@segmentstream/agent 0.20.3 → 0.21.1

package/dist/extension/lib/ontology-file-call.mjs

@@ -4,7 +4,8 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { i as memberIdOf, u as runtimeEnvelope } from "../../_chunks/principal-DFcIfKSa.mjs";
+import { u as runtimeEnvelope } from "../../_chunks/principal-69qoDdqy.mjs";
+import { actorKey, actorOf } from "./actor.mjs";
 import { isChatPost } from "./chat-post-confirmation.mjs";
 import { actionApproval, confirmations, inputHash } from "./confirmations.mjs";
 import { ontologyTools } from "./ontology-tools.mjs";
@@ -21,6 +22,9 @@ function receipt(saved, dispatched = saved.dispatched) {
 		...dispatched ? { dispatched } : {}
 	};
 }
+function ownerOf(actor) {
+	return actor === void 0 ? void 0 : actor.kind === "member" ? actor.memberId : actorKey(actor);
+}
 function releaseOntologyFilePayloads() {
 	snapshots.update((all) => Object.fromEntries(Object.entries(all).map(([id, saved]) => [id, receipt(saved)])));
 }
@@ -35,27 +39,27 @@ function releasePayload(callId) {
 }
 function ontologyFileCall(texts) {
 	const policy = (principal) => actionApproval({
-		labels: async (memberId, _action, input) => {
-			const saved = bound(input, memberId);
-			return ontologyTools({ principal }).labels(memberId, saved.name, saved.arguments);
+		labels: async (actor, _action, input) => {
+			const saved = bound(input, ownerOf(actor));
+			return ontologyTools({ principal }).labels(actor, saved.name, saved.arguments);
 		},
-		describe: async (memberId, _action, input) => {
-			const saved = bound(input, memberId);
-			return ontologyTools({ principal }).describe(memberId, saved.name, saved.arguments);
+		describe: async (actor, _action, input) => {
+			const saved = bound(input, ownerOf(actor));
+			return ontologyTools({ principal }).describe(actor, saved.name, saved.arguments);
 		},
 		texts
 	});
-	function bound(input, memberId) {
+	function bound(input, owner) {
 		const saved = snapshots.get()[String(input.snapshot)];
-		if (saved === void 0 || saved.memberId !== memberId || saved.dispatched || saved.arguments === void 0) throw new Error("The file call is unavailable or already dispatched.");
+		if (saved === void 0 || saved.memberId !== owner || saved.dispatched || saved.arguments === void 0) throw new Error("The file call is unavailable or already dispatched.");
 		return {
 			...saved,
 			arguments: saved.arguments
 		};
 	}
-	function request(callId, input, memberId) {
+	function request(callId, input, owner) {
 		const saved = snapshots.get()[callId];
-		if (saved === void 0 || saved.memberId !== memberId || saved.requestHash !== inputHash(input)) throw new Error("The file call belongs to another member or input.");
+		if (saved === void 0 || saved.memberId !== owner || saved.requestHash !== inputHash(input)) throw new Error("The file call belongs to another member or input.");
 		return {
 			snapshot: callId,
 			digest: saved.digest
@@ -83,11 +87,11 @@ function ontologyFileCall(texts) {
 		approval: {
 			async request(ctx) {
 				try {
-					const memberId = memberIdOf(ctx.session.auth.current);
+					const owner = ownerOf(actorOf(ctx.session.auth.current));
 					const input = ctx.toolInput;
-					if (memberId === void 0 || input === void 0 || isChatPost(input.name) || input.name.startsWith("ontology_") || input.name.includes("__") || !/^[a-z][a-z0-9_]*$/.test(input.name)) return {
+					if (owner === void 0 || input === void 0 || isChatPost(input.name) || input.name.startsWith("ontology_") || input.name.includes("__") || !/^[a-z][a-z0-9_]*$/.test(input.name)) return {
 						type: "denied",
-						reason: "A paired member and a direct ontology tool are required."
+						reason: "A paired member or a task, and a direct ontology tool, are required."
 					};
 					if (snapshots.get()[ctx.callId] === void 0) {
 						const { content } = await sandboxFile(ctx, input.arguments_file, { maximumBytes: 1048576 });
@@ -97,7 +101,7 @@ function ontologyFileCall(texts) {
 						snapshots.update((all) => ({
 							...all,
 							[ctx.callId]: {
-								memberId,
+								memberId: owner,
 								requestHash: inputHash(input),
 								name: input.name,
 								digest: inputHash(args),
@@ -107,7 +111,7 @@ function ontologyFileCall(texts) {
 					}
 					const decision = await policy(ctx.session.auth.current).request({
 						...ctx,
-						toolInput: request(ctx.callId, input, memberId)
+						toolInput: request(ctx.callId, input, owner)
 					});
 					if (decision === "denied" || decision === false || typeof decision === "object" && decision?.type === "denied") {
 						const current = confirmations.get()[ctx.callId];
@@ -128,7 +132,7 @@ function ontologyFileCall(texts) {
 						...ctx,
 						request: {
 							...ctx.request,
-							toolInput: request(ctx.request.callId, ctx.request.toolInput, memberIdOf(ctx.request.principal))
+							toolInput: request(ctx.request.callId, ctx.request.toolInput, ownerOf(actorOf(ctx.request.principal)))
 						}
 					});
 					if (decision.status === "allowed" && ctx.response.decision === "deny") releasePayload(ctx.request.callId);
@@ -142,8 +146,9 @@ function ontologyFileCall(texts) {
 			}
 		},
 		async execute(input, ctx) {
-			const memberId = memberIdOf(ctx.session.auth.current);
-			const saved = bound(request(ctx.callId, input, memberId), memberId);
+			const actor = actorOf(ctx.session.auth.current);
+			const owner = ownerOf(actor);
+			const saved = bound(request(ctx.callId, input, owner), owner);
 			const confirmation = confirmations.get()[ctx.callId];
 			if (confirmation !== void 0 && confirmation.status !== "consumed") throw new Error("The file call has not been confirmed.");
 			const result = await ontologyTools({
@@ -154,13 +159,13 @@ function ontologyFileCall(texts) {
 					callId: ctx.callId
 				}),
 				beforeCall: async () => {
-					bound({ snapshot: ctx.callId }, memberId);
+					bound({ snapshot: ctx.callId }, owner);
 					snapshots.update((all) => ({
 						...all,
 						[ctx.callId]: receipt(saved, true)
 					}));
 				}
-			}).rpc(memberId, "tools/call", {
+			}).rpc(actor, "tools/call", {
 				name: saved.name,
 				arguments: saved.arguments
 			});

package/dist/extension/lib/ontology-tools.d.ts

@@ -1,5 +1,6 @@
 import { type RuntimeEnvelope } from "./runtime-envelope.js";
 import type { SessionAuthContext } from "eve/context";
+import { type OntologyActor } from "./actor.js";
 import type { ActionAnnotations } from "./confirmations.js";
 import { type Environment } from "./environment.js";
 import { type RuntimeToken } from "./runtime-token.js";
@@ -27,21 +28,23 @@ export declare function ontologyTools(options?: {
     readonly fetch?: typeof fetch;
     /** Install a durable dispatch fence after safe metadata/auth work, immediately before the action request. */
     readonly beforeCall?: (name: string) => Promise<void>;
+    /** Reads a task's live secret; the session's task state unless a test passes another. */
+    readonly secret?: (taskId: string) => string | undefined;
     /**
-     * What a tools/list said about runtime-source support, per member, shared by the clients of
-     * one caller. A large catalog's listing takes megabytes and seconds; without it, every client
+     * What a tools/list said about runtime-source support, per member or task, shared by the
+     * clients of one caller. A large catalog's listing takes megabytes and seconds; without it, every client
      * lists the whole catalog again before its first call.
      */
     readonly runtimeSources?: Map<string, boolean>;
 }): {
-    rpc: (memberId: string, method: string, params: Record<string, unknown>, signal?: AbortSignal) => Promise<Record<string, unknown>>;
-    list(memberId: string): Promise<Record<string, unknown>[]>;
-    supportsRuntimeSource(memberId: string, signal?: AbortSignal): Promise<boolean>;
-    supportsChatPosting(memberId: string): Promise<boolean>;
-    labels(memberId: string, action: string, input?: Readonly<Record<string, unknown>>, signal?: AbortSignal): Promise<ActionAnnotations>;
-    describe(memberId: string, action: string, input: Readonly<Record<string, unknown>>): Promise<import("./confirmation-description.js").ConfirmationDescription>;
+    rpc: (actor: OntologyActor, method: string, params: Record<string, unknown>, signal?: AbortSignal) => Promise<Record<string, unknown>>;
+    list(actor: OntologyActor): Promise<Record<string, unknown>[]>;
+    supportsRuntimeSource(actor: OntologyActor, signal?: AbortSignal): Promise<boolean>;
+    supportsChatPosting(actor: OntologyActor): Promise<boolean>;
+    labels(actor: OntologyActor, action: string, input?: Readonly<Record<string, unknown>>, signal?: AbortSignal): Promise<ActionAnnotations>;
+    describe(actor: OntologyActor, action: string, input: Readonly<Record<string, unknown>>): Promise<import("./confirmation-description.js").ConfirmationDescription>;
 };
-export declare function ontologyToolLabels(options?: Parameters<typeof ontologyTools>[0]): (memberId: string, action: string, input?: Readonly<Record<string, unknown>>, signal?: AbortSignal) => Promise<ActionAnnotations>;
+export declare function ontologyToolLabels(options?: Parameters<typeof ontologyTools>[0]): (actor: OntologyActor, action: string, input?: Readonly<Record<string, unknown>>, signal?: AbortSignal) => Promise<ActionAnnotations>;
 /** MCP normalizes an authored camelCase action to snake_case. */
 export declare function actionToolName(entity: string, action: string): string;
 /** One target contract for native and MCP attachment promotion; never trust supplied safety hints. */

package/dist/extension/lib/ontology-tools.mjs

@@ -4,11 +4,13 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { appOrigin } from "./environment.mjs";
-import { c as compatibleRuntimeEnvelope, i as memberIdOf, r as identityProviderOf, s as RUNTIME_SOURCE_PROTOCOL, u as runtimeEnvelope } from "../../_chunks/principal-DFcIfKSa.mjs";
 import { redactDiagnostic } from "./diagnostics.mjs";
-import { describeConfirmation, object } from "./confirmation-description.mjs";
+import { appOrigin } from "./environment.mjs";
 import { runtimeToken } from "./runtime-token.mjs";
+import "./agent-task.mjs";
+import { c as compatibleRuntimeEnvelope, s as RUNTIME_SOURCE_PROTOCOL, u as runtimeEnvelope } from "../../_chunks/principal-69qoDdqy.mjs";
+import { describeConfirmation, object } from "./confirmation-description.mjs";
+import { actorHeaders, actorKey, actorOf } from "./actor.mjs";
 import { describeChatPost, isChatPost, supportsChatPost } from "./chat-post-confirmation.mjs";
 import { randomUUID } from "node:crypto";
 var OntologyToolRejected = class extends Error {
@@ -29,29 +31,36 @@ var OntologyFileUnavailable = class extends Error {
 };
 function ontologyTools(options = {}) {
 	const runtimeSources = options.runtimeSources ?? new Map();
-	async function rpc(memberId, method, params, signal) {
+	async function rpc(actor, method, params, signal) {
+		const key = actorKey(actor);
+		const current = actorOf(options.principal);
+		const own = current !== void 0 && actorKey(current) === key ? options.principal : null;
 		if (method === "tools/call") {
-			const envelope = options.envelope ?? runtimeEnvelope({ principal: memberIdOf(options.principal) === memberId ? options.principal : null });
-			if (envelope.source !== void 0 && !runtimeSources.has(memberId)) await rpc(memberId, "tools/list", {}, signal);
+			const envelope = options.envelope ?? runtimeEnvelope({ principal: own });
+			if (envelope.source !== void 0 && !runtimeSources.has(key)) await rpc(actor, "tools/list", {}, signal);
 			params = {
 				...params,
 				arguments: {
 					...object(params.arguments),
-					_segmentstream: compatibleRuntimeEnvelope(envelope, runtimeSources.get(memberId) === true)
+					_segmentstream: compatibleRuntimeEnvelope(envelope, runtimeSources.get(key) === true)
 				}
 			};
 		}
-		const provider = memberIdOf(options.principal) === memberId ? identityProviderOf(options.principal) : void 0;
 		const credential = await (options.token ?? runtimeToken)();
 		const secrets = new Set([credential]);
 		if (method === "tools/call") await options.beforeCall?.(String(params.name));
 		try {
+			const acting = actorHeaders({
+				actor,
+				principal: own,
+				secret: options.secret
+			});
+			secrets.add(acting["X-SegmentStream-Agent-Task"] ?? "");
 			const response = await (options.fetch ?? fetch)(`${appOrigin(options.environment ?? process.env)}/mcp`, {
 				method: "POST",
 				headers: {
 					authorization: `Bearer ${credential}`,
-					"X-SegmentStream-Act-As": memberId,
-					...provider === void 0 ? {} : { "X-SegmentStream-Identity-Provider": provider },
+					...acting,
 					"content-type": "application/json",
 					accept: "application/json, text/event-stream",
 					"mcp-protocol-version": "2025-11-25"
@@ -69,7 +78,7 @@ function ontologyTools(options = {}) {
 			const body = object(await response.json());
 			if (body.error !== void 0) throw new Error("Ontology metadata unavailable.", { cause: body.error });
 			const result = object(body.result);
-			if (method === "tools/list" && Array.isArray(result.tools)) runtimeSources.set(memberId, result.tools.map(object).some((tool) => object(tool._meta)[RUNTIME_SOURCE_PROTOCOL] === 1));
+			if (method === "tools/list" && Array.isArray(result.tools)) runtimeSources.set(key, result.tools.map(object).some((tool) => object(tool._meta)[RUNTIME_SOURCE_PROTOCOL] === 1));
 			if (result.isError === true) {
 				const failure = object(result.structuredContent);
 				if (method === "tools/call" && params.name === "files_download" && failure.retryable === true && ["ontology_updating", "storage_unavailable"].includes(String(failure.error))) throw new OntologyFileUnavailable(String(failure.error), typeof failure.request_id === "string" ? failure.request_id : void 0, { cause: result });
@@ -104,13 +113,13 @@ function ontologyTools(options = {}) {
 			throw new Error(`The ontology request failed (${reference}).`, { cause: diagnostic });
 		}
 	}
-	async function toolFor(memberId, action, signal) {
-		const result = await rpc(memberId, "tools/list", {}, signal);
+	async function toolFor(actor, action, signal) {
+		const result = await rpc(actor, "tools/list", {}, signal);
 		const tools = Array.isArray(result.tools) ? result.tools.map(object) : [];
 		const bareName = action.split("__").at(-1);
 		let tool = tools.find((candidate) => candidate.name === bareName);
 		if (tool === void 0 && tools.some((item) => item.name === "ontology_describe_tool")) {
-			const inspected = await rpc(memberId, "tools/call", {
+			const inspected = await rpc(actor, "tools/call", {
 				name: "ontology_describe_tool",
 				arguments: { name: bareName }
 			}, signal);
@@ -123,17 +132,17 @@ function ontologyTools(options = {}) {
 			tools
 		};
 	}
-	async function resolve(memberId, action, input, signal, depth = 0) {
+	async function resolve(actor, action, input, signal, depth = 0) {
 		if (depth > 3) throw new Error("Too many nested ontology tools.");
-		const found = await toolFor(memberId, action, signal);
+		const found = await toolFor(actor, action, signal);
 		if (depth > 0 && isChatPost(String(found.tool.name))) throw new Error("Exact chat posting must use the direct chat_post_message tool.");
 		if (found.tool.name === "ontology_call_tool") {
 			if (typeof input.name !== "string") throw new Error("A target tool is required.");
-			return resolve(memberId, input.name, object(input.arguments), signal, depth + 1);
+			return resolve(actor, input.name, object(input.arguments), signal, depth + 1);
 		}
 		if (found.tool.name === "attachments_promote") {
 			const target = promotionTarget(input);
-			return resolve(memberId, target.action, target.input, signal, depth + 1);
+			return resolve(actor, target.action, target.input, signal, depth + 1);
 		}
 		return {
 			...found,
@@ -142,28 +151,28 @@ function ontologyTools(options = {}) {
 	}
 	return {
 		rpc,
-		async list(memberId) {
-			const result = await rpc(memberId, "tools/list", {});
+		async list(actor) {
+			const result = await rpc(actor, "tools/list", {});
 			return Array.isArray(result.tools) ? result.tools.map(object) : [];
 		},
-		async supportsRuntimeSource(memberId, signal) {
-			if (!runtimeSources.has(memberId)) await rpc(memberId, "tools/list", {}, signal);
-			return runtimeSources.get(memberId) === true;
+		async supportsRuntimeSource(actor, signal) {
+			if (!runtimeSources.has(actorKey(actor))) await rpc(actor, "tools/list", {}, signal);
+			return runtimeSources.get(actorKey(actor)) === true;
 		},
-		async supportsChatPosting(memberId) {
-			const result = await rpc(memberId, "tools/list", {});
+		async supportsChatPosting(actor) {
+			const result = await rpc(actor, "tools/list", {});
 			return Array.isArray(result.tools) && result.tools.map(object).some(supportsChatPost);
 		},
-		async labels(memberId, action, input = {}, signal) {
-			const { tool } = await resolve(memberId, action, input, signal);
+		async labels(actor, action, input = {}, signal) {
+			const { tool } = await resolve(actor, action, input, signal);
 			return {
 				...object(tool.annotations),
 				confirmation: object(object(tool.inputSchema).properties)._confirmation !== void 0
 			};
 		},
-		async describe(memberId, action, input) {
+		async describe(actor, action, input) {
 			const signal = AbortSignal.timeout(15e3);
-			const resolved = await resolve(memberId, action, input, signal);
+			const resolved = await resolve(actor, action, input, signal);
 			const { tool, tools } = resolved;
 			input = resolved.input;
 			action = String(tool.name);
@@ -171,7 +180,7 @@ function ontologyTools(options = {}) {
 				if (!supportsChatPost(tool)) throw new Error("The ontology does not support exact chat confirmations.");
 				const read = async (name, args) => {
 					if (!tools.some((candidate) => candidate.name === name && object(candidate.annotations).readOnlyHint === true)) throw new Error("The chat preview reads are unavailable.");
-					const result = await rpc(memberId, "tools/call", {
+					const result = await rpc(actor, "tools/call", {
 						name,
 						arguments: args
 					}, signal);
@@ -190,7 +199,7 @@ function ontologyTools(options = {}) {
 			}
 			let entities = [];
 			try {
-				const catalog = await rpc(memberId, "resources/read", { uri: "ontology://catalog" }, signal);
+				const catalog = await rpc(actor, "resources/read", { uri: "ontology://catalog" }, signal);
 				const text = object(Array.isArray(catalog.contents) ? catalog.contents[0] : void 0).text;
 				const manifest = object(typeof text === "string" ? JSON.parse(text) : void 0);
 				entities = Array.isArray(manifest.entities) ? manifest.entities.map(object) : [];
@@ -217,9 +226,9 @@ function ontologyTools(options = {}) {
 				async read(entityName, id) {
 					const name = actionToolName(entityName, "get");
 					try {
-						const permitted = (await toolFor(memberId, name, signal)).tool;
+						const permitted = (await toolFor(actor, name, signal)).tool;
 						if (object(permitted.annotations).readOnlyHint !== true) return;
-						const result = await rpc(memberId, "tools/call", {
+						const result = await rpc(actor, "tools/call", {
 							name,
 							arguments: { id }
 						}, signal);

package/dist/extension/lib/runtime-envelope.mjs

@@ -4,5 +4,5 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { c as compatibleRuntimeEnvelope, d as telegramRuntimeSource, l as principalRuntimeSource, s as RUNTIME_SOURCE_PROTOCOL, u as runtimeEnvelope } from "../../_chunks/principal-DFcIfKSa.mjs";
+import { c as compatibleRuntimeEnvelope, d as telegramRuntimeSource, l as principalRuntimeSource, s as RUNTIME_SOURCE_PROTOCOL, u as runtimeEnvelope } from "../../_chunks/principal-69qoDdqy.mjs";
 export { RUNTIME_SOURCE_PROTOCOL, compatibleRuntimeEnvelope, principalRuntimeSource, runtimeEnvelope, telegramRuntimeSource };

package/dist/extension/lib/sandbox-session.mjs

@@ -4,8 +4,8 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { posix } from "node:path";
 import { defineState } from "eve/context";
+import { posix } from "node:path";
 const SANDBOX_MARKER_PATH = "/workspace/.segmentstream/sandbox.json";
 const SANDBOX_ATTACHMENTS_DIRECTORY = "/workspace/.eve/attachments";
 const SANDBOX_MAXIMUM_AGE_MS = 864e5;

package/dist/extension/lib/stored-files.mjs

@@ -4,9 +4,10 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { i as memberIdOf } from "../../_chunks/principal-DFcIfKSa.mjs";
 import { redactDiagnostic } from "./diagnostics.mjs";
+import { i as memberIdOf } from "../../_chunks/principal-69qoDdqy.mjs";
 import { object } from "./confirmation-description.mjs";
+import { member } from "./actor.mjs";
 import { OntologyFileUnavailable, ontologyTools } from "./ontology-tools.mjs";
 import { createHash } from "node:crypto";
 async function readStoredFile(input, principal, options = {}) {
@@ -18,7 +19,7 @@ async function readStoredFile(input, principal, options = {}) {
 	});
 	const readGrant = async () => {
 		for (let attempt = 0;; attempt++) try {
-			return await tools.rpc(memberId, "tools/call", {
+			return await tools.rpc(member(memberId), "tools/call", {
 				name: "files_download",
 				arguments: input
 			});

package/dist/extension/lib/telegram/adapter.mjs

@@ -4,14 +4,15 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { appOrigin, channelsEnabled, proxyEnvironment, runtimeIdentityEnvironment, webhookSecret } from "../environment.mjs";
+import { runtimeToken } from "../runtime-token.mjs";
+import { runtimeTokenVerifier } from "../runtime-identity.mjs";
 import { telegramText, withTelegramTexts } from "./texts.mjs";
 import { manifestOf } from "../../config.mjs";
-import { appOrigin, channelsEnabled, proxyEnvironment, runtimeIdentityEnvironment, webhookSecret } from "../environment.mjs";
-import { n as conversationLanguage, o as telegramPrincipal } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { n as conversationLanguage, o as telegramPrincipal } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { object } from "../confirmation-description.mjs";
 import { confirmationLocale } from "./confirmation-text.mjs";
 import { telegramSendScope } from "./send-queue.mjs";
-import { runtimeToken } from "../runtime-token.mjs";
 import { conversations } from "../conversations.mjs";
 import { withDeliveryDiagnostics } from "./delivery-diagnostics.mjs";
 import { d as failureText, h as withDeliveryLocale, i as withReplacedText, m as safeTelegramFetch, n as currentInboundRequest, o as currentLocale, p as reportTelegramError, r as runInboundRequest, t as InboundRequest } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
@@ -23,7 +24,7 @@ import { MAXIMUM_DOWNLOAD_BYTES, connectionProxy } from "../connection-proxy.mjs
 import { dispatchStructuredMessage, structuredMessage } from "./structured.mjs";
 import { scopedAddress, sessionPolicy } from "./sessions.mjs";
 import { handleWorkspaceCallback, isWorkspaceCallback } from "./callbacks.mjs";
-import { t as agentBuild } from "../../../_chunks/build-metadata-Bgh-kwt7.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-kBu1knj6.mjs";
 import { attachmentLifecycle } from "./lifecycle.mjs";
 import { observedMessages } from "./observed.mjs";
 import { expireDeferredCards, handleDeferredCallback, isDeferredCallback } from "./deferred-confirmations.mjs";
@@ -34,7 +35,6 @@ import { agentIdentities } from "../identities.mjs";
 import { interimTexts, replyDelivery } from "./silent.mjs";
 import { handleConfirmationCallback, telegramConfirmationEvents } from "./confirmations.mjs";
 import { captureRouteDecider, captureTelegramFetch, conversationIdentities, recordGateDecision, telegramConversationCapture } from "./conversations.mjs";
-import { runtimeTokenVerifier } from "../runtime-identity.mjs";
 import { botIdentityCache } from "./bot.mjs";
 import { gatewayMediaCapabilities, planMedia } from "./media-policy.mjs";
 import { agentChats } from "./chats.mjs";

package/dist/extension/lib/telegram/attachments-send.mjs

@@ -4,15 +4,15 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { appOrigin, channelsEnabled, proxyEnvironment } from "../environment.mjs";
-import "../../../_chunks/principal-DFcIfKSa.mjs";
 import { redactDiagnostic } from "../diagnostics.mjs";
+import { appOrigin, channelsEnabled, proxyEnvironment } from "../environment.mjs";
+import { runtimeToken } from "../runtime-token.mjs";
+import "../../../_chunks/principal-69qoDdqy.mjs";
 import { confirmationLocale } from "./confirmation-text.mjs";
 import { inTelegramSendQueue, telegramSendScope } from "./send-queue.mjs";
-import { runtimeToken } from "../runtime-token.mjs";
 import { d as failureText, f as formattingRefused, l as customerMessage, p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
 import { MAXIMUM_PROXY_BODY_BYTES, connectionProxy } from "../connection-proxy.mjs";
-import { ACT_AS_HEADER } from "../ontology-connection.mjs";
+import { ACT_AS_HEADER } from "../actor.mjs";
 import { AttachmentError, CONVERSATION_HEADER, SESSION_HEADER } from "../attachments.mjs";
 import { TELEGRAM_PLACEHOLDER_TOKEN, TELEGRAM_PROXY_ORIGIN, telegramProxyFetch } from "./proxy-fetch.mjs";
 import { attachmentOwner } from "../attachment-tools.mjs";

package/dist/extension/lib/telegram/callbacks.mjs

@@ -6,7 +6,7 @@ __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { admitMessage } from "../admission.mjs";
 import { telegramText } from "./texts.mjs";
-import { d as telegramRuntimeSource, i as memberIdOf, o as telegramPrincipal, u as runtimeEnvelope } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { d as telegramRuntimeSource, i as memberIdOf, o as telegramPrincipal, u as runtimeEnvelope } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { object } from "../confirmation-description.mjs";
 import { n as currentInboundRequest, p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
 import { workspaceAction } from "./workspace-action.mjs";

package/dist/extension/lib/telegram/confirmation-expiry.mjs

@@ -4,10 +4,10 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { withTelegramTexts } from "./texts.mjs";
 import { proxyEnvironment } from "../environment.mjs";
-import { telegramSendScope } from "./send-queue.mjs";
 import { runtimeToken } from "../runtime-token.mjs";
+import { withTelegramTexts } from "./texts.mjs";
+import { telegramSendScope } from "./send-queue.mjs";
 import { conversations } from "../conversations.mjs";
 import { m as safeTelegramFetch, p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
 import { connectionProxy } from "../connection-proxy.mjs";

package/dist/extension/lib/telegram/confirmations.mjs

@@ -5,7 +5,7 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { telegramText } from "./texts.mjs";
-import { i as memberIdOf, o as telegramPrincipal } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { i as memberIdOf, o as telegramPrincipal } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { humanText } from "../confirmation-description.mjs";
 import { renderConfirmation, withConfirmationText } from "./confirmation-text.mjs";
 import { chatPostCard, chatPostCardStatus, chatPostReceipt, withChatPostCard } from "./chat-post-card.mjs";
@@ -17,9 +17,9 @@ import { confirmations } from "../confirmations.mjs";
 import { formatAddress, scopedAddress } from "./sessions.mjs";
 import { postDeferredCard } from "./deferred-confirmations.mjs";
 import { answerMarker, isPendingQuestion, pendingQuestions, questionKey } from "../questions.mjs";
+import { call } from "eve/events";
 import { createHash } from "node:crypto";
 import { telegramTextLinks } from "@segmentstream-cloud/ontology/telegram";
-import { call } from "eve/events";
 const PREFIX = "ss-confirm:";
 function shortHash(value) {
 	return createHash("sha256").update(value).digest("hex").slice(0, 20);

package/dist/extension/lib/telegram/deferred-confirmations.mjs

@@ -5,7 +5,7 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { telegramText, withTelegramLocale } from "./texts.mjs";
-import { o as telegramPrincipal } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { o as telegramPrincipal } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { humanText } from "../confirmation-description.mjs";
 import { renderConfirmation, withConfirmationText } from "./confirmation-text.mjs";
 import { chatPostCard, chatPostCardStatus, chatPostReceipt, withChatPostCard } from "./chat-post-card.mjs";

package/dist/extension/lib/telegram/durable-typing.mjs

@@ -5,8 +5,8 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { channelsEnabled, proxyEnvironment } from "../environment.mjs";
-import { redactTelegramDiagnostic } from "./diagnostic-redaction.mjs";
 import { runtimeToken } from "../runtime-token.mjs";
+import { redactTelegramDiagnostic } from "./diagnostic-redaction.mjs";
 import { conversationEvent, conversations } from "../conversations.mjs";
 import { p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
 import { connectionProxy } from "../connection-proxy.mjs";

package/dist/extension/lib/telegram/files.mjs

@@ -4,7 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { n as conversationLanguage } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { n as conversationLanguage } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { d as failureText, p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
 import { describableImage, describeReceivedImage } from "./images.mjs";
 import { MAXIMUM_ATTACHMENT_BYTES, attachmentUrl } from "../attachments.mjs";

package/dist/extension/lib/telegram/health.mjs

@@ -4,8 +4,8 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { t as agentBuild } from "../../../_chunks/build-metadata-Bgh-kwt7.mjs";
 import { runtimeRequestFailure } from "./runtime-request.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-kBu1knj6.mjs";
 import { GET } from "eve/channels";
 const HEALTH_ROUTE = "/eve/v1/telegram/health";
 function healthRoute(input) {

package/dist/extension/lib/telegram/held-approvals.d.ts

@@ -22,6 +22,6 @@ export declare function releaseHeldApproval(input: {
     turnId: string;
     startedAt: string;
     actions: string[];
-    cancellation: "cancelled" | "failed" | "completed" | "awaiting-input";
+    cancellation: "completed" | "failed" | "cancelled" | "awaiting-input";
     executionRequested: boolean;
 } | undefined>;

package/dist/extension/lib/telegram/inbound.mjs

@@ -6,7 +6,7 @@ __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { effectiveGroupPolicy, groupPolicy } from "../group-routing/policy.mjs";
 import { admitMessage, localizedText } from "../admission.mjs";
-import { d as telegramRuntimeSource, n as conversationLanguage, o as telegramPrincipal, u as runtimeEnvelope } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { d as telegramRuntimeSource, n as conversationLanguage, o as telegramPrincipal, u as runtimeEnvelope } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
 import { addressingReason, conversationKey, otherRecipient } from "../group-routing/signals.mjs";
 import { conversationAddressing, conversationState } from "../group-routing/conversation.mjs";

package/dist/extension/lib/telegram/lifecycle.mjs

@@ -4,12 +4,13 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { d as telegramRuntimeSource, l as principalRuntimeSource, u as runtimeEnvelope } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { d as telegramRuntimeSource, l as principalRuntimeSource, u as runtimeEnvelope } from "../../../_chunks/principal-69qoDdqy.mjs";
 import { object } from "../confirmation-description.mjs";
 import { n as currentInboundRequest, p as reportTelegramError } from "../../../_chunks/inbound-request-gJ5wpsBF.mjs";
+import { member } from "../actor.mjs";
 import { needsConfirmation } from "../confirmations.mjs";
 import { OntologyActionNotPermitted, actionToolName, ontologyTools } from "../ontology-tools.mjs";
-import { t as agentBuild } from "../../../_chunks/build-metadata-Bgh-kwt7.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-kBu1knj6.mjs";
 var AttachmentLifecycleNotPermitted = class extends Error {
 	code = "attachment_lifecycle_not_permitted";
 };
@@ -52,11 +53,11 @@ function attachmentLifecycle(options) {
 				source: source()
 			})
 		});
-		const labels = await tools.labels(options.memberId, action, input).catch((error) => {
+		const labels = await tools.labels(member(options.memberId), action, input).catch((error) => {
 			throw error instanceof OntologyActionNotPermitted ? new AttachmentLifecycleNotPermitted("The sender may not run the lifecycle action.", { cause: error }) : error;
 		});
 		if (needsConfirmation(labels)) throw new Error("An attachment lifecycle hook must be a permitted routine action.");
-		const raw = await tools.rpc(options.memberId, "tools/call", {
+		const raw = await tools.rpc(member(options.memberId), "tools/call", {
 			name: action,
 			arguments: input
 		});
@@ -64,7 +65,7 @@ function attachmentLifecycle(options) {
 		if (object(envelope.validation).ok === false) throw new Error("The attachment lifecycle action rejected its event.");
 		const result = object(envelope.result ?? envelope);
 		const retention = object(result.retain);
-		if (typeof retention.entity === "string" && typeof retention.action === "string" && needsConfirmation(await tools.labels(options.memberId, actionToolName(retention.entity, retention.action), object(retention.input)))) throw new Error("Automatic retention requires a permitted routine storage action.");
+		if (typeof retention.entity === "string" && typeof retention.action === "string" && needsConfirmation(await tools.labels(member(options.memberId), actionToolName(retention.entity, retention.action), object(retention.input)))) throw new Error("Automatic retention requires a permitted routine storage action.");
 		return {
 			...typeof result.dispatch === "boolean" ? { dispatch: result.dispatch } : {},
 			...typeof result.dispatch_token === "string" ? { dispatchToken: result.dispatch_token } : {},

package/dist/extension/lib/telegram/principal.d.ts

@@ -18,7 +18,10 @@ export declare function telegramPrincipal(input: {
 }): SessionAuthContext;
 /** Short answers and attachment-only turns retain the recent chat language when known. */
 export declare function conversationLanguage(texts: readonly string[]): "ru" | "en" | undefined;
-/** The member a session principal acts for: `memberId` stamped by a SegmentStream channel. */
+/**
+ * The member a session principal acts for: `memberId` stamped by a SegmentStream channel. A task
+ * session acts for no member; `actorOf` in `lib/actor.ts` names whom any session acts for.
+ */
 export declare function memberIdOf(principal: SessionAuthContext | null | undefined): string | undefined;
 /** The member's roles on a session principal; empty when it carries none. */
 export declare function rolesOf(principal: SessionAuthContext | null | undefined): ReadonlyArray<string>;

package/dist/extension/lib/telegram/principal.mjs

@@ -4,5 +4,5 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { a as rolesOf, i as memberIdOf, n as conversationLanguage, o as telegramPrincipal, r as identityProviderOf, t as TELEGRAM_AUTHENTICATOR } from "../../../_chunks/principal-DFcIfKSa.mjs";
+import { a as rolesOf, i as memberIdOf, n as conversationLanguage, o as telegramPrincipal, r as identityProviderOf, t as TELEGRAM_AUTHENTICATOR } from "../../../_chunks/principal-69qoDdqy.mjs";
 export { TELEGRAM_AUTHENTICATOR, conversationLanguage, identityProviderOf, memberIdOf, rolesOf, telegramPrincipal };

package/dist/extension/lib/telegram/silent.mjs

@@ -4,7 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import "../../../_chunks/principal-DFcIfKSa.mjs";
+import "../../../_chunks/principal-69qoDdqy.mjs";
 import { confirmationLocale } from "./confirmation-text.mjs";
 import { splitTelegramText } from "./format.mjs";
 import { inTelegramSendQueue } from "./send-queue.mjs";