@botiverse/porthole 0.2.1 → 0.2.2

package/docs/OBJECTIVES.md

@@ -0,0 +1,116 @@
+# Objectives
+
+## What Porthole is for
+
+Any app that wants the "show content made by an agent" ability — like the inline
+visuals and standalone pages in ChatGPT and the Claude app — should be able to
+embed Porthole and get a working, safe display out of the box, plus the manual
+that teaches the agent to write for it.
+
+The library has two layers:
+
+- a **framework layer** of mechanisms (isolation, egress hardening, the in-frame
+  shell, streaming, sizing, theming, the host-function bridge, the guide
+  generator); and
+- a **preset policy layer** of ready-made bundles a host adopts with near-zero
+  config: **inline widget**, **artifact** (a standalone page), **MCP Apps** (the
+  standard protocol), and **URL** (a running app framed by URL, such as a dev
+  server's preview).
+
+The subject, stated generally, is **HTML drawn by an agent that may optionally
+interact with the agent** — and that interaction is just one host function among
+several. "Out of the box" means: a host picks a preset, passes theme tokens and
+callbacks, and receives a safe display plus a generated agent manual.
+
+## Objectives and success criteria
+
+1. **Show untrusted agent HTML without putting the host at risk.**
+   - *Success:* the conformance/leak suite passes on Chromium, WebKit and
+     Firefox — every egress and escape probe attempts its channel and observes
+     nothing; the content cannot reach the host origin, its storage, its DOM, or
+     its credentials.
+
+2. **One config generates the sandbox, the shell, and the manual, in agreement.**
+   - *Success:* for every preset, a test derives the CSP, the shell's wired host
+     functions, and the generated guide from the same config and asserts they
+     match — the guide names only variables the shell injects and only
+     capabilities the CSP and bridge allow; changing the config changes all
+     three together.
+
+3. **Speak the MCP Apps standard, proven against the reference implementation.**
+   - *Success:* the MCP Apps preset renders and interacts with the official
+     ext-apps example servers **unmodified** (initialize handshake, tool input
+     and result, size and theme changes, open-link and message), driven in the
+     leak suite.
+
+4. **Embed with near-zero config across the modes.**
+   - *Success:* a host mounts an inline widget, an artifact page, an MCP Apps
+     view and a URL frame each in a few lines using only a preset, theme tokens
+     and callbacks; the framework-agnostic core and the React binding both do
+     this; no host-specific code lives in the core.
+
+5. **Ship the agent manual as a first-class output.**
+   - *Success:* each preset produces an agent-facing guide and tool description
+     from its config; a real agent that reads the guide produces content that
+     renders within the sandbox and reads correctly at the target widths in light
+     and dark, checked by rendering the guide's own examples in the leak suite.
+
+## Non-goals
+
+- **Host-drawn DSL rendering.** Rendering a JSON/JSX/remote-DOM UI description
+  with the host's own native components (A2UI, json-render, remote-dom, JSX
+  preview) is a separate concern and a different project. Porthole is the HTML
+  sandbox only.
+- **A component vocabulary inside the sandbox.** Content is plain HTML and SVG,
+  taught by the generated manual; a consistent look comes from the injected theme
+  variables and, at most, plain base CSS for native elements, never from tags and
+  props an agent must learn (P015). Nor is Porthole a design-system library.
+- **A new widget-side protocol.** The contract is MCP Apps; we do not define an
+  alternative (PRINCIPLE 2).
+- **A shell or egress control for URL mode.** A URL frame is someone else's
+  running app: Porthole gives it isolation and access auth, nothing more (P020).
+- **Operating infrastructure.** The serving part (`/server`) is a request handler a
+  host mounts in its own backend; Porthole runs no service, domain or certificate
+  of its own.
+- **Being an agent framework or an MCP server.** Porthole is host-side rendering
+  and isolation. It does not run models, implement an MCP server, or decide
+  product policy (PRINCIPLE 8).
+
+## Who the users are
+
+- **Host app developers** who want to show agent-made HTML in a chat or canvas UI
+  and do not want to build or audit an isolation layer themselves. They are the
+  primary users: they embed the library and pick a preset.
+- **Agents (and the people prompting them)** who write the HTML. They are served
+  indirectly: the generated manual is written for them, and the sandbox is the
+  environment their code runs in.
+- **MCP App authors** who build standard MCP Apps and want them to render in any
+  Porthole-based host unmodified.
+
+The first adopter is a normal user of the public API, with no privileged path
+(PRINCIPLE 9).
+
+## What "done" means for phase 1
+
+Phase 1 is done when:
+
+- the framework-agnostic web core and the React binding (with its default,
+  replaceable confirmation dialog) exist, with opaque-origin isolation, egress
+  hardening, the shell runtime, streaming render, auto-sizing, theming, and the
+  host-function bridge;
+- the served modes exist: domain mode (a stable origin per storage scope, CSP in
+  headers, ticket → cookie for private content) with its `/server` request
+  handler, the artifact page on it, and URL mode (frame, isolation and access
+  auth only);
+- the presets exist (inline widget, artifact page, MCP Apps view, URL), each
+  generating its CSP and frame policy, and all but URL its shell and manual, from
+  one config;
+- the MCP Apps adapter runs the official ext-apps examples unmodified;
+- the leak/conformance suite passes on Chromium and WebKit, then Firefox, and is
+  runnable by any host; and
+- the first host has migrated onto it (dogfooding), every one of its features
+  that shows agent-made or foreign HTML (widgets, shown HTML files, the dev-server
+  preview) going through Porthole, with its own code reduced to configuration
+  plus callbacks.
+
+Native hosts (WKWebView, maybe Android) are phase 2.

package/docs/PRINCIPLES.md

@@ -0,0 +1,155 @@
+# Principles
+
+These are the rules we use to make decisions quickly. When a choice is unclear,
+pick the option that best satisfies these, write it down in
+[DECISIONS.md](DECISIONS.md), and move on. Principles change only through a
+decision entry.
+
+Each principle gives its reason and what it rules out.
+
+## 1. Security defaults cannot be weakened silently
+
+Isolation is on, egress is closed, host functions are off until declared, and
+their gates are on — by default. Any change that loosens a default (widens an
+allowlist, drops a sandbox flag, relaxes the CSP, removes a gate) happens only
+through a decision entry that names the threat it re-opens and ships the test
+that bounds the new risk.
+
+- **Why.** The whole point of the library is that a host can hand it untrusted
+  HTML without reasoning about browser internals. A quiet loosening moves risk
+  onto hosts who never agreed to it.
+- **Rules out.** Convenience flags that trade safety for a smaller config;
+  "temporary" allowlist entries without an owner; a default that is safe only if
+  the host remembers to also set something.
+
+## 2. The external contract is the standard; we do not invent a widget protocol
+
+What the agent-written HTML speaks to its host is **MCP Apps**
+(`io.modelcontextprotocol/ui`). Gaps are filled through the spec's own extension
+points (experimental capabilities, own-prefixed methods), and anything general is
+taken upstream to the spec, not kept as a private dialect.
+
+- **Why.** The value of standard agent-UI is that one widget runs in many hosts
+  and one host renders many widgets. A bespoke protocol forfeits that and makes
+  every author integrate with us specifically.
+- **Rules out.** A new wire format for widgets; forking the protocol to ship a
+  feature faster; host-specific globals the widget must detect.
+
+## 3. One config is the single source for the sandbox, the shell, and the manual
+
+From one config Porthole derives the CSP, the iframe sandbox and `allow`
+attributes, the in-frame shell, the host-function bridge, **and** the
+agent-facing guide and tool description. They are generated together, never
+edited apart.
+
+- **Why.** These four artifacts must agree to be safe and usable: a manual that
+  promises a capability the CSP blocks wastes the agent's turns; a CSP that
+  allows more than the manual teaches is unaudited surface. Drift between them is
+  the most common defect in hand-built sandboxes.
+- **Rules out.** A guide maintained by hand; a CSP string literal that no test
+  ties back to the capability list; teaching a variable or function the shell
+  does not inject.
+
+## 4. Everything the HTML can do beyond drawing is a declared host function
+
+Drawing pixels is free; every other power — send a prompt to the agent, open a
+link, read or write state, call a tool, read data, report an error — is a
+**host function (capability)** named in the config. Each declares its gate (needs
+a user gesture, needs a person's confirmation, is rate-limited), its egress
+needs, and its guide entry. Talking to the agent is just one host function among
+these.
+
+- **Why.** This is the core abstraction: "agent-drawn HTML + host functions." It
+  gives one list that drives the bridge, the CSP and the manual at once (see
+  PRINCIPLE 3), and it makes the question "what can this content do?" answerable
+  by reading the config.
+- **Rules out.** Ambient powers the HTML gets without the host opting in; a
+  capability wired into the bridge but absent from the CSP or the manual; a
+  gate decided ad hoc per call site instead of declared once.
+
+## 5. Every hardening item ships with a test that proves it
+
+A claim that the sandbox blocks something is backed by a test in the conformance
+suite that attempts it and observes nothing. A hardening item without a passing
+test does not exist.
+
+- **Why.** Browser behavior changes across versions and engines, and egress
+  paths are easy to miss by inspection. Only an executed probe shows the wall is
+  really there, and keeps it there as browsers move.
+- **Rules out.** "We set the CSP, so it's blocked" without a probe; hardening
+  described in a doc but not exercised; a fix landed without first writing the
+  test that failed.
+
+## 6. Measured over assumed
+
+Browser isolation facts are decided by running the probe on the engines we
+support, not by reading a spec or assuming parity across engines. Where engines
+differ, we harden for the weakest and record the measurement.
+
+- **Why.** CSP directives are honored unevenly, and sandbox and frame rules have
+  engine-specific gaps. An assumption that is wrong in one engine is a hole in
+  production.
+- **Rules out.** Relying on a single directive that one engine ignores; trusting
+  that two engines behave the same; shipping a hardening item we have not seen
+  pass and fail.
+
+## 7. Host-agnostic outside, protocol-pluggable inside
+
+The core knows nothing about any particular host app or vendor. It exposes
+mechanisms and takes a config; the host supplies theme tokens, callbacks and
+policy. Inside, the protocol an adapter speaks is swappable behind a thin seam;
+MCP Apps is the first and default adapter.
+
+- **Why.** The library is meant to be embedded by many apps. Baking one app's
+  assumptions, or one protocol's object model, into the core makes it that app's
+  library, not everyone's.
+- **Rules out.** Importing a host's types into the core; a core that only works
+  with one framework; tying the core to one protocol SDK's class hierarchy.
+
+## 8. The host owns product policy; the surface stays small
+
+Porthole decides mechanism (how isolation and gating work); the host decides
+policy (whether to confirm an action, what the confirmation says, which origins
+are allowed, what the theme is). We prefer deleting options to adding them, and
+presets over knobs.
+
+Authentication and authorization *policy* are the host's; carrying the host's
+decision safely onto the content domain is Porthole's *mechanism*. Porthole never
+knows who someone is or what they may see: the host decides before it issues a
+ticket and on every request after (`authorize`), and Porthole carries that decision
+in tickets and cookies, opaque to it (P046, P050).
+
+- **Why.** Policy is product-specific and changes faster than mechanism. A small,
+  opinionated surface with safe presets is easier to audit and harder to misuse
+  than a large configurable one.
+- **Rules out.** Drawing our own confirmation UI the host can't control; config
+  options that exist only to avoid a decision; a second way to do something the
+  presets already cover; users, roles, share lists or revocation lists inside
+  Porthole.
+
+## 9. No special first user
+
+Porthole is built as a general library. Its first adopter is a normal consumer of
+the public API, not a privileged case with private hooks. If the first user needs
+something, it goes into the config or an extension point that any host could use.
+
+- **Why.** A library shaped around one caller's internals is not reusable, and
+  the shortcuts leak that caller's assumptions into the core (against PRINCIPLE
+  7).
+- **Rules out.** An escape hatch only the first host uses; branching on who the
+  caller is; features reachable only through internal, undocumented API.
+
+## 10. The agent manual is a first-class output, from day one
+
+The shell is designed together with the manual that teaches an agent to write for
+it. Guide generation is part of the framework layer, not an afterthought: every
+preset ships an agent-facing manual and a tool description generated from the
+same config as the sandbox and the shell.
+
+- **Why.** Untrusted HTML is only as good as what the author was told — the sizes
+  that read on each screen, the theme variables that exist, what the sandbox
+  forbids. A shell without a matching manual produces content that is almost
+  right, and the manual must track the shell automatically to stay true.
+- **Rules out.** Shipping a shell and leaving the manual to each host; a manual
+  that lists variables or limits the shell does not actually enforce; prose
+  guidance that no test checks against real renders.

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@botiverse/porthole",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "A host-side sandbox for agent-made HTML: isolation, egress hardening, a themed shell, gated host functions, and the agent manual, from one config.",
   "license": "Apache-2.0",
   "files": [
     "src",
-    "dist"
+    "dist",
+    "docs"
   ],
   "type": "module",
   "sideEffects": false,
@@ -62,7 +63,7 @@
     "node": ">=24"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/build-harness.ts",
+    "build": "tsc -p tsconfig.build.json && node scripts/build-harness.ts && node scripts/copy-docs.ts",
     "test:leak": "playwright test -c leak/playwright.config.ts"
   }
 }

package/src/conformance/entry.ts

@@ -17,9 +17,15 @@ export interface EntryConformanceHost {
    * The clean address of a stored page the signed-in viewer may open (`ContentHost.urlOf`), for
    * `scope`: it draws `<main id="artifact">version 1</main>`.
    */
-  url(scope: string): string;
+  url(scope: string): string | Promise<string>;
   /** A clean address the signed-in viewer may not open. */
-  denied(scope: string): string;
+  denied(scope: string): string | Promise<string>;
+  /**
+   * Addresses on the content domain that name nothing (a label the app never assigns, the bare
+   * domain, a path no instance has): each must be Porthole's 404 there, never the app's sign-in
+   * (P070). Absent: the case is skipped.
+   */
+  unknown?(): readonly string[] | Promise<readonly string[]>;
   /** Whether `page` shows the app's own sign-in. */
   atSignIn(page: Page): Promise<boolean>;
   /** On the app's sign-in page: signs in, as a person does (and the app goes back). */
@@ -86,7 +92,7 @@ export function entryTests(
     "a clean address opens directly for a signed-in viewer, and stays clean; a reload rides on its cookie",
     async ({ page }) => {
       await host.signIn(page);
-      const url = host.url("entry-direct");
+      const url = await host.url("entry-direct");
       await page.goto(url);
       await expect(page.locator("#artifact")).toHaveText("version 1");
       expect(page.url(), "the address bar shows the clean address, no code").toBe(url);
@@ -106,7 +112,7 @@ export function entryTests(
     "served.entry.signed-out",
     "signed out, a clean address goes to the app's own sign-in, then back to the content",
     async ({ page }) => {
-      const url = host.url("entry-signed-out");
+      const url = await host.url("entry-signed-out");
       await page.goto(url);
       expect(await host.atSignIn(page), "the app's sign-in").toBe(true);
       expect(await shows(page)).toBe(false);
@@ -121,7 +127,7 @@ export function entryTests(
     "a viewer without access gets the app's refusal, never the content",
     async ({ page }) => {
       await host.signIn(page);
-      const url = host.denied("entry-denied");
+      const url = await host.denied("entry-denied");
       const answer = await page.goto(url);
       expect(answer?.status()).toBe(403);
       expect(await shows(page)).toBe(false);
@@ -129,12 +135,35 @@ export function entryTests(
     },
   );
 
+  define(
+    "served.entry.unknown",
+    "an address that names nothing is a 404 on the content domain: never a trip to the app's sign-in",
+    async ({ page }, info) => {
+      info.skip(
+        host.unknown === undefined,
+        "the host gave no addresses that name nothing (unknown)",
+      );
+      const request = page.context().request;
+      for (const url of (await host.unknown?.()) ?? []) {
+        const answer = await request.get(url, {
+          maxRedirects: 0,
+          headers: { "sec-fetch-dest": "document" },
+        });
+        expect(answer.status(), url).toBe(404);
+        expect(answer.headers().location, url).toBeUndefined();
+        const opened = await page.goto(url);
+        expect(opened?.status(), url).toBe(404);
+        expect(new URL(page.url()).origin, url).toBe(new URL(url).origin);
+      }
+    },
+  );
+
   define(
     "served.entry.code-once",
     "an entry code works once: replayed, it opens nothing",
     async ({ page }) => {
       await host.signIn(page);
-      const code = await codeFor(page, host.url("entry-once"));
+      const code = await codeFor(page, await host.url("entry-once"));
       const request = page.context().request;
       const top = { "sec-fetch-dest": "document" };
       const first = await request.get(code, { maxRedirects: 0, headers: top });
@@ -150,8 +179,8 @@ export function entryTests(
     "an entry code taken to another instance's origin opens nothing there",
     async ({ page }) => {
       await host.signIn(page);
-      const code = new URL(await codeFor(page, host.url("entry-mine")));
-      const other = new URL(host.url("entry-theirs"));
+      const code = new URL(await codeFor(page, await host.url("entry-mine")));
+      const other = new URL(await host.url("entry-theirs"));
       const request = page.context().request;
       const answer = await request.get(`${other.origin}${code.pathname}${code.search}`, {
         maxRedirects: 0,
@@ -167,7 +196,7 @@ export function entryTests(
     "a clean address in a frame shows the content where the browser keeps the cookies, else asks for a tab: never the app's sign-in",
     async ({ page, browserName }, info) => {
       await host.signIn(page);
-      const shown = await host.frame(page, host.url("entry-framed"));
+      const shown = await host.frame(page, await host.url("entry-framed"));
       const outcome = await shown.outcome();
       const frame = await shown.frame();
       expect(await host.atSignIn(page)).toBe(false);
@@ -194,7 +223,7 @@ export function entryTests(
       await host.signIn(page);
       // The app's page stays; the browser forgets every sign-in.
       await page.context().clearCookies();
-      const shown = await host.frame(page, host.url("entry-framed-out"));
+      const shown = await host.frame(page, await host.url("entry-framed-out"));
       expect(await shown.outcome()).toMatchObject({ state: "blocked", reason: "sign-in" });
       const frame = await shown.frame();
       await expect(frame.locator("h1")).toHaveText("Open this in a new tab to sign in");

package/src/conformance/host-kit.ts

@@ -1,13 +1,14 @@
 import { readFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
-import { expect, type Frame, type Page, type TestType } from "@playwright/test";
+import { runInThisContext } from "node:vm";
+import { expect, type Frame, type Page, type TestInfo, type TestType } from "@playwright/test";
 import type { PortholeConfig } from "../config/schema.ts";
 import type { FrameLocation, InstanceRef } from "../isolation/types.ts";
 import { entryTests, type EntryConformanceHost } from "./entry.ts";
 import type { ConformanceHarness } from "./harness/page.ts";
 import type { FrameOutcome } from "../host/types.ts";
 import type { ConformanceHost, LaunchedDisplay, LaunchSpec } from "./index.ts";
-import { leakTests, type ConformanceFixtures } from "./probes.ts";
+import { leakTests, type ConformanceFixtures, type ConformanceTest } from "./probes.ts";
 import { servedTests, type ServedConformanceHost, type ServedDisplay } from "./served.ts";
 
 /**
@@ -55,14 +56,19 @@ export interface HostConformanceOptions {
    * signed in and out, and in a frame.
    */
   readonly entry?: {
-    /** The clean address of `instances.artifact(scope, "1")` (`ContentHost.urlOf`). */
-    readonly url: (scope: string) => string;
+    /**
+     * The clean address of `instances.artifact(scope, "1")` (`ContentHost.urlOf`); may publish it
+     * on demand.
+     */
+    readonly url: (scope: string) => string | Promise<string>;
     /** A clean address the signed-in viewer may not open. */
-    readonly denied: (scope: string) => string;
+    readonly denied: (scope: string) => string | Promise<string>;
     /** Whether `page` shows the app's own sign-in. */
     readonly atSignIn: (page: Page) => Promise<boolean>;
     /** On the app's sign-in page: signs in, as a person does. */
     readonly completeSignIn: (page: Page) => Promise<void>;
+    /** Addresses on the content domain that name nothing: each a 404 there (P070). */
+    readonly unknown?: () => readonly string[] | Promise<readonly string[]>;
   };
   /** Case ids to skip, each with its reason (shown in the report). */
   readonly skip?: Readonly<Record<string, string>>;
@@ -338,9 +344,10 @@ export function hostConformance(options: HostConformanceOptions): HostConformanc
           denied: given.denied,
           atSignIn: given.atSignIn,
           completeSignIn: given.completeSignIn,
+          ...(given.unknown === undefined ? {} : { unknown: given.unknown }),
           async frame(page, url) {
             await ready(page);
-            const instance = served.artifact("entry", "1");
+            const instance = await served.artifact("entry", "1");
             const id = await invoke(page, "show", options.config(instance), instance, {
               location: { url, origin: new URL(url).origin },
             });
@@ -435,32 +442,68 @@ export function defineHostConformance(
   if (options.instances.proxy === undefined) {
     absent(PROXY_CASES, "the app serves no MCP Apps views");
   }
-  typed.describe(`Porthole leak suite (${options.name})`, () => {
-    for (const each of leakTests(hosts.leak, { skip })) {
-      // Playwright reads the fixtures a test uses from its parameter's destructuring.
-      typed(each.title, async ({ page, browserName }, info) => {
-        await hosts.begin(page);
-        await each.run({ page, browserName }, info);
-      });
-    }
-  });
-  typed.describe(`Porthole served modes (${options.name})`, () => {
-    for (const each of servedTests(hosts.served, { skip })) {
-      typed(each.title, async ({ page, browserName }, info) => {
-        await hosts.begin(page);
-        await each.run({ page, browserName }, info);
-      });
-    }
-  });
-  const entry = hosts.entry;
-  if (entry !== null) {
-    typed.describe(`Porthole redirect entry (${options.name})`, () => {
-      for (const each of entryTests(entry, { skip })) {
-        typed(each.title, async ({ page, browserName }, info) => {
+  // Registered as the app's own spec file's (P070): Playwright locates a test where `test()` is
+  // called, so `playwright test <spec>` and `<spec>:<line>` select these.
+  const at = callerOf(defineHostConformance);
+  const describeOf = Reflect.get(test, "describe") as unknown as Register;
+  const describe = calledFrom(describeOf, at);
+  const register = calledFrom(typed as unknown as Register, at);
+  const suite = (title: string, tests: readonly ConformanceTest[]) => {
+    describe(title, () => {
+      for (const each of tests) {
+        // Playwright reads the fixtures a test uses from its parameter's destructuring.
+        register(each.title, async ({ page, browserName }: ConformanceFixtures, info: TestInfo) => {
           await hosts.begin(page);
           await each.run({ page, browserName }, info);
         });
       }
     });
+  };
+  suite(`Porthole leak suite (${options.name})`, leakTests(hosts.leak, { skip }));
+  suite(`Porthole served modes (${options.name})`, servedTests(hosts.served, { skip }));
+  if (hosts.entry !== null) {
+    suite(`Porthole redirect entry (${options.name})`, entryTests(hosts.entry, { skip }));
+  }
+}
+
+/** Where a function was called from: the caller's file and line, or null. */
+function callerOf(callee: (...args: never[]) => unknown): { file: string; line: number } | null {
+  const holder: { stack?: string } = {};
+  Error.captureStackTrace(holder, callee);
+  // The first frame is the caller's: "    at file:///…/app.spec.ts:16:1" or "    at fn (/…/app.spec.ts:16:1)".
+  const frame = (holder.stack ?? "")
+    .split("\n")
+    .map((line) => line.trim())
+    .find((line) => line.startsWith("at "));
+  const where = (frame ?? "").slice(3).replace(/^.*\((.*)\)$/u, "$1");
+  const found = /^(.+):(\d+):\d+$/u.exec(where);
+  if (found?.[1] === undefined || found[2] === undefined) {
+    return null;
+  }
+  try {
+    return {
+      file: found[1].startsWith("file://") ? fileURLToPath(found[1]) : found[1],
+      line: Number(found[2]),
+    };
+  } catch {
+    return null;
+  }
+}
+
+type Register = (title: string, body: unknown) => void;
+
+/**
+ * `register` (Playwright's `test` or `test.describe`), called from a function compiled as the
+ * caller's file and line (`vm`'s `filename` and `lineOffset`), so the tests it makes are located
+ * there. Without a caller, `register` itself.
+ */
+function calledFrom(register: Register, at: { file: string; line: number } | null): Register {
+  if (at === null) {
+    return (title, body) => register(title, body);
   }
+  const call = runInThisContext("(register, title, body) => register(title, body)", {
+    filename: at.file,
+    lineOffset: Math.max(0, at.line - 1),
+  }) as (register: Register, title: string, body: unknown) => void;
+  return (title, body) => call(register, title, body);
 }