@harborclient/team-hub 0.2.4 → 0.4.0

package/dist/cli.js

@@ -25,6 +25,35 @@ import path from "path";
 import { parse as parseYaml } from "yaml";
 
 // src/config/llmConfig.ts
+function headerRowsFromSingleKeyObject(record) {
+  const rows = [];
+  for (const [key, value] of Object.entries(record)) {
+    const trimmedKey = key.trim();
+    if (trimmedKey.length > 0) {
+      rows.push({ key: trimmedKey, value: String(value) });
+    }
+  }
+  return rows;
+}
+function normalizeHubMcpHeaders(headers) {
+  if (!headers) {
+    return [];
+  }
+  if (!Array.isArray(headers)) {
+    return headerRowsFromSingleKeyObject(headers);
+  }
+  const rows = [];
+  for (const item of headers) {
+    if (Array.isArray(item)) {
+      for (const nested of item) {
+        rows.push(...headerRowsFromSingleKeyObject(nested));
+      }
+      continue;
+    }
+    rows.push(...headerRowsFromSingleKeyObject(item));
+  }
+  return rows;
+}
 function normalizeLlmConfig(section) {
   const providers = {};
   if (section.providers.openai?.apiKey) {
@@ -36,9 +65,15 @@ function normalizeLlmConfig(section) {
   if (section.providers.gemini?.apiKey) {
     providers.gemini = { apiKey: section.providers.gemini.apiKey };
   }
+  const mcp = section.mcp && section.mcp.length > 0 ? section.mcp.map((entry) => ({
+    name: entry.name.trim(),
+    url: entry.url.trim().replace(/\/+$/, ""),
+    headers: normalizeHubMcpHeaders(entry.headers)
+  })) : void 0;
   return {
     providers,
-    ...section.models && section.models.length > 0 ? { models: section.models } : {}
+    ...section.models && section.models.length > 0 ? { models: section.models } : {},
+    ...mcp && mcp.length > 0 ? { mcp } : {}
   };
 }
 
@@ -116,6 +151,15 @@ var redisSectionSchema = z.object({
 var llmProviderEntrySchema = z.object({
   apiKey: z.string().trim().min(1, { message: "LLM provider apiKey must not be empty." })
 });
+var hubMcpHeadersSchema = z.union([
+  z.record(z.string(), z.string()),
+  z.array(z.union([z.record(z.string(), z.string()), z.array(z.record(z.string(), z.string()))]))
+]);
+var hubMcpServerEntrySchema = z.object({
+  name: z.string().trim().min(1),
+  url: z.string().trim().min(1),
+  headers: hubMcpHeadersSchema.optional()
+});
 var llmSectionSchema = z.object({
   providers: z.object({
     openai: llmProviderEntrySchema.optional(),
@@ -125,7 +169,8 @@ var llmSectionSchema = z.object({
     (providers) => Boolean(providers.openai?.apiKey || providers.claude?.apiKey || providers.gemini?.apiKey),
     { message: "llm.providers must include at least one provider with an apiKey." }
   ),
-  models: z.array(z.string().trim().min(1)).optional()
+  models: z.array(z.string().trim().min(1)).optional(),
+  mcp: z.array(hubMcpServerEntrySchema).optional()
 });
 var pluginsSectionSchema = z.object({
   catalogs: z.array(z.string().trim().url()).optional(),
@@ -313,6 +358,7 @@ var USERS_COLLECTION = "users";
 var API_TOKENS_COLLECTION = "apiTokens";
 var COLLECTIONS_COLLECTION = "collections";
 var ENVIRONMENTS_COLLECTION = "environments";
+var SNIPPETS_COLLECTION = "snippets";
 var FOLDERS_COLLECTION = "folders";
 var REQUESTS_COLLECTION = "requests";
 var AUDIT_LOG_COLLECTION = "auditLog";
@@ -339,7 +385,8 @@ function createSystemUserInput() {
     name: SYSTEM_USER_NAME,
     role: "admin",
     collectionAccess: [],
-    environmentAccess: []
+    environmentAccess: [],
+    snippetAccess: []
   };
 }
 
@@ -353,7 +400,7 @@ var firestoreConfigSchema = z2.object({
 
 // src/db/firestore/utils.ts
 function parseAuditEntityType(value) {
-  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "folder" || value === "request") {
+  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -382,6 +429,7 @@ function mapFirestoreUser(id, data) {
     role: data.role,
     collectionAccess: data.collectionAccess,
     environmentAccess: data.environmentAccess,
+    snippetAccess: data.snippetAccess ?? [],
     llmAccess: data.llmAccess ?? false,
     llmModels: data.llmModels ?? [],
     llmMonthlyTokenLimit: data.llmMonthlyTokenLimit ?? null,
@@ -447,6 +495,20 @@ function mapFirestoreEnvironment(id, data) {
     deletionLocked: data.deletionLocked ?? false
   };
 }
+function mapFirestoreSnippet(id, data) {
+  return {
+    id,
+    name: data.name,
+    code: data.code,
+    scope: data.scope,
+    sortOrder: data.sortOrder,
+    createdAt: data.createdAt,
+    updatedAt: data.updatedAt ?? data.createdAt,
+    createdByUserId: data.createdByUserId ?? null,
+    updatedByUserId: data.updatedByUserId ?? null,
+    deletionLocked: data.deletionLocked ?? false
+  };
+}
 function mapFirestoreFolder(id, data) {
   return {
     id,
@@ -654,6 +716,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
   async migrate() {
     await this.ensureSystemUser();
     await this.migrateOrphanTokensToBootstrapUser();
+    await this.migrateSnippetAccessBackfill();
   }
   /**
    * Returns the stable identifier of the internal system user, when provisioned.
@@ -700,6 +763,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       role: input.role,
       collectionAccess: input.collectionAccess,
       environmentAccess: input.environmentAccess,
+      snippetAccess: input.snippetAccess,
       llmAccess: input.llmAccess ?? false,
       llmModels: input.llmModels ?? [],
       llmMonthlyTokenLimit: input.llmMonthlyTokenLimit ?? null,
@@ -771,6 +835,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
     const role = input.role ?? existing.role;
     const collectionAccess = input.collectionAccess ?? existing.collectionAccess;
     const environmentAccess = input.environmentAccess ?? existing.environmentAccess;
+    const snippetAccess = input.snippetAccess ?? existing.snippetAccess;
     const llmAccess = input.llmAccess ?? existing.llmAccess;
     const llmModels = input.llmModels ?? existing.llmModels;
     const llmMonthlyTokenLimit = input.llmMonthlyTokenLimit !== void 0 ? input.llmMonthlyTokenLimit : existing.llmMonthlyTokenLimit;
@@ -780,6 +845,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       role,
       collectionAccess,
       environmentAccess,
+      snippetAccess,
       llmAccess,
       llmModels,
       llmMonthlyTokenLimit,
@@ -834,7 +900,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
           name: BOOTSTRAP_USER_NAME,
           role: "user",
           collectionAccess: ["*"],
-          environmentAccess: ["*"]
+          environmentAccess: ["*"],
+          snippetAccess: ["*"]
         },
         systemUserId
       );
@@ -848,6 +915,37 @@ var FirestoreDatabase = class _FirestoreDatabase {
       await batch.commit();
     }
   }
+  /**
+   * Grants wildcard snippet access to user accounts that already have wildcard collection access.
+   */
+  async migrateSnippetAccessBackfill() {
+    const client = this.requireClient();
+    const snapshot = await client.collection(USERS_COLLECTION).where("role", "==", "user").get();
+    if (snapshot.docs.length === 0) {
+      return;
+    }
+    let batch = client.batch();
+    let batchSize = 0;
+    for (const doc of snapshot.docs) {
+      const data = doc.data();
+      if ((data.snippetAccess?.length ?? 0) > 0) {
+        continue;
+      }
+      if (!data.collectionAccess?.includes("*")) {
+        continue;
+      }
+      batch.update(doc.ref, { snippetAccess: ["*"] });
+      batchSize += 1;
+      if (batchSize >= WRITE_BATCH_LIMIT) {
+        await batch.commit();
+        batch = client.batch();
+        batchSize = 0;
+      }
+    }
+    if (batchSize > 0) {
+      await batch.commit();
+    }
+  }
   /**
    * Inserts a new API token document.
    *
@@ -1205,6 +1303,129 @@ var FirestoreDatabase = class _FirestoreDatabase {
       updatedByUserId: actingUserId
     });
   }
+  /**
+   * Lists all snippets ordered by sort order then name.
+   */
+  async listSnippets() {
+    const snapshot = await this.requireClient().collection(SNIPPETS_COLLECTION).get();
+    return snapshot.docs.map((doc) => mapFirestoreSnippet(doc.id, doc.data())).sort((left, right) => {
+      if (left.sortOrder !== right.sortOrder) {
+        return left.sortOrder - right.sortOrder;
+      }
+      return left.name.localeCompare(right.name);
+    });
+  }
+  /**
+   * Creates a new snippet with the given fields.
+   *
+   * @param name - Display name for the snippet.
+   * @param code - JavaScript source for the snippet.
+   * @param scope - Execution scope for the snippet.
+   * @param actingUserId - User performing the create action.
+   */
+  async createSnippet(name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const id = randomUUID2();
+    const now = /* @__PURE__ */ new Date();
+    const existing = await this.listSnippets();
+    const maxOrder = existing.reduce((max, snippet) => Math.max(max, snippet.sortOrder), -1);
+    const data = {
+      name: trimmedName,
+      code,
+      scope,
+      sortOrder: maxOrder + 1,
+      createdAt: now,
+      updatedAt: now,
+      createdByUserId: actingUserId,
+      updatedByUserId: actingUserId,
+      deletionLocked: false
+    };
+    await this.requireClient().collection(SNIPPETS_COLLECTION).doc(id).set(data);
+    await this.recordAuditEntry(actingUserId, "create", "snippet", id);
+    return mapFirestoreSnippet(id, data);
+  }
+  /**
+   * Updates a snippet's name, code, and scope. Sort order is left unchanged.
+   *
+   * @param actingUserId - User performing the update action.
+   */
+  async updateSnippet(id, name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const docRef = this.requireClient().collection(SNIPPETS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Snippet not found");
+    }
+    const existing = snapshot.data();
+    const updated = {
+      ...existing,
+      name: trimmedName,
+      code,
+      scope,
+      updatedAt,
+      updatedByUserId: actingUserId
+    };
+    await docRef.update({
+      name: trimmedName,
+      code,
+      scope,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    return mapFirestoreSnippet(id, updated);
+  }
+  /**
+   * Deletes a snippet.
+   *
+   * @param id - Snippet ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteSnippet(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "snippet", id);
+    await this.requireClient().collection(SNIPPETS_COLLECTION).doc(id).delete();
+  }
+  /**
+   * Finds a snippet by stable identifier.
+   *
+   * @param id - Snippet ID to look up.
+   */
+  async findSnippetById(id) {
+    const snapshot = await this.requireClient().collection(SNIPPETS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreSnippet(id, snapshot.data());
+  }
+  /**
+   * Updates whether non-admin users may delete a snippet.
+   *
+   * @param id - Snippet ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the snippet.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setSnippetDeletionLocked(id, deletionLocked, actingUserId) {
+    const docRef = this.requireClient().collection(SNIPPETS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Snippet not found");
+    }
+    const updatedAt = /* @__PURE__ */ new Date();
+    await docRef.update({
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const existing = snapshot.data();
+    return mapFirestoreSnippet(id, {
+      ...existing,
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -1671,6 +1892,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       role: input.role,
       collectionAccess: input.collectionAccess,
       environmentAccess: input.environmentAccess,
+      snippetAccess: input.snippetAccess,
       llmAccess: false,
       llmModels: [],
       llmMonthlyTokenLimit: null,
@@ -1754,7 +1976,7 @@ function parseAuditAction(value) {
   throw new Error(`Invalid audit action: ${value}`);
 }
 function parseAuditEntityType2(value) {
-  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "folder" || value === "request") {
+  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -1831,6 +2053,26 @@ function mapEnvironmentSqlRow(row) {
     deletionLocked: Boolean(row.deletion_locked)
   };
 }
+function parseSnippetScope(value) {
+  if (value === "pre-request" || value === "post-request" || value === "any") {
+    return value;
+  }
+  throw new Error(`Invalid snippet scope: ${value}`);
+}
+function mapSnippetSqlRow(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    code: row.code,
+    scope: parseSnippetScope(row.scope),
+    sortOrder: row.sort_order,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at ?? row.created_at,
+    createdByUserId: row.created_by_user_id ?? null,
+    updatedByUserId: row.updated_by_user_id ?? null,
+    deletionLocked: Boolean(row.deletion_locked)
+  };
+}
 function mapFolderSqlRow(row) {
   return {
     id: row.id,
@@ -1915,6 +2157,22 @@ CREATE TABLE IF NOT EXISTS environments (
   FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
 )
 `.trim();
+var SNIPPETS_MIGRATION_SQL = `
+CREATE TABLE IF NOT EXISTS snippets (
+  id VARCHAR(36) PRIMARY KEY,
+  name VARCHAR(255) NOT NULL,
+  code LONGTEXT NOT NULL,
+  scope VARCHAR(32) NOT NULL DEFAULT 'any',
+  sort_order INT NOT NULL DEFAULT 0,
+  created_at DATETIME NOT NULL,
+  updated_at DATETIME NOT NULL,
+  created_by_user_id VARCHAR(36) NULL,
+  updated_by_user_id VARCHAR(36) NULL,
+  deletion_locked TINYINT(1) NOT NULL DEFAULT 0,
+  FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE SET NULL,
+  FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
+)
+`.trim();
 var FOLDERS_MIGRATION_SQL = `
 CREATE TABLE IF NOT EXISTS folders (
   id VARCHAR(36) PRIMARY KEY,
@@ -1964,6 +2222,7 @@ CREATE TABLE IF NOT EXISTS users (
   role VARCHAR(16) NOT NULL,
   collection_access LONGTEXT NOT NULL,
   environment_access LONGTEXT NOT NULL,
+  snippet_access LONGTEXT NOT NULL,
   created_at DATETIME NOT NULL,
   updated_at DATETIME NOT NULL,
   created_by_user_id VARCHAR(36) NULL,
@@ -2079,11 +2338,23 @@ var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL = `
 ALTER TABLE environments
   ADD COLUMN IF NOT EXISTS deletion_locked TINYINT(1) NOT NULL DEFAULT 0;
 `.trim();
+var USERS_SNIPPET_ACCESS_MIGRATION_SQL = `
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS snippet_access LONGTEXT NOT NULL DEFAULT '[]';
+`.trim();
+var USERS_SNIPPET_ACCESS_BACKFILL_SQL = `
+UPDATE users
+SET snippet_access = '["*"]'
+WHERE role = 'user'
+  AND snippet_access = '[]'
+  AND collection_access LIKE '%"*"%';
+`.trim();
 var MYSQL_MIGRATIONS = [
   USERS_MIGRATION_SQL,
   API_TOKENS_MIGRATION_SQL,
   COLLECTIONS_MIGRATION_SQL,
   ENVIRONMENTS_MIGRATION_SQL,
+  SNIPPETS_MIGRATION_SQL,
   FOLDERS_MIGRATION_SQL,
   REQUESTS_MIGRATION_SQL,
   AUDIT_LOG_MIGRATION_SQL,
@@ -2101,7 +2372,9 @@ var MYSQL_MIGRATIONS = [
   LLM_USAGE_MIGRATION_SQL,
   LLM_USAGE_LOG_MIGRATION_SQL,
   COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL,
-  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL,
+  USERS_SNIPPET_ACCESS_MIGRATION_SQL,
+  USERS_SNIPPET_ACCESS_BACKFILL_SQL
 ];
 
 // src/db/mysql/schemas.ts
@@ -2145,6 +2418,7 @@ function mapUserSqlRow(row) {
     role: parseUserRole(row.role),
     collectionAccess: parseAccessList(row.collection_access),
     environmentAccess: parseAccessList(row.environment_access),
+    snippetAccess: parseAccessList(row.snippet_access),
     llmAccess: Boolean(row.llm_access),
     llmModels: parseAccessList(row.llm_models),
     llmMonthlyTokenLimit: row.llm_monthly_token_limit,
@@ -2157,9 +2431,10 @@ function mapUserSqlRow(row) {
 function serializeAccessList(access) {
   return JSON.stringify(access);
 }
-var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
+var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, snippet_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
 var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
+var SNIPPET_SELECT_COLUMNS = `id, name, code, scope, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
 var FOLDER_SELECT_COLUMNS = `id, collection_id, name, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var REQUEST_SELECT_COLUMNS = `id, collection_id, folder_id, name, method, url, headers, params, auth, body, body_type, pre_request_script, post_request_script, comment, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var API_TOKEN_SELECT_COLUMNS = `id, user_id, name, token_hash, token_prefix, created_at, last_used_at, revoked_at, created_by_user_id, updated_by_user_id`;
@@ -2202,6 +2477,7 @@ var LLM_USAGE_SELECT_COLUMNS = `id, user_id, period, prompt_tokens, completion_t
 // src/db/mysql/MysqlDatabase.ts
 var COLLECTION_SELECT = `SELECT ${COLLECTION_SELECT_COLUMNS} FROM collections`;
 var ENVIRONMENT_SELECT = `SELECT ${ENVIRONMENT_SELECT_COLUMNS} FROM environments`;
+var SNIPPET_SELECT = `SELECT ${SNIPPET_SELECT_COLUMNS} FROM snippets`;
 var USER_SELECT = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
@@ -2339,6 +2615,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -2346,13 +2623,14 @@ var MysqlDatabase = class _MysqlDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         trimmedName,
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         input.llmAccess ? 1 : 0,
         serializeAccessList(input.llmModels ?? []),
         input.llmMonthlyTokenLimit ?? null,
@@ -2425,6 +2703,7 @@ var MysqlDatabase = class _MysqlDatabase {
     const role = input.role ?? existing.role;
     const collectionAccess = input.collectionAccess ?? existing.collectionAccess;
     const environmentAccess = input.environmentAccess ?? existing.environmentAccess;
+    const snippetAccess = input.snippetAccess ?? existing.snippetAccess;
     const llmAccess = input.llmAccess ?? existing.llmAccess;
     const llmModels = input.llmModels ?? existing.llmModels;
     const llmMonthlyTokenLimit = input.llmMonthlyTokenLimit !== void 0 ? input.llmMonthlyTokenLimit : existing.llmMonthlyTokenLimit;
@@ -2435,6 +2714,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role = ?,
         collection_access = ?,
         environment_access = ?,
+        snippet_access = ?,
         llm_access = ?,
         llm_models = ?,
         llm_monthly_token_limit = ?,
@@ -2446,6 +2726,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role,
         serializeAccessList(collectionAccess),
         serializeAccessList(environmentAccess),
+        serializeAccessList(snippetAccess),
         llmAccess ? 1 : 0,
         serializeAccessList(llmModels),
         llmMonthlyTokenLimit,
@@ -2507,7 +2788,8 @@ var MysqlDatabase = class _MysqlDatabase {
           name: BOOTSTRAP_USER_NAME,
           role: "user",
           collectionAccess: ["*"],
-          environmentAccess: ["*"]
+          environmentAccess: ["*"],
+          snippetAccess: ["*"]
         },
         systemUserId
       );
@@ -2922,6 +3204,143 @@ var MysqlDatabase = class _MysqlDatabase {
     }
     return mapEnvironmentSqlRow(row);
   }
+  /**
+   * Lists all snippets ordered by sort order then name.
+   */
+  async listSnippets() {
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} ORDER BY sort_order ASC, name ASC`
+    );
+    return rows.map(mapSnippetSqlRow);
+  }
+  /**
+   * Creates a new snippet with the given fields.
+   *
+   * @param name - Display name for the snippet.
+   * @param code - JavaScript source for the snippet.
+   * @param scope - Execution scope for the snippet.
+   * @param actingUserId - User performing the create action.
+   */
+  async createSnippet(name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const id = randomUUID3();
+    const now = /* @__PURE__ */ new Date();
+    const maxRows = await this.queryRows(
+      "SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM snippets"
+    );
+    const maxOrder = maxRows[0]?.max_order ?? -1;
+    await this.executeStatement(
+      `INSERT INTO snippets (
+        id,
+        name,
+        code,
+        scope,
+        sort_order,
+        created_at,
+        updated_at,
+        created_by_user_id,
+        updated_by_user_id,
+        deletion_locked
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [id, trimmedName, code, scope, maxOrder + 1, now, now, actingUserId, actingUserId, 0]
+    );
+    await this.recordAuditEntry(actingUserId, "create", "snippet", id);
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Snippet not found after insert");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Updates a snippet's name, code, and scope. Sort order is left unchanged.
+   *
+   * @param actingUserId - User performing the update action.
+   */
+  async updateSnippet(id, name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE snippets
+      SET name = ?,
+        code = ?,
+        scope = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [trimmedName, code, scope, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Deletes a snippet.
+   *
+   * @param id - Snippet ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteSnippet(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "snippet", id);
+    await this.executeStatement("DELETE FROM snippets WHERE id = ?", [id]);
+  }
+  /**
+   * Finds a snippet by stable identifier.
+   *
+   * @param id - Snippet ID to look up.
+   */
+  async findSnippetById(id) {
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapSnippetSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a snippet.
+   *
+   * @param id - Snippet ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the snippet.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setSnippetDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE snippets
+      SET deletion_locked = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [deletionLocked ? 1 : 0, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -3484,6 +3903,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -3491,13 +3911,14 @@ var MysqlDatabase = class _MysqlDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         trimmedName,
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         0,
         serializeAccessList([]),
         null,
@@ -3626,6 +4047,20 @@ CREATE TABLE IF NOT EXISTS environments (
   updated_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL
 );
 `.trim();
+var SNIPPETS_MIGRATION_SQL2 = `
+CREATE TABLE IF NOT EXISTS snippets (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  code TEXT NOT NULL DEFAULT '',
+  scope TEXT NOT NULL DEFAULT 'any' CHECK (scope IN ('pre-request', 'post-request', 'any')),
+  sort_order INT NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+  updated_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+  deletion_locked BOOLEAN NOT NULL DEFAULT FALSE
+);
+`.trim();
 var FOLDERS_MIGRATION_SQL2 = `
 CREATE TABLE IF NOT EXISTS folders (
   id TEXT PRIMARY KEY,
@@ -3671,6 +4106,7 @@ CREATE TABLE IF NOT EXISTS users (
   role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
   collection_access TEXT NOT NULL DEFAULT '[]',
   environment_access TEXT NOT NULL DEFAULT '[]',
+  snippet_access TEXT NOT NULL DEFAULT '[]',
   created_at TIMESTAMPTZ NOT NULL,
   updated_at TIMESTAMPTZ NOT NULL,
   created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
@@ -3782,11 +4218,23 @@ var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2 = `
 ALTER TABLE environments
   ADD COLUMN IF NOT EXISTS deletion_locked BOOLEAN NOT NULL DEFAULT FALSE;
 `.trim();
+var USERS_SNIPPET_ACCESS_MIGRATION_SQL2 = `
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS snippet_access TEXT NOT NULL DEFAULT '[]';
+`.trim();
+var USERS_SNIPPET_ACCESS_BACKFILL_SQL2 = `
+UPDATE users
+SET snippet_access = '["*"]'
+WHERE role = 'user'
+  AND snippet_access = '[]'
+  AND collection_access LIKE '%"*"%';
+`.trim();
 var POSTGRES_MIGRATIONS = [
   USERS_MIGRATION_SQL2,
   API_TOKENS_MIGRATION_SQL2,
   COLLECTIONS_MIGRATION_SQL2,
   ENVIRONMENTS_MIGRATION_SQL2,
+  SNIPPETS_MIGRATION_SQL2,
   FOLDERS_MIGRATION_SQL2,
   REQUESTS_MIGRATION_SQL2,
   AUDIT_LOG_MIGRATION_SQL2,
@@ -3804,7 +4252,9 @@ var POSTGRES_MIGRATIONS = [
   LLM_USAGE_MIGRATION_SQL2,
   LLM_USAGE_LOG_MIGRATION_SQL2,
   COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2,
-  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2,
+  USERS_SNIPPET_ACCESS_MIGRATION_SQL2,
+  USERS_SNIPPET_ACCESS_BACKFILL_SQL2
 ];
 
 // src/db/postgres/schemas.ts
@@ -3828,6 +4278,7 @@ var postgresConfigSchema = z4.object({
 var { Pool } = pg;
 var COLLECTION_SELECT2 = `SELECT ${COLLECTION_SELECT_COLUMNS} FROM collections`;
 var ENVIRONMENT_SELECT2 = `SELECT ${ENVIRONMENT_SELECT_COLUMNS} FROM environments`;
+var SNIPPET_SELECT2 = `SELECT ${SNIPPET_SELECT_COLUMNS} FROM snippets`;
 var USER_SELECT2 = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT2 = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT2 = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
@@ -3968,6 +4419,7 @@ var PostgresDatabase = class _PostgresDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -3975,7 +4427,7 @@ var PostgresDatabase = class _PostgresDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
       RETURNING ${USER_SELECT_COLUMNS}`,
       [
         id,
@@ -3983,6 +4435,7 @@ var PostgresDatabase = class _PostgresDatabase {
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         input.llmAccess ?? false,
         serializeAccessList(input.llmModels ?? []),
         input.llmMonthlyTokenLimit ?? null,
@@ -4047,6 +4500,7 @@ var PostgresDatabase = class _PostgresDatabase {
     const role = input.role ?? existing.role;
     const collectionAccess = input.collectionAccess ?? existing.collectionAccess;
     const environmentAccess = input.environmentAccess ?? existing.environmentAccess;
+    const snippetAccess = input.snippetAccess ?? existing.snippetAccess;
     const llmAccess = input.llmAccess ?? existing.llmAccess;
     const llmModels = input.llmModels ?? existing.llmModels;
     const llmMonthlyTokenLimit = input.llmMonthlyTokenLimit !== void 0 ? input.llmMonthlyTokenLimit : existing.llmMonthlyTokenLimit;
@@ -4057,17 +4511,19 @@ var PostgresDatabase = class _PostgresDatabase {
         role = $2,
         collection_access = $3,
         environment_access = $4,
-        llm_access = $5,
-        llm_models = $6,
-        llm_monthly_token_limit = $7,
-        updated_at = $8,
-        updated_by_user_id = $9
-      WHERE id = $10`,
+        snippet_access = $5,
+        llm_access = $6,
+        llm_models = $7,
+        llm_monthly_token_limit = $8,
+        updated_at = $9,
+        updated_by_user_id = $10
+      WHERE id = $11`,
       [
         name,
         role,
         serializeAccessList(collectionAccess),
         serializeAccessList(environmentAccess),
+        serializeAccessList(snippetAccess),
         llmAccess,
         serializeAccessList(llmModels),
         llmMonthlyTokenLimit,
@@ -4129,7 +4585,8 @@ var PostgresDatabase = class _PostgresDatabase {
           name: BOOTSTRAP_USER_NAME,
           role: "user",
           collectionAccess: ["*"],
-          environmentAccess: ["*"]
+          environmentAccess: ["*"],
+          snippetAccess: ["*"]
         },
         systemUserId
       );
@@ -4526,27 +4983,151 @@ var PostgresDatabase = class _PostgresDatabase {
     return mapEnvironmentSqlRow(row);
   }
   /**
-   * Lists all saved requests in a collection.
-   *
-   * @param collectionId - Collection to query.
+   * Lists all snippets ordered by sort order then name.
    */
-  async listRequests(collectionId) {
+  async listSnippets() {
     const result = await this.query(
-      `${REQUEST_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
-      [collectionId]
+      `${SNIPPET_SELECT2} ORDER BY sort_order ASC, name ASC`
     );
-    return result.rows.map(mapRequestSqlRow);
+    return result.rows.map(mapSnippetSqlRow);
   }
   /**
-   * Finds a saved request by id.
+   * Creates a new snippet with the given fields.
    *
-   * @param id - Request identifier to look up.
+   * @param name - Display name for the snippet.
+   * @param code - JavaScript source for the snippet.
+   * @param scope - Execution scope for the snippet.
+   * @param actingUserId - User performing the create action.
    */
-  async findRequestById(id) {
-    const result = await this.query(`${REQUEST_SELECT2} WHERE id = $1 LIMIT 1`, [id]);
-    const row = result.rows[0];
-    return row ? mapRequestSqlRow(row) : null;
-  }
+  async createSnippet(name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const id = randomUUID4();
+    const now = /* @__PURE__ */ new Date();
+    const maxResult = await this.query(
+      "SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM snippets"
+    );
+    const maxOrder = maxResult.rows[0]?.max_order ?? -1;
+    const result = await this.query(
+      `INSERT INTO snippets (
+        id,
+        name,
+        code,
+        scope,
+        sort_order,
+        created_at,
+        updated_at,
+        created_by_user_id,
+        updated_by_user_id
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+      RETURNING ${SNIPPET_SELECT_COLUMNS}`,
+      [id, trimmedName, code, scope, maxOrder + 1, now, now, actingUserId, actingUserId]
+    );
+    const row = result.rows[0];
+    if (!row) {
+      throw new Error("Snippet not found after insert");
+    }
+    await this.recordAuditEntry(actingUserId, "create", "snippet", id);
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Updates a snippet's name, code, and scope. Sort order is left unchanged.
+   *
+   * @param actingUserId - User performing the update action.
+   */
+  async updateSnippet(id, name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE snippets
+      SET name = $1,
+        code = $2,
+        scope = $3,
+        updated_at = $4,
+        updated_by_user_id = $5
+      WHERE id = $6`,
+      [trimmedName, code, scope, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const selectResult = await this.query(`${SNIPPET_SELECT2} WHERE id = $1`, [id]);
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Deletes a snippet.
+   *
+   * @param id - Snippet ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteSnippet(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "snippet", id);
+    await this.query("DELETE FROM snippets WHERE id = $1", [id]);
+  }
+  /**
+   * Finds a snippet by stable identifier.
+   *
+   * @param id - Snippet ID to look up.
+   */
+  async findSnippetById(id) {
+    const result = await this.query(`${SNIPPET_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapSnippetSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a snippet.
+   *
+   * @param id - Snippet ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the snippet.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setSnippetDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE snippets
+      SET deletion_locked = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4`,
+      [deletionLocked, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const selectResult = await this.query(`${SNIPPET_SELECT2} WHERE id = $1`, [id]);
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Lists all saved requests in a collection.
+   *
+   * @param collectionId - Collection to query.
+   */
+  async listRequests(collectionId) {
+    const result = await this.query(
+      `${REQUEST_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
+      [collectionId]
+    );
+    return result.rows.map(mapRequestSqlRow);
+  }
+  /**
+   * Finds a saved request by id.
+   *
+   * @param id - Request identifier to look up.
+   */
+  async findRequestById(id) {
+    const result = await this.query(`${REQUEST_SELECT2} WHERE id = $1 LIMIT 1`, [id]);
+    const row = result.rows[0];
+    return row ? mapRequestSqlRow(row) : null;
+  }
   /**
    * Inserts a new request or updates an existing one.
    *
@@ -5082,6 +5663,7 @@ var PostgresDatabase = class _PostgresDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -5089,13 +5671,14 @@ var PostgresDatabase = class _PostgresDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`,
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
       [
         id,
         SYSTEM_USER_NAME,
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         false,
         serializeAccessList([]),
         null,
@@ -5395,21 +5978,26 @@ function normalizeLlmForRole(role, llmAccess, llmModels) {
     llmModels
   };
 }
-function normalizeAccessForRole(role, collectionAccess, environmentAccess) {
+function normalizeAccessForRole(role, collectionAccess, environmentAccess, snippetAccess) {
   if (role === "admin") {
-    if (collectionAccess.length > 0 || environmentAccess.length > 0) {
-      throw new ValidationError("Admin users cannot have collection or environment access.");
+    if (collectionAccess.length > 0 || environmentAccess.length > 0 || snippetAccess.length > 0) {
+      throw new ValidationError(
+        "Admin users cannot have collection, environment, or snippet access."
+      );
     }
     return {
       collectionAccess: [],
-      environmentAccess: []
+      environmentAccess: [],
+      snippetAccess: []
     };
   }
   validateAccessList(collectionAccess);
   validateAccessList(environmentAccess);
+  validateAccessList(snippetAccess);
   return {
     collectionAccess,
-    environmentAccess
+    environmentAccess,
+    snippetAccess
   };
 }
 function findUnknownAccessIds(access, knownIds) {
@@ -5435,6 +6023,9 @@ function validateSubmittedAccessLists(submitted, catalogs) {
         "environment"
       );
     }
+    if (submitted.snippetAccess !== void 0) {
+      validateKnownAccessIds(submitted.snippetAccess, catalogs.knownSnippetIds, "snippet");
+    }
   }
   if (submitted.llmModels !== void 0 && catalogs.knownLlmModelIds !== null) {
     validateKnownAccessIds(submitted.llmModels, catalogs.knownLlmModelIds, "LLM model");
@@ -5448,6 +6039,9 @@ function buildAccessListWarnings(stored, catalogs) {
   for (const id of findUnknownAccessIds(stored.environmentAccess, catalogs.knownEnvironmentIds)) {
     warnings.push(`Unknown environment id "${id}".`);
   }
+  for (const id of findUnknownAccessIds(stored.snippetAccess, catalogs.knownSnippetIds)) {
+    warnings.push(`Unknown snippet id "${id}".`);
+  }
   if (catalogs.knownLlmModelIds !== null) {
     for (const id of findUnknownAccessIds(stored.llmModels, catalogs.knownLlmModelIds)) {
       warnings.push(`Unknown LLM model id "${id}".`);
@@ -5455,10 +6049,11 @@ function buildAccessListWarnings(stored, catalogs) {
   }
   return warnings;
 }
-function buildAccessCatalogIds(collections, environments, llmModelIds) {
+function buildAccessCatalogIds(collections, environments, snippets, llmModelIds) {
   return {
     knownCollectionIds: new Set(collections.map((collection) => collection.id)),
     knownEnvironmentIds: new Set(environments.map((environment) => environment.id)),
+    knownSnippetIds: new Set(snippets.map((snippet) => snippet.id)),
     knownLlmModelIds: llmModelIds === null ? null : new Set(llmModelIds)
   };
 }
@@ -5466,7 +6061,8 @@ function buildAdminUserUpdateInput(existing, body) {
   const role = body.role ?? existing.role;
   const collectionAccess = role === "admin" ? [] : body.collectionAccess ?? existing.collectionAccess;
   const environmentAccess = role === "admin" ? [] : body.environmentAccess ?? existing.environmentAccess;
-  const access = normalizeAccessForRole(role, collectionAccess, environmentAccess);
+  const snippetAccess = role === "admin" ? [] : body.snippetAccess ?? existing.snippetAccess;
+  const access = normalizeAccessForRole(role, collectionAccess, environmentAccess, snippetAccess);
   const llmAccess = role === "admin" ? false : body.llmAccess ?? existing.llmAccess;
   const llmModels = role === "admin" ? [] : body.llmModels ?? existing.llmModels;
   const llm = normalizeLlmForRole(role, llmAccess, llmModels);
@@ -5475,6 +6071,7 @@ function buildAdminUserUpdateInput(existing, body) {
     role: body.role,
     collectionAccess: access.collectionAccess,
     environmentAccess: access.environmentAccess,
+    snippetAccess: access.snippetAccess,
     llmAccess: llm.llmAccess,
     llmModels: llm.llmModels,
     llmMonthlyTokenLimit: body.llmMonthlyTokenLimit
@@ -5483,7 +6080,13 @@ function buildAdminUserUpdateInput(existing, body) {
 function buildAdminUserCreateInput(body) {
   const collectionAccess = body.collectionAccess ?? [];
   const environmentAccess = body.environmentAccess ?? [];
-  const access = normalizeAccessForRole(body.role, collectionAccess, environmentAccess);
+  const snippetAccess = body.snippetAccess ?? [];
+  const access = normalizeAccessForRole(
+    body.role,
+    collectionAccess,
+    environmentAccess,
+    snippetAccess
+  );
   const llmAccess = body.role === "admin" ? false : body.llmAccess ?? false;
   const llmModels = body.role === "admin" ? [] : body.llmModels ?? [];
   const llm = normalizeLlmForRole(body.role, llmAccess, llmModels);
@@ -5492,6 +6095,7 @@ function buildAdminUserCreateInput(body) {
     role: body.role,
     collectionAccess: access.collectionAccess ?? [],
     environmentAccess: access.environmentAccess ?? [],
+    snippetAccess: access.snippetAccess ?? [],
     llmAccess: llm.llmAccess ?? false,
     llmModels: llm.llmModels ?? [],
     llmMonthlyTokenLimit: body.llmMonthlyTokenLimit ?? null
@@ -5590,6 +6194,7 @@ function printUser(user, usage) {
   console.log(`  role: ${user.role}`);
   console.log(`  collection access: ${formatAccessList(user.collectionAccess)}`);
   console.log(`  environment access: ${formatAccessList(user.environmentAccess)}`);
+  console.log(`  snippet access: ${formatAccessList(user.snippetAccess)}`);
   console.log(`  llm access: ${user.llmAccess ? "enabled" : "disabled"}`);
   console.log(`  llm models: ${formatAccessList(user.llmModels)}`);
   console.log(
@@ -5609,13 +6214,15 @@ function printCreatedApiToken(user, record, secret) {
   console.log(secret);
 }
 async function loadAccessCatalogs(db, llm) {
-  const [collections, environments] = await Promise.all([
+  const [collections, environments, snippets] = await Promise.all([
     db.listCollections(),
-    db.listEnvironments()
+    db.listEnvironments(),
+    db.listSnippets()
   ]);
   return buildAccessCatalogIds(
     collections,
     environments,
+    snippets,
     llm ? listHubOfferedModels(llm).map((model) => model.id) : null
   );
 }
@@ -5641,7 +6248,12 @@ async function userCreateCommand(options) {
   const config = loadServerConfig(options.config);
   const db = createDatabase(config.db);
   const access = mapValidationError(
-    () => normalizeAccessForRole(options.role, options.collectionAccess, options.environmentAccess)
+    () => normalizeAccessForRole(
+      options.role,
+      options.collectionAccess,
+      options.environmentAccess,
+      options.snippetAccess
+    )
   );
   await db.connect();
   const actingUserId = await requireSystemUserId(db);
@@ -5655,6 +6267,7 @@ async function userCreateCommand(options) {
       role: options.role,
       collectionAccess: access.collectionAccess,
       environmentAccess: access.environmentAccess,
+      snippetAccess: access.snippetAccess,
       llmModels
     },
     catalogs
@@ -5665,6 +6278,7 @@ async function userCreateCommand(options) {
       role: options.role,
       collectionAccess: access.collectionAccess ?? [],
       environmentAccess: access.environmentAccess ?? [],
+      snippetAccess: access.snippetAccess ?? [],
       llmAccess: llm.llmAccess,
       llmModels: llm.llmModels,
       llmMonthlyTokenLimit: options.llmMonthlyTokens ?? null
@@ -5702,6 +6316,7 @@ async function userListCommand(options) {
         {
           collectionAccess: user.collectionAccess,
           environmentAccess: user.environmentAccess,
+          snippetAccess: user.snippetAccess,
           llmModels: user.llmModels
         },
         catalogs
@@ -5731,6 +6346,7 @@ async function userShowCommand(options) {
       {
         collectionAccess: user.collectionAccess,
         environmentAccess: user.environmentAccess,
+        snippetAccess: user.snippetAccess,
         llmModels: user.llmModels
       },
       catalogs
@@ -5752,8 +6368,9 @@ async function userUpdateCommand(options) {
   const role = options.role ?? existing.role;
   const collectionAccess = options.collectionAccess ?? (options.role === "admin" ? [] : existing.collectionAccess);
   const environmentAccess = options.environmentAccess ?? (options.role === "admin" ? [] : existing.environmentAccess);
+  const snippetAccess = options.snippetAccess ?? (options.role === "admin" ? [] : existing.snippetAccess);
   const access = mapValidationError(
-    () => normalizeAccessForRole(role, collectionAccess, environmentAccess)
+    () => normalizeAccessForRole(role, collectionAccess, environmentAccess, snippetAccess)
   );
   const llmAccess = role === "admin" ? false : options.llmAccess ?? existing.llmAccess;
   const llmModels = role === "admin" ? [] : options.llmModels ?? existing.llmModels;
@@ -5764,6 +6381,7 @@ async function userUpdateCommand(options) {
       role,
       collectionAccess: options.collectionAccess,
       environmentAccess: options.environmentAccess,
+      snippetAccess: options.snippetAccess,
       llmModels: options.llmModels
     },
     catalogs
@@ -5773,6 +6391,7 @@ async function userUpdateCommand(options) {
     role: options.role,
     collectionAccess: access.collectionAccess,
     environmentAccess: access.environmentAccess,
+    snippetAccess: access.snippetAccess,
     llmAccess: llm.llmAccess,
     llmModels: llm.llmModels,
     llmMonthlyTokenLimit: options.llmMonthlyTokens !== void 0 ? options.llmMonthlyTokens : void 0
@@ -5856,6 +6475,11 @@ function registerUserCommand(program, handlers = {}) {
     "Environment id or * (repeatable)",
     parseAccessFlag,
     []
+  ).option(
+    "--snippet-access <id>",
+    "Snippet id or * (repeatable)",
+    parseAccessFlag,
+    []
   ).option("--llm-access", "Enable hub-proxied LLM access for the user").option("--llm-model <id>", "LLM model id or * (repeatable)", parseAccessFlag, []).option("--llm-monthly-tokens <count>", "Monthly LLM token limit", parseMonthlyTokenLimit).action(
     /**
      * Runs the user create subcommand after merging global CLI options.
@@ -5890,6 +6514,11 @@ function registerUserCommand(program, handlers = {}) {
     "Replacement environment id or * (repeatable)",
     parseAccessFlag,
     []
+  ).option(
+    "--snippet-access <id>",
+    "Replacement snippet id or * (repeatable)",
+    parseAccessFlag,
+    []
   ).option("--llm-access", "Enable hub-proxied LLM access for the user").option("--no-llm-access", "Disable hub-proxied LLM access for the user").option(
     "--llm-model <id>",
     "Replacement LLM model id or * (repeatable)",
@@ -5905,6 +6534,7 @@ function registerUserCommand(program, handlers = {}) {
         ...merged,
         collectionAccess: (options.collectionAccess ?? []).length > 0 ? options.collectionAccess : void 0,
         environmentAccess: (options.environmentAccess ?? []).length > 0 ? options.environmentAccess : void 0,
+        snippetAccess: (options.snippetAccess ?? []).length > 0 ? options.snippetAccess : void 0,
         llmModels: (() => {
           const llmModels = readLlmModelsOption(options);
           return llmModels.length > 0 ? llmModels : void 0;
@@ -6022,6 +6652,9 @@ function canListCollections(user) {
 function canListEnvironments(user) {
   return canUseDataApi(user) || canUseManagementApi(user);
 }
+function canListSnippets(user) {
+  return canUseDataApi(user) || canUseManagementApi(user);
+}
 function hasWildcardAccess(access) {
   return access.includes("*");
 }
@@ -6043,6 +6676,15 @@ function canAccessEnvironment(user, environmentId) {
   }
   return user.environmentAccess.includes(environmentId);
 }
+function canAccessSnippet(user, snippetId) {
+  if (user.role === "admin") {
+    return false;
+  }
+  if (hasWildcardAccess(user.snippetAccess)) {
+    return true;
+  }
+  return user.snippetAccess.includes(snippetId);
+}
 function canDeleteCollection(user, collection) {
   return canUseDataApi(user) && canAccessCollection(user, collection.id) && collection.createdByUserId === user.id && !collection.deletionLocked;
 }
@@ -6055,6 +6697,9 @@ function canCreateCollection(user) {
 function canCreateEnvironment(user) {
   return user.role === "user" && hasWildcardAccess(user.environmentAccess);
 }
+function canCreateSnippet(user) {
+  return user.role === "user" && hasWildcardAccess(user.snippetAccess);
+}
 function filterAccessibleCollections(user, collections) {
   if (user.role === "admin" || hasWildcardAccess(user.collectionAccess)) {
     return collections;
@@ -6069,6 +6714,13 @@ function filterAccessibleEnvironments(user, environments) {
   const allowed = new Set(user.environmentAccess);
   return environments.filter((environment) => allowed.has(environment.id));
 }
+function filterAccessibleSnippets(user, snippets) {
+  if (user.role === "admin" || hasWildcardAccess(user.snippetAccess)) {
+    return snippets;
+  }
+  const allowed = new Set(user.snippetAccess);
+  return snippets.filter((snippet) => allowed.has(snippet.id));
+}
 function canUseLlm(user) {
   return user.role !== "admin" && user.llmAccess;
 }
@@ -6297,12 +6949,18 @@ var updateAdminCollectionBodySchema = z8.object({
 var updateAdminEnvironmentBodySchema = z8.object({
   deletionLocked: z8.boolean()
 });
+var updateAdminSnippetBodySchema = z8.object({
+  deletionLocked: z8.boolean()
+});
 var listAdminCollectionsResponseSchema = z8.object({
   collections: z8.array(adminResourceOptionSchema)
 });
 var listAdminEnvironmentsResponseSchema = z8.object({
   environments: z8.array(adminResourceOptionSchema)
 });
+var listAdminSnippetsResponseSchema = z8.object({
+  snippets: z8.array(adminResourceOptionSchema)
+});
 var listAdminLlmModelsResponseSchema = listLlmModelsResponseSchema;
 var hubUserRecordSchema = z8.object({
   id: z8.string(),
@@ -6310,6 +6968,7 @@ var hubUserRecordSchema = z8.object({
   role: userRoleSchema,
   collectionAccess: z8.array(z8.string()),
   environmentAccess: z8.array(z8.string()),
+  snippetAccess: z8.array(z8.string()),
   llmAccess: z8.boolean(),
   llmModels: z8.array(z8.string()),
   llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable(),
@@ -6327,6 +6986,7 @@ var updateAdminUserBodySchema = z8.object({
   role: userRoleSchema.optional(),
   collectionAccess: z8.array(z8.string()).optional(),
   environmentAccess: z8.array(z8.string()).optional(),
+  snippetAccess: z8.array(z8.string()).optional(),
   llmAccess: z8.boolean().optional(),
   llmModels: z8.array(z8.string()).optional(),
   llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable().optional()
@@ -6336,6 +6996,7 @@ var createAdminUserBodySchema = z8.object({
   role: userRoleSchema,
   collectionAccess: z8.array(z8.string()).optional(),
   environmentAccess: z8.array(z8.string()).optional(),
+  snippetAccess: z8.array(z8.string()).optional(),
   llmAccess: z8.boolean().optional(),
   llmModels: z8.array(z8.string()).optional(),
   llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable().optional()
@@ -6380,6 +7041,7 @@ function serializeHubUser(user) {
     role: user.role,
     collectionAccess: user.collectionAccess,
     environmentAccess: user.environmentAccess,
+    snippetAccess: user.snippetAccess,
     llmAccess: user.llmAccess,
     llmModels: user.llmModels,
     llmMonthlyTokenLimit: user.llmMonthlyTokenLimit,
@@ -6425,6 +7087,19 @@ var environmentRecordSchema = z9.object({
   updatedByUserId: z9.string().nullable(),
   deletionLocked: z9.boolean()
 });
+var snippetScopeSchema = z9.enum(["pre-request", "post-request", "any"]);
+var snippetRecordSchema = z9.object({
+  id: z9.string(),
+  name: z9.string(),
+  code: z9.string(),
+  scope: snippetScopeSchema,
+  sortOrder: z9.number().int(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z9.string().nullable(),
+  updatedByUserId: z9.string().nullable(),
+  deletionLocked: z9.boolean()
+});
 var folderRecordSchema = z9.object({
   id: z9.string(),
   collectionId: z9.string(),
@@ -6474,6 +7149,16 @@ var updateEnvironmentBodySchema = z9.object({
   name: z9.string().trim().min(1),
   variables: z9.array(variableSchema)
 });
+var createSnippetBodySchema = z9.object({
+  name: z9.string().trim().min(1),
+  code: z9.string().default(""),
+  scope: snippetScopeSchema.default("any")
+});
+var updateSnippetBodySchema = z9.object({
+  name: z9.string().trim().min(1),
+  code: z9.string(),
+  scope: snippetScopeSchema
+});
 var createFolderBodySchema = z9.object({
   name: z9.string().trim().min(1)
 });
@@ -6514,6 +7199,9 @@ var listCollectionsResponseSchema = z9.object({
 var listEnvironmentsResponseSchema = z9.object({
   environments: z9.array(environmentRecordSchema)
 });
+var listSnippetsResponseSchema = z9.object({
+  snippets: z9.array(snippetRecordSchema)
+});
 var listFoldersResponseSchema = z9.object({
   folders: z9.array(folderRecordSchema)
 });
@@ -6535,6 +7223,13 @@ function serializeEnvironment(record) {
     updatedAt: record.updatedAt.toISOString()
   };
 }
+function serializeSnippet(record) {
+  return {
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
+  };
+}
 function serializeFolder(record) {
   return {
     ...record,
@@ -6603,14 +7298,16 @@ async function registerAdminRoutes(app, options) {
         }
         const systemUserId = db.getSystemUserId();
         const llm = getLlm();
-        const [users, collections, environments] = await Promise.all([
+        const [users, collections, environments, snippets] = await Promise.all([
           db.listUsers(),
           db.listCollections(),
-          db.listEnvironments()
+          db.listEnvironments(),
+          db.listSnippets()
         ]);
         const catalogs = buildAccessCatalogIds(
           collections,
           environments,
+          snippets,
           llm ? listHubOfferedModels(llm).map((model) => model.id) : null
         );
         return reply.send({
@@ -6620,6 +7317,7 @@ async function registerAdminRoutes(app, options) {
               {
                 collectionAccess: record.collectionAccess,
                 environmentAccess: record.environmentAccess,
+                snippetAccess: record.snippetAccess,
                 llmModels: record.llmModels
               },
               catalogs
@@ -6656,13 +7354,15 @@ async function registerAdminRoutes(app, options) {
         }
         const input = buildAdminUserCreateInput(request.body);
         const llm = getLlm();
-        const [collections, environments] = await Promise.all([
+        const [collections, environments, snippets] = await Promise.all([
           db.listCollections(),
-          db.listEnvironments()
+          db.listEnvironments(),
+          db.listSnippets()
         ]);
         const catalogs = buildAccessCatalogIds(
           collections,
           environments,
+          snippets,
           llm ? listHubOfferedModels(llm).map((model) => model.id) : null
         );
         validateSubmittedAccessLists(
@@ -6670,6 +7370,7 @@ async function registerAdminRoutes(app, options) {
             role: request.body.role,
             collectionAccess: request.body.collectionAccess,
             environmentAccess: request.body.environmentAccess,
+            snippetAccess: request.body.snippetAccess,
             llmModels: request.body.llmModels
           },
           catalogs
@@ -6832,6 +7533,40 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "GET",
+    url: "/admin/snippets",
+    schema: {
+      response: {
+        200: listAdminSnippetsResponseSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Lists all snippets for operator user management.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippets = await db.listSnippets();
+        return reply.send({
+          snippets: snippets.map((snippet) => ({
+            id: snippet.id,
+            name: snippet.name,
+            deletionLocked: snippet.deletionLocked
+          }))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "DELETE",
     url: "/admin/collections/:id",
@@ -6902,6 +7637,80 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a snippet regardless of deletion lock state.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippet = await db.findSnippetById(request.params.id);
+        if (!snippet) {
+          void reply.code(404).send({ error: "Snippet not found" });
+          return;
+        }
+        await db.deleteSnippet(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/admin/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateAdminSnippetBodySchema,
+      response: {
+        200: adminEntityConfigSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates admin configuration for a snippet.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippet = await db.setSnippetDeletionLocked(
+          request.params.id,
+          request.body.deletionLocked,
+          user.id
+        );
+        return reply.send({
+          id: snippet.id,
+          name: snippet.name,
+          deletionLocked: snippet.deletionLocked
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "PUT",
     url: "/admin/collections/:id",
@@ -7082,13 +7891,15 @@ async function registerAdminRoutes(app, options) {
         const input = buildAdminUserUpdateInput(existing, request.body);
         const role = request.body.role ?? existing.role;
         const llm = getLlm();
-        const [collections, environments] = await Promise.all([
+        const [collections, environments, snippets] = await Promise.all([
           db.listCollections(),
-          db.listEnvironments()
+          db.listEnvironments(),
+          db.listSnippets()
         ]);
         const catalogs = buildAccessCatalogIds(
           collections,
           environments,
+          snippets,
           llm ? listHubOfferedModels(llm).map((model) => model.id) : null
         );
         validateSubmittedAccessLists(
@@ -7096,6 +7907,7 @@ async function registerAdminRoutes(app, options) {
             role,
             collectionAccess: request.body.collectionAccess,
             environmentAccess: request.body.environmentAccess,
+            snippetAccess: request.body.snippetAccess,
             llmModels: request.body.llmModels
           },
           catalogs
@@ -7632,6 +8444,150 @@ async function registerEnvironmentRoutes(app, db) {
   });
 }
 
+// src/server/routes/snippets.ts
+async function registerSnippetRoutes(app, db) {
+  const routes = app.withTypeProvider();
+  routes.route({
+    method: "GET",
+    url: "/snippets",
+    schema: {
+      response: {
+        200: listSnippetsResponseSchema
+      }
+    },
+    /**
+     * Lists all snippets ordered by sort order then name.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canListSnippets(user))) {
+          return;
+        }
+        const snippets = await db.listSnippets();
+        return reply.send({
+          snippets: filterAccessibleSnippets(user, snippets).map(
+            (snippet) => serializeSnippet(snippet)
+          )
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "POST",
+    url: "/snippets",
+    schema: {
+      body: createSnippetBodySchema,
+      response: {
+        200: snippetRecordSchema,
+        400: errorResponseSchema
+      }
+    },
+    /**
+     * Creates a new snippet with the given display name and content.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user) && canCreateSnippet(user))) {
+          return;
+        }
+        const snippet = await db.createSnippet(
+          request.body.name,
+          request.body.code,
+          request.body.scope,
+          user.id
+        );
+        return reply.send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateSnippetBodySchema,
+      response: {
+        200: snippetRecordSchema,
+        400: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates a snippet's name, code, and scope. Sort order is preserved.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user) && canAccessSnippet(user, request.params.id))) {
+          return;
+        }
+        const snippet = await db.updateSnippet(
+          request.params.id,
+          request.body.name,
+          request.body.code,
+          request.body.scope,
+          user.id
+        );
+        return reply.send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a snippet by id.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user) && canAccessSnippet(user, request.params.id))) {
+          return;
+        }
+        const snippet = await db.findSnippetById(request.params.id);
+        if (!snippet) {
+          void reply.code(404).send({ error: "Snippet not found" });
+          return;
+        }
+        if (snippet.deletionLocked) {
+          throw new DeletionLockedError("snippet");
+        }
+        await db.deleteSnippet(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+}
+
 // src/server/routes/folders.ts
 async function registerFolderRoutes(app, db) {
   const routes = app.withTypeProvider();
@@ -8216,6 +9172,258 @@ async function runLlmCompletion(config, input) {
   return parseCompletionResponse(json);
 }
 
+// src/server/llm/hubMcpToolNames.ts
+var HUB_MCP_TOOL_PREFIX = "hubmcp__";
+function encodeHubMcpToolName(serverIndex, toolName) {
+  return `${HUB_MCP_TOOL_PREFIX}${serverIndex}__${toolName}`;
+}
+function decodeHubMcpToolName(prefixed) {
+  if (!prefixed.startsWith(HUB_MCP_TOOL_PREFIX)) {
+    return null;
+  }
+  const rest = prefixed.slice(HUB_MCP_TOOL_PREFIX.length);
+  const separatorIndex = rest.indexOf("__");
+  if (separatorIndex <= 0) {
+    return null;
+  }
+  const serverIndex = Number.parseInt(rest.slice(0, separatorIndex), 10);
+  if (!Number.isInteger(serverIndex) || serverIndex < 0) {
+    return null;
+  }
+  const toolName = rest.slice(separatorIndex + 2);
+  if (!toolName) {
+    return null;
+  }
+  return { serverIndex, toolName };
+}
+function isHubMcpToolName(name) {
+  return decodeHubMcpToolName(name) !== null;
+}
+
+// src/server/llm/mcpClient.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+var connectedClients = /* @__PURE__ */ new Map();
+var activeConfigSignature = "";
+function buildRequestHeaders(headers) {
+  const result = {};
+  for (const row of headers) {
+    if (row.key.trim()) {
+      result[row.key.trim()] = row.value;
+    }
+  }
+  return result;
+}
+function buildMcpConfigSignature(config) {
+  return JSON.stringify(config.mcp ?? []);
+}
+function flattenMcpToolContent(content) {
+  if (!Array.isArray(content)) {
+    return JSON.stringify(content ?? null);
+  }
+  const parts = content.map((item) => {
+    if (!item || typeof item !== "object") {
+      return String(item);
+    }
+    const record = item;
+    if (record.type === "text" && typeof record.text === "string") {
+      return record.text;
+    }
+    if (record.type === "resource" && typeof record.uri === "string") {
+      return record.uri;
+    }
+    return JSON.stringify(record);
+  });
+  return parts.join("\n");
+}
+function toOpenAiTool(serverIndex, tool) {
+  return {
+    type: "function",
+    function: {
+      name: encodeHubMcpToolName(serverIndex, tool.name),
+      description: tool.description ?? `MCP tool ${tool.name}`,
+      parameters: tool.inputSchema ?? {
+        type: "object",
+        properties: {},
+        additionalProperties: true
+      }
+    }
+  };
+}
+async function connectHubMcpServer(serverIndex, server) {
+  const headers = buildRequestHeaders(server.headers);
+  const url = new URL(server.url);
+  const client = new Client(
+    {
+      name: "team-hub",
+      version: "1.0.0"
+    },
+    {}
+  );
+  let transport;
+  try {
+    transport = new StreamableHTTPClientTransport(url, {
+      requestInit: { headers }
+    });
+    await client.connect(transport);
+  } catch {
+    transport = new SSEClientTransport(url, {
+      requestInit: { headers }
+    });
+    await client.connect(transport);
+  }
+  const { tools } = await client.listTools();
+  return {
+    serverIndex,
+    client,
+    remoteTools: tools
+  };
+}
+async function ensureHubMcpConnections(config) {
+  const servers = config.mcp ?? [];
+  const signature = buildMcpConfigSignature(config);
+  if (signature !== activeConfigSignature) {
+    await disposeHubMcpConnections();
+    activeConfigSignature = signature;
+  }
+  if (servers.length === 0) {
+    return;
+  }
+  for (const [index, server] of servers.entries()) {
+    if (connectedClients.has(index)) {
+      continue;
+    }
+    try {
+      const connected = await connectHubMcpServer(index, server);
+      connectedClients.set(index, connected);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Connection failed";
+      console.warn(`Hub MCP server "${server.name}" failed to connect: ${message}`);
+    }
+  }
+}
+function listHubMcpTools() {
+  const tools = [];
+  for (const entry of connectedClients.values()) {
+    for (const tool of entry.remoteTools) {
+      tools.push(toOpenAiTool(entry.serverIndex, tool));
+    }
+  }
+  return tools;
+}
+async function callHubMcpTool(prefixedName, args) {
+  const decoded = decodeHubMcpToolName(prefixedName);
+  if (!decoded) {
+    return JSON.stringify({ error: `Unknown hub MCP tool: ${prefixedName}` });
+  }
+  const entry = connectedClients.get(decoded.serverIndex);
+  if (!entry) {
+    return JSON.stringify({ error: `Hub MCP server ${decoded.serverIndex} is not connected.` });
+  }
+  try {
+    const result = await entry.client.callTool({
+      name: decoded.toolName,
+      arguments: args ?? {}
+    });
+    if (result.isError) {
+      return JSON.stringify({
+        error: flattenMcpToolContent(result.content)
+      });
+    }
+    return flattenMcpToolContent(result.content);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "MCP tool execution failed.";
+    return JSON.stringify({ error: message });
+  }
+}
+async function disposeHubMcpConnections() {
+  const closePromises = [...connectedClients.values()].map(async (entry) => {
+    try {
+      await entry.client.close();
+    } catch {
+    }
+  });
+  connectedClients.clear();
+  activeConfigSignature = "";
+  await Promise.allSettled(closePromises);
+}
+
+// src/server/llm/agent.ts
+var HUB_CHAT_STEP_MAX_ITERATIONS = 8;
+function addUsage(current, next) {
+  return {
+    promptTokens: current.promptTokens + next.promptTokens,
+    completionTokens: current.completionTokens + next.completionTokens,
+    totalTokens: current.totalTokens + next.totalTokens
+  };
+}
+function parseToolArguments(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+async function runHubChatStep(config, input, deps = {}) {
+  const runCompletion = deps.runCompletion ?? runLlmCompletion;
+  const ensureConnections = deps.ensureConnections ?? ensureHubMcpConnections;
+  const listTools = deps.listTools ?? listHubMcpTools;
+  const callTool = deps.callTool ?? callHubMcpTool;
+  await ensureConnections(config);
+  const hubTools = listTools();
+  const mergedTools = hubTools.length > 0 || (input.tools?.length ?? 0) > 0 ? [...hubTools, ...input.tools ?? []] : void 0;
+  let messages = [...input.messages];
+  let usage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
+  let lastContent = null;
+  for (let iteration = 0; iteration < HUB_CHAT_STEP_MAX_ITERATIONS; iteration += 1) {
+    const result = await runCompletion(config, {
+      model: input.model,
+      messages,
+      systemPrompt: input.systemPrompt,
+      tools: mergedTools
+    });
+    usage = addUsage(usage, result.usage);
+    lastContent = result.content;
+    const toolCalls = result.toolCalls ?? [];
+    if (toolCalls.length === 0) {
+      return {
+        content: result.content,
+        usage
+      };
+    }
+    const hubCalls = toolCalls.filter((call) => isHubMcpToolName(call.name));
+    const passthroughCalls = toolCalls.filter((call) => !isHubMcpToolName(call.name));
+    if (passthroughCalls.length > 0) {
+      return {
+        content: result.content,
+        toolCalls: passthroughCalls,
+        usage
+      };
+    }
+    messages = [
+      ...messages,
+      {
+        role: "assistant",
+        content: result.content,
+        tool_calls: hubCalls
+      }
+    ];
+    for (const call of hubCalls) {
+      const toolResult = await callTool(call.name, parseToolArguments(call.arguments));
+      messages.push({
+        role: "tool",
+        tool_call_id: call.id,
+        content: toolResult
+      });
+    }
+  }
+  return {
+    content: lastContent,
+    usage
+  };
+}
+
 // src/server/routes/llm.ts
 function sendMonthlyLimitExceeded(reply) {
   return reply.code(402).send({
@@ -8333,7 +9541,7 @@ async function registerLlmRoutes(app, options) {
       if (isNewTurn && isOverMonthlyLimit(totalTokens, user.llmMonthlyTokenLimit)) {
         return sendMonthlyLimitExceeded(reply);
       }
-      const result = await runLlmCompletion(llm, {
+      const result = await runHubChatStep(llm, {
         model,
         messages,
         tools,
@@ -8481,6 +9689,7 @@ async function registerProtectedRoutes(app, options) {
   });
   await registerCollectionRoutes(app, options.db);
   await registerEnvironmentRoutes(app, options.db);
+  await registerSnippetRoutes(app, options.db);
   await registerFolderRoutes(app, options.db);
   await registerRequestRoutes(app, options.db);
   await registerLlmRoutes(app, { db: options.db, getLlm: options.getLlm });
@@ -8825,6 +10034,7 @@ function registerGracefulShutdown(app, ctx) {
   const shutdown = async (signal) => {
     app.log.info(`Received ${signal}, shutting down.`);
     await app.close();
+    await disposeHubMcpConnections();
     await disconnectAll(ctx);
     process.exit(0);
   };