@shuffleio/shuffle-mcps 0.0.64 → 0.0.65

package/dist/chunk-C7HCHOHU.mjs

@@ -1,1208 +0,0 @@
-import {
-  getApiUrl,
-  getAuthHeader
-} from "./chunk-2PFFYHRO.mjs";
-
-// requestScheduler.ts
-var MAX_CONCURRENT = 6;
-var MAX_PER_SECOND = 16;
-var priorityQueue = [];
-var backgroundQueue = [];
-var active = 0;
-var recentStarts = [];
-var pump = () => {
-  const now = Date.now();
-  recentStarts = recentStarts.filter((t) => now - t < 1e3);
-  while (active < MAX_CONCURRENT && recentStarts.length < MAX_PER_SECOND) {
-    const next = priorityQueue.shift() || backgroundQueue.shift();
-    if (!next) return;
-    active += 1;
-    recentStarts.push(Date.now());
-    next();
-  }
-  if ((priorityQueue.length || backgroundQueue.length) && recentStarts.length >= MAX_PER_SECOND) {
-    const wait2 = Math.max(20, 1e3 - (Date.now() - recentStarts[0]));
-    setTimeout(pump, wait2);
-  }
-};
-var acquireDatastoreSlot = (priority = false) => new Promise((resolve) => {
-  let released = false;
-  const release = () => {
-    if (released) return;
-    released = true;
-    active = Math.max(0, active - 1);
-    pump();
-  };
-  const start = () => resolve(release);
-  if (priority) priorityQueue.push(start);
-  else backgroundQueue.push(start);
-  pump();
-});
-
-// ../Shuffle-Core/fetchBreaker.ts
-var rewriteShufflerApiToShuffleSecurity = (input) => {
-  if (typeof window === "undefined") return input;
-  const currentHost = window.location.hostname.toLowerCase();
-  const isOnShuffleSecurity = currentHost === "shuffle.security" || currentHost.endsWith(".shuffle.security") || currentHost === "localhost" || currentHost === "127.0.0.1" || currentHost.includes("lovable");
-  if (!isOnShuffleSecurity) return input;
-  let urlStr = null;
-  if (typeof input === "string") urlStr = input;
-  else if (input instanceof URL) urlStr = input.toString();
-  else if (input && typeof input.url === "string") urlStr = input.url;
-  if (!urlStr) return input;
-  if (!urlStr.includes("/api/") || urlStr.includes("/api/v1/auth/exchange")) {
-    return input;
-  }
-  try {
-    const u = new URL(urlStr, window.location.href);
-    const host = u.hostname.toLowerCase();
-    if (host === "shuffler.io" || host === "www.shuffler.io") {
-      u.protocol = "https:";
-      u.hostname = "uk.shuffle.security";
-      const rewritten = u.toString();
-      if (typeof input === "string") return rewritten;
-      if (input instanceof URL) return new URL(rewritten);
-      if (typeof Request !== "undefined" && input instanceof Request) return new Request(rewritten, input);
-    } else if (host.endsWith(".shuffler.io")) {
-      const subdomain = host.slice(0, -".shuffler.io".length);
-      u.protocol = "https:";
-      u.hostname = `${subdomain}.shuffle.security`;
-      const rewritten = u.toString();
-      if (typeof input === "string") return rewritten;
-      if (input instanceof URL) return new URL(rewritten);
-      if (typeof Request !== "undefined" && input instanceof Request) return new Request(rewritten, input);
-    }
-  } catch {
-  }
-  return input;
-};
-var FAIL_THRESHOLD = 12;
-var ROLLING_WINDOW_MS = 5e3;
-var COOLDOWN_MS = 1e4;
-var PROBE_AFTER_MS = 1500;
-var MAX_PROBE_BACKOFF_MS = 5e3;
-var HARD_BURST_THRESHOLD = 30;
-var HARD_BURST_WINDOW_MS = 1e3;
-var state = /* @__PURE__ */ new Map();
-var installed = false;
-var allowedOrigins = /* @__PURE__ */ new Set();
-var getEntry = (key) => {
-  let entry = state.get(key);
-  if (!entry) {
-    entry = { failures: [], attempts: [], blockedUntil: 0, probeAfter: 0, probing: false, warned: false };
-    state.set(key, entry);
-  }
-  return entry;
-};
-var trip = (entry, now, cooldownMs = COOLDOWN_MS) => {
-  entry.blockedUntil = now + cooldownMs;
-  entry.probeAfter = now + PROBE_AFTER_MS;
-  entry.probing = false;
-};
-var reset = (entry) => {
-  entry.failures.length = 0;
-  entry.attempts.length = 0;
-  entry.blockedUntil = 0;
-  entry.probeAfter = 0;
-  entry.probing = false;
-  entry.warned = false;
-};
-var prune = (arr, now, windowMs) => {
-  const cutoff = now - windowMs;
-  while (arr.length && arr[0] < cutoff) arr.shift();
-};
-var keyFor = (input, init) => {
-  let urlStr;
-  let method = (init?.method || (typeof input !== "string" && "method" in input ? input.method : "GET") || "GET").toUpperCase();
-  if (typeof input === "string") urlStr = input;
-  else if (input instanceof URL) urlStr = input.toString();
-  else if (input && typeof input.url === "string") urlStr = input.url;
-  else return null;
-  try {
-    const u = new URL(urlStr, typeof window !== "undefined" ? window.location.href : "http://localhost");
-    if (allowedOrigins.size && !allowedOrigins.has(u.origin)) return null;
-    if (!u.pathname.startsWith("/api/")) return null;
-    return `${method} ${u.origin}${u.pathname}`;
-  } catch {
-    return null;
-  }
-};
-var withStoredAuth = (input, init) => {
-  if (typeof window === "undefined") return init;
-  let urlStr;
-  if (typeof input === "string") urlStr = input;
-  else if (input instanceof URL) urlStr = input.toString();
-  else if (input && typeof input.url === "string") urlStr = input.url;
-  else return init;
-  try {
-    const url = new URL(urlStr, window.location.href);
-    const isKnownShuffleOrigin = allowedOrigins.has(url.origin) || url.origin === window.location.origin || url.hostname === "shuffler.io" || url.hostname.endsWith(".shuffler.io") || url.hostname === "tunnel.schemaless.org" || url.hostname === "shuffle.security" || url.hostname.endsWith(".shuffle.security");
-    if (!url.pathname.startsWith("/api/") || !isKnownShuffleOrigin) return init;
-    if (url.pathname === "/api/v1/login" || url.pathname === "/api/v1/users/register") return init;
-    const sessionToken = window.localStorage.getItem("session_token");
-    const token = sessionToken && sessionToken.trim().length > 0 ? sessionToken.trim() : null;
-    const authMode = window.localStorage.getItem("shuffle_auth_mode");
-    const isCapacitor = Boolean(
-      window.Capacitor?.isNativePlatform?.() || window._isCapacitorNative
-    );
-    const requestHeaders = typeof Request !== "undefined" && input instanceof Request ? input.headers : void 0;
-    const headers = new Headers(requestHeaders);
-    if (init?.headers) {
-      new Headers(init.headers).forEach((value, name) => headers.set(name, value));
-    }
-    const rootDomain = (host) => {
-      const parts = host.split(".");
-      return parts.length <= 2 ? host : parts.slice(-2).join(".");
-    };
-    const backendHost = url.hostname.toLowerCase();
-    const frontendHost = window.location.hostname.toLowerCase();
-    const isLocalPair = ["localhost", "127.0.0.1"].includes(backendHost) && ["localhost", "127.0.0.1"].includes(frontendHost);
-    const isCrossDomain = backendHost !== frontendHost && !isLocalPair && rootDomain(backendHost) !== rootDomain(frontendHost);
-    if (token && (authMode === "bearer" || isCapacitor || isCrossDomain) && !headers.has("Authorization")) {
-      headers.set("Authorization", `Bearer ${token}`);
-    }
-    if (!headers.has("Org-Id")) {
-      try {
-        const raw = window.localStorage.getItem("shuffle_user_info");
-        if (raw) {
-          const parsed = JSON.parse(raw);
-          const orgId = parsed?.active_org?.id;
-          if (orgId) headers.set("Org-Id", orgId);
-        }
-      } catch {
-      }
-    }
-    return {
-      ...init,
-      credentials: init?.credentials || "include",
-      headers
-    };
-  } catch {
-    return init;
-  }
-};
-var synthetic503 = (key, retryInMs) => new Response(
-  JSON.stringify({
-    error: "circuit_breaker_open",
-    message: `Too many failures for ${key}. Cooling down for ${Math.ceil(retryInMs / 1e3)}s.`
-  }),
-  {
-    status: 503,
-    statusText: "Service Unavailable (circuit breaker)",
-    headers: {
-      "Content-Type": "application/json",
-      "Retry-After": String(Math.ceil(retryInMs / 1e3)),
-      "X-Circuit-Breaker": "open"
-    }
-  }
-);
-var isCircuitBreakerResponse = (res) => {
-  if (!res) return false;
-  if (res.headers?.get?.("X-Circuit-Breaker") === "open") return true;
-  return res.status === 503 && /circuit breaker/i.test(res.statusText || "");
-};
-var registerProtectedOrigin = (url) => {
-  if (!url) return;
-  try {
-    const origin = new URL(url, typeof window !== "undefined" ? window.location.href : "http://localhost").origin;
-    allowedOrigins.add(origin);
-  } catch {
-  }
-};
-var installFetchBreaker = () => {
-  if (installed) return;
-  if (typeof window === "undefined" || typeof window.fetch !== "function") return;
-  installed = true;
-  const original = window.fetch.bind(window);
-  window.fetch = (async (input, init) => {
-    const finalInput = rewriteShufflerApiToShuffleSecurity(input);
-    const authenticatedInit = withStoredAuth(finalInput, init);
-    const key = keyFor(finalInput, authenticatedInit);
-    if (!key) return original(finalInput, authenticatedInit);
-    const entry = getEntry(key);
-    const now = Date.now();
-    let isProbe = false;
-    if (entry.blockedUntil > now) {
-      if (!entry.probing && now >= entry.probeAfter) {
-        entry.probing = true;
-        isProbe = true;
-      } else {
-        return synthetic503(key, entry.blockedUntil - now);
-      }
-    }
-    if (!isProbe) {
-      entry.attempts.push(now);
-      prune(entry.attempts, now, HARD_BURST_WINDOW_MS);
-      if (entry.attempts.length > HARD_BURST_THRESHOLD) {
-        trip(entry, now);
-        if (!entry.warned) {
-          entry.warned = true;
-          console.error(
-            `[fetchBreaker] Burst detected on ${key} (${entry.attempts.length} calls / ${HARD_BURST_WINDOW_MS}ms). Blocking for up to ${COOLDOWN_MS / 1e3}s (probing again in ${PROBE_AFTER_MS / 1e3}s). Fix the caller \u2014 this is almost always a missing useEffect dep or a render loop.`
-          );
-        }
-        return synthetic503(key, COOLDOWN_MS);
-      }
-    }
-    const onProbeFailure = (ts) => {
-      if (!isProbe) return;
-      entry.probing = false;
-      entry.probeAfter = ts + Math.min(MAX_PROBE_BACKOFF_MS, PROBE_AFTER_MS * 2);
-      entry.blockedUntil = Math.max(entry.blockedUntil, ts + PROBE_AFTER_MS);
-    };
-    let response;
-    try {
-      response = await original(finalInput, authenticatedInit);
-    } catch (err) {
-      const ts = Date.now();
-      entry.failures.push(ts);
-      prune(entry.failures, ts, ROLLING_WINDOW_MS);
-      onProbeFailure(ts);
-      if (!isProbe && entry.failures.length >= FAIL_THRESHOLD) {
-        trip(entry, ts);
-        if (!entry.warned) {
-          entry.warned = true;
-          console.error(
-            `[fetchBreaker] ${entry.failures.length} network errors on ${key} in ${ROLLING_WINDOW_MS / 1e3}s. Blocking for up to ${COOLDOWN_MS / 1e3}s.`
-          );
-        }
-      }
-      throw err;
-    }
-    if (response.status >= 500 || response.status === 0) {
-      const ts = Date.now();
-      entry.failures.push(ts);
-      prune(entry.failures, ts, ROLLING_WINDOW_MS);
-      onProbeFailure(ts);
-      if (!isProbe && entry.failures.length >= FAIL_THRESHOLD) {
-        trip(entry, ts);
-        if (!entry.warned) {
-          entry.warned = true;
-          console.error(
-            `[fetchBreaker] ${entry.failures.length} ${response.status}s on ${key} in ${ROLLING_WINDOW_MS / 1e3}s. Blocking for up to ${COOLDOWN_MS / 1e3}s.`
-          );
-        }
-      }
-    } else if (response.status < 400) {
-      reset(entry);
-    } else {
-      if (isProbe) reset(entry);
-    }
-    return response;
-  });
-};
-
-// datastore.ts
-var _runtimeOrgId = null;
-var setRuntimeOrgId = (orgId) => {
-  _runtimeOrgId = orgId || null;
-};
-var getOrgId = () => {
-  if (_runtimeOrgId) return _runtimeOrgId;
-  try {
-    const userInfo = localStorage.getItem("shuffle_user_info") || localStorage.getItem("userinfo") || localStorage.getItem("user_info");
-    if (userInfo) {
-      const parsed = JSON.parse(userInfo);
-      return parsed.active_org?.id || parsed.org_id || parsed.active_org_id || parsed.orgs && parsed.orgs[0]?.id || null;
-    }
-  } catch {
-  }
-  return null;
-};
-var ORG_ID_WAIT_MS = 8e3;
-var ORG_ID_POLL_MS = 100;
-var waitForOrgId = async () => {
-  const immediate = getOrgId();
-  if (immediate) return immediate;
-  if (typeof window === "undefined") return null;
-  const deadline = Date.now() + ORG_ID_WAIT_MS;
-  while (Date.now() < deadline) {
-    await new Promise((resolve) => setTimeout(resolve, ORG_ID_POLL_MS));
-    const orgId = getOrgId();
-    if (orgId) return orgId;
-  }
-  return null;
-};
-var decodeDatastoreKey = (key) => {
-  if (!key) return "";
-  if (!key.includes("%")) return key;
-  try {
-    return decodeURIComponent(key);
-  } catch {
-    return key.replace(/%3a/gi, ":");
-  }
-};
-var normalizeDatastoreKey = (key) => {
-  if (!key) return key;
-  const decoded = decodeDatastoreKey(key);
-  if (!decoded.includes("::")) return decoded;
-  const parts = decoded.split("::").filter(Boolean);
-  return parts.length > 0 ? parts[parts.length - 1] : decoded;
-};
-var extractOrgIdFromDatastoreKey = (key) => {
-  if (!key) return null;
-  const decoded = decodeDatastoreKey(key);
-  if (!decoded.includes("::")) return null;
-  const parts = decoded.split("::").filter(Boolean);
-  return parts.length > 1 ? parts[0] : null;
-};
-var truncateResponsePreview = (value, maxLength = 280) => {
-  if (!value) return void 0;
-  const normalized = value.replace(/\s+/g, " ").trim();
-  if (!normalized) return void 0;
-  return normalized.length > maxLength ? `${normalized.slice(0, maxLength)}\u2026` : normalized;
-};
-var wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-var isTransientDatastoreStatus = (status) => {
-  return status === 408 || status === 425 || status === 429 || status >= 500;
-};
-var isSameDatastoreKey = (a, b) => {
-  if (!a) return false;
-  return normalizeDatastoreKey(a) === normalizeDatastoreKey(b);
-};
-var serializeDatastoreValue = (value) => {
-  if (typeof value === "string") {
-    const trimmed = value.trim();
-    if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-      try {
-        return JSON.stringify(JSON.parse(trimmed));
-      } catch {
-        return value;
-      }
-    }
-    return value;
-  }
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-};
-var DATASTORE_VALUE_SOFT_LIMIT_BYTES = 9e5;
-var DATASTORE_VALUE_HARD_LIMIT_BYTES = 14e5;
-var byteLength = (s) => {
-  try {
-    return new Blob([s]).size;
-  } catch {
-    return s.length;
-  }
-};
-var looksLikeValueTooBig = (status, body) => {
-  if (status < 500) return false;
-  const b = (body || "").toLowerCase();
-  return b.includes("value") && (b.includes("too big") || b.includes("too large") || b.includes("size") || b.includes("limit"));
-};
-var slimIncidentValueForWrite = (raw) => {
-  let obj;
-  try {
-    obj = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (!obj || typeof obj !== "object") return null;
-  const dropped = [];
-  const stripBase64Attachments = (node) => {
-    if (!node || typeof node !== "object") return;
-    if (Array.isArray(node.attachments)) {
-      for (const a of node.attachments) {
-        if (a && typeof a === "object" && typeof a.data === "string" && a.data.length > 4e3) {
-          a.data = "";
-          a._truncated = true;
-        }
-      }
-    }
-    for (const k of Object.keys(node)) {
-      const v = node[k];
-      if (v && typeof v === "object") stripBase64Attachments(v);
-    }
-  };
-  stripBase64Attachments(obj);
-  dropped.push("attachments.data");
-  const capString = (s, cap = 2e5) => typeof s === "string" && s.length > cap ? s.slice(0, cap) + "\u2026[truncated]" : s;
-  if (obj.email && typeof obj.email === "object") {
-    if (typeof obj.email.body_html === "string") obj.email.body_html = capString(obj.email.body_html);
-    if (typeof obj.email.body === "string") obj.email.body = capString(obj.email.body);
-    if (Array.isArray(obj.email.messages)) {
-      for (const m of obj.email.messages) {
-        if (m && typeof m === "object") {
-          if (typeof m.body_html === "string") m.body_html = capString(m.body_html);
-          if (typeof m.body === "string") m.body = capString(m.body);
-        }
-      }
-    }
-    dropped.push("email.body_html");
-  }
-  if (obj.rawOCSF?.unmapped_original) {
-    obj.rawOCSF = { ...obj.rawOCSF };
-    delete obj.rawOCSF.unmapped_original;
-    dropped.push("rawOCSF.unmapped_original");
-  }
-  if (Array.isArray(obj.activity) && obj.activity.length > 200) {
-    obj.activity = obj.activity.slice(-200);
-    dropped.push("activity[older]");
-  }
-  if (Array.isArray(obj.timeline) && obj.timeline.length > 200) {
-    obj.timeline = obj.timeline.slice(-200);
-    dropped.push("timeline[older]");
-  }
-  return { value: JSON.stringify(obj), dropped };
-};
-var parseWriteResponseBody = (bodyText) => {
-  if (!bodyText) return {};
-  try {
-    const parsed = JSON.parse(bodyText);
-    if (!parsed || typeof parsed !== "object") return {};
-    const rawKeys = Array.isArray(parsed.keys_existed) ? parsed.keys_existed : void 0;
-    return {
-      success: typeof parsed.success === "boolean" ? parsed.success : void 0,
-      keysExisted: rawKeys?.map((k) => ({
-        key: String(k?.key ?? ""),
-        existed: !!k?.existed,
-        changed: !!k?.changed
-      }))
-    };
-  } catch {
-    return {};
-  }
-};
-var isUnchangedWrite = (keysExisted) => !!keysExisted && keysExisted.length > 0 && keysExisted.every((k) => k.existed && !k.changed);
-var datastoreUrl = (path, regionUrl) => regionUrl ? `${regionUrl.replace(/\/+$/, "")}${path}` : getApiUrl(path);
-var setDatastoreItem = async (key, value, category, overrideOrgId, options) => {
-  const extractedOrgId = !overrideOrgId ? extractOrgIdFromDatastoreKey(key) : null;
-  const orgId = overrideOrgId || extractedOrgId || await waitForOrgId();
-  if (!orgId) {
-    return { success: false, error: "No organization ID found" };
-  }
-  const rawKey = normalizeDatastoreKey(key);
-  let serialized = serializeDatastoreValue(value);
-  if (category === "shuffle-security_incidents" && byteLength(serialized) > DATASTORE_VALUE_SOFT_LIMIT_BYTES) {
-    const slim = slimIncidentValueForWrite(serialized);
-    if (slim) {
-      console.warn(
-        `[datastore.set] pre-slim incident ${rawKey} bytes=${byteLength(serialized)} -> ${byteLength(slim.value)} dropped=${slim.dropped.join(",")}`
-      );
-      serialized = slim.value;
-    }
-  }
-  if (byteLength(serialized) > DATASTORE_VALUE_HARD_LIMIT_BYTES) {
-    return {
-      success: false,
-      error: `Datastore value too large (${byteLength(serialized)} bytes) after slimming; write aborted for ${rawKey}`
-    };
-  }
-  const buildPayload = (v) => [{
-    key: rawKey,
-    value: v,
-    category,
-    org_id: orgId,
-    ...category === "shuffle-security_incidents" ? { ignore_security_rules: true } : {}
-  }];
-  const headers = {
-    "Content-Type": "application/json",
-    ...getAuthHeader(orgId)
-  };
-  console.log(`[datastore.set] key=${rawKey} category=${category} orgId=${orgId} bytes=${byteLength(serialized)}${overrideOrgId ? " (override)" : ""}`);
-  const send = (v) => fetch(datastoreUrl("/api/v2/datastore", options?.regionUrl), {
-    method: "POST",
-    credentials: "include",
-    headers,
-    body: JSON.stringify(buildPayload(v))
-  });
-  let response = await send(serialized);
-  if (!response.ok) {
-    const bodyText = await response.text().catch(() => "");
-    const parsed = parseWriteResponseBody(bodyText);
-    if (isUnchangedWrite(parsed.keysExisted)) {
-      console.log(`[datastore.set] key=${rawKey} unchanged (value identical) \u2014 treated as no-op`);
-      return { success: true, changed: false, keysExisted: parsed.keysExisted };
-    }
-    if (category === "shuffle-security_incidents" && looksLikeValueTooBig(response.status, bodyText)) {
-      const slim = slimIncidentValueForWrite(serialized);
-      if (slim && slim.value.length < serialized.length) {
-        console.warn(
-          `[datastore.set] backend rejected large value for ${rawKey}; retrying slimmed bytes=${byteLength(slim.value)} dropped=${slim.dropped.join(",")}`
-        );
-        response = await send(slim.value);
-        if (response.ok) {
-          const retryOk = parseWriteResponseBody(await response.text().catch(() => ""));
-          return {
-            success: true,
-            keysExisted: retryOk.keysExisted,
-            changed: retryOk.keysExisted ? retryOk.keysExisted.some((k) => k.changed) : void 0
-          };
-        }
-        const retryBody = await response.text().catch(() => "");
-        const retryParsed = parseWriteResponseBody(retryBody);
-        if (isUnchangedWrite(retryParsed.keysExisted)) {
-          return { success: true, changed: false, keysExisted: retryParsed.keysExisted };
-        }
-        return {
-          success: false,
-          error: `Datastore value too large for ${rawKey} even after slimming: ${response.status} ${truncateResponsePreview(retryBody) || response.statusText}`,
-          keysExisted: retryParsed.keysExisted
-        };
-      }
-      return {
-        success: false,
-        error: `Datastore value too large for ${rawKey}: ${response.status} ${truncateResponsePreview(bodyText) || response.statusText}`,
-        keysExisted: parsed.keysExisted
-      };
-    }
-    return {
-      success: false,
-      error: `Failed to set datastore item: ${response.status} ${truncateResponsePreview(bodyText) || response.statusText}`,
-      keysExisted: parsed.keysExisted
-    };
-  }
-  const okParsed = parseWriteResponseBody(await response.text().catch(() => ""));
-  if (okParsed.success === false && !isUnchangedWrite(okParsed.keysExisted)) {
-    return {
-      success: false,
-      error: `Failed to set datastore item ${rawKey}: backend reported success=false`,
-      keysExisted: okParsed.keysExisted
-    };
-  }
-  return {
-    success: true,
-    keysExisted: okParsed.keysExisted,
-    changed: okParsed.keysExisted ? okParsed.keysExisted.some((k) => k.changed) : void 0
-  };
-};
-var setDatastoreItems = async (items, category) => {
-  const orgId = await waitForOrgId();
-  if (!orgId) {
-    return { success: false, error: "No organization ID found" };
-  }
-  const payload = items.map((item) => ({
-    key: item.key,
-    value: serializeDatastoreValue(item.value),
-    category,
-    ...category === "shuffle-security_incidents" ? { ignore_security_rules: true } : {}
-  }));
-  const response = await fetch(getApiUrl("/api/v2/datastore"), {
-    method: "POST",
-    credentials: "include",
-    headers: {
-      "Content-Type": "application/json",
-      ...getAuthHeader(orgId)
-    },
-    body: JSON.stringify(payload)
-  });
-  if (!response.ok) {
-    const bodyText = await response.text().catch(() => "");
-    const parsed = parseWriteResponseBody(bodyText);
-    if (isUnchangedWrite(parsed.keysExisted)) {
-      return { success: true, changed: false, keysExisted: parsed.keysExisted };
-    }
-    const fallbackResults = await Promise.all(items.map(
-      (item) => setDatastoreItem(item.key, item.value, category)
-    ));
-    const failedWrites = fallbackResults.filter((result) => !result.success);
-    if (failedWrites.length > 0) {
-      return {
-        success: false,
-        error: failedWrites[0]?.error || `Failed to set datastore items: ${response.statusText}`,
-        keysExisted: fallbackResults.flatMap((r) => r.keysExisted || [])
-      };
-    }
-    const fallbackKeys = fallbackResults.flatMap((r) => r.keysExisted || []);
-    return {
-      success: true,
-      keysExisted: fallbackKeys.length ? fallbackKeys : void 0,
-      changed: fallbackKeys.length ? fallbackKeys.some((k) => k.changed) : void 0
-    };
-  }
-  const okParsed = parseWriteResponseBody(await response.text().catch(() => ""));
-  if (okParsed.keysExisted?.some((k) => !k.changed)) {
-    console.warn(
-      `[datastore.setMany] category=${category} unchanged keys: ${okParsed.keysExisted.filter((k) => !k.changed).map((k) => k.key).join(", ")}`
-    );
-  }
-  return {
-    success: okParsed.success !== false,
-    keysExisted: okParsed.keysExisted,
-    changed: okParsed.keysExisted ? okParsed.keysExisted.some((k) => k.changed) : void 0,
-    ...okParsed.success === false ? { error: "Backend reported success=false for bulk datastore write" } : {}
-  };
-};
-var getDatastoreItem = async (key, category, overrideOrgId, options) => {
-  const extractedOrgId = !overrideOrgId ? extractOrgIdFromDatastoreKey(key) : null;
-  const orgId = overrideOrgId || extractedOrgId || await waitForOrgId();
-  if (!orgId) {
-    return { success: false, error: "No organization ID found" };
-  }
-  const rawKey = normalizeDatastoreKey(key);
-  const payload = {
-    key: rawKey,
-    org_id: orgId
-  };
-  if (category) {
-    payload.category = category;
-  }
-  const isVulnsCategory = category === "shuffle-security_vulns" || category === "shuffle-security_vulnerabilities" || category === "vulns";
-  const requestUrl = isVulnsCategory ? datastoreUrl(`/api/v2/vulns/${encodeURIComponent(rawKey)}`, options?.regionUrl) : datastoreUrl(`/api/v1/orgs/${orgId}/get_cache`, options?.regionUrl);
-  const baseDiagnostics = {
-    operation: "get",
-    category,
-    orgId,
-    url: requestUrl,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const headers = {
-    "Content-Type": "application/json",
-    ...getAuthHeader(orgId)
-  };
-  console.log(`[datastore.get] key=${rawKey} category=${category} orgId=${orgId}${overrideOrgId ? " (override)" : ""}`);
-  let response = null;
-  let rawBody = "";
-  const maxAttempts = category === "shuffle-security_incidents" ? 3 : 2;
-  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const release = await acquireDatastoreSlot(options?.priority === true);
-    try {
-      response = await fetch(requestUrl, {
-        method: isVulnsCategory ? "GET" : "POST",
-        credentials: "include",
-        headers,
-        body: isVulnsCategory ? void 0 : JSON.stringify(payload)
-      });
-      rawBody = await response.text();
-      if (response.ok || response.status === 404 || !isTransientDatastoreStatus(response.status) || attempt === maxAttempts - 1) {
-        break;
-      }
-    } catch (error) {
-      if (attempt === maxAttempts - 1) {
-        release();
-        return {
-          success: false,
-          error: error instanceof Error ? error.message : "Failed to get datastore item",
-          diagnostics: {
-            ...baseDiagnostics,
-            errorStage: "request",
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          }
-        };
-      }
-    } finally {
-      release();
-    }
-    await wait(400 * (attempt + 1));
-  }
-  if (!response) {
-    return {
-      success: false,
-      error: "Failed to get datastore item",
-      diagnostics: {
-        ...baseDiagnostics,
-        errorStage: "request",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-  }
-  if (!response.ok) {
-    if (response.status === 404) {
-      return {
-        success: true,
-        item: void 0,
-        diagnostics: {
-          ...baseDiagnostics,
-          status: response.status,
-          statusText: response.statusText,
-          contentType: response.headers.get("content-type"),
-          bodyPreview: truncateResponsePreview(rawBody),
-          errorStage: "response",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        }
-      };
-    }
-    if (category === "shuffle-security_incidents" && isTransientDatastoreStatus(response.status) && !isCircuitBreakerResponse(response)) {
-      const fallbackItem = await findDatastoreItemInCategoryPages(rawKey, category, orgId);
-      if (fallbackItem) {
-        return {
-          success: true,
-          item: fallbackItem,
-          diagnostics: {
-            ...baseDiagnostics,
-            status: response.status,
-            statusText: `${response.statusText || "transient"}; recovered via list_cache`,
-            contentType: response.headers.get("content-type"),
-            bodyPreview: truncateResponsePreview(rawBody),
-            errorStage: "response",
-            timestamp: (/* @__PURE__ */ new Date()).toISOString()
-          }
-        };
-      }
-    }
-    if (isCircuitBreakerResponse(response)) {
-      return {
-        success: false,
-        error: "circuit_breaker_open",
-        diagnostics: {
-          ...baseDiagnostics,
-          status: response.status,
-          statusText: response.statusText,
-          contentType: response.headers.get("content-type"),
-          bodyPreview: truncateResponsePreview(rawBody),
-          errorStage: "response",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        }
-      };
-    }
-    return {
-      success: false,
-      error: `Failed to get datastore item: ${response.status} ${response.statusText}`.trim(),
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType: response.headers.get("content-type"),
-        bodyPreview: truncateResponsePreview(rawBody),
-        errorStage: "response",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-  }
-  let data;
-  try {
-    data = rawBody ? JSON.parse(rawBody) : {};
-  } catch (error) {
-    return {
-      success: false,
-      error: error instanceof Error ? `Failed to parse datastore item response: ${error.message}` : "Failed to parse datastore item response",
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType: response.headers.get("content-type"),
-        bodyPreview: truncateResponsePreview(rawBody),
-        errorStage: "parse",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-  }
-  if (data.success === false && !data.value) {
-    return {
-      success: true,
-      item: void 0,
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType: response.headers.get("content-type"),
-        bodyPreview: truncateResponsePreview(rawBody),
-        responseShape: "unknown",
-        itemCount: 0,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-  }
-  if (typeof data.value !== "string") {
-    if (data && typeof data === "object" && (data.id || data.title || data.cve_id || data.affected)) {
-      return {
-        success: true,
-        item: {
-          key: data.id || rawKey,
-          value: JSON.stringify(data),
-          category: category || "shuffle-security_vulns",
-          org_id: orgId,
-          ...data
-        },
-        diagnostics: {
-          ...baseDiagnostics,
-          status: response.status,
-          statusText: response.statusText,
-          contentType: response.headers.get("content-type"),
-          bodyPreview: truncateResponsePreview(rawBody),
-          responseShape: "object",
-          itemCount: 1,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        }
-      };
-    }
-    return {
-      success: true,
-      item: void 0,
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType: response.headers.get("content-type"),
-        bodyPreview: truncateResponsePreview(rawBody),
-        responseShape: "unknown",
-        itemCount: 0,
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-  }
-  return {
-    success: true,
-    item: data,
-    diagnostics: {
-      ...baseDiagnostics,
-      status: response.status,
-      statusText: response.statusText,
-      contentType: response.headers.get("content-type"),
-      responseShape: "unknown",
-      itemCount: data?.key ? 1 : 0,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-};
-async function findDatastoreItemInCategoryPages(rawKey, category, orgId) {
-  let cursor;
-  for (let page = 0; page < 12; page += 1) {
-    const response = await getDatastoreByCategory(category, cursor, 100, orgId);
-    if (!response.success) return null;
-    const found = (response.data || []).find((item) => isSameDatastoreKey(item.key, rawKey));
-    if (found) return found;
-    if (!response.cursor) return null;
-    cursor = response.cursor;
-  }
-  return null;
-}
-var getDatastoreItemPublic = async (key, orgId, authorization) => {
-  const response = await fetch(
-    getApiUrl(`/api/v1/orgs/${orgId}/cache/${key}?authorization=${authorization}`),
-    { method: "GET" }
-  );
-  if (!response.ok) {
-    if (response.status === 404) {
-      return { success: true, item: void 0 };
-    }
-    return { success: false, error: `Failed to get public datastore item: ${response.statusText}` };
-  }
-  const data = await response.json();
-  if (data.success === false && !data.value) {
-    return { success: true, item: void 0 };
-  }
-  return { success: true, item: data };
-};
-var tryExtractItemsFromBody = (rawBody) => {
-  try {
-    const data = rawBody ? JSON.parse(rawBody) : null;
-    if (!data || typeof data !== "object") return null;
-    const items = Array.isArray(data) ? data : data.keys || data.data || [];
-    if (!Array.isArray(items) || items.length === 0) return null;
-    if (!items.some((i) => i && typeof i === "object" && typeof i.key === "string")) return null;
-    const shape = Array.isArray(data) ? "array" : Array.isArray(data?.keys) ? "keys" : Array.isArray(data?.data) ? "data" : "unknown";
-    return {
-      items,
-      categoryConfig: data.category_config,
-      cursor: data.cursor,
-      totalAmount: data.total_amount,
-      shape
-    };
-  } catch {
-    return null;
-  }
-};
-var scopeItemsToOrg = (items, orgId) => {
-  if (!Array.isArray(items)) return items;
-  const mismatched = items.filter((item) => {
-    const owner = item?.org_id || item?.orgId;
-    return typeof owner === "string" && owner && owner !== orgId;
-  }).length;
-  if (mismatched > 0) {
-    console.debug(`[Datastore] ${mismatched}/${items.length} items have a different org_id than ${orgId} \u2014 showing them anyway`);
-  }
-  return items;
-};
-var filterItemsByCategory = (items, category) => {
-  if (!Array.isArray(items) || !category || category === "all") return items;
-  const targetCategory = category.trim().toLowerCase();
-  const isVulns = targetCategory === "shuffle-security_vulns" || targetCategory === "shuffle-security_vulnerabilities" || targetCategory === "vulns";
-  const vulnAliases = /* @__PURE__ */ new Set(["shuffle-security_vulns", "shuffle-security_vulnerabilities", "vulns"]);
-  const filtered = items.filter((item) => {
-    if (!item || typeof item !== "object") return false;
-    const itemCat = typeof item.category === "string" ? item.category.trim().toLowerCase() : "";
-    if (!itemCat) return true;
-    if (isVulns) return vulnAliases.has(itemCat);
-    return itemCat === targetCategory;
-  });
-  const leakedCount = items.length - filtered.length;
-  if (leakedCount > 0) {
-    console.warn(`[Datastore] Filtered out ${leakedCount}/${items.length} items with mismatched category (requested: "${category}") due to backend analyzed-match leakage`);
-  }
-  return filtered;
-};
-var getDatastorePageSize = (category, limit) => limit ?? (category === DATASTORE_CATEGORIES.INCIDENTS ? 50 : 100);
-var getDatastoreByCategory = async (category, cursor, limit, overrideOrgId) => {
-  const orgId = overrideOrgId || await waitForOrgId();
-  if (!orgId) {
-    return {
-      success: false,
-      error: "No organization ID found",
-      diagnostics: {
-        operation: "list",
-        category,
-        orgId: null,
-        cursor,
-        errorStage: "request",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-  }
-  const effectiveLimit = getDatastorePageSize(category, limit);
-  const isVulnsCategory = category === "shuffle-security_vulns" || category === "shuffle-security_vulnerabilities" || category === "vulns";
-  let url = isVulnsCategory ? `/api/v2/vulns?skip_fields=false&top=${effectiveLimit}` : `/api/v1/orgs/${orgId}/list_cache?category=${encodeURIComponent(category)}&top=${effectiveLimit}`;
-  if (cursor) {
-    url += `&cursor=${encodeURIComponent(cursor)}`;
-  }
-  const requestUrl = getApiUrl(url);
-  const baseDiagnostics = {
-    operation: "list",
-    category,
-    orgId,
-    url: requestUrl,
-    cursor,
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  let response;
-  try {
-    response = await fetch(
-      requestUrl,
-      {
-        method: "GET",
-        credentials: "include",
-        headers: {
-          "Content-Type": "application/json",
-          ...getAuthHeader(orgId)
-        }
-      }
-    );
-  } catch (error) {
-    try {
-      response = await fetch(
-        requestUrl,
-        {
-          method: "GET",
-          credentials: "include",
-          headers: {
-            "Content-Type": "application/json",
-            ...getAuthHeader(orgId)
-          }
-        }
-      );
-    } catch (retryError) {
-      return {
-        success: false,
-        error: retryError instanceof Error ? retryError.message : "Failed to request datastore items",
-        diagnostics: {
-          ...baseDiagnostics,
-          errorStage: "request"
-        }
-      };
-    }
-  }
-  const contentType = response.headers.get("content-type");
-  const rawBody = await response.text();
-  if (!response.ok) {
-    const extracted = tryExtractItemsFromBody(rawBody);
-    if (extracted && extracted.items.length > 0) {
-      console.warn(`[Datastore] ${response.status} response for category=${category} but body contained ${extracted.items.length} valid items \u2014 treating as success`);
-      const rawCount = extracted.items.length;
-      const scoped = scopeItemsToOrg(extracted.items, orgId);
-      const filtered = filterItemsByCategory(scoped, category);
-      return {
-        success: true,
-        data: filtered,
-        rawItemCount: rawCount,
-        categoryConfig: extracted.categoryConfig,
-        cursor: extracted.cursor,
-        totalAmount: extracted.totalAmount,
-        diagnostics: {
-          ...baseDiagnostics,
-          status: response.status,
-          statusText: response.statusText,
-          contentType,
-          responseShape: extracted.shape,
-          itemCount: filtered.length,
-          rawItemCount: rawCount,
-          totalAmount: extracted.totalAmount ?? null
-        }
-      };
-    }
-    if (response.status >= 400 && response.status < 500) {
-      try {
-        const retryResponse = await fetch(
-          requestUrl,
-          {
-            method: "GET",
-            credentials: "include",
-            headers: {
-              "Content-Type": "application/json",
-              ...getAuthHeader(orgId)
-            }
-          }
-        );
-        const retryBody = await retryResponse.text();
-        const retryExtracted = tryExtractItemsFromBody(retryBody);
-        if (retryResponse.ok || retryExtracted && retryExtracted.items.length > 0) {
-          const rawCount = (retryExtracted?.items || []).length;
-          const scoped = scopeItemsToOrg(retryExtracted?.items || [], orgId);
-          const filtered = filterItemsByCategory(scoped, category);
-          console.warn(`[Datastore] Retry succeeded for category=${category} (status=${retryResponse.status}, items=${filtered.length})`);
-          return {
-            success: true,
-            data: filtered,
-            rawItemCount: rawCount,
-            categoryConfig: retryExtracted?.categoryConfig,
-            cursor: retryExtracted?.cursor,
-            totalAmount: retryExtracted?.totalAmount,
-            diagnostics: {
-              ...baseDiagnostics,
-              status: retryResponse.status,
-              statusText: retryResponse.statusText,
-              contentType: retryResponse.headers.get("content-type"),
-              responseShape: retryExtracted?.shape || "unknown",
-              itemCount: filtered.length,
-              rawItemCount: rawCount,
-              totalAmount: retryExtracted?.totalAmount ?? null
-            }
-          };
-        }
-      } catch {
-      }
-    }
-    return {
-      success: false,
-      error: isCircuitBreakerResponse(response) ? "circuit_breaker_open" : `Failed to get datastore items: ${response.status} ${response.statusText}`.trim(),
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType,
-        bodyPreview: truncateResponsePreview(rawBody),
-        errorStage: "response"
-      }
-    };
-  }
-  try {
-    const data = rawBody ? JSON.parse(rawBody) : {};
-    const responseShape = Array.isArray(data) ? "array" : Array.isArray(data?.keys) ? "keys" : Array.isArray(data?.data) ? "data" : "unknown";
-    const items = Array.isArray(data) ? data : data.keys || data.data || [];
-    const rawCount = Array.isArray(items) ? items.length : 0;
-    const scoped = scopeItemsToOrg(items, orgId);
-    const filtered = filterItemsByCategory(scoped, category);
-    const totalAmount = data.total_amount ?? data.total ?? data.amount;
-    return {
-      success: true,
-      data: filtered,
-      rawItemCount: rawCount,
-      categoryConfig: data.category_config,
-      cursor: data.cursor,
-      totalAmount,
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType,
-        responseShape,
-        itemCount: filtered.length,
-        rawItemCount: rawCount,
-        totalAmount: totalAmount ?? null
-      }
-    };
-  } catch (error) {
-    return {
-      success: false,
-      error: error instanceof Error ? `Failed to parse datastore response: ${error.message}` : "Failed to parse datastore response",
-      diagnostics: {
-        ...baseDiagnostics,
-        status: response.status,
-        statusText: response.statusText,
-        contentType,
-        bodyPreview: truncateResponsePreview(rawBody),
-        errorStage: "parse"
-      }
-    };
-  }
-};
-var deleteDatastoreItem = async (key, category, overrideOrgId, options) => {
-  const extractedOrgId = !overrideOrgId ? extractOrgIdFromDatastoreKey(key) : null;
-  const orgId = overrideOrgId || extractedOrgId || await waitForOrgId();
-  if (!orgId) {
-    return { success: false, error: "No organization ID found" };
-  }
-  const rawKey = normalizeDatastoreKey(key);
-  const payload = {
-    key: rawKey,
-    org_id: orgId
-  };
-  if (category) {
-    payload.category = category;
-  }
-  const headers = {
-    "Content-Type": "application/json",
-    ...getAuthHeader(orgId)
-  };
-  console.log(`[datastore.delete] key=${rawKey} category=${category} orgId=${orgId}${overrideOrgId ? " (override)" : ""}`);
-  const response = await fetch(datastoreUrl(`/api/v1/orgs/${orgId}/delete_cache`, options?.regionUrl), {
-    method: "POST",
-    credentials: "include",
-    headers,
-    body: JSON.stringify(payload)
-  });
-  if (!response.ok) {
-    return { success: false, error: `Failed to delete datastore item: ${response.statusText}` };
-  }
-  return { success: true };
-};
-var deleteDatastoreItems = async (keys, category) => {
-  const orgId = await waitForOrgId();
-  if (!orgId) {
-    return { success: false, deleted: 0, failed: keys, error: "No organization ID found" };
-  }
-  const results = await Promise.allSettled(
-    keys.map((key) => deleteDatastoreItem(key, category))
-  );
-  const failed = [];
-  let deleted = 0;
-  results.forEach((result, index) => {
-    if (result.status === "fulfilled" && result.value.success) {
-      deleted++;
-    } else {
-      failed.push(keys[index]);
-    }
-  });
-  return {
-    success: failed.length === 0,
-    deleted,
-    failed
-  };
-};
-var DATASTORE_CATEGORIES = {
-  INCIDENTS: "shuffle-security_incidents",
-  EVENTS: "shuffle-security_events",
-  VULNERABILITIES: "shuffle-security_vulns",
-  VULNS: "shuffle-security_vulns",
-  ASSETS: "shuffle-security_assets",
-  PACKAGES: "shuffle-security_packages",
-  SOFTWARE: "shuffle-security_software",
-  TEMPLATES: "shuffle-security_templates",
-  CONFIGURATION: "shuffle-security_configuration",
-  IOCS: "shuffle-security_ioc-config",
-  CUSTOM_FIELDS: "shuffle-security_custom-fields",
-  THREAT_FEEDS: "shuffle-security_threat-feeds",
-  INFRASTRUCTURE: "shuffle-security_infrastructure",
-  USERS: "shuffle-security_users",
-  REPORTS: "shuffle-security_reports",
-  // Legacy - for migration purposes
-  LEGACY_ALERTS: "shuffle-security_alerts",
-  LEGACY_CASES: "shuffle-security_cases"
-};
-
-export {
-  registerProtectedOrigin,
-  installFetchBreaker,
-  setRuntimeOrgId,
-  setDatastoreItem,
-  setDatastoreItems,
-  getDatastoreItem,
-  getDatastoreItemPublic,
-  filterItemsByCategory,
-  getDatastorePageSize,
-  getDatastoreByCategory,
-  deleteDatastoreItem,
-  deleteDatastoreItems,
-  DATASTORE_CATEGORIES
-};