premanmcp 1.1.3 → 1.1.5

package/bin/eval.js

@@ -21,15 +21,25 @@
  *     run — cancelled, or taken over — and the only correct response is to stop.
  *   - The runner token never enters the child's environment.
  *
- * One rule is this module's own: the run executes in a scratch directory, never
- * in the customer's project. assert-ai writes results under `cwd`, and a harness
- * that scattered `artifacts/` into somebody's repository would be a bad guest
- * even before the first `git status`.
+ * One rule is this module's own: the run executes outside the customer's
+ * project, under `~/.preman/evals`. assert-ai writes results under `cwd`, and a
+ * harness that scattered `artifacts/` into somebody's repository would be a bad
+ * guest even before the first `git status`. That directory is kept between runs
+ * rather than thrown away — see `suiteHome` for what is stored there and why
+ * deleting it was the reason every run measured different cases.
  */
 
 import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -75,10 +85,114 @@ const MAX_STDERR_BYTES = 256 * 1024;
 
 export class EvalError extends Error {}
 
+// ── Where a suite lives between runs ────────────────────────────────────
+
+/** Everything this machine keeps about evals it has run. */
+const EVAL_HOME = path.join(os.homedir(), ".preman", "evals");
+
+/**
+ * Upstream's own rule for a suite id, copied rather than referenced.
+ *
+ * `assert_ai.config._validate_identifier` applies this to `suite:` before it
+ * builds a path from it. Applying it again here is not distrust of the backend
+ * but of the join: this is the one place a value off the network becomes a
+ * directory name in the user's home.
+ */
+const SAFE_SUITE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+
+/** Finished runs kept per suite. Enough to compare against last week. */
+const KEEP_RUNS = 20;
+
+/**
+ * The directory this suite runs in — the same one, every time.
+ *
+ * This being stable is the whole reason a rerun measures the same cases as the
+ * run before it. assert-ai caches its two generative stages: `systematize` and
+ * `test_set` write into `<suite>/artifacts/<stage>/v0001, v0002, ...` beside a
+ * hash of what produced them, and on the next run it re-derives that hash and
+ * reuses the matching version instead of generating again. The hash covers the
+ * behaviour text, the stage config and the taxonomy the test set was built
+ * from, so an edit to any of those regenerates and nothing else does.
+ *
+ * That machinery was already there and we were defeating it. The run used to
+ * execute in a fresh `mkdtemp` that was deleted on the way out, so the lookup
+ * had an empty disk to search and missed every time — which is why two runs of
+ * an unchanged behaviour never scored the same cases, and why nothing here was
+ * comparable to anything.
+ *
+ * Deliberately not the customer's project, and deliberately not keyed by it
+ * either: the bank belongs to the behaviour, and running the same eval from a
+ * second checkout should reuse it rather than pay to invent a parallel one.
+ */
+export function suiteHome(job, { home = EVAL_HOME } = {}) {
+  const suite = String(job?.suite ?? "");
+  if (suite.length > 255 || suite.includes("..") || !SAFE_SUITE.test(suite)) {
+    throw new EvalError(
+      `this run names a suite that cannot be a directory: ${JSON.stringify(suite)}`
+    );
+  }
+  const directory = path.join(home, suite);
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  return directory;
+}
+
+/**
+ * Drop the oldest finished runs, keeping the bank.
+ *
+ * Run outputs are transcripts and scores and they accumulate without limit;
+ * the cached stages next to them are the reason this directory is kept at all.
+ * So the rule is by name, not by age alone: `artifacts/` is never a candidate
+ * however old it looks, and everything else under the suite is a run.
+ *
+ * Called before the run starts rather than after it finishes, so that nothing
+ * being deleted here can be a run that is still being uploaded.
+ */
+export function pruneRuns(home, job, { keep = KEEP_RUNS } = {}) {
+  const results = path.join(home, "artifacts", "results", String(job.suite));
+  let entries;
+  try {
+    entries = readdirSync(results, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+
+  const runs = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || entry.name === "artifacts") continue;
+    const full = path.join(results, entry.name);
+    try {
+      runs.push({ full, at: statSync(full).mtimeMs });
+    } catch {
+      // Vanished between the listing and the stat. Nothing to prune.
+    }
+  }
+
+  const doomed = runs.sort((a, b) => b.at - a.at).slice(keep);
+  for (const run of doomed) rmSync(run.full, { recursive: true, force: true });
+  return doomed.map((run) => run.full);
+}
+
+/**
+ * What a finished run leaves behind, and what it must not.
+ *
+ * The bundle goes. It is whatever the frame carried — a spec, and sandbox or
+ * fixture files that can hold a URL and a credential for the customer's own
+ * systems — and when this ran in a temp directory that was deleted on the way
+ * out, none of it outlived the run. Keeping the directory must not quietly
+ * turn that into a token sitting in `~/.preman` until someone notices.
+ *
+ * The bank and the results stay. Those are the point: generated cases to reuse
+ * and scores to compare against.
+ */
+function tidy(home) {
+  if (!home) return;
+  rmSync(path.join(home, "bundle"), { recursive: true, force: true });
+}
+
 // ── The bundle on disk ──────────────────────────────────────────────────
 
 /**
- * Write the leased run into a scratch directory and return what to run.
+ * Write the leased run into its suite's directory and return what to run.
  *
  * Every path in the frame is checked before it is joined, not because the
  * backend is untrusted but because "the server would never send that" is the
@@ -88,6 +202,11 @@ export class EvalError extends Error {}
 export function materialize(job, root) {
   mkdirSync(root, { recursive: true, mode: 0o700 });
   const bundle = path.join(root, "bundle");
+  // Emptied first, because the directory outlives the run now. Every file the
+  // spec refers to arrives in the frame, so anything already here came from a
+  // previous run — and a sandbox or fixture the behaviour has since dropped
+  // would otherwise still be sitting where the spec used to point.
+  rmSync(bundle, { recursive: true, force: true });
   mkdirSync(bundle, { recursive: true, mode: 0o700 });
 
   for (const entry of job.files || []) {
@@ -306,9 +425,10 @@ function readJson(file) {
 /**
  * Where this run's output lands.
  *
- * `artifacts_base()` upstream is `Path.cwd()`, so this is a consequence of the
- * scratch directory rather than a configuration choice — which is also why the
- * scratch directory has to be stable for the life of the run.
+ * `artifacts_base()` upstream is `Path.cwd()`, so this is a consequence of
+ * where the run is executed rather than a configuration choice — which is why
+ * `suiteHome` is what it is. The sibling of this path is the cached bank the
+ * same suite reuses next time.
  */
 export function runDir(cwd, job) {
   return path.join(cwd, "artifacts", "results", String(job.suite), String(job.run));
@@ -455,6 +575,58 @@ export function readProgress(cwd, job) {
   };
 }
 
+/**
+ * Whether the tool calls the agent made are in the transcript the judge read.
+ *
+ * A behaviour like `unchecked_account_claim` is defined entirely in terms of
+ * tool calls: its taxonomy tells the judge to read the events and not to infer
+ * a lookup from the wording of a reply. So a transcript that lost them is not a
+ * degraded measurement, it is the opposite measurement -- an agent that checked
+ * before answering is indistinguishable from one that made the figure up, and
+ * the run reports the second. It happened for every run of that suite until the
+ * adapter's event field names were corrected, and it exited 0 each time.
+ *
+ * Compared against the adapter's own count rather than checked for zero on its
+ * own, because zero tool calls is a legitimate result: an agent asked a general
+ * question should not call anything. The failure is the disagreement.
+ *
+ * Returns "" when there is nothing wrong, so the caller can tell "fine" from
+ * "unreadable".
+ */
+export function missingToolEvidence(dir, stats) {
+  const forwarded = Number(stats?.toolCalls);
+  if (!Number.isFinite(forwarded) || forwarded <= 0) return "";
+
+  let recorded = 0;
+  try {
+    const text = readFileSync(path.join(dir, "inference_set.jsonl"), "utf8");
+    for (const line of text.split("\n")) {
+      if (!line.trim()) continue;
+      let row;
+      try {
+        row = JSON.parse(line);
+      } catch {
+        continue; // A row we cannot read is not evidence that evidence is missing.
+      }
+      for (const event of row.events || []) {
+        if (event?.edit?.type === "tool_call") recorded += 1;
+      }
+    }
+  } catch {
+    // No transcript to read is a different failure, and the harness's own exit
+    // code reports it. Claiming this one on top would be guessing.
+    return "";
+  }
+  if (recorded > 0) return "";
+
+  return (
+    `the agent made ${forwarded} tool call(s) and none of them reached the transcript, so ` +
+    `the judge scored it as an agent that called nothing. Every case that answered from a ` +
+    `lookup would be marked unsupported. This is the adapter's event channel, not the ` +
+    `agent: check that the events it sends still match the fields assert-ai reads.`
+  );
+}
+
 // ── Handing the run over to a surface ───────────────────────────────────
 
 /** How long to hold a leased run waiting for somebody to be watching it. */
@@ -652,12 +824,13 @@ export async function executeEvalRun(
     return { ok, reason: result.ok ? "reported" : "report_failed" };
   };
 
-  let scratch = "";
+  let home = "";
   let laid;
   let python;
   try {
-    scratch = mkdtempSync(path.join(os.tmpdir(), "preman-eval-"));
-    laid = materialize(job, scratch);
+    home = suiteHome(job);
+    pruneRuns(home, job);
+    laid = materialize(job, home);
     python = resolveInterpreter({ projectPath, log });
     log(`eval ${job.id}: assert-ai ${python.version} via ${python.how}`);
   } catch (error) {
@@ -665,12 +838,12 @@ export async function executeEvalRun(
     // amount of retrying changes it. Failing with the reason is more use than
     // letting the lease lapse and having the server call it a lost device.
     log(`eval ${job.id} cannot run here: ${error.message}`);
-    if (scratch) rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return finish(false, { error: error.message });
   }
 
   if (!existsSync(HARNESS_PATH)) {
-    rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return finish(false, { error: `the eval harness is missing from this install (${HARNESS_PATH})` });
   }
 
@@ -680,13 +853,13 @@ export async function executeEvalRun(
     // which reports it from inside `inference` as an authentication error
     // against a model name -- true, and no use to somebody who simply has not
     // saved a key anywhere.
-    rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return finish(false, { error: missingKey });
   }
 
   const handoff = await awaitAudience(job, { call, log, lease, headless, surface });
   if (handoff.lost) {
-    rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return { ok: false, reason: "lease_lost" };
   }
 
@@ -774,8 +947,8 @@ export async function executeEvalRun(
   clearInterval(heartbeat);
   clearTimeout(killer);
 
-  // Deliberately before the scratch directory is removed: the summary is read
-  // off the disk the run just wrote to.
+  // Deliberately before the bundle is removed: the summary is read off the
+  // disk the run just wrote to.
   const summary = readJson(path.join(runDir(laid.cwd, job), "metrics.json")) || {};
   const artifacts = runDir(laid.cwd, job);
 
@@ -783,7 +956,7 @@ export async function executeEvalRun(
     // No completion callback and no final sync. The run belongs to something
     // else now, and this device reporting a result for it — or writing over its
     // artifacts — is the exact thing the fencing token exists to prevent.
-    rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return { ok: false, reason: "lease_lost" };
   }
 
@@ -794,7 +967,7 @@ export async function executeEvalRun(
   // whose results are already readable.
   const final = await syncArtifacts(job, laid.cwd, sent, { call, log, lease });
   if (final.lost) {
-    rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return { ok: false, reason: "lease_lost" };
   }
 
@@ -818,12 +991,21 @@ export async function executeEvalRun(
           `measured against it. The last reason was: ${stats.lastFailure || "unknown"}`,
         exitCode,
       });
-      rmSync(scratch, { recursive: true, force: true });
+      tidy(home);
+      return { ...outcome, summary, artifacts };
+    }
+
+    // The same shape of failure one layer in: the agent was reached, it acted,
+    // and the record of it acting did not survive the trip to the judge.
+    const blind = missingToolEvidence(artifacts, stats);
+    if (blind) {
+      const outcome = await finish(false, { summary, error: blind, exitCode });
+      tidy(home);
       return { ...outcome, summary, artifacts };
     }
 
     const outcome = await finish(true, { summary, exitCode });
-    rmSync(scratch, { recursive: true, force: true });
+    tidy(home);
     return { ...outcome, summary, artifacts };
   }
 
@@ -833,7 +1015,7 @@ export async function executeEvalRun(
     error: `the eval harness exited ${exitCode}: ${tail}`,
     exitCode,
   });
-  rmSync(scratch, { recursive: true, force: true });
+  tidy(home);
   return { ...outcome, summary, artifacts };
 }
 

package/bin/eval_target.js

@@ -293,7 +293,7 @@ function readBody(request) {
 /**
  * One turn against PreMan's own agent.
  *
- * Tool calls come back in `turn.artifacts` and are forwarded as adapter-shaped
+ * Tool calls come back in `turn.tool_calls` and are forwarded as adapter-shaped
  * `events`, which is the difference between the judge seeing a transcript and
  * the judge seeing what the agent *did*. `HTTPEndpointSession` promotes those to
  * first-class interaction messages; without them a tool-using agent is scored on
@@ -443,32 +443,78 @@ async function premanTurn(target, args, { message, history }, state) {
     .digest("hex");
   state.conversations.set(nextKey, conversationId);
 
-  return { response: reply, events: eventsFrom(turn) };
+  // Counted here rather than derived from the artifacts later, because these
+  // two numbers answer different questions: this is what the agent did, and
+  // what the transcript holds is what the judge got to see. A run where they
+  // disagree is the failure this counter exists to make visible.
+  //
+  // Counting the events rather than `turn.tool_calls` keeps it a count of what
+  // was forwarded: a call this adapter dropped is not one the transcript is
+  // missing. `tool_result` is one call, per `eventsFrom`.
+  const events = eventsFrom(turn);
+  state.toolCalls += events.filter((event) => event.role === "tool_result").length;
+
+  return { response: reply, events };
 }
 
 /**
- * PreMan's `turn.artifacts` as the events assert-ai understands.
+ * What the turn did, as the events assert-ai understands.
  *
- * Best-effort and deliberately lossy: only artifacts that clearly describe a
- * tool invocation become events. Forwarding everything would put rendered
- * markdown and UI intents in front of the judge as though they were actions the
- * agent took, and a judge scoring "did it do something it should not have" would
- * be reading the wrong evidence.
+ * Read from `turn.tool_calls`, which the backend records by name. It used to
+ * be inferred from `turn.artifacts` and that never worked: artifacts are keyed
+ * by the UI card they render rather than by the tool that produced them, no
+ * artifact anywhere carried a tool name, and the loop that looked for one
+ * returned an empty array on every turn ever scored. A judge asked whether the
+ * agent checked before answering was reading a transcript in which checking
+ * was invisible.
+ *
+ * The field names are assert-ai's `AdapterEvent`, and they are the whole
+ * difference between an event and nothing. Its normalizer keys on `role` and
+ * skips any event whose role is not one of its three, without logging -- so a
+ * plausible-looking `{type, name, arguments}` is dropped silently and produces
+ * exactly the same transcript as an agent that called nothing. Every run of
+ * `unchecked_account_claim` before this was scored against one: 24 cases, zero
+ * tool calls recorded, while the agent was answering with live figures that
+ * matched the workspace.
+ *
+ * One `tool_result` per call, and deliberately no `tool_call` event alongside
+ * it. `tool_result` is the one that becomes a tool call in the artifacts: a
+ * `tool_call` event is an assistant message carrying `tool_calls`, which the
+ * inference stage only remembers, while the `ToolCallEdit` that
+ * `edit.type == "tool_call"` refers to -- what the judge and the optimizer both
+ * count -- is written when the tool *message* arrives. Sending both records the
+ * same single call and adds an assistant message with empty content for each
+ * one, because the endpoint session attaches a `raw` to every event and the
+ * stage keeps any message that has one. Blank assistant turns are the last
+ * thing to show a judge deciding whether the agent answered from a lookup.
+ *
+ * Whether the tool ran travels in the result's text, in the taxonomy's own
+ * words, because text is what survives: of everything an event can carry, only
+ * `content`, `tool_name`, `tool_args` and `tool_call_id` reach the artifacts. A
+ * risky tool is not run — the broker records a proposal and waits for a person —
+ * and a judge that read the request as the deed would score a deletion that
+ * never occurred. What the tool returned is not carried at all: the backend's
+ * record is name, arguments and executed, which is what "did it look this up
+ * before answering" needs and no more.
  */
-function eventsFrom(turn) {
-  const artifacts = Array.isArray(turn.artifacts) ? turn.artifacts : [];
+export function eventsFrom(turn) {
+  const calls = Array.isArray(turn.tool_calls) ? turn.tool_calls : [];
   const events = [];
-  for (const artifact of artifacts) {
-    const name = artifact?.tool || artifact?.name || artifact?.tool_name;
+  for (const call of calls) {
+    const name = String(call?.name || "");
     if (!name) continue;
-    events.push({ type: "tool_call", name: String(name), arguments: artifact.arguments ?? artifact.input ?? {} });
-    if (artifact.result !== undefined || artifact.output !== undefined) {
-      events.push({
-        type: "tool_result",
-        name: String(name),
-        result: artifact.result ?? artifact.output,
-      });
-    }
+    const args = call.arguments;
+    events.push({
+      role: "tool_result",
+      content:
+        call.executed === false
+          ? `executed: false — ${name} is a risky action held for the user's approval. It ` +
+            `did not run and returned no data.`
+          : `executed: true — ${name} ran and returned its result to the agent. The result ` +
+            `itself is not carried into this transcript.`,
+      tool_name: name,
+      tool_args: args && typeof args === "object" && !Array.isArray(args) ? args : {},
+    });
   }
   return events;
 }
@@ -504,6 +550,7 @@ export async function startAdapter(target, args, { log = () => {}, onStep = null
     failures: 0,
     lastFailure: "",
     streamFailures: 0,
+    toolCalls: 0,
     log,
     /**
      * One thing the agent said it was doing, on its way to the dashboard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "premanmcp",
-  "version": "1.1.3",
+  "version": "1.1.5",
   "description": "PreMan CLI and stdio proxy for PreMan's hosted MCP server",
   "type": "module",
   "bin": {

package/dist/auth_flow_ui.d.ts

@@ -1,38 +0,0 @@
-/**
- * Auth flow endpoints (signup, verify OTP, login, resend OTP) with JSON schemas
- * for share_endpoints_with_ui / agent-sessions push.
- */
-export type AuthFlowEndpoint = {
-    method: string;
-    path_template: string;
-    description: string;
-    tags: string[];
-    source_file: string;
-    request_body_schema: Record<string, unknown>;
-    response_schema: Record<string, unknown>;
-    mcp_tool?: string;
-};
-/** Core auth endpoints aligned with routes/auth/routes.py and user_auth_* MCP tools. */
-export declare function buildAuthFlowEndpoints(): AuthFlowEndpoint[];
-export type ShareAuthFlowResult = {
-    session_id: string;
-    url: string;
-    endpoint_count: number;
-    user_id: number | null;
-    auto_discoverable: boolean;
-    upstream_base_url: string;
-    endpoints: AuthFlowEndpoint[];
-    ui: {
-        url: string;
-        note: string;
-    };
-    related_tools: string[];
-};
-export declare function shareAuthFlowToUi(opts: {
-    backendUrl: string;
-    frontendUrl: string;
-    upstreamBaseUrl?: string;
-    sessionId?: string;
-    intent?: string;
-    apiKey?: string;
-}): Promise<ShareAuthFlowResult>;

package/dist/auth_flow_ui.js

@@ -1,170 +0,0 @@
-/**
- * Auth flow endpoints (signup, verify OTP, login, resend OTP) with JSON schemas
- * for share_endpoints_with_ui / agent-sessions push.
- */
-const EMAIL_PROP = { type: "string", format: "email", description: "User email" };
-const PASSWORD_PROP = {
-    type: "string",
-    minLength: 6,
-    description: "Password (min 6 characters on the server)",
-};
-const OTP_PROP = { type: "string", description: "6-digit code from email" };
-const TOKEN_RESPONSE = {
-    type: "object",
-    properties: {
-        access_token: { type: "string", description: "JWT bearer token" },
-        token_type: { type: "string", enum: ["bearer"] },
-        user: {
-            type: "object",
-            properties: {
-                id: { type: "string" },
-                email: { type: "string", format: "email" },
-            },
-            required: ["id", "email"],
-        },
-    },
-    required: ["access_token", "token_type", "user"],
-};
-const OTP_SENT_RESPONSE = {
-    type: "object",
-    properties: {
-        message: { type: "string" },
-        email_sent: { type: "boolean" },
-    },
-    required: ["message", "email_sent"],
-};
-/** Core auth endpoints aligned with routes/auth/routes.py and user_auth_* MCP tools. */
-export function buildAuthFlowEndpoints() {
-    return [
-        {
-            method: "POST",
-            path_template: "/auth/signup",
-            description: "Register with email and password. Sends OTP to email; next: verify-otp.",
-            tags: ["auth", "signup"],
-            source_file: "routes/auth/routes.py",
-            mcp_tool: "user_auth_signup",
-            request_body_schema: {
-                type: "object",
-                properties: { email: EMAIL_PROP, password: PASSWORD_PROP },
-                required: ["email", "password"],
-                additionalProperties: false,
-            },
-            response_schema: {
-                type: "object",
-                properties: {
-                    message: { type: "string" },
-                    user_id: { type: "string" },
-                    email: { type: "string", format: "email" },
-                    email_sent: { type: "boolean" },
-                },
-                required: ["message", "user_id", "email", "email_sent"],
-            },
-        },
-        {
-            method: "POST",
-            path_template: "/auth/verify-otp",
-            description: "Verify email OTP after signup; returns JWT access_token.",
-            tags: ["auth", "otp"],
-            source_file: "routes/auth/routes.py",
-            mcp_tool: "user_auth_verify_otp",
-            request_body_schema: {
-                type: "object",
-                properties: { email: EMAIL_PROP, otp: OTP_PROP },
-                required: ["email", "otp"],
-                additionalProperties: false,
-            },
-            response_schema: TOKEN_RESPONSE,
-        },
-        {
-            method: "POST",
-            path_template: "/auth/login",
-            description: "Login with email and password. Returns access_token if email is verified.",
-            tags: ["auth", "login"],
-            source_file: "routes/auth/routes.py",
-            mcp_tool: "user_auth_login",
-            request_body_schema: {
-                type: "object",
-                properties: { email: EMAIL_PROP, password: PASSWORD_PROP },
-                required: ["email", "password"],
-                additionalProperties: false,
-            },
-            response_schema: TOKEN_RESPONSE,
-        },
-        {
-            method: "POST",
-            path_template: "/auth/resend-otp",
-            description: "Send (resend) verification OTP to email.",
-            tags: ["auth", "otp"],
-            source_file: "routes/auth/routes.py",
-            mcp_tool: "user_auth_resend_otp",
-            request_body_schema: {
-                type: "object",
-                properties: { email: EMAIL_PROP },
-                required: ["email"],
-                additionalProperties: false,
-            },
-            response_schema: OTP_SENT_RESPONSE,
-        },
-    ];
-}
-export async function shareAuthFlowToUi(opts) {
-    const backend = opts.backendUrl.replace(/\/+$/, "");
-    const frontend = opts.frontendUrl.replace(/\/+$/, "");
-    const apiKey = opts.apiKey?.trim();
-    if (!apiKey) {
-        throw new Error("PreMan authentication required. Run preman_login first so auth-flow sessions can stream to your dashboard.");
-    }
-    const upstream = (opts.upstreamBaseUrl || backend).replace(/\/+$/, "") || backend;
-    const sessionId = opts.sessionId?.trim() || crypto.randomUUID();
-    const endpoints = buildAuthFlowEndpoints().map((ep) => ({
-        ...ep,
-        base_url: upstream,
-    }));
-    const resp = await fetch(`${backend}/agent-sessions/${encodeURIComponent(sessionId)}/endpoints`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Accept: "application/json",
-            Authorization: `Bearer ${apiKey}`,
-        },
-        body: JSON.stringify({
-            endpoints,
-            upstream_base_url: upstream,
-            intent: opts.intent || "Auth flow: signup, verify OTP, login, resend OTP",
-            client_label: "premanmcp",
-        }),
-    });
-    const text = await resp.text();
-    let body = {};
-    try {
-        body = text ? JSON.parse(text) : {};
-    }
-    catch {
-        throw new Error(`Agent session push failed: ${resp.status} ${text.slice(0, 500)}`);
-    }
-    if (!resp.ok) {
-        throw new Error(String(body.detail ?? body.error ?? `Agent session push failed: ${resp.status}`));
-    }
-    const sid = String(body.id ?? sessionId);
-    const url = `${frontend}/try?session=${encodeURIComponent(sid)}`;
-    return {
-        session_id: sid,
-        url,
-        endpoint_count: Number(body.endpoint_count ?? endpoints.length),
-        user_id: typeof body.user_id === "number" ? body.user_id : null,
-        auto_discoverable: Boolean(body.auto_discoverable),
-        upstream_base_url: upstream,
-        endpoints: buildAuthFlowEndpoints(),
-        ui: {
-            url,
-            note: "Open in Cursor Agent Browser or the Playground session list. Test signup → verify-otp → login, or resend-otp. " +
-                "Schemas are prefilled from routes/auth Pydantic models.",
-        },
-        related_tools: [
-            "user_auth_signup",
-            "user_auth_verify_otp",
-            "user_auth_login",
-            "user_auth_resend_otp",
-        ],
-    };
-}

package/dist/mcp-preview-panel.d.ts

@@ -1,30 +0,0 @@
-export declare const MCP_PREVIEW_RESOURCE_URI = "ui://preman/mcp-preview";
-export declare const RESOURCE_URI_META_KEY = "ui/resourceUri";
-export declare function escapeHtmlAttr(s: string): string;
-export declare function escapeHtmlText(s: string): string;
-export interface PreviewTool {
-    name?: string;
-    description?: string;
-    inputSchema?: unknown;
-    _endpoint_ref?: {
-        method?: string;
-        path_template?: string;
-        tags?: string[];
-        source?: string;
-    };
-}
-export interface PreviewPayload {
-    intent?: string | string[];
-    selection_method?: string | string[];
-    rationale?: string | string[] | Record<string, string>;
-    selected_count?: number;
-    spec_preview?: {
-        upstream_base_url?: string | string[];
-        tools?: PreviewTool[];
-    };
-}
-export declare function buildConversionPanelHtml(data: PreviewPayload): string;
-export declare function writeMcpPreviewFile(panelHtml: string): Promise<{
-    absolutePath: string;
-    fileUrl: string;
-}>;

package/dist/mcp-preview-panel.js

@@ -1,166 +0,0 @@
-/**
- * Two-pane HTML for mcp_preview — shared by the MCP stdio server and
- * scripts/emit-mcp-preview.mjs (browser tab fallback when Cursor does not render mcp-app).
- */
-import fs from "node:fs/promises";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-export const MCP_PREVIEW_RESOURCE_URI = "ui://preman/mcp-preview";
-export const RESOURCE_URI_META_KEY = "ui/resourceUri";
-export function escapeHtmlAttr(s) {
-    return s.replace(/&/g, "&").replace(/"/g, """);
-}
-export function escapeHtmlText(s) {
-    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-export function buildConversionPanelHtml(data) {
-    const toStr = (v) => {
-        if (v == null)
-            return "";
-        if (Array.isArray(v))
-            return v.filter((x) => x != null).map((x) => String(x)).join("; ");
-        if (typeof v === "object") {
-            try {
-                return Object.entries(v)
-                    .map(([k, val]) => `${k}: ${val == null ? "" : String(val)}`)
-                    .join(" · ");
-            }
-            catch {
-                try {
-                    return JSON.stringify(v);
-                }
-                catch {
-                    return String(v);
-                }
-            }
-        }
-        return String(v);
-    };
-    const intent = toStr(data.intent).trim() || "(unspecified)";
-    const method = toStr(data.selection_method).trim() || "unknown";
-    const rationale = toStr(data.rationale).trim();
-    const upstream = toStr(data.spec_preview?.upstream_base_url).trim();
-    const tools = Array.isArray(data.spec_preview?.tools) ? data.spec_preview.tools : [];
-    const selectedCount = typeof data.selected_count === "number" ? data.selected_count : tools.length;
-    const linkKey = (m, p) => `${(m || "").toUpperCase()} ${p || ""}`.trim();
-    const endpointRows = tools
-        .map((t) => {
-        const ref = t._endpoint_ref ?? {};
-        const m = (ref.method ?? "").toUpperCase();
-        const p = ref.path_template ?? "";
-        const key = linkKey(m, p);
-        const tags = Array.isArray(ref.tags) && ref.tags.length > 0 ? ref.tags.join(", ") : "";
-        return `
-        <div class="row" data-link="${escapeHtmlAttr(key)}">
-          <div class="row-head">
-            <span class="method ${escapeHtmlAttr(m)}">${escapeHtmlText(m)}</span>
-            <span class="path">${escapeHtmlText(p)}</span>
-          </div>
-          ${tags ? `<div class="row-meta">tags: ${escapeHtmlText(tags)}</div>` : ""}
-        </div>`;
-    })
-        .join("");
-    const toolRows = tools
-        .map((t) => {
-        const ref = t._endpoint_ref ?? {};
-        const key = linkKey(ref.method, ref.path_template);
-        const schemaJson = (() => {
-            try {
-                return JSON.stringify(t.inputSchema ?? {}, null, 2);
-            }
-            catch {
-                return "{}";
-            }
-        })();
-        return `
-        <div class="row" data-link="${escapeHtmlAttr(key)}">
-          <div class="tool-name">${escapeHtmlText(t.name ?? "(unnamed)")}</div>
-          ${t.description ? `<div class="tool-desc">${escapeHtmlText(t.description)}</div>` : ""}
-          <pre class="tool-schema">${escapeHtmlText(schemaJson)}</pre>
-        </div>`;
-    })
-        .join("");
-    const empty = tools.length === 0
-        ? `<div class="empty">No matching endpoints. Try a different intent or run <code>verify_endpoints_live</code> first.</div>`
-        : "";
-    return `<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="UTF-8" />
-<meta name="viewport" content="width=device-width, initial-scale=1.0" />
-<title>PreMan · MCP Preview</title>
-<style>
-  :root { color-scheme: light dark; --bg:#0d1117; --bg2:#161b22; --border:#30363d; --fg:#e6edf3; --muted:#8b949e; --accent:#58a6ff; --green:#2ea043; --orange:#bf8700; --red:#cf222e; --purple:#8957e5; }
-  * { margin:0; padding:0; box-sizing:border-box; }
-  html, body { height:100%; background:var(--bg); color:var(--fg); font-family:-apple-system,BlinkMacSystemFont,sans-serif; font-size:13px; }
-  body { display:flex; flex-direction:column; overflow:hidden; }
-  header { padding:10px 14px; border-bottom:1px solid var(--border); background:var(--bg2); flex-shrink:0; }
-  header h1 { font-size:13px; font-weight:600; color:var(--accent); }
-  header .meta { font-size:11px; color:var(--muted); margin-top:3px; }
-  header .meta strong { color:var(--fg); font-weight:600; }
-  header .rationale { font-size:11px; color:var(--muted); margin-top:5px; font-style:italic; max-width:900px; }
-  .columns { flex:1; display:grid; grid-template-columns:1fr 1fr; gap:1px; background:var(--border); overflow:hidden; min-height:0; }
-  .col { background:var(--bg); overflow-y:auto; }
-  .col-header { padding:7px 12px; font-size:10px; font-weight:700; letter-spacing:0.06em; text-transform:uppercase; color:var(--muted); border-bottom:1px solid var(--border); position:sticky; top:0; background:var(--bg2); z-index:1; }
-  .row { padding:9px 12px; border-bottom:1px solid var(--border); transition:background 0.1s; }
-  .row:last-child { border-bottom:none; }
-  .row:hover, .row.linked { background:rgba(88,166,255,0.08); }
-  .row-head { display:flex; align-items:center; gap:8px; }
-  .row-meta { font-size:10px; color:var(--muted); margin-top:3px; padding-left:56px; }
-  .method { display:inline-block; min-width:48px; text-align:center; padding:2px 6px; border-radius:3px; font-weight:700; font-size:10px; color:white; font-family:SFMono-Regular,Consolas,monospace; }
-  .method.GET{background:var(--accent);} .method.POST{background:var(--green);} .method.PATCH{background:var(--orange);} .method.PUT{background:var(--purple);} .method.DELETE{background:var(--red);}
-  .path { font-family:SFMono-Regular,Consolas,monospace; font-size:12px; word-break:break-all; }
-  .tool-name { font-family:SFMono-Regular,Consolas,monospace; font-size:12px; font-weight:600; color:var(--accent); }
-  .tool-desc { font-size:11px; color:var(--muted); margin-top:3px; line-height:1.4; }
-  .tool-schema { font-family:SFMono-Regular,Consolas,monospace; font-size:10px; background:var(--bg2); padding:6px 8px; border-radius:3px; margin-top:6px; white-space:pre-wrap; word-break:break-all; max-height:120px; overflow-y:auto; line-height:1.4; color:var(--muted); }
-  .empty { padding:24px; text-align:center; color:var(--muted); font-style:italic; }
-  .empty code { font-family:SFMono-Regular,Consolas,monospace; color:var(--accent); background:var(--bg2); padding:1px 5px; border-radius:3px; font-style:normal; }
-  footer { padding:8px 14px; border-top:1px solid var(--border); background:var(--bg2); display:flex; gap:10px; align-items:center; flex-shrink:0; font-size:11px; color:var(--muted); }
-  footer .upstream { font-family:SFMono-Regular,Consolas,monospace; color:var(--accent); }
-  footer .deploy-hint { margin-left:auto; }
-  footer .deploy-hint code { font-family:SFMono-Regular,Consolas,monospace; color:var(--fg); background:var(--bg); padding:2px 6px; border-radius:3px; }
-</style>
-</head>
-<body>
-  <header>
-    <h1>API → MCP Conversion preview</h1>
-    <div class="meta">
-      Intent: <strong>${escapeHtmlText(intent)}</strong> · Selected <strong>${selectedCount}</strong> endpoint${selectedCount === 1 ? "" : "s"} · Method: ${escapeHtmlText(method)}
-    </div>
-    ${rationale ? `<div class="rationale">${escapeHtmlText(rationale)}</div>` : ""}
-  </header>
-  <main class="columns">
-    <div class="col">
-      <div class="col-header">Your API endpoints (${tools.length})</div>
-      ${endpointRows}${tools.length === 0 ? empty : ""}
-    </div>
-    <div class="col">
-      <div class="col-header">Generated MCP tools (${tools.length})</div>
-      ${toolRows}${tools.length === 0 ? empty : ""}
-    </div>
-  </main>
-  <footer>
-    <span>Upstream: <span class="upstream">${escapeHtmlText(upstream || "(not set)")}</span></span>
-    <span class="deploy-hint">Next: ask the agent to call <code>mcp_deploy</code></span>
-  </footer>
-  <script>
-    document.querySelectorAll('.row[data-link]').forEach(row => {
-      const key = row.getAttribute('data-link');
-      if (!key) return;
-      const matches = () => document.querySelectorAll('[data-link="' + CSS.escape(key) + '"]');
-      row.addEventListener('mouseenter', () => matches().forEach(r => r.classList.add('linked')));
-      row.addEventListener('mouseleave', () => matches().forEach(r => r.classList.remove('linked')));
-    });
-  </script>
-</body>
-</html>`;
-}
-export async function writeMcpPreviewFile(panelHtml) {
-    const outPath = path.join(process.cwd(), "preman-mcp", "mcp-preview-last.html");
-    await fs.mkdir(path.dirname(outPath), { recursive: true });
-    await fs.writeFile(outPath, panelHtml, "utf8");
-    return {
-        absolutePath: outPath,
-        fileUrl: pathToFileURL(outPath).href,
-    };
-}

package/dist/user_auth_flow.d.ts

@@ -1,11 +0,0 @@
-/**
- * App user auth (JWT) — tools that call the FastAPI backend at PREMAN_BACKEND /auth/*.
- * Separate from preman_login (device flow + pm_live_ API key). No API key is required
- * for these tools; for JWT-protected routes, pass the access_token from login/verify.
- */
-import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-/**
- * Register MCP tools for routes/auth (email, OTP, password, JWT).
- * Proxies to the same process as preman-local (PREMAN_BACKEND, e.g. http://127.0.0.1:8000).
- */
-export declare function registerUserAuthFlowTools(server: McpServer, backendUrl: string): void;

package/dist/user_auth_flow.js

@@ -1,279 +0,0 @@
-import { z } from "zod";
-function toolError(message, code = "backend_error", hints) {
-    const payload = { error: message, error_code: code };
-    if (hints)
-        payload._agent_hints = hints;
-    return {
-        content: [{ type: "text", text: JSON.stringify(payload) }],
-        isError: true,
-    };
-}
-function jsonOk(obj) {
-    return { content: [{ type: "text", text: JSON.stringify(obj) }] };
-}
-function normalizeBase(backendUrl) {
-    return backendUrl.replace(/\/+$/, "");
-}
-async function callAuthJson(base, method, path, opts) {
-    const url = new URL(path.startsWith("/") ? path.slice(1) : path, `${base}/`);
-    if (opts?.query) {
-        for (const [k, v] of Object.entries(opts.query)) {
-            if (v != null && v !== "")
-                url.searchParams.set(k, v);
-        }
-    }
-    const headers = { Accept: "application/json" };
-    const hasBody = opts?.json != null && (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE");
-    if (hasBody) {
-        headers["Content-Type"] = "application/json";
-    }
-    if (opts?.token) {
-        headers.Authorization = `Bearer ${opts.token.trim()}`;
-    }
-    const init = { method, headers };
-    if (hasBody && opts?.json) {
-        init.body = JSON.stringify(opts.json);
-    }
-    const resp = await fetch(url, init);
-    const text = await resp.text();
-    let parsed;
-    try {
-        parsed = text ? JSON.parse(text) : {};
-    }
-    catch {
-        parsed = { raw: text };
-    }
-    const body = typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
-        ? parsed
-        : { value: parsed };
-    return {
-        status_code: resp.status,
-        ok: resp.ok,
-        ...body,
-    };
-}
-/**
- * Register MCP tools for routes/auth (email, OTP, password, JWT).
- * Proxies to the same process as preman-local (PREMAN_BACKEND, e.g. http://127.0.0.1:8000).
- */
-export function registerUserAuthFlowTools(server, backendUrl) {
-    const base = normalizeBase(backendUrl);
-    server.tool("user_auth_start_signup", "Start signup with email only. Sends an OTP; next call user_auth_set_password with email, OTP, and new password. Uses POST /auth/start-signup on PREMAN_BACKEND (no API key). If the backend does not support this endpoint yet, use user_auth_signup instead.", {
-        email: z.string().describe("User email"),
-    }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/start-signup", {
-                json: { email: args.email },
-            });
-            if (!r.ok) {
-                if (r.status_code === 404) {
-                    return toolError("This backend does not support email-only signup yet. Use user_auth_signup with email and password, then user_auth_verify_otp.", "backend_error", {
-                        next_actions: ["Call user_auth_signup with email and password.", "Then call user_auth_verify_otp with the email code."],
-                        related_tools: ["user_auth_signup", "user_auth_verify_otp"],
-                    });
-                }
-                return toolError(String(r.detail ?? r.message ?? "start signup failed"), r.status_code === 400 ? "invalid_input" : "backend_error", {
-                    next_actions: ["If email exists, use user_auth_login or user_auth_resend_otp."],
-                    related_tools: ["user_auth_set_password", "user_auth_login"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            const m = e instanceof Error ? e.message : String(e);
-            return toolError(m, "backend_error", {
-                next_actions: ["Ensure PREMAN_BACKEND is running and JWT_SECRET is set on the server."],
-            });
-        }
-    });
-    server.tool("user_auth_signup", "Register with email and password. Sends an OTP; next call user_auth_verify_otp. Uses POST /auth/signup on PREMAN_BACKEND (no API key).", {
-        email: z.string().describe("User email"),
-        password: z.string().describe("Password (min 6 characters on the server)"),
-    }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/signup", {
-                json: { email: args.email, password: args.password },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? r.message ?? "signup failed"), r.status_code === 400 ? "invalid_input" : "backend_error", {
-                    next_actions: ["If email exists, use user_auth_login or user_auth_resend_otp."],
-                    related_tools: ["user_auth_verify_otp", "user_auth_login"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            const m = e instanceof Error ? e.message : String(e);
-            return toolError(m, "backend_error", {
-                next_actions: ["Ensure PREMAN_BACKEND is running and JWT_SECRET is set on the server."],
-            });
-        }
-    });
-    server.tool("user_auth_verify_otp", "Verify the email OTP and receive access_token (JWT). POST /auth/verify-otp.", { email: z.string(), otp: z.string().describe("6-digit code from email") }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/verify-otp", {
-                json: { email: args.email, otp: args.otp },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "verify failed"), "auth_required", {
-                    next_actions: ["Request a new code with user_auth_resend_otp if expired."],
-                    related_tools: ["user_auth_resend_otp", "user_auth_signup"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_login", "Login with email and password. Returns access_token if email is verified. POST /auth/login.", { email: z.string(), password: z.string() }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/login", {
-                json: { email: args.email, password: args.password },
-            });
-            if (!r.ok) {
-                const sc = r.status_code;
-                const code = sc === 403 || sc === 401 ? "auth_required" : "backend_error";
-                return toolError(String(r.detail ?? "login failed"), code, {
-                    next_actions: [
-                        "If 403 email not verified: use user_auth_verify_otp or user_auth_resend_otp.",
-                        "If 403 migrated account: use user_auth_forgot_password or user_auth_set_password flow.",
-                    ],
-                    related_tools: ["user_auth_verify_otp", "user_auth_needs_password", "user_auth_set_password"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_needs_password", "Check if an account must set a password (e.g. migrated user). GET /auth/needs-password?email=", { email: z.string().optional().describe("Email to check; omit to return false/false from server") }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "GET", "/auth/needs-password", {
-                query: { email: args.email },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "request failed"), "backend_error");
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_resend_otp", "Resend verification OTP. POST /auth/resend-otp with { email }.", { email: z.string() }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/resend-otp", {
-                json: { email: args.email },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "resend failed"), "invalid_input");
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_forgot_password", "Request password reset OTP. POST /auth/forgot-password with { email }.", { email: z.string() }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/forgot-password", {
-                json: { email: args.email },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "forgot failed"), "backend_error");
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_set_password", "Set a new password using OTP (migrated / forgot flow). Returns access_token. POST /auth/set-password.", {
-        email: z.string(),
-        otp: z.string(),
-        new_password: z.string().min(6),
-    }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/set-password", {
-                json: {
-                    email: args.email,
-                    otp: args.otp,
-                    new_password: args.new_password,
-                },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "set password failed"), "auth_required", {
-                    next_actions: ["Request a new OTP with user_auth_forgot_password or user_auth_resend_otp."],
-                    related_tools: ["user_auth_forgot_password"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_me", "Current user profile (JWT). GET /auth/me with Authorization: Bearer access_token from login/verify.", {
-        access_token: z.string().describe("JWT from user_auth_login or user_auth_verify_otp"),
-    }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "GET", "/auth/me", {
-                token: args.access_token,
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "unauthorized"), "auth_required", {
-                    next_actions: ["Call user_auth_login to obtain a fresh access_token."],
-                    related_tools: ["user_auth_login"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_change_password", "Change password for the signed-in user. POST /auth/change-password with JWT.", {
-        access_token: z.string(),
-        current_password: z.string(),
-        new_password: z.string().min(6),
-    }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "POST", "/auth/change-password", {
-                token: args.access_token,
-                json: {
-                    current_password: args.current_password,
-                    new_password: args.new_password,
-                },
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "change password failed"), r.status_code === 401 ? "auth_required" : "invalid_input", {
-                    related_tools: ["user_auth_login", "user_auth_me"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-    server.tool("user_auth_delete_account", "Delete the current account. DELETE /auth/me with JWT. Irreversible.", {
-        access_token: z.string().describe("JWT from user_auth_login or user_auth_verify_otp"),
-    }, async (args) => {
-        try {
-            const r = await callAuthJson(base, "DELETE", "/auth/me", {
-                token: args.access_token,
-            });
-            if (!r.ok) {
-                return toolError(String(r.detail ?? "delete failed"), "auth_required", {
-                    related_tools: ["user_auth_login"],
-                });
-            }
-            return jsonOk(r);
-        }
-        catch (e) {
-            return toolError(e instanceof Error ? e.message : String(e), "backend_error");
-        }
-    });
-}