@decocms/mesh 2.135.1 → 2.136.1

package/dist/server/migrate.js

@@ -1296,7 +1296,7 @@ Hint: Configure a valid Google account email in Monitor Configuration > Contexto
 
 `).trim(),B=$.length>0?`Not executed tools (${$.length}/${Y.tools.length}): ${$.join(", ")}`:"",U=[V,B].filter((z)=>z.length>0).join(`
 
-`);return{toolResults:H,agentSummary:U.length>0?U:null,unexecutedTools:$}}finally{await Q.close?.().catch(()=>{})}}async function YH1(Y,Q){let X=t0(),J=Y.organization.id,G=await X.monitorConnections.findByItemId(J,Q.id);if(G){if(await Y.storage.connections.findById(G.connection_id,J))return G.connection_id}let K=hN4(Q);if(!K)throw Error(`Registry item ${Q.id} has no remote URL`);let W=fN4(Y),Z=bN4(Q),H=await Y.storage.connections.create({organization_id:J,created_by:W,title:`[Monitor] ${Q.title}`,description:`Auto-created monitor connection for ${Q.id}`,app_name:"private-registry-monitor",app_id:`${vZ}:monitor`,connection_type:Z,connection_url:K,metadata:{monitorConnection:!0,registryItemId:Q.id,pluginId:vZ}});return await X.monitorConnections.upsert({organization_id:J,item_id:Q.id,connection_id:H.id,auth_status:"none"}),H.id}async function iN4(Y){let Q=t0();switch(Y.action){case"unlisted":return await Q.items.update(Y.organizationId,Y.item.id,{is_unlisted:!0}),"unlisted";case"remove_public":return await Q.items.update(Y.organizationId,Y.item.id,{is_public:!1}),"removed_public";case"remove_private":case"remove_all":return await Q.items.delete(Y.organizationId,Y.item.id),Y.action==="remove_all"?"removed_all":"removed_private";default:return"none"}}async function aN4(Y){let Q=Date.now();if(Y.signal.aborted)throw Error("Run cancelled");let X="passed",J=!1,G=!1,K=null,W="none",Z=null,H=[],F=null,$=async()=>{await Y.onProgress?.({status:X,connectionOk:J,toolsListed:G,toolResults:[...H],agentSummary:Z,errorMessage:K,actionTaken:W,durationMs:Date.now()-Q})};try{let V=await YH1(Y.ctx,Y.item);F=await Y.ctx.createMCPProxy(V),J=!0;let U=(await DR(F.listTools?F.listTools():Promise.resolve({tools:[]}),Y.monitorConfig.perMcpTimeoutMs,`listTools ${Y.item.id}`)).tools??[];if(G=!0,Y.monitorConfig.monitorMode!=="health_check")H.push(...U.map((z)=>e31(z.name))),await $();if(Y.monitorConfig.monitorMode==="full_agent"){let z=await nN4({ctx:Y.ctx,monitorConfig:Y.monitorConfig,item:Y.item,proxy:F,tools:U,signal:Y.signal,onProgress:async(O)=>{H.length=0,H.push(...LI0({discoveredTools:U,executedResults:O})),X=O.some((M)=>!M.success)?"failed":"passed",await $()}});if(H.length=0,H.push(...LI0({discoveredTools:U,executedResults:z.toolResults})),Z=z.agentSummary,z.toolResults.some((O)=>!O.success))X="failed";if(z.unexecutedTools.length>0){if(X="failed",!K)K=`Agent skipped ${z.unexecutedTools.length} tool(s): ${z.unexecutedTools.join(", ")}`}}else if(Y.monitorConfig.monitorMode!=="health_check"){for(let z=0;z<U.length;z++){let O=U[z];if(!O||Y.signal.aborted)throw Error("Run cancelled");let M=Date.now();try{let w={},P=await DR(F.callTool({name:O.name,arguments:w}),Y.monitorConfig.perToolTimeoutMs,`tool ${O.name}`),S=!P.isError,C=Date.now()-M;NI0(H,{toolName:O.name,success:S,input:w,durationMs:C,outputPreview:TI0(P.structuredContent??P.content),error:S?null:$d(P.content?.find((E)=>E.type==="text")?.text?.slice(0,300)??"Tool returned error")}),await $()}catch(w){let P=Date.now()-M,S=w instanceof Error?w.message:String(w);NI0(H,{toolName:O.name,success:!1,durationMs:P,error:$d(S)}),await $()}}if(H.some((z)=>!z.success))X="failed"}else for(let z of U)H.push(e31(z.name));if(Y.canApplyFailureAction&&X==="failed"&&Y.monitorConfig.onFailure!=="none")W=await iN4({organizationId:Y.organizationId,item:Y.item,action:Y.monitorConfig.onFailure})}catch(V){if(K=V instanceof Error?V.message:String(V),xN4(V))X="needs_auth",await t0().monitorConnections.updateAuthStatus(Y.organizationId,Y.item.id,"needs_auth");else X="error"}finally{await F?.close?.().catch(()=>{})}return{status:X,connectionOk:J,toolsListed:G,toolResults:H,agentSummary:Z,errorMessage:K,actionTaken:W,durationMs:Date.now()-Q}}async function rN4(Y){let Q=Date.now(),X=t0(),G=(await X.items.list(Y.organizationId,{includeUnlisted:!0})).items.filter((B)=>{if(Y.monitorConfig.testPublicOnly&&!B.is_public)return!1;if(Y.monitorConfig.testPrivateOnly&&B.is_public)return!1;return!0}),K=Y.monitorConfig.includePendingRequests?(await X.publishRequests.list(Y.organizationId,{status:"pending",limit:500})).items.map((B)=>oN4(B)):[],W=[...G.map((B)=>({item:B,source:"registry_item"})),...K.map((B)=>({item:B,source:"publish_request"}))];if(W.length===0){await X.monitorRuns.update(Y.organizationId,Y.runId,{total_items:0,status:"completed",started_at:new Date().toISOString(),finished_at:new Date().toISOString()}),await Hd({ctx:Y.ctx,type:"registry.monitor.completed",subject:Y.runId,data:{runId:Y.runId,total:0}});return}await X.monitorRuns.update(Y.organizationId,Y.runId,{total_items:W.length,status:"running",started_at:new Date().toISOString()});let Z=0,H=0,F=0,$=0;for(let B=0;B<W.length;B++){let U=W[B],z=U?.item;if(!z||Y.signal.aborted){await X.monitorRuns.update(Y.organizationId,Y.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()});return}await X.monitorRuns.update(Y.organizationId,Y.runId,{current_item_id:z.id});let O=null,M=async(P)=>{if(!O){O=(await X.monitorResults.create({run_id:Y.runId,organization_id:Y.organizationId,item_id:z.id,item_title:z.title,status:P.status,error_message:P.errorMessage,connection_ok:P.connectionOk,tools_listed:P.toolsListed,tool_results:P.toolResults,agent_summary:P.agentSummary,duration_ms:P.durationMs,action_taken:P.actionTaken})).id;return}await X.monitorResults.update(Y.organizationId,O,{status:P.status,error_message:P.errorMessage,connection_ok:P.connectionOk,tools_listed:P.toolsListed,tool_results:P.toolResults,agent_summary:P.agentSummary,duration_ms:P.durationMs,action_taken:P.actionTaken})},w=await aN4({ctx:Y.ctx,organizationId:Y.organizationId,item:z,monitorConfig:Y.monitorConfig,signal:Y.signal,canApplyFailureAction:U.source==="registry_item",onProgress:M});if(await M({status:w.status,connectionOk:w.connectionOk,toolsListed:w.toolsListed,toolResults:w.toolResults,agentSummary:w.agentSummary,errorMessage:w.errorMessage,actionTaken:w.actionTaken,durationMs:w.durationMs}),Z+=1,w.status==="passed")H+=1;else if(w.status==="failed"||w.status==="error")F+=1;else $+=1;if(await X.monitorRuns.update(Y.organizationId,Y.runId,{tested_items:Z,passed_items:H,failed_items:F,skipped_items:$}),w.status==="failed"||w.status==="error")await Hd({ctx:Y.ctx,type:"registry.monitor.item_failed",subject:z.id,data:{runId:Y.runId,itemId:z.id,itemTitle:z.title,status:w.status,errorMessage:w.errorMessage,actionTaken:w.actionTaken}})}let V=Date.now()-Q;await X.monitorRuns.update(Y.organizationId,Y.runId,{status:"completed",current_item_id:null,finished_at:new Date().toISOString()}),await Hd({ctx:Y.ctx,type:"registry.monitor.completed",subject:Y.runId,data:{runId:Y.runId,total:Z,passed:H,failed:F,skipped:$,durationMs:V}})}function oN4(Y){return{id:`${K$}${Y.id}`,title:Y.title,description:Y.description,_meta:Y._meta,server:Y.server,is_public:!1,is_unlisted:!0,created_at:Y.created_at,updated_at:Y.updated_at}}async function sN4(Y,Q){let X=EI0(Y);await X.access.check();let J=t0(),G=await J.monitorRuns.create({organization_id:X.organization.id,status:"pending",config_snapshot:Q,started_at:null}),K=new AbortController;return Fd.set(G.id,K),rN4({ctx:X,runId:G.id,organizationId:X.organization.id,monitorConfig:Q,signal:K.signal}).catch(async(W)=>{await J.monitorRuns.update(X.organization.id,G.id,{status:"failed",current_item_id:null,finished_at:new Date().toISOString()}).catch(()=>{}),await Hd({ctx:X,type:"registry.monitor.failed",subject:G.id,data:{runId:G.id,error:W instanceof Error?W.message:String(W)}}),yN4(`Run ${G.id} failed with uncaught error:`,W)}).finally(()=>{Fd.delete(G.id)}),{run:{id:G.id}}}var Fd,AI0="[MONITOR-AGENT]",_N4,vN4="health_check: not called",II0;var Vd=j(()=>{DY();XI0();fB();m7();J8();Fd=new Map,_N4=Sw0;II0={name:"REGISTRY_MONITOR_RUN_START",description:"Start an MCP registry monitor run with an isolated set of monitor connections.",inputSchema:KI0,outputSchema:HI0,handler:async(Y,Q)=>{let J=Zd(Y.config??{}),{run:G}=await sN4(Q,J),W=await t0().monitorRuns.findById(EI0(Q).organization.id,G.id);if(!W)throw Error(`Failed to load monitor run ${G.id}`);return{run:W}}}});var jI0;var SI0=j(()=>{m7();J8();jI0={name:"REGISTRY_MONITOR_RUN_LIST",description:"List MCP registry monitor runs",inputSchema:c31,outputSchema:$I0,handler:O6(c31,async(Y,Q)=>{return t0().monitorRuns.list(Q.organization.id,Y)})}});var _I0;var vI0=j(()=>{m7();J8();_I0={name:"REGISTRY_MONITOR_RUN_GET",description:"Get details for one MCP registry monitor run",inputSchema:n31,outputSchema:VI0,handler:O6(n31,async(Y,Q)=>{return{run:await t0().monitorRuns.findById(Q.organization.id,Y.runId)}})}});var kI0;var yI0=j(()=>{m7();Vd();J8();kI0={name:"REGISTRY_MONITOR_RUN_CANCEL",description:"Cancel a running MCP registry monitor run",inputSchema:p31,outputSchema:FI0,handler:O6(p31,async(Y,Q)=>{return PI0(Y.runId),{run:await t0().monitorRuns.update(Q.organization.id,Y.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()})}})}});var fI0;var bI0=j(()=>{m7();J8();fI0={name:"REGISTRY_MONITOR_RESULT_LIST",description:"List results for a given MCP registry monitor run",inputSchema:i31,outputSchema:qI0,handler:O6(i31,async(Y,Q)=>{return t0().monitorResults.listByRun(Q.organization.id,Y.runId,{status:Y.status,limit:Y.limit,offset:Y.offset})})}});var hI0;var xI0=j(()=>{m7();J8();fB();hI0={name:"REGISTRY_MONITOR_CONNECTION_LIST",description:"List monitor connection mappings for private registry MCP monitor runs, including auth status",inputSchema:a31,outputSchema:BI0,handler:O6(a31,async(Y,Q)=>{let X=t0(),J=await X.monitorConnections.list(Q.organization.id);return{items:await Promise.all(J.map(async(K)=>{let W=await X.items.findById(Q.organization.id,K.item_id);if(!W&&K.item_id.startsWith(K$)){let F=K.item_id.slice(K$.length),$=await X.publishRequests.findById(Q.organization.id,F);if($)W={id:K.item_id,title:$.title,description:$.description,_meta:$._meta,server:$.server,is_public:!1,is_unlisted:!0,created_at:$.created_at,updated_at:$.updated_at}}let Z=W?.server.remotes?.find((F)=>F.url)?.url??null,H=K.item_id.startsWith(K$)?"request":"store";return{mapping:K,item:W,remoteUrl:Z,source:H}}))}})}});function tN4(Y){return{id:`${K$}${Y.id}`,title:Y.title,description:Y.description,_meta:Y._meta,server:Y.server,is_public:!1,is_unlisted:!0,created_at:Y.created_at,updated_at:Y.updated_at}}var gI0;var uI0=j(()=>{m7();Vd();J8();fB();gI0={name:"REGISTRY_MONITOR_CONNECTION_SYNC",description:"Ensure every registry item has a dedicated monitor connection mapping for MCP monitors",inputSchema:r31,outputSchema:UI0,handler:O6(r31,async(Y,Q)=>{let X=t0(),J=(await X.items.list(Q.organization.id,{includeUnlisted:!0})).items,K=(await X.publishRequests.list(Q.organization.id,{status:"pending",limit:500})).items.map(tN4),W=[...J,...K],Z=await X.monitorConnections.list(Q.organization.id),H=new Set(Z.map(($)=>$.item_id)),F=0;for(let $ of W){if(!$.server.remotes?.some((V)=>V.url))continue;if(await YH1(Q,$),!H.has($.id))F+=1}return{created:F,updated:Math.max(W.length-F,0)}})}});var mI0;var lI0=j(()=>{m7();J8();mI0={name:"REGISTRY_MONITOR_CONNECTION_UPDATE_AUTH",description:"Update the auth_status of a monitor connection mapping (by core connection ID)",inputSchema:o31,outputSchema:zI0,handler:O6(o31,async({connectionId:Y,authStatus:Q},X)=>{let J=t0(),G=X.organization.id,K=await J.monitorConnections.findByConnectionId(G,Y);if(!K)throw Error(`No monitor connection mapping found for connection ${Y}`);return await J.monitorConnections.updateAuthStatus(G,K.item_id,Q),{success:!0}})}});function OR(Y){if(!Y||typeof Y!=="object")return null;let Q=Y,X=Q.id;if(typeof X==="string"&&X.length>0)return X;for(let J of["event","result","structuredContent","content"]){let G=Q[J],K=OR(G);if(K)return K}if(Array.isArray(Y))for(let J of Y){let G=OR(J);if(G)return G}return null}var dI0;var pI0=j(()=>{DY();m7();J8();dI0={name:"REGISTRY_MONITOR_SCHEDULE_SET",description:"Schedule recurring MCP monitor runs via EVENT_PUBLISH cron",inputSchema:s31,outputSchema:DI0,handler:O6(s31,async(Y,Q)=>{let X=u9.SELF(Q.organization.id),J=await Q.createMCPProxy(X);try{let G=await J.callTool({name:"EVENT_PUBLISH",arguments:{type:"registry.monitor.scheduled",subject:"private-registry",cron:Y.cronExpression,data:{config:Y.config??{}}}});if(G.isError)throw Error("Failed to create monitor schedule via EVENT_PUBLISH");let K=OR(G.structuredContent)??OR(G.content)??OR(G);if(!K)throw Error("Could not resolve schedule event id from EVENT_PUBLISH");return{scheduleEventId:K}}finally{await J.close?.().catch(()=>{})}})}});var cI0;var nI0=j(()=>{DY();m7();J8();cI0={name:"REGISTRY_MONITOR_SCHEDULE_CANCEL",description:"Cancel a recurring MCP monitor schedule via EVENT_CANCEL",inputSchema:t31,outputSchema:OI0,handler:O6(t31,async(Y,Q)=>{let X=u9.SELF(Q.organization.id),J=await Q.createMCPProxy(X);try{if((await J.callTool({name:"EVENT_CANCEL",arguments:{eventId:Y.scheduleEventId}})).isError)throw Error("Failed to cancel monitor schedule via EVENT_CANCEL");return{success:!0}}finally{await J.close?.().catch(()=>{})}})}});function eN4(Y,Q){if(!Q)return Y;let X={field:["is_public"],operator:"eq",value:!1};if(!Y)return X;return{operator:"and",conditions:[Y,X]}}function YM4(Y){let Q=new Map,X=new Map;for(let G of Y){let K=G._meta?.["mcp.mesh"];for(let W of K?.tags??[])Q.set(W,(Q.get(W)??0)+1);for(let W of K?.categories??[])X.set(W,(X.get(W)??0)+1)}let J=(G)=>Array.from(G.entries()).map(([K,W])=>({value:K,count:W})).sort((K,W)=>K.value.localeCompare(W.value));return{tags:J(Q),categories:J(X)}}var iI0,aI0,rI0,oI0;var sI0=j(()=>{k1();v9();J8();iI0={name:"COLLECTION_REGISTRY_APP_LIST",description:"List registry items for Store discovery. Supports private-only mode from plugin settings.",inputSchema:H$,outputSchema:eL,handler:O6(H$,async(Y,Q)=>{let X=t0(),J=await sC(Q,Q.organization.id);return X.items.list(Q.organization.id,{...Y,where:eN4(Y.where,J.storePrivateOnly===!0)})})},aI0={name:"COLLECTION_REGISTRY_APP_GET",description:"Get a registry item for Store details. Respects private-only mode from plugin settings.",inputSchema:mX,outputSchema:uB,handler:O6(mX,async(Y,Q)=>{let X=t0(),J=await sC(Q,Q.organization.id),G=Y.id??Y.name;if(!G)return{item:null};let K=await X.items.findByIdOrName(Q.organization.id,G);if(!K)return{item:null};if(J.storePrivateOnly&&K.is_public)return{item:null};return{item:K}})},rI0={name:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get registry item versions for Store details. Respects private-only mode from plugin settings.",inputSchema:mX,outputSchema:q.object({versions:q.array(cG)}),handler:O6(mX,async(Y,Q)=>{let X=t0(),J=await sC(Q,Q.organization.id),G=Y.id??Y.name;if(!G)return{versions:[]};let K=await X.items.findByIdOrName(Q.organization.id,G);if(!K)return{versions:[]};if(J.storePrivateOnly&&K.is_public)return{versions:[]};return{versions:[K]}})},oI0={name:"COLLECTION_REGISTRY_APP_FILTERS",description:"List Store filter facets for registry items. Respects private-only mode from plugin settings.",inputSchema:q.object({}),outputSchema:YN,handler:O6(q.object({}),async(Y,Q)=>{let X=t0();if(!(await sC(Q,Q.organization.id)).storePrivateOnly)return X.items.getFilters(Q.organization.id);let G=await X.items.list(Q.organization.id,{limit:1e4,where:{field:["is_public"],operator:"eq",value:!1}});return YM4(G.items)})}});var tI0;var eI0=j(()=>{wP0();PP0();TP0();RP0();E20();C20();I20();S20();v20();y20();b20();x20();u20();l20();p20();n20();a20();o20();Vd();SI0();vI0();yI0();bI0();xI0();uI0();lI0();pI0();nI0();sI0();tI0=[iI0,aI0,rI0,oI0,j20,_20,R20,f20,EP0,MP0,k20,CP0,T20,P20,AP0,h20,g20,m20,d20,c20,i20,r20,II0,jI0,_I0,kI0,fI0,hI0,gI0,mI0,dI0,cI0]});var Yj0;var Qj0=j(()=>{fB();nw0();qP0();NP0();eI0();m7();Yj0={id:vZ,description:jw0,tools:tI0,migrations:cw0,publicRoutes:(Y,Q)=>{wK1(Y,Q),LK1(Y,Q)},createStorage:LP0,onEvents:{types:["registry.monitor.scheduled"],handler:async(Y,Q)=>{let X=await Q.createMCPProxy(Q.connectionId);try{for(let J of Y){if(J.type!=="registry.monitor.scheduled")continue;let G=J.data&&typeof J.data==="object"?J.data:{},K=G.config&&typeof G.config==="object"?G.config:{},W=Zd(K);await X.callTool({name:"REGISTRY_MONITOR_RUN_START",arguments:{config:W}})}}finally{await X.close()}}}}});var qd="user-sandbox",Xj0="Create embeddable integration flows for platform end-users";import{sql as LR}from"kysely";var Jj0;var Gj0=j(()=>{Jj0={name:"001-user-sandbox",async up(Y){await Y.schema.createTable("user_sandbox").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(Q)=>Q.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("required_apps","text",(Q)=>Q.notNull()).addColumn("redirect_url","text").addColumn("webhook_url","text").addColumn("event_type","text",(Q)=>Q.notNull().defaultTo("integration.completed")).addColumn("agent_title_template","text",(Q)=>Q.notNull().defaultTo("Agent for {{externalUserId}}")).addColumn("agent_instructions","text").addColumn("tool_selection_mode","text",(Q)=>Q.notNull().defaultTo("inclusion")).addColumn("status","text",(Q)=>Q.notNull().defaultTo("active")).addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(Q)=>Q.references("user.id").onDelete("set null")).execute(),await Y.schema.createIndex("idx_user_sandbox_org").on("user_sandbox").column("organization_id").execute(),await Y.schema.createTable("user_sandbox_sessions").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("template_id","text",(Q)=>Q.notNull().references("user_sandbox.id").onDelete("cascade")).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("external_user_id","text",(Q)=>Q.notNull()).addColumn("status","text",(Q)=>Q.notNull().defaultTo("pending")).addColumn("app_statuses","text",(Q)=>Q.notNull().defaultTo("{}")).addColumn("created_agent_id","text",(Q)=>Q.references("connections.id").onDelete("set null")).addColumn("redirect_url","text").addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("expires_at","text",(Q)=>Q.notNull()).execute(),await Y.schema.createIndex("idx_user_sandbox_sessions_template").on("user_sandbox_sessions").column("template_id").execute(),await Y.schema.createIndex("idx_user_sandbox_sessions_external_user").on("user_sandbox_sessions").columns(["template_id","external_user_id"]).execute(),await Y.schema.createIndex("idx_user_sandbox_sessions_org").on("user_sandbox_sessions").column("organization_id").execute(),await Y.schema.createTable("user_sandbox_agents").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("user_sandbox_id","text",(Q)=>Q.notNull().references("user_sandbox.id").onDelete("cascade")).addColumn("external_user_id","text",(Q)=>Q.notNull()).addColumn("connection_id","text",(Q)=>Q.notNull().references("connections.id").onDelete("cascade")).addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).execute(),await Y.schema.createIndex("idx_user_sandbox_agents_unique").on("user_sandbox_agents").columns(["user_sandbox_id","external_user_id"]).unique().execute(),await Y.schema.createIndex("idx_user_sandbox_agents_connection").on("user_sandbox_agents").column("connection_id").execute()},async down(Y){await Y.schema.dropIndex("idx_user_sandbox_agents_connection").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_agents_unique").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_sessions_org").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_sessions_external_user").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_sessions_template").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_org").ifExists().execute(),await Y.schema.dropTable("user_sandbox_agents").ifExists().execute(),await Y.schema.dropTable("user_sandbox_sessions").ifExists().execute(),await Y.schema.dropTable("user_sandbox").ifExists().execute()}}});var Wj0;var Zj0=j(()=>{Gj0();Wj0=[Jj0]});function Bd(Y){let Q=Date.now().toString(36),X=crypto.randomUUID().replace(/-/g,"").substring(0,8);return`${Y}_${Q}${X}`}class NR{db;constructor(Y){this.db=Y}async create(Y){let Q=Bd("usb"),X=new Date().toISOString(),J={id:Q,organization_id:Y.organization_id,title:Y.title,description:Y.description??null,icon:Y.icon??null,required_apps:JSON.stringify(Y.required_apps),redirect_url:Y.redirect_url??null,webhook_url:Y.webhook_url??null,event_type:Y.event_type??"integration.completed",agent_title_template:Y.agent_title_template??"{{externalUserId}}'s Agent",agent_instructions:Y.agent_instructions??null,tool_selection_mode:Y.tool_selection_mode??"inclusion",status:"active",created_at:X,updated_at:X,created_by:Y.created_by??null};await this.db.insertInto("user_sandbox").values(J).execute();let G=await this.findById(Q);if(!G)throw Error(`Failed to create user sandbox with id: ${Q}`);return G}async findById(Y){let Q=await this.db.selectFrom("user_sandbox").selectAll().where("id","=",Y).executeTakeFirst();if(!Q)return null;return this.deserialize(Q)}async list(Y){return(await this.db.selectFrom("user_sandbox").selectAll().where("organization_id","=",Y).orderBy("created_at","desc").execute()).map((X)=>this.deserialize(X))}async update(Y,Q){let J={updated_at:new Date().toISOString()};if(Q.title!==void 0)J.title=Q.title;if(Q.description!==void 0)J.description=Q.description;if(Q.icon!==void 0)J.icon=Q.icon;if(Q.required_apps!==void 0)J.required_apps=JSON.stringify(Q.required_apps);if(Q.redirect_url!==void 0)J.redirect_url=Q.redirect_url;if(Q.webhook_url!==void 0)J.webhook_url=Q.webhook_url;if(Q.event_type!==void 0)J.event_type=Q.event_type;if(Q.agent_title_template!==void 0)J.agent_title_template=Q.agent_title_template;if(Q.agent_instructions!==void 0)J.agent_instructions=Q.agent_instructions;if(Q.tool_selection_mode!==void 0)J.tool_selection_mode=Q.tool_selection_mode;if(Q.status!==void 0)J.status=Q.status;await this.db.updateTable("user_sandbox").set(J).where("id","=",Y).execute();let G=await this.findById(Y);if(!G)throw Error(`Template not found after update: ${Y}`);return G}async delete(Y){await this.db.deleteFrom("user_sandbox").where("id","=",Y).execute()}deserialize(Y){let Q=[];try{Q=JSON.parse(Y.required_apps)}catch{Q=[]}return{id:Y.id,organization_id:Y.organization_id,title:Y.title,description:Y.description,icon:Y.icon,required_apps:Q,redirect_url:Y.redirect_url,webhook_url:Y.webhook_url,event_type:Y.event_type,agent_title_template:Y.agent_title_template,agent_instructions:Y.agent_instructions,tool_selection_mode:Y.tool_selection_mode,status:Y.status,created_at:Y.created_at,updated_at:Y.updated_at,created_by:Y.created_by}}}var QH1=()=>{};class MR{db;constructor(Y){this.db=Y}async create(Y){let Q=Bd("sandbox_session"),X=new Date().toISOString(),J={id:Q,template_id:Y.template_id,organization_id:Y.organization_id,external_user_id:Y.external_user_id,status:"pending",app_statuses:"{}",created_agent_id:Y.created_agent_id??null,redirect_url:Y.redirect_url??null,created_at:X,updated_at:X,expires_at:Y.expires_at};await this.db.insertInto("user_sandbox_sessions").values(J).execute();let G=await this.findById(Q);if(!G)throw Error(`Failed to create session with id: ${Q}`);return G}async findById(Y){let Q=await this.db.selectFrom("user_sandbox_sessions").selectAll().where("id","=",Y).executeTakeFirst();if(!Q)return null;return this.deserialize(Q)}async findExisting(Y,Q){let X=new Date().toISOString(),J=await this.db.selectFrom("user_sandbox_sessions").selectAll().where("template_id","=",Y).where("external_user_id","=",Q).where("expires_at",">",X).where("status","!=","completed").orderBy("created_at","desc").executeTakeFirst();if(!J)return null;return this.deserialize(J)}async listByTemplate(Y){return(await this.db.selectFrom("user_sandbox_sessions").selectAll().where("template_id","=",Y).orderBy("created_at","desc").execute()).map((X)=>this.deserialize(X))}async listByOrganization(Y){return(await this.db.selectFrom("user_sandbox_sessions").selectAll().where("organization_id","=",Y).orderBy("created_at","desc").execute()).map((X)=>this.deserialize(X))}async update(Y,Q){let J={updated_at:new Date().toISOString()};if(Q.status!==void 0)J.status=Q.status;if(Q.app_statuses!==void 0)J.app_statuses=JSON.stringify(Q.app_statuses);if(Q.created_agent_id!==void 0)J.created_agent_id=Q.created_agent_id;await this.db.updateTable("user_sandbox_sessions").set(J).where("id","=",Y).execute();let G=await this.findById(Y);if(!G)throw Error(`Session not found after update: ${Y}`);return G}async delete(Y){await this.db.deleteFrom("user_sandbox_sessions").where("id","=",Y).execute()}async deleteExpired(){let Y=new Date().toISOString(),Q=await this.db.deleteFrom("user_sandbox_sessions").where("expires_at","<",Y).where("status","!=","completed").executeTakeFirst();return Number(Q.numDeletedRows??0)}async deleteByExternalUserId(Y,Q){let X=await this.db.deleteFrom("user_sandbox_sessions").where("organization_id","=",Y).where("external_user_id","=",Q).executeTakeFirst();return Number(X.numDeletedRows??0)}deserialize(Y){let Q={};try{Q=JSON.parse(Y.app_statuses)}catch{Q={}}return{id:Y.id,template_id:Y.template_id,organization_id:Y.organization_id,external_user_id:Y.external_user_id,status:Y.status,app_statuses:Q,created_agent_id:Y.created_agent_id,redirect_url:Y.redirect_url,created_at:Y.created_at,updated_at:Y.updated_at,expires_at:Y.expires_at}}}var XH1=()=>{};function wR(Y){JH1=Y}function q5(){if(!JH1)throw Error(`Plugin storage not initialized. Make sure the "${qd}" plugin is enabled.`);return JH1}function GH1(){return process.env.BASE_URL||"http://localhost:3000"}var JH1=null;var sG=()=>{};function Kj0(Y){let Q=Y.db,X={templates:new NR(Q),sessions:new MR(Q)};return wR(X),X}var Hj0=j(()=>{QH1();XH1();sG()});var QM4,XM4,JM4,GM4,WM4,z$,ZM4,Fj0,$j0,Vj0,qj0,Bj0,Uj0,zj0,Dj0,Oj0,Lj0,Nj0,KM4,Mj0,wj0,Aj0;var uZ=j(()=>{k1();QM4=q.object({authorizationEndpoint:q.string().describe("OAuth authorization endpoint URL"),tokenEndpoint:q.string().describe("OAuth token endpoint URL"),clientId:q.string().describe("OAuth client ID"),scopes:q.array(q.string()).describe("OAuth scopes to request"),grantType:q.enum(["authorization_code","client_credentials"]).describe("OAuth grant type")}),XM4=q.object({headers:q.record(q.string(),q.string()).optional().describe("HTTP headers")}),JM4=q.object({command:q.string().describe("Command to run"),args:q.array(q.string()).optional().describe("Command arguments"),cwd:q.string().optional().describe("Working directory"),envVars:q.record(q.string(),q.string()).optional().describe("Environment variables")}),GM4=q.object({app_name:q.string().describe("App name from registry (e.g., '@deco/gmail')"),title:q.string().describe("Display title for the app"),description:q.string().nullable().optional().describe("App description"),icon:q.string().nullable().optional().describe("Icon URL"),connection_type:q.enum(["HTTP","SSE","Websocket","STDIO"]).describe("Connection type"),connection_url:q.string().nullable().optional().describe("MCP server URL"),connection_headers:q.union([XM4,JM4]).nullable().optional().describe("Connection parameters"),oauth_config:QM4.nullable().optional().describe("OAuth configuration if required"),selected_tools:q.array(q.string()).nullable().optional().describe("Selected tools to expose (null = all)"),selected_resources:q.array(q.string()).nullable().optional().describe("Selected resources to expose (null = all)"),selected_prompts:q.array(q.string()).nullable().optional().describe("Selected prompts to expose (null = all)")}),WM4=q.object({configured:q.boolean().describe("Whether the app has been configured"),connection_id:q.string().nullable().describe("Connection ID if created"),error:q.string().nullable().describe("Error message if configuration failed")}),z$=q.object({id:q.string(),organization_id:q.string(),title:q.string(),description:q.string().nullable(),icon:q.string().nullable(),required_apps:q.array(GM4),redirect_url:q.string().nullable(),webhook_url:q.string().nullable(),event_type:q.string(),agent_title_template:q.string(),agent_instructions:q.string().nullable(),tool_selection_mode:q.enum(["inclusion","exclusion"]),status:q.enum(["active","inactive"]),created_at:q.string(),updated_at:q.string(),created_by:q.string().nullable()}),ZM4=q.object({id:q.string(),template_id:q.string(),organization_id:q.string(),external_user_id:q.string(),status:q.enum(["pending","in_progress","completed"]),app_statuses:q.record(q.string(),WM4),created_agent_id:q.string().nullable(),redirect_url:q.string().nullable(),created_at:q.string(),updated_at:q.string(),expires_at:q.string()}),Fj0=q.object({app_name:q.string().describe("App name from registry (e.g., '@deco/openrouter')"),selected_tools:q.array(q.string()).nullable().optional().describe("Selected tools to expose (null = all)"),selected_resources:q.array(q.string()).nullable().optional().describe("Selected resources to expose (null = all)"),selected_prompts:q.array(q.string()).nullable().optional().describe("Selected prompts to expose (null = all)")}),$j0=q.object({title:q.string().describe("Title for the template"),description:q.string().optional().describe("Optional description"),icon:q.string().optional().describe("Optional icon URL"),registry_id:q.string().describe("Connection ID of the registry to look up apps from"),required_apps:q.array(Fj0).describe("Apps to include - only app_name required, details fetched from registry"),redirect_url:q.string().optional().describe("URL to redirect to after completion"),webhook_url:q.string().optional().describe("Webhook URL to call on completion"),event_type:q.string().optional().describe("Event type to emit (default: integration.completed)"),agent_title_template:q.string().optional().describe("Template for agent title (supports {{externalUserId}})"),agent_instructions:q.string().optional().describe("Instructions for the created agent"),tool_selection_mode:q.enum(["inclusion","exclusion"]).optional().describe("Tool selection mode for the agent")}),Vj0=q.object({id:q.string().describe("Template ID to update"),title:q.string().optional(),description:q.string().nullable().optional(),icon:q.string().nullable().optional(),registry_id:q.string().optional().describe("Connection ID of the registry (required if updating required_apps)"),required_apps:q.array(Fj0).optional().describe("Updated apps (details will be fetched from registry)"),redirect_url:q.string().nullable().optional(),webhook_url:q.string().nullable().optional(),event_type:q.string().optional(),agent_title_template:q.string().optional(),agent_instructions:q.string().nullable().optional(),tool_selection_mode:q.enum(["inclusion","exclusion"]).optional(),status:q.enum(["active","inactive"]).optional()}),qj0=q.object({id:q.string().describe("Template ID")}),Bj0=q.object({}),Uj0=q.object({id:q.string().describe("Template ID to delete")}),zj0=q.object({templateId:q.string().describe("Template ID"),externalUserId:q.string().describe("External user ID from your platform"),expiresInSeconds:q.number().optional().describe("Session expiration in seconds (default: 7 days)")}),Dj0=q.object({sessionId:q.string().describe("Session ID"),url:q.string().describe("URL for the connect flow"),expiresAt:q.string().describe("Session expiration time"),agentId:q.string().nullable().optional().describe("Virtual MCP ID for this user (unique per template + user)"),created:q.boolean().describe("Whether the agent was newly created (true) or already existed (false)")}),Oj0=q.object({templateId:q.string().optional().describe("Filter by template ID")}),Lj0=q.object({sessions:q.array(ZM4)}),Nj0=q.object({externalUserId:q.string().describe("External user ID to find agents for")}),KM4=q.object({id:q.string().describe("Agent (Virtual MCP) ID"),title:q.string(),external_user_id:q.string(),template_id:q.string().nullable(),created_at:q.string()}),Mj0=q.object({agents:q.array(KM4)}),wj0=q.object({externalUserId:q.string().describe("External user ID whose session data should be cleared")}),Aj0=q.object({success:q.boolean(),deletedAgents:q.number().describe("Number of agents (Virtual MCPs) deleted"),deletedConnections:q.number().describe("Number of child connections deleted"),deletedSessions:q.number().describe("Number of sessions deleted")})});function FM4(Y){if(!Y?.url)return null;try{let Q=new URL(Y.url);if(Q.hostname==="github.com"){let X=Q.pathname.split("/").filter(Boolean);if(X.length>=1)return`https://github.com/${X[0]}.png`}}catch{}return null}function $M4(Y){return Y.find((X)=>X.name.endsWith("_LIST"))?.name??null}function VM4(Y){if(!Y)return[];if(Array.isArray(Y))return Y;if(typeof Y==="object"&&Y!==null){let Q=Object.keys(Y).find((X)=>Array.isArray(Y[X]));if(Q)return Y[Q]}return[]}function qM4(Y,Q,X,J){let G=Y.server,K=Y._meta?.["mcp.mesh"],W=K?.friendlyName||K?.friendly_name||Y.title||G?.title||G?.name||"Unnamed MCP Server",Z=G?.description||null,H=G?.icons?.[0]?.src||FM4(G?.repository)||null,F=K?.oauth_config,$=F&&typeof F.authorizationEndpoint==="string"&&typeof F.tokenEndpoint==="string"&&typeof F.clientId==="string"&&Array.isArray(F.scopes)&&(F.grantType==="authorization_code"||F.grantType==="client_credentials")?{authorizationEndpoint:F.authorizationEndpoint,tokenEndpoint:F.tokenEndpoint,clientId:F.clientId,scopes:F.scopes,grantType:F.grantType}:null,V=G?.packages??[],B=G?.remotes??[],U,z,O=null,M=B[0],w=V[0];if(M){if(U=HM4[M.type??""]??M.type?.toUpperCase()??"HTTP",z=M.url??null,M.headers&&M.headers.length>0){let P={};for(let S of M.headers)if(S.name&&S.value)P[S.name]=S.value;if(Object.keys(P).length>0)O={headers:P}}}else if(w){U="STDIO",z=null;let P=w.identifier||w.name,S={};if(w.environmentVariables){for(let C of w.environmentVariables)if(C.name)S[C.name]=""}O={command:"npx",args:P?["-y",P]:[],...Object.keys(S).length>0&&{envVars:S}}}else U="HTTP",z=null;return{title:W,description:Z,icon:H,connection_type:U,connection_url:z,connection_headers:O,oauth_config:$,selected_tools:Q,selected_resources:X,selected_prompts:J}}async function BM4(Y,Q,X,J=null,G=null,K=null){let W=await Y.createMCPProxy(Q);try{let Z=await W.listTools(),H=$M4(Z.tools);if(!H)throw Error(`Registry "${Q}" does not have a LIST tool`);let F=await W.callTool({name:H,arguments:{where:{appName:X}}}),$=F.structuredContent??F,B=VM4($)[0];if(!B)throw Error(`App "${X}" not found in registry "${Q}"`);let U=qM4(B,J,G,K);return{app_name:X,...U}}finally{await W.close().catch(console.error)}}async function Ud(Y,Q,X){let J=[];for(let G of X){let K=await BM4(Y,Q,G.app_name,G.selected_tools??null,G.selected_resources??null,G.selected_prompts??null);J.push(K)}return J}var HM4;var WH1=j(()=>{HM4={"streamable-http":"HTTP",http:"HTTP",sse:"SSE",stdio:"STDIO",websocket:"Websocket"}});var Pj0;var Ej0=j(()=>{uZ();sG();WH1();Pj0={name:"USER_SANDBOX_CREATE",description:"Create a new user sandbox for platform integration flows. Specify apps by name and the system will automatically fetch connection details from the registry.",inputSchema:$j0,outputSchema:z$,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=await Ud(J,X.registry_id,X.required_apps.map((Z)=>({app_name:Z.app_name,selected_tools:Z.selected_tools??null,selected_resources:Z.selected_resources??null,selected_prompts:Z.selected_prompts??null})));return await q5().templates.create({organization_id:J.organization.id,title:X.title,description:X.description??null,icon:X.icon??null,required_apps:G,redirect_url:X.redirect_url??null,webhook_url:X.webhook_url??null,event_type:X.event_type,agent_title_template:X.agent_title_template,agent_instructions:X.agent_instructions??null,tool_selection_mode:X.tool_selection_mode,created_by:J.auth.user?.id??null})}}});var Tj0;var Cj0=j(()=>{uZ();sG();WH1();Tj0={name:"USER_SANDBOX_UPDATE",description:"Update an existing user sandbox. If updating required_apps, provide registry_id to auto-fetch details.",inputSchema:Vj0,outputSchema:z$,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K=await G.templates.findById(X.id);if(!K)throw Error(`Template not found: ${X.id}`);if(K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");let W=void 0;if(X.required_apps&&X.required_apps.length>0){if(!X.registry_id)throw Error("registry_id is required when updating required_apps");W=await Ud(J,X.registry_id,X.required_apps.map((H)=>({app_name:H.app_name,selected_tools:H.selected_tools??null,selected_resources:H.selected_resources??null,selected_prompts:H.selected_prompts??null})))}return await G.templates.update(X.id,{title:X.title,description:X.description,icon:X.icon,required_apps:W,redirect_url:X.redirect_url,webhook_url:X.webhook_url,event_type:X.event_type,agent_title_template:X.agent_title_template,agent_instructions:X.agent_instructions,tool_selection_mode:X.tool_selection_mode,status:X.status})}}});var Rj0;var Ij0=j(()=>{k1();uZ();sG();Rj0={name:"USER_SANDBOX_DELETE",description:"Delete a user sandbox",inputSchema:Uj0,outputSchema:q.object({success:q.boolean(),id:q.string()}),handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K=await G.templates.findById(X.id);if(!K)throw Error(`Template not found: ${X.id}`);if(K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");return await G.templates.delete(X.id),{success:!0,id:X.id}}}});var jj0;var Sj0=j(()=>{k1();uZ();sG();jj0={name:"USER_SANDBOX_LIST",description:"List all user sandbox in the organization",inputSchema:Bj0,outputSchema:q.object({templates:q.array(z$)}),handler:async(Y,Q)=>{let X=Q;if(!X.organization)throw Error("Organization context required");return await X.access.check(),{templates:await q5().templates.list(X.organization.id)}}}});var _j0;var vj0=j(()=>{uZ();sG();_j0={name:"USER_SANDBOX_GET",description:"Get a user sandbox by ID",inputSchema:qj0,outputSchema:z$,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let K=await q5().templates.findById(X.id);if(K&&K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");return K}}});async function kj0(Y,Q){let X=await Q.sessions.findById(Y);if(!X)throw new _3("Session not found","SESSION_NOT_FOUND");if(new Date(X.expires_at)<new Date)throw new _3("Session has expired","SESSION_EXPIRED");return X}async function UM4(Y,Q){let X=await kj0(Y,Q);if(X.status==="completed")throw new _3("Session is already completed. Create a new session to reconfigure.","SESSION_COMPLETED");return X}function zM4(Y,Q){let X=Y.metadata;if(!X)throw new _3("Connection has no metadata","CONNECTION_ACCESS_DENIED");let J=X[D$.SESSION_ID]===Q.id,G=X[D$.EXTERNAL_USER_ID]===Q.external_user_id&&X[D$.TEMPLATE_ID]===Q.template_id;if(!J&&!G)throw new _3("Access denied: connection does not belong to this session","CONNECTION_ACCESS_DENIED")}function ZH1(Y,Q,X){return{[D$.SESSION_ID]:Y,[D$.EXTERNAL_USER_ID]:Q,[D$.TEMPLATE_ID]:X,source:"user-sandbox"}}function KH1(Y,Q){return{[D$.EXTERNAL_USER_ID]:Y,[D$.TEMPLATE_ID]:Q,source:"user-sandbox"}}async function eB(Y,Q,X){let J=X?.allowCompleted?await kj0(Y,Q):await UM4(Y,Q);if(X?.connection)zM4(X.connection,J);return J}var D$,_3;var yj0=j(()=>{D$={SESSION_ID:"user_sandbox_session_id",EXTERNAL_USER_ID:"user_sandbox_external_user_id",TEMPLATE_ID:"user_sandbox_id"};_3=class _3 extends Error{code;constructor(Y,Q){super(Y);this.code=Q;this.name="SessionAccessError"}}});var HH1=j(()=>{yj0()});async function OM4(Y,Q,X,J,G,K,W,Z){let H=Y,F=await H.selectFrom("user_sandbox_agents").select("connection_id").where("user_sandbox_id","=",J).where("external_user_id","=",G).executeTakeFirst();if(F)return{connectionId:F.connection_id,created:!1};let $=new Date().toISOString(),V=`usa_${Date.now().toString(36)}${crypto.randomUUID().replace(/-/g,"").substring(0,8)}`,B=`vir_${Date.now().toString(36)}${crypto.randomUUID().replace(/-/g,"").substring(0,8)}`;try{return await H.transaction().execute(async(U)=>{await U.insertInto("connections").values({id:B,organization_id:Q,created_by:X,title:K,description:W,icon:null,app_name:null,app_id:null,connection_type:"VIRTUAL",connection_url:`virtual://${B}`,connection_token:null,connection_headers:JSON.stringify({tool_selection_mode:Z}),oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:JSON.stringify(KH1(G,J)),tools:null,bindings:null,status:"active",created_at:$,updated_at:$}).execute(),await U.insertInto("user_sandbox_agents").values({id:V,user_sandbox_id:J,external_user_id:G,connection_id:B,created_at:$}).execute()}),{connectionId:B,created:!0}}catch(U){let z=String(U);if(z.includes("UNIQUE constraint")||z.includes("duplicate key")){let O=await H.selectFrom("user_sandbox_agents").select("connection_id").where("user_sandbox_id","=",J).where("external_user_id","=",G).executeTakeFirst();if(O)return{connectionId:O.connection_id,created:!1}}throw U}}var DM4=604800,fj0;var bj0=j(()=>{uZ();sG();HH1();fj0={name:"USER_SANDBOX_CREATE_SESSION",description:"Create a connect session URL for an external user. Returns a URL that the user can visit to configure their integrations. Also creates a unique Virtual MCP (agent) for this user if one doesn't exist.",inputSchema:zj0,outputSchema:Dj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K=await G.templates.findById(X.templateId);if(!K)throw Error(`Template not found: ${X.templateId}`);if(K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");if(K.status!=="active")throw Error("Template is not active");let W=K.agent_title_template.replace("{{externalUserId}}",X.externalUserId),Z=K.created_by??J.auth.user?.id??"system",{connectionId:H,created:F}=await OM4(J.db,J.organization.id,Z,K.id,X.externalUserId,W,K.agent_instructions,K.tool_selection_mode),$=await G.sessions.findExisting(X.templateId,X.externalUserId);if($){if(!$.created_agent_id)await G.sessions.update($.id,{created_agent_id:H});let O=GH1();return{sessionId:$.id,url:`${O}/connect/${$.id}`,expiresAt:$.expires_at,agentId:$.created_agent_id??H,created:F}}let V=X.expiresInSeconds??DM4,B=new Date(Date.now()+V*1000).toISOString(),U=await G.sessions.create({template_id:X.templateId,organization_id:J.organization.id,external_user_id:X.externalUserId,redirect_url:K.redirect_url,expires_at:B,created_agent_id:H}),z=GH1();return{sessionId:U.id,url:`${z}/connect/${U.id}`,expiresAt:U.expires_at,agentId:H,created:F}}}});var hj0;var xj0=j(()=>{uZ();sG();hj0={name:"USER_SANDBOX_LIST_SESSIONS",description:"List connect sessions for monitoring and management",inputSchema:Oj0,outputSchema:Lj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K;if(X.templateId){let W=await G.templates.findById(X.templateId);if(!W)throw Error(`Template not found: ${X.templateId}`);if(W.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");K=await G.sessions.listByTemplate(X.templateId)}else K=await G.sessions.listByOrganization(J.organization.id);return{sessions:K}}}});var LM4="user_sandbox_external_user_id",NM4="user_sandbox_id",gj0;var uj0=j(()=>{uZ();gj0={name:"USER_SANDBOX_LIST_USER_AGENTS",description:"List all agents (Virtual MCPs) created for an external user. Use this to find agents created via user sandbox for a specific user in your platform.",inputSchema:Nj0,outputSchema:Mj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");return await J.access.check(),{agents:(await J.storage.connections.list(J.organization.id)).filter((W)=>{if(W.connection_type!=="VIRTUAL")return!1;let Z=W.metadata;if(!Z)return!1;return Z[LM4]===X.externalUserId}).map((W)=>{let Z=W.metadata;return{id:W.id,title:W.title,external_user_id:X.externalUserId,template_id:Z[NM4]??null,created_at:W.created_at}})}}}});var MM4="user_sandbox_external_user_id",mj0;var lj0=j(()=>{uZ();sG();mj0={name:"USER_SANDBOX_CLEAR_USER_SESSION",description:"Clear all session data for an external user, revoking all access they've granted. This deletes their agents (Virtual MCPs), child connections, OAuth tokens, and sessions. Use this when a user wants to disconnect all their integrations.",inputSchema:wj0,outputSchema:Aj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=J.db,K=q5(),Z=(await G.selectFrom("connections").select(["id","metadata"]).where("organization_id","=",J.organization.id).where("connection_type","=","VIRTUAL").execute()).filter(($)=>{if(!$.metadata)return!1;try{return JSON.parse($.metadata)[MM4]===X.externalUserId}catch{return!1}}).map(($)=>$.id),H=0;if(Z.length>0){let V=(await G.selectFrom("connection_aggregations").select("child_connection_id").where("parent_connection_id","in",Z).execute()).map((B)=>B.child_connection_id);if(await G.deleteFrom("connection_aggregations").where("parent_connection_id","in",Z).execute(),V.length>0)await G.deleteFrom("downstream_tokens").where("connectionId","in",V).execute(),await G.deleteFrom("connections").where("id","in",V).execute(),H=V.length;await G.deleteFrom("connections").where("id","in",Z).execute(),await G.deleteFrom("user_sandbox_agents").where("external_user_id","=",X.externalUserId).execute()}let F=await K.sessions.deleteByExternalUserId(J.organization.id,X.externalUserId);return{success:!0,deletedAgents:Z.length,deletedConnections:H,deletedSessions:F}}}});var dj0;var pj0=j(()=>{Ej0();Cj0();Ij0();Sj0();vj0();bj0();xj0();uj0();lj0();sG();dj0=[Pj0,Tj0,Rj0,jj0,_j0,fj0,hj0,gj0,mj0]});function wM4(Y){let Q=Date.now().toString(36),X=crypto.randomUUID().replace(/-/g,"").substring(0,8);return`${Y}_${Q}${X}`}async function FH1(Y,Q,X,J){let G={success:!1,agentId:Y.created_agent_id,connectionIds:[],redirectUrl:null,eventEmitted:!1,webhookCalled:!1};try{let K=J.db,W=new Date().toISOString(),Z=Y.created_agent_id;if(!Z)throw Error("Session has no agent - this should not happen");let H=[],F=[];for(let[B,U]of Object.entries(Y.app_statuses))if(U.configured&&U.connection_id){H.push(U.connection_id);let z=Q.required_apps.find((O)=>O.app_name===B);F.push({appName:B,connectionId:U.connection_id,selectedTools:z?.selected_tools??null,selectedResources:z?.selected_resources??null,selectedPrompts:z?.selected_prompts??null})}if(G.connectionIds=H,await K.deleteFrom("connection_aggregations").where("parent_connection_id","=",Z).execute(),F.length>0)await K.insertInto("connection_aggregations").values(F.map((B)=>({id:wM4("agg"),parent_connection_id:Z,child_connection_id:B.connectionId,selected_tools:B.selectedTools?JSON.stringify(B.selectedTools):null,selected_resources:B.selectedResources?JSON.stringify(B.selectedResources):null,selected_prompts:B.selectedPrompts?JSON.stringify(B.selectedPrompts):null,created_at:W}))).execute();await X.sessions.update(Y.id,{status:"completed"});let $={type:Q.event_type,data:{externalUserId:Y.external_user_id,agentId:Z,templateId:Q.id,sessionId:Y.id,connections:H.map((B)=>{let U=Object.entries(Y.app_statuses).find(([z,O])=>O.connection_id===B)?.[0];return{id:B,appName:U??"unknown"}})}};if(J.eventBus)try{await J.eventBus.publish(J.organizationId,"user-sandbox",$),G.eventEmitted=!0}catch(B){console.error("[UserSandbox] Failed to emit completion event:",B)}if(Q.webhook_url)try{let B=await fetch(Q.webhook_url,{method:"POST",headers:{"Content-Type":"application/json","X-User-Sandbox-Event":Q.event_type},body:JSON.stringify($.data)});if(!B.ok)console.error("[UserSandbox] Webhook returned error:",B.status);else G.webhookCalled=!0}catch(B){console.error("[UserSandbox] Failed to call webhook:",B)}let V=Y.redirect_url??Q.redirect_url;if(V){let B=new URL(V);B.searchParams.set("sessionId",Y.id),B.searchParams.set("externalUserId",Y.external_user_id),B.searchParams.set("agentId",Z),G.redirectUrl=B.toString()}return G.success=!0,G}catch(K){throw console.error("[UserSandbox] Completion failed:",K),K}}var cj0=()=>{};function AM4(){let Y=Date.now().toString(36),Q=crypto.randomUUID().replace(/-/g,"").substring(0,8);return`conn_${Y}${Q}`}async function PM4(Y,Q,X,J,G,K,W){let Z=AM4(),H=new Date().toISOString();if(!W.title)throw Error(`App "${W.app_name}" is missing required field: title`);if(!W.connection_type)throw Error(`App "${W.app_name}" is missing required field: connection_type`);if(!W.connection_url&&W.connection_type!=="STDIO")throw Error(`App "${W.app_name}" is missing required field: connection_url`);let F={id:Z,organization_id:Q,created_by:X,title:W.title,description:W.description??null,icon:W.icon??null,app_name:W.app_name,app_id:null,connection_type:W.connection_type,connection_url:W.connection_url??"",connection_token:null,connection_headers:W.connection_headers?JSON.stringify(W.connection_headers):null,oauth_config:W.oauth_config?JSON.stringify(W.oauth_config):null,configuration_state:null,configuration_scopes:null,metadata:JSON.stringify(ZH1(J,G,K)),tools:null,bindings:null,status:"active",created_at:H,updated_at:H};return await Y.insertInto("connections").values(F).execute(),Z}function AR(Y,Q){if(Q instanceof _3){let X={SESSION_NOT_FOUND:404,SESSION_EXPIRED:410,SESSION_COMPLETED:409,ACCESS_DENIED:403,CONNECTION_ACCESS_DENIED:403};return Y.json({error:Q.message,code:Q.code},X[Q.code]??400)}return console.error("[UserSandbox] Connect API error:",Q),Y.json({error:Q instanceof Error?Q.message:"Internal error"},500)}function $H1(Y,Q){let X=Q.db,J=new NR(X),G=new MR(X),K={templates:J,sessions:G};Y.get("/api/user-sandbox/sessions/:sessionId",async(W)=>{try{let Z=W.req.param("sessionId"),H=await eB(Z,K,{allowCompleted:!0}),F=await J.findById(H.template_id);if(!F)return W.json({error:"Template not found"},404);return W.json({session:{id:H.id,status:H.status,external_user_id:H.external_user_id,expires_at:H.expires_at,redirect_url:H.redirect_url,created_agent_id:H.created_agent_id},template:{id:F.id,title:F.title,description:F.description,icon:F.icon},apps:F.required_apps.map(($)=>({app_name:$.app_name,title:$.title,description:$.description,icon:$.icon,connection_type:$.connection_type,requires_oauth:!!$.oauth_config,selected_tools:$.selected_tools,selected_resources:$.selected_resources,selected_prompts:$.selected_prompts,status:H.app_statuses[$.app_name]??{configured:!1,connection_id:null,error:null}}))})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/provision",async(W)=>{try{let Z=W.req.param("sessionId"),H=await W.req.json();if(!H.app_name)return W.json({error:"app_name is required"},400);let F=await eB(Z,K,{allowCompleted:!0}),$=await J.findById(F.template_id);if(!$)return W.json({error:"Template not found"},404);let V=$.required_apps.find((O)=>O.app_name===H.app_name);if(!V)return W.json({error:`App "${H.app_name}" is not required by this template`},400);let B=F.app_statuses[H.app_name];if(B?.connection_id)return W.json({success:!0,connection_id:B.connection_id,already_provisioned:!0,requires_oauth:!!V.oauth_config});if(!$.created_by)return W.json({error:"Template is missing created_by - cannot create connections"},500);let U=await PM4(X,F.organization_id,$.created_by,Z,F.external_user_id,F.template_id,V),z={...F.app_statuses,[H.app_name]:{configured:!1,connection_id:U,error:null}};return await G.update(Z,{status:"in_progress",app_statuses:z}),W.json({success:!0,connection_id:U,already_provisioned:!1,requires_oauth:!!V.oauth_config})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/configure",async(W)=>{try{let Z=W.req.param("sessionId"),H=await W.req.json();if(!H.app_name)return W.json({error:"app_name is required"},400);let F=await eB(Z,K,{allowCompleted:!0}),$=await J.findById(F.template_id);if(!$)return W.json({error:"Template not found"},404);if(!$.required_apps.find((M)=>M.app_name===H.app_name))return W.json({error:`App "${H.app_name}" is not required by this template`},400);let B=F.app_statuses[H.app_name],z={configured:!0,connection_id:H.connection_id??B?.connection_id??null,error:null},O={...F.app_statuses,[H.app_name]:z};return await G.update(Z,{status:"in_progress",app_statuses:O}),W.json({success:!0,app_name:H.app_name,status:z})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/oauth-token",async(W)=>{try{let Z=W.req.param("sessionId"),H=await W.req.json();if(!H.connection_id)return W.json({error:"connection_id is required"},400);if(!H.access_token)return W.json({error:"access_token is required"},400);let F=await eB(Z,K,{allowCompleted:!0});if(!Object.values(F.app_statuses).some((P)=>P.connection_id===H.connection_id))return W.json({error:"Connection does not belong to this session"},403);let V=H.expires_in?new Date(Date.now()+H.expires_in*1000):null,B=new Date().toISOString(),U=await Q.vault.encrypt(H.access_token),z=H.refresh_token?await Q.vault.encrypt(H.refresh_token):null,O=H.client_secret?await Q.vault.encrypt(H.client_secret):null,M=X,w=await M.selectFrom("downstream_tokens").select(["id"]).where("connectionId","=",H.connection_id).executeTakeFirst();if(w)await M.updateTable("downstream_tokens").set({accessToken:U,refreshToken:z,scope:H.scope??null,expiresAt:V?.toISOString()??null,clientId:H.client_id??null,clientSecret:O,tokenEndpoint:H.token_endpoint??null,updatedAt:B}).where("id","=",w.id).execute();else{let P=`dtok_${Date.now().toString(36)}${crypto.randomUUID().replace(/-/g,"").substring(0,8)}`;await M.insertInto("downstream_tokens").values({id:P,connectionId:H.connection_id,accessToken:U,refreshToken:z,scope:H.scope??null,expiresAt:V?.toISOString()??null,clientId:H.client_id??null,clientSecret:O,tokenEndpoint:H.token_endpoint??null,createdAt:B,updatedAt:B}).execute()}return W.json({success:!0,expiresAt:V})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/complete",async(W)=>{try{let Z=W.req.param("sessionId"),H=await eB(Z,K,{allowCompleted:!0}),F=await J.findById(H.template_id);if(!F)return W.json({error:"Template not found"},404);if(F.required_apps.filter((B)=>{return H.app_statuses[B.app_name]?.configured}).length===0)return W.json({error:"At least one app must be configured"},400);let V=await FH1(H,F,K,{organizationId:H.organization_id,db:X});return W.json({success:V.success,completed:!0,agentId:V.agentId,redirectUrl:V.redirectUrl,eventEmitted:V.eventEmitted,webhookCalled:V.webhookCalled})}catch(Z){return AR(W,Z)}})}var nj0=j(()=>{QH1();XH1();HH1();cj0()});var ij0=j(()=>{nj0()});var aj0;var rj0=j(()=>{Zj0();Hj0();pj0();ij0();aj0={id:qd,description:Xj0,tools:dj0,publicRoutes:(Y,Q)=>{$H1(Y,Q)},migrations:Wj0,createStorage:(Y)=>{let Q=Kj0(Y);return wR(Q),Q}}});var oj0="workflows",sj0="Create workflows for platform end-users";import{sql as tj0}from"kysely";var ej0;var YS0=j(()=>{ej0={name:"001-workflows",async up(Y){await Y.schema.createTable("workflow_collection").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(Q)=>Q.notNull()).addColumn("description","text").addColumn("virtual_mcp_id","text",(Q)=>Q.notNull()).addColumn("steps","text",(Q)=>Q.notNull().defaultTo("[]")).addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(tj0`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(Q)=>Q.notNull().defaultTo(tj0`CURRENT_TIMESTAMP`)).addColumn("created_by","text").addColumn("updated_by","text").execute(),await Y.schema.createIndex("idx_wf_collection_org").on("workflow_collection").column("organization_id").execute(),await Y.schema.createIndex("idx_wf_collection_created_at").on("workflow_collection").column("created_at").execute(),await Y.schema.createTable("workflow").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("workflow_collection_id","text").addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("steps","text",(Q)=>Q.notNull().defaultTo("[]")).addColumn("input","text").addColumn("virtual_mcp_id","text",(Q)=>Q.notNull()).addColumn("created_at_epoch_ms","bigint",(Q)=>Q.notNull()).addColumn("created_by","text").execute(),await Y.schema.createIndex("idx_workflow_created_at").on("workflow").column("created_at_epoch_ms").execute(),await Y.schema.createIndex("idx_workflow_collection_id").on("workflow").column("workflow_collection_id").execute(),await Y.schema.createTable("workflow_execution").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("workflow_id","text",(Q)=>Q.notNull().references("workflow.id").onDelete("cascade")).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("status","text",(Q)=>Q.notNull().defaultTo("enqueued")).addColumn("input","text").addColumn("output","text").addColumn("error","text").addColumn("created_at","bigint",(Q)=>Q.notNull()).addColumn("updated_at","bigint",(Q)=>Q.notNull()).addColumn("start_at_epoch_ms","bigint").addColumn("started_at_epoch_ms","bigint").addColumn("completed_at_epoch_ms","bigint").addColumn("timeout_ms","bigint").addColumn("deadline_at_epoch_ms","bigint").addColumn("created_by","text").execute(),await Y.schema.createIndex("idx_wf_execution_status").on("workflow_execution").column("status").execute(),await Y.schema.createIndex("idx_wf_execution_workflow_id").on("workflow_execution").column("workflow_id").execute(),await Y.schema.createIndex("idx_wf_execution_org").on("workflow_execution").column("organization_id").execute(),await Y.schema.createIndex("idx_wf_execution_created_at").on("workflow_execution").column("created_at").execute(),await Y.schema.createTable("workflow_execution_step_result").addColumn("execution_id","text",(Q)=>Q.notNull().references("workflow_execution.id").onDelete("cascade")).addColumn("step_id","text",(Q)=>Q.notNull()).addColumn("started_at_epoch_ms","bigint").addColumn("completed_at_epoch_ms","bigint").addColumn("output","text").addColumn("error","text").addColumn("raw_tool_output","text").execute(),await Y.schema.createIndex("idx_wf_step_result_pk").on("workflow_execution_step_result").columns(["execution_id","step_id"]).unique().execute(),await Y.schema.createIndex("idx_wf_step_result_execution").on("workflow_execution_step_result").column("execution_id").execute()},async down(Y){await Y.schema.dropIndex("idx_wf_step_result_execution").ifExists().execute(),await Y.schema.dropIndex("idx_wf_step_result_pk").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_created_at").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_org").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_workflow_id").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_status").ifExists().execute(),await Y.schema.dropIndex("idx_workflow_collection_id").ifExists().execute(),await Y.schema.dropIndex("idx_workflow_created_at").ifExists().execute(),await Y.schema.dropIndex("idx_wf_collection_created_at").ifExists().execute(),await Y.schema.dropIndex("idx_wf_collection_org").ifExists().execute(),await Y.schema.dropTable("workflow_execution_step_result").ifExists().execute(),await Y.schema.dropTable("workflow_execution").ifExists().execute(),await Y.schema.dropTable("workflow").ifExists().execute(),await Y.schema.dropTable("workflow_collection").ifExists().execute()}}});var QS0;var XS0=j(()=>{YS0();QS0=[ej0]});function pX(Y){let Q=Y;if(!Q.organization)throw Error("Organization context required for workflow tools");return Q}function QX(Y){if(Y===null||Y===void 0)return null;if(typeof Y==="object")return Y;if(typeof Y!=="string")return Y;try{return JSON.parse(Y)}catch{return Y}}function JS0(Y){VH1=Y}function gQ(){if(!VH1)throw Error('Plugin storage not initialized. Make sure the "workflows" plugin is enabled.');return VH1}var VH1=null;function GS0(Y){return{...Y,steps:QX(Y.steps)??[]}}class qH1{db;constructor(Y){this.db=Y}async list(Y,Q={}){let{limit:X=50,offset:J=0}=Q,G=await this.db.selectFrom("workflow_collection").selectAll().where("organization_id","=",Y).orderBy("created_at","desc").limit(X).offset(J).execute(),K=await this.db.selectFrom("workflow_collection").select((W)=>W.fn.countAll().as("count")).where("organization_id","=",Y).executeTakeFirstOrThrow();return{items:G,totalCount:Number(K.count)}}async getById(Y,Q){let X=await this.db.selectFrom("workflow_collection").selectAll().where("id","=",Y).where("organization_id","=",Q).executeTakeFirst();return X?GS0(X):null}async create(Y){let Q=await this.db.insertInto("workflow_collection").values(Y).returningAll().executeTakeFirstOrThrow();return GS0(Q)}async update(Y,Q,X){return await this.db.updateTable("workflow_collection").set({...X,updated_at:new Date().toISOString()}).where("id","=",Y).where("organization_id","=",Q).returningAll().executeTakeFirstOrThrow()}async delete(Y,Q){return await this.db.deleteFrom("workflow_collection").where("id","=",Y).where("organization_id","=",Q).returningAll().executeTakeFirstOrThrow()}}var WS0=()=>{};function EM4(Y){return{...Y,steps:QX(Y.steps)??[],input:QX(Y.input)??null}}function O$(Y){return{...Y,output:QX(Y.output),error:QX(Y.error),raw_tool_output:QX(Y.raw_tool_output)}}class BH1{db;constructor(Y){this.db=Y}async _createWorkflow(Y,Q){let X=crypto.randomUUID(),J=Date.now();return await Y.insertInto("workflow").values({id:X,workflow_collection_id:Q.workflowCollectionId??null,organization_id:Q.organizationId,steps:JSON.stringify(Q.steps),input:Q.input?JSON.stringify(Q.input):null,virtual_mcp_id:Q.virtualMcpId,created_at_epoch_ms:J,created_by:Q.createdBy??null}).execute(),{id:X}}async createWorkflow(Y){return this._createWorkflow(this.db,Y)}async getWorkflow(Y){let Q=await this.db.selectFrom("workflow").selectAll().where("id","=",Y).executeTakeFirst();return Q?EM4(Q):null}async createExecution(Y){return this.db.transaction().execute(async(Q)=>{let X=Date.now(),{id:J}=await this._createWorkflow(Q,{organizationId:Y.organizationId,workflowCollectionId:Y.workflowCollectionId,virtualMcpId:Y.virtualMcpId,input:Y.input,steps:Y.steps,createdBy:Y.createdBy}),G=crypto.randomUUID(),K=Y.startAtEpochMs??X,W=Y.timeoutMs?K+Y.timeoutMs:null;return await Q.insertInto("workflow_execution").values({id:G,workflow_id:J,organization_id:Y.organizationId,status:"enqueued",input:Y.input?JSON.stringify(Y.input):null,created_at:X,updated_at:X,start_at_epoch_ms:K,timeout_ms:Y.timeoutMs??null,deadline_at_epoch_ms:W,created_by:Y.createdBy??null}).execute(),{id:G}})}async getExecution(Y,Q){return await this.db.selectFrom("workflow_execution").selectAll().where("id","=",Y).where("organization_id","=",Q).executeTakeFirst()??null}async getExecutionFull(Y,Q){let X=await this.db.selectFrom("workflow_execution").selectAll().where("id","=",Y).where("organization_id","=",Q).executeTakeFirst();if(!X)return null;let J=await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).execute();return{execution:X,stepResults:J.map(O$)}}async getExecutionContext(Y){let Q=await this.db.selectFrom("workflow_execution").select(["id","status","workflow_id","deadline_at_epoch_ms"]).where("id","=",Y).executeTakeFirst();if(!Q)return null;let X=await this.db.selectFrom("workflow").select(["steps","input","virtual_mcp_id"]).where("id","=",Q.workflow_id).executeTakeFirst();if(!X)return null;let J=await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).execute();return{execution:{id:Q.id,status:Q.status,workflow_id:Q.workflow_id,deadline_at_epoch_ms:Q.deadline_at_epoch_ms},workflow:{steps:QX(X.steps)??[],input:QX(X.input)??null,virtual_mcp_id:X.virtual_mcp_id},stepResults:J.map(O$)}}async claimExecution(Y){let Q=Date.now(),X=await this.db.updateTable("workflow_execution").set({status:"running",updated_at:Q}).where("id","=",Y).where("status","=","enqueued").returningAll().executeTakeFirst();if(!X)return null;let J=await this.getWorkflow(X.workflow_id);if(!J)throw Error(`Workflow ${X.workflow_id} not found for execution ${Y}`);return{execution:X,workflow:J}}async updateExecution(Y,Q,X){let G={updated_at:Date.now()};if(Q.status!==void 0)G.status=Q.status;if(Q.output!==void 0)G.output=JSON.stringify(Q.output);if(Q.error!==void 0)G.error=JSON.stringify(Q.error);if(Q.completed_at_epoch_ms!==void 0)G.completed_at_epoch_ms=Q.completed_at_epoch_ms;let K=this.db.updateTable("workflow_execution").set(G).where("id","=",Y);if(X?.onlyIfStatus)K=K.where("status","=",X.onlyIfStatus);return await K.returningAll().executeTakeFirst()??null}async cancelExecution(Y,Q){let X=Date.now();return!!await this.db.updateTable("workflow_execution").set({status:"cancelled",updated_at:X}).where("id","=",Y).where("organization_id","=",Q).where("status","in",["enqueued","running"]).returningAll().executeTakeFirst()}async resumeExecution(Y,Q){return this.db.transaction().execute(async(X)=>{let J=Date.now();return await X.deleteFrom("workflow_execution_step_result").where("execution_id","=",Y).where("completed_at_epoch_ms","is",null).execute(),!!await X.updateTable("workflow_execution").set({status:"enqueued",updated_at:J,completed_at_epoch_ms:null}).where("id","=",Y).where("organization_id","=",Q).where("status","=","cancelled").returningAll().executeTakeFirst()})}async listExecutions(Y,Q={}){let{limit:X=50,offset:J=0,status:G}=Q,K=this.db.selectFrom("workflow_execution as we").innerJoin("workflow as w","we.workflow_id","w.id").leftJoin("workflow_collection as wc","w.workflow_collection_id","wc.id").select(["we.id","we.workflow_id","we.organization_id","we.status","we.input","we.output","we.error","we.created_at","we.updated_at","we.start_at_epoch_ms","we.started_at_epoch_ms","we.completed_at_epoch_ms","we.timeout_ms","we.deadline_at_epoch_ms","we.created_by","w.virtual_mcp_id"]).select(($)=>$.fn.coalesce("wc.title",$.val("Workflow Execution")).as("title")).where("we.organization_id","=",Y);if(G)K=K.where("we.status","=",G);let W=await K.orderBy("we.created_at","desc").limit(X).offset(J).execute(),Z=this.db.selectFrom("workflow_execution").select(($)=>$.fn.countAll().as("count")).where("organization_id","=",Y);if(G)Z=Z.where("status","=",G);let H=await Z.executeTakeFirstOrThrow(),F=Number(H.count);return{items:W,totalCount:F,hasMore:J+W.length<F}}async createStepResult(Y){let Q=await this.db.insertInto("workflow_execution_step_result").values({execution_id:Y.execution_id,step_id:Y.step_id,started_at_epoch_ms:Y.completed_at_epoch_ms?Date.now():null,completed_at_epoch_ms:Y.completed_at_epoch_ms??null,output:Y.output!==void 0?JSON.stringify(Y.output):null,error:Y.error!==void 0?JSON.stringify(Y.error):null}).onConflict((X)=>X.columns(["execution_id","step_id"]).doNothing()).returningAll().executeTakeFirst();return Q?O$(Q):null}async updateStepResult(Y,Q,X){let J={};if(X.output!==void 0)J.output=JSON.stringify(X.output);if(X.error!==void 0)J.error=JSON.stringify(X.error);if(X.started_at_epoch_ms!==void 0)J.started_at_epoch_ms=X.started_at_epoch_ms;if(X.completed_at_epoch_ms!==void 0)J.completed_at_epoch_ms=X.completed_at_epoch_ms;if(Object.keys(J).length===0)return null;let G=await this.db.updateTable("workflow_execution_step_result").set(J).where("execution_id","=",Y).where("step_id","=",Q).returningAll().executeTakeFirst();return G?O$(G):null}async checkpointAndTransform(Y,Q,X,J){await this.db.updateTable("workflow_execution_step_result").set({raw_tool_output:JSON.stringify(X)}).where("execution_id","=",Y).where("step_id","=",Q).execute();let G,K;try{let H=await J(X);G=H.output,K=H.error}catch(H){K=H instanceof Error?`Transform failed: ${H.message}`:`Transform failed: ${String(H)}`}let W={completed_at_epoch_ms:Date.now()};if(G!==void 0)W.output=JSON.stringify(G);if(K!==void 0)W.error=JSON.stringify(K);let Z=await this.db.updateTable("workflow_execution_step_result").set(W).where("execution_id","=",Y).where("step_id","=",Q).returningAll().executeTakeFirst();return Z?O$(Z):null}async getStepResult(Y,Q){let X=await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).where("step_id","=",Q).executeTakeFirst();return X?O$(X):null}async getStepResults(Y){return(await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).execute()).map(O$)}async deleteStepResult(Y,Q){await this.db.deleteFrom("workflow_execution_step_result").where("execution_id","=",Y).where("step_id","=",Q).execute()}async getStepResultsByPrefix(Y,Q){return(await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).where("step_id","like",`${Q}%`).orderBy("step_id").execute()).map(O$)}async recoverStuckExecutions(){return this.db.transaction().execute(async(Y)=>{let Q=await Y.selectFrom("workflow_execution").select(["id","organization_id"]).where("status","=","running").execute();if(Q.length===0)return[];let X=Q.map((J)=>J.id);return await Y.updateTable("workflow_execution").set({status:"enqueued",updated_at:Date.now()}).where("id","in",X).where("status","=","running").execute(),Q})}}var ZS0=()=>{};function KS0(Y){let Q=Y.db;return{collections:new qH1(Q),executions:new BH1(Q)}}var HS0=j(()=>{WS0();ZS0()});var FS0,$S0,VS0,qS0,BS0;var US0=j(()=>{k1();tL();DY();FS0={name:"COLLECTION_WORKFLOW_LIST",description:"List workflows with pagination. Does not include steps -- use GET for full details.",inputSchema:q.object({limit:q.number().optional().default(50),offset:q.number().optional().default(0)}),outputSchema:q.object({items:q.array(q.object({id:q.string(),title:q.string(),description:q.string().nullable(),virtual_mcp_id:q.string(),created_at:q.string(),updated_at:q.string()})),totalCount:q.number(),hasMore:q.boolean()}),handler:async(Y,Q)=>{let X=pX(Q);await X.access.check();let J=Y,G=gQ(),{items:K,totalCount:W}=await G.collections.list(X.organization.id,{limit:J.limit,offset:J.offset});return{items:K.map((Z)=>({id:Z.id,title:Z.title,description:Z.description,virtual_mcp_id:Z.virtual_mcp_id,created_at:Z.created_at,updated_at:Z.updated_at})),totalCount:W,hasMore:(J.offset??0)+K.length<W}}},$S0={name:"COLLECTION_WORKFLOW_GET",description:"Get a single workflow by ID, including its steps.",inputSchema:q.object({id:q.string()}),outputSchema:q.object({item:q.object({id:q.string(),title:q.string(),description:q.string().nullable(),virtual_mcp_id:q.string(),steps:q.array(xB),created_at:q.string(),updated_at:q.string()}).nullable()}),handler:async(Y,Q)=>{let X=pX(Q);await X.access.check();let{id:J}=Y,K=await gQ().collections.getById(J,X.organization.id);if(!K)return{item:null};return{item:{id:K.id,title:K.title,description:K.description,virtual_mcp_id:K.virtual_mcp_id,steps:K.steps,created_at:K.created_at,updated_at:K.updated_at}}}},VS0={name:"COLLECTION_WORKFLOW_CREATE",description:`Create a workflow template. This is a reusable definition, not an execution.
+`);return{toolResults:H,agentSummary:U.length>0?U:null,unexecutedTools:$}}finally{await Q.close?.().catch(()=>{})}}async function YH1(Y,Q){let X=t0(),J=Y.organization.id,G=await X.monitorConnections.findByItemId(J,Q.id);if(G){if(await Y.storage.connections.findById(G.connection_id,J))return G.connection_id}let K=hN4(Q);if(!K)throw Error(`Registry item ${Q.id} has no remote URL`);let W=fN4(Y),Z=bN4(Q),H=await Y.storage.connections.create({organization_id:J,created_by:W,title:`[MCP Tester] ${Q.title}`,description:`Auto-created monitor connection for ${Q.id}`,app_name:"private-registry-monitor",app_id:`${vZ}:monitor`,connection_type:Z,connection_url:K,metadata:{monitorConnection:!0,registryItemId:Q.id,pluginId:vZ}});return await X.monitorConnections.upsert({organization_id:J,item_id:Q.id,connection_id:H.id,auth_status:"none"}),H.id}async function iN4(Y){let Q=t0();switch(Y.action){case"unlisted":return await Q.items.update(Y.organizationId,Y.item.id,{is_unlisted:!0}),"unlisted";case"remove_public":return await Q.items.update(Y.organizationId,Y.item.id,{is_public:!1}),"removed_public";case"remove_private":case"remove_all":return await Q.items.delete(Y.organizationId,Y.item.id),Y.action==="remove_all"?"removed_all":"removed_private";default:return"none"}}async function aN4(Y){let Q=Date.now();if(Y.signal.aborted)throw Error("Run cancelled");let X="passed",J=!1,G=!1,K=null,W="none",Z=null,H=[],F=null,$=async()=>{await Y.onProgress?.({status:X,connectionOk:J,toolsListed:G,toolResults:[...H],agentSummary:Z,errorMessage:K,actionTaken:W,durationMs:Date.now()-Q})};try{let V=await YH1(Y.ctx,Y.item);F=await Y.ctx.createMCPProxy(V),J=!0;let U=(await DR(F.listTools?F.listTools():Promise.resolve({tools:[]}),Y.monitorConfig.perMcpTimeoutMs,`listTools ${Y.item.id}`)).tools??[];if(G=!0,Y.monitorConfig.monitorMode!=="health_check")H.push(...U.map((z)=>e31(z.name))),await $();if(Y.monitorConfig.monitorMode==="full_agent"){let z=await nN4({ctx:Y.ctx,monitorConfig:Y.monitorConfig,item:Y.item,proxy:F,tools:U,signal:Y.signal,onProgress:async(O)=>{H.length=0,H.push(...LI0({discoveredTools:U,executedResults:O})),X=O.some((M)=>!M.success)?"failed":"passed",await $()}});if(H.length=0,H.push(...LI0({discoveredTools:U,executedResults:z.toolResults})),Z=z.agentSummary,z.toolResults.some((O)=>!O.success))X="failed";if(z.unexecutedTools.length>0){if(X="failed",!K)K=`Agent skipped ${z.unexecutedTools.length} tool(s): ${z.unexecutedTools.join(", ")}`}}else if(Y.monitorConfig.monitorMode!=="health_check"){for(let z=0;z<U.length;z++){let O=U[z];if(!O||Y.signal.aborted)throw Error("Run cancelled");let M=Date.now();try{let w={},P=await DR(F.callTool({name:O.name,arguments:w}),Y.monitorConfig.perToolTimeoutMs,`tool ${O.name}`),S=!P.isError,C=Date.now()-M;NI0(H,{toolName:O.name,success:S,input:w,durationMs:C,outputPreview:TI0(P.structuredContent??P.content),error:S?null:$d(P.content?.find((E)=>E.type==="text")?.text?.slice(0,300)??"Tool returned error")}),await $()}catch(w){let P=Date.now()-M,S=w instanceof Error?w.message:String(w);NI0(H,{toolName:O.name,success:!1,durationMs:P,error:$d(S)}),await $()}}if(H.some((z)=>!z.success))X="failed"}else for(let z of U)H.push(e31(z.name));if(Y.canApplyFailureAction&&X==="failed"&&Y.monitorConfig.onFailure!=="none")W=await iN4({organizationId:Y.organizationId,item:Y.item,action:Y.monitorConfig.onFailure})}catch(V){if(K=V instanceof Error?V.message:String(V),xN4(V))X="needs_auth",await t0().monitorConnections.updateAuthStatus(Y.organizationId,Y.item.id,"needs_auth");else X="error"}finally{await F?.close?.().catch(()=>{})}return{status:X,connectionOk:J,toolsListed:G,toolResults:H,agentSummary:Z,errorMessage:K,actionTaken:W,durationMs:Date.now()-Q}}async function rN4(Y){let Q=Date.now(),X=t0(),G=(await X.items.list(Y.organizationId,{includeUnlisted:!0})).items.filter((B)=>{if(Y.monitorConfig.testPublicOnly&&!B.is_public)return!1;if(Y.monitorConfig.testPrivateOnly&&B.is_public)return!1;return!0}),K=Y.monitorConfig.includePendingRequests?(await X.publishRequests.list(Y.organizationId,{status:"pending",limit:500})).items.map((B)=>oN4(B)):[],W=[...G.map((B)=>({item:B,source:"registry_item"})),...K.map((B)=>({item:B,source:"publish_request"}))];if(W.length===0){await X.monitorRuns.update(Y.organizationId,Y.runId,{total_items:0,status:"completed",started_at:new Date().toISOString(),finished_at:new Date().toISOString()}),await Hd({ctx:Y.ctx,type:"registry.monitor.completed",subject:Y.runId,data:{runId:Y.runId,total:0}});return}await X.monitorRuns.update(Y.organizationId,Y.runId,{total_items:W.length,status:"running",started_at:new Date().toISOString()});let Z=0,H=0,F=0,$=0;for(let B=0;B<W.length;B++){let U=W[B],z=U?.item;if(!z||Y.signal.aborted){await X.monitorRuns.update(Y.organizationId,Y.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()});return}await X.monitorRuns.update(Y.organizationId,Y.runId,{current_item_id:z.id});let O=null,M=async(P)=>{if(!O){O=(await X.monitorResults.create({run_id:Y.runId,organization_id:Y.organizationId,item_id:z.id,item_title:z.title,status:P.status,error_message:P.errorMessage,connection_ok:P.connectionOk,tools_listed:P.toolsListed,tool_results:P.toolResults,agent_summary:P.agentSummary,duration_ms:P.durationMs,action_taken:P.actionTaken})).id;return}await X.monitorResults.update(Y.organizationId,O,{status:P.status,error_message:P.errorMessage,connection_ok:P.connectionOk,tools_listed:P.toolsListed,tool_results:P.toolResults,agent_summary:P.agentSummary,duration_ms:P.durationMs,action_taken:P.actionTaken})},w=await aN4({ctx:Y.ctx,organizationId:Y.organizationId,item:z,monitorConfig:Y.monitorConfig,signal:Y.signal,canApplyFailureAction:U.source==="registry_item",onProgress:M});if(await M({status:w.status,connectionOk:w.connectionOk,toolsListed:w.toolsListed,toolResults:w.toolResults,agentSummary:w.agentSummary,errorMessage:w.errorMessage,actionTaken:w.actionTaken,durationMs:w.durationMs}),Z+=1,w.status==="passed")H+=1;else if(w.status==="failed"||w.status==="error")F+=1;else $+=1;if(await X.monitorRuns.update(Y.organizationId,Y.runId,{tested_items:Z,passed_items:H,failed_items:F,skipped_items:$}),w.status==="failed"||w.status==="error")await Hd({ctx:Y.ctx,type:"registry.monitor.item_failed",subject:z.id,data:{runId:Y.runId,itemId:z.id,itemTitle:z.title,status:w.status,errorMessage:w.errorMessage,actionTaken:w.actionTaken}})}let V=Date.now()-Q;await X.monitorRuns.update(Y.organizationId,Y.runId,{status:"completed",current_item_id:null,finished_at:new Date().toISOString()}),await Hd({ctx:Y.ctx,type:"registry.monitor.completed",subject:Y.runId,data:{runId:Y.runId,total:Z,passed:H,failed:F,skipped:$,durationMs:V}})}function oN4(Y){return{id:`${K$}${Y.id}`,title:Y.title,description:Y.description,_meta:Y._meta,server:Y.server,is_public:!1,is_unlisted:!0,created_at:Y.created_at,updated_at:Y.updated_at}}async function sN4(Y,Q){let X=EI0(Y);await X.access.check();let J=t0(),G=await J.monitorRuns.create({organization_id:X.organization.id,status:"pending",config_snapshot:Q,started_at:null}),K=new AbortController;return Fd.set(G.id,K),rN4({ctx:X,runId:G.id,organizationId:X.organization.id,monitorConfig:Q,signal:K.signal}).catch(async(W)=>{await J.monitorRuns.update(X.organization.id,G.id,{status:"failed",current_item_id:null,finished_at:new Date().toISOString()}).catch(()=>{}),await Hd({ctx:X,type:"registry.monitor.failed",subject:G.id,data:{runId:G.id,error:W instanceof Error?W.message:String(W)}}),yN4(`Run ${G.id} failed with uncaught error:`,W)}).finally(()=>{Fd.delete(G.id)}),{run:{id:G.id}}}var Fd,AI0="[MONITOR-AGENT]",_N4,vN4="health_check: not called",II0;var Vd=j(()=>{DY();XI0();fB();m7();J8();Fd=new Map,_N4=Sw0;II0={name:"REGISTRY_MONITOR_RUN_START",description:"Start an MCP registry monitor run with an isolated set of monitor connections.",inputSchema:KI0,outputSchema:HI0,handler:async(Y,Q)=>{let J=Zd(Y.config??{}),{run:G}=await sN4(Q,J),W=await t0().monitorRuns.findById(EI0(Q).organization.id,G.id);if(!W)throw Error(`Failed to load monitor run ${G.id}`);return{run:W}}}});var jI0;var SI0=j(()=>{m7();J8();jI0={name:"REGISTRY_MONITOR_RUN_LIST",description:"List MCP registry monitor runs",inputSchema:c31,outputSchema:$I0,handler:O6(c31,async(Y,Q)=>{return t0().monitorRuns.list(Q.organization.id,Y)})}});var _I0;var vI0=j(()=>{m7();J8();_I0={name:"REGISTRY_MONITOR_RUN_GET",description:"Get details for one MCP registry monitor run",inputSchema:n31,outputSchema:VI0,handler:O6(n31,async(Y,Q)=>{return{run:await t0().monitorRuns.findById(Q.organization.id,Y.runId)}})}});var kI0;var yI0=j(()=>{m7();Vd();J8();kI0={name:"REGISTRY_MONITOR_RUN_CANCEL",description:"Cancel a running MCP registry monitor run",inputSchema:p31,outputSchema:FI0,handler:O6(p31,async(Y,Q)=>{return PI0(Y.runId),{run:await t0().monitorRuns.update(Q.organization.id,Y.runId,{status:"cancelled",current_item_id:null,finished_at:new Date().toISOString()})}})}});var fI0;var bI0=j(()=>{m7();J8();fI0={name:"REGISTRY_MONITOR_RESULT_LIST",description:"List results for a given MCP registry monitor run",inputSchema:i31,outputSchema:qI0,handler:O6(i31,async(Y,Q)=>{return t0().monitorResults.listByRun(Q.organization.id,Y.runId,{status:Y.status,limit:Y.limit,offset:Y.offset})})}});var hI0;var xI0=j(()=>{m7();J8();fB();hI0={name:"REGISTRY_MONITOR_CONNECTION_LIST",description:"List monitor connection mappings for private registry MCP monitor runs, including auth status",inputSchema:a31,outputSchema:BI0,handler:O6(a31,async(Y,Q)=>{let X=t0(),J=await X.monitorConnections.list(Q.organization.id);return{items:await Promise.all(J.map(async(K)=>{let W=await X.items.findById(Q.organization.id,K.item_id);if(!W&&K.item_id.startsWith(K$)){let F=K.item_id.slice(K$.length),$=await X.publishRequests.findById(Q.organization.id,F);if($)W={id:K.item_id,title:$.title,description:$.description,_meta:$._meta,server:$.server,is_public:!1,is_unlisted:!0,created_at:$.created_at,updated_at:$.updated_at}}let Z=W?.server.remotes?.find((F)=>F.url)?.url??null,H=K.item_id.startsWith(K$)?"request":"store";return{mapping:K,item:W,remoteUrl:Z,source:H}}))}})}});function tN4(Y){return{id:`${K$}${Y.id}`,title:Y.title,description:Y.description,_meta:Y._meta,server:Y.server,is_public:!1,is_unlisted:!0,created_at:Y.created_at,updated_at:Y.updated_at}}var gI0;var uI0=j(()=>{m7();Vd();J8();fB();gI0={name:"REGISTRY_MONITOR_CONNECTION_SYNC",description:"Ensure every registry item has a dedicated monitor connection mapping for MCP monitors",inputSchema:r31,outputSchema:UI0,handler:O6(r31,async(Y,Q)=>{let X=t0(),J=(await X.items.list(Q.organization.id,{includeUnlisted:!0})).items,K=(await X.publishRequests.list(Q.organization.id,{status:"pending",limit:500})).items.map(tN4),W=[...J,...K],Z=await X.monitorConnections.list(Q.organization.id),H=new Set(Z.map(($)=>$.item_id)),F=0;for(let $ of W){if(!$.server.remotes?.some((V)=>V.url))continue;if(await YH1(Q,$),!H.has($.id))F+=1}return{created:F,updated:Math.max(W.length-F,0)}})}});var mI0;var lI0=j(()=>{m7();J8();mI0={name:"REGISTRY_MONITOR_CONNECTION_UPDATE_AUTH",description:"Update the auth_status of a monitor connection mapping (by core connection ID)",inputSchema:o31,outputSchema:zI0,handler:O6(o31,async({connectionId:Y,authStatus:Q},X)=>{let J=t0(),G=X.organization.id,K=await J.monitorConnections.findByConnectionId(G,Y);if(!K)throw Error(`No monitor connection mapping found for connection ${Y}`);return await J.monitorConnections.updateAuthStatus(G,K.item_id,Q),{success:!0}})}});function OR(Y){if(!Y||typeof Y!=="object")return null;let Q=Y,X=Q.id;if(typeof X==="string"&&X.length>0)return X;for(let J of["event","result","structuredContent","content"]){let G=Q[J],K=OR(G);if(K)return K}if(Array.isArray(Y))for(let J of Y){let G=OR(J);if(G)return G}return null}var dI0;var pI0=j(()=>{DY();m7();J8();dI0={name:"REGISTRY_MONITOR_SCHEDULE_SET",description:"Schedule recurring MCP monitor runs via EVENT_PUBLISH cron",inputSchema:s31,outputSchema:DI0,handler:O6(s31,async(Y,Q)=>{let X=u9.SELF(Q.organization.id),J=await Q.createMCPProxy(X);try{let G=await J.callTool({name:"EVENT_PUBLISH",arguments:{type:"registry.monitor.scheduled",subject:"private-registry",cron:Y.cronExpression,data:{config:Y.config??{}}}});if(G.isError)throw Error("Failed to create monitor schedule via EVENT_PUBLISH");let K=OR(G.structuredContent)??OR(G.content)??OR(G);if(!K)throw Error("Could not resolve schedule event id from EVENT_PUBLISH");return{scheduleEventId:K}}finally{await J.close?.().catch(()=>{})}})}});var cI0;var nI0=j(()=>{DY();m7();J8();cI0={name:"REGISTRY_MONITOR_SCHEDULE_CANCEL",description:"Cancel a recurring MCP monitor schedule via EVENT_CANCEL",inputSchema:t31,outputSchema:OI0,handler:O6(t31,async(Y,Q)=>{let X=u9.SELF(Q.organization.id),J=await Q.createMCPProxy(X);try{if((await J.callTool({name:"EVENT_CANCEL",arguments:{eventId:Y.scheduleEventId}})).isError)throw Error("Failed to cancel monitor schedule via EVENT_CANCEL");return{success:!0}}finally{await J.close?.().catch(()=>{})}})}});function eN4(Y,Q){if(!Q)return Y;let X={field:["is_public"],operator:"eq",value:!1};if(!Y)return X;return{operator:"and",conditions:[Y,X]}}function YM4(Y){let Q=new Map,X=new Map;for(let G of Y){let K=G._meta?.["mcp.mesh"];for(let W of K?.tags??[])Q.set(W,(Q.get(W)??0)+1);for(let W of K?.categories??[])X.set(W,(X.get(W)??0)+1)}let J=(G)=>Array.from(G.entries()).map(([K,W])=>({value:K,count:W})).sort((K,W)=>K.value.localeCompare(W.value));return{tags:J(Q),categories:J(X)}}var iI0,aI0,rI0,oI0;var sI0=j(()=>{k1();v9();J8();iI0={name:"COLLECTION_REGISTRY_APP_LIST",description:"List registry items for Store discovery. Supports private-only mode from plugin settings.",inputSchema:H$,outputSchema:eL,handler:O6(H$,async(Y,Q)=>{let X=t0(),J=await sC(Q,Q.organization.id);return X.items.list(Q.organization.id,{...Y,where:eN4(Y.where,J.storePrivateOnly===!0)})})},aI0={name:"COLLECTION_REGISTRY_APP_GET",description:"Get a registry item for Store details. Respects private-only mode from plugin settings.",inputSchema:mX,outputSchema:uB,handler:O6(mX,async(Y,Q)=>{let X=t0(),J=await sC(Q,Q.organization.id),G=Y.id??Y.name;if(!G)return{item:null};let K=await X.items.findByIdOrName(Q.organization.id,G);if(!K)return{item:null};if(J.storePrivateOnly&&K.is_public)return{item:null};return{item:K}})},rI0={name:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get registry item versions for Store details. Respects private-only mode from plugin settings.",inputSchema:mX,outputSchema:q.object({versions:q.array(cG)}),handler:O6(mX,async(Y,Q)=>{let X=t0(),J=await sC(Q,Q.organization.id),G=Y.id??Y.name;if(!G)return{versions:[]};let K=await X.items.findByIdOrName(Q.organization.id,G);if(!K)return{versions:[]};if(J.storePrivateOnly&&K.is_public)return{versions:[]};return{versions:[K]}})},oI0={name:"COLLECTION_REGISTRY_APP_FILTERS",description:"List Store filter facets for registry items. Respects private-only mode from plugin settings.",inputSchema:q.object({}),outputSchema:YN,handler:O6(q.object({}),async(Y,Q)=>{let X=t0();if(!(await sC(Q,Q.organization.id)).storePrivateOnly)return X.items.getFilters(Q.organization.id);let G=await X.items.list(Q.organization.id,{limit:1e4,where:{field:["is_public"],operator:"eq",value:!1}});return YM4(G.items)})}});var tI0;var eI0=j(()=>{wP0();PP0();TP0();RP0();E20();C20();I20();S20();v20();y20();b20();x20();u20();l20();p20();n20();a20();o20();Vd();SI0();vI0();yI0();bI0();xI0();uI0();lI0();pI0();nI0();sI0();tI0=[iI0,aI0,rI0,oI0,j20,_20,R20,f20,EP0,MP0,k20,CP0,T20,P20,AP0,h20,g20,m20,d20,c20,i20,r20,II0,jI0,_I0,kI0,fI0,hI0,gI0,mI0,dI0,cI0]});var Yj0;var Qj0=j(()=>{fB();nw0();qP0();NP0();eI0();m7();Yj0={id:vZ,description:jw0,tools:tI0,migrations:cw0,publicRoutes:(Y,Q)=>{wK1(Y,Q),LK1(Y,Q)},createStorage:LP0,onEvents:{types:["registry.monitor.scheduled"],handler:async(Y,Q)=>{let X=await Q.createMCPProxy(Q.connectionId);try{for(let J of Y){if(J.type!=="registry.monitor.scheduled")continue;let G=J.data&&typeof J.data==="object"?J.data:{},K=G.config&&typeof G.config==="object"?G.config:{},W=Zd(K);await X.callTool({name:"REGISTRY_MONITOR_RUN_START",arguments:{config:W}})}}finally{await X.close()}}}}});var qd="user-sandbox",Xj0="Create embeddable integration flows for platform end-users";import{sql as LR}from"kysely";var Jj0;var Gj0=j(()=>{Jj0={name:"001-user-sandbox",async up(Y){await Y.schema.createTable("user_sandbox").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(Q)=>Q.notNull()).addColumn("description","text").addColumn("icon","text").addColumn("required_apps","text",(Q)=>Q.notNull()).addColumn("redirect_url","text").addColumn("webhook_url","text").addColumn("event_type","text",(Q)=>Q.notNull().defaultTo("integration.completed")).addColumn("agent_title_template","text",(Q)=>Q.notNull().defaultTo("Agent for {{externalUserId}}")).addColumn("agent_instructions","text").addColumn("tool_selection_mode","text",(Q)=>Q.notNull().defaultTo("inclusion")).addColumn("status","text",(Q)=>Q.notNull().defaultTo("active")).addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("created_by","text",(Q)=>Q.references("user.id").onDelete("set null")).execute(),await Y.schema.createIndex("idx_user_sandbox_org").on("user_sandbox").column("organization_id").execute(),await Y.schema.createTable("user_sandbox_sessions").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("template_id","text",(Q)=>Q.notNull().references("user_sandbox.id").onDelete("cascade")).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("external_user_id","text",(Q)=>Q.notNull()).addColumn("status","text",(Q)=>Q.notNull().defaultTo("pending")).addColumn("app_statuses","text",(Q)=>Q.notNull().defaultTo("{}")).addColumn("created_agent_id","text",(Q)=>Q.references("connections.id").onDelete("set null")).addColumn("redirect_url","text").addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).addColumn("expires_at","text",(Q)=>Q.notNull()).execute(),await Y.schema.createIndex("idx_user_sandbox_sessions_template").on("user_sandbox_sessions").column("template_id").execute(),await Y.schema.createIndex("idx_user_sandbox_sessions_external_user").on("user_sandbox_sessions").columns(["template_id","external_user_id"]).execute(),await Y.schema.createIndex("idx_user_sandbox_sessions_org").on("user_sandbox_sessions").column("organization_id").execute(),await Y.schema.createTable("user_sandbox_agents").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("user_sandbox_id","text",(Q)=>Q.notNull().references("user_sandbox.id").onDelete("cascade")).addColumn("external_user_id","text",(Q)=>Q.notNull()).addColumn("connection_id","text",(Q)=>Q.notNull().references("connections.id").onDelete("cascade")).addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(LR`CURRENT_TIMESTAMP`)).execute(),await Y.schema.createIndex("idx_user_sandbox_agents_unique").on("user_sandbox_agents").columns(["user_sandbox_id","external_user_id"]).unique().execute(),await Y.schema.createIndex("idx_user_sandbox_agents_connection").on("user_sandbox_agents").column("connection_id").execute()},async down(Y){await Y.schema.dropIndex("idx_user_sandbox_agents_connection").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_agents_unique").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_sessions_org").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_sessions_external_user").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_sessions_template").ifExists().execute(),await Y.schema.dropIndex("idx_user_sandbox_org").ifExists().execute(),await Y.schema.dropTable("user_sandbox_agents").ifExists().execute(),await Y.schema.dropTable("user_sandbox_sessions").ifExists().execute(),await Y.schema.dropTable("user_sandbox").ifExists().execute()}}});var Wj0;var Zj0=j(()=>{Gj0();Wj0=[Jj0]});function Bd(Y){let Q=Date.now().toString(36),X=crypto.randomUUID().replace(/-/g,"").substring(0,8);return`${Y}_${Q}${X}`}class NR{db;constructor(Y){this.db=Y}async create(Y){let Q=Bd("usb"),X=new Date().toISOString(),J={id:Q,organization_id:Y.organization_id,title:Y.title,description:Y.description??null,icon:Y.icon??null,required_apps:JSON.stringify(Y.required_apps),redirect_url:Y.redirect_url??null,webhook_url:Y.webhook_url??null,event_type:Y.event_type??"integration.completed",agent_title_template:Y.agent_title_template??"{{externalUserId}}'s Agent",agent_instructions:Y.agent_instructions??null,tool_selection_mode:Y.tool_selection_mode??"inclusion",status:"active",created_at:X,updated_at:X,created_by:Y.created_by??null};await this.db.insertInto("user_sandbox").values(J).execute();let G=await this.findById(Q);if(!G)throw Error(`Failed to create user sandbox with id: ${Q}`);return G}async findById(Y){let Q=await this.db.selectFrom("user_sandbox").selectAll().where("id","=",Y).executeTakeFirst();if(!Q)return null;return this.deserialize(Q)}async list(Y){return(await this.db.selectFrom("user_sandbox").selectAll().where("organization_id","=",Y).orderBy("created_at","desc").execute()).map((X)=>this.deserialize(X))}async update(Y,Q){let J={updated_at:new Date().toISOString()};if(Q.title!==void 0)J.title=Q.title;if(Q.description!==void 0)J.description=Q.description;if(Q.icon!==void 0)J.icon=Q.icon;if(Q.required_apps!==void 0)J.required_apps=JSON.stringify(Q.required_apps);if(Q.redirect_url!==void 0)J.redirect_url=Q.redirect_url;if(Q.webhook_url!==void 0)J.webhook_url=Q.webhook_url;if(Q.event_type!==void 0)J.event_type=Q.event_type;if(Q.agent_title_template!==void 0)J.agent_title_template=Q.agent_title_template;if(Q.agent_instructions!==void 0)J.agent_instructions=Q.agent_instructions;if(Q.tool_selection_mode!==void 0)J.tool_selection_mode=Q.tool_selection_mode;if(Q.status!==void 0)J.status=Q.status;await this.db.updateTable("user_sandbox").set(J).where("id","=",Y).execute();let G=await this.findById(Y);if(!G)throw Error(`Template not found after update: ${Y}`);return G}async delete(Y){await this.db.deleteFrom("user_sandbox").where("id","=",Y).execute()}deserialize(Y){let Q=[];try{Q=JSON.parse(Y.required_apps)}catch{Q=[]}return{id:Y.id,organization_id:Y.organization_id,title:Y.title,description:Y.description,icon:Y.icon,required_apps:Q,redirect_url:Y.redirect_url,webhook_url:Y.webhook_url,event_type:Y.event_type,agent_title_template:Y.agent_title_template,agent_instructions:Y.agent_instructions,tool_selection_mode:Y.tool_selection_mode,status:Y.status,created_at:Y.created_at,updated_at:Y.updated_at,created_by:Y.created_by}}}var QH1=()=>{};class MR{db;constructor(Y){this.db=Y}async create(Y){let Q=Bd("sandbox_session"),X=new Date().toISOString(),J={id:Q,template_id:Y.template_id,organization_id:Y.organization_id,external_user_id:Y.external_user_id,status:"pending",app_statuses:"{}",created_agent_id:Y.created_agent_id??null,redirect_url:Y.redirect_url??null,created_at:X,updated_at:X,expires_at:Y.expires_at};await this.db.insertInto("user_sandbox_sessions").values(J).execute();let G=await this.findById(Q);if(!G)throw Error(`Failed to create session with id: ${Q}`);return G}async findById(Y){let Q=await this.db.selectFrom("user_sandbox_sessions").selectAll().where("id","=",Y).executeTakeFirst();if(!Q)return null;return this.deserialize(Q)}async findExisting(Y,Q){let X=new Date().toISOString(),J=await this.db.selectFrom("user_sandbox_sessions").selectAll().where("template_id","=",Y).where("external_user_id","=",Q).where("expires_at",">",X).where("status","!=","completed").orderBy("created_at","desc").executeTakeFirst();if(!J)return null;return this.deserialize(J)}async listByTemplate(Y){return(await this.db.selectFrom("user_sandbox_sessions").selectAll().where("template_id","=",Y).orderBy("created_at","desc").execute()).map((X)=>this.deserialize(X))}async listByOrganization(Y){return(await this.db.selectFrom("user_sandbox_sessions").selectAll().where("organization_id","=",Y).orderBy("created_at","desc").execute()).map((X)=>this.deserialize(X))}async update(Y,Q){let J={updated_at:new Date().toISOString()};if(Q.status!==void 0)J.status=Q.status;if(Q.app_statuses!==void 0)J.app_statuses=JSON.stringify(Q.app_statuses);if(Q.created_agent_id!==void 0)J.created_agent_id=Q.created_agent_id;await this.db.updateTable("user_sandbox_sessions").set(J).where("id","=",Y).execute();let G=await this.findById(Y);if(!G)throw Error(`Session not found after update: ${Y}`);return G}async delete(Y){await this.db.deleteFrom("user_sandbox_sessions").where("id","=",Y).execute()}async deleteExpired(){let Y=new Date().toISOString(),Q=await this.db.deleteFrom("user_sandbox_sessions").where("expires_at","<",Y).where("status","!=","completed").executeTakeFirst();return Number(Q.numDeletedRows??0)}async deleteByExternalUserId(Y,Q){let X=await this.db.deleteFrom("user_sandbox_sessions").where("organization_id","=",Y).where("external_user_id","=",Q).executeTakeFirst();return Number(X.numDeletedRows??0)}deserialize(Y){let Q={};try{Q=JSON.parse(Y.app_statuses)}catch{Q={}}return{id:Y.id,template_id:Y.template_id,organization_id:Y.organization_id,external_user_id:Y.external_user_id,status:Y.status,app_statuses:Q,created_agent_id:Y.created_agent_id,redirect_url:Y.redirect_url,created_at:Y.created_at,updated_at:Y.updated_at,expires_at:Y.expires_at}}}var XH1=()=>{};function wR(Y){JH1=Y}function q5(){if(!JH1)throw Error(`Plugin storage not initialized. Make sure the "${qd}" plugin is enabled.`);return JH1}function GH1(){return process.env.BASE_URL||"http://localhost:3000"}var JH1=null;var sG=()=>{};function Kj0(Y){let Q=Y.db,X={templates:new NR(Q),sessions:new MR(Q)};return wR(X),X}var Hj0=j(()=>{QH1();XH1();sG()});var QM4,XM4,JM4,GM4,WM4,z$,ZM4,Fj0,$j0,Vj0,qj0,Bj0,Uj0,zj0,Dj0,Oj0,Lj0,Nj0,KM4,Mj0,wj0,Aj0;var uZ=j(()=>{k1();QM4=q.object({authorizationEndpoint:q.string().describe("OAuth authorization endpoint URL"),tokenEndpoint:q.string().describe("OAuth token endpoint URL"),clientId:q.string().describe("OAuth client ID"),scopes:q.array(q.string()).describe("OAuth scopes to request"),grantType:q.enum(["authorization_code","client_credentials"]).describe("OAuth grant type")}),XM4=q.object({headers:q.record(q.string(),q.string()).optional().describe("HTTP headers")}),JM4=q.object({command:q.string().describe("Command to run"),args:q.array(q.string()).optional().describe("Command arguments"),cwd:q.string().optional().describe("Working directory"),envVars:q.record(q.string(),q.string()).optional().describe("Environment variables")}),GM4=q.object({app_name:q.string().describe("App name from registry (e.g., '@deco/gmail')"),title:q.string().describe("Display title for the app"),description:q.string().nullable().optional().describe("App description"),icon:q.string().nullable().optional().describe("Icon URL"),connection_type:q.enum(["HTTP","SSE","Websocket","STDIO"]).describe("Connection type"),connection_url:q.string().nullable().optional().describe("MCP server URL"),connection_headers:q.union([XM4,JM4]).nullable().optional().describe("Connection parameters"),oauth_config:QM4.nullable().optional().describe("OAuth configuration if required"),selected_tools:q.array(q.string()).nullable().optional().describe("Selected tools to expose (null = all)"),selected_resources:q.array(q.string()).nullable().optional().describe("Selected resources to expose (null = all)"),selected_prompts:q.array(q.string()).nullable().optional().describe("Selected prompts to expose (null = all)")}),WM4=q.object({configured:q.boolean().describe("Whether the app has been configured"),connection_id:q.string().nullable().describe("Connection ID if created"),error:q.string().nullable().describe("Error message if configuration failed")}),z$=q.object({id:q.string(),organization_id:q.string(),title:q.string(),description:q.string().nullable(),icon:q.string().nullable(),required_apps:q.array(GM4),redirect_url:q.string().nullable(),webhook_url:q.string().nullable(),event_type:q.string(),agent_title_template:q.string(),agent_instructions:q.string().nullable(),tool_selection_mode:q.enum(["inclusion","exclusion"]),status:q.enum(["active","inactive"]),created_at:q.string(),updated_at:q.string(),created_by:q.string().nullable()}),ZM4=q.object({id:q.string(),template_id:q.string(),organization_id:q.string(),external_user_id:q.string(),status:q.enum(["pending","in_progress","completed"]),app_statuses:q.record(q.string(),WM4),created_agent_id:q.string().nullable(),redirect_url:q.string().nullable(),created_at:q.string(),updated_at:q.string(),expires_at:q.string()}),Fj0=q.object({app_name:q.string().describe("App name from registry (e.g., '@deco/openrouter')"),selected_tools:q.array(q.string()).nullable().optional().describe("Selected tools to expose (null = all)"),selected_resources:q.array(q.string()).nullable().optional().describe("Selected resources to expose (null = all)"),selected_prompts:q.array(q.string()).nullable().optional().describe("Selected prompts to expose (null = all)")}),$j0=q.object({title:q.string().describe("Title for the template"),description:q.string().optional().describe("Optional description"),icon:q.string().optional().describe("Optional icon URL"),registry_id:q.string().describe("Connection ID of the registry to look up apps from"),required_apps:q.array(Fj0).describe("Apps to include - only app_name required, details fetched from registry"),redirect_url:q.string().optional().describe("URL to redirect to after completion"),webhook_url:q.string().optional().describe("Webhook URL to call on completion"),event_type:q.string().optional().describe("Event type to emit (default: integration.completed)"),agent_title_template:q.string().optional().describe("Template for agent title (supports {{externalUserId}})"),agent_instructions:q.string().optional().describe("Instructions for the created agent"),tool_selection_mode:q.enum(["inclusion","exclusion"]).optional().describe("Tool selection mode for the agent")}),Vj0=q.object({id:q.string().describe("Template ID to update"),title:q.string().optional(),description:q.string().nullable().optional(),icon:q.string().nullable().optional(),registry_id:q.string().optional().describe("Connection ID of the registry (required if updating required_apps)"),required_apps:q.array(Fj0).optional().describe("Updated apps (details will be fetched from registry)"),redirect_url:q.string().nullable().optional(),webhook_url:q.string().nullable().optional(),event_type:q.string().optional(),agent_title_template:q.string().optional(),agent_instructions:q.string().nullable().optional(),tool_selection_mode:q.enum(["inclusion","exclusion"]).optional(),status:q.enum(["active","inactive"]).optional()}),qj0=q.object({id:q.string().describe("Template ID")}),Bj0=q.object({}),Uj0=q.object({id:q.string().describe("Template ID to delete")}),zj0=q.object({templateId:q.string().describe("Template ID"),externalUserId:q.string().describe("External user ID from your platform"),expiresInSeconds:q.number().optional().describe("Session expiration in seconds (default: 7 days)")}),Dj0=q.object({sessionId:q.string().describe("Session ID"),url:q.string().describe("URL for the connect flow"),expiresAt:q.string().describe("Session expiration time"),agentId:q.string().nullable().optional().describe("Virtual MCP ID for this user (unique per template + user)"),created:q.boolean().describe("Whether the agent was newly created (true) or already existed (false)")}),Oj0=q.object({templateId:q.string().optional().describe("Filter by template ID")}),Lj0=q.object({sessions:q.array(ZM4)}),Nj0=q.object({externalUserId:q.string().describe("External user ID to find agents for")}),KM4=q.object({id:q.string().describe("Agent (Virtual MCP) ID"),title:q.string(),external_user_id:q.string(),template_id:q.string().nullable(),created_at:q.string()}),Mj0=q.object({agents:q.array(KM4)}),wj0=q.object({externalUserId:q.string().describe("External user ID whose session data should be cleared")}),Aj0=q.object({success:q.boolean(),deletedAgents:q.number().describe("Number of agents (Virtual MCPs) deleted"),deletedConnections:q.number().describe("Number of child connections deleted"),deletedSessions:q.number().describe("Number of sessions deleted")})});function FM4(Y){if(!Y?.url)return null;try{let Q=new URL(Y.url);if(Q.hostname==="github.com"){let X=Q.pathname.split("/").filter(Boolean);if(X.length>=1)return`https://github.com/${X[0]}.png`}}catch{}return null}function $M4(Y){return Y.find((X)=>X.name.endsWith("_LIST"))?.name??null}function VM4(Y){if(!Y)return[];if(Array.isArray(Y))return Y;if(typeof Y==="object"&&Y!==null){let Q=Object.keys(Y).find((X)=>Array.isArray(Y[X]));if(Q)return Y[Q]}return[]}function qM4(Y,Q,X,J){let G=Y.server,K=Y._meta?.["mcp.mesh"],W=K?.friendlyName||K?.friendly_name||Y.title||G?.title||G?.name||"Unnamed MCP Server",Z=G?.description||null,H=G?.icons?.[0]?.src||FM4(G?.repository)||null,F=K?.oauth_config,$=F&&typeof F.authorizationEndpoint==="string"&&typeof F.tokenEndpoint==="string"&&typeof F.clientId==="string"&&Array.isArray(F.scopes)&&(F.grantType==="authorization_code"||F.grantType==="client_credentials")?{authorizationEndpoint:F.authorizationEndpoint,tokenEndpoint:F.tokenEndpoint,clientId:F.clientId,scopes:F.scopes,grantType:F.grantType}:null,V=G?.packages??[],B=G?.remotes??[],U,z,O=null,M=B[0],w=V[0];if(M){if(U=HM4[M.type??""]??M.type?.toUpperCase()??"HTTP",z=M.url??null,M.headers&&M.headers.length>0){let P={};for(let S of M.headers)if(S.name&&S.value)P[S.name]=S.value;if(Object.keys(P).length>0)O={headers:P}}}else if(w){U="STDIO",z=null;let P=w.identifier||w.name,S={};if(w.environmentVariables){for(let C of w.environmentVariables)if(C.name)S[C.name]=""}O={command:"npx",args:P?["-y",P]:[],...Object.keys(S).length>0&&{envVars:S}}}else U="HTTP",z=null;return{title:W,description:Z,icon:H,connection_type:U,connection_url:z,connection_headers:O,oauth_config:$,selected_tools:Q,selected_resources:X,selected_prompts:J}}async function BM4(Y,Q,X,J=null,G=null,K=null){let W=await Y.createMCPProxy(Q);try{let Z=await W.listTools(),H=$M4(Z.tools);if(!H)throw Error(`Registry "${Q}" does not have a LIST tool`);let F=await W.callTool({name:H,arguments:{where:{appName:X}}}),$=F.structuredContent??F,B=VM4($)[0];if(!B)throw Error(`App "${X}" not found in registry "${Q}"`);let U=qM4(B,J,G,K);return{app_name:X,...U}}finally{await W.close().catch(console.error)}}async function Ud(Y,Q,X){let J=[];for(let G of X){let K=await BM4(Y,Q,G.app_name,G.selected_tools??null,G.selected_resources??null,G.selected_prompts??null);J.push(K)}return J}var HM4;var WH1=j(()=>{HM4={"streamable-http":"HTTP",http:"HTTP",sse:"SSE",stdio:"STDIO",websocket:"Websocket"}});var Pj0;var Ej0=j(()=>{uZ();sG();WH1();Pj0={name:"USER_SANDBOX_CREATE",description:"Create a new user sandbox for platform integration flows. Specify apps by name and the system will automatically fetch connection details from the registry.",inputSchema:$j0,outputSchema:z$,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=await Ud(J,X.registry_id,X.required_apps.map((Z)=>({app_name:Z.app_name,selected_tools:Z.selected_tools??null,selected_resources:Z.selected_resources??null,selected_prompts:Z.selected_prompts??null})));return await q5().templates.create({organization_id:J.organization.id,title:X.title,description:X.description??null,icon:X.icon??null,required_apps:G,redirect_url:X.redirect_url??null,webhook_url:X.webhook_url??null,event_type:X.event_type,agent_title_template:X.agent_title_template,agent_instructions:X.agent_instructions??null,tool_selection_mode:X.tool_selection_mode,created_by:J.auth.user?.id??null})}}});var Tj0;var Cj0=j(()=>{uZ();sG();WH1();Tj0={name:"USER_SANDBOX_UPDATE",description:"Update an existing user sandbox. If updating required_apps, provide registry_id to auto-fetch details.",inputSchema:Vj0,outputSchema:z$,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K=await G.templates.findById(X.id);if(!K)throw Error(`Template not found: ${X.id}`);if(K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");let W=void 0;if(X.required_apps&&X.required_apps.length>0){if(!X.registry_id)throw Error("registry_id is required when updating required_apps");W=await Ud(J,X.registry_id,X.required_apps.map((H)=>({app_name:H.app_name,selected_tools:H.selected_tools??null,selected_resources:H.selected_resources??null,selected_prompts:H.selected_prompts??null})))}return await G.templates.update(X.id,{title:X.title,description:X.description,icon:X.icon,required_apps:W,redirect_url:X.redirect_url,webhook_url:X.webhook_url,event_type:X.event_type,agent_title_template:X.agent_title_template,agent_instructions:X.agent_instructions,tool_selection_mode:X.tool_selection_mode,status:X.status})}}});var Rj0;var Ij0=j(()=>{k1();uZ();sG();Rj0={name:"USER_SANDBOX_DELETE",description:"Delete a user sandbox",inputSchema:Uj0,outputSchema:q.object({success:q.boolean(),id:q.string()}),handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K=await G.templates.findById(X.id);if(!K)throw Error(`Template not found: ${X.id}`);if(K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");return await G.templates.delete(X.id),{success:!0,id:X.id}}}});var jj0;var Sj0=j(()=>{k1();uZ();sG();jj0={name:"USER_SANDBOX_LIST",description:"List all user sandbox in the organization",inputSchema:Bj0,outputSchema:q.object({templates:q.array(z$)}),handler:async(Y,Q)=>{let X=Q;if(!X.organization)throw Error("Organization context required");return await X.access.check(),{templates:await q5().templates.list(X.organization.id)}}}});var _j0;var vj0=j(()=>{uZ();sG();_j0={name:"USER_SANDBOX_GET",description:"Get a user sandbox by ID",inputSchema:qj0,outputSchema:z$,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let K=await q5().templates.findById(X.id);if(K&&K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");return K}}});async function kj0(Y,Q){let X=await Q.sessions.findById(Y);if(!X)throw new _3("Session not found","SESSION_NOT_FOUND");if(new Date(X.expires_at)<new Date)throw new _3("Session has expired","SESSION_EXPIRED");return X}async function UM4(Y,Q){let X=await kj0(Y,Q);if(X.status==="completed")throw new _3("Session is already completed. Create a new session to reconfigure.","SESSION_COMPLETED");return X}function zM4(Y,Q){let X=Y.metadata;if(!X)throw new _3("Connection has no metadata","CONNECTION_ACCESS_DENIED");let J=X[D$.SESSION_ID]===Q.id,G=X[D$.EXTERNAL_USER_ID]===Q.external_user_id&&X[D$.TEMPLATE_ID]===Q.template_id;if(!J&&!G)throw new _3("Access denied: connection does not belong to this session","CONNECTION_ACCESS_DENIED")}function ZH1(Y,Q,X){return{[D$.SESSION_ID]:Y,[D$.EXTERNAL_USER_ID]:Q,[D$.TEMPLATE_ID]:X,source:"user-sandbox"}}function KH1(Y,Q){return{[D$.EXTERNAL_USER_ID]:Y,[D$.TEMPLATE_ID]:Q,source:"user-sandbox"}}async function eB(Y,Q,X){let J=X?.allowCompleted?await kj0(Y,Q):await UM4(Y,Q);if(X?.connection)zM4(X.connection,J);return J}var D$,_3;var yj0=j(()=>{D$={SESSION_ID:"user_sandbox_session_id",EXTERNAL_USER_ID:"user_sandbox_external_user_id",TEMPLATE_ID:"user_sandbox_id"};_3=class _3 extends Error{code;constructor(Y,Q){super(Y);this.code=Q;this.name="SessionAccessError"}}});var HH1=j(()=>{yj0()});async function OM4(Y,Q,X,J,G,K,W,Z){let H=Y,F=await H.selectFrom("user_sandbox_agents").select("connection_id").where("user_sandbox_id","=",J).where("external_user_id","=",G).executeTakeFirst();if(F)return{connectionId:F.connection_id,created:!1};let $=new Date().toISOString(),V=`usa_${Date.now().toString(36)}${crypto.randomUUID().replace(/-/g,"").substring(0,8)}`,B=`vir_${Date.now().toString(36)}${crypto.randomUUID().replace(/-/g,"").substring(0,8)}`;try{return await H.transaction().execute(async(U)=>{await U.insertInto("connections").values({id:B,organization_id:Q,created_by:X,title:K,description:W,icon:null,app_name:null,app_id:null,connection_type:"VIRTUAL",connection_url:`virtual://${B}`,connection_token:null,connection_headers:JSON.stringify({tool_selection_mode:Z}),oauth_config:null,configuration_state:null,configuration_scopes:null,metadata:JSON.stringify(KH1(G,J)),tools:null,bindings:null,status:"active",created_at:$,updated_at:$}).execute(),await U.insertInto("user_sandbox_agents").values({id:V,user_sandbox_id:J,external_user_id:G,connection_id:B,created_at:$}).execute()}),{connectionId:B,created:!0}}catch(U){let z=String(U);if(z.includes("UNIQUE constraint")||z.includes("duplicate key")){let O=await H.selectFrom("user_sandbox_agents").select("connection_id").where("user_sandbox_id","=",J).where("external_user_id","=",G).executeTakeFirst();if(O)return{connectionId:O.connection_id,created:!1}}throw U}}var DM4=604800,fj0;var bj0=j(()=>{uZ();sG();HH1();fj0={name:"USER_SANDBOX_CREATE_SESSION",description:"Create a connect session URL for an external user. Returns a URL that the user can visit to configure their integrations. Also creates a unique Virtual MCP (agent) for this user if one doesn't exist.",inputSchema:zj0,outputSchema:Dj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K=await G.templates.findById(X.templateId);if(!K)throw Error(`Template not found: ${X.templateId}`);if(K.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");if(K.status!=="active")throw Error("Template is not active");let W=K.agent_title_template.replace("{{externalUserId}}",X.externalUserId),Z=K.created_by??J.auth.user?.id??"system",{connectionId:H,created:F}=await OM4(J.db,J.organization.id,Z,K.id,X.externalUserId,W,K.agent_instructions,K.tool_selection_mode),$=await G.sessions.findExisting(X.templateId,X.externalUserId);if($){if(!$.created_agent_id)await G.sessions.update($.id,{created_agent_id:H});let O=GH1();return{sessionId:$.id,url:`${O}/connect/${$.id}`,expiresAt:$.expires_at,agentId:$.created_agent_id??H,created:F}}let V=X.expiresInSeconds??DM4,B=new Date(Date.now()+V*1000).toISOString(),U=await G.sessions.create({template_id:X.templateId,organization_id:J.organization.id,external_user_id:X.externalUserId,redirect_url:K.redirect_url,expires_at:B,created_agent_id:H}),z=GH1();return{sessionId:U.id,url:`${z}/connect/${U.id}`,expiresAt:U.expires_at,agentId:H,created:F}}}});var hj0;var xj0=j(()=>{uZ();sG();hj0={name:"USER_SANDBOX_LIST_SESSIONS",description:"List connect sessions for monitoring and management",inputSchema:Oj0,outputSchema:Lj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=q5(),K;if(X.templateId){let W=await G.templates.findById(X.templateId);if(!W)throw Error(`Template not found: ${X.templateId}`);if(W.organization_id!==J.organization.id)throw Error("Access denied: template belongs to another organization");K=await G.sessions.listByTemplate(X.templateId)}else K=await G.sessions.listByOrganization(J.organization.id);return{sessions:K}}}});var LM4="user_sandbox_external_user_id",NM4="user_sandbox_id",gj0;var uj0=j(()=>{uZ();gj0={name:"USER_SANDBOX_LIST_USER_AGENTS",description:"List all agents (Virtual MCPs) created for an external user. Use this to find agents created via user sandbox for a specific user in your platform.",inputSchema:Nj0,outputSchema:Mj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");return await J.access.check(),{agents:(await J.storage.connections.list(J.organization.id)).filter((W)=>{if(W.connection_type!=="VIRTUAL")return!1;let Z=W.metadata;if(!Z)return!1;return Z[LM4]===X.externalUserId}).map((W)=>{let Z=W.metadata;return{id:W.id,title:W.title,external_user_id:X.externalUserId,template_id:Z[NM4]??null,created_at:W.created_at}})}}}});var MM4="user_sandbox_external_user_id",mj0;var lj0=j(()=>{uZ();sG();mj0={name:"USER_SANDBOX_CLEAR_USER_SESSION",description:"Clear all session data for an external user, revoking all access they've granted. This deletes their agents (Virtual MCPs), child connections, OAuth tokens, and sessions. Use this when a user wants to disconnect all their integrations.",inputSchema:wj0,outputSchema:Aj0,handler:async(Y,Q)=>{let X=Y,J=Q;if(!J.organization)throw Error("Organization context required");await J.access.check();let G=J.db,K=q5(),Z=(await G.selectFrom("connections").select(["id","metadata"]).where("organization_id","=",J.organization.id).where("connection_type","=","VIRTUAL").execute()).filter(($)=>{if(!$.metadata)return!1;try{return JSON.parse($.metadata)[MM4]===X.externalUserId}catch{return!1}}).map(($)=>$.id),H=0;if(Z.length>0){let V=(await G.selectFrom("connection_aggregations").select("child_connection_id").where("parent_connection_id","in",Z).execute()).map((B)=>B.child_connection_id);if(await G.deleteFrom("connection_aggregations").where("parent_connection_id","in",Z).execute(),V.length>0)await G.deleteFrom("downstream_tokens").where("connectionId","in",V).execute(),await G.deleteFrom("connections").where("id","in",V).execute(),H=V.length;await G.deleteFrom("connections").where("id","in",Z).execute(),await G.deleteFrom("user_sandbox_agents").where("external_user_id","=",X.externalUserId).execute()}let F=await K.sessions.deleteByExternalUserId(J.organization.id,X.externalUserId);return{success:!0,deletedAgents:Z.length,deletedConnections:H,deletedSessions:F}}}});var dj0;var pj0=j(()=>{Ej0();Cj0();Ij0();Sj0();vj0();bj0();xj0();uj0();lj0();sG();dj0=[Pj0,Tj0,Rj0,jj0,_j0,fj0,hj0,gj0,mj0]});function wM4(Y){let Q=Date.now().toString(36),X=crypto.randomUUID().replace(/-/g,"").substring(0,8);return`${Y}_${Q}${X}`}async function FH1(Y,Q,X,J){let G={success:!1,agentId:Y.created_agent_id,connectionIds:[],redirectUrl:null,eventEmitted:!1,webhookCalled:!1};try{let K=J.db,W=new Date().toISOString(),Z=Y.created_agent_id;if(!Z)throw Error("Session has no agent - this should not happen");let H=[],F=[];for(let[B,U]of Object.entries(Y.app_statuses))if(U.configured&&U.connection_id){H.push(U.connection_id);let z=Q.required_apps.find((O)=>O.app_name===B);F.push({appName:B,connectionId:U.connection_id,selectedTools:z?.selected_tools??null,selectedResources:z?.selected_resources??null,selectedPrompts:z?.selected_prompts??null})}if(G.connectionIds=H,await K.deleteFrom("connection_aggregations").where("parent_connection_id","=",Z).execute(),F.length>0)await K.insertInto("connection_aggregations").values(F.map((B)=>({id:wM4("agg"),parent_connection_id:Z,child_connection_id:B.connectionId,selected_tools:B.selectedTools?JSON.stringify(B.selectedTools):null,selected_resources:B.selectedResources?JSON.stringify(B.selectedResources):null,selected_prompts:B.selectedPrompts?JSON.stringify(B.selectedPrompts):null,created_at:W}))).execute();await X.sessions.update(Y.id,{status:"completed"});let $={type:Q.event_type,data:{externalUserId:Y.external_user_id,agentId:Z,templateId:Q.id,sessionId:Y.id,connections:H.map((B)=>{let U=Object.entries(Y.app_statuses).find(([z,O])=>O.connection_id===B)?.[0];return{id:B,appName:U??"unknown"}})}};if(J.eventBus)try{await J.eventBus.publish(J.organizationId,"user-sandbox",$),G.eventEmitted=!0}catch(B){console.error("[UserSandbox] Failed to emit completion event:",B)}if(Q.webhook_url)try{let B=await fetch(Q.webhook_url,{method:"POST",headers:{"Content-Type":"application/json","X-User-Sandbox-Event":Q.event_type},body:JSON.stringify($.data)});if(!B.ok)console.error("[UserSandbox] Webhook returned error:",B.status);else G.webhookCalled=!0}catch(B){console.error("[UserSandbox] Failed to call webhook:",B)}let V=Y.redirect_url??Q.redirect_url;if(V){let B=new URL(V);B.searchParams.set("sessionId",Y.id),B.searchParams.set("externalUserId",Y.external_user_id),B.searchParams.set("agentId",Z),G.redirectUrl=B.toString()}return G.success=!0,G}catch(K){throw console.error("[UserSandbox] Completion failed:",K),K}}var cj0=()=>{};function AM4(){let Y=Date.now().toString(36),Q=crypto.randomUUID().replace(/-/g,"").substring(0,8);return`conn_${Y}${Q}`}async function PM4(Y,Q,X,J,G,K,W){let Z=AM4(),H=new Date().toISOString();if(!W.title)throw Error(`App "${W.app_name}" is missing required field: title`);if(!W.connection_type)throw Error(`App "${W.app_name}" is missing required field: connection_type`);if(!W.connection_url&&W.connection_type!=="STDIO")throw Error(`App "${W.app_name}" is missing required field: connection_url`);let F={id:Z,organization_id:Q,created_by:X,title:W.title,description:W.description??null,icon:W.icon??null,app_name:W.app_name,app_id:null,connection_type:W.connection_type,connection_url:W.connection_url??"",connection_token:null,connection_headers:W.connection_headers?JSON.stringify(W.connection_headers):null,oauth_config:W.oauth_config?JSON.stringify(W.oauth_config):null,configuration_state:null,configuration_scopes:null,metadata:JSON.stringify(ZH1(J,G,K)),tools:null,bindings:null,status:"active",created_at:H,updated_at:H};return await Y.insertInto("connections").values(F).execute(),Z}function AR(Y,Q){if(Q instanceof _3){let X={SESSION_NOT_FOUND:404,SESSION_EXPIRED:410,SESSION_COMPLETED:409,ACCESS_DENIED:403,CONNECTION_ACCESS_DENIED:403};return Y.json({error:Q.message,code:Q.code},X[Q.code]??400)}return console.error("[UserSandbox] Connect API error:",Q),Y.json({error:Q instanceof Error?Q.message:"Internal error"},500)}function $H1(Y,Q){let X=Q.db,J=new NR(X),G=new MR(X),K={templates:J,sessions:G};Y.get("/api/user-sandbox/sessions/:sessionId",async(W)=>{try{let Z=W.req.param("sessionId"),H=await eB(Z,K,{allowCompleted:!0}),F=await J.findById(H.template_id);if(!F)return W.json({error:"Template not found"},404);return W.json({session:{id:H.id,status:H.status,external_user_id:H.external_user_id,expires_at:H.expires_at,redirect_url:H.redirect_url,created_agent_id:H.created_agent_id},template:{id:F.id,title:F.title,description:F.description,icon:F.icon},apps:F.required_apps.map(($)=>({app_name:$.app_name,title:$.title,description:$.description,icon:$.icon,connection_type:$.connection_type,requires_oauth:!!$.oauth_config,selected_tools:$.selected_tools,selected_resources:$.selected_resources,selected_prompts:$.selected_prompts,status:H.app_statuses[$.app_name]??{configured:!1,connection_id:null,error:null}}))})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/provision",async(W)=>{try{let Z=W.req.param("sessionId"),H=await W.req.json();if(!H.app_name)return W.json({error:"app_name is required"},400);let F=await eB(Z,K,{allowCompleted:!0}),$=await J.findById(F.template_id);if(!$)return W.json({error:"Template not found"},404);let V=$.required_apps.find((O)=>O.app_name===H.app_name);if(!V)return W.json({error:`App "${H.app_name}" is not required by this template`},400);let B=F.app_statuses[H.app_name];if(B?.connection_id)return W.json({success:!0,connection_id:B.connection_id,already_provisioned:!0,requires_oauth:!!V.oauth_config});if(!$.created_by)return W.json({error:"Template is missing created_by - cannot create connections"},500);let U=await PM4(X,F.organization_id,$.created_by,Z,F.external_user_id,F.template_id,V),z={...F.app_statuses,[H.app_name]:{configured:!1,connection_id:U,error:null}};return await G.update(Z,{status:"in_progress",app_statuses:z}),W.json({success:!0,connection_id:U,already_provisioned:!1,requires_oauth:!!V.oauth_config})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/configure",async(W)=>{try{let Z=W.req.param("sessionId"),H=await W.req.json();if(!H.app_name)return W.json({error:"app_name is required"},400);let F=await eB(Z,K,{allowCompleted:!0}),$=await J.findById(F.template_id);if(!$)return W.json({error:"Template not found"},404);if(!$.required_apps.find((M)=>M.app_name===H.app_name))return W.json({error:`App "${H.app_name}" is not required by this template`},400);let B=F.app_statuses[H.app_name],z={configured:!0,connection_id:H.connection_id??B?.connection_id??null,error:null},O={...F.app_statuses,[H.app_name]:z};return await G.update(Z,{status:"in_progress",app_statuses:O}),W.json({success:!0,app_name:H.app_name,status:z})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/oauth-token",async(W)=>{try{let Z=W.req.param("sessionId"),H=await W.req.json();if(!H.connection_id)return W.json({error:"connection_id is required"},400);if(!H.access_token)return W.json({error:"access_token is required"},400);let F=await eB(Z,K,{allowCompleted:!0});if(!Object.values(F.app_statuses).some((P)=>P.connection_id===H.connection_id))return W.json({error:"Connection does not belong to this session"},403);let V=H.expires_in?new Date(Date.now()+H.expires_in*1000):null,B=new Date().toISOString(),U=await Q.vault.encrypt(H.access_token),z=H.refresh_token?await Q.vault.encrypt(H.refresh_token):null,O=H.client_secret?await Q.vault.encrypt(H.client_secret):null,M=X,w=await M.selectFrom("downstream_tokens").select(["id"]).where("connectionId","=",H.connection_id).executeTakeFirst();if(w)await M.updateTable("downstream_tokens").set({accessToken:U,refreshToken:z,scope:H.scope??null,expiresAt:V?.toISOString()??null,clientId:H.client_id??null,clientSecret:O,tokenEndpoint:H.token_endpoint??null,updatedAt:B}).where("id","=",w.id).execute();else{let P=`dtok_${Date.now().toString(36)}${crypto.randomUUID().replace(/-/g,"").substring(0,8)}`;await M.insertInto("downstream_tokens").values({id:P,connectionId:H.connection_id,accessToken:U,refreshToken:z,scope:H.scope??null,expiresAt:V?.toISOString()??null,clientId:H.client_id??null,clientSecret:O,tokenEndpoint:H.token_endpoint??null,createdAt:B,updatedAt:B}).execute()}return W.json({success:!0,expiresAt:V})}catch(Z){return AR(W,Z)}}),Y.post("/api/user-sandbox/sessions/:sessionId/complete",async(W)=>{try{let Z=W.req.param("sessionId"),H=await eB(Z,K,{allowCompleted:!0}),F=await J.findById(H.template_id);if(!F)return W.json({error:"Template not found"},404);if(F.required_apps.filter((B)=>{return H.app_statuses[B.app_name]?.configured}).length===0)return W.json({error:"At least one app must be configured"},400);let V=await FH1(H,F,K,{organizationId:H.organization_id,db:X});return W.json({success:V.success,completed:!0,agentId:V.agentId,redirectUrl:V.redirectUrl,eventEmitted:V.eventEmitted,webhookCalled:V.webhookCalled})}catch(Z){return AR(W,Z)}})}var nj0=j(()=>{QH1();XH1();HH1();cj0()});var ij0=j(()=>{nj0()});var aj0;var rj0=j(()=>{Zj0();Hj0();pj0();ij0();aj0={id:qd,description:Xj0,tools:dj0,publicRoutes:(Y,Q)=>{$H1(Y,Q)},migrations:Wj0,createStorage:(Y)=>{let Q=Kj0(Y);return wR(Q),Q}}});var oj0="workflows",sj0="Create workflows for platform end-users";import{sql as tj0}from"kysely";var ej0;var YS0=j(()=>{ej0={name:"001-workflows",async up(Y){await Y.schema.createTable("workflow_collection").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("title","text",(Q)=>Q.notNull()).addColumn("description","text").addColumn("virtual_mcp_id","text",(Q)=>Q.notNull()).addColumn("steps","text",(Q)=>Q.notNull().defaultTo("[]")).addColumn("created_at","text",(Q)=>Q.notNull().defaultTo(tj0`CURRENT_TIMESTAMP`)).addColumn("updated_at","text",(Q)=>Q.notNull().defaultTo(tj0`CURRENT_TIMESTAMP`)).addColumn("created_by","text").addColumn("updated_by","text").execute(),await Y.schema.createIndex("idx_wf_collection_org").on("workflow_collection").column("organization_id").execute(),await Y.schema.createIndex("idx_wf_collection_created_at").on("workflow_collection").column("created_at").execute(),await Y.schema.createTable("workflow").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("workflow_collection_id","text").addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("steps","text",(Q)=>Q.notNull().defaultTo("[]")).addColumn("input","text").addColumn("virtual_mcp_id","text",(Q)=>Q.notNull()).addColumn("created_at_epoch_ms","bigint",(Q)=>Q.notNull()).addColumn("created_by","text").execute(),await Y.schema.createIndex("idx_workflow_created_at").on("workflow").column("created_at_epoch_ms").execute(),await Y.schema.createIndex("idx_workflow_collection_id").on("workflow").column("workflow_collection_id").execute(),await Y.schema.createTable("workflow_execution").addColumn("id","text",(Q)=>Q.primaryKey()).addColumn("workflow_id","text",(Q)=>Q.notNull().references("workflow.id").onDelete("cascade")).addColumn("organization_id","text",(Q)=>Q.notNull().references("organization.id").onDelete("cascade")).addColumn("status","text",(Q)=>Q.notNull().defaultTo("enqueued")).addColumn("input","text").addColumn("output","text").addColumn("error","text").addColumn("created_at","bigint",(Q)=>Q.notNull()).addColumn("updated_at","bigint",(Q)=>Q.notNull()).addColumn("start_at_epoch_ms","bigint").addColumn("started_at_epoch_ms","bigint").addColumn("completed_at_epoch_ms","bigint").addColumn("timeout_ms","bigint").addColumn("deadline_at_epoch_ms","bigint").addColumn("created_by","text").execute(),await Y.schema.createIndex("idx_wf_execution_status").on("workflow_execution").column("status").execute(),await Y.schema.createIndex("idx_wf_execution_workflow_id").on("workflow_execution").column("workflow_id").execute(),await Y.schema.createIndex("idx_wf_execution_org").on("workflow_execution").column("organization_id").execute(),await Y.schema.createIndex("idx_wf_execution_created_at").on("workflow_execution").column("created_at").execute(),await Y.schema.createTable("workflow_execution_step_result").addColumn("execution_id","text",(Q)=>Q.notNull().references("workflow_execution.id").onDelete("cascade")).addColumn("step_id","text",(Q)=>Q.notNull()).addColumn("started_at_epoch_ms","bigint").addColumn("completed_at_epoch_ms","bigint").addColumn("output","text").addColumn("error","text").addColumn("raw_tool_output","text").execute(),await Y.schema.createIndex("idx_wf_step_result_pk").on("workflow_execution_step_result").columns(["execution_id","step_id"]).unique().execute(),await Y.schema.createIndex("idx_wf_step_result_execution").on("workflow_execution_step_result").column("execution_id").execute()},async down(Y){await Y.schema.dropIndex("idx_wf_step_result_execution").ifExists().execute(),await Y.schema.dropIndex("idx_wf_step_result_pk").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_created_at").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_org").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_workflow_id").ifExists().execute(),await Y.schema.dropIndex("idx_wf_execution_status").ifExists().execute(),await Y.schema.dropIndex("idx_workflow_collection_id").ifExists().execute(),await Y.schema.dropIndex("idx_workflow_created_at").ifExists().execute(),await Y.schema.dropIndex("idx_wf_collection_created_at").ifExists().execute(),await Y.schema.dropIndex("idx_wf_collection_org").ifExists().execute(),await Y.schema.dropTable("workflow_execution_step_result").ifExists().execute(),await Y.schema.dropTable("workflow_execution").ifExists().execute(),await Y.schema.dropTable("workflow").ifExists().execute(),await Y.schema.dropTable("workflow_collection").ifExists().execute()}}});var QS0;var XS0=j(()=>{YS0();QS0=[ej0]});function pX(Y){let Q=Y;if(!Q.organization)throw Error("Organization context required for workflow tools");return Q}function QX(Y){if(Y===null||Y===void 0)return null;if(typeof Y==="object")return Y;if(typeof Y!=="string")return Y;try{return JSON.parse(Y)}catch{return Y}}function JS0(Y){VH1=Y}function gQ(){if(!VH1)throw Error('Plugin storage not initialized. Make sure the "workflows" plugin is enabled.');return VH1}var VH1=null;function GS0(Y){return{...Y,steps:QX(Y.steps)??[]}}class qH1{db;constructor(Y){this.db=Y}async list(Y,Q={}){let{limit:X=50,offset:J=0}=Q,G=await this.db.selectFrom("workflow_collection").selectAll().where("organization_id","=",Y).orderBy("created_at","desc").limit(X).offset(J).execute(),K=await this.db.selectFrom("workflow_collection").select((W)=>W.fn.countAll().as("count")).where("organization_id","=",Y).executeTakeFirstOrThrow();return{items:G,totalCount:Number(K.count)}}async getById(Y,Q){let X=await this.db.selectFrom("workflow_collection").selectAll().where("id","=",Y).where("organization_id","=",Q).executeTakeFirst();return X?GS0(X):null}async create(Y){let Q=await this.db.insertInto("workflow_collection").values(Y).returningAll().executeTakeFirstOrThrow();return GS0(Q)}async update(Y,Q,X){return await this.db.updateTable("workflow_collection").set({...X,updated_at:new Date().toISOString()}).where("id","=",Y).where("organization_id","=",Q).returningAll().executeTakeFirstOrThrow()}async delete(Y,Q){return await this.db.deleteFrom("workflow_collection").where("id","=",Y).where("organization_id","=",Q).returningAll().executeTakeFirstOrThrow()}}var WS0=()=>{};function EM4(Y){return{...Y,steps:QX(Y.steps)??[],input:QX(Y.input)??null}}function O$(Y){return{...Y,output:QX(Y.output),error:QX(Y.error),raw_tool_output:QX(Y.raw_tool_output)}}class BH1{db;constructor(Y){this.db=Y}async _createWorkflow(Y,Q){let X=crypto.randomUUID(),J=Date.now();return await Y.insertInto("workflow").values({id:X,workflow_collection_id:Q.workflowCollectionId??null,organization_id:Q.organizationId,steps:JSON.stringify(Q.steps),input:Q.input?JSON.stringify(Q.input):null,virtual_mcp_id:Q.virtualMcpId,created_at_epoch_ms:J,created_by:Q.createdBy??null}).execute(),{id:X}}async createWorkflow(Y){return this._createWorkflow(this.db,Y)}async getWorkflow(Y){let Q=await this.db.selectFrom("workflow").selectAll().where("id","=",Y).executeTakeFirst();return Q?EM4(Q):null}async createExecution(Y){return this.db.transaction().execute(async(Q)=>{let X=Date.now(),{id:J}=await this._createWorkflow(Q,{organizationId:Y.organizationId,workflowCollectionId:Y.workflowCollectionId,virtualMcpId:Y.virtualMcpId,input:Y.input,steps:Y.steps,createdBy:Y.createdBy}),G=crypto.randomUUID(),K=Y.startAtEpochMs??X,W=Y.timeoutMs?K+Y.timeoutMs:null;return await Q.insertInto("workflow_execution").values({id:G,workflow_id:J,organization_id:Y.organizationId,status:"enqueued",input:Y.input?JSON.stringify(Y.input):null,created_at:X,updated_at:X,start_at_epoch_ms:K,timeout_ms:Y.timeoutMs??null,deadline_at_epoch_ms:W,created_by:Y.createdBy??null}).execute(),{id:G}})}async getExecution(Y,Q){return await this.db.selectFrom("workflow_execution").selectAll().where("id","=",Y).where("organization_id","=",Q).executeTakeFirst()??null}async getExecutionFull(Y,Q){let X=await this.db.selectFrom("workflow_execution").selectAll().where("id","=",Y).where("organization_id","=",Q).executeTakeFirst();if(!X)return null;let J=await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).execute();return{execution:X,stepResults:J.map(O$)}}async getExecutionContext(Y){let Q=await this.db.selectFrom("workflow_execution").select(["id","status","workflow_id","deadline_at_epoch_ms"]).where("id","=",Y).executeTakeFirst();if(!Q)return null;let X=await this.db.selectFrom("workflow").select(["steps","input","virtual_mcp_id"]).where("id","=",Q.workflow_id).executeTakeFirst();if(!X)return null;let J=await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).execute();return{execution:{id:Q.id,status:Q.status,workflow_id:Q.workflow_id,deadline_at_epoch_ms:Q.deadline_at_epoch_ms},workflow:{steps:QX(X.steps)??[],input:QX(X.input)??null,virtual_mcp_id:X.virtual_mcp_id},stepResults:J.map(O$)}}async claimExecution(Y){let Q=Date.now(),X=await this.db.updateTable("workflow_execution").set({status:"running",updated_at:Q}).where("id","=",Y).where("status","=","enqueued").returningAll().executeTakeFirst();if(!X)return null;let J=await this.getWorkflow(X.workflow_id);if(!J)throw Error(`Workflow ${X.workflow_id} not found for execution ${Y}`);return{execution:X,workflow:J}}async updateExecution(Y,Q,X){let G={updated_at:Date.now()};if(Q.status!==void 0)G.status=Q.status;if(Q.output!==void 0)G.output=JSON.stringify(Q.output);if(Q.error!==void 0)G.error=JSON.stringify(Q.error);if(Q.completed_at_epoch_ms!==void 0)G.completed_at_epoch_ms=Q.completed_at_epoch_ms;let K=this.db.updateTable("workflow_execution").set(G).where("id","=",Y);if(X?.onlyIfStatus)K=K.where("status","=",X.onlyIfStatus);return await K.returningAll().executeTakeFirst()??null}async cancelExecution(Y,Q){let X=Date.now();return!!await this.db.updateTable("workflow_execution").set({status:"cancelled",updated_at:X}).where("id","=",Y).where("organization_id","=",Q).where("status","in",["enqueued","running"]).returningAll().executeTakeFirst()}async resumeExecution(Y,Q){return this.db.transaction().execute(async(X)=>{let J=Date.now();return await X.deleteFrom("workflow_execution_step_result").where("execution_id","=",Y).where("completed_at_epoch_ms","is",null).execute(),!!await X.updateTable("workflow_execution").set({status:"enqueued",updated_at:J,completed_at_epoch_ms:null}).where("id","=",Y).where("organization_id","=",Q).where("status","=","cancelled").returningAll().executeTakeFirst()})}async listExecutions(Y,Q={}){let{limit:X=50,offset:J=0,status:G}=Q,K=this.db.selectFrom("workflow_execution as we").innerJoin("workflow as w","we.workflow_id","w.id").leftJoin("workflow_collection as wc","w.workflow_collection_id","wc.id").select(["we.id","we.workflow_id","we.organization_id","we.status","we.input","we.output","we.error","we.created_at","we.updated_at","we.start_at_epoch_ms","we.started_at_epoch_ms","we.completed_at_epoch_ms","we.timeout_ms","we.deadline_at_epoch_ms","we.created_by","w.virtual_mcp_id"]).select(($)=>$.fn.coalesce("wc.title",$.val("Workflow Execution")).as("title")).where("we.organization_id","=",Y);if(G)K=K.where("we.status","=",G);let W=await K.orderBy("we.created_at","desc").limit(X).offset(J).execute(),Z=this.db.selectFrom("workflow_execution").select(($)=>$.fn.countAll().as("count")).where("organization_id","=",Y);if(G)Z=Z.where("status","=",G);let H=await Z.executeTakeFirstOrThrow(),F=Number(H.count);return{items:W,totalCount:F,hasMore:J+W.length<F}}async createStepResult(Y){let Q=await this.db.insertInto("workflow_execution_step_result").values({execution_id:Y.execution_id,step_id:Y.step_id,started_at_epoch_ms:Y.completed_at_epoch_ms?Date.now():null,completed_at_epoch_ms:Y.completed_at_epoch_ms??null,output:Y.output!==void 0?JSON.stringify(Y.output):null,error:Y.error!==void 0?JSON.stringify(Y.error):null}).onConflict((X)=>X.columns(["execution_id","step_id"]).doNothing()).returningAll().executeTakeFirst();return Q?O$(Q):null}async updateStepResult(Y,Q,X){let J={};if(X.output!==void 0)J.output=JSON.stringify(X.output);if(X.error!==void 0)J.error=JSON.stringify(X.error);if(X.started_at_epoch_ms!==void 0)J.started_at_epoch_ms=X.started_at_epoch_ms;if(X.completed_at_epoch_ms!==void 0)J.completed_at_epoch_ms=X.completed_at_epoch_ms;if(Object.keys(J).length===0)return null;let G=await this.db.updateTable("workflow_execution_step_result").set(J).where("execution_id","=",Y).where("step_id","=",Q).returningAll().executeTakeFirst();return G?O$(G):null}async checkpointAndTransform(Y,Q,X,J){await this.db.updateTable("workflow_execution_step_result").set({raw_tool_output:JSON.stringify(X)}).where("execution_id","=",Y).where("step_id","=",Q).execute();let G,K;try{let H=await J(X);G=H.output,K=H.error}catch(H){K=H instanceof Error?`Transform failed: ${H.message}`:`Transform failed: ${String(H)}`}let W={completed_at_epoch_ms:Date.now()};if(G!==void 0)W.output=JSON.stringify(G);if(K!==void 0)W.error=JSON.stringify(K);let Z=await this.db.updateTable("workflow_execution_step_result").set(W).where("execution_id","=",Y).where("step_id","=",Q).returningAll().executeTakeFirst();return Z?O$(Z):null}async getStepResult(Y,Q){let X=await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).where("step_id","=",Q).executeTakeFirst();return X?O$(X):null}async getStepResults(Y){return(await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).execute()).map(O$)}async deleteStepResult(Y,Q){await this.db.deleteFrom("workflow_execution_step_result").where("execution_id","=",Y).where("step_id","=",Q).execute()}async getStepResultsByPrefix(Y,Q){return(await this.db.selectFrom("workflow_execution_step_result").selectAll().where("execution_id","=",Y).where("step_id","like",`${Q}%`).orderBy("step_id").execute()).map(O$)}async recoverStuckExecutions(){return this.db.transaction().execute(async(Y)=>{let Q=await Y.selectFrom("workflow_execution").select(["id","organization_id"]).where("status","=","running").execute();if(Q.length===0)return[];let X=Q.map((J)=>J.id);return await Y.updateTable("workflow_execution").set({status:"enqueued",updated_at:Date.now()}).where("id","in",X).where("status","=","running").execute(),Q})}}var ZS0=()=>{};function KS0(Y){let Q=Y.db;return{collections:new qH1(Q),executions:new BH1(Q)}}var HS0=j(()=>{WS0();ZS0()});var FS0,$S0,VS0,qS0,BS0;var US0=j(()=>{k1();tL();DY();FS0={name:"COLLECTION_WORKFLOW_LIST",description:"List workflows with pagination. Does not include steps -- use GET for full details.",inputSchema:q.object({limit:q.number().optional().default(50),offset:q.number().optional().default(0)}),outputSchema:q.object({items:q.array(q.object({id:q.string(),title:q.string(),description:q.string().nullable(),virtual_mcp_id:q.string(),created_at:q.string(),updated_at:q.string()})),totalCount:q.number(),hasMore:q.boolean()}),handler:async(Y,Q)=>{let X=pX(Q);await X.access.check();let J=Y,G=gQ(),{items:K,totalCount:W}=await G.collections.list(X.organization.id,{limit:J.limit,offset:J.offset});return{items:K.map((Z)=>({id:Z.id,title:Z.title,description:Z.description,virtual_mcp_id:Z.virtual_mcp_id,created_at:Z.created_at,updated_at:Z.updated_at})),totalCount:W,hasMore:(J.offset??0)+K.length<W}}},$S0={name:"COLLECTION_WORKFLOW_GET",description:"Get a single workflow by ID, including its steps.",inputSchema:q.object({id:q.string()}),outputSchema:q.object({item:q.object({id:q.string(),title:q.string(),description:q.string().nullable(),virtual_mcp_id:q.string(),steps:q.array(xB),created_at:q.string(),updated_at:q.string()}).nullable()}),handler:async(Y,Q)=>{let X=pX(Q);await X.access.check();let{id:J}=Y,K=await gQ().collections.getById(J,X.organization.id);if(!K)return{item:null};return{item:{id:K.id,title:K.title,description:K.description,virtual_mcp_id:K.virtual_mcp_id,steps:K.steps,created_at:K.created_at,updated_at:K.updated_at}}}},VS0={name:"COLLECTION_WORKFLOW_CREATE",description:`Create a workflow template. This is a reusable definition, not an execution.
 
 Key concepts:
 - Steps without references run immediately (in parallel).