pi-roundtable-web 0.25.0 → 0.26.1

package/CHANGELOG.md

@@ -5,6 +5,60 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.26.1] - 2026-10-30
+
+### Added
+
+- `HostCard.keep`: a card the host still wants (a ticket's pinned card while the ticket is open) survives its kind's `retention.textDays` sweep for as long as `card` or `updateCard` passes `keep: true`; `updateCard` without it makes the card ordinary again. Adds the migration `web-host-cards-keep` (a `keep` column).
+- `WebApp.rooms.context(room, { limit?, messageChars? })`: a host room's recent messages as the channel-context block `CHANNEL_CONTEXT.read` gives a turn, for a host that starts a turn from a room's `send` hook and has no addressing message. It marks nothing handed over, so a retry reads the same.
+- `auth.onSessionVerified(principalId)` for `oidc`: called when a request or an open socket proves a live session, at most once per session every five minutes, so a host can count a person who only has the app open as present. It is not awaited; an error it throws is logged and never fails the request.
+- Typing `@AI` as the first word of the box works as the toggle, in a host room that offers both ways and in an agent or group room that offers the `@AI` switch for notes. The word counts in any case when a space, a colon, a comma or the end of the text follows it. While it is there the switch shows on and locked, and it returns to the person's own setting when the token is deleted; the page sends the message with an explicit `mode: "turn"` and cuts the leading token (and the space, colon or comma after it) from the text. Only typing counts: `@AI` later in the text, inside an address such as `a@ai.com` or a word such as `@AIX`, in pasted or dropped text, in a restored draft or in a quote is plain text and the message goes as the switch says. This is the page's shorthand only; the server never reads a message's text for it, so a `note` frame whose text starts with `@AI` stays a note, and only an explicit `mode: "turn"` from a viewer who may send turns starts one. `Composer.onSend` gets a third argument, whether the person addressed the agent, and `Composer` takes `onAddressed`; `ModeToggle` takes `locked`. Rooms without the switch are unchanged.
+- Internal notes in an agent or group room: an agent or group room that more than one person reads (the host has more than one owner) gets an `@AI` switch on the composer, on by default. Off, the message is an internal note: it is stored in the room's log with its author, shown live to every other owner and in the history with the author's name and picture and an "Internal note" marker (zh-TW has its own wording), and never given to the agent: no turn runs, it is not in the agent's session, and it is not in any channel context. The server says which rooms take notes: `RoomView.notes` is `true` on the agent and group rooms of a host with more than one owner, absent otherwise, so the page does not guess. A note is a `send` frame with `mode: "note"` (the frame the host rooms already use); a stored note carries `RoomMessage.note: true` (additive column `web_room_messages.note`, migration `web-room-messages-note`). A host with one owner behaves exactly as before: no switch, no new field in the room list or the history, and a `note` frame is still refused as `bad_frame`. The fixture takes `FIXTURE_OWNERS=2` to try it with Ada and Bob.
+- The package entry exports the host-facing API: `WEB_APP` and the types `WebApp`, `HostRoomKind`, `HostPage`, `HostCard`, `Viewer`, `OpenTarget`, `ActionResult`, `LinkProver`, `OnboardingStep` and `Notices`, so a host plugin no longer mirrors them.
+- The `description` option, and `<meta name="description">`, `og:title`, `og:description` and `og:image` on the page, so a search result and a link preview have a title, a line and the mark. Without `description` a line is derived from `title`.
+- `<mount>/icons/mark.svg`, the round-table mark.
+- The tab shows a small red dot on its icon, top-right with a white ring, while anything waits (cards waiting, notices, unread messages), and the title leads with `(N) `. The dotted icon is drawn in the browser from the page's own icon, so a host's `icons.dir` keeps its look; Safari ignores a changed tab icon, so there the title's count is the signal. It is a lazy chunk that loads after the first paint. Unread messages now count in the title too, not only cards.
+
+### Changed
+
+- README and the `Notices.raise` doc: a notice's `tag` is the dedupe key, the push tag and the acknowledgement key, visible to the people the notice is for; put no private id in it.
+- A host may name the `table` pane for a member or an admin (`panes: { owner, admin?, member }`, with that tier's `rooms` pane too; the default lists still leave it out). Their table seats the host rooms their kinds let them list, newest first, not agents: the agent rooms stay the owners'. A seat is lit by its room's own `activity` and cards, which reach a socket only for a room the person may read now, and a tap opens the room's page, where the kind's `access` decides what they may write and press. There is no dialogue box, seat menu or "Who's at the table" sheet for them, and no new route. `overview`, `workspace`, `skills` and `connectors` stay owners-only. The owners' table is unchanged.
+- Following a host room now also sends the follower the room's `activity` frame when a turn is already running, so a seat does not wait for the next change to show it.
+- `HostRoomKind.buttons` may return a promise, for a host whose rights source is async.
+- README: `WebApp.rooms`, `.notices`, `.pages`, `.onboarding` and `.push` throw until the plugin started; `notices.onAck` is available only after start.
+- An ordinary folder is a light section header (chevron, name, count, ⋯), left-aligned like the Home and Pinned labels, not the boxed grey card, which stays for the archive. A folded folder shows a small overlapping stack of the pictures of its first four rooms and, when it holds more, how many more (`+2`).
+- An owner can take a finished dispatch thread off the room list: a remove button on each finished row, and "Clear all" in the fold of a room's finished threads. The thread leaves the list for every owner and every open page at once; it is hidden, not deleted, and stays readable by its address and through the links in its room. An open thread cannot be removed (409). The mark is the new column `web_threads.dismissed_at` (migration `web-threads-dismissed`, additive). Routes: `POST api/rooms/<thread>/dismiss`, `POST api/rooms/<room>/dismiss-threads`, and `GET api/rooms/<thread>` for the view of a thread the list does not carry (owners only, like the rest of `api/rooms`).
+- `HostPage.icon` and `HostRoomKind.icon`: an optional name from the console's own icon set (`HOST_ICONS`, type `HostIconName`, exported): `chat`, `link`, `activity`, `users`, `megaphone`, `qr`, `settings`, `bell`, `file`, `list`, `shield`, `lock`, `sparkle`. A page's icon shows in the navigation (the list icon stays the default), a kind's beside its section in the room list. A name outside the set is dropped and the default shows. `ConfigView.pages[].icon` and `.kinds[].icon` carry it. The new glyphs load only when a page names one.
+- A host room where a viewer may send both a note and a turn shows one `@AI` toggle over the composer's bar instead of the two chips "Note" and "Ask the agent": off sends a note for the room's people only, on sends a turn the agent answers, and the box's hint follows ("Write an internal note…" / "Ask AI…", never naming the room as a recipient, in every shipped locale). The toggle stands in the composer's column (it sat at the pane's edge on a wide screen) and is at least 44 px high. A room open to one way only shows that way's hint and no toggle. `Composer` takes `placeholder` and `above`, and `ModeToggle` is a piece of its own, for any room that offers the choice.
+- `HostRoomKind.sendWording`: a kind may word the toggle (`turn.label`) and each way's hint (`note.placeholder`, `turn.placeholder`); text only, a label cut to 40 characters and a placeholder to 100. `HostRoomView.wording` carries it.
+
+### Fixed
+
+- Without a session only the icons the page, the manifest and the sign-in pages link answer (`192.png`, `512.png`, `maskable-512.png`, `apple-180.png`, `badge-96.png`, `mark.svg`, `mark-maskable.svg`); another file a host keeps in `icons.dir` stays behind the sign-in.
+- In an agent or group room that more than one owner reads, every owner message was drawn as the viewer's own (right-aligned, accent bubble), so Bob saw Ada's messages as his. A message is the viewer's own only when its author's principal (`RoomMessage.principalId`, which the server already stores and sends on owner messages) is the viewer's; another owner's message is drawn as someone else's, with that person's name and picture, as in host rooms. A message stored without a principal is the viewer's only where one owner reads the room; where several do, it is drawn as an owner nobody can name, never as the viewer's. A room one owner reads draws exactly as before.
+- A folder's header no longer turns into an unreadable light fill with white text when the pointer rests on it (on a phone the highlight stuck after a tap), and its title is left-aligned, not centered. The base rule `button:hover:not(:disabled)` out-specified the header's own style; its hover, press and keyboard focus now tint the label and keep its text colour in every look and scheme.
+- A row of the room list that is held and dragged on an iPhone now lifts and reorders. iOS Safari lets a page stop a finger's scroll only if a non-passive `touchmove` listener existed when the finger went down; the lift added its own after the hold, so the first move scrolled the page and the browser cancelled the drag. While a row that can be lifted is on the page, a no-op non-passive `touchmove` listener is now held.
+- The plain room list (no pin and no folder yet) keeps Agents and Groups by latest activity, as the arranged list and the drawer do. Before, it kept the order the server listed them in, so a room you had just talked to did not move up, even after a reload.
+- Under path routing the manifest and the home-screen icon links come after the page's base, so a page opened at a room's URL (`<mount>/room/<key>`) still finds them.
+- The page now has a tab icon: the round-table mark, linked as `rel="icon"` on the app, the sign-in page and the sign-in flow's pages, so a browser no longer asks the site root for `/favicon.ico` and gets a 404. A host's own `icons.dir` is kept (add a `mark.svg` to it to replace the SVG too).
+- The manifest and the icons answer without a session in `oidc` and `password` mode, so the sign-in page and a link preview have an icon. They were redirected to the sign-in. Nothing else below the mount is open.
+- The served page carries the host's `title` in `<title>` from the first byte; it said `Console` until the script ran.
+
+## [0.26.0] - 2026-10-30
+
+The core peer range is now `>=0.26.0 <0.27.0`.
+
+### Fixed
+
+- A card or an unprompted reply in a host room no longer pushes to every owner's phone; host rooms reach phones only through notices.
+- A file an agent attaches in a host room is bound to the room and the kind's file retention, so its readers can download it (before, only owners could, and the 30-day agent sweep applied).
+- Answering a card in a host room asks the kind's `access` with the person's roles, so a role-gated reader is no longer refused or dropped from the room.
+- A link with a tab, newline or space is no longer taken for a path of this origin.
+
+### Changed
+
+- A running turn's strip shows only its three newest tool calls; a button counts the earlier ones and opens them all (and folds them again).
+
 ## [0.25.0] - 2026-10-29
 
 The core peer range is now `>=0.25.0 <0.26.0`.

package/README.md

@@ -21,14 +21,16 @@ Then only a person whose principal holds the owner role gets in.
 
 - [Requirements](#requirements) and [Install](#install)
 - [The owner app](#the-owner-app): rooms, cards, [modes](#modes-yolo-and-long-running), [dispatch threads](#dispatch-threads), [pins and folders](#pins-and-folders), [uploads](#uploads), [characters](#characters-in-the-page), [the Camelot look](#the-camelot-look), [the round table](#the-round-table), [the files pane](#the-files-pane)
+- [Members and the gate](#members-and-the-gate): [who is let in](#who-is-let-in), what each tier sees, and the steps owed before the app opens
 - [Install on a device](#install-on-a-device) and [Notifications](#notifications)
 - [Authentication](#authentication) and the [threat model](#threat-model)
 - [Options](#options), [the console's panes](#the-consoles-panes) and [host feature ports](#host-feature-ports)
+- [Host rooms, pages and cards](#host-rooms-pages-and-cards): rooms a host plugin owns, with read marks
 - [App protocol](#app-protocol), [Screenshots](#screenshots) and [Development](#development)
 
 ## Requirements
 
-- Bun 1.4.4 or later, and pi-roundtable `>=0.25.0 <0.26.0` as a peer dependency.
+- Bun 1.4.4 or later, and pi-roundtable `>=0.26.0 <0.27.0` as a peer dependency.
 - The host must run on the machine that holds its data directory: the console reads `<dataDir>/sessions` from disk, and the app keeps its files and keys under `<dataDir>/web/`.
 - An agent team: `agents` in the configuration, with or without `discord`. Without Discord the host also needs a surface that hosts rooms, and this plugin is one; the start fails otherwise, naming the fix.
 - A way to authenticate the owners (see [Authentication](#authentication)): a password, Cloudflare Access or a verifier of your own in front of the listener, or `none` on a listener only the owner reaches.
@@ -176,7 +178,7 @@ The owners arrange the room list together: one layout for the whole app, kept on
 | Where | What it does |
 |---|---|
 | A room's menu (long press, right click, or the Menu key; the **⋯** beside a row in arrange mode; or the **⋯** in the room's header) | **Pin** or **Unpin**, **Move to folder…** (a sheet with the folders, Ungrouped and **New folder…**), and **Move up** or **Move down** within the pinned list or the folder. |
-| A folder's header | Fold or unfold it (kept per device in `localStorage`, `roundtable-console:folders-collapsed`; the folder that holds the open room shows open, and a folded folder still shows its rooms' waiting cards and working dots). Its **⋯** (or a long press, right click or the Menu key) offers **Rename**, **Mute the whole folder** or **Unmute the whole folder**, **Move up**, **Move down** and **Delete folder** (after a question; its rooms move to Ungrouped, no room is deleted). A bell-slash shows when every room in it is muted, a fainter one when some are. |
+| A folder's header | A light section header (chevron, name, count, ⋯). Fold or unfold it (kept per device in `localStorage`, `roundtable-console:folders-collapsed`; the folder that holds the open room shows open, and a folded folder still shows a small stack of its rooms' pictures, then how many more, and its rooms' waiting cards and working dots). Its **⋯** (or a long press, right click or the Menu key) offers **Rename**, **Mute the whole folder** or **Unmute the whole folder**, **Move up**, **Move down** and **Delete folder** (after a question; its rooms move to Ungrouped, no room is deleted). A bell-slash shows when every room in it is muted, a fainter one when some are. |
 | The list's **⋯** | **Add a folder**, and **Arrange**, which shows a **⋯** beside every row and a bar to add a folder until **Done**. |
 | A room row or a folder header, held or dragged | A finger that rests on a row lifts it (a short vibration where the phone has one); dragging then reorders it within its list, moves it into another folder, the pinned list or Ungrouped, and a folded folder opens after the finger rests on it. A held folder header moves the whole folder among the folders. The rows make room as you drag, the list scrolls near its edges, the place it lands is outlined, and Escape or a drop outside every list puts everything back. Letting go without moving opens the row's menu as before. A mouse lifts a row once it moves with the button down. A touch within 32 px of a screen edge never lifts a row (the system keeps that edge), so the menu is the way there. While a row is lifted the lists keep their order, so a message that arrives does not move rows under the finger, and the pinned list and empty folders show as places to drop even when they hold nothing yet. On Android the browser's own long press (its `contextmenu`, at about 400 ms) counts as the hold. Ungrouped is ordered by activity, so a row dragged within it goes back; pin it or put it in a folder to place it. The lift code is a chunk of its own that loads on the first press. |
 
@@ -192,7 +194,7 @@ An owner may send a file of any kind in a room, up to four to a message: the but
 
 - **Streamed, not buffered.** The body is read as a stream and written to disk as it arrives, so a large file costs disk, not memory. Only the first bytes are kept to tell what the file is. A file over `uploadMaxBytes` is refused with `413` (before it is read when the length says so, as it passes the limit otherwise), and nothing is left on disk.
 - **Any type.** Images are checked by their first bytes (a file that says it is a PNG but is not one is refused with `415`); a file that is valid UTF-8 without NUL bytes is kept as text (`text/markdown`, `text/csv` or `application/json` by its name, else `text/plain`); a PDF by its first bytes keeps `application/pdf`; everything else is kept as `application/octet-stream` under the name it came with. What the browser said the type was (often empty, or `video/mp2t` for a `.ts` file) does not decide.
-- **Bounded.** A person may have 16 files and 400 MiB waiting for a message, counting uploads on their way (`429` beyond that); a waiting file is deleted after a day, a sent one after 30. The page deletes a chip's upload when it is removed or its send fails (`DELETE <mount>/api/uploads/<id>`, the owner's own waiting uploads only), and a body that is cut short leaves no file behind.
+- **Bounded.** A person may have 16 files and 400 MiB waiting for a message, counting uploads on their way (`429` beyond that); a waiting file is deleted after a day, a sent one after `uploads.keepDays` (30 by default). The page deletes a chip's upload when it is removed or its send fails (`DELETE <mount>/api/uploads/<id>`, the owner's own waiting uploads only), and a body that is cut short leaves no file behind.
 - **Served safely.** A stored file is a download, never a page (`content-disposition: attachment`, `content-security-policy: sandbox`, `nosniff`); only the four image types are shown inline.
 - **What the agent gets.** The turn's message names each file, and the host saves it for the agent's tools: the app hands the host the stored file's path, so a large file is copied from disk, never held in memory. The agent takes a file up to `uploadMaxBytes` (the surface's `maxAttachmentBytes`), not the 25 MiB a Discord attachment is held to. Images (four at most) are also shown to the model, and a text or PDF file can be read by the agent. A file over 25 MiB is kept as a file for tools: it is not shown to the model and `read_attachment` refuses it, and the turn's attachment list marks it "too large for read_attachment; kept as a file for tools", which a tool that takes files opens as it is.
 - **Limits in front of the app.** The upload route asks the host's listener for a request body of `uploadMaxBytes` plus 64 KiB of form framing, so a larger `uploadMaxBytes` raises the listener's limit past its 128 MiB default (a listener the host fixed with its own `maxRequestBodyBytes` decides instead, and refuses a larger body with `413`). A reverse proxy has its own limit; Cloudflare's free plan caps request bodies at 100 MB, so a larger file needs a paid plan or an upload path that skips the proxy.
@@ -220,6 +222,8 @@ Every agent is drawn as its composed character (`pi-roundtable/characters`). The
 
 The `table` pane is a council hall: a ring of tall dark-wood podiums, one for each active agent whose room is not muted (the coordinator first) and one low lip at the near edge for you, under torches, banners and a stained-glass window, around a glowing rune circle. The hall is drawn in the characters' own flat, outlined style (a stepped tone gradient and a dark line round every shape, no photographic textures). Dark is the hall at night, light the same hall by day; the Modern and Camelot looks change the banners and the trim, not the hall. Each agent stands behind its podium as a waist-up standee: the character without its frame, cut out with a thin light rim, a dark line and a visible board thickness, turning to the camera within limits. A seat's state comes from the same rules as the room list (`sleepy` sits as `idle`): a thinking seat shows a "…" badge and bobs, a seat with a card waiting a gold "!", a speaking seat has a light on its podium and the concept art's three gold emphasis strokes beside its head; a change of face redraws that one picture once it has stood for 300 ms. More than twelve agents show twelve and a "+N" podium that opens the list.
 
+This section describes the owners' table. A member or an admin is served the table only when the host names it for their tier, and theirs seats host rooms instead of agents: see [What each tier is served](#what-each-tier-is-served).
+
 - **Cameras.** The overview stands behind your podium, raised. A drag or swipe turns it round the ring and snaps to a podium; the wheel or a pinch moves in on the podium across the ring and back out. A close-up of a speaker stands low inside the ring, tilted a little, with thin speed lines flashing for 400 ms on a new speaker. A turn follows the ring the shorter way and takes 450 to 650 ms. A swipe never starts within 32 px of the screen's edge. Under `prefers-reduced-motion` the camera cuts, with no speed lines, bob or flicker.
 - **Talking in the scene.** A tap on a podium (or on its name, a button over the plate) turns the camera to that agent and slides up a dialogue box on the agent's own room: a nameplate tab in the agent's color with its picture, the line being said (Markdown, typed out while it streams, a tap shows it whole), the cards waiting for an answer, and the room's own message box, with its unsent text kept per room. **Log** opens the room's whole message list as a sheet over the scene. The address is `#/table/<agent>` (the agent's name or the key of its room): Back returns to the whole ring, a link opens the scene at that agent, and an address that names nobody seated goes back to `#/table`.
 - **Names.** A seat's name is a button laid over its podium's nameplate, at least 12 px on the screen at any distance, in a font stack that carries Chinese (`system-ui`, PingFang TC, Noto Sans TC, Microsoft JhengHei); the podium's own plate is lettered the same way. The seat's full name and state are its accessible name. Where the names stand over each other (many seats on a phone) the agents are also listed as buttons under the scene.
@@ -287,13 +291,58 @@ A host that adds a root the agents cannot reach should authenticate with a verif
 The REST is `GET api/workspace`, `GET api/workspace/<place>/list?path=`, `file?path=` (the text, `hash`, `editable` and, when not, `reason`), `raw?path=` (bytes, `no-store`, `&download=1` forces a download), `PUT file?path=` (`{ text, baseHash }`), `POST new?path=` (`{ kind: "file" | "dir", text? }`), `POST rename` (`{ from, to }`), `DELETE entry?path=`, `GET trash`, `POST trash/<id>/restore` and `DELETE trash/<id>`.
 The service worker never caches `api/workspace`.
 
+## Members and the gate
+
+By default the app lets in only owners, as it always has. With `admission: "access"` it lets in everyone the host's `IDENTITY` admits on the app's surface: owners, admins and members. The app never makes a rule of its own about who that is; it asks `IDENTITY`, whose `access` configuration decides.
+
+### Who is let in
+
+`admission: "access"` needs a credential that names a person: `auth: { mode: "oidc", ... }` (below), or a verifier that reports who signed in. `none` and `password` speak for one shared actor and are refused with it.
+
+- A person whose identity is linked to a principal is looked up with `IDENTITY.peek`, which writes nothing. A person nobody has linked is admitted through `IDENTITY.resolve`, which makes a new principal only where `access.provisioning.app` is `admitted` for the surface; otherwise they are refused.
+- The facts the app reports are partial (`partial: true`): signing in here shows less than a person may hold elsewhere, and never lowers a tier recorded somewhere else. An admin in the app is a lasting admin grant, or a role named by the access rules as `app:role:<name>` that the provider's token carries.
+- A disabled principal, and a person the rules give no tier, are refused with `403`.
+- The tier is read again on every request and on a socket's every frame and once a minute. Losing admission closes the socket with 4403; a change of tier changes what it is sent from then on.
+
+### Deny by default
+
+One table decides every request before any handler sees it (`src/authz.ts`). A route that is not in it answers `404` to everyone, owners included. Each row says who it answers:
+
+| Who | Routes |
+|---|---|
+| Owner | the owners' agent rooms (`api/rooms*`, a `404` to anyone else), the overview, skills, connectors, folders, agents, groups, the archive, prompts, the files pane, and the event stream |
+| Any admitted person | their own conversations, notes and schedules, the host's rooms and pages, uploads, and pictures of agents |
+| Anyone admitted, gated or not | the page itself, `config`, `session`, their notices, push, profile, links and onboarding |
+
+A member's socket receives nothing from an agent room, neither as it happens nor when it connects: the owners' cards and the table of who is busy are sent only to sockets whose tier is owner now. A card is answered only by its own audience, the same rule as Discord's: for an approval that names approvers, the named ones who hold its tier now, and the owners; otherwise the turn's speaker and the owners where the scope escalates. A room's readers can never widen that.
+
+### What each tier is served
+
+`panes` takes a list for the owners and, with `admission: "access"`, `{ owner, admin?, member }` to choose per tier. The default gives a member `rooms` (the host's own rooms only), `conversations`, `notes`, `schedules` and `profile`, of those the host serves; an admin's list is the member's unless given. A member is never served `overview`, `workspace`, `skills` or `connectors`, and naming one for them stops the start. `table` is the one pane whose name a host may give a member or an admin (it needs that tier's `rooms` pane, and the owners' list must have it too): the default lists leave it out, so it is served only where the host names it.
+
+- **The round table for members and admins**: the agent rooms are the owners', so a member's or an admin's table seats none of them. It seats the host rooms of every kind they may list (`GET api/host/<kind>`, the same lists and the same kind `access` as their room list, so a room the kind does not give them is no seat), newest first, in the same ring and the same looks. No new route is added: the table asks only for those lists. A seat is lit from its room's own frames, which the page follows by `subscribe` for the seats the scene draws (at most twelve), and a follow is answered only for a room the person may read now: `activity` (thinking, working, a turn already running when they follow) and the cards are addressed to the room's readers, as they are in the room, and a room they may not read sends nothing, however they ask. A room that asks for something in the kind's list (`attention`) sits as waiting. A tap on a seat opens that room's own page, where what the person may write (a note, a turn to the agent, or nothing) and press is decided by the kind's `access` as everywhere else, so the table has no dialogue box, no seat menu and no **Who's at the table** sheet for them (those mute and arrange agent rooms, which are the owners'), and an address `#/table/<seat>` goes back to the whole ring. The "+N" podium opens the room list. The table sends the person nothing of the overview, the files pane, the skills or the presence of the team, and the owners' view is unchanged.
+- **Conversations**: a member lists and reads only the private conversations the registry records as theirs, found by the registry; `exclude(key, record)` is asked on every list and every transcript read.
+- **Notes**: their own only. Asking for another person's is `403`. The pane is left out, with a warning, when the host keeps no memory (`MEMORY`); naming it with none is an error.
+- **Schedules**: their own, whichever of the 0.8 and the current id the schedule names them by; an owner sees every schedule.
+- **Profile**: who they are signed in as, and Log out.
+
+### The gate
+
+A required step the person still owes (see `onboarding`) closes the app on it: only their profile, settings and the pages that finish a step answer, the page shows the steps with a link to each, and the socket carries only the gate, their notices and refusals. When the last step is done the page loads again with everything the person may now see.
+
+### Deep links
+
+A link to a page can name where to go after signing in: `?next=profile`, `?next=notices`, `?next=settings`, `?next=room:<key>` for a room of the app's surface, or `?next=p:<page>` for a host page. Anything else, an address of another site included, is dropped.
+
 ## Install on a device
 
 The app is a progressive web app, installable on a phone, tablet or desktop and opened in its own window.
 
 - `<mount>/manifest.webmanifest` is generated for the mount: its `id`, `start_url` and `scope` are all `<mount>/`, `display` is `standalone`, the name is `title`, and the theme and splash colors follow `appearance.look`. The page links it with `crossorigin="use-credentials"`, so a proxy such as Cloudflare Access that sets a cookie sees it.
 - `<mount>/sw.js` is the service worker, served `no-cache` and scoped to the mount. It precaches the page's hashed assets and `index.html`, serves assets cache-first and navigations network-first with the cached shell as the offline fallback. It never touches `api/`, `auth/`, `login`, `files/` or `avatars/`, and returns a redirect (a proxy's login) as it came. It caches the shell only, never data, so a shared device keeps nothing after you log out. The round table's 3D scene and the files pane's editor and languages are fetched the first time they are needed and are not precached.
-- `<mount>/icons/` serves `192.png`, `512.png`, `maskable-512.png`, `apple-180.png` and `badge-96.png`. The package ships a set; `icons.dir` replaces it with a directory that has the same five names.
+- `<mount>/icons/` serves `192.png`, `512.png`, `maskable-512.png`, `apple-180.png` and `badge-96.png`, and `mark.svg`, the round-table mark. The package ships a set; `icons.dir` replaces it with a directory that has the same five PNG names, and `mark.svg` too if it should be the tab icon.
+- The tab icon is the round-table mark by default. The page, the sign-in page and the pages of the sign-in flow link `<mount>/icons/mark.svg` (when the icon directory has it) and `<mount>/icons/192.png` as `rel="icon"`, so the browser does not ask the site root for `/favicon.ico`. The page also carries `og:title`, `og:description` and `og:image` (`<origin><mount>/icons/512.png`) for link previews.
+- The manifest and the icons answer without a session, in every `auth` mode: they are the same for everyone, and a sign-in page and a link preview need them before anyone has signed in. Nothing else below the mount does.
 
 To install: open the page over HTTPS in Chrome, Edge or Safari and use the browser's Install option, or press **Install the app** in Settings where the browser offers it.
 On iPhone and iPad use Share, then Add to Home Screen, and open the app from the home screen: iOS allows notifications only to an installed app.
@@ -331,6 +380,39 @@ Setup:
 - **Delivery.** The payload is encrypted for the device (RFC 8291, `aes128gcm`) and signed with a VAPID token (RFC 8292, ES256 with `jose`); there is no push dependency. A `404` or `410` from the service removes the subscription, as do five failures in a row. A person has at most 20 devices.
 - **Who gets it.** Only a device of a person who is still an owner, and only while no open page of that owner reports itself visible.
 
+## Notices and the profile
+
+A notice is something that waits on one person, such as a customer's message or a card to approve. A host raises one with `Notices.raise({ tag, people, title, open, urgency?, via? })` and takes it back with `Notices.resolve(tag)`; `renotify` adds people to an open one. `open` names exactly where a tap goes: `{ room, message? }` (the room, scrolled to that message) or `{ page, query? }`. A notice appears in the bell, with a count on the app icon where the device allows it, and is pushed according to its `urgency`: a normal one waits in the bell during the person's quiet hours, an urgent one rings and stays on screen until dealt with. `via` narrows a notice to named transports (see `push.transports`).
+
+The `tag` is the notice's dedupe key, the tag of its push and the key of its acknowledgement, so it is not secret from the people the notice is for: their browser sees it. Do not put an id that those people should not see in it (a customer's or a group's id); use a hash or a counter of your own instead.
+
+Tapping a notification or a bell row opens exactly that room or page, whether the app is open (its window comes forward and goes there) or closed (a new window opens at the address; a signed-out person signs in and lands there). A device reports when a notice arrived and when it was opened, which is how the app knows a test notification reached the device.
+
+The profile page (`profile`) shows the person's name, picture and tier, the accounts they linked and the ones they can link or unlink, **Shown as** (which linked account names them in the app, or Automatic), and their own quiet hours with a test notification. An account that the host's configuration links cannot be unlinked there.
+
+### An external push sender
+
+With `push.sender: { external: { publicKey } }` the app holds no VAPID key: it queues each push as a row in `web_push_outbox` and a separate process empties it. Run that process with `runPushSender` from `pi-roundtable-web/push-sender`:
+
+```ts
+import { runPushSender, webPushTransport } from "pi-roundtable-web/push-sender";
+
+runPushSender({
+  database,                         // a role that may SELECT the outbox, subscriptions, sessions and principals, UPDATE the outbox, and INSERT deliveries and subscriptions
+  transports: [webPushTransport({ /* the VAPID key pair and subject */ }), mySlackTransport],
+  render: (row) => ({ title: "Something needs you" }), // with push.content "none" the row carries no text
+  subscribe: {                      // omit when the app's own subscription routes are used
+    listener: { port: 8788 },
+    path: "/push/subscriptions",    // the app's push.sender.external.subscribePath
+    origin: "https://app.example.com",
+    authenticate: (request) => webSessionPrincipal(database, request),
+  },
+  logger,
+});
+```
+
+The sender tries its transports in order for each row until one says it was sent, narrowed by the row's `via`. Its subscription routes answer only with the app's session cookie, and every request other than a GET must carry exactly the console's `Origin`, or it is refused with `403`. `webSessionPrincipal` and `webSessionClaims` read the session cookie, the second giving the claims of a person's newest live session (set `auth.storeClaims` for them to be stored). Nothing in the app process can read the key.
+
 ## Authentication
 
 The app never makes an account.
@@ -342,6 +424,7 @@ You choose how with the `auth` option; the console then looks the person up in t
 | `{ mode: "verifier", verifier }`, or the `verifier` option as shorthand | The person the verifier reports, linked to an owner's principal. | A proxy such as Cloudflare Access authenticates people in front of the listener. This is the one mode whose proof an agent on the host cannot forge. |
 | `{ mode: "password" }` | The primary owner, once they give the password. | The console is reachable from the internet with no proxy that signs people in. |
 | `{ mode: "none" }` | The primary owner, whoever reaches the listener. | Only the owner can reach the listener: a unix socket, or loopback TCP. |
+| `{ mode: "oidc", issuer, clientId }` | The person the provider reports, by the identity `IDENTITY` links to a principal. With `admission: "access"`, members and admins too. | People sign in with a provider of your own, without a proxy in front. See [OpenID Connect](#openid-connect). |
 
 Giving both `auth` and `verifier` throws, and so does giving neither: the plugin never starts without a way to authenticate.
 Whatever the mode, a request that changes data must carry the console's own `Origin`.
@@ -412,6 +495,20 @@ The console never resolves an identity the way a chat surface does: a visitor is
 It refuses an identity of the `legacy` provider too, as resolving refuses it: that is the alias 0.9 keeps for a 0.8 id, not anyone's sign-in.
 A verifier may vouch for members as well as owners, through a proxy that lets the whole company in or an allowlist that grows, so the console never guesses whose an identity is: only a link says so.
 
+### OpenID Connect
+
+`auth: { mode: "oidc", issuer, clientId }` signs people in with any OpenID Connect provider (Microsoft Entra, Google, Keycloak, Authentik and the like) by the authorization code flow with PKCE. The origin must be `https`: the session cookie is `Secure`.
+
+1. A person with no session is sent to the provider with a state, a nonce and a PKCE challenge, kept in a signed cookie that lives ten minutes and works once. The first visit asks silently (`prompt=none`), so a live single sign-on needs no click; when the provider answers `login_required` the person is asked once, normally.
+2. At the callback the code is exchanged, and the `id_token` is checked once: its signature against the provider's published keys, issuer, audience, expiry and nonce. A state that does not match or was used before, a callback with no pending cookie, and a token that fails any check are refused and make no session.
+3. `IDENTITY` admits the person (see [Who is let in](#who-is-let-in)); only then is a session made: a random 256-bit id in an `HttpOnly` cookie, of which the database keeps only the SHA-256, in the `web_sessions` table. No token, claim, code or session id is logged.
+4. The session slides: it ends after `sessionDays` (30) without a visit, and a visit moves the limit at most once an hour. Nothing the provider said is trusted again; the tier is read from `IDENTITY` on every request. Disabling the principal refuses the next request and closes the socket.
+5. Log out deletes the row, so the old cookie is refused afterwards, clears the cookie and, with `endSession`, also signs out at the provider. A person who just logged out is asked, not signed in silently again.
+
+`reauthHours` makes the provider vouch again: past it, the next page load does a silent round trip that refreshes the stored facts and roles, a provider that wants the person sends them through a normal sign-in, and a request to the API or the socket on such a session is answered `401` until then. `storeClaims` keeps the named `id_token` claims with the session, replaced at each sign-in, for a sender that needs, say, a mailbox address.
+
+`onSessionVerified(principalId)` is called when a request or an open socket proves a live session, at most once per session every five minutes. Use it to count who is present: a host that keeps a linked chat account only while its web person is active can note the person there, even when they only have the app open and call nothing of the host's. It is not awaited, and an error it throws is logged and never fails the request.
+
 ### Upgrading from 0.8
 
 The core [Migrating to 0.9](../../docs/migration-0.9.md) guide covers backfill, rollback, and the principal isolation boundary.
@@ -569,7 +666,7 @@ Every option is checked when the plugin is created, so a bad setting stops the h
 
 | Option | Default | What it does |
 |---|---|---|
-| `auth` | none, `auth` or `verifier` required | How requests are authenticated: `{ mode: "none" }`, `{ mode: "password" }` or `{ mode: "verifier", verifier }`; its keys are in the next table, and [Authentication](#authentication) explains the modes. |
+| `auth` | none, `auth` or `verifier` required | How requests are authenticated: `{ mode: "none" }`, `{ mode: "password" }`, `{ mode: "verifier", verifier }` or `{ mode: "oidc", ... }`; its keys are in the next table, and [Authentication](#authentication) explains the modes. |
 | `verifier` | none | Shorthand for `auth: { mode: "verifier", verifier }`: decides whether a request comes from someone your proxy authenticated, and reports who. `cloudflareAccess(...)` is built in; pass your own function to use another proxy. Giving both `auth` and `verifier` throws. |
 | `origin` | none, required | The app's own origin as the browser sees it, such as `https://app.example.com`: scheme and host (and port), no path. Requests that change data must carry it as their `Origin`, the dashboard line links to it, and push derives its default contact from it. |
 | `ownerId` | the primary owner | Deprecated. The owner's principal id that a request from a verifier reporting no actor stands for. The Notes pane no longer needs it: it shows each owner their own notes. |
@@ -577,31 +674,48 @@ Every option is checked when the plugin is created, so a bad setting stops the h
 | `mountPath` | `/console` | The path the app is served under: one or more segments of letters, digits, `.`, `_`, `~`, and `-`. |
 | `listener` | `public` | The id of the listener whose address serves the app. |
 | `routing` | `hash` | `path` retains links such as `/console/skills`, with history navigation and an authenticated page fallback. |
-| `panes` | `rooms`, `table`, `workspace`, `overview`, `schedules`, `conversations`, `notes` | Ordered subset of those panes plus `skills` and `connectors`. `schedules`, `table` and `workspace` need `rooms`, and `workspace` needs a place to show (below). Disabled panes answer 404. `skills` and `connectors` require their feature ports at setup. An explicit list is kept as written, so a host that listed its panes before 0.23 adds `rooms`, `table` and `schedules` by hand, and one that listed them before 0.24 adds `workspace`. |
+| `admission` | `owners` | `owners` lets in only people who hold the owner role; `access` lets in everyone `IDENTITY` admits on the surface. See [Members and the gate](#members-and-the-gate). |
+| `modes` | on | `false` leaves out the yolo and long-running switches: none is shown or set, and `PUT api/rooms/<key>/mode` answers 404. |
+| `panes` | `rooms`, `table`, `workspace`, `overview`, `schedules`, `conversations`, `notes` | Ordered subset of those panes plus `skills` and `connectors`. `schedules`, `table` and `workspace` need `rooms`, and `workspace` needs a place to show (below). With `admission: "access"` the default adds `profile`, and `{ owner, admin?, member }` chooses per tier. Disabled panes answer 404. `skills` and `connectors` require their feature ports at setup. An explicit list is kept as written, so a host that listed its panes before 0.23 adds `rooms`, `table` and `schedules` by hand, and one that listed them before 0.24 adds `workspace`. |
 | `workspace` | the agents' directories | What the [files pane](#the-files-pane) shows: `workspace.roots` adds places, each with an `id` (`workspace.roots.id`, a lower-case word other than `agents` and `scratch`), a `label` (`workspace.roots.label`), an absolute `dir` (`workspace.roots.dir`) and `writable` (`workspace.roots.writable`, false unless set), and `workspace.agents` / `workspace.scratch` set to `false` leave the agents' working directory or scratch directory out. A `dir` that is or contains `dataDir` stops the start. |
 | `surface` | `app` | The key prefix of the app's rooms, a lower-case word that is not `discord`. Rooms keep their conversations under it, so changing it starts every room over. |
 | `cardGraceSeconds` | `120` | How long a turn waits on an approval or question card before it goes on without the answer, above 0 and at most 3600. The card stays open for a day. |
 | `uploadMaxBytes` | `104857600` (100 MiB) | The most bytes of one file a person may upload, from 1 to 4 GiB; the agent takes files up to it too. It raises the listener's request body limit. See [Uploads](#uploads). |
+| `uploads` | `{ keepDays: 30 }` | `uploads.keepDays`: how many days a stored file of the app's agent rooms is kept, a whole number from 1 to 3650. A host kind's own `retention.fileDays` decides for its rooms. |
 | `push` | on, with an `https` origin | Web Push; its keys are in the table below, and [Notifications](#notifications) describes the whole. |
 | `icons` | the package's own | `{ dir }`: a directory of the five install icons, see [Install on a device](#install-on-a-device). |
 | `appearance` | `{ look: "modern" }` | `{ look }`: `modern` or `camelot`. The page's default look and the manifest's splash colors; the owner can switch it in the app. |
-| `title` | `Roundtable` | The page's heading, title and the installed app's name. |
+| `title` | `Roundtable` | The page's heading, `<title>` (set in the served HTML, so a tab and a search result have it before the script runs), `og:title` and the installed app's name. |
+| `description` | a line derived from `title` | The page's `<meta name="description">` and `og:description`, for search results and link previews. |
 | `presentation` | English | `{ locale, messages }`: locale controls dates and document language, and `zh-TW` also selects the [built-in Traditional Chinese wording](#presentation-and-built-in-zh-tw); English source strings are dictionary keys for labels, descriptions, confirmations, and API errors. |
 | `features` | none | Trusted host integrations, or a factory receiving public plugin setup context; see [Host feature ports](#host-feature-ports). |
 | `relayNotes` | the remote MCP note | Text that an outside agent's relayed message begins with, taken off before the owner's words are shown. Set it to the same value as the `relayNote` of [pi-roundtable-mcp][mcp] when you changed that one. |
-| `exclude` | none | A function from a channel key to `true` for conversations the console must neither list nor read, such as the channels of another plugin that keeps its own sessions in the same directory. |
+| `exclude` | none | A function from a channel key (and the registry's record of the conversation, when there is one) to `true` for conversations the console must neither list nor read, such as the channels of another plugin that keeps its own sessions in the same directory. |
 | `assetDir` | the package's `dist/` | The built page's directory. Set it only in tests. |
 
 The `auth` keys:
 
 | Key | Default | What it does |
 |---|---|---|
-| `auth.mode` | none, required | `none`, `password` or `verifier`. |
+| `auth.mode` | none, required | `none`, `password`, `verifier` or `oidc`. |
 | `auth.trustNetwork` | `false` | `none` only: allows a TCP listener that reaches beyond this machine, when a network in front of it keeps everyone else out. |
 | `auth.passwordEnv` | `ROUNDTABLE_WEB_PASSWORD` | `password` only: the environment variable that holds the password, which must be set and at least 12 characters. |
 | `auth.sessionDays` | `30` | `password` only: how long a login lasts, 1 to 365 days. |
 | `auth.principal` | the primary owner | `none` and `password`: the owner's principal id the session speaks for. |
 | `auth.verifier` | none | `verifier` only: the request verifier, as the `verifier` option. |
+| `auth.issuer` | none, required | `oidc` only: the provider's exact `iss`, an `https` URL. |
+| `auth.discoveryUrl` | `<issuer>/.well-known/openid-configuration` | `oidc` only: where the provider's endpoints are read at start; the start fails if they cannot be. |
+| `auth.clientId` | none, required | `oidc` only: the client id registered with the provider; the redirect URI is `<origin><mountPath>/auth/callback`. |
+| `auth.clientSecretEnv` | none | `oidc` only: the environment variable that holds the client secret; set means a confidential client, left out a public client with PKCE. |
+| `auth.scopes` | `openid`, `profile` | `oidc` only. `offline_access` is refused: the app keeps no refresh token. |
+| `auth.subjectClaim` | `sub` | `oidc` only: the claim that names the person (Entra: `oid`). |
+| `auth.nameClaim` | `name`, then `preferred_username` | `oidc` only: the claim for their name. |
+| `auth.rolesClaim` | `roles` | `oidc` only: the claim whose values become `app:role:<name>`; `false` reads none. |
+| `auth.check` | none | `oidc` only: a function from the token's claims to whether the token is acceptable at all. |
+| `auth.endSession` | `false` | `oidc` only: whether Log out also signs out at the provider. |
+| `auth.reauthHours` | never | `oidc` only: ask the provider again after this many hours of one session. |
+| `auth.storeClaims` | none | `oidc` only: `id_token` claims kept with the session. |
+| `auth.onSessionVerified` | none | `oidc` only: `(principalId) => void`, called when a request or socket proves a live session (once per session per five minutes). |
 
 The `push` keys:
 
@@ -610,7 +724,19 @@ The `push` keys:
 | `push.preview` | `true` | Whether a notification shows the first 120 characters of the message. With `false` it says only that something waits, and where. |
 | `push.quietHours` | `{ start: "23:00", end: "08:00" }` | The hours when an agent's post and a notice are not pushed, as two different `HH:MM` times on the console's time zone; an `end` before the `start` crosses midnight. Cards are always pushed. `false` turns quiet hours off. |
 | `push.endpointHosts` | none | Push services to post to besides the browsers' own (Google, Mozilla, Apple, Microsoft), as host names; a leading `*.` allows every subdomain. Endpoints must still be `https`. |
+| `push.tiers` | `["owner"]` | The tiers whose people may subscribe and receive push. |
 | `push.subject` | `origin`, when it is `https` | The contact a push service may use about this server (the VAPID `sub`): a `mailto:` or `https:` URL. With an `http` origin push stays off until it is set. |
+| `push.sender` | `"internal"` | Who signs and sends a push. `"internal"`: this process, with its own VAPID key. `{ external: { publicKey, subscribePath? } }`: a sender process you run holds the key, and this app never does; `publicKey` (base64url) is what browsers subscribe against, and `subscribePath` (starting with `/`) is where the sender serves the subscription routes, when it does. See [An external push sender](#an-external-push-sender). |
+| `push.content` | `"full"` internal, `"none"` external | What leaves the app for a push: `"full"` is a title and a preview, `"none"` is the kind, a tag and a count only (the sender words it). A host room never previews. |
+| `push.transports` | none | Names of the transports besides `web-push` that the sender process carries, such as `slack`. A notice's `via` may name only these and `web-push`; any other name is a `ConfigError` when the notice is raised. The app loads no transport itself. |
+
+The `onboarding` keys (what a person owes before the app opens, see [The gate](#the-gate)):
+
+| Key | Default | What it does |
+|---|---|---|
+| `onboarding.links` | none | Maps a provider name to `"required"` (gates the app until the account is linked) or `"nudge"` (only asks). Each provider needs a `LinkProver` registered through `WEB_APP`; the person links it on their profile page. A prover's `requires` decides the order. |
+| `onboarding.push` | `"off"` | `"required"` or `"nudge"` asks the person to turn push on for a device and receive a test notification; `"off"` leaves it out. |
+| `onboarding.pushWaiver` | `false` | Lets a person skip a `"required"` push step, which then counts as done and is recorded as waived. |
 
 The bad settings that stop the host at startup are: no `auth` or `verifier`, both of them, an unknown `auth.mode`, a password shorter than 12 characters, `none` on a listener that reaches beyond the machine, an `origin` with a path, a `mountPath` of `/` or with `..` in it, an unknown or repeated pane, `schedules`, `table` or `workspace` without `rooms`, a `workspace` pane with no place to show, a `workspace.roots` entry that is malformed, reuses an id, or is or contains `dataDir`, a `surface` that is not a lower-case word or is `discord`, an empty `ownerId`, a `uploadMaxBytes` out of range, and a `push.subject` that is neither a `mailto:` address nor an `https:` URL, and a `push.quietHours` that is neither `false` nor two different `HH:MM` times.
 
@@ -619,7 +745,7 @@ The host refuses to start with a message naming the missing service when one of
 
 ## The console's panes
 
-The page has nine panes; `panes` chooses which ones a host serves.
+The page has ten panes; `panes` chooses which ones a host serves.
 Rooms and Schedules belong to the [owner app](#the-owner-app), and the Round table to [its own section](#the-round-table); the rest are the console that came first, which reads what the host already stores: the conversation files under the data directory, the memory addon, and the agent team.
 
 | Pane | What it shows |
@@ -632,6 +758,7 @@ Rooms and Schedules belong to the [owner app](#the-owner-app), and the Round tab
 | Skills | The full host catalog, source, groups and carriers; each available skill opens its ordered frontmatter and Markdown body, and an owner edits an agent-written skill or makes a new one. |
 | Connectors | Upstream gateway enabled/reachable/tool status, virtual-server tool lists, and the agents or profiles that use them; an optional administration link. |
 | Files | The agents' workspace: a tree, highlighted files, an editor with conflict-checked saves, and a restorable trash (see [The files pane](#the-files-pane)). Needs `rooms` and a place to show. |
+| Profile | Who the person is signed in as, their tier, and Log out; it stays open while a step is owed. Part of the [members' app](#members-and-the-gate). |
 | Round table | Every active agent at a podium of one council hall, the coordinator first, each in the state its room is in; a seat turns the camera to its agent and opens a dialogue box on the agent's room (see [The round table](#the-round-table)). Needs `rooms`. |
 
 Opening a conversation shows its **transcript**: the user's and the assistant's messages, the tools the assistant called with a short preview of their arguments, and each tool's result (collapsed).
@@ -706,14 +833,40 @@ webConsole({
 
 When serving Skills and Connectors, provide those hooks as well; a missing port fails startup rather than silently dropping a pane.
 
+## Host rooms, pages and cards
+
+A host plugin that is not an agent can have rooms of its own in the app: a support inbox with one room per email thread, say. It lists `WEB_APP` in its `requires` and registers from `setup`:
+
+```ts
+const app = context.service(WEB_APP);
+app.registerRoomKind({ kind: "inbox", label: "Support inbox", list, access, header, send, act, buttons, retention });
+app.registerPage({ id: "mailboxes", label: "Mailboxes", place: "settings", visible, view, act });
+```
+
+The host-facing types are exported from the package entry: `WEB_APP`, `WebApp`, `HostRoomKind`, `HostPage`, `HostCard`, `Viewer`, `OpenTarget`, `ActionResult`, `LinkProver`, `OnboardingStep` and `Notices`. Keep the `WebApp` object and read `app.rooms`, `.notices`, `.pages`, `.onboarding` and `.push` when you use them: they throw until the web plugin has started, so copying one in `setup` crashes the boot (`registerRoomKind` and `registerPage` work in `setup`). `notices.onAck` can be attached only after start.
+
+A room's key is `<surface>:<kind>.<id>`, with an id of 8 to 64 letters, digits, `-` or `_`. The kind name is lower case and none of `agent`, `group`, `thread` or `home`. Everything is checked when the web service starts.
+
+- **Access is the host's, asked every time.** `access(viewer, id)` answers `{ read, send, act }` for each read, frame, send, card answer, upload and file; `undefined` makes the room, its messages and its files a `404` for that person. `send` is `note` (a message for the room's people), `turn` (a message the room's agent answers), both, or neither; `act` lets them press buttons and run actions. `list(viewer, { filter, cursor })` returns the rooms the person may open, and `undefined` hides the kind. `changed(room)` and `accessChanged(principalId)` on `app.rooms` tell the app a header, a list or a person's access may differ.
+- **Who wrote what.** A host posts with `app.rooms.post(room, { author: { kind, name, label?, principalId?, picture? }, text, files?, reference? })`. The author kinds are `external` (someone outside, shown with the host's label such as "Customer"; plain text with links), `member`, `assistant` (an agent partner; Markdown, raw HTML shown as text) and `notice` (a line of the room's own, such as "Assigned to Mel"; Markdown). `reference` is the host's own id, unique per room, and `byReference` finds it again; `edit` and `remove` change a message. An import may give an earlier `at`, kept within retention.
+- **Recent messages.** `app.rooms.context(room, { limit?, messageChars? })` gives the room's recent messages as the same block `CHANNEL_CONTEXT.read` gives a turn (`{ messages, text }`): what was said since the assistant last posted, the newest `limit` of it (default 15, at most 100), an outsider's words marked `external`, notices left out; `undefined` when there is nothing, and a room that is not one of a registered kind throws. Use it when a turn starts from a room's `send` hook, where no message addressed the assistant. It marks nothing handed over, so a retry of the turn reads the same messages.
+- **Cards.** `app.rooms.card(room, { title, body, tone?, state?, links?, buttons? })` puts a card in the room; `updateCard` replaces it by id. A button calls the kind's `act(viewer, id, { action, card }, input)`; a button may carry a `form` (text, textarea, url, select with `initial` and `search`, multiselect), and its input is checked against the form on the server before `act` runs. `act` answers `{ ok: true, notice?, open?, url? }` or `{ ok: false, error, field? }`; `open` is a room (with a message) or a page (with a query). Buttons show only while the card's `state` is `open`, and `buttons(viewer, id, card)` (sync or async, so it can ask the host's own rights source) may narrow which ones a person sees. A card's `links` are `https` or a path of this origin. Approval and question cards of the room's agent follow the agent's own prompt scope, never `access` or `buttons`.
+- **Writing.** Where a viewer may send both a `note` and a `turn`, the room shows one `@AI` toggle over the composer's bar: off sends a note (for the room's people only), on sends a turn (the agent answers). The box's hint follows the toggle, "Write an internal note…" or "Ask AI…" (the box never names the room as a recipient), and a room remembers the way the person last wrote in. A viewer who may send one way only has no toggle and the hint of that way. A kind words it with `sendWording: { note?: { placeholder }, turn?: { label, placeholder } }`; `turn.label` replaces `@AI` on the toggle. Only text is taken: a label is cut to 40 characters and a placeholder to 100, and a value that is not text is dropped. Typing `@AI` as the first word of the box (any case, followed by a space, a colon, a comma or the end of the text) does the same as turning the toggle on: the toggle shows on, and locked, while the box starts with it and returns to the person's own setting when the token is deleted, and the page sends the message as an explicit `mode: "turn"` with that leading token (and the space, colon or comma after it) cut from the text. Only typing counts: `@AI` later in the text, inside an address such as `a@ai.com` or a longer word, in pasted or dropped text, in a restored draft or in a quote is plain text and the message stays as the toggle says. The same holds in an agent or group room that offers the switch for notes. It is the page's shorthand only: the server never reads a message's text for it, so a `note` frame whose text starts with `@AI` stays a note, and only a frame with an explicit `mode: "turn"` from a viewer who may send turns starts one. A room without the toggle takes `@AI` as plain text.
+- **Icons.** A page or a kind may give `icon`, one of `HOST_ICONS` (type `HostIconName`, both exported by the package): `chat`, `link`, `activity`, `users`, `megaphone`, `qr`, `settings`, `bell`, `file`, `list`, `shield`, `lock` and `sparkle`. A page's icon shows in the navigation (without one, a list); a kind's shows beside its section in the room list (without one, none). A name outside the list shows the default. The glyphs the first page does not draw load only when a page names one, so the first load does not grow.
+- **Links and pictures.** `app.rooms.link(room, messageId?)` gives the same-origin address that opens a room and highlights a message (`<mount>/room/<key>?message=<id>` with `routing: "path"`, `<mount>/#/room/<key>?message=<id>` with hash routing). `![alt](file:<id>)` in a card, a page or an assistant or notice message shows an image the host saved with `saveFile` (rooms) or `app.pages.saveAsset` (pages): PNG, JPEG or WebP whose bytes prove it, served only to those who may see the room or page. Anything else is shown as text.
+- **Pages.** A page is at `<mount>/p/<id>` and is built from sections: Markdown, a list of rows (each may open a link and carry buttons), a form with an action, and a card. `place` is `main` (the navigation), `settings` (the Settings pane) or `hidden`. `visible(viewer)` is asked on every fetch and action; a page that is not visible is a `404`. `app.pages.changed(id?)` sends the viewers who may see it a `page_changed` frame and their page fetches the view again.
+- **Retention.** A kind's `retention: { textDays, fileDays }` deletes its messages, author names, host cards and files that old, counted from each message's `at` (a card's from when it was first posted). Without it nothing is deleted. A card the host still wants, such as a ticket's pinned card while the ticket is open, carries `keep: true` in `card` and `updateCard`: the sweep skips it for as long as the host passes `keep: true`, and `updateCard` without it makes the card an ordinary one again.
+- **Read marks.** The page tells the app how far a person has read (the newest message in view, at most once a second, never while the page is hidden). The app keeps one cursor per person and room, for host rooms and agent rooms alike (among owners), and computes each room's `unread` from it; the list and the drawer show the count, an attention dot where the host sets `attention`, and the room opens with a "new messages" divider where the person stopped. Under each message the people who have read up to it are named: "Seen by 2", with their pictures; a person's own mark is not shown to them.
+- **The page is lazy.** The room, the lists and the pages load as separate chunks when first opened, so the app's first load is the same size as before.
+
 ## App protocol
 
 The `rooms` pane's page and any client of your own talk to the host in this protocol. A page opens one WebSocket at `<mount>/api/socket` with the subprotocol `roundtable.app.v1`. The upgrade passes the same authenticator as every request and must come from the console's own origin; the socket closes with `4401` when the credential lapses.
 
-- Page to server: `hello {visible, focus?}`, `visibility`, `focus {room?}`, `send {id, room, text, uploads?}`, `stop {room}`, `approval {prompt, approved}`, `answer {prompt, answer}`, `answers {prompt, answers, note?}`, `cancel {prompt}`.
+- Page to server: `hello {visible, focus?}`, `visibility`, `focus {room?}`, `send {id, room, text, uploads?}`, `stop {room}`, `approval {prompt, approved}`, `answer {prompt, answer}`, `answers {prompt, answers, note?}`, `cancel {prompt}`; for a host room also `subscribe {room}`, `unsubscribe {room}`, `act {id, room, action, card?, input?}` and `read {room, upTo}`.
 - Server to page: `ready {protocol, principal, name, uploads: {perMessage, maxBytes}}` (then every open card), `accepted`, `refused {id?, prompt?, code}` (`id` names a refused `send`, `prompt` a refused answer to a card), `message`, `progress` (only for the focused room), `activity {room, typing, stoppable, phase?, agent?, outcome?}` (`phase` is `working` during a tool call and `thinking` otherwise; `agent` names the member speaking in a group round; `outcome` is `done` or `failed` and comes only on the frame where `typing` turns false), `presence {agents: {<name>: {busy}}}` (after `ready` and when it changes; `busy` includes work in Discord channels), `edited` (a stored message changed its text, such as a thread's start line once the thread exists), `prompt`, `prompt_closed {prompt, outcome, note?, by?, answer?, closedAt?}`, `mode`, `auto_approved`, `changed`.
 - REST under `<mount>/api/`: `session`, `rooms`, `rooms/<key>/messages?before=&limit=` (`{messages, more, cards}`: the cards of the room that opened within the page's span, from the first message's time on, or from the beginning when `more` is false, and before the first message of the next page), `PUT rooms/<key>/mode`, `PUT rooms/<key>/mute` (body `{muted: boolean}`; the room's push is off for every owner while true; a waiting card still pushes), `PUT rooms/<key>/pin` (body `{pinned: boolean, before?: key | null}`) and `PUT rooms/<key>/folder` (body `{folder: id | null, before?: key | null}`; `before` is the room it goes before, none or an unknown room for the end; `400` for Home and a dispatch thread, `404` for an unknown room or folder), `POST folders` (body `{name}`, `201`), `PATCH folders/<id>` (body `{name?, before?: id | null}`), `DELETE folders/<id>`, `PUT folders/<id>/mute` (body `{muted: boolean}`; answers `{muted, rooms}`), all of which answer with the whole layout `{pins, folders}` (except the mute), and `GET rooms` answering `{rooms, pins, folders}`, `POST rooms/<key>/start-over`, `POST uploads`, `DELETE uploads/<id>`, `files/<id>`, `schedules` (`GET`, and `DELETE schedules/<id>`), `agents/<name>` (`GET`, `PATCH`), `GET agents/<name>/prompt-history` (`{versions}`, newest first), `GET prompts` (`{documents}`), `GET` and `PUT prompts/<id>` (body `{text, base}`; `409 {error, conflict, current}` when `base` is not the text in force), `POST prompts/<id>/revert` (body `{base}`; the same `409`), `GET prompts/<id>/history`, `GET` and `PUT skill-docs/<name>` (body `{text, baseHash}`; `409` with `current`), `POST skill-docs` (body `{text}`; `201`), `GET skill-docs/<name>/history`, `PUT agents/<name>/character` (body `{character}`, at most 4 KiB; `400 {error, field}` for a look that is not a character), `POST agents` (body `{name, displayName, prompt, model?, thinking?, task?, character?, skills?}`; `201` with the profile; `400` for what the agent server refuses, `{error, field}` for a look), `POST agents/<name>/archive`, `POST agents/<name>/restore` (the profile), `DELETE agents/<name>` (an archived agent only; `400` for an active one), `GET` and `PUT agents/<name>/skills` (`{skills: [{name, description?, source, builtin, carried, missing?}]}`; the body of `PUT` is `{add?, remove?}`, one change that an unknown or built-in name refuses whole; `404` when the host has no skills), `POST groups` (body `{name, displayName, members, host?}`; `201`), `GET`, `PATCH` (`{displayName?, members?, host?}`) and `DELETE groups/<name>`, `POST groups/<name>/archive` and `POST groups/<name>/restore`, `GET archive` (`{entries}`: the archived agents and groups), `models`, `workspace` (the [files pane](#the-files-pane)'s calls), and for push `GET push/key`, `GET`, `POST` and `DELETE push/subscriptions` and `DELETE push/subscriptions/<id>`. The agents' pictures are at `<mount>/avatars/<hash>.png`.
-- Beside the API: `<mount>/manifest.webmanifest`, `<mount>/sw.js`, `<mount>/icons/<name>.png`, `<mount>/theme-init.js`, and in password mode `<mount>/login`, `POST <mount>/auth/login` and `POST <mount>/auth/logout`.
+- Beside the API: `<mount>/manifest.webmanifest`, `<mount>/sw.js`, `<mount>/icons/<name>.png` (and `mark.svg`), `<mount>/theme-init.js`, and in password mode `<mount>/login`, `POST <mount>/auth/login` and `POST <mount>/auth/logout`.
 
 A room key from a page must be one of the app's rooms whose agent or group exists; every other key, Discord's included, is refused. Every write needs an owner, whose tier is read again, and REST writes also need the console's `Origin`. A card can be answered by any owner, except a card that is the speaker's alone, which only the speaker's principal answers. After `cardGraceSeconds` (default 120) a turn goes on without the answer and the card stays open for a day; an answer then starts a new turn in the room. The types are in `src/api-types.ts`.
 

package/dist/account-zk4efb87.css

@@ -0,0 +1,102 @@
+/* The account pages (notices, onboarding, profile) and the bell. Loaded with the first of them, not with the first page. */
+.bell {
+	position: relative;
+}
+.bell-count {
+	position: absolute;
+	top: 0.25rem;
+	right: 0.15rem;
+	min-width: 1.05rem;
+	padding: 0 0.28rem;
+	border-radius: var(--radius-full);
+	background: var(--warn);
+	color: var(--bg);
+	font-size: 0.65rem;
+	font-weight: var(--weight-bold);
+	line-height: 1.05rem;
+	text-align: center;
+}
+.notices {
+	list-style: none;
+	margin: 0;
+	padding: 0;
+}
+.notice[data-urgent] {
+	border-color: var(--warn);
+}
+.steps {
+	margin: 0;
+	padding: 0;
+	list-style: none;
+	display: flex;
+	flex-direction: column;
+	gap: var(--space-3);
+}
+.steps > li {
+	display: flex;
+	flex-direction: column;
+	align-items: flex-start;
+	gap: var(--space-2);
+	padding-left: var(--space-3);
+	border-left: 3px solid var(--border);
+}
+.steps > li[data-done] {
+	border-left-color: var(--accent);
+}
+.who {
+	display: flex;
+	align-items: center;
+	gap: var(--space-3);
+}
+.who-picture {
+	width: 3.5rem;
+	height: 3.5rem;
+	border-radius: var(--radius-full);
+	object-fit: cover;
+	background: var(--surface-2);
+}
+.who-initial {
+	display: inline-flex;
+	align-items: center;
+	justify-content: center;
+	width: 3.5rem;
+	height: 3.5rem;
+	border-radius: var(--radius-full);
+	background: var(--accent-soft);
+	color: var(--accent);
+	font-size: 1.4rem;
+	font-weight: var(--weight-bold);
+}
+.link-code {
+	display: block;
+	width: fit-content;
+	font-family: var(--mono, ui-monospace, monospace);
+	font-size: 1.6rem;
+	letter-spacing: 0.15em;
+	padding: var(--space-2) var(--space-3);
+	border: 1px dashed var(--border);
+	border-radius: var(--radius);
+	user-select: all;
+}
+.choice {
+	display: flex;
+	flex-direction: column;
+	gap: var(--space-2);
+	border: 0;
+	padding: 0;
+	margin: 0;
+}
+.choice label {
+	display: flex;
+	flex-direction: row;
+	justify-content: flex-start;
+	align-items: center;
+	gap: var(--space-2);
+	min-height: var(--touch);
+}
+.quiet-row {
+	display: flex;
+	flex-wrap: wrap;
+	gap: var(--space-3);
+	align-items: center;
+}

package/dist/chunk-account-ghq105t4.js

@@ -0,0 +1 @@
+import{h,M,w,e,x}from"./chunk-index-zynq0b0w.js";var a={profile:w(()=>(h("6qemf3m7"),import("./chunk-profile-6qemf3m7.js")).then((o)=>({default:o.ProfilePage}))),notices:w(()=>(h("x07da5bb"),import("./chunk-notices-x07da5bb.js")).then((o)=>({default:o.NoticesPage}))),onboarding:w(()=>(h("csrkbh9z"),import("./chunk-onboarding-csrkbh9z.js")).then((o)=>({default:o.OnboardingPage})))};function n({pane:o}){let t=a[o];return t?e(M,{fallback:e(x,{}),children:e(t,{})}):null}export{n as default};

package/dist/chunk-action-menu-me0g9qsc.js

@@ -0,0 +1 @@
+import{a,yt,o,r,m,e,n,s,an,hs}from"./chunk-index-zynq0b0w.js";import{I}from"./chunk-index-vcyzwtk2.js";var k=()=>typeof matchMedia==="function"&&matchMedia("(max-width: 719px)").matches,x={rtMenu:!0},g=()=>Boolean(window.history.state?.rtMenu),E=8,y=(t)=>t?.isConnected?t:null;function b(t){return t.items.map((u)=>n("button",{type:"button",role:u.checked===void 0?"menuitem":"menuitemcheckbox",...u.checked===void 0?{}:{"aria-checked":u.checked},className:"menu-item menu-link","data-tone":u.tone,onClick:()=>t.onChoose(u),children:[u.icon?e("span",{className:"menu-icon","data-tone":u.tone,children:e(s,{name:u.icon,size:18})}):null,e("span",{className:"menu-text",children:e("strong",{children:u.label})}),u.checked?e(s,{name:"check",size:18,className:"menu-check"}):null]},u.id))}function H({menu:t}){let u=o(void 0);if(t)u.current=t;let c=u.current,f=o(!1),v=o(void 0),p=t?.serial;return a(()=>{if(p===void 0)return;return window.history.pushState(x,"",window.location.href),f.current=!0,()=>{if(f.current)f.current=!1,window.history.back()}},[p]),a(()=>{let h=()=>{if(!f.current||g())return;f.current=!1,an();let M=v.current;v.current=void 0,M?.()};return window.addEventListener("popstate",h),()=>window.removeEventListener("popstate",h)},[]),e(I,{open:t!==void 0,title:c?.title??"",onClose:an,restoreFocus:()=>y(c?.source??null),children:c?e("div",{className:"menu action-items",role:"menu","aria-label":c.title,children:e(b,{items:c.items,onChoose:(h)=>{if(!f.current){an(),h.run();return}v.current=h.run,window.history.back()}})}):null})}function T({menu:t}){let u=o(null),[c,f]=r(t.at),{source:v}=t,p=(i)=>{y(v)?.focus(),an(),i?.()},h=o(p);h.current=p,yt(()=>{let i=u.current;if(!i)return;let d=i.getBoundingClientRect();f({x:Math.max(E,Math.min(t.at.x,window.innerWidth-d.width-E)),y:Math.max(E,Math.min(t.at.y,window.innerHeight-d.height-E))}),i.querySelector('[role^="menuitem"]')?.focus()},[t.serial]),a(()=>{let i=(l)=>{if(l.target instanceof Node&&u.current?.contains(l.target))return;an()},d=()=>an();return document.addEventListener("pointerdown",i,!0),document.addEventListener("wheel",i,{capture:!0,passive:!0}),document.addEventListener("touchmove",i,{capture:!0,passive:!0}),window.addEventListener("resize",d),()=>{document.removeEventListener("pointerdown",i,!0),document.removeEventListener("wheel",i,!0),document.removeEventListener("touchmove",i,!0),window.removeEventListener("resize",d)}},[]);let M=(i)=>{let d=[...u.current?.querySelectorAll('[role^="menuitem"]')??[]],l=d.indexOf(document.activeElement),w=(L)=>{i.preventDefault(),d[(L+d.length)%d.length]?.focus()};switch(i.key){case"Escape":i.preventDefault(),i.stopPropagation(),h.current();return;case"ArrowDown":return w(l+1);case"ArrowUp":return w(l<0?-1:l-1);case"Tab":return w(i.shiftKey?l<0?-1:l-1:l+1);case"Home":return w(0);case"End":return w(-1)}};return e("div",{ref:u,className:"action-popover",role:"menu","aria-label":t.title,tabIndex:-1,style:{left:`${c.x}px`,top:`${c.y}px`},onKeyDown:M,children:e(b,{items:t.items,onChoose:(i)=>p(i.run)})})}function O(){let t=hs(),u=o(void 0);if(t&&u.current?.serial!==t.serial)u.current={serial:t.serial,sheet:k()};let c=Boolean(t&&u.current?.sheet);return n(m,{children:[e(H,{menu:c?t:void 0}),t&&!c?e(T,{menu:t},t.serial):null]})}export{O as ActionMenuHost};

package/dist/{chunk-agent-0pm9p3nn.js → chunk-agent-rdv7ekrt.js}

@@ -1 +1 @@
-import{s,e,H,d,x,De}from"./chunk-index-31wh5twj.js";function g({name:o}){let i=d((t)=>t.listed),r=d((t)=>Object.values(t.rooms).find((m)=>m.view?.kind==="agent"&&m.view.name===o)?.view?.key,o);return s(()=>{if(r)H("room",r,{replace:!0}),De(o);else if(i)H("rooms",void 0,{replace:!0})},[r,i,o]),e("div",{className:"page",children:e(x,{})})}export{g as AgentPage};
+import{a,e,K,d,x,Ye}from"./chunk-index-zynq0b0w.js";function g({name:o}){let i=d((t)=>t.listed),r=d((t)=>Object.values(t.rooms).find((m)=>m.view?.kind==="agent"&&m.view.name===o)?.view?.key,o);return a(()=>{if(r)K("room",r,{replace:!0}),Ye(o);else if(i)K("rooms",void 0,{replace:!0})},[r,i,o]),e("div",{className:"page",children:e(x,{})})}export{g as AgentPage};

package/dist/chunk-arranged-rooms-81rqhx9x.js

@@ -0,0 +1 @@
+import{h,M,w,J,A,o,t,m,e,n,s,Ie,d,_,k,ye,Bt,ln,ne,Mi,Kn,ur,Tn,Jn,dr}from"./chunk-index-zynq0b0w.js";import{Me}from"./chunk-index-wrm8w165.js";import{In,Dn,Un,Xt}from"./chunk-index-2yebd9tb.js";import{Ln}from"./chunk-index-4t0r3t3b.js";import{Rt}from"./chunk-index-zrvg23jd.js";In();var O=w(()=>(h("era3tksh"),import("./chunk-folder-list-era3tksh.js")).then((a)=>({default:a.FolderList}))),Z=J(function(c){let{view:r}=c,p=Xt(()=>Bt(r.key),r.home?void 0:Dn(r.key));return e(ur,{...c,press:p,item:{...r.home?{}:{"data-drop-item":"","data-key":r.key},...c.arranging?{"data-arranging":""}:{}},after:c.arranging?e("button",{type:"button",className:"icon-button row-more","aria-haspopup":"menu","aria-label":t("Room menu"),onClick:(u)=>{let g=u.currentTarget;Bt(r.key).then((i)=>{if(!i)return;let y=g.getBoundingClientRect();ye({...i,at:{x:y.left,y:y.bottom},via:"key",source:g})},()=>{return})},children:e(s,{name:"more",size:18})}):null})});function P(a){let{now:c}=ne(),{timeZone:r}=k(),p=Tn(a.rooms);return e("ul",{className:"room-list",children:p.map(({key:u,...g})=>{let i=a.threads[u];return e(Z,{...g,active:u===a.active,now:c,timeZone:r,arranging:a.arranging,...i?{threads:e(Jn,{open:i.open,closed:i.closed,active:a.active,parent:u})}:{}},u)})})}function v(a){let r=Tn(a.rooms).length===0;if(r&&a.zone?.kind!=="pinned")return null;return n("section",{className:"stack",...r?{"data-empty":""}:{},...a.zone?{"data-drop-zone":a.zone.kind,"data-zone-id":a.zone.id}:{},children:[e("h2",{className:"section-title",children:a.title}),r?null:e(P,{rooms:a.rooms,threads:a.threads,active:a.active,arranging:a.arranging})]})}function re(a){let c=Boolean(k().kinds?.length),r=d((l)=>JSON.stringify({listed:l.listed,...Rt(l,(K)=>Ie(l,K))})),p=Un(),u=o(r);if(!p)u.current=r;let g=u.current,{listed:i,...y}=A(()=>JSON.parse(g),[g]),{home:z,pinned:S,folders:N,restAgents:T,restGroups:D,rest:C,threads:L,orphans:f}=y,R=Mi(),F=z.length+S.length+C.length===0&&N.every((l)=>l.rooms.length===0)&&f.open.length+f.closed.length===0,b={threads:L,active:a.active,arranging:R};return n("div",{className:"page","data-column":a.active?"":void 0,"data-drop-root":"",children:[n("header",{className:"page-head",children:[e("h1",{children:t("Rooms")}),n("div",{className:"actions",children:[n("button",{type:"button",className:"header-button search-button",onClick:a.onSearch,children:[e(s,{name:"search",size:16}),e("span",{children:t("Find a room")}),e("kbd",{children:"⌘K"})]}),i?e("button",{type:"button",className:"header-button icon-button","aria-haspopup":"menu","aria-label":t("Folders and order"),onClick:(l)=>Ln(l.currentTarget),children:e(s,{name:"more",size:18})}):null,e("button",{type:"button",className:"header-button icon-button","aria-label":t("Add"),"aria-haspopup":"menu",onClick:(l)=>ln(l.currentTarget),children:e(s,{name:"plus"})})]})]}),R?n("div",{className:"arrange-bar",children:[n("button",{type:"button",className:"secondary",onClick:()=>Me({kind:"new"}),children:[e(s,{name:"plus",size:16}),e("span",{children:t("Add a folder")})]}),e("button",{type:"button",onClick:()=>Kn(!1),children:t("Done")})]}):null,i&&F&&!c?e(_,{children:t("No rooms yet. Rooms appear when the team has an agent.")}):null,!i?n("div",{className:"stack","aria-busy":"true",children:[e("div",{className:"skeleton"}),e("div",{className:"skeleton"}),e("div",{className:"skeleton"})]}):null,e(v,{title:t("Home"),rooms:z,...b}),e(v,{title:t("Pinned"),rooms:S,zone:{kind:"pinned",id:"pinned"},...b}),N.length>0?e("div",{className:"stack folder-list","data-folder-list":"",children:e(M,{fallback:e("div",{className:"skeleton","aria-busy":"true"}),children:e(O,{folders:N,active:a.active,listed:i,rooms:(l)=>e(P,{rooms:l,threads:L,active:a.active,arranging:R})})})}):null,N.length>0?e(v,{title:t("Ungrouped"),rooms:C,zone:{kind:"rest",id:"rest"},...b}):n(m,{children:[e(v,{title:t("Agents"),rooms:T,zone:{kind:"rest",id:"rest-agents"},...b}),e(v,{title:t("Groups"),rooms:D,zone:{kind:"rest",id:"rest-groups"},...b})]}),f.open.length+f.closed.length>0?n("section",{className:"stack",children:[e("h2",{className:"section-title",children:t("Dispatch threads")}),e(Jn,{open:f.open,closed:f.closed,active:a.active})]}):null,e(dr,{active:a.active})]})}export{re as ArrangedRoomsPage};