@fayz-ai/admin 0.62.0 → 0.63.0

package/dist/chunk-6QFOE3UD.js

@@ -0,0 +1,1466 @@
+import { checkAccess, guardLimit, useRightRailStore } from './chunk-PQ47MLTH.js';
+import { invalidateLimit } from './chunk-S56FQKPL.js';
+import { resolveEntityRoute, openEntity } from './chunk-ALCSIN3Z.js';
+import { loadArea, useChatStore, CORE_QUERY_ENTITIES, resolveAttachmentDigest, listAttachmentNames, nonTabularAttachmentNames, readAllRows, ALWAYS_ON_TOOLS, lookupRecordRef, PROFILE_ACTIONS, resolveToolSearch } from './chunk-KLO7DKXX.js';
+import { usePermissionsStore } from './chunk-UQ2NTFQC.js';
+import { create } from 'zustand';
+import { resolveDataProvider, emitDataChanged, deriveEntityKey, bulkCreate, matchesRange, getSupabaseClientOptional, getActiveTenantId, useTranslation, parseRangeFilter, isFilterObject } from '@fayz-ai/core';
+import { profileHasSystemPermission } from '@fayz-ai/core/access';
+import * as React from 'react';
+import { WandSparkles } from 'lucide-react';
+import { DropdownItem, Button, Modal, ModalContent, ModalHeader, ModalTitle, ModalDescription, ModalFooter } from '@fayz-ai/ui';
+import { jsxs, jsx } from 'react/jsx-runtime';
+
+var ASK_AI_HANDOFF_ID = "ask-ai.handoff";
+var KEY_DISMISSED = "fayz.assistant.invite.dismissed";
+function session() {
+  try {
+    return typeof sessionStorage === "undefined" ? null : sessionStorage;
+  } catch {
+    return null;
+  }
+}
+function dismissedIds() {
+  try {
+    return JSON.parse(session()?.getItem(KEY_DISMISSED) ?? "[]");
+  } catch {
+    return [];
+  }
+}
+function rememberDismissal(id) {
+  const store = session();
+  if (!store) return;
+  store.setItem(KEY_DISMISSED, JSON.stringify([.../* @__PURE__ */ new Set([...dismissedIds(), id])]));
+}
+var useAssistantInviteStore = create((set, get) => ({
+  invite: null,
+  stage: "dock",
+  dockBox: null,
+  leaving: null,
+  setInvite: (invite, id) => {
+    if (!invite) {
+      if (id && get().invite?.id !== id) return;
+      const { invite: going, dockBox } = get();
+      set({
+        invite: null,
+        stage: "dock",
+        dockBox: null,
+        leaving: going && dockBox ? { invite: going, box: dockBox } : null
+      });
+      return;
+    }
+    if (invite.role) loadArea(invite.role);
+    const hero = invite.auto !== false && !dismissedIds().includes(invite.id);
+    set({ invite, stage: hero ? "hero" : "dock", leaving: null });
+  },
+  setDockBox: (box) => {
+    const current = get().dockBox;
+    if (current?.left === box?.left && current?.width === box?.width) return;
+    set({ dockBox: box });
+  },
+  endLeave: () => set({ leaving: null }),
+  dismiss: () => {
+    const { invite } = get();
+    if (invite) rememberDismissal(invite.id);
+    set({ stage: "dock" });
+  }
+}));
+
+// src/lib/reveal-page.ts
+function revealPage(delayMs = 1200) {
+  if (typeof window === "undefined" || window.matchMedia("(min-width: 768px)").matches) return;
+  const close = () => {
+    useChatStore.getState().setOpen(false);
+    if (useRightRailStore.getState().open) useRightRailStore.getState().close();
+  };
+  if (!useChatStore.getState().isStreaming) {
+    window.setTimeout(close, delayMs);
+    return;
+  }
+  const stop = useChatStore.subscribe((state, prev) => {
+    if (prev.isStreaming && !state.isStreaming) {
+      stop();
+      window.setTimeout(close, delayMs);
+    }
+  });
+}
+
+// src/lib/agent-surface.ts
+var entries = [];
+var version = 0;
+var listeners = /* @__PURE__ */ new Set();
+function emit() {
+  version++;
+  for (const l of listeners) l();
+}
+function registerSurface(entry) {
+  entries = [...entries.filter((e) => e.id !== entry.id), entry];
+  emit();
+}
+function unregisterSurface(id) {
+  const next = entries.filter((e) => e.id !== id);
+  if (next.length === entries.length) return;
+  entries = next;
+  emit();
+}
+function subscribeSurfaces(cb) {
+  listeners.add(cb);
+  return () => listeners.delete(cb);
+}
+function getSurfaceVersion() {
+  return version;
+}
+function getSurfaceTools() {
+  return [...entries].reverse().flatMap((e) => {
+    const c = e.get();
+    return c.tools?.map(({ tool }) => tool.role || !c.role ? tool : { ...tool, role: c.role }) ?? [];
+  });
+}
+function getActiveSurfaceContext() {
+  const snapshot = [];
+  const instructions = [];
+  for (const e of entries) {
+    const c = e.get();
+    if (c.describe) {
+      try {
+        snapshot.push(c.describe());
+      } catch {
+      }
+    }
+    if (c.instructions) instructions.push(c.instructions);
+  }
+  return { snapshot, instructions };
+}
+function requestChatConfirmation(action) {
+  return useChatStore.getState().requestConfirmation(action);
+}
+var SYSTEM_FIELD_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "tenant_id",
+  "tenantId",
+  "created_at",
+  "createdAt",
+  "updated_at",
+  "updatedAt",
+  "deleted_at",
+  "deletedAt",
+  "created_by",
+  "createdBy"
+]);
+function normaliseOptions(raw) {
+  if (!Array.isArray(raw)) return void 0;
+  const out = [];
+  for (const o of raw) {
+    if (typeof o === "string") out.push({ value: o });
+    else if (o && typeof o === "object" && typeof o.value === "string") {
+      const rec = o;
+      out.push({ value: rec.value, label: typeof rec.label === "string" ? rec.label : void 0 });
+    }
+  }
+  return out.length ? out : void 0;
+}
+function cardFields(entity) {
+  return (entity.fields ?? []).filter((f) => f.showInForm !== false && !SYSTEM_FIELD_KEYS.has(String(f.key))).map((f) => {
+    const type = typeof f.type === "string" ? f.type : void 0;
+    return {
+      key: String(f.key),
+      label: typeof f.label === "string" ? f.label : void 0,
+      type,
+      required: f.required === true,
+      options: normaliseOptions(f.options),
+      placeholder: typeof f.placeholder === "string" ? f.placeholder : void 0,
+      hint: typeof f.hint === "string" ? f.hint : void 0,
+      min: typeof f.min === "number" ? f.min : void 0,
+      max: typeof f.max === "number" ? f.max : void 0,
+      default: f.defaultValue,
+      // A computed value has no input, and a relation needs its option list
+      // loaded from a table — neither is something to type into a chat card.
+      readOnly: type === "computed" || type === "relation" || !!f.relation
+    };
+  });
+}
+var handlers = /* @__PURE__ */ new Map();
+function registerAIToolHandler(name, handler) {
+  handlers.set(name, handler);
+}
+function unregisterAIToolHandler(name) {
+  handlers.delete(name);
+}
+function hasAIToolHandler(name) {
+  return handlers.has(name);
+}
+var REGISTRY_PAGE_SIZE = 20;
+var FILTERED_PAGE_SIZE = 200;
+var FRESH = { cache: false };
+function localDayBound(value, edge) {
+  const dateOnly = /^\d{4}-\d{2}-\d{2}$/.test(value.trim());
+  if (!dateOnly) return value;
+  const time = edge === "start" ? "00:00:00.000" : "23:59:59.999";
+  const parsed = /* @__PURE__ */ new Date(`${value.trim()}T${time}`);
+  return Number.isNaN(parsed.getTime()) ? value : parsed.toISOString();
+}
+function dateRangeFilter(args) {
+  const from = typeof args.from === "string" && args.from.trim() ? args.from.trim() : void 0;
+  const to = typeof args.to === "string" && args.to.trim() ? args.to.trim() : void 0;
+  if (!from && !to) return null;
+  const field = typeof args.dateField === "string" && args.dateField.trim() ? args.dateField.trim() : "createdAt";
+  const range = {};
+  if (from) range.gte = localDayBound(from, "start");
+  if (to) range.lte = localDayBound(to, "end");
+  return { field, range };
+}
+var MAX_TOOLS_PER_TURN = 36;
+function errorResult(error, message) {
+  return { ok: false, content: JSON.stringify({ error, message }) };
+}
+function attachRefs(entity, rows) {
+  const archetype = entity.data?.archetype;
+  if (!archetype) return rows;
+  const kind = entity.data?.archetypeKind;
+  const entityKey = deriveEntityKey(entity);
+  return rows.map(
+    (r) => r.id ? {
+      ...r,
+      ref: {
+        id: r.id,
+        resource: entity.data?.table,
+        archetype: kind ? `${archetype}:${kind}` : archetype,
+        entityKey
+      }
+    } : r
+  );
+}
+function rowContainsText(row, needle) {
+  const n = needle.toLowerCase();
+  return Object.values(row).some((v) => typeof v === "string" && v.toLowerCase().includes(n));
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function executeDataTool(target, args) {
+  const provider = resolveDataProvider(
+    target.entity,
+    target.mockData,
+    FRESH
+  );
+  const search = typeof args.search === "string" && args.search.trim() ? args.search.trim() : void 0;
+  if (search && UUID_RE.test(search)) {
+    try {
+      const byId = await provider.list({ filters: { id: search }, pageSize: 1 });
+      const row = byId.data[0];
+      if (row && String(row.id) === search) {
+        return {
+          entity: target.label,
+          search,
+          total: 1,
+          truncated: false,
+          records: attachRefs(target.entity, [row])
+        };
+      }
+    } catch {
+    }
+  }
+  const dateRange = dateRangeFilter(args);
+  const result = await provider.list({
+    search,
+    pageSize: dateRange ? FILTERED_PAGE_SIZE : REGISTRY_PAGE_SIZE,
+    ...dateRange ? { filters: { [dateRange.field]: dateRange.range } } : {},
+    ...typeof args.orderBy === "string" ? { sortBy: args.orderBy, sortDir: args.direction === "asc" ? "asc" : "desc" } : {}
+  });
+  let rows = result.data;
+  let total = result.total;
+  if (dateRange && rows.length) {
+    const key = resolveFieldKey(rows[0], dateRange.field);
+    if (!key) {
+      return {
+        error: "unknown_field",
+        message: `dateField "${dateRange.field}" does not exist on ${target.label}. Use one of the available fields and retry.`,
+        availableFields: Object.keys(rows[0])
+      };
+    }
+    const narrowed = rows.filter((r) => matchesRange(r[key], dateRange.range));
+    if (narrowed.length !== rows.length) total = narrowed.length;
+    rows = narrowed;
+  }
+  const unmatched = !!search && rows.length > 0 && !rows.some((r) => rowContainsText(r, search));
+  return {
+    entity: target.label,
+    ...search ? { search } : {},
+    ...dateRange ? { dateRange: { field: dateRange.field, ...dateRange.range } } : {},
+    total,
+    // Truthful cap: the model is told the list was trimmed so it can say so
+    // rather than presenting one page as the whole set.
+    truncated: total > rows.length,
+    records: attachRefs(target.entity, rows),
+    ...unmatched ? {
+      warning: "None of these rows contain the search text \u2014 they are RECENT records, not matches. Do NOT present them as the searched item; say it was not found or try another entity."
+    } : {}
+  };
+}
+function readOnlyRefusal(ctx, target, verb) {
+  const noun = target.entity.name.replace(/\s+/g, "").toLowerCase();
+  const plural = target.label.replace(/\s+/g, "").toLowerCase();
+  const wantedAction = verb === "created" ? "create" : "edit";
+  const candidates = (ctx.writeTools ?? []).filter(({ name, action }) => {
+    const n = name.toLowerCase();
+    if (n === "createrecord" || n === "updaterecord") return false;
+    if (!n.includes(noun) && !n.includes(plural)) return false;
+    if (action) return action === wantedAction;
+    return wantedAction === "create" ? /^(create|add|new)/.test(n) : /^(update|edit|set|change|move)/.test(n);
+  }).map((t) => t.name);
+  return {
+    error: "read_only",
+    message: `${target.label} is a read-only view \u2014 records cannot be ${verb} through this tool.` + (candidates.length ? ` Use ${candidates.join(" or ")} instead.` : ` This app has no tool that can change a ${target.entity.name.toLowerCase()}. Tell the user plainly that you cannot, and where in the app they can do it themselves.`) + " Do NOT substitute a create: making a new record instead of changing the existing one leaves the original in place and duplicates it.",
+    ...candidates.length ? { useInstead: candidates } : {}
+  };
+}
+function resolveFieldKey(row, name) {
+  if (name in row) return name;
+  const camel = name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+  if (camel in row) return camel;
+  const snake = name.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
+  if (snake in row) return snake;
+  return null;
+}
+function resolveFilter(sample, label, name, value) {
+  const key = resolveFieldKey(sample, name);
+  if (!key) {
+    return {
+      error: "unknown_field",
+      message: `Filter field "${name}" does not exist on ${label}. Use one of the available fields and retry.`,
+      availableFields: Object.keys(sample)
+    };
+  }
+  const range = parseRangeFilter(value);
+  if (range) return { key, test: (row) => matchesRange(row[key], range) };
+  if (isFilterObject(value)) {
+    return {
+      error: "invalid_filter",
+      message: `Filter "${name}" is an object with no recognised bound. For a range use {"from":\u2026,"to":\u2026} (also accepted: gte/lte/gt/lt). For a date or period, prefer the from/to parameters of this tool instead of filters.`
+    };
+  }
+  return { key, test: (row) => String(row[key] ?? "") === String(value) };
+}
+async function executeAITool(name, args, context) {
+  const handler = handlers.get(name);
+  const dataTarget = context.dataTools.get(name);
+  if (!handler && !dataTarget) {
+    return errorResult(
+      "not_executable",
+      `The tool "${name}" is not available here. Do not retry it \u2014 tell the user what you cannot do, or use a different tool.`
+    );
+  }
+  try {
+    const result = handler ? await handler(args, context) : await executeDataTool(dataTarget, args);
+    return { ok: true, content: JSON.stringify(result ?? { ok: true }) };
+  } catch (error) {
+    return errorResult("execution_failed", describeThrown(error));
+  }
+}
+function describeThrown(error) {
+  if (error instanceof Error) return error.message;
+  if (error && typeof error === "object") {
+    const e = error;
+    const parts = [
+      typeof e.message === "string" ? e.message : null,
+      typeof e.hint === "string" ? e.hint : null,
+      typeof e.code === "string" ? `(${e.code})` : null
+    ].filter(Boolean);
+    if (parts.length) return parts.join(" ");
+  }
+  return typeof error === "string" && error ? error : "Unknown error";
+}
+function buildDataToolIndex(input) {
+  const index = /* @__PURE__ */ new Map();
+  for (const [pluginId, defs] of input.registries) {
+    for (const registry of defs) {
+      if (registry.readOnly) continue;
+      const target = {
+        label: registry.entity.namePlural ?? registry.entity.name,
+        entity: registry.entity,
+        mockData: registry.mockData
+      };
+      index.set(input.registryToolName(pluginId, registry.id), target);
+      index.set(`key:${pluginId}:${registry.id}`, target);
+    }
+  }
+  for (const entity of input.entities) {
+    if (!entity.entityDef || entity.entityDef.agentHidden) continue;
+    const target = {
+      label: entity.labelPlural,
+      entity: entity.entityDef,
+      mockData: entity.mockData
+    };
+    index.set(input.entityToolName(entity.entityKey), target);
+    index.set(`key:${entity.entityKey}`, target);
+  }
+  for (const q of [...input.queryEntities ?? [], ...CORE_QUERY_ENTITIES]) {
+    index.set(`key:${q.key}`, {
+      label: q.entity.namePlural ?? q.entity.name,
+      entity: q.entity,
+      readOnly: !q.writable
+    });
+  }
+  return index;
+}
+function openListWriteHint() {
+  const hasCreateHere = getSurfaceTools().some((t) => t.name === "createRecordHere");
+  return hasCreateHere ? " The list the user has open CAN create this one: call `createRecordHere` with `values`, using the field keys in the screen state." : "";
+}
+function resolveKeyedTarget(ctx, args) {
+  const key = typeof args.entity === "string" ? args.entity : "";
+  const target = ctx.dataTools.get(`key:${key}`);
+  if (!target) {
+    return {
+      error: {
+        ok: false,
+        error: "unknown_entity",
+        // Said as plainly as it can be said: the failure above this one was a
+        // reply that described a record nobody had written.
+        message: `NOTHING WAS WRITTEN. No entity "${key}" is available to these tools \u2014 do not tell the user it worked. Use one of the keys listed in the tool description.${openListWriteHint()}`
+      }
+    };
+  }
+  const permission = target.entity.permission;
+  if (permission) {
+    const access = checkAccess(permission.feature, permission.action);
+    if (!access.allowed) return { error: access };
+  }
+  return { target };
+}
+function sameField(a, b) {
+  const norm = (s) => s.replace(/[_-]/g, "").toLowerCase();
+  return norm(a) === norm(b);
+}
+function matchDeclaredFields(target, values) {
+  const declaredKeys = (target.entity.fields ?? []).map((f) => f.key);
+  const clean = {};
+  const unknown = [];
+  for (const [k, v] of Object.entries(values)) {
+    const match = declaredKeys.find((d) => sameField(d, k)) ?? null;
+    if (match) clean[match] = v;
+    else unknown.push(k);
+  }
+  if (!unknown.length) return { clean };
+  return {
+    error: {
+      error: "unknown_field",
+      message: `Unknown field(s) ${unknown.join(", ")} for ${target.label}. Use only the available fields and retry.`,
+      availableFields: declaredKeys
+    }
+  };
+}
+async function resolveAttachedRecords(ctx, matches) {
+  const ownerIds = /* @__PURE__ */ new Set();
+  for (const m of matches) {
+    const target = ctx.dataTools.get(`key:${m.key}`);
+    if (target?.entity.data?.archetype !== "person") continue;
+    for (const r of m.records) {
+      const id = r.id;
+      if (typeof id === "string") ownerIds.add(id);
+    }
+  }
+  if (!ownerIds.size) return null;
+  const out = {};
+  for (const q of CORE_QUERY_ENTITIES) {
+    const target = ctx.dataTools.get(`key:${q.key}`);
+    if (!target) continue;
+    const permission = target.entity.permission;
+    if (permission && !checkAccess(permission.feature, permission.action).allowed) continue;
+    try {
+      const provider = resolveDataProvider(target.entity, target.mockData);
+      const result = await provider.list({ pageSize: 50 });
+      const rows = result.data.filter((row) => {
+        const owner = row.ownerId ?? row.owner_id;
+        return typeof owner === "string" && ownerIds.has(owner);
+      });
+      if (rows.length) out[q.key] = rows;
+    } catch {
+    }
+  }
+  return Object.keys(out).length ? out : null;
+}
+registerAIToolHandler("findAnything", async (args, ctx) => {
+  const search = typeof args.search === "string" ? args.search.trim() : "";
+  if (!search) return { error: "missing_search", message: "Provide the name or text to look up." };
+  const seen = /* @__PURE__ */ new Set();
+  const candidates = [];
+  for (const [key, target] of ctx.dataTools) {
+    if (!key.startsWith("key:") || seen.has(target)) continue;
+    seen.add(target);
+    candidates.push({ key: key.slice(4), target });
+  }
+  let skippedForPermission = 0;
+  const allowed = candidates.filter(({ target }) => {
+    const permission = target.entity.permission;
+    if (!permission) return true;
+    if (checkAccess(permission.feature, permission.action).allowed) return true;
+    skippedForPermission += 1;
+    return false;
+  });
+  allowed.sort((a, b) => {
+    const ap = a.target.entity.data?.archetype === "person" ? 0 : 1;
+    const bp = b.target.entity.data?.archetype === "person" ? 0 : 1;
+    return ap - bp || a.key.localeCompare(b.key);
+  });
+  const MAX_TARGETS = 20;
+  const searched = allowed.slice(0, MAX_TARGETS);
+  const settled = await Promise.allSettled(
+    searched.map(async ({ key, target }) => {
+      const provider = resolveDataProvider(
+        target.entity,
+        target.mockData
+      );
+      const result = await provider.list({ search, pageSize: 5 });
+      return {
+        key,
+        label: target.label,
+        total: result.total,
+        records: attachRefs(target.entity, result.data)
+      };
+    })
+  );
+  const matches = settled.filter((r) => r.status === "fulfilled" && r.value.records.length > 0).map((r) => r.value);
+  const attached = await resolveAttachedRecords(ctx, matches);
+  return {
+    query: search,
+    matches,
+    ...attached ? { attached } : {},
+    searchedEntities: searched.length,
+    ...allowed.length > MAX_TARGETS ? { targetsTruncated: true } : {},
+    ...skippedForPermission ? { skippedForPermission } : {},
+    ...matches.length === 0 ? { hint: "No records matched anywhere the user can see. Say so \u2014 do not retry other search tools with the same text." } : {}
+  };
+});
+registerAIToolHandler("createRecord", async (args, ctx) => {
+  const resolved = resolveKeyedTarget(ctx, args);
+  if ("error" in resolved) return resolved.error;
+  const { target } = resolved;
+  if (target.readOnly) return readOnlyRefusal(ctx, target, "created");
+  const permission = target.entity.permission;
+  if (permission) {
+    const access = checkAccess(permission.feature, "create");
+    if (!access.allowed) return access;
+  }
+  if (target.entity.limitKey) {
+    const limit = await guardLimit(target.entity.limitKey);
+    if (!limit.allowed) return limit;
+  }
+  const values = args.values ?? {};
+  const declared = target.entity.fields ?? [];
+  const matched = matchDeclaredFields(target, values);
+  if ("error" in matched) return matched.error;
+  const { clean } = matched;
+  const isEmpty = (v) => v === void 0 || v === null || v === "";
+  const missingRequired = declared.filter((f) => f.required && isEmpty(clean[f.key]));
+  const mustResolveFirst = missingRequired.filter(
+    (f) => f.type === "computed" || f.type === "relation" || !!f.relation || f.showInForm === false
+  );
+  if (mustResolveFirst.length) {
+    return {
+      error: "missing_required",
+      message: `Missing required field(s) that must be resolved to a record first: ${mustResolveFirst.map((f) => f.key).join(", ")}. Look them up (search for the referenced record), then retry.`,
+      availableFields: declared.map((f) => f.key)
+    };
+  }
+  const dupName = typeof clean.name === "string" ? clean.name.trim() : "";
+  if (dupName && args.allowDuplicate !== true) {
+    const provider0 = resolveDataProvider(
+      target.entity,
+      target.mockData
+    );
+    const existing = await provider0.list({ search: dupName, pageSize: 3 });
+    const dupes = existing.data.filter(
+      (r) => String(r.name ?? "").trim().toLowerCase() === dupName.toLowerCase()
+    );
+    if (dupes.length) {
+      return {
+        error: "possible_duplicate",
+        message: `A ${target.entity.name} named "${dupName}" already exists. If the user wants to CHANGE that existing record, use updateRecord with its id; only retry createRecord with allowDuplicate:true if they explicitly want a second one.`,
+        matches: dupes
+      };
+    }
+  }
+  const decision = await requestChatConfirmation({
+    id: `create-${Date.now()}`,
+    toolName: "createRecord",
+    title: `Criar ${target.entity.name}`,
+    params: clean,
+    plane: "client",
+    // Scoped grant: "always create clients", never "always create anything".
+    scope: typeof args.entity === "string" ? args.entity : void 0,
+    scopeLabel: `Criar ${target.entity.name}`,
+    fields: cardFields(target.entity)
+  });
+  const approved = decision.approved;
+  if (decision.values) {
+    for (const key of Object.keys(clean)) delete clean[key];
+    Object.assign(clean, decision.values);
+  }
+  if (!approved) return { ok: false, cancelled: true, reason: "user_declined" };
+  const stillMissing = declared.filter((f) => f.required && isEmpty(clean[f.key])).map((f) => f.key);
+  if (stillMissing.length) {
+    return {
+      error: "missing_required",
+      message: `Still missing required field(s): ${stillMissing.join(", ")}. Ask the user for them, then retry.`,
+      availableFields: declared.map((f) => f.key)
+    };
+  }
+  const provider = resolveDataProvider(
+    target.entity,
+    target.mockData
+  );
+  const record = await provider.create(clean);
+  if (target.entity.limitKey) invalidateLimit(target.entity.limitKey);
+  emitDataChanged({
+    table: target.entity.data?.table,
+    entityKey: typeof args.entity === "string" ? args.entity : void 0,
+    archetype: target.entity.data?.archetype,
+    op: "create",
+    id: record.id,
+    source: "agent"
+  });
+  return {
+    ok: true,
+    record,
+    ref: {
+      id: record.id,
+      label: String(record.name ?? target.entity.name),
+      resource: target.entity.data?.table,
+      archetype: target.entity.data?.archetype ? `${target.entity.data.archetype}${target.entity.data.archetypeKind ? ":" + target.entity.data.archetypeKind : ""}` : void 0,
+      entityKey: deriveEntityKey(target.entity)
+    }
+  };
+});
+registerAIToolHandler("updateRecord", async (args, ctx) => {
+  const resolved = resolveKeyedTarget(ctx, args);
+  if ("error" in resolved) return resolved.error;
+  const { target } = resolved;
+  if (target.readOnly) return readOnlyRefusal(ctx, target, "updated");
+  const id = typeof args.id === "string" ? args.id : "";
+  if (!id) return { error: "missing_id", message: "Provide the id of the record to update (from this conversation or a search)." };
+  const permission = target.entity.permission;
+  if (permission) {
+    const access = checkAccess(permission.feature, "edit");
+    if (!access.allowed) return access;
+  }
+  const values = args.values ?? {};
+  const matched = matchDeclaredFields(target, values);
+  if ("error" in matched) return matched.error;
+  const { clean } = matched;
+  if (!Object.keys(clean).length) {
+    return { error: "empty_update", message: "No valid fields to change were provided." };
+  }
+  const decision = await requestChatConfirmation({
+    id: `update-${Date.now()}`,
+    toolName: "updateRecord",
+    title: `Atualizar ${target.entity.name}`,
+    params: { id, ...clean },
+    plane: "client",
+    scope: typeof args.entity === "string" ? args.entity : void 0,
+    scopeLabel: `Atualizar ${target.entity.name}`,
+    fields: cardFields(target.entity),
+    partial: true
+  });
+  if (!decision.approved) return { ok: false, cancelled: true, reason: "user_declined" };
+  if (decision.values) {
+    for (const key of Object.keys(clean)) delete clean[key];
+    for (const [k, v] of Object.entries(decision.values)) if (k !== "id") clean[k] = v;
+  }
+  const provider = resolveDataProvider(
+    target.entity,
+    target.mockData
+  );
+  const record = await provider.update(id, clean);
+  emitDataChanged({
+    table: target.entity.data?.table,
+    entityKey: typeof args.entity === "string" ? args.entity : void 0,
+    archetype: target.entity.data?.archetype,
+    op: "update",
+    id,
+    source: "agent"
+  });
+  return {
+    ok: true,
+    record,
+    ref: {
+      id,
+      label: String(record.name ?? target.entity.name),
+      resource: target.entity.data?.table,
+      archetype: target.entity.data?.archetype ? `${target.entity.data.archetype}${target.entity.data.archetypeKind ? ":" + target.entity.data.archetypeKind : ""}` : void 0,
+      entityKey: deriveEntityKey(target.entity)
+    }
+  };
+});
+registerAIToolHandler("searchRecords", async (args, ctx) => {
+  const resolved = resolveKeyedTarget(ctx, args);
+  if ("error" in resolved) return resolved.error;
+  const base = await executeDataTool(resolved.target, args);
+  if ("error" in base) return base;
+  const filters = args.filters ?? {};
+  const keys = Object.keys(filters);
+  if (!keys.length) return base;
+  let rows = base.records;
+  for (const k of keys) {
+    const sample = rows[0] ?? base.records[0];
+    if (!sample) break;
+    const f = resolveFilter(sample, resolved.target.label, k, filters[k]);
+    if ("error" in f) return f;
+    rows = rows.filter(f.test);
+  }
+  return {
+    ...base,
+    records: rows,
+    filtered: keys,
+    total: rows.length,
+    // A filter that empties a non-empty page is ambiguous — "no record matches"
+    // and "the filter was wrong" look identical to the model, and it picks the
+    // first. Name the difference so it can retry instead of asserting absence.
+    ...rows.length === 0 && base.records.length > 0 ? {
+      warning: `${base.records.length} record(s) were read but the filters ${JSON.stringify(filters)} excluded all of them. Check the filter values against the fields on those records before telling the user nothing exists.`
+    } : {}
+  };
+});
+registerAIToolHandler("proposeImport", async (args, ctx) => {
+  const resolved = resolveKeyedTarget(ctx, args);
+  if ("error" in resolved) return resolved.error;
+  const { target } = resolved;
+  const fileName = typeof args.file === "string" ? args.file : void 0;
+  const digest = resolveAttachmentDigest(fileName);
+  if (!digest) {
+    const names = listAttachmentNames();
+    const other = nonTabularAttachmentNames();
+    return {
+      error: "no_file",
+      message: names.length ? `No readable file called "${fileName ?? ""}". Attached right now: ${names.join(", ")}.` : other.length ? `${other.join(", ")} is attached, but it has no columns \u2014 importing is for spreadsheets and CSVs. If it is a photo or a scan, READ IT: it is in front of you, so answer from what is written on it and use the tool that matches what the user asked for. Do not ask for a CSV.` : "There is no file attached to this conversation. Ask the user to attach a CSV or a spreadsheet."
+    };
+  }
+  const headers = (digest.headers ?? []).filter((h) => h.trim());
+  const fields = (target.entity.fields ?? []).filter(
+    (f) => f.showInForm !== false && !SYSTEM_FIELD_KEYS.has(String(f.key))
+  );
+  const fieldKeys = new Set(fields.map((f) => String(f.key)));
+  const proposed = args.mapping ?? {};
+  const accepted = {};
+  const rejected = [];
+  for (const [column, field] of Object.entries(proposed)) {
+    if (!headers.includes(column)) {
+      rejected.push(`column "${column}" is not in the file`);
+      continue;
+    }
+    if (typeof field !== "string" || !fieldKeys.has(field)) {
+      rejected.push(`"${column}" \u2192 "${String(field)}" is not a field of ${target.label}`);
+      continue;
+    }
+    accepted[column] = field;
+  }
+  const options = [
+    ...fields.map((f) => ({ value: String(f.key), label: f.label ?? String(f.key) }))
+  ];
+  const decision = await requestChatConfirmation({
+    id: `import-${digest.name}`,
+    toolName: "proposeImport",
+    title: `${digest.name} \u2192 ${target.label}`,
+    params: accepted,
+    plane: "client",
+    scope: typeof args.entity === "string" ? args.entity : void 0,
+    scopeLabel: `Importar para ${target.label}`,
+    // One row per column of the FILE, so a column the model skipped is visibly
+    // unmapped instead of silently absent.
+    fields: headers.map((header) => ({
+      key: header,
+      label: header,
+      options,
+      hint: digest.columnTypes?.find((c) => c.name === header)?.note
+    })),
+    partial: true
+  });
+  if (!decision.approved) return { ok: false, cancelled: true, reason: "user_declined" };
+  const mapping = decision.values ?? accepted;
+  const mapped = Object.keys(mapping).length;
+  return {
+    ok: true,
+    file: digest.name,
+    entity: target.label,
+    rows: digest.rowCount,
+    mapping,
+    unmapped: headers.filter((h) => !mapping[h]),
+    ...rejected.length ? { ignoredFromYourProposal: rejected } : {},
+    nextStep: "commitImport",
+    message: `The user confirmed the mapping: ${mapped} of ${headers.length} columns are mapped for ${digest.rowCount ?? "?"} rows. NOW CALL commitImport with this exact mapping to write the rows \u2014 that is the next and final step, and the user is waiting for it. Do not announce it, do not ask again, and do not repeat the mapping back line by line.`
+  };
+});
+registerAIToolHandler("commitImport", async (args, ctx) => {
+  const resolved = resolveKeyedTarget(ctx, args);
+  if ("error" in resolved) return resolved.error;
+  const { target } = resolved;
+  const digest = resolveAttachmentDigest(typeof args.file === "string" ? args.file : void 0);
+  if (!digest) {
+    return {
+      error: "no_file",
+      message: "The file is no longer in this conversation. Ask the user to attach it again."
+    };
+  }
+  const mapping = args.mapping ?? {};
+  const columns = Object.keys(mapping).filter((c) => typeof mapping[c] === "string" && mapping[c]);
+  if (!columns.length) {
+    return {
+      error: "empty_mapping",
+      message: "No column is mapped. Run proposeImport first and pass the mapping it returns."
+    };
+  }
+  const permission = target.entity.permission;
+  if (permission) {
+    const access = checkAccess(permission.feature, "create");
+    if (!access.allowed) return access;
+  }
+  let rows;
+  try {
+    rows = await readAllRows(digest);
+  } catch (error) {
+    return { error: "unreadable", message: error instanceof Error ? error.message : "Could not read the file." };
+  }
+  const records = rows.map((row) => {
+    const record = {};
+    for (const column of columns) {
+      const value = row[column];
+      if (value !== void 0 && value !== "") record[mapping[column]] = value;
+    }
+    return record;
+  }).filter((r) => Object.keys(r).length);
+  if (!records.length) {
+    return { error: "no_rows", message: "Every row is empty under this mapping. Check the column names." };
+  }
+  if (target.entity.limitKey) {
+    const limit = await guardLimit(target.entity.limitKey, records.length);
+    if (!limit.allowed) return limit;
+  }
+  const decision = await requestChatConfirmation({
+    id: `commit-${digest.name}`,
+    toolName: "commitImport",
+    title: `Importar ${records.length} \xD7 ${target.entity.name}`,
+    params: {
+      arquivo: digest.name,
+      registros: records.length,
+      campos: columns.map((c) => `${c} \u2192 ${mapping[c]}`).join(", ")
+    },
+    plane: "client",
+    scope: typeof args.entity === "string" ? args.entity : void 0,
+    scopeLabel: `Importar ${target.label}`
+  });
+  if (!decision.approved) return { ok: false, cancelled: true, reason: "user_declined" };
+  const batchId = `imp-${Date.now().toString(36)}`;
+  const canStamp = (target.entity.fields ?? []).some((f) => String(f.key) === "importBatchId");
+  const provider = resolveDataProvider(target.entity, target.mockData, FRESH);
+  const result = await bulkCreate(
+    provider,
+    canStamp ? records.map((r) => ({ ...r, importBatchId: batchId })) : records,
+    { chunkSize: 200 }
+  );
+  emitDataChanged({
+    table: target.entity.data?.table,
+    entityKey: typeof args.entity === "string" ? args.entity : void 0,
+    archetype: target.entity.data?.archetype,
+    op: "create",
+    source: "agent"
+  });
+  if (target.entity.limitKey) invalidateLimit(target.entity.limitKey);
+  return {
+    ok: result.created > 0,
+    ...canStamp ? { batchId } : {},
+    created: result.created,
+    failed: result.failed.length,
+    // Row numbers, not row contents — the model never needs the data, and a
+    // failure list of 200 rows would swamp the turn.
+    firstErrors: result.failed.slice(0, 5).map((f) => ({ row: f.index + 2, reason: f.message })),
+    message: `${result.created} of ${records.length} rows were created` + (result.failed.length ? `. ${result.failed.length} failed \u2014 tell the user which rows and why, and offer to fix and retry those.` : ". Tell the user it is done.")
+  };
+});
+registerAIToolHandler("queryData", async (args, ctx) => {
+  const resolved = resolveKeyedTarget(ctx, args);
+  if ("error" in resolved) return resolved.error;
+  const { target } = resolved;
+  const metric = args.metric === "sum" || args.metric === "avg" ? args.metric : "count";
+  let field = typeof args.field === "string" ? args.field : void 0;
+  if (metric !== "count" && !field) {
+    return { error: "missing_field", message: `metric "${metric}" needs a "field" to aggregate.` };
+  }
+  const provider = resolveDataProvider(
+    target.entity,
+    target.mockData,
+    FRESH
+  );
+  const dateRange = dateRangeFilter(args);
+  const page = await provider.list({
+    pageSize: 1e3,
+    ...dateRange ? { filters: { [dateRange.field]: dateRange.range } } : {}
+  });
+  let rows = page.data;
+  const sampleRow = rows[0];
+  const availableFields = sampleRow ? Object.keys(sampleRow) : [];
+  const requireField = (name) => {
+    if (!sampleRow) return name;
+    const resolved2 = resolveFieldKey(sampleRow, name);
+    if (resolved2) return resolved2;
+    return {
+      error: "unknown_field",
+      message: `Field "${name}" does not exist on ${target.label}. Use one of the available fields and retry.`,
+      availableFields
+    };
+  };
+  if (dateRange) {
+    const resolved2 = requireField(dateRange.field);
+    if (typeof resolved2 !== "string") return resolved2;
+    rows = rows.filter((r) => matchesRange(r[resolved2], dateRange.range));
+  }
+  const filters = args.filters ?? {};
+  for (const [k, v] of Object.entries(filters)) {
+    if (!sampleRow) break;
+    const f = resolveFilter(sampleRow, target.label, k, v);
+    if ("error" in f) return f;
+    rows = rows.filter(f.test);
+  }
+  const aggregate = (subset) => {
+    if (metric === "count") return subset.length;
+    const values = subset.map((r) => Number(r[field])).filter((n) => !Number.isNaN(n));
+    const sum = values.reduce((a, b) => a + b, 0);
+    if (metric === "sum") return Math.round(sum * 100) / 100;
+    return values.length ? Math.round(sum / values.length * 100) / 100 : 0;
+  };
+  if (field && rows[0]) {
+    const resolved2 = resolveFieldKey(rows[0], field);
+    if (!resolved2) {
+      return {
+        error: "unknown_field",
+        message: `Field "${field}" does not exist on ${target.label}. Use one of the available fields and retry.`,
+        availableFields
+      };
+    }
+    field = resolved2;
+  }
+  let groupBy = typeof args.groupBy === "string" ? args.groupBy : void 0;
+  if (groupBy && rows[0]) {
+    const resolved2 = resolveFieldKey(rows[0], groupBy);
+    if (!resolved2) {
+      return {
+        error: "unknown_field",
+        message: `Field "${groupBy}" does not exist on ${target.label}. Use one of the available fields and retry.`,
+        availableFields
+      };
+    }
+    groupBy = resolved2;
+  }
+  const sampled = page.total > page.data.length;
+  if (groupBy) {
+    const groups = /* @__PURE__ */ new Map();
+    for (const r of rows) {
+      const g = String(r[groupBy] ?? "\u2014");
+      if (!groups.has(g)) groups.set(g, []);
+      groups.get(g).push(r);
+    }
+    const labelKey = groupBy.endsWith("Id") ? resolveFieldKey(rows[0] ?? {}, groupBy.slice(0, -2) + "Name") : null;
+    return {
+      entity: target.label,
+      metric,
+      ...field ? { field } : {},
+      groupBy,
+      groups: Array.from(groups.entries()).map(([group, subset]) => ({
+        group,
+        ...labelKey && subset[0] ? { label: subset[0][labelKey] } : {},
+        value: aggregate(subset),
+        rows: subset.length
+      })).sort((a, b) => Number(b.value) - Number(a.value)),
+      matchedRows: rows.length,
+      sampled
+    };
+  }
+  return {
+    entity: target.label,
+    metric,
+    ...field ? { field } : {},
+    value: aggregate(rows),
+    matchedRows: rows.length,
+    sampled
+  };
+});
+function buildAgentToolset(tools, { dataTools, activePluginId, pinned, loaded, maxTools = MAX_TOOLS_PER_TURN }) {
+  const executable = tools.filter(
+    (t) => handlers.has(t.name) || dataTools.has(t.name) || t.execution?.plane === "server" && t.execution.kind === "rpc"
+  );
+  const ofPlugin = (t) => !!activePluginId && t.id.startsWith(`${activePluginId}.`);
+  const CORE_PINNED = /* @__PURE__ */ new Set([...ALWAYS_ON_TOOLS, "findTools"]);
+  const pinnedBand = executable.filter((t) => pinned?.has(t.name)).sort((a, b) => (CORE_PINNED.has(a.name) ? 0 : 1) - (CORE_PINNED.has(b.name) ? 0 : 1));
+  const ranked = pinned ? [
+    ...pinnedBand,
+    ...executable.filter((t) => !pinned.has(t.name) && loaded?.has(t.name)),
+    ...executable.filter((t) => !pinned.has(t.name) && !loaded?.has(t.name) && ofPlugin(t))
+  ] : activePluginId ? [...executable.filter(ofPlugin), ...executable.filter((t) => !ofPlugin(t))] : executable;
+  return ranked.slice(0, maxTools).map((tool) => ({
+    name: tool.name,
+    description: tool.description,
+    parameters: tool.parameters
+  }));
+}
+async function resolveTeamRows(ctx) {
+  if (ctx.loadTeam) {
+    const team = await ctx.loadTeam();
+    return team.map((p) => ({
+      name: p.name ?? null,
+      kind: p.kind,
+      email: p.email ?? null,
+      accessRole: p.membership?.profileName ?? null,
+      hasLogin: !!p.membership
+    }));
+  }
+  return ctx.members.map((m) => ({
+    name: m.user?.fullName ?? null,
+    email: m.user?.email ?? null,
+    accessRole: m.profileName ?? null,
+    hasLogin: true
+  }));
+}
+registerAIToolHandler("getBusinessSummary", async (_args, ctx) => {
+  if (!ctx.currentOrg) return { error: "no_active_business" };
+  const org = ctx.currentOrg;
+  return {
+    name: org.name,
+    slug: org.slug,
+    plan: org.plan ?? null,
+    vertical: org.verticalId ?? null,
+    teamSize: (await resolveTeamRows(ctx)).length,
+    createdAt: org.createdAt ?? null
+  };
+});
+registerAIToolHandler("getTeamMembers", async (args, ctx) => {
+  const filter = typeof args.role === "string" ? args.role.trim().toLowerCase() : void 0;
+  const rows = await resolveTeamRows(ctx);
+  const members = filter ? rows.filter(
+    (r) => String(r.kind ?? "").toLowerCase() === filter || String(r.accessRole ?? "").toLowerCase() === filter
+  ) : rows;
+  return { total: members.length, members };
+});
+registerAIToolHandler("navigateTo", (args, ctx) => {
+  const query = typeof args.page === "string" ? args.page.trim().toLowerCase() : "";
+  if (!query) return { error: "missing_page" };
+  const match = ctx.routes.find((r) => r.path.toLowerCase() === query || r.path.toLowerCase() === `/${query}`) ?? ctx.routes.find((r) => (r.label ?? "").toLowerCase() === query) ?? ctx.routes.find((r) => {
+    const label = (r.label ?? "").toLowerCase();
+    return !!label && (label.startsWith(query) || query.startsWith(label));
+  });
+  if (!match) {
+    return {
+      error: "page_not_found",
+      message: "No page matches that. If the user meant a specific record, look it up and call openRecord with its id.",
+      availablePages: ctx.routes.map((r) => r.label ?? r.path)
+    };
+  }
+  ctx.navigate(match.path);
+  revealPage();
+  return { navigatedTo: match.path, label: match.label ?? match.path };
+});
+registerAIToolHandler("openRecord", async (args, ctx) => {
+  const id = typeof args.id === "string" ? args.id.trim() : "";
+  if (!id) return { error: "missing_id", message: "Provide the record id returned by an earlier tool." };
+  if (ctx.currentPath.includes(id)) {
+    return {
+      alreadyOpen: true,
+      message: "This record is already the page the user is looking at \u2014 nothing to navigate. To talk about it, read it with searchRecords filtered by this id."
+    };
+  }
+  const ref = lookupRecordRef(id);
+  if (!ref) {
+    return {
+      error: "unknown_record",
+      message: "That id was not seen in this conversation. Search for the record first, then call openRecord with the id from the result."
+    };
+  }
+  if (!resolveEntityRoute(ref.archetype, ref.kind, ref.entityKey)) {
+    return { error: "no_page_for_record", message: `This app has no page for ${ref.label}.` };
+  }
+  openEntity(id, ref.archetype, ref.kind, void 0, ref.entityKey);
+  revealPage();
+  return { opened: ref.label, ref: { id, label: ref.label, archetype: ref.archetype } };
+});
+function validateGrants(features, raw) {
+  const known = new Set(features.map((f) => f.id));
+  const grants = {};
+  const rejected = [];
+  const isAction = (a) => PROFILE_ACTIONS.includes(a);
+  for (const [featureId, value] of Object.entries(raw ?? {})) {
+    if (!known.has(featureId)) {
+      rejected.push(`${featureId}: not an area of this app`);
+      continue;
+    }
+    const asked = (Array.isArray(value) ? value : [value]).map((a) => String(a).trim().toLowerCase());
+    const unknown = asked.filter((a) => !isAction(a));
+    if (unknown.length) rejected.push(`${featureId}: unknown action(s) ${unknown.join(", ")}`);
+    const actions = asked.filter(isAction);
+    if (actions.length) grants[featureId] = actions;
+  }
+  return { grants, rejected };
+}
+registerAIToolHandler("createPermissionProfile", async (args, ctx) => {
+  const profile = usePermissionsStore.getState().currentProfile;
+  if (!profileHasSystemPermission(profile, "manage_permissions")) {
+    return {
+      error: "forbidden",
+      message: "This user cannot manage permissions. Say so \u2014 do not try another tool."
+    };
+  }
+  if (!ctx.orgAdapter?.createProfile || !ctx.currentOrg) {
+    return {
+      error: "not_executable",
+      message: "This app has no permission-profile store wired. Tell the user to create the profile in Settings \u2192 Permissions."
+    };
+  }
+  const name = typeof args.name === "string" ? args.name.trim() : "";
+  if (!name) return { error: "missing_name", message: "Give the profile a name." };
+  const features = usePermissionsStore.getState().features;
+  const byId = new Map(features.map((f) => [f.id, f]));
+  const { grants, rejected } = validateGrants(features, args.grants);
+  if (!Object.keys(grants).length) {
+    return {
+      error: "empty_grants",
+      message: `No valid area was granted. Use the ids from the tool's area list and the actions ${PROFILE_ACTIONS.join("/")}.`,
+      ...rejected.length ? { rejected } : {},
+      availableAreas: features.map((f) => f.id)
+    };
+  }
+  const existing = usePermissionsStore.getState().profiles;
+  const clash = existing.find((p) => p.name.trim().toLowerCase() === name.toLowerCase());
+  if (clash) {
+    return {
+      error: "name_taken",
+      message: `A profile named "${clash.name}" already exists. Ask the user for a different name, or whether they meant to change that one (which happens in Settings \u2192 Permissions).`
+    };
+  }
+  const summary = describeGrants(grants, byId);
+  const decision = await requestChatConfirmation({
+    id: `permission-profile-${Date.now()}`,
+    toolName: "createPermissionProfile",
+    title: `Criar perfil de acesso: ${name}`,
+    params: {
+      nome: name,
+      ...typeof args.description === "string" && args.description.trim() ? { descri\u00E7\u00E3o: args.description.trim() } : {},
+      acessos: summary
+    },
+    plane: "client",
+    noAutoApproval: true
+  });
+  if (!decision.approved) return { ok: false, cancelled: true, reason: "user_declined" };
+  const finalName = typeof decision.values?.nome === "string" && decision.values.nome.trim() ? decision.values.nome.trim() : name;
+  const finalDescription = typeof decision.values?.["descri\xE7\xE3o"] === "string" ? decision.values["descri\xE7\xE3o"].trim() || void 0 : typeof args.description === "string" && args.description.trim() ? args.description.trim() : void 0;
+  let created;
+  try {
+    created = await ctx.orgAdapter.createProfile(ctx.currentOrg.id, {
+      name: finalName,
+      description: finalDescription,
+      grants
+    });
+  } catch (error) {
+    return {
+      error: "create_failed",
+      message: `The profile could not be saved: ${describeThrown(error)}. Report this to the user \u2014 do not retry.`
+    };
+  }
+  if (ctx.orgAdapter.listProfiles) {
+    try {
+      usePermissionsStore.getState().setProfiles(await ctx.orgAdapter.listProfiles(ctx.currentOrg.id));
+    } catch {
+    }
+  }
+  return {
+    ok: true,
+    profile: { id: created.id, name: created.name },
+    grants: summary,
+    ...rejected.length ? { rejectedFromYourProposal: rejected } : {},
+    message: "Profile created. Summarise for the user WHAT IT CAN REACH using the labels in `grants`, then say the profile is assigned to people on the Team screen. The link to review it is already in the reply.",
+    ref: { id: created.id, label: created.name, path: PERMISSIONS_PATH }
+  };
+});
+registerAIToolHandler("updatePermissionProfile", async (args, ctx) => {
+  const actor = usePermissionsStore.getState().currentProfile;
+  if (!profileHasSystemPermission(actor, "manage_permissions")) {
+    return {
+      error: "forbidden",
+      message: "This user cannot manage permissions. Say so \u2014 do not try another tool."
+    };
+  }
+  if (!ctx.orgAdapter?.updateProfile || !ctx.currentOrg) {
+    return {
+      error: "not_executable",
+      message: "This app cannot change profiles from here. Tell the user to edit it in Settings \u2192 Permissions."
+    };
+  }
+  const id = typeof args.id === "string" ? args.id.trim() : "";
+  const { features, profiles } = usePermissionsStore.getState();
+  const target = profiles.find((p) => p.id === id);
+  if (!target) {
+    return {
+      error: "unknown_profile",
+      message: `No profile with id "${id}". Existing: ${profiles.map((p) => `${p.id} (${p.name})`).join(", ")}.`
+    };
+  }
+  if (target.isSystem) {
+    return {
+      error: "system_profile",
+      message: `"${target.name}" is a built-in role and cannot be changed. Offer to create a new profile based on it instead (createPermissionProfile).`
+    };
+  }
+  const byId = new Map(features.map((f) => [f.id, f]));
+  const { grants: setAreas, rejected } = validateGrants(features, args.grants);
+  const revoke = (Array.isArray(args.revoke) ? args.revoke : []).map((a) => String(a).trim()).filter(Boolean);
+  const before = target.grants ?? {};
+  const next = { ...before, ...setAreas };
+  for (const area of revoke) {
+    if (!(area in next)) rejected.push(`${area}: was not granted, nothing to revoke`);
+    delete next[area];
+  }
+  const rename = typeof args.name === "string" && args.name.trim() && args.name.trim() !== target.name ? args.name.trim() : void 0;
+  const redescribe = typeof args.description === "string" && args.description.trim() !== (target.description ?? "") ? args.description.trim() : void 0;
+  const same = (a, b) => !!a && !!b && a.length === b.length && a.every((x) => b.includes(x));
+  const untouched = Object.keys(next).length === Object.keys(before).length && Object.keys(next).every((k) => same(next[k], before[k]));
+  if (untouched && !rename && redescribe === void 0) {
+    return {
+      error: "no_change",
+      message: "That would leave the profile exactly as it is. Tell the user what it already has instead of writing it again.",
+      current: describeGrants(before, byId),
+      ...rejected.length ? { rejectedFromYourProposal: rejected } : {}
+    };
+  }
+  const rows = [];
+  for (const area of Object.keys(next)) {
+    const label = byId.get(area)?.label ?? area;
+    const now = (next[area] ?? []).map((a) => ACTION_LABELS[a] ?? a).join(", ");
+    if (!(area in before)) rows.push({ label, type: `${now} (novo)` });
+    else if (!same(next[area], before[area])) {
+      const was = (before[area] ?? []).map((a) => ACTION_LABELS[a] ?? a).join(", ");
+      rows.push({ label, type: `${now} (antes: ${was})` });
+    } else rows.push({ label, type: now });
+  }
+  for (const area of Object.keys(before)) {
+    if (!(area in next)) rows.push({ label: byId.get(area)?.label ?? area, type: "REMOVIDO" });
+  }
+  const decision = await requestChatConfirmation({
+    id: `permission-profile-update-${Date.now()}`,
+    toolName: "updatePermissionProfile",
+    title: `Alterar perfil de acesso: ${rename ?? target.name}`,
+    params: {
+      perfil: target.name,
+      ...rename ? { "novo nome": rename } : {},
+      ...redescribe !== void 0 ? { descri\u00E7\u00E3o: redescribe } : {},
+      acessos: rows
+    },
+    plane: "client",
+    noAutoApproval: true
+  });
+  if (!decision.approved) return { ok: false, cancelled: true, reason: "user_declined" };
+  const finalName = typeof decision.values?.["novo nome"] === "string" && decision.values["novo nome"] ? decision.values["novo nome"].trim() : rename;
+  try {
+    await ctx.orgAdapter.updateProfile(ctx.currentOrg.id, target.id, {
+      ...finalName ? { name: finalName } : {},
+      ...redescribe !== void 0 ? { description: redescribe || void 0 } : {},
+      grants: next
+    });
+  } catch (error) {
+    return {
+      error: "update_failed",
+      message: `The profile could not be saved: ${describeThrown(error)}. Report this to the user \u2014 do not retry.`
+    };
+  }
+  if (ctx.orgAdapter.listProfiles) {
+    try {
+      usePermissionsStore.getState().setProfiles(await ctx.orgAdapter.listProfiles(ctx.currentOrg.id));
+    } catch {
+    }
+  }
+  return {
+    ok: true,
+    profile: { id: target.id, name: finalName ?? target.name },
+    grants: describeGrants(next, byId),
+    ...rejected.length ? { rejectedFromYourProposal: rejected } : {},
+    message: "Profile updated. Tell the user WHAT CHANGED and what the profile can reach now, using the labels in `grants` \u2014 not the ids. The link to review it is already in the reply.",
+    ref: { id: target.id, label: finalName ?? target.name, path: PERMISSIONS_PATH }
+  };
+});
+function describeGrants(grants, byId) {
+  return Object.entries(grants).map(([featureId, actions]) => ({
+    label: byId.get(featureId)?.label ?? featureId,
+    type: actions.map((a) => ACTION_LABELS[a] ?? a).join(", ")
+  }));
+}
+var PERMISSIONS_PATH = "/settings/permissions";
+var ACTION_LABELS = {
+  read: "ver",
+  create: "criar",
+  edit: "editar",
+  delete: "excluir"
+};
+async function executeRpcTool(rpcName, args, userId) {
+  const supabase = getSupabaseClientOptional();
+  const tenantId = getActiveTenantId();
+  if (!supabase?.rpc || !tenantId || !userId) {
+    return errorResult("not_executable", "No authenticated session/tenant available for this action.");
+  }
+  const { data, error } = await supabase.rpc(rpcName, {
+    p_tenant_id: tenantId,
+    p_actor_user_id: userId,
+    p_payload: args
+  });
+  if (error) return errorResult("execution_failed", error.message);
+  return { ok: true, content: JSON.stringify(data ?? { ok: true }) };
+}
+registerAIToolHandler(
+  "findTools",
+  (args, ctx) => resolveToolSearch(args, ctx.searchableTools ?? [], new Set(ctx.carriedTools ?? []))
+);
+function useAgentSurface(contribution) {
+  const ref = React.useRef(contribution);
+  ref.current = contribution;
+  const id = contribution.id;
+  React.useEffect(() => {
+    registerSurface({ id, get: () => ref.current });
+    const names = (ref.current.tools ?? []).map((t) => t.tool.name);
+    for (const name of names) {
+      registerAIToolHandler(name, (args) => {
+        const entry = ref.current.tools?.find((t) => t.tool.name === name);
+        if (!entry) return { error: "tool_unmounted", message: "That surface is no longer open." };
+        return entry.execute(args);
+      });
+    }
+    return () => {
+      unregisterSurface(id);
+      for (const name of names) unregisterAIToolHandler(name);
+    };
+  }, [id]);
+}
+var HANDOFF_ID = ASK_AI_HANDOFF_ID;
+var releaseIntro = null;
+function borrowIntro(intro, placeholder) {
+  const store = useAssistantInviteStore.getState();
+  const previous = store.invite?.id === HANDOFF_ID ? null : store.invite ?? null;
+  if (previous || !releaseIntro) {
+    releaseIntro = () => {
+      if (useAssistantInviteStore.getState().invite?.id === HANDOFF_ID) {
+        useAssistantInviteStore.getState().setInvite(previous);
+      }
+      releaseIntro = null;
+    };
+  }
+  const def = {
+    id: HANDOFF_ID,
+    ...intro.role ? { role: intro.role } : {},
+    persona: intro.persona,
+    headline: intro.pitch,
+    pitch: intro.pitch,
+    description: intro.description,
+    placeholder,
+    suggestions: intro.suggestions,
+    // Never the hero takeover: the user asked for the assistant from a screen
+    // they are still looking at, and covering it would be answering a question
+    // they did not ask.
+    auto: false
+  };
+  store.setInvite(def);
+}
+function releaseOnClose() {
+  const stop = useChatStore.subscribe((state, previous) => {
+    if (previous.isOpen && !state.isOpen) {
+      releaseIntro?.();
+      stop();
+    }
+  });
+}
+function askAI({ hint, prompt, draft, media, intro } = {}) {
+  const chat = useChatStore.getState();
+  chat.setComposerHint(hint ?? null);
+  chat.requestComposerFocus();
+  if (media) chat.attachMedia(media);
+  if (draft) chat.setDraft(draft);
+  if (intro) {
+    borrowIntro(intro, hint);
+    releaseOnClose();
+  }
+  if (prompt) chat.queuePrompt(prompt);
+  else chat.setOpen(true);
+}
+function AskAIMenuItem({
+  hint,
+  prompt,
+  draft,
+  media,
+  intro,
+  label,
+  description,
+  onHandoff
+}) {
+  const t = useTranslation();
+  return /* @__PURE__ */ jsxs(
+    DropdownItem,
+    {
+      onSelect: () => {
+        askAI({ hint, prompt, draft, media, intro });
+        onHandoff?.();
+      },
+      className: "fz-ai-action items-start gap-2 py-2",
+      children: [
+        /* @__PURE__ */ jsx(WandSparkles, { className: "mt-0.5 h-3.5 w-3.5 shrink-0" }),
+        /* @__PURE__ */ jsxs("span", { className: "min-w-0", children: [
+          /* @__PURE__ */ jsx("span", { className: "block font-medium", children: label ?? t("assistant.askAI") }),
+          description ? /* @__PURE__ */ jsx("span", { className: "block text-xs font-normal opacity-70", children: description }) : null
+        ] })
+      ]
+    }
+  );
+}
+function AskAIButton({
+  hint,
+  prompt,
+  draft,
+  media,
+  intro,
+  label,
+  onHandoff,
+  size = "sm",
+  variant = "default",
+  className,
+  disabled
+}) {
+  const t = useTranslation();
+  return /* @__PURE__ */ jsxs(
+    Button,
+    {
+      type: "button",
+      size,
+      variant,
+      className,
+      disabled,
+      onClick: () => {
+        askAI({ hint, prompt, draft, media, intro });
+        onHandoff?.();
+      },
+      children: [
+        /* @__PURE__ */ jsx(WandSparkles, { className: "mr-1.5 h-3.5 w-3.5" }),
+        label ?? t("assistant.askAI")
+      ]
+    }
+  );
+}
+function DeleteConfirmDialog({ open, onClose, onConfirm, entityName, displayValue, mode = "delete" }) {
+  const t = useTranslation();
+  const soft = mode === "deactivate";
+  const key = (suffix) => soft ? `crud.deactivate.${suffix}` : `crud.delete.${suffix}`;
+  return /* @__PURE__ */ jsx(Modal, { open, onOpenChange: (isOpen) => {
+    if (!isOpen) onClose();
+  }, children: /* @__PURE__ */ jsxs(ModalContent, { children: [
+    /* @__PURE__ */ jsxs(ModalHeader, { children: [
+      /* @__PURE__ */ jsx(ModalTitle, { children: t(key("title"), { entity: entityName }) }),
+      /* @__PURE__ */ jsx(ModalDescription, { children: displayValue ? t(key("confirmNamed"), { displayValue }) : t(key("confirmGeneric"), { entity: entityName.toLowerCase() }) })
+    ] }),
+    /* @__PURE__ */ jsxs(ModalFooter, { children: [
+      /* @__PURE__ */ jsx(Button, { variant: "outline", onClick: onClose, children: t("common.cancel") }),
+      /* @__PURE__ */ jsx(Button, { variant: soft ? "default" : "destructive", onClick: onConfirm, children: soft ? t("crud.deactivate.action") : t("common.delete") })
+    ] })
+  ] }) });
+}
+
+export { ASK_AI_HANDOFF_ID, AskAIButton, AskAIMenuItem, DeleteConfirmDialog, askAI, buildAgentToolset, buildDataToolIndex, executeAITool, executeRpcTool, getActiveSurfaceContext, getSurfaceTools, getSurfaceVersion, hasAIToolHandler, registerAIToolHandler, revealPage, subscribeSurfaces, unregisterAIToolHandler, useAgentSurface, useAssistantInviteStore };
+//# sourceMappingURL=chunk-6QFOE3UD.js.map
+//# sourceMappingURL=chunk-6QFOE3UD.js.map