@rudderhq/server 0.5.2-canary.2 → 0.6.0

package/dist/bundled-plugins/plugin-linear/dist/worker.js

@@ -5209,9 +5209,71 @@ var RUDDER_CORE_MCP_TOOL_NAMES = RUDDER_AGENT_V1_MCP_TOOL_NAMES.filter((name) =>
 var CUSTOM_INTEGRATION_KINDS = ["custom_api", "mcp_server"];
 var CUSTOM_INTEGRATION_SCOPES = ["organization", "agent"];
 var CUSTOM_INTEGRATION_STATUSES = ["active", "disabled", "error", "revoked"];
-var CUSTOM_INTEGRATION_TOOL_STATUSES = ["active", "disabled", "error"];
+var CUSTOM_INTEGRATION_TOOL_STATUSES = ["active", "disabled", "error", "removed"];
 var CUSTOM_INTEGRATION_BINDING_STATUSES = ["active", "revoked"];
 var CUSTOM_INTEGRATION_TOOL_CALL_STATUSES = ["success", "error", "blocked"];
+var MCP_CONNECTION_PROVIDERS = ["supabase", "linear", "notion", "custom"];
+var MCP_CONNECTION_TRANSPORTS = ["stdio", "streamable_http", "legacy_manual"];
+var MCP_CONNECTION_ACCESS_MODES = ["provider_default", "read_only", "read_write"];
+var MCP_CONNECTION_STATUSES = [
+  "draft",
+  "authorizing",
+  "selecting_scope",
+  "active",
+  "needs_reauth",
+  "disabled",
+  "revoked",
+  "error"
+];
+var MCP_OAUTH_GRANT_STATUSES = ["active", "needs_reauth", "revoked", "error"];
+var MCP_AGENT_BINDING_STATUSES = ["active", "disabled", "revoked"];
+var MCP_OAUTH_SESSION_TTL_MS = 10 * 60 * 1e3;
+var MCP_PROVIDER_CATALOG = [
+  {
+    id: "supabase",
+    label: "Supabase",
+    curated: true,
+    requiresOAuth: true,
+    requiresScopeSelection: true,
+    scopeLabel: "Project",
+    transports: ["streamable_http"],
+    accessModes: ["read_only", "read_write"],
+    defaultAccessMode: "read_only"
+  },
+  {
+    id: "linear",
+    label: "Linear",
+    curated: true,
+    requiresOAuth: true,
+    requiresScopeSelection: false,
+    scopeLabel: "Workspace",
+    transports: ["streamable_http"],
+    accessModes: ["read_only", "read_write"],
+    defaultAccessMode: "read_write"
+  },
+  {
+    id: "notion",
+    label: "Notion",
+    curated: true,
+    requiresOAuth: true,
+    requiresScopeSelection: false,
+    scopeLabel: "Workspace",
+    transports: ["streamable_http"],
+    accessModes: ["provider_default"],
+    defaultAccessMode: "provider_default"
+  },
+  {
+    id: "custom",
+    label: "Custom MCP",
+    curated: false,
+    requiresOAuth: false,
+    requiresScopeSelection: false,
+    scopeLabel: "Server",
+    transports: ["stdio", "streamable_http"],
+    accessModes: ["provider_default", "read_only", "read_write"],
+    defaultAccessMode: "provider_default"
+  }
+];
 var CALENDAR_SOURCE_TYPES = ["rudder_local", "google_calendar", "agent_work", "system"];
 var CALENDAR_OWNER_TYPES = ["user", "agent", "system"];
 var CALENDAR_VISIBILITIES = ["full", "busy_only", "private"];
@@ -5645,6 +5707,464 @@ var createCustomIntegrationToolCallSchema = external_exports.object({
   issueId: external_exports.string().uuid().optional().nullable()
 });
 
+// ../../../shared/src/validators/mcp.ts
+var uuidSchema = external_exports.string().uuid();
+var timestampSchema = external_exports.string().datetime({ offset: true });
+var connectionNameSchema = external_exports.string().min(1).max(80).regex(/^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?$/, "Use lowercase letters, numbers, underscores, and hyphens");
+var reservedMcpConnectionNames = /* @__PURE__ */ new Set(["rudder-tools", "rudder-browser"]);
+var environmentNameSchema = external_exports.string().min(1).max(160).regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "Use a valid environment variable name");
+var externalMcpToolNameSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9_.-]+$/, "Use an exact MCP tool name");
+var externalMcpToolFilterSchema = external_exports.array(externalMcpToolNameSchema).max(500);
+var mcpConnectionProviderSchema = external_exports.enum(MCP_CONNECTION_PROVIDERS);
+var mcpConnectionTransportSchema = external_exports.enum(MCP_CONNECTION_TRANSPORTS);
+var mcpConnectionAccessModeSchema = external_exports.enum(MCP_CONNECTION_ACCESS_MODES);
+var mcpConnectionStatusSchema = external_exports.enum(MCP_CONNECTION_STATUSES);
+var mcpOAuthGrantStatusSchema = external_exports.enum(MCP_OAUTH_GRANT_STATUSES);
+var mcpAgentBindingStatusSchema = external_exports.enum(MCP_AGENT_BINDING_STATUSES);
+var stringMapSchema = external_exports.record(external_exports.string().max(8192));
+var environmentValueMapSchema = stringMapSchema.superRefine((values, ctx) => {
+  for (const name of Object.keys(values)) {
+    if (!environmentNameSchema.safeParse(name).success) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [name],
+        message: `${name} must be a valid environment variable name`
+      });
+    }
+  }
+});
+var safeHeaderSchema = stringMapSchema.superRefine((headers, ctx) => {
+  const forbidden = /* @__PURE__ */ new Set(["authorization", "cookie", "proxy-authorization", "x-api-key"]);
+  for (const name of Object.keys(headers)) {
+    if (forbidden.has(name.toLowerCase())) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [name],
+        message: `${name} must be stored as encrypted credential material`
+      });
+    }
+  }
+});
+var mcpStdioSafeConfigSchema = external_exports.object({
+  command: external_exports.string().min(1).max(2048),
+  args: external_exports.array(external_exports.string().max(8192)).max(200).optional(),
+  cwd: external_exports.string().min(1).max(4096).optional(),
+  staticEnv: environmentValueMapSchema.optional(),
+  forwardedEnv: external_exports.array(environmentNameSchema).max(100).optional(),
+  secretEnvNames: external_exports.array(environmentNameSchema).max(100).optional(),
+  toolAllowlist: externalMcpToolFilterSchema.optional(),
+  toolDenylist: externalMcpToolFilterSchema.optional()
+}).strict().superRefine((value, ctx) => {
+  const staticNames = new Set(Object.keys(value.staticEnv ?? {}));
+  for (const name of value.secretEnvNames ?? []) {
+    if (staticNames.has(name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["staticEnv", name],
+        message: `${name} is marked secret and cannot remain in safe config`
+      });
+    }
+  }
+});
+var mcpStreamableHttpSafeConfigSchema = external_exports.object({
+  url: external_exports.string().url().max(8192).optional(),
+  staticHeaders: safeHeaderSchema.optional(),
+  headersFromEnv: external_exports.record(environmentNameSchema).optional(),
+  bearerTokenEnvVar: environmentNameSchema.optional(),
+  secretHeaderNames: external_exports.array(external_exports.string().min(1).max(256)).max(100).optional(),
+  hasBearerToken: external_exports.boolean().optional(),
+  toolAllowlist: externalMcpToolFilterSchema.optional(),
+  toolDenylist: externalMcpToolFilterSchema.optional()
+}).strict().superRefine((value, ctx) => {
+  const staticNames = new Set(Object.keys(value.staticHeaders ?? {}).map((name) => name.toLowerCase()));
+  const mappedNames = new Set(Object.keys(value.headersFromEnv ?? {}).map((name) => name.toLowerCase()));
+  for (const name of value.secretHeaderNames ?? []) {
+    if (staticNames.has(name.toLowerCase())) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["staticHeaders", name],
+        message: `${name} is marked secret and cannot remain in safe config`
+      });
+    }
+  }
+  for (const name of mappedNames) {
+    if (staticNames.has(name)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["headersFromEnv", name],
+        message: `${name} cannot have both a static value and an environment mapping`
+      });
+    }
+  }
+});
+var mcpConnectionSecretsMutationSchema = external_exports.object({
+  env: environmentValueMapSchema.optional(),
+  headers: stringMapSchema.optional(),
+  bearerToken: external_exports.string().min(1).max(1e6).optional()
+}).strict().refine((value) => Object.keys(value.env ?? {}).length > 0 || Object.keys(value.headers ?? {}).length > 0 || Boolean(value.bearerToken), {
+  message: "At least one secret value is required"
+});
+var mcpLegacyManualSafeConfigSchema = external_exports.object({
+  legacyConfigRetained: external_exports.literal(true)
+}).strict();
+var mcpCuratedSafeConfigSchema = external_exports.object({
+  featureGroups: external_exports.object({
+    mode: external_exports.literal("provider_default"),
+    excluded: external_exports.array(external_exports.string().min(1).max(120)).max(100)
+  }).strict()
+}).strict();
+var mcpConnectionSafeConfigSchema = external_exports.union([
+  mcpStdioSafeConfigSchema,
+  mcpStreamableHttpSafeConfigSchema,
+  mcpLegacyManualSafeConfigSchema,
+  mcpCuratedSafeConfigSchema
+]);
+var mcpConnectionInputFields = {
+  name: connectionNameSchema,
+  displayName: external_exports.string().trim().min(1).max(120),
+  provider: mcpConnectionProviderSchema,
+  transport: mcpConnectionTransportSchema,
+  externalScope: external_exports.string().trim().min(1).max(512).optional().nullable(),
+  accessMode: mcpConnectionAccessModeSchema.optional(),
+  safeConfig: mcpConnectionSafeConfigSchema.default({}),
+  startupTimeoutMs: external_exports.number().int().min(100).max(3e5).default(1e4),
+  toolTimeoutMs: external_exports.number().int().min(100).max(9e5).default(6e4),
+  enabled: external_exports.boolean().default(true),
+  required: external_exports.boolean().default(false),
+  secrets: mcpConnectionSecretsMutationSchema.optional()
+};
+var providerAccessModes = {
+  supabase: ["read_only", "read_write"],
+  linear: ["read_only", "read_write"],
+  notion: ["provider_default"],
+  custom: ["provider_default", "read_only", "read_write"]
+};
+function defaultAccessMode(provider) {
+  if (provider === "supabase") return "read_only";
+  if (provider === "linear") return "read_write";
+  return "provider_default";
+}
+function sameNames(left, right, caseInsensitive = false) {
+  const normalize = (name) => caseInsensitive ? name.toLowerCase() : name;
+  const leftNames = new Set(left.map(normalize));
+  const rightNames = new Set(right.map(normalize));
+  return leftNames.size === rightNames.size && [...leftNames].every((name) => rightNames.has(name));
+}
+function validateSafeConnectionConfig(value, ctx, options = {}) {
+  const accessMode = value.accessMode ?? defaultAccessMode(value.provider);
+  const allowedAccessModes = value.provider ? providerAccessModes[value.provider] : void 0;
+  if (!allowedAccessModes?.some((allowed) => allowed === accessMode)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["accessMode"],
+      message: `${value.provider ?? "Unknown"} does not support ${accessMode}`
+    });
+  }
+  if (value.provider !== "custom") {
+    if (value.transport !== "streamable_http") {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["transport"],
+        message: "Curated providers use Rudder-managed Streamable HTTP"
+      });
+    }
+    const hasManagedCuratedConfig = options.allowManagedCuratedSafeConfig === true && mcpCuratedSafeConfigSchema.safeParse(value.safeConfig).success;
+    if (typeof value.safeConfig !== "object" || value.safeConfig === null || Array.isArray(value.safeConfig) || Object.keys(value.safeConfig).length > 0 && !hasManagedCuratedConfig) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["safeConfig"],
+        message: "Curated provider URL, headers, and transport config are Rudder-managed"
+      });
+    }
+    if (value.secrets) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["secrets"],
+        message: "Curated provider credentials must come from its OAuth grant"
+      });
+    }
+    return;
+  }
+  if (value.transport === "stdio") {
+    const parsed = mcpStdioSafeConfigSchema.safeParse(value.safeConfig);
+    if (!parsed.success) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["safeConfig"],
+        message: "STDIO connections require command-based safe config"
+      });
+    }
+  }
+  if (value.transport === "streamable_http") {
+    const parsed = mcpStreamableHttpSafeConfigSchema.safeParse(value.safeConfig);
+    if (!parsed.success || value.provider === "custom" && !parsed.data.url) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["safeConfig", "url"],
+        message: "Custom Streamable HTTP connections require a URL"
+      });
+    }
+  }
+  if (value.transport === "legacy_manual") {
+    if (!mcpLegacyManualSafeConfigSchema.safeParse(value.safeConfig).success) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["safeConfig"],
+        message: "Legacy manual connections require compatibility config"
+      });
+    }
+    if (value.enabled !== false) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["enabled"],
+        message: "Legacy manual connections cannot be executable"
+      });
+    }
+  }
+  if (value.transport === "streamable_http") {
+    const parsed = mcpStreamableHttpSafeConfigSchema.safeParse(value.safeConfig);
+    if (parsed.success) {
+      const declaredHeaderNames = parsed.data.secretHeaderNames ?? [];
+      const suppliedHeaderNames = Object.keys(value.secrets?.headers ?? {});
+      const declaredBearer = parsed.data.hasBearerToken === true;
+      const suppliedBearer = Boolean(value.secrets?.bearerToken);
+      const authorizationFromEnv = Object.keys(parsed.data.headersFromEnv ?? {}).some((name) => name.toLowerCase() === "authorization");
+      const encryptedAuthorizationHeader = declaredHeaderNames.some((name) => name.toLowerCase() === "authorization") || suppliedHeaderNames.some((name) => name.toLowerCase() === "authorization");
+      const bearerEnvironment = Boolean(parsed.data.bearerTokenEnvVar);
+      const directBearer = declaredBearer || suppliedBearer;
+      if ([
+        authorizationFromEnv,
+        encryptedAuthorizationHeader,
+        bearerEnvironment,
+        directBearer
+      ].filter(Boolean).length > 1) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["safeConfig"],
+          message: "Configure only one manual Authorization or Bearer source"
+        });
+      }
+    }
+  }
+}
+function validateConnectionSecretMutation(value, ctx) {
+  if (value.provider !== "custom") return;
+  if (value.transport === "stdio") {
+    const parsed = mcpStdioSafeConfigSchema.safeParse(value.safeConfig);
+    if (parsed.success) {
+      const declaredEnvNames = parsed.data.secretEnvNames ?? [];
+      const suppliedEnvNames = Object.keys(value.secrets?.env ?? {});
+      if (!sameNames(declaredEnvNames, suppliedEnvNames) || Object.keys(value.secrets?.headers ?? {}).length > 0 || Boolean(value.secrets?.bearerToken)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["secrets"],
+          message: "STDIO secret values must exactly match declared secret environment names"
+        });
+      }
+    }
+  }
+  if (value.transport === "legacy_manual" && value.secrets) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["secrets"],
+      message: "Legacy manual connections cannot accept new secret values"
+    });
+  }
+  if (value.transport === "streamable_http") {
+    const parsed = mcpStreamableHttpSafeConfigSchema.safeParse(value.safeConfig);
+    if (parsed.success) {
+      const suppliedEnvNames = Object.keys(value.secrets?.env ?? {});
+      const declaredHeaderNames = parsed.data.secretHeaderNames ?? [];
+      const suppliedHeaderNames = Object.keys(value.secrets?.headers ?? {});
+      const declaredBearer = parsed.data.hasBearerToken === true;
+      const suppliedBearer = Boolean(value.secrets?.bearerToken);
+      if (suppliedEnvNames.length > 0 || !sameNames(declaredHeaderNames, suppliedHeaderNames, true) || declaredBearer !== suppliedBearer) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["secrets"],
+          message: "HTTP mutations accept only exactly declared encrypted headers and direct Bearer values"
+        });
+      }
+    }
+  }
+}
+var createMcpConnectionSchema = external_exports.object(mcpConnectionInputFields).strict().superRefine((value, ctx) => {
+  if (reservedMcpConnectionNames.has(value.name)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["name"],
+      message: `${value.name} is reserved for an internal Rudder runtime`
+    });
+  }
+}).superRefine(validateSafeConnectionConfig).superRefine(validateConnectionSecretMutation).transform((value) => ({
+  ...value,
+  accessMode: value.accessMode ?? defaultAccessMode(value.provider)
+}));
+var updateMcpConnectionSchema = external_exports.object({
+  displayName: mcpConnectionInputFields.displayName.optional(),
+  externalScope: mcpConnectionInputFields.externalScope.optional(),
+  accessMode: mcpConnectionAccessModeSchema.optional(),
+  safeConfig: mcpConnectionSafeConfigSchema.optional(),
+  startupTimeoutMs: external_exports.number().int().min(100).max(3e5).optional(),
+  toolTimeoutMs: external_exports.number().int().min(100).max(9e5).optional(),
+  enabled: external_exports.boolean().optional(),
+  required: external_exports.boolean().optional(),
+  secrets: mcpConnectionSecretsMutationSchema.optional()
+}).strict().refine((value) => Object.keys(value).length > 0, {
+  message: "At least one connection field is required"
+});
+var mcpConnectionMergedConfigFields = {
+  provider: mcpConnectionProviderSchema,
+  transport: mcpConnectionTransportSchema,
+  accessMode: mcpConnectionAccessModeSchema,
+  safeConfig: mcpConnectionSafeConfigSchema,
+  enabled: external_exports.boolean()
+};
+var mcpConnectionMergedConfigSchema = external_exports.object(
+  mcpConnectionMergedConfigFields
+).strict().superRefine((value, ctx) => {
+  validateSafeConnectionConfig(value, ctx, { allowManagedCuratedSafeConfig: true });
+});
+var mcpConnectionMutationConfigSchema = external_exports.object({
+  ...mcpConnectionMergedConfigFields,
+  secrets: mcpConnectionSecretsMutationSchema.optional()
+}).strict().superRefine((value, ctx) => {
+  validateSafeConnectionConfig(value, ctx, { allowManagedCuratedSafeConfig: true });
+}).superRefine(validateConnectionSecretMutation);
+var mcpConnectionSummarySchema = external_exports.object({
+  id: uuidSchema,
+  orgId: uuidSchema,
+  name: connectionNameSchema,
+  displayName: external_exports.string().min(1).max(120),
+  provider: mcpConnectionProviderSchema,
+  transport: mcpConnectionTransportSchema,
+  externalScope: external_exports.string().max(512).nullable(),
+  accessMode: mcpConnectionAccessModeSchema,
+  status: mcpConnectionStatusSchema,
+  safeConfig: mcpConnectionSafeConfigSchema,
+  startupTimeoutMs: external_exports.number().int().positive(),
+  toolTimeoutMs: external_exports.number().int().positive(),
+  enabled: external_exports.boolean(),
+  required: external_exports.boolean(),
+  hasCredentials: external_exports.boolean(),
+  lastDiscoveredAt: timestampSchema.nullable(),
+  activatedAt: timestampSchema.nullable(),
+  disabledAt: timestampSchema.nullable(),
+  revokedAt: timestampSchema.nullable(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
+}).strict();
+var mcpProviderCatalogEntrySchema = external_exports.object({
+  id: mcpConnectionProviderSchema,
+  label: external_exports.string().min(1),
+  curated: external_exports.boolean(),
+  requiresOAuth: external_exports.boolean(),
+  requiresScopeSelection: external_exports.boolean(),
+  scopeLabel: external_exports.string().min(1),
+  transports: external_exports.array(mcpConnectionTransportSchema).min(1),
+  accessModes: external_exports.array(mcpConnectionAccessModeSchema).min(1),
+  defaultAccessMode: mcpConnectionAccessModeSchema
+}).strict().superRefine((value, ctx) => {
+  if (!value.accessModes.includes(value.defaultAccessMode)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["defaultAccessMode"],
+      message: "Default access mode must be included in accessModes"
+    });
+  }
+});
+var mcpProviderCatalogSchema = external_exports.array(mcpProviderCatalogEntrySchema);
+mcpProviderCatalogSchema.parse(MCP_PROVIDER_CATALOG);
+var mcpOAuthStartSchema = external_exports.object({}).strict();
+var mcpOAuthStartResponseSchema = external_exports.object({
+  connectionId: uuidSchema,
+  authorizationUrl: external_exports.string().url().max(16384),
+  expiresAt: timestampSchema
+}).strict();
+var mcpOAuthCallbackSchema = external_exports.object({
+  state: external_exports.string().min(16).max(8192),
+  code: external_exports.string().min(1).max(16384).optional(),
+  error: external_exports.string().min(1).max(512).optional(),
+  errorDescription: external_exports.string().max(4096).optional(),
+  iss: external_exports.string().url().max(8192).optional()
+}).strict().superRefine((value, ctx) => {
+  if (Boolean(value.code) === Boolean(value.error)) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "OAuth callback must include exactly one of code or error"
+    });
+  }
+});
+var mcpScopeSelectionSchema = external_exports.object({
+  connectionId: uuidSchema,
+  externalScope: external_exports.string().trim().min(1).max(512),
+  accessMode: mcpConnectionAccessModeSchema
+}).strict();
+var mcpExternalScopeOptionSchema = external_exports.object({
+  id: external_exports.string().min(1).max(512),
+  displayName: external_exports.string().min(1).max(240),
+  metadata: external_exports.record(external_exports.unknown()).default({})
+}).strict();
+var mcpOAuthGrantSummarySchema = external_exports.object({
+  id: uuidSchema,
+  connectionId: uuidSchema,
+  providerSubject: external_exports.string().max(1024).nullable(),
+  providerScopes: external_exports.array(external_exports.string().max(512)),
+  externalScopeMetadata: external_exports.record(external_exports.unknown()),
+  status: mcpOAuthGrantStatusSchema,
+  hasCredentials: external_exports.boolean(),
+  expiresAt: timestampSchema.nullable(),
+  lastRefreshedAt: timestampSchema.nullable(),
+  revokedAt: timestampSchema.nullable(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
+}).strict();
+var mcpDiscoveredToolSchema = external_exports.object({
+  id: uuidSchema,
+  connectionId: uuidSchema,
+  externalToolName: external_exports.string().min(1).max(240),
+  rudderToolName: external_exports.string().min(1).max(320),
+  description: external_exports.string().max(4e3).nullable(),
+  inputSchema: external_exports.record(external_exports.unknown()),
+  outputSchema: external_exports.record(external_exports.unknown()).nullable(),
+  enabled: external_exports.boolean(),
+  removedAt: timestampSchema.nullable()
+}).strict();
+var mcpAgentBindingSchema = external_exports.object({
+  id: uuidSchema,
+  connectionId: uuidSchema,
+  agentId: uuidSchema,
+  status: mcpAgentBindingStatusSchema,
+  enabledToolIds: external_exports.array(uuidSchema).max(500)
+}).strict();
+var mcpAgentConnectionSummarySchema = external_exports.object({
+  connection: mcpConnectionSummarySchema,
+  binding: mcpAgentBindingSchema.nullable(),
+  tools: external_exports.array(mcpDiscoveredToolSchema).max(500)
+}).strict();
+var upsertMcpAgentBindingSchema = external_exports.object({
+  status: mcpAgentBindingStatusSchema.optional(),
+  enabledToolIds: external_exports.array(uuidSchema).max(500).optional()
+}).strict();
+var updateMcpAgentBindingSchema = external_exports.object({
+  status: mcpAgentBindingStatusSchema.optional(),
+  enabledToolIds: external_exports.array(uuidSchema).max(500).optional()
+}).strict().refine((value) => Object.keys(value).length > 0, {
+  message: "At least one binding field is required"
+});
+var managedExternalMcpBindingSchema = external_exports.object({
+  bindingId: uuidSchema,
+  serverName: connectionNameSchema,
+  toolPolicy: external_exports.object({
+    mode: external_exports.literal("allowlist"),
+    allowedToolNames: external_exports.array(external_exports.string().min(1).max(320)).max(500)
+  }).strict(),
+  required: external_exports.boolean(),
+  startupTimeoutMs: external_exports.number().int().positive(),
+  toolTimeoutMs: external_exports.number().int().positive()
+}).strict();
+var managedExternalMcpBindingsSchema = external_exports.array(managedExternalMcpBindingSchema).max(100);
+
 // ../../../shared/src/validators/chat.ts
 var chatConversationStatusSchema = external_exports.enum(CHAT_CONVERSATION_STATUSES);
 var chatIssueCreationModeSchema = external_exports.enum(CHAT_ISSUE_CREATION_MODES);
@@ -5747,6 +6267,174 @@ var chatQueuedMessageStatusSchema = external_exports.enum([
 ]);
 var chatControlActionIdSchema = external_exports.string().uuid();
 var chatBodyHashSchema = external_exports.string().regex(/^[a-f0-9]{64}$/i, "Expected a SHA-256 body hash");
+var MAX_CHAT_INLINE_ANNOTATIONS = 10;
+var MAX_CHAT_INLINE_ANNOTATION_SELECTED_TEXT_LENGTH = 4e3;
+var MAX_CHAT_INLINE_ANNOTATION_COMMENT_LENGTH = 2e3;
+var MAX_CHAT_INLINE_ANNOTATION_TOTAL_TEXT_LENGTH = 16e3;
+var MAX_CHAT_INLINE_ANNOTATION_CONTEXT_LENGTH = 160;
+var MAX_CHAT_INLINE_ANNOTATION_ATTACHMENTS = 10;
+var chatInlineAnnotationCommentSchema = external_exports.preprocess(
+  (value) => {
+    if (typeof value !== "string") return value;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  },
+  external_exports.string().max(MAX_CHAT_INLINE_ANNOTATION_COMMENT_LENGTH).nullable().optional()
+);
+var chatInlineAnnotationSelectedTextSchema = external_exports.string().min(1).max(MAX_CHAT_INLINE_ANNOTATION_SELECTED_TEXT_LENGTH).refine((value) => value.trim().length > 0, "Selected text must not be blank");
+var chatInlineAnnotationSourceHashSchema = external_exports.string().regex(/^[a-f0-9]{64}$/, "Expected a lowercase SHA-256 source hash");
+var chatInlineAnnotationShape = {
+  id: external_exports.string().uuid(),
+  selectedText: chatInlineAnnotationSelectedTextSchema,
+  comment: chatInlineAnnotationCommentSchema,
+  sourceConversationId: external_exports.string().uuid(),
+  sourceMessageId: external_exports.string().uuid(),
+  sourceHash: chatInlineAnnotationSourceHashSchema,
+  start: external_exports.number().int().nonnegative(),
+  end: external_exports.number().int().nonnegative(),
+  prefix: external_exports.string().max(MAX_CHAT_INLINE_ANNOTATION_CONTEXT_LENGTH),
+  suffix: external_exports.string().max(MAX_CHAT_INLINE_ANNOTATION_CONTEXT_LENGTH),
+  attachmentIds: external_exports.array(external_exports.string().uuid()).default([])
+};
+function refineChatInlineAnnotation(annotation, ctx) {
+  if (annotation.end <= annotation.start) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Annotation end must be greater than start",
+      path: ["end"]
+    });
+  }
+  const attachmentIds = /* @__PURE__ */ new Set();
+  annotation.attachmentIds.forEach((attachmentId, index) => {
+    if (attachmentIds.has(attachmentId)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Annotation attachment ids must be unique",
+        path: ["attachmentIds", index]
+      });
+    }
+    attachmentIds.add(attachmentId);
+  });
+  const attachmentFileIndexes = /* @__PURE__ */ new Set();
+  annotation.attachmentFileIndexes?.forEach((fileIndex, index) => {
+    if (attachmentFileIndexes.has(fileIndex)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: "Annotation attachment file indexes must be unique",
+        path: ["attachmentFileIndexes", index]
+      });
+    }
+    attachmentFileIndexes.add(fileIndex);
+  });
+  if (annotation.surface === "process_transcript" && annotation.generationSeqStart !== void 0 && annotation.generationSeqEnd !== void 0 && annotation.generationSeqEnd < annotation.generationSeqStart) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Generation sequence end must be greater than or equal to start",
+      path: ["generationSeqEnd"]
+    });
+  }
+}
+var chatAssistantInlineAnnotationSchema = external_exports.object({
+  ...chatInlineAnnotationShape,
+  surface: external_exports.literal("assistant_body")
+}).strict();
+var chatProcessInlineAnnotationSchema = external_exports.object({
+  ...chatInlineAnnotationShape,
+  surface: external_exports.literal("process_transcript"),
+  transcriptKind: external_exports.enum(["thinking", "assistant"]),
+  generationId: external_exports.string().uuid(),
+  generationSeqStart: external_exports.number().int().nonnegative(),
+  generationSeqEnd: external_exports.number().int().nonnegative()
+}).strict();
+var chatInlineAnnotationSchema = external_exports.discriminatedUnion("surface", [
+  chatAssistantInlineAnnotationSchema,
+  chatProcessInlineAnnotationSchema
+]).superRefine(refineChatInlineAnnotation);
+var chatAssistantInlineAnnotationInputSchema = chatAssistantInlineAnnotationSchema.extend({
+  attachmentFileIndexes: external_exports.array(external_exports.number().int().nonnegative()).optional()
+}).strict();
+var chatProcessInlineAnnotationInputSchema = chatProcessInlineAnnotationSchema.extend({
+  attachmentFileIndexes: external_exports.array(external_exports.number().int().nonnegative()).optional()
+}).strict();
+var chatInlineAnnotationInputSchema = external_exports.discriminatedUnion("surface", [
+  chatAssistantInlineAnnotationInputSchema,
+  chatProcessInlineAnnotationInputSchema
+]).superRefine(refineChatInlineAnnotation);
+function createChatInlineAnnotationsSchema(annotationSchema) {
+  return external_exports.array(annotationSchema).max(MAX_CHAT_INLINE_ANNOTATIONS).superRefine((annotations, ctx) => {
+    let totalTextLength = 0;
+    let attachmentReferenceCount = 0;
+    const annotationIds = /* @__PURE__ */ new Set();
+    const sourceRanges = /* @__PURE__ */ new Set();
+    const attachmentIds = /* @__PURE__ */ new Set();
+    const attachmentFileIndexes = /* @__PURE__ */ new Set();
+    annotations.forEach((annotation, annotationIndex) => {
+      totalTextLength += annotation.selectedText.length + (annotation.comment?.length ?? 0);
+      attachmentReferenceCount += annotation.attachmentIds.length + (annotation.attachmentFileIndexes?.length ?? 0);
+      if (annotationIds.has(annotation.id)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "Annotation ids must be unique across the message",
+          path: [annotationIndex, "id"]
+        });
+      }
+      annotationIds.add(annotation.id);
+      const sourceRangeKey = JSON.stringify([
+        annotation.sourceConversationId,
+        annotation.sourceMessageId,
+        annotation.surface,
+        annotation.surface === "process_transcript" ? annotation.transcriptKind : null,
+        annotation.surface === "process_transcript" ? annotation.generationId : null,
+        annotation.surface === "process_transcript" ? annotation.generationSeqStart : null,
+        annotation.surface === "process_transcript" ? annotation.generationSeqEnd : null,
+        annotation.start,
+        annotation.end
+      ]);
+      if (sourceRanges.has(sourceRangeKey)) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "Annotation source ranges must be unique across the message",
+          path: [annotationIndex, "start"]
+        });
+      }
+      sourceRanges.add(sourceRangeKey);
+      annotation.attachmentIds.forEach((attachmentId, attachmentIndex) => {
+        if (attachmentIds.has(attachmentId)) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            message: "Annotation attachment ids must be unique across the message",
+            path: [annotationIndex, "attachmentIds", attachmentIndex]
+          });
+        }
+        attachmentIds.add(attachmentId);
+      });
+      annotation.attachmentFileIndexes?.forEach((fileIndex, attachmentIndex) => {
+        if (attachmentFileIndexes.has(fileIndex)) {
+          ctx.addIssue({
+            code: external_exports.ZodIssueCode.custom,
+            message: "Annotation attachment file indexes must be unique across the message",
+            path: [annotationIndex, "attachmentFileIndexes", attachmentIndex]
+          });
+        }
+        attachmentFileIndexes.add(fileIndex);
+      });
+    });
+    if (totalTextLength > MAX_CHAT_INLINE_ANNOTATION_TOTAL_TEXT_LENGTH) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: `Annotation selected text and comments must not exceed ${MAX_CHAT_INLINE_ANNOTATION_TOTAL_TEXT_LENGTH} characters`
+      });
+    }
+    if (attachmentReferenceCount > MAX_CHAT_INLINE_ANNOTATION_ATTACHMENTS) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        message: `Annotations must not reference more than ${MAX_CHAT_INLINE_ANNOTATION_ATTACHMENTS} attachments`
+      });
+    }
+  });
+}
+var chatInlineAnnotationsSchema = createChatInlineAnnotationsSchema(chatInlineAnnotationSchema);
+var chatInlineAnnotationsInputSchema = createChatInlineAnnotationsSchema(chatInlineAnnotationInputSchema);
 var createChatContextLinkSchema = external_exports.object({
   entityType: chatContextEntityTypeSchema,
   entityId: external_exports.string().min(1),
@@ -5786,28 +6474,65 @@ var createSideChatSchema = external_exports.object({
   clientMutationId: external_exports.string().trim().min(1).max(120)
 });
 var addChatMessageSchema = external_exports.object({
-  body: external_exports.string().trim().min(1).max(2e4),
+  body: external_exports.string().trim().max(2e4).default(""),
+  inlineAnnotations: chatInlineAnnotationsInputSchema.optional(),
   editUserMessageId: external_exports.string().uuid().optional().nullable(),
   queuedMessageId: external_exports.string().uuid().optional().nullable()
+}).superRefine((value, ctx) => {
+  if (value.body.length === 0 && (value.inlineAnnotations?.length ?? 0) === 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Chat message body or at least one inline annotation is required",
+      path: ["body"]
+    });
+  }
 });
 var chatQueuedMessagePayloadSchema = external_exports.object({
-  body: external_exports.string().trim().min(1).max(2e4),
+  body: external_exports.string().trim().max(2e4).default(""),
   attachmentIds: external_exports.array(external_exports.string().uuid()).optional().default([]),
+  inlineAnnotations: chatInlineAnnotationsInputSchema.optional().default([]),
   projectId: external_exports.string().uuid().optional().nullable(),
   skillRefs: external_exports.array(external_exports.string().trim().min(1).max(240)).optional().default([]),
   accessMode: external_exports.string().trim().min(1).max(120).optional().nullable(),
   model: external_exports.string().trim().min(1).max(120).optional().nullable(),
   effort: external_exports.string().trim().min(1).max(120).optional().nullable(),
   metadata: external_exports.record(external_exports.unknown()).optional().nullable()
+}).superRefine((value, ctx) => {
+  if (value.body.length === 0 && value.inlineAnnotations.length === 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Queued message body or at least one inline annotation is required",
+      path: ["body"]
+    });
+  }
 });
 var createChatQueuedMessageSchema = external_exports.object({
   clientMutationId: external_exports.string().trim().min(1).max(120),
   expectedGenerationId: external_exports.string().uuid().optional().nullable(),
   payload: chatQueuedMessagePayloadSchema
 });
+var chatQueuedMessageUpdatePayloadSchema = external_exports.object({
+  body: external_exports.string().trim().max(2e4).default(""),
+  attachmentIds: external_exports.array(external_exports.string().uuid()).optional().default([]),
+  inlineAnnotations: chatInlineAnnotationsInputSchema.optional(),
+  projectId: external_exports.string().uuid().optional().nullable(),
+  skillRefs: external_exports.array(external_exports.string().trim().min(1).max(240)).optional().default([]),
+  accessMode: external_exports.string().trim().min(1).max(120).optional().nullable(),
+  model: external_exports.string().trim().min(1).max(120).optional().nullable(),
+  effort: external_exports.string().trim().min(1).max(120).optional().nullable(),
+  metadata: external_exports.record(external_exports.unknown()).optional().nullable()
+}).superRefine((value, ctx) => {
+  if (value.body.length === 0 && value.inlineAnnotations !== void 0 && value.inlineAnnotations.length === 0) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Queued message body or at least one inline annotation is required",
+      path: ["body"]
+    });
+  }
+});
 var updateChatQueuedMessageSchema = external_exports.object({
   version: external_exports.number().int().positive(),
-  payload: chatQueuedMessagePayloadSchema
+  payload: chatQueuedMessageUpdatePayloadSchema
 });
 var cancelChatQueuedMessageSchema = external_exports.object({
   version: external_exports.number().int().positive().optional()
@@ -6040,6 +6765,7 @@ var messengerItemKeysSchema = external_exports.array(messengerItemKeySchema).min
 var createMessengerCustomGroupWithEntriesSchema = createMessengerCustomGroupSchema.extend({
   itemKeys: messengerItemKeysSchema.optional(),
   threadKeys: messengerItemKeysSchema.optional(),
+  anchorItemKey: messengerItemKeySchema.optional(),
   autoGenerateName: external_exports.boolean().optional()
 }).superRefine((value, ctx) => {
   if (!value.itemKeys && !value.threadKeys) {
@@ -6047,6 +6773,14 @@ var createMessengerCustomGroupWithEntriesSchema = createMessengerCustomGroupSche
   } else if (value.itemKeys && value.threadKeys && JSON.stringify(value.itemKeys) !== JSON.stringify(value.threadKeys)) {
     ctx.addIssue({ code: "custom", message: "itemKeys and threadKeys must match", path: ["itemKeys"] });
   }
+  const itemKeys = value.itemKeys ?? value.threadKeys;
+  if (value.anchorItemKey && itemKeys && !itemKeys.includes(value.anchorItemKey)) {
+    ctx.addIssue({
+      code: "custom",
+      message: "anchorItemKey must be included in itemKeys",
+      path: ["anchorItemKey"]
+    });
+  }
 }).transform((value) => ({ ...value, itemKeys: value.itemKeys ?? value.threadKeys }));
 var updateMessengerCustomGroupSchema = external_exports.object({
   name: external_exports.string().trim().min(1).max(80).optional(),
@@ -6364,16 +7098,16 @@ var createSecretSchema = external_exports.object({
   value: external_exports.string().min(1),
   description: external_exports.string().optional().nullable(),
   externalRef: external_exports.string().optional().nullable()
-});
+}).strict();
 var rotateSecretSchema = external_exports.object({
   value: external_exports.string().min(1),
   externalRef: external_exports.string().optional().nullable()
-});
+}).strict();
 var updateSecretSchema = external_exports.object({
   name: external_exports.string().min(1).optional(),
   description: external_exports.string().optional().nullable(),
   externalRef: external_exports.string().optional().nullable()
-});
+}).strict();
 
 // ../../../shared/src/validators/model-fallbacks.ts
 var agentRuntimeTypes = new Set(AGENT_RUNTIME_TYPES);