@volter/supercode-teams 0.2.179 → 0.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.179",
+  "version": "0.3.0",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",
@@ -10,6 +10,7 @@
     "./machine": "./machine.mjs",
     "./browser-attach": "./browser-attach.mjs",
     "./attention": "./attention.mjs",
+    "./event-client": "./event-client.mjs",
     "./bin": "./bin/teams.mjs",
     "./fleet": "./fleet.mjs",
     "./bin/fleet": "./bin/fleet.mjs",
@@ -62,7 +63,7 @@
     "@volter/supercode-harness-sdk": "^0.3.43",
     "@volter/supercode-terminal": "^0.2.54",
     "@volter/identity": "^0.4.1",
-    "@volter/teams": "^0.1.58",
+    "@volter/teams": "0.2.0",
     "@xterm/addon-serialize": "^0.14.0",
     "@xterm/headless": "^6.0.0",
     "protobufjs": "8.8.0",

package/server/harness-routes.mjs

@@ -125,7 +125,7 @@ export const harnessRoutes = Object.freeze({ preAuth, authed, beforeIdempotency,
 
 async function canonicalSession(api,team,row){const seen=new Set();while(row?.canonical_id){if(seen.has(row.id))fail(409,'conflict','correlation cycle');seen.add(row.id);row=await api.store.one('SELECT * FROM sessions WHERE team_id=? AND id=?',[team,row.canonical_id]);}return row;}
 async function constituents(api,team,row){const root=await canonicalSession(api,team,row);return api.store.query('WITH RECURSIVE family(id) AS (SELECT ? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT s.* FROM sessions s JOIN family f ON f.id=s.id WHERE s.team_id=?',[root.id,team,team]);}
-async function canReadMerged(api,auth,row){for(const member of await constituents(api,auth.team_id,row))if(!canRead(auth,member,await grants(api,auth.team_id,member.id)))return false;return true;}
+async function canReadMerged(api,auth,row){if(auth.principal_kind==='agent'){try{await api.store.authorizedSession({teamId:auth.team_id,principalId:auth.principal_id,credentialId:auth.credential_id,ref:row.id,now:api.clock.nowMs()});return true;}catch(error){if([401,403,404,410].includes(error.status))return false;throw error;}}for(const member of await constituents(api,auth.team_id,row))if(!canRead(auth,member,await grants(api,auth.team_id,member.id)))return false;return true;}
 const managerGuard=(auth,sessionId,now,{governance=false}={})=>({
   sql:`SELECT 1 ok FROM sessions s JOIN memberships m ON m.team_id=s.team_id AND m.principal_id=? WHERE s.team_id=? AND s.id=? AND s.deleted_at IS NULL AND m.active=1 AND m.role!='viewer' AND (?=1 AND m.role IN ('owner','admin') OR s.custodian_id=? OR EXISTS (SELECT 1 FROM session_grants g WHERE g.team_id=s.team_id AND g.session_id=s.id AND g.role='manager' AND (g.expires_at IS NULL OR g.expires_at>?) AND (g.subject_kind='principal' AND g.subject_id=? OR g.subject_kind='group' AND EXISTS (SELECT 1 FROM group_members gm WHERE gm.team_id=s.team_id AND gm.group_id=g.subject_id AND gm.principal_id=?))))`,
   params:[auth.principal_id,auth.team_id,sessionId,governance?1:0,auth.principal_id,now,auth.principal_id,auth.principal_id],
@@ -171,6 +171,7 @@ async function listSessions(api,res,auth,url,requestId,search){
   const rows=[...currentRows,...olderRows],currentById=new Map(currentRows.map(row=>[row.id,row]));
   const boundaryNow=api.clock.nowMs();
   if(!membership?.active||credential?.revoked_at!=null||(credential?.expires_at!=null&&credential.expires_at<=boundaryNow))fail(401,'authentication_required','authentication required');
+  if(cursorKey&&!cursor)fail(409,'resync_required','cursor expired, mismatched, or authorization changed');
   let tuples;
   if(cursor){
     if(cursor.kind!==(search?'search':'list')||cursor.expires_at<=boundaryNow||cursor.auth_epoch!==team.auth_epoch||canonicalJson(JSON.parse(cursor.query_json))!==canonicalJson(normalizedQuery))fail(409,'resync_required','cursor expired, mismatched, or authorization changed');
@@ -441,13 +442,17 @@ async function viewBindingRoute(api,req,res,auth,ref,requestId){
     const bindings=await list();
     // Native transport destinations are custody information, not an extra transcript-reader capability.
     if(session.custodian_id===auth.principal_id&&!auth.installation_id)for(const binding of bindings){
-      const resolution=await sessionDeliveryResolution(api,auth.team_id,{sessionRef:session.id,...binding},true);
+      const resolution=await sessionDeliveryResolution(api,auth.team_id,{sessionRef:session.id,...binding},true,auth);
       binding.delivery=resolution.target&&resolution.target.harness!==session.harness
         ? {...resolution,state:'unavailable',reason:'harness_mismatch'} : resolution;
     }
     send(res,200,result(api,auth,{session_id:session.id,harness:session.harness,bindings}),requestId);return;
   }
-  if(session.custodian_id!==auth.principal_id)fail(403,'forbidden',"only the session's owner binds it to a view");
+  // The owner binds, in person or through an app they installed and consented to `sessions.access` (the app acts for its
+  // installer); an app installed by anyone else binds nothing of theirs.
+  const installer=auth.installation_id&&auth.app_grants==null&&auth.app_actions?.includes('sessions.access')
+    ?(await api.store.one("SELECT installer_id FROM app_installations WHERE id=? AND team_id=? AND state='active'",[auth.installation_id,auth.team_id]))?.installer_id:null;
+  if(session.custodian_id!==auth.principal_id&&session.custodian_id!==installer)fail(403,'forbidden',"only the session's owner binds it to a view");
   const body=await parseJson(req);exact(body,['issuer','room','conversation']);
   if(typeof body.room!=='string'||!body.room||typeof body.conversation!=='string'||!body.conversation)fail(400,'invalid_request','room and conversation are required');
   if(!await installedIssuer(api,body.issuer,'delegation.sessions',auth.team_id))fail(400,'invalid_request','this issuer is not an installed session integration');

package/server/index.mjs

@@ -1,7 +1,6 @@
 // The Node host: one process on a data directory (SQLite in a worker thread, the
 // bootstrap credential in a protected file beside it), serving HTTP and the
 // machine doors on one listener. The server itself is core.mjs's.
-import { identityOrganizationsFromEnv } from '@volter/teams/server/identity-orgs';
 import { createServer as createHttpServer } from 'node:http';
 import { mkdirSync, openSync, closeSync, writeFileSync, readFileSync, renameSync, chmodSync, unlinkSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
@@ -21,7 +20,7 @@ export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},p
   const loopback=['127.0.0.1','::1','localhost'].includes(listen.host??'127.0.0.1');
   publicOrigin=normalizePublicOrigin(publicOrigin);
   if(!loopback&&!publicOrigin?.startsWith('https:'))throw new TypeError('non-loopback Teams servers require an HTTPS publicOrigin');
-  const api=createTeamsApi({clock,ids,publicOrigin,identityOrganizations:identityOrganizationsFromEnv(process.env),uploadLimitBytes});
+  const api=createTeamsApi({clock,ids,publicOrigin,uploadLimitBytes});
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;

package/server/store-core.mjs

@@ -7,6 +7,7 @@ import { ingestOtlpBatch, correlateSessions } from './arc2-transactions.mjs';
 import { claimEffect, getEffect, listEffects, reportEffect } from './effects-transactions.mjs';
 import { applyCaptureMessages } from './capture-transactions.mjs';
 import { MIGRATIONS, MESSAGE_AT } from '@volter/teams/server/migrations';
+import { AGENT_ACTIVE, AGENT_DESCENDANTS } from '@volter/teams/server/agent-authority';
 import { APP_LINEAGE_REVOKED, appGrantAllows } from '@volter/teams/server/auth';
 
 /** Bring a database to the newest schema. `version()`/`setVersion(n)` name where the host records it. */
@@ -27,7 +28,7 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null,appFence=null,grantSource=null;
+    let membership=null,appFence=null,grantSource=null,agentGrantSource=null,agentReader=false;
     if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
       if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
@@ -45,6 +46,12 @@ export function createStoreHandlers({ all, get, run, tx }) {
         if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
       }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
+      const principal=get('SELECT kind FROM principals WHERE id=?',[principalId]);
+      if(principal?.kind==='agent'){
+        agentGrantSource=get('SELECT c.id,c.principal_id FROM agent_credentials d JOIN credentials c ON c.id=d.parent_credential_id WHERE d.credential_id=?',[credentialId]);
+        if(!get(AGENT_ACTIVE,[teamId,principalId])||get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','agent delegation revoked');
+        agentReader=true;
+      }
     }
     if(typeof ref!=='string'||ref.length<8)domainError(404,'not_found','not found');
     const groups=all('SELECT group_id FROM group_members WHERE team_id=? AND principal_id=?',[teamId,principalId]).map(row=>row.group_id);
@@ -69,7 +76,13 @@ export function createStoreHandlers({ all, get, run, tx }) {
           if(!grantSource)return false;
           try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
         }
-        if(session.visibility==='team'||session.custodian_id===principalId)return true;
+        if(agentGrantSource){
+          try{authorizedSession({teamId,principalId:agentGrantSource.principal_id,credentialId:agentGrantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
+        }
+        if(agentReader&&get(`WITH RECURSIVE owners(id) AS (${AGENT_DESCENDANTS}), family(id) AS (SELECT s.session_id FROM agent_sessions s JOIN owners o ON s.agent_id=o.id WHERE s.team_id=? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT 1 FROM family WHERE id=?`,[teamId,principalId,teamId,teamId,session.id]))return true;
+        // An agent's standing delegation covers its own family and descendants. Team visibility
+        // alone does not open a parent's or sibling's transcript; those require an explicit grant.
+        if(!agentReader&&(session.visibility==='team'||session.custodian_id===principalId))return true;
         const grants=all('SELECT subject_kind,subject_id,expires_at FROM session_grants WHERE team_id=? AND session_id=?',[teamId,session.id]);
         return grants.some(grant=>(grant.subject_kind==='principal'&&grant.subject_id===principalId||grant.subject_kind==='group'&&groups.includes(grant.subject_id))&&(grant.expires_at==null||grant.expires_at>now));
       });

package/session-notice-target.mjs

@@ -0,0 +1,39 @@
+// A Room reply may resume its existing thread. Configuration is read through the harness's own door.
+import { isAbsolute } from 'node:path';
+
+export function codexNoticeResumeArguments(config){
+  if(config?.harness!=='codex'||typeof config.cwd!=='string'||!isAbsolute(config.cwd))return null;
+  if(!['untrusted','on-failure','on-request','never'].includes(config.approval_policy))return null;
+  const policy=config.sandbox_policy;
+  if(!policy||typeof policy!=='object'||Array.isArray(policy)||!['read-only','workspace-write','danger-full-access'].includes(policy.type))return null;
+  const keys=['type',...(policy.type==='workspace-write'?['writable_roots','network_access','exclude_tmpdir_env_var','exclude_slash_tmp']:[])];
+  if(Object.keys(policy).some(key=>!keys.includes(key)))return null;
+  if(policy.writable_roots!==undefined&&(!Array.isArray(policy.writable_roots)||!policy.writable_roots.every(root=>typeof root==='string'&&isAbsolute(root))))return null;
+  for(const key of ['network_access','exclude_tmpdir_env_var','exclude_slash_tmp'])if(policy[key]!==undefined&&typeof policy[key]!=='boolean')return null;
+  const args=['--ask-for-approval',config.approval_policy,'--sandbox',policy.type];
+  if(policy.type==='workspace-write'){
+    args.push('-c',`sandbox_workspace_write.writable_roots=${JSON.stringify(policy.writable_roots??[])}`);
+    for(const key of ['network_access','exclude_tmpdir_env_var','exclude_slash_tmp'])args.push('-c',`sandbox_workspace_write.${key}=${policy[key]??(key!=='network_access')}`);
+  }
+  if(typeof config.model==='string'&&config.model)args.push('--model',config.model);
+  return args;
+}
+
+export async function sessionNoticeTarget(address,{machine,mail,discover,recordedConfig}){
+  const match=/^sc:([^:]+):([^:]+):([^:\s]+)$/.exec(address??'');
+  if(!match||match[1]!==machine)return {state:'unavailable',reason:'native_target_not_local',resumable:false};
+  const [, ,harness,id]=match;
+  const live=await mail({op:'list'});
+  if(live.code!==0||!Array.isArray(live.sessions))throw new Error('native liveness door returned no session catalogue');
+  if(live.sessions.some(row=>row.address===address))return {state:'running',reason:null,resumable:false};
+  const page=await discover({query:id,harnesses:[harness],limit:200});
+  const row=page.sessions?.find(value=>value.locator?.session_id===id&&value.locator?.harness===harness);
+  if(!row)return {state:'unavailable',reason:'native_session_not_found',resumable:false};
+  if(harness!=='codex')return {state:'stopped',reason:'native_resume_not_supported',resumable:false};
+  let config;
+  try{config=await recordedConfig(row.locator);}catch{return {state:'stopped',reason:'native_resume_profile_unavailable',resumable:false};}
+  const args=codexNoticeResumeArguments(config);
+  if(config.session_id!==id)return {state:'stopped',reason:'native_resume_identity_unrecorded',resumable:false};
+  return {state:'stopped',reason:args?null:'native_resume_profile_unrecorded',resumable:!!args,
+    ...(args?{resume:{cwd:config.cwd,args}}:{})};
+}

package/worker/index.mjs

@@ -6,9 +6,6 @@
 //   PUBLIC_ORIGIN                      the https origin the Worker is served at
 //   INIT_TEAM                          the first team's name (used once, at bootstrap)
 // Identity and delegation issuers are registered apps installed by team admins through the public doors.
-//   VOLTER_ORG_CLIENT_ID, VOLTER_ORG_CLIENT_SECRET, VOLTER_TEAM_ORGS
-//                                      optional: this server's product credential at the organization's identity issuer, and the teams whose
-//                                      organization there admits its members with no invitation (`team=slug,…`)
 //   SUPERCODE_TEAMS_BOOTSTRAP_TOKEN    secret: the owner's first credential, minted with
 //                                      `supercode teams server token`
 import { DurableObject } from 'cloudflare:workers';
@@ -18,7 +15,6 @@ import { createHttpHandler, authenticate } from '@volter/teams/server/http';
 import { harnessRoutes } from '../server/harness-routes.mjs';
 import { authorizeMachineUpgrade, acceptMachineSocket, LINK_PROTOCOL, CHANNEL_PROTOCOL } from '@volter/teams/server/machine-link';
 import { setOtlpSchemaSources } from '../server/otlp/transport.mjs';
-import { identityOrganizationsFromEnv } from '@volter/teams/server/identity-orgs';
 import { setViewerSources } from '@volter/teams/server/viewer';
 import { serveFetch } from './fetch-adapter.mjs';
 import { webSocketDuplex } from './websocket-duplex.mjs';
@@ -80,7 +76,7 @@ export class TeamsServer extends DurableObject {
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
       const db = durableSql(ctx.storage);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
-      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null, identityOrganizations: identityOrganizationsFromEnv(env) });
+      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;

package/workspace-client.d.ts

@@ -54,6 +54,8 @@ export interface AppDelegation { actions:string[]; actor:string; expires_in_ms?:
 export interface AppToken { grants?:AppResourceGrant[]|null; token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
 export interface AppCodeExchange { version:1; installation:AppInstallation; credential:AppToken; webhook_secret:string }
 export interface TeamClient {
+  identity: import('@volter/teams/http-client').TeamClient['identity'];
+  events:{catalogue(options?:RequestOptions):Promise<Result<{kinds:string[]}>>;createSource(body:{name:string},options?:RequestOptions):Promise<Result<{id:string;name:string}>>;publish(source:string,body:{id:string;kind:string;resource:{kind:'task'|'agent';id:string};revision:number;data:Record<string,unknown>;actor?:{session?:string|null}},options?:RequestOptions):Promise<Result<OntologyEvent>>;follow(query?:{source?:string;kinds?:string[]},options?:StreamOptions):AsyncIterable<PublishedEventFrame>};
   apps:{deregister(id:string,options?:RequestOptions):Promise<null>;catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
   appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:AppDelegation,options?:RequestOptions):Promise<Result<AppToken|null>>};
   sessions:{list(query?:ListQuery,options?:RequestOptions):Promise<Page<Descriptor>>;search(query:SearchQuery,options?:RequestOptions):Promise<SearchPage>;watch(query?:ListQuery,options?:StreamOptions):AsyncIterable<Event>;get(id:string):SessionClient};
@@ -78,6 +80,8 @@ export interface TeamClient {
     stream(attachment:Attachment,options?:Pick<RequestOptions,'signal'>):AsyncIterable<AttachmentFrame>;
   };
 }
+export interface OntologyEvent { id:string|null;org:string;at:number|null;actor:{principal:string|null;session:string|null;lineage:string[]}|null;kind:string;resource:{kind:string;id:string};data:Record<string,unknown> }
+export interface PublishedEventFrame { type:'snapshot_begin'|'snapshot_item'|'snapshot_end'|'event'|'checkpoint'|'access_revoked'|'resync_required';cursor?:string;sequence?:number;data?:OntologyEvent;terminal?:boolean;reason?:string }
 export interface SessionClient {
   artifact(uploadId:string,options?:{signal?:AbortSignal;range?:string}):Promise<Response>;
   descriptor(options?:RequestOptions):Promise<Result<Descriptor>>;

package/workspace-client.mjs

@@ -1,185 +1,2 @@
-const trimOrigin=value=>{const u=new URL(value),loopback=u.hostname==='localhost'||u.hostname==='::1'||u.hostname==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(u.hostname);if(!['http:','https:'].includes(u.protocol)||u.username||u.password||u.search||u.hash||(u.pathname!==''&&u.pathname!=='/')||(u.protocol==='http:'&&!loopback))throw new TypeError('server must be an HTTPS origin (HTTP is loopback-only)');return u.origin;};
-const randomKey=()=>globalThis.crypto.randomUUID().replaceAll('-','')+globalThis.crypto.randomUUID().replaceAll('-','');
-export class TeamsClient {
-  constructor({server,credential,fetch:fetchImpl=(...args)=>globalThis.fetch(...args)}){this.server=trimOrigin(server);this.credential=credential;this.fetch=fetchImpl;if(typeof fetchImpl!=='function')throw new TypeError('fetch is required');}
-  async request(method,path,{body,signal,idempotencyKey,ifMatch}={}) {
-    const key=idempotencyKey??(method==='GET'?null:randomKey());let delay=250,last;
-    for(let attempt=0;attempt<5;attempt++) { try {
-      const response=await this.fetch(this.server+path,{method,signal,redirect:'manual',headers:{Accept:'application/json',Authorization:`Bearer ${this.credential}`,...(body!==undefined?{'Content-Type':'application/json'}:{}),...(key?{'Idempotency-Key':key}:{}),...(ifMatch!==undefined?{'If-Match':String(ifMatch)}:{})},body:body===undefined?undefined:JSON.stringify(body)});
-      if(response.type==='opaqueredirect'||(response.status>=300&&response.status<400))throw Object.assign(new Error('cross-origin redirects are refused'),{code:'invalid_request',status:400,retryable:false});
-      const value=response.status===204?null:await response.json();if(!response.ok)throw Object.assign(new Error(value?.error?.message??`HTTP ${response.status}`),value?.error,{status:response.status});return value;
-    } catch(error) { last=error;if(method!=='GET'||signal?.aborted||!(!error.status||error.retryable)||attempt===4)throw error;await retryWait(delay,signal);delay=Math.min(delay*2,5000); } }
-    throw last;
-  }
-  me(options){return this.request('GET','/api/v1/me',options);} capabilities(options){return this.request('GET','/api/v1/capabilities',options);} team(id){return new TeamClient(this,id);}
-  redeemAppCode(body,options){return this.request('POST','/api/v1/apps/token',{...options,body});}
-  teams(queryValue={},options){return this.request('GET','/api/v1/teams'+query(queryValue),options);}
-  createTeam(body,options){return this.request('POST','/api/v1/teams',{...options,body});}
-}
-const segment = value => {
-  if (typeof value !== 'string' || !value || value.length > 256) throw new TypeError('a nonempty resource ID is required');
-  return encodeURIComponent(value);
-};
-class TeamClient {
-  constructor(root, id) {
-    this.root = root; this.id = id;
-    const base = `/api/v1/teams/${segment(id)}`;
-    const get = (path, options) => root.request('GET', base + path, options);
-    const post = (path, body, options) => root.request('POST', base + path, { ...options, body });
-    const patch = (path, body, options) => root.request('PATCH', base + path, { ...options, body });
-    const remove = (path, options) => root.request('DELETE', base + path, options);
-    const resource = (path, id) => `${path}/${segment(id)}`;
-    this.apps = {
-      catalogue: o => get('/apps/catalogue', o),
-      list: o => get('/apps', o), get: (id, o) => get(resource('/apps', id), o),
-      register: (body, o) => post('/apps', body, o),
-      deregister: (id, o) => remove(resource('/apps', id), o),
-      rotateSecret: (id, o) => post(resource('/apps', id) + '/secret', {}, o),
-      install: (id, body, o) => post(resource('/apps', id) + '/installations', body, o),
-    };
-    this.appInstallations = {
-      list: o => get('/app-installations', o), get: (id, o) => get(resource('/app-installations', id), o),
-      uninstall: (id, o) => remove(resource('/app-installations', id), o),
-      delegate: (id, body, o) => post(resource('/app-installations', id) + '/delegations', body, o),
-    };
-    this.sessions = {
-      list: (q = {}, o) => get('/sessions' + query(q), o),
-      search: (q, o) => get('/sessions/search' + query(q), o),
-      watch: (q = {}, o = {}) => events(root, base + '/sessions/events' + query(q), o),
-      get: id => new SessionClient(root, base, id),
-    };
-    this.members = {
-      list: (q = {}, o) => get('/members' + query(q), o),
-      update: (id, body, o) => patch(resource('/members', id), body, o),
-      remove: (id, o) => remove(resource('/members', id), o),
-    };
-    this.groups = {
-      list: (q = {}, o) => get('/groups' + query(q), o),
-      create: (body, o) => post('/groups', body, o),
-      remove: (id, o) => remove(resource('/groups', id), o),
-      addMember: (id, member, o) => root.request('PUT', base + resource('/groups', id) + resource('/members', member), o),
-      removeMember: (id, member, o) => remove(resource('/groups', id) + resource('/members', member), o),
-    };
-    this.machines = {
-      list: (q = {}, o) => get('/machines' + query(q), o),
-      get: (id, o) => get(resource('/machines', id), o),
-      create: (body, o) => post('/machines', body, o),
-      roots: (id, q = {}, o) => get(resource('/machines', id) + '/roots' + query(q), o),
-      remove: (id, o) => remove(resource('/machines', id), o),
-      liveGrants: machineId => {
-        const path = resource('/machines', machineId) + '/grants';
-        return {
-          list: (o) => get(path, o), get: (id, o) => get(resource(path, id), o),
-          create: (body, o) => post(path, body, o), remove: (id, o) => remove(resource(path, id), o),
-        };
-      },
-    };
-    this.sources = {
-      list: (q = {}, o) => get('/sources' + query(q), o),
-      get: (id, o) => get(resource('/sources', id), o),
-      create: (body, o) => post('/sources', body, o),
-      update: (id, body, o) => patch(resource('/sources', id), body, o),
-      credential: (id, body, o) => post(resource('/sources', id) + '/credentials', body, o),
-      configuration: (id, format = 'otel-collector', o) => get(resource('/sources', id) + '/config' + query({ format }), o),
-    };
-    this.syncRules = {
-      list: (q = {}, o) => get('/sync-rules' + query(q), o), get: (id, o) => get(resource('/sync-rules', id), o),
-      create: (body, o) => post('/sync-rules', body, o), update: (id, body, o) => patch(resource('/sync-rules', id), body, o),
-      remove: (id, o) => remove(resource('/sync-rules', id), o),
-    };
-    this.credentials = {
-      create: (body, o) => post('/credentials', body, o), remove: (id, o) => remove(resource('/credentials', id), o),
-    };
-    this.invitations = { create: (body, o) => post('/invitations', body, o) };
-    this.operations = { get: (id, o) => get(resource('/operations', id), o) };
-    this.continuations = {
-      get: (id, o) => get(resource('/continuations', id), o),
-      authorizeDestination: (id, body, o) => post(resource('/continuations', id) + '/authorize-destination', body, o),
-      launch: (id, o) => post(resource('/continuations', id) + '/launch', undefined, o),
-      completeLocal: (id, body, o) => post(resource('/continuations', id) + '/complete-local', body, o),
-    };
-    this.attachments = {
-      actions: (id, body, o) => post(resource('/attachments', id) + '/actions', body, o),
-      detach: (id, o) => remove(resource('/attachments', id), o),
-      stream: (attachment, o = {}) => attachmentEvents(root, base, attachment, o),
-    };
-  }
-}
-class SessionClient {
-  constructor(root, base, id) { this.root = root; this.path = `${base}/sessions/${segment(id)}`; }
-  descriptor = o => this.root.request('GET', this.path, o);
-  read = (q = {}, o) => this.root.request('GET', this.path + '/messages' + query(q), o);
-  follow = (q = {}, o = {}) => events(this.root, this.path + '/events' + query(q), o);
-  access = o => this.root.request('GET', this.path + '/access', o);
-  grant = (body, o) => this.root.request('POST', this.path + '/access', { ...o, body });
-  revoke = (id, o) => this.root.request('DELETE', this.path + '/access/' + segment(id), o);
-  export = (body, o) => this.root.request('POST', this.path + '/exports', { ...o, body });
-  prepare = (body, o) => this.root.request('POST', this.path + '/continuations', { ...o, body });
-  attach = (body, o) => this.root.request('POST', this.path + '/attachments', { ...o, body });
-  artifact = async (id, { signal, range } = {}) => {
-    if (range !== undefined && !/^bytes=(?:[0-9]+-[0-9]*|-[0-9]+)$/.test(range)) throw new TypeError('range must be one byte range');
-    const response = await this.root.fetch(this.root.server + this.path + '/artifacts/' + segment(id), {
-      signal, redirect: 'manual', headers: { Authorization: `Bearer ${this.root.credential}`, ...(range ? { Range: range } : {}) },
-    });
-    rejectRedirect(response);
-    if (!response.ok) throw await sseError(response);
-    return response;
-  };
-}
-function rejectRedirect(response) {
-  if (response.type === 'opaqueredirect' || response.status >= 300 && response.status < 400) throw Object.assign(new Error('cross-origin redirects are refused'), { code: 'invalid_request', status: 400, retryable: false });
-}
-async function* attachmentEvents(root, base, attachment, { signal } = {}) {
-  const expected = root.server + base + '/attachments/' + segment(attachment.id) + '/stream';
-  if (attachment.stream_format !== 'observed_runtime_event' || attachment.stream_url !== expected || typeof attachment.credential !== 'string' || !attachment.credential) throw new TypeError('attachment stream target or credential is invalid');
-  let response;
-  try {
-    response = await root.fetch(expected, { signal, redirect: 'manual', headers: { Accept: 'text/event-stream', Authorization: `Bearer ${attachment.credential}` } });
-    rejectRedirect(response);
-    if (!response.ok) throw await sseError(response);
-    let buffer = '';
-    for await (const chunk of response.body.pipeThrough(new TextDecoderStream())) {
-      buffer += chunk;
-      let match;
-      while ((match = /\r?\n\r?\n/.exec(buffer))) {
-        const block = buffer.slice(0, match.index); buffer = buffer.slice(match.index + match[0].length);
-        if (new TextEncoder().encode(block).length > 1024 * 1024 + 4096) throw Object.assign(new Error('attachment frame exceeds 1 MiB'), { code: 'resync_required', retryable: false });
-        const lines = block.split(/\r?\n/), kind = lines.find(line => line.startsWith('event:'))?.slice(6).trim();
-        const data = lines.filter(line => line.startsWith('data:')).map(line => line.slice(5).replace(/^ /, '')).join('\n');
-        if (!data) continue;
-        if (kind === 'access_revoked' || kind === 'resync_required') throw Object.assign(new Error(`attachment stream ${kind}`), { code: kind, retryable: false });
-        if (kind !== 'runtime') throw Object.assign(new Error('unexpected attachment stream event'), { code: 'invalid_request', retryable: false });
-        const frame = JSON.parse(data);
-        yield frame;
-        if (frame.type === 'closed' || frame.type === 'error' && frame.terminal) return;
-      }
-      if (new TextEncoder().encode(buffer).length > 1024 * 1024 + 4096) throw Object.assign(new Error('attachment frame exceeds 1 MiB'), { code: 'resync_required', retryable: false });
-    }
-    if (!signal?.aborted) throw Object.assign(new Error('attachment stream ended; create a new attachment to reconnect'), { code: 'resync_required', retryable: false });
-  } catch (error) { if (!signal?.aborted) throw error; }
-}
-const query=q=>{const p=new URLSearchParams();for(const [k,v]of Object.entries(q))if(v!==undefined)p.set(k,String(v));return p.size?'?'+p:'';};
-const retryWait=(delay,signal)=>new Promise((resolve,reject)=>{const done=()=>{signal?.removeEventListener('abort',abort);resolve();},timer=setTimeout(done,delay),abort=()=>{clearTimeout(timer);signal?.removeEventListener('abort',abort);reject(signal.reason);};signal?.addEventListener('abort',abort,{once:true});});
-async function sseError(response){let value=null;try{value=await response.json();}catch{}return Object.assign(new Error(value?.error?.message??`SSE HTTP ${response.status}`),value?.error,{status:response.status,retryable:value?.error?.retryable??(response.status===429||response.status>=500)});}
-async function* events(root,path,{signal,after}={}){
-  let cursor=after??null,lastYielded=null,lastError=null;
-  for(let attempt=0;attempt<5&&!signal?.aborted;attempt++){
-    const suffix=cursor?path+(path.includes('?')?'&':'?')+'after='+encodeURIComponent(cursor):path;
-    try{
-      const response=await root.fetch(root.server+suffix,{signal,redirect:'manual',headers:{Accept:'text/event-stream',Authorization:`Bearer ${root.credential}`,...(cursor?{'Last-Event-ID':cursor}:{})}});
-      if(response.type==='opaqueredirect'||response.status>=300&&response.status<400)throw Object.assign(new Error('cross-origin redirects are refused'),{code:'invalid_request',status:400,retryable:false});
-      if(!response.ok)throw await sseError(response);
-      let buffer='';
-      for await(const chunk of response.body.pipeThrough(new TextDecoderStream())){
-        buffer+=chunk;let at;
-        while((at=buffer.indexOf('\n\n'))>=0){
-          const block=buffer.slice(0,at);buffer=buffer.slice(at+2);const id=block.split('\n').find(line=>line.startsWith('id: '))?.slice(4),data=block.split('\n').filter(line=>line.startsWith('data: ')).map(line=>line.slice(6)).join('\n');if(!data)continue;
-          const event=JSON.parse(data),terminal=event?.terminal||event?.type==='access_revoked'||event?.type==='resync_required',nextCursor=id??cursor;cursor=nextCursor;if(!terminal&&nextCursor&&nextCursor===lastYielded)continue;if(nextCursor)lastYielded=nextCursor;yield event;if(terminal)return;
-        }
-      }
-      lastError=Object.assign(new Error('SSE stream ended before a terminal event'),{retryable:true});
-    }catch(error){if(signal?.aborted)return;if(error.retryable===false||error.status&&error.status!==429&&error.status<500)throw error;lastError=error;}
-    if(attempt<4)await retryWait(Math.min(250*2**attempt,5000),signal).catch(()=>{});
-  }
-  if(!signal?.aborted&&lastError)throw lastError;
-}
+// The Teams HTTP door has one implementation in the neutral Teams package.
+export { TeamsClient } from "@volter/teams/http-client";

package/lines.mjs

@@ -1,19 +0,0 @@
-/** Splits a stream's chunks into its complete lines, in time linear in its length: each chunk is scanned once and a
- *  line joined once, when its newline arrives. Appending to one buffer and searching it from the start again on
- *  every chunk is quadratic in a long line, and one answer (a large session's `sessions.load`, a whole machine's
- *  `sessions.discover`) is a line of tens of megabytes. */
-export function lineSplitter() {
-  let pending = [];
-  return (chunk) => {
-    const text = String(chunk), lines = [];
-    let from = 0, at;
-    while ((at = text.indexOf('\n', from)) >= 0) {
-      pending.push(text.slice(from, at));
-      lines.push(pending.join(''));
-      pending = [];
-      from = at + 1;
-    }
-    if (from < text.length) pending.push(text.slice(from));
-    return lines;
-  };
-}