@ever-works/composio-plugin 1.0.0 → 1.0.6

package/dist/index.cjs

@@ -0,0 +1,3685 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ComposioPlugin: () => ComposioPlugin,
+  default: () => composio_plugin_default
+});
+module.exports = __toCommonJS(index_exports);
+
+// ../../../node_modules/.pnpm/@ever-co+connect-contracts@1.0.0-rc.2/node_modules/@ever-co/connect-contracts/dist/index.js
+var CONSTANTS = {
+  "$comment": "Wire constants of the Ever Platform modules. tools/split-integrations.mjs refreshes the fields read from the contract (contracts_version, code patterns, install_sources, products, stats_headers, feed_event_types, integration_keys, root_keys); every other value is a default a product may override by its own configuration.",
+  "contracts_version": "1.0.0-rc.2",
+  "connect_code_pattern": "^EVC(-[0-9A-HJKMNP-TV-Za-hj-kmnp-tv-z]{4}){3}$",
+  "link_code_pattern": "^EVL(-[0-9A-HJKMNP-TV-Za-hj-kmnp-tv-z]{4}){3}$",
+  "install_sources": "^(cloud|self-hosted|ever\\.sh|works_app|desktop|partner:[a-z0-9-]{2,32})$",
+  "products": [
+    "gauzy",
+    "teams",
+    "works",
+    "rec",
+    "traduora",
+    "demand"
+  ],
+  "instance_kinds": [
+    "cloud",
+    "self_hosted",
+    "works_app"
+  ],
+  "instance_token_prefix": "evit_",
+  "entitlement_typ": "ever-entitlement+jwt",
+  "intent_typ": "ever-intent+jwt",
+  "assertion_typ": "ever-assertion+jwt",
+  "key_manifest_typ": "ever-key-manifest+jwt",
+  "stats_link_typ": "ever-stats-link+jwt",
+  "client_assertion_typ": "JWT",
+  "client_assertion_type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
+  "entitlement_aud": "ever-connect",
+  "stats_headers": {
+    "key": "Ever-Stats-Key",
+    "signature": "Ever-Stats-Signature",
+    "key_id": "Ever-Stats-Key-Id"
+  },
+  "stats_signature_prefix": "ed25519=",
+  "feed_event_types": [
+    "ever.consent.consent.granted",
+    "ever.consent.consent.revoked",
+    "ever.consent.integration.disabled",
+    "ever.consent.integration.enabled",
+    "ever.consent.integration.scope_bumped",
+    "ever.entitlements.entitlement.issued",
+    "ever.entitlements.entitlement.revoked",
+    "ever.entitlements.usage.limit_reached",
+    "ever.registry.instance.approved",
+    "ever.registry.instance.connected",
+    "ever.registry.instance.disconnected",
+    "ever.registry.instance.key_rotated",
+    "ever.registry.instance.revoked",
+    "ever.registry.instance.seen",
+    "ever.registry.managed_operation.requested",
+    "ever.registry.managed_operation.state_changed",
+    "ever.registry.membership.created",
+    "ever.registry.membership.removed",
+    "ever.registry.membership.role_changed",
+    "ever.registry.person.deletion_requested",
+    "ever.registry.person.export_requested",
+    "ever.registry.tenant_link.created",
+    "ever.registry.tenant_link.orphaned",
+    "ever.registry.tenant_link.resumed",
+    "ever.registry.tenant_link.suspended",
+    "ever.registry.tenant_link.unlinked"
+  ],
+  "integration_keys": [
+    "instance_url",
+    "stats_link",
+    "ever_id_login",
+    "counterparty_lookup",
+    "counterparty_discoverable",
+    "profile_import",
+    "usage_reporting",
+    "app_sync",
+    "billing_link",
+    "webhooks",
+    "managed_operations",
+    "provider_access",
+    "marketplace_installs"
+  ],
+  "key_manifest_path": "/.well-known/ever-keys.json",
+  "assertion_audience_path": "/v1/instances/token",
+  "assertion_max_ttl_s": 300,
+  "assertion_max_skew_s": 300,
+  "token_ttl_s": 3600,
+  "token_refresh_after_s": 3e3,
+  "key_rotation_overlap_s": 604800,
+  "entitlement": {
+    "validity_s": 604800,
+    "refresh_after_s": 21600,
+    "grace_s": 2592e3,
+    "max_reads_per_hour": 6
+  },
+  "key_manifest": {
+    "refresh_s": 86400,
+    "unknown_kid_refresh_min_s": 600,
+    "lifetime_s": 2592e3
+  },
+  "heartbeat_interval_s": 86400,
+  "heartbeat_after_boot_max_s": 300,
+  "heartbeat_min_interval_s": 60,
+  "feed": {
+    "wait_s": 25,
+    "interval_fallback_s": 900,
+    "page_limit": 50
+  },
+  "stats": {
+    "send_interval_s": 86400,
+    "min_interval_s": 3600,
+    "max_bytes": 16384,
+    "final_resend_days": [
+      1,
+      2,
+      3
+    ],
+    "reports_per_day": 24
+  },
+  "lookup": {
+    "normalization_version": 1,
+    "max_hashes_per_query": 100,
+    "cache_positive_s": 86400,
+    "cache_negative_s": 3600,
+    "salt_cache_s": 86400
+  },
+  "mirror": {
+    "max_bytes": 4194304,
+    "interval_s": 30
+  },
+  "step_up_max_age_s": 300,
+  "stats_link_statement_max_age_s": 600,
+  "timeouts_ms": {
+    "read": 6e3,
+    "write": 1e4
+  },
+  "user_agent_pattern": "ever-connect-sdk/<sdk version> (<product>/<product version>)",
+  "root_keys": [
+    {
+      "kid": "ever-202610-0d77",
+      "iss": "https://api-dev.ever.co",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "x": "cgULEqOov0n4s9I8luZboIgJp9mIGusmsSdSL4oCjKk",
+      "use": "sig",
+      "alg": "EdDSA"
+    },
+    {
+      "kid": "ever-202610-8704",
+      "iss": "https://api-stage.ever.co",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "x": "Ync-MW21JL72GOiS-RVrlvS3gyFH5Krh5f6I66jw1Qc",
+      "use": "sig",
+      "alg": "EdDSA"
+    }
+  ],
+  "root_keys_file_env": "EVER_PLATFORM_ROOT_KEYS_FILE",
+  "root_keys_file_hosts": [
+    "localhost",
+    "127.0.0.0/8",
+    "::1",
+    "10.0.0.0/8",
+    "172.16.0.0/12",
+    "192.168.0.0/16",
+    "*.localhost"
+  ]
+};
+var FEED_EVENT_TYPES = CONSTANTS.feed_event_types;
+var PROBLEM_CODES = [
+  "validation_failed",
+  "not_found",
+  "unauthorized",
+  "forbidden_role",
+  "forbidden_scope",
+  "ambiguous_credentials",
+  "credential_revoked",
+  "instance_disconnected",
+  "instance_pending_approval",
+  "not_connection_owner",
+  "integration_disabled",
+  "integration_revoked",
+  "denied_by_policy",
+  "integration_not_available",
+  "entitlement_required",
+  "tier_required",
+  "limit_exceeded",
+  "rate_limited",
+  "idempotency_mismatch",
+  "idempotency_in_progress",
+  "stale_version",
+  "module_disabled",
+  "handle_taken",
+  "handle_reserved",
+  "handle_retired",
+  "handle_invalid",
+  "handle_held",
+  "handle_held_by_you",
+  "code_invalid",
+  "code_expired",
+  "product_mismatch",
+  "product_not_supported",
+  "key_mismatch",
+  "signature_invalid",
+  "unlinked_org",
+  "schema_violation",
+  "mirror_owned_field",
+  "illegal_transition",
+  "already_exists",
+  "already_completed",
+  "billing_active",
+  "sso_required",
+  "reauth_required",
+  "session_required",
+  "step_up_required",
+  "session_bound",
+  "authorization_pending",
+  "slow_down",
+  "expired_token",
+  "already_connected",
+  "already_linked",
+  "already_claimed",
+  "invalid_client",
+  "public_jwk_invalid",
+  "identifier_claimed",
+  "salt_version_unknown",
+  "salt_version_retired",
+  "hashes_invalid",
+  "lookup_key_required",
+  "required_component",
+  "resync_required",
+  "last_owner",
+  "last_auth_method",
+  "instances_linked",
+  "install_in_progress",
+  "slug_reserved",
+  "checklist_incomplete",
+  "scope_version_outdated",
+  "method_not_allowed",
+  "payload_too_large",
+  "unsupported_media_type",
+  "gone",
+  "unavailable",
+  "upstream",
+  "database_absent",
+  "database_unreachable",
+  "topic_private",
+  "keys_unavailable",
+  "internal_error"
+];
+var CODES = new Set(PROBLEM_CODES);
+
+// ../../contracts/dist/index.js
+var USER_SELECTABLE_WORK_KINDS = [
+  "website",
+  "landing-page",
+  "blog",
+  "directory",
+  "awesome-repo",
+  "repo",
+  "app"
+];
+var WORK_KINDS = [...USER_SELECTABLE_WORK_KINDS, "company", "campaign", "project", "default"];
+var WORK_KIND_SET = new Set(WORK_KINDS);
+var GOAL_KINDS = ["metric", "delivery"];
+var GOAL_KIND_SET = new Set(GOAL_KINDS);
+var RECORD_VISIBILITIES = ["private", "team", "organization"];
+var RECORD_VISIBILITY_SET = new Set(RECORD_VISIBILITIES);
+var RECORD_LIST_VIEWS = ["mine", "shared", "organization"];
+var RECORD_LIST_VIEW_SET = new Set(RECORD_LIST_VIEWS);
+var APP_DEPENDENCY_BACKUP_OVERDUE_MS = 26 * 36e5;
+var APP_DEPENDENCY_MANAGED = {
+  pgRoleConnectionLimit: 20,
+  pgDatabaseConnectionLimit: 25,
+  pgStatementTimeoutMs: 6e4,
+  pgIdleInTransactionTimeoutMs: 6e4,
+  bucketQuotaGiB: 10,
+  redisMaxMemoryMiB: 256,
+  backupMaxAgeMs: 864e5
+};
+var APP_ENV_VALIDATION_REFUSAL_CODES = [
+  "invalidName",
+  "reservedName",
+  "valueTooLarge",
+  "controlCharacter",
+  "lengthMismatch",
+  "tooShort",
+  "tooLong",
+  "patternMismatch"
+];
+var APP_ENV_API_ERROR_CODES = [
+  "generatedValueUseRotate",
+  "neverRotateNotAcknowledged",
+  "rotateConfirmationMismatch",
+  "secureStorageUnavailable",
+  "tooManyValues",
+  "valuesTooLarge",
+  "malformedLine",
+  "rotateRateLimited"
+];
+var APP_ENV_ERROR_CODES = [...APP_ENV_VALIDATION_REFUSAL_CODES, ...APP_ENV_API_ERROR_CODES];
+var APP_LAUNCHER_CLIENT_CACHE_MS = 5 * 6e4;
+var MANAGED_HOSTING_REASONS = [
+  "licenseNotGreen",
+  "upstreamAgreementMissing",
+  "entryDisallows",
+  "blueprintNotVerified",
+  "managedTierDisabled"
+];
+var MANAGED_HOSTING_AVAILABILITIES = ["available", ...MANAGED_HOSTING_REASONS];
+var APP_PRIVATE_COPY_MAX_SIZE_KB = 512e3;
+var APP_DEPLOY_MAX_DURATION_S = 7200;
+var APP_DEPLOY_LOCK_STALE_S = APP_DEPLOY_MAX_DURATION_S + 60;
+var APPS_CATALOG_LAST_GOOD_REGISTRY_MS = 7 * 864e5;
+var APP_REPOSITORY_STAGE_LIMITS = {
+  "private-copy": {
+    maxSizeKb: APP_PRIVATE_COPY_MAX_SIZE_KB,
+    fetchesLfs: false,
+    refusalCodes: ["too_large_for_private_copy", "uses_lfs"]
+  },
+  provisioning: {
+    maxSizeKb: 3 * 1024 * 1024,
+    refusalCodes: ["repository-too-large"]
+  },
+  build: {
+    refusalCodes: []
+  },
+  sandbox: {
+    refusalCodes: []
+  }
+};
+var TENANT_POSTGRES_ROLE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgRoleConnectionLimit;
+var TENANT_POSTGRES_DATABASE_CONNECTION_LIMIT = APP_DEPENDENCY_MANAGED.pgDatabaseConnectionLimit;
+var TENANT_POSTGRES_STATEMENT_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgStatementTimeoutMs;
+var TENANT_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS = APP_DEPENDENCY_MANAGED.pgIdleInTransactionTimeoutMs;
+var APP_PROVISION_LIMITS = {
+  attemptsDefault: 3,
+  attemptsMin: 1,
+  attemptsMax: 5,
+  attemptsPerAnswer: 2,
+  questionsMax: 3,
+  attemptsCeiling: 9,
+  optionsMax: 4,
+  tokenCapDefault: 3e6,
+  tokenCapMin: 5e5,
+  tokenCapMax: 1e7,
+  runnerMinuteCapDefault: 240,
+  runnerMinuteCapMin: 60,
+  runnerMinuteCapMax: 600,
+  /** Two starts of the same App Work inside this window yield one row (§4 "Start semantics"). */
+  startDedupeMs: 1e4,
+  analysisRunMs: 45 * 6e4,
+  iterateRunMs: 30 * 6e4,
+  forkWaitMs: 30 * 6e4,
+  activeDeadlineMs: 8 * 36e5,
+  /**
+   * Verification-Build reservation: `min(headSpec.build.resources.timeoutMinutes, buildMinutesMax)
+   * + runnerBootMinutesMax` — 90 minutes at the defaults, and the number §6.4 compares against the cap.
+   */
+  buildMinutesMax: 60,
+  jobSecondsMax: 900,
+  startupSecondsMax: 900,
+  smokeRequestMs: 3e4,
+  smokeTotalMs: 3e5,
+  runnerBootMinutesMax: 30,
+  runnerBootMemoryGiB: 12,
+  buildMemoryGiBMax: 14,
+  namespaceTtlMinutes: 90,
+  repoMaxBytes: 3 * 1024 ** 3,
+  diffMaxFiles: 12,
+  diffMaxLines: 3e3,
+  fileMaxBytes: 128 * 1024,
+  outputMaxBytes: 512 * 1024,
+  reportMaxChars: 4e4,
+  instructionFileMaxBytes: 32 * 1024,
+  logTailLines: 200,
+  logTailBytes: 16 * 1024,
+  evidenceCommentMaxChars: 6e4,
+  chatMessagesMax: 12,
+  questionReminderMs: 72 * 36e5,
+  questionExpiryMs: 14 * 864e5,
+  activePerUser: 3,
+  activePerOrg: 10,
+  startsPerHour: 10,
+  pollMs: 5e3,
+  infraRetries: 3,
+  infraRetryWindowMs: 30 * 6e4,
+  suggestionsPer30Days: 5,
+  autoReprovisionPerSync: 1,
+  autoReprovisionPer7Days: 2,
+  clusterProbeMs: 1e4,
+  podPendingInfraMs: 10 * 6e4
+};
+var MAX_CANDIDATE_OPTIONS = APP_PROVISION_LIMITS.optionsMax - 1;
+var KB_EXPORT_MAX_BYTES = 200 * 1024 * 1024;
+var TERMINAL_MAX_FRAME_BYTES = 1024 * 1024;
+var COMPUTER_MAX_FRAME_BYTES = 512 * 1024;
+var COMPUTER_MAX_BATCH_BYTES = 512 * 1024;
+var COMPUTER_MAX_WIRE_FRAME_BYTES = Math.ceil(COMPUTER_MAX_FRAME_BYTES * 4 / 3) + 4096;
+var COMPUTER_QUALITY_PRESETS = Object.freeze({
+  sharp: Object.freeze({ width: 1280, maxFps: 8, keyframeMs: 5e3, q: 70 }),
+  smooth: Object.freeze({ width: 960, maxFps: 15, keyframeMs: 5e3, q: 55 }),
+  steady: Object.freeze({ width: 800, maxFps: 2, keyframeMs: 2e3, q: 45 })
+});
+var COMPUTER_CONTROL_IDLE_MS_DEFAULT = 10 * 6e4;
+var COMPUTER_CONTROL_CEILING_MS_DEFAULT = 60 * 6e4;
+var COMPUTER_KEY_MODIFIER_ALT = 1;
+var COMPUTER_KEY_MODIFIER_CTRL = 2;
+var COMPUTER_KEY_MODIFIER_META = 4;
+var CTRL = COMPUTER_KEY_MODIFIER_CTRL;
+var META = COMPUTER_KEY_MODIFIER_META;
+var ALT = COMPUTER_KEY_MODIFIER_ALT;
+function withCtrlOrMeta(code, key) {
+  return [
+    { code, requires: CTRL, label: `Ctrl/\u2318+${key}` },
+    { code, requires: META, label: `Ctrl/\u2318+${key}` }
+  ];
+}
+var COMPUTER_BLOCKED_SHORTCUTS = Object.freeze([
+  ...withCtrlOrMeta("KeyC", "C"),
+  ...withCtrlOrMeta("KeyX", "X"),
+  ...withCtrlOrMeta("KeyV", "V"),
+  ...withCtrlOrMeta("KeyW", "W"),
+  ...withCtrlOrMeta("KeyT", "T"),
+  ...withCtrlOrMeta("KeyN", "N"),
+  ...withCtrlOrMeta("KeyQ", "Q"),
+  ...withCtrlOrMeta("Tab", "Tab"),
+  { code: "Tab", requires: ALT, label: "Alt+Tab" },
+  { code: "F4", requires: ALT, label: "Alt+F4" },
+  { code: "Delete", requires: CTRL | ALT, label: "Ctrl+Alt+Delete" },
+  { code: "MetaLeft", requires: 0, label: "\u2318/Win" },
+  { code: "MetaRight", requires: 0, label: "\u2318/Win" }
+]);
+var TASK_BOARD_STATUSES = [
+  "backlog",
+  "todo",
+  "in_progress",
+  "in_review",
+  "blocked",
+  "done",
+  "cancelled"
+];
+var TASK_BOARD_TERMINAL_STATUSES = ["done", "cancelled"];
+var TASK_BOARD_STATUS_COLUMNS = TASK_BOARD_STATUSES.map((status) => ({
+  key: status,
+  statuses: [status],
+  terminal: TASK_BOARD_TERMINAL_STATUSES.includes(status),
+  toggleOnly: false
+}));
+var PLATFORM_DEFAULT_MERGE_POLICY = Object.freeze({
+  allowAgentMerge: false,
+  requireGreenGate: true,
+  requireHumanApproval: true,
+  allowedMergeMethods: ["squash"],
+  protectedBranches: ["main", "master", "develop", "stage"]
+});
+var MERGE_APPROVAL_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var TOOL_GRANT_SCOPE_PRECEDENCE = Object.freeze([
+  "tenant",
+  "organization",
+  "work",
+  "agent"
+]);
+var PLATFORM_DEFAULT_TOOL_GRANT = Object.freeze({
+  allow: Object.freeze(["*"]),
+  deny: Object.freeze([])
+});
+var AGENT_INIT_SCRIPT_MAX_BYTES = 16 * 1024;
+var INGEST_EVENT_PAYLOAD_MAX_BYTES = 32 * 1024;
+var VERSION = "1.0.0";
+var GTM_SKILLS = [
+  // ── research ────────────────────────────────────────────────────────
+  {
+    slug: "lead-research",
+    title: "Lead research",
+    description: "Build a candidate lead list from seed criteria and public sources, recording a supporting source for every contact.",
+    stage: "research",
+    tags: ["gtm", "sales", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "icp", description: "Ideal-customer description: segment, size, geography, role titles." },
+      { key: "seed_sources", description: "Seed lists, domains, or saved searches to start from." },
+      { key: "max_leads", description: "Hard cap on how many candidates this run may collect." }
+    ],
+    outputs: [
+      { key: "contacts", description: "Candidate contacts with name, company, title, and a source reference." }
+    ],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Build a candidate lead list from the supplied criteria and seed sources.",
+      "",
+      "## Rules",
+      "- NEVER invent a contact detail. An email address, phone number, or title is recorded only",
+      "  when a source supports it; otherwise leave the field empty.",
+      "- Record `source` on every contact \u2014 the URL or seed list the entry came from. A contact",
+      "  without a source is not a lead, it is a guess.",
+      "- Respect `max_leads` exactly. Stop collecting when the cap is reached and say how many",
+      "  candidates were left unexamined.",
+      "- De-duplicate by email when present, otherwise by (company, name).",
+      "- Exclude anyone who has asked not to be contacted, and any source that forbids collection.",
+      "",
+      "## Output",
+      "Write `contacts`. Each entry carries `name`, and any of `email`, `company`, `title`,",
+      "`source`, `notes` that a source supports. Report the counts examined, kept, and dropped,",
+      "with the reason for each drop category."
+    ].join("\n")
+  },
+  {
+    slug: "competitor-watch",
+    title: "Competitor watch",
+    description: "Monitor a watchlist of companies across public sources and emit dated, source-linked change signals.",
+    stage: "research",
+    tags: ["gtm", "marketing", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "watchlist", description: "Companies to monitor: name, website, public repositories." },
+      { key: "focus_areas", description: "What to watch: pricing, features, positioning, hiring." },
+      { key: "since", description: "Only report changes observed after this date." }
+    ],
+    outputs: [{ key: "signals", description: "Dated observations with a source URL and the focus area they hit." }],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Monitor the watchlist across public sources and report what changed.",
+      "",
+      "## Rules",
+      "- Public sources only: published pages, public announcements, public repositories.",
+      "- Every signal carries a source URL and an observation date. No date or no URL means the",
+      "  signal is not reportable.",
+      "- Separate FACT (what the source says) from ANALYSIS (what you infer). Never blend them in",
+      "  the same sentence.",
+      "- Report only changes since `since`. If a focus area produced nothing, say so explicitly \u2014",
+      "  an empty period is a finding, not a gap to fill.",
+      "- Do not speculate about unannounced plans, internal metrics, or private information.",
+      "",
+      "## Output",
+      "Write `signals`. Each entry carries `title`, `url`, `publishedDate`, the focus area, and a",
+      "one-line factual summary."
+    ].join("\n")
+  },
+  {
+    slug: "news-signal-detection",
+    title: "News signal detection",
+    description: "Scan configured topics for newsworthy events and rank them by relevance to the campaign, discarding noise.",
+    stage: "research",
+    tags: ["gtm", "marketing", "research"],
+    version: VERSION,
+    inputs: [
+      { key: "topics", description: "Topics, keywords, or accounts to scan." },
+      { key: "lookback_days", description: "How far back the scan reaches." },
+      { key: "relevance_threshold", description: "Minimum relevance (0-1) an item must clear to be kept." }
+    ],
+    outputs: [{ key: "signals", description: "Relevance-ranked news items with source URL and publish date." }],
+    allowedTools: ["search", "content-extractor"],
+    body: [
+      "Scan the configured topics and keep only what is genuinely newsworthy for this campaign.",
+      "",
+      "## Rules",
+      "- Score each candidate 0-1 for relevance to the campaign brief and drop anything below",
+      "  `relevance_threshold`. State the score and the one-line reason for every item you keep.",
+      "- Prefer primary sources over aggregators; when both exist, link the primary.",
+      "- Collapse duplicate coverage of the same event into one signal with the best source.",
+      "- Nothing older than `lookback_days`. Undated items are dropped, not guessed at.",
+      "- Never restate a headline as fact when the source hedges it \u2014 carry the hedge through.",
+      "",
+      "## Output",
+      "Write `signals` ordered by descending relevance, each with `title`, `url`, `publishedDate`,",
+      "the relevance score, and the reason it matters here."
+    ].join("\n")
+  },
+  // ── qualify ─────────────────────────────────────────────────────────
+  {
+    slug: "lead-scoring",
+    title: "Lead scoring",
+    description: "Score contacts 0-100 against a declarative weight table and attach an explainable reason per point awarded.",
+    stage: "qualify",
+    tags: ["gtm", "sales", "scoring"],
+    version: VERSION,
+    inputs: [
+      { key: "contacts", description: "Candidate contacts to score." },
+      { key: "score_weights", description: "Weight table: signal name \u2192 points awarded." }
+    ],
+    outputs: [
+      { key: "scored_contacts", description: "Contacts with `score` (0-100) and `scoreReasons` per contact." }
+    ],
+    allowedTools: [],
+    body: [
+      "Score every contact against the supplied weight table.",
+      "",
+      "## Rules",
+      "- The weight table is the whole model. Award points ONLY for signals it names; never invent",
+      "  a bonus, and never award points for a signal the contact data does not actually support.",
+      "- Clamp the final score to 0-100. Record one `scoreReasons` line per point awarded, in the",
+      "  form `<signal> +<points>`, so any score can be re-derived by hand.",
+      "- A missing field is worth zero points, never an assumed value.",
+      "- Scoring is deterministic: the same contact and the same weight table must always produce",
+      "  the same score. Do not break ties with judgement calls \u2014 leave ties tied.",
+      "",
+      "## Output",
+      "Write `scored_contacts` sorted by descending score, then report the score distribution and",
+      "the three signals that moved the list most."
+    ].join("\n")
+  },
+  {
+    slug: "risk-filter",
+    title: "Risk filter",
+    description: "Flag low-quality or unsafe contacts against a risk weight table and exclude those at or above the threshold.",
+    stage: "qualify",
+    tags: ["gtm", "sales", "safety"],
+    version: VERSION,
+    inputs: [
+      { key: "scored_contacts", description: "Contacts already carrying a priority score." },
+      { key: "risk_weights", description: "Risk weight table: risk signal \u2192 points." },
+      { key: "risk_threshold", description: "Risk score at or above which a contact is excluded." }
+    ],
+    outputs: [
+      {
+        key: "scored_contacts",
+        description: "The same contacts, now carrying `riskScore`, `riskReasons`, and an excluded flag."
+      }
+    ],
+    allowedTools: [],
+    body: [
+      "Assess each scored contact for risk and mark \u2014 never silently delete \u2014 the excluded ones.",
+      "",
+      "## Rules",
+      "- Apply the risk weight table exactly as given; record one `riskReasons` line per point.",
+      "- Contacts at or above `risk_threshold` are EXCLUDED from outbound, but they stay in the",
+      "  data set with their reasons attached so a human can overturn the call.",
+      '- Never drop a contact without a recorded reason. "Looked wrong" is not a reason.',
+      "- Risk is about deliverability and safety (unverifiable identity, throwaway domains,",
+      "  do-not-contact signals) \u2014 it is not a second opinion on fit. Fit is `lead-scoring`.",
+      "",
+      "## Output",
+      "Write the enriched `scored_contacts` and report how many were excluded, grouped by the",
+      "dominant risk reason."
+    ].join("\n")
+  },
+  // ── draft ───────────────────────────────────────────────────────────
+  {
+    slug: "outreach-personalization",
+    title: "Outreach personalization",
+    description: "Write one 80-120 word personalized outbound draft per qualified contact, grounded only in known facts.",
+    stage: "draft",
+    tags: ["gtm", "sales", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "scored_contacts", description: "Qualified, non-excluded contacts to write for." },
+      { key: "campaign_brief", description: "Offer, proof points, and the single ask." },
+      { key: "tone", description: "Configured tone for the campaign." }
+    ],
+    outputs: [{ key: "drafts", description: "One draft per contact with `ref`, `channel`, `subject`, `body`." }],
+    allowedTools: [],
+    body: [
+      "Write one outbound draft per qualified contact.",
+      "",
+      "## Rules",
+      "- HARD CONSTRAINT: drafts only. Nothing is sent, scheduled, or queued for delivery here.",
+      '- 80-120 words in the body. One ask. No multi-part asks, no "quick question" openers that',
+      "  the rest of the message contradicts.",
+      "- Personalize ONLY from fields and signals actually present on the contact. If there is no",
+      "  personalization material, write the generic version and say so \u2014 a fabricated detail is",
+      "  worse than a generic opener.",
+      "- Write a subject line only for channels that carry one.",
+      "- No invented metrics, customer names, or mutual connections. Ever.",
+      "",
+      "## Output",
+      "Write `drafts`, ordered by descending contact score so the review gate sees the best",
+      "candidates first. Each draft carries a stable `ref` used later by review and the action log."
+    ].join("\n")
+  },
+  {
+    slug: "newsletter-drafting",
+    title: "Newsletter drafting",
+    description: "Turn briefs, notes, and collected signals into a scannable newsletter issue with one clear call to action.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "content", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "campaign_brief", description: "Issue theme, audience, and the call to action." },
+      { key: "signals", description: "Collected source material for the issue." },
+      { key: "tone", description: "Configured editorial tone." }
+    ],
+    outputs: [{ key: "drafts", description: "A single newsletter draft: subject line plus sectioned body." }],
+    allowedTools: ["content-extractor"],
+    body: [
+      "Draft one newsletter issue from the brief and the collected material.",
+      "",
+      "## Rules",
+      "- Draft-first: the issue is produced for human review. Never send or schedule it.",
+      "- Structure: subject line, one-sentence hook, 3-5 short sections, one call to action.",
+      "  Scannable beats comprehensive.",
+      "- Every claim traces to the brief, the knowledge base, or a supplied signal. Link the",
+      "  source when the section rests on one.",
+      "- Never invent metrics, quotes, or customer names.",
+      "- When the source material is thin, say so and list what extra input would raise quality",
+      "  rather than padding the issue.",
+      "",
+      "## Output",
+      "Write `drafts` with a single entry: `subject` plus the sectioned `body`."
+    ].join("\n")
+  },
+  {
+    slug: "social-scheduling",
+    title: "Social scheduling",
+    description: "Plan a channel-fit social calendar and stage each post for review, respecting cadence and angle variety.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "social", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "campaign_brief", description: "Campaign themes, channels, and cadence." },
+      { key: "signals", description: "Source material and trends to build posts from." },
+      { key: "cadence", description: "Posts per channel per period." }
+    ],
+    outputs: [
+      { key: "drafts", description: "Channel-fit post drafts, each with its planned slot in the calendar." }
+    ],
+    allowedTools: [],
+    body: [
+      "Plan the social calendar for the cadence window and draft each post.",
+      "",
+      "## Rules",
+      "- Draft-first: posts are STAGED for review. Never publish, never schedule to a live channel.",
+      "- Fit each draft to its channel: length, hashtag conventions, and link placement differ and",
+      "  a cross-posted body is a tell.",
+      "- Do not repeat the same angle inside one cadence window. Track the angle per slot and vary",
+      "  it deliberately.",
+      "- Build only from the brief, the content Works, and supplied signals. Never invent product",
+      "  claims or engagement numbers.",
+      "- Respect `cadence` exactly \u2014 proposing more slots than the operator configured is not",
+      "  ambition, it is a spam risk.",
+      "",
+      "## Output",
+      "Write `drafts` with the planned slot (channel + relative day) on each entry, plus a compact",
+      "calendar view of the window."
+    ].join("\n")
+  },
+  {
+    slug: "digest-compilation",
+    title: "Digest compilation",
+    description: "Compile collected signals into a recurring digest that separates facts from analysis and highlights change.",
+    stage: "draft",
+    tags: ["gtm", "marketing", "reporting", "writing"],
+    version: VERSION,
+    inputs: [
+      { key: "signals", description: "Signals collected this period." },
+      { key: "previous_digest", description: "The prior issue, used to compute what changed." },
+      { key: "focus_areas", description: "Sections the digest must cover." }
+    ],
+    outputs: [{ key: "drafts", description: "A digest draft: sections, change highlights, and a trend view." }],
+    allowedTools: [],
+    body: [
+      "Compile the period digest from the collected signals.",
+      "",
+      "## Rules",
+      "- One section per focus area, in the configured order, every issue. A stable shape is what",
+      "  makes a recurring digest readable.",
+      "- Every section splits FACTS (sourced, dated, linked) from ANALYSIS (your interpretation),",
+      "  under those labels.",
+      "- Lead with what CHANGED since `previous_digest`. Unchanged areas get one line, not a",
+      "  restatement of last issue.",
+      "- No fabrication and no padding: if a focus area produced no signal this period, write",
+      "  exactly that.",
+      "- Close with a short trend view over the recent periods \u2014 direction, not prophecy.",
+      "",
+      "## Output",
+      "Write `drafts` with a single digest entry for review."
+    ].join("\n")
+  },
+  // ── act ─────────────────────────────────────────────────────────────
+  {
+    slug: "crm-sync-hygiene",
+    title: "CRM sync hygiene",
+    description: "Prepare reviewed records for a customer-record sync: normalized fields, no duplicates, no destructive overwrites.",
+    stage: "act",
+    tags: ["gtm", "sales", "operations"],
+    version: VERSION,
+    inputs: [
+      { key: "approved_drafts", description: "Records cleared by the review gate." },
+      { key: "field_map", description: "Local field \u2192 destination field mapping." }
+    ],
+    outputs: [
+      { key: "action_log", description: "Prepared record writes with the field diff and the reason for each." }
+    ],
+    allowedTools: ["connector"],
+    body: [
+      "Prepare reviewed records for the destination system without losing data.",
+      "",
+      "## Rules",
+      "- Only records that passed the review gate are eligible. Nothing else, no exceptions.",
+      "- NEVER overwrite a populated destination field with an empty local value. Blank does not",
+      '  mean "clear it", it means "we do not know".',
+      "- Match before you create: search by the destination key (email, then domain + name) and",
+      "  update the existing record rather than minting a duplicate.",
+      "- Normalize on the way out \u2014 casing, phone format, domain form \u2014 per `field_map`.",
+      "- Record every intended write in `action_log` with its field-level diff BEFORE it is",
+      "  applied, so the change is auditable and reversible.",
+      "",
+      "## Output",
+      "Write `action_log` with one entry per record, status `prepared` or `skipped`, and the",
+      "reason for every skip."
+    ].join("\n")
+  },
+  // ── follow-up ───────────────────────────────────────────────────────
+  {
+    slug: "follow-up-cadence",
+    title: "Follow-up cadence",
+    description: "Schedule timed re-engagement for quiet threads, with strict caps and an unconditional stop on any reply.",
+    stage: "follow-up",
+    tags: ["gtm", "sales", "cadence"],
+    version: VERSION,
+    inputs: [
+      { key: "action_log", description: "What was prepared, for whom, and when." },
+      { key: "reply_state", description: "Which threads have received a reply." },
+      { key: "cadence", description: "Follow-up spacing and the maximum number of touches." }
+    ],
+    outputs: [
+      { key: "follow_up_queue", description: "Queued follow-ups with a due offset and the rationale for each." }
+    ],
+    allowedTools: [],
+    body: [
+      "Queue follow-ups for threads that have gone quiet.",
+      "",
+      "## Rules",
+      "- HARD STOP on any reply, bounce, or opt-out: that thread leaves the cadence immediately and",
+      "  permanently. This overrides every other rule here.",
+      "- Never exceed the configured maximum touches per contact, and never shorten the configured",
+      "  spacing to fit more in.",
+      "- Each follow-up must add something \u2014 a new angle, a new proof point, a genuine deadline.",
+      '  "Bumping this to the top of your inbox" is not a follow-up.',
+      "- Follow-ups are drafts like any other outbound: they re-enter the review gate before",
+      "  anything is prepared for delivery.",
+      "",
+      "## Output",
+      "Write `follow_up_queue` with `draftRef`, `channel`, `dueAfterDays`, and the rationale."
+    ].join("\n")
+  },
+  {
+    slug: "reply-detection",
+    title: "Reply detection",
+    description: "Classify inbound replies into interested / not-now / decline / opt-out and route each to the right next step.",
+    stage: "follow-up",
+    tags: ["gtm", "sales", "classification"],
+    version: VERSION,
+    inputs: [
+      { key: "inbound_messages", description: "Replies received against prepared outbound." },
+      { key: "action_log", description: "The outbound each reply responds to." }
+    ],
+    outputs: [
+      { key: "reply_state", description: "Per-thread classification, confidence, and the routing decision." }
+    ],
+    allowedTools: ["connector"],
+    body: [
+      "Classify each inbound reply and decide what happens to its thread.",
+      "",
+      "## Classes",
+      "`interested` \xB7 `not_now` \xB7 `decline` \xB7 `opt_out` \xB7 `auto_reply` \xB7 `unclear`",
+      "",
+      "## Rules",
+      "- `opt_out` and `decline` stop the cadence permanently. When in doubt between `opt_out` and",
+      "  anything else, choose `opt_out` \u2014 the cost of a wrong stop is far below the cost of a",
+      "  wrong send.",
+      "- `auto_reply` (out-of-office, autoresponder) does NOT count as a reply for cadence",
+      "  purposes, but it does update the contact record if it names a new owner.",
+      "- Use `unclear` rather than guessing; unclear threads route to a human, they do not route",
+      "  to the next touch.",
+      "- Record a confidence value and the phrase that drove the classification.",
+      "",
+      "## Output",
+      "Write `reply_state` with the class, confidence, evidence phrase, and routing decision per",
+      "thread."
+    ].join("\n")
+  },
+  // ── enrich ──────────────────────────────────────────────────────────
+  {
+    slug: "contact-enrichment",
+    title: "Contact enrichment",
+    description: "Backfill missing contact and account fields from verifiable sources, recording the evidence for each fill.",
+    stage: "enrich",
+    tags: ["gtm", "sales", "data"],
+    version: VERSION,
+    inputs: [
+      { key: "contacts", description: "Contacts with gaps to fill." },
+      { key: "enrichment_fields", description: "Which fields this run is allowed to fill." }
+    ],
+    outputs: [
+      { key: "enriched_contacts", description: "Contacts with filled fields and a source note per filled field." }
+    ],
+    allowedTools: ["search", "content-extractor", "connector"],
+    body: [
+      "Fill the requested gaps on each contact \u2014 and only those gaps.",
+      "",
+      "## Rules",
+      "- Evidence-bound: a field is filled ONLY when a source supports it, and the source goes in",
+      "  the contact notes alongside the value. No source, no fill.",
+      "- NEVER guess or pattern-generate an email address. Constructing `first.last@domain` because",
+      "  it usually works is fabrication, and it is the single most damaging thing this Skill can do.",
+      "- Never overwrite an existing non-empty value. Enrichment fills gaps; corrections are a",
+      "  human decision.",
+      "- Only touch fields named in `enrichment_fields`.",
+      "- When two sources disagree, leave the field empty and flag the conflict.",
+      "",
+      "## Output",
+      "Write `enriched_contacts` and report fill rate per field plus every conflict flagged."
+    ].join("\n")
+  },
+  // ── measure ─────────────────────────────────────────────────────────
+  {
+    slug: "seo-audit",
+    title: "Search-visibility audit",
+    description: "Audit a site or content Work for search visibility and return a prioritized, evidence-cited fix list.",
+    stage: "measure",
+    tags: ["gtm", "marketing", "seo", "audit"],
+    version: VERSION,
+    inputs: [
+      { key: "pages", description: "Pages or posts in scope, with their current metadata and headings." },
+      { key: "target_keywords", description: "Keywords or topics the Work is meant to rank for." },
+      { key: "previous_audit", description: "The prior audit, used to report movement and regressions." }
+    ],
+    outputs: [
+      { key: "campaign_report", description: "Prioritized findings with page reference, impact, and fix." }
+    ],
+    allowedTools: ["content-extractor", "search"],
+    body: [
+      "Audit the in-scope pages for search visibility and propose fixes.",
+      "",
+      "## What to check",
+      "Title and description metadata \xB7 heading structure and hierarchy \xB7 internal linking and",
+      "orphan pages \xB7 keyword coverage against `target_keywords` and the gaps between them \xB7",
+      "duplicate or thin content \xB7 canonical and indexability signals.",
+      "",
+      "## Rules",
+      "- Every finding cites the specific page or setting it applies to and states the expected",
+      "  impact. A finding without a page reference is an opinion.",
+      "- Return a prioritized top 5-10, quick wins first \u2014 not an exhaustive dump.",
+      "- Propose changes as reviewable edits or tasks. Never modify published pages directly.",
+      "- When `previous_audit` is present, report movement honestly, INCLUDING regressions. A",
+      "  clean report that hides a regression is worse than no report.",
+      "- No traffic or ranking projections. Estimate effort and impact qualitatively instead.",
+      "",
+      "## Output",
+      "Write `campaign_report` with the prioritized findings and the movement summary."
+    ].join("\n")
+  },
+  {
+    slug: "campaign-reporting",
+    title: "Campaign reporting",
+    description: "Summarize a campaign period into counted totals, honest insights, and concrete hints for the next cycle.",
+    stage: "measure",
+    tags: ["gtm", "reporting"],
+    version: VERSION,
+    inputs: [
+      { key: "action_log", description: "What the campaign prepared and skipped." },
+      { key: "reply_state", description: "How recipients responded." },
+      { key: "scored_contacts", description: "The qualified population the period worked from." }
+    ],
+    outputs: [{ key: "campaign_report", description: "Totals, insights, and next-cycle variant hints." }],
+    allowedTools: [],
+    body: [
+      "Report the campaign period and close the loop into the next one.",
+      "",
+      "## Rules",
+      "- Totals are COUNTED from the supplied data, never estimated: contacts, qualified, excluded,",
+      "  drafts, approved, prepared, follow-ups queued.",
+      "- State the denominator on every rate. A percentage without its base is not a metric.",
+      "- Below roughly 30 observations, report counts and refuse to draw a conclusion \u2014 small",
+      "  samples produce confident nonsense.",
+      "- Insights must be falsifiable and tied to a number in the totals.",
+      "- End with `nextVariantHints`: concrete, testable changes for the next draft cycle, one per",
+      "  line. This is the loop closing \u2014 a report that ends at description wasted the period.",
+      "",
+      "## Output",
+      "Write `campaign_report` with `summary`, `totals`, `insights`, and `nextVariantHints`."
+    ].join("\n")
+  },
+  {
+    slug: "engagement-analysis",
+    title: "Engagement analysis",
+    description: "Compare engagement across variants, channels, and segments, and say which differences are real.",
+    stage: "measure",
+    tags: ["gtm", "marketing", "reporting"],
+    version: VERSION,
+    inputs: [
+      { key: "engagement_events", description: "Per-item engagement observations for the period." },
+      { key: "drafts", description: "The variants the events belong to." },
+      { key: "comparison_window", description: "Prior period to compare against." }
+    ],
+    outputs: [
+      { key: "campaign_report", description: "Per-variant and per-segment engagement with a confidence call." }
+    ],
+    allowedTools: ["metrics"],
+    body: [
+      "Analyze engagement and report what actually differs.",
+      "",
+      "## Rules",
+      "- Compare like with like: same channel, same audience segment, comparable send window.",
+      "  Cross-channel comparisons need an explicit caveat.",
+      "- Report absolute counts alongside every rate.",
+      "- Say plainly when a difference is within noise. Declaring a winner on a handful of",
+      "  observations is the most common way this analysis misleads a campaign for months.",
+      "- Separate what changed (observation) from why (hypothesis), and label hypotheses as such.",
+      "- Surface the losing variants too \u2014 a variant that consistently underperforms is the",
+      "  cheapest thing to stop doing.",
+      "",
+      "## Output",
+      "Write `campaign_report` with the per-variant table, the segment breakdown, and an explicit",
+      "confidence statement per comparison."
+    ].join("\n")
+  }
+];
+var GTM_SKILL_SLUGS = GTM_SKILLS.map((skill) => skill.slug);
+var GTM_SKILL_BY_SLUG = new Map(
+  GTM_SKILLS.map((skill) => [skill.slug, skill])
+);
+var SKILL_READINESS_STATES = [
+  "ready",
+  "needs_setup",
+  "missing_requirements",
+  "blocked_by_access",
+  "unknown",
+  "check_failed"
+];
+var SKILL_CARD_STATES = [...SKILL_READINESS_STATES, "disabled", "needs_review"];
+var SKILL_READINESS_FILTERS = [...SKILL_CARD_STATES, "attention"];
+var FLEET_AGENT_CREDENTIAL_FAMILIES = [
+  {
+    cli: "claude-code",
+    // CLAUDE_CODE_OAUTH_TOKEN (a Claude plan) before ANTHROPIC_API_KEY
+    // (per-token Console billing) — deliberately the REVERSE of the CLI's
+    // own precedence, so the cheaper credential wins rather than the one
+    // that silently spends money.
+    envNames: ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"]
+  },
+  {
+    cli: "codex",
+    // CODEX_ACCESS_TOKEN draws the ChatGPT workspace entitlement;
+    // OPENAI_API_KEY is per-token platform billing.
+    envNames: ["CODEX_ACCESS_TOKEN", "OPENAI_API_KEY"]
+  }
+];
+var FLEET_AGENT_CREDENTIAL_ENV_NAMES = FLEET_AGENT_CREDENTIAL_FAMILIES.flatMap(
+  (family) => family.envNames
+);
+var FLEET_RUN_ENV_FILE_MAX_CONTENT_BYTES = 32 * 1024;
+var FLEET_RUN_ENV_FILES_MAX_TOTAL_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_PAYLOAD_BYTES = 256 * 1024;
+var FLEET_JOB_MAX_RESULT_BYTES = 256 * 1024;
+var FLEET_JOB_DEFAULT_QUEUED_MAX_AGE_SEC = Object.freeze({
+  "agent-task": 24 * 60 * 60,
+  "acceptance-checks": 2 * 60 * 60,
+  "browser-check": 2 * 60 * 60,
+  // A live view nobody claimed is abandoned by the session service after
+  // 40 seconds, which cancels its job there and then. The queue SLA is only
+  // the backstop behind that, so it deliberately does not undercut the
+  // shortest existing default (the fallback an unknown kind fails closed to).
+  "computer-session": 2 * 60 * 60
+});
+var FLEET_JOB_MAX_QUEUED_MAX_AGE_SEC = 7 * 24 * 60 * 60;
+var FLEET_AGENT_EXECUTION_MAX_INSTRUCTIONS_BYTES = 160 * 1024;
+var FLEET_AGENT_TASK_TIMELINE_MAX_BYTES = 48 * 1024;
+var FLEET_AGENT_TASK_TRANSCRIPT_MAX_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_FILE_BYTES = 64 * 1024;
+var FLEET_AGENT_TASK_QUESTION_MAX_CONTEXT_BYTES = 6 * 1024;
+var FLEET_NODE_MAX_MEMORY_MB = 1024 * 1024;
+var FLEET_MAX_DAILY_COST_CEILING_CENTS = 1e5 * 100;
+var FLEET_MAX_DISK_FREE_BYTES = 2 ** 60;
+var FLEET_DEFAULT_ENROLLMENT_TOKEN_TTL_MS = 15 * 6e4;
+var FLEET_DEFAULT_NODE_OFFLINE_AFTER_MS = 5 * 6e4;
+var FLEET_DEFAULT_NODE_OFFLINE_NOTICE_AFTER_MS = 30 * 6e4;
+var FLEET_DEFAULT_CREDENTIAL_ROTATION_OVERLAP_MS = 15 * 6e4;
+var FLEET_MAX_CREDENTIAL_ROTATION_OVERLAP_MS = 24 * 60 * 6e4;
+var EMAIL_INBOX_DEFAULT_DAILY_CAP = 100;
+var EMAIL_INBOX_BURST_SENDS = 10;
+var EMAIL_INBOX_BURST_RECIPIENTS = 20;
+var EMAIL_WORKSPACE_DAILY_CAP = 500;
+var EMAIL_WORKSPACE_MONTHLY_CAP = 1e4;
+var EMAIL_MAX_RECIPIENTS_PER_MESSAGE = 50;
+var EMAIL_SEND_CAP_RECOMMENDED_DEFAULTS = Object.freeze({
+  inboxDailySends: EMAIL_INBOX_DEFAULT_DAILY_CAP,
+  inboxBurstSends: EMAIL_INBOX_BURST_SENDS,
+  inboxBurstRecipients: EMAIL_INBOX_BURST_RECIPIENTS,
+  recipientsPerMessage: EMAIL_MAX_RECIPIENTS_PER_MESSAGE,
+  workspaceDailySends: EMAIL_WORKSPACE_DAILY_CAP,
+  workspaceMonthlySends: EMAIL_WORKSPACE_MONTHLY_CAP
+});
+var EMAIL_DAY_WINDOW_MS = 24 * 60 * 60 * 1e3;
+var EMAIL_MONTH_WINDOW_MS = 30 * EMAIL_DAY_WINDOW_MS;
+var EMAIL_INBOX_CAP_FIELDS = [
+  "inboxDailySends",
+  "inboxBurstSends",
+  "inboxBurstRecipients",
+  "recipientsPerMessage"
+];
+var EMAIL_SEND_CAP_FIELDS = [
+  ...EMAIL_INBOX_CAP_FIELDS,
+  "workspaceDailySends",
+  "workspaceMonthlySends"
+];
+var INBOX_CAP_FIELD_SET = new Set(EMAIL_INBOX_CAP_FIELDS);
+var DAY_MS2 = 24 * 60 * 60 * 1e3;
+var PROMOTION_GATE_DECISION_GRACE_MS = 20 * 60 * 1e3;
+var RELEASE_VERIFY_ATTEMPT_INTERVAL_MS = 10 * 60 * 1e3;
+var RELEASE_VERIFY_BUDGET_MS = 8 * 60 * 60 * 1e3;
+var MAX_CONVERSATION_BODY_BYTES = 16 * 1024;
+var CONNECTION_CREDENTIAL_ERROR_CODES = Object.freeze([
+  "credential_rejected",
+  "credential_missing",
+  "https_required"
+]);
+var CONNECTION_HEALTH_WARNING_CODES = Object.freeze([
+  "insecure_transport"
+]);
+var BACKUP_TRIM_POLICIES = Object.freeze({
+  activity: Object.freeze({ field: "createdAt", defaultDays: 365, fullHistoryDays: 1095 }),
+  runLogs: Object.freeze({ field: "createdAt", defaultDays: 90, fullHistoryDays: 1095 }),
+  terminalTranscripts: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  notifications: Object.freeze({ field: "createdAt", defaultDays: 180, fullHistoryDays: 1095 }),
+  // `occurredAt`, not `createdAt`: `PluginUsageEvent` names its
+  // `@CreateDateColumn` `occurredAt` and has no `createdAt` at all. The trim
+  // resolver fails OPEN on an unknown column, so the wrong name here did not
+  // error — it silently exported every plugin usage event for the lifetime
+  // of the workspace, from the archive's single largest history table, while
+  // the docs page published a 180-day window.
+  pluginUsageEvents: Object.freeze({ field: "occurredAt", defaultDays: 180, fullHistoryDays: 1095 }),
+  deliveryLogs: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  // `firedAt`, for the same reason: `InboundTriggerFire`'s creation
+  // timestamp is `firedAt` and it has no `createdAt`, so the declared
+  // 90-day window was never applied to `data/schedules/trigger-fires.jsonl`
+  // and the `schedules` domain reported `complete` where the docs promise a
+  // trim.
+  triggerFires: Object.freeze({ field: "firedAt", defaultDays: 90, fullHistoryDays: 1095 }),
+  retrievalTrail: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 }),
+  fleetJobs: Object.freeze({ field: "createdAt", defaultDays: 30, fullHistoryDays: 365 })
+});
+var BACKUP_DOMAINS = Object.freeze([
+  Object.freeze({
+    key: "account",
+    restorability: "restorable",
+    collectorId: "account",
+    dataDir: "account"
+  }),
+  Object.freeze({
+    key: "organizations",
+    restorability: "restorable",
+    collectorId: "organizations",
+    dataDir: "organizations"
+  }),
+  Object.freeze({
+    key: "agents",
+    restorability: "restorable",
+    collectorId: "agents",
+    dataDir: "agents"
+  }),
+  Object.freeze({
+    key: "missions",
+    restorability: "restorable",
+    collectorId: "missions",
+    dataDir: "missions"
+  }),
+  Object.freeze({
+    key: "tasks",
+    restorability: "restorable",
+    collectorId: "tasks",
+    dataDir: "tasks"
+  }),
+  Object.freeze({
+    key: "works",
+    restorability: "restorable",
+    collectorId: "works",
+    dataDir: "works"
+  }),
+  Object.freeze({
+    key: "knowledge",
+    restorability: "restorable",
+    collectorId: "knowledge",
+    dataDir: "knowledge"
+  }),
+  Object.freeze({
+    key: "schedules",
+    restorability: "restorable",
+    collectorId: "schedules",
+    dataDir: "schedules"
+  }),
+  Object.freeze({
+    key: "runs",
+    restorability: "record-only",
+    collectorId: "runs",
+    dataDir: "runs"
+  }),
+  Object.freeze({
+    key: "decisions",
+    restorability: "record-only",
+    collectorId: "decisions",
+    dataDir: "decisions"
+  }),
+  Object.freeze({
+    key: "communication",
+    restorability: "partly-restorable",
+    collectorId: "communication",
+    dataDir: "communication"
+  }),
+  Object.freeze({
+    key: "connections",
+    restorability: "restorable",
+    collectorId: "connections",
+    dataDir: "connections"
+  }),
+  Object.freeze({
+    key: "fleet",
+    restorability: "partly-restorable",
+    collectorId: "fleet",
+    dataDir: "fleet"
+  }),
+  Object.freeze({
+    key: "billing",
+    restorability: "record-only",
+    collectorId: "billing",
+    dataDir: "billing"
+  }),
+  Object.freeze({
+    key: "activity",
+    restorability: "record-only",
+    collectorId: "activity",
+    dataDir: "activity",
+    trim: BACKUP_TRIM_POLICIES.activity
+  })
+]);
+var BACKUP_DOMAIN_KEYS = Object.freeze(BACKUP_DOMAINS.map((domain) => domain.key));
+var BACKUP_DOMAIN_COUNT = BACKUP_DOMAINS.length;
+var BACKUP_EXCLUSIONS = Object.freeze([
+  Object.freeze({
+    code: "auth_tokens",
+    summary: "Password hashes, password-reset tokens, magic-link tokens and email-verification tokens."
+  }),
+  Object.freeze({
+    code: "sessions",
+    summary: "Sessions, refresh tokens, and third-party auth provider access and refresh tokens."
+  }),
+  Object.freeze({
+    code: "api_key_material",
+    summary: "API key material. Keys appear as name, prefix, created date and active flag only."
+  }),
+  Object.freeze({
+    code: "stored_credentials",
+    summary: "Every stored credential, in plaintext or ciphertext \u2014 plugin secrets, connection headers, deployment secrets, webhook and trigger signing secrets, and encrypted runtime credentials. Only the names of the fields that were set are exported."
+  }),
+  Object.freeze({
+    code: "node_enrolment_secrets",
+    summary: "Node enrolment and heartbeat secrets."
+  }),
+  Object.freeze({
+    code: "payment_identifiers",
+    summary: "Payment-provider customer, subscription, payment-method and meter identifiers."
+  }),
+  Object.freeze({
+    code: "platform_admin_flag",
+    summary: "The platform-administrator flag."
+  }),
+  Object.freeze({
+    code: "vector_embeddings",
+    summary: "Vector embeddings and their coordinates, because they are derived and regenerate on demand."
+  }),
+  Object.freeze({
+    code: "internal_caches",
+    summary: "Internal caches and the delivery outbox."
+  })
+]);
+var BACKUP_DEFAULT_LIMITS = Object.freeze({
+  /** Ready archives kept for this long before their bytes are deleted. */
+  retentionDays: 14,
+  /** The record outlives its bytes by this long, so history stays legible. */
+  recordRetentionDays: 90,
+  /** Ready outcomes allowed per rolling 24 hours. Failures do not count. */
+  dailyAllowance: 3,
+  /** Rows the history list shows before "Show all". */
+  historyPageSize: 20,
+  /** Hard ceiling on a single history page. */
+  historyPageLimit: 50,
+  /** Bytes of one uploaded file that may be carried (200 MiB). */
+  maxFileBytes: 200 * 1024 * 1024,
+  /** Bytes of uploaded files in total (2 GiB). */
+  maxAttachmentBytes: 2 * 1024 * 1024 * 1024,
+  /** Bytes the finished archive may not exceed with a streaming backend (5 GiB). */
+  maxArchiveBytes: 5 * 1024 * 1024 * 1024,
+  /**
+   * The ceiling when the active storage backend cannot accept a stream and
+   * the archive has to be handed over as one buffer (512 MiB). A backend
+   * without streaming is a smaller limit, never a wrong result.
+   */
+  maxBufferedArchiveBytes: 512 * 1024 * 1024,
+  /** A manifest larger than this is refused by the check without being read (8 MiB). */
+  maxManifestBytes: 8 * 1024 * 1024,
+  /** Minutes a download link stays valid before the client re-mints it. */
+  downloadLinkTtlMinutes: 15,
+  /** Minutes without a heartbeat before a running backup is called stalled. */
+  stallMinutes: 10,
+  /** Minutes a queued backup may wait before it is called stalled. */
+  queuedStallMinutes: 15,
+  /** Minutes a backup may run before it is stopped. */
+  timeoutMinutes: 60,
+  /** Retries a single domain gets before it is marked failed and the archive finishes without it. */
+  domainRetries: 2,
+  /** Retries a storage write gets before the backup fails as `storage_unavailable`. */
+  storageRetries: 3
+});
+var HOUR_MS = 60 * 60 * 1e3;
+var MINUTE_MS = 60 * 1e3;
+var ACTION_CATEGORIES = Object.freeze([
+  "read.internal",
+  "read.external",
+  "write.internal",
+  "write.destructive",
+  "message.internal",
+  "message.external",
+  "publish.external",
+  "spend.metered",
+  "spend.commitment",
+  "access.grant",
+  "machine.run",
+  "machine.admin",
+  "agent.fanout"
+]);
+var LADDERED_CATEGORIES = Object.freeze(
+  ACTION_CATEGORIES.filter((c) => c !== "read.internal")
+);
+var DRAFTABLE_CATEGORIES = Object.freeze([
+  "write.internal",
+  "write.destructive",
+  "message.external",
+  "publish.external",
+  "machine.run",
+  "machine.admin"
+]);
+var ACTION_CATEGORY_CEILING = Object.freeze({
+  "read.external": "auto",
+  "write.internal": "auto",
+  "write.destructive": "ask",
+  "message.internal": "auto",
+  "message.external": "ask",
+  "publish.external": "ask",
+  "spend.metered": "auto",
+  "spend.commitment": "off",
+  "access.grant": "ask",
+  "machine.run": "auto",
+  "machine.admin": "ask",
+  "agent.fanout": "auto"
+});
+var ACTION_CATEGORY_DEFAULT = Object.freeze({
+  "read.external": "auto",
+  "write.internal": "auto",
+  "write.destructive": "ask",
+  "message.internal": "auto",
+  "message.external": "draft",
+  "publish.external": "ask",
+  "spend.metered": "auto",
+  "spend.commitment": "off",
+  "access.grant": "ask",
+  "machine.run": "ask",
+  "machine.admin": "ask",
+  "agent.fanout": "ask"
+});
+var ACTION_CATEGORY_RESTRICTIVENESS = Object.freeze([
+  "spend.commitment",
+  "access.grant",
+  "machine.admin",
+  "publish.external",
+  "message.external",
+  "write.destructive",
+  "machine.run",
+  "agent.fanout",
+  "spend.metered",
+  "write.internal",
+  "message.internal",
+  "read.external",
+  "read.internal"
+]);
+var ACTION_CATEGORY_I18N_KEY = Object.freeze({
+  "read.internal": "readInternal",
+  "read.external": "readExternal",
+  "write.internal": "writeInternal",
+  "write.destructive": "writeDestructive",
+  "message.internal": "messageInternal",
+  "message.external": "messageExternal",
+  "publish.external": "publishExternal",
+  "spend.metered": "spendMetered",
+  "spend.commitment": "spendCommitment",
+  "access.grant": "accessGrant",
+  "machine.run": "machineRun",
+  "machine.admin": "machineAdmin",
+  "agent.fanout": "agentFanout"
+});
+var TRUST_RUNG_ORDER = Object.freeze([
+  "off",
+  "draft",
+  "ask",
+  "auto"
+]);
+var SAFETY_RAIL_ORDER = Object.freeze([
+  "platform-stop",
+  "workspace-pause",
+  "scope-pause",
+  "grants",
+  "ladder",
+  "caps",
+  "rules"
+]);
+var SAFETY_REASON_CODES = Object.freeze([
+  "platform-stopped",
+  "workspace-paused",
+  "scope-paused",
+  "rung-off",
+  "rung-held",
+  "ceiling-refused",
+  "cap-reached",
+  "grant-denied",
+  "rule-blocked",
+  "policy-refused",
+  "unclassified-action",
+  "instruction-widening-attempt",
+  "non-human-actor",
+  "safe-mode"
+]);
+var SAFETY_ALLOW = Object.freeze({
+  decision: "allow",
+  railId: null,
+  category: null,
+  rung: null,
+  reasonCode: null,
+  summary: null
+});
+var AUTONOMY_GRANT_SCOPE_PRECEDENCE = Object.freeze([
+  "workspace",
+  "agent"
+]);
+var RAIL_REFUSAL_SUBJECT_TYPES = Object.freeze([
+  "run",
+  "agent",
+  "mission",
+  "task",
+  "schedule",
+  "trigger"
+]);
+var WORKSPACE_RUNNING = Object.freeze({
+  paused: false,
+  unverified: false,
+  reason: null,
+  pausedByUserId: null,
+  pausedAt: null,
+  refusedStarts: 0,
+  cleanlyStopped: 0
+});
+var WORKSPACE_PAUSED_UNVERIFIED = Object.freeze({
+  paused: true,
+  unverified: true,
+  reason: null,
+  pausedByUserId: null,
+  pausedAt: null,
+  refusedStarts: 0,
+  cleanlyStopped: 0
+});
+var READINESS_BLOCKERS = Object.freeze([
+  "at-ceiling",
+  "too-few-decisions",
+  "approval-rate",
+  "withdrawn",
+  "other-refusals"
+]);
+var EVER_STATS_KEY_HEADER = CONSTANTS.stats_headers.key;
+var EVER_STATS_SIGNATURE_HEADER = CONSTANTS.stats_headers.signature;
+var EVER_STATS_KEY_ID_HEADER = CONSTANTS.stats_headers.key_id;
+var EVER_STATS_SIGNATURE_PREFIX = CONSTANTS.stats_signature_prefix;
+var EVER_STATS_MAX_BODY_BYTES = CONSTANTS.stats.max_bytes;
+var DOMAIN_EVENT_CATALOG = [
+  // EW-P2-6 — `org:write` (and the app) create Organizations.
+  { type: "organization.created", domain: "organization", aggregateType: "organization", phase: "P2" },
+  { type: "organization.updated", domain: "organization", aggregateType: "organization", phase: "P1" },
+  {
+    type: "organization.member.added",
+    domain: "organization",
+    aggregateType: "organization",
+    phase: "P1",
+    child: "member"
+  },
+  {
+    type: "organization.member.updated",
+    domain: "organization",
+    aggregateType: "organization",
+    phase: "P1",
+    child: "member"
+  },
+  {
+    type: "organization.member.removed",
+    domain: "organization",
+    aggregateType: "organization",
+    phase: "P1",
+    child: "member"
+  },
+  { type: "agent.created", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.updated", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.status_changed", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.archived", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "agent.deleted", domain: "agents", aggregateType: "agent", phase: "P1" },
+  { type: "team.created", domain: "teams", aggregateType: "team", phase: "P1" },
+  { type: "team.updated", domain: "teams", aggregateType: "team", phase: "P1" },
+  { type: "team.deleted", domain: "teams", aggregateType: "team", phase: "P1" },
+  { type: "team.member.added", domain: "teams", aggregateType: "team", phase: "P1", child: "member" },
+  { type: "team.member.updated", domain: "teams", aggregateType: "team", phase: "P1", child: "member" },
+  { type: "team.member.removed", domain: "teams", aggregateType: "team", phase: "P1", child: "member" },
+  { type: "team.resource.added", domain: "teams", aggregateType: "team", phase: "P1", child: "resource" },
+  { type: "team.resource.removed", domain: "teams", aggregateType: "team", phase: "P1", child: "resource" },
+  { type: "work.created", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.updated", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.archived", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.deleted", domain: "works", aggregateType: "work", phase: "P1" },
+  { type: "work.member.added", domain: "works", aggregateType: "work", phase: "P1", child: "member" },
+  { type: "work.member.updated", domain: "works", aggregateType: "work", phase: "P1", child: "member" },
+  { type: "work.member.removed", domain: "works", aggregateType: "work", phase: "P1", child: "member" },
+  { type: "mission.created", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.updated", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.status_changed", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.deleted", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "goal.created", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.updated", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.status_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.archived", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.unarchived", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.deleted", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "goal.progress_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
+  { type: "idea.created", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "idea.updated", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "idea.status_changed", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "idea.deleted", domain: "ideas", aggregateType: "idea", phase: "P2" },
+  { type: "task.created", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.updated", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.transitioned", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.deleted", domain: "tasks", aggregateType: "task", phase: "P1" },
+  { type: "task.assignee.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "assignee" },
+  { type: "task.assignee.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "assignee" },
+  { type: "task.watcher.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "watcher" },
+  { type: "task.watcher.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "watcher" },
+  { type: "task.block.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "block" },
+  { type: "task.block.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "block" },
+  { type: "task.relation.added", domain: "tasks", aggregateType: "task", phase: "P1", child: "relation" },
+  { type: "task.relation.removed", domain: "tasks", aggregateType: "task", phase: "P1", child: "relation" },
+  { type: "task.comment.created", domain: "tasks", aggregateType: "task", phase: "P1", child: "comment" },
+  { type: "task.comment.updated", domain: "tasks", aggregateType: "task", phase: "P1", child: "comment" },
+  { type: "task.comment.deleted", domain: "tasks", aggregateType: "task", phase: "P1", child: "comment" },
+  { type: "task.attachment.added", domain: "tasks", aggregateType: "task", phase: "P3", child: "attachment" },
+  { type: "task.attachment.removed", domain: "tasks", aggregateType: "task", phase: "P3", child: "attachment" },
+  { type: "task.runtime_updated", domain: "tasks", aggregateType: "task", phase: "P1", optIn: true },
+  { type: "inbox.item.created", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "inbox.item.answered", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "inbox.item.state_changed", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "inbox.item.deleted", domain: "inbox", aggregateType: "inbox_item", phase: "P3" },
+  { type: "kb.document.created", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.updated", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.moved", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.archived", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.unarchived", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.deleted", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.document.review_changed", domain: "kb", aggregateType: "kb_document", phase: "P3" },
+  { type: "kb.folder.created", domain: "kb", aggregateType: "kb_folder", phase: "P3" },
+  { type: "kb.folder.updated", domain: "kb", aggregateType: "kb_folder", phase: "P3" },
+  { type: "kb.folder.deleted", domain: "kb", aggregateType: "kb_folder", phase: "P3" },
+  { type: "email.message.received", domain: "email", aggregateType: "email_message", phase: "P4" },
+  { type: "email.message.sent", domain: "email", aggregateType: "email_message", phase: "P4" },
+  { type: "email.message.status_changed", domain: "email", aggregateType: "email_message", phase: "P4" },
+  { type: "task.visibility_changed", domain: "visibility", aggregateType: "task", phase: "P1" },
+  { type: "agent.visibility_changed", domain: "visibility", aggregateType: "agent", phase: "P1" },
+  { type: "goal.visibility_changed", domain: "visibility", aggregateType: "goal", phase: "P2" },
+  { type: "mission.visibility_changed", domain: "visibility", aggregateType: "mission", phase: "P2" },
+  { type: "idea.visibility_changed", domain: "visibility", aggregateType: "idea", phase: "P2" }
+];
+var DOMAIN_EVENT_TYPES = DOMAIN_EVENT_CATALOG.map((entry) => entry.type);
+var CATALOG_BY_TYPE = new Map(
+  DOMAIN_EVENT_CATALOG.map((entry) => [entry.type, entry])
+);
+var RECIPIENT_SCOPED_EVENT_DOMAINS = {
+  inbox: "inbox:read",
+  email: "email:read"
+};
+var RECIPIENT_EVENT_SCOPES = Object.values(RECIPIENT_SCOPED_EVENT_DOMAINS);
+var INTEGRATION_SCOPES = [
+  "org:read",
+  "org:write",
+  "members:read",
+  "members:write",
+  "agents:read",
+  "teams:read",
+  "teams:write",
+  "works:read",
+  "works:write",
+  "missions:read",
+  "missions:write",
+  "goals:read",
+  "goals:write",
+  "ideas:read",
+  "ideas:write",
+  "tasks:read",
+  "tasks:write",
+  "inbox:read",
+  "inbox:write",
+  "kb:read",
+  "kb:write",
+  "email:read",
+  "email:write",
+  "events:read",
+  "webhooks:manage",
+  "links:write"
+];
+var INTEGRATION_OPT_IN_SCOPES = ["org:write", "email:write"];
+var EVER_GAUZY_PRESET_SCOPES = INTEGRATION_SCOPES.filter(
+  (scope) => !INTEGRATION_OPT_IN_SCOPES.includes(scope)
+);
+
+// ../../plugin/dist/index.js
+var DEFAULT_DIFF_MAX_BYTES = 256 * 1024;
+var HARD_DIFF_MAX_BYTES = 1024 * 1024;
+var PLUGIN_CAPABILITIES = {
+  AI_PROVIDER: "ai-provider",
+  SEARCH: "search",
+  SCREENSHOT: "screenshot",
+  CONTENT_EXTRACTOR: "content-extractor",
+  DATA_SOURCE: "data-source",
+  PIPELINE: "pipeline",
+  PIPELINE_MODIFIER: "pipeline-modifier",
+  CODE_EDIT: "code-edit",
+  FORM_SCHEMA_PROVIDER: "form-schema-provider",
+  DEPLOYMENT: "deployment",
+  GIT_PROVIDER: "git-provider",
+  OAUTH: "oauth",
+  DEVICE_AUTH: "device-auth",
+  PROMPT_PROVIDER: "prompt-provider",
+  // EW-637 — pluggable object storage. `put-object` + `get-object` are the
+  // floor; `presigned-put` is opt-in for backends that can hand the
+  // browser a direct-upload URL (S3, MinIO).
+  STORAGE: "storage",
+  PUT_OBJECT: "put-object",
+  GET_OBJECT: "get-object",
+  PRESIGNED_PUT: "presigned-put",
+  // Agents/Skills/Tasks PR #1017 — Phase 8 (ADR-012). Plugin
+  // category for Skill catalog providers. "Ever Works Skills" is
+  // the first-party default; community plugins implement the same
+  // `ISkillsProviderPlugin` contract to surface other catalogs.
+  SKILLS_PROVIDER: "skills-provider",
+  // Agents/Skills/Tasks PR #1017 — Phase 11 (ADR-013). Plugin
+  // category for external task trackers. "Ever Works Task Tracker"
+  // is the first-party default. Community plugins (Linear / Jira /
+  // GitHub Issues) implement the same contract.
+  TASK_TRACKER: "task-tracker",
+  // Notifications v2 (EW-650) — Email Providers. Plugins MAY declare
+  // `EMAIL_OUTBOUND`, `EMAIL_INBOUND`, or both. See
+  // `capabilities/email-provider.interface.ts` for the contract.
+  EMAIL_OUTBOUND: "email-outbound",
+  EMAIL_INBOUND: "email-inbound",
+  // Notifications v2 (sibling of EW-650) — Notification Channels.
+  // Plugins declare `NOTIFICATION_CHANNEL` (umbrella) plus the
+  // channel-specific constant for plugin discovery + UI grouping.
+  // See `capabilities/notification-channel.interface.ts`.
+  NOTIFICATION_CHANNEL: "notification-channel",
+  NOTIFICATION_CHANNEL_DISCORD: "notification-channel-discord",
+  NOTIFICATION_CHANNEL_SLACK: "notification-channel-slack",
+  NOTIFICATION_CHANNEL_TELEGRAM: "notification-channel-telegram",
+  NOTIFICATION_CHANNEL_WHATSAPP: "notification-channel-whatsapp",
+  NOTIFICATION_CHANNEL_NOVU: "notification-channel-novu",
+  // Connectors ("Connector fabric") — first-party BIDIRECTIONAL
+  // communication-channel plugins. Each connector declares `CONNECTOR`
+  // (umbrella, for discovery/grouping) plus its `CONNECTOR_<provider>`
+  // constant. Superset of the outbound-only notification channels; see
+  // `capabilities/connector.interface.ts`.
+  CONNECTOR: "connector",
+  CONNECTOR_SLACK: "connector-slack",
+  CONNECTOR_DISCORD: "connector-discord",
+  CONNECTOR_WHATSAPP: "connector-whatsapp",
+  CONNECTOR_LINEAR: "connector-linear",
+  CONNECTOR_NOTION: "connector-notion",
+  CONNECTOR_MICROSOFT_365: "connector-microsoft-365",
+  // CRM / enrichment connectors — first-party native connectors over
+  // the vendors' own Node SDKs. Outbound writes CRM records/notes,
+  // the event-source leg streams record changes into the ingest spine.
+  CONNECTOR_HUBSPOT: "connector-hubspot",
+  CONNECTOR_PIPEDRIVE: "connector-pipedrive",
+  // Social connectors — public-timeline surfaces. Outbound publishes a
+  // post; the event-source leg streams mentions/replies + the account's
+  // own timeline into the ingest spine.
+  CONNECTOR_BLUESKY: "connector-bluesky",
+  CONNECTOR_MASTODON: "connector-mastodon",
+  // Pluggable persistent memory for AI coding / generation agents.
+  // First-party implementation: `@ever-works/agentmemory-plugin`
+  // (talks to the `agentmemory` standalone Node server on :3111 —
+  // runs locally OR hosted via a configurable `baseUrl` + bearer
+  // token). Community plugins (mem0, zep, langmem) implement the
+  // same `IAgentMemoryPlugin` contract.
+  AGENT_MEMORY: "agent-memory",
+  // Goals feature PR-7 — read-only metrics collectors. First-party
+  // providers: `custom-http` (GET-only, SSRF-guarded) and `stripe`
+  // (official SDK; balance + income windows). See
+  // `capabilities/metrics-provider.interface.ts` for the contract.
+  METRICS_PROVIDER: "metrics-provider",
+  // Streaming-terminal session hosts (Wave 1 M5). First-party:
+  // pty-local (node-pty in the executing job-runtime worker, with a
+  // child_process pipe floor). Future: pty-ssh (user's own box),
+  // k8s-exec. See capabilities/terminal-stream.interface.ts.
+  TERMINAL_STREAM: "terminal-stream",
+  // Isolated git working contexts for agent Tasks (Wave 2).
+  WORKSPACE: "workspace",
+  // Headless browser drivers (audit item G22). navigate / extract /
+  // screenshot / act, headless by default, behind a default-deny
+  // navigation allowlist re-checked on every redirect hop. First-party:
+  // `browser-automation` (Playwright). See
+  // capabilities/browser-automation.interface.ts.
+  BROWSER_AUTOMATION: "browser-automation",
+  // Event-ingest spine (Wave 6) — plugins that pull/push normalized
+  // external events into the platform ingest pipeline. See
+  // capabilities/event-source.interface.ts.
+  EVENT_SOURCE: "event-source",
+  // Capability & playbook catalogue (AW-21) — plugins that supply Playbook
+  // catalogue entries (packaged outcomes: trigger, steps, required
+  // capabilities, artefacts, escalation points). Consumed only through
+  // PlaybookCatalogFacadeService. See
+  // capabilities/playbook-provider.interface.ts.
+  PLAYBOOK_PROVIDER: "playbook-provider",
+  // AW-15 — optional access-level declaration ("Read only" / "Read and
+  // write") mapped onto the tool-grant lattice. Declared alongside a
+  // provider's main capability; see
+  // capabilities/connection-scopes.interface.ts.
+  CONNECTION_SCOPES: "connection-scopes",
+  // App Works (APW-07 T3) — App dependency providers: the `k8s` plugin serves
+  // the three in-cluster ids, `app-dependencies-external` the external ones,
+  // and P2's `apps-tier-dependencies` the managed ones. Consumed only through
+  // `AppDependencyFacadeService`; see
+  // capabilities/app-dependency.interface.ts.
+  APP_DEPENDENCY: "app-dependency",
+  // App Works (APW-05 T2) — producing a container image from a commit. The
+  // `github-actions-build` plugin declares it (`IBuildPlugin`, `buildKind
+  // 'github-actions'`), and P3's `apps-builder` declares the same capability
+  // with the other `buildKind`. Consumed only through `BuildFacadeService`
+  // (APW-05 T16); see `capabilities/build.interface.ts`. Resolution R-13 keeps
+  // `build` a CAPABILITY while the strategy (`dockerfile` / `image` / `auto` /
+  // `none`) stays the App spec's own choice.
+  BUILD: "build",
+  // App Works (APW-12 T4) — the Ever ID relying-party capability. The
+  // `oidc-identity` plugin declares it (APW-12 T5/T6), and it is consumed only
+  // through `IdentityProviderFacadeService` (APW-12 plan §4.4); see
+  // `capabilities/identity-provider.interface.ts`. Appended after `build`, and
+  // landed in the same change as the `identity` category in
+  // `plugin-manifest.types.ts` — a plugin contract with no category to be
+  // discovered under is a manifest the loader rejects.
+  IDENTITY_PROVIDER: "identity-provider",
+  // App Works (APW-10 T2) — the managed hosting tier's zone capability. The
+  // `ever-works-apps` plugin declares it together with `deployment`
+  // (plan §5.2:602) and is consumed only through `AppsTierFacadeService`
+  // (APW-10 plan §5.3:655); see `capabilities/apps-tier.interface.ts`.
+  // Appended after `identity-provider`, and appended **last** on purpose:
+  // every existing constant keeps its value and its position, because the
+  // capability list is an append-only surface — a member that moves silently
+  // changes what a persisted manifest means. Deliberately NOT paired with a
+  // new category: the tier's plugin is a `deployment` plugin, so
+  // `PLUGIN_CATEGORIES` is untouched and every exhaustive map over it in
+  // `apps/web` stays total.
+  APPS_TIER: "apps-tier",
+  // Domain events (EW-P1-1) — plugins that follow the durable domain event
+  // outbox (`task.updated`, `team.member.added`, …) through the relay, at
+  // least once, with a per-plugin cursor. See
+  // `capabilities/domain-event-subscriber.interface.ts`. Appended last, so
+  // every existing constant keeps its value and its position; no category is
+  // added (a subscriber plugin keeps the category of what it otherwise is).
+  DOMAIN_EVENT_SUBSCRIBER: "domain-event-subscriber"
+};
+var ALL_PLUGIN_CAPABILITIES = Object.values(PLUGIN_CAPABILITIES);
+var ITEM_SCHEMA_PROMPT_TEXT = `
+Each item must be a JSON file with the following structure:
+
+{
+  "name": "string (required) - The item's canonical display name",
+  "description": "string (required) - A concise, informative summary of the item and its relevance to the work topic (2-4 sentences). Generate from page content if not directly available.",
+  "source_url": "string (required) - The most direct, canonical URL for the item itself (homepage or official page). Must be real and working. Never use blog posts or articles *about* the item.",
+  "category": "string (required) - ONE primary category based on the item's core function (e.g., 'Monitoring', 'CI/CD', 'Data Visualization')",
+  "tags": ["string"] - 1-3 specific, descriptive tags (e.g., "open-source", "real-time", "cloud-native"),
+  "featured": boolean - Whether this is a notable/featured item (optional, default false),
+  "slug": "string - URL-friendly identifier (optional, auto-generated from name if omitted)",
+  "brand": "string - At most one brand/company name per item (optional)",
+  "brand_logo_url": "string - Canonical logo URL from official domain, prefer SVG/PNG (optional)",
+  "images": ["string"] - Multiple high-quality image URLs (screenshots, product imagery) from official sources (optional),
+  "markdown": "string - Detailed product/service information in markdown: features, pricing, use cases (see Markdown Rules below). Do not repeat category, tags, or other metadata fields."
+}
+
+Required fields: name, description, source_url, category
+
+### Example
+
+\`\`\`json
+{
+  "name": "Prometheus",
+  "description": "Open-source monitoring and alerting toolkit designed for reliability and scalability, widely adopted in cloud-native environments.",
+  "source_url": "https://prometheus.io",
+  "category": "Monitoring",
+  "tags": ["open-source", "metrics", "cloud-native"],
+  "featured": false,
+  "brand": "Cloud Native Computing Foundation",
+  "brand_logo_url": "https://www.cncf.io/wp-content/uploads/2022/07/cncf-color-bg.svg",
+  "images": ["https://prometheus.io/assets/architecture.png"],
+  "markdown": "## Overview\\n\\nPrometheus is an open-source systems monitoring and alerting toolkit originally built at SoundCloud.\\n\\n## Features\\n\\n- Multi-dimensional data model with time series data identified by metric name and key/value pairs\\n- PromQL, a flexible query language\\n- No reliance on distributed storage; single server nodes are autonomous\\n- Time series collection via a pull model over HTTP\\n- Targets discovered via service discovery or static configuration\\n\\n## Pricing\\n\\nFree and open-source under the Apache 2.0 license."
+}
+\`\`\`
+`.trim();
+function createEmptyPipelineOutputs() {
+  return {
+    items: [],
+    categories: [],
+    tags: [],
+    collections: [],
+    brands: []
+  };
+}
+function buildSuccessPipelineResult(outputs, base) {
+  return {
+    success: true,
+    outputs,
+    duration: base.duration,
+    stepsCompleted: base.stepsCompleted,
+    totalSteps: base.totalSteps,
+    state: base.state,
+    metrics: base.metrics,
+    warnings: base.warnings
+  };
+}
+function buildErrorPipelineResult(error, base) {
+  return {
+    success: false,
+    outputs: base.outputs ?? createEmptyPipelineOutputs(),
+    duration: base.duration,
+    stepsCompleted: base.stepsCompleted,
+    totalSteps: base.totalSteps,
+    state: base.state,
+    metrics: base.metrics,
+    warnings: base.warnings,
+    error,
+    failedStep: base.failedStep
+  };
+}
+function buildCancelledPipelineResult(base) {
+  return buildErrorPipelineResult("Pipeline cancelled", base);
+}
+
+// src/utils/composio-client.ts
+var import_core = require("@composio/core");
+var ComposioClient = class {
+  constructor(options) {
+    if (!options.apiKey || options.apiKey.trim() === "") {
+      throw new Error("Composio API key is required.");
+    }
+    this.logger = options.logger;
+    this.sdk = options.sdkOverride ?? this.buildSdk(options.apiKey.trim(), options.baseUrl);
+  }
+  buildSdk(apiKey, baseUrl) {
+    const sdkConfig = { apiKey };
+    if (baseUrl) {
+      sdkConfig.baseURL = baseUrl.replace(/\/+$/, "");
+    }
+    return new import_core.Composio(sdkConfig);
+  }
+  /**
+   * Validates that:
+   *  1. The API key is accepted (the SDK throws on 401/403).
+   *  2. The toolkit exists.
+   *  3. The user has at least one ACTIVE connected account for the toolkit.
+   *
+   * Throws a user-friendly error explaining which check failed.
+   */
+  async validateConnection(ref) {
+    const accounts = await this.listConnectedAccounts(ref.userId, ref.toolkit);
+    const active = accounts.find((a) => normalizeStatus(a.status) === "ACTIVE");
+    if (!active) {
+      throw new Error(
+        `No active Composio connected account found for user "${ref.userId}" on toolkit "${ref.toolkit}". Connect ${ref.toolkit} in the Composio dashboard (or via the plugin's connect flow) and retry.`
+      );
+    }
+    return active;
+  }
+  /** Lists toolkits the API key has access to. Used by `isAvailable` and the settings UI. */
+  async listToolkits(limit = 50) {
+    try {
+      const response = await this.sdk.toolkits.get({ limit: Math.max(1, Math.min(limit, 200)) });
+      return response.items ?? [];
+    } catch (error) {
+      throw this.wrapError(error, "list toolkits");
+    }
+  }
+  /**
+   * Lists the user's connected accounts, optionally filtered by toolkit.
+   * Returns an empty array if the API key has no access to that user or
+   * if the user has not connected any account yet.
+   */
+  async listConnectedAccounts(userId, toolkit) {
+    try {
+      const query = { userIds: [userId] };
+      if (toolkit) query.toolkitSlugs = [toolkit.toUpperCase()];
+      const response = await this.sdk.connectedAccounts.list(query);
+      return response.items ?? [];
+    } catch (error) {
+      throw this.wrapError(error, "list connected accounts");
+    }
+  }
+  /**
+   * Executes a tool against the resolved user. The SDK unwraps the v3
+   * envelope (`{ successful, data, error }`) — on success we return its
+   * `data`; on failure (`successful === false`) we throw with the upstream
+   * error text including the log id when present.
+   *
+   * Cancellation: the SDK does not accept an AbortSignal, so we race our
+   * await against the signal. When the signal fires, this method rejects
+   * with "Pipeline execution was cancelled"; the SDK's HTTP request may
+   * still complete on the wire but its result is discarded.
+   */
+  async executeTool(ref, args, options) {
+    const signal = options?.signal;
+    if (signal?.aborted) throw new Error("Pipeline execution was cancelled");
+    const startTime = Date.now();
+    this.logger.log(`Running Composio tool "${ref.toolSlug}" for user "${ref.userId}"`);
+    const execPromise = this.sdk.tools.execute(ref.toolSlug, {
+      userId: ref.userId,
+      arguments: args
+    }).catch((error) => {
+      throw this.wrapError(error, `execute tool ${ref.toolSlug}`);
+    });
+    const envelope = signal ? await raceWithAbort(execPromise, signal) : await execPromise;
+    if (envelope.successful === false) {
+      const logId = envelope.logId ?? envelope.log_id;
+      throw new Error(
+        `Composio tool "${ref.toolSlug}" execution failed: ${envelope.error ?? "unknown error"}` + (logId ? ` (log_id=${logId})` : "")
+      );
+    }
+    return {
+      data: envelope.data ?? envelope,
+      composioDuration: Date.now() - startTime
+    };
+  }
+  wrapError(error, context) {
+    if (error instanceof Error) {
+      const message = error.message || String(error);
+      const status = readNumberProp(error, "status") ?? readNumberProp(error, "statusCode");
+      if (status === 401 || status === 403) {
+        return new Error(
+          `Composio rejected the API key (HTTP ${status}) during ${context}. Verify COMPOSIO_API_KEY in plugin settings.`
+        );
+      }
+      if (status === 404) {
+        return new Error(
+          `Composio returned 404 during ${context}. Likely causes: the tool slug or toolkit does not exist, or the user has no connected account.`
+        );
+      }
+      if (status === 408 || status === 504) {
+        return new Error(`Composio request timed out during ${context} (HTTP ${status}).`);
+      }
+      if (status === 429) {
+        return new Error("Composio rate limit exceeded (HTTP 429). Wait and retry.");
+      }
+      if (status !== void 0 && status >= 500) {
+        return new Error(
+          `Composio is returning HTTP ${status} during ${context}. Check https://status.composio.dev. (${message})`
+        );
+      }
+      return new Error(`Composio error during ${context}: ${message}`);
+    }
+    return new Error(`Unexpected error during ${context}: ${String(error)}`);
+  }
+};
+function normalizeStatus(status) {
+  return (status || "").trim().toUpperCase();
+}
+function readNumberProp(target, prop) {
+  const value = target[prop];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function raceWithAbort(promise, signal) {
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      signal.removeEventListener("abort", onAbort);
+      reject(new Error("Pipeline execution was cancelled"));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+  });
+}
+
+// src/skills-provider.ts
+var SKILL_VERSION = "1.0.0";
+var ACTIVE_STATUS = "ACTIVE";
+async function buildSkillCatalogEntries({
+  apiKey,
+  baseUrl,
+  defaultUserId,
+  logger,
+  sdkOverride
+}) {
+  if (!apiKey || !defaultUserId) return [];
+  const client = new ComposioClient({
+    apiKey,
+    baseUrl,
+    logger: logger ?? { log: () => void 0, warn: () => void 0 },
+    ...sdkOverride ? { sdkOverride } : {}
+  });
+  const accounts = await client.listConnectedAccounts(defaultUserId);
+  const activeBySlug = /* @__PURE__ */ new Map();
+  for (const account of accounts) {
+    if ((account.status || "").toUpperCase() !== ACTIVE_STATUS) continue;
+    const slug = (account.toolkit?.slug || "").trim().toUpperCase();
+    if (!slug) continue;
+    if (!activeBySlug.has(slug)) {
+      activeBySlug.set(slug, { id: account.id, slug });
+    }
+  }
+  const entries = [];
+  for (const { slug } of activeBySlug.values()) {
+    entries.push(entryFor(slug, defaultUserId));
+  }
+  return entries.sort((a, b) => a.slug.localeCompare(b.slug));
+}
+function entryFor(toolkitSlug, defaultUserId) {
+  const slug = `composio-${toolkitSlug.toLowerCase()}`;
+  const title = `Composio: ${toolkitSlug}`;
+  const description = `Call Composio tools in the ${toolkitSlug} toolkit during Work generation. The user has an ACTIVE Composio connection for this toolkit.`;
+  const body = `# ${title}
+
+This user has an **ACTIVE** Composio connection for the \`${toolkitSlug}\` toolkit.
+
+When the user's task can be served by a ${toolkitSlug} tool (e.g. send an email, create an issue, read a document), use the **composio** pipeline plugin to execute the tool. Pass the following config:
+
+\`\`\`json
+` + JSON.stringify(
+    {
+      toolkit: toolkitSlug,
+      tool_slug: `<TOOL_SLUG_TO_FILL_IN>`,
+      composio_user_id: defaultUserId
+    },
+    null,
+    2
+  ) + `
+\`\`\`
+
+Pick \`tool_slug\` from the toolkit's tool list (search composio.dev for ${toolkitSlug} tools or call \`GET /api/plugins/composio/toolkits\`). Do NOT invent slugs \u2014 Composio rejects unknown tools with HTTP 404.
+`;
+  return {
+    slug,
+    title,
+    description,
+    frontmatter: {
+      name: slug,
+      description,
+      tags: ["composio", toolkitSlug.toLowerCase(), "integration"]
+    },
+    body,
+    version: SKILL_VERSION,
+    tags: ["composio", toolkitSlug.toLowerCase(), "integration"]
+  };
+}
+function filterSkillCatalog(entries, options) {
+  let filtered = entries;
+  if (options.search) {
+    const q = options.search.toLowerCase();
+    filtered = filtered.filter(
+      (e) => e.slug.includes(q) || e.title.toLowerCase().includes(q) || e.description.toLowerCase().includes(q)
+    );
+  }
+  if (options.tags && options.tags.length > 0) {
+    const requested = new Set(options.tags.map((t) => t.toLowerCase()));
+    filtered = filtered.filter((e) => e.tags.some((t) => requested.has(t.toLowerCase())));
+  }
+  const total = filtered.length;
+  const sliced = filtered.slice(options.offset, options.offset + options.limit);
+  return { entries: sliced, total };
+}
+function diffSkillCatalogVersions(entries, installedVersions) {
+  const updated = [];
+  for (const entry of entries) {
+    const installed = installedVersions[entry.slug];
+    if (installed && installed !== entry.version) {
+      updated.push({ slug: entry.slug, oldVersion: installed, newVersion: entry.version });
+    }
+  }
+  return { updated };
+}
+function readApiKey(settings) {
+  if (!settings) return void 0;
+  const value = settings.apiKey;
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function readBaseUrl(settings) {
+  if (!settings) return void 0;
+  const value = settings.baseUrl;
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function readDefaultUserId(settings) {
+  if (!settings) return void 0;
+  const value = settings.defaultUserId;
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+
+// src/types.ts
+var COMPOSIO_STEP_IDS = [
+  "validate-composio",
+  "prepare-payload",
+  "execute-tool",
+  "collect-results",
+  "capture-screenshots",
+  "cleanup"
+];
+var DEFAULT_BASE_URL = "https://backend.composio.dev/api/v3";
+var DEFAULT_TARGET_ITEMS = 50;
+var DEFAULT_TIMEOUT_MS = 18e4;
+
+// src/steps.ts
+var STEP_DEFINITIONS = [
+  {
+    id: "validate-composio",
+    name: "Validate Composio Connection",
+    description: "Verify the API key, the tool exists, and the user has an active connected account for the toolkit",
+    position: { type: "first" },
+    dependencies: [],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 3
+  },
+  {
+    id: "prepare-payload",
+    name: "Prepare Tool Payload",
+    description: "Build the arguments payload from work context, existing items, and config",
+    position: { type: "after", stepId: "validate-composio" },
+    dependencies: [{ stepId: "validate-composio", required: true }],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 2
+  },
+  {
+    id: "execute-tool",
+    name: "Execute Composio Tool",
+    description: "Invoke the Composio tool for the resolved user and await the result",
+    position: { type: "after", stepId: "prepare-payload" },
+    dependencies: [{ stepId: "prepare-payload", required: true }],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 120
+  },
+  {
+    id: "collect-results",
+    name: "Collect & Validate Results",
+    description: "Parse the tool output into work items and deduplicate",
+    position: { type: "after", stepId: "execute-tool" },
+    dependencies: [{ stepId: "execute-tool", required: true }],
+    optional: false,
+    parallelizable: false,
+    estimatedDuration: 5
+  },
+  {
+    id: "capture-screenshots",
+    name: "Capture Screenshots",
+    description: "Capture screenshots for generated items",
+    position: { type: "after", stepId: "collect-results" },
+    dependencies: [{ stepId: "collect-results", required: true }],
+    optional: true,
+    parallelizable: false,
+    estimatedDuration: 30
+  },
+  {
+    id: "cleanup",
+    name: "Cleanup",
+    description: "Release resources and clear temporary data",
+    position: { type: "last" },
+    dependencies: [{ stepId: "capture-screenshots", required: false }],
+    optional: true,
+    parallelizable: false,
+    estimatedDuration: 1
+  }
+];
+
+// src/utils/payload-builder.ts
+function isGitHubHttpsUrl(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    return false;
+  }
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname.toLowerCase() === "github.com";
+  } catch {
+    return false;
+  }
+}
+function buildToolPayload(options) {
+  const { work, request, existing, config } = options;
+  const envelope = {
+    metadata: {
+      workId: work.id,
+      workName: work.name,
+      workSlug: work.slug,
+      workDescription: work.description,
+      prompt: request.prompt,
+      generationMethod: request.generationMethod,
+      targetItems: config.target_items ?? DEFAULT_TARGET_ITEMS
+    }
+  };
+  if (config.pass_existing_items !== false && existing.items.length > 0) {
+    envelope.existingSummary = {
+      totalItems: existing.items.length,
+      categories: existing.categories.map((c) => c.name),
+      tags: existing.tags.map((t) => t.name),
+      sampleItems: existing.items.slice(0, 20).map((item) => ({
+        name: item.name,
+        url: item.source_url
+      }))
+    };
+  }
+  if (config.pass_repo_access && isGitHubHttpsUrl(config.repo_url)) {
+    envelope.dataSource = {
+      type: "github-repo",
+      repoUrl: config.repo_url,
+      accessToken: config.repo_access_token,
+      branch: config.repo_branch || "data",
+      path: "items/"
+    };
+  }
+  const toolParams = config.tool_params && typeof config.tool_params === "object" ? config.tool_params : void 0;
+  if (toolParams) {
+    envelope.toolParams = toolParams;
+  }
+  return {
+    ...envelope,
+    ...toolParams ?? {}
+  };
+}
+
+// src/utils/result-parser.ts
+function parseComposioOutput(raw, shape, mapping) {
+  if (raw === null || raw === void 0) {
+    throw new Error("Composio tool returned no data.");
+  }
+  if (shape === "native") {
+    const records = normalizeRecordList(raw);
+    const items2 = records.map((record) => mapNativeRecord(record, mapping)).filter(isNonEmptyItem);
+    if (items2.length === 0) {
+      throw new Error(
+        "Composio tool returned records but none could be mapped to work items. Double-check the field mapping \u2014 at minimum the name field must point to a non-empty string."
+      );
+    }
+    const categories2 = parseCategories(void 0, items2);
+    const tags2 = parseTags(void 0, items2);
+    const brands2 = parseBrands(void 0, items2);
+    return { items: items2, categories: categories2, tags: tags2, brands: brands2 };
+  }
+  const output = normalizeStructured(raw);
+  const items = parseItems(output.items ?? []);
+  if (items.length === 0) {
+    throw new Error(
+      'Composio tool returned a structured response but with no usable items. Ensure the tool outputs `{ items: [...] }` with each item containing at least a `name`. If the tool returns native records instead, switch the result shape to "native" and set a field mapping.'
+    );
+  }
+  const categories = parseCategories(output.categories, items);
+  const tags = parseTags(output.tags, items);
+  const brands = parseBrands(output.brands, items);
+  return { items, categories, tags, brands };
+}
+function normalizeStructured(raw) {
+  if (typeof raw === "string") {
+    const parsed = tryParseJson(raw);
+    if (parsed !== null && typeof parsed === "object") {
+      return normalizeStructured(parsed);
+    }
+    const preview = raw.length > 200 ? raw.slice(0, 200) + "..." : raw;
+    throw new Error(
+      `Composio tool returned a string that is not valid JSON. Ensure the tool returns a JSON object with { items: [...] }. Received: ${preview}`
+    );
+  }
+  if (Array.isArray(raw)) {
+    if (raw.length === 1 && raw[0] && typeof raw[0] === "object") {
+      const single = raw[0];
+      for (const key of ["items", "output", "result", "content", "data", "response", "body", "payload"]) {
+        if (single[key] != null && single[key] !== "") {
+          return normalizeStructured(single);
+        }
+      }
+    }
+    return { items: raw };
+  }
+  if (!raw || typeof raw !== "object") {
+    throw new Error(`Composio tool returned an unexpected type: ${typeof raw}`);
+  }
+  const obj = raw;
+  if ("items" in obj) {
+    const items = Array.isArray(obj.items) ? obj.items : [];
+    return {
+      items,
+      categories: obj.categories,
+      tags: obj.tags,
+      brands: obj.brands
+    };
+  }
+  for (const key of ["output", "result", "content", "data", "response", "body", "payload"]) {
+    if (obj[key] != null && obj[key] !== "") {
+      return normalizeStructured(obj[key]);
+    }
+  }
+  if (typeof obj.message === "string") {
+    const parsed = tryParseJson(obj.message);
+    if (parsed !== null && typeof parsed === "object") {
+      return normalizeStructured(parsed);
+    }
+  }
+  throw new Error(
+    `Composio tool output does not contain an "items" array. Expected \`{ items: [...] }\` or a direct array. Received keys: ${Object.keys(obj).join(", ")}`
+  );
+}
+function normalizeRecordList(raw) {
+  if (typeof raw === "string") {
+    const parsed = tryParseJson(raw);
+    if (parsed !== null) return normalizeRecordList(parsed);
+    return [];
+  }
+  if (Array.isArray(raw)) {
+    return raw.filter((r) => !!r && typeof r === "object");
+  }
+  if (!raw || typeof raw !== "object") return [];
+  const obj = raw;
+  for (const key of ["items", "results", "records", "data", "output", "response", "payload", "messages", "issues"]) {
+    const value = obj[key];
+    if (Array.isArray(value)) {
+      return value.filter((r) => !!r && typeof r === "object");
+    }
+  }
+  return [obj];
+}
+function mapNativeRecord(record, mapping) {
+  const name = readString(record, mapping.nameField);
+  const urlKey = mapping.urlField;
+  const url = urlKey ? readString(record, urlKey) : "";
+  const description = mapping.descriptionField ? readString(record, mapping.descriptionField) : "";
+  const category = mapping.categoryField ? readString(record, mapping.categoryField) : "";
+  const content = mapping.contentField ? readString(record, mapping.contentField) : void 0;
+  const brand = mapping.brandField ? readString(record, mapping.brandField) : void 0;
+  const tags = [];
+  if (mapping.tagsField) {
+    const raw = readField(record, mapping.tagsField);
+    if (Array.isArray(raw)) {
+      for (const t of raw) {
+        if (typeof t === "string" && t.trim()) tags.push(t.trim());
+      }
+    } else if (typeof raw === "string" && raw.trim()) {
+      for (const t of raw.split(",")) {
+        const trimmed = t.trim();
+        if (trimmed) tags.push(trimmed);
+      }
+    }
+  }
+  const images = [];
+  if (mapping.imageField) {
+    const raw = readField(record, mapping.imageField);
+    if (Array.isArray(raw)) {
+      for (const img of raw) {
+        if (typeof img === "string") {
+          const safe = sanitizeHttpUrl(img);
+          if (safe) images.push(safe);
+        }
+      }
+    } else if (typeof raw === "string") {
+      const safe = sanitizeHttpUrl(raw);
+      if (safe) images.push(safe);
+    }
+  }
+  return {
+    name: (name || "").trim(),
+    description: (description || "").trim(),
+    // Security: reject non-http(s) source URLs (javascript:/data:/…).
+    source_url: sanitizeHttpUrl(url || ""),
+    markdown: content,
+    category: (category || "").trim(),
+    tags,
+    brand: brand?.trim() || void 0,
+    images: images.length > 0 ? images : void 0
+  };
+}
+function isNonEmptyItem(item) {
+  return typeof item.name === "string" && item.name.trim().length > 0;
+}
+function readField(record, path) {
+  if (!path) return void 0;
+  const parts = path.split(".").map((p) => p.trim()).filter(Boolean);
+  let current = record;
+  for (const part of parts) {
+    if (current == null) return void 0;
+    if (part === "__proto__" || part === "prototype" || part === "constructor") return void 0;
+    if (Array.isArray(current)) {
+      const idx = Number(part);
+      if (!Number.isInteger(idx)) return void 0;
+      current = current[idx];
+      continue;
+    }
+    if (typeof current !== "object") return void 0;
+    current = Object.prototype.hasOwnProperty.call(current, part) ? current[part] : void 0;
+  }
+  return current;
+}
+function readString(record, path) {
+  const value = readField(record, path);
+  return typeof value === "string" ? value : value == null ? "" : String(value);
+}
+function tryParseJson(str) {
+  try {
+    return JSON.parse(str);
+  } catch {
+    return null;
+  }
+}
+function sanitizeHttpUrl(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return "";
+  try {
+    const u = new URL(trimmed);
+    return u.protocol === "http:" || u.protocol === "https:" ? trimmed : "";
+  } catch {
+    return "";
+  }
+}
+function parseItems(rawItems) {
+  const items = [];
+  for (const raw of rawItems) {
+    if (!raw || typeof raw !== "object") continue;
+    if (!raw.name || typeof raw.name !== "string") continue;
+    const rawUrl = typeof raw.url === "string" ? raw.url : typeof raw.source_url === "string" ? raw.source_url : "";
+    const safeImages = Array.isArray(raw.images) ? raw.images.reduce((acc, i) => {
+      if (typeof i === "string") {
+        const safe = sanitizeHttpUrl(i);
+        if (safe) acc.push(safe);
+      }
+      return acc;
+    }, []) : void 0;
+    const item = {
+      name: raw.name.trim(),
+      description: typeof raw.description === "string" ? raw.description.trim() : "",
+      source_url: sanitizeHttpUrl(rawUrl),
+      markdown: typeof raw.content === "string" ? raw.content : void 0,
+      category: typeof raw.category === "string" ? raw.category.trim() : "",
+      tags: Array.isArray(raw.tags) ? raw.tags.filter((t) => typeof t === "string") : [],
+      brand: typeof raw.brand === "string" ? raw.brand.trim() : void 0,
+      images: safeImages
+    };
+    items.push(item);
+  }
+  return items;
+}
+function parseCategories(rawCategories, items) {
+  const categoryNames = /* @__PURE__ */ new Set();
+  if (Array.isArray(rawCategories)) {
+    for (const cat of rawCategories) {
+      if (cat && typeof cat.name === "string" && cat.name.trim()) {
+        categoryNames.add(cat.name.trim());
+      }
+    }
+  }
+  for (const item of items) {
+    if (typeof item.category === "string" && item.category) {
+      categoryNames.add(item.category);
+    } else if (Array.isArray(item.category)) {
+      for (const c of item.category) {
+        if (typeof c === "string" && c.trim()) categoryNames.add(c.trim());
+      }
+    }
+  }
+  return Array.from(categoryNames).map((name) => {
+    const explicit = rawCategories?.find((c) => c.name === name);
+    return {
+      id: name.toLowerCase().replace(/\s+/g, "-"),
+      name,
+      description: explicit?.description
+    };
+  });
+}
+function parseTags(rawTags, items) {
+  const tagNames = /* @__PURE__ */ new Set();
+  if (Array.isArray(rawTags)) {
+    for (const tag of rawTags) {
+      if (tag && typeof tag.name === "string" && tag.name.trim()) {
+        tagNames.add(tag.name.trim());
+      }
+    }
+  }
+  for (const item of items) {
+    if (Array.isArray(item.tags)) {
+      for (const t of item.tags) {
+        if (typeof t === "string") tagNames.add(t);
+      }
+    }
+  }
+  return Array.from(tagNames).map((name) => ({
+    id: name.toLowerCase().replace(/\s+/g, "-"),
+    name
+  }));
+}
+function parseBrands(rawBrands, items) {
+  const brandNames = /* @__PURE__ */ new Set();
+  if (Array.isArray(rawBrands)) {
+    for (const brand of rawBrands) {
+      if (brand && typeof brand.name === "string" && brand.name.trim()) {
+        brandNames.add(brand.name.trim());
+      }
+    }
+  }
+  for (const item of items) {
+    if (item.brand) {
+      if (typeof item.brand === "string") {
+        brandNames.add(item.brand);
+      } else if (typeof item.brand === "object" && item.brand.name) {
+        brandNames.add(item.brand.name);
+      }
+    }
+  }
+  return Array.from(brandNames).map((name) => {
+    const explicit = rawBrands?.find((b) => b.name === name);
+    return {
+      id: name.toLowerCase().replace(/\s+/g, "-"),
+      name,
+      website: explicit?.url
+    };
+  });
+}
+function deduplicateItems(newItems, existingItemNames) {
+  const existingSet = new Set(existingItemNames.map((n) => n.toLowerCase().trim()));
+  return newItems.filter((item) => !existingSet.has(item.name.toLowerCase().trim()));
+}
+
+// src/utils/pipeline-helpers.ts
+function initializeState() {
+  const steps = /* @__PURE__ */ new Map();
+  for (const def of STEP_DEFINITIONS) {
+    steps.set(def.id, { definition: def, status: "pending" });
+  }
+  return {
+    steps,
+    completedSteps: [],
+    failedSteps: [],
+    isRunning: true,
+    isCancelled: false,
+    startedAt: Date.now()
+  };
+}
+function updateStepState(state, stepId, status, error) {
+  const existing = state.steps.get(stepId);
+  if (!existing) return state;
+  const now = Date.now();
+  const steps = new Map(state.steps);
+  steps.set(stepId, {
+    ...existing,
+    status,
+    startedAt: status === "running" ? now : existing.startedAt,
+    completedAt: status === "completed" || status === "failed" ? now : void 0,
+    error: error ?? existing.error
+  });
+  return {
+    ...state,
+    steps,
+    currentStep: status === "running" ? stepId : state.currentStep,
+    completedSteps: status === "completed" ? [...state.completedSteps, stepId] : state.completedSteps,
+    failedSteps: status === "failed" ? [...state.failedSteps, stepId] : state.failedSteps
+  };
+}
+function reportProgress(onProgress, stepIndex, percent, stepName, message) {
+  onProgress?.({
+    percent,
+    currentStepIndex: stepIndex,
+    totalSteps: COMPOSIO_STEP_IDS.length,
+    currentStepName: stepName,
+    message
+  });
+}
+async function resolveSettings(context, userId, workId) {
+  if (!context) return {};
+  try {
+    const [userSettings, workSettings] = await Promise.all([
+      context.getSettings("user", userId),
+      context.getSettings("work", workId)
+    ]);
+    const merged = { ...userSettings };
+    for (const key in workSettings) {
+      if (workSettings[key] !== void 0 && workSettings[key] !== null) {
+        merged[key] = workSettings[key];
+      }
+    }
+    return merged;
+  } catch {
+    return {};
+  }
+}
+function buildMetrics(startTime, duration, itemCount, composioMetrics) {
+  return {
+    startTime,
+    duration,
+    itemsProcessed: itemCount,
+    steps: {},
+    ...composioMetrics ? { custom: composioMetrics } : {}
+  };
+}
+function buildErrorResult(state, error, startTime) {
+  let currentState = state ?? initializeState();
+  for (const [stepId, stepState] of currentState.steps) {
+    if (stepState.status === "running") {
+      currentState = updateStepState(currentState, stepId, "failed", error.message);
+      break;
+    }
+  }
+  return {
+    state: currentState,
+    result: buildErrorPipelineResult(error, {
+      outputs: createEmptyPipelineOutputs(),
+      duration: Date.now() - startTime,
+      stepsCompleted: currentState.completedSteps.length,
+      totalSteps: COMPOSIO_STEP_IDS.length,
+      failedStep: currentState.failedSteps[currentState.failedSteps.length - 1],
+      state: currentState
+    })
+  };
+}
+function buildCancelledResult(state, startTime) {
+  const currentState = {
+    ...state ?? initializeState(),
+    isRunning: false,
+    isCancelled: true,
+    completedAt: Date.now()
+  };
+  return {
+    state: currentState,
+    result: buildCancelledPipelineResult({
+      outputs: createEmptyPipelineOutputs(),
+      duration: Date.now() - startTime,
+      stepsCompleted: currentState.completedSteps.length,
+      totalSteps: COMPOSIO_STEP_IDS.length,
+      state: currentState
+    })
+  };
+}
+
+// src/form-schema.ts
+var REPO_ACCESS_CONDITION = { field: "pass_repo_access", operator: "eq", value: true };
+var NATIVE_SHAPE_CONDITION = { field: "result_shape", operator: "eq", value: "native" };
+function getFormFields() {
+  return [
+    // ── Tool group ────────────────────────────────────────────────
+    {
+      name: "toolkit",
+      type: "text",
+      label: "Composio Toolkit",
+      description: "Toolkit slug for this generation (e.g. GMAIL, GITHUB, SLACK, NOTION, LINEAR). Used for connection validation only \u2014 the toolSlug uniquely identifies the action.",
+      placeholder: "e.g. GMAIL",
+      group: "tool"
+    },
+    {
+      name: "tool_slug",
+      type: "text",
+      label: "Composio Tool Slug",
+      description: "Composio tool slug (e.g. GMAIL_SEND_EMAIL, GITHUB_CREATE_ISSUE, SLACK_SEND_MESSAGE). Unique across toolkits.",
+      placeholder: "e.g. GMAIL_SEND_EMAIL",
+      group: "tool"
+    },
+    {
+      name: "composio_user_id",
+      type: "text",
+      label: "Composio User ID",
+      description: "Override the Composio user_id to run the tool against (defaults to your Ever Works user id). Use this if you connected the upstream account under a different identifier (typically an email).",
+      placeholder: "e.g. alice@example.com",
+      group: "tool"
+    },
+    {
+      name: "target_items",
+      type: "number",
+      label: "Target Items",
+      description: "Target number of new items to generate",
+      defaultValue: DEFAULT_TARGET_ITEMS,
+      validation: { min: 1, max: 500 },
+      group: "tool"
+    },
+    {
+      name: "tool_timeout",
+      type: "number",
+      label: "Tool Timeout (minutes)",
+      description: "Maximum time to wait for the Composio tool to complete",
+      defaultValue: 10,
+      validation: { min: 1, max: 120 },
+      group: "tool"
+    },
+    // ── Result shape & mapping ────────────────────────────────────
+    {
+      name: "result_shape",
+      type: "select",
+      label: "Result Shape",
+      description: 'How the plugin should interpret the tool response. "Structured" expects { items: [...] }. "Native" maps raw records via the field mapping below. "Side-effect" runs the tool for its effect only (e.g. send email, post message) and produces no work items.',
+      options: [
+        { value: "structured", label: "Structured ({ items: [...] })" },
+        { value: "native", label: "Native records (with field mapping)" },
+        { value: "side-effect", label: "Side-effect only (no items expected)" }
+      ],
+      defaultValue: "structured",
+      group: "mapping"
+    },
+    {
+      name: "name_field",
+      type: "text",
+      label: "Name Field",
+      description: "Path in each record that holds the item name (e.g. title, fields.name).",
+      placeholder: "e.g. subject or title",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION,
+      requiredIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "url_field",
+      type: "text",
+      label: "URL Field",
+      description: "Path in each record that holds the item URL.",
+      placeholder: "e.g. html_url",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "description_field",
+      type: "text",
+      label: "Description Field",
+      placeholder: "e.g. snippet",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "category_field",
+      type: "text",
+      label: "Category Field",
+      placeholder: "e.g. category",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "tags_field",
+      type: "text",
+      label: "Tags Field",
+      description: "Accepts either an array of strings or a comma-separated string.",
+      placeholder: "e.g. labels",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "image_field",
+      type: "text",
+      label: "Image Field",
+      description: "Path to an image URL or an array of image URLs.",
+      placeholder: "e.g. avatar_url",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "brand_field",
+      type: "text",
+      label: "Brand Field",
+      placeholder: "e.g. organization",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    {
+      name: "content_field",
+      type: "text",
+      label: "Content (Markdown) Field",
+      placeholder: "e.g. body",
+      group: "mapping",
+      showIf: NATIVE_SHAPE_CONDITION
+    },
+    // ── Data passing ──────────────────────────────────────────────
+    {
+      name: "pass_existing_items",
+      type: "boolean",
+      label: "Pass Existing Items Summary",
+      description: "Include a summary of existing work items in the tool input for deduplication",
+      defaultValue: true,
+      group: "data"
+    },
+    {
+      name: "pass_repo_access",
+      type: "boolean",
+      label: "Pass Data Repository Access",
+      description: "Grant the Composio tool read access to the work data repository",
+      defaultValue: false,
+      group: "data"
+    },
+    {
+      name: "repo_url",
+      type: "text",
+      label: "Data Repository URL",
+      description: "GitHub repository URL containing work data",
+      placeholder: "e.g., https://github.com/org/repo",
+      group: "data",
+      showIf: REPO_ACCESS_CONDITION,
+      requiredIf: REPO_ACCESS_CONDITION
+    },
+    {
+      name: "repo_access_token",
+      type: "password",
+      label: "Repository Access Token",
+      description: "Read-only access token for the data repository. \u26A0\uFE0F This token is forwarded verbatim to Composio as part of the tool arguments \u2014 it crosses your trust boundary into a third-party API where it may be logged or stored. Use a short-lived, narrowly-scoped, read-only PAT and rotate it after each run.",
+      placeholder: "ghp_...",
+      group: "data",
+      showIf: REPO_ACCESS_CONDITION,
+      requiredIf: REPO_ACCESS_CONDITION
+    },
+    {
+      name: "repo_branch",
+      type: "text",
+      label: "Repository Branch",
+      description: "Branch to read from",
+      defaultValue: "data",
+      group: "data",
+      showIf: REPO_ACCESS_CONDITION
+    },
+    // ── Features ──────────────────────────────────────────────────
+    {
+      name: "capture_screenshots",
+      type: "boolean",
+      label: "Capture Screenshots",
+      description: "Take screenshots for generated items (requires a screenshot plugin)",
+      defaultValue: false,
+      group: "features"
+    },
+    // ── Advanced ──────────────────────────────────────────────────
+    {
+      name: "tool_params",
+      type: "json",
+      label: "Custom Tool Arguments",
+      description: 'Additional key-value parameters forwarded to the Composio tool as top-level arguments AND under `toolParams` in the envelope. Use this to populate required tool inputs (e.g. `{ "to": "alice@example.com", "subject": "Hello" }` for GMAIL_SEND_EMAIL).',
+      defaultValue: {},
+      group: "advanced"
+    }
+  ];
+}
+function getFormGroups() {
+  return [
+    {
+      name: "tool",
+      title: "Composio Tool",
+      description: "Choose the toolkit, tool, and connected account to invoke",
+      order: 0
+    },
+    {
+      name: "mapping",
+      title: "Result Mapping",
+      description: "Control how the tool response becomes work items",
+      order: 1,
+      collapsible: true,
+      collapsed: false
+    },
+    {
+      name: "data",
+      title: "Data Passing",
+      description: "Configure what contextual data is forwarded to the Composio tool",
+      order: 2,
+      collapsible: true,
+      collapsed: false
+    },
+    {
+      name: "features",
+      title: "Features",
+      description: "Optional generation features",
+      order: 3,
+      collapsible: true,
+      collapsed: true
+    },
+    {
+      name: "advanced",
+      title: "Advanced",
+      description: "Advanced tool arguments",
+      order: 4,
+      collapsible: true,
+      collapsed: true
+    }
+  ];
+}
+function validateFormInput(values) {
+  if (values.pass_repo_access) {
+    if (!values.repo_url || typeof values.repo_url !== "string" || values.repo_url.trim() === "") {
+      return {
+        valid: false,
+        errors: [{ path: "repo_url", message: "Repository URL is required when repository access is enabled" }]
+      };
+    }
+    if (!values.repo_access_token || typeof values.repo_access_token !== "string" || values.repo_access_token.trim() === "") {
+      return {
+        valid: false,
+        errors: [
+          {
+            path: "repo_access_token",
+            message: "Repository access token is required when repository access is enabled"
+          }
+        ]
+      };
+    }
+  }
+  if (values.result_shape === "native") {
+    if (!values.name_field || typeof values.name_field !== "string" || values.name_field.trim() === "") {
+      return {
+        valid: false,
+        errors: [
+          {
+            path: "name_field",
+            message: "Name field is required when using the native result shape"
+          }
+        ]
+      };
+    }
+  }
+  return { valid: true };
+}
+function getDefaultValues(fields) {
+  const defaults = {};
+  for (const field of fields) {
+    if (field.defaultValue !== void 0) {
+      defaults[field.name] = field.defaultValue;
+    }
+  }
+  return defaults;
+}
+
+// src/readme.ts
+var README = [
+  "## What is the Composio Integrations plugin?",
+  "",
+  "This plugin lets Ever Works call any of [Composio](https://composio.dev)'s 500+ third-party app integrations (Gmail, Slack, GitHub, Notion, Linear, Salesforce, HubSpot, Stripe, Shopify, Airtable, \u2026) during Work generation.",
+  "Composio brokers OAuth on your behalf: each user connects an app once through Composio's hosted flow, and the platform reuses that connection to execute tools.",
+  "",
+  "## Why use it?",
+  "",
+  "- **500+ ready-made integrations** \u2014 no per-app connector code to write",
+  "- **OAuth handled for you** \u2014 Composio manages tokens, refresh, scopes, and rate limits",
+  "- **Per-user accounts** \u2014 every user can connect their own Gmail / Slack / GitHub without sharing credentials",
+  "- **Three result shapes** \u2014 structured items, native records via field mapping, or side-effect only",
+  "- **Side-effect actions** \u2014 send messages, create issues, or trigger downstream workflows without producing items",
+  "",
+  "## How it works in Ever Works",
+  "",
+  "When this plugin is selected as the active pipeline, the platform calls the Composio v3 REST API:",
+  "",
+  "1. **Validate** \u2014 checks that the Composio API key is accepted and that the user has an ACTIVE connected account for the requested toolkit",
+  "2. **Prepare Payload** \u2014 builds the input with work metadata, existing items summary, and custom arguments",
+  "3. **Execute Tool** \u2014 `POST /tools/execute/{tool_slug}` with `{ user_id, arguments }`",
+  "4. **Collect Results** \u2014 converts the response into work items or completes a side-effect action",
+  "5. **Capture Screenshots** \u2014 optionally captures screenshots for generated items",
+  "6. **Cleanup** \u2014 releases resources",
+  "",
+  "The plugin treats the **tool slug** (e.g. `GMAIL_SEND_EMAIL`, `GITHUB_CREATE_ISSUE`) as the unique identifier of an action \u2014 toolkit slug is informational and used only for connection validation.",
+  "",
+  "## Result modes",
+  "",
+  "- **Structured items** \u2014 for custom tools that already return `{ items: [...] }` in the work-item shape",
+  "- **Native records** \u2014 for catalog tools (Gmail messages, Notion pages, GitHub issues, \u2026) that return records you map onto work items via a field mapping",
+  "- **Side-effect only** \u2014 for tools that send a message, create a task, or update another system without adding work items",
+  "",
+  "## Data passing strategies",
+  "",
+  "- **Inline summary** (default) \u2014 work metadata and a sample of existing items are sent in the tool arguments",
+  "- **GitHub repository** \u2014 pass a repo URL and access token so the tool can read the full dataset directly",
+  "",
+  "## Required configuration",
+  "",
+  "- **Composio API key** \u2014 a single platform key, generated at https://app.composio.dev/settings/api-keys",
+  "- **Composio User ID** (optional override) \u2014 defaults to your Ever Works user id; set this if you connected the upstream account under a different identifier (typically an email)",
+  "- **Toolkit slug** \u2014 the upstream app (e.g. `GMAIL`, `GITHUB`, `SLACK`)",
+  "- **Tool slug** \u2014 the specific action inside the toolkit (e.g. `GMAIL_SEND_EMAIL`)",
+  "",
+  "## Tool input & output",
+  "",
+  "Composio executes the tool against the user's connected account using the arguments you provide.",
+  "",
+  "<details>",
+  "<summary><strong>Input your tool receives</strong></summary>",
+  "",
+  "```json",
+  "{",
+  '  "metadata": {',
+  '    "workId": "dir-123",',
+  '    "workName": "Best AI Tools",',
+  '    "workSlug": "best-ai-tools",',
+  '    "workDescription": "A curated list of the best AI tools",',
+  '    "prompt": "Find the best AI writing tools",',
+  '    "generationMethod": "create-update",',
+  '    "targetItems": 50',
+  "  },",
+  '  "existingSummary": {',
+  '    "totalItems": 10,',
+  '    "categories": ["Writing", "Image Generation"],',
+  '    "tags": ["free", "open-source"],',
+  '    "sampleItems": [{ "name": "ChatGPT", "url": "https://chat.openai.com" }]',
+  "  },",
+  '  "toolParams": { "to": "alice@example.com", "subject": "Hello" }',
+  "}",
+  "```",
+  "",
+  "- `existingSummary` is omitted when the work is empty or the user disables it via **Pass Existing Items Summary**",
+  "- `toolParams` is also spread at the top level so catalog tools see their required inputs (e.g. `to`, `subject`, `body` for `GMAIL_SEND_EMAIL`)",
+  "- `metadata.targetItems` is the number of new items the user asked for",
+  "",
+  "</details>",
+  "",
+  "<details>",
+  "<summary><strong>Structured output your tool can return</strong></summary>",
+  "",
+  "For Structured items mode, return a JSON object with an `items` array:",
+  "",
+  "```json",
+  "{",
+  '  "items": [',
+  "    {",
+  '      "name": "Tool Name",',
+  '      "description": "A concise description (1-3 sentences)",',
+  '      "url": "https://example.com",',
+  '      "category": "Category Name",',
+  '      "tags": ["tag1", "tag2"],',
+  '      "content": "Optional longer markdown content",',
+  '      "brand": "Optional brand name",',
+  '      "images": ["https://example.com/screenshot.png"]',
+  "    }",
+  "  ]",
+  "}",
+  "```",
+  "",
+  "**Required field:** `name`",
+  "",
+  "**Recommended fields:** `description`, `url`, `category`, `tags`",
+  "",
+  "**Optional fields:** `content` (stored as markdown), `brand`, `images`",
+  "",
+  "</details>",
+  "",
+  "## Connecting a toolkit (one-time, per user)",
+  "",
+  "1. Sign in to [Composio](https://app.composio.dev) and locate the toolkit you want (e.g. Gmail)",
+  "2. Add an **auth config** for the toolkit (Composio-managed OAuth is fastest; bring-your-own OAuth credentials is also supported)",
+  "3. From the Connected Accounts page, **Initiate** a connection for your `user_id` and complete the OAuth flow",
+  "4. Confirm the account shows status `ACTIVE` in the Composio dashboard",
+  "5. In Ever Works, open the Composio plugin settings, set the `Toolkit` and `Tool Slug` for your work, and trigger a run",
+  "",
+  "## Getting started",
+  "",
+  "1. Create a Composio account at [composio.dev](https://composio.dev) and grab your API key from **Settings \u2192 API Keys**",
+  "2. Connect at least one toolkit (Gmail, GitHub, Slack, \u2026) under your Composio `user_id`",
+  "3. Open the Composio plugin settings in Ever Works and paste the API key (and, if needed, override the Composio `user_id`). Save.",
+  "4. In the **Generate** flow, set `toolkit`, `tool_slug`, the result shape, and any custom tool arguments, then trigger a run."
+].join("\n");
+
+// ../../plugin/dist/helpers/ssrf-guard.js
+var import_net = require("net");
+function isSafeWebhookUrl(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    return false;
+  }
+  let host = url.hostname.toLowerCase();
+  if (host.startsWith("[") && host.endsWith("]")) {
+    host = host.slice(1, -1);
+  }
+  if (CLOUD_METADATA_HOSTNAMES.has(host)) {
+    return false;
+  }
+  const ipKind = (0, import_net.isIP)(host);
+  if (ipKind === 4 && isPrivateIPv4(host)) return false;
+  if (ipKind === 6 && isPrivateIPv6(host)) return false;
+  return true;
+}
+var CLOUD_METADATA_HOSTNAMES = /* @__PURE__ */ new Set([
+  // GCP
+  "metadata.google.internal",
+  "metadata.goog",
+  // AWS
+  "instance-data",
+  "instance-data.ec2.internal",
+  // Azure
+  "metadata.azure.internal"
+]);
+function isPrivateIPv4(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return false;
+  const [a, b] = parts;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 0) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 192 && b === 0 && parts[2] === 0) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isPrivateIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") return true;
+  if (lower.startsWith("fc") || lower.startsWith("fd")) return true;
+  const firstHextet = lower.split(":", 1)[0];
+  if (/^[0-9a-f]{1,4}$/.test(firstHextet)) {
+    const group0 = parseInt(firstHextet, 16);
+    if ((group0 & 65472) === 65152) return true;
+  }
+  if (lower.startsWith("::ffff:")) {
+    const v4 = lower.slice("::ffff:".length);
+    if ((0, import_net.isIP)(v4) === 4) return isPrivateIPv4(v4);
+  }
+  return false;
+}
+
+// src/composio.plugin.ts
+var ComposioPlugin = class {
+  constructor() {
+    this.id = "composio";
+    this.name = "Composio Integrations";
+    this.version = "1.0.0";
+    this.category = "pipeline";
+    this.capabilities = ["pipeline", "form-schema-provider", "skills-provider"];
+    this.configurationMode = "user-required";
+    this.handledConfigFields = ["*"];
+    this.providerName = "Composio Integrations";
+    this.settingsSchema = {
+      type: "object",
+      properties: {
+        apiKey: {
+          type: "string",
+          title: "Composio API Key",
+          description: "Your Composio API key. Generate one at https://app.composio.dev/settings/api-keys. Used as the `x-api-key` header on every Composio v3 call.",
+          "x-secret": true,
+          "x-envVar": "COMPOSIO_API_KEY",
+          "x-scope": "user"
+        },
+        webhookSecret: {
+          type: "string",
+          title: "Composio Webhook Secret",
+          description: "Your Composio project webhook secret, from Composio dashboard \u2192 Project Settings \u2192 Webhook. Required to verify inbound trigger webhook deliveries (HMAC-SHA256 of the signed payload). Without it, trigger deliveries are rejected.",
+          "x-secret": true,
+          "x-envVar": "COMPOSIO_WEBHOOK_SECRET",
+          "x-scope": "user"
+        },
+        baseUrl: {
+          type: "string",
+          title: "Composio API Base URL",
+          description: `Override the Composio API base URL. Leave empty to use the default (${DEFAULT_BASE_URL}).`,
+          "x-scope": "user"
+        },
+        defaultUserId: {
+          type: "string",
+          title: "Default Composio User ID",
+          description: "Composio `user_id` to run tools against. Defaults to your Ever Works user id. Override if you connected the upstream app under a different identifier (typically an email).",
+          "x-scope": "user"
+        },
+        defaultToolkit: {
+          type: "string",
+          title: "Default Toolkit",
+          description: "Default toolkit slug (e.g. GMAIL, GITHUB, SLACK). Used when no toolkit is set in the generator form.",
+          "x-scope": "user"
+        },
+        defaultToolSlug: {
+          type: "string",
+          title: "Default Tool Slug",
+          description: "Default Composio tool slug (e.g. GMAIL_SEND_EMAIL, GITHUB_CREATE_ISSUE). Used when no tool is set in the generator form.",
+          "x-scope": "user"
+        }
+      },
+      required: ["apiKey"]
+    };
+    this.context = null;
+    this._lastState = null;
+    this._lastAbortController = null;
+  }
+  // ── IPlugin lifecycle ──────────────────────────────────────────────
+  async onLoad(context) {
+    this.context = context;
+    context.logger.log("Composio Integrations plugin loaded");
+  }
+  async onUnload() {
+    await this.cancel();
+    this.context = null;
+  }
+  async healthCheck() {
+    return {
+      status: "healthy",
+      message: "Composio Integrations plugin is ready",
+      checkedAt: Date.now()
+    };
+  }
+  isAvailable(settings) {
+    return hasApiKey(settings ?? {});
+  }
+  async validateSettings(settings) {
+    if (hasApiKey(settings)) {
+      return { valid: true };
+    }
+    return {
+      valid: false,
+      errors: [
+        {
+          path: "apiKey",
+          message: "Composio API key is required. Generate one at https://app.composio.dev/settings/api-keys."
+        }
+      ]
+    };
+  }
+  async validateConnection(rawSettings) {
+    const settings = this.flattenSettings(rawSettings);
+    if (!hasApiKey(settings)) {
+      return {
+        success: false,
+        message: "Composio API key is not configured."
+      };
+    }
+    try {
+      const client = new ComposioClient({
+        apiKey: settings.apiKey,
+        // Security (SSRF): same guard as resolveComposioSettings — baseUrl is
+        // tenant-controlled and reaches the Composio SDK with the API key attached.
+        baseUrl: resolveSafeBaseUrl(trimOrUndefined(settings.baseUrl)),
+        logger: this.context?.logger ?? console
+      });
+      const toolkits = await client.listToolkits(1);
+      const userId = trimOrUndefined(settings.defaultUserId);
+      const toolkitSlug = trimOrUndefined(settings.defaultToolkit);
+      if (userId && toolkitSlug) {
+        const accounts = await client.listConnectedAccounts(userId, toolkitSlug);
+        const active = accounts.find((a) => (a.status || "").toUpperCase() === "ACTIVE");
+        if (active) {
+          return {
+            success: true,
+            message: `Connected to Composio. User "${userId}" has an ACTIVE ${toolkitSlug} connection.`
+          };
+        }
+        return {
+          success: true,
+          message: `Connected to Composio (${toolkits.length} toolkit(s) visible), but no ACTIVE connected account for user "${userId}" on toolkit "${toolkitSlug}". Connect it in the Composio dashboard.`
+        };
+      }
+      return {
+        success: true,
+        message: `Connected to Composio. ${toolkits.length} toolkit(s) visible. Set a default toolkit + user to verify a specific connection.`
+      };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Connection validation failed";
+      return { success: false, message };
+    }
+  }
+  getManifest() {
+    return {
+      id: this.id,
+      name: this.name,
+      version: this.version,
+      description: "Pipeline plugin that executes Composio tools across 500+ third-party apps (Gmail, Slack, GitHub, Notion, \u2026) during work generation. Composio brokers OAuth per user.",
+      category: this.category,
+      capabilities: [...this.capabilities],
+      author: { name: "Ever Works Team" },
+      license: "AGPL-3.0",
+      builtIn: true,
+      autoEnable: false,
+      visibility: "public",
+      selectableProviderCategories: ["screenshot"],
+      uiHints: {
+        includeInOnboarding: true,
+        onboardingPriority: 2,
+        completionFields: ["apiKey"],
+        onboardingDescription: "Connect Composio to call 500+ third-party app integrations (Gmail, Slack, GitHub, Notion, Linear, Salesforce, \u2026) per user during work generation."
+      },
+      readme: README,
+      homepage: "https://docs.composio.dev",
+      icon: {
+        type: "url",
+        value: "https://composio.dev/favicon.ico"
+      }
+    };
+  }
+  // ── IFormSchemaProvider ─────────────────────────────────────────────
+  getFormFields() {
+    return getFormFields();
+  }
+  getFormGroups() {
+    return getFormGroups();
+  }
+  validateFormInput(values) {
+    return validateFormInput(values);
+  }
+  getDefaultValues() {
+    return getDefaultValues(this.getFormFields());
+  }
+  // ── ISkillsProviderPlugin ───────────────────────────────────────────
+  //
+  // Each ACTIVE Composio connected account the user owns surfaces as one
+  // markdown skill entry under `composio-<toolkit>`. The agent reads the
+  // entry's body during planning and learns to dispatch the toolkit via
+  // the composio pipeline plugin. Connection state is read live (cached
+  // per call) — there's no separate ingestion job.
+  async listEntries(options) {
+    const entries = await this.loadEntries(options.settings);
+    return filterSkillCatalog(entries, options);
+  }
+  async getEntry(slug, settings) {
+    const entries = await this.loadEntries(settings);
+    return entries.find((e) => e.slug === slug) ?? null;
+  }
+  async checkForUpdates(installedVersions, settings) {
+    const entries = await this.loadEntries(settings);
+    return diffSkillCatalogVersions(entries, installedVersions);
+  }
+  async loadEntries(settings) {
+    const apiKey = readApiKey(settings);
+    const defaultUserId = readDefaultUserId(settings);
+    if (!apiKey || !defaultUserId) return [];
+    try {
+      return await buildSkillCatalogEntries({
+        apiKey,
+        // Security (SSRF): baseUrl is tenant-controlled and reaches the Composio
+        // SDK (with the API key) inside buildSkillCatalogEntries. Block private/
+        // loopback/link-local/cloud-metadata hosts and non-HTTP(S) schemes; an
+        // unsafe value throws and is caught below, degrading to an empty catalog.
+        baseUrl: resolveSafeBaseUrl(readBaseUrl(settings)),
+        defaultUserId,
+        logger: this.context?.logger ?? console
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      (this.context?.logger ?? console).warn(`Composio skills-provider: failed to load catalog \u2014 ${message}`);
+      return [];
+    }
+  }
+  // ── IPipelinePlugin ─────────────────────────────────────────────────
+  getStepDefinitions() {
+    return STEP_DEFINITIONS;
+  }
+  async execute(work, request, existing, options, onProgress) {
+    const startTime = Date.now();
+    const abortController = new AbortController();
+    if (options?.signal) {
+      if (options.signal.aborted) {
+        abortController.abort();
+      } else {
+        options.signal.addEventListener("abort", () => abortController.abort(), { once: true });
+      }
+    }
+    const signal = abortController.signal;
+    let state = initializeState();
+    this._lastState = state;
+    this._lastAbortController = abortController;
+    const setState = (stepId, status, error) => {
+      state = updateStepState(state, stepId, status, error);
+      this._lastState = state;
+    };
+    const handleError = (error) => {
+      const { result, state: s } = buildErrorResult(state, error, startTime);
+      state = s;
+      this._lastState = state;
+      return result;
+    };
+    const handleCancel = () => {
+      const { result, state: s } = buildCancelledResult(state, startTime);
+      state = s;
+      this._lastState = state;
+      return result;
+    };
+    const logger = this.context?.logger ?? console;
+    const userId = work.user?.id;
+    if (!userId) {
+      return handleError(new Error("User ID is required"));
+    }
+    let timeoutHandle;
+    try {
+      const pluginSettings = await resolveSettings(this.context, userId, work.id);
+      const config = request.config || {};
+      const composioSettings = this.resolveComposioSettings(pluginSettings, config);
+      timeoutHandle = setTimeout(() => {
+        if (!signal.aborted) {
+          logger.warn(`Composio tool timed out after ${composioSettings.timeoutMs}ms \u2014 aborting`);
+          abortController.abort();
+        }
+      }, composioSettings.timeoutMs);
+      const toolRef = this.resolveToolRef(config, composioSettings, userId);
+      const missing = this.collectMissingToolFields(toolRef);
+      if (missing.length > 0) {
+        return handleError(
+          new Error(
+            `Composio tool is not fully configured. Missing: ${missing.join(", ")}. Provide the values in the generator form or in plugin settings.`
+          )
+        );
+      }
+      const client = new ComposioClient({
+        apiKey: composioSettings.apiKey,
+        baseUrl: composioSettings.baseUrl,
+        logger
+      });
+      setState("validate-composio", "running");
+      reportProgress(onProgress, 0, 5, "Validate Composio Connection");
+      await client.validateConnection(toolRef);
+      setState("validate-composio", "completed");
+      if (signal.aborted) return handleCancel();
+      setState("prepare-payload", "running");
+      reportProgress(onProgress, 1, 10, "Prepare Tool Payload");
+      const payload = buildToolPayload({ work, request, existing, config });
+      logger.log(
+        `Payload prepared: ${payload.metadata.targetItems} target items, ${payload.existingSummary?.totalItems ?? 0} existing items, dataSource=${payload.dataSource?.type ?? "none"}`
+      );
+      setState("prepare-payload", "completed");
+      if (signal.aborted) return handleCancel();
+      setState("execute-tool", "running");
+      reportProgress(
+        onProgress,
+        2,
+        15,
+        "Execute Composio Tool",
+        `Starting tool "${toolRef.toolSlug}" for user "${toolRef.userId}"...`
+      );
+      const execResult = await client.executeTool(
+        toolRef,
+        payload,
+        { signal }
+      );
+      reportProgress(onProgress, 2, 70, "Execute Composio Tool", "Tool completed.");
+      logger.log(`Composio tool completed. Duration: ${execResult.composioDuration}ms`);
+      setState("execute-tool", "completed");
+      if (signal.aborted) return handleCancel();
+      setState("collect-results", "running");
+      reportProgress(onProgress, 3, 75, "Collect & Validate Results");
+      let parsed;
+      let items;
+      if (composioSettings.resultShape === "side-effect") {
+        logger.log(`Side-effect tool completed \u2014 no items parsed. Response: ${safeStringify(execResult.data)}`);
+        parsed = { items: [], categories: [], tags: [], brands: [] };
+        items = [];
+      } else {
+        parsed = parseComposioOutput(
+          execResult.data,
+          composioSettings.resultShape,
+          composioSettings.fieldMapping
+        );
+        const existingNames = existing.items.map((i) => i.name);
+        items = deduplicateItems(parsed.items, existingNames);
+        logger.log(
+          `Collected ${parsed.items.length} items from Composio, ${parsed.items.length - items.length} duplicates removed, ${items.length} new items`
+        );
+      }
+      setState("collect-results", "completed");
+      const screenshotWarnings = await this.captureScreenshots(
+        setState,
+        request,
+        options?.execContext,
+        items,
+        { userId, workId: work.id },
+        signal,
+        onProgress,
+        logger
+      );
+      setState("cleanup", "running");
+      reportProgress(onProgress, 5, 95, "Cleanup");
+      setState("cleanup", "completed");
+      reportProgress(onProgress, 6, 100, "Complete");
+      const duration = Date.now() - startTime;
+      const composioMetrics = {
+        toolkit: toolRef.toolkit,
+        toolSlug: toolRef.toolSlug,
+        userId: toolRef.userId,
+        resultShape: composioSettings.resultShape,
+        composioDuration: execResult.composioDuration,
+        itemsReturned: parsed.items.length
+      };
+      return buildSuccessPipelineResult(
+        {
+          items,
+          categories: parsed.categories,
+          tags: parsed.tags,
+          brands: parsed.brands,
+          collections: []
+        },
+        {
+          metrics: buildMetrics(startTime, duration, items.length, composioMetrics),
+          duration,
+          stepsCompleted: state.completedSteps.length,
+          totalSteps: COMPOSIO_STEP_IDS.length,
+          state,
+          warnings: screenshotWarnings.length > 0 ? screenshotWarnings : void 0
+        }
+      );
+    } catch (error) {
+      const err = error instanceof Error ? error : new Error(String(error));
+      logger.error(`Composio pipeline failed: ${err.message}`);
+      return handleError(err);
+    } finally {
+      if (timeoutHandle !== void 0) clearTimeout(timeoutHandle);
+    }
+  }
+  async cancel() {
+    this._lastAbortController?.abort();
+  }
+  getState() {
+    return this._lastState;
+  }
+  // ── Private helpers ────────────────────────────────────────────────
+  resolveComposioSettings(pluginSettings, config) {
+    const apiKey = trimOrUndefined(pluginSettings.apiKey);
+    if (!apiKey) {
+      throw new Error("Composio API key is not configured. Add it in plugin settings.");
+    }
+    const timeoutMinutes = config.tool_timeout || 10;
+    const resultShape = config.result_shape || "structured";
+    const fieldMapping = {
+      nameField: config.name_field || "name",
+      urlField: trimOrUndefined(config.url_field),
+      descriptionField: trimOrUndefined(config.description_field),
+      categoryField: trimOrUndefined(config.category_field),
+      tagsField: trimOrUndefined(config.tags_field),
+      imageField: trimOrUndefined(config.image_field),
+      brandField: trimOrUndefined(config.brand_field),
+      contentField: trimOrUndefined(config.content_field)
+    };
+    const timeoutCandidate = timeoutMinutes * 60 * 1e3;
+    const timeoutMs = Number.isFinite(timeoutCandidate) ? Math.max(6e4, timeoutCandidate) : DEFAULT_TIMEOUT_MS;
+    return {
+      apiKey,
+      // Security (SSRF): baseUrl is tenant-controlled plugin settings and flows into
+      // the ComposioClient used by the execute() pipeline below, which sends every
+      // Composio request — carrying the API key — to that host. Reject private/
+      // loopback/link-local/cloud-metadata hosts and non-HTTP(S) schemes here so a
+      // malicious baseUrl can't redirect the request to an internal endpoint.
+      baseUrl: resolveSafeBaseUrl(trimOrUndefined(pluginSettings.baseUrl)),
+      defaultUserId: trimOrUndefined(pluginSettings.defaultUserId),
+      defaultToolkit: trimOrUndefined(pluginSettings.defaultToolkit),
+      defaultToolSlug: trimOrUndefined(pluginSettings.defaultToolSlug),
+      timeoutMs,
+      resultShape,
+      fieldMapping
+    };
+  }
+  resolveToolRef(config, settings, fallbackUserId) {
+    const toolkit = (trimOrUndefined(config.toolkit) || settings.defaultToolkit || "").trim().toUpperCase();
+    const toolSlug = (trimOrUndefined(config.tool_slug) || settings.defaultToolSlug || "").trim().toUpperCase();
+    const userId = trimOrUndefined(config.composio_user_id) || settings.defaultUserId || fallbackUserId;
+    return { toolkit, toolSlug, userId };
+  }
+  collectMissingToolFields(ref) {
+    const missing = [];
+    if (!ref.toolkit) missing.push("toolkit");
+    if (!ref.toolSlug) missing.push("tool_slug");
+    if (!ref.userId) missing.push("composio_user_id");
+    return missing;
+  }
+  async captureScreenshots(setState, request, execContext, items, facadeOptions, signal, onProgress, logger) {
+    const shouldCapture = (request.config || {}).capture_screenshots === true;
+    const screenshotFacade = execContext?.screenshotFacade;
+    if (!shouldCapture || items.length === 0 || signal.aborted || !screenshotFacade) {
+      setState("capture-screenshots", "skipped");
+      return [];
+    }
+    if (!screenshotFacade.isAvailable()) {
+      setState("capture-screenshots", "skipped");
+      return ["Screenshot provider is not configured. Enable a screenshot plugin to capture item images."];
+    }
+    setState("capture-screenshots", "running");
+    reportProgress(onProgress, 4, 80, "Capture Screenshots");
+    const errors = [];
+    const itemsNeedingImages = items.filter(
+      (item) => item.source_url && (!item.images || item.images.length === 0)
+    );
+    for (const item of itemsNeedingImages) {
+      if (signal.aborted) break;
+      try {
+        const result = await screenshotFacade.getSmartImage(
+          { url: item.source_url, itemName: item.name },
+          facadeOptions
+        );
+        if (result.primaryImage) {
+          item.images = [result.primaryImage, ...item.images || []];
+        }
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : "Unknown error";
+        logger.warn(`Failed to capture image for ${item.name}: ${reason}`);
+        errors.push(reason);
+      }
+    }
+    setState(
+      "capture-screenshots",
+      errors.length > 0 && errors.length === itemsNeedingImages.length ? "failed" : "completed"
+    );
+    if (errors.length > 0) {
+      const providerName = await screenshotFacade.getActiveProviderName?.(facadeOptions);
+      const label = providerName ? `Screenshot capture (${providerName})` : "Screenshot capture";
+      const unique = [...new Set(errors)];
+      return [`${label} failed for ${errors.length} item(s): ${unique.join("; ")}`];
+    }
+    return [];
+  }
+  flattenSettings(settings) {
+    const flat = {};
+    for (const [key, entry] of Object.entries(settings)) {
+      if (entry && typeof entry === "object" && "value" in entry) {
+        flat[key] = entry.value;
+      } else {
+        flat[key] = entry;
+      }
+    }
+    return flat;
+  }
+};
+function trimOrUndefined(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed === "" ? void 0 : trimmed;
+}
+function resolveSafeBaseUrl(baseUrl) {
+  if (!baseUrl) return void 0;
+  if (!isSafeWebhookUrl(baseUrl)) {
+    throw new Error("Composio API base URL is not safe to call (SSRF guard blocked the destination host).");
+  }
+  return baseUrl;
+}
+function safeStringify(value, maxLength = 500) {
+  try {
+    const s = JSON.stringify(value);
+    return s.length > maxLength ? `${s.slice(0, maxLength)}\u2026` : s;
+  } catch {
+    return String(value);
+  }
+}
+function hasApiKey(settings) {
+  return !!trimOrUndefined(settings.apiKey);
+}
+var composio_plugin_default = ComposioPlugin;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ComposioPlugin
+});
+/**
+ * One header finding of the licence scan (plan §2.6:324-325, FR-54): the
+ * `SPDX-License-Identifier:` / `@license` tag a file declares in its first
+ * `LICENSE_HEADER_SCAN_BYTES` bytes.
+ *
+ * **Gap, named rather than guessed:** plan §3.1:437 writes the column's third
+ * field as `headerFindings: …` without a shape. `path` is certain — it is the
+ * first field of the scan's input — and the detected identifier is the second
+ * fact the scan produces, so both are declared; anything further an
+ * implementation adds is additive.
+ */