@indx-workspace/embedded 0.0.0-bootstrap → 0.3.0

package/dist/web/.next-embedded/server/chunks/5173.js

@@ -0,0 +1 @@
+"use strict";exports.id=5173,exports.ids=[5173],exports.modules={17337:(a,b,c)=>{c.d(b,{cg:()=>e});let d=globalThis;function e(){return d.__agentWorkspaceRbacRuntime__??null}},48704:(a,b,c)=>{c.d(b,{LA:()=>aa,U$:()=>ad,Fq:()=>am,SJ:()=>al,rs:()=>ab,xK:()=>ak,CC:()=>Z,YQ:()=>_,G0:()=>aq,zc:()=>ao});var d=c(97482),e=c(50483);let f=["PATH","HOME"],g=["PATH","USERPROFILE","SystemRoot","TEMP"];function h(a=process.env){let b="win32"===process.platform?g:f,c={};for(let d of b){let b=a[d];void 0!==b&&(c[d]=b)}return c}var i=c(71614),j=c(64957),k=c(77598),l=c(47090);let m=/^3\.[01]\.\d+$/u,n=["get","put","post","delete","options","head","patch","trace"],o=new Set(["simple","form"]),p=/[^A-Za-z0-9_-]+/gu,q=/^_+|_+$/gu,r=/^[^\p{Cc}]{1,200}$/u,s=/\{([^{}]*)\}/gu;function t(a){return"object"==typeof a&&null!==a&&!Array.isArray(a)}function u(a,b="connector_spec_invalid"){return{ok:!1,code:b,details:a}}class v extends Error{}class w extends Error{}function x(a){return Array.isArray(a)?a.flatMap(a=>t(a)&&"string"==typeof a.name&&"string"==typeof a.in?[{name:a.name,in:a.in,required:"boolean"==typeof a.required?a.required:"path"===a.in,..."string"==typeof a.style?{style:a.style}:{},...void 0===a.schema?{}:{schema:a.schema}}]:[]):[]}function y(a){return a.replace(p,"_")}function z(a,b,c,d){return{status:a,body:{error:{code:b,message:c,details:[...d]}}}}let A=async a=>{let b=await (0,i.ek)(a,(0,i.HK)());return b.ok?{ok:!0}:{ok:!1,reason:b.reason}};function B(a,b){return{ok:!1,result:z(j.mX[a],a,"The connector could not be registered from this body.",b)}}function C(a,b,c){return{status:200,body:{ok:!0,kind:"ok",message:`The ${a} connector is valid; nothing was saved.`,serverName:b,serverVersion:null,toolCount:c}}}async function D(a,b=A){let c=j.wx.safeParse(a);if(!c.success){let a=c.error.issues,b=a.map(a=>0===a.path.length?a.message:`${a.path.map(String).join(".")}: ${a.message}`),d=a.map(j.Le),e=d[0];return null==e||d.includes(null)?{ok:!1,result:z(400,"invalid_body","The connector could not be created from this body.",b)}:B(e,b)}let d=c.data,e=!0===d.dryRun;if("postgres"===d.kind){let a=new URL(d.credential).hostname;return(await b(`https://${a}/`)).ok?{ok:!0,dryRun:e,dryRunResult:C("postgres",null,j.Q3.length),write:{kind:"postgres",name:d.name,toolConfig:{postgres:{tables:[...d.tables],readOnly:d.readOnly,maxRows:d.maxRows}},credential:d.credential}}:B("connector_spec_invalid",["credential: the database host is refused by the egress policy"])}let f=function(a){var b,c;let d,e,f,g;try{d=(0,l.qg)(a.document,{maxAliasCount:100,logLevel:"error"})}catch{return u(["document: is not a valid JSON or YAML document (duplicate keys included)"])}if(!t(d))return u(["document: must be an object"]);let h=d.openapi;if("string"!=typeof h||!m.test(h))return u(["document.openapi: must be an OpenAPI 3.0.x or 3.1.x version"]);try{let a,c,f;b=d,a=[],c=0,e={value:(f=(d,e,g)=>{if((c+=1)>1e5)throw new v;if(g>512)throw new w;if(Array.isArray(d))return d.map(a=>f(a,e,g+1));if(!t(d))return d;let h=d.$ref;if("string"==typeof h){if(!h.startsWith("#/"))return a.push(`$ref ${JSON.stringify(h)}: only references within the document are supported`),{};if(e.includes(h)||e.length>=32)return{};let c=function(a,b){let c=a;for(let a of b.slice(2).split("/")){let b;try{b=decodeURIComponent(a)}catch{return}if(b=b.replaceAll("~1","/").replaceAll("~0","~"),Array.isArray(c))c=c[Number(b)];else{if(!(t(c)&&Object.hasOwn(c,b)))return;c=c[b]}}return c}(b,h);return void 0===c?(a.push(`$ref ${JSON.stringify(h)}: names nothing in the document`),{}):f(c,[...e,h],g+1)}return Object.fromEntries(Object.entries(d).map(([a,b])=>[a,f(b,e,g+1)]))})(b,[],0),problems:a}}catch(a){if(a instanceof v)return u([`document: expands beyond ${String(1e5)} nodes`]);if(a instanceof w)return u([`document: nests deeper than ${String(512)} levels`]);throw a}if(e.problems.length>0)return u(e.problems);let i=e.value,p=i.paths;if(!t(p))return u(["document.paths: must be an object"]);let z=Object.entries(p).flatMap(([a,b])=>{if(!t(b))return[];let c=x(b.parameters);return n.flatMap(d=>{let e=b[d];if(!t(e))return[];let f=x(e.parameters),g=[...c.filter(a=>!f.some(b=>b.name===a.name&&b.in===a.in)),...f],h=e.operationId;return[{method:d.toUpperCase(),path:a,..."string"==typeof h?{operationId:h}:{},parameters:g}]})});if(z.length>j.Rx)return u([`document: has ${String(z.length)} operations; at most ${String(j.Rx)} are supported`]);let A=(0,j.zh)(a.allow,z);if(A.refusals.length>0){let a=A.refusals.some(a=>"connector_write_unsupported"===a.code);return u(A.refusals.map(a=>`${a.path.join(".")}: ${a.message}`),a?"connector_write_unsupported":"connector_spec_invalid")}let B=A.admitted.flatMap(a=>a.parameters.filter(a=>void 0!==a.style&&!o.has(a.style)).map(b=>`${a.method} ${a.path}: parameter ${JSON.stringify(b.name)} uses style ${JSON.stringify(b.style)}; only simple and form are supported`));if(B.length>0)return u(B);let C=new Map,D=[];for(let a of A.admitted){let b=function(a){let b=void 0===a.operationId?"":y(a.operationId);if(b.length>=1&&b.length<=j.d)return b;let c=y(a.path).replace(q,"");return`${a.method.toLowerCase()}_${c}`.slice(0,j.d).replace(q,"")}(a),c=C.get(b);void 0===c?C.set(b,a):D.push(`operations: ${JSON.stringify(b)} names both ${c.method} ${c.path} and ${a.method} ${a.path}`)}if(D.length>0)return u(D,"connector_tool_name_collision");let E=a.baseUrl;if(void 0===E){let a=function(a){let b=a.servers,c=Array.isArray(b)?b[0]:void 0;if(!t(c)||"string"!=typeof c.url)return{problem:"servers: the document names no server and the body sends no baseUrl"};let d=t(c.variables)?c.variables:{},e=[],f=c.url.replace(s,(a,b)=>{let c=d[b];return t(c)&&"string"==typeof c.default?c.default:(e.push(b),"")});if(e.length>0)return{problem:`servers: variable ${JSON.stringify(e[0])} has no default`};let g=URL.canParse(f)?new URL(f):null;return null===g||"http:"!==g.protocol&&"https:"!==g.protocol?{problem:"servers: servers[0].url is not an absolute http or https URL"}:{url:f}}(i);if("problem"in a)return u([a.problem]);E=a.url}let F=void 0===a.baseUrl,G=Object.fromEntries([...C].map(([a,b])=>[a,b.parameters])),H=!1;if(JSON.stringify(G,(a,b)=>((a.includes("\0")||"string"==typeof b&&b.includes("\0"))&&(H=!0),b)),H)return u(["document: a parameter holds U+0000, which cannot be stored"]);let I=j.Ks.safeParse({spec:(c=a.document,g=t(f=d.info)?f.title:void 0,{digest:`sha256:${(0,k.createHash)("sha256").update(c,"utf8").digest("hex")}`,bytes:Buffer.byteLength(c,"utf8"),..."string"==typeof g&&r.test(g)?{title:g}:{}}),baseUrl:E,auth:a.auth,allow:a.allow,operations:[...C].map(([a,b])=>({name:a,method:b.method,path:b.path}))});if(!I.success){let a=I.error.issues,b=a.map(j.Le).find(a=>null!==a)??"connector_spec_invalid";return u(a.map(a=>{let b=a.path.map(String);return F&&"baseUrl"===b[0]&&(b[0]="servers"),`${b.join(".")}: ${a.message}`}),b)}return{ok:!0,openapi:I.data,parameters:G,baseUrlFromServers:F}}({document:d.document,baseUrl:d.baseUrl,allow:d.allow,auth:d.auth});if(!f.ok)return B(f.code,f.details);let g=await b(f.openapi.baseUrl);if(!g.ok){let a=f.baseUrlFromServers?"servers":"baseUrl";return B("connector_spec_invalid",[`${a}: is not reachable: ${g.reason}`])}return{ok:!0,dryRun:e,dryRunResult:C("openapi",f.openapi.spec.title??null,f.openapi.operations.length),write:{kind:"openapi",name:d.name,toolConfig:{openapi:f.openapi,parameters:f.parameters},credential:d.credential??null}}}let E=new Set(["ECONNREFUSED","ENOTFOUND","EAI_AGAIN","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EPIPE","UND_ERR_CONNECT_TIMEOUT","UND_ERR_HEADERS_TIMEOUT","UND_ERR_SOCKET"]),F={ok:()=>"Connected. The server answered and accepted the credential.","auth-required":()=>"The server is reachable but requires authentication. Choose an authentication method and supply a credential.","credential-rejected":()=>"The server was reached, but it rejected the credential. The address or command is correct — check the token, API key or environment variable.","credential-insufficient-scope":()=>"The server is reachable and the credential is valid, but it is not permitted to use this server. Ask for wider scope.",unreachable:a=>`Could not reach the server at ${a.target??"(unknown target)"}. Check the address and that it is reachable from this deployment.`,"endpoint-not-mcp":a=>null===a.status?`"${a.command??a.target??"(unknown)"}" answered, but not as an MCP server — it did not implement the MCP handshake.`:`${a.target??"(unknown target)"} answered, but not as an MCP server (HTTP ${String(a.status)}). Check the URL — and whether this server uses the HTTP or the SSE transport.`,"tls-error":a=>`Could not establish a secure connection to ${a.target??"(unknown target)"}. The TLS certificate or protocol was rejected.`,"command-not-found":a=>`The command "${a.command??""}" could not be run. Check that it is installed and on the PATH of the runner.`,"process-died":a=>`The command "${a.command??""}" started but stopped before answering. Check the runner's own logs for details — for safety, this message never repeats anything the command wrote to its own output.`,timeout:a=>`No answer within ${String(a.timeoutMs/1e3)} seconds. The server may be starting slowly, or unreachable behind a firewall that drops rather than refuses.`,"protocol-version-unsupported":a=>`The server speaks MCP protocol version ${a.serverVersion??"(unrecognised)"}, which this deployment does not support.`,"server-error":a=>`${a.target??"(unknown target)"} returned HTTP ${String(a.status??"")}. The server is reachable but failing.`,"rate-limited":a=>`${a.target??"(unknown target)"} is rate-limiting this deployment (HTTP 429). Try again shortly.`,"http-error":a=>`${a.target??"(unknown target)"} returned HTTP ${String(a.status??"")}.`,"server-refused":a=>`The server refused the connection: ${a.detail||"no reason given"}.`,"sse-stream-failed":a=>`${a.target??"(unknown target)"} did not open an SSE stream, and the transport gave no machine-readable reason: ${a.detail}`,"unknown-failure":a=>`The connection failed for a reason this probe does not recognise: ${a.detail}`,"stdio-probe-unavailable":a=>`Test Connection cannot run a stdio server in this deployment: doing so would execute "${a.command??"(no command)"}" directly in the control plane, and there is no sandboxed runner here to execute it safely instead. This connector is saved when you press Save — only the stdio probe is unavailable until the sandboxed runner (Wave 3's runtime layer) exists.`};class G extends Error{constructor(a,b){super(b),this.name="ProbeError",this.signal=a}}let H=["2025-11-25","2025-06-18","2025-03-26","2024-11-05","2024-10-07"];function I(a){return{jsonrpc:"2.0",id:a,method:"initialize",params:{protocolVersion:"2025-11-25",capabilities:{},clientInfo:{name:"agent-workspace-connection-test",version:"1"}}}}function J(){return{jsonrpc:"2.0",method:"notifications/initialized"}}function K(a){return{jsonrpc:"2.0",id:a,method:"tools/list",params:{}}}function L(a){if("object"!=typeof a||null===a||"2.0"!==a.jsonrpc)return null;if("error"in a){let b=a.error;if("object"!=typeof b||null===b||"number"!=typeof b.code||"string"!=typeof b.message)return null;let c=a.id;return"number"!=typeof c&&"string"!=typeof c&&null!=c?null:{kind:"error",id:void 0===c?null:c,error:"data"in b?{code:b.code,message:b.message,data:b.data}:{code:b.code,message:b.message}}}if("result"in a){let b=a.id;return"number"!=typeof b&&"string"!=typeof b?null:{kind:"result",id:b,result:a.result}}return null}function M(a){if("object"!=typeof a||null===a)return{protocolVersion:null,serverName:null,serverVersion:null};let b="string"==typeof a.protocolVersion?a.protocolVersion:null,c=a.serverInfo,d=null,e=null;return"object"==typeof c&&null!==c&&("string"==typeof c.name&&(d=c.name),"string"==typeof c.version&&(e=c.version)),{protocolVersion:b,serverName:d,serverVersion:e}}function N(a){if("object"!=typeof a||null===a)return 0;let b=a.tools;return Array.isArray(b)?b.length:0}let O=new Set(["ECONNREFUSED","ENOTFOUND","EAI_AGAIN","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EPIPE","UND_ERR_CONNECT_TIMEOUT","UND_ERR_HEADERS_TIMEOUT","UND_ERR_SOCKET"]);function P(a){let b=function(a){let b=a;for(let a=0;a<8&&"object"==typeof b&&null!==b;a+=1){let a=b.code;if("string"==typeof a)return a;b=b.cause}return null}(a);return null!==b&&(b.startsWith("ERR_SSL_")||b.startsWith("ERR_TLS_")||"DEPTH_ZERO_SELF_SIGNED_CERT"===b||"SELF_SIGNED_CERT_IN_CHAIN"===b||"CERT_HAS_EXPIRED"===b||"ERR_TLS_CERT_ALTNAME_INVALID"===b)?{kind:"tls-error",code:b}:null!==b&&O.has(b)?{kind:"network-error",code:b}:{kind:"unknown",detail:a instanceof Error?a.message:String(a)}}let Q="application/json",R="text/event-stream";async function S(a,b,c,d,e){let f,g={...b,"content-type":Q,accept:`${Q}, ${R}`};null!==e&&(g["mcp-session-id"]=e);try{f=await fetch(a,{method:"POST",headers:g,body:JSON.stringify(c),signal:d,redirect:"error"})}catch(b){throw new G(P(b),`POST ${a} failed`)}let h=f.headers.get("mcp-session-id")??e;return{response:f,sessionId:h}}async function T(a,b){let c;if(!a.ok)throw new G({kind:"http-status",status:a.status},`${b} -> HTTP ${String(a.status)}`);let d=(a.headers.get("content-type")??"").split(";")[0]?.trim().toLowerCase()??"",e=await a.text();if(d===Q)try{c=JSON.parse(e)}catch{throw new G({kind:"not-json-rpc"},`${b} did not return valid JSON`)}else if(d===R){let a=function(a){for(let b of a.split("\n\n"))for(let a of b.split("\n")){let b=a.trimStart();if(b.startsWith("data:")){let a=b.slice(5).trim();try{return JSON.parse(a)}catch{return null}}}return null}(e);if(null===a)throw new G({kind:"not-json-rpc"},`${b} opened an event stream with no JSON-RPC frame`);c=a}else throw new G({kind:"not-json-rpc"},`${b} answered with content-type ${JSON.stringify(d)}`);let f=L(c);if(null===f)throw new G({kind:"not-json-rpc"},`${b} did not answer with a JSON-RPC 2.0 frame`);if("error"===f.kind){let{code:a,message:b}=f.error;if(a<=-32e3&&a>=-32099)throw new G({kind:"json-rpc-app-error",code:a,message:b},b);throw new G({kind:"json-rpc-protocol-error",code:a},b)}return f}async function U(a,b,c){let d=await S(a,b,I(1),c,null),{protocolVersion:e,serverName:f,serverVersion:g}=M((await T(d.response,a)).result);if(null!==e&&!H.includes(e))throw new G({kind:"protocol-version-unsupported",version:e},`unsupported protocol version ${e}`);await S(a,b,J(),c,d.sessionId).catch(()=>void 0);let h=await S(a,b,K(2),c,d.sessionId);return{serverName:f,serverVersion:g,toolCount:N((await T(h.response,a)).result)}}let V="text/event-stream";function W(a,b){return a<=-32e3&&a>=-32099?new G({kind:"json-rpc-app-error",code:a,message:b},b):new G({kind:"json-rpc-protocol-error",code:a},b)}async function X(a,b,c){let d;try{d=await fetch(a,{method:"GET",headers:{...b,accept:V},signal:c,redirect:"error"})}catch(b){throw new G(P(b),`GET ${a} failed`)}if(!d.ok)throw new G({kind:"http-status",status:d.status},`${a} -> HTTP ${String(d.status)}`);let e=(d.headers.get("content-type")??"").split(";")[0]?.trim().toLowerCase()??"";if(e!==V)throw new G({kind:"not-json-rpc"},`${a} did not open an SSE stream (content-type ${JSON.stringify(e)})`);let f=d.body;if(null===f)throw new G({kind:"sse-transport-error",text:"empty response body"},"empty SSE body");let g=f.getReader(),h=new TextDecoder,i="",j=null,k=null,l=null,m=new Promise((a,b)=>{k=a,l=b}),n=new Map,o=null,p=a=>{for(let{reject:b}of(o??=a,null===j&&l?.(a),n.values()))b(a);n.clear()},q=b=>{let c,d="message",e=[];for(let a of b.split("\n")){let b=a.endsWith("\r")?a.slice(0,-1):a;b.startsWith("event:")?d=b.slice(6).trim():b.startsWith("data:")&&e.push(b.slice(5).trimStart())}if(0===e.length)return;let f=e.join("\n");if("endpoint"===d){if(null===j){let b=new URL(a),c=new URL(f,b);if(c.origin!==b.origin)return void p(new G({kind:"unknown",detail:"the SSE endpoint event named a different origin"},"cross-origin SSE endpoint refused"));j=c.toString(),k?.(j)}return}try{c=JSON.parse(f)}catch{return}let g=L(c);if(null===g||"number"!=typeof g.id)return;let h=n.get(g.id);void 0!==h&&(n.delete(g.id),h.resolve(g))};(async()=>{try{for(;;){let{done:a,value:b}=await g.read();if(a)return void p(new G({kind:"sse-transport-error",text:"stream ended before answering"},"SSE stream ended"));let c=(i+=h.decode(b,{stream:!0})).indexOf("\n\n");for(;-1!==c;)q(i.slice(0,c)),c=(i=i.slice(c+2)).indexOf("\n\n")}}catch(a){if(c.aborted)return;p(new G(P(a),"SSE stream read failed"))}})().catch(()=>void 0);let r=async a=>{let d;if(null===j)throw new G({kind:"unknown",detail:"no SSE endpoint yet"},"no SSE endpoint received");try{d=await fetch(j,{method:"POST",headers:{...b,"content-type":"application/json"},body:JSON.stringify(a),signal:c,redirect:"error"})}catch(a){throw new G(P(a),`POST ${j} failed`)}if(!d.ok)throw new G({kind:"http-status",status:d.status},`${j} -> HTTP ${String(d.status)}`)},s=(a,b)=>null!==o?Promise.reject(o):new Promise((c,d)=>{n.set(a,{resolve:c,reject:d}),r(b).catch(b=>{n.delete(a),d(b instanceof Error?b:Error(String(b)))})});try{await m;let a=await s(1,I(1));if("error"===a.kind)throw W(a.error.code,a.error.message);let{protocolVersion:b,serverName:c,serverVersion:d}=M(a.result);if(null!==b&&!H.includes(b))throw new G({kind:"protocol-version-unsupported",version:b},`unsupported protocol version ${b}`);await r(J()).catch(()=>void 0);let e=await s(2,K(2));if("error"===e.kind)throw W(e.error.code,e.error.message);return{serverName:c,serverVersion:d,toolCount:N(e.result)}}finally{try{await g.cancel()}catch{}}}async function Y(a,b){let c,d;if(void 0===b.baseEnv)throw Error("testConnection: options.baseEnv is required and was not provided. Refusing to fall back to process.env (that fallback is the credential leak this signature exists to prevent) — pass an explicit environment, e.g. restrictedBaseEnv() from ./base-env.");if("stdio"===a.transport)return{ok:!1,kind:"stdio-probe-unavailable",message:F["stdio-probe-unavailable"]({target:a.command,command:a.command,status:null,timeoutMs:b.timeoutMs??1e4,stderr:null,detail:"",serverVersion:null})};let e=b.timeoutMs??1e4,f=(d=new AbortController,{promise:new Promise((a,b)=>{c=setTimeout(()=>{d.abort(),b(new G({kind:"timeout"},`no answer within ${String(e)}ms`))},e)}),cancel:()=>{clearTimeout(c)},signal:d.signal}),g=a.url;try{let b="http"===a.transport?await Promise.race([U(a.url,a.headers,f.signal),f.promise]):await Promise.race([X(a.url,a.headers,f.signal),f.promise]);return{ok:!0,kind:"ok",message:F.ok({target:g,command:null,status:null,timeoutMs:e,stderr:null,detail:"",serverVersion:b.serverVersion}),serverName:b.serverName,serverVersion:b.serverVersion,toolCount:b.toolCount}}catch(f){let b=f instanceof G?f.signal:{kind:"unknown",detail:f instanceof Error?f.message:String(f)},c=function(a,b){switch(a.kind){case"http-status":{let{status:c}=a;if(401===c)return b.credentialConfigured?"credential-rejected":"auth-required";if(403===c)return"credential-insufficient-scope";if(404===c||405===c||400===c)return"endpoint-not-mcp";if(429===c)return"rate-limited";if(c>=500)return"server-error";return"http-error"}case"json-rpc-app-error":return b.credentialConfigured?"credential-rejected":"server-refused";case"json-rpc-protocol-error":case"not-json-rpc":return"endpoint-not-mcp";case"network-error":return"unreachable";case"tls-error":return"tls-error";case"sse-transport-error":{let b=a.text;for(let a of E)if(b.includes(a))return"unreachable";for(let a of["ERR_SSL_","ERR_TLS_","CERT_HAS_EXPIRED","SELF_SIGNED_CERT"])if(b.includes(a))return"tls-error";return"sse-stream-failed"}case"spawn-error":return"ENOENT"===a.code||"EACCES"===a.code?"command-not-found":"unknown-failure";case"process-died":return"process-died";case"protocol-version-unsupported":return"protocol-version-unsupported";case"timeout":return"timeout";case"unknown":return"unknown-failure";default:return a}}(b,{credentialConfigured:a.credentialConfigured}),d={target:g,command:null,status:"http-status"===b.kind?b.status:null,timeoutMs:e,stderr:"process-died"===b.kind?b.stderr:null,detail:function(a,b){switch(a.kind){case"json-rpc-app-error":return a.message;case"json-rpc-protocol-error":return`JSON-RPC error ${String(a.code)}`;case"sse-transport-error":return a.text;case"unknown":return a.detail;case"network-error":case"tls-error":case"spawn-error":return a.code;case"process-died":return a.stderr??`exit code ${String(a.exitCode)}`;case"protocol-version-unsupported":return a.version;default:return b}}(b,f instanceof Error?f.message:String(f)),serverVersion:"protocol-version-unsupported"===b.kind?b.version:null};return{ok:!1,kind:c,message:F[c](d)}}finally{f.cancel()}}function Z(a,b,c,d){return{status:a,body:{error:void 0===d||0===d.length?{code:b,message:c}:{code:b,message:c,details:[...d]}}}}let $=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;function _(a){return"string"==typeof a&&$.test(a)?{ok:!0,id:a}:{ok:!1,result:Z(400,"invalid_connector_id","The connector id in the path is not a UUID.")}}function aa(){return Z(404,"connector_not_found","This workspace has no connector with that id.")}function ab(a){return"object"==typeof a&&null!==a&&!0===a.dryRun}function ac(a){return{status:200,body:a}}async function ad(a,b,c,d=A){if("object"==typeof b&&null!==b&&"dryRun"in b&&"boolean"!=typeof b.dryRun)return Z(400,"invalid_body",'"dryRun" must be a boolean when supplied.');let f=(0,e.fc)(b);if(null===f)return Z(400,"connector_kind_unsupported","This server does not create that kind of connector.",[e.Gr]);if("mcp"!==f)return ag(a,b,c,d);let g=(0,e.Tw)(b);if(!g.ok)return Z(400,"invalid_body","The connector could not be created from this body.",g.errors);if(ab(b))return ac(await Y(function(a){let b=(0,e.N3)(a.transport,a.authType),c=null!==b&&null!==a.credential;if("stdio"===a.transport){let d={};return b?.kind==="env"&&null!==a.credential&&(d[b.name]=a.credential),{transport:"stdio",command:a.command??"",args:a.args??[],env:d,credentialConfigured:c}}let d={};return b?.kind==="header"&&null!==a.credential&&(d[b.name]=(0,e.qz)(a.authType,a.credential)),{transport:a.transport,url:a.url??"",headers:d,credentialConfigured:c}}(g.value),{baseEnv:h()}));if(null===c)return ae();let i=await a.create(g.value,c);switch(i.kind){case"created":var j;return{status:201,body:{id:(j=i.server).id,workspaceId:j.workspaceId,name:j.name,transport:j.transport,command:j.command,args:j.args,url:j.url,authType:j.authType,hasCredential:null!==j.credentialSecretId,enabled:j.enabled,createdBy:j.createdBy,ownerPrincipalId:j.ownerPrincipalId,createdAt:j.createdAt.toISOString(),updatedAt:j.updatedAt.toISOString()}};case"name-conflict":return af(i.name);case"unknown-credential-secret":return Z(500,"credential_secret_missing","The credential could not be sealed as a secret before the connector row was created.");default:return Z(500,"unhandled_store_outcome",`The store returned an outcome this route does not handle: ${JSON.stringify(i)}.`)}}function ae(){return Z(500,"connector_owner_missing","Persisting a connector requires an authenticated owner principal.")}function af(a){return Z(409,"connector_name_conflict",`This workspace already has a connector named ${JSON.stringify(a)}.`)}async function ag(a,b,c,d){let e=await D(b,d);if(!e.ok)return e.result;if(e.dryRun)return e.dryRunResult;if(null===c)return ae();let f=await a.createToolConnector(e.write,c);return"created"===f.kind?{status:201,body:f.connector}:af(f.name)}function ah(a){switch(a.kind){case"updated":return{status:200,body:a.connector};case"not-found":return aa();case"name-conflict":return af(a.name);default:return Z(500,"unhandled_store_outcome",JSON.stringify(a))}}async function ai(a,b,c,e){if("object"!=typeof c||null===c||Array.isArray(c))return Z(400,"invalid_body","The request body must be a JSON object.");if("kind"in c){if(c.kind!==b.kind)return Z(400,"invalid_body","The connector could not be updated from this body.",["kind: a connector's kind cannot change"]);let d=await D(c,e);return d.ok?d.dryRun?d.dryRunResult:ah(await a.replaceToolConnector(b.id,d.write)):d.result}let f=Object.keys(c).filter(a=>"name"!==a&&"enabled"!==a),g=d.$1.safeParse(c),h=g.success?g.data.name:void 0;return f.length>0||!g.success||h?.trim()===""||void 0!==h&&aj.test(h)?Z(400,"invalid_body","The connector could not be updated from this body.",f.length>0?f.map(a=>`${JSON.stringify(a)} is not valid for a ${b.kind} connector; send the full ${b.kind} body with kind`):["name and enabled: send a non-blank name of at most 200 characters without control or bidirectional formatting characters, or a boolean"]):ah(await a.replaceToolConnector(b.id,{...void 0===h?{}:{name:h},...void 0===g.data.enabled?{}:{enabled:g.data.enabled}}))}let aj=/[\p{Cc}\u200E\u200F\u202A-\u202E\u2066-\u2069]/u;async function ak(a){return{status:200,body:{connectors:await a.list()}}}async function al(a,b){let c=_(b);if(!c.ok)return c.result;let d=await a.get(c.id);return null===d?aa():{status:200,body:d}}async function am(a,b){let c=_(b);if(!c.ok)return c.result;let d=await a.delete(c.id);switch(d.kind){case"deleted":return{status:204,body:null};case"not-found":return aa();default:return Z(500,"unhandled_store_outcome",`The store returned an outcome this route does not handle: ${JSON.stringify(d)}.`)}}async function an(a,b,c){let d=_(b);if(!d.ok)return d.result;if("object"!=typeof c||null===c||Array.isArray(c))return Z(400,"invalid_body","The request body must be a JSON object.");let e=Object.keys(c);if(1!==e.length||"credential"!==e[0])return Z(400,"invalid_body",'Credential rotation accepts exactly one field: a non-blank "credential" string.');let f=c.credential;if("string"!=typeof f||""===f.trim())return Z(400,"invalid_credential",'"credential" must be a non-blank string.');let g=await a.rotateCredential(d.id,f);switch(g.kind){case"rotated":return{status:200,body:g.connector};case"not-found":return aa();case"credential-not-configured":return ap();default:return Z(500,"unhandled_store_outcome",JSON.stringify(g))}}async function ao(a,b,c,e=A){let f=_(b);if(!f.ok)return f.result;let g=await a.get(f.id);if(null!==g&&null===g.transport)return ai(a,g,c,e);if(function(a){if("object"!=typeof a||null===a||Array.isArray(a))return!1;let b=Object.keys(a);return 1===b.length&&"credential"===b[0]}(c))return an(a,b,c);let h=d.$1.safeParse(c);if(!h.success)return Z(400,"invalid_body","The connector could not be updated from this body.",h.error.issues.map(a=>0===a.path.length?a.message:`${a.path.map(String).join(".")}: ${a.message}`));let i=h.data,j={...void 0===i.name?{}:{name:i.name},...void 0===i.enabled?{}:{enabled:i.enabled},...void 0===i.command?{}:{command:i.command},...void 0===i.args?{}:{args:i.args},...void 0===i.url?{}:{url:i.url},...void 0===i.authType?{}:{authType:i.authType},...void 0===i.credential?{}:{credential:i.credential}};if(null===g)return aa();let k=function(a,b){var c,d,e,f;let g,h,i=[];"stdio"===a.transport?void 0!==b.url&&i.push('"url" is not valid for a stdio connector'):(void 0!==b.command&&i.push('"command" is not valid for a remote connector'),void 0!==b.args&&i.push('"args" is not valid for a remote connector'));let j=b.authType??a.authType;if("none"===j&&void 0!==b.credential){if(void 0===b.authType&&0===i.length)return{kind:"credential-not-configured"};i.push('"credential" must not be supplied when "authType" is "none"')}return("none"===j||a.hasCredential||void 0!==b.credential||i.push(`"credential" is required when "authType" changes from "none" to ${JSON.stringify(j)}`),i.length>0)?{kind:"invalid",errors:i}:a.hasCredential&&"none"!==j&&void 0===b.credential&&(c=a,void 0!==(d=b).url&&d.url!==c.url||void 0!==d.command&&d.command!==c.command||void 0!==d.args&&(e=c.args,f=d.args,g=e??[],h=f??[],g.length!==h.length||g.some((a,b)=>a!==h[b])))?{kind:"credential-required-on-retarget"}:null}(g,j);if(k?.kind==="credential-not-configured")return ap();if(k?.kind==="credential-required-on-retarget")return Z(409,"credential_required_on_retarget",'This change moves where the connector sends its saved credential. Send a new "credential" in the same request; the saved one is never sent to a new destination.');if(null!==k)return Z(400,"invalid_body","The connector could not be updated from this body.",k.errors);let l=await a.update(f.id,j);switch(l.kind){case"updated":return{status:200,body:l.connector};case"not-found":return aa();case"name-conflict":return af(l.name);default:return Z(500,"unhandled_store_outcome",JSON.stringify(l))}}function ap(){return Z(409,"credential_not_configured",'This connector has no credential slot to rotate. Set an authenticated "authType" with the credential.')}async function aq(a,b){let c=_(b);if(!c.ok)return c.result;let d=await a.resolveForProbe(c.id);return null===d?aa():ac(await Y(d,{baseEnv:h()}))}},50483:(a,b,c)=>{c.d(b,{Gr:()=>k,N3:()=>f,Tw:()=>j,fc:()=>l,qz:()=>g});let d=["stdio","http","sse"],e=["none","api-key","bearer","oauth"];function f(a,b){return"none"===b?null:"stdio"===a?{kind:"env",name:"MCP_CREDENTIAL"}:"bearer"===b||"oauth"===b?{kind:"header",name:"Authorization"}:{kind:"header",name:"X-Api-Key"}}function g(a,b){return"bearer"===a||"oauth"===a?`Bearer ${b}`:b}let h=/^.{1,200}$/u;function i(a){return d.includes(a)}function j(a){let b=[];if("object"!=typeof a||null===a)return{ok:!1,errors:["the request body must be a JSON object"]};let c=a.name;"string"==typeof c&&h.test(c)||b.push('"name" must be a non-empty string of at most 200 characters');let f=a.transport;"string"==typeof f&&i(f)||b.push(`"transport" must be one of ${d.join(", ")}`);let g=a.authType??"none";"string"==typeof g&&e.includes(g)||b.push(`"authType" must be one of ${e.join(", ")}`);let j=null,k=null,l=null;if("string"==typeof f&&i(f)){let c="stdio"===f,d=a.command,e=a.url,g=a.args;c?("string"!=typeof d||""===d.trim()?b.push('"command" is required and must be non-blank for a stdio connector'):j=d,void 0!==g&&(Array.isArray(g)&&g.every(a=>"string"==typeof a)?k=g:b.push('"args" must be an array of strings')),void 0!==e&&b.push('"url" is not valid for a stdio connector')):("string"==typeof e&&/^https?:\/\//u.test(e)?l=e:b.push('"url" is required and must be an absolute http(s) URL for a remote connector'),void 0!==d&&b.push('"command" is not valid for a remote connector'),void 0!==g&&b.push('"args" is not valid for a remote connector'))}let m=null;if("string"==typeof g&&"none"!==g){let c=a.credential;"string"!=typeof c||""===c.trim()?b.push(`"credential" is required when "authType" is ${JSON.stringify(g)}`):m=c}else void 0!==a.credential&&b.push('"credential" must not be supplied when "authType" is "none"');return b.length>0?{ok:!1,errors:b}:{ok:!0,value:{name:c,transport:f,command:j,args:k,url:l,authType:g,credential:m}}}let k='"kind" must be one of mcp, openapi, postgres';function l(a){if("object"!=typeof a||null===a||!("kind"in a))return"mcp";let b=a.kind;return"mcp"===b||"openapi"===b||"postgres"===b?b:null}},61701:(a,b,c)=>{c.d(b,{R_:()=>m,U7:()=>k,Zr:()=>j,aD:()=>n,gT:()=>i,tD:()=>l});var d=c(97482),e=c(50483),f=c(48704),g=c(85265),h=c(99711);async function i(a){let b=await (0,h.OP)(a,{maxBytes:d.Bx,problem:f.CC});if(!b.ok)return b;let c=d.tm[(0,e.fc)(b.value)??"mcp"];return b.bytes>c?{ok:!1,result:(0,f.CC)(413,"request_body_too_large",`This route reads at most ${String(c)} bytes of request body for this connector kind; the request sent ${String(b.bytes)}.`)}:{ok:!0,value:b.value}}function j(a){return(0,h.Dj)(a)}let k=()=>(0,f.CC)(503,"connectors_runtime_not_configured","The connectors API has no store or workspace resolver wired into it. This deployment cannot serve connector requests; it is not that the request was rejected.");async function l(a,b,c){let d=(0,g.CJ)();if(null===d)return k();if(void 0!==c)return b(d.connectors.forWorkspace(c),{recordAudit:b=>d.recordAudit(a,b),workspaceId:c,identifyActor:()=>d.identifyActor(a)});let e=await d.resolveWorkspace(a);switch(e.kind){case"workspace":return b(d.connectors.forWorkspace(e.workspaceId),{recordAudit:b=>d.recordAudit(a,b),workspaceId:e.workspaceId,identifyActor:()=>d.identifyActor(a)});case"unauthenticated":return(0,f.CC)(401,"unauthenticated",e.reason);case"forbidden":return(0,f.CC)(403,"forbidden",e.reason);default:return(0,f.CC)(500,"unhandled_workspace_resolution",`The workspace resolver returned a case this route does not handle: ${JSON.stringify(e)}.`)}}async function m(a,b,c){let d=(0,g.CJ)();if(null===d)return k();if(void 0!==c)return b(d.connectors.forWorkspace(c));let e=await d.resolveWorkspace(a);switch(e.kind){case"workspace":return b(d.connectors.forWorkspace(e.workspaceId));case"unauthenticated":return(0,f.CC)(401,"unauthenticated",e.reason);case"forbidden":return(0,f.CC)(403,"forbidden",e.reason);default:return(0,f.CC)(500,"unhandled_workspace_resolution",`The workspace resolver returned a case this route does not handle: ${JSON.stringify(e)}.`)}}async function n(a){return(0,h.rc)(a,"id")}},64957:(a,b,c)=>{c.d(b,{I7:()=>f,Ks:()=>aa,Le:()=>o,Q3:()=>i,Rx:()=>g,d:()=>h,mX:()=>j,wx:()=>$,xY:()=>ab,zh:()=>ad});var d=c(24147),e=c(77763);let f=1048576,g=128,h=41,i=["list_tables","describe","select"],j={connector_spec_invalid:422,connector_write_unsupported:422,connector_tool_name_collision:422,connector_kind_unsupported:400},k=/[\s\p{Cc}]/u,l=/\p{Cc}/u,m=/^\//u;function n(a,b,c,d=[]){a.addIssue({code:"custom",message:c,path:[...d],params:{problemCode:b}})}function o(a){var b;if("custom"!==a.code)return null;let c=a.params?.problemCode;return"string"==typeof(b=c)&&Object.hasOwn(j,b)?c:null}let p=d.YjP().regex(/^[A-Za-z0-9_-]{1,41}$/u,'must be 1-41 letters, digits, "_" or "-"'),q=d.YjP().max(2048).regex(m,'must start with "/"').refine(a=>!k.test(a),{message:"must not contain whitespace or a control character"}),r=d.Ikc({name:p,method:d.k5n(["GET","HEAD"]),path:q}).strict().readonly(),s=new Set(["POST","PUT","PATCH","DELETE","OPTIONS","TRACE","CONNECT","QUERY"]),t=/^([A-Za-z]+) (.+)$/su,u=/^operationId:/u,v=/\//u,w=/^[\x21-\x22\x24-\x29\x2B-\x2E\x30-\x3E\x40-\x7E]+$/u;function x(a){return"/"===a?[]:a.slice(1).split(v)}function y(a){if(u.test(a)){let b=a.slice(12);return b.length>=1&&b.length<=256&&!k.test(b)?{kind:"operationId",operationId:b}:{kind:"invalid"}}let b=t.exec(a),c=b?.[1],d=b?.[2];if(void 0===c||void 0===d)return{kind:"invalid"};let e="GET"===c||"HEAD"===c?c:s.has(c.toUpperCase())?"write":null;if("write"===e)return{kind:"write"};if(null===e||d.length>2048||!m.test(d))return{kind:"invalid"};let f=x(d);return f.every((a,b)=>"*"===a||"**"===a&&b===f.length-1||w.test(a))?{kind:"path",method:e,glob:f}:{kind:"invalid"}}let z="only GET and HEAD operations are supported",A='must be "GET <path-glob>", "HEAD <path-glob>" or "operationId:<id>"',B=d.YjP().superRefine((a,b)=>{let c=y(a);"write"===c.kind&&n(b,"connector_write_unsupported",z),"invalid"===c.kind&&b.addIssue({code:"custom",message:A})}),C=d.YOg(B).min(1).max(256).superRefine((a,b)=>{a.forEach((c,d)=>{a.indexOf(c)!==d&&b.addIssue({code:"custom",message:"duplicate rule",path:[d]})})}).readonly(),D=["host","content-length","content-type","transfer-encoding","connection","keep-alive","upgrade","te","trailer","proxy-connection"];Object.freeze(D);let E=new Set(D),F=d.KCZ([d.euz("none"),d.euz("bearer"),d.Ikc({header:d.YjP().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]{1,128}$/u,"must be an HTTP header name of at most 128 characters").refine(a=>!E.has(a.toLowerCase()),{message:"this header cannot carry a credential"})}).strict().readonly()]),G=/^(?:pg_|information_schema\.)/iu,H=d.YjP().regex(/^[A-Za-z_][A-Za-z0-9_$]{0,62}\.[A-Za-z_][A-Za-z0-9_$]{0,62}$/u,'must be a qualified table name "schema.table"').refine(a=>!G.test(a),{message:"must not name a table in a system schema"}),I=d.YOg(H).min(1).max(64).superRefine((a,b)=>{a.forEach((c,d)=>{a.indexOf(c)!==d&&b.addIssue({code:"custom",message:"duplicate table",path:[d]})})}).readonly(),J=d.aig().int().min(1).max(1e3),K=/[\u202A-\u202E\u2066-\u2069]/u,L=d.YjP().regex(/^.{1,200}$/u,"must be 1-200 characters on one line").refine(a=>""!==a.trim(),{message:"must not be blank"}).refine(a=>!l.test(a)&&!K.test(a),{message:"must not contain a control or bidirectional formatting character"}),M=d.YjP().superRefine((a,b)=>{a.length>f||function(a){let b=0;for(let d=0;d<a.length;d+=1){var c;let e=a.charCodeAt(d);e<128?b+=1:e<2048?b+=2:e>=55296&&e<=56319&&(c=a.charCodeAt(d+1))>=56320&&c<=57343?(b+=4,d+=1):b+=3}return b}(a)>f?n(b,"connector_spec_invalid","the document is larger than 1 MiB"):""===a.trim()&&n(b,"connector_spec_invalid","the document is empty")}),N=/#/u,O=/\\/u;function P(a){return URL.canParse(a)?new URL(a):null}let Q=d.YjP().max(2048,"must be at most 2048 characters").superRefine((a,b)=>{let c=k.test(a)?null:P(a);null===c||"http:"!==c.protocol&&"https:"!==c.protocol?b.addIssue({code:"custom",message:"must be an absolute http or https URL"}):(0,e.E)(c)?b.addIssue({code:"custom",message:"must not carry a credential; send it as the write-only credential"}):N.test(a)?b.addIssue({code:"custom",message:"must not carry a fragment"}):O.test(a)&&b.addIssue({code:"custom",message:"must not contain a backslash"})}),R=d.YjP().regex(/^[\x21-\x7E](?:[\x20-\x7E\t]*[\x21-\x7E])?$/u,"must be visible ASCII, with spaces or tabs only between visible characters"),S=d.Ikc({kind:d.euz("openapi"),name:L,document:M,baseUrl:Q.optional(),allow:C,auth:F.default("none"),credential:R.optional(),dryRun:d.euz(!0).optional()}).strict().superRefine((a,b)=>{"none"!==a.auth&&void 0===a.credential&&b.addIssue({code:"custom",message:"a credential is required when auth is not none",path:["credential"]}),"none"===a.auth&&void 0!==a.credential&&b.addIssue({code:"custom",message:"a credential is refused when auth is none",path:["credential"]})}).readonly(),T=new Set(["postgres:","postgresql:"]),U=["sslmode","connect_timeout","application_name"];Object.freeze(U);let V=new Set(U),W=/^[^,%]+$/u,X=d.YjP().max(4096,"must be at most 4096 characters").superRefine((a,b)=>{let c=l.test(a)?null:P(a);null!==c&&T.has(c.protocol)&&W.test(c.hostname)?[...c.searchParams.keys()].some(a=>!V.has(a))&&b.addIssue({code:"custom",message:"may carry only the sslmode, connect_timeout and application_name parameters"}):b.addIssue({code:"custom",message:"must be a postgres:// or postgresql:// URL with one host"})}),Y=d.zMY().superRefine((a,b)=>{a||n(b,"connector_write_unsupported","only reads are supported; set true")}).pipe(d.euz(!0)),Z=d.Ikc({kind:d.euz("postgres"),name:L,credential:X,tables:I,readOnly:Y,maxRows:J.default(100),dryRun:d.euz(!0).optional()}).strict().readonly(),$=d.gMt("kind",[S,Z]),_=d.Ikc({digest:d.YjP().regex(/^sha256:[0-9a-f]{64}$/u,"must be sha256:<64 hex digits>"),bytes:d.aig().int().min(1).max(f),title:d.YjP().regex(/^[^\p{Cc}]{1,200}$/u,"must be 1-200 characters with no control character").optional()}).strict().readonly(),aa=d.Ikc({spec:_,baseUrl:Q,auth:F,allow:C,operations:d.YOg(r).min(1).max(g).superRefine((a,b)=>{let c=new Set;a.forEach((a,d)=>{c.has(a.name)&&n(b,"connector_tool_name_collision","duplicate operation name",[d,"name"]),c.add(a.name)})}).readonly()}).strict().readonly(),ab=d.Ikc({tables:I,readOnly:d.euz(!0),maxRows:J}).strict().readonly();function ac(a,b,c){return{path:["allow",a],code:b,message:c}}function ad(a,b){let c=new Set,d=[],e=b.filter(a=>q.safeParse(a.path).success);return a.forEach((a,b)=>{let f=y(a);if("write"===f.kind)d.push(ac(b,"connector_write_unsupported",z));else if("invalid"===f.kind)d.push(ac(b,"connector_spec_invalid",A));else if("path"===f.kind){let a=e.filter(a=>a.method.toUpperCase()===f.method&&function(a,b){for(let[c,d]of a.entries()){if("**"===d)return!0;let a=b[c];if(void 0===a||""===a||"*"!==d&&d!==a)return!1}return a.length===b.length}(f.glob,x(a.path)));for(let e of(0===a.length&&d.push(ac(b,"connector_spec_invalid","admits no operation")),a))c.add(e)}else{let a=e.filter(a=>a.operationId===f.operationId);if(0===a.length)d.push(ac(b,"connector_spec_invalid","names no operation"));else if(a.some(a=>{let b;return"GET"!==(b=a.method.toUpperCase())&&"HEAD"!==b}))d.push(ac(b,"connector_write_unsupported",z));else for(let b of a)c.add(b)}}),{admitted:b.filter(a=>c.has(a)),refusals:d}}},78572:(a,b,c)=>{c.d(b,{A:()=>e});var d=c(80061);async function e(a,b){let c=null,e=await (0,d.Z_)(a,b,a=>(c=a.principal,Promise.resolve({status:204,body:null})));if(204!==e.status)return{ok:!1,response:(0,d.Zr)(e)};if(null===c)throw Error("RBAC allowed a resource request without retaining its verified principal.");return{ok:!0,principal:c}}},80061:(a,b,c)=>{c.d(b,{CC:()=>g,Z_:()=>j,Zr:()=>h,nE:()=>i,tW:()=>k});var d=c(82333),e=c(17337);let f="application/json";function g(a,b,c){return{status:a,body:{error:{code:b,message:c,detail:c}}}}function h(a){let b={...a.headers,"cache-control":"no-store"};return 204===a.status||null===a.body?new Response(null,{status:a.status,headers:b}):new Response(JSON.stringify(a.body),{status:a.status,headers:{...b,"content-type":"application/json; charset=utf-8"}})}async function i(a){let b,c=a.headers.get("content-type"),d=null===c?"":(c.split(";")[0]??"").trim().toLowerCase();if(d!==f)return{ok:!1,result:g(415,"unsupported_media_type",`This route accepts ${f}; the request declared ${""===d?"no Content-Type":JSON.stringify(d)}.`)};try{let c=await a.arrayBuffer();if(c.byteLength>16384)return{ok:!1,result:g(413,"request_body_too_large",`This route reads at most ${String(16384)} bytes of request body.`)};b=new TextDecoder("utf-8",{fatal:!0}).decode(c)}catch{return{ok:!1,result:g(400,"malformed_body","The request body could not be read as UTF-8.")}}if(""===b.trim())return{ok:!1,result:g(400,"malformed_body","This route requires a JSON object body.")};try{return{ok:!0,value:JSON.parse(b)}}catch{return{ok:!1,result:g(400,"malformed_body","The request body is not valid JSON.")}}}async function j(a,b,c){let f,h,i=(0,e.cg)();if(null===i)return g(503,"rbac_runtime_not_configured","The users, memberships and API-key routes have no directory or identity resolver wired into them. This deployment cannot serve them; it is not that the request was rejected.");let j=await i.identify(a);if(null===j)return g(401,"unauthenticated",'This route requires a verified session cookie or an API key presented as "Authorization: Bearer ak_live_…".');let k=i.directory.forWorkspace(j.workspaceId);if("function"==typeof b){let a=await b(j,k);if("refuse"===a.kind)return a.result;f=a.ownership}else f=b;try{h=new URL(a.url).pathname}catch{return g(500,"authorisation_undecidable",`The request URL ${JSON.stringify(a.url)} could not be read as a URL, so no route could be derived from it and no authorisation decision was made.`)}let l=(0,d.LD)({role:j.role,method:a.method,path:h,ownership:f,scope:j.scope});switch(l.effect){case"allow":return c({principal:j,directory:k,decision:l});case"deny":return g(403,l.code??"forbidden",l.because);case"refuse":return g(500,"authorisation_undecidable",`${l.because} No authorisation decision was made, so this request was neither allowed nor refused on its merits.`);default:throw Error(`unclassified decision ${JSON.stringify(l)} — refusing to serve the request`)}}async function k(a){let b=await a.params;if("object"==typeof b&&null!==b)return b.id}},85265:(a,b,c)=>{c.d(b,{CJ:()=>e});let d=globalThis;function e(){return d.__agentWorkspaceConnectorsRuntime__??null}},93616:(a,b,c)=>{c.d(b,{cW:()=>j,iV:()=>k});var d=c(24147);let e="AW_DEPLOYMENT_POSTURE",f=["local","production"],g=d.k5n(f);class h extends Error{constructor(a,b){super(b),this.name="DeploymentPostureError",this.code=a}}let i=/^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/u;function j(a){let b=a.toLowerCase();if("localhost"===b||"::1"===b||"[::1]"===b)return!0;let c=i.exec(b);return null!==c&&c.slice(1).every(a=>255>=Number(a))}function k(a=process.env){var b=a,c=a.HOST;let d=(b[e]??"").trim();if(0===d.length)return"production"===b.NODE_ENV?"production":"local";let i=g.safeParse(d);if(!i.success)throw new h("invalid_deployment_posture",`${e} must be one of ${f.join(", ")}`);if("local"===i.data&&(void 0===c||!j(c)))throw new h("local_posture_needs_loopback_host",`local posture needs a loopback HOST (${e}=local)`);return i.data}},97482:(a,b,c)=>{c.d(b,{$1:()=>m,Bx:()=>h,tm:()=>i});var d=c(24147),e=c(3e4),f=c(64957);let g=["none","api-key","bearer","oauth"],h=2*f.I7+65536,i=Object.freeze({mcp:65536,openapi:h,postgres:65536}),j=["transport","command","args","url","authType"],k=d.Ikc({id:d.YjP().min(1),workspaceId:d.YjP().min(1),name:d.YjP().min(1),kind:d.k5n(["mcp","openapi","postgres"]).optional(),transport:d.k5n(["stdio","http","sse"]).nullable(),command:d.YjP().nullable(),args:d.YOg(d.YjP()).readonly().nullable(),url:d.YjP().nullable(),authType:d.k5n(g).nullable(),hasCredential:d.zMY(),enabled:d.zMY(),createdBy:d.YjP().min(1).nullable(),ownerPrincipalId:d.YjP().min(1),createdAt:e.EH,updatedAt:e.EH,openapi:f.Ks.optional(),postgres:f.xY.optional()}).strict().superRefine((a,b)=>{var c;let d=(a,c)=>{b.addIssue({code:"custom",message:c,path:[a]})},e=a.kind??"mcp";if("mcp"===e){null===a.transport&&d("transport","an mcp connector has a transport"),null===a.authType&&d("authType","an mcp connector has an auth type"),void 0!==a.openapi&&d("openapi","only an openapi connector has this"),void 0!==a.postgres&&d("postgres","only a postgres connector has this");return}for(let b of j)null!==a[b]&&d(b,`a ${e} connector has none`);let f="openapi"===e?"postgres":"openapi";void 0===a[e]&&d(e,`a ${e} connector has this`),void 0!==a[f]&&d(f,`only a ${f} connector has this`);let g=void 0!==(c=a).postgres||(void 0!==c.openapi?"none"!==c.openapi.auth:null);null!==g&&a.hasCredential!==g&&d("hasCredential",g?"this connector has a credential":"auth none has no credential")}).readonly();d.Ikc({connectors:d.YOg(k).readonly()}).strict().readonly(),d.gMt("ok",[d.Ikc({ok:d.euz(!0),kind:d.euz("ok"),message:d.YjP(),serverName:d.YjP().nullable(),serverVersion:d.YjP().nullable(),toolCount:d.aig().int().nonnegative()}).strict().readonly(),d.Ikc({ok:d.euz(!1),kind:d.k5n(["auth-required","credential-rejected","credential-insufficient-scope","unreachable","endpoint-not-mcp","tls-error","command-not-found","process-died","timeout","protocol-version-unsupported","server-error","rate-limited","http-error","server-refused","sse-stream-failed","unknown-failure","stdio-probe-unavailable"]),message:d.YjP()}).strict().readonly()]);let l=a=>""!==a.trim(),m=d.Ikc({name:d.YjP().regex(/^.{1,200}$/u).optional(),enabled:d.zMY().optional(),url:d.YjP().regex(/^https?:\/\//u).optional(),command:d.YjP().refine(l).optional(),args:d.YOg(d.YjP()).readonly().nullable().optional(),authType:d.k5n(g).optional(),credential:d.YjP().refine(l).optional()}).strict().refine(a=>Object.keys(a).length>0,{message:"at least one field is required"}).readonly();({...f.mX,invalid_body:400,invalid_credential:400,connector_not_found:404,connector_name_conflict:409,credential_not_configured:409,credential_required_on_retarget:409,connectors_runtime_not_configured:503})},99711:(a,b,c)=>{c.d(b,{Dj:()=>j,Ml:()=>i,OP:()=>h,g5:()=>g,rc:()=>k});let d="application/json";function e(a,b,c,d){return{ok:!1,result:a.problem(b,c,d)}}async function f(a,b){let c=a.headers.get("content-length");if(null!==c){let a=Number(c);if(!Number.isInteger(a)||a<0)return e(b,400,"malformed_body",`The Content-Length header is ${JSON.stringify(c)}, which is not a byte count.`);if(a>b.maxBytes)return e(b,413,"request_body_too_large",`This route reads at most ${String(b.maxBytes)} bytes of request body; the request declared a Content-Length of ${String(a)}.`)}let d=a.body;if(null===d)return{ok:!0,bytes:new Uint8Array(0)};let f=d.getReader(),g=[],h=0;try{for(;;){let{done:a,value:c}=await f.read();if(a)break;if(void 0!==c){if((h+=c.byteLength)>b.maxBytes){try{await f.cancel()}catch{}return e(b,413,"request_body_too_large",`This route reads at most ${String(b.maxBytes)} bytes of request body; the request sent more than that and was not read to the end.`)}g.push(c)}}}catch{return e(b,400,"malformed_body","The request body could not be read.")}let i=new Uint8Array(h),j=0;for(let a of g)i.set(a,j),j+=a.byteLength;return{ok:!0,bytes:i}}async function g(a,b){let c=await h(a,b);return c.ok?{ok:!0,value:c.value}:c}async function h(a,b){let c,g=a.headers.get("content-type"),h=null===g?"":(g.split(";")[0]??"").trim().toLowerCase();if(h!==d)return e(b,415,"unsupported_media_type",`This route accepts ${d}; the request declared ${""===h?"no Content-Type":JSON.stringify(h)}.`);let i=await f(a,b);if(!i.ok)return i;try{c=new TextDecoder("utf-8",{fatal:!0}).decode(i.bytes)}catch{return e(b,400,"malformed_body","The request body is not valid UTF-8.")}if(""===c.trim())return e(b,400,"malformed_body","The request body is empty; a JSON object is required.");try{return{ok:!0,value:JSON.parse(c),bytes:i.bytes.byteLength}}catch{return e(b,400,"malformed_body","The request body is not valid JSON.")}}function i(a,b,c={}){return new Response(JSON.stringify(b),{status:a,headers:{...c,"content-type":"application/json; charset=utf-8"}})}function j(a){return 204===a.status||null===a.body?new Response(null,{status:a.status}):i(a.status,a.body)}async function k(a,b){let c=await a.params;if("object"==typeof c&&null!==c)return c[b]}}};

package/dist/web/.next-embedded/server/chunks/5225.js

@@ -0,0 +1,2 @@
+"use strict";exports.id=5225,exports.ids=[5225],exports.modules={95225:(a,b,c)=>{c.d(b,{loadRuntimeVerificationCache:()=>i});var d=c(77598),e=c(51455),f=c(76760),g=c.n(f);async function h(a){try{let b=JSON.parse(await (0,e.readFile)(a,"utf8"));if(null===b||"object"!=typeof b||Array.isArray(b))throw Error("runtime verification document must be an object");if(1!==b.schemaVersion||null===b.drivers||"object"!=typeof b.drivers||Array.isArray(b.drivers))throw Error("runtime verification document has an unsupported schema");let c=Object.fromEntries(Object.entries(b.drivers).filter(a=>{var b;return b=a[1],!(null===b||"object"!=typeof b||Array.isArray(b))&&["fingerprint","configurationKey","verifiedAt","expiresAt"].every(a=>"string"==typeof b[a]&&b[a].length>0)}));return{schemaVersion:1,drivers:c}}catch(b){if("ENOENT"===b.code)return{schemaVersion:1,drivers:{}};throw Error(`runtime verification state is unreadable at ${a}`,{cause:b})}}async function i(a){let b=await h(a),c=Promise.resolve();return{wasVerified(a,c,d=new Date){let e=b.drivers[a];return void 0!==e&&e.configurationKey===c&&Number.isFinite(Date.parse(e.verifiedAt))&&Date.parse(e.expiresAt)>d.getTime()},async record(f,h,i){let j=c.then(async()=>{let c=Date.parse(i.expiresAt),j=Date.parse(i.verifiedAt);if(!Number.isFinite(c)||!Number.isFinite(j)||c<=j)throw Error("runtime verification has an invalid validity window");b={schemaVersion:1,drivers:{...b.drivers,[f]:{...i,configurationKey:h}}},await (0,e.mkdir)(g().dirname(a),{recursive:!0});let k=`${a}.${(0,d.randomUUID)()}.tmp`;await (0,e.writeFile)(k,`${JSON.stringify(b,null,2)}
+`,{flag:"wx",mode:384}),await (0,e.rename)(k,a)});return c=j.catch(()=>void 0),j}}}}};