flujo-ai 3.48.6 → 3.48.7

package/.next/server/chunks/73633.js

@@ -1 +1 @@
-"use strict";exports.id=73633,exports.ids=[972,16079,17492,33829,55437,56210,57863,68115,73633,74188,77818,78591,80244,90496],exports.modules={186359:(a,b,c)=>{c.d(b,{fI:()=>e,B5:()=>g});let d=JSON.parse('{"e":{"format":"flujo-workspace-encrypted","cipher":"aes-256-gcm","writeVersion":2,"readVersions":[1,2],"legacyPlaintextRead":true,"recipientKeyRequired":true,"recipientKeyBytes":32,"recipientKeyEncoding":"base64","v2Aad":"flujo:workspace-snapshot:v2","v2Digest":"sha256-encrypted-wire","v1Digest":"sha256-plaintext-zip"},"R":{"maxFileBytes":268435456,"maxUncompressedBytes":1073741824,"maxManifestBytes":8388608,"maxArchiveBytes":1082130432,"maxEncryptedBytes":1442844672,"maxMembers":65534}}'),e=d.e,f=d.R;function g(){let a=(a,b)=>{let c=process.env[a];if(void 0===c)return b;let d=Number(c);if(!/^[1-9]\d*$/.test(c)||!Number.isSafeInteger(d))throw Error("Snapshot limits are invalid.");return d},b=a("FLUJO_SNAPSHOT_MAX_FILE_BYTES",f.maxFileBytes),c=a("FLUJO_SNAPSHOT_MAX_BYTES",f.maxUncompressedBytes),d=c+f.maxManifestBytes,e=4*Math.ceil(d/3)+4096;if(!Number.isSafeInteger(d)||!Number.isSafeInteger(e))throw Error("Snapshot limits are invalid.");return{...f,maxFileBytes:b,maxUncompressedBytes:c,maxArchiveBytes:d,maxEncryptedBytes:e}}},204983:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Eq:()=>D,QO:()=>H,TH:()=>J,XV:()=>L});var e=c(973024),f=c(100629),g=c(977598),h=c(157075),i=c(186359),j=c(621385),k=c(587301),l=c(848161),m=c(176760),n=c.n(m),o=c(76364),p=c.n(o),q=c(907986),r=c(620775),s=c(683843),t=c(472178),u=c(965385),v=c(826045),w=c(930100),x=c(719031),y=c(816079),z=c(774755),A=c(158601),B=c(739006),C=a([u]);u=(C.then?(await C)():C)[0];let K=".workspace.json";class L extends Error{constructor(a,b){super(b),this.code=a,this.name="SnapshotArchiveError"}}let M=new WeakMap,N=new WeakMap;function D(a){if(void 0!==a&&"string"!=typeof a)throw new L("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let b=a??process.env.FLUJO_WORKER_SNAPSHOT_KEY;if(void 0===b)return null;if("string"!=typeof b||44!==b.length)throw new L("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let c=Buffer.from(b,"base64");if(32!==c.length||c.toString("base64")!==b)throw c.fill(0),new L("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");return c}async function E(a){let b=!1,c=async(a,c)=>(a&&!/^\$\{global:[^}]+\}$/.test(a)&&(c||/^(?:encrypted:|encrypted_failed:|v2:)/.test(a))&&(b=!0),a);try{for(let d of y.DB){let e=a.file(`db/${d}.json`);if(!e)continue;let f=JSON.parse(await e.async("string"));if(d===z.Zg.GLOBAL_ENV_VARS&&f&&"object"==typeof f)for(let a of Object.values(f))await (0,y.I5)(a,c,!0);else await (0,y.I5)(f,c,!1,0,!1,d===z.Zg.MCP_SERVERS?async(a,c)=>(c&&("object"!=typeof c||Object.keys(c).length)&&(b=!0),c):void 0)}return b}catch{throw new L("CREDENTIALS_UNAVAILABLE","Credential inventory cannot be verified for plaintext export.")}}function F(a,b,c=!1){let d=n().relative(n().resolve(a),n().resolve(b));return""===d?c:!d.startsWith("..")&&!n().isAbsolute(d)}async function G(a,b,c,d,g,h){let i;g?.throwIfAborted();let j=n().join(b,K);try{i=await e.promises.lstat(j,{bigint:!0})}catch(a){if("ENOENT"===a.code)return;throw a}if(!i.isFile()||i.isSymbolicLink()||i.nlink>BigInt(1))throw new L("UNSAFE_ENTRY","Workspace metadata is not a plain, singly-linked file.");if(i.size>BigInt(d))throw new L("SIZE_LIMIT","Workspace metadata exceeds the configured file limit.");let k=await e.promises.realpath(b);if(!F(k,await e.promises.realpath(j)))throw new L("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.");try{let l=await (0,f.b)(j,{expected:i,maxBytes:d,signal:g,consume:h?.consume,verifyPath:async()=>{if(await (0,t.V$)(b,j),!F(k,await e.promises.realpath(j)))throw new L("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.")}});h?h.complete(i):(c(K,l),a.file(K,l))}catch(a){if(a instanceof f.$)throw new L("SIZE_LIMIT"===a.code?"SIZE_LIMIT":"UNSAFE_ENTRY","Workspace metadata changed or is unsafe.");throw a}}async function H(a,b,c={}){let d,f,{signal:k}=c;if(k?.throwIfAborted(),await (0,v.Tm)(a))throw new L("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let l=D(c.recipientKey),m=(0,q.getWorkspaceDataDir)(a);try{d=await e.promises.lstat(m)}catch{throw l?.fill(0),new L("WORKSPACE_UNAVAILABLE","Workspace directory is unavailable.")}if(!d.isDirectory()||d.isSymbolicLink())throw l?.fill(0),new L("WORKSPACE_UNAVAILABLE","Workspace directory is not a real directory.");let o=(0,i.B5)(),y=o.maxFileBytes,z=o.maxUncompressedBytes,C=[],F=0,J=new(p());try{f=await j.N.create()}catch(a){throw l?.fill(0),a}let O=new Map;try{let d,i,j,v=(a,b,c)=>{if(k?.throwIfAborted(),b.byteLength>y)throw new L("SIZE_LIMIT","Snapshot member exceeds the configured file limit.");if(b.subarray(0,16).equals(Buffer.from("SQLite format 3\0")))throw new L("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);if((F+=b.byteLength)>z)throw new L("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");C.push({path:a,size:b.byteLength,sha256:(0,g.createHash)("sha256").update(b).digest("hex"),mode:c?384|Number(c.mode&BigInt(64)):384})},D=f.size,H=(0,g.createHash)("sha256"),P=Buffer.alloc(0);await G(J,m,v,y,k,{consume:async a=>{if(f.size+a.length>z)throw new L("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");P.length<16&&(P=Buffer.concat([P,a.subarray(0,16-P.length)])),H.update(a),await f.append(a)},complete:a=>{if(P.equals(Buffer.from("SQLite format 3\0")))throw new L("UNSAFE_ENTRY","Live SQLite state is not portable: .workspace.json. Export it with its owning tool first.");let b=Number(a.size);F+=b,C.push({path:K,size:b,sha256:H.digest("hex"),mode:384}),J.file(K,Buffer.alloc(0)),O.set(K,{position:D,size:b,file:J.file(K)})}});let Q=["mcp-servers","db/codex-runtime","db/antigravity-cli-runtime","userdata/mcp-runtime","browser-profile","bash-utils","db/worker-bootstrap-secrets.json","db/native-tool-journal","db/native-session-payloads","db/native-session-origins"],R=a=>Q.some(b=>a===b||a.startsWith(`${b}/`))||/^db\/codex-private-[^/]*(?:\/|$)/i.test(a);for(let a of q.WORKSPACE_SUBTREES){let b;if(k?.throwIfAborted(),R(a)){J.folder(a);continue}let c=n().join(m,a);try{b=await e.promises.lstat(c)}catch(b){if("ENOENT"===b.code){J.folder(a);continue}throw b}if(!b.isDirectory()||b.isSymbolicLink())throw new L("UNSAFE_ENTRY",`Workspace subtree ${a} is not a real directory.`);J.folder(a),await (0,t.N)(J,c,a,m,(a,b)=>{throw new L(b.includes("size limit")?"SIZE_LIMIT":"UNSAFE_ENTRY",`Cannot safely snapshot ${a}: ${b}`)},{maxFileBytes:y,skippedDirectories:new Set(["node_modules",".venv","__pycache__"]),skipPath:R,signal:k,preserveMode:!0,allowHardLinks:!0,onFileStream:async(a,b,c)=>{let d=Number(c.size);if(F+d>z)throw new L("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");let e=f.size,h=(0,g.createHash)("sha256"),i=Buffer.alloc(0);for await(let a of b)k?.throwIfAborted(),i.length<16&&(i=Buffer.concat([i,a.subarray(0,16-i.length)])),h.update(a),await f.append(a);if(f.size-e!==d)throw new L("UNSAFE_ENTRY","Snapshot member changed while being captured.");if(i.equals(Buffer.from("SQLite format 3\0")))throw new L("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);F+=d,C.push({path:a,size:d,sha256:h.digest("hex"),mode:384|Number(c.mode&BigInt(64))}),J.file(a,Buffer.alloc(0),{unixPermissions:Number(c.mode&BigInt(33279))}),O.set(a,{position:e,size:d,file:J.file(a)})}})}await f.finish();let S=async a=>{let b=O.get(a);if(b&&J.file(a)===b.file){let a=[];for await(let c of f.range(b.position,b.size))a.push(c);return Buffer.concat(a)}return J.file(a).async("nodebuffer")};for(let[a,b]of O)b.file.async=(c,d)=>{let e=new(p());return e.file(a,h.Readable.from(f.range(b.position,b.size),{objectMode:!1,highWaterMark:65536})),e.file(a).async(c,d)};let T=async(a,b)=>{if(!J.file(a))return b;try{return JSON.parse((await S(a)).toString("utf8"))}catch{throw new L("UNSAFE_ENTRY",`Invalid workspace configuration: ${a}`)}},U=await T("db/mcp_servers.json",{});if(!U||"object"!=typeof U||Array.isArray(U)||Object.values(U).some(a=>!a||"object"!=typeof a))throw new L("UNSAFE_ENTRY","Invalid workspace configuration: db/mcp_servers.json");let V=await T("db/models.json",[]);if(!Array.isArray(V)||V.some(a=>!a||"object"!=typeof a))throw new L("UNSAFE_ENTRY","Invalid workspace configuration: db/models.json");let W=(a,b)=>{let c=C.findIndex(b=>b.path===a);-1!==c&&(F-=C.splice(c,1)[0].size),v(a,b),J.file(a,b,{unixPermissions:33152})},X=new Map;if(c.flowIds){let a=await T("db/flows.json",[]);if(!Array.isArray(a))throw new L("UNSAFE_ENTRY","Invalid workspace configuration: db/flows.json");for(let b of a)X.set(b.id,b);for(let a of Object.keys(J.files).filter(a=>/^db\/flows\/[^/]+\.json$/.test(a))){let b=await T(a,null);if(!b||"string"!=typeof b.id||!Array.isArray(b.nodes)||!Array.isArray(b.edges))throw new L("UNSAFE_ENTRY",`Invalid workspace flow: ${a}`);X.set(b.id,b)}}try{let a=(0,u.xL)(c.flowIds,{flows:[...X.values()],models:V,mcpServers:Object.entries(U).map(([a,b])=>({...b,name:a,transport:b.transport||"stdio"}))});i=a.requiresCodexAuth,(j=c.flowIds?a.flowIds:void 0)&&W("db/mcp_servers.json",Buffer.from(JSON.stringify(Object.fromEntries(a.configs.map(a=>[a.name,a]))))),d=await (0,u.zk)((0,u.am)(a.configs,m,{requiredServerNames:j?a.mcpServerNames:void 0}),{signal:k})}catch(a){throw k?.throwIfAborted(),new L("MCP_UNSUPPORTED",a instanceof Error?a.message:"MCP runtime cannot be reconstructed.")}if(!l&&await E(J))throw new L("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption.");let Y="none";if(i){if(!l)throw new L("CREDENTIALS_UNAVAILABLE","ChatGPT authentication requires an encrypted workspace snapshot.");try{let b=await (0,x.E0)(a);k?.throwIfAborted(),W("db/codex-runtime/auth.json",b),W(`db/codex-runtime/${x.Sy}`,Buffer.from(JSON.stringify(x.J1))),Y="chatgpt"}catch{throw k?.throwIfAborted(),new L("CREDENTIALS_UNAVAILABLE","Codex authentication is unavailable for encrypted transfer.")}}let Z=await T("db/encryption_key.json",{}),$="user"===Z.encryption_type?"user":"default";if("user"===$){let b;if(!l)throw new L("CREDENTIALS_UNAVAILABLE","Private workspace bootstrap requires an encrypted snapshot.");try{b="operator-file"===Z.key_protection?await (0,q.runWithWorkspace)(a,()=>(0,w.OS)(Z)):(0,A.eu)()}catch{throw new L("CREDENTIALS_UNAVAILABLE","Restore the matching independent operator secret before creating a worker snapshot.")}if(!b)throw new L("CREDENTIALS_UNAVAILABLE","Unlock this workspace before creating a worker snapshot.");W("db/worker-bootstrap-secrets.json",Buffer.from(JSON.stringify({version:1,workspaceDek:b})))}C.sort((a,b)=>a.path.localeCompare(b.path));let _={formatVersion:s.nt,layoutVersion:r.q,workspace:a,generation:b,createdAt:new Date().toISOString(),coherence:"registered-flujo-writers",externalRootsIncluded:!1,subtrees:q.WORKSPACE_SUBTREES,files:C,source:{version:B.rE,platform:process.platform},runtime:{mcpTransfer:d,codexAuth:Y,encryption:$,...j?{selectedFlowIds:j}:{}},excludedRuntimePaths:Q},aa=Buffer.from(JSON.stringify(_,null,2));if(aa.length>o.maxManifestBytes||Object.keys(J.files).length+1>o.maxMembers)throw new L("SIZE_LIMIT","Snapshot manifest or member count exceeds the restore limit.");J.file("snapshot-manifest.json",aa);let ab=!1,ac={zip:J,manifest:_,files:C.length,bytes:F,dispose:async()=>{ab||(l?.fill(0),await f.close(),ab=!0)}};return k?.throwIfAborted(),M.set(ac,{store:f,members:O}),J.generateInternalStream=a=>I(ac).generateInternalStream(a),N.set(ac,{key:l,recipientKeyUsed:void 0!==c.recipientKey}),ac}catch(a){throw l?.fill(0),await f.close().catch(()=>void 0),a}}function I(a){let b=M.get(a);if(!b)return a.zip;let c=new(p());for(let[d,e]of Object.entries(a.zip.files)){let a=b.members.get(d),f={date:e.date,unixPermissions:e.unixPermissions??void 0};e.dir?c.file(d,null,{...f,dir:!0}):a&&a.file===e?c.file(d,h.Readable.from(b.store.range(a.position,a.size),{objectMode:!1,highWaterMark:65536}),f):c.file(d,e.async("nodebuffer"),f)}return c}async function J(a,b={}){let{signal:c}=b;c?.throwIfAborted();let d=N.get(a),f=d?.recipientKeyUsed?Buffer.from(d.key):D();try{if(N.has(a)){let a=d?.key;if(!!a!=!!f||a&&f&&!(0,g.timingSafeEqual)(a,f))throw f?.fill(0),new L("CREDENTIALS_UNAVAILABLE","Snapshot encryption key changed. Start a new capture.")}let b=Object.keys(a.zip.files);if(b.length>(0,i.B5)().maxMembers)throw new L("SIZE_LIMIT","Snapshot exceeds the archive member limit.");let j=new Set(["db/codex-runtime/","db/codex-runtime/auth.json",`db/codex-runtime/${x.Sy}`]);if(b.some(a=>/^db\/codex-private-/i.test(a))||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a)&&!j.has(a))||!f&&("chatgpt"===a.manifest.runtime.codexAuth||"user"===a.manifest.runtime.encryption||b.includes("db/worker-bootstrap-secrets.json")||await E(a.zip)||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a))))throw f?.fill(0),new L("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption; runtime homes cannot be exported.");if(await (0,v.Tm)(a.manifest.workspace))throw new L("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let m=await e.promises.mkdtemp(n().join((0,l.tmpdir)(),"flujo-hot-clone-"));await e.promises.chmod(m,448).catch(()=>void 0);let o=n().join(m,"workspace.snapshot.zip");try{let b=I(a).generateNodeStream({type:"nodebuffer",streamFiles:!0,compression:"DEFLATE",compressionOptions:{level:6},platform:"UNIX"},()=>c?.throwIfAborted()),g=await (0,k.s)(new h.Readable({highWaterMark:65536}).wrap(b),o,f,c);return await e.promises.chmod(o,384).catch(()=>void 0),c?.throwIfAborted(),{archivePath:o,stagingDir:m,sha256:g.sha256,plaintextSha256:g.plaintextSha256,encrypted:!!f,encryptionVersion:2*!!f,recipientKeyUsed:d?.recipientKeyUsed??!1,size:g.size,files:a.files,bytes:a.bytes}}catch(a){throw await e.promises.rm(m,{recursive:!0,force:!0}).catch(()=>void 0),a}}finally{f?.fill(0)}}d()}catch(a){d(a)}})},261571:(a,b,c)=>{c.d(b,{Js:()=>i,L$:()=>j,SZ:()=>k});var d=c(610782),e=c(774755),f=c(266844),g=c(882980);let h=(0,f.h)("backend/services/mcp/runtimeHomeIsolation"),i="FLUJO_MCP_RUNTIME_HOME_ISOLATION";function j(a){let b=a?.trim().toLowerCase();if(b){if(["1","true","yes","on","isolated"].includes(b))return!0;if(["0","false","no","off","host"].includes(b))return!1}}async function k(a,b=process.env){if((0,g.SL)(a),"stdio"!==a.transport)return!1;let c=j(b[i]);if(void 0!==c)return c;if("isolated"===a.runtimeHomeMode)return!0;if("host"===a.runtimeHomeMode)return!1;try{let a=await (0,d.loadItem)(e.Zg.SPEECH_SETTINGS,void 0);return a?.experimental?.mcpRuntimeHomeIsolation===!0}catch(a){return h.warn("Could not read the workspace MCP runtime-home preference; defaulting to host home",{error:a}),!1}}},326790:(a,b,c)=>{c.d(b,{ED:()=>k,Ws:()=>l,jD:()=>i});var d=c(673496),e=c.n(d);let f=(0,c(266844).h)("backend/utils/registryClient");class g extends Error{constructor(){super("MCP Registry response exceeded its byte limit")}}class h extends Error{constructor(a="MCP Registry request timed out"){super(a)}}let i="https://registry.modelcontextprotocol.io";async function j(a,b,c){let d=new AbortController,e=setTimeout(()=>d.abort(new h),b),f=c.signal?AbortSignal.any([d.signal,c.signal]):d.signal;try{let b=await fetch(a,{headers:{Accept:"application/json"},signal:f,cache:"no-store",redirect:"error"});if(void 0===c.maxBytes)return{status:b.status,body:await b.text()};let d=b.body?.getReader(),e=[],h=0;try{if(d)for(;;){let{done:a,value:b}=await d.read();if(a)break;if((h+=b.byteLength)>c.maxBytes)throw new g;e.push(b)}}finally{await d?.cancel().catch(()=>{})}return{status:b.status,body:Buffer.concat(e).toString("utf8")}}finally{clearTimeout(e)}}async function k(a,b,c={}){let d=Date.now();c.signal?.throwIfAborted();try{return await new Promise((d,f)=>{if(c.signal?.aborted)return void f(c.signal.reason);let i=e().connect(a.origin),j=!1,k=setTimeout(()=>l(()=>f(new h)),b),l=a=>{j||(j=!0,clearTimeout(k),c.signal?.removeEventListener("abort",m),a(),i.destroy())},m=()=>l(()=>f(c.signal?.reason??new DOMException("Aborted","AbortError")));i.setTimeout(b,()=>l(()=>f(new h(`HTTP/2 session timed out after ${b}ms`)))),i.on("error",a=>l(()=>f(a)));let n=i.request({":method":"GET",":path":a.pathname+a.search,accept:"application/json"});n.setTimeout(b,()=>l(()=>f(new h(`HTTP/2 request timed out after ${b}ms`)))),n.on("error",a=>l(()=>f(a)));let o=0,p="",q=0;(n.setEncoding("utf8"),n.on("response",a=>{o=Number(a[":status"]||0)}),n.on("data",a=>{(q+=Buffer.byteLength(a,"utf8"),void 0!==c.maxBytes&&q>c.maxBytes)?l(()=>f(new g)):p+=a}),n.on("end",()=>l(()=>d({status:o,body:p}))),c.signal?.addEventListener("abort",m,{once:!0}),c.signal?.aborted)?m():n.end()})}catch(i){c.signal?.throwIfAborted();let e=b-(Date.now()-d);if(i instanceof g||i instanceof h||e<=0)throw i;return f.warn("HTTP/2 request to registry failed, retrying over HTTP/1.1",i instanceof Error?i.message:i),await j(a,e,c)}}async function l(a,b,c={}){let d=await k(a,b,c);if(d.status<200||d.status>=300)throw Error(`MCP Registry responded with status ${d.status}`);return JSON.parse(d.body)}},464896:(a,b,c)=>{function d(a){if(null==a)return null;if("object"!=typeof a||Array.isArray(a))return"Invalid AI condition";if("llm-gate"!==a.mode&&"flow-gate"!==a.mode)return"Invalid AI checker type";if("string"!=typeof a.condition||!a.condition.trim())return"A condition is required for the AI to check";let b="llm-gate"===a.mode?a.modelId:a.flowId;return"string"==typeof b&&b.trim()?void 0!==a.maxCallsPerDay&&("number"!=typeof a.maxCallsPerDay||!Number.isSafeInteger(a.maxCallsPerDay)||a.maxCallsPerDay<1)?"Maximum AI checks per day must be a positive whole number":null:"A model or flow is required to check the condition"}function e(a){return"mcp-poll"===a.type&&("llm-gate"===a.evaluate.mode||"flow-gate"===a.evaluate.mode)?{...a,evaluate:{mode:"on-change"}}:a}function f(a){let b=a.startRestriction,c="unrestricted"===b||"singleton"===b||"exclusive"===b,d=!c&&!0===a.exclusive;return{startRestriction:c?b:d?"exclusive":"unrestricted",superExclusive:!!d||!0===a.superExclusive,emergency:!0===a.emergency}}function g(a){return!(!a||"object"!=typeof a||Array.isArray(a))&&["personaId","behaviorSlotKey","personaRetired","personaArchived"].some(b=>Object.prototype.hasOwnProperty.call(a,b))}c.d(b,{B2:()=>d,Vw:()=>g,n$:()=>e,vq:()=>f})},480244:(a,b,c)=>{c.r(b),c.d(b,{loadServerConfigs:()=>q,loadServerRoots:()=>r,saveConfig:()=>t});var d=c(333873),e=c.n(d),f=c(107397),g=c(610782),h=c(774755),i=c(266844),j=c(907986),k=c(882980);let l=(0,i.h)("backend/services/mcp/config"),m=new Set(["streamable","sse","websocket"]),n=new Map;async function o(a){if(n.has(a))return n.get(a);let b=null;try{let c=(0,f.Lp)({baseDir:a,timeout:{block:5e3}});b=(await c.remote(["get-url","origin"])||"").trim()||null}catch{b=null}return n.set(a,b),b}async function p(a){var b;let c;if(m.has(a.transport))return{type:"remote"};let d="string"!=typeof(b=a.rootPath)||""===b.trim()?null:e().isAbsolute(b)?b:e().resolve((0,j.getWorkspaceDataDir)(),b);if(d&&""!==(c=e().relative(e().join((0,j.getWorkspaceDataDir)(),"mcp-servers"),d))&&!c.startsWith("..")&&!e().isAbsolute(c)){let a=await o(d);if(a)return{type:"github",repositoryUrl:a}}return{type:"local"}}async function q(){l.debug("Entering loadServerConfigs method");try{let a=await (0,g.loadItem)(h.Zg.MCP_SERVERS,{}),b=Object.entries(a).map(([a,b])=>{let c=(0,k.H6)(b.transport),d=a=>"string"==typeof a?(0,j.remapLegacyDefaultWorkspaceReference)(a,"mcp-servers"):void 0,e=a=>Array.isArray(a)?a.map(d).filter(a=>void 0!==a):void 0,f=a=>{if(!a||"object"!=typeof a||Array.isArray(a))return;let b={};for(let[c,e]of Object.entries(a)){if("string"==typeof e){b[c]=d(e)??e;continue}e&&"object"==typeof e&&"value"in e&&"string"==typeof e.value&&"metadata"in e&&e.metadata&&"object"==typeof e.metadata&&"isSecret"in e.metadata&&"boolean"==typeof e.metadata.isSecret&&(b[c]={value:d(e.value)??e.value,metadata:{isSecret:e.metadata.isSecret}})}return b},g=b.launch,h=g&&"object"==typeof g?{...g,command:d(g.command),cwd:d(g.cwd),args:e(g.args),env:f(g.env)}:void 0;b={...b,transport:c,rootPath:d(b.rootPath),cwd:d(b.cwd),command:d(b.command),args:e(b.args),roots:e(b.roots),env:f(b.env),...Object.prototype.hasOwnProperty.call(b,"launch")?{launch:h}:{}},m.has(c)&&function(a){if("string"!=typeof a)return!1;let b=a.trim();return"/"===b||"\\"===b||/^[A-Za-z]:[\\/]?$/.test(b)}(b.rootPath)&&(l.info(`Normalizing filesystem-root rootPath "${b.rootPath}" of remote server ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let i=b.source?.type;"stdio"===c&&"string"==typeof b.rootPath&&"."===b.rootPath.trim()&&("registry"===i||"marketplace"===i)&&/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(a)&&(l.info(`Normalizing shared Registry rootPath "." of ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let n={name:a,disabled:!1,rootPath:"",env:{},_buildCommand:"",_installCommand:""};return"streamable"===c?{...n,...b,name:a,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0,reconnectionOptions:b.reconnectionOptions&&"object"==typeof b.reconnectionOptions?b.reconnectionOptions:void 0,sessionId:b.sessionId||void 0,oauthClientId:b.oauthClientId||"",oauthClientSecret:b.oauthClientSecret||"",oauthScopes:b.oauthScopes||(b.oauthClientId||b.oauthClientInformation?["read"]:void 0),oauthClientMetadata:b.oauthClientMetadata,oauthClientInformation:b.oauthClientInformation,oauthTokens:b.oauthTokens,oauthCodeVerifier:b.oauthCodeVerifier}:"sse"===c?{...n,...b,name:a,eventSourceInit:b.eventSourceInit&&"object"==typeof b.eventSourceInit?b.eventSourceInit:void 0,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0}:"websocket"===c?{...n,...b,name:a,websocketUrl:b.websocketUrl||""}:{...n,...b,name:a,command:b.command||"",args:b.args||[],stderr:b.stderr||"pipe"}});return await Promise.all(b.map(async a=>{a.source||(a.source=await p(a))})),b}catch(a){if(a instanceof k.UQ)return l.warn("Stored MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to load server configs",a),{success:!1,error:`Failed to load server configs: ${a instanceof Error?a.message:"Unknown error"}`}}}async function r(a){let b=await q();if(!Array.isArray(b))return[];let c=b.find(b=>b.name===a)?.roots;return Array.isArray(c)?c.filter(a=>"string"==typeof a):[]}let s=["_buildCommand","_installCommand","oauthClientId","oauthClientSecret"];async function t(a){l.debug("Entering saveConfig method");try{for(let b of a.values())(0,k.SL)(b);let b=Object.fromEntries(Array.from(a.entries()).map(([a,b])=>[a,function(a){let{name:b,...c}=a,d={};for(let[a,b]of Object.entries(c))void 0!==b&&(""===b&&s.includes(a)||(d[a]=b));return d}(b)]));return await (0,g.VH)(h.Zg.MCP_SERVERS,b),{success:!0}}catch(a){if(a instanceof k.UQ)return l.warn("MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to save config",a),{success:!1,error:`Failed to save config: ${a instanceof Error?a.message:"Unknown error"}`}}}},587301:(a,b,c)=>{c.d(b,{s:()=>h,t:()=>i});var d=c(973024),e=c(977598),f=c(186359),g=c(157075);async function h(a,b,c,g){let h;a.on("error",()=>void 0);let i=(0,e.createHash)("sha256"),j=(0,e.createHash)("sha256");try{let a=(0,f.B5)(),i=c?(0,e.randomBytes)(12):void 0,j=c?(0,e.createCipheriv)("aes-256-gcm",c,i):void 0;j&&j.setAAD(Buffer.from(f.fI.v2Aad)),g?.throwIfAborted();let k=await d.promises.open(b,"wx",384);h={limits:a,iv:i,cipher:j,output:k}}catch(b){throw a.destroy(),b}let{limits:k,iv:l,cipher:m,output:n}=h,o=0,p=Buffer.alloc(0),q=0,r=async a=>{if(g?.throwIfAborted(),q+a.length>(c?k.maxEncryptedBytes:k.maxArchiveBytes))throw Error("Snapshot exceeds the archive size limit.");for(let b=0;b<a.length;){let c=await n.write(a,b,a.length-b);if(!c.bytesWritten)throw Error("Snapshot write made no progress.");b+=c.bytesWritten}i.update(a),q+=a.length},s=async(a,b=!1)=>{let c=p.length?Buffer.concat([p,a]):a,d=b?c.length:c.length-c.length%3;for(let a=0;a<d;){let b=Math.min(49152,d-a);await r(Buffer.from(c.subarray(a,a+b).toString("base64"))),a+=b}p=Buffer.from(c.subarray(d))},t=()=>a.destroy(g?.reason instanceof Error?g.reason:Error("Snapshot aborted."));g?.addEventListener("abort",t,{once:!0});let u=!1;try{for await(let b of(g?.throwIfAborted(),l&&await r(Buffer.from(`{"format":"flujo-workspace-encrypted","version":2,"iv":"${l.toString("base64")}","data":"`)),a)){g?.throwIfAborted();let a=Buffer.isBuffer(b)?b:Buffer.from(b);if((o+=a.length)>k.maxArchiveBytes)throw Error("Snapshot exceeds the archive size limit.");j.update(a),m?await s(m.update(a)):await r(a)}return m&&(await s(m.final(),!0),await r(Buffer.from(`","tag":"${m.getAuthTag().toString("base64")}"}`))),await n.sync(),{sha256:i.digest("hex"),plaintextSha256:j.digest("hex"),size:q}}catch(a){throw u=!0,a}finally{g?.removeEventListener("abort",t),a.destroy();try{await n.close()}catch(a){if(!u)throw a}}}async function i(a,b,c,f,h){let i,j=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),k=()=>i??=j.close(),l=!1;try{let i=await j.stat({bigint:!0}),m=a=>["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"].every(b=>i[b]===a[b]),n=async()=>{f.throwIfAborted(),h();let c=await d.promises.lstat(a,{bigint:!0});if(!i.isFile()||i.nlink!==BigInt(1)||!c.isFile()||c.isSymbolicLink()||i.size!==BigInt(b)||!m(c)||!m(await j.stat({bigint:!0})))throw Error("Snapshot archive failed its integrity check.")},o=async a=>{let c=Buffer.alloc(Math.min(65536,b-a));for(let b=0;b<c.length;){let{bytesRead:d}=await j.read(c,b,c.length-b,a+b);if(!d)throw Error("Snapshot archive failed its integrity check.");b+=d}return c};await n();let p=(0,e.createHash)("sha256");for(let a=0;a<b;a+=65536)f.throwIfAborted(),h(),p.update(await o(a));if(await n(),p.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.");let q=g.Readable.from(async function*(){try{let a=(0,e.createHash)("sha256");for(let c=0;c<b;c+=65536){await n();let b=await o(c);a.update(b),yield b}if(await n(),a.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.")}finally{await k()}}(),{objectMode:!1,highWaterMark:65536}),r=()=>q.destroy(Error("Snapshot session is no longer available."));return q.on("error",()=>void 0),q.once("close",()=>{f.removeEventListener("abort",r),k().catch(()=>void 0)}),f.addEventListener("abort",r,{once:!0}),f.aborted&&r(),l=!0,g.Readable.toWeb(q,{strategy:{highWaterMark:65536,size:a=>a.byteLength}})}finally{l||await k()}}},620775:(a,b,c)=>{c.d(b,{q:()=>d});let d=2},621385:(a,b,c)=>{c.d(b,{N:()=>o,z:()=>r});var d=c(973024),e=c(977598),f=c(848161),g=c(176760),h=c.n(g),i=c(186359);let j=["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"],k=(a,b)=>j.every(c=>a[c]===b[c]),l=()=>Error("Worker snapshot is unsafe or changed while being read.");async function m(a,b){for(let c=0;c<b.length;){let{bytesWritten:d}=await a.write(b,c,b.length-c);if(!d)throw l();c+=d}}async function n(a,b,c,d){let e=d?d.subarray(0,c):Buffer.alloc(c);if(e.length!==c)throw l();for(let d=0;d<c;){let{bytesRead:f}=await a.read(e,d,c-d,b+d);if(!f)throw l();d+=f}return e}class o{constructor(a,b){this.root=a,this.file=b,this.size=0,this.key=(0,e.randomBytes)(32),this.pending=Buffer.alloc(0),this.blocks=[],this.diskSize=0,this.sealed=Buffer.alloc(65564),this.readTail=Promise.resolve()}static async create(){let a=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-input-"));try{return await d.promises.chmod(a,448),new o(a,await d.promises.open(h().join(a,"ciphertext"),"wx+",384))}catch(b){throw await d.promises.rm(a,{recursive:!0,force:!0}),b}}async append(a){this.size+=a.length;let b=this.pending.length?Buffer.concat([this.pending,a]):a;for(;b.length>=65536;)await this.seal(b.subarray(0,65536)),b=b.subarray(65536);this.pending=Buffer.from(b)}async seal(a){let b=(0,e.randomBytes)(12),c=(0,e.createCipheriv)("aes-256-gcm",this.key,b);c.setAAD(Buffer.from(`${this.blocks.length}:${a.length}`));let d=c.update(a),f=c.final();b.copy(this.sealed),c.getAuthTag().copy(this.sealed,12),d.copy(this.sealed,28),f.copy(this.sealed,28+d.length),await m(this.file,this.sealed.subarray(0,a.length+28)),this.blocks.push({offset:this.diskSize,length:a.length}),this.diskSize+=a.length+28}async finish(){this.pending.length&&await this.seal(this.pending),this.pending.fill(0),this.pending=Buffer.alloc(0),await this.file.sync()}async read(a,b){let c,d=this.readTail;this.readTail=new Promise(a=>{c=a}),await d;try{return await this.readOwned(a,b)}finally{c()}}async readOwned(a,b){if(!Number.isSafeInteger(a)||!Number.isSafeInteger(b)||a<0||b<0||a+b>this.size||b>8388608)throw l();let c=Buffer.alloc(b);for(let d=0;d<b;){let f=Math.floor((a+d)/65536),g=this.blocks[f];if(!g)throw l();if(this.cache?.index!==f){this.cache?.bytes.fill(0);let a=await n(this.file,g.offset,g.length+28,this.sealed),b=(0,e.createDecipheriv)("aes-256-gcm",this.key,a.subarray(0,12));b.setAAD(Buffer.from(`${f}:${g.length}`)),b.setAuthTag(a.subarray(12,28));let c=b.update(a.subarray(28)),d=b.final();this.cache={index:f,bytes:d.length?Buffer.concat([c,d]):c}}let h=(a+d)%65536,i=Math.min(b-d,g.length-h);this.cache.bytes.copy(c,d,h,h+i),d+=i}return c}async *range(a=0,b=this.size-a){for(let c=0;c<b;c+=65536)yield await this.read(a+c,Math.min(65536,b-c))}async close(){for(let a of(this.key.fill(0),this.pending.fill(0),this.cache?.bytes.fill(0),this.sealed.fill(0),[...await Promise.allSettled([this.file.close()]),...await Promise.allSettled([d.promises.rm(this.root,{recursive:!0,force:!0})])]))if("rejected"===a.status)throw a.reason}}class p{constructor(a,b){this.file=a,this.size=b,this.storage=Buffer.alloc(65536),this.buffer=Buffer.alloc(0),this.offset=0,this.position=0}async fill(){return this.offset<this.buffer.length||this.position!==this.size&&(this.buffer=await n(this.file,this.position,Math.min(65536,this.size-this.position),this.storage),this.position+=this.buffer.length,this.offset=0,!0)}async peek(){return await this.fill()?this.buffer[this.offset]:-1}async byte(){let a=await this.peek();return -1!==a&&this.offset++,a}async whitespace(){for(;[9,10,13,32].includes(await this.peek());)await this.byte()}async expect(a){if(await this.whitespace(),await this.byte()!==a)throw l()}async smallValue(){await this.whitespace();let a=[],b=await this.peek()===34;b&&a.push(await this.byte());let c=!1;for(;a.length<256;){let d=await this.peek();if(-1===d)throw l();if(!b&&[44,125,9,10,13,32].includes(d)||(a.push(await this.byte()),b&&34===d&&!c))break;c=92===d&&!c}if(256===a.length)throw l();try{return JSON.parse(Buffer.from(a).toString("utf8"))}catch{throw l()}}async data(a,b){await this.expect(34);let c="",d=!1,e=0,f=async f=>{if(!/^[A-Za-z0-9+/=]*$/.test(f)||d&&f.length)throw l();let g=(c+=f).length-c.length%4;if(!g)return;let h=c.slice(0,g);if(!/^[A-Za-z0-9+/]*={0,2}$/.test(h))throw l();let i=Buffer.from(h,"base64");if(i.toString("base64")!==h||(d=h.includes("="),(e+=i.length)>b))throw l();await m(a,i),c=c.slice(g)};for(;await this.fill();){let a=this.buffer.indexOf(34,this.offset),b=this.buffer.indexOf(92,this.offset),d=Math.min(a<0?this.buffer.length:a,b<0?this.buffer.length:b);if(await f(this.buffer.subarray(this.offset,d).toString("latin1")),this.offset=d,d===this.buffer.length)continue;if(34===await this.byte()){if(c.length)throw l();return e}let g=await this.byte();if(117===g){let a="";for(let b=0;b<4;b++){let b=await this.byte();if(b<0)throw l();a+=String.fromCharCode(b)}if(!/^[0-9a-fA-F]{4}$/.test(a))throw l();await f(String.fromCharCode(Number.parseInt(a,16)))}else{let a=new Map([[34,'"'],[92,"\\"],[47,"/"],[98,"\b"],[102,"\f"],[110,"\n"],[114,"\r"],[116,"	"]]).get(g);if(void 0===a)throw l();await f(a)}}throw l()}}function q(a,b){if("string"!=typeof a||a.length>64)throw l();let c=Buffer.from(a,"base64");if(c.length!==b||c.toString("base64")!==a)throw l();return c}async function r(a,b,c,g){let j,m,r,s,t=await d.promises.lstat(a,{bigint:!0}),u=void 0===b?c:4*Math.ceil(c/3)+4096;if(!t.isFile()||t.isSymbolicLink()||t.nlink!==BigInt(1)||t.size>BigInt(u))throw l();let v=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),w=!1,x=0,y=(0,e.createHash)("sha256");try{let u=j=await o.create();if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();let z=Buffer.alloc(65536);for(let a=0;a<Number(t.size);a+=65536)y.update(await n(v,a,Math.min(65536,Number(t.size)-a),z));let A=(0,e.createHash)("sha256"),B=async a=>{if(u.size+a.length>c)throw l();A.update(a),await u.append(a)};if(void 0!==b)try{s=q(b,32),m=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-envelope-")),await d.promises.chmod(m,448),r=await d.promises.open(h().join(m,"ciphertext"),"wx+",384);let a=new p(v,Number(t.size)),g=new Map,j=-1;for(await a.expect(123);;){let b=await a.smallValue();if("string"!=typeof b||!["format","version","iv","tag","data"].includes(b)||g.has(b))throw l();await a.expect(58),g.set(b,"data"===b||await a.smallValue()),"data"===b&&(j=await a.data(r,c)),await a.whitespace();let d=await a.byte();if(125===d)break;if(44!==d)throw l()}if(await a.whitespace(),await a.byte()!==-1||5!==g.size||"flujo-workspace-encrypted"!==g.get("format")||![1,2].includes(g.get("version"))||j<0)throw l();x=g.get("version");let k=(0,e.createDecipheriv)("aes-256-gcm",s,q(g.get("iv"),12));2===x&&k.setAAD(Buffer.from(i.fI.v2Aad)),k.setAuthTag(q(g.get("tag"),16));for(let a=0;a<j;a+=65536)await B(k.update(await n(r,a,Math.min(65536,j-a),z)));await B(k.final())}catch{throw Error("Worker snapshot decryption failed. Check the encrypted archive and its key.")}else for(let a=0;a<Number(t.size);a+=65536)await B(await n(v,a,Math.min(65536,Number(t.size)-a),z));let C=A.digest("hex");if((2===x?y.digest("hex"):C)!==g)throw Error("Worker snapshot SHA-256 mismatch.");if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();return await u.finish(),w=!0,u}catch(a){throw await j?.close().catch(()=>void 0),a}finally{s?.fill(0);let a=await Promise.allSettled([v.close(),...r?[r.close()]:[]]),b=await Promise.allSettled(m?[d.promises.rm(m,{recursive:!0,force:!0})]:[]);if(w&&[...a,...b].some(a=>"rejected"===a.status))throw await j?.close().catch(()=>void 0),Error("Snapshot temporary storage could not be released.")}}},676145:(a,b,c)=>{c.d(b,{AH:()=>i,O$:()=>u,P1:()=>e,XQ:()=>v,Yr:()=>r,cy:()=>x,jg:()=>y,nO:()=>s,q7:()=>k,vf:()=>t,zz:()=>w});var d=c(372628);function e(a){return"manual-launch"!==a.kind}let f={npm:"npx",pypi:"uvx",oci:"docker",nuget:"dnx"},g={npm:"npm",pypi:"PyPI",oci:"Docker",nuget:"NuGet",mcpb:"MCPB",cargo:"Cargo"};function h(a){return""!==a&&/^[A-Za-z0-9_@%+=:,./-]+$/.test(a)?a:`"${a.replace(/(["$`\\])/g,"\\$1")}"`}function i(a){var b;let c=[],d=[];for(let e of a.packages??[]){let a=function(a){if(!a.identifier)return{supported:!1,reason:"no-identifier"};if(!f[a.registryType]&&!a.runtimeHint)return{supported:!1,reason:"unknown-runner"};let b=a.transport?.type;return b&&"stdio"!==b?"streamable-http"===b||"sse"===b?{supported:!1,reason:"launch-and-connect"}:{supported:!1,reason:"unknown-transport"}:{supported:!0}}(e);a.supported?c.push({kind:"package",label:`${g[b=e.registryType]||b}: ${e.identifier}`,pkg:e}):"launch-and-connect"===a.reason&&d.push(function(a){var b;let{command:c,args:d}=q(a,{envFlags:"inline"}),e=a.transport?.type==="sse"?"sse":"streamable",f=a.transport?.url,i={kind:"manual-launch",label:`${g[b=a.registryType]||b}: ${a.identifier} (manual start)`,pkg:a,transport:e,runLine:[c,...d].map(h).join(" ")};if(!f)return{...i,urlError:"missing-url",urlErrorDetail:"no transport.url declared"};let j=function(a,b){let c,d=[],e=a.replace(/\{([^{}]+)\}/g,(a,c)=>{let e=b.args[c]??b.env[c];return void 0===e||""===e?(d.push(c),""):e});if(d.length>0)return{error:"unresolved-placeholder",detail:d.join(", ")};try{c=new URL(e)}catch{return{error:"invalid-url",detail:e}}return/^https?:$/.test(c.protocol)?!function(a){let b=a.toLowerCase().replace(/^\[/,"").replace(/\]$/,"");if("localhost"===b||"::1"===b||"0:0:0:0:0:0:0:1"===b)return!0;let c=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(b);if(!c)return!1;let d=c.slice(1,5).map(Number);return!d.some(a=>a>255)&&127===d[0]}(c.hostname)?{error:"non-loopback",detail:c.hostname}:{url:c.toString()}:{error:"invalid-url",detail:e}}(f,{env:function(a){let b={};for(let c of a??[]){if(!c.name)continue;let a=c.value??c.default;void 0!==a&&""!==a&&(b[c.name]=a)}return b}(a.environmentVariables),args:{...n(a.runtimeArguments),...n(a.packageArguments)}});return"url"in j?{...i,resolvedUrl:j.url}:{...i,urlError:j.error,urlErrorDetail:j.detail}}(e))}for(let b of a.remotes??[])b.url&&("streamable-http"===b.type||"sse"===b.type)&&c.push({kind:"remote",label:`Remote (${"sse"===b.type?"SSE":"Streamable HTTP"}): ${b.url}`,remote:b});return[...c,...d]}let j=new Set(["mcp","server","mcp-server","mcpserver"]);function k(a){return(function(a){let b=a.indexOf("/"),c=b>=0?a.slice(0,b):"",d=b>=0?a.slice(b+1):a;if(!j.has(d.toLowerCase())||!c)return d;let e=c.split(".").reverse().find(a=>a&&!j.has(a.toLowerCase()))||"";return e?`${e}-${d}`:d})(a).replace(/[^a-zA-Z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")||"mcp-server"}function l(a){let b=a.value??a.default;return"named"===a.type?a.name?void 0!==b&&""!==b?[a.name,b]:a.isRequired&&a.valueHint?[a.name,`<${a.valueHint}>`]:a.isRequired?[a.name]:[]:[]:void 0!==b&&""!==b?[b]:a.isRequired?[`<${a.valueHint||"value"}>`]:[]}function m(a){return(a??[]).flatMap(l)}function n(a){let b={};for(let c of a??[]){if("named"!==c.type||!c.name)continue;let a=c.value??c.default;void 0!==a&&""!==a&&(b[c.name]=a)}return b}function o(a){let b=(a.icons??[]).flatMap(a=>{if(!a?.src)return[];try{if(!/^https?:$/.test(new URL(a.src).protocol))return[]}catch{return[]}return[{src:a.src,...a.sizes?{sizes:a.sizes}:{},...a.mimeType?{mimeType:a.mimeType}:{},..."light"===a.theme||"dark"===a.theme?{theme:a.theme}:{}}]});return{name:k(a.name),disabled:!1,env:{},_buildCommand:"",_installCommand:"",...b.length>0?{icons:b}:{}}}function p(a){return a.version?`${a.identifier}@${a.version}`:a.identifier}function q(a,b={}){let c,d=a.runtimeHint||f[a.registryType],e=m(a.packageArguments),g=m(a.runtimeArguments),h=function(a){let b={};for(let c of a??[]){if(!c.name)continue;let a=c.value??c.default??"";b[c.name]=c.isSecret?{value:a,metadata:{isSecret:!0}}:a}return b}(a.environmentVariables);switch(a.registryType){case"npm":c=[...g,"-y",p(a),...e];break;case"pypi":c=[...g,a.version?`${a.identifier}==${a.version}`:a.identifier,...e];break;case"oci":{let d,f="inline"===b.envFlags?function(a){let b=[];for(let c of a??[]){if(!c.name)continue;let a=c.value??c.default,d=!c.isSecret&&void 0!==a&&""!==a;b.push("-e",`${c.name}=${d?a:`<${c.name}>`}`)}return b}(a.environmentVariables):Object.keys(h).flatMap(a=>["-e",a]);c=[..."run"===g[0]?[]:["run","-i","--rm"],...g,...f,!((d=a.identifier.split("/").pop()||a.identifier).includes(":")||d.includes("@"))&&a.version?`${a.identifier}:${a.version}`:a.identifier,...e];break}case"nuget":c=[...g,p(a),"--yes",...e];break;default:c=[...g,p(a),...e]}return{command:d,args:c,env:h}}function r(a,b){let c="package"===b.kind?function(a,b){let{command:c,args:d,env:e}=q(b),f=o(a);return{...f,transport:"stdio",command:c,args:d,env:e,rootPath:`mcp-servers/${f.name}`}}(a,b.pkg):"manual-launch"===b.kind?function(a,b){let{command:c,args:d,env:e}=q(b.pkg),f=o(a),g={command:c,...d.length>0?{args:d}:{},...Object.keys(e).length>0?{env:e}:{}};return{...f,transport:b.transport,serverUrl:b.resolvedUrl??"",headers:{},env:e,launch:g,rootPath:`mcp-servers/${f.name}`}}(a,b):function(a,b){let c={};for(let a of b.headers??[])a.name&&(c[a.name]=a.value??a.default??"");let d=o(a);return{...d,transport:"sse"===b.type?"sse":"streamable",serverUrl:b.url,headers:c,rootPath:`mcp-servers/${d.name}`}}(a,b.remote),d="remote"===b.kind?a.version:b.pkg.version??a.version,e={type:"registry",registryName:a.name,...d?{version:d}:{}};return{...c,source:e}}function s(a){return"active"===a}function t(a){let b=a?._meta?.["io.modelcontextprotocol.registry/official"]?.status;return"string"==typeof b&&b.length>0?b:"unverified"}function u(a,b,c,d){let e=r(b,c),f=e.transport??"stdio";return{registryName:a,resolvedName:b.name,serverName:e.name??k(b.name),transport:f,...e.command?{command:e.command}:{},...Array.isArray(e.args)?{args:e.args}:{},...e.serverUrl?{serverUrl:e.serverUrl}:{},requiredEnvNames:"remote"===c.kind?(c.remote.headers??[]).filter(a=>a.isRequired&&a.name).map(a=>a.name):(c.pkg.environmentVariables??[]).filter(a=>a.isRequired&&a.name).map(a=>a.name),verificationStatus:d}}function v(a){let b;try{b=new URL(a)}catch{return null}let c=b.searchParams.get("q");if(c)return`/v0.1/servers?search=${encodeURIComponent(c)}&version=latest&limit=1`;if(/^\/v[\d.]+\/servers\/[^/]+\/versions\/[^/]+$/.test(b.pathname))return b.pathname;let d=b.pathname.match(/^\/v[\d.]+\/servers\/([^/]+)(?:\/versions)?\/?$/);if(d){let a=decodeURIComponent(d[1]);return`/v0.1/servers?search=${encodeURIComponent(a)}&version=latest&limit=1`}return null}function w(a){return a?.servers&&a.servers.length>0?a.servers[0]:a?.server?.name?a:null}function x(a,b){if(!b||0===Object.keys(b).length)return a;let c=(0,d.P0)(a.env,b);return{...a,env:c}}function y(a,b){let c=(0,d.bq)(b);return"remote"===a.kind?(a.remote.headers??[]).filter(a=>a.isRequired&&!(a.value??a.default)&&!c[a.name]).map(a=>a.name):(a.pkg.environmentVariables??[]).filter(a=>a.isRequired&&!(a.value??a.default)&&!c[a.name]).map(a=>a.name)}},683843:(a,b,c)=>{c.d(b,{d1:()=>h,nt:()=>g});var d=c(739006),e=c(186359),f=c(620775);let g=2;function h(){let a=process.env.FLUJO_BUILD_REVISION;return{applicationVersion:d.rE,snapshotEncryption:{...e.fI,readVersions:[...e.fI.readVersions]},snapshotLimits:(0,e.B5)(),snapshotFormatVersion:g,layoutVersion:f.q,workerProtocolVersion:1,workerSnapshotSourceVersion:1,.../^[a-f0-9]{40}$/.test(a??"")?{revision:a}:{}}}},715628:(a,b,c)=>{c.d(b,{d:()=>e,o:()=>d});let d=["https://registry.modelcontextprotocol.io/?q=ai.keenable%2Fweb-search",{url:"https://registry.modelcontextprotocol.io/v0.1/servers/ai.parallel%2Fsearch-mcp/versions",remoteUrlOverrides:{"https://search-mcp.parallel.ai/mcp":"https://search.parallel.ai/mcp"}},"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-abap-adt/versions","https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-audio-studio/versions","https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-vscode/versions","https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-cad-studio/versions",{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.microsoft%2Fplaywright-mcp/versions",env:{PLAYWRIGHT_MCP_BROWSER:"msedge"}},{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dosev-ai%2Fmcp-office-word/versions/",env:{WORD_ALLOWLIST_ROOTS:".",WORD_ENABLE_WRITE:"true"}},{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dosev-ai%2Fmcp-office-excel/versions/",env:{EXCEL_ALLOWLIST_ROOTS:".",EXCEL_ENABLE_WRITE:"true"}},{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dosev-ai%2Fmcp-office-powerpoint/versions/",env:{PPT_ALLOWLIST_ROOTS:".",PPT_ENABLE_WRITE:"true"}}];function e(a){return"string"==typeof a?{url:a}:a}},739006:a=>{a.exports={rE:"3.48.6"}},794856:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{$J:()=>k,Mh:()=>n,Ng:()=>m,k6:()=>l});var e=c(838583),f=c(952294),g=c(580940),h=c(905738),i=c(907986),j=a([e]);function k(a){if((0,g.ye)()&&"1"===process.env.FLUJO_WORKER_SNAPSHOT_SOURCE){let b=(0,f.i)(a);if(b)return b;if(process.env.FLUJO_EXPOSURE_MODE?.trim().toLowerCase()!=="network")return m({error:"Worker snapshot sources require network exposure."},403);let c=(0,h.$)(a);if(c)return c;let d=(0,g.dT)();return"ready"===d.state&&d.workspace?d.workspace!==(0,i.getCurrentWorkspace)()?m({error:"This workspace is not assigned to the worker."},404):null:m({error:"Worker is not ready.",code:"WORKER_NOT_READY"},503)}let b=(0,h.$)(a,{strictLoopback:!0});return b||(0,f.i)(a)}function l(a){try{return new URL(a.url).searchParams.get("sessionId")}catch{return null}}function m(a,b=200){return Response.json(a,{status:b,headers:{"Cache-Control":"no-store"}})}function n(a){return a instanceof e.b?m({error:a.message,code:a.code},a.status):m({error:"Snapshot operation failed.",code:"SNAPSHOT_FAILED"},500)}e=(j.then?(await j)():j)[0],d()}catch(a){d(a)}})},816079:(a,b,c)=>{c.d(b,{DB:()=>q,HM:()=>y,I5:()=>v,TX:()=>x,hD:()=>u});var d=c(973024),e=c(176760),f=c.n(e),g=c(774755),h=c(100629),i=c(134887),j=c(907986),k=c(845223),l=c(930100),m=c(851018),n=c(989481),o=c(472178),p=c(879628);let q=[g.Zg.MODELS,g.Zg.MCP_SERVERS,g.Zg.GLOBAL_ENV_VARS,g.Zg.REGISTRY_ACCOUNT],r="flujo:secret:v2",s=new Set(["apikey","password","passphrase","secret","token","privatekey","cookie","clientsecret","oauthclientsecret","accesstoken","refreshtoken","idtoken","oauthcodeverifier","authorization"]),t=new Map([["oauthtokens","tokens"],["oauthclientinformation","client"],["oauthcodeverifier","verifier"]]);function u(a,b){if(!b||"object"!=typeof b||a===g.Zg.MODELS&&!Array.isArray(b)||![g.Zg.MODELS,g.Zg.MCP_SERVERS].includes(a)&&Array.isArray(b)||(a===g.Zg.MODELS||a===g.Zg.MCP_SERVERS)&&(Array.isArray(b)?b:Object.values(b)).some(a=>!a||"object"!=typeof a||Array.isArray(a)))throw new n.Zz;if(a===g.Zg.MCP_SERVERS&&Array.isArray(b)){let a=b.map(a=>a.name);if(a.some(a=>"string"!=typeof a||!a.trim())||new Set(a).size!==a.length)throw new n.Zz;return Object.fromEntries(b.map(a=>[a.name,a]))}return b}async function v(a,b,c=!1,d=0,e=!1,f){if(d>100)throw new n.Zz;if("string"==typeof a)return b(a,c);if(Array.isArray(a))return Promise.all(a.map(a=>v(a,b,c,d+1,e,f)));if(!a||"object"!=typeof a)return a;if(1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length)return b(a.plaintext,!0);let g=c||!!(a.metadata&&"object"==typeof a.metadata&&a.metadata.isSecret),h={};for(let[c,i]of Object.entries(a)){let a=c.replace(/[_-]/g,"").toLowerCase(),j="env"===a||"headers"===a,k=t.get(a),l=f&&1===d&&k?await f(k,i):j&&i&&"object"==typeof i&&!Array.isArray(i)?Object.fromEntries(await Promise.all(Object.entries(i).map(async([a,c])=>{let g=await v(c,b,!0,d+1,e,f);return[a,e?"string"==typeof g?{value:g,metadata:{isSecret:!0}}:{...g,metadata:{isSecret:!0}}:g]}))):await v(i,b,s.has(a)||"value"===c&&g,d+1,e,f);Object.defineProperty(h,c,{value:l,enumerable:!0})}return h}async function w(a,b){if(a.startsWith("encrypted_failed:"))return{$flujoCredential:1,plaintext:a.slice(17)};let c=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;if(void 0===c)return b&&a?{$flujoCredential:1,plaintext:a}:a;let d=await (0,l.Do)(c);if(null===d)throw new n.Zz;return{$flujoCredential:1,plaintext:d}}async function x(a){return(0,p.Ns)(async()=>{let b={};for(let a of q){let c,d=f().join((0,j.getWorkspaceDataDir)(),"db",`${a}.json`);try{c=await (0,h.b)(d,{maxBytes:7340032,verifyPath:()=>(0,o.V$)((0,i.ok)(),d)})}catch(a){if("ENOENT"===a.code)continue;throw new n.Zz}try{let d=u(a,JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c))),e=async(a,b)=>(0,k.rr)(a,await (0,k.eC)(a,b,(0,j.getCurrentWorkspace)(),async a=>{let b=await (0,l.Do)(a);if(null===b)throw new n.Zz;return b}),(0,j.getCurrentWorkspace)());b[a]=await v(d,w,!1,0,!1,a===g.Zg.MCP_SERVERS?e:void 0)}finally{c.fill(0)}}let c=Date.now(),d=Buffer.from(JSON.stringify({version:1,createdAt:c,expiresAt:c+864e5,records:b}));try{return await (0,n.of)(d,a)}finally{d.fill(0)}})}async function y(a,b,c,e,l={}){let p,s=(0,j.assertValidWorkspaceName)(c);if("string"!=typeof e||e.length<12||Buffer.byteLength(e)>1024||e===m.Gr||e===b)throw new n.Zz;let t=await (0,n.XM)(a,b);try{p=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t))}finally{t.fill(0)}let w=Date.now();if(!p||1!==p.version||!Number.isSafeInteger(p.createdAt)||!Number.isSafeInteger(p.expiresAt)||p.createdAt>w+6e4||p.expiresAt<=w||p.expiresAt-p.createdAt!=864e5||!p.records||"object"!=typeof p.records||Array.isArray(p.records)||Object.keys(p.records).some(a=>!q.includes(a)))throw new n.Zz;let x=(0,m.OD)(),z=await (0,m.Mk)(x,"user",e,"passphrase"),A=new Map;for(let[a,b]of Object.entries(p.records)){let c=u(a,b),d=async(a,b)=>{if(!b||!a||/^\$\{global:[^}]+\}$/.test(a))return a;let c=(0,m.od)(a,x.activeKey,r);if((0,m.ho)(c,x.activeKey,r)!==a)throw new n.Zz;return`encrypted:${c}`},e=a===g.Zg.GLOBAL_ENV_VARS&&c&&"object"==typeof c&&!Array.isArray(c)?Object.fromEntries(await Promise.all(Object.entries(c).map(async([a,b])=>{let c=await v(b,d,!0,0,!0);if("string"==typeof c)return[a,{value:c,metadata:{isSecret:!0}}];if(!c||"object"!=typeof c||"string"!=typeof c.value)throw new n.Zz;return[a,{...c,metadata:{isSecret:!0}}]}))):await v(c,d,!1,0,!0,a===g.Zg.MCP_SERVERS?async(a,b)=>{let c=await (0,k.ZA)(a,b,s),d=(0,k.bM)(a,c,s),e=(0,m.od)(d,x.activeKey,r);if((0,m.ho)(e,x.activeKey,r)!==d)throw new n.Zz;return{format:k.ok,ciphertext:e}}:void 0);if(a===g.Zg.MCP_SERVERS&&e&&"object"==typeof e)for(let a of Object.values(e)){if(!a||"object"!=typeof a||Array.isArray(a))throw new n.Zz;a.disabled=!0}A.set(`${a}.json`,Buffer.from(JSON.stringify(e)))}if(A.set(`${g.Zg.ENCRYPTION_KEY}.json`,Buffer.from(JSON.stringify(z))),[...A.values()].reduce((a,b)=>a+b.length,0)>2*n.Ns)throw new n.Zz;l.signal?.throwIfAborted();let B=(0,j.getWorkspacesDir)();await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let C=await d.promises.lstat(B,{bigint:!0}),D=await d.promises.mkdtemp(f().join(B,".credential-transfer-")),E=await d.promises.lstat(D,{bigint:!0}),F=!1;try{for(let a of(await d.promises.chmod(D,448),j.WORKSPACE_SUBTREES))await d.promises.mkdir(f().join(D,a),{mode:448});for(let[a,b]of(await (0,o.sA)(D,f().join(D,".workspace.json"),Buffer.from('{"roots":[]}'),{mode:384}),A)){l.signal?.throwIfAborted(),await (0,o.sA)(D,f().join(D,"db",a),b,{mode:384});let c=await (0,h.b)(f().join(D,"db",a),{maxBytes:2*n.Ns,ownerOnly:!0});try{if(!c.equals(b))throw new n.Zz}finally{c.fill(0)}await l.checkpoint?.("file_written")}return await (0,j.withWorkspaceNamespaceMutation)(async()=>{l.signal?.throwIfAborted(),await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let a=await d.promises.lstat(B,{bigint:!0}),b=await d.promises.lstat(D,{bigint:!0});if(a.dev!==C.dev||a.ino!==C.ino||b.dev!==E.dev||b.ino!==E.ino||b.isSymbolicLink()||(await l.checkpoint?.("before_publish"),(await d.promises.readdir(B)).some(a=>a.toLowerCase()===s.toLowerCase())))throw new n.Zz;if(l.signal?.throwIfAborted(),await d.promises.rename(D,(0,j.getWorkspaceDir)(s)),F=!0,"win32"!==process.platform){let a=await d.promises.open(B,d.constants.O_RDONLY|d.constants.O_DIRECTORY|d.constants.O_NOFOLLOW|d.constants.O_NONBLOCK);try{let b=await a.stat({bigint:!0});if(!b.isDirectory()||b.dev!==C.dev||b.ino!==C.ino||b.mode!==C.mode||b.uid!==C.uid||b.gid!==C.gid)throw new n.Zz;await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let c=await d.promises.lstat(B,{bigint:!0});if(c.isSymbolicLink()||c.dev!==b.dev||c.ino!==b.ino)throw new n.Zz;await a.sync()}finally{await a.close()}}return s})}finally{for(let a of A.values())a.fill(0);if(!F){let a=await d.promises.lstat(D,{bigint:!0}).catch(()=>void 0);a&&a.isDirectory()&&!a.isSymbolicLink()&&a.dev===E.dev&&a.ino===E.ino&&f().dirname(D)===B&&f().basename(D).startsWith(".credential-transfer-")&&await d.promises.rm(D,{recursive:!0,force:!0})}}}},817492:(a,b,c)=>{c.d(b,{Hm:()=>f,xc:()=>e});let d=["key","secret","token","password"],e=a=>d.some(b=>a.toLowerCase().includes(b)),f=a=>e(a)||"authorization"===a.trim().toLowerCase()},838583:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{b:()=>x,f:()=>z});var e=c(973024),f=c(977598),g=c(907986),h=c(204983),i=c(879628),j=c(620775),k=c(683843),l=c(587301),m=a([h]);h=(m.then?(await m)():m)[0];let w=/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;class x extends Error{constructor(a,b,c){super(c),this.code=a,this.status=b,this.name="SnapshotCoordinatorError"}}let y=globalThis.__flujoWorkspaceSnapshotSessions??(globalThis.__flujoWorkspaceSnapshotSessions=new Map);function n(a){return{sessionId:a.sessionId,workspace:a.workspace,generation:a.generation,state:a.state,createdAt:new Date(a.createdAtMs).toISOString(),expiresAt:new Date(a.expiresAtMs).toISOString(),bytesStaged:a.bytesStaged,filesStaged:a.filesStaged,archiveBytes:a.archiveBytes,sha256:a.sha256,plaintextSha256:a.plaintextSha256,encrypted:a.encrypted,encryptionVersion:a.encryptionVersion,recipientKeyUsed:a.recipientKeyUsed,errorCode:a.errorCode,error:a.error}}function o(a){return"finalized"===a||"aborted"===a||"failed"===a}async function p(a){let b=a.stagingDir;a.archivePath=void 0,a.stagingDir=void 0,b&&await e.promises.rm(b,{recursive:!0,force:!0}).catch(()=>void 0)}function q(a){a.expiryTimer&&(clearTimeout(a.expiryTimer),a.expiryTimer=void 0)}async function r(a){o(a.state)||(q(a),a.abortRequested=!0,a.state="aborted",a.errorCode="SNAPSHOT_EXPIRED",a.controller.abort(Error("Snapshot session expired.")),await p(a))}async function s(a){Date.now()<=a.expiresAtMs||o(a.state)||await r(a)}async function t(a){let b=y.get(a);return b&&await s(b),b}function u(a,b){if(!w.test(b))throw new x("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");let c=y.get(a);if(!c||c.sessionId!==b)throw new x("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");return c}async function v(a){let b,c,{signal:d}=a.controller,e=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_CAPTURE_TIMEOUT_MS??"",10))||c<=0?3e4:Math.min(c,6e4),f=setTimeout(()=>{d.aborted||(a.abortRequested=!0,a.state="failed",a.errorCode="SNAPSHOT_TIMEOUT",q(a),a.controller.abort(Error("Workspace snapshot exceeded its capture time limit.")))},e);f.unref?.();try{b=await (0,i.Ns)(async c=>(a.generation=c,d.throwIfAborted(),a.state="staging",b=await (0,h.QO)(a.workspace,c,{signal:d,flowIds:a.flowIds,recipientKey:a.recipientKey})),{workspace:a.workspace,timeoutMs:e,signal:d}),d.throwIfAborted(),a.bytesStaged=b.bytes,a.filesStaged=b.files,clearTimeout(f);let c=await (0,h.TH)(b,{signal:d});if(a.archivePath=c.archivePath,a.stagingDir=c.stagingDir,a.archiveBytes=c.size,a.sha256=c.sha256,a.plaintextSha256=c.plaintextSha256,a.encrypted=c.encrypted,a.encryptionVersion=c.encryptionVersion??+!!c.encrypted,a.recipientKeyUsed=c.recipientKeyUsed??!1,a.recipientKey=void 0,await b.dispose?.(),b=void 0,a.abortRequested){"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"),await p(a);return}a.state="ready"}catch(b){a.abortRequested?"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"):(a.state="failed",q(a),a.errorCode=b instanceof h.XV?b.code:b instanceof Error&&"WorkspaceSnapshotBusyError"===b.name?"SNAPSHOT_BUSY":b instanceof Error&&"WorkspaceSnapshotTimeoutError"===b.name?"SNAPSHOT_TIMEOUT":"SNAPSHOT_FAILED",a.error=b instanceof h.XV?b.message:void 0),await p(a)}finally{a.recipientKey=void 0,clearTimeout(f),await b?.dispose?.().catch(()=>void 0)}}let z={async info(a=(0,g.getCurrentWorkspace)()){let b=(0,g.normalizeWorkspaceName)(a),c=await t(b),d=(0,i.B7)(b),e=c&&!o(c.state)?n(c):null;return{workspace:b,layoutVersion:j.q,workerCompatibility:(0,k.d1)(),capability:e||d.blocked?"busy":"available",coherence:"registered-flujo-writers",externalRootsIncluded:!1,activeOperation:e}},async begin(a=(0,g.getCurrentWorkspace)(),b={}){let c;void 0!==b.recipientKey&&(0,h.Eq)(b.recipientKey)?.fill(0);let d=(0,g.normalizeWorkspaceName)(a),e=y.get(d);if(e&&!o(e.state)&&Date.now()<=e.expiresAtMs)throw new x("SNAPSHOT_BUSY",409,"A snapshot is already active for this workspace.");e&&(o(e.state)?(q(e),p(e)):r(e));let j=Date.now(),k=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_SESSION_TTL_MS??"",10))||c<=0?9e5:Math.min(c,36e5),l={sessionId:(0,f.randomUUID)(),workspace:d,generation:(0,i.B7)(d).generation,state:"beginning",createdAtMs:j,expiresAtMs:j+k,bytesStaged:0,filesStaged:0,abortRequested:!1,controller:new AbortController,flowIds:b.flowIds?[...b.flowIds]:void 0,recipientKey:b.recipientKey,encryptionVersion:2*(void 0!==b.recipientKey||void 0!==process.env.FLUJO_WORKER_SNAPSHOT_KEY)};y.set(d,l);let m=setTimeout(()=>{(0,g.runWithWorkspace)(d,async()=>{await r(l)})},k);return m.unref?.(),l.expiryTimer=m,(0,g.runWithWorkspace)(d,()=>v(l)),n(l)},async status(a,b=(0,g.getCurrentWorkspace)()){let c=u((0,g.normalizeWorkspaceName)(b),a);return await s(c),n(c)},async readDownload(a,b=(0,g.getCurrentWorkspace)()){let c,d=u((0,g.normalizeWorkspaceName)(b),a);if(await s(d),"SNAPSHOT_EXPIRED"===d.errorCode)throw new x("SNAPSHOT_EXPIRED",410,"Snapshot session has expired.");if("ready"!==d.state||!d.archivePath||!d.sha256||void 0===d.archiveBytes)throw new x("SNAPSHOT_NOT_READY",409,"Snapshot archive is not ready.");try{c=await (0,l.t)(d.archivePath,d.archiveBytes,d.sha256,d.controller.signal,()=>{if("ready"!==d.state||Date.now()>d.expiresAtMs)throw Error("Snapshot session is no longer available.")})}catch{throw d.state="failed",d.errorCode="SNAPSHOT_INTEGRITY",await p(d),new x("SNAPSHOT_INTEGRITY",500,"Snapshot archive failed its integrity check.")}return{content:c,sha256:d.sha256,plaintextSha256:d.plaintextSha256??d.sha256,encrypted:d.encrypted??!1,encryptionVersion:d.encryptionVersion??0,recipientKeyUsed:d.recipientKeyUsed??!1,size:d.archiveBytes}},async finalize(a,b=(0,g.getCurrentWorkspace)()){let c=u((0,g.normalizeWorkspaceName)(b),a);if(await s(c),"finalized"===c.state)return n(c);if("ready"!==c.state)throw new x("SNAPSHOT_NOT_READY",409,"Only a ready snapshot can be finalized.");return q(c),await p(c),c.state="finalized",n(c)},async abort(a,b=(0,g.getCurrentWorkspace)()){let c=u((0,g.normalizeWorkspaceName)(b),a);if("aborted"===c.state)return n(c);if("finalized"===c.state)throw new x("SNAPSHOT_NOT_READY",409,"A finalized snapshot cannot be aborted.");return q(c),c.abortRequested=!0,c.state="aborted",c.controller.abort(Error("Snapshot session was aborted.")),await p(c),n(c)}};d()}catch(a){d(a)}})},845223:(a,b,c)=>{c.d(b,{ZA:()=>l,bM:()=>g,eC:()=>j,ok:()=>e,rr:()=>k});var d=c(88169);let e="flujo-oauth-v1",f=a=>!!a&&"object"==typeof a&&!Array.isArray(a),g=d.rt;function h(a){return f(a)&&(a.format===e||Object.hasOwn(a,"format")&&Object.hasOwn(a,"ciphertext")&&2===Object.keys(a).length)}async function i(a,b,c,d=0){if(d>100)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");if("string"==typeof a){if(c)return a;if(a.startsWith("encrypted_failed:"))return a.slice(17);let d=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;return void 0===d?a:b(d)}return Array.isArray(a)?Promise.all(a.map(a=>i(a,b,c,d+1))):f(a)?c&&1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length?a.plaintext:Object.fromEntries(await Promise.all(Object.entries(a).map(async([a,e])=>[a,await i(e,b,c,d+1)]))):a}async function j(a,b,c,j){if(h(b)){let g;if(!f(b)||2!==Object.keys(b).length||b.format!==e||"string"!=typeof b.ciphertext||!b.ciphertext.startsWith("v2:")||Buffer.byteLength(b.ciphertext)>524288)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g=await j(b.ciphertext),(0,d.s6)(a,g,c)}let k=await i(b,j,!1);return g(a,k,c),k}function k(a,b,c){return g(a,b,c),{$flujoOAuth:1,kind:a,value:b}}async function l(a,b,c){if(f(b)&&1===b.$flujoOAuth){if(3!==Object.keys(b).length||b.kind!==a||!Object.hasOwn(b,"value"))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g(a,b.value,c),b.value}if(h(b))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");let d=await i(b,async()=>{throw Error("OAuth credentials are malformed or belong to another workspace or purpose.")},!0);return g(a,d,c),d}},882980:(a,b,c)=>{c.d(b,{H6:()=>h,Mt:()=>e,SL:()=>g,UQ:()=>f,ZW:()=>d});let d="MCP_TRANSPORT_INVALID";function e(a){return"stdio"===a||"streamable"===a||"sse"===a||"websocket"===a}class f extends Error{constructor(){super(d),this.name="McpTransportError"}}function g(a){if(!e(a.transport))throw new f}function h(a){if(void 0===a)return"stdio";if(!e(a))throw new f;return a}},989481:(a,b,c)=>{c.d(b,{Ns:()=>i,XM:()=>m,Zz:()=>j,of:()=>l});var d=c(977598),e=c(257975),f=c(851018);let g=(0,e.promisify)(d.pbkdf2),h=Buffer.from("FLUJOT01"),i=0x2000000;class j extends Error{constructor(){super("Invalid transfer or recipient passphrase."),this.name="RecipientTransferError"}}function k(a){if("string"!=typeof a||a===f.Gr||a.length<16||Buffer.byteLength(a,"utf8")>1024)throw new j}async function l(a,b){if(k(b),!a.byteLength||a.byteLength>i)throw new j;let c=Buffer.alloc(40);h.copy(c),(0,d.randomBytes)(16).copy(c,8),(0,d.randomBytes)(12).copy(c,24),c.writeUInt32BE(a.byteLength,36);let e=await g(b,c.subarray(8,24),f.fn,32,"sha256");try{let b=(0,d.createCipheriv)("aes-256-gcm",e,c.subarray(24,36));return b.setAAD(c),Buffer.concat([c,b.update(a),b.final(),b.getAuthTag()])}finally{e.fill(0)}}async function m(a,b){let c;if(k(b),a.byteLength<57||a.byteLength>56+i)throw new j;let e=Buffer.from(a),l=e.subarray(0,40);if(!l.subarray(0,8).equals(h)||l.readUInt32BE(36)!==e.length-40-16)throw new j;let m=await g(b,l.subarray(8,24),f.fn,32,"sha256");try{let a=(0,d.createDecipheriv)("aes-256-gcm",m,l.subarray(24,36));a.setAAD(l),a.setAuthTag(e.subarray(-16)),c=a.update(e.subarray(40,-16));let b=a.final();return Buffer.concat([c,b])}catch{throw new j}finally{c?.fill(0),m.fill(0),e.fill(0)}}}};
+"use strict";exports.id=73633,exports.ids=[972,16079,17492,33829,55437,56210,57863,68115,73633,74188,77818,78591,80244,90496],exports.modules={186359:(a,b,c)=>{c.d(b,{fI:()=>e,B5:()=>g});let d=JSON.parse('{"e":{"format":"flujo-workspace-encrypted","cipher":"aes-256-gcm","writeVersion":2,"readVersions":[1,2],"legacyPlaintextRead":true,"recipientKeyRequired":true,"recipientKeyBytes":32,"recipientKeyEncoding":"base64","v2Aad":"flujo:workspace-snapshot:v2","v2Digest":"sha256-encrypted-wire","v1Digest":"sha256-plaintext-zip"},"R":{"maxFileBytes":268435456,"maxUncompressedBytes":1073741824,"maxManifestBytes":8388608,"maxArchiveBytes":1082130432,"maxEncryptedBytes":1442844672,"maxMembers":65534}}'),e=d.e,f=d.R;function g(){let a=(a,b)=>{let c=process.env[a];if(void 0===c)return b;let d=Number(c);if(!/^[1-9]\d*$/.test(c)||!Number.isSafeInteger(d))throw Error("Snapshot limits are invalid.");return d},b=a("FLUJO_SNAPSHOT_MAX_FILE_BYTES",f.maxFileBytes),c=a("FLUJO_SNAPSHOT_MAX_BYTES",f.maxUncompressedBytes),d=c+f.maxManifestBytes,e=4*Math.ceil(d/3)+4096;if(!Number.isSafeInteger(d)||!Number.isSafeInteger(e))throw Error("Snapshot limits are invalid.");return{...f,maxFileBytes:b,maxUncompressedBytes:c,maxArchiveBytes:d,maxEncryptedBytes:e}}},204983:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Eq:()=>D,QO:()=>H,TH:()=>J,XV:()=>L});var e=c(973024),f=c(100629),g=c(977598),h=c(157075),i=c(186359),j=c(621385),k=c(587301),l=c(848161),m=c(176760),n=c.n(m),o=c(76364),p=c.n(o),q=c(907986),r=c(620775),s=c(683843),t=c(472178),u=c(965385),v=c(826045),w=c(930100),x=c(719031),y=c(816079),z=c(774755),A=c(158601),B=c(739006),C=a([u]);u=(C.then?(await C)():C)[0];let K=".workspace.json";class L extends Error{constructor(a,b){super(b),this.code=a,this.name="SnapshotArchiveError"}}let M=new WeakMap,N=new WeakMap;function D(a){if(void 0!==a&&"string"!=typeof a)throw new L("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let b=a??process.env.FLUJO_WORKER_SNAPSHOT_KEY;if(void 0===b)return null;if("string"!=typeof b||44!==b.length)throw new L("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");let c=Buffer.from(b,"base64");if(32!==c.length||c.toString("base64")!==b)throw c.fill(0),new L("CREDENTIALS_UNAVAILABLE","Configure a canonical base64 32-byte worker snapshot encryption key.");return c}async function E(a){let b=!1,c=async(a,c)=>(a&&!/^\$\{global:[^}]+\}$/.test(a)&&(c||/^(?:encrypted:|encrypted_failed:|v2:)/.test(a))&&(b=!0),a);try{for(let d of y.DB){let e=a.file(`db/${d}.json`);if(!e)continue;let f=JSON.parse(await e.async("string"));if(d===z.Zg.GLOBAL_ENV_VARS&&f&&"object"==typeof f)for(let a of Object.values(f))await (0,y.I5)(a,c,!0);else await (0,y.I5)(f,c,!1,0,!1,d===z.Zg.MCP_SERVERS?async(a,c)=>(c&&("object"!=typeof c||Object.keys(c).length)&&(b=!0),c):void 0)}return b}catch{throw new L("CREDENTIALS_UNAVAILABLE","Credential inventory cannot be verified for plaintext export.")}}function F(a,b,c=!1){let d=n().relative(n().resolve(a),n().resolve(b));return""===d?c:!d.startsWith("..")&&!n().isAbsolute(d)}async function G(a,b,c,d,g,h){let i;g?.throwIfAborted();let j=n().join(b,K);try{i=await e.promises.lstat(j,{bigint:!0})}catch(a){if("ENOENT"===a.code)return;throw a}if(!i.isFile()||i.isSymbolicLink()||i.nlink>BigInt(1))throw new L("UNSAFE_ENTRY","Workspace metadata is not a plain, singly-linked file.");if(i.size>BigInt(d))throw new L("SIZE_LIMIT","Workspace metadata exceeds the configured file limit.");let k=await e.promises.realpath(b);if(!F(k,await e.promises.realpath(j)))throw new L("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.");try{let l=await (0,f.b)(j,{expected:i,maxBytes:d,signal:g,consume:h?.consume,verifyPath:async()=>{if(await (0,t.V$)(b,j),!F(k,await e.promises.realpath(j)))throw new L("UNSAFE_ENTRY","Workspace metadata resolves outside the workspace.")}});h?h.complete(i):(c(K,l),a.file(K,l))}catch(a){if(a instanceof f.$)throw new L("SIZE_LIMIT"===a.code?"SIZE_LIMIT":"UNSAFE_ENTRY","Workspace metadata changed or is unsafe.");throw a}}async function H(a,b,c={}){let d,f,{signal:k}=c;if(k?.throwIfAborted(),await (0,v.Tm)(a))throw new L("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let l=D(c.recipientKey),m=(0,q.getWorkspaceDataDir)(a);try{d=await e.promises.lstat(m)}catch{throw l?.fill(0),new L("WORKSPACE_UNAVAILABLE","Workspace directory is unavailable.")}if(!d.isDirectory()||d.isSymbolicLink())throw l?.fill(0),new L("WORKSPACE_UNAVAILABLE","Workspace directory is not a real directory.");let o=(0,i.B5)(),y=o.maxFileBytes,z=o.maxUncompressedBytes,C=[],F=0,J=new(p());try{f=await j.N.create()}catch(a){throw l?.fill(0),a}let O=new Map;try{let d,i,j,v=(a,b,c)=>{if(k?.throwIfAborted(),b.byteLength>y)throw new L("SIZE_LIMIT","Snapshot member exceeds the configured file limit.");if(b.subarray(0,16).equals(Buffer.from("SQLite format 3\0")))throw new L("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);if((F+=b.byteLength)>z)throw new L("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");C.push({path:a,size:b.byteLength,sha256:(0,g.createHash)("sha256").update(b).digest("hex"),mode:c?384|Number(c.mode&BigInt(64)):384})},D=f.size,H=(0,g.createHash)("sha256"),P=Buffer.alloc(0);await G(J,m,v,y,k,{consume:async a=>{if(f.size+a.length>z)throw new L("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");P.length<16&&(P=Buffer.concat([P,a.subarray(0,16-P.length)])),H.update(a),await f.append(a)},complete:a=>{if(P.equals(Buffer.from("SQLite format 3\0")))throw new L("UNSAFE_ENTRY","Live SQLite state is not portable: .workspace.json. Export it with its owning tool first.");let b=Number(a.size);F+=b,C.push({path:K,size:b,sha256:H.digest("hex"),mode:384}),J.file(K,Buffer.alloc(0)),O.set(K,{position:D,size:b,file:J.file(K)})}});let Q=["mcp-servers","db/codex-runtime","db/antigravity-cli-runtime","userdata/mcp-runtime","browser-profile","bash-utils","db/worker-bootstrap-secrets.json","db/native-tool-journal","db/native-session-payloads","db/native-session-origins"],R=a=>Q.some(b=>a===b||a.startsWith(`${b}/`))||/^db\/codex-private-[^/]*(?:\/|$)/i.test(a);for(let a of q.WORKSPACE_SUBTREES){let b;if(k?.throwIfAborted(),R(a)){J.folder(a);continue}let c=n().join(m,a);try{b=await e.promises.lstat(c)}catch(b){if("ENOENT"===b.code){J.folder(a);continue}throw b}if(!b.isDirectory()||b.isSymbolicLink())throw new L("UNSAFE_ENTRY",`Workspace subtree ${a} is not a real directory.`);J.folder(a),await (0,t.N)(J,c,a,m,(a,b)=>{throw new L(b.includes("size limit")?"SIZE_LIMIT":"UNSAFE_ENTRY",`Cannot safely snapshot ${a}: ${b}`)},{maxFileBytes:y,skippedDirectories:new Set(["node_modules",".venv","__pycache__"]),skipPath:R,signal:k,preserveMode:!0,allowHardLinks:!0,onFileStream:async(a,b,c)=>{let d=Number(c.size);if(F+d>z)throw new L("SIZE_LIMIT","Workspace snapshot exceeds the configured total size limit.");let e=f.size,h=(0,g.createHash)("sha256"),i=Buffer.alloc(0);for await(let a of b)k?.throwIfAborted(),i.length<16&&(i=Buffer.concat([i,a.subarray(0,16-i.length)])),h.update(a),await f.append(a);if(f.size-e!==d)throw new L("UNSAFE_ENTRY","Snapshot member changed while being captured.");if(i.equals(Buffer.from("SQLite format 3\0")))throw new L("UNSAFE_ENTRY",`Live SQLite state is not portable: ${a}. Export it with its owning tool first.`);F+=d,C.push({path:a,size:d,sha256:h.digest("hex"),mode:384|Number(c.mode&BigInt(64))}),J.file(a,Buffer.alloc(0),{unixPermissions:Number(c.mode&BigInt(33279))}),O.set(a,{position:e,size:d,file:J.file(a)})}})}await f.finish();let S=async a=>{let b=O.get(a);if(b&&J.file(a)===b.file){let a=[];for await(let c of f.range(b.position,b.size))a.push(c);return Buffer.concat(a)}return J.file(a).async("nodebuffer")};for(let[a,b]of O)b.file.async=(c,d)=>{let e=new(p());return e.file(a,h.Readable.from(f.range(b.position,b.size),{objectMode:!1,highWaterMark:65536})),e.file(a).async(c,d)};let T=async(a,b)=>{if(!J.file(a))return b;try{return JSON.parse((await S(a)).toString("utf8"))}catch{throw new L("UNSAFE_ENTRY",`Invalid workspace configuration: ${a}`)}},U=await T("db/mcp_servers.json",{});if(!U||"object"!=typeof U||Array.isArray(U)||Object.values(U).some(a=>!a||"object"!=typeof a))throw new L("UNSAFE_ENTRY","Invalid workspace configuration: db/mcp_servers.json");let V=await T("db/models.json",[]);if(!Array.isArray(V)||V.some(a=>!a||"object"!=typeof a))throw new L("UNSAFE_ENTRY","Invalid workspace configuration: db/models.json");let W=(a,b)=>{let c=C.findIndex(b=>b.path===a);-1!==c&&(F-=C.splice(c,1)[0].size),v(a,b),J.file(a,b,{unixPermissions:33152})},X=new Map;if(c.flowIds){let a=await T("db/flows.json",[]);if(!Array.isArray(a))throw new L("UNSAFE_ENTRY","Invalid workspace configuration: db/flows.json");for(let b of a)X.set(b.id,b);for(let a of Object.keys(J.files).filter(a=>/^db\/flows\/[^/]+\.json$/.test(a))){let b=await T(a,null);if(!b||"string"!=typeof b.id||!Array.isArray(b.nodes)||!Array.isArray(b.edges))throw new L("UNSAFE_ENTRY",`Invalid workspace flow: ${a}`);X.set(b.id,b)}}try{let a=(0,u.xL)(c.flowIds,{flows:[...X.values()],models:V,mcpServers:Object.entries(U).map(([a,b])=>({...b,name:a,transport:b.transport||"stdio"}))});i=a.requiresCodexAuth,(j=c.flowIds?a.flowIds:void 0)&&W("db/mcp_servers.json",Buffer.from(JSON.stringify(Object.fromEntries(a.configs.map(a=>[a.name,a]))))),d=await (0,u.zk)((0,u.am)(a.configs,m,{requiredServerNames:j?a.mcpServerNames:void 0}),{signal:k})}catch(a){throw k?.throwIfAborted(),new L("MCP_UNSUPPORTED",a instanceof Error?a.message:"MCP runtime cannot be reconstructed.")}if(!l&&await E(J))throw new L("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption.");let Y="none";if(i){if(!l)throw new L("CREDENTIALS_UNAVAILABLE","ChatGPT authentication requires an encrypted workspace snapshot.");try{let b=await (0,x.E0)(a);k?.throwIfAborted(),W("db/codex-runtime/auth.json",b),W(`db/codex-runtime/${x.Sy}`,Buffer.from(JSON.stringify(x.J1))),Y="chatgpt"}catch{throw k?.throwIfAborted(),new L("CREDENTIALS_UNAVAILABLE","Codex authentication is unavailable for encrypted transfer.")}}let Z=await T("db/encryption_key.json",{}),$="user"===Z.encryption_type?"user":"default";if("user"===$){let b;if(!l)throw new L("CREDENTIALS_UNAVAILABLE","Private workspace bootstrap requires an encrypted snapshot.");try{b="operator-file"===Z.key_protection?await (0,q.runWithWorkspace)(a,()=>(0,w.OS)(Z)):(0,A.eu)()}catch{throw new L("CREDENTIALS_UNAVAILABLE","Restore the matching independent operator secret before creating a worker snapshot.")}if(!b)throw new L("CREDENTIALS_UNAVAILABLE","Unlock this workspace before creating a worker snapshot.");W("db/worker-bootstrap-secrets.json",Buffer.from(JSON.stringify({version:1,workspaceDek:b})))}C.sort((a,b)=>a.path.localeCompare(b.path));let _={formatVersion:s.nt,layoutVersion:r.q,workspace:a,generation:b,createdAt:new Date().toISOString(),coherence:"registered-flujo-writers",externalRootsIncluded:!1,subtrees:q.WORKSPACE_SUBTREES,files:C,source:{version:B.rE,platform:process.platform},runtime:{mcpTransfer:d,codexAuth:Y,encryption:$,...j?{selectedFlowIds:j}:{}},excludedRuntimePaths:Q},aa=Buffer.from(JSON.stringify(_,null,2));if(aa.length>o.maxManifestBytes||Object.keys(J.files).length+1>o.maxMembers)throw new L("SIZE_LIMIT","Snapshot manifest or member count exceeds the restore limit.");J.file("snapshot-manifest.json",aa);let ab=!1,ac={zip:J,manifest:_,files:C.length,bytes:F,dispose:async()=>{ab||(l?.fill(0),await f.close(),ab=!0)}};return k?.throwIfAborted(),M.set(ac,{store:f,members:O}),J.generateInternalStream=a=>I(ac).generateInternalStream(a),N.set(ac,{key:l,recipientKeyUsed:void 0!==c.recipientKey}),ac}catch(a){throw l?.fill(0),await f.close().catch(()=>void 0),a}}function I(a){let b=M.get(a);if(!b)return a.zip;let c=new(p());for(let[d,e]of Object.entries(a.zip.files)){let a=b.members.get(d),f={date:e.date,unixPermissions:e.unixPermissions??void 0};e.dir?c.file(d,null,{...f,dir:!0}):a&&a.file===e?c.file(d,h.Readable.from(b.store.range(a.position,a.size),{objectMode:!1,highWaterMark:65536}),f):c.file(d,e.async("nodebuffer"),f)}return c}async function J(a,b={}){let{signal:c}=b;c?.throwIfAborted();let d=N.get(a),f=d?.recipientKeyUsed?Buffer.from(d.key):D();try{if(N.has(a)){let a=d?.key;if(!!a!=!!f||a&&f&&!(0,g.timingSafeEqual)(a,f))throw f?.fill(0),new L("CREDENTIALS_UNAVAILABLE","Snapshot encryption key changed. Start a new capture.")}let b=Object.keys(a.zip.files);if(b.length>(0,i.B5)().maxMembers)throw new L("SIZE_LIMIT","Snapshot exceeds the archive member limit.");let j=new Set(["db/codex-runtime/","db/codex-runtime/auth.json",`db/codex-runtime/${x.Sy}`]);if(b.some(a=>/^db\/codex-private-/i.test(a))||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a)&&!j.has(a))||!f&&("chatgpt"===a.manifest.runtime.codexAuth||"user"===a.manifest.runtime.encryption||b.includes("db/worker-bootstrap-secrets.json")||await E(a.zip)||b.some(a=>/^db\/codex-runtime(?:\/|$)/i.test(a))))throw f?.fill(0),new L("CREDENTIALS_UNAVAILABLE","Credential-bearing snapshots require encryption; runtime homes cannot be exported.");if(await (0,v.Tm)(a.manifest.workspace))throw new L("CREDENTIALS_UNAVAILABLE","Resume or roll back credential migration before creating a worker snapshot.");let m=await e.promises.mkdtemp(n().join((0,l.tmpdir)(),"flujo-hot-clone-"));await e.promises.chmod(m,448).catch(()=>void 0);let o=n().join(m,"workspace.snapshot.zip");try{let b=I(a).generateNodeStream({type:"nodebuffer",streamFiles:!0,compression:"DEFLATE",compressionOptions:{level:6},platform:"UNIX"},()=>c?.throwIfAborted()),g=await (0,k.s)(new h.Readable({highWaterMark:65536}).wrap(b),o,f,c);return await e.promises.chmod(o,384).catch(()=>void 0),c?.throwIfAborted(),{archivePath:o,stagingDir:m,sha256:g.sha256,plaintextSha256:g.plaintextSha256,encrypted:!!f,encryptionVersion:2*!!f,recipientKeyUsed:d?.recipientKeyUsed??!1,size:g.size,files:a.files,bytes:a.bytes}}catch(a){throw await e.promises.rm(m,{recursive:!0,force:!0}).catch(()=>void 0),a}}finally{f?.fill(0)}}d()}catch(a){d(a)}})},261571:(a,b,c)=>{c.d(b,{Js:()=>i,L$:()=>j,SZ:()=>k});var d=c(610782),e=c(774755),f=c(266844),g=c(882980);let h=(0,f.h)("backend/services/mcp/runtimeHomeIsolation"),i="FLUJO_MCP_RUNTIME_HOME_ISOLATION";function j(a){let b=a?.trim().toLowerCase();if(b){if(["1","true","yes","on","isolated"].includes(b))return!0;if(["0","false","no","off","host"].includes(b))return!1}}async function k(a,b=process.env){if((0,g.SL)(a),"stdio"!==a.transport)return!1;let c=j(b[i]);if(void 0!==c)return c;if("isolated"===a.runtimeHomeMode)return!0;if("host"===a.runtimeHomeMode)return!1;try{let a=await (0,d.loadItem)(e.Zg.SPEECH_SETTINGS,void 0);return a?.experimental?.mcpRuntimeHomeIsolation===!0}catch(a){return h.warn("Could not read the workspace MCP runtime-home preference; defaulting to host home",{error:a}),!1}}},326790:(a,b,c)=>{c.d(b,{ED:()=>k,Ws:()=>l,jD:()=>i});var d=c(673496),e=c.n(d);let f=(0,c(266844).h)("backend/utils/registryClient");class g extends Error{constructor(){super("MCP Registry response exceeded its byte limit")}}class h extends Error{constructor(a="MCP Registry request timed out"){super(a)}}let i="https://registry.modelcontextprotocol.io";async function j(a,b,c){let d=new AbortController,e=setTimeout(()=>d.abort(new h),b),f=c.signal?AbortSignal.any([d.signal,c.signal]):d.signal;try{let b=await fetch(a,{headers:{Accept:"application/json"},signal:f,cache:"no-store",redirect:"error"});if(void 0===c.maxBytes)return{status:b.status,body:await b.text()};let d=b.body?.getReader(),e=[],h=0;try{if(d)for(;;){let{done:a,value:b}=await d.read();if(a)break;if((h+=b.byteLength)>c.maxBytes)throw new g;e.push(b)}}finally{await d?.cancel().catch(()=>{})}return{status:b.status,body:Buffer.concat(e).toString("utf8")}}finally{clearTimeout(e)}}async function k(a,b,c={}){let d=Date.now();c.signal?.throwIfAborted();try{return await new Promise((d,f)=>{if(c.signal?.aborted)return void f(c.signal.reason);let i=e().connect(a.origin),j=!1,k=setTimeout(()=>l(()=>f(new h)),b),l=a=>{j||(j=!0,clearTimeout(k),c.signal?.removeEventListener("abort",m),a(),i.destroy())},m=()=>l(()=>f(c.signal?.reason??new DOMException("Aborted","AbortError")));i.setTimeout(b,()=>l(()=>f(new h(`HTTP/2 session timed out after ${b}ms`)))),i.on("error",a=>l(()=>f(a)));let n=i.request({":method":"GET",":path":a.pathname+a.search,accept:"application/json"});n.setTimeout(b,()=>l(()=>f(new h(`HTTP/2 request timed out after ${b}ms`)))),n.on("error",a=>l(()=>f(a)));let o=0,p="",q=0;(n.setEncoding("utf8"),n.on("response",a=>{o=Number(a[":status"]||0)}),n.on("data",a=>{(q+=Buffer.byteLength(a,"utf8"),void 0!==c.maxBytes&&q>c.maxBytes)?l(()=>f(new g)):p+=a}),n.on("end",()=>l(()=>d({status:o,body:p}))),c.signal?.addEventListener("abort",m,{once:!0}),c.signal?.aborted)?m():n.end()})}catch(i){c.signal?.throwIfAborted();let e=b-(Date.now()-d);if(i instanceof g||i instanceof h||e<=0)throw i;return f.warn("HTTP/2 request to registry failed, retrying over HTTP/1.1",i instanceof Error?i.message:i),await j(a,e,c)}}async function l(a,b,c={}){let d=await k(a,b,c);if(d.status<200||d.status>=300)throw Error(`MCP Registry responded with status ${d.status}`);return JSON.parse(d.body)}},464896:(a,b,c)=>{function d(a){if(null==a)return null;if("object"!=typeof a||Array.isArray(a))return"Invalid AI condition";if("llm-gate"!==a.mode&&"flow-gate"!==a.mode)return"Invalid AI checker type";if("string"!=typeof a.condition||!a.condition.trim())return"A condition is required for the AI to check";let b="llm-gate"===a.mode?a.modelId:a.flowId;return"string"==typeof b&&b.trim()?void 0!==a.maxCallsPerDay&&("number"!=typeof a.maxCallsPerDay||!Number.isSafeInteger(a.maxCallsPerDay)||a.maxCallsPerDay<1)?"Maximum AI checks per day must be a positive whole number":null:"A model or flow is required to check the condition"}function e(a){return"mcp-poll"===a.type&&("llm-gate"===a.evaluate.mode||"flow-gate"===a.evaluate.mode)?{...a,evaluate:{mode:"on-change"}}:a}function f(a){let b=a.startRestriction,c="unrestricted"===b||"singleton"===b||"exclusive"===b,d=!c&&!0===a.exclusive;return{startRestriction:c?b:d?"exclusive":"unrestricted",superExclusive:!!d||!0===a.superExclusive,emergency:!0===a.emergency}}function g(a){return!(!a||"object"!=typeof a||Array.isArray(a))&&["personaId","behaviorSlotKey","personaRetired","personaArchived"].some(b=>Object.prototype.hasOwnProperty.call(a,b))}c.d(b,{B2:()=>d,Vw:()=>g,n$:()=>e,vq:()=>f})},480244:(a,b,c)=>{c.r(b),c.d(b,{loadServerConfigs:()=>q,loadServerRoots:()=>r,saveConfig:()=>t});var d=c(333873),e=c.n(d),f=c(107397),g=c(610782),h=c(774755),i=c(266844),j=c(907986),k=c(882980);let l=(0,i.h)("backend/services/mcp/config"),m=new Set(["streamable","sse","websocket"]),n=new Map;async function o(a){if(n.has(a))return n.get(a);let b=null;try{let c=(0,f.Lp)({baseDir:a,timeout:{block:5e3}});b=(await c.remote(["get-url","origin"])||"").trim()||null}catch{b=null}return n.set(a,b),b}async function p(a){var b;let c;if(m.has(a.transport))return{type:"remote"};let d="string"!=typeof(b=a.rootPath)||""===b.trim()?null:e().isAbsolute(b)?b:e().resolve((0,j.getWorkspaceDataDir)(),b);if(d&&""!==(c=e().relative(e().join((0,j.getWorkspaceDataDir)(),"mcp-servers"),d))&&!c.startsWith("..")&&!e().isAbsolute(c)){let a=await o(d);if(a)return{type:"github",repositoryUrl:a}}return{type:"local"}}async function q(){l.debug("Entering loadServerConfigs method");try{let a=await (0,g.loadItem)(h.Zg.MCP_SERVERS,{}),b=Object.entries(a).map(([a,b])=>{let c=(0,k.H6)(b.transport),d=a=>"string"==typeof a?(0,j.remapLegacyDefaultWorkspaceReference)(a,"mcp-servers"):void 0,e=a=>Array.isArray(a)?a.map(d).filter(a=>void 0!==a):void 0,f=a=>{if(!a||"object"!=typeof a||Array.isArray(a))return;let b={};for(let[c,e]of Object.entries(a)){if("string"==typeof e){b[c]=d(e)??e;continue}e&&"object"==typeof e&&"value"in e&&"string"==typeof e.value&&"metadata"in e&&e.metadata&&"object"==typeof e.metadata&&"isSecret"in e.metadata&&"boolean"==typeof e.metadata.isSecret&&(b[c]={value:d(e.value)??e.value,metadata:{isSecret:e.metadata.isSecret}})}return b},g=b.launch,h=g&&"object"==typeof g?{...g,command:d(g.command),cwd:d(g.cwd),args:e(g.args),env:f(g.env)}:void 0;b={...b,transport:c,rootPath:d(b.rootPath),cwd:d(b.cwd),command:d(b.command),args:e(b.args),roots:e(b.roots),env:f(b.env),...Object.prototype.hasOwnProperty.call(b,"launch")?{launch:h}:{}},m.has(c)&&function(a){if("string"!=typeof a)return!1;let b=a.trim();return"/"===b||"\\"===b||/^[A-Za-z]:[\\/]?$/.test(b)}(b.rootPath)&&(l.info(`Normalizing filesystem-root rootPath "${b.rootPath}" of remote server ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let i=b.source?.type;"stdio"===c&&"string"==typeof b.rootPath&&"."===b.rootPath.trim()&&("registry"===i||"marketplace"===i)&&/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(a)&&(l.info(`Normalizing shared Registry rootPath "." of ${a} to mcp-servers/${a}`),b={...b,rootPath:`mcp-servers/${a}`});let n={name:a,disabled:!1,rootPath:"",env:{},_buildCommand:"",_installCommand:""};return"streamable"===c?{...n,...b,name:a,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0,reconnectionOptions:b.reconnectionOptions&&"object"==typeof b.reconnectionOptions?b.reconnectionOptions:void 0,sessionId:b.sessionId||void 0,oauthClientId:b.oauthClientId||"",oauthClientSecret:b.oauthClientSecret||"",oauthScopes:b.oauthScopes||(b.oauthClientId||b.oauthClientInformation?["read"]:void 0),oauthClientMetadata:b.oauthClientMetadata,oauthClientInformation:b.oauthClientInformation,oauthTokens:b.oauthTokens,oauthCodeVerifier:b.oauthCodeVerifier}:"sse"===c?{...n,...b,name:a,eventSourceInit:b.eventSourceInit&&"object"==typeof b.eventSourceInit?b.eventSourceInit:void 0,requestInit:b.requestInit&&"object"==typeof b.requestInit?b.requestInit:void 0}:"websocket"===c?{...n,...b,name:a,websocketUrl:b.websocketUrl||""}:{...n,...b,name:a,command:b.command||"",args:b.args||[],stderr:b.stderr||"pipe"}});return await Promise.all(b.map(async a=>{a.source||(a.source=await p(a))})),b}catch(a){if(a instanceof k.UQ)return l.warn("Stored MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to load server configs",a),{success:!1,error:`Failed to load server configs: ${a instanceof Error?a.message:"Unknown error"}`}}}async function r(a){let b=await q();if(!Array.isArray(b))return[];let c=b.find(b=>b.name===a)?.roots;return Array.isArray(c)?c.filter(a=>"string"==typeof a):[]}let s=["_buildCommand","_installCommand","oauthClientId","oauthClientSecret"];async function t(a){l.debug("Entering saveConfig method");try{for(let b of a.values())(0,k.SL)(b);let b=Object.fromEntries(Array.from(a.entries()).map(([a,b])=>[a,function(a){let{name:b,...c}=a,d={};for(let[a,b]of Object.entries(c))void 0!==b&&(""===b&&s.includes(a)||(d[a]=b));return d}(b)]));return await (0,g.VH)(h.Zg.MCP_SERVERS,b),{success:!0}}catch(a){if(a instanceof k.UQ)return l.warn("MCP transport is invalid"),{success:!1,error:a.message,statusCode:400};return l.warn("Failed to save config",a),{success:!1,error:`Failed to save config: ${a instanceof Error?a.message:"Unknown error"}`}}}},587301:(a,b,c)=>{c.d(b,{s:()=>h,t:()=>i});var d=c(973024),e=c(977598),f=c(186359),g=c(157075);async function h(a,b,c,g){let h;a.on("error",()=>void 0);let i=(0,e.createHash)("sha256"),j=(0,e.createHash)("sha256");try{let a=(0,f.B5)(),i=c?(0,e.randomBytes)(12):void 0,j=c?(0,e.createCipheriv)("aes-256-gcm",c,i):void 0;j&&j.setAAD(Buffer.from(f.fI.v2Aad)),g?.throwIfAborted();let k=await d.promises.open(b,"wx",384);h={limits:a,iv:i,cipher:j,output:k}}catch(b){throw a.destroy(),b}let{limits:k,iv:l,cipher:m,output:n}=h,o=0,p=Buffer.alloc(0),q=0,r=async a=>{if(g?.throwIfAborted(),q+a.length>(c?k.maxEncryptedBytes:k.maxArchiveBytes))throw Error("Snapshot exceeds the archive size limit.");for(let b=0;b<a.length;){let c=await n.write(a,b,a.length-b);if(!c.bytesWritten)throw Error("Snapshot write made no progress.");b+=c.bytesWritten}i.update(a),q+=a.length},s=async(a,b=!1)=>{let c=p.length?Buffer.concat([p,a]):a,d=b?c.length:c.length-c.length%3;for(let a=0;a<d;){let b=Math.min(49152,d-a);await r(Buffer.from(c.subarray(a,a+b).toString("base64"))),a+=b}p=Buffer.from(c.subarray(d))},t=()=>a.destroy(g?.reason instanceof Error?g.reason:Error("Snapshot aborted."));g?.addEventListener("abort",t,{once:!0});let u=!1;try{for await(let b of(g?.throwIfAborted(),l&&await r(Buffer.from(`{"format":"flujo-workspace-encrypted","version":2,"iv":"${l.toString("base64")}","data":"`)),a)){g?.throwIfAborted();let a=Buffer.isBuffer(b)?b:Buffer.from(b);if((o+=a.length)>k.maxArchiveBytes)throw Error("Snapshot exceeds the archive size limit.");j.update(a),m?await s(m.update(a)):await r(a)}return m&&(await s(m.final(),!0),await r(Buffer.from(`","tag":"${m.getAuthTag().toString("base64")}"}`))),await n.sync(),{sha256:i.digest("hex"),plaintextSha256:j.digest("hex"),size:q}}catch(a){throw u=!0,a}finally{g?.removeEventListener("abort",t),a.destroy();try{await n.close()}catch(a){if(!u)throw a}}}async function i(a,b,c,f,h){let i,j=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),k=()=>i??=j.close(),l=!1;try{let i=await j.stat({bigint:!0}),m=a=>["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"].every(b=>i[b]===a[b]),n=async()=>{f.throwIfAborted(),h();let c=await d.promises.lstat(a,{bigint:!0});if(!i.isFile()||i.nlink!==BigInt(1)||!c.isFile()||c.isSymbolicLink()||i.size!==BigInt(b)||!m(c)||!m(await j.stat({bigint:!0})))throw Error("Snapshot archive failed its integrity check.")},o=async a=>{let c=Buffer.alloc(Math.min(65536,b-a));for(let b=0;b<c.length;){let{bytesRead:d}=await j.read(c,b,c.length-b,a+b);if(!d)throw Error("Snapshot archive failed its integrity check.");b+=d}return c};await n();let p=(0,e.createHash)("sha256");for(let a=0;a<b;a+=65536)f.throwIfAborted(),h(),p.update(await o(a));if(await n(),p.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.");let q=g.Readable.from(async function*(){try{let a=(0,e.createHash)("sha256");for(let c=0;c<b;c+=65536){await n();let b=await o(c);a.update(b),yield b}if(await n(),a.digest("hex")!==c)throw Error("Snapshot archive failed its integrity check.")}finally{await k()}}(),{objectMode:!1,highWaterMark:65536}),r=()=>q.destroy(Error("Snapshot session is no longer available."));return q.on("error",()=>void 0),q.once("close",()=>{f.removeEventListener("abort",r),k().catch(()=>void 0)}),f.addEventListener("abort",r,{once:!0}),f.aborted&&r(),l=!0,g.Readable.toWeb(q,{strategy:{highWaterMark:65536,size:a=>a.byteLength}})}finally{l||await k()}}},620775:(a,b,c)=>{c.d(b,{q:()=>d});let d=2},621385:(a,b,c)=>{c.d(b,{N:()=>o,z:()=>r});var d=c(973024),e=c(977598),f=c(848161),g=c(176760),h=c.n(g),i=c(186359);let j=["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"],k=(a,b)=>j.every(c=>a[c]===b[c]),l=()=>Error("Worker snapshot is unsafe or changed while being read.");async function m(a,b){for(let c=0;c<b.length;){let{bytesWritten:d}=await a.write(b,c,b.length-c);if(!d)throw l();c+=d}}async function n(a,b,c,d){let e=d?d.subarray(0,c):Buffer.alloc(c);if(e.length!==c)throw l();for(let d=0;d<c;){let{bytesRead:f}=await a.read(e,d,c-d,b+d);if(!f)throw l();d+=f}return e}class o{constructor(a,b){this.root=a,this.file=b,this.size=0,this.key=(0,e.randomBytes)(32),this.pending=Buffer.alloc(0),this.blocks=[],this.diskSize=0,this.sealed=Buffer.alloc(65564),this.readTail=Promise.resolve()}static async create(){let a=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-input-"));try{return await d.promises.chmod(a,448),new o(a,await d.promises.open(h().join(a,"ciphertext"),"wx+",384))}catch(b){throw await d.promises.rm(a,{recursive:!0,force:!0}),b}}async append(a){this.size+=a.length;let b=this.pending.length?Buffer.concat([this.pending,a]):a;for(;b.length>=65536;)await this.seal(b.subarray(0,65536)),b=b.subarray(65536);this.pending=Buffer.from(b)}async seal(a){let b=(0,e.randomBytes)(12),c=(0,e.createCipheriv)("aes-256-gcm",this.key,b);c.setAAD(Buffer.from(`${this.blocks.length}:${a.length}`));let d=c.update(a),f=c.final();b.copy(this.sealed),c.getAuthTag().copy(this.sealed,12),d.copy(this.sealed,28),f.copy(this.sealed,28+d.length),await m(this.file,this.sealed.subarray(0,a.length+28)),this.blocks.push({offset:this.diskSize,length:a.length}),this.diskSize+=a.length+28}async finish(){this.pending.length&&await this.seal(this.pending),this.pending.fill(0),this.pending=Buffer.alloc(0),await this.file.sync()}async read(a,b){let c,d=this.readTail;this.readTail=new Promise(a=>{c=a}),await d;try{return await this.readOwned(a,b)}finally{c()}}async readOwned(a,b){if(!Number.isSafeInteger(a)||!Number.isSafeInteger(b)||a<0||b<0||a+b>this.size||b>8388608)throw l();let c=Buffer.alloc(b);for(let d=0;d<b;){let f=Math.floor((a+d)/65536),g=this.blocks[f];if(!g)throw l();if(this.cache?.index!==f){this.cache?.bytes.fill(0);let a=await n(this.file,g.offset,g.length+28,this.sealed),b=(0,e.createDecipheriv)("aes-256-gcm",this.key,a.subarray(0,12));b.setAAD(Buffer.from(`${f}:${g.length}`)),b.setAuthTag(a.subarray(12,28));let c=b.update(a.subarray(28)),d=b.final();this.cache={index:f,bytes:d.length?Buffer.concat([c,d]):c}}let h=(a+d)%65536,i=Math.min(b-d,g.length-h);this.cache.bytes.copy(c,d,h,h+i),d+=i}return c}async *range(a=0,b=this.size-a){for(let c=0;c<b;c+=65536)yield await this.read(a+c,Math.min(65536,b-c))}async close(){for(let a of(this.key.fill(0),this.pending.fill(0),this.cache?.bytes.fill(0),this.sealed.fill(0),[...await Promise.allSettled([this.file.close()]),...await Promise.allSettled([d.promises.rm(this.root,{recursive:!0,force:!0})])]))if("rejected"===a.status)throw a.reason}}class p{constructor(a,b){this.file=a,this.size=b,this.storage=Buffer.alloc(65536),this.buffer=Buffer.alloc(0),this.offset=0,this.position=0}async fill(){return this.offset<this.buffer.length||this.position!==this.size&&(this.buffer=await n(this.file,this.position,Math.min(65536,this.size-this.position),this.storage),this.position+=this.buffer.length,this.offset=0,!0)}async peek(){return await this.fill()?this.buffer[this.offset]:-1}async byte(){let a=await this.peek();return -1!==a&&this.offset++,a}async whitespace(){for(;[9,10,13,32].includes(await this.peek());)await this.byte()}async expect(a){if(await this.whitespace(),await this.byte()!==a)throw l()}async smallValue(){await this.whitespace();let a=[],b=await this.peek()===34;b&&a.push(await this.byte());let c=!1;for(;a.length<256;){let d=await this.peek();if(-1===d)throw l();if(!b&&[44,125,9,10,13,32].includes(d)||(a.push(await this.byte()),b&&34===d&&!c))break;c=92===d&&!c}if(256===a.length)throw l();try{return JSON.parse(Buffer.from(a).toString("utf8"))}catch{throw l()}}async data(a,b){await this.expect(34);let c="",d=!1,e=0,f=async f=>{if(!/^[A-Za-z0-9+/=]*$/.test(f)||d&&f.length)throw l();let g=(c+=f).length-c.length%4;if(!g)return;let h=c.slice(0,g);if(!/^[A-Za-z0-9+/]*={0,2}$/.test(h))throw l();let i=Buffer.from(h,"base64");if(i.toString("base64")!==h||(d=h.includes("="),(e+=i.length)>b))throw l();await m(a,i),c=c.slice(g)};for(;await this.fill();){let a=this.buffer.indexOf(34,this.offset),b=this.buffer.indexOf(92,this.offset),d=Math.min(a<0?this.buffer.length:a,b<0?this.buffer.length:b);if(await f(this.buffer.subarray(this.offset,d).toString("latin1")),this.offset=d,d===this.buffer.length)continue;if(34===await this.byte()){if(c.length)throw l();return e}let g=await this.byte();if(117===g){let a="";for(let b=0;b<4;b++){let b=await this.byte();if(b<0)throw l();a+=String.fromCharCode(b)}if(!/^[0-9a-fA-F]{4}$/.test(a))throw l();await f(String.fromCharCode(Number.parseInt(a,16)))}else{let a=new Map([[34,'"'],[92,"\\"],[47,"/"],[98,"\b"],[102,"\f"],[110,"\n"],[114,"\r"],[116,"	"]]).get(g);if(void 0===a)throw l();await f(a)}}throw l()}}function q(a,b){if("string"!=typeof a||a.length>64)throw l();let c=Buffer.from(a,"base64");if(c.length!==b||c.toString("base64")!==a)throw l();return c}async function r(a,b,c,g){let j,m,r,s,t=await d.promises.lstat(a,{bigint:!0}),u=void 0===b?c:4*Math.ceil(c/3)+4096;if(!t.isFile()||t.isSymbolicLink()||t.nlink!==BigInt(1)||t.size>BigInt(u))throw l();let v=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),w=!1,x=0,y=(0,e.createHash)("sha256");try{let u=j=await o.create();if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();let z=Buffer.alloc(65536);for(let a=0;a<Number(t.size);a+=65536)y.update(await n(v,a,Math.min(65536,Number(t.size)-a),z));let A=(0,e.createHash)("sha256"),B=async a=>{if(u.size+a.length>c)throw l();A.update(a),await u.append(a)};if(void 0!==b)try{s=q(b,32),m=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-envelope-")),await d.promises.chmod(m,448),r=await d.promises.open(h().join(m,"ciphertext"),"wx+",384);let a=new p(v,Number(t.size)),g=new Map,j=-1;for(await a.expect(123);;){let b=await a.smallValue();if("string"!=typeof b||!["format","version","iv","tag","data"].includes(b)||g.has(b))throw l();await a.expect(58),g.set(b,"data"===b||await a.smallValue()),"data"===b&&(j=await a.data(r,c)),await a.whitespace();let d=await a.byte();if(125===d)break;if(44!==d)throw l()}if(await a.whitespace(),await a.byte()!==-1||5!==g.size||"flujo-workspace-encrypted"!==g.get("format")||![1,2].includes(g.get("version"))||j<0)throw l();x=g.get("version");let k=(0,e.createDecipheriv)("aes-256-gcm",s,q(g.get("iv"),12));2===x&&k.setAAD(Buffer.from(i.fI.v2Aad)),k.setAuthTag(q(g.get("tag"),16));for(let a=0;a<j;a+=65536)await B(k.update(await n(r,a,Math.min(65536,j-a),z)));await B(k.final())}catch{throw Error("Worker snapshot decryption failed. Check the encrypted archive and its key.")}else for(let a=0;a<Number(t.size);a+=65536)await B(await n(v,a,Math.min(65536,Number(t.size)-a),z));let C=A.digest("hex");if((2===x?y.digest("hex"):C)!==g)throw Error("Worker snapshot SHA-256 mismatch.");if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();return await u.finish(),w=!0,u}catch(a){throw await j?.close().catch(()=>void 0),a}finally{s?.fill(0);let a=await Promise.allSettled([v.close(),...r?[r.close()]:[]]),b=await Promise.allSettled(m?[d.promises.rm(m,{recursive:!0,force:!0})]:[]);if(w&&[...a,...b].some(a=>"rejected"===a.status))throw await j?.close().catch(()=>void 0),Error("Snapshot temporary storage could not be released.")}}},676145:(a,b,c)=>{c.d(b,{AH:()=>i,O$:()=>u,P1:()=>e,XQ:()=>v,Yr:()=>r,cy:()=>x,jg:()=>y,nO:()=>s,q7:()=>k,vf:()=>t,zz:()=>w});var d=c(372628);function e(a){return"manual-launch"!==a.kind}let f={npm:"npx",pypi:"uvx",oci:"docker",nuget:"dnx"},g={npm:"npm",pypi:"PyPI",oci:"Docker",nuget:"NuGet",mcpb:"MCPB",cargo:"Cargo"};function h(a){return""!==a&&/^[A-Za-z0-9_@%+=:,./-]+$/.test(a)?a:`"${a.replace(/(["$`\\])/g,"\\$1")}"`}function i(a){var b;let c=[],d=[];for(let e of a.packages??[]){let a=function(a){if(!a.identifier)return{supported:!1,reason:"no-identifier"};if(!f[a.registryType]&&!a.runtimeHint)return{supported:!1,reason:"unknown-runner"};let b=a.transport?.type;return b&&"stdio"!==b?"streamable-http"===b||"sse"===b?{supported:!1,reason:"launch-and-connect"}:{supported:!1,reason:"unknown-transport"}:{supported:!0}}(e);a.supported?c.push({kind:"package",label:`${g[b=e.registryType]||b}: ${e.identifier}`,pkg:e}):"launch-and-connect"===a.reason&&d.push(function(a){var b;let{command:c,args:d}=q(a,{envFlags:"inline"}),e=a.transport?.type==="sse"?"sse":"streamable",f=a.transport?.url,i={kind:"manual-launch",label:`${g[b=a.registryType]||b}: ${a.identifier} (manual start)`,pkg:a,transport:e,runLine:[c,...d].map(h).join(" ")};if(!f)return{...i,urlError:"missing-url",urlErrorDetail:"no transport.url declared"};let j=function(a,b){let c,d=[],e=a.replace(/\{([^{}]+)\}/g,(a,c)=>{let e=b.args[c]??b.env[c];return void 0===e||""===e?(d.push(c),""):e});if(d.length>0)return{error:"unresolved-placeholder",detail:d.join(", ")};try{c=new URL(e)}catch{return{error:"invalid-url",detail:e}}return/^https?:$/.test(c.protocol)?!function(a){let b=a.toLowerCase().replace(/^\[/,"").replace(/\]$/,"");if("localhost"===b||"::1"===b||"0:0:0:0:0:0:0:1"===b)return!0;let c=/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(b);if(!c)return!1;let d=c.slice(1,5).map(Number);return!d.some(a=>a>255)&&127===d[0]}(c.hostname)?{error:"non-loopback",detail:c.hostname}:{url:c.toString()}:{error:"invalid-url",detail:e}}(f,{env:function(a){let b={};for(let c of a??[]){if(!c.name)continue;let a=c.value??c.default;void 0!==a&&""!==a&&(b[c.name]=a)}return b}(a.environmentVariables),args:{...n(a.runtimeArguments),...n(a.packageArguments)}});return"url"in j?{...i,resolvedUrl:j.url}:{...i,urlError:j.error,urlErrorDetail:j.detail}}(e))}for(let b of a.remotes??[])b.url&&("streamable-http"===b.type||"sse"===b.type)&&c.push({kind:"remote",label:`Remote (${"sse"===b.type?"SSE":"Streamable HTTP"}): ${b.url}`,remote:b});return[...c,...d]}let j=new Set(["mcp","server","mcp-server","mcpserver"]);function k(a){return(function(a){let b=a.indexOf("/"),c=b>=0?a.slice(0,b):"",d=b>=0?a.slice(b+1):a;if(!j.has(d.toLowerCase())||!c)return d;let e=c.split(".").reverse().find(a=>a&&!j.has(a.toLowerCase()))||"";return e?`${e}-${d}`:d})(a).replace(/[^a-zA-Z0-9_-]+/g,"-").replace(/^-+|-+$/g,"")||"mcp-server"}function l(a){let b=a.value??a.default;return"named"===a.type?a.name?void 0!==b&&""!==b?[a.name,b]:a.isRequired&&a.valueHint?[a.name,`<${a.valueHint}>`]:a.isRequired?[a.name]:[]:[]:void 0!==b&&""!==b?[b]:a.isRequired?[`<${a.valueHint||"value"}>`]:[]}function m(a){return(a??[]).flatMap(l)}function n(a){let b={};for(let c of a??[]){if("named"!==c.type||!c.name)continue;let a=c.value??c.default;void 0!==a&&""!==a&&(b[c.name]=a)}return b}function o(a){let b=(a.icons??[]).flatMap(a=>{if(!a?.src)return[];try{if(!/^https?:$/.test(new URL(a.src).protocol))return[]}catch{return[]}return[{src:a.src,...a.sizes?{sizes:a.sizes}:{},...a.mimeType?{mimeType:a.mimeType}:{},..."light"===a.theme||"dark"===a.theme?{theme:a.theme}:{}}]});return{name:k(a.name),disabled:!1,env:{},_buildCommand:"",_installCommand:"",...b.length>0?{icons:b}:{}}}function p(a){return a.version?`${a.identifier}@${a.version}`:a.identifier}function q(a,b={}){let c,d=a.runtimeHint||f[a.registryType],e=m(a.packageArguments),g=m(a.runtimeArguments),h=function(a){let b={};for(let c of a??[]){if(!c.name)continue;let a=c.value??c.default??"";b[c.name]=c.isSecret?{value:a,metadata:{isSecret:!0}}:a}return b}(a.environmentVariables);switch(a.registryType){case"npm":c=[...g,"-y",p(a),...e];break;case"pypi":c=[...g,a.version?`${a.identifier}==${a.version}`:a.identifier,...e];break;case"oci":{let d,f="inline"===b.envFlags?function(a){let b=[];for(let c of a??[]){if(!c.name)continue;let a=c.value??c.default,d=!c.isSecret&&void 0!==a&&""!==a;b.push("-e",`${c.name}=${d?a:`<${c.name}>`}`)}return b}(a.environmentVariables):Object.keys(h).flatMap(a=>["-e",a]);c=[..."run"===g[0]?[]:["run","-i","--rm"],...g,...f,!((d=a.identifier.split("/").pop()||a.identifier).includes(":")||d.includes("@"))&&a.version?`${a.identifier}:${a.version}`:a.identifier,...e];break}case"nuget":c=[...g,p(a),"--yes",...e];break;default:c=[...g,p(a),...e]}return{command:d,args:c,env:h}}function r(a,b){let c="package"===b.kind?function(a,b){let{command:c,args:d,env:e}=q(b),f=o(a);return{...f,transport:"stdio",command:c,args:d,env:e,rootPath:`mcp-servers/${f.name}`}}(a,b.pkg):"manual-launch"===b.kind?function(a,b){let{command:c,args:d,env:e}=q(b.pkg),f=o(a),g={command:c,...d.length>0?{args:d}:{},...Object.keys(e).length>0?{env:e}:{}};return{...f,transport:b.transport,serverUrl:b.resolvedUrl??"",headers:{},env:e,launch:g,rootPath:`mcp-servers/${f.name}`}}(a,b):function(a,b){let c={};for(let a of b.headers??[])a.name&&(c[a.name]=a.value??a.default??"");let d=o(a);return{...d,transport:"sse"===b.type?"sse":"streamable",serverUrl:b.url,headers:c,rootPath:`mcp-servers/${d.name}`}}(a,b.remote),d="remote"===b.kind?a.version:b.pkg.version??a.version,e={type:"registry",registryName:a.name,...d?{version:d}:{}};return{...c,source:e}}function s(a){return"active"===a}function t(a){let b=a?._meta?.["io.modelcontextprotocol.registry/official"]?.status;return"string"==typeof b&&b.length>0?b:"unverified"}function u(a,b,c,d){let e=r(b,c),f=e.transport??"stdio";return{registryName:a,resolvedName:b.name,serverName:e.name??k(b.name),transport:f,...e.command?{command:e.command}:{},...Array.isArray(e.args)?{args:e.args}:{},...e.serverUrl?{serverUrl:e.serverUrl}:{},requiredEnvNames:"remote"===c.kind?(c.remote.headers??[]).filter(a=>a.isRequired&&a.name).map(a=>a.name):(c.pkg.environmentVariables??[]).filter(a=>a.isRequired&&a.name).map(a=>a.name),verificationStatus:d}}function v(a){let b;try{b=new URL(a)}catch{return null}let c=b.searchParams.get("q");if(c)return`/v0.1/servers?search=${encodeURIComponent(c)}&version=latest&limit=1`;if(/^\/v[\d.]+\/servers\/[^/]+\/versions\/[^/]+$/.test(b.pathname))return b.pathname;let d=b.pathname.match(/^\/v[\d.]+\/servers\/([^/]+)(?:\/versions)?\/?$/);if(d){let a=decodeURIComponent(d[1]);return`/v0.1/servers?search=${encodeURIComponent(a)}&version=latest&limit=1`}return null}function w(a){return a?.servers&&a.servers.length>0?a.servers[0]:a?.server?.name?a:null}function x(a,b){if(!b||0===Object.keys(b).length)return a;let c=(0,d.P0)(a.env,b);return{...a,env:c}}function y(a,b){let c=(0,d.bq)(b);return"remote"===a.kind?(a.remote.headers??[]).filter(a=>a.isRequired&&!(a.value??a.default)&&!c[a.name]).map(a=>a.name):(a.pkg.environmentVariables??[]).filter(a=>a.isRequired&&!(a.value??a.default)&&!c[a.name]).map(a=>a.name)}},683843:(a,b,c)=>{c.d(b,{d1:()=>h,nt:()=>g});var d=c(739006),e=c(186359),f=c(620775);let g=2;function h(){let a=process.env.FLUJO_BUILD_REVISION;return{applicationVersion:d.rE,snapshotEncryption:{...e.fI,readVersions:[...e.fI.readVersions]},snapshotLimits:(0,e.B5)(),snapshotFormatVersion:g,layoutVersion:f.q,workerProtocolVersion:1,workerSnapshotSourceVersion:1,.../^[a-f0-9]{40}$/.test(a??"")?{revision:a}:{}}}},715628:(a,b,c)=>{c.d(b,{d:()=>e,o:()=>d});let d=["https://registry.modelcontextprotocol.io/?q=ai.keenable%2Fweb-search",{url:"https://registry.modelcontextprotocol.io/v0.1/servers/ai.parallel%2Fsearch-mcp/versions",remoteUrlOverrides:{"https://search-mcp.parallel.ai/mcp":"https://search.parallel.ai/mcp"}},"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-abap-adt/versions","https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-audio-studio/versions","https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-vscode/versions","https://registry.modelcontextprotocol.io/v0.1/servers/io.github.mario-andreschak%2Fmcp-cad-studio/versions",{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.microsoft%2Fplaywright-mcp/versions",env:{PLAYWRIGHT_MCP_BROWSER:"msedge"}},{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dosev-ai%2Fmcp-office-word/versions/",env:{WORD_ALLOWLIST_ROOTS:".",WORD_ENABLE_WRITE:"true"}},{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dosev-ai%2Fmcp-office-excel/versions/",env:{EXCEL_ALLOWLIST_ROOTS:".",EXCEL_ENABLE_WRITE:"true"}},{url:"https://registry.modelcontextprotocol.io/v0.1/servers/io.github.dosev-ai%2Fmcp-office-powerpoint/versions/",env:{PPT_ALLOWLIST_ROOTS:".",PPT_ENABLE_WRITE:"true"}}];function e(a){return"string"==typeof a?{url:a}:a}},739006:a=>{a.exports={rE:"3.48.7"}},794856:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{$J:()=>k,Mh:()=>n,Ng:()=>m,k6:()=>l});var e=c(838583),f=c(952294),g=c(580940),h=c(905738),i=c(907986),j=a([e]);function k(a){if((0,g.ye)()&&"1"===process.env.FLUJO_WORKER_SNAPSHOT_SOURCE){let b=(0,f.i)(a);if(b)return b;if(process.env.FLUJO_EXPOSURE_MODE?.trim().toLowerCase()!=="network")return m({error:"Worker snapshot sources require network exposure."},403);let c=(0,h.$)(a);if(c)return c;let d=(0,g.dT)();return"ready"===d.state&&d.workspace?d.workspace!==(0,i.getCurrentWorkspace)()?m({error:"This workspace is not assigned to the worker."},404):null:m({error:"Worker is not ready.",code:"WORKER_NOT_READY"},503)}let b=(0,h.$)(a,{strictLoopback:!0});return b||(0,f.i)(a)}function l(a){try{return new URL(a.url).searchParams.get("sessionId")}catch{return null}}function m(a,b=200){return Response.json(a,{status:b,headers:{"Cache-Control":"no-store"}})}function n(a){return a instanceof e.b?m({error:a.message,code:a.code},a.status):m({error:"Snapshot operation failed.",code:"SNAPSHOT_FAILED"},500)}e=(j.then?(await j)():j)[0],d()}catch(a){d(a)}})},816079:(a,b,c)=>{c.d(b,{DB:()=>q,HM:()=>y,I5:()=>v,TX:()=>x,hD:()=>u});var d=c(973024),e=c(176760),f=c.n(e),g=c(774755),h=c(100629),i=c(134887),j=c(907986),k=c(845223),l=c(930100),m=c(851018),n=c(989481),o=c(472178),p=c(879628);let q=[g.Zg.MODELS,g.Zg.MCP_SERVERS,g.Zg.GLOBAL_ENV_VARS,g.Zg.REGISTRY_ACCOUNT],r="flujo:secret:v2",s=new Set(["apikey","password","passphrase","secret","token","privatekey","cookie","clientsecret","oauthclientsecret","accesstoken","refreshtoken","idtoken","oauthcodeverifier","authorization"]),t=new Map([["oauthtokens","tokens"],["oauthclientinformation","client"],["oauthcodeverifier","verifier"]]);function u(a,b){if(!b||"object"!=typeof b||a===g.Zg.MODELS&&!Array.isArray(b)||![g.Zg.MODELS,g.Zg.MCP_SERVERS].includes(a)&&Array.isArray(b)||(a===g.Zg.MODELS||a===g.Zg.MCP_SERVERS)&&(Array.isArray(b)?b:Object.values(b)).some(a=>!a||"object"!=typeof a||Array.isArray(a)))throw new n.Zz;if(a===g.Zg.MCP_SERVERS&&Array.isArray(b)){let a=b.map(a=>a.name);if(a.some(a=>"string"!=typeof a||!a.trim())||new Set(a).size!==a.length)throw new n.Zz;return Object.fromEntries(b.map(a=>[a.name,a]))}return b}async function v(a,b,c=!1,d=0,e=!1,f){if(d>100)throw new n.Zz;if("string"==typeof a)return b(a,c);if(Array.isArray(a))return Promise.all(a.map(a=>v(a,b,c,d+1,e,f)));if(!a||"object"!=typeof a)return a;if(1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length)return b(a.plaintext,!0);let g=c||!!(a.metadata&&"object"==typeof a.metadata&&a.metadata.isSecret),h={};for(let[c,i]of Object.entries(a)){let a=c.replace(/[_-]/g,"").toLowerCase(),j="env"===a||"headers"===a,k=t.get(a),l=f&&1===d&&k?await f(k,i):j&&i&&"object"==typeof i&&!Array.isArray(i)?Object.fromEntries(await Promise.all(Object.entries(i).map(async([a,c])=>{let g=await v(c,b,!0,d+1,e,f);return[a,e?"string"==typeof g?{value:g,metadata:{isSecret:!0}}:{...g,metadata:{isSecret:!0}}:g]}))):await v(i,b,s.has(a)||"value"===c&&g,d+1,e,f);Object.defineProperty(h,c,{value:l,enumerable:!0})}return h}async function w(a,b){if(a.startsWith("encrypted_failed:"))return{$flujoCredential:1,plaintext:a.slice(17)};let c=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;if(void 0===c)return b&&a?{$flujoCredential:1,plaintext:a}:a;let d=await (0,l.Do)(c);if(null===d)throw new n.Zz;return{$flujoCredential:1,plaintext:d}}async function x(a){return(0,p.Ns)(async()=>{let b={};for(let a of q){let c,d=f().join((0,j.getWorkspaceDataDir)(),"db",`${a}.json`);try{c=await (0,h.b)(d,{maxBytes:7340032,verifyPath:()=>(0,o.V$)((0,i.ok)(),d)})}catch(a){if("ENOENT"===a.code)continue;throw new n.Zz}try{let d=u(a,JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(c))),e=async(a,b)=>(0,k.rr)(a,await (0,k.eC)(a,b,(0,j.getCurrentWorkspace)(),async a=>{let b=await (0,l.Do)(a);if(null===b)throw new n.Zz;return b}),(0,j.getCurrentWorkspace)());b[a]=await v(d,w,!1,0,!1,a===g.Zg.MCP_SERVERS?e:void 0)}finally{c.fill(0)}}let c=Date.now(),d=Buffer.from(JSON.stringify({version:1,createdAt:c,expiresAt:c+864e5,records:b}));try{return await (0,n.of)(d,a)}finally{d.fill(0)}})}async function y(a,b,c,e,l={}){let p,s=(0,j.assertValidWorkspaceName)(c);if("string"!=typeof e||e.length<12||Buffer.byteLength(e)>1024||e===m.Gr||e===b)throw new n.Zz;let t=await (0,n.XM)(a,b);try{p=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(t))}finally{t.fill(0)}let w=Date.now();if(!p||1!==p.version||!Number.isSafeInteger(p.createdAt)||!Number.isSafeInteger(p.expiresAt)||p.createdAt>w+6e4||p.expiresAt<=w||p.expiresAt-p.createdAt!=864e5||!p.records||"object"!=typeof p.records||Array.isArray(p.records)||Object.keys(p.records).some(a=>!q.includes(a)))throw new n.Zz;let x=(0,m.OD)(),z=await (0,m.Mk)(x,"user",e,"passphrase"),A=new Map;for(let[a,b]of Object.entries(p.records)){let c=u(a,b),d=async(a,b)=>{if(!b||!a||/^\$\{global:[^}]+\}$/.test(a))return a;let c=(0,m.od)(a,x.activeKey,r);if((0,m.ho)(c,x.activeKey,r)!==a)throw new n.Zz;return`encrypted:${c}`},e=a===g.Zg.GLOBAL_ENV_VARS&&c&&"object"==typeof c&&!Array.isArray(c)?Object.fromEntries(await Promise.all(Object.entries(c).map(async([a,b])=>{let c=await v(b,d,!0,0,!0);if("string"==typeof c)return[a,{value:c,metadata:{isSecret:!0}}];if(!c||"object"!=typeof c||"string"!=typeof c.value)throw new n.Zz;return[a,{...c,metadata:{isSecret:!0}}]}))):await v(c,d,!1,0,!0,a===g.Zg.MCP_SERVERS?async(a,b)=>{let c=await (0,k.ZA)(a,b,s),d=(0,k.bM)(a,c,s),e=(0,m.od)(d,x.activeKey,r);if((0,m.ho)(e,x.activeKey,r)!==d)throw new n.Zz;return{format:k.ok,ciphertext:e}}:void 0);if(a===g.Zg.MCP_SERVERS&&e&&"object"==typeof e)for(let a of Object.values(e)){if(!a||"object"!=typeof a||Array.isArray(a))throw new n.Zz;a.disabled=!0}A.set(`${a}.json`,Buffer.from(JSON.stringify(e)))}if(A.set(`${g.Zg.ENCRYPTION_KEY}.json`,Buffer.from(JSON.stringify(z))),[...A.values()].reduce((a,b)=>a+b.length,0)>2*n.Ns)throw new n.Zz;l.signal?.throwIfAborted();let B=(0,j.getWorkspacesDir)();await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let C=await d.promises.lstat(B,{bigint:!0}),D=await d.promises.mkdtemp(f().join(B,".credential-transfer-")),E=await d.promises.lstat(D,{bigint:!0}),F=!1;try{for(let a of(await d.promises.chmod(D,448),j.WORKSPACE_SUBTREES))await d.promises.mkdir(f().join(D,a),{mode:448});for(let[a,b]of(await (0,o.sA)(D,f().join(D,".workspace.json"),Buffer.from('{"roots":[]}'),{mode:384}),A)){l.signal?.throwIfAborted(),await (0,o.sA)(D,f().join(D,"db",a),b,{mode:384});let c=await (0,h.b)(f().join(D,"db",a),{maxBytes:2*n.Ns,ownerOnly:!0});try{if(!c.equals(b))throw new n.Zz}finally{c.fill(0)}await l.checkpoint?.("file_written")}return await (0,j.withWorkspaceNamespaceMutation)(async()=>{l.signal?.throwIfAborted(),await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let a=await d.promises.lstat(B,{bigint:!0}),b=await d.promises.lstat(D,{bigint:!0});if(a.dev!==C.dev||a.ino!==C.ino||b.dev!==E.dev||b.ino!==E.ino||b.isSymbolicLink()||(await l.checkpoint?.("before_publish"),(await d.promises.readdir(B)).some(a=>a.toLowerCase()===s.toLowerCase())))throw new n.Zz;if(l.signal?.throwIfAborted(),await d.promises.rename(D,(0,j.getWorkspaceDir)(s)),F=!0,"win32"!==process.platform){let a=await d.promises.open(B,d.constants.O_RDONLY|d.constants.O_DIRECTORY|d.constants.O_NOFOLLOW|d.constants.O_NONBLOCK);try{let b=await a.stat({bigint:!0});if(!b.isDirectory()||b.dev!==C.dev||b.ino!==C.ino||b.mode!==C.mode||b.uid!==C.uid||b.gid!==C.gid)throw new n.Zz;await (0,o.V$)((0,i.ok)(),f().join(B,"probe"));let c=await d.promises.lstat(B,{bigint:!0});if(c.isSymbolicLink()||c.dev!==b.dev||c.ino!==b.ino)throw new n.Zz;await a.sync()}finally{await a.close()}}return s})}finally{for(let a of A.values())a.fill(0);if(!F){let a=await d.promises.lstat(D,{bigint:!0}).catch(()=>void 0);a&&a.isDirectory()&&!a.isSymbolicLink()&&a.dev===E.dev&&a.ino===E.ino&&f().dirname(D)===B&&f().basename(D).startsWith(".credential-transfer-")&&await d.promises.rm(D,{recursive:!0,force:!0})}}}},817492:(a,b,c)=>{c.d(b,{Hm:()=>f,xc:()=>e});let d=["key","secret","token","password"],e=a=>d.some(b=>a.toLowerCase().includes(b)),f=a=>e(a)||"authorization"===a.trim().toLowerCase()},838583:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{b:()=>x,f:()=>z});var e=c(973024),f=c(977598),g=c(907986),h=c(204983),i=c(879628),j=c(620775),k=c(683843),l=c(587301),m=a([h]);h=(m.then?(await m)():m)[0];let w=/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;class x extends Error{constructor(a,b,c){super(c),this.code=a,this.status=b,this.name="SnapshotCoordinatorError"}}let y=globalThis.__flujoWorkspaceSnapshotSessions??(globalThis.__flujoWorkspaceSnapshotSessions=new Map);function n(a){return{sessionId:a.sessionId,workspace:a.workspace,generation:a.generation,state:a.state,createdAt:new Date(a.createdAtMs).toISOString(),expiresAt:new Date(a.expiresAtMs).toISOString(),bytesStaged:a.bytesStaged,filesStaged:a.filesStaged,archiveBytes:a.archiveBytes,sha256:a.sha256,plaintextSha256:a.plaintextSha256,encrypted:a.encrypted,encryptionVersion:a.encryptionVersion,recipientKeyUsed:a.recipientKeyUsed,errorCode:a.errorCode,error:a.error}}function o(a){return"finalized"===a||"aborted"===a||"failed"===a}async function p(a){let b=a.stagingDir;a.archivePath=void 0,a.stagingDir=void 0,b&&await e.promises.rm(b,{recursive:!0,force:!0}).catch(()=>void 0)}function q(a){a.expiryTimer&&(clearTimeout(a.expiryTimer),a.expiryTimer=void 0)}async function r(a){o(a.state)||(q(a),a.abortRequested=!0,a.state="aborted",a.errorCode="SNAPSHOT_EXPIRED",a.controller.abort(Error("Snapshot session expired.")),await p(a))}async function s(a){Date.now()<=a.expiresAtMs||o(a.state)||await r(a)}async function t(a){let b=y.get(a);return b&&await s(b),b}function u(a,b){if(!w.test(b))throw new x("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");let c=y.get(a);if(!c||c.sessionId!==b)throw new x("SNAPSHOT_NOT_FOUND",404,"Snapshot session was not found.");return c}async function v(a){let b,c,{signal:d}=a.controller,e=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_CAPTURE_TIMEOUT_MS??"",10))||c<=0?3e4:Math.min(c,6e4),f=setTimeout(()=>{d.aborted||(a.abortRequested=!0,a.state="failed",a.errorCode="SNAPSHOT_TIMEOUT",q(a),a.controller.abort(Error("Workspace snapshot exceeded its capture time limit.")))},e);f.unref?.();try{b=await (0,i.Ns)(async c=>(a.generation=c,d.throwIfAborted(),a.state="staging",b=await (0,h.QO)(a.workspace,c,{signal:d,flowIds:a.flowIds,recipientKey:a.recipientKey})),{workspace:a.workspace,timeoutMs:e,signal:d}),d.throwIfAborted(),a.bytesStaged=b.bytes,a.filesStaged=b.files,clearTimeout(f);let c=await (0,h.TH)(b,{signal:d});if(a.archivePath=c.archivePath,a.stagingDir=c.stagingDir,a.archiveBytes=c.size,a.sha256=c.sha256,a.plaintextSha256=c.plaintextSha256,a.encrypted=c.encrypted,a.encryptionVersion=c.encryptionVersion??+!!c.encrypted,a.recipientKeyUsed=c.recipientKeyUsed??!1,a.recipientKey=void 0,await b.dispose?.(),b=void 0,a.abortRequested){"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"),await p(a);return}a.state="ready"}catch(b){a.abortRequested?"SNAPSHOT_TIMEOUT"!==a.errorCode&&(a.state="aborted"):(a.state="failed",q(a),a.errorCode=b instanceof h.XV?b.code:b instanceof Error&&"WorkspaceSnapshotBusyError"===b.name?"SNAPSHOT_BUSY":b instanceof Error&&"WorkspaceSnapshotTimeoutError"===b.name?"SNAPSHOT_TIMEOUT":"SNAPSHOT_FAILED",a.error=b instanceof h.XV?b.message:void 0),await p(a)}finally{a.recipientKey=void 0,clearTimeout(f),await b?.dispose?.().catch(()=>void 0)}}let z={async info(a=(0,g.getCurrentWorkspace)()){let b=(0,g.normalizeWorkspaceName)(a),c=await t(b),d=(0,i.B7)(b),e=c&&!o(c.state)?n(c):null;return{workspace:b,layoutVersion:j.q,workerCompatibility:(0,k.d1)(),capability:e||d.blocked?"busy":"available",coherence:"registered-flujo-writers",externalRootsIncluded:!1,activeOperation:e}},async begin(a=(0,g.getCurrentWorkspace)(),b={}){let c;void 0!==b.recipientKey&&(0,h.Eq)(b.recipientKey)?.fill(0);let d=(0,g.normalizeWorkspaceName)(a),e=y.get(d);if(e&&!o(e.state)&&Date.now()<=e.expiresAtMs)throw new x("SNAPSHOT_BUSY",409,"A snapshot is already active for this workspace.");e&&(o(e.state)?(q(e),p(e)):r(e));let j=Date.now(),k=!Number.isSafeInteger(c=Number.parseInt(process.env.FLUJO_SNAPSHOT_SESSION_TTL_MS??"",10))||c<=0?9e5:Math.min(c,36e5),l={sessionId:(0,f.randomUUID)(),workspace:d,generation:(0,i.B7)(d).generation,state:"beginning",createdAtMs:j,expiresAtMs:j+k,bytesStaged:0,filesStaged:0,abortRequested:!1,controller:new AbortController,flowIds:b.flowIds?[...b.flowIds]:void 0,recipientKey:b.recipientKey,encryptionVersion:2*(void 0!==b.recipientKey||void 0!==process.env.FLUJO_WORKER_SNAPSHOT_KEY)};y.set(d,l);let m=setTimeout(()=>{(0,g.runWithWorkspace)(d,async()=>{await r(l)})},k);return m.unref?.(),l.expiryTimer=m,(0,g.runWithWorkspace)(d,()=>v(l)),n(l)},async status(a,b=(0,g.getCurrentWorkspace)()){let c=u((0,g.normalizeWorkspaceName)(b),a);return await s(c),n(c)},async readDownload(a,b=(0,g.getCurrentWorkspace)()){let c,d=u((0,g.normalizeWorkspaceName)(b),a);if(await s(d),"SNAPSHOT_EXPIRED"===d.errorCode)throw new x("SNAPSHOT_EXPIRED",410,"Snapshot session has expired.");if("ready"!==d.state||!d.archivePath||!d.sha256||void 0===d.archiveBytes)throw new x("SNAPSHOT_NOT_READY",409,"Snapshot archive is not ready.");try{c=await (0,l.t)(d.archivePath,d.archiveBytes,d.sha256,d.controller.signal,()=>{if("ready"!==d.state||Date.now()>d.expiresAtMs)throw Error("Snapshot session is no longer available.")})}catch{throw d.state="failed",d.errorCode="SNAPSHOT_INTEGRITY",await p(d),new x("SNAPSHOT_INTEGRITY",500,"Snapshot archive failed its integrity check.")}return{content:c,sha256:d.sha256,plaintextSha256:d.plaintextSha256??d.sha256,encrypted:d.encrypted??!1,encryptionVersion:d.encryptionVersion??0,recipientKeyUsed:d.recipientKeyUsed??!1,size:d.archiveBytes}},async finalize(a,b=(0,g.getCurrentWorkspace)()){let c=u((0,g.normalizeWorkspaceName)(b),a);if(await s(c),"finalized"===c.state)return n(c);if("ready"!==c.state)throw new x("SNAPSHOT_NOT_READY",409,"Only a ready snapshot can be finalized.");return q(c),await p(c),c.state="finalized",n(c)},async abort(a,b=(0,g.getCurrentWorkspace)()){let c=u((0,g.normalizeWorkspaceName)(b),a);if("aborted"===c.state)return n(c);if("finalized"===c.state)throw new x("SNAPSHOT_NOT_READY",409,"A finalized snapshot cannot be aborted.");return q(c),c.abortRequested=!0,c.state="aborted",c.controller.abort(Error("Snapshot session was aborted.")),await p(c),n(c)}};d()}catch(a){d(a)}})},845223:(a,b,c)=>{c.d(b,{ZA:()=>l,bM:()=>g,eC:()=>j,ok:()=>e,rr:()=>k});var d=c(88169);let e="flujo-oauth-v1",f=a=>!!a&&"object"==typeof a&&!Array.isArray(a),g=d.rt;function h(a){return f(a)&&(a.format===e||Object.hasOwn(a,"format")&&Object.hasOwn(a,"ciphertext")&&2===Object.keys(a).length)}async function i(a,b,c,d=0){if(d>100)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");if("string"==typeof a){if(c)return a;if(a.startsWith("encrypted_failed:"))return a.slice(17);let d=a.startsWith("encrypted:")?a.slice(10):a.startsWith("v2:")||/^[a-f0-9]{32}:[A-Za-z0-9+/]+={0,2}$/.test(a)?a:void 0;return void 0===d?a:b(d)}return Array.isArray(a)?Promise.all(a.map(a=>i(a,b,c,d+1))):f(a)?c&&1===a.$flujoCredential&&"string"==typeof a.plaintext&&2===Object.keys(a).length?a.plaintext:Object.fromEntries(await Promise.all(Object.entries(a).map(async([a,e])=>[a,await i(e,b,c,d+1)]))):a}async function j(a,b,c,j){if(h(b)){let g;if(!f(b)||2!==Object.keys(b).length||b.format!==e||"string"!=typeof b.ciphertext||!b.ciphertext.startsWith("v2:")||Buffer.byteLength(b.ciphertext)>524288)throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g=await j(b.ciphertext),(0,d.s6)(a,g,c)}let k=await i(b,j,!1);return g(a,k,c),k}function k(a,b,c){return g(a,b,c),{$flujoOAuth:1,kind:a,value:b}}async function l(a,b,c){if(f(b)&&1===b.$flujoOAuth){if(3!==Object.keys(b).length||b.kind!==a||!Object.hasOwn(b,"value"))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");return g(a,b.value,c),b.value}if(h(b))throw Error("OAuth credentials are malformed or belong to another workspace or purpose.");let d=await i(b,async()=>{throw Error("OAuth credentials are malformed or belong to another workspace or purpose.")},!0);return g(a,d,c),d}},882980:(a,b,c)=>{c.d(b,{H6:()=>h,Mt:()=>e,SL:()=>g,UQ:()=>f,ZW:()=>d});let d="MCP_TRANSPORT_INVALID";function e(a){return"stdio"===a||"streamable"===a||"sse"===a||"websocket"===a}class f extends Error{constructor(){super(d),this.name="McpTransportError"}}function g(a){if(!e(a.transport))throw new f}function h(a){if(void 0===a)return"stdio";if(!e(a))throw new f;return a}},989481:(a,b,c)=>{c.d(b,{Ns:()=>i,XM:()=>m,Zz:()=>j,of:()=>l});var d=c(977598),e=c(257975),f=c(851018);let g=(0,e.promisify)(d.pbkdf2),h=Buffer.from("FLUJOT01"),i=0x2000000;class j extends Error{constructor(){super("Invalid transfer or recipient passphrase."),this.name="RecipientTransferError"}}function k(a){if("string"!=typeof a||a===f.Gr||a.length<16||Buffer.byteLength(a,"utf8")>1024)throw new j}async function l(a,b){if(k(b),!a.byteLength||a.byteLength>i)throw new j;let c=Buffer.alloc(40);h.copy(c),(0,d.randomBytes)(16).copy(c,8),(0,d.randomBytes)(12).copy(c,24),c.writeUInt32BE(a.byteLength,36);let e=await g(b,c.subarray(8,24),f.fn,32,"sha256");try{let b=(0,d.createCipheriv)("aes-256-gcm",e,c.subarray(24,36));return b.setAAD(c),Buffer.concat([c,b.update(a),b.final(),b.getAuthTag()])}finally{e.fill(0)}}async function m(a,b){let c;if(k(b),a.byteLength<57||a.byteLength>56+i)throw new j;let e=Buffer.from(a),l=e.subarray(0,40);if(!l.subarray(0,8).equals(h)||l.readUInt32BE(36)!==e.length-40-16)throw new j;let m=await g(b,l.subarray(8,24),f.fn,32,"sha256");try{let a=(0,d.createDecipheriv)("aes-256-gcm",m,l.subarray(24,36));a.setAAD(l),a.setAuthTag(e.subarray(-16)),c=a.update(e.subarray(40,-16));let b=a.final();return Buffer.concat([c,b])}catch{throw new j}finally{c?.fill(0),m.fill(0),e.fill(0)}}}};

package/.next/server/chunks/81306.js

@@ -1 +1 @@
-"use strict";exports.id=81306,exports.ids=[81306],exports.modules={186359:(a,b,c)=>{c.d(b,{fI:()=>e,B5:()=>g});let d=JSON.parse('{"e":{"format":"flujo-workspace-encrypted","cipher":"aes-256-gcm","writeVersion":2,"readVersions":[1,2],"legacyPlaintextRead":true,"recipientKeyRequired":true,"recipientKeyBytes":32,"recipientKeyEncoding":"base64","v2Aad":"flujo:workspace-snapshot:v2","v2Digest":"sha256-encrypted-wire","v1Digest":"sha256-plaintext-zip"},"R":{"maxFileBytes":268435456,"maxUncompressedBytes":1073741824,"maxManifestBytes":8388608,"maxArchiveBytes":1082130432,"maxEncryptedBytes":1442844672,"maxMembers":65534}}'),e=d.e,f=d.R;function g(){let a=(a,b)=>{let c=process.env[a];if(void 0===c)return b;let d=Number(c);if(!/^[1-9]\d*$/.test(c)||!Number.isSafeInteger(d))throw Error("Snapshot limits are invalid.");return d},b=a("FLUJO_SNAPSHOT_MAX_FILE_BYTES",f.maxFileBytes),c=a("FLUJO_SNAPSHOT_MAX_BYTES",f.maxUncompressedBytes),d=c+f.maxManifestBytes,e=4*Math.ceil(d/3)+4096;if(!Number.isSafeInteger(d)||!Number.isSafeInteger(e))throw Error("Snapshot limits are invalid.");return{...f,maxFileBytes:b,maxUncompressedBytes:c,maxArchiveBytes:d,maxEncryptedBytes:e}}},381306:(a,b,c)=>{c.r(b),c.d(b,{restoreConfiguredWorkerSnapshot:()=>N,unlockWorkerSnapshot:()=>L,verifyWorkerCodexAuth:()=>J});var d=c(973024),e=c(100629),f=c(977598),g=c(186359),h=c(621385),i=c(157075),j=c(638522);let k=()=>Error("Invalid snapshot ZIP structure or member integrity."),l=Array.from({length:256},(a,b)=>{let c=b;for(let a=0;a<8;a++)c=c>>>1^(1&c?0xedb88320:0);return c>>>0});async function m(a,b,c,d){let e=await a.read(Math.max(0,a.size-65557),Math.min(a.size,65557)),f=-1;for(let a=e.length-22;a>=0;a--)if(0x6054b50===e.readUInt32LE(a)&&a+22+e.readUInt16LE(a+20)===e.length){f=a;break}if(f<0)throw k();let g=a.size-e.length+f,h=e.readUInt16LE(f+10),i=e.readUInt32LE(f+12),j=e.readUInt32LE(f+16);if(e.readUInt16LE(f+4)||e.readUInt16LE(f+6)||e.readUInt16LE(f+8)!==h||65535===h||h>65534||j+i!==g)throw k();let l=new Map,m=[],n=[],o=j,p=0;for(let e=0;e<h;e++){if(o+46>g)throw k();let e=await a.read(o,46);if(0x2014b50!==e.readUInt32LE(0))throw k();let f=e.readUInt16LE(8),h=e.readUInt16LE(10),i=e.readUInt32LE(20),q=e.readUInt32LE(24),r=e.readUInt16LE(28),s=o+46+r+e.readUInt16LE(30)+e.readUInt16LE(32);if(1&f||0!==e.readUInt16LE(34)||![0,8].includes(h)||s>g||0xffffffff===i||0xffffffff===q)throw k();let t=await a.read(o+46,r),u=new TextDecoder("utf-8",{fatal:!0}).decode(t),v=u.endsWith("/"),w=d(u,v).normalize("NFC").toLowerCase();if(l.has(w))throw Error("Snapshot contains duplicate or case-aliased archive paths.");l.set(w,v);let x=e.readUInt32LE(38)>>>16,y=61440&x;if(y&&y!==(v?16384:32768))throw Error("Snapshot links and special files are unsupported.");if(q>("snapshot-manifest.json"===u?8388608:b)||v&&0!==q)throw Error("Snapshot file exceeds the restore size limit.");if((p+=q)>c+8388608)throw Error("Snapshot exceeds the restore size limit.");let z=e.readUInt32LE(42);if(z+30>j)throw k();let A=await a.read(z,30);if(0x4034b50!==A.readUInt32LE(0)||A.readUInt16LE(6)!==f||A.readUInt16LE(8)!==h||A.readUInt16LE(26)!==r)throw k();let B=z+30+r+A.readUInt16LE(28);if(B+i>j||!(await a.read(z+30,r)).equals(t))throw k();let C=e.readUInt32LE(16);if(!(8&f)&&(A.readUInt32LE(14)!==C||A.readUInt32LE(18)!==i||A.readUInt32LE(22)!==q))throw k();let D=B+i;if(8&f){if(D+12>j)throw k();let b=0x8074b50===(await a.read(D,4)).readUInt32LE(0),c=await a.read(D+4*!!b,12);if(c.readUInt32LE(0)!==C||c.readUInt32LE(4)!==i||c.readUInt32LE(8)!==q||(D+=b?16:12)>j)throw k()}n.push({start:z,end:D}),m.push({name:u,directory:v,size:q,mode:x,crc:C,method:h,offset:B,compressed:i}),o=s}if(o!==g)throw k();n.sort((a,b)=>a.start-b.start);for(let a=1;a<n.length;a++)if(n[a].start<n[a-1].end)throw k();for(let a of m){let b=d(a.name,a.directory).split("/");for(let a=1;a<b.length;a++)if(!1===l.get(b.slice(0,a).join("/").normalize("NFC").toLowerCase()))throw Error("Snapshot contains a file/directory path conflict.")}return m}async function*n(a,b){let c=i.Readable.from(a.range(b.offset,b.compressed),{objectMode:!1,highWaterMark:65536}),d=8===b.method?(0,j.createInflateRaw)():void 0,e=d?c.pipe(d):c;e!==c&&c.on("error",a=>e.destroy(a));let f=0,g=0xffffffff;try{for await(let a of e){let c=Buffer.isBuffer(a)?a:Buffer.from(a);if((f+=c.length)>b.size)throw k();for(let a of c)g=g>>>8^l[(g^a)&255];yield c}if(f!==b.size||(0xffffffff^g)>>>0!==b.crc||d&&d.bytesWritten!==b.compressed)throw k()}finally{c.destroy(),e.destroy()}}var o=c(176760),p=c.n(o),q=c(739006),r=c(134887),s=c(930100),t=c(851018),u=c(907986),v=c(719031),w=c(472178),x=c(620775),y=c(683843),z=c(580940);let A="snapshot-manifest.json",B=".flujo-worker-snapshot.json",C=/^[a-f0-9]{64}$/;function D(a){return"object"==typeof a&&null!==a&&!Array.isArray(a)}function E(a,b){try{return JSON.parse(a)}catch{throw Error(b)}}function F(a,b=!1){let c=b?a.replace(/\/$/,""):a,d=c.split("/");if(!c||c.includes("\\")||c.includes("\0")||d.some(a=>!a||"."===a||".."===a||a.includes(":")||/[. ]$/.test(a)||/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(a)))throw Error("Snapshot contains an unsafe archive path.");if(c!==A&&".workspace.json"!==c&&!u.WORKSPACE_SUBTREES.includes(d[0]))throw Error("Snapshot contains a file outside the supported workspace roots.");if(b&&(c===A||".workspace.json"===c))throw Error("Snapshot metadata must be a file.");if(!b&&u.WORKSPACE_SUBTREES.includes(c))throw Error("Snapshot workspace roots must be directories.");return c}async function G(a,b=!1){b&&await d.promises.mkdir(a,{recursive:!0,mode:448});let c=await d.promises.lstat(a);if(!c.isDirectory()||c.isSymbolicLink())throw Error("Worker restore destination must be a plain directory.")}async function H(a){try{return await d.promises.lstat(a)}catch(a){if("ENOENT"===a.code)return null;throw a}}async function I(a){await G(a);let b=await d.promises.readdir(a,{withFileTypes:!0});for(let c of b)if(!u.WORKSPACE_SUBTREES.includes(c.name)||!c.isDirectory()||c.isSymbolicLink()||0!==(await d.promises.readdir(p().join(a,c.name))).length)throw Error("Worker snapshot restore refuses to overwrite an existing workspace.");for(let c of b)await d.promises.rmdir(p().join(a,c.name));await d.promises.rmdir(a)}async function J(a,b=(0,u.getWorkspaceDir)(a.workspace)){if("chatgpt"!==a.codexAuth)return;let c=p().join(b,"db","codex-runtime"),f=[];for(let a of["auth.json","flujo-auth-source.json"]){let g=await d.promises.lstat(p().join(c,a),{bigint:!0});if(!g.isFile()||g.isSymbolicLink()||g.nlink>BigInt(1)||g.size>BigInt(1048576))throw Error("Worker Codex authentication is not a valid workspace credential file.");let h=p().join(c,a);f.push(await (0,e.b)(h,{expected:g,maxBytes:1048576,verifyPath:()=>(0,w.V$)(b,h)}))}let[g,h]=f,i=E(h.toString("utf8"),"Worker Codex authentication marker is invalid.");if(!(0,v.eK)(g)||!D(i)||1!==i.version||"workspace"!==i.source)throw Error("Worker Codex ChatGPT authentication is missing or invalid.")}async function K(a,b=(0,u.getWorkspaceDir)(a.workspace)){if("user"!==a.encryption)return null;let c=p().join(b,"db","worker-bootstrap-secrets.json"),f=await d.promises.lstat(c,{bigint:!0});if(!f.isFile()||f.isSymbolicLink()||f.nlink>BigInt(1)||f.size>BigInt(4096))throw Error("Worker workspace encryption requires valid bootstrap credentials.");if("win32"!==process.platform&&(f.mode&BigInt(63))!==BigInt(0))throw Error("Worker workspace encryption credentials must be owner-only.");let g=E((await (0,e.b)(c,{expected:f,maxBytes:4096,ownerOnly:!0,verifyPath:()=>(0,w.V$)(b,c)})).toString("utf8"),"Worker workspace encryption bootstrap credentials are invalid.");if(!D(g)||1!==g.version||"string"!=typeof g.workspaceDek||!(0,t.TE)(g.workspaceDek))throw Error("Worker workspace encryption bootstrap credentials are invalid.");return g.workspaceDek}async function L(a){if((0,u.getCurrentWorkspace)()!==a.workspace)throw Error("Worker encryption unlock workspace mismatch.");let b=await K(a);b&&await (0,s.SO)(b,{workspace:a.workspace,root:(0,u.getWorkspaceDir)(a.workspace)})}async function M(a,b){(0,z.Vv)({state:"restoring",archiveSha256:b,error:void 0});let c=(0,g.B5)(),i=c.maxFileBytes,j=c.maxUncompressedBytes,k=await (0,h.z)(a,process.env.FLUJO_WORKER_SNAPSHOT_KEY,c.maxArchiveBytes,b);try{let a=await m(k,i,j,F),c=a.find(a=>a.name===A&&!a.directory);if(!c)throw Error("Worker snapshot manifest is missing.");let g=[];for await(let a of n(k,c))g.push(a);let h=function(a){if(!D(a)||a.formatVersion!==y.nt||a.layoutVersion!==x.q||!1!==a.externalRootsIncluded||!D(a.source)||a.source.version!==q.rE||"string"!=typeof a.source.platform||!D(a.runtime)||!D(a.runtime.mcpTransfer)||1!==a.runtime.mcpTransfer.formatVersion||"string"!=typeof a.runtime.mcpTransfer.sourceWorkspaceRoot||!Array.isArray(a.runtime.mcpTransfer.servers)||!["chatgpt","none"].includes(a.runtime.codexAuth)||!["default","user"].includes(a.runtime.encryption)||!Array.isArray(a.files)||!Array.isArray(a.subtrees)||a.subtrees.length!==u.WORKSPACE_SUBTREES.length||u.WORKSPACE_SUBTREES.some(b=>!a.subtrees.includes(b)))throw Error("Snapshot format, FLUJO version, layout, or portable runtime metadata is incompatible.");return(0,u.assertValidWorkspaceName)(a.workspace),a}(E(Buffer.concat(g).toString("utf8"),"Worker snapshot manifest is invalid JSON.")),l={workspace:h.workspace,archiveSha256:b,mcpTransfer:h.runtime.mcpTransfer,codexAuth:h.runtime.codexAuth,encryption:h.runtime.encryption};(0,z.Vv)({workspace:l.workspace});let o=new Map,s=0;for(let a of h.files){if(!D(a)||"string"!=typeof a.path||a.path===A||!Number.isSafeInteger(a.size)||a.size<0||a.size>i||"string"!=typeof a.sha256||!C.test(a.sha256))throw Error("Invalid snapshot manifest member.");if(F(a.path),o.has(a.path))throw Error("Snapshot manifest has duplicate members.");if((s+=a.size)>j)throw Error("Snapshot manifest exceeds the restore size limit.");o.set(a.path,a)}for(let b of a){if(b.name===A)continue;let a=b.directory?void 0:o.get(b.name);if(!b.directory&&(!a||a.size!==b.size))throw Error("Snapshot archive does not match its manifest.");let c=(0,f.createHash)("sha256");for await(let a of n(k,b))c.update(a);if(a&&c.digest("hex")!==a.sha256)throw Error("Snapshot member integrity check failed.");b.directory||o.delete(b.name)}if(o.size)throw Error("Snapshot archive is missing a manifest member.");await G((0,r.ok)(),!0),await G((0,u.getWorkspacesDir)(),!0);let t=(0,u.getWorkspaceDir)(l.workspace);if((await d.promises.readdir((0,u.getWorkspacesDir)())).filter(a=>a.toLowerCase()===l.workspace.toLowerCase()).some(a=>a!==l.workspace))throw Error("Worker workspace has a case-alias conflict.");let v=await H(t);if(v){await G(t);let a=p().join(t,B);if(await H(a)){let c=await d.promises.lstat(a,{bigint:!0});if(!c.isFile()||c.isSymbolicLink()||c.nlink>BigInt(1)||c.size>BigInt(4096))throw Error("Invalid worker restore marker.");let f=E((await (0,e.b)(a,{expected:c,maxBytes:4096,verifyPath:()=>(0,w.V$)(t,a)})).toString("utf8"),"Worker restore marker is invalid.");if(!D(f)||1!==f.formatVersion||f.archiveSha256!==b||f.workspace!==l.workspace)throw Error("Worker snapshot does not match the existing workspace.");return await J(l),await K(l),l}}let L=await d.promises.mkdtemp(p().join((0,u.getWorkspacesDir)(),".worker-restore-")),M=!1;try{for(let a of(await d.promises.chmod(L,448),u.WORKSPACE_SUBTREES))await d.promises.mkdir(p().join(L,a),{mode:448});for(let b of a.filter(a=>a.directory))await d.promises.mkdir(p().join(L,...F(b.name,!0).split("/")),{recursive:!0,mode:448});for(let b of a){if(b.directory||b.name===A)continue;let a=p().join(L,...b.name.split("/"));await d.promises.mkdir(p().dirname(a),{recursive:!0,mode:448}),await (0,w.V$)(L,a);let c=await d.promises.open(a,"wx",73&b.mode?448:384);try{if(".workspace.json"===b.name)await c.writeFile('{"roots":[]}\n');else for await(let a of n(k,b))for(let b=0;b<a.length;){let{bytesWritten:d}=await c.write(a,b,a.length-b);if(!d)throw Error("Worker restore write made no progress.");b+=d}await c.sync()}finally{await c.close()}}if(await J(l,L),await K(l,L),await (0,w.sA)(L,p().join(L,B),Buffer.from(JSON.stringify({formatVersion:1,workspace:l.workspace,archiveSha256:b}))),v)await I(t);else if(await H(t))throw Error("Worker restore destination was created concurrently.");return await d.promises.rename(L,t),M=!0,await J(l),l}finally{M||await d.promises.rm(L,{recursive:!0,force:!0})}}finally{await k.close()}}function N(){if(!(0,z.ye)())return Promise.resolve(null);let a=process.env.FLUJO_WORKER_SNAPSHOT?.trim(),b=process.env.FLUJO_WORKER_SNAPSHOT_SHA256?.trim().toLowerCase();if(!a||!b||!C.test(b)||!p().isAbsolute(a)){let a="Worker mode requires an absolute FLUJO_WORKER_SNAPSHOT path and FLUJO_WORKER_SNAPSHOT_SHA256.";return(0,z.Vv)({state:"error",error:a}),Promise.reject(Error(a))}let c=(0,f.createHash)("sha256").update(process.env.FLUJO_WORKER_SNAPSHOT_KEY??"").digest("hex"),d=`${(0,u.getWorkspacesDir)()}\0${a}\0${b}\0${c}`;if(global.__flujo_worker_snapshot_restore?.key===d)return global.__flujo_worker_snapshot_restore.promise;let e=M(a,b).catch(a=>{throw(0,z.Vv)({state:"error",error:a instanceof Error?a.message:"Worker restore failed."}),global.__flujo_worker_snapshot_restore?.promise===e&&(global.__flujo_worker_snapshot_restore=void 0),a});return global.__flujo_worker_snapshot_restore={key:d,promise:e},e}},621385:(a,b,c)=>{c.d(b,{N:()=>o,z:()=>r});var d=c(973024),e=c(977598),f=c(848161),g=c(176760),h=c.n(g),i=c(186359);let j=["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"],k=(a,b)=>j.every(c=>a[c]===b[c]),l=()=>Error("Worker snapshot is unsafe or changed while being read.");async function m(a,b){for(let c=0;c<b.length;){let{bytesWritten:d}=await a.write(b,c,b.length-c);if(!d)throw l();c+=d}}async function n(a,b,c,d){let e=d?d.subarray(0,c):Buffer.alloc(c);if(e.length!==c)throw l();for(let d=0;d<c;){let{bytesRead:f}=await a.read(e,d,c-d,b+d);if(!f)throw l();d+=f}return e}class o{constructor(a,b){this.root=a,this.file=b,this.size=0,this.key=(0,e.randomBytes)(32),this.pending=Buffer.alloc(0),this.blocks=[],this.diskSize=0,this.sealed=Buffer.alloc(65564),this.readTail=Promise.resolve()}static async create(){let a=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-input-"));try{return await d.promises.chmod(a,448),new o(a,await d.promises.open(h().join(a,"ciphertext"),"wx+",384))}catch(b){throw await d.promises.rm(a,{recursive:!0,force:!0}),b}}async append(a){this.size+=a.length;let b=this.pending.length?Buffer.concat([this.pending,a]):a;for(;b.length>=65536;)await this.seal(b.subarray(0,65536)),b=b.subarray(65536);this.pending=Buffer.from(b)}async seal(a){let b=(0,e.randomBytes)(12),c=(0,e.createCipheriv)("aes-256-gcm",this.key,b);c.setAAD(Buffer.from(`${this.blocks.length}:${a.length}`));let d=c.update(a),f=c.final();b.copy(this.sealed),c.getAuthTag().copy(this.sealed,12),d.copy(this.sealed,28),f.copy(this.sealed,28+d.length),await m(this.file,this.sealed.subarray(0,a.length+28)),this.blocks.push({offset:this.diskSize,length:a.length}),this.diskSize+=a.length+28}async finish(){this.pending.length&&await this.seal(this.pending),this.pending.fill(0),this.pending=Buffer.alloc(0),await this.file.sync()}async read(a,b){let c,d=this.readTail;this.readTail=new Promise(a=>{c=a}),await d;try{return await this.readOwned(a,b)}finally{c()}}async readOwned(a,b){if(!Number.isSafeInteger(a)||!Number.isSafeInteger(b)||a<0||b<0||a+b>this.size||b>8388608)throw l();let c=Buffer.alloc(b);for(let d=0;d<b;){let f=Math.floor((a+d)/65536),g=this.blocks[f];if(!g)throw l();if(this.cache?.index!==f){this.cache?.bytes.fill(0);let a=await n(this.file,g.offset,g.length+28,this.sealed),b=(0,e.createDecipheriv)("aes-256-gcm",this.key,a.subarray(0,12));b.setAAD(Buffer.from(`${f}:${g.length}`)),b.setAuthTag(a.subarray(12,28));let c=b.update(a.subarray(28)),d=b.final();this.cache={index:f,bytes:d.length?Buffer.concat([c,d]):c}}let h=(a+d)%65536,i=Math.min(b-d,g.length-h);this.cache.bytes.copy(c,d,h,h+i),d+=i}return c}async *range(a=0,b=this.size-a){for(let c=0;c<b;c+=65536)yield await this.read(a+c,Math.min(65536,b-c))}async close(){for(let a of(this.key.fill(0),this.pending.fill(0),this.cache?.bytes.fill(0),this.sealed.fill(0),[...await Promise.allSettled([this.file.close()]),...await Promise.allSettled([d.promises.rm(this.root,{recursive:!0,force:!0})])]))if("rejected"===a.status)throw a.reason}}class p{constructor(a,b){this.file=a,this.size=b,this.storage=Buffer.alloc(65536),this.buffer=Buffer.alloc(0),this.offset=0,this.position=0}async fill(){return this.offset<this.buffer.length||this.position!==this.size&&(this.buffer=await n(this.file,this.position,Math.min(65536,this.size-this.position),this.storage),this.position+=this.buffer.length,this.offset=0,!0)}async peek(){return await this.fill()?this.buffer[this.offset]:-1}async byte(){let a=await this.peek();return -1!==a&&this.offset++,a}async whitespace(){for(;[9,10,13,32].includes(await this.peek());)await this.byte()}async expect(a){if(await this.whitespace(),await this.byte()!==a)throw l()}async smallValue(){await this.whitespace();let a=[],b=await this.peek()===34;b&&a.push(await this.byte());let c=!1;for(;a.length<256;){let d=await this.peek();if(-1===d)throw l();if(!b&&[44,125,9,10,13,32].includes(d)||(a.push(await this.byte()),b&&34===d&&!c))break;c=92===d&&!c}if(256===a.length)throw l();try{return JSON.parse(Buffer.from(a).toString("utf8"))}catch{throw l()}}async data(a,b){await this.expect(34);let c="",d=!1,e=0,f=async f=>{if(!/^[A-Za-z0-9+/=]*$/.test(f)||d&&f.length)throw l();let g=(c+=f).length-c.length%4;if(!g)return;let h=c.slice(0,g);if(!/^[A-Za-z0-9+/]*={0,2}$/.test(h))throw l();let i=Buffer.from(h,"base64");if(i.toString("base64")!==h||(d=h.includes("="),(e+=i.length)>b))throw l();await m(a,i),c=c.slice(g)};for(;await this.fill();){let a=this.buffer.indexOf(34,this.offset),b=this.buffer.indexOf(92,this.offset),d=Math.min(a<0?this.buffer.length:a,b<0?this.buffer.length:b);if(await f(this.buffer.subarray(this.offset,d).toString("latin1")),this.offset=d,d===this.buffer.length)continue;if(34===await this.byte()){if(c.length)throw l();return e}let g=await this.byte();if(117===g){let a="";for(let b=0;b<4;b++){let b=await this.byte();if(b<0)throw l();a+=String.fromCharCode(b)}if(!/^[0-9a-fA-F]{4}$/.test(a))throw l();await f(String.fromCharCode(Number.parseInt(a,16)))}else{let a=new Map([[34,'"'],[92,"\\"],[47,"/"],[98,"\b"],[102,"\f"],[110,"\n"],[114,"\r"],[116,"	"]]).get(g);if(void 0===a)throw l();await f(a)}}throw l()}}function q(a,b){if("string"!=typeof a||a.length>64)throw l();let c=Buffer.from(a,"base64");if(c.length!==b||c.toString("base64")!==a)throw l();return c}async function r(a,b,c,g){let j,m,r,s,t=await d.promises.lstat(a,{bigint:!0}),u=void 0===b?c:4*Math.ceil(c/3)+4096;if(!t.isFile()||t.isSymbolicLink()||t.nlink!==BigInt(1)||t.size>BigInt(u))throw l();let v=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),w=!1,x=0,y=(0,e.createHash)("sha256");try{let u=j=await o.create();if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();let z=Buffer.alloc(65536);for(let a=0;a<Number(t.size);a+=65536)y.update(await n(v,a,Math.min(65536,Number(t.size)-a),z));let A=(0,e.createHash)("sha256"),B=async a=>{if(u.size+a.length>c)throw l();A.update(a),await u.append(a)};if(void 0!==b)try{s=q(b,32),m=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-envelope-")),await d.promises.chmod(m,448),r=await d.promises.open(h().join(m,"ciphertext"),"wx+",384);let a=new p(v,Number(t.size)),g=new Map,j=-1;for(await a.expect(123);;){let b=await a.smallValue();if("string"!=typeof b||!["format","version","iv","tag","data"].includes(b)||g.has(b))throw l();await a.expect(58),g.set(b,"data"===b||await a.smallValue()),"data"===b&&(j=await a.data(r,c)),await a.whitespace();let d=await a.byte();if(125===d)break;if(44!==d)throw l()}if(await a.whitespace(),await a.byte()!==-1||5!==g.size||"flujo-workspace-encrypted"!==g.get("format")||![1,2].includes(g.get("version"))||j<0)throw l();x=g.get("version");let k=(0,e.createDecipheriv)("aes-256-gcm",s,q(g.get("iv"),12));2===x&&k.setAAD(Buffer.from(i.fI.v2Aad)),k.setAuthTag(q(g.get("tag"),16));for(let a=0;a<j;a+=65536)await B(k.update(await n(r,a,Math.min(65536,j-a),z)));await B(k.final())}catch{throw Error("Worker snapshot decryption failed. Check the encrypted archive and its key.")}else for(let a=0;a<Number(t.size);a+=65536)await B(await n(v,a,Math.min(65536,Number(t.size)-a),z));let C=A.digest("hex");if((2===x?y.digest("hex"):C)!==g)throw Error("Worker snapshot SHA-256 mismatch.");if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();return await u.finish(),w=!0,u}catch(a){throw await j?.close().catch(()=>void 0),a}finally{s?.fill(0);let a=await Promise.allSettled([v.close(),...r?[r.close()]:[]]),b=await Promise.allSettled(m?[d.promises.rm(m,{recursive:!0,force:!0})]:[]);if(w&&[...a,...b].some(a=>"rejected"===a.status))throw await j?.close().catch(()=>void 0),Error("Snapshot temporary storage could not be released.")}}},683843:(a,b,c)=>{c.d(b,{d1:()=>h,nt:()=>g});var d=c(739006),e=c(186359),f=c(620775);let g=2;function h(){let a=process.env.FLUJO_BUILD_REVISION;return{applicationVersion:d.rE,snapshotEncryption:{...e.fI,readVersions:[...e.fI.readVersions]},snapshotLimits:(0,e.B5)(),snapshotFormatVersion:g,layoutVersion:f.q,workerProtocolVersion:1,workerSnapshotSourceVersion:1,.../^[a-f0-9]{40}$/.test(a??"")?{revision:a}:{}}}},739006:a=>{a.exports={rE:"3.48.6"}}};
+"use strict";exports.id=81306,exports.ids=[81306],exports.modules={186359:(a,b,c)=>{c.d(b,{fI:()=>e,B5:()=>g});let d=JSON.parse('{"e":{"format":"flujo-workspace-encrypted","cipher":"aes-256-gcm","writeVersion":2,"readVersions":[1,2],"legacyPlaintextRead":true,"recipientKeyRequired":true,"recipientKeyBytes":32,"recipientKeyEncoding":"base64","v2Aad":"flujo:workspace-snapshot:v2","v2Digest":"sha256-encrypted-wire","v1Digest":"sha256-plaintext-zip"},"R":{"maxFileBytes":268435456,"maxUncompressedBytes":1073741824,"maxManifestBytes":8388608,"maxArchiveBytes":1082130432,"maxEncryptedBytes":1442844672,"maxMembers":65534}}'),e=d.e,f=d.R;function g(){let a=(a,b)=>{let c=process.env[a];if(void 0===c)return b;let d=Number(c);if(!/^[1-9]\d*$/.test(c)||!Number.isSafeInteger(d))throw Error("Snapshot limits are invalid.");return d},b=a("FLUJO_SNAPSHOT_MAX_FILE_BYTES",f.maxFileBytes),c=a("FLUJO_SNAPSHOT_MAX_BYTES",f.maxUncompressedBytes),d=c+f.maxManifestBytes,e=4*Math.ceil(d/3)+4096;if(!Number.isSafeInteger(d)||!Number.isSafeInteger(e))throw Error("Snapshot limits are invalid.");return{...f,maxFileBytes:b,maxUncompressedBytes:c,maxArchiveBytes:d,maxEncryptedBytes:e}}},381306:(a,b,c)=>{c.r(b),c.d(b,{restoreConfiguredWorkerSnapshot:()=>N,unlockWorkerSnapshot:()=>L,verifyWorkerCodexAuth:()=>J});var d=c(973024),e=c(100629),f=c(977598),g=c(186359),h=c(621385),i=c(157075),j=c(638522);let k=()=>Error("Invalid snapshot ZIP structure or member integrity."),l=Array.from({length:256},(a,b)=>{let c=b;for(let a=0;a<8;a++)c=c>>>1^(1&c?0xedb88320:0);return c>>>0});async function m(a,b,c,d){let e=await a.read(Math.max(0,a.size-65557),Math.min(a.size,65557)),f=-1;for(let a=e.length-22;a>=0;a--)if(0x6054b50===e.readUInt32LE(a)&&a+22+e.readUInt16LE(a+20)===e.length){f=a;break}if(f<0)throw k();let g=a.size-e.length+f,h=e.readUInt16LE(f+10),i=e.readUInt32LE(f+12),j=e.readUInt32LE(f+16);if(e.readUInt16LE(f+4)||e.readUInt16LE(f+6)||e.readUInt16LE(f+8)!==h||65535===h||h>65534||j+i!==g)throw k();let l=new Map,m=[],n=[],o=j,p=0;for(let e=0;e<h;e++){if(o+46>g)throw k();let e=await a.read(o,46);if(0x2014b50!==e.readUInt32LE(0))throw k();let f=e.readUInt16LE(8),h=e.readUInt16LE(10),i=e.readUInt32LE(20),q=e.readUInt32LE(24),r=e.readUInt16LE(28),s=o+46+r+e.readUInt16LE(30)+e.readUInt16LE(32);if(1&f||0!==e.readUInt16LE(34)||![0,8].includes(h)||s>g||0xffffffff===i||0xffffffff===q)throw k();let t=await a.read(o+46,r),u=new TextDecoder("utf-8",{fatal:!0}).decode(t),v=u.endsWith("/"),w=d(u,v).normalize("NFC").toLowerCase();if(l.has(w))throw Error("Snapshot contains duplicate or case-aliased archive paths.");l.set(w,v);let x=e.readUInt32LE(38)>>>16,y=61440&x;if(y&&y!==(v?16384:32768))throw Error("Snapshot links and special files are unsupported.");if(q>("snapshot-manifest.json"===u?8388608:b)||v&&0!==q)throw Error("Snapshot file exceeds the restore size limit.");if((p+=q)>c+8388608)throw Error("Snapshot exceeds the restore size limit.");let z=e.readUInt32LE(42);if(z+30>j)throw k();let A=await a.read(z,30);if(0x4034b50!==A.readUInt32LE(0)||A.readUInt16LE(6)!==f||A.readUInt16LE(8)!==h||A.readUInt16LE(26)!==r)throw k();let B=z+30+r+A.readUInt16LE(28);if(B+i>j||!(await a.read(z+30,r)).equals(t))throw k();let C=e.readUInt32LE(16);if(!(8&f)&&(A.readUInt32LE(14)!==C||A.readUInt32LE(18)!==i||A.readUInt32LE(22)!==q))throw k();let D=B+i;if(8&f){if(D+12>j)throw k();let b=0x8074b50===(await a.read(D,4)).readUInt32LE(0),c=await a.read(D+4*!!b,12);if(c.readUInt32LE(0)!==C||c.readUInt32LE(4)!==i||c.readUInt32LE(8)!==q||(D+=b?16:12)>j)throw k()}n.push({start:z,end:D}),m.push({name:u,directory:v,size:q,mode:x,crc:C,method:h,offset:B,compressed:i}),o=s}if(o!==g)throw k();n.sort((a,b)=>a.start-b.start);for(let a=1;a<n.length;a++)if(n[a].start<n[a-1].end)throw k();for(let a of m){let b=d(a.name,a.directory).split("/");for(let a=1;a<b.length;a++)if(!1===l.get(b.slice(0,a).join("/").normalize("NFC").toLowerCase()))throw Error("Snapshot contains a file/directory path conflict.")}return m}async function*n(a,b){let c=i.Readable.from(a.range(b.offset,b.compressed),{objectMode:!1,highWaterMark:65536}),d=8===b.method?(0,j.createInflateRaw)():void 0,e=d?c.pipe(d):c;e!==c&&c.on("error",a=>e.destroy(a));let f=0,g=0xffffffff;try{for await(let a of e){let c=Buffer.isBuffer(a)?a:Buffer.from(a);if((f+=c.length)>b.size)throw k();for(let a of c)g=g>>>8^l[(g^a)&255];yield c}if(f!==b.size||(0xffffffff^g)>>>0!==b.crc||d&&d.bytesWritten!==b.compressed)throw k()}finally{c.destroy(),e.destroy()}}var o=c(176760),p=c.n(o),q=c(739006),r=c(134887),s=c(930100),t=c(851018),u=c(907986),v=c(719031),w=c(472178),x=c(620775),y=c(683843),z=c(580940);let A="snapshot-manifest.json",B=".flujo-worker-snapshot.json",C=/^[a-f0-9]{64}$/;function D(a){return"object"==typeof a&&null!==a&&!Array.isArray(a)}function E(a,b){try{return JSON.parse(a)}catch{throw Error(b)}}function F(a,b=!1){let c=b?a.replace(/\/$/,""):a,d=c.split("/");if(!c||c.includes("\\")||c.includes("\0")||d.some(a=>!a||"."===a||".."===a||a.includes(":")||/[. ]$/.test(a)||/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(a)))throw Error("Snapshot contains an unsafe archive path.");if(c!==A&&".workspace.json"!==c&&!u.WORKSPACE_SUBTREES.includes(d[0]))throw Error("Snapshot contains a file outside the supported workspace roots.");if(b&&(c===A||".workspace.json"===c))throw Error("Snapshot metadata must be a file.");if(!b&&u.WORKSPACE_SUBTREES.includes(c))throw Error("Snapshot workspace roots must be directories.");return c}async function G(a,b=!1){b&&await d.promises.mkdir(a,{recursive:!0,mode:448});let c=await d.promises.lstat(a);if(!c.isDirectory()||c.isSymbolicLink())throw Error("Worker restore destination must be a plain directory.")}async function H(a){try{return await d.promises.lstat(a)}catch(a){if("ENOENT"===a.code)return null;throw a}}async function I(a){await G(a);let b=await d.promises.readdir(a,{withFileTypes:!0});for(let c of b)if(!u.WORKSPACE_SUBTREES.includes(c.name)||!c.isDirectory()||c.isSymbolicLink()||0!==(await d.promises.readdir(p().join(a,c.name))).length)throw Error("Worker snapshot restore refuses to overwrite an existing workspace.");for(let c of b)await d.promises.rmdir(p().join(a,c.name));await d.promises.rmdir(a)}async function J(a,b=(0,u.getWorkspaceDir)(a.workspace)){if("chatgpt"!==a.codexAuth)return;let c=p().join(b,"db","codex-runtime"),f=[];for(let a of["auth.json","flujo-auth-source.json"]){let g=await d.promises.lstat(p().join(c,a),{bigint:!0});if(!g.isFile()||g.isSymbolicLink()||g.nlink>BigInt(1)||g.size>BigInt(1048576))throw Error("Worker Codex authentication is not a valid workspace credential file.");let h=p().join(c,a);f.push(await (0,e.b)(h,{expected:g,maxBytes:1048576,verifyPath:()=>(0,w.V$)(b,h)}))}let[g,h]=f,i=E(h.toString("utf8"),"Worker Codex authentication marker is invalid.");if(!(0,v.eK)(g)||!D(i)||1!==i.version||"workspace"!==i.source)throw Error("Worker Codex ChatGPT authentication is missing or invalid.")}async function K(a,b=(0,u.getWorkspaceDir)(a.workspace)){if("user"!==a.encryption)return null;let c=p().join(b,"db","worker-bootstrap-secrets.json"),f=await d.promises.lstat(c,{bigint:!0});if(!f.isFile()||f.isSymbolicLink()||f.nlink>BigInt(1)||f.size>BigInt(4096))throw Error("Worker workspace encryption requires valid bootstrap credentials.");if("win32"!==process.platform&&(f.mode&BigInt(63))!==BigInt(0))throw Error("Worker workspace encryption credentials must be owner-only.");let g=E((await (0,e.b)(c,{expected:f,maxBytes:4096,ownerOnly:!0,verifyPath:()=>(0,w.V$)(b,c)})).toString("utf8"),"Worker workspace encryption bootstrap credentials are invalid.");if(!D(g)||1!==g.version||"string"!=typeof g.workspaceDek||!(0,t.TE)(g.workspaceDek))throw Error("Worker workspace encryption bootstrap credentials are invalid.");return g.workspaceDek}async function L(a){if((0,u.getCurrentWorkspace)()!==a.workspace)throw Error("Worker encryption unlock workspace mismatch.");let b=await K(a);b&&await (0,s.SO)(b,{workspace:a.workspace,root:(0,u.getWorkspaceDir)(a.workspace)})}async function M(a,b){(0,z.Vv)({state:"restoring",archiveSha256:b,error:void 0});let c=(0,g.B5)(),i=c.maxFileBytes,j=c.maxUncompressedBytes,k=await (0,h.z)(a,process.env.FLUJO_WORKER_SNAPSHOT_KEY,c.maxArchiveBytes,b);try{let a=await m(k,i,j,F),c=a.find(a=>a.name===A&&!a.directory);if(!c)throw Error("Worker snapshot manifest is missing.");let g=[];for await(let a of n(k,c))g.push(a);let h=function(a){if(!D(a)||a.formatVersion!==y.nt||a.layoutVersion!==x.q||!1!==a.externalRootsIncluded||!D(a.source)||a.source.version!==q.rE||"string"!=typeof a.source.platform||!D(a.runtime)||!D(a.runtime.mcpTransfer)||1!==a.runtime.mcpTransfer.formatVersion||"string"!=typeof a.runtime.mcpTransfer.sourceWorkspaceRoot||!Array.isArray(a.runtime.mcpTransfer.servers)||!["chatgpt","none"].includes(a.runtime.codexAuth)||!["default","user"].includes(a.runtime.encryption)||!Array.isArray(a.files)||!Array.isArray(a.subtrees)||a.subtrees.length!==u.WORKSPACE_SUBTREES.length||u.WORKSPACE_SUBTREES.some(b=>!a.subtrees.includes(b)))throw Error("Snapshot format, FLUJO version, layout, or portable runtime metadata is incompatible.");return(0,u.assertValidWorkspaceName)(a.workspace),a}(E(Buffer.concat(g).toString("utf8"),"Worker snapshot manifest is invalid JSON.")),l={workspace:h.workspace,archiveSha256:b,mcpTransfer:h.runtime.mcpTransfer,codexAuth:h.runtime.codexAuth,encryption:h.runtime.encryption};(0,z.Vv)({workspace:l.workspace});let o=new Map,s=0;for(let a of h.files){if(!D(a)||"string"!=typeof a.path||a.path===A||!Number.isSafeInteger(a.size)||a.size<0||a.size>i||"string"!=typeof a.sha256||!C.test(a.sha256))throw Error("Invalid snapshot manifest member.");if(F(a.path),o.has(a.path))throw Error("Snapshot manifest has duplicate members.");if((s+=a.size)>j)throw Error("Snapshot manifest exceeds the restore size limit.");o.set(a.path,a)}for(let b of a){if(b.name===A)continue;let a=b.directory?void 0:o.get(b.name);if(!b.directory&&(!a||a.size!==b.size))throw Error("Snapshot archive does not match its manifest.");let c=(0,f.createHash)("sha256");for await(let a of n(k,b))c.update(a);if(a&&c.digest("hex")!==a.sha256)throw Error("Snapshot member integrity check failed.");b.directory||o.delete(b.name)}if(o.size)throw Error("Snapshot archive is missing a manifest member.");await G((0,r.ok)(),!0),await G((0,u.getWorkspacesDir)(),!0);let t=(0,u.getWorkspaceDir)(l.workspace);if((await d.promises.readdir((0,u.getWorkspacesDir)())).filter(a=>a.toLowerCase()===l.workspace.toLowerCase()).some(a=>a!==l.workspace))throw Error("Worker workspace has a case-alias conflict.");let v=await H(t);if(v){await G(t);let a=p().join(t,B);if(await H(a)){let c=await d.promises.lstat(a,{bigint:!0});if(!c.isFile()||c.isSymbolicLink()||c.nlink>BigInt(1)||c.size>BigInt(4096))throw Error("Invalid worker restore marker.");let f=E((await (0,e.b)(a,{expected:c,maxBytes:4096,verifyPath:()=>(0,w.V$)(t,a)})).toString("utf8"),"Worker restore marker is invalid.");if(!D(f)||1!==f.formatVersion||f.archiveSha256!==b||f.workspace!==l.workspace)throw Error("Worker snapshot does not match the existing workspace.");return await J(l),await K(l),l}}let L=await d.promises.mkdtemp(p().join((0,u.getWorkspacesDir)(),".worker-restore-")),M=!1;try{for(let a of(await d.promises.chmod(L,448),u.WORKSPACE_SUBTREES))await d.promises.mkdir(p().join(L,a),{mode:448});for(let b of a.filter(a=>a.directory))await d.promises.mkdir(p().join(L,...F(b.name,!0).split("/")),{recursive:!0,mode:448});for(let b of a){if(b.directory||b.name===A)continue;let a=p().join(L,...b.name.split("/"));await d.promises.mkdir(p().dirname(a),{recursive:!0,mode:448}),await (0,w.V$)(L,a);let c=await d.promises.open(a,"wx",73&b.mode?448:384);try{if(".workspace.json"===b.name)await c.writeFile('{"roots":[]}\n');else for await(let a of n(k,b))for(let b=0;b<a.length;){let{bytesWritten:d}=await c.write(a,b,a.length-b);if(!d)throw Error("Worker restore write made no progress.");b+=d}await c.sync()}finally{await c.close()}}if(await J(l,L),await K(l,L),await (0,w.sA)(L,p().join(L,B),Buffer.from(JSON.stringify({formatVersion:1,workspace:l.workspace,archiveSha256:b}))),v)await I(t);else if(await H(t))throw Error("Worker restore destination was created concurrently.");return await d.promises.rename(L,t),M=!0,await J(l),l}finally{M||await d.promises.rm(L,{recursive:!0,force:!0})}}finally{await k.close()}}function N(){if(!(0,z.ye)())return Promise.resolve(null);let a=process.env.FLUJO_WORKER_SNAPSHOT?.trim(),b=process.env.FLUJO_WORKER_SNAPSHOT_SHA256?.trim().toLowerCase();if(!a||!b||!C.test(b)||!p().isAbsolute(a)){let a="Worker mode requires an absolute FLUJO_WORKER_SNAPSHOT path and FLUJO_WORKER_SNAPSHOT_SHA256.";return(0,z.Vv)({state:"error",error:a}),Promise.reject(Error(a))}let c=(0,f.createHash)("sha256").update(process.env.FLUJO_WORKER_SNAPSHOT_KEY??"").digest("hex"),d=`${(0,u.getWorkspacesDir)()}\0${a}\0${b}\0${c}`;if(global.__flujo_worker_snapshot_restore?.key===d)return global.__flujo_worker_snapshot_restore.promise;let e=M(a,b).catch(a=>{throw(0,z.Vv)({state:"error",error:a instanceof Error?a.message:"Worker restore failed."}),global.__flujo_worker_snapshot_restore?.promise===e&&(global.__flujo_worker_snapshot_restore=void 0),a});return global.__flujo_worker_snapshot_restore={key:d,promise:e},e}},621385:(a,b,c)=>{c.d(b,{N:()=>o,z:()=>r});var d=c(973024),e=c(977598),f=c(848161),g=c(176760),h=c.n(g),i=c(186359);let j=["dev","ino","size","mtimeNs","ctimeNs","mode","uid","gid","nlink"],k=(a,b)=>j.every(c=>a[c]===b[c]),l=()=>Error("Worker snapshot is unsafe or changed while being read.");async function m(a,b){for(let c=0;c<b.length;){let{bytesWritten:d}=await a.write(b,c,b.length-c);if(!d)throw l();c+=d}}async function n(a,b,c,d){let e=d?d.subarray(0,c):Buffer.alloc(c);if(e.length!==c)throw l();for(let d=0;d<c;){let{bytesRead:f}=await a.read(e,d,c-d,b+d);if(!f)throw l();d+=f}return e}class o{constructor(a,b){this.root=a,this.file=b,this.size=0,this.key=(0,e.randomBytes)(32),this.pending=Buffer.alloc(0),this.blocks=[],this.diskSize=0,this.sealed=Buffer.alloc(65564),this.readTail=Promise.resolve()}static async create(){let a=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-input-"));try{return await d.promises.chmod(a,448),new o(a,await d.promises.open(h().join(a,"ciphertext"),"wx+",384))}catch(b){throw await d.promises.rm(a,{recursive:!0,force:!0}),b}}async append(a){this.size+=a.length;let b=this.pending.length?Buffer.concat([this.pending,a]):a;for(;b.length>=65536;)await this.seal(b.subarray(0,65536)),b=b.subarray(65536);this.pending=Buffer.from(b)}async seal(a){let b=(0,e.randomBytes)(12),c=(0,e.createCipheriv)("aes-256-gcm",this.key,b);c.setAAD(Buffer.from(`${this.blocks.length}:${a.length}`));let d=c.update(a),f=c.final();b.copy(this.sealed),c.getAuthTag().copy(this.sealed,12),d.copy(this.sealed,28),f.copy(this.sealed,28+d.length),await m(this.file,this.sealed.subarray(0,a.length+28)),this.blocks.push({offset:this.diskSize,length:a.length}),this.diskSize+=a.length+28}async finish(){this.pending.length&&await this.seal(this.pending),this.pending.fill(0),this.pending=Buffer.alloc(0),await this.file.sync()}async read(a,b){let c,d=this.readTail;this.readTail=new Promise(a=>{c=a}),await d;try{return await this.readOwned(a,b)}finally{c()}}async readOwned(a,b){if(!Number.isSafeInteger(a)||!Number.isSafeInteger(b)||a<0||b<0||a+b>this.size||b>8388608)throw l();let c=Buffer.alloc(b);for(let d=0;d<b;){let f=Math.floor((a+d)/65536),g=this.blocks[f];if(!g)throw l();if(this.cache?.index!==f){this.cache?.bytes.fill(0);let a=await n(this.file,g.offset,g.length+28,this.sealed),b=(0,e.createDecipheriv)("aes-256-gcm",this.key,a.subarray(0,12));b.setAAD(Buffer.from(`${f}:${g.length}`)),b.setAuthTag(a.subarray(12,28));let c=b.update(a.subarray(28)),d=b.final();this.cache={index:f,bytes:d.length?Buffer.concat([c,d]):c}}let h=(a+d)%65536,i=Math.min(b-d,g.length-h);this.cache.bytes.copy(c,d,h,h+i),d+=i}return c}async *range(a=0,b=this.size-a){for(let c=0;c<b;c+=65536)yield await this.read(a+c,Math.min(65536,b-c))}async close(){for(let a of(this.key.fill(0),this.pending.fill(0),this.cache?.bytes.fill(0),this.sealed.fill(0),[...await Promise.allSettled([this.file.close()]),...await Promise.allSettled([d.promises.rm(this.root,{recursive:!0,force:!0})])]))if("rejected"===a.status)throw a.reason}}class p{constructor(a,b){this.file=a,this.size=b,this.storage=Buffer.alloc(65536),this.buffer=Buffer.alloc(0),this.offset=0,this.position=0}async fill(){return this.offset<this.buffer.length||this.position!==this.size&&(this.buffer=await n(this.file,this.position,Math.min(65536,this.size-this.position),this.storage),this.position+=this.buffer.length,this.offset=0,!0)}async peek(){return await this.fill()?this.buffer[this.offset]:-1}async byte(){let a=await this.peek();return -1!==a&&this.offset++,a}async whitespace(){for(;[9,10,13,32].includes(await this.peek());)await this.byte()}async expect(a){if(await this.whitespace(),await this.byte()!==a)throw l()}async smallValue(){await this.whitespace();let a=[],b=await this.peek()===34;b&&a.push(await this.byte());let c=!1;for(;a.length<256;){let d=await this.peek();if(-1===d)throw l();if(!b&&[44,125,9,10,13,32].includes(d)||(a.push(await this.byte()),b&&34===d&&!c))break;c=92===d&&!c}if(256===a.length)throw l();try{return JSON.parse(Buffer.from(a).toString("utf8"))}catch{throw l()}}async data(a,b){await this.expect(34);let c="",d=!1,e=0,f=async f=>{if(!/^[A-Za-z0-9+/=]*$/.test(f)||d&&f.length)throw l();let g=(c+=f).length-c.length%4;if(!g)return;let h=c.slice(0,g);if(!/^[A-Za-z0-9+/]*={0,2}$/.test(h))throw l();let i=Buffer.from(h,"base64");if(i.toString("base64")!==h||(d=h.includes("="),(e+=i.length)>b))throw l();await m(a,i),c=c.slice(g)};for(;await this.fill();){let a=this.buffer.indexOf(34,this.offset),b=this.buffer.indexOf(92,this.offset),d=Math.min(a<0?this.buffer.length:a,b<0?this.buffer.length:b);if(await f(this.buffer.subarray(this.offset,d).toString("latin1")),this.offset=d,d===this.buffer.length)continue;if(34===await this.byte()){if(c.length)throw l();return e}let g=await this.byte();if(117===g){let a="";for(let b=0;b<4;b++){let b=await this.byte();if(b<0)throw l();a+=String.fromCharCode(b)}if(!/^[0-9a-fA-F]{4}$/.test(a))throw l();await f(String.fromCharCode(Number.parseInt(a,16)))}else{let a=new Map([[34,'"'],[92,"\\"],[47,"/"],[98,"\b"],[102,"\f"],[110,"\n"],[114,"\r"],[116,"	"]]).get(g);if(void 0===a)throw l();await f(a)}}throw l()}}function q(a,b){if("string"!=typeof a||a.length>64)throw l();let c=Buffer.from(a,"base64");if(c.length!==b||c.toString("base64")!==a)throw l();return c}async function r(a,b,c,g){let j,m,r,s,t=await d.promises.lstat(a,{bigint:!0}),u=void 0===b?c:4*Math.ceil(c/3)+4096;if(!t.isFile()||t.isSymbolicLink()||t.nlink!==BigInt(1)||t.size>BigInt(u))throw l();let v=await d.promises.open(a,d.constants.O_RDONLY|(d.constants.O_NOFOLLOW??0)|(d.constants.O_NONBLOCK??0)),w=!1,x=0,y=(0,e.createHash)("sha256");try{let u=j=await o.create();if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();let z=Buffer.alloc(65536);for(let a=0;a<Number(t.size);a+=65536)y.update(await n(v,a,Math.min(65536,Number(t.size)-a),z));let A=(0,e.createHash)("sha256"),B=async a=>{if(u.size+a.length>c)throw l();A.update(a),await u.append(a)};if(void 0!==b)try{s=q(b,32),m=await d.promises.mkdtemp(h().join((0,f.tmpdir)(),"flujo-snapshot-envelope-")),await d.promises.chmod(m,448),r=await d.promises.open(h().join(m,"ciphertext"),"wx+",384);let a=new p(v,Number(t.size)),g=new Map,j=-1;for(await a.expect(123);;){let b=await a.smallValue();if("string"!=typeof b||!["format","version","iv","tag","data"].includes(b)||g.has(b))throw l();await a.expect(58),g.set(b,"data"===b||await a.smallValue()),"data"===b&&(j=await a.data(r,c)),await a.whitespace();let d=await a.byte();if(125===d)break;if(44!==d)throw l()}if(await a.whitespace(),await a.byte()!==-1||5!==g.size||"flujo-workspace-encrypted"!==g.get("format")||![1,2].includes(g.get("version"))||j<0)throw l();x=g.get("version");let k=(0,e.createDecipheriv)("aes-256-gcm",s,q(g.get("iv"),12));2===x&&k.setAAD(Buffer.from(i.fI.v2Aad)),k.setAuthTag(q(g.get("tag"),16));for(let a=0;a<j;a+=65536)await B(k.update(await n(r,a,Math.min(65536,j-a),z)));await B(k.final())}catch{throw Error("Worker snapshot decryption failed. Check the encrypted archive and its key.")}else for(let a=0;a<Number(t.size);a+=65536)await B(await n(v,a,Math.min(65536,Number(t.size)-a),z));let C=A.digest("hex");if((2===x?y.digest("hex"):C)!==g)throw Error("Worker snapshot SHA-256 mismatch.");if(!k(t,await v.stat({bigint:!0}))||!k(t,await d.promises.lstat(a,{bigint:!0})))throw l();return await u.finish(),w=!0,u}catch(a){throw await j?.close().catch(()=>void 0),a}finally{s?.fill(0);let a=await Promise.allSettled([v.close(),...r?[r.close()]:[]]),b=await Promise.allSettled(m?[d.promises.rm(m,{recursive:!0,force:!0})]:[]);if(w&&[...a,...b].some(a=>"rejected"===a.status))throw await j?.close().catch(()=>void 0),Error("Snapshot temporary storage could not be released.")}}},683843:(a,b,c)=>{c.d(b,{d1:()=>h,nt:()=>g});var d=c(739006),e=c(186359),f=c(620775);let g=2;function h(){let a=process.env.FLUJO_BUILD_REVISION;return{applicationVersion:d.rE,snapshotEncryption:{...e.fI,readVersions:[...e.fI.readVersions]},snapshotLimits:(0,e.B5)(),snapshotFormatVersion:g,layoutVersion:f.q,workerProtocolVersion:1,workerSnapshotSourceVersion:1,.../^[a-f0-9]{40}$/.test(a??"")?{revision:a}:{}}}},739006:a=>{a.exports={rE:"3.48.7"}}};