@tangle-network/agent-app 0.49.4 → 0.49.5

package/dist/design-canvas-react/index.js

@@ -43,6 +43,10 @@ import {
   selectTickStep
 } from "../chunk-KWN5PGXM.js";
 import "../chunk-Q2QKEV6J.js";
+import {
+  DesignCanvasChromeLazy,
+  DesignCanvasLazy
+} from "../chunk-WAMJSZYB.js";
 import "../chunk-ZN5J47UX.js";
 import {
   DEFAULT_INSERT_TEMPLATES,
@@ -90,10 +94,6 @@ import {
   bleedAwareExportBounds,
   scaleForPreset
 } from "../chunk-BWQPVS7D.js";
-import {
-  DesignCanvasChromeLazy,
-  DesignCanvasLazy
-} from "../chunk-WAMJSZYB.js";
 import "../chunk-EA4UVS4T.js";
 import "../chunk-TXD5HXLE.js";
 

package/dist/hosted-agent/index.d.ts

@@ -0,0 +1,139 @@
+import { type HubProviderEvent } from '@tangle-network/hub-sdk';
+import type { AgentProfile } from '@tangle-network/sandbox';
+/**
+ * A hosted agent: a person texts or calls a line, and the agent answers from
+ * that person's own isolated sandbox. The developer's Tangle API key pays for
+ * every box, model turn and reply.
+ *
+ * Each person gets one fresh isolated box built from the published profile,
+ * never a copy of the developer's box. Later messages resume the same box and
+ * the same conversation, so text and voice share one memory. A box the
+ * platform deleted is replaced by a fresh one instead of blocking the person.
+ *
+ * Every step is idempotent by the message's turn id: a retried delivery
+ * settles the same sandbox turn and replays the same Hub send. So the caller
+ * may retry any failure, and needs no dedupe table.
+ */
+/** Durable key-value storage. A Cloudflare KV namespace satisfies it. */
+export interface HostedAgentStore {
+    get(key: string): Promise<string | null>;
+    put(key: string, value: string, options?: {
+        expirationTtl?: number;
+    }): Promise<void>;
+}
+export type HostedChannel = 'imessage' | 'voice';
+export interface HostedMessage {
+    /** The sender's address as the channel delivered it: E.164 for a phone. */
+    userId: string;
+    channel: HostedChannel;
+    text: string;
+    /** Stable per logical message. Reusing it settles the same turn. */
+    turnId: string;
+}
+/** What the allowance hook decides for one new message. */
+export type Allowance = 'answer' | 'ignore' | {
+    reply: string;
+};
+export interface HostedAgentConfig {
+    /** The developer's Tangle API key (Sandbox and Hub). */
+    apiKey: string;
+    /** The persona, model and tools every person's box runs. */
+    profile: AgentProfile;
+    /** Backend harness type, such as `opencode`; the runtime default when omitted. */
+    harness?: string;
+    store: HostedAgentStore;
+    /** Answers per person per UTC day before `allow` must decide. Default 20. */
+    freeTurnsPerDay?: number;
+    /**
+     * Decide a new message after the free allowance is used, for example reply
+     * with a checkout link. Without it, a person past the allowance is told to
+     * come back tomorrow. Retries of an admitted message never reach this hook.
+     */
+    allow?: (message: HostedMessage, usedToday: number) => Allowance | Promise<Allowance>;
+    /** Shared secret for the ph0ny call hook and `ask_workspace` webhook tool. */
+    voiceSecret?: string;
+    /** How long one `ask_workspace` call may wait before it returns a ticket. Default 8 s. */
+    voiceBudgetMs?: number;
+    box?: Partial<BoxPolicy>;
+    turnWallCapMs?: number;
+    sandboxUrl?: string;
+    hubUrl?: string;
+}
+export interface BoxPolicy {
+    cpuCores: number;
+    memoryMB: number;
+    diskGB: number;
+    idleTimeoutSeconds: number;
+    maxLifetimeSeconds: number;
+    deleteAfterStoppedSeconds: number;
+    /** Egress allow-list. The default reaches the model router only. */
+    allowDomains: string[];
+}
+export declare const DEFAULT_BOX_POLICY: BoxPolicy;
+export type AskResult = {
+    state: 'answered';
+    text: string;
+} | {
+    state: 'declined';
+    reply?: string;
+} | {
+    state: 'pending';
+};
+/** A Hub delivery that passed authentication, in a form a queue can carry. */
+export interface HostedInbound {
+    runId: string;
+    connectionId: string;
+    event: HubProviderEvent;
+}
+export declare const NOTICE: {
+    readonly stopped: 'You are unsubscribed. Text START to talk again.';
+    readonly started: 'Welcome back. Text me anytime. Reply STOP to stop.';
+    readonly limit: 'You have used today\'s free messages. Talk tomorrow!';
+    readonly unavailable: 'Sorry, I could not answer that just now. Please try again in a minute.';
+};
+/** One address per person: E.164 for anything phone-shaped, else lowercase. */
+export declare function normalizeAddress(value: string): string | null;
+export declare class HostedAgentError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function createHostedAgent(config: HostedAgentConfig): {
+    ask: (message: HostedMessage, options: {
+        deadline: number;
+    }) => Promise<AskResult>;
+    /**
+     * One-time setup: route an Inkbox iMessage identity's messages, connected
+     * to Hub under the developer's account, to `callbackUrl`, and allow the
+     * one reply action on that connection. Safe to repeat.
+     */
+    connect(input: {
+        connectionId: string;
+        identityId: string;
+        callbackUrl: string;
+        secret: string;
+    }): Promise<import("@tangle-network/hub-sdk").HubEventSubscription>;
+    /** The Hub callback. Authenticates within Hub's 10 s budget and runs nothing. */
+    receive(request: Request, secret: string): Promise<{
+        response: Response;
+        inbound?: HostedInbound;
+    }>;
+    /**
+     * Answer one inbound message and send the reply through Hub. Returns
+     * 'pending' while the turn still runs; call again with the same inbound.
+     * On `lastAttempt`, a failure is answered with an apology instead of thrown.
+     */
+    respond(inbound: HostedInbound, options?: {
+        lastAttempt?: boolean;
+    }): Promise<'replied' | 'ignored' | 'pending'>;
+    /**
+     * ph0ny's call hook. `admit` returns a call token bound to the caller's
+     * number from the carrier's signed call record, never from the model.
+     */
+    voiceHook(request: Request): Promise<Response>;
+    /**
+     * ph0ny's `ask_workspace` webhook tool, configured with `forwardCallToken`.
+     * A slow turn returns a ticket; the voice agent asks again with it.
+     */
+    voiceAsk(request: Request): Promise<Response>;
+};
+export type HostedAgent = ReturnType<typeof createHostedAgent>;

package/dist/hosted-agent/index.js

@@ -0,0 +1,254 @@
+// src/hosted-agent/index.ts
+import { authenticateHubEventRequest, HubClient } from "@tangle-network/hub-sdk";
+import { buildMessagingReply, normalizeConversationEvent } from "@tangle-network/agent-integrations/conversation-events";
+import { Sandbox } from "@tangle-network/sandbox/core";
+var DEFAULT_BOX_POLICY = {
+  cpuCores: 1,
+  memoryMB: 2048,
+  diskGB: 10,
+  idleTimeoutSeconds: 600,
+  maxLifetimeSeconds: 86400,
+  deleteAfterStoppedSeconds: 7 * 86400,
+  allowDomains: ["router.tangle.tools"]
+};
+var NOTICE = {
+  stopped: "You are unsubscribed. Text START to talk again.",
+  started: "Welcome back. Text me anytime. Reply STOP to stop.",
+  limit: "You have used today's free messages. Talk tomorrow!",
+  unavailable: "Sorry, I could not answer that just now. Please try again in a minute."
+};
+var IMESSAGE_EVENT = "inkbox.imessage.received";
+var IMESSAGE_REPLY = "inkbox.imessage.reply";
+var STOP = /^(stop|stopall|unsubscribe|cancel|end|quit)$/i;
+var START = /^(start|unstop|resume)$/i;
+var TWO_DAYS = 2 * 86400;
+var RESUMABLE = /* @__PURE__ */ new Set(["stopped", "expired"]);
+var GONE = /* @__PURE__ */ new Set(["failed", "deleted"]);
+var encode = (text) => new TextEncoder().encode(text);
+var hex = (bytes) => Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
+var sha256 = async (value) => hex(await crypto.subtle.digest("SHA-256", encode(value)));
+async function hmac(secret, value) {
+  const key = await crypto.subtle.importKey("raw", encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return hex(await crypto.subtle.sign("HMAC", key, encode(value)));
+}
+async function equal(given, expected) {
+  if (!given) return false;
+  const [a, b] = await Promise.all([sha256(given), sha256(expected)]);
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+var b64 = (text) => btoa(String.fromCharCode(...encode(text))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var unb64 = (text) => new TextDecoder().decode(Uint8Array.from(atob(text.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0)));
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var json = (body, status = 200) => Response.json(body, { status });
+var describe = (error) => (error instanceof Error ? `${error.name}: ${error.message}` : String(error)).replace(/sk-tan-[\w-]+|Bearer\s+\S+/g, "<redacted>").slice(0, 400);
+function normalizeAddress(value) {
+  const trimmed = value.trim();
+  if (trimmed.includes("@")) return trimmed.toLowerCase();
+  const digits = trimmed.replace(/[^\d]/g, "");
+  if (digits.length < 8 || digits.length > 15) return null;
+  return `+${digits.length === 10 && !trimmed.startsWith("+") ? `1${digits}` : digits}`;
+}
+var HostedAgentError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "HostedAgentError";
+  }
+  code;
+};
+function createHostedAgent(config) {
+  const store = config.store;
+  const policy = { ...DEFAULT_BOX_POLICY, ...config.box };
+  const wallCapMs = config.turnWallCapMs ?? 12e4;
+  const sandbox = new Sandbox({ apiKey: config.apiKey, baseUrl: config.sandboxUrl ?? "https://sandbox.tangle.tools", timeoutMs: 2e4 });
+  const hub = new HubClient({ baseUrl: config.hubUrl ?? "https://id.tangle.tools", apiKey: config.apiKey });
+  const backend = { ...config.harness ? { type: config.harness } : {}, profile: config.profile };
+  const profileTag = sha256(JSON.stringify(config.profile)).then((hash) => hash.slice(0, 8));
+  async function ensureBox(user, deadline) {
+    const key = `box:${user}`;
+    const known = await store.get(key);
+    let box = known ? await sandbox.get(known) : null;
+    if (!box || GONE.has(box.status)) {
+      box = await sandbox.createIsolated({
+        name: `hosted-${user.slice(0, 24)}`,
+        idempotencyKey: known ? `hosted-${user}-after-${known}` : `hosted-${user}`,
+        resources: { cpuCores: policy.cpuCores, memoryMB: policy.memoryMB, diskGB: policy.diskGB },
+        backend,
+        secrets: [],
+        sshEnabled: false,
+        egressPolicy: { mode: "strict", allowDomains: policy.allowDomains, includeImplicitDomains: false },
+        idleTimeoutSeconds: policy.idleTimeoutSeconds,
+        maxLifetimeSeconds: policy.maxLifetimeSeconds,
+        deleteAfterStoppedSeconds: policy.deleteAfterStoppedSeconds,
+        metadata: { hostedUser: user }
+      });
+      await store.put(key, box.id);
+    }
+    if (RESUMABLE.has(box.status)) await box.resume();
+    if (box.status === "running") return box;
+    const timeoutMs = deadline - Date.now();
+    if (timeoutMs < 1e3) return null;
+    try {
+      return await sandbox.waitForRunning(box.id, { timeoutMs });
+    } catch (error) {
+      if (error instanceof Error && error.name === "TimeoutError") return null;
+      throw error;
+    }
+  }
+  async function admit(message, user) {
+    const stopKey = `stop:${user}`;
+    if (message.channel !== "voice" && STOP.test(message.text.trim())) {
+      await store.put(stopKey, "1");
+      return { reply: NOTICE.stopped };
+    }
+    if (message.channel !== "voice" && START.test(message.text.trim())) {
+      await store.put(stopKey, "");
+      return { reply: NOTICE.started };
+    }
+    if (await store.get(stopKey)) return "ignore";
+    const dayKey = `turns:${user}:${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
+    const used = Number(await store.get(dayKey) ?? 0);
+    const decision = used < (config.freeTurnsPerDay ?? 20) ? "answer" : config.allow ? await config.allow(message, used) : { reply: NOTICE.limit };
+    if (decision === "answer") await store.put(dayKey, String(used + 1), { expirationTtl: TWO_DAYS });
+    return decision;
+  }
+  async function ask(message, options) {
+    const text = message.text.trim();
+    if (!text || text.length > 8e3 || !/^[\w-]{1,120}$/.test(message.turnId)) return { state: "declined" };
+    const user = (await sha256(message.userId)).slice(0, 32);
+    const admittedKey = `turn:${user}:${message.turnId}`;
+    if (!await store.get(admittedKey)) {
+      const decision = await admit(message, user);
+      if (decision === "ignore") return { state: "declined" };
+      if (decision !== "answer") return { state: "declined", reply: decision.reply };
+      await store.put(admittedKey, "1", { expirationTtl: TWO_DAYS });
+    }
+    const box = await ensureBox(user, options.deadline);
+    if (!box) return { state: "pending" };
+    const sessionId = `hosted-${user}-${await profileTag}`;
+    if (!await box.session(sessionId).status()) await box.createSession({ sessionId, retention: "workspace", backend });
+    const prompt = message.channel === "voice" ? `[Phone call. Answer in one to three short spoken sentences.]
+${text}` : text;
+    for (; ; ) {
+      const result = await box.driveConversationTurn(prompt, { sessionId, turnId: message.turnId, wallCapMs, timeoutMs: 8e3 });
+      if (result.state === "completed") {
+        const answer = result.text.trim();
+        if (!answer) throw new HostedAgentError("empty_reply", "The turn completed with no reply text.");
+        return { state: "answered", text: answer };
+      }
+      if (result.state === "failed") throw new HostedAgentError("turn_failed", result.error);
+      if (Date.now() + 2e3 > options.deadline) return { state: "pending" };
+      await sleep(2e3);
+    }
+  }
+  return {
+    ask,
+    /**
+     * One-time setup: route an Inkbox iMessage identity's messages, connected
+     * to Hub under the developer's account, to `callbackUrl`, and allow the
+     * one reply action on that connection. Safe to repeat.
+     */
+    async connect(input) {
+      const webhook = await hub.connections.inboundWebhook.get(input.connectionId);
+      if (!webhook.configured) await hub.connections.inboundWebhook.create(input.connectionId, { identityId: input.identityId, imessage: true });
+      await hub.permissions.set({ connectionId: input.connectionId, actionPath: IMESSAGE_REPLY, decision: "allow" });
+      const { subscription } = await hub.eventSubscriptions.create({
+        clientReference: `hosted-agent:${input.connectionId}`,
+        label: "Hosted agent messages",
+        source: { type: "connection", connectionId: input.connectionId },
+        event: IMESSAGE_EVENT,
+        callback: { url: input.callbackUrl, secret: input.secret }
+      });
+      return subscription;
+    },
+    /** The Hub callback. Authenticates within Hub's 10 s budget and runs nothing. */
+    async receive(request, secret) {
+      const authenticated = await authenticateHubEventRequest({ request, secret, maxBodyBytes: 64 * 1024 });
+      if (!authenticated.ok) return { response: authenticated.response };
+      const { runId, source, providerEvent } = authenticated.delivery;
+      const ack = new Response(null, { status: 204 });
+      if (source.kind !== "connection" || source.event !== IMESSAGE_EVENT || providerEvent.connectionId !== source.id) return { response: ack };
+      return { response: ack, inbound: { runId, connectionId: source.id, event: providerEvent } };
+    },
+    /**
+     * Answer one inbound message and send the reply through Hub. Returns
+     * 'pending' while the turn still runs; call again with the same inbound.
+     * On `lastAttempt`, a failure is answered with an apology instead of thrown.
+     */
+    async respond(inbound, options = {}) {
+      const normalized = normalizeConversationEvent(inbound.event);
+      if (!normalized.ok) return "ignored";
+      const event = normalized.event;
+      const userId = normalizeAddress(event.sender.id ?? "");
+      if (!userId || !event.text?.trim() || event.isGroup || event.historyOnly) return "ignored";
+      const turnId = `t-${(await sha256(inbound.runId)).slice(0, 40)}`;
+      let text;
+      try {
+        const result = await ask(
+          { userId, channel: "imessage", text: event.text, turnId },
+          { deadline: Date.now() + wallCapMs + 6e4 }
+        );
+        if (result.state === "pending") return "pending";
+        if (result.state === "declined" && !result.reply) return "ignored";
+        text = result.state === "answered" ? result.text : result.reply;
+      } catch (error) {
+        if (!(error instanceof HostedAgentError) && !options.lastAttempt) throw error;
+        console.error(`[hosted-agent] turn=${turnId} ${describe(error)}`);
+        text = NOTICE.unavailable;
+      }
+      const plan = buildMessagingReply(inbound.event, text.slice(0, 1500), `reply-${turnId}`);
+      if (!plan.ok) return "ignored";
+      await hub.tools.invoke(plan.reply.action, plan.reply.input, { connectionId: inbound.connectionId, idempotencyKey: plan.reply.idempotencyKey });
+      return "replied";
+    },
+    /**
+     * ph0ny's call hook. `admit` returns a call token bound to the caller's
+     * number from the carrier's signed call record, never from the model.
+     */
+    async voiceHook(request) {
+      const secret = config.voiceSecret;
+      if (!secret || !await equal(request.headers.get("authorization"), `Bearer ${secret}`)) return json({ error: "unauthorized" }, 401);
+      const body = await request.json().catch(() => null);
+      if (body?.event !== "admit") return json({ ok: true });
+      const phone = normalizeAddress(body.phone ?? "");
+      if (!phone?.startsWith("+")) return json({ admit: false, say: "Sorry, I can only take calls from a visible number." });
+      if (await store.get(`stop:${(await sha256(phone)).slice(0, 32)}`)) return json({ admit: false, say: "You unsubscribed from this line." });
+      const claims = b64(JSON.stringify({ phone, exp: Date.now() + 2 * 36e5 }));
+      return json({ admit: true, callToken: `hvt.${claims}.${await hmac(secret, claims)}` });
+    },
+    /**
+     * ph0ny's `ask_workspace` webhook tool, configured with `forwardCallToken`.
+     * A slow turn returns a ticket; the voice agent asks again with it.
+     */
+    async voiceAsk(request) {
+      const secret = config.voiceSecret;
+      if (!secret || !await equal(request.headers.get("authorization"), `Bearer ${secret}`)) return json({ error: "unauthorized" }, 401);
+      const [tag, claims, signature] = (request.headers.get("x-voice-call-token") ?? "").split(".");
+      if (tag !== "hvt" || !claims || !await equal(signature, await hmac(secret, claims))) return json({ status: "error", error: "call_not_admitted" }, 403);
+      const call = JSON.parse(unb64(claims));
+      if (call.exp < Date.now()) return json({ status: "error", error: "call_expired" }, 403);
+      const body = await request.json().catch(() => null);
+      const [turnId, asked] = body?.ticket ? body.ticket.split(".") : [`v-${crypto.randomUUID()}`, b64(body?.utterance ?? "")];
+      if (!turnId || !asked) return json({ status: "error", error: "missing_utterance" }, 400);
+      try {
+        const result = await ask({ userId: call.phone, channel: "voice", text: unb64(asked), turnId }, { deadline: Date.now() + (config.voiceBudgetMs ?? 8e3) });
+        if (result.state === "pending") return json({ status: "pending", ticket: `${turnId}.${asked}` });
+        if (result.state === "declined") return json({ status: "complete", answer: result.reply ?? "I cannot answer that right now." });
+        return json({ status: "complete", answer: result.text });
+      } catch (error) {
+        console.error(`[hosted-agent] voice turn=${turnId} ${describe(error)}`);
+        return json({ status: "error", error: "agent_unavailable" }, 502);
+      }
+    }
+  };
+}
+export {
+  DEFAULT_BOX_POLICY,
+  HostedAgentError,
+  NOTICE,
+  createHostedAgent,
+  normalizeAddress
+};
+//# sourceMappingURL=index.js.map

package/dist/hosted-agent/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/hosted-agent/index.ts"],"sourcesContent":["import { authenticateHubEventRequest, HubClient, type HubProviderEvent } from '@tangle-network/hub-sdk'\nimport { buildMessagingReply, normalizeConversationEvent } from '@tangle-network/agent-integrations/conversation-events'\nimport type { AgentProfile, BackendConfig, SandboxInstance } from '@tangle-network/sandbox'\nimport { Sandbox } from '@tangle-network/sandbox/core'\n\n/**\n * A hosted agent: a person texts or calls a line, and the agent answers from\n * that person's own isolated sandbox. The developer's Tangle API key pays for\n * every box, model turn and reply.\n *\n * Each person gets one fresh isolated box built from the published profile,\n * never a copy of the developer's box. Later messages resume the same box and\n * the same conversation, so text and voice share one memory. A box the\n * platform deleted is replaced by a fresh one instead of blocking the person.\n *\n * Every step is idempotent by the message's turn id: a retried delivery\n * settles the same sandbox turn and replays the same Hub send. So the caller\n * may retry any failure, and needs no dedupe table.\n */\n\n/** Durable key-value storage. A Cloudflare KV namespace satisfies it. */\nexport interface HostedAgentStore {\n  get(key: string): Promise<string | null>\n  put(key: string, value: string, options?: { expirationTtl?: number }): Promise<void>\n}\n\nexport type HostedChannel = 'imessage' | 'voice'\n\nexport interface HostedMessage {\n  /** The sender's address as the channel delivered it: E.164 for a phone. */\n  userId: string\n  channel: HostedChannel\n  text: string\n  /** Stable per logical message. Reusing it settles the same turn. */\n  turnId: string\n}\n\n/** What the allowance hook decides for one new message. */\nexport type Allowance = 'answer' | 'ignore' | { reply: string }\n\nexport interface HostedAgentConfig {\n  /** The developer's Tangle API key (Sandbox and Hub). */\n  apiKey: string\n  /** The persona, model and tools every person's box runs. */\n  profile: AgentProfile\n  /** Backend harness type, such as `opencode`; the runtime default when omitted. */\n  harness?: string\n  store: HostedAgentStore\n  /** Answers per person per UTC day before `allow` must decide. Default 20. */\n  freeTurnsPerDay?: number\n  /**\n   * Decide a new message after the free allowance is used, for example reply\n   * with a checkout link. Without it, a person past the allowance is told to\n   * come back tomorrow. Retries of an admitted message never reach this hook.\n   */\n  allow?: (message: HostedMessage, usedToday: number) => Allowance | Promise<Allowance>\n  /** Shared secret for the ph0ny call hook and `ask_workspace` webhook tool. */\n  voiceSecret?: string\n  /** How long one `ask_workspace` call may wait before it returns a ticket. Default 8 s. */\n  voiceBudgetMs?: number\n  box?: Partial<BoxPolicy>\n  turnWallCapMs?: number\n  sandboxUrl?: string\n  hubUrl?: string\n}\n\nexport interface BoxPolicy {\n  cpuCores: number\n  memoryMB: number\n  diskGB: number\n  idleTimeoutSeconds: number\n  maxLifetimeSeconds: number\n  deleteAfterStoppedSeconds: number\n  /** Egress allow-list. The default reaches the model router only. */\n  allowDomains: string[]\n}\n\nexport const DEFAULT_BOX_POLICY: BoxPolicy = {\n  cpuCores: 1, memoryMB: 2048, diskGB: 10,\n  idleTimeoutSeconds: 600, maxLifetimeSeconds: 86_400, deleteAfterStoppedSeconds: 7 * 86_400,\n  allowDomains: ['router.tangle.tools'],\n}\n\nexport type AskResult =\n  | { state: 'answered'; text: string }\n  | { state: 'declined'; reply?: string }\n  | { state: 'pending' }\n\n/** A Hub delivery that passed authentication, in a form a queue can carry. */\nexport interface HostedInbound {\n  runId: string\n  connectionId: string\n  event: HubProviderEvent\n}\n\nexport const NOTICE = {\n  stopped: 'You are unsubscribed. Text START to talk again.',\n  started: 'Welcome back. Text me anytime. Reply STOP to stop.',\n  limit: 'You have used today\\'s free messages. Talk tomorrow!',\n  unavailable: 'Sorry, I could not answer that just now. Please try again in a minute.',\n} as const\n\nconst IMESSAGE_EVENT = 'inkbox.imessage.received'\nconst IMESSAGE_REPLY = 'inkbox.imessage.reply'\nconst STOP = /^(stop|stopall|unsubscribe|cancel|end|quit)$/i\nconst START = /^(start|unstop|resume)$/i\nconst TWO_DAYS = 2 * 86_400\nconst RESUMABLE = new Set(['stopped', 'expired'])\nconst GONE = new Set(['failed', 'deleted'])\n\nconst encode = (text: string) => new TextEncoder().encode(text)\nconst hex = (bytes: ArrayBuffer) => Array.from(new Uint8Array(bytes), byte => byte.toString(16).padStart(2, '0')).join('')\nconst sha256 = async (value: string) => hex(await crypto.subtle.digest('SHA-256', encode(value)))\nasync function hmac(secret: string, value: string): Promise<string> {\n  const key = await crypto.subtle.importKey('raw', encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  return hex(await crypto.subtle.sign('HMAC', key, encode(value)))\n}\n/** Compares digests, so the time taken reveals nothing about the secret. */\nasync function equal(given: string | null | undefined, expected: string): Promise<boolean> {\n  if (!given) return false\n  const [a, b] = await Promise.all([sha256(given), sha256(expected)])\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\nconst b64 = (text: string) => btoa(String.fromCharCode(...encode(text))).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\nconst unb64 = (text: string) => new TextDecoder().decode(Uint8Array.from(atob(text.replace(/-/g, '+').replace(/_/g, '/')), c => c.charCodeAt(0)))\nconst sleep = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))\nconst json = (body: unknown, status = 200) => Response.json(body, { status })\nconst describe = (error: unknown) => (error instanceof Error ? `${error.name}: ${error.message}` : String(error))\n  .replace(/sk-tan-[\\w-]+|Bearer\\s+\\S+/g, '<redacted>').slice(0, 400)\n\n/** One address per person: E.164 for anything phone-shaped, else lowercase. */\nexport function normalizeAddress(value: string): string | null {\n  const trimmed = value.trim()\n  if (trimmed.includes('@')) return trimmed.toLowerCase()\n  const digits = trimmed.replace(/[^\\d]/g, '')\n  if (digits.length < 8 || digits.length > 15) return null\n  return `+${digits.length === 10 && !trimmed.startsWith('+') ? `1${digits}` : digits}`\n}\n\nexport class HostedAgentError extends Error {\n  constructor(readonly code: string, message: string) { super(message); this.name = 'HostedAgentError' }\n}\n\nexport function createHostedAgent(config: HostedAgentConfig) {\n  const store = config.store\n  const policy = { ...DEFAULT_BOX_POLICY, ...config.box }\n  const wallCapMs = config.turnWallCapMs ?? 120_000\n  const sandbox = new Sandbox({ apiKey: config.apiKey, baseUrl: config.sandboxUrl ?? 'https://sandbox.tangle.tools', timeoutMs: 20_000 })\n  const hub = new HubClient({ baseUrl: config.hubUrl ?? 'https://id.tangle.tools', apiKey: config.apiKey })\n  const backend: BackendConfig = { ...(config.harness ? { type: config.harness as BackendConfig['type'] } : {}), profile: config.profile }\n  const profileTag = sha256(JSON.stringify(config.profile)).then(hash => hash.slice(0, 8))\n\n  /** The person's running box: created on the first message, resumed later,\n   *  replaced when the platform deleted it. Null when the deadline passed. */\n  async function ensureBox(user: string, deadline: number): Promise<SandboxInstance | null> {\n    const key = `box:${user}`\n    const known = await store.get(key)\n    let box = known ? await sandbox.get(known) : null\n    if (!box || GONE.has(box.status)) {\n      // The key names the box it replaces, so concurrent first messages and\n      // retries converge on one allocation instead of each creating a box.\n      box = await sandbox.createIsolated({\n        name: `hosted-${user.slice(0, 24)}`, idempotencyKey: known ? `hosted-${user}-after-${known}` : `hosted-${user}`,\n        resources: { cpuCores: policy.cpuCores, memoryMB: policy.memoryMB, diskGB: policy.diskGB },\n        backend, secrets: [], sshEnabled: false,\n        egressPolicy: { mode: 'strict', allowDomains: policy.allowDomains, includeImplicitDomains: false },\n        idleTimeoutSeconds: policy.idleTimeoutSeconds, maxLifetimeSeconds: policy.maxLifetimeSeconds,\n        deleteAfterStoppedSeconds: policy.deleteAfterStoppedSeconds, metadata: { hostedUser: user },\n      })\n      await store.put(key, box.id)\n    }\n    if (RESUMABLE.has(box.status)) await box.resume()\n    if (box.status === 'running') return box\n    const timeoutMs = deadline - Date.now()\n    if (timeoutMs < 1000) return null\n    try {\n      return await sandbox.waitForRunning(box.id, { timeoutMs })\n    } catch (error) {\n      if (error instanceof Error && error.name === 'TimeoutError') return null\n      throw error\n    }\n  }\n\n  /** Admit a new message once: STOP/START, the free allowance, then `allow`. */\n  async function admit(message: HostedMessage, user: string): Promise<Allowance> {\n    const stopKey = `stop:${user}`\n    if (message.channel !== 'voice' && STOP.test(message.text.trim())) { await store.put(stopKey, '1'); return { reply: NOTICE.stopped } }\n    if (message.channel !== 'voice' && START.test(message.text.trim())) { await store.put(stopKey, ''); return { reply: NOTICE.started } }\n    if (await store.get(stopKey)) return 'ignore'\n    const dayKey = `turns:${user}:${new Date().toISOString().slice(0, 10)}`\n    // KV has no atomic increment, so concurrent messages may overshoot the\n    // allowance by a few; the sponsor key's budget is the hard ceiling.\n    const used = Number(await store.get(dayKey) ?? 0)\n    const decision = used < (config.freeTurnsPerDay ?? 20) ? 'answer'\n      : config.allow ? await config.allow(message, used) : { reply: NOTICE.limit }\n    if (decision === 'answer') await store.put(dayKey, String(used + 1), { expirationTtl: TWO_DAYS })\n    return decision\n  }\n\n  /** Run one message in the person's box until it answers or `deadline`. */\n  async function ask(message: HostedMessage, options: { deadline: number }): Promise<AskResult> {\n    const text = message.text.trim()\n    if (!text || text.length > 8000 || !/^[\\w-]{1,120}$/.test(message.turnId)) return { state: 'declined' }\n    const user = (await sha256(message.userId)).slice(0, 32)\n    // Scoped to the person: a voice ticket is model-supplied, so a turn id\n    // admitted for one person must not skip another person's allowance.\n    const admittedKey = `turn:${user}:${message.turnId}`\n    if (!await store.get(admittedKey)) {\n      const decision = await admit(message, user)\n      if (decision === 'ignore') return { state: 'declined' }\n      if (decision !== 'answer') return { state: 'declined', reply: decision.reply }\n      await store.put(admittedKey, '1', { expirationTtl: TWO_DAYS })\n    }\n    const box = await ensureBox(user, options.deadline)\n    if (!box) return { state: 'pending' }\n    // A session binds its backend when created, and the runtime would give a\n    // bare session its generic default assistant. A new profile starts a new\n    // conversation, so the persona always matches the one in force.\n    const sessionId = `hosted-${user}-${await profileTag}`\n    if (!await box.session(sessionId).status()) await box.createSession({ sessionId, retention: 'workspace', backend })\n    const prompt = message.channel === 'voice' ? `[Phone call. Answer in one to three short spoken sentences.]\\n${text}` : text\n    for (;;) {\n      const result = await box.driveConversationTurn(prompt, { sessionId, turnId: message.turnId, wallCapMs, timeoutMs: 8000 })\n      if (result.state === 'completed') {\n        const answer = result.text.trim()\n        if (!answer) throw new HostedAgentError('empty_reply', 'The turn completed with no reply text.')\n        return { state: 'answered', text: answer }\n      }\n      if (result.state === 'failed') throw new HostedAgentError('turn_failed', result.error)\n      if (Date.now() + 2000 > options.deadline) return { state: 'pending' }\n      await sleep(2000)\n    }\n  }\n\n  return {\n    ask,\n\n    /**\n     * One-time setup: route an Inkbox iMessage identity's messages, connected\n     * to Hub under the developer's account, to `callbackUrl`, and allow the\n     * one reply action on that connection. Safe to repeat.\n     */\n    async connect(input: { connectionId: string; identityId: string; callbackUrl: string; secret: string }) {\n      const webhook = await hub.connections.inboundWebhook.get(input.connectionId)\n      if (!webhook.configured) await hub.connections.inboundWebhook.create(input.connectionId, { identityId: input.identityId, imessage: true })\n      await hub.permissions.set({ connectionId: input.connectionId, actionPath: IMESSAGE_REPLY, decision: 'allow' })\n      const { subscription } = await hub.eventSubscriptions.create({\n        clientReference: `hosted-agent:${input.connectionId}`, label: 'Hosted agent messages',\n        source: { type: 'connection', connectionId: input.connectionId }, event: IMESSAGE_EVENT,\n        callback: { url: input.callbackUrl, secret: input.secret },\n      })\n      return subscription\n    },\n\n    /** The Hub callback. Authenticates within Hub's 10 s budget and runs nothing. */\n    async receive(request: Request, secret: string): Promise<{ response: Response; inbound?: HostedInbound }> {\n      const authenticated = await authenticateHubEventRequest({ request, secret, maxBodyBytes: 64 * 1024 })\n      if (!authenticated.ok) return { response: authenticated.response }\n      const { runId, source, providerEvent } = authenticated.delivery\n      const ack = new Response(null, { status: 204 })\n      if (source.kind !== 'connection' || source.event !== IMESSAGE_EVENT || providerEvent.connectionId !== source.id) return { response: ack }\n      return { response: ack, inbound: { runId, connectionId: source.id, event: providerEvent } }\n    },\n\n    /**\n     * Answer one inbound message and send the reply through Hub. Returns\n     * 'pending' while the turn still runs; call again with the same inbound.\n     * On `lastAttempt`, a failure is answered with an apology instead of thrown.\n     */\n    async respond(inbound: HostedInbound, options: { lastAttempt?: boolean } = {}): Promise<'replied' | 'ignored' | 'pending'> {\n      const normalized = normalizeConversationEvent(inbound.event)\n      if (!normalized.ok) return 'ignored'\n      const event = normalized.event\n      const userId = normalizeAddress(event.sender.id ?? '')\n      if (!userId || !event.text?.trim() || event.isGroup || event.historyOnly) return 'ignored'\n      const turnId = `t-${(await sha256(inbound.runId)).slice(0, 40)}`\n      let text: string\n      try {\n        const result = await ask({ userId, channel: 'imessage', text: event.text, turnId },\n          { deadline: Date.now() + wallCapMs + 60_000 })\n        if (result.state === 'pending') return 'pending'\n        if (result.state === 'declined' && !result.reply) return 'ignored'\n        text = result.state === 'answered' ? result.text : result.reply!\n      } catch (error) {\n        // A failed turn fails the same way on every retry; anything else may clear.\n        if (!(error instanceof HostedAgentError) && !options.lastAttempt) throw error\n        console.error(`[hosted-agent] turn=${turnId} ${describe(error)}`)\n        text = NOTICE.unavailable\n      }\n      const plan = buildMessagingReply(inbound.event, text.slice(0, 1500), `reply-${turnId}`)\n      if (!plan.ok) return 'ignored'\n      // Hub replays the first result for a retry with this key and input.\n      await hub.tools.invoke(plan.reply.action, plan.reply.input, { connectionId: inbound.connectionId, idempotencyKey: plan.reply.idempotencyKey })\n      return 'replied'\n    },\n\n    /**\n     * ph0ny's call hook. `admit` returns a call token bound to the caller's\n     * number from the carrier's signed call record, never from the model.\n     */\n    async voiceHook(request: Request): Promise<Response> {\n      const secret = config.voiceSecret\n      if (!secret || !await equal(request.headers.get('authorization'), `Bearer ${secret}`)) return json({ error: 'unauthorized' }, 401)\n      const body = await request.json().catch(() => null) as { event?: string; phone?: string } | null\n      if (body?.event !== 'admit') return json({ ok: true })\n      const phone = normalizeAddress(body.phone ?? '')\n      if (!phone?.startsWith('+')) return json({ admit: false, say: 'Sorry, I can only take calls from a visible number.' })\n      if (await store.get(`stop:${(await sha256(phone)).slice(0, 32)}`)) return json({ admit: false, say: 'You unsubscribed from this line.' })\n      const claims = b64(JSON.stringify({ phone, exp: Date.now() + 2 * 3_600_000 }))\n      return json({ admit: true, callToken: `hvt.${claims}.${await hmac(secret, claims)}` })\n    },\n\n    /**\n     * ph0ny's `ask_workspace` webhook tool, configured with `forwardCallToken`.\n     * A slow turn returns a ticket; the voice agent asks again with it.\n     */\n    async voiceAsk(request: Request): Promise<Response> {\n      const secret = config.voiceSecret\n      if (!secret || !await equal(request.headers.get('authorization'), `Bearer ${secret}`)) return json({ error: 'unauthorized' }, 401)\n      const [tag, claims, signature] = (request.headers.get('x-voice-call-token') ?? '').split('.')\n      if (tag !== 'hvt' || !claims || !await equal(signature, await hmac(secret, claims))) return json({ status: 'error', error: 'call_not_admitted' }, 403)\n      const call = JSON.parse(unb64(claims)) as { phone: string; exp: number }\n      if (call.exp < Date.now()) return json({ status: 'error', error: 'call_expired' }, 403)\n      const body = await request.json().catch(() => null) as { utterance?: string; ticket?: string } | null\n      // A ticket carries its own turn id and question, so a retry after a\n      // slow first step still admits and settles exactly one turn.\n      const [turnId, asked] = body?.ticket ? body.ticket.split('.') : [`v-${crypto.randomUUID()}`, b64(body?.utterance ?? '')]\n      if (!turnId || !asked) return json({ status: 'error', error: 'missing_utterance' }, 400)\n      try {\n        const result = await ask({ userId: call.phone, channel: 'voice', text: unb64(asked), turnId }, { deadline: Date.now() + (config.voiceBudgetMs ?? 8000) })\n        if (result.state === 'pending') return json({ status: 'pending', ticket: `${turnId}.${asked}` })\n        if (result.state === 'declined') return json({ status: 'complete', answer: result.reply ?? 'I cannot answer that right now.' })\n        return json({ status: 'complete', answer: result.text })\n      } catch (error) {\n        console.error(`[hosted-agent] voice turn=${turnId} ${describe(error)}`)\n        return json({ status: 'error', error: 'agent_unavailable' }, 502)\n      }\n    },\n  }\n}\n\nexport type HostedAgent = ReturnType<typeof createHostedAgent>\n"],"mappings":";AAAA,SAAS,6BAA6B,iBAAwC;AAC9E,SAAS,qBAAqB,kCAAkC;AAEhE,SAAS,eAAe;AA0EjB,IAAM,qBAAgC;AAAA,EAC3C,UAAU;AAAA,EAAG,UAAU;AAAA,EAAM,QAAQ;AAAA,EACrC,oBAAoB;AAAA,EAAK,oBAAoB;AAAA,EAAQ,2BAA2B,IAAI;AAAA,EACpF,cAAc,CAAC,qBAAqB;AACtC;AAcO,IAAM,SAAS;AAAA,EACpB,SAAS;AAAA,EACT,SAAS;AAAA,EACT,OAAO;AAAA,EACP,aAAa;AACf;AAEA,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AACvB,IAAM,OAAO;AACb,IAAM,QAAQ;AACd,IAAM,WAAW,IAAI;AACrB,IAAM,YAAY,oBAAI,IAAI,CAAC,WAAW,SAAS,CAAC;AAChD,IAAM,OAAO,oBAAI,IAAI,CAAC,UAAU,SAAS,CAAC;AAE1C,IAAM,SAAS,CAAC,SAAiB,IAAI,YAAY,EAAE,OAAO,IAAI;AAC9D,IAAM,MAAM,CAAC,UAAuB,MAAM,KAAK,IAAI,WAAW,KAAK,GAAG,UAAQ,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACzH,IAAM,SAAS,OAAO,UAAkB,IAAI,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK,CAAC,CAAC;AAChG,eAAe,KAAK,QAAgB,OAAgC;AAClE,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,OAAO,MAAM,GAAG,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACnH,SAAO,IAAI,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,OAAO,KAAK,CAAC,CAAC;AACjE;AAEA,eAAe,MAAM,OAAkC,UAAoC;AACzF,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,CAAC,GAAG,CAAC,IAAI,MAAM,QAAQ,IAAI,CAAC,OAAO,KAAK,GAAG,OAAO,QAAQ,CAAC,CAAC;AAClE,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AACA,IAAM,MAAM,CAAC,SAAiB,KAAK,OAAO,aAAa,GAAG,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAClI,IAAM,QAAQ,CAAC,SAAiB,IAAI,YAAY,EAAE,OAAO,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC,GAAG,OAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AAChJ,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,aAAW,WAAW,SAAS,EAAE,CAAC;AAC5E,IAAM,OAAO,CAAC,MAAe,SAAS,QAAQ,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC;AAC5E,IAAM,WAAW,CAAC,WAAoB,iBAAiB,QAAQ,GAAG,MAAM,IAAI,KAAK,MAAM,OAAO,KAAK,OAAO,KAAK,GAC5G,QAAQ,+BAA+B,YAAY,EAAE,MAAM,GAAG,GAAG;AAG7D,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,QAAQ,SAAS,GAAG,EAAG,QAAO,QAAQ,YAAY;AACtD,QAAM,SAAS,QAAQ,QAAQ,UAAU,EAAE;AAC3C,MAAI,OAAO,SAAS,KAAK,OAAO,SAAS,GAAI,QAAO;AACpD,SAAO,IAAI,OAAO,WAAW,MAAM,CAAC,QAAQ,WAAW,GAAG,IAAI,IAAI,MAAM,KAAK,MAAM;AACrF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAqB,MAAc,SAAiB;AAAE,UAAM,OAAO;AAA9C;AAAiD,SAAK,OAAO;AAAA,EAAmB;AAAA,EAAhF;AACvB;AAEO,SAAS,kBAAkB,QAA2B;AAC3D,QAAM,QAAQ,OAAO;AACrB,QAAM,SAAS,EAAE,GAAG,oBAAoB,GAAG,OAAO,IAAI;AACtD,QAAM,YAAY,OAAO,iBAAiB;AAC1C,QAAM,UAAU,IAAI,QAAQ,EAAE,QAAQ,OAAO,QAAQ,SAAS,OAAO,cAAc,gCAAgC,WAAW,IAAO,CAAC;AACtI,QAAM,MAAM,IAAI,UAAU,EAAE,SAAS,OAAO,UAAU,2BAA2B,QAAQ,OAAO,OAAO,CAAC;AACxG,QAAM,UAAyB,EAAE,GAAI,OAAO,UAAU,EAAE,MAAM,OAAO,QAAiC,IAAI,CAAC,GAAI,SAAS,OAAO,QAAQ;AACvI,QAAM,aAAa,OAAO,KAAK,UAAU,OAAO,OAAO,CAAC,EAAE,KAAK,UAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;AAIvF,iBAAe,UAAU,MAAc,UAAmD;AACxF,UAAM,MAAM,OAAO,IAAI;AACvB,UAAM,QAAQ,MAAM,MAAM,IAAI,GAAG;AACjC,QAAI,MAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,IAAI;AAC7C,QAAI,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,GAAG;AAGhC,YAAM,MAAM,QAAQ,eAAe;AAAA,QACjC,MAAM,UAAU,KAAK,MAAM,GAAG,EAAE,CAAC;AAAA,QAAI,gBAAgB,QAAQ,UAAU,IAAI,UAAU,KAAK,KAAK,UAAU,IAAI;AAAA,QAC7G,WAAW,EAAE,UAAU,OAAO,UAAU,UAAU,OAAO,UAAU,QAAQ,OAAO,OAAO;AAAA,QACzF;AAAA,QAAS,SAAS,CAAC;AAAA,QAAG,YAAY;AAAA,QAClC,cAAc,EAAE,MAAM,UAAU,cAAc,OAAO,cAAc,wBAAwB,MAAM;AAAA,QACjG,oBAAoB,OAAO;AAAA,QAAoB,oBAAoB,OAAO;AAAA,QAC1E,2BAA2B,OAAO;AAAA,QAA2B,UAAU,EAAE,YAAY,KAAK;AAAA,MAC5F,CAAC;AACD,YAAM,MAAM,IAAI,KAAK,IAAI,EAAE;AAAA,IAC7B;AACA,QAAI,UAAU,IAAI,IAAI,MAAM,EAAG,OAAM,IAAI,OAAO;AAChD,QAAI,IAAI,WAAW,UAAW,QAAO;AACrC,UAAM,YAAY,WAAW,KAAK,IAAI;AACtC,QAAI,YAAY,IAAM,QAAO;AAC7B,QAAI;AACF,aAAO,MAAM,QAAQ,eAAe,IAAI,IAAI,EAAE,UAAU,CAAC;AAAA,IAC3D,SAAS,OAAO;AACd,UAAI,iBAAiB,SAAS,MAAM,SAAS,eAAgB,QAAO;AACpE,YAAM;AAAA,IACR;AAAA,EACF;AAGA,iBAAe,MAAM,SAAwB,MAAkC;AAC7E,UAAM,UAAU,QAAQ,IAAI;AAC5B,QAAI,QAAQ,YAAY,WAAW,KAAK,KAAK,QAAQ,KAAK,KAAK,CAAC,GAAG;AAAE,YAAM,MAAM,IAAI,SAAS,GAAG;AAAG,aAAO,EAAE,OAAO,OAAO,QAAQ;AAAA,IAAE;AACrI,QAAI,QAAQ,YAAY,WAAW,MAAM,KAAK,QAAQ,KAAK,KAAK,CAAC,GAAG;AAAE,YAAM,MAAM,IAAI,SAAS,EAAE;AAAG,aAAO,EAAE,OAAO,OAAO,QAAQ;AAAA,IAAE;AACrI,QAAI,MAAM,MAAM,IAAI,OAAO,EAAG,QAAO;AACrC,UAAM,SAAS,SAAS,IAAI,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAGrE,UAAM,OAAO,OAAO,MAAM,MAAM,IAAI,MAAM,KAAK,CAAC;AAChD,UAAM,WAAW,QAAQ,OAAO,mBAAmB,MAAM,WACrD,OAAO,QAAQ,MAAM,OAAO,MAAM,SAAS,IAAI,IAAI,EAAE,OAAO,OAAO,MAAM;AAC7E,QAAI,aAAa,SAAU,OAAM,MAAM,IAAI,QAAQ,OAAO,OAAO,CAAC,GAAG,EAAE,eAAe,SAAS,CAAC;AAChG,WAAO;AAAA,EACT;AAGA,iBAAe,IAAI,SAAwB,SAAmD;AAC5F,UAAM,OAAO,QAAQ,KAAK,KAAK;AAC/B,QAAI,CAAC,QAAQ,KAAK,SAAS,OAAQ,CAAC,iBAAiB,KAAK,QAAQ,MAAM,EAAG,QAAO,EAAE,OAAO,WAAW;AACtG,UAAM,QAAQ,MAAM,OAAO,QAAQ,MAAM,GAAG,MAAM,GAAG,EAAE;AAGvD,UAAM,cAAc,QAAQ,IAAI,IAAI,QAAQ,MAAM;AAClD,QAAI,CAAC,MAAM,MAAM,IAAI,WAAW,GAAG;AACjC,YAAM,WAAW,MAAM,MAAM,SAAS,IAAI;AAC1C,UAAI,aAAa,SAAU,QAAO,EAAE,OAAO,WAAW;AACtD,UAAI,aAAa,SAAU,QAAO,EAAE,OAAO,YAAY,OAAO,SAAS,MAAM;AAC7E,YAAM,MAAM,IAAI,aAAa,KAAK,EAAE,eAAe,SAAS,CAAC;AAAA,IAC/D;AACA,UAAM,MAAM,MAAM,UAAU,MAAM,QAAQ,QAAQ;AAClD,QAAI,CAAC,IAAK,QAAO,EAAE,OAAO,UAAU;AAIpC,UAAM,YAAY,UAAU,IAAI,IAAI,MAAM,UAAU;AACpD,QAAI,CAAC,MAAM,IAAI,QAAQ,SAAS,EAAE,OAAO,EAAG,OAAM,IAAI,cAAc,EAAE,WAAW,WAAW,aAAa,QAAQ,CAAC;AAClH,UAAM,SAAS,QAAQ,YAAY,UAAU;AAAA,EAAiE,IAAI,KAAK;AACvH,eAAS;AACP,YAAM,SAAS,MAAM,IAAI,sBAAsB,QAAQ,EAAE,WAAW,QAAQ,QAAQ,QAAQ,WAAW,WAAW,IAAK,CAAC;AACxH,UAAI,OAAO,UAAU,aAAa;AAChC,cAAM,SAAS,OAAO,KAAK,KAAK;AAChC,YAAI,CAAC,OAAQ,OAAM,IAAI,iBAAiB,eAAe,wCAAwC;AAC/F,eAAO,EAAE,OAAO,YAAY,MAAM,OAAO;AAAA,MAC3C;AACA,UAAI,OAAO,UAAU,SAAU,OAAM,IAAI,iBAAiB,eAAe,OAAO,KAAK;AACrF,UAAI,KAAK,IAAI,IAAI,MAAO,QAAQ,SAAU,QAAO,EAAE,OAAO,UAAU;AACpE,YAAM,MAAM,GAAI;AAAA,IAClB;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,QAAQ,OAA0F;AACtG,YAAM,UAAU,MAAM,IAAI,YAAY,eAAe,IAAI,MAAM,YAAY;AAC3E,UAAI,CAAC,QAAQ,WAAY,OAAM,IAAI,YAAY,eAAe,OAAO,MAAM,cAAc,EAAE,YAAY,MAAM,YAAY,UAAU,KAAK,CAAC;AACzI,YAAM,IAAI,YAAY,IAAI,EAAE,cAAc,MAAM,cAAc,YAAY,gBAAgB,UAAU,QAAQ,CAAC;AAC7G,YAAM,EAAE,aAAa,IAAI,MAAM,IAAI,mBAAmB,OAAO;AAAA,QAC3D,iBAAiB,gBAAgB,MAAM,YAAY;AAAA,QAAI,OAAO;AAAA,QAC9D,QAAQ,EAAE,MAAM,cAAc,cAAc,MAAM,aAAa;AAAA,QAAG,OAAO;AAAA,QACzE,UAAU,EAAE,KAAK,MAAM,aAAa,QAAQ,MAAM,OAAO;AAAA,MAC3D,CAAC;AACD,aAAO;AAAA,IACT;AAAA;AAAA,IAGA,MAAM,QAAQ,SAAkB,QAA0E;AACxG,YAAM,gBAAgB,MAAM,4BAA4B,EAAE,SAAS,QAAQ,cAAc,KAAK,KAAK,CAAC;AACpG,UAAI,CAAC,cAAc,GAAI,QAAO,EAAE,UAAU,cAAc,SAAS;AACjE,YAAM,EAAE,OAAO,QAAQ,cAAc,IAAI,cAAc;AACvD,YAAM,MAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC9C,UAAI,OAAO,SAAS,gBAAgB,OAAO,UAAU,kBAAkB,cAAc,iBAAiB,OAAO,GAAI,QAAO,EAAE,UAAU,IAAI;AACxI,aAAO,EAAE,UAAU,KAAK,SAAS,EAAE,OAAO,cAAc,OAAO,IAAI,OAAO,cAAc,EAAE;AAAA,IAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOA,MAAM,QAAQ,SAAwB,UAAqC,CAAC,GAA+C;AACzH,YAAM,aAAa,2BAA2B,QAAQ,KAAK;AAC3D,UAAI,CAAC,WAAW,GAAI,QAAO;AAC3B,YAAM,QAAQ,WAAW;AACzB,YAAM,SAAS,iBAAiB,MAAM,OAAO,MAAM,EAAE;AACrD,UAAI,CAAC,UAAU,CAAC,MAAM,MAAM,KAAK,KAAK,MAAM,WAAW,MAAM,YAAa,QAAO;AACjF,YAAM,SAAS,MAAM,MAAM,OAAO,QAAQ,KAAK,GAAG,MAAM,GAAG,EAAE,CAAC;AAC9D,UAAI;AACJ,UAAI;AACF,cAAM,SAAS,MAAM;AAAA,UAAI,EAAE,QAAQ,SAAS,YAAY,MAAM,MAAM,MAAM,OAAO;AAAA,UAC/E,EAAE,UAAU,KAAK,IAAI,IAAI,YAAY,IAAO;AAAA,QAAC;AAC/C,YAAI,OAAO,UAAU,UAAW,QAAO;AACvC,YAAI,OAAO,UAAU,cAAc,CAAC,OAAO,MAAO,QAAO;AACzD,eAAO,OAAO,UAAU,aAAa,OAAO,OAAO,OAAO;AAAA,MAC5D,SAAS,OAAO;AAEd,YAAI,EAAE,iBAAiB,qBAAqB,CAAC,QAAQ,YAAa,OAAM;AACxE,gBAAQ,MAAM,uBAAuB,MAAM,IAAI,SAAS,KAAK,CAAC,EAAE;AAChE,eAAO,OAAO;AAAA,MAChB;AACA,YAAM,OAAO,oBAAoB,QAAQ,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,MAAM,EAAE;AACtF,UAAI,CAAC,KAAK,GAAI,QAAO;AAErB,YAAM,IAAI,MAAM,OAAO,KAAK,MAAM,QAAQ,KAAK,MAAM,OAAO,EAAE,cAAc,QAAQ,cAAc,gBAAgB,KAAK,MAAM,eAAe,CAAC;AAC7I,aAAO;AAAA,IACT;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,UAAU,SAAqC;AACnD,YAAM,SAAS,OAAO;AACtB,UAAI,CAAC,UAAU,CAAC,MAAM,MAAM,QAAQ,QAAQ,IAAI,eAAe,GAAG,UAAU,MAAM,EAAE,EAAG,QAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AACjI,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,IAAI;AAClD,UAAI,MAAM,UAAU,QAAS,QAAO,KAAK,EAAE,IAAI,KAAK,CAAC;AACrD,YAAM,QAAQ,iBAAiB,KAAK,SAAS,EAAE;AAC/C,UAAI,CAAC,OAAO,WAAW,GAAG,EAAG,QAAO,KAAK,EAAE,OAAO,OAAO,KAAK,sDAAsD,CAAC;AACrH,UAAI,MAAM,MAAM,IAAI,SAAS,MAAM,OAAO,KAAK,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,EAAG,QAAO,KAAK,EAAE,OAAO,OAAO,KAAK,mCAAmC,CAAC;AACxI,YAAM,SAAS,IAAI,KAAK,UAAU,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,IAAI,KAAU,CAAC,CAAC;AAC7E,aAAO,KAAK,EAAE,OAAO,MAAM,WAAW,OAAO,MAAM,IAAI,MAAM,KAAK,QAAQ,MAAM,CAAC,GAAG,CAAC;AAAA,IACvF;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,SAAS,SAAqC;AAClD,YAAM,SAAS,OAAO;AACtB,UAAI,CAAC,UAAU,CAAC,MAAM,MAAM,QAAQ,QAAQ,IAAI,eAAe,GAAG,UAAU,MAAM,EAAE,EAAG,QAAO,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AACjI,YAAM,CAAC,KAAK,QAAQ,SAAS,KAAK,QAAQ,QAAQ,IAAI,oBAAoB,KAAK,IAAI,MAAM,GAAG;AAC5F,UAAI,QAAQ,SAAS,CAAC,UAAU,CAAC,MAAM,MAAM,WAAW,MAAM,KAAK,QAAQ,MAAM,CAAC,EAAG,QAAO,KAAK,EAAE,QAAQ,SAAS,OAAO,oBAAoB,GAAG,GAAG;AACrJ,YAAM,OAAO,KAAK,MAAM,MAAM,MAAM,CAAC;AACrC,UAAI,KAAK,MAAM,KAAK,IAAI,EAAG,QAAO,KAAK,EAAE,QAAQ,SAAS,OAAO,eAAe,GAAG,GAAG;AACtF,YAAM,OAAO,MAAM,QAAQ,KAAK,EAAE,MAAM,MAAM,IAAI;AAGlD,YAAM,CAAC,QAAQ,KAAK,IAAI,MAAM,SAAS,KAAK,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,OAAO,WAAW,CAAC,IAAI,IAAI,MAAM,aAAa,EAAE,CAAC;AACvH,UAAI,CAAC,UAAU,CAAC,MAAO,QAAO,KAAK,EAAE,QAAQ,SAAS,OAAO,oBAAoB,GAAG,GAAG;AACvF,UAAI;AACF,cAAM,SAAS,MAAM,IAAI,EAAE,QAAQ,KAAK,OAAO,SAAS,SAAS,MAAM,MAAM,KAAK,GAAG,OAAO,GAAG,EAAE,UAAU,KAAK,IAAI,KAAK,OAAO,iBAAiB,KAAM,CAAC;AACxJ,YAAI,OAAO,UAAU,UAAW,QAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC;AAC/F,YAAI,OAAO,UAAU,WAAY,QAAO,KAAK,EAAE,QAAQ,YAAY,QAAQ,OAAO,SAAS,kCAAkC,CAAC;AAC9H,eAAO,KAAK,EAAE,QAAQ,YAAY,QAAQ,OAAO,KAAK,CAAC;AAAA,MACzD,SAAS,OAAO;AACd,gBAAQ,MAAM,6BAA6B,MAAM,IAAI,SAAS,KAAK,CAAC,EAAE;AACtE,eAAO,KAAK,EAAE,QAAQ,SAAS,OAAO,oBAAoB,GAAG,GAAG;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/teams-react/index.js

@@ -1,13 +1,13 @@
+import {
+  MembersPanel
+} from "../chunk-GRDLGQ6A.js";
 import {
   InvitationsPanel
 } from "../chunk-5MI2SKQH.js";
+import "../chunk-AULM4X7U.js";
 import {
   InviteAcceptPage
 } from "../chunk-W7P5KV6O.js";
-import {
-  MembersPanel
-} from "../chunk-GRDLGQ6A.js";
-import "../chunk-AULM4X7U.js";
 import "../chunk-6XIAPIW6.js";
 export {
   InvitationsPanel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.49.4",
+  "version": "0.49.5",
   "packageManager": "pnpm@11.24.0",
   "description": "Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.",
   "keywords": [
@@ -212,6 +212,11 @@
       "import": "./dist/integrations/index.js",
       "default": "./dist/integrations/index.js"
     },
+    "./hosted-agent": {
+      "types": "./dist/hosted-agent/index.d.ts",
+      "import": "./dist/hosted-agent/index.js",
+      "default": "./dist/hosted-agent/index.js"
+    },
     "./interactions": {
       "types": "./dist/interactions/index.d.ts",
       "import": "./dist/interactions/index.js",
@@ -543,6 +548,7 @@
     "@tangle-network/agent-profile-materialize": "0.20.1",
     "@tangle-network/agent-runtime": "0.249.1",
     "@tangle-network/brand": "1.5.0",
+    "@tangle-network/hub-sdk": "0.14.2",
     "@tangle-network/sandbox": "0.45.0",
     "@tangle-network/sandbox-ui": "0.113.3",
     "@tangle-network/ui": "11.9.0",
@@ -603,6 +609,7 @@
     "@tangle-network/agent-profile-materialize": ">=0.20.1 <0.21.0",
     "@tangle-network/agent-runtime": ">=0.249.1 <0.250.0",
     "@tangle-network/brand": ">=1.5.0",
+    "@tangle-network/hub-sdk": ">=0.12.6 <0.15.0",
     "@tangle-network/sandbox": ">=0.45.0 <0.46.0",
     "@tangle-network/sandbox-ui": ">=0.113.3 <0.114.0",
     "@tangle-network/ui": ">=11.6.0 <12.0.0",
@@ -702,6 +709,9 @@
     },
     "react-dom": {
       "optional": true
+    },
+    "@tangle-network/hub-sdk": {
+      "optional": true
     }
   },
   "dependencies": {