npm - broods - Versions diffs - 0.44.0 → 0.44.1 - Mend

broods 0.44.0 → 0.44.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/README.md +6 -6
package/dist/account.d.ts +7 -7
package/dist/chunk-4j35s4p8.js +1 -0
package/dist/{chunk-ee92fs0x.js → chunk-b3q14j68.js} +1 -1
package/dist/{chunk-t0fvmbkd.js → chunk-hdcy74kj.js} +3 -3
package/dist/{chunk-qyq5kyz9.js → chunk-hxky9s3f.js} +1 -1
package/dist/{chunk-g9yebag8.js → chunk-kjccsy1h.js} +1 -1
package/dist/{chunk-naxtmb6t.js → chunk-n890pdvc.js} +6 -6
package/dist/{chunk-dcjq5a2g.js → chunk-r86n05ec.js} +1 -1
package/dist/{chunk-dmax7s31.js → chunk-wq1x460w.js} +2 -2
package/dist/cli/index.js +64 -61
package/dist/index.d.ts +10 -10
package/dist/index.js +1 -1
package/package.json +1 -1
package/dist/chunk-7ddy2nyy.js +0 -1

package/dist/cli/index.js CHANGED Viewed

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{G,S,_,O,T,W,K,v,f,L,h,M,E,F,Y,z,ie,w,g}from"../chunk-t0fvmbkd.js";import{m,R}from"../chunk-a3f2xzbr.js";import{chmod as ps,lstat as fs,mkdir as In,readFile as Mt,readdir as ms,stat as hs,writeFile as be}from"node:fs/promises";import{createHash as Bt}from"node:crypto";import ws from"node:module";import{basename as bs,join as Ue,relative as ys,resolve as P,sep as vs}from"node:path";import{watch as ks}from"node:fs";import{spawn as Gt}from"node:child_process";import{tmpdir as Ss}from"node:os";import{performance as _t}from"node:perf_hooks";import{stripVTControlCharacters as $s}from"node:util";import{fileURLToPath as io,pathToFileURL as Zn}from"node:url";import{createHash as ao}from"node:crypto";import{readFileSync as co}from"node:fs";import{mkdtemp as Xn,readdir as Qn,readFile as lo,rm as et,writeFile as tn}from"node:fs/promises";import Wn from"node:module";import{tmpdir as nt}from"node:os";import{basename as uo,isAbsolute as go,join as le,relative as ke,resolve as Me}from"node:path";import{build as po,transformSync as tt}from"esbuild";var Mn={alibaba:{label:"Alibaba Qwen",modelPlaceholder:"qwen3-max"},anthropic:{label:"Anthropic",modelPlaceholder:"claude-sonnet-4-5-20250929"},azure:{label:"Azure OpenAI",modelPlaceholder:"gpt-4.1-mini"},baseten:{label:"Baseten",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},bedrock:{label:"Amazon Bedrock",modelPlaceholder:"anthropic.claude-sonnet-4-5-20250929-v1:0"},cerebras:{label:"Cerebras",modelPlaceholder:"llama3.1-8b"},chatgpt:{label:"ChatGPT plan",modelPlaceholder:"gpt-5.5"},cloudflare:{label:"Cloudflare Workers AI",modelPlaceholder:"@cf/meta/llama-3.3-70b-instruct-fp8-fast"},cohere:{label:"Cohere",modelPlaceholder:"command-a-03-2025"},custom:{label:"Custom OpenAI-compatible",modelPlaceholder:"gpt-oss-120b"},deepinfra:{label:"DeepInfra",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},deepseek:{label:"DeepSeek",modelPlaceholder:"deepseek-chat"},fireworks:{label:"Fireworks",modelPlaceholder:"accounts/fireworks/models/deepseek-v3"},google:{label:"Google",modelPlaceholder:"gemini-2.5-flash"},groq:{label:"Groq",modelPlaceholder:"llama-3.3-70b-versatile"},huggingface:{label:"Hugging Face",modelPlaceholder:"meta-llama/Llama-3.3-70B-Instruct"},llmgateway:{label:"LLM Gateway",modelPlaceholder:"openai/gpt-4.1-mini"},minimax:{label:"MiniMax",modelPlaceholder:"MiniMax-M2.7"},mistral:{label:"Mistral",modelPlaceholder:"mistral-large-latest"},moonshotai:{label:"Moonshot AI Kimi",modelPlaceholder:"kimi-k2.6"},ollama:{label:"Ollama",modelPlaceholder:"gpt-oss:120b"},openai:{label:"OpenAI",modelPlaceholder:"gpt-4.1-mini"},openrouter:{label:"OpenRouter",modelPlaceholder:"anthropic/claude-sonnet-4.5"},perplexity:{label:"Perplexity",modelPlaceholder:"low"},togetherai:{label:"Together.ai",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},v0:{label:"Vercel v0",modelPlaceholder:"v0-1.0-md"},vercel:{label:"Vercel AI Gateway",modelPlaceholder:"openai/gpt-4.1-mini"},vertex:{label:"Google Vertex AI",modelPlaceholder:"gemini-2.5-flash"},xai:{label:"xAI Grok",modelPlaceholder:"grok-4"},zai:{label:"Z.ai GLM",modelPlaceholder:"glm-4.7"}},Bn=Object.keys(Mn);function Gn(e){return Object.hasOwn(Mn,e)}var Oe="*",fo=`const passthrough = (input) => input;
+import{G,y,_,O,T,W,K,v,f,L,h,M,E,F,Y,z,ie,w,g}from"../chunk-hdcy74kj.js";import{m,R}from"../chunk-a3f2xzbr.js";import{chmod as Es,lstat as Cs,mkdir as Un,readFile as zt,readdir as Rs,stat as Os,writeFile as ve}from"node:fs/promises";import{createHash as Vt}from"node:crypto";import As from"node:module";import{basename as xs,join as Le,relative as Ps,resolve as P,sep as js}from"node:path";import{watch as Ts}from"node:fs";import{spawn as Jt}from"node:child_process";import{tmpdir as Is}from"node:os";import{performance as Wt}from"node:perf_hooks";import{stripVTControlCharacters as _s}from"node:util";import{fileURLToPath as mo,pathToFileURL as ot}from"node:url";import{createHash as ho}from"node:crypto";import{existsSync as wo,readFileSync as bo}from"node:fs";import{mkdtemp as rt,readdir as st,readFile as yo,rm as it,writeFile as an}from"node:fs/promises";import Vn from"node:module";import{tmpdir as at}from"node:os";import{basename as vo,isAbsolute as ko,join as le,relative as Se,resolve as Ge}from"node:path";import{build as So,transformSync as ct}from"esbuild";var Hn={alibaba:{label:"Alibaba Qwen",modelPlaceholder:"qwen3-max"},anthropic:{label:"Anthropic",modelPlaceholder:"claude-sonnet-4-5-20250929"},azure:{label:"Azure OpenAI",modelPlaceholder:"gpt-4.1-mini"},baseten:{label:"Baseten",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},bedrock:{label:"Amazon Bedrock",modelPlaceholder:"anthropic.claude-sonnet-4-5-20250929-v1:0"},cerebras:{label:"Cerebras",modelPlaceholder:"llama3.1-8b"},chatgpt:{label:"ChatGPT plan",modelPlaceholder:"gpt-5.5"},cloudflare:{label:"Cloudflare Workers AI",modelPlaceholder:"@cf/meta/llama-3.3-70b-instruct-fp8-fast"},cohere:{label:"Cohere",modelPlaceholder:"command-a-03-2025"},custom:{label:"Custom OpenAI-compatible",modelPlaceholder:"gpt-oss-120b"},deepinfra:{label:"DeepInfra",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},deepseek:{label:"DeepSeek",modelPlaceholder:"deepseek-chat"},fireworks:{label:"Fireworks",modelPlaceholder:"accounts/fireworks/models/deepseek-v3"},google:{label:"Google",modelPlaceholder:"gemini-2.5-flash"},groq:{label:"Groq",modelPlaceholder:"llama-3.3-70b-versatile"},huggingface:{label:"Hugging Face",modelPlaceholder:"meta-llama/Llama-3.3-70B-Instruct"},llmgateway:{label:"LLM Gateway",modelPlaceholder:"openai/gpt-4.1-mini"},minimax:{label:"MiniMax",modelPlaceholder:"MiniMax-M2.7"},mistral:{label:"Mistral",modelPlaceholder:"mistral-large-latest"},moonshotai:{label:"Moonshot AI Kimi",modelPlaceholder:"kimi-k2.6"},ollama:{label:"Ollama",modelPlaceholder:"gpt-oss:120b"},openai:{label:"OpenAI",modelPlaceholder:"gpt-4.1-mini"},openrouter:{label:"OpenRouter",modelPlaceholder:"anthropic/claude-sonnet-4.5"},perplexity:{label:"Perplexity",modelPlaceholder:"low"},togetherai:{label:"Together.ai",modelPlaceholder:"deepseek-ai/DeepSeek-V3"},v0:{label:"Vercel v0",modelPlaceholder:"v0-1.0-md"},vercel:{label:"Vercel AI Gateway",modelPlaceholder:"openai/gpt-4.1-mini"},vertex:{label:"Google Vertex AI",modelPlaceholder:"gemini-2.5-flash"},xai:{label:"xAI Grok",modelPlaceholder:"grok-4"},zai:{label:"Z.ai GLM",modelPlaceholder:"glm-4.7"}},Yn=Object.keys(Hn);function zn(e){return Object.hasOwn(Hn,e)}var Ae="*",$o=`const passthrough = (input) => input;
 export const defineAgent = passthrough;
 export const defineBroods = passthrough;
 export const defineCron = passthrough;
@@ -39,15 +39,15 @@ export const defineZaloChannel = passthrough;
 export const defineZaloConnection = passthrough;
 export const env = (name) => ({ __beeblastEnv: true, name });
 export default {};
-`,Be=1e7,Fn=50000000,ot=1e7,Kn=20000000,Hn=200,mo=new Set(["node_modules",".git"]),ho=[/^\.env(?:\.|$)/i,/^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,/\.(?:pem|key|p12|pfx)$/i],on={onStart:"agent.started",onStepFinish:"agent.step.finished",onToolCall:"tool.call.started",onToolResult:"tool.result",onFinish:"agent.finished",onApproval:"agent.approval.required",onError:"agent.failed",onSubagentFinish:"subagent.task.finished",onMessageReceived:"channel.message.received",onMessageSending:"channel.message.sending"};async function de(e={}){let n=e.cwd??process.cwd();h(n);let t=Me(n,S),o=await bo(t),r=await yo(o),s=await ko(r,n,e.project),i=r.filter((b)=>g(b.value)).map((b)=>({exportName:b.exportName,file:b.file,resource:b.value})),a=i.map((b)=>b.resource);Vn(a),Io(a);let c=_o(i,r),d=Uo(a);for(let b of a)$o(b);for(let b of a)Eo(b);for(let b of a)Co(b);Oo(a),Ao(a),Do(i,d);let l=To(i),p=wo(s,e.stage??(e.useRuntimeStage===!1?void 0:v()),e.command??"dev"),u=(await Promise.all(i.map((b)=>No(b,t,d)))).flat().sort((b,k)=>`${b.kind}:${b.name}`.localeCompare(`${k.kind}:${k.name}`));return Vn(u),{config:s,resources:a,resourceAliases:l,channels:c,manifest:{version:1,project:s.project,stage:p,resources:u}}}function rt(e){let n=new Set;for(let t of e.resources)rn(t.config,n);return[...n].sort()}function rn(e,n){if(Array.isArray(e)){for(let t of e)rn(t,n);return}if(e&&typeof e==="object"){let t=e;if(t.__beeblastEnv===!0&&typeof t.name==="string"){n.add(t.name);return}for(let o of Object.values(t))rn(o,n)}}function wo(e,n,t){if(n)return n;let o=e.stages?.[t];if(o)return o;return t==="deploy"?"production":"development"}async function bo(e){let n=[];async function t(o){let r=await Qn(o,{withFileTypes:!0});for(let s of r){let i=le(o,s.name);if(s.isDirectory()){if(s.name===_||s.name==="generated")continue;await t(i)}else if(s.isFile()&&s.name.endsWith(".ts"))n.push(i)}}return await t(e),n.sort((o,r)=>ke(e,o).localeCompare(ke(e,r)))}async function yo(e){vo();let n=[];for(let t of e){let r=await import(`${Zn(t).href}?t=${Date.now()}`);n.push(...Object.entries(r).map(([s,i])=>({exportName:s,file:t,value:i})))}return n}var zn=!1;function vo(){if(zn)return;if(zn=!0,typeof Wn.registerHooks!=="function")return;Wn.registerHooks({load:(e,n,t)=>{let[o]=e.split("?");if(o===void 0||!o.startsWith("file:")||!o.endsWith(".ts"))return t(e,n);let r=io(o);return{format:"module",shortCircuit:!0,source:tt(co(r,"utf8"),{loader:"ts",format:"esm",sourcefile:r,sourcemap:"inline"}).code}}})}async function ko(e,n,t){let r=e.find((i)=>ie(i.value))?.value?.config??{},s=t??process.env.BROODS_PROJECT??r.project??dr(uo(Me(n)));if(!s.trim())throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT.");return{...r,project:s}}var Yn=new Set(["agent","harness","model","provider","session","hooks","connections","tools","mcp","denyTools","sandboxes","workspaces","subagent","skills","scheduler","policies","publicAccess","allowRunOverrides"]),So={workspace:"workspaces",skill:"skills",policy:"policies",tool:"tools",mcpServers:"mcp",channel:"connections",channels:"connections",hook:"hooks",subagents:"subagent",systemPrompt:"agent",system:"agent"};function $o(e){if(e.kind!=="agent")return;let n=e.config;for(let t of Object.keys(n)){if(Yn.has(t))continue;if(t==="sandbox")throw Error(`Agent "${e.name}" config.sandbox was removed; use sandboxes, the first is the default`);let o=So[t],r=o?` Did you mean "${o}"?`:` Allowed keys: ${[...Yn].sort().join(", ")}.`;throw Error(`Agent "${e.name}" has an unknown config key "${t}".${r}`)}}function Eo(e){if(e.kind!=="workspace")return;let t=e.config.storage;if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Workspace "${e.name}" config.storage must be an object`);let o=t.provider;if(o===void 0||o==="s3")return;if(o==="vercel")throw Error(`Workspace "${e.name}" uses storage.provider "vercel", but Vercel Drive workspace storage is not supported yet. Use storage.provider "s3" or omit storage until Vercel Drive is wired.`);throw Error(`Workspace "${e.name}" config.storage.provider must be one of: s3`)}function Co(e){if(e.kind!=="workspace")return;let n=e.config;if(typeof n.partitioned==="string")throw Error(`Workspace "${e.name}" config.partitioned must be a boolean; string modes are not supported.`);if(n.isolation!==void 0)throw Error(`Workspace "${e.name}" config.isolation is no longer supported; use partitioned: true.`)}function Oo(e){let n=new Map(e.filter((t)=>t.kind==="workspace").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=o.connections;if(r!==void 0&&!Array.isArray(r))throw Error(`Agent "${t.name}" config.connections must be an array of connection definitions`);let s=Array.isArray(r)?r.filter(w):[],i=new Set;for(let l of s){let p=l.config,u=typeof p.id==="string"?p.id:void 0;if(u){if(i.has(u))throw Error(`Duplicate channel id: ${u}`);i.add(u)}if(l.partition)st(l.partition,`Agent "${t.name}" connection "${l.type}"`);if(l.config&&typeof l.config==="object"&&(("workspaceIsolationScope"in l.config)||("workspaceScope"in l.config)))throw Error(`Agent "${t.name}" connection "${l.type}" uses workspaceScope, which is no longer supported; use partition.`)}let c=(Array.isArray(o.workspaces)?o.workspaces.map((l)=>Ro(l,n)).filter((l)=>Boolean(l)):[]).filter((l)=>l.config.partitioned===!0),d=s.filter((l)=>l.partition);if(d.length>0&&c.length===0){let l=d[0];throw Error(`Agent "${t.name}" connection "${l.type}" defines partition, but no attached workspace has partitioned: true.`)}if(c.length>0){for(let l of s)if(!l.partition)throw Error(`Agent "${t.name}" attaches partitioned workspace "${c[0].name}", but connection "${l.type}" does not define partition.`)}}}function st(e,n){if(!e)return;if(e.by==="shared"){if("alias"in e&&e.alias!==void 0)throw Error(`${n} partition.alias is only supported when partition.by is conversation`);return}if(e.by!=="conversation")throw Error(`${n} partition.by must be one of: shared, conversation`);if(typeof e.alias!=="string"||e.alias.length===0)throw Error(`${n} partition.alias is required when partition.by is conversation`);if(!/^[A-Za-z0-9._-]+$/.test(e.alias))throw Error(`${n} partition.alias must use only letters, numbers, dots, underscores, or hyphens`);if(e.alias==="."||e.alias==="..")throw Error(`${n} partition.alias must not be "." or ".."`)}function Ro(e,n){if(g(e)&&e.kind==="workspace")return e;if(typeof e==="string")return n.get(e);if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace;if(g(t)&&t.kind==="workspace")return t;if(typeof t==="string")return n.get(t)}return}function Ao(e){let n=new Map(e.filter((t)=>t.kind==="sandbox").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=it(Array.isArray(o.sandboxes)?o.sandboxes[0]:void 0,n),s=o.workspaces;if(!Array.isArray(s))continue;for(let i of s){let a=Po(i),c=xo(i,r,n);if(!c||jo(c))continue;throw Error(`Agent "${t.name}" workspace "${a}" uses sandbox "${c.name}" (${at(c)}) which does not support S3 workspace mounts. Use lambda/sandbox, or daytona with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`)}}}function it(e,n){if(g(e)&&e.kind==="sandbox")return e;if(typeof e==="string")return n.get(e);return}function xo(e,n,t){if(e&&typeof e==="object"&&"sandbox"in e){let o=e.sandbox;if(o===null)return;return it(o,t)}return n}function Po(e){if(g(e)&&e.kind==="workspace")return e.name;if(e&&typeof e==="object"&&"workspace"in e){let n=e.workspace;if(g(n))return n.name;if(typeof n==="string")return n}return"<unknown>"}function jo(e){let n=at(e);if(n==="lambda"||n==="sandbox")return!0;if(n!=="daytona")return!1;let t=e.config.options;return Boolean(t&&typeof t==="object"&&!Array.isArray(t)&&t.mountAwsS3Buckets===!0)}function at(e){return typeof e.config.provider==="string"?e.config.provider:"sandbox"}function Io(e){let n=new Set(e.filter((t)=>t.kind==="sandbox").map((t)=>t.name));for(let t of e){if(t.kind!=="agent")continue;let o=t.config.sandboxes;if(o===void 0)continue;if(!Array.isArray(o))throw Error(`Agent "${t.name}" sandboxes must be an array of sandbox resources or names`);let r=o;for(let[s,i]of r.entries()){let a=typeof i==="string"&&i.trim().length>0,c=g(i)&&i.kind==="sandbox";if(!a&&!c)throw Error(`Agent "${t.name}" sandboxes[${s}] must be a sandbox resource or a non-empty name`);if(c&&!n.has(i.name))throw Error(`Agent "${t.name}" sandboxes references sandbox "${i.name}", but that sandbox is not exported from broods/`)}}}function Vn(e){let n=new Set;for(let t of e){let o=`${t.kind}:${t.name}`;if(n.has(o))throw Error(`Duplicate resource: ${o}`);n.add(o)}}function To(e){let n={},t=new Set;for(let{exportName:o,resource:r}of e){if(o==="default"||!sn(o))continue;let s=`${r.kind}:${o}`;if(t.has(s))throw Error(`Duplicate export alias for ${r.kind}: ${o}`);t.add(s),n[r.kind]??={},n[r.kind][r.name]=o}return n}function _o(e,n){let t=new Map;for(let i of n){if(!w(i.value)||i.exportName==="default"||!sn(i.exportName))continue;let a=t.get(i.value);if(a&&a!==i.exportName)throw Error(`Channel is exported more than once: ${a}, ${i.exportName}`);t.set(i.value,i.exportName)}let o=new Map,r=new Set,s=[];for(let{exportName:i,resource:a}of e){if(a.kind!=="agent")continue;let c=a.config.connections;if(c===void 0)continue;if(!Array.isArray(c))throw Error(`Agent "${a.name}" config.connections must be an array of connection definitions`);let d=new Set;for(let l of c){if(!w(l))throw Error(`Agent "${a.name}" config.connections must contain connection definitions`);let p=o.get(l);if(p&&p!==a.name)throw Error(`Channel ${l.type} is already attached to agent "${p}" and cannot also attach to "${a.name}"`);if(d.has(l.type))throw Error(`Agent "${a.name}" cannot configure more than one ${l.type} channel`);o.set(l,a.name),d.add(l.type);let u=i!=="default"&&sn(i)?i:a.name,b=t.get(l)??`${u}${lt(l.type)}Channel`;if(r.has(b))throw Error(`Duplicate channel export alias: ${b}`);r.add(b),s.push({alias:b,type:l.type,id:b,agentName:a.name})}}for(let[i,a]of t)if(!o.has(i))throw Error(`Channel "${a}" must be attached to exactly one agent`);return s.sort((i,a)=>i.alias.localeCompare(a.alias))}function Do(e,n){for(let{resource:t}of e){if(t.kind!=="agent")continue;let o=t.config.connections;if(!Array.isArray(o))continue;for(let r of o){if(!w(r))continue;if(ct(r,n).length>0)continue;throw Error(`Agent "${t.name}" connection "${r.type}" reaches no rooms: declare a ${r.type} channel for it, or set allowedChannelIds: ["*"] to answer everywhere`)}}}function ct(e,n){let t=e.config.allowedChannelIds??[];if(t.includes(Oe))return[Oe];return[...new Set([...n.get(e)??[],...t])]}function Uo(e){let n=new Map;for(let t of e){if(t.kind!=="channelRecord")continue;let o=t.config;if(!w(o.connection))continue;let r=dt(t.name,o.externalId);if(r.length===0)continue;let s=n.get(o.connection)??new Set;for(let i of r)s.add(i);n.set(o.connection,s)}return n}function lt(e){return e.charAt(0).toUpperCase()+e.slice(1)}function sn(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)}async function No(e,n,t){let o=e.resource;if(o.kind==="agent"){let r=zo(o,n,t);return[...r.hookResource?[r.hookResource]:[],{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:r.config}]}if(o.kind==="channelRecord"){let r=o.config,s=dt(o.name,r.externalId);return s.map((i)=>({kind:o.kind,name:s.length===1?o.name:`${o.name}-${i}`,...o.description?{description:o.description}:{},config:sr(o.name,{...r,externalId:i})}))}return[{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:await Lo(e,n)}]}function dt(e,n){if(n===void 0)return[];if(typeof n==="string")return Jn(e,n),[n];if(!Array.isArray(n))throw Error(`Channel "${e}" externalId must be a string or an array`);if(n.length===0)throw Error(`Channel "${e}" externalId must not be an empty array`);let t=new Set;for(let o of n){if(typeof o!=="string"||o.length===0)throw Error(`Channel "${e}" externalId must be an array of non-empty strings`);if(t.has(o))throw Error(`Channel "${e}" externalId lists ${o} twice`);Jn(e,o),t.add(o)}return n}function Jn(e,n){if(n!==Oe)return;throw Error(`Channel "${e}" cannot use "${Oe}" as its id: a record matches one exact room. To answer everywhere, set allowedChannelIds: ["${Oe}"] on the connection; undeclared rooms already fall back to its agent.`)}async function Lo(e,n){let t=e.resource;if(t.kind==="skill")return await Qo(t.config,n);if(t.kind==="workspace"){let o={...t.config};if(o.partitioned!==void 0){if(typeof o.partitioned!=="boolean")throw Error(`Workspace "${t.name}" config.partitioned must be a boolean`);let r=o.partitioned;if(delete o.partitioned,r)o.isolation=!0}return Q(o)}if(t.kind==="mcp")return await er(e,t.config,n);if(t.kind==="policy"){let o={...t.config};return o.version=o.version??1,Q(o)}if(t.kind==="cron"){let o={...t.config},r=o.agent;if(o.agentId=g(r)?r.name:r,o.name=o.name??t.name,o.status===void 0)o.status="active";if(delete o.agent,typeof o.input==="string")o.events=[{role:"user",content:[{type:"text",text:o.input}]}],delete o.input;return Q(o)}return Q(t.config)}var Mo=new Set(["apiKey","base_url","baseURL"]),Bo=new Set(["activeTools","debug","inactiveTools","permissionMode","startupTimeoutMs","type","webSearch"]),Go=new Set(["enabled","level","subsystems"]);function Wo(e){if(Mo.has(e))return"";let n=e.replace(/[^a-z0-9]/gi,"").toLowerCase();if(n==="baseurl")return'"base_url" or "baseURL"';if(n==="apikey")return'"apiKey"';return""}function Fo(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.provider must be an object`);for(let[t,o]of Object.entries(n)){if(!Gn(t))throw Error(`Agent "${e}" config.provider.${t} is not a supported provider (expected one of: ${Bn.join(", ")})`);if(typeof o!=="object"||o===null||Array.isArray(o))throw Error(`Agent "${e}" config.provider.${t} must be an object`);let r=o;for(let s of Object.keys(r)){let i=Wo(s);if(i)throw Error(`Agent "${e}" config.provider.${t} has unknown option "${s}". Did you mean ${i}?`)}if(t==="custom"&&r.base_url===void 0&&r.baseURL===void 0)throw Error(`Agent "${e}" config.provider.custom.base_url is required (use "base_url" or "baseURL")`)}}function Ko(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.harness must be an object`);let t=n;if("sandbox"in t)throw Error(`Agent "${e}" harness sandbox was removed; list it first in the agent's sandboxes`);for(let o of Object.keys(t))if(!Bo.has(o))throw Error(`Agent "${e}" config.harness has unknown option "${o}"`);if(t.type!=="claude-code"&&t.type!=="codex"&&t.type!=="deepagents"&&t.type!=="opencode"&&t.type!=="pi")throw Error(`Agent "${e}" config.harness.type must be claude-code, codex, deepagents, opencode, or pi`);if(t.permissionMode!==void 0&&t.permissionMode!=="allow-reads"&&t.permissionMode!=="allow-edits"&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-reads, allow-edits, or allow-all`);if(t.type==="codex"&&t.permissionMode!==void 0&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-all for codex`);if(t.startupTimeoutMs!==void 0&&(typeof t.startupTimeoutMs!=="number"||!Number.isSafeInteger(t.startupTimeoutMs)||t.startupTimeoutMs<1||t.startupTimeoutMs>600000))throw Error(`Agent "${e}" config.harness.startupTimeoutMs must be an integer from 1 to 600000`);if(t.webSearch!==void 0&&typeof t.webSearch!=="boolean")throw Error(`Agent "${e}" config.harness.webSearch must be a boolean`);if(t.type!=="codex"&&t.webSearch!==void 0)throw Error(`Agent "${e}" config.harness.webSearch is only supported by codex`);if(t.type==="pi"&&t.startupTimeoutMs!==void 0)throw Error(`Agent "${e}" config.harness.startupTimeoutMs is not supported by pi`);if(an(e,t.activeTools,"activeTools"),an(e,t.inactiveTools,"inactiveTools"),t.activeTools!==void 0&&t.inactiveTools!==void 0)throw Error(`Agent "${e}" config.harness must use either activeTools or inactiveTools, not both`);Ho(e,t.debug)}function Ho(e,n){if(n===void 0)return;if(typeof n!=="object"||n===null||Array.isArray(n))throw Error(`Agent "${e}" config.harness.debug must be an object`);let t=n;for(let o of Object.keys(t))if(!Go.has(o))throw Error(`Agent "${e}" config.harness.debug has unknown option "${o}"`);if(t.enabled!==void 0&&typeof t.enabled!=="boolean")throw Error(`Agent "${e}" config.harness.debug.enabled must be a boolean`);if(t.level!==void 0&&t.level!=="error"&&t.level!=="warn"&&t.level!=="info"&&t.level!=="debug"&&t.level!=="trace")throw Error(`Agent "${e}" config.harness.debug.level must be error, warn, info, debug, or trace`);an(e,t.subsystems,"debug.subsystems")}function an(e,n,t){if(n!==void 0&&(!Array.isArray(n)||!n.every((o)=>typeof o==="string"&&o.trim().length>0)))throw Error(`Agent "${e}" config.harness.${t} must be an array of non-empty strings`)}function zo(e,n,t){let o={...e.config};Fo(e.name,o.provider),Ko(e.name,o.harness);let r=Array.isArray(o.sandboxes)?o.sandboxes.map((i)=>g(i)?i.name:i):void 0;if(r)o.sandboxes=r;r?.forEach((i,a)=>{if(r.indexOf(i)===a)return;throw Error(`Agent "${e.name}" sandboxes[${a}] "${String(i)}" is listed more than once`)});let s=Yo(e.name,o.hooks);if(s)o.hooks=s.agentHooksConfig;else if(o.hooks!==void 0)o.hooks=ut(o.hooks,e.name);if(o.connections!==void 0){if(!Array.isArray(o.connections))throw Error(`Agent "${e.name}" config.connections must be an array of connection definitions`);o.channels=Object.fromEntries(o.connections.map((i)=>{if(!w(i))throw Error(`Agent "${e.name}" config.connections must contain connection definitions`);let a=`${e.name}${lt(i.type)}Channel`,c=ct(i,t);return[i.type,{id:a,...i.config,...i.partition?{partition:i.partition}:{},allowedChannelIds:c}]})),delete o.connections}if(Array.isArray(o.workspaces)){let i=o.workspaces.map((a)=>or(a,e.name));for(let a of i){let c=r?.indexOf(a.sandbox)??-1;if(c>=1)throw Error(`Agent "${e.name}" sandboxes[${c}] "${String(a.sandbox)}" also backs workspace "${String(a.name)}"; only the first sandbox can back a workspace`)}o.workspaces=i}if(o.harness&&!r?.length)throw Error(`Agent "${e.name}" runs a harness, so it needs sandboxes; the first runs the harness`);if(o.policies!==void 0){let i=qo(o.policies,e.name);if(i)o.policies=i;else delete o.policies}return{config:Q(o),...s?.hookResource?{hookResource:s.hookResource}:{}}}function Yo(e,n){if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.hooks must be an object`);let t=n,o=Object.keys(on).flatMap((d)=>{let l=t[d];if(l===void 0)return[];if(typeof l!=="function")throw Error(`Agent "${e}" config.hooks.${d} must be a function`);return[{name:d,event:on[d],source:Vo(l.toString())}]});if(o.length===0)return;let r=`${e}-hooks`,s=Jo(e,o),i=Buffer.byteLength(s);if(i>Be)throw Error(`Agent "${e}" hook bundle is too large (${i} bytes, max ${Be})`);let a=o.map((d)=>d.event),c=ut(t,e);return c.code=[{hookId:r}],{agentHooksConfig:c,hookResource:{kind:"hook",name:r,description:`Inline hooks for agent ${e}`,config:{events:a,bundle:s,sha256:Re(s)}}}}function ut(e,n){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Agent "${n}" config.hooks must be an object`);let t=Object.entries(e);for(let[r]of t){if(r==="webhooks"||r in on)continue;throw Error(`Agent "${n}" config.hooks.${r} is not supported. Use inline hook callbacks or hooks.webhooks.`)}return Object.fromEntries(t.filter(([r])=>r==="webhooks"))}function Vo(e){let n=e.trim();if(/^(async\s+)?function\b/.test(n)||/^(async\s*)?\(/.test(n)||/^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(n))return n;if(/^(async\s+)?[A-Za-z_$][\w$]*\s*\(/.test(n))return n.replace(/^(async\s+)?/,"$1function ");return n}function Jo(e,n){let t=`export default {
+`,We=1e7,Jn=50000000,lt=1e7,qn=20000000,Zn=200,Eo=new Set(["node_modules",".git"]),Co=[/^\.env(?:\.|$)/i,/^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.pub)?$/i,/\.(?:pem|key|p12|pfx)$/i],cn={onStart:"agent.started",onStepFinish:"agent.step.finished",onToolCall:"tool.call.started",onToolResult:"tool.result",onFinish:"agent.finished",onApproval:"agent.approval.required",onError:"agent.failed",onSubagentFinish:"subagent.task.finished",onMessageReceived:"channel.message.received",onMessageSending:"channel.message.sending"};async function de(e={}){let n=e.cwd??process.cwd();h(n);let t=Ge(n,y);if(!wo(t))throw Error(`No ${y}/ folder in ${n}. Run \`broods dev\` to scaffold one.`);let o=await Oo(t),r=await Ao(o),s=await Po(r,n,e.project),i=r.filter((b)=>g(b.value)).map((b)=>({exportName:b.exportName,file:b.file,resource:b.value})),a=i.map((b)=>b.resource);et(a),Go(a);let c=Fo(i,r),d=Ho(a);for(let b of a)To(b);for(let b of a)Io(b);for(let b of a)_o(b);Do(a),No(a),Ko(i,d);let l=Wo(i),p=Ro(s,e.stage??(e.useRuntimeStage===!1?void 0:v()),e.command??"dev"),u=(await Promise.all(i.map((b)=>Yo(b,t,d)))).flat().sort((b,S)=>`${b.kind}:${b.name}`.localeCompare(`${S.kind}:${S.name}`));return et(u),{config:s,resources:a,resourceAliases:l,channels:c,manifest:{version:1,project:s.project,stage:p,resources:u}}}function dt(e){let n=new Set;for(let t of e.resources)ln(t.config,n);return[...n].sort()}function ln(e,n){if(Array.isArray(e)){for(let t of e)ln(t,n);return}if(e&&typeof e==="object"){let t=e;if(t.__beeblastEnv===!0&&typeof t.name==="string"){n.add(t.name);return}for(let o of Object.values(t))ln(o,n)}}function Ro(e,n,t){if(n)return n;let o=e.stages?.[t];if(o)return o;return t==="deploy"?"production":"development"}async function Oo(e){let n=[];async function t(o){let r=await st(o,{withFileTypes:!0});for(let s of r){let i=le(o,s.name);if(s.isDirectory()){if(s.name===_||s.name==="generated")continue;await t(i)}else if(s.isFile()&&s.name.endsWith(".ts"))n.push(i)}}return await t(e),n.sort((o,r)=>Se(e,o).localeCompare(Se(e,r)))}async function Ao(e){xo();let n=[];for(let t of e){let r=await import(`${ot(t).href}?t=${Date.now()}`);n.push(...Object.entries(r).map(([s,i])=>({exportName:s,file:t,value:i})))}return n}var Xn=!1;function xo(){if(Xn)return;if(Xn=!0,typeof Vn.registerHooks!=="function")return;Vn.registerHooks({load:(e,n,t)=>{let[o]=e.split("?");if(o===void 0||!o.startsWith("file:")||!o.endsWith(".ts"))return t(e,n);let r=mo(o);return{format:"module",shortCircuit:!0,source:ct(bo(r,"utf8"),{loader:"ts",format:"esm",sourcefile:r,sourcemap:"inline"}).code}}})}async function Po(e,n,t){let r=e.find((i)=>ie(i.value))?.value?.config??{},s=t??process.env.BROODS_PROJECT??r.project??yr(vo(Ge(n)));if(!s.trim())throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT.");return{...r,project:s}}var Qn=new Set(["agent","harness","model","provider","session","hooks","connections","tools","mcp","denyTools","sandboxes","workspaces","subagent","skills","scheduler","policies","publicAccess","allowRunOverrides"]),jo={workspace:"workspaces",skill:"skills",policy:"policies",tool:"tools",mcpServers:"mcp",channel:"connections",channels:"connections",hook:"hooks",subagents:"subagent",systemPrompt:"agent",system:"agent"};function To(e){if(e.kind!=="agent")return;let n=e.config;for(let t of Object.keys(n)){if(Qn.has(t))continue;if(t==="sandbox")throw Error(`Agent "${e.name}" config.sandbox was removed; use sandboxes, the first is the default`);let o=jo[t],r=o?` Did you mean "${o}"?`:` Allowed keys: ${[...Qn].sort().join(", ")}.`;throw Error(`Agent "${e.name}" has an unknown config key "${t}".${r}`)}}function Io(e){if(e.kind!=="workspace")return;let t=e.config.storage;if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Workspace "${e.name}" config.storage must be an object`);let o=t.provider;if(o===void 0||o==="s3")return;if(o==="vercel")throw Error(`Workspace "${e.name}" uses storage.provider "vercel", but Vercel Drive workspace storage is not supported yet. Use storage.provider "s3" or omit storage until Vercel Drive is wired.`);throw Error(`Workspace "${e.name}" config.storage.provider must be one of: s3`)}function _o(e){if(e.kind!=="workspace")return;let n=e.config;if(typeof n.partitioned==="string")throw Error(`Workspace "${e.name}" config.partitioned must be a boolean; string modes are not supported.`);if(n.isolation!==void 0)throw Error(`Workspace "${e.name}" config.isolation is no longer supported; use partitioned: true.`)}function Do(e){let n=new Map(e.filter((t)=>t.kind==="workspace").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=o.connections;if(r!==void 0&&!Array.isArray(r))throw Error(`Agent "${t.name}" config.connections must be an array of connection definitions`);let s=Array.isArray(r)?r.filter(w):[],i=new Set;for(let l of s){let p=l.config,u=typeof p.id==="string"?p.id:void 0;if(u){if(i.has(u))throw Error(`Duplicate channel id: ${u}`);i.add(u)}if(l.partition)ut(l.partition,`Agent "${t.name}" connection "${l.type}"`);if(l.config&&typeof l.config==="object"&&(("workspaceIsolationScope"in l.config)||("workspaceScope"in l.config)))throw Error(`Agent "${t.name}" connection "${l.type}" uses workspaceScope, which is no longer supported; use partition.`)}let c=(Array.isArray(o.workspaces)?o.workspaces.map((l)=>Uo(l,n)).filter((l)=>Boolean(l)):[]).filter((l)=>l.config.partitioned===!0),d=s.filter((l)=>l.partition);if(d.length>0&&c.length===0){let l=d[0];throw Error(`Agent "${t.name}" connection "${l.type}" defines partition, but no attached workspace has partitioned: true.`)}if(c.length>0){for(let l of s)if(!l.partition)throw Error(`Agent "${t.name}" attaches partitioned workspace "${c[0].name}", but connection "${l.type}" does not define partition.`)}}}function ut(e,n){if(!e)return;if(e.by==="shared"){if("alias"in e&&e.alias!==void 0)throw Error(`${n} partition.alias is only supported when partition.by is conversation`);return}if(e.by!=="conversation")throw Error(`${n} partition.by must be one of: shared, conversation`);if(typeof e.alias!=="string"||e.alias.length===0)throw Error(`${n} partition.alias is required when partition.by is conversation`);if(!/^[A-Za-z0-9._-]+$/.test(e.alias))throw Error(`${n} partition.alias must use only letters, numbers, dots, underscores, or hyphens`);if(e.alias==="."||e.alias==="..")throw Error(`${n} partition.alias must not be "." or ".."`)}function Uo(e,n){if(g(e)&&e.kind==="workspace")return e;if(typeof e==="string")return n.get(e);if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace;if(g(t)&&t.kind==="workspace")return t;if(typeof t==="string")return n.get(t)}return}function No(e){let n=new Map(e.filter((t)=>t.kind==="sandbox").map((t)=>[t.name,t]));for(let t of e){if(t.kind!=="agent")continue;let o=t.config,r=gt(Array.isArray(o.sandboxes)?o.sandboxes[0]:void 0,n),s=o.workspaces;if(!Array.isArray(s))continue;for(let i of s){let a=Mo(i),c=Lo(i,r,n);if(!c||Bo(c))continue;throw Error(`Agent "${t.name}" workspace "${a}" uses sandbox "${c.name}" (${pt(c)}) which does not support S3 workspace mounts. Use lambda/sandbox, or daytona with options.mountAwsS3Buckets: true, or set this workspace ref to sandbox: null for read-only S3 access.`)}}}function gt(e,n){if(g(e)&&e.kind==="sandbox")return e;if(typeof e==="string")return n.get(e);return}function Lo(e,n,t){if(e&&typeof e==="object"&&"sandbox"in e){let o=e.sandbox;if(o===null)return;return gt(o,t)}return n}function Mo(e){if(g(e)&&e.kind==="workspace")return e.name;if(e&&typeof e==="object"&&"workspace"in e){let n=e.workspace;if(g(n))return n.name;if(typeof n==="string")return n}return"<unknown>"}function Bo(e){let n=pt(e);if(n==="lambda"||n==="sandbox")return!0;if(n!=="daytona")return!1;let t=e.config.options;return Boolean(t&&typeof t==="object"&&!Array.isArray(t)&&t.mountAwsS3Buckets===!0)}function pt(e){return typeof e.config.provider==="string"?e.config.provider:"lambda"}function Go(e){let n=new Set(e.filter((t)=>t.kind==="sandbox").map((t)=>t.name));for(let t of e){if(t.kind!=="agent")continue;let o=t.config.sandboxes;if(o===void 0)continue;if(!Array.isArray(o))throw Error(`Agent "${t.name}" sandboxes must be an array of sandbox resources or names`);let r=o;for(let[s,i]of r.entries()){let a=typeof i==="string"&&i.trim().length>0,c=g(i)&&i.kind==="sandbox";if(!a&&!c)throw Error(`Agent "${t.name}" sandboxes[${s}] must be a sandbox resource or a non-empty name`);if(c&&!n.has(i.name))throw Error(`Agent "${t.name}" sandboxes references sandbox "${i.name}", but that sandbox is not exported from broods/`)}}}function et(e){let n=new Set;for(let t of e){let o=`${t.kind}:${t.name}`;if(n.has(o))throw Error(`Duplicate resource: ${o}`);n.add(o)}}function Wo(e){let n={},t=new Set;for(let{exportName:o,resource:r}of e){if(o==="default"||!dn(o))continue;let s=`${r.kind}:${o}`;if(t.has(s))throw Error(`Duplicate export alias for ${r.kind}: ${o}`);t.add(s),n[r.kind]??={},n[r.kind][r.name]=o}return n}function Fo(e,n){let t=new Map;for(let i of n){if(!w(i.value)||i.exportName==="default"||!dn(i.exportName))continue;let a=t.get(i.value);if(a&&a!==i.exportName)throw Error(`Channel is exported more than once: ${a}, ${i.exportName}`);t.set(i.value,i.exportName)}let o=new Map,r=new Set,s=[];for(let{exportName:i,resource:a}of e){if(a.kind!=="agent")continue;let c=a.config.connections;if(c===void 0)continue;if(!Array.isArray(c))throw Error(`Agent "${a.name}" config.connections must be an array of connection definitions`);let d=new Set;for(let l of c){if(!w(l))throw Error(`Agent "${a.name}" config.connections must contain connection definitions`);let p=o.get(l);if(p&&p!==a.name)throw Error(`Channel ${l.type} is already attached to agent "${p}" and cannot also attach to "${a.name}"`);if(d.has(l.type))throw Error(`Agent "${a.name}" cannot configure more than one ${l.type} channel`);o.set(l,a.name),d.add(l.type);let u=i!=="default"&&dn(i)?i:a.name,b=t.get(l)??`${u}${mt(l.type)}Channel`;if(r.has(b))throw Error(`Duplicate channel export alias: ${b}`);r.add(b),s.push({alias:b,type:l.type,id:b,agentName:a.name})}}for(let[i,a]of t)if(!o.has(i))throw Error(`Channel "${a}" must be attached to exactly one agent`);return s.sort((i,a)=>i.alias.localeCompare(a.alias))}function Ko(e,n){for(let{resource:t}of e){if(t.kind!=="agent")continue;let o=t.config.connections;if(!Array.isArray(o))continue;for(let r of o){if(!w(r))continue;if(ft(r,n).length>0)continue;throw Error(`Agent "${t.name}" connection "${r.type}" reaches no rooms: declare a ${r.type} channel for it, or set allowedChannelIds: ["*"] to answer everywhere`)}}}function ft(e,n){let t=e.config.allowedChannelIds??[];if(t.includes(Ae))return[Ae];return[...new Set([...n.get(e)??[],...t])]}function Ho(e){let n=new Map;for(let t of e){if(t.kind!=="channelRecord")continue;let o=t.config;if(!w(o.connection))continue;let r=ht(t.name,o.externalId);if(r.length===0)continue;let s=n.get(o.connection)??new Set;for(let i of r)s.add(i);n.set(o.connection,s)}return n}function mt(e){return e.charAt(0).toUpperCase()+e.slice(1)}function dn(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)}async function Yo(e,n,t){let o=e.resource;if(o.kind==="agent"){let r=nr(o,n,t);return[...r.hookResource?[r.hookResource]:[],{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:r.config}]}if(o.kind==="channelRecord"){let r=o.config,s=ht(o.name,r.externalId);return s.map((i)=>({kind:o.kind,name:s.length===1?o.name:`${o.name}-${i}`,...o.description?{description:o.description}:{},config:fr(o.name,{...r,externalId:i})}))}return[{kind:o.kind,name:o.name,...o.description?{description:o.description}:{},config:await zo(e,n)}]}function ht(e,n){if(n===void 0)return[];if(typeof n==="string")return nt(e,n),[n];if(!Array.isArray(n))throw Error(`Channel "${e}" externalId must be a string or an array`);if(n.length===0)throw Error(`Channel "${e}" externalId must not be an empty array`);let t=new Set;for(let o of n){if(typeof o!=="string"||o.length===0)throw Error(`Channel "${e}" externalId must be an array of non-empty strings`);if(t.has(o))throw Error(`Channel "${e}" externalId lists ${o} twice`);nt(e,o),t.add(o)}return n}function nt(e,n){if(n!==Ae)return;throw Error(`Channel "${e}" cannot use "${Ae}" as its id: a record matches one exact room. To answer everywhere, set allowedChannelIds: ["${Ae}"] on the connection; undeclared rooms already fall back to its agent.`)}async function zo(e,n){let t=e.resource;if(t.kind==="skill")return await cr(t.config,n);if(t.kind==="workspace"){let o={...t.config};if(o.partitioned!==void 0){if(typeof o.partitioned!=="boolean")throw Error(`Workspace "${t.name}" config.partitioned must be a boolean`);let r=o.partitioned;if(delete o.partitioned,r)o.isolation=!0}return Q(o)}if(t.kind==="mcp")return await lr(e,t.config,n);if(t.kind==="policy"){let o={...t.config};return o.version=o.version??1,Q(o)}if(t.kind==="cron"){let o={...t.config},r=o.agent;if(o.agentId=g(r)?r.name:r,o.name=o.name??t.name,o.status===void 0)o.status="active";if(delete o.agent,typeof o.input==="string")o.events=[{role:"user",content:[{type:"text",text:o.input}]}],delete o.input;return Q(o)}return Q(t.config)}var Vo=new Set(["apiKey","base_url","baseURL"]),Jo=new Set(["activeTools","debug","inactiveTools","permissionMode","startupTimeoutMs","type","webSearch"]),qo=new Set(["enabled","level","subsystems"]);function Zo(e){if(Vo.has(e))return"";let n=e.replace(/[^a-z0-9]/gi,"").toLowerCase();if(n==="baseurl")return'"base_url" or "baseURL"';if(n==="apikey")return'"apiKey"';return""}function Xo(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.provider must be an object`);for(let[t,o]of Object.entries(n)){if(!zn(t))throw Error(`Agent "${e}" config.provider.${t} is not a supported provider (expected one of: ${Yn.join(", ")})`);if(typeof o!=="object"||o===null||Array.isArray(o))throw Error(`Agent "${e}" config.provider.${t} must be an object`);let r=o;for(let s of Object.keys(r)){let i=Zo(s);if(i)throw Error(`Agent "${e}" config.provider.${t} has unknown option "${s}". Did you mean ${i}?`)}if(t==="custom"&&r.base_url===void 0&&r.baseURL===void 0)throw Error(`Agent "${e}" config.provider.custom.base_url is required (use "base_url" or "baseURL")`)}}function Qo(e,n){if(n===void 0||n===null)return;if(typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.harness must be an object`);let t=n;if("sandbox"in t)throw Error(`Agent "${e}" harness sandbox was removed; list it first in the agent's sandboxes`);for(let o of Object.keys(t))if(!Jo.has(o))throw Error(`Agent "${e}" config.harness has unknown option "${o}"`);if(t.type!=="claude-code"&&t.type!=="codex"&&t.type!=="deepagents"&&t.type!=="opencode"&&t.type!=="pi")throw Error(`Agent "${e}" config.harness.type must be claude-code, codex, deepagents, opencode, or pi`);if(t.permissionMode!==void 0&&t.permissionMode!=="allow-reads"&&t.permissionMode!=="allow-edits"&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-reads, allow-edits, or allow-all`);if(t.type==="codex"&&t.permissionMode!==void 0&&t.permissionMode!=="allow-all")throw Error(`Agent "${e}" config.harness.permissionMode must be allow-all for codex`);if(t.startupTimeoutMs!==void 0&&(typeof t.startupTimeoutMs!=="number"||!Number.isSafeInteger(t.startupTimeoutMs)||t.startupTimeoutMs<1||t.startupTimeoutMs>600000))throw Error(`Agent "${e}" config.harness.startupTimeoutMs must be an integer from 1 to 600000`);if(t.webSearch!==void 0&&typeof t.webSearch!=="boolean")throw Error(`Agent "${e}" config.harness.webSearch must be a boolean`);if(t.type!=="codex"&&t.webSearch!==void 0)throw Error(`Agent "${e}" config.harness.webSearch is only supported by codex`);if(t.type==="pi"&&t.startupTimeoutMs!==void 0)throw Error(`Agent "${e}" config.harness.startupTimeoutMs is not supported by pi`);if(un(e,t.activeTools,"activeTools"),un(e,t.inactiveTools,"inactiveTools"),t.activeTools!==void 0&&t.inactiveTools!==void 0)throw Error(`Agent "${e}" config.harness must use either activeTools or inactiveTools, not both`);er(e,t.debug)}function er(e,n){if(n===void 0)return;if(typeof n!=="object"||n===null||Array.isArray(n))throw Error(`Agent "${e}" config.harness.debug must be an object`);let t=n;for(let o of Object.keys(t))if(!qo.has(o))throw Error(`Agent "${e}" config.harness.debug has unknown option "${o}"`);if(t.enabled!==void 0&&typeof t.enabled!=="boolean")throw Error(`Agent "${e}" config.harness.debug.enabled must be a boolean`);if(t.level!==void 0&&t.level!=="error"&&t.level!=="warn"&&t.level!=="info"&&t.level!=="debug"&&t.level!=="trace")throw Error(`Agent "${e}" config.harness.debug.level must be error, warn, info, debug, or trace`);un(e,t.subsystems,"debug.subsystems")}function un(e,n,t){if(n!==void 0&&(!Array.isArray(n)||!n.every((o)=>typeof o==="string"&&o.trim().length>0)))throw Error(`Agent "${e}" config.harness.${t} must be an array of non-empty strings`)}function nr(e,n,t){let o={...e.config};Xo(e.name,o.provider),Qo(e.name,o.harness);let r=Array.isArray(o.sandboxes)?o.sandboxes.map((i)=>g(i)?i.name:i):void 0;if(r)o.sandboxes=r;r?.forEach((i,a)=>{if(r.indexOf(i)===a)return;throw Error(`Agent "${e.name}" sandboxes[${a}] "${String(i)}" is listed more than once`)});let s=tr(e.name,o.hooks);if(s)o.hooks=s.agentHooksConfig;else if(o.hooks!==void 0)o.hooks=wt(o.hooks,e.name);if(o.connections!==void 0){if(!Array.isArray(o.connections))throw Error(`Agent "${e.name}" config.connections must be an array of connection definitions`);o.channels=Object.fromEntries(o.connections.map((i)=>{if(!w(i))throw Error(`Agent "${e.name}" config.connections must contain connection definitions`);let a=`${e.name}${mt(i.type)}Channel`,c=ft(i,t);return[i.type,{id:a,...i.config,...i.partition?{partition:i.partition}:{},allowedChannelIds:c}]})),delete o.connections}if(Array.isArray(o.workspaces)){let i=o.workspaces.map((a)=>gr(a,e.name));for(let a of i){let c=r?.indexOf(a.sandbox)??-1;if(c>=1)throw Error(`Agent "${e.name}" sandboxes[${c}] "${String(a.sandbox)}" also backs workspace "${String(a.name)}"; only the first sandbox can back a workspace`)}o.workspaces=i}if(o.harness&&!r?.length)throw Error(`Agent "${e.name}" runs a harness, so it needs sandboxes; the first runs the harness`);if(o.policies!==void 0){let i=sr(o.policies,e.name);if(i)o.policies=i;else delete o.policies}return{config:Q(o),...s?.hookResource?{hookResource:s.hookResource}:{}}}function tr(e,n){if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n))throw Error(`Agent "${e}" config.hooks must be an object`);let t=n,o=Object.keys(cn).flatMap((d)=>{let l=t[d];if(l===void 0)return[];if(typeof l!=="function")throw Error(`Agent "${e}" config.hooks.${d} must be a function`);return[{name:d,event:cn[d],source:or(l.toString())}]});if(o.length===0)return;let r=`${e}-hooks`,s=rr(e,o),i=Buffer.byteLength(s);if(i>We)throw Error(`Agent "${e}" hook bundle is too large (${i} bytes, max ${We})`);let a=o.map((d)=>d.event),c=wt(t,e);return c.code=[{hookId:r}],{agentHooksConfig:c,hookResource:{kind:"hook",name:r,description:`Inline hooks for agent ${e}`,config:{events:a,bundle:s,sha256:xe(s)}}}}function wt(e,n){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Agent "${n}" config.hooks must be an object`);let t=Object.entries(e);for(let[r]of t){if(r==="webhooks"||r in cn)continue;throw Error(`Agent "${n}" config.hooks.${r} is not supported. Use inline hook callbacks or hooks.webhooks.`)}return Object.fromEntries(t.filter(([r])=>r==="webhooks"))}function or(e){let n=e.trim();if(/^(async\s+)?function\b/.test(n)||/^(async\s*)?\(/.test(n)||/^(async\s+)?[A-Za-z_$][\w$]*\s*=>/.test(n))return n;if(/^(async\s+)?[A-Za-z_$][\w$]*\s*\(/.test(n))return n.replace(/^(async\s+)?/,"$1function ");return n}function rr(e,n){let t=`export default {
 ${n.map((o)=>`  ${JSON.stringify(o.event)}: ${o.source},`).join(`
 `)}
 };
-`;try{return tt(t,{loader:"ts"}).code}catch(o){let r=o instanceof Error?o.message:String(o);throw Error(`Agent "${e}" inline hooks failed to transpile: ${r}`)}}function qo(e,n){if(!Array.isArray(e))throw Error(`Agent "${n}" config.policies must be an array`);let t=e.map((o)=>{if(g(o)&&o.kind==="policy")return o.name;if(typeof o==="string")return o;throw Error(`Agent "${n}" config.policies must contain definePolicy(...) resources or strings`)});return t.length>0?t:void 0}async function Zo(e,n){let t=await Xn(le(nt(),"broods-mcp-"));try{let o=le(t,"server.mjs");await tn(o,n,"utf8");let r;try{r=await import(Zn(o).href)}catch(a){throw Error(`MCP server bundle ${e} failed to import: ${a instanceof Error?a.message:String(a)}`)}let s=r.default;if(!(typeof s==="function"||typeof s==="object"&&s!==null&&typeof s.fetch==="function"))throw Error(`MCP server bundle ${e} default export must be a fetch handler (createMcpHandler)`)}finally{await et(t,{recursive:!0,force:!0})}}async function Xo(e){let n=await po({entryPoints:[e.entryPoint],bundle:!0,platform:"node",format:"esm",minify:!1,write:!1,logLevel:"silent",plugins:e.plugins??[]}).catch((t)=>{let o=cr(t)?t.errors.map((r)=>r.text).filter(Boolean).join("; "):t instanceof Error?t.message:String(t);throw Error(`${e.label} ${e.manifestPath} failed to build${o?`: ${o}`:""}`)});if(n.outputFiles.length!==1)throw Error(`${e.label} ${e.manifestPath} failed to build: expected one output file`);return n.outputFiles[0].text}async function Qo(e,n){let t=rr(n,e.path,"Skill"),o=ke(n,t).split("\\").join("/"),r=await ir(t);if(!r.some((s)=>s.path==="SKILL.md"))throw Error(`Skill folder ${e.path} must contain SKILL.md`);return{source:"files",path:o,files:r}}async function er(e,n,t){let{handler:o,...r}=n,s=[o,n.url,n.sandbox].filter((l)=>l!==void 0).length;if(s>1)throw Error(`MCP server "${e.resource.name}" declares more than one of url, handler and sandbox; pick one`);if(o===void 0){if(s===0)throw Error(`MCP server "${e.resource.name}" needs url (external), handler (hosted) or sandbox (on a machine)`);return Q(r)}let i=ke(t,e.file).split("\\").join("/");ar(i,"MCP server");let a=await Xn(le(nt(),"broods-mcp-shim-")),c;try{let l=le(a,"mcp-handler.mjs");await tn(l,nr(e),"utf8"),await tn(le(a,"broods-stub.mjs"),fo,"utf8"),c=await Xo({entryPoint:l,label:"MCP server bundle",manifestPath:i,plugins:[tr(a)]})}finally{await et(a,{recursive:!0,force:!0})}let d=Buffer.byteLength(c);if(d>Fn)throw Error(`MCP server bundle ${i} is too large (${d} bytes, max ${Fn})`);return await Zo(i,c),{...Q(r),bundle:c,sha256:Re(c)}}function nr(e){return`import * as __exports from ${JSON.stringify(e.file)};
+`;try{return ct(t,{loader:"ts"}).code}catch(o){let r=o instanceof Error?o.message:String(o);throw Error(`Agent "${e}" inline hooks failed to transpile: ${r}`)}}function sr(e,n){if(!Array.isArray(e))throw Error(`Agent "${n}" config.policies must be an array`);let t=e.map((o)=>{if(g(o)&&o.kind==="policy")return o.name;if(typeof o==="string")return o;throw Error(`Agent "${n}" config.policies must contain definePolicy(...) resources or strings`)});return t.length>0?t:void 0}async function ir(e,n){let t=await rt(le(at(),"broods-mcp-"));try{let o=le(t,"server.mjs");await an(o,n,"utf8");let r;try{r=await import(ot(o).href)}catch(a){throw Error(`MCP server bundle ${e} failed to import: ${a instanceof Error?a.message:String(a)}`)}let s=r.default;if(!(typeof s==="function"||typeof s==="object"&&s!==null&&typeof s.fetch==="function"))throw Error(`MCP server bundle ${e} default export must be a fetch handler (createMcpHandler)`)}finally{await it(t,{recursive:!0,force:!0})}}async function ar(e){let n=await So({entryPoints:[e.entryPoint],bundle:!0,platform:"node",format:"esm",minify:!1,write:!1,logLevel:"silent",plugins:e.plugins??[]}).catch((t)=>{let o=wr(t)?t.errors.map((r)=>r.text).filter(Boolean).join("; "):t instanceof Error?t.message:String(t);throw Error(`${e.label} ${e.manifestPath} failed to build${o?`: ${o}`:""}`)});if(n.outputFiles.length!==1)throw Error(`${e.label} ${e.manifestPath} failed to build: expected one output file`);return n.outputFiles[0].text}async function cr(e,n){let t=pr(n,e.path,"Skill"),o=Se(n,t).split("\\").join("/"),r=await mr(t);if(!r.some((s)=>s.path==="SKILL.md"))throw Error(`Skill folder ${e.path} must contain SKILL.md`);return{source:"files",path:o,files:r}}async function lr(e,n,t){let{handler:o,...r}=n,s=[o,n.url,n.sandbox].filter((l)=>l!==void 0).length;if(s>1)throw Error(`MCP server "${e.resource.name}" declares more than one of url, handler and sandbox; pick one`);if(o===void 0){if(s===0)throw Error(`MCP server "${e.resource.name}" needs url (external), handler (hosted) or sandbox (on a machine)`);return Q(r)}let i=Se(t,e.file).split("\\").join("/");hr(i,"MCP server");let a=await rt(le(at(),"broods-mcp-shim-")),c;try{let l=le(a,"mcp-handler.mjs");await an(l,dr(e),"utf8"),await an(le(a,"broods-stub.mjs"),$o,"utf8"),c=await ar({entryPoint:l,label:"MCP server bundle",manifestPath:i,plugins:[ur(a)]})}finally{await it(a,{recursive:!0,force:!0})}let d=Buffer.byteLength(c);if(d>Jn)throw Error(`MCP server bundle ${i} is too large (${d} bytes, max ${Jn})`);return await ir(i,c),{...Q(r),bundle:c,sha256:xe(c)}}function dr(e){return`import * as __exports from ${JSON.stringify(e.file)};
 const __mcp = __exports[${JSON.stringify(e.exportName)}];
 export default __mcp?.config?.handler ?? __mcp?.handler;
-`}function tr(e){let n=le(e,"broods-stub.mjs");return{name:"broods-sdk-stub",setup:function(t){t.onResolve({filter:/^broods(\/.*)?$/},()=>({path:n}))}}}function or(e,n){if(g(e))return{name:e.name,workspaceId:e.name};if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace,o=g(t)?t.name:t;if(typeof o!=="string")throw Error(`Agent ${n} workspace ref must be a defineWorkspace(...) resource or its name`);let r={name:o,workspaceId:o};if("sandbox"in e){let s=e.sandbox;r.sandbox=s===null?null:g(s)?s.name:s}return r}throw Error(`Agent ${n} workspaces must be defineWorkspace(...) resources or { workspace, sandbox } refs`)}function rr(e,n,t){if(n.trim().length===0)throw Error(`${t} path is required`);if(n.includes("\x00"))throw Error(`${t} path must not contain null bytes`);let o=Me(e),r=Me(o,n),s=ke(o,r);if(s===""||!s.startsWith("..")&&!go(s))return r;throw Error(`${t} path ${n} must stay inside ${S}/`)}function sr(e,n){let t={...n},o=t.connection;if(!w(o))throw Error(`Channel "${e}" config.connection must be a connection definition`);return delete t.connection,t.platform=o.type,st(t.partition,`Channel "${e}"`),Q(t)}function Q(e){if(Array.isArray(e))return e.map((n)=>Q(n));if(g(e))return e.name;if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).map(([n,t])=>[n,Q(t)]));return e}async function ir(e){let n=[],t=0;async function o(r){let s=await Qn(r,{withFileTypes:!0});for(let i of s){let a=le(r,i.name),c=ke(e,a).split("\\").join("/");if(i.isDirectory()){if(qn(i.name))continue;await o(a)}else if(i.isFile()){if(qn(i.name)||gt(c))continue;let d=await lo(a);if(d.byteLength>Be)throw Error(`Skill bundle file ${c} is too large (${d.byteLength} bytes, max ${Be})`);if(t+=d.byteLength,t>Kn)throw Error(`Skill bundle at ${e} is too large (${t} bytes, max ${Kn})`);if(n.length>=Hn)throw Error(`Skill bundle at ${e} has too many files (max ${Hn})`);n.push({path:c,size:d.byteLength,sha256:Re(d),contentBase64:d.toString("base64"),contentType:lr(c)})}}}return await o(e),n.sort((r,s)=>String(r.path).localeCompare(String(s.path)))}function qn(e){return e.startsWith(".")||mo.has(e)}function ar(e,n){if(gt(e))throw Error(`${n} bundle path ${e} looks like a hidden file or secret and will not be bundled`)}function cr(e){return e instanceof Error&&Array.isArray(e.errors)}function gt(e){return e.split("/").some((t)=>t.startsWith(".")||ho.some((o)=>o.test(t)))}function Re(e){return ao("sha256").update(e).digest("hex")}function lr(e){if(e.endsWith(".md"))return"text/markdown; charset=utf-8";if(e.endsWith(".json"))return"application/json";if(e.endsWith(".js")||e.endsWith(".mjs"))return"application/javascript";if(e.endsWith(".ts"))return"text/typescript; charset=utf-8";if(e.endsWith(".txt"))return"text/plain; charset=utf-8";return"application/octet-stream"}function dr(e){return e.replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")}import{mkdir as ur,writeFile as Ge}from"node:fs/promises";import{resolve as Ae}from"node:path";async function We(e,n,t=process.cwd(),o={},r=null,s=[]){let i=Ae(t,S,_),a=gr(n,e);await ur(i,{recursive:!0}),await Ge(Ae(i,"ids.ts"),mr(a),"utf8"),await Ge(Ae(i,"api.ts"),pr(e,a,o,r,s),"utf8"),await Ge(Ae(i,"resources.ts"),hr(e),"utf8"),await Ge(Ae(i,"dataModel.ts"),fr(),"utf8")}function gr(e,n){let t={agents:ue(n,"agent"),workspaces:ue(n,"workspace"),sandboxes:ue(n,"sandbox"),crons:ue(n,"cron"),skills:ue(n,"skill"),mcp:ue(n,"mcp"),policies:ue(n,"policy"),channelRecords:ue(n,"channelRecord")};return{agents:ge(e.agents,t.agents),workspaces:ge(e.workspaces,t.workspaces),sandboxes:ge(e.sandboxes,t.sandboxes),crons:ge(e.crons,t.crons),skills:ge(e.skills,t.skills),hooks:{},mcp:ge(e.mcp,t.mcp),policies:ge(e.policies,t.policies),channelRecords:ge(e.channelRecords,t.channelRecords)}}function ue(e,n){return new Set(e.resources.filter((t)=>t.kind===n).map((t)=>t.name))}function ge(e,n){return Object.fromEntries(Object.entries(e??{}).filter(([t])=>n.has(t)))}function pr(e,n,t,o,r){let s=Object.keys(n.agents),i=o?`, endpointId: ${JSON.stringify(o.endpointId)}, projectSlug: ${JSON.stringify(o.projectSlug)}, stageSlug: ${JSON.stringify(o.stageSlug)}`:"",a=s.map((d)=>`    ${cn(t.agent?.[d]??d)}: { kind: "agent", name: ${JSON.stringify(d)}, id: ids.agents[${JSON.stringify(d)}], project: ${JSON.stringify(e.project)}, stage: ${JSON.stringify(e.stage)}${i} },`).join(`
-`),c=o?r.map((d)=>{let l=encodeURIComponent(o.accountId),p=o.stageKind===void 0||o.stageKind==="production"?`/v1/webhooks/${l}/${encodeURIComponent(d.type)}`:`/v1/webhooks/${l}/dev/${encodeURIComponent(o.endpointId)}/${encodeURIComponent(d.type)}`;return`    ${cn(d.alias)}: { kind: "channel", type: ${JSON.stringify(d.type)}, agentName: ${JSON.stringify(d.agentName)}, agentId: ids.agents[${JSON.stringify(d.agentName)}], accountId: ${JSON.stringify(o.accountId)}, webhookPath: ${JSON.stringify(p)} },`}).join(`
+`}function ur(e){let n=le(e,"broods-stub.mjs");return{name:"broods-sdk-stub",setup:function(t){t.onResolve({filter:/^broods(\/.*)?$/},()=>({path:n}))}}}function gr(e,n){if(g(e))return{name:e.name,workspaceId:e.name};if(e&&typeof e==="object"&&"workspace"in e){let t=e.workspace,o=g(t)?t.name:t;if(typeof o!=="string")throw Error(`Agent ${n} workspace ref must be a defineWorkspace(...) resource or its name`);let r={name:o,workspaceId:o};if("sandbox"in e){let s=e.sandbox;r.sandbox=s===null?null:g(s)?s.name:s}return r}throw Error(`Agent ${n} workspaces must be defineWorkspace(...) resources or { workspace, sandbox } refs`)}function pr(e,n,t){if(n.trim().length===0)throw Error(`${t} path is required`);if(n.includes("\x00"))throw Error(`${t} path must not contain null bytes`);let o=Ge(e),r=Ge(o,n),s=Se(o,r);if(s===""||!s.startsWith("..")&&!ko(s))return r;throw Error(`${t} path ${n} must stay inside ${y}/`)}function fr(e,n){let t={...n},o=t.connection;if(!w(o))throw Error(`Channel "${e}" config.connection must be a connection definition`);return delete t.connection,t.platform=o.type,ut(t.partition,`Channel "${e}"`),Q(t)}function Q(e){if(Array.isArray(e))return e.map((n)=>Q(n));if(g(e))return e.name;if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).map(([n,t])=>[n,Q(t)]));return e}async function mr(e){let n=[],t=0;async function o(r){let s=await st(r,{withFileTypes:!0});for(let i of s){let a=le(r,i.name),c=Se(e,a).split("\\").join("/");if(i.isDirectory()){if(tt(i.name))continue;await o(a)}else if(i.isFile()){if(tt(i.name)||bt(c))continue;let d=await yo(a);if(d.byteLength>We)throw Error(`Skill bundle file ${c} is too large (${d.byteLength} bytes, max ${We})`);if(t+=d.byteLength,t>qn)throw Error(`Skill bundle at ${e} is too large (${t} bytes, max ${qn})`);if(n.length>=Zn)throw Error(`Skill bundle at ${e} has too many files (max ${Zn})`);n.push({path:c,size:d.byteLength,sha256:xe(d),contentBase64:d.toString("base64"),contentType:br(c)})}}}return await o(e),n.sort((r,s)=>String(r.path).localeCompare(String(s.path)))}function tt(e){return e.startsWith(".")||Eo.has(e)}function hr(e,n){if(bt(e))throw Error(`${n} bundle path ${e} looks like a hidden file or secret and will not be bundled`)}function wr(e){return e instanceof Error&&Array.isArray(e.errors)}function bt(e){return e.split("/").some((t)=>t.startsWith(".")||Co.some((o)=>o.test(t)))}function xe(e){return ho("sha256").update(e).digest("hex")}function br(e){if(e.endsWith(".md"))return"text/markdown; charset=utf-8";if(e.endsWith(".json"))return"application/json";if(e.endsWith(".js")||e.endsWith(".mjs"))return"application/javascript";if(e.endsWith(".ts"))return"text/typescript; charset=utf-8";if(e.endsWith(".txt"))return"text/plain; charset=utf-8";return"application/octet-stream"}function yr(e){return e.replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")}import{mkdir as vr,writeFile as Fe}from"node:fs/promises";import{resolve as Pe}from"node:path";async function Ke(e,n,t=process.cwd(),o={},r=null,s=[]){let i=Pe(t,y,_),a=kr(n,e);await vr(i,{recursive:!0}),await Fe(Pe(i,"ids.ts"),Er(a),"utf8"),await Fe(Pe(i,"api.ts"),Sr(e,a,o,r,s),"utf8"),await Fe(Pe(i,"resources.ts"),Cr(e),"utf8"),await Fe(Pe(i,"dataModel.ts"),$r(),"utf8")}function kr(e,n){let t={agents:ue(n,"agent"),workspaces:ue(n,"workspace"),sandboxes:ue(n,"sandbox"),crons:ue(n,"cron"),skills:ue(n,"skill"),mcp:ue(n,"mcp"),policies:ue(n,"policy"),channelRecords:ue(n,"channelRecord")};return{agents:ge(e.agents,t.agents),workspaces:ge(e.workspaces,t.workspaces),sandboxes:ge(e.sandboxes,t.sandboxes),crons:ge(e.crons,t.crons),skills:ge(e.skills,t.skills),hooks:{},mcp:ge(e.mcp,t.mcp),policies:ge(e.policies,t.policies),channelRecords:ge(e.channelRecords,t.channelRecords)}}function ue(e,n){return new Set(e.resources.filter((t)=>t.kind===n).map((t)=>t.name))}function ge(e,n){return Object.fromEntries(Object.entries(e??{}).filter(([t])=>n.has(t)))}function Sr(e,n,t,o,r){let s=Object.keys(n.agents),i=o?`, endpointId: ${JSON.stringify(o.endpointId)}, projectSlug: ${JSON.stringify(o.projectSlug)}, stageSlug: ${JSON.stringify(o.stageSlug)}`:"",a=s.map((d)=>`    ${gn(t.agent?.[d]??d)}: { kind: "agent", name: ${JSON.stringify(d)}, id: ids.agents[${JSON.stringify(d)}], project: ${JSON.stringify(e.project)}, stage: ${JSON.stringify(e.stage)}${i} },`).join(`
+`),c=o?r.map((d)=>{let l=encodeURIComponent(o.accountId),p=o.stageKind===void 0||o.stageKind==="production"?`/v1/webhooks/${l}/${encodeURIComponent(d.type)}`:`/v1/webhooks/${l}/dev/${encodeURIComponent(o.endpointId)}/${encodeURIComponent(d.type)}`;return`    ${gn(d.alias)}: { kind: "channel", type: ${JSON.stringify(d.type)}, agentName: ${JSON.stringify(d.agentName)}, agentId: ids.agents[${JSON.stringify(d.agentName)}], accountId: ${JSON.stringify(o.accountId)}, webhookPath: ${JSON.stringify(p)} },`}).join(`
 `):"";return`// Generated by broods. Do not edit by hand.
 import type { ResourceApi } from "broods";
 import { ids } from "./ids";
@@ -60,15 +60,15 @@ ${a}
   channels: {
 ${c}
   },
-  workspaces: ${xe("workspaces",n.workspaces,t.workspace)},
-  sandboxes: ${xe("sandboxes",n.sandboxes,t.sandbox)},
-  crons: ${xe("crons",n.crons,t.cron)},
-  skills: ${xe("skills",n.skills,t.skill)},
-  policies: ${xe("policies",n.policies,t.policy)},
+  workspaces: ${je("workspaces",n.workspaces,t.workspace)},
+  sandboxes: ${je("sandboxes",n.sandboxes,t.sandbox)},
+  crons: ${je("crons",n.crons,t.cron)},
+  skills: ${je("skills",n.skills,t.skill)},
+  policies: ${je("policies",n.policies,t.policy)},
 } as const satisfies ResourceApi;
-`}function fr(){return`// Generated by broods. Do not edit by hand.
+`}function $r(){return`// Generated by broods. Do not edit by hand.
 export type { AgentReference, ChannelReference, AgentRunInput, AgentRunResult, ResourceApi } from "broods";
-`}function mr(e){return`// Generated by broods. Do not edit by hand.
+`}function Er(e){return`// Generated by broods. Do not edit by hand.
 export const ids = ${JSON.stringify(e,null,2)} as const;
 export const agents = ids.agents;
 export const workspaces = ids.workspaces;
@@ -76,18 +76,19 @@ export const sandboxes = ids.sandboxes;
 export const crons = ids.crons;
 export const skills = ids.skills;
 export const policies = ids.policies;
-`}function hr(e){return`// Generated by broods. Do not edit by hand.
+`}function Cr(e){return`// Generated by broods. Do not edit by hand.
 export const manifest = ${JSON.stringify(e,null,2)} as const;
-`}function xe(e,n,t){let o=Object.keys(n);if(o.length===0)return"{}";return`{
-${o.map((s)=>`    ${cn(t?.[s]??s)}: ids.${e}[${JSON.stringify(s)}],`).join(`
+`}function je(e,n,t){let o=Object.keys(n);if(o.length===0)return"{}";return`{
+${o.map((s)=>`    ${gn(t?.[s]??s)}: ids.${e}[${JSON.stringify(s)}],`).join(`
 `)}
-  }`}function cn(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)?e:JSON.stringify(e)}var wr=1,br=0;function se(e,n){return new Promise((t)=>{if(n?.aborted)return t();let o=setTimeout(t,e);n?.addEventListener("abort",()=>{clearTimeout(o),t()},{once:!0})})}function fe(){let e=globalThis.WebSocket;if(!e)throw Error("WebSocket is not available in this environment.");return e}class D extends Error{}async function*Fe(e,n={}){let t=new Set,o=500;while(!n.signal?.aborted){try{for await(let r of yr(e,n)){let s=`${r.ts}|${r.eventType}|${r.message}`;if(t.has(s))continue;if(t.add(s),t.size>5000)t.delete(t.values().next().value);o=500,yield r}}catch(r){if(n.signal?.aborted)return;let s=r instanceof Error?r.message:String(r);if(r instanceof D||/unauthorized|invalid websocket token|scope does not match/i.test(s))throw r}await se(o,n.signal),o=Math.min(o*2,5000)}}async function*yr(e,n){let{baseUrl:t,credential:o,project:r,stage:s}=e,{backfill:i=0,minLevel:a,sandboxId:c,signal:d}=n,l=n.liveOnly??i<=0;if(d?.aborted)return;let p=vr(t,r,s),u=p,b=fe(),k=[],C=null,A=!1,ae=null,V=()=>{ae?.(),ae=null},ce=new b(p,z(await o())),nn=()=>{if(ce.readyState===wr||ce.readyState===br)ce.close(1000,"client closed");d?.removeEventListener("abort",Ln)},Ln=()=>{A=!0,V(),nn()};d?.addEventListener("abort",Ln,{once:!0}),ce.onopen=()=>{if(d?.aborted){nn();return}let X={type:"subscribe",stream:"logs",...i>0?{backfill:i}:{},...l?{liveOnly:!0}:{},...a!==void 0?{minLevel:a}:{},...c!==void 0?{sandboxId:c}:{}};ce.send(JSON.stringify(X))},ce.onmessage=(X)=>{let ve=kr(X.data);if(!ve)return;switch(ve.type){case"backfill":if(ve.stream==="logs"){for(let so of ve.entries)k.push(so);V()}break;case"log":k.push(ve.entry),V();break;case"error":C=Error(`Observability gateway error: ${ve.error}`),A=!0,V();break;case"ready":break;default:break}},ce.onerror=()=>{C=Error(`Cannot connect to the observability gateway at ${u}.`),A=!0,V()},ce.onclose=(X)=>{if(!A){if(X.code!==1000)C=Error(X.reason?`Observability WebSocket closed: ${X.reason}`:`Observability WebSocket closed with code ${X.code}.`);A=!0,V()}};try{while(!0){if(k.length>0){yield k.shift();continue}if(C)throw C;if(A)return;await new Promise((X)=>{ae=X})}}finally{nn()}}function vr(e,n,t){return`${Y(e)}/v1/projects/${encodeURIComponent(n)}/stages/${encodeURIComponent(t)}/observability/ws`}function kr(e){if(typeof e!=="string")return null;try{let n=JSON.parse(e);return typeof n==="object"&&n!==null&&typeof n.type==="string"?n:null}catch{return null}}var Sr=new Set(["bundle","bundleStorageId","contentBase64"]),$r=new Set(["hook","mcp","skill"]);class He extends Error{}class N{baseUrl;token;fetchImpl;constructor(e){this.baseUrl=f(e.baseUrl),this.token=e.token,this.fetchImpl=e.fetch??fetch}async getManifest(e,n){let t=await this.request(e,n,"/manifest",{method:"GET"});if(t.status===404)return null;return await U(t,"Fetch manifest failed"),await t.json()}async putManifest(e,n,t=!1,o){let r=await this.externalizeLargeMcpBundles(e),s=await this.request(e.project,e.stage,"/manifest",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({manifest:r,prune:n,rotateRuntimeKey:t,...o!==void 0?{revision:o}:{}})});return await U(s,"Sync manifest failed"),await s.json()}async externalizeLargeMcpBundles(e){if(e.resources.every((t)=>mt(t)===null))return e;let n=await Promise.all(e.resources.map(async(t)=>{let o=mt(t);if(o===null)return t;let{bundle:r,...s}=t.config,i=await this.uploadMcpBundle(e.project,e.stage,o);return{...t,config:{...s,bundleStorageId:i,sha256:Re(o)}}}));return{...e,resources:n}}async uploadMcpBundle(e,n,t){let o=await this.request(e,n,"/mcp-bundle-uploads",{method:"POST"});await U(o,"Mint bundle upload URL failed");let{uploadUrl:r}=await o.json();if(!r)throw Error("Mint bundle upload URL failed: response omitted uploadUrl");let s=await this.fetchImpl(r,{method:"POST",headers:{"Content-Type":"application/javascript"},body:t});await U(s,"Bundle upload failed");let{storageId:i}=await s.json();if(!i)throw Error("Bundle upload failed: response omitted storageId");return i}async getRuntimeKey(e,n){let t=await this.request(e,n,"/runtime-key",{method:"GET"});if(t.status===404)return null;await U(t,"Fetch runtime key failed");let o=await t.json();if(!o.apiKey)throw Error("Fetch runtime key failed: response omitted apiKey");return{apiKey:o.apiKey,keyHint:o.keyHint??"",...o.endpointId?{endpointId:o.endpointId}:{},...o.projectSlug?{projectSlug:o.projectSlug}:{},...o.stageSlug?{stageSlug:o.stageSlug}:{}}}async setEnv(e,n,t,o){let r=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({value:o})});await U(r,"Set environment variable failed")}async listEnv(e,n){let t=await this.request(e,n,"/env",{method:"GET"});return await U(t,"List environment variables failed"),(await t.json()).variables??[]}async getEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"GET"});if(o.status===404)return null;return await U(o,"Read environment variable failed"),(await o.json()).value??null}async removeEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"DELETE"});await U(o,"Remove environment variable failed")}async getOnboarding(){let e=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return await U(e,"Fetch CLI onboarding context failed"),await e.json()}async selectOnboardingOrg(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({orgId:e})});return await U(n,"Select CLI org failed"),await n.json()}async listStages(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/stages?project=${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return Pe(n,"/v1/account/stages","broods stage"),await U(n,"List stages failed"),(await n.json()).stages??[]}async createStage(e,n,t){let o=await this.fetchImpl(`${this.baseUrl}/v1/account/stages`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,name:n,...t?{from:t}:{}})});return Pe(o,"/v1/account/stages","broods stage"),await U(o,"Create stage failed"),await o.json()}async mintStageSession(e,n){let t=await this.fetchImpl(`${this.baseUrl}/v1/account/stage-session`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,stage:n})});Pe(t,"/v1/account/stage-session","broods logs");try{await U(t,"Open stage session failed")}catch(o){if(t.status===401||t.status===404)throw new D(o instanceof Error?o.message:String(o));throw o}return await t.json()}async listProjects(){let e=await this.fetchImpl(`${this.baseUrl}/v1/account/projects`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return Pe(e,"/v1/account/projects","broods project"),await U(e,"List projects failed"),(await e.json()).projects??[]}async deleteProject(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/projects?projectId=${encodeURIComponent(e)}`,{method:"DELETE",headers:{Authorization:`Bearer ${this.token}`}});if(Pe(n,"/v1/account/projects","broods project"),n.status===404)return null;return await U(n,"Delete project failed"),(await n.json()).deleted??null}async createOnboardingOrg(e){let n=await this.fetchImpl(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({createOrgName:e})});return await U(n,"Create CLI org failed"),await n.json()}async request(e,n,t,o){let r=`${this.baseUrl}/v1/account/projects/${encodeURIComponent(e)}/stages/${encodeURIComponent(n)}${t}`;return await this.fetchImpl(r,{...o,headers:{Authorization:`Bearer ${this.token}`,...o.headers}})}}function pn(e,n){let t=new Map((n?.resources??[]).map((d)=>[`${d.kind}:${d.name}`,d])),o=new Map(e.resources.map((d)=>[`${d.kind}:${d.name}`,d])),r=[],s=[],i=[];for(let[d,l]of o){let p=t.get(d);if(!p)s.push({key:d,resource:l});else if(Ke(dn(p))!==Ke(dn(l)))r.push({operation:"update",kind:l.kind,name:l.name})}for(let[d,l]of t)if(!o.has(d))i.push({key:d,resource:l});let a=new Set,c=new Set;for(let d of s){let l=i.find((p)=>!a.has(p.key)&&Er(d.resource.kind)&&d.resource.kind===p.resource.kind&&Ke(ft(d.resource))===Ke(ft(p.resource)));if(!l)continue;c.add(d.key),a.add(l.key),r.push({operation:"rename",kind:d.resource.kind,name:d.resource.name,previousName:l.resource.name})}for(let{key:d,resource:l}of s)if(!c.has(d))r.push({operation:"create",kind:l.kind,name:l.name});for(let{key:d,resource:l}of i)if(!a.has(d))r.push({operation:"delete",kind:l.kind,name:l.name});return r.sort((d,l)=>pt(d).localeCompare(pt(l)))}function pt(e){return`${{create:0,rename:1,update:2,delete:3}[e.operation]}:${e.kind}:${e.previousName??""}:${e.name}`}function Er(e){return e==="agent"||e==="workspace"||e==="sandbox"||e==="policy"}function ln(e){if(Array.isArray(e))return e.map(ln);if(e&&typeof e==="object"){let n=e;if(n.__beeblastEnv===!0&&typeof n.name==="string")return`\${${n.name}}`;return Object.fromEntries(Object.entries(n).map(([t,o])=>[t,ln(o)]))}return e}function ft(e){let n=dn(e),{name:t,...o}=n;return o}function dn(e){let n=ln(e);if(!$r.has(e.kind))return n;return{...n,config:gn(n.config)}}function un(e){if(Array.isArray(e))return e.map(un);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).sort(([n],[t])=>n.localeCompare(t)).map(([n,t])=>[n,un(t)]));return e}function Ke(e){return JSON.stringify(un(e))}function gn(e){if(Array.isArray(e))return e.map(gn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).flatMap(([n,t])=>{if(Sr.has(n))return[];return[[n,gn(t)]]}));return e}async function U(e,n){if(e.ok)return;let t=await e.text(),{message:o=t,code:r}=Cr(t);if(r==="manifest_conflict")throw new He(o);let s=e.status===401?"\nRun `broods login` to sign in again.":"";throw Error(`${n}: ${e.status} ${o}${s}`)}function Cr(e){let n;try{n=JSON.parse(e)}catch{return{}}let t=typeof n==="object"&&n!==null&&"error"in n?n.error:void 0;if(typeof t!=="object"||t===null)return{};return{..."message"in t&&typeof t.message==="string"?{message:t.message}:{},..."code"in t&&typeof t.code==="string"?{code:t.code}:{}}}function Pe(e,n,t){if(e.status!==404)return;if((e.headers.get("Content-Type")??"").includes("application/json"))return;throw Error(`This broods deployment has no ${n} route yet. Update the backend to use \`${t}\`.`)}function mt(e){if(e.kind!=="mcp")return null;let n=e.config?.bundle;if(typeof n!=="string")return null;return Buffer.byteLength(n)>ot?n:null}var ze=["chatgpt"];var me={chatgpt:{label:"ChatGPT plan",description:"Run agents on model.provider chatgpt with your ChatGPT plan",authorizeUrl:"https://auth.openai.com/api/accounts/authorize",tokenUrl:"https://auth.openai.com/api/accounts/oauth/token",revokeUrl:"https://auth.openai.com/api/accounts/oauth/revoke",jwksUrl:"https://auth.openai.com/.well-known/jwks.json",issuer:"https://auth.openai.com",scopes:["openid","profile","email","offline_access","resource.invoke","chatgpt.tokens.use.direct"],resource:"https://api.openai.com/v1",requiredScope:"chatgpt.tokens.use.direct",selfHostedOnly:"ChatGPT plan usage is only available on self-hosted Broods for now. Use an OpenAI API key with the `openai` provider instead.",modelsUrl:"https://api.openai.com/v1/models",usageUrl:"https://chatgpt.com/settings/usage"}};function fn(e){return ze.some((n)=>n===e)}import{createHash as zr,randomBytes as Yr,randomUUID as Ot}from"node:crypto";import{createServer as Dr}from"node:http";import{createHash as Ur,randomBytes as Nr,randomUUID as Lr}from"node:crypto";import{spawn as Mr}from"node:child_process";import{createInterface as je}from"node:readline/promises";import{stdin as oe,stdout as te}from"node:process";function Se(e,n,t={}){let o=`${n?"*":" "} ${e}`;return n?j(o,"\x1B[1m\x1B[36m",J(t)):o}function ht(e,n={}){let t=J(n),o=(i)=>j(i.padEnd(9),"\x1B[2m",t),r=!e.loggedIn?j("not logged in","\x1B[33m",t):e.org??j("unknown, run broods whoami","\x1B[2m",t),s=e.project??`none ${j(`(${e.projectGuess} from folder name)`,"\x1B[2m",t)}`;return[`  ${o("org")}${r}`,`  ${o("project")}${s}`,`  ${o("stage")}${kt(e.stage,t)}`,`  ${o("server")}${e.server}`]}function Or(e,n={}){let t=J(n),o=St(e.stage),r=o==="Development",s=j("▌",r?"\x1B[32m":"\x1B[33m",t),i=t?`${r?"\x1B[42m\x1B[30m\x1B[1m":"\x1B[43m\x1B[30m\x1B[1m"} ${o} \x1B[0m`:`[${o}]`,a=t?j("dashboard","\x1B[4m",t):"dashboard",c=`${e.dashboardUrl}?project=${encodeURIComponent(e.project)}&stage=${encodeURIComponent(e.stage)}`,d=j(c,"\x1B[2m\x1B[4m",t);return[`${s} Syncing ${o}: ${j(e.project,"",t)}`,`${s} ${i} ${e.stage} (${a})`,`${s} ${j("└─","\x1B[2m",t)} ${d}`].join(`
-`)}function Rr(e,n={}){let t=J(n);return e.map((o)=>{let r=Tr(o.operation,t);if(o.operation==="rename"&&o.previousName)return`  ${r} ${o.kind}:${o.previousName} -> ${o.name}`;return`  ${r} ${o.kind}:${o.name}`})}function Ar(e,n={}){let t=J(n),o=j("▌","\x1B[32m",t),r=j("↑","\x1B[32m",t);return`${o} ${r} Synced ${e.length} env var(s) from .env.local: ${e.join(", ")}`}function xr(e,n={}){return`${j("✖","\x1B[31m",J(n))} ${e}`}function wt(e,n={}){let t=J(n),o=Math.max(...e.map(([r])=>r.length))+2;return e.map(([r,s])=>`  ${r.padEnd(o)}${j(s,"\x1B[2m",t)}`)}function Pr(e,n={}){let t=(n.now??new Date).toTimeString().slice(0,8);return`${j("✔","\x1B[32m",J(n))} ${t} Resources ready! (${_r(e)})`}function jr(e,n={}){return`${j("✔","\x1B[32m",J(n))} ${e}`}function mn(e,n,t={}){let o=J(t),r=t.note?`  ${j(`(${t.note})`,"\x1B[2m",o)}`:"";return`  ${j("now","\x1B[2m",o)}  ${e} → ${kt(n,o)}${r}`}function Ir(e,n={}){return j(`! ${e}`,"\x1B[33m",J(n))}function bt(e){console.error(Or(e))}function Ye(e){for(let n of Rr(e))console.log(n)}function hn(e){console.error(Ar(e))}function yt(e){console.error(xr(e,{stream:"stderr"}))}function vt(e){console.error(Pr(e))}function H(e){console.log(jr(e,{stream:"stdout"}))}function x(e){console.log(Ir(e,{stream:"stdout"}))}function Tr(e,n){if(e==="create")return`[${j("+","\x1B[32m",n)}]`;if(e==="rename")return`[${j("~","\x1B[33m",n)}]`;if(e==="update")return`[${j("*","\x1B[36m",n)}]`;return`[${j("-","\x1B[31m",n)}]`}function _r(e){if(e>=1000)return`${(e/1000).toFixed(2)}s`;return`${Math.max(e,0).toFixed(1)}ms`}function j(e,n,t){return t?`${n}${e}\x1B[0m`:e}function kt(e,n){let t=St(e)==="Development";return j(e,t?"\x1B[32m":"\x1B[33m",n)}function J(e){if(e.color!==void 0)return e.color;if(Object.hasOwn(process.env,"NO_COLOR"))return!1;if(process.env.FORCE_COLOR&&process.env.FORCE_COLOR!=="0")return!0;return(e.stream==="stdout"?process.stdout:process.stderr).isTTY&&process.env.TERM!=="dumb"}function St(e){let n=e.trim().toLowerCase();if(n==="development")return"Development";if(n==="production")return"Production";return e.trim()}var Br=180000,Gr=`Timed out waiting for browser login to complete.
+  }`}function gn(e){return/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(e)?e:JSON.stringify(e)}var Rr=1,Or=0,yt=60000,vt=15000;function se(e,n){return new Promise((t)=>{if(n?.aborted)return t();let o=setTimeout(t,e);n?.addEventListener("abort",()=>{clearTimeout(o),t()},{once:!0})})}function fe(){let e=globalThis.WebSocket;if(!e)throw Error("WebSocket is not available in this environment.");return e}class D extends Error{}async function*He(e,n={}){let t=new Set,o=500,r=0,s=Date.now();while(!n.signal?.aborted){let i=!1,a="the log stream closed";try{for await(let c of Ar(e,n,()=>{i=!0})){let d=`${c.ts}|${c.eventType}|${c.message}`;if(t.has(d))continue;if(t.add(d),t.size>5000)t.delete(t.values().next().value);yield c}}catch(c){if(n.signal?.aborted)return;if(a=c instanceof Error?c.message:String(c),c instanceof D||/unauthorized|invalid websocket token|scope does not match/i.test(a))throw c}if(n.signal?.aborted)return;if(i)o=500,r=0,s=Date.now();if(!n.keepReconnecting&&Date.now()-s>=yt)throw Error(`Gave up reconnecting to the live logs after ${yt/1000} s. Last error: ${a}`);r+=1,n.onReconnect?.(r,a),await se(o,n.signal),o=Math.min(o*2,5000)}}async function*Ar(e,n,t){let{baseUrl:o,credential:r,project:s,stage:i}=e,{backfill:a=0,minLevel:c,sandboxId:d,signal:l}=n,p=n.liveOnly??a<=0;if(l?.aborted)return;let u=xr(o,s,i),b=u,S=fe(),C=[],A=null,V=!1,re=null,me=()=>{re?.(),re=null},ce=new S(u,z(await r())),Fn=setTimeout(()=>{A=Error(`The observability gateway did not answer within ${vt/1000} s.`),V=!0,me()},vt),sn=()=>{if(clearTimeout(Fn),ce.readyState===Rr||ce.readyState===Or)ce.close(1000,"client closed");l?.removeEventListener("abort",Kn)},Kn=()=>{V=!0,me(),sn()};l?.addEventListener("abort",Kn,{once:!0}),ce.onopen=()=>{if(l?.aborted){sn();return}let X={type:"subscribe",stream:"logs",...a>0?{backfill:a}:{},...p?{liveOnly:!0}:{},...c!==void 0?{minLevel:c}:{},...d!==void 0?{sandboxId:d}:{}};ce.send(JSON.stringify(X))},ce.onmessage=(X)=>{let he=Pr(X.data);if(!he)return;if(clearTimeout(Fn),he.type!=="error")t();switch(he.type){case"backfill":if(he.stream==="logs"){for(let fo of he.entries)C.push(fo);me()}break;case"log":C.push(he.entry),me();break;case"error":A=Error(`Observability gateway error: ${he.error}`),V=!0,me();break;case"ready":break;default:break}},ce.onerror=()=>{A=Error(`Cannot connect to the observability gateway at ${b}.`),V=!0,me()},ce.onclose=(X)=>{if(!V){if(X.code!==1000)A=Error(X.reason?`Observability WebSocket closed: ${X.reason}`:`Observability WebSocket closed with code ${X.code}.`);V=!0,me()}};try{while(!0){if(C.length>0){yield C.shift();continue}if(A)throw A;if(V)return;await new Promise((X)=>{re=X})}}finally{sn()}}function xr(e,n,t){return`${Y(e)}/v1/projects/${encodeURIComponent(n)}/stages/${encodeURIComponent(t)}/observability/ws`}function Pr(e){if(typeof e!=="string")return null;try{let n=JSON.parse(e);return typeof n==="object"&&n!==null&&typeof n.type==="string"?n:null}catch{return null}}var jr=new Set(["bundle","bundleStorageId","contentBase64"]),Tr=new Set(["hook","mcp","skill"]),Ir=30000;class ze extends Error{}class Ve extends Error{}class N{baseUrl;token;fetchImpl;constructor(e){this.baseUrl=f(e.baseUrl),this.token=e.token,this.fetchImpl=e.fetch??fetch}async getManifest(e,n){let t=await this.request(e,n,"/manifest",{method:"GET"});if(t.status===404)return null;return await U(t,"Fetch manifest failed"),await t.json()}async putManifest(e,n,t=!1,o){let r=await this.externalizeLargeMcpBundles(e),s=await this.request(e.project,e.stage,"/manifest",{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({manifest:r,prune:n,rotateRuntimeKey:t,...o!==void 0?{revision:o}:{}})},null);return await U(s,"Sync manifest failed"),await s.json()}async externalizeLargeMcpBundles(e){if(e.resources.every((t)=>$t(t)===null))return e;let n=await Promise.all(e.resources.map(async(t)=>{let o=$t(t);if(o===null)return t;let{bundle:r,...s}=t.config,i=await this.uploadMcpBundle(e.project,e.stage,o);return{...t,config:{...s,bundleStorageId:i,sha256:xe(o)}}}));return{...e,resources:n}}async uploadMcpBundle(e,n,t){let o=await this.request(e,n,"/mcp-bundle-uploads",{method:"POST"});await U(o,"Mint bundle upload URL failed");let{uploadUrl:r}=await o.json();if(!r)throw Error("Mint bundle upload URL failed: response omitted uploadUrl");let s=await this.send(r,{method:"POST",headers:{"Content-Type":"application/javascript"},body:t},null);await U(s,"Bundle upload failed");let{storageId:i}=await s.json();if(!i)throw Error("Bundle upload failed: response omitted storageId");return i}async getRuntimeKey(e,n){let t=await this.request(e,n,"/runtime-key",{method:"GET"});if(t.status===404)return null;await U(t,"Fetch runtime key failed");let o=await t.json();if(!o.apiKey)throw Error("Fetch runtime key failed: response omitted apiKey");return{apiKey:o.apiKey,keyHint:o.keyHint??"",...o.endpointId?{endpointId:o.endpointId}:{},...o.projectSlug?{projectSlug:o.projectSlug}:{},...o.stageSlug?{stageSlug:o.stageSlug}:{}}}async setEnv(e,n,t,o){let r=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"PUT",headers:{"Content-Type":"application/json"},body:JSON.stringify({value:o})});await U(r,"Set environment variable failed")}async listEnv(e,n){let t=await this.request(e,n,"/env",{method:"GET"});return await U(t,"List environment variables failed"),(await t.json()).variables??[]}async getEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"GET"});if(o.status===404)return null;return await U(o,"Read environment variable failed"),(await o.json()).value??null}async removeEnv(e,n,t){let o=await this.request(e,n,`/env/${encodeURIComponent(t)}`,{method:"DELETE"});await U(o,"Remove environment variable failed")}async getOnboarding(){let e=await this.send(`${this.baseUrl}/v1/account/onboarding`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return $e(e,"/v1/account/onboarding","broods org"),await U(e,"Fetch CLI onboarding context failed"),await e.json()}async selectOnboardingOrg(e){let n=await this.send(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({orgId:e})});return await U(n,"Select CLI org failed"),await n.json()}async listStages(e){let n=await this.send(`${this.baseUrl}/v1/account/stages?project=${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return $e(n,"/v1/account/stages","broods stage"),await U(n,"List stages failed"),(await n.json()).stages??[]}async createStage(e,n,t){let o=await this.send(`${this.baseUrl}/v1/account/stages`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,name:n,...t?{from:t}:{}})});return $e(o,"/v1/account/stages","broods stage"),await U(o,"Create stage failed"),await o.json()}async mintStageSession(e,n){let t=await this.send(`${this.baseUrl}/v1/account/stage-session`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({project:e,stage:n})});$e(t,"/v1/account/stage-session","broods logs");try{await U(t,"Open stage session failed")}catch(o){if(t.status===401||t.status===404)throw new D(o instanceof Error?o.message:String(o));throw o}return await t.json()}async listProjects(){let e=await this.send(`${this.baseUrl}/v1/account/projects`,{method:"GET",headers:{Authorization:`Bearer ${this.token}`}});return $e(e,"/v1/account/projects","broods project"),await U(e,"List projects failed"),(await e.json()).projects??[]}async deleteProject(e){let n=await this.send(`${this.baseUrl}/v1/account/projects?projectId=${encodeURIComponent(e)}`,{method:"DELETE",headers:{Authorization:`Bearer ${this.token}`}});if($e(n,"/v1/account/projects","broods project"),n.status===404)return null;return await U(n,"Delete project failed"),(await n.json()).deleted??null}async createOnboardingOrg(e){let n=await this.send(`${this.baseUrl}/v1/account/onboarding`,{method:"POST",headers:{Authorization:`Bearer ${this.token}`,"Content-Type":"application/json"},body:JSON.stringify({createOrgName:e})});return await U(n,"Create CLI org failed"),await n.json()}async request(e,n,t,o,r){let s=`${this.baseUrl}/v1/account/projects/${encodeURIComponent(e)}/stages/${encodeURIComponent(n)}${t}`;return await this.send(s,{...o,headers:{Authorization:`Bearer ${this.token}`,...o.headers}},r)}async send(e,n,t){return await Je(e,n,{fetch:this.fetchImpl,timeoutMs:t})}}async function Je(e,n,t={}){let o=t.fetch??fetch,r=t.timeoutMs===void 0?Ir:t.timeoutMs;try{return await o(e,r===null?n:{...n,signal:AbortSignal.timeout(r)})}catch(s){throw Error(`Cannot reach ${new URL(e).origin}: ${Ur(s,r)}`,{cause:s})}}function wn(e,n){let t=new Map((n?.resources??[]).map((d)=>[`${d.kind}:${d.name}`,d])),o=new Map(e.resources.map((d)=>[`${d.kind}:${d.name}`,d])),r=[],s=[],i=[];for(let[d,l]of o){let p=t.get(d);if(!p)s.push({key:d,resource:l});else if(Ye(fn(p))!==Ye(fn(l)))r.push({operation:"update",kind:l.kind,name:l.name})}for(let[d,l]of t)if(!o.has(d))i.push({key:d,resource:l});let a=new Set,c=new Set;for(let d of s){let l=i.find((p)=>!a.has(p.key)&&_r(d.resource.kind)&&d.resource.kind===p.resource.kind&&Ye(St(d.resource))===Ye(St(p.resource)));if(!l)continue;c.add(d.key),a.add(l.key),r.push({operation:"rename",kind:d.resource.kind,name:d.resource.name,previousName:l.resource.name})}for(let{key:d,resource:l}of s)if(!c.has(d))r.push({operation:"create",kind:l.kind,name:l.name});for(let{key:d,resource:l}of i)if(!a.has(d))r.push({operation:"delete",kind:l.kind,name:l.name});return r.sort((d,l)=>kt(d).localeCompare(kt(l)))}function kt(e){return`${{create:0,rename:1,update:2,delete:3}[e.operation]}:${e.kind}:${e.previousName??""}:${e.name}`}function _r(e){return e==="agent"||e==="workspace"||e==="sandbox"||e==="policy"}function pn(e){if(Array.isArray(e))return e.map(pn);if(e&&typeof e==="object"){let n=e;if(n.__beeblastEnv===!0&&typeof n.name==="string")return`\${${n.name}}`;return Object.fromEntries(Object.entries(n).map(([t,o])=>[t,pn(o)]))}return e}function St(e){let n=fn(e),{name:t,...o}=n;return o}function fn(e){let n=pn(e);if(!Tr.has(e.kind))return n;return{...n,config:hn(n.config)}}function mn(e){if(Array.isArray(e))return e.map(mn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).sort(([n],[t])=>n.localeCompare(t)).map(([n,t])=>[n,mn(t)]));return e}function Ye(e){return JSON.stringify(mn(e))}function hn(e){if(Array.isArray(e))return e.map(hn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).flatMap(([n,t])=>{if(jr.has(n))return[];return[[n,hn(t)]]}));return e}async function U(e,n){if(e.ok)return;let t=await e.text(),{message:o=t,code:r}=Dr(t);if(r==="manifest_conflict")throw new ze(o);let s=e.status===401?"\nRun `broods login` to sign in again.":"";throw Error(`${n}: ${e.status} ${o}${s}`)}function Dr(e){let n;try{n=JSON.parse(e)}catch{return{}}let t=typeof n==="object"&&n!==null&&"error"in n?n.error:void 0;if(typeof t!=="object"||t===null)return{};return{..."message"in t&&typeof t.message==="string"?{message:t.message}:{},..."code"in t&&typeof t.code==="string"?{code:t.code}:{}}}function $e(e,n,t){if(e.status!==404)return;if((e.headers.get("Content-Type")??"").includes("application/json"))return;throw new Ve(`This broods server is older than your CLI and does not support \`${t}\` yet (no ${n} route).`)}function Ur(e,n){if(!(e instanceof Error))return String(e);if(e.name==="TimeoutError"&&n!==null)return`no answer within ${n/1000} s`;let t=e.cause;if(!(t instanceof Error))return e.message;if(t.message)return t.message;return"code"in t&&typeof t.code==="string"?t.code:e.message}function $t(e){if(e.kind!=="mcp")return null;let n=e.config?.bundle;if(typeof n!=="string")return null;return Buffer.byteLength(n)>lt?n:null}var qe=["chatgpt"];var we={chatgpt:{label:"ChatGPT plan",description:"Run agents on model.provider chatgpt with your ChatGPT plan",authorizeUrl:"https://auth.openai.com/api/accounts/authorize",tokenUrl:"https://auth.openai.com/api/accounts/oauth/token",revokeUrl:"https://auth.openai.com/api/accounts/oauth/revoke",jwksUrl:"https://auth.openai.com/.well-known/jwks.json",issuer:"https://auth.openai.com",scopes:["openid","profile","email","offline_access","resource.invoke","chatgpt.tokens.use.direct"],resource:"https://api.openai.com/v1",requiredScope:"chatgpt.tokens.use.direct",selfHostedOnly:"ChatGPT plan usage is only available on self-hosted Broods for now. Use an OpenAI API key with the `openai` provider instead.",modelsUrl:"https://api.openai.com/v1/models",usageUrl:"https://chatgpt.com/settings/usage"}};function bn(e){return qe.some((n)=>n===e)}import{createHash as os,randomBytes as rs,randomUUID as _t}from"node:crypto";import{createServer as Hr}from"node:http";import{createHash as Yr,randomBytes as zr,randomUUID as Vr}from"node:crypto";import{spawn as Jr}from"node:child_process";import{createInterface as Ie}from"node:readline/promises";import{stdin as ne,stdout as ee}from"node:process";import{Writable as qr}from"node:stream";function Ee(e,n,t={}){let o=`${n?"*":" "} ${e}`;return n?j(o,"\x1B[1m\x1B[36m",J(t)):o}function Et(e,n={}){let t=J(n),o=(i)=>j(i.padEnd(9),"\x1B[2m",t),r=!e.loggedIn?j("not logged in","\x1B[33m",t):e.org??j("unknown, run broods whoami","\x1B[2m",t),s=e.project??`none ${j(`(${e.projectGuess} from folder name)`,"\x1B[2m",t)}`;return[`  ${o("org")}${r}`,`  ${o("project")}${s}`,`  ${o("stage")}${xt(e.stage,t)}`,`  ${o("server")}${e.server}`]}function Nr(e,n={}){let t=J(n),o=Pt(e.stage),r=o==="Development",s=j("▌",r?"\x1B[32m":"\x1B[33m",t),i=t?`${r?"\x1B[42m\x1B[30m\x1B[1m":"\x1B[43m\x1B[30m\x1B[1m"} ${o} \x1B[0m`:`[${o}]`,a=t?j("dashboard","\x1B[4m",t):"dashboard",c=`${e.dashboardUrl}?project=${encodeURIComponent(e.project)}&stage=${encodeURIComponent(e.stage)}`,d=j(c,"\x1B[2m\x1B[4m",t);return[`${s} Syncing ${o}: ${j(e.project,"",t)}`,`${s} ${i} ${e.stage} (${a})`,`${s} ${j("└─","\x1B[2m",t)} ${d}`].join(`
+`)}function Lr(e,n={}){let t=J(n);return e.map((o)=>{let r=Fr(o.operation,t);if(o.operation==="rename"&&o.previousName)return`  ${r} ${o.kind}:${o.previousName} -> ${o.name}`;return`  ${r} ${o.kind}:${o.name}`})}function Mr(e,n={}){let t=J(n),o=j("▌","\x1B[32m",t),r=j("↑","\x1B[32m",t);return`${o} ${r} Synced ${e.length} env var(s) from .env.local: ${e.join(", ")}`}function Br(e,n={}){return`${j("✖","\x1B[31m",J(n))} ${e}`}function Ct(e,n={}){let t=J(n),o=Math.max(...e.map(([r])=>r.length))+2;return e.map(([r,s])=>`  ${r.padEnd(o)}${j(s,"\x1B[2m",t)}`)}function Gr(e,n={}){let t=(n.now??new Date).toTimeString().slice(0,8);return`${j("✔","\x1B[32m",J(n))} ${t} Resources ready! (${Kr(e)})`}function Wr(e,n={}){return`${j("✔","\x1B[32m",J(n))} ${e}`}function yn(e,n,t={}){let o=J(t),r=t.note?`  ${j(`(${t.note})`,"\x1B[2m",o)}`:"";return`  ${j("now","\x1B[2m",o)}  ${e} → ${xt(n,o)}${r}`}function Te(e,n={}){return j(`! ${e}`,"\x1B[33m",J(n))}function Rt(e){console.error(Nr(e))}function Ze(e){for(let n of Lr(e))console.log(n)}function vn(e){console.error(Mr(e))}function Ot(e){console.error(Br(e,{stream:"stderr"}))}function At(e){console.error(Gr(e))}function H(e){console.log(Wr(e,{stream:"stdout"}))}function x(e){console.log(Te(e,{stream:"stdout"}))}function Fr(e,n){if(e==="create")return`[${j("+","\x1B[32m",n)}]`;if(e==="rename")return`[${j("~","\x1B[33m",n)}]`;if(e==="update")return`[${j("*","\x1B[36m",n)}]`;return`[${j("-","\x1B[31m",n)}]`}function Kr(e){if(e>=1000)return`${(e/1000).toFixed(2)}s`;return`${Math.max(e,0).toFixed(1)}ms`}function j(e,n,t){return t?`${n}${e}\x1B[0m`:e}function xt(e,n){let t=Pt(e)==="Development";return j(e,t?"\x1B[32m":"\x1B[33m",n)}function J(e){if(e.color!==void 0)return e.color;if(Object.hasOwn(process.env,"NO_COLOR"))return!1;if(process.env.FORCE_COLOR&&process.env.FORCE_COLOR!=="0")return!0;return(e.stream==="stdout"?process.stdout:process.stderr).isTTY&&process.env.TERM!=="dumb"}function Pt(e){let n=e.trim().toLowerCase();if(n==="development")return"Development";if(n==="production")return"Production";return e.trim()}var Zr=180000,Xr=`Timed out waiting for browser login to complete.
 Check the browser tab and the dashboard logs for an error. If the browser shows
 404 on /cli-auth/start, deploy the dashboard build that includes CLI auth or pass
 --dashboard-url for the environment you deployed. Other common causes are missing
-cliAuth Convex functions or no active API account (Settings -> API Access).`,$t=new Set(["--base-url","--cwd","--dashboard-url","--stage","--from","--level","--limit","--mcp","--project","--region","--sandbox","-n"]);function Wr(e,n=process.platform){if(n==="darwin")return{command:"open",args:[e]};if(n==="win32")return{command:"rundll32",args:["url.dll,FileProtocolHandler",e]};return{command:"xdg-open",args:[e]}}function I(e,n){let t=$t.has(n)?`${n}=`:null;return e.some((o)=>o===n||t!==null&&o.startsWith(t))}function he(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function y(e,n){for(let t=0;t<e.length;t+=1){let o=e[t];if(o===n)return e[t+1];if(o?.startsWith(`${n}=`))return o.slice(n.length+1)||void 0}return}function ee(e){let n=[];for(let t=0;t<e.length;t+=1){let o=e[t];if(o===void 0)continue;if($t.has(o)){t+=1;continue}if(o.startsWith("-"))continue;n.push(o)}return n}async function wn(e){let n=Lr(),t=Nr(32).toString("base64url"),o=Ur("sha256").update(t).digest("base64url"),{code:r,close:s}=await yn(n,{port:Kr(),fixedPort:Boolean(process.env.BROODS_LOGIN_PORT),path:"/callback",read:Hr,done:"broods CLI login complete. You can close this tab."});try{let i=r.callbackUrl,a=`${f(e)}/cli-auth/start?`+new URLSearchParams({callback:i,state:n,code_challenge:o});await Fr(a),bn(a),console.log(`Opening ${a}`);let c=await vn(r.promise),d=await fetch(`${c.baseUrl}/v1/account/auth/exchange`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:c.code,code_verifier:t})});if(!d.ok)throw Error(`Login exchange failed: ${d.status} ${await d.text()}`);let l=await d.json(),p={baseUrl:c.baseUrl,dashboardUrl:f(e),token:l.token,createdAt:new Date().toISOString(),...l.user?{user:l.user}:{},...l.org?{org:l.org}:{},...l.account?{account:l.account}:{}};return await W(p),p}finally{s()}}async function q(e){h();let n=T(e);if(!n){let t=process.env.BROODS_DASHBOARD_URL,o=e??process.env.BROODS_BASE_URL??(t?L(t):void 0);throw Error(o?`Not logged in to ${f(o)}. Run \`broods login\`.`:"Run `broods login` first, or set BROODS_TOKEN and BROODS_BASE_URL.")}return n}async function Ve(e){if(!oe.isTTY)return!1;let n=je({input:oe,output:te});try{let t=(await n.question(`${e} [y/N] `)).trim().toLowerCase();return t==="y"||t==="yes"}finally{n.close()}}async function Et(e){let n=je({input:oe,output:te});try{let t=await n.question(`${e}: `);if(!t)throw Error(`${e} is required`);return t}finally{n.close()}}async function Ie(e,n,t,o){if(n.length===0)throw Error(`${e}: no options available`);if(n.length===1)return n[0];let r=o!==void 0&&o>=0&&o<n.length?o:void 0;console.log(e),n.forEach((a,c)=>{console.log(Se(`${c+1}. ${t(a)}`,c===r))});let s=r===void 0?`Choose 1-${n.length}: `:`Choose 1-${n.length} [${r+1}]: `,i=je({input:oe,output:te});try{for(;;){let a=(await i.question(s)).trim();if(a===""&&r!==void 0)return n[r];let c=Number(a);if(Number.isInteger(c)&&c>=1&&c<=n.length)return n[c-1];console.log(`Enter a number from 1 to ${n.length}.`)}}finally{i.close()}}async function Ct(e,n,t,o){console.log(e),n.forEach((i,a)=>{console.log(`  ${a+1}. ${t(i)}`)});let r=n.length>0?`Choose 1-${n.length}, or `:"",s=je({input:oe,output:te});try{let i=(await s.question(`${r}${o.hint} [${o.defaultValue}]: `)).trim();if(i==="")return o.defaultValue;let a=Number(i);if(Number.isInteger(a)&&a>=1&&a<=n.length)return n[a-1];return i}finally{s.close()}}async function we(e,n){if(!oe.isTTY)return n??"";let t=je({input:oe,output:te});try{let o=t.question(`${e}: `);if(n){if(oe.isTTY&&te.isTTY)te.write("\x1B[90m");if(t.write(n),oe.isTTY&&te.isTTY)te.write("\x1B[0m")}return(await o).trim()||n||""}finally{t.close()}}function bn(e){let{command:n,args:t}=Wr(e);Mr(n,t,{stdio:"ignore",detached:!0}).unref()}function yn(e,n){return new Promise((t,o)=>{let r=Dr((c,d)=>{let l=new URL(c.url??"/","http://127.0.0.1");if(l.pathname!==n.path||l.searchParams.get("state")!==e){d.writeHead(400).end("Invalid callback.");return}try{let p=n.read(l.searchParams);d.writeHead(200,{"Content-Type":"text/plain"}).end(n.done),s(p)}catch(p){d.writeHead(400,{"Content-Type":"text/plain"}).end(p instanceof Error?p.message:String(p)),i(p)}}),s,i,a=new Promise((c,d)=>{s=c,i=d});r.on("error",(c)=>{if(!n.fixedPort&&n.port!==0&&c.code==="EADDRINUSE"){r.listen(0,"127.0.0.1");return}o(c)}),r.listen(n.port,"127.0.0.1",()=>{let c=r.address();if(!c||typeof c==="string"){o(Error("Failed to allocate callback port"));return}t({code:{callbackUrl:`http://127.0.0.1:${c.port}${n.path}`,promise:a},close:()=>r.close()})})})}async function vn(e,n=Gr){let t,o=new Promise((r,s)=>{t=setTimeout(()=>s(Error(n)),Br)});try{return await Promise.race([e,o])}finally{if(t)clearTimeout(t)}}async function Fr(e){let n=await fetch(e,{method:"GET",redirect:"manual"});if(n.status===404){let t=new URL(e);throw Error(`${t.origin} does not expose /cli-auth/start yet. Deploy the dashboard changes first, or use --dashboard-url http://localhost:3000 with a local dashboard dev server.`)}if(n.status>=500)throw Error(`Dashboard CLI auth route failed: ${n.status} ${await n.text()}`)}function Kr(){let e=process.env.BROODS_LOGIN_PORT;if(e){let n=Number(e);if(Number.isInteger(n)&&n>0&&n<65536)return n;throw Error("BROODS_LOGIN_PORT must be a TCP port number")}return 18987}function Hr(e){let n=e.get("code");if(!n)throw Error("Login callback carried no code.");let t=e.get("base_url");if(!t)throw Error("Login callback did not advertise the API base URL (base_url). Deploy a dashboard build that includes the Convex-direct CLI auth flow.");return{code:n,baseUrl:f(t)}}var Vr=1455,Jr="/auth/callback";async function Rt(e,n,t=bn){let o=me[n].label,r=Ot(),s=Ot(),i=Yr(32).toString("base64url"),{code:a,close:c}=await yn(r,{port:Vr,fixedPort:!1,path:Jr,read:qr,done:`${o} is connected to broods. You can close this tab.`});try{let d=a.callbackUrl,l=await e.startConnection(n,{redirectUri:d,codeChallenge:zr("sha256").update(i).digest("base64url"),state:r,nonce:s});t(l.authorizeUrl),console.log(`Opening ${l.authorizeUrl}`);let p=await vn(a.promise,`Timed out waiting for the ${o} sign-in to finish in the browser.`);return await e.connect(n,{code:p.code,codeVerifier:i,redirectUri:d,nonce:s,clientId:p.clientId??l.clientId,hostId:l.hostId})}finally{c()}}function qr(e){let n=e.get("error");if(n)throw Error(`Sign-in failed: ${e.get("error_description")??n}`);let t=e.get("code");if(!t)throw Error("Sign-in callback carried no code.");return{code:t,clientId:e.get("client_id")??void 0}}import{existsSync as xt}from"node:fs";import{mkdir as Xr,readFile as Qr,writeFile as es}from"node:fs/promises";import{dirname as Pt,join as $n,resolve as ns,sep as pe}from"node:path";import{fileURLToPath as ts}from"node:url";var Te={name:"broods",version:"0.44.0",description:"CLI + TypeScript SDK for the broods agent platform.",keywords:["agents","ai","broods","cli","sdk"],homepage:"https://github.com/beeblastco/broods#readme",bugs:{url:"https://github.com/beeblastco/broods/issues"},license:"MIT",repository:{type:"git",url:"git+https://github.com/beeblastco/broods.git",directory:"packages/broods"},bin:{broods:"dist/cli/index.js"},files:["dist","README.md","LICENSE.md"],type:"module",main:"./dist/index.js",types:"./dist/index.d.ts",typesVersions:{"*":{account:["./dist/account.d.ts"]}},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./account":{types:"./dist/account.d.ts",import:"./dist/account.js"}},scripts:{build:"bun scripts/build.ts && rollup -c rollup.dts.config.mjs && rm -rf .dts-temp",check:"tsc --noEmit","pack:check":"bun run build && publint && attw --pack .",prepublishOnly:"bun run build",test:"bun test"},dependencies:{"@modelcontextprotocol/client":"^2.0.0",esbuild:"^0.28.2"},devDependencies:{"@ai-sdk/tui":"1.0.128","@arethetypeswrong/cli":"^0.18.5","@chat-adapter/discord":"^4.38.1","@chat-adapter/github":"^4.38.1","@chat-adapter/slack":"^4.38.1","@chat-adapter/telegram":"^4.38.1","@modelcontextprotocol/server":"2.0.0","@types/bun":"^1.3.14","@typescript/typescript6":"6.0.2",ai:"^7.0.127",publint:"^0.3.23",rollup:"^4.62.4","rollup-plugin-dts":"^6.5.1",typescript:"^7.0.2",zod:"^4.4.3"},peerDependencies:{ai:"^7.0.127"},engines:{node:">=22.15"}};var kn=$n(Pt(O),"update-check.json"),os=86400000,rs="https://registry.npmjs.org/broods/latest",ss=2000,is=[["bun.lock","bun"],["bun.lockb","bun"],["pnpm-lock.yaml","pnpm"],["yarn.lock","yarn"]];function En(e,n){let t=Sn(e),o=Sn(n);for(let r=0;r<3;r+=1){let s=t[r]??0,i=o[r]??0;if(s!==i)return s>i}return!At(e)&&At(n)}async function Cn(e={}){let n=await cs(),t=e.maxAgeMs??os;if(n&&Date.now()-n.checkedAt<t)return n.latest;let o=await as();if(o===null)return n?.latest??null;return await ds({checkedAt:Date.now(),latest:o}),o}function _e(e){return Sn(e)[0]??0}function jt(e=ns(process.cwd()),n=ts(import.meta.url),t=Te.version){let o=`${pe}node_modules${pe}`,r=n.indexOf(o),s=r===-1?null:n.slice(0,r),i=s===null?n.startsWith(`${e}${pe}`):e===s||e.startsWith(`${s}${pe}`),a=n.includes(`${pe}.bun${pe}install${pe}global${pe}`),c=s??e,d=i?ls(c):a?"bun":"npm",l=d==="npm"?"install":"add",p=d==="pnpm"&&xt($n(c,"pnpm-workspace.yaml"))?["-w"]:[],u=`broods@${_e(t)}`;return{manager:d,global:!i,command:d,cwd:i?c:e,args:i?[l,...p,u]:[l,"-g",u]}}async function as(){try{let e=await fetch(rs,{signal:AbortSignal.timeout(ss),headers:{accept:"application/json"}});if(!e.ok)return null;let n=await e.json();return typeof n.version==="string"?n.version:null}catch{return null}}function At(e){return e.includes("-")}async function cs(){try{let e=JSON.parse(await Qr(kn,"utf8"));if(typeof e.latest!=="string")return null;if(typeof e.checkedAt!=="number")return null;return{checkedAt:e.checkedAt,latest:e.latest}}catch{return null}}function ls(e){return is.find(([t])=>xt($n(e,t)))?.[1]??"npm"}function Sn(e){let[n]=e.trim().replace(/^v/,"").split("-");return(n??"").split(".").slice(0,3).map((t)=>Number.parseInt(t,10)||0)}async function ds(e){try{await Xr(Pt(kn),{recursive:!0}),await es(kn,`${JSON.stringify(e)}
-`,"utf8")}catch{}}var It=`---
+cliAuth Convex functions or no active API account (Settings -> API Access).`,jt=new Set(["--base-url","--cwd","--dashboard-url","--stage","--from","--level","--limit","--mcp","--project","--region","--sandbox","-n"]);function Qr(e,n=process.platform){if(n==="darwin")return{command:"open",args:[e]};if(n==="win32")return{command:"rundll32",args:["url.dll,FileProtocolHandler",e]};return{command:"xdg-open",args:[e]}}function I(e,n){let t=jt.has(n)?`${n}=`:null;return e.some((o)=>o===n||t!==null&&o.startsWith(t))}function be(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function k(e,n){for(let t=0;t<e.length;t+=1){let o=e[t];if(o===n)return e[t+1];if(o?.startsWith(`${n}=`))return o.slice(n.length+1)||void 0}return}function te(e){let n=[];for(let t=0;t<e.length;t+=1){let o=e[t];if(o===void 0)continue;if(jt.has(o)){t+=1;continue}if(o.startsWith("-"))continue;n.push(o)}return n}async function kn(e){let n=Vr(),t=zr(32).toString("base64url"),o=Yr("sha256").update(t).digest("base64url"),{code:r,close:s}=await $n(n,{port:ns(),fixedPort:Boolean(process.env.BROODS_LOGIN_PORT),path:"/callback",read:ts,done:"broods CLI login complete. You can close this tab."});try{let i=r.callbackUrl,a=`${f(e)}/cli-auth/start?`+new URLSearchParams({callback:i,state:n,code_challenge:o});await es(a),console.log(`Opening ${a}`),Sn(a);let c=await En(r.promise),d=await Je(`${c.baseUrl}/v1/account/auth/exchange`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:c.code,code_verifier:t})});if(!d.ok)throw Error(`Login exchange failed: ${d.status} ${await d.text()}`);let l=await d.json(),p={baseUrl:c.baseUrl,dashboardUrl:f(e),token:l.token,createdAt:new Date().toISOString(),...l.user?{user:l.user}:{},...l.org?{org:l.org}:{},...l.account?{account:l.account}:{}};return await W(p),p}finally{s()}}async function q(e){h();let n=T(e);if(!n){let t=process.env.BROODS_DASHBOARD_URL,o=e??process.env.BROODS_BASE_URL??(t?L(t):void 0);throw Error(o?`Not logged in to ${f(o)}. Run \`broods login\`.`:"Run `broods login` first, or set BROODS_TOKEN and BROODS_BASE_URL.")}return n}async function Xe(e){if(!ne.isTTY)return!1;let n=Ie({input:ne,output:ee});try{let t=(await n.question(`${e} [y/N] `)).trim().toLowerCase();return t==="y"||t==="yes"}finally{n.close()}}async function Tt(e){ee.write(`${e}: `);let n=new qr({write:(o,r,s)=>s()}),t=Ie({input:ne,output:n,terminal:ne.isTTY===!0});try{let o=await t.question("");if(!o)throw Error(`${e} is required`);return o}finally{t.close(),ee.write(`
+`)}}async function _e(e,n,t,o){if(n.length===0)throw Error(`${e}: no options available`);if(n.length===1)return n[0];let r=o!==void 0&&o>=0&&o<n.length?o:void 0;console.log(e),n.forEach((a,c)=>{console.log(Ee(`${c+1}. ${t(a)}`,c===r))});let s=r===void 0?`Choose 1-${n.length}: `:`Choose 1-${n.length} [${r+1}]: `,i=Ie({input:ne,output:ee});try{for(;;){let a=(await i.question(s)).trim();if(a===""&&r!==void 0)return n[r];let c=Number(a);if(Number.isInteger(c)&&c>=1&&c<=n.length)return n[c-1];console.log(`Enter a number from 1 to ${n.length}.`)}}finally{i.close()}}async function It(e,n,t,o){console.log(e),n.forEach((i,a)=>{console.log(`  ${a+1}. ${t(i)}`)});let r=n.length>0?`Choose 1-${n.length}, or `:"",s=Ie({input:ne,output:ee});try{let i=(await s.question(`${r}${o.hint} [${o.defaultValue}]: `)).trim();if(i==="")return o.defaultValue;let a=Number(i);if(Number.isInteger(a)&&a>=1&&a<=n.length)return n[a-1];return i}finally{s.close()}}async function ye(e,n){if(!ne.isTTY)return n??"";let t=Ie({input:ne,output:ee});try{let o=t.question(`${e}: `);if(n){if(ne.isTTY&&ee.isTTY)ee.write("\x1B[90m");if(t.write(n),ne.isTTY&&ee.isTTY)ee.write("\x1B[0m")}return(await o).trim()||n||""}finally{t.close()}}function Sn(e){let{command:n,args:t}=Qr(e),o=Jr(n,t,{stdio:"ignore",detached:!0});o.on("error",(r)=>{console.error(Te(`Could not open a browser (${r.message}). Open the URL above to continue.`,{stream:"stderr"}))}),o.unref()}function $n(e,n){return new Promise((t,o)=>{let r=Hr((c,d)=>{let l=new URL(c.url??"/","http://127.0.0.1");if(l.pathname!==n.path||l.searchParams.get("state")!==e){d.writeHead(400).end("Invalid callback.");return}try{let p=n.read(l.searchParams);d.writeHead(200,{"Content-Type":"text/plain"}).end(n.done),s(p)}catch(p){d.writeHead(400,{"Content-Type":"text/plain"}).end(p instanceof Error?p.message:String(p)),i(p)}}),s,i,a=new Promise((c,d)=>{s=c,i=d});r.on("error",(c)=>{if(!n.fixedPort&&n.port!==0&&c.code==="EADDRINUSE"){r.listen(0,"127.0.0.1");return}o(c)}),r.listen(n.port,"127.0.0.1",()=>{let c=r.address();if(!c||typeof c==="string"){o(Error("Failed to allocate callback port"));return}t({code:{callbackUrl:`http://127.0.0.1:${c.port}${n.path}`,promise:a},close:()=>r.close()})})})}async function En(e,n=Xr){let t,o=new Promise((r,s)=>{t=setTimeout(()=>s(Error(n)),Zr)});try{return await Promise.race([e,o])}finally{if(t)clearTimeout(t)}}async function es(e){let n=await Je(e,{method:"GET",redirect:"manual"});if(n.status===404){let t=new URL(e);throw Error(`${t.origin} has no broods login page. Check that --dashboard-url points at your broods dashboard.`)}if(n.status>=500)throw Error(`The broods login page failed: ${n.status} ${await n.text()}`)}function ns(){let e=process.env.BROODS_LOGIN_PORT;if(e){let n=Number(e);if(Number.isInteger(n)&&n>0&&n<65536)return n;throw Error("BROODS_LOGIN_PORT must be a TCP port number")}return 18987}function ts(e){let n=e.get("error");if(n)throw Error(`Login failed: ${n}`);let t=e.get("code");if(!t)throw Error("Login callback carried no code.");let o=e.get("base_url");if(!o)throw Error("Login callback did not advertise the API base URL (base_url). Deploy a dashboard build that includes the Convex-direct CLI auth flow.");return{code:t,baseUrl:f(o)}}var ss=1455,is="/auth/callback";async function Dt(e,n,t=Sn){let o=we[n].label,r=_t(),s=_t(),i=rs(32).toString("base64url"),{code:a,close:c}=await $n(r,{port:ss,fixedPort:!1,path:is,read:as,done:`${o} is connected to broods. You can close this tab.`});try{let d=a.callbackUrl,l=await e.startConnection(n,{redirectUri:d,codeChallenge:os("sha256").update(i).digest("base64url"),state:r,nonce:s});t(l.authorizeUrl),console.log(`Opening ${l.authorizeUrl}`);let p=await En(a.promise,`Timed out waiting for the ${o} sign-in to finish in the browser.`);return await e.connect(n,{code:p.code,codeVerifier:i,redirectUri:d,nonce:s,clientId:p.clientId??l.clientId,hostId:l.hostId})}finally{c()}}function as(e){let n=e.get("error");if(n)throw Error(`Sign-in failed: ${e.get("error_description")??n}`);let t=e.get("code");if(!t)throw Error("Sign-in callback carried no code.");return{code:t,clientId:e.get("client_id")??void 0}}import{existsSync as Nt}from"node:fs";import{mkdir as ls,readFile as ds,writeFile as us}from"node:fs/promises";import{dirname as Lt,join as On,resolve as gs,sep as pe}from"node:path";import{fileURLToPath as ps}from"node:url";var De={name:"broods",version:"0.44.1",description:"CLI + TypeScript SDK for the broods agent platform.",keywords:["agents","ai","broods","cli","sdk"],homepage:"https://github.com/beeblastco/broods#readme",bugs:{url:"https://github.com/beeblastco/broods/issues"},license:"MIT",repository:{type:"git",url:"git+https://github.com/beeblastco/broods.git",directory:"packages/broods"},bin:{broods:"dist/cli/index.js"},files:["dist","README.md","LICENSE.md"],type:"module",main:"./dist/index.js",types:"./dist/index.d.ts",typesVersions:{"*":{account:["./dist/account.d.ts"]}},exports:{".":{types:"./dist/index.d.ts",import:"./dist/index.js"},"./account":{types:"./dist/account.d.ts",import:"./dist/account.js"}},scripts:{build:"bun scripts/build.ts && rollup -c rollup.dts.config.mjs && rm -rf .dts-temp",check:"tsc --noEmit","pack:check":"bun run build && publint && attw --pack .",prepublishOnly:"bun run build",test:"bun test"},dependencies:{"@modelcontextprotocol/client":"^2.0.0",esbuild:"^0.28.2"},devDependencies:{"@ai-sdk/tui":"1.0.128","@arethetypeswrong/cli":"^0.18.5","@chat-adapter/discord":"^4.38.1","@chat-adapter/github":"^4.38.1","@chat-adapter/slack":"^4.38.1","@chat-adapter/telegram":"^4.38.1","@modelcontextprotocol/server":"2.0.0","@types/bun":"^1.3.14","@typescript/typescript6":"6.0.2",ai:"^7.0.127",publint:"^0.3.23",rollup:"^4.62.4","rollup-plugin-dts":"^6.5.1",typescript:"^7.0.2",zod:"^4.4.3"},peerDependencies:{ai:"^7.0.127"},engines:{node:">=22.15"}};var Cn=On(Lt(O),"update-check.json"),fs=86400000,ms="https://registry.npmjs.org/broods/latest",hs=2000,ws=[["bun.lock","bun"],["bun.lockb","bun"],["pnpm-lock.yaml","pnpm"],["yarn.lock","yarn"]];function An(e,n){let t=Rn(e),o=Rn(n);for(let r=0;r<3;r+=1){let s=t[r]??0,i=o[r]??0;if(s!==i)return s>i}return!Ut(e)&&Ut(n)}async function xn(e={}){let n=await ys(),t=e.maxAgeMs??fs;if(n&&Date.now()-n.checkedAt<t)return n.latest;let o=await bs();if(o===null)return n?.latest??null;return await ks({checkedAt:Date.now(),latest:o}),o}function Ue(e){return Rn(e)[0]??0}function Mt(e=gs(process.cwd()),n=ps(import.meta.url),t=De.version){let o=`${pe}node_modules${pe}`,r=n.indexOf(o),s=r===-1?null:n.slice(0,r),i=s===null?n.startsWith(`${e}${pe}`):e===s||e.startsWith(`${s}${pe}`),a=n.includes(`${pe}.bun${pe}install${pe}global${pe}`),c=s??e,d=i?vs(c):a?"bun":"npm",l=d==="npm"?"install":"add",p=d==="pnpm"&&Nt(On(c,"pnpm-workspace.yaml"))?["-w"]:[],u=`broods@${Ue(t)}`;return{manager:d,global:!i,command:d,cwd:i?c:e,args:i?[l,...p,u]:[l,"-g",u]}}async function bs(){try{let e=await fetch(ms,{signal:AbortSignal.timeout(hs),headers:{accept:"application/json"}});if(!e.ok)return null;let n=await e.json();return typeof n.version==="string"?n.version:null}catch{return null}}function Ut(e){return e.includes("-")}async function ys(){try{let e=JSON.parse(await ds(Cn,"utf8"));if(typeof e.latest!=="string")return null;if(typeof e.checkedAt!=="number")return null;return{checkedAt:e.checkedAt,latest:e.latest}}catch{return null}}function vs(e){return ws.find(([t])=>Nt(On(e,t)))?.[1]??"npm"}function Rn(e){let[n]=e.trim().replace(/^v/,"").split("-");return(n??"").split(".").slice(0,3).map((t)=>Number.parseInt(t,10)||0)}async function ks(e){try{await ls(Lt(Cn),{recursive:!0}),await us(Cn,`${JSON.stringify(e)}
+`,"utf8")}catch{}}var Bt=`---
 name: broods
 description: Work on a broods account alongside a developer from Claude Code or a development agent. Covers onboarding and sign-in, creating a broods project, defining and deploying agents and their resources with the CLI, and integrating a deployed agent into existing code with the SDK. Use when asked to set up broods, create or work on a broods project, create or manage agents or any account resource, or call a deployed agent from application code.
 ---
@@ -135,7 +136,7 @@ Crons, skills, sandboxes, policies, roles, channels, and hooks have no CLI verb.
 - Env values are write-only. Reference them from configs as \`\${NAME}\`. If the user pastes a secret at you, put it in the env store and use the ref.
 - Deletes are confirmed, named, and singular. Never loop a delete over a list.
 - Editing a manifest-declared resource outside the project drifts from the definition, and the next deploy silently reverts it.
-`;var Tt=`#!/usr/bin/env bash
+`;var Gt=`#!/usr/bin/env bash
 # Onboard this machine onto broods: check the CLI, check auth, and run the
 # browser login when needed. Login is a human step, so run this where the
 # user can see the browser open and finish it themselves.
@@ -170,17 +171,17 @@ elif [ "$STATUS" -ne 0 ]; then
   # Not the expected signed-out state: surface the real failure.
   exit "$STATUS"
 fi
-`;var re=Te.version,Je=Ue(".agents","skills","broods"),ne="https://dashboard.broods.app",Es=60000,Cs=3,De="eu-west-1",Os=[{region:"eu-west-1",label:"eu-west-1 (Ireland)"},{region:"us-east-1",label:"us-east-1 (US East)"},{region:"ap-southeast-1",label:"ap-southeast-1 (Singapore)"}],B=`Global options:
+`;var ae=De.version,Qe=Le(".agents","skills","broods"),oe="https://dashboard.broods.app",Ds=60000,Us=3,Ne="eu-west-1",Ns=[{region:"eu-west-1",label:"eu-west-1 (Ireland)"},{region:"us-east-1",label:"us-east-1 (US East)"},{region:"ap-southeast-1",label:"ap-southeast-1 (Singapore)"}],B=`Global options:
   --project <name>      Project name override (default: package name or folder)
   --stage <name>        Target stage override (BROODS_STAGE otherwise)
   --base-url <url>      broods API base URL for sync/env calls (default: discovered at login)
-  --dashboard-url <url> Dashboard base URL for login and deep links (default: ${ne})
-  -h, --help            Show this help`,Rs=`Commands
+  --dashboard-url <url> Dashboard base URL for login and deep links (default: ${oe})
+  -h, --help            Show this help`,Ls=`Commands
   Develop   dev  diff  run  logs  stream
   Ship      deploy  env  stage
   Inspect   agent  whoami
   Account   login  connect  disconnect  org  project
-  Tools     init  machine  mcp  update`,On={stream:"stdout"},Wt={color:!1},As=new Set(["agent","deploy","dev","diff","env","logs","machine","run","stage","stream"]),Ft={agent:`Usage: broods agent <list|get> [name]
+  Tools     init  machine  mcp  update`,Pn={stream:"stdout"},qt={color:!1},Ms=new Set(["agent","deploy","dev","diff","env","logs","machine","run","stage","stream"]),Zt={agent:`Usage: broods agent <list|get> [name]
 Subcommands:
   list                 List the agents in the current project/stage scope
@@ -190,10 +191,11 @@ ${B}`,connect:`Usage: broods connect [type]
 Signs an external account in through the browser and keeps it on your
 deployment, so agents act through it. Without a type, lists the account's
-connections. Uses BROODS_ACCOUNT_SECRET when set, otherwise your broods login.
+connections. Uses the account key in BROODS_ACCOUNT_SECRET when set, otherwise
+your broods login.
 Types:
-${ze.map((e)=>`  ${e.padEnd(11)} ${me[e].description}`).join(`
+${qe.map((e)=>`  ${e.padEnd(11)} ${we[e].description}`).join(`
 `)}
 ${B}`,deploy:`Usage: broods deploy [options]
@@ -203,7 +205,7 @@ BROODS_STAGE by design. Pass --stage to deploy anywhere else.
 Options:
   --prune               Allow deploy to delete undeclared remote resources
-  --rotate-key          Mint a fresh runtime API key and write it to .env.local
+  --rotate-key          Mint a fresh runtime key and write it to .env.local
 ${B}`,dev:`Usage: broods dev [--once] [options]
@@ -215,7 +217,7 @@ Options:
   --once                Sync a single time and exit (no watch, no log stream)
   --level <lvl>         Minimum level for the log tail DEBUG|INFO|WARN|ERROR (default: WARN)
   --all                 Tail INFO and up (DEBUG is dashboard-only)
-  --region <region>     Service region for a new project (default: ${De})
+  --region <region>     Service region for a new project (default: ${Ne})
 ${B}`,diff:`Usage: broods diff [options]
@@ -247,7 +249,7 @@ ${B}`,init:`Usage: broods init [options]
 Creates the broods/ project shell and .env.local defaults.
 Options:
-  --region <region>     Broods service region preference (default: ${De})
+  --region <region>     Broods service region preference (default: ${Ne})
   --force               Overwrite existing starter files
 ${B}`,login:`Usage: broods login [options]
@@ -256,7 +258,7 @@ Authenticates through the dashboard and stores the token in
 ~/.broods/config.json.
 Options:
-  --region <region>     Broods service region preference (default: ${De})
+  --region <region>     Broods service region preference (default: ${Ne})
 ${B}`,logs:`Usage: broods logs [options]
@@ -286,7 +288,7 @@ whose sandbox is this record. The file has the .mcp.json shape Claude Code and
 Cursor read, and it never leaves this computer.
 Authenticates with your \`broods login\`, like \`broods logs\`, and needs a
-deployed stage. The stage runtime key cannot open the machine socket.
+deployed stage. The runtime key cannot open the machine socket.
 Options:
   --cwd <dir>           Working directory for commands (default: current directory)
@@ -353,9 +355,10 @@ than a terminal:
 Auth comes from the environment, same as the SDK. Prefer a role session
 (BROODS_SESSION_TOKEN) so the role's policy bounds what the agent can reach;
-BROODS_ACCOUNT_SECRET is the full-tenant fallback. Mint a session with the
-assume-role tool, or with the account secret from another client. With only
-a stored \`broods login\`, the org, project and stage tools still register.
+BROODS_ACCOUNT_SECRET (the account key) is the full-tenant fallback. Mint a
+session with the assume-role tool, or with the account key from another
+client. With only a stored \`broods login\`, the org, project and stage tools
+still register.
 rotate-secret and delete-project stay unregistered unless
 BROODS_MCP_ALLOW_DESTRUCTIVE=1 is exported in the shell: no role policy
@@ -369,55 +372,55 @@ project the dependency is upgraded instead. A new major is only announced.`,whoa
 Shows the login, server, org, plan, project and stage the next command uses.
-${B}`};async function xs(){Ai();let[,,e,...n]=process.argv;switch(e){case void 0:case"--help":case"-h":console.log(Rn(n,On));return;case"--version":case"-v":console.log(re);return}if(xi(e,n),Ft[e]&&(I(n,"--help")||I(n,"-h"))){console.log(ye(e,n));return}switch(e){case"init":await js(n);return;case"login":await Is(n);return;case"connect":await _s(n);return;case"disconnect":await Ds(n);return;case"whoami":await Ls(n);return;case"org":await Bs(n);return;case"project":await Gs(n);return;case"stage":await Ws(n);return;case"diff":await Fs(n);return;case"deploy":await Ks(n);return;case"dev":await zs(n);return;case"env":await mi(n);return;case"stream":await bi(n);return;case"logs":await ki(n);return;case"machine":await yi(n);return;case"agent":await Si(n);return;case"run":await Ci(n);return;case"mcp":await Pi();return;case"update":await Hs();return;default:throw Error(`Unknown command: ${e}
+${B}`};async function Bs(){Mi();let[,,e,...n]=process.argv;switch(e){case void 0:case"--help":case"-h":console.log(jn(n,Pn));return;case"--version":case"-v":console.log(ae);return}if(Bi(e,n),Zt[e]&&(I(n,"--help")||I(n,"-h"))){console.log(ke(e,n));return}switch(e){case"init":await Ws(n);return;case"login":await Fs(n);return;case"connect":await Hs(n);return;case"disconnect":await Ys(n);return;case"whoami":await Js(n);return;case"org":await Zs(n);return;case"project":await Xs(n);return;case"stage":await Qs(n);return;case"diff":await ei(n);return;case"deploy":await ni(n);return;case"dev":await oi(n);return;case"env":await Ri(n);return;case"stream":await xi(n);return;case"logs":await Ti(n);return;case"machine":await Pi(n);return;case"agent":await Ii(n);return;case"run":await Ui(n);return;case"mcp":await Gi();return;case"update":await ti();return;default:throw Error(`Unknown command: ${e}
-${Rn(n,Wt)}`)}}function Z(e){return Ft[e]??Rn([],Wt)}function Kt(e){let n=h(),t=y(e,"--base-url")??n.baseUrl,o=T(t),r=f(t??o?.baseUrl??E);return{loggedIn:o!==null,org:o?.org?.name,project:y(e,"--project")??n.project,projectGuess:Ce(process.cwd()),server:r.replace(/^https?:\/\//,""),stage:y(e,"--stage")??n.stage??"development"}}function Ps(e){if(!e.loggedIn)return[["broods login","sign in through the dashboard"]];if(!e.project)return[["broods dev","create a project and sync on save"]];return[["broods dev","sync on save, tail logs"],["broods run <agent>","chat with an agent"]]}function ye(e,n){let t=Z(e);if(!As.has(e))return t;let o=Kt(n),r=o.project??o.projectGuess;if(e!=="deploy"||y(n,"--stage")!==void 0)return`${mn(r,o.stage,On)}
+${jn(n,qt)}`)}}function Z(e){return Zt[e]??jn([],qt)}function Xt(e){let n=h(),t=k(e,"--base-url")??n.baseUrl,o=T(t),r=f(t??o?.baseUrl??E);return{loggedIn:o!==null,org:o?.org?.name,project:k(e,"--project")??n.project,projectGuess:Oe(process.cwd()),server:r.replace(/^https?:\/\//,""),stage:k(e,"--stage")??n.stage??"development"}}function Gs(e){if(!e.loggedIn)return[["broods login","sign in through the dashboard"]];if(!e.project)return[["broods dev","create a project and sync on save"]];return[["broods dev","sync on save, tail logs"],["broods run <agent>","chat with an agent"]]}function ke(e,n){let t=Z(e);if(!Ms.has(e))return t;let o=Xt(n),r=o.project??o.projectGuess;if(e!=="deploy"||k(n,"--stage")!==void 0)return`${yn(r,o.stage,Pn)}
-${t}`;let s=v(),i=s&&s!=="production"?`ignores stage ${s}`:void 0;return`${mn(r,"production",{...On,note:i})}
+${t}`;let s=v(),i=s&&s!=="production"?`ignores stage ${s}`:void 0;return`${yn(r,"production",{...Pn,note:i})}
-${t}`}function Rn(e,n){let t=Kt(e);return[`broods v${re}`,"",...ht(t,n),"","Next",...wt(Ps(t),n),"",Rs,"","Usage: broods <command> [options]    -h, --help    -v, --version","Run `broods <command> --help` for a command's flags."].join(`
-`)}async function js(e){let n=I(e,"--force"),t=P(process.cwd(),S);await In(P(t,_),{recursive:!0}),await Ze(P(t,"index.ts"),ro(),n),await Ze(P(t,".gitignore"),`_generated
+${t}`}function jn(e,n){let t=Xt(e);return[`broods v${ae}`,"",...Et(t,n),"","Next",...Ct(Gs(t),n),"",Ls,"","Usage: broods <command> [options]    -h, --help    -v, --version","Run `broods <command> --help` for a command's flags."].join(`
+`)}async function Ws(e){let n=I(e,"--force"),t=P(process.cwd(),y);await Un(P(t,_),{recursive:!0}),await nn(P(t,"index.ts"),po(),n),await nn(P(t,".gitignore"),`_generated
 .cache
-`,n),await Vt(n);let o=y(e,"--dashboard-url")??ne;await Un({dashboardUrl:o,baseUrl:L(o),project:y(e,"--project")??Ce(process.cwd()),stage:y(e,"--stage")??"development",region:y(e,"--region")??De,force:n}),H(`Created ${S}/`)}async function Is(e){let n=h(),t=y(e,"--dashboard-url")??n.dashboardUrl??ne,o=await wn(t);await Un({dashboardUrl:o.dashboardUrl??t,baseUrl:o.baseUrl,project:y(e,"--project"),stage:y(e,"--stage"),region:y(e,"--region"),force:!1});let r=o.user?.email||o.user?.name||o.user?.authId,s=o.org?`${o.org.name} (${o.org.slug})`:void 0,i=o.account?.username;if(H(`Logged in to ${o.dashboardUrl}`),r)console.log(`User: ${r}`);if(s)console.log(`Org: ${s}`);if(i)console.log(`Account: ${i}`);let a=y(e,"--project")??process.env.BROODS_PROJECT;if(!a)return;let c=y(e,"--stage")??v()??"development";await Ns(o.baseUrl,o.token,a,c)}function Ts(e){if(!(e instanceof m))return e instanceof Error?e.message:String(e);try{return JSON.parse(e.body).error?.message??e.message}catch{return e.message}}async function _s(e){let[n]=ee(e),t=await Ht(e);if(n===void 0){await Us(t);return}if(!fn(n))throw Error(`Unknown connection type ${n}.
+`,n),await to(n);let o=k(e,"--dashboard-url")??oe;await Gn({dashboardUrl:o,baseUrl:L(o),project:k(e,"--project")??Oe(process.cwd()),stage:k(e,"--stage")??"development",region:k(e,"--region")??Ne,force:n}),H(`Created ${y}/`)}async function Fs(e){let n=h(),t=k(e,"--dashboard-url")??n.dashboardUrl??oe,o=await kn(t);await Gn({dashboardUrl:o.dashboardUrl??t,baseUrl:o.baseUrl,project:k(e,"--project"),stage:k(e,"--stage"),region:k(e,"--region"),force:!1});let r=o.user?.email||o.user?.name||o.user?.authId,s=o.org?`${o.org.name} (${o.org.slug})`:void 0,i=o.account?.username;if(H(`Logged in to ${o.dashboardUrl}`),r)console.log(`User: ${r}`);if(s)console.log(`Org: ${s}`);if(i)console.log(`Account: ${i}`);let a=k(e,"--project")??process.env.BROODS_PROJECT;if(!a)return;let c=k(e,"--stage")??v()??"development";await Vs(o.baseUrl,o.token,a,c)}function Ks(e){if(!(e instanceof m))return e instanceof Error?e.message:String(e);try{return JSON.parse(e.body).error?.message??e.message}catch{return e.message}}async function Hs(e){let[n]=te(e),t=await Qt(e);if(n===void 0){await zs(t);return}if(!bn(n))throw Error(`Unknown connection type ${n}.
-${Z("connect")}`);let o=me[n],r=await Rt(t,n).catch((s)=>{throw Error(Ts(s))});if(H(`Connected ${o.label}${r.email?` as ${r.email}`:""}.`),console.log(`Agents on model.provider "${n}" now run on it.`),o.usageUrl)console.log(`Manage usage: ${o.usageUrl}`);if(!r.models?.length)return;console.log("Models (use the id as model.modelId):");for(let s of r.models)console.log(`  ${s}`)}async function Ht(e){h();let n=y(e,"--base-url"),t=process.env.BROODS_ACCOUNT_SECRET;if(t)return new R({accountSecret:t,...n?{baseUrl:n}:{}});let o=await q(n);return new R({accountSecret:o.token,baseUrl:n??o.baseUrl})}async function Ds(e){let[n]=ee(e);if(!n||!fn(n))throw Error(Z("disconnect"));if(await(await Ht(e)).disconnect(n)){H(`Disconnected ${me[n].label}`);return}console.log(`No ${n} connection.`)}async function Us(e){let n=await e.listConnections();if(n.length===0)console.log("No connections yet.");else console.log(`${"TYPE".padEnd(16)} ACCOUNT`);for(let t of n)console.log(`${me[t.type].label.padEnd(16)} ${t.email??t.clientId}`);console.log(`
-Connect one: broods connect <${ze.join("|")}>`)}async function Ns(e,n,t,o){try{let s=await new N({baseUrl:e,token:n}).getRuntimeKey(t,o);if(s?.apiKey)await $e("BROODS_API_KEY",s.apiKey),H(`Wrote BROODS_API_KEY (${s.keyHint}) to .env.local`)}catch{}}async function Ls(e){let n=h(),t=Qe(e),o=y(e,"--dashboard-url")??n.dashboardUrl??ne,r=Boolean(y(e,"--project")??n.project);console.log(`broods v${re}`),console.log(`Dashboard:   ${o}`),console.log(`Project:     ${r?t.project:`none (${t.project} from folder name)`}`),console.log(`Stage:       ${t.stage}`);let s;try{s=await q(y(e,"--base-url"))}catch(l){x(l instanceof Error?l.message:String(l));return}console.log(`Server:      ${s.baseUrl}`);let i=new N({baseUrl:s.baseUrl,token:s.token}),a=await i.getOnboarding(),c=a.orgs.find((l)=>l.id===a.currentOrgId);if(a.user)console.log(`User:        ${a.user.email}`);if(console.log(`Org:         ${c?Ne(c):a.currentOrgId}`),a.account)console.log(`Account:     ${a.account.username} (${a.account.status})`);if(!r){x("No project set. `broods dev` picks one.");return}await Ms(i,t,c?.name);let d=a.projects.map((l)=>l.name);if(!d.includes(t.project))x(`This org has no project named ${t.project}. It has: ${d.length>0?d.join(", "):"none"}.`)}async function Ms(e,n,t){let o=process.env.BROODS_API_KEY,r=M("BROODS_API_KEY")?"your shell":".env.local",s=null,i=null;try{s=await e.getRuntimeKey(n.project,n.stage)}catch(a){i=a instanceof Error?a.message:String(a)}if(i)console.log("Runtime key: unavailable"),x(`Could not read the runtime key: ${i}`);else if(!s?.apiKey)console.log("Runtime key: none for this scope"),x(`${n.project}/${n.stage} does not exist in ${t??"this org"} yet. \`broods dev\` will create it.`);else if(!o)console.log(`Runtime key: ${s.keyHint} (not in .env.local)`),x("BROODS_API_KEY is not set locally. Run `broods dev`.");else if(o===s.apiKey)console.log(`Runtime key: ${s.keyHint} (matches this org and stage)`);else console.log(`Runtime key: ${s.keyHint} expected`),x(`BROODS_API_KEY from ${r} belongs to a different org or stage. Run \`broods stage use ${n.stage}\` to repoint it.`)}async function Bs(e){let[n,t]=ee(e);if(!n){console.log(ye("org",e));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown org subcommand: ${n}
+${Z("connect")}`);let o=we[n],r=await Dt(t,n).catch((s)=>{throw Error(Ks(s))});if(H(`Connected ${o.label}${r.email?` as ${r.email}`:""}.`),console.log(`Agents on model.provider "${n}" now run on it.`),o.usageUrl)console.log(`Manage usage: ${o.usageUrl}`);if(!r.models?.length)return;console.log("Models (use the id as model.modelId):");for(let s of r.models)console.log(`  ${s}`)}async function Qt(e){h();let n=k(e,"--base-url"),t=process.env.BROODS_ACCOUNT_SECRET;if(t)return new R({accountSecret:t,...n?{baseUrl:n}:{}});let o=await q(n);return new R({accountSecret:o.token,baseUrl:n??o.baseUrl})}async function Ys(e){let[n]=te(e);if(!n||!bn(n))throw Error(Z("disconnect"));if(await(await Qt(e)).disconnect(n)){H(`Disconnected ${we[n].label}`);return}console.log(`No ${n} connection.`)}async function zs(e){let n=await e.listConnections();if(n.length===0)console.log("No connections yet.");else console.log(`${"TYPE".padEnd(16)} ACCOUNT`);for(let t of n)console.log(`${we[t.type].label.padEnd(16)} ${t.email??t.clientId}`);console.log(`
+Connect one: broods connect <${qe.join("|")}>`)}async function Vs(e,n,t,o){try{let s=await new N({baseUrl:e,token:n}).getRuntimeKey(t,o);if(s?.apiKey)await Ce("BROODS_API_KEY",s.apiKey),H(`Wrote BROODS_API_KEY (${s.keyHint}) to .env.local`)}catch{}}async function Js(e){let n=h(),t=on(e),o=k(e,"--dashboard-url")??n.dashboardUrl??oe,r=Boolean(k(e,"--project")??n.project);console.log(`broods v${ae}`),console.log(`Dashboard:   ${o}`),console.log(`Project:     ${r?t.project:`none (${t.project} from folder name)`}`),console.log(`Stage:       ${t.stage}`);let s;try{s=await q(k(e,"--base-url"))}catch(l){x(l instanceof Error?l.message:String(l));return}console.log(`Server:      ${s.baseUrl}`);let i=new N({baseUrl:s.baseUrl,token:s.token}),a=await i.getOnboarding(),c=a.orgs.find((l)=>l.id===a.currentOrgId);if(a.user)console.log(`User:        ${a.user.email}`);if(console.log(`Org:         ${c?Me(c):a.currentOrgId}`),a.account)console.log(`Account:     ${a.account.username} (${a.account.status})`);if(!r){x("No project set. `broods dev` picks one.");return}await qs(i,t,c?.name);let d=a.projects.map((l)=>l.name);if(!d.includes(t.project))x(`This org has no project named ${t.project}. It has: ${d.length>0?d.join(", "):"none"}.`)}async function qs(e,n,t){let o=process.env.BROODS_API_KEY,r=M("BROODS_API_KEY")?"your shell":".env.local",s=null,i=null;try{s=await e.getRuntimeKey(n.project,n.stage)}catch(a){i=a instanceof Error?a.message:String(a)}if(i)console.log("Runtime key: unavailable"),x(`Could not read the runtime key: ${i}`);else if(!s?.apiKey)console.log("Runtime key: none for this scope"),x(`${n.project}/${n.stage} does not exist in ${t??"this org"} yet. \`broods dev\` will create it.`);else if(!o)console.log(`Runtime key: ${s.keyHint} (not in .env.local)`),x("BROODS_API_KEY is not set locally. Run `broods dev`.");else if(o===s.apiKey)console.log(`Runtime key: ${s.keyHint} (matches this org and stage)`);else console.log(`Runtime key: ${s.keyHint} expected`),x(`BROODS_API_KEY from ${r} belongs to a different org or stage. Run \`broods stage use ${n.stage}\` to repoint it.`)}async function Zs(e){let[n,t]=te(e);if(!n){console.log(ke("org",e));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown org subcommand: ${n}
-${Z("org")}`);let i=h(),a=y(e,"--dashboard-url")??i.dashboardUrl??ne,c=await Le(a,y(e,"--base-url")),d=new N({baseUrl:c.baseUrl,token:c.token}),l=await d.getOnboarding();if(o){for(let u of l.orgs){let b=u.accountStatus==="active"?"":` [${u.accountStatus} account]`;console.log(Se(`${Ne(u)}${b}`,u.id===l.currentOrgId))}console.log(`
-Only orgs where you are owner or admin can be selected from the CLI.`);return}if(r){let u=l.orgs.filter((k)=>k.accountStatus==="active"),b=t?u.find((k)=>k.slug===t||k.name===t||k.id===t):await Ie("Select organization",u,Ne,u.findIndex((k)=>k.id===l.currentOrgId));if(!b)throw Error(`No selectable organization matches "${t}". Run \`broods org list\`.`);await Nt(d,c,await d.selectOnboardingOrg(b.id),e);return}let p=t??await we("Organization name",Ce(process.cwd()));if(!p.trim())throw Error("Organization name is required.");await Nt(d,c,await d.createOnboardingOrg(p),e)}async function Gs(e){let[n,t]=ee(e);if(!n){console.log(ye("project",e));return}let o=n==="list"||n==="ls";if(!o&&!(n==="delete"||n==="rm"))throw Error(`Unknown project subcommand: ${n}
+${Z("org")}`);let i=h(),a=k(e,"--dashboard-url")??i.dashboardUrl??oe,c=await Be(a,k(e,"--base-url")),d=new N({baseUrl:c.baseUrl,token:c.token}),l=await d.getOnboarding();if(o){for(let u of l.orgs){let b=u.accountStatus==="active"?"":` [${u.accountStatus} account]`;console.log(Ee(`${Me(u)}${b}`,u.id===l.currentOrgId))}console.log(`
+Only orgs where you are owner or admin can be selected from the CLI.`);return}if(r){let u=l.orgs.filter((S)=>S.accountStatus==="active"),b=t?u.find((S)=>S.slug===t||S.name===t||S.id===t):await _e("Select organization",u,Me,u.findIndex((S)=>S.id===l.currentOrgId));if(!b)throw Error(`No selectable organization matches "${t}". Run \`broods org list\`.`);await Ht(d,c,await d.selectOnboardingOrg(b.id),e);return}let p=t??await ye("Organization name",Oe(process.cwd()));if(!p.trim())throw Error("Organization name is required.");await Ht(d,c,await d.createOnboardingOrg(p),e)}async function Xs(e){let[n,t]=te(e);if(!n){console.log(ke("project",e));return}let o=n==="list"||n==="ls";if(!o&&!(n==="delete"||n==="rm"))throw Error(`Unknown project subcommand: ${n}
-${Z("project")}`);let s=h(),i=y(e,"--dashboard-url")??s.dashboardUrl??ne,a=Qe(e),c=await Le(i,y(e,"--base-url")),d=new N({baseUrl:c.baseUrl,token:c.token});if(o){let k=await d.listProjects();if(k.length===0){console.log("This org has no projects yet. `broods dev` creates one.");return}console.log("Projects:");for(let A of k)console.log(ei(A,a.project));let C=k.filter((A)=>A.empty);if(C.length>0)console.log(`
-${C.length} empty project(s). Delete one with \`broods project delete <name>\`.`);return}let l=t??await we("Project to delete","");if(!l.trim())throw Error("Project name is required.");let p=await d.listProjects(),u=p.find((k)=>k.name===l||k.slug===l);if(!u)throw Error(`No project named "${l}". Existing: ${p.map((k)=>k.name).join(", ")}.`);if(!I(e,"--yes")){if(console.log(`Deleting ${u.name} removes ${Pn(u)}.`),!await Ve(`Permanently delete project ${u.name}?`)){console.log("Left it alone. Pass --yes to skip this prompt.");return}}let b=await d.deleteProject(u.id);if(!b)throw Error(`Project ${u.name} was not found.`);if(H(`Deleted project ${b.name} (${Pn(b)})`),b.name===a.project||b.slug===a.project)console.log("That was the project this directory points at. Update BROODS_PROJECT in .env.local.")}async function Ws(e){let[n,t]=ee(e);if(!n){console.log(ye("stage",e));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown stage subcommand: ${n}
+${Z("project")}`);let s=h(),i=k(e,"--dashboard-url")??s.dashboardUrl??oe,a=on(e),c=await Be(i,k(e,"--base-url")),d=new N({baseUrl:c.baseUrl,token:c.token});if(o){let S=await d.listProjects();if(S.length===0){console.log("This org has no projects yet. `broods dev` creates one.");return}console.log("Projects:");for(let A of S)console.log(ui(A,a.project));let C=S.filter((A)=>A.empty);if(C.length>0)console.log(`
+${C.length} empty project(s). Delete one with \`broods project delete <name>\`.`);return}let l=t??await ye("Project to delete","");if(!l.trim())throw Error("Project name is required.");let p=await d.listProjects(),u=p.find((S)=>S.name===l||S.slug===l);if(!u)throw Error(`No project named "${l}". Existing: ${p.map((S)=>S.name).join(", ")}.`);if(!I(e,"--yes")){if(console.log(`Deleting ${u.name} removes ${_n(u)}.`),!await Xe(`Permanently delete project ${u.name}?`)){console.log("Left it alone. Pass --yes to skip this prompt.");return}}let b=await d.deleteProject(u.id);if(!b)throw Error(`Project ${u.name} was not found.`);if(H(`Deleted project ${b.name} (${_n(b)})`),b.name===a.project||b.slug===a.project)console.log("That was the project this directory points at. Update BROODS_PROJECT in .env.local.")}async function Qs(e){let[n,t]=te(e);if(!n){console.log(ke("stage",e));return}let o=n==="list"||n==="ls",r=n==="use"||n==="select";if(!o&&!r&&!(n==="create"||n==="new"))throw Error(`Unknown stage subcommand: ${n}
-${Z("stage")}`);let i=h(),a=y(e,"--dashboard-url")??i.dashboardUrl??ne,c=Qe(e),d=await Le(a,y(e,"--base-url")),l=new N({baseUrl:d.baseUrl,token:d.token});if(o){let C=await l.listStages(c.project);if(C.length===0){console.log(`${c.project} has no stages yet. \`broods dev\` creates Development.`);return}console.log(`Stages for ${c.project}:`);for(let A of C)console.log(ni(A,c.stage));return}if(r){let C=await l.listStages(c.project),A=t?C.find((V)=>jn(V.name,t)):await Ie("Select stage",C,Jt,C.findIndex((V)=>jn(V.name,c.stage)));if(!A)throw Error(`${c.project} has no stage "${t}". Existing: ${C.map((V)=>V.name).join(", ")}. Create it with \`broods stage create ${t} --from ${c.stage}\`.`);let ae=M("BROODS_STAGE");await $e("BROODS_STAGE",A.name),console.log(`Stage: ${A.name} (wrote BROODS_STAGE)`),xn("BROODS_STAGE",ae),await An(l,{project:c.project,stage:A.name});return}let p=t??await we("Stage name","staging");if(!p.trim())throw Error("Stage name is required.");let u=y(e,"--from"),b=await l.createStage(c.project,p,u);if(H(`Created stage ${b.stage.name} in ${c.project}${b.clonedFrom?` from ${b.clonedFrom}`:""}`),b.clonedFrom)console.log(`  ${b.stage.agentCount} agent(s), ${b.stage.variableCount} env var(s) copied`);if(!I(e,"--use")){console.log(`Switch to it with \`broods stage use ${b.stage.name}\`.`);return}let k=M("BROODS_STAGE");await $e("BROODS_STAGE",b.stage.name),console.log(`Stage: ${b.stage.name} (wrote BROODS_STAGE)`),xn("BROODS_STAGE",k),await An(l,{project:c.project,stage:b.stage.name})}async function Fs(e){let{manifest:n,config:t}=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),o=await q(y(e,"--base-url")??t.baseUrl),r=new N({baseUrl:o.baseUrl,token:o.token}),s=await r.getManifest(n.project,n.stage);Ye(pn(n,s?.manifest??null)),li(await Tn(r,n),`${n.project}/${n.stage}`)}async function Ks(e){let{manifest:n,config:t,resourceAliases:o,channels:r}=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"deploy",useRuntimeStage:!1}),s=await q(y(e,"--base-url")??t.baseUrl),a=await new N({baseUrl:s.baseUrl,token:s.token}).putManifest(n,I(e,"--prune"),I(e,"--rotate-key"));await We(n,a.ids,process.cwd(),o,a.deployment,r),await to(),H(`Synced ${a.manifest.resources.length} resources to ${n.project}/${n.stage}`),await zt(a.deployment),qt(r,a),Yt(a)}async function zt(e){if(!e)return;if(e.apiKey){await $e("BROODS_API_KEY",e.apiKey),H(`Wrote BROODS_API_KEY (${e.keyHint}) to .env.local`);return}}function Yt(e){let n=e.warnings?.missingPolicies??[];if(n.length>0)x(`${n.length} policy ref(s) in agent config match no policy resource in this deploy. One that is not an existing policy id refuses every action at runtime: ${n.join(", ")}`);let t=e.warnings?.reservedResources??[];if(t.length>0)x(`Kept on prune, a reserved sandbox instance is still live: ${t.join(", ")}. Terminate it from the dashboard, then deploy again.`)}async function Hs(){let e=await Cn({maxAgeMs:0});if(e===null)throw Error("Could not reach the npm registry to check for a newer broods.");if(!En(e,re)){console.log(`broods v${re} is already the newest release.`);return}let n=jt(),t=_e(re),o=_e(e)===t,r=o?e:`the newest ${t}.x`;if(console.log(`Updating broods ${re} → ${r} ${n.global?"globally":"in this project"}`),console.log(`$ ${[n.command,...n.args].join(" ")}`),await new Promise((s,i)=>{let a=Gt(n.command,n.args,{cwd:n.cwd,stdio:"inherit",shell:process.platform==="win32"});a.on("error",i),a.on("exit",(c)=>{if(c===0){s();return}i(Error(`${n.command} exited with code ${c??"unknown"}`))})}),console.log(`broods ${o?e:`${t}.x`} installed.`),!o)x(`broods ${e} is a new major version. Install broods@${_e(e)} yourself to move to it.`)}async function Dt(){let e=await Cn();if(e===null||!En(e,re))return;x(`broods ${e} is out, you are on ${re}. Run \`broods update\`.`)}async function zs(e){if(await Vs(e),I(e,"--once")){if(!process.env.BROODS_SUPPRESS_DEV_TARGET)await Lt(e),await Dt();let u=_t.now();await ai(e),vt(_t.now()-u);return}let n=Ue(Ss(),`broods-declined-${process.pid}.txt`),t={...process.env,BROODS_DECLINED_FILE:n,BROODS_SUPPRESS_DEV_TARGET:"1",BROODS_RELOAD_ENV:"1"};await Lt(e),await Dt();let o,r=!1,s=!1,i,a=async()=>{let u=await Oi();if(u===i)return;await ii(e,t),i=u},c=(u)=>console.error(u instanceof Error?u.message:String(u));await a().catch(c);let d=()=>{if(r){s=!0;return}r=!0,a().catch(c).finally(()=>{if(r=!1,s)s=!1,d()})},l=ks(P(process.cwd(),S),{recursive:!0},(u,b)=>{if(!b||Ri(b))return;clearTimeout(o),o=setTimeout(d,150)}),p=new AbortController;Ys(e,p.signal),process.on("SIGINT",()=>{p.abort(),l.close(),process.exit(0)})}async function Ys(e,n){let t;try{t=await en(e)}catch(r){console.log(`· live logs off. ${r instanceof Error?r.message:String(r)}`);return}let o=_n(e);try{for await(let r of Fe(t,{backfill:0,minLevel:o,signal:n}))console.log(Dn(r))}catch(r){if(!n.aborted)console.error(`live logs: ${r instanceof Error?r.message:String(r)}`)}}async function Vs(e){await qs(),await Vt(!1),await Zs(e)}async function Vt(e){let n=process.cwd();if(!(await Promise.all([".agent",".agents",".claude","AGENTS.md","CLAUDE.md"].map((c)=>Ut(P(n,c))))).includes(!0))return;let r=P(n,Je);if(!e&&await Ut(P(r,"SKILL.md")))return;let s=Ue(Je,"SKILL.md"),i=Ue(Je,"scripts","onboard.sh");for(let c of[s,i])if(await Js(n,c)){x(`Skipped the agent skill: ${c} crosses a symlink.`);return}await In(P(r,"scripts"),{recursive:!0}),await be(P(r,"SKILL.md"),It);let a=P(r,"scripts","onboard.sh");await be(a,Tt),await ps(a,493),H(`Installed the broods agent skill at ${Je}/`)}async function Js(e,n){let t=e;for(let o of n.split(vs)){t=P(t,o);try{if((await fs(t)).isSymbolicLink())return!0}catch{return!1}}return!1}async function Ut(e){try{return await hs(e),!0}catch{return!1}}async function qs(){let e=P(process.cwd(),S);await In(P(e,_),{recursive:!0});let n=[];if(await Nn(e,n),n.length>0)return;await Ze(P(e,"index.ts"),ro(),!1),await Ze(P(e,".gitignore"),`_generated
+${Z("stage")}`);let i=h(),a=k(e,"--dashboard-url")??i.dashboardUrl??oe,c=on(e),d=await Be(a,k(e,"--base-url")),l=new N({baseUrl:d.baseUrl,token:d.token});if(o){let C=await l.listStages(c.project);if(C.length===0){console.log(`${c.project} has no stages yet. \`broods dev\` creates Development.`);return}console.log(`Stages for ${c.project}:`);for(let A of C)console.log(gi(A,c.stage));return}if(r){let C=await l.listStages(c.project),A=t?C.find((re)=>Dn(re.name,t)):await _e("Select stage",C,oo,C.findIndex((re)=>Dn(re.name,c.stage)));if(!A)throw Error(`${c.project} has no stage "${t}". Existing: ${C.map((re)=>re.name).join(", ")}. Create it with \`broods stage create ${t} --from ${c.stage}\`.`);let V=M("BROODS_STAGE");await Ce("BROODS_STAGE",A.name),console.log(`Stage: ${A.name} (wrote BROODS_STAGE)`),In("BROODS_STAGE",V),await Tn(l,{project:c.project,stage:A.name});return}let p=t??await ye("Stage name","staging");if(!p.trim())throw Error("Stage name is required.");let u=k(e,"--from"),b=await l.createStage(c.project,p,u);if(H(`Created stage ${b.stage.name} in ${c.project}${b.clonedFrom?` from ${b.clonedFrom}`:""}`),b.clonedFrom)console.log(`  ${b.stage.agentCount} agent(s), ${b.stage.variableCount} env var(s) copied`);if(!I(e,"--use")){console.log(`Switch to it with \`broods stage use ${b.stage.name}\`.`);return}let S=M("BROODS_STAGE");await Ce("BROODS_STAGE",b.stage.name),console.log(`Stage: ${b.stage.name} (wrote BROODS_STAGE)`),In("BROODS_STAGE",S),await Tn(l,{project:c.project,stage:b.stage.name})}async function ei(e){let{manifest:n,config:t}=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"dev"}),o=await q(k(e,"--base-url")??t.baseUrl),r=new N({baseUrl:o.baseUrl,token:o.token}),s=await r.getManifest(n.project,n.stage);Ze(wn(n,s?.manifest??null)),vi(await Nn(r,n),`${n.project}/${n.stage}`)}async function ni(e){let{manifest:n,config:t,resourceAliases:o,channels:r}=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"deploy",useRuntimeStage:!1}),s=await q(k(e,"--base-url")??t.baseUrl),a=await new N({baseUrl:s.baseUrl,token:s.token}).putManifest(n,I(e,"--prune"),I(e,"--rotate-key"));await Ke(n,a.ids,process.cwd(),o,a.deployment,r),await uo(),H(`Synced ${a.manifest.resources.length} resources to ${n.project}/${n.stage}`),await eo(a.deployment),ro(r,a),no(a)}async function eo(e){if(!e)return;if(e.apiKey){await Ce("BROODS_API_KEY",e.apiKey),H(`Wrote BROODS_API_KEY (${e.keyHint}) to .env.local`);return}}function no(e){let n=e.warnings?.missingPolicies??[];if(n.length>0)x(`${n.length} policy ref(s) in agent config match no policy resource in this deploy. One that is not an existing policy id refuses every action at runtime: ${n.join(", ")}`);let t=e.warnings?.reservedResources??[];if(t.length>0)x(`Kept on prune, a reserved sandbox instance is still live: ${t.join(", ")}. Terminate it from the dashboard, then deploy again.`)}async function ti(){let e=await xn({maxAgeMs:0});if(e===null)throw Error("Could not reach the npm registry to check for a newer broods.");if(!An(e,ae)){console.log(`broods v${ae} is already the newest release.`);return}let n=Mt(),t=Ue(ae),o=Ue(e)===t,r=o?e:`the newest ${t}.x`;if(console.log(`Updating broods ${ae} → ${r} ${n.global?"globally":"in this project"}`),console.log(`$ ${[n.command,...n.args].join(" ")}`),await new Promise((s,i)=>{let a=Jt(n.command,n.args,{cwd:n.cwd,stdio:"inherit",shell:process.platform==="win32"});a.on("error",i),a.on("exit",(c)=>{if(c===0){s();return}i(Error(`${n.command} exited with code ${c??"unknown"}`))})}),console.log(`broods ${o?e:`${t}.x`} installed.`),!o)x(`broods ${e} is a new major version. Install broods@${Ue(e)} yourself to move to it.`)}async function Ft(){let e=await xn();if(e===null||!An(e,ae))return;x(`broods ${e} is out, you are on ${ae}. Run \`broods update\`.`)}async function oi(e){if(await si(e),I(e,"--once")){if(!process.env.BROODS_SUPPRESS_DEV_TARGET)await Yt(e),await Ft();let u=Wt.now();await bi(e),At(Wt.now()-u);return}let n=Le(Is(),`broods-declined-${process.pid}.txt`),t={...process.env,BROODS_DECLINED_FILE:n,BROODS_SUPPRESS_DEV_TARGET:"1",BROODS_RELOAD_ENV:"1"};await Yt(e),await Ft();let o,r=!1,s=!1,i,a=async()=>{let u=await Ni();if(u===i)return;await wi(e,t),i=u},c=(u)=>console.error(u instanceof Error?u.message:String(u));await a().catch(c);let d=()=>{if(r){s=!0;return}r=!0,a().catch(c).finally(()=>{if(r=!1,s)s=!1,d()})},l=Ts(P(process.cwd(),y),{recursive:!0},(u,b)=>{if(!b||Li(b))return;clearTimeout(o),o=setTimeout(d,150)}),p=new AbortController;ri(e,p.signal),process.on("SIGINT",()=>{p.abort(),l.close(),process.exit(0)})}async function ri(e,n){let t;try{t=await rn(e)}catch(r){console.log(`· live logs off. ${r instanceof Error?r.message:String(r)}`);return}let o=Ln(e);try{for await(let r of He(t,{backfill:0,keepReconnecting:!0,minLevel:o,signal:n,onReconnect:Mn}))console.log(Bn(r))}catch(r){if(!n.aborted)console.error(`live logs: ${r instanceof Error?r.message:String(r)}`)}}async function si(e){await ai(),await to(!1),await ci(e)}async function to(e){let n=process.cwd();if(!(await Promise.all([".agent",".agents",".claude","AGENTS.md","CLAUDE.md"].map((c)=>Kt(P(n,c))))).includes(!0))return;let r=P(n,Qe);if(!e&&await Kt(P(r,"SKILL.md")))return;let s=Le(Qe,"SKILL.md"),i=Le(Qe,"scripts","onboard.sh");for(let c of[s,i])if(await ii(n,c)){x(`Skipped the agent skill: ${c} crosses a symlink.`);return}await Un(P(r,"scripts"),{recursive:!0}),await ve(P(r,"SKILL.md"),Bt);let a=P(r,"scripts","onboard.sh");await ve(a,Gt),await Es(a,493),H(`Installed the broods agent skill at ${Qe}/`)}async function ii(e,n){let t=e;for(let o of n.split(js)){t=P(t,o);try{if((await Cs(t)).isSymbolicLink())return!0}catch{return!1}}return!1}async function Kt(e){try{return await Os(e),!0}catch{return!1}}async function ai(){let e=P(process.cwd(),y);await Un(P(e,_),{recursive:!0});let n=[];if(await Wn(e,n),n.length>0)return;await nn(P(e,"index.ts"),po(),!1),await nn(P(e,".gitignore"),`_generated
 .cache
-`,!1),H(`Created starter ${S}/`)}async function Zs(e){let n=P(process.cwd(),".env.local"),t=await Ee(n),o=oo(t),r=o.BROODS_STAGE;if(["BROODS_DASHBOARD_URL","BROODS_BASE_URL","BROODS_PROJECT","BROODS_REGION"].filter((k)=>o[k]===void 0).length===0&&r!==void 0)return;let i=o.BROODS_PROJECT===void 0,a=r===void 0,c=o.BROODS_REGION===void 0,d=h(),l=y(e,"--dashboard-url")??d.dashboardUrl??ne,p=y(e,"--project")??process.env.BROODS_PROJECT??Ce(process.cwd()),u=y(e,"--stage")??v()??"development",b=y(e,"--region")??process.env.BROODS_REGION??De;if(process.stdin.isTTY&&i){let k=await Le(l,y(e,"--base-url")),C=new N({baseUrl:k.baseUrl,token:k.token}),A=await Xs(C,k),ae=await ti(C,A);if(p=await si(ae,p),!p.trim())throw Error("Project name is required.")}if(process.stdin.isTTY&&a){if(u=await we("Stage",u),!u.trim())throw Error("Stage is required.")}if(process.stdin.isTTY&&c){let k=[...Os];b=await Ie("Select service region",k,(C)=>C.label,k.findIndex((C)=>C.region===b)).then((C)=>C.region)}await Un({dashboardUrl:l,baseUrl:d.baseUrl??L(l),project:p,stage:u,region:b,force:!1})}async function Le(e,n){try{return await q(n)}catch(t){if(!process.stdin.isTTY)throw t;return x(`${t instanceof Error?t.message:String(t)} Starting browser login.`),await wn(e)}}async function Xs(e,n){try{return await e.getOnboarding()}catch(t){if(!n.org)throw t;return x("CLI onboarding endpoint is not available yet; using the org from the current login."),{currentOrgId:n.org.id,orgs:[{id:n.org.id,name:n.org.name,slug:n.org.slug,role:"admin",accountStatus:"active"}],projects:[]}}}async function Nt(e,n,t,o){let r=t.orgs.find((s)=>s.id===t.currentOrgId);if(!r)throw Error("Selected organization is not visible to this login");if(process.env.BROODS_TOKEN)x("BROODS_TOKEN is set, so the switch applies to this token only and was not stored.");else await W({...n,org:{id:r.id,name:r.name,slug:r.slug},...t.account?{account:{id:t.account.id,username:t.account.username}}:{}});console.log(`Org: ${Ne(r)}`),console.log(`Projects: ${t.projects.length>0?t.projects.map((s)=>s.name).join(", "):"none yet"}`),await An(e,Qe(o))}async function An(e,n){let t;try{t=await e.getRuntimeKey(n.project,n.stage)}catch(r){x(`Could not read the runtime key for ${n.project}/${n.stage} (${r instanceof Error?r.message:String(r)}). BROODS_API_KEY still points at the previous scope. Run \`broods whoami\` to check it.`);return}if(!t?.apiKey){x(`${n.project}/${n.stage} is not synced here yet, so BROODS_API_KEY still points at the previous scope. Run \`broods dev\`.`);return}let o=M("BROODS_API_KEY");if(!o&&process.env.BROODS_API_KEY===t.apiKey)return;await $e("BROODS_API_KEY",t.apiKey),H(`Wrote BROODS_API_KEY (${t.keyHint}) to .env.local`),xn("BROODS_API_KEY",o)}function xn(e,n){if(!n)return;x(`${e} is exported in your shell, which wins over .env.local. Run \`unset ${e}\` or the next broods command keeps the old value.`)}function Ne(e){let n=e.role==="owner"||e.role==="admin"?e.role:"member",t=e.plan?`, ${e.plan} plan`:"";return`${e.name} (${e.slug}, ${n}${t})`}function Qs(e){return e.slug===e.name?e.name:`${e.name} (${e.slug})`}function Pn(e){return e.empty?"nothing (it is already empty)":`${e.stageCount} stage(s), ${e.agentCount} agent(s), ${e.variableCount} env var(s), ${e.deploymentCount} deployment(s), ${e.fileCount} workspace file(s)`}function ei(e,n){let t=e.empty?"empty":Pn(e);return Se(`${e.name}: ${t}`,e.name===n||e.slug===n)}function ni(e,n){return Se(Jt(e),jn(e.name,n))}function Jt(e){let n=e.deploymentRegion?`, ${e.deploymentRegion}`:"";return`${e.name} (${e.kind}${n}): ${e.agentCount} agent(s), ${e.variableCount} env var(s)`}function jn(e,n){return e.trim().toLowerCase()===n.trim().toLowerCase()}function Qe(e){return h(),{project:y(e,"--project")??process.env.BROODS_PROJECT??Ce(process.cwd()),stage:y(e,"--stage")??v()??"development"}}async function ti(e,n){let t=n.orgs.filter((s)=>s.accountStatus==="active"),o={kind:"create",name:"New organization"},r=await Ie("Select organization",[...t,o],(s)=>("kind"in s)?"Create new organization":Ne(s),t.findIndex((s)=>s.id===n.currentOrgId));if("kind"in r){let s=await we("Organization name",Ce(process.cwd()));if(!s.trim())throw Error("Organization name is required.");return await e.createOnboardingOrg(s)}return r.id===n.currentOrgId?n:await e.selectOnboardingOrg(r.id)}function oi(e,n){return e.projects.find((o)=>o.name===n||o.slug===n)?.name??n}function ri(e,n){return e.projects.find((t)=>t.name===n||t.slug===n)}async function si(e,n){let t=oi(e,n);if(e.projects.length===0)return we("Project name",t);for(;;){let o=await Ct("Select project",e.projects,Qs,{hint:"type a new project name",defaultValue:t}),r=typeof o==="string"?o:o.name,s=ri(e,r);if(!s)return r;if(await Ve(`Continue with the existing project ${s.name}?`))return s.name}}function ii(e,n){return new Promise((t,o)=>{let r=process.argv[1]??"",s=Gt(process.execPath,[r,"dev","--once",...e],{stdio:"inherit",env:n});s.on("error",o),s.on("exit",(i,a)=>{if(i===0){t();return}o(Error(a?`Sync child exited from signal ${a}`:`Sync child exited with code ${i??"unknown"}`))})})}async function ai(e){let n=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),t=await q(y(e,"--base-url")??n.config.baseUrl),o=new N({baseUrl:t.baseUrl,token:t.token}),r=await Zt(o,n.manifest,await Tn(o,n.manifest));if(r.length>0)hn(r);for(let s=1;;s+=1)try{return await ci(o,n)}catch(i){if(!(i instanceof He)||s===Cs)throw i;x("Stage changed in another session. Re-reading...")}}async function ci(e,n){let{manifest:t,resourceAliases:o,channels:r}=n,s=await e.getManifest(t.project,t.stage),i=pn(t,s?.manifest??null);Ye(i.filter((u)=>u.operation!=="delete"));let a=await e.putManifest(t,!1,!1,s===null?0:s.revision);await We(t,a.ids,process.cwd(),o,a.deployment,r),await to();let c=await gi(),d=i.filter((u)=>u.operation==="delete"),l=d.filter((u)=>!c.has(`${u.kind}:${u.name}`)),p=!1;if(l.length>0)if(x("These remote resources are no longer declared locally:"),Ye(l),await Ve(`Delete ${l.length} resource(s) from ${t.project}/${t.stage}?`))a=await e.putManifest(t,!0,!1,a.revision),await We(t,a.ids,process.cwd(),o,a.deployment,r),await fi(),p=!0;else await pi(l.map((u)=>`${u.kind}:${u.name}`));if(!p&&d.length>0){let u=d.map((b)=>`${b.kind}:${b.name}`).join(", ");x(`${d.length} undeclared resource(s) kept remotely: ${u}. Re-declare in code or run \`deploy --prune\` to remove.`)}return await zt(a.deployment),qt(r,a),Yt(a),a}function qt(e,n){let t=n.deployment;if(!t||e.length===0)return;let o=new F,r=new Map;for(let i of e){if(!n.ids.agents[i.agentName])continue;let a=r.get(i.type)??[];a.push(i.alias),r.set(i.type,a)}let s=t.stageKind===void 0||t.stageKind==="production";for(let[i,a]of r){let c=s?o.accountWebhookUrl(t.accountId,i):o.stageWebhookUrl(t.accountId,t.endpointId,i);console.log(`Channel ${a.join(", ")} (${i}): ${c}${i==="pancake"?"?secret=<PANCAKE_WEBHOOK_SECRET>":""}`)}}async function Tn(e,n){let t=rt(n).filter((r)=>!r.startsWith("BROODS_"));if(t.length===0)return[];let o=new Map((await e.listEnv(n.project,n.stage)).map((r)=>[r.name,r.valueDigest]));return t.map((r)=>({name:r,state:di(r,o)}))}async function Zt(e,n,t){let o=t.filter((r)=>r.state==="unset"||r.state==="drifted").map((r)=>r.name);if(o.length===0)return[];return await Promise.all(o.map((r)=>e.setEnv(n.project,n.stage,r,process.env[r]))),o}function li(e,n){let t=qe(e,"drifted");if(t.length>0)x(`.env.local and ${n} disagree on ${t.length} variable(s): ${t.join(", ")}. Run \`broods env sync\` to push the local values.`)}function di(e,n){let t=process.env[e],o=n.get(e);if(t===void 0||t==="")return o===void 0?"unresolved":"stage-only";if(o===void 0)return"unset";return o===ui(t)?"synced":"drifted"}function ui(e){return Bt("sha256").update(e).digest("hex")}function qe(e,n){return e.filter((t)=>t.state===n).map((t)=>t.name)}async function Lt(e){let n=h(),{manifest:t,config:o}=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),r=await q(y(e,"--base-url")??o.baseUrl);bt({project:t.project,stage:t.stage,dashboardUrl:y(e,"--dashboard-url")??n.dashboardUrl??r.dashboardUrl??o.dashboardUrl??ne})}async function gi(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return new Set;let n=await Ee(e);return new Set(n.split(/\r?\n/).map((t)=>t.trim()).filter(Boolean))}async function pi(e){let n=process.env.BROODS_DECLINED_FILE;if(!n||e.length===0)return;await be(n,`${e.join(`
+`,!1),H(`Created starter ${y}/`)}async function ci(e){let n=P(process.cwd(),".env.local"),t=await Re(n),o=go(t),r=o.BROODS_STAGE;if(["BROODS_DASHBOARD_URL","BROODS_BASE_URL","BROODS_PROJECT","BROODS_REGION"].filter((S)=>o[S]===void 0).length===0&&r!==void 0)return;let i=o.BROODS_PROJECT===void 0,a=r===void 0,c=o.BROODS_REGION===void 0,d=h(),l=k(e,"--dashboard-url")??d.dashboardUrl??oe,p=k(e,"--project")??process.env.BROODS_PROJECT??Oe(process.cwd()),u=k(e,"--stage")??v()??"development",b=k(e,"--region")??process.env.BROODS_REGION??Ne;if(process.stdin.isTTY&&i){let S=await Be(l,k(e,"--base-url")),C=new N({baseUrl:S.baseUrl,token:S.token}),A=await li(C,S),V=await pi(C,A);if(p=await hi(V,p),!p.trim())throw Error("Project name is required.")}if(process.stdin.isTTY&&a){if(u=await ye("Stage",u),!u.trim())throw Error("Stage is required.")}if(process.stdin.isTTY&&c){let S=[...Ns];b=await _e("Select service region",S,(C)=>C.label,S.findIndex((C)=>C.region===b)).then((C)=>C.region)}await Gn({dashboardUrl:l,baseUrl:d.baseUrl??L(l),project:p,stage:u,region:b,force:!1})}async function Be(e,n){try{return await q(n)}catch(t){if(!process.stdin.isTTY)throw t;return x(`${t instanceof Error?t.message:String(t)} Starting browser login.`),await kn(e)}}async function li(e,n){try{return await e.getOnboarding()}catch(t){if(!(t instanceof Ve)||!n.org)throw t;return x("This broods server cannot list your orgs yet; using the org from your login."),{currentOrgId:n.org.id,orgs:[{id:n.org.id,name:n.org.name,slug:n.org.slug,role:"admin",accountStatus:"active"}],projects:[]}}}async function Ht(e,n,t,o){let r=t.orgs.find((s)=>s.id===t.currentOrgId);if(!r)throw Error("Selected organization is not visible to this login");if(process.env.BROODS_TOKEN)x("BROODS_TOKEN is set, so the switch applies to this token only and was not stored.");else await W({...n,org:{id:r.id,name:r.name,slug:r.slug},...t.account?{account:{id:t.account.id,username:t.account.username}}:{}});console.log(`Org: ${Me(r)}`),console.log(`Projects: ${t.projects.length>0?t.projects.map((s)=>s.name).join(", "):"none yet"}`),await Tn(e,on(o))}async function Tn(e,n){let t;try{t=await e.getRuntimeKey(n.project,n.stage)}catch(r){x(`Could not read the runtime key for ${n.project}/${n.stage} (${r instanceof Error?r.message:String(r)}). BROODS_API_KEY still points at the previous scope. Run \`broods whoami\` to check it.`);return}if(!t?.apiKey){x(`${n.project}/${n.stage} is not synced here yet, so BROODS_API_KEY still points at the previous scope. Run \`broods dev\`.`);return}let o=M("BROODS_API_KEY");if(!o&&process.env.BROODS_API_KEY===t.apiKey)return;await Ce("BROODS_API_KEY",t.apiKey),H(`Wrote BROODS_API_KEY (${t.keyHint}) to .env.local`),In("BROODS_API_KEY",o)}function In(e,n){if(!n)return;x(`${e} is exported in your shell, which wins over .env.local. Run \`unset ${e}\` or the next broods command keeps the old value.`)}function Me(e){let n=e.role==="owner"||e.role==="admin"?e.role:"member",t=e.plan?`, ${e.plan} plan`:"";return`${e.name} (${e.slug}, ${n}${t})`}function di(e){return e.slug===e.name?e.name:`${e.name} (${e.slug})`}function _n(e){return e.empty?"nothing (it is already empty)":`${e.stageCount} stage(s), ${e.agentCount} agent(s), ${e.variableCount} env var(s), ${e.deploymentCount} deployment(s), ${e.fileCount} workspace file(s)`}function ui(e,n){let t=e.empty?"empty":_n(e);return Ee(`${e.name}: ${t}`,e.name===n||e.slug===n)}function gi(e,n){return Ee(oo(e),Dn(e.name,n))}function oo(e){let n=e.deploymentRegion?`, ${e.deploymentRegion}`:"";return`${e.name} (${e.kind}${n}): ${e.agentCount} agent(s), ${e.variableCount} env var(s)`}function Dn(e,n){return e.trim().toLowerCase()===n.trim().toLowerCase()}function on(e){return h(),{project:k(e,"--project")??process.env.BROODS_PROJECT??Oe(process.cwd()),stage:k(e,"--stage")??v()??"development"}}async function pi(e,n){let t=n.orgs.filter((s)=>s.accountStatus==="active"),o={kind:"create",name:"New organization"},r=await _e("Select organization",[...t,o],(s)=>("kind"in s)?"Create new organization":Me(s),t.findIndex((s)=>s.id===n.currentOrgId));if("kind"in r){let s=await ye("Organization name",Oe(process.cwd()));if(!s.trim())throw Error("Organization name is required.");return await e.createOnboardingOrg(s)}return r.id===n.currentOrgId?n:await e.selectOnboardingOrg(r.id)}function fi(e,n){return e.projects.find((o)=>o.name===n||o.slug===n)?.name??n}function mi(e,n){return e.projects.find((t)=>t.name===n||t.slug===n)}async function hi(e,n){let t=fi(e,n);if(e.projects.length===0)return ye("Project name",t);for(;;){let o=await It("Select project",e.projects,di,{hint:"type a new project name",defaultValue:t}),r=typeof o==="string"?o:o.name,s=mi(e,r);if(!s)return r;if(await Xe(`Continue with the existing project ${s.name}?`))return s.name}}function wi(e,n){return new Promise((t,o)=>{let r=process.argv[1]??"",s=Jt(process.execPath,[r,"dev","--once",...e],{stdio:"inherit",env:n});s.on("error",o),s.on("exit",(i,a)=>{if(i===0){t();return}o(Error(a?`Sync child exited from signal ${a}`:`Sync child exited with code ${i??"unknown"}`))})})}async function bi(e){let n=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"dev"}),t=await q(k(e,"--base-url")??n.config.baseUrl),o=new N({baseUrl:t.baseUrl,token:t.token}),r=await so(o,n.manifest,await Nn(o,n.manifest));if(r.length>0)vn(r);for(let s=1;;s+=1)try{return await yi(o,n)}catch(i){if(!(i instanceof ze)||s===Us)throw i;x("Stage changed in another session. Re-reading...")}}async function yi(e,n){let{manifest:t,resourceAliases:o,channels:r}=n,s=await e.getManifest(t.project,t.stage),i=wn(t,s?.manifest??null);Ze(i.filter((u)=>u.operation!=="delete"));let a=await e.putManifest(t,!1,!1,s===null?0:s.revision);await Ke(t,a.ids,process.cwd(),o,a.deployment,r),await uo();let c=await $i(),d=i.filter((u)=>u.operation==="delete"),l=d.filter((u)=>!c.has(`${u.kind}:${u.name}`)),p=!1;if(l.length>0)if(x("These remote resources are no longer declared locally:"),Ze(l),await Xe(`Delete ${l.length} resource(s) from ${t.project}/${t.stage}?`))a=await e.putManifest(t,!0,!1,a.revision),await Ke(t,a.ids,process.cwd(),o,a.deployment,r),await Ci(),p=!0;else await Ei(l.map((u)=>`${u.kind}:${u.name}`));if(!p&&d.length>0){let u=d.map((b)=>`${b.kind}:${b.name}`).join(", ");x(`${d.length} undeclared resource(s) kept remotely: ${u}. Re-declare in code or run \`deploy --prune\` to remove.`)}return await eo(a.deployment),ro(r,a),no(a),a}function ro(e,n){let t=n.deployment;if(!t||e.length===0)return;let o=new F,r=new Map;for(let i of e){if(!n.ids.agents[i.agentName])continue;let a=r.get(i.type)??[];a.push(i.alias),r.set(i.type,a)}let s=t.stageKind===void 0||t.stageKind==="production";for(let[i,a]of r){let c=s?o.accountWebhookUrl(t.accountId,i):o.stageWebhookUrl(t.accountId,t.endpointId,i);console.log(`Channel ${a.join(", ")} (${i}): ${c}${i==="pancake"?"?secret=<PANCAKE_WEBHOOK_SECRET>":""}`)}}async function Nn(e,n){let t=dt(n).filter((r)=>!r.startsWith("BROODS_"));if(t.length===0)return[];let o=new Map((await e.listEnv(n.project,n.stage)).map((r)=>[r.name,r.valueDigest]));return t.map((r)=>({name:r,state:ki(r,o)}))}async function so(e,n,t){let o=t.filter((r)=>r.state==="unset"||r.state==="drifted").map((r)=>r.name);if(o.length===0)return[];return await Promise.all(o.map((r)=>e.setEnv(n.project,n.stage,r,process.env[r]))),o}function vi(e,n){let t=en(e,"drifted");if(t.length>0)x(`.env.local and ${n} disagree on ${t.length} variable(s): ${t.join(", ")}. Run \`broods env sync\` to push the local values.`)}function ki(e,n){let t=process.env[e],o=n.get(e);if(t===void 0||t==="")return o===void 0?"unresolved":"stage-only";if(o===void 0)return"unset";return o===Si(t)?"synced":"drifted"}function Si(e){return Vt("sha256").update(e).digest("hex")}function en(e,n){return e.filter((t)=>t.state===n).map((t)=>t.name)}async function Yt(e){let n=h(),{manifest:t,config:o}=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"dev"}),r=await q(k(e,"--base-url")??o.baseUrl);Rt({project:t.project,stage:t.stage,dashboardUrl:k(e,"--dashboard-url")??n.dashboardUrl??r.dashboardUrl??o.dashboardUrl??oe})}async function $i(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return new Set;let n=await Re(e);return new Set(n.split(/\r?\n/).map((t)=>t.trim()).filter(Boolean))}async function Ei(e){let n=process.env.BROODS_DECLINED_FILE;if(!n||e.length===0)return;await ve(n,`${e.join(`
 `)}
-`,{flag:"a"})}async function fi(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return;await be(e,"","utf8")}async function mi(e){let[n,t]=ee(e);if(!n){console.log(ye("env",e));return}let o=n==="list"||n==="ls",r=n==="rm"||n==="remove",s=n==="get",i=n==="sync",a=n==="set"||r||s;if(!o&&!i&&!a)throw Error(`Unknown env subcommand: ${n}
+`,{flag:"a"})}async function Ci(){let e=process.env.BROODS_DECLINED_FILE;if(!e)return;await ve(e,"","utf8")}async function Ri(e){let[n,t]=te(e);if(!n){console.log(ke("env",e));return}let o=n==="list"||n==="ls",r=n==="rm"||n==="remove",s=n==="get",i=n==="sync",a=n==="set"||r||s;if(!o&&!i&&!a)throw Error(`Unknown env subcommand: ${n}
 ${Z("env")}`);if(a&&!t)throw Error(`broods env ${n} needs a variable name.
-${Z("env")}`);let{manifest:c,config:d}=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),l=await q(y(e,"--base-url")??d.baseUrl),p=new N({baseUrl:l.baseUrl,token:l.token}),u=`${c.project}/${c.stage}`;if(i){await hi(p,c,u);return}if(o){let k=await p.listEnv(c.project,c.stage);if(k.length===0){console.log(`No environment variables set for ${u}.`);return}console.log(`Environment variables for ${u} (values hidden):`);for(let C of k)console.log(`  ${C.name}`);return}if(s){let k=await p.getEnv(c.project,c.stage,t);if(k===null){console.error(`${t} is not set for ${u}`),process.exitCode=1;return}console.log(k);return}if(r){await p.removeEnv(c.project,c.stage,t),H(`Removed ${t} from ${u}`);return}let b=await Et(t);await p.setEnv(c.project,c.stage,t,b),H(`Stored ${t} for ${u}`)}async function hi(e,n,t){let o=await Tn(e,n);if(o.length===0){console.log('No env("NAME") references in this project.');return}let r=await Zt(e,n,o);if(r.length>0)hn(r);let s=qe(o,"synced").length;console.log(r.length>0?`${s} other referenced variable(s) already in step with ${t}.`:`${s} referenced variable(s) already in step with ${t}.`);let i=qe(o,"stage-only");if(i.length>0)console.log(`${i.length} referenced variable(s) live only on ${t}: ${i.join(", ")}`);let a=qe(o,"unresolved");if(a.length>0)x(`${a.length} referenced variable(s) with no value here or on ${t}: ${a.join(", ")}. Put them in .env.local, or run \`broods env set <NAME>\`.`)}function _n(e){if(I(e,"--all"))return"DEBUG";let n=y(e,"--level");if(n===void 0&&I(e,"--level"))throw Error("Missing value for --level. Use DEBUG, INFO, WARN, or ERROR.");if(!n)return"WARN";let t=n.toUpperCase();if(t==="DEBUG")return"DEBUG";if(t==="INFO")return"INFO";if(t==="WARN"||t==="WARNING")return"WARN";if(t==="ERROR")return"ERROR";throw Error(`Unknown log level: ${n}. Use DEBUG, INFO, WARN, or ERROR.`)}async function wi(e){h();let n=y(e,"--project")??process.env.BROODS_PROJECT,t=y(e,"--stage")??v();if(!n)throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT in .env.local.");if(!t)throw Error("Stage name is required. Pass --stage <name> or set BROODS_STAGE in .env.local.");return{project:n,stage:t}}async function en(e){let n=await wi(e),t=h(),o=await Le(y(e,"--dashboard-url")??t.dashboardUrl??ne,y(e,"--base-url")),r=new N({baseUrl:o.baseUrl,token:o.token}),s=await r.mintStageSession(n.project,n.stage),i=async()=>{if(s.expiresAt-Date.now()<Es)s=await r.mintStageSession(n.project,n.stage);return s.token};return{baseUrl:process.env.BROODS_BASE_URL??process.env.BROODS_HOST??E,credential:i,project:s.projectSlug,stage:s.stageSlug}}function Xt(e){return e==="WARN"?" (--all for INFO too)":""}function Dn(e){let n=new Date(e.ts).toISOString().slice(11,23),t=e.level.padEnd(5),o=$s(e.message);return`${n} ${t} ${e.eventType} ${o}`}async function bi(e){let n=await en(e),{project:t,stage:o}=n,r=_n(e),s=new AbortController,i=()=>s.abort();process.on("SIGINT",i),console.log(`Streaming live logs for ${t}/${o} [${r}+]`+Xt(r)+", Ctrl+C to stop");try{for await(let a of Fe(n,{backfill:0,minLevel:r,signal:s.signal}))console.log(Dn(a))}catch(a){if(!s.signal.aborted)console.error(a instanceof Error?a.message:String(a)),process.exitCode=1}finally{process.off("SIGINT",i)}}async function yi(e){if(I(e,"--doctor")){await vi(I(e,"--request"));return}let n=ee(e)[0];if(!n){console.log(ye("machine",e));return}let{runMachineDaemon:t}=await import("../chunk-dmax7s31.js"),{baseUrl:o,credential:r}=await en(e),s=P(y(e,"--cwd")??process.cwd()),i=I(e,"--computer"),a=y(e,"--mcp"),c=I(e,"--force"),d=new AbortController,l=()=>d.abort();process.on("SIGINT",l),console.log(`Connecting ${n} to ${o} (cwd ${s}${i?", computer use on":""}), Ctrl+C to stop`);try{await t({baseUrl:o,computer:i,credential:r,cwd:s,force:c,log:(p)=>console.log(p),mcpFile:a?P(a):void 0,sandbox:n,signal:d.signal})}catch(p){console.error(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{process.off("SIGINT",l)}}async function vi(e){try{let{startDesktop:n}=await import("../chunk-5tnnqapc.js"),{display:t,driver:o,permissions:r}=await n(e);o.stop();let s=(i)=>i?"granted":"missing";if(console.log(`screenshot frame   ${t.width}x${t.height} (scale ${t.scale.toFixed(2)})`),console.log(`screen recording   ${s(r.screenRecording)}`),console.log(`accessibility      ${s(r.accessibility)}`),!r.screenRecording||!r.accessibility)console.log(e?"Approve the prompts, or add this terminal under System Settings > Privacy & Security, then run again.":"Run `broods machine --doctor --request` to show the macOS prompts."),process.exitCode=1}catch(n){console.error(n instanceof Error?n.message:String(n)),process.exitCode=1}}async function ki(e){let n=await en(e),{project:t,stage:o}=n,r=y(e,"--sandbox");if(I(e,"--sandbox")&&!G(r))throw Error("--sandbox needs the instance log id, the UUID shown in the dashboard Instances sheet.");let s=r?"DEBUG":_n(e),i=Number(y(e,"--limit")??y(e,"-n")??100),a=I(e,"--json"),c=new AbortController,d=()=>c.abort();process.on("SIGINT",d),console.log(`Logs for ${t}/${o}`+(r?` sandbox ${r}`:"")+` [${s}+]`+Xt(s)+` (backfill ${i}), Ctrl+C to stop`);try{for await(let l of Fe(n,{backfill:i,minLevel:s,...r?{sandboxId:r}:{},signal:c.signal}))if(a)console.log(JSON.stringify(l));else console.log(Dn(l))}catch(l){if(!c.signal.aborted)console.error(l instanceof Error?l.message:String(l)),process.exitCode=1}finally{process.off("SIGINT",d)}}async function Si(e){let[n,t]=ee(e);if(!n){console.log(ye("agent",e));return}if(n==="list"||n==="ls"){await $i(e);return}if(n==="get"){await Ei(t,e);return}throw Error(`Unknown agent subcommand: ${n}
+${Z("env")}`);let{manifest:c,config:d}=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"dev"}),l=await q(k(e,"--base-url")??d.baseUrl),p=new N({baseUrl:l.baseUrl,token:l.token}),u=`${c.project}/${c.stage}`;if(i){await Oi(p,c,u);return}if(o){let S=await p.listEnv(c.project,c.stage);if(S.length===0){console.log(`No environment variables set for ${u}.`);return}console.log(`Environment variables for ${u} (values hidden):`);for(let C of S)console.log(`  ${C.name}`);return}if(s){let S=await p.getEnv(c.project,c.stage,t);if(S===null){console.error(`${t} is not set for ${u}`),process.exitCode=1;return}console.log(S);return}if(r){await p.removeEnv(c.project,c.stage,t),H(`Removed ${t} from ${u}`);return}let b=await Tt(t);await p.setEnv(c.project,c.stage,t,b),H(`Stored ${t} for ${u}`)}async function Oi(e,n,t){let o=await Nn(e,n);if(o.length===0){console.log('No env("NAME") references in this project.');return}let r=await so(e,n,o);if(r.length>0)vn(r);let s=en(o,"synced").length;console.log(r.length>0?`${s} other referenced variable(s) already in step with ${t}.`:`${s} referenced variable(s) already in step with ${t}.`);let i=en(o,"stage-only");if(i.length>0)console.log(`${i.length} referenced variable(s) live only on ${t}: ${i.join(", ")}`);let a=en(o,"unresolved");if(a.length>0)x(`${a.length} referenced variable(s) with no value here or on ${t}: ${a.join(", ")}. Put them in .env.local, or run \`broods env set <NAME> --stage ${n.stage}\`.`)}function Ln(e){if(I(e,"--all"))return"DEBUG";let n=k(e,"--level");if(n===void 0&&I(e,"--level"))throw Error("Missing value for --level. Use DEBUG, INFO, WARN, or ERROR.");if(!n)return"WARN";let t=n.toUpperCase();if(t==="DEBUG")return"DEBUG";if(t==="INFO")return"INFO";if(t==="WARN"||t==="WARNING")return"WARN";if(t==="ERROR")return"ERROR";throw Error(`Unknown log level: ${n}. Use DEBUG, INFO, WARN, or ERROR.`)}async function Ai(e){h();let n=k(e,"--project")??process.env.BROODS_PROJECT,t=k(e,"--stage")??v();if(!n)throw Error("Project name is required. Pass --project <name> or set BROODS_PROJECT in .env.local.");if(!t)throw Error("Stage name is required. Pass --stage <name> or set BROODS_STAGE in .env.local.");return{project:n,stage:t}}async function rn(e){let n=await Ai(e),t=h(),o=await Be(k(e,"--dashboard-url")??t.dashboardUrl??oe,k(e,"--base-url")),r=new N({baseUrl:o.baseUrl,token:o.token}),s=await r.mintStageSession(n.project,n.stage),i=async()=>{if(s.expiresAt-Date.now()<Ds)s=await r.mintStageSession(n.project,n.stage);return s.token};return{baseUrl:process.env.BROODS_BASE_URL??process.env.BROODS_HOST??E,credential:i,project:s.projectSlug,stage:s.stageSlug}}function io(e){return e==="WARN"?" (--all for INFO too)":""}function Mn(e,n){console.error(Te(`Reconnecting to live logs (attempt ${e}): ${n}`,{stream:"stderr"}))}function Bn(e){let n=new Date(e.ts).toISOString().slice(11,23),t=e.level.padEnd(5),o=_s(e.message);return`${n} ${t} ${e.eventType} ${o}`}async function xi(e){let n=await rn(e),{project:t,stage:o}=n,r=Ln(e),s=new AbortController,i=()=>s.abort();process.on("SIGINT",i),console.log(`Streaming live logs for ${t}/${o} [${r}+]`+io(r)+", Ctrl+C to stop");try{for await(let a of He(n,{backfill:0,minLevel:r,signal:s.signal,onReconnect:Mn}))console.log(Bn(a))}catch(a){if(!s.signal.aborted)console.error(a instanceof Error?a.message:String(a)),process.exitCode=1}finally{process.off("SIGINT",i)}}async function Pi(e){if(I(e,"--doctor")){await ji(I(e,"--request"));return}let n=te(e)[0];if(!n){console.log(ke("machine",e));return}let{runMachineDaemon:t}=await import("../chunk-wq1x460w.js"),{baseUrl:o,credential:r}=await rn(e),s=P(k(e,"--cwd")??process.cwd()),i=I(e,"--computer"),a=k(e,"--mcp"),c=I(e,"--force"),d=new AbortController,l=()=>d.abort();process.on("SIGINT",l),console.log(`Connecting ${n} to ${o} (cwd ${s}${i?", computer use on":""}), Ctrl+C to stop`);try{await t({baseUrl:o,computer:i,credential:r,cwd:s,force:c,log:(p)=>console.log(p),mcpFile:a?P(a):void 0,sandbox:n,signal:d.signal})}catch(p){console.error(p instanceof Error?p.message:String(p)),process.exitCode=1}finally{process.off("SIGINT",l)}}async function ji(e){try{let{startDesktop:n}=await import("../chunk-5tnnqapc.js"),{display:t,driver:o,permissions:r}=await n(e);o.stop();let s=(i)=>i?"granted":"missing";if(console.log(`screenshot frame   ${t.width}x${t.height} (scale ${t.scale.toFixed(2)})`),console.log(`screen recording   ${s(r.screenRecording)}`),console.log(`accessibility      ${s(r.accessibility)}`),!r.screenRecording||!r.accessibility)console.log(e?"Approve the prompts, or add this terminal under System Settings > Privacy & Security, then run again.":"Run `broods machine --doctor --request` to show the macOS prompts."),process.exitCode=1}catch(n){console.error(n instanceof Error?n.message:String(n)),process.exitCode=1}}async function Ti(e){let n=await rn(e),{project:t,stage:o}=n,r=k(e,"--sandbox");if(I(e,"--sandbox")&&!G(r))throw Error("--sandbox needs the instance log id, the UUID shown in the dashboard Instances sheet.");let s=r?"DEBUG":Ln(e),i=Number(k(e,"--limit")??k(e,"-n")??100),a=I(e,"--json"),c=new AbortController,d=()=>c.abort();process.on("SIGINT",d),console.log(`Logs for ${t}/${o}`+(r?` sandbox ${r}`:"")+` [${s}+]`+io(s)+` (backfill ${i}), Ctrl+C to stop`);try{for await(let l of He(n,{backfill:i,minLevel:s,...r?{sandboxId:r}:{},signal:c.signal,onReconnect:Mn}))if(a)console.log(JSON.stringify(l));else console.log(Bn(l))}catch(l){if(!c.signal.aborted)console.error(l instanceof Error?l.message:String(l)),process.exitCode=1}finally{process.off("SIGINT",d)}}async function Ii(e){let[n,t]=te(e);if(!n){console.log(ke("agent",e));return}if(n==="list"||n==="ls"){await _i(e);return}if(n==="get"){await Di(t,e);return}throw Error(`Unknown agent subcommand: ${n}
-${Z("agent")}`)}async function Qt(e){let{manifest:n,config:t}=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),o=await q(y(e,"--base-url")??t.baseUrl),r=await new N({baseUrl:o.baseUrl,token:o.token}).getManifest(n.project,n.stage),s=n.resources.filter((i)=>i.kind==="agent").map((i)=>({name:i.name,config:i.config??{},agentId:r?.ids.agents[i.name]}));return{manifest:n,agents:s}}async function $i(e){let{manifest:n,agents:t}=await Qt(e);if(t.length===0){console.log(`No agents declared in ${n.project}/${n.stage}.`);return}console.log(`Agents in ${n.project}/${n.stage}:`);for(let o of t){let r=eo(o.config),s=o.config.publicAccess===!0?"public":"private",i=o.agentId?o.agentId:"not deployed";console.log(`  ${o.name}  [${s}]  ${r}  (${i})`)}}async function Ei(e,n){if(!e)throw Error(`Missing agent name.
+${Z("agent")}`)}async function ao(e){let{manifest:n,config:t}=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"dev"}),o=await q(k(e,"--base-url")??t.baseUrl),r=await new N({baseUrl:o.baseUrl,token:o.token}).getManifest(n.project,n.stage),s=n.resources.filter((i)=>i.kind==="agent").map((i)=>({name:i.name,config:i.config??{},agentId:r?.ids.agents[i.name]}));return{manifest:n,agents:s}}async function _i(e){let{manifest:n,agents:t}=await ao(e);if(t.length===0){console.log(`No agents declared in ${n.project}/${n.stage}.`);return}console.log(`Agents in ${n.project}/${n.stage}:`);for(let o of t){let r=co(o.config),s=o.config.publicAccess===!0?"public":"private",i=o.agentId?o.agentId:"not deployed";console.log(`  ${o.name}  [${s}]  ${r}  (${i})`)}}async function Di(e,n){if(!e)throw Error(`Missing agent name.
-${Z("agent")}`);let{manifest:t,agents:o}=await Qt(n),r=o.find((u)=>u.name===e);if(!r)throw Error(`Unknown local agent: ${e}`);let s=r.config,i=[s.sandboxes].flat().filter((u)=>typeof u==="string").map((u,b)=>b===0?`${u} (default)`:u),a=Array.isArray(s.workspaces)?s.workspaces.map((u)=>typeof u==="string"?u:u.name).filter(Boolean):[],c=he(s.tools)?Object.keys(s.tools):[],d=he(s.channels)?Object.keys(s.channels):[],l=he(s.subagent)&&Array.isArray(s.subagent.allowed)?s.subagent.allowed.map((u)=>typeof u==="string"?u:u.name).filter(Boolean):[],p=he(s.hooks)&&Array.isArray(s.hooks.webhooks)?s.hooks.webhooks.filter(he):[];if(console.log(`Agent: ${r.name}`),console.log(`  Project/Stage: ${t.project}/${t.stage}`),console.log(`  Deployed id:  ${r.agentId??"not deployed"}`),console.log(`  Public access: ${s.publicAccess===!0?"public (SSE/WebSocket enabled)":"private (secured by default)"}`),console.log(`  Model:        ${eo(s)}`),console.log(`  Sandboxes:    ${i.length>0?i.join(", "):"none"}`),console.log(`  Workspaces:   ${a.length>0?a.join(", "):"none"}`),console.log(`  Tools:        ${c.length>0?c.join(", "):"none"}`),console.log(`  Subagents:    ${l.length>0?l.join(", "):"none"}`),console.log(`  Channels:     ${d.length>0?d.join(", "):"none"}`),p.length>0)console.log("  Webhooks:"),p.forEach((u,b)=>{let k=Array.isArray(u.events)&&u.events.length>0?u.events.join(", "):"all events",C=u.enabled===!1?"disabled":"enabled";console.log(`    [${b}] ${C} → ${u.url??"none"} (${k})`)})}function eo(e){let n=he(e.model)?e.model:{},t=typeof n.provider==="string"?n.provider:void 0,o=typeof n.modelId==="string"?n.modelId:void 0;if(t&&o)return`${t}/${o}`;return o??t??"unconfigured model"}async function Ci(e){let[n,...t]=ee(e);if(!n)throw Error(`Missing agent name.
+${Z("agent")}`);let{manifest:t,agents:o}=await ao(n),r=o.find((u)=>u.name===e);if(!r)throw Error(`Unknown local agent: ${e}`);let s=r.config,i=[s.sandboxes].flat().filter((u)=>typeof u==="string").map((u,b)=>b===0?`${u} (default)`:u),a=Array.isArray(s.workspaces)?s.workspaces.map((u)=>typeof u==="string"?u:u.name).filter(Boolean):[],c=be(s.tools)?Object.keys(s.tools):[],d=be(s.channels)?Object.keys(s.channels):[],l=be(s.subagent)&&Array.isArray(s.subagent.allowed)?s.subagent.allowed.map((u)=>typeof u==="string"?u:u.name).filter(Boolean):[],p=be(s.hooks)&&Array.isArray(s.hooks.webhooks)?s.hooks.webhooks.filter(be):[];if(console.log(`Agent: ${r.name}`),console.log(`  Project/Stage: ${t.project}/${t.stage}`),console.log(`  Deployed id:  ${r.agentId??"not deployed"}`),console.log(`  Public access: ${s.publicAccess===!0?"public (SSE/WebSocket enabled)":"private (secured by default)"}`),console.log(`  Model:        ${co(s)}`),console.log(`  Sandboxes:    ${i.length>0?i.join(", "):"none"}`),console.log(`  Workspaces:   ${a.length>0?a.join(", "):"none"}`),console.log(`  Tools:        ${c.length>0?c.join(", "):"none"}`),console.log(`  Subagents:    ${l.length>0?l.join(", "):"none"}`),console.log(`  Channels:     ${d.length>0?d.join(", "):"none"}`),p.length>0)console.log("  Webhooks:"),p.forEach((u,b)=>{let S=Array.isArray(u.events)&&u.events.length>0?u.events.join(", "):"all events",C=u.enabled===!1?"disabled":"enabled";console.log(`    [${b}] ${C} → ${u.url??"none"} (${S})`)})}function co(e){let n=be(e.model)?e.model:{},t=typeof n.provider==="string"?n.provider:void 0,o=typeof n.modelId==="string"?n.modelId:void 0;if(t&&o)return`${t}/${o}`;return o??t??"unconfigured model"}async function Ui(e){let[n,...t]=te(e);if(!n)throw Error(`Missing agent name.
-${Z("run")}`);let o=t.join(" "),r=Boolean(process.stdin.isTTY&&process.stdout.isTTY);if(!r&&!o)throw Error("A prompt is required when output is redirected: broods run <agent> <prompt>. Run it in a terminal to chat without one.");let{manifest:s,config:i}=await de({project:y(e,"--project"),stage:y(e,"--stage"),command:"dev"}),a=await q(y(e,"--base-url")??i.baseUrl),c=s.resources.find((A)=>A.kind==="agent"&&A.name===n);if(!c)throw Error(`Unknown local agent: ${n}`);let l=(await new N({baseUrl:a.baseUrl,token:a.token}).getManifest(s.project,s.stage))?.ids.agents[n];if(!l)throw Error(`Agent ${n} is not synced yet. Run broods dev --once or broods deploy first.`);let p=await new N({baseUrl:a.baseUrl,token:a.token}).getRuntimeKey(s.project,s.stage).catch(()=>null);if(p?.apiKey)await $e("BROODS_API_KEY",p.apiKey);if(c.config.publicAccess!==!0)x(`Agent "${n}" does not set publicAccess: true. The public endpoint is secured by default; if the deployed agent has not enabled it, this run will be refused.`);let u=new F({baseUrl:y(e,"--base-url")??process.env.BROODS_BASE_URL??process.env.BROODS_HOST??a.baseUrl,...p?.apiKey?{apiKey:p.apiKey}:{}}),b={kind:"agent",name:n,id:l,project:s.project,stage:s.stage,...p?.endpointId?{endpointId:p.endpointId}:{},...p?.projectSlug?{projectSlug:p.projectSlug}:{},...p?.stageSlug?{stageSlug:p.stageSlug}:{}},{runAgentTui:k,streamAgentText:C}=await import("../chunk-m7ws7kqc.js");try{if(r){await k({client:u,agent:b,...o?{prompt:o}:{}});return}await C({client:u,agent:b,prompt:o})}catch(A){if((A instanceof Error?A.message:String(A)).includes("public_access_disabled"))throw Error(`Agent "${n}" is not publicly accessible (secured by default). Set publicAccess: true in its config and redeploy, or enable Public access in the dashboard.`);throw A}}async function Ze(e,n,t){try{await be(e,n,{flag:t?"w":"wx"})}catch(o){if(o.code==="EEXIST")return;throw o}}async function no(){let e=P(process.cwd(),".gitignore"),n=await Ee(e);if(n.split(/\r?\n/).some((r)=>[".env.local","/.env.local",".env*.local",".env.*",".env*"].includes(r.trim())))return;let o=n?`${n.trimEnd()}
+${Z("run")}`);let o=t.join(" "),r=Boolean(process.stdin.isTTY&&process.stdout.isTTY);if(!r&&!o)throw Error("A prompt is required when output is redirected: broods run <agent> <prompt>. Run it in a terminal to chat without one.");let{manifest:s,config:i}=await de({project:k(e,"--project"),stage:k(e,"--stage"),command:"dev"}),a=await q(k(e,"--base-url")??i.baseUrl),c=s.resources.find((A)=>A.kind==="agent"&&A.name===n);if(!c)throw Error(`Unknown local agent: ${n}`);let l=(await new N({baseUrl:a.baseUrl,token:a.token}).getManifest(s.project,s.stage))?.ids.agents[n];if(!l)throw Error(`Agent ${n} is not synced yet. Run broods dev --once or broods deploy first.`);let p=await new N({baseUrl:a.baseUrl,token:a.token}).getRuntimeKey(s.project,s.stage).catch(()=>null);if(p?.apiKey)await Ce("BROODS_API_KEY",p.apiKey);if(c.config.publicAccess!==!0)x(`Agent "${n}" does not set publicAccess: true. The public endpoint is secured by default; if the deployed agent has not enabled it, this run will be refused.`);let u=new F({baseUrl:k(e,"--base-url")??process.env.BROODS_BASE_URL??process.env.BROODS_HOST??a.baseUrl,...p?.apiKey?{apiKey:p.apiKey}:{}}),b={kind:"agent",name:n,id:l,project:s.project,stage:s.stage,...p?.endpointId?{endpointId:p.endpointId}:{},...p?.projectSlug?{projectSlug:p.projectSlug}:{},...p?.stageSlug?{stageSlug:p.stageSlug}:{}},{runAgentTui:S,streamAgentText:C}=await import("../chunk-m7ws7kqc.js");try{if(r){await S({client:u,agent:b,...o?{prompt:o}:{}});return}await C({client:u,agent:b,prompt:o})}catch(A){if((A instanceof Error?A.message:String(A)).includes("public_access_disabled"))throw Error(`Agent "${n}" is not publicly accessible (secured by default). Set publicAccess: true in its config and redeploy, or enable Public access in the dashboard.`);throw A}}async function nn(e,n,t){try{await ve(e,n,{flag:t?"w":"wx"})}catch(o){if(o.code==="EEXIST")return;throw o}}async function lo(){let e=P(process.cwd(),".gitignore"),n=await Re(e);if(n.split(/\r?\n/).some((r)=>[".env.local","/.env.local",".env*.local",".env.*",".env*"].includes(r.trim())))return;let o=n?`${n.trimEnd()}
 .env*.local
 `:`.env*.local
-`;await be(e,o,"utf8")}async function to(){let e=P(process.cwd(),S,".gitignore"),n=await Ee(e),o=["_generated",".cache"].filter((s)=>!n.split(/\r?\n/).some((i)=>i.trim()===s));if(o.length===0)return;let r=n?n.trimEnd()+`
+`;await ve(e,o,"utf8")}async function uo(){let e=P(process.cwd(),y,".gitignore"),n=await Re(e),o=["_generated",".cache"].filter((s)=>!n.split(/\r?\n/).some((i)=>i.trim()===s));if(o.length===0)return;let r=n?n.trimEnd()+`
 `+o.join(`
 `)+`
 `:o.join(`
 `)+`
-`;await be(e,r,"utf8")}async function Un(e){let n=P(process.cwd(),".env.local"),t=await Ee(n),o=oo(t),r={BROODS_DASHBOARD_URL:e.dashboardUrl,BROODS_BASE_URL:e.baseUrl,BROODS_PROJECT:e.project,BROODS_STAGE:e.stage,BROODS_REGION:e.region},s=t?t.replace(/\n?$/,`
-`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],i=!1;for(let[c,d]of Object.entries(r)){if(!d)continue;if(o[c]!==void 0&&!e.force)continue;let l=s.findIndex((p)=>p.trim().startsWith(`${c}=`));if(l>=0)s[l]=`${c}=${Xe(d)}`;else s.push(`${c}=${Xe(d)}`);if(process.env[c]===void 0)process.env[c]=d;i=!0}if(!i&&t)return;let a=`${s.filter((c,d,l)=>!(c===""&&d===l.length-1)).join(`
+`;await ve(e,r,"utf8")}async function Gn(e){let n=P(process.cwd(),".env.local"),t=await Re(n),o=go(t),r={BROODS_DASHBOARD_URL:e.dashboardUrl,BROODS_BASE_URL:e.baseUrl,BROODS_PROJECT:e.project,BROODS_STAGE:e.stage,BROODS_REGION:e.region},s=t?t.replace(/\n?$/,`
+`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],i=!1;for(let[c,d]of Object.entries(r)){if(!d)continue;if(o[c]!==void 0&&!e.force)continue;let l=s.findIndex((p)=>p.trim().startsWith(`${c}=`));if(l>=0)s[l]=`${c}=${tn(d)}`;else s.push(`${c}=${tn(d)}`);if(process.env[c]===void 0)process.env[c]=d;i=!0}if(!i&&t)return;let a=`${s.filter((c,d,l)=>!(c===""&&d===l.length-1)).join(`
 `)}
-`;await K(n,a),await no()}async function $e(e,n){let t=P(process.cwd(),".env.local"),o=await Ee(t),r=o?o.replace(/\n?$/,`
-`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],s=r.findIndex((a)=>a.trim().startsWith(`${e}=`));if(s>=0)r[s]=`${e}=${Xe(n)}`;else r.push(`${e}=${Xe(n)}`);process.env[e]=n;let i=`${r.filter((a,c,d)=>!(a===""&&c===d.length-1)).join(`
+`;await K(n,a),await lo()}async function Ce(e,n){let t=P(process.cwd(),".env.local"),o=await Re(t),r=o?o.replace(/\n?$/,`
+`).split(/\n/):["# Local broods CLI settings. Tokens are stored outside the repo."],s=r.findIndex((a)=>a.trim().startsWith(`${e}=`));if(s>=0)r[s]=`${e}=${tn(n)}`;else r.push(`${e}=${tn(n)}`);process.env[e]=n;let i=`${r.filter((a,c,d)=>!(a===""&&c===d.length-1)).join(`
 `)}
-`;await K(t,i),await no()}async function Ee(e){try{return await Mt(e,"utf8")}catch(n){if(n.code==="ENOENT")return"";throw n}}function oo(e){let n={};for(let t of e.split(/\r?\n/)){let o=t.trim();if(!o||o.startsWith("#"))continue;let r=o.indexOf("=");if(r<=0)continue;n[o.slice(0,r).trim()]=o.slice(r+1).trim()}return n}function Xe(e){return JSON.stringify(e)}function Ce(e){return bs(P(e)).replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")||"broods-app"}async function Oi(){let e=P(process.cwd(),S),n=[];await Nn(e,n);let t=Bt("sha256");for(let o of n.sort())t.update(ys(e,o)),t.update("\x00"),t.update(await Mt(o)),t.update("\x00");return t.digest("hex")}async function Nn(e,n){let t=await ms(e,{withFileTypes:!0});for(let o of t){let r=Ue(e,o.name);if(o.isDirectory()){if(o.name===_||o.name==="generated"||o.name===".cache")continue;await Nn(r,n);continue}if(o.isFile()&&(o.name.endsWith(".ts")||o.name.endsWith(".md")))n.push(r)}}function Ri(e){return e.split(/[\\/]/).some((n)=>n===_||n==="generated"||n===".cache")}function ro(){return`import { defineAgent, defineSandbox, env } from "broods";
+`;await K(t,i),await lo()}async function Re(e){try{return await zt(e,"utf8")}catch(n){if(n.code==="ENOENT")return"";throw n}}function go(e){let n={};for(let t of e.split(/\r?\n/)){let o=t.trim();if(!o||o.startsWith("#"))continue;let r=o.indexOf("=");if(r<=0)continue;n[o.slice(0,r).trim()]=o.slice(r+1).trim()}return n}function tn(e){return JSON.stringify(e)}function Oe(e){return xs(P(e)).replace(/^@/,"").replace(/\//g,"-").replace(/[^A-Za-z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")||"broods-app"}async function Ni(){let e=P(process.cwd(),y),n=[];await Wn(e,n);let t=Vt("sha256");for(let o of n.sort())t.update(Ps(e,o)),t.update("\x00"),t.update(await zt(o)),t.update("\x00");return t.digest("hex")}async function Wn(e,n){let t=await Rs(e,{withFileTypes:!0});for(let o of t){let r=Le(e,o.name);if(o.isDirectory()){if(o.name===_||o.name==="generated"||o.name===".cache")continue;await Wn(r,n);continue}if(o.isFile()&&(o.name.endsWith(".ts")||o.name.endsWith(".md")))n.push(r)}}function Li(e){return e.split(/[\\/]/).some((n)=>n===_||n==="generated"||n===".cache")}function po(){return`import { defineAgent, defineSandbox, env } from "broods";
 // A Lambda sandbox: a fresh, ephemeral bash environment created per run.
 export const lambdaSandbox = defineSandbox({
@@ -441,9 +444,9 @@ export const myAgent = defineAgent({
     system: "You are a helpful assistant.",
   },
   sandboxes: [lambdaSandbox],
-  // Expose the public runtime endpoint (SSE/WebSocket) so the API key and
+  // Expose the public runtime endpoint (SSE/WebSocket) so the runtime key and
   // \`broods run\` can reach this agent. Off by default: a private agent is
   // only reachable via internal endpoints or channel webhooks.
   publicAccess: true,
 });
-`}function Ai(){if("bun"in process.versions)return;if(typeof ws.registerHooks==="function")return;throw Error(`broods needs Node ${Te.engines.node.replace(">=","")} or newer, or Bun. This is Node ${process.version}.`)}function xi(e,n){if(e==="status")throw Error("status was renamed to whoami. Run `broods whoami`.");if(I(n,"--env")||y(n,"--env")!==void 0)throw Error("--env was renamed to --stage. Pass --stage <name> instead.");h();let t=process.env.BROODS_ENVIRONMENT;if(t!==void 0&&process.env.BROODS_STAGE===void 0)throw Error(`BROODS_ENVIRONMENT was renamed to BROODS_STAGE. Rename the key in .env.local (it is currently set to "${t}").`)}async function Pi(){let e=h(),[{createBroodsMcpServer:n},{serveStdio:t},o]=await Promise.all([import("../chunk-7ddy2nyy.js"),import("../chunk-g9yebag8.js"),T()]),r=o?new N({baseUrl:o.baseUrl,token:o.token}):null,s=n({allowDestructive:process.env.BROODS_MCP_ALLOW_DESTRUCTIVE==="1"&&M("BROODS_MCP_ALLOW_DESTRUCTIVE"),cli:r,scope:{project:e.project,stage:e.stage}});t(()=>s),await new Promise((i)=>{process.stdin.on("close",i)})}xs().catch((e)=>{yt(e instanceof Error?e.message:String(e)),process.exit(1)});export{se,fe,D};
+`}function Mi(){if("bun"in process.versions)return;if(typeof As.registerHooks==="function")return;throw Error(`broods needs Node ${De.engines.node.replace(">=","")} or newer, or Bun. This is Node ${process.version}.`)}function Bi(e,n){if(e==="status")throw Error("status was renamed to whoami. Run `broods whoami`.");if(I(n,"--env")||k(n,"--env")!==void 0)throw Error("--env was renamed to --stage. Pass --stage <name> instead.");h();let t=process.env.BROODS_ENVIRONMENT;if(t!==void 0&&process.env.BROODS_STAGE===void 0)throw Error(`BROODS_ENVIRONMENT was renamed to BROODS_STAGE. Rename the key in .env.local (it is currently set to "${t}").`)}async function Gi(){let e=h(),[{createBroodsMcpServer:n},{serveStdio:t},o]=await Promise.all([import("../chunk-4j35s4p8.js"),import("../chunk-kjccsy1h.js"),T()]),r=o?new N({baseUrl:o.baseUrl,token:o.token}):null,s=n({allowDestructive:process.env.BROODS_MCP_ALLOW_DESTRUCTIVE==="1"&&M("BROODS_MCP_ALLOW_DESTRUCTIVE"),cli:r,scope:{project:e.project,stage:e.stage}});t(()=>s),await new Promise((i)=>{process.stdin.on("close",i)})}Bs().catch((e)=>{Ot(e instanceof Error?e.message:String(e)),process.exit(1)});export{se,fe,D};