@segmentstream/agent 0.20.2 → 0.21.1

package/dist/extension/lib/agent-task.mjs

@@ -0,0 +1,183 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { redactDiagnostic } from "./diagnostics.mjs";
+import { appOrigin } from "./environment.mjs";
+import { runtimeToken } from "./runtime-token.mjs";
+import { randomUUID } from "node:crypto";
+import { defineState } from "eve/context";
+const AGENT_TASK_AUTHENTICATOR = "segmentstream-agent-task";
+const AGENT_TASK_HEADER = "X-SegmentStream-Agent-Task";
+const AGENT_TASK_ROUTE = "/eve/segmentstream/v1/tasks";
+const AGENT_TASK_END_ROUTE = "/eve/segmentstream/v1/tasks/end";
+const MAXIMUM_TASK_TEXT = 65536;
+const CALL_TIMEOUT_MS = 15e3;
+const FIRST_RETRY_MS = 1e3;
+const MAXIMUM_RETRY_MS = 3e4;
+const REPORT_WINDOW_MS = 12e4;
+function taskAddress(taskId) {
+	return `task:${taskId}`;
+}
+function taskPrincipal(task) {
+	return {
+		authenticator: AGENT_TASK_AUTHENTICATOR,
+		principalType: "service",
+		principalId: task.principal.id,
+		attributes: {
+			taskId: task.id,
+			workflow: task.workflow,
+			roles: task.principal.roles,
+			name: task.principal.name
+		}
+	};
+}
+function agentTaskIdOf(principal) {
+	if (principal?.authenticator !== "segmentstream-agent-task") return;
+	const taskId = principal.attributes.taskId;
+	return typeof taskId === "string" && taskId !== "" ? taskId : void 0;
+}
+const agentTaskSessions = defineState("segmentstream.agent-task", () => null);
+function taskSecret(taskId, state = agentTaskSessions) {
+	const session = state.get();
+	return session?.taskId === taskId && session.secret !== null ? session.secret : void 0;
+}
+function resultBody(outcome) {
+	if (outcome.status === "failed") return {
+		status: "failed",
+		reason: outcome.reason
+	};
+	if (outcome.text.length <= 65536) return {
+		status: outcome.status,
+		text: outcome.text,
+		truncated: false
+	};
+	const last = outcome.text.charCodeAt(65535);
+	const end = last >= 55296 && last <= 56319 ? 65535 : MAXIMUM_TASK_TEXT;
+	return {
+		status: outcome.status,
+		text: outcome.text.slice(0, end),
+		truncated: true
+	};
+}
+var AgentTaskError = class extends Error {
+	status;
+	name = "AgentTaskError";
+	constructor(message, status, options) {
+		super(message, options);
+		this.status = status;
+	}
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function currentTask(value) {
+	const principal = isRecord(value) ? value.principal : void 0;
+	if (!isRecord(value) || typeof value.id !== "string" || value.id === "" || typeof value.workflow !== "string" || typeof value.prompt !== "string" || typeof value.deadline_at !== "string" || Number.isNaN(Date.parse(value.deadline_at)) || !isRecord(principal) || typeof principal.id !== "string" || principal.id === "" || typeof principal.name !== "string" || !Array.isArray(principal.roles) || !principal.roles.every((role) => typeof role === "string")) throw new AgentTaskError("The ontology answered the current task with an invalid body.");
+	return {
+		id: value.id,
+		workflow: value.workflow,
+		prompt: value.prompt,
+		deadlineAt: value.deadline_at,
+		principal: {
+			id: principal.id,
+			name: principal.name,
+			roles: principal.roles
+		}
+	};
+}
+function transient(status) {
+	return status === 408 || status === 429 || status >= 500;
+}
+function agentTasks(options = {}) {
+	const environment = options.environment ?? process.env;
+	const token = options.token ?? runtimeToken;
+	const fetchImpl = options.fetch ?? fetch;
+	const now = options.now ?? Date.now;
+	const sleep = options.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+	const log = options.log ?? ((message, detail) => console.error(message, detail));
+	async function call(path, init) {
+		const credential = await token();
+		try {
+			return await fetchImpl(`${appOrigin(environment)}${path}`, {
+				method: init.method,
+				redirect: "error",
+				signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+				headers: {
+					authorization: `Bearer ${credential}`,
+					accept: "application/json",
+					...init.secret === void 0 ? {} : { [AGENT_TASK_HEADER]: init.secret },
+					...init.body === void 0 ? {} : { "content-type": "application/json" }
+				},
+				...init.body === void 0 ? {} : { body: JSON.stringify(init.body) }
+			});
+		} catch (error) {
+			throw new AgentTaskError(`The task request to ${path} failed.`, void 0, { cause: redactDiagnostic(error, new Set([credential, init.secret ?? ""])) });
+		}
+	}
+	return {
+		async current(secret) {
+			const response = await call("/api/ontology/agent/tasks/current", {
+				method: "GET",
+				secret
+			});
+			if (response.status === 403) return { status: "refused" };
+			if (!response.ok) throw new AgentTaskError(`The ontology answered the current task with HTTP ${response.status}.`, response.status);
+			return {
+				status: "live",
+				task: currentTask(await response.json())
+			};
+		},
+		async report(secret, outcome, context) {
+			const reference = randomUUID();
+			const stop = Math.min(Date.parse(context.deadlineAt), now() + REPORT_WINDOW_MS);
+			const body = resultBody(outcome);
+			for (let delay = FIRST_RETRY_MS;; delay = Math.min(delay * 2, MAXIMUM_RETRY_MS)) {
+				let failure;
+				try {
+					const response = await call("/api/ontology/agent/tasks/current/result", {
+						method: "POST",
+						secret,
+						body
+					});
+					if (response.ok) return "accepted";
+					if (response.status === 409) return "already_reported";
+					if (response.status === 403) return "refused";
+					failure = new AgentTaskError(`The ontology answered the task report with HTTP ${response.status}.`, response.status);
+					if (!transient(response.status)) {
+						log("[segmentstream] agent_task_report_failed", {
+							reference,
+							taskId: context.taskId,
+							error: failure
+						});
+						return "failed";
+					}
+				} catch (error) {
+					failure = error;
+				}
+				if (now() + delay >= stop) {
+					log("[segmentstream] agent_task_report_failed", {
+						reference,
+						taskId: context.taskId,
+						error: failure
+					});
+					return "failed";
+				}
+				await sleep(delay);
+			}
+		},
+		async end(input) {
+			const response = await call(AGENT_TASK_END_ROUTE, {
+				method: "POST",
+				body: {
+					task_id: input.taskId,
+					session_id: input.sessionId
+				}
+			});
+			if (!response.ok) throw new AgentTaskError(`The agent answered the session end with HTTP ${response.status}.`, response.status);
+		}
+	};
+}
+export { AGENT_TASK_AUTHENTICATOR, AGENT_TASK_END_ROUTE, AGENT_TASK_HEADER, AGENT_TASK_ROUTE, AgentTaskError, MAXIMUM_TASK_TEXT, agentTaskIdOf, agentTaskSessions, agentTasks, resultBody, taskAddress, taskPrincipal, taskSecret };

package/dist/extension/lib/attachment-tools.mjs

@@ -5,8 +5,8 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { appOrigin } from "./environment.mjs";
-import { i as memberIdOf } from "../../_chunks/principal-DFcIfKSa.mjs";
 import { runtimeToken } from "./runtime-token.mjs";
+import { i as memberIdOf } from "../../_chunks/principal-69qoDdqy.mjs";
 import { agentAttachments } from "./attachments.mjs";
 import { telegramConversation } from "./telegram/files.mjs";
 import { detectFile, documentText } from "./attachment-formats.mjs";

package/dist/extension/lib/attachments.mjs

@@ -5,7 +5,7 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { MAXIMUM_DOWNLOAD_BYTES } from "./connection-proxy.mjs";
-import { ACT_AS_HEADER } from "./ontology-connection.mjs";
+import { ACT_AS_HEADER } from "./actor.mjs";
 import { createHash } from "node:crypto";
 const MAXIMUM_ATTACHMENT_BYTES = MAXIMUM_DOWNLOAD_BYTES;
 const ATTACHMENT_TTL_HOURS = 24;

package/dist/extension/lib/build-metadata.mjs

@@ -4,5 +4,5 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { t as agentBuild } from "../../_chunks/build-metadata-CftTwBkw.mjs";
+import { t as agentBuild } from "../../_chunks/build-metadata-kBu1knj6.mjs";
 export { agentBuild };

package/dist/extension/lib/chat-post-confirmation.d.ts

@@ -2,6 +2,8 @@ import type { ConfirmationDescription } from "./confirmation-description.js";
 /** Versioned agreement with the authenticated ontology, not a model supplied capability. */
 export declare const CHAT_POST_PROTOCOL = "segmentstream/chat-post";
 export declare const CHAT_POST_ENVELOPE = "_segmentstream";
+/** The ontology's chat posting tool, without the connection's namespace. */
+export declare const CHAT_POST_TOOL = "chat_post_message";
 export interface ChatPostPreview {
     readonly chatId: string;
     readonly provider: "telegram";

package/dist/extension/lib/chat-post-confirmation.mjs

@@ -9,9 +9,10 @@ import { createHash } from "node:crypto";
 import { TelegramFormatConverter, escapeMarkdownV2 } from "@chat-adapter/telegram";
 const CHAT_POST_PROTOCOL = "segmentstream/chat-post";
 const CHAT_POST_ENVELOPE = "_segmentstream";
+const CHAT_POST_TOOL = "chat_post_message";
 const converter = new TelegramFormatConverter();
 function isChatPost(action) {
-	return action.split("__").at(-1) === "chat_post_message";
+	return action.split("__").at(-1) === CHAT_POST_TOOL;
 }
 function supportsChatPost(tool) {
 	return isChatPost(String(tool.name)) && object(tool._meta)["segmentstream/chat-post"] === 1;
@@ -64,4 +65,4 @@ function describeChatPost(input) {
 		}
 	};
 }
-export { CHAT_POST_ENVELOPE, CHAT_POST_PROTOCOL, chatPostDigest, chatPostOperationId, describeChatPost, isChatPost, supportsChatPost };
+export { CHAT_POST_ENVELOPE, CHAT_POST_PROTOCOL, CHAT_POST_TOOL, chatPostDigest, chatPostOperationId, describeChatPost, isChatPost, supportsChatPost };

package/dist/extension/lib/confirmation-outcome.d.ts

@@ -22,6 +22,6 @@ export declare function confirmationOutcome(record: DeferredConfirmation, status
         request?: string | undefined;
     } | undefined;
     confirmation: string;
-    status: "expired" | "done" | "cancelled" | "failed" | "approved";
+    status: "failed" | "expired" | "done" | "cancelled" | "approved";
     summary: string;
 };

package/dist/extension/lib/confirmations.d.ts

@@ -1,5 +1,6 @@
 import { type StateHandle } from "eve/context";
 import type { ApprovalConfiguration } from "eve/tools/approval";
+import { type OntologyActor } from "./actor.js";
 import type { ConfirmationDescription } from "./confirmation-description.js";
 import { type ConfirmationCopy } from "./telegram/confirmation-text.js";
 import { type TelegramTexts } from "./telegram/texts.js";
@@ -30,10 +31,14 @@ export interface Confirmation {
     readonly cancellationReason?: "edit" | "expired";
 }
 export declare const confirmations: StateHandle<Record<string, Confirmation>>;
-/** Eve pauses the original call and rechecks this policy immediately before executing it. */
+/**
+ * Eve pauses the original call and rechecks this policy immediately before executing it. In a task
+ * session no person is present: an action the workflow's role permits runs without a confirmation
+ * card, because the role is the boundary, and chat posting is refused.
+ */
 export declare function actionApproval(options: {
-    readonly labels: (memberId: string, action: string, input: Readonly<Record<string, unknown>>) => Promise<ActionAnnotations>;
-    readonly describe?: (memberId: string, action: string, input: Readonly<Record<string, unknown>>) => Promise<ConfirmationDescription>;
+    readonly labels: (actor: OntologyActor, action: string, input: Readonly<Record<string, unknown>>) => Promise<ActionAnnotations>;
+    readonly describe?: (actor: OntologyActor, action: string, input: Readonly<Record<string, unknown>>) => Promise<ConfirmationDescription>;
     readonly texts?: () => TelegramTexts;
     readonly state?: StateHandle<Record<string, Confirmation>>;
     readonly now?: () => number;

package/dist/extension/lib/confirmations.mjs

@@ -5,9 +5,10 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { withTelegramTexts } from "./telegram/texts.mjs";
-import { i as memberIdOf } from "../../_chunks/principal-DFcIfKSa.mjs";
+import { i as memberIdOf } from "../../_chunks/principal-69qoDdqy.mjs";
 import { confirmationCopy, confirmationLocale, renderConfirmation } from "./telegram/confirmation-text.mjs";
 import { chatPostCard } from "./telegram/chat-post-card.mjs";
+import { actorOf, member } from "./actor.mjs";
 import { chatPostDigest, isChatPost } from "./chat-post-confirmation.mjs";
 import { createHash } from "node:crypto";
 import { defineState } from "eve/context";
@@ -35,7 +36,18 @@ function actionApproval(options) {
 	});
 	return {
 		async request(ctx) {
-			const memberId = memberIdOf(ctx.session.auth.current);
+			const actor = actorOf(ctx.session.auth.current);
+			if (actor?.kind === "task") {
+				if (isChatPost(ctx.toolName)) return denied("Chat posting is unavailable in a task.");
+				try {
+					await options.labels(actor, ctx.toolName, ctx.toolInput ?? {});
+				} catch (error) {
+					console.warn("The ontology action permission check failed.", error);
+					return denied("The action is unavailable or the task's role does not permit it.");
+				}
+				return "approved";
+			}
+			const memberId = actor?.memberId;
 			if (memberId === void 0) return denied("A paired member is required.");
 			const present = (run) => options.texts === void 0 ? run() : withTelegramTexts(options.texts(), run, () => confirmationLocale(ctx.session.auth.current));
 			const hash = inputHash(ctx.toolInput ?? {});
@@ -47,7 +59,7 @@ function actionApproval(options) {
 			}
 			let labels;
 			try {
-				labels = await options.labels(memberId, ctx.toolName, ctx.toolInput ?? {});
+				labels = await options.labels(member(memberId), ctx.toolName, ctx.toolInput ?? {});
 			} catch (error) {
 				console.warn("The ontology action permission check failed.", error);
 				return denied("The action is unavailable or the member no longer has permission.");
@@ -57,7 +69,7 @@ function actionApproval(options) {
 			const posting = isChatPost(ctx.toolName);
 			let description;
 			if (posting) try {
-				description = await options.describe?.(memberId, ctx.toolName, businessInput);
+				description = await options.describe?.(member(memberId), ctx.toolName, businessInput);
 				const preview = description?.chatPost;
 				const source = ctx.session.auth.current?.attributes;
 				if (description === void 0 || preview === void 0 || typeof source?.chatId !== "string" || source.chatId === preview.externalId) return denied("A complete preview for a different chat is required. Reply normally in this chat.");
@@ -84,7 +96,7 @@ function actionApproval(options) {
 			if (saved !== void 0) return denied("The original call is waiting for its Confirm / Cancel buttons.");
 			if (!posting && !needsConfirmation(labels)) return "approved";
 			try {
-				if (!posting) description = await options.describe?.(memberId, ctx.toolName, businessInput);
+				if (!posting) description = await options.describe?.(member(memberId), ctx.toolName, businessInput);
 				if (description === void 0) throw new Error("A trusted confirmation description is required.");
 			} catch (error) {
 				console.warn("The confirmation description could not be read.", error);

package/dist/extension/lib/conversation-runtime.mjs

@@ -4,17 +4,27 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { agentTaskIdOf } from "./agent-task.mjs";
 import { ENDS_CONVERSATION_INSTRUCTIONS } from "./group-routing/conversation-prompt.mjs";
-import { i as memberIdOf } from "../../_chunks/principal-DFcIfKSa.mjs";
+import { i as memberIdOf } from "../../_chunks/principal-69qoDdqy.mjs";
 import { n as contentText, t as CONTENT_CAPS } from "../../_chunks/content-cDtVnr8Y.mjs";
 import { conversationEvent, conversations, sessionFailureEventId, summarizeArguments } from "./conversations.mjs";
 import { parseAddress } from "./telegram/sessions.mjs";
 import { completionKind } from "./telegram/silent.mjs";
 import { recordModelServiceAlert } from "./model-service-alert.mjs";
-import { decide } from "eve/ai";
 import { call } from "eve/events";
+import { decide } from "eve/ai";
 function conversationCoordinates(context) {
 	const principal = context.session.auth.current;
+	const taskId = agentTaskIdOf(principal);
+	if (taskId !== void 0) return {
+		provider: "task",
+		chatId: taskId,
+		chatType: "private",
+		threadId: null,
+		participantIds: [],
+		senderId: principal?.principalId ?? null
+	};
 	const telegram = principal?.authenticator === "segmentstream-telegram" || context.channel.kind?.includes("telegram");
 	const address = context.channel.continuationToken;
 	const attributes = principal?.attributes;

package/dist/extension/lib/deferred-confirmations.mjs

@@ -4,9 +4,10 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { appOrigin } from "./environment.mjs";
 import { redactDiagnostic } from "./diagnostics.mjs";
+import { appOrigin } from "./environment.mjs";
 import { runtimeToken } from "./runtime-token.mjs";
+import { member } from "./actor.mjs";
 import { chatPostDigest, isChatPost } from "./chat-post-confirmation.mjs";
 import { inputHash } from "./confirmations.mjs";
 import { ontologyTools } from "./ontology-tools.mjs";
@@ -36,11 +37,11 @@ function deferredConfirmations(options = {}) {
 async function runDeferredAction(record, options) {
 	if (record.inputHash !== inputHash(record.data.input)) throw new Error("The confirmed input changed.");
 	const tools = ontologyTools(options);
-	await tools.labels(record.memberId, record.data.action, record.data.input);
+	await tools.labels(member(record.memberId), record.data.action, record.data.input);
 	const preview = record.data.confirmation.description?.chatPost;
 	if (isChatPost(record.data.action)) {
 		const input = Object.fromEntries(Object.entries(record.data.input).filter(([key]) => key !== "_confirmation"));
-		const current = (await tools.describe(record.memberId, record.data.action, input)).chatPost;
+		const current = (await tools.describe(member(record.memberId), record.data.action, input)).chatPost;
 		if (!preview || !current || chatPostDigest(preview) !== chatPostDigest(current)) throw new Error("The confirmed chat destination or attribution changed.");
 	}
 	const envelope = {
@@ -65,7 +66,7 @@ async function runDeferredAction(record, options) {
 	const result = await ontologyTools({
 		...options,
 		envelope
-	}).rpc(record.memberId, "tools/call", {
+	}).rpc(member(record.memberId), "tools/call", {
 		name: record.data.action.split("__").at(-1),
 		arguments: record.data.input
 	});

package/dist/extension/lib/group-routing/dequeue.mjs

@@ -12,8 +12,8 @@ import { routeMessage } from "./router.mjs";
 import { archivedRoutingMessages } from "./routing-context.mjs";
 import { routingBurst } from "./burst.mjs";
 import { conversationCoordinates } from "../conversation-runtime.mjs";
-import { decide } from "eve/ai";
 import { createHash } from "node:crypto";
+import { decide } from "eve/ai";
 function conversationDequeueGuard(archive = conversations(), classifier = decide) {
 	return async (event, ctx) => {
 		const auth = ctx.session.auth.current;

package/dist/extension/lib/ontology-connection.d.ts

@@ -2,33 +2,33 @@ import type { SessionAuthContext } from "eve/context";
 import { type McpClientConnectionDefinition } from "eve/connections";
 import { type Environment } from "./environment.js";
 import { type RuntimeToken } from "./runtime-token.js";
+import { type OntologyActor } from "./actor.js";
 import type { TelegramTexts } from "./telegram/texts.js";
 /**
  * The ontology as tools: an MCP connection to the workspace app's `/mcp`
  * (`ontology-mcp-design.md`). The agent authenticates as the deployment with its Vercel OIDC token
- * and names the member it acts for in `X-SegmentStream-Act-As`; the ontology service checks that
- * the member is active and has a live pairing, lists only the tools the member may run, and
- * records the member in history.
+ * and names whom it acts for: the member in `X-SegmentStream-Act-As`, or a task's secret in
+ * `X-SegmentStream-Agent-Task` (`agent-tasks-spec.md`). The ontology service checks that the member
+ * is active and has a live pairing, or that the task is live, lists only the tools that user may
+ * run, and records them in history.
  */
-/** The header that names the member a runtime caller acts for. */
-export declare const ACT_AS_HEADER = "X-SegmentStream-Act-As";
-/** The session has no member to act for, so the ontology must not be reached. */
-export declare class MemberRequiredError extends Error {
-    readonly name = "MemberRequiredError";
-}
+export { ACT_AS_HEADER } from "./actor.js";
 /**
- * The headers that name the member, from the session principal of the turn. The connection fails
- * without one, and fails when the turn's member is not the one the connection instance was opened
- * for, so a client opened for one member never serves another.
+ * The headers that name whom the turn acts for, from its session principal. The connection fails
+ * without a member or task, and fails when the turn's actor is not the one the connection instance
+ * was opened for, so a client opened for one member or task never serves another.
  */
 export declare function actAsHeaders(input: {
     readonly principal: SessionAuthContext | null;
-    readonly expectedMemberId: string;
+    readonly expected: OntologyActor;
+    readonly secret?: (taskId: string) => string | undefined;
 }): Record<string, string>;
 /**
- * The connection for one turn, or `null` when the turn has no member principal: an unpaired
- * caller never reaches the ontology. The instance key names the member, so eve opens a separate
- * client per member even when members share a group chat's session.
+ * The connection for one turn, or `null` when the turn has no member or task principal: an
+ * unpaired caller never reaches the ontology. The instance key names the member or the task, so
+ * eve opens a separate client per member even when members share a group chat's session, and a
+ * task never shares a client with a member. A task session negotiates neither chat posting nor the
+ * chat's runtime source, and does not offer `chat_post_message`.
  */
 export declare function ontologyConnection(input: {
     readonly principal: SessionAuthContext | null;
@@ -40,4 +40,6 @@ export declare function ontologyConnection(input: {
     /** Trusted deployment capability (or authenticated handshake), never model input. */
     readonly chatPosting?: boolean;
     readonly runtimeSource?: boolean;
+    /** Reads a task's live secret; the session's task state unless a test passes another. */
+    readonly secret?: (taskId: string) => string | undefined;
 }): McpClientConnectionDefinition | null;

package/dist/extension/lib/ontology-connection.mjs

@@ -5,48 +5,68 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { appOrigin } from "./environment.mjs";
-import { c as compatibleRuntimeEnvelope, i as memberIdOf, r as identityProviderOf, u as runtimeEnvelope } from "../../_chunks/principal-DFcIfKSa.mjs";
 import { runtimeToken, tokenExpiry } from "./runtime-token.mjs";
-import { CHAT_POST_ENVELOPE, chatPostDigest, chatPostOperationId, isChatPost } from "./chat-post-confirmation.mjs";
+import { c as compatibleRuntimeEnvelope, u as runtimeEnvelope } from "../../_chunks/principal-69qoDdqy.mjs";
+import { ACT_AS_HEADER, ActorRequiredError, actorHeaders, actorKey, actorOf } from "./actor.mjs";
+import { CHAT_POST_ENVELOPE, CHAT_POST_TOOL, chatPostDigest, chatPostOperationId, isChatPost } from "./chat-post-confirmation.mjs";
 import { actionApproval, confirmations } from "./confirmations.mjs";
 import { ontologyTools } from "./ontology-tools.mjs";
 import { defineMcpClientConnection } from "eve/connections";
-const ACT_AS_HEADER = "X-SegmentStream-Act-As";
-const DESCRIPTION = "The company's ontology: its records, their history, and the actions that change them, narrowed to what the member you act for may read and do. Use describe for the compact entity index or discover for metadata search, then describe relevant refs for complete definitions. Call me for the member. Older ontologies without discover provide the legacy catalog through describe.";
-var MemberRequiredError = class extends Error {
-	name = "MemberRequiredError";
-};
+const DESCRIPTION = "The company's ontology: its records, their history, and the actions that change them, narrowed to what the user you act for may read and do. Use describe for the compact entity index or discover for metadata search, then describe relevant refs for complete definitions. Call me for that user. Older ontologies without discover provide the legacy catalog through describe.";
 function actAsHeaders(input) {
-	const memberId = memberIdOf(input.principal);
-	if (memberId === void 0) throw new MemberRequiredError("The ontology is reachable only for a member paired with this agent.");
-	if (memberId !== input.expectedMemberId) throw new MemberRequiredError("The ontology connection was opened for another member.");
-	const provider = identityProviderOf(input.principal);
-	return {
-		[ACT_AS_HEADER]: memberId,
-		...provider === void 0 ? {} : { "X-SegmentStream-Identity-Provider": provider }
-	};
+	const actor = actorOf(input.principal);
+	if (actor === void 0) throw new ActorRequiredError("The ontology is reachable only for a member paired with this agent or a live task.");
+	if (actorKey(actor) !== actorKey(input.expected)) throw new ActorRequiredError("The ontology connection was opened for another member or task.");
+	return actorHeaders({
+		actor,
+		principal: input.principal,
+		secret: input.secret
+	});
 }
 function ontologyConnection(input) {
-	const memberId = memberIdOf(input.principal);
-	if (memberId === void 0) return null;
+	const actor = actorOf(input.principal);
+	if (actor === void 0) return null;
 	const origin = appOrigin(input.environment ?? process.env);
 	const token = input.token ?? runtimeToken;
-	const chatProtocol = input.chatPosting ? ":chat-post-v1" : "";
-	const sourceProtocol = input.runtimeSource ? ":runtime-source-v1" : "";
-	return defineMcpClientConnection({
+	const headers = (context) => actAsHeaders({
+		principal: context.session.auth.current,
+		expected: actor,
+		secret: input.secret
+	});
+	const common = {
 		url: `${origin}/mcp`,
 		protocolVersionDiscovery: false,
 		description: DESCRIPTION,
-		instanceKey: `${origin}/mcp#member:${memberId}${chatProtocol}${sourceProtocol}`,
 		approval: actionApproval({
 			...ontologyTools(input),
 			texts: input.texts
 		}),
+		auth: {
+			principalType: "app",
+			getToken: async () => {
+				const value = await token();
+				const expiresAt = tokenExpiry(value);
+				return expiresAt === void 0 ? { token: value } : {
+					token: value,
+					expiresAt
+				};
+			}
+		},
+		headers
+	};
+	if (actor.kind === "task") return defineMcpClientConnection({
+		...common,
+		instanceKey: `${origin}/mcp#task:${actor.taskId}`,
+		tools: { block: [CHAT_POST_TOOL] }
+	});
+	const memberId = actor.memberId;
+	const chatProtocol = input.chatPosting ? ":chat-post-v1" : "";
+	const sourceProtocol = input.runtimeSource ? ":runtime-source-v1" : "";
+	return defineMcpClientConnection({
+		...common,
+		instanceKey: `${origin}/mcp#member:${memberId}${chatProtocol}${sourceProtocol}`,
 		...input.chatPosting || input.runtimeSource ? { toolCall: { providedArguments: { [CHAT_POST_ENVELOPE]: (ctx) => {
-			actAsHeaders({
-				principal: ctx.session.auth.current,
-				expectedMemberId: memberId
-			});
+			headers(ctx);
 			const base = compatibleRuntimeEnvelope(runtimeEnvelope({
 				principal: ctx.session.auth.current,
 				sessionId: ctx.session.id,
@@ -70,22 +90,7 @@ function ontologyConnection(input) {
 					digest: chatPostDigest(preview)
 				}
 			};
-		} } } } : {},
-		auth: {
-			principalType: "app",
-			getToken: async () => {
-				const value = await token();
-				const expiresAt = tokenExpiry(value);
-				return expiresAt === void 0 ? { token: value } : {
-					token: value,
-					expiresAt
-				};
-			}
-		},
-		headers: (context) => actAsHeaders({
-			principal: context.session.auth.current,
-			expectedMemberId: memberId
-		})
+		} } } } : {}
 	});
 }
-export { ACT_AS_HEADER, MemberRequiredError, actAsHeaders, ontologyConnection };
+export { ACT_AS_HEADER, actAsHeaders, ontologyConnection };