@zackbart/connecta 0.28.1 → 0.30.0

package/dist/request-state.js

@@ -0,0 +1,21 @@
+import { ProtocolError, INVALID_PARAMS } from "@modelcontextprotocol/server";
+export const REQUEST_STATE_TTL_MS = 10 * 60_000;
+export const MAX_INPUT_ROUNDS = 3;
+export function stateObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function invalidRequestState() {
+    throw new ProtocolError(INVALID_PARAMS, "Invalid or expired requestState", { reason: "invalid_request_state" });
+}
+/** Object order is immaterial; array order and every submitted value are bound. */
+export function canonicalState(value) {
+    return JSON.stringify(value, (_key, item) => stateObject(item)
+        ? Object.fromEntries(Object.keys(item)
+            .sort()
+            .map((key) => [key, item[key]]))
+        : item);
+}
+export async function requestDigest(tool, args) {
+    const bytes = new TextEncoder().encode(canonicalState({ tool, args }));
+    return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/resource-read.js

@@ -0,0 +1,103 @@
+import { Effect } from "effect";
+import { classifyCallError, ConnectorCallError } from "./errors.js";
+import { InvocationFailure, timed } from "./invocation.js";
+import { withDeadlineEffect } from "./runtime/run.js";
+import { sentSecretsFor } from "./sent-secrets.js";
+import { hasControlCharacters } from "./tool-name.js";
+const encoder = new TextEncoder();
+const URI_HINT = "Use resource://<connectorId>/<encodeURIComponent(downstreamUri)> with a whole-connector grant.";
+/** Parse once without URL normalization or interpreting the downstream URI. */
+function resourceTarget(registry, raw) {
+    const invalid = () => new ConnectorCallError("invalid_args", `Invalid resource URI. ${URI_HINT}`);
+    if (typeof raw !== "string" || raw.length > 8192 || encoder.encode(raw).length > 8192)
+        throw invalid();
+    const match = /^resource:\/\/([a-z0-9_-]+)\/(.+)$/.exec(raw);
+    if (!match)
+        throw invalid();
+    let uri;
+    try {
+        uri = decodeURIComponent(match[2]);
+    }
+    catch {
+        throw invalid();
+    }
+    if (encodeURIComponent(uri) !== match[2] || !/^[A-Za-z][A-Za-z0-9+.-]*:/.test(uri) || hasControlCharacters(uri))
+        throw invalid();
+    const connector = registry.getResourceConnector(match[1]);
+    if (!connector?.readResource) {
+        throw new InvocationFailure({
+            code: "unknown_address",
+            message: `No resource reader is available for this address. ${URI_HINT}`,
+            retryable: false,
+        });
+    }
+    return { connector, uri };
+}
+/** A protocol read, under the same request scope, call permit and deadline as tools. */
+export function readResource(registry, raw, options) {
+    let connector;
+    return withDeadlineEffect((signal) => Effect.scoped(Effect.gen(function* () {
+        const target = yield* Effect.try({ try: () => resourceTarget(registry, raw), catch: (error) => error });
+        connector = target.connector;
+        options.onResolved?.(target.connector);
+        // Await this Promise in the reader's request context, as invocation.ts does.
+        yield* Effect.acquireRelease(Effect.suspend(() => {
+            const pending = registry.admitCall(target.connector.id, {
+                toolName: "resources/read",
+                args: { uri: target.uri },
+                signal,
+            });
+            return Effect.tryPromise({ try: () => pending, catch: (error) => error }).pipe(Effect.onInterrupt(() => Effect.sync(() => {
+                pending.then((permit) => permit.release(), () => { });
+            })));
+        }), (permit) => Effect.sync(() => permit.release()), { interruptible: true });
+        // Downstream contents enter the guest here, so they take the full payload rules.
+        const contents = yield* timed((elapsed) => options.onConnectorTime?.(elapsed), Effect.tryPromise({
+            try: () => {
+                if (signal.aborted)
+                    throw signal.reason;
+                const ctx = registry.contextFor(target.connector.id, options.baseUrl, options.requestScope, {
+                    signal,
+                    timeoutMs: options.timeoutMs,
+                });
+                options.sentSecrets.include(sentSecretsFor(ctx));
+                if (target.connector.credential && !ctx.credential) {
+                    throw new ConnectorCallError("auth_required", "Operator-managed credential storage is not configured.");
+                }
+                return target.connector.readResource(target.uri, ctx);
+            },
+            catch: (error) => error,
+        }));
+        return options.sentSecrets.redact(contents);
+    })), {
+        timeoutMs: options.timeoutMs,
+        ...(options.signal ? { signal: options.signal } : {}),
+        timeoutError: new ConnectorCallError("timeout", `Resource read timed out after ${options.timeoutMs}ms.`),
+    }).pipe(Effect.catch((error) => {
+        let details = options.signal?.aborted
+            ? { code: "cancelled", message: "Resource read was cancelled because the run ended.", retryable: false }
+            : error instanceof InvocationFailure
+                ? error.details
+                : classifyCallError(options.sentSecrets.redact(error));
+        if (connector && (details.code === "auth_required" || details.code === "downstream_oauth_required")) {
+            details = {
+                ...details,
+                connector: connector.id,
+                recovery: connector.startAuth
+                    ? "oauth"
+                    : registry.credentialUiAvailable() &&
+                        connector.credential &&
+                        registry.contextFor(connector.id, options.baseUrl, options.requestScope).credential
+                        ? "operator_config"
+                        : "unavailable",
+                nextAction: {
+                    tool: "authorize_connector",
+                    arguments: { connector: connector.id },
+                    operatorHandoff: "Give the URL and instructions it returns to the operator.",
+                },
+                retry: "Retry connecta.read with the same resource URI after the operator completes recovery.",
+            };
+        }
+        return Effect.fail(new InvocationFailure(options.sentSecrets.redact(details)));
+    }));
+}

package/dist/result-shapes.js

@@ -1,4 +1,3 @@
-import { isExplicitlyReadOnly } from "./tool-safety.js";
 const OBSERVATION_TTL_MS = 24 * 60 * 60 * 1000;
 const MAX_CACHED_SHAPES = 256;
 const MAX_DEFINITION_BYTES = 64 * 1024;
@@ -8,11 +7,7 @@ const MAX_SCHEMA_NODES = 128;
 const MAX_OBJECT_PROPERTIES = 48;
 const MAX_ARRAY_ITEMS = 32;
 const MAX_PROPERTY_NAME_BYTES = 128;
-const UNSAFE_PROPERTY_NAMES = new Set([
-    "__proto__",
-    "constructor",
-    "prototype",
-]);
+const UNSAFE_PROPERTY_NAMES = new Set(["__proto__", "constructor", "prototype"]);
 const encoder = new TextEncoder();
 function broadType(value) {
     if (value === null)
@@ -34,9 +29,7 @@ function broadType(value) {
 function serializedSchema(schema) {
     try {
         const text = JSON.stringify(schema);
-        return encoder.encode(text).byteLength <= MAX_SCHEMA_BYTES
-            ? text
-            : undefined;
+        return encoder.encode(text).byteLength <= MAX_SCHEMA_BYTES ? text : undefined;
     }
     catch {
         return undefined;
@@ -56,9 +49,7 @@ function cloneSchema(schema) {
 function definitionIdentity(definition) {
     try {
         const serialized = JSON.stringify(definition);
-        return encoder.encode(serialized).byteLength <= MAX_DEFINITION_BYTES
-            ? serialized
-            : undefined;
+        return encoder.encode(serialized).byteLength <= MAX_DEFINITION_BYTES ? serialized : undefined;
     }
     catch {
         return undefined;
@@ -68,8 +59,7 @@ function schemaType(schema) {
     return typeof schema.type === "string" ? schema.type : undefined;
 }
 function safePropertyName(name) {
-    return (!UNSAFE_PROPERTY_NAMES.has(name) &&
-        encoder.encode(name).byteLength <= MAX_PROPERTY_NAME_BYTES);
+    return !UNSAFE_PROPERTY_NAMES.has(name) && encoder.encode(name).byteLength <= MAX_PROPERTY_NAME_BYTES;
 }
 function boundedPropertyNames(value) {
     const names = [];
@@ -83,9 +73,7 @@ function boundedPropertyNames(value) {
     return names.sort();
 }
 function unionBranches(schema) {
-    return Array.isArray(schema.anyOf)
-        ? schema.anyOf
-        : [schema];
+    return Array.isArray(schema.anyOf) ? schema.anyOf : [schema];
 }
 function branchOrder(schema) {
     return ["null", "boolean", "number", "string", "array", "object"].indexOf(schemaType(schema) ?? "");
@@ -94,40 +82,25 @@ function mergeSchemas(left, right) {
     const leftType = schemaType(left);
     const rightType = schemaType(right);
     if (leftType === "object" && rightType === "object") {
-        const leftProperties = left.properties && typeof left.properties === "object"
-            ? left.properties
-            : {};
-        const rightProperties = right.properties && typeof right.properties === "object"
-            ? right.properties
-            : {};
+        const leftProperties = left.properties && typeof left.properties === "object" ? left.properties : {};
+        const rightProperties = right.properties && typeof right.properties === "object" ? right.properties : {};
         const properties = Object.create(null);
-        for (const key of [...new Set([
-                ...Object.keys(leftProperties),
-                ...Object.keys(rightProperties),
-            ])].sort()) {
+        for (const key of [...new Set([...Object.keys(leftProperties), ...Object.keys(rightProperties)])].sort()) {
             const leftProperty = leftProperties[key];
             const rightProperty = rightProperties[key];
             properties[key] =
-                leftProperty && rightProperty
-                    ? mergeSchemas(leftProperty, rightProperty)
-                    : (leftProperty ?? rightProperty);
+                leftProperty && rightProperty ? mergeSchemas(leftProperty, rightProperty) : (leftProperty ?? rightProperty);
         }
         return { type: "object", properties };
     }
     if (leftType === "array" && rightType === "array") {
-        const leftItems = left.items && typeof left.items === "object"
-            ? left.items
-            : undefined;
-        const rightItems = right.items && typeof right.items === "object"
-            ? right.items
-            : undefined;
+        const leftItems = left.items && typeof left.items === "object" ? left.items : undefined;
+        const rightItems = right.items && typeof right.items === "object" ? right.items : undefined;
         return {
             type: "array",
             ...(leftItems || rightItems
                 ? {
-                    items: leftItems && rightItems
-                        ? mergeSchemas(leftItems, rightItems)
-                        : (leftItems ?? rightItems),
+                    items: leftItems && rightItems ? mergeSchemas(leftItems, rightItems) : (leftItems ?? rightItems),
                 }
                 : {}),
         };
@@ -212,8 +185,7 @@ function boundSchema(schema, budget, depth = 0) {
         const properties = Object.create(null);
         let included = 0;
         for (const key of Object.keys(source).sort()) {
-            if (included >= MAX_OBJECT_PROPERTIES ||
-                !safePropertyName(key)) {
+            if (included >= MAX_OBJECT_PROPERTIES || !safePropertyName(key)) {
                 continue;
             }
             const property = boundSchema(source[key], budget, depth + 1);
@@ -231,9 +203,7 @@ function boundSchema(schema, budget, depth = 0) {
 function observedSchema(value) {
     try {
         const inferred = inferSchema(value, { nodes: 0, seen: new WeakSet() });
-        const schema = inferred
-            ? boundSchema(inferred, { nodes: 0 })
-            : undefined;
+        const schema = inferred ? boundSchema(inferred, { nodes: 0 }) : undefined;
         return schema && serializedSchema(schema) ? schema : undefined;
     }
     catch {
@@ -267,7 +237,7 @@ export class ObservedOutputSchemas {
                 this.entries.delete(key);
                 return undefined;
             }
-            if (!isExplicitlyReadOnly(definition)) {
+            if (definition.classification !== "read") {
                 this.entries.delete(key);
                 return undefined;
             }
@@ -298,7 +268,7 @@ export class ObservedOutputSchemas {
                 this.entries.delete(key);
                 return;
             }
-            if (!isExplicitlyReadOnly(definition)) {
+            if (definition.classification !== "read") {
                 this.entries.delete(key);
                 return;
             }
@@ -311,9 +281,7 @@ export class ObservedOutputSchemas {
             if (!inferred)
                 return;
             const current = this.entries.get(key);
-            const merged = boundSchema(current &&
-                current.definition === identity &&
-                current.expiresAt > Date.now()
+            const merged = boundSchema(current && current.definition === identity && current.expiresAt > Date.now()
                 ? mergeSchemas(current.schema, inferred)
                 : inferred, { nodes: 0 });
             if (!merged || !serializedSchema(merged))

package/dist/retired-toolkits.js

@@ -4,5 +4,5 @@ export function assertNoRetiredToolkitOptions(source, options) {
     if (!hasOwn(options, "toolkits") && !hasOwn(options, "unscoped"))
         return;
     throw new Error(`${source} options \`toolkits\` and \`unscoped\` were removed in issue ` +
-        "#178. Deploy one connecta instance per audience instead; see ethos.md.");
+        "#178. Deploy one connecta instance per audience instead; see PRINCIPLES.md.");
 }

package/dist/routes/access-tokens.js

@@ -1,9 +1,6 @@
-import { authorizeUiIdentity, isSameOrigin, privateJson, } from "./shared.js";
+import { authorizeUiIdentity, isSameOrigin, privateJson } from "./shared.js";
 async function readName(request) {
-    if (!request.headers
-        .get("content-type")
-        ?.toLowerCase()
-        .startsWith("application/json")) {
+    if (!request.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
         return {
             ok: false,
             response: privateJson({ error: "Content-Type must be application/json" }, { status: 415 }),
@@ -70,7 +67,7 @@ export async function routeAccessTokens(context, manager) {
     if (mutating && !isSameOrigin(request, baseUrl)) {
         return privateJson({ error: "same-origin request required" }, { status: 403 });
     }
-    const admin = await authorizeUiIdentity(request, baseUrl, opts.auth, "access token management", context.runtimeContext, opts.identity);
+    const admin = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "access token management", context.runtimeContext, opts.config.identity);
     if (!admin.ok)
         return admin.response;
     if (!admin.accessTokenManagement || !admin.identity.principal) {

package/dist/routes/activity-context.js

@@ -0,0 +1,21 @@
+/** Attribute catalog refreshes initiated by an admitted operator request. */
+export function operatorActivityContext(context, authz) {
+    const { opts, defer } = context;
+    const activity = opts.config.activity;
+    if (!activity)
+        return undefined;
+    const principal = authz.identity.principal;
+    return {
+        sink: activity.store,
+        recordTool: activity.recordTool,
+        actor: authz.actor,
+        ...(principal
+            ? { principalActor: { kind: authz.actor.kind, id: principal.id, namespace: principal.namespace } }
+            : {}),
+        requestId: crypto.randomUUID(),
+        serverInfo: opts.config.serverInfo,
+        ...(activity.deploymentId ? { deploymentId: activity.deploymentId } : {}),
+        ...(defer ? { defer } : {}),
+        logger: opts.config.logger,
+    };
+}

package/dist/routes/activity-disclosure.js

@@ -0,0 +1,40 @@
+import { intersectAccess } from "../connector-access.js";
+import { recordedToolName } from "../operator-record.js";
+/** Historical disclosure uses the verdict at call time; old guarded rows fail closed. */
+function activityToolVisible(authz, event) {
+    const allowed = authz.toolAccess?.get(event.connectorId);
+    return (recordedToolName({ name: event.toolName }) === event.toolName &&
+        (!allowed || allowed.has(event.toolName)) &&
+        (!authz.guardedToolAccess?.get(event.connectorId)?.has(event.toolName) || event.classification === "read"));
+}
+/**
+ * One disclosure rule for the timeline and the UI's last-call overlay.
+ * After Activity access and the read gate, operators and activityAccess machine
+ * callers may see other principals' shared-connector history when connector/tool
+ * and recorded-pool grants permit, including request IDs, client name/version,
+ * and actor kind/id/namespace. Interactive reads may add directory actor labels;
+ * machine reads do not. Personal history requires a matching principal owner.
+ */
+export function activityEventVisible(context, authz, registry, admittedPools, event) {
+    const connector = registry.getConnector(event.connectorId);
+    if (!connector || (event.pool !== undefined && !admittedPools.has(event.pool)))
+        return false;
+    if (connector.authScope === "personal" || (event.kind === "catalog_drift" && event.actorBasis === "principal")) {
+        const owner = authz.identity.principal;
+        if (!owner ||
+            event.actorBasis !== "principal" ||
+            event.actor.id !== owner.id ||
+            event.actor.namespace !== owner.namespace)
+            return false;
+    }
+    const pool = event.pool ? context.opts.pools.get(event.pool) : undefined;
+    if (event.pool && !pool)
+        return false;
+    const access = pool ? intersectAccess(authz, pool.access) : authz;
+    if (access.connectorIds !== "all" && !access.connectorIds.includes(event.connectorId))
+        return false;
+    // Connector-wide counts reveal tools outside an address-only grant.
+    if (event.kind === "catalog_drift")
+        return !access.toolAccess?.has(event.connectorId);
+    return activityToolVisible(access, event);
+}

package/dist/routes/activity.js

@@ -1,7 +1,9 @@
+import { activityEventVisible } from "./activity-disclosure.js";
 import { Duration, Effect } from "effect";
-import { InvalidActivityCursorError, } from "../activity.js";
+import { activityBehaviorFacts, activityPackageVersion, activityClientFact, InvalidActivityCursorError, } from "../activity.js";
+import { failureRecord, logFailure } from "../operator-record.js";
 import { ACTOR_LABEL_BUDGET_MS, ACTOR_LABEL_CONCURRENCY, actorKey, cleanActorLabel, labelLookups, } from "./actor-labels.js";
-import { authorized, refuse, serveOperator } from "./operator.js";
+import { authorized, refuse, serveOperator, visibleRegistry } from "./operator.js";
 import { privateJson } from "./shared.js";
 /**
  * Add display-only actor labels to one authorized activity page. Resolution is
@@ -25,20 +27,25 @@ function enrichActivityActorLabels(page, auth) {
         }).pipe(Effect.timeoutOption(Duration.millis(ACTOR_LABEL_BUDGET_MS)), Effect.map(() => ({
             ...page,
             events: page.events.map((event) => {
-                const resolved = event.actor.id
-                    ? labels.get(actorKey(event.actor))
-                    : undefined;
+                const resolved = event.actor.id ? labels.get(actorKey(event.actor)) : undefined;
                 // Never trust or echo a `label` supplied by storage. The persisted event
                 // schema has no label; only this authenticated read path may add one.
                 const actor = {
                     kind: event.actor.kind,
                     ...(event.actor.id ? { id: event.actor.id } : {}),
-                    ...(event.actor.namespace
-                        ? { namespace: event.actor.namespace }
-                        : {}),
+                    ...(event.actor.namespace ? { namespace: event.actor.namespace } : {}),
                 };
+                // Re-check stored client facts, including custom readers and old rows.
+                const { packageVersion: suppliedPackageVersion, clientName: suppliedName, clientVersion: suppliedVersion, classification: _classification, resultBytes: _resultBytes, kind: _kind, drift: _drift, pool: _pool, actorBasis: _actorBasis, ...record } = event;
+                const packageVersion = activityPackageVersion(suppliedPackageVersion);
+                const clientName = activityClientFact(suppliedName, "name");
+                const clientVersion = activityClientFact(suppliedVersion, "version");
                 return {
-                    ...event,
+                    ...record,
+                    ...activityBehaviorFacts(event),
+                    ...(packageVersion !== undefined ? { packageVersion } : {}),
+                    ...(clientName !== undefined ? { clientName } : {}),
+                    ...(clientVersion !== undefined ? { clientVersion } : {}),
                     actor: resolved ? { ...actor, label: resolved } : actor,
                 };
             }),
@@ -48,41 +55,72 @@ function enrichActivityActorLabels(page, auth) {
 function activityRead(context) {
     const { url, opts } = context;
     return Effect.gen(function* () {
-        const authz = yield* authorized(context, false);
+        const authz = yield* authorized(context);
+        const registry = yield* visibleRegistry(context, authz);
         if (!authz.operator)
-            return yield* refuse("operator access required", 403);
-        if (opts.activityReadGate &&
-            !(yield* Effect.promise(async () => opts.activityReadGate(authz.actor)))) {
+            return yield* refuse("activity access required", 403);
+        if (opts.config.activity?.readGate &&
+            !(yield* Effect.promise(async () => opts.config.activity?.readGate(authz.actor)))) {
             return yield* refuse("forbidden", 403);
         }
-        const list = opts.activity?.list?.bind(opts.activity);
+        const list = opts.config.activity?.store.list?.bind(opts.config.activity?.store);
         if (!list)
             return yield* refuse("activity history is not configured", 404);
+        const admittedPools = new Set();
+        for (const [name, pool] of opts.pools) {
+            if (yield* Effect.promise(async () => {
+                try {
+                    return (await pool.grant(authz.identity)) === true;
+                }
+                catch {
+                    return false;
+                }
+            }))
+                admittedPools.add(name);
+        }
+        const visible = (event) => activityEventVisible(context, authz, registry, admittedPools, event);
         const cursor = url.searchParams.get("cursor") ?? undefined;
         if (cursor && cursor.length > 500)
             return yield* refuse("invalid cursor", 400);
         const requestedLimit = Number(url.searchParams.get("limit") ?? "50");
-        const limit = Number.isFinite(requestedLimit)
-            ? Math.min(100, Math.max(1, Math.trunc(requestedLimit)))
-            : 50;
-        return yield* Effect.tryPromise({
+        const limit = Number.isFinite(requestedLimit) ? Math.min(100, Math.max(1, Math.trunc(requestedLimit))) : 50;
+        const readPage = (cursor, limit) => Effect.tryPromise({
             try: () => list({ ...(cursor !== undefined ? { cursor } : {}), limit }),
             catch: (error) => error,
-        }).pipe(Effect.flatMap((page) => enrichActivityActorLabels(page, opts.auth)), Effect.map((page) => privateJson(page)), 
+        });
+        return yield* Effect.gen(function* () {
+            let page = yield* readPage(cursor, limit);
+            const events = page.events.filter(visible);
+            // Store cursors may encode their boundary row's timestamp and id. A
+            // rejected boundary must never reach the caller. Advance one row at a
+            // time until the boundary is visible or history is exhausted.
+            const seen = new Set();
+            let boundaryReads = 0;
+            while (page.nextCursor && (!page.events.length || !visible(page.events[page.events.length - 1]))) {
+                if (boundaryReads++ >= 1000)
+                    throw new Error("activity disclosure scan exhausted");
+                if (seen.has(page.nextCursor))
+                    throw new Error("activity cursor did not advance");
+                seen.add(page.nextCursor);
+                page = yield* readPage(page.nextCursor, 1);
+                events.push(...page.events.filter(visible));
+            }
+            return { events, ...(page.nextCursor ? { nextCursor: page.nextCursor } : {}) };
+        }).pipe(Effect.flatMap((page) => enrichActivityActorLabels(page, authz.identity.interactive ? opts.config.auth : [])), Effect.map((page) => privateJson(page)), 
         // A page too malformed to label or serialize is the store's failure,
         // like any other.
         Effect.catchDefect((defect) => Effect.fail(defect)), Effect.catch((error) => {
             if (error instanceof InvalidActivityCursorError) {
                 return refuse(error.message, 400);
             }
-            opts.logger.error("[connecta] activity read failed", error);
+            logFailure(opts.config.logger, "activity read failed", failureRecord({}, error), "error");
             return refuse("activity history is temporarily unavailable", 503);
         }));
     });
 }
 export async function routeActivity(context) {
     const { path, request } = context;
-    if (path !== "/ui/activity")
+    if (path !== "/ui/activity" && path !== "/ui/api/activity")
         return null;
     if (request.method !== "GET") {
         return privateJson({ error: "method not allowed" }, { status: 405 });

package/dist/routes/actor-labels.js

@@ -1,5 +1,4 @@
-// Display labels for stored actors, shared by the activity page and the
-// artifact library. An actor is stored as a stable id; a label is resolved at
+// Display labels for stored activity actors. An actor is stored as a stable id; a label is resolved at
 // read time from the one auth provider that owns the actor's directory, and
 // only on an authorized read path. Nothing here is persisted, and a label a
 // store happens to carry is never trusted or echoed.
@@ -43,11 +42,9 @@ export function labelLookups(actors, auth) {
         const eligible = identity.namespace
             ? candidates.filter(({ provider }) => activityActorNamespace(provider) === identity.namespace)
             : (() => {
-                const directoryKey = ({ provider, index, }) => {
+                const directoryKey = ({ provider, index }) => {
                     const namespace = activityActorNamespace(provider);
-                    return namespace === undefined
-                        ? `provider:${index}`
-                        : `namespace:${namespace}`;
+                    return namespace === undefined ? `provider:${index}` : `namespace:${namespace}`;
                 };
                 // Every same-kind provider participates in the ambiguity check,
                 // even if it cannot resolve labels. Otherwise a legacy ID owned
@@ -68,47 +65,3 @@ export function labelLookups(actors, auth) {
     }
     return lookups;
 }
-/**
- * Resolve labels for `actors`, best-effort: at most eight lookups at once,
- * 1.5 seconds in all, and whatever has resolved by then is the answer. A
- * provider outage yields no labels, never a failed read.
- */
-export async function resolveActorLabels(actors, auth) {
-    const labels = new Map();
-    const queue = labelLookups(actors, auth);
-    let cursor = 0;
-    let expired = false;
-    const worker = async () => {
-        while (!expired && cursor < queue.length) {
-            const lookup = queue[cursor++];
-            if (!lookup)
-                return;
-            try {
-                const label = cleanActorLabel(await Promise.resolve(lookup.provider.activityActorLabel?.(lookup.id)));
-                if (label && !expired)
-                    labels.set(lookup.key, label);
-            }
-            catch {
-                // A failed lookup leaves the actor unlabeled.
-            }
-        }
-    };
-    let timer;
-    const budget = new Promise((resolve) => {
-        timer = setTimeout(() => {
-            expired = true;
-            resolve();
-        }, ACTOR_LABEL_BUDGET_MS);
-    });
-    try {
-        await Promise.race([
-            Promise.all(Array.from({ length: Math.min(ACTOR_LABEL_CONCURRENCY, queue.length) }, worker)),
-            budget,
-        ]);
-    }
-    finally {
-        if (timer !== undefined)
-            clearTimeout(timer);
-    }
-    return new Map(labels);
-}