pi-roundtable-web 0.28.0 → 0.29.1

package/src/app/queued-frames.ts

@@ -0,0 +1,115 @@
+import type { ChannelKey, ConversationPort } from "pi-roundtable";
+import {
+	type ClientFrame,
+	MAX_MESSAGE_CHARS,
+	type RefusalCode,
+} from "../api-types.ts";
+import type { Answerer } from "./desk.ts";
+import { coreMessageId } from "./queued-delivery.ts";
+import type { Rooms } from "./rooms.ts";
+import type { AppSurface } from "./surface.ts";
+
+export interface QueuedFrameDeps {
+	rooms: Pick<Rooms, "resolve">;
+	surface: Pick<AppSurface, "delivery" | "edit">;
+	conversations: Pick<ConversationPort, "cancelQueued" | "editQueued">;
+}
+
+/**
+ * An owner's request to edit or cancel a message of theirs that waits for its turn. The room must
+ * be one of the app's, the message theirs, and the host must still hold it in the queue: once its
+ * turn has started the answer is `not_queued`, and nothing changes. An edit shows the new text in
+ * the room as an edited message; a cancel keeps the message, marked cancelled.
+ */
+export async function changeQueued(
+	frame: Extract<ClientFrame, { type: "edit_queued" | "cancel_queued" }>,
+	who: Answerer,
+	deps: QueuedFrameDeps,
+): Promise<RefusalCode | undefined> {
+	if (who.tier !== "owner") return "forbidden";
+	const room = await deps.rooms.resolve(frame.room);
+	if (!room) return "unknown_room";
+	if (room.readOnly) return "read_only";
+	return inTurn(deps.surface, room.key, () =>
+		apply(frame, who, deps, room.key),
+	);
+}
+
+/** The changes of one room per surface, each waiting for the one before it. */
+const lines = new WeakMap<
+	QueuedFrameDeps["surface"],
+	Map<string, Promise<unknown>>
+>();
+
+/**
+ * Runs `change` after every change already asked for in the room has finished. The host takes an
+ * edit at once but the room's log is written a moment later; two edits from two sockets would
+ * otherwise land in the log in either order, and the room would show a text the turn does not use.
+ */
+function inTurn<T>(
+	owner: QueuedFrameDeps["surface"],
+	room: string,
+	change: () => Promise<T>,
+): Promise<T> {
+	let rooms = lines.get(owner);
+	if (!rooms) {
+		rooms = new Map();
+		lines.set(owner, rooms);
+	}
+	const before = rooms.get(room) ?? Promise.resolve();
+	const result = before.then(change, change);
+	const tail = result.catch(() => undefined);
+	rooms.set(room, tail);
+	// A room with nothing waiting leaves no entry behind.
+	tail.then(() => {
+		if (rooms.get(room) === tail) rooms.delete(room);
+	});
+	return result;
+}
+
+async function apply(
+	frame: Extract<ClientFrame, { type: "edit_queued" | "cancel_queued" }>,
+	who: Answerer,
+	deps: QueuedFrameDeps,
+	roomKey: ChannelKey,
+): Promise<RefusalCode | undefined> {
+	const room = { key: roomKey };
+	const stored = await deps.surface.delivery.stored(room.key, frame.message);
+	if (stored?.kind !== "owner") return "not_queued";
+	if (stored.principalId !== who.principalId) return "forbidden";
+	const by = { principalId: who.principalId };
+	const messageId = coreMessageId(stored.id);
+	if (frame.type === "cancel_queued")
+		return refusalOf(
+			await deps.surface.delivery.cancel(
+				room.key,
+				stored.id,
+				() =>
+					deps.conversations.cancelQueued?.(room.key, messageId, by) ??
+					"unknown",
+			),
+		);
+	const text = frame.text.trim();
+	if (text.length > MAX_MESSAGE_CHARS) return "too_long";
+	if (text === "" && stored.files.length === 0) return "empty";
+	const change =
+		deps.conversations.editQueued?.(room.key, messageId, by, text) ?? "unknown";
+	if (change === "done")
+		await deps.surface.edit(room.key, stored.id, text, true);
+	return refusalOf(change);
+}
+
+function refusalOf(
+	change: "done" | "unknown" | "forbidden" | "refused",
+): RefusalCode | undefined {
+	switch (change) {
+		case "done":
+			return undefined;
+		case "unknown":
+			return "not_queued";
+		case "forbidden":
+			return "forbidden";
+		case "refused":
+			return "not_accepted";
+	}
+}

package/src/app/room-log.ts

@@ -8,7 +8,7 @@ import {
 	type RoomMessage,
 	START_OVER_TEXT,
 } from "../api-types.ts";
-import { storedJson } from "../host/stored-json.ts";
+import { jsonValuesMigration, storedJson } from "../host/stored-json.ts";
 
 /** A message to store; the log numbers it and stamps its time. */
 export interface NewRoomMessage {
@@ -49,6 +49,7 @@ interface Row {
 	edited_at: Date | null;
 	note: boolean | null;
 	intercom?: RoomIntercom | string | null;
+	delivery: "steered" | "cancelled" | null;
 }
 
 /** The most messages one page of history holds. */
@@ -78,6 +79,7 @@ function messageOf(row: Row): RoomMessage {
 		...(row.intercom == null
 			? {}
 			: { intercom: storedJson(row.intercom, "intercom card") }),
+		...(row.delivery === null ? {} : { delivery: row.delivery }),
 	};
 }
 
@@ -94,6 +96,13 @@ export class RoomLog {
 		this.#sql = sql;
 	}
 
+	/** Its jsonb columns stored as the JSON values themselves, not as the text of them. */
+	static readonly jsonValuesMigration: Migration = jsonValuesMigration(
+		"web-room-messages-json-values",
+		"web_room_messages",
+		["files", "picture", "intercom"],
+	);
+
 	/** The log's table. */
 	static readonly migration: Migration = {
 		name: "web-room-messages",
@@ -152,6 +161,14 @@ export class RoomLog {
 		},
 	};
 
+	/** The column that records how an owner message sent during a turn went: steered into it, or cancelled while it waited. */
+	static readonly deliveryMigration: Migration = {
+		name: "web-room-messages-delivery",
+		up: async (sql) => {
+			await sql`ALTER TABLE web_room_messages ADD COLUMN IF NOT EXISTS delivery text`;
+		},
+	};
+
 	async append(message: NewRoomMessage): Promise<RoomMessage> {
 		const [row] = await this.#insert(message, false);
 		if (!row) throw new Error("the room log stored nothing");
@@ -184,18 +201,18 @@ export class RoomLog {
 				INSERT INTO web_room_messages (room, kind, principal_id, agent, author_name, text, files,
 					author_kind, author_label, picture, reference, created_at, note, intercom)
 				VALUES (${message.room}, ${message.kind}, ${message.principalId ?? null},
-					${message.agent ?? null}, ${message.author}, ${message.text}, ${files}::jsonb,
-					${message.authorKind ?? null}, ${message.authorLabel ?? null}, ${picture}::jsonb,
-					${message.reference ?? null}, ${at}, ${message.note === true}, ${intercom}::jsonb)
+					${message.agent ?? null}, ${message.author}, ${message.text}, ${files}::text::jsonb,
+					${message.authorKind ?? null}, ${message.authorLabel ?? null}, ${picture}::text::jsonb,
+					${message.reference ?? null}, ${at}, ${message.note === true}, ${intercom}::text::jsonb)
 				ON CONFLICT (room, reference) WHERE reference IS NOT NULL DO NOTHING
 				RETURNING *`
 			: await this.#sql`
 				INSERT INTO web_room_messages (room, kind, principal_id, agent, author_name, text, files,
 					author_kind, author_label, picture, reference, created_at, note, intercom)
 				VALUES (${message.room}, ${message.kind}, ${message.principalId ?? null},
-					${message.agent ?? null}, ${message.author}, ${message.text}, ${files}::jsonb,
-					${message.authorKind ?? null}, ${message.authorLabel ?? null}, ${picture}::jsonb,
-					${message.reference ?? null}, ${at}, ${message.note === true}, ${intercom}::jsonb)
+					${message.agent ?? null}, ${message.author}, ${message.text}, ${files}::text::jsonb,
+					${message.authorKind ?? null}, ${message.authorLabel ?? null}, ${picture}::text::jsonb,
+					${message.reference ?? null}, ${at}, ${message.note === true}, ${intercom}::text::jsonb)
 				RETURNING *`;
 	}
 
@@ -219,6 +236,21 @@ export class RoomLog {
 		return row && messageOf(row);
 	}
 
+	/**
+	 * Records how a message sent during a turn went (`steered`, `cancelled`), or clears it; the
+	 * message as it is now, or undefined when the room holds none.
+	 */
+	async setDelivery(
+		room: string,
+		id: number,
+		delivery: "steered" | "cancelled" | null,
+	): Promise<RoomMessage | undefined> {
+		const [row]: Row[] = await this.#sql`
+			UPDATE web_room_messages SET delivery = ${delivery}
+			WHERE id = ${id} AND room = ${room} RETURNING *`;
+		return row && messageOf(row);
+	}
+
 	/** The message the host's reference names, if the room holds one. */
 	async byReference(
 		room: string,

package/src/app/rooms.ts

@@ -13,6 +13,7 @@ import {
 	channelKey,
 	characterOf,
 	groupRoomKey,
+	helperSurface,
 	isHelper,
 	roomOf,
 } from "pi-roundtable";
@@ -74,6 +75,8 @@ const THREAD_ID = /^thread\.[0-9a-f-]{36}$/;
  */
 export class Rooms {
 	readonly #options: RoomsOptions;
+	/** The rooms of temp knights made on Discord that someone opened by their address here. */
+	readonly #opened = new Set<string>();
 
 	constructor(options: RoomsOptions) {
 		this.#options = options;
@@ -204,6 +207,19 @@ export class Rooms {
 		};
 	}
 
+	/**
+	 * The view of a temp knight's room that the list leaves out, opened by its address: from then on
+	 * the list shows it. Undefined for any other room.
+	 */
+	async openHelper(key: ChannelKey): Promise<RoomView | undefined> {
+		const room = await this.resolve(key);
+		if (room?.kind !== "agent") return undefined;
+		const agent = this.#options.directory.agent(room.name);
+		if (helperSurface(agent) !== "discord") return undefined;
+		this.#opened.add(room.name);
+		return (await this.list()).find((one) => one.key === key);
+	}
+
 	async list(): Promise<RoomView[]> {
 		const { surface, directory, modes, mutes, activity, log, threads } =
 			this.#options;
@@ -274,9 +290,21 @@ export class Rooms {
 		// Home first; the others keep the team's order.
 		rooms.sort((a, b) => Number(b.home) - Number(a.home));
 		const last = await log.lastOf(rooms.map((room) => room.key));
-		return rooms.map((room) => {
+		// A temp knight made on Discord works there: its room here shows once it has a message or
+		// someone opened it by its address.
+		const quiet = new Set<string>(
+			agents
+				.filter(
+					(agent) =>
+						helperSurface(agent) === "discord" && !this.#opened.has(agent.name),
+				)
+				.map((agent) => agentRoomKey(surface, agent.name))
+				.filter((key) => !last.has(key)),
+		);
+		return rooms.flatMap((room) => {
+			if (quiet.has(room.key)) return [];
 			const message = last.get(room.key);
-			return message ? { ...room, last: message } : room;
+			return [message ? { ...room, last: message } : room];
 		});
 	}
 }

package/src/app/routes.ts

@@ -60,6 +60,7 @@ import { PromptApi, type PromptApiOptions } from "./prompt-routes.ts";
 import { PAGE_LIMIT, type RoomLog } from "./room-log.ts";
 import { type ResolvedRoom, type Rooms, roomModeOf } from "./rooms.ts";
 import { SkillDocApi } from "./skill-doc-routes.ts";
+import { SkillGroupApi } from "./skill-group-routes.ts";
 import type { AppSurface } from "./surface.ts";
 import { TeamApi } from "./team-routes.ts";
 import type { WebThreads } from "./threads.ts";
@@ -70,15 +71,40 @@ import {
 	type WorkspaceFiles,
 	WorkspaceRefusal,
 } from "./workspace-files.ts";
+import { uniqueNames, zipStore } from "./zip.ts";
 
 /** The most threads one request puts back on the room list: more than the list ever shows. */
 const MAX_RESTORED = 100;
+/** The most bytes a message's files may add up to and still be zipped together: 200 MB. */
+const MAX_ZIP_BYTES = 200 * 1024 * 1024;
+
+/** A message's zip, named after when it was sent on the host's clock: `attachments-20261031-2030.zip`. */
+export const zipName = (at: Date, timeZone = "UTC"): string => {
+	if (Number.isNaN(at.getTime())) return "attachments.zip";
+	const part = Object.fromEntries(
+		new Intl.DateTimeFormat("en-CA", {
+			timeZone,
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit",
+			hour: "2-digit",
+			minute: "2-digit",
+			hourCycle: "h23",
+		})
+			.formatToParts(at)
+			.map(({ type, value }) => [type, value]),
+	);
+	return `attachments-${part.year}${part.month}${part.day}-${part.hour}${part.minute}.zip`;
+};
+
 /** The most rooms one bulk request names. */
 const MAX_BULK_ROOMS = MAX_READ_ALL;
 
 export interface AppApiOptions {
 	/** The host's wording: a refusal reaches a client of the API in this locale when the catalog has it. */
 	presentation?: ConsolePresentation;
+	/** The host's IANA time zone, for the date in a zip's name; absent = UTC. */
+	timeZone?: string;
 	surface: AppSurface;
 	rooms: Rooms;
 	log: Pick<RoomLog, "page" | "lastOf" | "removeRoom" | "get" | "startOver">;
@@ -142,6 +168,8 @@ export interface AppApiOptions {
 			| "documentHistory"
 			| "delete"
 		>;
+		/** The registry's skill groups: listed, saved and deleted. */
+		groups: Pick<SkillRegistry, "groups" | "setGroup" | "deleteGroup">;
 	};
 	/** Present when the host has prompt documents (the prompts plugin): the main prompts the owner edits. */
 	prompts?: PromptApiOptions["prompts"];
@@ -285,6 +313,7 @@ export class AppApi {
 	readonly #helpers: HelperRoutes;
 	readonly #prompts: PromptApi | undefined;
 	readonly #skillDocs: SkillDocApi | undefined;
+	readonly #skillGroups: SkillGroupApi | undefined;
 
 	constructor(options: AppApiOptions) {
 		this.#options = options;
@@ -311,6 +340,17 @@ export class AppApi {
 					catalog: () => options.skills?.catalog() ?? [],
 				})
 			: undefined;
+		const skills = options.skills;
+		this.#skillGroups = skills
+			? new SkillGroupApi({
+					groups: skills.groups,
+					catalog: () => skills.catalog(),
+					attach: (agent, add, remove) => skills.attach(agent, add, remove),
+					active: (agent) =>
+						options.directory.agent(agent)?.status === "active",
+					changed: () => options.changed(),
+				})
+			: undefined;
 		this.#team = new TeamApi({
 			surface: options.surface.surface,
 			rooms: options.rooms,
@@ -394,6 +434,7 @@ export class AppApi {
 					"workspace",
 					"prompts",
 					"skill-docs",
+					"skill-groups",
 				].includes(second ?? ""));
 		if (!mine) return undefined;
 		try {
@@ -473,6 +514,8 @@ export class AppApi {
 				throw notFound();
 			return json({ ok: true });
 		}
+		if (area === "files" && method === "GET" && id === "zip" && !action)
+			return await this.#messageZip(request, admission);
 		if (area === "files" && method === "GET" && id && !action)
 			return await this.#file(id, admission);
 		if (area === "workspace") return this.#workspace(request, parts, admission);
@@ -492,6 +535,11 @@ export class AppApi {
 				throw new HttpError(404, "This host has no skills.");
 			return this.#skillDocs.handle(request, parts, owner);
 		}
+		if (area === "skill-groups") {
+			if (!this.#skillGroups)
+				throw new HttpError(404, "This host has no skills.");
+			return this.#skillGroups.handle(request, parts, owner);
+		}
 		throw new HttpError(404, "There is no such API.");
 	}
 
@@ -565,8 +613,11 @@ export class AppApi {
 		const room = await rooms.resolve(key);
 		if (!room) throw notFound();
 		if (!action && method === "GET") {
-			// A thread dismissed from the list still opens by its address; the page asks for its view.
-			const view = await rooms.threadView(room.key);
+			// A thread dismissed from the list, or a temp knight's room the list leaves out, still opens
+			// by its address; the page asks for its view.
+			const view =
+				(await rooms.threadView(room.key)) ??
+				(await rooms.openHelper(room.key));
 			if (!view) throw notFound();
 			return json({ room: view } satisfies RoomOneView);
 		}
@@ -609,7 +660,10 @@ export class AppApi {
 			const cursor = await reads?.cursorOf(room.key, self);
 			return json({
 				...page,
-				messages: withExpiredFiles(page.messages, this.#options.files),
+				messages: withExpiredFiles(
+					page.messages.map((one) => this.#options.surface.delivery.shown(one)),
+					this.#options.files,
+				),
 				cards: await cards.during(room.key, {
 					...(first && (page.more || isStartOver(first))
 						? { from: first.at }
@@ -843,6 +897,16 @@ export class AppApi {
 
 	async #file(id: string, admission: Authenticated): Promise<Response> {
 		if (!isFileId(id)) throw notFound();
+		await this.#mayServe(id, admission);
+		const { files } = this.#options;
+		const meta = files.meta(id);
+		const blob = files.blob(id);
+		if (!meta || !blob) throw notFound();
+		return fileResponse(meta, blob);
+	}
+
+	/** Refuses, as a missing file, a stored file the visitor may not be served. */
+	async #mayServe(id: string, admission: Authenticated): Promise<void> {
 		const { files, host } = this.#options;
 		// A file bound to a host room or page is for the people it is open to, owners too; every other stored file belongs to an agent room, which only owners read.
 		const bound = files.binding(id)?.room;
@@ -853,10 +917,62 @@ export class AppApi {
 			!(await host.mayRead(viewerOf(admission.visitor), bound))
 		)
 			throw notFound();
-		const meta = files.meta(id);
-		const blob = files.blob(id);
-		if (!meta || !blob) throw notFound();
-		return fileResponse(meta, blob);
+	}
+
+	/**
+	 * `GET api/files/zip?room=<room>&message=<id>`: the message's files still kept, as one zip.
+	 * The room and every file answer as the single file does; a refusal is a missing message.
+	 */
+	async #messageZip(
+		request: Request,
+		admission: Authenticated,
+	): Promise<Response> {
+		const params = new URL(request.url).searchParams;
+		const room = params.get("room") ?? "";
+		const id = Number(params.get("message"));
+		if (room === "" || !Number.isSafeInteger(id) || id <= 0) throw notFound();
+		const { files, host, log } = this.#options;
+		const mayReadRoom =
+			admission.visitor.tier === "owner" ||
+			(host !== undefined &&
+				(await host.mayRead(viewerOf(admission.visitor), room)));
+		if (!mayReadRoom) throw notFound();
+		const message = await log.get(room, id);
+		if (!message) throw notFound();
+		// Only the files still kept: a swept file has no binding left to check it by.
+		const kept = message.files.flatMap((file) => {
+			const meta = isFileId(file.id) ? files.meta(file.id) : undefined;
+			const blob = meta && files.blob(file.id);
+			return meta && blob ? [{ id: file.id, meta, blob }] : [];
+		});
+		for (const file of kept) await this.#mayServe(file.id, admission);
+		if (kept.length === 0)
+			throw new HttpError(
+				404,
+				"None of this message's files are kept any more.",
+			);
+		const total = kept.reduce((sum, { blob }) => sum + blob.size, 0);
+		if (total > MAX_ZIP_BYTES)
+			throw new HttpError(
+				413,
+				"These files are too large to download together; download them one by one.",
+			);
+		const names = uniqueNames(kept.map(({ meta }) => meta.name));
+		const entries = await Promise.all(
+			kept.map(async ({ blob }, i) => ({
+				name: names[i] ?? "file",
+				data: new Uint8Array(await blob.arrayBuffer()),
+			})),
+		);
+		const at = new Date(message.at);
+		return new Response(zipStore(entries, at), {
+			headers: {
+				"content-type": "application/zip",
+				"content-disposition": `attachment; filename="${zipName(at, this.#options.timeZone)}"`,
+				"cache-control": "private, no-store",
+				"x-content-type-options": "nosniff",
+			},
+		});
 	}
 
 	/** The workspace files pane's API; every call, a read too, is an owner's. */

package/src/app/skill-group-routes.ts

@@ -0,0 +1,126 @@
+import type { SkillRegistry } from "pi-roundtable";
+import type {
+	SkillGroupApplied,
+	SkillGroupApply,
+	SkillGroupChanged,
+	SkillGroupSave,
+	SkillGroupsView,
+	SkillView,
+} from "../api-types.ts";
+import { json } from "../http.ts";
+import {
+	bad,
+	bodyOf,
+	HttpError,
+	optionalList,
+	optionalText,
+	requiredText,
+} from "./api-http.ts";
+import type { OwnerOf } from "./team-routes.ts";
+
+export interface SkillGroupApiOptions {
+	groups: Pick<SkillRegistry, "groups" | "setGroup" | "deleteGroup">;
+	/** The catalog the page lists: who carries each skill, and which are built in. */
+	catalog(): SkillView[];
+	/** The same change the per-skill toggle makes. */
+	attach(
+		agent: string,
+		add: readonly string[],
+		remove: readonly string[],
+	): Promise<string[]>;
+	/** Whether a knight answers; an archived or unknown one is a 404. */
+	active(agent: string): boolean;
+	changed(): void;
+}
+
+/**
+ * The app's REST for skill groups: listing them, creating or replacing one, deleting one, and
+ * applying one to a knight. Applying switches on the group's skills the knight lacks through the
+ * per-skill toggle's path; applying it off switches off the group's skills the knight carries, built-in
+ * ones excepted. The knight carries skills, not the group.
+ * Every call is an owner's; the registry's refusals are a 400 in its words.
+ */
+export class SkillGroupApi {
+	readonly #options: SkillGroupApiOptions;
+
+	constructor(options: SkillGroupApiOptions) {
+		this.#options = options;
+	}
+
+	async handle(
+		request: Request,
+		parts: string[],
+		owner: OwnerOf,
+	): Promise<Response> {
+		const { method } = request;
+		const [, , name, action] = parts;
+		const { groups } = this.#options;
+		// The tier is read first, so a person below the owner learns of no group.
+		await owner();
+		if (!name) {
+			if (method !== "GET") throw new HttpError(405, "Method not allowed.");
+			return json({
+				groups: groups.groups().map(({ name, description, skills }) => ({
+					name,
+					description,
+					skills: [...skills],
+				})),
+			} satisfies SkillGroupsView);
+		}
+		const group = groups.groups().find((one) => one.name === name);
+		if (!action && method === "PUT") {
+			const body = await bodyOf(request);
+			const from = optionalText(body, "from");
+			const save: SkillGroupSave = {
+				description: requiredText(body, "description"),
+				skills: optionalList(body, "skills") ?? [],
+				...(from ? { from } : {}),
+			};
+			const renamed = save.from !== undefined && save.from !== name;
+			if (renamed) {
+				if (!groups.groups().some((one) => one.name === save.from))
+					throw new HttpError(404, "There is no such skill group.");
+				if (group) throw bad(`There is already a skill group "${name}".`);
+			}
+			let message = await groups.setGroup(name, save.description, save.skills);
+			if (renamed && save.from)
+				message = `${message} ${await groups.deleteGroup(save.from)}`;
+			this.#options.changed();
+			return json({ message } satisfies SkillGroupChanged, group ? 200 : 201);
+		}
+		if (!group) throw new HttpError(404, "There is no such skill group.");
+		if (!action && method === "DELETE") {
+			const message = await groups.deleteGroup(name);
+			this.#options.changed();
+			return json({ message } satisfies SkillGroupChanged);
+		}
+		if (action === "apply" && method === "POST" && parts.length === 4) {
+			const body = await bodyOf(request);
+			const apply: SkillGroupApply = {
+				agent: requiredText(body, "agent"),
+				on: body.on !== false,
+			};
+			if (!this.#options.active(apply.agent))
+				throw new HttpError(404, "There is no such room, knight or file.");
+			const catalog = new Map(
+				this.#options.catalog().map((entry) => [entry.name, entry]),
+			);
+			// A built-in skill is carried always: it is never added nor switched off.
+			const switchable = group.skills.filter(
+				(skill) => catalog.get(skill)?.source.kind !== "builtin",
+			);
+			const carries = (skill: string) =>
+				catalog.get(skill)?.carriers.includes(apply.agent) ?? false;
+			const added = apply.on
+				? switchable.filter((skill) => !carries(skill))
+				: [];
+			const removed = apply.on ? [] : switchable.filter(carries);
+			if (added.length > 0 || removed.length > 0) {
+				await this.#options.attach(apply.agent, added, removed);
+				this.#options.changed();
+			}
+			return json({ added, removed } satisfies SkillGroupApplied);
+		}
+		throw new HttpError(404, "There is no such API.");
+	}
+}

package/src/app/socket.ts

@@ -26,6 +26,8 @@ import type { PluggedFrames, Viewer, WebAppRegistry } from "../web-app.ts";
 import type { Answerer, OwnerDesk } from "./desk.ts";
 import type { Presence } from "./presence.ts";
 import { parseClientFrame } from "./protocol.ts";
+import { coreMessageId } from "./queued-delivery.ts";
+import { changeQueued } from "./queued-frames.ts";
 import type { Rooms } from "./rooms.ts";
 import type { AppSocket, Audience, Sockets } from "./sockets.ts";
 import type { AppSurface } from "./surface.ts";
@@ -65,7 +67,7 @@ export interface SocketRouteOptions {
 	 * not: the pieces of the app send what is per person there, such as the notices and the badge.
 	 */
 	opened?(connection: AppSocket): Promise<void>;
-	conversations: Pick<ConversationPort, "stop">;
+	conversations: Pick<ConversationPort, "stop" | "cancelQueued" | "editQueued">;
 	logger: Logger;
 	/**
 	 * The longest a socket stays open, whatever its credential says. A password session lives for
@@ -443,6 +445,14 @@ export class SocketRoute {
 				else conversations.stop(room.key);
 				break;
 			}
+			case "edit_queued":
+			case "cancel_queued":
+				refused = await changeQueued(frame, who, {
+					rooms,
+					surface: this.#options.surface,
+					conversations,
+				});
+				break;
 			case "approval":
 			case "answer":
 			case "answers":
@@ -658,7 +668,7 @@ export class SocketRoute {
 		stored?.(message);
 		const inbound: InboundMessage = {
 			channel: room,
-			messageId: `app-${message.id}`,
+			messageId: coreMessageId(message.id),
 			actor: who.actor,
 			authorId: who.principalId,
 			authorName: who.name,