broods 0.40.0 → 0.40.1

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{H,S,b,j,x,V,_,f,q,h,O,C,D,W,E,ne,w,g}from"../chunk-kafpmgd4.js";import{chmod as Tr,lstat as Ur,mkdir as pn,readFile as kt,readdir as Lr,stat as Nr,writeFile as J}from"node:fs/promises";import{createHash as St}from"node:crypto";import{basename as Br,join as Oe,relative as Mr,resolve as A,sep as Kr}from"node:path";import{watch as Gr}from"node:fs";import{spawn as $t}from"node:child_process";import{tmpdir as Wr}from"node:os";import{performance as pt}from"node:perf_hooks";import{stripVTControlCharacters as Fr}from"node:util";import{fileURLToPath as Lt,pathToFileURL as Un}from"node:url";import{createHash as Nt}from"node:crypto";import{readFileSync as Bt}from"node:fs";import{mkdtemp as Ln,readdir as Nn,readFile as Mt,rm as Bn,writeFile as He}from"node:fs/promises";import Cn from"node:module";import{tmpdir as Mn}from"node:os";import{basename as Kt,isAbsolute as Gt,join as ee,relative as ge,resolve as Ae}from"node:path";import{build as Wt,transformSync as Kn}from"esbuild";var En={anthropic:{label:"Anthropic",modelPlaceholder:"claude-sonnet-4-5-20250929"},azure:{label:"Azure OpenAI",modelPlaceholder:"gpt-4.1-mini"},baseten:{label:"Baseten",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},bedrock:{label:"Amazon Bedrock",modelPlaceholder:"anthropic.claude-sonnet-4-5-20250929-v1:0"},cerebras:{label:"Cerebras",modelPlaceholder:"llama3.1-8b"},cohere:{label:"Cohere",modelPlaceholder:"command-a-03-2025"},custom:{label:"Custom OpenAI-compatible",modelPlaceholder:"gpt-oss-120b"},deepinfra:{label:"DeepInfra",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},deepseek:{label:"DeepSeek",modelPlaceholder:"deepseek-chat"},fireworks:{label:"Fireworks",modelPlaceholder:"accounts/fireworks/models/deepseek-v3"},google:{label:"Google",modelPlaceholder:"gemini-2.5-flash"},groq:{label:"Groq",modelPlaceholder:"llama-3.3-70b-versatile"},minimax:{label:"MiniMax",modelPlaceholder:"MiniMax-M2.7"},mistral:{label:"Mistral",modelPlaceholder:"mistral-large-latest"},openai:{label:"OpenAI",modelPlaceholder:"gpt-4.1-mini"},perplexity:{label:"Perplexity",modelPlaceholder:"sonar-pro"},togetherai:{label:"Together.ai",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},v0:{label:"Vercel v0",modelPlaceholder:"v0-1.0-md"},vercel:{label:"Vercel AI Gateway",modelPlaceholder:"openai/gpt-4.1-mini"},vertex:{label:"Google Vertex AI",modelPlaceholder:"gemini-2.5-flash"},xai:{label:"xAI Grok",modelPlaceholder:"grok-4"}},On=Object.keys(En);function Rn(e){return Object.hasOwn(En,e)}var we="*",Ft=`const passthrough = (input) => input;
+import{W,S,_,O,z,G,K,b,f,D,m,A,E,U,Y,C,ie,w,g}from"../chunk-5epfg4tw.js";import{chmod as Yr,lstat as Jr,mkdir as vn,readFile as xt,readdir as qr,stat as Zr,writeFile as ge}from"node:fs/promises";import{createHash as jt}from"node:crypto";import{basename as Xr,join as Pe,relative as Qr,resolve as x,sep as es}from"node:path";import{watch as ns}from"node:fs";import{spawn as Pt}from"node:child_process";import{tmpdir as ts}from"node:os";import{performance as St}from"node:perf_hooks";import{stripVTControlCharacters as os}from"node:util";import{fileURLToPath as Jt,pathToFileURL as Bn}from"node:url";import{createHash as qt}from"node:crypto";import{readFileSync as Zt}from"node:fs";import{mkdtemp as Gn,readdir as Wn,readFile as Xt,rm as Fn,writeFile as Je}from"node:fs/promises";import Pn from"node:module";import{tmpdir as Kn}from"node:os";import{basename as Qt,isAbsolute as eo,join as oe,relative as ye,resolve as _e}from"node:path";import{build as no,transformSync as Hn}from"esbuild";var An={anthropic:{label:"Anthropic",modelPlaceholder:"claude-sonnet-4-5-20250929"},azure:{label:"Azure OpenAI",modelPlaceholder:"gpt-4.1-mini"},baseten:{label:"Baseten",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},bedrock:{label:"Amazon Bedrock",modelPlaceholder:"anthropic.claude-sonnet-4-5-20250929-v1:0"},cerebras:{label:"Cerebras",modelPlaceholder:"llama3.1-8b"},cohere:{label:"Cohere",modelPlaceholder:"command-a-03-2025"},custom:{label:"Custom OpenAI-compatible",modelPlaceholder:"gpt-oss-120b"},deepinfra:{label:"DeepInfra",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},deepseek:{label:"DeepSeek",modelPlaceholder:"deepseek-chat"},fireworks:{label:"Fireworks",modelPlaceholder:"accounts/fireworks/models/deepseek-v3"},google:{label:"Google",modelPlaceholder:"gemini-2.5-flash"},groq:{label:"Groq",modelPlaceholder:"llama-3.3-70b-versatile"},minimax:{label:"MiniMax",modelPlaceholder:"MiniMax-M2.7"},mistral:{label:"Mistral",modelPlaceholder:"mistral-large-latest"},openai:{label:"OpenAI",modelPlaceholder:"gpt-4.1-mini"},perplexity:{label:"Perplexity",modelPlaceholder:"sonar-pro"},togetherai:{label:"Together.ai",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},v0:{label:"Vercel v0",modelPlaceholder:"v0-1.0-md"},vercel:{label:"Vercel AI Gateway",modelPlaceholder:"openai/gpt-4.1-mini"},vertex:{label:"Google Vertex AI",modelPlaceholder:"gemini-2.5-flash"},xai:{label:"xAI Grok",modelPlaceholder:"grok-4"}},xn=Object.keys(An);function jn(e){return Object.hasOwn(An,e)}var $e="*",to=`const passthrough = (input) => input;
 export const defineAgent = passthrough;
 export const defineBroods = passthrough;
 export const defineCron = passthrough;
@@ -25,15 +25,15 @@ export const defineZaloChannel = passthrough;
 export const defineZaloConnection = passthrough;
 export const env = (name) => ({ __beeblastEnv: true, name });
 export default {};
-`,xe=1e7,An=50000000,Gn=1e7,xn=20000000,jn=200,Ht=new Set(["node_modules",".git"]),zt=[/^\.env(?:\.|$)/i,/^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,/\.(?:pem|key|p12|pfx)$/i],ze={onStart:"agent.started",onStepFinish:"agent.step.finished",onToolCall:"tool.call.started",onToolResult:"tool.result",onFinish:"agent.finished",onApproval:"agent.approval.required",onError:"agent.failed",onSubagentFinish:"subagent.task.finished",onMessageReceived:"channel.message.received",onMessageSending:"channel.message.sending"};async function te(e={}){let n=e.cwd??process.cwd();h(n);let t=Ae(n,S),o=await Vt(t),r=await Jt(o),s=await Zt(r,n,e.project),i=r.filter((m)=>g(m.value)).map((m)=>({exportName:m.exportName,file:m.file,resource:m.value})),a=i.map((m)=>m.resource);Dn(a),co(a);let c=uo(i,r),d=fo(a);for(let m of a)Qt(m);for(let m of a)eo(m);for(let m of a)no(m);to(a),ro(a),go(i,d);let l=lo(i),u=Yt(s,e.stage??(e.useRuntimeStage===!1?void 0:_()),e.command??"dev"),p=(await Promise.all(i.map((m)=>po(m,t,d)))).flat().sort((m,v)=>`${m.kind}:${m.name}`.localeCompare(`${v.kind}:${v.name}`));return Dn(p),{config:s,resources:a,resourceAliases:l,channels:c,manifest:{version:1,project:s.project,stage:u,resources:p}}}function Wn(e){let n=new Set;for(let t of e.resources)Ye(t.config,n);return[...n].sort()}function Ye(e,n){if(Array.isArray(e)){for(let t of e)Ye(t,n);return}if(e&&typeof e==="object"){let t=e;if(t.__beeblastEnv===!0&&typeof t.name==="string"){n.add(t.name);return}for(let o of Object.values(t))Ye(o,n)}}function Yt(e,n,t){if(n)return n;let o=e.stages?.[t];if(o)return o;return t==="deploy"?"production":"development"}async function Vt(e){let n=[];async function t(o){let r=await Nn(o,{withFileTypes:!0});for(let s of r){let i=ee(o,s.name);if(s.isDirectory()){if(s.name===b||s.name==="generated")continue;await t(i)}else if(s.isFile()&&s.name.endsWith(".ts"))n.push(i)}}return await t(e),n.sort((o,r)=>ge(e,o).localeCompare(ge(e,r)))}async function Jt(e){qt();let n=[];for(let t of e){let r=await import(`${Un(t).href}?t=${Date.now()}`);n.push(...Object.entries(r).map(([s,i])=>({exportName:s,file:t,value:i})))}return n}var Pn=!1;function qt(){if(Pn)return;if(Pn=!0,typeof Cn.registerHooks!=="function")return;Cn.registerHooks({load:(e,n,t)=>{let[o]=e.split("?");if(o===void 0||!o.startsWith("file:")||!o.endsWith(".ts"))return t(e,n);let r=Lt(o);return{format:"module",shortCircuit:!0,source:Kn(Bt(r,"utf8"),{loader:"ts",format:"esm",sourcefile:r,sourcemap:"inline"}).code}}})}async function Zt(e,n,t){let r=e.find((i)=>ne(i.value))?.value?.config??{},s=t??process.env.BROODS_PROJECT??r.project??Ko(Kt(Ae(n)));if(!s.trim())throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT.");return{...r,project:s}}var In=new Set(["agent","harness","model","provider","session","hooks","connections","tools","mcp","denyTools","sandboxes","workspaces","subagent","skills","scheduler","policies","publicAccess","allowRunOverrides"]),Xt={workspace:"workspaces",skill:"skills",policy:"policies",tool:"tools",mcpServers:"mcp",channel:"connections",channels:"connections",hook:"hooks",subagents:"subagent",systemPrompt:"agent",system:"agent"};function Qt(e){if(e.kind!=="agent")return;let n=e.config;for(let t of Object.keys(n)){if(In.has(t))continue;if(t==="sandbox")throw Error(`Agent "${e.name}" config.sandbox was removed; use sandboxes, the first is the default`);let o=Xt[t],r=o?` Did you mean "${o}"?`:` Allowed keys: ${[...In].sort().join(", ")}.`;throw Error(`Agent "${e.name}" has an unknown config key "${t}".${r}`)}}function eo(e){if(e.kind!=="workspace")return;let t=e.config.storage;if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Workspace "${e.name}" config.storage must be an object`);let o=t.provider;if(o===void 0||o==="s3")return;if(o==="vercel")throw Error(`Workspace "${e.name}" uses storage.provider "vercel", but Vercel Drive workspace storage is not supported yet. Use storage.provider "s3" or omit storage until Vercel Drive is wired.`);throw Error(`Workspace "${e.name}" config.storage.provider must be one of: s3`)}function no(e){if(e.kind!=="workspace")return;let n=e.config;if(typeof n.partitioned==="string")throw Error(`Workspace "${e.name}" config.partitioned must be a boolean; string modes are not supported.`);if(n.isolation!==void 0)throw Error(`Workspace "${e.name}" config.isolation is no longer supported; use partitioned: true.`)}function to(e){let n=new Map(e.filter((t)=>t.kind==="workspace").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=o.connections;if(r!==void 0&&!Array.isArray(r))throw Error(`Agent "${t.name}" config.connections must be an array of connection definitions`);let s=Array.isArray(r)?r.filter(w):[],i=new Set;for(let l of s){let u=l.config,p=typeof u.id==="string"?u.id:void 0;if(p){if(i.has(p))throw Error(`Duplicate channel id: ${p}`);i.add(p)}if(l.partition)Fn(l.partition,`Agent "${t.name}" connection "${l.type}"`);if(l.config&&typeof l.config==="object"&&(("workspaceIsolationScope"in l.config)||("workspaceScope"in l.config)))throw Error(`Agent "${t.name}" connection "${l.type}" uses workspaceScope, which is no longer supported; use partition.`)}let c=(Array.isArray(o.workspaces)?o.workspaces.map((l)=>oo(l,n)).filter((l)=>Boolean(l)):[]).filter((l)=>l.config.partitioned===!0),d=s.filter((l)=>l.partition);if(d.length>0&&c.length===0){let l=d[0];throw Error(`Agent "${t.name}" connection "${l.type}" defines partition, but no attached workspace has partitioned: true.`)}if(c.length>0){for(let l of s)if(!l.partition)throw Error(`Agent "${t.name}" attaches partitioned workspace "${c[0].name}", but connection "${l.type}" does not define partition.`)}}}function Fn(e,n){if(!e)return;if(e.by==="shared"){if("alias"in e&&e.alias!==void 0)throw Error(`${n} partition.alias is only supported when partition.by is conversation`);return}if(e.by!=="conversation")throw Error(`${n} partition.by must be one of: shared, conversation`);if(typeof e.alias!=="string"||e.alias.length===0)throw Error(`${n} partition.alias is required when partition.by is conversation`);if(!/^[A-Za-z0-9._-]+$/.test(e.alias))throw Error(`${n} partition.alias must use only letters, numbers, dots, underscores, or hyphens`);if(e.alias==="."||e.alias==="..")throw Error(`${n} partition.alias must not be "." or ".."`)}function oo(e,n){if(g(e)&&e.kind==="workspace")return e;if(typeof e==="string")return n.get(e);if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace;if(g(t)&&t.kind==="workspace")return t;if(typeof t==="string")return n.get(t)}return}function ro(e){let n=new Map(e.filter((t)=>t.kind==="sandbox").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=Hn(Array.isArray(o.sandboxes)?o.sandboxes[0]:void 0,n),s=o.workspaces;if(!Array.isArray(s))continue;for(let i of s){let a=io(i),c=so(i,r,n);if(!c||ao(c))continue;throw Error(`Agent "${t.name}" workspace "${a}" uses sandbox "${c.name}" (${zn(c)}) which does not support S3 workspace mounts. Use lambda/sandbox, or daytona with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`)}}}function Hn(e,n){if(g(e)&&e.kind==="sandbox")return e;if(typeof e==="string")return n.get(e);return}function so(e,n,t){if(e&&typeof e==="object"&&"sandbox"in e){let o=e.sandbox;if(o===null)return;return Hn(o,t)}return n}function io(e){if(g(e)&&e.kind==="workspace")return e.name;if(e&&typeof e==="object"&&"workspace"in e){let n=e.workspace;if(g(n))return n.name;if(typeof n==="string")return n}return"<unknown>"}function ao(e){let n=zn(e);if(n==="lambda"||n==="sandbox")return!0;if(n!=="daytona")return!1;let t=e.config.options;return Boolean(t&&typeof t==="object"&&!Array.isArray(t)&&t.mountAwsS3Buckets===!0)}function zn(e){return typeof e.config.provider==="string"?e.config.provider:"sandbox"}function co(e){let n=new Set(e.filter((t)=>t.kind==="sandbox").map((t)=>t.name));for(let t of e){if(t.kind!=="agent")continue;let o=t.config.sandboxes;if(o===void 0)continue;if(!Array.isArray(o))throw Error(`Agent "${t.name}" sandboxes must be an array of sandbox resources or names`);let r=o;for(let[s,i]of r.entries()){let a=typeof i==="string"&&i.trim().length>0,c=g(i)&&i.kind==="sandbox";if(!a&&!c)throw Error(`Agent "${t.name}" sandboxes[${s}] must be a sandbox resource or a non-empty name`);if(c&&!n.has(i.name))throw Error(`Agent "${t.name}" sandboxes references sandbox "${i.name}", but that sandbox is not exported from broods/`)}}}function Dn(e){let n=new Set;for(let t of e){let o=`${t.kind}:${t.name}`;if(n.has(o))throw Error(`Duplicate resource: ${o}`);n.add(o)}}function lo(e){let n={},t=new Set;for(let{exportName:o,resource:r}of e){if(o==="default"||!Ve(o))continue;let s=`${r.kind}:${o}`;if(t.has(s))throw Error(`Duplicate export alias for ${r.kind}: ${o}`);t.add(s),n[r.kind]??={},n[r.kind][r.name]=o}return n}function uo(e,n){let t=new Map;for(let i of n){if(!w(i.value)||i.exportName==="default"||!Ve(i.exportName))continue;let a=t.get(i.value);if(a&&a!==i.exportName)throw Error(`Channel is exported more than once: ${a}, ${i.exportName}`);t.set(i.value,i.exportName)}let o=new Map,r=new Set,s=[];for(let{exportName:i,resource:a}of e){if(a.kind!=="agent")continue;let c=a.config.connections;if(c===void 0)continue;if(!Array.isArray(c))throw Error(`Agent "${a.name}" config.connections must be an array of connection definitions`);let d=new Set;for(let l of c){if(!w(l))throw Error(`Agent "${a.name}" config.connections must contain connection definitions`);let u=o.get(l);if(u&&u!==a.name)throw Error(`Channel ${l.type} is already attached to agent "${u}" and cannot also attach to "${a.name}"`);if(d.has(l.type))throw Error(`Agent "${a.name}" cannot configure more than one ${l.type} channel`);o.set(l,a.name),d.add(l.type);let p=i!=="default"&&Ve(i)?i:a.name,m=t.get(l)??`${p}${Vn(l.type)}Channel`;if(r.has(m))throw Error(`Duplicate channel export alias: ${m}`);r.add(m),s.push({alias:m,type:l.type,id:m,agentName:a.name})}}for(let[i,a]of t)if(!o.has(i))throw Error(`Channel "${a}" must be attached to exactly one agent`);return s.sort((i,a)=>i.alias.localeCompare(a.alias))}function go(e,n){for(let{resource:t}of e){if(t.kind!=="agent")continue;let o=t.config.connections;if(!Array.isArray(o))continue;for(let r of o){if(!w(r))continue;if(Yn(r,n).length>0)continue;throw Error(`Agent "${t.name}" connection "${r.type}" reaches no rooms: declare a ${r.type} channel for it, or set allowedChannelIds: ["*"] to answer everywhere`)}}}function Yn(e,n){let t=e.config.allowedChannelIds??[];if(t.includes(we))return[we];return[...new Set([...n.get(e)??[],...t])]}function fo(e){let n=new Map;for(let t of e){if(t.kind!=="channelRecord")continue;let o=t.config;if(!w(o.connection))continue;let r=Jn(t.name,o.externalId);if(r.length===0)continue;let s=n.get(o.connection)??new Set;for(let i of r)s.add(i);n.set(o.connection,s)}return n}function Vn(e){return e.charAt(0).toUpperCase()+e.slice(1)}function Ve(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)}async function po(e,n,t){let o=e.resource;if(o.kind==="agent"){let r=$o(o,n,t);return[...r.hookResource?[r.hookResource]:[],{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:r.config}]}if(o.kind==="channelRecord"){let r=o.config,s=Jn(o.name,r.externalId);return s.map((i)=>({kind:o.kind,name:s.length===1?o.name:`${o.name}-${i}`,...o.description?{description:o.description}:{},config:Uo(o.name,{...r,externalId:i})}))}return[{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:await mo(e,n)}]}function Jn(e,n){if(n===void 0)return[];if(typeof n==="string")return _n(e,n),[n];if(!Array.isArray(n))throw Error(`Channel "${e}" externalId must be a string or an array`);if(n.length===0)throw Error(`Channel "${e}" externalId must not be an empty array`);let t=new Set;for(let o of n){if(typeof o!=="string"||o.length===0)throw Error(`Channel "${e}" externalId must be an array of non-empty strings`);if(t.has(o))throw Error(`Channel "${e}" externalId lists ${o} twice`);_n(e,o),t.add(o)}return n}function _n(e,n){if(n!==we)return;throw Error(`Channel "${e}" cannot use "${we}" as its id: a record matches one exact room. To answer everywhere, set allowedChannelIds: ["${we}"] on the connection; undeclared rooms already fall back to its agent.`)}async function mo(e,n){let t=e.resource;if(t.kind==="skill")return await jo(t.config,n);if(t.kind==="workspace"){let o={...t.config};if(o.partitioned!==void 0){if(typeof o.partitioned!=="boolean")throw Error(`Workspace "${t.name}" config.partitioned must be a boolean`);let r=o.partitioned;if(delete o.partitioned,r)o.isolation=!0}return G(o)}if(t.kind==="mcp")return await Po(e,t.config,n);if(t.kind==="policy"){let o={...t.config};return o.version=o.version??1,G(o)}if(t.kind==="cron"){let o={...t.config},r=o.agent;if(o.agentId=g(r)?r.name:r,o.name=o.name??t.name,delete o.agent,typeof o.input==="string")o.events=[{role:"user",content:[{type:"text",text:o.input}]}],delete o.input;return G(o)}return G(t.config)}var ho=new Set(["apiKey","base_url","baseURL"]),bo=new Set(["activeTools","debug","inactiveTools","permissionMode","startupTimeoutMs","type","webSearch"]),wo=new Set(["enabled","level","subsystems"]);function yo(e){if(ho.has(e))return"";let n=e.replace(/[^a-z0-9]/gi,"").toLowerCase();if(n==="baseurl")return'"base_url" or "baseURL"';if(n==="apikey")return'"apiKey"';return""}function vo(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.provider must be an object`);for(let[t,o]of Object.entries(n)){if(!Rn(t))throw Error(`Agent "${e}" config.provider.${t} is not a supported provider (expected one of: ${On.join(", ")})`);if(typeof o!=="object"||o===null||Array.isArray(o))throw Error(`Agent "${e}" config.provider.${t} must be an object`);let r=o;for(let s of Object.keys(r)){let i=yo(s);if(i)throw Error(`Agent "${e}" config.provider.${t} has unknown option "${s}". Did you mean ${i}?`)}if(t==="custom"&&r.base_url===void 0&&r.baseURL===void 0)throw Error(`Agent "${e}" config.provider.custom.base_url is required (use "base_url" or "baseURL")`)}}function ko(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.harness must be an object`);let t=n;if("sandbox"in t)throw Error(`Agent "${e}" harness sandbox was removed; list it first in the agent's sandboxes`);for(let o of Object.keys(t))if(!bo.has(o))throw Error(`Agent "${e}" config.harness has unknown option "${o}"`);if(t.type!=="claude-code"&&t.type!=="codex"&&t.type!=="deepagents"&&t.type!=="opencode"&&t.type!=="pi")throw Error(`Agent "${e}" config.harness.type must be claude-code, codex, deepagents, opencode, or pi`);if(t.permissionMode!==void 0&&t.permissionMode!=="allow-reads"&&t.permissionMode!=="allow-edits"&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-reads, allow-edits, or allow-all`);if(t.type==="codex"&&t.permissionMode!==void 0&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-all for codex`);if(t.startupTimeoutMs!==void 0&&(typeof t.startupTimeoutMs!=="number"||!Number.isSafeInteger(t.startupTimeoutMs)||t.startupTimeoutMs<1||t.startupTimeoutMs>600000))throw Error(`Agent "${e}" config.harness.startupTimeoutMs must be an integer from 1 to 600000`);if(t.webSearch!==void 0&&typeof t.webSearch!=="boolean")throw Error(`Agent "${e}" config.harness.webSearch must be a boolean`);if(t.type!=="codex"&&t.webSearch!==void 0)throw Error(`Agent "${e}" config.harness.webSearch is only supported by codex`);if(t.type==="pi"&&t.startupTimeoutMs!==void 0)throw Error(`Agent "${e}" config.harness.startupTimeoutMs is not supported by pi`);if(Je(e,t.activeTools,"activeTools"),Je(e,t.inactiveTools,"inactiveTools"),t.activeTools!==void 0&&t.inactiveTools!==void 0)throw Error(`Agent "${e}" config.harness must use either activeTools or inactiveTools, not both`);So(e,t.debug)}function So(e,n){if(n===void 0)return;if(typeof n!=="object"||n===null||Array.isArray(n))throw Error(`Agent "${e}" config.harness.debug must be an object`);let t=n;for(let o of Object.keys(t))if(!wo.has(o))throw Error(`Agent "${e}" config.harness.debug has unknown option "${o}"`);if(t.enabled!==void 0&&typeof t.enabled!=="boolean")throw Error(`Agent "${e}" config.harness.debug.enabled must be a boolean`);if(t.level!==void 0&&t.level!=="error"&&t.level!=="warn"&&t.level!=="info"&&t.level!=="debug"&&t.level!=="trace")throw Error(`Agent "${e}" config.harness.debug.level must be error, warn, info, debug, or trace`);Je(e,t.subsystems,"debug.subsystems")}function Je(e,n,t){if(n!==void 0&&(!Array.isArray(n)||!n.every((o)=>typeof o==="string"&&o.trim().length>0)))throw Error(`Agent "${e}" config.harness.${t} must be an array of non-empty strings`)}function $o(e,n,t){let o={...e.config};vo(e.name,o.provider),ko(e.name,o.harness);let r=Array.isArray(o.sandboxes)?o.sandboxes.map((i)=>g(i)?i.name:i):void 0;if(r)o.sandboxes=r;r?.forEach((i,a)=>{if(r.indexOf(i)===a)return;throw Error(`Agent "${e.name}" sandboxes[${a}] "${String(i)}" is listed more than once`)});let s=Eo(e.name,o.hooks);if(s)o.hooks=s.agentHooksConfig;else if(o.hooks!==void 0)o.hooks=qn(o.hooks,e.name);if(o.connections!==void 0){if(!Array.isArray(o.connections))throw Error(`Agent "${e.name}" config.connections must be an array of connection definitions`);o.channels=Object.fromEntries(o.connections.map((i)=>{if(!w(i))throw Error(`Agent "${e.name}" config.connections must contain connection definitions`);let a=`${e.name}${Vn(i.type)}Channel`,c=Yn(i,t);return[i.type,{id:a,...i.config,...i.partition?{partition:i.partition}:{},allowedChannelIds:c}]})),delete o.connections}if(Array.isArray(o.workspaces)){let i=o.workspaces.map((a)=>_o(a,e.name));for(let a of i){let c=r?.indexOf(a.sandbox)??-1;if(c>=1)throw Error(`Agent "${e.name}" sandboxes[${c}] "${String(a.sandbox)}" also backs workspace "${String(a.name)}"; only the first sandbox can back a workspace`)}o.workspaces=i}if(o.harness&&!r?.length)throw Error(`Agent "${e.name}" runs a harness, so it needs sandboxes; the first runs the harness`);if(o.policies!==void 0){let i=Co(o.policies,e.name);if(i)o.policies=i;else delete o.policies}return{config:G(o),...s?.hookResource?{hookResource:s.hookResource}:{}}}function Eo(e,n){if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.hooks must be an object`);let t=n,o=Object.keys(ze).flatMap((d)=>{let l=t[d];if(l===void 0)return[];if(typeof l!=="function")throw Error(`Agent "${e}" config.hooks.${d} must be a function`);return[{name:d,event:ze[d],source:Oo(l.toString())}]});if(o.length===0)return;let r=`${e}-hooks`,s=Ro(e,o),i=Buffer.byteLength(s);if(i>xe)throw Error(`Agent "${e}" hook bundle is too large (${i} bytes, max ${xe})`);let a=o.map((d)=>d.event),c=qn(t,e);return c.code=[{hookId:r}],{agentHooksConfig:c,hookResource:{kind:"hook",name:r,description:`Inline hooks for agent ${e}`,config:{events:a,bundle:s,sha256:je(s)}}}}function qn(e,n){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Agent "${n}" config.hooks must be an object`);let t=Object.entries(e);for(let[r]of t){if(r==="webhooks"||r in ze)continue;throw Error(`Agent "${n}" config.hooks.${r} is not supported. Use inline hook callbacks or hooks.webhooks.`)}return Object.fromEntries(t.filter(([r])=>r==="webhooks"))}function Oo(e){let n=e.trim();if(/^(async\s+)?function\b/.test(n)||/^(async\s*)?\(/.test(n)||/^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(n))return n;if(/^(async\s+)?[A-Za-z_$][\w$]*\s*\(/.test(n))return n.replace(/^(async\s+)?/,"$1function ");return n}function Ro(e,n){let t=`export default {
+`,Te=1e7,In=50000000,zn=1e7,Dn=20000000,_n=200,oo=new Set(["node_modules",".git"]),ro=[/^\.env(?:\.|$)/i,/^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,/\.(?:pem|key|p12|pfx)$/i],qe={onStart:"agent.started",onStepFinish:"agent.step.finished",onToolCall:"tool.call.started",onToolResult:"tool.result",onFinish:"agent.finished",onApproval:"agent.approval.required",onError:"agent.failed",onSubagentFinish:"subagent.task.finished",onMessageReceived:"channel.message.received",onMessageSending:"channel.message.sending"};async function re(e={}){let n=e.cwd??process.cwd();m(n);let t=_e(n,S),o=await io(t),r=await ao(o),s=await lo(r,n,e.project),i=r.filter((h)=>g(h.value)).map((h)=>({exportName:h.exportName,file:h.file,resource:h.value})),a=i.map((h)=>h.resource);Ln(a),ko(a);let l=$o(i,r),d=Oo(a);for(let h of a)go(h);for(let h of a)fo(h);for(let h of a)po(h);mo(a),bo(a),Eo(i,d);let c=So(i),p=so(s,e.stage??(e.useRuntimeStage===!1?void 0:b()),e.command??"dev"),u=(await Promise.all(i.map((h)=>Ro(h,t,d)))).flat().sort((h,v)=>`${h.kind}:${h.name}`.localeCompare(`${v.kind}:${v.name}`));return Ln(u),{config:s,resources:a,resourceAliases:c,channels:l,manifest:{version:1,project:s.project,stage:p,resources:u}}}function Vn(e){let n=new Set;for(let t of e.resources)Ze(t.config,n);return[...n].sort()}function Ze(e,n){if(Array.isArray(e)){for(let t of e)Ze(t,n);return}if(e&&typeof e==="object"){let t=e;if(t.__beeblastEnv===!0&&typeof t.name==="string"){n.add(t.name);return}for(let o of Object.values(t))Ze(o,n)}}function so(e,n,t){if(n)return n;let o=e.stages?.[t];if(o)return o;return t==="deploy"?"production":"development"}async function io(e){let n=[];async function t(o){let r=await Wn(o,{withFileTypes:!0});for(let s of r){let i=oe(o,s.name);if(s.isDirectory()){if(s.name===_||s.name==="generated")continue;await t(i)}else if(s.isFile()&&s.name.endsWith(".ts"))n.push(i)}}return await t(e),n.sort((o,r)=>ye(e,o).localeCompare(ye(e,r)))}async function ao(e){co();let n=[];for(let t of e){let r=await import(`${Bn(t).href}?t=${Date.now()}`);n.push(...Object.entries(r).map(([s,i])=>({exportName:s,file:t,value:i})))}return n}var Tn=!1;function co(){if(Tn)return;if(Tn=!0,typeof Pn.registerHooks!=="function")return;Pn.registerHooks({load:(e,n,t)=>{let[o]=e.split("?");if(o===void 0||!o.startsWith("file:")||!o.endsWith(".ts"))return t(e,n);let r=Jt(o);return{format:"module",shortCircuit:!0,source:Hn(Zt(r,"utf8"),{loader:"ts",format:"esm",sourcefile:r,sourcemap:"inline"}).code}}})}async function lo(e,n,t){let r=e.find((i)=>ie(i.value))?.value?.config??{},s=t??process.env.BROODS_PROJECT??r.project??Qo(Qt(_e(n)));if(!s.trim())throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT.");return{...r,project:s}}var Un=new Set(["agent","harness","model","provider","session","hooks","connections","tools","mcp","denyTools","sandboxes","workspaces","subagent","skills","scheduler","policies","publicAccess","allowRunOverrides"]),uo={workspace:"workspaces",skill:"skills",policy:"policies",tool:"tools",mcpServers:"mcp",channel:"connections",channels:"connections",hook:"hooks",subagents:"subagent",systemPrompt:"agent",system:"agent"};function go(e){if(e.kind!=="agent")return;let n=e.config;for(let t of Object.keys(n)){if(Un.has(t))continue;if(t==="sandbox")throw Error(`Agent "${e.name}" config.sandbox was removed; use sandboxes, the first is the default`);let o=uo[t],r=o?` Did you mean "${o}"?`:` Allowed keys: ${[...Un].sort().join(", ")}.`;throw Error(`Agent "${e.name}" has an unknown config key "${t}".${r}`)}}function fo(e){if(e.kind!=="workspace")return;let t=e.config.storage;if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Workspace "${e.name}" config.storage must be an object`);let o=t.provider;if(o===void 0||o==="s3")return;if(o==="vercel")throw Error(`Workspace "${e.name}" uses storage.provider "vercel", but Vercel Drive workspace storage is not supported yet. Use storage.provider "s3" or omit storage until Vercel Drive is wired.`);throw Error(`Workspace "${e.name}" config.storage.provider must be one of: s3`)}function po(e){if(e.kind!=="workspace")return;let n=e.config;if(typeof n.partitioned==="string")throw Error(`Workspace "${e.name}" config.partitioned must be a boolean; string modes are not supported.`);if(n.isolation!==void 0)throw Error(`Workspace "${e.name}" config.isolation is no longer supported; use partitioned: true.`)}function mo(e){let n=new Map(e.filter((t)=>t.kind==="workspace").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=o.connections;if(r!==void 0&&!Array.isArray(r))throw Error(`Agent "${t.name}" config.connections must be an array of connection definitions`);let s=Array.isArray(r)?r.filter(w):[],i=new Set;for(let c of s){let p=c.config,u=typeof p.id==="string"?p.id:void 0;if(u){if(i.has(u))throw Error(`Duplicate channel id: ${u}`);i.add(u)}if(c.partition)Yn(c.partition,`Agent "${t.name}" connection "${c.type}"`);if(c.config&&typeof c.config==="object"&&(("workspaceIsolationScope"in c.config)||("workspaceScope"in c.config)))throw Error(`Agent "${t.name}" connection "${c.type}" uses workspaceScope, which is no longer supported; use partition.`)}let l=(Array.isArray(o.workspaces)?o.workspaces.map((c)=>ho(c,n)).filter((c)=>Boolean(c)):[]).filter((c)=>c.config.partitioned===!0),d=s.filter((c)=>c.partition);if(d.length>0&&l.length===0){let c=d[0];throw Error(`Agent "${t.name}" connection "${c.type}" defines partition, but no attached workspace has partitioned: true.`)}if(l.length>0){for(let c of s)if(!c.partition)throw Error(`Agent "${t.name}" attaches partitioned workspace "${l[0].name}", but connection "${c.type}" does not define partition.`)}}}function Yn(e,n){if(!e)return;if(e.by==="shared"){if("alias"in e&&e.alias!==void 0)throw Error(`${n} partition.alias is only supported when partition.by is conversation`);return}if(e.by!=="conversation")throw Error(`${n} partition.by must be one of: shared, conversation`);if(typeof e.alias!=="string"||e.alias.length===0)throw Error(`${n} partition.alias is required when partition.by is conversation`);if(!/^[A-Za-z0-9._-]+$/.test(e.alias))throw Error(`${n} partition.alias must use only letters, numbers, dots, underscores, or hyphens`);if(e.alias==="."||e.alias==="..")throw Error(`${n} partition.alias must not be "." or ".."`)}function ho(e,n){if(g(e)&&e.kind==="workspace")return e;if(typeof e==="string")return n.get(e);if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace;if(g(t)&&t.kind==="workspace")return t;if(typeof t==="string")return n.get(t)}return}function bo(e){let n=new Map(e.filter((t)=>t.kind==="sandbox").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=Jn(Array.isArray(o.sandboxes)?o.sandboxes[0]:void 0,n),s=o.workspaces;if(!Array.isArray(s))continue;for(let i of s){let a=yo(i),l=wo(i,r,n);if(!l||vo(l))continue;throw Error(`Agent "${t.name}" workspace "${a}" uses sandbox "${l.name}" (${qn(l)}) which does not support S3 workspace mounts. Use lambda/sandbox, or daytona with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`)}}}function Jn(e,n){if(g(e)&&e.kind==="sandbox")return e;if(typeof e==="string")return n.get(e);return}function wo(e,n,t){if(e&&typeof e==="object"&&"sandbox"in e){let o=e.sandbox;if(o===null)return;return Jn(o,t)}return n}function yo(e){if(g(e)&&e.kind==="workspace")return e.name;if(e&&typeof e==="object"&&"workspace"in e){let n=e.workspace;if(g(n))return n.name;if(typeof n==="string")return n}return"<unknown>"}function vo(e){let n=qn(e);if(n==="lambda"||n==="sandbox")return!0;if(n!=="daytona")return!1;let t=e.config.options;return Boolean(t&&typeof t==="object"&&!Array.isArray(t)&&t.mountAwsS3Buckets===!0)}function qn(e){return typeof e.config.provider==="string"?e.config.provider:"sandbox"}function ko(e){let n=new Set(e.filter((t)=>t.kind==="sandbox").map((t)=>t.name));for(let t of e){if(t.kind!=="agent")continue;let o=t.config.sandboxes;if(o===void 0)continue;if(!Array.isArray(o))throw Error(`Agent "${t.name}" sandboxes must be an array of sandbox resources or names`);let r=o;for(let[s,i]of r.entries()){let a=typeof i==="string"&&i.trim().length>0,l=g(i)&&i.kind==="sandbox";if(!a&&!l)throw Error(`Agent "${t.name}" sandboxes[${s}] must be a sandbox resource or a non-empty name`);if(l&&!n.has(i.name))throw Error(`Agent "${t.name}" sandboxes references sandbox "${i.name}", but that sandbox is not exported from broods/`)}}}function Ln(e){let n=new Set;for(let t of e){let o=`${t.kind}:${t.name}`;if(n.has(o))throw Error(`Duplicate resource: ${o}`);n.add(o)}}function So(e){let n={},t=new Set;for(let{exportName:o,resource:r}of e){if(o==="default"||!Xe(o))continue;let s=`${r.kind}:${o}`;if(t.has(s))throw Error(`Duplicate export alias for ${r.kind}: ${o}`);t.add(s),n[r.kind]??={},n[r.kind][r.name]=o}return n}function $o(e,n){let t=new Map;for(let i of n){if(!w(i.value)||i.exportName==="default"||!Xe(i.exportName))continue;let a=t.get(i.value);if(a&&a!==i.exportName)throw Error(`Channel is exported more than once: ${a}, ${i.exportName}`);t.set(i.value,i.exportName)}let o=new Map,r=new Set,s=[];for(let{exportName:i,resource:a}of e){if(a.kind!=="agent")continue;let l=a.config.connections;if(l===void 0)continue;if(!Array.isArray(l))throw Error(`Agent "${a.name}" config.connections must be an array of connection definitions`);let d=new Set;for(let c of l){if(!w(c))throw Error(`Agent "${a.name}" config.connections must contain connection definitions`);let p=o.get(c);if(p&&p!==a.name)throw Error(`Channel ${c.type} is already attached to agent "${p}" and cannot also attach to "${a.name}"`);if(d.has(c.type))throw Error(`Agent "${a.name}" cannot configure more than one ${c.type} channel`);o.set(c,a.name),d.add(c.type);let u=i!=="default"&&Xe(i)?i:a.name,h=t.get(c)??`${u}${Xn(c.type)}Channel`;if(r.has(h))throw Error(`Duplicate channel export alias: ${h}`);r.add(h),s.push({alias:h,type:c.type,id:h,agentName:a.name})}}for(let[i,a]of t)if(!o.has(i))throw Error(`Channel "${a}" must be attached to exactly one agent`);return s.sort((i,a)=>i.alias.localeCompare(a.alias))}function Eo(e,n){for(let{resource:t}of e){if(t.kind!=="agent")continue;let o=t.config.connections;if(!Array.isArray(o))continue;for(let r of o){if(!w(r))continue;if(Zn(r,n).length>0)continue;throw Error(`Agent "${t.name}" connection "${r.type}" reaches no rooms: declare a ${r.type} channel for it, or set allowedChannelIds: ["*"] to answer everywhere`)}}}function Zn(e,n){let t=e.config.allowedChannelIds??[];if(t.includes($e))return[$e];return[...new Set([...n.get(e)??[],...t])]}function Oo(e){let n=new Map;for(let t of e){if(t.kind!=="channelRecord")continue;let o=t.config;if(!w(o.connection))continue;let r=Qn(t.name,o.externalId);if(r.length===0)continue;let s=n.get(o.connection)??new Set;for(let i of r)s.add(i);n.set(o.connection,s)}return n}function Xn(e){return e.charAt(0).toUpperCase()+e.slice(1)}function Xe(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)}async function Ro(e,n,t){let o=e.resource;if(o.kind==="agent"){let r=To(o,n,t);return[...r.hookResource?[r.hookResource]:[],{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:r.config}]}if(o.kind==="channelRecord"){let r=o.config,s=Qn(o.name,r.externalId);return s.map((i)=>({kind:o.kind,name:s.length===1?o.name:`${o.name}-${i}`,...o.description?{description:o.description}:{},config:Yo(o.name,{...r,externalId:i})}))}return[{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:await Co(e,n)}]}function Qn(e,n){if(n===void 0)return[];if(typeof n==="string")return Nn(e,n),[n];if(!Array.isArray(n))throw Error(`Channel "${e}" externalId must be a string or an array`);if(n.length===0)throw Error(`Channel "${e}" externalId must not be an empty array`);let t=new Set;for(let o of n){if(typeof o!=="string"||o.length===0)throw Error(`Channel "${e}" externalId must be an array of non-empty strings`);if(t.has(o))throw Error(`Channel "${e}" externalId lists ${o} twice`);Nn(e,o),t.add(o)}return n}function Nn(e,n){if(n!==$e)return;throw Error(`Channel "${e}" cannot use "${$e}" as its id: a record matches one exact room. To answer everywhere, set allowedChannelIds: ["${$e}"] on the connection; undeclared rooms already fall back to its agent.`)}async function Co(e,n){let t=e.resource;if(t.kind==="skill")return await Wo(t.config,n);if(t.kind==="workspace"){let o={...t.config};if(o.partitioned!==void 0){if(typeof o.partitioned!=="boolean")throw Error(`Workspace "${t.name}" config.partitioned must be a boolean`);let r=o.partitioned;if(delete o.partitioned,r)o.isolation=!0}return V(o)}if(t.kind==="mcp")return await Fo(e,t.config,n);if(t.kind==="policy"){let o={...t.config};return o.version=o.version??1,V(o)}if(t.kind==="cron"){let o={...t.config},r=o.agent;if(o.agentId=g(r)?r.name:r,o.name=o.name??t.name,delete o.agent,typeof o.input==="string")o.events=[{role:"user",content:[{type:"text",text:o.input}]}],delete o.input;return V(o)}return V(t.config)}var Ao=new Set(["apiKey","base_url","baseURL"]),xo=new Set(["activeTools","debug","inactiveTools","permissionMode","startupTimeoutMs","type","webSearch"]),jo=new Set(["enabled","level","subsystems"]);function Po(e){if(Ao.has(e))return"";let n=e.replace(/[^a-z0-9]/gi,"").toLowerCase();if(n==="baseurl")return'"base_url" or "baseURL"';if(n==="apikey")return'"apiKey"';return""}function Io(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.provider must be an object`);for(let[t,o]of Object.entries(n)){if(!jn(t))throw Error(`Agent "${e}" config.provider.${t} is not a supported provider (expected one of: ${xn.join(", ")})`);if(typeof o!=="object"||o===null||Array.isArray(o))throw Error(`Agent "${e}" config.provider.${t} must be an object`);let r=o;for(let s of Object.keys(r)){let i=Po(s);if(i)throw Error(`Agent "${e}" config.provider.${t} has unknown option "${s}". Did you mean ${i}?`)}if(t==="custom"&&r.base_url===void 0&&r.baseURL===void 0)throw Error(`Agent "${e}" config.provider.custom.base_url is required (use "base_url" or "baseURL")`)}}function Do(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.harness must be an object`);let t=n;if("sandbox"in t)throw Error(`Agent "${e}" harness sandbox was removed; list it first in the agent's sandboxes`);for(let o of Object.keys(t))if(!xo.has(o))throw Error(`Agent "${e}" config.harness has unknown option "${o}"`);if(t.type!=="claude-code"&&t.type!=="codex"&&t.type!=="deepagents"&&t.type!=="opencode"&&t.type!=="pi")throw Error(`Agent "${e}" config.harness.type must be claude-code, codex, deepagents, opencode, or pi`);if(t.permissionMode!==void 0&&t.permissionMode!=="allow-reads"&&t.permissionMode!=="allow-edits"&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-reads, allow-edits, or allow-all`);if(t.type==="codex"&&t.permissionMode!==void 0&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-all for codex`);if(t.startupTimeoutMs!==void 0&&(typeof t.startupTimeoutMs!=="number"||!Number.isSafeInteger(t.startupTimeoutMs)||t.startupTimeoutMs<1||t.startupTimeoutMs>600000))throw Error(`Agent "${e}" config.harness.startupTimeoutMs must be an integer from 1 to 600000`);if(t.webSearch!==void 0&&typeof t.webSearch!=="boolean")throw Error(`Agent "${e}" config.harness.webSearch must be a boolean`);if(t.type!=="codex"&&t.webSearch!==void 0)throw Error(`Agent "${e}" config.harness.webSearch is only supported by codex`);if(t.type==="pi"&&t.startupTimeoutMs!==void 0)throw Error(`Agent "${e}" config.harness.startupTimeoutMs is not supported by pi`);if(Qe(e,t.activeTools,"activeTools"),Qe(e,t.inactiveTools,"inactiveTools"),t.activeTools!==void 0&&t.inactiveTools!==void 0)throw Error(`Agent "${e}" config.harness must use either activeTools or inactiveTools, not both`);_o(e,t.debug)}function _o(e,n){if(n===void 0)return;if(typeof n!=="object"||n===null||Array.isArray(n))throw Error(`Agent "${e}" config.harness.debug must be an object`);let t=n;for(let o of Object.keys(t))if(!jo.has(o))throw Error(`Agent "${e}" config.harness.debug has unknown option "${o}"`);if(t.enabled!==void 0&&typeof t.enabled!=="boolean")throw Error(`Agent "${e}" config.harness.debug.enabled must be a boolean`);if(t.level!==void 0&&t.level!=="error"&&t.level!=="warn"&&t.level!=="info"&&t.level!=="debug"&&t.level!=="trace")throw Error(`Agent "${e}" config.harness.debug.level must be error, warn, info, debug, or trace`);Qe(e,t.subsystems,"debug.subsystems")}function Qe(e,n,t){if(n!==void 0&&(!Array.isArray(n)||!n.every((o)=>typeof o==="string"&&o.trim().length>0)))throw Error(`Agent "${e}" config.harness.${t} must be an array of non-empty strings`)}function To(e,n,t){let o={...e.config};Io(e.name,o.provider),Do(e.name,o.harness);let r=Array.isArray(o.sandboxes)?o.sandboxes.map((i)=>g(i)?i.name:i):void 0;if(r)o.sandboxes=r;r?.forEach((i,a)=>{if(r.indexOf(i)===a)return;throw Error(`Agent "${e.name}" sandboxes[${a}] "${String(i)}" is listed more than once`)});let s=Uo(e.name,o.hooks);if(s)o.hooks=s.agentHooksConfig;else if(o.hooks!==void 0)o.hooks=et(o.hooks,e.name);if(o.connections!==void 0){if(!Array.isArray(o.connections))throw Error(`Agent "${e.name}" config.connections must be an array of connection definitions`);o.channels=Object.fromEntries(o.connections.map((i)=>{if(!w(i))throw Error(`Agent "${e.name}" config.connections must contain connection definitions`);let a=`${e.name}${Xn(i.type)}Channel`,l=Zn(i,t);return[i.type,{id:a,...i.config,...i.partition?{partition:i.partition}:{},allowedChannelIds:l}]})),delete o.connections}if(Array.isArray(o.workspaces)){let i=o.workspaces.map((a)=>zo(a,e.name));for(let a of i){let l=r?.indexOf(a.sandbox)??-1;if(l>=1)throw Error(`Agent "${e.name}" sandboxes[${l}] "${String(a.sandbox)}" also backs workspace "${String(a.name)}"; only the first sandbox can back a workspace`)}o.workspaces=i}if(o.harness&&!r?.length)throw Error(`Agent "${e.name}" runs a harness, so it needs sandboxes; the first runs the harness`);if(o.policies!==void 0){let i=Mo(o.policies,e.name);if(i)o.policies=i;else delete o.policies}return{config:V(o),...s?.hookResource?{hookResource:s.hookResource}:{}}}function Uo(e,n){if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.hooks must be an object`);let t=n,o=Object.keys(qe).flatMap((d)=>{let c=t[d];if(c===void 0)return[];if(typeof c!=="function")throw Error(`Agent "${e}" config.hooks.${d} must be a function`);return[{name:d,event:qe[d],source:Lo(c.toString())}]});if(o.length===0)return;let r=`${e}-hooks`,s=No(e,o),i=Buffer.byteLength(s);if(i>Te)throw Error(`Agent "${e}" hook bundle is too large (${i} bytes, max ${Te})`);let a=o.map((d)=>d.event),l=et(t,e);return l.code=[{hookId:r}],{agentHooksConfig:l,hookResource:{kind:"hook",name:r,description:`Inline hooks for agent ${e}`,config:{events:a,bundle:s,sha256:Ue(s)}}}}function et(e,n){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Agent "${n}" config.hooks must be an object`);let t=Object.entries(e);for(let[r]of t){if(r==="webhooks"||r in qe)continue;throw Error(`Agent "${n}" config.hooks.${r} is not supported. Use inline hook callbacks or hooks.webhooks.`)}return Object.fromEntries(t.filter(([r])=>r==="webhooks"))}function Lo(e){let n=e.trim();if(/^(async\s+)?function\b/.test(n)||/^(async\s*)?\(/.test(n)||/^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(n))return n;if(/^(async\s+)?[A-Za-z_$][\w$]*\s*\(/.test(n))return n.replace(/^(async\s+)?/,"$1function ");return n}function No(e,n){let t=`export default {
 ${n.map((o)=>`  ${JSON.stringify(o.event)}: ${o.source},`).join(`
 `)}
 };
-`;try{return Kn(t,{loader:"ts"}).code}catch(o){let r=o instanceof Error?o.message:String(o);throw Error(`Agent "${e}" inline hooks failed to transpile: ${r}`)}}function Co(e,n){if(!Array.isArray(e))throw Error(`Agent "${n}" config.policies must be an array`);let t=e.map((o)=>{if(g(o)&&o.kind==="policy")return o.name;if(typeof o==="string")return o;throw Error(`Agent "${n}" config.policies must contain definePolicy(...) resources or strings`)});return t.length>0?t:void 0}async function Ao(e,n){let t=await Ln(ee(Mn(),"broods-mcp-"));try{let o=ee(t,"server.mjs");await He(o,n,"utf8");let r;try{r=await import(Un(o).href)}catch(a){throw Error(`MCP server bundle ${e} failed to import: ${a instanceof Error?a.message:String(a)}`)}let s=r.default;if(!(typeof s==="function"||typeof s==="object"&&s!==null&&typeof s.fetch==="function"))throw Error(`MCP server bundle ${e} default export must be a fetch handler (createMcpHandler)`)}finally{await Bn(t,{recursive:!0,force:!0})}}async function xo(e){let n=await Wt({entryPoints:[e.entryPoint],bundle:!0,platform:"node",format:"esm",minify:!1,write:!1,logLevel:"silent",plugins:e.plugins??[]}).catch((t)=>{let o=Bo(t)?t.errors.map((r)=>r.text).filter(Boolean).join("; "):t instanceof Error?t.message:String(t);throw Error(`${e.label} ${e.manifestPath} failed to build${o?`: ${o}`:""}`)});if(n.outputFiles.length!==1)throw Error(`${e.label} ${e.manifestPath} failed to build: expected one output file`);return n.outputFiles[0].text}async function jo(e,n){let t=To(n,e.path,"Skill"),o=ge(n,t).split("\\").join("/"),r=await Lo(t);if(!r.some((s)=>s.path==="SKILL.md"))throw Error(`Skill folder ${e.path} must contain SKILL.md`);return{source:"files",path:o,files:r}}async function Po(e,n,t){let{handler:o,...r}=n,s=[o,n.url,n.sandbox].filter((l)=>l!==void 0).length;if(s>1)throw Error(`MCP server "${e.resource.name}" declares more than one of url, handler and sandbox; pick one`);if(o===void 0){if(s===0)throw Error(`MCP server "${e.resource.name}" needs url (external), handler (hosted) or sandbox (on a machine)`);return G(r)}let i=ge(t,e.file).split("\\").join("/");No(i,"MCP server");let a=await Ln(ee(Mn(),"broods-mcp-shim-")),c;try{let l=ee(a,"mcp-handler.mjs");await He(l,Io(e),"utf8"),await He(ee(a,"broods-stub.mjs"),Ft,"utf8"),c=await xo({entryPoint:l,label:"MCP server bundle",manifestPath:i,plugins:[Do(a)]})}finally{await Bn(a,{recursive:!0,force:!0})}let d=Buffer.byteLength(c);if(d>An)throw Error(`MCP server bundle ${i} is too large (${d} bytes, max ${An})`);return await Ao(i,c),{...G(r),bundle:c}}function Io(e){return`import * as __exports from ${JSON.stringify(e.file)};
+`;try{return Hn(t,{loader:"ts"}).code}catch(o){let r=o instanceof Error?o.message:String(o);throw Error(`Agent "${e}" inline hooks failed to transpile: ${r}`)}}function Mo(e,n){if(!Array.isArray(e))throw Error(`Agent "${n}" config.policies must be an array`);let t=e.map((o)=>{if(g(o)&&o.kind==="policy")return o.name;if(typeof o==="string")return o;throw Error(`Agent "${n}" config.policies must contain definePolicy(...) resources or strings`)});return t.length>0?t:void 0}async function Bo(e,n){let t=await Gn(oe(Kn(),"broods-mcp-"));try{let o=oe(t,"server.mjs");await Je(o,n,"utf8");let r;try{r=await import(Bn(o).href)}catch(a){throw Error(`MCP server bundle ${e} failed to import: ${a instanceof Error?a.message:String(a)}`)}let s=r.default;if(!(typeof s==="function"||typeof s==="object"&&s!==null&&typeof s.fetch==="function"))throw Error(`MCP server bundle ${e} default export must be a fetch handler (createMcpHandler)`)}finally{await Fn(t,{recursive:!0,force:!0})}}async function Go(e){let n=await no({entryPoints:[e.entryPoint],bundle:!0,platform:"node",format:"esm",minify:!1,write:!1,logLevel:"silent",plugins:e.plugins??[]}).catch((t)=>{let o=Zo(t)?t.errors.map((r)=>r.text).filter(Boolean).join("; "):t instanceof Error?t.message:String(t);throw Error(`${e.label} ${e.manifestPath} failed to build${o?`: ${o}`:""}`)});if(n.outputFiles.length!==1)throw Error(`${e.label} ${e.manifestPath} failed to build: expected one output file`);return n.outputFiles[0].text}async function Wo(e,n){let t=Vo(n,e.path,"Skill"),o=ye(n,t).split("\\").join("/"),r=await Jo(t);if(!r.some((s)=>s.path==="SKILL.md"))throw Error(`Skill folder ${e.path} must contain SKILL.md`);return{source:"files",path:o,files:r}}async function Fo(e,n,t){let{handler:o,...r}=n,s=[o,n.url,n.sandbox].filter((c)=>c!==void 0).length;if(s>1)throw Error(`MCP server "${e.resource.name}" declares more than one of url, handler and sandbox; pick one`);if(o===void 0){if(s===0)throw Error(`MCP server "${e.resource.name}" needs url (external), handler (hosted) or sandbox (on a machine)`);return V(r)}let i=ye(t,e.file).split("\\").join("/");qo(i,"MCP server");let a=await Gn(oe(Kn(),"broods-mcp-shim-")),l;try{let c=oe(a,"mcp-handler.mjs");await Je(c,Ko(e),"utf8"),await Je(oe(a,"broods-stub.mjs"),to,"utf8"),l=await Go({entryPoint:c,label:"MCP server bundle",manifestPath:i,plugins:[Ho(a)]})}finally{await Fn(a,{recursive:!0,force:!0})}let d=Buffer.byteLength(l);if(d>In)throw Error(`MCP server bundle ${i} is too large (${d} bytes, max ${In})`);return await Bo(i,l),{...V(r),bundle:l}}function Ko(e){return`import * as __exports from ${JSON.stringify(e.file)};
 const __mcp = __exports[${JSON.stringify(e.exportName)}];
 export default __mcp?.config?.handler ?? __mcp?.handler;
-`}function Do(e){let n=ee(e,"broods-stub.mjs");return{name:"broods-sdk-stub",setup:function(t){t.onResolve({filter:/^broods(\/.*)?$/},()=>({path:n}))}}}function _o(e,n){if(g(e))return{name:e.name,workspaceId:e.name};if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace,o=g(t)?t.name:t;if(typeof o!=="string")throw Error(`Agent ${n} workspace ref must be a defineWorkspace(...) resource or its name`);let r={name:o,workspaceId:o};if("sandbox"in e){let s=e.sandbox;r.sandbox=s===null?null:g(s)?s.name:s}return r}throw Error(`Agent ${n} workspaces must be defineWorkspace(...) resources or { workspace, sandbox } refs`)}function To(e,n,t){if(n.trim().length===0)throw Error(`${t} path is required`);if(n.includes("\x00"))throw Error(`${t} path must not contain null bytes`);let o=Ae(e),r=Ae(o,n),s=ge(o,r);if(s===""||!s.startsWith("..")&&!Gt(s))return r;throw Error(`${t} path ${n} must stay inside ${S}/`)}function Uo(e,n){let t={...n},o=t.connection;if(!w(o))throw Error(`Channel "${e}" config.connection must be a connection definition`);return delete t.connection,t.platform=o.type,Fn(t.partition,`Channel "${e}"`),G(t)}function G(e){if(Array.isArray(e))return e.map((n)=>G(n));if(g(e))return e.name;if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).map(([n,t])=>[n,G(t)]));return e}async function Lo(e){let n=[],t=0;async function o(r){let s=await Nn(r,{withFileTypes:!0});for(let i of s){let a=ee(r,i.name),c=ge(e,a).split("\\").join("/");if(i.isDirectory()){if(Tn(i.name))continue;await o(a)}else if(i.isFile()){if(Tn(i.name)||Zn(c))continue;let d=await Mt(a);if(d.byteLength>xe)throw Error(`Skill bundle file ${c} is too large (${d.byteLength} bytes, max ${xe})`);if(t+=d.byteLength,t>xn)throw Error(`Skill bundle at ${e} is too large (${t} bytes, max ${xn})`);if(n.length>=jn)throw Error(`Skill bundle at ${e} has too many files (max ${jn})`);n.push({path:c,size:d.byteLength,sha256:je(d),contentBase64:d.toString("base64"),contentType:Mo(c)})}}}return await o(e),n.sort((r,s)=>String(r.path).localeCompare(String(s.path)))}function Tn(e){return e.startsWith(".")||Ht.has(e)}function No(e,n){if(Zn(e))throw Error(`${n} bundle path ${e} looks like a hidden file or secret and will not be bundled`)}function Bo(e){return e instanceof Error&&Array.isArray(e.errors)}function Zn(e){return e.split("/").some((t)=>t.startsWith(".")||zt.some((o)=>o.test(t)))}function je(e){return Nt("sha256").update(e).digest("hex")}function Mo(e){if(e.endsWith(".md"))return"text/markdown; charset=utf-8";if(e.endsWith(".json"))return"application/json";if(e.endsWith(".js")||e.endsWith(".mjs"))return"application/javascript";if(e.endsWith(".ts"))return"text/typescript; charset=utf-8";if(e.endsWith(".txt"))return"text/plain; charset=utf-8";return"application/octet-stream"}function Ko(e){return e.replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")}import{mkdir as Go,writeFile as Pe}from"node:fs/promises";import{resolve as ye}from"node:path";async function Ie(e,n,t=process.cwd(),o={},r=null,s=[]){let i=ye(t,S,b),a=Wo(n,e);await Go(i,{recursive:!0}),await Pe(ye(i,"ids.ts"),zo(a),"utf8"),await Pe(ye(i,"api.ts"),Fo(e,a,o,r,s),"utf8"),await Pe(ye(i,"resources.ts"),Yo(e),"utf8"),await Pe(ye(i,"dataModel.ts"),Ho(),"utf8")}function Wo(e,n){let t={agents:oe(n,"agent"),workspaces:oe(n,"workspace"),sandboxes:oe(n,"sandbox"),crons:oe(n,"cron"),skills:oe(n,"skill"),mcp:oe(n,"mcp"),policies:oe(n,"policy"),channelRecords:oe(n,"channelRecord")};return{agents:re(e.agents,t.agents),workspaces:re(e.workspaces,t.workspaces),sandboxes:re(e.sandboxes,t.sandboxes),crons:re(e.crons,t.crons),skills:re(e.skills,t.skills),hooks:{},mcp:re(e.mcp,t.mcp),policies:re(e.policies,t.policies),channelRecords:re(e.channelRecords,t.channelRecords)}}function oe(e,n){return new Set(e.resources.filter((t)=>t.kind===n).map((t)=>t.name))}function re(e,n){return Object.fromEntries(Object.entries(e??{}).filter(([t])=>n.has(t)))}function Fo(e,n,t,o,r){let s=Object.keys(n.agents),i=o?`, endpointId: ${JSON.stringify(o.endpointId)}, projectSlug: ${JSON.stringify(o.projectSlug)}, stageSlug: ${JSON.stringify(o.stageSlug)}`:"",a=s.map((d)=>`    ${qe(t.agent?.[d]??d)}: { kind: "agent", name: ${JSON.stringify(d)}, id: ids.agents[${JSON.stringify(d)}], project: ${JSON.stringify(e.project)}, stage: ${JSON.stringify(e.stage)}${i} },`).join(`
-`),c=o?r.map((d)=>{let l=encodeURIComponent(o.accountId),u=o.stageKind===void 0||o.stageKind==="production"?`/v1/webhooks/${l}/${encodeURIComponent(d.type)}`:`/v1/webhooks/${l}/dev/${encodeURIComponent(o.endpointId)}/${encodeURIComponent(d.type)}`;return`    ${qe(d.alias)}: { kind: "channel", type: ${JSON.stringify(d.type)}, agentName: ${JSON.stringify(d.agentName)}, agentId: ids.agents[${JSON.stringify(d.agentName)}], accountId: ${JSON.stringify(o.accountId)}, webhookPath: ${JSON.stringify(u)} },`}).join(`
+`}function Ho(e){let n=oe(e,"broods-stub.mjs");return{name:"broods-sdk-stub",setup:function(t){t.onResolve({filter:/^broods(\/.*)?$/},()=>({path:n}))}}}function zo(e,n){if(g(e))return{name:e.name,workspaceId:e.name};if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace,o=g(t)?t.name:t;if(typeof o!=="string")throw Error(`Agent ${n} workspace ref must be a defineWorkspace(...) resource or its name`);let r={name:o,workspaceId:o};if("sandbox"in e){let s=e.sandbox;r.sandbox=s===null?null:g(s)?s.name:s}return r}throw Error(`Agent ${n} workspaces must be defineWorkspace(...) resources or { workspace, sandbox } refs`)}function Vo(e,n,t){if(n.trim().length===0)throw Error(`${t} path is required`);if(n.includes("\x00"))throw Error(`${t} path must not contain null bytes`);let o=_e(e),r=_e(o,n),s=ye(o,r);if(s===""||!s.startsWith("..")&&!eo(s))return r;throw Error(`${t} path ${n} must stay inside ${S}/`)}function Yo(e,n){let t={...n},o=t.connection;if(!w(o))throw Error(`Channel "${e}" config.connection must be a connection definition`);return delete t.connection,t.platform=o.type,Yn(t.partition,`Channel "${e}"`),V(t)}function V(e){if(Array.isArray(e))return e.map((n)=>V(n));if(g(e))return e.name;if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).map(([n,t])=>[n,V(t)]));return e}async function Jo(e){let n=[],t=0;async function o(r){let s=await Wn(r,{withFileTypes:!0});for(let i of s){let a=oe(r,i.name),l=ye(e,a).split("\\").join("/");if(i.isDirectory()){if(Mn(i.name))continue;await o(a)}else if(i.isFile()){if(Mn(i.name)||nt(l))continue;let d=await Xt(a);if(d.byteLength>Te)throw Error(`Skill bundle file ${l} is too large (${d.byteLength} bytes, max ${Te})`);if(t+=d.byteLength,t>Dn)throw Error(`Skill bundle at ${e} is too large (${t} bytes, max ${Dn})`);if(n.length>=_n)throw Error(`Skill bundle at ${e} has too many files (max ${_n})`);n.push({path:l,size:d.byteLength,sha256:Ue(d),contentBase64:d.toString("base64"),contentType:Xo(l)})}}}return await o(e),n.sort((r,s)=>String(r.path).localeCompare(String(s.path)))}function Mn(e){return e.startsWith(".")||oo.has(e)}function qo(e,n){if(nt(e))throw Error(`${n} bundle path ${e} looks like a hidden file or secret and will not be bundled`)}function Zo(e){return e instanceof Error&&Array.isArray(e.errors)}function nt(e){return e.split("/").some((t)=>t.startsWith(".")||ro.some((o)=>o.test(t)))}function Ue(e){return qt("sha256").update(e).digest("hex")}function Xo(e){if(e.endsWith(".md"))return"text/markdown; charset=utf-8";if(e.endsWith(".json"))return"application/json";if(e.endsWith(".js")||e.endsWith(".mjs"))return"application/javascript";if(e.endsWith(".ts"))return"text/typescript; charset=utf-8";if(e.endsWith(".txt"))return"text/plain; charset=utf-8";return"application/octet-stream"}function Qo(e){return e.replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")}import{mkdir as er,writeFile as Le}from"node:fs/promises";import{resolve as Ee}from"node:path";async function Ne(e,n,t=process.cwd(),o={},r=null,s=[]){let i=Ee(t,S,_),a=nr(n,e);await er(i,{recursive:!0}),await Le(Ee(i,"ids.ts"),rr(a),"utf8"),await Le(Ee(i,"api.ts"),tr(e,a,o,r,s),"utf8"),await Le(Ee(i,"resources.ts"),sr(e),"utf8"),await Le(Ee(i,"dataModel.ts"),or(),"utf8")}function nr(e,n){let t={agents:ae(n,"agent"),workspaces:ae(n,"workspace"),sandboxes:ae(n,"sandbox"),crons:ae(n,"cron"),skills:ae(n,"skill"),mcp:ae(n,"mcp"),policies:ae(n,"policy"),channelRecords:ae(n,"channelRecord")};return{agents:ce(e.agents,t.agents),workspaces:ce(e.workspaces,t.workspaces),sandboxes:ce(e.sandboxes,t.sandboxes),crons:ce(e.crons,t.crons),skills:ce(e.skills,t.skills),hooks:{},mcp:ce(e.mcp,t.mcp),policies:ce(e.policies,t.policies),channelRecords:ce(e.channelRecords,t.channelRecords)}}function ae(e,n){return new Set(e.resources.filter((t)=>t.kind===n).map((t)=>t.name))}function ce(e,n){return Object.fromEntries(Object.entries(e??{}).filter(([t])=>n.has(t)))}function tr(e,n,t,o,r){let s=Object.keys(n.agents),i=o?`, endpointId: ${JSON.stringify(o.endpointId)}, projectSlug: ${JSON.stringify(o.projectSlug)}, stageSlug: ${JSON.stringify(o.stageSlug)}`:"",a=s.map((d)=>`    ${en(t.agent?.[d]??d)}: { kind: "agent", name: ${JSON.stringify(d)}, id: ids.agents[${JSON.stringify(d)}], project: ${JSON.stringify(e.project)}, stage: ${JSON.stringify(e.stage)}${i} },`).join(`
+`),l=o?r.map((d)=>{let c=encodeURIComponent(o.accountId),p=o.stageKind===void 0||o.stageKind==="production"?`/v1/webhooks/${c}/${encodeURIComponent(d.type)}`:`/v1/webhooks/${c}/dev/${encodeURIComponent(o.endpointId)}/${encodeURIComponent(d.type)}`;return`    ${en(d.alias)}: { kind: "channel", type: ${JSON.stringify(d.type)}, agentName: ${JSON.stringify(d.agentName)}, agentId: ids.agents[${JSON.stringify(d.agentName)}], accountId: ${JSON.stringify(o.accountId)}, webhookPath: ${JSON.stringify(p)} },`}).join(`
 `):"";return`// Generated by broods. Do not edit by hand.
 import type { ResourceApi } from "broods";
 import { ids } from "./ids";
@@ -44,17 +44,17 @@ export const api = {
 ${a}
   },
   channels: {
-${c}
+${l}
   },
-  workspaces: ${ve("workspaces",n.workspaces,t.workspace)},
-  sandboxes: ${ve("sandboxes",n.sandboxes,t.sandbox)},
-  crons: ${ve("crons",n.crons,t.cron)},
-  skills: ${ve("skills",n.skills,t.skill)},
-  policies: ${ve("policies",n.policies,t.policy)},
+  workspaces: ${Oe("workspaces",n.workspaces,t.workspace)},
+  sandboxes: ${Oe("sandboxes",n.sandboxes,t.sandbox)},
+  crons: ${Oe("crons",n.crons,t.cron)},
+  skills: ${Oe("skills",n.skills,t.skill)},
+  policies: ${Oe("policies",n.policies,t.policy)},
 } as const satisfies ResourceApi;
-`}function Ho(){return`// Generated by broods. Do not edit by hand.
+`}function or(){return`// Generated by broods. Do not edit by hand.
 export type { AgentReference, ChannelReference, AgentRunInput, AgentRunResult, ResourceApi } from "broods";
-`}function zo(e){return`// Generated by broods. Do not edit by hand.
+`}function rr(e){return`// Generated by broods. Do not edit by hand.
 export const ids = ${JSON.stringify(e,null,2)} as const;
 export const agents = ids.agents;
 export const workspaces = ids.workspaces;
@@ -62,18 +62,18 @@ export const sandboxes = ids.sandboxes;
 export const crons = ids.crons;
 export const skills = ids.skills;
 export const policies = ids.policies;
-`}function Yo(e){return`// Generated by broods. Do not edit by hand.
+`}function sr(e){return`// Generated by broods. Do not edit by hand.
 export const manifest = ${JSON.stringify(e,null,2)} as const;
-`}function ve(e,n,t){let o=Object.keys(n);if(o.length===0)return"{}";return`{
-${o.map((s)=>`    ${qe(t?.[s]??s)}: ids.${e}[${JSON.stringify(s)}],`).join(`
+`}function Oe(e,n,t){let o=Object.keys(n);if(o.length===0)return"{}";return`{
+${o.map((s)=>`    ${en(t?.[s]??s)}: ids.${e}[${JSON.stringify(s)}],`).join(`
 `)}
-  }`}function qe(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)?e:JSON.stringify(e)}class U{baseUrl;token;fetchImpl;constructor(e){this.baseUrl=f(e.baseUrl),this.token=e.token,this.fetchImpl=e.fetch??fetch}async getManifest(e,n){let t=await this.request(e,n,"/manifest",{method:"GET"});if(t.status===404)return null;return await T(t,"Fetch manifest failed"),await t.json()}async putManifest(e,n,t=!1){let o=await this.externalizeLargeMcpBundles(e),r=await this.request(e.project,e.stage,"/manifest",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({manifest:o,prune:n,rotateRuntimeKey:t})});return await T(r,"Sync manifest failed"),await r.json()}async externalizeLargeMcpBundles(e){if(e.resources.every((t)=>et(t)===null))return e;let n=await Promise.all(e.resources.map(async(t)=>{let o=et(t);if(o===null)return t;let{bundle:r,...s}=t.config,i=await this.uploadMcpBundle(e.project,e.stage,o);return{...t,config:{...s,bundleStorageId:i,sha256:je(o)}}}));return{...e,resources:n}}async uploadMcpBundle(e,n,t){let o=await this.request(e,n,"/mcp-bundle-uploads",{method:"POST"});await T(o,"Mint bundle upload URL failed");let{uploadUrl:r}=await o.json();if(!r)throw Error("Mint bundle upload URL failed: response omitted uploadUrl");let s=await this.fetchImpl(r,{method:"POST",headers:{"Content-Type":"application/javascript"},body:t});await T(s,"Bundle upload failed");let{storageId:i}=await s.json();if(!i)throw Error("Bundle upload failed: response omitted storageId");return i}async getRuntimeKey(e,n){let t=await this.request(e,n,"/runtime-key",{method:"GET"});if(t.status===404)return null;await T(t,"Fetch runtime key failed");let o=await t.json();if(!o.apiKey)throw Error("Fetch runtime key failed: response omitted apiKey");return{apiKey:o.apiKey,keyHint:o.keyHint??"",...o.endpointId?{endpointId:o.endpointId}:{},...o.projectSlug?{projectSlug:o.projectSlug}:{},...o.stageSlug?{stageSlug:o.stageSlug}:{}}}async setEnv(e,n,t,o){let r=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({value:o})});await T(r,"Set environment variable failed")}async listEnv(e,n){let t=await this.request(e,n,"/env",{method:"GET"});return await T(t,"List environment variables failed"),(await t.json()).variables??[]}async getEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"GET"});if(o.status===404)return null;return await T(o,"Read environment variable failed"),(await o.json()).value??null}async removeEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"DELETE"});await T(o,"Remove environment variable failed")}async getOnboarding(){let e=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return await T(e,"Fetch CLI onboarding context failed"),await e.json()}async selectOnboardingOrg(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({orgId:e})});return await T(n,"Select CLI org failed"),await n.json()}async listStages(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/stages?project=${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return _e(n,"/v1/account/stages","broods stage"),await T(n,"List stages failed"),(await n.json()).stages??[]}async createStage(e,n,t){let o=await this.fetchImpl(`${this.baseUrl}/v1/account/stages`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,name:n,...t?{from:t}:{}})});return _e(o,"/v1/account/stages","broods stage"),await T(o,"Create stage failed"),await o.json()}async listProjects(){let e=await this.fetchImpl(`${this.baseUrl}/v1/account/projects`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return _e(e,"/v1/account/projects","broods project"),await T(e,"List projects failed"),(await e.json()).projects??[]}async deleteProject(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/projects?projectId=${encodeURIComponent(e)}`,{method:"DELETE",headers:{Authorization:`Bearer ${this.token}`}});if(_e(n,"/v1/account/projects","broods project"),n.status===404)return null;return await T(n,"Delete project failed"),(await n.json()).deleted??null}async createOnboardingOrg(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({createOrgName:e})});return await T(n,"Create CLI org failed"),await n.json()}async request(e,n,t,o){let r=`${this.baseUrl}/v1/account/projects/${encodeURIComponent(e)}/stages/${encodeURIComponent(n)}${t}`;return await this.fetchImpl(r,{...o,headers:{Authorization:`Bearer ${this.token}`,...o.headers}})}}function nn(e,n){let t=new Map((n?.resources??[]).map((d)=>[`${d.kind}:${d.name}`,d])),o=new Map(e.resources.map((d)=>[`${d.kind}:${d.name}`,d])),r=[],s=[],i=[];for(let[d,l]of o){let u=t.get(d);if(!u)s.push({key:d,resource:l});else if(De(Xe(u))!==De(Xe(l)))r.push({operation:"update",kind:l.kind,name:l.name})}for(let[d,l]of t)if(!o.has(d))i.push({key:d,resource:l});let a=new Set,c=new Set;for(let d of s){let l=i.find((u)=>!a.has(u.key)&&Vo(d.resource.kind)&&d.resource.kind===u.resource.kind&&De(Qn(d.resource))===De(Qn(u.resource)));if(!l)continue;c.add(d.key),a.add(l.key),r.push({operation:"rename",kind:d.resource.kind,name:d.resource.name,previousName:l.resource.name})}for(let{key:d,resource:l}of s)if(!c.has(d))r.push({operation:"create",kind:l.kind,name:l.name});for(let{key:d,resource:l}of i)if(!a.has(d))r.push({operation:"delete",kind:l.kind,name:l.name});return r.sort((d,l)=>Xn(d).localeCompare(Xn(l)))}function Xn(e){return`${{create:0,rename:1,update:2,delete:3}[e.operation]}:${e.kind}:${e.previousName??""}:${e.name}`}function Vo(e){return e==="agent"||e==="workspace"||e==="sandbox"||e==="policy"}function Ze(e){if(Array.isArray(e))return e.map(Ze);if(e&&typeof e==="object"){let n=e;if(n.__beeblastEnv===!0&&typeof n.name==="string")return`\${${n.name}}`;return Object.fromEntries(Object.entries(n).map(([t,o])=>[t,Ze(o)]))}return e}function Qn(e){let n=Xe(e),{name:t,...o}=n;return o}function Xe(e){let n=Ze(e);if(e.kind!=="skill"&&e.kind!=="hook")return n;return{...n,config:en(n.config)}}function Qe(e){if(Array.isArray(e))return e.map(Qe);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).sort(([n],[t])=>n.localeCompare(t)).map(([n,t])=>[n,Qe(t)]));return e}function De(e){return JSON.stringify(Qe(e))}function en(e){if(Array.isArray(e))return e.map(en);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).flatMap(([n,t])=>{if(n==="contentBase64"||n==="bundle")return[];return[[n,en(t)]]}));return e}async function T(e,n){if(e.ok)return;let t=await e.text(),o=t;try{o=JSON.parse(t).error?.message??t}catch{}throw Error(`${n}: ${e.status} ${o}`)}function _e(e,n,t){if(e.status!==404)return;if((e.headers.get("Content-Type")??"").includes("application/json"))return;throw Error(`This broods deployment has no ${n} route yet. Update the backend to use \`${t}\`.`)}function et(e){if(e.kind!=="mcp")return null;let n=e.config?.bundle;if(typeof n!=="string")return null;return Buffer.byteLength(n)>Gn?n:null}var Jo=1,qo=0;async function nt(e,n,t=fetch){try{let o=await t(`${e.replace(/\/+$/,"")}/v1/internal/observability-scope`,{method:"POST",headers:{Authorization:`Bearer ${n}`,"Content-Type":"application/json"},signal:AbortSignal.timeout(5000)});if(!o.ok)return null;let r=await o.json();if(typeof r?.projectSlug!=="string"||typeof r?.stageSlug!=="string"||r.projectSlug===""||r.stageSlug==="")return null;return r}catch{return null}}function de(e,n){return new Promise((t)=>{if(n?.aborted)return t();let o=setTimeout(t,e);n?.addEventListener("abort",()=>{clearTimeout(o),t()},{once:!0})})}function pe(){let e=globalThis.WebSocket;if(!e)throw Error("WebSocket is not available in this environment.");return e}async function*Te(e,n={}){let t=new Set,o=500;while(!n.signal?.aborted){try{for await(let r of Zo(e,n)){let s=`${r.ts}|${r.eventType}|${r.message}`;if(t.has(s))continue;if(t.add(s),t.size>5000)t.delete(t.values().next().value);o=500,yield r}}catch(r){if(n.signal?.aborted)return;let s=r instanceof Error?r.message:String(r);if(/unauthorized|invalid websocket token|scope does not match/i.test(s))throw r}await de(o,n.signal),o=Math.min(o*2,5000)}}async function*Zo(e,n){let{baseUrl:t,apiKey:o,project:r,stage:s}=e,{backfill:i=0,minLevel:a,sandboxId:c,signal:d}=n,l=n.liveOnly??i<=0;if(d?.aborted)return;let u=Xo(t,r,s),p=u,m=pe(),v=[],k=null,R=!1,X=null,M=()=>{X?.(),X=null},Q=new m(u,E(o)),Fe=()=>{if(Q.readyState===Jo||Q.readyState===qo)Q.close(1000,"client closed");d?.removeEventListener("abort",$n)},$n=()=>{R=!0,M(),Fe()};d?.addEventListener("abort",$n,{once:!0}),Q.onopen=()=>{if(d?.aborted){Fe();return}let K={type:"subscribe",stream:"logs",...i>0?{backfill:i}:{},...l?{liveOnly:!0}:{},...a!==void 0?{minLevel:a}:{},...c!==void 0?{sandboxId:c}:{}};Q.send(JSON.stringify(K))},Q.onmessage=(K)=>{let ue=Qo(K.data);if(!ue)return;switch(ue.type){case"backfill":if(ue.stream==="logs"){for(let Ut of ue.entries)v.push(Ut);M()}break;case"log":v.push(ue.entry),M();break;case"error":k=Error(`Observability gateway error: ${ue.error}`),R=!0,M();break;case"ready":break;default:break}},Q.onerror=()=>{k=Error(`Cannot connect to the observability gateway at ${p}.`),R=!0,M()},Q.onclose=(K)=>{if(!R){if(K.code!==1000)k=Error(K.reason?`Observability WebSocket closed: ${K.reason}`:`Observability WebSocket closed with code ${K.code}.`);R=!0,M()}};try{while(!0){if(v.length>0){yield v.shift();continue}if(k)throw k;if(R)return;await new Promise((K)=>{X=K})}}finally{Fe()}}function Xo(e,n,t){return`${W(e)}/v1/projects/${encodeURIComponent(n)}/stages/${encodeURIComponent(t)}/observability/ws`}function Qo(e){if(typeof e!=="string")return null;try{let n=JSON.parse(e);return typeof n==="object"&&n!==null&&typeof n.type==="string"?n:null}catch{return null}}import{createServer as cr}from"node:http";import{createHash as lr,randomBytes as dr,randomUUID as ur}from"node:crypto";import{spawn as gr}from"node:child_process";import{createInterface as ke}from"node:readline/promises";import{stdin as Y,stdout as z}from"node:process";function fe(e,n,t={}){let o=`${n?"*":" "} ${e}`;return n?N(o,"\x1B[1m\x1B[36m",me(t)):o}function er(e,n={}){let t=me(n),o=ar(e.stage),r=o==="Development",s=N("▌",r?"\x1B[32m":"\x1B[33m",t),i=t?`${r?"\x1B[42m\x1B[30m\x1B[1m":"\x1B[43m\x1B[30m\x1B[1m"} ${o} \x1B[0m`:`[${o}]`,a=t?N("dashboard","\x1B[4m",t):"dashboard",c=`${e.dashboardUrl}?project=${encodeURIComponent(e.project)}&stage=${encodeURIComponent(e.stage)}`,d=N(c,"\x1B[2m\x1B[4m",t);return[`${s} Syncing ${o}: ${N(e.project,"",t)}`,`${s} ${i} ${e.stage} (${a})`,`${s} ${N("└─","\x1B[2m",t)} ${d}`].join(`
-`)}function nr(e,n={}){let t=me(n);return e.map((o)=>{let r=sr(o.operation,t);if(o.operation==="rename"&&o.previousName)return`  ${r} ${o.kind}:${o.previousName} -> ${o.name}`;return`  ${r} ${o.kind}:${o.name}`})}function tr(e,n={}){let t=me(n),o=N("▌","\x1B[32m",t),r=N("↑","\x1B[32m",t);return`${o} ${r} Synced ${e.length} env var(s) from .env.local: ${e.join(", ")}`}function or(e,n={}){let t=(n.now??new Date).toTimeString().slice(0,8);return`${N("✔","\x1B[32m",me(n))} ${t} Resources ready! (${ir(e)})`}function rr(e,n={}){return N(e,"\x1B[33m",me(n))}function tt(e){console.error(er(e))}function Ue(e){for(let n of nr(e))console.log(n)}function tn(e){console.error(tr(e))}function ot(e){console.error(or(e))}function P(e){console.log(rr(e))}function sr(e,n){if(e==="create")return`[${N("+","\x1B[32m",n)}]`;if(e==="rename")return`[${N("~","\x1B[33m",n)}]`;if(e==="update")return`[${N("*","\x1B[36m",n)}]`;return`[${N("-","\x1B[31m",n)}]`}function ir(e){if(e>=1000)return`${(e/1000).toFixed(2)}s`;return`${Math.max(e,0).toFixed(1)}ms`}function N(e,n,t){return t?`${n}${e}\x1B[0m`:e}function me(e){if(e.color!==void 0)return e.color;if(Object.hasOwn(process.env,"NO_COLOR"))return!1;if(process.env.FORCE_COLOR&&process.env.FORCE_COLOR!=="0")return!0;return process.stderr.isTTY&&process.env.TERM!=="dumb"}function ar(e){let n=e.trim().toLowerCase();if(n==="development")return"Development";if(n==="production")return"Production";return e.trim()}var fr=180000,pr=new Set(["--base-url","--cwd","--dashboard-url","--stage","--from","--level","--limit","--mcp","--project","--region","--sandbox","-n"]);function I(e,n){return e.includes(n)}function ce(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function y(e,n){let t=e.indexOf(n);return t>=0?e[t+1]:void 0}function se(e){let n=[];for(let t=0;t<e.length;t+=1){let o=e[t];if(o===void 0)continue;if(pr.has(o)){t+=1;continue}if(o.startsWith("-"))continue;n.push(o)}return n}async function on(e){let n=ur(),t=dr(32).toString("base64url"),o=lr("sha256").update(t).digest("base64url"),{code:r,close:s}=await wr(n);try{let i=r.callbackUrl,a=`${f(e)}/cli-auth/start?`+new URLSearchParams({callback:i,state:n,code_challenge:o});await mr(a),br(a),console.log(`Opening ${a}`);let c=await yr(r.promise,fr),d=await fetch(`${c.baseUrl}/v1/account/auth/exchange`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:c.code,code_verifier:t})});if(!d.ok)throw Error(`Login exchange failed: ${d.status} ${await d.text()}`);let l=await d.json(),u={baseUrl:c.baseUrl,dashboardUrl:f(e),token:l.token,createdAt:new Date().toISOString(),...l.user?{user:l.user}:{},...l.org?{org:l.org}:{},...l.account?{account:l.account}:{}};return await V(u),u}finally{s()}}async function F(e){h();let n=x(e);if(!n){let t=process.env.BROODS_DASHBOARD_URL,o=e??process.env.BROODS_BASE_URL??(t?q(t):void 0);throw Error(o?`Not logged in to ${f(o)}. Run \`broods login\`.`:"Run `broods login` first, or set BROODS_TOKEN and BROODS_BASE_URL.")}return n}async function Le(e){if(!Y.isTTY)return!1;let n=ke({input:Y,output:z});try{let t=(await n.question(`${e} [y/N] `)).trim().toLowerCase();return t==="y"||t==="yes"}finally{n.close()}}async function rt(e){let n=ke({input:Y,output:z});try{let t=await n.question(`${e}: `);if(!t)throw Error(`${e} is required`);return t}finally{n.close()}}async function Se(e,n,t,o){if(n.length===0)throw Error(`${e}: no options available`);if(n.length===1)return n[0];let r=o!==void 0&&o>=0&&o<n.length?o:void 0;console.log(e),n.forEach((a,c)=>{console.log(fe(`${c+1}. ${t(a)}`,c===r))});let s=r===void 0?`Choose 1-${n.length}: `:`Choose 1-${n.length} [${r+1}]: `,i=ke({input:Y,output:z});try{while(!0){let a=(await i.question(s)).trim();if(a===""&&r!==void 0)return n[r];let c=Number(a);if(Number.isInteger(c)&&c>=1&&c<=n.length)return n[c-1];console.log(`Enter a number from 1 to ${n.length}.`)}}finally{i.close()}}async function st(e,n,t,o){console.log(e),n.forEach((i,a)=>{console.log(`  ${a+1}. ${t(i)}`)});let r=n.length>0?`Choose 1-${n.length}, or `:"",s=ke({input:Y,output:z});try{let i=(await s.question(`${r}${o.hint} [${o.defaultValue}]: `)).trim();if(i==="")return o.defaultValue;let a=Number(i);if(Number.isInteger(a)&&a>=1&&a<=n.length)return n[a-1];return i}finally{s.close()}}async function le(e,n){if(!Y.isTTY)return n??"";let t=ke({input:Y,output:z});try{let o=t.question(`${e}: `);if(n){if(Y.isTTY&&z.isTTY)z.write("\x1B[90m");if(t.write(n),Y.isTTY&&z.isTTY)z.write("\x1B[0m")}return(await o).trim()||n||""}finally{t.close()}}async function mr(e){let n=await fetch(e,{method:"GET",redirect:"manual"});if(n.status===404){let t=new URL(e);throw Error(`${t.origin} does not expose /cli-auth/start yet. Deploy the dashboard changes first, or use --dashboard-url http://localhost:3000 with a local dashboard dev server.`)}if(n.status>=500)throw Error(`Dashboard CLI auth route failed: ${n.status} ${await n.text()}`)}function hr(){let e=process.env.BROODS_LOGIN_PORT;if(e){let n=Number(e);if(Number.isInteger(n)&&n>0&&n<65536)return n;throw Error("BROODS_LOGIN_PORT must be a TCP port number")}return 18987}function br(e){let n=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",t=process.platform==="win32"?["/c","start",e]:[e];gr(n,t,{stdio:"ignore",detached:!0}).unref()}function wr(e){return new Promise((n,t)=>{let o=cr((c,d)=>{try{let l=new URL(c.url??"/","http://127.0.0.1"),u=l.searchParams.get("state"),p=l.searchParams.get("code"),m=l.searchParams.get("base_url");if(u!==e||!p){d.writeHead(400).end("Invalid broods login callback.");return}if(!m){d.writeHead(400).end("Login callback omitted base_url; update the dashboard deployment."),s(Error("Login callback did not advertise the API base URL (base_url). Deploy a dashboard build that includes the Convex-direct CLI auth flow."));return}d.writeHead(200,{"Content-Type":"text/plain"}).end("broods CLI login complete. You can close this tab."),r({code:p,baseUrl:f(m)})}catch(l){s(l)}}),r,s,i=new Promise((c,d)=>{r=c,s=d}),a=hr();o.on("error",(c)=>{if(!process.env.BROODS_LOGIN_PORT&&a!==0&&c.code==="EADDRINUSE"){o.listen(0,"127.0.0.1");return}t(c)}),o.listen(a,"127.0.0.1",()=>{let c=o.address();if(!c||typeof c==="string"){t(Error("Failed to allocate callback port"));return}n({code:{callbackUrl:`http://127.0.0.1:${c.port}/callback`,promise:i},close:()=>o.close()})})})}async function yr(e,n){let t,o=new Promise((r,s)=>{t=setTimeout(()=>s(Error(`Timed out waiting for browser login to complete.
+  }`}function en(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)?e:JSON.stringify(e)}var ir=1,ar=0;function se(e,n){return new Promise((t)=>{if(n?.aborted)return t();let o=setTimeout(t,e);n?.addEventListener("abort",()=>{clearTimeout(o),t()},{once:!0})})}function fe(){let e=globalThis.WebSocket;if(!e)throw Error("WebSocket is not available in this environment.");return e}class q extends Error{}async function*Me(e,n={}){let t=new Set,o=500;while(!n.signal?.aborted){try{for await(let r of cr(e,n)){let s=`${r.ts}|${r.eventType}|${r.message}`;if(t.has(s))continue;if(t.add(s),t.size>5000)t.delete(t.values().next().value);o=500,yield r}}catch(r){if(n.signal?.aborted)return;let s=r instanceof Error?r.message:String(r);if(r instanceof q||/unauthorized|invalid websocket token|scope does not match/i.test(s))throw r}await se(o,n.signal),o=Math.min(o*2,5000)}}async function*cr(e,n){let{baseUrl:t,credential:o,project:r,stage:s}=e,{backfill:i=0,minLevel:a,sandboxId:l,signal:d}=n,c=n.liveOnly??i<=0;if(d?.aborted)return;let p=lr(t,r,s),u=p,h=fe(),v=[],k=null,R=!1,ne=null,B=()=>{ne?.(),ne=null},te=new h(p,C(await o())),Ye=()=>{if(te.readyState===ir||te.readyState===ar)te.close(1000,"client closed");d?.removeEventListener("abort",Cn)},Cn=()=>{R=!0,B(),Ye()};d?.addEventListener("abort",Cn,{once:!0}),te.onopen=()=>{if(d?.aborted){Ye();return}let H={type:"subscribe",stream:"logs",...i>0?{backfill:i}:{},...c?{liveOnly:!0}:{},...a!==void 0?{minLevel:a}:{},...l!==void 0?{sandboxId:l}:{}};te.send(JSON.stringify(H))},te.onmessage=(H)=>{let we=dr(H.data);if(!we)return;switch(we.type){case"backfill":if(we.stream==="logs"){for(let Yt of we.entries)v.push(Yt);B()}break;case"log":v.push(we.entry),B();break;case"error":k=Error(`Observability gateway error: ${we.error}`),R=!0,B();break;case"ready":break;default:break}},te.onerror=()=>{k=Error(`Cannot connect to the observability gateway at ${u}.`),R=!0,B()},te.onclose=(H)=>{if(!R){if(H.code!==1000)k=Error(H.reason?`Observability WebSocket closed: ${H.reason}`:`Observability WebSocket closed with code ${H.code}.`);R=!0,B()}};try{while(!0){if(v.length>0){yield v.shift();continue}if(k)throw k;if(R)return;await new Promise((H)=>{ne=H})}}finally{Ye()}}function lr(e,n,t){return`${Y(e)}/v1/projects/${encodeURIComponent(n)}/stages/${encodeURIComponent(t)}/observability/ws`}function dr(e){if(typeof e!=="string")return null;try{let n=JSON.parse(e);return typeof n==="object"&&n!==null&&typeof n.type==="string"?n:null}catch{return null}}class T{baseUrl;token;fetchImpl;constructor(e){this.baseUrl=f(e.baseUrl),this.token=e.token,this.fetchImpl=e.fetch??fetch}async getManifest(e,n){let t=await this.request(e,n,"/manifest",{method:"GET"});if(t.status===404)return null;return await I(t,"Fetch manifest failed"),await t.json()}async putManifest(e,n,t=!1){let o=await this.externalizeLargeMcpBundles(e),r=await this.request(e.project,e.stage,"/manifest",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({manifest:o,prune:n,rotateRuntimeKey:t})});return await I(r,"Sync manifest failed"),await r.json()}async externalizeLargeMcpBundles(e){if(e.resources.every((t)=>rt(t)===null))return e;let n=await Promise.all(e.resources.map(async(t)=>{let o=rt(t);if(o===null)return t;let{bundle:r,...s}=t.config,i=await this.uploadMcpBundle(e.project,e.stage,o);return{...t,config:{...s,bundleStorageId:i,sha256:Ue(o)}}}));return{...e,resources:n}}async uploadMcpBundle(e,n,t){let o=await this.request(e,n,"/mcp-bundle-uploads",{method:"POST"});await I(o,"Mint bundle upload URL failed");let{uploadUrl:r}=await o.json();if(!r)throw Error("Mint bundle upload URL failed: response omitted uploadUrl");let s=await this.fetchImpl(r,{method:"POST",headers:{"Content-Type":"application/javascript"},body:t});await I(s,"Bundle upload failed");let{storageId:i}=await s.json();if(!i)throw Error("Bundle upload failed: response omitted storageId");return i}async getRuntimeKey(e,n){let t=await this.request(e,n,"/runtime-key",{method:"GET"});if(t.status===404)return null;await I(t,"Fetch runtime key failed");let o=await t.json();if(!o.apiKey)throw Error("Fetch runtime key failed: response omitted apiKey");return{apiKey:o.apiKey,keyHint:o.keyHint??"",...o.endpointId?{endpointId:o.endpointId}:{},...o.projectSlug?{projectSlug:o.projectSlug}:{},...o.stageSlug?{stageSlug:o.stageSlug}:{}}}async setEnv(e,n,t,o){let r=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({value:o})});await I(r,"Set environment variable failed")}async listEnv(e,n){let t=await this.request(e,n,"/env",{method:"GET"});return await I(t,"List environment variables failed"),(await t.json()).variables??[]}async getEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"GET"});if(o.status===404)return null;return await I(o,"Read environment variable failed"),(await o.json()).value??null}async removeEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"DELETE"});await I(o,"Remove environment variable failed")}async getOnboarding(){let e=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return await I(e,"Fetch CLI onboarding context failed"),await e.json()}async selectOnboardingOrg(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({orgId:e})});return await I(n,"Select CLI org failed"),await n.json()}async listStages(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/stages?project=${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return Re(n,"/v1/account/stages","broods stage"),await I(n,"List stages failed"),(await n.json()).stages??[]}async createStage(e,n,t){let o=await this.fetchImpl(`${this.baseUrl}/v1/account/stages`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,name:n,...t?{from:t}:{}})});return Re(o,"/v1/account/stages","broods stage"),await I(o,"Create stage failed"),await o.json()}async mintStageSession(e,n){let t=await this.fetchImpl(`${this.baseUrl}/v1/account/stage-session`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,stage:n})});Re(t,"/v1/account/stage-session","broods logs");try{await I(t,"Open stage session failed")}catch(o){if(t.status===401||t.status===404)throw new q(o instanceof Error?o.message:String(o));throw o}return await t.json()}async listProjects(){let e=await this.fetchImpl(`${this.baseUrl}/v1/account/projects`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return Re(e,"/v1/account/projects","broods project"),await I(e,"List projects failed"),(await e.json()).projects??[]}async deleteProject(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/projects?projectId=${encodeURIComponent(e)}`,{method:"DELETE",headers:{Authorization:`Bearer ${this.token}`}});if(Re(n,"/v1/account/projects","broods project"),n.status===404)return null;return await I(n,"Delete project failed"),(await n.json()).deleted??null}async createOnboardingOrg(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({createOrgName:e})});return await I(n,"Create CLI org failed"),await n.json()}async request(e,n,t,o){let r=`${this.baseUrl}/v1/account/projects/${encodeURIComponent(e)}/stages/${encodeURIComponent(n)}${t}`;return await this.fetchImpl(r,{...o,headers:{Authorization:`Bearer ${this.token}`,...o.headers}})}}function sn(e,n){let t=new Map((n?.resources??[]).map((d)=>[`${d.kind}:${d.name}`,d])),o=new Map(e.resources.map((d)=>[`${d.kind}:${d.name}`,d])),r=[],s=[],i=[];for(let[d,c]of o){let p=t.get(d);if(!p)s.push({key:d,resource:c});else if(Be(tn(p))!==Be(tn(c)))r.push({operation:"update",kind:c.kind,name:c.name})}for(let[d,c]of t)if(!o.has(d))i.push({key:d,resource:c});let a=new Set,l=new Set;for(let d of s){let c=i.find((p)=>!a.has(p.key)&&ur(d.resource.kind)&&d.resource.kind===p.resource.kind&&Be(ot(d.resource))===Be(ot(p.resource)));if(!c)continue;l.add(d.key),a.add(c.key),r.push({operation:"rename",kind:d.resource.kind,name:d.resource.name,previousName:c.resource.name})}for(let{key:d,resource:c}of s)if(!l.has(d))r.push({operation:"create",kind:c.kind,name:c.name});for(let{key:d,resource:c}of i)if(!a.has(d))r.push({operation:"delete",kind:c.kind,name:c.name});return r.sort((d,c)=>tt(d).localeCompare(tt(c)))}function tt(e){return`${{create:0,rename:1,update:2,delete:3}[e.operation]}:${e.kind}:${e.previousName??""}:${e.name}`}function ur(e){return e==="agent"||e==="workspace"||e==="sandbox"||e==="policy"}function nn(e){if(Array.isArray(e))return e.map(nn);if(e&&typeof e==="object"){let n=e;if(n.__beeblastEnv===!0&&typeof n.name==="string")return`\${${n.name}}`;return Object.fromEntries(Object.entries(n).map(([t,o])=>[t,nn(o)]))}return e}function ot(e){let n=tn(e),{name:t,...o}=n;return o}function tn(e){let n=nn(e);if(e.kind!=="skill"&&e.kind!=="hook")return n;return{...n,config:rn(n.config)}}function on(e){if(Array.isArray(e))return e.map(on);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).sort(([n],[t])=>n.localeCompare(t)).map(([n,t])=>[n,on(t)]));return e}function Be(e){return JSON.stringify(on(e))}function rn(e){if(Array.isArray(e))return e.map(rn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).flatMap(([n,t])=>{if(n==="contentBase64"||n==="bundle")return[];return[[n,rn(t)]]}));return e}async function I(e,n){if(e.ok)return;let t=await e.text(),o=t;try{o=JSON.parse(t).error?.message??t}catch{}throw Error(`${n}: ${e.status} ${o}`)}function Re(e,n,t){if(e.status!==404)return;if((e.headers.get("Content-Type")??"").includes("application/json"))return;throw Error(`This broods deployment has no ${n} route yet. Update the backend to use \`${t}\`.`)}function rt(e){if(e.kind!=="mcp")return null;let n=e.config?.bundle;if(typeof n!=="string")return null;return Buffer.byteLength(n)>zn?n:null}import{createServer as kr}from"node:http";import{createHash as Sr,randomBytes as $r,randomUUID as Er}from"node:crypto";import{spawn as Or}from"node:child_process";import{createInterface as Ce}from"node:readline/promises";import{stdin as Q,stdout as X}from"node:process";function ve(e,n,t={}){let o=`${n?"*":" "} ${e}`;return n?j(o,"\x1B[1m\x1B[36m",F(t)):o}function st(e,n={}){let t=F(n),o=(i)=>j(i.padEnd(9),"\x1B[2m",t),r=!e.loggedIn?j("not logged in","\x1B[33m",t):e.org??j("unknown, run broods whoami","\x1B[2m",t),s=e.project??`none ${j(`(${e.projectGuess} from folder name)`,"\x1B[2m",t)}`;return[`  ${o("org")}${r}`,`  ${o("project")}${s}`,`  ${o("stage")}${dt(e.stage,t)}`,`  ${o("server")}${e.server}`]}function gr(e,n={}){let t=F(n),o=ut(e.stage),r=o==="Development",s=j("▌",r?"\x1B[32m":"\x1B[33m",t),i=t?`${r?"\x1B[42m\x1B[30m\x1B[1m":"\x1B[43m\x1B[30m\x1B[1m"} ${o} \x1B[0m`:`[${o}]`,a=t?j("dashboard","\x1B[4m",t):"dashboard",l=`${e.dashboardUrl}?project=${encodeURIComponent(e.project)}&stage=${encodeURIComponent(e.stage)}`,d=j(l,"\x1B[2m\x1B[4m",t);return[`${s} Syncing ${o}: ${j(e.project,"",t)}`,`${s} ${i} ${e.stage} (${a})`,`${s} ${j("└─","\x1B[2m",t)} ${d}`].join(`
+`)}function fr(e,n={}){let t=F(n);return e.map((o)=>{let r=yr(o.operation,t);if(o.operation==="rename"&&o.previousName)return`  ${r} ${o.kind}:${o.previousName} -> ${o.name}`;return`  ${r} ${o.kind}:${o.name}`})}function pr(e,n={}){let t=F(n),o=j("▌","\x1B[32m",t),r=j("↑","\x1B[32m",t);return`${o} ${r} Synced ${e.length} env var(s) from .env.local: ${e.join(", ")}`}function mr(e,n={}){return`${j("✖","\x1B[31m",F(n))} ${e}`}function it(e,n={}){let t=F(n),o=Math.max(...e.map(([r])=>r.length))+2;return e.map(([r,s])=>`  ${r.padEnd(o)}${j(s,"\x1B[2m",t)}`)}function hr(e,n={}){let t=(n.now??new Date).toTimeString().slice(0,8);return`${j("✔","\x1B[32m",F(n))} ${t} Resources ready! (${vr(e)})`}function br(e,n={}){return`${j("✔","\x1B[32m",F(n))} ${e}`}function an(e,n,t={}){let o=F(t),r=t.note?`  ${j(`(${t.note})`,"\x1B[2m",o)}`:"";return`  ${j("now","\x1B[2m",o)}  ${e} → ${dt(n,o)}${r}`}function wr(e,n={}){return j(`! ${e}`,"\x1B[33m",F(n))}function at(e){console.error(gr(e))}function Ge(e){for(let n of fr(e))console.log(n)}function cn(e){console.error(pr(e))}function ct(e){console.error(mr(e,{stream:"stderr"}))}function lt(e){console.error(hr(e))}function M(e){console.log(br(e,{stream:"stdout"}))}function P(e){console.log(wr(e,{stream:"stdout"}))}function yr(e,n){if(e==="create")return`[${j("+","\x1B[32m",n)}]`;if(e==="rename")return`[${j("~","\x1B[33m",n)}]`;if(e==="update")return`[${j("*","\x1B[36m",n)}]`;return`[${j("-","\x1B[31m",n)}]`}function vr(e){if(e>=1000)return`${(e/1000).toFixed(2)}s`;return`${Math.max(e,0).toFixed(1)}ms`}function j(e,n,t){return t?`${n}${e}\x1B[0m`:e}function dt(e,n){let t=ut(e)==="Development";return j(e,t?"\x1B[32m":"\x1B[33m",n)}function F(e){if(e.color!==void 0)return e.color;if(Object.hasOwn(process.env,"NO_COLOR"))return!1;if(process.env.FORCE_COLOR&&process.env.FORCE_COLOR!=="0")return!0;return(e.stream==="stdout"?process.stdout:process.stderr).isTTY&&process.env.TERM!=="dumb"}function ut(e){let n=e.trim().toLowerCase();if(n==="development")return"Development";if(n==="production")return"Production";return e.trim()}var Rr=180000,Cr=new Set(["--base-url","--cwd","--dashboard-url","--stage","--from","--level","--limit","--mcp","--project","--region","--sandbox","-n"]);function L(e,n){return e.includes(n)}function pe(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function y(e,n){let t=e.indexOf(n);return t>=0?e[t+1]:void 0}function le(e){let n=[];for(let t=0;t<e.length;t+=1){let o=e[t];if(o===void 0)continue;if(Cr.has(o)){t+=1;continue}if(o.startsWith("-"))continue;n.push(o)}return n}async function ln(e){let n=Er(),t=$r(32).toString("base64url"),o=Sr("sha256").update(t).digest("base64url"),{code:r,close:s}=await Pr(n);try{let i=r.callbackUrl,a=`${f(e)}/cli-auth/start?`+new URLSearchParams({callback:i,state:n,code_challenge:o});await Ar(a),jr(a),console.log(`Opening ${a}`);let l=await Ir(r.promise,Rr),d=await fetch(`${l.baseUrl}/v1/account/auth/exchange`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:l.code,code_verifier:t})});if(!d.ok)throw Error(`Login exchange failed: ${d.status} ${await d.text()}`);let c=await d.json(),p={baseUrl:l.baseUrl,dashboardUrl:f(e),token:c.token,createdAt:new Date().toISOString(),...c.user?{user:c.user}:{},...c.org?{org:c.org}:{},...c.account?{account:c.account}:{}};return await G(p),p}finally{s()}}async function J(e){m();let n=z(e);if(!n){let t=process.env.BROODS_DASHBOARD_URL,o=e??process.env.BROODS_BASE_URL??(t?D(t):void 0);throw Error(o?`Not logged in to ${f(o)}. Run \`broods login\`.`:"Run `broods login` first, or set BROODS_TOKEN and BROODS_BASE_URL.")}return n}async function We(e){if(!Q.isTTY)return!1;let n=Ce({input:Q,output:X});try{let t=(await n.question(`${e} [y/N] `)).trim().toLowerCase();return t==="y"||t==="yes"}finally{n.close()}}async function gt(e){let n=Ce({input:Q,output:X});try{let t=await n.question(`${e}: `);if(!t)throw Error(`${e} is required`);return t}finally{n.close()}}async function Ae(e,n,t,o){if(n.length===0)throw Error(`${e}: no options available`);if(n.length===1)return n[0];let r=o!==void 0&&o>=0&&o<n.length?o:void 0;console.log(e),n.forEach((a,l)=>{console.log(ve(`${l+1}. ${t(a)}`,l===r))});let s=r===void 0?`Choose 1-${n.length}: `:`Choose 1-${n.length} [${r+1}]: `,i=Ce({input:Q,output:X});try{while(!0){let a=(await i.question(s)).trim();if(a===""&&r!==void 0)return n[r];let l=Number(a);if(Number.isInteger(l)&&l>=1&&l<=n.length)return n[l-1];console.log(`Enter a number from 1 to ${n.length}.`)}}finally{i.close()}}async function ft(e,n,t,o){console.log(e),n.forEach((i,a)=>{console.log(`  ${a+1}. ${t(i)}`)});let r=n.length>0?`Choose 1-${n.length}, or `:"",s=Ce({input:Q,output:X});try{let i=(await s.question(`${r}${o.hint} [${o.defaultValue}]: `)).trim();if(i==="")return o.defaultValue;let a=Number(i);if(Number.isInteger(a)&&a>=1&&a<=n.length)return n[a-1];return i}finally{s.close()}}async function me(e,n){if(!Q.isTTY)return n??"";let t=Ce({input:Q,output:X});try{let o=t.question(`${e}: `);if(n){if(Q.isTTY&&X.isTTY)X.write("\x1B[90m");if(t.write(n),Q.isTTY&&X.isTTY)X.write("\x1B[0m")}return(await o).trim()||n||""}finally{t.close()}}async function Ar(e){let n=await fetch(e,{method:"GET",redirect:"manual"});if(n.status===404){let t=new URL(e);throw Error(`${t.origin} does not expose /cli-auth/start yet. Deploy the dashboard changes first, or use --dashboard-url http://localhost:3000 with a local dashboard dev server.`)}if(n.status>=500)throw Error(`Dashboard CLI auth route failed: ${n.status} ${await n.text()}`)}function xr(){let e=process.env.BROODS_LOGIN_PORT;if(e){let n=Number(e);if(Number.isInteger(n)&&n>0&&n<65536)return n;throw Error("BROODS_LOGIN_PORT must be a TCP port number")}return 18987}function jr(e){let n=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",t=process.platform==="win32"?["/c","start",e]:[e];Or(n,t,{stdio:"ignore",detached:!0}).unref()}function Pr(e){return new Promise((n,t)=>{let o=kr((l,d)=>{try{let c=new URL(l.url??"/","http://127.0.0.1"),p=c.searchParams.get("state"),u=c.searchParams.get("code"),h=c.searchParams.get("base_url");if(p!==e||!u){d.writeHead(400).end("Invalid broods login callback.");return}if(!h){d.writeHead(400).end("Login callback omitted base_url; update the dashboard deployment."),s(Error("Login callback did not advertise the API base URL (base_url). Deploy a dashboard build that includes the Convex-direct CLI auth flow."));return}d.writeHead(200,{"Content-Type":"text/plain"}).end("broods CLI login complete. You can close this tab."),r({code:u,baseUrl:f(h)})}catch(c){s(c)}}),r,s,i=new Promise((l,d)=>{r=l,s=d}),a=xr();o.on("error",(l)=>{if(!process.env.BROODS_LOGIN_PORT&&a!==0&&l.code==="EADDRINUSE"){o.listen(0,"127.0.0.1");return}t(l)}),o.listen(a,"127.0.0.1",()=>{let l=o.address();if(!l||typeof l==="string"){t(Error("Failed to allocate callback port"));return}n({code:{callbackUrl:`http://127.0.0.1:${l.port}/callback`,promise:i},close:()=>o.close()})})})}async function Ir(e,n){let t,o=new Promise((r,s)=>{t=setTimeout(()=>s(Error(`Timed out waiting for browser login to complete.
 Check the browser tab and the dashboard logs for an error. If the browser shows
 404 on /cli-auth/start, deploy the dashboard build that includes CLI auth or pass
 --dashboard-url for the environment you deployed. Other common causes are missing
-cliAuth Convex functions or no active API account (Settings -> API Access).`)),n)});try{return await Promise.race([e,o])}finally{if(t)clearTimeout(t)}}import{existsSync as it}from"node:fs";import{mkdir as vr,readFile as kr,writeFile as Sr}from"node:fs/promises";import{dirname as lt,join as rn,resolve as $r,sep as ie}from"node:path";import{fileURLToPath as Er}from"node:url";var sn=rn(lt(j),"update-check.json"),Or=86400000,Rr="https://registry.npmjs.org/broods/latest",Cr=2000;function an(e,n){let t=ct(e),o=ct(n);for(let r=0;r<3;r+=1){let s=t[r]??0,i=o[r]??0;if(s!==i)return s>i}return!at(e)&&at(n)}async function cn(e={}){let n=await jr(),t=e.maxAgeMs??Or;if(n&&Date.now()-n.checkedAt<t)return n.latest;let o=await Ar();if(o===null)return n?.latest??null;return await Pr({checkedAt:Date.now(),latest:o}),o}function dt(e=$r(process.cwd()),n=Er(import.meta.url)){let t=`${ie}node_modules${ie}`,o=n.lastIndexOf(t),r=o===-1?null:n.slice(0,o),s=r===null?n.startsWith(`${e}${ie}`):e===r||e.startsWith(`${r}${ie}`),a=n.includes(`${ie}.bun${ie}install${ie}global${ie}`)||s&&xr(r??e)?"bun":"npm",c=a==="bun"?"add":"install";return{manager:a,global:!s,command:a,args:s?[c,"broods@latest"]:[c,"-g","broods@latest"]}}async function Ar(){try{let e=await fetch(Rr,{signal:AbortSignal.timeout(Cr),headers:{accept:"application/json"}});if(!e.ok)return null;let n=await e.json();return typeof n.version==="string"?n.version:null}catch{return null}}function xr(e){return it(rn(e,"bun.lock"))||it(rn(e,"bun.lockb"))}function at(e){return e.includes("-")}async function jr(){try{let e=JSON.parse(await kr(sn,"utf8"));if(typeof e.latest!=="string")return null;if(typeof e.checkedAt!=="number")return null;return{checkedAt:e.checkedAt,latest:e.latest}}catch{return null}}function ct(e){let[n]=e.trim().replace(/^v/,"").split("-");return(n??"").split(".").slice(0,3).map((t)=>Number.parseInt(t,10)||0)}async function Pr(e){try{await vr(lt(sn),{recursive:!0}),await Sr(sn,`${JSON.stringify(e)}
-`,"utf8")}catch{}}var ut={name:"broods",version:"0.40.0",description:"CLI + TypeScript SDK for the broods agent platform.",keywords:["agents","ai","broods","cli","sdk"],homepage:"https://github.com/beeblastco/broods#readme",bugs:{url:"https://github.com/beeblastco/broods/issues"},license:"MIT",repository:{type:"git",url:"git+https://github.com/beeblastco/broods.git",directory:"packages/broods"},bin:{broods:"dist/cli/index.js"},files:["dist","README.md","LICENSE.md"],type:"module",main:"./dist/index.js",types:"./dist/index.d.ts",typesVersions:{"*":{account:["./dist/account.d.ts"]}},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./account":{types:"./dist/account.d.ts",import:"./dist/account.js"}},scripts:{build:"bun scripts/build.ts && rollup -c rollup.dts.config.mjs && rm -rf .dts-temp",check:"tsc --noEmit","pack:check":"bun run build && publint && attw --pack .",test:"bun test"},dependencies:{"@modelcontextprotocol/client":"^2.0.0",esbuild:"^0.28.2"},devDependencies:{"@ai-sdk/tui":"1.0.108","@arethetypeswrong/cli":"^0.18.5","@chat-adapter/discord":"^4.38.1","@chat-adapter/github":"^4.38.1","@chat-adapter/slack":"^4.38.1","@chat-adapter/telegram":"^4.38.1","@modelcontextprotocol/server":"2.0.0","@types/bun":"^1.3.14","@typescript/typescript6":"6.0.2",ai:"^7.0.107",publint:"^0.3.23",rollup:"^4.62.4","rollup-plugin-dts":"^6.5.1",typescript:"^7.0.2",zod:"^4.4.3"},peerDependencies:{ai:"^7.0.107"},engines:{node:">=22.15"}};var gt=`---
+cliAuth Convex functions or no active API account (Settings -> API Access).`)),n)});try{return await Promise.race([e,o])}finally{if(t)clearTimeout(t)}}import{existsSync as pt}from"node:fs";import{mkdir as Dr,readFile as _r,writeFile as Tr}from"node:fs/promises";import{dirname as bt,join as dn,resolve as Ur,sep as de}from"node:path";import{fileURLToPath as Lr}from"node:url";var un=dn(bt(O),"update-check.json"),Nr=86400000,Mr="https://registry.npmjs.org/broods/latest",Br=2000;function gn(e,n){let t=ht(e),o=ht(n);for(let r=0;r<3;r+=1){let s=t[r]??0,i=o[r]??0;if(s!==i)return s>i}return!mt(e)&&mt(n)}async function fn(e={}){let n=await Fr(),t=e.maxAgeMs??Nr;if(n&&Date.now()-n.checkedAt<t)return n.latest;let o=await Gr();if(o===null)return n?.latest??null;return await Kr({checkedAt:Date.now(),latest:o}),o}function wt(e=Ur(process.cwd()),n=Lr(import.meta.url)){let t=`${de}node_modules${de}`,o=n.lastIndexOf(t),r=o===-1?null:n.slice(0,o),s=r===null?n.startsWith(`${e}${de}`):e===r||e.startsWith(`${r}${de}`),a=n.includes(`${de}.bun${de}install${de}global${de}`)||s&&Wr(r??e)?"bun":"npm",l=a==="bun"?"add":"install";return{manager:a,global:!s,command:a,args:s?[l,"broods@latest"]:[l,"-g","broods@latest"]}}async function Gr(){try{let e=await fetch(Mr,{signal:AbortSignal.timeout(Br),headers:{accept:"application/json"}});if(!e.ok)return null;let n=await e.json();return typeof n.version==="string"?n.version:null}catch{return null}}function Wr(e){return pt(dn(e,"bun.lock"))||pt(dn(e,"bun.lockb"))}function mt(e){return e.includes("-")}async function Fr(){try{let e=JSON.parse(await _r(un,"utf8"));if(typeof e.latest!=="string")return null;if(typeof e.checkedAt!=="number")return null;return{checkedAt:e.checkedAt,latest:e.latest}}catch{return null}}function ht(e){let[n]=e.trim().replace(/^v/,"").split("-");return(n??"").split(".").slice(0,3).map((t)=>Number.parseInt(t,10)||0)}async function Kr(e){try{await Dr(bt(un),{recursive:!0}),await Tr(un,`${JSON.stringify(e)}
+`,"utf8")}catch{}}var yt={name:"broods",version:"0.40.1",description:"CLI + TypeScript SDK for the broods agent platform.",keywords:["agents","ai","broods","cli","sdk"],homepage:"https://github.com/beeblastco/broods#readme",bugs:{url:"https://github.com/beeblastco/broods/issues"},license:"MIT",repository:{type:"git",url:"git+https://github.com/beeblastco/broods.git",directory:"packages/broods"},bin:{broods:"dist/cli/index.js"},files:["dist","README.md","LICENSE.md"],type:"module",main:"./dist/index.js",types:"./dist/index.d.ts",typesVersions:{"*":{account:["./dist/account.d.ts"]}},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./account":{types:"./dist/account.d.ts",import:"./dist/account.js"}},scripts:{build:"bun scripts/build.ts && rollup -c rollup.dts.config.mjs && rm -rf .dts-temp",check:"tsc --noEmit","pack:check":"bun run build && publint && attw --pack .",test:"bun test"},dependencies:{"@modelcontextprotocol/client":"^2.0.0",esbuild:"^0.28.2"},devDependencies:{"@ai-sdk/tui":"1.0.108","@arethetypeswrong/cli":"^0.18.5","@chat-adapter/discord":"^4.38.1","@chat-adapter/github":"^4.38.1","@chat-adapter/slack":"^4.38.1","@chat-adapter/telegram":"^4.38.1","@modelcontextprotocol/server":"2.0.0","@types/bun":"^1.3.14","@typescript/typescript6":"6.0.2",ai:"^7.0.107",publint:"^0.3.23",rollup:"^4.62.4","rollup-plugin-dts":"^6.5.1",typescript:"^7.0.2",zod:"^4.4.3"},peerDependencies:{ai:"^7.0.107"},engines:{node:">=22.15"}};var vt=`---
 name: broods
 description: Work on a broods account alongside a developer from Claude Code or a development agent. Covers onboarding and sign-in, creating a broods project, defining and deploying agents and their resources with the CLI, and integrating a deployed agent into existing code with the SDK. Use when asked to set up broods, create or work on a broods project, create or manage agents or any account resource, or call a deployed agent from application code.
 ---
@@ -92,7 +92,7 @@ The \`broods\` CLI does the interaction: sign-in, project sync, env, logs, runni
 
 \`broods dev\` on first run does everything: scaffolds \`broods/\` with a starter agent, runs the browser login if needed, pushes model keys from \`.env.local\` to the cloud env store, syncs to the \`development\` stage, then watches for changes and tails logs. \`broods init\` and \`broods login\` exist standalone when you want the steps separate.
 
-A project is the \`broods/\` directory. \`broods/index.ts\` exports resources built with the \`define*\` functions: \`defineAgent\`, \`defineSandbox\`, \`defineWorkspace\`, \`defineSkill\`, \`defineCron\`, \`defineMcp\`, \`definePolicy\`, and the channel helpers. An optional \`export default defineBroods({...})\` sets project defaults like project name and stage mapping. The full reference is \`resources.md\` in the docs; the starter agent in \`broods/index.ts\` shows the minimum shape.
+A project is the \`broods/\` directory. \`broods/index.ts\` exports resources built with the \`define*\` functions: \`defineAgent\`, \`defineSandbox\`, \`defineWorkspace\`, \`defineSkill\`, \`defineCron\`, \`defineMcp\`, \`definePolicy\`, and the channel helpers. An optional \`export default defineBroods({...})\` sets project defaults like project name and stage mapping. The full reference is https://docs.broods.app/reference/configuration; the starter agent in \`broods/index.ts\` shows the minimum shape.
 
 To create an agent, add a \`defineAgent\` to the project and sync. Talk to it with \`broods run <agent> "prompt"\`. Day to day: \`broods dev\` watches, \`broods diff\` previews, \`broods deploy\` syncs the production stage. Always \`diff\` before the first \`deploy\` on a stage you did not create.
 
@@ -108,11 +108,11 @@ const client = new BroodsClient();
 const result = await client.run(api.agents.myAgent, { input: "..." });
 \`\`\`
 
-\`client.stream(...)\` and \`client.runAsync(...)\` cover streaming and async runs. \`_generated/\` is empty until a sync has run at least once. The \`sdk.md\` docs page has the full client, including account operations through \`BroodsAccountClient\`.
+\`client.stream(...)\` and \`client.runAsync(...)\` cover streaming and async runs. \`_generated/\` is empty until a sync has run at least once. https://docs.broods.app/reference/sdk has the full client, including account operations through \`BroodsAccountClient\`.
 
 ## When the CLI has no command
 
-Crons, skills, sandboxes, policies, roles, channels, and hooks have no CLI verb. Prefer changing them in the project definition and syncing. For one-off reads and operations a manifest cannot say, use the MCP server. \`claude mcp add broods -- broods mcp\` adds it, and its tool names mirror the SDK: \`list-agents\`, \`create-cron\`, \`update-agent\`, and so on. For scoped automation credentials, read \`roles.md\` in the docs.
+Crons, skills, sandboxes, policies, roles, channels, and hooks have no CLI verb. Prefer changing them in the project definition and syncing. For one-off reads and operations a manifest cannot say, use the MCP server. \`claude mcp add broods -- broods mcp\` adds it, and its tool names mirror the SDK: \`list-agents\`, \`create-cron\`, \`update-agent\`, and so on. For scoped automation credentials, read the roles section of https://docs.broods.app/guides/security.
 
 ## Rules that keep you out of trouble
 
@@ -121,7 +121,7 @@ Crons, skills, sandboxes, policies, roles, channels, and hooks have no CLI verb.
 - Env values are write-only. Reference them from configs as \`\${NAME}\`. If the user pastes a secret at you, put it in the env store and use the ref.
 - Deletes are confirmed, named, and singular. Never loop a delete over a list.
 - Editing a manifest-declared resource outside the project drifts from the definition, and the next deploy silently reverts it.
-`;var ft=`#!/usr/bin/env bash
+`;var kt=`#!/usr/bin/env bash
 # Onboard this machine onto broods: check the CLI, check auth, and run the
 # browser login when needed. Login is a human step, so run this where the
 # user can see the browser open and finish it themselves.
@@ -156,51 +156,23 @@ elif [ "$STATUS" -ne 0 ]; then
   # Not the expected signed-out state: surface the real failure.
   exit "$STATUS"
 fi
-`;var ae=ut.version,Ne=Oe(".agents","skills","broods"),Z="https://dashboard.broods.app",$e="eu-west-1",Hr=[{region:"eu-west-1",label:"eu-west-1 (Ireland)"},{region:"us-east-1",label:"us-east-1 (US East)"},{region:"ap-southeast-1",label:"ap-southeast-1 (Singapore)"}],L=`Global options:
+`;var ue=yt.version,Fe=Pe(".agents","skills","broods"),Z="https://dashboard.broods.app",rs=60000,xe="eu-west-1",ss=[{region:"eu-west-1",label:"eu-west-1 (Ireland)"},{region:"us-east-1",label:"us-east-1 (US East)"},{region:"ap-southeast-1",label:"ap-southeast-1 (Singapore)"}],N=`Global options:
   --project <name>      Project name override (default: package name or folder)
   --stage <name>        Target stage override (BROODS_STAGE otherwise)
   --base-url <url>      broods API base URL for sync/env calls (default: discovered at login)
   --dashboard-url <url> Dashboard base URL for login and deep links (default: ${Z})
-  -h, --help            Show this help`,ln=`broods v${ae}
-
-Usage: broods <command> [subcommand] [options]
-
-Project:
-  init                 Create a broods/ project shell
-  project              List the org's projects, or delete one
-  dev                  Watch + sync the current stage and live-tail agent logs
-  diff                 Show local desired state vs remote state
-  deploy               Sync Production once and write BROODS_API_KEY to .env.local
-
-Account:
-  login                Authenticate through the dashboard
-  whoami               Show the login, server, org, plan, project and stage in use
-  org                  List, switch or create organizations
-  stage                List, switch or create stages
-  env                  Store, reveal, list, remove or sync encrypted environment variables
-
-Runtime:
-  agent                Inspect the agents declared in the current scope
-  run <agent> [prompt] Chat with an agent in a terminal UI
-  logs                 Backfill recent logs then live-tail
-  stream               Stream live logs for the whole project/stage (Ctrl+C to stop)
-  machine <sandbox>    Make this computer the sandbox behind a "machine" record
-
-CLI:
-  mcp                  Serve the account config plane to an agent over MCP (stdio)
-  update               Install the newest broods release over this one
-
-Options:
-  -h, --help           Show help for a command (e.g. \`broods org --help\`)
-  -v, --version        Print the CLI version
-
-Run \`broods <command> --help\` to see a command's subcommands and flags.`,mn={agent:`Usage: broods agent <list|get> [name]
+  -h, --help            Show this help`,is=`Commands
+  Develop   dev  diff  run  logs  stream
+  Ship      deploy  env  stage
+  Inspect   agent  whoami
+  Account   login  org  project
+  Tools     init  machine  mcp  update`,pn={stream:"stdout"},It={color:!1},as=new Set(["agent","deploy","dev","diff","env","logs","machine","run","stage","stream"]),Dt={agent:`Usage: broods agent <list|get> [name]
 
 Subcommands:
   list                 List the agents in the current project/stage scope
   get <name>           Show an agent's model, sandboxes, workspaces, tools and channels
 
-${L}`,deploy:`Usage: broods deploy [options]
+${N}`,deploy:`Usage: broods deploy [options]
 
 Syncs Production once and writes BROODS_API_KEY to .env.local. Ignores
 BROODS_STAGE by design. Pass --stage to deploy anywhere else.
@@ -208,9 +180,8 @@ BROODS_STAGE by design. Pass --stage to deploy anywhere else.
 Options:
   --prune               Allow deploy to delete undeclared remote resources
   --rotate-key          Mint a fresh runtime API key and write it to .env.local
-  --region <region>     Broods service region preference (default: ${$e})
 
-${L}`,dev:`Usage: broods dev [--once] [options]
+${N}`,dev:`Usage: broods dev [--once] [options]
 
 Watches broods/, syncs the current stage (BROODS_STAGE, default Development)
 and live-tails agent logs. Confirms before deleting, and auto-pushes
@@ -220,13 +191,14 @@ Options:
   --once                Sync a single time and exit (no watch, no log stream)
   --level <lvl>         Minimum level for the log tail DEBUG|INFO|WARN|ERROR (default: WARN)
   --all                 Tail INFO and up (DEBUG is dashboard-only)
+  --region <region>     Service region for a new project (default: ${xe})
 
-${L}`,diff:`Usage: broods diff [options]
+${N}`,diff:`Usage: broods diff [options]
 
 Shows local desired state against the remote state of the current stage, and
 warns when the stage's value for an env("NAME") ref no longer matches .env.local.
 
-${L}`,env:`Usage: broods env <set|get|list|rm|sync> [name]
+${N}`,env:`Usage: broods env <set|get|list|rm|sync> [name]
 
 Subcommands:
   set <name>           Store an encrypted environment variable (value read from the prompt or stdin)
@@ -242,23 +214,23 @@ Subcommands:
 those the stage does not already hold the local value for. \`dev\` runs the same
 push on every sync; \`deploy\` never does, so Production stays explicit.
 
-${L}`,init:`Usage: broods init [options]
+${N}`,init:`Usage: broods init [options]
 
 Creates the broods/ project shell and .env.local defaults.
 
 Options:
-  --region <region>     Broods service region preference (default: ${$e})
+  --region <region>     Broods service region preference (default: ${xe})
   --force               Overwrite existing starter files
 
-${L}`,login:`Usage: broods login [options]
+${N}`,login:`Usage: broods login [options]
 
 Authenticates through the dashboard and stores the token in
 ~/.broods/config.json.
 
 Options:
-  --region <region>     Broods service region preference (default: ${$e})
+  --region <region>     Broods service region preference (default: ${xe})
 
-${L}`,logs:`Usage: broods logs [options]
+${N}`,logs:`Usage: broods logs [options]
 
 Backfills recent logs then live-tails. Warnings and errors, 100 lines by default.
 
@@ -271,7 +243,7 @@ Options:
                         is the last segment of the instance's log stream
                         (dashboard Instances sheet).
 
-${L}`,machine:`Usage: broods machine <sandbox> [options]
+${N}`,machine:`Usage: broods machine <sandbox> [options]
 
 Connects this computer to a sandbox record whose provider is "machine". Agents
 on that sandbox run their bash tool here, as you, with your PATH and
@@ -285,7 +257,8 @@ With --mcp <file>, the stdio MCP servers in that file run here for MCP rows
 whose sandbox is this record. The file has the .mcp.json shape Claude Code and
 Cursor read, and it never leaves this computer.
 
-Authenticates with BROODS_API_KEY from .env.local, like \`broods logs\`.
+Authenticates with your \`broods login\`, like \`broods logs\`, and needs a
+deployed stage. The stage runtime key cannot open the machine socket.
 
 Options:
   --cwd <dir>           Working directory for commands (default: current directory)
@@ -294,7 +267,7 @@ Options:
   --force               Take the record over from another daemon, even one on this computer
   --doctor [--request]  Check the macOS permissions computer use needs; --request prompts for them
 
-${L}`,org:`Usage: broods org <list|use|create> [name]
+${N}`,org:`Usage: broods org <list|use|create> [name]
 
 Subcommands:
   list                 List the organizations this login can act on
@@ -303,13 +276,13 @@ Subcommands:
 
 Only orgs where you are owner or admin can be selected from the CLI.
 
-${L}`,run:`Usage: broods run <agent> [prompt]
+${N}`,run:`Usage: broods run <agent> [prompt]
 
 Chats with an agent in a terminal UI (reasoning, tool cards, y/n approvals).
 A prompt is sent as the first turn; redirected output streams plain text and
 therefore requires a prompt.
 
-${L}`,project:`Usage: broods project <list|delete> [name]
+${N}`,project:`Usage: broods project <list|delete> [name]
 
 Subcommands:
   list                 List the org's projects and what each one still holds
@@ -322,7 +295,7 @@ admin role. There is no undo.
 Options:
   --yes                 Skip the confirmation prompt
 
-${L}`,stage:`Usage: broods stage <list|use|create> [name]
+${N}`,stage:`Usage: broods stage <list|use|create> [name]
 
 Subcommands:
   list                 List the project's stages
@@ -333,7 +306,7 @@ Options:
   --from <stage>        Clone the source stage's architecture and env vars
   --use                 Switch to the stage \`stage create\` just made
 
-${L}`,stream:`Usage: broods stream [options]
+${N}`,stream:`Usage: broods stream [options]
 
 Streams live logs for the whole project/stage until Ctrl+C. No backfill.
 
@@ -341,7 +314,7 @@ Options:
   --level <lvl>         Minimum log level DEBUG|INFO|WARN|ERROR (default: WARN)
   --all                 Stream INFO and up (DEBUG is dashboard-only)
 
-${L}`,mcp:`Usage: broods mcp
+${N}`,mcp:`Usage: broods mcp
 
 Serves the account config plane to a development agent over MCP on stdio, so
 Claude Code and friends drive broods through typed tools instead of curl. It
@@ -367,45 +340,53 @@ place; inside a project the dependency is upgraded instead.`,whoami:`Usage: broo
 
 Shows the login, server, org, plan, project and stage the next command uses.
 
-${L}`};async function zr(){let[,,e,...n]=process.argv;switch(e){case void 0:case"--help":case"-h":console.log(ln);return;case"--version":case"-v":console.log(ae);return}Ls(e,n);let t=mn[e];if(t&&(I(n,"--help")||I(n,"-h"))){console.log(t);return}switch(e){case"init":await Yr(n);return;case"login":await Vr(n);return;case"whoami":await qr(n);return;case"org":await Xr(n);return;case"project":await Qr(n);return;case"stage":await es(n);return;case"diff":await ns(n);return;case"deploy":await ts(n);return;case"dev":await rs(n);return;case"env":await Os(n);return;case"stream":await As(n);return;case"logs":await Ps(n);return;case"machine":await xs(n);return;case"agent":await Is(n);return;case"run":await Ts(n);return;case"mcp":await Ns();return;case"update":await os();return;default:throw Error(`Unknown command: ${e}
+${N}`};async function cs(){let[,,e,...n]=process.argv;switch(e){case void 0:case"--help":case"-h":console.log(mn(n,pn));return;case"--version":case"-v":console.log(ue);return}if(ei(e,n),Dt[e]&&(L(n,"--help")||L(n,"-h"))){console.log(he(e,n));return}switch(e){case"init":await ds(n);return;case"login":await us(n);return;case"whoami":await fs(n);return;case"org":await ms(n);return;case"project":await hs(n);return;case"stage":await bs(n);return;case"diff":await ws(n);return;case"deploy":await ys(n);return;case"dev":await ks(n);return;case"env":await Ws(n);return;case"stream":await Hs(n);return;case"logs":await Ys(n);return;case"machine":await zs(n);return;case"agent":await Js(n);return;case"run":await Xs(n);return;case"mcp":await ni();return;case"update":await vs();return;default:throw Error(`Unknown command: ${e}
+
+${mn(n,It)}`)}}function ee(e){return Dt[e]??mn([],It)}function _t(e){let n=m(),t=y(e,"--base-url")??n.baseUrl,o=z(t),r=f(t??o?.baseUrl??E);return{loggedIn:o!==null,org:o?.org?.name,project:y(e,"--project")??n.project,projectGuess:Se(process.cwd()),server:r.replace(/^https?:\/\//,""),stage:y(e,"--stage")??n.stage??"development"}}function ls(e){if(!e.loggedIn)return[["broods login","sign in through the dashboard"]];if(!e.project)return[["broods dev","create a project and sync on save"]];return[["broods dev","sync on save, tail logs"],["broods run <agent>","chat with an agent"]]}function he(e,n){let t=ee(e);if(!as.has(e))return t;let o=_t(n),r=o.project??o.projectGuess;if(e!=="deploy"||y(n,"--stage")!==void 0)return`${an(r,o.stage,pn)}
+
+${t}`;let s=b(),i=s&&s!=="production"?`ignores stage ${s}`:void 0;return`${an(r,"production",{...pn,note:i})}
 
-${ln}`)}}function B(e){return mn[e]??ln}async function Yr(e){let n=I(e,"--force"),t=A(process.cwd(),S);await pn(A(t,b),{recursive:!0}),await Be(A(t,"index.ts"),Tt(),n),await Be(A(t,".gitignore"),`_generated
+${t}`}function mn(e,n){let t=_t(e);return[`broods v${ue}`,"",...st(t,n),"","Next",...it(ls(t),n),"",is,"","Usage: broods <command> [options]    -h, --help    -v, --version","Run `broods <command> --help` for a command's flags."].join(`
+`)}async function ds(e){let n=L(e,"--force"),t=x(process.cwd(),S);await vn(x(t,_),{recursive:!0}),await Ke(x(t,"index.ts"),Vt(),n),await Ke(x(t,".gitignore"),`_generated
 .cache
-`,n),await Rt(n);let o=y(e,"--dashboard-url")??Z;await kn({dashboardUrl:o,baseUrl:q(o),project:y(e,"--project")??Ce(process.cwd()),stage:y(e,"--stage")??"development",region:y(e,"--region")??$e,force:n}),await vn(),console.log(`Created ${S}/`)}async function Vr(e){let n=h(),t=y(e,"--dashboard-url")??n.dashboardUrl??Z,o=await on(t);await kn({dashboardUrl:o.dashboardUrl??t,baseUrl:o.baseUrl,project:y(e,"--project"),stage:y(e,"--stage"),region:y(e,"--region"),force:!1});let r=o.user?.email||o.user?.name||o.user?.authId,s=o.org?`${o.org.name} (${o.org.slug})`:void 0,i=o.account?.username;if(console.log(`Logged in to ${o.dashboardUrl}`),r)console.log(`User: ${r}`);if(s)console.log(`Org: ${s}`);if(i)console.log(`Account: ${i}`);let a=y(e,"--project")??process.env.BROODS_PROJECT;if(!a)return;let c=y(e,"--stage")??_()??"development";await Jr(o.baseUrl,o.token,a,c)}async function Jr(e,n,t,o){try{let s=await new U({baseUrl:e,token:n}).getRuntimeKey(t,o);if(s?.apiKey)await he("BROODS_API_KEY",s.apiKey),console.log(`Wrote BROODS_API_KEY (${s.keyHint}) to .env.local`)}catch{}}async function qr(e){let n=h(),t=Ge(e),o=y(e,"--dashboard-url")??n.dashboardUrl??Z,r=Boolean(y(e,"--project")??n.project);console.log(`broods v${ae}`),console.log(`Dashboard:   ${o}`),console.log(`Project:     ${r?t.project:`none (${t.project} from folder name)`}`),console.log(`Stage:       ${t.stage}`);let s;try{s=await F(y(e,"--base-url"))}catch(l){P(l instanceof Error?l.message:String(l));return}console.log(`Server:      ${s.baseUrl}`);let i=new U({baseUrl:s.baseUrl,token:s.token}),a=await i.getOnboarding(),c=a.orgs.find((l)=>l.id===a.currentOrgId);if(a.user)console.log(`User:        ${a.user.email}`);if(console.log(`Org:         ${c?Re(c):a.currentOrgId}`),a.account)console.log(`Account:     ${a.account.username} (${a.account.status})`);if(!r){P("No project set. `broods dev` picks one.");return}await Zr(i,t,c?.name);let d=a.projects.map((l)=>l.name);if(!d.includes(t.project))P(`This org has no project named ${t.project}. It has: ${d.length>0?d.join(", "):"none"}.`)}async function Zr(e,n,t){let o=process.env.BROODS_API_KEY,r=O("BROODS_API_KEY")?"your shell":".env.local",s=null,i=null;try{s=await e.getRuntimeKey(n.project,n.stage)}catch(a){i=a instanceof Error?a.message:String(a)}if(i)console.log("Runtime key: unavailable"),P(`⚠ Could not read the runtime key: ${i}`);else if(!s?.apiKey)console.log("Runtime key: none for this scope"),P(`${n.project}/${n.stage} does not exist in ${t??"this org"} yet. \`broods dev\` will create it.`);else if(!o)console.log(`Runtime key: ${s.keyHint} (not in .env.local)`),P("BROODS_API_KEY is not set locally. Run `broods dev`.");else if(o===s.apiKey)console.log(`Runtime key: ${s.keyHint} (matches this org and stage)`);else console.log(`Runtime key: ${s.keyHint} expected`),P(`⚠ BROODS_API_KEY from ${r} belongs to a different org or stage. Run \`broods stage use ${n.stage}\` to repoint it.`)}async function Xr(e){let[n,t]=se(e);if(!n){console.log(B("org"));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown org subcommand: ${n}
+`,n),await Lt(n);let o=y(e,"--dashboard-url")??Z;await On({dashboardUrl:o,baseUrl:D(o),project:y(e,"--project")??Se(process.cwd()),stage:y(e,"--stage")??"development",region:y(e,"--region")??xe,force:n}),await En(),M(`Created ${S}/`)}async function us(e){let n=m(),t=y(e,"--dashboard-url")??n.dashboardUrl??Z,o=await ln(t);await On({dashboardUrl:o.dashboardUrl??t,baseUrl:o.baseUrl,project:y(e,"--project"),stage:y(e,"--stage"),region:y(e,"--region"),force:!1});let r=o.user?.email||o.user?.name||o.user?.authId,s=o.org?`${o.org.name} (${o.org.slug})`:void 0,i=o.account?.username;if(M(`Logged in to ${o.dashboardUrl}`),r)console.log(`User: ${r}`);if(s)console.log(`Org: ${s}`);if(i)console.log(`Account: ${i}`);let a=y(e,"--project")??process.env.BROODS_PROJECT;if(!a)return;let l=y(e,"--stage")??b()??"development";await gs(o.baseUrl,o.token,a,l)}async function gs(e,n,t,o){try{let s=await new T({baseUrl:e,token:n}).getRuntimeKey(t,o);if(s?.apiKey)await ke("BROODS_API_KEY",s.apiKey),M(`Wrote BROODS_API_KEY (${s.keyHint}) to .env.local`)}catch{}}async function fs(e){let n=m(),t=ze(e),o=y(e,"--dashboard-url")??n.dashboardUrl??Z,r=Boolean(y(e,"--project")??n.project);console.log(`broods v${ue}`),console.log(`Dashboard:   ${o}`),console.log(`Project:     ${r?t.project:`none (${t.project} from folder name)`}`),console.log(`Stage:       ${t.stage}`);let s;try{s=await J(y(e,"--base-url"))}catch(c){P(c instanceof Error?c.message:String(c));return}console.log(`Server:      ${s.baseUrl}`);let i=new T({baseUrl:s.baseUrl,token:s.token}),a=await i.getOnboarding(),l=a.orgs.find((c)=>c.id===a.currentOrgId);if(a.user)console.log(`User:        ${a.user.email}`);if(console.log(`Org:         ${l?Ie(l):a.currentOrgId}`),a.account)console.log(`Account:     ${a.account.username} (${a.account.status})`);if(!r){P("No project set. `broods dev` picks one.");return}await ps(i,t,l?.name);let d=a.projects.map((c)=>c.name);if(!d.includes(t.project))P(`This org has no project named ${t.project}. It has: ${d.length>0?d.join(", "):"none"}.`)}async function ps(e,n,t){let o=process.env.BROODS_API_KEY,r=A("BROODS_API_KEY")?"your shell":".env.local",s=null,i=null;try{s=await e.getRuntimeKey(n.project,n.stage)}catch(a){i=a instanceof Error?a.message:String(a)}if(i)console.log("Runtime key: unavailable"),P(`Could not read the runtime key: ${i}`);else if(!s?.apiKey)console.log("Runtime key: none for this scope"),P(`${n.project}/${n.stage} does not exist in ${t??"this org"} yet. \`broods dev\` will create it.`);else if(!o)console.log(`Runtime key: ${s.keyHint} (not in .env.local)`),P("BROODS_API_KEY is not set locally. Run `broods dev`.");else if(o===s.apiKey)console.log(`Runtime key: ${s.keyHint} (matches this org and stage)`);else console.log(`Runtime key: ${s.keyHint} expected`),P(`BROODS_API_KEY from ${r} belongs to a different org or stage. Run \`broods stage use ${n.stage}\` to repoint it.`)}async function ms(e){let[n,t]=le(e);if(!n){console.log(he("org",e));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown org subcommand: ${n}
 
-${B("org")}`);let i=h(),a=y(e,"--dashboard-url")??i.dashboardUrl??Z,c=await Ke(a,y(e,"--base-url")),d=new U({baseUrl:c.baseUrl,token:c.token}),l=await d.getOnboarding();if(o){for(let p of l.orgs){let m=p.accountStatus==="active"?"":` [${p.accountStatus} account]`;console.log(fe(`${Re(p)}${m}`,p.id===l.currentOrgId))}console.log(`
-Only orgs where you are owner or admin can be selected from the CLI.`);return}if(r){let p=l.orgs.filter((v)=>v.accountStatus==="active"),m=t?p.find((v)=>v.slug===t||v.name===t||v.id===t):await Se("Select organization",p,Re,p.findIndex((v)=>v.id===l.currentOrgId));if(!m)throw Error(`No selectable organization matches "${t}". Run \`broods org list\`.`);await bt(d,c,await d.selectOnboardingOrg(m.id),e);return}let u=t??await le("Organization name",Ce(process.cwd()));if(!u.trim())throw Error("Organization name is required.");await bt(d,c,await d.createOnboardingOrg(u),e)}async function Qr(e){let[n,t]=se(e);if(!n){console.log(B("project"));return}let o=n==="list"||n==="ls";if(!o&&!(n==="delete"||n==="rm"))throw Error(`Unknown project subcommand: ${n}
+${ee("org")}`);let i=m(),a=y(e,"--dashboard-url")??i.dashboardUrl??Z,l=await De(a,y(e,"--base-url")),d=new T({baseUrl:l.baseUrl,token:l.token}),c=await d.getOnboarding();if(o){for(let u of c.orgs){let h=u.accountStatus==="active"?"":` [${u.accountStatus} account]`;console.log(ve(`${Ie(u)}${h}`,u.id===c.currentOrgId))}console.log(`
+Only orgs where you are owner or admin can be selected from the CLI.`);return}if(r){let u=c.orgs.filter((v)=>v.accountStatus==="active"),h=t?u.find((v)=>v.slug===t||v.name===t||v.id===t):await Ae("Select organization",u,Ie,u.findIndex((v)=>v.id===c.currentOrgId));if(!h)throw Error(`No selectable organization matches "${t}". Run \`broods org list\`.`);await Ot(d,l,await d.selectOnboardingOrg(h.id),e);return}let p=t??await me("Organization name",Se(process.cwd()));if(!p.trim())throw Error("Organization name is required.");await Ot(d,l,await d.createOnboardingOrg(p),e)}async function hs(e){let[n,t]=le(e);if(!n){console.log(he("project",e));return}let o=n==="list"||n==="ls";if(!o&&!(n==="delete"||n==="rm"))throw Error(`Unknown project subcommand: ${n}
 
-${B("project")}`);let s=h(),i=y(e,"--dashboard-url")??s.dashboardUrl??Z,a=Ge(e),c=await Ke(i,y(e,"--base-url")),d=new U({baseUrl:c.baseUrl,token:c.token});if(o){let v=await d.listProjects();if(v.length===0){console.log("This org has no projects yet. `broods dev` creates one.");return}console.log("Projects:");for(let R of v)console.log(gs(R,a.project));let k=v.filter((R)=>R.empty);if(k.length>0)console.log(`
-${k.length} empty project(s). Delete one with \`broods project delete <name>\`.`);return}let l=t??await le("Project to delete","");if(!l.trim())throw Error("Project name is required.");let u=await d.listProjects(),p=u.find((v)=>v.name===l||v.slug===l);if(!p)throw Error(`No project named "${l}". Existing: ${u.map((v)=>v.name).join(", ")}.`);if(!I(e,"--yes")){if(console.log(`Deleting ${p.name} removes ${gn(p)}.`),!await Le(`Permanently delete project ${p.name}?`)){console.log("Left it alone. Pass --yes to skip this prompt.");return}}let m=await d.deleteProject(p.id);if(!m)throw Error(`Project ${p.name} was not found.`);if(console.log(`Deleted project ${m.name} (${gn(m)})`),m.name===a.project||m.slug===a.project)console.log("That was the project this directory points at. Update BROODS_PROJECT in .env.local.")}async function es(e){let[n,t]=se(e);if(!n){console.log(B("stage"));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown stage subcommand: ${n}
+${ee("project")}`);let s=m(),i=y(e,"--dashboard-url")??s.dashboardUrl??Z,a=ze(e),l=await De(i,y(e,"--base-url")),d=new T({baseUrl:l.baseUrl,token:l.token});if(o){let v=await d.listProjects();if(v.length===0){console.log("This org has no projects yet. `broods dev` creates one.");return}console.log("Projects:");for(let R of v)console.log(xs(R,a.project));let k=v.filter((R)=>R.empty);if(k.length>0)console.log(`
+${k.length} empty project(s). Delete one with \`broods project delete <name>\`.`);return}let c=t??await me("Project to delete","");if(!c.trim())throw Error("Project name is required.");let p=await d.listProjects(),u=p.find((v)=>v.name===c||v.slug===c);if(!u)throw Error(`No project named "${c}". Existing: ${p.map((v)=>v.name).join(", ")}.`);if(!L(e,"--yes")){if(console.log(`Deleting ${u.name} removes ${wn(u)}.`),!await We(`Permanently delete project ${u.name}?`)){console.log("Left it alone. Pass --yes to skip this prompt.");return}}let h=await d.deleteProject(u.id);if(!h)throw Error(`Project ${u.name} was not found.`);if(M(`Deleted project ${h.name} (${wn(h)})`),h.name===a.project||h.slug===a.project)console.log("That was the project this directory points at. Update BROODS_PROJECT in .env.local.")}async function bs(e){let[n,t]=le(e);if(!n){console.log(he("stage",e));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown stage subcommand: ${n}
 
-${B("stage")}`);let i=h(),a=y(e,"--dashboard-url")??i.dashboardUrl??Z,c=Ge(e),d=await Ke(a,y(e,"--base-url")),l=new U({baseUrl:d.baseUrl,token:d.token});if(o){let k=await l.listStages(c.project);if(k.length===0){console.log(`${c.project} has no stages yet. \`broods dev\` creates Development.`);return}console.log(`Stages for ${c.project}:`);for(let R of k)console.log(fs(R,c.stage));return}if(r){let k=await l.listStages(c.project),R=t?k.find((M)=>fn(M.name,t)):await Se("Select stage",k,Ct,k.findIndex((M)=>fn(M.name,c.stage)));if(!R)throw Error(`${c.project} has no stage "${t}". Existing: ${k.map((M)=>M.name).join(", ")}. Create it with \`broods stage create ${t} --from ${c.stage}\`.`);let X=O("BROODS_STAGE");await he("BROODS_STAGE",R.name),console.log(`Stage: ${R.name} (wrote BROODS_STAGE)`),un("BROODS_STAGE",X),await dn(l,{project:c.project,stage:R.name});return}let u=t??await le("Stage name","staging");if(!u.trim())throw Error("Stage name is required.");let p=y(e,"--from"),m=await l.createStage(c.project,u,p);if(console.log(`Created stage ${m.stage.name} in ${c.project}${m.clonedFrom?` from ${m.clonedFrom}`:""}`),m.clonedFrom)console.log(`  ${m.stage.agentCount} agent(s), ${m.stage.variableCount} env var(s) copied`);if(!I(e,"--use")){console.log(`Switch to it with \`broods stage use ${m.stage.name}\`.`);return}let v=O("BROODS_STAGE");await he("BROODS_STAGE",m.stage.name),console.log(`Stage: ${m.stage.name} (wrote BROODS_STAGE)`),un("BROODS_STAGE",v),await dn(l,{project:c.project,stage:m.stage.name})}async function ns(e){let{manifest:n,config:t}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),o=await F(y(e,"--base-url")??t.baseUrl),r=new U({baseUrl:o.baseUrl,token:o.token}),s=await r.getManifest(n.project,n.stage);Ue(nn(n,s?.manifest??null)),ys(await hn(r,n),`${n.project}/${n.stage}`)}async function ts(e){let{manifest:n,config:t,resourceAliases:o,channels:r}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"deploy",useRuntimeStage:!1}),s=await F(y(e,"--base-url")??t.baseUrl),a=await new U({baseUrl:s.baseUrl,token:s.token}).putManifest(n,I(e,"--prune"),I(e,"--rotate-key"));await Ie(n,a.ids,process.cwd(),o,a.deployment,r),await Dt(),await vn(),console.log(`Synced ${a.manifest.resources.length} resources to ${n.project}/${n.stage}`),await Et(a.deployment),At(r,a),Ot(a)}async function Et(e){if(!e)return;if(e.apiKey){await he("BROODS_API_KEY",e.apiKey),console.log(`Wrote BROODS_API_KEY (${e.keyHint}) to .env.local`);return}}function Ot(e){let n=e.warnings?.missingPolicies??[];if(n.length>0)P(`⚠ ${n.length} policy ref(s) in agent config match no policy resource in this deploy. One that is not an existing policy id refuses every action at runtime: ${n.join(", ")}`)}async function os(){let e=await cn({maxAgeMs:0});if(e===null)throw Error("Could not reach the npm registry to check for a newer broods.");if(!an(e,ae)){console.log(`broods v${ae} is already the newest release.`);return}let n=dt();console.log(`Updating broods ${ae} → ${e} ${n.global?"globally":"in this project"}`),console.log(`$ ${[n.command,...n.args].join(" ")}`),await new Promise((t,o)=>{let r=$t(n.command,n.args,{stdio:"inherit"});r.on("error",o),r.on("exit",(s)=>{if(s===0){t();return}o(Error(`${n.command} exited with code ${s??"unknown"}`))})}),console.log(`broods ${e} installed.`)}async function mt(){let e=await cn();if(e===null||!an(e,ae))return;P(`broods ${e} is out, you are on ${ae}. Run \`broods update\`.`)}async function rs(e){if(await is(e),I(e,"--once")){if(!process.env.BROODS_SUPPRESS_DEV_TARGET)await yt(e),await mt();let l=pt.now();await ws(e),ot(pt.now()-l);return}let n=Oe(Wr(),`broods-declined-${process.pid}.txt`),t={...process.env,BROODS_DECLINED_FILE:n,BROODS_SUPPRESS_DEV_TARGET:"1",BROODS_RELOAD_ENV:"1"};await yt(e),await mt(),await wt(e,t);let o,r=!1,s=!1,i=await vt(),a=()=>{if(r){s=!0;return}r=!0,vt().then(async(l)=>{if(l===i)return;i=l,await wt(e,t)}).catch((l)=>console.error(l instanceof Error?l.message:String(l))).finally(()=>{if(r=!1,s)s=!1,a()})},c=Gr(A(process.cwd(),S),{recursive:!0},(l,u)=>{if(!u||Us(u))return;clearTimeout(o),o=setTimeout(a,150)}),d=new AbortController;ss(e,d.signal),process.on("SIGINT",()=>{d.abort(),c.close(),process.exit(0)})}async function ss(e,n){let t;try{t=We()}catch{console.log("· live logs off. No runtime key for this stage yet. Run `broods dev --once` after login to create or reconnect it.");return}let o,r;try{({project:o,stage:r}=await wn(e,t))}catch{return}let s=bn(e);try{for await(let i of Te({baseUrl:t.baseUrl,apiKey:t.apiKey,project:o,stage:r},{backfill:0,minLevel:s,signal:n}))console.log(yn(i))}catch(i){if(!n.aborted)console.error(`live logs: ${i instanceof Error?i.message:String(i)}`)}}async function is(e){await cs(),await Rt(!1),await ls(e)}async function Rt(e){let n=process.cwd();if(!(await Promise.all([".agent",".agents",".claude","AGENTS.md","CLAUDE.md"].map((c)=>ht(A(n,c))))).includes(!0))return;let r=A(n,Ne);if(!e&&await ht(A(r,"SKILL.md")))return;let s=Oe(Ne,"SKILL.md"),i=Oe(Ne,"scripts","onboard.sh");for(let c of[s,i])if(await as(n,c)){P(`Skipped the agent skill: ${c} crosses a symlink.`);return}await pn(A(r,"scripts"),{recursive:!0}),await J(A(r,"SKILL.md"),gt);let a=A(r,"scripts","onboard.sh");await J(a,ft),await Tr(a,493),console.log(`Installed the broods agent skill at ${Ne}/`)}async function as(e,n){let t=e;for(let o of n.split(Kr)){t=A(t,o);try{if((await Ur(t)).isSymbolicLink())return!0}catch{return!1}}return!1}async function ht(e){try{return await Nr(e),!0}catch{return!1}}async function cs(){let e=A(process.cwd(),S);await pn(A(e,b),{recursive:!0});let n=[];if(await Sn(e,n),n.length>0)return;await Be(A(e,"index.ts"),Tt(),!1),await Be(A(e,".gitignore"),`_generated
+${ee("stage")}`);let i=m(),a=y(e,"--dashboard-url")??i.dashboardUrl??Z,l=ze(e),d=await De(a,y(e,"--base-url")),c=new T({baseUrl:d.baseUrl,token:d.token});if(o){let k=await c.listStages(l.project);if(k.length===0){console.log(`${l.project} has no stages yet. \`broods dev\` creates Development.`);return}console.log(`Stages for ${l.project}:`);for(let R of k)console.log(js(R,l.stage));return}if(r){let k=await c.listStages(l.project),R=t?k.find((B)=>yn(B.name,t)):await Ae("Select stage",k,Nt,k.findIndex((B)=>yn(B.name,l.stage)));if(!R)throw Error(`${l.project} has no stage "${t}". Existing: ${k.map((B)=>B.name).join(", ")}. Create it with \`broods stage create ${t} --from ${l.stage}\`.`);let ne=A("BROODS_STAGE");await ke("BROODS_STAGE",R.name),console.log(`Stage: ${R.name} (wrote BROODS_STAGE)`),bn("BROODS_STAGE",ne),await hn(c,{project:l.project,stage:R.name});return}let p=t??await me("Stage name","staging");if(!p.trim())throw Error("Stage name is required.");let u=y(e,"--from"),h=await c.createStage(l.project,p,u);if(M(`Created stage ${h.stage.name} in ${l.project}${h.clonedFrom?` from ${h.clonedFrom}`:""}`),h.clonedFrom)console.log(`  ${h.stage.agentCount} agent(s), ${h.stage.variableCount} env var(s) copied`);if(!L(e,"--use")){console.log(`Switch to it with \`broods stage use ${h.stage.name}\`.`);return}let v=A("BROODS_STAGE");await ke("BROODS_STAGE",h.stage.name),console.log(`Stage: ${h.stage.name} (wrote BROODS_STAGE)`),bn("BROODS_STAGE",v),await hn(c,{project:l.project,stage:h.stage.name})}async function ws(e){let{manifest:n,config:t}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),o=await J(y(e,"--base-url")??t.baseUrl),r=new T({baseUrl:o.baseUrl,token:o.token}),s=await r.getManifest(n.project,n.stage);Ge(sn(n,s?.manifest??null)),Us(await kn(r,n),`${n.project}/${n.stage}`)}async function ys(e){let{manifest:n,config:t,resourceAliases:o,channels:r}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"deploy",useRuntimeStage:!1}),s=await J(y(e,"--base-url")??t.baseUrl),a=await new T({baseUrl:s.baseUrl,token:s.token}).putManifest(n,L(e,"--prune"),L(e,"--rotate-key"));await Ne(n,a.ids,process.cwd(),o,a.deployment,r),await Ht(),await En(),M(`Synced ${a.manifest.resources.length} resources to ${n.project}/${n.stage}`),await Tt(a.deployment),Mt(r,a),Ut(a)}async function Tt(e){if(!e)return;if(e.apiKey){await ke("BROODS_API_KEY",e.apiKey),M(`Wrote BROODS_API_KEY (${e.keyHint}) to .env.local`);return}}function Ut(e){let n=e.warnings?.missingPolicies??[];if(n.length>0)P(`${n.length} policy ref(s) in agent config match no policy resource in this deploy. One that is not an existing policy id refuses every action at runtime: ${n.join(", ")}`)}async function vs(){let e=await fn({maxAgeMs:0});if(e===null)throw Error("Could not reach the npm registry to check for a newer broods.");if(!gn(e,ue)){console.log(`broods v${ue} is already the newest release.`);return}let n=wt();console.log(`Updating broods ${ue} → ${e} ${n.global?"globally":"in this project"}`),console.log(`$ ${[n.command,...n.args].join(" ")}`),await new Promise((t,o)=>{let r=Pt(n.command,n.args,{stdio:"inherit"});r.on("error",o),r.on("exit",(s)=>{if(s===0){t();return}o(Error(`${n.command} exited with code ${s??"unknown"}`))})}),console.log(`broods ${e} installed.`)}async function $t(){let e=await fn();if(e===null||!gn(e,ue))return;P(`broods ${e} is out, you are on ${ue}. Run \`broods update\`.`)}async function ks(e){if(await $s(e),L(e,"--once")){if(!process.env.BROODS_SUPPRESS_DEV_TARGET)await Ct(e),await $t();let c=St.now();await Ts(e),lt(St.now()-c);return}let n=Pe(ts(),`broods-declined-${process.pid}.txt`),t={...process.env,BROODS_DECLINED_FILE:n,BROODS_SUPPRESS_DEV_TARGET:"1",BROODS_RELOAD_ENV:"1"};await Ct(e),await $t(),await Rt(e,t);let o,r=!1,s=!1,i=await At(),a=()=>{if(r){s=!0;return}r=!0,At().then(async(c)=>{if(c===i)return;i=c,await Rt(e,t)}).catch((c)=>console.error(c instanceof Error?c.message:String(c))).finally(()=>{if(r=!1,s)s=!1,a()})},l=ns(x(process.cwd(),S),{recursive:!0},(c,p)=>{if(!p||Qs(p))return;clearTimeout(o),o=setTimeout(a,150)}),d=new AbortController;Ss(e,d.signal),process.on("SIGINT",()=>{d.abort(),l.close(),process.exit(0)})}async function Ss(e,n){let t;try{t=await Ve(e)}catch(r){console.log(`· live logs off. ${r instanceof Error?r.message:String(r)}`);return}let o=Sn(e);try{for await(let r of Me(t,{backfill:0,minLevel:o,signal:n}))console.log($n(r))}catch(r){if(!n.aborted)console.error(`live logs: ${r instanceof Error?r.message:String(r)}`)}}async function $s(e){await Os(),await Lt(!1),await Rs(e)}async function Lt(e){let n=process.cwd();if(!(await Promise.all([".agent",".agents",".claude","AGENTS.md","CLAUDE.md"].map((l)=>Et(x(n,l))))).includes(!0))return;let r=x(n,Fe);if(!e&&await Et(x(r,"SKILL.md")))return;let s=Pe(Fe,"SKILL.md"),i=Pe(Fe,"scripts","onboard.sh");for(let l of[s,i])if(await Es(n,l)){P(`Skipped the agent skill: ${l} crosses a symlink.`);return}await vn(x(r,"scripts"),{recursive:!0}),await ge(x(r,"SKILL.md"),vt);let a=x(r,"scripts","onboard.sh");await ge(a,kt),await Yr(a,493),M(`Installed the broods agent skill at ${Fe}/`)}async function Es(e,n){let t=e;for(let o of n.split(es)){t=x(t,o);try{if((await Jr(t)).isSymbolicLink())return!0}catch{return!1}}return!1}async function Et(e){try{return await Zr(e),!0}catch{return!1}}async function Os(){let e=x(process.cwd(),S);await vn(x(e,_),{recursive:!0});let n=[];if(await Rn(e,n),n.length>0)return;await Ke(x(e,"index.ts"),Vt(),!1),await Ke(x(e,".gitignore"),`_generated
 .cache
-`,!1),console.log(`Created starter ${S}/`)}async function ls(e){let n=A(process.cwd(),".env.local"),t=await be(n),o=_t(t),r=o.BROODS_STAGE;if(["BROODS_DASHBOARD_URL","BROODS_BASE_URL","BROODS_PROJECT","BROODS_REGION"].filter((v)=>o[v]===void 0).length===0&&r!==void 0)return;let i=o.BROODS_PROJECT===void 0,a=r===void 0,c=o.BROODS_REGION===void 0,d=h(),l=y(e,"--dashboard-url")??d.dashboardUrl??Z,u=y(e,"--project")??process.env.BROODS_PROJECT??Ce(process.cwd()),p=y(e,"--stage")??_()??"development",m=y(e,"--region")??process.env.BROODS_REGION??$e;if(process.stdin.isTTY&&i){let v=await Ke(l,y(e,"--base-url")),k=new U({baseUrl:v.baseUrl,token:v.token}),R=await ds(k,v),X=await ps(k,R);if(u=await bs(X,u),!u.trim())throw Error("Project name is required.")}if(process.stdin.isTTY&&a){if(p=await le("Stage",p),!p.trim())throw Error("Stage is required.")}if(process.stdin.isTTY&&c){let v=[...Hr];m=await Se("Select service region",v,(k)=>k.label,v.findIndex((k)=>k.region===m)).then((k)=>k.region)}await kn({dashboardUrl:l,baseUrl:d.baseUrl??q(l),project:u,stage:p,region:m,force:!1})}async function Ke(e,n){try{return await F(n)}catch(t){if(!process.stdin.isTTY)throw t;return P(`${t instanceof Error?t.message:String(t)} Starting browser login.`),await on(e)}}async function ds(e,n){try{return await e.getOnboarding()}catch(t){if(!n.org)throw t;return P("CLI onboarding endpoint is not available yet; using the org from the current login."),{currentOrgId:n.org.id,orgs:[{id:n.org.id,name:n.org.name,slug:n.org.slug,role:"admin",accountStatus:"active"}],projects:[]}}}async function bt(e,n,t,o){let r=t.orgs.find((s)=>s.id===t.currentOrgId);if(!r)throw Error("Selected organization is not visible to this login");if(process.env.BROODS_TOKEN)P("BROODS_TOKEN is set, so the switch applies to this token only and was not stored.");else await V({...n,org:{id:r.id,name:r.name,slug:r.slug},...t.account?{account:{id:t.account.id,username:t.account.username}}:{}});console.log(`Org: ${Re(r)}`),console.log(`Projects: ${t.projects.length>0?t.projects.map((s)=>s.name).join(", "):"none yet"}`),await dn(e,Ge(o))}async function dn(e,n){let t;try{t=await e.getRuntimeKey(n.project,n.stage)}catch(r){P(`⚠ Could not read the runtime key for ${n.project}/${n.stage} (${r instanceof Error?r.message:String(r)}). BROODS_API_KEY still points at the previous scope. Run \`broods whoami\` to check it.`);return}if(!t?.apiKey){P(`⚠ ${n.project}/${n.stage} is not synced here yet, so BROODS_API_KEY still points at the previous scope. Run \`broods dev\`.`);return}let o=O("BROODS_API_KEY");if(!o&&process.env.BROODS_API_KEY===t.apiKey)return;await he("BROODS_API_KEY",t.apiKey),console.log(`Wrote BROODS_API_KEY (${t.keyHint}) to .env.local`),un("BROODS_API_KEY",o)}function un(e,n){if(!n)return;P(`⚠ ${e} is exported in your shell, which wins over .env.local. Run \`unset ${e}\` or the next broods command keeps the old value.`)}function Re(e){let n=e.role==="owner"||e.role==="admin"?e.role:"member",t=e.plan?`, ${e.plan} plan`:"";return`${e.name} (${e.slug}, ${n}${t})`}function us(e){return e.slug===e.name?e.name:`${e.name} (${e.slug})`}function gn(e){return e.empty?"nothing (it is already empty)":`${e.stageCount} stage(s), ${e.agentCount} agent(s), ${e.variableCount} env var(s), ${e.deploymentCount} deployment(s), ${e.fileCount} workspace file(s)`}function gs(e,n){let t=e.empty?"empty":gn(e);return fe(`${e.name}: ${t}`,e.name===n||e.slug===n)}function fs(e,n){return fe(Ct(e),fn(e.name,n))}function Ct(e){let n=e.deploymentRegion?`, ${e.deploymentRegion}`:"";return`${e.name} (${e.kind}${n}): ${e.agentCount} agent(s), ${e.variableCount} env var(s)`}function fn(e,n){return e.trim().toLowerCase()===n.trim().toLowerCase()}function Ge(e){return h(),{project:y(e,"--project")??process.env.BROODS_PROJECT??Ce(process.cwd()),stage:y(e,"--stage")??_()??"development"}}async function ps(e,n){let t=n.orgs.filter((s)=>s.accountStatus==="active"),o={kind:"create",name:"New organization"},r=await Se("Select organization",[...t,o],(s)=>("kind"in s)?"Create new organization":Re(s),t.findIndex((s)=>s.id===n.currentOrgId));if("kind"in r){let s=await le("Organization name",Ce(process.cwd()));if(!s.trim())throw Error("Organization name is required.");return await e.createOnboardingOrg(s)}return r.id===n.currentOrgId?n:await e.selectOnboardingOrg(r.id)}function ms(e,n){return e.projects.find((o)=>o.name===n||o.slug===n)?.name??n}function hs(e,n){return e.projects.find((t)=>t.name===n||t.slug===n)}async function bs(e,n){let t=ms(e,n);if(e.projects.length===0)return le("Project name",t);while(!0){let o=await st("Select project",e.projects,us,{hint:"type a new project name",defaultValue:t}),r=typeof o==="string"?o:o.name,s=hs(e,r);if(!s)return r;if(await Le(`Continue with the existing project ${s.name}?`))return s.name}}function wt(e,n){return new Promise((t,o)=>{let r=process.argv[1]??"",s=$t(process.execPath,[r,"dev","--once",...e],{stdio:"inherit",env:n});s.on("error",o),s.on("exit",(i,a)=>{if(i===0){t();return}o(Error(a?`Sync child exited from signal ${a}`:`Sync child exited with code ${i??"unknown"}`))})})}async function ws(e){let{manifest:n,config:t,resourceAliases:o,channels:r}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),s=await F(y(e,"--base-url")??t.baseUrl),i=new U({baseUrl:s.baseUrl,token:s.token}),a=await i.getManifest(n.project,n.stage),c=nn(n,a?.manifest??null);Ue(c.filter((k)=>k.operation!=="delete"));let d=await xt(i,n,await hn(i,n));if(d.length>0)tn(d);let l=await i.putManifest(n,!1);await Ie(n,l.ids,process.cwd(),o,l.deployment,r),await Dt(),await vn();let u=await Ss(),p=c.filter((k)=>k.operation==="delete"),m=p.filter((k)=>!u.has(`${k.kind}:${k.name}`)),v=!1;if(m.length>0)if(P("⚠ These remote resources are no longer declared locally:"),Ue(m),await Le(`Delete ${m.length} resource(s) from ${n.project}/${n.stage}?`))l=await i.putManifest(n,!0),await Ie(n,l.ids,process.cwd(),o,l.deployment,r),await Es(),v=!0;else await $s(m.map((k)=>`${k.kind}:${k.name}`));if(!v&&p.length>0){let k=p.map((R)=>`${R.kind}:${R.name}`).join(", ");P(`⚠ ${p.length} undeclared resource(s) kept remotely: ${k}. Re-declare in code or run \`deploy --prune\` to remove.`)}return await Et(l.deployment),At(r,l),Ot(l),l}function At(e,n){let t=n.deployment;if(!t||e.length===0)return;let o=new D,r=new Map;for(let i of e){if(!n.ids.agents[i.agentName])continue;let a=r.get(i.type)??[];a.push(i.alias),r.set(i.type,a)}let s=t.stageKind===void 0||t.stageKind==="production";for(let[i,a]of r){let c=s?o.accountWebhookUrl(t.accountId,i):o.stageWebhookUrl(t.accountId,t.endpointId,i);console.log(`Channel ${a.join(", ")} (${i}): ${c}${i==="pancake"?"?secret=<PANCAKE_WEBHOOK_SECRET>":""}`)}}async function hn(e,n){let t=Wn(n).filter((r)=>!r.startsWith("BROODS_"));if(t.length===0)return[];let o=new Map((await e.listEnv(n.project,n.stage)).map((r)=>[r.name,r.valueDigest]));return t.map((r)=>({name:r,state:vs(r,o)}))}async function xt(e,n,t){let o=t.filter((r)=>r.state==="unset"||r.state==="drifted"||r.state==="unverified").map((r)=>r.name);if(o.length===0)return[];return await Promise.all(o.map((r)=>e.setEnv(n.project,n.stage,r,process.env[r]))),o}function ys(e,n){let t=Ee(e,"drifted"),o=Ee(e,"unverified");if(t.length>0)P(`⚠ .env.local and ${n} disagree on ${t.length} variable(s): ${t.join(", ")}. Run \`broods env sync\` to push the local values.`);if(o.length>0)P(`⚠ ${n} stored ${o.length} variable(s) before value digests, so nothing can compare them: ${o.join(", ")}. Run \`broods env sync\` to bring them in step.`)}function vs(e,n){let t=process.env[e],o=n.has(e);if(t===void 0||t==="")return o?"stage-only":"unresolved";if(!o)return"unset";let r=n.get(e);if(!r)return"unverified";return r===ks(t)?"synced":"drifted"}function ks(e){return St("sha256").update(e).digest("hex")}function Ee(e,n){return e.filter((t)=>t.state===n).map((t)=>t.name)}async function yt(e){let n=h(),{manifest:t,config:o}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),r=await F(y(e,"--base-url")??o.baseUrl);tt({project:t.project,stage:t.stage,dashboardUrl:y(e,"--dashboard-url")??n.dashboardUrl??r.dashboardUrl??o.dashboardUrl??Z})}async function Ss(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return new Set;let n=await be(e);return new Set(n.split(/\r?\n/).map((t)=>t.trim()).filter(Boolean))}async function $s(e){let n=process.env.BROODS_DECLINED_FILE;if(!n||e.length===0)return;await J(n,`${e.join(`
+`,!1),M(`Created starter ${S}/`)}async function Rs(e){let n=x(process.cwd(),".env.local"),t=await be(n),o=zt(t),r=o.BROODS_STAGE;if(["BROODS_DASHBOARD_URL","BROODS_BASE_URL","BROODS_PROJECT","BROODS_REGION"].filter((v)=>o[v]===void 0).length===0&&r!==void 0)return;let i=o.BROODS_PROJECT===void 0,a=r===void 0,l=o.BROODS_REGION===void 0,d=m(),c=y(e,"--dashboard-url")??d.dashboardUrl??Z,p=y(e,"--project")??process.env.BROODS_PROJECT??Se(process.cwd()),u=y(e,"--stage")??b()??"development",h=y(e,"--region")??process.env.BROODS_REGION??xe;if(process.stdin.isTTY&&i){let v=await De(c,y(e,"--base-url")),k=new T({baseUrl:v.baseUrl,token:v.token}),R=await Cs(k,v),ne=await Ps(k,R);if(p=await _s(ne,p),!p.trim())throw Error("Project name is required.")}if(process.stdin.isTTY&&a){if(u=await me("Stage",u),!u.trim())throw Error("Stage is required.")}if(process.stdin.isTTY&&l){let v=[...ss];h=await Ae("Select service region",v,(k)=>k.label,v.findIndex((k)=>k.region===h)).then((k)=>k.region)}await On({dashboardUrl:c,baseUrl:d.baseUrl??D(c),project:p,stage:u,region:h,force:!1})}async function De(e,n){try{return await J(n)}catch(t){if(!process.stdin.isTTY)throw t;return P(`${t instanceof Error?t.message:String(t)} Starting browser login.`),await ln(e)}}async function Cs(e,n){try{return await e.getOnboarding()}catch(t){if(!n.org)throw t;return P("CLI onboarding endpoint is not available yet; using the org from the current login."),{currentOrgId:n.org.id,orgs:[{id:n.org.id,name:n.org.name,slug:n.org.slug,role:"admin",accountStatus:"active"}],projects:[]}}}async function Ot(e,n,t,o){let r=t.orgs.find((s)=>s.id===t.currentOrgId);if(!r)throw Error("Selected organization is not visible to this login");if(process.env.BROODS_TOKEN)P("BROODS_TOKEN is set, so the switch applies to this token only and was not stored.");else await G({...n,org:{id:r.id,name:r.name,slug:r.slug},...t.account?{account:{id:t.account.id,username:t.account.username}}:{}});console.log(`Org: ${Ie(r)}`),console.log(`Projects: ${t.projects.length>0?t.projects.map((s)=>s.name).join(", "):"none yet"}`),await hn(e,ze(o))}async function hn(e,n){let t;try{t=await e.getRuntimeKey(n.project,n.stage)}catch(r){P(`Could not read the runtime key for ${n.project}/${n.stage} (${r instanceof Error?r.message:String(r)}). BROODS_API_KEY still points at the previous scope. Run \`broods whoami\` to check it.`);return}if(!t?.apiKey){P(`${n.project}/${n.stage} is not synced here yet, so BROODS_API_KEY still points at the previous scope. Run \`broods dev\`.`);return}let o=A("BROODS_API_KEY");if(!o&&process.env.BROODS_API_KEY===t.apiKey)return;await ke("BROODS_API_KEY",t.apiKey),M(`Wrote BROODS_API_KEY (${t.keyHint}) to .env.local`),bn("BROODS_API_KEY",o)}function bn(e,n){if(!n)return;P(`${e} is exported in your shell, which wins over .env.local. Run \`unset ${e}\` or the next broods command keeps the old value.`)}function Ie(e){let n=e.role==="owner"||e.role==="admin"?e.role:"member",t=e.plan?`, ${e.plan} plan`:"";return`${e.name} (${e.slug}, ${n}${t})`}function As(e){return e.slug===e.name?e.name:`${e.name} (${e.slug})`}function wn(e){return e.empty?"nothing (it is already empty)":`${e.stageCount} stage(s), ${e.agentCount} agent(s), ${e.variableCount} env var(s), ${e.deploymentCount} deployment(s), ${e.fileCount} workspace file(s)`}function xs(e,n){let t=e.empty?"empty":wn(e);return ve(`${e.name}: ${t}`,e.name===n||e.slug===n)}function js(e,n){return ve(Nt(e),yn(e.name,n))}function Nt(e){let n=e.deploymentRegion?`, ${e.deploymentRegion}`:"";return`${e.name} (${e.kind}${n}): ${e.agentCount} agent(s), ${e.variableCount} env var(s)`}function yn(e,n){return e.trim().toLowerCase()===n.trim().toLowerCase()}function ze(e){return m(),{project:y(e,"--project")??process.env.BROODS_PROJECT??Se(process.cwd()),stage:y(e,"--stage")??b()??"development"}}async function Ps(e,n){let t=n.orgs.filter((s)=>s.accountStatus==="active"),o={kind:"create",name:"New organization"},r=await Ae("Select organization",[...t,o],(s)=>("kind"in s)?"Create new organization":Ie(s),t.findIndex((s)=>s.id===n.currentOrgId));if("kind"in r){let s=await me("Organization name",Se(process.cwd()));if(!s.trim())throw Error("Organization name is required.");return await e.createOnboardingOrg(s)}return r.id===n.currentOrgId?n:await e.selectOnboardingOrg(r.id)}function Is(e,n){return e.projects.find((o)=>o.name===n||o.slug===n)?.name??n}function Ds(e,n){return e.projects.find((t)=>t.name===n||t.slug===n)}async function _s(e,n){let t=Is(e,n);if(e.projects.length===0)return me("Project name",t);while(!0){let o=await ft("Select project",e.projects,As,{hint:"type a new project name",defaultValue:t}),r=typeof o==="string"?o:o.name,s=Ds(e,r);if(!s)return r;if(await We(`Continue with the existing project ${s.name}?`))return s.name}}function Rt(e,n){return new Promise((t,o)=>{let r=process.argv[1]??"",s=Pt(process.execPath,[r,"dev","--once",...e],{stdio:"inherit",env:n});s.on("error",o),s.on("exit",(i,a)=>{if(i===0){t();return}o(Error(a?`Sync child exited from signal ${a}`:`Sync child exited with code ${i??"unknown"}`))})})}async function Ts(e){let{manifest:n,config:t,resourceAliases:o,channels:r}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),s=await J(y(e,"--base-url")??t.baseUrl),i=new T({baseUrl:s.baseUrl,token:s.token}),a=await i.getManifest(n.project,n.stage),l=sn(n,a?.manifest??null);Ge(l.filter((k)=>k.operation!=="delete"));let d=await Bt(i,n,await kn(i,n));if(d.length>0)cn(d);let c=await i.putManifest(n,!1);await Ne(n,c.ids,process.cwd(),o,c.deployment,r),await Ht(),await En();let p=await Ms(),u=l.filter((k)=>k.operation==="delete"),h=u.filter((k)=>!p.has(`${k.kind}:${k.name}`)),v=!1;if(h.length>0)if(P("These remote resources are no longer declared locally:"),Ge(h),await We(`Delete ${h.length} resource(s) from ${n.project}/${n.stage}?`))c=await i.putManifest(n,!0),await Ne(n,c.ids,process.cwd(),o,c.deployment,r),await Gs(),v=!0;else await Bs(h.map((k)=>`${k.kind}:${k.name}`));if(!v&&u.length>0){let k=u.map((R)=>`${R.kind}:${R.name}`).join(", ");P(`${u.length} undeclared resource(s) kept remotely: ${k}. Re-declare in code or run \`deploy --prune\` to remove.`)}return await Tt(c.deployment),Mt(r,c),Ut(c),c}function Mt(e,n){let t=n.deployment;if(!t||e.length===0)return;let o=new U,r=new Map;for(let i of e){if(!n.ids.agents[i.agentName])continue;let a=r.get(i.type)??[];a.push(i.alias),r.set(i.type,a)}let s=t.stageKind===void 0||t.stageKind==="production";for(let[i,a]of r){let l=s?o.accountWebhookUrl(t.accountId,i):o.stageWebhookUrl(t.accountId,t.endpointId,i);console.log(`Channel ${a.join(", ")} (${i}): ${l}${i==="pancake"?"?secret=<PANCAKE_WEBHOOK_SECRET>":""}`)}}async function kn(e,n){let t=Vn(n).filter((r)=>!r.startsWith("BROODS_"));if(t.length===0)return[];let o=new Map((await e.listEnv(n.project,n.stage)).map((r)=>[r.name,r.valueDigest]));return t.map((r)=>({name:r,state:Ls(r,o)}))}async function Bt(e,n,t){let o=t.filter((r)=>r.state==="unset"||r.state==="drifted"||r.state==="unverified").map((r)=>r.name);if(o.length===0)return[];return await Promise.all(o.map((r)=>e.setEnv(n.project,n.stage,r,process.env[r]))),o}function Us(e,n){let t=je(e,"drifted"),o=je(e,"unverified");if(t.length>0)P(`.env.local and ${n} disagree on ${t.length} variable(s): ${t.join(", ")}. Run \`broods env sync\` to push the local values.`);if(o.length>0)P(`${n} stored ${o.length} variable(s) before value digests, so nothing can compare them: ${o.join(", ")}. Run \`broods env sync\` to bring them in step.`)}function Ls(e,n){let t=process.env[e],o=n.has(e);if(t===void 0||t==="")return o?"stage-only":"unresolved";if(!o)return"unset";let r=n.get(e);if(!r)return"unverified";return r===Ns(t)?"synced":"drifted"}function Ns(e){return jt("sha256").update(e).digest("hex")}function je(e,n){return e.filter((t)=>t.state===n).map((t)=>t.name)}async function Ct(e){let n=m(),{manifest:t,config:o}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),r=await J(y(e,"--base-url")??o.baseUrl);at({project:t.project,stage:t.stage,dashboardUrl:y(e,"--dashboard-url")??n.dashboardUrl??r.dashboardUrl??o.dashboardUrl??Z})}async function Ms(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return new Set;let n=await be(e);return new Set(n.split(/\r?\n/).map((t)=>t.trim()).filter(Boolean))}async function Bs(e){let n=process.env.BROODS_DECLINED_FILE;if(!n||e.length===0)return;await ge(n,`${e.join(`
 `)}
-`,{flag:"a"})}async function Es(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return;await J(e,"","utf8")}async function Os(e){let[n,t]=se(e);if(!n){console.log(B("env"));return}let o=n==="list"||n==="ls",r=n==="rm"||n==="remove",s=n==="get",i=n==="sync",a=n==="set"||r||s;if(!o&&!i&&!a)throw Error(`Unknown env subcommand: ${n}
+`,{flag:"a"})}async function Gs(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return;await ge(e,"","utf8")}async function Ws(e){let[n,t]=le(e);if(!n){console.log(he("env",e));return}let o=n==="list"||n==="ls",r=n==="rm"||n==="remove",s=n==="get",i=n==="sync",a=n==="set"||r||s;if(!o&&!i&&!a)throw Error(`Unknown env subcommand: ${n}
 
-${B("env")}`);if(a&&!t)throw Error(`broods env ${n} needs a variable name.
+${ee("env")}`);if(a&&!t)throw Error(`broods env ${n} needs a variable name.
 
-${B("env")}`);let{manifest:c,config:d}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),l=await F(y(e,"--base-url")??d.baseUrl),u=new U({baseUrl:l.baseUrl,token:l.token}),p=`${c.project}/${c.stage}`;if(i){await Rs(u,c,p);return}if(o){let v=await u.listEnv(c.project,c.stage);if(v.length===0){console.log(`No environment variables set for ${p}.`);return}console.log(`Environment variables for ${p} (values hidden):`);for(let k of v)console.log(`  ${k.name}`);return}if(s){let v=await u.getEnv(c.project,c.stage,t);if(v===null){console.error(`${t} is not set for ${p}`),process.exitCode=1;return}console.log(v);return}if(r){await u.removeEnv(c.project,c.stage,t),console.log(`Removed ${t} from ${p}`);return}let m=await rt(t);await u.setEnv(c.project,c.stage,t,m),console.log(`Stored ${t} for ${p}`)}async function Rs(e,n,t){let o=await hn(e,n);if(o.length===0){console.log('No env("NAME") references in this project.');return}let r=await xt(e,n,o);if(r.length>0)tn(r);let s=Ee(o,"synced").length;console.log(r.length>0?`${s} other referenced variable(s) already in step with ${t}.`:`${s} referenced variable(s) already in step with ${t}.`);let i=Ee(o,"stage-only");if(i.length>0)console.log(`${i.length} referenced variable(s) live only on ${t}: ${i.join(", ")}`);let a=Ee(o,"unresolved");if(a.length>0)P(`⚠ ${a.length} referenced variable(s) with no value here or on ${t}: ${a.join(", ")}. Put them in .env.local, or run \`broods env set <NAME>\`.`)}function We(){h();let e=process.env.BROODS_API_KEY??"";if(!e)throw Error("BROODS_API_KEY is not set. Run `broods deploy` first, or set the key in .env.local.");let n=process.env.BROODS_BASE_URL??process.env.BROODS_HOST??C;return{apiKey:e,baseUrl:n}}function bn(e){if(I(e,"--all"))return"DEBUG";let n=y(e,"--level");if(n===void 0&&I(e,"--level"))throw Error("Missing value for --level. Use DEBUG, INFO, WARN, or ERROR.");if(!n)return"WARN";let t=n.toUpperCase();if(t==="DEBUG")return"DEBUG";if(t==="INFO")return"INFO";if(t==="WARN"||t==="WARNING")return"WARN";if(t==="ERROR")return"ERROR";throw Error(`Unknown log level: ${n}. Use DEBUG, INFO, WARN, or ERROR.`)}async function Cs(e){h();let n=y(e,"--project")??process.env.BROODS_PROJECT,t=y(e,"--stage")??_();if(!n)throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT in .env.local.");if(!t)throw Error("Stage name is required. Pass --stage <name> or set BROODS_STAGE in .env.local.");return{project:n,stage:t}}async function wn(e,n){let t=await Cs(e),o=await nt(n.baseUrl,n.apiKey);if(!o)return t;if(o.projectSlug!==t.project||o.stageSlug!==t.stage)console.log(`· reading ${o.projectSlug}/${o.stageSlug}. The runtime key is scoped there, not to ${t.project}/${t.stage}.`);return{project:o.projectSlug,stage:o.stageSlug}}function jt(e){return e==="WARN"?" (--all for INFO too)":""}function yn(e){let n=new Date(e.ts).toISOString().slice(11,23),t=e.level.padEnd(5),o=Fr(e.message);return`${n} ${t} ${e.eventType} ${o}`}async function As(e){let{apiKey:n,baseUrl:t}=We(),{project:o,stage:r}=await wn(e,{baseUrl:t,apiKey:n}),s=bn(e),i=new AbortController,a=()=>i.abort();process.on("SIGINT",a),console.log(`Streaming live logs for ${o}/${r} [${s}+]`+jt(s)+", Ctrl+C to stop");try{for await(let c of Te({baseUrl:t,apiKey:n,project:o,stage:r},{backfill:0,minLevel:s,signal:i.signal}))console.log(yn(c))}catch(c){if(!i.signal.aborted)console.error(c instanceof Error?c.message:String(c)),process.exitCode=1}finally{process.off("SIGINT",a)}}async function xs(e){if(I(e,"--doctor")){await js(I(e,"--request"));return}let n=se(e)[0];if(!n){console.log(mn.machine),process.exitCode=1;return}let{runMachineDaemon:t}=await import("../chunk-mf5em3wq.js"),{apiKey:o,baseUrl:r}=We(),s=A(y(e,"--cwd")??process.cwd()),i=I(e,"--computer"),a=y(e,"--mcp"),c=I(e,"--force"),d=new AbortController,l=()=>d.abort();process.on("SIGINT",l),console.log(`Connecting ${n} to ${r} (cwd ${s}${i?", computer use on":""}), Ctrl+C to stop`);try{await t({apiKey:o,baseUrl:r,computer:i,cwd:s,force:c,log:(u)=>console.log(u),mcpFile:a?A(a):void 0,sandbox:n,signal:d.signal})}catch(u){console.error(u instanceof Error?u.message:String(u)),process.exitCode=1}finally{process.off("SIGINT",l)}}async function js(e){try{let{startDesktop:n}=await import("../chunk-5tnnqapc.js"),{display:t,driver:o,permissions:r}=await n(e);o.stop();let s=(i)=>i?"granted":"missing";if(console.log(`screenshot frame   ${t.width}x${t.height} (scale ${t.scale.toFixed(2)})`),console.log(`screen recording   ${s(r.screenRecording)}`),console.log(`accessibility      ${s(r.accessibility)}`),!r.screenRecording||!r.accessibility)console.log(e?"Approve the prompts, or add this terminal under System Settings > Privacy & Security, then run again.":"Run `broods machine --doctor --request` to show the macOS prompts."),process.exitCode=1}catch(n){console.error(n instanceof Error?n.message:String(n)),process.exitCode=1}}async function Ps(e){let{apiKey:n,baseUrl:t}=We(),{project:o,stage:r}=await wn(e,{baseUrl:t,apiKey:n}),s=y(e,"--sandbox");if(I(e,"--sandbox")&&!H(s))throw Error("--sandbox needs the instance log id, the UUID shown in the dashboard Instances sheet.");let i=s?"DEBUG":bn(e),a=Number(y(e,"--limit")??y(e,"-n")??100),c=I(e,"--json"),d=new AbortController,l=()=>d.abort();process.on("SIGINT",l),console.log(`Logs for ${o}/${r}`+(s?` sandbox ${s}`:"")+` [${i}+]`+jt(i)+` (backfill ${a}), Ctrl+C to stop`);try{for await(let u of Te({baseUrl:t,apiKey:n,project:o,stage:r},{backfill:a,minLevel:i,...s?{sandboxId:s}:{},signal:d.signal}))if(c)console.log(JSON.stringify(u));else console.log(yn(u))}catch(u){if(!d.signal.aborted)console.error(u instanceof Error?u.message:String(u)),process.exitCode=1}finally{process.off("SIGINT",l)}}async function Is(e){let[n,t]=se(e);if(!n){console.log(B("agent"));return}if(n==="list"||n==="ls"){await Ds(e);return}if(n==="get"){await _s(t,e);return}throw Error(`Unknown agent subcommand: ${n}
+${ee("env")}`);let{manifest:l,config:d}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),c=await J(y(e,"--base-url")??d.baseUrl),p=new T({baseUrl:c.baseUrl,token:c.token}),u=`${l.project}/${l.stage}`;if(i){await Fs(p,l,u);return}if(o){let v=await p.listEnv(l.project,l.stage);if(v.length===0){console.log(`No environment variables set for ${u}.`);return}console.log(`Environment variables for ${u} (values hidden):`);for(let k of v)console.log(`  ${k.name}`);return}if(s){let v=await p.getEnv(l.project,l.stage,t);if(v===null){console.error(`${t} is not set for ${u}`),process.exitCode=1;return}console.log(v);return}if(r){await p.removeEnv(l.project,l.stage,t),M(`Removed ${t} from ${u}`);return}let h=await gt(t);await p.setEnv(l.project,l.stage,t,h),M(`Stored ${t} for ${u}`)}async function Fs(e,n,t){let o=await kn(e,n);if(o.length===0){console.log('No env("NAME") references in this project.');return}let r=await Bt(e,n,o);if(r.length>0)cn(r);let s=je(o,"synced").length;console.log(r.length>0?`${s} other referenced variable(s) already in step with ${t}.`:`${s} referenced variable(s) already in step with ${t}.`);let i=je(o,"stage-only");if(i.length>0)console.log(`${i.length} referenced variable(s) live only on ${t}: ${i.join(", ")}`);let a=je(o,"unresolved");if(a.length>0)P(`${a.length} referenced variable(s) with no value here or on ${t}: ${a.join(", ")}. Put them in .env.local, or run \`broods env set <NAME>\`.`)}function Sn(e){if(L(e,"--all"))return"DEBUG";let n=y(e,"--level");if(n===void 0&&L(e,"--level"))throw Error("Missing value for --level. Use DEBUG, INFO, WARN, or ERROR.");if(!n)return"WARN";let t=n.toUpperCase();if(t==="DEBUG")return"DEBUG";if(t==="INFO")return"INFO";if(t==="WARN"||t==="WARNING")return"WARN";if(t==="ERROR")return"ERROR";throw Error(`Unknown log level: ${n}. Use DEBUG, INFO, WARN, or ERROR.`)}async function Ks(e){m();let n=y(e,"--project")??process.env.BROODS_PROJECT,t=y(e,"--stage")??b();if(!n)throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT in .env.local.");if(!t)throw Error("Stage name is required. Pass --stage <name> or set BROODS_STAGE in .env.local.");return{project:n,stage:t}}async function Ve(e){let n=await Ks(e),t=m(),o=await De(y(e,"--dashboard-url")??t.dashboardUrl??Z,y(e,"--base-url")),r=new T({baseUrl:o.baseUrl,token:o.token}),s=await r.mintStageSession(n.project,n.stage),i=async()=>{if(s.expiresAt-Date.now()<rs)s=await r.mintStageSession(n.project,n.stage);return s.token};return{baseUrl:process.env.BROODS_BASE_URL??process.env.BROODS_HOST??E,credential:i,project:s.projectSlug,stage:s.stageSlug}}function Gt(e){return e==="WARN"?" (--all for INFO too)":""}function $n(e){let n=new Date(e.ts).toISOString().slice(11,23),t=e.level.padEnd(5),o=os(e.message);return`${n} ${t} ${e.eventType} ${o}`}async function Hs(e){let n=await Ve(e),{project:t,stage:o}=n,r=Sn(e),s=new AbortController,i=()=>s.abort();process.on("SIGINT",i),console.log(`Streaming live logs for ${t}/${o} [${r}+]`+Gt(r)+", Ctrl+C to stop");try{for await(let a of Me(n,{backfill:0,minLevel:r,signal:s.signal}))console.log($n(a))}catch(a){if(!s.signal.aborted)console.error(a instanceof Error?a.message:String(a)),process.exitCode=1}finally{process.off("SIGINT",i)}}async function zs(e){if(L(e,"--doctor")){await Vs(L(e,"--request"));return}let n=le(e)[0];if(!n){console.log(he("machine",e));return}let{runMachineDaemon:t}=await import("../chunk-8bsz0vkr.js"),{baseUrl:o,credential:r}=await Ve(e),s=x(y(e,"--cwd")??process.cwd()),i=L(e,"--computer"),a=y(e,"--mcp"),l=L(e,"--force"),d=new AbortController,c=()=>d.abort();process.on("SIGINT",c),console.log(`Connecting ${n} to ${o} (cwd ${s}${i?", computer use on":""}), Ctrl+C to stop`);try{await t({baseUrl:o,computer:i,credential:r,cwd:s,force:l,log:(p)=>console.log(p),mcpFile:a?x(a):void 0,sandbox:n,signal:d.signal})}catch(p){console.error(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{process.off("SIGINT",c)}}async function Vs(e){try{let{startDesktop:n}=await import("../chunk-5tnnqapc.js"),{display:t,driver:o,permissions:r}=await n(e);o.stop();let s=(i)=>i?"granted":"missing";if(console.log(`screenshot frame   ${t.width}x${t.height} (scale ${t.scale.toFixed(2)})`),console.log(`screen recording   ${s(r.screenRecording)}`),console.log(`accessibility      ${s(r.accessibility)}`),!r.screenRecording||!r.accessibility)console.log(e?"Approve the prompts, or add this terminal under System Settings > Privacy & Security, then run again.":"Run `broods machine --doctor --request` to show the macOS prompts."),process.exitCode=1}catch(n){console.error(n instanceof Error?n.message:String(n)),process.exitCode=1}}async function Ys(e){let n=await Ve(e),{project:t,stage:o}=n,r=y(e,"--sandbox");if(L(e,"--sandbox")&&!W(r))throw Error("--sandbox needs the instance log id, the UUID shown in the dashboard Instances sheet.");let s=r?"DEBUG":Sn(e),i=Number(y(e,"--limit")??y(e,"-n")??100),a=L(e,"--json"),l=new AbortController,d=()=>l.abort();process.on("SIGINT",d),console.log(`Logs for ${t}/${o}`+(r?` sandbox ${r}`:"")+` [${s}+]`+Gt(s)+` (backfill ${i}), Ctrl+C to stop`);try{for await(let c of Me(n,{backfill:i,minLevel:s,...r?{sandboxId:r}:{},signal:l.signal}))if(a)console.log(JSON.stringify(c));else console.log($n(c))}catch(c){if(!l.signal.aborted)console.error(c instanceof Error?c.message:String(c)),process.exitCode=1}finally{process.off("SIGINT",d)}}async function Js(e){let[n,t]=le(e);if(!n){console.log(he("agent",e));return}if(n==="list"||n==="ls"){await qs(e);return}if(n==="get"){await Zs(t,e);return}throw Error(`Unknown agent subcommand: ${n}
 
-${B("agent")}`)}async function Pt(e){let{manifest:n,config:t}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),o=await F(y(e,"--base-url")??t.baseUrl),r=await new U({baseUrl:o.baseUrl,token:o.token}).getManifest(n.project,n.stage),s=n.resources.filter((i)=>i.kind==="agent").map((i)=>({name:i.name,config:i.config??{},agentId:r?.ids.agents[i.name]}));return{manifest:n,agents:s}}async function Ds(e){let{manifest:n,agents:t}=await Pt(e);if(t.length===0){console.log(`No agents declared in ${n.project}/${n.stage}.`);return}console.log(`Agents in ${n.project}/${n.stage}:`);for(let o of t){let r=It(o.config),s=o.config.publicAccess===!0?"public":"private",i=o.agentId?o.agentId:"not deployed";console.log(`  ${o.name}  [${s}]  ${r}  (${i})`)}}async function _s(e,n){if(!e)throw Error(`Missing agent name.
+${ee("agent")}`)}async function Wt(e){let{manifest:n,config:t}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),o=await J(y(e,"--base-url")??t.baseUrl),r=await new T({baseUrl:o.baseUrl,token:o.token}).getManifest(n.project,n.stage),s=n.resources.filter((i)=>i.kind==="agent").map((i)=>({name:i.name,config:i.config??{},agentId:r?.ids.agents[i.name]}));return{manifest:n,agents:s}}async function qs(e){let{manifest:n,agents:t}=await Wt(e);if(t.length===0){console.log(`No agents declared in ${n.project}/${n.stage}.`);return}console.log(`Agents in ${n.project}/${n.stage}:`);for(let o of t){let r=Ft(o.config),s=o.config.publicAccess===!0?"public":"private",i=o.agentId?o.agentId:"not deployed";console.log(`  ${o.name}  [${s}]  ${r}  (${i})`)}}async function Zs(e,n){if(!e)throw Error(`Missing agent name.
 
-${B("agent")}`);let{manifest:t,agents:o}=await Pt(n),r=o.find((p)=>p.name===e);if(!r)throw Error(`Unknown local agent: ${e}`);let s=r.config,i=[s.sandboxes].flat().filter((p)=>typeof p==="string").map((p,m)=>m===0?`${p} (default)`:p),a=Array.isArray(s.workspaces)?s.workspaces.map((p)=>typeof p==="string"?p:p.name).filter(Boolean):[],c=ce(s.tools)?Object.keys(s.tools):[],d=ce(s.channels)?Object.keys(s.channels):[],l=ce(s.subagent)&&Array.isArray(s.subagent.allowed)?s.subagent.allowed.map((p)=>typeof p==="string"?p:p.name).filter(Boolean):[],u=ce(s.hooks)&&Array.isArray(s.hooks.webhooks)?s.hooks.webhooks.filter(ce):[];if(console.log(`Agent: ${r.name}`),console.log(`  Project/Stage: ${t.project}/${t.stage}`),console.log(`  Deployed id:  ${r.agentId??"not deployed"}`),console.log(`  Public access: ${s.publicAccess===!0?"public (SSE/WebSocket enabled)":"private (secured by default)"}`),console.log(`  Model:        ${It(s)}`),console.log(`  Sandboxes:    ${i.length>0?i.join(", "):"none"}`),console.log(`  Workspaces:   ${a.length>0?a.join(", "):"none"}`),console.log(`  Tools:        ${c.length>0?c.join(", "):"none"}`),console.log(`  Subagents:    ${l.length>0?l.join(", "):"none"}`),console.log(`  Channels:     ${d.length>0?d.join(", "):"none"}`),u.length>0)console.log("  Webhooks:"),u.forEach((p,m)=>{let v=Array.isArray(p.events)&&p.events.length>0?p.events.join(", "):"all events",k=p.enabled===!1?"disabled":"enabled";console.log(`    [${m}] ${k} → ${p.url??"none"} (${v})`)})}function It(e){let n=ce(e.model)?e.model:{},t=typeof n.provider==="string"?n.provider:void 0,o=typeof n.modelId==="string"?n.modelId:void 0;if(t&&o)return`${t}/${o}`;return o??t??"unconfigured model"}async function Ts(e){let[n,...t]=se(e);if(!n)throw Error(`Missing agent name.
+${ee("agent")}`);let{manifest:t,agents:o}=await Wt(n),r=o.find((u)=>u.name===e);if(!r)throw Error(`Unknown local agent: ${e}`);let s=r.config,i=[s.sandboxes].flat().filter((u)=>typeof u==="string").map((u,h)=>h===0?`${u} (default)`:u),a=Array.isArray(s.workspaces)?s.workspaces.map((u)=>typeof u==="string"?u:u.name).filter(Boolean):[],l=pe(s.tools)?Object.keys(s.tools):[],d=pe(s.channels)?Object.keys(s.channels):[],c=pe(s.subagent)&&Array.isArray(s.subagent.allowed)?s.subagent.allowed.map((u)=>typeof u==="string"?u:u.name).filter(Boolean):[],p=pe(s.hooks)&&Array.isArray(s.hooks.webhooks)?s.hooks.webhooks.filter(pe):[];if(console.log(`Agent: ${r.name}`),console.log(`  Project/Stage: ${t.project}/${t.stage}`),console.log(`  Deployed id:  ${r.agentId??"not deployed"}`),console.log(`  Public access: ${s.publicAccess===!0?"public (SSE/WebSocket enabled)":"private (secured by default)"}`),console.log(`  Model:        ${Ft(s)}`),console.log(`  Sandboxes:    ${i.length>0?i.join(", "):"none"}`),console.log(`  Workspaces:   ${a.length>0?a.join(", "):"none"}`),console.log(`  Tools:        ${l.length>0?l.join(", "):"none"}`),console.log(`  Subagents:    ${c.length>0?c.join(", "):"none"}`),console.log(`  Channels:     ${d.length>0?d.join(", "):"none"}`),p.length>0)console.log("  Webhooks:"),p.forEach((u,h)=>{let v=Array.isArray(u.events)&&u.events.length>0?u.events.join(", "):"all events",k=u.enabled===!1?"disabled":"enabled";console.log(`    [${h}] ${k} → ${u.url??"none"} (${v})`)})}function Ft(e){let n=pe(e.model)?e.model:{},t=typeof n.provider==="string"?n.provider:void 0,o=typeof n.modelId==="string"?n.modelId:void 0;if(t&&o)return`${t}/${o}`;return o??t??"unconfigured model"}async function Xs(e){let[n,...t]=le(e);if(!n)throw Error(`Missing agent name.
 
-${B("run")}`);let o=t.join(" "),r=Boolean(process.stdin.isTTY&&process.stdout.isTTY);if(!r&&!o)throw Error("Usage: broods run <agent> <prompt>. Omit the prompt for an interactive session, which requires a TTY.");let{manifest:s,config:i}=await te({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),a=await F(y(e,"--base-url")??i.baseUrl),c=s.resources.find((R)=>R.kind==="agent"&&R.name===n);if(!c)throw Error(`Unknown local agent: ${n}`);let l=(await new U({baseUrl:a.baseUrl,token:a.token}).getManifest(s.project,s.stage))?.ids.agents[n];if(!l)throw Error(`Agent ${n} is not synced yet. Run broods dev --once or broods deploy first.`);let u=await new U({baseUrl:a.baseUrl,token:a.token}).getRuntimeKey(s.project,s.stage).catch(()=>null);if(u?.apiKey)await he("BROODS_API_KEY",u.apiKey);if(c.config.publicAccess!==!0)P(`⚠ Agent "${n}" does not set publicAccess: true. The public endpoint is secured by default; if the deployed agent has not enabled it, this run will be refused.`);let p=new D({baseUrl:y(e,"--base-url")??process.env.BROODS_BASE_URL??process.env.BROODS_HOST??a.baseUrl,...u?.apiKey?{apiKey:u.apiKey}:{}}),m={kind:"agent",name:n,id:l,project:s.project,stage:s.stage,...u?.endpointId?{endpointId:u.endpointId}:{},...u?.projectSlug?{projectSlug:u.projectSlug}:{},...u?.stageSlug?{stageSlug:u.stageSlug}:{}},{runAgentTui:v,streamAgentText:k}=await import("../chunk-f294wr3z.js");try{if(r){await v({client:p,agent:m,...o?{prompt:o}:{}});return}await k({client:p,agent:m,prompt:o})}catch(R){if((R instanceof Error?R.message:String(R)).includes("public_access_disabled"))throw Error(`Agent "${n}" is not publicly accessible (secured by default). Set publicAccess: true in its config and redeploy, or enable Public access in the dashboard.`);throw R}}async function Be(e,n,t){try{await J(e,n,{flag:t?"w":"wx"})}catch(o){if(o.code==="EEXIST")return;throw o}}async function Dt(){let e=A(process.cwd(),S,".gitignore"),n=await be(e),o=["_generated",".cache"].filter((s)=>!n.split(/\r?\n/).some((i)=>i.trim()===s));if(o.length===0)return;let r=n?n.trimEnd()+`
+${ee("run")}`);let o=t.join(" "),r=Boolean(process.stdin.isTTY&&process.stdout.isTTY);if(!r&&!o)throw Error("A prompt is required when output is redirected: broods run <agent> <prompt>. Run it in a terminal to chat without one.");let{manifest:s,config:i}=await re({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),a=await J(y(e,"--base-url")??i.baseUrl),l=s.resources.find((R)=>R.kind==="agent"&&R.name===n);if(!l)throw Error(`Unknown local agent: ${n}`);let c=(await new T({baseUrl:a.baseUrl,token:a.token}).getManifest(s.project,s.stage))?.ids.agents[n];if(!c)throw Error(`Agent ${n} is not synced yet. Run broods dev --once or broods deploy first.`);let p=await new T({baseUrl:a.baseUrl,token:a.token}).getRuntimeKey(s.project,s.stage).catch(()=>null);if(p?.apiKey)await ke("BROODS_API_KEY",p.apiKey);if(l.config.publicAccess!==!0)P(`Agent "${n}" does not set publicAccess: true. The public endpoint is secured by default; if the deployed agent has not enabled it, this run will be refused.`);let u=new U({baseUrl:y(e,"--base-url")??process.env.BROODS_BASE_URL??process.env.BROODS_HOST??a.baseUrl,...p?.apiKey?{apiKey:p.apiKey}:{}}),h={kind:"agent",name:n,id:c,project:s.project,stage:s.stage,...p?.endpointId?{endpointId:p.endpointId}:{},...p?.projectSlug?{projectSlug:p.projectSlug}:{},...p?.stageSlug?{stageSlug:p.stageSlug}:{}},{runAgentTui:v,streamAgentText:k}=await import("../chunk-f294wr3z.js");try{if(r){await v({client:u,agent:h,...o?{prompt:o}:{}});return}await k({client:u,agent:h,prompt:o})}catch(R){if((R instanceof Error?R.message:String(R)).includes("public_access_disabled"))throw Error(`Agent "${n}" is not publicly accessible (secured by default). Set publicAccess: true in its config and redeploy, or enable Public access in the dashboard.`);throw R}}async function Ke(e,n,t){try{await ge(e,n,{flag:t?"w":"wx"})}catch(o){if(o.code==="EEXIST")return;throw o}}async function Kt(){let e=x(process.cwd(),".gitignore"),n=await be(e);if(n.split(/\r?\n/).some((r)=>[".env.local","/.env.local",".env*.local",".env.*",".env*"].includes(r.trim())))return;let o=n?`${n.trimEnd()}
+.env*.local
+`:`.env*.local
+`;await ge(e,o,"utf8")}async function Ht(){let e=x(process.cwd(),S,".gitignore"),n=await be(e),o=["_generated",".cache"].filter((s)=>!n.split(/\r?\n/).some((i)=>i.trim()===s));if(o.length===0)return;let r=n?n.trimEnd()+`
 `+o.join(`
 `)+`
 `:o.join(`
 `)+`
-`;await J(e,r,"utf8")}async function vn(){let e=A(process.cwd(),"package.json"),n=await be(e);if(!n)return;let t;try{t=JSON.parse(n)}catch{return}if(t.type)return;t.type="module",await J(e,JSON.stringify(t,null,2)+`
-`,"utf8")}async function kn(e){let n=A(process.cwd(),".env.local"),t=await be(n),o=_t(t),r={BROODS_DASHBOARD_URL:e.dashboardUrl,BROODS_BASE_URL:e.baseUrl,BROODS_PROJECT:e.project,BROODS_STAGE:e.stage,BROODS_REGION:e.region},s=t?t.replace(/\n?$/,`
-`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],i=!1;for(let[c,d]of Object.entries(r)){if(!d)continue;if(o[c]!==void 0&&!e.force)continue;let l=s.findIndex((u)=>u.trim().startsWith(`${c}=`));if(l>=0)s[l]=`${c}=${Me(d)}`;else s.push(`${c}=${Me(d)}`);if(process.env[c]===void 0)process.env[c]=d;i=!0}if(!i&&t)return;let a=`${s.filter((c,d,l)=>!(c===""&&d===l.length-1)).join(`
+`;await ge(e,r,"utf8")}async function En(){let e=x(process.cwd(),"package.json"),n=await be(e);if(!n)return;let t;try{t=JSON.parse(n)}catch{return}if(t.type)return;t.type="module",await ge(e,JSON.stringify(t,null,2)+`
+`,"utf8")}async function On(e){let n=x(process.cwd(),".env.local"),t=await be(n),o=zt(t),r={BROODS_DASHBOARD_URL:e.dashboardUrl,BROODS_BASE_URL:e.baseUrl,BROODS_PROJECT:e.project,BROODS_STAGE:e.stage,BROODS_REGION:e.region},s=t?t.replace(/\n?$/,`
+`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],i=!1;for(let[l,d]of Object.entries(r)){if(!d)continue;if(o[l]!==void 0&&!e.force)continue;let c=s.findIndex((p)=>p.trim().startsWith(`${l}=`));if(c>=0)s[c]=`${l}=${He(d)}`;else s.push(`${l}=${He(d)}`);if(process.env[l]===void 0)process.env[l]=d;i=!0}if(!i&&t)return;let a=`${s.filter((l,d,c)=>!(l===""&&d===c.length-1)).join(`
 `)}
-`;await J(n,a,"utf8")}async function he(e,n){let t=A(process.cwd(),".env.local"),o=await be(t),r=o?o.replace(/\n?$/,`
-`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],s=r.findIndex((a)=>a.trim().startsWith(`${e}=`));if(s>=0)r[s]=`${e}=${Me(n)}`;else r.push(`${e}=${Me(n)}`);process.env[e]=n;let i=`${r.filter((a,c,d)=>!(a===""&&c===d.length-1)).join(`
+`;await K(n,a),await Kt()}async function ke(e,n){let t=x(process.cwd(),".env.local"),o=await be(t),r=o?o.replace(/\n?$/,`
+`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],s=r.findIndex((a)=>a.trim().startsWith(`${e}=`));if(s>=0)r[s]=`${e}=${He(n)}`;else r.push(`${e}=${He(n)}`);process.env[e]=n;let i=`${r.filter((a,l,d)=>!(a===""&&l===d.length-1)).join(`
 `)}
-`;await J(t,i,"utf8")}async function be(e){try{return await kt(e,"utf8")}catch(n){if(n.code==="ENOENT")return"";throw n}}function _t(e){let n={};for(let t of e.split(/\r?\n/)){let o=t.trim();if(!o||o.startsWith("#"))continue;let r=o.indexOf("=");if(r<=0)continue;n[o.slice(0,r).trim()]=o.slice(r+1).trim()}return n}function Me(e){return JSON.stringify(e)}function Ce(e){return Br(A(e)).replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")||"broods-app"}async function vt(){let e=A(process.cwd(),S),n=[];await Sn(e,n);let t=St("sha256");for(let o of n.sort())t.update(Mr(e,o)),t.update("\x00"),t.update(await kt(o)),t.update("\x00");return t.digest("hex")}async function Sn(e,n){let t=await Lr(e,{withFileTypes:!0});for(let o of t){let r=Oe(e,o.name);if(o.isDirectory()){if(o.name===b||o.name==="generated"||o.name===".cache")continue;await Sn(r,n);continue}if(o.isFile()&&(o.name.endsWith(".ts")||o.name.endsWith(".md")))n.push(r)}}function Us(e){return e.split(/[\\/]/).some((n)=>n===b||n==="generated"||n===".cache")}function Tt(){return`import { defineAgent, defineSandbox, env } from "broods";
+`;await K(t,i),await Kt()}async function be(e){try{return await xt(e,"utf8")}catch(n){if(n.code==="ENOENT")return"";throw n}}function zt(e){let n={};for(let t of e.split(/\r?\n/)){let o=t.trim();if(!o||o.startsWith("#"))continue;let r=o.indexOf("=");if(r<=0)continue;n[o.slice(0,r).trim()]=o.slice(r+1).trim()}return n}function He(e){return JSON.stringify(e)}function Se(e){return Xr(x(e)).replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")||"broods-app"}async function At(){let e=x(process.cwd(),S),n=[];await Rn(e,n);let t=jt("sha256");for(let o of n.sort())t.update(Qr(e,o)),t.update("\x00"),t.update(await xt(o)),t.update("\x00");return t.digest("hex")}async function Rn(e,n){let t=await qr(e,{withFileTypes:!0});for(let o of t){let r=Pe(e,o.name);if(o.isDirectory()){if(o.name===_||o.name==="generated"||o.name===".cache")continue;await Rn(r,n);continue}if(o.isFile()&&(o.name.endsWith(".ts")||o.name.endsWith(".md")))n.push(r)}}function Qs(e){return e.split(/[\\/]/).some((n)=>n===_||n==="generated"||n===".cache")}function Vt(){return`import { defineAgent, defineSandbox, env } from "broods";
 
 // A Lambda sandbox: a fresh, ephemeral bash environment created per run.
 export const lambdaSandbox = defineSandbox({
@@ -434,4 +415,4 @@ export const myAgent = defineAgent({
   // only reachable via internal endpoints or channel webhooks.
   publicAccess: true,
 });
-`}function Ls(e,n){if(e==="status")throw Error("status was renamed to whoami. Run `broods whoami`.");if(n.includes("--env"))throw Error("--env was renamed to --stage. Pass --stage <name> instead.");h();let t=process.env.BROODS_ENVIRONMENT;if(t!==void 0&&process.env.BROODS_STAGE===void 0)throw Error(`BROODS_ENVIRONMENT was renamed to BROODS_STAGE. Rename the key in .env.local (it is currently set to "${t}").`)}async function Ns(){let e=h(),[{createBroodsMcpServer:n},{serveStdio:t},o]=await Promise.all([import("../chunk-dmvntxs7.js"),import("../chunk-ta62e9cc.js"),x()]),r=o?new U({baseUrl:o.baseUrl,token:o.token}):null,s=n({allowDestructive:process.env.BROODS_MCP_ALLOW_DESTRUCTIVE==="1"&&O("BROODS_MCP_ALLOW_DESTRUCTIVE"),cli:r,scope:{project:e.project,stage:e.stage}});t(()=>s),await new Promise((i)=>{process.stdin.on("close",i)})}zr().catch((e)=>{console.error(e instanceof Error?e.message:String(e)),process.exit(1)});export{de,pe};
+`}function ei(e,n){if(e==="status")throw Error("status was renamed to whoami. Run `broods whoami`.");if(n.includes("--env"))throw Error("--env was renamed to --stage. Pass --stage <name> instead.");m();let t=process.env.BROODS_ENVIRONMENT;if(t!==void 0&&process.env.BROODS_STAGE===void 0)throw Error(`BROODS_ENVIRONMENT was renamed to BROODS_STAGE. Rename the key in .env.local (it is currently set to "${t}").`)}async function ni(){let e=m(),[{createBroodsMcpServer:n},{serveStdio:t},o]=await Promise.all([import("../chunk-ymkt9r21.js"),import("../chunk-pf07c5ff.js"),z()]),r=o?new T({baseUrl:o.baseUrl,token:o.token}):null,s=n({allowDestructive:process.env.BROODS_MCP_ALLOW_DESTRUCTIVE==="1"&&A("BROODS_MCP_ALLOW_DESTRUCTIVE"),cli:r,scope:{project:e.project,stage:e.stage}});t(()=>s),await new Promise((i)=>{process.stdin.on("close",i)})}cs().catch((e)=>{ct(e instanceof Error?e.message:String(e)),process.exit(1)});export{se,fe,q};