@adonis-agora/agent 0.76.2 → 0.77.0

package/dist/src/poppy-client/identity.js

@@ -0,0 +1,111 @@
+import { SignJWT } from 'jose';
+import { importSigningKey } from './keys.js';
+import { nowSeconds, randomId, requireSecureUrl } from './util.js';
+/** Lifetime of every assertion this agent signs. The browser assertion caps at 60s (section 5). */
+export const ASSERTION_TTL_SECONDS = 60;
+/**
+ * The Personal Agent's identity (4.1): its `client_id` URL, its metadata document, and the
+ * keys from `jwks_uri` that sign client assertions, Session assertions and browser assertions.
+ */
+export class AgentIdentity {
+    baseUrl;
+    clientName;
+    logoUri;
+    keys;
+    extensions;
+    constructor(cfg, sec = {}) {
+        const base = requireSecureUrl(cfg.baseUrl, 'identity base URL', sec);
+        if (base.search || base.hash)
+            throw new TypeError('identity base URL must not have a query');
+        this.baseUrl = base.toString().replace(/\/+$/, '');
+        this.clientName = cfg.clientName;
+        this.logoUri = cfg.logoUri ?? `${this.baseUrl}/logo.svg`;
+        if (cfg.keys.length === 0)
+            throw new TypeError('identity needs at least one signing key');
+        this.keys = cfg.keys;
+        this.extensions = cfg.extensions;
+    }
+    /** `client_id` is the URL the metadata document is fetched from (4.1). */
+    get clientId() {
+        return `${this.baseUrl}/agent.json`;
+    }
+    get jwksUri() {
+        return `${this.baseUrl}/jwks.json`;
+    }
+    /** Same origin as `client_id`, as 4.1 requires for `redirect_uris`. */
+    get redirectUri() {
+        return `${this.baseUrl}/oauth/callback`;
+    }
+    metadata() {
+        const doc = {
+            client_id: this.clientId,
+            client_name: this.clientName,
+            logo_uri: this.logoUri,
+            jwks_uri: this.jwksUri,
+            redirect_uris: [this.redirectUri],
+            token_endpoint_auth_method: 'private_key_jwt',
+        };
+        if (this.extensions && Object.keys(this.extensions).length > 0) {
+            doc.extensions = this.extensions;
+        }
+        return doc;
+    }
+    /** The public key set. Never contains private members. */
+    jwks() {
+        return { keys: this.keys.map((k) => ({ ...k.publicJwk })) };
+    }
+    async sign(payload, typ) {
+        const key = this.keys[0];
+        if (!key)
+            throw new TypeError('identity has no signing key');
+        const header = { alg: 'ES256', kid: key.kid };
+        if (typ)
+            header.typ = typ;
+        return new SignJWT(payload).setProtectedHeader(header).sign(await importSigningKey(key));
+    }
+    /**
+     * `private_key_jwt` client assertion (RFC 7523 section 2.2): `iss` = `sub` = `client_id`,
+     * `aud` = the authorization server (its token endpoint by default), fresh `jti`.
+     */
+    clientAssertion(audience) {
+        const iat = nowSeconds();
+        return this.sign({
+            iss: this.clientId,
+            sub: this.clientId,
+            aud: audience,
+            iat,
+            exp: iat + ASSERTION_TTL_SECONDS,
+            jti: randomId(),
+        });
+    }
+    /**
+     * The JWT bearer grant assertion that starts or renews a Session (4.2): names the agent in
+     * `iss` and the User ID in `sub`; `aud` is the token endpoint as a single string.
+     */
+    sessionAssertion(userId, tokenEndpoint) {
+        const iat = nowSeconds();
+        return this.sign({
+            iss: this.clientId,
+            sub: userId,
+            aud: tokenEndpoint,
+            iat,
+            exp: iat + ASSERTION_TTL_SECONDS,
+            jti: randomId(),
+        });
+    }
+    /** Browser assertion (section 5), header `typ: poppy-browser+jwt`, `exp` <= `iat` + 60. */
+    browserAssertion(input) {
+        const iat = nowSeconds();
+        return this.sign({
+            iss: this.clientId,
+            sub: input.userId,
+            aud: input.endpoint,
+            session_id: input.sessionId,
+            return_to: input.returnTo,
+            iat,
+            exp: iat + ASSERTION_TTL_SECONDS,
+            jti: randomId(),
+        }, 'poppy-browser+jwt');
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/src/poppy-client/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/poppy-client/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAwB,MAAM,WAAW,CAAC;AAczF,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,IAAI,CAAc;IAClB,UAAU,CAAmD;IAEtE,YAAY,GAAmB,EAAE,GAAG,GAAoB,EAAE;QACxD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC7F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,IAAI,CAAC,OAAO,WAAW,CAAC;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACnC,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,GAAG,IAAI,CAAC,OAAO,aAAa,CAAC;IACtC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC;IACrC,CAAC;IAED,uEAAuE;IACvE,IAAI,WAAW;QACb,OAAO,GAAG,IAAI,CAAC,OAAO,iBAAiB,CAAC;IAC1C,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAmB;YAC1B,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,aAAa,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;YACjC,0BAA0B,EAAE,iBAAiB;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0DAA0D;IAC1D,IAAI;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAgC,EAAE,GAAY;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,MAAM,GAA+C,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC1F,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QAC1B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB;QAC9B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,QAAQ;YACb,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,MAAc,EAAE,aAAqB;QACpD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,aAAa;YAClB,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,CAAC,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,gBAAgB,CAAC,KAKhB;QACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CACd;YACE,GAAG,EAAE,IAAI,CAAC,QAAQ;YAClB,GAAG,EAAE,KAAK,CAAC,MAAM;YACjB,GAAG,EAAE,KAAK,CAAC,QAAQ;YACnB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,qBAAqB;YAChC,GAAG,EAAE,QAAQ,EAAE;SAChB,EACD,mBAAmB,CACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/src/poppy-client/identity_server.d.ts

@@ -0,0 +1,29 @@
+import { type Server } from 'node:http';
+import type { AgentIdentity } from './identity.js';
+export interface IdentityServerOptions {
+    host?: string | undefined;
+    port?: number | undefined;
+    /**
+     * Directory where Direct Sign-In callbacks are relayed as `{state}.json` (0600), so a
+     * `poppy-agent signin` process can pick up a redirect received by `serve-identity`.
+     */
+    relayDir?: string | undefined;
+    /** In-process callback hook (used when `signin` runs the server itself). */
+    onCallback?: ((params: URLSearchParams) => void) | undefined;
+    log?: ((line: string) => void) | undefined;
+}
+/**
+ * Serves the agent's Client ID Metadata Document, JWKS (public keys only), logo, and the
+ * Direct Sign-In redirect target, under the paths of `identity.baseUrl` (4.1).
+ */
+export declare function startIdentityServer(identity: AgentIdentity, opts?: IdentityServerOptions): Promise<{
+    server: Server;
+    url: string;
+    close: () => Promise<void>;
+}>;
+/** Waits for a relayed callback file for `state` (written by `serve-identity`). */
+export declare function waitForRelayedCallback(relayDir: string, state: string, opts?: {
+    signal?: AbortSignal | undefined;
+    pollMs?: number | undefined;
+}): Promise<URLSearchParams>;
+//# sourceMappingURL=identity_server.d.ts.map

package/dist/src/poppy-client/identity_server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity_server.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/identity_server.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,aAAa,EACvB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAkEtE;AAED,mFAAmF;AACnF,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GAC3E,OAAO,CAAC,eAAe,CAAC,CAY1B"}

package/dist/src/poppy-client/identity_server.js

@@ -0,0 +1,84 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { sleep } from './util.js';
+const LOGO_SVG = `<svg xmlns="http://www.w3.org/2000/svg" width="64" height="64" viewBox="0 0 64 64"><rect width="64" height="64" rx="14" fill="#7c3aed"/><text x="32" y="42" font-family="sans-serif" font-size="30" text-anchor="middle" fill="#fff">P</text></svg>`;
+const STATE_RE = /^[A-Za-z0-9_-]{8,128}$/;
+/**
+ * Serves the agent's Client ID Metadata Document, JWKS (public keys only), logo, and the
+ * Direct Sign-In redirect target, under the paths of `identity.baseUrl` (4.1).
+ */
+export async function startIdentityServer(identity, opts = {}) {
+    const base = new URL(identity.baseUrl);
+    const prefix = base.pathname.replace(/\/+$/, '');
+    const paths = {
+        meta: new URL(identity.clientId).pathname,
+        jwks: new URL(identity.jwksUri).pathname,
+        callback: new URL(identity.redirectUri).pathname,
+        logo: `${prefix}/logo.svg`,
+    };
+    const server = createServer(async (req, res) => {
+        const url = new URL(req.url ?? '/', 'http://local');
+        const send = (status, type, body, extra = {}) => {
+            res.writeHead(status, { 'content-type': type, ...extra });
+            res.end(body);
+        };
+        opts.log?.(`${req.method} ${url.pathname}`);
+        if (req.method !== 'GET' && req.method !== 'HEAD')
+            return send(405, 'text/plain', 'method not allowed');
+        if (url.pathname === paths.meta) {
+            return send(200, 'application/json', JSON.stringify(identity.metadata(), null, 2), {
+                'cache-control': 'public, max-age=300',
+            });
+        }
+        if (url.pathname === paths.jwks) {
+            return send(200, 'application/json', JSON.stringify(identity.jwks(), null, 2), {
+                'cache-control': 'public, max-age=300',
+            });
+        }
+        if (url.pathname === paths.logo)
+            return send(200, 'image/svg+xml', LOGO_SVG);
+        if (url.pathname === paths.callback) {
+            const state = url.searchParams.get('state') ?? '';
+            if (!STATE_RE.test(state))
+                return send(400, 'text/plain', 'invalid state');
+            opts.onCallback?.(url.searchParams);
+            if (opts.relayDir) {
+                const dir = join(opts.relayDir, 'callbacks');
+                await mkdir(dir, { recursive: true, mode: 0o700 });
+                await writeFile(join(dir, `${state}.json`), url.searchParams.toString(), { mode: 0o600 });
+            }
+            const ok = !url.searchParams.get('error');
+            return send(200, 'text/html; charset=utf-8', `<!doctype html><meta charset="utf-8"><title>poppy-agent</title><p>${ok ? 'Sign-in received.' : 'Sign-in was not completed.'} You can close this tab and return to the terminal.</p>`, { 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' });
+        }
+        send(404, 'text/plain', 'not found');
+    });
+    const host = opts.host ?? '127.0.0.1';
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(opts.port ?? 0, host, () => resolve());
+    });
+    const { port } = server.address();
+    return {
+        server,
+        url: `http://${host}:${port}`,
+        close: () => new Promise((r) => server.close(() => r())),
+    };
+}
+/** Waits for a relayed callback file for `state` (written by `serve-identity`). */
+export async function waitForRelayedCallback(relayDir, state, opts = {}) {
+    const file = join(relayDir, 'callbacks', `${state}.json`);
+    for (;;) {
+        try {
+            const raw = await readFile(file, 'utf8');
+            await rm(file, { force: true });
+            return new URLSearchParams(raw);
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        await sleep(opts.pollMs ?? 500, opts.signal);
+    }
+}
+//# sourceMappingURL=identity_server.js.map

package/dist/src/poppy-client/identity_server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity_server.js","sourceRoot":"","sources":["../../../src/poppy-client/identity_server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,MAAM,QAAQ,GAAG,qPAAqP,CAAC;AAEvQ,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAe1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAuB,EACvB,IAAI,GAA0B,EAAE;IAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ;QACzC,IAAI,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ;QACxC,QAAQ,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,QAAQ;QAChD,IAAI,EAAE,GAAG,MAAM,WAAW;KAC3B,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,CACX,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,KAAK,GAA2B,EAAE,EAClC,EAAE;YACF,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;YAC/C,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACjF,eAAe,EAAE,qBAAqB;aACvC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBAC7E,eAAe,EAAE,qBAAqB;aACvC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;YAC3E,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;gBAC7C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnD,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,IAAI,CACT,GAAG,EACH,0BAA0B,EAC1B,qEACE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,4BAC7B,yDAAyD,EACzD,EAAE,eAAe,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,OAAO;QACL,MAAM;QACN,GAAG,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE;QAC7B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,KAAa,EACb,IAAI,GAAsE,EAAE;IAE5E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC1D,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/src/poppy-client/index.d.ts

@@ -0,0 +1,19 @@
+export { apiBaseUrl, callOpenApi, listApis, loadOpenApi, pickApi } from './api.js';
+export { autoSubmitFormHtml, createBrowserAssertion, serveOneShotPage } from './browser.js';
+export { CompanyClient, PoppyAgent, type PoppyAgentOptions, type SignInResult, throwForResponse, } from './company.js';
+export { ConversationClient, type FollowOptions, newMessageId, poppyProtocol, type StreamItem, } from './conversations.js';
+export { authServerMetadataUrl, type Discovered, discover, HttpJsonCache, SUPPORTED_MAJOR_VERSIONS, validateMetadata, validatePoppyDocument, wellKnownUrlFor, } from './discovery.js';
+export { DpopKey, htuOf } from './dpop.js';
+export { ConversationError, DiscoveryError, OAuthError, PoppyError, ResourceAuthError, } from './errors.js';
+export { PoppyHttp } from './http.js';
+export { AgentIdentity, type IdentityConfig } from './identity.js';
+export { startIdentityServer, waitForRelayedCallback } from './identity_server.js';
+export { generateEs256Key, type StoredKey } from './keys.js';
+export { ask, DEFAULT_MODEL } from './llm.js';
+export { connectMcp, type McpConnection } from './mcp.js';
+export { completeDirectSignIn, deviceSignIn, eligibleSignInTypes, type MediatedOutcome, mediatedSignIn, type PendingDirectSignIn, pollDeviceSignInOnce, type SignInType, startDirectSignIn, submitMediatedCode, } from './signin.js';
+export { parseSse } from './sse.js';
+export { defaultStatePath, StateStore } from './store.js';
+export { TokenClient } from './token_client.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/poppy-client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,aAAa,EAClB,YAAY,EACZ,aAAa,EACb,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,KAAK,UAAU,EACf,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,KAAK,eAAe,EACpB,cAAc,EACd,KAAK,mBAAmB,EACxB,oBAAoB,EACpB,KAAK,UAAU,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,mBAAmB,YAAY,CAAC"}

package/dist/src/poppy-client/index.js

@@ -0,0 +1,18 @@
+export { apiBaseUrl, callOpenApi, listApis, loadOpenApi, pickApi } from './api.js';
+export { autoSubmitFormHtml, createBrowserAssertion, serveOneShotPage } from './browser.js';
+export { CompanyClient, PoppyAgent, throwForResponse, } from './company.js';
+export { ConversationClient, newMessageId, poppyProtocol, } from './conversations.js';
+export { authServerMetadataUrl, discover, HttpJsonCache, SUPPORTED_MAJOR_VERSIONS, validateMetadata, validatePoppyDocument, wellKnownUrlFor, } from './discovery.js';
+export { DpopKey, htuOf } from './dpop.js';
+export { ConversationError, DiscoveryError, OAuthError, PoppyError, ResourceAuthError, } from './errors.js';
+export { PoppyHttp } from './http.js';
+export { AgentIdentity } from './identity.js';
+export { startIdentityServer, waitForRelayedCallback } from './identity_server.js';
+export { generateEs256Key } from './keys.js';
+export { ask, DEFAULT_MODEL } from './llm.js';
+export { connectMcp } from './mcp.js';
+export { completeDirectSignIn, deviceSignIn, eligibleSignInTypes, mediatedSignIn, pollDeviceSignInOnce, startDirectSignIn, submitMediatedCode, } from './signin.js';
+export { parseSse } from './sse.js';
+export { defaultStatePath, StateStore } from './store.js';
+export { TokenClient } from './token_client.js';
+//# sourceMappingURL=index.js.map

package/dist/src/poppy-client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/poppy-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EACL,aAAa,EACb,UAAU,EAGV,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAElB,YAAY,EACZ,aAAa,GAEd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EAErB,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EAEnB,cAAc,EAEd,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/poppy-client/keys.d.ts

@@ -0,0 +1,13 @@
+import { importJWK, type JWK } from 'jose';
+/** An ES256 key pair as stored in the state file. */
+export interface StoredKey {
+    kid: string;
+    privateJwk: JWK;
+    publicJwk: JWK;
+}
+export declare function generateEs256Key(): Promise<StoredKey>;
+export type SigningKey = Awaited<ReturnType<typeof importJWK>>;
+export declare function importSigningKey(key: StoredKey): Promise<SigningKey>;
+/** Only the public members of an EC JWK, as embedded in a DPoP header (RFC 9449 4.2). */
+export declare function bareEcPublicJwk(jwk: JWK): JWK;
+//# sourceMappingURL=keys.d.ts.map

package/dist/src/poppy-client/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsD,SAAS,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAE/F,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,GAAG,CAAC;IAChB,SAAS,EAAE,GAAG,CAAC;CAChB;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,SAAS,CAAC,CAU3D;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAI/D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAOpE;AAED,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAM7C"}

package/dist/src/poppy-client/keys.js

@@ -0,0 +1,31 @@
+import { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK } from 'jose';
+export async function generateEs256Key() {
+    const { privateKey, publicKey } = await generateKeyPair('ES256', { extractable: true });
+    const pub = await exportJWK(publicKey);
+    const priv = await exportJWK(privateKey);
+    const kid = await calculateJwkThumbprint(pub, 'sha256');
+    return {
+        kid,
+        privateJwk: { ...priv, kid, alg: 'ES256', use: 'sig' },
+        publicJwk: { ...bareEcPublicJwk(pub), kid, alg: 'ES256', use: 'sig' },
+    };
+}
+const cache = new WeakMap();
+export function importSigningKey(key) {
+    let p = cache.get(key);
+    if (!p) {
+        p = importJWK(key.privateJwk, 'ES256');
+        cache.set(key, p);
+    }
+    return p;
+}
+/** Only the public members of an EC JWK, as embedded in a DPoP header (RFC 9449 4.2). */
+export function bareEcPublicJwk(jwk) {
+    const out = {};
+    for (const k of ['kty', 'crv', 'x', 'y']) {
+        if (jwk[k] !== undefined)
+            out[k] = jwk[k];
+    }
+    return out;
+}
+//# sourceMappingURL=keys.js.map

package/dist/src/poppy-client/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/poppy-client/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAS/F,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO;QACL,GAAG;QACH,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QACtD,SAAS,EAAE,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;KACtE,CAAC;AACJ,CAAC;AAID,MAAM,KAAK,GAAG,IAAI,OAAO,EAAkC,CAAC;AAE5D,MAAM,UAAU,gBAAgB,CAAC,GAAc;IAC7C,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAU,EAAE,CAAC;QAClD,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/poppy-client/llm.d.ts

@@ -0,0 +1,31 @@
+import type { CompanyClient } from './company.js';
+import type { MessageContext } from './types.js';
+import type { FetchLike } from './util.js';
+/** Cheap, capable, tool-calling model on OpenRouter. Override with --model / POPPY_AGENT_MODEL. */
+export declare const DEFAULT_MODEL = "anthropic/claude-haiku-5.5";
+export declare const OPENROUTER_URL = "https://openrouter.ai/api/v1/chat/completions";
+export interface AskOptions {
+    apiKey: string;
+    model?: string | undefined;
+    /** Hard cap on LLM turns. */
+    maxSteps?: number | undefined;
+    baseUrl?: string | undefined;
+    fetch?: FetchLike | undefined;
+    /** Transcript sink. */
+    log: (line: string) => void;
+    /** Lets MCP tools without `readOnlyHint` run. Otherwise `confirm` is asked, or they're refused. */
+    allowWrites?: boolean | undefined;
+    confirm?: ((question: string) => Promise<boolean>) | undefined;
+    context?: MessageContext | undefined;
+}
+/**
+ * "LLM mode": a tiny autonomous Personal Agent. It uses an OpenRouter model to work on `task`
+ * through the Company's conversation endpoint and/or MCP tools, within `maxSteps`. It never
+ * sees tokens: tools return only what the Company said.
+ */
+export declare function ask(company: CompanyClient, task: string, opts: AskOptions): Promise<{
+    answer?: string | undefined;
+    steps: number;
+    conversationId?: string | undefined;
+}>;
+//# sourceMappingURL=llm.d.ts.map

package/dist/src/poppy-client/llm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../../src/poppy-client/llm.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlD,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,mGAAmG;AACnG,eAAO,MAAM,aAAa,+BAA+B,CAAC;AAC1D,eAAO,MAAM,cAAc,kDAAkD,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,uBAAuB;IACvB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,mGAAmG;IACnG,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAC/D,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CACtC;AAsCD;;;;GAIG;AACH,wBAAsB,GAAG,CACvB,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GACf,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC,CAoM9F"}

package/dist/src/poppy-client/llm.js

@@ -0,0 +1,230 @@
+import { ConversationClient, newMessageId, poppyProtocol } from './conversations.js';
+import { PoppyError, ResourceAuthError } from './errors.js';
+import { connectMcp } from './mcp.js';
+/** Cheap, capable, tool-calling model on OpenRouter. Override with --model / POPPY_AGENT_MODEL. */
+export const DEFAULT_MODEL = 'anthropic/claude-haiku-5.5';
+export const OPENROUTER_URL = 'https://openrouter.ai/api/v1/chat/completions';
+function summarize(events) {
+    const out = [];
+    for (const ev of events) {
+        if (ev.type === 'message' && ev.message?.role !== 'user') {
+            out.push({
+                from: `company:${ev.message?.sender}`,
+                text: ev.message?.text,
+                data: ev.message?.data,
+            });
+        }
+        else if (ev.type === 'authorization') {
+            out.push({
+                notice: `The company needs the user to sign in (${ev.error}${ev.scope ? `, scope "${ev.scope}"` : ''}). You cannot sign in yourself; tell the user to run "poppy-agent signin".`,
+            });
+        }
+        else if (ev.type === 'user_requested') {
+            out.push({
+                notice: `The company asked to talk with the user directly: ${ev.reason}. The user is not available in this mode.`,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * "LLM mode": a tiny autonomous Personal Agent. It uses an OpenRouter model to work on `task`
+ * through the Company's conversation endpoint and/or MCP tools, within `maxSteps`. It never
+ * sees tokens: tools return only what the Company said.
+ */
+export async function ask(company, task, opts) {
+    const doFetch = opts.fetch ?? ((i, init) => globalThis.fetch(i, init));
+    const maxSteps = opts.maxSteps ?? 8;
+    const tools = [];
+    const conv = poppyProtocol(company) ? new ConversationClient(company) : undefined;
+    let conversationId;
+    let mcp;
+    const mcpTools = new Map();
+    if (conv) {
+        tools.push({
+            type: 'function',
+            function: {
+                name: 'talk_to_company',
+                description: "Send a message to the company's own agent and get its reply. Use plain text; put structured details in data.",
+                parameters: {
+                    type: 'object',
+                    properties: {
+                        text: { type: 'string' },
+                        data: { type: 'object', description: 'Optional structured details.' },
+                    },
+                    required: ['text'],
+                },
+            },
+        });
+    }
+    if ((company.document.apis ?? []).some((a) => a?.type === 'mcp')) {
+        try {
+            mcp = await connectMcp(company);
+            const { tools: list } = await mcp.client.listTools();
+            for (const t of list) {
+                const name = `mcp_${t.name}`.replace(/[^A-Za-z0-9_-]/g, '_').slice(0, 64);
+                mcpTools.set(name, { name: t.name, readOnly: t.annotations?.readOnlyHint === true });
+                tools.push({
+                    type: 'function',
+                    function: {
+                        name,
+                        description: `[company MCP tool] ${t.description ?? t.name}`,
+                        parameters: t.inputSchema ?? { type: 'object' },
+                    },
+                });
+            }
+        }
+        catch (e) {
+            opts.log(`! MCP unavailable: ${e.message}`);
+        }
+    }
+    if (tools.length === 0) {
+        throw new PoppyError('nothing_to_use', 'Company offers no conversation endpoint or MCP tools');
+    }
+    tools.push({
+        type: 'function',
+        function: {
+            name: 'finish',
+            description: 'Finish with the answer for the user.',
+            parameters: {
+                type: 'object',
+                properties: { answer: { type: 'string' } },
+                required: ['answer'],
+            },
+        },
+    });
+    const messages = [
+        {
+            role: 'system',
+            content: [
+                `You are a personal agent acting for one user at ${company.document.organization.name} (${company.document.organization.domain}).`,
+                'Accomplish the user task with the tools. Be brief with the company agent: no greetings.',
+                'Never invent personal data about the user. If something needs the user (sign-in, a decision, personal data you do not have), stop and say so in finish.',
+                'Call finish exactly once when done.',
+            ].join(' '),
+        },
+        { role: 'user', content: task },
+    ];
+    const runTool = async (name, args) => {
+        if (name === 'talk_to_company' && conv) {
+            const message = {
+                id: newMessageId(),
+                sender: 'agent',
+                text: String(args.text ?? ''),
+                data: typeof args.data === 'object' && args.data
+                    ? args.data
+                    : undefined,
+                context: conversationId ? undefined : { ...opts.context, user_available: false },
+            };
+            if (!conversationId) {
+                conversationId = (await conv.start(message)).conversation_id;
+                opts.log(`  (conversation ${conversationId})`);
+            }
+            else {
+                await conv.send(conversationId, message);
+            }
+            const { events, state } = await conv.collect(conversationId);
+            for (const ev of events) {
+                if (ev.type === 'message' && ev.message?.role !== 'user') {
+                    opts.log(`  company[${ev.message?.sender}]: ${ev.message?.text ?? ''}${ev.message?.data ? ` ${JSON.stringify(ev.message.data)}` : ''}`);
+                }
+                if (ev.type === 'user_requested') {
+                    // 7.10: only the Personal Agent starts Direct Conversations; the user isn't here.
+                    await conv.send(conversationId, {
+                        id: newMessageId(),
+                        sender: 'agent',
+                        text: 'The user is not available to talk right now.',
+                        context: { user_available: false },
+                    });
+                }
+            }
+            return { status: state.status, responder: state.responder, replies: summarize(events) };
+        }
+        const mt = mcpTools.get(name);
+        if (mt && mcp) {
+            if (!mt.readOnly && !opts.allowWrites) {
+                const ok = opts.confirm
+                    ? await opts.confirm(`Allow MCP tool ${mt.name}(${JSON.stringify(args)})?`)
+                    : false;
+                if (!ok)
+                    return { error: 'refused: this tool may change things and the user did not allow it' };
+            }
+            const r = await mcp.client.callTool({ name: mt.name, arguments: args });
+            return r;
+        }
+        return { error: `unknown tool ${name}` };
+    };
+    let answer;
+    let steps = 0;
+    try {
+        while (steps < maxSteps && answer === undefined) {
+            steps++;
+            const res = await doFetch(opts.baseUrl ?? OPENROUTER_URL, {
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${opts.apiKey}`,
+                    'content-type': 'application/json',
+                    'x-title': 'poppy-agent',
+                },
+                body: JSON.stringify({
+                    model: opts.model ?? DEFAULT_MODEL,
+                    messages,
+                    tools,
+                    tool_choice: 'auto',
+                }),
+            });
+            if (!res.ok)
+                throw new PoppyError('llm_error', `LLM HTTP ${res.status}: ${(await res.text()).slice(0, 300)}`);
+            const json = (await res.json());
+            const msg = json.choices?.[0]?.message;
+            if (!msg)
+                throw new PoppyError('llm_error', 'LLM returned no message');
+            messages.push({
+                role: 'assistant',
+                content: msg.content ?? null,
+                tool_calls: msg.tool_calls,
+            });
+            if (msg.content)
+                opts.log(`agent: ${msg.content}`);
+            if (!msg.tool_calls?.length) {
+                answer = msg.content ?? '';
+                break;
+            }
+            for (const call of msg.tool_calls) {
+                let args = {};
+                try {
+                    args = JSON.parse(call.function.arguments || '{}');
+                }
+                catch { }
+                opts.log(`> ${call.function.name}(${JSON.stringify(args)})`);
+                if (call.function.name === 'finish') {
+                    answer = String(args.answer ?? '');
+                    messages.push({ role: 'tool', tool_call_id: call.id, content: 'ok' });
+                    continue;
+                }
+                let result;
+                try {
+                    result = await runTool(call.function.name, args);
+                }
+                catch (e) {
+                    result =
+                        e instanceof ResourceAuthError
+                            ? { error: e.code, ...(e.scope ? { needs_scope: e.scope } : {}) }
+                            : { error: e.message };
+                }
+                const text = JSON.stringify(result);
+                opts.log(`< ${text.length > 600 ? `${text.slice(0, 600)}…` : text}`);
+                messages.push({ role: 'tool', tool_call_id: call.id, content: text });
+            }
+        }
+    }
+    finally {
+        if (conversationId && conv)
+            await conv.close(conversationId).catch(() => { });
+        await mcp?.close().catch(() => { });
+    }
+    if (answer === undefined)
+        opts.log(`! stopped after ${maxSteps} steps without finishing`);
+    return { answer, steps, conversationId };
+}
+//# sourceMappingURL=llm.js.map

package/dist/src/poppy-client/llm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm.js","sourceRoot":"","sources":["../../../src/poppy-client/llm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAsB,MAAM,UAAU,CAAC;AAI1D,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAC1D,MAAM,CAAC,MAAM,cAAc,GAAG,+CAA+C,CAAC;AA+B9E,SAAS,SAAS,CAAC,MAA2B;IAC5C,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE;gBACrC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI;gBACtB,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,0CAA0C,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,4EAA4E;aACjL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,qDAAqD,EAAE,CAAC,MAAM,2CAA2C;aAClH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,OAAsB,EACtB,IAAY,EACZ,IAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,cAAkC,CAAC;IACvC,IAAI,GAA8B,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+C,CAAC;IAExE,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE;gBACR,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EACT,8GAA8G;gBAChH,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE;wBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8BAA8B,EAAE;qBACtE;oBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACrD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1E,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE;wBACR,IAAI;wBACJ,WAAW,EAAE,sBAAsB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,EAAE;wBAC5D,UAAU,EAAG,CAAC,CAAC,WAAuC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;qBAC7E;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,sDAAsD,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,sCAAsC;YACnD,UAAU,EAAE;gBACV,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBAC1C,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;SACF;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAkB;QAC9B;YACE,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE;gBACP,mDAAmD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,IAAI;gBAClI,yFAAyF;gBACzF,yJAAyJ;gBACzJ,qCAAqC;aACtC,CAAC,IAAI,CAAC,GAAG,CAAC;SACZ;QACD,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE;KAChC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,IAAY,EAAE,IAA6B,EAAoB,EAAE;QACtF,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG;gBACd,EAAE,EAAE,YAAY,EAAE;gBAClB,MAAM,EAAE,OAAgB;gBACxB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,EACF,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI;oBACxC,CAAC,CAAE,IAAI,CAAC,IAAgC;oBACxC,CAAC,CAAC,SAAS;gBACf,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE;aACjF,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC7D,IAAI,CAAC,GAAG,CAAC,mBAAmB,cAAc,GAAG,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC7D,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;gBACxB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;oBACzD,IAAI,CAAC,GAAG,CACN,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9H,CAAC;gBACJ,CAAC;gBACD,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACjC,kFAAkF;oBAClF,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;wBAC9B,EAAE,EAAE,YAAY,EAAE;wBAClB,MAAM,EAAE,OAAO;wBACf,IAAI,EAAE,8CAA8C;wBACpD,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO;oBACrB,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC3E,CAAC,CAAC,KAAK,CAAC;gBACV,IAAI,CAAC,EAAE;oBACL,OAAO,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;YAC3F,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,gBAAgB,IAAI,EAAE,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,KAAK,GAAG,QAAQ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,cAAc,EAAE;gBACxD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,SAAS,EAAE,aAAa;iBACzB;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,aAAa;oBAClC,QAAQ;oBACR,KAAK;oBACL,WAAW,EAAE,MAAM;iBACpB,CAAC;aACH,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBACT,MAAM,IAAI,UAAU,CAClB,WAAW,EACX,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC9D,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6C,CAAC;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;YACvC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAClC,IAAI,IAAI,GAA4B,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtE,SAAS;gBACX,CAAC;gBACD,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM;wBACJ,CAAC,YAAY,iBAAiB;4BAC5B,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;4BACjE,CAAC,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;gBACxC,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,cAAc,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,QAAQ,0BAA0B,CAAC,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC3C,CAAC"}