pi-roundtable-web 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -5,6 +5,21 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.26.0] - 2026-10-30
+
+The core peer range is now `>=0.26.0 <0.27.0`.
+
+### Fixed
+
+- A card or an unprompted reply in a host room no longer pushes to every owner's phone; host rooms reach phones only through notices.
+- A file an agent attaches in a host room is bound to the room and the kind's file retention, so its readers can download it (before, only owners could, and the 30-day agent sweep applied).
+- Answering a card in a host room asks the kind's `access` with the person's roles, so a role-gated reader is no longer refused or dropped from the room.
+- A link with a tab, newline or space is no longer taken for a path of this origin.
+
+### Changed
+
+- A running turn's strip shows only its three newest tool calls; a button counts the earlier ones and opens them all (and folds them again).
+
 ## [0.25.0] - 2026-10-29
 
 The core peer range is now `>=0.25.0 <0.26.0`.

package/README.md

@@ -21,14 +21,16 @@ Then only a person whose principal holds the owner role gets in.
 
 - [Requirements](#requirements) and [Install](#install)
 - [The owner app](#the-owner-app): rooms, cards, [modes](#modes-yolo-and-long-running), [dispatch threads](#dispatch-threads), [pins and folders](#pins-and-folders), [uploads](#uploads), [characters](#characters-in-the-page), [the Camelot look](#the-camelot-look), [the round table](#the-round-table), [the files pane](#the-files-pane)
+- [Members and the gate](#members-and-the-gate): [who is let in](#who-is-let-in), what each tier sees, and the steps owed before the app opens
 - [Install on a device](#install-on-a-device) and [Notifications](#notifications)
 - [Authentication](#authentication) and the [threat model](#threat-model)
 - [Options](#options), [the console's panes](#the-consoles-panes) and [host feature ports](#host-feature-ports)
+- [Host rooms, pages and cards](#host-rooms-pages-and-cards): rooms a host plugin owns, with read marks
 - [App protocol](#app-protocol), [Screenshots](#screenshots) and [Development](#development)
 
 ## Requirements
 
-- Bun 1.4.4 or later, and pi-roundtable `>=0.25.0 <0.26.0` as a peer dependency.
+- Bun 1.4.4 or later, and pi-roundtable `>=0.26.0 <0.27.0` as a peer dependency.
 - The host must run on the machine that holds its data directory: the console reads `<dataDir>/sessions` from disk, and the app keeps its files and keys under `<dataDir>/web/`.
 - An agent team: `agents` in the configuration, with or without `discord`. Without Discord the host also needs a surface that hosts rooms, and this plugin is one; the start fails otherwise, naming the fix.
 - A way to authenticate the owners (see [Authentication](#authentication)): a password, Cloudflare Access or a verifier of your own in front of the listener, or `none` on a listener only the owner reaches.
@@ -192,7 +194,7 @@ An owner may send a file of any kind in a room, up to four to a message: the but
 
 - **Streamed, not buffered.** The body is read as a stream and written to disk as it arrives, so a large file costs disk, not memory. Only the first bytes are kept to tell what the file is. A file over `uploadMaxBytes` is refused with `413` (before it is read when the length says so, as it passes the limit otherwise), and nothing is left on disk.
 - **Any type.** Images are checked by their first bytes (a file that says it is a PNG but is not one is refused with `415`); a file that is valid UTF-8 without NUL bytes is kept as text (`text/markdown`, `text/csv` or `application/json` by its name, else `text/plain`); a PDF by its first bytes keeps `application/pdf`; everything else is kept as `application/octet-stream` under the name it came with. What the browser said the type was (often empty, or `video/mp2t` for a `.ts` file) does not decide.
-- **Bounded.** A person may have 16 files and 400 MiB waiting for a message, counting uploads on their way (`429` beyond that); a waiting file is deleted after a day, a sent one after 30. The page deletes a chip's upload when it is removed or its send fails (`DELETE <mount>/api/uploads/<id>`, the owner's own waiting uploads only), and a body that is cut short leaves no file behind.
+- **Bounded.** A person may have 16 files and 400 MiB waiting for a message, counting uploads on their way (`429` beyond that); a waiting file is deleted after a day, a sent one after `uploads.keepDays` (30 by default). The page deletes a chip's upload when it is removed or its send fails (`DELETE <mount>/api/uploads/<id>`, the owner's own waiting uploads only), and a body that is cut short leaves no file behind.
 - **Served safely.** A stored file is a download, never a page (`content-disposition: attachment`, `content-security-policy: sandbox`, `nosniff`); only the four image types are shown inline.
 - **What the agent gets.** The turn's message names each file, and the host saves it for the agent's tools: the app hands the host the stored file's path, so a large file is copied from disk, never held in memory. The agent takes a file up to `uploadMaxBytes` (the surface's `maxAttachmentBytes`), not the 25 MiB a Discord attachment is held to. Images (four at most) are also shown to the model, and a text or PDF file can be read by the agent. A file over 25 MiB is kept as a file for tools: it is not shown to the model and `read_attachment` refuses it, and the turn's attachment list marks it "too large for read_attachment; kept as a file for tools", which a tool that takes files opens as it is.
 - **Limits in front of the app.** The upload route asks the host's listener for a request body of `uploadMaxBytes` plus 64 KiB of form framing, so a larger `uploadMaxBytes` raises the listener's limit past its 128 MiB default (a listener the host fixed with its own `maxRequestBodyBytes` decides instead, and refuses a larger body with `413`). A reverse proxy has its own limit; Cloudflare's free plan caps request bodies at 100 MB, so a larger file needs a paid plan or an upload path that skips the proxy.
@@ -287,6 +289,48 @@ A host that adds a root the agents cannot reach should authenticate with a verif
 The REST is `GET api/workspace`, `GET api/workspace/<place>/list?path=`, `file?path=` (the text, `hash`, `editable` and, when not, `reason`), `raw?path=` (bytes, `no-store`, `&download=1` forces a download), `PUT file?path=` (`{ text, baseHash }`), `POST new?path=` (`{ kind: "file" | "dir", text? }`), `POST rename` (`{ from, to }`), `DELETE entry?path=`, `GET trash`, `POST trash/<id>/restore` and `DELETE trash/<id>`.
 The service worker never caches `api/workspace`.
 
+## Members and the gate
+
+By default the app lets in only owners, as it always has. With `admission: "access"` it lets in everyone the host's `IDENTITY` admits on the app's surface: owners, admins and members. The app never makes a rule of its own about who that is; it asks `IDENTITY`, whose `access` configuration decides.
+
+### Who is let in
+
+`admission: "access"` needs a credential that names a person: `auth: { mode: "oidc", ... }` (below), or a verifier that reports who signed in. `none` and `password` speak for one shared actor and are refused with it.
+
+- A person whose identity is linked to a principal is looked up with `IDENTITY.peek`, which writes nothing. A person nobody has linked is admitted through `IDENTITY.resolve`, which makes a new principal only where `access.provisioning.app` is `admitted` for the surface; otherwise they are refused.
+- The facts the app reports are partial (`partial: true`): signing in here shows less than a person may hold elsewhere, and never lowers a tier recorded somewhere else. An admin in the app is a lasting admin grant, or a role named by the access rules as `app:role:<name>` that the provider's token carries.
+- A disabled principal, and a person the rules give no tier, are refused with `403`.
+- The tier is read again on every request and on a socket's every frame and once a minute. Losing admission closes the socket with 4403; a change of tier changes what it is sent from then on.
+
+### Deny by default
+
+One table decides every request before any handler sees it (`src/authz.ts`). A route that is not in it answers `404` to everyone, owners included. Each row says who it answers:
+
+| Who | Routes |
+|---|---|
+| Owner | the owners' agent rooms (`api/rooms*`, a `404` to anyone else), the overview, skills, connectors, folders, agents, groups, the archive, prompts, the files pane, and the event stream |
+| Any admitted person | their own conversations, notes and schedules, the host's rooms and pages, uploads, and pictures of agents |
+| Anyone admitted, gated or not | the page itself, `config`, `session`, their notices, push, profile, links and onboarding |
+
+A member's socket receives nothing from an agent room, neither as it happens nor when it connects: the owners' cards and the table of who is busy are sent only to sockets whose tier is owner now. A card is answered only by its own audience, the same rule as Discord's: for an approval that names approvers, the named ones who hold its tier now, and the owners; otherwise the turn's speaker and the owners where the scope escalates. A room's readers can never widen that.
+
+### What each tier is served
+
+`panes` takes a list for the owners and, with `admission: "access"`, `{ owner, admin?, member }` to choose per tier. The default gives a member `rooms` (the host's own rooms only), `conversations`, `notes`, `schedules` and `profile`, of those the host serves; an admin's list is the member's unless given. A member is never served `overview`, `table`, `workspace`, `skills` or `connectors`, and naming one for them stops the start.
+
+- **Conversations**: a member lists and reads only the private conversations the registry records as theirs, found by the registry; `exclude(key, record)` is asked on every list and every transcript read.
+- **Notes**: their own only. Asking for another person's is `403`. The pane is left out, with a warning, when the host keeps no memory (`MEMORY`); naming it with none is an error.
+- **Schedules**: their own, whichever of the 0.8 and the current id the schedule names them by; an owner sees every schedule.
+- **Profile**: who they are signed in as, and Log out.
+
+### The gate
+
+A required step the person still owes (see `onboarding`) closes the app on it: only their profile, settings and the pages that finish a step answer, the page shows the steps with a link to each, and the socket carries only the gate, their notices and refusals. When the last step is done the page loads again with everything the person may now see.
+
+### Deep links
+
+A link to a page can name where to go after signing in: `?next=profile`, `?next=notices`, `?next=settings`, `?next=room:<key>` for a room of the app's surface, or `?next=p:<page>` for a host page. Anything else, an address of another site included, is dropped.
+
 ## Install on a device
 
 The app is a progressive web app, installable on a phone, tablet or desktop and opened in its own window.
@@ -331,6 +375,37 @@ Setup:
 - **Delivery.** The payload is encrypted for the device (RFC 8291, `aes128gcm`) and signed with a VAPID token (RFC 8292, ES256 with `jose`); there is no push dependency. A `404` or `410` from the service removes the subscription, as do five failures in a row. A person has at most 20 devices.
 - **Who gets it.** Only a device of a person who is still an owner, and only while no open page of that owner reports itself visible.
 
+## Notices and the profile
+
+A notice is something that waits on one person, such as a customer's message or a card to approve. A host raises one with `Notices.raise({ tag, people, title, open, urgency?, via? })` and takes it back with `Notices.resolve(tag)`; `renotify` adds people to an open one. `open` names exactly where a tap goes: `{ room, message? }` (the room, scrolled to that message) or `{ page, query? }`. A notice appears in the bell, with a count on the app icon where the device allows it, and is pushed according to its `urgency`: a normal one waits in the bell during the person's quiet hours, an urgent one rings and stays on screen until dealt with. `via` narrows a notice to named transports (see `push.transports`).
+
+Tapping a notification or a bell row opens exactly that room or page, whether the app is open (its window comes forward and goes there) or closed (a new window opens at the address; a signed-out person signs in and lands there). A device reports when a notice arrived and when it was opened, which is how the app knows a test notification reached the device.
+
+The profile page (`profile`) shows the person's name, picture and tier, the accounts they linked and the ones they can link or unlink, **Shown as** (which linked account names them in the app, or Automatic), and their own quiet hours with a test notification. An account that the host's configuration links cannot be unlinked there.
+
+### An external push sender
+
+With `push.sender: { external: { publicKey } }` the app holds no VAPID key: it queues each push as a row in `web_push_outbox` and a separate process empties it. Run that process with `runPushSender` from `pi-roundtable-web/push-sender`:
+
+```ts
+import { runPushSender, webPushTransport } from "pi-roundtable-web/push-sender";
+
+runPushSender({
+  database,                         // a role that may SELECT the outbox, subscriptions, sessions and principals, UPDATE the outbox, and INSERT deliveries and subscriptions
+  transports: [webPushTransport({ /* the VAPID key pair and subject */ }), mySlackTransport],
+  render: (row) => ({ title: "Something needs you" }), // with push.content "none" the row carries no text
+  subscribe: {                      // omit when the app's own subscription routes are used
+    listener: { port: 8788 },
+    path: "/push/subscriptions",    // the app's push.sender.external.subscribePath
+    origin: "https://app.example.com",
+    authenticate: (request) => webSessionPrincipal(database, request),
+  },
+  logger,
+});
+```
+
+The sender tries its transports in order for each row until one says it was sent, narrowed by the row's `via`. Its subscription routes answer only with the app's session cookie, and every request other than a GET must carry exactly the console's `Origin`, or it is refused with `403`. `webSessionPrincipal` and `webSessionClaims` read the session cookie, the second giving the claims of a person's newest live session (set `auth.storeClaims` for them to be stored). Nothing in the app process can read the key.
+
 ## Authentication
 
 The app never makes an account.
@@ -342,6 +417,7 @@ You choose how with the `auth` option; the console then looks the person up in t
 | `{ mode: "verifier", verifier }`, or the `verifier` option as shorthand | The person the verifier reports, linked to an owner's principal. | A proxy such as Cloudflare Access authenticates people in front of the listener. This is the one mode whose proof an agent on the host cannot forge. |
 | `{ mode: "password" }` | The primary owner, once they give the password. | The console is reachable from the internet with no proxy that signs people in. |
 | `{ mode: "none" }` | The primary owner, whoever reaches the listener. | Only the owner can reach the listener: a unix socket, or loopback TCP. |
+| `{ mode: "oidc", issuer, clientId }` | The person the provider reports, by the identity `IDENTITY` links to a principal. With `admission: "access"`, members and admins too. | People sign in with a provider of your own, without a proxy in front. See [OpenID Connect](#openid-connect). |
 
 Giving both `auth` and `verifier` throws, and so does giving neither: the plugin never starts without a way to authenticate.
 Whatever the mode, a request that changes data must carry the console's own `Origin`.
@@ -412,6 +488,18 @@ The console never resolves an identity the way a chat surface does: a visitor is
 It refuses an identity of the `legacy` provider too, as resolving refuses it: that is the alias 0.9 keeps for a 0.8 id, not anyone's sign-in.
 A verifier may vouch for members as well as owners, through a proxy that lets the whole company in or an allowlist that grows, so the console never guesses whose an identity is: only a link says so.
 
+### OpenID Connect
+
+`auth: { mode: "oidc", issuer, clientId }` signs people in with any OpenID Connect provider (Microsoft Entra, Google, Keycloak, Authentik and the like) by the authorization code flow with PKCE. The origin must be `https`: the session cookie is `Secure`.
+
+1. A person with no session is sent to the provider with a state, a nonce and a PKCE challenge, kept in a signed cookie that lives ten minutes and works once. The first visit asks silently (`prompt=none`), so a live single sign-on needs no click; when the provider answers `login_required` the person is asked once, normally.
+2. At the callback the code is exchanged, and the `id_token` is checked once: its signature against the provider's published keys, issuer, audience, expiry and nonce. A state that does not match or was used before, a callback with no pending cookie, and a token that fails any check are refused and make no session.
+3. `IDENTITY` admits the person (see [Who is let in](#who-is-let-in)); only then is a session made: a random 256-bit id in an `HttpOnly` cookie, of which the database keeps only the SHA-256, in the `web_sessions` table. No token, claim, code or session id is logged.
+4. The session slides: it ends after `sessionDays` (30) without a visit, and a visit moves the limit at most once an hour. Nothing the provider said is trusted again; the tier is read from `IDENTITY` on every request. Disabling the principal refuses the next request and closes the socket.
+5. Log out deletes the row, so the old cookie is refused afterwards, clears the cookie and, with `endSession`, also signs out at the provider. A person who just logged out is asked, not signed in silently again.
+
+`reauthHours` makes the provider vouch again: past it, the next page load does a silent round trip that refreshes the stored facts and roles, a provider that wants the person sends them through a normal sign-in, and a request to the API or the socket on such a session is answered `401` until then. `storeClaims` keeps the named `id_token` claims with the session, replaced at each sign-in, for a sender that needs, say, a mailbox address.
+
 ### Upgrading from 0.8
 
 The core [Migrating to 0.9](../../docs/migration-0.9.md) guide covers backfill, rollback, and the principal isolation boundary.
@@ -569,7 +657,7 @@ Every option is checked when the plugin is created, so a bad setting stops the h
 
 | Option | Default | What it does |
 |---|---|---|
-| `auth` | none, `auth` or `verifier` required | How requests are authenticated: `{ mode: "none" }`, `{ mode: "password" }` or `{ mode: "verifier", verifier }`; its keys are in the next table, and [Authentication](#authentication) explains the modes. |
+| `auth` | none, `auth` or `verifier` required | How requests are authenticated: `{ mode: "none" }`, `{ mode: "password" }`, `{ mode: "verifier", verifier }` or `{ mode: "oidc", ... }`; its keys are in the next table, and [Authentication](#authentication) explains the modes. |
 | `verifier` | none | Shorthand for `auth: { mode: "verifier", verifier }`: decides whether a request comes from someone your proxy authenticated, and reports who. `cloudflareAccess(...)` is built in; pass your own function to use another proxy. Giving both `auth` and `verifier` throws. |
 | `origin` | none, required | The app's own origin as the browser sees it, such as `https://app.example.com`: scheme and host (and port), no path. Requests that change data must carry it as their `Origin`, the dashboard line links to it, and push derives its default contact from it. |
 | `ownerId` | the primary owner | Deprecated. The owner's principal id that a request from a verifier reporting no actor stands for. The Notes pane no longer needs it: it shows each owner their own notes. |
@@ -577,11 +665,14 @@ Every option is checked when the plugin is created, so a bad setting stops the h
 | `mountPath` | `/console` | The path the app is served under: one or more segments of letters, digits, `.`, `_`, `~`, and `-`. |
 | `listener` | `public` | The id of the listener whose address serves the app. |
 | `routing` | `hash` | `path` retains links such as `/console/skills`, with history navigation and an authenticated page fallback. |
-| `panes` | `rooms`, `table`, `workspace`, `overview`, `schedules`, `conversations`, `notes` | Ordered subset of those panes plus `skills` and `connectors`. `schedules`, `table` and `workspace` need `rooms`, and `workspace` needs a place to show (below). Disabled panes answer 404. `skills` and `connectors` require their feature ports at setup. An explicit list is kept as written, so a host that listed its panes before 0.23 adds `rooms`, `table` and `schedules` by hand, and one that listed them before 0.24 adds `workspace`. |
+| `admission` | `owners` | `owners` lets in only people who hold the owner role; `access` lets in everyone `IDENTITY` admits on the surface. See [Members and the gate](#members-and-the-gate). |
+| `modes` | on | `false` leaves out the yolo and long-running switches: none is shown or set, and `PUT api/rooms/<key>/mode` answers 404. |
+| `panes` | `rooms`, `table`, `workspace`, `overview`, `schedules`, `conversations`, `notes` | Ordered subset of those panes plus `skills` and `connectors`. `schedules`, `table` and `workspace` need `rooms`, and `workspace` needs a place to show (below). With `admission: "access"` the default adds `profile`, and `{ owner, admin?, member }` chooses per tier. Disabled panes answer 404. `skills` and `connectors` require their feature ports at setup. An explicit list is kept as written, so a host that listed its panes before 0.23 adds `rooms`, `table` and `schedules` by hand, and one that listed them before 0.24 adds `workspace`. |
 | `workspace` | the agents' directories | What the [files pane](#the-files-pane) shows: `workspace.roots` adds places, each with an `id` (`workspace.roots.id`, a lower-case word other than `agents` and `scratch`), a `label` (`workspace.roots.label`), an absolute `dir` (`workspace.roots.dir`) and `writable` (`workspace.roots.writable`, false unless set), and `workspace.agents` / `workspace.scratch` set to `false` leave the agents' working directory or scratch directory out. A `dir` that is or contains `dataDir` stops the start. |
 | `surface` | `app` | The key prefix of the app's rooms, a lower-case word that is not `discord`. Rooms keep their conversations under it, so changing it starts every room over. |
 | `cardGraceSeconds` | `120` | How long a turn waits on an approval or question card before it goes on without the answer, above 0 and at most 3600. The card stays open for a day. |
 | `uploadMaxBytes` | `104857600` (100 MiB) | The most bytes of one file a person may upload, from 1 to 4 GiB; the agent takes files up to it too. It raises the listener's request body limit. See [Uploads](#uploads). |
+| `uploads` | `{ keepDays: 30 }` | `uploads.keepDays`: how many days a stored file of the app's agent rooms is kept, a whole number from 1 to 3650. A host kind's own `retention.fileDays` decides for its rooms. |
 | `push` | on, with an `https` origin | Web Push; its keys are in the table below, and [Notifications](#notifications) describes the whole. |
 | `icons` | the package's own | `{ dir }`: a directory of the five install icons, see [Install on a device](#install-on-a-device). |
 | `appearance` | `{ look: "modern" }` | `{ look }`: `modern` or `camelot`. The page's default look and the manifest's splash colors; the owner can switch it in the app. |
@@ -589,19 +680,31 @@ Every option is checked when the plugin is created, so a bad setting stops the h
 | `presentation` | English | `{ locale, messages }`: locale controls dates and document language, and `zh-TW` also selects the [built-in Traditional Chinese wording](#presentation-and-built-in-zh-tw); English source strings are dictionary keys for labels, descriptions, confirmations, and API errors. |
 | `features` | none | Trusted host integrations, or a factory receiving public plugin setup context; see [Host feature ports](#host-feature-ports). |
 | `relayNotes` | the remote MCP note | Text that an outside agent's relayed message begins with, taken off before the owner's words are shown. Set it to the same value as the `relayNote` of [pi-roundtable-mcp][mcp] when you changed that one. |
-| `exclude` | none | A function from a channel key to `true` for conversations the console must neither list nor read, such as the channels of another plugin that keeps its own sessions in the same directory. |
+| `exclude` | none | A function from a channel key (and the registry's record of the conversation, when there is one) to `true` for conversations the console must neither list nor read, such as the channels of another plugin that keeps its own sessions in the same directory. |
 | `assetDir` | the package's `dist/` | The built page's directory. Set it only in tests. |
 
 The `auth` keys:
 
 | Key | Default | What it does |
 |---|---|---|
-| `auth.mode` | none, required | `none`, `password` or `verifier`. |
+| `auth.mode` | none, required | `none`, `password`, `verifier` or `oidc`. |
 | `auth.trustNetwork` | `false` | `none` only: allows a TCP listener that reaches beyond this machine, when a network in front of it keeps everyone else out. |
 | `auth.passwordEnv` | `ROUNDTABLE_WEB_PASSWORD` | `password` only: the environment variable that holds the password, which must be set and at least 12 characters. |
 | `auth.sessionDays` | `30` | `password` only: how long a login lasts, 1 to 365 days. |
 | `auth.principal` | the primary owner | `none` and `password`: the owner's principal id the session speaks for. |
 | `auth.verifier` | none | `verifier` only: the request verifier, as the `verifier` option. |
+| `auth.issuer` | none, required | `oidc` only: the provider's exact `iss`, an `https` URL. |
+| `auth.discoveryUrl` | `<issuer>/.well-known/openid-configuration` | `oidc` only: where the provider's endpoints are read at start; the start fails if they cannot be. |
+| `auth.clientId` | none, required | `oidc` only: the client id registered with the provider; the redirect URI is `<origin><mountPath>/auth/callback`. |
+| `auth.clientSecretEnv` | none | `oidc` only: the environment variable that holds the client secret; set means a confidential client, left out a public client with PKCE. |
+| `auth.scopes` | `openid`, `profile` | `oidc` only. `offline_access` is refused: the app keeps no refresh token. |
+| `auth.subjectClaim` | `sub` | `oidc` only: the claim that names the person (Entra: `oid`). |
+| `auth.nameClaim` | `name`, then `preferred_username` | `oidc` only: the claim for their name. |
+| `auth.rolesClaim` | `roles` | `oidc` only: the claim whose values become `app:role:<name>`; `false` reads none. |
+| `auth.check` | none | `oidc` only: a function from the token's claims to whether the token is acceptable at all. |
+| `auth.endSession` | `false` | `oidc` only: whether Log out also signs out at the provider. |
+| `auth.reauthHours` | never | `oidc` only: ask the provider again after this many hours of one session. |
+| `auth.storeClaims` | none | `oidc` only: `id_token` claims kept with the session. |
 
 The `push` keys:
 
@@ -610,7 +713,19 @@ The `push` keys:
 | `push.preview` | `true` | Whether a notification shows the first 120 characters of the message. With `false` it says only that something waits, and where. |
 | `push.quietHours` | `{ start: "23:00", end: "08:00" }` | The hours when an agent's post and a notice are not pushed, as two different `HH:MM` times on the console's time zone; an `end` before the `start` crosses midnight. Cards are always pushed. `false` turns quiet hours off. |
 | `push.endpointHosts` | none | Push services to post to besides the browsers' own (Google, Mozilla, Apple, Microsoft), as host names; a leading `*.` allows every subdomain. Endpoints must still be `https`. |
+| `push.tiers` | `["owner"]` | The tiers whose people may subscribe and receive push. |
 | `push.subject` | `origin`, when it is `https` | The contact a push service may use about this server (the VAPID `sub`): a `mailto:` or `https:` URL. With an `http` origin push stays off until it is set. |
+| `push.sender` | `"internal"` | Who signs and sends a push. `"internal"`: this process, with its own VAPID key. `{ external: { publicKey, subscribePath? } }`: a sender process you run holds the key, and this app never does; `publicKey` (base64url) is what browsers subscribe against, and `subscribePath` (starting with `/`) is where the sender serves the subscription routes, when it does. See [An external push sender](#an-external-push-sender). |
+| `push.content` | `"full"` internal, `"none"` external | What leaves the app for a push: `"full"` is a title and a preview, `"none"` is the kind, a tag and a count only (the sender words it). A host room never previews. |
+| `push.transports` | none | Names of the transports besides `web-push` that the sender process carries, such as `slack`. A notice's `via` may name only these and `web-push`; any other name is a `ConfigError` when the notice is raised. The app loads no transport itself. |
+
+The `onboarding` keys (what a person owes before the app opens, see [The gate](#the-gate)):
+
+| Key | Default | What it does |
+|---|---|---|
+| `onboarding.links` | none | Maps a provider name to `"required"` (gates the app until the account is linked) or `"nudge"` (only asks). Each provider needs a `LinkProver` registered through `WEB_APP`; the person links it on their profile page. A prover's `requires` decides the order. |
+| `onboarding.push` | `"off"` | `"required"` or `"nudge"` asks the person to turn push on for a device and receive a test notification; `"off"` leaves it out. |
+| `onboarding.pushWaiver` | `false` | Lets a person skip a `"required"` push step, which then counts as done and is recorded as waived. |
 
 The bad settings that stop the host at startup are: no `auth` or `verifier`, both of them, an unknown `auth.mode`, a password shorter than 12 characters, `none` on a listener that reaches beyond the machine, an `origin` with a path, a `mountPath` of `/` or with `..` in it, an unknown or repeated pane, `schedules`, `table` or `workspace` without `rooms`, a `workspace` pane with no place to show, a `workspace.roots` entry that is malformed, reuses an id, or is or contains `dataDir`, a `surface` that is not a lower-case word or is `discord`, an empty `ownerId`, a `uploadMaxBytes` out of range, and a `push.subject` that is neither a `mailto:` address nor an `https:` URL, and a `push.quietHours` that is neither `false` nor two different `HH:MM` times.
 
@@ -619,7 +734,7 @@ The host refuses to start with a message naming the missing service when one of
 
 ## The console's panes
 
-The page has nine panes; `panes` chooses which ones a host serves.
+The page has ten panes; `panes` chooses which ones a host serves.
 Rooms and Schedules belong to the [owner app](#the-owner-app), and the Round table to [its own section](#the-round-table); the rest are the console that came first, which reads what the host already stores: the conversation files under the data directory, the memory addon, and the agent team.
 
 | Pane | What it shows |
@@ -632,6 +747,7 @@ Rooms and Schedules belong to the [owner app](#the-owner-app), and the Round tab
 | Skills | The full host catalog, source, groups and carriers; each available skill opens its ordered frontmatter and Markdown body, and an owner edits an agent-written skill or makes a new one. |
 | Connectors | Upstream gateway enabled/reachable/tool status, virtual-server tool lists, and the agents or profiles that use them; an optional administration link. |
 | Files | The agents' workspace: a tree, highlighted files, an editor with conflict-checked saves, and a restorable trash (see [The files pane](#the-files-pane)). Needs `rooms` and a place to show. |
+| Profile | Who the person is signed in as, their tier, and Log out; it stays open while a step is owed. Part of the [members' app](#members-and-the-gate). |
 | Round table | Every active agent at a podium of one council hall, the coordinator first, each in the state its room is in; a seat turns the camera to its agent and opens a dialogue box on the agent's room (see [The round table](#the-round-table)). Needs `rooms`. |
 
 Opening a conversation shows its **transcript**: the user's and the assistant's messages, the tools the assistant called with a short preview of their arguments, and each tool's result (collapsed).
@@ -706,11 +822,32 @@ webConsole({
 
 When serving Skills and Connectors, provide those hooks as well; a missing port fails startup rather than silently dropping a pane.
 
+## Host rooms, pages and cards
+
+A host plugin that is not an agent can have rooms of its own in the app: a support inbox with one room per email thread, say. It lists `WEB_APP` in its `requires` and registers from `setup`:
+
+```ts
+const app = context.service(WEB_APP);
+app.registerRoomKind({ kind: "inbox", label: "Support inbox", list, access, header, send, act, buttons, retention });
+app.registerPage({ id: "mailboxes", label: "Mailboxes", place: "settings", visible, view, act });
+```
+
+A room's key is `<surface>:<kind>.<id>`, with an id of 8 to 64 letters, digits, `-` or `_`. The kind name is lower case and none of `agent`, `group`, `thread` or `home`. Everything is checked when the web service starts.
+
+- **Access is the host's, asked every time.** `access(viewer, id)` answers `{ read, send, act }` for each read, frame, send, card answer, upload and file; `undefined` makes the room, its messages and its files a `404` for that person. `send` is `note` (a message for the room's people), `turn` (a message the room's agent answers), both, or neither; `act` lets them press buttons and run actions. `list(viewer, { filter, cursor })` returns the rooms the person may open, and `undefined` hides the kind. `changed(room)` and `accessChanged(principalId)` on `app.rooms` tell the app a header, a list or a person's access may differ.
+- **Who wrote what.** A host posts with `app.rooms.post(room, { author: { kind, name, label?, principalId?, picture? }, text, files?, reference? })`. The author kinds are `external` (someone outside, shown with the host's label such as "Customer"; plain text with links), `member`, `assistant` (an agent partner; Markdown, raw HTML shown as text) and `notice` (a line of the room's own, such as "Assigned to Mel"; Markdown). `reference` is the host's own id, unique per room, and `byReference` finds it again; `edit` and `remove` change a message. An import may give an earlier `at`, kept within retention.
+- **Cards.** `app.rooms.card(room, { title, body, tone?, state?, links?, buttons? })` puts a card in the room; `updateCard` replaces it by id. A button calls the kind's `act(viewer, id, { action, card }, input)`; a button may carry a `form` (text, textarea, url, select with `initial` and `search`, multiselect), and its input is checked against the form on the server before `act` runs. `act` answers `{ ok: true, notice?, open?, url? }` or `{ ok: false, error, field? }`; `open` is a room (with a message) or a page (with a query). Buttons show only while the card's `state` is `open`, and `buttons(viewer, id, card)` may narrow which ones a person sees. A card's `links` are `https` or a path of this origin. Approval and question cards of the room's agent follow the agent's own prompt scope, never `access` or `buttons`.
+- **Links and pictures.** `app.rooms.link(room, messageId?)` gives the same-origin address that opens a room and highlights a message (`<mount>/room/<key>?message=<id>` with `routing: "path"`, `<mount>/#/room/<key>?message=<id>` with hash routing). `![alt](file:<id>)` in a card, a page or an assistant or notice message shows an image the host saved with `saveFile` (rooms) or `app.pages.saveAsset` (pages): PNG, JPEG or WebP whose bytes prove it, served only to those who may see the room or page. Anything else is shown as text.
+- **Pages.** A page is at `<mount>/p/<id>` and is built from sections: Markdown, a list of rows (each may open a link and carry buttons), a form with an action, and a card. `place` is `main` (the navigation), `settings` (the Settings pane) or `hidden`. `visible(viewer)` is asked on every fetch and action; a page that is not visible is a `404`. `app.pages.changed(id?)` sends the viewers who may see it a `page_changed` frame and their page fetches the view again.
+- **Retention.** A kind's `retention: { textDays, fileDays }` deletes its messages, author names, host cards and files that old, counted from each message's `at`. Without it nothing is deleted.
+- **Read marks.** The page tells the app how far a person has read (the newest message in view, at most once a second, never while the page is hidden). The app keeps one cursor per person and room, for host rooms and agent rooms alike (among owners), and computes each room's `unread` from it; the list and the drawer show the count, an attention dot where the host sets `attention`, and the room opens with a "new messages" divider where the person stopped. Under each message the people who have read up to it are named: "Seen by 2", with their pictures; a person's own mark is not shown to them.
+- **The page is lazy.** The room, the lists and the pages load as separate chunks when first opened, so the app's first load is the same size as before.
+
 ## App protocol
 
 The `rooms` pane's page and any client of your own talk to the host in this protocol. A page opens one WebSocket at `<mount>/api/socket` with the subprotocol `roundtable.app.v1`. The upgrade passes the same authenticator as every request and must come from the console's own origin; the socket closes with `4401` when the credential lapses.
 
-- Page to server: `hello {visible, focus?}`, `visibility`, `focus {room?}`, `send {id, room, text, uploads?}`, `stop {room}`, `approval {prompt, approved}`, `answer {prompt, answer}`, `answers {prompt, answers, note?}`, `cancel {prompt}`.
+- Page to server: `hello {visible, focus?}`, `visibility`, `focus {room?}`, `send {id, room, text, uploads?}`, `stop {room}`, `approval {prompt, approved}`, `answer {prompt, answer}`, `answers {prompt, answers, note?}`, `cancel {prompt}`; for a host room also `subscribe {room}`, `unsubscribe {room}`, `act {id, room, action, card?, input?}` and `read {room, upTo}`.
 - Server to page: `ready {protocol, principal, name, uploads: {perMessage, maxBytes}}` (then every open card), `accepted`, `refused {id?, prompt?, code}` (`id` names a refused `send`, `prompt` a refused answer to a card), `message`, `progress` (only for the focused room), `activity {room, typing, stoppable, phase?, agent?, outcome?}` (`phase` is `working` during a tool call and `thinking` otherwise; `agent` names the member speaking in a group round; `outcome` is `done` or `failed` and comes only on the frame where `typing` turns false), `presence {agents: {<name>: {busy}}}` (after `ready` and when it changes; `busy` includes work in Discord channels), `edited` (a stored message changed its text, such as a thread's start line once the thread exists), `prompt`, `prompt_closed {prompt, outcome, note?, by?, answer?, closedAt?}`, `mode`, `auto_approved`, `changed`.
 - REST under `<mount>/api/`: `session`, `rooms`, `rooms/<key>/messages?before=&limit=` (`{messages, more, cards}`: the cards of the room that opened within the page's span, from the first message's time on, or from the beginning when `more` is false, and before the first message of the next page), `PUT rooms/<key>/mode`, `PUT rooms/<key>/mute` (body `{muted: boolean}`; the room's push is off for every owner while true; a waiting card still pushes), `PUT rooms/<key>/pin` (body `{pinned: boolean, before?: key | null}`) and `PUT rooms/<key>/folder` (body `{folder: id | null, before?: key | null}`; `before` is the room it goes before, none or an unknown room for the end; `400` for Home and a dispatch thread, `404` for an unknown room or folder), `POST folders` (body `{name}`, `201`), `PATCH folders/<id>` (body `{name?, before?: id | null}`), `DELETE folders/<id>`, `PUT folders/<id>/mute` (body `{muted: boolean}`; answers `{muted, rooms}`), all of which answer with the whole layout `{pins, folders}` (except the mute), and `GET rooms` answering `{rooms, pins, folders}`, `POST rooms/<key>/start-over`, `POST uploads`, `DELETE uploads/<id>`, `files/<id>`, `schedules` (`GET`, and `DELETE schedules/<id>`), `agents/<name>` (`GET`, `PATCH`), `GET agents/<name>/prompt-history` (`{versions}`, newest first), `GET prompts` (`{documents}`), `GET` and `PUT prompts/<id>` (body `{text, base}`; `409 {error, conflict, current}` when `base` is not the text in force), `POST prompts/<id>/revert` (body `{base}`; the same `409`), `GET prompts/<id>/history`, `GET` and `PUT skill-docs/<name>` (body `{text, baseHash}`; `409` with `current`), `POST skill-docs` (body `{text}`; `201`), `GET skill-docs/<name>/history`, `PUT agents/<name>/character` (body `{character}`, at most 4 KiB; `400 {error, field}` for a look that is not a character), `POST agents` (body `{name, displayName, prompt, model?, thinking?, task?, character?, skills?}`; `201` with the profile; `400` for what the agent server refuses, `{error, field}` for a look), `POST agents/<name>/archive`, `POST agents/<name>/restore` (the profile), `DELETE agents/<name>` (an archived agent only; `400` for an active one), `GET` and `PUT agents/<name>/skills` (`{skills: [{name, description?, source, builtin, carried, missing?}]}`; the body of `PUT` is `{add?, remove?}`, one change that an unknown or built-in name refuses whole; `404` when the host has no skills), `POST groups` (body `{name, displayName, members, host?}`; `201`), `GET`, `PATCH` (`{displayName?, members?, host?}`) and `DELETE groups/<name>`, `POST groups/<name>/archive` and `POST groups/<name>/restore`, `GET archive` (`{entries}`: the archived agents and groups), `models`, `workspace` (the [files pane](#the-files-pane)'s calls), and for push `GET push/key`, `GET`, `POST` and `DELETE push/subscriptions` and `DELETE push/subscriptions/<id>`. The agents' pictures are at `<mount>/avatars/<hash>.png`.
 - Beside the API: `<mount>/manifest.webmanifest`, `<mount>/sw.js`, `<mount>/icons/<name>.png`, `<mount>/theme-init.js`, and in password mode `<mount>/login`, `POST <mount>/auth/login` and `POST <mount>/auth/logout`.

package/dist/account-zk4efb87.css

@@ -0,0 +1,102 @@
+/* The account pages (notices, onboarding, profile) and the bell. Loaded with the first of them, not with the first page. */
+.bell {
+	position: relative;
+}
+.bell-count {
+	position: absolute;
+	top: 0.25rem;
+	right: 0.15rem;
+	min-width: 1.05rem;
+	padding: 0 0.28rem;
+	border-radius: var(--radius-full);
+	background: var(--warn);
+	color: var(--bg);
+	font-size: 0.65rem;
+	font-weight: var(--weight-bold);
+	line-height: 1.05rem;
+	text-align: center;
+}
+.notices {
+	list-style: none;
+	margin: 0;
+	padding: 0;
+}
+.notice[data-urgent] {
+	border-color: var(--warn);
+}
+.steps {
+	margin: 0;
+	padding: 0;
+	list-style: none;
+	display: flex;
+	flex-direction: column;
+	gap: var(--space-3);
+}
+.steps > li {
+	display: flex;
+	flex-direction: column;
+	align-items: flex-start;
+	gap: var(--space-2);
+	padding-left: var(--space-3);
+	border-left: 3px solid var(--border);
+}
+.steps > li[data-done] {
+	border-left-color: var(--accent);
+}
+.who {
+	display: flex;
+	align-items: center;
+	gap: var(--space-3);
+}
+.who-picture {
+	width: 3.5rem;
+	height: 3.5rem;
+	border-radius: var(--radius-full);
+	object-fit: cover;
+	background: var(--surface-2);
+}
+.who-initial {
+	display: inline-flex;
+	align-items: center;
+	justify-content: center;
+	width: 3.5rem;
+	height: 3.5rem;
+	border-radius: var(--radius-full);
+	background: var(--accent-soft);
+	color: var(--accent);
+	font-size: 1.4rem;
+	font-weight: var(--weight-bold);
+}
+.link-code {
+	display: block;
+	width: fit-content;
+	font-family: var(--mono, ui-monospace, monospace);
+	font-size: 1.6rem;
+	letter-spacing: 0.15em;
+	padding: var(--space-2) var(--space-3);
+	border: 1px dashed var(--border);
+	border-radius: var(--radius);
+	user-select: all;
+}
+.choice {
+	display: flex;
+	flex-direction: column;
+	gap: var(--space-2);
+	border: 0;
+	padding: 0;
+	margin: 0;
+}
+.choice label {
+	display: flex;
+	flex-direction: row;
+	justify-content: flex-start;
+	align-items: center;
+	gap: var(--space-2);
+	min-height: var(--touch);
+}
+.quiet-row {
+	display: flex;
+	flex-wrap: wrap;
+	gap: var(--space-3);
+	align-items: center;
+}

package/dist/chunk-account-hw49gd0d.js

@@ -0,0 +1 @@
+import{O,C,S,e,v}from"./chunk-index-v23m38p6.js";var a={profile:S(()=>(O("ypxdbsk1"),import("./chunk-profile-ypxdbsk1.js")).then((o)=>({default:o.ProfilePage}))),notices:S(()=>(O("fa3g7qze"),import("./chunk-notices-fa3g7qze.js")).then((o)=>({default:o.NoticesPage}))),onboarding:S(()=>(O("34v3nr17"),import("./chunk-onboarding-34v3nr17.js")).then((o)=>({default:o.OnboardingPage})))};function n({pane:o}){let t=a[o];return t?e(C,{fallback:e(v,{}),children:e(t,{})}):null}export{n as default};

package/dist/chunk-action-menu-rm5cyqkj.js

@@ -0,0 +1 @@
+import{a,ft,o,r,p,e,n,s,Kt,jr}from"./chunk-index-v23m38p6.js";import{I}from"./chunk-index-awx6nnta.js";var k=()=>typeof matchMedia==="function"&&matchMedia("(max-width: 719px)").matches,x={rtMenu:!0},g=()=>Boolean(window.history.state?.rtMenu),E=8,y=(t)=>t?.isConnected?t:null;function b(t){return t.items.map((u)=>n("button",{type:"button",role:u.checked===void 0?"menuitem":"menuitemcheckbox",...u.checked===void 0?{}:{"aria-checked":u.checked},className:"menu-item menu-link","data-tone":u.tone,onClick:()=>t.onChoose(u),children:[u.icon?e("span",{className:"menu-icon","data-tone":u.tone,children:e(s,{name:u.icon,size:18})}):null,e("span",{className:"menu-text",children:e("strong",{children:u.label})}),u.checked?e(s,{name:"check",size:18,className:"menu-check"}):null]},u.id))}function H({menu:t}){let u=o(void 0);if(t)u.current=t;let c=u.current,m=o(!1),v=o(void 0),h=t?.serial;return a(()=>{if(h===void 0)return;return window.history.pushState(x,"",window.location.href),m.current=!0,()=>{if(m.current)m.current=!1,window.history.back()}},[h]),a(()=>{let f=()=>{if(!m.current||g())return;m.current=!1,Kt();let M=v.current;v.current=void 0,M?.()};return window.addEventListener("popstate",f),()=>window.removeEventListener("popstate",f)},[]),e(I,{open:t!==void 0,title:c?.title??"",onClose:Kt,restoreFocus:()=>y(c?.source??null),children:c?e("div",{className:"menu action-items",role:"menu","aria-label":c.title,children:e(b,{items:c.items,onChoose:(f)=>{if(!m.current){Kt(),f.run();return}v.current=f.run,window.history.back()}})}):null})}function T({menu:t}){let u=o(null),[c,m]=r(t.at),{source:v}=t,h=(i)=>{y(v)?.focus(),Kt(),i?.()},f=o(h);f.current=h,ft(()=>{let i=u.current;if(!i)return;let d=i.getBoundingClientRect();m({x:Math.max(E,Math.min(t.at.x,window.innerWidth-d.width-E)),y:Math.max(E,Math.min(t.at.y,window.innerHeight-d.height-E))}),i.querySelector('[role^="menuitem"]')?.focus()},[t.serial]),a(()=>{let i=(l)=>{if(l.target instanceof Node&&u.current?.contains(l.target))return;Kt()},d=()=>Kt();return document.addEventListener("pointerdown",i,!0),document.addEventListener("wheel",i,{capture:!0,passive:!0}),document.addEventListener("touchmove",i,{capture:!0,passive:!0}),window.addEventListener("resize",d),()=>{document.removeEventListener("pointerdown",i,!0),document.removeEventListener("wheel",i,!0),document.removeEventListener("touchmove",i,!0),window.removeEventListener("resize",d)}},[]);let M=(i)=>{let d=[...u.current?.querySelectorAll('[role^="menuitem"]')??[]],l=d.indexOf(document.activeElement),w=(L)=>{i.preventDefault(),d[(L+d.length)%d.length]?.focus()};switch(i.key){case"Escape":i.preventDefault(),i.stopPropagation(),f.current();return;case"ArrowDown":return w(l+1);case"ArrowUp":return w(l<0?-1:l-1);case"Tab":return w(i.shiftKey?l<0?-1:l-1:l+1);case"Home":return w(0);case"End":return w(-1)}};return e("div",{ref:u,className:"action-popover",role:"menu","aria-label":t.title,tabIndex:-1,style:{left:`${c.x}px`,top:`${c.y}px`},onKeyDown:M,children:e(b,{items:t.items,onChoose:(i)=>h(i.run)})})}function O(){let t=jr(),u=o(void 0);if(t&&u.current?.serial!==t.serial)u.current={serial:t.serial,sheet:k()};let c=Boolean(t&&u.current?.sheet);return n(p,{children:[e(H,{menu:c?t:void 0}),t&&!c?e(T,{menu:t},t.serial):null]})}export{O as ActionMenuHost};

package/dist/{chunk-agent-0pm9p3nn.js → chunk-agent-b017vswv.js}

@@ -1 +1 @@
-import{s,e,H,d,x,De}from"./chunk-index-31wh5twj.js";function g({name:o}){let i=d((t)=>t.listed),r=d((t)=>Object.values(t.rooms).find((m)=>m.view?.kind==="agent"&&m.view.name===o)?.view?.key,o);return s(()=>{if(r)H("room",r,{replace:!0}),De(o);else if(i)H("rooms",void 0,{replace:!0})},[r,i,o]),e("div",{className:"page",children:e(x,{})})}export{g as AgentPage};
+import{a,e,K,d,v,Fe}from"./chunk-index-v23m38p6.js";function g({name:o}){let i=d((t)=>t.listed),r=d((t)=>Object.values(t.rooms).find((m)=>m.view?.kind==="agent"&&m.view.name===o)?.view?.key,o);return a(()=>{if(r)K("room",r,{replace:!0}),Fe(o);else if(i)K("rooms",void 0,{replace:!0})},[r,i,o]),e("div",{className:"page",children:e(v,{})})}export{g as AgentPage};

package/dist/chunk-arranged-rooms-q5v3dm1r.js

@@ -0,0 +1 @@
+import{O,C,S,ee,A,o,t,p,e,n,s,d,_,k,ge,Lt,en,ne,yi,Gn,Wi,vn,Zn,Yi}from"./chunk-index-v23m38p6.js";import{Te}from"./chunk-index-nwqk447w.js";import{Cn,An,$n,Rt}from"./chunk-index-pcfhpm8v.js";import{En}from"./chunk-index-cq1e9xdz.js";import{It,_t}from"./chunk-index-459drsft.js";Cn();var M=S(()=>(O("b97xk12b"),import("./chunk-folder-list-b97xk12b.js")).then((a)=>({default:a.FolderList}))),Z=ee(function(l){let{view:r}=l,h=Rt(()=>Lt(r.key),r.home?void 0:An(r.key));return e(Wi,{...l,press:h,item:{...r.home?{}:{"data-drop-item":"","data-key":r.key},...l.arranging?{"data-arranging":""}:{}},after:l.arranging?e("button",{type:"button",className:"icon-button row-more","aria-haspopup":"menu","aria-label":t("Room menu"),onClick:(c)=>{let u=c.currentTarget;Lt(r.key).then((i)=>{if(!i)return;let v=u.getBoundingClientRect();ge({...i,at:{x:v.left,y:v.bottom},via:"key",source:u})},()=>{return})},children:e(s,{name:"more",size:18})}):null})});function P(a){let{now:l}=ne(),{timeZone:r}=k(),h=vn(a.rooms);return e("ul",{className:"room-list",children:h.map(({key:c,...u})=>{let i=a.threads[c];return e(Z,{...u,active:c===a.active,now:l,timeZone:r,arranging:a.arranging,...i?{threads:e(Zn,{open:i.open,closed:i.closed,active:a.active})}:{}},c)})})}function b(a){let r=vn(a.rooms).length===0;if(r&&a.zone?.kind!=="pinned")return null;return n("section",{className:"stack",...r?{"data-empty":""}:{},...a.zone?{"data-drop-zone":a.zone.kind,"data-zone-id":a.zone.id}:{},children:[e("h2",{className:"section-title",children:a.title}),r?null:e(P,{rooms:a.rooms,threads:a.threads,active:a.active,arranging:a.arranging})]})}function re(a){let l=Boolean(k().kinds?.length),r=d((m)=>JSON.stringify({listed:m.listed,...It(m,(K)=>_t(m,K))})),h=$n(),c=o(r);if(!h)c.current=r;let u=c.current,{listed:i,...v}=A(()=>JSON.parse(u),[u]),{home:R,pinned:w,folders:y,restAgents:T,restGroups:D,rest:z,threads:L,orphans:g}=v,N=yi(),F=R.length+w.length+z.length===0&&y.every((m)=>m.rooms.length===0)&&g.open.length+g.closed.length===0,f={threads:L,active:a.active,arranging:N};return n("div",{className:"page","data-column":a.active?"":void 0,"data-drop-root":"",children:[n("header",{className:"page-head",children:[e("h1",{children:t("Rooms")}),n("div",{className:"actions",children:[n("button",{type:"button",className:"header-button search-button",onClick:a.onSearch,children:[e(s,{name:"search",size:16}),e("span",{children:t("Find a room")}),e("kbd",{children:"⌘K"})]}),i?e("button",{type:"button",className:"header-button icon-button","aria-haspopup":"menu","aria-label":t("Folders and order"),onClick:(m)=>En(m.currentTarget),children:e(s,{name:"more",size:18})}):null,e("button",{type:"button",className:"header-button icon-button","aria-label":t("Add"),"aria-haspopup":"menu",onClick:(m)=>en(m.currentTarget),children:e(s,{name:"plus"})})]})]}),N?n("div",{className:"arrange-bar",children:[n("button",{type:"button",className:"secondary",onClick:()=>Te({kind:"new"}),children:[e(s,{name:"plus",size:16}),e("span",{children:t("Add a folder")})]}),e("button",{type:"button",onClick:()=>Gn(!1),children:t("Done")})]}):null,i&&F&&!l?e(_,{children:t("No rooms yet. Rooms appear when the team has an agent.")}):null,!i?n("div",{className:"stack","aria-busy":"true",children:[e("div",{className:"skeleton"}),e("div",{className:"skeleton"}),e("div",{className:"skeleton"})]}):null,e(b,{title:t("Home"),rooms:R,...f}),e(b,{title:t("Pinned"),rooms:w,zone:{kind:"pinned",id:"pinned"},...f}),y.length>0?e("div",{className:"stack folder-list","data-folder-list":"",children:e(C,{fallback:e("div",{className:"skeleton","aria-busy":"true"}),children:e(M,{folders:y,active:a.active,listed:i,rooms:(m)=>e(P,{rooms:m,threads:L,active:a.active,arranging:N})})})}):null,y.length>0?e(b,{title:t("Ungrouped"),rooms:z,zone:{kind:"rest",id:"rest"},...f}):n(p,{children:[e(b,{title:t("Agents"),rooms:T,zone:{kind:"rest",id:"rest-agents"},...f}),e(b,{title:t("Groups"),rooms:D,zone:{kind:"rest",id:"rest-groups"},...f})]}),g.open.length+g.closed.length>0?n("section",{className:"stack",children:[e("h2",{className:"section-title",children:t("Dispatch threads")}),e(Zn,{open:g.open,closed:g.closed,active:a.active})]}):null,e(Yi,{active:a.active})]})}export{re as ArrangedRoomsPage};

package/dist/chunk-character-creator-5dxcvd16.js

@@ -0,0 +1 @@
+import{Le,Xt,B,Wn,sn}from"./chunk-index-66nskrdj.js";import{ee,Ii,a,D,A,o,r,t,c,p,e,n,Dn,oe,y,u,m,tn,de,ze,ke}from"./chunk-index-v23m38p6.js";import{H}from"./chunk-index-e5sd30xy.js";import{I}from"./chunk-index-awx6nnta.js";var fe={"hat.none":"No hat","hat.goggcap":"Leather cap","hat.tallcap":"Burgundian felt cap","hat.softcap":"Soft cap","hat.hardhat":"Iron skullcap","hat.fcap":"Hunter's cap","hat.winghelm":"Winged helm","hat.helm":"Helm","hat.mortar":"Biretta","hat.beret":"Chaperon","hat.goggles":"Pointed cap","hat.tricorn":"Pilgrim hat","hat.sailor":"Straw hat","hat.kettle":"Kettle hat","hat.cavalier":"Feathered hat","hat.toque":"Linen cook's cap","hair.none":"No hair","beard.none":"No beard","accessory.none":"No accessory","prop.beads":"Prayer beads","prop.marotte":"Marotte","prop.map":"Chart","prop.flask":"Alchemist's phial","prop.telescope":"Astrolabe","prop.wrench":"Dividers","outfit.surplice":"Surplice","outfit.overalls":"Work jerkin","outfit.armor":"Mail hauberk","outfit.apron":"Smith's apron","outfit.chef":"Cook's tunic","outfit.coat":"Doublet","outfit.vest":"Pourpoint","outfit.sailor":"Mariner's tunic","hair.bob":"Bob","hair.bun":"Bun","hair.ponytail":"Ponytail"},X=(i)=>i.charAt(0).toUpperCase()+i.slice(1);function N(i,l){let h=`character.${i}.${l}`,b=t(h);if(b!==h)return b;if(i==="class")return B.classes[l]?.label??X(l);return fe[`${i}.${l}`]??X(l)}function Y(i){let l=`character.jobs.${i}`,h=t(l);return h!==l?h:B.classes[i]?.jobs??""}var W=[{field:"hat",title:c("Hat"),ids:B.hats},{field:"outfit",title:c("Outfit"),ids:B.outfits},{field:"prop",title:c("Prop"),ids:B.props},{field:"hair",title:c("Hair"),ids:B.hair},{field:"beard",title:c("Beard"),ids:["none",...B.beards]},{field:"accessory",title:c("Accessory"),ids:["none",...B.accessories]}],me=new Set(["class","colors","palette","build","skin","hairColor",...W.map((i)=>i.field)]),re=Object.keys(B.palettes),Z={idle:c("Idle"),thinking:c("Thinking"),working:c("Working"),waiting:c("Waiting for you"),done:c("Done"),error:c("Error"),sleepy:c("Sleepy")},he={slim:c("Slim"),regular:c("Regular"),stout:c("Stout")};function U(i){return{class:i.class,outfit:i.outfit,hat:i.hat,prop:i.prop,hair:i.hair,beard:i.beard,accessory:i.accessory,build:i.build,skin:i.skin,hairColor:i.hairColor,colors:{...i.colors}}}var te=(i)=>JSON.stringify(U(i)),C=(i)=>i[Math.floor(Math.random()*i.length)];function be(){return{class:C(Le),outfit:C(B.outfits),hat:C(B.hats),prop:C(B.props),hair:C(B.hair),beard:C(["none",...B.beards]),accessory:C(["none",...B.accessories]),build:C(["slim","regular","stout"]),skin:C([0,1,2,3,4,5]),hairColor:C(B.hairColors),palette:C(re)}}var ie=ee(function(l){return n("button",{type:"button",className:"creator-tile","aria-pressed":l.pressed,title:l.hint?`${l.label} — ${l.hint}`:l.label,onClick:l.onPick,...l.data,children:[e(de,{spec:l.spec,size:l.size,live:!1}),e("span",{children:l.label})]})});function ge(i,l,h){let b=JSON.stringify({...i,[l]:0});return A(()=>h.map((d)=>({...i,[l]:d})),[b,l,h])}function pe(){let i=o(null),[l,h]=r();return a(()=>{let b=i.current;if(!b)return;let d=()=>{let S=b.scrollLeft>1,L=b.scrollLeft+b.clientWidth<b.scrollWidth-1;h(S&&L?"both":L?"end":S?"start":void 0)};d(),b.addEventListener("scroll",d,{passive:!0});let g=typeof ResizeObserver>"u"?void 0:new ResizeObserver(d);return g?.observe(b),()=>{b.removeEventListener("scroll",d),g?.disconnect()}},[]),[i,l]}function ye(i){let{part:l}=i,h=ge(i.shown,l.field,l.ids),[b,d]=pe();return e("div",{className:"creator-strip",ref:b,"data-more":d,children:l.ids.map((g,S)=>e(ie,{data:{[`data-${l.field}`]:g},spec:h[S],size:44,label:N(l.field,g),pressed:i.draft[l.field]===g,onPick:()=>i.onPick(g)},g))})}function z(i){return e("button",{type:"button",className:"creator-swatch","aria-pressed":i.pressed,"aria-label":i.label,title:i.label,style:{background:i.background},onClick:i.onPick,...i.data})}function P(i){return n("div",{className:"creator-field","data-field":i.field,children:[i.title?e("h3",{children:i.title}):null,i.children,i.error?e("p",{className:"field-error",role:"alert",children:i.error}):null]})}function Oe(i){let[l,h]=r(i.character),b=Ii(l),[d,g]=r({}),[S,L]=r(!1),[R,ne]=r("idle"),[_,T]=r(),[F,j]=r(),G=ke("(max-width: 719px)"),J=o(null),K=D(),se=ze(l),le=tn(),w=te(l)!==te(i.character);a(()=>h(i.character),[i.character]),a(()=>{if(!w||i.onPick)return;let s=(k)=>k.preventDefault(),f=(k)=>{if(k.button!==0||k.metaKey||k.ctrlKey||k.shiftKey||k.altKey)return;let E=k.target instanceof Element?k.target.closest("a"):null;if(!E||E.target||E.hasAttribute("download"))return;if(J.current?.contains(E))return;k.preventDefault(),k.stopPropagation(),T({kind:"link",anchor:E})},O=Dn((k)=>T({kind:"navigate",proceed:k}));return window.addEventListener("beforeunload",s),document.addEventListener("click",f,!0),()=>{O(),window.removeEventListener("beforeunload",s),document.removeEventListener("click",f,!0)}},[w,i.onPick]);let v=(s)=>{g({}),h((f)=>Wn(s,f))},ce=async()=>{if(i.onPick){i.onPick(U(l),l);return}L(!0),g({});try{let s=await y.setCharacter(i.name,U(l));i.onSaved?.(s),m(t("Saved."))}catch(s){let f=s instanceof oe&&s.field?s.field.split(".")[0]:void 0,O=f&&me.has(f)?f:"*";g({[O]:u(s)})}finally{L(!1)}},ue=async()=>{let s=_;if(h(i.character),g({}),s?.kind==="link")setTimeout(()=>s.anchor.click(),0);else if(s?.kind==="navigate")s.proceed()},V=e(P,{field:"class",title:t("Class"),error:d.class,children:e("div",{className:"creator-grid",children:Le.map((s)=>e(Ce,{id:s,base:b,pressed:l.class===s,onPick:()=>v({class:s,colors:l.colors})},s))})}),q=n(P,{field:"colors",title:t("Colors"),error:d.colors??d.palette,children:[n("fieldset",{className:"creator-swatches",children:[e("legend",{className:"visually-hidden",children:t("Palette")}),re.map((s)=>{let f=B.palettes[s];return e(z,{data:{"data-palette":s},label:N("palette",s),pressed:l.palette===s,background:`linear-gradient(135deg, ${f.primary} 52%, ${f.trim} 52%)`,onPick:()=>v({palette:s})},s)})]}),e("div",{className:"creator-custom",children:["primary","secondary","trim"].map((s)=>n("label",{children:[e("span",{children:s==="primary"?t("Primary (the accent)"):s==="secondary"?t("Secondary"):t("Trim")}),e("input",{type:"color",value:l.colors[s],onChange:(f)=>v({colors:{[s]:f.target.value}})})]},s))})]}),x=W.map((s)=>e(P,{field:s.field,title:t(s.title),error:d[s.field],children:e(ye,{part:s,draft:l,shown:b,onPick:(f)=>v({[s.field]:f})})},s.field)),Q=n(p,{children:[e(P,{field:"build",title:t("Build"),error:d.build,children:n("fieldset",{className:"segmented",children:[e("legend",{className:"visually-hidden",children:t("Build")}),["slim","regular","stout"].map((s)=>n("label",{"data-checked":l.build===s,children:[e("input",{type:"radio",name:`${K}-build`,checked:l.build===s,onChange:()=>v({build:s})}),ae(s)]},s))]})}),e(P,{field:"skin",title:t("Skin tone"),error:d.skin,children:n("fieldset",{className:"creator-swatches",children:[e("legend",{className:"visually-hidden",children:t("Skin tone")}),(le??B.skins).map((s,f)=>e(z,{data:{"data-skin":String(f)},label:t("Skin tone {n}",{n:f+1}),pressed:l.skin===f,background:s,onPick:()=>v({skin:f})},f))]})}),e(P,{field:"hairColor",title:t("Hair color"),error:d.hairColor,children:n("fieldset",{className:"creator-swatches",children:[e("legend",{className:"visually-hidden",children:t("Hair color")}),B.hairColors.map((s,f)=>e(z,{data:{"data-hair-color":s},label:t("Hair color {n}",{n:f+1}),pressed:l.hairColor===s,background:s,onPick:()=>v({hairColor:s})},s)),e("input",{type:"color","aria-label":t("Hair color"),value:l.hairColor,onChange:(s)=>v({hairColor:s.target.value})})]})})]}),M=[{id:"class",title:t("Class"),summary:N("class",l.class),error:d.class,node:V},{id:"colors",title:t("Colors"),summary:l.palette?N("palette",l.palette):l.colors.primary,error:d.colors??d.palette,node:q},...W.map((s,f)=>({id:s.field,title:t(s.title),summary:N(s.field,l[s.field]),error:d[s.field],node:x[f]})),{id:"body",title:t("Body"),summary:ae(l.build),error:d.build??d.skin??d.hairColor,node:Q}];return n("form",{ref:J,className:"creator",style:se,"aria-labelledby":K,onSubmit:(s)=>{if(s.preventDefault(),(w||i.onPick)&&!S)ce()},children:[e("h2",{id:K,className:"visually-hidden",children:t("Character of {name}",{name:i.displayName})}),n("div",{className:"creator-preview",children:[e(de,{spec:l,name:i.name,state:R,size:176,label:t("{name}, {state}",{name:i.displayName,state:t(Z[R])})}),e("button",{type:"button",className:"secondary","data-action":"cycle",onClick:()=>ne((s)=>Xt[(Xt.indexOf(s)+1)%Xt.length]??"idle"),children:t("Preview states")}),e("span",{className:"meta","aria-live":"polite",children:t(Z[R])})]}),n("div",{className:"creator-body",children:[d["*"]?e("p",{className:"field-error",role:"alert","data-field":"*",children:d["*"]}):null,G?e("ul",{className:"creator-sections",children:M.map((s)=>e("li",{children:n("button",{type:"button",className:"creator-section secondary",onClick:()=>j(s.id),children:[e("strong",{children:s.title}),e("span",{className:"meta",children:s.summary}),s.error?e("span",{className:"field-error",role:"alert",children:s.error}):null]})},s.id))}):n(p,{children:[V,q,x,Q]}),n("div",{className:"actions creator-actions",children:[e("button",{type:"button",className:"secondary","data-action":"suggest",onClick:()=>{g({}),h(sn({name:i.name,displayName:i.displayName,prompt:i.prompt}))},children:t("Suggest from role")}),e("button",{type:"button",className:"secondary","data-action":"randomize",onClick:()=>v(be()),children:t("Randomize")}),e("button",{type:"button",className:"secondary","data-action":"cancel",onClick:()=>{if(i.onCancel)i.onCancel();else if(w)T({kind:"cancel"})},children:t("Cancel")}),e("button",{type:"submit","data-action":"save",disabled:!w&&!i.onPick||S,children:S?t("Saving…"):i.onPick?t("Use this look"):t("Save")})]})]}),e(I,{open:G&&F!==void 0,title:M.find((s)=>s.id===F)?.title??"",onClose:()=>j(void 0),children:e("div",{className:"stack",children:M.find((s)=>s.id===F)?.node})}),e(H,{open:_!==void 0,title:t("Discard your changes?"),confirmLabel:t("Discard"),cancelLabel:t("Keep editing"),tone:"danger",onClose:()=>T(void 0),onConfirm:ue,children:e("p",{children:t("The new look for {name} has not been saved.",{name:i.displayName})})})]})}var ae=(i)=>t(he[i]);function Ce(i){let l=i.base.colors,h=A(()=>Wn({class:i.id,colors:l}),[i.id,l]);return e(ie,{data:{"data-class":i.id},spec:h,size:56,label:N("class",i.id),hint:Y(i.id),pressed:i.pressed,onPick:i.onPick})}export{Oe as CharacterCreator};