@qoniai/qoni 0.4.0

package/dist/index.js

@@ -0,0 +1,2866 @@
+// src/signature.ts
+import { createHmac } from "crypto";
+function filter(value) {
+  return String(value).replace(/[\t\n\r\f]/g, " ");
+}
+function canonicalizedHeaders(headers) {
+  return Object.keys(headers).filter((key) => key.startsWith("x-authing-") || key === "date").sort().map((key) => `${key}:${filter(headers[key]).trim()}
+`).join("");
+}
+function canonicalizedResource(pathname, params) {
+  const keys = Object.keys(params).sort();
+  if (!keys.length) return pathname;
+  const query = keys.map((key) => {
+    const value = params[key];
+    return `${key}=${typeof value === "object" && value !== null ? JSON.stringify(value) : value}`;
+  });
+  return `${pathname}?${query.join("&")}`;
+}
+function buildStringToSign(method, pathname, headers, params) {
+  return `${method.toUpperCase()}
+${canonicalizedHeaders(headers)}${canonicalizedResource(
+    pathname,
+    params
+  )}`;
+}
+function buildSignature(secretKey, stringToSign) {
+  return createHmac("sha1", secretKey).update(stringToSign, "utf8").digest("base64");
+}
+function buildAuthorization(accessKey, secretKey, stringToSign) {
+  return `authing ${accessKey}:${buildSignature(secretKey, stringToSign)}`;
+}
+
+// src/auth.ts
+var lastSigningTimestamp = 0;
+function nextSigningTimestamp() {
+  const now = Date.now();
+  lastSigningTimestamp = Math.max(now, lastSigningTimestamp + 1);
+  return lastSigningTimestamp;
+}
+function buildSignedHeaders(credentials, method, pathname, payload) {
+  const headers = {
+    "content-type": "application/json",
+    // GenAuth rejects an already-consumed signature. A strictly monotonic
+    // timestamp keeps otherwise identical requests unique within a process,
+    // including retries or concurrent calls that start in the same millisecond.
+    "x-authing-date": String(nextSigningTimestamp()),
+    "x-authing-signature-method": "HMAC-SHA1",
+    "x-authing-signature-version": "1.0"
+  };
+  const stringToSign = buildStringToSign(method, pathname, headers, payload);
+  headers.authorization = buildAuthorization(
+    credentials.accessKey,
+    credentials.secretKey,
+    stringToSign
+  );
+  return headers;
+}
+
+// src/scopes.ts
+var QoniScopes = {
+  GUMEM_SESSION_CREATE: "gumem.session:create",
+  GUMEM_MESSAGE_WRITE: "gumem.message:write",
+  GUMEM_MEMORY_READ: "gumem.memory:read",
+  GUMEM_MEMORY_WRITE: "gumem.memory:write",
+  GUMEM_MEMORY_DELETE: "gumem.memory:delete",
+  GUMEM_SEARCH_RUN: "gumem.search:run",
+  GUMEM_ADMIN_MANAGE: "gumem.admin:manage",
+  GUMEM_RESOURCE_WRITE: "gumem.resource:write",
+  GUMEM_ACTION_WRITE: "gumem.action:write",
+  GUMEM_ACTION_READ: "gumem.action:read",
+  GUMEM_PROFILE_READ: "gumem.profile:read",
+  // WebAgent products: exactly two verbs per product — `read` (observe) and
+  // `manage` (anything that changes execution state). See
+  // wa/docs/qoni-sdk-public-surface.md §3.
+  DO_ANYTHING_READ: "webagent.do_anything:read",
+  DO_ANYTHING_MANAGE: "webagent.do_anything:manage",
+  WEB_SEARCH_READ: "webagent.web_search:read",
+  WEB_SEARCH_MANAGE: "webagent.web_search:manage",
+  DEEP_RESEARCH_READ: "webagent.deep_research:read",
+  DEEP_RESEARCH_MANAGE: "webagent.deep_research:manage",
+  TRACK_READ: "webagent.track:read",
+  TRACK_MANAGE: "webagent.track:manage"
+};
+var QoniProductScopes = {
+  doAnything: [
+    QoniScopes.DO_ANYTHING_READ,
+    QoniScopes.DO_ANYTHING_MANAGE
+  ],
+  webSearch: [
+    QoniScopes.WEB_SEARCH_READ,
+    QoniScopes.WEB_SEARCH_MANAGE
+  ],
+  deepResearch: [
+    QoniScopes.DEEP_RESEARCH_READ,
+    QoniScopes.DEEP_RESEARCH_MANAGE
+  ],
+  track: [
+    QoniScopes.TRACK_READ,
+    QoniScopes.TRACK_MANAGE
+  ]
+};
+var KNOWN_SCOPES = Object.values(QoniScopes);
+var QoniScopeBundles = {
+  GUMEM_READONLY: [QoniScopes.GUMEM_MEMORY_READ, QoniScopes.GUMEM_PROFILE_READ],
+  GUMEM_SESSION_RECALL: [
+    QoniScopes.GUMEM_MEMORY_READ,
+    QoniScopes.GUMEM_MEMORY_WRITE,
+    QoniScopes.GUMEM_MESSAGE_WRITE
+  ],
+  GUMEM_WRITE: [
+    QoniScopes.GUMEM_SESSION_CREATE,
+    QoniScopes.GUMEM_MESSAGE_WRITE,
+    QoniScopes.GUMEM_ACTION_WRITE
+  ],
+  // One bundle per WebAgent product = [read, manage].
+  DO_ANYTHING: [
+    QoniScopes.DO_ANYTHING_READ,
+    QoniScopes.DO_ANYTHING_MANAGE
+  ],
+  WEB_SEARCH: [
+    QoniScopes.WEB_SEARCH_READ,
+    QoniScopes.WEB_SEARCH_MANAGE
+  ],
+  DEEP_RESEARCH: [
+    QoniScopes.DEEP_RESEARCH_READ,
+    QoniScopes.DEEP_RESEARCH_MANAGE
+  ],
+  TRACK: [
+    QoniScopes.TRACK_READ,
+    QoniScopes.TRACK_MANAGE
+  ]
+};
+
+// src/types.ts
+function isJsonObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/errors.ts
+var QoniError = class extends Error {
+  code;
+  status;
+  requestId;
+  traceId;
+  auditId;
+  retryable;
+  body;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "QoniError";
+    this.code = options.code || "qoni_error";
+    this.status = options.status;
+    this.requestId = options.requestId;
+    this.traceId = options.traceId;
+    this.auditId = options.auditId;
+    this.retryable = options.retryable ?? false;
+    this.body = options.body;
+    if (options.cause !== void 0) {
+      this.cause = options.cause;
+    }
+  }
+};
+var QoniAuthError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "auth.failed", ...options });
+    this.name = "QoniAuthError";
+  }
+};
+var QoniDelegationRequiredError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "delegation.required", ...options });
+    this.name = "QoniDelegationRequiredError";
+  }
+};
+var QoniPermissionDeniedError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "permission_denied", ...options });
+    this.name = "QoniPermissionDeniedError";
+  }
+};
+var QoniTokenExpiredError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "token.expired", ...options });
+    this.name = "QoniTokenExpiredError";
+  }
+};
+var QoniValidationError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "validation.failed", ...options });
+    this.name = "QoniValidationError";
+  }
+};
+var QoniRateLimitError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "rate_limit.exceeded", retryable: true, ...options });
+    this.name = "QoniRateLimitError";
+  }
+};
+var QoniUpstreamError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "upstream.failed", retryable: true, ...options });
+    this.name = "QoniUpstreamError";
+  }
+};
+var QoniTimeoutError = class extends QoniError {
+  constructor(message, options = {}) {
+    super(message, { code: "timeout", retryable: true, ...options });
+    this.name = "QoniTimeoutError";
+  }
+};
+function errorFromPayload(status, payload, fallbackMessage) {
+  const detail = isJsonObject(payload) ? payload.detail : void 0;
+  const detailObject = isJsonObject(detail) ? detail : void 0;
+  const source = detailObject || (isJsonObject(payload) ? payload : {});
+  const code = stringField(source, "code") || stringField(source, "apiCode") || statusCodeToCode(status);
+  const rawMessage = stringField(source, "message") || stringField(source, "detail") || fallbackMessage;
+  const message = appendOnboardingHint(
+    appendDeniedScopes(appendUpstreamDescription(rawMessage, source), source),
+    code
+  );
+  const options = {
+    code,
+    status,
+    requestId: stringField(payload, "requestId") || stringField(source, "requestId"),
+    traceId: stringField(payload, "traceId") || stringField(source, "traceId"),
+    auditId: stringField(payload, "auditId") || stringField(source, "auditId"),
+    retryable: status === 429 || status >= 500,
+    body: payload
+  };
+  if (isTokenExpired(code, message)) return new QoniTokenExpiredError(message, options);
+  if (isDelegationRequired(code)) return new QoniDelegationRequiredError(message, options);
+  if (status === 401) return new QoniAuthError(message, options);
+  if (status === 403 || isPermissionDenied(code)) {
+    return new QoniPermissionDeniedError(appendKnownScopes(message), options);
+  }
+  if (status === 400 || status === 422) return new QoniValidationError(message, options);
+  if (status === 429) return new QoniRateLimitError(message, options);
+  if (status >= 500) return new QoniUpstreamError(message, options);
+  return new QoniError(message, options);
+}
+function timeoutError(cause) {
+  return new QoniTimeoutError("Qoni request timed out", { cause });
+}
+function networkError(cause) {
+  return new QoniUpstreamError("Qoni network request failed", { cause });
+}
+function stringField(value, key) {
+  if (!isJsonObject(value)) return void 0;
+  const field = value[key];
+  return typeof field === "string" && field ? field : void 0;
+}
+function appendDeniedScopes(message, source) {
+  const details = isJsonObject(source) ? source.details : void 0;
+  const raw = (isJsonObject(details) ? details.deniedScopes : void 0) ?? (isJsonObject(source) ? source.deniedScopes : void 0);
+  if (!Array.isArray(raw) || raw.length === 0) return message;
+  const scopes = raw.filter((s) => typeof s === "string");
+  if (scopes.length === 0 || message.includes(scopes[0])) return message;
+  return `${message} (scopes not granted: ${scopes.join(", ")})`;
+}
+function appendUpstreamDescription(message, source) {
+  const details = isJsonObject(source) ? source.details : void 0;
+  const upstream = isJsonObject(details) ? details.upstream : void 0;
+  const description = stringField(upstream, "error_description") || stringField(upstream, "message") || stringField(upstream, "error");
+  if (!description || message.includes(description)) return message;
+  return `${message}: ${description}`;
+}
+var ONBOARDING_HINTS = {
+  "eak.delegation.user_not_bound": "Hint: the userId is not in the GenAuth userpool bound to this credential. Resolve a real user with qoni.resolveAnyBoundUser() (demo/smoke) or qoni.currentUser({ accessToken }).",
+  "eak.genauth.userpool_binding_missing": "Hint: bind the Qoni credential to a GenAuth userpool before calling genauth.users.*."
+};
+function appendOnboardingHint(message, code) {
+  const hint = ONBOARDING_HINTS[code];
+  if (!hint || message.includes(hint)) return message;
+  return `${message} ${hint}`;
+}
+function appendKnownScopes(message) {
+  if (message.includes("Known scopes:")) return message;
+  return `${message} (Known scopes: ${KNOWN_SCOPES.join(", ")})`;
+}
+function statusCodeToCode(status) {
+  if (status === 401) return "auth.failed";
+  if (status === 403) return "permission_denied";
+  if (status === 404) return "not_found";
+  if (status === 409) return "conflict";
+  if (status === 422) return "validation.failed";
+  if (status === 429) return "rate_limit.exceeded";
+  if (status >= 500) return "upstream.failed";
+  return "qoni_error";
+}
+function isPermissionDenied(code) {
+  return code.includes("permission") || code.includes("insufficient_scope");
+}
+function isDelegationRequired(code) {
+  return code.includes("interactive_required") || code.includes("delegation.required");
+}
+function isTokenExpired(code, message) {
+  return code.includes("expired") || /token expired/i.test(message);
+}
+
+// src/run-events.ts
+var QoniEventTypes = {
+  // --- Core (any product run can emit these) ---
+  /** The agent is working — folds ALL internal steps (actions, plan/subtask, sections, telemetry, take-control, …); `event.data` is a best-effort human-readable line (string). */
+  Progress: "progress",
+  /** The agent produced a user-facing chat message. */
+  Message: "message",
+  /** HITL — a typed interaction needs the user (login / clarification / confirmation / take-control / wait); `event.data` is the full {@link Interaction} object. Act on it via the action methods (`run.interactionHandle(event.data).answer(…)` etc). */
+  Interaction: "interaction",
+  /** A live screenshot frame (opt in with `capture: { screenshots: true }`); image on `event.image`. */
+  Screenshot: "screenshot",
+  /** Terminal — the run finished; outcome + output in `event.data` (cost is on the `RunResult`). */
+  Done: "done",
+  // --- Web Search ---
+  /** Web Search results are ready; `event.data` is the count (the list is in `done.output`). */
+  ResultsReady: "resultsReady",
+  // --- Deep Research ---
+  /** Deep Research coarse phase changed (brief → gather → synthesize …). */
+  Phase: "phase",
+  /** A Deep Research outline section was completed (stream sections as they finish). */
+  SectionReady: "sectionReady",
+  // --- Track (monitor) ---
+  /** A Track monitor was created (e.g. Do Anything handed a recurring request to Track). */
+  MonitorCreated: "monitorCreated",
+  /** A monitor detected a change worth acting on (the Track signal you react to). */
+  Triggered: "triggered",
+  /** A monitor's scheduled check finished (`event.data` is whether it found a change). */
+  CheckCompleted: "checkCompleted"
+};
+function isTerminalRunStatus(status) {
+  return status === "succeeded" || status === "failed" || status === "canceled";
+}
+function camelKey(key) {
+  return key.replace(/_([a-z0-9])/g, (_, ch) => ch.toUpperCase());
+}
+function camelizeKeys(value) {
+  if (Array.isArray(value)) return value.map(camelizeKeys);
+  if (!isJsonObject(value)) return value;
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    out[camelKey(key)] = camelizeKeys(item);
+  }
+  return out;
+}
+function camelizeRecord(value) {
+  const out = camelizeKeys(value);
+  return isJsonObject(out) ? out : {};
+}
+function decodeDataUri(uri) {
+  const match = /^data:([^;,]*)?(;base64)?,(.*)$/s.exec(uri);
+  if (!match) return void 0;
+  const [, mime, isBase64, body] = match;
+  const bytes = isBase64 ? new Uint8Array(Buffer.from(body, "base64")) : new TextEncoder().encode(decodeURIComponent(body));
+  return { bytes, mime: mime || "application/octet-stream" };
+}
+function asString(value) {
+  return typeof value === "string" && value ? value : void 0;
+}
+function asNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function decodeScreenshotImage(payload) {
+  const url = asString(payload.screenshot_url);
+  if (!url) return void 0;
+  const decoded = decodeDataUri(url);
+  if (!decoded) return void 0;
+  return {
+    ...decoded,
+    pageUrl: asString(payload.page_url) ?? asString(payload.url),
+    step: asNumber(payload.step) ?? asNumber(payload.step_index)
+  };
+}
+var HEARTBEAT = "stream.heartbeat";
+var SCREENSHOT = "run.screenshot";
+var TERMINAL = "run.completed";
+var INTERACTION = "run.interaction";
+var WIRE_TO_SEMANTIC = {
+  // --- Headline events a developer reacts to ---
+  "run.message": "message",
+  "search.results_ready": "resultsReady",
+  "run.phase_changed": "phase",
+  // Deep Research coarse phase
+  "run.section_completed": "sectionReady",
+  // Deep Research section finished
+  "run.monitor_created": "monitorCreated",
+  // Do Anything → Track handoff
+  // NB: `run.interaction` is NOT here — it's an out-of-band case in the
+  // normalizer (→ "interaction", carrying the typed Interaction object), like
+  // screenshot/done. The old `run.input_request` / `run.take_control_*` family
+  // it replaces is being removed backend-side; while the backend still lists
+  // them in the catalog (dual-emit window) they fold to progress below — the
+  // SDK no longer has an `inputRequired` surface (clean break).
+  // --- Internal churn → progress (raw type stays on event.raw.event) ---
+  // supervisor lifecycle / planning
+  "run.status_changed": "progress",
+  "run.input_request": "progress",
+  // superseded by run.interaction
+  "run.input_request_resolved": "progress",
+  "run.cost_update": "progress",
+  // cost is surfaced on RunResult, not as an event
+  "run.plan_ready": "progress",
+  "run.plan_finalized": "progress",
+  "run.subtask_started": "progress",
+  "run.subtask_graded": "progress",
+  "run.subtask_status": "progress",
+  "run.todos_updated": "progress",
+  // sub-agent execution (actions + browser-agent telemetry)
+  "run.action.started": "progress",
+  "run.action.completed": "progress",
+  "run.action.failed": "progress",
+  "run.action.progress": "progress",
+  "run.action_result": "progress",
+  "run.browser_agent.config_applied": "progress",
+  "run.browser_agent.summary": "progress",
+  "run.browser_agent.vision_decision": "progress",
+  "run.browser_agent.observe": "progress",
+  "run.browser_agent.page_gate": "progress",
+  // web search / deep research intermediate progress
+  "search.progress": "progress",
+  "search.summarize_progress": "progress",
+  "search.done": "progress",
+  // run ends on run.completed → "done"
+  "run.section_started": "progress",
+  "run.section_failed": "progress",
+  "run.replan_started": "progress",
+  "run.crosscheck_done": "progress",
+  "run.synthesize_progress": "progress",
+  // take-control / recording / live-url protocol
+  "run.take_control_pending": "progress",
+  "run.take_control_expired": "progress",
+  "run.user_paused": "progress",
+  "run.user_released": "progress",
+  "run.recording_started": "progress",
+  "run.recording_paused": "progress",
+  "run.recording_finalized": "progress",
+  "run.browser_live_url_changed": "progress",
+  // side-channel
+  "run.feedback_submitted": "progress"
+};
+var MONITOR_TRIGGERED = "monitor.triggered";
+var MONITOR_LIFECYCLE = "monitor.lifecycle_changed";
+function pickNote(c) {
+  return asString(c.note) ?? asString(c.summary) ?? asString(c.lastStepSummary) ?? asString(c.label) ?? asString(c.text) ?? asString(c.kind) ?? // action events: "click" / "input" / "navigate" / …
+  asString(c.toPhase) ?? asString(c.status) ?? asString(c.to) ?? asString(c.reason) ?? "";
+}
+function shapeData(type, c) {
+  switch (type) {
+    // Simple events: event.data IS the value.
+    case "progress":
+      return pickNote(c);
+    // a human-readable line (string)
+    case "resultsReady":
+      return asNumber(c.totalUniqueResults) ?? asNumber(c.count) ?? 0;
+    // count
+    case "phase":
+      return asString(c.toPhase) ?? asString(c.phase) ?? "";
+    // phase name
+    case "sectionReady":
+      return asString(c.title) ?? asString(c.sectionTitle) ?? "";
+    // section title
+    case "monitorCreated":
+      return asString(c.monitorId) ?? "";
+    // monitor id
+    case "triggered":
+      return asString(c.summary) ?? asString(c.note) ?? "";
+    // change summary
+    case "checkCompleted":
+      return c.changed === true;
+    // whether a change was found
+    // Rich events: event.data is a small object.
+    case "message":
+      return { text: asString(c.text) ?? "", role: asString(c.role) ?? "" };
+  }
+}
+function normalizeRunEvent(wire, options = {}) {
+  const envelope = isJsonObject(wire.data) ? wire.data : void 0;
+  const wireType = wire.event ?? asString(envelope?.type);
+  if (!wireType) return null;
+  if (wireType === HEARTBEAT) return null;
+  const payload = isJsonObject(envelope?.data) ? envelope.data : {};
+  const taskId = asString(envelope?.task_id);
+  const runId = taskId ?? options.topRunId ?? "";
+  const at = asString(envelope?.occurred_at) ?? asString(payload.occurred_at) ?? asString(payload.timestamp) ?? (/* @__PURE__ */ new Date()).toISOString();
+  const c = camelizeRecord(payload);
+  const base = { runId, at, raw: wire };
+  const isSubRun = Boolean(options.topRunId && taskId && taskId !== options.topRunId);
+  if (wireType === SCREENSHOT) {
+    const image = decodeScreenshotImage(payload);
+    if (image) {
+      const sData = {};
+      const pageUrl = asString(c.pageUrl) ?? asString(c.url);
+      const step = asNumber(c.step) ?? asNumber(c.stepIndex);
+      if (pageUrl !== void 0) sData.pageUrl = pageUrl;
+      if (step !== void 0) sData.step = step;
+      return { ...base, type: "screenshot", data: sData, image, isTerminal: false };
+    }
+  }
+  if (wireType === INTERACTION) {
+    const interaction = normalizeInteraction(payload);
+    if (interaction) {
+      return { ...base, type: "interaction", data: interaction, isTerminal: false };
+    }
+  }
+  if (wireType === TERMINAL && !isSubRun) {
+    const dData = {
+      output: c.output,
+      succeeded: typeof c.isTaskSuccessful === "boolean" ? c.isTaskSuccessful : null,
+      terminalReason: asString(c.terminalReason) ?? ""
+    };
+    return { ...base, type: "done", data: dData, isTerminal: true };
+  }
+  let type;
+  if (wireType === MONITOR_TRIGGERED) type = "triggered";
+  else if (wireType === MONITOR_LIFECYCLE) type = "checkCompleted";
+  else type = WIRE_TO_SEMANTIC[wireType] ?? "progress";
+  const data = shapeData(type, c);
+  if (type === "progress" && data === "") return null;
+  return { ...base, type, data, isTerminal: false };
+}
+
+// src/generated/interaction-types.ts
+var InteractionTypes = {
+  SiteLogin: "site_login",
+  Clarification: "clarification",
+  Confirmation: "confirmation",
+  TakeControl: "take_control",
+  Wait: "wait"
+};
+var INTERACTION_TYPE_VALUES = Object.values(InteractionTypes);
+var InteractionStatuses = {
+  Pending: "pending",
+  Active: "active",
+  Resolved: "resolved",
+  Expired: "expired",
+  Canceled: "canceled"
+};
+var INTERACTION_STATUS_VALUES = Object.values(InteractionStatuses);
+var ActionKinds = {
+  answer: "answer",
+  skip: "skip",
+  confirm: "confirm",
+  reject: "reject",
+  openLogin: "open_login",
+  confirmSignedIn: "confirm_signed_in",
+  connectControl: "connect_control",
+  refreshControl: "refresh_control",
+  releaseControl: "release_control",
+  retry: "retry",
+  switchProfile: "switch_profile"
+};
+var ACTION_KIND_VALUES = Object.values(ActionKinds);
+
+// src/interactions.ts
+function asString2(value) {
+  return typeof value === "string" && value ? value : void 0;
+}
+function asBool(value) {
+  return typeof value === "boolean" ? value : void 0;
+}
+function normalizeActions(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const item of value) {
+    if (!isJsonObject(item)) continue;
+    const kind = asString2(item.kind);
+    if (!kind) continue;
+    const action = {
+      kind,
+      label: asString2(item.label) ?? "",
+      method: asString2(item.method) ?? "POST",
+      endpoint: asString2(item.endpoint) ?? ""
+    };
+    if (isJsonObject(item.inputSchema)) action.inputSchema = item.inputSchema;
+    out.push(action);
+  }
+  return out;
+}
+function normalizeEvidence(c) {
+  const artifactId = asString2(c.evidenceArtifactId) ?? (isJsonObject(c.evidence) ? asString2(c.evidence.artifactId) : void 0);
+  return artifactId ? { artifactId } : void 0;
+}
+function shapePayload(type, c) {
+  switch (type) {
+    case "site_login": {
+      const sites = Array.isArray(c.sites) ? c.sites.flatMap((raw) => {
+        if (!isJsonObject(raw)) return [];
+        return [
+          {
+            siteId: asString2(raw.siteId) ?? "",
+            displayName: asString2(raw.displayName) ?? "",
+            loginUrl: asString2(raw.loginUrl) ?? ""
+          }
+        ];
+      }) : [];
+      const payload = { sites };
+      const monitorId = asString2(c.monitorId);
+      if (monitorId) payload.monitorId = monitorId;
+      return payload;
+    }
+    case "clarification": {
+      const payload = { question: asString2(c.question) ?? "" };
+      const inputType = asString2(c.inputType);
+      if (inputType) payload.inputType = inputType;
+      return payload;
+    }
+    case "confirmation":
+      return { summary: asString2(c.summary) ?? "" };
+    case "take_control": {
+      const payload = { liveUrl: asString2(c.liveUrl) ?? "" };
+      const surface = asString2(c.surface);
+      const reason = asString2(c.reason);
+      if (surface) payload.surface = surface;
+      if (reason) payload.reason = reason;
+      return payload;
+    }
+    case "wait": {
+      const payload = {
+        waitKind: asString2(c.waitKind) ?? "external"
+      };
+      const until = asString2(c.until);
+      const retryable = asBool(c.retryable);
+      if (until) payload.until = until;
+      if (retryable !== void 0) payload.retryable = retryable;
+      return payload;
+    }
+  }
+}
+function normalizeInteraction(payload) {
+  const c = camelizeRecord(payload);
+  const type = asString2(c.type);
+  if (!type) return null;
+  const interaction = {
+    id: asString2(c.id) ?? "",
+    type,
+    status: asString2(c.status) ?? "pending",
+    createdAt: asString2(c.createdAt) ?? "",
+    title: asString2(c.title) ?? "",
+    actions: normalizeActions(c.actions),
+    payload: shapePayload(type, c)
+  };
+  const resolvedAt = asString2(c.resolvedAt);
+  const expiresAt = asString2(c.expiresAt);
+  const prompt = asString2(c.prompt);
+  const evidence = normalizeEvidence(c);
+  if (resolvedAt) interaction.resolvedAt = resolvedAt;
+  if (expiresAt) interaction.expiresAt = expiresAt;
+  if (prompt) interaction.prompt = prompt;
+  if (evidence) interaction.evidence = evidence;
+  return interaction;
+}
+var InteractionHandle = class {
+  constructor(interaction, post) {
+    this.post = post;
+    this.interaction = interaction;
+  }
+  post;
+  interaction;
+  get id() {
+    return this.interaction.id;
+  }
+  get type() {
+    return this.interaction.type;
+  }
+  get status() {
+    return this.interaction.status;
+  }
+  get actions() {
+    return this.interaction.actions;
+  }
+  /** Whether the backend declared an action of this kind on the interaction. */
+  can(kind) {
+    return this.interaction.actions.some((a) => a.kind === kind);
+  }
+  /** Answer a clarification ask. */
+  answer(text) {
+    return this.invoke(ActionKinds.answer, { response: text });
+  }
+  /** Skip / dismiss the interaction (proceed without acting on it). */
+  skip() {
+    return this.invoke(ActionKinds.skip);
+  }
+  /** Confirm a pending confirmation (approve the plan / destructive op). */
+  confirm() {
+    return this.invoke(ActionKinds.confirm);
+  }
+  /** Reject a pending confirmation. */
+  reject() {
+    return this.invoke(ActionKinds.reject);
+  }
+  /** Open the login surface for a site_login interaction. */
+  openLogin() {
+    return this.invoke(ActionKinds.openLogin);
+  }
+  /** Tell the agent the user has finished signing in. */
+  confirmSignedIn() {
+    return this.invoke(ActionKinds.confirmSignedIn);
+  }
+  /** Connect to the live browser for a take_control interaction. */
+  connectControl() {
+    return this.invoke(ActionKinds.connectControl);
+  }
+  /** Refresh the live control surface / live url. */
+  refreshControl() {
+    return this.invoke(ActionKinds.refreshControl);
+  }
+  /** Hand control back to the agent. */
+  releaseControl() {
+    return this.invoke(ActionKinds.releaseControl);
+  }
+  /** Retry a wait interaction now. */
+  retry() {
+    return this.invoke(ActionKinds.retry);
+  }
+  /** Switch the profile a wait/login interaction is bound to. */
+  switchProfile() {
+    return this.invoke(ActionKinds.switchProfile);
+  }
+  /**
+   * Invoke an action by kind with an optional body. `async` so a missing-action
+   * error surfaces as a rejected promise (not a synchronous throw), keeping the
+   * method contract uniformly promise-based.
+   */
+  async invoke(kind, body) {
+    const action = this.interaction.actions.find((a) => a.kind === kind);
+    if (!action) {
+      const offered = this.interaction.actions.map((a) => a.kind).join(", ") || "none";
+      throw new QoniValidationError(
+        `interaction "${this.interaction.id}" (${this.interaction.type}) does not offer the "${kind}" action \u2014 the backend declared: ${offered}. Only call methods whose action the interaction currently offers.`
+      );
+    }
+    await this.post(action, body);
+  }
+};
+
+// src/run-handle.ts
+var CANCEL_IDEMPOTENT_STATUSES = /* @__PURE__ */ new Set([400, 404, 409, 410, 422]);
+var RunHandle = class {
+  constructor(ops, init) {
+    this.ops = ops;
+    this.id = init.id;
+    this.sessionRef = init.sessionRef;
+    this.capture = init.capture ?? {};
+  }
+  ops;
+  id;
+  /** Pass back to `run({ session })` to reuse the same backend session. */
+  sessionRef;
+  capture;
+  /** Refresh and return the run's current state. */
+  async status() {
+    const detail = await this.ops.getDetail();
+    this.#adoptSessionRef(detail);
+    return normalizeRunStatus(this.id, detail);
+  }
+  /**
+   * Stream semantic events. Ends automatically at the run's terminal event.
+   * Reconnects with `Last-Event-ID` catch-up are handled internally.
+   */
+  async *events(opts = {}) {
+    for await (const wire of this.ops.streamEvents(opts)) {
+      await opts.onWireEvent?.(wire);
+      const event = normalizeRunEvent(wire, { topRunId: this.id });
+      if (!event) continue;
+      if (event.type === "screenshot" && !this.capture.screenshots) continue;
+      if (isVideoFrame(wire) && !this.capture.videoFrames) continue;
+      yield event;
+      if (event.isTerminal) return;
+    }
+  }
+  /** Drive the run to a terminal state and return the settled result. */
+  async wait(opts = {}) {
+    const { signal, timedOut } = withTimeout(opts.signal, opts.timeoutMs);
+    let lastEventId;
+    let eventIdAtLastClose;
+    let sawCleanClose = false;
+    let terminalPayload;
+    let terminalDoneReason;
+    let screenshotIndex = 0;
+    try {
+      settled: for (; ; ) {
+        for await (const event of this.events({
+          signal,
+          lastEventId,
+          onWireEvent: opts.onWireEvent,
+          onReconnect: opts.onReconnect
+        })) {
+          if (event.raw.id) lastEventId = event.raw.id;
+          await opts.onEvent?.(event);
+          if (event.type === "screenshot") {
+            await opts.onScreenshot?.(event.image, screenshotIndex++);
+          } else if (event.type === "interaction") {
+            await opts.onInteraction?.(this.interactionHandle(event.data), event);
+          }
+          if (event.isTerminal) {
+            terminalPayload = isJsonObject(event.raw.data) ? event.raw.data : void 0;
+            if (event.type === "done") terminalDoneReason = event.data.terminalReason || void 0;
+            break settled;
+          }
+        }
+        const detail2 = await this.ops.getDetail();
+        if (isTerminalRunStatus(detail2.status)) break;
+        if (sawCleanClose && lastEventId === eventIdAtLastClose) {
+          throw new QoniError(
+            `run event stream ended before a terminal event while the run is still "${String(detail2.status)}" \u2014 re-attach or poll status()`,
+            { code: "upstream.failed", retryable: true }
+          );
+        }
+        sawCleanClose = true;
+        eventIdAtLastClose = lastEventId;
+      }
+    } catch (err) {
+      if (timedOut() && !opts.signal?.aborted) {
+        throw new QoniTimeoutError(
+          `run.wait timed out after ${opts.timeoutMs} ms \u2014 the run keeps executing server-side; attach() to it again or cancel() it`,
+          { cause: err }
+        );
+      }
+      throw err;
+    }
+    let detail;
+    try {
+      detail = await this.ops.getDetail();
+    } catch (err) {
+      if (!terminalPayload) throw err;
+      detail = terminalPayload;
+    }
+    this.#adoptSessionRef(detail);
+    const artifacts = this.ops.listArtifacts ? await this.ops.listArtifacts() : [];
+    return settleRunResult(this.id, detail, artifacts, terminalDoneReason);
+  }
+  /**
+   * Wrap an {@link Interaction} (from `event.data` of an `interaction` event)
+   * in a typed {@link InteractionHandle} bound to this run. The handle's action
+   * methods (`answer` / `confirmSignedIn` / `releaseControl` / …) post to the
+   * endpoint the backend declared for that action.
+   */
+  interactionHandle(interaction) {
+    return new InteractionHandle(
+      interaction,
+      (action, body) => this.ops.postAction(action, body)
+    );
+  }
+  /**
+   * Cancel the run. Idempotent: cancelling an already-terminal run returns
+   * its terminal state instead of throwing.
+   */
+  async cancel(reason) {
+    try {
+      const data = await this.ops.cancel(reason);
+      this.#adoptSessionRef(data);
+      return normalizeRunStatus(this.id, data);
+    } catch (err) {
+      if (err instanceof QoniError && CANCEL_IDEMPOTENT_STATUSES.has(err.status ?? 0)) {
+        let snapshot;
+        try {
+          snapshot = await this.status();
+        } catch {
+          throw err;
+        }
+        if (isTerminalRunStatus(snapshot.status)) return snapshot;
+      }
+      throw err;
+    }
+  }
+  #adoptSessionRef(detail) {
+    const sessionId = typeof detail.session_id === "string" ? detail.session_id : void 0;
+    if (sessionId && !this.sessionRef) this.sessionRef = { sessionId };
+  }
+};
+function normalizeRunStatus(id, detail) {
+  return {
+    id,
+    status: typeof detail.status === "string" ? detail.status : inferStatus(detail),
+    sessionId: typeof detail.session_id === "string" ? detail.session_id : void 0,
+    output: runOutput(detail),
+    raw: detail
+  };
+}
+function settleRunResult(runId, detail, artifacts, fallbackTerminalReason) {
+  const terminalReason = (typeof detail.terminal_reason === "string" ? detail.terminal_reason : void 0) ?? fallbackTerminalReason;
+  const isTaskSuccessful = typeof detail.is_task_successful === "boolean" ? detail.is_task_successful : void 0;
+  let status;
+  if (isTerminalRunStatus(detail.status)) {
+    status = detail.status;
+  } else if (terminalReason === "canceled") {
+    status = "canceled";
+  } else if (terminalReason === "failed" || terminalReason === "expired" || isTaskSuccessful === false) {
+    status = "failed";
+  } else {
+    status = "succeeded";
+  }
+  return {
+    runId,
+    status,
+    output: runOutput(detail),
+    artifacts,
+    terminalReason,
+    isTaskSuccessful,
+    raw: detail
+  };
+}
+function runOutput(detail) {
+  return detail.output ?? detail.result ?? detail.results;
+}
+function inferStatus(detail) {
+  const reason = typeof detail.terminal_reason === "string" ? detail.terminal_reason : void 0;
+  if (reason === "canceled") return "canceled";
+  if (reason === "failed" || reason === "expired") return "failed";
+  if (reason === "done") return "succeeded";
+  return "";
+}
+function isVideoFrame(wire) {
+  const type = wire.event ?? (isJsonObject(wire.data) ? wire.data.type : void 0);
+  return type === "browser_video_frame" || type === "run.browser_video_frame";
+}
+function withTimeout(signal, timeoutMs) {
+  if (!timeoutMs) return { signal, timedOut: () => false };
+  const controller = new AbortController();
+  let fired = false;
+  const timer = setTimeout(() => {
+    fired = true;
+    controller.abort();
+  }, timeoutMs);
+  controller.signal.addEventListener("abort", () => clearTimeout(timer), { once: true });
+  if (signal) {
+    if (signal.aborted) controller.abort();
+    else signal.addEventListener("abort", () => controller.abort(), { once: true });
+  }
+  return { signal: controller.signal, timedOut: () => fired };
+}
+
+// src/deep-research.ts
+function createDeepResearchNamespace(transport) {
+  const api = {
+    run: (input) => transport.webAgentJson("POST", "/deep_research/runs", input.token, {
+      body: normalizeDeepResearchRunInput(omit(input, "token")),
+      requiredScopes: ["webagent.deep_research:manage"]
+    }),
+    get: (input) => transport.webAgentJson(
+      "GET",
+      `/deep_research/runs/${encodeURIComponent(input.runId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.deep_research:read"]
+      }
+    ),
+    events: (input) => transport.webAgentSSE(
+      `/deep_research/runs/${encodeURIComponent(input.runId)}/events`,
+      input.token,
+      {
+        lastEventId: input.lastEventId,
+        requiredScopes: ["webagent.deep_research:read"],
+        signal: input.signal,
+        onReconnect: input.onReconnect
+      }
+    ),
+    followUp: (input) => transport.webAgentJson(
+      "POST",
+      `/deep_research/runs/${encodeURIComponent(input.runId)}/messages`,
+      input.token,
+      {
+        body: omit(input, "token", "runId"),
+        requiredScopes: ["webagent.deep_research:manage"]
+      }
+    ),
+    cancel: (input) => transport.webAgentJson(
+      "POST",
+      `/deep_research/runs/${encodeURIComponent(input.runId)}/cancel`,
+      input.token,
+      {
+        body: {},
+        requiredScopes: ["webagent.deep_research:manage"]
+      }
+    ),
+    feedback: (input) => transport.webAgentJson(
+      "POST",
+      `/deep_research/runs/${encodeURIComponent(input.runId)}/feedback`,
+      input.token,
+      {
+        body: renameKeys(omit(input, "token", "runId"), { feedbackText: "feedback_text" }),
+        requiredScopes: ["webagent.deep_research:manage"]
+      }
+    ),
+    listArtifacts: (input) => transport.webAgentJson(
+      "GET",
+      `/deep_research/runs/${encodeURIComponent(input.runId)}/artifacts`,
+      input.token,
+      {
+        requiredScopes: ["webagent.deep_research:read"]
+      }
+    ),
+    getArtifact: (input) => transport.webAgentJson(
+      "GET",
+      `/deep_research/runs/${encodeURIComponent(input.runId)}/artifacts/${encodeURIComponent(input.artifactId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.deep_research:read"]
+      }
+    )
+  };
+  function buildOps(token, runId) {
+    return {
+      getDetail: async () => asRecord((await api.get({ token, runId })).data),
+      streamEvents: (opts) => api.events({
+        token,
+        runId,
+        lastEventId: opts.lastEventId,
+        signal: opts.signal,
+        onReconnect: opts.onReconnect
+      }),
+      postAction: async (action, body) => {
+        await transport.webAgentJson(
+          action.method || "POST",
+          action.endpoint,
+          token,
+          {
+            ...body !== void 0 ? { body } : {},
+            requiredScopes: ["webagent.deep_research:manage"]
+          }
+        );
+      },
+      cancel: async () => asRecord((await api.cancel({ token, runId })).data),
+      listArtifacts: async () => {
+        const res = await api.listArtifacts({ token, runId });
+        const items = Array.isArray(res.data?.items) ? res.data.items : [];
+        return items.filter(isJsonObject).map((item) => toArtifact(item, token, runId));
+      }
+    };
+  }
+  function toArtifact(item, token, runId) {
+    const id = typeof item.id === "string" ? item.id : "";
+    return {
+      id,
+      name: typeof item.name === "string" && item.name ? item.name : void 0,
+      mime: typeof item.mime_type === "string" ? item.mime_type : void 0,
+      sizeBytes: typeof item.size_bytes === "number" ? item.size_bytes : void 0,
+      createdAt: typeof item.created_at === "string" ? item.created_at : void 0,
+      content: async () => (await transport.webAgentBytes(
+        `/deep_research/runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(id)}`,
+        token,
+        { requiredScopes: ["webagent.deep_research:read"] }
+      )).bytes
+    };
+  }
+  return {
+    /**
+     * Start a research run. Pass `session: prior.sessionRef` to start a
+     * follow-up run that inherits the prior run's context.
+     */
+    run: async (input) => {
+      const { token, prompt, capture, limits, session, ...rest } = input;
+      if (!prompt) {
+        throw new QoniValidationError("deepResearch.run requires a prompt");
+      }
+      const run = await api.run({
+        token,
+        topic: prompt,
+        ...rest,
+        ...limits?.maxDurationMinutes !== void 0 ? { maxDurationMinutes: limits.maxDurationMinutes } : {},
+        ...session ? { session_id: session.sessionId } : {}
+      });
+      const runId = run.data.run_id || run.data.id;
+      if (!runId) {
+        throw new QoniValidationError("deepResearch run create did not return a run id");
+      }
+      return new RunHandle(buildOps(token, runId), {
+        id: runId,
+        sessionRef: session,
+        capture
+      });
+    },
+    /** Reconnect to an existing run. Verifies the run exists before returning. */
+    attach: async (runId, opts) => {
+      const handle = new RunHandle(buildOps(opts.token, runId), {
+        id: runId,
+        capture: opts.capture
+      });
+      await handle.status();
+      return handle;
+    },
+    api
+  };
+}
+function normalizeDeepResearchRunInput(input) {
+  return renameKeys(input, {
+    outputFormat: "output_format",
+    targetAudience: "target_audience",
+    maxDurationMinutes: "max_duration_minutes",
+    callbackUrl: "callback_url",
+    domainWhitelist: "domain_whitelist",
+    domainBlacklist: "domain_blacklist"
+  });
+}
+function asRecord(value) {
+  return isJsonObject(value) ? value : {};
+}
+function omit(value, ...keys) {
+  const skipped = new Set(keys);
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!skipped.has(key) && item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function renameKeys(value, mapping) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    const target = mapping[key] || key;
+    if (out[target] === void 0) out[target] = item;
+  }
+  return out;
+}
+
+// src/do-anything.ts
+var PLATFORM_DECIDED_RUN_OPTIONS = [
+  "model",
+  "proxyCountryCode",
+  "callbackUrl",
+  "workspaceId",
+  "outputSchema",
+  "cacheScript"
+];
+function createDoAnythingNamespace(transport) {
+  const api = {
+    createSession: (input) => transport.webAgentJson("POST", "/do_anything/sessions", input.token, {
+      body: omit2(input, "token"),
+      requiredScopes: ["webagent.do_anything:manage"]
+    }),
+    /**
+     * `POST /do_anything/runs` — one call creates the run. Without
+     * `session_id` a fresh session is created around the run; with it the
+     * run is a follow-up in that session (409 while the prior run is
+     * non-terminal).
+     */
+    createRun: (input) => transport.webAgentJson("POST", "/do_anything/runs", input.token, {
+      body: normalizeDoAnythingRunInput(omit2(input, "token")),
+      requiredScopes: ["webagent.do_anything:manage"]
+    }),
+    getRun: (input) => transport.webAgentJson(
+      "GET",
+      `/do_anything/runs/${encodeURIComponent(input.runId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.do_anything:read"]
+      }
+    ),
+    events: async function* (input) {
+      const path = `/do_anything/runs/${encodeURIComponent(input.runId)}/events`;
+      const stream = transport.webAgentSSE(path, input.token, {
+        lastEventId: input.lastEventId,
+        requiredScopes: ["webagent.do_anything:read"],
+        signal: input.signal,
+        onReconnect: input.onReconnect,
+        ...input.includeScreenshots === void 0 ? {} : { query: { include_screenshots: input.includeScreenshots } }
+      });
+      for await (const event of stream) {
+        if (input.onlyTopLevel) {
+          const taskId = envelopeTaskId(event);
+          if (taskId && taskId !== input.runId) continue;
+        }
+        yield event;
+      }
+    },
+    intervene: (input) => transport.webAgentJson(
+      "POST",
+      `/do_anything/runs/${encodeURIComponent(input.runId)}/intervene`,
+      input.token,
+      {
+        body: normalizeDoAnythingInterveneInput(omit2(input, "token", "runId")),
+        requiredScopes: ["webagent.do_anything:manage"]
+      }
+    ),
+    cancel: (input) => transport.webAgentJson(
+      "POST",
+      `/do_anything/runs/${encodeURIComponent(input.runId)}/cancel`,
+      input.token,
+      {
+        body: omit2(input, "token", "runId"),
+        requiredScopes: ["webagent.do_anything:manage"]
+      }
+    ),
+    readArtifacts: (input) => transport.webAgentJson(
+      "GET",
+      `/do_anything/sessions/${encodeURIComponent(input.sessionId)}/artifacts/${encodeURIComponent(input.artifactId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.do_anything:read"]
+      }
+    ),
+    readRecording: (input) => transport.webAgentJson(
+      "GET",
+      `/do_anything/sessions/${encodeURIComponent(input.sessionId)}/recording`,
+      input.token,
+      {
+        requiredScopes: ["webagent.do_anything:read"]
+      }
+    )
+  };
+  function buildOps(token, runId, capture) {
+    return {
+      getDetail: async () => asRecord2((await api.getRun({ token, runId })).data),
+      streamEvents: (opts) => api.events({
+        token,
+        runId,
+        lastEventId: opts.lastEventId,
+        signal: opts.signal,
+        onReconnect: opts.onReconnect,
+        // Skip screenshot rows in backfill when the caller did not opt in.
+        includeScreenshots: capture?.screenshots ? void 0 : false
+      }),
+      postAction: async (action, body) => {
+        await transport.webAgentJson(
+          action.method || "POST",
+          action.endpoint,
+          token,
+          {
+            ...body !== void 0 ? { body } : {},
+            requiredScopes: ["webagent.do_anything:manage"]
+          }
+        );
+      },
+      cancel: async (reason) => asRecord2(
+        (await api.cancel({
+          token,
+          runId,
+          ...reason === void 0 ? {} : { reason }
+        })).data
+      )
+    };
+  }
+  return {
+    /** Start a run. Returns a handle — see `RunHandle` for the run lifecycle. */
+    run: async (input) => {
+      const { token, prompt, capture, limits, session, ...rest } = input;
+      if (!prompt || typeof prompt !== "string") {
+        throw new QoniValidationError("doAnything.run requires a prompt string");
+      }
+      const unsupported = PLATFORM_DECIDED_RUN_OPTIONS.filter(
+        (key) => rest[key] !== void 0
+      );
+      if (unsupported.length > 0) {
+        throw new QoniValidationError(
+          `doAnything.run does not support ${unsupported.join(", ")} \u2014 the wire create body has no such field (the platform decides these server-side), so the value would be silently dropped. Remove it from the call.`
+        );
+      }
+      const created = await api.createRun({
+        token,
+        instructions: prompt,
+        ...rest,
+        ...session?.sessionId ? { sessionId: session.sessionId } : {},
+        ...limits?.maxDurationMinutes !== void 0 ? { maxDurationMinutes: limits.maxDurationMinutes } : {}
+      });
+      const runId = created.data.run_id || created.data.id;
+      if (!runId) {
+        throw new QoniValidationError("doAnything run create did not return a run id");
+      }
+      const sessionId = typeof created.data.session_id === "string" && created.data.session_id ? created.data.session_id : session?.sessionId;
+      return new RunHandle(buildOps(token, runId, capture), {
+        id: runId,
+        sessionRef: sessionId ? { sessionId } : void 0,
+        capture
+      });
+    },
+    /**
+     * Reconnect to an existing run by id. Verifies the run exists before
+     * returning; `sessionRef` is adopted from the run detail envelope when
+     * not supplied.
+     */
+    attach: async (runId, opts) => {
+      const sessionId = opts.session?.sessionId;
+      const handle = new RunHandle(buildOps(opts.token, runId, opts.capture), {
+        id: runId,
+        sessionRef: sessionId ? { sessionId } : void 0,
+        capture: opts.capture
+      });
+      await handle.status();
+      return handle;
+    },
+    api
+  };
+}
+function normalizeDoAnythingRunInput(input) {
+  const body = renameKeys2(input, {
+    sessionId: "session_id",
+    profileId: "profile_id",
+    keepAlive: "keep_alive",
+    allowedActions: "allowed_actions",
+    maxDurationMinutes: "max_duration_minutes"
+  });
+  return body;
+}
+function normalizeDoAnythingInterveneInput(input) {
+  const body = renameKeys2(input, { requestId: "input_request_id" });
+  if (body.input_request_id !== void 0 && body.kind === void 0) {
+    body.kind = body.response === void 0 ? "skip_input_request" : "answer_input_request";
+  }
+  return body;
+}
+function envelopeTaskId(event) {
+  const env = event.data;
+  return env && typeof env === "object" && typeof env.task_id === "string" ? env.task_id : void 0;
+}
+function asRecord2(value) {
+  return isJsonObject(value) ? value : {};
+}
+function omit2(value, ...keys) {
+  const skipped = new Set(keys);
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!skipped.has(key) && item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function renameKeys2(value, mapping) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    const target = mapping[key] || key;
+    if (out[target] === void 0) out[target] = item;
+  }
+  return out;
+}
+
+// src/qoni.ts
+function createQoniNamespace(_transport, delegateToken, completeDelegateToken) {
+  return {
+    delegateToken,
+    /** @deprecated Use delegateToken. */
+    delegateAgent: (input) => delegateToken(input),
+    completeDelegateToken,
+    /** @deprecated Use completeDelegateToken. */
+    completeDelegateAgent: (input) => completeDelegateToken(input)
+  };
+}
+
+// src/genauth.ts
+function createGenAuthNamespace(transport, options = {}) {
+  return {
+    userInfo: (input) => transport.genauthJson("GET", "/oidc/me", input.accessToken),
+    jwks: () => transport.genauthJson("GET", "/oidc/.well-known/jwks.json"),
+    discovery: () => transport.genauthJson("GET", "/oidc/.well-known/openid-configuration"),
+    introspectDelegationToken: (input) => transport.genauthJson("POST", "/api/v3/eak/delegations/introspect", void 0, {
+      body: { token: requiredDelegationToken(input) }
+    }),
+    users: {
+      list: async (input = {}) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("POST", "/api/v3/list-users", auth.accessToken, {
+          body: listUsersBody(input),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      },
+      get: async (input) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("GET", "/api/v3/get-user", auth.accessToken, {
+          query: omit3(input, "adminToken", "userPoolId"),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      },
+      getBatch: async (input) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("GET", "/api/v3/get-user-batch", auth.accessToken, {
+          query: omit3(input, "adminToken", "userPoolId"),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      },
+      create: async (input) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("POST", "/api/v3/create-user", auth.accessToken, {
+          body: omit3(input, "adminToken", "userPoolId"),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      },
+      createBatch: async (input) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("POST", "/api/v3/create-users-batch", auth.accessToken, {
+          body: createUsersBatchBody(input),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      },
+      update: async (input) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("POST", "/api/v3/update-user", auth.accessToken, {
+          body: omit3(input, "adminToken", "userPoolId"),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      },
+      deleteBatch: async (input) => {
+        const auth = await adminAuthFor(options.adminTokenFor, input);
+        return transport.genauthJson("POST", "/api/v3/delete-users-batch", auth.accessToken, {
+          body: omit3(input, "adminToken", "userPoolId"),
+          headers: userPoolHeaders(auth.userPoolId)
+        });
+      }
+    }
+  };
+}
+function requiredDelegationToken(input) {
+  const token = input.token ?? input.delegateAgentToken;
+  if (token?.trim()) return token;
+  throw new Error("GenAuth delegation introspection requires token");
+}
+async function adminAuthFor(provider, input) {
+  if (input.adminToken?.trim()) {
+    if (!input.userPoolId?.trim()) {
+      throw new Error("GenAuth adminToken override requires userPoolId");
+    }
+    return { accessToken: input.adminToken, userPoolId: input.userPoolId };
+  }
+  if (!provider) throw new Error("GenAuth user management requires Qoni AK/SK admin token exchange");
+  return provider();
+}
+function userPoolHeaders(userPoolId) {
+  return { "x-authing-userpool-id": userPoolId };
+}
+function omit3(value, ...keys) {
+  const skipped = new Set(keys);
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!skipped.has(key) && item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function listUsersBody(input) {
+  const body = omit3(input, "adminToken", "userPoolId", "page", "limit");
+  if (input.page === void 0 && input.limit === void 0) return body;
+  const options = isJsonObject2(body.options) ? { ...body.options } : {};
+  const pagination = isJsonObject2(options.pagination) ? { ...options.pagination } : {};
+  if (input.page !== void 0) pagination.page = input.page;
+  if (input.limit !== void 0) pagination.limit = input.limit;
+  options.pagination = pagination;
+  body.options = options;
+  return body;
+}
+function createUsersBatchBody(input) {
+  const body = omit3(input, "adminToken", "userPoolId", "users");
+  if (input.users && !body.list) body.list = input.users;
+  return body;
+}
+function isJsonObject2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/gumem.ts
+function createGumemNamespace(transport) {
+  return {
+    createSession: (input) => transport.gumemJson("POST", "/api/sessions", input.token, {
+      body: gumemBody(omit4(input, "token")),
+      requiredScopes: ["gumem.memory:write"]
+    }),
+    addMessages: (input) => transport.gumemJson(
+      "POST",
+      `/api/sessions/${encodeURIComponent(input.sessionId)}/messages`,
+      input.token,
+      {
+        body: gumemBody(omit4(input, "token", "sessionId")),
+        requiredScopes: ["gumem.memory:write"]
+      }
+    ),
+    recall: (input) => transport.gumemJson(
+      "POST",
+      `/api/sessions/${encodeURIComponent(input.sessionId || "default")}/context`,
+      input.token,
+      {
+        query: { query: input.query || "", details: input.details ?? false },
+        body: gumemBody(omit4(input, "token", "sessionId", "query", "details")),
+        requiredScopes: ["gumem.memory:read"]
+      }
+    ),
+    uploadResource: (input) => {
+      const form = new FormData();
+      form.set("file", input.file, input.filename);
+      const userId = input.userId ?? input.user_id;
+      const sessionId = input.sessionId ?? input.session_id;
+      if (userId) form.set("user_id", userId);
+      if (sessionId) form.set("session_id", sessionId);
+      if (input.contentType) form.set("content_type", input.contentType);
+      return transport.gumemJson("POST", "/api/resources", input.token, {
+        body: form,
+        requiredScopes: ["gumem.memory:write"]
+      });
+    },
+    actions: {
+      record: (input) => transport.gumemJson("POST", "/api/user/actions", input.token, {
+        body: omit4(input, "token"),
+        requiredScopes: ["gumem.action:write"]
+      }),
+      recall: (input) => transport.gumemJson("GET", "/api/user/actions/query", input.token, {
+        query: omit4(input, "token"),
+        requiredScopes: ["gumem.action:read"]
+      }),
+      stream: (input) => transport.gumemJson("GET", "/api/user/actions/stream", input.token, {
+        query: omit4(input, "token"),
+        requiredScopes: ["gumem.action:read"]
+      })
+    }
+  };
+}
+function omit4(value, ...keys) {
+  const skipped = new Set(keys);
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!skipped.has(key) && item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function gumemBody(value) {
+  return renameKeys3(value, {
+    userId: "user_id",
+    sessionId: "session_id",
+    recallConfig: "recall_config",
+    metadataFilters: "metadata_filters"
+  });
+}
+function renameKeys3(value, mapping) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    const target = mapping[key] || key;
+    if (out[target] === void 0) out[target] = item;
+  }
+  return out;
+}
+
+// src/track.ts
+var MonitorHandle = class {
+  constructor(ops, id) {
+    this.ops = ops;
+    this.id = id;
+  }
+  ops;
+  id;
+  /** Refresh and return the monitor (normalized camelCase fields). */
+  async get() {
+    return camelizeRecord(await this.ops.get());
+  }
+  /**
+   * Pause the monitor — stops scheduled ticks until {@link resume}. The
+   * monitor stays addressable; this is the way to "stop monitoring" without
+   * deleting.
+   */
+  async pause() {
+    return camelizeRecord(await this.ops.update({ action: "pause" }));
+  }
+  /** Resume a paused monitor. */
+  async resume() {
+    return camelizeRecord(await this.ops.update({ action: "resume" }));
+  }
+  /**
+   * Change the monitor definition. Pass any subset of fields (at least one);
+   * `schedule` is `{ kind: "cron", expr }` or `{ kind: "interval", intervalSeconds }`.
+   * The backend re-validates the trigger DSL against the schema, so a bad
+   * change is rejected, not applied. The natural-language intent is not
+   * refinable — create a new monitor to change it.
+   */
+  async refine(patch) {
+    const { schedule, ...rest } = patch;
+    const body = snakeifyKeys(rest);
+    if (schedule) body.schedule = normalizeSchedule(schedule);
+    if (Object.keys(body).length === 0) {
+      throw new QoniValidationError(
+        "track refine requires at least one field to change (schedule / targetUrls / extractionSchema / triggerDsl / stopConditionDsl / notifyChannel)"
+      );
+    }
+    return camelizeRecord(await this.ops.update({ action: "refine", patch: body }));
+  }
+  /** Trigger an immediate tick outside the schedule. */
+  async runNow() {
+    return camelizeRecord(await this.ops.runNow());
+  }
+  /**
+   * Stream semantic monitor events. Monitors are resident, so the stream has
+   * no terminal event — it ends only when closed by the caller or the server.
+   */
+  async *events(opts = {}) {
+    for await (const wire of this.ops.streamEvents(opts)) {
+      const event = normalizeRunEvent(wire);
+      if (event) yield event;
+    }
+  }
+  /**
+   * Wrap an {@link Interaction} (from `event.data` of an `interaction` event on
+   * the monitor stream — e.g. a `site_login` to unlock a `needs_reauth` park)
+   * in a typed {@link InteractionHandle}. The handle's action methods post to
+   * the endpoint the backend declared for that action.
+   */
+  interactionHandle(interaction) {
+    return new InteractionHandle(
+      interaction,
+      (action, body) => this.ops.postAction(action, body)
+    );
+  }
+  /**
+   * Read-only list of the runs the monitor's ticks produced. Tick runs are
+   * owned by the scheduler — to stop monitoring use `pause()` / `delete()`.
+   */
+  async runs(opts = {}) {
+    const data = await this.ops.listRuns(opts);
+    const items = Array.isArray(data.items) ? data.items : Array.isArray(data.runs) ? data.runs : [];
+    return items.filter(isJsonObject).map(normalizeMonitorRun);
+  }
+  /** Read-only detail of a single tick run. */
+  async run(runId) {
+    return normalizeMonitorRun(await this.ops.getRun(runId));
+  }
+  /** Delete the monitor. */
+  async delete() {
+    await this.ops.delete();
+  }
+};
+function createTrackNamespace(transport) {
+  const api = {
+    createMonitor: (input) => transport.webAgentJson("POST", "/track/monitors", input.token, {
+      body: omit5(input, "token"),
+      requiredScopes: ["webagent.track:manage"]
+    }),
+    getMonitor: (input) => transport.webAgentJson(
+      "GET",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.track:read"]
+      }
+    ),
+    runNow: (input) => transport.webAgentJson(
+      "POST",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}/run_now`,
+      input.token,
+      {
+        body: {},
+        requiredScopes: ["webagent.track:manage"]
+      }
+    ),
+    events: (input) => transport.webAgentSSE(
+      `/track/monitors/${encodeURIComponent(input.monitorId)}/events`,
+      input.token,
+      {
+        lastEventId: input.lastEventId,
+        requiredScopes: ["webagent.track:read"],
+        signal: input.signal
+      }
+    ),
+    intervene: (input) => transport.webAgentJson(
+      "POST",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}/intervene`,
+      input.token,
+      {
+        body: normalizeTrackInterveneInput(omit5(input, "token", "monitorId")),
+        requiredScopes: ["webagent.track:manage"]
+      }
+    ),
+    listRuns: (input) => transport.webAgentJson(
+      "GET",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}/runs`,
+      input.token,
+      {
+        query: omit5(input, "token", "monitorId"),
+        requiredScopes: ["webagent.track:read"]
+      }
+    ),
+    getRun: (input) => transport.webAgentJson(
+      "GET",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}/runs/${encodeURIComponent(input.runId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.track:read"]
+      }
+    ),
+    updateMonitor: (input) => transport.webAgentJson(
+      "PATCH",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}`,
+      input.token,
+      {
+        body: omit5(input, "token", "monitorId"),
+        requiredScopes: ["webagent.track:manage"]
+      }
+    ),
+    deleteMonitor: (input) => transport.webAgentJson(
+      "DELETE",
+      `/track/monitors/${encodeURIComponent(input.monitorId)}`,
+      input.token,
+      {
+        // Backend DELETE /track/monitors/{id} requires track:manage
+        // (see api/v1/track/monitors.py:delete_monitor).
+        requiredScopes: ["webagent.track:manage"]
+      }
+    )
+  };
+  function buildOps(token, monitorId) {
+    return {
+      get: async () => asRecord3((await api.getMonitor({ token, monitorId })).data),
+      update: async (input) => asRecord3((await api.updateMonitor({ token, monitorId, ...input })).data),
+      runNow: async () => asRecord3((await api.runNow({ token, monitorId })).data),
+      streamEvents: (opts) => api.events({ token, monitorId, lastEventId: opts.lastEventId, signal: opts.signal }),
+      postAction: async (action, body) => {
+        await transport.webAgentJson(
+          action.method || "POST",
+          action.endpoint,
+          token,
+          {
+            ...body !== void 0 ? { body } : {},
+            requiredScopes: ["webagent.track:manage"]
+          }
+        );
+      },
+      listRuns: async (opts) => asRecord3((await api.listRuns({ token, monitorId, ...opts })).data),
+      getRun: async (runId) => asRecord3((await api.getRun({ token, monitorId, runId })).data),
+      delete: async () => {
+        await api.deleteMonitor({ token, monitorId });
+      }
+    };
+  }
+  return {
+    /** Create a monitor. Returns a handle — see `MonitorHandle`. */
+    create: async (input) => {
+      const { token, prompt, ...rest } = input;
+      if (!prompt || typeof prompt !== "string") {
+        throw new QoniValidationError("track.create requires a prompt string");
+      }
+      const created = await api.createMonitor({
+        token,
+        intent: prompt,
+        ...snakeifyKeys(rest)
+      });
+      const monitorId = created.data.id || created.data.monitor_id;
+      if (!monitorId) {
+        throw new QoniValidationError("track monitor create did not return a monitor id");
+      }
+      return new MonitorHandle(buildOps(token, monitorId), monitorId);
+    },
+    /** Reconnect to an existing monitor. Verifies it exists before returning. */
+    attach: async (monitorId, opts) => {
+      const handle = new MonitorHandle(buildOps(opts.token, monitorId), monitorId);
+      await handle.get();
+      return handle;
+    },
+    api
+  };
+}
+function normalizeMonitorRun(item) {
+  const normalized = camelizeRecord(item);
+  if (typeof normalized.id !== "string" || !normalized.id) {
+    const id = normalized.runId ?? normalized.snapshotId;
+    if (typeof id === "string" && id) normalized.id = id;
+  }
+  return normalized;
+}
+function normalizeTrackInterveneInput(input) {
+  return renameKeys4(input, { requestId: "request_id" });
+}
+function normalizeSchedule(schedule) {
+  if (schedule.kind === "interval") {
+    return { kind: "interval", interval_seconds: schedule.intervalSeconds };
+  }
+  return { kind: "cron", expr: schedule.expr };
+}
+function snakeifyKeys(value) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (item === void 0) continue;
+    out[key.replace(/([A-Z])/g, (_, ch) => `_${ch.toLowerCase()}`)] = item;
+  }
+  return out;
+}
+function asRecord3(value) {
+  return isJsonObject(value) ? value : {};
+}
+function omit5(value, ...keys) {
+  const skipped = new Set(keys);
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!skipped.has(key) && item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function renameKeys4(value, mapping) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    const target = mapping[key] || key;
+    if (out[target] === void 0) out[target] = item;
+  }
+  return out;
+}
+
+// src/web-search.ts
+function createWebSearchNamespace(transport) {
+  const api = {
+    run: (input) => transport.webAgentJson("POST", "/web_search/runs", input.token, {
+      body: normalizeWebSearchRunInput(omit6(input, "token")),
+      requiredScopes: ["webagent.web_search:manage"]
+    }),
+    get: (input) => transport.webAgentJson(
+      "GET",
+      `/web_search/runs/${encodeURIComponent(input.runId)}`,
+      input.token,
+      {
+        requiredScopes: ["webagent.web_search:read"]
+      }
+    ),
+    events: (input) => transport.webAgentSSE(
+      `/web_search/runs/${encodeURIComponent(input.runId)}/events`,
+      input.token,
+      {
+        lastEventId: input.lastEventId,
+        requiredScopes: ["webagent.web_search:read"],
+        signal: input.signal,
+        onReconnect: input.onReconnect
+      }
+    ),
+    cancel: (input) => transport.webAgentJson(
+      "POST",
+      `/web_search/runs/${encodeURIComponent(input.runId)}/cancel`,
+      input.token,
+      {
+        body: omit6(input, "token", "runId"),
+        requiredScopes: ["webagent.web_search:manage"]
+      }
+    )
+  };
+  function buildOps(token, runId) {
+    return {
+      getDetail: async () => asRecord4((await api.get({ token, runId })).data),
+      streamEvents: (opts) => api.events({
+        token,
+        runId,
+        lastEventId: opts.lastEventId,
+        signal: opts.signal,
+        onReconnect: opts.onReconnect
+      }),
+      postAction: async () => {
+        throw new QoniError(
+          "webSearch runs never request interaction \u2014 there is no action to invoke",
+          { code: "validation.failed" }
+        );
+      },
+      cancel: async (reason) => asRecord4(
+        (await api.cancel({
+          token,
+          runId,
+          ...reason === void 0 ? {} : { reason }
+        })).data
+      )
+    };
+  }
+  return {
+    /** Start a search run. Returns a handle — see `RunHandle` for the run lifecycle. */
+    run: async (input) => {
+      const { token, prompt, capture, limits, session, ...rest } = input;
+      if (session) {
+        throw new QoniValidationError(
+          "webSearch runs do not execute in reusable sessions \u2014 drop the session option"
+        );
+      }
+      if (limits) {
+        throw new QoniValidationError(
+          "webSearch does not support limits yet \u2014 drop the limits option"
+        );
+      }
+      const resolvedQueries = Array.isArray(prompt) ? prompt : prompt ? [prompt] : void 0;
+      if (!resolvedQueries || resolvedQueries.length === 0) {
+        throw new QoniValidationError("webSearch.run requires a prompt");
+      }
+      const run = await api.run({
+        token,
+        queries: resolvedQueries,
+        ...rest
+      });
+      const runId = run.data.run_id || run.data.id;
+      if (!runId) {
+        throw new QoniValidationError("webSearch run create did not return a run id");
+      }
+      return new RunHandle(buildOps(token, runId), { id: runId, capture });
+    },
+    /** Reconnect to an existing run. Verifies the run exists before returning. */
+    attach: async (runId, opts) => {
+      const handle = new RunHandle(buildOps(opts.token, runId), {
+        id: runId,
+        capture: opts.capture
+      });
+      await handle.status();
+      return handle;
+    },
+    api
+  };
+}
+function normalizeWebSearchRunInput(input) {
+  const body = renameKeys5(input, {
+    maxResultsPerQuery: "max_results_per_query",
+    siteWhitelist: "site_whitelist",
+    siteBlacklist: "site_blacklist"
+  });
+  return body;
+}
+function asRecord4(value) {
+  return isJsonObject(value) ? value : {};
+}
+function omit6(value, ...keys) {
+  const skipped = new Set(keys);
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!skipped.has(key) && item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function renameKeys5(value, mapping) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    const target = mapping[key] || key;
+    if (out[target] === void 0) out[target] = item;
+  }
+  return out;
+}
+
+// src/client.ts
+var DEFAULT_QONI_HOST = "https://anima.eazo.ai/dashboard";
+var QoniAgentKit = class {
+  constructor(options) {
+    this.options = options;
+    const accessKey = options.accessKey ?? options.accessKeyId;
+    const secretKey = options.secretKey ?? options.accessKeySecret;
+    const host = options.host ?? options.qoniBaseUrl ?? options.genauthBaseUrl ?? DEFAULT_QONI_HOST;
+    if (!accessKey || !secretKey) {
+      throw new Error("Qoni requires accessKey and secretKey");
+    }
+    this.accessKey = accessKey ?? "";
+    this.secretKey = secretKey ?? "";
+    this.host = normalizeBaseUrl(host);
+    this.fetchImpl = options.fetch ?? fetch;
+    this.timeoutMs = options.timeoutMs ?? 3e4;
+    this.sseMaxRetries = options.sseMaxRetries ?? 5;
+    const transport = {
+      qoniJson: (...args) => this.qoniJson(...args),
+      genauthJson: (...args) => this.genauthJson(...args),
+      gumemJson: (...args) => this.gumemJson(...args),
+      gumemSSE: (...args) => this.gumemSSE(...args),
+      webAgentJson: (...args) => this.webAgentJson(...args),
+      webAgentBytes: (...args) => this.webAgentBytes(...args),
+      webAgentSSE: (...args) => this.webAgentSSE(...args)
+    };
+    this.genauth = createGenAuthNamespace(transport, {
+      adminTokenFor: () => this.genauthAdminTokenFor()
+    });
+    this.qoni = createQoniNamespace(
+      transport,
+      this.delegateToken.bind(this),
+      (input) => this.completeDelegateToken(input)
+    );
+    this.gumem = createGumemNamespace(transport);
+    this.webSearch = createWebSearchNamespace(transport);
+    this.doAnything = createDoAnythingNamespace(transport);
+    this.track = createTrackNamespace(transport);
+    this.deepResearch = createDeepResearchNamespace(transport);
+  }
+  options;
+  fetchImpl;
+  timeoutMs;
+  sseMaxRetries;
+  accessKey;
+  secretKey;
+  host;
+  runtimeConfigPromise;
+  productTokenCache = /* @__PURE__ */ new Map();
+  genAuthAdminTokenCache;
+  gumem;
+  genauth;
+  qoni;
+  webSearch;
+  doAnything;
+  track;
+  deepResearch;
+  delegateToken(input) {
+    let body;
+    try {
+      body = normalizeDelegateTokenInput(input);
+    } catch (err) {
+      return Promise.reject(err);
+    }
+    return this.signedPost(
+      "/api/v3/eak/delegations",
+      body
+    ).then(normalizeDelegateAgentTokenResponse);
+  }
+  /** @deprecated Use delegateToken. */
+  delegateAgent(input) {
+    return this.delegateToken(input);
+  }
+  completeDelegateToken(input) {
+    return this.signedPost(
+      "/api/v3/eak/delegations/complete",
+      input
+    ).then(
+      normalizeDelegateAgentTokenResponse
+    );
+  }
+  /** @deprecated Use completeDelegateToken. */
+  completeDelegateAgent(input) {
+    return this.completeDelegateToken(input);
+  }
+  currentUser(input) {
+    return this.genauth.userInfo(input);
+  }
+  /**
+   * Resolve a real GenAuth user id from the userpool bound to this AK/SK, by
+   * listing users and returning the first one. Convenience for demos / smoke
+   * tests so `delegateToken` has a valid `userId` without hardcoding one. In
+   * application code, resolve the actual logged-in user via `currentUser`
+   * instead of picking an arbitrary userpool member.
+   */
+  async resolveAnyBoundUser() {
+    const res = await this.genauth.users.list({ page: 1, limit: 1 });
+    const userId = firstBoundUserId(res.data);
+    if (!userId) {
+      throw new QoniError(
+        "resolveAnyBoundUser: the credential-bound GenAuth userpool returned no users. Create a user in the userpool, or pass a real userId to delegateToken.",
+        { code: "eak.genauth.no_bound_users" }
+      );
+    }
+    return userId;
+  }
+  request(input) {
+    return this.unstableRequest(input);
+  }
+  unstableRequest(input) {
+    if (!input.token) {
+      const pathname = normalizePath(input.path);
+      const signaturePayload = input.method === "GET" ? input.query || {} : input.body || {};
+      const signedHeaders = buildSignedHeaders(
+        {
+          accessKey: this.accessKey,
+          secretKey: this.secretKey
+        },
+        input.method,
+        pathname,
+        signaturePayload
+      );
+      return this.baseUrlFor("qoni").then((baseUrl) => this.jsonRequest(baseUrl, pathname, {
+        method: input.method,
+        query: input.query,
+        body: input.body,
+        headers: {
+          ...nonSignatureHeaders(input.headers),
+          ...signedHeaders
+        },
+        service: "qoni",
+        signed: true
+      }));
+    }
+    return this.baseUrlFor("qoni").then((baseUrl) => this.jsonRequest(baseUrl, input.path, {
+      method: input.method,
+      token: input.token,
+      query: input.query,
+      body: input.body,
+      headers: input.headers,
+      service: "qoni"
+    }));
+  }
+  qoniJson(method, path, token, payload = {}) {
+    return this.baseUrlFor("qoni").then((baseUrl) => this.jsonRequest(baseUrl, path, {
+      ...payload,
+      method,
+      token,
+      service: "qoni"
+    }));
+  }
+  genauthJson(method, path, token, payload = {}) {
+    return this.baseUrlFor("genauth").then((baseUrl) => this.jsonRequest(baseUrl, path, {
+      ...payload,
+      method,
+      token,
+      service: "genauth"
+    }));
+  }
+  async gumemJson(method, path, token, payload = {}) {
+    const runtimeToken = await this.productTokenFor("gumem", token, payload.requiredScopes);
+    const baseUrl = await this.baseUrlFor("gumem");
+    return this.jsonRequest(baseUrl, path, {
+      ...payload,
+      method,
+      token: runtimeToken,
+      service: "gumem"
+    });
+  }
+  async *gumemSSE(path, token, payload = {}) {
+    const runtimeToken = await this.productTokenFor("gumem", token, payload.requiredScopes);
+    const baseUrl = await this.baseUrlFor("gumem");
+    for await (const event of this.sseRequest(baseUrl, path, {
+      ...payload,
+      token: runtimeToken,
+      service: "gumem"
+    })) {
+      yield event;
+    }
+  }
+  async webAgentJson(method, path, token, payload = {}) {
+    const runtimeToken = await this.productTokenFor("webagent", token, payload.requiredScopes);
+    const baseUrl = await this.baseUrlFor("webagent");
+    return this.jsonRequest(
+      baseUrl,
+      this.webAgentPath(runtimeToken, path),
+      { ...payload, method, token: runtimeToken, service: "webagent" }
+    );
+  }
+  // Binary GET against the WebAgent API — artifact content downloads. JSON
+  // error payloads still map to typed QoniErrors.
+  async webAgentBytes(path, token, payload = {}) {
+    const runtimeToken = await this.productTokenFor("webagent", token, payload.requiredScopes);
+    const baseUrl = await this.baseUrlFor("webagent");
+    const response = await this.fetchWithTimeout(
+      urlWithBasePath(baseUrl, this.webAgentPath(runtimeToken, path), payload.query),
+      {
+        method: "GET",
+        headers: {
+          accept: "*/*",
+          authorization: `Bearer ${runtimeToken}`,
+          ...payload.headers || {}
+        }
+      }
+    );
+    if (!response.ok) {
+      throw errorFromPayload(
+        response.status,
+        await readJson(response),
+        `Qoni request failed with HTTP ${response.status}`
+      );
+    }
+    const buffer = await response.arrayBuffer();
+    return {
+      bytes: new Uint8Array(buffer),
+      mime: response.headers.get("content-type") || "application/octet-stream"
+    };
+  }
+  async *webAgentSSE(path, token, payload = {}) {
+    const runtimeToken = await this.productTokenFor("webagent", token, payload.requiredScopes);
+    const baseUrl = await this.baseUrlFor("webagent");
+    for await (const event of this.sseRequest(
+      baseUrl,
+      this.webAgentPath(runtimeToken, path),
+      {
+        ...payload,
+        token: runtimeToken,
+        service: "webagent",
+        // Re-resolve the product token before each reconnect (refreshes if the
+        // cached one expired); the tenant — and therefore the path — is stable.
+        refreshToken: () => this.productTokenFor("webagent", token, payload.requiredScopes)
+      }
+    )) {
+      yield normalizeWebAgentEvent(event);
+    }
+  }
+  async signedPost(pathname, body) {
+    const payload = toRecord(body);
+    const headers = buildSignedHeaders(
+      {
+        accessKey: this.accessKey,
+        secretKey: this.secretKey
+      },
+      "POST",
+      pathname,
+      payload
+    );
+    return this.jsonRequest(await this.baseUrlFor("qoni"), pathname, {
+      method: "POST",
+      body: payload,
+      headers,
+      service: "qoni",
+      signed: true
+    });
+  }
+  async jsonRequest(baseUrl, pathname, options) {
+    const response = await this.fetchWithTimeout(
+      urlWithBasePath(baseUrl, pathname, options.query),
+      {
+        method: options.method,
+        headers: requestHeaders(options),
+        body: requestBody(options.body)
+      }
+    );
+    const payload = await readJson(response);
+    if (!response.ok) {
+      throw errorFromPayload(
+        response.status,
+        payload,
+        `Qoni request failed with HTTP ${response.status}`
+      );
+    }
+    const envelopeStatus = errorEnvelopeStatus(payload);
+    if (envelopeStatus !== void 0) {
+      throw errorFromPayload(
+        envelopeStatus,
+        payload,
+        `Qoni request failed with statusCode ${envelopeStatus}`
+      );
+    }
+    return normalizeResponse(payload, options.service);
+  }
+  // Reconnecting wrapper: yields events from a fresh connection, and on a
+  // dropped stream (network/5xx, not a clean close or a user abort) reconnects
+  // with `last-event-id` so the backend replays from where we left off. Each
+  // attempt re-issues the GET with the same Bearer product token (no per-call
+  // AK/SK signature, so no gateway nonce replay). Caps at `sseMaxRetries`.
+  async *sseRequest(baseUrl, pathname, options) {
+    let lastEventId = options.lastEventId;
+    let attempt = 0;
+    for (; ; ) {
+      const token = options.refreshToken ? await options.refreshToken() : options.token;
+      try {
+        for await (const event of this.sseConnectOnce(baseUrl, pathname, {
+          ...options,
+          token,
+          lastEventId
+        })) {
+          if (event.id) lastEventId = event.id;
+          attempt = 0;
+          yield event;
+        }
+        return;
+      } catch (err) {
+        if (options.signal?.aborted) throw err;
+        const canRetry = isRetryableStreamError(err) || !!options.refreshToken && isAuthError(err);
+        if (attempt >= this.sseMaxRetries || !canRetry) throw err;
+        attempt++;
+        options.onReconnect?.({ attempt, lastEventId, error: err });
+        await sleepWithAbort(sseBackoffMs(attempt), options.signal);
+      }
+    }
+  }
+  async *sseConnectOnce(baseUrl, pathname, options) {
+    const response = await this.fetchWithTimeout(
+      urlWithBasePath(baseUrl, pathname, options.query),
+      {
+        method: "GET",
+        headers: {
+          accept: "text/event-stream",
+          authorization: `Bearer ${options.token}`,
+          ...options.headers || {},
+          ...options.lastEventId ? { "last-event-id": options.lastEventId } : {}
+        }
+      },
+      options.signal,
+      { streamBody: true }
+    );
+    if (!response.ok) {
+      throw errorFromPayload(
+        response.status,
+        await readJson(response),
+        `Qoni stream failed with HTTP ${response.status}`
+      );
+    }
+    if (!response.body) {
+      throw errorFromPayload(502, void 0, "Qoni stream response has no body");
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      while (true) {
+        if (options.signal?.aborted) {
+          await reader.cancel().catch(() => void 0);
+          throw options.signal.reason || new DOMException("Aborted", "AbortError");
+        }
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        const chunks = buffer.split(/\r?\n\r?\n/);
+        buffer = chunks.pop() || "";
+        for (const chunk of chunks) {
+          const event = parseSSEEvent(chunk);
+          if (event) yield event;
+        }
+      }
+      const finalEvent = parseSSEEvent(buffer);
+      if (finalEvent) yield finalEvent;
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  async fetchWithTimeout(input, init, signal, opts) {
+    if (signal?.aborted) throw signal.reason || new DOMException("Aborted", "AbortError");
+    const controller = new AbortController();
+    const resolved = resolveLocalGenauthRequest(input);
+    const requestInit = resolved.hostHeader ? {
+      ...init,
+      headers: withHostHeader(init.headers, resolved.hostHeader)
+    } : init;
+    let didTimeout = false;
+    const abortFromSignal = () => controller.abort(signal?.reason);
+    signal?.addEventListener("abort", abortFromSignal, { once: true });
+    const timeout = setTimeout(() => {
+      didTimeout = true;
+      controller.abort();
+    }, this.timeoutMs);
+    try {
+      return await this.fetchImpl(resolved.url, { ...requestInit, signal: controller.signal });
+    } catch (error) {
+      if (isAbortError(error) && didTimeout || isConnectTimeoutError(error)) {
+        throw timeoutError(error);
+      }
+      if (isFetchNetworkError(error)) throw networkError(error);
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+      if (!opts?.streamBody) signal?.removeEventListener("abort", abortFromSignal);
+    }
+  }
+  async baseUrlFor(service) {
+    const explicit = this.explicitBaseUrlFor(service);
+    if (explicit) return explicit;
+    const runtime = await this.runtimeConfig();
+    if (service === "qoni") return this.host;
+    const hostOrigin = originBaseUrl(this.host);
+    if (service === "genauth") return runtime.genauthBaseUrl ?? hostOrigin;
+    if (service === "gumem") return runtime.gumemBaseUrl ?? hostOrigin;
+    return runtime.webAgentBaseUrl ?? hostOrigin;
+  }
+  explicitBaseUrlFor(service) {
+    if (service === "qoni") {
+      const value = this.options.qoniBaseUrl ?? this.options.genauthBaseUrl;
+      return value ? normalizeBaseUrl(value) : void 0;
+    }
+    if (service === "genauth" && this.options.genauthBaseUrl) {
+      return normalizeBaseUrl(this.options.genauthBaseUrl);
+    }
+    if (service === "genauth") {
+      const value = serviceHostOption(this.options, "genauth");
+      return value ? normalizeBaseUrl(value) : void 0;
+    }
+    if (service === "gumem" && this.options.gumemBaseUrl) {
+      return normalizeBaseUrl(this.options.gumemBaseUrl);
+    }
+    if (service === "gumem") {
+      const value = serviceHostOption(this.options, "gumem");
+      return value ? normalizeBaseUrl(value) : void 0;
+    }
+    if (service === "webagent" && this.options.webAgentBaseUrl) {
+      return normalizeBaseUrl(this.options.webAgentBaseUrl);
+    }
+    if (service === "webagent") {
+      const value = serviceHostOption(this.options, "webagent");
+      return value ? normalizeBaseUrl(value) : void 0;
+    }
+    return void 0;
+  }
+  runtimeConfig() {
+    this.runtimeConfigPromise ??= this.fetchRuntimeConfig();
+    return this.runtimeConfigPromise;
+  }
+  async fetchRuntimeConfig() {
+    const pathname = "/api/v3/eak/runtime-config";
+    const headers = buildSignedHeaders(
+      {
+        accessKey: this.accessKey,
+        secretKey: this.secretKey
+      },
+      "GET",
+      pathname,
+      {}
+    );
+    const response = await this.fetchWithTimeout(
+      urlWithBasePath(this.host, pathname),
+      {
+        method: "GET",
+        headers: {
+          accept: "application/json",
+          ...headers
+        }
+      }
+    );
+    const payload = await readJson(response);
+    if (!response.ok) {
+      throw errorFromPayload(
+        response.status,
+        payload,
+        `Qoni runtime config request failed with HTTP ${response.status}`
+      );
+    }
+    return normalizeRuntimeConfig(payload);
+  }
+  webAgentPath(token, path) {
+    const normalized = normalizePath(path);
+    if (normalized.startsWith("/api/v1/projects/")) return normalized;
+    const tenantId = requiredWebAgentTenantId(token);
+    return `/api/v1/projects/${encodeURIComponent(tenantId)}${normalized}`;
+  }
+  async productTokenFor(service, token, requiredScopes) {
+    const runtimeToken = requiredRuntimeToken(token);
+    if (!isQoniDelegationToken(runtimeToken)) return runtimeToken;
+    const scopes = [...requiredScopes || []].sort();
+    const cacheKey = [service, runtimeToken, scopes.join(" ")].join(":");
+    const cached = this.productTokenCache.get(cacheKey);
+    if (cached && cached.expiresAt > Date.now() + 3e4) return cached.token;
+    const response = await this.signedPost("/api/v3/eak/token-exchange", {
+      subjectToken: runtimeToken,
+      resource: service === "gumem" ? "gumem" : "webagent",
+      scopes
+    });
+    const payload = response.data;
+    const accessToken = readAccessToken(payload);
+    if (!accessToken) {
+      throw errorFromPayload(
+        502,
+        payload,
+        "Qoni product token exchange response did not include an access token"
+      );
+    }
+    this.productTokenCache.set(cacheKey, {
+      token: accessToken,
+      expiresAt: Date.now() + Math.max(0, readExpiresIn(payload) ?? 3600) * 1e3
+    });
+    return accessToken;
+  }
+  async genauthAdminTokenFor() {
+    const cached = this.genAuthAdminTokenCache;
+    if (cached && cached.expiresAt > Date.now() + 3e4) {
+      return { accessToken: cached.accessToken, userPoolId: cached.userPoolId };
+    }
+    const response = await this.signedPost("/api/v3/eak/genauth/admin-token", {});
+    const payload = response.data;
+    const accessToken = readAccessToken(payload);
+    const userPoolId = readString(payload, "userPoolId") ?? readString(payload, "userpoolId") ?? readString(payload, "user_pool_id");
+    if (!accessToken || !userPoolId) {
+      throw errorFromPayload(
+        502,
+        payload,
+        "Qoni GenAuth admin-token response did not include accessToken and userPoolId"
+      );
+    }
+    this.genAuthAdminTokenCache = {
+      accessToken,
+      userPoolId,
+      expiresAt: Date.now() + Math.max(0, readExpiresIn(payload) ?? 3600) * 1e3
+    };
+    return { accessToken, userPoolId };
+  }
+};
+function requestHeaders(options) {
+  const headers = {
+    accept: "application/json",
+    ...options.headers || {}
+  };
+  if (options.token) headers.authorization = `Bearer ${options.token}`;
+  if (options.body !== void 0 && !isBodyInit(options.body) && !headers["content-type"]) {
+    headers["content-type"] = "application/json";
+  }
+  return headers;
+}
+function nonSignatureHeaders(headers) {
+  return Object.fromEntries(
+    Object.entries(headers || {}).filter(([key]) => {
+      const normalized = key.toLowerCase();
+      return normalized !== "authorization" && normalized !== "content-type" && normalized !== "date" && !normalized.startsWith("x-authing-");
+    })
+  );
+}
+function requestBody(body) {
+  if (body === void 0) return void 0;
+  if (isBodyInit(body)) return body;
+  return JSON.stringify(body);
+}
+function isBodyInit(value) {
+  return typeof value === "string" || value instanceof ArrayBuffer || value instanceof Blob || value instanceof FormData || value instanceof URLSearchParams;
+}
+async function readJson(response) {
+  const contentType = response.headers.get("content-type")?.toLowerCase() || "";
+  if (contentType.includes("ndjson") || contentType.includes("jsonl")) {
+    const body = await response.text();
+    if (!body.trim()) return [];
+    try {
+      return body.split(/\r?\n/).filter((line) => line.trim().length > 0).map((line) => JSON.parse(line));
+    } catch {
+      return void 0;
+    }
+  }
+  return response.json().catch(() => void 0);
+}
+function normalizeResponse(payload, _service) {
+  if (isJsonObject(payload) && ("data" in payload || "meta" in payload)) {
+    return {
+      data: "data" in payload ? payload.data : payload,
+      meta: {
+        ...isJsonObject(payload.meta) ? payload.meta : {},
+        ...topLevelMeta(payload)
+      }
+    };
+  }
+  return { data: payload, meta: {} };
+}
+function topLevelMeta(payload) {
+  const meta = {};
+  for (const key of ["requestId", "traceId", "auditId"]) {
+    if (typeof payload[key] === "string") meta[key] = payload[key];
+  }
+  return meta;
+}
+function urlWithQuery(baseUrl, pathname, query) {
+  const url = new URL(normalizePath(pathname), baseUrl);
+  for (const [key, value] of Object.entries(query || {})) {
+    if (value !== void 0 && value !== null) url.searchParams.set(key, String(value));
+  }
+  return url;
+}
+function urlWithBasePath(baseUrl, pathname, query) {
+  const base = new URL(baseUrl);
+  const basePath = base.pathname === "/" ? "" : base.pathname.replace(/\/+$/, "");
+  const normalizedPath = normalizePath(pathname);
+  const fullPath = basePath && (normalizedPath === basePath || normalizedPath.startsWith(`${basePath}/`)) ? normalizedPath : `${basePath}${normalizedPath}`;
+  return urlWithQuery(base.origin, fullPath, query);
+}
+function resolveLocalGenauthRequest(input) {
+  const url = new URL(input.toString());
+  if (process.env.QONI_LOCAL_GENAUTH_REWRITE === "false" || url.protocol !== "http:" || !url.hostname.endsWith(".genauth.localhost")) {
+    return { url };
+  }
+  const hostHeader = url.host;
+  url.hostname = process.env.QONI_LOCAL_GENAUTH_TARGET_HOST || "127.0.0.1";
+  return { url, hostHeader };
+}
+function withHostHeader(headers, hostHeader) {
+  const out = {};
+  new Headers(headers).forEach((value, key) => {
+    out[key] = value;
+  });
+  out.Host = hostHeader;
+  return out;
+}
+function normalizePath(path) {
+  return path.startsWith("/") ? path : `/${path}`;
+}
+function normalizeBaseUrl(host) {
+  const withProtocol = /^https?:\/\//i.test(host) ? host : `https://${host}`;
+  return withProtocol.replace(/\/+$/, "");
+}
+function originBaseUrl(host) {
+  return new URL(host).origin;
+}
+function serviceHostOption(options, service) {
+  if (service === "genauth") {
+    return options.genauthHost;
+  }
+  if (service === "gumem") {
+    return options.gumemHost;
+  }
+  return options.webAgentHost;
+}
+function normalizeRuntimeConfig(payload) {
+  const data = envelopeData(payload);
+  if (!isJsonObject(data)) return {};
+  const config = data;
+  return {
+    eakBaseUrl: runtimeServiceUrl(config, "eak", "eakBaseUrl"),
+    genauthBaseUrl: runtimeServiceUrl(config, "genauth", "genauthBaseUrl"),
+    gumemBaseUrl: runtimeServiceUrl(config, "gumem", "gumemBaseUrl"),
+    webAgentBaseUrl: runtimeServiceUrl(config, "webAgent", "webAgentBaseUrl") ?? runtimeServiceUrl(config, "webagent", "webAgentBaseUrl")
+  };
+}
+function envelopeData(payload) {
+  if (isJsonObject(payload) && "data" in payload) return payload.data;
+  return payload;
+}
+function runtimeServiceUrl(config, service, topLevelKey) {
+  const topLevel = config[topLevelKey];
+  if (typeof topLevel === "string" && topLevel.trim()) return normalizeBaseUrl(topLevel);
+  const serviceValue = config.services?.[service];
+  if (typeof serviceValue === "string" && serviceValue.trim()) {
+    return normalizeBaseUrl(serviceValue);
+  }
+  if (isJsonObject(serviceValue)) {
+    for (const key of ["baseUrl", "url", "host"]) {
+      const value = serviceValue[key];
+      if (typeof value === "string" && value.trim()) return normalizeBaseUrl(value);
+    }
+  }
+  return void 0;
+}
+function toRecord(value) {
+  const out = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (item !== void 0) out[key] = item;
+  }
+  return out;
+}
+function normalizeDelegateTokenInput(input) {
+  const body = toRecord(input);
+  if (!body.userId && isJsonObject(input.user) && typeof input.user.id === "string") {
+    body.userId = input.user.id;
+  }
+  if (input.mode !== "interactive" && !body.userId) {
+    throw new QoniValidationError(
+      'delegateToken: silent mode requires a user \u2014 pass `user: { id: <genauthUserId> }` (or the deprecated top-level `userId`). Interactive mode (`mode: "interactive"`) does not need one.'
+    );
+  }
+  body.agent = input.agent ?? "sdk";
+  body.scopes = resolveDelegationScopes(input.scopes, input.products);
+  delete body.products;
+  return body;
+}
+function resolveDelegationScopes(scopes, products) {
+  const resolved = /* @__PURE__ */ new Set();
+  for (const product of products ?? []) {
+    const expansion = QoniProductScopes[product];
+    if (!expansion) {
+      throw new QoniValidationError(
+        `delegateToken: unknown product "${product}" \u2014 expected one of ${Object.keys(QoniProductScopes).join(", ")}`
+      );
+    }
+    for (const scope of expansion) resolved.add(scope);
+  }
+  for (const scope of scopes ?? []) {
+    validateScopeFormat(scope);
+    resolved.add(scope);
+  }
+  if (resolved.size === 0) {
+    throw new QoniValidationError(
+      'delegateToken requires at least one scope \u2014 pass scopes (e.g. ["webagent.do_anything:manage"]) and/or products (e.g. ["doAnything"])'
+    );
+  }
+  return [...resolved];
+}
+function validateScopeFormat(scope) {
+  if (KNOWN_SCOPES.includes(scope)) return;
+  const prefixed = KNOWN_SCOPES.find((known) => known.endsWith(`.${scope}`) || known === `webagent.${scope}`);
+  if (prefixed) {
+    throw new QoniValidationError(
+      `delegateToken: scope "${scope}" is missing its service prefix \u2014 write "${prefixed}"`
+    );
+  }
+  if (!/^[a-z0-9_]+(\.[a-z0-9_]+)+:[a-z0-9_]+$/.test(scope)) {
+    throw new QoniValidationError(
+      `delegateToken: malformed scope "${scope}" \u2014 scopes look like "<service>.<resource>:<action>", e.g. "webagent.do_anything:manage"`
+    );
+  }
+}
+function errorEnvelopeStatus(payload) {
+  if (!isJsonObject(payload)) return void 0;
+  const statusCode = payload.statusCode;
+  if (typeof statusCode !== "number" || statusCode < 400) return void 0;
+  if ("data" in payload && payload.data !== void 0) return void 0;
+  return statusCode;
+}
+function decodeJwtPayload(token) {
+  const [, payload] = token.split(".");
+  if (!payload) throw new Error("token is not a JWT");
+  return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+}
+function safeDecodeJwtPayload(token) {
+  try {
+    return decodeJwtPayload(token);
+  } catch {
+    return void 0;
+  }
+}
+function isQoniDelegationToken(token) {
+  return safeDecodeJwtPayload(token)?.token_type === "eak_delegation_token";
+}
+function readAccessToken(payload) {
+  if (!isJsonObject(payload)) return void 0;
+  for (const key of ["accessToken", "access_token", "token"]) {
+    const token = payload[key];
+    if (typeof token === "string" && token.trim()) return token;
+  }
+  return void 0;
+}
+function readExpiresIn(payload) {
+  if (!isJsonObject(payload)) return void 0;
+  const expiresIn = payload.expiresIn ?? payload.expires_in;
+  if (typeof expiresIn === "number" && Number.isFinite(expiresIn)) return expiresIn;
+  if (typeof expiresIn === "string" && expiresIn.trim()) {
+    const parsed = Number(expiresIn);
+    return Number.isFinite(parsed) ? parsed : void 0;
+  }
+  return void 0;
+}
+function readString(payload, key) {
+  if (!isJsonObject(payload)) return void 0;
+  const value = payload[key];
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function requiredWebAgentTenantId(token) {
+  const payload = decodeJwtPayload(token);
+  const productResource = payload.product_resource;
+  if (isJsonObject(productResource) && productResource.type === "webagent_tenant") {
+    const id = productResource.id;
+    if (typeof id === "string" && id.trim()) return id;
+  }
+  const resourceBindingTenantId = nestedString(payload, [
+    "resource_bindings",
+    "webagent",
+    "tenant_id"
+  ]);
+  if (resourceBindingTenantId) return resourceBindingTenantId;
+  const tenantId = payload.webagent_tenant_id;
+  if (typeof tenantId === "string" && tenantId.trim()) return tenantId;
+  const projectId = payload.webagent_project_id;
+  if (typeof projectId === "string" && projectId.trim()) return projectId;
+  throw new Error("token is missing WebAgent tenant binding");
+}
+function nestedString(value, path) {
+  let cursor = value;
+  for (const segment of path) {
+    if (!isJsonObject(cursor)) return void 0;
+    cursor = cursor[segment];
+  }
+  return typeof cursor === "string" && cursor.trim() ? cursor : void 0;
+}
+function normalizeWebAgentEvent(event) {
+  if (event.event) return event;
+  const data = event.data;
+  if (data && typeof data === "object" && typeof data.type === "string") {
+    return { ...event, event: data.type };
+  }
+  return event;
+}
+function isRetryableStreamError(err) {
+  if (err && typeof err === "object") {
+    const e = err;
+    if (e.name === "AbortError") return false;
+    if (typeof e.retryable === "boolean") return e.retryable;
+    if (typeof e.status === "number") {
+      return e.status >= 500 || e.status === 408 || e.status === 429;
+    }
+  }
+  return true;
+}
+function isAuthError(err) {
+  const status = err?.status;
+  return status === 401 || status === 403;
+}
+function sseBackoffMs(attempt) {
+  const base = Math.min(500 * 2 ** (attempt - 1), 1e4);
+  return base + Math.floor(Math.random() * 250);
+}
+function sleepWithAbort(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(new DOMException("The operation was aborted", "AbortError"));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new DOMException("The operation was aborted", "AbortError"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function firstBoundUserId(data) {
+  const arrays = [
+    data,
+    data?.list,
+    data?.users,
+    data?.data,
+    data?.items
+  ];
+  for (const candidate of arrays) {
+    if (Array.isArray(candidate) && candidate.length) {
+      const u = candidate[0];
+      for (const key of ["userId", "id", "user_id", "sub", "username"]) {
+        const v = u?.[key];
+        if (typeof v === "string" && v) return v;
+      }
+    }
+  }
+  return void 0;
+}
+function parseSSEEvent(chunk) {
+  const lines = chunk.split(/\r?\n/);
+  let id;
+  let event;
+  const data = [];
+  for (const line of lines) {
+    if (!line || line.startsWith(":")) continue;
+    const index = line.indexOf(":");
+    const field = index >= 0 ? line.slice(0, index) : line;
+    const value = index >= 0 ? line.slice(index + 1).replace(/^ /, "") : "";
+    if (field === "id") id = value;
+    if (field === "event") event = value;
+    if (field === "data") data.push(value);
+  }
+  if (!id && !event && !data.length) return null;
+  return { id, event, data: parseEventData(data.join("\n")) };
+}
+function parseEventData(raw) {
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+function requiredRuntimeToken(token) {
+  if (token && token.trim()) return token;
+  throw new QoniDelegationRequiredError(
+    "Product capability calls require an explicit token in the token field"
+  );
+}
+function normalizeDelegateAgentTokenResponse(response) {
+  if (!isJsonObject(response.data)) return response;
+  const grantState = typeof response.data.grantState === "string" ? response.data.grantState : typeof response.data.state === "string" ? response.data.state : typeof response.data.grantId === "string" ? response.data.grantId : void 0;
+  if (typeof response.data.authorizationUrl === "string" && grantState) {
+    return {
+      ...response,
+      data: {
+        ...response.data,
+        grantState,
+        state: grantState
+      }
+    };
+  }
+  const token = typeof response.data.delegateAgentToken === "string" ? response.data.delegateAgentToken : typeof response.data.delegationToken === "string" ? response.data.delegationToken : typeof response.data.token === "string" ? response.data.token : void 0;
+  if (!token) return response;
+  return {
+    ...response,
+    data: {
+      ...response.data,
+      token,
+      delegateAgentToken: token
+    }
+  };
+}
+function isAbortError(error) {
+  return error instanceof DOMException && error.name === "AbortError";
+}
+function isConnectTimeoutError(error) {
+  const cause = errorCause(error);
+  return errorCode(cause) === "UND_ERR_CONNECT_TIMEOUT" || errorName(cause) === "ConnectTimeoutError";
+}
+function isFetchNetworkError(error) {
+  if (!(error instanceof TypeError)) return false;
+  const message = error.message.toLowerCase();
+  return message.includes("fetch failed") || message.includes("network");
+}
+function errorCause(error) {
+  return error && typeof error === "object" ? error.cause : void 0;
+}
+function errorCode(error) {
+  return error && typeof error === "object" && typeof error.code === "string" ? error.code : void 0;
+}
+function errorName(error) {
+  return error && typeof error === "object" && typeof error.name === "string" ? error.name : void 0;
+}
+export {
+  ActionKinds,
+  InteractionHandle,
+  InteractionStatuses,
+  InteractionTypes,
+  MonitorHandle,
+  QoniAgentKit as Qoni,
+  QoniAgentKit,
+  QoniAuthError,
+  QoniDelegationRequiredError,
+  QoniError,
+  QoniEventTypes,
+  QoniPermissionDeniedError,
+  QoniProductScopes,
+  QoniRateLimitError,
+  QoniScopeBundles,
+  QoniScopes,
+  QoniTimeoutError,
+  QoniTokenExpiredError,
+  QoniUpstreamError,
+  QoniValidationError,
+  RunHandle,
+  buildAuthorization,
+  buildSignature,
+  buildStringToSign
+};
+//# sourceMappingURL=index.js.map