@vornrun/connector-sdk 0.7.0-beta.13 → 0.7.0-beta.15

package/dist/{chunk-XOP6JKBX.js → chunk-FHGC7LE7.js}

@@ -1,1017 +1,1633 @@
-// src/packaging.ts
-import { builtinModules } from "module";
-import { readFileSync } from "fs";
-import { dirname, isAbsolute, join, resolve } from "path";
-var MAX_PACK_BYTES = 8 * 1024 * 1024;
-var LIFECYCLE_SCRIPTS = [
-  "preinstall",
-  "install",
-  "postinstall",
-  "prepare",
-  "prepublish",
-  "prepublishOnly",
-  "postpublish"
+// src/define.ts
+var KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+var PATH_DATA_PATTERN = /^[MmZzLlHhVvCcSsQqTtAa0-9\s,.\-+eE]+$/;
+var VIEW_BOX_PATTERN = /^-?[\d.]+\s+-?[\d.]+\s+-?[\d.]+\s+-?[\d.]+$/;
+var DEDUPE_STRATEGIES = ["timestamp", "lastItem"];
+var AUTH_RUNGS = ["none", "cli", "key", "oauth"];
+var EXTENSION_PERMISSIONS = [
+  "git.read",
+  "terminal.read",
+  "terminal.selection",
+  "terminal.send",
+  "card.rename",
+  "agent.usage"
 ];
-var BUILTINS = new Set(builtinModules);
-function finding(code, target, message) {
-  return { level: "error", code, target, message };
-}
-function lifecycleScriptFindings(pkg) {
-  const scripts = pkg?.scripts;
-  if (!scripts || typeof scripts !== "object") return [];
-  const named = LIFECYCLE_SCRIPTS.filter((name) => typeof scripts[name] === "string");
-  if (named.length === 0) return [];
-  return [
-    finding(
-      "lifecycle-scripts",
-      "package.json",
-      `Remove the ${named.join(", ")} script(s); a pack is installed by copying files, never by running them`
-    )
-  ];
-}
-function bundleDependencyFindings(external) {
-  const specifiers = /* @__PURE__ */ new Set();
-  for (const specifier of external) {
-    if (specifier.startsWith(".") || specifier.startsWith("/")) continue;
-    if (specifier.startsWith("node:") || BUILTINS.has(specifier)) continue;
-    specifiers.add(specifier);
-  }
-  if (specifiers.size === 0) return [];
-  return [
-    finding(
-      "runtime-dependencies",
-      "bundle",
-      `${[...specifiers].sort().join(", ")} stayed outside the bundle; a pack must launch with no install step`
-    )
-  ];
-}
-function packageDirFor(resolveDir, entry) {
-  const from = resolve(resolveDir);
-  if (entry === void 0) return from;
-  return entry.startsWith(".") || isAbsolute(entry) ? dirname(resolve(from, entry)) : from;
-}
-function readNearestPackageJson(fromDir) {
-  let current = resolve(fromDir);
-  for (; ; ) {
-    try {
-      return JSON.parse(readFileSync(join(current, "package.json"), "utf8"));
-    } catch {
-      const parent = dirname(current);
-      if (parent === current) return void 0;
-      current = parent;
+var HOST_PERMISSIONS = {
+  diff: "git.read",
+  status: "git.read",
+  output: "terminal.read",
+  selection: "terminal.selection",
+  send: "terminal.send",
+  rename: "card.rename",
+  usage: "agent.usage"
+};
+var EXTENSION_AGENTS = [
+  "claude",
+  "copilot",
+  "codex",
+  "opencode",
+  "gemini",
+  "shell"
+];
+var EXTENSION_PLATFORMS = ["darwin", "linux", "win32"];
+var WEB_ENTRY_PATTERN = /^web\/[A-Za-z0-9._/-]+\.html$/;
+var MIN_FOOTER_SECONDS = 5;
+var MAX_PATTERN_LENGTH = 256;
+var GROUP_OPEN = /^\((\?(:|=|!|<=|<!|<[A-Za-z_$][\w$]*>))?/;
+function hasNestedQuantifier(pattern) {
+  const quantifierAt = (at) => {
+    const ch = pattern[at];
+    return ch !== void 0 && "*+?{".includes(ch);
+  };
+  const quantified = [];
+  let inClass = false;
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
     }
+    if (ch === "(") {
+      quantified.push(false);
+      i += (GROUP_OPEN.exec(pattern.slice(i))?.[0].length ?? 1) - 1;
+      continue;
+    }
+    if (ch === ")") {
+      const heldOne = quantified.pop() ?? false;
+      const repeated = quantifierAt(i + 1);
+      if (heldOne && repeated) return true;
+      if ((heldOne || repeated) && quantified.length > 0) {
+        quantified[quantified.length - 1] = true;
+      }
+      continue;
+    }
+    if (quantifierAt(i) && quantified.length > 0) quantified[quantified.length - 1] = true;
   }
+  return false;
 }
-function packEntryContents(entry, sdkModule = "@vornrun/connector-sdk") {
-  return [
-    `import { serveConnector } from ${JSON.stringify(sdkModule)}`,
-    `import * as entry from ${JSON.stringify(entry)}`,
-    "const exported = Object.values(entry).find((value) => value && Array.isArray(value.triggers))",
-    `if (!exported) throw new Error(${JSON.stringify(`${entry} exports no connector`)})`,
-    "await serveConnector(exported)",
-    ""
-  ].join("\n");
-}
-async function esbuildBundle(request) {
-  const { build } = await import("esbuild");
-  const result = await build({
-    stdin: {
-      contents: request.contents,
-      resolveDir: request.resolveDir,
-      sourcefile: "vorn-connector-pack.js",
-      loader: "js"
-    },
-    bundle: true,
-    platform: "node",
-    target: "node20",
-    format: "esm",
-    write: false,
-    metafile: true,
-    legalComments: "none"
-  });
-  const output = Object.values(result.metafile.outputs)[0];
-  return {
-    code: result.outputFiles[0].text,
-    external: (output?.imports ?? []).filter((item) => item.external).map((item) => item.path)
-  };
-}
-
-// src/normalize.ts
-var RESERVED_KEYS = [
-  "externalId",
-  "title",
-  "url",
-  "description",
-  "status",
-  "labels",
-  "assignee",
-  "updatedAt"
-];
-var UNSAFE_KEYS = ["__proto__", "constructor", "prototype"];
-function itemExternalId(item) {
-  return String(item.externalId ?? "").trim();
-}
-function itemTimestamp(item, fallback) {
-  return isoTimestamp(item.updatedAt, fallback);
-}
-function isoTimestamp(value, fallback) {
-  if (value === void 0) return fallback;
-  const date = value instanceof Date ? value : new Date(value);
-  if (Number.isNaN(date.getTime())) {
-    throw new Error(`Invalid updatedAt: ${String(value)}`);
+var ABSOLUTE_URL_PATTERN = /^https?:\/\//i;
+var CONFIG_ROOTED_URL_PATTERN = /^\{\{\s*config\./;
+function assertUnique(kind, keys) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const key of keys) {
+    if (seen.has(key)) throw new Error(`Duplicate ${kind} "${key}"`);
+    seen.add(key);
   }
-  return date.toISOString();
 }
-function normalizeItem(item, polledAt) {
-  const externalId = itemExternalId(item);
-  if (!externalId) {
-    throw new Error("Connector item is missing externalId");
+function assertAuth(definition) {
+  const auth = definition.auth;
+  if (!auth) return;
+  const id = definition.id;
+  if (!AUTH_RUNGS.includes(auth.rung)) {
+    throw new Error(
+      `Connector ${id} declares unknown auth rung ${JSON.stringify(auth.rung)}; expected ${AUTH_RUNGS.join(", ")}`
+    );
   }
-  if (!item.title || !item.title.trim()) {
-    throw new Error(`Connector item ${externalId} is missing title`);
+  if (auth.rung === "cli" && !auth.probe?.command?.trim()) {
+    throw new Error(`Connector ${id} borrows a CLI login but declares no probe command to ask it`);
   }
-  const extra = {};
-  for (const [key, value] of Object.entries(item.data ?? {})) {
-    if (RESERVED_KEYS.includes(key)) continue;
-    if (UNSAFE_KEYS.includes(key)) continue;
-    extra[key] = value;
+  if (auth.rung === "key") {
+    const keys = auth.keys ?? [];
+    if (keys.length === 0) {
+      throw new Error(`Connector ${id} signs in with a key but names no config field holding it`);
+    }
+    const declared = new Set((definition.config ?? []).map((field) => field.key));
+    for (const key of keys) {
+      if (!declared.has(key)) {
+        throw new Error(`Connector ${id} names auth key "${key}", which is not a config field`);
+      }
+    }
   }
-  return {
-    ...extra,
-    externalId,
-    title: item.title,
-    url: item.url ?? "",
-    description: item.description ?? "",
-    status: item.status ?? "open",
-    labels: item.labels ?? [],
-    ...item.assignee !== void 0 && { assignee: item.assignee },
-    updatedAt: isoTimestamp(item.updatedAt, polledAt)
-  };
-}
-function normalizeItems(items, polledAt) {
-  const seen = /* @__PURE__ */ new Set();
-  return items.map((item) => {
-    const normalized = normalizeItem(item, polledAt);
-    if (seen.has(normalized.externalId)) {
-      throw new Error(`Duplicate externalId "${normalized.externalId}" in one poll page`);
+  if (auth.rung === "none") {
+    const secret = (definition.config ?? []).find((field) => field.secret === true);
+    if (secret) {
+      throw new Error(
+        `Connector ${id} claims it needs no sign-in but declares secret field "${secret.key}"`
+      );
     }
-    seen.add(normalized.externalId);
-    return normalized;
-  });
+  }
 }
-
-// src/dedupe.ts
-var MAX_BOUNDARY_IDS = 500;
-function decodeCursor(cursor, strategy) {
-  if (!cursor) return void 0;
-  let parsed;
-  try {
-    parsed = JSON.parse(cursor);
-  } catch (error) {
-    throw new Error(`Cursor is not valid SDK cursor JSON: ${cursor}`, { cause: error });
+function assertIdentity(kind, definition) {
+  if (!KEY_PATTERN.test(definition.id ?? "")) {
+    throw new Error(`${kind} id "${definition.id}" must start with a letter and be url-safe`);
   }
-  const state = parsed;
-  if (!state || typeof state !== "object" || state.v !== 1 || state.s !== strategy) {
-    throw new Error(`Cursor does not belong to the "${strategy}" strategy: ${cursor}`);
+  if (!definition.name?.trim()) {
+    throw new Error(`${kind} ${definition.id} is missing a name`);
   }
-  const wellFormed = state.s === "timestamp" ? typeof state.t === "string" && Array.isArray(state.ids) && state.ids.every((id) => typeof id === "string") : typeof state.id === "string";
-  if (!wellFormed) {
-    throw new Error(`Cursor is missing the fields the "${strategy}" strategy needs: ${cursor}`);
+  assertIcon(`${kind} ${definition.id}`, definition.icon);
+}
+function assertIcon(subject, icon) {
+  if (!icon) return;
+  const { viewBox, paths } = icon;
+  if (!Array.isArray(paths) || paths.length === 0) {
+    throw new Error(`${subject} has an icon with no paths`);
+  }
+  for (const path of paths) {
+    if (typeof path !== "string" || !PATH_DATA_PATTERN.test(path)) {
+      throw new Error(
+        `${subject} has an icon path that is not SVG path data. Only path data is accepted, not markup.`
+      );
+    }
+  }
+  if (viewBox !== void 0 && !VIEW_BOX_PATTERN.test(viewBox)) {
+    throw new Error(`${subject} has an icon viewBox that is not four numbers`);
   }
-  return state;
 }
-function compare(left, right) {
-  if (left === right) return 0;
-  return left < right ? -1 : 1;
+function envNameFor(key, explicit) {
+  if (explicit) return explicit;
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toUpperCase();
 }
-function page(chronological, context, hadCursor, nextCursor) {
-  const delivered = context.limit === void 0 ? chronological : chronological.slice(0, context.limit);
-  if (delivered.length === 0) {
-    return { items: [], ...context.cursor !== void 0 && { nextCursor: context.cursor } };
+function defineConnector(definition) {
+  assertIdentity("Connector", definition);
+  const triggers = definition.triggers ?? [];
+  const actions = definition.actions ?? [];
+  if (triggers.length === 0 && actions.length === 0) {
+    throw new Error(`Connector ${definition.id} declares no triggers and no actions`);
   }
-  return {
-    items: delivered.map((entry) => entry.item),
-    nextCursor: JSON.stringify(nextCursor(delivered)),
-    // Only drain a backlog we know we truncated, and only once a cursor
-    // exists — a first poll should not pull the source's entire history.
-    hasMore: chronological.length > delivered.length && hadCursor
-  };
-}
-function timestampPoll(fetched, state, context, polledAt) {
-  const boundary = state?.t ?? context.since;
-  const seen = new Set(state?.ids ?? []);
-  const fresh = [];
-  const pinnedAlreadySeen = [];
-  for (const item of fetched) {
-    const id = itemExternalId(item);
-    const pinned = item.updatedAt === void 0 && boundary !== void 0;
-    const at = pinned ? boundary : itemTimestamp(item, polledAt);
-    const isNew = boundary === void 0 || at > boundary || at === boundary && !seen.has(id);
-    if (isNew) fresh.push({ item, at, id, ...pinned && { pinned: true } });
-    else if (pinned) pinnedAlreadySeen.push(id);
+  for (const trigger of triggers) {
+    if (!KEY_PATTERN.test(trigger.type ?? "")) {
+      throw new Error(`Trigger type "${trigger.type}" must start with a letter and be url-safe`);
+    }
+    const loose = trigger;
+    const declarative = typeof loose.fetch === "function";
+    const imperative = typeof loose.poll === "function";
+    if (declarative && imperative) {
+      throw new Error(`Trigger ${trigger.type} declares both fetch() and poll(); pick one`);
+    }
+    if (declarative !== (loose.dedupe !== void 0)) {
+      throw new Error(
+        `Trigger ${trigger.type} needs fetch() and a dedupe strategy together, not one alone`
+      );
+    }
+    if (loose.dedupe !== void 0 && !DEDUPE_STRATEGIES.includes(loose.dedupe)) {
+      throw new Error(
+        `Trigger ${trigger.type} has unknown dedupe strategy ${JSON.stringify(loose.dedupe)}; expected ${DEDUPE_STRATEGIES.join(" or ")}`
+      );
+    }
+    if (loose.poll !== void 0 && !imperative) {
+      throw new Error(`Trigger ${trigger.type} declares poll but it is not a function`);
+    }
+    if (!declarative && !imperative) {
+      throw new Error(`Trigger ${trigger.type} is missing a fetch() or poll() implementation`);
+    }
   }
-  fresh.sort((left, right) => compare(left.at, right.at) || compare(left.id, right.id));
-  return page(fresh, context, state !== void 0, (delivered) => {
-    const newest = delivered[delivered.length - 1].at;
-    const atNewest = [];
-    for (let i = delivered.length - 1; i >= 0 && delivered[i].at === newest; i -= 1) {
-      atNewest.push(delivered[i].id);
+  for (const action of actions) {
+    if (!KEY_PATTERN.test(action.type ?? "")) {
+      throw new Error(`Action type "${action.type}" must start with a letter and be url-safe`);
     }
-    const carried = newest === boundary ? [...seen, ...atNewest] : [
-      ...pinnedAlreadySeen,
-      ...delivered.filter((entry) => entry.pinned).map((entry) => entry.id),
-      ...atNewest
-    ];
-    return { v: 1, s: "timestamp", t: newest, ids: carried.slice(-MAX_BOUNDARY_IDS) };
-  });
-}
-function lastItemPoll(fetched, state, context, polledAt) {
-  const keyed = fetched.map((item) => ({
-    item,
-    at: itemTimestamp(item, polledAt),
-    id: itemExternalId(item)
-  }));
-  const stopAt = state ? keyed.findIndex((entry) => entry.id === state.id) : -1;
-  const chronological = (stopAt === -1 ? keyed : keyed.slice(0, stopAt)).reverse();
-  return page(chronological, context, state !== void 0, (delivered) => ({
-    v: 1,
-    s: "lastItem",
-    id: delivered[delivered.length - 1].id
-  }));
+    const loose = action;
+    const written = typeof loose.run === "function";
+    const declared = loose.request !== void 0;
+    if (written && declared) {
+      throw new Error(`Action ${action.type} declares both run() and a request; pick one`);
+    }
+    if (!written && !declared) {
+      throw new Error(`Action ${action.type} is missing a run() implementation or a request`);
+    }
+    if (declared) {
+      const request = loose.request;
+      if (typeof request?.url !== "string" || request.url.trim() === "") {
+        throw new Error(`Action ${action.type} declares a request with no URL`);
+      }
+      const url = request.url.trim();
+      if (!ABSOLUTE_URL_PATTERN.test(url) && !CONFIG_ROOTED_URL_PATTERN.test(url)) {
+        throw new Error(
+          `Action ${action.type} declares the request URL "${url}", which is neither absolute nor rooted in a {{config.\u2026}} value`
+        );
+      }
+    }
+    if (!declared && loose.postReceive !== void 0) {
+      throw new Error(`Action ${action.type} has postReceive but no request for it to reshape`);
+    }
+    for (const input of action.inputs ?? []) {
+      if (input.loadOptions !== void 0 && definition.options?.[input.loadOptions] === void 0) {
+        throw new Error(
+          `Action ${action.type} argument "${input.key}" loads options from "${input.loadOptions}", which the connector does not serve`
+        );
+      }
+    }
+  }
+  assertUnique(
+    "trigger",
+    triggers.map((trigger) => trigger.type)
+  );
+  assertUnique(
+    "action",
+    actions.map((action) => action.type)
+  );
+  assertUnique(
+    "config field",
+    (definition.config ?? []).map((field) => field.key)
+  );
+  assertAuth(definition);
+  return {
+    ...definition,
+    kind: "connector",
+    version: definition.version ?? "0.0.0",
+    config: definition.config ?? [],
+    triggers,
+    actions
+  };
 }
-async function pollWithDedupe(trigger, context) {
-  const strategy = trigger.dedupe;
-  const fetchItems = trigger.fetch;
-  if (!strategy || !fetchItems) {
-    throw new Error(`Trigger ${trigger.type} is not a declarative trigger`);
+function assertPredicate(id, where, predicate) {
+  if (!predicate) return;
+  const lists = [
+    ["workspaceContains", predicate.workspaceContains],
+    ["remoteHost", predicate.remoteHost],
+    ["agent", predicate.agent],
+    ["platform", predicate.platform]
+  ];
+  for (const [field, value] of lists) {
+    if (value === void 0) continue;
+    if (!Array.isArray(value) || value.length === 0) {
+      throw new Error(`Extension ${id} ${where} declares "${field}" with nothing in it`);
+    }
+    for (const entry of value) {
+      if (typeof entry !== "string" || entry.trim() === "") {
+        throw new Error(`Extension ${id} ${where} declares an empty "${field}" value`);
+      }
+    }
   }
-  const polledAt = context.now();
-  if (strategy === "lastItem") {
-    const state2 = decodeCursor(context.cursor, "lastItem");
-    const fetched2 = await runFetch(trigger.type, fetchItems, {
-      config: context.config,
-      ...state2 && { lastItemId: state2.id },
-      ...context.limit !== void 0 && { limit: context.limit },
-      now: context.now,
-      fetch: context.fetch
-    });
-    return lastItemPoll(fetched2, state2, context, polledAt);
+  for (const glob of predicate.workspaceContains ?? []) {
+    if (glob.startsWith("/") || glob.split("/").includes("..")) {
+      throw new Error(
+        `Extension ${id} ${where} looks for "${glob}", which is not inside the worktree`
+      );
+    }
   }
-  const state = decodeCursor(context.cursor, "timestamp");
-  const since = state?.t ?? context.since;
-  const fetched = await runFetch(trigger.type, fetchItems, {
-    config: context.config,
-    ...since !== void 0 && { since },
-    ...context.limit !== void 0 && { limit: context.limit },
-    now: context.now,
-    fetch: context.fetch
-  });
-  return timestampPoll(fetched, state, context, polledAt);
-}
-async function runFetch(type, fetchItems, context) {
-  const fetched = await fetchItems(context);
-  if (!Array.isArray(fetched)) {
-    throw new Error(`Trigger ${type} fetch() did not return an array`);
+  for (const agent of predicate.agent ?? []) {
+    if (!EXTENSION_AGENTS.includes(agent)) {
+      throw new Error(
+        `Extension ${id} ${where} names unknown agent ${JSON.stringify(agent)}; expected ${EXTENSION_AGENTS.join(", ")}`
+      );
+    }
   }
-  return fetched;
-}
-
-// src/post-receive.ts
-var UNSAFE_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function segments(path) {
-  return path.split(".").map((part) => part.trim()).filter((part) => part !== "");
-}
-function valueAt(value, path) {
-  let current = value;
-  for (const key of segments(path)) {
-    if (UNSAFE_KEYS2.has(key)) return void 0;
-    if (Array.isArray(current)) {
-      const index = Number(key);
-      if (!Number.isInteger(index)) return void 0;
-      current = current[index];
-      continue;
+  for (const platform of predicate.platform ?? []) {
+    if (!EXTENSION_PLATFORMS.includes(platform)) {
+      throw new Error(
+        `Extension ${id} ${where} names unknown platform ${JSON.stringify(platform)}; expected ${EXTENSION_PLATFORMS.join(", ")}`
+      );
     }
-    if (!isRecord(current)) return void 0;
-    current = Object.prototype.hasOwnProperty.call(current, key) ? current[key] : void 0;
   }
-  return current;
 }
-function withValueAt(value, path, next) {
-  const keys = segments(path);
-  if (keys.length === 0) return next;
-  const [head, ...rest] = keys;
-  if (UNSAFE_KEYS2.has(head)) return value;
-  if (Array.isArray(value)) {
-    const index = Number(head);
-    if (!Number.isInteger(index)) return value;
-    const copy = [...value];
-    copy[index] = rest.length === 0 ? next : withValueAt(copy[index], rest.join("."), next);
-    return copy;
+function assertPane(id, pane) {
+  assertIcon(`Extension ${id} pane ${pane.id}`, pane.icon);
+  const loose = pane;
+  const page2 = loose.web !== void 0;
+  const program = loose.command !== void 0;
+  if (page2 && program) {
+    throw new Error(`Extension ${id} pane ${pane.id} declares both a web page and a command`);
   }
-  const base = isRecord(value) ? value : {};
-  return {
-    ...base,
-    [head]: rest.length === 0 ? next : withValueAt(base[head], rest.join("."), next)
-  };
-}
-function pick(value, keys) {
-  if (Array.isArray(value)) return value.map((entry) => pick(entry, keys));
-  if (!isRecord(value)) return value;
-  const out = {};
-  for (const key of keys) {
-    if (UNSAFE_KEYS2.has(key)) continue;
-    if (Object.prototype.hasOwnProperty.call(value, key)) out[key] = value[key];
+  if (!page2 && !program) {
+    throw new Error(`Extension ${id} pane ${pane.id} declares neither a web page nor a command`);
   }
-  return out;
-}
-function rename(value, from, to) {
-  if (Array.isArray(value)) return value.map((entry) => rename(entry, from, to));
-  if (!isRecord(value)) return value;
-  if (UNSAFE_KEYS2.has(from) || UNSAFE_KEYS2.has(to)) return value;
-  if (!Object.prototype.hasOwnProperty.call(value, from)) return value;
-  const out = {};
-  for (const [key, entry] of Object.entries(value)) {
-    if (key === from) out[to] = entry;
-    else if (key !== to) out[key] = entry;
+  if (page2) {
+    const web = loose.web;
+    if (typeof web !== "string" || !WEB_ENTRY_PATTERN.test(web) || web.split("/").includes("..")) {
+      throw new Error(
+        `Extension ${id} pane ${pane.id} declares the page ${JSON.stringify(web)}; a page is an .html file under web/ in the package`
+      );
+    }
+    return;
   }
-  return out;
-}
-function applyOp(value, op) {
-  if (op.op === "flatten") return valueAt(value, op.path);
-  const target = op.path === void 0 ? value : valueAt(value, op.path);
-  if (op.path !== void 0 && target === void 0) return value;
-  let next;
-  if (op.op === "pick") next = pick(target, op.keys);
-  else if (op.op === "rename") next = rename(target, op.from, op.to);
-  else if (op.op === "filter") {
-    next = Array.isArray(target) ? target.filter((entry) => isRecord(entry) && valueAt(entry, op.key) === op.equals) : target;
-  } else {
-    next = Array.isArray(target) ? target.map((entry) => applyPostReceive(entry, op.ops)) : target;
+  const command = loose.command;
+  if (!Array.isArray(command) || command.length === 0) {
+    throw new Error(`Extension ${id} pane ${pane.id} declares a command with nothing to run`);
   }
-  return op.path === void 0 ? next : withValueAt(value, op.path, next);
-}
-function applyPostReceive(value, ops) {
-  return (ops ?? []).reduce(applyOp, value);
-}
-
-// src/request.ts
-var MAX_ERROR_BODY = 500;
-var PLACEHOLDER = /\{\{\s*(args|config)\.([A-Za-z0-9_.-]+)\s*\}\}/g;
-var WHOLE_PLACEHOLDER = /^\{\{\s*(args|config)\.([A-Za-z0-9_.-]+)\s*\}\}$/;
-function lookup(source, path, scope) {
-  return valueAt(source === "args" ? scope.args : scope.config, path);
-}
-var intoUrl = (value, source) => source === "config" ? value : encodeURIComponent(value);
-function intoHeader(name) {
-  return (value) => {
-    if (/[\r\n]/.test(value)) {
-      throw new Error(`Header "${name}" would carry a line ending, which is not allowed`);
+  for (const arg of command) {
+    if (typeof arg !== "string" || arg === "") {
+      throw new Error(`Extension ${id} pane ${pane.id} declares a command with an empty argument`);
     }
-    return value;
-  };
+  }
 }
-function resolveTemplates(value, scope, substitute) {
-  if (typeof value === "string") {
-    const whole = WHOLE_PLACEHOLDER.exec(value);
-    if (whole) {
-      const resolved = lookup(whole[1], whole[2], scope);
-      if (substitute === void 0 || resolved === void 0 || resolved === null) return resolved;
-      return substitute(String(resolved), whole[1]);
+function defineExtension(definition) {
+  assertIdentity("Extension", definition);
+  const id = definition.id;
+  const panes = definition.panes ?? [];
+  const footers = definition.footers ?? [];
+  const linkHandlers = definition.linkHandlers ?? [];
+  if (panes.length === 0 && footers.length === 0 && linkHandlers.length === 0) {
+    throw new Error(`Extension ${id} contributes nothing`);
+  }
+  const permissions = definition.permissions ?? [];
+  if (!Array.isArray(permissions)) {
+    throw new Error(`Extension ${id} declares permissions that are not a list`);
+  }
+  for (const permission of permissions) {
+    if (!EXTENSION_PERMISSIONS.includes(permission)) {
+      throw new Error(
+        `Extension ${id} asks for unknown permission ${JSON.stringify(permission)}; expected ${EXTENSION_PERMISSIONS.join(", ")}`
+      );
     }
-    return value.replace(PLACEHOLDER, (_match, source, path) => {
-      const resolved = lookup(source, path, scope);
-      if (resolved === void 0 || resolved === null) return "";
-      const text = String(resolved);
-      return substitute === void 0 ? text : substitute(text, source);
-    });
   }
-  if (Array.isArray(value)) return value.map((entry) => resolveTemplates(entry, scope, substitute));
-  if (typeof value === "object" && value !== null) {
-    const out = {};
-    for (const [key, entry] of Object.entries(value)) {
-      out[key] = resolveTemplates(entry, scope, substitute);
+  assertUnique("permission", permissions);
+  const contributions = [...panes, ...footers, ...linkHandlers];
+  for (const contribution of contributions) {
+    if (!KEY_PATTERN.test(contribution.id ?? "")) {
+      throw new Error(
+        `Contribution id "${contribution.id}" must start with a letter and be url-safe`
+      );
+    }
+    if (!contribution.title?.trim()) {
+      throw new Error(`Extension ${id} contribution ${contribution.id} is missing a title`);
+    }
+    assertPredicate(id, `contribution ${contribution.id}`, contribution.when);
+  }
+  assertUnique(
+    "contribution",
+    contributions.map((contribution) => contribution.id)
+  );
+  assertPredicate(id, "activates", definition.activates);
+  for (const pane of panes) assertPane(id, pane);
+  for (const footer of footers) {
+    if (typeof footer.run !== "function") {
+      throw new Error(`Extension ${id} footer ${footer.id} is missing a run() implementation`);
+    }
+    if (!Number.isFinite(footer.every) || footer.every < MIN_FOOTER_SECONDS) {
+      throw new Error(
+        `Extension ${id} footer ${footer.id} asks to run every ${footer.every}s; ${MIN_FOOTER_SECONDS}s is the shortest interval a footer may ask for`
+      );
+    }
+  }
+  for (const handler of linkHandlers) {
+    if (typeof handler.run !== "function") {
+      throw new Error(
+        `Extension ${id} link handler ${handler.id} is missing a run() implementation`
+      );
+    }
+    if (typeof handler.pattern !== "string" || handler.pattern.length > MAX_PATTERN_LENGTH) {
+      throw new Error(
+        `Extension ${id} link handler ${handler.id} has a pattern longer than ${MAX_PATTERN_LENGTH} characters; it is matched on every click`
+      );
+    }
+    if (hasNestedQuantifier(handler.pattern)) {
+      throw new Error(
+        `Extension ${id} link handler ${handler.id} has a pattern that repeats a group which already repeats; matching it can take exponential time on a click`
+      );
+    }
+    let matcher;
+    try {
+      matcher = new RegExp(handler.pattern);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `Extension ${id} link handler ${handler.id} has a pattern that is not a regular expression: ${reason}`,
+        { cause: error }
+      );
+    }
+    if (typeof handler.example !== "string" || handler.example.trim() === "") {
+      throw new Error(
+        `Extension ${id} link handler ${handler.id} names no example link its pattern matches`
+      );
+    }
+    if (!matcher.test(handler.example)) {
+      throw new Error(
+        `Extension ${id} link handler ${handler.id} has the example ${JSON.stringify(handler.example)}, which its own pattern ${JSON.stringify(handler.pattern)} does not match`
+      );
+    }
+  }
+  return {
+    id,
+    name: definition.name,
+    ...definition.description !== void 0 && { description: definition.description },
+    ...definition.icon !== void 0 && { icon: definition.icon },
+    kind: "extension",
+    version: definition.version ?? "0.0.0",
+    // Its credential is the host's own token, so there is nothing to sign in to.
+    auth: { rung: "none" },
+    config: [],
+    triggers: [],
+    actions: [],
+    permissions,
+    ...definition.activates !== void 0 && { activates: definition.activates },
+    contributes: {
+      ...panes.length > 0 && { panes },
+      ...footers.length > 0 && { footers },
+      ...linkHandlers.length > 0 && { linkHandlers }
+    }
+  };
+}
+function resolveConfig(connector, env = process.env) {
+  const config = {};
+  const missing = [];
+  for (const field of connector.config) {
+    const name = envNameFor(field.key, field.env);
+    const value = env[name] ?? field.default;
+    if (value === void 0 || value === "") {
+      if (field.required) missing.push(`${field.key} (${name})`);
+      continue;
     }
-    return out;
+    config[field.key] = value;
   }
-  return value;
-}
-function resolveHeaders(raw, scope) {
-  const out = {};
-  for (const [name, value] of Object.entries(raw ?? {})) {
-    const resolved = resolveTemplates(value, scope, intoHeader(name));
-    if (resolved === void 0 || resolved === null || resolved === "") continue;
-    out[name] = String(resolved);
+  if (missing.length > 0) {
+    throw new Error(
+      `Connector ${connector.id} is missing required configuration: ${missing.join(", ")}`
+    );
   }
-  return out;
+  return config;
 }
-function stringMap(raw) {
-  const out = {};
-  if (typeof raw !== "object" || raw === null) return out;
-  for (const [key, value] of Object.entries(raw)) {
-    if (value === void 0 || value === null || value === "") continue;
-    out[key] = String(value);
-  }
-  return out;
+
+// src/setup.ts
+function pollToolName(triggerType) {
+  return `poll_${triggerType}`;
 }
-function resolveRequest(request, scope) {
-  const method = (request.method ?? "GET").toUpperCase();
-  const rawUrl = resolveTemplates(request.url, scope, intoUrl);
-  if (typeof rawUrl !== "string" || rawUrl.trim() === "") {
-    throw new Error("Request has no URL once its templates are resolved");
-  }
-  let url;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    throw new Error(`Request URL is not a URL once its templates are resolved: "${rawUrl}"`);
-  }
-  for (const [key, value] of Object.entries(stringMap(resolveTemplates(request.query, scope)))) {
-    url.searchParams.set(key, value);
-  }
-  const headers = resolveHeaders(request.headers, scope);
-  const resolved = { url: url.toString(), method, headers };
-  if (request.body !== void 0 && method !== "GET" && method !== "HEAD") {
-    const body = resolveTemplates(request.body, scope);
-    if (body !== void 0) {
-      resolved.body = typeof body === "string" ? body : JSON.stringify(body);
-      if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
-        resolved.headers["content-type"] = typeof body === "string" ? "text/plain" : "application/json";
-      }
-    }
-  }
-  return resolved;
+function footerToolName(footerId) {
+  return `vorn_footer_${footerId}`;
 }
-async function readBody(response) {
-  const text = await response.text();
-  if (text === "") return void 0;
-  const type = response.headers.get("content-type") ?? "";
-  if (!type.includes("json")) return text;
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
+function handlerToolName(handlerId) {
+  return `vorn_handler_${handlerId}`;
 }
-function describeFailure(response, body) {
-  const detail = typeof body === "string" ? body : body === void 0 ? "" : JSON.stringify(body);
-  const quoted = detail.length > MAX_ERROR_BODY ? `${detail.slice(0, MAX_ERROR_BODY)}\u2026` : detail;
-  return `Request failed with ${response.status} ${response.statusText}${quoted ? `: ${quoted}` : ""}`;
+var MANIFEST_TOOL = "vorn_connector_manifest";
+var PREFLIGHT_TOOL = "vorn_connector_preflight";
+var OPTIONS_TOOL = "vorn_connector_options";
+function connectionSetup(connector, triggerType) {
+  const trigger = connector.triggers.find((entry) => entry.type === triggerType);
+  if (!trigger) {
+    throw new Error(`Connector ${connector.id} has no trigger "${triggerType}"`);
+  }
+  return {
+    connectorId: connector.id,
+    triggerType,
+    filters: {
+      pollTool: pollToolName(triggerType),
+      itemsPath: "items",
+      idField: "externalId",
+      timestampField: "updatedAt",
+      titleField: "title",
+      urlField: "url",
+      cursorArg: "cursor",
+      cursorPath: "nextCursor"
+    },
+    env: connector.config.map((field) => ({
+      name: envNameFor(field.key, field.env),
+      required: field.required === true,
+      secret: field.secret === true,
+      ...field.description !== void 0 && { description: field.description },
+      ...field.builderHint !== void 0 && { builderHint: field.builderHint }
+    }))
+  };
 }
-async function sendRequest(resolved, options) {
-  const response = await options.fetchImpl(resolved.url, {
-    method: resolved.method,
-    headers: resolved.headers,
-    ...resolved.body !== void 0 && { body: resolved.body }
+function manifestContributions(connector) {
+  const contributes = connector.contributes;
+  if (!contributes) return void 0;
+  const shared = (contribution) => ({
+    id: contribution.id,
+    title: contribution.title,
+    ...contribution.description !== void 0 && { description: contribution.description },
+    ...contribution.when !== void 0 && { when: contribution.when }
   });
-  const body = await readBody(response);
-  if (!response.ok) throw new Error(describeFailure(response, body));
-  return { response, body };
+  return {
+    ...contributes.panes !== void 0 && {
+      panes: contributes.panes.map((pane) => ({
+        ...shared(pane),
+        ...pane.icon !== void 0 && { icon: pane.icon },
+        ...pane.web !== void 0 && { web: pane.web },
+        ...pane.command !== void 0 && { command: pane.command }
+      }))
+    },
+    ...contributes.footers !== void 0 && {
+      footers: contributes.footers.map((footer) => ({ ...shared(footer), every: footer.every }))
+    },
+    ...contributes.linkHandlers !== void 0 && {
+      linkHandlers: contributes.linkHandlers.map((handler) => ({
+        ...shared(handler),
+        pattern: handler.pattern,
+        example: handler.example
+      }))
+    }
+  };
 }
-function asOutput(value) {
-  if (Array.isArray(value)) return { items: value };
-  if (typeof value === "object" && value !== null) return value;
-  return value === void 0 ? {} : { result: value };
+function connectorManifest(connector) {
+  const contributes = manifestContributions(connector);
+  return {
+    id: connector.id,
+    name: connector.name,
+    version: connector.version,
+    kind: connector.kind,
+    ...connector.description !== void 0 && { description: connector.description },
+    ...connector.icon !== void 0 && { icon: connector.icon },
+    ...connector.auth !== void 0 && { auth: connector.auth },
+    ...contributes !== void 0 && { contributes },
+    ...connector.permissions !== void 0 && { permissions: connector.permissions },
+    ...connector.activates !== void 0 && { activates: connector.activates },
+    triggers: connector.triggers.map((trigger) => ({
+      type: trigger.type,
+      label: trigger.label,
+      ...trigger.description !== void 0 && { description: trigger.description },
+      // Carried through so the app can seed a connection's status mapping and
+      // its polling workflow. Absent when the connector said nothing, which is
+      // different from saying there is nothing.
+      ...trigger.statusMapping !== void 0 && { statusMapping: trigger.statusMapping },
+      ...trigger.defaultWorkflow !== void 0 && { defaultWorkflow: trigger.defaultWorkflow },
+      setup: connectionSetup(connector, trigger.type)
+    })),
+    actions: connector.actions.map((action) => ({
+      type: action.type,
+      label: action.label,
+      ...action.description !== void 0 && { description: action.description },
+      inputs: (action.inputs ?? []).map((input) => ({
+        key: input.key,
+        label: input.label,
+        type: input.type ?? "string",
+        required: input.required === true,
+        ...input.options !== void 0 && { options: input.options },
+        ...input.loadOptions !== void 0 && { loadOptions: input.loadOptions },
+        ...input.builderHint !== void 0 && { builderHint: input.builderHint }
+      })),
+      ...action.outputs !== void 0 && { outputs: action.outputs },
+      ...action.sample !== void 0 && { sample: action.sample }
+    }))
+  };
 }
-var MAX_REQUEST_PAGES = 100;
-var LINK_NEXT = /<([^>]+)>\s*;[^,]*\brel\s*=\s*"?next"?/i;
-function nextLink(header) {
-  const match = header === null ? null : LINK_NEXT.exec(header);
-  return match ? match[1] : void 0;
+
+// src/packaging.ts
+import { builtinModules } from "module";
+import { existsSync, readFileSync } from "fs";
+import { cp, mkdtemp, readdir, stat, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname, isAbsolute, join, resolve } from "path";
+var MAX_PACK_BYTES = 8 * 1024 * 1024;
+var MAX_UNPACKED_BYTES = 32 * 1024 * 1024;
+var LIFECYCLE_SCRIPTS = [
+  "preinstall",
+  "install",
+  "postinstall",
+  "prepare",
+  "prepublish",
+  "prepublishOnly",
+  "postpublish"
+];
+var BUILTINS = new Set(builtinModules);
+function finding(code, target, message, level = "error") {
+  return { level, code, target, message };
 }
-function pageItems(body, itemsPath) {
-  const value = itemsPath === void 0 ? body : valueAt(body, itemsPath);
-  return Array.isArray(value) ? value : void 0;
+function lifecycleScriptFindings(pkg) {
+  const scripts = pkg?.scripts;
+  if (!scripts || typeof scripts !== "object") return [];
+  const named = LIFECYCLE_SCRIPTS.filter((name) => typeof scripts[name] === "string");
+  if (named.length === 0) return [];
+  return [
+    finding(
+      "lifecycle-scripts",
+      "package.json",
+      `Remove the ${named.join(", ")} script(s); a pack is installed by copying files, never by running them`
+    )
+  ];
 }
-async function collectPages(request, strategy, scope, options) {
-  const collected = [];
-  const seen = /* @__PURE__ */ new Set();
-  let page2 = strategy.kind === "page" ? strategy.startPage ?? 1 : 0;
-  let cursor;
-  let nextUrl;
-  for (let index = 0; index < MAX_REQUEST_PAGES; index++) {
-    const resolved = resolveRequest(request, scope);
-    if (nextUrl !== void 0) resolved.url = nextUrl;
-    if (strategy.kind === "cursor" && cursor !== void 0) {
-      const url = new URL(resolved.url);
-      url.searchParams.set(strategy.param, cursor);
-      resolved.url = url.toString();
+function bundleDependencyFindings(external) {
+  const specifiers = /* @__PURE__ */ new Set();
+  for (const specifier of external) {
+    if (specifier.startsWith(".") || specifier.startsWith("/")) continue;
+    if (specifier.startsWith("node:") || BUILTINS.has(specifier)) continue;
+    specifiers.add(specifier);
+  }
+  if (specifiers.size === 0) return [];
+  return [
+    finding(
+      "runtime-dependencies",
+      "bundle",
+      `${[...specifiers].sort().join(", ")} stayed outside the bundle; a pack must launch with no install step`
+    )
+  ];
+}
+var RELATIVE_REQUIRE = /(?:__)?(?:require(?:\.resolve)?|import)\(\s*(['"])(\.\.?\/[^'"]*)\1\s*\)/y;
+var RELATIVE_CREATE_REQUIRE = /createRequire\([^()]*\)\(\s*(['"])(\.\.?\/[^'"]*)\1\s*\)/y;
+var CALL_WORDS = /* @__PURE__ */ new Set(["require", "__require", "createRequire", "import"]);
+var BEFORE_REGEX = /* @__PURE__ */ new Set(["", ..."(,=:[!&|?{};+-*%~^<>"]);
+var BEFORE_REGEX_WORDS = /* @__PURE__ */ new Set([
+  "return",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "new",
+  "delete",
+  "void",
+  "case",
+  "do",
+  "else",
+  "yield",
+  "await"
+]);
+var WORD = /[\w$]/;
+function endOfQuoted(code, start) {
+  const quote2 = code[start];
+  let i = start + 1;
+  while (i < code.length) {
+    if (code[i] === "\\") {
+      i += 2;
+      continue;
     }
-    if (strategy.kind === "page") {
-      const url = new URL(resolved.url);
-      url.searchParams.set(strategy.param, String(page2));
-      resolved.url = url.toString();
+    if (code[i] === quote2) return i + 1;
+    i += 1;
+  }
+  return code.length;
+}
+function endOfRegex(code, start) {
+  let i = start + 1;
+  let inClass = false;
+  while (i < code.length) {
+    const ch = code[i];
+    if (ch === "\\") {
+      i += 2;
+      continue;
     }
-    if (seen.has(resolved.url)) {
-      throw new Error(`Request for ${request.url} asked for the same page twice`);
+    if (ch === "\n") return i;
+    if (ch === "[") inClass = true;
+    else if (ch === "]") inClass = false;
+    else if (ch === "/" && !inClass) return i + 1;
+    i += 1;
+  }
+  return code.length;
+}
+function relativeRuntimeSpecifiers(code) {
+  const found = /* @__PURE__ */ new Set();
+  let previous = "";
+  let previousWord = "";
+  let i = 0;
+  while (i < code.length) {
+    const ch = code[i];
+    if (ch === "/" && code[i + 1] === "/") {
+      const end = code.indexOf("\n", i);
+      i = end === -1 ? code.length : end;
+      continue;
     }
-    seen.add(resolved.url);
-    const { response, body } = await sendRequest(resolved, options);
-    const items = pageItems(body, strategy.itemsPath);
-    if (items === void 0) {
-      if (index === 0) {
-        const where = strategy.itemsPath === void 0 ? "the response is not a list" : `the response has no list at "${strategy.itemsPath}"`;
-        throw new Error(`Cannot page through this request: ${where}`);
-      }
-      return collected;
+    if (ch === "/" && code[i + 1] === "*") {
+      const end = code.indexOf("*/", i + 2);
+      i = end === -1 ? code.length : end + 2;
+      continue;
     }
-    collected.push(...items);
-    if (items.length === 0) return collected;
-    if (strategy.kind === "cursor") {
-      const next = valueAt(body, strategy.cursorPath);
-      if (next === void 0 || next === null || next === "") return collected;
-      cursor = String(next);
+    if (ch === '"' || ch === "'" || ch === "`") {
+      i = endOfQuoted(code, i);
+      previous = ch;
+      previousWord = "";
       continue;
     }
-    if (strategy.kind === "link") {
-      nextUrl = nextLink(response.headers.get("link"));
-      if (nextUrl === void 0) return collected;
+    if (ch === "/" && (BEFORE_REGEX.has(previous) || BEFORE_REGEX_WORDS.has(previousWord))) {
+      i = endOfRegex(code, i);
+      previous = "/";
+      previousWord = "";
+      continue;
+    }
+    if (WORD.test(ch)) {
+      const start = i;
+      while (i < code.length && WORD.test(code[i])) i += 1;
+      const word = code.slice(start, i);
+      if (CALL_WORDS.has(word) && code[start - 1] !== ".") {
+        for (const pattern of [RELATIVE_REQUIRE, RELATIVE_CREATE_REQUIRE]) {
+          pattern.lastIndex = start;
+          const match = pattern.exec(code);
+          if (match) found.add(match[2]);
+        }
+      }
+      previous = code[i - 1];
+      previousWord = word;
       continue;
     }
-    page2 += 1;
+    if (!/\s/.test(ch)) {
+      previous = ch;
+      previousWord = "";
+    }
+    i += 1;
+  }
+  return [...found];
+}
+function bundledRequireFindings(code) {
+  const specifiers = relativeRuntimeSpecifiers(code);
+  if (specifiers.length === 0) return [];
+  return [
+    finding(
+      "runtime-dependencies",
+      "bundle",
+      `${specifiers.sort().join(", ")} ${specifiers.length === 1 ? "is" : "are"} required at runtime; a pack is one file, so nothing beside it survives packing`,
+      "warn"
+    )
+  ];
+}
+function packageDirFor(resolveDir, entry) {
+  const from = resolve(resolveDir);
+  if (entry === void 0) return from;
+  return entry.startsWith(".") || isAbsolute(entry) ? dirname(resolve(from, entry)) : from;
+}
+function readNearestPackageJson(fromDir) {
+  let current = resolve(fromDir);
+  for (; ; ) {
+    try {
+      return JSON.parse(readFileSync(join(current, "package.json"), "utf8"));
+    } catch {
+      const parent = dirname(current);
+      if (parent === current) return void 0;
+      current = parent;
+    }
   }
-  throw new Error(`Request for ${request.url} exceeded ${MAX_REQUEST_PAGES} pages`);
 }
-async function executeRequest(request, postReceive, scope, options) {
-  if (request.paginate) {
-    const items = await collectPages(request, request.paginate, scope, options);
-    return asOutput(applyPostReceive(items, postReceive));
+function packageRootFor(fromDir) {
+  let current = resolve(fromDir);
+  for (; ; ) {
+    if (existsSync(join(current, "package.json"))) return current;
+    const parent = dirname(current);
+    if (parent === current) return resolve(fromDir);
+    current = parent;
   }
-  const { body } = await sendRequest(resolveRequest(request, scope), options);
-  return asOutput(applyPostReceive(body, postReceive));
 }
-
-// src/resilience.ts
-var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
-var DEFAULT_ATTEMPTS = 3;
-var DEFAULT_BASE_DELAY_MS = 250;
-var DEFAULT_MAX_DELAY_MS = 3e4;
-var MAX_ATTEMPTS = 10;
-var MAX_TOTAL_WAIT_MS = 12e4;
-var wait = (ms) => new Promise((resolve3) => {
-  setTimeout(resolve3, ms);
-});
-function retryAfterMs(header, now) {
-  if (!header) return void 0;
-  const trimmed = header.trim();
-  if (trimmed === "") return void 0;
-  const seconds = Number(trimmed);
-  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
-  const at = Date.parse(trimmed);
-  if (Number.isNaN(at)) return void 0;
-  return Math.max(0, at - now);
+function packEntryContents(entry, sdkModule = "@vornrun/connector-sdk") {
+  return [
+    `import { serveConnector } from ${JSON.stringify(sdkModule)}`,
+    `import * as entry from ${JSON.stringify(entry)}`,
+    "const exported = Object.values(entry).find((value) => value && Array.isArray(value.triggers))",
+    `if (!exported) throw new Error(${JSON.stringify(`${entry} exports no connector`)})`,
+    "await serveConnector(exported)",
+    ""
+  ].join("\n");
 }
-function backoffMs(attempt, policy = {}) {
-  const base = policy.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
-  const max = policy.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
-  return Math.min(max, base * 2 ** attempt);
+var WEB_DIR = "web";
+async function directoryBytes(dir) {
+  let total = 0;
+  for (const entry of await readdir(dir, { withFileTypes: true, recursive: true })) {
+    if (!entry.isFile()) continue;
+    total += (await stat(join(entry.parentPath, entry.name))).size;
+  }
+  return total;
+}
+function webDirectories(connector) {
+  const dirs = (connector.contributes?.panes ?? []).map((pane) => pane.web).filter((web) => web !== void 0).map((web) => dirname(web));
+  return [...new Set(dirs)];
+}
+async function stagePack(connector, code, packageRoot) {
+  const dir = await mkdtemp(join(tmpdir(), "vorn-pack-"));
+  await writeFile(join(dir, "index.js"), code, "utf8");
+  await writeFile(
+    join(dir, "manifest.json"),
+    `${JSON.stringify(connectorManifest(connector), null, 2)}
+`,
+    "utf8"
+  );
+  if (packageRoot !== void 0) {
+    for (const relative of webDirectories(connector)) {
+      const from = join(packageRoot, relative);
+      if (existsSync(from)) await cp(from, join(dir, relative), { recursive: true });
+    }
+  }
+  return dir;
+}
+var LAUNCH_TIMEOUT_MS = 15e3;
+var LAUNCH_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "USERPROFILE",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "PROGRAMFILES",
+  "SystemRoot",
+  "SYSTEMDRIVE",
+  "COMSPEC",
+  "PATHEXT",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TZ",
+  "SHELL",
+  "TERM",
+  "USER",
+  "LOGNAME",
+  "NODE_EXTRA_CA_CERTS"
+];
+function launchEnv() {
+  const env = {};
+  for (const key of LAUNCH_ENV_KEYS) {
+    const value = process.env[key];
+    if (value !== void 0) env[key] = value;
+  }
+  return env;
+}
+function errorLine(text) {
+  const lines = text.split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  return [...lines].reverse().find((line) => /Error\b/.test(line)) ?? lines[lines.length - 1];
+}
+function withTimeout(promise, ms, message) {
+  let timer;
+  return Promise.race([
+    promise.finally(() => clearTimeout(timer)),
+    new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(message)), ms);
+    })
+  ]);
+}
+async function packLaunchFindings(dir) {
+  const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
+  const { StdioClientTransport } = await import("@modelcontextprotocol/sdk/client/stdio.js");
+  const transport = new StdioClientTransport({
+    command: process.execPath,
+    args: ["index.js"],
+    cwd: dir,
+    env: launchEnv(),
+    stderr: "pipe"
+  });
+  const client = new Client({ name: "vorn-connector-check", version: "1" }, { capabilities: {} });
+  let stderr = "";
+  transport.stderr?.on("data", (chunk) => {
+    stderr += chunk.toString();
+  });
+  try {
+    await withTimeout(
+      client.connect(transport),
+      LAUNCH_TIMEOUT_MS,
+      `did not answer within ${LAUNCH_TIMEOUT_MS / 1e3}s of starting`
+    );
+    return [];
+  } catch (error) {
+    const said = error instanceof Error ? error.message : String(error);
+    return [
+      finding("pack-launch", "bundle", `did not start as a pack: ${errorLine(stderr) ?? said}`)
+    ];
+  } finally {
+    await client.close().catch(() => {
+    });
+    await transport.close().catch(() => {
+    });
+  }
 }
-function resilientFetch(options) {
-  const attempts = Math.min(MAX_ATTEMPTS, Math.max(1, options.retry?.attempts ?? DEFAULT_ATTEMPTS));
-  const sleep = options.sleep ?? wait;
-  const ceiling = options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
-  const send = async (input, init) => {
-    let waited = 0;
-    const pause = async (ms) => {
-      if (waited + ms > MAX_TOTAL_WAIT_MS) return false;
-      waited += ms;
-      await sleep(ms);
-      return true;
-    };
-    for (let attempt = 0; attempt < attempts; attempt++) {
-      const last = attempt === attempts - 1;
-      try {
-        const response = await options.fetchImpl(input, init);
-        if (!RETRYABLE_STATUS.has(response.status)) return response;
-        if (!options.retryable || last) return response;
-        const asked = retryAfterMs(response.headers.get("retry-after"), Date.now());
-        const delay = asked === void 0 ? backoffMs(attempt, options.retry) : Math.min(asked, ceiling);
-        if (!await pause(delay)) return response;
-      } catch (error) {
-        if (!options.retryable || last) throw error;
-        if (!await pause(backoffMs(attempt, options.retry))) throw error;
-      }
+async function esbuildBundle(request) {
+  const { build } = await import("esbuild");
+  const result = await build({
+    stdin: {
+      contents: request.contents,
+      resolveDir: request.resolveDir,
+      sourcefile: "vorn-connector-pack.js",
+      loader: "js"
+    },
+    bundle: true,
+    platform: "node",
+    target: "node20",
+    format: "esm",
+    write: false,
+    metafile: true,
+    legalComments: "none",
+    // A bundled CommonJS dependency asks for its builtins through esbuild's shim, which throws unless a real require is in scope.
+    banner: {
+      js: [
+        "import { createRequire as __vornCreateRequire } from 'node:module'",
+        "const require = __vornCreateRequire(import.meta.url)",
+        ""
+      ].join("\n")
     }
-    throw new Error("Request was never attempted");
+  });
+  const output = Object.values(result.metafile.outputs)[0];
+  return {
+    code: result.outputFiles[0].text,
+    external: (output?.imports ?? []).filter((item) => item.external).map((item) => item.path)
   };
-  return send;
 }
 
-// src/runtime.ts
-var MAX_POLL_PAGES = 1e3;
-async function runPoll(connector, triggerType, options = {}) {
-  const trigger = connector.triggers.find((entry) => entry.type === triggerType);
-  if (!trigger) {
-    throw new Error(`Connector ${connector.id} has no trigger "${triggerType}"`);
+// src/host.ts
+var HOST_URL_ENV = "VORN_EXTENSION_HOST";
+var HOST_TOKEN_ENV = "VORN_EXTENSION_TOKEN";
+var PermissionDeniedError = class extends Error {
+  constructor(method, detail) {
+    super(`The host refused ${method}: ${detail}`);
+    this.name = "PermissionDeniedError";
   }
-  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const polledAt = now();
-  const context = {
-    config: options.config ?? {},
-    ...options.since !== void 0 && { since: options.since },
-    ...options.cursor !== void 0 && { cursor: options.cursor },
-    ...options.limit !== void 0 && { limit: options.limit },
-    now,
-    // A poll only reads, so every failure it meets is worth trying again.
-    fetch: resilientFetch({
-      fetchImpl: options.fetchImpl ?? globalThis.fetch,
-      retryable: true,
-      ...options.retry !== void 0 && { retry: options.retry },
-      ...options.sleep !== void 0 && { sleep: options.sleep }
-    })
-  };
-  const outcome = typeof trigger.poll === "function" ? await trigger.poll(context) : await pollWithDedupe(trigger, context);
-  if (!outcome || !Array.isArray(outcome.items)) {
-    throw new Error(`Trigger ${triggerType} did not return an items array`);
+};
+var HostReplyError = class extends Error {
+  constructor(method, detail) {
+    super(`The host answered ${method} with ${detail}`);
+    this.name = "HostReplyError";
   }
-  if (outcome.hasMore && !outcome.nextCursor) {
-    throw new Error(`Trigger ${triggerType} reported more pages without a nextCursor`);
+};
+var HOST_TIMEOUT_MS = 15e3;
+var LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "[::1]"];
+function endpoint(env) {
+  const url = env[HOST_URL_ENV]?.trim();
+  const token = env[HOST_TOKEN_ENV]?.trim();
+  if (!url || !token) {
+    throw new Error(
+      `This extension was started without a host bridge; ${HOST_URL_ENV} and ${HOST_TOKEN_ENV} are set by Vorn`
+    );
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`${HOST_URL_ENV} is ${JSON.stringify(url)}, which is not a URL`);
+  }
+  if (parsed.protocol !== "http:" || !LOOPBACK_HOSTS.includes(parsed.hostname)) {
+    throw new Error(
+      `${HOST_URL_ENV} is ${JSON.stringify(url)}; the bridge is served on this machine, over http on ${LOOPBACK_HOSTS.join(", ")}`
+    );
+  }
+  return { url: url.replace(/\/$/, ""), token };
+}
+function createExtensionHost(options) {
+  const env = options.env ?? process.env;
+  const call = options.fetchImpl ?? fetch;
+  async function ask(method, params) {
+    const { url, token } = endpoint(env);
+    const response = await call(`${url}/${method}`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ sessionId: options.sessionId, ...params }),
+      signal: AbortSignal.timeout(HOST_TIMEOUT_MS)
+    });
+    const text = await response.text();
+    if (response.status === 403) throw new PermissionDeniedError(method, text || "not granted");
+    if (!response.ok) throw new Error(`The host answered ${method} with HTTP ${response.status}`);
+    if (text === "") return void 0;
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      throw new HostReplyError(method, "a body that is not JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || !("result" in parsed)) {
+      throw new HostReplyError(method, "a body carrying no result");
+    }
+    return parsed.result;
   }
   return {
-    items: normalizeItems(outcome.items, polledAt),
-    ...outcome.nextCursor !== void 0 && { nextCursor: outcome.nextCursor },
-    hasMore: outcome.hasMore === true
+    diff: () => ask("diff", {}),
+    status: () => ask("status", {}),
+    output: (opts) => ask("output", { ...opts?.lines !== void 0 && { lines: opts.lines } }),
+    selection: () => ask("selection", {}),
+    send: (text) => ask("send", { text }),
+    rename: (name) => ask("rename", { name }),
+    usage: () => ask("usage", {})
   };
 }
-async function drainPoll(connector, triggerType, options = {}) {
-  const collected = [];
-  let cursor = options.cursor;
-  for (let page2 = 0; page2 < MAX_POLL_PAGES; page2++) {
-    const result = await runPoll(connector, triggerType, {
-      ...options,
-      ...cursor !== void 0 && { cursor }
-    });
-    collected.push(...result.items);
-    if (!result.hasMore) return collected;
-    if (result.nextCursor === cursor) {
-      throw new Error(`Trigger ${triggerType} did not advance its cursor`);
-    }
-    cursor = result.nextCursor;
+
+// src/normalize.ts
+var RESERVED_KEYS = [
+  "externalId",
+  "title",
+  "url",
+  "description",
+  "status",
+  "labels",
+  "assignee",
+  "updatedAt"
+];
+var UNSAFE_KEYS = ["__proto__", "constructor", "prototype"];
+function itemExternalId(item) {
+  return String(item.externalId ?? "").trim();
+}
+function itemTimestamp(item, fallback) {
+  return isoTimestamp(item.updatedAt, fallback);
+}
+function isoTimestamp(value, fallback) {
+  if (value === void 0) return fallback;
+  const date = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new Error(`Invalid updatedAt: ${String(value)}`);
   }
-  throw new Error(`Trigger ${triggerType} exceeded ${MAX_POLL_PAGES} pages`);
+  return date.toISOString();
 }
-var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-async function runOptions(connector, name, options = {}) {
-  const loader = connector.options?.[name];
-  if (!loader) {
-    throw new Error(`Connector ${connector.id} serves no options set "${name}"`);
+function normalizeItem(item, polledAt) {
+  const externalId = itemExternalId(item);
+  if (!externalId) {
+    throw new Error("Connector item is missing externalId");
   }
-  const loaded = await loader({
-    config: options.config ?? {},
-    now: options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()),
-    fetch: resilientFetch({
-      fetchImpl: options.fetchImpl ?? globalThis.fetch,
-      retryable: true,
-      ...options.retry !== void 0 && { retry: options.retry },
-      ...options.sleep !== void 0 && { sleep: options.sleep }
-    })
+  if (!item.title || !item.title.trim()) {
+    throw new Error(`Connector item ${externalId} is missing title`);
+  }
+  const extra = {};
+  for (const [key, value] of Object.entries(item.data ?? {})) {
+    if (RESERVED_KEYS.includes(key)) continue;
+    if (UNSAFE_KEYS.includes(key)) continue;
+    extra[key] = value;
+  }
+  return {
+    ...extra,
+    externalId,
+    title: item.title,
+    url: item.url ?? "",
+    description: item.description ?? "",
+    status: item.status ?? "open",
+    labels: item.labels ?? [],
+    ...item.assignee !== void 0 && { assignee: item.assignee },
+    updatedAt: isoTimestamp(item.updatedAt, polledAt)
+  };
+}
+function normalizeItems(items, polledAt) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.map((item) => {
+    const normalized = normalizeItem(item, polledAt);
+    if (seen.has(normalized.externalId)) {
+      throw new Error(`Duplicate externalId "${normalized.externalId}" in one poll page`);
+    }
+    seen.add(normalized.externalId);
+    return normalized;
   });
-  if (!Array.isArray(loaded)) {
-    throw new Error(`Options set "${name}" did not return an array`);
+}
+
+// src/dedupe.ts
+var MAX_BOUNDARY_IDS = 500;
+function decodeCursor(cursor, strategy) {
+  if (!cursor) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(cursor);
+  } catch (error) {
+    throw new Error(`Cursor is not valid SDK cursor JSON: ${cursor}`, { cause: error });
   }
-  return loaded.map(
-    (entry) => typeof entry === "string" ? { value: entry } : { ...entry, value: String(entry.value) }
-  );
+  const state = parsed;
+  if (!state || typeof state !== "object" || state.v !== 1 || state.s !== strategy) {
+    throw new Error(`Cursor does not belong to the "${strategy}" strategy: ${cursor}`);
+  }
+  const wellFormed = state.s === "timestamp" ? typeof state.t === "string" && Array.isArray(state.ids) && state.ids.every((id) => typeof id === "string") : typeof state.id === "string";
+  if (!wellFormed) {
+    throw new Error(`Cursor is missing the fields the "${strategy}" strategy needs: ${cursor}`);
+  }
+  return state;
 }
-var MAX_QUOTED_VALUE = 80;
-function quote(value) {
-  return value.length > MAX_QUOTED_VALUE ? `${value.slice(0, MAX_QUOTED_VALUE)}\u2026` : value;
+function compare(left, right) {
+  if (left === right) return 0;
+  return left < right ? -1 : 1;
 }
-function coerceArg(value, type) {
-  if (typeof value !== "string") return value;
-  if (type === "number") {
-    const parsed = Number(value);
-    if (Number.isNaN(parsed)) throw new Error(`Expected a number, got "${quote(value)}"`);
-    return parsed;
+function page(chronological, context, hadCursor, nextCursor) {
+  const delivered = context.limit === void 0 ? chronological : chronological.slice(0, context.limit);
+  if (delivered.length === 0) {
+    return { items: [], ...context.cursor !== void 0 && { nextCursor: context.cursor } };
   }
-  if (type === "boolean") {
-    if (value === "true") return true;
-    if (value === "false") return false;
-    throw new Error(`Expected a boolean, got "${quote(value)}"`);
+  return {
+    items: delivered.map((entry) => entry.item),
+    nextCursor: JSON.stringify(nextCursor(delivered)),
+    // Only drain a backlog we know we truncated, and only once a cursor
+    // exists — a first poll should not pull the source's entire history.
+    hasMore: chronological.length > delivered.length && hadCursor
+  };
+}
+function timestampPoll(fetched, state, context, polledAt) {
+  const boundary = state?.t ?? context.since;
+  const seen = new Set(state?.ids ?? []);
+  const fresh = [];
+  const pinnedAlreadySeen = [];
+  for (const item of fetched) {
+    const id = itemExternalId(item);
+    const pinned = item.updatedAt === void 0 && boundary !== void 0;
+    const at = pinned ? boundary : itemTimestamp(item, polledAt);
+    const isNew = boundary === void 0 || at > boundary || at === boundary && !seen.has(id);
+    if (isNew) fresh.push({ item, at, id, ...pinned && { pinned: true } });
+    else if (pinned) pinnedAlreadySeen.push(id);
   }
-  if (type === "json") {
-    try {
-      return JSON.parse(value);
-    } catch {
-      throw new Error(`Expected JSON, got "${quote(value)}"`);
+  fresh.sort((left, right) => compare(left.at, right.at) || compare(left.id, right.id));
+  return page(fresh, context, state !== void 0, (delivered) => {
+    const newest = delivered[delivered.length - 1].at;
+    const atNewest = [];
+    for (let i = delivered.length - 1; i >= 0 && delivered[i].at === newest; i -= 1) {
+      atNewest.push(delivered[i].id);
     }
-  }
-  return value;
+    const carried = newest === boundary ? [...seen, ...atNewest] : [
+      ...pinnedAlreadySeen,
+      ...delivered.filter((entry) => entry.pinned).map((entry) => entry.id),
+      ...atNewest
+    ];
+    return { v: 1, s: "timestamp", t: newest, ids: carried.slice(-MAX_BOUNDARY_IDS) };
+  });
 }
-async function runAction(connector, actionType, args, options = {}) {
-  const action = connector.actions.find((entry) => entry.type === actionType);
-  if (!action) {
-    throw new Error(`Connector ${connector.id} has no action "${actionType}"`);
+function lastItemPoll(fetched, state, context, polledAt) {
+  const keyed = fetched.map((item) => ({
+    item,
+    at: itemTimestamp(item, polledAt),
+    id: itemExternalId(item)
+  }));
+  const stopAt = state ? keyed.findIndex((entry) => entry.id === state.id) : -1;
+  const chronological = (stopAt === -1 ? keyed : keyed.slice(0, stopAt)).reverse();
+  return page(chronological, context, state !== void 0, (delivered) => ({
+    v: 1,
+    s: "lastItem",
+    id: delivered[delivered.length - 1].id
+  }));
+}
+async function pollWithDedupe(trigger, context) {
+  const strategy = trigger.dedupe;
+  const fetchItems = trigger.fetch;
+  if (!strategy || !fetchItems) {
+    throw new Error(`Trigger ${trigger.type} is not a declarative trigger`);
   }
-  const coerced = { ...args };
-  for (const input of action.inputs ?? []) {
-    const value = coerced[input.key];
-    if (value === void 0 || value === "") {
-      if (input.required) throw new Error(`Action ${actionType} requires "${input.key}"`);
-      delete coerced[input.key];
-      continue;
-    }
-    try {
-      coerced[input.key] = coerceArg(value, input.type);
-    } catch (error) {
-      throw new Error(
-        `Action ${actionType} argument "${input.key}": ${error instanceof Error ? error.message : String(error)}`,
-        { cause: error }
-      );
-    }
+  const polledAt = context.now();
+  if (strategy === "lastItem") {
+    const state2 = decodeCursor(context.cursor, "lastItem");
+    const fetched2 = await runFetch(trigger.type, fetchItems, {
+      config: context.config,
+      ...state2 && { lastItemId: state2.id },
+      ...context.limit !== void 0 && { limit: context.limit },
+      now: context.now,
+      fetch: context.fetch
+    });
+    return lastItemPoll(fetched2, state2, context, polledAt);
   }
-  const config = options.config ?? {};
-  const method = (action.request?.method ?? "GET").toUpperCase();
-  const retryable = action.idempotent === true || action.request !== void 0 && SAFE_METHODS.has(method);
-  const fetchImpl = resilientFetch({
-    fetchImpl: options.fetchImpl ?? globalThis.fetch,
-    retryable,
-    ...options.retry !== void 0 && { retry: options.retry },
-    ...options.sleep !== void 0 && { sleep: options.sleep }
+  const state = decodeCursor(context.cursor, "timestamp");
+  const since = state?.t ?? context.since;
+  const fetched = await runFetch(trigger.type, fetchItems, {
+    config: context.config,
+    ...since !== void 0 && { since },
+    ...context.limit !== void 0 && { limit: context.limit },
+    now: context.now,
+    fetch: context.fetch
   });
-  if (action.request !== void 0) {
-    try {
-      return await executeRequest(
-        action.request,
-        action.postReceive,
-        { args: coerced, config },
-        { fetchImpl }
-      );
-    } catch (error) {
-      throw new Error(
-        `Action ${actionType}: ${error instanceof Error ? error.message : String(error)}`,
-        { cause: error }
-      );
+  return timestampPoll(fetched, state, context, polledAt);
+}
+async function runFetch(type, fetchItems, context) {
+  const fetched = await fetchItems(context);
+  if (!Array.isArray(fetched)) {
+    throw new Error(`Trigger ${type} fetch() did not return an array`);
+  }
+  return fetched;
+}
+
+// src/post-receive.ts
+var UNSAFE_KEYS2 = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function segments(path) {
+  return path.split(".").map((part) => part.trim()).filter((part) => part !== "");
+}
+function valueAt(value, path) {
+  let current = value;
+  for (const key of segments(path)) {
+    if (UNSAFE_KEYS2.has(key)) return void 0;
+    if (Array.isArray(current)) {
+      const index = Number(key);
+      if (!Number.isInteger(index)) return void 0;
+      current = current[index];
+      continue;
     }
+    if (!isRecord(current)) return void 0;
+    current = Object.prototype.hasOwnProperty.call(current, key) ? current[key] : void 0;
   }
-  if (typeof action.run !== "function") {
-    throw new Error(`Action ${actionType} has neither a run() implementation nor a request`);
+  return current;
+}
+function withValueAt(value, path, next) {
+  const keys = segments(path);
+  if (keys.length === 0) return next;
+  const [head, ...rest] = keys;
+  if (UNSAFE_KEYS2.has(head)) return value;
+  if (Array.isArray(value)) {
+    const index = Number(head);
+    if (!Number.isInteger(index)) return value;
+    const copy = [...value];
+    copy[index] = rest.length === 0 ? next : withValueAt(copy[index], rest.join("."), next);
+    return copy;
   }
-  const output = await action.run(coerced, {
-    config,
-    now: options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()),
-    fetch: fetchImpl
-  });
-  return output ?? {};
+  const base = isRecord(value) ? value : {};
+  return {
+    ...base,
+    [head]: rest.length === 0 ? next : withValueAt(base[head], rest.join("."), next)
+  };
 }
-
-// src/define.ts
-var KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
-var PATH_DATA_PATTERN = /^[MmZzLlHhVvCcSsQqTtAa0-9\s,.\-+eE]+$/;
-var VIEW_BOX_PATTERN = /^-?[\d.]+\s+-?[\d.]+\s+-?[\d.]+\s+-?[\d.]+$/;
-var DEDUPE_STRATEGIES = ["timestamp", "lastItem"];
-var AUTH_RUNGS = ["none", "cli", "key", "oauth"];
-var ABSOLUTE_URL_PATTERN = /^https?:\/\//i;
-var CONFIG_ROOTED_URL_PATTERN = /^\{\{\s*config\./;
-function assertUnique(kind, keys) {
-  const seen = /* @__PURE__ */ new Set();
+function pick(value, keys) {
+  if (Array.isArray(value)) return value.map((entry) => pick(entry, keys));
+  if (!isRecord(value)) return value;
+  const out = {};
   for (const key of keys) {
-    if (seen.has(key)) throw new Error(`Duplicate ${kind} "${key}"`);
-    seen.add(key);
+    if (UNSAFE_KEYS2.has(key)) continue;
+    if (Object.prototype.hasOwnProperty.call(value, key)) out[key] = value[key];
   }
+  return out;
 }
-function assertAuth(definition) {
-  const auth = definition.auth;
-  if (!auth) return;
-  const id = definition.id;
-  if (!AUTH_RUNGS.includes(auth.rung)) {
-    throw new Error(
-      `Connector ${id} declares unknown auth rung ${JSON.stringify(auth.rung)}; expected ${AUTH_RUNGS.join(", ")}`
-    );
+function rename(value, from, to) {
+  if (Array.isArray(value)) return value.map((entry) => rename(entry, from, to));
+  if (!isRecord(value)) return value;
+  if (UNSAFE_KEYS2.has(from) || UNSAFE_KEYS2.has(to)) return value;
+  if (!Object.prototype.hasOwnProperty.call(value, from)) return value;
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === from) out[to] = entry;
+    else if (key !== to) out[key] = entry;
   }
-  if (auth.rung === "cli" && !auth.probe?.command?.trim()) {
-    throw new Error(`Connector ${id} borrows a CLI login but declares no probe command to ask it`);
+  return out;
+}
+function applyOp(value, op) {
+  if (op.op === "flatten") return valueAt(value, op.path);
+  const target = op.path === void 0 ? value : valueAt(value, op.path);
+  if (op.path !== void 0 && target === void 0) return value;
+  let next;
+  if (op.op === "pick") next = pick(target, op.keys);
+  else if (op.op === "rename") next = rename(target, op.from, op.to);
+  else if (op.op === "filter") {
+    next = Array.isArray(target) ? target.filter((entry) => isRecord(entry) && valueAt(entry, op.key) === op.equals) : target;
+  } else {
+    next = Array.isArray(target) ? target.map((entry) => applyPostReceive(entry, op.ops)) : target;
   }
-  if (auth.rung === "key") {
-    const keys = auth.keys ?? [];
-    if (keys.length === 0) {
-      throw new Error(`Connector ${id} signs in with a key but names no config field holding it`);
+  return op.path === void 0 ? next : withValueAt(value, op.path, next);
+}
+function applyPostReceive(value, ops) {
+  return (ops ?? []).reduce(applyOp, value);
+}
+
+// src/request.ts
+var MAX_ERROR_BODY = 500;
+var PLACEHOLDER = /\{\{\s*(args|config)\.([A-Za-z0-9_.-]+)\s*\}\}/g;
+var WHOLE_PLACEHOLDER = /^\{\{\s*(args|config)\.([A-Za-z0-9_.-]+)\s*\}\}$/;
+function lookup(source, path, scope) {
+  return valueAt(source === "args" ? scope.args : scope.config, path);
+}
+var intoUrl = (value, source) => source === "config" ? value : encodeURIComponent(value);
+function intoHeader(name) {
+  return (value) => {
+    if (/[\r\n]/.test(value)) {
+      throw new Error(`Header "${name}" would carry a line ending, which is not allowed`);
     }
-    const declared = new Set((definition.config ?? []).map((field) => field.key));
-    for (const key of keys) {
-      if (!declared.has(key)) {
-        throw new Error(`Connector ${id} names auth key "${key}", which is not a config field`);
-      }
+    return value;
+  };
+}
+function resolveTemplates(value, scope, substitute) {
+  if (typeof value === "string") {
+    const whole = WHOLE_PLACEHOLDER.exec(value);
+    if (whole) {
+      const resolved = lookup(whole[1], whole[2], scope);
+      if (substitute === void 0 || resolved === void 0 || resolved === null) return resolved;
+      return substitute(String(resolved), whole[1]);
     }
+    return value.replace(PLACEHOLDER, (_match, source, path) => {
+      const resolved = lookup(source, path, scope);
+      if (resolved === void 0 || resolved === null) return "";
+      const text = String(resolved);
+      return substitute === void 0 ? text : substitute(text, source);
+    });
   }
-  if (auth.rung === "none") {
-    const secret = (definition.config ?? []).find((field) => field.secret === true);
-    if (secret) {
-      throw new Error(
-        `Connector ${id} claims it needs no sign-in but declares secret field "${secret.key}"`
-      );
+  if (Array.isArray(value)) return value.map((entry) => resolveTemplates(entry, scope, substitute));
+  if (typeof value === "object" && value !== null) {
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      out[key] = resolveTemplates(entry, scope, substitute);
     }
+    return out;
   }
+  return value;
 }
-function envNameFor(key, explicit) {
-  if (explicit) return explicit;
-  return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toUpperCase();
+function resolveHeaders(raw, scope) {
+  const out = {};
+  for (const [name, value] of Object.entries(raw ?? {})) {
+    const resolved = resolveTemplates(value, scope, intoHeader(name));
+    if (resolved === void 0 || resolved === null || resolved === "") continue;
+    out[name] = String(resolved);
+  }
+  return out;
 }
-function defineConnector(definition) {
-  if (!KEY_PATTERN.test(definition.id ?? "")) {
-    throw new Error(`Connector id "${definition.id}" must start with a letter and be url-safe`);
+function stringMap(raw) {
+  const out = {};
+  if (typeof raw !== "object" || raw === null) return out;
+  for (const [key, value] of Object.entries(raw)) {
+    if (value === void 0 || value === null || value === "") continue;
+    out[key] = String(value);
   }
-  if (!definition.name?.trim()) {
-    throw new Error(`Connector ${definition.id} is missing a name`);
+  return out;
+}
+function resolveRequest(request, scope) {
+  const method = (request.method ?? "GET").toUpperCase();
+  const rawUrl = resolveTemplates(request.url, scope, intoUrl);
+  if (typeof rawUrl !== "string" || rawUrl.trim() === "") {
+    throw new Error("Request has no URL once its templates are resolved");
   }
-  if (definition.icon) {
-    const { viewBox, paths } = definition.icon;
-    if (!Array.isArray(paths) || paths.length === 0) {
-      throw new Error(`Connector ${definition.id} has an icon with no paths`);
-    }
-    for (const path of paths) {
-      if (typeof path !== "string" || !PATH_DATA_PATTERN.test(path)) {
-        throw new Error(
-          `Connector ${definition.id} has an icon path that is not SVG path data. Only path data is accepted, not markup.`
-        );
-      }
-    }
-    if (viewBox !== void 0 && !VIEW_BOX_PATTERN.test(viewBox)) {
-      throw new Error(`Connector ${definition.id} has an icon viewBox that is not four numbers`);
-    }
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error(`Request URL is not a URL once its templates are resolved: "${rawUrl}"`);
   }
-  const triggers = definition.triggers ?? [];
-  const actions = definition.actions ?? [];
-  if (triggers.length === 0 && actions.length === 0) {
-    throw new Error(`Connector ${definition.id} declares no triggers and no actions`);
+  for (const [key, value] of Object.entries(stringMap(resolveTemplates(request.query, scope)))) {
+    url.searchParams.set(key, value);
   }
-  for (const trigger of triggers) {
-    if (!KEY_PATTERN.test(trigger.type ?? "")) {
-      throw new Error(`Trigger type "${trigger.type}" must start with a letter and be url-safe`);
-    }
-    const loose = trigger;
-    const declarative = typeof loose.fetch === "function";
-    const imperative = typeof loose.poll === "function";
-    if (declarative && imperative) {
-      throw new Error(`Trigger ${trigger.type} declares both fetch() and poll(); pick one`);
-    }
-    if (declarative !== (loose.dedupe !== void 0)) {
-      throw new Error(
-        `Trigger ${trigger.type} needs fetch() and a dedupe strategy together, not one alone`
-      );
-    }
-    if (loose.dedupe !== void 0 && !DEDUPE_STRATEGIES.includes(loose.dedupe)) {
-      throw new Error(
-        `Trigger ${trigger.type} has unknown dedupe strategy ${JSON.stringify(loose.dedupe)}; expected ${DEDUPE_STRATEGIES.join(" or ")}`
-      );
-    }
-    if (loose.poll !== void 0 && !imperative) {
-      throw new Error(`Trigger ${trigger.type} declares poll but it is not a function`);
-    }
-    if (!declarative && !imperative) {
-      throw new Error(`Trigger ${trigger.type} is missing a fetch() or poll() implementation`);
+  const headers = resolveHeaders(request.headers, scope);
+  const resolved = { url: url.toString(), method, headers };
+  if (request.body !== void 0 && method !== "GET" && method !== "HEAD") {
+    const body = resolveTemplates(request.body, scope);
+    if (body !== void 0) {
+      resolved.body = typeof body === "string" ? body : JSON.stringify(body);
+      if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+        resolved.headers["content-type"] = typeof body === "string" ? "text/plain" : "application/json";
+      }
     }
   }
-  for (const action of actions) {
-    if (!KEY_PATTERN.test(action.type ?? "")) {
-      throw new Error(`Action type "${action.type}" must start with a letter and be url-safe`);
+  return resolved;
+}
+async function readBody(response) {
+  const text = await response.text();
+  if (text === "") return void 0;
+  const type = response.headers.get("content-type") ?? "";
+  if (!type.includes("json")) return text;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+function describeFailure(response, body) {
+  const detail = typeof body === "string" ? body : body === void 0 ? "" : JSON.stringify(body);
+  const quoted = detail.length > MAX_ERROR_BODY ? `${detail.slice(0, MAX_ERROR_BODY)}\u2026` : detail;
+  return `Request failed with ${response.status} ${response.statusText}${quoted ? `: ${quoted}` : ""}`;
+}
+async function sendRequest(resolved, options) {
+  const response = await options.fetchImpl(resolved.url, {
+    method: resolved.method,
+    headers: resolved.headers,
+    ...resolved.body !== void 0 && { body: resolved.body }
+  });
+  const body = await readBody(response);
+  if (!response.ok) throw new Error(describeFailure(response, body));
+  return { response, body };
+}
+function asOutput(value) {
+  if (Array.isArray(value)) return { items: value };
+  if (typeof value === "object" && value !== null) return value;
+  return value === void 0 ? {} : { result: value };
+}
+var MAX_REQUEST_PAGES = 100;
+var LINK_NEXT = /<([^>]+)>\s*;[^,]*\brel\s*=\s*"?next"?/i;
+function nextLink(header) {
+  const match = header === null ? null : LINK_NEXT.exec(header);
+  return match ? match[1] : void 0;
+}
+function pageItems(body, itemsPath) {
+  const value = itemsPath === void 0 ? body : valueAt(body, itemsPath);
+  return Array.isArray(value) ? value : void 0;
+}
+async function collectPages(request, strategy, scope, options) {
+  const collected = [];
+  const seen = /* @__PURE__ */ new Set();
+  let page2 = strategy.kind === "page" ? strategy.startPage ?? 1 : 0;
+  let cursor;
+  let nextUrl;
+  for (let index = 0; index < MAX_REQUEST_PAGES; index++) {
+    const resolved = resolveRequest(request, scope);
+    if (nextUrl !== void 0) resolved.url = nextUrl;
+    if (strategy.kind === "cursor" && cursor !== void 0) {
+      const url = new URL(resolved.url);
+      url.searchParams.set(strategy.param, cursor);
+      resolved.url = url.toString();
     }
-    const loose = action;
-    const written = typeof loose.run === "function";
-    const declared = loose.request !== void 0;
-    if (written && declared) {
-      throw new Error(`Action ${action.type} declares both run() and a request; pick one`);
+    if (strategy.kind === "page") {
+      const url = new URL(resolved.url);
+      url.searchParams.set(strategy.param, String(page2));
+      resolved.url = url.toString();
     }
-    if (!written && !declared) {
-      throw new Error(`Action ${action.type} is missing a run() implementation or a request`);
+    if (seen.has(resolved.url)) {
+      throw new Error(`Request for ${request.url} asked for the same page twice`);
     }
-    if (declared) {
-      const request = loose.request;
-      if (typeof request?.url !== "string" || request.url.trim() === "") {
-        throw new Error(`Action ${action.type} declares a request with no URL`);
-      }
-      const url = request.url.trim();
-      if (!ABSOLUTE_URL_PATTERN.test(url) && !CONFIG_ROOTED_URL_PATTERN.test(url)) {
-        throw new Error(
-          `Action ${action.type} declares the request URL "${url}", which is neither absolute nor rooted in a {{config.\u2026}} value`
-        );
+    seen.add(resolved.url);
+    const { response, body } = await sendRequest(resolved, options);
+    const items = pageItems(body, strategy.itemsPath);
+    if (items === void 0) {
+      if (index === 0) {
+        const where = strategy.itemsPath === void 0 ? "the response is not a list" : `the response has no list at "${strategy.itemsPath}"`;
+        throw new Error(`Cannot page through this request: ${where}`);
       }
+      return collected;
     }
-    if (!declared && loose.postReceive !== void 0) {
-      throw new Error(`Action ${action.type} has postReceive but no request for it to reshape`);
-    }
-    for (const input of action.inputs ?? []) {
-      if (input.loadOptions !== void 0 && definition.options?.[input.loadOptions] === void 0) {
-        throw new Error(
-          `Action ${action.type} argument "${input.key}" loads options from "${input.loadOptions}", which the connector does not serve`
-        );
-      }
+    collected.push(...items);
+    if (items.length === 0) return collected;
+    if (strategy.kind === "cursor") {
+      const next = valueAt(body, strategy.cursorPath);
+      if (next === void 0 || next === null || next === "") return collected;
+      cursor = String(next);
+      continue;
     }
-  }
-  assertUnique(
-    "trigger",
-    triggers.map((trigger) => trigger.type)
-  );
-  assertUnique(
-    "action",
-    actions.map((action) => action.type)
-  );
-  assertUnique(
-    "config field",
-    (definition.config ?? []).map((field) => field.key)
-  );
-  assertAuth(definition);
-  return {
-    ...definition,
-    version: definition.version ?? "0.0.0",
-    config: definition.config ?? [],
-    triggers,
-    actions
-  };
-}
-function resolveConfig(connector, env = process.env) {
-  const config = {};
-  const missing = [];
-  for (const field of connector.config) {
-    const name = envNameFor(field.key, field.env);
-    const value = env[name] ?? field.default;
-    if (value === void 0 || value === "") {
-      if (field.required) missing.push(`${field.key} (${name})`);
+    if (strategy.kind === "link") {
+      nextUrl = nextLink(response.headers.get("link"));
+      if (nextUrl === void 0) return collected;
       continue;
     }
-    config[field.key] = value;
+    page2 += 1;
   }
-  if (missing.length > 0) {
-    throw new Error(
-      `Connector ${connector.id} is missing required configuration: ${missing.join(", ")}`
-    );
+  throw new Error(`Request for ${request.url} exceeded ${MAX_REQUEST_PAGES} pages`);
+}
+async function executeRequest(request, postReceive, scope, options) {
+  if (request.paginate) {
+    const items = await collectPages(request, request.paginate, scope, options);
+    return asOutput(applyPostReceive(items, postReceive));
   }
-  return config;
+  const { body } = await sendRequest(resolveRequest(request, scope), options);
+  return asOutput(applyPostReceive(body, postReceive));
 }
 
-// src/setup.ts
-function pollToolName(triggerType) {
-  return `poll_${triggerType}`;
+// src/resilience.ts
+var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 425, 429, 500, 502, 503, 504]);
+var DEFAULT_ATTEMPTS = 3;
+var DEFAULT_BASE_DELAY_MS = 250;
+var DEFAULT_MAX_DELAY_MS = 3e4;
+var MAX_ATTEMPTS = 10;
+var MAX_TOTAL_WAIT_MS = 12e4;
+var wait = (ms) => new Promise((resolve4) => {
+  setTimeout(resolve4, ms);
+});
+function retryAfterMs(header, now) {
+  if (!header) return void 0;
+  const trimmed = header.trim();
+  if (trimmed === "") return void 0;
+  const seconds = Number(trimmed);
+  if (Number.isFinite(seconds)) return Math.max(0, seconds * 1e3);
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at)) return void 0;
+  return Math.max(0, at - now);
 }
-var MANIFEST_TOOL = "vorn_connector_manifest";
-var PREFLIGHT_TOOL = "vorn_connector_preflight";
-var OPTIONS_TOOL = "vorn_connector_options";
-function connectionSetup(connector, triggerType) {
+function backoffMs(attempt, policy = {}) {
+  const base = policy.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+  const max = policy.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+  return Math.min(max, base * 2 ** attempt);
+}
+function resilientFetch(options) {
+  const attempts = Math.min(MAX_ATTEMPTS, Math.max(1, options.retry?.attempts ?? DEFAULT_ATTEMPTS));
+  const sleep = options.sleep ?? wait;
+  const ceiling = options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+  const send = async (input, init) => {
+    let waited = 0;
+    const pause = async (ms) => {
+      if (waited + ms > MAX_TOTAL_WAIT_MS) return false;
+      waited += ms;
+      await sleep(ms);
+      return true;
+    };
+    for (let attempt = 0; attempt < attempts; attempt++) {
+      const last = attempt === attempts - 1;
+      try {
+        const response = await options.fetchImpl(input, init);
+        if (!RETRYABLE_STATUS.has(response.status)) return response;
+        if (!options.retryable || last) return response;
+        const asked = retryAfterMs(response.headers.get("retry-after"), Date.now());
+        const delay = asked === void 0 ? backoffMs(attempt, options.retry) : Math.min(asked, ceiling);
+        if (!await pause(delay)) return response;
+      } catch (error) {
+        if (!options.retryable || last) throw error;
+        if (!await pause(backoffMs(attempt, options.retry))) throw error;
+      }
+    }
+    throw new Error("Request was never attempted");
+  };
+  return send;
+}
+
+// src/runtime.ts
+var MAX_POLL_PAGES = 1e3;
+async function runPoll(connector, triggerType, options = {}) {
   const trigger = connector.triggers.find((entry) => entry.type === triggerType);
   if (!trigger) {
     throw new Error(`Connector ${connector.id} has no trigger "${triggerType}"`);
   }
-  return {
-    connectorId: connector.id,
-    triggerType,
-    filters: {
-      pollTool: pollToolName(triggerType),
-      itemsPath: "items",
-      idField: "externalId",
-      timestampField: "updatedAt",
-      titleField: "title",
-      urlField: "url",
-      cursorArg: "cursor",
-      cursorPath: "nextCursor"
-    },
-    env: connector.config.map((field) => ({
-      name: envNameFor(field.key, field.env),
-      required: field.required === true,
-      secret: field.secret === true,
-      ...field.description !== void 0 && { description: field.description },
-      ...field.builderHint !== void 0 && { builderHint: field.builderHint }
-    }))
+  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const polledAt = now();
+  const context = {
+    config: options.config ?? {},
+    ...options.since !== void 0 && { since: options.since },
+    ...options.cursor !== void 0 && { cursor: options.cursor },
+    ...options.limit !== void 0 && { limit: options.limit },
+    now,
+    // A poll only reads, so every failure it meets is worth trying again.
+    fetch: resilientFetch({
+      fetchImpl: options.fetchImpl ?? globalThis.fetch,
+      retryable: true,
+      ...options.retry !== void 0 && { retry: options.retry },
+      ...options.sleep !== void 0 && { sleep: options.sleep }
+    })
   };
-}
-function connectorManifest(connector) {
+  const outcome = typeof trigger.poll === "function" ? await trigger.poll(context) : await pollWithDedupe(trigger, context);
+  if (!outcome || !Array.isArray(outcome.items)) {
+    throw new Error(`Trigger ${triggerType} did not return an items array`);
+  }
+  if (outcome.hasMore && !outcome.nextCursor) {
+    throw new Error(`Trigger ${triggerType} reported more pages without a nextCursor`);
+  }
   return {
-    id: connector.id,
-    name: connector.name,
-    version: connector.version,
-    ...connector.description !== void 0 && { description: connector.description },
-    ...connector.icon !== void 0 && { icon: connector.icon },
-    ...connector.auth !== void 0 && { auth: connector.auth },
-    triggers: connector.triggers.map((trigger) => ({
-      type: trigger.type,
-      label: trigger.label,
-      ...trigger.description !== void 0 && { description: trigger.description },
-      // Carried through so the app can seed a connection's status mapping and
-      // its polling workflow. Absent when the connector said nothing, which is
-      // different from saying there is nothing.
-      ...trigger.statusMapping !== void 0 && { statusMapping: trigger.statusMapping },
-      ...trigger.defaultWorkflow !== void 0 && { defaultWorkflow: trigger.defaultWorkflow },
-      setup: connectionSetup(connector, trigger.type)
-    })),
-    actions: connector.actions.map((action) => ({
-      type: action.type,
-      label: action.label,
-      ...action.description !== void 0 && { description: action.description },
-      inputs: (action.inputs ?? []).map((input) => ({
-        key: input.key,
-        label: input.label,
-        type: input.type ?? "string",
-        required: input.required === true,
-        ...input.options !== void 0 && { options: input.options },
-        ...input.loadOptions !== void 0 && { loadOptions: input.loadOptions },
-        ...input.builderHint !== void 0 && { builderHint: input.builderHint }
-      })),
-      ...action.outputs !== void 0 && { outputs: action.outputs },
-      ...action.sample !== void 0 && { sample: action.sample }
-    }))
+    items: normalizeItems(outcome.items, polledAt),
+    ...outcome.nextCursor !== void 0 && { nextCursor: outcome.nextCursor },
+    hasMore: outcome.hasMore === true
   };
 }
+async function drainPoll(connector, triggerType, options = {}) {
+  const collected = [];
+  let cursor = options.cursor;
+  for (let page2 = 0; page2 < MAX_POLL_PAGES; page2++) {
+    const result = await runPoll(connector, triggerType, {
+      ...options,
+      ...cursor !== void 0 && { cursor }
+    });
+    collected.push(...result.items);
+    if (!result.hasMore) return collected;
+    if (result.nextCursor === cursor) {
+      throw new Error(`Trigger ${triggerType} did not advance its cursor`);
+    }
+    cursor = result.nextCursor;
+  }
+  throw new Error(`Trigger ${triggerType} exceeded ${MAX_POLL_PAGES} pages`);
+}
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+async function runOptions(connector, name, options = {}) {
+  const loader = connector.options?.[name];
+  if (!loader) {
+    throw new Error(`Connector ${connector.id} serves no options set "${name}"`);
+  }
+  const loaded = await loader({
+    config: options.config ?? {},
+    now: options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()),
+    fetch: resilientFetch({
+      fetchImpl: options.fetchImpl ?? globalThis.fetch,
+      retryable: true,
+      ...options.retry !== void 0 && { retry: options.retry },
+      ...options.sleep !== void 0 && { sleep: options.sleep }
+    })
+  });
+  if (!Array.isArray(loaded)) {
+    throw new Error(`Options set "${name}" did not return an array`);
+  }
+  return loaded.map(
+    (entry) => typeof entry === "string" ? { value: entry } : { ...entry, value: String(entry.value) }
+  );
+}
+var MAX_QUOTED_VALUE = 80;
+function quote(value) {
+  return value.length > MAX_QUOTED_VALUE ? `${value.slice(0, MAX_QUOTED_VALUE)}\u2026` : value;
+}
+function coerceArg(value, type) {
+  if (typeof value !== "string") return value;
+  if (type === "number") {
+    const parsed = Number(value);
+    if (Number.isNaN(parsed)) throw new Error(`Expected a number, got "${quote(value)}"`);
+    return parsed;
+  }
+  if (type === "boolean") {
+    if (value === "true") return true;
+    if (value === "false") return false;
+    throw new Error(`Expected a boolean, got "${quote(value)}"`);
+  }
+  if (type === "json") {
+    try {
+      return JSON.parse(value);
+    } catch {
+      throw new Error(`Expected JSON, got "${quote(value)}"`);
+    }
+  }
+  return value;
+}
+async function runAction(connector, actionType, args, options = {}) {
+  const action = connector.actions.find((entry) => entry.type === actionType);
+  if (!action) {
+    throw new Error(`Connector ${connector.id} has no action "${actionType}"`);
+  }
+  const coerced = { ...args };
+  for (const input of action.inputs ?? []) {
+    const value = coerced[input.key];
+    if (value === void 0 || value === "") {
+      if (input.required) throw new Error(`Action ${actionType} requires "${input.key}"`);
+      delete coerced[input.key];
+      continue;
+    }
+    try {
+      coerced[input.key] = coerceArg(value, input.type);
+    } catch (error) {
+      throw new Error(
+        `Action ${actionType} argument "${input.key}": ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
+    }
+  }
+  const config = options.config ?? {};
+  const method = (action.request?.method ?? "GET").toUpperCase();
+  const retryable = action.idempotent === true || action.request !== void 0 && SAFE_METHODS.has(method);
+  const fetchImpl = resilientFetch({
+    fetchImpl: options.fetchImpl ?? globalThis.fetch,
+    retryable,
+    ...options.retry !== void 0 && { retry: options.retry },
+    ...options.sleep !== void 0 && { sleep: options.sleep }
+  });
+  if (action.request !== void 0) {
+    try {
+      return await executeRequest(
+        action.request,
+        action.postReceive,
+        { args: coerced, config },
+        { fetchImpl }
+      );
+    } catch (error) {
+      throw new Error(
+        `Action ${actionType}: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
+    }
+  }
+  if (typeof action.run !== "function") {
+    throw new Error(`Action ${actionType} has neither a run() implementation nor a request`);
+  }
+  const output = await action.run(coerced, {
+    config,
+    now: options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString()),
+    fetch: fetchImpl
+  });
+  return output ?? {};
+}
 
 // src/harness.ts
 function matches(route, method, url) {
@@ -1109,8 +1725,44 @@ function createConnectorHarness(connector, harnessOptions = {}) {
     withMockHttp
   };
 }
+var HOST_FIXTURES = {
+  diff: async () => "diff --git a/src/index.ts b/src/index.ts\n@@ -1 +1 @@\n-const a = 1\n+const a = 2\n",
+  status: async () => " M src/index.ts\n",
+  output: async () => "$ yarn test\n  Test Files  1 passed (1)\n",
+  selection: async () => "",
+  send: async () => {
+  },
+  rename: async () => {
+  },
+  usage: async () => ({
+    contextTokens: 13e4,
+    contextWindow: 1e6,
+    cacheHitRate: 0.93,
+    limits: [{ window: "5h", remaining: 0.72 }]
+  })
+};
+function mockExtensionHost(granted, answers = {}) {
+  const allowed = new Set(granted);
+  const used = /* @__PURE__ */ new Set();
+  const host = {};
+  for (const name of Object.keys(HOST_FIXTURES)) {
+    const permission = HOST_PERMISSIONS[name];
+    host[name] = async (...args) => {
+      used.add(permission);
+      if (!allowed.has(permission)) {
+        throw new PermissionDeniedError(name, `this extension does not ask for ${permission}`);
+      }
+      const answer = answers[name] ?? HOST_FIXTURES[name];
+      return answer(...args);
+    };
+  }
+  return { host, used };
+}
 
 // src/check.ts
+import { existsSync as existsSync2 } from "fs";
+import { rm } from "fs/promises";
+import { resolve as resolve2, sep } from "path";
 var EXECUTABLE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var CREDENTIAL_NAME = /(secret|token|password|passphrase|api[-_]?key|credential)/i;
 var INPUT_TYPES = /* @__PURE__ */ new Set(["string", "number", "boolean", "select", "json"]);
@@ -1204,7 +1856,17 @@ function actionShapeFindings(action) {
   }
   return found;
 }
-async function packageFindings(options) {
+function bundles(options) {
+  return Boolean(options.bundle && options.entry !== void 0 && options.packageDir !== void 0);
+}
+function launches(options) {
+  return bundles(options) && options.mock === true;
+}
+function packageRootOf(options) {
+  if (options.packageDir === void 0) return void 0;
+  return packageRootFor(packageDirFor(options.packageDir, options.entry));
+}
+async function packageFindings(connector, options) {
   if (options.packageDir === void 0) return [];
   const pkg = readNearestPackageJson(packageDirFor(options.packageDir, options.entry));
   const found = [...lifecycleScriptFindings(pkg)];
@@ -1225,7 +1887,15 @@ async function packageFindings(options) {
       contents: packEntryContents(options.entry),
       resolveDir: options.packageDir
     });
-    found.push(...bundleDependencyFindings(built.external));
+    found.push(...bundleDependencyFindings(built.external), ...bundledRequireFindings(built.code));
+    if (options.mock) {
+      const dir = await stagePack(connector, built.code, packageRootOf(options));
+      try {
+        found.push(...await packLaunchFindings(dir));
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    }
   }
   return found;
 }
@@ -1290,6 +1960,153 @@ async function mockFindings(connector, options) {
   }
   return found;
 }
+var CHECK_SESSION = {
+  sessionId: "check",
+  worktreePath: process.cwd(),
+  agent: "claude"
+};
+var FOOTER_TONES = ["default", "ok", "danger"];
+var FOOTER_HREF_PROTOCOLS = ["http:", "https:"];
+function invalidItem(item) {
+  if (!item || typeof item !== "object") return "is not an object";
+  const reading = item;
+  if (typeof reading.label !== "string" || reading.label === "") return "has no label";
+  if (typeof reading.value !== "string") return "has no value";
+  if (reading.tone !== void 0 && !FOOTER_TONES.includes(reading.tone)) {
+    return `has unknown tone ${JSON.stringify(reading.tone)}`;
+  }
+  if (reading.href === void 0) return void 0;
+  if (typeof reading.href !== "string") return "has a link that is not text";
+  let protocol;
+  try {
+    protocol = new URL(reading.href).protocol;
+  } catch {
+    return `has the link ${JSON.stringify(reading.href)}, which is not a URL`;
+  }
+  if (!FOOTER_HREF_PROTOCOLS.includes(protocol)) {
+    return `has the link ${JSON.stringify(reading.href)}; a reading links to ${FOOTER_HREF_PROTOCOLS.join(" or ")} and nothing else`;
+  }
+  return void 0;
+}
+async function contributionFindings(connector) {
+  const contributes = connector.contributes;
+  if (!contributes) return [];
+  const found = [];
+  const declared = connector.permissions ?? [];
+  const spent = /* @__PURE__ */ new Set();
+  const ran = async (kind, id, code, body) => {
+    const { host, used } = mockExtensionHost(declared);
+    try {
+      return await body(host);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      found.push(
+        finding2(
+          "error",
+          error instanceof PermissionDeniedError ? "permission-undeclared" : code,
+          `${kind} ${id}`,
+          error instanceof PermissionDeniedError ? `asked the host for something this extension does not declare: ${reason}` : `threw: ${reason}`
+        )
+      );
+      return void 0;
+    } finally {
+      for (const permission of used) spent.add(permission);
+    }
+  };
+  for (const footer of contributes.footers ?? []) {
+    const items = await ran(
+      "footer",
+      footer.id,
+      "footer-failed",
+      (host) => Promise.resolve(footer.run({ ...CHECK_SESSION, host, now: () => (/* @__PURE__ */ new Date()).toISOString() }))
+    );
+    if (items === void 0) continue;
+    if (!Array.isArray(items)) {
+      found.push(
+        finding2(
+          "error",
+          "footer-items-invalid",
+          `footer ${footer.id}`,
+          "returned something that is not a list of readings"
+        )
+      );
+      continue;
+    }
+    for (const item of items) {
+      const wrong = invalidItem(item);
+      if (wrong) {
+        found.push(
+          finding2(
+            "error",
+            "footer-items-invalid",
+            `footer ${footer.id}`,
+            `returned a reading that ${wrong}`
+          )
+        );
+      }
+    }
+  }
+  for (const handler of contributes.linkHandlers ?? []) {
+    await ran(
+      "link handler",
+      handler.id,
+      "handler-failed",
+      (host) => Promise.resolve(
+        handler.run({
+          ...CHECK_SESSION,
+          host,
+          now: () => (/* @__PURE__ */ new Date()).toISOString(),
+          url: handler.example
+        })
+      )
+    );
+  }
+  const observable = !(contributes.panes ?? []).some((pane) => pane.web !== void 0);
+  for (const permission of declared) {
+    if (observable && !spent.has(permission)) {
+      found.push(
+        finding2(
+          "warn",
+          "permission-unused",
+          `${connector.id} permissions`,
+          `asks for ${permission} but nothing this run exercised used it; ask only for what it spends`
+        )
+      );
+    }
+  }
+  return found;
+}
+function paneFindings(connector, packageRoot) {
+  if (packageRoot === void 0) return [];
+  const root = resolve2(packageRoot);
+  const found = [];
+  for (const pane of connector.contributes?.panes ?? []) {
+    if (pane.web === void 0) continue;
+    const full = resolve2(root, pane.web);
+    if (full !== root && !full.startsWith(`${root}${sep}`)) {
+      found.push(
+        finding2(
+          "error",
+          "web-entry-outside-package",
+          `pane ${pane.id}`,
+          `declares the page "${pane.web}", which resolves outside the package`
+        )
+      );
+      continue;
+    }
+    if (!existsSync2(full)) {
+      found.push(
+        finding2(
+          "error",
+          "web-entry-missing",
+          `pane ${pane.id}`,
+          `declares the page "${pane.web}", which the package does not carry`
+        )
+      );
+    }
+  }
+  return found;
+}
 var AUTH_FAILURE = /\b(401|403|unauthor|unauthenticat|forbidden|invalid[- ]?(token|credential))/i;
 function liveRunnable(action) {
   if (action.idempotent !== true) return false;
@@ -1418,9 +2235,11 @@ async function checkConnector(connector, options = {}) {
       )
     );
   }
-  found.push(...authFindings(connector));
+  if (connector.kind !== "extension") found.push(...authFindings(connector));
   found.push(...secretFindings(connector));
-  found.push(...await packageFindings(options));
+  found.push(...paneFindings(connector, packageRootOf(options)));
+  found.push(...await contributionFindings(connector));
+  found.push(...await packageFindings(connector, options));
   found.push(...await mockFindings(connector, options));
   found.push(...await liveFindings(connector, options));
   const perTrigger = await Promise.all(
@@ -1516,15 +2335,30 @@ var CHECK_OWNERS = {
   "mock-network-escape": "mock",
   "mock-not-observed": "mock",
   "preflight-failed": "live",
-  "live-action-failed": "live"
+  "live-action-failed": "live",
+  "pack-launch": "launch",
+  "web-entry-missing": "contributes",
+  "web-entry-outside-package": "contributes",
+  "footer-failed": "footers",
+  "footer-items-invalid": "footers",
+  "handler-failed": "handlers",
+  "permission-undeclared": "permissions",
+  "permission-unused": "permissions"
 };
 function checksRun(connector, options) {
-  const names = ["manifest", "auth"];
+  const names = ["manifest"];
+  if (connector.kind !== "extension") names.push("auth");
+  const contributes = connector.contributes;
+  if (contributes?.panes?.length && options.packageDir !== void 0) names.push("contributes");
+  if (contributes?.footers?.length) names.push("footers");
+  if (contributes?.linkHandlers?.length) names.push("handlers");
+  if (connector.permissions !== void 0) names.push("permissions");
   if (connector.config.length > 0) names.push("secrets");
   if (connector.actions.length > 0) names.push("actions");
   if (connector.triggers.length > 0) names.push("dedupe");
   if (options.packageDir !== void 0) names.push("no-lifecycle-scripts", "keywords");
-  if (options.bundle && options.entry !== void 0) names.push("no-runtime-deps");
+  if (bundles(options)) names.push("no-runtime-deps");
+  if (launches(options)) names.push("launch");
   if (options.mock && connector.actions.length > 0) names.push("mock");
   if (options.live && liveExamines(connector)) names.push("live");
   return names;
@@ -1555,9 +2389,9 @@ function formatFindings(findings) {
 }
 
 // src/pack.ts
-import { mkdtemp, mkdir, rm, stat, writeFile } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join2, resolve as resolve2 } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { mkdir, rm as rm2, stat as stat2 } from "fs/promises";
+import { join as join2, resolve as resolve3 } from "path";
 function finding3(code, target, message) {
   return { level: "error", code, target, message };
 }
@@ -1565,37 +2399,51 @@ function packFileName(connector) {
   return `${connector.id}-${connector.version}.vorn.tgz`;
 }
 async function packConnector(connector, options) {
-  const resolveDir = resolve2(options.resolveDir ?? process.cwd());
+  const resolveDir = resolve3(options.resolveDir ?? process.cwd());
   const entryDir = packageDirFor(resolveDir, options.entry);
-  const findings = await checkConnector(connector);
+  const packageRoot = packageRootFor(entryDir);
+  const findings = await checkConnector(connector, { packageDir: packageRoot });
   findings.push(...lifecycleScriptFindings(readNearestPackageJson(entryDir)));
   if (findings.some((item) => item.level === "error")) return { findings };
   const contents = packEntryContents(options.entry, options.sdkModule);
   const bundle = options.bundle ?? esbuildBundle;
   const built = await bundle({ contents, resolveDir });
-  findings.push(...bundleDependencyFindings(built.external));
+  findings.push(...bundleDependencyFindings(built.external), ...bundledRequireFindings(built.code));
   if (findings.some((item) => item.level === "error")) return { findings };
-  const outDir = resolve2(options.outDir ?? process.cwd());
+  const outDir = resolve3(options.outDir ?? process.cwd());
   await mkdir(outDir, { recursive: true });
   const file = join2(outDir, packFileName(connector));
-  const staging = await mkdtemp(join2(tmpdir(), "vorn-pack-"));
+  const staging = await stagePack(connector, built.code, packageRoot);
   try {
-    await writeFile(join2(staging, "index.js"), built.code, "utf8");
-    await writeFile(
-      join2(staging, "manifest.json"),
-      `${JSON.stringify(connectorManifest(connector), null, 2)}
-`,
-      "utf8"
-    );
+    findings.push(...await (options.launch ?? packLaunchFindings)(staging));
+    if (findings.some((item) => item.level === "error")) return { findings };
+    const unpacked = await directoryBytes(staging);
+    const maxUnpacked = options.maxUnpackedBytes ?? MAX_UNPACKED_BYTES;
+    if (unpacked > maxUnpacked) {
+      return {
+        findings: [
+          ...findings,
+          finding3(
+            "pack-too-large",
+            "bundle",
+            `The pack unpacks to ${Math.round(unpacked / 1024)} KB; Vorn unpacks at most ${Math.round(maxUnpacked / 1024)} KB`
+          )
+        ]
+      };
+    }
     const { create } = await import("tar");
-    await create({ gzip: true, file, cwd: staging }, ["manifest.json", "index.js"]);
+    await create({ gzip: true, file, cwd: staging }, [
+      "manifest.json",
+      "index.js",
+      ...existsSync3(join2(staging, WEB_DIR)) ? [WEB_DIR] : []
+    ]);
   } finally {
-    await rm(staging, { recursive: true, force: true });
+    await rm2(staging, { recursive: true, force: true });
   }
-  const bytes = (await stat(file)).size;
+  const bytes = (await stat2(file)).size;
   const maxBytes = options.maxBytes ?? MAX_PACK_BYTES;
   if (bytes > maxBytes) {
-    await rm(file, { force: true });
+    await rm2(file, { force: true });
     return {
       findings: [
         ...findings,
@@ -1612,7 +2460,7 @@ async function packConnector(connector, options) {
 
 // src/scaffold.ts
 var ID_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
-var SDK_DEPENDENCY_RANGE = "^0.7.0-beta.9";
+var SDK_DEPENDENCY_RANGE = "^0.7.0-beta.14";
 var SCAFFOLD_VERSION = "0.1.0";
 var VITEST_RANGE = "^4.1.10";
 function jsonFile(value) {
@@ -1622,17 +2470,24 @@ function jsonFile(value) {
 function titleCase(id) {
   return id.split(/[-_]+/).filter((part) => part !== "").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
-function packageJson(id, description, inRepo) {
+function packageJson(id, description, inRepo, kind) {
+  const scoped = kind === "extension" ? "extension" : "connector";
   return jsonFile({
-    name: inRepo ? `@vornrun/connector-${id}` : `vorn-connector-${id}`,
+    name: inRepo ? `@vornrun/${scoped}-${id}` : `vorn-${scoped}-${id}`,
     version: SCAFFOLD_VERSION,
     description,
     type: "module",
     license: "MIT",
-    bin: { [`vorn-connector-${id}`]: "dist/index.js" },
+    bin: { [`vorn-${scoped}-${id}`]: "dist/index.js" },
     main: "./dist/index.js",
     types: "./dist/index.d.ts",
-    files: ["dist", "README.md", ...inRepo ? ["CHANGELOG.md"] : []],
+    // A pane's page ships beside the bundle, so `web` is published like `dist`.
+    files: [
+      "dist",
+      "README.md",
+      ...kind === "extension" ? ["web"] : [],
+      ...inRepo ? ["CHANGELOG.md"] : []
+    ],
     ...inRepo && {
       repository: {
         type: "git",
@@ -1655,15 +2510,16 @@ function packageJson(id, description, inRepo) {
       typescript: "^6.0.3",
       vitest: VITEST_RANGE
     },
-    // Read by the catalog build: how this connector is filed, found, and what it asks of you.
+    // Read by the catalog build: how this is filed, found, and what it asks of you.
     vorn: {
-      category: "Other",
+      category: kind === "extension" ? "Extensions" : "Other",
       keywords: [id],
-      ...inRepo && { auth: "Say in one line what signing in takes." }
+      ...kind === "extension" && { kind: "extension" },
+      ...inRepo && kind === "connector" && { auth: "Say in one line what signing in takes." }
     }
   });
 }
-function tsconfig() {
+function tsconfig(inRepo) {
   return jsonFile({
     compilerOptions: {
       target: "ES2022",
@@ -1676,10 +2532,11 @@ function tsconfig() {
       skipLibCheck: true,
       types: ["node"],
       noEmit: true,
+      resolveJsonModule: true,
       ignoreDeprecations: "6.0",
       allowImportingTsExtensions: true
     },
-    include: ["src/**/*", "vitest.config.ts"]
+    include: ["src/**/*", ...inRepo ? ["vitest.config.ts"] : []]
   });
 }
 function tsupConfig() {
@@ -1712,12 +2569,14 @@ function changelog() {
 }
 function connectorSource(id, name, description) {
   return `import { defineConnector } from '@vornrun/connector-sdk'
+// Bundled at build time: a pack is one file, so a version read from disk is not there to read.
+import pkg from '../package.json'
 
 export const connector = defineConnector({
   id: ${JSON.stringify(id)},
   name: ${JSON.stringify(name)},
   description: ${JSON.stringify(description)},
-  version: '${SCAFFOLD_VERSION}',
+  version: pkg.version,
   // Prefer a login the machine already has: { rung: 'cli', probe: { command: 'tool', args: ['auth', 'status'] } }
   auth: { rung: 'key', keys: ['apiToken'] },
   config: [
@@ -1778,11 +2637,149 @@ export const connector = defineConnector({
 })
 `;
 }
-function entrySource() {
+function extensionSource(id, name, description) {
+  return `import { defineExtension } from '@vornrun/connector-sdk'
+// Bundled at build time: a pack is one file, so a version read from disk is not there to read.
+import pkg from '../package.json'
+
+export const connector = defineExtension({
+  id: ${JSON.stringify(id)},
+  name: ${JSON.stringify(name)},
+  description: ${JSON.stringify(description)},
+  version: pkg.version,
+  // Only what this actually spends: the check names one it declared and never used.
+  permissions: ['terminal.read'],
+  // Absent where none of these hold, rather than showing a band with nothing in it.
+  activates: { workspaceContains: ['package.json'] },
+  footers: [
+    {
+      id: 'checks',
+      title: 'Checks',
+      description: 'What the last commands in this session said',
+      every: 30,
+      async run(context) {
+        const output = await context.host.output({ lines: 200 })
+        const failed = /\\b(FAIL|failed|error)\\b/i.test(output)
+        return [
+          {
+            label: 'tests',
+            value: failed ? 'failing' : 'passing',
+            tone: failed ? 'danger' : 'ok'
+          }
+        ]
+      }
+    }
+  ],
+  panes: [
+    {
+      id: 'report',
+      title: 'Report',
+      description: 'The reading, in full, beside the terminal',
+      // Drawn beside the pane's name wherever it is offered; path data only.
+      icon: { viewBox: '0 0 24 24', paths: ['M4 4h16v16H4z M8 9h8 M8 13h8 M8 17h5'] },
+      // Served from the pack; everything the page needs lives under web/.
+      web: 'web/report/index.html'
+    }
+  ]
+})
+`;
+}
+function extensionPage(name) {
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>${name}</title>
+    <style>
+      body {
+        margin: 0;
+        padding: 12px;
+        font: 12px ui-sans-serif, system-ui, sans-serif;
+        color: #faf9f7;
+        background: #101012;
+      }
+      h1 {
+        font-size: 13px;
+        font-weight: 500;
+        margin: 0 0 8px;
+      }
+      pre {
+        margin: 0;
+        white-space: pre-wrap;
+        color: rgba(255, 255, 255, 0.55);
+      }
+    </style>
+  </head>
+  <body>
+    <h1>${name}</h1>
+    <pre id="output">Reading the session\u2026</pre>
+    <script type="module">
+      // Same origin, so the page carries no credential: Vorn knows which pane is
+      // asking and grants exactly the permissions the manifest declared.
+      const ask = async (method, body = {}) => {
+        const response = await fetch('bridge/' + method, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(body)
+        })
+        if (!response.ok) throw new Error(method + ' answered ' + response.status)
+        return (await response.json()).result
+      }
+
+      const node = document.getElementById('output')
+      try {
+        node.textContent = await ask('output', { lines: 200 })
+      } catch (error) {
+        node.textContent = String(error)
+      }
+    </script>
+  </body>
+</html>
+`;
+}
+function extensionTestSource(name) {
+  return `import { describe, expect, it } from 'vitest'
+import { mockExtensionHost } from '@vornrun/connector-sdk'
+import { connector } from './extension'
+
+/** Runs one footer the way the host will, against a stub that enforces the manifest. */
+async function footer(id: string, output: string) {
+  const { host } = mockExtensionHost(connector.permissions ?? [], { output: async () => output })
+  const declared = connector.contributes?.footers?.find((entry) => entry.id === id)
+  if (!declared) throw new Error('no footer ' + id)
+  return declared.run({
+    sessionId: 'test',
+    worktreePath: process.cwd(),
+    agent: 'claude',
+    host,
+    now: () => '2026-01-01T00:00:00.000Z'
+  })
+}
+
+describe(${JSON.stringify(name)}, () => {
+  it('reads the session as passing when nothing failed', async () => {
+    expect(await footer('checks', 'Test Files  1 passed (1)')).toEqual([
+      { label: 'tests', value: 'passing', tone: 'ok' }
+    ])
+  })
+
+  it('reads it as failing when the output says so', async () => {
+    expect(await footer('checks', 'FAIL src/index.test.ts')).toEqual([
+      { label: 'tests', value: 'failing', tone: 'danger' }
+    ])
+  })
+
+  it('asks for nothing it did not declare', () => {
+    expect(connector.permissions).toEqual(['terminal.read'])
+  })
+})
+`;
+}
+function entrySource(module) {
   return `import { realpathSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { serveConnector } from '@vornrun/connector-sdk'
-import { connector } from './connector'
+import { connector } from './${module}'
 
 /** True when this file was run directly rather than imported. */
 export function isEntryPoint(moduleUrl: string, argv = process.argv): boolean {
@@ -1850,8 +2847,8 @@ describe('the packaged connector', () => {
 })
 `;
 }
-function indexSource() {
-  return `import { connector } from './connector'
+function indexSource(module) {
+  return `import { connector } from './${module}'
 import { serveIfEntryPoint } from './entry'
 
 export { connector }
@@ -1956,24 +2953,71 @@ Rename the trigger, the action and the settings to whatever this connector
 really talks to; the shapes here are a starting point, not a rule.
 `;
 }
+function extensionReadme(id, name, description) {
+  return `# ${name}
+
+${description}
+
+## Build and check
+
+\`\`\`sh
+yarn install
+yarn build
+yarn check      # verifies the extension against Vorn's contract
+yarn test
+yarn pack       # writes ${id}-${SCAFFOLD_VERSION}.vorn.tgz, installable in Vorn
+\`\`\`
+
+## What it contributes
+
+| Kind | Name | What it does |
+| --- | --- | --- |
+| Footer | Checks | A band under the card's status bar, recomputed every 30s |
+| Pane | Report | A page beside the terminal, served from \`web/report\` |
+
+## What it asks for
+
+| Permission | What it grants |
+| --- | --- |
+| \`terminal.read\` | The session's recent terminal output |
+
+Ask for only what the extension spends: \`check\` names a permission that was
+declared and never used.
+
+## Where it shows
+
+Sessions whose worktree has a \`package.json\`. Widen or narrow that in
+\`activates\`, and narrow one contribution further with its own \`when\`.
+`;
+}
 function scaffoldFiles(options) {
+  const kind = options.kind ?? "connector";
   if (!ID_PATTERN.test(options.id ?? "")) {
-    throw new Error(`Connector id "${options.id}" must start with a letter and be url-safe`);
+    throw new Error(
+      `${kind === "extension" ? "Extension" : "Connector"} id "${options.id}" must start with a letter and be url-safe`
+    );
   }
   const name = options.name?.trim() || titleCase(options.id);
-  const description = options.description?.trim() || `${name} connector for Vorn`;
+  const description = options.description?.trim() || `${name} ${kind} for Vorn`;
   const inRepo = options.repoConventions ?? false;
+  const module = kind === "extension" ? "extension" : "connector";
   return [
-    { path: "package.json", contents: packageJson(options.id, description, inRepo) },
-    { path: "src/connector.ts", contents: connectorSource(options.id, name, description) },
-    { path: "src/entry.ts", contents: entrySource() },
-    { path: "src/index.ts", contents: indexSource() },
-    { path: "src/connector.test.ts", contents: testSource(name) },
+    { path: "package.json", contents: packageJson(options.id, description, inRepo, kind) },
+    kind === "extension" ? { path: "src/extension.ts", contents: extensionSource(options.id, name, description) } : { path: "src/connector.ts", contents: connectorSource(options.id, name, description) },
+    { path: "src/entry.ts", contents: entrySource(module) },
+    { path: "src/index.ts", contents: indexSource(module) },
+    kind === "extension" ? { path: "src/extension.test.ts", contents: extensionTestSource(name) } : { path: "src/connector.test.ts", contents: testSource(name) },
     { path: "src/entry.test.ts", contents: entryTestSource() },
-    { path: "README.md", contents: readme(options.id, name, description) },
+    // The page a pane is drawn from, carried into the pack as it stands here.
+    ...kind === "extension" ? [{ path: "web/report/index.html", contents: extensionPage(name) }] : [],
+    {
+      path: "README.md",
+      contents: kind === "extension" ? extensionReadme(options.id, name, description) : readme(options.id, name, description)
+    },
+    // Everywhere: the generated source imports its package.json, which needs resolveJsonModule to compile.
+    { path: "tsconfig.json", contents: tsconfig(inRepo) },
     ...inRepo ? [
       { path: "CHANGELOG.md", contents: changelog() },
-      { path: "tsconfig.json", contents: tsconfig() },
       { path: "tsup.config.ts", contents: tsupConfig() },
       { path: "vitest.config.ts", contents: vitestConfig() }
     ] : []
@@ -2136,6 +3180,67 @@ function createConnectorServer(connector, options = {}) {
       }
     );
   }
+  const sessionShape = {
+    sessionId: z.string().describe("The session this is being computed for"),
+    worktreePath: z.string().describe("Where the session's work is"),
+    agent: z.enum(EXTENSION_AGENTS).describe("Which agent runs in the session")
+  };
+  const sessionContext = (args, host) => ({
+    sessionId: args.sessionId,
+    worktreePath: args.worktreePath,
+    agent: args.agent,
+    host,
+    now: options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString())
+  });
+  const hostFor = (sessionId) => options.host?.(sessionId) ?? createExtensionHost({ sessionId });
+  for (const footer of connector.contributes?.footers ?? []) {
+    server.registerTool(
+      footerToolName(footer.id),
+      {
+        title: footer.title,
+        description: footer.description ?? `Recompute ${footer.title} for one session`,
+        inputSchema: sessionShape,
+        outputSchema: z.looseObject({
+          items: z.array(z.looseObject({ label: z.string(), value: z.string() })).describe("The readings to show in the band")
+        })
+      },
+      async (args) => {
+        try {
+          const items = await footer.run(sessionContext(args, hostFor(args.sessionId)));
+          return json({ items });
+        } catch (error) {
+          return failure(error);
+        }
+      }
+    );
+  }
+  for (const handler of connector.contributes?.linkHandlers ?? []) {
+    server.registerTool(
+      handlerToolName(handler.id),
+      {
+        title: handler.title,
+        description: handler.description ?? `Open ${handler.title} for a clicked link`,
+        inputSchema: {
+          ...sessionShape,
+          url: z.string().describe("The clicked text, which matched this handler")
+        },
+        outputSchema: z.looseObject({
+          openPane: z.string().optional().describe("Id of one of this extension's panes to open")
+        })
+      },
+      async (args) => {
+        try {
+          const handled = await handler.run({
+            ...sessionContext(args, hostFor(args.sessionId)),
+            url: args.url
+          });
+          return json({ ...handled ?? {} });
+        } catch (error) {
+          return failure(error);
+        }
+      }
+    );
+  }
   for (const action of connector.actions) {
     const base = action.description ?? `${action.label} in ${connector.name}`;
     const retryHint = action.idempotent === void 0 ? "" : action.idempotent ? " Safe to retry: repeating this call with the same arguments has no additional effect." : " Not idempotent: repeating this call performs the operation again.";
@@ -2170,11 +3275,30 @@ async function serveConnector(connector, options = {}) {
 }
 
 export {
+  EXTENSION_PERMISSIONS,
+  HOST_PERMISSIONS,
+  envNameFor,
+  defineConnector,
+  defineExtension,
+  resolveConfig,
+  pollToolName,
+  footerToolName,
+  handlerToolName,
+  MANIFEST_TOOL,
+  PREFLIGHT_TOOL,
+  OPTIONS_TOOL,
+  connectionSetup,
+  connectorManifest,
   MAX_PACK_BYTES,
   lifecycleScriptFindings,
   bundleDependencyFindings,
+  bundledRequireFindings,
   readNearestPackageJson,
   esbuildBundle,
+  HOST_URL_ENV,
+  HOST_TOKEN_ENV,
+  PermissionDeniedError,
+  createExtensionHost,
   normalizeItem,
   normalizeItems,
   pollWithDedupe,
@@ -2194,19 +3318,11 @@ export {
   drainPoll,
   runOptions,
   runAction,
-  envNameFor,
-  defineConnector,
-  resolveConfig,
-  pollToolName,
-  MANIFEST_TOOL,
-  PREFLIGHT_TOOL,
-  OPTIONS_TOOL,
-  connectionSetup,
-  connectorManifest,
   MockRouteMissError,
   escapedMockHttp,
   withMockHttp,
   createConnectorHarness,
+  mockExtensionHost,
   checkConnector,
   CHECK_OWNERS,
   runConformance,