@ai-ecoverse/slicc-agent 7.0.0 → 7.1.0

package/README.md

@@ -138,13 +138,13 @@ const owner = await startAgent({
 
 `runAgentWorker(self, options)` is the same with its parts replaceable (model, providers, kernel attach, the account store, storage).
 
-**Providers.** `sliccProviders()` registers Bedrock, Adobe and every pi-ai provider that takes a plain API key: Anthropic, OpenAI, Mistral, Groq, DeepSeek, Together, Hugging Face, Xiaomi and its three token plans, Cerebras, OpenRouter, Fireworks, Baseten, Moonshot AI and its China platform, xAI, Meta, Vercel AI Gateway, MiniMax and MiniMax CN, Z.AI and Z.AI Coding CN, NVIDIA, Kimi For Coding, Ant Ling, OpenCode Zen and Go, and the three Qwen token plans (`KEY_PROVIDERS` in `src/providers.ts`, each with its id, pi-ai factory, pi-ai env name, a description, a key URL and whether it answers browsers). Three more take a key and non-secret fields (`auth: 'fields'`), each checked in `connect` and mapped to pi-ai's env: Azure (`endpoint`, required: a resource name becomes `AZURE_OPENAI_RESOURCE_NAME`, an `https:` URL without a port or user name `AZURE_OPENAI_BASE_URL`; `deployments`, optional `model=deployment` pairs, `AZURE_OPENAI_DEPLOYMENT_NAME_MAP`), Cloudflare Workers AI (`account`, 32 hex characters, `CLOUDFLARE_ACCOUNT_ID`) and Cloudflare AI Gateway (`account` and `gateway`, `CLOUDFLARE_GATEWAY_ID`). Bedrock's `region` is on the same mechanism. A bad value rejects `connect` with a sentence, a required field left out keeps its stored value or rejects with “{label} can’t be empty.”, and a stored value that no longer passes is left out of the env. A fields provider whose required fields are missing or no longer pass shows as not connected, gives pi-ai no credential and offers no models, even with its key already in the vault (spectrum puts the key before `connect` checks the fields). Bedrock's region is any AWS region name (`eusc-de-east-1` and `us-gov-west-1` included), and stored values are trimmed. OpenCode Zen and OpenCode Go need seven's vault 1.12.2 or later, whose built-in table has their `/inference` endpoints; their descriptions say so. Azure's `endpoint` field says `customBase: true`: when its value is a full URL, spectrum registers it with the vault (the page's `endpoints`) before `connect`, since the agent never registers model endpoints for pi-ai providers; a resource name needs nothing, as `*.openai.azure.com` is built into the vault. The worker routes requests to an Azure account's base URL as Azure's. Google and Google Vertex wait for slicc-bios to stop removing `@google/genai`; the sign-ins come later. A provider's preferred model is pi-coding-agent 1.4.0's `defaultModelPerProvider` (Bedrock keeps `us.anthropic.claude-sonnet-5-5`), and the first model when that one is missing. Providers that don't answer a browser from `https://seven.sliccy.ai` with the headers pi-ai and the AWS SDK send say `needs: 'cors-free-transport'`; the direct ones are Bedrock, Adobe, Anthropic, OpenAI, Azure, Mistral, Groq, DeepSeek, Together, Hugging Face, Baseten, both Moonshot AI platforms, xAI, Meta, Z.AI Coding CN and the four Xiaomi providers. Chrome accepts `Authorization` under a bare `Access-Control-Allow-Headers: *` (as xAI, Meta and Adobe's proxy answer), checked in Chrome 156. The worker's transport fetch drops the Stainless SDKs' `x-stainless-*` telemetry headers from every request it sends, which is what Baseten's and Moonshot AI's preflights refuse.
+**Providers.** `sliccProviders()` registers Bedrock, Adobe and every pi-ai provider that takes a plain API key: Anthropic, OpenAI, Mistral, Groq, DeepSeek, Together, Hugging Face, Xiaomi and its three token plans, Cerebras, OpenRouter, Fireworks, Baseten, Moonshot AI and its China platform, xAI, Meta, Vercel AI Gateway, MiniMax and MiniMax CN, Z.AI and Z.AI Coding CN, NVIDIA, Kimi For Coding, Ant Ling, OpenCode Zen and Go, and the three Qwen token plans (`KEY_PROVIDERS` in `src/providers.ts`, each with its id, pi-ai factory, pi-ai env name, a description, a key URL and whether it answers browsers). Three more take a key and non-secret fields (`auth: 'fields'`), each checked in `connect` and mapped to pi-ai's env: Azure (`endpoint`, required: a resource name becomes `AZURE_OPENAI_RESOURCE_NAME`, an `https:` URL without a port or user name `AZURE_OPENAI_BASE_URL`; `deployments`, optional `model=deployment` pairs, `AZURE_OPENAI_DEPLOYMENT_NAME_MAP`), Cloudflare Workers AI (`account`, 32 hex characters, `CLOUDFLARE_ACCOUNT_ID`) and Cloudflare AI Gateway (`account` and `gateway`, `CLOUDFLARE_GATEWAY_ID`). Bedrock's `region` is on the same mechanism. A bad value rejects `connect` with a sentence, a required field left out keeps its stored value or rejects with “{label} can’t be empty.”, and a stored value that no longer passes is left out of the env. A fields provider whose required fields are missing or no longer pass shows as not connected, gives pi-ai no credential and offers no models, even with its key already in the vault (spectrum puts the key before `connect` checks the fields). Bedrock's region is any AWS region name (`eusc-de-east-1` and `us-gov-west-1` included), and stored values are trimmed. OpenCode Zen and OpenCode Go need seven's vault 1.12.2 or later, whose built-in table has their `/inference` endpoints; their descriptions say so. Azure's `endpoint` field says `customBase: true`: when its value is a full URL, spectrum registers it with the vault (the page's `endpoints`) before `connect`, since the agent never registers model endpoints for pi-ai providers; a resource name needs nothing, as `*.openai.azure.com` is built into the vault. The worker routes requests to an Azure account's base URL as Azure's. Google and Google Vertex wait for slicc-bios to stop removing `@google/genai`; the sign-ins come later. A provider's preferred model is pi-coding-agent 1.4.0's `defaultModelPerProvider` (Bedrock keeps `us.anthropic.claude-sonnet-5-5`), and the first model when that one is missing. Providers that don't answer a browser from `https://seven.sliccy.ai` with the headers pi-ai and the AWS SDK send say `needs: 'cors-free-transport'`; the direct ones are Bedrock, Adobe, Anthropic, OpenAI, Azure, Mistral, Groq, DeepSeek, Together, Hugging Face, Baseten, both Moonshot AI platforms, xAI, Meta and the four Xiaomi providers. Z.AI Coding CN stays cors-free: the nightly check found it answering browsers on one day and not two days later. Chrome accepts `Authorization` under a bare `Access-Control-Allow-Headers: *` (as xAI, Meta and Adobe's proxy answer), checked in Chrome 156. The worker's transport fetch drops the Stainless SDKs' `x-stainless-*` telemetry headers from every request it sends, which is what Baseten's and Moonshot AI's preflights refuse.
 
-**Reachability, nightly.** `npm run reach` (`scripts/reach.mjs`, through `verdict.mjs`) checks every listing from `https://seven.sliccy.ai`. It captures the request pi-ai builds for each of the provider's APIs (with a dummy key and dummy fields, and the fetch faked; Bedrock's from the AWS SDK's own request, caught at its Node HTTP handler, which carries the same headers as in a browser: `amz-sdk-invocation-id`, `amz-sdk-request`, `authorization`, `content-type`, `x-amz-user-agent`). Then it sends that request's preflight and, when the preflight passes, the request itself with dummy credentials, whose answer must carry `Access-Control-Allow-Origin` too. Besides each chat API it probes what the provider's models need beyond a turn: the requests its model discovery sends under its base URL (Adobe's `/v1/config`), one classifier call per classifier API (Adobe's `/v1/ai/run`, OpenAI's `/v1/decisions`, OpenRouter's and Cloudflare's), and Adobe's `/v1/usage`. It prints `reach: <id> direct|cors-free|unknown|unprobed` per provider (`unknown` when the network gave no answer; `unprobed` when it captured no request at all, which counts as a disagreement, so a provider can't silently drop out of the check) and one `reach: PASS` line. A provider that stays `unknown` three runs in a row counts as a disagreement too: the workflow keeps the streaks in the Actions cache (`REACH_HISTORY`), and the line says how many runs in a row. A direct provider that passes only because Chrome lets `Authorization` through under a bare `Access-Control-Allow-Headers: *` reads `direct (wildcard auth)` (today Adobe, xAI and Meta); the PASS line, the run's summary and the issue body list them, without failing, so we know at once which break if Chrome ever enforces the Fetch spec. `.github/workflows/reach.yml` runs it every night on `ubuntu-latest`, never on pull requests, and opens or updates the issue titled “Provider reachability disagrees with the listings” when a provider's verdict isn't its `needs`, and closes it with a comment once every provider's verdict matches its listing again (a run with an `unknown` provider leaves it open); a run without the PASS line fails.
+**Reachability, by hand.** `npm run reach` (`scripts/reach.mjs`, through `verdict.mjs`) checks every listing from `https://seven.sliccy.ai`. It captures the request pi-ai builds for each of the provider's APIs (with a dummy key and dummy fields, and the fetch faked; Bedrock's from the AWS SDK's own request, caught at its Node HTTP handler, which carries the same headers as in a browser: `amz-sdk-invocation-id`, `amz-sdk-request`, `authorization`, `content-type`, `x-amz-user-agent`). Then it sends that request's preflight and, when the preflight passes, the request itself with dummy credentials, whose answer must carry `Access-Control-Allow-Origin` too. Besides each chat API it probes what the provider's models need beyond a turn: the requests its model discovery sends under its base URL (Adobe's `/v1/config`), one classifier call per classifier API (Adobe's `/v1/ai/run`, OpenAI's `/v1/decisions`, OpenRouter's and Cloudflare's), and Adobe's `/v1/usage`. It prints `reach: <id> direct|cors-free|unknown|unprobed` per provider (`unknown` when the network gave no answer; `unprobed` when it captured no request at all, which counts as a disagreement, so a provider can't silently drop out of the check) and one `reach: PASS` line. A provider that stays `unknown` three runs in a row counts as a disagreement too, when `REACH_HISTORY` names a file that keeps the streaks between runs, and the line says how many runs in a row; `REACH_REPORT` names a file for the JSON report. A direct provider that passes only because Chrome lets `Authorization` through under a bare `Access-Control-Allow-Headers: *` reads `direct (wildcard auth)` (today Adobe, xAI and Meta); the PASS line and the report list them, without failing, so we know at once which break if Chrome ever enforces the Fetch spec. No workflow runs it: it calls the real providers' endpoints, so it is a check to run before changing a listing, and no CI job or integration test reaches a real provider (`test/integration/reach.test.mjs` fakes the network). A run without the PASS line fails.
 
 The first provider is AWS Bedrock with a Bedrock API key as the bearer token; the default model is `us.anthropic.claude-sonnet-5-5`. Requests go to `us-west-2` unless the account's `region` field names another one (`AWS_REGION`). The account publishes that field as `fields: [{ name: 'region', label: 'Region', help, options, value }]`, and `connect` takes it. Bedrock's runtime endpoints answer browsers (`Access-Control-Allow-Origin: *`, allowing the AWS SDK's headers), so it needs no CORS-free transport.
 
-**Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and seals the token in the vault itself (bios: `seal { kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }`), so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that resolves `{ sealed: true }`; the adapter then calls `connect('adobe')` with no secret. A `login` that still returns a token is refused with "Adobe sign-in needs seven's vault: update seven", and the token never reaches the worker. IMS gives no refresh token, so an expired record shows the account as `expired`, and Sign in (or Reconnect) runs `login` again. The worker derives that from each vault record (`records()`, any account kind, MCP rows included): a record that isn't `ready` or `refreshing` (such as `inert`), or whose `expiresAt` (epoch milliseconds, the vault's `EpochMs`) has passed, reads `expired`, and a timer flips it when the clock reaches `expiresAt`, so an open page needn't wait for the vault to change. A model request that still gets a 401 after the vault's one refresh marks the record it was sent with `expired` too, until that record changes (a new sign-in gives it a new `expiresAt`) or the account is connected again (`connect`), not when an unrelated record changes, so the error card's **Log in** lands on an account that offers Sign in. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state as `budget` (refreshed on connect and every five minutes), and the `tray` adapter shows it in spectrum's TrayStatus. The proxy answers browsers from `seven.sliccy.ai`, so Adobe needs no CORS-free transport. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**, reads “Log in again to continue.” (the raw error goes to the console once, already scrubbed, never onto the card) and names its account (`account: 'adobe'`, spectrum ≥ 1.88.0), so Log in calls `settings.connect('adobe')` inside the click and spectrum's card follows the sign-in (its own copy while signing in, then “Signed in to Adobe again.”, from the account's `provider`), or shows the failure as a sentence (a `login` that rejects with “the sign-in timed out” reads “The sign-in timed out.”; a cancel stays an `AbortError`, which shows nothing). A rejected or missing key's card, and the “isn't connected” error, name their account too, so spectrum opens Settings at that row; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
+**Adobe.** `adobeProvider()` reaches Adobe's LLM proxy (`ADOBE_PROXY`) with the user's IMS token as a bearer. Its models come from the proxy's `/v1/config` once a token is stored: Anthropic-style models go through pi-ai's `anthropic-messages` API at the proxy root, `api: 'openai'` models through `openai-completions` under `/v1`, and hidden ones are skipped. Every request to the proxy (turns on either API, Clef, `/v1/config` and `/v1/usage`) carries an `X-Session-Id` that is fixed for the worker and an `X-Slicc-Version` (slicc-agent's version, `adobeProvider({ session, version })`); the proxy refuses turns without them. They're added where the request is built, over the caller's and the model's headers, because pi-ai 1.0.4 keeps a provider's `headers` but never sends them. The account is a sign-in (`auth: 'oauth'`): `AgentSettings.signIn('adobe')` returns the IMS `clientId`, `scopes` and `imsEnvironment` from `/v1/config`, fetched in the worker through the transport. The page runs the IMS popup and seals the token in the vault itself (bios: `seal { kind: 'model', provider: 'adobe', name: 'ADOBE_IMS_TOKEN', source: 'oauth:adobe', expiresAt }`), so `createAgentModel(connection, { login })` takes a `login(providerId, signIn, { signal })` that resolves `{ sealed: true }`; the adapter then calls `connect('adobe')` with no secret. A `login` that still returns a token is refused with "Adobe sign-in needs seven's vault: update seven", and the token never reaches the worker. IMS gives no refresh token, so an expired record shows the account as `expired`, and Sign in (or Reconnect) runs `login` again. The worker derives that from each vault record (`records()`, any account kind, MCP rows included): a record that isn't `ready` or `refreshing` (such as `inert`), or whose `expiresAt` (epoch milliseconds, the vault's `EpochMs`) has passed, reads `expired`, and a timer flips it when the clock reaches `expiresAt`, so an open page needn't wait for the vault to change. A model request that still gets a 401 after the vault's one refresh marks the record it was sent with `expired` too, until that record changes (a new sign-in gives it a new `expiresAt`) or the account is connected again (`connect`), not when an unrelated record changes, so the error card's **Log in** lands on an account that offers Sign in. While it runs, the account shows as `signing-in` (spectrum ≥ 1.34.0), and `SettingsPort.cancel(id)` aborts the signal; a cancelled sign-in never connects, even if the login resolves late. The adapter calls `login` before anything else in the click's task, so the page can open its popup while it still has the user's gesture, and `signIn()` then fetches the IMS options lazily. The weekly budget from `/v1/usage` is in the settings state (refreshed on connect and every five minutes); see **Budgets**. The proxy answers browsers from `seven.sliccy.ai`, so Adobe needs no CORS-free transport. An expired session's error card (a 401, or a refusal whose type or message says the token is invalid or expired) offers **Log in**, reads “Log in again to continue.” (the raw error goes to the console once, already scrubbed, never onto the card) and names its account (`account: 'adobe'`, spectrum ≥ 1.88.0), so Log in calls `settings.connect('adobe')` inside the click and spectrum's card follows the sign-in (its own copy while signing in, then “Signed in to Adobe again.”, from the account's `provider`), or shows the failure as a sentence (a `login` that rejects with “the sign-in timed out” reads “The sign-in timed out.”; a cancel stays an `AbortError`, which shows nothing). A rejected or missing key's card, and the “isn't connected” error, name their account too, so spectrum opens Settings at that row; any other refusal, such as a 403 `missing_required_header`, shows the proxy's message, with the HTTP status and error type below it (`403 missing_required_header`) and **Retry**.
 
 **Classifiers.** The Adobe provider also registers Cloudflare's Clef classifiers as `adobe/clef` and `adobe/clef-flash` (`adobeClassifiers()`): `type: 'classifier'` models on pi-ai's `cloudflare-workers-ai-system-one` API with `baseUrl: <proxy>/v1/ai`, so `models.classify(model, { state, questions })` posts `{ model: '@cf/cloudflare/clef', input }` to the proxy's `/v1/ai/run` with the IMS token as the bearer. The provider maps its short ids to the Workers AI names, and pi parses the answers and prices the usage ($0.24 per million input tokens for Clef, $0.09 for Clef Flash, nothing for output), which counts against the same weekly budget. They are classifiers only: `models.getModels()`, the settings `models` and the picker list chat models, and `models.getAvailableOfType('classifier', 'adobe')` returns them only while an Adobe token is stored.
 
@@ -154,6 +154,8 @@ The first provider is AWS Bedrock with a Bedrock API key as the bearer token; th
 
 **Blocked providers.** `needs: 'cors-free-transport'` is the static fact; `blocked: 'cors-free-transport'`, on both `ProviderOption` and the account, says the current transport can't reach that provider right now: the worker's kernel transport is unavailable, or it is the page's own fetch without a linked exit (`transportReach(client)` in `src/net.ts`, from the transport's traits). The worker follows `client.onTraits`, so a provider unblocks as soon as an extension or a linked slicc gives a CORS-free route, and blocks again when it goes, with no reload. A blocked provider is still offered and can be added; a connected one keeps its key and its row, but its models are left out of `models` and `labels`, so the picker offers none until the route is back.
 
+**Budgets.** The settings state's `budgets` lists each subscription's weekly window as `{ provider, percent, window: 'weekly', resets }`: Adobe's from `/v1/usage`, then SuperGrok's, and `budget` is the first of them (Adobe's when both are there). SuperGrok's (`xaiUsage` in `src/supergrok.ts`, as in SLICC 6) is `GET https://cli-chat-proxy.grok.com/v1/billing?format=credits` with the xAI record's placeholder as the bearer. It's read only for an xAI sign-in (a record with an `expiresAt`, not `expired`; a pasted key has none) and only while the cors-free transport is up (`reach.free()`), since that host doesn't answer browsers. It's read at most once per five-minute poll for the same record, with an 8 s timeout. The route is undocumented, so the answer is read defensively: a body over 64 KiB, malformed JSON, or anything but a `USAGE_PERIOD_TYPE_WEEKLY` `currentPeriod` with a finite `creditUsagePercent` and a valid `end` gives no budget, and the percent is clamped to 0–100 and rounded to one decimal. The vault fills the token only where xAI's endpoints allow: until its built-in table has the billing route, it refuses the request before anything is sent, and xAI shows no budget. The `tray` and `monitor` adapters show the budget of the selected model's provider (the active agent's model), or the first budget when that provider has none, and pass its `provider` (spectrum labels `adobe` “Adobe” and `xai` “SuperGrok”). The Monitor's budget vital carries `provider` and `window` too, which spectrum's heading is built from, so its own label stays “Budget (weekly)”; its alert names the provider: “SuperGrok budget 96% used”. `test/integration/budget.test.mjs` checks the switch, the refused endpoint and an oversized answer.
+
 **Held sign-in windows** (`src/spectrum/held.ts`, slicc-bios#772). A sign-in popup opens in the click on `about:blank#slicc-sign-in-<nonce>` (a random UUID), and the page asks seven's owner to hold it with `{ type: 'hold', marker: <nonce> }` on the `slicc-held` BroadcastChannel. The owner holds the target with that exact URL, so no CDP client can list or drive it, and answers `{ type, marker }`: `held` once it's held on every connected browser host, `none` when no host is connected (nothing can reach the popup), and `unheld` when a host is connected but the target wasn't found. The popup goes to the IdP or device page only on `held` or `none`. On `unheld` or after 6 s without an answer, the popup closes without navigating and the sign-in fails with “SLICC couldn't protect the sign-in window. Try again.”; on Cancel it never navigates either.
 
 **Subscription sign-ins.** xAI, Kimi For Coding and ChatGPT (`openai-codex`, shown as ChatGPT) sign in with pi-ai's own device-code flows (`DEVICE_SIGN_INS` in `src/sign-ins.ts`); xAI and Kimi keep API-key entry too, so their accounts are `auth: 'oauth'` with `secret: 'api-key'` (spectrum's “Use an API key instead”) and a `keyUrl`. Spectrum's Sign in calls `connect(id, undefined, undefined, { method: 'sign-in' })` in the click, and a pasted key `put`s first and calls `connect(id, undefined, fields, { method: 'key' })` (spectrum's `ConnectOptions`); without the fourth argument an `oauth` account signs in. The adapter opens a held popup (`slicc-sign-in`, see **Held sign-in windows**) before anything else in the click's task, then asks the worker's `signIn(id)`, which adds the account, runs the provider's `auth.oauth.login` and answers `{ url, code }` once the provider gives its device code (an `https:` page only). While it waits the account is `signing-in` with `signIn: { url, code? }`, kept in the page and never in the replicated settings state; the prompt appears and the popup goes to `url` only once the popup is held, and spectrum shows `code` with Copy and a link to `url` when the browser blocked the popup. The adapter's `connect` call then waits in the worker for the token (a sign-in no `connect` claims within a minute is dropped) and hands the vault `grant { provider, name, response, settings? }`, `name` being the account's `vaultName` and `response` the token response built from pi-ai's credential, as bytes zeroed after the call; the token is never stored, logged, licked or put in the state, and pi-ai's own error texts, which can quote a token response, never leave the worker. A refusal reads “The sign-in was refused.”, a timeout, network failure or malformed answer “The sign-in didn't finish. Try again.”, the vault's `EEXIST` “This name holds another provider's key.”, and Cancel aborts at once with an `AbortError`. Signing in again is a rotation that keeps the placeholder, and over a pasted key the vault keeps that key restorable. The vault refreshes the token through `egress`; after `invalid_grant` its record is `expired` and the account offers Sign in again. ChatGPT's API reads the account id from the access token's JWT, which a placeholder isn't: the grant carries `settings: { CHATGPT_ACCOUNT_ID }` (every sign-in), the credential's env gets it from the record, and the worker hands pi-ai a carrier key `slicc.<claims>.<placeholder>` that the worker's fetch turns back into `Bearer <placeholder>` before the vault fills it, so pi-ai sends `chatgpt-account-id` itself; its turns use SSE, not WebSockets. Kimi's auth host answers browsers but its API needs the CORS-free transport; xAI's API answers browsers but its device endpoints don't, so an xAI sign-in needs the CORS-free transport while its key doesn't; ChatGPT's auth host answers browsers and its API doesn't. The flows load lazily from pi-ai: xAI's and Kimi's modules import nothing from Node, and openai-codex's imports `node:http` for its browser callback, which the device flow never runs, so slicc-bios's `node:*` stubs let it load.
@@ -162,7 +164,7 @@ The first provider is AWS Bedrock with a Bedrock API key as the bearer token; th
 
 ### In slicc-spectrum
 
-`@ai-ecoverse/slicc-spectrum` is an optional peer dependency, `^1.103.0`. 1.102.0 types a guest tool approval's `args` and `argsTruncated`, and 1.103.0 shows a device sign-in's `signIn` code and link in Settings. 1.94.0 is the first release with the provider picker (`providers()`, `remove`, `vaultName`, `customBase`, a field's `options` and `value`); 1.94.1 shows a field with `options` as an `sp-picker` on its `value`; 1.95.0 shows a `blocked` provider in the picker as unpickable with “Needs the SLICC extension or CLI”; 1.96.0 registers an MCP token's server URL (`Account.url`) with the vault itself, after a “Connect to {url}?” confirm, and offers Reconnect when the URL moves; and 1.98.0 saves a field's value as its `vaultSetting` on the vault record (`VaultPort.settings`, V3). `test/integration/settings-ui.test.mjs` checks each in a real `<slicc-settings>`: Bedrock's region picker on the stored region, a blocked provider that can't be picked until a CORS-free route appears, the moved note once `mcp.json` points a connected server elsewhere, and that adding Cloudflare Workers AI or Azure (by resource name) puts the key with its tenant fields as the record's vault `settings` (`CLOUDFLARE_ACCOUNT_ID`, `AZURE_OPENAI_RESOURCE_NAME`).
+`@ai-ecoverse/slicc-spectrum` is an optional peer dependency, `^1.103.0`. 1.102.0 types a guest tool approval's `args` and `argsTruncated`, and 1.103.0 shows a device sign-in's `signIn` code and link in Settings. 1.107.0 heads the budget with its provider: the tray's `budget.provider` and the Monitor vital's `provider` and `window` (older releases ignore them). 1.94.0 is the first release with the provider picker (`providers()`, `remove`, `vaultName`, `customBase`, a field's `options` and `value`); 1.94.1 shows a field with `options` as an `sp-picker` on its `value`; 1.95.0 shows a `blocked` provider in the picker as unpickable with “Needs the SLICC extension or CLI”; 1.96.0 registers an MCP token's server URL (`Account.url`) with the vault itself, after a “Connect to {url}?” confirm, and offers Reconnect when the URL moves; and 1.98.0 saves a field's value as its `vaultSetting` on the vault record (`VaultPort.settings`, V3). `test/integration/settings-ui.test.mjs` checks each in a real `<slicc-settings>`: Bedrock's region picker on the stored region, a blocked provider that can't be picked until a CORS-free route appears, the moved note once `mcp.json` points a connected server elsewhere, and that adding Cloudflare Workers AI or Azure (by resource name) puts the key with its tenant fields as the record's vault `settings` (`CLOUDFLARE_ACCOUNT_ID`, `AZURE_OPENAI_RESOURCE_NAME`).
 
 `@ai-ecoverse/slicc-agent/spectrum` turns an `AgentConnection` into slicc-spectrum's `AgentPort`, so `<slicc-app>` shows the real agent:
 
@@ -643,7 +645,7 @@ The process table is the worker's root client's `ps()`. Each process is named af
 - **Users mode:** the human's panel is root's, so it sees every process. A cone's bound client would see only its own, by the kernel's hidepid.
 
 **The port.** `createAgentModel()` returns a `MonitorAdapter`. Its first `snapshot` listener opens the lease (with a resync), and its last one closes it.
-- **Vitals:** the Adobe budget, spend (or tokens when every model is free) with its hourly rate, active agents, running tools and tasks, processes, process memory, CPU and the fullest context.
+- **Vitals:** the selected provider's budget (see **Budgets**), spend (or tokens when every model is free) with its hourly rate, active agents, running tools and tasks, processes, process memory, CPU and the fullest context.
 - **Alerts:**
 
   | Alert | Warn | Error |

package/dist/providers.js

@@ -355,7 +355,7 @@ const KEY_PROVIDERS = [
     env: "ZAI_CODING_CN_API_KEY",
     description: "GLM models on Zhipu\u2019s coding plan in China.",
     keyUrl: "https://open.bigmodel.cn/usercenter/apikeys",
-    cors: true
+    cors: false
   },
   {
     id: "nvidia",

package/dist/providers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/providers.ts"],
-  "sourcesContent": ["import type { Provider } from '@earendil-works/pi-ai';\nimport { antLingProvider } from '@earendil-works/pi-ai/providers/ant-ling';\nimport { anthropicProvider } from '@earendil-works/pi-ai/providers/anthropic';\nimport { azureProvider } from '@earendil-works/pi-ai/providers/azure';\nimport { basetenProvider } from '@earendil-works/pi-ai/providers/baseten';\nimport { cerebrasProvider } from '@earendil-works/pi-ai/providers/cerebras';\nimport { cloudflareAIGatewayProvider } from '@earendil-works/pi-ai/providers/cloudflare-ai-gateway';\nimport { cloudflareWorkersAIProvider } from '@earendil-works/pi-ai/providers/cloudflare-workers-ai';\nimport { deepseekProvider } from '@earendil-works/pi-ai/providers/deepseek';\nimport { fireworksProvider } from '@earendil-works/pi-ai/providers/fireworks';\nimport { groqProvider } from '@earendil-works/pi-ai/providers/groq';\nimport { huggingfaceProvider } from '@earendil-works/pi-ai/providers/huggingface';\nimport { kimiCodingProvider } from '@earendil-works/pi-ai/providers/kimi-coding';\nimport { metaProvider } from '@earendil-works/pi-ai/providers/meta';\nimport { minimaxProvider } from '@earendil-works/pi-ai/providers/minimax';\nimport { minimaxCnProvider } from '@earendil-works/pi-ai/providers/minimax-cn';\nimport { mistralProvider } from '@earendil-works/pi-ai/providers/mistral';\nimport { moonshotaiProvider } from '@earendil-works/pi-ai/providers/moonshotai';\nimport { moonshotaiCnProvider } from '@earendil-works/pi-ai/providers/moonshotai-cn';\nimport { nvidiaProvider } from '@earendil-works/pi-ai/providers/nvidia';\nimport { openaiProvider } from '@earendil-works/pi-ai/providers/openai';\nimport { opencodeProvider } from '@earendil-works/pi-ai/providers/opencode';\nimport { opencodeGoProvider } from '@earendil-works/pi-ai/providers/opencode-go';\nimport { openrouterProvider } from '@earendil-works/pi-ai/providers/openrouter';\nimport { qwenTokenPlanProvider } from '@earendil-works/pi-ai/providers/qwen-token-plan';\nimport { qwenTokenPlanCnProvider } from '@earendil-works/pi-ai/providers/qwen-token-plan-cn';\nimport { qwenTokenPlanIndividualProvider } from '@earendil-works/pi-ai/providers/qwen-token-plan-individual';\nimport { togetherProvider } from '@earendil-works/pi-ai/providers/together';\nimport { vercelAIGatewayProvider } from '@earendil-works/pi-ai/providers/vercel-ai-gateway';\nimport { xaiProvider } from '@earendil-works/pi-ai/providers/xai';\nimport { xiaomiProvider } from '@earendil-works/pi-ai/providers/xiaomi';\nimport { xiaomiTokenPlanAmsProvider } from '@earendil-works/pi-ai/providers/xiaomi-token-plan-ams';\nimport { xiaomiTokenPlanCnProvider } from '@earendil-works/pi-ai/providers/xiaomi-token-plan-cn';\nimport { xiaomiTokenPlanSgpProvider } from '@earendil-works/pi-ai/providers/xiaomi-token-plan-sgp';\nimport { zaiProvider } from '@earendil-works/pi-ai/providers/zai';\nimport { zaiCodingCnProvider } from '@earendil-works/pi-ai/providers/zai-coding-cn';\nimport { CODEX } from './sign-ins.ts';\n\nexport interface FieldOption {\n  value: string;\n  label: string;\n}\n\nexport interface FieldInput {\n  name: string;\n  label: string;\n  required?: boolean;\n  placeholder?: string;\n  help?: string;\n  customBase?: true;\n  vaultSetting?: string;\n  options?: readonly FieldOption[];\n  value?: string;\n}\n\nexport interface FieldSpec extends FieldInput {\n  env(value: string): Record<string, string> | string;\n}\n\nexport interface KeyProvider {\n  id: string;\n  make: () => Provider;\n  env: string;\n  description: string;\n  keyUrl: string;\n  cors: boolean;\n  signIn?: true;\n  fields?: readonly FieldSpec[];\n}\n\nconst RESOURCE = /^[a-z0-9][a-z0-9-]{0,62}$/i;\nconst DEPLOYMENTS = /^[^=,\\s]+\\s*=\\s*[^=,\\s]+(\\s*,\\s*[^=,\\s]+\\s*=\\s*[^=,\\s]+)*$/;\n\nexport function httpsBase(value: string): URL | undefined {\n  const url = URL.parse(value);\n  if (url?.protocol !== 'https:' || url.username || url.password) return undefined;\n  return url.port === '' || url.port === '443' ? url : undefined;\n}\n\nfunction azureEndpoint(value: string): Record<string, string> | string {\n  if (RESOURCE.test(value)) return { AZURE_OPENAI_RESOURCE_NAME: value };\n  const url = httpsBase(value);\n  if (!url)\n    return 'Enter your Azure resource name, or its endpoint as an https:// address without a port or a user name.';\n  return { AZURE_OPENAI_BASE_URL: url.href.replace(/\\/+$/, '') };\n}\n\nexport const AZURE = 'azure';\n\nexport function azureBase(env: Readonly<Record<string, string>>): string | undefined {\n  if (env.AZURE_OPENAI_BASE_URL) return env.AZURE_OPENAI_BASE_URL;\n  const name = env.AZURE_OPENAI_RESOURCE_NAME;\n  return name ? `https://${name}.openai.azure.com/openai/v1` : undefined;\n}\n\nconst REGION = /^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$/;\nconst ACCOUNT = /^[0-9a-f]{32}$/i;\nconst GATEWAY = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst checked =\n  (pattern: RegExp, env: string, problem: string) =>\n  (value: string): Record<string, string> | string =>\n    pattern.test(value) ? { [env]: value } : problem;\n\nconst BEDROCK_REGIONS: readonly (readonly [string, string])[] = [\n  ['ap-northeast-1', 'Asia Pacific (Tokyo)'],\n  ['ap-northeast-2', 'Asia Pacific (Seoul)'],\n  ['ap-northeast-3', 'Asia Pacific (Osaka)'],\n  ['ap-south-1', 'Asia Pacific (Mumbai)'],\n  ['ap-south-2', 'Asia Pacific (Hyderabad)'],\n  ['ap-southeast-1', 'Asia Pacific (Singapore)'],\n  ['ap-southeast-2', 'Asia Pacific (Sydney)'],\n  ['ca-central-1', 'Canada (Central)'],\n  ['eu-central-1', 'Europe (Frankfurt)'],\n  ['eu-central-2', 'Europe (Zurich)'],\n  ['eu-north-1', 'Europe (Stockholm)'],\n  ['eu-south-1', 'Europe (Milan)'],\n  ['eu-south-2', 'Europe (Spain)'],\n  ['eu-west-1', 'Europe (Ireland)'],\n  ['eu-west-2', 'Europe (London)'],\n  ['eu-west-3', 'Europe (Paris)'],\n  ['sa-east-1', 'South America (S\u00E3o Paulo)'],\n  ['us-east-1', 'US East (N. Virginia)'],\n  ['us-gov-east-1', 'AWS GovCloud (US-East)'],\n  ['us-gov-west-1', 'AWS GovCloud (US-West)'],\n  ['us-west-2', 'US West (Oregon)'],\n];\n\nexport const DEFAULT_REGION = 'us-west-2';\n\nexport const REGION_FIELD: FieldSpec = {\n  name: 'region',\n  label: 'Region',\n  help: 'The AWS region your Bedrock models run in.',\n  options: BEDROCK_REGIONS.map(([value, label]) => ({ value, label: `${label}, ${value}` })),\n  value: DEFAULT_REGION,\n  env: checked(REGION, 'AWS_REGION', 'Enter an AWS region such as us-west-2.'),\n};\n\nconst ACCOUNT_FIELD: FieldSpec = {\n  name: 'account',\n  label: 'Account ID',\n  required: true,\n  placeholder: '0123456789abcdef0123456789abcdef',\n  help: 'The 32-character ID on your Cloudflare dashboard\u2019s account overview.',\n  vaultSetting: 'CLOUDFLARE_ACCOUNT_ID',\n  env: checked(\n    ACCOUNT,\n    'CLOUDFLARE_ACCOUNT_ID',\n    'A Cloudflare account ID is 32 characters of 0\u20139 and a\u2013f.'\n  ),\n};\n\nexport const KEY_PROVIDERS: readonly KeyProvider[] = [\n  {\n    id: 'azure',\n    make: azureProvider,\n    env: 'AZURE_OPENAI_API_KEY',\n    description: 'OpenAI models deployed in your own Azure OpenAI or AI Foundry resource.',\n    keyUrl: 'https://portal.azure.com',\n    cors: true,\n    fields: [\n      {\n        name: 'endpoint',\n        label: 'Endpoint',\n        required: true,\n        placeholder: 'my-resource or https://my-resource.openai.azure.com',\n        help: 'Your resource\u2019s name, or its endpoint address from Keys and Endpoint.',\n        customBase: true,\n        vaultSetting: 'AZURE_OPENAI_RESOURCE_NAME',\n        env: azureEndpoint,\n      },\n      {\n        name: 'deployments',\n        label: 'Deployments',\n        placeholder: 'gpt-5.4=my-gpt',\n        help: 'Only for deployments named differently from their model, as model=deployment, separated by commas.',\n        env: (value) =>\n          DEPLOYMENTS.test(value)\n            ? { AZURE_OPENAI_DEPLOYMENT_NAME_MAP: value }\n            : 'Write each deployment as model=deployment, separated by commas.',\n      },\n    ],\n  },\n  {\n    id: 'cloudflare-workers-ai',\n    make: cloudflareWorkersAIProvider,\n    env: 'CLOUDFLARE_API_KEY',\n    description: 'Open models on Cloudflare Workers AI, in your Cloudflare account.',\n    keyUrl: 'https://dash.cloudflare.com/profile/api-tokens',\n    cors: false,\n    fields: [ACCOUNT_FIELD],\n  },\n  {\n    id: 'cloudflare-ai-gateway',\n    make: cloudflareAIGatewayProvider,\n    env: 'CLOUDFLARE_API_KEY',\n    description: 'Models from many labs through your Cloudflare AI Gateway.',\n    keyUrl: 'https://dash.cloudflare.com/profile/api-tokens',\n    cors: false,\n    fields: [\n      ACCOUNT_FIELD,\n      {\n        name: 'gateway',\n        label: 'Gateway ID',\n        required: true,\n        placeholder: 'my-gateway',\n        help: 'The name of your gateway under AI \u203A AI Gateway.',\n        vaultSetting: 'CLOUDFLARE_GATEWAY_ID',\n        env: checked(\n          GATEWAY,\n          'CLOUDFLARE_GATEWAY_ID',\n          'A gateway ID is letters, digits, - and _, up to 64 characters.'\n        ),\n      },\n    ],\n  },\n  {\n    id: 'anthropic',\n    make: anthropicProvider,\n    env: 'ANTHROPIC_API_KEY',\n    description: 'Claude models, with an API key from the Claude Console.',\n    keyUrl: 'https://console.anthropic.com/settings/keys',\n    cors: true,\n  },\n  {\n    id: 'openai',\n    make: openaiProvider,\n    env: 'OPENAI_API_KEY',\n    description: 'GPT models, with an API key from the OpenAI platform.',\n    keyUrl: 'https://platform.openai.com/api-keys',\n    cors: true,\n  },\n  {\n    id: 'mistral',\n    make: mistralProvider,\n    env: 'MISTRAL_API_KEY',\n    description: 'Mistral and Devstral models from La Plateforme.',\n    keyUrl: 'https://console.mistral.ai/api-keys',\n    cors: true,\n  },\n  {\n    id: 'groq',\n    make: groqProvider,\n    env: 'GROQ_API_KEY',\n    description: 'Open models on Groq\u2019s fast inference.',\n    keyUrl: 'https://console.groq.com/keys',\n    cors: true,\n  },\n  {\n    id: 'deepseek',\n    make: deepseekProvider,\n    env: 'DEEPSEEK_API_KEY',\n    description: 'DeepSeek\u2019s own models.',\n    keyUrl: 'https://platform.deepseek.com/api_keys',\n    cors: true,\n  },\n  {\n    id: 'together',\n    make: togetherProvider,\n    env: 'TOGETHER_API_KEY',\n    description: 'Open models hosted by Together AI.',\n    keyUrl: 'https://api.together.ai/settings/api-keys',\n    cors: true,\n  },\n  {\n    id: 'huggingface',\n    make: huggingfaceProvider,\n    env: 'HF_TOKEN',\n    description: 'Open models through Hugging Face\u2019s inference router.',\n    keyUrl: 'https://huggingface.co/settings/tokens',\n    cors: true,\n  },\n  {\n    id: 'xiaomi',\n    make: xiaomiProvider,\n    env: 'XIAOMI_API_KEY',\n    description: 'Xiaomi\u2019s MiMo models.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xiaomi-token-plan-ams',\n    make: xiaomiTokenPlanAmsProvider,\n    env: 'XIAOMI_TOKEN_PLAN_AMS_API_KEY',\n    description: 'MiMo models on a Xiaomi token plan, served from Amsterdam.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xiaomi-token-plan-cn',\n    make: xiaomiTokenPlanCnProvider,\n    env: 'XIAOMI_TOKEN_PLAN_CN_API_KEY',\n    description: 'MiMo models on a Xiaomi token plan, served from China.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xiaomi-token-plan-sgp',\n    make: xiaomiTokenPlanSgpProvider,\n    env: 'XIAOMI_TOKEN_PLAN_SGP_API_KEY',\n    description: 'MiMo models on a Xiaomi token plan, served from Singapore.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'cerebras',\n    make: cerebrasProvider,\n    env: 'CEREBRAS_API_KEY',\n    description: 'Open models on Cerebras inference.',\n    keyUrl: 'https://cloud.cerebras.ai',\n    cors: false,\n  },\n  {\n    id: 'openrouter',\n    make: openrouterProvider,\n    env: 'OPENROUTER_API_KEY',\n    description: 'Hundreds of models from many labs through one key.',\n    keyUrl: 'https://openrouter.ai/settings/keys',\n    cors: false,\n  },\n  {\n    id: 'fireworks',\n    make: fireworksProvider,\n    env: 'FIREWORKS_API_KEY',\n    description: 'Open models hosted by Fireworks AI.',\n    keyUrl: 'https://app.fireworks.ai/settings/users/api-keys',\n    cors: false,\n  },\n  {\n    id: 'baseten',\n    make: basetenProvider,\n    env: 'BASETEN_API_KEY',\n    description: 'Open models hosted by Baseten.',\n    keyUrl: 'https://app.baseten.co/settings/api_keys',\n    cors: true,\n  },\n  {\n    id: 'moonshotai',\n    make: moonshotaiProvider,\n    env: 'MOONSHOT_API_KEY',\n    description: 'Kimi models from Moonshot AI.',\n    keyUrl: 'https://platform.moonshot.ai/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'moonshotai-cn',\n    make: moonshotaiCnProvider,\n    env: 'MOONSHOT_API_KEY',\n    description: 'Kimi models from Moonshot AI\u2019s China platform.',\n    keyUrl: 'https://platform.moonshot.cn/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xai',\n    make: xaiProvider,\n    env: 'XAI_API_KEY',\n    description: 'Grok models from xAI.',\n    keyUrl: 'https://console.x.ai',\n    cors: true,\n    signIn: true,\n  },\n  {\n    id: 'meta',\n    make: metaProvider,\n    env: 'META_API_KEY',\n    description: 'Meta\u2019s Muse models.',\n    keyUrl: 'https://developer.meta.ai',\n    cors: true,\n  },\n  {\n    id: 'vercel-ai-gateway',\n    make: vercelAIGatewayProvider,\n    env: 'AI_GATEWAY_API_KEY',\n    description: 'Models from many labs through Vercel\u2019s AI Gateway.',\n    keyUrl: 'https://vercel.com/docs/ai-gateway/authentication',\n    cors: false,\n  },\n  {\n    id: 'minimax',\n    make: minimaxProvider,\n    env: 'MINIMAX_API_KEY',\n    description: 'MiniMax\u2019s models.',\n    keyUrl: 'https://platform.minimax.io/user-center/basic-information/interface-key',\n    cors: false,\n  },\n  {\n    id: 'minimax-cn',\n    make: minimaxCnProvider,\n    env: 'MINIMAX_CN_API_KEY',\n    description: 'MiniMax\u2019s models from its China platform.',\n    keyUrl: 'https://platform.minimaxi.com/user-center/basic-information/interface-key',\n    cors: false,\n  },\n  {\n    id: 'zai',\n    make: zaiProvider,\n    env: 'ZAI_API_KEY',\n    description: 'GLM models on Z.AI\u2019s coding plan.',\n    keyUrl: 'https://z.ai/manage-apikey/apikey-list',\n    cors: false,\n  },\n  {\n    id: 'zai-coding-cn',\n    make: zaiCodingCnProvider,\n    env: 'ZAI_CODING_CN_API_KEY',\n    description: 'GLM models on Zhipu\u2019s coding plan in China.',\n    keyUrl: 'https://open.bigmodel.cn/usercenter/apikeys',\n    cors: true,\n  },\n  {\n    id: 'nvidia',\n    make: nvidiaProvider,\n    env: 'NVIDIA_API_KEY',\n    description: 'Open models on NVIDIA\u2019s API catalog.',\n    keyUrl: 'https://build.nvidia.com/settings/api-keys',\n    cors: false,\n  },\n  {\n    id: 'kimi-coding',\n    make: kimiCodingProvider,\n    env: 'KIMI_API_KEY',\n    description: 'Kimi models on the Kimi Code subscription.',\n    keyUrl: 'https://www.kimi.com/code/console',\n    cors: false,\n    signIn: true,\n  },\n  {\n    id: 'ant-ling',\n    make: antLingProvider,\n    env: 'ANT_LING_API_KEY',\n    description: 'Ling and Ring models from Ant Group.',\n    keyUrl: 'https://www.ant-ling.com',\n    cors: false,\n  },\n  {\n    id: 'opencode',\n    make: opencodeProvider,\n    env: 'OPENCODE_API_KEY',\n    description:\n      'Models curated for coding agents by OpenCode Zen. Needs seven\u2019s vault 1.12.2 or later.',\n    keyUrl: 'https://opencode.ai/auth',\n    cors: false,\n  },\n  {\n    id: 'opencode-go',\n    make: opencodeGoProvider,\n    env: 'OPENCODE_API_KEY',\n    description:\n      'Open models on the OpenCode Go subscription. Needs seven\u2019s vault 1.12.2 or later.',\n    keyUrl: 'https://opencode.ai/auth',\n    cors: false,\n  },\n  {\n    id: 'qwen-token-plan',\n    make: qwenTokenPlanProvider,\n    env: 'QWEN_TOKEN_PLAN_API_KEY',\n    description: 'Qwen models on an Alibaba Cloud token plan.',\n    keyUrl: 'https://modelstudio.console.alibabacloud.com',\n    cors: false,\n  },\n  {\n    id: 'qwen-token-plan-cn',\n    make: qwenTokenPlanCnProvider,\n    env: 'QWEN_TOKEN_PLAN_CN_API_KEY',\n    description: 'Qwen models on an Alibaba Cloud token plan in China.',\n    keyUrl: 'https://bailian.console.aliyun.com',\n    cors: false,\n  },\n  {\n    id: 'qwen-token-plan-individual',\n    make: qwenTokenPlanIndividualProvider,\n    env: 'QWEN_TOKEN_PLAN_API_KEY',\n    description: 'Qwen models on an individual Alibaba Cloud token plan.',\n    keyUrl: 'https://modelstudio.console.alibabacloud.com',\n    cors: false,\n  },\n];\n\nexport type ProviderAuth = 'api-key' | 'oauth' | 'fields' | 'local';\n\nexport interface Listing {\n  description: string;\n  keyUrl?: string;\n  auth: ProviderAuth;\n  corsFree: boolean;\n  vaultName: string;\n  fields?: readonly FieldSpec[];\n}\n\nconst upper = (text: string) => text.toUpperCase().replace(/[^A-Z0-9]/g, '_');\n\nfunction vaultNames(entries: readonly KeyProvider[]): Map<string, string> {\n  const uses = Map.groupBy(entries, (entry) => entry.env);\n  return new Map(\n    entries.map((entry) => [\n      entry.id,\n      (uses.get(entry.env) as KeyProvider[]).length > 1 ? `${upper(entry.id)}_API_KEY` : entry.env,\n    ])\n  );\n}\n\nconst named = vaultNames(KEY_PROVIDERS);\n\nexport const LISTINGS: ReadonlyMap<string, Listing> = new Map<string, Listing>([\n  [\n    'amazon-bedrock',\n    {\n      description: 'Claude and other models on AWS, with a Bedrock API key.',\n      keyUrl: 'https://console.aws.amazon.com/bedrock/home#/api-keys',\n      auth: 'fields',\n      corsFree: false,\n      vaultName: 'AWS_BEARER_TOKEN_BEDROCK',\n      fields: [REGION_FIELD],\n    },\n  ],\n  [\n    'adobe',\n    {\n      description: 'Models through Adobe\u2019s LLM proxy, with your Adobe ID.',\n      auth: 'oauth',\n      corsFree: false,\n      vaultName: 'ADOBE_IMS_TOKEN',\n    },\n  ],\n  ...KEY_PROVIDERS.map((entry): [string, Listing] => [\n    entry.id,\n    {\n      description: entry.description,\n      keyUrl: entry.keyUrl,\n      auth: entry.signIn ? 'oauth' : entry.fields ? 'fields' : 'api-key',\n      corsFree: !entry.cors,\n      vaultName: named.get(entry.id) as string,\n      ...(entry.fields ? { fields: entry.fields } : {}),\n    },\n  ]),\n  [\n    CODEX,\n    {\n      description: 'GPT models on your ChatGPT Plus or Pro plan, with your ChatGPT account.',\n      auth: 'oauth',\n      corsFree: true,\n      vaultName: 'OPENAI_CODEX_TOKEN',\n    },\n  ],\n]);\n\nexport const ADDED_FIRST: readonly string[] = ['amazon-bedrock', 'adobe'];\n"],
+  "sourcesContent": ["import type { Provider } from '@earendil-works/pi-ai';\nimport { antLingProvider } from '@earendil-works/pi-ai/providers/ant-ling';\nimport { anthropicProvider } from '@earendil-works/pi-ai/providers/anthropic';\nimport { azureProvider } from '@earendil-works/pi-ai/providers/azure';\nimport { basetenProvider } from '@earendil-works/pi-ai/providers/baseten';\nimport { cerebrasProvider } from '@earendil-works/pi-ai/providers/cerebras';\nimport { cloudflareAIGatewayProvider } from '@earendil-works/pi-ai/providers/cloudflare-ai-gateway';\nimport { cloudflareWorkersAIProvider } from '@earendil-works/pi-ai/providers/cloudflare-workers-ai';\nimport { deepseekProvider } from '@earendil-works/pi-ai/providers/deepseek';\nimport { fireworksProvider } from '@earendil-works/pi-ai/providers/fireworks';\nimport { groqProvider } from '@earendil-works/pi-ai/providers/groq';\nimport { huggingfaceProvider } from '@earendil-works/pi-ai/providers/huggingface';\nimport { kimiCodingProvider } from '@earendil-works/pi-ai/providers/kimi-coding';\nimport { metaProvider } from '@earendil-works/pi-ai/providers/meta';\nimport { minimaxProvider } from '@earendil-works/pi-ai/providers/minimax';\nimport { minimaxCnProvider } from '@earendil-works/pi-ai/providers/minimax-cn';\nimport { mistralProvider } from '@earendil-works/pi-ai/providers/mistral';\nimport { moonshotaiProvider } from '@earendil-works/pi-ai/providers/moonshotai';\nimport { moonshotaiCnProvider } from '@earendil-works/pi-ai/providers/moonshotai-cn';\nimport { nvidiaProvider } from '@earendil-works/pi-ai/providers/nvidia';\nimport { openaiProvider } from '@earendil-works/pi-ai/providers/openai';\nimport { opencodeProvider } from '@earendil-works/pi-ai/providers/opencode';\nimport { opencodeGoProvider } from '@earendil-works/pi-ai/providers/opencode-go';\nimport { openrouterProvider } from '@earendil-works/pi-ai/providers/openrouter';\nimport { qwenTokenPlanProvider } from '@earendil-works/pi-ai/providers/qwen-token-plan';\nimport { qwenTokenPlanCnProvider } from '@earendil-works/pi-ai/providers/qwen-token-plan-cn';\nimport { qwenTokenPlanIndividualProvider } from '@earendil-works/pi-ai/providers/qwen-token-plan-individual';\nimport { togetherProvider } from '@earendil-works/pi-ai/providers/together';\nimport { vercelAIGatewayProvider } from '@earendil-works/pi-ai/providers/vercel-ai-gateway';\nimport { xaiProvider } from '@earendil-works/pi-ai/providers/xai';\nimport { xiaomiProvider } from '@earendil-works/pi-ai/providers/xiaomi';\nimport { xiaomiTokenPlanAmsProvider } from '@earendil-works/pi-ai/providers/xiaomi-token-plan-ams';\nimport { xiaomiTokenPlanCnProvider } from '@earendil-works/pi-ai/providers/xiaomi-token-plan-cn';\nimport { xiaomiTokenPlanSgpProvider } from '@earendil-works/pi-ai/providers/xiaomi-token-plan-sgp';\nimport { zaiProvider } from '@earendil-works/pi-ai/providers/zai';\nimport { zaiCodingCnProvider } from '@earendil-works/pi-ai/providers/zai-coding-cn';\nimport { CODEX } from './sign-ins.ts';\n\nexport interface FieldOption {\n  value: string;\n  label: string;\n}\n\nexport interface FieldInput {\n  name: string;\n  label: string;\n  required?: boolean;\n  placeholder?: string;\n  help?: string;\n  customBase?: true;\n  vaultSetting?: string;\n  options?: readonly FieldOption[];\n  value?: string;\n}\n\nexport interface FieldSpec extends FieldInput {\n  env(value: string): Record<string, string> | string;\n}\n\nexport interface KeyProvider {\n  id: string;\n  make: () => Provider;\n  env: string;\n  description: string;\n  keyUrl: string;\n  cors: boolean;\n  signIn?: true;\n  fields?: readonly FieldSpec[];\n}\n\nconst RESOURCE = /^[a-z0-9][a-z0-9-]{0,62}$/i;\nconst DEPLOYMENTS = /^[^=,\\s]+\\s*=\\s*[^=,\\s]+(\\s*,\\s*[^=,\\s]+\\s*=\\s*[^=,\\s]+)*$/;\n\nexport function httpsBase(value: string): URL | undefined {\n  const url = URL.parse(value);\n  if (url?.protocol !== 'https:' || url.username || url.password) return undefined;\n  return url.port === '' || url.port === '443' ? url : undefined;\n}\n\nfunction azureEndpoint(value: string): Record<string, string> | string {\n  if (RESOURCE.test(value)) return { AZURE_OPENAI_RESOURCE_NAME: value };\n  const url = httpsBase(value);\n  if (!url)\n    return 'Enter your Azure resource name, or its endpoint as an https:// address without a port or a user name.';\n  return { AZURE_OPENAI_BASE_URL: url.href.replace(/\\/+$/, '') };\n}\n\nexport const AZURE = 'azure';\n\nexport function azureBase(env: Readonly<Record<string, string>>): string | undefined {\n  if (env.AZURE_OPENAI_BASE_URL) return env.AZURE_OPENAI_BASE_URL;\n  const name = env.AZURE_OPENAI_RESOURCE_NAME;\n  return name ? `https://${name}.openai.azure.com/openai/v1` : undefined;\n}\n\nconst REGION = /^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$/;\nconst ACCOUNT = /^[0-9a-f]{32}$/i;\nconst GATEWAY = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst checked =\n  (pattern: RegExp, env: string, problem: string) =>\n  (value: string): Record<string, string> | string =>\n    pattern.test(value) ? { [env]: value } : problem;\n\nconst BEDROCK_REGIONS: readonly (readonly [string, string])[] = [\n  ['ap-northeast-1', 'Asia Pacific (Tokyo)'],\n  ['ap-northeast-2', 'Asia Pacific (Seoul)'],\n  ['ap-northeast-3', 'Asia Pacific (Osaka)'],\n  ['ap-south-1', 'Asia Pacific (Mumbai)'],\n  ['ap-south-2', 'Asia Pacific (Hyderabad)'],\n  ['ap-southeast-1', 'Asia Pacific (Singapore)'],\n  ['ap-southeast-2', 'Asia Pacific (Sydney)'],\n  ['ca-central-1', 'Canada (Central)'],\n  ['eu-central-1', 'Europe (Frankfurt)'],\n  ['eu-central-2', 'Europe (Zurich)'],\n  ['eu-north-1', 'Europe (Stockholm)'],\n  ['eu-south-1', 'Europe (Milan)'],\n  ['eu-south-2', 'Europe (Spain)'],\n  ['eu-west-1', 'Europe (Ireland)'],\n  ['eu-west-2', 'Europe (London)'],\n  ['eu-west-3', 'Europe (Paris)'],\n  ['sa-east-1', 'South America (S\u00E3o Paulo)'],\n  ['us-east-1', 'US East (N. Virginia)'],\n  ['us-gov-east-1', 'AWS GovCloud (US-East)'],\n  ['us-gov-west-1', 'AWS GovCloud (US-West)'],\n  ['us-west-2', 'US West (Oregon)'],\n];\n\nexport const DEFAULT_REGION = 'us-west-2';\n\nexport const REGION_FIELD: FieldSpec = {\n  name: 'region',\n  label: 'Region',\n  help: 'The AWS region your Bedrock models run in.',\n  options: BEDROCK_REGIONS.map(([value, label]) => ({ value, label: `${label}, ${value}` })),\n  value: DEFAULT_REGION,\n  env: checked(REGION, 'AWS_REGION', 'Enter an AWS region such as us-west-2.'),\n};\n\nconst ACCOUNT_FIELD: FieldSpec = {\n  name: 'account',\n  label: 'Account ID',\n  required: true,\n  placeholder: '0123456789abcdef0123456789abcdef',\n  help: 'The 32-character ID on your Cloudflare dashboard\u2019s account overview.',\n  vaultSetting: 'CLOUDFLARE_ACCOUNT_ID',\n  env: checked(\n    ACCOUNT,\n    'CLOUDFLARE_ACCOUNT_ID',\n    'A Cloudflare account ID is 32 characters of 0\u20139 and a\u2013f.'\n  ),\n};\n\nexport const KEY_PROVIDERS: readonly KeyProvider[] = [\n  {\n    id: 'azure',\n    make: azureProvider,\n    env: 'AZURE_OPENAI_API_KEY',\n    description: 'OpenAI models deployed in your own Azure OpenAI or AI Foundry resource.',\n    keyUrl: 'https://portal.azure.com',\n    cors: true,\n    fields: [\n      {\n        name: 'endpoint',\n        label: 'Endpoint',\n        required: true,\n        placeholder: 'my-resource or https://my-resource.openai.azure.com',\n        help: 'Your resource\u2019s name, or its endpoint address from Keys and Endpoint.',\n        customBase: true,\n        vaultSetting: 'AZURE_OPENAI_RESOURCE_NAME',\n        env: azureEndpoint,\n      },\n      {\n        name: 'deployments',\n        label: 'Deployments',\n        placeholder: 'gpt-5.4=my-gpt',\n        help: 'Only for deployments named differently from their model, as model=deployment, separated by commas.',\n        env: (value) =>\n          DEPLOYMENTS.test(value)\n            ? { AZURE_OPENAI_DEPLOYMENT_NAME_MAP: value }\n            : 'Write each deployment as model=deployment, separated by commas.',\n      },\n    ],\n  },\n  {\n    id: 'cloudflare-workers-ai',\n    make: cloudflareWorkersAIProvider,\n    env: 'CLOUDFLARE_API_KEY',\n    description: 'Open models on Cloudflare Workers AI, in your Cloudflare account.',\n    keyUrl: 'https://dash.cloudflare.com/profile/api-tokens',\n    cors: false,\n    fields: [ACCOUNT_FIELD],\n  },\n  {\n    id: 'cloudflare-ai-gateway',\n    make: cloudflareAIGatewayProvider,\n    env: 'CLOUDFLARE_API_KEY',\n    description: 'Models from many labs through your Cloudflare AI Gateway.',\n    keyUrl: 'https://dash.cloudflare.com/profile/api-tokens',\n    cors: false,\n    fields: [\n      ACCOUNT_FIELD,\n      {\n        name: 'gateway',\n        label: 'Gateway ID',\n        required: true,\n        placeholder: 'my-gateway',\n        help: 'The name of your gateway under AI \u203A AI Gateway.',\n        vaultSetting: 'CLOUDFLARE_GATEWAY_ID',\n        env: checked(\n          GATEWAY,\n          'CLOUDFLARE_GATEWAY_ID',\n          'A gateway ID is letters, digits, - and _, up to 64 characters.'\n        ),\n      },\n    ],\n  },\n  {\n    id: 'anthropic',\n    make: anthropicProvider,\n    env: 'ANTHROPIC_API_KEY',\n    description: 'Claude models, with an API key from the Claude Console.',\n    keyUrl: 'https://console.anthropic.com/settings/keys',\n    cors: true,\n  },\n  {\n    id: 'openai',\n    make: openaiProvider,\n    env: 'OPENAI_API_KEY',\n    description: 'GPT models, with an API key from the OpenAI platform.',\n    keyUrl: 'https://platform.openai.com/api-keys',\n    cors: true,\n  },\n  {\n    id: 'mistral',\n    make: mistralProvider,\n    env: 'MISTRAL_API_KEY',\n    description: 'Mistral and Devstral models from La Plateforme.',\n    keyUrl: 'https://console.mistral.ai/api-keys',\n    cors: true,\n  },\n  {\n    id: 'groq',\n    make: groqProvider,\n    env: 'GROQ_API_KEY',\n    description: 'Open models on Groq\u2019s fast inference.',\n    keyUrl: 'https://console.groq.com/keys',\n    cors: true,\n  },\n  {\n    id: 'deepseek',\n    make: deepseekProvider,\n    env: 'DEEPSEEK_API_KEY',\n    description: 'DeepSeek\u2019s own models.',\n    keyUrl: 'https://platform.deepseek.com/api_keys',\n    cors: true,\n  },\n  {\n    id: 'together',\n    make: togetherProvider,\n    env: 'TOGETHER_API_KEY',\n    description: 'Open models hosted by Together AI.',\n    keyUrl: 'https://api.together.ai/settings/api-keys',\n    cors: true,\n  },\n  {\n    id: 'huggingface',\n    make: huggingfaceProvider,\n    env: 'HF_TOKEN',\n    description: 'Open models through Hugging Face\u2019s inference router.',\n    keyUrl: 'https://huggingface.co/settings/tokens',\n    cors: true,\n  },\n  {\n    id: 'xiaomi',\n    make: xiaomiProvider,\n    env: 'XIAOMI_API_KEY',\n    description: 'Xiaomi\u2019s MiMo models.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xiaomi-token-plan-ams',\n    make: xiaomiTokenPlanAmsProvider,\n    env: 'XIAOMI_TOKEN_PLAN_AMS_API_KEY',\n    description: 'MiMo models on a Xiaomi token plan, served from Amsterdam.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xiaomi-token-plan-cn',\n    make: xiaomiTokenPlanCnProvider,\n    env: 'XIAOMI_TOKEN_PLAN_CN_API_KEY',\n    description: 'MiMo models on a Xiaomi token plan, served from China.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xiaomi-token-plan-sgp',\n    make: xiaomiTokenPlanSgpProvider,\n    env: 'XIAOMI_TOKEN_PLAN_SGP_API_KEY',\n    description: 'MiMo models on a Xiaomi token plan, served from Singapore.',\n    keyUrl: 'https://platform.xiaomimimo.com/#/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'cerebras',\n    make: cerebrasProvider,\n    env: 'CEREBRAS_API_KEY',\n    description: 'Open models on Cerebras inference.',\n    keyUrl: 'https://cloud.cerebras.ai',\n    cors: false,\n  },\n  {\n    id: 'openrouter',\n    make: openrouterProvider,\n    env: 'OPENROUTER_API_KEY',\n    description: 'Hundreds of models from many labs through one key.',\n    keyUrl: 'https://openrouter.ai/settings/keys',\n    cors: false,\n  },\n  {\n    id: 'fireworks',\n    make: fireworksProvider,\n    env: 'FIREWORKS_API_KEY',\n    description: 'Open models hosted by Fireworks AI.',\n    keyUrl: 'https://app.fireworks.ai/settings/users/api-keys',\n    cors: false,\n  },\n  {\n    id: 'baseten',\n    make: basetenProvider,\n    env: 'BASETEN_API_KEY',\n    description: 'Open models hosted by Baseten.',\n    keyUrl: 'https://app.baseten.co/settings/api_keys',\n    cors: true,\n  },\n  {\n    id: 'moonshotai',\n    make: moonshotaiProvider,\n    env: 'MOONSHOT_API_KEY',\n    description: 'Kimi models from Moonshot AI.',\n    keyUrl: 'https://platform.moonshot.ai/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'moonshotai-cn',\n    make: moonshotaiCnProvider,\n    env: 'MOONSHOT_API_KEY',\n    description: 'Kimi models from Moonshot AI\u2019s China platform.',\n    keyUrl: 'https://platform.moonshot.cn/console/api-keys',\n    cors: true,\n  },\n  {\n    id: 'xai',\n    make: xaiProvider,\n    env: 'XAI_API_KEY',\n    description: 'Grok models from xAI.',\n    keyUrl: 'https://console.x.ai',\n    cors: true,\n    signIn: true,\n  },\n  {\n    id: 'meta',\n    make: metaProvider,\n    env: 'META_API_KEY',\n    description: 'Meta\u2019s Muse models.',\n    keyUrl: 'https://developer.meta.ai',\n    cors: true,\n  },\n  {\n    id: 'vercel-ai-gateway',\n    make: vercelAIGatewayProvider,\n    env: 'AI_GATEWAY_API_KEY',\n    description: 'Models from many labs through Vercel\u2019s AI Gateway.',\n    keyUrl: 'https://vercel.com/docs/ai-gateway/authentication',\n    cors: false,\n  },\n  {\n    id: 'minimax',\n    make: minimaxProvider,\n    env: 'MINIMAX_API_KEY',\n    description: 'MiniMax\u2019s models.',\n    keyUrl: 'https://platform.minimax.io/user-center/basic-information/interface-key',\n    cors: false,\n  },\n  {\n    id: 'minimax-cn',\n    make: minimaxCnProvider,\n    env: 'MINIMAX_CN_API_KEY',\n    description: 'MiniMax\u2019s models from its China platform.',\n    keyUrl: 'https://platform.minimaxi.com/user-center/basic-information/interface-key',\n    cors: false,\n  },\n  {\n    id: 'zai',\n    make: zaiProvider,\n    env: 'ZAI_API_KEY',\n    description: 'GLM models on Z.AI\u2019s coding plan.',\n    keyUrl: 'https://z.ai/manage-apikey/apikey-list',\n    cors: false,\n  },\n  {\n    id: 'zai-coding-cn',\n    make: zaiCodingCnProvider,\n    env: 'ZAI_CODING_CN_API_KEY',\n    description: 'GLM models on Zhipu\u2019s coding plan in China.',\n    keyUrl: 'https://open.bigmodel.cn/usercenter/apikeys',\n    cors: false,\n  },\n  {\n    id: 'nvidia',\n    make: nvidiaProvider,\n    env: 'NVIDIA_API_KEY',\n    description: 'Open models on NVIDIA\u2019s API catalog.',\n    keyUrl: 'https://build.nvidia.com/settings/api-keys',\n    cors: false,\n  },\n  {\n    id: 'kimi-coding',\n    make: kimiCodingProvider,\n    env: 'KIMI_API_KEY',\n    description: 'Kimi models on the Kimi Code subscription.',\n    keyUrl: 'https://www.kimi.com/code/console',\n    cors: false,\n    signIn: true,\n  },\n  {\n    id: 'ant-ling',\n    make: antLingProvider,\n    env: 'ANT_LING_API_KEY',\n    description: 'Ling and Ring models from Ant Group.',\n    keyUrl: 'https://www.ant-ling.com',\n    cors: false,\n  },\n  {\n    id: 'opencode',\n    make: opencodeProvider,\n    env: 'OPENCODE_API_KEY',\n    description:\n      'Models curated for coding agents by OpenCode Zen. Needs seven\u2019s vault 1.12.2 or later.',\n    keyUrl: 'https://opencode.ai/auth',\n    cors: false,\n  },\n  {\n    id: 'opencode-go',\n    make: opencodeGoProvider,\n    env: 'OPENCODE_API_KEY',\n    description:\n      'Open models on the OpenCode Go subscription. Needs seven\u2019s vault 1.12.2 or later.',\n    keyUrl: 'https://opencode.ai/auth',\n    cors: false,\n  },\n  {\n    id: 'qwen-token-plan',\n    make: qwenTokenPlanProvider,\n    env: 'QWEN_TOKEN_PLAN_API_KEY',\n    description: 'Qwen models on an Alibaba Cloud token plan.',\n    keyUrl: 'https://modelstudio.console.alibabacloud.com',\n    cors: false,\n  },\n  {\n    id: 'qwen-token-plan-cn',\n    make: qwenTokenPlanCnProvider,\n    env: 'QWEN_TOKEN_PLAN_CN_API_KEY',\n    description: 'Qwen models on an Alibaba Cloud token plan in China.',\n    keyUrl: 'https://bailian.console.aliyun.com',\n    cors: false,\n  },\n  {\n    id: 'qwen-token-plan-individual',\n    make: qwenTokenPlanIndividualProvider,\n    env: 'QWEN_TOKEN_PLAN_API_KEY',\n    description: 'Qwen models on an individual Alibaba Cloud token plan.',\n    keyUrl: 'https://modelstudio.console.alibabacloud.com',\n    cors: false,\n  },\n];\n\nexport type ProviderAuth = 'api-key' | 'oauth' | 'fields' | 'local';\n\nexport interface Listing {\n  description: string;\n  keyUrl?: string;\n  auth: ProviderAuth;\n  corsFree: boolean;\n  vaultName: string;\n  fields?: readonly FieldSpec[];\n}\n\nconst upper = (text: string) => text.toUpperCase().replace(/[^A-Z0-9]/g, '_');\n\nfunction vaultNames(entries: readonly KeyProvider[]): Map<string, string> {\n  const uses = Map.groupBy(entries, (entry) => entry.env);\n  return new Map(\n    entries.map((entry) => [\n      entry.id,\n      (uses.get(entry.env) as KeyProvider[]).length > 1 ? `${upper(entry.id)}_API_KEY` : entry.env,\n    ])\n  );\n}\n\nconst named = vaultNames(KEY_PROVIDERS);\n\nexport const LISTINGS: ReadonlyMap<string, Listing> = new Map<string, Listing>([\n  [\n    'amazon-bedrock',\n    {\n      description: 'Claude and other models on AWS, with a Bedrock API key.',\n      keyUrl: 'https://console.aws.amazon.com/bedrock/home#/api-keys',\n      auth: 'fields',\n      corsFree: false,\n      vaultName: 'AWS_BEARER_TOKEN_BEDROCK',\n      fields: [REGION_FIELD],\n    },\n  ],\n  [\n    'adobe',\n    {\n      description: 'Models through Adobe\u2019s LLM proxy, with your Adobe ID.',\n      auth: 'oauth',\n      corsFree: false,\n      vaultName: 'ADOBE_IMS_TOKEN',\n    },\n  ],\n  ...KEY_PROVIDERS.map((entry): [string, Listing] => [\n    entry.id,\n    {\n      description: entry.description,\n      keyUrl: entry.keyUrl,\n      auth: entry.signIn ? 'oauth' : entry.fields ? 'fields' : 'api-key',\n      corsFree: !entry.cors,\n      vaultName: named.get(entry.id) as string,\n      ...(entry.fields ? { fields: entry.fields } : {}),\n    },\n  ]),\n  [\n    CODEX,\n    {\n      description: 'GPT models on your ChatGPT Plus or Pro plan, with your ChatGPT account.',\n      auth: 'oauth',\n      corsFree: true,\n      vaultName: 'OPENAI_CODEX_TOKEN',\n    },\n  ],\n]);\n\nexport const ADDED_FIRST: readonly string[] = ['amazon-bedrock', 'adobe'];\n"],
   "mappings": "AACA,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,mCAAmC;AAC5C,SAAS,mCAAmC;AAC5C,SAAS,wBAAwB;AACjC,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,+BAA+B;AACxC,SAAS,uCAAuC;AAChD,SAAS,wBAAwB;AACjC,SAAS,+BAA+B;AACxC,SAAS,mBAAmB;AAC5B,SAAS,sBAAsB;AAC/B,SAAS,kCAAkC;AAC3C,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,aAAa;AAkCtB,MAAM,WAAW;AACjB,MAAM,cAAc;AAEb,SAAS,UAAU,OAAgC;AACxD,QAAM,MAAM,IAAI,MAAM,KAAK;AAC3B,MAAI,KAAK,aAAa,YAAY,IAAI,YAAY,IAAI,SAAU,QAAO;AACvE,SAAO,IAAI,SAAS,MAAM,IAAI,SAAS,QAAQ,MAAM;AACvD;AAEA,SAAS,cAAc,OAAgD;AACrE,MAAI,SAAS,KAAK,KAAK,EAAG,QAAO,EAAE,4BAA4B,MAAM;AACrE,QAAM,MAAM,UAAU,KAAK;AAC3B,MAAI,CAAC;AACH,WAAO;AACT,SAAO,EAAE,uBAAuB,IAAI,KAAK,QAAQ,QAAQ,EAAE,EAAE;AAC/D;AAEO,MAAM,QAAQ;AAEd,SAAS,UAAU,KAA2D;AACnF,MAAI,IAAI,sBAAuB,QAAO,IAAI;AAC1C,QAAM,OAAO,IAAI;AACjB,SAAO,OAAO,WAAW,IAAI,gCAAgC;AAC/D;AAEA,MAAM,SAAS;AACf,MAAM,UAAU;AAChB,MAAM,UAAU;AAEhB,MAAM,UACJ,CAAC,SAAiB,KAAa,YAC/B,CAAC,UACC,QAAQ,KAAK,KAAK,IAAI,EAAE,CAAC,GAAG,GAAG,MAAM,IAAI;AAE7C,MAAM,kBAA0D;AAAA,EAC9D,CAAC,kBAAkB,sBAAsB;AAAA,EACzC,CAAC,kBAAkB,sBAAsB;AAAA,EACzC,CAAC,kBAAkB,sBAAsB;AAAA,EACzC,CAAC,cAAc,uBAAuB;AAAA,EACtC,CAAC,cAAc,0BAA0B;AAAA,EACzC,CAAC,kBAAkB,0BAA0B;AAAA,EAC7C,CAAC,kBAAkB,uBAAuB;AAAA,EAC1C,CAAC,gBAAgB,kBAAkB;AAAA,EACnC,CAAC,gBAAgB,oBAAoB;AAAA,EACrC,CAAC,gBAAgB,iBAAiB;AAAA,EAClC,CAAC,cAAc,oBAAoB;AAAA,EACnC,CAAC,cAAc,gBAAgB;AAAA,EAC/B,CAAC,cAAc,gBAAgB;AAAA,EAC/B,CAAC,aAAa,kBAAkB;AAAA,EAChC,CAAC,aAAa,iBAAiB;AAAA,EAC/B,CAAC,aAAa,gBAAgB;AAAA,EAC9B,CAAC,aAAa,8BAA2B;AAAA,EACzC,CAAC,aAAa,uBAAuB;AAAA,EACrC,CAAC,iBAAiB,wBAAwB;AAAA,EAC1C,CAAC,iBAAiB,wBAAwB;AAAA,EAC1C,CAAC,aAAa,kBAAkB;AAClC;AAEO,MAAM,iBAAiB;AAEvB,MAAM,eAA0B;AAAA,EACrC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,MAAM;AAAA,EACN,SAAS,gBAAgB,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,OAAO,OAAO,GAAG,KAAK,KAAK,KAAK,GAAG,EAAE;AAAA,EACzF,OAAO;AAAA,EACP,KAAK,QAAQ,QAAQ,cAAc,wCAAwC;AAC7E;AAEA,MAAM,gBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,MAAM;AAAA,EACN,cAAc;AAAA,EACd,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,MAAM,gBAAwC;AAAA,EACnD;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,MACN;AAAA,QACE,MAAM;AAAA,QACN,OAAO;AAAA,QACP,UAAU;AAAA,QACV,aAAa;AAAA,QACb,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,KAAK;AAAA,MACP;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,OAAO;AAAA,QACP,aAAa;AAAA,QACb,MAAM;AAAA,QACN,KAAK,CAAC,UACJ,YAAY,KAAK,KAAK,IAClB,EAAE,kCAAkC,MAAM,IAC1C;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ,CAAC,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,OAAO;AAAA,QACP,UAAU;AAAA,QACV,aAAa;AAAA,QACb,MAAM;AAAA,QACN,cAAc;AAAA,QACd,KAAK;AAAA,UACH;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aACE;AAAA,IACF,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aACE;AAAA,IACF,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,KAAK;AAAA,IACL,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,MAAM;AAAA,EACR;AACF;AAaA,MAAM,QAAQ,CAAC,SAAiB,KAAK,YAAY,EAAE,QAAQ,cAAc,GAAG;AAE5E,SAAS,WAAW,SAAsD;AACxE,QAAM,OAAO,IAAI,QAAQ,SAAS,CAAC,UAAU,MAAM,GAAG;AACtD,SAAO,IAAI;AAAA,IACT,QAAQ,IAAI,CAAC,UAAU;AAAA,MACrB,MAAM;AAAA,MACL,KAAK,IAAI,MAAM,GAAG,EAAoB,SAAS,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,aAAa,MAAM;AAAA,IAC3F,CAAC;AAAA,EACH;AACF;AAEA,MAAM,QAAQ,WAAW,aAAa;AAE/B,MAAM,WAAyC,IAAI,IAAqB;AAAA,EAC7E;AAAA,IACE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,MACX,QAAQ,CAAC,YAAY;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AAAA,EACA,GAAG,cAAc,IAAI,CAAC,UAA6B;AAAA,IACjD,MAAM;AAAA,IACN;AAAA,MACE,aAAa,MAAM;AAAA,MACnB,QAAQ,MAAM;AAAA,MACd,MAAM,MAAM,SAAS,UAAU,MAAM,SAAS,WAAW;AAAA,MACzD,UAAU,CAAC,MAAM;AAAA,MACjB,WAAW,MAAM,IAAI,MAAM,EAAE;AAAA,MAC7B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IACjD;AAAA,EACF,CAAC;AAAA,EACD;AAAA,IACE;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,MAAM;AAAA,MACN,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACF,CAAC;AAEM,MAAM,cAAiC,CAAC,kBAAkB,OAAO;",
   "names": []
 }

package/dist/services.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/services.ts"],
-  "sourcesContent": ["import type { Context, JsonValue, RemoteContract, ReplicatedState } from '@earendil-works/chord';\nimport type { BlockedReason, ConversationView } from '@earendil-works/pi-durable';\nimport type { Approval, ApprovalAnswer, ApprovalDecided } from './approvals/index.ts';\nimport type {\n  ApprovalPolicy,\n  ApprovalPolicyChange,\n  ApprovalPolicySet,\n} from './approvals/policy.ts';\nimport type { AgentSudo } from './approvals/sudo.ts';\nimport type { SendAttachment, ShownAttachment } from './attachments.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { ImportProgress, ImportResult } from './freezer/v6.ts';\nimport type { GuestOpened, Proposed, ProposeRequest } from './guests/index.ts';\nimport type { GuestDraft, GuestGates, GuestSeat } from './guests/seats.ts';\nimport type { MemoryEntry, MemoryScope, MemoryTag } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport { contract } from './serving.ts';\nimport type { DeviceSignIn } from './sign-ins.ts';\nimport type { SkillPackage, SkillSource } from './skills/skills.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\n\nexport type SendMode = 'steer' | 'followUp' | 'reject';\n\nexport interface SendRequest {\n  text: string;\n  whenBusy: SendMode;\n  requestId: string | null;\n  agentId?: string | null;\n  attachments?: SendAttachment[];\n}\n\nexport interface OperationError {\n  code: string;\n  message: string;\n}\n\nexport type SendResponse =\n  | { accepted: true; submissionId: string; error: null }\n  | { accepted: false; submissionId: null; error: OperationError };\n\nexport type PromptResult =\n  | { status: 'done'; text: string; reason: null }\n  | { status: 'unanswered'; text: null; reason: string };\n\nexport interface AgentControl {\n  send(request: SendRequest, context: Context): Promise<SendResponse>;\n  wait(submissionId: string, context: Context): Promise<PromptResult>;\n  withdraw(\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  abort(context: Context): Promise<void>;\n  compact(instructions: string | null, context: Context): Promise<SendResponse>;\n  compactAgent(\n    agentId: string,\n    instructions: string | null,\n    context: Context\n  ): Promise<SendResponse>;\n  reset(handoff: string | null, context: Context): Promise<void>;\n  configure(change: AgentSettingsChange, context: Context): Promise<void>;\n  rewind(messageId: string | null, context: Context): Promise<Rewound>;\n  rewindAgent(agentId: string, messageId: string | null, context: Context): Promise<Rewound>;\n  resolveLick(\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  resolveAgentLick(\n    agentId: string,\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  webhook(\n    name: string,\n    delivery: WebhookRequest,\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  stopAgent(agentId: string, context: Context): Promise<void>;\n  selectCone(agentId: string, context: Context): Promise<void>;\n  createCone(name: string, context: Context): Promise<Created>;\n  createScoop(parentId: string, name: string, context: Context): Promise<Created>;\n  drop(agentId: string, context: Context): Promise<Created>;\n  unqueue(\n    agentId: string | null,\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  sprinkleSend(\n    sprinkleId: string,\n    payload: { action: string; data: JsonValue | null; target: string | null },\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  sprinkleCall(\n    sprinkleId: string,\n    method: string,\n    args: JsonValue[],\n    context: Context\n  ): Promise<JsonValue>;\n  memorySave(draft: MemoryDraft, context: Context): Promise<MemoryEntry>;\n  memoryRemove(id: string, context: Context): Promise<{ removed: boolean }>;\n  freeze(agentId: string, context: Context): Promise<Created>;\n  newChat(agentId: string, context: Context): Promise<Created>;\n  thaw(frozenId: string, context: Context): Promise<Created>;\n  discard(frozenId: string, context: Context): Promise<Created>;\n  importProfile(request: ImportRequest, context: Context): Promise<ImportResult>;\n  importCancel(context: Context): Promise<void>;\n  changesOpen(context: Context): Promise<void>;\n  changeAccept(path: string, context: Context): Promise<Created>;\n  changeRevert(path: string, context: Context): Promise<Created>;\n  monitorOpen(lease: string | null, resync: boolean, context: Context): Promise<MonitorLease>;\n  monitorClose(lease: string, context: Context): Promise<void>;\n  image(ref: ImageRef, context: Context): Promise<StoredImage>;\n  agentCommands(agentId: string, context: Context): Promise<Command[]>;\n  toolLabel(agentId: string, callIds: string[], context: Context): Promise<string | null>;\n  guestOpen(draft: GuestDraft, context: Context): Promise<GuestOpened>;\n  guestRevoke(id: string, context: Context): Promise<{ revoked: boolean }>;\n  guestAlwaysForget(\n    seat: string,\n    approval: string,\n    context: Context\n  ): Promise<{ removed: boolean }>;\n  approvalPolicySet(change: ApprovalPolicyChange, context: Context): Promise<ApprovalPolicySet>;\n  decide(\n    id: string,\n    decision: ApprovalAnswer,\n    reason: string | null,\n    context: Context\n  ): Promise<ApprovalDecided>;\n}\n\nexport interface ImportRequest {\n  upload: string | null;\n  data: string | null;\n  inPlace?: string | null;\n  again: boolean;\n  preview: boolean;\n}\n\nexport interface ImageRef {\n  entry: number;\n  message: number;\n  part: number;\n}\n\nexport type StoredImage = { data: string; mimeType: string } | { data: null; mimeType: null };\n\nexport interface MonitorLease {\n  lease: string;\n  ttlMs: number;\n}\n\nexport interface MonitorAgent {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  model: string | null;\n  running: boolean;\n  queued: number;\n  tool: string | null;\n  retry: { attempt: number; since: number; error: string } | null;\n  failed: string | null;\n  context: number | null;\n  cpu?: number | null;\n}\n\nexport interface MonitorTask {\n  id: string;\n  kind: string;\n  detail: string | null;\n  agentId: string | null;\n  owner: string | null;\n  status: 'pending' | 'running' | 'waiting' | 'sleeping' | 'completing';\n  phase: string;\n  background: boolean;\n  aborting: number | null;\n  since: number;\n  waits: number;\n  until: number | null;\n  blocked: BlockedReason | null;\n}\n\nexport interface MonitorProcess {\n  pid: number;\n  ppid: number;\n  pgid: number;\n  user: string | null;\n  agentId: string | null;\n  command: string;\n  state: 'S' | 'Z';\n  started: number;\n  zombie: number | null;\n  tty: boolean;\n  rss: number | null;\n  utime?: number;\n  stime?: number;\n  cpu?: number | null;\n}\n\nexport interface MonitorProblem {\n  id: string;\n  at: number;\n  agentId: string | null;\n  kind: 'task' | 'retry' | 'turn';\n  message: string;\n}\n\nexport interface MonitorFeed {\n  open: boolean;\n  at: number;\n  usage: { tokens: number; cost: number; free: boolean } | null;\n  agents: MonitorAgent[];\n  tasks: MonitorTask[];\n  processes: MonitorProcess[] | null;\n  kernel: 'checking' | 'ok' | 'unreachable';\n  problems: MonitorProblem[];\n  paused: boolean;\n}\n\nexport interface MemoryDraft {\n  id: string | null;\n  scope: string;\n  section: string;\n  title: string;\n  body: string;\n  tag: MemoryTag | null;\n}\n\nexport type Created = { id: string; error: null } | { id: null; error: string };\n\nexport interface AgentSummary {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  role: string | null;\n}\n\nexport interface AgentsSummary {\n  active: string;\n  agents: AgentSummary[];\n}\n\nexport type LickResolved =\n  | { done: true; text: string; error: null }\n  | { done: false; text: null; error: string };\n\nexport interface WebhookRequest {\n  id: string | null;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport type Rewound =\n  | { done: true; text: string; reason: null; attachments?: ShownAttachment[] }\n  | { done: false; text: null; reason: 'busy' | 'no-turn' };\n\nexport interface AgentSettingsChange {\n  model: { provider: string; modelId: string } | null;\n  thinkingLevel: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | null;\n  agentId?: string | null;\n}\n\nconst keys = <T>(record: Record<keyof T, true>) => Object.keys(record) as (keyof T & string)[];\n\nexport const CONTROL_METHODS = keys<AgentControl>({\n  send: true,\n  wait: true,\n  withdraw: true,\n  abort: true,\n  compact: true,\n  compactAgent: true,\n  reset: true,\n  configure: true,\n  rewind: true,\n  rewindAgent: true,\n  resolveLick: true,\n  resolveAgentLick: true,\n  webhook: true,\n  stopAgent: true,\n  selectCone: true,\n  createCone: true,\n  createScoop: true,\n  drop: true,\n  unqueue: true,\n  sprinkleSend: true,\n  sprinkleCall: true,\n  memorySave: true,\n  memoryRemove: true,\n  freeze: true,\n  newChat: true,\n  thaw: true,\n  discard: true,\n  importProfile: true,\n  importCancel: true,\n  changesOpen: true,\n  changeAccept: true,\n  changeRevert: true,\n  monitorOpen: true,\n  monitorClose: true,\n  image: true,\n  agentCommands: true,\n  toolLabel: true,\n  guestOpen: true,\n  guestRevoke: true,\n  guestAlwaysForget: true,\n  approvalPolicySet: true,\n  decide: true,\n});\n\nexport const OWNER_DEVICE_METHODS: readonly (keyof AgentControl & string)[] = [\n  'decide',\n  'guestOpen',\n  'guestRevoke',\n  'guestAlwaysForget',\n  'approvalPolicySet',\n];\n\nexport const CONTROL_READS: readonly (keyof AgentControl & string)[] = [\n  'wait',\n  'changesOpen',\n  'monitorOpen',\n  'monitorClose',\n  'image',\n  'toolLabel',\n];\n\nexport const AgentControl: RemoteContract = contract('slicc.agent.control', {\n  control: { methods: CONTROL_METHODS },\n  view: { methods: [...CONTROL_READS, ...OWNER_DEVICE_METHODS] },\n});\n\nexport type Delivered = 'run' | 'steer' | 'follow-up';\n\nexport interface AgentTranscript {\n  readonly state: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents: ReplicatedState<AgentsSummary>;\n  readonly views: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands: ReplicatedState<Command[]>;\n  readonly privateRevision: ReplicatedState<PrivateRevision>;\n  readonly sprinkles: ReplicatedState<Sprinkle[]>;\n  readonly memories: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes: ReplicatedState<MemoryScope[]>;\n  readonly frozen: ReplicatedState<FrozenCone[]>;\n  readonly importing: ReplicatedState<ImportProgress>;\n  readonly changes: ReplicatedState<ChangesView>;\n  readonly monitor: ReplicatedState<MonitorFeed>;\n  readonly vault: ReplicatedState<VaultState>;\n  readonly labels: ReplicatedState<Record<string, string>>;\n  readonly guests: ReplicatedState<GuestSeat[]>;\n  readonly approvals: ReplicatedState<Approval[]>;\n  readonly approvalPolicy: ReplicatedState<ApprovalPolicy>;\n}\n\nexport interface PrivateRevision {\n  revision: number;\n}\n\nexport interface Command {\n  name: string;\n  description: string;\n  kind: 'prompt' | 'skill' | 'action';\n  source?: SkillSource;\n  package?: SkillPackage;\n}\n\nexport const TRANSCRIPT_STATES = keys<AgentTranscript>({\n  state: true,\n  deliveries: true,\n  agents: true,\n  views: true,\n  commands: true,\n  privateRevision: true,\n  sprinkles: true,\n  memories: true,\n  memoryScopes: true,\n  frozen: true,\n  importing: true,\n  changes: true,\n  monitor: true,\n  vault: true,\n  labels: true,\n  guests: true,\n  approvals: true,\n  approvalPolicy: true,\n});\n\nexport const AgentTranscript: RemoteContract = contract('slicc.agent.transcript', {\n  transcript: { state: TRANSCRIPT_STATES },\n});\n\nexport const REMOTE_METHODS = keys<AgentRemote>({\n  prompt: true,\n  watch: true,\n  next: true,\n  close: true,\n  abort: true,\n});\n\nexport const REMOTE_READS: readonly (keyof AgentRemote & string)[] = ['watch', 'next', 'close'];\n\nexport interface GuestShown {\n  id: string;\n  label: string;\n  agentId: string;\n  name: string;\n  expiresAt: number | null;\n  gates: GuestGates;\n}\n\nexport interface GuestProposal {\n  id: string;\n  text: string;\n  state: 'queued' | 'pending' | 'approved' | 'rejected' | 'unanswered' | 'withdrawn';\n  reason: string | null;\n  createdAt: number;\n  decidedAt: number | null;\n}\n\nexport interface AgentGuest {\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly seat: ReplicatedState<GuestShown>;\n  readonly proposals: ReplicatedState<GuestProposal[]>;\n  propose(request: ProposeRequest, context: Context): Promise<Proposed>;\n  guestOpen(draft: GuestDraft, context: Context): Promise<GuestOpened>;\n  guestRevoke(id: string, context: Context): Promise<{ revoked: boolean }>;\n}\n\nexport const GUEST_STATES = ['transcript', 'seat', 'proposals'] as const;\n\nexport const GUEST_METHODS = ['propose', 'guestOpen', 'guestRevoke'] as const;\n\nexport const AgentGuestService: RemoteContract = contract('slicc.agent.guest', {\n  guest: { state: GUEST_STATES, methods: GUEST_METHODS },\n  none: {},\n});\n\nexport const AgentRemoteService: RemoteContract = contract('slicc.agent.remote', {\n  remote: { methods: REMOTE_METHODS },\n  watch: { methods: REMOTE_READS },\n});\n\nexport const PAGE_METHODS = keys<AgentPages>({\n  open: true,\n  report: true,\n  next: true,\n  answer: true,\n  close: true,\n});\n\nexport const AgentPagesService: RemoteContract = contract('slicc.agent.pages', {\n  pages: { methods: PAGE_METHODS },\n  none: {},\n});\n\nexport const SUDO_METHODS = keys<Omit<AgentSudo, 'approvals'>>({\n  request: true,\n  withdraw: true,\n});\n\nexport const AgentSudoService: RemoteContract = contract('slicc.agent.sudo', {\n  sudo: { state: ['approvals'], methods: SUDO_METHODS },\n  none: {},\n});\n\nexport interface ModelChoice {\n  id: string;\n  label: string;\n  provider: string;\n  kind: 'chat' | 'classifier';\n  reasoning: boolean;\n  images?: boolean;\n  contextWindow: number;\n}\n\nexport interface AccountState {\n  id: string;\n  provider: string;\n  identity: string;\n  status: 'connected' | 'disconnected' | 'expired';\n  auth: 'api-key' | 'oauth';\n  needs: 'cors-free-transport' | null;\n  blocked?: 'cors-free-transport';\n  group?: 'providers' | 'mcp';\n  secret?: 'api-key' | 'token';\n  store?: 'vault';\n  fields?: AccountField[];\n  description?: string;\n  keyUrl?: string;\n  vaultName?: string;\n}\n\nexport interface AccountField {\n  name: string;\n  label: string;\n  required?: boolean;\n  placeholder?: string;\n  help?: string;\n  customBase?: true;\n  vaultSetting?: string;\n  options?: readonly { value: string; label: string }[];\n  value?: string;\n}\n\nexport interface ProviderOption {\n  id: string;\n  name: string;\n  description?: string;\n  auth: 'api-key' | 'oauth' | 'fields' | 'local';\n  fields?: AccountField[];\n  keyUrl?: string;\n  needs?: 'cors-free-transport';\n  blocked?: 'cors-free-transport';\n  vaultName?: string;\n}\n\nexport interface BudgetState {\n  provider: string;\n  percent: number;\n  window: 'weekly';\n  resets: string;\n}\n\nexport interface SignIn {\n  clientId: string;\n  scopes: string;\n  imsEnvironment: string;\n}\n\nexport interface McpSignIn {\n  url: string;\n  state: string;\n}\n\nexport interface SettingsState {\n  models: ModelChoice[];\n  accounts: AccountState[];\n  providers?: ProviderOption[];\n  budget?: BudgetState | null;\n  moved?: { kind: 'model' | 'mcp'; label: string }[];\n  labels?: Record<string, string>;\n}\n\nexport interface AgentSettings {\n  readonly state: ReplicatedState<SettingsState>;\n  connect(\n    providerId: string,\n    secret: string | null,\n    fields: Record<string, string> | null,\n    context: Context\n  ): Promise<void>;\n  disconnect(providerId: string, context: Context): Promise<void>;\n  remove(providerId: string, context: Context): Promise<void>;\n  serverUrl(providerId: string, context: Context): Promise<string | null>;\n  signIn(providerId: string, context: Context): Promise<SignIn | McpSignIn | DeviceSignIn | null>;\n  dismissMoved(context: Context): Promise<void>;\n}\n\nexport const SETTINGS_METHODS = keys<Omit<AgentSettings, 'state'>>({\n  connect: true,\n  disconnect: true,\n  remove: true,\n  serverUrl: true,\n  signIn: true,\n  dismissMoved: true,\n});\n\nexport const AgentSettings: RemoteContract = contract('slicc.agent.settings', {\n  settings: { state: ['state'], methods: SETTINGS_METHODS },\n  view: { state: ['state'] },\n});\n"],
-  "mappings": "AAmBA,SAAS,gBAAgB;AAwPzB,MAAM,OAAO,CAAI,WAAkC,OAAO,KAAK,MAAM;AAE9D,MAAM,kBAAkB,KAAmB;AAAA,EAChD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,cAAc;AAAA,EACd,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,SAAS;AAAA,EACT,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,MAAM;AAAA,EACN,SAAS;AAAA,EACT,cAAc;AAAA,EACd,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,MAAM;AAAA,EACN,SAAS;AAAA,EACT,eAAe;AAAA,EACf,cAAc;AAAA,EACd,aAAa;AAAA,EACb,cAAc;AAAA,EACd,cAAc;AAAA,EACd,aAAa;AAAA,EACb,cAAc;AAAA,EACd,OAAO;AAAA,EACP,eAAe;AAAA,EACf,WAAW;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,QAAQ;AACV,CAAC;AAEM,MAAM,uBAAiE;AAAA,EAC5E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,gBAA0D;AAAA,EACrE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,eAA+B,SAAS,uBAAuB;AAAA,EAC1E,SAAS,EAAE,SAAS,gBAAgB;AAAA,EACpC,MAAM,EAAE,SAAS,CAAC,GAAG,eAAe,GAAG,oBAAoB,EAAE;AAC/D,CAAC;AAqCM,MAAM,oBAAoB,KAAsB;AAAA,EACrD,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,gBAAgB;AAClB,CAAC;AAEM,MAAM,kBAAkC,SAAS,0BAA0B;AAAA,EAChF,YAAY,EAAE,OAAO,kBAAkB;AACzC,CAAC;AAEM,MAAM,iBAAiB,KAAkB;AAAA,EAC9C,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO;AACT,CAAC;AAEM,MAAM,eAAwD,CAAC,SAAS,QAAQ,OAAO;AA6BvF,MAAM,eAAe,CAAC,cAAc,QAAQ,WAAW;AAEvD,MAAM,gBAAgB,CAAC,WAAW,aAAa,aAAa;AAE5D,MAAM,oBAAoC,SAAS,qBAAqB;AAAA,EAC7E,OAAO,EAAE,OAAO,cAAc,SAAS,cAAc;AAAA,EACrD,MAAM,CAAC;AACT,CAAC;AAEM,MAAM,qBAAqC,SAAS,sBAAsB;AAAA,EAC/E,QAAQ,EAAE,SAAS,eAAe;AAAA,EAClC,OAAO,EAAE,SAAS,aAAa;AACjC,CAAC;AAEM,MAAM,eAAe,KAAiB;AAAA,EAC3C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT,CAAC;AAEM,MAAM,oBAAoC,SAAS,qBAAqB;AAAA,EAC7E,OAAO,EAAE,SAAS,aAAa;AAAA,EAC/B,MAAM,CAAC;AACT,CAAC;AAEM,MAAM,eAAe,KAAmC;AAAA,EAC7D,SAAS;AAAA,EACT,UAAU;AACZ,CAAC;AAEM,MAAM,mBAAmC,SAAS,oBAAoB;AAAA,EAC3E,MAAM,EAAE,OAAO,CAAC,WAAW,GAAG,SAAS,aAAa;AAAA,EACpD,MAAM,CAAC;AACT,CAAC;AA+FM,MAAM,mBAAmB,KAAmC;AAAA,EACjE,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,cAAc;AAChB,CAAC;AAEM,MAAM,gBAAgC,SAAS,wBAAwB;AAAA,EAC5E,UAAU,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,iBAAiB;AAAA,EACxD,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE;AAC3B,CAAC;",
+  "sourcesContent": ["import type { Context, JsonValue, RemoteContract, ReplicatedState } from '@earendil-works/chord';\nimport type { BlockedReason, ConversationView } from '@earendil-works/pi-durable';\nimport type { Approval, ApprovalAnswer, ApprovalDecided } from './approvals/index.ts';\nimport type {\n  ApprovalPolicy,\n  ApprovalPolicyChange,\n  ApprovalPolicySet,\n} from './approvals/policy.ts';\nimport type { AgentSudo } from './approvals/sudo.ts';\nimport type { SendAttachment, ShownAttachment } from './attachments.ts';\nimport type { ChangesView } from './changes/git.ts';\nimport type { FrozenCone } from './freezer/index.ts';\nimport type { ImportProgress, ImportResult } from './freezer/v6.ts';\nimport type { GuestOpened, Proposed, ProposeRequest } from './guests/index.ts';\nimport type { GuestDraft, GuestGates, GuestSeat } from './guests/seats.ts';\nimport type { MemoryEntry, MemoryScope, MemoryTag } from './memory/format.ts';\nimport type { AgentRemote } from './remote/host.ts';\nimport type { AgentPages } from './remote/pages.ts';\nimport type { VaultState } from './secrets/vault.ts';\nimport { contract } from './serving.ts';\nimport type { DeviceSignIn } from './sign-ins.ts';\nimport type { SkillPackage, SkillSource } from './skills/skills.ts';\nimport type { Sprinkle } from './sprinkles/kind.ts';\n\nexport type SendMode = 'steer' | 'followUp' | 'reject';\n\nexport interface SendRequest {\n  text: string;\n  whenBusy: SendMode;\n  requestId: string | null;\n  agentId?: string | null;\n  attachments?: SendAttachment[];\n}\n\nexport interface OperationError {\n  code: string;\n  message: string;\n}\n\nexport type SendResponse =\n  | { accepted: true; submissionId: string; error: null }\n  | { accepted: false; submissionId: null; error: OperationError };\n\nexport type PromptResult =\n  | { status: 'done'; text: string; reason: null }\n  | { status: 'unanswered'; text: null; reason: string };\n\nexport interface AgentControl {\n  send(request: SendRequest, context: Context): Promise<SendResponse>;\n  wait(submissionId: string, context: Context): Promise<PromptResult>;\n  withdraw(\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  abort(context: Context): Promise<void>;\n  compact(instructions: string | null, context: Context): Promise<SendResponse>;\n  compactAgent(\n    agentId: string,\n    instructions: string | null,\n    context: Context\n  ): Promise<SendResponse>;\n  reset(handoff: string | null, context: Context): Promise<void>;\n  configure(change: AgentSettingsChange, context: Context): Promise<void>;\n  rewind(messageId: string | null, context: Context): Promise<Rewound>;\n  rewindAgent(agentId: string, messageId: string | null, context: Context): Promise<Rewound>;\n  resolveLick(\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  resolveAgentLick(\n    agentId: string,\n    lickId: string,\n    state: 'confirmed' | 'dismissed',\n    context: Context\n  ): Promise<LickResolved>;\n  webhook(\n    name: string,\n    delivery: WebhookRequest,\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  stopAgent(agentId: string, context: Context): Promise<void>;\n  selectCone(agentId: string, context: Context): Promise<void>;\n  createCone(name: string, context: Context): Promise<Created>;\n  createScoop(parentId: string, name: string, context: Context): Promise<Created>;\n  drop(agentId: string, context: Context): Promise<Created>;\n  unqueue(\n    agentId: string | null,\n    submissionId: string,\n    context: Context\n  ): Promise<{ outcome: 'withdrawn' | 'already_placed' | 'not_found' }>;\n  sprinkleSend(\n    sprinkleId: string,\n    payload: { action: string; data: JsonValue | null; target: string | null },\n    context: Context\n  ): Promise<{ delivered: boolean }>;\n  sprinkleCall(\n    sprinkleId: string,\n    method: string,\n    args: JsonValue[],\n    context: Context\n  ): Promise<JsonValue>;\n  memorySave(draft: MemoryDraft, context: Context): Promise<MemoryEntry>;\n  memoryRemove(id: string, context: Context): Promise<{ removed: boolean }>;\n  freeze(agentId: string, context: Context): Promise<Created>;\n  newChat(agentId: string, context: Context): Promise<Created>;\n  thaw(frozenId: string, context: Context): Promise<Created>;\n  discard(frozenId: string, context: Context): Promise<Created>;\n  importProfile(request: ImportRequest, context: Context): Promise<ImportResult>;\n  importCancel(context: Context): Promise<void>;\n  changesOpen(context: Context): Promise<void>;\n  changeAccept(path: string, context: Context): Promise<Created>;\n  changeRevert(path: string, context: Context): Promise<Created>;\n  monitorOpen(lease: string | null, resync: boolean, context: Context): Promise<MonitorLease>;\n  monitorClose(lease: string, context: Context): Promise<void>;\n  image(ref: ImageRef, context: Context): Promise<StoredImage>;\n  agentCommands(agentId: string, context: Context): Promise<Command[]>;\n  toolLabel(agentId: string, callIds: string[], context: Context): Promise<string | null>;\n  guestOpen(draft: GuestDraft, context: Context): Promise<GuestOpened>;\n  guestRevoke(id: string, context: Context): Promise<{ revoked: boolean }>;\n  guestAlwaysForget(\n    seat: string,\n    approval: string,\n    context: Context\n  ): Promise<{ removed: boolean }>;\n  approvalPolicySet(change: ApprovalPolicyChange, context: Context): Promise<ApprovalPolicySet>;\n  decide(\n    id: string,\n    decision: ApprovalAnswer,\n    reason: string | null,\n    context: Context\n  ): Promise<ApprovalDecided>;\n}\n\nexport interface ImportRequest {\n  upload: string | null;\n  data: string | null;\n  inPlace?: string | null;\n  again: boolean;\n  preview: boolean;\n}\n\nexport interface ImageRef {\n  entry: number;\n  message: number;\n  part: number;\n}\n\nexport type StoredImage = { data: string; mimeType: string } | { data: null; mimeType: null };\n\nexport interface MonitorLease {\n  lease: string;\n  ttlMs: number;\n}\n\nexport interface MonitorAgent {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  model: string | null;\n  running: boolean;\n  queued: number;\n  tool: string | null;\n  retry: { attempt: number; since: number; error: string } | null;\n  failed: string | null;\n  context: number | null;\n  cpu?: number | null;\n}\n\nexport interface MonitorTask {\n  id: string;\n  kind: string;\n  detail: string | null;\n  agentId: string | null;\n  owner: string | null;\n  status: 'pending' | 'running' | 'waiting' | 'sleeping' | 'completing';\n  phase: string;\n  background: boolean;\n  aborting: number | null;\n  since: number;\n  waits: number;\n  until: number | null;\n  blocked: BlockedReason | null;\n}\n\nexport interface MonitorProcess {\n  pid: number;\n  ppid: number;\n  pgid: number;\n  user: string | null;\n  agentId: string | null;\n  command: string;\n  state: 'S' | 'Z';\n  started: number;\n  zombie: number | null;\n  tty: boolean;\n  rss: number | null;\n  utime?: number;\n  stime?: number;\n  cpu?: number | null;\n}\n\nexport interface MonitorProblem {\n  id: string;\n  at: number;\n  agentId: string | null;\n  kind: 'task' | 'retry' | 'turn';\n  message: string;\n}\n\nexport interface MonitorFeed {\n  open: boolean;\n  at: number;\n  usage: { tokens: number; cost: number; free: boolean } | null;\n  agents: MonitorAgent[];\n  tasks: MonitorTask[];\n  processes: MonitorProcess[] | null;\n  kernel: 'checking' | 'ok' | 'unreachable';\n  problems: MonitorProblem[];\n  paused: boolean;\n}\n\nexport interface MemoryDraft {\n  id: string | null;\n  scope: string;\n  section: string;\n  title: string;\n  body: string;\n  tag: MemoryTag | null;\n}\n\nexport type Created = { id: string; error: null } | { id: null; error: string };\n\nexport interface AgentSummary {\n  id: string;\n  name: string;\n  kind: 'cone' | 'scoop';\n  parentId: string | null;\n  role: string | null;\n}\n\nexport interface AgentsSummary {\n  active: string;\n  agents: AgentSummary[];\n}\n\nexport type LickResolved =\n  | { done: true; text: string; error: null }\n  | { done: false; text: null; error: string };\n\nexport interface WebhookRequest {\n  id: string | null;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport type Rewound =\n  | { done: true; text: string; reason: null; attachments?: ShownAttachment[] }\n  | { done: false; text: null; reason: 'busy' | 'no-turn' };\n\nexport interface AgentSettingsChange {\n  model: { provider: string; modelId: string } | null;\n  thinkingLevel: 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max' | null;\n  agentId?: string | null;\n}\n\nconst keys = <T>(record: Record<keyof T, true>) => Object.keys(record) as (keyof T & string)[];\n\nexport const CONTROL_METHODS = keys<AgentControl>({\n  send: true,\n  wait: true,\n  withdraw: true,\n  abort: true,\n  compact: true,\n  compactAgent: true,\n  reset: true,\n  configure: true,\n  rewind: true,\n  rewindAgent: true,\n  resolveLick: true,\n  resolveAgentLick: true,\n  webhook: true,\n  stopAgent: true,\n  selectCone: true,\n  createCone: true,\n  createScoop: true,\n  drop: true,\n  unqueue: true,\n  sprinkleSend: true,\n  sprinkleCall: true,\n  memorySave: true,\n  memoryRemove: true,\n  freeze: true,\n  newChat: true,\n  thaw: true,\n  discard: true,\n  importProfile: true,\n  importCancel: true,\n  changesOpen: true,\n  changeAccept: true,\n  changeRevert: true,\n  monitorOpen: true,\n  monitorClose: true,\n  image: true,\n  agentCommands: true,\n  toolLabel: true,\n  guestOpen: true,\n  guestRevoke: true,\n  guestAlwaysForget: true,\n  approvalPolicySet: true,\n  decide: true,\n});\n\nexport const OWNER_DEVICE_METHODS: readonly (keyof AgentControl & string)[] = [\n  'decide',\n  'guestOpen',\n  'guestRevoke',\n  'guestAlwaysForget',\n  'approvalPolicySet',\n];\n\nexport const CONTROL_READS: readonly (keyof AgentControl & string)[] = [\n  'wait',\n  'changesOpen',\n  'monitorOpen',\n  'monitorClose',\n  'image',\n  'toolLabel',\n];\n\nexport const AgentControl: RemoteContract = contract('slicc.agent.control', {\n  control: { methods: CONTROL_METHODS },\n  view: { methods: [...CONTROL_READS, ...OWNER_DEVICE_METHODS] },\n});\n\nexport type Delivered = 'run' | 'steer' | 'follow-up';\n\nexport interface AgentTranscript {\n  readonly state: ReplicatedState<ConversationView>;\n  readonly deliveries: ReplicatedState<Record<string, Delivered>>;\n  readonly agents: ReplicatedState<AgentsSummary>;\n  readonly views: ReplicatedState<Record<string, ConversationView>>;\n  readonly commands: ReplicatedState<Command[]>;\n  readonly privateRevision: ReplicatedState<PrivateRevision>;\n  readonly sprinkles: ReplicatedState<Sprinkle[]>;\n  readonly memories: ReplicatedState<MemoryEntry[]>;\n  readonly memoryScopes: ReplicatedState<MemoryScope[]>;\n  readonly frozen: ReplicatedState<FrozenCone[]>;\n  readonly importing: ReplicatedState<ImportProgress>;\n  readonly changes: ReplicatedState<ChangesView>;\n  readonly monitor: ReplicatedState<MonitorFeed>;\n  readonly vault: ReplicatedState<VaultState>;\n  readonly labels: ReplicatedState<Record<string, string>>;\n  readonly guests: ReplicatedState<GuestSeat[]>;\n  readonly approvals: ReplicatedState<Approval[]>;\n  readonly approvalPolicy: ReplicatedState<ApprovalPolicy>;\n}\n\nexport interface PrivateRevision {\n  revision: number;\n}\n\nexport interface Command {\n  name: string;\n  description: string;\n  kind: 'prompt' | 'skill' | 'action';\n  source?: SkillSource;\n  package?: SkillPackage;\n}\n\nexport const TRANSCRIPT_STATES = keys<AgentTranscript>({\n  state: true,\n  deliveries: true,\n  agents: true,\n  views: true,\n  commands: true,\n  privateRevision: true,\n  sprinkles: true,\n  memories: true,\n  memoryScopes: true,\n  frozen: true,\n  importing: true,\n  changes: true,\n  monitor: true,\n  vault: true,\n  labels: true,\n  guests: true,\n  approvals: true,\n  approvalPolicy: true,\n});\n\nexport const AgentTranscript: RemoteContract = contract('slicc.agent.transcript', {\n  transcript: { state: TRANSCRIPT_STATES },\n});\n\nexport const REMOTE_METHODS = keys<AgentRemote>({\n  prompt: true,\n  watch: true,\n  next: true,\n  close: true,\n  abort: true,\n});\n\nexport const REMOTE_READS: readonly (keyof AgentRemote & string)[] = ['watch', 'next', 'close'];\n\nexport interface GuestShown {\n  id: string;\n  label: string;\n  agentId: string;\n  name: string;\n  expiresAt: number | null;\n  gates: GuestGates;\n}\n\nexport interface GuestProposal {\n  id: string;\n  text: string;\n  state: 'queued' | 'pending' | 'approved' | 'rejected' | 'unanswered' | 'withdrawn';\n  reason: string | null;\n  createdAt: number;\n  decidedAt: number | null;\n}\n\nexport interface AgentGuest {\n  readonly transcript: ReplicatedState<ConversationView>;\n  readonly seat: ReplicatedState<GuestShown>;\n  readonly proposals: ReplicatedState<GuestProposal[]>;\n  propose(request: ProposeRequest, context: Context): Promise<Proposed>;\n  guestOpen(draft: GuestDraft, context: Context): Promise<GuestOpened>;\n  guestRevoke(id: string, context: Context): Promise<{ revoked: boolean }>;\n}\n\nexport const GUEST_STATES = ['transcript', 'seat', 'proposals'] as const;\n\nexport const GUEST_METHODS = ['propose', 'guestOpen', 'guestRevoke'] as const;\n\nexport const AgentGuestService: RemoteContract = contract('slicc.agent.guest', {\n  guest: { state: GUEST_STATES, methods: GUEST_METHODS },\n  none: {},\n});\n\nexport const AgentRemoteService: RemoteContract = contract('slicc.agent.remote', {\n  remote: { methods: REMOTE_METHODS },\n  watch: { methods: REMOTE_READS },\n});\n\nexport const PAGE_METHODS = keys<AgentPages>({\n  open: true,\n  report: true,\n  next: true,\n  answer: true,\n  close: true,\n});\n\nexport const AgentPagesService: RemoteContract = contract('slicc.agent.pages', {\n  pages: { methods: PAGE_METHODS },\n  none: {},\n});\n\nexport const SUDO_METHODS = keys<Omit<AgentSudo, 'approvals'>>({\n  request: true,\n  withdraw: true,\n});\n\nexport const AgentSudoService: RemoteContract = contract('slicc.agent.sudo', {\n  sudo: { state: ['approvals'], methods: SUDO_METHODS },\n  none: {},\n});\n\nexport interface ModelChoice {\n  id: string;\n  label: string;\n  provider: string;\n  kind: 'chat' | 'classifier';\n  reasoning: boolean;\n  images?: boolean;\n  contextWindow: number;\n}\n\nexport interface AccountState {\n  id: string;\n  provider: string;\n  identity: string;\n  status: 'connected' | 'disconnected' | 'expired';\n  auth: 'api-key' | 'oauth';\n  needs: 'cors-free-transport' | null;\n  blocked?: 'cors-free-transport';\n  group?: 'providers' | 'mcp';\n  secret?: 'api-key' | 'token';\n  store?: 'vault';\n  fields?: AccountField[];\n  description?: string;\n  keyUrl?: string;\n  vaultName?: string;\n}\n\nexport interface AccountField {\n  name: string;\n  label: string;\n  required?: boolean;\n  placeholder?: string;\n  help?: string;\n  customBase?: true;\n  vaultSetting?: string;\n  options?: readonly { value: string; label: string }[];\n  value?: string;\n}\n\nexport interface ProviderOption {\n  id: string;\n  name: string;\n  description?: string;\n  auth: 'api-key' | 'oauth' | 'fields' | 'local';\n  fields?: AccountField[];\n  keyUrl?: string;\n  needs?: 'cors-free-transport';\n  blocked?: 'cors-free-transport';\n  vaultName?: string;\n}\n\nexport interface BudgetState {\n  provider: string;\n  percent: number;\n  window: 'weekly';\n  resets: string;\n}\n\nexport interface SignIn {\n  clientId: string;\n  scopes: string;\n  imsEnvironment: string;\n}\n\nexport interface McpSignIn {\n  url: string;\n  state: string;\n}\n\nexport interface SettingsState {\n  models: ModelChoice[];\n  accounts: AccountState[];\n  providers?: ProviderOption[];\n  budget?: BudgetState | null;\n  budgets?: BudgetState[];\n  moved?: { kind: 'model' | 'mcp'; label: string }[];\n  labels?: Record<string, string>;\n}\n\nexport interface AgentSettings {\n  readonly state: ReplicatedState<SettingsState>;\n  connect(\n    providerId: string,\n    secret: string | null,\n    fields: Record<string, string> | null,\n    context: Context\n  ): Promise<void>;\n  disconnect(providerId: string, context: Context): Promise<void>;\n  remove(providerId: string, context: Context): Promise<void>;\n  serverUrl(providerId: string, context: Context): Promise<string | null>;\n  signIn(providerId: string, context: Context): Promise<SignIn | McpSignIn | DeviceSignIn | null>;\n  dismissMoved(context: Context): Promise<void>;\n}\n\nexport const SETTINGS_METHODS = keys<Omit<AgentSettings, 'state'>>({\n  connect: true,\n  disconnect: true,\n  remove: true,\n  serverUrl: true,\n  signIn: true,\n  dismissMoved: true,\n});\n\nexport const AgentSettings: RemoteContract = contract('slicc.agent.settings', {\n  settings: { state: ['state'], methods: SETTINGS_METHODS },\n  view: { state: ['state'] },\n});\n"],
+  "mappings": "AAmBA,SAAS,gBAAgB;AAwPzB,MAAM,OAAO,CAAI,WAAkC,OAAO,KAAK,MAAM;AAE9D,MAAM,kBAAkB,KAAmB;AAAA,EAChD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,UAAU;AAAA,EACV,OAAO;AAAA,EACP,SAAS;AAAA,EACT,cAAc;AAAA,EACd,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,SAAS;AAAA,EACT,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,MAAM;AAAA,EACN,SAAS;AAAA,EACT,cAAc;AAAA,EACd,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,MAAM;AAAA,EACN,SAAS;AAAA,EACT,eAAe;AAAA,EACf,cAAc;AAAA,EACd,aAAa;AAAA,EACb,cAAc;AAAA,EACd,cAAc;AAAA,EACd,aAAa;AAAA,EACb,cAAc;AAAA,EACd,OAAO;AAAA,EACP,eAAe;AAAA,EACf,WAAW;AAAA,EACX,WAAW;AAAA,EACX,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,QAAQ;AACV,CAAC;AAEM,MAAM,uBAAiE;AAAA,EAC5E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,gBAA0D;AAAA,EACrE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,eAA+B,SAAS,uBAAuB;AAAA,EAC1E,SAAS,EAAE,SAAS,gBAAgB;AAAA,EACpC,MAAM,EAAE,SAAS,CAAC,GAAG,eAAe,GAAG,oBAAoB,EAAE;AAC/D,CAAC;AAqCM,MAAM,oBAAoB,KAAsB;AAAA,EACrD,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,cAAc;AAAA,EACd,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,gBAAgB;AAClB,CAAC;AAEM,MAAM,kBAAkC,SAAS,0BAA0B;AAAA,EAChF,YAAY,EAAE,OAAO,kBAAkB;AACzC,CAAC;AAEM,MAAM,iBAAiB,KAAkB;AAAA,EAC9C,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,MAAM;AAAA,EACN,OAAO;AAAA,EACP,OAAO;AACT,CAAC;AAEM,MAAM,eAAwD,CAAC,SAAS,QAAQ,OAAO;AA6BvF,MAAM,eAAe,CAAC,cAAc,QAAQ,WAAW;AAEvD,MAAM,gBAAgB,CAAC,WAAW,aAAa,aAAa;AAE5D,MAAM,oBAAoC,SAAS,qBAAqB;AAAA,EAC7E,OAAO,EAAE,OAAO,cAAc,SAAS,cAAc;AAAA,EACrD,MAAM,CAAC;AACT,CAAC;AAEM,MAAM,qBAAqC,SAAS,sBAAsB;AAAA,EAC/E,QAAQ,EAAE,SAAS,eAAe;AAAA,EAClC,OAAO,EAAE,SAAS,aAAa;AACjC,CAAC;AAEM,MAAM,eAAe,KAAiB;AAAA,EAC3C,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AACT,CAAC;AAEM,MAAM,oBAAoC,SAAS,qBAAqB;AAAA,EAC7E,OAAO,EAAE,SAAS,aAAa;AAAA,EAC/B,MAAM,CAAC;AACT,CAAC;AAEM,MAAM,eAAe,KAAmC;AAAA,EAC7D,SAAS;AAAA,EACT,UAAU;AACZ,CAAC;AAEM,MAAM,mBAAmC,SAAS,oBAAoB;AAAA,EAC3E,MAAM,EAAE,OAAO,CAAC,WAAW,GAAG,SAAS,aAAa;AAAA,EACpD,MAAM,CAAC;AACT,CAAC;AAgGM,MAAM,mBAAmB,KAAmC;AAAA,EACjE,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,cAAc;AAChB,CAAC;AAEM,MAAM,gBAAgC,SAAS,wBAAwB;AAAA,EAC5E,UAAU,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,iBAAiB;AAAA,EACxD,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE;AAC3B,CAAC;",
   "names": []
 }

package/dist/settings.js

@@ -23,6 +23,7 @@ import {
 } from "./providers.js";
 import { absent } from "./secrets/fetch.js";
 import { DEVICE_NEEDS_VAULT, DEVICE_SIGN_INS } from "./sign-ins.js";
+import { XAI, xaiUsage } from "./supergrok.js";
 import { BEDROCK as BEDROCK2, PREFERRED_MODELS, preferredModel as preferredModel2 } from "./preferred.js";
 const DEFAULT_MODEL = { provider: BEDROCK, modelId: "us.anthropic.claude-sonnet-5-5" };
 const DEFAULT_REGIONS = { [BEDROCK]: DEFAULT_REGION };
@@ -239,11 +240,25 @@ async function providerFields(store, providers) {
     }
   };
 }
-async function budget(records, usage) {
+async function adobeBudget(records, usage) {
   const key = records.model(ADOBE)?.placeholder;
   const found = key ? await usage(key).catch(() => null) : null;
   return found ? { provider: ADOBE, ...found } : null;
 }
+function grokBudgets(records, usage, { reach, every, now }) {
+  let kept;
+  return async () => {
+    const record = records.model(XAI);
+    if (!record || record.expiresAt === void 0 || record.state === "expired") return null;
+    if (reach?.free() !== true) return null;
+    const key = `${record.placeholder} ${record.expiresAt}`;
+    const at = now();
+    if (!kept || kept.key !== key || at - kept.at >= every)
+      kept = { key, at, found: usage(record.placeholder).catch(() => null) };
+    const found = await kept.found;
+    return found ? { provider: XAI, ...found } : null;
+  };
+}
 function blockedBy(reach) {
   return (providerId) => Boolean(LISTINGS.get(providerId)?.corsFree) && reach?.free() === false;
 }
@@ -266,6 +281,16 @@ async function createAgentSettings(models, sources, providers = sliccProviders()
   const endpoint = adobe?.baseUrl ?? ADOBE_PROXY;
   const identity = adobe?.headers ?? adobeIdentity();
   const usage = options.usage ?? ((token) => adobeUsage(token, { endpoint, identity }));
+  const every = options.every ?? BUDGET_EVERY;
+  const grok = grokBudgets(records, options.grok ?? ((token) => xaiUsage(token)), {
+    reach,
+    every,
+    now: options.now ?? Date.now
+  });
+  const polled = providers.some((provider) => provider.id === XAI);
+  const budgets = async () => (await Promise.all([adobeBudget(records, usage), polled ? grok() : null])).filter(
+    (found) => found !== null
+  );
   const snapshot = async () => {
     const stored = new Set(
       providers.filter((provider) => records.model(provider.id) && fields.ready(provider.id)).map((provider) => provider.id)
@@ -273,12 +298,14 @@ async function createAgentSettings(models, sources, providers = sliccProviders()
     const show = listed(records, fields);
     const shown = providers.filter((provider) => show(provider.id));
     const open = (list) => list.filter((provider) => !blocked(provider.id));
+    const held2 = await budgets();
     return {
       models: choices(models, open(providers), stored),
       labels: labels(models, open(shown), stored),
       accounts: [...accounts(records, shown, fields, blocked), ...await mcp?.accounts() ?? []],
       providers: offered(providers, blocked),
-      budget: await budget(records, usage),
+      budget: held2[0] ?? null,
+      budgets: held2,
       ...moved?.state.value?.length ? { moved: moved.state.value.map((name) => ({ ...name })) } : {}
     };
   };
@@ -294,10 +321,10 @@ async function createAgentSettings(models, sources, providers = sliccProviders()
     () => void 0,
     () => void 0
   );
-  if (signedIn.length) {
-    const cycle = () => void discover(signedIn).then(() => refresh(BACKGROUND_CONTEXT)).catch(() => void 0);
+  if (signedIn.length || polled) {
+    const cycle = () => void (signedIn.length ? discover(signedIn) : Promise.resolve()).then(() => refresh(BACKGROUND_CONTEXT)).catch(() => void 0);
     cycle();
-    const timer = setInterval(cycle, options.every ?? BUDGET_EVERY);
+    const timer = setInterval(cycle, every);
     timer.unref?.();
   }
   mcp?.onChange(() => void refresh(BACKGROUND_CONTEXT).catch(() => void 0));
@@ -381,6 +408,7 @@ export {
   catalogStore,
   createAgentSettings,
   createSliccModels,
+  grokBudgets,
   preferredModel2 as preferredModel,
   providerFields,
   resolveDefaultModel,