super-dsh 0.1.3 → 0.1.5

package/{agent-hub → superd-hub}/package.json

@@ -1,13 +1,14 @@
 {
-  "name": "@pgmi-builds/agent-hub",
+  "name": "@pgmi-builds/superd-hub",
   "version": "0.1.0",
-  "description": "Agent Worlds hub host half: world inventory control plane, roster, world spawner and the single-origin per-world mount carrier (no server-side selection; the addressed world is the request's mount path)",
+  "description": "Super D hub host half: world inventory control plane, roster, world spawner and the single-origin per-world mount carrier (no server-side selection; the addressed world is the request's mount path)",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
     "./client": "./lib/client/index.js",
     "./world": "./dist/world-entry.js",
-    "./join": "./dist/world-join.js"
+    "./join": "./dist/world-join.js",
+    "./web-trust": "./dist/web-trust.js"
   },
   "files": [
     "dist",
@@ -27,17 +28,19 @@
   },
   "scripts": {
     "build": "tsc -p .",
-    "build-client": "node scripts/build-client.mjs",
+    "typecheck:client": "tsc -p tsconfig.client.json",
+    "build-client": "npm run typecheck:client && node scripts/build-client.mjs",
     "test": "node --test --test-force-exit test/*.test.mjs"
   },
   "dependencies": {
+    "js-yaml": "^4.3.2",
     "ws": "^8.21.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "*",
-    "@deepseek-ai/dsh-api-gateway": "*",
-    "@deepseek-ai/dsh-host-webserver": "*",
-    "@deepseek-ai/dsh-typert-protocol": "*"
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -54,7 +57,9 @@
     }
   },
   "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
     "@types/node": "^26.5.1",
+    "@types/react": "18.3.31",
     "tsdown": "^0.15.12",
     "typescript": "5.9.3"
   },

package/agent-agy/dist/agent-preset-projection.d.ts

@@ -1,31 +0,0 @@
-/**
- * The `agentPreset` session projection, owned by the adapter.
- *
- * Upstream registers this fold from the `dsh-agent-presets` package, which our
- * patch disables (the Antigravity provider replaces preset composition
- * wholesale). But the Web UI depends on the projection regardless: the preset
- * hero chip renders only when `session.projectionValues.agentPreset` resolves
- * (presetOf in ui-agent-preset/seat-store.ts), and the session-header label
- * reads it too. Without a registrant the projection is absent for every
- * adapter session and both surfaces stay blank — roster or no roster.
- *
- * Same fold as upstream (packages/preset/agent-presets/src/session.ts):
- * initialized from the creation header, advanced by `agent-preset/selected`
- * events, which this adapter synthesizes (`"agy"`) on every session it
- * prepares. Registered under the provider's own fiber via
- * `ctx.inject(['sessionProjections'])`, so the key lives exactly as long as
- * the provider is mounted.
- */
-import { z } from "zod";
-/** Current Session preset, initialized from its header and advanced by selection events. */
-export declare const agyAgentPresetProjection: {
-    key: "agentPreset";
-    stateSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
-    init: (header: import("@deepseek-ai/dsh-session").SessionHeader) => string;
-    apply: (state: string | null, event: import("@deepseek-ai/dsh-session").SessionEvent) => string | null;
-    wire: {
-        viewSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNull]>;
-        view: (state: string | null) => string | null;
-    };
-    stateVersion: number;
-};

package/agent-agy/dist/agent-preset-projection.js

@@ -1,33 +0,0 @@
-/**
- * The `agentPreset` session projection, owned by the adapter.
- *
- * Upstream registers this fold from the `dsh-agent-presets` package, which our
- * patch disables (the Antigravity provider replaces preset composition
- * wholesale). But the Web UI depends on the projection regardless: the preset
- * hero chip renders only when `session.projectionValues.agentPreset` resolves
- * (presetOf in ui-agent-preset/seat-store.ts), and the session-header label
- * reads it too. Without a registrant the projection is absent for every
- * adapter session and both surfaces stay blank — roster or no roster.
- *
- * Same fold as upstream (packages/preset/agent-presets/src/session.ts):
- * initialized from the creation header, advanced by `agent-preset/selected`
- * events, which this adapter synthesizes (`"agy"`) on every session it
- * prepares. Registered under the provider's own fiber via
- * `ctx.inject(['sessionProjections'])`, so the key lives exactly as long as
- * the provider is mounted.
- */
-import { z } from "zod";
-const agentPresetSchema = z.union([z.string(), z.null()]);
-/** Current Session preset, initialized from its header and advanced by selection events. */
-export const agyAgentPresetProjection = {
-    key: "agentPreset",
-    stateSchema: agentPresetSchema,
-    // adapter-agy is single-preset: default every session to "agy" so the
-    // header chip resolves for scan-native (never-resumed) sessions too.
-    init: (header) => header.agentPreset ?? "agy",
-    apply: (state, event) => event.type === "agent-preset/selected"
-        ? event.data.agentPreset
-        : state,
-    wire: { viewSchema: agentPresetSchema, view: (state) => state },
-    stateVersion: 1,
-};

package/agent-claude/dist/agent-preset-projection.js

@@ -1,30 +0,0 @@
-/**
- * The `agentPreset` session projection, owned by the adapter.
- *
- * Upstream registers this fold from the `dsh-agent-presets` package, which
- * the bundle patch disables (the claude provider replaces preset composition
- * wholesale). But the Web UI depends on the projection regardless: the
- * preset hero chip renders only when `session.projectionValues.agentPreset`
- * resolves, and the session-header label reads it too. Without a registrant
- * the projection is absent for every adapter session and both surfaces stay
- * blank — roster or no roster (the omp line's "no mode" bug, re-observed as
- * the claude "degraded preset" finding).
- *
- * Same fold as upstream; adapter-claude is single-preset: default every
- * session to "claude" so the header chip resolves for sessions whose log
- * carries no `agent-preset/selected` event yet. Registered under the
- * provider's own fiber via `ctx.inject(['sessionProjections'])`.
- */
-import { z } from "zod";
-const agentPresetSchema = z.union([z.string(), z.null()]);
-/** Current Session preset, initialized from its header and advanced by selection events. */
-export const claudeAgentPresetProjection = {
-    key: "agentPreset",
-    stateSchema: agentPresetSchema,
-    init: (header) => header.agentPreset ?? "claude",
-    apply: (state, event) => event.type === "agent-preset/selected"
-        ? event.data.agentPreset
-        : state,
-    wire: { viewSchema: agentPresetSchema, view: (state) => state },
-    stateVersion: 1,
-};

package/agent-codex/dist/agent-preset-projection.js

@@ -1,37 +0,0 @@
-/**
- * The `agentPreset` session projection, owned by the adapter.
- *
- * Upstream registers this fold from the `dsh-agent-presets` package, which our
- * patch disables (the Codex provider replaces preset composition wholesale).
- * But the Web UI depends on the projection regardless: the preset hero chip
- * renders only when `session.projectionValues.agentPreset` resolves
- * (`presetOf` in ui-agent-preset/seat-store.ts), and the session-header label
- * reads it too. Without a registrant the projection is absent for every
- * adapter session and both surfaces stay blank — roster or no roster (that
- * was the "no mode" bug on the omp line: the roster service answered
- * agentPresets/list 200, yet nothing drove the per-session projection the
- * chip gates on).
- *
- * Same fold as upstream (packages/preset/agent-presets/src/session.ts):
- * initialized from the creation header, advanced by `agent-preset/selected`
- * events, which this adapter synthesizes (`"codex"`) on every session it
- * prepares. Registered under the provider's own fiber via
- * `ctx.inject(['sessionProjections'])`, so the key lives exactly as long as
- * the provider is mounted.
- */
-import { z } from "zod";
-const agentPresetSchema = z.union([z.string(), z.null()]);
-/** Current Session preset, initialized from its header and advanced by selection events. */
-export const codexAgentPresetProjection = {
-    key: "agentPreset",
-    stateSchema: agentPresetSchema,
-    // adapter-codex is single-preset: default every session to "codex" so the
-    // header chip resolves for scan-native (never-resumed) sessions too,
-    // instead of only those whose log carries an `agent-preset/selected` event.
-    init: (header) => header.agentPreset ?? "codex",
-    apply: (state, event) => event.type === "agent-preset/selected"
-        ? event.data.agentPreset
-        : state,
-    wire: { viewSchema: agentPresetSchema, view: (state) => state },
-    stateVersion: 1,
-};

package/agent-codex/dist/app-home.js

@@ -1,65 +0,0 @@
-/**
- * Codex runtime app home bootstrap — idempotently creates the codex home and
- * seeds it with the Codex CLI's own config set (config.toml / model catalog /
- * auth) copied once from the native `~/.codex`.
- *
- * Why this is required, not cosmetic: a Codex home without `config.toml` makes
- * the CLI fall back to its built-in OpenAI provider, so every turn dies on
- * `wss://api.openai.com/v1/responses` with a region block (403 "Country,
- * region, or territory not supported"). The native home is where the user's
- * provider wiring lives (e.g. a local proxy: `model_provider = "custom"`,
- * `base_url = "http://127.0.0.1:15721/v1"`, `model = "glm-5.3-flash"`), and the
- * world deliberately runs with its own CODEX_HOME — so the config has to travel.
- *
- * Same manners as the OMP twin: never overwrites an existing file (a
- * provisioned app home wins), skips missing sources, and is fail-soft — the app
- * home is derived state, never a boot gate.
- */
-import { copyFileSync, existsSync, mkdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { resolveCodexHome } from "./codex-store.js";
-/**
- * Config files seeded into the codex home. `config.toml` names the provider and
- * model, `cc-switch-model-catalog.json` is what its `model_catalog_json` key
- * points at (a relative path, hence the same directory), and `auth.json` is the
- * CLI's own credential record.
- */
-export const CODEX_HOME_CONFIG_FILES = ["config.toml", "cc-switch-model-catalog.json", "auth.json"];
-/** Native codex home — the copy source (`AW_CODEX_SEED_HOME` overrides). */
-export function defaultCodexSeedHome() {
-    const configured = process.env.AW_CODEX_SEED_HOME;
-    return configured !== undefined && configured !== "" ? configured : join(homedir(), ".codex");
-}
-/**
- * Ensure the codex home exists and carries the CLI config set.
- *
- * @param options - target/source/files overrides.
- * @returns the resolved codex home path (always, even on a failed seed).
- */
-export function ensureCodexAppHome(options = {}) {
-    const codexHome = options.codexHome ?? resolveCodexHome();
-    const source = options.seedHome ?? defaultCodexSeedHome();
-    const files = options.files ?? CODEX_HOME_CONFIG_FILES;
-    const seeded = [];
-    try {
-        mkdirSync(codexHome, { recursive: true });
-        for (const name of files) {
-            const dest = join(codexHome, name);
-            if (existsSync(dest))
-                continue;
-            const src = join(source, name);
-            if (!existsSync(src))
-                continue;
-            copyFileSync(src, dest);
-            seeded.push(name);
-        }
-        if (seeded.length > 0) {
-            options.warn?.(`codex-provider: app home ${codexHome} seeded from ${source} (${seeded.join(", ")})`);
-        }
-    }
-    catch (error) {
-        options.warn?.(`codex-provider: app-home bootstrap failed (fail-soft): ${String(error)}`);
-    }
-    return codexHome;
-}

package/agent-codex/dist/spike.js

@@ -1,46 +0,0 @@
-/**
- * AW-E Task 1 spike (P0 gate): prove `@openai/codex-sdk@0.154.0` drives a real
- * turn against the local cc-switch provider (glm-5.2) under an ISOLATED
- * CODEX_HOME, and capture the raw ThreadEvent chain for the Task 2 projection
- * fixtures. The SDK spawns its own exact-pinned codex binary — the 0.153.4
- * CLI on PATH is never consulted (version-mix safety, 2026-09-10 fact).
- */
-import { Codex } from "@openai/codex-sdk";
-function lastOfType(events, type) {
-    for (let i = events.length - 1; i >= 0; i -= 1) {
-        const evt = events[i];
-        if (evt.type === type)
-            return evt;
-    }
-    return undefined;
-}
-/** Run one real streamed turn and collect the full event chain. */
-export async function runSpike(opts) {
-    const codex = new Codex({
-        // env REPLACES process.env (SDK contract) — carry it forward + redirect home.
-        env: { ...process.env, CODEX_HOME: opts.codexHome },
-    });
-    const thread = codex.startThread({
-        workingDirectory: opts.cwd,
-        skipGitRepoCheck: true,
-        approvalPolicy: "never",
-        sandboxMode: "read-only",
-    });
-    const events = [];
-    const streamed = await thread.runStreamed(opts.prompt ?? "Reply with exactly: ok");
-    for await (const evt of streamed.events) {
-        events.push(evt);
-        if (evt.type === "turn.failed") {
-            const error = evt.error;
-            throw new Error(`spike turn failed: ${error?.message ?? "unknown"}`);
-        }
-    }
-    const completed = lastOfType(events, "turn.completed");
-    const message = lastOfType(events, "item.completed");
-    return {
-        threadId: thread.id ?? "",
-        finalResponse: message?.item?.text ?? "",
-        usage: completed?.usage ?? null,
-        events,
-    };
-}

package/agent-hermes/dist/agent-preset-projection.js

@@ -1,34 +0,0 @@
-/**
- * The `agentPreset` session projection, owned by the adapter.
- *
- * Upstream registers this fold from the `dsh-agent-presets` package, which our
- * patch disables (the Hermes provider replaces preset composition wholesale).
- * But the Web UI depends on the projection regardless: the preset hero chip
- * renders only when `session.projectionValues.agentPreset` resolves
- * (`presetOf` in ui-agent-preset/seat-store.ts), and the session-header label
- * reads it too. Without a registrant the projection is absent for every
- * adapter session and both surfaces stay blank — roster or no roster.
- *
- * Same fold as upstream (packages/preset/agent-presets/src/session.ts):
- * initialized from the creation header, advanced by `agent-preset/selected`
- * events, which this adapter synthesizes (`"hermes"`) on every session it
- * prepares. Registered under the provider's own fiber via
- * `ctx.inject(['sessionProjections'])`, so the key lives exactly as long as
- * the provider is mounted.
- */
-import { z } from "zod";
-const agentPresetSchema = z.union([z.string(), z.null()]);
-/** Current Session preset, initialized from its header and advanced by selection events. */
-export const hermesAgentPresetProjection = {
-    key: "agentPreset",
-    stateSchema: agentPresetSchema,
-    // adapter-hermes is single-preset: default every session to "hermes" so the
-    // header chip resolves for scan-native (never-resumed) sessions too,
-    // instead of only those whose log carries an `agent-preset/selected` event.
-    init: (header) => header.agentPreset ?? "hermes",
-    apply: (state, event) => event.type === "agent-preset/selected"
-        ? event.data.agentPreset
-        : state,
-    wire: { viewSchema: agentPresetSchema, view: (state) => state },
-    stateVersion: 1,
-};

package/agent-hub/dist/carrier.d.ts

@@ -1,43 +0,0 @@
-import { type RealWebServerFace } from './world-web-server.js';
-import { type MuxFailure } from './world-mux.js';
-/** The two-method face of a world's typertGateway service instance. */
-export interface CarrierGatewayFace {
-    dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
-    /** Streams return an async iterable (upstream face is synchronous-returning). */
-    openWireStream(endpoint: string, payload: unknown, signal: AbortSignal): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
-}
-/** Options for mounting one world. */
-export interface MountWorldOptions {
-    /** The ctx0 webServer the translated routes register on. */
-    real: RealWebServerFace;
-    /** Runtime key: the mount label (`omp` → `/omp`). */
-    label: string;
-    /** The addressed world's gateway instance. */
-    gateway: CarrierGatewayFace;
-    /** ctx0's browser-trust fence: returns an HTTP status to reject with. */
-    requestRejection?(req: unknown): number | undefined;
-    /** Max request body bytes (mirrors the connection default). */
-    maxBodyBytes?: number;
-    /** Mux ping interval (upstream default 30s). */
-    heartbeatIntervalMs?: number;
-    /** Error → wire failure mapper for the world's streams. */
-    failure?(error: unknown): MuxFailure;
-}
-/** The live mount handle. */
-export interface MountedWorld {
-    /** Mount root (`/omp`). */
-    readonly labelPath: string;
-    /** Unary channel root (`/omp/api`). */
-    readonly apiPath: string;
-    /** Mux websocket path (`/omp/api/remote.mux`). */
-    readonly muxPath: string;
-    /** Unregister everything this mount installed. */
-    dispose(): void;
-}
-/**
- * Mount one world on the shared ctx0 webServer.
- * @param options - see {@link MountWorldOptions}.
- * @returns the live mount handle.
- */
-export declare function mountWorld(options: MountWorldOptions): MountedWorld;
-export { rewriteIndexHtml } from './index-pass.js';

package/agent-hub/dist/carrier.js

@@ -1,241 +0,0 @@
-/**
- * ctx0 WebCarrier (AW-B DL1/DL5): mounts one world's traffic under `/<label>`.
- *
- * Responsibilities (grow per AW-B task):
- *  - Task 4: unary RPC — `/<label>/api/<endpoint>` decodes the connection
- *    envelope and dispatches into the ADDRESSED world's gateway instance.
- *  - Task 6: mux — `/<label>/api/remote.mux` upgrade bridged to the same
- *    instance (no shared selection anywhere).
- *  - 2026-09-17 (H1): non-envelope GET/HEAD on `/<label>/api` forwards into
- *    the owning world's registered exact Fetch routes — the world connection's
- *    shared `/api` handler, published from `world-entry` via `world-host` —
- *    still behind ctx0's fence, so `HEAD /<label>/api/session.export?...`
- *    reaches the world's session-log-download route.
- *
- * The addressed world is the request's path. Nothing here reads a global.
- */
-import { EnvelopeError, parseClientRequest, serverError, serverResult, wireErrorOf, } from './envelope.js';
-import { stripLabelFromUrl } from './world-web-server.js';
-import { worldFetchHandlerOf } from './world-host.js';
-import { WorldMuxServer } from './world-mux.js';
-/** Default body cap, aligned with the connection service. */
-const DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
-async function readBody(req, limit) {
-    const carrier = req;
-    const chunks = [];
-    let size = 0;
-    if (typeof carrier[Symbol.asyncIterator] === 'function') {
-        for await (const chunk of carrier) {
-            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
-            size += buf.byteLength;
-            if (size > limit)
-                throw new EnvelopeError({ code: 'gateway/bad-request', message: 'request body too large' });
-            chunks.push(buf);
-        }
-        return Buffer.concat(chunks).toString('utf8');
-    }
-    if (typeof carrier.on !== 'function')
-        return '';
-    return await new Promise((resolve, reject) => {
-        carrier.on?.('data', (chunk) => {
-            const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk ?? ''));
-            size += buf.byteLength;
-            if (size > limit) {
-                reject(new EnvelopeError({ code: 'gateway/bad-request', message: 'request body too large' }));
-                return;
-            }
-            chunks.push(buf);
-        });
-        carrier.on?.('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-        carrier.on?.('error', (error) => reject(error instanceof Error ? error : new Error(String(error))));
-    });
-}
-/** Reject an upgrade on the raw socket (no ws ownership transfer). */
-function rejectUpgrade(socket, status) {
-    const reason = status === 401 ? 'Unauthorized' : 'Forbidden';
-    const body = reason.toLowerCase();
-    const writable = socket;
-    writable.write?.(`HTTP/1.1 ${status} ${reason}\r\n`
-        + 'Connection: close\r\n'
-        + 'Content-Type: text/plain; charset=utf-8\r\n'
-        + `Content-Length: ${String(Buffer.byteLength(body, 'utf8'))}\r\n\r\n`
-        + body);
-    writable.destroy?.();
-}
-function writeJson(res, status, body) {
-    const carrier = res;
-    carrier.writeHead?.(status, { 'content-type': 'application/json' });
-    res.end(body);
-}
-/** Write a plain-text answer (the shape upstream's own 404/413 answers use). */
-function writeText(res, status, body) {
-    const carrier = res;
-    carrier.writeHead?.(status, { 'content-type': 'text/plain; charset=utf-8' });
-    res.end(body);
-}
-/**
- * Mount one world on the shared ctx0 webServer.
- * @param options - see {@link MountWorldOptions}.
- * @returns the live mount handle.
- */
-export function mountWorld(options) {
-    const labelPath = `/${options.label}`;
-    const apiPath = `${labelPath}/api`;
-    const muxPath = `${apiPath}/remote.mux`;
-    const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
-    const disposers = [];
-    const forwardsFetchMethod = (req) => {
-        const method = req.method;
-        return method === 'GET' || method === 'HEAD';
-    };
-    /**
-     * Forward one non-envelope GET/HEAD request into the owning world's shared
-     * `/api` fetch handler (exact Fetch routes first, then the gateway's RPC
-     * interceptor, then 404 — the upstream composition). The ctx0 fence has
-     * already answered by the time we get here; the world's own browser-auth
-     * gate is never consulted (a different tree, a different secret).
-     */
-    const bridgeWorldFetch = async (req, res) => {
-        const worldFetch = worldFetchHandlerOf(options.label);
-        if (worldFetch === undefined) {
-            writeText(res, 404, 'not found');
-            return;
-        }
-        const method = (req.method ?? 'GET');
-        const resCarrier = res;
-        // Client-disconnect detection rides the response (same reason as the
-        // upstream node:http bridge: the request 'close' fires as soon as a
-        // bodyless GET is consumed).
-        const abort = new AbortController();
-        const onClose = () => {
-            if (resCarrier.writableEnded !== true)
-                abort.abort();
-        };
-        resCarrier.once?.('close', onClose);
-        let headersSent = false;
-        try {
-            const headers = {};
-            for (const [name, value] of Object.entries(req.headers ?? {})) {
-                if (typeof value === 'string')
-                    headers[name.toLowerCase()] = value;
-            }
-            // The world route owns the world-relative URL: strip the mount label,
-            // keep the query (the session-export route reads it from searchParams).
-            const request = new Request(new URL(stripLabelFromUrl(req.url, labelPath), 'http://dsh.internal'), { method, headers, signal: abort.signal });
-            const response = await worldFetch.fetch(request);
-            res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
-            headersSent = true;
-            if (response.body === null) {
-                res.end();
-                return;
-            }
-            for await (const chunk of response.body) {
-                // Backpressure: wait for drain instead of buffering unboundedly; a
-                // socket close resolves the wait and the aborted signal ends the stream.
-                if (resCarrier.write?.(chunk) === false && typeof resCarrier.once === 'function') {
-                    await new Promise((resolve) => {
-                        const done = () => {
-                            resCarrier.off?.('drain', done);
-                            resCarrier.off?.('close', done);
-                            resolve();
-                        };
-                        resCarrier.once?.('drain', done);
-                        resCarrier.once?.('close', done);
-                    });
-                }
-            }
-            res.end();
-        }
-        catch {
-            // The world route owns its statuses; only carrier-level faults land here.
-            if (!headersSent)
-                writeText(res, 500, 'carrier fetch bridge failure');
-            else
-                resCarrier.destroy?.();
-        }
-        finally {
-            resCarrier.off?.('close', onClose);
-        }
-    };
-    const handleUnary = async (req, res) => {
-        const rejection = options.requestRejection?.(req);
-        if (rejection !== undefined) {
-            writeJson(res, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }));
-            return;
-        }
-        let rpcId = 'invalid-request';
-        try {
-            const text = await readBody(req, maxBody);
-            let envelope;
-            try {
-                envelope = parseClientRequest(text);
-            }
-            catch (error) {
-                // Non-envelope GET/HEAD traffic on the shared mount prefix belongs to
-                // the world's own registered fetch routes; envelopes (and every other
-                // method) keep the transport-level 400 below.
-                if (error instanceof EnvelopeError && forwardsFetchMethod(req)) {
-                    await bridgeWorldFetch(req, res);
-                    return;
-                }
-                throw error;
-            }
-            rpcId = envelope.rpcId;
-            const controller = new AbortController();
-            const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal);
-            // The gateway already returns a Result (`{ok:true,value}` | `{ok:false,error}`),
-            // which is exactly the server-response's `result` field.
-            writeJson(res, 200, serverResult(rpcId, result));
-        }
-        catch (error) {
-            const wire = wireErrorOf(error);
-            // Envelope-level failures are transport-level 400s; dispatch failures are
-            // business results carried inside a 200 server-response (upstream shape).
-            if (error instanceof EnvelopeError) {
-                writeJson(res, 400, serverError(rpcId, wire));
-                return;
-            }
-            writeJson(res, 200, serverError(rpcId, wire));
-        }
-    };
-    disposers.push(options.real.register({
-        kind: 'prefix',
-        path: apiPath,
-        handler: handleUnary,
-    }));
-    // Mux: the world's own stream face behind the same mount prefix.
-    const mux = new WorldMuxServer((endpoint, payload, signal) => Promise.resolve(options.gateway.openWireStream(endpoint, payload, signal)), {
-        ...(options.heartbeatIntervalMs === undefined ? {} : { heartbeatIntervalMs: options.heartbeatIntervalMs }),
-        ...(options.failure === undefined ? {} : { failure: options.failure }),
-    });
-    disposers.push(options.real.registerUpgrade({
-        path: muxPath,
-        handler: ((req, socket, head) => {
-            const rejection = options.requestRejection?.(req);
-            if (rejection !== undefined) {
-                rejectUpgrade(socket, rejection === 401 ? 401 : 403);
-                return;
-            }
-            return mux.handleUpgrade(req, socket, head);
-        }),
-    }));
-    disposers.push(() => { void mux.close().catch(() => undefined); });
-    return {
-        labelPath,
-        apiPath,
-        muxPath,
-        dispose() {
-            for (const dispose of disposers.splice(0).reverse()) {
-                try {
-                    dispose();
-                }
-                catch {
-                    // teardown must not throw
-                }
-            }
-        },
-    };
-}
-// The mount HTML pass lives in its own module; re-exported here so the carrier
-// remains the single import surface for mount behaviour.
-export { rewriteIndexHtml } from './index-pass.js';

package/agent-hub/dist/client-shim.d.ts

@@ -1,28 +0,0 @@
-/**
- * Client mount shim (AW-B DL8).
- *
- * ONE head script installs every client-side break point:
- *   - `__DSH_TRANSPORT__.fetch`  → the Connection RPC fetch (URL object input)
- *   - `WebSocket` / `EventSource` / `XMLHttpRequest` constructors → path rewrite
- *   - `__DSH_FILE_UPLOAD__`      → uploads bypass the blob worker + its XHR
- *   - Storage.prototype get/set/remove → per-world key namespace
- *   - `globalThis.fetch`         → global-fetch calls asking for ctx0-root `/api`
- *     URLs (2026-09-17 H1: upstream session-log-export resolves the GLOBAL
- *     fetch at call time; narrow `/api`-only rule, query + hash preserved)
- *   - `HTMLAnchorElement.prototype.click` → download-anchor clicks re-rooted
- *     (2026-09-18 H1 r2: upstream hands the UNREWRITTEN absolute URL to a
- *     DETACHED `<a download>` and clicks it — detached clicks never reach
- *     document, so a document-level listener cannot see them, and a blanket
- *     rewrite breaks the runtime selector's root-absolute anchors
- *     (live-found 2026-09-18). Narrow rule: ONLY anchors carrying a
- *     `download` attribute AND a same-authority root-absolute `/api` href.)
- * The rule is namespace-agnostic: a same-origin root-absolute URL is re-rooted
- * under the mount (`/omp`), nothing else is touched. That covers every prefix
- * a plugin may declare later — no list to keep in sync.
- */
-/**
- * Render the shim as a classic script (parser-blocking head injection).
- * @param labelPath - mount root, e.g. `/omp`.
- * @returns JavaScript source.
- */
-export declare function renderClientShim(labelPath: string): string;