flujo-ai 3.47.0 → 3.48.0

package/.next/server/chunks/21619.js

@@ -1 +1 @@
-"use strict";exports.id=21619,exports.ids=[972,16079,17492,21619,33829,55437,56210,57863,68115,74188,77818,78591,80244],exports.modules={186359:(a,b,c)=>{c.d(b,{fI:()=>e,B5:()=>g});let d=JSON.parse('{"e":{"format":"flujo-workspace-encrypted","cipher":"aes-256-gcm","writeVersion":2,"readVersions":[1,2],"legacyPlaintextRead":true,"recipientKeyRequired":true,"recipientKeyBytes":32,"recipientKeyEncoding":"base64","v2Aad":"flujo:workspace-snapshot:v2","v2Digest":"sha256-encrypted-wire","v1Digest":"sha256-plaintext-zip"},"R":{"maxFileBytes":268435456,"maxUncompressedBytes":1073741824,"maxManifestBytes":8388608,"maxArchiveBytes":1082130432,"maxEncryptedBytes":1442844672,"maxMembers":65534}}'),e=d.e,f=d.R;function g(){let a=(a,b)=>{let c=process.env[a];if(void 0===c)return b;let d=Number(c);if(!/^[1-9]\d*$/.test(c)||!Number.isSafeInteger(d))throw Error("Snapshot limits are invalid.");return d},b=a("FLUJO_SNAPSHOT_MAX_FILE_BYTES",f.maxFileBytes),c=a("FLUJO_SNAPSHOT_MAX_BYTES",f.maxUncompressedBytes),d=c+f.maxManifestBytes,e=4*Math.ceil(d/3)+4096;if(!Number.isSafeInteger(d)||!Number.isSafeInteger(e))throw Error("Snapshot limits are invalid.");return{...f,maxFileBytes:b,maxUncompressedBytes:c,maxArchiveBytes:d,maxEncryptedBytes:e}}},261571:(a,b,c)=>{c.d(b,{Js:()=>i,L$:()=>j,SZ:()=>k});var d=c(610782),e=c(774755),f=c(266844),g=c(882980);let h=(0,f.h)("backend/services/mcp/runtimeHomeIsolation"),i="FLUJO_MCP_RUNTIME_HOME_ISOLATION";function j(a){let b=a?.trim().toLowerCase();if(b){if(["1","true","yes","on","isolated"].includes(b))return!0;if(["0","false","no","off","host"].includes(b))return!1}}async function k(a,b=process.env){if((0,g.SL)(a),"stdio"!==a.transport)return!1;let c=j(b[i]);if(void 0!==c)return c;if("isolated"===a.runtimeHomeMode)return!0;if("host"===a.runtimeHomeMode)return!1;try{let a=await (0,d.loadItem)(e.Zg.SPEECH_SETTINGS,void 0);return a?.experimental?.mcpRuntimeHomeIsolation===!0}catch(a){return h.warn("Could not read the workspace MCP runtime-home preference; defaulting to host home",{error:a}),!1}}},262070:(a,b,c)=>{c.d(b,{b:()=>P,f:()=>$});var d=c(973024),e=c(977598),f=c(907986),g=c(100629),h=c(157075),i=c(186359),j=c(621385);async function k(a,b,c,f){let g;a.on("error",()=>void 0);let h=(0,e.createHash)("sha256"),j=(0,e.createHash)("sha256");try{let a=(0,i.B5)(),h=c?(0,e.randomBytes)(12):void 0,j=c?(0,e.createCipheriv)("aes-256-gcm",c,h):void 0;j&&j.setAAD(Buffer.from(i.fI.v2Aad)),f?.throwIfAborted();let k=await d.promises.open(b,"wx",384);g={limits:a,iv:h,cipher:j,output:k}}catch(b){throw a.destroy(),b}let{limits:k,iv:l,cipher:m,output:n}=g,o=0,p=Buffer.alloc(0),q=0,r=async a=>{if(f?.throwIfAborted(),q+a.length>(c?k.maxEncryptedBytes:k.maxArchiveBytes))throw Error("Snapshot exceeds the archive size limit.");for(let b=0;b<a.length;){let c=await n.write(a,b,a.length-b);if(!c.bytesWritten)throw Error("Snapshot write made no progress.");b+=c.bytesWritten}h.update(a),q+=a.length},s=async(a,b=!1)=>{let c=p.length?Buffer.concat([p,a]):a,d=b?c.length:c.length-c.length%3;for(let a=0;a<d;){let b=Math.min(49152,d-a);await r(Buffer.from(c.subarray(a,a+b).toString("base64"))),a+=b}p=Buffer.from(c.subarray(d))},t=()=>a.destroy(f?.reason instanceof Error?f.reason:Error("Snapshot aborted."));f?.addEventListener("abort",t,{once:!0});let u=!1;try{for await(let b of(f?.throwIfAborted(),l&&await r(Buffer.from(`{"format":"flujo-workspace-encrypted","version":2,"iv":"${l.toString("base64")}","data":"`)),a)){f?.throwIfAborted();let a=Buffer.isBuffer(b)?b:Buffer.from(b);if((o+=a.length)>k.maxArchiveBytes)throw Error("Snapshot exceeds the archive size limit.");j.update(a),m?await s(m.update(a)):await r(a)}return m&&(await s(m.final(),!0),await r(Buffer.from(`","tag":"${m.getAuthTag().toString("base64")}"}`))),await n.sync(),{sha256:h.digest("hex"),plaintextSha256:j.digest("hex"),size:q}}catch(a){throw u=!0,a}finally{f?.removeEventListener("abort",t),a.destroy();try{await n.close()}catch(a){if(!u)throw a}}}async function l(a,b,c,f,g){let i,j=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),k=()=>i??=j.close(),l=!1;try{let i=await j.stat({bigint:!0}),m=a=>["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"].every(b=>i[b]===a[b]),n=async()=>{f.throwIfAborted(),g();let c=await d.promises.lstat(a,{bigint:!0});if(!i.isFile()||i.nlink!==BigInt(1)||!c.isFile()||c.isSymbolicLink()||i.size!==BigInt(b)||!m(c)||!m(await j.stat({bigint:!0})))throw Error("Snapshot archive failed its integrity check.")},o=async a=>{let c=Buffer.alloc(Math.min(65536,b-a));for(let b=0;b<c.length;){let{bytesRead:d}=await j.read(c,b,c.length-b,a+b);if(!d)throw Error("Snapshot archive failed its integrity check.");b+=d}return c};await n();let p=(0,e.createHash)("sha256");for(let a=0;a<b;a+=65536)f.throwIfAborted(),g(),p.update(await o(a));if(await n(),p.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.");let q=h.Readable.from(async function*(){try{let a=(0,e.createHash)("sha256");for(let c=0;c<b;c+=65536){await n();let b=await o(c);a.update(b),yield b}if(await n(),a.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.")}finally{await k()}}(),{objectMode:!1,highWaterMark:65536}),r=()=>q.destroy(Error("Snapshot session is no longer available."));return q.on("error",()=>void 0),q.once("close",()=>{f.removeEventListener("abort",r),k().catch(()=>void 0)}),f.addEventListener("abort",r,{once:!0}),f.aborted&&r(),l=!0,h.Readable.toWeb(q,{strategy:{highWaterMark:65536,size:a=>a.byteLength}})}finally{l||await k()}}var m=c(848161),n=c(176760),o=c.n(n),p=c(76364),q=c.n(p),r=c(620775),s=c(683843),t=c(472178),u=c(965385),v=c(826045),w=c(930100),x=c(719031),y=c(816079),z=c(774755),A=c(158601),B=c(739006);let C=".workspace.json";class D extends Error{constructor(a,b){super(b),this.code=a,this.name="SnapshotArchiveError"}}let E=new WeakMap,F=new WeakMap;function G(a){if(void 0!==a&&"string"!=typeof a)throw new D("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let b=a??process.env.FLUJO_WORKER_SNAPSHOT_KEY;if(void 0===b)return null;if("string"!=typeof b||44!==b.length)throw new D("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let c=Buffer.from(b,"base64");if(32!==c.length||c.toString("base64")!==b)throw c.fill(0),new D("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");return c}async function H(a){let b=!1,c=async(a,c)=>(a&&!/^\$\{global:[^}]+\}$/.test(a)&&(c||/^(?:encrypted:|encrypted_failed:|v2:)/.test(a))&&(b=!0),a);try{for(let d of y.DB){let e=a.file(`db/${d}.json`);if(!e)continue;let f=JSON.parse(await e.async("string"));if(d===z.Zg.GLOBAL_ENV_VARS&&f&&"object"==typeof f)for(let a of Object.values(f))await (0,y.I5)(a,c,!0);else await (0,y.I5)(f,c,!1,0,!1,d===z.Zg.MCP_SERVERS?async(a,c)=>(c&&("object"!=typeof c||Object.keys(c).length)&&(b=!0),c):void 0)}return b}catch{throw new D("CREDENTIALS_UNAVAILABLE","Credential inventory cannot be verified for plaintext export.")}}function I(a,b,c=!1){let d=o().relative(o().resolve(a),o().resolve(b));return""===d?c:!d.startsWith("..")&&!o().isAbsolute(d)}async function J(a,b,c,e,f,h){let i;f?.throwIfAborted();let j=o().join(b,C);try{i=await d.promises.lstat(j,{bigint:!0})}catch(a){if("ENOENT"===a.code)return;throw a}if(!i.isFile()||i.isSymbolicLink()||i.nlink>BigInt(1))throw new D("UNSAFE_ENTRY","Workspace metadata is not a plain, singly-linked file.");if(i.size>BigInt(e))throw new D("SIZE_LIMIT","Workspace metadata exceeds the configured file limit.");let k=await d.promises.realpath(b);if(!I(k,await d.promises.realpath(j)))throw new D("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.");try{let l=await (0,g.b)(j,{expected:i,maxBytes:e,signal:f,consume:h?.consume,verifyPath:async()=>{if(await (0,t.V$)(b,j),!I(k,await d.promises.realpath(j)))throw new D("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.")}});h?h.complete(i):(c(C,l),a.file(C,l))}catch(a){if(a instanceof g.$)throw new D("SIZE_LIMIT"===a.code?"SIZE_LIMIT":"UNSAFE_ENTRY","Workspace metadata changed or is unsafe.");throw a}}async function K(a,b,c={}){let g,k,{signal:l}=c;if(l?.throwIfAborted(),await (0,v.Tm)(a))throw new D("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let m=G(c.recipientKey),n=(0,f.getWorkspaceDataDir)(a);try{g=await d.promises.lstat(n)}catch{throw m?.fill(0),new D("WORKSPACE_UNAVAILABLE","Workspace directory is unavailable.")}if(!g.isDirectory()||g.isSymbolicLink())throw m?.fill(0),new D("WORKSPACE_UNAVAILABLE","Workspace directory is not a real directory.");let p=(0,i.B5)(),y=p.maxFileBytes,z=p.maxUncompressedBytes,I=[],M=0,N=new(q());try{k=await j.N.create()}catch(a){throw m?.fill(0),a}let O=new Map;try{let g,i,j,v=(a,b,c)=>{if(l?.throwIfAborted(),b.byteLength>y)throw new D("SIZE_LIMIT","Snapshot member exceeds the configured file limit.");if(b.subarray(0,16).equals(Buffer.from("SQLite format 3\0")))throw new D("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);if((M+=b.byteLength)>z)throw new D("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");I.push({path:a,size:b.byteLength,sha256:(0,e.createHash)("sha256").update(b).digest("hex"),mode:c?384|Number(c.mode&BigInt(64)):384})},G=k.size,K=(0,e.createHash)("sha256"),P=Buffer.alloc(0);await J(N,n,v,y,l,{consume:async a=>{if(k.size+a.length>z)throw new D("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");P.length<16&&(P=Buffer.concat([P,a.subarray(0,16-P.length)])),K.update(a),await k.append(a)},complete:a=>{if(P.equals(Buffer.from("SQLite format 3\0")))throw new D("UNSAFE_ENTRY","Live SQLite state is not portable: .workspace.json. Export it with its owning tool first.");let b=Number(a.size);M+=b,I.push({path:C,size:b,sha256:K.digest("hex"),mode:384}),N.file(C,Buffer.alloc(0)),O.set(C,{position:G,size:b,file:N.file(C)})}});let Q=["mcp-servers","db/codex-runtime","db/antigravity-cli-runtime","userdata/mcp-runtime","browser-profile","bash-utils","db/worker-bootstrap-secrets.json","db/native-tool-journal","db/native-session-payloads","db/native-session-origins"],R=a=>Q.some(b=>a===b||a.startsWith(`${b}/`))||/^db\/codex-private-[^/]*(?:\/|$)/i.test(a);for(let a of f.WORKSPACE_SUBTREES){let b;if(l?.throwIfAborted(),R(a)){N.folder(a);continue}let c=o().join(n,a);try{b=await d.promises.lstat(c)}catch(b){if("ENOENT"===b.code){N.folder(a);continue}throw b}if(!b.isDirectory()||b.isSymbolicLink())throw new D("UNSAFE_ENTRY",`Workspace subtree ${a} is not a real directory.`);N.folder(a),await (0,t.N)(N,c,a,n,(a,b)=>{throw new D(b.includes("size limit")?"SIZE_LIMIT":"UNSAFE_ENTRY",`Cannot safely snapshot ${a}: ${b}`)},{maxFileBytes:y,skippedDirectories:new Set(["node_modules",".venv","__pycache__"]),skipPath:R,signal:l,preserveMode:!0,allowHardLinks:!0,onFileStream:async(a,b,c)=>{let d=Number(c.size);if(M+d>z)throw new D("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");let f=k.size,g=(0,e.createHash)("sha256"),h=Buffer.alloc(0);for await(let a of b)l?.throwIfAborted(),h.length<16&&(h=Buffer.concat([h,a.subarray(0,16-h.length)])),g.update(a),await k.append(a);if(k.size-f!==d)throw new D("UNSAFE_ENTRY","Snapshot member changed while being captured.");if(h.equals(Buffer.from("SQLite format 3\0")))throw new D("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);M+=d,I.push({path:a,size:d,sha256:g.digest("hex"),mode:384|Number(c.mode&BigInt(64))}),N.file(a,Buffer.alloc(0),{unixPermissions:Number(c.mode&BigInt(33279))}),O.set(a,{position:f,size:d,file:N.file(a)})}})}await k.finish();let S=async a=>{let b=O.get(a);if(b&&N.file(a)===b.file){let a=[];for await(let c of k.range(b.position,b.size))a.push(c);return Buffer.concat(a)}return N.file(a).async("nodebuffer")};for(let[a,b]of O)b.file.async=(c,d)=>{let e=new(q());return e.file(a,h.Readable.from(k.range(b.position,b.size),{objectMode:!1,highWaterMark:65536})),e.file(a).async(c,d)};let T=async(a,b)=>{if(!N.file(a))return b;try{return JSON.parse((await S(a)).toString("utf8"))}catch{throw new D("UNSAFE_ENTRY",`Invalid workspace configuration: ${a}`)}},U=await T("db/mcp_servers.json",{});if(!U||"object"!=typeof U||Array.isArray(U)||Object.values(U).some(a=>!a||"object"!=typeof a))throw new D("UNSAFE_ENTRY","Invalid workspace configuration: db/mcp_servers.json");let V=await T("db/models.json",[]);if(!Array.isArray(V)||V.some(a=>!a||"object"!=typeof a))throw new D("UNSAFE_ENTRY","Invalid workspace configuration: db/models.json");let W=(a,b)=>{let c=I.findIndex(b=>b.path===a);-1!==c&&(M-=I.splice(c,1)[0].size),v(a,b),N.file(a,b,{unixPermissions:33152})},X=new Map;if(c.flowIds){let a=await T("db/flows.json",[]);if(!Array.isArray(a))throw new D("UNSAFE_ENTRY","Invalid workspace configuration: db/flows.json");for(let b of a)X.set(b.id,b);for(let a of Object.keys(N.files).filter(a=>/^db\/flows\/[^/]+\.json$/.test(a))){let b=await T(a,null);if(!b||"string"!=typeof b.id||!Array.isArray(b.nodes)||!Array.isArray(b.edges))throw new D("UNSAFE_ENTRY",`Invalid workspace flow: ${a}`);X.set(b.id,b)}}try{let a=(0,u.xL)(c.flowIds,{flows:[...X.values()],models:V,mcpServers:Object.entries(U).map(([a,b])=>({...b,name:a,transport:b.transport||"stdio"}))});i=a.requiresCodexAuth,(j=c.flowIds?a.flowIds:void 0)&&W("db/mcp_servers.json",Buffer.from(JSON.stringify(Object.fromEntries(a.configs.map(a=>[a.name,a]))))),g=await (0,u.zk)((0,u.am)(a.configs,n,{requiredServerNames:j?a.mcpServerNames:void 0}),{signal:l})}catch(a){throw l?.throwIfAborted(),new D("MCP_UNSUPPORTED",a instanceof Error?a.message:"MCP runtime cannot be reconstructed.")}if(!m&&await H(N))throw new D("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption.");let Y="none";if(i){if(!m)throw new D("CREDENTIALS_UNAVAILABLE","ChatGPT authentication requires an encrypted workspace snapshot.");try{let b=await (0,x.E0)(a);l?.throwIfAborted(),W("db/codex-runtime/auth.json",b),W(`db/codex-runtime/${x.Sy}`,Buffer.from(JSON.stringify(x.J1))),Y="chatgpt"}catch{throw l?.throwIfAborted(),new D("CREDENTIALS_UNAVAILABLE","Codex authentication is unavailable for encrypted transfer.")}}let Z=await T("db/encryption_key.json",{}),$="user"===Z.encryption_type?"user":"default";if("user"===$){let b;if(!m)throw new D("CREDENTIALS_UNAVAILABLE","Private workspace bootstrap requires an encrypted snapshot.");try{b="operator-file"===Z.key_protection?await (0,f.runWithWorkspace)(a,()=>(0,w.OS)(Z)):(0,A.eu)()}catch{throw new D("CREDENTIALS_UNAVAILABLE","Restore the matching independent operator secret before creating a worker snapshot.")}if(!b)throw new D("CREDENTIALS_UNAVAILABLE","Unlock this workspace before creating a worker snapshot.");W("db/worker-bootstrap-secrets.json",Buffer.from(JSON.stringify({version:1,workspaceDek:b})))}I.sort((a,b)=>a.path.localeCompare(b.path));let _={formatVersion:s.nt,layoutVersion:r.q,workspace:a,generation:b,createdAt:new Date().toISOString(),coherence:"registered-flujo-writers",externalRootsIncluded:!1,subtrees:f.WORKSPACE_SUBTREES,files:I,source:{version:B.rE,platform:process.platform},runtime:{mcpTransfer:g,codexAuth:Y,encryption:$,...j?{selectedFlowIds:j}:{}},excludedRuntimePaths:Q},aa=Buffer.from(JSON.stringify(_,null,2));if(aa.length>p.maxManifestBytes||Object.keys(N.files).length+1>p.maxMembers)throw new D("SIZE_LIMIT","Snapshot manifest or member count exceeds the restore limit.");N.file("snapshot-manifest.json",aa);let ab=!1,ac={zip:N,manifest:_,files:I.length,bytes:M,dispose:async()=>{ab||(m?.fill(0),await k.close(),ab=!0)}};return l?.throwIfAborted(),E.set(ac,{store:k,members:O}),N.generateInternalStream=a=>L(ac).generateInternalStream(a),F.set(ac,{key:m,recipientKeyUsed:void 0!==c.recipientKey}),ac}catch(a){throw m?.fill(0),await k.close().catch(()=>void 0),a}}function L(a){let b=E.get(a);if(!b)return a.zip;let c=new(q());for(let[d,e]of Object.entries(a.zip.files)){let a=b.members.get(d),f={date:e.date,unixPermissions:e.unixPermissions??void 0};e.dir?c.file(d,null,{...f,dir:!0}):a&&a.file===e?c.file(d,h.Readable.from(b.store.range(a.position,a.size),{objectMode:!1,highWaterMark:65536}),f):c.file(d,e.async("nodebuffer"),f)}return c}async function M(a,b={}){let{signal:c}=b;c?.throwIfAborted();let f=F.get(a),g=f?.recipientKeyUsed?Buffer.from(f.key):G();try{if(F.has(a)){let a=f?.key;if(!!a!=!!g||a&&g&&!(0,e.timingSafeEqual)(a,g))throw g?.fill(0),new D("CREDENTIALS_UNAVAILABLE","Snapshot encryption key changed. Start a new capture.")}let b=Object.keys(a.zip.files);if(b.length>(0,i.B5)().maxMembers)throw new D("SIZE_LIMIT","Snapshot exceeds the archive member limit.");let j=new Set(["db/codex-runtime/","db/codex-runtime/auth.json",`db/codex-runtime/${x.Sy}`]);if(b.some(a=>/^db\/codex-private-/i.test(a))||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a)&&!j.has(a))||!g&&("chatgpt"===a.manifest.runtime.codexAuth||"user"===a.manifest.runtime.encryption||b.includes("db/worker-bootstrap-secrets.json")||await H(a.zip)||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a))))throw g?.fill(0),new D("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption; runtime homes cannot be exported.");if(await (0,v.Tm)(a.manifest.workspace))throw new D("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let l=await d.promises.mkdtemp(o().join((0,m.tmpdir)(),"flujo-hot-clone-"));await d.promises.chmod(l,448).catch(()=>void 0);let n=o().join(l,"workspace.snapshot.zip");try{let b=L(a).generateNodeStream({type:"nodebuffer",streamFiles:!0,compression:"DEFLATE",compressionOptions:{level:6},platform:"UNIX"},()=>c?.throwIfAborted()),e=await k(new h.Readable({highWaterMark:65536}).wrap(b),n,g,c);return await d.promises.chmod(n,384).catch(()=>void 0),c?.throwIfAborted(),{archivePath:n,stagingDir:l,sha256:e.sha256,plaintextSha256:e.plaintextSha256,encrypted:!!g,encryptionVersion:2*!!g,recipientKeyUsed:f?.recipientKeyUsed??!1,size:e.size,files:a.files,bytes:a.bytes}}catch(a){throw await d.promises.rm(l,{recursive:!0,force:!0}).catch(()=>void 0),a}}finally{g?.fill(0)}}var N=c(879628);let O=/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;class P extends Error{constructor(a,b,c){super(c),this.code=a,this.status=b,this.name="SnapshotCoordinatorError"}}let Q=globalThis.__flujoWorkspaceSnapshotSessions??(globalThis.__flujoWorkspaceSnapshotSessions=new Map);function R(a){return{sessionId:a.sessionId,workspace:a.workspace,generation:a.generation,state:a.state,createdAt:new Date(a.createdAtMs).toISOString(),expiresAt:new Date(a.expiresAtMs).toISOString(),bytesStaged:a.bytesStaged,filesStaged:a.filesStaged,archiveBytes:a.archiveBytes,sha256:a.sha256,plaintextSha256:a.plaintextSha256,encrypted:a.encrypted,encryptionVersion:a.encryptionVersion,recipientKeyUsed:a.recipientKeyUsed,errorCode:a.errorCode,error:a.error}}function S(a){return"finalized"===a||"aborted"===a||"failed"===a}async function T(a){let b=a.stagingDir;a.archivePath=void 0,a.stagingDir=void 0,b&&await d.promises.rm(b,{recursive:!0,force:!0}).catch(()=>void 0)}function U(a){a.expiryTimer&&(clearTimeout(a.expiryTimer),a.expiryTimer=void 0)}async function V(a){S(a.state)||(U(a),a.abortRequested=!0,a.state="aborted",a.errorCode="SNAPSHOT_EXPIRED",a.controller.abort(Error("Snapshot session expired.")),await T(a))}async function W(a){Date.now()<=a.expiresAtMs||S(a.state)||await V(a)}async function X(a){let b=Q.get(a);return b&&await W(b),b}function Y(a,b){if(!O.test(b))throw new P("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");let c=Q.get(a);if(!c||c.sessionId!==b)throw new P("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");return c}async function Z(a){let b,c,{signal:d}=a.controller,e=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_CAPTURE_TIMEOUT_MS??"",10))||c<=0?3e4:Math.min(c,6e4),f=setTimeout(()=>{d.aborted||(a.abortRequested=!0,a.state="failed",a.errorCode="SNAPSHOT_TIMEOUT",U(a),a.controller.abort(Error("Workspace snapshot exceeded its capture time limit.")))},e);f.unref?.();try{b=await (0,N.Ns)(async c=>(a.generation=c,d.throwIfAborted(),a.state="staging",b=await K(a.workspace,c,{signal:d,flowIds:a.flowIds,recipientKey:a.recipientKey})),{workspace:a.workspace,timeoutMs:e,signal:d}),d.throwIfAborted(),a.bytesStaged=b.bytes,a.filesStaged=b.files,clearTimeout(f);let c=await M(b,{signal:d});if(a.archivePath=c.archivePath,a.stagingDir=c.stagingDir,a.archiveBytes=c.size,a.sha256=c.sha256,a.plaintextSha256=c.plaintextSha256,a.encrypted=c.encrypted,a.encryptionVersion=c.encryptionVersion??+!!c.encrypted,a.recipientKeyUsed=c.recipientKeyUsed??!1,a.recipientKey=void 0,await b.dispose?.(),b=void 0,a.abortRequested){"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"),await T(a);return}a.state="ready"}catch(b){a.abortRequested?"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"):(a.state="failed",U(a),a.errorCode=b instanceof D?b.code:b instanceof Error&&"WorkspaceSnapshotBusyError"===b.name?"SNAPSHOT_BUSY":b instanceof Error&&"WorkspaceSnapshotTimeoutError"===b.name?"SNAPSHOT_TIMEOUT":"SNAPSHOT_FAILED",a.error=b instanceof D?b.message:void 0),await T(a)}finally{a.recipientKey=void 0,clearTimeout(f),await b?.dispose?.().catch(()=>void 0)}}let $={async info(a=(0,f.getCurrentWorkspace)()){let b=(0,f.normalizeWorkspaceName)(a),c=await X(b),d=(0,N.B7)(b),e=c&&!S(c.state)?R(c):null;return{workspace:b,layoutVersion:r.q,workerCompatibility:(0,s.d1)(),capability:e||d.blocked?"busy":"available",coherence:"registered-flujo-writers",externalRootsIncluded:!1,activeOperation:e}},async begin(a=(0,f.getCurrentWorkspace)(),b={}){let c;void 0!==b.recipientKey&&G(b.recipientKey)?.fill(0);let d=(0,f.normalizeWorkspaceName)(a),g=Q.get(d);if(g&&!S(g.state)&&Date.now()<=g.expiresAtMs)throw new P("SNAPSHOT_BUSY",409,"A snapshot is already active for this workspace.");g&&(S(g.state)?(U(g),T(g)):V(g));let h=Date.now(),i=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_SESSION_TTL_MS??"",10))||c<=0?9e5:Math.min(c,36e5),j={sessionId:(0,e.randomUUID)(),workspace:d,generation:(0,N.B7)(d).generation,state:"beginning",createdAtMs:h,expiresAtMs:h+i,bytesStaged:0,filesStaged:0,abortRequested:!1,controller:new AbortController,flowIds:b.flowIds?[...b.flowIds]:void 0,recipientKey:b.recipientKey,encryptionVersion:2*(void 0!==b.recipientKey||void 0!==process.env.FLUJO_WORKER_SNAPSHOT_KEY)};Q.set(d,j);let k=setTimeout(()=>{(0,f.runWithWorkspace)(d,async()=>{await V(j)})},i);return k.unref?.(),j.expiryTimer=k,(0,f.runWithWorkspace)(d,()=>Z(j)),R(j)},async status(a,b=(0,f.getCurrentWorkspace)()){let c=Y((0,f.normalizeWorkspaceName)(b),a);return await W(c),R(c)},async readDownload(a,b=(0,f.getCurrentWorkspace)()){let c,d=Y((0,f.normalizeWorkspaceName)(b),a);if(await W(d),"SNAPSHOT_EXPIRED"===d.errorCode)throw new P("SNAPSHOT_EXPIRED",410,"Snapshot session has expired.");if("ready"!==d.state||!d.archivePath||!d.sha256||void 0===d.archiveBytes)throw new P("SNAPSHOT_NOT_READY",409,"Snapshot archive is not ready.");try{c=await l(d.archivePath,d.archiveBytes,d.sha256,d.controller.signal,()=>{if("ready"!==d.state||Date.now()>d.expiresAtMs)throw Error("Snapshot session is no longer available.")})}catch{throw d.state="failed",d.errorCode="SNAPSHOT_INTEGRITY",await T(d),new P("SNAPSHOT_INTEGRITY",500,"Snapshot archive failed its integrity check.")}return{content:c,sha256:d.sha256,plaintextSha256:d.plaintextSha256??d.sha256,encrypted:d.encrypted??!1,encryptionVersion:d.encryptionVersion??0,recipientKeyUsed:d.recipientKeyUsed??!1,size:d.archiveBytes}},async finalize(a,b=(0,f.getCurrentWorkspace)()){let c=Y((0,f.normalizeWorkspaceName)(b),a);if(await W(c),"finalized"===c.state)return R(c);if("ready"!==c.state)throw new P("SNAPSHOT_NOT_READY",409,"Only a ready snapshot can be finalized.");return U(c),await T(c),c.state="finalized",R(c)},async abort(a,b=(0,f.getCurrentWorkspace)()){let c=Y((0,f.normalizeWorkspaceName)(b),a);if("aborted"===c.state)return R(c);if("finalized"===c.state)throw new P("SNAPSHOT_NOT_READY",409,"A finalized snapshot cannot be aborted.");return U(c),c.abortRequested=!0,c.state="aborted",c.controller.abort(Error("Snapshot session was aborted.")),await T(c),R(c)}}},464896:(a,b,c)=>{function d(a){let b=a.startRestriction,c="unrestricted"===b||"singleton"===b||"exclusive"===b,d=!c&&!0===a.exclusive;return{startRestriction:c?b:d?"exclusive":"unrestricted",superExclusive:!!d||!0===a.superExclusive,emergency:!0===a.emergency}}function e(a){return!(!a||"object"!=typeof a||Array.isArray(a))&&["personaId","behaviorSlotKey","personaRetired","personaArchived"].some(b=>Object.prototype.hasOwnProperty.call(a,b))}c.d(b,{V:()=>e,v:()=>d})},480244:(a,b,c)=>{c.r(b),c.d(b,{loadServerConfigs:()=>q,loadServerRoots:()=>r,saveConfig:()=>t});var d=c(333873),e=c.n(d),f=c(107397),g=c(610782),h=c(774755),i=c(266844),j=c(907986),k=c(882980);let l=(0,i.h)("backend/services/mcp/config"),m=new Set(["streamable","sse","websocket"]),n=new Map;async function o(a){if(n.has(a))return n.get(a);let b=null;try{let c=(0,f.Lp)({baseDir:a,timeout:{block:5e3}});b=(await c.remote(["get-url","origin"])||"").trim()||null}catch{b=null}return n.set(a,b),b}async function p(a){var b;let c;if(m.has(a.transport))return{type:"remote"};let d="string"!=typeof(b=a.rootPath)||""===b.trim()?null:e().isAbsolute(b)?b:e().resolve((0,j.getWorkspaceDataDir)(),b);if(d&&""!==(c=e().relative(e().join((0,j.getWorkspaceDataDir)(),"mcp-servers"),d))&&!c.startsWith("..")&&!e().isAbsolute(c)){let a=await o(d);if(a)return{type:"github",repositoryUrl:a}}return{type:"local"}}async function q(){l.debug("Entering loadServerConfigs method");try{let a=await (0,g.loadItem)(h.Zg.MCP_SERVERS,{}),b=Object.entries(a).map(([a,b])=>{let c=(0,k.H6)(b.transport),d=a=>"string"==typeof a?(0,j.remapLegacyDefaultWorkspaceReference)(a,"mcp-servers"):void 0,e=a=>Array.isArray(a)?a.map(d).filter(a=>void 0!==a):void 0,f=a=>{if(!a||"object"!=typeof a||Array.isArray(a))return;let b={};for(let[c,e]of Object.entries(a)){if("string"==typeof e){b[c]=d(e)??e;continue}e&&"object"==typeof e&&"value"in e&&"string"==typeof e.value&&"metadata"in e&&e.metadata&&"object"==typeof e.metadata&&"isSecret"in e.metadata&&"boolean"==typeof e.metadata.isSecret&&(b[c]={value:d(e.value)??e.value,metadata:{isSecret:e.metadata.isSecret}})}return b},g=b.launch,h=g&&"object"==typeof g?{...g,command:d(g.command),cwd:d(g.cwd),args:e(g.args),env:f(g.env)}:void 0;b={...b,transport:c,rootPath:d(b.rootPath),cwd:d(b.cwd),command:d(b.command),args:e(b.args),roots:e(b.roots),env:f(b.env),...Object.prototype.hasOwnProperty.call(b,"launch")?{launch:h}:{}},m.has(c)&&function(a){if("string"!=typeof a)return!1;let b=a.trim();return"/"===b||"\\"===b||/^[A-Za-z]:[\\/]?$/.test(b)}(b.rootPath)&&(l.info(`Normalizing filesystem-root rootPath "${b.rootPath}" of remote server ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let i=b.source?.type;"stdio"===c&&"string"==typeof b.rootPath&&"."===b.rootPath.trim()&&("registry"===i||"marketplace"===i)&&/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(a)&&(l.info(`Normalizing shared Registry rootPath "." of ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let n={name:a,disabled:!1,rootPath:"",env:{},_buildCommand:"",_installCommand:""};return"streamable"===c?{...n,...b,name:a,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0,reconnectionOptions:b.reconnectionOptions&&"object"==typeof b.reconnectionOptions?b.reconnectionOptions:void 0,sessionId:b.sessionId||void 0,oauthClientId:b.oauthClientId||"",oauthClientSecret:b.oauthClientSecret||"",oauthScopes:b.oauthScopes||(b.oauthClientId||b.oauthClientInformation?["read"]:void 0),oauthClientMetadata:b.oauthClientMetadata,oauthClientInformation:b.oauthClientInformation,oauthTokens:b.oauthTokens,oauthCodeVerifier:b.oauthCodeVerifier}:"sse"===c?{...n,...b,name:a,eventSourceInit:b.eventSourceInit&&"object"==typeof b.eventSourceInit?b.eventSourceInit:void 0,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0}:"websocket"===c?{...n,...b,name:a,websocketUrl:b.websocketUrl||""}:{...n,...b,name:a,command:b.command||"",args:b.args||[],stderr:b.stderr||"pipe"}});return await Promise.all(b.map(async a=>{a.source||(a.source=await p(a))})),b}catch(a){if(a instanceof k.UQ)return l.warn("Stored MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to load server configs",a),{success:!1,error:`Failed to load server configs: ${a instanceof Error?a.message:"Unknown error"}`}}}async function r(a){let b=await q();if(!Array.isArray(b))return[];let c=b.find(b=>b.name===a)?.roots;return Array.isArray(c)?c.filter(a=>"string"==typeof a):[]}let s=["_buildCommand","_installCommand","oauthClientId","oauthClientSecret"];async function t(a){l.debug("Entering saveConfig method");try{for(let b of a.values())(0,k.SL)(b);let b=Object.fromEntries(Array.from(a.entries()).map(([a,b])=>[a,function(a){let{name:b,...c}=a,d={};for(let[a,b]of Object.entries(c))void 0!==b&&(""===b&&s.includes(a)||(d[a]=b));return d}(b)]));return await (0,g.VH)(h.Zg.MCP_SERVERS,b),{success:!0}}catch(a){if(a instanceof k.UQ)return l.warn("MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to save config",a),{success:!1,error:`Failed to save config: ${a instanceof Error?a.message:"Unknown error"}`}}}},620775:(a,b,c)=>{c.d(b,{q:()=>d});let d=2},621385:(a,b,c)=>{c.d(b,{N:()=>o,z:()=>r});var d=c(973024),e=c(977598),f=c(848161),g=c(176760),h=c.n(g),i=c(186359);let j=["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"],k=(a,b)=>j.every(c=>a[c]===b[c]),l=()=>Error("Worker snapshot is unsafe or changed while being read.");async function m(a,b){for(let c=0;c<b.length;){let{bytesWritten:d}=await a.write(b,c,b.length-c);if(!d)throw l();c+=d}}async function n(a,b,c){let d=Buffer.alloc(c);for(let e=0;e<c;){let{bytesRead:f}=await a.read(d,e,c-e,b+e);if(!f)throw l();e+=f}return d}class o{constructor(a,b){this.root=a,this.file=b,this.size=0,this.key=(0,e.randomBytes)(32),this.pending=Buffer.alloc(0),this.blocks=[],this.diskSize=0}static async create(){let a=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-input-"));try{return await d.promises.chmod(a,448),new o(a,await d.promises.open(h().join(a,"ciphertext"),"wx+",384))}catch(b){throw await d.promises.rm(a,{recursive:!0,force:!0}),b}}async append(a){this.size+=a.length;let b=this.pending.length?Buffer.concat([this.pending,a]):a;for(;b.length>=65536;)await this.seal(b.subarray(0,65536)),b=b.subarray(65536);this.pending=Buffer.from(b)}async seal(a){let b=(0,e.randomBytes)(12),c=(0,e.createCipheriv)("aes-256-gcm",this.key,b);c.setAAD(Buffer.from(`${this.blocks.length}:${a.length}`));let d=Buffer.concat([c.update(a),c.final()]);await m(this.file,Buffer.concat([b,c.getAuthTag(),d])),this.blocks.push({offset:this.diskSize,length:a.length}),this.diskSize+=a.length+28}async finish(){this.pending.length&&await this.seal(this.pending),this.pending.fill(0),this.pending=Buffer.alloc(0),await this.file.sync()}async read(a,b){if(!Number.isSafeInteger(a)||!Number.isSafeInteger(b)||a<0||b<0||a+b>this.size||b>8388608)throw l();let c=Buffer.alloc(b);for(let d=0;d<b;){let f=Math.floor((a+d)/65536),g=this.blocks[f];if(!g)throw l();if(this.cache?.index!==f){this.cache?.bytes.fill(0);let a=await n(this.file,g.offset,g.length+28),b=(0,e.createDecipheriv)("aes-256-gcm",this.key,a.subarray(0,12));b.setAAD(Buffer.from(`${f}:${g.length}`)),b.setAuthTag(a.subarray(12,28)),this.cache={index:f,bytes:Buffer.concat([b.update(a.subarray(28)),b.final()])}}let h=(a+d)%65536,i=Math.min(b-d,g.length-h);this.cache.bytes.copy(c,d,h,h+i),d+=i}return c}async *range(a=0,b=this.size-a){for(let c=0;c<b;c+=65536)yield await this.read(a+c,Math.min(65536,b-c))}async close(){for(let a of(this.key.fill(0),this.pending.fill(0),this.cache?.bytes.fill(0),[...await Promise.allSettled([this.file.close()]),...await Promise.allSettled([d.promises.rm(this.root,{recursive:!0,force:!0})])]))if("rejected"===a.status)throw a.reason}}class p{constructor(a,b){this.file=a,this.size=b,this.buffer=Buffer.alloc(0),this.offset=0,this.position=0}async fill(){return this.offset<this.buffer.length||this.position!==this.size&&(this.buffer=await n(this.file,this.position,Math.min(65536,this.size-this.position)),this.position+=this.buffer.length,this.offset=0,!0)}async peek(){return await this.fill()?this.buffer[this.offset]:-1}async byte(){let a=await this.peek();return -1!==a&&this.offset++,a}async whitespace(){for(;[9,10,13,32].includes(await this.peek());)await this.byte()}async expect(a){if(await this.whitespace(),await this.byte()!==a)throw l()}async smallValue(){await this.whitespace();let a=[],b=await this.peek()===34;b&&a.push(await this.byte());let c=!1;for(;a.length<256;){let d=await this.peek();if(-1===d)throw l();if(!b&&[44,125,9,10,13,32].includes(d)||(a.push(await this.byte()),b&&34===d&&!c))break;c=92===d&&!c}if(256===a.length)throw l();try{return JSON.parse(Buffer.from(a).toString("utf8"))}catch{throw l()}}async data(a,b){await this.expect(34);let c="",d=!1,e=0,f=async f=>{if(!/^[A-Za-z0-9+/=]*$/.test(f)||d&&f.length)throw l();let g=(c+=f).length-c.length%4;if(!g)return;let h=c.slice(0,g);if(!/^[A-Za-z0-9+/]*={0,2}$/.test(h))throw l();let i=Buffer.from(h,"base64");if(i.toString("base64")!==h||(d=h.includes("="),(e+=i.length)>b))throw l();await m(a,i),c=c.slice(g)};for(;await this.fill();){let a=this.buffer.indexOf(34,this.offset),b=this.buffer.indexOf(92,this.offset),d=Math.min(a<0?this.buffer.length:a,b<0?this.buffer.length:b);if(await f(this.buffer.subarray(this.offset,d).toString("latin1")),this.offset=d,d===this.buffer.length)continue;if(34===await this.byte()){if(c.length)throw l();return e}let g=await this.byte();if(117===g){let a="";for(let b=0;b<4;b++){let b=await this.byte();if(b<0)throw l();a+=String.fromCharCode(b)}if(!/^[0-9a-fA-F]{4}$/.test(a))throw l();await f(String.fromCharCode(Number.parseInt(a,16)))}else{let a=new Map([[34,'"'],[92,"\\"],[47,"/"],[98,"\b"],[102,"\f"],[110,"\n"],[114,"\r"],[116,"	"]]).get(g);if(void 0===a)throw l();await f(a)}}throw l()}}function q(a,b){if("string"!=typeof a||a.length>64)throw l();let c=Buffer.from(a,"base64");if(c.length!==b||c.toString("base64")!==a)throw l();return c}async function r(a,b,c,g){let j,m,r,s,t=await d.promises.lstat(a,{bigint:!0}),u=void 0===b?c:4*Math.ceil(c/3)+4096;if(!t.isFile()||t.isSymbolicLink()||t.nlink!==BigInt(1)||t.size>BigInt(u))throw l();let v=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),w=!1,x=0,y=(0,e.createHash)("sha256");try{let u=j=await o.create();if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();for(let a=0;a<Number(t.size);a+=65536)y.update(await n(v,a,Math.min(65536,Number(t.size)-a)));let z=(0,e.createHash)("sha256"),A=async a=>{if(u.size+a.length>c)throw l();z.update(a),await u.append(a)};if(void 0!==b)try{s=q(b,32),m=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-envelope-")),await d.promises.chmod(m,448),r=await d.promises.open(h().join(m,"ciphertext"),"wx+",384);let a=new p(v,Number(t.size)),g=new Map,j=-1;for(await a.expect(123);;){let b=await a.smallValue();if("string"!=typeof b||!["format","version","iv","tag","data"].includes(b)||g.has(b))throw l();await a.expect(58),g.set(b,"data"===b||await a.smallValue()),"data"===b&&(j=await a.data(r,c)),await a.whitespace();let d=await a.byte();if(125===d)break;if(44!==d)throw l()}if(await a.whitespace(),await a.byte()!==-1||5!==g.size||"flujo-workspace-encrypted"!==g.get("format")||![1,2].includes(g.get("version"))||j<0)throw l();x=g.get("version");let k=(0,e.createDecipheriv)("aes-256-gcm",s,q(g.get("iv"),12));2===x&&k.setAAD(Buffer.from(i.fI.v2Aad)),k.setAuthTag(q(g.get("tag"),16));for(let a=0;a<j;a+=65536)await A(k.update(await n(r,a,Math.min(65536,j-a))));await A(k.final())}catch{throw Error("Worker snapshot decryption failed. Check the encrypted archive and its key.")}else for(let a=0;a<Number(t.size);a+=65536)await A(await n(v,a,Math.min(65536,Number(t.size)-a)));let B=z.digest("hex");if((2===x?y.digest("hex"):B)!==g)throw Error("Worker snapshot SHA-256 mismatch.");if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();return await u.finish(),w=!0,u}catch(a){throw await j?.close().catch(()=>void 0),a}finally{s?.fill(0);let a=await Promise.allSettled([v.close(),...r?[r.close()]:[]]),b=await Promise.allSettled(m?[d.promises.rm(m,{recursive:!0,force:!0})]:[]);if(w&&[...a,...b].some(a=>"rejected"===a.status))throw await j?.close().catch(()=>void 0),Error("Snapshot temporary storage could not be released.")}}},683843:(a,b,c)=>{c.d(b,{d1:()=>h,nt:()=>g});var d=c(739006),e=c(186359),f=c(620775);let g=2;function h(){let a=process.env.FLUJO_BUILD_REVISION;return{applicationVersion:d.rE,snapshotEncryption:{...e.fI,readVersions:[...e.fI.readVersions]},snapshotLimits:(0,e.B5)(),snapshotFormatVersion:g,layoutVersion:f.q,workerProtocolVersion:1,workerSnapshotSourceVersion:1,.../^[a-f0-9]{40}$/.test(a??"")?{revision:a}:{}}}},739006:a=>{a.exports={rE:"3.47.0"}},794856:(a,b,c)=>{c.d(b,{$J:()=>i,Mh:()=>l,Ng:()=>k,k6:()=>j});var d=c(262070),e=c(952294),f=c(580940),g=c(905738),h=c(907986);function i(a){if((0,f.ye)()&&"1"===process.env.FLUJO_WORKER_SNAPSHOT_SOURCE){let b=(0,e.i)(a);if(b)return b;if(process.env.FLUJO_EXPOSURE_MODE?.trim().toLowerCase()!=="network")return k({error:"Worker snapshot sources require network exposure."},403);let c=(0,g.$)(a);if(c)return c;let d=(0,f.dT)();return"ready"===d.state&&d.workspace?d.workspace!==(0,h.getCurrentWorkspace)()?k({error:"This workspace is not assigned to the worker."},404):null:k({error:"Worker is not ready.",code:"WORKER_NOT_READY"},503)}let b=(0,g.$)(a,{strictLoopback:!0});return b||(0,e.i)(a)}function j(a){try{return new URL(a.url).searchParams.get("sessionId")}catch{return null}}function k(a,b=200){return Response.json(a,{status:b,headers:{"Cache-Control":"no-store"}})}function l(a){return a instanceof d.b?k({error:a.message,code:a.code},a.status):k({error:"Snapshot operation failed.",code:"SNAPSHOT_FAILED"},500)}},816079:(a,b,c)=>{c.d(b,{DB:()=>q,HM:()=>y,I5:()=>v,TX:()=>x,hD:()=>u});var d=c(973024),e=c(176760),f=c.n(e),g=c(774755),h=c(100629),i=c(134887),j=c(907986),k=c(845223),l=c(930100),m=c(851018),n=c(989481),o=c(472178),p=c(879628);let q=[g.Zg.MODELS,g.Zg.MCP_SERVERS,g.Zg.GLOBAL_ENV_VARS,g.Zg.REGISTRY_ACCOUNT],r="flujo:secret:v2",s=new Set(["apikey","password","passphrase","secret","token","privatekey","cookie","clientsecret","oauthclientsecret","accesstoken","refreshtoken","idtoken","oauthcodeverifier","authorization"]),t=new Map([["oauthtokens","tokens"],["oauthclientinformation","client"],["oauthcodeverifier","verifier"]]);function u(a,b){if(!b||"object"!=typeof b||a===g.Zg.MODELS&&!Array.isArray(b)||![g.Zg.MODELS,g.Zg.MCP_SERVERS].includes(a)&&Array.isArray(b)||(a===g.Zg.MODELS||a===g.Zg.MCP_SERVERS)&&(Array.isArray(b)?b:Object.values(b)).some(a=>!a||"object"!=typeof a||Array.isArray(a)))throw new n.Zz;if(a===g.Zg.MCP_SERVERS&&Array.isArray(b)){let a=b.map(a=>a.name);if(a.some(a=>"string"!=typeof a||!a.trim())||new Set(a).size!==a.length)throw new n.Zz;return Object.fromEntries(b.map(a=>[a.name,a]))}return b}async function v(a,b,c=!1,d=0,e=!1,f){if(d>100)throw new n.Zz;if("string"==typeof a)return b(a,c);if(Array.isArray(a))return Promise.all(a.map(a=>v(a,b,c,d+1,e,f)));if(!a||"object"!=typeof a)return a;if(1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length)return b(a.plaintext,!0);let g=c||!!(a.metadata&&"object"==typeof a.metadata&&a.metadata.isSecret),h={};for(let[c,i]of Object.entries(a)){let a=c.replace(/[_-]/g,"").toLowerCase(),j="env"===a||"headers"===a,k=t.get(a),l=f&&1===d&&k?await f(k,i):j&&i&&"object"==typeof i&&!Array.isArray(i)?Object.fromEntries(await Promise.all(Object.entries(i).map(async([a,c])=>{let g=await v(c,b,!0,d+1,e,f);return[a,e?"string"==typeof g?{value:g,metadata:{isSecret:!0}}:{...g,metadata:{isSecret:!0}}:g]}))):await v(i,b,s.has(a)||"value"===c&&g,d+1,e,f);Object.defineProperty(h,c,{value:l,enumerable:!0})}return h}async function w(a,b){if(a.startsWith("encrypted_failed:"))return{$flujoCredential:1,plaintext:a.slice(17)};let c=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;if(void 0===c)return b&&a?{$flujoCredential:1,plaintext:a}:a;let d=await (0,l.Do)(c);if(null===d)throw new n.Zz;return{$flujoCredential:1,plaintext:d}}async function x(a){return(0,p.Ns)(async()=>{let b={};for(let a of q){let c,d=f().join((0,j.getWorkspaceDataDir)(),"db",`${a}.json`);try{c=await (0,h.b)(d,{maxBytes:7340032,verifyPath:()=>(0,o.V$)((0,i.ok)(),d)})}catch(a){if("ENOENT"===a.code)continue;throw new n.Zz}try{let d=u(a,JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c))),e=async(a,b)=>(0,k.rr)(a,await (0,k.eC)(a,b,(0,j.getCurrentWorkspace)(),async a=>{let b=await (0,l.Do)(a);if(null===b)throw new n.Zz;return b}),(0,j.getCurrentWorkspace)());b[a]=await v(d,w,!1,0,!1,a===g.Zg.MCP_SERVERS?e:void 0)}finally{c.fill(0)}}let c=Date.now(),d=Buffer.from(JSON.stringify({version:1,createdAt:c,expiresAt:c+864e5,records:b}));try{return await (0,n.of)(d,a)}finally{d.fill(0)}})}async function y(a,b,c,e,l={}){let p,s=(0,j.assertValidWorkspaceName)(c);if("string"!=typeof e||e.length<12||Buffer.byteLength(e)>1024||e===m.Gr||e===b)throw new n.Zz;let t=await (0,n.XM)(a,b);try{p=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t))}finally{t.fill(0)}let w=Date.now();if(!p||1!==p.version||!Number.isSafeInteger(p.createdAt)||!Number.isSafeInteger(p.expiresAt)||p.createdAt>w+6e4||p.expiresAt<=w||p.expiresAt-p.createdAt!=864e5||!p.records||"object"!=typeof p.records||Array.isArray(p.records)||Object.keys(p.records).some(a=>!q.includes(a)))throw new n.Zz;let x=(0,m.OD)(),z=await (0,m.Mk)(x,"user",e,"passphrase"),A=new Map;for(let[a,b]of Object.entries(p.records)){let c=u(a,b),d=async(a,b)=>{if(!b||!a||/^\$\{global:[^}]+\}$/.test(a))return a;let c=(0,m.od)(a,x.activeKey,r);if((0,m.ho)(c,x.activeKey,r)!==a)throw new n.Zz;return`encrypted:${c}`},e=a===g.Zg.GLOBAL_ENV_VARS&&c&&"object"==typeof c&&!Array.isArray(c)?Object.fromEntries(await Promise.all(Object.entries(c).map(async([a,b])=>{let c=await v(b,d,!0,0,!0);if("string"==typeof c)return[a,{value:c,metadata:{isSecret:!0}}];if(!c||"object"!=typeof c||"string"!=typeof c.value)throw new n.Zz;return[a,{...c,metadata:{isSecret:!0}}]}))):await v(c,d,!1,0,!0,a===g.Zg.MCP_SERVERS?async(a,b)=>{let c=await (0,k.ZA)(a,b,s),d=(0,k.bM)(a,c,s),e=(0,m.od)(d,x.activeKey,r);if((0,m.ho)(e,x.activeKey,r)!==d)throw new n.Zz;return{format:k.ok,ciphertext:e}}:void 0);if(a===g.Zg.MCP_SERVERS&&e&&"object"==typeof e)for(let a of Object.values(e)){if(!a||"object"!=typeof a||Array.isArray(a))throw new n.Zz;a.disabled=!0}A.set(`${a}.json`,Buffer.from(JSON.stringify(e)))}if(A.set(`${g.Zg.ENCRYPTION_KEY}.json`,Buffer.from(JSON.stringify(z))),[...A.values()].reduce((a,b)=>a+b.length,0)>2*n.Ns)throw new n.Zz;l.signal?.throwIfAborted();let B=(0,j.getWorkspacesDir)();await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let C=await d.promises.lstat(B,{bigint:!0}),D=await d.promises.mkdtemp(f().join(B,".credential-transfer-")),E=await d.promises.lstat(D,{bigint:!0}),F=!1;try{for(let a of(await d.promises.chmod(D,448),j.WORKSPACE_SUBTREES))await d.promises.mkdir(f().join(D,a),{mode:448});for(let[a,b]of(await (0,o.sA)(D,f().join(D,".workspace.json"),Buffer.from('{"roots":[]}'),{mode:384}),A)){l.signal?.throwIfAborted(),await (0,o.sA)(D,f().join(D,"db",a),b,{mode:384});let c=await (0,h.b)(f().join(D,"db",a),{maxBytes:2*n.Ns,ownerOnly:!0});try{if(!c.equals(b))throw new n.Zz}finally{c.fill(0)}await l.checkpoint?.("file_written")}return await (0,j.withWorkspaceNamespaceMutation)(async()=>{l.signal?.throwIfAborted(),await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let a=await d.promises.lstat(B,{bigint:!0}),b=await d.promises.lstat(D,{bigint:!0});if(a.dev!==C.dev||a.ino!==C.ino||b.dev!==E.dev||b.ino!==E.ino||b.isSymbolicLink()||(await l.checkpoint?.("before_publish"),(await d.promises.readdir(B)).some(a=>a.toLowerCase()===s.toLowerCase())))throw new n.Zz;if(l.signal?.throwIfAborted(),await d.promises.rename(D,(0,j.getWorkspaceDir)(s)),F=!0,"win32"!==process.platform){let a=await d.promises.open(B,d.constants.O_RDONLY|d.constants.O_DIRECTORY|d.constants.O_NOFOLLOW|d.constants.O_NONBLOCK);try{let b=await a.stat({bigint:!0});if(!b.isDirectory()||b.dev!==C.dev||b.ino!==C.ino||b.mode!==C.mode||b.uid!==C.uid||b.gid!==C.gid)throw new n.Zz;await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let c=await d.promises.lstat(B,{bigint:!0});if(c.isSymbolicLink()||c.dev!==b.dev||c.ino!==b.ino)throw new n.Zz;await a.sync()}finally{await a.close()}}return s})}finally{for(let a of A.values())a.fill(0);if(!F){let a=await d.promises.lstat(D,{bigint:!0}).catch(()=>void 0);a&&a.isDirectory()&&!a.isSymbolicLink()&&a.dev===E.dev&&a.ino===E.ino&&f().dirname(D)===B&&f().basename(D).startsWith(".credential-transfer-")&&await d.promises.rm(D,{recursive:!0,force:!0})}}}},817492:(a,b,c)=>{c.d(b,{Hm:()=>f,xc:()=>e});let d=["key","secret","token","password"],e=a=>d.some(b=>a.toLowerCase().includes(b)),f=a=>e(a)||"authorization"===a.trim().toLowerCase()},845223:(a,b,c)=>{c.d(b,{ZA:()=>l,bM:()=>g,eC:()=>j,ok:()=>e,rr:()=>k});var d=c(88169);let e="flujo-oauth-v1",f=a=>!!a&&"object"==typeof a&&!Array.isArray(a),g=d.rt;function h(a){return f(a)&&(a.format===e||Object.hasOwn(a,"format")&&Object.hasOwn(a,"ciphertext")&&2===Object.keys(a).length)}async function i(a,b,c,d=0){if(d>100)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");if("string"==typeof a){if(c)return a;if(a.startsWith("encrypted_failed:"))return a.slice(17);let d=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;return void 0===d?a:b(d)}return Array.isArray(a)?Promise.all(a.map(a=>i(a,b,c,d+1))):f(a)?c&&1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length?a.plaintext:Object.fromEntries(await Promise.all(Object.entries(a).map(async([a,e])=>[a,await i(e,b,c,d+1)]))):a}async function j(a,b,c,j){if(h(b)){let g;if(!f(b)||2!==Object.keys(b).length||b.format!==e||"string"!=typeof b.ciphertext||!b.ciphertext.startsWith("v2:")||Buffer.byteLength(b.ciphertext)>524288)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g=await j(b.ciphertext),(0,d.s6)(a,g,c)}let k=await i(b,j,!1);return g(a,k,c),k}function k(a,b,c){return g(a,b,c),{$flujoOAuth:1,kind:a,value:b}}async function l(a,b,c){if(f(b)&&1===b.$flujoOAuth){if(3!==Object.keys(b).length||b.kind!==a||!Object.hasOwn(b,"value"))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g(a,b.value,c),b.value}if(h(b))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");let d=await i(b,async()=>{throw Error("OAuth credentials are malformed or belong to another workspace or purpose.")},!0);return g(a,d,c),d}},882980:(a,b,c)=>{c.d(b,{H6:()=>h,Mt:()=>e,SL:()=>g,UQ:()=>f,ZW:()=>d});let d="MCP_TRANSPORT_INVALID";function e(a){return"stdio"===a||"streamable"===a||"sse"===a||"websocket"===a}class f extends Error{constructor(){super(d),this.name="McpTransportError"}}function g(a){if(!e(a.transport))throw new f}function h(a){if(void 0===a)return"stdio";if(!e(a))throw new f;return a}},989481:(a,b,c)=>{c.d(b,{Ns:()=>i,XM:()=>m,Zz:()=>j,of:()=>l});var d=c(977598),e=c(257975),f=c(851018);let g=(0,e.promisify)(d.pbkdf2),h=Buffer.from("FLUJOT01"),i=0x2000000;class j extends Error{constructor(){super("Invalid transfer or recipient passphrase."),this.name="RecipientTransferError"}}function k(a){if("string"!=typeof a||a===f.Gr||a.length<16||Buffer.byteLength(a,"utf8")>1024)throw new j}async function l(a,b){if(k(b),!a.byteLength||a.byteLength>i)throw new j;let c=Buffer.alloc(40);h.copy(c),(0,d.randomBytes)(16).copy(c,8),(0,d.randomBytes)(12).copy(c,24),c.writeUInt32BE(a.byteLength,36);let e=await g(b,c.subarray(8,24),f.fn,32,"sha256");try{let b=(0,d.createCipheriv)("aes-256-gcm",e,c.subarray(24,36));return b.setAAD(c),Buffer.concat([c,b.update(a),b.final(),b.getAuthTag()])}finally{e.fill(0)}}async function m(a,b){let c;if(k(b),a.byteLength<57||a.byteLength>56+i)throw new j;let e=Buffer.from(a),l=e.subarray(0,40);if(!l.subarray(0,8).equals(h)||l.readUInt32BE(36)!==e.length-40-16)throw new j;let m=await g(b,l.subarray(8,24),f.fn,32,"sha256");try{let a=(0,d.createDecipheriv)("aes-256-gcm",m,l.subarray(24,36));a.setAAD(l),a.setAuthTag(e.subarray(-16)),c=a.update(e.subarray(40,-16));let b=a.final();return Buffer.concat([c,b])}catch{throw new j}finally{c?.fill(0),m.fill(0),e.fill(0)}}}};
+"use strict";exports.id=21619,exports.ids=[972,16079,17492,21619,33829,55437,56210,57863,68115,74188,77818,78591,80244],exports.modules={186359:(a,b,c)=>{c.d(b,{fI:()=>e,B5:()=>g});let d=JSON.parse('{"e":{"format":"flujo-workspace-encrypted","cipher":"aes-256-gcm","writeVersion":2,"readVersions":[1,2],"legacyPlaintextRead":true,"recipientKeyRequired":true,"recipientKeyBytes":32,"recipientKeyEncoding":"base64","v2Aad":"flujo:workspace-snapshot:v2","v2Digest":"sha256-encrypted-wire","v1Digest":"sha256-plaintext-zip"},"R":{"maxFileBytes":268435456,"maxUncompressedBytes":1073741824,"maxManifestBytes":8388608,"maxArchiveBytes":1082130432,"maxEncryptedBytes":1442844672,"maxMembers":65534}}'),e=d.e,f=d.R;function g(){let a=(a,b)=>{let c=process.env[a];if(void 0===c)return b;let d=Number(c);if(!/^[1-9]\d*$/.test(c)||!Number.isSafeInteger(d))throw Error("Snapshot limits are invalid.");return d},b=a("FLUJO_SNAPSHOT_MAX_FILE_BYTES",f.maxFileBytes),c=a("FLUJO_SNAPSHOT_MAX_BYTES",f.maxUncompressedBytes),d=c+f.maxManifestBytes,e=4*Math.ceil(d/3)+4096;if(!Number.isSafeInteger(d)||!Number.isSafeInteger(e))throw Error("Snapshot limits are invalid.");return{...f,maxFileBytes:b,maxUncompressedBytes:c,maxArchiveBytes:d,maxEncryptedBytes:e}}},261571:(a,b,c)=>{c.d(b,{Js:()=>i,L$:()=>j,SZ:()=>k});var d=c(610782),e=c(774755),f=c(266844),g=c(882980);let h=(0,f.h)("backend/services/mcp/runtimeHomeIsolation"),i="FLUJO_MCP_RUNTIME_HOME_ISOLATION";function j(a){let b=a?.trim().toLowerCase();if(b){if(["1","true","yes","on","isolated"].includes(b))return!0;if(["0","false","no","off","host"].includes(b))return!1}}async function k(a,b=process.env){if((0,g.SL)(a),"stdio"!==a.transport)return!1;let c=j(b[i]);if(void 0!==c)return c;if("isolated"===a.runtimeHomeMode)return!0;if("host"===a.runtimeHomeMode)return!1;try{let a=await (0,d.loadItem)(e.Zg.SPEECH_SETTINGS,void 0);return a?.experimental?.mcpRuntimeHomeIsolation===!0}catch(a){return h.warn("Could not read the workspace MCP runtime-home preference; defaulting to host home",{error:a}),!1}}},262070:(a,b,c)=>{c.d(b,{b:()=>P,f:()=>$});var d=c(973024),e=c(977598),f=c(907986),g=c(100629),h=c(157075),i=c(186359),j=c(621385);async function k(a,b,c,f){let g;a.on("error",()=>void 0);let h=(0,e.createHash)("sha256"),j=(0,e.createHash)("sha256");try{let a=(0,i.B5)(),h=c?(0,e.randomBytes)(12):void 0,j=c?(0,e.createCipheriv)("aes-256-gcm",c,h):void 0;j&&j.setAAD(Buffer.from(i.fI.v2Aad)),f?.throwIfAborted();let k=await d.promises.open(b,"wx",384);g={limits:a,iv:h,cipher:j,output:k}}catch(b){throw a.destroy(),b}let{limits:k,iv:l,cipher:m,output:n}=g,o=0,p=Buffer.alloc(0),q=0,r=async a=>{if(f?.throwIfAborted(),q+a.length>(c?k.maxEncryptedBytes:k.maxArchiveBytes))throw Error("Snapshot exceeds the archive size limit.");for(let b=0;b<a.length;){let c=await n.write(a,b,a.length-b);if(!c.bytesWritten)throw Error("Snapshot write made no progress.");b+=c.bytesWritten}h.update(a),q+=a.length},s=async(a,b=!1)=>{let c=p.length?Buffer.concat([p,a]):a,d=b?c.length:c.length-c.length%3;for(let a=0;a<d;){let b=Math.min(49152,d-a);await r(Buffer.from(c.subarray(a,a+b).toString("base64"))),a+=b}p=Buffer.from(c.subarray(d))},t=()=>a.destroy(f?.reason instanceof Error?f.reason:Error("Snapshot aborted."));f?.addEventListener("abort",t,{once:!0});let u=!1;try{for await(let b of(f?.throwIfAborted(),l&&await r(Buffer.from(`{"format":"flujo-workspace-encrypted","version":2,"iv":"${l.toString("base64")}","data":"`)),a)){f?.throwIfAborted();let a=Buffer.isBuffer(b)?b:Buffer.from(b);if((o+=a.length)>k.maxArchiveBytes)throw Error("Snapshot exceeds the archive size limit.");j.update(a),m?await s(m.update(a)):await r(a)}return m&&(await s(m.final(),!0),await r(Buffer.from(`","tag":"${m.getAuthTag().toString("base64")}"}`))),await n.sync(),{sha256:h.digest("hex"),plaintextSha256:j.digest("hex"),size:q}}catch(a){throw u=!0,a}finally{f?.removeEventListener("abort",t),a.destroy();try{await n.close()}catch(a){if(!u)throw a}}}async function l(a,b,c,f,g){let i,j=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),k=()=>i??=j.close(),l=!1;try{let i=await j.stat({bigint:!0}),m=a=>["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"].every(b=>i[b]===a[b]),n=async()=>{f.throwIfAborted(),g();let c=await d.promises.lstat(a,{bigint:!0});if(!i.isFile()||i.nlink!==BigInt(1)||!c.isFile()||c.isSymbolicLink()||i.size!==BigInt(b)||!m(c)||!m(await j.stat({bigint:!0})))throw Error("Snapshot archive failed its integrity check.")},o=async a=>{let c=Buffer.alloc(Math.min(65536,b-a));for(let b=0;b<c.length;){let{bytesRead:d}=await j.read(c,b,c.length-b,a+b);if(!d)throw Error("Snapshot archive failed its integrity check.");b+=d}return c};await n();let p=(0,e.createHash)("sha256");for(let a=0;a<b;a+=65536)f.throwIfAborted(),g(),p.update(await o(a));if(await n(),p.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.");let q=h.Readable.from(async function*(){try{let a=(0,e.createHash)("sha256");for(let c=0;c<b;c+=65536){await n();let b=await o(c);a.update(b),yield b}if(await n(),a.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.")}finally{await k()}}(),{objectMode:!1,highWaterMark:65536}),r=()=>q.destroy(Error("Snapshot session is no longer available."));return q.on("error",()=>void 0),q.once("close",()=>{f.removeEventListener("abort",r),k().catch(()=>void 0)}),f.addEventListener("abort",r,{once:!0}),f.aborted&&r(),l=!0,h.Readable.toWeb(q,{strategy:{highWaterMark:65536,size:a=>a.byteLength}})}finally{l||await k()}}var m=c(848161),n=c(176760),o=c.n(n),p=c(76364),q=c.n(p),r=c(620775),s=c(683843),t=c(472178),u=c(965385),v=c(826045),w=c(930100),x=c(719031),y=c(816079),z=c(774755),A=c(158601),B=c(739006);let C=".workspace.json";class D extends Error{constructor(a,b){super(b),this.code=a,this.name="SnapshotArchiveError"}}let E=new WeakMap,F=new WeakMap;function G(a){if(void 0!==a&&"string"!=typeof a)throw new D("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let b=a??process.env.FLUJO_WORKER_SNAPSHOT_KEY;if(void 0===b)return null;if("string"!=typeof b||44!==b.length)throw new D("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let c=Buffer.from(b,"base64");if(32!==c.length||c.toString("base64")!==b)throw c.fill(0),new D("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");return c}async function H(a){let b=!1,c=async(a,c)=>(a&&!/^\$\{global:[^}]+\}$/.test(a)&&(c||/^(?:encrypted:|encrypted_failed:|v2:)/.test(a))&&(b=!0),a);try{for(let d of y.DB){let e=a.file(`db/${d}.json`);if(!e)continue;let f=JSON.parse(await e.async("string"));if(d===z.Zg.GLOBAL_ENV_VARS&&f&&"object"==typeof f)for(let a of Object.values(f))await (0,y.I5)(a,c,!0);else await (0,y.I5)(f,c,!1,0,!1,d===z.Zg.MCP_SERVERS?async(a,c)=>(c&&("object"!=typeof c||Object.keys(c).length)&&(b=!0),c):void 0)}return b}catch{throw new D("CREDENTIALS_UNAVAILABLE","Credential inventory cannot be verified for plaintext export.")}}function I(a,b,c=!1){let d=o().relative(o().resolve(a),o().resolve(b));return""===d?c:!d.startsWith("..")&&!o().isAbsolute(d)}async function J(a,b,c,e,f,h){let i;f?.throwIfAborted();let j=o().join(b,C);try{i=await d.promises.lstat(j,{bigint:!0})}catch(a){if("ENOENT"===a.code)return;throw a}if(!i.isFile()||i.isSymbolicLink()||i.nlink>BigInt(1))throw new D("UNSAFE_ENTRY","Workspace metadata is not a plain, singly-linked file.");if(i.size>BigInt(e))throw new D("SIZE_LIMIT","Workspace metadata exceeds the configured file limit.");let k=await d.promises.realpath(b);if(!I(k,await d.promises.realpath(j)))throw new D("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.");try{let l=await (0,g.b)(j,{expected:i,maxBytes:e,signal:f,consume:h?.consume,verifyPath:async()=>{if(await (0,t.V$)(b,j),!I(k,await d.promises.realpath(j)))throw new D("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.")}});h?h.complete(i):(c(C,l),a.file(C,l))}catch(a){if(a instanceof g.$)throw new D("SIZE_LIMIT"===a.code?"SIZE_LIMIT":"UNSAFE_ENTRY","Workspace metadata changed or is unsafe.");throw a}}async function K(a,b,c={}){let g,k,{signal:l}=c;if(l?.throwIfAborted(),await (0,v.Tm)(a))throw new D("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let m=G(c.recipientKey),n=(0,f.getWorkspaceDataDir)(a);try{g=await d.promises.lstat(n)}catch{throw m?.fill(0),new D("WORKSPACE_UNAVAILABLE","Workspace directory is unavailable.")}if(!g.isDirectory()||g.isSymbolicLink())throw m?.fill(0),new D("WORKSPACE_UNAVAILABLE","Workspace directory is not a real directory.");let p=(0,i.B5)(),y=p.maxFileBytes,z=p.maxUncompressedBytes,I=[],M=0,N=new(q());try{k=await j.N.create()}catch(a){throw m?.fill(0),a}let O=new Map;try{let g,i,j,v=(a,b,c)=>{if(l?.throwIfAborted(),b.byteLength>y)throw new D("SIZE_LIMIT","Snapshot member exceeds the configured file limit.");if(b.subarray(0,16).equals(Buffer.from("SQLite format 3\0")))throw new D("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);if((M+=b.byteLength)>z)throw new D("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");I.push({path:a,size:b.byteLength,sha256:(0,e.createHash)("sha256").update(b).digest("hex"),mode:c?384|Number(c.mode&BigInt(64)):384})},G=k.size,K=(0,e.createHash)("sha256"),P=Buffer.alloc(0);await J(N,n,v,y,l,{consume:async a=>{if(k.size+a.length>z)throw new D("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");P.length<16&&(P=Buffer.concat([P,a.subarray(0,16-P.length)])),K.update(a),await k.append(a)},complete:a=>{if(P.equals(Buffer.from("SQLite format 3\0")))throw new D("UNSAFE_ENTRY","Live SQLite state is not portable: .workspace.json. Export it with its owning tool first.");let b=Number(a.size);M+=b,I.push({path:C,size:b,sha256:K.digest("hex"),mode:384}),N.file(C,Buffer.alloc(0)),O.set(C,{position:G,size:b,file:N.file(C)})}});let Q=["mcp-servers","db/codex-runtime","db/antigravity-cli-runtime","userdata/mcp-runtime","browser-profile","bash-utils","db/worker-bootstrap-secrets.json","db/native-tool-journal","db/native-session-payloads","db/native-session-origins"],R=a=>Q.some(b=>a===b||a.startsWith(`${b}/`))||/^db\/codex-private-[^/]*(?:\/|$)/i.test(a);for(let a of f.WORKSPACE_SUBTREES){let b;if(l?.throwIfAborted(),R(a)){N.folder(a);continue}let c=o().join(n,a);try{b=await d.promises.lstat(c)}catch(b){if("ENOENT"===b.code){N.folder(a);continue}throw b}if(!b.isDirectory()||b.isSymbolicLink())throw new D("UNSAFE_ENTRY",`Workspace subtree ${a} is not a real directory.`);N.folder(a),await (0,t.N)(N,c,a,n,(a,b)=>{throw new D(b.includes("size limit")?"SIZE_LIMIT":"UNSAFE_ENTRY",`Cannot safely snapshot ${a}: ${b}`)},{maxFileBytes:y,skippedDirectories:new Set(["node_modules",".venv","__pycache__"]),skipPath:R,signal:l,preserveMode:!0,allowHardLinks:!0,onFileStream:async(a,b,c)=>{let d=Number(c.size);if(M+d>z)throw new D("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");let f=k.size,g=(0,e.createHash)("sha256"),h=Buffer.alloc(0);for await(let a of b)l?.throwIfAborted(),h.length<16&&(h=Buffer.concat([h,a.subarray(0,16-h.length)])),g.update(a),await k.append(a);if(k.size-f!==d)throw new D("UNSAFE_ENTRY","Snapshot member changed while being captured.");if(h.equals(Buffer.from("SQLite format 3\0")))throw new D("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);M+=d,I.push({path:a,size:d,sha256:g.digest("hex"),mode:384|Number(c.mode&BigInt(64))}),N.file(a,Buffer.alloc(0),{unixPermissions:Number(c.mode&BigInt(33279))}),O.set(a,{position:f,size:d,file:N.file(a)})}})}await k.finish();let S=async a=>{let b=O.get(a);if(b&&N.file(a)===b.file){let a=[];for await(let c of k.range(b.position,b.size))a.push(c);return Buffer.concat(a)}return N.file(a).async("nodebuffer")};for(let[a,b]of O)b.file.async=(c,d)=>{let e=new(q());return e.file(a,h.Readable.from(k.range(b.position,b.size),{objectMode:!1,highWaterMark:65536})),e.file(a).async(c,d)};let T=async(a,b)=>{if(!N.file(a))return b;try{return JSON.parse((await S(a)).toString("utf8"))}catch{throw new D("UNSAFE_ENTRY",`Invalid workspace configuration: ${a}`)}},U=await T("db/mcp_servers.json",{});if(!U||"object"!=typeof U||Array.isArray(U)||Object.values(U).some(a=>!a||"object"!=typeof a))throw new D("UNSAFE_ENTRY","Invalid workspace configuration: db/mcp_servers.json");let V=await T("db/models.json",[]);if(!Array.isArray(V)||V.some(a=>!a||"object"!=typeof a))throw new D("UNSAFE_ENTRY","Invalid workspace configuration: db/models.json");let W=(a,b)=>{let c=I.findIndex(b=>b.path===a);-1!==c&&(M-=I.splice(c,1)[0].size),v(a,b),N.file(a,b,{unixPermissions:33152})},X=new Map;if(c.flowIds){let a=await T("db/flows.json",[]);if(!Array.isArray(a))throw new D("UNSAFE_ENTRY","Invalid workspace configuration: db/flows.json");for(let b of a)X.set(b.id,b);for(let a of Object.keys(N.files).filter(a=>/^db\/flows\/[^/]+\.json$/.test(a))){let b=await T(a,null);if(!b||"string"!=typeof b.id||!Array.isArray(b.nodes)||!Array.isArray(b.edges))throw new D("UNSAFE_ENTRY",`Invalid workspace flow: ${a}`);X.set(b.id,b)}}try{let a=(0,u.xL)(c.flowIds,{flows:[...X.values()],models:V,mcpServers:Object.entries(U).map(([a,b])=>({...b,name:a,transport:b.transport||"stdio"}))});i=a.requiresCodexAuth,(j=c.flowIds?a.flowIds:void 0)&&W("db/mcp_servers.json",Buffer.from(JSON.stringify(Object.fromEntries(a.configs.map(a=>[a.name,a]))))),g=await (0,u.zk)((0,u.am)(a.configs,n,{requiredServerNames:j?a.mcpServerNames:void 0}),{signal:l})}catch(a){throw l?.throwIfAborted(),new D("MCP_UNSUPPORTED",a instanceof Error?a.message:"MCP runtime cannot be reconstructed.")}if(!m&&await H(N))throw new D("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption.");let Y="none";if(i){if(!m)throw new D("CREDENTIALS_UNAVAILABLE","ChatGPT authentication requires an encrypted workspace snapshot.");try{let b=await (0,x.E0)(a);l?.throwIfAborted(),W("db/codex-runtime/auth.json",b),W(`db/codex-runtime/${x.Sy}`,Buffer.from(JSON.stringify(x.J1))),Y="chatgpt"}catch{throw l?.throwIfAborted(),new D("CREDENTIALS_UNAVAILABLE","Codex authentication is unavailable for encrypted transfer.")}}let Z=await T("db/encryption_key.json",{}),$="user"===Z.encryption_type?"user":"default";if("user"===$){let b;if(!m)throw new D("CREDENTIALS_UNAVAILABLE","Private workspace bootstrap requires an encrypted snapshot.");try{b="operator-file"===Z.key_protection?await (0,f.runWithWorkspace)(a,()=>(0,w.OS)(Z)):(0,A.eu)()}catch{throw new D("CREDENTIALS_UNAVAILABLE","Restore the matching independent operator secret before creating a worker snapshot.")}if(!b)throw new D("CREDENTIALS_UNAVAILABLE","Unlock this workspace before creating a worker snapshot.");W("db/worker-bootstrap-secrets.json",Buffer.from(JSON.stringify({version:1,workspaceDek:b})))}I.sort((a,b)=>a.path.localeCompare(b.path));let _={formatVersion:s.nt,layoutVersion:r.q,workspace:a,generation:b,createdAt:new Date().toISOString(),coherence:"registered-flujo-writers",externalRootsIncluded:!1,subtrees:f.WORKSPACE_SUBTREES,files:I,source:{version:B.rE,platform:process.platform},runtime:{mcpTransfer:g,codexAuth:Y,encryption:$,...j?{selectedFlowIds:j}:{}},excludedRuntimePaths:Q},aa=Buffer.from(JSON.stringify(_,null,2));if(aa.length>p.maxManifestBytes||Object.keys(N.files).length+1>p.maxMembers)throw new D("SIZE_LIMIT","Snapshot manifest or member count exceeds the restore limit.");N.file("snapshot-manifest.json",aa);let ab=!1,ac={zip:N,manifest:_,files:I.length,bytes:M,dispose:async()=>{ab||(m?.fill(0),await k.close(),ab=!0)}};return l?.throwIfAborted(),E.set(ac,{store:k,members:O}),N.generateInternalStream=a=>L(ac).generateInternalStream(a),F.set(ac,{key:m,recipientKeyUsed:void 0!==c.recipientKey}),ac}catch(a){throw m?.fill(0),await k.close().catch(()=>void 0),a}}function L(a){let b=E.get(a);if(!b)return a.zip;let c=new(q());for(let[d,e]of Object.entries(a.zip.files)){let a=b.members.get(d),f={date:e.date,unixPermissions:e.unixPermissions??void 0};e.dir?c.file(d,null,{...f,dir:!0}):a&&a.file===e?c.file(d,h.Readable.from(b.store.range(a.position,a.size),{objectMode:!1,highWaterMark:65536}),f):c.file(d,e.async("nodebuffer"),f)}return c}async function M(a,b={}){let{signal:c}=b;c?.throwIfAborted();let f=F.get(a),g=f?.recipientKeyUsed?Buffer.from(f.key):G();try{if(F.has(a)){let a=f?.key;if(!!a!=!!g||a&&g&&!(0,e.timingSafeEqual)(a,g))throw g?.fill(0),new D("CREDENTIALS_UNAVAILABLE","Snapshot encryption key changed. Start a new capture.")}let b=Object.keys(a.zip.files);if(b.length>(0,i.B5)().maxMembers)throw new D("SIZE_LIMIT","Snapshot exceeds the archive member limit.");let j=new Set(["db/codex-runtime/","db/codex-runtime/auth.json",`db/codex-runtime/${x.Sy}`]);if(b.some(a=>/^db\/codex-private-/i.test(a))||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a)&&!j.has(a))||!g&&("chatgpt"===a.manifest.runtime.codexAuth||"user"===a.manifest.runtime.encryption||b.includes("db/worker-bootstrap-secrets.json")||await H(a.zip)||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a))))throw g?.fill(0),new D("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption; runtime homes cannot be exported.");if(await (0,v.Tm)(a.manifest.workspace))throw new D("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let l=await d.promises.mkdtemp(o().join((0,m.tmpdir)(),"flujo-hot-clone-"));await d.promises.chmod(l,448).catch(()=>void 0);let n=o().join(l,"workspace.snapshot.zip");try{let b=L(a).generateNodeStream({type:"nodebuffer",streamFiles:!0,compression:"DEFLATE",compressionOptions:{level:6},platform:"UNIX"},()=>c?.throwIfAborted()),e=await k(new h.Readable({highWaterMark:65536}).wrap(b),n,g,c);return await d.promises.chmod(n,384).catch(()=>void 0),c?.throwIfAborted(),{archivePath:n,stagingDir:l,sha256:e.sha256,plaintextSha256:e.plaintextSha256,encrypted:!!g,encryptionVersion:2*!!g,recipientKeyUsed:f?.recipientKeyUsed??!1,size:e.size,files:a.files,bytes:a.bytes}}catch(a){throw await d.promises.rm(l,{recursive:!0,force:!0}).catch(()=>void 0),a}}finally{g?.fill(0)}}var N=c(879628);let O=/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;class P extends Error{constructor(a,b,c){super(c),this.code=a,this.status=b,this.name="SnapshotCoordinatorError"}}let Q=globalThis.__flujoWorkspaceSnapshotSessions??(globalThis.__flujoWorkspaceSnapshotSessions=new Map);function R(a){return{sessionId:a.sessionId,workspace:a.workspace,generation:a.generation,state:a.state,createdAt:new Date(a.createdAtMs).toISOString(),expiresAt:new Date(a.expiresAtMs).toISOString(),bytesStaged:a.bytesStaged,filesStaged:a.filesStaged,archiveBytes:a.archiveBytes,sha256:a.sha256,plaintextSha256:a.plaintextSha256,encrypted:a.encrypted,encryptionVersion:a.encryptionVersion,recipientKeyUsed:a.recipientKeyUsed,errorCode:a.errorCode,error:a.error}}function S(a){return"finalized"===a||"aborted"===a||"failed"===a}async function T(a){let b=a.stagingDir;a.archivePath=void 0,a.stagingDir=void 0,b&&await d.promises.rm(b,{recursive:!0,force:!0}).catch(()=>void 0)}function U(a){a.expiryTimer&&(clearTimeout(a.expiryTimer),a.expiryTimer=void 0)}async function V(a){S(a.state)||(U(a),a.abortRequested=!0,a.state="aborted",a.errorCode="SNAPSHOT_EXPIRED",a.controller.abort(Error("Snapshot session expired.")),await T(a))}async function W(a){Date.now()<=a.expiresAtMs||S(a.state)||await V(a)}async function X(a){let b=Q.get(a);return b&&await W(b),b}function Y(a,b){if(!O.test(b))throw new P("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");let c=Q.get(a);if(!c||c.sessionId!==b)throw new P("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");return c}async function Z(a){let b,c,{signal:d}=a.controller,e=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_CAPTURE_TIMEOUT_MS??"",10))||c<=0?3e4:Math.min(c,6e4),f=setTimeout(()=>{d.aborted||(a.abortRequested=!0,a.state="failed",a.errorCode="SNAPSHOT_TIMEOUT",U(a),a.controller.abort(Error("Workspace snapshot exceeded its capture time limit.")))},e);f.unref?.();try{b=await (0,N.Ns)(async c=>(a.generation=c,d.throwIfAborted(),a.state="staging",b=await K(a.workspace,c,{signal:d,flowIds:a.flowIds,recipientKey:a.recipientKey})),{workspace:a.workspace,timeoutMs:e,signal:d}),d.throwIfAborted(),a.bytesStaged=b.bytes,a.filesStaged=b.files,clearTimeout(f);let c=await M(b,{signal:d});if(a.archivePath=c.archivePath,a.stagingDir=c.stagingDir,a.archiveBytes=c.size,a.sha256=c.sha256,a.plaintextSha256=c.plaintextSha256,a.encrypted=c.encrypted,a.encryptionVersion=c.encryptionVersion??+!!c.encrypted,a.recipientKeyUsed=c.recipientKeyUsed??!1,a.recipientKey=void 0,await b.dispose?.(),b=void 0,a.abortRequested){"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"),await T(a);return}a.state="ready"}catch(b){a.abortRequested?"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"):(a.state="failed",U(a),a.errorCode=b instanceof D?b.code:b instanceof Error&&"WorkspaceSnapshotBusyError"===b.name?"SNAPSHOT_BUSY":b instanceof Error&&"WorkspaceSnapshotTimeoutError"===b.name?"SNAPSHOT_TIMEOUT":"SNAPSHOT_FAILED",a.error=b instanceof D?b.message:void 0),await T(a)}finally{a.recipientKey=void 0,clearTimeout(f),await b?.dispose?.().catch(()=>void 0)}}let $={async info(a=(0,f.getCurrentWorkspace)()){let b=(0,f.normalizeWorkspaceName)(a),c=await X(b),d=(0,N.B7)(b),e=c&&!S(c.state)?R(c):null;return{workspace:b,layoutVersion:r.q,workerCompatibility:(0,s.d1)(),capability:e||d.blocked?"busy":"available",coherence:"registered-flujo-writers",externalRootsIncluded:!1,activeOperation:e}},async begin(a=(0,f.getCurrentWorkspace)(),b={}){let c;void 0!==b.recipientKey&&G(b.recipientKey)?.fill(0);let d=(0,f.normalizeWorkspaceName)(a),g=Q.get(d);if(g&&!S(g.state)&&Date.now()<=g.expiresAtMs)throw new P("SNAPSHOT_BUSY",409,"A snapshot is already active for this workspace.");g&&(S(g.state)?(U(g),T(g)):V(g));let h=Date.now(),i=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_SESSION_TTL_MS??"",10))||c<=0?9e5:Math.min(c,36e5),j={sessionId:(0,e.randomUUID)(),workspace:d,generation:(0,N.B7)(d).generation,state:"beginning",createdAtMs:h,expiresAtMs:h+i,bytesStaged:0,filesStaged:0,abortRequested:!1,controller:new AbortController,flowIds:b.flowIds?[...b.flowIds]:void 0,recipientKey:b.recipientKey,encryptionVersion:2*(void 0!==b.recipientKey||void 0!==process.env.FLUJO_WORKER_SNAPSHOT_KEY)};Q.set(d,j);let k=setTimeout(()=>{(0,f.runWithWorkspace)(d,async()=>{await V(j)})},i);return k.unref?.(),j.expiryTimer=k,(0,f.runWithWorkspace)(d,()=>Z(j)),R(j)},async status(a,b=(0,f.getCurrentWorkspace)()){let c=Y((0,f.normalizeWorkspaceName)(b),a);return await W(c),R(c)},async readDownload(a,b=(0,f.getCurrentWorkspace)()){let c,d=Y((0,f.normalizeWorkspaceName)(b),a);if(await W(d),"SNAPSHOT_EXPIRED"===d.errorCode)throw new P("SNAPSHOT_EXPIRED",410,"Snapshot session has expired.");if("ready"!==d.state||!d.archivePath||!d.sha256||void 0===d.archiveBytes)throw new P("SNAPSHOT_NOT_READY",409,"Snapshot archive is not ready.");try{c=await l(d.archivePath,d.archiveBytes,d.sha256,d.controller.signal,()=>{if("ready"!==d.state||Date.now()>d.expiresAtMs)throw Error("Snapshot session is no longer available.")})}catch{throw d.state="failed",d.errorCode="SNAPSHOT_INTEGRITY",await T(d),new P("SNAPSHOT_INTEGRITY",500,"Snapshot archive failed its integrity check.")}return{content:c,sha256:d.sha256,plaintextSha256:d.plaintextSha256??d.sha256,encrypted:d.encrypted??!1,encryptionVersion:d.encryptionVersion??0,recipientKeyUsed:d.recipientKeyUsed??!1,size:d.archiveBytes}},async finalize(a,b=(0,f.getCurrentWorkspace)()){let c=Y((0,f.normalizeWorkspaceName)(b),a);if(await W(c),"finalized"===c.state)return R(c);if("ready"!==c.state)throw new P("SNAPSHOT_NOT_READY",409,"Only a ready snapshot can be finalized.");return U(c),await T(c),c.state="finalized",R(c)},async abort(a,b=(0,f.getCurrentWorkspace)()){let c=Y((0,f.normalizeWorkspaceName)(b),a);if("aborted"===c.state)return R(c);if("finalized"===c.state)throw new P("SNAPSHOT_NOT_READY",409,"A finalized snapshot cannot be aborted.");return U(c),c.abortRequested=!0,c.state="aborted",c.controller.abort(Error("Snapshot session was aborted.")),await T(c),R(c)}}},464896:(a,b,c)=>{function d(a){let b=a.startRestriction,c="unrestricted"===b||"singleton"===b||"exclusive"===b,d=!c&&!0===a.exclusive;return{startRestriction:c?b:d?"exclusive":"unrestricted",superExclusive:!!d||!0===a.superExclusive,emergency:!0===a.emergency}}function e(a){return!(!a||"object"!=typeof a||Array.isArray(a))&&["personaId","behaviorSlotKey","personaRetired","personaArchived"].some(b=>Object.prototype.hasOwnProperty.call(a,b))}c.d(b,{V:()=>e,v:()=>d})},480244:(a,b,c)=>{c.r(b),c.d(b,{loadServerConfigs:()=>q,loadServerRoots:()=>r,saveConfig:()=>t});var d=c(333873),e=c.n(d),f=c(107397),g=c(610782),h=c(774755),i=c(266844),j=c(907986),k=c(882980);let l=(0,i.h)("backend/services/mcp/config"),m=new Set(["streamable","sse","websocket"]),n=new Map;async function o(a){if(n.has(a))return n.get(a);let b=null;try{let c=(0,f.Lp)({baseDir:a,timeout:{block:5e3}});b=(await c.remote(["get-url","origin"])||"").trim()||null}catch{b=null}return n.set(a,b),b}async function p(a){var b;let c;if(m.has(a.transport))return{type:"remote"};let d="string"!=typeof(b=a.rootPath)||""===b.trim()?null:e().isAbsolute(b)?b:e().resolve((0,j.getWorkspaceDataDir)(),b);if(d&&""!==(c=e().relative(e().join((0,j.getWorkspaceDataDir)(),"mcp-servers"),d))&&!c.startsWith("..")&&!e().isAbsolute(c)){let a=await o(d);if(a)return{type:"github",repositoryUrl:a}}return{type:"local"}}async function q(){l.debug("Entering loadServerConfigs method");try{let a=await (0,g.loadItem)(h.Zg.MCP_SERVERS,{}),b=Object.entries(a).map(([a,b])=>{let c=(0,k.H6)(b.transport),d=a=>"string"==typeof a?(0,j.remapLegacyDefaultWorkspaceReference)(a,"mcp-servers"):void 0,e=a=>Array.isArray(a)?a.map(d).filter(a=>void 0!==a):void 0,f=a=>{if(!a||"object"!=typeof a||Array.isArray(a))return;let b={};for(let[c,e]of Object.entries(a)){if("string"==typeof e){b[c]=d(e)??e;continue}e&&"object"==typeof e&&"value"in e&&"string"==typeof e.value&&"metadata"in e&&e.metadata&&"object"==typeof e.metadata&&"isSecret"in e.metadata&&"boolean"==typeof e.metadata.isSecret&&(b[c]={value:d(e.value)??e.value,metadata:{isSecret:e.metadata.isSecret}})}return b},g=b.launch,h=g&&"object"==typeof g?{...g,command:d(g.command),cwd:d(g.cwd),args:e(g.args),env:f(g.env)}:void 0;b={...b,transport:c,rootPath:d(b.rootPath),cwd:d(b.cwd),command:d(b.command),args:e(b.args),roots:e(b.roots),env:f(b.env),...Object.prototype.hasOwnProperty.call(b,"launch")?{launch:h}:{}},m.has(c)&&function(a){if("string"!=typeof a)return!1;let b=a.trim();return"/"===b||"\\"===b||/^[A-Za-z]:[\\/]?$/.test(b)}(b.rootPath)&&(l.info(`Normalizing filesystem-root rootPath "${b.rootPath}" of remote server ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let i=b.source?.type;"stdio"===c&&"string"==typeof b.rootPath&&"."===b.rootPath.trim()&&("registry"===i||"marketplace"===i)&&/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(a)&&(l.info(`Normalizing shared Registry rootPath "." of ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let n={name:a,disabled:!1,rootPath:"",env:{},_buildCommand:"",_installCommand:""};return"streamable"===c?{...n,...b,name:a,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0,reconnectionOptions:b.reconnectionOptions&&"object"==typeof b.reconnectionOptions?b.reconnectionOptions:void 0,sessionId:b.sessionId||void 0,oauthClientId:b.oauthClientId||"",oauthClientSecret:b.oauthClientSecret||"",oauthScopes:b.oauthScopes||(b.oauthClientId||b.oauthClientInformation?["read"]:void 0),oauthClientMetadata:b.oauthClientMetadata,oauthClientInformation:b.oauthClientInformation,oauthTokens:b.oauthTokens,oauthCodeVerifier:b.oauthCodeVerifier}:"sse"===c?{...n,...b,name:a,eventSourceInit:b.eventSourceInit&&"object"==typeof b.eventSourceInit?b.eventSourceInit:void 0,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0}:"websocket"===c?{...n,...b,name:a,websocketUrl:b.websocketUrl||""}:{...n,...b,name:a,command:b.command||"",args:b.args||[],stderr:b.stderr||"pipe"}});return await Promise.all(b.map(async a=>{a.source||(a.source=await p(a))})),b}catch(a){if(a instanceof k.UQ)return l.warn("Stored MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to load server configs",a),{success:!1,error:`Failed to load server configs: ${a instanceof Error?a.message:"Unknown error"}`}}}async function r(a){let b=await q();if(!Array.isArray(b))return[];let c=b.find(b=>b.name===a)?.roots;return Array.isArray(c)?c.filter(a=>"string"==typeof a):[]}let s=["_buildCommand","_installCommand","oauthClientId","oauthClientSecret"];async function t(a){l.debug("Entering saveConfig method");try{for(let b of a.values())(0,k.SL)(b);let b=Object.fromEntries(Array.from(a.entries()).map(([a,b])=>[a,function(a){let{name:b,...c}=a,d={};for(let[a,b]of Object.entries(c))void 0!==b&&(""===b&&s.includes(a)||(d[a]=b));return d}(b)]));return await (0,g.VH)(h.Zg.MCP_SERVERS,b),{success:!0}}catch(a){if(a instanceof k.UQ)return l.warn("MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to save config",a),{success:!1,error:`Failed to save config: ${a instanceof Error?a.message:"Unknown error"}`}}}},620775:(a,b,c)=>{c.d(b,{q:()=>d});let d=2},621385:(a,b,c)=>{c.d(b,{N:()=>o,z:()=>r});var d=c(973024),e=c(977598),f=c(848161),g=c(176760),h=c.n(g),i=c(186359);let j=["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"],k=(a,b)=>j.every(c=>a[c]===b[c]),l=()=>Error("Worker snapshot is unsafe or changed while being read.");async function m(a,b){for(let c=0;c<b.length;){let{bytesWritten:d}=await a.write(b,c,b.length-c);if(!d)throw l();c+=d}}async function n(a,b,c){let d=Buffer.alloc(c);for(let e=0;e<c;){let{bytesRead:f}=await a.read(d,e,c-e,b+e);if(!f)throw l();e+=f}return d}class o{constructor(a,b){this.root=a,this.file=b,this.size=0,this.key=(0,e.randomBytes)(32),this.pending=Buffer.alloc(0),this.blocks=[],this.diskSize=0}static async create(){let a=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-input-"));try{return await d.promises.chmod(a,448),new o(a,await d.promises.open(h().join(a,"ciphertext"),"wx+",384))}catch(b){throw await d.promises.rm(a,{recursive:!0,force:!0}),b}}async append(a){this.size+=a.length;let b=this.pending.length?Buffer.concat([this.pending,a]):a;for(;b.length>=65536;)await this.seal(b.subarray(0,65536)),b=b.subarray(65536);this.pending=Buffer.from(b)}async seal(a){let b=(0,e.randomBytes)(12),c=(0,e.createCipheriv)("aes-256-gcm",this.key,b);c.setAAD(Buffer.from(`${this.blocks.length}:${a.length}`));let d=Buffer.concat([c.update(a),c.final()]);await m(this.file,Buffer.concat([b,c.getAuthTag(),d])),this.blocks.push({offset:this.diskSize,length:a.length}),this.diskSize+=a.length+28}async finish(){this.pending.length&&await this.seal(this.pending),this.pending.fill(0),this.pending=Buffer.alloc(0),await this.file.sync()}async read(a,b){if(!Number.isSafeInteger(a)||!Number.isSafeInteger(b)||a<0||b<0||a+b>this.size||b>8388608)throw l();let c=Buffer.alloc(b);for(let d=0;d<b;){let f=Math.floor((a+d)/65536),g=this.blocks[f];if(!g)throw l();if(this.cache?.index!==f){this.cache?.bytes.fill(0);let a=await n(this.file,g.offset,g.length+28),b=(0,e.createDecipheriv)("aes-256-gcm",this.key,a.subarray(0,12));b.setAAD(Buffer.from(`${f}:${g.length}`)),b.setAuthTag(a.subarray(12,28)),this.cache={index:f,bytes:Buffer.concat([b.update(a.subarray(28)),b.final()])}}let h=(a+d)%65536,i=Math.min(b-d,g.length-h);this.cache.bytes.copy(c,d,h,h+i),d+=i}return c}async *range(a=0,b=this.size-a){for(let c=0;c<b;c+=65536)yield await this.read(a+c,Math.min(65536,b-c))}async close(){for(let a of(this.key.fill(0),this.pending.fill(0),this.cache?.bytes.fill(0),[...await Promise.allSettled([this.file.close()]),...await Promise.allSettled([d.promises.rm(this.root,{recursive:!0,force:!0})])]))if("rejected"===a.status)throw a.reason}}class p{constructor(a,b){this.file=a,this.size=b,this.buffer=Buffer.alloc(0),this.offset=0,this.position=0}async fill(){return this.offset<this.buffer.length||this.position!==this.size&&(this.buffer=await n(this.file,this.position,Math.min(65536,this.size-this.position)),this.position+=this.buffer.length,this.offset=0,!0)}async peek(){return await this.fill()?this.buffer[this.offset]:-1}async byte(){let a=await this.peek();return -1!==a&&this.offset++,a}async whitespace(){for(;[9,10,13,32].includes(await this.peek());)await this.byte()}async expect(a){if(await this.whitespace(),await this.byte()!==a)throw l()}async smallValue(){await this.whitespace();let a=[],b=await this.peek()===34;b&&a.push(await this.byte());let c=!1;for(;a.length<256;){let d=await this.peek();if(-1===d)throw l();if(!b&&[44,125,9,10,13,32].includes(d)||(a.push(await this.byte()),b&&34===d&&!c))break;c=92===d&&!c}if(256===a.length)throw l();try{return JSON.parse(Buffer.from(a).toString("utf8"))}catch{throw l()}}async data(a,b){await this.expect(34);let c="",d=!1,e=0,f=async f=>{if(!/^[A-Za-z0-9+/=]*$/.test(f)||d&&f.length)throw l();let g=(c+=f).length-c.length%4;if(!g)return;let h=c.slice(0,g);if(!/^[A-Za-z0-9+/]*={0,2}$/.test(h))throw l();let i=Buffer.from(h,"base64");if(i.toString("base64")!==h||(d=h.includes("="),(e+=i.length)>b))throw l();await m(a,i),c=c.slice(g)};for(;await this.fill();){let a=this.buffer.indexOf(34,this.offset),b=this.buffer.indexOf(92,this.offset),d=Math.min(a<0?this.buffer.length:a,b<0?this.buffer.length:b);if(await f(this.buffer.subarray(this.offset,d).toString("latin1")),this.offset=d,d===this.buffer.length)continue;if(34===await this.byte()){if(c.length)throw l();return e}let g=await this.byte();if(117===g){let a="";for(let b=0;b<4;b++){let b=await this.byte();if(b<0)throw l();a+=String.fromCharCode(b)}if(!/^[0-9a-fA-F]{4}$/.test(a))throw l();await f(String.fromCharCode(Number.parseInt(a,16)))}else{let a=new Map([[34,'"'],[92,"\\"],[47,"/"],[98,"\b"],[102,"\f"],[110,"\n"],[114,"\r"],[116,"	"]]).get(g);if(void 0===a)throw l();await f(a)}}throw l()}}function q(a,b){if("string"!=typeof a||a.length>64)throw l();let c=Buffer.from(a,"base64");if(c.length!==b||c.toString("base64")!==a)throw l();return c}async function r(a,b,c,g){let j,m,r,s,t=await d.promises.lstat(a,{bigint:!0}),u=void 0===b?c:4*Math.ceil(c/3)+4096;if(!t.isFile()||t.isSymbolicLink()||t.nlink!==BigInt(1)||t.size>BigInt(u))throw l();let v=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),w=!1,x=0,y=(0,e.createHash)("sha256");try{let u=j=await o.create();if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();for(let a=0;a<Number(t.size);a+=65536)y.update(await n(v,a,Math.min(65536,Number(t.size)-a)));let z=(0,e.createHash)("sha256"),A=async a=>{if(u.size+a.length>c)throw l();z.update(a),await u.append(a)};if(void 0!==b)try{s=q(b,32),m=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-envelope-")),await d.promises.chmod(m,448),r=await d.promises.open(h().join(m,"ciphertext"),"wx+",384);let a=new p(v,Number(t.size)),g=new Map,j=-1;for(await a.expect(123);;){let b=await a.smallValue();if("string"!=typeof b||!["format","version","iv","tag","data"].includes(b)||g.has(b))throw l();await a.expect(58),g.set(b,"data"===b||await a.smallValue()),"data"===b&&(j=await a.data(r,c)),await a.whitespace();let d=await a.byte();if(125===d)break;if(44!==d)throw l()}if(await a.whitespace(),await a.byte()!==-1||5!==g.size||"flujo-workspace-encrypted"!==g.get("format")||![1,2].includes(g.get("version"))||j<0)throw l();x=g.get("version");let k=(0,e.createDecipheriv)("aes-256-gcm",s,q(g.get("iv"),12));2===x&&k.setAAD(Buffer.from(i.fI.v2Aad)),k.setAuthTag(q(g.get("tag"),16));for(let a=0;a<j;a+=65536)await A(k.update(await n(r,a,Math.min(65536,j-a))));await A(k.final())}catch{throw Error("Worker snapshot decryption failed. Check the encrypted archive and its key.")}else for(let a=0;a<Number(t.size);a+=65536)await A(await n(v,a,Math.min(65536,Number(t.size)-a)));let B=z.digest("hex");if((2===x?y.digest("hex"):B)!==g)throw Error("Worker snapshot SHA-256 mismatch.");if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();return await u.finish(),w=!0,u}catch(a){throw await j?.close().catch(()=>void 0),a}finally{s?.fill(0);let a=await Promise.allSettled([v.close(),...r?[r.close()]:[]]),b=await Promise.allSettled(m?[d.promises.rm(m,{recursive:!0,force:!0})]:[]);if(w&&[...a,...b].some(a=>"rejected"===a.status))throw await j?.close().catch(()=>void 0),Error("Snapshot temporary storage could not be released.")}}},683843:(a,b,c)=>{c.d(b,{d1:()=>h,nt:()=>g});var d=c(739006),e=c(186359),f=c(620775);let g=2;function h(){let a=process.env.FLUJO_BUILD_REVISION;return{applicationVersion:d.rE,snapshotEncryption:{...e.fI,readVersions:[...e.fI.readVersions]},snapshotLimits:(0,e.B5)(),snapshotFormatVersion:g,layoutVersion:f.q,workerProtocolVersion:1,workerSnapshotSourceVersion:1,.../^[a-f0-9]{40}$/.test(a??"")?{revision:a}:{}}}},739006:a=>{a.exports={rE:"3.48.0"}},794856:(a,b,c)=>{c.d(b,{$J:()=>i,Mh:()=>l,Ng:()=>k,k6:()=>j});var d=c(262070),e=c(952294),f=c(580940),g=c(905738),h=c(907986);function i(a){if((0,f.ye)()&&"1"===process.env.FLUJO_WORKER_SNAPSHOT_SOURCE){let b=(0,e.i)(a);if(b)return b;if(process.env.FLUJO_EXPOSURE_MODE?.trim().toLowerCase()!=="network")return k({error:"Worker snapshot sources require network exposure."},403);let c=(0,g.$)(a);if(c)return c;let d=(0,f.dT)();return"ready"===d.state&&d.workspace?d.workspace!==(0,h.getCurrentWorkspace)()?k({error:"This workspace is not assigned to the worker."},404):null:k({error:"Worker is not ready.",code:"WORKER_NOT_READY"},503)}let b=(0,g.$)(a,{strictLoopback:!0});return b||(0,e.i)(a)}function j(a){try{return new URL(a.url).searchParams.get("sessionId")}catch{return null}}function k(a,b=200){return Response.json(a,{status:b,headers:{"Cache-Control":"no-store"}})}function l(a){return a instanceof d.b?k({error:a.message,code:a.code},a.status):k({error:"Snapshot operation failed.",code:"SNAPSHOT_FAILED"},500)}},816079:(a,b,c)=>{c.d(b,{DB:()=>q,HM:()=>y,I5:()=>v,TX:()=>x,hD:()=>u});var d=c(973024),e=c(176760),f=c.n(e),g=c(774755),h=c(100629),i=c(134887),j=c(907986),k=c(845223),l=c(930100),m=c(851018),n=c(989481),o=c(472178),p=c(879628);let q=[g.Zg.MODELS,g.Zg.MCP_SERVERS,g.Zg.GLOBAL_ENV_VARS,g.Zg.REGISTRY_ACCOUNT],r="flujo:secret:v2",s=new Set(["apikey","password","passphrase","secret","token","privatekey","cookie","clientsecret","oauthclientsecret","accesstoken","refreshtoken","idtoken","oauthcodeverifier","authorization"]),t=new Map([["oauthtokens","tokens"],["oauthclientinformation","client"],["oauthcodeverifier","verifier"]]);function u(a,b){if(!b||"object"!=typeof b||a===g.Zg.MODELS&&!Array.isArray(b)||![g.Zg.MODELS,g.Zg.MCP_SERVERS].includes(a)&&Array.isArray(b)||(a===g.Zg.MODELS||a===g.Zg.MCP_SERVERS)&&(Array.isArray(b)?b:Object.values(b)).some(a=>!a||"object"!=typeof a||Array.isArray(a)))throw new n.Zz;if(a===g.Zg.MCP_SERVERS&&Array.isArray(b)){let a=b.map(a=>a.name);if(a.some(a=>"string"!=typeof a||!a.trim())||new Set(a).size!==a.length)throw new n.Zz;return Object.fromEntries(b.map(a=>[a.name,a]))}return b}async function v(a,b,c=!1,d=0,e=!1,f){if(d>100)throw new n.Zz;if("string"==typeof a)return b(a,c);if(Array.isArray(a))return Promise.all(a.map(a=>v(a,b,c,d+1,e,f)));if(!a||"object"!=typeof a)return a;if(1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length)return b(a.plaintext,!0);let g=c||!!(a.metadata&&"object"==typeof a.metadata&&a.metadata.isSecret),h={};for(let[c,i]of Object.entries(a)){let a=c.replace(/[_-]/g,"").toLowerCase(),j="env"===a||"headers"===a,k=t.get(a),l=f&&1===d&&k?await f(k,i):j&&i&&"object"==typeof i&&!Array.isArray(i)?Object.fromEntries(await Promise.all(Object.entries(i).map(async([a,c])=>{let g=await v(c,b,!0,d+1,e,f);return[a,e?"string"==typeof g?{value:g,metadata:{isSecret:!0}}:{...g,metadata:{isSecret:!0}}:g]}))):await v(i,b,s.has(a)||"value"===c&&g,d+1,e,f);Object.defineProperty(h,c,{value:l,enumerable:!0})}return h}async function w(a,b){if(a.startsWith("encrypted_failed:"))return{$flujoCredential:1,plaintext:a.slice(17)};let c=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;if(void 0===c)return b&&a?{$flujoCredential:1,plaintext:a}:a;let d=await (0,l.Do)(c);if(null===d)throw new n.Zz;return{$flujoCredential:1,plaintext:d}}async function x(a){return(0,p.Ns)(async()=>{let b={};for(let a of q){let c,d=f().join((0,j.getWorkspaceDataDir)(),"db",`${a}.json`);try{c=await (0,h.b)(d,{maxBytes:7340032,verifyPath:()=>(0,o.V$)((0,i.ok)(),d)})}catch(a){if("ENOENT"===a.code)continue;throw new n.Zz}try{let d=u(a,JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c))),e=async(a,b)=>(0,k.rr)(a,await (0,k.eC)(a,b,(0,j.getCurrentWorkspace)(),async a=>{let b=await (0,l.Do)(a);if(null===b)throw new n.Zz;return b}),(0,j.getCurrentWorkspace)());b[a]=await v(d,w,!1,0,!1,a===g.Zg.MCP_SERVERS?e:void 0)}finally{c.fill(0)}}let c=Date.now(),d=Buffer.from(JSON.stringify({version:1,createdAt:c,expiresAt:c+864e5,records:b}));try{return await (0,n.of)(d,a)}finally{d.fill(0)}})}async function y(a,b,c,e,l={}){let p,s=(0,j.assertValidWorkspaceName)(c);if("string"!=typeof e||e.length<12||Buffer.byteLength(e)>1024||e===m.Gr||e===b)throw new n.Zz;let t=await (0,n.XM)(a,b);try{p=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t))}finally{t.fill(0)}let w=Date.now();if(!p||1!==p.version||!Number.isSafeInteger(p.createdAt)||!Number.isSafeInteger(p.expiresAt)||p.createdAt>w+6e4||p.expiresAt<=w||p.expiresAt-p.createdAt!=864e5||!p.records||"object"!=typeof p.records||Array.isArray(p.records)||Object.keys(p.records).some(a=>!q.includes(a)))throw new n.Zz;let x=(0,m.OD)(),z=await (0,m.Mk)(x,"user",e,"passphrase"),A=new Map;for(let[a,b]of Object.entries(p.records)){let c=u(a,b),d=async(a,b)=>{if(!b||!a||/^\$\{global:[^}]+\}$/.test(a))return a;let c=(0,m.od)(a,x.activeKey,r);if((0,m.ho)(c,x.activeKey,r)!==a)throw new n.Zz;return`encrypted:${c}`},e=a===g.Zg.GLOBAL_ENV_VARS&&c&&"object"==typeof c&&!Array.isArray(c)?Object.fromEntries(await Promise.all(Object.entries(c).map(async([a,b])=>{let c=await v(b,d,!0,0,!0);if("string"==typeof c)return[a,{value:c,metadata:{isSecret:!0}}];if(!c||"object"!=typeof c||"string"!=typeof c.value)throw new n.Zz;return[a,{...c,metadata:{isSecret:!0}}]}))):await v(c,d,!1,0,!0,a===g.Zg.MCP_SERVERS?async(a,b)=>{let c=await (0,k.ZA)(a,b,s),d=(0,k.bM)(a,c,s),e=(0,m.od)(d,x.activeKey,r);if((0,m.ho)(e,x.activeKey,r)!==d)throw new n.Zz;return{format:k.ok,ciphertext:e}}:void 0);if(a===g.Zg.MCP_SERVERS&&e&&"object"==typeof e)for(let a of Object.values(e)){if(!a||"object"!=typeof a||Array.isArray(a))throw new n.Zz;a.disabled=!0}A.set(`${a}.json`,Buffer.from(JSON.stringify(e)))}if(A.set(`${g.Zg.ENCRYPTION_KEY}.json`,Buffer.from(JSON.stringify(z))),[...A.values()].reduce((a,b)=>a+b.length,0)>2*n.Ns)throw new n.Zz;l.signal?.throwIfAborted();let B=(0,j.getWorkspacesDir)();await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let C=await d.promises.lstat(B,{bigint:!0}),D=await d.promises.mkdtemp(f().join(B,".credential-transfer-")),E=await d.promises.lstat(D,{bigint:!0}),F=!1;try{for(let a of(await d.promises.chmod(D,448),j.WORKSPACE_SUBTREES))await d.promises.mkdir(f().join(D,a),{mode:448});for(let[a,b]of(await (0,o.sA)(D,f().join(D,".workspace.json"),Buffer.from('{"roots":[]}'),{mode:384}),A)){l.signal?.throwIfAborted(),await (0,o.sA)(D,f().join(D,"db",a),b,{mode:384});let c=await (0,h.b)(f().join(D,"db",a),{maxBytes:2*n.Ns,ownerOnly:!0});try{if(!c.equals(b))throw new n.Zz}finally{c.fill(0)}await l.checkpoint?.("file_written")}return await (0,j.withWorkspaceNamespaceMutation)(async()=>{l.signal?.throwIfAborted(),await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let a=await d.promises.lstat(B,{bigint:!0}),b=await d.promises.lstat(D,{bigint:!0});if(a.dev!==C.dev||a.ino!==C.ino||b.dev!==E.dev||b.ino!==E.ino||b.isSymbolicLink()||(await l.checkpoint?.("before_publish"),(await d.promises.readdir(B)).some(a=>a.toLowerCase()===s.toLowerCase())))throw new n.Zz;if(l.signal?.throwIfAborted(),await d.promises.rename(D,(0,j.getWorkspaceDir)(s)),F=!0,"win32"!==process.platform){let a=await d.promises.open(B,d.constants.O_RDONLY|d.constants.O_DIRECTORY|d.constants.O_NOFOLLOW|d.constants.O_NONBLOCK);try{let b=await a.stat({bigint:!0});if(!b.isDirectory()||b.dev!==C.dev||b.ino!==C.ino||b.mode!==C.mode||b.uid!==C.uid||b.gid!==C.gid)throw new n.Zz;await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let c=await d.promises.lstat(B,{bigint:!0});if(c.isSymbolicLink()||c.dev!==b.dev||c.ino!==b.ino)throw new n.Zz;await a.sync()}finally{await a.close()}}return s})}finally{for(let a of A.values())a.fill(0);if(!F){let a=await d.promises.lstat(D,{bigint:!0}).catch(()=>void 0);a&&a.isDirectory()&&!a.isSymbolicLink()&&a.dev===E.dev&&a.ino===E.ino&&f().dirname(D)===B&&f().basename(D).startsWith(".credential-transfer-")&&await d.promises.rm(D,{recursive:!0,force:!0})}}}},817492:(a,b,c)=>{c.d(b,{Hm:()=>f,xc:()=>e});let d=["key","secret","token","password"],e=a=>d.some(b=>a.toLowerCase().includes(b)),f=a=>e(a)||"authorization"===a.trim().toLowerCase()},845223:(a,b,c)=>{c.d(b,{ZA:()=>l,bM:()=>g,eC:()=>j,ok:()=>e,rr:()=>k});var d=c(88169);let e="flujo-oauth-v1",f=a=>!!a&&"object"==typeof a&&!Array.isArray(a),g=d.rt;function h(a){return f(a)&&(a.format===e||Object.hasOwn(a,"format")&&Object.hasOwn(a,"ciphertext")&&2===Object.keys(a).length)}async function i(a,b,c,d=0){if(d>100)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");if("string"==typeof a){if(c)return a;if(a.startsWith("encrypted_failed:"))return a.slice(17);let d=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;return void 0===d?a:b(d)}return Array.isArray(a)?Promise.all(a.map(a=>i(a,b,c,d+1))):f(a)?c&&1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length?a.plaintext:Object.fromEntries(await Promise.all(Object.entries(a).map(async([a,e])=>[a,await i(e,b,c,d+1)]))):a}async function j(a,b,c,j){if(h(b)){let g;if(!f(b)||2!==Object.keys(b).length||b.format!==e||"string"!=typeof b.ciphertext||!b.ciphertext.startsWith("v2:")||Buffer.byteLength(b.ciphertext)>524288)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g=await j(b.ciphertext),(0,d.s6)(a,g,c)}let k=await i(b,j,!1);return g(a,k,c),k}function k(a,b,c){return g(a,b,c),{$flujoOAuth:1,kind:a,value:b}}async function l(a,b,c){if(f(b)&&1===b.$flujoOAuth){if(3!==Object.keys(b).length||b.kind!==a||!Object.hasOwn(b,"value"))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g(a,b.value,c),b.value}if(h(b))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");let d=await i(b,async()=>{throw Error("OAuth credentials are malformed or belong to another workspace or purpose.")},!0);return g(a,d,c),d}},882980:(a,b,c)=>{c.d(b,{H6:()=>h,Mt:()=>e,SL:()=>g,UQ:()=>f,ZW:()=>d});let d="MCP_TRANSPORT_INVALID";function e(a){return"stdio"===a||"streamable"===a||"sse"===a||"websocket"===a}class f extends Error{constructor(){super(d),this.name="McpTransportError"}}function g(a){if(!e(a.transport))throw new f}function h(a){if(void 0===a)return"stdio";if(!e(a))throw new f;return a}},989481:(a,b,c)=>{c.d(b,{Ns:()=>i,XM:()=>m,Zz:()=>j,of:()=>l});var d=c(977598),e=c(257975),f=c(851018);let g=(0,e.promisify)(d.pbkdf2),h=Buffer.from("FLUJOT01"),i=0x2000000;class j extends Error{constructor(){super("Invalid transfer or recipient passphrase."),this.name="RecipientTransferError"}}function k(a){if("string"!=typeof a||a===f.Gr||a.length<16||Buffer.byteLength(a,"utf8")>1024)throw new j}async function l(a,b){if(k(b),!a.byteLength||a.byteLength>i)throw new j;let c=Buffer.alloc(40);h.copy(c),(0,d.randomBytes)(16).copy(c,8),(0,d.randomBytes)(12).copy(c,24),c.writeUInt32BE(a.byteLength,36);let e=await g(b,c.subarray(8,24),f.fn,32,"sha256");try{let b=(0,d.createCipheriv)("aes-256-gcm",e,c.subarray(24,36));return b.setAAD(c),Buffer.concat([c,b.update(a),b.final(),b.getAuthTag()])}finally{e.fill(0)}}async function m(a,b){let c;if(k(b),a.byteLength<57||a.byteLength>56+i)throw new j;let e=Buffer.from(a),l=e.subarray(0,40);if(!l.subarray(0,8).equals(h)||l.readUInt32BE(36)!==e.length-40-16)throw new j;let m=await g(b,l.subarray(8,24),f.fn,32,"sha256");try{let a=(0,d.createDecipheriv)("aes-256-gcm",m,l.subarray(24,36));a.setAAD(l),a.setAuthTag(e.subarray(-16)),c=a.update(e.subarray(40,-16));let b=a.final();return Buffer.concat([c,b])}catch{throw new j}finally{c?.fill(0),m.fill(0),e.fill(0)}}}};