@datalayer/agent-runtimes 1.5.24 → 1.5.26

package/lib/apps/plugins/pap-sign-in/signIn.d.ts

@@ -1,93 +1,7 @@
 /**
- * What the gateway's `pap_sign_in` tool answers, read and checked
- * (AGENT_PROTOCOLS PI-56, PAP_DATALAYER P-03): the person signs in at a
- * company themselves — on the company's page (`direct`), by entering a
- * code there (`device`), or by typing what the company asks on Datalayer's
- * own page (`mediated`), never in the conversation. The chat shows the link,
- * the code and until when; the agent never sees what the person types. A
- * business over PACT answers its `pact_sign_in` the same way (a `device`
- * sign-in at the business).
- *
- * Pure: no React. A test reaches it without a chat around it.
+ * What the gateway's `pap_sign_in` answers, read and checked: kept in
+ * `portable/signIn`, which Datalayer Mobile reads too (MOBILE M-037).
  *
  * @module apps/plugins/pap-sign-in/signIn
  */
-/** A sign-in waiting for the person, as the card shows it. */
-export type PapSignInWaiting = {
-    mode: 'direct' | 'device' | 'mediated';
-    /** The company's page — Datalayer's own, for `mediated` — `https` only. */
-    open: string;
-    /** The page's domain, read from its address: what the person can trust. */
-    host: string;
-    /**
-     * The company's domain, when the gateway names it: for a bound `direct`
-     * sign-in the page opened is Datalayer's start link (PAP_DATALAYER P-04),
-     * which sends the person on to the company and takes them back only from it.
-     */
-    company?: string;
-    /** The code to enter, for `device`. */
-    code?: string;
-    /** Where the company sent a code, for `mediated`, when it did. */
-    sentTo?: string;
-    /** Until when, ISO 8601. */
-    expiresAt?: string;
-    /**
-     * What the company said it needs (its `authorization` event's scope,
-     * PAP_DATALAYER P-02): what the person is asked to allow there.
-     */
-    needs?: string[];
-};
-/** What the card says. */
-export declare const PAP_SIGN_IN_WORDS: {
-    readonly title: (host: string) => string;
-    readonly direct: "Open the company’s page through Datalayer, sign in there, and this conversation goes on once you are back.";
-    readonly device: "Open the company’s page and enter this code there.";
-    /** `mediated`: the page is Datalayer's, which names the company and asks what it asks. */
-    readonly mediatedTitle: (host: string) => string;
-    readonly mediated: "Open this page: it names the company and asks what the company needs. Type it there, never in this conversation.";
-    readonly sentTo: (to: string) => string;
-    readonly needs: (scopes: string[]) => string;
-    readonly open: (host: string) => string;
-    readonly code: "Your code";
-    readonly copy: "Copy the code";
-    readonly copied: "Copied";
-    readonly until: (at: string) => string;
-    readonly checkAgain: "I have signed in: check again";
-    readonly tellMe: "Tell me when you are done.";
-    readonly checkMessage: (host: string) => string;
-    readonly refused: "This sign-in link cannot be opened safely, so it is not shown.";
-    readonly qr: (host: string) => string;
-    /** Once the person's browser came back from the company (P-04), said under the card. */
-    readonly returned: {
-        readonly signed_in: (company: string) => string;
-        readonly denied: (company: string) => string;
-        readonly refused: (company: string) => string;
-    };
-};
-/**
- * Where Datalayer's `/pap/signed-in` page says a Direct Sign-In came back
- * (PAP_DATALAYER P-04): the card waiting for that company hears it in the
- * person's tab, so the conversation goes on there.
- */
-export declare const PAP_SIGN_IN_CHANNEL = "datalayer-pap-sign-in";
-/** How a Direct Sign-In came back. */
-export type PapSignInReturn = keyof typeof PAP_SIGN_IN_WORDS.returned;
-/** What a message on the channel says of this company's sign-in, or `null`: another company's, or not one. */
-export declare function signInReturnOf(message: unknown, company: string): PapSignInReturn | null;
-/**
- * `pap_sign_in` — or a business's `pact_sign_in` (PI-56) — as the gateway
- * names it with or without a prefix.
- */
-export declare const PAP_SIGN_IN_TOOL: RegExp;
-/** Whether a tool is `pap_sign_in` or `pact_sign_in`, as the gateway names it with or without a prefix. */
-export declare const isPapSignInTool: (name: string) => boolean;
-/** The page's address, `https` only; `null` for anything else. */
-export declare function safeSignInUrl(open: unknown): URL | null;
-/**
- * The sign-in waiting for the person, or why it is not shown: `null` for a
- * result that is not one (another status: the chat's default row says it),
- * `{ refused }` for a link that is not `https`.
- */
-export declare function readPapSignIn(result: unknown): PapSignInWaiting | {
-    refused: string;
-} | null;
+export * from '../../../portable/signIn';

package/lib/apps/plugins/pap-sign-in/signIn.js

@@ -2,147 +2,10 @@
  * Copyright (c) 2025-2026 Datalayer, Inc.
  * Distributed under the terms of the Modified BSD License.
  */
-/** What the card says. */
-export const PAP_SIGN_IN_WORDS = {
-    title: (host) => `Sign in at ${host}`,
-    direct: 'Open the company’s page through Datalayer, sign in there, and this conversation goes on once you are back.',
-    device: 'Open the company’s page and enter this code there.',
-    /** `mediated`: the page is Datalayer's, which names the company and asks what it asks. */
-    mediatedTitle: (host) => `Sign in through ${host}`,
-    mediated: 'Open this page: it names the company and asks what the company needs. Type it there, never in this conversation.',
-    sentTo: (to) => `The company sent a code to ${to}.`,
-    needs: (scopes) => `It needs: ${scopes.join(', ')}.`,
-    open: (host) => `Open ${host}`,
-    code: 'Your code',
-    copy: 'Copy the code',
-    copied: 'Copied',
-    until: (at) => `Until ${new Date(at).toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' })}.`,
-    checkAgain: 'I have signed in: check again',
-    tellMe: 'Tell me when you are done.',
-    checkMessage: (host) => `I have signed in at ${host}. Please check again.`,
-    refused: 'This sign-in link cannot be opened safely, so it is not shown.',
-    qr: (host) => `A code to scan to open ${host} on your phone`,
-    /** Once the person's browser came back from the company (P-04), said under the card. */
-    returned: {
-        signed_in: (company) => `Signed in at ${company}: checking again.`,
-        denied: (company) => `You did not sign in at ${company}: ask again when you want to.`,
-        refused: (company) => `That sign-in at ${company} was refused, and nothing was kept: start it again here.`,
-    },
-};
 /**
- * Where Datalayer's `/pap/signed-in` page says a Direct Sign-In came back
- * (PAP_DATALAYER P-04): the card waiting for that company hears it in the
- * person's tab, so the conversation goes on there.
+ * What the gateway's `pap_sign_in` answers, read and checked: kept in
+ * `portable/signIn`, which Datalayer Mobile reads too (MOBILE M-037).
+ *
+ * @module apps/plugins/pap-sign-in/signIn
  */
-export const PAP_SIGN_IN_CHANNEL = 'datalayer-pap-sign-in';
-/** One OAuth scope token (RFC 6749 §3.3). */
-const SCOPE = /^[\x21\x23-\x5B\x5D-\x7E]{1,128}$/;
-const DOMAIN = /^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/;
-/** What a message on the channel says of this company's sign-in, or `null`: another company's, or not one. */
-export function signInReturnOf(message, company) {
-    if (!message || typeof message !== 'object' || Array.isArray(message)) {
-        return null;
-    }
-    const said = message;
-    const outcome = said.outcome;
-    return said.company === company &&
-        (outcome === 'signed_in' || outcome === 'denied' || outcome === 'refused')
-        ? outcome
-        : null;
-}
-/**
- * `pap_sign_in` — or a business's `pact_sign_in` (PI-56) — as the gateway
- * names it with or without a prefix.
- */
-export const PAP_SIGN_IN_TOOL = /(^|[_.:\-/])pa(?:p|ct)_sign_in$/;
-/** Whether a tool is `pap_sign_in` or `pact_sign_in`, as the gateway names it with or without a prefix. */
-export const isPapSignInTool = (name) => PAP_SIGN_IN_TOOL.test(name);
-/** An MCP result's own object: its structured content, or the JSON of its text. */
-function unwrapped(result) {
-    let value = result;
-    if (typeof value === 'string') {
-        try {
-            value = JSON.parse(value);
-        }
-        catch {
-            return null;
-        }
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        return null;
-    }
-    const data = value;
-    if (data.structuredContent && typeof data.structuredContent === 'object') {
-        return unwrapped(data.structuredContent);
-    }
-    if (Array.isArray(data.content)) {
-        const text = data.content.find(part => part?.type === 'text' && typeof part.text === 'string');
-        return text ? unwrapped(text.text) : null;
-    }
-    // FastMCP wraps a non-object answer as `{result: …}`.
-    if (data.result && typeof data.result === 'object' && !('status' in data)) {
-        return unwrapped(data.result);
-    }
-    return data;
-}
-/** The page's address, `https` only; `null` for anything else. */
-export function safeSignInUrl(open) {
-    if (typeof open !== 'string') {
-        return null;
-    }
-    try {
-        const url = new URL(open);
-        return url.protocol === 'https:' && url.hostname ? url : null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * The sign-in waiting for the person, or why it is not shown: `null` for a
- * result that is not one (another status: the chat's default row says it),
- * `{ refused }` for a link that is not `https`.
- */
-export function readPapSignIn(result) {
-    const data = unwrapped(result);
-    if (!data || data.status !== 'waiting_for_the_person') {
-        return null;
-    }
-    if (data.mode !== 'direct' &&
-        data.mode !== 'device' &&
-        data.mode !== 'mediated') {
-        return null;
-    }
-    const url = safeSignInUrl(data.open);
-    if (!url) {
-        return { refused: PAP_SIGN_IN_WORDS.refused };
-    }
-    if (data.mode === 'device' && (typeof data.code !== 'string' || !data.code)) {
-        return null;
-    }
-    // A bound Direct Sign-In opens Datalayer's start link: the card names the company the gateway
-    // names (`PapSignIn.company`); without one, the page's own domain is the company's.
-    const company = typeof data.company === 'string' && DOMAIN.test(data.company)
-        ? data.company
-        : '';
-    // What the company said it needs: scope tokens only, anything else not shown.
-    const needs = Array.isArray(data.needs)
-        ? data.needs.filter((scope) => typeof scope === 'string' && SCOPE.test(scope))
-        : [];
-    return {
-        mode: data.mode,
-        open: url.toString(),
-        host: url.hostname,
-        ...(company ? { company } : {}),
-        ...(typeof data.code === 'string' && data.code ? { code: data.code } : {}),
-        ...(data.mode === 'mediated' &&
-            typeof data.sent_to === 'string' &&
-            data.sent_to
-            ? { sentTo: data.sent_to }
-            : {}),
-        ...(typeof data.expires_at === 'string' && data.expires_at
-            ? { expiresAt: data.expires_at }
-            : {}),
-        ...(needs.length > 0 ? { needs } : {}),
-    };
-}
+export * from '../../../portable/signIn';

package/lib/chat/messages/ChatMessageList.js

@@ -539,6 +539,8 @@ export function ChatMessageList({ displayItems, actOn, upload, isLoading, isStre
                 }
             }
         }
+        // The host's footer, asked once: a row only when it draws something.
+        const messageFooter = renderMessageFooter?.(message);
         return (_jsx(Box, { "data-chat-message": message.role, display: "flex", flexDirection: "column", alignItems: isUser ? 'flex-end' : 'flex-start', px: padding, py: compact ? '2px' : 1, children: _jsxs(Box, { display: "flex", gap: 2, flexDirection: isUser ? 'row-reverse' : 'row', alignItems: "flex-start", 
                 /*
                         Full width, always.
@@ -611,7 +613,7 @@ export function ChatMessageList({ displayItems, actOn, upload, isLoading, isStre
                                                 whiteSpace: 'pre-wrap',
                                                 wordBreak: 'break-word',
                                             }, children: [message.metadata?.input === 'voice' ? (_jsx(Box, { as: "span", "data-spoken": "", title: "Said aloud", "aria-label": "Said aloud:", display: "inline-flex", verticalAlign: "text-bottom", mr: 1, opacity: 0.85, children: _jsx(MicrophoneIcon, { size: 14, "aria-hidden": "true" }) })) : null, text] }));
-                                    })()) : message.live && !getMessageText(message) ? (_jsx(TypingDots, { size: 6 })) : (_jsx(ChatMarkdown, { density: density, text: getMessageText(message) || (isStreaming ? '...' : '') }))] }), message.displays?.length ? (_jsx(Box, { "data-chat-displays": "", display: "flex", flexDirection: "column", gap: 2, mt: 2, width: "100%", children: message.displays.map(display => platform ? (_jsx(ReactorDisplay, { display: display, act: actOn?.(display), upload: upload }, display.id)) : (_jsx(DisplayText, { display: display }, display.id))) })) : null, renderMessageFooter?.(message) ? (_jsx(Box, { display: "flex", gap: 2, alignItems: "center", mt: 1, flexWrap: "wrap", flexDirection: isUser ? 'row-reverse' : 'row', children: renderMessageFooter(message) })) : null] })] }) }, message.id));
+                                    })()) : message.live && !getMessageText(message) ? (_jsx(TypingDots, { size: 6 })) : (_jsx(ChatMarkdown, { density: density, text: getMessageText(message) || (isStreaming ? '...' : '') }))] }), message.displays?.length ? (_jsx(Box, { "data-chat-displays": "", display: "flex", flexDirection: "column", gap: 2, mt: 2, width: "100%", children: message.displays.map(display => platform ? (_jsx(ReactorDisplay, { display: display, act: actOn?.(display), upload: upload }, display.id)) : (_jsx(DisplayText, { display: display }, display.id))) })) : null, messageFooter ? (_jsx(Box, { display: "flex", gap: 2, alignItems: "center", mt: 1, flexWrap: "wrap", flexDirection: isUser ? 'row-reverse' : 'row', children: messageFooter })) : null] })] }) }, message.id));
     };
     return (_jsxs(_Fragment, { children: [displayItems.map((item, index) => {
                 const itemUI = renderItem(item, index);

package/lib/portable/conversation.d.ts

@@ -21,6 +21,7 @@
  * @module portable/conversation
  */
 import { type AgUiEvent } from './agui';
+import { type ProtocolDisplay } from './displays';
 /** How many rows a conversation keeps: its newest. */
 export declare const ITEM_LIMIT = 400;
 /** How many characters of an answer are kept. */
@@ -51,6 +52,8 @@ export type ConversationItem = {
     /** Its result in words, cut at its limit. */
     result: string;
     error: string;
+    /** The protocol display its result carries, read strictly (`portable/displays`, MOBILE M-037). */
+    display: ProtocolDisplay | null;
 } | {
     kind: 'step';
     id: string;

package/lib/portable/conversation.js

@@ -25,6 +25,7 @@
  * @module portable/conversation
  */
 import { REACTOR_UI_NAME, toolResultOf, UI_ON_RUN, } from './agui';
+import { displayOfToolResult } from './displays';
 import { RUN_END_WORDS } from './records';
 import { messagesOfThread } from './thread';
 /** How many rows a conversation keeps: its newest. */
@@ -56,6 +57,17 @@ const appended = (kept, delta, limit) => {
     }
     return cut(kept + delta, limit);
 };
+/** A result as the model read it: the page's `_meta` (its display) is the card's, not words. */
+function withoutMeta(result) {
+    if (result &&
+        typeof result === 'object' &&
+        !Array.isArray(result) &&
+        '_meta' in result) {
+        const { _meta: _page, ...view } = result;
+        return view;
+    }
+    return result;
+}
 /** A result in words. */
 function said(result) {
     if (result === undefined || result === null) {
@@ -214,6 +226,7 @@ export function reduceConversation(state, event) {
                     status: 'running',
                     result: '',
                     error: '',
+                    display: null,
                 },
             ], 1);
         }
@@ -232,8 +245,9 @@ export function reduceConversation(state, event) {
                 ? {
                     ...item,
                     status: result.success ? 'complete' : 'error',
-                    result: cut(said(result.result), TOOL_TEXT_LIMIT),
+                    result: cut(said(withoutMeta(result.result)), TOOL_TEXT_LIMIT),
                     error: result.error ?? '',
+                    display: displayOfToolResult(item.name, result.result, item.id),
                 }
                 : item) ?? noted(state, event));
         }

package/lib/portable/direct.d.ts

@@ -0,0 +1,100 @@
+/**
+ * A Direct Conversation the person types in themselves (PAP_DATALAYER P-08,
+ * MOBILE M-038): a linked sub-conversation under the one a company answered
+ * in, where the person's own words go to the company as `sender: human`,
+ * never through the application's model, until the company closes it.
+ *
+ * Each message takes a one-use ticket IAM gives the person for one
+ * application, one company and one conversation (`POST /pap/my/direct`, with
+ * their own sign-in), then goes to the gateway with it (`POST
+ * /api/mcp/v1/pap/direct`); the company's replies are read back from the
+ * cursor last read (`GET /api/mcp/v1/pap/direct`), never by sending again.
+ * One client for every page (the Studio's chat, Datalayer Mobile): the
+ * addresses, the person's sign-in and `fetch` are given.
+ *
+ * Pure but for the given `fetch`: no React, DOM or storage.
+ *
+ * @module portable/direct
+ */
+/** Where the person writes: the application, the company by its domain, and the conversation there. */
+export type DirectTarget = {
+    appUid: string;
+    company: string;
+    conversationId: string;
+};
+/** One reply of the company, and who wrote it there. */
+export type DirectReply = {
+    text: string;
+    from: 'agent' | 'human';
+};
+/** What the company answered, and where the conversation stands. */
+export type DirectAnswer = {
+    directConversation: string;
+    replies: DirectReply[];
+    status: string;
+    responder: string;
+    cursor: string;
+    /** The `PapReplies` display, when the company wrote anything. */
+    display: unknown;
+};
+/** The longest message the gateway takes. */
+export declare const DIRECT_MAX = 4000;
+/** What a page says around the person's own words. */
+export declare const DIRECT_WORDS: {
+    readonly notConfigured: "Datalayer is not configured to send your words to a company here.";
+    readonly signIn: "Sign in to Datalayer first: only you write in your Direct Conversation.";
+    readonly tooLong: "Write a message of at most 4000 characters.";
+    readonly empty: "Write something to send.";
+    readonly unread: (company: string) => string;
+    readonly write: (company: string) => string;
+    readonly says: (company: string) => string;
+    readonly writing: (company: string) => string;
+    readonly how: "What you write here goes to the company as your own words, never through the application. The company’s answers appear here.";
+    readonly you: "You";
+    readonly agent: "Its agent";
+    readonly human: "One of its people";
+    readonly back: "Back to the application";
+    readonly closed: (company: string) => string;
+    readonly locked: (company: string) => string;
+};
+/** The addresses of IAM and the gateway, the person's sign-in, and `fetch`. */
+export type DirectClientOptions = {
+    iamUrl: string;
+    gatewayUrl: string;
+    getAccessToken: () => string | undefined;
+    fetch: typeof fetch;
+};
+/** The gateway's answer, read whole or refused. */
+export declare function directAnswerOf(raw: unknown, company: string): DirectAnswer;
+/** IAM's ticket and the gateway's Direct Conversation routes, as the person. */
+export declare function directClient({ iamUrl, gatewayUrl, getAccessToken, fetch: fetcher, }: DirectClientOptions): {
+    ticket: (target: DirectTarget) => Promise<string>;
+    /**
+     * The person's own words, sent as theirs: a ticket, then the words with
+     * it. Refused in the gateway's sentence, and never retried.
+     */
+    send: (target: DirectTarget, text: string) => Promise<DirectAnswer>;
+    /** What the company wrote since `cursor`: read, never sent again. */
+    read: (target: DirectTarget, cursor?: string) => Promise<DirectAnswer>;
+};
+export type DirectClient = ReturnType<typeof directClient>;
+/** One line of the Direct Conversation: the person's, or the company's (its agent or one of its people). */
+export type DirectLine = {
+    from: 'you' | 'agent' | 'human';
+    text: string;
+};
+/** A Direct Conversation open under its parent: the parent's composer is locked while it is. */
+export type DirectOpen = {
+    /** Before the first words, the conversation it opens under; after, the Direct Conversation itself. */
+    target: DirectTarget;
+    lines: DirectLine[];
+    cursor: string;
+    /** Closed by the company: nothing more is sent, and the parent is talked to again. */
+    closed: boolean;
+};
+/** A Direct Conversation opened under the conversation a company answered in. */
+export declare const openDirect: (target: DirectTarget) => DirectOpen;
+/** The open conversation with what the company answered, and the person's words when they sent some. */
+export declare function withDirectAnswer(open: DirectOpen, answer: DirectAnswer, mine?: string): DirectOpen;
+/** Who wrote a line, said apart: the person, the company's agent, one of its people. */
+export declare const directAuthor: (line: DirectLine) => string;

package/lib/portable/direct.js

@@ -0,0 +1,172 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** The longest message the gateway takes. */
+export const DIRECT_MAX = 4000;
+/** What a page says around the person's own words. */
+export const DIRECT_WORDS = {
+    notConfigured: 'Datalayer is not configured to send your words to a company here.',
+    signIn: 'Sign in to Datalayer first: only you write in your Direct Conversation.',
+    tooLong: `Write a message of at most ${DIRECT_MAX} characters.`,
+    empty: 'Write something to send.',
+    unread: (company) => `${company}'s answer could not be read.`,
+    write: (company) => `Write to ${company} yourself`,
+    says: (company) => `Your own words to ${company}, sent as yours, not through the application`,
+    writing: (company) => `Writing to ${company} yourself`,
+    how: 'What you write here goes to the company as your own words, never through the application. The company’s answers appear here.',
+    you: 'You',
+    agent: 'Its agent',
+    human: 'One of its people',
+    back: 'Back to the application',
+    closed: (company) => `${company} closed this conversation: write through the application again.`,
+    locked: (company) => `You are writing to ${company} yourself: go back to the application to talk to it.`,
+};
+const root = (url) => url.replace(/\/+$/, '');
+/** The sentence a refusal carries: its `note` (closed, none, another) or its `detail`. */
+async function refusal(response, fallback) {
+    const body = (await response.json().catch(() => ({})));
+    const said = typeof body.note === 'string'
+        ? body.note
+        : typeof body.detail === 'string'
+            ? body.detail
+            : '';
+    return new Error(said || `${fallback} (${response.status})`);
+}
+/** The gateway's answer, read whole or refused. */
+export function directAnswerOf(raw, company) {
+    const data = raw;
+    const replies = data?.replies;
+    if (!data ||
+        typeof data.direct_conversation !== 'string' ||
+        !Array.isArray(replies) ||
+        typeof data.status !== 'string' ||
+        replies.some(reply => !reply ||
+            typeof reply.text !== 'string' ||
+            (reply.from !== 'agent' &&
+                reply.from !== 'human'))) {
+        throw new Error(DIRECT_WORDS.unread(company));
+    }
+    return {
+        directConversation: data.direct_conversation,
+        replies: replies.map(reply => ({
+            text: reply.text,
+            from: reply.from,
+        })),
+        status: data.status,
+        responder: typeof data.responder === 'string' ? data.responder : '',
+        cursor: typeof data.cursor === 'string' ? data.cursor : '',
+        display: data.display ?? null,
+    };
+}
+/** IAM's ticket and the gateway's Direct Conversation routes, as the person. */
+export function directClient({ iamUrl, gatewayUrl, getAccessToken, fetch: fetcher, }) {
+    const bearer = () => {
+        const token = getAccessToken();
+        if (!token) {
+            throw new Error(DIRECT_WORDS.signIn);
+        }
+        return { Authorization: `Bearer ${token}` };
+    };
+    const configured = (...urls) => {
+        if (urls.some(url => !url)) {
+            throw new Error(DIRECT_WORDS.notConfigured);
+        }
+    };
+    /** A one-use ticket for one message, asked of IAM with the person's own sign-in. */
+    const ticket = async (target) => {
+        configured(iamUrl);
+        const response = await fetcher(`${root(iamUrl)}/api/iam/v1/pap/my/direct`, {
+            method: 'POST',
+            headers: { ...bearer(), 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                app_uid: target.appUid,
+                company: target.company,
+                conversation_id: target.conversationId,
+            }),
+        });
+        if (!response.ok) {
+            throw await refusal(response, 'Your words could not be sent');
+        }
+        const body = (await response.json());
+        if (typeof body.ticket !== 'string' || !body.ticket) {
+            throw new Error('Your words could not be sent: no ticket came back.');
+        }
+        return body.ticket;
+    };
+    return {
+        ticket,
+        /**
+         * The person's own words, sent as theirs: a ticket, then the words with
+         * it. Refused in the gateway's sentence, and never retried.
+         */
+        send: async (target, text) => {
+            const words = text.trim();
+            if (!words) {
+                throw new Error(DIRECT_WORDS.empty);
+            }
+            if (words.length > DIRECT_MAX) {
+                throw new Error(DIRECT_WORDS.tooLong);
+            }
+            configured(gatewayUrl);
+            const used = await ticket(target);
+            const response = await fetcher(`${root(gatewayUrl)}/api/mcp/v1/pap/direct`, {
+                method: 'POST',
+                headers: { ...bearer(), 'Content-Type': 'application/json' },
+                body: JSON.stringify({ ticket: used, text: words }),
+            });
+            if (!response.ok) {
+                throw await refusal(response, 'Your words were not sent');
+            }
+            return directAnswerOf(await response.json(), target.company);
+        },
+        /** What the company wrote since `cursor`: read, never sent again. */
+        read: async (target, cursor = '') => {
+            configured(gatewayUrl);
+            const query = new URLSearchParams({
+                app_uid: target.appUid,
+                company: target.company,
+                conversation_id: target.conversationId,
+            });
+            if (cursor) {
+                query.set('cursor', cursor);
+            }
+            const response = await fetcher(`${root(gatewayUrl)}/api/mcp/v1/pap/direct?${query.toString()}`, { headers: bearer() });
+            if (!response.ok) {
+                throw await refusal(response, DIRECT_WORDS.unread(target.company));
+            }
+            return directAnswerOf(await response.json(), target.company);
+        },
+    };
+}
+/** A Direct Conversation opened under the conversation a company answered in. */
+export const openDirect = (target) => ({
+    target,
+    lines: [],
+    cursor: '',
+    closed: false,
+});
+/** The open conversation with what the company answered, and the person's words when they sent some. */
+export function withDirectAnswer(open, answer, mine) {
+    return {
+        target: {
+            ...open.target,
+            conversationId: answer.directConversation || open.target.conversationId,
+        },
+        lines: [
+            ...open.lines,
+            ...(mine !== undefined
+                ? [{ from: 'you', text: mine.trim() }]
+                : []),
+            ...answer.replies.map(reply => ({ from: reply.from, text: reply.text })),
+        ],
+        cursor: answer.cursor || open.cursor,
+        closed: answer.status === 'closed',
+    };
+}
+/** Who wrote a line, said apart: the person, the company's agent, one of its people. */
+export const directAuthor = (line) => line.from === 'you'
+    ? DIRECT_WORDS.you
+    : line.from === 'agent'
+        ? DIRECT_WORDS.agent
+        : DIRECT_WORDS.human;