\n    views().some((view) => view.entries.some((item) => item.id === entry));\n  const gated =\n    (allowed: (entry: number) => boolean): AgentControl['image'] =>\n    async (ref, using) =>\n      allowed(ref.entry) ? control.image(ref, using) : { data: null, mimeType: null };\n  const trusted: AgentControl = { ...control, image: gated(shown) };\n  const viewed: AgentControl = { ...control, image: gated(visible), toolLabel: watchLabel(labels) };\n  return { trusted, viewed };\n}\n\nasync function approving(\n  agent: Agent,\n  policy: ApprovalPolicies,\n  options: { judge?: ApprovalJudge; intent?: ScoopReviewHost['intent']; approvalMs?: number },\n  context: Context\n): Promise<Approvals> {\n  const approvals = await attachApprovals(\n    {\n      harness: agent.harness,\n      guestAlways: alwaysFor(policy),\n      sudoApprover: () => policy.current().sudo.approver,\n      scoops: agent.scoopReviews,\n      ...(options.judge ? { judge: options.judge } : {}),\n      ...(options.approvalMs ? { ttlMs: options.approvalMs } : {}),\n    },\n    context\n  );\n  agent.scoopReviews.bind({\n    approvals,\n    agents: agent.agents,\n    harness: agent.harness,\n    ...(options.intent ? { intent: options.intent } : {}),\n  });\n  return approvals;\n}\n\nasync function guestsOf(\n  agent: Agent,\n  approvals: Approvals,\n  policy: ApprovalPolicies,\n  context: Context\n): Promise<Guests> {\n  const guests = await createGuests({\n    harness: agent.harness,\n    agents: agent.agents,\n    approvals,\n    policy,\n    reviews: agent.reviews,\n    context,\n  });\n  agent.gate.bind({ approvals, policy: () => guests.policy() });\n  return guests;\n}\n\nconst noRevision = () => replicatedState<PrivateRevision>({ revision: 0 });\n\nexport async function hostAgent(\n  agent: Agent,\n  options: {\n    serverId?: string;\n    context?: Context;\n    settings?: AgentSettings;\n    licks?: HostLicks;\n    scoops?: HostScoops;\n    skills?: SkillsRuntime;\n    sprinkles?: SprinklesRuntime;\n    memory?: MemoryRuntime;\n    freezer?: FreezerRuntime;\n    changes?: ChangesRuntime;\n    mcp?: Pick<McpRuntime, 'close'>;\n    users?: UserClients;\n    monitor?: Pick<MonitorOptions, 'kernel' | 'groups' | 'users'>;\n    pages?: Pages;\n    secrets?: HostSecrets;\n    uploads?: Uploads;\n    thumbnail?: Thumbnail;\n    labels?: LabelsRuntime;\n    approvals?: Approvals;\n    judge?: ApprovalJudge;\n    intent?: ScoopReviewHost['intent'];\n    approvalMs?: number;\n  } = {}\n): Promise<AgentHost> {\n  const context = options.context ?? BACKGROUND_CONTEXT;\n  const serverId = options.serverId ?? crypto.randomUUID();\n  let refresh = () => {};\n  const slims = slimmer(options.thumbnail ?? thumbnail, () => refresh());\n  const transcript = await follow(agent, context, slims.slim);\n  const { state } = transcript;\n  const mounted = await agentViews(agent, context, slims.slim);\n  refresh = () => {\n    transcript.refresh();\n    mounted.refresh();\n  };\n  const touch = () => options.freezer?.touch();\n  const untouch = [state.subscribe(touch), mounted.views.subscribe(touch)];\n  const pages = options.pages ?? createPages();\n  const deliveries = trackDeliveries(agent.harness, state, context);\n  const policy = await attachApprovalPolicy(agent.harness, context);\n  const approvals = options.approvals ?? (await approving(agent, policy, options, context));\n  const monitor = createMonitor({\n    ...options.monitor,\n    harness: agent.harness,\n    agents: agent.agents,\n    views: mounted.views,\n    context,\n  });\n  const guests = await guestsOf(agent, approvals, policy, context);\n  const control: AgentControl = {\n    ...createAgentControl(\n      agent.harness,\n      agent,\n      deliveries,\n      options.licks,\n      options.scoops,\n      options.skills,\n      options.sprinkles,\n      options.memory,\n      options.freezer,\n      options.changes,\n      monitor,\n      options.secrets?.list,\n      options.uploads,\n      options.labels,\n      guests\n    ),\n    approvalPolicySet: (change, using) => policy.set(change, using),\n  };\n  const remote = createRemote({\n    harness: agent.harness,\n    send: (request, using) => control.send(request, using),\n    vault: options.secrets?.vault ?? idleVault,\n    async conversation(agentId, using) {\n      if (!agentId) return agent.cone();\n      const found = await agent.agents.conversation(agentId, using);\n      if (!found) throw new Error(`There is no agent ${agentId}.`);\n      return found;\n    },\n  });\n  const shownViews = () => [state.value, ...Object.values(mounted.views.value)];\n  const kept = options.labels?.labels ?? replicatedState<Record<string, string>>({});\n  const labels = visibleLabels(kept, [state, mounted.views], shownViews);\n  const transcriptService = {\n    state,\n    deliveries: deliveries.state,\n    agents: mounted.agents,\n    views: mounted.views,\n    commands: options.skills?.commands ?? replicatedState<Command[]>([]),\n    privateRevision: options.skills?.privateRevision ?? noRevision(),\n    sprinkles: options.sprinkles?.sprinkles ?? replicatedState<Sprinkle[]>([]),\n    memories: options.memory?.memories ?? replicatedState<MemoryEntry[]>([]),\n    memoryScopes: options.memory?.scopes ?? replicatedState<MemoryScope[]>([]),\n    frozen: options.freezer?.frozen ?? replicatedState<FrozenCone[]>([]),\n    importing: options.freezer?.importing ?? replicatedState<ImportProgress>(IDLE),\n    changes:\n      options.changes?.view ?? replicatedState<ChangesView>({ unavailable: null, changes: [] }),\n    monitor: monitor.state,\n    vault: options.secrets?.vault ?? idleVault,\n    labels: labels.state,\n    guests: guests.seats,\n    approvals: approvals.state,\n    approvalPolicy: policy.state,\n  };\n  const sudo = createSudo({\n    approvals,\n    agents: () => agent.agents.state(),\n    ...(options.licks ? { licks: options.licks.licks } : {}),\n  });\n  const settings = options.settings ?? noSettings;\n  const gates = gatedControls(control, slims.shown, shownViews, transcriptService.labels);\n  const { trusted, viewed } = gates;\n  const host = serveAgent({\n    trusted,\n    viewed,\n    transcript: transcriptService,\n    viewMonitor: monitor.viewState,\n    sudo,\n    settings,\n    remote,\n    pages,\n    guest: guestOpener(guests, agent.agents, mounted.views, context),\n    decide: (by) => (id, decision, reason, using) =>\n      approvals.decide(id, decision, reason, by, using),\n  });\n  const offGuests = guests.onEnd((id) => {\n    void host.invalidatePrincipal(\n      (principal) => principal.seat === 'guest' && principal.guest.id === id\n    );\n  });\n  let links = 0;\n  return {\n    serverId,\n    agent,\n    pages,\n    guests,\n    approvals,\n    ...(options.users ? { users: options.users } : {}),\n    connect(endpoint, connectOptions) {\n      if (connectOptions?.guest) {\n        links += 1;\n        admitGuest(guests, endpoint, connectOptions.guest, serverId, links, host);\n        return;\n      }\n      const seat: Exclude<Seat, 'guest'> = connectOptions?.readOnly\n        ? 'view'\n        : connectOptions?.pages === false\n          ? 'control'\n          : 'owner';\n      links += 1;\n      const link = new PortLink(endpoint);\n      link.greet(serverId);\n      const device = connectOptions?.device ? { device: connectOptions.device } : {};\n      host.accept(link, {\n        principal: { seat, link: links, ...device } satisfies AgentPrincipal,\n      });\n    },\n    async close() {\n      offGuests();\n      await host.close();\n      guests.dispose();\n      await pages.dispose();\n      await monitor.dispose();\n      await remote.dispose();\n      deliveries.dispose();\n      sudo.close();\n      approvals.close();\n      transcript.dispose();\n      mounted.dispose();\n      labels.dispose();\n      slims.dispose();\n      for (const off of untouch) off();\n      options.freezer?.close();\n      options.secrets?.close?.();\n      await options.changes?.close(context);\n      await options.memory?.close(context);\n      await options.sprinkles?.close(context);\n      await options.skills?.close(context);\n      await options.mcp?.close(context);\n      await options.scoops?.runtime.close(context);\n      await options.licks?.sources.close(context);\n      await agent.close();\n      await options.users?.close();\n    },\n  };\n}\n\ninterface Served {\n  trusted: AgentControl;\n  viewed: AgentControl;\n  transcript: Record<keyof AgentTranscript, ReplicatedState<unknown>>;\n  viewMonitor: ReplicatedState<unknown>;\n  sudo?: AgentSudo;\n  settings: AgentSettings;\n  remote: AgentRemote;\n  pages: Pages;\n  guest?: (principal: GuestPrincipal) => { value: AgentGuest; dispose(): void } | undefined;\n  decide: (by: Decider) => AgentControl['decide'];\n}\n\nexport const CLOSED_TO_GUESTS = 'a guest seat has only its transcript and propose';\n\nconst opened = new WeakSet<object>();\n\nexport const openToGuests = <F extends object>(factory: F): F => {\n  opened.add(factory);\n  return factory;\n};\n\nexport function closedToGuests(host: Host<AgentPrincipal>): Host<AgentPrincipal> {\n  const serve = ((type: never, factory: (...args: unknown[]) => unknown, options?: never) =>\n    host.serve(\n      type,\n      (opened.has(factory)\n        ? factory\n        : (input: unknown, principal: AgentPrincipal, self: unknown) => {\n            if (principal.seat === 'guest') throw forbidden(CLOSED_TO_GUESTS);\n            return factory(input, principal, self);\n          }) as never,\n      options\n    )) as Host<AgentPrincipal>['serve'];\n  return new Proxy(host, {\n    get(target, key) {\n      if (key === 'serve') return serve;\n      const value = Reflect.get(target, key, target) as unknown;\n      return typeof value === 'function' ? value.bind(target) : value;\n    },\n  });\n}\n\nexport function lazily<T>(state: () => ReplicatedState<T>): Readable<T> {\n  return {\n    get value() {\n      return readable(state()).value;\n    },\n    subscribe: (listener) => readable(state()).subscribe(listener),\n    events: (listener) => readable(state()).events(listener),\n  };\n}\n\nconst seated = (serving: Served, principal: AgentPrincipal): AgentControl => ({\n  ...(principal.seat === 'view' ? serving.viewed : serving.trusted),\n  decide: serving.decide({\n    by: principal.seat === 'owner' ? 'owner' : 'follower',\n    ...('device' in principal && principal.device ? { device: principal.device } : {}),\n  }),\n});\n\nconst VIEW_METHODS = [...CONTROL_READS, ...OWNER_DEVICE_METHODS];\n\nexport function serveAgent(serving: Served): Host<AgentPrincipal> {\n  const host = closedToGuests(\n    createHost<AgentPrincipal>({ name: AGENT_HOST, self: SELF, principalKey })\n  );\n  const viewing = { ...serving.transcript, monitor: serving.viewMonitor };\n  host.serve(AgentControl, (_input, principal) => {\n    const control = seated(serving, principal);\n    return principal.seat === 'view'\n      ? { variant: 'view', ...served(() => control, VIEW_METHODS) }\n      : { variant: 'control', ...served(() => control, CONTROL_METHODS) };\n  });\n  host.serve(AgentTranscript, (_input, principal) => ({\n    variant: 'transcript',\n    ...readablesOf(principal.seat === 'view' ? viewing : serving.transcript),\n  }));\n  host.serve(AgentSettings, (_input, principal) =>\n    principal.seat === 'view'\n      ? { variant: 'view', state: readable(serving.settings.state) }\n      : {\n          variant: 'settings',\n          state: readable(serving.settings.state),\n          ...served(() => serving.settings, SETTINGS_METHODS),\n        }\n  );\n  host.serve(AgentRemoteService, (_input, principal) => {\n    if (principal.seat !== 'view')\n      return { variant: 'remote', ...served(() => serving.remote, REMOTE_METHODS) };\n    const scoped = viewRemote(serving.remote);\n    return { variant: 'watch', ...served(() => scoped, REMOTE_READS) };\n  });\n  host.serve(AgentPagesService, (_input, principal, self) => {\n    if (principal.seat !== 'owner') return { variant: 'none' };\n    const mine = self.resource('mine', {\n      version: 1,\n      open: () => ownedPages(serving.pages),\n      close: (owned) => owned.release(),\n    });\n    return { variant: 'pages', ...served(() => mine.value, PAGE_METHODS) };\n  });\n  host.serve(\n    AgentGuestService,\n    openToGuests((_input: unknown, principal: AgentPrincipal, self: Self<AgentPrincipal>) => {\n      if (principal.seat !== 'guest') return { variant: 'none' };\n      const opening = serving.guest?.(principal.guest);\n      if (!opening) throw forbidden(CLOSED_TO_GUESTS);\n      const seat = self.resource('seat', {\n        version: 1,\n        open: () => opening,\n        close: (made) => made.dispose(),\n      });\n      const later = (name: 'transcript' | 'seat' | 'proposals') =>\n        lazily(() => seat.value.value[name] as ReplicatedState<unknown>);\n      return {\n        variant: 'guest',\n        transcript: later('transcript'),\n        seat: later('seat'),\n        proposals: later('proposals'),\n        ...served(() => seat.value.value, GUEST_METHODS),\n      };\n    })\n  );\n  host.serve(AgentSudoService, (_input, principal, self) => {\n    const sudo = serving.sudo;\n    if (principal.seat !== 'owner' || !sudo) return { variant: 'none' };\n    const mine = self.resource('mine', {\n      version: 1,\n      open: () => ownedSudo(sudo),\n      close: (owned) => owned.release(),\n    });\n    return {\n      variant: 'sudo',\n      approvals: readable(sudo.approvals),\n      ...served(() => mine.value, SUDO_METHODS),\n    };\n  });\n  return host;\n}\n"],
+  "mappings": "AAAA;AAAA,EAEE;AAAA,EACA;AAAA,EAIA;AAAA,OAEK;AACP,SAAS,0BAA0B;AAGnC;AAAA,EAGE;AAAA,OAEK;AACP,SAAgC,WAAW,4BAA4B;AACvE,SAAyB,YAAY,iBAAiB;AAGtD,SAAS,0BAA2D;AACpE,SAAS,uBAAuB;AAEhC,SAAS,YAAiC;AAC1C,SAAS,oBAAiC;AAE1C,SAAS,YAAY,mBAAmB;AAKxC,SAAS,qBAA0C;AACnD,SAAS,kBAAkB;AAC3B,SAA2B,oBAAoB;AAC/C,SAAS,aAAa,kBAA8B;AAGpD;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAIP,SAAS,SAAyB,iBAAiB;AACnD,SAA6B,eAAe,kBAAkB;AAE9D,SAAS,kBAAkB;AAC3B,SAA4B,gBAAgB;AAoB5C,MAAM,aAA4B;AAAA,EAChC,OAAO,gBAAgB,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC;AAAA,EACnD,SAAS,YAAY;AACnB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAAA,EACA,YAAY,YAAY;AAAA,EAAC;AAAA,EACzB,QAAQ,YAAY;AAAA,EAAC;AAAA,EACrB,WAAW,YAAY;AAAA,EACvB,QAAQ,YAAY;AAAA,EACpB,cAAc,YAAY;AAAA,EAAC;AAC7B;AAEA,eAAe,OACb,OACA,SACA,MACA;AACA,MAAI,WAAW,MAAM,MAAM,KAAK,EAAE,UAAU,OAAO;AACnD,QAAM,QAAQ,gBAAkC,KAAK,SAAS,KAAK,CAAC;AACpE,QAAM,SAAS,CAAC,OAAyB,SAAkB,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC;AAC1F,MAAI,MAAM,SAAS,UAAU,MAAM;AACnC,QAAM,OAAO,MAAM,OAAO,OAAO,iBAAiB;AAChD,UAAM,OAAO,MAAM,aAAa,UAAU,OAAO;AACjD,QAAI;AACJ,aAAS,QAAQ;AACjB,eAAW;AACX,UAAM,QAAQ,SAAS,KAAK,KAAK,KAAK,CAAC;AACvC,UAAM,KAAK,UAAU,MAAM;AAAA,EAC7B,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM,MAAM,QAAQ,SAAS,KAAK,SAAS,KAAK,CAAC;AAAA,IAC1D,UAAU;AACR,WAAK;AACL,UAAI;AACJ,eAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AACF;AAQA,MAAM,YAAY,gBAA4B;AAAA,EAC5C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,MAAM;AACR,CAAC;AAED,SAAS,cACP,SACA,OACA,OACA,QACA;AACA,QAAM,UAAU,CAAC,UACf,MAAM,EAAE,KAAK,CAAC,SAAS,KAAK,QAAQ,KAAK,CAAC,SAAS,KAAK,OAAO,KAAK,CAAC;AACvE,QAAM,QACJ,CAAC,YACD,OAAO,KAAK,UACV,QAAQ,IAAI,KAAK,IAAI,QAAQ,MAAM,KAAK,KAAK,IAAI,EAAE,MAAM,MAAM,UAAU,KAAK;AAClF,QAAM,UAAwB,EAAE,GAAG,SAAS,OAAO,MAAM,KAAK,EAAE;AAChE,QAAM,SAAuB,EAAE,GAAG,SAAS,OAAO,MAAM,OAAO,GAAG,WAAW,WAAW,MAAM,EAAE;AAChG,SAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,eAAe,UACb,OACA,QACA,SACA,SACoB;AACpB,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,MACE,SAAS,MAAM;AAAA,MACf,aAAa,UAAU,MAAM;AAAA,MAC7B,cAAc,MAAM,OAAO,QAAQ,EAAE,KAAK;AAAA,MAC1C,QAAQ,MAAM;AAAA,MACd,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAChD,GAAI,QAAQ,aAAa,EAAE,OAAO,QAAQ,WAAW,IAAI,CAAC;AAAA,IAC5D;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,KAAK;AAAA,IACtB;AAAA,IACA,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,EACrD,CAAC;AACD,SAAO;AACT;AAEA,eAAe,SACb,OACA,WACA,QACA,SACiB;AACjB,QAAM,SAAS,MAAM,aAAa;AAAA,IAChC,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd;AAAA,IACA;AAAA,IACA,SAAS,MAAM;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,KAAK,KAAK,EAAE,WAAW,QAAQ,MAAM,OAAO,OAAO,EAAE,CAAC;AAC5D,SAAO;AACT;AAEA,MAAM,aAAa,MAAM,gBAAiC,EAAE,UAAU,EAAE,CAAC;AAEzE,eAAsB,UACpB,OACA,UAuBI,CAAC,GACe;AACpB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,WAAW,QAAQ,YAAY,OAAO,WAAW;AACvD,MAAI,UAAU,MAAM;AAAA,EAAC;AACrB,QAAM,QAAQ,QAAQ,QAAQ,aAAa,WAAW,MAAM,QAAQ,CAAC;AACrE,QAAM,aAAa,MAAM,OAAO,OAAO,SAAS,MAAM,IAAI;AAC1D,QAAM,EAAE,MAAM,IAAI;AAClB,QAAM,UAAU,MAAM,WAAW,OAAO,SAAS,MAAM,IAAI;AAC3D,YAAU,MAAM;AACd,eAAW,QAAQ;AACnB,YAAQ,QAAQ;AAAA,EAClB;AACA,QAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM;AAC3C,QAAM,UAAU,CAAC,MAAM,UAAU,KAAK,GAAG,QAAQ,MAAM,UAAU,KAAK,CAAC;AACvE,QAAM,QAAQ,QAAQ,SAAS,YAAY;AAC3C,QAAM,aAAa,gBAAgB,MAAM,SAAS,OAAO,OAAO;AAChE,QAAM,SAAS,MAAM,qBAAqB,MAAM,SAAS,OAAO;AAChE,QAAM,YAAY,QAAQ,aAAc,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO;AACvF,QAAM,UAAU,cAAc;AAAA,IAC5B,GAAG,QAAQ;AAAA,IACX,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,OAAO,QAAQ;AAAA,IACf;AAAA,EACF,CAAC;AACD,QAAM,SAAS,MAAM,SAAS,OAAO,WAAW,QAAQ,OAAO;AAC/D,QAAM,UAAwB;AAAA,IAC5B,GAAG;AAAA,MACD,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,IACA,mBAAmB,CAAC,QAAQ,UAAU,OAAO,IAAI,QAAQ,KAAK;AAAA,EAChE;AACA,QAAM,SAAS,aAAa;AAAA,IAC1B,SAAS,MAAM;AAAA,IACf,MAAM,CAAC,SAAS,UAAU,QAAQ,KAAK,SAAS,KAAK;AAAA,IACrD,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,MAAM,aAAa,SAAS,OAAO;AACjC,UAAI,CAAC,QAAS,QAAO,MAAM,KAAK;AAChC,YAAM,QAAQ,MAAM,MAAM,OAAO,aAAa,SAAS,KAAK;AAC5D,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,qBAAqB,OAAO,GAAG;AAC3D,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,QAAM,aAAa,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,OAAO,QAAQ,MAAM,KAAK,CAAC;AAC5E,QAAM,OAAO,QAAQ,QAAQ,UAAU,gBAAwC,CAAC,CAAC;AACjF,QAAM,SAAS,cAAc,MAAM,CAAC,OAAO,QAAQ,KAAK,GAAG,UAAU;AACrE,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,YAAY,WAAW;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,OAAO,QAAQ;AAAA,IACf,UAAU,QAAQ,QAAQ,YAAY,gBAA2B,CAAC,CAAC;AAAA,IACnE,iBAAiB,QAAQ,QAAQ,mBAAmB,WAAW;AAAA,IAC/D,WAAW,QAAQ,WAAW,aAAa,gBAA4B,CAAC,CAAC;AAAA,IACzE,UAAU,QAAQ,QAAQ,YAAY,gBAA+B,CAAC,CAAC;AAAA,IACvE,cAAc,QAAQ,QAAQ,UAAU,gBAA+B,CAAC,CAAC;AAAA,IACzE,QAAQ,QAAQ,SAAS,UAAU,gBAA8B,CAAC,CAAC;AAAA,IACnE,WAAW,QAAQ,SAAS,aAAa,gBAAgC,IAAI;AAAA,IAC7E,SACE,QAAQ,SAAS,QAAQ,gBAA6B,EAAE,aAAa,MAAM,SAAS,CAAC,EAAE,CAAC;AAAA,IAC1F,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ,SAAS,SAAS;AAAA,IACjC,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,WAAW,UAAU;AAAA,IACrB,gBAAgB,OAAO;AAAA,EACzB;AACA,QAAM,OAAO,WAAW;AAAA,IACtB;AAAA,IACA,QAAQ,MAAM,MAAM,OAAO,MAAM;AAAA,IACjC,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,MAAM,IAAI,CAAC;AAAA,EACxD,CAAC;AACD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,QAAQ,cAAc,SAAS,MAAM,OAAO,YAAY,kBAAkB,MAAM;AACtF,QAAM,EAAE,SAAS,OAAO,IAAI;AAC5B,QAAM,OAAO,WAAW;AAAA,IACtB;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,YAAY,QAAQ,MAAM,QAAQ,QAAQ,OAAO,OAAO;AAAA,IAC/D,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,QAAQ,UACrC,UAAU,OAAO,IAAI,UAAU,QAAQ,IAAI,KAAK;AAAA,EACpD,CAAC;AACD,QAAM,YAAY,OAAO,MAAM,CAAC,OAAO;AACrC,SAAK,KAAK;AAAA,MACR,CAAC,cAAc,UAAU,SAAS,WAAW,UAAU,MAAM,OAAO;AAAA,IACtE;AAAA,EACF,CAAC;AACD,MAAI,QAAQ;AACZ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,IAChD,QAAQ,UAAU,gBAAgB;AAChC,UAAI,gBAAgB,OAAO;AACzB,iBAAS;AACT,mBAAW,QAAQ,UAAU,eAAe,OAAO,UAAU,OAAO,IAAI;AACxE;AAAA,MACF;AACA,YAAM,OAA+B,gBAAgB,WACjD,SACA,gBAAgB,UAAU,QACxB,YACA;AACN,eAAS;AACT,YAAM,OAAO,IAAI,SAAS,QAAQ;AAClC,WAAK,MAAM,QAAQ;AACnB,YAAM,SAAS,gBAAgB,SAAS,EAAE,QAAQ,eAAe,OAAO,IAAI,CAAC;AAC7E,WAAK,OAAO,MAAM;AAAA,QAChB,WAAW,EAAE,MAAM,MAAM,OAAO,GAAG,OAAO;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU;AACV,YAAM,KAAK,MAAM;AACjB,aAAO,QAAQ;AACf,YAAM,MAAM,QAAQ;AACpB,YAAM,QAAQ,QAAQ;AACtB,YAAM,OAAO,QAAQ;AACrB,iBAAW,QAAQ;AACnB,WAAK,MAAM;AACX,gBAAU,MAAM;AAChB,iBAAW,QAAQ;AACnB,cAAQ,QAAQ;AAChB,aAAO,QAAQ;AACf,YAAM,QAAQ;AACd,iBAAW,OAAO,QAAS,KAAI;AAC/B,cAAQ,SAAS,MAAM;AACvB,cAAQ,SAAS,QAAQ;AACzB,YAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,WAAW,MAAM,OAAO;AACtC,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,YAAM,QAAQ,KAAK,MAAM,OAAO;AAChC,YAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO;AAC3C,YAAM,QAAQ,OAAO,QAAQ,MAAM,OAAO;AAC1C,YAAM,MAAM,MAAM;AAClB,YAAM,QAAQ,OAAO,MAAM;AAAA,IAC7B;AAAA,EACF;AACF;AAeO,MAAM,mBAAmB;AAEhC,MAAM,SAAS,oBAAI,QAAgB;AAE5B,MAAM,eAAe,CAAmB,YAAkB;AAC/D,SAAO,IAAI,OAAO;AAClB,SAAO;AACT;AAEO,SAAS,eAAe,MAAkD;AAC/E,QAAM,SAAS,CAAC,MAAa,SAA0C,YACrE,KAAK;AAAA,IACH;AAAA,IACC,OAAO,IAAI,OAAO,IACf,UACA,CAAC,OAAgB,WAA2B,SAAkB;AAC5D,UAAI,UAAU,SAAS,QAAS,OAAM,UAAU,gBAAgB;AAChE,aAAO,QAAQ,OAAO,WAAW,IAAI;AAAA,IACvC;AAAA,IACJ;AAAA,EACF;AACF,SAAO,IAAI,MAAM,MAAM;AAAA,IACrB,IAAI,QAAQ,KAAK;AACf,UAAI,QAAQ,QAAS,QAAO;AAC5B,YAAM,QAAQ,QAAQ,IAAI,QAAQ,KAAK,MAAM;AAC7C,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF,CAAC;AACH;AAEO,SAAS,OAAU,OAA8C;AACtE,SAAO;AAAA,IACL,IAAI,QAAQ;AACV,aAAO,SAAS,MAAM,CAAC,EAAE;AAAA,IAC3B;AAAA,IACA,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC,EAAE,UAAU,QAAQ;AAAA,IAC7D,QAAQ,CAAC,aAAa,SAAS,MAAM,CAAC,EAAE,OAAO,QAAQ;AAAA,EACzD;AACF;AAEA,MAAM,SAAS,CAAC,SAAiB,eAA6C;AAAA,EAC5E,GAAI,UAAU,SAAS,SAAS,QAAQ,SAAS,QAAQ;AAAA,EACzD,QAAQ,QAAQ,OAAO;AAAA,IACrB,IAAI,UAAU,SAAS,UAAU,UAAU;AAAA,IAC3C,GAAI,YAAY,aAAa,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,CAAC;AAAA,EAClF,CAAC;AACH;AAEA,MAAM,eAAe,CAAC,GAAG,eAAe,GAAG,oBAAoB;AAExD,SAAS,WAAW,SAAuC;AAChE,QAAM,OAAO;AAAA,IACX,WAA2B,EAAE,MAAM,YAAY,MAAM,MAAM,aAAa,CAAC;AAAA,EAC3E;AACA,QAAM,UAAU,EAAE,GAAG,QAAQ,YAAY,SAAS,QAAQ,YAAY;AACtE,OAAK,MAAM,cAAc,CAAC,QAAQ,cAAc;AAC9C,UAAM,UAAU,OAAO,SAAS,SAAS;AACzC,WAAO,UAAU,SAAS,SACtB,EAAE,SAAS,QAAQ,GAAG,OAAO,MAAM,SAAS,YAAY,EAAE,IAC1D,EAAE,SAAS,WAAW,GAAG,OAAO,MAAM,SAAS,eAAe,EAAE;AAAA,EACtE,CAAC;AACD,OAAK,MAAM,iBAAiB,CAAC,QAAQ,eAAe;AAAA,IAClD,SAAS;AAAA,IACT,GAAG,YAAY,UAAU,SAAS,SAAS,UAAU,QAAQ,UAAU;AAAA,EACzE,EAAE;AACF,OAAK;AAAA,IAAM;AAAA,IAAe,CAAC,QAAQ,cACjC,UAAU,SAAS,SACf,EAAE,SAAS,QAAQ,OAAO,SAAS,QAAQ,SAAS,KAAK,EAAE,IAC3D;AAAA,MACE,SAAS;AAAA,MACT,OAAO,SAAS,QAAQ,SAAS,KAAK;AAAA,MACtC,GAAG,OAAO,MAAM,QAAQ,UAAU,gBAAgB;AAAA,IACpD;AAAA,EACN;AACA,OAAK,MAAM,oBAAoB,CAAC,QAAQ,cAAc;AACpD,QAAI,UAAU,SAAS;AACrB,aAAO,EAAE,SAAS,UAAU,GAAG,OAAO,MAAM,QAAQ,QAAQ,cAAc,EAAE;AAC9E,UAAM,SAAS,WAAW,QAAQ,MAAM;AACxC,WAAO,EAAE,SAAS,SAAS,GAAG,OAAO,MAAM,QAAQ,YAAY,EAAE;AAAA,EACnE,CAAC;AACD,OAAK,MAAM,mBAAmB,CAAC,QAAQ,WAAW,SAAS;AACzD,QAAI,UAAU,SAAS,QAAS,QAAO,EAAE,SAAS,OAAO;AACzD,UAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,MACjC,SAAS;AAAA,MACT,MAAM,MAAM,WAAW,QAAQ,KAAK;AAAA,MACpC,OAAO,CAAC,UAAU,MAAM,QAAQ;AAAA,IAClC,CAAC;AACD,WAAO,EAAE,SAAS,SAAS,GAAG,OAAO,MAAM,KAAK,OAAO,YAAY,EAAE;AAAA,EACvE,CAAC;AACD,OAAK;AAAA,IACH;AAAA,IACA,aAAa,CAAC,QAAiB,WAA2B,SAA+B;AACvF,UAAI,UAAU,SAAS,QAAS,QAAO,EAAE,SAAS,OAAO;AACzD,YAAM,UAAU,QAAQ,QAAQ,UAAU,KAAK;AAC/C,UAAI,CAAC,QAAS,OAAM,UAAU,gBAAgB;AAC9C,YAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,QACjC,SAAS;AAAA,QACT,MAAM,MAAM;AAAA,QACZ,OAAO,CAAC,SAAS,KAAK,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,QAAQ,CAAC,SACb,OAAO,MAAM,KAAK,MAAM,MAAM,IAAI,CAA6B;AACjE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,YAAY,MAAM,YAAY;AAAA,QAC9B,MAAM,MAAM,MAAM;AAAA,QAClB,WAAW,MAAM,WAAW;AAAA,QAC5B,GAAG,OAAO,MAAM,KAAK,MAAM,OAAO,aAAa;AAAA,MACjD;AAAA,IACF,CAAC;AAAA,EACH;AACA,OAAK,MAAM,kBAAkB,CAAC,QAAQ,WAAW,SAAS;AACxD,UAAM,OAAO,QAAQ;AACrB,QAAI,UAAU,SAAS,WAAW,CAAC,KAAM,QAAO,EAAE,SAAS,OAAO;AAClE,UAAM,OAAO,KAAK,SAAS,QAAQ;AAAA,MACjC,SAAS;AAAA,MACT,MAAM,MAAM,UAAU,IAAI;AAAA,MAC1B,OAAO,CAAC,UAAU,MAAM,QAAQ;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW,SAAS,KAAK,SAAS;AAAA,MAClC,GAAG,OAAO,MAAM,KAAK,OAAO,YAAY;AAAA,IAC1C;AAAA,EACF,CAAC;AACD,SAAO;AACT;",
   "names": []
 }

package/dist/mcp/accounts.js

@@ -6,6 +6,14 @@ const TOKENS_IN_VAULT = "MCP tokens are kept in seven's vault: update seven";
 function kindOf(connection) {
   return secretNames(connection.entry.config).length ? "token" : "oauth";
 }
+function serverUrl(raw) {
+  const url = new URL(raw);
+  url.username = "";
+  url.password = "";
+  url.search = "";
+  url.hash = "";
+  return url.href;
+}
 function row(connection, kind, stored, expired) {
   const rejected = connection.state === "needs-auth" || stored && expired;
   return {
@@ -73,6 +81,10 @@ function mcpAccounts(catalog, sources, restart, listeners) {
       await reread();
       restart(connection);
     },
+    async serverUrl(id) {
+      const { connection } = find(id);
+      return serverUrl(connection.entry.config.url);
+    },
     onChange(listener) {
       listeners.add(listener);
       return () => listeners.delete(listener);
@@ -81,6 +93,7 @@ function mcpAccounts(catalog, sources, restart, listeners) {
 }
 export {
   TOKENS_IN_VAULT,
-  mcpAccounts
+  mcpAccounts,
+  serverUrl
 };
 //# sourceMappingURL=accounts.js.map

package/dist/mcp/accounts.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/accounts.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { McpFetch } from '@earendil-works/pi-mcp';\nimport type { AccountState } from '../services.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport type { McpServerEntry } from './config.ts';\nimport type { McpServerConnection } from './connection.ts';\nimport { heldRecords, type McpRecords, resolveHeaders, secretNames } from './credentials.ts';\nimport { MCP_ACCOUNT } from './label.ts';\nimport { beginSignIn, finishSignIn, type McpSignIn, type StoredOAuth } from './oauth.ts';\n\nexport const TOKENS_IN_VAULT = \"MCP tokens are kept in seven's vault: update seven\";\n\nexport interface McpAccounts {\n  accounts(): Promise<AccountState[]>;\n  signIn(id: string): Promise<McpSignIn>;\n  connect(id: string, secret: string | null): Promise<void>;\n  disconnect(id: string): Promise<void>;\n  onChange(listener: () => void): () => void;\n}\n\nexport interface AccountSources {\n  records: McpRecords & { refresh(context: Context): Promise<void> };\n  oauth: (entry: McpServerEntry) => StoredOAuth;\n  fetch: (server: string) => McpFetch;\n  grant: (server: string) => McpFetch;\n  register: (server: string, tokenUrl: string) => Promise<void>;\n}\n\ntype Kind = 'token' | 'oauth';\n\nfunction kindOf(connection: McpServerConnection): Kind {\n  return secretNames(connection.entry.config).length ? 'token' : 'oauth';\n}\n\nfunction row(\n  connection: McpServerConnection,\n  kind: Kind,\n  stored: boolean,\n  expired: boolean\n): AccountState {\n  const rejected = connection.state === 'needs-auth' || (stored && expired);\n  return {\n    id: `${MCP_ACCOUNT}${connection.name}`,\n    provider: connection.name,\n    identity: new URL(connection.entry.config.url).host,\n    status:\n      rejected && (kind === 'token' || stored)\n        ? 'expired'\n        : stored && connection.live\n          ? 'connected'\n          : 'disconnected',\n    auth: kind === 'token' ? 'api-key' : 'oauth',\n    needs: null,\n    group: 'mcp',\n    store: 'vault',\n    ...(kind === 'token' ? { secret: 'token' as const } : {}),\n  };\n}\n\nexport function mcpAccounts(\n  catalog: McpCatalog,\n  sources: AccountSources,\n  restart: (connection: McpServerConnection) => void,\n  listeners: Set<() => void>\n): McpAccounts {\n  const { records } = sources;\n  const find = (id: string, want?: Kind) => {\n    const connection = id.startsWith(MCP_ACCOUNT)\n      ? catalog.connections.get(id.slice(MCP_ACCOUNT.length))\n      : undefined;\n    const kind = connection && kindOf(connection);\n    if (!connection || (want && kind !== want))\n      throw new Error(\n        `${id} is not an MCP server that ${want === 'oauth' ? 'signs in' : 'takes a token or a sign-in'}`\n      );\n    return { connection, kind: kind as Kind };\n  };\n  const reread = () => records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  return {\n    async accounts() {\n      const rows: AccountState[] = [];\n      for (const connection of catalog.connections.values()) {\n        const kind = kindOf(connection);\n        const stored =\n          kind === 'token'\n            ? resolveHeaders(connection.name, connection.entry.config, records).ok\n            : await sources.oauth(connection.entry).signedIn();\n        if (kind === 'oauth' && !stored && connection.state !== 'needs-auth') continue;\n        const expired = heldRecords(connection.name, connection.entry.config, records).some(\n          (record) => record?.state === 'expired'\n        );\n        rows.push(row(connection, kind, stored, expired));\n      }\n      return rows;\n    },\n    async signIn(id) {\n      const { connection } = find(id, 'oauth');\n      return beginSignIn(sources.oauth(connection.entry), connection.entry, {\n        fetch: sources.fetch(connection.name),\n        register: (tokenUrl) => sources.register(connection.name, tokenUrl),\n      });\n    },\n    async connect(id, secret) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') {\n        if (secret === null) throw new Error(`${id} needs a sign-in`);\n        await finishSignIn(\n          sources.oauth(connection.entry),\n          connection.entry,\n          secret,\n          sources.grant(connection.name)\n        );\n      } else if (secret !== null) throw new Error(TOKENS_IN_VAULT);\n      await reread();\n      restart(connection);\n    },\n    async disconnect(id) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') await sources.oauth(connection.entry).forget();\n      await reread();\n      restart(connection);\n    },\n    onChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n  };\n}\n"],
-  "mappings": "AACA,SAAS,0BAA0B;AAMnC,SAAS,aAA8B,gBAAgB,mBAAmB;AAC1E,SAAS,mBAAmB;AAC5B,SAAS,aAAa,oBAAsD;AAErE,MAAM,kBAAkB;AAoB/B,SAAS,OAAO,YAAuC;AACrD,SAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SAAS,UAAU;AACjE;AAEA,SAAS,IACP,YACA,MACA,QACA,SACc;AACd,QAAM,WAAW,WAAW,UAAU,gBAAiB,UAAU;AACjE,SAAO;AAAA,IACL,IAAI,GAAG,WAAW,GAAG,WAAW,IAAI;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,UAAU,IAAI,IAAI,WAAW,MAAM,OAAO,GAAG,EAAE;AAAA,IAC/C,QACE,aAAa,SAAS,WAAW,UAC7B,YACA,UAAU,WAAW,OACnB,cACA;AAAA,IACR,MAAM,SAAS,UAAU,YAAY;AAAA,IACrC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,GAAI,SAAS,UAAU,EAAE,QAAQ,QAAiB,IAAI,CAAC;AAAA,EACzD;AACF;AAEO,SAAS,YACd,SACA,SACA,SACA,WACa;AACb,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,OAAO,CAAC,IAAY,SAAgB;AACxC,UAAM,aAAa,GAAG,WAAW,WAAW,IACxC,QAAQ,YAAY,IAAI,GAAG,MAAM,YAAY,MAAM,CAAC,IACpD;AACJ,UAAM,OAAO,cAAc,OAAO,UAAU;AAC5C,QAAI,CAAC,cAAe,QAAQ,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,EAAE,8BAA8B,SAAS,UAAU,aAAa,4BAA4B;AAAA,MACjG;AACF,WAAO,EAAE,YAAY,KAAmB;AAAA,EAC1C;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AAC9E,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,OAAuB,CAAC;AAC9B,iBAAW,cAAc,QAAQ,YAAY,OAAO,GAAG;AACrD,cAAM,OAAO,OAAO,UAAU;AAC9B,cAAM,SACJ,SAAS,UACL,eAAe,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE,KAClE,MAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,SAAS;AACrD,YAAI,SAAS,WAAW,CAAC,UAAU,WAAW,UAAU,aAAc;AACtE,cAAM,UAAU,YAAY,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE;AAAA,UAC7E,CAAC,WAAW,QAAQ,UAAU;AAAA,QAChC;AACA,aAAK,KAAK,IAAI,YAAY,MAAM,QAAQ,OAAO,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,IAAI;AACf,YAAM,EAAE,WAAW,IAAI,KAAK,IAAI,OAAO;AACvC,aAAO,YAAY,QAAQ,MAAM,WAAW,KAAK,GAAG,WAAW,OAAO;AAAA,QACpE,OAAO,QAAQ,MAAM,WAAW,IAAI;AAAA,QACpC,UAAU,CAAC,aAAa,QAAQ,SAAS,WAAW,MAAM,QAAQ;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,IACA,MAAM,QAAQ,IAAI,QAAQ;AACxB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,SAAS;AACpB,YAAI,WAAW,KAAM,OAAM,IAAI,MAAM,GAAG,EAAE,kBAAkB;AAC5D,cAAM;AAAA,UACJ,QAAQ,MAAM,WAAW,KAAK;AAAA,UAC9B,WAAW;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,WAAW,IAAI;AAAA,QAC/B;AAAA,MACF,WAAW,WAAW,KAAM,OAAM,IAAI,MAAM,eAAe;AAC3D,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,QAAS,OAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,OAAO;AACnE,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,SAAS,UAAU;AACjB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM,UAAU,OAAO,QAAQ;AAAA,IACxC;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport { BACKGROUND_CONTEXT } from '@earendil-works/chord/context';\nimport type { McpFetch } from '@earendil-works/pi-mcp';\nimport type { AccountState } from '../services.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport type { McpServerEntry } from './config.ts';\nimport type { McpServerConnection } from './connection.ts';\nimport { heldRecords, type McpRecords, resolveHeaders, secretNames } from './credentials.ts';\nimport { MCP_ACCOUNT } from './label.ts';\nimport { beginSignIn, finishSignIn, type McpSignIn, type StoredOAuth } from './oauth.ts';\n\nexport const TOKENS_IN_VAULT = \"MCP tokens are kept in seven's vault: update seven\";\n\nexport interface McpAccounts {\n  accounts(): Promise<AccountState[]>;\n  signIn(id: string): Promise<McpSignIn>;\n  connect(id: string, secret: string | null): Promise<void>;\n  disconnect(id: string): Promise<void>;\n  serverUrl(id: string): Promise<string | null>;\n  onChange(listener: () => void): () => void;\n}\n\nexport interface AccountSources {\n  records: McpRecords & { refresh(context: Context): Promise<void> };\n  oauth: (entry: McpServerEntry) => StoredOAuth;\n  fetch: (server: string) => McpFetch;\n  grant: (server: string) => McpFetch;\n  register: (server: string, tokenUrl: string) => Promise<void>;\n}\n\ntype Kind = 'token' | 'oauth';\n\nfunction kindOf(connection: McpServerConnection): Kind {\n  return secretNames(connection.entry.config).length ? 'token' : 'oauth';\n}\n\nexport function serverUrl(raw: string): string {\n  const url = new URL(raw);\n  url.username = '';\n  url.password = '';\n  url.search = '';\n  url.hash = '';\n  return url.href;\n}\n\nfunction row(\n  connection: McpServerConnection,\n  kind: Kind,\n  stored: boolean,\n  expired: boolean\n): AccountState {\n  const rejected = connection.state === 'needs-auth' || (stored && expired);\n  return {\n    id: `${MCP_ACCOUNT}${connection.name}`,\n    provider: connection.name,\n    identity: new URL(connection.entry.config.url).host,\n    status:\n      rejected && (kind === 'token' || stored)\n        ? 'expired'\n        : stored && connection.live\n          ? 'connected'\n          : 'disconnected',\n    auth: kind === 'token' ? 'api-key' : 'oauth',\n    needs: null,\n    group: 'mcp',\n    store: 'vault',\n    ...(kind === 'token' ? { secret: 'token' as const } : {}),\n  };\n}\n\nexport function mcpAccounts(\n  catalog: McpCatalog,\n  sources: AccountSources,\n  restart: (connection: McpServerConnection) => void,\n  listeners: Set<() => void>\n): McpAccounts {\n  const { records } = sources;\n  const find = (id: string, want?: Kind) => {\n    const connection = id.startsWith(MCP_ACCOUNT)\n      ? catalog.connections.get(id.slice(MCP_ACCOUNT.length))\n      : undefined;\n    const kind = connection && kindOf(connection);\n    if (!connection || (want && kind !== want))\n      throw new Error(\n        `${id} is not an MCP server that ${want === 'oauth' ? 'signs in' : 'takes a token or a sign-in'}`\n      );\n    return { connection, kind: kind as Kind };\n  };\n  const reread = () => records.refresh(BACKGROUND_CONTEXT).catch(() => undefined);\n  return {\n    async accounts() {\n      const rows: AccountState[] = [];\n      for (const connection of catalog.connections.values()) {\n        const kind = kindOf(connection);\n        const stored =\n          kind === 'token'\n            ? resolveHeaders(connection.name, connection.entry.config, records).ok\n            : await sources.oauth(connection.entry).signedIn();\n        if (kind === 'oauth' && !stored && connection.state !== 'needs-auth') continue;\n        const expired = heldRecords(connection.name, connection.entry.config, records).some(\n          (record) => record?.state === 'expired'\n        );\n        rows.push(row(connection, kind, stored, expired));\n      }\n      return rows;\n    },\n    async signIn(id) {\n      const { connection } = find(id, 'oauth');\n      return beginSignIn(sources.oauth(connection.entry), connection.entry, {\n        fetch: sources.fetch(connection.name),\n        register: (tokenUrl) => sources.register(connection.name, tokenUrl),\n      });\n    },\n    async connect(id, secret) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') {\n        if (secret === null) throw new Error(`${id} needs a sign-in`);\n        await finishSignIn(\n          sources.oauth(connection.entry),\n          connection.entry,\n          secret,\n          sources.grant(connection.name)\n        );\n      } else if (secret !== null) throw new Error(TOKENS_IN_VAULT);\n      await reread();\n      restart(connection);\n    },\n    async disconnect(id) {\n      const { connection, kind } = find(id);\n      if (kind === 'oauth') await sources.oauth(connection.entry).forget();\n      await reread();\n      restart(connection);\n    },\n    async serverUrl(id) {\n      const { connection } = find(id);\n      return serverUrl(connection.entry.config.url);\n    },\n    onChange(listener) {\n      listeners.add(listener);\n      return () => listeners.delete(listener);\n    },\n  };\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AAMnC,SAAS,aAA8B,gBAAgB,mBAAmB;AAC1E,SAAS,mBAAmB;AAC5B,SAAS,aAAa,oBAAsD;AAErE,MAAM,kBAAkB;AAqB/B,SAAS,OAAO,YAAuC;AACrD,SAAO,YAAY,WAAW,MAAM,MAAM,EAAE,SAAS,UAAU;AACjE;AAEO,SAAS,UAAU,KAAqB;AAC7C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,SAAS;AACb,MAAI,OAAO;AACX,SAAO,IAAI;AACb;AAEA,SAAS,IACP,YACA,MACA,QACA,SACc;AACd,QAAM,WAAW,WAAW,UAAU,gBAAiB,UAAU;AACjE,SAAO;AAAA,IACL,IAAI,GAAG,WAAW,GAAG,WAAW,IAAI;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,UAAU,IAAI,IAAI,WAAW,MAAM,OAAO,GAAG,EAAE;AAAA,IAC/C,QACE,aAAa,SAAS,WAAW,UAC7B,YACA,UAAU,WAAW,OACnB,cACA;AAAA,IACR,MAAM,SAAS,UAAU,YAAY;AAAA,IACrC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,GAAI,SAAS,UAAU,EAAE,QAAQ,QAAiB,IAAI,CAAC;AAAA,EACzD;AACF;AAEO,SAAS,YACd,SACA,SACA,SACA,WACa;AACb,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,OAAO,CAAC,IAAY,SAAgB;AACxC,UAAM,aAAa,GAAG,WAAW,WAAW,IACxC,QAAQ,YAAY,IAAI,GAAG,MAAM,YAAY,MAAM,CAAC,IACpD;AACJ,UAAM,OAAO,cAAc,OAAO,UAAU;AAC5C,QAAI,CAAC,cAAe,QAAQ,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,GAAG,EAAE,8BAA8B,SAAS,UAAU,aAAa,4BAA4B;AAAA,MACjG;AACF,WAAO,EAAE,YAAY,KAAmB;AAAA,EAC1C;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,kBAAkB,EAAE,MAAM,MAAM,MAAS;AAC9E,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,OAAuB,CAAC;AAC9B,iBAAW,cAAc,QAAQ,YAAY,OAAO,GAAG;AACrD,cAAM,OAAO,OAAO,UAAU;AAC9B,cAAM,SACJ,SAAS,UACL,eAAe,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE,KAClE,MAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,SAAS;AACrD,YAAI,SAAS,WAAW,CAAC,UAAU,WAAW,UAAU,aAAc;AACtE,cAAM,UAAU,YAAY,WAAW,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE;AAAA,UAC7E,CAAC,WAAW,QAAQ,UAAU;AAAA,QAChC;AACA,aAAK,KAAK,IAAI,YAAY,MAAM,QAAQ,OAAO,CAAC;AAAA,MAClD;AACA,aAAO;AAAA,IACT;AAAA,IACA,MAAM,OAAO,IAAI;AACf,YAAM,EAAE,WAAW,IAAI,KAAK,IAAI,OAAO;AACvC,aAAO,YAAY,QAAQ,MAAM,WAAW,KAAK,GAAG,WAAW,OAAO;AAAA,QACpE,OAAO,QAAQ,MAAM,WAAW,IAAI;AAAA,QACpC,UAAU,CAAC,aAAa,QAAQ,SAAS,WAAW,MAAM,QAAQ;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,IACA,MAAM,QAAQ,IAAI,QAAQ;AACxB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,SAAS;AACpB,YAAI,WAAW,KAAM,OAAM,IAAI,MAAM,GAAG,EAAE,kBAAkB;AAC5D,cAAM;AAAA,UACJ,QAAQ,MAAM,WAAW,KAAK;AAAA,UAC9B,WAAW;AAAA,UACX;AAAA,UACA,QAAQ,MAAM,WAAW,IAAI;AAAA,QAC/B;AAAA,MACF,WAAW,WAAW,KAAM,OAAM,IAAI,MAAM,eAAe;AAC3D,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,MAAM,WAAW,IAAI;AACnB,YAAM,EAAE,YAAY,KAAK,IAAI,KAAK,EAAE;AACpC,UAAI,SAAS,QAAS,OAAM,QAAQ,MAAM,WAAW,KAAK,EAAE,OAAO;AACnE,YAAM,OAAO;AACb,cAAQ,UAAU;AAAA,IACpB;AAAA,IACA,MAAM,UAAU,IAAI;AAClB,YAAM,EAAE,WAAW,IAAI,KAAK,EAAE;AAC9B,aAAO,UAAU,WAAW,MAAM,OAAO,GAAG;AAAA,IAC9C;AAAA,IACA,SAAS,UAAU;AACjB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM,UAAU,OAAO,QAAQ;AAAA,IACxC;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/mcp/index.js

@@ -11,6 +11,7 @@ const idle = {
     throw new Error(`${id} is not an MCP server that takes a token`);
   },
   disconnect: async () => void 0,
+  serverUrl: async () => null,
   onChange: () => () => void 0,
   status: () => [],
   reload: async () => void 0,

package/dist/mcp/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/mcp/index.ts"],
-  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type {\n  Agent,\n  Registry,\n  ToolExecutionApi,\n  ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport type { CodemodeExtra } from './allow.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport { parseMcpConfig } from './config.ts';\nimport { configPath, shown } from './paths.ts';\nimport type { McpAttach, McpRuntime } from './runtime.ts';\n\nexport { allows, type CodemodeExtra, McpAllowDoc, mcpEntries, serverAllowed } from './allow.ts';\nexport type { McpAccounts, McpAttach, McpRuntime, ServerStatus } from './runtime.ts';\n\nexport type McpLoader = () => Promise<typeof import('./runtime.ts')>;\n\nexport const loadRuntime: McpLoader = () => import('./runtime.ts');\n\nexport interface McpSetup {\n  catalog(): McpCatalog | undefined;\n  direct(names: readonly string[]): ToolRegistration[];\n  codemode(api: ToolExecutionApi, agent: Agent, context: Context): Promise<CodemodeExtra>;\n  attach(options: McpAttach, context: Context): Promise<McpRuntime>;\n}\n\nconst idle: McpRuntime = {\n  accounts: async () => [],\n  signIn: async (id) => {\n    throw new Error(`${id} is not an MCP server that signs in`);\n  },\n  connect: async (id) => {\n    throw new Error(`${id} is not an MCP server that takes a token`);\n  },\n  disconnect: async () => undefined,\n  onChange: () => () => undefined,\n  status: () => [],\n  reload: async () => undefined,\n  close: async () => undefined,\n};\n\nasync function unavailable(options: McpAttach, error: unknown, context: Context) {\n  const file = configPath(options.home, options.agentDir);\n  const named = shown(file, options.home);\n  const read = await options.env.readTextFile(file, context);\n  if (!parseMcpConfig(read.ok ? read.value : undefined).servers.length) return;\n  await options.licks\n    .deliver(\n      {\n        channel: 'fswatch',\n        source: `mcp:${named}`,\n        title: \"MCP servers can't start in this SLICC\",\n        text: error instanceof Error ? error.message : String(error),\n        body: `The MCP client didn't load, so the servers in ${named} stay off until SLICC is updated.`,\n        target: 'cone',\n        severity: 'warn',\n        eventId: 'mcp\\nunavailable',\n      },\n      context\n    )\n    .catch(() => undefined);\n}\n\nexport function setupMcp(registry: Registry, load: McpLoader = loadRuntime): McpSetup {\n  let catalog: McpCatalog | undefined;\n  return {\n    catalog: () => catalog,\n    direct: (names) => catalog?.direct(names) ?? [],\n    codemode: async (api, agent, context) =>\n      catalog ? catalog.codemode(api, agent, context) : { tools: [], globals: [] },\n    async attach(options, context) {\n      let started: Awaited<ReturnType<Awaited<ReturnType<McpLoader>>['startMcp']>>;\n      try {\n        started = await (await load()).startMcp(registry, options, context);\n      } catch (error) {\n        await unavailable(options, error, context);\n        return idle;\n      }\n      catalog = started.catalog;\n      return started.runtime;\n    },\n  };\n}\n"],
-  "mappings": "AASA,SAAS,sBAAsB;AAC/B,SAAS,YAAY,aAAa;AAGlC,SAAS,QAA4B,aAAa,YAAY,qBAAqB;AAK5E,MAAM,cAAyB,MAAM,OAAO,cAAc;AASjE,MAAM,OAAmB;AAAA,EACvB,UAAU,YAAY,CAAC;AAAA,EACvB,QAAQ,OAAO,OAAO;AACpB,UAAM,IAAI,MAAM,GAAG,EAAE,qCAAqC;AAAA,EAC5D;AAAA,EACA,SAAS,OAAO,OAAO;AACrB,UAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AAAA,EACjE;AAAA,EACA,YAAY,YAAY;AAAA,EACxB,UAAU,MAAM,MAAM;AAAA,EACtB,QAAQ,MAAM,CAAC;AAAA,EACf,QAAQ,YAAY;AAAA,EACpB,OAAO,YAAY;AACrB;AAEA,eAAe,YAAY,SAAoB,OAAgB,SAAkB;AAC/E,QAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ,QAAQ;AACtD,QAAM,QAAQ,MAAM,MAAM,QAAQ,IAAI;AACtC,QAAM,OAAO,MAAM,QAAQ,IAAI,aAAa,MAAM,OAAO;AACzD,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS,EAAE,QAAQ,OAAQ;AACtE,QAAM,QAAQ,MACX;AAAA,IACC;AAAA,MACE,SAAS;AAAA,MACT,QAAQ,OAAO,KAAK;AAAA,MACpB,OAAO;AAAA,MACP,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC3D,MAAM,iDAAiD,KAAK;AAAA,MAC5D,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA;AAAA,EACF,EACC,MAAM,MAAM,MAAS;AAC1B;AAEO,SAAS,SAAS,UAAoB,OAAkB,aAAuB;AACpF,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC;AAAA,IAC9C,UAAU,OAAO,KAAK,OAAO,YAC3B,UAAU,QAAQ,SAAS,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC7E,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AACJ,UAAI;AACF,kBAAU,OAAO,MAAM,KAAK,GAAG,SAAS,UAAU,SAAS,OAAO;AAAA,MACpE,SAAS,OAAO;AACd,cAAM,YAAY,SAAS,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,gBAAU,QAAQ;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { Context } from '@earendil-works/chord';\nimport type {\n  Agent,\n  Registry,\n  ToolExecutionApi,\n  ToolRegistration,\n} from '@earendil-works/pi-durable';\nimport type { CodemodeExtra } from './allow.ts';\nimport type { McpCatalog } from './catalog.ts';\nimport { parseMcpConfig } from './config.ts';\nimport { configPath, shown } from './paths.ts';\nimport type { McpAttach, McpRuntime } from './runtime.ts';\n\nexport { allows, type CodemodeExtra, McpAllowDoc, mcpEntries, serverAllowed } from './allow.ts';\nexport type { McpAccounts, McpAttach, McpRuntime, ServerStatus } from './runtime.ts';\n\nexport type McpLoader = () => Promise<typeof import('./runtime.ts')>;\n\nexport const loadRuntime: McpLoader = () => import('./runtime.ts');\n\nexport interface McpSetup {\n  catalog(): McpCatalog | undefined;\n  direct(names: readonly string[]): ToolRegistration[];\n  codemode(api: ToolExecutionApi, agent: Agent, context: Context): Promise<CodemodeExtra>;\n  attach(options: McpAttach, context: Context): Promise<McpRuntime>;\n}\n\nconst idle: McpRuntime = {\n  accounts: async () => [],\n  signIn: async (id) => {\n    throw new Error(`${id} is not an MCP server that signs in`);\n  },\n  connect: async (id) => {\n    throw new Error(`${id} is not an MCP server that takes a token`);\n  },\n  disconnect: async () => undefined,\n  serverUrl: async () => null,\n  onChange: () => () => undefined,\n  status: () => [],\n  reload: async () => undefined,\n  close: async () => undefined,\n};\n\nasync function unavailable(options: McpAttach, error: unknown, context: Context) {\n  const file = configPath(options.home, options.agentDir);\n  const named = shown(file, options.home);\n  const read = await options.env.readTextFile(file, context);\n  if (!parseMcpConfig(read.ok ? read.value : undefined).servers.length) return;\n  await options.licks\n    .deliver(\n      {\n        channel: 'fswatch',\n        source: `mcp:${named}`,\n        title: \"MCP servers can't start in this SLICC\",\n        text: error instanceof Error ? error.message : String(error),\n        body: `The MCP client didn't load, so the servers in ${named} stay off until SLICC is updated.`,\n        target: 'cone',\n        severity: 'warn',\n        eventId: 'mcp\\nunavailable',\n      },\n      context\n    )\n    .catch(() => undefined);\n}\n\nexport function setupMcp(registry: Registry, load: McpLoader = loadRuntime): McpSetup {\n  let catalog: McpCatalog | undefined;\n  return {\n    catalog: () => catalog,\n    direct: (names) => catalog?.direct(names) ?? [],\n    codemode: async (api, agent, context) =>\n      catalog ? catalog.codemode(api, agent, context) : { tools: [], globals: [] },\n    async attach(options, context) {\n      let started: Awaited<ReturnType<Awaited<ReturnType<McpLoader>>['startMcp']>>;\n      try {\n        started = await (await load()).startMcp(registry, options, context);\n      } catch (error) {\n        await unavailable(options, error, context);\n        return idle;\n      }\n      catalog = started.catalog;\n      return started.runtime;\n    },\n  };\n}\n"],
+  "mappings": "AASA,SAAS,sBAAsB;AAC/B,SAAS,YAAY,aAAa;AAGlC,SAAS,QAA4B,aAAa,YAAY,qBAAqB;AAK5E,MAAM,cAAyB,MAAM,OAAO,cAAc;AASjE,MAAM,OAAmB;AAAA,EACvB,UAAU,YAAY,CAAC;AAAA,EACvB,QAAQ,OAAO,OAAO;AACpB,UAAM,IAAI,MAAM,GAAG,EAAE,qCAAqC;AAAA,EAC5D;AAAA,EACA,SAAS,OAAO,OAAO;AACrB,UAAM,IAAI,MAAM,GAAG,EAAE,0CAA0C;AAAA,EACjE;AAAA,EACA,YAAY,YAAY;AAAA,EACxB,WAAW,YAAY;AAAA,EACvB,UAAU,MAAM,MAAM;AAAA,EACtB,QAAQ,MAAM,CAAC;AAAA,EACf,QAAQ,YAAY;AAAA,EACpB,OAAO,YAAY;AACrB;AAEA,eAAe,YAAY,SAAoB,OAAgB,SAAkB;AAC/E,QAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ,QAAQ;AACtD,QAAM,QAAQ,MAAM,MAAM,QAAQ,IAAI;AACtC,QAAM,OAAO,MAAM,QAAQ,IAAI,aAAa,MAAM,OAAO;AACzD,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,QAAQ,MAAS,EAAE,QAAQ,OAAQ;AACtE,QAAM,QAAQ,MACX;AAAA,IACC;AAAA,MACE,SAAS;AAAA,MACT,QAAQ,OAAO,KAAK;AAAA,MACpB,OAAO;AAAA,MACP,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC3D,MAAM,iDAAiD,KAAK;AAAA,MAC5D,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,SAAS;AAAA,IACX;AAAA,IACA;AAAA,EACF,EACC,MAAM,MAAM,MAAS;AAC1B;AAEO,SAAS,SAAS,UAAoB,OAAkB,aAAuB;AACpF,MAAI;AACJ,SAAO;AAAA,IACL,SAAS,MAAM;AAAA,IACf,QAAQ,CAAC,UAAU,SAAS,OAAO,KAAK,KAAK,CAAC;AAAA,IAC9C,UAAU,OAAO,KAAK,OAAO,YAC3B,UAAU,QAAQ,SAAS,KAAK,OAAO,OAAO,IAAI,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,EAAE;AAAA,IAC7E,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AACJ,UAAI;AACF,kBAAU,OAAO,MAAM,KAAK,GAAG,SAAS,UAAU,SAAS,OAAO;AAAA,MACpE,SAAS,OAAO;AACd,cAAM,YAAY,SAAS,OAAO,OAAO;AACzC,eAAO;AAAA,MACT;AACA,gBAAU,QAAQ;AAClB,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/net.js

@@ -31,9 +31,17 @@ function stream(body) {
     }
   });
 }
+const TELEMETRY = "x-stainless-";
+function untracked(request) {
+  const telemetry = [...request.headers.keys()].filter((name) => name.startsWith(TELEMETRY));
+  if (!telemetry.length) return request;
+  const headers = new Headers(request.headers);
+  for (const name of telemetry) headers.delete(name);
+  return new Request(request, { headers });
+}
 function transportFetch(transport, origin, native = globalThis.fetch.bind(globalThis), loopback) {
   return async (input, init) => {
-    const request = new Request(input, init);
+    const request = untracked(new Request(input, init));
     const port = kernelPort(request.url);
     if (loopback && port) return loopback(request, { port, signal: request.signal });
     if (new URL(request.url).origin === origin || transport.traits?.unavailable || request.credentials === "include") {

package/dist/net.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/net.ts"],
-  "sourcesContent": ["import { FACADE_PORT, kernelHost, ownKernelServer } from './kernel/loopback.ts';\n\nexport interface TransportResponse {\n  url?: string;\n  redirected?: boolean;\n  status: number;\n  statusText?: string;\n  headers: HeadersInit;\n  body: AsyncIterable<Uint8Array>;\n}\n\nexport interface Transport {\n  traits?: {\n    crossOrigin?: 'cors' | 'any';\n    manualRedirects?: boolean;\n    unavailable?: boolean;\n    exit?: TransportExit;\n  };\n  fetch(request: {\n    url: string;\n    method: string;\n    headers: [string, string][];\n    body?: Uint8Array;\n    signal?: AbortSignal;\n  }): Promise<TransportResponse>;\n}\n\nexport interface TransportExit {\n  kind: string;\n  caps: string[];\n}\n\nexport function linkedExit(transport: Transport | undefined): TransportExit | undefined {\n  const exit = transport?.traits?.exit;\n  return typeof exit?.kind === 'string' ? exit : undefined;\n}\n\nexport function pageOnly(transport: Transport | undefined): boolean {\n  return transport?.traits?.crossOrigin === 'cors' && !linkedExit(transport);\n}\n\nexport type Loopback = (\n  request: Request,\n  options: { port: number; signal?: AbortSignal }\n) => Promise<Response>;\n\nconst empty = new Set([101, 103, 204, 205, 304]);\nconst redirects = new Set([301, 302, 303, 307, 308]);\nconst bare = (url: string) => url.split('#')[0];\n\nexport function kernelPort(url: string): number | undefined {\n  const host = new URL(url).hostname.replace(/\\.+$/, '');\n  if (!kernelHost(host)) return undefined;\n  if (!ownKernelServer(host))\n    throw new TypeError(\n      `${host} isn't a kernel server SLICC may reach: use <port>.kernel.localhost with a port from 1 to 65535 other than ${FACADE_PORT}, the CDP facade`\n    );\n  return Number(host.split('.')[0]);\n}\n\nfunction stream(body: AsyncIterable<Uint8Array>): ReadableStream<Uint8Array> {\n  const iterator = body[Symbol.asyncIterator]();\n  return new ReadableStream({\n    async pull(controller) {\n      const next = await iterator.next();\n      if (next.done) controller.close();\n      else controller.enqueue(next.value);\n    },\n    async cancel() {\n      await iterator.return?.();\n    },\n  });\n}\n\nexport function transportFetch(\n  transport: Transport,\n  origin: string,\n  native: typeof fetch = globalThis.fetch.bind(globalThis),\n  loopback?: Loopback\n): typeof fetch {\n  return async (input, init) => {\n    const request = new Request(input, init);\n    const port = kernelPort(request.url);\n    if (loopback && port) return loopback(request, { port, signal: request.signal });\n    if (\n      new URL(request.url).origin === origin ||\n      transport.traits?.unavailable ||\n      request.credentials === 'include'\n    ) {\n      return native(request);\n    }\n    const body = ['GET', 'HEAD'].includes(request.method)\n      ? undefined\n      : new Uint8Array(await request.arrayBuffer());\n    const response = await transport.fetch({\n      url: request.url,\n      method: request.method,\n      headers: [...request.headers],\n      ...(body ? { body } : {}),\n      signal: request.signal,\n    });\n    const redirected =\n      response.redirected ||\n      (response.url && bare(response.url) !== bare(request.url)) ||\n      (transport.traits?.manualRedirects && redirects.has(response.status));\n    if (request.redirect === 'error' && redirected) {\n      await stream(response.body)\n        .cancel()\n        .catch(() => undefined);\n      throw new TypeError('unexpected redirect');\n    }\n    return new Response(empty.has(response.status) ? null : stream(response.body), {\n      status: response.status,\n      statusText: response.statusText ?? '',\n      headers: response.headers,\n    });\n  };\n}\n"],
-  "mappings": "AAAA,SAAS,aAAa,YAAY,uBAAuB;AAgClD,SAAS,WAAW,WAA6D;AACtF,QAAM,OAAO,WAAW,QAAQ;AAChC,SAAO,OAAO,MAAM,SAAS,WAAW,OAAO;AACjD;AAEO,SAAS,SAAS,WAA2C;AAClE,SAAO,WAAW,QAAQ,gBAAgB,UAAU,CAAC,WAAW,SAAS;AAC3E;AAOA,MAAM,QAAQ,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAC/C,MAAM,YAAY,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AACnD,MAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,CAAC;AAEvC,SAAS,WAAW,KAAiC;AAC1D,QAAM,OAAO,IAAI,IAAI,GAAG,EAAE,SAAS,QAAQ,QAAQ,EAAE;AACrD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI,CAAC,gBAAgB,IAAI;AACvB,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,8GAA8G,WAAW;AAAA,IAClI;AACF,SAAO,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AAClC;AAEA,SAAS,OAAO,MAA6D;AAC3E,QAAM,WAAW,KAAK,OAAO,aAAa,EAAE;AAC5C,SAAO,IAAI,eAAe;AAAA,IACxB,MAAM,KAAK,YAAY;AACrB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,KAAK,KAAM,YAAW,MAAM;AAAA,UAC3B,YAAW,QAAQ,KAAK,KAAK;AAAA,IACpC;AAAA,IACA,MAAM,SAAS;AACb,YAAM,SAAS,SAAS;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eACd,WACA,QACA,SAAuB,WAAW,MAAM,KAAK,UAAU,GACvD,UACc;AACd,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;AACvC,UAAM,OAAO,WAAW,QAAQ,GAAG;AACnC,QAAI,YAAY,KAAM,QAAO,SAAS,SAAS,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAC/E,QACE,IAAI,IAAI,QAAQ,GAAG,EAAE,WAAW,UAChC,UAAU,QAAQ,eAClB,QAAQ,gBAAgB,WACxB;AACA,aAAO,OAAO,OAAO;AAAA,IACvB;AACA,UAAM,OAAO,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAChD,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,UAAM,WAAW,MAAM,UAAU,MAAM;AAAA,MACrC,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,MAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AACD,UAAM,aACJ,SAAS,cACR,SAAS,OAAO,KAAK,SAAS,GAAG,MAAM,KAAK,QAAQ,GAAG,KACvD,UAAU,QAAQ,mBAAmB,UAAU,IAAI,SAAS,MAAM;AACrE,QAAI,QAAQ,aAAa,WAAW,YAAY;AAC9C,YAAM,OAAO,SAAS,IAAI,EACvB,OAAO,EACP,MAAM,MAAM,MAAS;AACxB,YAAM,IAAI,UAAU,qBAAqB;AAAA,IAC3C;AACA,WAAO,IAAI,SAAS,MAAM,IAAI,SAAS,MAAM,IAAI,OAAO,OAAO,SAAS,IAAI,GAAG;AAAA,MAC7E,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS,cAAc;AAAA,MACnC,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AACF;",
+  "sourcesContent": ["import { FACADE_PORT, kernelHost, ownKernelServer } from './kernel/loopback.ts';\n\nexport interface TransportResponse {\n  url?: string;\n  redirected?: boolean;\n  status: number;\n  statusText?: string;\n  headers: HeadersInit;\n  body: AsyncIterable<Uint8Array>;\n}\n\nexport interface Transport {\n  traits?: {\n    crossOrigin?: 'cors' | 'any';\n    manualRedirects?: boolean;\n    unavailable?: boolean;\n    exit?: TransportExit;\n  };\n  fetch(request: {\n    url: string;\n    method: string;\n    headers: [string, string][];\n    body?: Uint8Array;\n    signal?: AbortSignal;\n  }): Promise<TransportResponse>;\n}\n\nexport interface TransportExit {\n  kind: string;\n  caps: string[];\n}\n\nexport function linkedExit(transport: Transport | undefined): TransportExit | undefined {\n  const exit = transport?.traits?.exit;\n  return typeof exit?.kind === 'string' ? exit : undefined;\n}\n\nexport function pageOnly(transport: Transport | undefined): boolean {\n  return transport?.traits?.crossOrigin === 'cors' && !linkedExit(transport);\n}\n\nexport type Loopback = (\n  request: Request,\n  options: { port: number; signal?: AbortSignal }\n) => Promise<Response>;\n\nconst empty = new Set([101, 103, 204, 205, 304]);\nconst redirects = new Set([301, 302, 303, 307, 308]);\nconst bare = (url: string) => url.split('#')[0];\n\nexport function kernelPort(url: string): number | undefined {\n  const host = new URL(url).hostname.replace(/\\.+$/, '');\n  if (!kernelHost(host)) return undefined;\n  if (!ownKernelServer(host))\n    throw new TypeError(\n      `${host} isn't a kernel server SLICC may reach: use <port>.kernel.localhost with a port from 1 to 65535 other than ${FACADE_PORT}, the CDP facade`\n    );\n  return Number(host.split('.')[0]);\n}\n\nfunction stream(body: AsyncIterable<Uint8Array>): ReadableStream<Uint8Array> {\n  const iterator = body[Symbol.asyncIterator]();\n  return new ReadableStream({\n    async pull(controller) {\n      const next = await iterator.next();\n      if (next.done) controller.close();\n      else controller.enqueue(next.value);\n    },\n    async cancel() {\n      await iterator.return?.();\n    },\n  });\n}\n\nconst TELEMETRY = 'x-stainless-';\n\nfunction untracked(request: Request): Request {\n  const telemetry = [...request.headers.keys()].filter((name) => name.startsWith(TELEMETRY));\n  if (!telemetry.length) return request;\n  const headers = new Headers(request.headers);\n  for (const name of telemetry) headers.delete(name);\n  return new Request(request, { headers });\n}\n\nexport function transportFetch(\n  transport: Transport,\n  origin: string,\n  native: typeof fetch = globalThis.fetch.bind(globalThis),\n  loopback?: Loopback\n): typeof fetch {\n  return async (input, init) => {\n    const request = untracked(new Request(input, init));\n    const port = kernelPort(request.url);\n    if (loopback && port) return loopback(request, { port, signal: request.signal });\n    if (\n      new URL(request.url).origin === origin ||\n      transport.traits?.unavailable ||\n      request.credentials === 'include'\n    ) {\n      return native(request);\n    }\n    const body = ['GET', 'HEAD'].includes(request.method)\n      ? undefined\n      : new Uint8Array(await request.arrayBuffer());\n    const response = await transport.fetch({\n      url: request.url,\n      method: request.method,\n      headers: [...request.headers],\n      ...(body ? { body } : {}),\n      signal: request.signal,\n    });\n    const redirected =\n      response.redirected ||\n      (response.url && bare(response.url) !== bare(request.url)) ||\n      (transport.traits?.manualRedirects && redirects.has(response.status));\n    if (request.redirect === 'error' && redirected) {\n      await stream(response.body)\n        .cancel()\n        .catch(() => undefined);\n      throw new TypeError('unexpected redirect');\n    }\n    return new Response(empty.has(response.status) ? null : stream(response.body), {\n      status: response.status,\n      statusText: response.statusText ?? '',\n      headers: response.headers,\n    });\n  };\n}\n"],
+  "mappings": "AAAA,SAAS,aAAa,YAAY,uBAAuB;AAgClD,SAAS,WAAW,WAA6D;AACtF,QAAM,OAAO,WAAW,QAAQ;AAChC,SAAO,OAAO,MAAM,SAAS,WAAW,OAAO;AACjD;AAEO,SAAS,SAAS,WAA2C;AAClE,SAAO,WAAW,QAAQ,gBAAgB,UAAU,CAAC,WAAW,SAAS;AAC3E;AAOA,MAAM,QAAQ,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAC/C,MAAM,YAAY,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AACnD,MAAM,OAAO,CAAC,QAAgB,IAAI,MAAM,GAAG,EAAE,CAAC;AAEvC,SAAS,WAAW,KAAiC;AAC1D,QAAM,OAAO,IAAI,IAAI,GAAG,EAAE,SAAS,QAAQ,QAAQ,EAAE;AACrD,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI,CAAC,gBAAgB,IAAI;AACvB,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,8GAA8G,WAAW;AAAA,IAClI;AACF,SAAO,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AAClC;AAEA,SAAS,OAAO,MAA6D;AAC3E,QAAM,WAAW,KAAK,OAAO,aAAa,EAAE;AAC5C,SAAO,IAAI,eAAe;AAAA,IACxB,MAAM,KAAK,YAAY;AACrB,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,KAAK,KAAM,YAAW,MAAM;AAAA,UAC3B,YAAW,QAAQ,KAAK,KAAK;AAAA,IACpC;AAAA,IACA,MAAM,SAAS;AACb,YAAM,SAAS,SAAS;AAAA,IAC1B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,YAAY;AAElB,SAAS,UAAU,SAA2B;AAC5C,QAAM,YAAY,CAAC,GAAG,QAAQ,QAAQ,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,KAAK,WAAW,SAAS,CAAC;AACzF,MAAI,CAAC,UAAU,OAAQ,QAAO;AAC9B,QAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,aAAW,QAAQ,UAAW,SAAQ,OAAO,IAAI;AACjD,SAAO,IAAI,QAAQ,SAAS,EAAE,QAAQ,CAAC;AACzC;AAEO,SAAS,eACd,WACA,QACA,SAAuB,WAAW,MAAM,KAAK,UAAU,GACvD,UACc;AACd,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,UAAU,UAAU,IAAI,QAAQ,OAAO,IAAI,CAAC;AAClD,UAAM,OAAO,WAAW,QAAQ,GAAG;AACnC,QAAI,YAAY,KAAM,QAAO,SAAS,SAAS,EAAE,MAAM,QAAQ,QAAQ,OAAO,CAAC;AAC/E,QACE,IAAI,IAAI,QAAQ,GAAG,EAAE,WAAW,UAChC,UAAU,QAAQ,eAClB,QAAQ,gBAAgB,WACxB;AACA,aAAO,OAAO,OAAO;AAAA,IACvB;AACA,UAAM,OAAO,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM,IAChD,SACA,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AAC9C,UAAM,WAAW,MAAM,UAAU,MAAM;AAAA,MACrC,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,SAAS,CAAC,GAAG,QAAQ,OAAO;AAAA,MAC5B,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,QAAQ,QAAQ;AAAA,IAClB,CAAC;AACD,UAAM,aACJ,SAAS,cACR,SAAS,OAAO,KAAK,SAAS,GAAG,MAAM,KAAK,QAAQ,GAAG,KACvD,UAAU,QAAQ,mBAAmB,UAAU,IAAI,SAAS,MAAM;AACrE,QAAI,QAAQ,aAAa,WAAW,YAAY;AAC9C,YAAM,OAAO,SAAS,IAAI,EACvB,OAAO,EACP,MAAM,MAAM,MAAS;AACxB,YAAM,IAAI,UAAU,qBAAqB;AAAA,IAC3C;AACA,WAAO,IAAI,SAAS,MAAM,IAAI,SAAS,MAAM,IAAI,OAAO,OAAO,SAAS,IAAI,GAAG;AAAA,MAC7E,QAAQ,SAAS;AAAA,MACjB,YAAY,SAAS,cAAc;AAAA,MACnC,SAAS,SAAS;AAAA,IACpB,CAAC;AAAA,EACH;AACF;",
   "names": []
 }