@krantho/api 0.0.0-stage → 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Descoped
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/active-locales.d.ts

@@ -0,0 +1,11 @@
+import type { ApiContext } from './types.js';
+/**
+ * The site's active locales: the list an admin chose in Setup › Locales, else
+ * the configured ones. A stored locale the configuration no longer lists is
+ * left out, and the configuration's default locale is always active.
+ */
+export declare function activeLocales(ctx: ApiContext): Promise<{
+    locales: string[];
+    stored: boolean;
+}>;
+//# sourceMappingURL=active-locales.d.ts.map

package/dist/active-locales.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-locales.d.ts","sourceRoot":"","sources":["../src/active-locales.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;CAChB,CAAC,CAUD"}

package/dist/active-locales.js

@@ -0,0 +1,31 @@
+/**
+ * The site's active locales: the list an admin chose in Setup › Locales, else
+ * the configured ones. A stored locale the configuration no longer lists is
+ * left out, and the configuration's default locale is always active.
+ */
+export async function activeLocales(ctx) {
+    const { defaultLocale, supportedLocales: configured } = ctx.config.site;
+    const stored = await ctx.siteSettingsAdapter?.getSetting('supportedLocales');
+    const chosen = stored ? storedLocales(stored) : null;
+    if (!chosen)
+        return { locales: [...configured], stored: false };
+    const kept = chosen.filter((locale) => configured.includes(locale));
+    return {
+        locales: kept.includes(defaultLocale) ? kept : [defaultLocale, ...kept],
+        stored: true,
+    };
+}
+/** The stored list of locale codes, or null when the setting is not one */
+function storedLocales(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(parsed))
+        return null;
+    return parsed.filter((locale) => typeof locale === 'string');
+}
+//# sourceMappingURL=active-locales.js.map

package/dist/active-locales.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"active-locales.js","sourceRoot":"","sources":["../src/active-locales.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAe;IAIjD,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAA;IACvE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACnE,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC;QACvE,MAAM,EAAE,IAAI;KACb,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAA;AAChF,CAAC"}

package/dist/assistant/access.d.ts

@@ -0,0 +1,25 @@
+import type { ApiContext, ApiRequest, ApiResponse, AuthenticatedUser } from '../types.js';
+/**
+ * The signed-in user the assistant acts for, or the refusal: 401 without a
+ * user, or for the anonymous reader of a site with sign-in (who must not learn
+ * the provider or drive the model); 403 below `assistant.role`.
+ */
+export declare function requireAssistantUser(ctx: ApiContext): {
+    ok: true;
+    user: AuthenticatedUser;
+} | {
+    ok: false;
+    response: ApiResponse;
+};
+/**
+ * 415 unless the request body is declared JSON. Any body is parsed as JSON on
+ * the way in, so without this a cross-site `text/plain` form post would reach
+ * the handler; a JSON request from another site needs a CORS preflight the API
+ * never grants.
+ */
+export declare function requireJsonBody(req: ApiRequest): ApiResponse | null;
+declare const ROLE_ORDER: readonly ["admin", "editor", "viewer"];
+/** The user's highest role — the only thing about the user the model is told */
+export declare function highestRole(user: AuthenticatedUser): (typeof ROLE_ORDER)[number];
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/assistant/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/assistant/access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAEzF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,UAAU,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,CAQ9E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI,CAKnE;AAED,QAAA,MAAM,UAAU,wCAAyC,CAAA;AAEzD,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAEhF"}

package/dist/assistant/access.js

@@ -0,0 +1,35 @@
+import { requireRole } from '../permissions.js';
+/**
+ * The signed-in user the assistant acts for, or the refusal: 401 without a
+ * user, or for the anonymous reader of a site with sign-in (who must not learn
+ * the provider or drive the model); 403 below `assistant.role`.
+ */
+export function requireAssistantUser(ctx) {
+    const user = ctx.auth;
+    if (!user || (ctx.config.auth.mode !== 'none' && user.id === 'anonymous')) {
+        return { ok: false, response: { status: 401, body: { error: 'Authentication required' } } };
+    }
+    const denied = requireRole(user, ctx.config.assistant.role);
+    if (denied)
+        return { ok: false, response: denied };
+    return { ok: true, user };
+}
+/**
+ * 415 unless the request body is declared JSON. Any body is parsed as JSON on
+ * the way in, so without this a cross-site `text/plain` form post would reach
+ * the handler; a JSON request from another site needs a CORS preflight the API
+ * never grants.
+ */
+export function requireJsonBody(req) {
+    const contentType = req.headers?.['content-type'] ?? '';
+    const mediaType = contentType.split(';')[0]?.trim().toLowerCase();
+    if (mediaType === 'application/json')
+        return null;
+    return { status: 415, body: { error: 'Content-Type must be application/json' } };
+}
+const ROLE_ORDER = ['admin', 'editor', 'viewer'];
+/** The user's highest role — the only thing about the user the model is told */
+export function highestRole(user) {
+    return ROLE_ORDER.find((role) => user.roles.includes(role)) ?? 'viewer';
+}
+//# sourceMappingURL=access.js.map

package/dist/assistant/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/assistant/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAG/C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAe;IAEf,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACrB,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,EAAE,CAAA;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC3D,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe;IAC7C,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACjE,IAAI,SAAS,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAA;IACjD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAAE,CAAA;AAClF,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAA;AAEzD,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,IAAuB;IACjD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAA;AACzE,CAAC"}

package/dist/assistant/agent-loop.d.ts

@@ -0,0 +1,31 @@
+import type { ChatAdapter, ChatMessage } from '@krantho/ai';
+import type { AssistantSection } from '@krantho/config';
+import type { AssistantChatRequest } from './protocol.js';
+import type { Emit } from './sse-stream.js';
+import { type AssistantTool, type ToolOutcome, type ToolRunContext } from './tool-registry.js';
+export interface AgentLoopOptions {
+    chat: ChatAdapter;
+    system: string;
+    /** The client's text turns, mapped to ChatMessages */
+    history: readonly ChatMessage[];
+    tools: readonly AssistantTool[];
+    run: Omit<ToolRunContext, 'spend'>;
+    limits: AssistantSection['limits'];
+    emit: Emit;
+    signal: AbortSignal;
+}
+/**
+ * The client's turns as chat messages, one to one; consecutive messages of the
+ * same role are merged with a blank line between (providers require alternation).
+ */
+export declare function toChatHistory(messages: AssistantChatRequest['messages']): ChatMessage[];
+/** Validate a call's input with the tool's schema, then run it; a failure never ends the stream */
+export declare function executeTool(tool: AssistantTool, input: Record<string, unknown>, run: ToolRunContext): Promise<ToolOutcome>;
+/**
+ * The agent loop of one chat request: model turns streamed to the client, the
+ * tools they call run in order, bounded by turns, tool calls and tokens. The
+ * last allowed turn and every turn after the tool limit forbid tool calls, so
+ * the request ends with an answer.
+ */
+export declare function runAgentLoop(o: AgentLoopOptions): Promise<void>;
+//# sourceMappingURL=agent-loop.d.ts.map

package/dist/assistant/agent-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loop.d.ts","sourceRoot":"","sources":["../../src/assistant/agent-loop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,WAAW,EAEX,WAAW,EAKZ,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAuB,MAAM,eAAe,CAAA;AAC9E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,cAAc,EAEpB,MAAM,oBAAoB,CAAA;AAG3B,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;IAC/B,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;IAC/B,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,WAAW,CAAA;CACpB;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,CAAC,GAAG,WAAW,EAAE,CAWvF;AAsED,mGAAmG;AACnG,wBAAsB,WAAW,CAC/B,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,WAAW,CAAC,CAatB;AA8DD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCrE"}

package/dist/assistant/agent-loop.js

@@ -0,0 +1,183 @@
+import { toolDefinitions, } from './tool-registry.js';
+import { failure } from './tools/support.js';
+/**
+ * The client's turns as chat messages, one to one; consecutive messages of the
+ * same role are merged with a blank line between (providers require alternation).
+ */
+export function toChatHistory(messages) {
+    const history = [];
+    for (const message of messages) {
+        const last = history[history.length - 1];
+        if (last && last.role === message.role) {
+            last.content = `${last.content}\n\n${message.content}`;
+        }
+        else {
+            history.push({ role: message.role, content: message.content });
+        }
+    }
+    return history;
+}
+/** The provider's error as the user reads it; an unsupported model is named with its provider */
+function errorMessage(chat, event) {
+    if (event.code !== 'tools_unsupported')
+        return event.message;
+    return `The model \`${chat.model}\` on \`${chat.provider}\` does not support tool use, which the assistant needs. Choose a model that does in Setup › AI provider, or set assistant.model.`;
+}
+function doneReason(stop) {
+    if (stop === 'max_tokens' || stop === 'refusal')
+        return stop;
+    return 'end_turn';
+}
+/** Count usage toward the budget; a turn reporting no input tokens is estimated from what was sent */
+function countUsage(o, state, event, sentChars) {
+    state.inputTokens += event.inputTokens > 0 ? event.inputTokens : Math.ceil(sentChars / 4);
+    state.outputTokens += event.outputTokens;
+    o.emit({ type: 'usage', inputTokens: state.inputTokens, outputTokens: state.outputTokens });
+}
+/** Stream one model turn to the client; a provider error ends the request */
+async function streamTurn(o, messages, definitions, state) {
+    const lastTurn = state.turns === o.limits.maxTurns;
+    const toolChoice = state.toolCalls >= o.limits.maxToolCalls || lastTurn ? 'none' : 'auto';
+    const request = {
+        system: o.system,
+        messages,
+        tools: definitions,
+        toolChoice,
+        maxTokens: o.limits.maxTokens,
+        signal: o.signal,
+    };
+    const sentChars = JSON.stringify([o.system, messages, definitions]).length;
+    let text = '';
+    const calls = [];
+    let stop = 'other';
+    let replay;
+    for await (const event of o.chat.stream(request)) {
+        if (event.type === 'text') {
+            // A turn after tool calls continues the answer: keep it apart from what the last turn said
+            if (text === '' && state.said)
+                o.emit({ type: 'text', text: '\n\n' });
+            text += event.text;
+            o.emit({ type: 'text', text: event.text });
+        }
+        else if (event.type === 'tool_call') {
+            calls.push(event.call);
+        }
+        else if (event.type === 'usage') {
+            countUsage(o, state, event, sentChars);
+        }
+        else if (event.type === 'stop') {
+            stop = event.reason;
+            replay = event.replay;
+        }
+        else {
+            o.emit({ type: 'error', code: event.code, message: errorMessage(o.chat, event) });
+            o.emit({ type: 'done', reason: event.code === 'aborted' ? 'aborted' : 'error' });
+            return { ok: false };
+        }
+    }
+    return { ok: true, text, calls, stop, replay };
+}
+/** Validate a call's input with the tool's schema, then run it; a failure never ends the stream */
+export async function executeTool(tool, input, run) {
+    const parsed = tool.input.safeParse(input);
+    if (!parsed.success) {
+        const issues = parsed.error.issues.map((issue) => `${issue.path.join('.') || '(input)'}: ${issue.message}`);
+        return failure(`Invalid arguments — ${issues.join('; ')}`);
+    }
+    try {
+        return await tool.run(parsed.data, run);
+    }
+    catch (err) {
+        return failure(err instanceof Error ? err.message : 'The tool failed');
+    }
+}
+/** A result as the model receives it: JSON within the per-result limit */
+function resultContent(result, limit) {
+    const content = JSON.stringify(result);
+    if (content.length <= limit)
+        return content;
+    return JSON.stringify({ ok: false, error: 'Result too large; narrow the request' });
+}
+function toolMessage(call, result, limit) {
+    return {
+        role: 'tool',
+        toolCallId: call.id,
+        content: resultContent(result, limit),
+        isError: result['ok'] === false,
+    };
+}
+/** Run one tool call within the request's limits and report it to the client */
+async function runToolCall(o, call, state) {
+    const limit = o.limits.toolResultChars;
+    if (state.toolCalls >= o.limits.maxToolCalls) {
+        return toolMessage(call, { ok: false, error: 'Tool limit reached for this request; answer with what you have.' }, limit);
+    }
+    if (call.inputError) {
+        return toolMessage(call, { ok: false, error: `Arguments were not a JSON object: ${call.inputError}` }, limit);
+    }
+    const tool = o.tools.find((candidate) => candidate.name === call.name);
+    if (!tool) {
+        const summary = `No tool named ${call.name}`;
+        o.emit({
+            type: 'activity',
+            activity: { id: call.id, tool: call.name, status: 'failed', summary, documents: [] },
+        });
+        return toolMessage(call, { ok: false, error: 'No such tool' }, limit);
+    }
+    state.toolCalls++;
+    const parsed = tool.input.safeParse(call.input);
+    const label = parsed.success ? tool.describe(parsed.data) : tool.name;
+    o.emit({ type: 'tool', id: call.id, tool: tool.name, label });
+    const spend = (usage) => {
+        state.inputTokens += usage.inputTokens;
+        state.outputTokens += usage.outputTokens;
+    };
+    const outcome = await executeTool(tool, call.input, { ...o.run, callId: call.id, spend });
+    o.emit({ type: 'activity', activity: { id: call.id, tool: tool.name, ...outcome.activity } });
+    return toolMessage(call, outcome.result, limit);
+}
+/**
+ * The agent loop of one chat request: model turns streamed to the client, the
+ * tools they call run in order, bounded by turns, tool calls and tokens. The
+ * last allowed turn and every turn after the tool limit forbid tool calls, so
+ * the request ends with an answer.
+ */
+export async function runAgentLoop(o) {
+    const messages = [...o.history];
+    const definitions = toolDefinitions(o.tools);
+    const state = { turns: 0, toolCalls: 0, inputTokens: 0, outputTokens: 0, said: false };
+    while (state.turns < o.limits.maxTurns) {
+        state.turns++;
+        if (o.signal.aborted) {
+            o.emit({ type: 'done', reason: 'aborted' });
+            return;
+        }
+        if (state.inputTokens + state.outputTokens >= o.limits.maxRequestTokens) {
+            const message = 'The assistant used its token budget for this request. Ask again to continue.';
+            o.emit({ type: 'error', code: 'limit', message });
+            o.emit({ type: 'done', reason: 'limit' });
+            return;
+        }
+        const turn = await streamTurn(o, messages, definitions, state);
+        if (!turn.ok)
+            return;
+        if (turn.text !== '')
+            state.said = true;
+        if (turn.calls.length === 0) {
+            o.emit({ type: 'done', reason: doneReason(turn.stop) });
+            return;
+        }
+        messages.push({
+            role: 'assistant',
+            content: turn.text,
+            toolCalls: turn.calls,
+            replay: turn.replay,
+        });
+        for (const call of turn.calls)
+            messages.push(await runToolCall(o, call, state));
+    }
+    const message = `The assistant stopped after ${o.limits.maxTurns} steps. Ask again to continue.`;
+    o.emit({ type: 'error', code: 'limit', message });
+    o.emit({ type: 'done', reason: 'limit' });
+}
+//# sourceMappingURL=agent-loop.js.map

package/dist/assistant/agent-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loop.js","sourceRoot":"","sources":["../../src/assistant/agent-loop.ts"],"names":[],"mappings":"AAYA,OAAO,EAIL,eAAe,GAChB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAmC5C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA0C;IACtE,MAAM,OAAO,GAAkB,EAAE,CAAA;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxC,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,GAAG,GAAG,IAAI,CAAC,OAAO,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QACxD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,iGAAiG;AACjG,SAAS,YAAY,CAAC,IAAiB,EAAE,KAA4C;IACnF,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAC5D,OAAO,eAAe,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,QAAQ,mIAAmI,CAAA;AAC7L,CAAC;AAED,SAAS,UAAU,CAAC,IAAoB;IACtC,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC5D,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU,CACjB,CAAmB,EACnB,KAAgB,EAChB,KAA4C,EAC5C,SAAiB;IAEjB,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IACzF,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAA;IACxC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;AAC7F,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,UAAU,CACvB,CAAmB,EACnB,QAAgC,EAChC,WAAgC,EAChC,KAAgB;IAEhB,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAA;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IACzF,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ;QACR,KAAK,EAAE,WAAW;QAClB,UAAU;QACV,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;QAC7B,MAAM,EAAE,CAAC,CAAC,MAAM;KACR,CAAA;IACV,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAA;IAE1E,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,MAAM,KAAK,GAAe,EAAE,CAAA;IAC5B,IAAI,IAAI,GAAmB,OAAO,CAAA;IAClC,IAAI,MAAkC,CAAA;IACtC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,2FAA2F;YAC3F,IAAI,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI;gBAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;YACrE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAA;YAClB,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAClC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;QACxC,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAA;YACnB,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YACjF,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;YAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAChD,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAmB,EACnB,KAA8B,EAC9B,GAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACpC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,KAAK,KAAK,CAAC,OAAO,EAAE,CACpE,CAAA;QACD,OAAO,OAAO,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,MAA+B,EAAE,KAAa;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,OAAO,CAAA;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,MAA+B,EAAE,KAAa;IACjF,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,IAAI,CAAC,EAAE;QACnB,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;QACrC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK;KAChC,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,WAAW,CACxB,CAAmB,EACnB,IAAc,EACd,KAAgB;IAEhB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAA;IACtC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC7C,OAAO,WAAW,CAChB,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE,EACvF,KAAK,CACN,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,WAAW,CAChB,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,IAAI,CAAC,UAAU,EAAE,EAAE,EAC5E,KAAK,CACN,CAAA;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,iBAAiB,IAAI,CAAC,IAAI,EAAE,CAAA;QAC5C,CAAC,CAAC,IAAI,CAAC;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;SACrF,CAAC,CAAA;QACF,OAAO,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,KAAK,CAAC,CAAA;IACvE,CAAC;IAED,KAAK,CAAC,SAAS,EAAE,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IACrE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,CAAC,KAAoD,EAAQ,EAAE;QAC3E,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAA;QACtC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAA;IAC1C,CAAC,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC7F,OAAO,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAmB;IACpD,MAAM,QAAQ,GAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAEjG,OAAO,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;YAC3C,OAAM;QACR,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACxE,MAAM,OAAO,GAAG,8EAA8E,CAAA;YAC9F,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;YACjD,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;YACzC,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;QAC9D,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAM;QACpB,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;QACvC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACvD,OAAM;QACR,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;QACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,+BAA+B,CAAC,CAAC,MAAM,CAAC,QAAQ,gCAAgC,CAAA;IAChG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACjD,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AAC3C,CAAC"}

package/dist/assistant/call-handler.d.ts

@@ -0,0 +1,15 @@
+import type { ApiContext, ApiHandler, ApiResponse } from '../types.js';
+/**
+ * Run a REST handler in-process with the request's authenticated context. The
+ * handlers called this way read only params, query and body.
+ */
+export declare function callHandler(handler: ApiHandler, ctx: ApiContext, req: {
+    params?: Record<string, string>;
+    query?: Record<string, string>;
+    body?: unknown;
+}): Promise<ApiResponse>;
+/** The error message of a non-2xx handler response */
+export declare function responseError(response: ApiResponse): string;
+/** Whether a handler response is a success */
+export declare function isSuccess(response: ApiResponse): boolean;
+//# sourceMappingURL=call-handler.d.ts.map

package/dist/assistant/call-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-handler.d.ts","sourceRoot":"","sources":["../../src/assistant/call-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEtE;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,EACf,GAAG,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACvF,OAAO,CAAC,WAAW,CAAC,CAYtB;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM,CAG3D;AAED,8CAA8C;AAC9C,wBAAgB,SAAS,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAExD"}

package/dist/assistant/call-handler.js

@@ -0,0 +1,24 @@
+/**
+ * Run a REST handler in-process with the request's authenticated context. The
+ * handlers called this way read only params, query and body.
+ */
+export function callHandler(handler, ctx, req) {
+    return handler({
+        method: 'POST',
+        path: '',
+        params: req.params ?? {},
+        query: req.query ?? {},
+        body: req.body,
+        headers: {},
+    }, ctx);
+}
+/** The error message of a non-2xx handler response */
+export function responseError(response) {
+    const body = response.body;
+    return typeof body?.error === 'string' ? body.error : `Request failed (${response.status})`;
+}
+/** Whether a handler response is a success */
+export function isSuccess(response) {
+    return response.status >= 200 && response.status < 300;
+}
+//# sourceMappingURL=call-handler.js.map

package/dist/assistant/call-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-handler.js","sourceRoot":"","sources":["../../src/assistant/call-handler.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,GAAe,EACf,GAAwF;IAExF,OAAO,OAAO,CACZ;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,EAAE;KACZ,EACD,GAAG,CACJ,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,QAAqB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAkC,CAAA;IACxD,OAAO,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,QAAQ,CAAC,MAAM,GAAG,CAAA;AAC7F,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,SAAS,CAAC,QAAqB;IAC7C,OAAO,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAA;AACxD,CAAC"}

package/dist/assistant/chat-handler.d.ts

@@ -0,0 +1,8 @@
+import type { ApiHandler } from '../types.js';
+/**
+ * POST /api/assistant/chat — run the agent loop for the user's conversation and
+ * stream its events (`text/event-stream`). Errors before the stream starts are
+ * JSON: 400/413 request, 401/403 access, 415 content type, 503 no model.
+ */
+export declare const assistantChat: ApiHandler;
+//# sourceMappingURL=chat-handler.d.ts.map

package/dist/assistant/chat-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-handler.d.ts","sourceRoot":"","sources":["../../src/assistant/chat-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAc,UAAU,EAAe,MAAM,aAAa,CAAA;AA2CtE;;;;GAIG;AACH,eAAO,MAAM,aAAa,EAAE,UAmC3B,CAAA"}

package/dist/assistant/chat-handler.js

@@ -0,0 +1,79 @@
+import { llmCredentialLeaf } from '@krantho/config';
+import { resolveChatAdapter } from '../handlers/llm-resolve.js';
+import { getMergedSchema } from '../merged-schema.js';
+import { highestRole, requireAssistantUser, requireJsonBody } from './access.js';
+import { runAgentLoop, toChatHistory } from './agent-loop.js';
+import { parseChatRequest } from './chat-request.js';
+import { createEventStream, EVENT_STREAM_HEADERS } from './sse-stream.js';
+import { buildSystemPrompt } from './system-prompt.js';
+import { toolsForUser } from './tool-registry.js';
+import { createFramer } from './untrusted.js';
+import { WritePolicy } from './write-policy.js';
+/** The chat adapter, or the 503 that says why the assistant cannot reach a model */
+async function resolveChat(ctx, requested) {
+    let resolved;
+    try {
+        resolved = await resolveChatAdapter(ctx, ctx.config.assistant, requested);
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : 'The LLM is not configured';
+        return { ok: false, response: { status: 503, body: { error, code: 'llm_unconfigured' } } };
+    }
+    if (resolved.credential === 'none' && resolved.chat.provider !== 'ollama') {
+        const { provider } = resolved.chat;
+        const env = llmCredentialLeaf(ctx.config.llm, provider)?.env;
+        const error = `No credential for ${provider}. Set ${env ?? 'its key'} in the environment, or save a key for it in Setup › AI provider.`;
+        return { ok: false, response: { status: 503, body: { error, code: 'llm_credential_missing' } } };
+    }
+    return { ok: true, resolved };
+}
+/** Each collection's field names, from its merged schema (code and runtime fields) */
+async function collectionFields(ctx) {
+    const collections = [];
+    for (const [name, collectionDef] of ctx.contentConfig.collections) {
+        const schema = await getMergedSchema(collectionDef, ctx.adapter);
+        collections.push({ name, fields: Object.keys(schema.shape) });
+    }
+    return collections;
+}
+/**
+ * POST /api/assistant/chat — run the agent loop for the user's conversation and
+ * stream its events (`text/event-stream`). Errors before the stream starts are
+ * JSON: 400/413 request, 401/403 access, 415 content type, 503 no model.
+ */
+export const assistantChat = async (req, ctx) => {
+    const access = requireAssistantUser(ctx);
+    if (!access.ok)
+        return access.response;
+    const notJson = requireJsonBody(req);
+    if (notJson)
+        return notJson;
+    const parsed = parseChatRequest(req.body, ctx);
+    if (!parsed.ok)
+        return parsed.response;
+    const chat = await resolveChat(ctx, parsed.value.provider);
+    if (!chat.ok)
+        return chat.response;
+    const system = buildSystemPrompt({
+        site: ctx.config.site,
+        role: highestRole(access.user),
+        context: parsed.value.context,
+        collections: await collectionFields(ctx),
+        today: new Date().toISOString().slice(0, 10),
+    });
+    const tools = toolsForUser(ctx);
+    const framer = createFramer();
+    const writes = new WritePolicy();
+    const body = createEventStream((emit, signal) => runAgentLoop({
+        chat: chat.resolved.chat,
+        system,
+        history: toChatHistory(parsed.value.messages),
+        tools,
+        run: { ctx, callId: '', writes, frame: framer.frame, signal },
+        limits: ctx.config.assistant.limits,
+        emit,
+        signal,
+    }), req.rawRequest?.signal);
+    return { status: 200, headers: { ...EVENT_STREAM_HEADERS }, body };
+};
+//# sourceMappingURL=chat-handler.js.map

package/dist/assistant/chat-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-handler.js","sourceRoot":"","sources":["../../src/assistant/chat-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAqB,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,oFAAoF;AACpF,KAAK,UAAU,WAAW,CACxB,GAAe,EACf,SAA6B;IAE7B,IAAI,QAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAA;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAA;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAA;QAClC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAA;QAC5D,MAAM,KAAK,GAAG,qBAAqB,QAAQ,SAAS,GAAG,IAAI,SAAS,mEAAmE,CAAA;QACvI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,EAAE,EAAE,CAAA;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,gBAAgB,CAC7B,GAAe;IAEf,MAAM,WAAW,GAA8C,EAAE,CAAA;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;QAChE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1D,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAA;IACtC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;IAElC,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI;QACrB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;QAC7B,WAAW,EAAE,MAAM,gBAAgB,CAAC,GAAG,CAAC;QACxC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAC7B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,iBAAiB,CAC5B,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACf,YAAY,CAAC;QACX,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,MAAM;QACN,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7C,KAAK;QACL,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE;QAC7D,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM;QACnC,IAAI;QACJ,MAAM;KACP,CAAC,EACJ,GAAG,CAAC,UAAU,EAAE,MAAM,CACvB,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAA;AACpE,CAAC,CAAA"}

package/dist/assistant/chat-request.d.ts

@@ -0,0 +1,16 @@
+import type { ApiContext, ApiResponse } from '../types.js';
+import type { AssistantChatRequest } from './protocol.js';
+/**
+ * Validate a chat request: a non-empty conversation of user and assistant text
+ * turns that starts and ends with the user (400), within the history and
+ * character limits (413). Only `messages`, `provider` and `context` are read — tool calls
+ * and tool results are never accepted from the client.
+ */
+export declare function parseChatRequest(body: unknown, ctx: ApiContext): {
+    ok: true;
+    value: AssistantChatRequest;
+} | {
+    ok: false;
+    response: ApiResponse;
+};
+//# sourceMappingURL=chat-request.d.ts.map

package/dist/assistant/chat-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-request.d.ts","sourceRoot":"","sources":["../../src/assistant/chat-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AA6BzD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,UAAU,GACd;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,CA+BlF"}

package/dist/assistant/chat-request.js

@@ -0,0 +1,59 @@
+/** A slug or locale as Studio's routes carry them */
+const ROUTE_TOKEN = /^[A-Za-z0-9._-]{1,200}$/;
+function badRequest(error) {
+    return { ok: false, response: { status: 400, body: { error } } };
+}
+function isMessage(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const { role, content } = value;
+    return (role === 'user' || role === 'assistant') && typeof content === 'string' && content !== '';
+}
+/** The screen context, kept only when it names a collection that exists */
+function parseContext(value, ctx) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const { collection, slug, locale } = value;
+    if (typeof collection !== 'string' || !ctx.contentConfig.collections.has(collection)) {
+        return undefined;
+    }
+    const token = (v) => typeof v === 'string' && ROUTE_TOKEN.test(v) ? v : undefined;
+    return { collection, slug: token(slug), locale: token(locale) };
+}
+/**
+ * Validate a chat request: a non-empty conversation of user and assistant text
+ * turns that starts and ends with the user (400), within the history and
+ * character limits (413). Only `messages`, `provider` and `context` are read — tool calls
+ * and tool results are never accepted from the client.
+ */
+export function parseChatRequest(body, ctx) {
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        return badRequest('Request body must be a JSON object');
+    }
+    const { messages, context, provider } = body;
+    if (!Array.isArray(messages) || messages.length === 0) {
+        return badRequest('messages must be a non-empty array');
+    }
+    if (!messages.every(isMessage)) {
+        return badRequest('Each message needs role "user" or "assistant" and non-empty text content');
+    }
+    if (messages[0]?.role !== 'user' || messages[messages.length - 1]?.role !== 'user') {
+        return badRequest('The conversation must start and end with a user message');
+    }
+    const limits = ctx.config.assistant.limits;
+    const chars = messages.reduce((sum, message) => sum + message.content.length, 0);
+    if (messages.length > limits.maxHistoryMessages || chars > limits.maxInputChars) {
+        const error = `The conversation is too long (at most ${limits.maxHistoryMessages} messages and ${limits.maxInputChars} characters)`;
+        return { ok: false, response: { status: 413, body: { error } } };
+    }
+    if (provider !== undefined && typeof provider !== 'string') {
+        return badRequest('provider must be a string');
+    }
+    const value = {
+        messages: messages.map(({ role, content }) => ({ role, content })),
+        provider,
+        context: parseContext(context, ctx),
+    };
+    return { ok: true, value };
+}
+//# sourceMappingURL=chat-request.js.map

package/dist/assistant/chat-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-request.js","sourceRoot":"","sources":["../../src/assistant/chat-request.ts"],"names":[],"mappings":"AAKA,qDAAqD;AACrD,MAAM,WAAW,GAAG,yBAAyB,CAAA;AAE7C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAgC,CAAA;IAC1D,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAA;AACnG,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY,CAAC,KAAc,EAAE,GAAe;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAgC,CAAA;IACrE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAsB,EAAE,CAC/C,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAA;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAa,EACb,GAAe;IAEf,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,UAAU,CAAC,oCAAoC,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAA+B,CAAA;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,UAAU,CAAC,oCAAoC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,OAAO,UAAU,CAAC,0EAA0E,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACnF,OAAO,UAAU,CAAC,yDAAyD,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAA;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAChF,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,kBAAkB,IAAI,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,yCAAyC,MAAM,CAAC,kBAAkB,iBAAiB,MAAM,CAAC,aAAa,cAAc,CAAA;QACnI,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAClE,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3D,OAAO,UAAU,CAAC,2BAA2B,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,QAAQ;QACR,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;KACpC,CAAA;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC"}

package/dist/assistant/confirm-handler.d.ts

@@ -0,0 +1,3 @@
+import type { ApiHandler } from '../types.js';
+export declare const assistantConfirm: ApiHandler;
+//# sourceMappingURL=confirm-handler.d.ts.map

package/dist/assistant/confirm-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-handler.d.ts","sourceRoot":"","sources":["../../src/assistant/confirm-handler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAa7C,eAAO,MAAM,gBAAgB,EAAE,UAsB9B,CAAA"}