@mono-agent/agent-app 0.6.2 → 0.9.0

package/dist/notify-tool.d.ts

@@ -0,0 +1,51 @@
+import type { MonoAgentAppLogger } from "./channels.js";
+import type { NotifyDeliveryResult } from "./proactive-notify.js";
+/**
+ * In-process MCP server that exposes the proactive-notification tools to the agent.
+ *
+ * Unlike `memory_recall`/the adapter send tools (stdio children that re-derive
+ * everything from config/disk), notification delivery has to run a real turn on a
+ * destination channel's LIVE session, so the handler must reach the app's running
+ * channel registry — which only exists in this process. We therefore host the
+ * tools over loopback HTTP (the one MCP transport the runtime's client supports
+ * for an in-process server) and close over app-supplied delivery/discovery hooks.
+ *
+ * Two tools, both intended for proactive cron/webhook turns (the runtime extension
+ * only injects this server for those):
+ *  - `list_notify_destinations` — discover the conversations the agent may notify
+ *    (answers "how do I get a conversationId?" when there is no triggering payload).
+ *  - `notify_conversation` — deliver a message as a real turn into one of them.
+ */
+export declare const NOTIFY_TOOLS_MCP_SERVER_NAME = "mono-agent-notify";
+/** A conversation the agent may proactively notify, surfaced to the model for discovery. */
+export interface NotifyToolDestination {
+    /** Destination conversationId to pass to `notify_conversation`, e.g. `telegram:42`. */
+    readonly conversationId: string;
+    /** Owning channel id (telegram/slack). */
+    readonly channelId: string;
+    /** ISO timestamp of the most recent turn on this conversation, if known. */
+    readonly lastSeen?: string;
+    /** True when this is an allowlisted destination the agent has not yet conversed with. */
+    readonly fromAllowlist?: boolean;
+}
+export interface NotifyToolsDeps {
+    /** Deliver `text` as a real turn into `conversationId` (allowlist-enforced by the owning channel). */
+    readonly deliver: (conversationId: string, text: string) => Promise<NotifyDeliveryResult>;
+    /** The conversations the agent may notify right now (seen + single-allowlist destinations). */
+    readonly listDestinations: () => Promise<readonly NotifyToolDestination[]>;
+    readonly logger?: MonoAgentAppLogger | undefined;
+}
+export interface NotifyToolsServer {
+    /** Loopback URL the runtime's MCP client connects to (`http://127.0.0.1:<port>/mcp`). */
+    readonly url: string;
+    /** Bearer token required on every request. */
+    readonly token: string;
+    close(): Promise<void>;
+}
+/**
+ * Start the in-process notify MCP server on an ephemeral loopback port. Stateless:
+ * each request gets a fresh `McpServer`+transport (the tools are pure request/response),
+ * which sidesteps session bookkeeping and concurrent-trigger races.
+ */
+export declare function startNotifyToolsServer(deps: NotifyToolsDeps): Promise<NotifyToolsServer>;
+//# sourceMappingURL=notify-tool.d.ts.map

package/dist/notify-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-tool.d.ts","sourceRoot":"","sources":["../src/notify-tool.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1F,+FAA+F;IAC/F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,iBAAiB;IAChC,yFAAyF;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgC9F"}

package/dist/notify-tool.js

@@ -0,0 +1,182 @@
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import * as z from "zod/v4";
+/**
+ * In-process MCP server that exposes the proactive-notification tools to the agent.
+ *
+ * Unlike `memory_recall`/the adapter send tools (stdio children that re-derive
+ * everything from config/disk), notification delivery has to run a real turn on a
+ * destination channel's LIVE session, so the handler must reach the app's running
+ * channel registry — which only exists in this process. We therefore host the
+ * tools over loopback HTTP (the one MCP transport the runtime's client supports
+ * for an in-process server) and close over app-supplied delivery/discovery hooks.
+ *
+ * Two tools, both intended for proactive cron/webhook turns (the runtime extension
+ * only injects this server for those):
+ *  - `list_notify_destinations` — discover the conversations the agent may notify
+ *    (answers "how do I get a conversationId?" when there is no triggering payload).
+ *  - `notify_conversation` — deliver a message as a real turn into one of them.
+ */
+export const NOTIFY_TOOLS_MCP_SERVER_NAME = "mono-agent-notify";
+const MCP_PATH = "/mcp";
+/**
+ * Start the in-process notify MCP server on an ephemeral loopback port. Stateless:
+ * each request gets a fresh `McpServer`+transport (the tools are pure request/response),
+ * which sidesteps session bookkeeping and concurrent-trigger races.
+ */
+export async function startNotifyToolsServer(deps) {
+    const token = randomBytes(24).toString("hex");
+    const expectedAuth = `Bearer ${token}`;
+    const httpServer = createServer((req, res) => {
+        void handleHttpRequest(req, res, expectedAuth, deps);
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (error) => reject(error);
+        httpServer.once("error", onError);
+        httpServer.listen(0, "127.0.0.1", () => {
+            httpServer.removeListener("error", onError);
+            resolve();
+        });
+    });
+    const address = httpServer.address();
+    if (address === null || typeof address === "string") {
+        httpServer.close();
+        throw new Error("notify tools server: failed to bind a loopback port.");
+    }
+    const url = `http://127.0.0.1:${address.port}${MCP_PATH}`;
+    return {
+        url,
+        token,
+        close: () => new Promise((resolve) => {
+            httpServer.close(() => resolve());
+        }),
+    };
+}
+async function handleHttpRequest(req, res, expectedAuth, deps) {
+    if (!isAuthorized(req, expectedAuth)) {
+        res.writeHead(401, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: "unauthorized" }));
+        return;
+    }
+    if (req.url?.split("?", 1)[0] !== MCP_PATH) {
+        res.writeHead(404, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: "not found" }));
+        return;
+    }
+    // Stateless: only POST carries JSON-RPC. The single tool round-trips are
+    // request/response, so reject the optional GET/DELETE session streams.
+    if (req.method !== "POST") {
+        res.writeHead(405, { "content-type": "application/json", allow: "POST" });
+        res.end(JSON.stringify({ error: "method not allowed" }));
+        return;
+    }
+    const server = buildMcpServer(deps);
+    // Stateless: omitting sessionIdGenerator runs the transport without session
+    // tracking, so a fresh server+transport per request is the correct pattern and
+    // concurrent triggers never share state.
+    const transport = new StreamableHTTPServerTransport({});
+    // Idempotent: with HTTP keep-alive the response can `finish` without firing
+    // `close`, so bind both and guard against a double-close leaking nothing.
+    let cleaned = false;
+    const cleanup = () => {
+        if (cleaned)
+            return;
+        cleaned = true;
+        void transport.close();
+        void server.close();
+    };
+    res.on("close", cleanup);
+    res.on("finish", cleanup);
+    try {
+        // The transport implements the SDK Transport interface at runtime; the cast
+        // bridges an exactOptionalPropertyTypes mismatch in the SDK's own typings.
+        await server.connect(transport);
+        await transport.handleRequest(req, res);
+    }
+    catch (error) {
+        deps.logger?.error?.("notify tools server: request failed.", { reason: reasonOf(error) });
+        if (!res.headersSent) {
+            res.writeHead(500, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: "internal error" }));
+        }
+    }
+}
+function isAuthorized(req, expectedAuth) {
+    const header = req.headers.authorization;
+    if (typeof header !== "string") {
+        return false;
+    }
+    const a = Buffer.from(header);
+    const b = Buffer.from(expectedAuth);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function buildMcpServer(deps) {
+    const server = new McpServer({ name: "agent-notify-tools", version: "0.1.0" });
+    server.registerTool("list_notify_destinations", {
+        title: "List notification destinations",
+        description: "List the conversations you can proactively deliver a message to with notify_conversation. " +
+            "Use this when you have no triggering conversationId in hand (e.g. a scheduled/cron run) to " +
+            "discover where to reach the user. Each entry's `conversationId` is what notify_conversation " +
+            "expects — read its description for how delivery works (the destination turn's reply is what is sent).",
+        inputSchema: {},
+    }, async () => {
+        const destinations = await deps.listDestinations();
+        const lines = destinations.length === 0
+            ? ["(no known destinations yet — the agent has not handled any push-channel conversation and no single allowlisted destination is configured)"]
+            : destinations.map((d) => `- ${d.conversationId}${d.lastSeen === undefined ? "" : ` (last active ${d.lastSeen})`}${d.fromAllowlist === true ? " (allowlisted, not yet used)" : ""}`);
+        return {
+            content: [{ type: "text", text: ["Conversations you can notify:", ...lines].join("\n") }],
+            structuredContent: { destinations },
+        };
+    });
+    server.registerTool("notify_conversation", {
+        title: "Notify a conversation",
+        description: "Proactively deliver a message into a conversation you are not currently handling. The message " +
+            "runs as a real turn on that conversation's own session and THAT TURN'S REPLY is what the user " +
+            "receives (so the user sees it natively and the conversation remembers it). Use this to follow up " +
+            "from a cron job or an inbound webhook callback.\n\n" +
+            "How `text` is delivered (read carefully — this is the #1 mistake):\n" +
+            "- `text` is the stimulus the destination conversation acts on; it is NOT posted verbatim. The " +
+            "destination agent reads `text` and composes the user-facing reply with its own context, and that " +
+            "reply is delivered automatically.\n" +
+            "- To deliver pre-composed or exact content (e.g. a digest), phrase `text` as an explicit reply " +
+            "instruction, e.g.: \"Reply with the text below exactly as written, adding nothing, and do not call " +
+            "any tools — your reply is delivered automatically:\\n\\n<your content>\".\n" +
+            "- The destination must NOT call its own send tools (e.g. slack_send_message) — its reply is already " +
+            "delivered, so sending again posts the message twice.\n\n" +
+            "How to choose `conversationId`:\n" +
+            "- Webhook/async callback: pass the `conversationId` carried in the triggering request payload.\n" +
+            "- Otherwise (e.g. a scheduled run): call list_notify_destinations first and pick from it.\n\n" +
+            "Delivery is bounded by the channel allowlist and may return delivered:false (e.g. unknown/disallowed " +
+            "id, channel offline). The call blocks until the destination turn replies, so keep that turn to a single " +
+            "reply — a turn that re-scans, recalls, or hunts for a send tool is slow and can hit the request timeout. " +
+            "If you receive delivered:false, do not assume it was also delivered some other way.",
+        inputSchema: {
+            conversationId: z
+                .string()
+                .min(1)
+                .describe("Destination conversationId, e.g. telegram:42 or slack:C123 (or slack:C123:1718.99 for a thread)."),
+            text: z
+                .string()
+                .min(1)
+                .describe("What to deliver. The destination conversation runs this as a turn and its reply is delivered; " +
+                "to deliver exact content, phrase this as a reply-verbatim, no-tools instruction (see the tool description)."),
+        },
+    }, async (args) => {
+        const result = await deps.deliver(args.conversationId, args.text);
+        const summary = result.delivered
+            ? `Delivered to ${args.conversationId}.`
+            : `Not delivered to ${args.conversationId}${result.reason === undefined ? "" : `: ${result.reason}`}.`;
+        return {
+            content: [{ type: "text", text: summary }],
+            structuredContent: { delivered: result.delivered, ...(result.reason === undefined ? {} : { reason: result.reason }) },
+        };
+    });
+    return server;
+}
+function reasonOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=notify-tool.js.map

package/dist/notify-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-tool.js","sourceRoot":"","sources":["../src/notify-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAC;AA8BhE,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAqB;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,UAAU,KAAK,EAAE,CAAC;IAEvC,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,KAAK,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACrC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAwB,CAAC;IAC3D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,oBAAoB,OAAO,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;IAE1D,OAAO;QACL,GAAG;QACH,KAAK;QACL,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,YAAoB,EACpB,IAAqB;IAErB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,4EAA4E;IAC5E,+EAA+E;IAC/E,yCAAyC;IACzC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,CAAC,CAAC;IACxD,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,4EAA4E;QAC5E,2EAA2E;QAC3E,MAAM,MAAM,CAAC,OAAO,CAAC,SAA4D,CAAC,CAAC;QACnF,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAoB,EAAE,YAAoB;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,IAAqB;IAC3C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAE/E,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,uGAAuG;QACzG,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE;QACT,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC;YACrC,CAAC,CAAC,CAAC,2IAA2I,CAAC;YAC/I,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvL,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,+BAA+B,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,iBAAiB,EAAE,EAAE,YAAY,EAAE;SACpC,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,gGAAgG;YAChG,gGAAgG;YAChG,mGAAmG;YACnG,qDAAqD;YACrD,sEAAsE;YACtE,gGAAgG;YAChG,mGAAmG;YACnG,qCAAqC;YACrC,iGAAiG;YACjG,qGAAqG;YACrG,6EAA6E;YAC7E,sGAAsG;YACtG,0DAA0D;YAC1D,mCAAmC;YACnC,kGAAkG;YAClG,+FAA+F;YAC/F,uGAAuG;YACvG,0GAA0G;YAC1G,2GAA2G;YAC3G,qFAAqF;QACvF,WAAW,EAAE;YACX,cAAc,EAAE,CAAC;iBACd,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CAAC,kGAAkG,CAAC;YAC/G,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,CACP,gGAAgG;gBAC9F,6GAA6G,CAChH;SACJ;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS;YAC9B,CAAC,CAAC,gBAAgB,IAAI,CAAC,cAAc,GAAG;YACxC,CAAC,CAAC,oBAAoB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;QACzG,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC1C,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;SACtH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/package-version.d.ts

@@ -0,0 +1,3 @@
+/** The installed agent-app version, used for exact lockstep plugin guidance. */
+export declare function agentAppPackageVersion(): string | undefined;
+//# sourceMappingURL=package-version.d.ts.map

package/dist/package-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-version.d.ts","sourceRoot":"","sources":["../src/package-version.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAS3D"}

package/dist/package-version.js

@@ -0,0 +1,14 @@
+import { createRequire } from "node:module";
+/** The installed agent-app version, used for exact lockstep plugin guidance. */
+export function agentAppPackageVersion() {
+    try {
+        const pkg = createRequire(import.meta.url)("../package.json");
+        return typeof pkg.version === "string" && pkg.version.trim().length > 0
+            ? pkg.version.trim()
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=package-version.js.map

package/dist/package-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-version.js","sourceRoot":"","sources":["../src/package-version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,gFAAgF;AAChF,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAmC,CAAC;QAChG,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACrE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;YACpB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/pi-auth-store-inspection.d.ts

@@ -0,0 +1,21 @@
+export declare const MAX_PI_AUTH_STORE_BYTES = 1048576;
+export type PiAuthStoreUnsafeReason = "owner-check-unavailable" | "symbolic-link" | "not-regular-file" | "multiple-hard-links" | "oversized" | "foreign-owner" | "not-owner-only" | "changed-during-read" | "malformed-json" | "unreadable";
+export type PiAuthStoreInspection = {
+    readonly status: "ok";
+    readonly auth: Readonly<Record<string, unknown>>;
+} | {
+    readonly status: "missing";
+} | {
+    readonly status: "unsafe";
+    readonly reason: PiAuthStoreUnsafeReason;
+};
+/**
+ * Inspect an existing Pi credential store without following aliases or reading
+ * unbounded input. Credential discovery is deliberately stricter than the
+ * explicit, locked repair flow: discovery accepts only a current-user,
+ * owner-only, single-link regular file. The repair flow may read a
+ * current-user, non-writable 0644 file under its exclusive lock solely so it
+ * can atomically replace that file with a hardened 0600 store.
+ */
+export declare function inspectPiAuthStore(path: string): Promise<PiAuthStoreInspection>;
+//# sourceMappingURL=pi-auth-store-inspection.d.ts.map

package/dist/pi-auth-store-inspection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-auth-store-inspection.d.ts","sourceRoot":"","sources":["../src/pi-auth-store-inspection.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAEjD,MAAM,MAAM,uBAAuB,GAC/B,yBAAyB,GACzB,eAAe,GACf,kBAAkB,GAClB,qBAAqB,GACrB,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,GAChB,YAAY,CAAC;AAEjB,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,CAAC;AAE5E;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6DrF"}

package/dist/pi-auth-store-inspection.js

@@ -0,0 +1,120 @@
+import { constants as fsConstants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+export const MAX_PI_AUTH_STORE_BYTES = 1_048_576;
+/**
+ * Inspect an existing Pi credential store without following aliases or reading
+ * unbounded input. Credential discovery is deliberately stricter than the
+ * explicit, locked repair flow: discovery accepts only a current-user,
+ * owner-only, single-link regular file. The repair flow may read a
+ * current-user, non-writable 0644 file under its exclusive lock solely so it
+ * can atomically replace that file with a hardened 0600 store.
+ */
+export async function inspectPiAuthStore(path) {
+    if (typeof process.getuid !== "function") {
+        return { status: "unsafe", reason: "owner-check-unavailable" };
+    }
+    let handle;
+    try {
+        try {
+            handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+        }
+        catch (error) {
+            if (hasErrorCode(error, "ENOENT"))
+                return { status: "missing" };
+            if (hasErrorCode(error, "ELOOP") || hasErrorCode(error, "EMLINK")) {
+                return { status: "unsafe", reason: "symbolic-link" };
+            }
+            return { status: "unsafe", reason: "unreadable" };
+        }
+        const before = await handle.stat();
+        const unsafeBefore = unsafeStatReason(before, process.getuid());
+        if (unsafeBefore !== undefined)
+            return { status: "unsafe", reason: unsafeBefore };
+        const contents = await readBounded(handle, MAX_PI_AUTH_STORE_BYTES);
+        if (contents === undefined)
+            return { status: "unsafe", reason: "oversized" };
+        const after = await handle.stat();
+        const unsafeAfter = unsafeStatReason(after, process.getuid());
+        if (unsafeAfter !== undefined)
+            return { status: "unsafe", reason: unsafeAfter };
+        if (!sameOpenedFileSnapshot(before, after) || contents.byteLength !== after.size) {
+            return { status: "unsafe", reason: "changed-during-read" };
+        }
+        let pathStat;
+        try {
+            pathStat = await lstat(path);
+        }
+        catch {
+            return { status: "unsafe", reason: "changed-during-read" };
+        }
+        const unsafePath = unsafeStatReason(pathStat, process.getuid());
+        if (unsafePath !== undefined)
+            return { status: "unsafe", reason: unsafePath };
+        if (pathStat.dev !== after.dev || pathStat.ino !== after.ino) {
+            return { status: "unsafe", reason: "changed-during-read" };
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(contents.toString("utf8"));
+        }
+        catch {
+            return { status: "unsafe", reason: "malformed-json" };
+        }
+        if (!isRecord(parsed))
+            return { status: "unsafe", reason: "malformed-json" };
+        return { status: "ok", auth: parsed };
+    }
+    catch {
+        return { status: "unsafe", reason: "unreadable" };
+    }
+    finally {
+        try {
+            await handle?.close();
+        }
+        catch {
+            // Inspection is read-only and already fails closed; a close failure must
+            // not turn an unsafe credential store into an uncaught validation error.
+        }
+    }
+}
+function unsafeStatReason(value, ownerUid) {
+    if (!value.isFile())
+        return "not-regular-file";
+    if (value.nlink !== 1)
+        return "multiple-hard-links";
+    if (value.size > MAX_PI_AUTH_STORE_BYTES)
+        return "oversized";
+    if (value.uid !== ownerUid)
+        return "foreign-owner";
+    if ((value.mode & 0o077) !== 0)
+        return "not-owner-only";
+    return undefined;
+}
+async function readBounded(handle, maxBytes) {
+    const output = Buffer.allocUnsafe(maxBytes + 1);
+    let offset = 0;
+    while (offset < output.byteLength) {
+        const { bytesRead } = await handle.read(output, offset, output.byteLength - offset, null);
+        if (bytesRead === 0)
+            return output.subarray(0, offset);
+        offset += bytesRead;
+    }
+    return undefined;
+}
+function sameOpenedFileSnapshot(left, right) {
+    return left.dev === right.dev
+        && left.ino === right.ino
+        && left.uid === right.uid
+        && left.nlink === right.nlink
+        && left.mode === right.mode
+        && left.size === right.size
+        && left.mtimeMs === right.mtimeMs
+        && left.ctimeMs === right.ctimeMs;
+}
+function hasErrorCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=pi-auth-store-inspection.js.map

package/dist/pi-auth-store-inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-auth-store-inspection.js","sourceRoot":"","sources":["../src/pi-auth-store-inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAc,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AAEhE,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAmBjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,MAA8B,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAChE,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAClE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAElF,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAE7E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAChF,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,QAAe,CAAC;QACpB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9E,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC7E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,yEAAyE;QAC3E,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAY,EAAE,QAAgB;IACtD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,kBAAkB,CAAC;IAC/C,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,GAAG,uBAAuB;QAAE,OAAO,WAAW,CAAC;IAC7D,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAkB,EAAE,QAAgB;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1F,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,IAAI,SAAS,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAW,EAAE,KAAY;IACvD,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;WACxB,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;WACtB,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;WACtB,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;WAC1B,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;WACxB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;WACxB,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;WAC9B,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/pi-oauth-login-main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=pi-oauth-login-main.d.ts.map

package/dist/pi-oauth-login-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-oauth-login-main.d.ts","sourceRoot":"","sources":["../src/pi-oauth-login-main.ts"],"names":[],"mappings":""}

package/dist/pi-oauth-login-main.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { runPiOAuthLogin } from "./pi-oauth-login.js";
+const [provider, ...extra] = process.argv.slice(2);
+if (provider === undefined || extra.length > 0) {
+    process.stderr.write("Usage: mono-agent-pi-oauth-login <provider>\n");
+    process.exitCode = 2;
+}
+else {
+    runPiOAuthLogin(provider).catch((error) => {
+        process.stderr.write(`Pi OAuth login failed: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=pi-oauth-login-main.js.map

package/dist/pi-oauth-login-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-oauth-login-main.js","sourceRoot":"","sources":["../src/pi-oauth-login-main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnD,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;KAAM,CAAC;IACN,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3G,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pi-oauth-login.d.ts

@@ -0,0 +1,22 @@
+import { type OAuthProviderInterface } from "@earendil-works/pi-ai/oauth";
+export interface PiOAuthLoginIo {
+    readonly ask: (question: string) => Promise<string>;
+    readonly write: (text: string) => void;
+}
+export interface RunPiOAuthLoginOptions {
+    readonly authPath?: string;
+    readonly provider?: OAuthProviderInterface;
+    readonly io?: PiOAuthLoginIo;
+}
+/**
+ * Run Pi's provider-owned OAuth implementation with a complete terminal
+ * callback surface. In particular, Anthropic races its localhost callback
+ * against `onManualCodeInput`; Pi's generic CLI omits that callback even though
+ * it prints instructions saying a final redirect URL can be pasted.
+ *
+ * The raw line is intentionally handed to the provider unchanged. Anthropic's
+ * shipped parser extracts code/state from the full URL and validates state
+ * against the PKCE verifier before token exchange.
+ */
+export declare function runPiOAuthLogin(providerId: string, options?: RunPiOAuthLoginOptions): Promise<void>;
+//# sourceMappingURL=pi-oauth-login.d.ts.map

package/dist/pi-oauth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-oauth-login.d.ts","sourceRoot":"","sources":["../src/pi-oauth-login.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,6BAA6B,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,EAAE,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/pi-oauth-login.js

@@ -0,0 +1,79 @@
+import { chmod, readFile, writeFile } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { getOAuthProvider, } from "@earendil-works/pi-ai/oauth";
+/**
+ * Run Pi's provider-owned OAuth implementation with a complete terminal
+ * callback surface. In particular, Anthropic races its localhost callback
+ * against `onManualCodeInput`; Pi's generic CLI omits that callback even though
+ * it prints instructions saying a final redirect URL can be pasted.
+ *
+ * The raw line is intentionally handed to the provider unchanged. Anthropic's
+ * shipped parser extracts code/state from the full URL and validates state
+ * against the PKCE verifier before token exchange.
+ */
+export async function runPiOAuthLogin(providerId, options = {}) {
+    const provider = options.provider ?? getOAuthProvider(providerId);
+    if (provider === undefined || provider.id !== providerId) {
+        throw new Error(`Unknown bundled Pi OAuth provider: ${providerId}`);
+    }
+    const readline = options.io === undefined
+        ? createInterface({ input: process.stdin, output: process.stdout })
+        : undefined;
+    const io = options.io ?? {
+        ask: async (question) => await new Promise((resolve) => readline.question(question, resolve)),
+        write: (text) => process.stdout.write(text),
+    };
+    try {
+        const callbacks = {
+            onAuth: (info) => {
+                io.write(`\nOpen this URL in your browser:\n${info.url}\n`);
+                if (info.instructions !== undefined)
+                    io.write(`${info.instructions}\n`);
+                io.write("\n");
+            },
+            onDeviceCode: (info) => {
+                io.write(`\nOpen this URL in your browser:\n${info.verificationUri}\n`);
+                io.write(`Enter code: ${info.userCode}\n\n`);
+            },
+            onPrompt: async (prompt) => await io.ask(`${prompt.message}${prompt.placeholder === undefined ? "" : ` (${prompt.placeholder})`}: `),
+            onManualCodeInput: async () => await io.ask("Paste the final redirect URL or authorization code " +
+                "(its OAuth state will be validated), or wait for the localhost callback:\n> "),
+            onSelect: async (prompt) => {
+                io.write(`\n${prompt.message}\n`);
+                prompt.options.forEach((option, index) => io.write(`  ${index + 1}. ${option.label}\n`));
+                const answer = await io.ask(`Enter number (1-${prompt.options.length}): `);
+                return prompt.options[Number.parseInt(answer, 10) - 1]?.id;
+            },
+            onProgress: (message) => io.write(`${message}\n`),
+        };
+        const credentials = await provider.login(callbacks);
+        const authPath = options.authPath ?? "auth.json";
+        const auth = await readAuth(authPath);
+        await writeFile(authPath, `${JSON.stringify({
+            ...auth,
+            [providerId]: { type: "oauth", ...credentials },
+        }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+        await chmod(authPath, 0o600);
+        io.write(`\nCredentials saved to ${authPath}\n`);
+    }
+    finally {
+        readline?.close();
+    }
+}
+async function readAuth(path) {
+    let contents;
+    try {
+        contents = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+    const parsed = JSON.parse(contents);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`${path} must contain a JSON object.`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=pi-oauth-login.js.map

package/dist/pi-oauth-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-oauth-login.js","sourceRoot":"","sources":["../src/pi-oauth-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EACL,gBAAgB,GAGjB,MAAM,6BAA6B,CAAC;AAarC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,KAAK,SAAS;QACvC,CAAC,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,EAAE,GAAmB,OAAO,CAAC,EAAE,IAAI;QACvC,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAAC,QAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtG,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;KAC5C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,GAAwB;YACrC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACf,EAAE,CAAC,KAAK,CAAC,qCAAqC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5D,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;oBAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;gBACxE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;gBACrB,EAAE,CAAC,KAAK,CAAC,qCAAqC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;gBACxE,EAAE,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,QAAQ,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CACtC,GAAG,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,WAAW,GAAG,IAAI,CAC3F;YACD,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CACzC,qDAAqD;gBACrD,8EAA8E,CAC/E;YACD,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;gBACzB,EAAE,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;gBAClC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;gBACzF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC3E,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7D,CAAC;YACD,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;SAClD,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1C,GAAG,IAAI;YACP,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE;SAChD,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,0BAA0B,QAAQ,IAAI,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,QAAQ,EAAE,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC"}

package/dist/proactive-notify.d.ts

@@ -15,6 +15,8 @@ export interface ProactiveNotifyInput {
      * destination's harness (e.g. a Slack interactive trigger).
      */
     readonly verbatim?: boolean;
+    /** Stable host delivery identity for adapters with duplicate suppression. */
+    readonly deliveryKey?: string;
     /** Currently running channels, keyed by id (the app's live registry). */
     readonly running: ReadonlyMap<ChannelId, Pick<RunningChannel, "notify">>;
     readonly logger?: MonoAgentAppLogger;

package/dist/proactive-notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proactive-notify.d.ts","sourceRoot":"","sources":["../src/proactive-notify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAInF,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAcxE,mHAAmH;AACnH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAMtF;AAED,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+B3G"}
+{"version":3,"file":"proactive-notify.d.ts","sourceRoot":"","sources":["../src/proactive-notify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAInF,YAAY,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAcxE,mHAAmH;AACnH,wBAAgB,wBAAwB,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAMtF;AAED,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgC3G"}

package/dist/proactive-notify.js

@@ -44,6 +44,7 @@ export async function routeProactiveNotification(input) {
             conversationId: input.conversationId,
             text: input.text,
             ...(input.verbatim === undefined ? {} : { verbatim: input.verbatim }),
+            ...(input.deliveryKey === undefined ? {} : { deliveryKey: input.deliveryKey }),
         });
     }
     catch (error) {

package/dist/proactive-notify.js.map

@@ -1 +1 @@
-{"version":3,"file":"proactive-notify.js","sourceRoot":"","sources":["../src/proactive-notify.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,MAAM,sBAAsB,GAAuC;IACjE,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,mHAAmH;AACnH,MAAM,UAAU,wBAAwB,CAAC,cAAsB;IAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAA2B;IAC1E,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,2DAA2D,EAAE;YAChF,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAClB,kGAAkG,EAClG,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,CACpD,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,gEAAgE,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,kEAAkE,EAAE;YACvF,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"proactive-notify.js","sourceRoot":"","sources":["../src/proactive-notify.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,MAAM,sBAAsB,GAAuC;IACjE,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,mHAAmH;AACnH,MAAM,UAAU,wBAAwB,CAAC,cAAsB;IAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,sBAAsB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAqBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAA2B;IAC1E,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,2DAA2D,EAAE;YAChF,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAClB,kGAAkG,EAClG,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS,EAAE,CACpD,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,gEAAgE,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SAC/E,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,kEAAkE,EAAE;YACvF,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,SAAS;YACT,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}