madarx 2.17.0 → 2.18.0

package/.next/standalone/.next/server/chunks/1699.js

@@ -122,6 +122,13 @@ TOOL_SELF_MANAGEMENT
 - If the tool exists but is disabled, call install_tool to enable it. Tools rated irreversible_external will gate on operator approval — surface that to the principal.
 - After enabling a tool, immediately use it to complete the task.
 
+BROWSER_CONTROL
+- When asked to open, visit, or navigate a real web page and then read it, click, type, or search on it, drive a real browser — do NOT refuse and do NOT settle for web_fetch (which cannot click or run JavaScript-heavy pages).
+- Use browser_open to load the URL, browser_act to click/fill/type/press/scroll, browser_extract to read the rendered result, and browser_screenshot to capture it. The page persists across calls so you can chain open → act → extract.
+- These interactive browser tools start disabled. If a browser_* call is unavailable, call install_tool to enable it first, then proceed — exactly as TOOL_SELF_MANAGEMENT describes. Do not tell the principal you cannot browse; enable the tool and do it.
+- When the principal explicitly wants to WATCH the browser live (a visible window, "open the browser so I can see", "connect chrome"), use skill_bridge_run with skill="connect-chrome" or skill="browse" — it drives the real visible GStack browser. This tool ALWAYS asks for owner approval before each run (it crosses the local CLI boundary); surface that one approval, then proceed. For silent/background automation prefer the headless browser_* tools instead.
+- This applies identically whether the request arrives by voice or typed chat — voice runs through this same brain and toolset.
+
 ARTIFACT_LIFECYCLE
 - When asked to build a UI, page, interface, web component, landing page, dashboard, or any visual output — use generate_ui. Never use create_artifact for HTML or UI work.
 - When the principal refines, extends, or follows up on a previous artifact, use update_artifact with the existing artifact_id — do NOT create a new artifact.
@@ -852,7 +859,7 @@ ${b}
       els.forEach(function(e){ e.style.transitionDelay=Math.min(i*40,160)+'ms'; i++; io.observe(e); });
     })();
   </script>
-</body></html>`}(b,n),meta:{scenario_rows:l.scen.length,intercepts:l.intercepts.length,targets:l.targets.length,comparables:d.length,narrative_authored:Object.keys(c||{}).length>0}}}},17607:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{B:()=>n,M:()=>m});var e=c(58282),f=c(26531),g=a([e]);e=(g.then?(await g)():g)[0];let o={"User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Accept-Language":"en-US,en;q=0.9","Sec-Fetch-Mode":"navigate","Sec-Fetch-Site":"none","Sec-Fetch-User":"?1","Sec-Ch-Ua":'"Chromium";v="124", "Not(A:Brand";v="24"',"Upgrade-Insecure-Requests":"1"},p=new Map;function h(a){try{return new URL(a).hostname}catch{return a}}function i(a,b){let c=b.headers.get("set-cookie");if(!c)return;let d=c.split(/,(?=[^;]+=[^;]+)/).map(a=>a.trim().split(";")[0].trim()).filter(Boolean),e=p.get(a)||"",f=e?[...e.split("; "),...d].filter(Boolean).join("; "):d.join("; ");p.set(a,f)}function j(a){let b=h(a),c={...o},d=p.get(b);return d&&(c.Cookie=d),c}async function k(a,b){let c=a,d=[];for(let a=0;a<5;a++){d.push(c);let e=h(c),f=await b(c,{method:"GET",redirect:"manual",headers:j(c),signal:AbortSignal.timeout(2e4)});if(i(e,f),f.status>=300&&f.status<400){let a=f.headers.get("location");if(!a)break;c=new URL(a,c).href;continue}let g=await f.text(),k=function(a){let b=a.match(/<meta[^>]+http-equiv=["']?refresh["']?[^>]+content=["']?\d+;\s*url=([^"'\s>]+)/i);return b?b[1]:null}(g);if(k&&a<4){c=new URL(k,c).href;continue}return{res:f,html:g,finalUrl:c,redirects:d.length>1?d:void 0}}let e=h(c),f=await b(c,{method:"GET",redirect:"follow",headers:j(c),signal:AbortSignal.timeout(2e4)});i(e,f);let g=await f.text();return{res:f,html:g,finalUrl:c,redirects:d}}function l(a){let b=a.replace(/<(script|style|nav|header|footer|noscript)[\s\S]*?<\/\1>/gi,"");return b=(b=(b=(b=b.replace(/<\/?(p|div|br|h[1-6]|li|tr|td|th|section|article|main|aside|blockquote)[^>]*>/gi,"\n")).replace(/<[^>]+>/g," ")).replace(/&amp;/g,"&").replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"').replace(/&#39;/g,"'").replace(/&nbsp;/g," ")).replace(/[ \t]+/g," ").replace(/\n{3,}/g,"\n\n").trim()}async function m({url:a,extract:b="text",selector:c,wait_for:d,max_chars:g=12e3}={}){let h,i,j,n,o,p=Math.min(Number(g)||12e3,5e4),q=(0,e.N)("browser_navigate",null);try{({res:h,html:i,finalUrl:j,redirects:n}=await k(a,q))}catch(b){return{status:"error",url:a,final_url:a,content_type:null,content:"Fetch error: "+String(b&&b.message?b.message:b).slice(0,512),length:0}}let r=h.headers.get("content-type")||"";if(d&&!i.includes(d))return{status:"incomplete",url:a,final_url:j,content_type:r,hint:"Substring not found, site may need JS rendering",length:i.length,...n?{redirects:n}:{}};let s=i;if(c){let a=function(a,b){if(!b)return null;try{let c;if(b.startsWith("#")){let a=b.slice(1).replace(/[.*+?^${}()|[\]\\]/g,"\\$&");c=RegExp("<[a-z][^>]+id=[\"']"+a+"[\"'][^>]*>([\\s\\S]*?)<\\/[a-z]+>","i")}else if(b.startsWith(".")){let a=b.slice(1).replace(/[.*+?^${}()|[\]\\]/g,"\\$&");c=RegExp("<[a-z][^>]+class=[\"'][^\"']*"+a+"[^\"']*[\"'][^>]*>([\\s\\S]*?)<\\/[a-z]+>","i")}else{let a=b.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");c=RegExp("<"+a+"[^>]*>([\\s\\S]*?)<\\/"+a+">","i")}let d=a.match(c);return d?d[0]:null}catch{return null}}(i,c);a&&(s=a)}try{if("text"===b)o=l(s).slice(0,p);else if("markdown"===b)o=s.replace(/<(script|style|noscript)[\s\S]*?<\/\1>/gi,"").replace(/<h1[^>]*>([\s\S]*?)<\/h1>/gi,(a,b)=>"\n# "+l(b)+"\n").replace(/<h2[^>]*>([\s\S]*?)<\/h2>/gi,(a,b)=>"\n## "+l(b)+"\n").replace(/<h3[^>]*>([\s\S]*?)<\/h3>/gi,(a,b)=>"\n### "+l(b)+"\n").replace(/<h[4-6][^>]*>([\s\S]*?)<\/h[4-6]>/gi,(a,b)=>"\n#### "+l(b)+"\n").replace(/<a[^>]+href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi,(a,b,c)=>"["+l(c)+"]("+b+")").replace(/<code[^>]*>([\s\S]*?)<\/code>/gi,(a,b)=>"`"+b+"`").replace(/<pre[^>]*>([\s\S]*?)<\/pre>/gi,(a,b)=>"\n```\n"+l(b)+"\n```\n").replace(/<li[^>]*>([\s\S]*?)<\/li>/gi,(a,b)=>"\n- "+l(b)).replace(/<\/?(p|div|br)[^>]*>/gi,"\n").replace(/<[^>]+>/g," ").replace(/&amp;/g,"&").replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"').replace(/&#39;/g,"'").replace(/&nbsp;/g," ").replace(/[ \t]+/g," ").replace(/\n{3,}/g,"\n\n").trim().slice(0,p);else o="json-ld"===b?function(a){let b,c=[],d=/<script[^>]+type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/gi;for(;null!==(b=d.exec(a));)try{c.push(JSON.parse(b[1]))}catch{}return c}(s):"metadata"===b?function(a){let b,c={},d=a.match(/<title[^>]*>([\s\S]*?)<\/title>/i);d&&(c.title=d[1].replace(/<[^>]+>/g,"").trim());let e=/<meta[^>]+(?:name|property)=["']([^"']+)["'][^>]+content=["']([^"']*)["'][^>]*>/gi;for(;null!==(b=e.exec(a));)c[b[1]]=b[2];let f=/<meta[^>]+content=["']([^"']*)["'][^>]+(?:name|property)=["']([^"']+)["'][^>]*>/gi;for(;null!==(b=f.exec(a));)c[b[2]]||(c[b[2]]=b[1]);return c}(s):s.slice(0,p)}catch{o=s.slice(0,p)}let t=o;return"string"==typeof o&&(t=(0,f.nc)(o)),{status:"ok",url:a,final_url:j,content_type:r,content:t,length:"string"==typeof i?i.length:0,...n?{redirects:n}:{}}}async function n(a){let[b,c]=await Promise.all([m({url:a,extract:"json-ld",max_chars:5e4}),m({url:a,extract:"metadata",max_chars:5e4})]);return{json_ld:Array.isArray(b.content)?b.content:[],metadata:"object"==typeof c.content&&null!==c.content?c.content:{}}}d()}catch(a){d(a)}})},18313:(a,b,c)=>{"use strict";c.d(b,{Hb:()=>n,MK:()=>l,NV:()=>m,Ny:()=>g,_d:()=>p,ab:()=>q,eh:()=>i,rb:()=>h,uB:()=>k,vI:()=>o});let d=["backlog","todo","in_progress","in_review","blocked","done","cancelled"],e=["low","medium","high","urgent"],f=["queued","running","waiting_approval","succeeded","failed","cancelled","timed_out"],g=["task.created","task.updated","task.assigned","task.reassigned","task.status_changed","task.comment_added","task.blocked","task.unblocked","task.completed","task.cancelled","task.child_created"],h=["lifecycle","tool_start","tool_result","log","warning","error","approval_required","delegation_proposed","delegation_completed"],i=["activity.logged","task.updated","task.comment.added","task.assigned","task.reassigned","agent.status","agent.run.queued","agent.run.status","agent.run.event","agent.run.log"],j={backlog:["todo","cancelled"],todo:["in_progress","blocked","cancelled","done"],in_progress:["in_review","blocked","todo","done","cancelled"],in_review:["in_progress","done","blocked","cancelled"],blocked:["todo","in_progress","cancelled"],done:["in_review"],cancelled:["todo"]};function k(a){return"done"===a||"cancelled"===a}function l(a){return["queued","running","waiting_approval"].includes(a)}function m(a,b="todo"){return d.includes(a)?a:b}function n(a,b="medium"){return e.includes(a)?a:b}function o(a,b="queued"){return f.includes(a)?a:b}function p(a,b="activity.logged"){return i.includes(a)?a:b}function q(a,b){if(!(!a||a===b||j[a]?.includes(b)))throw Error(`Illegal task transition: ${a} -> ${b}`)}},18530:a=>{"use strict";a.exports=JSON.parse('{"schema_version":1,"slug":"vendor-onboarding","name":"Vendor Onboarding","version":1,"description":"Standard intake for new vendors. Captures contact + services, runs an automated risk review, gates on buyer sign-off, and packages the onboarding pack.","category":"procurement","source":"marketplace","status":"published","stages":[{"slug":"intake","name":"Vendor intake","kind":"intake_form","config":{"form_schema":{"title":"Vendor Onboarding — Intake","description":"Tell us about the vendor. The risk reviewer will use this to score them.","fields":[{"name":"vendor_name","label":"Vendor company name","type":"text","required":true,"placeholder":"Legal entity name"},{"name":"primary_contact_name","label":"Primary contact name","type":"text","required":true},{"name":"primary_contact_email","label":"Primary contact email","type":"email","required":true},{"name":"country","label":"Headquarters country","type":"select","required":true,"options":["United States","United Kingdom","United Arab Emirates","Singapore","Germany","India","Other"]},{"name":"services","label":"Services offered","type":"textarea","required":true,"placeholder":"Short list of services / products this vendor will deliver."},{"name":"annual_value_usd","label":"Estimated annual contract value (USD)","type":"number","required":true,"min":0},{"name":"references","label":"References (names + companies)","type":"textarea","required":false,"placeholder":"Optional. One reference per line."}]}}},{"slug":"risk-review","name":"Automated risk review","kind":"agent_run","config":{"agent_template_slug":"vendor-risk-reviewer","prompt":"You are a vendor risk reviewer. Given the intake payload, produce a structured risk report. Do not call external services — work from the intake alone. Return strict JSON only, no surrounding prose: { \\"outcome\\": \\"pass\\" | \\"reject\\", \\"overall_risk\\": \\"low\\" | \\"medium\\" | \\"high\\", \\"concerns\\": [string], \\"references_summary\\": string, \\"recommended_action\\": \\"auto_approve\\" | \\"manual_review\\" | \\"reject\\", \\"rationale\\": string }. Set outcome=\\"reject\\" when recommended_action is \\"reject\\" (sanctioned region, missing critical info). Set outcome=\\"pass\\" otherwise — the human-approval stage that follows is the real decision point. Risk tiers: low = clear references + reasonable value, medium = thin references OR value > $250k, high = sanctioned region OR missing services OR value > $1M.","output_schema":"vendor_risk_v1","timeout_ms":60000,"on_outcome":{"pass":"buyer-signoff","reject":"fail"}},"on_pass_stage_slug":"buyer-signoff","on_fail_stage_slug":null},{"slug":"buyer-signoff","name":"Buyer sign-off","kind":"human_approval","config":{"action_type":"process.stage.approve","risk":"medium","summary_template":"Approve onboarding for {{intake.vendor_name}} ({{intake.country}}) — risk {{risk-review.overall_risk}}"},"on_pass_stage_slug":"final-package","on_fail_stage_slug":null},{"slug":"final-package","name":"Onboarding pack","kind":"package","config":{"title_template":"Vendor onboarding pack — {{intake.vendor_name}}","include_stages":["intake","risk-review","buyer-signoff"]}}]}')},18630:(a,b,c)=>{"use strict";c.d(b,{m:()=>f});var d=c(1303),e=c(81553);async function f(a={}){let b=await (0,e.runUpdateCheck)({});if(!b.reachable)return{ok:!1,from:(0,e.YO)(),to:null,applied:!1,message:"npm registry unreachable"};if(!b.behind)return{ok:!0,from:b.current,to:b.latest,applied:!1,message:"already up to date"};let c=await (0,d.applyUpdate)({initiatedBy:"self_update_tool"});return{ok:c.ok,from:c.from,to:b.latest,applied:c.ok,message:c.ok?`updated ${c.from} → v${b.latest}; restart required`:`update failed (exit ${c.code})`}}},19151:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{A:()=>n,chatWithClaude:()=>j,x:()=>k});var e=c(50832),f=c(65451),g=a([e,f]);[e,f]=g.then?(await g)():g;let l=Number(process.env.MADARX_ANTHROPIC_MAX_RETRIES??4),m=Number(process.env.MADARX_ANTHROPIC_OUTER_RETRIES??3);function h(){let a=(0,f.resolveAnthropicApiKey)();if(!a)throw Error("ANTHROPIC_API_KEY not configured");return new e.default({apiKey:a,maxRetries:l})}let n="claude-sonnet-4-6",o=a=>new Promise(b=>setTimeout(b,a));async function i(a,b){let c;for(let d=0;d<m;d+=1)try{return await a()}catch(e){if(c=e,!function(a){let b=a?.status;return!!(429===b||408===b||409===b||"number"==typeof b&&b>=500||null==b&&(a?.name==="APIConnectionError"||a?.name==="APIConnectionTimeoutError"||/timeout|ECONNRESET|ENOTFOUND|EAI_AGAIN|socket hang up/i.test(String(a?.message||""))))}(e)||d===m-1)throw e;let a=function(a,b){let c=a?.headers?.get?.("retry-after"),d=null!=c?Number(c):NaN;return Number.isFinite(d)&&d>=0?Math.min(1e3*d,3e4):Math.min(500*2**b,8e3)+Math.floor(250*Math.random())}(e,d);console.warn(`[claude] ${b} transient ${e?.status||e?.name||"error"} — retry ${d+1}/${m-1} in ${a}ms`),await o(a)}throw c}async function j(a,b,c=[],d={}){let e=h(),f={model:d.model||n,max_tokens:d.max_tokens||8192,system:b,messages:a};return c.length&&(f.tools=c),d.tool_choice&&(f.tool_choice=d.tool_choice),"number"==typeof d.temperature&&(f.temperature=d.temperature),i(()=>e.messages.create(f),`chat(${f.model})`)}async function k(a,b,c=[],d=n){let e=h(),f={model:d,max_tokens:8192,system:b,messages:a};return c.length&&(f.tools=c),i(()=>e.messages.stream(f),`stream(${d})`)}d()}catch(a){d(a)}})},19348:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{D4:()=>p,It:()=>q,JF:()=>r}),c(73024);var e=c(34255),f=c(24516),g=c(58282),h=c(73912),i=c(61423),j=a([e,f,g,h,i]);[e,f,g,h,i]=j.then?(await j)():j;let r=["openai","elevenlabs","local"],s="alloy",t=new Set(["alloy","echo","fable","onyx","nova","shimmer"]);function k(){let a=process.env.MADARX_LOCAL_TTS_URL;return a&&/^https?:\/\//i.test(a.trim())?a.trim():null}function l(a,...b){let c=String(a??"");for(let a of b){if(!a)continue;let b=String(a).slice(-4);c=c.split(String(a)).join(`***${b}`)}return c}async function m({text:a,voice:b,model:c,format:d,fetchFn:e}){let g,h=(0,f.getSecret)("OPENAI_API_KEY")||process.env.OPENAI_API_KEY;if(!h)throw Error("OPENAI_API_KEY missing for OpenAI TTS");let i=b&&t.has(b)?b:s,j=c||"tts-1",k=d||"mp3";try{g=await e("https://api.openai.com/v1/audio/speech",{method:"POST",headers:{Authorization:`Bearer ${h}`,"Content-Type":"application/json"},body:JSON.stringify({model:j,voice:i,input:a,format:k})})}catch(a){throw Error(`openai tts failed: ${l(a?.message,h)}`)}if(!g.ok){let a="";try{a=(await g.text()).slice(0,256)}catch{}throw Error(`openai tts http ${g.status}: ${l(a,h)}`)}return{audio_buffer:Buffer.from(await g.arrayBuffer()),mime_type:"wav"===k?"audio/wav":"audio/mpeg",extension:"wav"===k?"wav":"mp3",provider:"openai",voice:i,model:j}}async function n({text:a,voice:b,model:c,format:d,fetchFn:e}){let g,h=(0,f.getSecret)("ELEVENLABS_API_KEY")||process.env.ELEVENLABS_API_KEY;if(!h)throw Error("ELEVENLABS_API_KEY missing for ElevenLabs TTS");let i=b||(0,f.getSecret)("ELEVENLABS_VOICE_ID")||process.env.ELEVENLABS_VOICE_ID||"21m00Tcm4TlvDq8ikWAM",j=c||"eleven_multilingual_v2",k="wav"===d?"pcm_16000":"mp3_44100_128";try{g=await e(`https://api.elevenlabs.io/v1/text-to-speech/${encodeURIComponent(i)}?output_format=${k}`,{method:"POST",headers:{"xi-api-key":h,"Content-Type":"application/json",Accept:"audio/mpeg"},body:JSON.stringify({text:a,model_id:j})})}catch(a){throw Error(`elevenlabs tts failed: ${l(a?.message,h)}`)}if(!g.ok){let a="";try{a=(await g.text()).slice(0,256)}catch{}throw Error(`elevenlabs tts http ${g.status}: ${l(a,h)}`)}return{audio_buffer:Buffer.from(await g.arrayBuffer()),mime_type:k.startsWith("pcm_")?"audio/wav":"audio/mpeg",extension:k.startsWith("pcm_")?"wav":"mp3",provider:"elevenlabs",voice:i,model:j}}async function o({text:a,voice:b,model:c,format:d,fetchFn:e}){let f,g=k();if(!g)throw Error("MADARX_LOCAL_TTS_URL missing for local TTS");let h=d||"wav",i=c||process.env.MADARX_LOCAL_TTS_MODEL||"local",j=b||process.env.MADARX_LOCAL_TTS_VOICE||"default";try{f=await e(g,{method:"POST",headers:{"Content-Type":"application/json",Accept:"mp3"===h?"audio/mpeg,application/json":"audio/wav,audio/*,application/json"},body:JSON.stringify({text:a,voice:j,model:i,format:h})})}catch(a){throw Error(`local tts failed: ${l(a?.message)}`)}if(!f.ok){let a="";try{a=(await f.text()).slice(0,256)}catch{}throw Error(`local tts http ${f.status}: ${a}`)}let m=String(f.headers.get("content-type")||"").toLowerCase();if(m.includes("application/json")){let a;try{a=await f.json()}catch{throw Error("local tts returned invalid JSON")}let b=a?.audio_base64||a?.audio;if(!b)throw Error("local tts JSON must include audio_base64");let c=a.mime_type||a.content_type||("mp3"===h?"audio/mpeg":"audio/wav"),d=a.extension||(String(c).includes("mpeg")||String(c).includes("mp3")?"mp3":"wav");return{audio_buffer:Buffer.from(String(b),"base64"),mime_type:c,extension:d,provider:"local",voice:a.voice||j,model:a.model||i}}let n=Buffer.from(await f.arrayBuffer()),o=m.includes("mpeg")||m.includes("mp3")||"mp3"===h;return{audio_buffer:n,mime_type:m||(o?"audio/mpeg":"audio/wav"),extension:o?"mp3":"wav",provider:"local",voice:j,model:i}}async function p(a={}){let b=String(a.text||"").trim();if(!b)throw Error("text is required");if(b.length>4e3)throw Error("text too long: max 4000 characters");let c=String(a.provider||process.env.MADARX_VOICE_DEFAULT_PROVIDER||process.env.TTS_DEFAULT_PROVIDER||"openai").toLowerCase(),d=r.includes(c)?c:"openai",f=(0,g.N)("voice_speak",a.agent_id??null,a.fetch||fetch),j=await ("elevenlabs"===d?n:"local"===d?o:m)({text:b,voice:a.voice,model:a.model,format:a.format,fetchFn:f}),k=Math.max(500,Math.round(b.length/14*1e3)),l=null;if(a.save_to_disk&&a.project_id){let c=(0,i.U1)(a.project_id);if(c){let a=function(a){let b=(0,e.getDb)(),c=(0,h.dh)(a),d=b.prepare("SELECT * FROM disk_folders WHERE project_id = ? AND parent_id = ? AND name = ? LIMIT 1").get(a,c.id,"voice");return d||(0,h.vV)(a,c.id,"voice")}(c.id),d=b.slice(0,40).replace(/[^A-Za-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"tts";l=(0,h.QM)(c.id,a.id,{name:`${d}-${Date.now()}.${j.extension}`,buffer:j.audio_buffer,type:j.mime_type},{local_only:!1})}}try{(0,e.getDb)().prepare(`
+</body></html>`}(b,n),meta:{scenario_rows:l.scen.length,intercepts:l.intercepts.length,targets:l.targets.length,comparables:d.length,narrative_authored:Object.keys(c||{}).length>0}}}},17607:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{B:()=>n,M:()=>m});var e=c(58282),f=c(26531),g=a([e]);e=(g.then?(await g)():g)[0];let o={"User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",Accept:"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","Accept-Language":"en-US,en;q=0.9","Sec-Fetch-Mode":"navigate","Sec-Fetch-Site":"none","Sec-Fetch-User":"?1","Sec-Ch-Ua":'"Chromium";v="124", "Not(A:Brand";v="24"',"Upgrade-Insecure-Requests":"1"},p=new Map;function h(a){try{return new URL(a).hostname}catch{return a}}function i(a,b){let c=b.headers.get("set-cookie");if(!c)return;let d=c.split(/,(?=[^;]+=[^;]+)/).map(a=>a.trim().split(";")[0].trim()).filter(Boolean),e=p.get(a)||"",f=e?[...e.split("; "),...d].filter(Boolean).join("; "):d.join("; ");p.set(a,f)}function j(a){let b=h(a),c={...o},d=p.get(b);return d&&(c.Cookie=d),c}async function k(a,b){let c=a,d=[];for(let a=0;a<5;a++){d.push(c);let e=h(c),f=await b(c,{method:"GET",redirect:"manual",headers:j(c),signal:AbortSignal.timeout(2e4)});if(i(e,f),f.status>=300&&f.status<400){let a=f.headers.get("location");if(!a)break;c=new URL(a,c).href;continue}let g=await f.text(),k=function(a){let b=a.match(/<meta[^>]+http-equiv=["']?refresh["']?[^>]+content=["']?\d+;\s*url=([^"'\s>]+)/i);return b?b[1]:null}(g);if(k&&a<4){c=new URL(k,c).href;continue}return{res:f,html:g,finalUrl:c,redirects:d.length>1?d:void 0}}let e=h(c),f=await b(c,{method:"GET",redirect:"follow",headers:j(c),signal:AbortSignal.timeout(2e4)});i(e,f);let g=await f.text();return{res:f,html:g,finalUrl:c,redirects:d}}function l(a){let b=a.replace(/<(script|style|nav|header|footer|noscript)[\s\S]*?<\/\1>/gi,"");return b=(b=(b=(b=b.replace(/<\/?(p|div|br|h[1-6]|li|tr|td|th|section|article|main|aside|blockquote)[^>]*>/gi,"\n")).replace(/<[^>]+>/g," ")).replace(/&amp;/g,"&").replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"').replace(/&#39;/g,"'").replace(/&nbsp;/g," ")).replace(/[ \t]+/g," ").replace(/\n{3,}/g,"\n\n").trim()}async function m({url:a,extract:b="text",selector:c,wait_for:d,max_chars:g=12e3}={}){let h,i,j,n,o,p=Math.min(Number(g)||12e3,5e4),q=(0,e.N)("browser_navigate",null);try{({res:h,html:i,finalUrl:j,redirects:n}=await k(a,q))}catch(b){return{status:"error",url:a,final_url:a,content_type:null,content:"Fetch error: "+String(b&&b.message?b.message:b).slice(0,512),length:0}}let r=h.headers.get("content-type")||"";if(d&&!i.includes(d))return{status:"incomplete",url:a,final_url:j,content_type:r,hint:"Substring not found, site may need JS rendering",length:i.length,...n?{redirects:n}:{}};let s=i;if(c){let a=function(a,b){if(!b)return null;try{let c;if(b.startsWith("#")){let a=b.slice(1).replace(/[.*+?^${}()|[\]\\]/g,"\\$&");c=RegExp("<[a-z][^>]+id=[\"']"+a+"[\"'][^>]*>([\\s\\S]*?)<\\/[a-z]+>","i")}else if(b.startsWith(".")){let a=b.slice(1).replace(/[.*+?^${}()|[\]\\]/g,"\\$&");c=RegExp("<[a-z][^>]+class=[\"'][^\"']*"+a+"[^\"']*[\"'][^>]*>([\\s\\S]*?)<\\/[a-z]+>","i")}else{let a=b.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");c=RegExp("<"+a+"[^>]*>([\\s\\S]*?)<\\/"+a+">","i")}let d=a.match(c);return d?d[0]:null}catch{return null}}(i,c);a&&(s=a)}try{if("text"===b)o=l(s).slice(0,p);else if("markdown"===b)o=s.replace(/<(script|style|noscript)[\s\S]*?<\/\1>/gi,"").replace(/<h1[^>]*>([\s\S]*?)<\/h1>/gi,(a,b)=>"\n# "+l(b)+"\n").replace(/<h2[^>]*>([\s\S]*?)<\/h2>/gi,(a,b)=>"\n## "+l(b)+"\n").replace(/<h3[^>]*>([\s\S]*?)<\/h3>/gi,(a,b)=>"\n### "+l(b)+"\n").replace(/<h[4-6][^>]*>([\s\S]*?)<\/h[4-6]>/gi,(a,b)=>"\n#### "+l(b)+"\n").replace(/<a[^>]+href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/gi,(a,b,c)=>"["+l(c)+"]("+b+")").replace(/<code[^>]*>([\s\S]*?)<\/code>/gi,(a,b)=>"`"+b+"`").replace(/<pre[^>]*>([\s\S]*?)<\/pre>/gi,(a,b)=>"\n```\n"+l(b)+"\n```\n").replace(/<li[^>]*>([\s\S]*?)<\/li>/gi,(a,b)=>"\n- "+l(b)).replace(/<\/?(p|div|br)[^>]*>/gi,"\n").replace(/<[^>]+>/g," ").replace(/&amp;/g,"&").replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"').replace(/&#39;/g,"'").replace(/&nbsp;/g," ").replace(/[ \t]+/g," ").replace(/\n{3,}/g,"\n\n").trim().slice(0,p);else o="json-ld"===b?function(a){let b,c=[],d=/<script[^>]+type=["']application\/ld\+json["'][^>]*>([\s\S]*?)<\/script>/gi;for(;null!==(b=d.exec(a));)try{c.push(JSON.parse(b[1]))}catch{}return c}(s):"metadata"===b?function(a){let b,c={},d=a.match(/<title[^>]*>([\s\S]*?)<\/title>/i);d&&(c.title=d[1].replace(/<[^>]+>/g,"").trim());let e=/<meta[^>]+(?:name|property)=["']([^"']+)["'][^>]+content=["']([^"']*)["'][^>]*>/gi;for(;null!==(b=e.exec(a));)c[b[1]]=b[2];let f=/<meta[^>]+content=["']([^"']*)["'][^>]+(?:name|property)=["']([^"']+)["'][^>]*>/gi;for(;null!==(b=f.exec(a));)c[b[2]]||(c[b[2]]=b[1]);return c}(s):s.slice(0,p)}catch{o=s.slice(0,p)}let t=o;return"string"==typeof o&&(t=(0,f.nc)(o)),{status:"ok",url:a,final_url:j,content_type:r,content:t,length:"string"==typeof i?i.length:0,...n?{redirects:n}:{}}}async function n(a){let[b,c]=await Promise.all([m({url:a,extract:"json-ld",max_chars:5e4}),m({url:a,extract:"metadata",max_chars:5e4})]);return{json_ld:Array.isArray(b.content)?b.content:[],metadata:"object"==typeof c.content&&null!==c.content?c.content:{}}}d()}catch(a){d(a)}})},18313:(a,b,c)=>{"use strict";c.d(b,{Hb:()=>n,MK:()=>l,NV:()=>m,Ny:()=>g,_d:()=>p,ab:()=>q,eh:()=>i,rb:()=>h,uB:()=>k,vI:()=>o});let d=["backlog","todo","in_progress","in_review","blocked","done","cancelled"],e=["low","medium","high","urgent"],f=["queued","running","waiting_approval","succeeded","failed","cancelled","timed_out"],g=["task.created","task.updated","task.assigned","task.reassigned","task.status_changed","task.comment_added","task.blocked","task.unblocked","task.completed","task.cancelled","task.child_created"],h=["lifecycle","tool_start","tool_result","log","warning","error","approval_required","delegation_proposed","delegation_completed"],i=["activity.logged","task.updated","task.comment.added","task.assigned","task.reassigned","agent.status","agent.run.queued","agent.run.status","agent.run.event","agent.run.log"],j={backlog:["todo","cancelled"],todo:["in_progress","blocked","cancelled","done"],in_progress:["in_review","blocked","todo","done","cancelled"],in_review:["in_progress","done","blocked","cancelled"],blocked:["todo","in_progress","cancelled"],done:["in_review"],cancelled:["todo"]};function k(a){return"done"===a||"cancelled"===a}function l(a){return["queued","running","waiting_approval"].includes(a)}function m(a,b="todo"){return d.includes(a)?a:b}function n(a,b="medium"){return e.includes(a)?a:b}function o(a,b="queued"){return f.includes(a)?a:b}function p(a,b="activity.logged"){return i.includes(a)?a:b}function q(a,b){if(!(!a||a===b||j[a]?.includes(b)))throw Error(`Illegal task transition: ${a} -> ${b}`)}},18530:a=>{"use strict";a.exports=JSON.parse('{"schema_version":1,"slug":"vendor-onboarding","name":"Vendor Onboarding","version":1,"description":"Standard intake for new vendors. Captures contact + services, runs an automated risk review, gates on buyer sign-off, and packages the onboarding pack.","category":"procurement","source":"marketplace","status":"published","stages":[{"slug":"intake","name":"Vendor intake","kind":"intake_form","config":{"form_schema":{"title":"Vendor Onboarding — Intake","description":"Tell us about the vendor. The risk reviewer will use this to score them.","fields":[{"name":"vendor_name","label":"Vendor company name","type":"text","required":true,"placeholder":"Legal entity name"},{"name":"primary_contact_name","label":"Primary contact name","type":"text","required":true},{"name":"primary_contact_email","label":"Primary contact email","type":"email","required":true},{"name":"country","label":"Headquarters country","type":"select","required":true,"options":["United States","United Kingdom","United Arab Emirates","Singapore","Germany","India","Other"]},{"name":"services","label":"Services offered","type":"textarea","required":true,"placeholder":"Short list of services / products this vendor will deliver."},{"name":"annual_value_usd","label":"Estimated annual contract value (USD)","type":"number","required":true,"min":0},{"name":"references","label":"References (names + companies)","type":"textarea","required":false,"placeholder":"Optional. One reference per line."}]}}},{"slug":"risk-review","name":"Automated risk review","kind":"agent_run","config":{"agent_template_slug":"vendor-risk-reviewer","prompt":"You are a vendor risk reviewer. Given the intake payload, produce a structured risk report. Do not call external services — work from the intake alone. Return strict JSON only, no surrounding prose: { \\"outcome\\": \\"pass\\" | \\"reject\\", \\"overall_risk\\": \\"low\\" | \\"medium\\" | \\"high\\", \\"concerns\\": [string], \\"references_summary\\": string, \\"recommended_action\\": \\"auto_approve\\" | \\"manual_review\\" | \\"reject\\", \\"rationale\\": string }. Set outcome=\\"reject\\" when recommended_action is \\"reject\\" (sanctioned region, missing critical info). Set outcome=\\"pass\\" otherwise — the human-approval stage that follows is the real decision point. Risk tiers: low = clear references + reasonable value, medium = thin references OR value > $250k, high = sanctioned region OR missing services OR value > $1M.","output_schema":"vendor_risk_v1","timeout_ms":60000,"on_outcome":{"pass":"buyer-signoff","reject":"fail"}},"on_pass_stage_slug":"buyer-signoff","on_fail_stage_slug":null},{"slug":"buyer-signoff","name":"Buyer sign-off","kind":"human_approval","config":{"action_type":"process.stage.approve","risk":"medium","summary_template":"Approve onboarding for {{intake.vendor_name}} ({{intake.country}}) — risk {{risk-review.overall_risk}}"},"on_pass_stage_slug":"final-package","on_fail_stage_slug":null},{"slug":"final-package","name":"Onboarding pack","kind":"package","config":{"title_template":"Vendor onboarding pack — {{intake.vendor_name}}","include_stages":["intake","risk-review","buyer-signoff"]}}]}')},18630:(a,b,c)=>{"use strict";c.d(b,{m:()=>f});var d=c(1303),e=c(81553);async function f(a={}){let b=await (0,e.runUpdateCheck)({});if(!b.reachable)return{ok:!1,from:(0,e.YO)(),to:null,applied:!1,message:"npm registry unreachable"};if(!b.behind)return{ok:!0,from:b.current,to:b.latest,applied:!1,message:"already up to date"};let c=await (0,d.applyUpdate)({initiatedBy:"self_update_tool"});return{ok:c.ok,from:c.from,to:b.latest,applied:c.ok,message:c.ok?`updated ${c.from} → v${b.latest}; restart required`:`update failed (exit ${c.code})`}}},19151:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{A2:()=>n,chatWithClaude:()=>j,xY:()=>k});var e=c(50832),f=c(65451),g=a([e,f]);[e,f]=g.then?(await g)():g;let l=Number(process.env.MADARX_ANTHROPIC_MAX_RETRIES??4),m=Number(process.env.MADARX_ANTHROPIC_OUTER_RETRIES??3);function h(){let a=(0,f.resolveAnthropicApiKey)();if(!a)throw Error("ANTHROPIC_API_KEY not configured");return new e.default({apiKey:a,maxRetries:l})}let n="claude-sonnet-4-6",o=a=>new Promise(b=>setTimeout(b,a));async function i(a,b){let c;for(let d=0;d<m;d+=1)try{return await a()}catch(e){if(c=e,!function(a){let b=a?.status;return!!(429===b||408===b||409===b||"number"==typeof b&&b>=500||null==b&&(a?.name==="APIConnectionError"||a?.name==="APIConnectionTimeoutError"||/timeout|ECONNRESET|ENOTFOUND|EAI_AGAIN|socket hang up/i.test(String(a?.message||""))))}(e)||d===m-1)throw e;let a=function(a,b){let c=a?.headers?.get?.("retry-after"),d=null!=c?Number(c):NaN;return Number.isFinite(d)&&d>=0?Math.min(1e3*d,3e4):Math.min(500*2**b,8e3)+Math.floor(250*Math.random())}(e,d);console.warn(`[claude] ${b} transient ${e?.status||e?.name||"error"} — retry ${d+1}/${m-1} in ${a}ms`),await o(a)}throw c}async function j(a,b,c=[],d={}){let e=h(),f={model:d.model||n,max_tokens:d.max_tokens||8192,system:b,messages:a};return c.length&&(f.tools=c),d.tool_choice&&(f.tool_choice=d.tool_choice),"number"==typeof d.temperature&&(f.temperature=d.temperature),i(()=>e.messages.create(f),`chat(${f.model})`)}async function k(a,b,c=[],d=n,e={}){let f=h(),g={model:d,max_tokens:e.max_tokens||8192,system:b,messages:a};if(c.length&&(g.tools=c),e.thinkingBudget>0&&/(sonnet-4|opus-4|haiku-4|3-7-sonnet)/i.test(String(d||""))){let a=Math.max(1024,Math.floor(e.thinkingBudget));g.thinking={type:"enabled",budget_tokens:a},g.max_tokens=Math.max(g.max_tokens,a+8192)}return i(()=>f.messages.stream(g),`stream(${d})`)}d()}catch(a){d(a)}})},19348:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{D4:()=>p,It:()=>q,JF:()=>r}),c(73024);var e=c(34255),f=c(24516),g=c(58282),h=c(73912),i=c(61423),j=a([e,f,g,h,i]);[e,f,g,h,i]=j.then?(await j)():j;let r=["openai","elevenlabs","local"],s="alloy",t=new Set(["alloy","echo","fable","onyx","nova","shimmer"]);function k(){let a=process.env.MADARX_LOCAL_TTS_URL;return a&&/^https?:\/\//i.test(a.trim())?a.trim():null}function l(a,...b){let c=String(a??"");for(let a of b){if(!a)continue;let b=String(a).slice(-4);c=c.split(String(a)).join(`***${b}`)}return c}async function m({text:a,voice:b,model:c,format:d,fetchFn:e}){let g,h=(0,f.getSecret)("OPENAI_API_KEY")||process.env.OPENAI_API_KEY;if(!h)throw Error("OPENAI_API_KEY missing for OpenAI TTS");let i=b&&t.has(b)?b:s,j=c||"tts-1",k=d||"mp3";try{g=await e("https://api.openai.com/v1/audio/speech",{method:"POST",headers:{Authorization:`Bearer ${h}`,"Content-Type":"application/json"},body:JSON.stringify({model:j,voice:i,input:a,format:k})})}catch(a){throw Error(`openai tts failed: ${l(a?.message,h)}`)}if(!g.ok){let a="";try{a=(await g.text()).slice(0,256)}catch{}throw Error(`openai tts http ${g.status}: ${l(a,h)}`)}return{audio_buffer:Buffer.from(await g.arrayBuffer()),mime_type:"wav"===k?"audio/wav":"audio/mpeg",extension:"wav"===k?"wav":"mp3",provider:"openai",voice:i,model:j}}async function n({text:a,voice:b,model:c,format:d,fetchFn:e}){let g,h=(0,f.getSecret)("ELEVENLABS_API_KEY")||process.env.ELEVENLABS_API_KEY;if(!h)throw Error("ELEVENLABS_API_KEY missing for ElevenLabs TTS");let i=b||(0,f.getSecret)("ELEVENLABS_VOICE_ID")||process.env.ELEVENLABS_VOICE_ID||"21m00Tcm4TlvDq8ikWAM",j=c||"eleven_multilingual_v2",k="wav"===d?"pcm_16000":"mp3_44100_128";try{g=await e(`https://api.elevenlabs.io/v1/text-to-speech/${encodeURIComponent(i)}?output_format=${k}`,{method:"POST",headers:{"xi-api-key":h,"Content-Type":"application/json",Accept:"audio/mpeg"},body:JSON.stringify({text:a,model_id:j})})}catch(a){throw Error(`elevenlabs tts failed: ${l(a?.message,h)}`)}if(!g.ok){let a="";try{a=(await g.text()).slice(0,256)}catch{}throw Error(`elevenlabs tts http ${g.status}: ${l(a,h)}`)}return{audio_buffer:Buffer.from(await g.arrayBuffer()),mime_type:k.startsWith("pcm_")?"audio/wav":"audio/mpeg",extension:k.startsWith("pcm_")?"wav":"mp3",provider:"elevenlabs",voice:i,model:j}}async function o({text:a,voice:b,model:c,format:d,fetchFn:e}){let f,g=k();if(!g)throw Error("MADARX_LOCAL_TTS_URL missing for local TTS");let h=d||"wav",i=c||process.env.MADARX_LOCAL_TTS_MODEL||"local",j=b||process.env.MADARX_LOCAL_TTS_VOICE||"default";try{f=await e(g,{method:"POST",headers:{"Content-Type":"application/json",Accept:"mp3"===h?"audio/mpeg,application/json":"audio/wav,audio/*,application/json"},body:JSON.stringify({text:a,voice:j,model:i,format:h})})}catch(a){throw Error(`local tts failed: ${l(a?.message)}`)}if(!f.ok){let a="";try{a=(await f.text()).slice(0,256)}catch{}throw Error(`local tts http ${f.status}: ${a}`)}let m=String(f.headers.get("content-type")||"").toLowerCase();if(m.includes("application/json")){let a;try{a=await f.json()}catch{throw Error("local tts returned invalid JSON")}let b=a?.audio_base64||a?.audio;if(!b)throw Error("local tts JSON must include audio_base64");let c=a.mime_type||a.content_type||("mp3"===h?"audio/mpeg":"audio/wav"),d=a.extension||(String(c).includes("mpeg")||String(c).includes("mp3")?"mp3":"wav");return{audio_buffer:Buffer.from(String(b),"base64"),mime_type:c,extension:d,provider:"local",voice:a.voice||j,model:a.model||i}}let n=Buffer.from(await f.arrayBuffer()),o=m.includes("mpeg")||m.includes("mp3")||"mp3"===h;return{audio_buffer:n,mime_type:m||(o?"audio/mpeg":"audio/wav"),extension:o?"mp3":"wav",provider:"local",voice:j,model:i}}async function p(a={}){let b=String(a.text||"").trim();if(!b)throw Error("text is required");if(b.length>4e3)throw Error("text too long: max 4000 characters");let c=String(a.provider||process.env.MADARX_VOICE_DEFAULT_PROVIDER||process.env.TTS_DEFAULT_PROVIDER||"openai").toLowerCase(),d=r.includes(c)?c:"openai",f=(0,g.N)("voice_speak",a.agent_id??null,a.fetch||fetch),j=await ("elevenlabs"===d?n:"local"===d?o:m)({text:b,voice:a.voice,model:a.model,format:a.format,fetchFn:f}),k=Math.max(500,Math.round(b.length/14*1e3)),l=null;if(a.save_to_disk&&a.project_id){let c=(0,i.U1)(a.project_id);if(c){let a=function(a){let b=(0,e.getDb)(),c=(0,h.dh)(a),d=b.prepare("SELECT * FROM disk_folders WHERE project_id = ? AND parent_id = ? AND name = ? LIMIT 1").get(a,c.id,"voice");return d||(0,h.vV)(a,c.id,"voice")}(c.id),d=b.slice(0,40).replace(/[^A-Za-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"tts";l=(0,h.QM)(c.id,a.id,{name:`${d}-${Date.now()}.${j.extension}`,buffer:j.audio_buffer,type:j.mime_type},{local_only:!1})}}try{(0,e.getDb)().prepare(`
       INSERT INTO audit_logs (id, at, type, summary, status, meta)
       VALUES (?, ?, ?, ?, ?, ?)
     `).run((0,e.newId)("audit"),(0,e.nowIso)(),"voice.tts",`TTS ${d} voice=${j.voice} chars=${b.length}`,"complete",JSON.stringify({provider:d,voice:j.voice,model:j.model,text_chars:b.length,audio_bytes:j.audio_buffer.length,disk_file_id:l?.id||null,agent_id:a.agent_id||null}))}catch(a){console.warn("[tts] audit write failed:",a?.message||a)}return{audio_buffer:j.audio_buffer,mime_type:j.mime_type,extension:j.extension,provider:d,voice:j.voice,model:j.model,duration_estimate_ms:k,disk_file:l}}function q(){return{openai:!!((0,f.getSecret)("OPENAI_API_KEY")||process.env.OPENAI_API_KEY),elevenlabs:!!((0,f.getSecret)("ELEVENLABS_API_KEY")||process.env.ELEVENLABS_API_KEY),local:!!k()}}d()}catch(a){d(a)}})},20086:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{An:()=>h,Bs:()=>g,_w:()=>j,b4:()=>i});var e=c(34255),f=a([e]);function g(a,{scope_key:b,scope_value:c},d={}){let f=(0,e.getDb)(),h=!!d.default_allow,i=f.prepare("SELECT id FROM tool_allowlists WHERE tool_name = ? AND scope_key = ?").all(a,b);return 0===i.length?h?{ok:!0}:{ok:!1,missing_entry:{tool_name:a,scope_key:b,scope_value:c}}:f.prepare("SELECT id FROM tool_allowlists WHERE tool_name = ? AND scope_key = ? AND scope_value = ?").get(a,b,String(c))?{ok:!0}:{ok:!1,missing_entry:{tool_name:a,scope_key:b,scope_value:c}}}function h({tool_name:a,scope_key:b,scope_value:c,label:d}){if(!a)throw Error("tool_name is required");if(!b)throw Error("scope_key is required");if(!c&&0!==c)throw Error("scope_value is required");let f=(0,e.getDb)(),g=(0,e.newId)("tal"),h=(0,e.nowIso)(),i=d?String(d).trim():null;return f.prepare(`
@@ -888,7 +895,7 @@ ${b}
        file_size_bytes, sha256, extraction_status, language, ingested_by_agent_id,
        created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?, 'es', ?, ?, ?)
-  `),B=0,C=0,D=0,E=0,F=0,G=b.agent_id||null;for(let a=0;a<y.length;a+=100){let b=y.slice(a,a+100),d=[];x.prepare("BEGIN").run();try{for(let a of b){B++;let b=e.extname(a).toLowerCase(),g=p.has(b)?{kind:"document",task:"mines.extract_document",status:"queued"}:q.has(b)?{kind:"tabular",task:"mines.load_tabular",status:"queued"}:r.has(b)?{kind:"spatial",task:"mines.index_spatial",status:"queued"}:s.has(b)?{kind:"photo",task:null,status:"catalog_only"}:{kind:"unsupported",task:null,status:"unsupported"},h=(0,k.X)(a),i=e.basename(a),j=null;try{j=u.statFile(a)?.size??null}catch{}if(z.get(c,a)){F++;continue}let l=(0,f.nowIso)(),m=(0,f.newId)("msd"),n=A.run(m,c,h,a,i,b.replace(/^\./,"").toLowerCase()||"other",j,g.status,G,l,l);if(0===n.changes){F++;continue}"document"===g.kind||"tabular"===g.kind||"spatial"===g.kind?(C++,d.push({task:g.task,source_document_id:m})):"photo"===g.kind?D++:E++}x.prepare("COMMIT").run()}catch(b){try{x.prepare("ROLLBACK").run()}catch{}t.push("Batch insert failed at offset "+a+": "+(b?.message||String(b)));continue}for(let a of d)try{(0,l.aJ)({type:a.task,agent_id:G,project_id:c,payload:{type:a.task,source_document_id:a.source_document_id,project_id:c}})}catch(b){t.push("Failed to enqueue "+a.task+" for "+a.source_document_id+": "+(b?.message||String(b)))}}try{(0,m.appendComplianceAudit)({user_id:b.acting_on_behalf_of_user_id||b.user_id||"system",org_id:b.org_id||"personal-org",action:"mines.data_import.completed",status:"success",summary:"Imported "+B+" files for project "+c+" — "+C+" queued, "+D+" catalog-only, "+E+" unsupported, "+F+" skipped",action_target_id:c,action_target_type:"mines_project",meta:{project_id:c,directory_root:v,files_found:B,queued:C,catalog_only:D,unsupported:E,skipped_complete:F,resume:n}})}catch{}return{status:"ok",files_found:B,queued:C,catalog_only:D,unsupported:E,skipped_complete:F,errors:t}}d()}catch(a){d(a)}})},29827:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{AU:()=>q,Bb:()=>z,J:()=>w,Sj:()=>p,Ud:()=>v,gn:()=>u,iP:()=>t,jj:()=>r,vj:()=>s,wt:()=>x,zI:()=>y});var e=c(24516),f=c(58282),g=a([e,f]);[e,f]=g.then?(await g)():g;let A="https://api.github.com";function h(a,b={}){let c=function(a,b={}){try{let c=(0,e.getSecret)(a,{agent_id:b.agent_id,project_id:b.project_id});if(c)return c}catch{}return process.env[a]||null}(a,b);if(!c)throw Error(`${a} not configured`);return c}function i(a){return{Authorization:`Bearer ${a}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28","User-Agent":"madarx-os"}}let B=/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;function j(a){if(!a||"string"!=typeof a)throw Error("repo_full_name is required (format: owner/repo)");if(!B.test(a))throw Error(`repo_full_name must be in owner/repo format, got: ${a}`)}function k(a){let[b,c]=a.split("/");return{owner:b,repo:c}}async function l(a){try{let b=await a.json();return b?.message||`GitHub API error: ${a.status}`}catch{return`GitHub API error: ${a.status}`}}function m(a){return{id:a.id,name:a.name,full_name:a.full_name,private:a.private,default_branch:a.default_branch,description:a.description||null,stars:a.stargazers_count,forks:a.forks_count,updated_at:a.updated_at}}function n(a){return{number:a.number,title:a.title,state:a.state,user:{login:a.user?.login},labels:(a.labels||[]).map(a=>"string"==typeof a?a:a.name),created_at:a.created_at,updated_at:a.updated_at,html_url:a.html_url,body_excerpt:"string"==typeof a.body?a.body.slice(0,500):null}}function o(a){return{number:a.number,title:a.title,state:a.state,user:{login:a.user?.login},labels:(a.labels||[]).map(a=>"string"==typeof a?a:a.name),created_at:a.created_at,updated_at:a.updated_at,html_url:a.html_url,body_excerpt:"string"==typeof a.body?a.body.slice(0,500):null,head:{ref:a.head?.ref,sha:a.head?.sha},base:{ref:a.base?.ref},merged:a.merged||!1,mergeable:a.mergeable??null}}async function p(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name),e=h("GITHUB_TOKEN",b),g=b.agent_id??null,n=await (0,f.N)("gh_repo_read",g)(`${A}/repos/${c}/${d}`,{headers:i(e)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return m(o)}async function q(a={},b={}){let c=h("GITHUB_TOKEN",b),d=b.agent_id??null,e=new URL(`${A}/user/repos`);a.visibility&&e.searchParams.set("visibility",String(a.visibility)),a.type&&e.searchParams.set("type",String(a.type)),a.sort&&e.searchParams.set("sort",String(a.sort));let g=Math.min(Math.max(Number(a.per_page||30),1),100);e.searchParams.set("per_page",String(g));let j=await (0,f.N)("gh_repo_list",d)(e,{headers:i(c)});if(!j.ok){let a=await l(j);throw Error(a)}let k=await j.json();return{repos:(Array.isArray(k)?k:[]).map(m)}}async function r(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name),e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=new URL(`${A}/repos/${c}/${d}/issues`);a.state&&m.searchParams.set("state",String(a.state)),a.labels&&m.searchParams.set("labels",String(a.labels));let o=Math.min(Math.max(Number(a.per_page||30),1),100);m.searchParams.set("per_page",String(o));let p=await (0,f.N)("gh_issue_list",g)(m,{headers:i(e)});if(!p.ok){let a=await l(p);throw Error(a)}let q=await p.json();return{issues:(Array.isArray(q)?q:[]).map(n)}}async function s(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.title)throw Error("title is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={title:String(a.title)};a.body&&(m.body=String(a.body)),Array.isArray(a.labels)&&(m.labels=a.labels.map(String)),Array.isArray(a.assignees)&&(m.assignees=a.assignees.map(String));let o=await (0,f.N)("gh_issue_create",g)(`${A}/repos/${c}/${d}/issues`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!o.ok){let a=await l(o);throw Error(a)}let p=await o.json();return n(p)}async function t(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.issue_number)throw Error("issue_number is required");if(!a.body)throw Error("body is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=await (0,f.N)("gh_issue_comment",g)(`${A}/repos/${c}/${d}/issues/${a.issue_number}/comments`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify({body:String(a.body)})});if(!m.ok){let a=await l(m);throw Error(a)}let n=await m.json();return{id:n.id,html_url:n.html_url,created_at:n.created_at}}async function u(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name),e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=new URL(`${A}/repos/${c}/${d}/pulls`);a.state&&m.searchParams.set("state",String(a.state)),a.head&&m.searchParams.set("head",String(a.head)),a.base&&m.searchParams.set("base",String(a.base));let n=Math.min(Math.max(Number(a.per_page||30),1),100);m.searchParams.set("per_page",String(n));let p=await (0,f.N)("gh_pr_list",g)(m,{headers:i(e)});if(!p.ok){let a=await l(p);throw Error(a)}let q=await p.json();return{pull_requests:(Array.isArray(q)?q:[]).map(o)}}async function v(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.title)throw Error("title is required");if(!a.head)throw Error("head is required");if(!a.base)throw Error("base is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={title:String(a.title),head:String(a.head),base:String(a.base)};a.body&&(m.body=String(a.body)),void 0!==a.draft&&(m.draft=!!a.draft);let n=await (0,f.N)("gh_pr_create",g)(`${A}/repos/${c}/${d}/pulls`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}let p=await n.json();return o(p)}async function w(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.pr_number)throw Error("pr_number is required");if(!a.body)throw Error("body is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=await (0,f.N)("gh_pr_comment",g)(`${A}/repos/${c}/${d}/issues/${a.pr_number}/comments`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify({body:String(a.body)})});if(!m.ok){let a=await l(m);throw Error(a)}let n=await m.json();return{id:n.id,html_url:n.html_url,created_at:n.created_at}}async function x(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.pr_number)throw Error("pr_number is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={merge_method:a.merge_method||"squash"};a.commit_title&&(m.commit_title=String(a.commit_title)),a.commit_message&&(m.commit_message=String(a.commit_message));let n=await (0,f.N)("gh_pr_merge",g)(`${A}/repos/${c}/${d}/pulls/${a.pr_number}/merge`,{method:"PUT",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return{merged:!0,sha:o.sha,message:o.message}}async function y(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.workflow_id)throw Error("workflow_id is required");if(!a.ref)throw Error("ref is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={ref:String(a.ref)};a.inputs&&"object"==typeof a.inputs&&(m.inputs=a.inputs);let n=await (0,f.N)("gh_actions_dispatch",g)(`${A}/repos/${c}/${d}/actions/workflows/${encodeURIComponent(String(a.workflow_id))}/dispatches`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}return{ok:!0,workflow_id:a.workflow_id,ref:a.ref}}async function z(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.tag_name)throw Error("tag_name is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={tag_name:String(a.tag_name)};a.target_commitish&&(m.target_commitish=String(a.target_commitish)),a.name&&(m.name=String(a.name)),a.body&&(m.body=String(a.body)),void 0!==a.draft&&(m.draft=!!a.draft),void 0!==a.prerelease&&(m.prerelease=!!a.prerelease);let n=await (0,f.N)("gh_release_create",g)(`${A}/repos/${c}/${d}/releases`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return{id:o.id,tag_name:o.tag_name,html_url:o.html_url,draft:o.draft,prerelease:o.prerelease}}d()}catch(a){d(a)}})},30918:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{b:()=>n});var e=c(76760),f=c(73024),g=c(78608),h=c(34255),i=c(73912),j=c(4160),k=c(9381),l=a([h,i,j]);[h,i,j]=l.then?(await l)():l;let o=Object.create(null);for(let[a,b]of Object.entries({name:["name","project","proyecto","nombre","prospect","target","project name","project/prospect"],commodity:["commodity","commodities","mineral","metal","commodity/commodities"],deposit_type:["deposit","deposit_type","deposit/target type","tipo","target type","deposit type","tipo de deposito","tipo de yacimiento"],owner:["owner","propietario","titular","company","empresa","operator"],available_information:["available information","informacion disponible","informaci\xf3n disponible","info","data available","available info","available data"],has_drilling:["has drilling","drilling","barrenacion","sondeo","drilled","has_drilling","has drilling?","drilling?"],deal_terms:["deal terms","deal","terms","terminos","t\xe9rminos","negociacion","negociaci\xf3n","deal/terms"],data_completeness:["data completeness","completeness","completitud","data_completeness","% completeness","completeness %"],notes:["notes","notas","comments","comentarios","observaciones","note","remarks","comentario"]}))for(let c of b)o[c.toLowerCase().trim()]=a;function m(a){if(null==a)return null;let b=a?.value??a;if(null==b)return null;if("object"==typeof b&&null!==b){if(void 0!==b.result)return String(b.result).trim()||null;if(void 0!==b.text)return String(b.text).trim()||null;if(Array.isArray(b.richText))return b.richText.map(a=>a.text||"").join("").trim()||null;if(b instanceof Date)return b.toISOString()}return String(b).trim()||null}async function n(a,b={}){let c,d,{file_id:l,portfolio_name:p,sheet_name:q}=a||{},r=[],s=(0,i.mM)(l);if(!s)return{status:"error",error:"file_not_found",errors:["Disk file not found: "+l]};{let a,b,c=e.join(k.nJ,"disk");try{a=f.realpathSync(s.storage_path)}catch{return{status:"error",error:"file_inaccessible",errors:["Disk file path is not accessible: "+s.storage_path]}}try{b=f.realpathSync(c)}catch{b=e.resolve(c)}let d=e.relative(b,a);if(!(""!==d&&!d.startsWith("..")&&!e.isAbsolute(d)))throw Error("Unsafe file path blocked by safety policy: storage_path is outside allowed disk root: "+s.storage_path)}let t=new g.Workbook;if(await t.xlsx.readFile(s.storage_path),q){if(!(c=t.getWorksheet(q)))return{status:"error",error:"sheet_not_found",errors:['Sheet "'+q+'" not found in workbook']}}else c=t.worksheets[0];if(!c)return{status:"error",error:"no_sheets",errors:["Workbook contains no worksheets"]};let u=c.getRow(1),v=Object.create(null),w=!1;if(u.eachCell({includeEmpty:!1},(a,b)=>{let c=m(a);if(!c)return;let d=o[c.toLowerCase().trim()];d&&(v[b]=d,"name"===d&&(w=!0))}),!w)return{status:"error",error:"missing_required_column",errors:['Required column "name" (or alias: project/proyecto/nombre/prospect/target) not found in sheet headers']};let x=(0,h.getDb)(),y=(0,h.nowIso)(),z=x.prepare("SELECT id FROM mines_portfolios WHERE name = ? LIMIT 1"),A=x.prepare("INSERT INTO mines_portfolios (id, name, source_catalog_artifact_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?)"),B=x.prepare("SELECT id FROM mines_portfolio_entries WHERE portfolio_id = ? AND name = ? LIMIT 1"),C=x.prepare(`
+  `),B=0,C=0,D=0,E=0,F=0,G=b.agent_id||null;for(let a=0;a<y.length;a+=100){let b=y.slice(a,a+100),d=[];x.prepare("BEGIN").run();try{for(let a of b){B++;let b=e.extname(a).toLowerCase(),g=p.has(b)?{kind:"document",task:"mines.extract_document",status:"queued"}:q.has(b)?{kind:"tabular",task:"mines.load_tabular",status:"queued"}:r.has(b)?{kind:"spatial",task:"mines.index_spatial",status:"queued"}:s.has(b)?{kind:"photo",task:null,status:"catalog_only"}:{kind:"unsupported",task:null,status:"unsupported"},h=(0,k.X)(a),i=e.basename(a),j=null;try{j=u.statFile(a)?.size??null}catch{}if(z.get(c,a)){F++;continue}let l=(0,f.nowIso)(),m=(0,f.newId)("msd"),n=A.run(m,c,h,a,i,b.replace(/^\./,"").toLowerCase()||"other",j,g.status,G,l,l);if(0===n.changes){F++;continue}"document"===g.kind||"tabular"===g.kind||"spatial"===g.kind?(C++,d.push({task:g.task,source_document_id:m})):"photo"===g.kind?D++:E++}x.prepare("COMMIT").run()}catch(b){try{x.prepare("ROLLBACK").run()}catch{}t.push("Batch insert failed at offset "+a+": "+(b?.message||String(b)));continue}for(let a of d)try{(0,l.aJ)({type:a.task,agent_id:G,project_id:c,payload:{type:a.task,source_document_id:a.source_document_id,project_id:c}})}catch(b){t.push("Failed to enqueue "+a.task+" for "+a.source_document_id+": "+(b?.message||String(b)))}}try{(0,m.appendComplianceAudit)({user_id:b.acting_on_behalf_of_user_id||b.user_id||"system",org_id:b.org_id||"personal-org",action:"mines.data_import.completed",status:"success",summary:"Imported "+B+" files for project "+c+" — "+C+" queued, "+D+" catalog-only, "+E+" unsupported, "+F+" skipped",action_target_id:c,action_target_type:"mines_project",meta:{project_id:c,directory_root:v,files_found:B,queued:C,catalog_only:D,unsupported:E,skipped_complete:F,resume:n}})}catch{}return{status:"ok",files_found:B,queued:C,catalog_only:D,unsupported:E,skipped_complete:F,errors:t}}d()}catch(a){d(a)}})},29827:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{AU:()=>q,Bb:()=>z,J:()=>w,Sj:()=>p,Ud:()=>v,gn:()=>u,iP:()=>t,jj:()=>r,vj:()=>s,wt:()=>x,zI:()=>y});var e=c(24516),f=c(58282),g=a([e,f]);[e,f]=g.then?(await g)():g;let A="https://api.github.com";function h(a,b={}){let c=function(a,b={}){try{let c=(0,e.getSecret)(a,{agent_id:b.agent_id,project_id:b.project_id});if(c)return c}catch{}return process.env[a]||null}(a,b);if(!c)throw Error(`${a} not configured`);return c}function i(a){return{Authorization:`Bearer ${a}`,Accept:"application/vnd.github+json","X-GitHub-Api-Version":"2022-11-28","User-Agent":"madarx-os"}}let B=/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;function j(a){if(!a||"string"!=typeof a)throw Error("repo_full_name is required (format: owner/repo)");if(!B.test(a))throw Error(`repo_full_name must be in owner/repo format, got: ${a}`)}function k(a){let[b,c]=a.split("/");return{owner:b,repo:c}}async function l(a){let b=`GitHub API error: ${a.status}`;try{let c=await a.json();c?.message&&(b=c.message)}catch{}let c=a.headers?.get?.("x-github-sso");if(403===a.status&&c){let a=/url=([^;,\s]+)/i.exec(c),d=a?` Authorize it here: ${a[1]}`:"";return`${b} — this org requires SAML SSO authorization for your token.${d}`}return 403===a.status?`${b} — the token is valid but lacks permission for this resource (check the fine-grained PAT's repository access / scopes, and authorize SSO if the org uses it).`:404===a.status?`${b} — not found, OR your token cannot see it. A fine-grained PAT only sees repos it was explicitly granted; a classic PAT needs the 'repo' scope. Grant access to this repo/org and retry.`:b}function m(a){return{id:a.id,name:a.name,full_name:a.full_name,private:a.private,default_branch:a.default_branch,description:a.description||null,stars:a.stargazers_count,forks:a.forks_count,updated_at:a.updated_at}}function n(a){return{number:a.number,title:a.title,state:a.state,user:{login:a.user?.login},labels:(a.labels||[]).map(a=>"string"==typeof a?a:a.name),created_at:a.created_at,updated_at:a.updated_at,html_url:a.html_url,body_excerpt:"string"==typeof a.body?a.body.slice(0,500):null}}function o(a){return{number:a.number,title:a.title,state:a.state,user:{login:a.user?.login},labels:(a.labels||[]).map(a=>"string"==typeof a?a:a.name),created_at:a.created_at,updated_at:a.updated_at,html_url:a.html_url,body_excerpt:"string"==typeof a.body?a.body.slice(0,500):null,head:{ref:a.head?.ref,sha:a.head?.sha},base:{ref:a.base?.ref},merged:a.merged||!1,mergeable:a.mergeable??null}}async function p(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name),e=h("GITHUB_TOKEN",b),g=b.agent_id??null,n=await (0,f.N)("gh_repo_read",g)(`${A}/repos/${c}/${d}`,{headers:i(e)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return m(o)}async function q(a={},b={}){let c,d=h("GITHUB_TOKEN",b),e=b.agent_id??null,g=a.org?String(a.org).trim():"";if(g){if(!/^[A-Za-z0-9_.-]+$/.test(g))throw Error(`org must be a valid GitHub org/owner name, got: ${g}`);c=new URL(`${A}/orgs/${g}/repos`),a.type&&c.searchParams.set("type",String(a.type))}else(c=new URL(`${A}/user/repos`)).searchParams.set("affiliation",String(a.affiliation||"owner,collaborator,organization_member")),a.visibility&&c.searchParams.set("visibility",String(a.visibility)),a.type&&!a.affiliation&&(c.searchParams.delete("affiliation"),c.searchParams.set("type",String(a.type)));a.sort&&c.searchParams.set("sort",String(a.sort));let j=Math.min(Math.max(Number(a.per_page||30),1),100);c.searchParams.set("per_page",String(j));let k=Math.max(Number(a.page||1),1);k>1&&c.searchParams.set("page",String(k));let n=await (0,f.N)("gh_repo_list",e)(c,{headers:i(d)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return{repos:(Array.isArray(o)?o:[]).map(m)}}async function r(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name),e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=new URL(`${A}/repos/${c}/${d}/issues`);a.state&&m.searchParams.set("state",String(a.state)),a.labels&&m.searchParams.set("labels",String(a.labels));let o=Math.min(Math.max(Number(a.per_page||30),1),100);m.searchParams.set("per_page",String(o));let p=await (0,f.N)("gh_issue_list",g)(m,{headers:i(e)});if(!p.ok){let a=await l(p);throw Error(a)}let q=await p.json();return{issues:(Array.isArray(q)?q:[]).map(n)}}async function s(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.title)throw Error("title is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={title:String(a.title)};a.body&&(m.body=String(a.body)),Array.isArray(a.labels)&&(m.labels=a.labels.map(String)),Array.isArray(a.assignees)&&(m.assignees=a.assignees.map(String));let o=await (0,f.N)("gh_issue_create",g)(`${A}/repos/${c}/${d}/issues`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!o.ok){let a=await l(o);throw Error(a)}let p=await o.json();return n(p)}async function t(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.issue_number)throw Error("issue_number is required");if(!a.body)throw Error("body is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=await (0,f.N)("gh_issue_comment",g)(`${A}/repos/${c}/${d}/issues/${a.issue_number}/comments`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify({body:String(a.body)})});if(!m.ok){let a=await l(m);throw Error(a)}let n=await m.json();return{id:n.id,html_url:n.html_url,created_at:n.created_at}}async function u(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name),e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=new URL(`${A}/repos/${c}/${d}/pulls`);a.state&&m.searchParams.set("state",String(a.state)),a.head&&m.searchParams.set("head",String(a.head)),a.base&&m.searchParams.set("base",String(a.base));let n=Math.min(Math.max(Number(a.per_page||30),1),100);m.searchParams.set("per_page",String(n));let p=await (0,f.N)("gh_pr_list",g)(m,{headers:i(e)});if(!p.ok){let a=await l(p);throw Error(a)}let q=await p.json();return{pull_requests:(Array.isArray(q)?q:[]).map(o)}}async function v(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.title)throw Error("title is required");if(!a.head)throw Error("head is required");if(!a.base)throw Error("base is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={title:String(a.title),head:String(a.head),base:String(a.base)};a.body&&(m.body=String(a.body)),void 0!==a.draft&&(m.draft=!!a.draft);let n=await (0,f.N)("gh_pr_create",g)(`${A}/repos/${c}/${d}/pulls`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}let p=await n.json();return o(p)}async function w(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.pr_number)throw Error("pr_number is required");if(!a.body)throw Error("body is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m=await (0,f.N)("gh_pr_comment",g)(`${A}/repos/${c}/${d}/issues/${a.pr_number}/comments`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify({body:String(a.body)})});if(!m.ok){let a=await l(m);throw Error(a)}let n=await m.json();return{id:n.id,html_url:n.html_url,created_at:n.created_at}}async function x(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.pr_number)throw Error("pr_number is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={merge_method:a.merge_method||"squash"};a.commit_title&&(m.commit_title=String(a.commit_title)),a.commit_message&&(m.commit_message=String(a.commit_message));let n=await (0,f.N)("gh_pr_merge",g)(`${A}/repos/${c}/${d}/pulls/${a.pr_number}/merge`,{method:"PUT",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return{merged:!0,sha:o.sha,message:o.message}}async function y(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.workflow_id)throw Error("workflow_id is required");if(!a.ref)throw Error("ref is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={ref:String(a.ref)};a.inputs&&"object"==typeof a.inputs&&(m.inputs=a.inputs);let n=await (0,f.N)("gh_actions_dispatch",g)(`${A}/repos/${c}/${d}/actions/workflows/${encodeURIComponent(String(a.workflow_id))}/dispatches`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}return{ok:!0,workflow_id:a.workflow_id,ref:a.ref}}async function z(a={},b={}){j(a.repo_full_name);let{owner:c,repo:d}=k(a.repo_full_name);if(!a.tag_name)throw Error("tag_name is required");let e=h("GITHUB_TOKEN",b),g=b.agent_id??null,m={tag_name:String(a.tag_name)};a.target_commitish&&(m.target_commitish=String(a.target_commitish)),a.name&&(m.name=String(a.name)),a.body&&(m.body=String(a.body)),void 0!==a.draft&&(m.draft=!!a.draft),void 0!==a.prerelease&&(m.prerelease=!!a.prerelease);let n=await (0,f.N)("gh_release_create",g)(`${A}/repos/${c}/${d}/releases`,{method:"POST",headers:{...i(e),"Content-Type":"application/json"},body:JSON.stringify(m)});if(!n.ok){let a=await l(n);throw Error(a)}let o=await n.json();return{id:o.id,tag_name:o.tag_name,html_url:o.html_url,draft:o.draft,prerelease:o.prerelease}}d()}catch(a){d(a)}})},30918:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{b:()=>n});var e=c(76760),f=c(73024),g=c(78608),h=c(34255),i=c(73912),j=c(4160),k=c(9381),l=a([h,i,j]);[h,i,j]=l.then?(await l)():l;let o=Object.create(null);for(let[a,b]of Object.entries({name:["name","project","proyecto","nombre","prospect","target","project name","project/prospect"],commodity:["commodity","commodities","mineral","metal","commodity/commodities"],deposit_type:["deposit","deposit_type","deposit/target type","tipo","target type","deposit type","tipo de deposito","tipo de yacimiento"],owner:["owner","propietario","titular","company","empresa","operator"],available_information:["available information","informacion disponible","informaci\xf3n disponible","info","data available","available info","available data"],has_drilling:["has drilling","drilling","barrenacion","sondeo","drilled","has_drilling","has drilling?","drilling?"],deal_terms:["deal terms","deal","terms","terminos","t\xe9rminos","negociacion","negociaci\xf3n","deal/terms"],data_completeness:["data completeness","completeness","completitud","data_completeness","% completeness","completeness %"],notes:["notes","notas","comments","comentarios","observaciones","note","remarks","comentario"]}))for(let c of b)o[c.toLowerCase().trim()]=a;function m(a){if(null==a)return null;let b=a?.value??a;if(null==b)return null;if("object"==typeof b&&null!==b){if(void 0!==b.result)return String(b.result).trim()||null;if(void 0!==b.text)return String(b.text).trim()||null;if(Array.isArray(b.richText))return b.richText.map(a=>a.text||"").join("").trim()||null;if(b instanceof Date)return b.toISOString()}return String(b).trim()||null}async function n(a,b={}){let c,d,{file_id:l,portfolio_name:p,sheet_name:q}=a||{},r=[],s=(0,i.mM)(l);if(!s)return{status:"error",error:"file_not_found",errors:["Disk file not found: "+l]};{let a,b,c=e.join(k.nJ,"disk");try{a=f.realpathSync(s.storage_path)}catch{return{status:"error",error:"file_inaccessible",errors:["Disk file path is not accessible: "+s.storage_path]}}try{b=f.realpathSync(c)}catch{b=e.resolve(c)}let d=e.relative(b,a);if(!(""!==d&&!d.startsWith("..")&&!e.isAbsolute(d)))throw Error("Unsafe file path blocked by safety policy: storage_path is outside allowed disk root: "+s.storage_path)}let t=new g.Workbook;if(await t.xlsx.readFile(s.storage_path),q){if(!(c=t.getWorksheet(q)))return{status:"error",error:"sheet_not_found",errors:['Sheet "'+q+'" not found in workbook']}}else c=t.worksheets[0];if(!c)return{status:"error",error:"no_sheets",errors:["Workbook contains no worksheets"]};let u=c.getRow(1),v=Object.create(null),w=!1;if(u.eachCell({includeEmpty:!1},(a,b)=>{let c=m(a);if(!c)return;let d=o[c.toLowerCase().trim()];d&&(v[b]=d,"name"===d&&(w=!0))}),!w)return{status:"error",error:"missing_required_column",errors:['Required column "name" (or alias: project/proyecto/nombre/prospect/target) not found in sheet headers']};let x=(0,h.getDb)(),y=(0,h.nowIso)(),z=x.prepare("SELECT id FROM mines_portfolios WHERE name = ? LIMIT 1"),A=x.prepare("INSERT INTO mines_portfolios (id, name, source_catalog_artifact_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?)"),B=x.prepare("SELECT id FROM mines_portfolio_entries WHERE portfolio_id = ? AND name = ? LIMIT 1"),C=x.prepare(`
     UPDATE mines_portfolio_entries
     SET commodity = ?, deposit_type = ?, owner = ?, available_information = ?,
         has_drilling = ?, deal_terms = ?, data_completeness = ?, notes = ?, updated_at = ?
@@ -910,17 +917,19 @@ ${b}
     WHERE project_id = ?
     GROUP BY document_category
   `).all(a),f=b.prepare("SELECT COUNT(*) AS n FROM mines_spatial_assets WHERE project_id = ?").get(a),g=new Map,h={total_files:0,queued:0,running:0,complete:0,failed:0,skipped:0};for(let a of c){let b=a.document_category;g.has(b)||g.set(b,{document_category:b,document_count:0,chunk_count:0,status_breakdown:{}});let c=g.get(b);c.document_count+=a.n,c.status_breakdown[a.extraction_status]=(c.status_breakdown[a.extraction_status]||0)+a.n,h.total_files+=a.n,h[i[a.extraction_status]||"queued"]+=a.n}for(let a of d)g.has(a.document_category)||g.set(a.document_category,{document_category:a.document_category,document_count:0,chunk_count:0,status_breakdown:{}}),g.get(a.document_category).chunk_count=a.n;let j=[...g.values()].sort((a,b)=>a.document_category.localeCompare(b.document_category)),k=j.filter(a=>a.document_count>0),l=k.filter(a=>(a.status_breakdown.complete||0)+(a.status_breakdown.embedding_failed||0)+(a.status_breakdown.done||0)>0),m=0===k.length?0:Math.round(l.length/k.length*100)/100,n=d.reduce((a,b)=>a+b.n,0);return{project_id:a,categories:j,totals:{documents:h.total_files,chunks:n},spatial_assets_count:f?.n??0,completeness_score:m,progress:h}}function h(a){return g(a).progress}d()}catch(a){d(a)}})},33446:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Im:()=>r,LC:()=>z,LQ:()=>u,V6:()=>n,VD:()=>v,fo:()=>t,gB:()=>o,hI:()=>q,vR:()=>s});var e=c(73024),f=c(76760),g=c(77030),h=c(71553),i=c(77598),j=c(67179),k=c(24516),l=c(9381),m=a([j,k]);[j,k]=m.then?(await m)():m;let A="auth_mode",B=new Set(["local","supabase"]),C=f.join(l.nJ,".auth-recovery-token");function n(){try{if(e.existsSync(C)){let a=e.readFileSync(C,"utf8").trim();if(a)return a}e.mkdirSync(l.nJ,{recursive:!0});let a=(0,i.randomBytes)(24).toString("hex");e.writeFileSync(C,`${a}
-`,{mode:384});try{e.chmodSync(C,384)}catch{}return a}catch(a){return console.warn("[auth-config] ensureRecoveryToken failed:",a.message),null}}function o(a){if(!a||"string"!=typeof a)return!1;let b=null;try{b=e.readFileSync(C,"utf8").trim()}catch{return!1}if(!b)return!1;let c=Buffer.from(a.trim()),d=Buffer.from(b);return c.length===d.length&&(0,i.timingSafeEqual)(c,d)}function p(){let a=process.env.MADARX_AUTH_MODE;return a&&String(a).trim()?String(a).trim().toLowerCase():null}function q(){let a=p();return!!(a&&B.has(a))}function r(){let a=p();if(a&&B.has(a))return a;try{let a=(0,j.getConfig)(A,null);if(a&&B.has(a))return a}catch{}return"local"}function s(){let a=null,b=null;try{a=(0,k.getSecret)("SUPABASE_URL"),b=(0,k.getSecret)("SUPABASE_ANON_KEY")}catch{}return a=a||process.env.NEXT_PUBLIC_SUPABASE_URL||process.env.SUPABASE_URL||null,b=b||process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY||process.env.SUPABASE_ANON_KEY||null,{url:a||null,anonKey:b||null}}function t(){try{let a=(0,k.getSecret)("SUPABASE_SERVICE_ROLE_KEY");if(a)return a}catch{}return process.env.SUPABASE_SERVICE_ROLE_KEY||null}function u(){return!!t()}function v({mode:a,url:b,anonKey:c,serviceKey:d}={}){if(b&&String(b).trim()&&(0,k.setSecret)("SUPABASE_URL",String(b).trim(),{source:"manual"}),c&&String(c).trim()&&(0,k.setSecret)("SUPABASE_ANON_KEY",String(c).trim(),{source:"manual"}),d&&String(d).trim()&&(0,k.setSecret)("SUPABASE_SERVICE_ROLE_KEY",String(d).trim(),{source:"manual"}),null!=a&&""!==a){let b=String(a).toLowerCase();if(!B.has(b))throw Error(`invalid auth mode: ${a}`);if("supabase"===b){let{url:a,anonKey:b}=s();if(!a||!b)throw Error("cannot switch to supabase mode without a configured SUPABASE_URL and SUPABASE_ANON_KEY");n()}(0,j.setConfig)(A,b)}return{mode:r()}}function w(a){return a.split(".").reduce((a,b)=>a<<8|parseInt(b,10),0)>>>0}function x(a){let b=w(a),c=(a,c)=>(b&(0===c?0:-1<<32-c>>>0))==(w(a)&(0===c?0:-1<<32-c>>>0));return c("0.0.0.0",8)||c("10.0.0.0",8)||c("100.64.0.0",10)||c("127.0.0.0",8)||c("169.254.0.0",16)||c("172.16.0.0",12)||c("192.168.0.0",16)||c("192.0.0.0",24)||c("198.18.0.0",15)||c("224.0.0.0",4)||c("240.0.0.0",4)}function y(a){let b=g.isIP(a);if(4===b)return x(a);if(6===b){let b=a.toLowerCase();if("::1"===b||"::"===b||b.startsWith("fe80")||b.startsWith("fe9")||b.startsWith("fea")||b.startsWith("feb")||b.startsWith("fc")||b.startsWith("fd"))return!0;let c=b.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);return!!c&&x(c[1])}return!0}async function z({url:a,anonKey:b}={}){let c;if(!a||!b)return{ok:!1,error:"missing_url_or_key"};try{c=new URL(a)}catch{return{ok:!1,error:"invalid_url"}}if("https:"!==c.protocol)return{ok:!1,error:"must_be_https"};try{let a=c.hostname;if(g.isIP(a)){if(y(a))return{ok:!1,error:"blocked_host"}}else{let b=await (0,h.lookup)(a,{all:!0});if(!b.length||b.some(a=>y(a.address)))return{ok:!1,error:"blocked_host"}}}catch{return{ok:!1,error:"unreachable"}}try{return(await fetch(`${c.origin}/auth/v1/health`,{headers:{apikey:b,Authorization:`Bearer ${b}`},redirect:"error",signal:AbortSignal.timeout(4e3)})).ok?{ok:!0}:{ok:!1,error:"unreachable"}}catch{return{ok:!1,error:"unreachable"}}}d()}catch(a){d(a)}})},34255:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{getDb:()=>n,newId:()=>p,nowIso:()=>o});var e=c(80099),f=c(73024),g=c(76760),h=c(48161),i=c(77598),j=c(9381),k=c(50662),l=c(23167),m=a([l]);l=(m.then?(await m)():m)[0];let q=null,r=null;function n(){if(q&&r===j.c_)return q;if(q){try{q.close()}catch{}q=null}(0,j.Jh)();let a=new e.DatabaseSync(j.c_);for(let b of(a.exec("PRAGMA journal_mode=WAL;"),a.exec("PRAGMA busy_timeout=5000;"),a.exec("PRAGMA foreign_keys=ON;"),a.exec(k.x),["ALTER TABLE artifacts ADD COLUMN title TEXT","ALTER TABLE artifacts ADD COLUMN content TEXT","ALTER TABLE artifacts ADD COLUMN source_md TEXT","ALTER TABLE agents ADD COLUMN system_prompt TEXT","ALTER TABLE agents ADD COLUMN memory TEXT","ALTER TABLE agents ADD COLUMN model TEXT","ALTER TABLE runs ADD COLUMN output TEXT","ALTER TABLE hermes_jobs ADD COLUMN cwd TEXT","ALTER TABLE hermes_jobs ADD COLUMN timeout_ms INTEGER","ALTER TABLE connectors ADD COLUMN type TEXT","ALTER TABLE connectors ADD COLUMN capabilities TEXT","ALTER TABLE connectors ADD COLUMN metadata TEXT","ALTER TABLE schedules ADD COLUMN last_queued_at TEXT","ALTER TABLE schedules ADD COLUMN last_queued_window TEXT","ALTER TABLE heartbeat_tasks ADD COLUMN approval_request_id TEXT","ALTER TABLE agents ADD COLUMN reports_to TEXT","ALTER TABLE agents ADD COLUMN role TEXT","ALTER TABLE agents ADD COLUMN title TEXT","ALTER TABLE agents ADD COLUMN status_reason TEXT","ALTER TABLE agents ADD COLUMN autonomy_mode TEXT","ALTER TABLE agents ADD COLUMN budget_monthly_cents INTEGER DEFAULT 0","ALTER TABLE agents ADD COLUMN spent_monthly_cents INTEGER DEFAULT 0","ALTER TABLE agents ADD COLUMN permissions_json TEXT","ALTER TABLE agents ADD COLUMN metadata_json TEXT","ALTER TABLE agents ADD COLUMN project_id TEXT","ALTER TABLE agents ADD COLUMN template_slug TEXT","ALTER TABLE secrets ADD COLUMN project_id TEXT","ALTER TABLE audit_logs ADD COLUMN project_id TEXT","ALTER TABLE audit_logs ADD COLUMN correlation_id TEXT","ALTER TABLE tool_egress ADD COLUMN project_id TEXT","ALTER TABLE activity_log ADD COLUMN project_id TEXT","ALTER TABLE artifacts ADD COLUMN project_id TEXT","ALTER TABLE heartbeat_tasks ADD COLUMN project_id TEXT","ALTER TABLE transcripts ADD COLUMN engine TEXT","ALTER TABLE transcripts ADD COLUMN language TEXT","ALTER TABLE transcripts ADD COLUMN duration_seconds REAL","ALTER TABLE approval_requests ADD COLUMN project_id TEXT","ALTER TABLE projects ADD COLUMN folder_path TEXT","ALTER TABLE tasks ADD COLUMN due_at TEXT","ALTER TABLE tasks ADD COLUMN tags_json TEXT","ALTER TABLE tasks ADD COLUMN estimate_minutes INTEGER","ALTER TABLE tasks ADD COLUMN watchers_json TEXT","ALTER TABLE tasks ADD COLUMN recurrence TEXT","ALTER TABLE tasks ADD COLUMN acceptance_criteria TEXT","ALTER TABLE tasks ADD COLUMN recurred_from_task_id TEXT","ALTER TABLE artifacts ADD COLUMN task_id TEXT","ALTER TABLE artifacts ADD COLUMN is_protected INTEGER NOT NULL DEFAULT 0","ALTER TABLE projects ADD COLUMN org_id TEXT","ALTER TABLE artifacts ADD COLUMN owner_user_id TEXT","ALTER TABLE artifacts ADD COLUMN sharing_scope TEXT NOT NULL DEFAULT 'private'","ALTER TABLE artifacts ADD COLUMN encrypted INTEGER NOT NULL DEFAULT 0","ALTER TABLE artifacts ADD COLUMN encryption_key_id TEXT","ALTER TABLE audit_logs ADD COLUMN user_id TEXT","ALTER TABLE audit_logs ADD COLUMN org_id TEXT","ALTER TABLE audit_logs ADD COLUMN ip TEXT","ALTER TABLE audit_logs ADD COLUMN user_agent TEXT","ALTER TABLE audit_logs ADD COLUMN action_target_id TEXT","ALTER TABLE audit_logs ADD COLUMN action_target_type TEXT","ALTER TABLE activity_log ADD COLUMN user_id TEXT","ALTER TABLE activity_log ADD COLUMN org_id TEXT","ALTER TABLE activity_log ADD COLUMN ip TEXT","ALTER TABLE heartbeat_tasks ADD COLUMN acting_on_behalf_of_user_id TEXT","ALTER TABLE schedules ADD COLUMN created_by_user_id TEXT","ALTER TABLE schedules ADD COLUMN catchup_policy TEXT DEFAULT 'fire_all'","ALTER TABLE artifacts ADD COLUMN folder_id TEXT","ALTER TABLE artifacts ADD COLUMN space_id TEXT","ALTER TABLE agents ADD COLUMN default_space_id TEXT","ALTER TABLE artifacts ADD COLUMN heartbeat_task_id TEXT","ALTER TABLE artifacts ADD COLUMN dedupe_key TEXT","ALTER TABLE artifact_share_links ADD COLUMN token TEXT","ALTER TABLE artifacts ADD COLUMN pinned_to_space_at TEXT","ALTER TABLE process_definitions ADD COLUMN source_spec_json TEXT","ALTER TABLE process_definitions ADD COLUMN schema_version INTEGER NOT NULL DEFAULT 1","ALTER TABLE process_definitions ADD COLUMN created_by_user_id TEXT","ALTER TABLE process_definitions ADD COLUMN created_by_agent_id TEXT","ALTER TABLE tool_allowlists ADD COLUMN org_id TEXT","ALTER TABLE tool_allowlists ADD COLUMN created_by_user_id TEXT","ALTER TABLE agents ADD COLUMN expected_output TEXT","ALTER TABLE mines_projects ADD COLUMN default_space_id TEXT"]))try{a.exec(b)}catch(a){if(!/duplicate column name/i.test(String(a?.message||a)))throw a}return a.exec("CREATE INDEX IF NOT EXISTS idx_agents_reports_to ON agents(reports_to);"),a.exec("CREATE INDEX IF NOT EXISTS idx_tasks_due_at ON tasks(due_at);"),a.exec("DROP INDEX IF EXISTS idx_secrets_one_active;"),a.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_secrets_one_active ON secrets(name, scope, COALESCE(project_id, '')) WHERE status = 'active';"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_project_at ON audit_logs(project_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_egress_project_at ON tool_egress(project_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_activity_project ON activity_log(project_id, created_at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_project ON artifacts(project_id, created_at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_task ON artifacts(task_id, created_at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_folder ON artifacts(project_id, folder_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_space ON artifacts(space_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_heartbeat_task ON artifacts(heartbeat_task_id);\nCREATE INDEX IF NOT EXISTS idx_artifacts_dedupe_key ON artifacts(dedupe_key);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_is_protected ON artifacts(is_protected, project_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_projects_org ON projects(org_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_user ON audit_logs(user_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_org ON audit_logs(org_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_target ON audit_logs(action_target_type, action_target_id, at DESC);"),a.exec("CREATE TRIGGER IF NOT EXISTS audit_logs_no_update\nBEFORE UPDATE ON audit_logs\nBEGIN\n  SELECT RAISE(ABORT, 'audit_logs rows are immutable');\nEND;"),a.exec("CREATE TRIGGER IF NOT EXISTS audit_logs_no_delete\nBEFORE DELETE ON audit_logs\nBEGIN\n  SELECT RAISE(ABORT, 'audit_logs rows cannot be deleted');\nEND;"),!function(){try{if(!a.prepare("PRAGMA index_list('secrets')").all().some(b=>"u"===b.origin&&b.name.startsWith("sqlite_autoindex_secrets_")&&3===a.prepare(`PRAGMA index_info('${b.name}')`).all().length))return;a.exec("BEGIN"),a.exec("CREATE TABLE secrets_new (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  scope TEXT NOT NULL DEFAULT 'global',\n  value_encrypted BLOB NOT NULL,\n  iv BLOB NOT NULL,\n  auth_tag BLOB NOT NULL,\n  status TEXT NOT NULL DEFAULT 'active',\n  source TEXT,\n  metadata_json TEXT,\n  last_used_at TEXT,\n  created_at TEXT NOT NULL,\n  rotated_at TEXT\n)"),a.exec("INSERT INTO secrets_new\n  SELECT id, name, scope, value_encrypted, iv, auth_tag, status,\n         source, metadata_json, last_used_at, created_at, rotated_at\n  FROM secrets\n  WHERE status = 'active'"),a.exec("DROP TABLE secrets"),a.exec("ALTER TABLE secrets_new RENAME TO secrets"),a.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_secrets_one_active\n  ON secrets(name, scope) WHERE status = 'active'"),a.exec("CREATE INDEX IF NOT EXISTS idx_secrets_name_status\n  ON secrets(name, status)"),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}(),a.exec(k.t),q=a,r=j.c_,(0,l.ef)(a),function(){if("1"===process.env.MADARX_DISABLE_INPROC_DAEMON||process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR)return;let a=Number(process.env.CRON_DAEMON_INTERVAL_MS||3e4),b=Number(process.env.HEARTBEAT_WORKER_INTERVAL_MS||5e3),d=process.env.MADARX_INPROC_HOST||"127.0.0.1",e=process.env.PORT||process.env.MADARX_PORT||"8787",k=`http://${d}:${e}`,l=Number(process.env.MADARX_INPROC_POKE_TIMEOUT_MS||5e3);async function m(a){let{getInprocToken:b,INPROC_TOKEN_HEADER:d}=await c.e(6818).then(c.bind(c,96818)),e=new AbortController,f=setTimeout(()=>e.abort(),l);try{let c=await fetch(`${k}${a}`,{method:"POST",headers:{"content-type":"application/json",[d]:b()},body:"{}",signal:e.signal});if(!c.ok)throw Error(`route ${a} returned ${c.status}`);return await c.json()}finally{clearTimeout(f)}}function n({name:a,flag:b,intervalMs:c,route:d,tag:e}){if(globalThis[b])return;let k=()=>{if(globalThis[b])return!0;let k=function(a,b){let c=function(a){let b=i.createHash("sha1").update(j.nJ).digest("hex").slice(0,12);return g.join(h.tmpdir(),`madarx-daemon-${b}-${a}.lock`)}(a),d=Math.max(3*b,15e3),e=()=>{let a=f.openSync(c,"wx");try{f.writeSync(a,JSON.stringify({pid:process.pid,at:Date.now()}))}finally{f.closeSync(a)}};try{return e(),c}catch(a){if("EEXIST"!==a.code)return null}let k=!1;try{k=Date.now()-f.statSync(c).mtimeMs<d}catch{}if(k)return null;try{return f.rmSync(c,{force:!0}),e(),c}catch{return null}}(a,c);if(!k)return!1;globalThis[b]=!0,process.once("exit",()=>{try{f.rmSync(k,{force:!0})}catch{}});let l=0,n=Math.max(6,Math.ceil(3e4/c)),o=setInterval(async()=>{try{let a=new Date;f.utimesSync(k,a,a)}catch{}try{await m(d),l=0}catch(a){if(l++,console.warn(`[${e}:inproc] tick error:`,a?.message||a),l>=n){console.warn(`[${e}:inproc] ${l} consecutive failures — server gone, stopping loop`),clearInterval(o),globalThis[b]=!1;try{f.rmSync(k,{force:!0})}catch{}}}},c);return"function"==typeof o.unref&&o.unref(),!0};if(k())return;let l=Math.max(3*c,15e3),n=setTimeout(k,l+Math.floor(1e3*Math.random()));"function"==typeof n.unref&&n.unref()}n({name:"cron",flag:"__madarxCronStarted",intervalMs:a,route:"/api/cron/tick",tag:"cron"}),n({name:"heartbeat",flag:"__madarxHeartbeatStarted",intervalMs:b,route:"/api/heartbeat/worker",tag:"heartbeat"})}(),a}function o(){return new Date().toISOString()}function p(a="id"){return`${a}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2,8)}`}d()}catch(a){d(a)}})},36575:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{DB:()=>z,QK:()=>l,RW:()=>x,Tx:()=>s,XJ:()=>v,ZW:()=>y,aO:()=>u,ck:()=>p,eb:()=>w,jI:()=>t,wt:()=>q});var e=c(77598),f=c(34255),g=c(46359),h=c(33446),i=a([f,g,h]);async function j(a){try{let{appendAudit:b}=await Promise.resolve().then(c.bind(c,60105));b(a)}catch{}}[f,g,h]=i.then?(await i)():i;let A=Object.freeze(["owner","admin","member","viewer"]),B=Object.freeze({owner:["owner","admin","member","viewer"],admin:["member","viewer"],member:[],viewer:[]});function k(a){return String(a||"").trim().toLowerCase()}function l(a){return(0,e.createHash)("sha256").update(String(a),"utf8").digest("hex")}function m(a,b){if(!A.includes(b))throw Error(`Invalid role: ${b}`);if(!(B[a]||[]).includes(b))throw Object.assign(Error(`role ${a} cannot mint an invite granting ${b}`),{code:"role_ceiling"})}function n(a){return new Date(Date.now()+3600*a*1e3).toISOString()}function o(a,b=Date.now()){return null!=a.expires_at&&new Date(a.expires_at).getTime()<=b}function p({orgId:a,email:b,role:c="member",createdBy:d,creatorRole:e,label:g=null}){if(!a||!b||!d)throw Error("orgId, email, createdBy are required");m(e,c);let h=k(b);if(!h.includes("@"))throw Error("a valid email is required");let i=(0,f.getDb)(),l=i.prepare("SELECT * FROM org_invites WHERE org_id = ? AND email = ? AND revoked_at IS NULL").get(a,h);if(l&&!o(l))return i.prepare("UPDATE org_invites SET role = ?, expires_at = ? WHERE id = ?").run(c,n(72),l.id),i.prepare("SELECT * FROM org_invites WHERE id = ?").get(l.id);let p=(0,f.newId)("inv");return i.prepare(`INSERT INTO org_invites (id, org_id, role, email, label, created_by_user_id, expires_at, created_at)
+`,{mode:384});try{e.chmodSync(C,384)}catch{}return a}catch(a){return console.warn("[auth-config] ensureRecoveryToken failed:",a.message),null}}function o(a){if(!a||"string"!=typeof a)return!1;let b=null;try{b=e.readFileSync(C,"utf8").trim()}catch{return!1}if(!b)return!1;let c=Buffer.from(a.trim()),d=Buffer.from(b);return c.length===d.length&&(0,i.timingSafeEqual)(c,d)}function p(){let a=process.env.MADARX_AUTH_MODE;if(a&&String(a).trim()){let b=String(a).trim().toLowerCase();if(B.has(b))return b}return null}function q(){let a=String(process.env.MADARX_AUTH_MODE_LOCK||"").trim().toLowerCase();return!!(p()&&("1"===a||"true"===a))}function r(){if(q())return p();try{let a=(0,j.getConfig)(A,null);if(a&&B.has(a))return a}catch{}return p()||"local"}function s(){let a=null,b=null;try{a=(0,k.getSecret)("SUPABASE_URL"),b=(0,k.getSecret)("SUPABASE_ANON_KEY")}catch{}return a=a||process.env.NEXT_PUBLIC_SUPABASE_URL||process.env.SUPABASE_URL||null,b=b||process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY||process.env.SUPABASE_ANON_KEY||null,{url:a||null,anonKey:b||null}}function t(){try{let a=(0,k.getSecret)("SUPABASE_SERVICE_ROLE_KEY");if(a)return a}catch{}return process.env.SUPABASE_SERVICE_ROLE_KEY||null}function u(){return!!t()}function v({mode:a,url:b,anonKey:c,serviceKey:d}={}){if(b&&String(b).trim()&&(0,k.setSecret)("SUPABASE_URL",String(b).trim(),{source:"manual"}),c&&String(c).trim()&&(0,k.setSecret)("SUPABASE_ANON_KEY",String(c).trim(),{source:"manual"}),d&&String(d).trim()&&(0,k.setSecret)("SUPABASE_SERVICE_ROLE_KEY",String(d).trim(),{source:"manual"}),null!=a&&""!==a){let b=String(a).toLowerCase();if(!B.has(b))throw Error(`invalid auth mode: ${a}`);if("supabase"===b){let{url:a,anonKey:b}=s();if(!a||!b)throw Error("cannot switch to supabase mode without a configured SUPABASE_URL and SUPABASE_ANON_KEY");n()}(0,j.setConfig)(A,b)}return{mode:r()}}function w(a){return a.split(".").reduce((a,b)=>a<<8|parseInt(b,10),0)>>>0}function x(a){let b=w(a),c=(a,c)=>(b&(0===c?0:-1<<32-c>>>0))==(w(a)&(0===c?0:-1<<32-c>>>0));return c("0.0.0.0",8)||c("10.0.0.0",8)||c("100.64.0.0",10)||c("127.0.0.0",8)||c("169.254.0.0",16)||c("172.16.0.0",12)||c("192.168.0.0",16)||c("192.0.0.0",24)||c("198.18.0.0",15)||c("224.0.0.0",4)||c("240.0.0.0",4)}function y(a){let b=g.isIP(a);if(4===b)return x(a);if(6===b){let b=a.toLowerCase();if("::1"===b||"::"===b||b.startsWith("fe80")||b.startsWith("fe9")||b.startsWith("fea")||b.startsWith("feb")||b.startsWith("fc")||b.startsWith("fd"))return!0;let c=b.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);return!!c&&x(c[1])}return!0}async function z({url:a,anonKey:b}={}){let c;if(!a||!b)return{ok:!1,error:"missing_url_or_key"};try{c=new URL(a)}catch{return{ok:!1,error:"invalid_url"}}if("https:"!==c.protocol)return{ok:!1,error:"must_be_https"};try{let a=c.hostname;if(g.isIP(a)){if(y(a))return{ok:!1,error:"blocked_host"}}else{let b=await (0,h.lookup)(a,{all:!0});if(!b.length||b.some(a=>y(a.address)))return{ok:!1,error:"blocked_host"}}}catch{return{ok:!1,error:"unreachable"}}try{return(await fetch(`${c.origin}/auth/v1/health`,{headers:{apikey:b,Authorization:`Bearer ${b}`},redirect:"error",signal:AbortSignal.timeout(4e3)})).ok?{ok:!0}:{ok:!1,error:"unreachable"}}catch{return{ok:!1,error:"unreachable"}}}d()}catch(a){d(a)}})},34255:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{getDb:()=>n,newId:()=>p,nowIso:()=>o});var e=c(80099),f=c(73024),g=c(76760),h=c(48161),i=c(77598),j=c(9381),k=c(50662),l=c(23167),m=a([l]);l=(m.then?(await m)():m)[0];let q=null,r=null;function n(){if(q&&r===j.c_)return q;if(q){try{q.close()}catch{}q=null}(0,j.Jh)();let a=new e.DatabaseSync(j.c_);for(let b of(a.exec("PRAGMA journal_mode=WAL;"),a.exec("PRAGMA busy_timeout=5000;"),a.exec("PRAGMA foreign_keys=ON;"),a.exec(k.x),["ALTER TABLE artifacts ADD COLUMN title TEXT","ALTER TABLE artifacts ADD COLUMN content TEXT","ALTER TABLE artifacts ADD COLUMN source_md TEXT","ALTER TABLE agents ADD COLUMN system_prompt TEXT","ALTER TABLE agents ADD COLUMN memory TEXT","ALTER TABLE agents ADD COLUMN model TEXT","ALTER TABLE runs ADD COLUMN output TEXT","ALTER TABLE hermes_jobs ADD COLUMN cwd TEXT","ALTER TABLE hermes_jobs ADD COLUMN timeout_ms INTEGER","ALTER TABLE connectors ADD COLUMN type TEXT","ALTER TABLE connectors ADD COLUMN capabilities TEXT","ALTER TABLE connectors ADD COLUMN metadata TEXT","ALTER TABLE schedules ADD COLUMN last_queued_at TEXT","ALTER TABLE schedules ADD COLUMN last_queued_window TEXT","ALTER TABLE heartbeat_tasks ADD COLUMN approval_request_id TEXT","ALTER TABLE agents ADD COLUMN reports_to TEXT","ALTER TABLE agents ADD COLUMN role TEXT","ALTER TABLE agents ADD COLUMN title TEXT","ALTER TABLE agents ADD COLUMN status_reason TEXT","ALTER TABLE agents ADD COLUMN autonomy_mode TEXT","ALTER TABLE agents ADD COLUMN budget_monthly_cents INTEGER DEFAULT 0","ALTER TABLE agents ADD COLUMN spent_monthly_cents INTEGER DEFAULT 0","ALTER TABLE agents ADD COLUMN permissions_json TEXT","ALTER TABLE agents ADD COLUMN metadata_json TEXT","ALTER TABLE agents ADD COLUMN project_id TEXT","ALTER TABLE agents ADD COLUMN template_slug TEXT","ALTER TABLE secrets ADD COLUMN project_id TEXT","ALTER TABLE audit_logs ADD COLUMN project_id TEXT","ALTER TABLE audit_logs ADD COLUMN correlation_id TEXT","ALTER TABLE tool_egress ADD COLUMN project_id TEXT","ALTER TABLE activity_log ADD COLUMN project_id TEXT","ALTER TABLE artifacts ADD COLUMN project_id TEXT","ALTER TABLE heartbeat_tasks ADD COLUMN project_id TEXT","ALTER TABLE transcripts ADD COLUMN engine TEXT","ALTER TABLE transcripts ADD COLUMN language TEXT","ALTER TABLE transcripts ADD COLUMN duration_seconds REAL","ALTER TABLE approval_requests ADD COLUMN project_id TEXT","ALTER TABLE projects ADD COLUMN folder_path TEXT","ALTER TABLE tasks ADD COLUMN due_at TEXT","ALTER TABLE tasks ADD COLUMN tags_json TEXT","ALTER TABLE tasks ADD COLUMN estimate_minutes INTEGER","ALTER TABLE tasks ADD COLUMN watchers_json TEXT","ALTER TABLE tasks ADD COLUMN recurrence TEXT","ALTER TABLE tasks ADD COLUMN acceptance_criteria TEXT","ALTER TABLE tasks ADD COLUMN recurred_from_task_id TEXT","ALTER TABLE artifacts ADD COLUMN task_id TEXT","ALTER TABLE artifacts ADD COLUMN is_protected INTEGER NOT NULL DEFAULT 0","ALTER TABLE projects ADD COLUMN org_id TEXT","ALTER TABLE artifacts ADD COLUMN owner_user_id TEXT","ALTER TABLE artifacts ADD COLUMN sharing_scope TEXT NOT NULL DEFAULT 'private'","ALTER TABLE artifacts ADD COLUMN encrypted INTEGER NOT NULL DEFAULT 0","ALTER TABLE artifacts ADD COLUMN encryption_key_id TEXT","ALTER TABLE audit_logs ADD COLUMN user_id TEXT","ALTER TABLE audit_logs ADD COLUMN org_id TEXT","ALTER TABLE audit_logs ADD COLUMN ip TEXT","ALTER TABLE audit_logs ADD COLUMN user_agent TEXT","ALTER TABLE audit_logs ADD COLUMN action_target_id TEXT","ALTER TABLE audit_logs ADD COLUMN action_target_type TEXT","ALTER TABLE activity_log ADD COLUMN user_id TEXT","ALTER TABLE activity_log ADD COLUMN org_id TEXT","ALTER TABLE activity_log ADD COLUMN ip TEXT","ALTER TABLE heartbeat_tasks ADD COLUMN acting_on_behalf_of_user_id TEXT","ALTER TABLE schedules ADD COLUMN created_by_user_id TEXT","ALTER TABLE schedules ADD COLUMN catchup_policy TEXT DEFAULT 'fire_all'","ALTER TABLE artifacts ADD COLUMN folder_id TEXT","ALTER TABLE artifacts ADD COLUMN space_id TEXT","ALTER TABLE agents ADD COLUMN default_space_id TEXT","ALTER TABLE artifacts ADD COLUMN heartbeat_task_id TEXT","ALTER TABLE artifacts ADD COLUMN dedupe_key TEXT","ALTER TABLE artifact_share_links ADD COLUMN token TEXT","ALTER TABLE artifacts ADD COLUMN pinned_to_space_at TEXT","ALTER TABLE process_definitions ADD COLUMN source_spec_json TEXT","ALTER TABLE process_definitions ADD COLUMN schema_version INTEGER NOT NULL DEFAULT 1","ALTER TABLE process_definitions ADD COLUMN created_by_user_id TEXT","ALTER TABLE process_definitions ADD COLUMN created_by_agent_id TEXT","ALTER TABLE tool_allowlists ADD COLUMN org_id TEXT","ALTER TABLE tool_allowlists ADD COLUMN created_by_user_id TEXT","ALTER TABLE agents ADD COLUMN expected_output TEXT","ALTER TABLE mines_projects ADD COLUMN default_space_id TEXT"]))try{a.exec(b)}catch(a){if(!/duplicate column name/i.test(String(a?.message||a)))throw a}return a.exec("CREATE INDEX IF NOT EXISTS idx_agents_reports_to ON agents(reports_to);"),a.exec("CREATE INDEX IF NOT EXISTS idx_tasks_due_at ON tasks(due_at);"),a.exec("DROP INDEX IF EXISTS idx_secrets_one_active;"),a.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_secrets_one_active ON secrets(name, scope, COALESCE(project_id, '')) WHERE status = 'active';"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_project_at ON audit_logs(project_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_egress_project_at ON tool_egress(project_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_activity_project ON activity_log(project_id, created_at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_project ON artifacts(project_id, created_at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_task ON artifacts(task_id, created_at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_folder ON artifacts(project_id, folder_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_space ON artifacts(space_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_heartbeat_task ON artifacts(heartbeat_task_id);\nCREATE INDEX IF NOT EXISTS idx_artifacts_dedupe_key ON artifacts(dedupe_key);"),a.exec("CREATE INDEX IF NOT EXISTS idx_artifacts_is_protected ON artifacts(is_protected, project_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_projects_org ON projects(org_id);"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_user ON audit_logs(user_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_org ON audit_logs(org_id, at DESC);"),a.exec("CREATE INDEX IF NOT EXISTS idx_audit_target ON audit_logs(action_target_type, action_target_id, at DESC);"),a.exec("CREATE TRIGGER IF NOT EXISTS audit_logs_no_update\nBEFORE UPDATE ON audit_logs\nBEGIN\n  SELECT RAISE(ABORT, 'audit_logs rows are immutable');\nEND;"),a.exec("CREATE TRIGGER IF NOT EXISTS audit_logs_no_delete\nBEFORE DELETE ON audit_logs\nBEGIN\n  SELECT RAISE(ABORT, 'audit_logs rows cannot be deleted');\nEND;"),!function(){try{if(!a.prepare("PRAGMA index_list('secrets')").all().some(b=>"u"===b.origin&&b.name.startsWith("sqlite_autoindex_secrets_")&&3===a.prepare(`PRAGMA index_info('${b.name}')`).all().length))return;a.exec("BEGIN"),a.exec("CREATE TABLE secrets_new (\n  id TEXT PRIMARY KEY,\n  name TEXT NOT NULL,\n  scope TEXT NOT NULL DEFAULT 'global',\n  value_encrypted BLOB NOT NULL,\n  iv BLOB NOT NULL,\n  auth_tag BLOB NOT NULL,\n  status TEXT NOT NULL DEFAULT 'active',\n  source TEXT,\n  metadata_json TEXT,\n  last_used_at TEXT,\n  created_at TEXT NOT NULL,\n  rotated_at TEXT\n)"),a.exec("INSERT INTO secrets_new\n  SELECT id, name, scope, value_encrypted, iv, auth_tag, status,\n         source, metadata_json, last_used_at, created_at, rotated_at\n  FROM secrets\n  WHERE status = 'active'"),a.exec("DROP TABLE secrets"),a.exec("ALTER TABLE secrets_new RENAME TO secrets"),a.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_secrets_one_active\n  ON secrets(name, scope) WHERE status = 'active'"),a.exec("CREATE INDEX IF NOT EXISTS idx_secrets_name_status\n  ON secrets(name, status)"),a.exec("COMMIT")}catch(b){try{a.exec("ROLLBACK")}catch{}throw b}}(),a.exec(k.t),q=a,r=j.c_,(0,l.ef)(a),function(){if("1"===process.env.MADARX_DISABLE_INPROC_DAEMON||process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR)return;let a=Number(process.env.CRON_DAEMON_INTERVAL_MS||3e4),b=Number(process.env.HEARTBEAT_WORKER_INTERVAL_MS||5e3),d=process.env.MADARX_INPROC_HOST||"127.0.0.1",e=process.env.PORT||process.env.MADARX_PORT||"8787",k=`http://${d}:${e}`,l=Number(process.env.MADARX_INPROC_POKE_TIMEOUT_MS||5e3);async function m(a){let{getInprocToken:b,INPROC_TOKEN_HEADER:d}=await c.e(6818).then(c.bind(c,96818)),e=new AbortController,f=setTimeout(()=>e.abort(),l);try{let c=await fetch(`${k}${a}`,{method:"POST",headers:{"content-type":"application/json",[d]:b()},body:"{}",signal:e.signal});if(!c.ok)throw Error(`route ${a} returned ${c.status}`);return await c.json()}finally{clearTimeout(f)}}function n({name:a,flag:b,intervalMs:c,route:d,tag:e}){if(globalThis[b])return;let k=()=>{if(globalThis[b])return!0;let k=function(a,b){let c=function(a){let b=i.createHash("sha1").update(j.nJ).digest("hex").slice(0,12);return g.join(h.tmpdir(),`madarx-daemon-${b}-${a}.lock`)}(a),d=Math.max(3*b,15e3),e=()=>{let a=f.openSync(c,"wx");try{f.writeSync(a,JSON.stringify({pid:process.pid,at:Date.now()}))}finally{f.closeSync(a)}};try{return e(),c}catch(a){if("EEXIST"!==a.code)return null}let k=!1;try{k=Date.now()-f.statSync(c).mtimeMs<d}catch{}if(k)return null;try{return f.rmSync(c,{force:!0}),e(),c}catch{return null}}(a,c);if(!k)return!1;globalThis[b]=!0,process.once("exit",()=>{try{f.rmSync(k,{force:!0})}catch{}});let l=0,n=Math.max(6,Math.ceil(3e4/c)),o=setInterval(async()=>{try{let a=new Date;f.utimesSync(k,a,a)}catch{}try{await m(d),l=0}catch(a){if(l++,console.warn(`[${e}:inproc] tick error:`,a?.message||a),l>=n){console.warn(`[${e}:inproc] ${l} consecutive failures — server gone, stopping loop`),clearInterval(o),globalThis[b]=!1;try{f.rmSync(k,{force:!0})}catch{}}}},c);return"function"==typeof o.unref&&o.unref(),!0};if(k())return;let l=Math.max(3*c,15e3),n=setTimeout(k,l+Math.floor(1e3*Math.random()));"function"==typeof n.unref&&n.unref()}n({name:"cron",flag:"__madarxCronStarted",intervalMs:a,route:"/api/cron/tick",tag:"cron"}),n({name:"heartbeat",flag:"__madarxHeartbeatStarted",intervalMs:b,route:"/api/heartbeat/worker",tag:"heartbeat"})}(),a}function o(){return new Date().toISOString()}function p(a="id"){return`${a}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2,8)}`}d()}catch(a){d(a)}})},36575:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{DB:()=>z,QK:()=>l,RW:()=>x,Tx:()=>s,XJ:()=>v,ZW:()=>y,aO:()=>u,ck:()=>p,eb:()=>w,jI:()=>t,wt:()=>q});var e=c(77598),f=c(34255),g=c(46359),h=c(33446),i=a([f,g,h]);async function j(a){try{let{appendAudit:b}=await Promise.resolve().then(c.bind(c,60105));b(a)}catch{}}[f,g,h]=i.then?(await i)():i;let A=Object.freeze(["owner","admin","member","viewer"]),B=Object.freeze({owner:["owner","admin","member","viewer"],admin:["member","viewer"],member:[],viewer:[]});function k(a){return String(a||"").trim().toLowerCase()}function l(a){return(0,e.createHash)("sha256").update(String(a),"utf8").digest("hex")}function m(a,b){if(!A.includes(b))throw Error(`Invalid role: ${b}`);if(!(B[a]||[]).includes(b))throw Object.assign(Error(`role ${a} cannot mint an invite granting ${b}`),{code:"role_ceiling"})}function n(a){return new Date(Date.now()+3600*a*1e3).toISOString()}function o(a,b=Date.now()){return null!=a.expires_at&&new Date(a.expires_at).getTime()<=b}function p({orgId:a,email:b,role:c="member",createdBy:d,creatorRole:e,label:g=null}){if(!a||!b||!d)throw Error("orgId, email, createdBy are required");m(e,c);let h=k(b);if(!h.includes("@"))throw Error("a valid email is required");let i=(0,f.getDb)(),l=i.prepare("SELECT * FROM org_invites WHERE org_id = ? AND email = ? AND revoked_at IS NULL").get(a,h);if(l&&!o(l))return i.prepare("UPDATE org_invites SET role = ?, expires_at = ? WHERE id = ?").run(c,n(72),l.id),i.prepare("SELECT * FROM org_invites WHERE id = ?").get(l.id);let p=(0,f.newId)("inv");return i.prepare(`INSERT INTO org_invites (id, org_id, role, email, label, created_by_user_id, expires_at, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(p,a,c,h,g,d,n(72),(0,f.nowIso)()),j({type:"org.invite.email.created",summary:`Email invite for ${h} to org ${a} as ${c}`,meta:{id:p,org_id:a,email:h,role:c}}),i.prepare("SELECT * FROM org_invites WHERE id = ?").get(p)}function q({orgId:a,role:b="member",createdBy:c,creatorRole:d,expiresInHours:g=72,maxUses:h=null,label:i=null}){if(!a||!c)throw Error("orgId and createdBy are required");if(m(d,b),null!=h&&(!Number.isInteger(h)||h<1))throw Error("maxUses must be a positive integer or null");let k=null==g?null:n(g),o=(0,e.randomBytes)(32).toString("base64url"),p=(0,f.newId)("inv");(0,f.getDb)().prepare(`INSERT INTO org_invites (id, org_id, role, token_hash, label, created_by_user_id, expires_at, max_uses, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(p,a,b,l(o),i,c,k,h,(0,f.nowIso)()),j({type:"org.invite.created",summary:`Invite link created for org ${a} as ${b}`,meta:{id:p,org_id:a,role:b,max_uses:h,expires_at:k}});let q=(0,f.getDb)().prepare("SELECT * FROM org_invites WHERE id = ?").get(p);return{id:p,token:o,invite:r(q)}}function r(a){if(!a)return a;let{token_hash:b,...c}=a;return{...c,has_token:null!=b}}function s(a,{includeInactive:b=!1}={}){return(0,f.getDb)().prepare("SELECT * FROM org_invites WHERE org_id = ? ORDER BY created_at DESC").all(a).filter(a=>b||null==a.revoked_at&&!o(a)&&(null==a.max_uses||!(a.used_count>=a.max_uses))).map(a=>({...r(a),kind:a.email?"email":"link"}))}function t(a){let b=k(a);return b?(0,f.getDb)().prepare(`SELECT i.*, o.name AS org_name, o.slug AS org_slug
        FROM org_invites i JOIN organizations o ON o.id = i.org_id
        WHERE i.email = ? AND i.revoked_at IS NULL`).all(b).filter(a=>!o(a)).map(a=>({id:a.id,org_id:a.org_id,org_name:a.org_name,org_slug:a.org_slug,role:a.role,created_at:a.created_at,expires_at:a.expires_at})):[]}function u(a,b){if(!a||!b)throw Error("token and userId are required");let c=l(a),d=(0,f.getDb)(),e=d.prepare("SELECT * FROM org_invites WHERE token_hash = ?").get(c);if(!e||null!=e.email)throw Object.assign(Error("invalid invite token"),{code:"invalid_token"});let h=(0,g.xX)(b,e.org_id);if(h)return{org_id:e.org_id,role:h.role,already_member:!0};d.exec("BEGIN IMMEDIATE");try{let a=d.prepare(`UPDATE org_invites SET used_count = used_count + 1
          WHERE id = ? AND revoked_at IS NULL
            AND (expires_at IS NULL OR expires_at > ?)
-           AND (max_uses IS NULL OR used_count < max_uses)`).run(e.id,(0,f.nowIso)());if(1!==a.changes)throw d.exec("ROLLBACK"),Object.assign(Error("invite is no longer valid (expired, revoked, or fully used)"),{code:"invite_invalid"});(0,g.s4)(e.org_id,b,e.role),d.exec("COMMIT")}catch(a){try{d.exec("ROLLBACK")}catch{}throw a}return j({type:"org.invite.redeemed",summary:`User ${b} redeemed an invite to org ${e.org_id} as ${e.role}`,meta:{invite_id:e.id,org_id:e.org_id,user_id:b,role:e.role}}),{org_id:e.org_id,role:e.role,already_member:!1}}function v(a,b){let c=k(b);if(!a||!c)return[];let d=(0,f.getDb)(),e=d.prepare("SELECT * FROM org_invites WHERE email = ? AND revoked_at IS NULL").all(c).filter(a=>!o(a)),h=[];for(let b of e){d.exec("BEGIN IMMEDIATE");try{(0,g.s4)(b.org_id,a,b.role),d.prepare("UPDATE org_invites SET used_count = used_count + 1, revoked_at = ? WHERE id = ?").run((0,f.nowIso)(),b.id),d.exec("COMMIT")}catch(a){try{d.exec("ROLLBACK")}catch{}continue}h.push({org_id:b.org_id,role:b.role}),j({type:"org.invite.email.claimed",summary:`User ${a} claimed email invite to org ${b.org_id} as ${b.role}`,meta:{invite_id:b.id,org_id:b.org_id,user_id:a,role:b.role}})}return h}function w(a,b){let c=(0,f.getDb)(),d=c.prepare("SELECT * FROM org_invites WHERE id = ?").get(a);return d?(null==d.revoked_at&&(c.prepare("UPDATE org_invites SET revoked_at = ? WHERE id = ?").run((0,f.nowIso)(),a),j({type:"org.invite.revoked",summary:`Invite ${a} revoked in org ${d.org_id}`,meta:{invite_id:a,org_id:d.org_id,by:b}})),(0,f.getDb)().prepare("SELECT org_id, revoked_at FROM org_invites WHERE id = ?").get(a)):null}let C=["servicekey","service_role","service_role_key","servicerolekey","supabase_service_role_key"];function x({url:a,anonKey:b,token:c,org:d}={}){if(!a||!b||!c)throw Error("url, anonKey, token are required");let e={v:1,url:a,anonKey:b,token:c};return d&&(e.org=d),Buffer.from(JSON.stringify(e),"utf8").toString("base64url")}function y(a){var b;let c;if("string"!=typeof a||!a)throw Object.assign(Error("this invite link is invalid or has expired"),{code:"bad_blob"});if(a.length>4096)throw Object.assign(Error("invite link is too large"),{code:"bad_blob"});try{let b=Buffer.from(a,"base64url").toString("utf8");if(b.length>4096)throw Error("oversized");c=JSON.parse(b)}catch{throw Object.assign(Error("this invite link is invalid or has expired"),{code:"bad_blob"})}if(!c||"object"!=typeof c||Array.isArray(c))throw Object.assign(Error("this invite link is invalid or has expired"),{code:"bad_blob"});if(b=c,Object.keys(b||{}).some(a=>C.includes(String(a).toLowerCase())))throw Object.assign(Error("invite must not contain a service-role key"),{code:"service_key_forbidden"});if(1!==c.v)throw Object.assign(Error("unsupported invite version"),{code:"bad_blob"});if("string"!=typeof c.url||!/^https:\/\//i.test(c.url))throw Object.assign(Error("invite project URL must be https"),{code:"bad_url"});if("string"!=typeof c.anonKey||!c.anonKey.trim())throw Object.assign(Error("invite is missing the project key"),{code:"bad_blob"});if("string"!=typeof c.token||!c.token.trim())throw Object.assign(Error("invite is missing its token"),{code:"missing_token"});return{v:1,url:c.url.trim(),anonKey:c.anonKey.trim(),token:c.token.trim(),org:"string"==typeof c.org?c.org:null}}async function z({url:a,anonKey:b,token:c}={},{testConnection:d}={}){if(!a||!b||!c)throw Object.assign(Error("url, anonKey, and token are required"),{code:"bad_request"});if(!/^https:\/\//i.test(a))throw Object.assign(Error("project URL must be https"),{code:"bad_url"});if("local"!==(0,h.Im)()||(0,h.fo)())throw Object.assign(Error("this app is already connected to an organization"),{code:"already_supabase"});let e=d||h.LC,f=await e({url:a,anonKey:b});if(!f?.ok)throw Object.assign(Error("couldn't reach that project"),{code:"connection_failed",detail:f?.error});(0,h.VD)({mode:"supabase",url:a,anonKey:b}),(0,h.V6)();let g=new URL(a).host;return j({type:"auth.join.bootstrap",summary:`Connected local app to project ${g} via invite bootstrap`,meta:{host:g}}),{ok:!0,host:g}}d()}catch(a){d(a)}})},37745:(a,b,c)=>{"use strict";c.d(b,{d:()=>m});var d=c(80099),e=c(73024),f=c(76760),g=c(73136);let h=f.dirname((0,g.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/scripts/migrate-auth-v1.mjs")),i=f.resolve(h,".."),j=process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR?f.resolve(process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR):process.env.MADARX_HOME?f.join(f.resolve(process.env.MADARX_HOME),"data"):f.join(i,"data"),k=f.join(j,"madarx.sqlite"),l=f.join(j,".auth-migrated-v1");function m(a){if(!a.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='organizations' LIMIT 1").get())throw Error("[migrate-auth-v1] organizations table does not exist. The schema has not been applied yet. Start the app once to initialize the schema, then re-run this migration.");let b=process.env.MADARX_OWNER_EMAIL||"owner@local.dev",c=new Date().toISOString();a.prepare(`INSERT OR IGNORE INTO organizations (id, slug, name, plan, created_at, updated_at)
+           AND (max_uses IS NULL OR used_count < max_uses)`).run(e.id,(0,f.nowIso)());if(1!==a.changes)throw d.exec("ROLLBACK"),Object.assign(Error("invite is no longer valid (expired, revoked, or fully used)"),{code:"invite_invalid"});(0,g.s4)(e.org_id,b,e.role),d.exec("COMMIT")}catch(a){try{d.exec("ROLLBACK")}catch{}throw a}return j({type:"org.invite.redeemed",summary:`User ${b} redeemed an invite to org ${e.org_id} as ${e.role}`,meta:{invite_id:e.id,org_id:e.org_id,user_id:b,role:e.role}}),{org_id:e.org_id,role:e.role,already_member:!1}}function v(a,b){let c=k(b);if(!a||!c)return[];let d=(0,f.getDb)(),e=d.prepare("SELECT * FROM org_invites WHERE email = ? AND revoked_at IS NULL").all(c).filter(a=>!o(a)),h=[];for(let b of e){d.exec("BEGIN IMMEDIATE");try{(0,g.s4)(b.org_id,a,b.role),d.prepare("UPDATE org_invites SET used_count = used_count + 1, revoked_at = ? WHERE id = ?").run((0,f.nowIso)(),b.id),d.exec("COMMIT")}catch(a){try{d.exec("ROLLBACK")}catch{}continue}h.push({org_id:b.org_id,role:b.role}),j({type:"org.invite.email.claimed",summary:`User ${a} claimed email invite to org ${b.org_id} as ${b.role}`,meta:{invite_id:b.id,org_id:b.org_id,user_id:a,role:b.role}})}return h}function w(a,b){let c=(0,f.getDb)(),d=c.prepare("SELECT * FROM org_invites WHERE id = ?").get(a);return d?(null==d.revoked_at&&(c.prepare("UPDATE org_invites SET revoked_at = ? WHERE id = ?").run((0,f.nowIso)(),a),j({type:"org.invite.revoked",summary:`Invite ${a} revoked in org ${d.org_id}`,meta:{invite_id:a,org_id:d.org_id,by:b}})),(0,f.getDb)().prepare("SELECT org_id, revoked_at FROM org_invites WHERE id = ?").get(a)):null}let C=["servicekey","service_role","service_role_key","servicerolekey","supabase_service_role_key"];function x({url:a,anonKey:b,token:c,org:d}={}){if(!a||!b||!c)throw Error("url, anonKey, token are required");let e={v:1,url:a,anonKey:b,token:c};return d&&(e.org=d),Buffer.from(JSON.stringify(e),"utf8").toString("base64url")}function y(a){var b;let c;if("string"!=typeof a||!a)throw Object.assign(Error("this invite link is invalid or has expired"),{code:"bad_blob"});if(a.length>4096)throw Object.assign(Error("invite link is too large"),{code:"bad_blob"});try{let b=Buffer.from(a,"base64url").toString("utf8");if(b.length>4096)throw Error("oversized");c=JSON.parse(b)}catch{throw Object.assign(Error("this invite link is invalid or has expired"),{code:"bad_blob"})}if(!c||"object"!=typeof c||Array.isArray(c))throw Object.assign(Error("this invite link is invalid or has expired"),{code:"bad_blob"});if(b=c,Object.keys(b||{}).some(a=>C.includes(String(a).toLowerCase())))throw Object.assign(Error("invite must not contain a service-role key"),{code:"service_key_forbidden"});if(1!==c.v)throw Object.assign(Error("unsupported invite version"),{code:"bad_blob"});if("string"!=typeof c.url||!/^https:\/\//i.test(c.url))throw Object.assign(Error("invite project URL must be https"),{code:"bad_url"});if("string"!=typeof c.anonKey||!c.anonKey.trim())throw Object.assign(Error("invite is missing the project key"),{code:"bad_blob"});if("string"!=typeof c.token||!c.token.trim())throw Object.assign(Error("invite is missing its token"),{code:"missing_token"});return{v:1,url:c.url.trim(),anonKey:c.anonKey.trim(),token:c.token.trim(),org:"string"==typeof c.org?c.org:null}}async function z({url:a,anonKey:b,token:c}={},{testConnection:d}={}){if(!a||!b||!c)throw Object.assign(Error("url, anonKey, and token are required"),{code:"bad_request"});if(!/^https:\/\//i.test(a))throw Object.assign(Error("project URL must be https"),{code:"bad_url"});if("local"!==(0,h.Im)()||(0,h.fo)())throw Object.assign(Error("this app is already connected to an organization"),{code:"already_supabase"});let e=d||h.LC,f=await e({url:a,anonKey:b});if(!f?.ok)throw Object.assign(Error("couldn't reach that project"),{code:"connection_failed",detail:f?.error});(0,h.VD)({mode:"supabase",url:a,anonKey:b}),(0,h.V6)();let g=new URL(a).host;return j({type:"auth.join.bootstrap",summary:`Connected local app to project ${g} via invite bootstrap`,meta:{host:g}}),{ok:!0,host:g}}d()}catch(a){d(a)}})},37745:(a,b,c)=>{"use strict";c.d(b,{d:()=>n});var d=c(80099),e=c(73024),f=c(76760),g=c(73136);let h=f.dirname((0,g.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/scripts/migrate-auth-v1.mjs")),i=f.resolve(h,".."),j=process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR?f.resolve(process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR):process.env.MADARX_HOME?f.join(f.resolve(process.env.MADARX_HOME),"data"):f.join(i,"data"),k=f.join(j,"madarx.sqlite"),l=f.join(j,".auth-migrated-v1");function m(){return new Date().toISOString()}function n(a){if(!a.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='organizations' LIMIT 1").get())throw Error("[migrate-auth-v1] organizations table does not exist. The schema has not been applied yet. Start the app once to initialize the schema, then re-run this migration.");let b=process.env.MADARX_OWNER_EMAIL||"owner@local.dev",c=m();a.prepare(`INSERT OR IGNORE INTO organizations (id, slug, name, plan, created_at, updated_at)
      VALUES ('personal-org', 'personal', 'Personal Org', 'free', ?, ?)`).run(c,c),a.prepare(`INSERT OR IGNORE INTO users (id, email, display_name, auth_provider, created_at)
      VALUES ('local-user-1', ?, 'Local Owner', 'local', ?)`).run(b,c),a.prepare(`INSERT OR IGNORE INTO org_memberships (id, org_id, user_id, role, accepted_at)
-     VALUES ('mem-local-owner', 'personal-org', 'local-user-1', 'owner', ?)`).run(c);let d=a.prepare("UPDATE projects SET org_id = 'personal-org' WHERE org_id IS NULL").run(),e=a.prepare("UPDATE artifacts SET sharing_scope = 'private' WHERE sharing_scope IS NULL").run();return{projectsUpdated:d.changes,artifactsUpdated:e.changes}}async function n(){e.existsSync(l)&&console.log("[migrate-auth-v1] Marker file exists — migration already applied. Re-running for idempotency check."),e.existsSync(k)||(console.error("[migrate-auth-v1] Database file not found at "+k+". Start the app once to create it, then re-run this script."),process.exit(1));let a=new d.DatabaseSync(k);a.exec("PRAGMA journal_mode=WAL;"),a.exec("PRAGMA foreign_keys=ON;");try{let b=m(a);e.writeFileSync(l,"migrated at "+new Date().toISOString()+"\n","utf8");let c=process.env.MADARX_OWNER_EMAIL||"owner@local.dev";console.log("[migrate-auth-v1] Migration complete."),console.log("  personal-org: ensured"),console.log("  local-user-1: ensured (email: "+c+")"),console.log("  owner membership: ensured"),console.log("  projects bound: "+b.projectsUpdated),console.log("  artifacts defaulted: "+b.artifactsUpdated),console.log("  marker: "+l)}catch(a){console.error("[migrate-auth-v1] ERROR:",a.message),process.exit(1)}finally{try{a.close()}catch{}}}let o=(0,g.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/scripts/migrate-auth-v1.mjs");(process.argv[1]?f.resolve(process.argv[1]):null)===o&&n()},38708:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{B:()=>k});var e=c(73024),f=c(76760),g=c(34255),h=c(9381),i=c(26531),j=a([g]);g=(j.then?(await j)():j)[0];let l=/^[a-z][a-z0-9_]{2,63}$/;async function k(a={},b={}){let d="string"==typeof a?.slug?a.slug.trim():"";if(!d||!l.test(d))return{ok:!1,status:"error",error:"slug_required",message:"slug required (snake_case, 3-64 chars)"};let j="string"==typeof a?.summary?a.summary.slice(0,2e3):"",m=["low","medium","high","irreversible_external"].includes(a?.risk)?a.risk:"medium",n=f.join("tool-proposals",d),o=f.join(h.un,n),p={[`${d}.adapter.js`]:function(a,b){let c=a.replace(/_([a-z])/g,(a,b)=>b.toUpperCase());return`// lib/tools/adapters/${a}.js — PROPOSED, not yet wired.
+     VALUES ('mem-local-owner', 'personal-org', 'local-user-1', 'owner', ?)`).run(c);let d=function(a){let b,c;if(!a.prepare("SELECT id FROM organizations WHERE id = ?").get(p))return{status:"no_default_org"};let d=a.prepare("SELECT user_id FROM org_memberships WHERE org_id = ? AND role = 'owner' AND user_id != ?").get(p,o);if(d)return{status:"already_owned",user_id:d.user_id};let e=a.prepare("SELECT user_id FROM org_memberships WHERE org_id = ? AND user_id != ?").all(p,o);if(0===e.length)return{status:"no_real_user"};if(1===e.length)b=e[0].user_id,c="sole_member";else{let d=process.env.MADARX_OWNER_EMAIL;if(!d||"owner@local.dev"===d)return{status:"ambiguous",count:e.length};let f=a.prepare(`SELECT m.user_id FROM org_memberships m JOIN users u ON u.id = m.user_id
+         WHERE m.org_id = ? AND m.user_id != ? AND lower(u.email) = lower(?)`).all(p,o,d);if(1!==f.length)return{status:"ambiguous",count:e.length};b=f[0].user_id,c="owner_email"}if(!a.prepare("UPDATE org_memberships SET role = 'owner' WHERE org_id = ? AND user_id = ? AND role != 'owner'").run(p,b).changes)return{status:"already_owned",user_id:b};try{a.prepare(`INSERT INTO audit_logs (id, at, type, summary, status, meta, user_id, org_id, action_target_id, action_target_type)
+       VALUES (?, ?, 'auth.default_org.owner_healed', ?, 'success', ?, ?, ?, ?, 'org_membership')`).run(`audit-orgheal-${Date.now()}-${Math.random().toString(36).slice(2,8)}`,m(),`Promoted real operator to owner of ${p} (was member; default org was owned only by synthetic ${o})`,JSON.stringify({org_id:p,user_id:b,basis:c}),b,p,b)}catch{}return{status:"promoted",user_id:b,basis:c}}(a),e=a.prepare("UPDATE projects SET org_id = 'personal-org' WHERE org_id IS NULL").run(),f=a.prepare("UPDATE artifacts SET sharing_scope = 'private' WHERE sharing_scope IS NULL").run();return{projectsUpdated:e.changes,artifactsUpdated:f.changes,ownershipHeal:d}}let o="local-user-1",p="personal-org";async function q(){e.existsSync(l)&&console.log("[migrate-auth-v1] Marker file exists — migration already applied. Re-running for idempotency check."),e.existsSync(k)||(console.error("[migrate-auth-v1] Database file not found at "+k+". Start the app once to create it, then re-run this script."),process.exit(1));let a=new d.DatabaseSync(k);a.exec("PRAGMA journal_mode=WAL;"),a.exec("PRAGMA foreign_keys=ON;");try{let b=n(a);e.writeFileSync(l,"migrated at "+new Date().toISOString()+"\n","utf8");let c=process.env.MADARX_OWNER_EMAIL||"owner@local.dev";console.log("[migrate-auth-v1] Migration complete."),console.log("  personal-org: ensured"),console.log("  local-user-1: ensured (email: "+c+")"),console.log("  owner membership: ensured"),console.log("  ownership heal: "+b.ownershipHeal.status+(b.ownershipHeal.user_id?" ("+b.ownershipHeal.user_id+")":"")),console.log("  projects bound: "+b.projectsUpdated),console.log("  artifacts defaulted: "+b.artifactsUpdated),console.log("  marker: "+l)}catch(a){console.error("[migrate-auth-v1] ERROR:",a.message),process.exit(1)}finally{try{a.close()}catch{}}}let r=(0,g.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/scripts/migrate-auth-v1.mjs");(process.argv[1]?f.resolve(process.argv[1]):null)===r&&q()},38708:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{B:()=>k});var e=c(73024),f=c(76760),g=c(34255),h=c(9381),i=c(26531),j=a([g]);g=(j.then?(await j)():j)[0];let l=/^[a-z][a-z0-9_]{2,63}$/;async function k(a={},b={}){let d="string"==typeof a?.slug?a.slug.trim():"";if(!d||!l.test(d))return{ok:!1,status:"error",error:"slug_required",message:"slug required (snake_case, 3-64 chars)"};let j="string"==typeof a?.summary?a.summary.slice(0,2e3):"",m=["low","medium","high","irreversible_external"].includes(a?.risk)?a.risk:"medium",n=f.join("tool-proposals",d),o=f.join(h.un,n),p={[`${d}.adapter.js`]:function(a,b){let c=a.replace(/_([a-z])/g,(a,b)=>b.toUpperCase());return`// lib/tools/adapters/${a}.js — PROPOSED, not yet wired.
 //
 // ${b||"Proposed tool adapter."}
 //
@@ -1013,30 +1022,30 @@ Review, wire into lib/tools/registry.js (see registry-snippet.txt), add tests, r
       UPDATE heartbeat_tasks
       SET status='queued', lease_owner=NULL, lease_expires_at=NULL, updated_at=?, error='Recovered stale lease'
       WHERE id=?
-    `).run((0,e.nowIso)(),a.id),r(a.id,{type:"stale_recovered",message:"Recovered stale lease"});return b.length&&h(),b.length}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},40718:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Cz:()=>ai,G7:()=>al,IC:()=>ak,TRUST_MODE_CONFIG_KEY:()=>as,VM:()=>ad,executeRegistryTool:()=>aq,h7:()=>at,is:()=>ar,kt:()=>au,n4:()=>af,sd:()=>ah,yC:()=>$});var e=c(77598),f=c(34255),g=c(8437),h=c(67179),i=c(26531),j=c(24516),k=c(20086),l=c(2163),m=c(1511),n=c(4160),o=c(59400),p=c(69635),q=c(48446),r=c(2583),s=c(29827),t=c(72189),u=c(68732),v=c(49567),w=c(32668),x=c(81992),y=c(98278),z=c(29327),A=c(13099),B=c(17607),C=c(85803),D=c(95019),E=c(80987),F=c(51542),G=c(18630),H=c(10088),I=c(22434),J=c(51218),K=c(38708),L=c(56050),M=c(23737),N=c(4638),O=c(45907),P=c(91437),Q=c(30918),R=c(29559),S=c(70952),T=c(59224),U=c(48409),V=c(97190),W=c(87466),X=c(13331),Y=c(43466),Z=a([f,g,h,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,B,C,D,E,F,H,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,X,Y]);[f,g,h,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,B,C,D,E,F,H,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,X,Y]=Z.then?(await Z)():Z;let as="tool_approval_global_mode",at="approval_required",au=new Set(["approval_required","auto"]);function $(){let a=(0,h.getConfig)(as,at);return au.has(a)?a:at}let av=[{name:"file_read",title:"Read file",description:"Read a bounded file inside approved local roots. Secret files are blocked.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{path:{type:"string"},offset:{type:"number"},limit:{type:"number"}},required:["path"]}},{name:"directory_list",title:"List folder",description:"List directory entries inside approved local roots.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{path:{type:"string"},limit:{type:"number"}}}},{name:"file_search",title:"Search files",description:"Search safe local files while skipping build output, dependencies, databases, and secret files.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{pattern:{type:"string"},path:{type:"string"},target:{type:"string"},file_glob:{type:"string"},limit:{type:"number"}},required:["pattern"]}},{name:"file_write",title:"Write file",description:"Write a file inside approved local roots after owner approval.",category:"local_machine",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{path:{type:"string"},content:{type:"string"},create_dirs:{type:"boolean"},approval_id:{type:"string"}},required:["path","content"]}},{name:"file_patch",title:"Edit file",description:"Patch a file inside approved local roots after owner approval.",category:"local_machine",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{path:{type:"string"},old_string:{type:"string"},new_string:{type:"string"},replace_all:{type:"boolean"},approval_id:{type:"string"}},required:["path","old_string","new_string"]}},{name:"terminal_run",title:"Run command",description:"Run a bounded local command with spawn command and args, never shell:true.",category:"local_machine",risk_level:"medium",approval_mode:"policy",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{command:{type:"string"},args:{type:"array",items:{type:"string"}},cwd:{type:"string"},timeout_ms:{type:"number"},approval_id:{type:"string"}},required:["command"]}},{name:"process_start",title:"Start process",description:"Start a madarX-owned local process and persist process state.",category:"local_machine",risk_level:"medium",approval_mode:"policy",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{command:{type:"string"},args:{type:"array",items:{type:"string"}},cwd:{type:"string"},approval_id:{type:"string"}},required:["command"]}},{name:"process_poll",title:"Check process",description:"Poll a madarX-owned local process row.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{process_id:{type:"string"}},required:["process_id"]}},{name:"process_kill",title:"Stop process",description:"Stop a madarX-owned process after owner approval.",category:"local_machine",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{process_id:{type:"string"},approval_id:{type:"string"}},required:["process_id"]}},{name:"web_search",title:"Search the web",description:"Search the public web with Firecrawl, SearXNG, Brave Search, or the no-key DuckDuckGo Lite fallback, returning ranked results with title, URL, snippet, and source metadata.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{query:{type:"string",description:"Search query."},count:{type:"number",description:"Number of results, 1-10. Default 5."},country:{type:"string",description:"Optional Brave country code, e.g. US."},search_lang:{type:"string",description:"Optional search language, e.g. en."}},required:["query"]}},{name:"web_fetch",title:"Fetch a webpage",description:"Fetch a public URL, block local/private network targets, strip HTML to readable text, and cap response size.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{url:{type:"string",description:"Public http(s) URL to fetch."},max_bytes:{type:"number",description:"Maximum response bytes, capped at 512000."}},required:["url"]}},{name:"web_extract",title:"Extract from webpage",description:"Extract readable content from a public URL with Firecrawl scrape when configured, otherwise fall back to direct web fetch.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{url:{type:"string",description:"Public http(s) URL to extract."},max_bytes:{type:"number",description:"Maximum response bytes for direct fetch fallback, capped at 512000."}},required:["url"]}},{name:"browser_harness_run",title:"Browser Harness",description:"Run a bounded browser-harness Python snippet against an activated Chrome CDP browser. This is local-code-execution risk: it starts disabled and requires owner approval for every main-agent or sub-agent execution.",category:"browser",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{script:{type:"string",description:"Python code executed by browser-harness. Helpers are pre-imported; use new_tab(url), wait_for_load(), page_info(), capture_screenshot(), click_at_xy(), js(), or cdp()."},timeout_ms:{type:"number",description:"Timeout in milliseconds, capped at 600000. Default 120000."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["script"]}},{name:"browser_open",title:"Browser Open (Playwright)",description:"Open a URL in a real headless Chromium and return the final URL, page title, and visible text. Use this (not browser_navigate) for JavaScript-rendered pages, SPAs, or anything that needs a real browser. The page persists across calls so you can browser_act / browser_extract on it next.",category:"browser",risk_level:"medium",required_env:[],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{url:{type:"string",description:"Public http(s) URL to open."},wait_for:{type:"string",description:"Optional CSS selector to wait for after load."},timeout_ms:{type:"number",description:"Navigation timeout in ms (default 30000, max 120000)."}},required:["url"]}},{name:"browser_act",title:"Browser Act (Playwright)",description:"Interact with the currently open page: click, fill, type, select, press a key, scroll, or wait. State-changing — gated for approval in approval-required trust mode. Locate elements with a CSS selector or a Playwright text= selector. Does NOT expand the agent's permissions; it only drives the page already loaded by browser_open.",category:"browser",risk_level:"high",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{action:{type:"string",enum:["click","fill","type","select","press","scroll","wait"],description:"Interaction to perform."},selector:{type:"string",description:"CSS selector or Playwright text= selector for the target element. Required for click/fill/type/select/press."},text:{type:"string",description:"Text to fill/type (for fill/type), or option value (for select)."},value:{type:"string",description:"Option value for select (alternative to text)."},key:{type:"string",description:"Key to press for the press action (default Enter)."},timeout_ms:{type:"number",description:"Action timeout in ms (default 30000, max 120000)."}},required:["action"]}},{name:"browser_extract",title:"Browser Extract (Playwright)",description:"Read content from the currently open page: visible text (default), raw HTML, or JSON-LD blocks. Optionally scoped to a CSS selector. Use after browser_open / browser_act to pull the rendered result.",category:"browser",risk_level:"medium",required_env:[],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{mode:{type:"string",enum:["text","html","json-ld"],default:"text",description:"What to extract."},selector:{type:"string",description:"Optional CSS selector to scope extraction."}}}},{name:"browser_screenshot",title:"Browser Screenshot (Playwright)",description:"Capture a PNG screenshot of the currently open page (or a selector / full page). Saved to disk under data/browser-screenshots; returns the file path.",category:"browser",risk_level:"medium",required_env:[],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{selector:{type:"string",description:"Optional CSS selector to screenshot just one element."},full_page:{type:"boolean",description:"Capture the full scrollable page (default false)."}}}},{name:"browser_navigate",title:"Browser Navigate",description:"Fetch a URL with Chrome 124 headers, cookie jar, redirect following, and configurable extraction (text, markdown, json-ld, metadata, raw). Falls back gracefully on JS-only pages.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_ms:6e4,max:30},input_schema:{type:"object",properties:{url:{type:"string",description:"HTTP/HTTPS URL"},extract:{type:"string",enum:["text","markdown","json-ld","metadata","raw"],default:"text"},selector:{type:"string",description:"Optional CSS-like selector: tag, #id, or .class"},wait_for:{type:"string",description:"Optional substring expected in response; returns hint if missing"},max_chars:{type:"integer",default:12e3,maximum:5e4}},required:["url"]}},{name:"browser_extract_structured",title:"Browser Extract Structured",description:"Fetch a URL and extract both JSON-LD structured data and page metadata (title, og:*, meta tags) in one call.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_ms:6e4,max:30},input_schema:{type:"object",properties:{url:{type:"string"}},required:["url"]}},{name:"supabase_list_projects",title:"List Supabase projects",description:"List Supabase projects available to the configured personal access token.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_ACCESS_TOKEN"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{}}},{name:"supabase_rest_select",title:"Read database rows",description:"Read rows from a Supabase table using the REST API with optional filters and limit.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{table:{type:"string",description:"Table name."},select:{type:"string",description:"PostgREST select expression. Default *."},filters:{type:"object",description:"Column filters. Values may be raw PostgREST operators or plain values for eq."},limit:{type:"number",description:"Maximum rows, 1-100. Default 25."}},required:["table"]}},{name:"supabase_rest_insert",title:"Add database rows",description:"Insert one or more rows into a Supabase table using the REST API. Returns the inserted rows.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name (schema-qualified allowed, e.g. auth.users)."},rows:{type:"array",items:{type:"object"},description:"Array of row objects to insert."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","rows"]}},{name:"supabase_rest_upsert",title:"Add or update rows",description:"Upsert one or more rows into a Supabase table. Merges on conflict. Returns affected rows.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name."},rows:{type:"array",items:{type:"object"},description:"Array of row objects to upsert."},on_conflict:{type:"string",description:"Comma-separated column(s) to resolve conflicts on."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","rows"]}},{name:"supabase_rest_update",title:"Update database rows",description:"Update rows in a Supabase table matching the given filters. Filters are required — table-wide updates are blocked.",category:"supabase",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name."},patch:{type:"object",description:"Column values to set on matching rows."},filters:{type:"object",description:"Row filters. At least one filter is required."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","patch","filters"]}},{name:"supabase_rest_delete",title:"Delete database rows",description:"Delete rows from a Supabase table matching the given filters. Filters are required — bulk table truncation is blocked. Always requires approval regardless of trust mode.",category:"supabase",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name."},filters:{type:"object",description:"Row filters. At least one filter is required."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","filters"]}},{name:"supabase_rpc",title:"Call database function",description:"Call a Postgres function via the Supabase REST RPC endpoint.",category:"supabase",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"function_name",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{function_name:{type:"string",description:"Postgres function name to call."},params:{type:"object",description:"Parameters passed as the request body."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["function_name"]}},{name:"supabase_sql",title:"Run SQL query",description:"Execute raw SQL via the madarx_exec_sql() Postgres function. Uses the service-role key and BYPASSES Row-Level Security. Always requires approval regardless of trust mode. Requires creating the madarx_exec_sql() function in your project.",category:"supabase",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{query:{type:"string",description:"SQL query to execute via madarx_exec_sql()."},params:{type:"object",description:"Optional named parameters for the query."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["query"]}},{name:"vercel_list_projects",title:"List Vercel projects",description:"List Vercel projects visible to the configured token.",category:"vercel",risk_level:"medium",required_env:["VERCEL_TOKEN"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{team_id:{type:"string",description:"Optional Vercel team id."},limit:{type:"number",description:"Maximum projects."}}}},{name:"vercel_list_deployments",title:"List Vercel deployments",description:"List Vercel deployments, optionally scoped by project.",category:"vercel",risk_level:"medium",required_env:["VERCEL_TOKEN"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{team_id:{type:"string",description:"Optional Vercel team id."},project_id:{type:"string",description:"Optional Vercel project id."},project_name:{type:"string",description:"Optional Vercel project name."},limit:{type:"number",description:"Maximum deployments."}}}},{name:"vercel_create_deployment",title:"Deploy to Vercel",description:"Stage a Vercel deployment request for owner approval. This does not deploy until approved.",category:"vercel",risk_level:"high",required_env:["VERCEL_TOKEN"],enabled_default:!1,approval_required:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{summary:{type:"string",description:"Deployment purpose and requested target."}}}},{name:"email_send",title:"Send email",description:"Send a transactional email via Resend. Approval is required.",category:"email",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:["RESEND_API_KEY"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"recipient_domain",allowlist_default_allow:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{from:{type:"string",description:"Sender address. Defaults to RESEND_FROM_EMAIL secret/env."},to:{type:"string",description:'Single recipient email address, e.g. "user@example.com".'},subject:{type:"string",description:"Email subject line."},text:{type:"string",description:"Plain-text email body. Either text or html is required."},html:{type:"string",description:"HTML email body. Either text or html is required."},reply_to:{type:"string",description:"Reply-to address."},recipient_domain:{type:"string",description:'Domain portion of the "to" address, e.g. "example.com". Must match the domain in "to" exactly — used by the allowlist gate.'},approval_id:{type:"string",description:"Approval request ID to consume for one-shot execution."}},required:["to","subject"]}},{name:"email_status_lookup",title:"Check email delivery",description:"Look up the delivery status of a previously-sent email.",category:"email",risk_level:"low",required_env:["RESEND_API_KEY"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{email_id:{type:"string",description:"Resend email ID returned by email_send."}},required:["email_id"]}},{name:"gh_repo_read",title:"Read a GitHub repo",description:"Read metadata for a GitHub repository (name, visibility, default branch, stars, forks).",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format, e.g. acme/api."}},required:["repo_full_name"]}},{name:"gh_repo_list",title:"List GitHub repos",description:"List GitHub repositories accessible to the configured token.",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{visibility:{type:"string",description:"Filter by visibility: all, public, private."},type:{type:"string",description:"Filter by type: all, owner, member."},sort:{type:"string",description:"Sort by: created, updated, pushed, full_name."},per_page:{type:"number",description:"Results per page, 1-100. Default 30."}}}},{name:"gh_issue_list",title:"List issues",description:"List issues in a GitHub repository with optional state and label filters.",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},state:{type:"string",description:"Issue state: open, closed, all. Default open."},labels:{type:"string",description:"Comma-separated label names to filter by."},per_page:{type:"number",description:"Results per page, 1-100. Default 30."}},required:["repo_full_name"]}},{name:"gh_issue_create",title:"Create an issue",description:"Create an issue in an allowlisted GitHub repository.",category:"github",risk_level:"medium",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},title:{type:"string",description:"Issue title."},body:{type:"string",description:"Issue body in Markdown."},labels:{type:"array",items:{type:"string"},description:"Labels to apply."},assignees:{type:"array",items:{type:"string"},description:"GitHub usernames to assign."}},required:["repo_full_name","title"]}},{name:"gh_issue_comment",title:"Comment on an issue",description:"Post a comment on a GitHub issue in an allowlisted repository.",category:"github",risk_level:"medium",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:30},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},issue_number:{type:"number",description:"Issue number."},body:{type:"string",description:"Comment body in Markdown."}},required:["repo_full_name","issue_number","body"]}},{name:"gh_pr_list",title:"List pull requests",description:"List pull requests in a GitHub repository with optional filters.",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},state:{type:"string",description:"PR state: open, closed, all. Default open."},head:{type:"string",description:"Filter by head branch (user:branch)."},base:{type:"string",description:"Filter by base branch name."},per_page:{type:"number",description:"Results per page, 1-100. Default 30."}},required:["repo_full_name"]}},{name:"gh_pr_create",title:"Open a pull request",description:"Open a pull request in an allowlisted GitHub repository.",category:"github",risk_level:"high",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},title:{type:"string",description:"PR title."},head:{type:"string",description:"Head branch (source)."},base:{type:"string",description:"Base branch (target)."},body:{type:"string",description:"PR description in Markdown."},draft:{type:"boolean",description:"Open as a draft PR."}},required:["repo_full_name","title","head","base"]}},{name:"gh_pr_comment",title:"Comment on a pull request",description:"Post a comment on a GitHub pull request in an allowlisted repository.",category:"github",risk_level:"medium",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:30},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},pr_number:{type:"number",description:"Pull request number."},body:{type:"string",description:"Comment body in Markdown."}},required:["repo_full_name","pr_number","body"]}},{name:"gh_pr_merge",title:"Merge a pull request",description:"Merge a pull request in an allowlisted GitHub repository. This action is irreversible once completed.",category:"github",risk_level:"irreversible_external",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},pr_number:{type:"number",description:"Pull request number."},commit_title:{type:"string",description:"Custom commit title for squash merge."},commit_message:{type:"string",description:"Custom commit message for squash merge."},merge_method:{type:"string",description:"Merge method: merge, squash, rebase. Default squash."}},required:["repo_full_name","pr_number"]}},{name:"gh_actions_dispatch",title:"Run a GitHub workflow",description:"Trigger a workflow dispatch event in an allowlisted GitHub repository.",category:"github",risk_level:"high",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},workflow_id:{type:"string",description:"Workflow filename or ID (e.g. deploy.yml)."},ref:{type:"string",description:"Branch or tag to run the workflow on."},inputs:{type:"object",description:"Optional workflow dispatch inputs."}},required:["repo_full_name","workflow_id","ref"]}},{name:"gh_release_create",title:"Publish a release",description:"Create a release in an allowlisted GitHub repository.",category:"github",risk_level:"high",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},tag_name:{type:"string",description:"Git tag for the release."},target_commitish:{type:"string",description:"Commit SHA or branch to tag."},name:{type:"string",description:"Release title."},body:{type:"string",description:"Release notes in Markdown."},draft:{type:"boolean",description:"Create as a draft release."},prerelease:{type:"boolean",description:"Mark as a pre-release."}},required:["repo_full_name","tag_name"]}},{name:"flight_search",title:"Search flights",description:"Search flight offers and return curated price + itinerary data. Uses Amadeus when AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET are configured, otherwise falls back to a free, key-less Google Flights backend lookup.",category:"travel",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{origin:{type:"string",description:'Origin airport IATA code, e.g. "JFK".'},destination:{type:"string",description:'Destination airport IATA code, e.g. "LHR".'},departure_date:{type:"string",description:"Departure date YYYY-MM-DD."},return_date:{type:"string",description:"Optional return date YYYY-MM-DD for round-trip search."},adults:{type:"number",description:"Adult passengers 1-9. Default 1."},children:{type:"number",description:"Child passengers 0-8."},travel_class:{type:"string",description:"ECONOMY | PREMIUM_ECONOMY | BUSINESS | FIRST."},currency:{type:"string",description:"3-letter ISO currency code. Default USD."},non_stop:{type:"boolean",description:"Only return non-stop itineraries."},max_results:{type:"number",description:"Max offers 1-25. Default 5."}},required:["origin","destination","departure_date"]}},{name:"flight_status",title:"Check flight status",description:"Look up live or scheduled flight status via Aviationstack. Returns departure, arrival, delay, and live position.",category:"travel",risk_level:"low",required_env:["AVIATIONSTACK_API_KEY"],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{flight_iata:{type:"string",description:'Flight IATA code, e.g. "BA283".'},flight_icao:{type:"string",description:"Flight ICAO code."},airline_iata:{type:"string",description:'Filter by airline IATA, e.g. "BA".'},dep_iata:{type:"string",description:"Departure airport IATA."},arr_iata:{type:"string",description:"Arrival airport IATA."},flight_date:{type:"string",description:"Flight date YYYY-MM-DD."},limit:{type:"number",description:"Max results 1-100. Default 5."}}}},{name:"hotel_search",title:"Search hotels",description:"List hotels at a TripAdvisor location via Xotelo. No API key required. Returns hotel_keys you can pass to hotel_rates.",category:"travel",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{location_key:{type:"string",description:'TripAdvisor geo location key, e.g. "g60763" for New York City.'},offset:{type:"number",description:"Pagination offset. Default 0."},limit:{type:"number",description:"Results 1-30. Default 10."},sort:{type:"string",description:"popularity | price | rating."},currency:{type:"string",description:"3-letter ISO currency. Default USD."},hotel_class:{type:"string",description:'Filter by star class, e.g. "4,5".'}},required:["location_key"]}},{name:"hotel_rates",title:"Check hotel rates",description:"Get real-time hotel rates from Booking.com, Expedia, Hotels.com, Agoda, etc. via Xotelo. No API key required.",category:"travel",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{hotel_key:{type:"string",description:'TripAdvisor hotel key, e.g. "g60763-d224867". Obtain from hotel_search.'},chk_in:{type:"string",description:"Check-in date YYYY-MM-DD."},chk_out:{type:"string",description:"Check-out date YYYY-MM-DD (must be after chk_in)."},currency:{type:"string",description:"3-letter ISO currency. Default USD."},rooms:{type:"number",description:"Rooms 1-9. Default 1."},adults:{type:"number",description:"Adults 1-9. Default 2."}},required:["hotel_key","chk_in","chk_out"]}},{name:"gmail_messages_list",title:"List Gmail messages",description:"Read message metadata from the operator Gmail inbox.",category:"email",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{max_results:{type:"number"},q:{type:"string"}}}},{name:"gmail_message_read",title:"Read a Gmail message",description:"Read one Gmail message for summarization or drafting.",category:"email",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{message_id:{type:"string"}},required:["message_id"]}},{name:"gmail_thread_read",title:"Read a Gmail thread",description:"Read a Gmail thread for context.",category:"email",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{thread_id:{type:"string"}},required:["thread_id"]}},{name:"calendar_events_list",title:"List calendar events",description:"Read upcoming Google Calendar events.",category:"calendar",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{calendar_id:{type:"string"},time_min:{type:"string"},time_max:{type:"string"},max_results:{type:"number"}}}},{name:"calendar_event_read",title:"Read a calendar event",description:"Read one Google Calendar event.",category:"calendar",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{event_id:{type:"string"},calendar_id:{type:"string"}},required:["event_id"]}},{name:"transcribe_audio",title:"Transcribe audio",description:"Transcribe a Disk audio file and save the transcript as a Disk artifact. Provider: openai (whisper, default), elevenlabs (Scribe), or local.",category:"local_machine",risk_level:"medium",approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{file_id:{type:"string"},use_local:{type:"boolean"},provider:{type:"string",description:'Transcription provider: openai | elevenlabs | local. Defaults to TRANSCRIBE_DEFAULT_PROVIDER or "openai".'},language:{type:"string"}},required:["file_id"]}},{name:"voice_speak",title:"Speak text aloud",description:"Synthesize a short text reply to audio via OpenAI TTS (default) or ElevenLabs. Returns base64 audio; optionally saves to Disk.",category:"voice",risk_level:"low",approval_mode:"auto",required_env:[["OPENAI_API_KEY","ELEVENLABS_API_KEY"]],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:60},input_schema:{type:"object",properties:{text:{type:"string",description:"Text to synthesize. Up to 4000 chars."},provider:{type:"string",description:"Provider: openai (default) or elevenlabs."},voice:{type:"string",description:"Provider-specific voice id. OpenAI: alloy|echo|fable|onyx|nova|shimmer. ElevenLabs: voice id."},model:{type:"string"},format:{type:"string",description:"mp3 (default) or wav."},save_to_disk:{type:"boolean"},project_id:{type:"string"}},required:["text"]}},{name:"printing_press_install",title:"Install Printing Press sub-package",description:"Install the printing-press sub-package required to generate scoped CLIs. Always approval-gated.",category:"cli_generator",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{},required:[]}},{name:"printing_press_generate",title:"Generate a scoped CLI",description:"Generate a new scoped CLI from a starter pack, GitHub repo, or local source.",category:"cli_generator",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{slug:{type:"string",description:"Lowercase kebab-case CLI slug."},source:{type:"string",description:"starter-pack | github | local | spec"},source_url:{type:"string",description:"Required when source is not starter-pack."}},required:["slug"]}},{name:"printing_press_run",title:"Run an installed CLI",description:"Execute a previously-installed printing-press CLI with bounded args.",category:"cli_generator",risk_level:"high",approval_mode:"approval_required",enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"printing_press_cli",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{slug:{type:"string",description:"CLI slug to run."},args:{type:"array",items:{type:"string"},description:"Bounded arg list (no shell metacharacters)."},printing_press_cli:{type:"string",description:"Slug used by the allowlist gate. Must equal `slug`."}},required:["slug"]}},{name:"create_workflow_definition",title:"Create workflow definition",description:'Create a new process workflow from a JSON spec. The spec is validated against lib/process/spec-validator.js. The new definition is published immediately at status="published" — cases can be started from it. Risk-gated by approval.',category:"workflow",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{spec:{type:"object",description:"Full workflow spec JSON. Must include schema_version, slug, name, version, stages[]. First stage must be intake_form. See ai-docs/process-engine.md and the validator at lib/process/spec-validator.js for the full schema."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["spec"]}},{name:"update_workflow_definition",title:"Update workflow definition",description:"Update an existing process workflow at a given slug. Spec is re-validated. version must be bumped if the stage list changed structurally. In-flight cases keep their old definition_id; new cases use the new version.",category:"workflow",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{slug:{type:"string",description:"Slug of the existing workflow to update."},spec:{type:"object",description:"Full workflow spec JSON. slug is forced to match the path slug."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["slug","spec"]}},{name:"self_update",title:"Update madarX OS",description:"Update the madarX OS install to the latest published version (npm i -g madarx@latest). Irreversible-external: an agent calling this ALWAYS requires owner approval — it can never silently replace the running binary. A restart is required after a successful update.",category:"system",risk_level:"irreversible_external",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:86400,max:4},input_schema:{type:"object",properties:{approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:[]}},{name:"printing_press_query",title:"Query an installed CLI SQLite mirror",description:"Run a single read-only SELECT against a CLI local SQLite mirror, if it exposes one.",category:"cli_generator",risk_level:"low",approval_mode:"auto",enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"printing_press_cli",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{slug:{type:"string",description:"CLI slug whose SQLite mirror to query."},sql:{type:"string",description:"Single SELECT statement. Multi-statement SQL is refused."},printing_press_cli:{type:"string",description:"Slug used by the allowlist gate. Must equal the slug."}},required:["slug","sql"]}},{name:"mines_project_create",title:"Create mine project",description:"Create a new mine project workspace and register it in the Mines module.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:30},input_schema:{type:"object",properties:{name:{type:"string"},slug:{type:"string",description:'Lowercase kebab-case, e.g. "batamote"'},asset_stage:{type:"string",enum:["exploration","development","production","care_and_maintenance","unknown"]},commodity:{type:"string"},deposit_type:{type:"string"},approval_id:{type:"string"}},required:["name","slug"]}},{name:"mines_project_read",title:"Read mine project summary",description:"Read a mine project record including data completeness and document counts by category.",category:"mines",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{project_id:{type:"string"}},required:["project_id"]}},{name:"mines_catalog_import",title:"Import portfolio catalog",description:"Load a master project catalog XLSX into Portfolio and PortfolioEntry records.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{file_id:{type:"string",description:"Disk file ID of the XLSX catalog."},portfolio_name:{type:"string"},sheet_name:{type:"string",description:"Optional sheet override."},approval_id:{type:"string"}},required:["file_id","portfolio_name"]}},{name:"mines_data_import",title:"Bulk import mine data directory",description:"Walk a directory tree, auto-classify files by folder taxonomy, and enqueue each file for ingestion. Incremental and resumable.",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{project_id:{type:"string"},directory_path:{type:"string"},resume:{type:"boolean",description:"Skip files already past queued status."},approval_id:{type:"string"}},required:["project_id","directory_path"]}},{name:"mines_document_extract",title:"Extract and embed document",description:"Parse a source document (PDF/DOCX/PPTX), OCR if scanned, chunk text, and embed chunks. Spanish-first.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{source_document_id:{type:"string"},force_ocr:{type:"boolean"},approval_id:{type:"string"}},required:["source_document_id"]}},{name:"mines_spatial_index",title:"Index spatial assets",description:"Read GIS/CAD file metadata (kind, CRS, bounding box) without rendering geometry.",category:"mines",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{project_id:{type:"string"},source_document_id:{type:"string",description:"Index a single already-catalogued file."}},required:["project_id"]}},{name:"mines_extract_facts",title:"Extract structured facts from documents (LLM)",description:"Read a project document's indexed chunks and extract structured, provenance-cited geology/economics facts into mines_extracted_facts. Every fact is validated to cite a real chunk + verbatim quote; uncited facts are rejected. Never declares a mineral resource the source did not. Feeds mines_report_generate and mines_valuation_run.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{project_id:{type:"string"},source_document_id:{type:"string",description:"Document to extract from. Defaults to the project's most-chunked document (its technical report)."},max_chunks:{type:"number",description:"Max chunks fed to the model. Default 48."},char_budget:{type:"number",description:"Max source characters per call. Default 32000."},approval_id:{type:"string"}},required:["project_id"]}},{name:"mines_assumption_validate",title:"Validate valuation assumptions",description:"Check completeness of data required for T1 or T2 valuation and return a gap list.",category:"mines",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{project_id:{type:"string"},target_tier:{type:"string",enum:["t1_in_situ","t2_dcf","auto"]}},required:["project_id"]}},{name:"mines_valuation_run",title:"Run tiered mine valuation",description:"Compute base/downside/upside valuation. Selects T1 (in-situ) or T2 (DCF) based on asset stage and data completeness. States tier and rationale.",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{project_id:{type:"string"},commodity_prices_json:{type:"string",description:'JSON price override e.g. {"Au":2300,"Cu":4.2}. Defaults to latest mines_market_snapshots.'},in_situ_factor_override:{type:"number"},force_tier:{type:"string",enum:["t1_in_situ","t2_dcf"]},approval_id:{type:"string"}},required:["project_id"]}},{name:"mines_sensitivity_run",title:"Run valuation sensitivity analysis",description:"Compute sensitivity of valuation to key drivers (grade, price, recovery, in_situ_factor, discount_rate).",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{scenario_id:{type:"string"},drivers:{type:"array",items:{type:"string"}},steps:{type:"number",description:"Steps per driver. Default 5."},approval_id:{type:"string"}},required:["scenario_id"]}},{name:"mines_market_snapshot",title:"Fetch commodity market data",description:"Retrieve current commodity prices from an approved market data provider.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:["MINES_MARKET_API_KEY"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"market_provider_host",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{commodities:{type:"array",items:{type:"string"}},market_provider_host:{type:"string",description:'e.g. "metals-api.com". Must be in allowlist.'},approval_id:{type:"string"}},required:["market_provider_host"]}},{name:"mines_report_generate",title:"Generate mine project report",description:"Generate a cited, structured report artifact. External email send always requires separate irreversible_external approval.",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{project_id:{type:"string"},report_kind:{type:"string",enum:["interpretation_memo","due_diligence_memo","data_quality_report","investor_presentation","pfs_readiness_report","valuation_report","due_diligence_questions","project_package","portfolio_screen"]},scenario_id:{type:"string",description:"Required for valuation_report."},space_id:{type:"string",description:"Optional dashboard space to publish into. Defaults to the project’s configured default space; the artifact is pinned there so it appears as a window on the dashboard board."},language:{type:"string",enum:["en","es"],description:'Default "en".'},narrative:{type:"object",description:"LLM-authored prose slots (all optional, each falls back to data-driven copy). For investor_presentation: hero_headline, hero_subhead (strings); opportunity (array of paragraph strings); findings_lead, upside_lead, risk_lead, the_ask (strings). For pfs_readiness_report: verdict, gap_intro, work_program, recommendation (strings). Numbers/figures are never taken from here — they always come from cited DB rows.",properties:{hero_headline:{type:"string"},hero_subhead:{type:"string"},opportunity:{type:"array",items:{type:"string"}},findings_lead:{type:"string"},upside_lead:{type:"string"},risk_lead:{type:"string"},the_ask:{type:"string"},verdict:{type:"string"},gap_intro:{type:"string"},work_program:{type:"string"},recommendation:{type:"string"}}},send_email:{type:"boolean"},recipient_email:{type:"string"},approval_id:{type:"string"}},required:["project_id","report_kind"]}},{name:"create_skill",title:"Author skill",description:"Author a declarative skill (SKILL.md + marketplace row) any agent can invoke. Instructions only — no code executes. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{spec:{type:"object",description:"{ slug, title, description?, markdown, invocation?, trigger_examples?[], category? }"},approval_id:{type:"string"}},required:["spec"]}},{name:"update_skill",title:"Update skill",description:"Update an existing authored skill by slug. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string"},spec:{type:"object"},approval_id:{type:"string"}},required:["slug","spec"]}},{name:"create_composite_tool",title:"Author composite tool",description:"Author a composite tool: a declarative recipe chaining EXISTING primitive tools + LLM steps. Inherits the MAX risk of its steps; every gate re-fires per sub-step. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{spec:{type:"object",description:'{ slug, title, description?, input_schema?, steps:[{kind:"tool_call"|"llm_synthesis"|"artifact_write", id, ...}] }'},approval_id:{type:"string"}},required:["spec"]}},{name:"update_composite_tool",title:"Update composite tool",description:"Update an existing composite tool by slug. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string"},spec:{type:"object"},approval_id:{type:"string"}},required:["slug","spec"]}},{name:"create_connector",title:"Author API connector",description:"Author a declarative REST API connector (Option D). Each endpoint becomes a callable <slug>.<endpoint> tool backed by the generic http_api_call executor. Manifest is inert data: https-only, secret-by-reference auth, host allowlist, per-endpoint risk ceiling. Owner/admin authority required. The owner supplies the API key once.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{manifest:{type:"object",description:"{ slug, base_url(https), allowed_hosts[], auth:{type,secret_ref|username_ref/password_ref,header?,prefix?,query_param?}, default_headers?, endpoints:{ name:{method,path,risk?,input_schema?} } }"},approval_id:{type:"string"}},required:["manifest"]}},{name:"update_connector",title:"Update API connector",description:"Update an existing API connector by slug. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string"},manifest:{type:"object"},approval_id:{type:"string"}},required:["slug","manifest"]}},{name:"propose_tool",title:"Propose new tool (code-gen)",description:"Option B escape hatch for non-REST integrations: generate an adapter scaffold + registry snippet + tests into a staging dir. The proposal is INERT — it is never callable until a human reviews, merges, and restarts. Writes files only; executes nothing.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string",description:"snake_case tool name"},summary:{type:"string"},risk:{type:"string",enum:["low","medium","high","irreversible_external"]},approval_id:{type:"string"}},required:["slug"]}}],aw={web_search:o.tE,web_fetch:o.dV,web_extract:o.IY,email_send:p.x,email_status_lookup:p.f,supabase_list_projects:q.NO,supabase_rest_select:q.TP,supabase_rest_insert:q.c3,supabase_rest_upsert:q.mD,supabase_rest_update:q.sX,supabase_rest_delete:q.oc,supabase_rpc:q.wm,supabase_sql:q.l8,vercel_list_projects:r.Q$,vercel_list_deployments:r.I6,vercel_create_deployment:r.vV,gh_repo_read:s.Sj,gh_repo_list:s.AU,gh_issue_list:s.jj,gh_issue_create:s.vj,gh_issue_comment:s.iP,gh_pr_list:s.gn,gh_pr_create:s.Ud,gh_pr_comment:s.J,gh_pr_merge:s.wt,gh_actions_dispatch:s.zI,gh_release_create:s.Bb,file_read:t.dd,directory_list:t.sv,file_search:t.X,file_write:t.sq,file_patch:t.vO,terminal_run:u.y,process_start:v.gy,process_poll:v.p3,process_kill:v.MU,flight_search:w.R5,flight_status:w.zP,hotel_search:w.FE,hotel_rates:w.Y$,gmail_messages_list:x.r_,gmail_message_read:x.cS,gmail_thread_read:x.vg,calendar_events_list:y.u,calendar_event_read:y.r,transcribe_audio:z.b,browser_harness_run:A.K,browser_open:C.D6,browser_act:C.Hz,browser_extract:C.aU,browser_screenshot:C.Jz,browser_navigate:B.M,browser_extract_structured:B.B,voice_speak:D.o,printing_press_install:E.gE,printing_press_generate:E.ID,printing_press_run:E.Cw,printing_press_query:E.VC,create_workflow_definition:F.h,update_workflow_definition:F.m,self_update:G.m,create_skill:H.S,update_skill:H.f,create_composite_tool:I.y$,update_composite_tool:I.le,create_connector:J.U$,update_connector:J.zc,propose_tool:K.B,http_api_call:L.p,composite_tool_run:M.n,mines_project_create:P.m,mines_project_read:P.I,mines_catalog_import:Q.b,mines_data_import:R.I,mines_document_extract:S.f,mines_extract_facts:Y.$,mines_spatial_index:T.d,mines_assumption_validate:U.w,mines_valuation_run:V.R,mines_sensitivity_run:V.h,mines_market_snapshot:W.V,mines_report_generate:X.Q},ax={file_write:t.Z6,file_patch:t.mr,terminal_run:u.x,process_start:v.H7,process_kill:v.L7,browser_harness_run:A.r},ay=new Set;function _(a){try{if((0,j.getSecret)(a))return!0}catch{}return!!process.env[a]&&(ay.has(a)||(ay.add(a),console.warn(`[secrets] ${a} is being read from process.env as a fallback. Migrate it to the vault with: node scripts/migrate-env-to-secrets.mjs`)),!0)}function aa(a=[]){return a.filter(a=>Array.isArray(a)?!a.some(a=>_(a)):!_(a)).map(a=>Array.isArray(a)?a.join(" or "):a)}let az=[{marker:"tool.repair.flight_search_enable_v1",tool_name:"flight_search",summary:"One-shot: enable flight_search on installs where the Amadeus→Google fallback shipped after the row was created."}];function ab(){let a=(0,f.getDb)(),b=(0,f.nowIso)();for(let c of av){let d=a.prepare("SELECT name, enabled, required_env FROM tool_installations WHERE name=?").get(c.name),e={name:c.name,title:c.title,description:c.description,category:c.category,enabled:+!!c.enabled_default,risk_level:c.risk_level,required_env:JSON.stringify(c.required_env||[])};if(!d){a.prepare(`
+    `).run((0,e.nowIso)(),a.id),r(a.id,{type:"stale_recovered",message:"Recovered stale lease"});return b.length&&h(),b.length}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},40718:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Cz:()=>aj,G7:()=>am,IC:()=>al,TRUST_MODE_CONFIG_KEY:()=>at,VM:()=>ae,executeRegistryTool:()=>ar,h7:()=>au,is:()=>as,kt:()=>av,n4:()=>ag,sd:()=>ai,yC:()=>_});var e=c(77598),f=c(34255),g=c(8437),h=c(67179),i=c(26531),j=c(24516),k=c(20086),l=c(2163),m=c(1511),n=c(4160),o=c(59400),p=c(69635),q=c(48446),r=c(2583),s=c(29827),t=c(72189),u=c(68732),v=c(49567),w=c(32668),x=c(81992),y=c(98278),z=c(29327),A=c(13099),B=c(89833),C=c(17607),D=c(85803),E=c(95019),F=c(80987),G=c(51542),H=c(18630),I=c(10088),J=c(22434),K=c(51218),L=c(38708),M=c(56050),N=c(23737),O=c(4638),P=c(45907),Q=c(91437),R=c(30918),S=c(29559),T=c(70952),U=c(59224),V=c(48409),W=c(97190),X=c(87466),Y=c(13331),Z=c(43466),$=a([f,g,h,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,B,C,D,E,F,G,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,W,Y,Z]);[f,g,h,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,B,C,D,E,F,G,I,J,K,L,M,N,O,P,Q,R,S,T,U,V,W,Y,Z]=$.then?(await $)():$;let at="tool_approval_global_mode",au="approval_required",av=new Set(["approval_required","auto"]);function _(){let a=(0,h.getConfig)(at,au);return av.has(a)?a:au}let aw=[{name:"file_read",title:"Read file",description:"Read a bounded file inside approved local roots. Secret files are blocked.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{path:{type:"string"},offset:{type:"number"},limit:{type:"number"}},required:["path"]}},{name:"directory_list",title:"List folder",description:"List directory entries inside approved local roots.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{path:{type:"string"},limit:{type:"number"}}}},{name:"file_search",title:"Search files",description:"Search safe local files while skipping build output, dependencies, databases, and secret files.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{pattern:{type:"string"},path:{type:"string"},target:{type:"string"},file_glob:{type:"string"},limit:{type:"number"}},required:["pattern"]}},{name:"file_write",title:"Write file",description:"Write a file inside approved local roots after owner approval.",category:"local_machine",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{path:{type:"string"},content:{type:"string"},create_dirs:{type:"boolean"},approval_id:{type:"string"}},required:["path","content"]}},{name:"file_patch",title:"Edit file",description:"Patch a file inside approved local roots after owner approval.",category:"local_machine",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{path:{type:"string"},old_string:{type:"string"},new_string:{type:"string"},replace_all:{type:"boolean"},approval_id:{type:"string"}},required:["path","old_string","new_string"]}},{name:"terminal_run",title:"Run command",description:"Run a bounded local command with spawn command and args, never shell:true.",category:"local_machine",risk_level:"medium",approval_mode:"policy",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{command:{type:"string"},args:{type:"array",items:{type:"string"}},cwd:{type:"string"},timeout_ms:{type:"number"},approval_id:{type:"string"}},required:["command"]}},{name:"process_start",title:"Start process",description:"Start a madarX-owned local process and persist process state.",category:"local_machine",risk_level:"medium",approval_mode:"policy",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{command:{type:"string"},args:{type:"array",items:{type:"string"}},cwd:{type:"string"},approval_id:{type:"string"}},required:["command"]}},{name:"process_poll",title:"Check process",description:"Poll a madarX-owned local process row.",category:"local_machine",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{process_id:{type:"string"}},required:["process_id"]}},{name:"process_kill",title:"Stop process",description:"Stop a madarX-owned process after owner approval.",category:"local_machine",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{process_id:{type:"string"},approval_id:{type:"string"}},required:["process_id"]}},{name:"web_search",title:"Search the web",description:"Search the public web with Firecrawl, SearXNG, Brave Search, or the no-key DuckDuckGo Lite fallback, returning ranked results with title, URL, snippet, and source metadata.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{query:{type:"string",description:"Search query."},count:{type:"number",description:"Number of results, 1-10. Default 5."},country:{type:"string",description:"Optional Brave country code, e.g. US."},search_lang:{type:"string",description:"Optional search language, e.g. en."}},required:["query"]}},{name:"web_fetch",title:"Fetch a webpage",description:"Fetch a public URL, block local/private network targets, strip HTML to readable text, and cap response size.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{url:{type:"string",description:"Public http(s) URL to fetch."},max_bytes:{type:"number",description:"Maximum response bytes, capped at 512000."}},required:["url"]}},{name:"web_extract",title:"Extract from webpage",description:"Extract readable content from a public URL with Firecrawl scrape when configured, otherwise fall back to direct web fetch.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{url:{type:"string",description:"Public http(s) URL to extract."},max_bytes:{type:"number",description:"Maximum response bytes for direct fetch fallback, capped at 512000."}},required:["url"]}},{name:"browser_harness_run",title:"Browser Harness",description:"Run a bounded browser-harness Python snippet against an activated Chrome CDP browser. This is local-code-execution risk: it starts disabled and requires owner approval for every main-agent or sub-agent execution.",category:"browser",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{script:{type:"string",description:"Python code executed by browser-harness. Helpers are pre-imported; use new_tab(url), wait_for_load(), page_info(), capture_screenshot(), click_at_xy(), js(), or cdp()."},timeout_ms:{type:"number",description:"Timeout in milliseconds, capped at 600000. Default 120000."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["script"]}},{name:"skill_bridge_run",title:"Skill Bridge",description:"Run one allowlisted first-party gstack CLI skill (connect-chrome, browse, qa-only) to drive the real visible browser the operator can watch live. Crosses the Claude Code CLI trust boundary, so it is ALWAYS approval-gated for every run (even in trust-mode auto) and disabled by default. Pass the skill slug and a plain-language instruction; the bridge invokes only that skill, bounded by the .claude deny list.",category:"browser",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:300,max:10},input_schema:{type:"object",properties:{skill:{type:"string",description:"Skill slug to invoke. One of: connect-chrome, browse, qa-only.",enum:["connect-chrome","browse","qa-only"]},instruction:{type:"string",description:'Plain-language instruction for the skill (e.g. "open Google News and search US Iran war, read the top 3 headlines"). Max 4000 chars.'},timeout_ms:{type:"number",description:"Timeout in milliseconds, capped at 600000. Default 180000."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["skill","instruction"]}},{name:"browser_open",title:"Browser Open (Playwright)",description:"Open a URL in a real headless Chromium and return the final URL, page title, and visible text. Use this (not browser_navigate) for JavaScript-rendered pages, SPAs, or anything that needs a real browser. The page persists across calls so you can browser_act / browser_extract on it next.",category:"browser",risk_level:"medium",required_env:[],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{url:{type:"string",description:"Public http(s) URL to open."},wait_for:{type:"string",description:"Optional CSS selector to wait for after load."},timeout_ms:{type:"number",description:"Navigation timeout in ms (default 30000, max 120000)."}},required:["url"]}},{name:"browser_act",title:"Browser Act (Playwright)",description:"Interact with the currently open page: click, fill, type, select, press a key, scroll, or wait. State-changing — gated for approval in approval-required trust mode. Locate elements with a CSS selector or a Playwright text= selector. Does NOT expand the agent's permissions; it only drives the page already loaded by browser_open.",category:"browser",risk_level:"high",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{action:{type:"string",enum:["click","fill","type","select","press","scroll","wait"],description:"Interaction to perform."},selector:{type:"string",description:"CSS selector or Playwright text= selector for the target element. Required for click/fill/type/select/press."},text:{type:"string",description:"Text to fill/type (for fill/type), or option value (for select)."},value:{type:"string",description:"Option value for select (alternative to text)."},key:{type:"string",description:"Key to press for the press action (default Enter)."},timeout_ms:{type:"number",description:"Action timeout in ms (default 30000, max 120000)."}},required:["action"]}},{name:"browser_extract",title:"Browser Extract (Playwright)",description:"Read content from the currently open page: visible text (default), raw HTML, or JSON-LD blocks. Optionally scoped to a CSS selector. Use after browser_open / browser_act to pull the rendered result.",category:"browser",risk_level:"medium",required_env:[],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{mode:{type:"string",enum:["text","html","json-ld"],default:"text",description:"What to extract."},selector:{type:"string",description:"Optional CSS selector to scope extraction."}}}},{name:"browser_screenshot",title:"Browser Screenshot (Playwright)",description:"Capture a PNG screenshot of the currently open page (or a selector / full page). Saved to disk under data/browser-screenshots; returns the file path.",category:"browser",risk_level:"medium",required_env:[],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:20},input_schema:{type:"object",properties:{selector:{type:"string",description:"Optional CSS selector to screenshot just one element."},full_page:{type:"boolean",description:"Capture the full scrollable page (default false)."}}}},{name:"browser_navigate",title:"Browser Navigate",description:"Fetch a URL with Chrome 124 headers, cookie jar, redirect following, and configurable extraction (text, markdown, json-ld, metadata, raw). Falls back gracefully on JS-only pages.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_ms:6e4,max:30},input_schema:{type:"object",properties:{url:{type:"string",description:"HTTP/HTTPS URL"},extract:{type:"string",enum:["text","markdown","json-ld","metadata","raw"],default:"text"},selector:{type:"string",description:"Optional CSS-like selector: tag, #id, or .class"},wait_for:{type:"string",description:"Optional substring expected in response; returns hint if missing"},max_chars:{type:"integer",default:12e3,maximum:5e4}},required:["url"]}},{name:"browser_extract_structured",title:"Browser Extract Structured",description:"Fetch a URL and extract both JSON-LD structured data and page metadata (title, og:*, meta tags) in one call.",category:"web",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_ms:6e4,max:30},input_schema:{type:"object",properties:{url:{type:"string"}},required:["url"]}},{name:"supabase_list_projects",title:"List Supabase projects",description:"List Supabase projects available to the configured personal access token.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_ACCESS_TOKEN"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{}}},{name:"supabase_rest_select",title:"Read database rows",description:"Read rows from a Supabase table using the REST API with optional filters and limit.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{table:{type:"string",description:"Table name."},select:{type:"string",description:"PostgREST select expression. Default *."},filters:{type:"object",description:"Column filters. Values may be raw PostgREST operators or plain values for eq."},limit:{type:"number",description:"Maximum rows, 1-100. Default 25."}},required:["table"]}},{name:"supabase_rest_insert",title:"Add database rows",description:"Insert one or more rows into a Supabase table using the REST API. Returns the inserted rows.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name (schema-qualified allowed, e.g. auth.users)."},rows:{type:"array",items:{type:"object"},description:"Array of row objects to insert."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","rows"]}},{name:"supabase_rest_upsert",title:"Add or update rows",description:"Upsert one or more rows into a Supabase table. Merges on conflict. Returns affected rows.",category:"supabase",risk_level:"medium",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name."},rows:{type:"array",items:{type:"object"},description:"Array of row objects to upsert."},on_conflict:{type:"string",description:"Comma-separated column(s) to resolve conflicts on."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","rows"]}},{name:"supabase_rest_update",title:"Update database rows",description:"Update rows in a Supabase table matching the given filters. Filters are required — table-wide updates are blocked.",category:"supabase",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name."},patch:{type:"object",description:"Column values to set on matching rows."},filters:{type:"object",description:"Row filters. At least one filter is required."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","patch","filters"]}},{name:"supabase_rest_delete",title:"Delete database rows",description:"Delete rows from a Supabase table matching the given filters. Filters are required — bulk table truncation is blocked. Always requires approval regardless of trust mode.",category:"supabase",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"table",allowlist_default_allow:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{table:{type:"string",description:"Target table name."},filters:{type:"object",description:"Row filters. At least one filter is required."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["table","filters"]}},{name:"supabase_rpc",title:"Call database function",description:"Call a Postgres function via the Supabase REST RPC endpoint.",category:"supabase",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"function_name",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{function_name:{type:"string",description:"Postgres function name to call."},params:{type:"object",description:"Parameters passed as the request body."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["function_name"]}},{name:"supabase_sql",title:"Run SQL query",description:"Execute raw SQL via the madarx_exec_sql() Postgres function. Uses the service-role key and BYPASSES Row-Level Security. Always requires approval regardless of trust mode. Requires creating the madarx_exec_sql() function in your project.",category:"supabase",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:["SUPABASE_URL",["SUPABASE_SERVICE_ROLE_KEY","SUPABASE_ANON_KEY"]],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{query:{type:"string",description:"SQL query to execute via madarx_exec_sql()."},params:{type:"object",description:"Optional named parameters for the query."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["query"]}},{name:"vercel_list_projects",title:"List Vercel projects",description:"List Vercel projects visible to the configured token.",category:"vercel",risk_level:"medium",required_env:["VERCEL_TOKEN"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{team_id:{type:"string",description:"Optional Vercel team id."},limit:{type:"number",description:"Maximum projects."}}}},{name:"vercel_list_deployments",title:"List Vercel deployments",description:"List Vercel deployments, optionally scoped by project.",category:"vercel",risk_level:"medium",required_env:["VERCEL_TOKEN"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{team_id:{type:"string",description:"Optional Vercel team id."},project_id:{type:"string",description:"Optional Vercel project id."},project_name:{type:"string",description:"Optional Vercel project name."},limit:{type:"number",description:"Maximum deployments."}}}},{name:"vercel_create_deployment",title:"Deploy to Vercel",description:"Stage a Vercel deployment request for owner approval. This does not deploy until approved.",category:"vercel",risk_level:"high",required_env:["VERCEL_TOKEN"],enabled_default:!1,approval_required:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{summary:{type:"string",description:"Deployment purpose and requested target."}}}},{name:"email_send",title:"Send email",description:"Send a transactional email via Resend. Approval is required.",category:"email",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",required_env:["RESEND_API_KEY"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"recipient_domain",allowlist_default_allow:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{from:{type:"string",description:"Sender address. Defaults to RESEND_FROM_EMAIL secret/env."},to:{type:"string",description:'Single recipient email address, e.g. "user@example.com".'},subject:{type:"string",description:"Email subject line."},text:{type:"string",description:"Plain-text email body. Either text or html is required."},html:{type:"string",description:"HTML email body. Either text or html is required."},reply_to:{type:"string",description:"Reply-to address."},recipient_domain:{type:"string",description:'Domain portion of the "to" address, e.g. "example.com". Must match the domain in "to" exactly — used by the allowlist gate.'},approval_id:{type:"string",description:"Approval request ID to consume for one-shot execution."}},required:["to","subject"]}},{name:"email_status_lookup",title:"Check email delivery",description:"Look up the delivery status of a previously-sent email.",category:"email",risk_level:"low",required_env:["RESEND_API_KEY"],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{email_id:{type:"string",description:"Resend email ID returned by email_send."}},required:["email_id"]}},{name:"gh_repo_read",title:"Read a GitHub repo",description:"Read metadata for a GitHub repository (name, visibility, default branch, stars, forks).",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format, e.g. acme/api."}},required:["repo_full_name"]}},{name:"gh_repo_list",title:"List GitHub repos",description:"List GitHub repositories the token can access. Without `org`, lists across all affiliations (owned + collaborator + organization_member). Pass `org` to list a specific organization's repos you were granted access to.",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{org:{type:"string",description:"List repos for this organization/owner (GET /orgs/{org}/repos). Use this to reach org repos you were granted access to."},affiliation:{type:"string",description:"Comma-separated: owner, collaborator, organization_member. Default lists all three. Ignored when `org` is set."},visibility:{type:"string",description:"Filter by visibility: all, public, private. Ignored when `org` is set."},type:{type:"string",description:"Without org: all|owner|member (mutually exclusive with affiliation). With org: all|public|private|forks|sources|member."},sort:{type:"string",description:"Sort by: created, updated, pushed, full_name."},per_page:{type:"number",description:"Results per page, 1-100. Default 30."},page:{type:"number",description:"Page number for pagination. Default 1."}}}},{name:"gh_issue_list",title:"List issues",description:"List issues in a GitHub repository with optional state and label filters.",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},state:{type:"string",description:"Issue state: open, closed, all. Default open."},labels:{type:"string",description:"Comma-separated label names to filter by."},per_page:{type:"number",description:"Results per page, 1-100. Default 30."}},required:["repo_full_name"]}},{name:"gh_issue_create",title:"Create an issue",description:"Create an issue in an allowlisted GitHub repository.",category:"github",risk_level:"medium",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},title:{type:"string",description:"Issue title."},body:{type:"string",description:"Issue body in Markdown."},labels:{type:"array",items:{type:"string"},description:"Labels to apply."},assignees:{type:"array",items:{type:"string"},description:"GitHub usernames to assign."}},required:["repo_full_name","title"]}},{name:"gh_issue_comment",title:"Comment on an issue",description:"Post a comment on a GitHub issue in an allowlisted repository.",category:"github",risk_level:"medium",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:30},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},issue_number:{type:"number",description:"Issue number."},body:{type:"string",description:"Comment body in Markdown."}},required:["repo_full_name","issue_number","body"]}},{name:"gh_pr_list",title:"List pull requests",description:"List pull requests in a GitHub repository with optional filters.",category:"github",risk_level:"low",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},state:{type:"string",description:"PR state: open, closed, all. Default open."},head:{type:"string",description:"Filter by head branch (user:branch)."},base:{type:"string",description:"Filter by base branch name."},per_page:{type:"number",description:"Results per page, 1-100. Default 30."}},required:["repo_full_name"]}},{name:"gh_pr_create",title:"Open a pull request",description:"Open a pull request in an allowlisted GitHub repository.",category:"github",risk_level:"high",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},title:{type:"string",description:"PR title."},head:{type:"string",description:"Head branch (source)."},base:{type:"string",description:"Base branch (target)."},body:{type:"string",description:"PR description in Markdown."},draft:{type:"boolean",description:"Open as a draft PR."}},required:["repo_full_name","title","head","base"]}},{name:"gh_pr_comment",title:"Comment on a pull request",description:"Post a comment on a GitHub pull request in an allowlisted repository.",category:"github",risk_level:"medium",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:30},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},pr_number:{type:"number",description:"Pull request number."},body:{type:"string",description:"Comment body in Markdown."}},required:["repo_full_name","pr_number","body"]}},{name:"gh_pr_merge",title:"Merge a pull request",description:"Merge a pull request in an allowlisted GitHub repository. This action is irreversible once completed.",category:"github",risk_level:"irreversible_external",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},pr_number:{type:"number",description:"Pull request number."},commit_title:{type:"string",description:"Custom commit title for squash merge."},commit_message:{type:"string",description:"Custom commit message for squash merge."},merge_method:{type:"string",description:"Merge method: merge, squash, rebase. Default squash."}},required:["repo_full_name","pr_number"]}},{name:"gh_actions_dispatch",title:"Run a GitHub workflow",description:"Trigger a workflow dispatch event in an allowlisted GitHub repository.",category:"github",risk_level:"high",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},workflow_id:{type:"string",description:"Workflow filename or ID (e.g. deploy.yml)."},ref:{type:"string",description:"Branch or tag to run the workflow on."},inputs:{type:"object",description:"Optional workflow dispatch inputs."}},required:["repo_full_name","workflow_id","ref"]}},{name:"gh_release_create",title:"Publish a release",description:"Create a release in an allowlisted GitHub repository.",category:"github",risk_level:"high",required_env:["GITHUB_TOKEN"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"repo_full_name",rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{repo_full_name:{type:"string",description:"Repository in owner/repo format."},tag_name:{type:"string",description:"Git tag for the release."},target_commitish:{type:"string",description:"Commit SHA or branch to tag."},name:{type:"string",description:"Release title."},body:{type:"string",description:"Release notes in Markdown."},draft:{type:"boolean",description:"Create as a draft release."},prerelease:{type:"boolean",description:"Mark as a pre-release."}},required:["repo_full_name","tag_name"]}},{name:"flight_search",title:"Search flights",description:"Search flight offers and return curated price + itinerary data. Uses Amadeus when AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET are configured, otherwise falls back to a free, key-less Google Flights backend lookup.",category:"travel",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{origin:{type:"string",description:'Origin airport IATA code, e.g. "JFK".'},destination:{type:"string",description:'Destination airport IATA code, e.g. "LHR".'},departure_date:{type:"string",description:"Departure date YYYY-MM-DD."},return_date:{type:"string",description:"Optional return date YYYY-MM-DD for round-trip search."},adults:{type:"number",description:"Adult passengers 1-9. Default 1."},children:{type:"number",description:"Child passengers 0-8."},travel_class:{type:"string",description:"ECONOMY | PREMIUM_ECONOMY | BUSINESS | FIRST."},currency:{type:"string",description:"3-letter ISO currency code. Default USD."},non_stop:{type:"boolean",description:"Only return non-stop itineraries."},max_results:{type:"number",description:"Max offers 1-25. Default 5."}},required:["origin","destination","departure_date"]}},{name:"flight_status",title:"Check flight status",description:"Look up live or scheduled flight status via Aviationstack. Returns departure, arrival, delay, and live position.",category:"travel",risk_level:"low",required_env:["AVIATIONSTACK_API_KEY"],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{flight_iata:{type:"string",description:'Flight IATA code, e.g. "BA283".'},flight_icao:{type:"string",description:"Flight ICAO code."},airline_iata:{type:"string",description:'Filter by airline IATA, e.g. "BA".'},dep_iata:{type:"string",description:"Departure airport IATA."},arr_iata:{type:"string",description:"Arrival airport IATA."},flight_date:{type:"string",description:"Flight date YYYY-MM-DD."},limit:{type:"number",description:"Max results 1-100. Default 5."}}}},{name:"hotel_search",title:"Search hotels",description:"List hotels at a TripAdvisor location via Xotelo. No API key required. Returns hotel_keys you can pass to hotel_rates.",category:"travel",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{location_key:{type:"string",description:'TripAdvisor geo location key, e.g. "g60763" for New York City.'},offset:{type:"number",description:"Pagination offset. Default 0."},limit:{type:"number",description:"Results 1-30. Default 10."},sort:{type:"string",description:"popularity | price | rating."},currency:{type:"string",description:"3-letter ISO currency. Default USD."},hotel_class:{type:"string",description:'Filter by star class, e.g. "4,5".'}},required:["location_key"]}},{name:"hotel_rates",title:"Check hotel rates",description:"Get real-time hotel rates from Booking.com, Expedia, Hotels.com, Agoda, etc. via Xotelo. No API key required.",category:"travel",risk_level:"low",required_env:[],enabled_default:!0,allowlist_required:!1,allowlist_default_allow:!0,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{hotel_key:{type:"string",description:'TripAdvisor hotel key, e.g. "g60763-d224867". Obtain from hotel_search.'},chk_in:{type:"string",description:"Check-in date YYYY-MM-DD."},chk_out:{type:"string",description:"Check-out date YYYY-MM-DD (must be after chk_in)."},currency:{type:"string",description:"3-letter ISO currency. Default USD."},rooms:{type:"number",description:"Rooms 1-9. Default 1."},adults:{type:"number",description:"Adults 1-9. Default 2."}},required:["hotel_key","chk_in","chk_out"]}},{name:"gmail_messages_list",title:"List Gmail messages",description:"Read message metadata from the operator Gmail inbox.",category:"email",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{max_results:{type:"number"},q:{type:"string"}}}},{name:"gmail_message_read",title:"Read a Gmail message",description:"Read one Gmail message for summarization or drafting.",category:"email",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{message_id:{type:"string"}},required:["message_id"]}},{name:"gmail_thread_read",title:"Read a Gmail thread",description:"Read a Gmail thread for context.",category:"email",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{thread_id:{type:"string"}},required:["thread_id"]}},{name:"calendar_events_list",title:"List calendar events",description:"Read upcoming Google Calendar events.",category:"calendar",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{calendar_id:{type:"string"},time_min:{type:"string"},time_max:{type:"string"},max_results:{type:"number"}}}},{name:"calendar_event_read",title:"Read a calendar event",description:"Read one Google Calendar event.",category:"calendar",risk_level:"low",approval_mode:"auto",required_env:["GOOGLE_REFRESH_TOKEN"],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{event_id:{type:"string"},calendar_id:{type:"string"}},required:["event_id"]}},{name:"transcribe_audio",title:"Transcribe audio",description:"Transcribe a Disk audio file and save the transcript as a Disk artifact. Provider: openai (whisper, default), elevenlabs (Scribe), or local.",category:"local_machine",risk_level:"medium",approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{file_id:{type:"string"},use_local:{type:"boolean"},provider:{type:"string",description:'Transcription provider: openai | elevenlabs | local. Defaults to TRANSCRIBE_DEFAULT_PROVIDER or "openai".'},language:{type:"string"}},required:["file_id"]}},{name:"voice_speak",title:"Speak text aloud",description:"Synthesize a short text reply to audio via OpenAI TTS (default) or ElevenLabs. Returns base64 audio; optionally saves to Disk.",category:"voice",risk_level:"low",approval_mode:"auto",required_env:[["OPENAI_API_KEY","ELEVENLABS_API_KEY"]],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:60},input_schema:{type:"object",properties:{text:{type:"string",description:"Text to synthesize. Up to 4000 chars."},provider:{type:"string",description:"Provider: openai (default) or elevenlabs."},voice:{type:"string",description:"Provider-specific voice id. OpenAI: alloy|echo|fable|onyx|nova|shimmer. ElevenLabs: voice id."},model:{type:"string"},format:{type:"string",description:"mp3 (default) or wav."},save_to_disk:{type:"boolean"},project_id:{type:"string"}},required:["text"]}},{name:"printing_press_install",title:"Install Printing Press sub-package",description:"Install the printing-press sub-package required to generate scoped CLIs. Always approval-gated.",category:"cli_generator",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{},required:[]}},{name:"printing_press_generate",title:"Generate a scoped CLI",description:"Generate a new scoped CLI from a starter pack, GitHub repo, or local source.",category:"cli_generator",risk_level:"irreversible_external",approval_required:!0,approval_mode:"approval_required",enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{slug:{type:"string",description:"Lowercase kebab-case CLI slug."},source:{type:"string",description:"starter-pack | github | local | spec"},source_url:{type:"string",description:"Required when source is not starter-pack."}},required:["slug"]}},{name:"printing_press_run",title:"Run an installed CLI",description:"Execute a previously-installed printing-press CLI with bounded args.",category:"cli_generator",risk_level:"high",approval_mode:"approval_required",enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"printing_press_cli",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:30},input_schema:{type:"object",properties:{slug:{type:"string",description:"CLI slug to run."},args:{type:"array",items:{type:"string"},description:"Bounded arg list (no shell metacharacters)."},printing_press_cli:{type:"string",description:"Slug used by the allowlist gate. Must equal `slug`."}},required:["slug"]}},{name:"create_workflow_definition",title:"Create workflow definition",description:'Create a new process workflow from a JSON spec. The spec is validated against lib/process/spec-validator.js. The new definition is published immediately at status="published" — cases can be started from it. Risk-gated by approval.',category:"workflow",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{spec:{type:"object",description:"Full workflow spec JSON. Must include schema_version, slug, name, version, stages[]. First stage must be intake_form. See ai-docs/process-engine.md and the validator at lib/process/spec-validator.js for the full schema."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["spec"]}},{name:"update_workflow_definition",title:"Update workflow definition",description:"Update an existing process workflow at a given slug. Spec is re-validated. version must be bumped if the stage list changed structurally. In-flight cases keep their old definition_id; new cases use the new version.",category:"workflow",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{slug:{type:"string",description:"Slug of the existing workflow to update."},spec:{type:"object",description:"Full workflow spec JSON. slug is forced to match the path slug."},approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:["slug","spec"]}},{name:"self_update",title:"Update madarX OS",description:"Update the madarX OS install to the latest published version (npm i -g madarx@latest). Irreversible-external: an agent calling this ALWAYS requires owner approval — it can never silently replace the running binary. A restart is required after a successful update.",category:"system",risk_level:"irreversible_external",required_env:[],enabled_default:!1,allowlist_required:!1,rate_limit:{window_seconds:86400,max:4},input_schema:{type:"object",properties:{approval_id:{type:"string",description:"Approval request ID for one-shot execution."}},required:[]}},{name:"printing_press_query",title:"Query an installed CLI SQLite mirror",description:"Run a single read-only SELECT against a CLI local SQLite mirror, if it exposes one.",category:"cli_generator",risk_level:"low",approval_mode:"auto",enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"printing_press_cli",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{slug:{type:"string",description:"CLI slug whose SQLite mirror to query."},sql:{type:"string",description:"Single SELECT statement. Multi-statement SQL is refused."},printing_press_cli:{type:"string",description:"Slug used by the allowlist gate. Must equal the slug."}},required:["slug","sql"]}},{name:"mines_project_create",title:"Create mine project",description:"Create a new mine project workspace and register it in the Mines module.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:30},input_schema:{type:"object",properties:{name:{type:"string"},slug:{type:"string",description:'Lowercase kebab-case, e.g. "batamote"'},asset_stage:{type:"string",enum:["exploration","development","production","care_and_maintenance","unknown"]},commodity:{type:"string"},deposit_type:{type:"string"},approval_id:{type:"string"}},required:["name","slug"]}},{name:"mines_project_read",title:"Read mine project summary",description:"Read a mine project record including data completeness and document counts by category.",category:"mines",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{project_id:{type:"string"}},required:["project_id"]}},{name:"mines_catalog_import",title:"Import portfolio catalog",description:"Load a master project catalog XLSX into Portfolio and PortfolioEntry records.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{file_id:{type:"string",description:"Disk file ID of the XLSX catalog."},portfolio_name:{type:"string"},sheet_name:{type:"string",description:"Optional sheet override."},approval_id:{type:"string"}},required:["file_id","portfolio_name"]}},{name:"mines_data_import",title:"Bulk import mine data directory",description:"Walk a directory tree, auto-classify files by folder taxonomy, and enqueue each file for ingestion. Incremental and resumable.",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{project_id:{type:"string"},directory_path:{type:"string"},resume:{type:"boolean",description:"Skip files already past queued status."},approval_id:{type:"string"}},required:["project_id","directory_path"]}},{name:"mines_document_extract",title:"Extract and embed document",description:"Parse a source document (PDF/DOCX/PPTX), OCR if scanned, chunk text, and embed chunks. Spanish-first.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{source_document_id:{type:"string"},force_ocr:{type:"boolean"},approval_id:{type:"string"}},required:["source_document_id"]}},{name:"mines_spatial_index",title:"Index spatial assets",description:"Read GIS/CAD file metadata (kind, CRS, bounding box) without rendering geometry.",category:"mines",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{project_id:{type:"string"},source_document_id:{type:"string",description:"Index a single already-catalogued file."}},required:["project_id"]}},{name:"mines_extract_facts",title:"Extract structured facts from documents (LLM)",description:"Read a project document's indexed chunks and extract structured, provenance-cited geology/economics facts into mines_extracted_facts. Every fact is validated to cite a real chunk + verbatim quote; uncited facts are rejected. Never declares a mineral resource the source did not. Feeds mines_report_generate and mines_valuation_run.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:20},input_schema:{type:"object",properties:{project_id:{type:"string"},source_document_id:{type:"string",description:"Document to extract from. Defaults to the project's most-chunked document (its technical report)."},max_chunks:{type:"number",description:"Max chunks fed to the model. Default 48."},char_budget:{type:"number",description:"Max source characters per call. Default 32000."},approval_id:{type:"string"}},required:["project_id"]}},{name:"mines_assumption_validate",title:"Validate valuation assumptions",description:"Check completeness of data required for T1 or T2 valuation and return a gap list.",category:"mines",risk_level:"low",approval_mode:"auto",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{project_id:{type:"string"},target_tier:{type:"string",enum:["t1_in_situ","t2_dcf","auto"]}},required:["project_id"]}},{name:"mines_valuation_run",title:"Run tiered mine valuation",description:"Compute base/downside/upside valuation. Selects T1 (in-situ) or T2 (DCF) based on asset stage and data completeness. States tier and rationale.",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{project_id:{type:"string"},commodity_prices_json:{type:"string",description:'JSON price override e.g. {"Au":2300,"Cu":4.2}. Defaults to latest mines_market_snapshots.'},in_situ_factor_override:{type:"number"},force_tier:{type:"string",enum:["t1_in_situ","t2_dcf"]},approval_id:{type:"string"}},required:["project_id"]}},{name:"mines_sensitivity_run",title:"Run valuation sensitivity analysis",description:"Compute sensitivity of valuation to key drivers (grade, price, recovery, in_situ_factor, discount_rate).",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:10},input_schema:{type:"object",properties:{scenario_id:{type:"string"},drivers:{type:"array",items:{type:"string"}},steps:{type:"number",description:"Steps per driver. Default 5."},approval_id:{type:"string"}},required:["scenario_id"]}},{name:"mines_market_snapshot",title:"Fetch commodity market data",description:"Retrieve current commodity prices from an approved market data provider.",category:"mines",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:["MINES_MARKET_API_KEY"],enabled_default:!1,allowlist_required:!0,allowlist_scope_key:"market_provider_host",allowlist_default_allow:!1,rate_limit:{window_seconds:60,max:60},input_schema:{type:"object",properties:{commodities:{type:"array",items:{type:"string"}},market_provider_host:{type:"string",description:'e.g. "metals-api.com". Must be in allowlist.'},approval_id:{type:"string"}},required:["market_provider_host"]}},{name:"mines_report_generate",title:"Generate mine project report",description:"Generate a cited, structured report artifact. External email send always requires separate irreversible_external approval.",category:"mines",risk_level:"high",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,rate_limit:{window_seconds:3600,max:5},input_schema:{type:"object",properties:{project_id:{type:"string"},report_kind:{type:"string",enum:["interpretation_memo","due_diligence_memo","data_quality_report","investor_presentation","pfs_readiness_report","valuation_report","due_diligence_questions","project_package","portfolio_screen"]},scenario_id:{type:"string",description:"Required for valuation_report."},space_id:{type:"string",description:"Optional dashboard space to publish into. Defaults to the project’s configured default space; the artifact is pinned there so it appears as a window on the dashboard board."},language:{type:"string",enum:["en","es"],description:'Default "en".'},narrative:{type:"object",description:"LLM-authored prose slots (all optional, each falls back to data-driven copy). For investor_presentation: hero_headline, hero_subhead (strings); opportunity (array of paragraph strings); findings_lead, upside_lead, risk_lead, the_ask (strings). For pfs_readiness_report: verdict, gap_intro, work_program, recommendation (strings). Numbers/figures are never taken from here — they always come from cited DB rows.",properties:{hero_headline:{type:"string"},hero_subhead:{type:"string"},opportunity:{type:"array",items:{type:"string"}},findings_lead:{type:"string"},upside_lead:{type:"string"},risk_lead:{type:"string"},the_ask:{type:"string"},verdict:{type:"string"},gap_intro:{type:"string"},work_program:{type:"string"},recommendation:{type:"string"}}},send_email:{type:"boolean"},recipient_email:{type:"string"},approval_id:{type:"string"}},required:["project_id","report_kind"]}},{name:"create_skill",title:"Author skill",description:"Author a declarative skill (SKILL.md + marketplace row) any agent can invoke. Instructions only — no code executes. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{spec:{type:"object",description:"{ slug, title, description?, markdown, invocation?, trigger_examples?[], category? }"},approval_id:{type:"string"}},required:["spec"]}},{name:"update_skill",title:"Update skill",description:"Update an existing authored skill by slug. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string"},spec:{type:"object"},approval_id:{type:"string"}},required:["slug","spec"]}},{name:"create_composite_tool",title:"Author composite tool",description:"Author a composite tool: a declarative recipe chaining EXISTING primitive tools + LLM steps. Inherits the MAX risk of its steps; every gate re-fires per sub-step. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{spec:{type:"object",description:'{ slug, title, description?, input_schema?, steps:[{kind:"tool_call"|"llm_synthesis"|"artifact_write", id, ...}] }'},approval_id:{type:"string"}},required:["spec"]}},{name:"update_composite_tool",title:"Update composite tool",description:"Update an existing composite tool by slug. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string"},spec:{type:"object"},approval_id:{type:"string"}},required:["slug","spec"]}},{name:"create_connector",title:"Author API connector",description:"Author a declarative REST API connector (Option D). Each endpoint becomes a callable <slug>.<endpoint> tool backed by the generic http_api_call executor. Manifest is inert data: https-only, secret-by-reference auth, host allowlist, per-endpoint risk ceiling. Owner/admin authority required. The owner supplies the API key once.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{manifest:{type:"object",description:"{ slug, base_url(https), allowed_hosts[], auth:{type,secret_ref|username_ref/password_ref,header?,prefix?,query_param?}, default_headers?, endpoints:{ name:{method,path,risk?,input_schema?} } }"},approval_id:{type:"string"}},required:["manifest"]}},{name:"update_connector",title:"Update API connector",description:"Update an existing API connector by slug. Owner/admin authority required.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string"},manifest:{type:"object"},approval_id:{type:"string"}},required:["slug","manifest"]}},{name:"propose_tool",title:"Propose new tool (code-gen)",description:"Option B escape hatch for non-REST integrations: generate an adapter scaffold + registry snippet + tests into a staging dir. The proposal is INERT — it is never callable until a human reviews, merges, and restarts. Writes files only; executes nothing.",category:"authoring",risk_level:"medium",approval_required:!0,approval_mode:"approval_required",required_env:[],enabled_default:!0,allowlist_required:!1,input_schema:{type:"object",properties:{slug:{type:"string",description:"snake_case tool name"},summary:{type:"string"},risk:{type:"string",enum:["low","medium","high","irreversible_external"]},approval_id:{type:"string"}},required:["slug"]}}],ax={web_search:o.tE,web_fetch:o.dV,web_extract:o.IY,email_send:p.x,email_status_lookup:p.f,supabase_list_projects:q.NO,supabase_rest_select:q.TP,supabase_rest_insert:q.c3,supabase_rest_upsert:q.mD,supabase_rest_update:q.sX,supabase_rest_delete:q.oc,supabase_rpc:q.wm,supabase_sql:q.l8,vercel_list_projects:r.Q$,vercel_list_deployments:r.I6,vercel_create_deployment:r.vV,gh_repo_read:s.Sj,gh_repo_list:s.AU,gh_issue_list:s.jj,gh_issue_create:s.vj,gh_issue_comment:s.iP,gh_pr_list:s.gn,gh_pr_create:s.Ud,gh_pr_comment:s.J,gh_pr_merge:s.wt,gh_actions_dispatch:s.zI,gh_release_create:s.Bb,file_read:t.dd,directory_list:t.sv,file_search:t.X,file_write:t.sq,file_patch:t.vO,terminal_run:u.y,process_start:v.gy,process_poll:v.p3,process_kill:v.MU,flight_search:w.R5,flight_status:w.zP,hotel_search:w.FE,hotel_rates:w.Y$,gmail_messages_list:x.r_,gmail_message_read:x.cS,gmail_thread_read:x.vg,calendar_events_list:y.u,calendar_event_read:y.r,transcribe_audio:z.b,browser_harness_run:A.K,skill_bridge_run:B.eE,browser_open:D.D6,browser_act:D.Hz,browser_extract:D.aU,browser_screenshot:D.Jz,browser_navigate:C.M,browser_extract_structured:C.B,voice_speak:E.o,printing_press_install:F.gE,printing_press_generate:F.ID,printing_press_run:F.Cw,printing_press_query:F.VC,create_workflow_definition:G.h,update_workflow_definition:G.m,self_update:H.m,create_skill:I.S,update_skill:I.f,create_composite_tool:J.y$,update_composite_tool:J.le,create_connector:K.U$,update_connector:K.zc,propose_tool:L.B,http_api_call:M.p,composite_tool_run:N.n,mines_project_create:Q.m,mines_project_read:Q.I,mines_catalog_import:R.b,mines_data_import:S.I,mines_document_extract:T.f,mines_extract_facts:Z.$,mines_spatial_index:U.d,mines_assumption_validate:V.w,mines_valuation_run:W.R,mines_sensitivity_run:W.h,mines_market_snapshot:X.V,mines_report_generate:Y.Q},ay={file_write:t.Z6,file_patch:t.mr,terminal_run:u.x,process_start:v.H7,process_kill:v.L7,browser_harness_run:A.r,skill_bridge_run:B.zE},az=new Set;function aa(a){try{if((0,j.getSecret)(a))return!0}catch{}return!!process.env[a]&&(az.has(a)||(az.add(a),console.warn(`[secrets] ${a} is being read from process.env as a fallback. Migrate it to the vault with: node scripts/migrate-env-to-secrets.mjs`)),!0)}function ab(a=[]){return a.filter(a=>Array.isArray(a)?!a.some(a=>aa(a)):!aa(a)).map(a=>Array.isArray(a)?a.join(" or "):a)}let aA=[{marker:"tool.repair.flight_search_enable_v1",tool_name:"flight_search",summary:"One-shot: enable flight_search on installs where the Amadeus→Google fallback shipped after the row was created."}];function ac(){let a=(0,f.getDb)(),b=(0,f.nowIso)();for(let c of aw){let d=a.prepare("SELECT name, enabled, required_env FROM tool_installations WHERE name=?").get(c.name),e={name:c.name,title:c.title,description:c.description,category:c.category,enabled:+!!c.enabled_default,risk_level:c.risk_level,required_env:JSON.stringify(c.required_env||[])};if(!d){a.prepare(`
         INSERT INTO tool_installations
           (name, title, description, category, enabled, risk_level, required_env, created_at, updated_at)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      `).run(e.name,e.title,e.description,e.category,e.enabled,e.risk_level,e.required_env,b,b);continue}let g=ac(d.required_env,[]),h=c.required_env||[],i=d.enabled,j=!1;g.length>0&&0===h.length&&0===Number(d.enabled)&&!0===c.enabled_default&&(i=1,j=!0),a.prepare(`
+      `).run(e.name,e.title,e.description,e.category,e.enabled,e.risk_level,e.required_env,b,b);continue}let g=ad(d.required_env,[]),h=c.required_env||[],i=d.enabled,j=!1;g.length>0&&0===h.length&&0===Number(d.enabled)&&!0===c.enabled_default&&(i=1,j=!0),a.prepare(`
       UPDATE tool_installations
       SET title=?, description=?, category=?, risk_level=?, required_env=?, enabled=?, updated_at=?
       WHERE name=?
     `).run(e.title,e.description,e.category,e.risk_level,e.required_env,i,b,e.name),j&&a.prepare(`
         INSERT INTO audit_logs (id, at, type, summary, status, meta)
         VALUES (?, ?, ?, ?, ?, ?)
-      `).run((0,f.newId)("audit"),b,"tool.auto_enabled_after_creds_removed",`Auto-enabled ${c.name} after credential requirements were removed.`,"success",JSON.stringify({tool_name:c.name,previous_required_env:g,new_required_env:h}))}let c=(0,f.getDb)(),d=(0,f.nowIso)();for(let a of az){if(c.prepare("SELECT id FROM audit_logs WHERE type=? LIMIT 1").get(a.marker))continue;let b=av.find(b=>b.name===a.tool_name);if(!b||0!==(b.required_env||[]).length||!0!==b.enabled_default)continue;let e=c.prepare("SELECT name, enabled FROM tool_installations WHERE name=?").get(a.tool_name);if(e){if(0!==Number(e.enabled)){c.prepare(`
+      `).run((0,f.newId)("audit"),b,"tool.auto_enabled_after_creds_removed",`Auto-enabled ${c.name} after credential requirements were removed.`,"success",JSON.stringify({tool_name:c.name,previous_required_env:g,new_required_env:h}))}let c=(0,f.getDb)(),d=(0,f.nowIso)();for(let a of aA){if(c.prepare("SELECT id FROM audit_logs WHERE type=? LIMIT 1").get(a.marker))continue;let b=aw.find(b=>b.name===a.tool_name);if(!b||0!==(b.required_env||[]).length||!0!==b.enabled_default)continue;let e=c.prepare("SELECT name, enabled FROM tool_installations WHERE name=?").get(a.tool_name);if(e){if(0!==Number(e.enabled)){c.prepare(`
         INSERT INTO audit_logs (id, at, type, summary, status, meta)
         VALUES (?, ?, ?, ?, ?, ?)
       `).run((0,f.newId)("audit"),d,a.marker,`${a.summary} (no-op: already enabled)`,"success",JSON.stringify({tool_name:a.tool_name,action:"noop"}));continue}c.prepare("UPDATE tool_installations SET enabled=1, updated_at=? WHERE name=?").run(d,a.tool_name),c.prepare(`
       INSERT INTO audit_logs (id, at, type, summary, status, meta)
       VALUES (?, ?, ?, ?, ?, ?)
-    `).run((0,f.newId)("audit"),d,a.marker,a.summary,"success",JSON.stringify({tool_name:a.tool_name,action:"enabled"}))}}}function ac(a,b){try{let c=JSON.parse(a||"[]");return Array.isArray(c)?c:b}catch{return b}}function ad(){let a=new Set,b=new Map;for(let c of av)a.add(c.name),b.set(c.name,c.risk_level||"medium");return{names:a,riskByName:b}}function ae(){let a=[],b=[];try{a=(0,N.n_)()}catch{a=[]}try{b=(0,O.R$)()}catch{b=[]}return[...a,...b].map(a=>({kind:"tool",connector:null,...a}))}function af(){return ab(),[...(0,f.getDb)().prepare("SELECT * FROM tool_installations ORDER BY category ASC, name ASC").all().map(a=>{let b=av.find(b=>b.name===a.name),c=ac(a.required_env,b?.required_env||[]),d=aa(c);return{kind:"tool",name:a.name,title:a.title,description:a.description,category:a.category,enabled:!!a.enabled,available:0===d.length,missing_env:d,required_env:function(a=[]){return a.flatMap(a=>Array.isArray(a)?a:[a])}(c),risk_level:a.risk_level,approval_required:!!b?.approval_required,approval_mode:b?.approval_mode||(b?.approval_required?"approval_required":"auto"),allowlist_required:!!b?.allowlist_required,allowlist_scope_key:b?.allowlist_scope_key??null,allowlist_default_allow:!!b?.allowlist_default_allow,connector:ag(a.category),input_schema:b?.input_schema||{type:"object",properties:{}}}}),...ae()]}function ag(a){var b=a;let c=av.filter(a=>a.category===b);if(!c.length)return null;let d=[...new Set(c.flatMap(a=>aa(a.required_env||[])))];return{type:b,status:d.length?"missing_env":"ready",missing_env:d}}function ah(a=[]){return{core:a.map(a=>({...a,enabled:!0,available:!0,category:"core",risk_level:"local"})),marketplace:af(),connectors:["local_machine","web","browser","supabase","vercel","github","email","travel","voice"].map(ag).filter(Boolean)}}function ai(a=[]){let b=af().filter(a=>a.enabled&&a.available).map(a=>({name:a.name,description:a.approval_required?`${a.description} Approval is required before external writes are executed.`:a.description,input_schema:a.input_schema}));return[...a,...b]}function aj({agent_id:a,tool_name:b,status:c,summary:d,meta:e={}}){a&&(0,f.getDb)().prepare(`
+    `).run((0,f.newId)("audit"),d,a.marker,a.summary,"success",JSON.stringify({tool_name:a.tool_name,action:"enabled"}))}}}function ad(a,b){try{let c=JSON.parse(a||"[]");return Array.isArray(c)?c:b}catch{return b}}function ae(){let a=new Set,b=new Map;for(let c of aw)a.add(c.name),b.set(c.name,c.risk_level||"medium");return{names:a,riskByName:b}}function af(){let a=[],b=[];try{a=(0,O.n_)()}catch{a=[]}try{b=(0,P.R$)()}catch{b=[]}return[...a,...b].map(a=>({kind:"tool",connector:null,...a}))}function ag(){return ac(),[...(0,f.getDb)().prepare("SELECT * FROM tool_installations ORDER BY category ASC, name ASC").all().map(a=>{let b=aw.find(b=>b.name===a.name),c=ad(a.required_env,b?.required_env||[]),d=ab(c);return{kind:"tool",name:a.name,title:a.title,description:a.description,category:a.category,enabled:!!a.enabled,available:0===d.length,missing_env:d,required_env:function(a=[]){return a.flatMap(a=>Array.isArray(a)?a:[a])}(c),risk_level:a.risk_level,approval_required:!!b?.approval_required,approval_mode:b?.approval_mode||(b?.approval_required?"approval_required":"auto"),allowlist_required:!!b?.allowlist_required,allowlist_scope_key:b?.allowlist_scope_key??null,allowlist_default_allow:!!b?.allowlist_default_allow,connector:ah(a.category),input_schema:b?.input_schema||{type:"object",properties:{}}}}),...af()]}function ah(a){var b=a;let c=aw.filter(a=>a.category===b);if(!c.length)return null;let d=[...new Set(c.flatMap(a=>ab(a.required_env||[])))];return{type:b,status:d.length?"missing_env":"ready",missing_env:d}}function ai(a=[]){return{core:a.map(a=>({...a,enabled:!0,available:!0,category:"core",risk_level:"local"})),marketplace:ag(),connectors:["local_machine","web","browser","supabase","vercel","github","email","travel","voice"].map(ah).filter(Boolean)}}function aj(a=[]){let b=ag().filter(a=>a.enabled&&a.available).map(a=>({name:a.name,description:a.approval_required?`${a.description} Approval is required before external writes are executed.`:a.description,input_schema:a.input_schema}));return[...a,...b]}function ak({agent_id:a,tool_name:b,status:c,summary:d,meta:e={}}){a&&(0,f.getDb)().prepare(`
     INSERT INTO audit_logs (id, at, type, summary, status, meta)
     VALUES (?, ?, ?, ?, ?, ?)
-  `).run((0,f.newId)("audit"),(0,f.nowIso)(),`agent.tool.${c}`,d,c,JSON.stringify({agent_id:a,tool_name:b,...e}))}function ak(a,b=[]){if(!a)return ai(b);let c=(0,f.getDb)().prepare("SELECT tool_name, mode FROM agent_tool_permissions WHERE agent_id = ?").all(a),d=new Map(c.filter(a=>"disabled"!==a.mode).map(a=>[a.tool_name,a.mode])),e=af().filter(a=>a.enabled&&a.available&&d.has(a.name)).map(a=>({name:a.name,description:"approval_required"===d.get(a.name)?`${a.description} Agent permission requires owner approval before execution.`:a.description,input_schema:a.input_schema}));return[...b,...e]}function al(a,b){ab();let c=(0,f.getDb)();if(c.prepare("SELECT name FROM tool_installations WHERE name=?").get(a))return c.prepare("UPDATE tool_installations SET enabled=?, updated_at=? WHERE name=?").run(+!!b,(0,f.nowIso)(),a),af().find(b=>b.name===a);let d=ae().find(b=>b.name===a);if(!d)throw Error(`Unknown tool: ${a}`);return b||d.source?.kind!=="composite"?b||d.source?.kind!=="connector"||(0,O.w$)(d.source.connector_slug):(0,N.u5)(d.source.composite_slug),ae().find(b=>b.name===a)||{name:a,enabled:!!b,available:!0}}function am(a,b){if("irreversible_external"===a.risk_level)return!0;if("terminal_run"===a.name||"process_start"===a.name){let a=String(b?.command||"");if(!a)return!1;let c=Array.isArray(b?.args)?b.args.map(String):[];return"irreversible_external"===(0,i.IB)(a,c).risk}return!1}function an(a={}){let b={...a};return"string"==typeof b.content&&b.content.length>500&&(b.content=`[${b.content.length} chars]`),"string"==typeof b.new_string&&b.new_string.length>500&&(b.new_string=`[${b.new_string.length} chars]`),"approval_id"in b&&delete b.approval_id,b}let aA={create_workflow_definition:a=>({slug:a?.spec?.slug||null}),update_workflow_definition:a=>({slug:a?.slug||a?.spec?.slug||null,version:a?.spec?.version||null})};function ao(a,b={}){let c=aA[a],d=c?c(b):(()=>{let a={...b};return delete a.approval_id,a})();return(0,e.createHash)("sha256").update(`${a}|${function a(b){if(null===b||"object"!=typeof b)return JSON.stringify(b);if(Array.isArray(b))return`[${b.map(b=>a(b)).join(",")}]`;let c=Object.keys(b).sort();return`{${c.map(c=>`${JSON.stringify(c)}:${a(b[c])}`).join(",")}}`}(d)}`).digest("hex")}function ap({tool_name:a,status:b,summary:c,meta:d={}}){(0,f.getDb)().prepare(`
+  `).run((0,f.newId)("audit"),(0,f.nowIso)(),`agent.tool.${c}`,d,c,JSON.stringify({agent_id:a,tool_name:b,...e}))}function al(a,b=[]){if(!a)return aj(b);let c=(0,f.getDb)().prepare("SELECT tool_name, mode FROM agent_tool_permissions WHERE agent_id = ?").all(a),d=new Map(c.filter(a=>"disabled"!==a.mode).map(a=>[a.tool_name,a.mode])),e=ag().filter(a=>a.enabled&&a.available&&d.has(a.name)).map(a=>({name:a.name,description:"approval_required"===d.get(a.name)?`${a.description} Agent permission requires owner approval before execution.`:a.description,input_schema:a.input_schema}));return[...b,...e]}function am(a,b){ac();let c=(0,f.getDb)();if(c.prepare("SELECT name FROM tool_installations WHERE name=?").get(a))return c.prepare("UPDATE tool_installations SET enabled=?, updated_at=? WHERE name=?").run(+!!b,(0,f.nowIso)(),a),ag().find(b=>b.name===a);let d=af().find(b=>b.name===a);if(!d)throw Error(`Unknown tool: ${a}`);return b||d.source?.kind!=="composite"?b||d.source?.kind!=="connector"||(0,P.w$)(d.source.connector_slug):(0,O.u5)(d.source.composite_slug),af().find(b=>b.name===a)||{name:a,enabled:!!b,available:!0}}function an(a,b){if("irreversible_external"===a.risk_level)return!0;if("terminal_run"===a.name||"process_start"===a.name){let a=String(b?.command||"");if(!a)return!1;let c=Array.isArray(b?.args)?b.args.map(String):[];return"irreversible_external"===(0,i.IB)(a,c).risk}return!1}function ao(a={}){let b={...a};return"string"==typeof b.content&&b.content.length>500&&(b.content=`[${b.content.length} chars]`),"string"==typeof b.new_string&&b.new_string.length>500&&(b.new_string=`[${b.new_string.length} chars]`),"approval_id"in b&&delete b.approval_id,b}let aB={create_workflow_definition:a=>({slug:a?.spec?.slug||null}),update_workflow_definition:a=>({slug:a?.slug||a?.spec?.slug||null,version:a?.spec?.version||null})};function ap(a,b={}){let c=aB[a],d=c?c(b):(()=>{let a={...b};return delete a.approval_id,a})();return(0,e.createHash)("sha256").update(`${a}|${function a(b){if(null===b||"object"!=typeof b)return JSON.stringify(b);if(Array.isArray(b))return`[${b.map(b=>a(b)).join(",")}]`;let c=Object.keys(b).sort();return`{${c.map(c=>`${JSON.stringify(c)}:${a(b[c])}`).join(",")}}`}(d)}`).digest("hex")}function aq({tool_name:a,status:b,summary:c,meta:d={}}){(0,f.getDb)().prepare(`
     INSERT INTO audit_logs (id, at, type, summary, status, meta)
     VALUES (?, ?, ?, ?, ?, ?)
-  `).run((0,f.newId)("audit"),(0,f.nowIso)(),`main_agent.tool.${b}`,c,b,JSON.stringify({tool_name:a,...d}))}async function aq(a,b={},c={}){let d=af().find(b=>b.name===a);if(!d)throw Error(`Unknown tool: ${a}`);if(!d.enabled)throw Error(`Tool disabled: ${a}`);if(!d.available)throw Error(`Tool unavailable; missing environment: ${d.missing_env.join(", ")}`);let e=ax[a];e&&e(b);{let b=c?.acting_on_behalf_of_user_id||c?.user_id||null,d=new Set(["system","whatsapp-service"]);if(b&&!d.has(b)){let d="personal-org";try{let a=(0,f.getDb)(),b=c.agent_id?a.prepare("SELECT project_id FROM agents WHERE id = ?").get(c.agent_id):null;if(b?.project_id){let c=a.prepare("SELECT org_id FROM projects WHERE id = ?").get(b.project_id);c?.org_id&&(d=c.org_id)}}catch{}try{await (0,m.aS)({user_id:b,org_id:d},d)}catch(e){if(e&&(403===e.status||"membership_revoked"===e.error)){if(c?.heartbeat_task_id)try{(0,f.getDb)().prepare("UPDATE heartbeat_tasks SET status = 'approval_required', updated_at = ? WHERE id = ?").run((0,f.nowIso)(),c.heartbeat_task_id)}catch(a){console.error("[registry] Gate 0: failed to pause heartbeat task:",a.message)}try{(0,n.appendComplianceAudit)({user_id:b,org_id:d,action:"auth.membership.revoked_detected",status:"denied",summary:`Tool ${a} blocked — membership revoked for user ${b}`,action_target_type:"tool",action_target_id:a,meta:{tool_name:a,agent_id:c.agent_id||null,org_id:d}})}catch{}return{ok:!1,status:"approval_required",approval_request_id:null,reason:"membership_revoked"}}throw e}}}let h=!1,j=null;if(!c.agent_id&&am(d,b)){let c=`main_agent_tool_irreversible:${a}`,d=ao(a,b);if(!(0,g.v)(b.approval_id,{action_type:c,matches:a=>a?.input_signature===d})){let e=(0,g.D6)({action_type:c,risk:"irreversible_external",summary:`Allow the main agent to run irreversible external tool ${a}`,payload:{tool_name:a,input:an(b),input_signature:d,...function(a,b={}){return"supabase_sql"===a?{warning:"This call uses the service-role key and BYPASSES Row-Level Security. Only approve if you have reviewed the exact SQL.",query:String(b.query||"")}:{}}(a,b)},requested_by:"main_agent"});return ap({tool_name:a,status:"irreversible_external_approval_required",summary:`Main agent irreversible-external approval required for ${a}`,meta:{approval_request_id:e.id}}),{ok:!1,status:"approval_required",approval_request_id:e.id,reason:`Tool ${a} is irreversible and always requires owner approval`}}h=!0,j=b.approval_id||null,ap({tool_name:a,status:"irreversible_external_approved",summary:`Main agent irreversible-external approval consumed for ${a}`})}if(!c.agent_id&&!h&&!c.owner_trusted&&function(a,b){if(a.approval_required)return!0;if("terminal_run"===a.name||"process_start"===a.name){let a=String(b?.command||"");if(!a)return!1;let c=Array.isArray(b?.args)?b.args.map(String):[];return(0,i.IB)(a,c).approval_required}return!1}(d,b)){let c=$();if("auto"===c)h=!0,ap({tool_name:a,status:"auto_approved",summary:`Main agent trust mode auto-approved ${a}`});else{let c=`main_agent_tool:${a}`,e=ao(a,b);if(!(0,g.v)(b.approval_id,{action_type:c,matches:a=>a?.input_signature===e})){let f=(0,g.D6)({action_type:c,risk:d.risk_level||"medium",summary:`Allow the main agent to run ${a}`,payload:{tool_name:a,input:an(b),input_signature:e},requested_by:"main_agent"});return ap({tool_name:a,status:"approval_required",summary:`Main agent approval required for ${a}`,meta:{approval_request_id:f.id}}),{ok:!1,status:"approval_required",approval_request_id:f.id,reason:`Main agent tool ${a} requires owner approval`}}h=!0,j=b.approval_id||null,ap({tool_name:a,status:"approved",summary:`Main agent approval consumed for ${a}`})}}let o=function(a,b){var c;if(!a)return{ok:!0,mode:"legacy"};let d=(c=b.name,a&&c&&(0,f.getDb)().prepare("SELECT * FROM agent_tool_permissions WHERE agent_id = ? AND tool_name = ?").get(a,c)||null);if(!d)throw aj({agent_id:a,tool_name:b.name,status:"denied",summary:`Denied ${b.name}: missing agent permission`}),Error(`Agent ${a} is not permitted to use ${b.name}`);if("disabled"===d.mode)throw aj({agent_id:a,tool_name:b.name,status:"denied",summary:`Denied ${b.name}: permission disabled`}),Error(`Tool disabled for agent ${a}: ${b.name}`);return{ok:!0,mode:d.mode}}(c.agent_id,d),p=am(d,b)&&("browser_harness_run"===a||!!d.source);if(c.agent_id&&p&&!(0,g.v)(b.approval_id,{action_type:`agent_tool_irreversible:${a}`})){let d=(0,g.D6)({action_type:`agent_tool_irreversible:${a}`,risk:"irreversible_external",summary:`Allow ${c.agent_id} to run irreversible external tool ${a}`,payload:{agent_id:c.agent_id,tool_name:a,input:an(b)},requested_by:c.agent_id});return aj({agent_id:c.agent_id,tool_name:a,status:"irreversible_external_approval_required",summary:`Irreversible-external approval required for ${a}`,meta:{approval_request_id:d.id}}),{ok:!1,status:"approval_required",approval_request_id:d.id,reason:`Tool ${a} is irreversible and always requires owner approval`}}if(c.agent_id&&"approval_required"===o.mode&&!(0,g.v)(b.approval_id,{action_type:`agent_tool:${a}`})){let e=(0,g.D6)({action_type:`agent_tool:${a}`,risk:d.risk_level||"medium",summary:`Allow ${c.agent_id} to run ${a}`,payload:{agent_id:c.agent_id,tool_name:a,input:an(b)},requested_by:c.agent_id});return aj({agent_id:c.agent_id,tool_name:a,status:"approval_required",summary:`Approval required for ${a}`,meta:{approval_request_id:e.id}}),{ok:!1,status:"approval_required",approval_request_id:e.id,reason:`Agent tool permission requires approval for ${a}`}}if(d.allowlist_required&&d.allowlist_scope_key){let e;if("recipient_domain"===d.allowlist_scope_key){let a=String(b?.to||""),c=a.lastIndexOf("@");e=c>=0?a.slice(c+1).toLowerCase():a.toLowerCase()}else e=String(b?.[d.allowlist_scope_key]??"");let f=!!d.allowlist_default_allow,g=(0,k.Bs)(a,{scope_key:d.allowlist_scope_key,scope_value:e},{default_allow:f});if(!g.ok){let b=c.agent_id?aj:ap,f=c.agent_id?{agent_id:c.agent_id,tool_name:a,status:"allowlist_violation",summary:`Allowlist violation for ${a}: ${d.allowlist_scope_key}=${e}`,meta:{scope_key:d.allowlist_scope_key,scope_value:e}}:{tool_name:a,status:"allowlist_violation",summary:`Allowlist violation for ${a}: ${d.allowlist_scope_key}=${e}`,meta:{scope_key:d.allowlist_scope_key,scope_value:e}};return b(f),{ok:!1,status:"allowlist_violation",missing_entry:g.missing_entry}}}let q=av.find(b=>b.name===a),r=(0,l.ab)(a,c.agent_id,q);if(!r.ok){let b="rate_limited",d=`Rate limit exceeded for ${a}: ${r.current_count}/${r.max} in window`;return c.agent_id?aj({agent_id:c.agent_id,tool_name:a,status:b,summary:d,meta:{current_count:r.current_count,max:r.max,retry_after_seconds:r.retry_after_seconds}}):ap({tool_name:a,status:b,summary:d,meta:{current_count:r.current_count,max:r.max,retry_after_seconds:r.retry_after_seconds}}),{ok:!1,status:"rate_limited",retry_after_seconds:r.retry_after_seconds,current_count:r.current_count,max:r.max}}let s=aw[a],t=b;if(s||d.source?.kind!=="connector"?s||d.source?.kind!=="composite"||(s=aw.composite_tool_run,t={...b,__composite_slug:d.source.composite_slug}):(s=aw.http_api_call,t={...b,__connector_slug:d.source.connector_slug,__endpoint:d.source.endpoint}),!s)throw Error(`No adapter registered for tool: ${a}`);let u=await s(t,{owner_trusted:h||!!c.owner_trusted,agent_id:c.agent_id,project_id:c.project_id,org_id:c.org_id,actor_role:c.actor_role||c.role,engine:c.engine,acting_on_behalf_of_user_id:c.acting_on_behalf_of_user_id||c.user_id||null}),v=u?.status==="error"||u?.ok===!1,w=new Set(["spec_invalid","spec_required","slug_required","slug_in_use","version_bump_required","not_found","insufficient_role"]);v&&w.has(u?.error)&&j&&(0,g.t6)(j),v||(0,l.Cu)(a,c.agent_id,q);let x=v?{error:u?.error,errors:u?.errors,message:u?.message}:{};return c.agent_id?aj({agent_id:c.agent_id,tool_name:a,status:u?.status||"complete",summary:`Ran ${a}`,meta:x}):ap({tool_name:a,status:u?.status||"complete",summary:`Main agent ran ${a}`,meta:x}),u}function ar(){return af().some(a=>a.enabled&&a.available&&["web_search","web_fetch"].includes(a.name))}av.length,d()}catch(a){d(a)}})},40924:(a,b,c)=>{"use strict";c.d(b,{O6:()=>f,Z2:()=>g,fb:()=>h});var d=c(77598);let e=new Map;function f(a){return(0,d.createHash)("sha1").update(JSON.stringify(a)).digest("hex")}function g(a){let b=e.get(a);return b?Date.now()>b.expires_at?(e.delete(a),null):(e.delete(a),e.set(a,b),b.value):null}function h(a,b){for(e.has(a)&&e.delete(a),e.set(a,{value:b,expires_at:Date.now()+9e5});e.size>200;){let a=e.keys().next().value;e.delete(a)}}},41249:(a,b,c)=>{"use strict";c.d(b,{Es:()=>h,K4:()=>g,Qw:()=>n,U5:()=>m,Zx:()=>f,v4:()=>l});var d=c(76760),e=c(80099);let f=Object.freeze(["strict","balanced","permissive"]),g="strict",h="MADARX_PRINTING_PRESS_SECURITY_MODE",i=new Set,j=null,k=0;function l(){k=0,j=null}function m(a){let b=a??function(){let a=Date.now();if(a-k<1500)return j;try{let a=process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR,b=a?d.resolve(a):process.env.MADARX_HOME?d.join(d.resolve(process.env.MADARX_HOME),"data"):d.resolve(process.cwd(),"data"),c=d.join(b,"madarx.sqlite"),f=new e.DatabaseSync(c,{readOnly:!0});try{let a=f.prepare("SELECT value FROM config WHERE key = ?").get("printing_press_security_mode_override");j=a?.value||null}finally{f.close()}}catch{j=null}return k=a,j}()??process.env[h];if(!b)return g;let c=String(b).trim().toLowerCase();return f.includes(c)?c:(i.has(c)||(i.add(c),console.warn(`[printing-press] Unknown ${h}="${b}" — defaulting to "${g}".`)),g)}function n(a){let b=f.includes(a)?a:g;return"strict"===b?Object.freeze({mode:"strict",force_approval:!0,allowlist_default_allow:!1,allow_network_write_clis:!1,allow_mcp_mount:!1,rate_limit_multiplier:1,production_safe:!0,warn_in_production:!1,allow_install_at_runtime:!0,banner:"red",banner_message:"Strict mode: every Printing Press action requires explicit approval."}):"balanced"===b?Object.freeze({mode:"balanced",force_approval:!1,allowlist_default_allow:!1,allow_network_write_clis:!0,allow_mcp_mount:!0,rate_limit_multiplier:2,production_safe:!0,warn_in_production:!0,allow_install_at_runtime:!0,banner:"amber",banner_message:"Balanced mode: trust-mode rules apply. Allowlist still default-deny."}):Object.freeze({mode:"permissive",force_approval:!1,allowlist_default_allow:!0,allow_network_write_clis:!0,allow_mcp_mount:!0,rate_limit_multiplier:5,production_safe:!1,warn_in_production:!0,allow_install_at_runtime:!0,banner:"grey",banner_message:"Permissive mode: only suitable for sandboxes. Not allowed in production."})}},41416:(a,b,c)=>{"use strict";c.d(b,{M2:()=>h});var d=c(73024),e=c(76760);let f={".shp":"shp",".shx":"shp",".dbf":"shp",".prj":"prj",".gdb":"gdb",".mxd":"mxd",".dxf":"dxf",".dwg":"dwg",".adf":"adf",".tif":"raster",".tiff":"raster",".img":"raster",".ecw":"raster"};function g(a){try{return d.readFileSync(a,"utf8").trim()||null}catch{return null}}function h(a){let b=e.extname(a).toLowerCase(),c=f[String(b||"").toLowerCase()]||"other_spatial",h=null;try{h=d.statSync(a).size}catch{}let i=null,j=null;if(".prj"===b)i=g(a);else if(".shp"===b){j=function(a){try{let b=d.openSync(a,"r");try{let a=Buffer.alloc(100);if(68>d.readSync(b,a,0,100,0))return null;let c=a.readDoubleLE(36),e=a.readDoubleLE(44),f=a.readDoubleLE(52),g=a.readDoubleLE(60);if(![c,e,f,g].every(Number.isFinite))return null;return{min_x:c,min_y:e,max_x:f,max_y:g}}finally{d.closeSync(b)}}catch{return null}}(a);let b=a.replace(/\.shp$/i,".prj");b!==a&&d.existsSync(b)&&(i=g(b))}return{kind:c,crs:i,bbox:j,file_size_bytes:h}}},43466:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{$:()=>k});var e=c(34255),f=c(19151),g=c(1423),h=c(4160),i=a([e,f,g,h]);[e,f,g,h]=i.then?(await i)():i;let l=Number(process.env.MINES_EXTRACT_CHAR_BUDGET)||9e4,m=Number(process.env.MINES_EXTRACT_MAX_CHUNKS)||120,n=["porphyry","deposit","mineraliz","mineralis","chalcocite","breccia","drill","sondaje","barren","trench","trinchera","channel","grade","ley","cu ","copper","cobre","au ","gold","oro","silver","plata","resource","recurso","reserve","reserva","tonn","tonelad","target","objetivo","qa/qc","qaqc","quality control","assay","ensaye","la caridad","cananea","la colorada","geophys","magnetic","gravity","recommend","recomend","work program","programa"],o=["property","asset_stage","deposit_type","mineralization","drilling_summary","trenching_summary","geophysics","qa_qc","data_verification","work_program","resource_estimate"],p={name:"emit_mining_facts",description:"Emit the structured facts extracted from the supplied document chunks. Call exactly once.",input_schema:{type:"object",properties:{facts:{type:"array",description:"One entry per distinct fact found in the chunks. Omit any fact not supported by the text.",items:{type:"object",properties:{fact_type:{type:"string",description:"Canonical key. Use one of: property, asset_stage, deposit_type, mineralization, drilling_summary, trenching_summary, geophysics, qa_qc, data_verification, work_program, resource_estimate. For each defined exploration target use target_<slug> (e.g. target_el_choclo_nw). For each comparable/analogue deposit use comparable_<slug> (e.g. comparable_la_caridad)."},value_text:{type:"string",description:"The fact stated concisely in English (preserve Spanish technical terms in parentheses on first use). Quote figures exactly as written."},source_chunk_id:{type:"string",description:"The exact [chunk_id] of the chunk this fact came from. Must be one of the provided ids."},source_quote:{type:"string",description:"A short verbatim span (10–200 chars) copied EXACTLY from that chunk that supports the fact. Must appear in the chunk text character-for-character."},confidence:{type:"number",description:"0..1 — how directly the chunk supports the fact. 0.9+ for explicit statements, lower for inferred."}},required:["fact_type","value_text","source_chunk_id","source_quote"]}}},required:["facts"]}};function j(a){return String(a||"").toLowerCase().replace(/\s+/g," ").replace(/[‘’]/g,"'").trim()}async function k(a,b={}){let c=a?.project_id;if(!c)return{status:"error",error:"project_id_required"};let d=(0,e.getDb)(),f=d.prepare("SELECT id, name, commodity, asset_stage FROM mines_projects WHERE id = ?").get(c);if(!f)return{status:"error",error:"project_not_found"};let i=function(a,b,c){if(c)return a.prepare("SELECT id, file_name, page_count FROM mines_source_documents WHERE id = ? AND project_id = ?").get(c,b);let d=a.prepare(`
+  `).run((0,f.newId)("audit"),(0,f.nowIso)(),`main_agent.tool.${b}`,c,b,JSON.stringify({tool_name:a,...d}))}async function ar(a,b={},c={}){let d=ag().find(b=>b.name===a);if(!d)throw Error(`Unknown tool: ${a}`);if(!d.enabled)throw Error(`Tool disabled: ${a}`);if(!d.available)throw Error(`Tool unavailable; missing environment: ${d.missing_env.join(", ")}`);let e=ay[a];e&&e(b);{let b=c?.acting_on_behalf_of_user_id||c?.user_id||null,d=new Set(["system","whatsapp-service"]);if(b&&!d.has(b)){let d="personal-org";try{let a=(0,f.getDb)(),b=c.agent_id?a.prepare("SELECT project_id FROM agents WHERE id = ?").get(c.agent_id):null;if(b?.project_id){let c=a.prepare("SELECT org_id FROM projects WHERE id = ?").get(b.project_id);c?.org_id&&(d=c.org_id)}}catch{}try{await (0,m.aS)({user_id:b,org_id:d},d)}catch(e){if(e&&(403===e.status||"membership_revoked"===e.error)){if(c?.heartbeat_task_id)try{(0,f.getDb)().prepare("UPDATE heartbeat_tasks SET status = 'approval_required', updated_at = ? WHERE id = ?").run((0,f.nowIso)(),c.heartbeat_task_id)}catch(a){console.error("[registry] Gate 0: failed to pause heartbeat task:",a.message)}try{(0,n.appendComplianceAudit)({user_id:b,org_id:d,action:"auth.membership.revoked_detected",status:"denied",summary:`Tool ${a} blocked — membership revoked for user ${b}`,action_target_type:"tool",action_target_id:a,meta:{tool_name:a,agent_id:c.agent_id||null,org_id:d}})}catch{}return{ok:!1,status:"approval_required",approval_request_id:null,reason:"membership_revoked"}}throw e}}}let h=!1,j=null;if(!c.agent_id&&an(d,b)){let c=`main_agent_tool_irreversible:${a}`,d=ap(a,b);if(!(0,g.v)(b.approval_id,{action_type:c,matches:a=>a?.input_signature===d})){let e=(0,g.D6)({action_type:c,risk:"irreversible_external",summary:`Allow the main agent to run irreversible external tool ${a}`,payload:{tool_name:a,input:ao(b),input_signature:d,...function(a,b={}){return"supabase_sql"===a?{warning:"This call uses the service-role key and BYPASSES Row-Level Security. Only approve if you have reviewed the exact SQL.",query:String(b.query||"")}:{}}(a,b)},requested_by:"main_agent"});return aq({tool_name:a,status:"irreversible_external_approval_required",summary:`Main agent irreversible-external approval required for ${a}`,meta:{approval_request_id:e.id}}),{ok:!1,status:"approval_required",approval_request_id:e.id,reason:`Tool ${a} is irreversible and always requires owner approval`}}h=!0,j=b.approval_id||null,aq({tool_name:a,status:"irreversible_external_approved",summary:`Main agent irreversible-external approval consumed for ${a}`})}if(!c.agent_id&&!h&&!c.owner_trusted&&function(a,b){if(a.approval_required)return!0;if("terminal_run"===a.name||"process_start"===a.name){let a=String(b?.command||"");if(!a)return!1;let c=Array.isArray(b?.args)?b.args.map(String):[];return(0,i.IB)(a,c).approval_required}return!1}(d,b)){let c=_();if("auto"===c)h=!0,aq({tool_name:a,status:"auto_approved",summary:`Main agent trust mode auto-approved ${a}`});else{let c=`main_agent_tool:${a}`,e=ap(a,b);if(!(0,g.v)(b.approval_id,{action_type:c,matches:a=>a?.input_signature===e})){let f=(0,g.D6)({action_type:c,risk:d.risk_level||"medium",summary:`Allow the main agent to run ${a}`,payload:{tool_name:a,input:ao(b),input_signature:e},requested_by:"main_agent"});return aq({tool_name:a,status:"approval_required",summary:`Main agent approval required for ${a}`,meta:{approval_request_id:f.id}}),{ok:!1,status:"approval_required",approval_request_id:f.id,reason:`Main agent tool ${a} requires owner approval`}}h=!0,j=b.approval_id||null,aq({tool_name:a,status:"approved",summary:`Main agent approval consumed for ${a}`})}}let o=function(a,b){var c;if(!a)return{ok:!0,mode:"legacy"};let d=(c=b.name,a&&c&&(0,f.getDb)().prepare("SELECT * FROM agent_tool_permissions WHERE agent_id = ? AND tool_name = ?").get(a,c)||null);if(!d)throw ak({agent_id:a,tool_name:b.name,status:"denied",summary:`Denied ${b.name}: missing agent permission`}),Error(`Agent ${a} is not permitted to use ${b.name}`);if("disabled"===d.mode)throw ak({agent_id:a,tool_name:b.name,status:"denied",summary:`Denied ${b.name}: permission disabled`}),Error(`Tool disabled for agent ${a}: ${b.name}`);return{ok:!0,mode:d.mode}}(c.agent_id,d),p=an(d,b)&&("browser_harness_run"===a||"skill_bridge_run"===a||!!d.source);if(c.agent_id&&p&&!(0,g.v)(b.approval_id,{action_type:`agent_tool_irreversible:${a}`})){let d=(0,g.D6)({action_type:`agent_tool_irreversible:${a}`,risk:"irreversible_external",summary:`Allow ${c.agent_id} to run irreversible external tool ${a}`,payload:{agent_id:c.agent_id,tool_name:a,input:ao(b)},requested_by:c.agent_id});return ak({agent_id:c.agent_id,tool_name:a,status:"irreversible_external_approval_required",summary:`Irreversible-external approval required for ${a}`,meta:{approval_request_id:d.id}}),{ok:!1,status:"approval_required",approval_request_id:d.id,reason:`Tool ${a} is irreversible and always requires owner approval`}}if(c.agent_id&&"approval_required"===o.mode&&!(0,g.v)(b.approval_id,{action_type:`agent_tool:${a}`})){let e=(0,g.D6)({action_type:`agent_tool:${a}`,risk:d.risk_level||"medium",summary:`Allow ${c.agent_id} to run ${a}`,payload:{agent_id:c.agent_id,tool_name:a,input:ao(b)},requested_by:c.agent_id});return ak({agent_id:c.agent_id,tool_name:a,status:"approval_required",summary:`Approval required for ${a}`,meta:{approval_request_id:e.id}}),{ok:!1,status:"approval_required",approval_request_id:e.id,reason:`Agent tool permission requires approval for ${a}`}}if(d.allowlist_required&&d.allowlist_scope_key){let e;if("recipient_domain"===d.allowlist_scope_key){let a=String(b?.to||""),c=a.lastIndexOf("@");e=c>=0?a.slice(c+1).toLowerCase():a.toLowerCase()}else e=String(b?.[d.allowlist_scope_key]??"");let f=!!d.allowlist_default_allow,g=(0,k.Bs)(a,{scope_key:d.allowlist_scope_key,scope_value:e},{default_allow:f});if(!g.ok){let b=c.agent_id?ak:aq,f=c.agent_id?{agent_id:c.agent_id,tool_name:a,status:"allowlist_violation",summary:`Allowlist violation for ${a}: ${d.allowlist_scope_key}=${e}`,meta:{scope_key:d.allowlist_scope_key,scope_value:e}}:{tool_name:a,status:"allowlist_violation",summary:`Allowlist violation for ${a}: ${d.allowlist_scope_key}=${e}`,meta:{scope_key:d.allowlist_scope_key,scope_value:e}};return b(f),{ok:!1,status:"allowlist_violation",missing_entry:g.missing_entry}}}let q=aw.find(b=>b.name===a),r=(0,l.ab)(a,c.agent_id,q);if(!r.ok){let b="rate_limited",d=`Rate limit exceeded for ${a}: ${r.current_count}/${r.max} in window`;return c.agent_id?ak({agent_id:c.agent_id,tool_name:a,status:b,summary:d,meta:{current_count:r.current_count,max:r.max,retry_after_seconds:r.retry_after_seconds}}):aq({tool_name:a,status:b,summary:d,meta:{current_count:r.current_count,max:r.max,retry_after_seconds:r.retry_after_seconds}}),{ok:!1,status:"rate_limited",retry_after_seconds:r.retry_after_seconds,current_count:r.current_count,max:r.max}}let s=ax[a],t=b;if(s||d.source?.kind!=="connector"?s||d.source?.kind!=="composite"||(s=ax.composite_tool_run,t={...b,__composite_slug:d.source.composite_slug}):(s=ax.http_api_call,t={...b,__connector_slug:d.source.connector_slug,__endpoint:d.source.endpoint}),!s)throw Error(`No adapter registered for tool: ${a}`);let u=await s(t,{owner_trusted:h||!!c.owner_trusted,agent_id:c.agent_id,project_id:c.project_id,org_id:c.org_id,actor_role:c.actor_role||c.role,engine:c.engine,acting_on_behalf_of_user_id:c.acting_on_behalf_of_user_id||c.user_id||null}),v=u?.status==="error"||u?.ok===!1,w=new Set(["spec_invalid","spec_required","slug_required","slug_in_use","version_bump_required","not_found","insufficient_role"]);v&&w.has(u?.error)&&j&&(0,g.t6)(j),v||(0,l.Cu)(a,c.agent_id,q);let x=v?{error:u?.error,errors:u?.errors,message:u?.message}:{};return c.agent_id?ak({agent_id:c.agent_id,tool_name:a,status:u?.status||"complete",summary:`Ran ${a}`,meta:x}):aq({tool_name:a,status:u?.status||"complete",summary:`Main agent ran ${a}`,meta:x}),u}function as(){return ag().some(a=>a.enabled&&a.available&&["web_search","web_fetch"].includes(a.name))}aw.length,d()}catch(a){d(a)}})},40924:(a,b,c)=>{"use strict";c.d(b,{O6:()=>f,Z2:()=>g,fb:()=>h});var d=c(77598);let e=new Map;function f(a){return(0,d.createHash)("sha1").update(JSON.stringify(a)).digest("hex")}function g(a){let b=e.get(a);return b?Date.now()>b.expires_at?(e.delete(a),null):(e.delete(a),e.set(a,b),b.value):null}function h(a,b){for(e.has(a)&&e.delete(a),e.set(a,{value:b,expires_at:Date.now()+9e5});e.size>200;){let a=e.keys().next().value;e.delete(a)}}},41249:(a,b,c)=>{"use strict";c.d(b,{Es:()=>h,K4:()=>g,Qw:()=>n,U5:()=>m,Zx:()=>f,v4:()=>l});var d=c(76760),e=c(80099);let f=Object.freeze(["strict","balanced","permissive"]),g="strict",h="MADARX_PRINTING_PRESS_SECURITY_MODE",i=new Set,j=null,k=0;function l(){k=0,j=null}function m(a){let b=a??function(){let a=Date.now();if(a-k<1500)return j;try{let a=process.env.MADARX_DATA_DIR||process.env.VILLA515_DATA_DIR,b=a?d.resolve(a):process.env.MADARX_HOME?d.join(d.resolve(process.env.MADARX_HOME),"data"):d.resolve(process.cwd(),"data"),c=d.join(b,"madarx.sqlite"),f=new e.DatabaseSync(c,{readOnly:!0});try{let a=f.prepare("SELECT value FROM config WHERE key = ?").get("printing_press_security_mode_override");j=a?.value||null}finally{f.close()}}catch{j=null}return k=a,j}()??process.env[h];if(!b)return g;let c=String(b).trim().toLowerCase();return f.includes(c)?c:(i.has(c)||(i.add(c),console.warn(`[printing-press] Unknown ${h}="${b}" — defaulting to "${g}".`)),g)}function n(a){let b=f.includes(a)?a:g;return"strict"===b?Object.freeze({mode:"strict",force_approval:!0,allowlist_default_allow:!1,allow_network_write_clis:!1,allow_mcp_mount:!1,rate_limit_multiplier:1,production_safe:!0,warn_in_production:!1,allow_install_at_runtime:!0,banner:"red",banner_message:"Strict mode: every Printing Press action requires explicit approval."}):"balanced"===b?Object.freeze({mode:"balanced",force_approval:!1,allowlist_default_allow:!1,allow_network_write_clis:!0,allow_mcp_mount:!0,rate_limit_multiplier:2,production_safe:!0,warn_in_production:!0,allow_install_at_runtime:!0,banner:"amber",banner_message:"Balanced mode: trust-mode rules apply. Allowlist still default-deny."}):Object.freeze({mode:"permissive",force_approval:!1,allowlist_default_allow:!0,allow_network_write_clis:!0,allow_mcp_mount:!0,rate_limit_multiplier:5,production_safe:!1,warn_in_production:!0,allow_install_at_runtime:!0,banner:"grey",banner_message:"Permissive mode: only suitable for sandboxes. Not allowed in production."})}},41416:(a,b,c)=>{"use strict";c.d(b,{M2:()=>h});var d=c(73024),e=c(76760);let f={".shp":"shp",".shx":"shp",".dbf":"shp",".prj":"prj",".gdb":"gdb",".mxd":"mxd",".dxf":"dxf",".dwg":"dwg",".adf":"adf",".tif":"raster",".tiff":"raster",".img":"raster",".ecw":"raster"};function g(a){try{return d.readFileSync(a,"utf8").trim()||null}catch{return null}}function h(a){let b=e.extname(a).toLowerCase(),c=f[String(b||"").toLowerCase()]||"other_spatial",h=null;try{h=d.statSync(a).size}catch{}let i=null,j=null;if(".prj"===b)i=g(a);else if(".shp"===b){j=function(a){try{let b=d.openSync(a,"r");try{let a=Buffer.alloc(100);if(68>d.readSync(b,a,0,100,0))return null;let c=a.readDoubleLE(36),e=a.readDoubleLE(44),f=a.readDoubleLE(52),g=a.readDoubleLE(60);if(![c,e,f,g].every(Number.isFinite))return null;return{min_x:c,min_y:e,max_x:f,max_y:g}}finally{d.closeSync(b)}}catch{return null}}(a);let b=a.replace(/\.shp$/i,".prj");b!==a&&d.existsSync(b)&&(i=g(b))}return{kind:c,crs:i,bbox:j,file_size_bytes:h}}},43466:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{$:()=>k});var e=c(34255),f=c(19151),g=c(1423),h=c(4160),i=a([e,f,g,h]);[e,f,g,h]=i.then?(await i)():i;let l=Number(process.env.MINES_EXTRACT_CHAR_BUDGET)||9e4,m=Number(process.env.MINES_EXTRACT_MAX_CHUNKS)||120,n=["porphyry","deposit","mineraliz","mineralis","chalcocite","breccia","drill","sondaje","barren","trench","trinchera","channel","grade","ley","cu ","copper","cobre","au ","gold","oro","silver","plata","resource","recurso","reserve","reserva","tonn","tonelad","target","objetivo","qa/qc","qaqc","quality control","assay","ensaye","la caridad","cananea","la colorada","geophys","magnetic","gravity","recommend","recomend","work program","programa"],o=["property","asset_stage","deposit_type","mineralization","drilling_summary","trenching_summary","geophysics","qa_qc","data_verification","work_program","resource_estimate"],p={name:"emit_mining_facts",description:"Emit the structured facts extracted from the supplied document chunks. Call exactly once.",input_schema:{type:"object",properties:{facts:{type:"array",description:"One entry per distinct fact found in the chunks. Omit any fact not supported by the text.",items:{type:"object",properties:{fact_type:{type:"string",description:"Canonical key. Use one of: property, asset_stage, deposit_type, mineralization, drilling_summary, trenching_summary, geophysics, qa_qc, data_verification, work_program, resource_estimate. For each defined exploration target use target_<slug> (e.g. target_el_choclo_nw). For each comparable/analogue deposit use comparable_<slug> (e.g. comparable_la_caridad)."},value_text:{type:"string",description:"The fact stated concisely in English (preserve Spanish technical terms in parentheses on first use). Quote figures exactly as written."},source_chunk_id:{type:"string",description:"The exact [chunk_id] of the chunk this fact came from. Must be one of the provided ids."},source_quote:{type:"string",description:"A short verbatim span (10–200 chars) copied EXACTLY from that chunk that supports the fact. Must appear in the chunk text character-for-character."},confidence:{type:"number",description:"0..1 — how directly the chunk supports the fact. 0.9+ for explicit statements, lower for inferred."}},required:["fact_type","value_text","source_chunk_id","source_quote"]}}},required:["facts"]}};function j(a){return String(a||"").toLowerCase().replace(/\s+/g," ").replace(/[‘’]/g,"'").trim()}async function k(a,b={}){let c=a?.project_id;if(!c)return{status:"error",error:"project_id_required"};let d=(0,e.getDb)(),f=d.prepare("SELECT id, name, commodity, asset_stage FROM mines_projects WHERE id = ?").get(c);if(!f)return{status:"error",error:"project_not_found"};let i=function(a,b,c){if(c)return a.prepare("SELECT id, file_name, page_count FROM mines_source_documents WHERE id = ? AND project_id = ?").get(c,b);let d=a.prepare(`
     SELECT d.id, d.file_name, d.page_count, COUNT(c.id) AS chunk_count
     FROM mines_source_documents d
     JOIN mines_document_chunks c ON c.source_document_id = d.id
@@ -2782,7 +2791,7 @@ FROM approval_requests;
 `},51218:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{U$:()=>m,zc:()=>n});var e=c(34255),f=c(45907),g=a([e,f]);function h(a){return a?.acting_on_behalf_of_user_id||a?.user_id||null}function i(a={}){if(a.owner_trusted||"owner"===a.actor_role||"admin"===a.actor_role)return!0;let b=h(a);if(!b||"system"===b)return!1;try{let c=(0,e.getDb)().prepare("SELECT role FROM org_memberships WHERE user_id=? AND org_id=COALESCE(?, 'personal-org')").get(b,a.org_id||"personal-org");return c?.role==="owner"||c?.role==="admin"}catch{return!1}}function j(){return{ok:!1,status:"error",error:"insufficient_role",message:"Connector authoring requires owner/admin authority in addition to tool approval."}}function k(a){return a?.code==="spec_invalid"?{ok:!1,status:"error",error:"spec_invalid",errors:a.errors||[a.message]}:null}function l({slug:a,title:b,secretRefs:c,toolSlugs:d}){if(c.length)try{let f=(0,e.getDb)(),g=`connection:${a}`,h={service_key:a,setup_kind:"api_key",benefit:`Unlocks the ${a} connector endpoints.`,credentials:c.map(b=>({name:b,label:b,type:"password",required:!0,help_text:`API credential for the ${a} connector. Stored encrypted in the secrets vault.`})),verify_endpoint:null,verify_supported:!1,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:d,engines:[],logo_glyph:a},i=JSON.stringify(["connection",a]),j=(0,e.nowIso)(),k=f.prepare("SELECT id FROM marketplace_items WHERE kind='connection' AND slug=?").get(a);k?f.prepare(`UPDATE marketplace_items
           SET title=?, description=?, manifest_json=?, tags=? WHERE id=?`).run(b||a,`Connect ${a}`,JSON.stringify(h),i,k.id):(f.prepare(`INSERT INTO marketplace_items
           (id, kind, slug, title, description, category, author, source_kind, source_url, version, manifest_json, risk_summary, tags, created_at)
-        VALUES (?, 'connection', ?, ?, ?, 'connector', 'tool-smith', 'authored', NULL, '1.0', ?, ?, ?, ?)`).run(g,a,b||a,`Connect ${a}`,JSON.stringify(h),"Provide an API credential — no code runs.",i,j),f.prepare("INSERT OR IGNORE INTO marketplace_installations (item_id, installed) VALUES (?, 0)").run(g))}catch{}}async function m(a,b={}){if(!i(b))return j();let c=a?.manifest;if(!c||"object"!=typeof c)return{ok:!1,status:"error",error:"spec_required",message:"manifest required (object)"};if(!c.slug||"string"!=typeof c.slug)return{ok:!1,error:"slug_required",message:"manifest.slug required (string)"};if((0,f.SJ)(c.slug))return{ok:!1,status:"error",error:"slug_in_use",slug:c.slug};try{let a=(0,f.vt)(c,{created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return l({slug:a.slug,title:c.title,secretRefs:a.secret_refs,toolSlugs:a.tool_slugs}),{ok:!0,status:"complete",slug:a.slug,endpoints:a.endpoints,tool_slugs:a.tool_slugs,secret_refs:a.secret_refs,setup_required:a.secret_refs.length>0,warnings:a.warnings||[]}}catch(b){let a=k(b);if(a)return a;throw b}}async function n(a,b={}){if(!i(b))return j();let c="string"==typeof a?.slug?a.slug.trim():"",d=a?.manifest;if(!c)return{ok:!1,status:"error",error:"slug_required",message:"slug required (string)"};if(!d||"object"!=typeof d)return{ok:!1,status:"error",error:"spec_required",message:"manifest required (object)"};if(!(0,f.SJ)(c))return{ok:!1,status:"error",error:"not_found",slug:c};let e={...d,slug:c};try{let a=(0,f.vt)(e,{created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return l({slug:a.slug,title:d.title,secretRefs:a.secret_refs,toolSlugs:a.tool_slugs}),{ok:!0,status:"complete",slug:a.slug,endpoints:a.endpoints,tool_slugs:a.tool_slugs,secret_refs:a.secret_refs,warnings:a.warnings||[]}}catch(b){let a=k(b);if(a)return a;throw b}}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},51542:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{h:()=>l,m:()=>m});var e=c(34255),f=c(9013),g=a([e,f]);function h(a){return a?.acting_on_behalf_of_user_id||a?.user_id||null}function i(a={}){if(a.owner_trusted||"owner"===a.actor_role||"admin"===a.actor_role)return!0;let b=h(a);if(!b||"system"===b)return!1;try{let c=(0,e.getDb)().prepare("SELECT role FROM org_memberships WHERE user_id=? AND org_id=COALESCE(?, 'personal-org')").get(b,a.org_id||"personal-org");return c?.role==="owner"||c?.role==="admin"}catch{return!1}}function j(){return{ok:!1,status:"error",error:"insufficient_role",message:"Workflow definition authoring requires owner/admin authority in addition to tool approval."}}function k(a){return a?.code==="spec_invalid"?{ok:!1,status:"error",error:"spec_invalid",errors:a.errors||[a.message]}:a?.code==="version_bump_required"?{ok:!1,status:"error",error:"version_bump_required",message:a.message}:null}async function l(a,b={}){if(!i(b))return j();let c=a?.spec;if(!c||"object"!=typeof c)return{ok:!1,status:"error",error:"spec_required",message:"spec required (object)"};if(!c.slug||"string"!=typeof c.slug)return{ok:!1,error:"slug_required",message:"spec.slug required (string)"};let d=(0,f.Ao)(c.slug);if(d&&"archived"!==d.status)return{ok:!1,status:"error",error:"slug_in_use",slug:c.slug};try{let a=(0,f.R1)(c,{source_spec_json:JSON.stringify(c),created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return{ok:!0,status:"complete",definition_id:a.id,slug:a.slug,version:a.version}}catch(b){let a=k(b);if(a)return a;throw b}}async function m(a,b={}){if(!i(b))return j();let c="string"==typeof a?.slug?a.slug.trim():"",d=a?.spec;if(!c)return{ok:!1,status:"error",error:"slug_required",message:"slug required (string)"};if(!d||"object"!=typeof d)return{ok:!1,status:"error",error:"spec_required",message:"spec required (object)"};if(!(0,f.Ao)(c))return{ok:!1,status:"error",error:"not_found",slug:c};let e={...d,slug:c};try{let a=(0,f.R1)(e,{source_spec_json:JSON.stringify(e),created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return{ok:!0,status:"complete",definition_id:a.id,slug:a.slug,version:a.version}}catch(b){let a=k(b);if(a)return a;throw b}}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},52993:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{b3:()=>n});var e=c(58282),f=c(40924),g=a([e]);e=(g.then?(await g)():g)[0];let o="H4cFwe",p={ECONOMY:1,PREMIUM_ECONOMY:2,BUSINESS:3,FIRST:4};function h(a,b,c,d){let e=Number(a);return Number.isFinite(e)?Math.min(Math.max(Math.trunc(e),c),d):b}function i(a,b){let c=String(a||"").trim().toUpperCase();if(!/^[A-Z]{3}$/.test(c))throw Error(`"${b}" must be a 3-letter IATA code (got: ${a??""})`);return c}function j(a,b){let c=String(a||"").trim();if(!/^\d{4}-\d{2}-\d{2}$/.test(c))throw Error(`"${b}" must be ISO date YYYY-MM-DD (got: ${a??""})`);return c}function k(a={}){let b=i(a.origin,"origin"),c=i(a.destination,"destination"),d=j(a.departure_date,"departure_date"),e=a.return_date?j(a.return_date,"return_date"):null,f=h(a.adults,1,1,9),g=h(a.children,0,0,8),l=a.travel_class?String(a.travel_class).toUpperCase():"ECONOMY",m=p[l]?l:"ECONOMY",n=!0===a.non_stop||"true"===a.non_stop;return{origin:b,destination:c,departure_date:d,return_date:e,adults:f,children:g,travel_class:m,non_stop:n}}function l(a){return Array.isArray(a)&&a.length>=2&&"number"==typeof a[0]&&"string"==typeof a[1]&&/^[A-Z]{3}$/.test(a[1])}function m(a){if(!Array.isArray(a))return!1;for(let b of a)if(l(b))return!0;return!1}async function n(a={},b={}){let c=k(a),d=h(a.max_results,5,1,25),g=a.currency?String(a.currency).toUpperCase().slice(0,3):"USD",i=(0,f.O6)({...c,currency:g}),j=(0,f.Z2)(i);if(j)return{...j,source:{...j.source,cache_hit:!0,fetched_at:j.source?.fetched_at||new Date().toISOString()}};if("1"!==process.env.MADARX_GOOGLE_FLIGHTS_FORCE_LIVE)throw Error("flight_search: free Google Flights fallback is offline as of 2026-05-17 (Google rotated the backend endpoint and payload schema, and slot-0 session tokens cannot be bootstrapped from raw HTTP). To restore flight_search, add AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET to the secrets vault — free tier covers 500 calls/month. See specs/active/google-flights-schema-repair.md and lib/tools/adapters/google-flights.js header for the full repair plan.");let q=function(a={}){let b=k(a),c=p[b.travel_class],d=+!!b.non_stop,e=b.children>0?Array(b.children).fill(11):[],f=[[b.origin],[b.destination],b.departure_date,b.return_date,[],b.adults,e,null,null,null,null,c,null,null,d];return JSON.stringify([null,JSON.stringify(f)])}(c),r=function(a){let b=new URLSearchParams;return b.set("f.req",JSON.stringify([[[o,a,null,"generic"]]])),b.toString()}(q),s=(0,e.N)("flight_search",b.agent_id??null),t=`https://www.google.com/_/TravelFrontendUi/data/batchexecute?rpcids=${o}&source-path=%2Ftravel%2Fflights%2Fsearch&rt=c`,u=await s(t,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded;charset=UTF-8","User-Agent":"Mozilla/5.0 (compatible; madarx-os/1.0; +https://madarx.io)",Accept:"*/*"},body:r});if(429===u.status)throw Error("flight_search: provider throttled by Google Flights, retry in a few minutes");if(!u.ok)throw Error(`Google Flights backend failed (HTTP ${u.status}). This usually means Google has rotated the batchexecute payload schema and the encoder in lib/tools/adapters/google-flights.js needs to be refreshed. Not a date-range or query problem. To unblock, add AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET to the secrets vault — flight_search will then use Amadeus instead of the free fallback.`);let v=await u.text(),w=function(a){if("string"!=typeof a)return{offers:[],warning:"response is not text"};let b=a.trim();b.startsWith(")]}'")&&(b=b.slice(4).trim());let c=function(a){let b=[],c=0;for(;c<a.length;){for(;c<a.length&&/\s/.test(a[c]);)c++;if(c<a.length&&/\d/.test(a[c])){for(;c<a.length&&/\d/.test(a[c]);)c++;continue}if("["===a[c]){let d=0,e=!1,f=!1,g=c;for(;c<a.length;c++){let h=a[c];if(e){if(f){f=!1;continue}if("\\"===h){f=!0;continue}'"'===h&&(e=!1);continue}if('"'===h){e=!0;continue}if("["===h)d++;else if("]"===h&&(d--,0===d)){c++;try{b.push(JSON.parse(a.slice(g,c)))}catch{}break}}continue}c++}return b}(b),d=null;for(let a of c)if(Array.isArray(a)){for(let b of a)if(Array.isArray(b)&&"wrb.fr"===b[0]&&b[1]===o&&"string"==typeof b[2]){try{d=JSON.parse(b[2])}catch{return{offers:[],warning:"inner RPC payload was not valid JSON"}}break}if(d)break}if(!d)return{offers:[],warning:"no RPC frame matched"};let e=[];return function a(b,c,d){if(!(c>10)&&Array.isArray(b)){if(function(a){if(!Array.isArray(a)||0===a.length)return!1;let b=a.filter(a=>Array.isArray(a));if(0===b.length)return!1;let c=0;for(let a of b)m(a)&&c++;return c>=1&&c===b.length}(b)){for(let a of b)Array.isArray(a)&&d.push(a);return}if(m(b))return void d.push(b);for(let e of b)a(e,c+1,d)}}(d,0,e),{offers:e,warning:e.length?null:"no offers parsed from response"}}(v),x=w.offers.slice(0,d).map((a,b)=>(function(a,b=0){let c,d=function a(b,c){if(c>4||!Array.isArray(b))return null;if(l(b))return{total:b[0],currency:b[1]};for(let d of b){let b=a(d,c+1);if(b)return b}return null}(a,0)||{total:null,currency:null},e=function(a){let b=[];return!function a(c,d){if(d>6||!Array.isArray(c))return;let e=[];for(let a of c)if(Array.isArray(a)){let b=function(a){let b=null,c=null,d=null,e=null,f=null,g=null,h=null;return(!function a(i,j){if(!(j>5)){if(Array.isArray(i)){for(let b of i)a(b,j+1);return}if("number"==typeof i){null==h&&i>30&&i<1500&&Number.isInteger(i)&&(h=i);return}"string"==typeof i&&(/^[A-Z]{3}$/.test(i)?b?c||i===b||(c=i):b=i:/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(i)?d?e||(e=i):d=i:/^[A-Z]{2,3}\s?\d{1,4}$/.test(i)&&!g?g=i:/^[A-Z]{2,3}$/.test(i)&&!f&&(f=i))}}(a,0),b&&c)?{carrier:f,flight_number:g,departure:{iata:b,at:d,terminal:null},arrival:{iata:c,at:e,terminal:null},duration_minutes:h,aircraft:null}:null}(a);b&&e.push(b)}if(e.length>0)return void b.push({segments:e,duration_minutes:e.reduce((a,b)=>a+(b.duration_minutes||0),0)||null});for(let b of c)a(b,d+1)}(a,0),b}(a);return{id:`gf-${b}`,price:{total:d.total,currency:d.currency,base:null},seats_available:null,last_ticketing_date:null,itineraries:e.length>0?e.map(a=>({duration:null!=a.duration_minutes?`PT${a.duration_minutes}M`:null,duration_minutes:a.duration_minutes,stops:Math.max(0,(a.segments||[]).length-1),segments:a.segments||[]})):[{duration:null,duration_minutes:null,stops:0,segments:[]}],validating_airlines:[],cabin:null,booking_link:(c=null,!function a(b,d){if(!c&&!(d>6)){if("string"==typeof b){/^https?:\/\/(www\.)?google\.com\/[^"\s]*flights/i.test(b)&&(c=b);return}if(Array.isArray(b))for(let c of b)a(c,d+1)}}(a,0),c)}})(a,b)),y={query:{origin:c.origin,destination:c.destination,departure_date:c.departure_date,return_date:c.return_date,adults:c.adults,children:c.children,currency:g,travel_class:c.travel_class,non_stop:c.non_stop,max_results:d},count:x.length,offers:x,source:{provider:"google_flights_web",fetched_at:new Date().toISOString(),...w.warning?{parse_warning:w.warning}:{}}};return x.length>0&&(0,f.fb)(i,y),y}d()}catch(a){d(a)}})},53962:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{N:()=>g,v:()=>h});var e=c(34255),f=a([e]);e=(f.then?(await f)():f)[0];let i="personal-org";function g(a,b=i){if(!a)return null;let c=b||i;return(0,e.getDb)().prepare(`
+        VALUES (?, 'connection', ?, ?, ?, 'connector', 'tool-smith', 'authored', NULL, '1.0', ?, ?, ?, ?)`).run(g,a,b||a,`Connect ${a}`,JSON.stringify(h),"Provide an API credential — no code runs.",i,j),f.prepare("INSERT OR IGNORE INTO marketplace_installations (item_id, installed) VALUES (?, 0)").run(g))}catch{}}async function m(a,b={}){if(!i(b))return j();let c=a?.manifest;if(!c||"object"!=typeof c)return{ok:!1,status:"error",error:"spec_required",message:"manifest required (object)"};if(!c.slug||"string"!=typeof c.slug)return{ok:!1,error:"slug_required",message:"manifest.slug required (string)"};if((0,f.SJ)(c.slug))return{ok:!1,status:"error",error:"slug_in_use",slug:c.slug};try{let a=(0,f.vt)(c,{created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return l({slug:a.slug,title:c.title,secretRefs:a.secret_refs,toolSlugs:a.tool_slugs}),{ok:!0,status:"complete",slug:a.slug,endpoints:a.endpoints,tool_slugs:a.tool_slugs,secret_refs:a.secret_refs,setup_required:a.secret_refs.length>0,warnings:a.warnings||[]}}catch(b){let a=k(b);if(a)return a;throw b}}async function n(a,b={}){if(!i(b))return j();let c="string"==typeof a?.slug?a.slug.trim():"",d=a?.manifest;if(!c)return{ok:!1,status:"error",error:"slug_required",message:"slug required (string)"};if(!d||"object"!=typeof d)return{ok:!1,status:"error",error:"spec_required",message:"manifest required (object)"};if(!(0,f.SJ)(c))return{ok:!1,status:"error",error:"not_found",slug:c};let e={...d,slug:c};try{let a=(0,f.vt)(e,{created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return l({slug:a.slug,title:d.title,secretRefs:a.secret_refs,toolSlugs:a.tool_slugs}),{ok:!0,status:"complete",slug:a.slug,endpoints:a.endpoints,tool_slugs:a.tool_slugs,secret_refs:a.secret_refs,warnings:a.warnings||[]}}catch(b){let a=k(b);if(a)return a;throw b}}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},51542:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{h:()=>l,m:()=>m});var e=c(34255),f=c(9013),g=a([e,f]);function h(a){return a?.acting_on_behalf_of_user_id||a?.user_id||null}function i(a={}){if(a.owner_trusted||"owner"===a.actor_role||"admin"===a.actor_role)return!0;let b=h(a);if(!b||"system"===b)return!1;try{let c=(0,e.getDb)().prepare("SELECT role FROM org_memberships WHERE user_id=? AND org_id=COALESCE(?, 'personal-org')").get(b,a.org_id||"personal-org");return c?.role==="owner"||c?.role==="admin"}catch{return!1}}function j(){return{ok:!1,status:"error",error:"insufficient_role",message:"Workflow definition authoring requires owner/admin authority in addition to tool approval."}}function k(a){return a?.code==="spec_invalid"?{ok:!1,status:"error",error:"spec_invalid",errors:a.errors||[a.message]}:a?.code==="version_bump_required"?{ok:!1,status:"error",error:"version_bump_required",message:a.message}:null}async function l(a,b={}){if(!i(b))return j();let c=a?.spec;if(!c||"object"!=typeof c)return{ok:!1,status:"error",error:"spec_required",message:"spec required (object)"};if(!c.slug||"string"!=typeof c.slug)return{ok:!1,error:"slug_required",message:"spec.slug required (string)"};let d=(0,f.Ao)(c.slug);if(d&&"archived"!==d.status)return{ok:!1,status:"error",error:"slug_in_use",slug:c.slug};try{let a=(0,f.R1)(c,{source_spec_json:JSON.stringify(c),created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return{ok:!0,status:"complete",definition_id:a.id,slug:a.slug,version:a.version}}catch(b){let a=k(b);if(a)return a;throw b}}async function m(a,b={}){if(!i(b))return j();let c="string"==typeof a?.slug?a.slug.trim():"",d=a?.spec;if(!c)return{ok:!1,status:"error",error:"slug_required",message:"slug required (string)"};if(!d||"object"!=typeof d)return{ok:!1,status:"error",error:"spec_required",message:"spec required (object)"};if(!(0,f.Ao)(c))return{ok:!1,status:"error",error:"not_found",slug:c};let e={...d,slug:c};try{let a=(0,f.R1)(e,{source_spec_json:JSON.stringify(e),created_by_user_id:h(b),created_by_agent_id:b?.agent_id||null});return{ok:!0,status:"complete",definition_id:a.id,slug:a.slug,version:a.version}}catch(b){let a=k(b);if(a)return a;throw b}}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},51867:(a,b,c)=>{"use strict";c.d(b,{Zf:()=>f,_e:()=>e,s_:()=>g});let d=new Set(["quiet","thinking","full"]);function e(){let a=String(process.env.MADARX_CC_STREAM_VERBOSITY||"thinking").trim().toLowerCase();return d.has(a)?a:"thinking"}function f(a=e()){return"thinking"===a||"full"===a}function g(a=e()){if(!f(a))return 0;let b=Number(process.env.MADARX_THINKING_BUDGET_TOKENS);return Number.isFinite(b)&&b>=0?Math.floor(b):4e3}},52993:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{b3:()=>n});var e=c(58282),f=c(40924),g=a([e]);e=(g.then?(await g)():g)[0];let o="H4cFwe",p={ECONOMY:1,PREMIUM_ECONOMY:2,BUSINESS:3,FIRST:4};function h(a,b,c,d){let e=Number(a);return Number.isFinite(e)?Math.min(Math.max(Math.trunc(e),c),d):b}function i(a,b){let c=String(a||"").trim().toUpperCase();if(!/^[A-Z]{3}$/.test(c))throw Error(`"${b}" must be a 3-letter IATA code (got: ${a??""})`);return c}function j(a,b){let c=String(a||"").trim();if(!/^\d{4}-\d{2}-\d{2}$/.test(c))throw Error(`"${b}" must be ISO date YYYY-MM-DD (got: ${a??""})`);return c}function k(a={}){let b=i(a.origin,"origin"),c=i(a.destination,"destination"),d=j(a.departure_date,"departure_date"),e=a.return_date?j(a.return_date,"return_date"):null,f=h(a.adults,1,1,9),g=h(a.children,0,0,8),l=a.travel_class?String(a.travel_class).toUpperCase():"ECONOMY",m=p[l]?l:"ECONOMY",n=!0===a.non_stop||"true"===a.non_stop;return{origin:b,destination:c,departure_date:d,return_date:e,adults:f,children:g,travel_class:m,non_stop:n}}function l(a){return Array.isArray(a)&&a.length>=2&&"number"==typeof a[0]&&"string"==typeof a[1]&&/^[A-Z]{3}$/.test(a[1])}function m(a){if(!Array.isArray(a))return!1;for(let b of a)if(l(b))return!0;return!1}async function n(a={},b={}){let c=k(a),d=h(a.max_results,5,1,25),g=a.currency?String(a.currency).toUpperCase().slice(0,3):"USD",i=(0,f.O6)({...c,currency:g}),j=(0,f.Z2)(i);if(j)return{...j,source:{...j.source,cache_hit:!0,fetched_at:j.source?.fetched_at||new Date().toISOString()}};if("1"!==process.env.MADARX_GOOGLE_FLIGHTS_FORCE_LIVE)throw Error("flight_search: free Google Flights fallback is offline as of 2026-05-17 (Google rotated the backend endpoint and payload schema, and slot-0 session tokens cannot be bootstrapped from raw HTTP). To restore flight_search, add AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET to the secrets vault — free tier covers 500 calls/month. See specs/active/google-flights-schema-repair.md and lib/tools/adapters/google-flights.js header for the full repair plan.");let q=function(a={}){let b=k(a),c=p[b.travel_class],d=+!!b.non_stop,e=b.children>0?Array(b.children).fill(11):[],f=[[b.origin],[b.destination],b.departure_date,b.return_date,[],b.adults,e,null,null,null,null,c,null,null,d];return JSON.stringify([null,JSON.stringify(f)])}(c),r=function(a){let b=new URLSearchParams;return b.set("f.req",JSON.stringify([[[o,a,null,"generic"]]])),b.toString()}(q),s=(0,e.N)("flight_search",b.agent_id??null),t=`https://www.google.com/_/TravelFrontendUi/data/batchexecute?rpcids=${o}&source-path=%2Ftravel%2Fflights%2Fsearch&rt=c`,u=await s(t,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded;charset=UTF-8","User-Agent":"Mozilla/5.0 (compatible; madarx-os/1.0; +https://madarx.io)",Accept:"*/*"},body:r});if(429===u.status)throw Error("flight_search: provider throttled by Google Flights, retry in a few minutes");if(!u.ok)throw Error(`Google Flights backend failed (HTTP ${u.status}). This usually means Google has rotated the batchexecute payload schema and the encoder in lib/tools/adapters/google-flights.js needs to be refreshed. Not a date-range or query problem. To unblock, add AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET to the secrets vault — flight_search will then use Amadeus instead of the free fallback.`);let v=await u.text(),w=function(a){if("string"!=typeof a)return{offers:[],warning:"response is not text"};let b=a.trim();b.startsWith(")]}'")&&(b=b.slice(4).trim());let c=function(a){let b=[],c=0;for(;c<a.length;){for(;c<a.length&&/\s/.test(a[c]);)c++;if(c<a.length&&/\d/.test(a[c])){for(;c<a.length&&/\d/.test(a[c]);)c++;continue}if("["===a[c]){let d=0,e=!1,f=!1,g=c;for(;c<a.length;c++){let h=a[c];if(e){if(f){f=!1;continue}if("\\"===h){f=!0;continue}'"'===h&&(e=!1);continue}if('"'===h){e=!0;continue}if("["===h)d++;else if("]"===h&&(d--,0===d)){c++;try{b.push(JSON.parse(a.slice(g,c)))}catch{}break}}continue}c++}return b}(b),d=null;for(let a of c)if(Array.isArray(a)){for(let b of a)if(Array.isArray(b)&&"wrb.fr"===b[0]&&b[1]===o&&"string"==typeof b[2]){try{d=JSON.parse(b[2])}catch{return{offers:[],warning:"inner RPC payload was not valid JSON"}}break}if(d)break}if(!d)return{offers:[],warning:"no RPC frame matched"};let e=[];return function a(b,c,d){if(!(c>10)&&Array.isArray(b)){if(function(a){if(!Array.isArray(a)||0===a.length)return!1;let b=a.filter(a=>Array.isArray(a));if(0===b.length)return!1;let c=0;for(let a of b)m(a)&&c++;return c>=1&&c===b.length}(b)){for(let a of b)Array.isArray(a)&&d.push(a);return}if(m(b))return void d.push(b);for(let e of b)a(e,c+1,d)}}(d,0,e),{offers:e,warning:e.length?null:"no offers parsed from response"}}(v),x=w.offers.slice(0,d).map((a,b)=>(function(a,b=0){let c,d=function a(b,c){if(c>4||!Array.isArray(b))return null;if(l(b))return{total:b[0],currency:b[1]};for(let d of b){let b=a(d,c+1);if(b)return b}return null}(a,0)||{total:null,currency:null},e=function(a){let b=[];return!function a(c,d){if(d>6||!Array.isArray(c))return;let e=[];for(let a of c)if(Array.isArray(a)){let b=function(a){let b=null,c=null,d=null,e=null,f=null,g=null,h=null;return(!function a(i,j){if(!(j>5)){if(Array.isArray(i)){for(let b of i)a(b,j+1);return}if("number"==typeof i){null==h&&i>30&&i<1500&&Number.isInteger(i)&&(h=i);return}"string"==typeof i&&(/^[A-Z]{3}$/.test(i)?b?c||i===b||(c=i):b=i:/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(i)?d?e||(e=i):d=i:/^[A-Z]{2,3}\s?\d{1,4}$/.test(i)&&!g?g=i:/^[A-Z]{2,3}$/.test(i)&&!f&&(f=i))}}(a,0),b&&c)?{carrier:f,flight_number:g,departure:{iata:b,at:d,terminal:null},arrival:{iata:c,at:e,terminal:null},duration_minutes:h,aircraft:null}:null}(a);b&&e.push(b)}if(e.length>0)return void b.push({segments:e,duration_minutes:e.reduce((a,b)=>a+(b.duration_minutes||0),0)||null});for(let b of c)a(b,d+1)}(a,0),b}(a);return{id:`gf-${b}`,price:{total:d.total,currency:d.currency,base:null},seats_available:null,last_ticketing_date:null,itineraries:e.length>0?e.map(a=>({duration:null!=a.duration_minutes?`PT${a.duration_minutes}M`:null,duration_minutes:a.duration_minutes,stops:Math.max(0,(a.segments||[]).length-1),segments:a.segments||[]})):[{duration:null,duration_minutes:null,stops:0,segments:[]}],validating_airlines:[],cabin:null,booking_link:(c=null,!function a(b,d){if(!c&&!(d>6)){if("string"==typeof b){/^https?:\/\/(www\.)?google\.com\/[^"\s]*flights/i.test(b)&&(c=b);return}if(Array.isArray(b))for(let c of b)a(c,d+1)}}(a,0),c)}})(a,b)),y={query:{origin:c.origin,destination:c.destination,departure_date:c.departure_date,return_date:c.return_date,adults:c.adults,children:c.children,currency:g,travel_class:c.travel_class,non_stop:c.non_stop,max_results:d},count:x.length,offers:x,source:{provider:"google_flights_web",fetched_at:new Date().toISOString(),...w.warning?{parse_warning:w.warning}:{}}};return x.length>0&&(0,f.fb)(i,y),y}d()}catch(a){d(a)}})},53962:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{N:()=>g,v:()=>h});var e=c(34255),f=a([e]);e=(f.then?(await f)():f)[0];let i="personal-org";function g(a,b=i){if(!a)return null;let c=b||i;return(0,e.getDb)().prepare(`
     SELECT mp.*, COALESCE(p.org_id, ?) AS effective_org_id
     FROM mines_projects mp
     LEFT JOIN projects p ON p.id = mp.os_project_id
@@ -3232,7 +3241,7 @@ ${e}`,triggered_by:b})}function am({project_id:a=null}={}){(0,i.Jh)();let b=(0,r
 
 Next action: choose a specialized agent, create a local run folder, keep human-in-loop approval before external actions.`,triggered_by:"orchestrator"}),`Received: ${b}`)}async function aw({once:a=!0}={}){let b=(0,h.getDb)(),c=(0,h.nowIso)(),d=Number(process.env.MADARX_BACKFILL_MAX_WINDOWS||10),e=b.prepare(`SELECT *, created_by_user_id FROM schedules
      WHERE enabled = 1 AND next_run_at IS NOT NULL AND next_run_at <= ?
-     ORDER BY next_run_at ASC`).all(c),f=[];for(let a of e)try{let e=a.created_by_user_id||null,g=a.catchup_policy||"fire_all",i=[],j=a.next_run_at;for(;j<=c&&i.length<d&&(i.push(j),j=(0,k.F)(a.schedule,j)););let l=0;if(j&&j<=c){let b=j;for(;b&&b<=c;)l++,b=(0,k.F)(a.schedule,b);j=b}let m="fire_once"===g?i.slice(-1):"skip"===g?[]:i;for(let c of m){let d=`hbtask-${a.id}-${String(c).replace(/[^a-zA-Z0-9]/g,"")}`,g=(0,n.aJ)({id:d,type:"agent_tick",agent_id:a.agent_id,schedule_id:a.id,max_attempts:Number(process.env.MADARX_AGENT_TICK_MAX_ATTEMPTS||1),payload:{type:a.action_kind||"agent-tick",agent_id:a.agent_id,schedule_id:a.id,prompt:`Run ${a.agent_name||a.agent_id} scheduled heartbeat`,tools_allowed:["web_search","file_read","create_artifact"]},run_after:c});if(e&&g?.id)try{b.prepare("UPDATE heartbeat_tasks SET acting_on_behalf_of_user_id = ? WHERE id = ?").run(e,g.id)}catch(a){console.warn("[cron] acting_on_behalf_of_user_id update failed:",a.message)}W({type:"cron.schedule.queued",summary:`Queued ${a.agent_name||a.agent_id} \xb7 ${a.action_kind}`,status:"queued",meta:{schedule_id:a.id,task_id:g?.id,window:c,acting_on_behalf_of_user_id:e}}),f.push(g)}let o=i.at(-1)||a.next_run_at;b.prepare("UPDATE schedules SET last_run_at=?, next_run_at=?, last_queued_at=?, last_queued_window=?, updated_at=? WHERE id=?").run(o,j,(0,h.nowIso)(),o,(0,h.nowIso)(),a.id),(i.length>1||l>0||"fire_all"!==g&&i.length>0)&&W({type:"cron.schedule.backfilled",summary:`Backfilled ${a.agent_name||a.agent_id}: fired ${m.length}/${i.length} missed windows`,status:"queued",meta:{schedule_id:a.id,missed_count:i.length,fired_count:m.length,truncated_count:l,policy:g,oldest:i[0]||null,newest:i.at(-1)||null}})}catch(b){f.push(X({kind:"cron-error",title:`Cron failed: ${a.id}`,status:"failed",agent:a.agent_name,agent_id:a.agent_id,preview:b.message,triggered_by:"cron"})),function(a,b=null){let c=(0,h.getDb)(),d=c.prepare("SELECT * FROM schedules WHERE id = ?").get(a);if(!d)return;let e=b||(0,h.nowIso)(),f=(0,k.F)(d.schedule,e),g=(0,h.nowIso)();c.prepare("UPDATE schedules SET last_run_at=?, next_run_at=?, updated_at=? WHERE id=?").run(e,f,g,a)}(a.id,a.next_run_at)}return{ok:!0,once:a,executed:f.filter(Boolean).length,tasks:f}}async function ax({lastTickAt:a=null,intervalMs:b=3e4}={}){let{recoverStaleHeartbeatTasks:d}=await Promise.resolve().then(c.bind(c,40563));if(null!==a&&Date.now()-a>2*b)try{await d()}catch(a){console.warn("[cron] stale recovery failed:",a?.message||a)}return aw({once:!0})}[h,j,l,m,n,o,p,q,r,s,u,v,w]=y.then?(await y)():y,d()}catch(a){d(a)}})},60897:(a,b,c)=>{"use strict";function d({slug:a,title:b,description:c,category:d="integration",provider:e,scopes:f,prefix:g,extraCredentials:h=[],unlocks:i,healthEndpoint:j,risk:k,tags:l}){let m=`${g}_ACCESS_TOKEN`;return{slug:a,title:b,description:c,category:d,author:"madarx",source_kind:"builtin",source_url:null,version:null,risk_summary:k,tags:l,manifest:{service_key:a,setup_kind:"oauth2",benefit:`Sign in with ${b} to unlock ${i.length} tool${1===i.length?"":"s"}. No code, no .env editing.`,credentials:[{name:`${g}_CLIENT_ID`,label:`${b} client ID`,type:"text",required:!0,help_text:`Create an app on the ${b} developer console and paste its client ID.`},{name:`${g}_CLIENT_SECRET`,label:`${b} client secret`,type:"password",required:!0,help_text:"Stored encrypted in the local vault — never echoed back."},...h],oauth:{provider:e,scopes:f,pkce:"google"===e||"tiktok"===e,redirect_path:`/api/connections/${a}/oauth/callback`,client_id_ref:`${g}_CLIENT_ID`,client_secret_ref:`${g}_CLIENT_SECRET`,access_token_ref:m,refresh_token_ref:`${g}_REFRESH_TOKEN`},health_check:{endpoint:j,method:"GET",expect_status:200,auth:{in:"header",name:"Authorization",prefix:"Bearer ",credential:m}},verify_endpoint:`/api/connections/${a}/verify`,verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:i,engines:[],logo_glyph:a}}}c.d(b,{R2:()=>q,fP:()=>o});let e=[{slug:"anthropic",title:"Anthropic",description:"Power any agent running on the Anthropic engine (Claude Opus, Sonnet, Haiku). Your key is encrypted on this Mac and never leaves the vault.",category:"engine",author:"madarx",source_kind:"builtin",source_url:"https://console.anthropic.com/settings/keys",version:null,risk_summary:"API key only — no destructive scope.",tags:["engine","anthropic","claude"],manifest:{service_key:"anthropic",setup_kind:"api_key",benefit:"Unlock the Anthropic engine for sub-agents and the main agent. Required for /api/orchestrator/command on default mode.",credentials:[{name:"ANTHROPIC_API_KEY",label:"API key",type:"password",placeholder:"sk-ant-…",help_url:"https://console.anthropic.com/settings/keys",help_text:"Generate a key in the Anthropic console.",required:!0}],verify_endpoint:"/api/connections/anthropic/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:[],engines:["anthropic"],logo_glyph:"anthropic"}},{slug:"openai",title:"OpenAI",description:"Use OpenAI models for agents that prefer GPT. Stored encrypted; never echoed back.",category:"engine",author:"madarx",source_kind:"builtin",source_url:"https://platform.openai.com/api-keys",version:null,risk_summary:"API key only.",tags:["engine","openai","gpt"],manifest:{service_key:"openai",setup_kind:"api_key",benefit:"Unlock OpenAI models for agents and transcription.",credentials:[{name:"OPENAI_API_KEY",label:"API key",type:"password",placeholder:"sk-…",help_url:"https://platform.openai.com/api-keys",help_text:"Create a key in the OpenAI dashboard.",required:!0}],verify_endpoint:"/api/connections/openai/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:[],engines:["openai"],logo_glyph:"openai"}},{slug:"kimi",title:"Kimi (Moonshot)",description:"Connect Moonshot AI — Kimi models for long-context Chinese + English reasoning. Stored encrypted.",category:"engine",author:"madarx",source_kind:"builtin",source_url:"https://platform.moonshot.ai/console/api-keys",version:null,risk_summary:"API key only.",tags:["engine","kimi","moonshot"],manifest:{service_key:"kimi",setup_kind:"api_key",benefit:"Unlock Kimi (Moonshot) models for the kimi engine.",credentials:[{name:"KIMI_API_KEY",label:"API key",type:"password",placeholder:"sk-…",help_url:"https://platform.moonshot.ai/console/api-keys",help_text:"Create a key in the Moonshot console.",required:!0}],verify_endpoint:"/api/connections/kimi/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:[],engines:["kimi"],logo_glyph:"kimi"}},{slug:"github",title:"GitHub",description:"Unlock 11 GitHub tools: read repos, list PRs, create issues, dispatch workflows, and (with approval) merge PRs. Token is encrypted at rest.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://github.com/settings/tokens",version:null,risk_summary:"Some GitHub tools are irreversible (e.g. gh_pr_merge) and always require approval.",tags:["integration","github","git"],manifest:{service_key:"github",setup_kind:"api_key",benefit:"Unlock 11 GitHub tools across read, issue, and PR workflows.",credentials:[{name:"GITHUB_TOKEN",label:"Personal access token",type:"password",placeholder:"ghp_…",help_url:"https://github.com/settings/tokens",help_text:"Use a fine-grained token. Grant only the scopes you need.",required:!0}],verify_endpoint:"/api/connections/github/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["gh_repo_read","gh_repo_list","gh_issue_list","gh_issue_create","gh_issue_comment","gh_pr_list","gh_pr_create","gh_pr_comment","gh_pr_merge","gh_actions_dispatch","gh_release_create"],engines:[],logo_glyph:"github"}},{slug:"resend",title:"Resend",description:"Send transactional email. A default recipient_domain allowlist is seeded from git config user.email — add more in the marketplace afterwards.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://resend.com/api-keys",version:null,risk_summary:"email_send is irreversible and always requires approval.",tags:["integration","email","resend"],manifest:{service_key:"resend",setup_kind:"api_key",benefit:"Unlock email_send and email_status_lookup for transactional email.",credentials:[{name:"RESEND_API_KEY",label:"API key",type:"password",placeholder:"re_…",help_url:"https://resend.com/api-keys",help_text:"Create a Resend API key.",required:!0},{name:"RESEND_FROM_EMAIL",label:"From email",type:"text",placeholder:"agent@yourdomain.com",help_url:"https://resend.com/domains",help_text:"A verified sender address on a verified Resend domain.",required:!0}],verify_endpoint:"/api/connections/resend/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["email_send","email_status_lookup"],engines:[],logo_glyph:"resend"}},{slug:"supabase",title:"Supabase",description:"Connect a Supabase project. Service role key bypasses RLS — destructive ops (supabase_rest_delete, supabase_sql) are always approval-gated.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://supabase.com/dashboard",version:null,risk_summary:"Service role key bypasses Row-Level Security. Some tools (supabase_sql) always require approval.",tags:["integration","database","supabase"],manifest:{service_key:"supabase",setup_kind:"api_key",benefit:"Unlock 7 Supabase tools: REST select/insert/upsert/update/delete, RPC, and SQL.",credentials:[{name:"SUPABASE_URL",label:"Project URL",type:"text",placeholder:"https://xxxx.supabase.co",help_url:"https://supabase.com/dashboard",help_text:"Project Settings → API → Project URL.",required:!0},{name:"SUPABASE_SERVICE_ROLE_KEY",label:"Service role key",type:"password",placeholder:"eyJ…",help_url:"https://supabase.com/dashboard",help_text:"Project Settings → API → service_role. Treat as a database password.",required:!1},{name:"SUPABASE_ANON_KEY",label:"Anon key",type:"password",placeholder:"eyJ…",help_url:"https://supabase.com/dashboard",help_text:"Project Settings → API → anon. Used for verify when service-role is absent.",required:!1},{name:"SUPABASE_ACCESS_TOKEN",label:"Personal access token",type:"password",placeholder:"sbp_…",help_url:"https://supabase.com/dashboard/account/tokens",help_text:"Required only if you want the agent to list / manage your Supabase projects via the Management API. Distinct from the project keys above.",required:!1}],verify_endpoint:"/api/connections/supabase/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["supabase_list_projects","supabase_rest_select","supabase_rest_insert","supabase_rest_upsert","supabase_rest_update","supabase_rest_delete","supabase_rpc","supabase_sql"],engines:[],logo_glyph:"supabase"}},{slug:"vercel",title:"Vercel",description:"Trigger deployments and read project state. v1 saves the token without a live verify — failures surface on first call.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://vercel.com/account/tokens",version:null,risk_summary:"vercel_create_deployment is high risk and approval-gated.",tags:["integration","vercel","deploy"],manifest:{service_key:"vercel",setup_kind:"api_key",benefit:"Unlock 3 Vercel tools: list projects, list deployments, create deployment.",credentials:[{name:"VERCEL_TOKEN",label:"Access token",type:"password",placeholder:"vercel_…",help_url:"https://vercel.com/account/tokens",help_text:"Create a token scoped to the right team.",required:!0},{name:"VERCEL_TEAM_ID",label:"Team ID (optional)",type:"text",placeholder:"team_…",help_url:"https://vercel.com/teams",help_text:"Only required for team-scoped tokens.",required:!1}],verify_endpoint:"/api/connections/vercel/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["vercel_list_projects","vercel_list_deployments","vercel_create_deployment"],engines:[],logo_glyph:"vercel"}},{slug:"whatsapp",title:"WhatsApp",description:"Text the main agent like you text Hermes. Pairs a dedicated WhatsApp number via Baileys. Operations (allowlist, message log) live at /whatsapp.",category:"channel",author:"madarx",source_kind:"builtin",source_url:null,version:null,risk_summary:"Pair only a dedicated number — Baileys is an unofficial Web client; the paired account can be banned.",tags:["channel","whatsapp","messaging"],manifest:{service_key:"whatsapp",setup_kind:"qr_pair",benefit:"Receive WhatsApp messages and let the main agent reply through your number.",credentials:[],verify_endpoint:"/api/connections/whatsapp/verify",verify_supported:!0,deep_link:"/whatsapp",requires_daemon:"npm run whatsapp:bridge",supports_scopes:["global"],unlocks_tool_slugs:["whatsapp_send"],engines:[],logo_glyph:"whatsapp"}},{slug:"hermes",title:"Hermes Agent",description:"Route long-running orchestrator jobs to the local Hermes binary. Detection probes ../hermes-agent and scripts/hermes-command.py.",category:"engine",author:"madarx",source_kind:"builtin",source_url:null,version:null,risk_summary:"Local subprocess execution — Hermes jobs inherit your local env.",tags:["engine","hermes","local"],manifest:{service_key:"hermes",setup_kind:"binary_detect",benefit:"Unlock the Hermes engine and the start_hermes_job orchestrator tool.",credentials:[{name:"HERMES_AGENT_DIR",label:"Hermes agent directory (optional)",type:"text",placeholder:"/Users/you/Projects/hermes-agent",help_url:null,help_text:"Defaults to ../hermes-agent relative to this repo. Override to point at a different checkout.",required:!1}],verify_endpoint:"/api/connections/hermes/verify",verify_supported:!0,deep_link:null,supports_scopes:["global"],unlocks_tool_slugs:["start_hermes_job","send_to_hermes"],engines:["hermes"],logo_glyph:"hermes"}},d({slug:"meta-ads",title:"Meta Ads",description:"Build and report on Facebook + Instagram ad campaigns. Campaign/budget writes are always approval-gated.",category:"marketing",provider:"meta",prefix:"META",scopes:["ads_management","ads_read","business_management"],unlocks:["meta_ads.insights_read","meta_ads.campaign_create","meta_ads.adset_create","meta_ads.budget_set"],healthEndpoint:"https://graph.facebook.com/v19.0/me",risk:"Campaign create, budget set, and audience create are irreversible and always require approval.",tags:["marketing","ads","meta","oauth"]}),d({slug:"google-ads",title:"Google Ads",description:"Manage Google Ads campaigns and pull GAQL reports. Requires a developer token in addition to OAuth sign-in.",category:"marketing",provider:"google",prefix:"GOOGLE_ADS",scopes:["https://www.googleapis.com/auth/adwords"],extraCredentials:[{name:"GOOGLE_ADS_DEVELOPER_TOKEN",label:"Developer token",type:"password",required:!0,help_text:"Google Ads API access requires a developer token alongside OAuth."}],unlocks:["google_ads.report","google_ads.campaign_create","google_ads.budget_set"],healthEndpoint:"https://googleads.googleapis.com/v17/customers:listAccessibleCustomers",risk:"Campaign create and budget set are irreversible and always require approval.",tags:["marketing","ads","google","oauth"]}),d({slug:"ga4",title:"Google Analytics 4",description:"Read GA4 metrics for marketing reports. Read-only — no external writes.",category:"analytics",provider:"google",prefix:"GA4",scopes:["https://www.googleapis.com/auth/analytics.readonly"],unlocks:["ga4.run_report","ga4.realtime_report"],healthEndpoint:"https://analyticsdata.googleapis.com/v1beta/properties",risk:"Read-only analytics access.",tags:["analytics","ga4","google","oauth"]}),d({slug:"hubspot-crm",title:"HubSpot CRM",description:"Read and (with approval) write contacts, deals, and activity in HubSpot.",category:"sales",provider:"hubspot",prefix:"HUBSPOT",scopes:["crm.objects.contacts.read","crm.objects.deals.read","crm.objects.contacts.write"],unlocks:["hubspot.contacts_read","hubspot.deals_read","hubspot.contact_upsert"],healthEndpoint:"https://api.hubapi.com/crm/v3/objects/contacts",risk:"CRM writes (contact/deal upsert) require approval.",tags:["sales","crm","hubspot","oauth"]})];e.map(a=>a.slug);let f=[{slug:"web-prototype",title:"Open Design — Web Prototype",description:"Generate a complete production-quality web prototype from a brief."},{slug:"saas-landing",title:"Open Design — SaaS Landing",description:"Build a SaaS landing page with hero, features, social proof, pricing."},{slug:"dashboard",title:"Open Design — Dashboard",description:"Information-dense, hierarchy-driven dashboard scaffold."},{slug:"mobile-app",title:"Open Design — Mobile App",description:"Mobile-first product UI scaffold with touch targets and gestures."},{slug:"social-carousel",title:"Open Design — Social Carousel",description:"Editorial social carousel with platform-aware aspect ratios."},{slug:"magazine-poster",title:"Open Design — Magazine Poster",description:"Editorial magazine/poster typography with high contrast."},{slug:"deck-guizang-editorial",title:"Open Design — Editorial Deck",description:"Guizang editorial-style slide deck system."},{slug:"email-marketing",title:"Open Design — Email Marketing",description:"Transactional/marketing email scaffold with bulletproof HTML."},{slug:"design-brief",title:"Open Design — Design Brief",description:"Structured design brief used to seed the rest of the pipeline."},{slug:"design-review",title:"Open Design — Design Review",description:"Designer's eye plan review and visual QA pass."},{slug:"brand-guidelines",title:"Open Design — Brand Guidelines",description:"Distill or author a brand guidelines book."},{slug:"copywriting",title:"Open Design — Copywriting",description:"High-signal product copywriting craft notes and structure."}],g={slug:"open-design",title:"Open Design (nexu-io)",description:"Vendored design corpus from nexu-io/open-design: craft notes, 130+ skills, ~140 design systems, prompt + design templates. Apache-2.0.",category:"design",author:"nexu-io",source_kind:"github",source_url:"https://github.com/nexu-io/open-design",version:null,risk_summary:"Read-only design content. No code executes; no external writes.",tags:["design","craft","systems","templates","open-source","apache-2.0"],manifest:{item_refs:f.map(a=>`skill:open-design-${a.slug}`),published_count:f.length,license:"Apache-2.0",note:"Vendored under workspace/skills/open-design/. Re-vendor with `npm run vendor:open-design`. See NOTICE.md for attribution."}},h=[{slug:"design-shotgun",title:"Design Shotgun",description:"Generate multiple AI design variants for any UI surface, open a comparison board, and iterate from approved options.",category:"design",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Read-only ideation — no external writes.",tags:["design","mockups","exploration"],manifest:{invocation:"/design-shotgun",file_paths:["skills/design-shotgun/SKILL.md"],trigger_examples:["explore designs","show me design variants","visual brainstorm"]}},{slug:"design-review",title:"Design Review",description:"Visual QA pass on live pages: extracts the design system in use, audits hierarchy, typography, color, and spacing, and proposes fixes.",category:"design",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Read-only audit — fixes are proposed, not applied.",tags:["design","review","visual-qa"],manifest:{invocation:"/design-review",file_paths:["skills/design-review/SKILL.md"],trigger_examples:["review the design","visual QA","audit this page"]}},{slug:"qa-only",title:"QA Only",description:"Systematically QA a web app and produce a structured report with health score, screenshots, and repro steps. Never modifies code.",category:"review",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Report-only — no auto-fix.",tags:["qa","testing","report"],manifest:{invocation:"/qa-only",file_paths:["skills/qa-only/SKILL.md"],trigger_examples:["just report bugs","qa report only","test but do not fix"]}},{slug:"cso-audit",title:"CSO Audit",description:"Chief Security Officer mode: infrastructure-first security audit covering secrets archaeology, supply chain, OWASP Top 10, and threat modeling.",category:"security",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Read-only audit; never executes destructive commands.",tags:["security","audit","owasp","threat-model"],manifest:{invocation:"/cso",file_paths:["skills/cso/SKILL.md"],trigger_examples:["security audit","threat model","OWASP review"]}}],i=[{slug:"market-research",title:"Market Research",category:"research",description:"Research any market, company, or topic across the web and deliver a cited, structured brief.",tools:["web_search","web_fetch","file_write"],risk_summary:"Read-only research; writes only the report file.",tags:["research","web","brief"],invocation:"/research",trigger_examples:["research this market","competitive landscape for X","brief me on company Y"]},{slug:"competitor-watch",title:"Competitor Watch",category:"research",description:"Track competitor pricing, features, and news on a schedule and alert you when something changes.",tools:["web_fetch","web_extract","email_send"],risk_summary:"Read-only monitoring; sends a summary email.",tags:["research","monitoring","competitive"],invocation:"/watch",trigger_examples:["watch competitor pricing","alert me when X changes","track this page weekly"]},{slug:"inbox-triage",title:"Inbox Triage",category:"comms",description:"Summarize, prioritize, and draft replies across your inbox so you act on what matters first.",tools:["gmail_messages_list","gmail_thread_read","email_send"],risk_summary:"Drafts replies; sending is approval-gated.",tags:["email","inbox","comms"],invocation:"/inbox",trigger_examples:["triage my inbox","summarize unread email","draft replies"]},{slug:"meeting-scheduler",title:"Meeting Scheduler",category:"comms",description:"Find times, schedule meetings, and send invites from your calendar and email.",tools:["calendar_events_list","calendar_event_read","email_send"],risk_summary:"Proposes times; invites are approval-gated.",tags:["calendar","scheduling","comms"],invocation:"/schedule-meeting",trigger_examples:["schedule a meeting","find a time with X","book a call next week"]},{slug:"document-extract",title:"Document Extraction",category:"documents",description:"Pull structured data and key facts from PDFs, documents, and audio into clean, usable output.",tools:["file_read","transcribe_audio","file_write"],risk_summary:"Read-only extraction; writes only the output file.",tags:["documents","extraction","pdf"],invocation:"/extract",trigger_examples:["extract data from this PDF","pull the numbers from these docs","transcribe this audio"]},{slug:"report-builder",title:"Report Builder",category:"documents",description:"Turn raw data and notes into a polished, formatted report or one-pager ready to share.",tools:["file_read","file_write"],risk_summary:"Generates a document; no external writes.",tags:["documents","reporting","writing"],invocation:"/report",trigger_examples:["build a report from this data","write a one-pager","summarize into a deck outline"]},{slug:"database-query",title:"Database Q&A",category:"data",description:"Ask questions of your database in plain English and get answers, tables, and charts.",tools:["supabase_rest_select","supabase_sql"],risk_summary:"Read-only queries by default; writes are approval-gated.",tags:["data","sql","analytics"],invocation:"/ask-data",trigger_examples:["how many orders last month","query the users table","top customers by revenue"]},{slug:"spreadsheet-analysis",title:"Spreadsheet Analysis",category:"data",description:"Clean, analyze, and summarize spreadsheets and CSVs — pivots, trends, and outliers.",tools:["file_read","file_write"],risk_summary:"Local file analysis; no external writes.",tags:["data","spreadsheet","csv"],invocation:"/analyze-sheet",trigger_examples:["analyze this spreadsheet","summarize this CSV","find trends in this data"]},{slug:"web-automation",title:"Web Automation",category:"web",description:"Fill forms, extract data, and run repetitive flows in a real browser, end to end.",tools:["browser_open","browser_act","browser_extract"],risk_summary:"Browser actions are bounded and audited.",tags:["web","automation","browser"],invocation:"/automate-web",trigger_examples:["automate this form","scrape this site","run this flow for each row"]}],j=[{slug:"paid-campaign-build",title:"Paid Campaign Build",category:"marketing",description:"Structure a paid campaign — objective, audiences, ad sets, creative spec, and budget — ready for approval-gated launch.",tools:["create_artifact","web_search"],risk_summary:"Plans campaigns; every publish/budget set stays approval-gated.",tags:["marketing","ads","campaign"],invocation:"/paid-campaign",trigger_examples:["build a Meta campaign","plan a paid launch","structure ad sets"]},{slug:"ads-reporting",title:"Ads Reporting",category:"marketing",description:"Pull spend, CPA, ROAS, and reach from connected ad accounts into one weekly performance report.",tools:["create_artifact","file_write"],risk_summary:"Read-only reporting; no external writes.",tags:["marketing","ads","reporting"],invocation:"/ads-report",trigger_examples:["weekly ads report","how did campaigns perform","ROAS summary"]},{slug:"content-calendar",title:"Content Calendar",category:"content",description:"Plan a multi-channel content calendar with post drafts, captions, and a scheduled queue.",tools:["create_artifact","file_write"],risk_summary:"Drafts and schedules; every publish stays approval-gated.",tags:["content","social","calendar"],invocation:"/content-calendar",trigger_examples:["plan this month of content","build a content calendar","draft social posts"]},{slug:"lead-research",title:"Lead Research",category:"sales",description:"Build a qualified target list, enrich it, and prep a personalized outreach sequence.",tools:["web_search","web_fetch","create_artifact"],risk_summary:"Research + drafts; sequence enrollment and bulk sends are approval-gated.",tags:["sales","outreach","leads"],invocation:"/lead-research",trigger_examples:["build a target list","find leads for X","prep an outreach sequence"]},{slug:"ticket-reply",title:"Ticket Reply",category:"support",description:"Triage support tickets, draft replies in brand voice, and flag escalations.",tools:["gmail_messages_list","file_write"],risk_summary:"Drafts replies; outbound sends/status changes are approval-gated.",tags:["support","helpdesk","tickets"],invocation:"/ticket-reply",trigger_examples:["triage support tickets","draft ticket replies","escalate this ticket"]},{slug:"runway-model",title:"Runway Model",category:"finance",description:"Turn revenue/expense data into a runway model and P&L summary with scenario sensitivity.",tools:["file_read","create_artifact"],risk_summary:"Advisory analysis; any money movement is approval-gated.",tags:["finance","runway","modeling"],invocation:"/runway",trigger_examples:["model our runway","P&L summary","how many months of cash"]}],k=[{slug:"gstack",title:"gstack",description:'"Senior engineering team in your terminal." 8 power tools + a stack of specialist skills for design, QA, review, security, and shipping. MIT licensed.',category:"engineering",author:"garrytan",source_kind:"builtin",source_url:"https://github.com/garrytan/gstack",version:null,risk_summary:"Mixed-risk bundle: includes read-only review skills and write-capable workflows (e.g. /ship runs git push). Per-item risk surfaces in Phase 2 when install is wired up.",tags:["engineering","skills-pack","mit"],manifest:{item_refs:["skill:design-shotgun","skill:design-review","skill:qa-only","skill:cso-audit"],published_count:4,license:"MIT",note:"Agent personas in this bundle will surface in the Agent Marketplace when it ships."}}];function l(a,b,c){let d=a.prepare("SELECT id FROM marketplace_items WHERE kind=? AND slug=?").get(b,c.slug),e=d?.id||`${b}:${c.slug}`,f=c.manifest?JSON.stringify(c.manifest):null,g=c.tags?JSON.stringify(c.tags):null;if(d)a.prepare(`
+     ORDER BY next_run_at ASC`).all(c),f=[];for(let a of e)try{let e=a.created_by_user_id||null,g=a.catchup_policy||"fire_all",i=[],j=a.next_run_at;for(;j<=c&&i.length<d&&(i.push(j),j=(0,k.F)(a.schedule,j)););let l=0;if(j&&j<=c){let b=j;for(;b&&b<=c;)l++,b=(0,k.F)(a.schedule,b);j=b}let m="fire_once"===g?i.slice(-1):"skip"===g?[]:i;for(let c of m){let d=`hbtask-${a.id}-${String(c).replace(/[^a-zA-Z0-9]/g,"")}`,g=(0,n.aJ)({id:d,type:"agent_tick",agent_id:a.agent_id,schedule_id:a.id,max_attempts:Number(process.env.MADARX_AGENT_TICK_MAX_ATTEMPTS||1),payload:{type:a.action_kind||"agent-tick",agent_id:a.agent_id,schedule_id:a.id,prompt:`Run ${a.agent_name||a.agent_id} scheduled heartbeat`,tools_allowed:["web_search","file_read","create_artifact"]},run_after:c});if(e&&g?.id)try{b.prepare("UPDATE heartbeat_tasks SET acting_on_behalf_of_user_id = ? WHERE id = ?").run(e,g.id)}catch(a){console.warn("[cron] acting_on_behalf_of_user_id update failed:",a.message)}W({type:"cron.schedule.queued",summary:`Queued ${a.agent_name||a.agent_id} \xb7 ${a.action_kind}`,status:"queued",meta:{schedule_id:a.id,task_id:g?.id,window:c,acting_on_behalf_of_user_id:e}}),f.push(g)}let o=i.at(-1)||a.next_run_at;b.prepare("UPDATE schedules SET last_run_at=?, next_run_at=?, last_queued_at=?, last_queued_window=?, updated_at=? WHERE id=?").run(o,j,(0,h.nowIso)(),o,(0,h.nowIso)(),a.id),(i.length>1||l>0||"fire_all"!==g&&i.length>0)&&W({type:"cron.schedule.backfilled",summary:`Backfilled ${a.agent_name||a.agent_id}: fired ${m.length}/${i.length} missed windows`,status:"queued",meta:{schedule_id:a.id,missed_count:i.length,fired_count:m.length,truncated_count:l,policy:g,oldest:i[0]||null,newest:i.at(-1)||null}})}catch(b){f.push(X({kind:"cron-error",title:`Cron failed: ${a.id}`,status:"failed",agent:a.agent_name,agent_id:a.agent_id,preview:b.message,triggered_by:"cron"})),function(a,b=null){let c=(0,h.getDb)(),d=c.prepare("SELECT * FROM schedules WHERE id = ?").get(a);if(!d)return;let e=b||(0,h.nowIso)(),f=(0,k.F)(d.schedule,e),g=(0,h.nowIso)();c.prepare("UPDATE schedules SET last_run_at=?, next_run_at=?, updated_at=? WHERE id=?").run(e,f,g,a)}(a.id,a.next_run_at)}return{ok:!0,once:a,executed:f.filter(Boolean).length,tasks:f}}async function ax({lastTickAt:a=null,intervalMs:b=3e4}={}){let{recoverStaleHeartbeatTasks:d}=await Promise.resolve().then(c.bind(c,40563));if(null!==a&&Date.now()-a>2*b)try{await d()}catch(a){console.warn("[cron] stale recovery failed:",a?.message||a)}return aw({once:!0})}[h,j,l,m,n,o,p,q,r,s,u,v,w]=y.then?(await y)():y,d()}catch(a){d(a)}})},60897:(a,b,c)=>{"use strict";function d({slug:a,title:b,description:c,category:d="integration",provider:e,scopes:f,prefix:g,extraCredentials:h=[],unlocks:i,healthEndpoint:j,risk:k,tags:l}){let m=`${g}_ACCESS_TOKEN`;return{slug:a,title:b,description:c,category:d,author:"madarx",source_kind:"builtin",source_url:null,version:null,risk_summary:k,tags:l,manifest:{service_key:a,setup_kind:"oauth2",benefit:`Sign in with ${b} to unlock ${i.length} tool${1===i.length?"":"s"}. No code, no .env editing.`,credentials:[{name:`${g}_CLIENT_ID`,label:`${b} client ID`,type:"text",required:!0,help_text:`Create an app on the ${b} developer console and paste its client ID.`},{name:`${g}_CLIENT_SECRET`,label:`${b} client secret`,type:"password",required:!0,help_text:"Stored encrypted in the local vault — never echoed back."},...h],oauth:{provider:e,scopes:f,pkce:"google"===e||"tiktok"===e,redirect_path:`/api/connections/${a}/oauth/callback`,client_id_ref:`${g}_CLIENT_ID`,client_secret_ref:`${g}_CLIENT_SECRET`,access_token_ref:m,refresh_token_ref:`${g}_REFRESH_TOKEN`},health_check:{endpoint:j,method:"GET",expect_status:200,auth:{in:"header",name:"Authorization",prefix:"Bearer ",credential:m}},verify_endpoint:`/api/connections/${a}/verify`,verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:i,engines:[],logo_glyph:a}}}c.d(b,{R2:()=>q,fP:()=>o});let e=[{slug:"anthropic",title:"Anthropic",description:"Power any agent running on the Anthropic engine (Claude Opus, Sonnet, Haiku). Your key is encrypted on this Mac and never leaves the vault.",category:"engine",author:"madarx",source_kind:"builtin",source_url:"https://console.anthropic.com/settings/keys",version:null,risk_summary:"API key only — no destructive scope.",tags:["engine","anthropic","claude"],manifest:{service_key:"anthropic",setup_kind:"api_key",benefit:"Unlock the Anthropic engine for sub-agents and the main agent. Required for /api/orchestrator/command on default mode.",credentials:[{name:"ANTHROPIC_API_KEY",label:"API key",type:"password",placeholder:"sk-ant-…",help_url:"https://console.anthropic.com/settings/keys",help_text:"Generate a key in the Anthropic console.",required:!0}],verify_endpoint:"/api/connections/anthropic/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:[],engines:["anthropic"],logo_glyph:"anthropic"}},{slug:"openai",title:"OpenAI",description:"Use OpenAI models for agents that prefer GPT. Stored encrypted; never echoed back.",category:"engine",author:"madarx",source_kind:"builtin",source_url:"https://platform.openai.com/api-keys",version:null,risk_summary:"API key only.",tags:["engine","openai","gpt"],manifest:{service_key:"openai",setup_kind:"api_key",benefit:"Unlock OpenAI models for agents and transcription.",credentials:[{name:"OPENAI_API_KEY",label:"API key",type:"password",placeholder:"sk-…",help_url:"https://platform.openai.com/api-keys",help_text:"Create a key in the OpenAI dashboard.",required:!0}],verify_endpoint:"/api/connections/openai/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:[],engines:["openai"],logo_glyph:"openai"}},{slug:"kimi",title:"Kimi (Moonshot)",description:"Connect Moonshot AI — Kimi models for long-context Chinese + English reasoning. Stored encrypted.",category:"engine",author:"madarx",source_kind:"builtin",source_url:"https://platform.moonshot.ai/console/api-keys",version:null,risk_summary:"API key only.",tags:["engine","kimi","moonshot"],manifest:{service_key:"kimi",setup_kind:"api_key",benefit:"Unlock Kimi (Moonshot) models for the kimi engine.",credentials:[{name:"KIMI_API_KEY",label:"API key",type:"password",placeholder:"sk-…",help_url:"https://platform.moonshot.ai/console/api-keys",help_text:"Create a key in the Moonshot console.",required:!0}],verify_endpoint:"/api/connections/kimi/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:[],engines:["kimi"],logo_glyph:"kimi"}},{slug:"github",title:"GitHub",description:"Unlock 11 GitHub tools: read repos, list PRs, create issues, dispatch workflows, and (with approval) merge PRs. Token is encrypted at rest.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://github.com/settings/tokens",version:null,risk_summary:"Some GitHub tools are irreversible (e.g. gh_pr_merge) and always require approval.",tags:["integration","github","git"],manifest:{service_key:"github",setup_kind:"api_key",benefit:"Unlock 11 GitHub tools across read, issue, and PR workflows.",credentials:[{name:"GITHUB_TOKEN",label:"Personal access token",type:"password",placeholder:"ghp_…",help_url:"https://github.com/settings/tokens",help_text:'To read repos beyond your own, the token must be granted access to them. Fine-grained PAT: under "Repository access" pick the orgs/repos (org owner may need to approve); classic PAT: enable the "repo" scope and, for SSO orgs, click "Authorize" / "Configure SSO" next to the token.',required:!0}],verify_endpoint:"/api/connections/github/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["gh_repo_read","gh_repo_list","gh_issue_list","gh_issue_create","gh_issue_comment","gh_pr_list","gh_pr_create","gh_pr_comment","gh_pr_merge","gh_actions_dispatch","gh_release_create"],engines:[],logo_glyph:"github"}},{slug:"resend",title:"Resend",description:"Send transactional email. A default recipient_domain allowlist is seeded from git config user.email — add more in the marketplace afterwards.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://resend.com/api-keys",version:null,risk_summary:"email_send is irreversible and always requires approval.",tags:["integration","email","resend"],manifest:{service_key:"resend",setup_kind:"api_key",benefit:"Unlock email_send and email_status_lookup for transactional email.",credentials:[{name:"RESEND_API_KEY",label:"API key",type:"password",placeholder:"re_…",help_url:"https://resend.com/api-keys",help_text:"Create a Resend API key.",required:!0},{name:"RESEND_FROM_EMAIL",label:"From email",type:"text",placeholder:"agent@yourdomain.com",help_url:"https://resend.com/domains",help_text:"A verified sender address on a verified Resend domain.",required:!0}],verify_endpoint:"/api/connections/resend/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["email_send","email_status_lookup"],engines:[],logo_glyph:"resend"}},{slug:"supabase",title:"Supabase",description:"Connect a Supabase project. Service role key bypasses RLS — destructive ops (supabase_rest_delete, supabase_sql) are always approval-gated.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://supabase.com/dashboard",version:null,risk_summary:"Service role key bypasses Row-Level Security. Some tools (supabase_sql) always require approval.",tags:["integration","database","supabase"],manifest:{service_key:"supabase",setup_kind:"api_key",benefit:"Unlock 7 Supabase tools: REST select/insert/upsert/update/delete, RPC, and SQL.",credentials:[{name:"SUPABASE_URL",label:"Project URL",type:"text",placeholder:"https://xxxx.supabase.co",help_url:"https://supabase.com/dashboard",help_text:"Project Settings → API → Project URL.",required:!0},{name:"SUPABASE_SERVICE_ROLE_KEY",label:"Service role key",type:"password",placeholder:"eyJ…",help_url:"https://supabase.com/dashboard",help_text:"Project Settings → API → service_role. Treat as a database password.",required:!1},{name:"SUPABASE_ANON_KEY",label:"Anon key",type:"password",placeholder:"eyJ…",help_url:"https://supabase.com/dashboard",help_text:"Project Settings → API → anon. Used for verify when service-role is absent.",required:!1},{name:"SUPABASE_ACCESS_TOKEN",label:"Personal access token",type:"password",placeholder:"sbp_…",help_url:"https://supabase.com/dashboard/account/tokens",help_text:"Required only if you want the agent to list / manage your Supabase projects via the Management API. Distinct from the project keys above.",required:!1}],verify_endpoint:"/api/connections/supabase/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["supabase_list_projects","supabase_rest_select","supabase_rest_insert","supabase_rest_upsert","supabase_rest_update","supabase_rest_delete","supabase_rpc","supabase_sql"],engines:[],logo_glyph:"supabase"}},{slug:"vercel",title:"Vercel",description:"Trigger deployments and read project state. v1 saves the token without a live verify — failures surface on first call.",category:"integration",author:"madarx",source_kind:"builtin",source_url:"https://vercel.com/account/tokens",version:null,risk_summary:"vercel_create_deployment is high risk and approval-gated.",tags:["integration","vercel","deploy"],manifest:{service_key:"vercel",setup_kind:"api_key",benefit:"Unlock 3 Vercel tools: list projects, list deployments, create deployment.",credentials:[{name:"VERCEL_TOKEN",label:"Access token",type:"password",placeholder:"vercel_…",help_url:"https://vercel.com/account/tokens",help_text:"Create a token scoped to the right team.",required:!0},{name:"VERCEL_TEAM_ID",label:"Team ID (optional)",type:"text",placeholder:"team_…",help_url:"https://vercel.com/teams",help_text:"Only required for team-scoped tokens.",required:!1}],verify_endpoint:"/api/connections/vercel/verify",verify_supported:!0,deep_link:null,supports_scopes:["global","project","agent"],unlocks_tool_slugs:["vercel_list_projects","vercel_list_deployments","vercel_create_deployment"],engines:[],logo_glyph:"vercel"}},{slug:"whatsapp",title:"WhatsApp",description:"Text the main agent like you text Hermes. Pairs a dedicated WhatsApp number via Baileys. Operations (allowlist, message log) live at /whatsapp.",category:"channel",author:"madarx",source_kind:"builtin",source_url:null,version:null,risk_summary:"Pair only a dedicated number — Baileys is an unofficial Web client; the paired account can be banned.",tags:["channel","whatsapp","messaging"],manifest:{service_key:"whatsapp",setup_kind:"qr_pair",benefit:"Receive WhatsApp messages and let the main agent reply through your number.",credentials:[],verify_endpoint:"/api/connections/whatsapp/verify",verify_supported:!0,deep_link:"/whatsapp",requires_daemon:"npm run whatsapp:bridge",supports_scopes:["global"],unlocks_tool_slugs:["whatsapp_send"],engines:[],logo_glyph:"whatsapp"}},{slug:"hermes",title:"Hermes Agent",description:"Route long-running orchestrator jobs to the local Hermes binary. Detection probes ../hermes-agent and scripts/hermes-command.py.",category:"engine",author:"madarx",source_kind:"builtin",source_url:null,version:null,risk_summary:"Local subprocess execution — Hermes jobs inherit your local env.",tags:["engine","hermes","local"],manifest:{service_key:"hermes",setup_kind:"binary_detect",benefit:"Unlock the Hermes engine and the start_hermes_job orchestrator tool.",credentials:[{name:"HERMES_AGENT_DIR",label:"Hermes agent directory (optional)",type:"text",placeholder:"/Users/you/Projects/hermes-agent",help_url:null,help_text:"Defaults to ../hermes-agent relative to this repo. Override to point at a different checkout.",required:!1}],verify_endpoint:"/api/connections/hermes/verify",verify_supported:!0,deep_link:null,supports_scopes:["global"],unlocks_tool_slugs:["start_hermes_job","send_to_hermes"],engines:["hermes"],logo_glyph:"hermes"}},d({slug:"meta-ads",title:"Meta Ads",description:"Build and report on Facebook + Instagram ad campaigns. Campaign/budget writes are always approval-gated.",category:"marketing",provider:"meta",prefix:"META",scopes:["ads_management","ads_read","business_management"],unlocks:["meta_ads.insights_read","meta_ads.campaign_create","meta_ads.adset_create","meta_ads.budget_set"],healthEndpoint:"https://graph.facebook.com/v19.0/me",risk:"Campaign create, budget set, and audience create are irreversible and always require approval.",tags:["marketing","ads","meta","oauth"]}),d({slug:"google-ads",title:"Google Ads",description:"Manage Google Ads campaigns and pull GAQL reports. Requires a developer token in addition to OAuth sign-in.",category:"marketing",provider:"google",prefix:"GOOGLE_ADS",scopes:["https://www.googleapis.com/auth/adwords"],extraCredentials:[{name:"GOOGLE_ADS_DEVELOPER_TOKEN",label:"Developer token",type:"password",required:!0,help_text:"Google Ads API access requires a developer token alongside OAuth."}],unlocks:["google_ads.report","google_ads.campaign_create","google_ads.budget_set"],healthEndpoint:"https://googleads.googleapis.com/v17/customers:listAccessibleCustomers",risk:"Campaign create and budget set are irreversible and always require approval.",tags:["marketing","ads","google","oauth"]}),d({slug:"ga4",title:"Google Analytics 4",description:"Read GA4 metrics for marketing reports. Read-only — no external writes.",category:"analytics",provider:"google",prefix:"GA4",scopes:["https://www.googleapis.com/auth/analytics.readonly"],unlocks:["ga4.run_report","ga4.realtime_report"],healthEndpoint:"https://analyticsdata.googleapis.com/v1beta/properties",risk:"Read-only analytics access.",tags:["analytics","ga4","google","oauth"]}),d({slug:"hubspot-crm",title:"HubSpot CRM",description:"Read and (with approval) write contacts, deals, and activity in HubSpot.",category:"sales",provider:"hubspot",prefix:"HUBSPOT",scopes:["crm.objects.contacts.read","crm.objects.deals.read","crm.objects.contacts.write"],unlocks:["hubspot.contacts_read","hubspot.deals_read","hubspot.contact_upsert"],healthEndpoint:"https://api.hubapi.com/crm/v3/objects/contacts",risk:"CRM writes (contact/deal upsert) require approval.",tags:["sales","crm","hubspot","oauth"]})];e.map(a=>a.slug);let f=[{slug:"web-prototype",title:"Open Design — Web Prototype",description:"Generate a complete production-quality web prototype from a brief."},{slug:"saas-landing",title:"Open Design — SaaS Landing",description:"Build a SaaS landing page with hero, features, social proof, pricing."},{slug:"dashboard",title:"Open Design — Dashboard",description:"Information-dense, hierarchy-driven dashboard scaffold."},{slug:"mobile-app",title:"Open Design — Mobile App",description:"Mobile-first product UI scaffold with touch targets and gestures."},{slug:"social-carousel",title:"Open Design — Social Carousel",description:"Editorial social carousel with platform-aware aspect ratios."},{slug:"magazine-poster",title:"Open Design — Magazine Poster",description:"Editorial magazine/poster typography with high contrast."},{slug:"deck-guizang-editorial",title:"Open Design — Editorial Deck",description:"Guizang editorial-style slide deck system."},{slug:"email-marketing",title:"Open Design — Email Marketing",description:"Transactional/marketing email scaffold with bulletproof HTML."},{slug:"design-brief",title:"Open Design — Design Brief",description:"Structured design brief used to seed the rest of the pipeline."},{slug:"design-review",title:"Open Design — Design Review",description:"Designer's eye plan review and visual QA pass."},{slug:"brand-guidelines",title:"Open Design — Brand Guidelines",description:"Distill or author a brand guidelines book."},{slug:"copywriting",title:"Open Design — Copywriting",description:"High-signal product copywriting craft notes and structure."}],g={slug:"open-design",title:"Open Design (nexu-io)",description:"Vendored design corpus from nexu-io/open-design: craft notes, 130+ skills, ~140 design systems, prompt + design templates. Apache-2.0.",category:"design",author:"nexu-io",source_kind:"github",source_url:"https://github.com/nexu-io/open-design",version:null,risk_summary:"Read-only design content. No code executes; no external writes.",tags:["design","craft","systems","templates","open-source","apache-2.0"],manifest:{item_refs:f.map(a=>`skill:open-design-${a.slug}`),published_count:f.length,license:"Apache-2.0",note:"Vendored under workspace/skills/open-design/. Re-vendor with `npm run vendor:open-design`. See NOTICE.md for attribution."}},h=[{slug:"design-shotgun",title:"Design Shotgun",description:"Generate multiple AI design variants for any UI surface, open a comparison board, and iterate from approved options.",category:"design",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Read-only ideation — no external writes.",tags:["design","mockups","exploration"],manifest:{invocation:"/design-shotgun",file_paths:["skills/design-shotgun/SKILL.md"],trigger_examples:["explore designs","show me design variants","visual brainstorm"]}},{slug:"design-review",title:"Design Review",description:"Visual QA pass on live pages: extracts the design system in use, audits hierarchy, typography, color, and spacing, and proposes fixes.",category:"design",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Read-only audit — fixes are proposed, not applied.",tags:["design","review","visual-qa"],manifest:{invocation:"/design-review",file_paths:["skills/design-review/SKILL.md"],trigger_examples:["review the design","visual QA","audit this page"]}},{slug:"qa-only",title:"QA Only",description:"Systematically QA a web app and produce a structured report with health score, screenshots, and repro steps. Never modifies code.",category:"review",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Report-only — no auto-fix.",tags:["qa","testing","report"],manifest:{invocation:"/qa-only",file_paths:["skills/qa-only/SKILL.md"],trigger_examples:["just report bugs","qa report only","test but do not fix"]}},{slug:"cso-audit",title:"CSO Audit",description:"Chief Security Officer mode: infrastructure-first security audit covering secrets archaeology, supply chain, OWASP Top 10, and threat modeling.",category:"security",author:"gstack",source_kind:"builtin",source_url:null,version:null,risk_summary:"Read-only audit; never executes destructive commands.",tags:["security","audit","owasp","threat-model"],manifest:{invocation:"/cso",file_paths:["skills/cso/SKILL.md"],trigger_examples:["security audit","threat model","OWASP review"]}}],i=[{slug:"market-research",title:"Market Research",category:"research",description:"Research any market, company, or topic across the web and deliver a cited, structured brief.",tools:["web_search","web_fetch","file_write"],risk_summary:"Read-only research; writes only the report file.",tags:["research","web","brief"],invocation:"/research",trigger_examples:["research this market","competitive landscape for X","brief me on company Y"]},{slug:"competitor-watch",title:"Competitor Watch",category:"research",description:"Track competitor pricing, features, and news on a schedule and alert you when something changes.",tools:["web_fetch","web_extract","email_send"],risk_summary:"Read-only monitoring; sends a summary email.",tags:["research","monitoring","competitive"],invocation:"/watch",trigger_examples:["watch competitor pricing","alert me when X changes","track this page weekly"]},{slug:"inbox-triage",title:"Inbox Triage",category:"comms",description:"Summarize, prioritize, and draft replies across your inbox so you act on what matters first.",tools:["gmail_messages_list","gmail_thread_read","email_send"],risk_summary:"Drafts replies; sending is approval-gated.",tags:["email","inbox","comms"],invocation:"/inbox",trigger_examples:["triage my inbox","summarize unread email","draft replies"]},{slug:"meeting-scheduler",title:"Meeting Scheduler",category:"comms",description:"Find times, schedule meetings, and send invites from your calendar and email.",tools:["calendar_events_list","calendar_event_read","email_send"],risk_summary:"Proposes times; invites are approval-gated.",tags:["calendar","scheduling","comms"],invocation:"/schedule-meeting",trigger_examples:["schedule a meeting","find a time with X","book a call next week"]},{slug:"document-extract",title:"Document Extraction",category:"documents",description:"Pull structured data and key facts from PDFs, documents, and audio into clean, usable output.",tools:["file_read","transcribe_audio","file_write"],risk_summary:"Read-only extraction; writes only the output file.",tags:["documents","extraction","pdf"],invocation:"/extract",trigger_examples:["extract data from this PDF","pull the numbers from these docs","transcribe this audio"]},{slug:"report-builder",title:"Report Builder",category:"documents",description:"Turn raw data and notes into a polished, formatted report or one-pager ready to share.",tools:["file_read","file_write"],risk_summary:"Generates a document; no external writes.",tags:["documents","reporting","writing"],invocation:"/report",trigger_examples:["build a report from this data","write a one-pager","summarize into a deck outline"]},{slug:"database-query",title:"Database Q&A",category:"data",description:"Ask questions of your database in plain English and get answers, tables, and charts.",tools:["supabase_rest_select","supabase_sql"],risk_summary:"Read-only queries by default; writes are approval-gated.",tags:["data","sql","analytics"],invocation:"/ask-data",trigger_examples:["how many orders last month","query the users table","top customers by revenue"]},{slug:"spreadsheet-analysis",title:"Spreadsheet Analysis",category:"data",description:"Clean, analyze, and summarize spreadsheets and CSVs — pivots, trends, and outliers.",tools:["file_read","file_write"],risk_summary:"Local file analysis; no external writes.",tags:["data","spreadsheet","csv"],invocation:"/analyze-sheet",trigger_examples:["analyze this spreadsheet","summarize this CSV","find trends in this data"]},{slug:"web-automation",title:"Web Automation",category:"web",description:"Fill forms, extract data, and run repetitive flows in a real browser, end to end.",tools:["browser_open","browser_act","browser_extract"],risk_summary:"Browser actions are bounded and audited.",tags:["web","automation","browser"],invocation:"/automate-web",trigger_examples:["automate this form","scrape this site","run this flow for each row"]}],j=[{slug:"paid-campaign-build",title:"Paid Campaign Build",category:"marketing",description:"Structure a paid campaign — objective, audiences, ad sets, creative spec, and budget — ready for approval-gated launch.",tools:["create_artifact","web_search"],risk_summary:"Plans campaigns; every publish/budget set stays approval-gated.",tags:["marketing","ads","campaign"],invocation:"/paid-campaign",trigger_examples:["build a Meta campaign","plan a paid launch","structure ad sets"]},{slug:"ads-reporting",title:"Ads Reporting",category:"marketing",description:"Pull spend, CPA, ROAS, and reach from connected ad accounts into one weekly performance report.",tools:["create_artifact","file_write"],risk_summary:"Read-only reporting; no external writes.",tags:["marketing","ads","reporting"],invocation:"/ads-report",trigger_examples:["weekly ads report","how did campaigns perform","ROAS summary"]},{slug:"content-calendar",title:"Content Calendar",category:"content",description:"Plan a multi-channel content calendar with post drafts, captions, and a scheduled queue.",tools:["create_artifact","file_write"],risk_summary:"Drafts and schedules; every publish stays approval-gated.",tags:["content","social","calendar"],invocation:"/content-calendar",trigger_examples:["plan this month of content","build a content calendar","draft social posts"]},{slug:"lead-research",title:"Lead Research",category:"sales",description:"Build a qualified target list, enrich it, and prep a personalized outreach sequence.",tools:["web_search","web_fetch","create_artifact"],risk_summary:"Research + drafts; sequence enrollment and bulk sends are approval-gated.",tags:["sales","outreach","leads"],invocation:"/lead-research",trigger_examples:["build a target list","find leads for X","prep an outreach sequence"]},{slug:"ticket-reply",title:"Ticket Reply",category:"support",description:"Triage support tickets, draft replies in brand voice, and flag escalations.",tools:["gmail_messages_list","file_write"],risk_summary:"Drafts replies; outbound sends/status changes are approval-gated.",tags:["support","helpdesk","tickets"],invocation:"/ticket-reply",trigger_examples:["triage support tickets","draft ticket replies","escalate this ticket"]},{slug:"runway-model",title:"Runway Model",category:"finance",description:"Turn revenue/expense data into a runway model and P&L summary with scenario sensitivity.",tools:["file_read","create_artifact"],risk_summary:"Advisory analysis; any money movement is approval-gated.",tags:["finance","runway","modeling"],invocation:"/runway",trigger_examples:["model our runway","P&L summary","how many months of cash"]}],k=[{slug:"gstack",title:"gstack",description:'"Senior engineering team in your terminal." 8 power tools + a stack of specialist skills for design, QA, review, security, and shipping. MIT licensed.',category:"engineering",author:"garrytan",source_kind:"builtin",source_url:"https://github.com/garrytan/gstack",version:null,risk_summary:"Mixed-risk bundle: includes read-only review skills and write-capable workflows (e.g. /ship runs git push). Per-item risk surfaces in Phase 2 when install is wired up.",tags:["engineering","skills-pack","mit"],manifest:{item_refs:["skill:design-shotgun","skill:design-review","skill:qa-only","skill:cso-audit"],published_count:4,license:"MIT",note:"Agent personas in this bundle will surface in the Agent Marketplace when it ships."}}];function l(a,b,c){let d=a.prepare("SELECT id FROM marketplace_items WHERE kind=? AND slug=?").get(b,c.slug),e=d?.id||`${b}:${c.slug}`,f=c.manifest?JSON.stringify(c.manifest):null,g=c.tags?JSON.stringify(c.tags):null;if(d)a.prepare(`
       UPDATE marketplace_items
          SET title=?, description=?, category=?, author=?, source_kind=?,
              source_url=?, version=?, manifest_json=?, risk_summary=?, tags=?
@@ -3309,11 +3318,11 @@ Next action: choose a specialized agent, create a local run folder, keep human-i
     SELECT COUNT(*) AS n,
            SUM(CASE WHEN au_ppm IS NOT NULL OR ag_ppm IS NOT NULL OR cu_pct IS NOT NULL THEN 1 ELSE 0 END) AS grade_n
     FROM mines_assay_samples WHERE project_id = ?
-  `).get(a)||{n:0,grade_n:0}).grade_n||0)>0,i=d.has("resource_estimate");d.has("reserve_estimate"),d.has("opex"),d.has("production_schedule");let j=h.filter(a=>!d.has(a)),k=0===j.length,l=i||f,m=String(c.asset_stage||"").toLowerCase(),n=m.includes("exploration")||m.includes("prospect")||m.includes("early");if("t1_in_situ"===b.force_tier)return{status:"ok",project_id:a,tier:"t1_in_situ",t1_ready:l,t2_ready:k,t2_blocked:!0,blocking_inputs_missing:j,t2_blocking_reason:j.length?`T2 DCF blocked: missing ${j.join(", ")}.`:"T1 was explicitly requested.",confidence:i?"moderate":"indicative",reason:"T1 in-situ valuation explicitly requested."};if(k&&!n)return{status:"ok",project_id:a,tier:"t2_dcf",t1_ready:l,t2_ready:!0,t2_blocked:!1,blocking_inputs_missing:[],t2_blocking_reason:null,confidence:"modelled",reason:"Reserve estimate, production schedule, and operating-cost facts are present; DCF is allowed."};let o="t2_dcf"===b.force_tier,p=[...new Set([...j,...k&&n?["asset_stage_not_dcf_ready"]:[]])];return{status:"ok",project_id:a,tier:"t1_in_situ",t1_ready:l,t2_ready:!1,t2_blocked:!0,blocking_inputs_missing:p,t2_blocking_reason:p.length?`T2 DCF blocked: missing or unsuitable inputs (${p.join(", ")}).`:"T2 DCF blocked by exploration-stage policy.",confidence:i?"moderate":"indicative",reason:o?"Forced T2 request was rejected because DCF prerequisites are incomplete or the asset stage is not DCF-ready; using T1 in-situ instead.":"Exploration/resource-stage projects use T1 in-situ until reserve, production schedule, and cost inputs are present."}}d()}catch(a){d(a)}})},72189:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{X:()=>t,Z6:()=>p,dd:()=>n,mr:()=>r,sq:()=>q,sv:()=>o,vO:()=>s});var e=c(73024),f=c(76760),g=c(60105),h=c(8437),i=c(26531),j=a([g,h]);[g,h]=j.then?(await j)():j;let u=new Set([".git","node_modules",".next","data"]);function k(a,b,c={}){(0,g.appendAudit)({type:`local.${a}`,summary:`${a} ${b}`,status:b,meta:c})}function l(a,b,c){return(0,h.D6)({action_type:a,risk:"medium",summary:`${a} requested for ${c}`,payload:{input:{...b,content:b.content?`[${String(b.content).length} chars]`:void 0},path:c}})}function m(a){return b=>b.path===a}async function n(a={}){let{path:b}=(0,i.hC)(a.path),c=Number(process.env.MADARX_FILE_READ_MAX_BYTES||1e5),d=e.statSync(b);if(!d.isFile())throw Error("Path is not a file");if(d.size>c)throw Error(`File too large: ${d.size} bytes`);let f=e.readFileSync(b,"utf8").split(/\r?\n/),g=Math.max(1,Number(a.offset||1)),h=Math.max(1,Math.min(2e3,Number(a.limit||500))),j=f.slice(g-1,g-1+h).join("\n");return k("file_read","complete",{path:b,bytes:Buffer.byteLength(j)}),{ok:!0,tool:"file_read",path:b,content:(0,i.nc)(j),metadata:{line_count:f.length,offset:g,limit:h}}}async function o(a={}){let{path:b}=(0,i.hC)(a.path||"."),c=Math.max(1,Math.min(500,Number(a.limit||100))),d=[];for(let a of e.readdirSync(b,{withFileTypes:!0})){if(d.length>=c)break;try{(0,i.hC)(f.join(b,a.name))}catch{continue}u.has(a.name)||d.push({name:a.name,type:a.isDirectory()?"directory":a.isFile()?"file":"other"})}return k("directory_list","complete",{path:b,count:d.length}),{ok:!0,tool:"directory_list",path:b,entries:d,metadata:{count:d.length}}}function p(a={}){let{path:b}=(0,i.hC)(a.path);if((0,i.Oe)(b))throw Error(`Write access denied: path is under a read-only root: ${a.path}`);return{absPath:b}}async function q(a={},b={}){let{absPath:c}=p(a);if(!b.owner_trusted&&!(0,h.v)(a.approval_id,{action_type:"file_write",matches:m(c)})){let b=l("file_write",a,c);return{ok:!1,status:"approval_required",approval_request_id:b.id,reason:"File writes require approval"}}return!1!==a.create_dirs&&e.mkdirSync(f.dirname(c),{recursive:!0}),e.writeFileSync(c,String(a.content??""),"utf8"),k("file_write","complete",{path:c}),{ok:!0,tool:"file_write",path:c,metadata:{bytes:Buffer.byteLength(String(a.content??""))}}}function r(a={}){let{path:b}=(0,i.hC)(a.path);if((0,i.Oe)(b))throw Error(`Write access denied: path is under a read-only root: ${a.path}`);let c=String(a.old_string??"");if(!c)throw Error("old_string is required");let d=e.readFileSync(b,"utf8"),f=d.split(c).length-1;if(!f)throw Error("old_string not found");if(f>1&&!a.replace_all)throw Error("old_string is ambiguous");return{absPath:b,content:d,matches:f,oldString:c}}async function s(a={},b={}){let{absPath:c,content:d,matches:f,oldString:g}=r(a),i=String(a.new_string??"");if(!b.owner_trusted&&!(0,h.v)(a.approval_id,{action_type:"file_patch",matches:m(c)})){let b=l("file_patch",{...a,new_string:`[${i.length} chars]`},c);return{ok:!1,status:"approval_required",approval_request_id:b.id,reason:"File patches require approval"}}return e.writeFileSync(c,a.replace_all?d.split(g).join(i):d.replace(g,i),"utf8"),k("file_patch","complete",{path:c,replacements:a.replace_all?f:1}),{ok:!0,tool:"file_patch",path:c,metadata:{replacements:a.replace_all?f:1}}}async function t(a={}){let{path:b}=(0,i.hC)(a.path||"."),c=String(a.pattern||"");if(!c)throw Error("pattern is required");let d=Math.max(1,Math.min(200,Number(a.limit||50))),g=RegExp(c.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i"),h=a.target||"content",j=a.file_glob?String(a.file_glob):null,l=j?RegExp("^"+j.split("*").map(a=>a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join(".*")+"$","i"):null,m=[];for(let a of function a(b,c=[],d=1e3){if(c.length>=d)return c;for(let g of e.readdirSync(b,{withFileTypes:!0})){if(u.has(g.name))continue;let e=f.join(b,g.name);if(g.isDirectory()?a(e,c,d):g.isFile()&&c.push(e),c.length>=d)break}return c}(b,[],5e3)){if(m.length>=d)break;try{(0,i.hC)(a)}catch{continue}if(!l||l.test(f.basename(a))){if("path"===h||"name"===h){g.test("name"===h?f.basename(a):a)&&m.push({path:a});continue}e.statSync(a).size>25e4||/\.sqlite/.test(a)||/^\.env/.test(f.basename(a))||e.readFileSync(a,"utf8").split(/\r?\n/).forEach((b,c)=>{m.length<d&&g.test(b)&&m.push({path:a,line:c+1,text:(0,i.nc)(b)})})}}return k("file_search","complete",{path:b,count:m.length}),{ok:!0,tool:"file_search",path:b,results:m,metadata:{count:m.length}}}d()}catch(a){d(a)}})},72326:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{$k:()=>n,GK:()=>p,Iu:()=>y,M2:()=>x,No:()=>u,Qp:()=>o,Ys:()=>s,bD:()=>w,d:()=>B});var e=c(76760),f=c(73024),g=c(48161),h=c(31421),i=c(73136),j=c(19151),k=c(9001),l=c(9381),m=a([j,k]);[j,k]=m.then?(await m)():m;let C=e.resolve(e.dirname((0,i.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/lib/agent-engines.js")),".."),D=process.env.OLLAMA_BASE_URL||"http://127.0.0.1:11434",E=[{id:"anthropic",label:"Anthropic API",description:"Server-native Claude Messages API brain with madarX governed tool_use.",default_model:"claude-sonnet-4-6",mode:"api"},{id:"claude-code",label:"Claude Code CLI",description:"Local Claude Code runner for developer/repo agents using the authenticated CLI.",default_model:"sonnet",mode:"local-cli"},{id:"ollama",label:"Ollama Local LLM",description:"Local or Ollama-hosted models through the Ollama chat API.",default_model:process.env.OLLAMA_MODEL||"",mode:"local-llm"},{id:"hermes",label:"Hermes",description:"Hermes as a meta-agent/router. Available through governed Hermes job tools.",default_model:"",mode:"orchestrator"},{id:"codex",label:"Codex CLI",description:"Local Codex CLI coding runner. Available through approval-gated terminal/tool workflows.",default_model:"",mode:"local-cli"}];function n(a){let b=String(a||"").trim().toLowerCase();return b?["anthropic","anthropic-api","claude-api","api"].includes(b)?"anthropic":["claude-code","claude code","claude_cli","claude-cli"].includes(b)?"claude-code":b.includes("hermes")&&b.includes("claude code")?"anthropic":["ollama","local","local-llm","local llm"].includes(b)?"ollama":["hermes","hermes-agent"].includes(b)?"hermes":["codex","codex-cli","openai-codex"].includes(b)?"codex":b:"claude-code"}function o(a){let b=n(a);return E.find(a=>a.id===b)?.default_model||""}async function p(a){let b=n(a);if("anthropic"===b){let{resolveAnthropicApiKey:a}=await Promise.resolve().then(c.bind(c,65451));if(!a()){let a=Error("The Anthropic API engine is selected but no API key is configured. Add ANTHROPIC_API_KEY to the secrets vault or .env.local, or switch to the Claude Code CLI engine.");throw a.code="engine_unavailable",a.engine=b,a}return!0}if("claude-code"===b){if(process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE)return!0;if(!await s("claude")){let a=Error("The Claude Code CLI engine is selected but the `claude` binary is not installed or not on PATH. Install Claude Code and sign in, or switch to the Anthropic API engine.");throw a.code="engine_unavailable",a.engine=b,a}return!0}if("codex"===b){if(process.env.MADARX_MOCK_CODEX_RESPONSE)return!0;if(!await s("codex")){let a=Error("The Codex CLI engine is selected but the `codex` binary is not installed or not on PATH.");throw a.code="engine_unavailable",a.engine=b,a}}return!0}let F=new Map;function q(a){if(F.has(a))return F.get(a);for(let b of[process.env[`MADARX_${a.toUpperCase()}_BIN`],e.join(g.homedir(),".local","bin",a),`/opt/homebrew/bin/${a}`,`/usr/local/bin/${a}`,e.join(g.homedir(),".npm-global","bin",a)].filter(Boolean))try{return f.accessSync(b,f.constants.X_OK),F.set(a,b),b}catch{}return null}function r(a){return F.get(a)||q(a)||a}async function s(a){return!!q(a)||new Promise(b=>{let c=(0,h.spawn)("sh",["-lc",`command -v ${a}`],{shell:!1}),d="";c.stdout.on("data",a=>{d+=a.toString()}),c.on("error",()=>b(!1)),c.on("close",c=>{let f=0===c?d.trim().split("\n").pop()?.trim():"";f&&e.isAbsolute(f)&&F.set(a,f),b(0===c)})})}async function t(){try{let a=await fetch(`${D}/api/tags`,{signal:AbortSignal.timeout(1500)});if(!a.ok)return[];return((await a.json()).models||[]).map(a=>({name:a.name||a.model,model:a.model||a.name,size:a.size||0,details:a.details||{},local:!a.remote_host,remote_host:a.remote_host||null})).filter(a=>a.name)}catch{return[]}}async function u(){let[a,b,c]=await Promise.all([t(),s("claude"),s("codex")]),d=process.env.OLLAMA_MODEL||(process.env.MADARX_MOCK_OLLAMA_RESPONSE?"qwen3.5:latest":""),e=a[0]?.name||d;return E.map(f=>({...f,default_model:"ollama"===f.id?e:f.default_model,available:"claude-code"===f.id?b:"codex"===f.id?c:"ollama"!==f.id||!!(a.length||process.env.MADARX_MOCK_OLLAMA_RESPONSE),models:"ollama"===f.id?a.length?a:d?[{name:d,model:d,local:!0,fallback:!0}]:[]:f.default_model?[{name:f.default_model,model:f.default_model}]:[]}))}function v(a,b,{cwd:c=process.cwd(),timeoutMs:d=12e4,closeStdin:e=!1,onChunk:f,env:g}={}){return new Promise((i,j)=>{let k=(0,h.spawn)(a,b,{shell:!1,cwd:c,env:g??{...process.env}});e&&k.stdin.end();let l="",m="",n=setTimeout(()=>{k.kill("SIGTERM"),j(Error(`${a} timed out after ${d}ms`))},d);k.stdout.on("data",a=>{let b=a.toString();l+=b,f?.(b)}),k.stderr.on("data",a=>{m+=a.toString()}),k.on("error",a=>{clearTimeout(n),j(a)}),k.on("close",b=>{if(clearTimeout(n),0===b||1===b&&l.trim())return void i(l.trim());j(Error(`${a} exited ${b}: ${m.trim()||l.trim()}`))})})}async function w({model:a,systemPrompt:b,userMessage:c,maxTokens:d=2048}){if(process.env.MADARX_MOCK_OLLAMA_RESPONSE)return process.env.MADARX_MOCK_OLLAMA_RESPONSE;let e=await fetch(`${D}/api/chat`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({model:a||process.env.OLLAMA_MODEL,stream:!1,options:{num_predict:d},messages:[{role:"system",content:b},{role:"user",content:c}]})});if(!e.ok)throw Error(`Ollama chat failed: HTTP ${e.status}`);let f=await e.json(),g=f.message?.content||f.response||"";if(!g.trim())throw Error("Ollama returned no text");return g.trim()}async function x({model:a,systemPrompt:b,userMessage:c,maxTurns:d,allowedTools:e=[],timeoutMs:f,onChunk:g,onAssistantText:h,onToolStart:i,onToolResult:j,cwd:l,addDirs:m=[],agentId:n,agentName:o}={}){if(process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE)return process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE;let p=`${b}
+  `).get(a)||{n:0,grade_n:0}).grade_n||0)>0,i=d.has("resource_estimate");d.has("reserve_estimate"),d.has("opex"),d.has("production_schedule");let j=h.filter(a=>!d.has(a)),k=0===j.length,l=i||f,m=String(c.asset_stage||"").toLowerCase(),n=m.includes("exploration")||m.includes("prospect")||m.includes("early");if("t1_in_situ"===b.force_tier)return{status:"ok",project_id:a,tier:"t1_in_situ",t1_ready:l,t2_ready:k,t2_blocked:!0,blocking_inputs_missing:j,t2_blocking_reason:j.length?`T2 DCF blocked: missing ${j.join(", ")}.`:"T1 was explicitly requested.",confidence:i?"moderate":"indicative",reason:"T1 in-situ valuation explicitly requested."};if(k&&!n)return{status:"ok",project_id:a,tier:"t2_dcf",t1_ready:l,t2_ready:!0,t2_blocked:!1,blocking_inputs_missing:[],t2_blocking_reason:null,confidence:"modelled",reason:"Reserve estimate, production schedule, and operating-cost facts are present; DCF is allowed."};let o="t2_dcf"===b.force_tier,p=[...new Set([...j,...k&&n?["asset_stage_not_dcf_ready"]:[]])];return{status:"ok",project_id:a,tier:"t1_in_situ",t1_ready:l,t2_ready:!1,t2_blocked:!0,blocking_inputs_missing:p,t2_blocking_reason:p.length?`T2 DCF blocked: missing or unsuitable inputs (${p.join(", ")}).`:"T2 DCF blocked by exploration-stage policy.",confidence:i?"moderate":"indicative",reason:o?"Forced T2 request was rejected because DCF prerequisites are incomplete or the asset stage is not DCF-ready; using T1 in-situ instead.":"Exploration/resource-stage projects use T1 in-situ until reserve, production schedule, and cost inputs are present."}}d()}catch(a){d(a)}})},72189:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{X:()=>t,Z6:()=>p,dd:()=>n,mr:()=>r,sq:()=>q,sv:()=>o,vO:()=>s});var e=c(73024),f=c(76760),g=c(60105),h=c(8437),i=c(26531),j=a([g,h]);[g,h]=j.then?(await j)():j;let u=new Set([".git","node_modules",".next","data"]);function k(a,b,c={}){(0,g.appendAudit)({type:`local.${a}`,summary:`${a} ${b}`,status:b,meta:c})}function l(a,b,c){return(0,h.D6)({action_type:a,risk:"medium",summary:`${a} requested for ${c}`,payload:{input:{...b,content:b.content?`[${String(b.content).length} chars]`:void 0},path:c}})}function m(a){return b=>b.path===a}async function n(a={}){let{path:b}=(0,i.hC)(a.path),c=Number(process.env.MADARX_FILE_READ_MAX_BYTES||1e5),d=e.statSync(b);if(!d.isFile())throw Error("Path is not a file");if(d.size>c)throw Error(`File too large: ${d.size} bytes`);let f=e.readFileSync(b,"utf8").split(/\r?\n/),g=Math.max(1,Number(a.offset||1)),h=Math.max(1,Math.min(2e3,Number(a.limit||500))),j=f.slice(g-1,g-1+h).join("\n");return k("file_read","complete",{path:b,bytes:Buffer.byteLength(j)}),{ok:!0,tool:"file_read",path:b,content:(0,i.nc)(j),metadata:{line_count:f.length,offset:g,limit:h}}}async function o(a={}){let{path:b}=(0,i.hC)(a.path||"."),c=Math.max(1,Math.min(500,Number(a.limit||100))),d=[];for(let a of e.readdirSync(b,{withFileTypes:!0})){if(d.length>=c)break;try{(0,i.hC)(f.join(b,a.name))}catch{continue}u.has(a.name)||d.push({name:a.name,type:a.isDirectory()?"directory":a.isFile()?"file":"other"})}return k("directory_list","complete",{path:b,count:d.length}),{ok:!0,tool:"directory_list",path:b,entries:d,metadata:{count:d.length}}}function p(a={}){let{path:b}=(0,i.hC)(a.path);if((0,i.Oe)(b))throw Error(`Write access denied: path is under a read-only root: ${a.path}`);return{absPath:b}}async function q(a={},b={}){let{absPath:c}=p(a);if(!b.owner_trusted&&!(0,h.v)(a.approval_id,{action_type:"file_write",matches:m(c)})){let b=l("file_write",a,c);return{ok:!1,status:"approval_required",approval_request_id:b.id,reason:"File writes require approval"}}return!1!==a.create_dirs&&e.mkdirSync(f.dirname(c),{recursive:!0}),e.writeFileSync(c,String(a.content??""),"utf8"),k("file_write","complete",{path:c}),{ok:!0,tool:"file_write",path:c,metadata:{bytes:Buffer.byteLength(String(a.content??""))}}}function r(a={}){let{path:b}=(0,i.hC)(a.path);if((0,i.Oe)(b))throw Error(`Write access denied: path is under a read-only root: ${a.path}`);let c=String(a.old_string??"");if(!c)throw Error("old_string is required");let d=e.readFileSync(b,"utf8"),f=d.split(c).length-1;if(!f)throw Error("old_string not found");if(f>1&&!a.replace_all)throw Error("old_string is ambiguous");return{absPath:b,content:d,matches:f,oldString:c}}async function s(a={},b={}){let{absPath:c,content:d,matches:f,oldString:g}=r(a),i=String(a.new_string??"");if(!b.owner_trusted&&!(0,h.v)(a.approval_id,{action_type:"file_patch",matches:m(c)})){let b=l("file_patch",{...a,new_string:`[${i.length} chars]`},c);return{ok:!1,status:"approval_required",approval_request_id:b.id,reason:"File patches require approval"}}return e.writeFileSync(c,a.replace_all?d.split(g).join(i):d.replace(g,i),"utf8"),k("file_patch","complete",{path:c,replacements:a.replace_all?f:1}),{ok:!0,tool:"file_patch",path:c,metadata:{replacements:a.replace_all?f:1}}}async function t(a={}){let{path:b}=(0,i.hC)(a.path||"."),c=String(a.pattern||"");if(!c)throw Error("pattern is required");let d=Math.max(1,Math.min(200,Number(a.limit||50))),g=RegExp(c.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),"i"),h=a.target||"content",j=a.file_glob?String(a.file_glob):null,l=j?RegExp("^"+j.split("*").map(a=>a.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join(".*")+"$","i"):null,m=[];for(let a of function a(b,c=[],d=1e3){if(c.length>=d)return c;for(let g of e.readdirSync(b,{withFileTypes:!0})){if(u.has(g.name))continue;let e=f.join(b,g.name);if(g.isDirectory()?a(e,c,d):g.isFile()&&c.push(e),c.length>=d)break}return c}(b,[],5e3)){if(m.length>=d)break;try{(0,i.hC)(a)}catch{continue}if(!l||l.test(f.basename(a))){if("path"===h||"name"===h){g.test("name"===h?f.basename(a):a)&&m.push({path:a});continue}e.statSync(a).size>25e4||/\.sqlite/.test(a)||/^\.env/.test(f.basename(a))||e.readFileSync(a,"utf8").split(/\r?\n/).forEach((b,c)=>{m.length<d&&g.test(b)&&m.push({path:a,line:c+1,text:(0,i.nc)(b)})})}}return k("file_search","complete",{path:b,count:m.length}),{ok:!0,tool:"file_search",path:b,results:m,metadata:{count:m.length}}}d()}catch(a){d(a)}})},72326:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{let E;c.d(b,{$k:()=>o,GK:()=>q,Iu:()=>A,M2:()=>z,No:()=>w,Qp:()=>p,Ys:()=>t,bD:()=>y,d:()=>D});var e=c(76760),f=c(73024),g=c(48161),h=c(31421),i=c(73136),j=c(19151),k=c(9001),l=c(9381),m=c(51867),n=a([j,k]);[j,k]=n.then?(await n)():n;let F=e.resolve(e.dirname((0,i.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/lib/agent-engines.js")),".."),G=process.env.OLLAMA_BASE_URL||"http://127.0.0.1:11434",H=[{id:"anthropic",label:"Anthropic API",description:"Server-native Claude Messages API brain with madarX governed tool_use.",default_model:"claude-sonnet-4-6",mode:"api"},{id:"claude-code",label:"Claude Code CLI",description:"Local Claude Code runner for developer/repo agents using the authenticated CLI.",default_model:"sonnet",mode:"local-cli"},{id:"ollama",label:"Ollama Local LLM",description:"Local or Ollama-hosted models through the Ollama chat API.",default_model:process.env.OLLAMA_MODEL||"",mode:"local-llm"},{id:"hermes",label:"Hermes",description:"Hermes as a meta-agent/router. Available through governed Hermes job tools.",default_model:"",mode:"orchestrator"},{id:"codex",label:"Codex CLI",description:"Local Codex CLI coding runner. Available through approval-gated terminal/tool workflows.",default_model:"",mode:"local-cli"}];function o(a){let b=String(a||"").trim().toLowerCase();return b?["anthropic","anthropic-api","claude-api","api"].includes(b)?"anthropic":["claude-code","claude code","claude_cli","claude-cli"].includes(b)?"claude-code":b.includes("hermes")&&b.includes("claude code")?"anthropic":["ollama","local","local-llm","local llm"].includes(b)?"ollama":["hermes","hermes-agent"].includes(b)?"hermes":["codex","codex-cli","openai-codex"].includes(b)?"codex":b:"claude-code"}function p(a){let b=o(a);return H.find(a=>a.id===b)?.default_model||""}async function q(a){let b=o(a);if("anthropic"===b){let{resolveAnthropicApiKey:a}=await Promise.resolve().then(c.bind(c,65451));if(!a()){let a=Error("The Anthropic API engine is selected but no API key is configured. Add ANTHROPIC_API_KEY to the secrets vault or .env.local, or switch to the Claude Code CLI engine.");throw a.code="engine_unavailable",a.engine=b,a}return!0}if("claude-code"===b){if(process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE)return!0;if(!await t("claude")){let a=Error("The Claude Code CLI engine is selected but the `claude` binary is not installed or not on PATH. Install Claude Code and sign in, or switch to the Anthropic API engine.");throw a.code="engine_unavailable",a.engine=b,a}return!0}if("codex"===b){if(process.env.MADARX_MOCK_CODEX_RESPONSE)return!0;if(!await t("codex")){let a=Error("The Codex CLI engine is selected but the `codex` binary is not installed or not on PATH.");throw a.code="engine_unavailable",a.engine=b,a}}return!0}let I=new Map;function r(a){if(I.has(a))return I.get(a);for(let b of[process.env[`MADARX_${a.toUpperCase()}_BIN`],e.join(g.homedir(),".local","bin",a),`/opt/homebrew/bin/${a}`,`/usr/local/bin/${a}`,e.join(g.homedir(),".npm-global","bin",a)].filter(Boolean))try{return f.accessSync(b,f.constants.X_OK),I.set(a,b),b}catch{}return null}function s(a){return I.get(a)||r(a)||a}async function t(a){return!!r(a)||new Promise(b=>{let c=(0,h.spawn)("sh",["-lc",`command -v ${a}`],{shell:!1}),d="";c.stdout.on("data",a=>{d+=a.toString()}),c.on("error",()=>b(!1)),c.on("close",c=>{let f=0===c?d.trim().split("\n").pop()?.trim():"";f&&e.isAbsolute(f)&&I.set(a,f),b(0===c)})})}async function u(){return!process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE&&("1"===process.env.MADARX_CC_FORCE_PARTIAL||"0"!==process.env.MADARX_CC_FORCE_PARTIAL&&(void 0!==E?E:E=await new Promise(a=>{try{let b=(0,h.spawn)(s("claude"),["--help"],{shell:!1}),c="";b.stdout.on("data",a=>{c+=a.toString()}),b.stderr.on("data",a=>{c+=a.toString()}),b.on("error",()=>a(!1)),b.on("close",()=>a(c.includes("include-partial-messages")))}catch{a(!1)}})))}async function v(){try{let a=await fetch(`${G}/api/tags`,{signal:AbortSignal.timeout(1500)});if(!a.ok)return[];return((await a.json()).models||[]).map(a=>({name:a.name||a.model,model:a.model||a.name,size:a.size||0,details:a.details||{},local:!a.remote_host,remote_host:a.remote_host||null})).filter(a=>a.name)}catch{return[]}}async function w(){let[a,b,c]=await Promise.all([v(),t("claude"),t("codex")]),d=process.env.OLLAMA_MODEL||(process.env.MADARX_MOCK_OLLAMA_RESPONSE?"qwen3.5:latest":""),e=a[0]?.name||d;return H.map(f=>({...f,default_model:"ollama"===f.id?e:f.default_model,available:"claude-code"===f.id?b:"codex"===f.id?c:"ollama"!==f.id||!!(a.length||process.env.MADARX_MOCK_OLLAMA_RESPONSE),models:"ollama"===f.id?a.length?a:d?[{name:d,model:d,local:!0,fallback:!0}]:[]:f.default_model?[{name:f.default_model,model:f.default_model}]:[]}))}function x(a,b,{cwd:c=process.cwd(),timeoutMs:d=12e4,closeStdin:e=!1,onChunk:f,env:g}={}){return new Promise((i,j)=>{let k=(0,h.spawn)(a,b,{shell:!1,cwd:c,env:g??{...process.env}});e&&k.stdin.end();let l="",m="",n=setTimeout(()=>{k.kill("SIGTERM"),j(Error(`${a} timed out after ${d}ms`))},d);k.stdout.on("data",a=>{let b=a.toString();l+=b,f?.(b)}),k.stderr.on("data",a=>{m+=a.toString()}),k.on("error",a=>{clearTimeout(n),j(a)}),k.on("close",b=>{if(clearTimeout(n),0===b||1===b&&l.trim())return void i(l.trim());j(Error(`${a} exited ${b}: ${m.trim()||l.trim()}`))})})}async function y({model:a,systemPrompt:b,userMessage:c,maxTokens:d=2048,onChunk:e,onThinking:f}={}){if(process.env.MADARX_MOCK_OLLAMA_RESPONSE)return process.env.MADARX_MOCK_OLLAMA_RESPONSE;let g=!!(e||f),h=g&&(0,m.Zf)()&&"1"===process.env.MADARX_OLLAMA_THINK,i={model:a||process.env.OLLAMA_MODEL,stream:g,options:{num_predict:d},messages:[{role:"system",content:b},{role:"user",content:c}]};h&&(i.think=!0);let j=await fetch(`${G}/api/chat`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});if(!j.ok)throw Error(`Ollama chat failed: HTTP ${j.status}`);if(!g){let a=await j.json(),b=a.message?.content||a.response||"";if(!b.trim())throw Error("Ollama returned no text");return b.trim()}let k="",l="",n=j.body.getReader(),o=new TextDecoder,p="";for(;;){let a,{done:b,value:c}=await n.read();if(b)break;for(p+=o.decode(c,{stream:!0});(a=p.indexOf("\n"))>=0;){let b,c=p.slice(0,a).trim();if(p=p.slice(a+1),!c)continue;try{b=JSON.parse(c)}catch{continue}let d=b.message?.content||b.response||"",g=b.message?.thinking||"";d&&(k+=d,e?.(d,k)),g&&(l+=g,f?.(l,g))}}if(!k.trim())throw Error("Ollama returned no text");return k.trim()}async function z({model:a,systemPrompt:b,userMessage:c,maxTurns:d,allowedTools:e=[],timeoutMs:f,onChunk:g,onAssistantText:h,onThinking:i,onStatus:j,onToolStart:l,onToolResult:n,cwd:o,addDirs:p=[],agentId:q,agentName:r,verbosity:t}={}){if(process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE)return process.env.MADARX_MOCK_CLAUDE_CODE_RESPONSE;let v=`${b}
 
-${c}`,q=Number(d||process.env.CLAUDE_CODE_MAX_TURNS||30),s=["-p",p,"--max-turns",String(q),"--output-format","stream-json","--verbose","--permission-mode","bypassPermissions","--setting-sources","project,local,user"];for(let a of m)a&&s.push("--add-dir",a);e.length&&s.push("--allowedTools",e.join(",")),a&&"claude-code"!==a&&s.splice(2,0,"--model",a);let t=[],u=[],w="",y="",z=function({agentId:a,agentName:b,onText:c,onToolStart:d,onToolResult:e,onResult:f}){let g="",h=new Map;return function(i){let j;for(g+=i;(j=g.indexOf("\n"))>=0;){let i,l=g.slice(0,j).trim();if(g=g.slice(j+1),!l||"{"!==l[0])continue;try{i=JSON.parse(l)}catch{continue}if(!i||"object"!=typeof i)continue;if("result"===i.type){"string"==typeof i.result&&i.result.trim()&&f?.(i.result.trim());continue}let m=i.message?.content;if(Array.isArray(m)){if("assistant"===i.type){let e=m.some(a=>a?.type==="tool_use"),f=m.filter(a=>a?.type==="text"&&"string"==typeof a.text).map(a=>a.text).join("");for(let g of(f&&c?.(f,{isFinal:!e}),m))g?.type==="tool_use"&&(g.id&&h.set(g.id,g.name||"tool"),d?.({id:g.id,name:g.name||"tool",input:g.input}),a&&(0,k.AC)({type:"agent_tool_start",agent_id:a,agent_name:b||a,tool:g.name||"tool",input_summary:function(a,b){if(!b||"object"!=typeof b)return"";if("Bash"===a)return String(b.command||"").slice(0,120);if("WebSearch"===a)return String(b.query||"").slice(0,120);if("WebFetch"===a)return String(b.url||"").slice(0,120);if("Read"===a||"Glob"===a||"Grep"===a||"LS"===a)return String(b.file_path||b.pattern||b.path||"").slice(0,120);if("Write"===a||"Edit"===a||"MultiEdit"===a)return String(b.file_path||"").slice(0,120);if("TodoWrite"===a)return Array.isArray(b.todos)?`${b.todos.length} todos`:"";try{return JSON.stringify(b).slice(0,120)}catch{return""}}(g.name,g.input)}))}else if("user"===i.type){for(let c of m)if(c?.type==="tool_result"){let d=h.get(c.tool_use_id)||"tool";e?.({tool_use_id:c.tool_use_id,name:d,isError:!!c.is_error}),a&&(0,k.AC)({type:"agent_tool_result",agent_id:a,agent_name:b||a,tool:d,status:c.is_error?"error":"done",isError:!!c.is_error}),h.delete(c.tool_use_id)}}}}}}({agentId:n,agentName:o,onText:(a,b={})=>{t.push(a),b.isFinal?u.push(a):w=a,h?.(t.join("").trim())},onResult:a=>{y=a},onToolStart:i,onToolResult:j});await v(r("claude"),s,{cwd:l,timeoutMs:f??Number(process.env.CLAUDE_CODE_TICK_TIMEOUT_MS||6e5),closeStdin:!0,env:function(){let a={...process.env};return"1"===process.env.MADARX_CLI_USE_API_KEY||(delete a.ANTHROPIC_API_KEY,delete a.ANTHROPIC_AUTH_TOKEN),a}(),onChunk:a=>{z(a),g?.(a)}});let A=u.join("").trim()||w.trim()||t.join("").trim()||y.trim();if(!A)throw Error("Claude Code returned no assistant text");return A}async function y({systemPrompt:a,userMessage:b,onChunk:c}){if(process.env.MADARX_MOCK_CODEX_RESPONSE)return process.env.MADARX_MOCK_CODEX_RESPONSE;let d=a?`${a}
+${c}`,w=Number(d||process.env.CLAUDE_CODE_MAX_TURNS||30),y=t||(0,m._e)(),A=(0,m.Zf)(y),B=A&&await u(),C=["-p",v,"--max-turns",String(w),"--output-format","stream-json","--verbose","--permission-mode","bypassPermissions","--setting-sources","project,local,user"];for(let a of(B&&C.push("--include-partial-messages"),p))a&&C.push("--add-dir",a);e.length&&C.push("--allowedTools",e.join(",")),a&&"claude-code"!==a&&C.splice(2,0,"--model",a);let D=function(){let a={...process.env};return"1"===process.env.MADARX_CLI_USE_API_KEY||(delete a.ANTHROPIC_API_KEY,delete a.ANTHROPIC_AUTH_TOKEN),a}();if(A){let a=(0,m.s_)(y);a>0&&(D.MAX_THINKING_TOKENS=String(Math.max(1024,a)))}let E=[],F=[],G="",H="",I="",J="",K=function({agentId:a,agentName:b,partial:c=!1,onText:d,onTextDelta:e,onThinkingDelta:f,onToolStart:g,onToolResult:h,onResult:i,onStatus:j}){let l="",m=new Map,n=new Map;return function(o){let p;for(l+=o;(p=l.indexOf("\n"))>=0;){let o,q=l.slice(0,p).trim();if(l=l.slice(p+1),!q||"{"!==q[0])continue;try{o=JSON.parse(q)}catch{continue}if(!o||"object"!=typeof o)continue;if("stream_event"===o.type&&o.event&&"object"==typeof o.event){let a=o.event;if("content_block_delta"===a.type&&a.delta){let b=a.delta;"text_delta"===b.type&&"string"==typeof b.text?e?.(b.text):"thinking_delta"===b.type&&"string"==typeof b.thinking&&f?.(b.thinking)}else"content_block_start"===a.type&&a.content_block?.type==="thinking"?j?.("thinking"):"message_start"===a.type&&j?.("generating");continue}if("result"===o.type){"string"==typeof o.result&&o.result.trim()&&i?.(o.result.trim());continue}let r=o.message?.content;if(Array.isArray(r)){if("assistant"===o.type){let e=r.some(a=>a?.type==="tool_use");if(!c)for(let a of r)a?.type==="thinking"&&"string"==typeof a.thinking&&a.thinking&&f?.(a.thinking);let h=r.filter(a=>a?.type==="text"&&"string"==typeof a.text).map(a=>a.text).join("");for(let c of(h&&d?.(h,{isFinal:!e}),r))c?.type==="tool_use"&&(c.id&&(m.set(c.id,c.name||"tool"),n.set(c.id,Date.now())),g?.({id:c.id,name:c.name||"tool",input:c.input}),a&&(0,k.AC)({type:"agent_tool_start",agent_id:a,agent_name:b||a,tool:c.name||"tool",input_summary:function(a,b){if(!b||"object"!=typeof b)return"";if("Bash"===a)return String(b.command||"").slice(0,120);if("WebSearch"===a)return String(b.query||"").slice(0,120);if("WebFetch"===a)return String(b.url||"").slice(0,120);if("Read"===a||"Glob"===a||"Grep"===a||"LS"===a)return String(b.file_path||b.pattern||b.path||"").slice(0,120);if("Write"===a||"Edit"===a||"MultiEdit"===a)return String(b.file_path||"").slice(0,120);if("TodoWrite"===a)return Array.isArray(b.todos)?`${b.todos.length} todos`:"";try{return JSON.stringify(b).slice(0,120)}catch{return""}}(c.name,c.input)}))}else if("user"===o.type){for(let c of r)if(c?.type==="tool_result"){let d=m.get(c.tool_use_id)||"tool",e=n.get(c.tool_use_id),f=e?Date.now()-e:null,{preview:g,chars:i,lines:j}=function(a){let b=a?.content,c="";return"string"==typeof b?c=b:Array.isArray(b)&&(c=b.map(a=>"string"==typeof a?a:a?.type==="text"&&"string"==typeof a.text?a.text:"").join("")),{preview:(c=String(c||"")).slice(0,200),chars:c.length,lines:c?c.split("\n").length:0}}(c);h?.({tool_use_id:c.tool_use_id,name:d,isError:!!c.is_error,durationMs:f,preview:g,chars:i,lines:j}),a&&(0,k.AC)({type:"agent_tool_result",agent_id:a,agent_name:b||a,tool:d,status:c.is_error?"error":"done",isError:!!c.is_error,duration_ms:f}),m.delete(c.tool_use_id),n.delete(c.tool_use_id)}}}}}}({agentId:q,agentName:r,partial:B,onText:(a,b={})=>{E.push(a),b.isFinal?F.push(a):G=a,B||h?.(E.join("").trim())},onTextDelta:a=>{I+=a,h?.(I.trim())},onThinkingDelta:a=>{J+=a,i?.(J.trim(),a)},onStatus:a=>{j?.(a)},onResult:a=>{H=a},onToolStart:l,onToolResult:n});await x(s("claude"),C,{cwd:o,timeoutMs:f??Number(process.env.CLAUDE_CODE_TICK_TIMEOUT_MS||6e5),closeStdin:!0,env:D,onChunk:a=>{K(a),g?.(a)}});let L=F.join("").trim()||G.trim()||E.join("").trim()||H.trim();if(!L)throw Error("Claude Code returned no assistant text");return L}async function A({systemPrompt:a,userMessage:b,onChunk:c}){if(process.env.MADARX_MOCK_CODEX_RESPONSE)return process.env.MADARX_MOCK_CODEX_RESPONSE;let d=a?`${a}
 
-${b}`:b;return v(r("codex"),["exec",d],{timeoutMs:Number(process.env.CODEX_TICK_TIMEOUT_MS||18e4),closeStdin:!0,onChunk:c})}async function z({model:a,systemPrompt:b,userMessage:c,maxTokens:d=2048}){var e;let f=(e=await (0,j.chatWithClaude)([{role:"user",content:c}],b,[],{max_tokens:d,model:a}),(e?.content||[]).filter(a=>a?.type==="text"||"string"==typeof a?.text).map(a=>a.text||"").join("\n").trim());if(!f)throw Error("Anthropic returned no text");return f}function A(a){try{return!!a&&f.statSync(a).isDirectory()}catch{return!1}}async function B({agent:a,systemPrompt:b,userMessage:c,maxTokens:d=2048}){let e=n(a.engine),f=a.model||o(e);if("ollama"===e)return w({model:f,systemPrompt:b,userMessage:c,maxTokens:d});if("claude-code"===e){try{(0,l.Jh)()}catch{}let d=[l.un,l.nJ].filter(A);return x({model:f,systemPrompt:b,userMessage:c,cwd:function(){for(let a of[l.un,l.nJ,C,process.cwd()])if(A(a))return a;return process.cwd()}(),addDirs:d,agentId:a.id,agentName:a.name})}if("anthropic"===e)return z({model:f,systemPrompt:b,userMessage:c,maxTokens:d});if("codex"===e)return y({systemPrompt:b,userMessage:c});if("hermes"===e){let a=Error('The Hermes engine cannot run scheduled autonomous ticks yet — it has no governed tool loop, so a tick would only fabricate output. Switch this agent to the "Anthropic API" engine, or drive Hermes via its governed job tools (send_to_hermes / start_hermes_job) from the console.');throw a.code="engine_cannot_run_tools",a.engine="hermes",a}throw Error(`Unknown agent engine: ${a.engine}`)}d()}catch(a){d(a)}})},72550:(a,b,c)=>{"use strict";c.d(b,{Kd:()=>e});let d={google:{label:"Google",authorize_url:"https://accounts.google.com/o/oauth2/v2/auth",token_url:"https://oauth2.googleapis.com/token",pkce:!0,default_scopes:["openid","email"],extra_auth_params:{access_type:"offline",prompt:"consent"}},meta:{label:"Meta (Facebook/Instagram)",authorize_url:"https://www.facebook.com/v19.0/dialog/oauth",token_url:"https://graph.facebook.com/v19.0/oauth/access_token",pkce:!1,default_scopes:["public_profile"],extra_auth_params:{}},linkedin:{label:"LinkedIn",authorize_url:"https://www.linkedin.com/oauth/v2/authorization",token_url:"https://www.linkedin.com/oauth/v2/accessToken",pkce:!1,default_scopes:["r_liteprofile"],extra_auth_params:{}},tiktok:{label:"TikTok",authorize_url:"https://www.tiktok.com/v2/auth/authorize/",token_url:"https://open.tiktokapis.com/v2/oauth/token/",pkce:!0,default_scopes:["user.info.basic"],extra_auth_params:{}},hubspot:{label:"HubSpot",authorize_url:"https://app.hubspot.com/oauth/authorize",token_url:"https://api.hubapi.com/oauth/v1/token",pkce:!1,default_scopes:["oauth"],extra_auth_params:{}}};function e(a,b={}){let c=a&&d[a]?d[a]:null,f=b.authorize_url||c?.authorize_url||null,g=b.token_url||c?.token_url||null;if(!f||!g)return null;let h=Array.isArray(b.scopes)&&b.scopes.length?b.scopes.slice():(c?.default_scopes||[]).slice(),i="boolean"==typeof b.pkce?b.pkce:!!c?.pkce,j={...c?.extra_auth_params||{},...b.extra_auth_params&&"object"==typeof b.extra_auth_params?b.extra_auth_params:{}};return{provider:a||"custom",label:c?.label||a||"Custom provider",authorize_url:f,token_url:g,scopes:h,pkce:i,extra_auth_params:j}}},73066:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Kg:()=>k,kA:()=>l,v2:()=>j});var e=c(73024),f=c(76760),g=c(9381),h=c(61423),i=a([h]);h=(i.then?(await i)():i)[0];let m="artifacts";function j(a){var b;let c=null;return(c=a&&"object"==typeof a?a:(0,h.U1)(a||h.Sk)||null)?f.join((b=c,b?.folder_path?b.folder_path:b?.slug?(0,h.ct)(b.slug):(0,h.ct)(h.Sk)),m):f.join((0,h.ct)(h.Sk),m)}function k(a){let b=j(a);return e.mkdirSync(b,{recursive:!0}),b}function l(a){if(!a)return!1;let b=f.resolve(a);return[f.resolve(g.yQ),...function(){try{return(0,h.hF)({status:"all"}).map(a=>f.resolve(j(a)))}catch{return[]}}()].some(a=>b===a||b.startsWith(`${a}${f.sep}`))}d()}catch(a){d(a)}})},73662:(a,b,c)=>{"use strict";c.d(b,{nA:()=>g});let d=/^[a-z][a-z0-9-]{2,63}$/,e=/^\/[a-z][a-z0-9-]{1,63}$/;function f(a,b,c){a.push(`${b}: ${c}`)}function g(a,b={}){var c;let h,i=[],j=[];try{h=JSON.stringify(a)}catch{return{ok:!1,errors:["spec: not JSON-serialisable"],warnings:[],normalized:null}}if(!h||"undefined"===h)return{ok:!1,errors:["spec: required"],warnings:[],normalized:null};if(Buffer.byteLength(h,"utf8")>65536)return{ok:!1,errors:["spec: exceeds 64KB"],warnings:[],normalized:null};return null===a||"object"!=typeof a||Array.isArray(a)?{ok:!1,errors:["spec: must be an object"],warnings:[],normalized:null}:(a.slug&&"string"==typeof a.slug?d.test(a.slug)||f(i,"slug",`does not match ${d} (lowercase, starts with letter, 3-64 chars, [a-z0-9-])`):f(i,"slug","required (string)"),a.title&&"string"==typeof a.title||f(i,"title","required (non-empty string)"),null!=a.description&&"string"!=typeof a.description&&f(i,"description","must be a string"),a.markdown&&"string"==typeof a.markdown?a.markdown.length>1e5&&f(i,"markdown",`exceeds 100000 chars (got ${a.markdown.length})`):f(i,"markdown","required (non-empty string)"),null!=a.invocation&&("string"!=typeof a.invocation?f(i,"invocation","must be a string"):e.test(a.invocation)||f(i,"invocation",`must match ${e} (e.g. "/my-skill")`)),null!=a.trigger_examples&&(Array.isArray(a.trigger_examples)?a.trigger_examples.forEach((a,b)=>{"string"==typeof a&&a.trim()||f(i,`trigger_examples[${b}]`,"must be a non-empty string")}):f(i,"trigger_examples","must be an array of strings")),null!=a.category&&"string"!=typeof a.category&&f(i,"category","must be a string"),i.length>0)?{ok:!1,errors:i,warnings:j,normalized:null}:{ok:!0,errors:[],warnings:j,normalized:{slug:(c=a).slug,title:c.title,description:c.description||null,category:"string"==typeof c.category&&c.category?c.category:"authored",invocation:"string"==typeof c.invocation&&c.invocation?c.invocation:`/${c.slug}`,markdown:c.markdown,trigger_examples:Array.isArray(c.trigger_examples)?c.trigger_examples.filter(a=>"string"==typeof a&&a.trim()):[]}}}},73899:(a,b,c)=>{"use strict";function d(a,b=null){if(!a)return b;try{return JSON.parse(a)}catch{return b}}c.d(b,{lp:()=>g,oi:()=>d,qY:()=>h});let e=/mars|accent|primary|brand|red|orange|coral/i,f=/^#?(ffffff|000000|fff|0f0f11|111318|1a1817|f7f4ee|e8e8e5|dcdcd8)$/i;function g(a){let b=Array.isArray(a?.colors)?a.colors:[];if(0===b.length)return"#c2452a";let c=b.find(a=>e.test(a?.name||""));if(c?.value)return c.value;let d=b.find(a=>a?.value&&!f.test(a.value));return d?.value||b[0].value||"#c2452a"}function h(a){try{let b=a.prepare("SELECT slug FROM marketplace_items WHERE kind = 'agent'").all();return new Set(b.map(a=>a.slug))}catch{return new Set}}},73912:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{AB:()=>y,CS:()=>s,Io:()=>w,QM:()=>v,R1:()=>z,Ww:()=>x,dh:()=>q,mM:()=>u,uT:()=>p,vV:()=>r,xP:()=>t});var e=c(73024),f=c(76760),g=c(77598),h=c(34255),i=c(9381),j=c(61423),k=c(9001),l=a([h,j,k]);[h,j,k]=l.then?(await l)():l;let A=f.join(i.nJ,"disk");function m(a){return a?{...a}:null}function n(a){return a?{...a,local_only:1===a.local_only}:null}function o(a={}){try{(0,k.jO)("disk",a)}catch{}}function p(a){let b=(0,h.getDb)();return a?b.prepare("SELECT * FROM disk_folders WHERE project_id = ? ORDER BY path ASC").all(a).map(m):b.prepare("SELECT * FROM disk_folders ORDER BY path ASC").all().map(m)}function q(a){let b=(0,j.U1)(a);if(!b)throw Error("project not found");return(0,j.yK)(b.id,b.slug),m((0,h.getDb)().prepare("SELECT * FROM disk_folders WHERE project_id = ? AND parent_id IS NULL LIMIT 1").get(b.id))}function r(a,b,c){if("object"==typeof a&&a){let d=a;a=d.project_id||d.projectId,b=d.parent_id||d.parentId||null,c=d.name}let d=(0,j.U1)(a);if(!d)throw Error("project not found");let g=String(c||"").trim();if(!g)throw Error("name is required");let i=(0,h.getDb)(),k=b?i.prepare("SELECT * FROM disk_folders WHERE id = ?").get(b):q(d.id);if(!k)throw Error("parent folder not found");if(i.prepare("SELECT * FROM disk_folders WHERE project_id = ? AND parent_id = ? AND name = ? LIMIT 1").get(d.id,k.id,g)){let a=Error(`Folder "${g}" already exists.`);throw a.code="FOLDER_EXISTS",a}let l=`${k.path.replace(/\/$/,"")}/${g}/`,n=(0,h.nowIso)(),p=(0,h.newId)("df");try{i.prepare("INSERT INTO disk_folders (id, project_id, parent_id, name, path, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(p,d.id,k.id,g,l,n,n)}catch(a){if(String(a?.message||"").includes("UNIQUE constraint failed")){let a=Error(`Folder "${g}" already exists.`);throw a.code="FOLDER_EXISTS",a}throw a}let r=f.join(A,l.replace(/^\/+|\/+$/g,""));e.mkdirSync(r,{recursive:!0});let s=m(i.prepare("SELECT * FROM disk_folders WHERE id = ?").get(p));return o({project_id:d.id,folder_id:s?.id||p,action:"folder.create"}),s}function s(a={}){let b=(0,h.getDb)(),c=[],d=[];a.project_id&&(c.push("project_id = ?"),d.push(a.project_id)),a.folder_id&&(c.push("folder_id = ?"),d.push(a.folder_id));let e=`SELECT * FROM disk_files ${c.length?"WHERE "+c.join(" AND "):""} ORDER BY updated_at DESC`;return b.prepare(e).all(...d).map(n)}function t(){let a=(0,h.getDb)().prepare(`SELECT project_id, COUNT(*) AS count
+${b}`:b;return x(s("codex"),["exec",d],{timeoutMs:Number(process.env.CODEX_TICK_TIMEOUT_MS||18e4),closeStdin:!0,onChunk:c})}async function B({model:a,systemPrompt:b,userMessage:c,maxTokens:d=2048}){var e;let f=(e=await (0,j.chatWithClaude)([{role:"user",content:c}],b,[],{max_tokens:d,model:a}),(e?.content||[]).filter(a=>a?.type==="text"||"string"==typeof a?.text).map(a=>a.text||"").join("\n").trim());if(!f)throw Error("Anthropic returned no text");return f}function C(a){try{return!!a&&f.statSync(a).isDirectory()}catch{return!1}}async function D({agent:a,systemPrompt:b,userMessage:c,maxTokens:d=2048}){let e=o(a.engine),f=a.model||p(e);if("ollama"===e)return y({model:f,systemPrompt:b,userMessage:c,maxTokens:d});if("claude-code"===e){try{(0,l.Jh)()}catch{}let d=[l.un,l.nJ].filter(C);return z({model:f,systemPrompt:b,userMessage:c,cwd:function(){for(let a of[l.un,l.nJ,F,process.cwd()])if(C(a))return a;return process.cwd()}(),addDirs:d,agentId:a.id,agentName:a.name})}if("anthropic"===e)return B({model:f,systemPrompt:b,userMessage:c,maxTokens:d});if("codex"===e)return A({systemPrompt:b,userMessage:c});if("hermes"===e){let a=Error('The Hermes engine cannot run scheduled autonomous ticks yet — it has no governed tool loop, so a tick would only fabricate output. Switch this agent to the "Anthropic API" engine, or drive Hermes via its governed job tools (send_to_hermes / start_hermes_job) from the console.');throw a.code="engine_cannot_run_tools",a.engine="hermes",a}throw Error(`Unknown agent engine: ${a.engine}`)}d()}catch(a){d(a)}})},72550:(a,b,c)=>{"use strict";c.d(b,{Kd:()=>e});let d={google:{label:"Google",authorize_url:"https://accounts.google.com/o/oauth2/v2/auth",token_url:"https://oauth2.googleapis.com/token",pkce:!0,default_scopes:["openid","email"],extra_auth_params:{access_type:"offline",prompt:"consent"}},meta:{label:"Meta (Facebook/Instagram)",authorize_url:"https://www.facebook.com/v19.0/dialog/oauth",token_url:"https://graph.facebook.com/v19.0/oauth/access_token",pkce:!1,default_scopes:["public_profile"],extra_auth_params:{}},linkedin:{label:"LinkedIn",authorize_url:"https://www.linkedin.com/oauth/v2/authorization",token_url:"https://www.linkedin.com/oauth/v2/accessToken",pkce:!1,default_scopes:["r_liteprofile"],extra_auth_params:{}},tiktok:{label:"TikTok",authorize_url:"https://www.tiktok.com/v2/auth/authorize/",token_url:"https://open.tiktokapis.com/v2/oauth/token/",pkce:!0,default_scopes:["user.info.basic"],extra_auth_params:{}},hubspot:{label:"HubSpot",authorize_url:"https://app.hubspot.com/oauth/authorize",token_url:"https://api.hubapi.com/oauth/v1/token",pkce:!1,default_scopes:["oauth"],extra_auth_params:{}}};function e(a,b={}){let c=a&&d[a]?d[a]:null,f=b.authorize_url||c?.authorize_url||null,g=b.token_url||c?.token_url||null;if(!f||!g)return null;let h=Array.isArray(b.scopes)&&b.scopes.length?b.scopes.slice():(c?.default_scopes||[]).slice(),i="boolean"==typeof b.pkce?b.pkce:!!c?.pkce,j={...c?.extra_auth_params||{},...b.extra_auth_params&&"object"==typeof b.extra_auth_params?b.extra_auth_params:{}};return{provider:a||"custom",label:c?.label||a||"Custom provider",authorize_url:f,token_url:g,scopes:h,pkce:i,extra_auth_params:j}}},73066:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Kg:()=>k,kA:()=>l,v2:()=>j});var e=c(73024),f=c(76760),g=c(9381),h=c(61423),i=a([h]);h=(i.then?(await i)():i)[0];let m="artifacts";function j(a){var b;let c=null;return(c=a&&"object"==typeof a?a:(0,h.U1)(a||h.Sk)||null)?f.join((b=c,b?.folder_path?b.folder_path:b?.slug?(0,h.ct)(b.slug):(0,h.ct)(h.Sk)),m):f.join((0,h.ct)(h.Sk),m)}function k(a){let b=j(a);return e.mkdirSync(b,{recursive:!0}),b}function l(a){if(!a)return!1;let b=f.resolve(a);return[f.resolve(g.yQ),...function(){try{return(0,h.hF)({status:"all"}).map(a=>f.resolve(j(a)))}catch{return[]}}()].some(a=>b===a||b.startsWith(`${a}${f.sep}`))}d()}catch(a){d(a)}})},73662:(a,b,c)=>{"use strict";c.d(b,{nA:()=>g});let d=/^[a-z][a-z0-9-]{2,63}$/,e=/^\/[a-z][a-z0-9-]{1,63}$/;function f(a,b,c){a.push(`${b}: ${c}`)}function g(a,b={}){var c;let h,i=[],j=[];try{h=JSON.stringify(a)}catch{return{ok:!1,errors:["spec: not JSON-serialisable"],warnings:[],normalized:null}}if(!h||"undefined"===h)return{ok:!1,errors:["spec: required"],warnings:[],normalized:null};if(Buffer.byteLength(h,"utf8")>65536)return{ok:!1,errors:["spec: exceeds 64KB"],warnings:[],normalized:null};return null===a||"object"!=typeof a||Array.isArray(a)?{ok:!1,errors:["spec: must be an object"],warnings:[],normalized:null}:(a.slug&&"string"==typeof a.slug?d.test(a.slug)||f(i,"slug",`does not match ${d} (lowercase, starts with letter, 3-64 chars, [a-z0-9-])`):f(i,"slug","required (string)"),a.title&&"string"==typeof a.title||f(i,"title","required (non-empty string)"),null!=a.description&&"string"!=typeof a.description&&f(i,"description","must be a string"),a.markdown&&"string"==typeof a.markdown?a.markdown.length>1e5&&f(i,"markdown",`exceeds 100000 chars (got ${a.markdown.length})`):f(i,"markdown","required (non-empty string)"),null!=a.invocation&&("string"!=typeof a.invocation?f(i,"invocation","must be a string"):e.test(a.invocation)||f(i,"invocation",`must match ${e} (e.g. "/my-skill")`)),null!=a.trigger_examples&&(Array.isArray(a.trigger_examples)?a.trigger_examples.forEach((a,b)=>{"string"==typeof a&&a.trim()||f(i,`trigger_examples[${b}]`,"must be a non-empty string")}):f(i,"trigger_examples","must be an array of strings")),null!=a.category&&"string"!=typeof a.category&&f(i,"category","must be a string"),i.length>0)?{ok:!1,errors:i,warnings:j,normalized:null}:{ok:!0,errors:[],warnings:j,normalized:{slug:(c=a).slug,title:c.title,description:c.description||null,category:"string"==typeof c.category&&c.category?c.category:"authored",invocation:"string"==typeof c.invocation&&c.invocation?c.invocation:`/${c.slug}`,markdown:c.markdown,trigger_examples:Array.isArray(c.trigger_examples)?c.trigger_examples.filter(a=>"string"==typeof a&&a.trim()):[]}}}},73899:(a,b,c)=>{"use strict";function d(a,b=null){if(!a)return b;try{return JSON.parse(a)}catch{return b}}c.d(b,{lp:()=>g,oi:()=>d,qY:()=>h});let e=/mars|accent|primary|brand|red|orange|coral/i,f=/^#?(ffffff|000000|fff|0f0f11|111318|1a1817|f7f4ee|e8e8e5|dcdcd8)$/i;function g(a){let b=Array.isArray(a?.colors)?a.colors:[];if(0===b.length)return"#c2452a";let c=b.find(a=>e.test(a?.name||""));if(c?.value)return c.value;let d=b.find(a=>a?.value&&!f.test(a.value));return d?.value||b[0].value||"#c2452a"}function h(a){try{let b=a.prepare("SELECT slug FROM marketplace_items WHERE kind = 'agent'").all();return new Set(b.map(a=>a.slug))}catch{return new Set}}},73912:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{AB:()=>y,CS:()=>s,Io:()=>w,QM:()=>v,R1:()=>z,Ww:()=>x,dh:()=>q,mM:()=>u,uT:()=>p,vV:()=>r,xP:()=>t});var e=c(73024),f=c(76760),g=c(77598),h=c(34255),i=c(9381),j=c(61423),k=c(9001),l=a([h,j,k]);[h,j,k]=l.then?(await l)():l;let A=f.join(i.nJ,"disk");function m(a){return a?{...a}:null}function n(a){return a?{...a,local_only:1===a.local_only}:null}function o(a={}){try{(0,k.jO)("disk",a)}catch{}}function p(a){let b=(0,h.getDb)();return a?b.prepare("SELECT * FROM disk_folders WHERE project_id = ? ORDER BY path ASC").all(a).map(m):b.prepare("SELECT * FROM disk_folders ORDER BY path ASC").all().map(m)}function q(a){let b=(0,j.U1)(a);if(!b)throw Error("project not found");return(0,j.yK)(b.id,b.slug),m((0,h.getDb)().prepare("SELECT * FROM disk_folders WHERE project_id = ? AND parent_id IS NULL LIMIT 1").get(b.id))}function r(a,b,c){if("object"==typeof a&&a){let d=a;a=d.project_id||d.projectId,b=d.parent_id||d.parentId||null,c=d.name}let d=(0,j.U1)(a);if(!d)throw Error("project not found");let g=String(c||"").trim();if(!g)throw Error("name is required");let i=(0,h.getDb)(),k=b?i.prepare("SELECT * FROM disk_folders WHERE id = ?").get(b):q(d.id);if(!k)throw Error("parent folder not found");if(i.prepare("SELECT * FROM disk_folders WHERE project_id = ? AND parent_id = ? AND name = ? LIMIT 1").get(d.id,k.id,g)){let a=Error(`Folder "${g}" already exists.`);throw a.code="FOLDER_EXISTS",a}let l=`${k.path.replace(/\/$/,"")}/${g}/`,n=(0,h.nowIso)(),p=(0,h.newId)("df");try{i.prepare("INSERT INTO disk_folders (id, project_id, parent_id, name, path, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)").run(p,d.id,k.id,g,l,n,n)}catch(a){if(String(a?.message||"").includes("UNIQUE constraint failed")){let a=Error(`Folder "${g}" already exists.`);throw a.code="FOLDER_EXISTS",a}throw a}let r=f.join(A,l.replace(/^\/+|\/+$/g,""));e.mkdirSync(r,{recursive:!0});let s=m(i.prepare("SELECT * FROM disk_folders WHERE id = ?").get(p));return o({project_id:d.id,folder_id:s?.id||p,action:"folder.create"}),s}function s(a={}){let b=(0,h.getDb)(),c=[],d=[];a.project_id&&(c.push("project_id = ?"),d.push(a.project_id)),a.folder_id&&(c.push("folder_id = ?"),d.push(a.folder_id));let e=`SELECT * FROM disk_files ${c.length?"WHERE "+c.join(" AND "):""} ORDER BY updated_at DESC`;return b.prepare(e).all(...d).map(n)}function t(){let a=(0,h.getDb)().prepare(`SELECT project_id, COUNT(*) AS count
        FROM disk_files
       WHERE project_id IS NOT NULL
       GROUP BY project_id`).all(),b=Object.create(null);for(let c of a)b[c.project_id]=c.count;return b}function u(a){return n((0,h.getDb)().prepare("SELECT * FROM disk_files WHERE id = ?").get(a))}function v(a,b,c,d={}){if("object"==typeof a&&a){let e=a;a=e.project_id||e.projectId,b=e.folder_id||e.folderId||null,c={name:e.name,content:e.content||e.buffer||"",type:e.mime_type||e.type||""},d={...e,local_only:e.local_only}}let i=(0,j.U1)(a);if(!i)throw Error("project not found");let k=b?(0,h.getDb)().prepare("SELECT * FROM disk_folders WHERE id = ?").get(b):q(i.id);if(!k)throw Error("folder not found");let l=Buffer.isBuffer(c?.buffer)?c.buffer:Buffer.from(c?.content||""),m=String(c?.name||d.name||"upload.bin").replace(/[\\/]+/g,"-"),n=g.createHash("sha256").update(l).digest("hex"),p=f.join(A,k.path.replace(/^\/+|\/+$/g,""));e.mkdirSync(p,{recursive:!0});let r=f.join(p,`${n.slice(0,12)}-${m}`);e.existsSync(r)||e.writeFileSync(r,l);let s=(0,h.nowIso)(),t=(0,h.newId)("file");(0,h.getDb)().prepare("INSERT INTO disk_files (id, project_id, folder_id, name, kind, mime_type, size_bytes, sha256, storage_path, local_only, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").run(t,i.id,k.id,m,function(a,b=""){let c=f.extname(a||"").toLowerCase();return[".md",".markdown"].includes(c)?"md":".pdf"===c?"pdf":[".mp3",".wav",".m4a",".ogg",".webm"].includes(c)||b.startsWith("audio/")?"audio":[".png",".jpg",".jpeg",".webp",".gif"].includes(c)||b.startsWith("image/")?"image":[".txt",".csv",".json",".yaml",".yml"].includes(c)||b.startsWith("text/")?"text":"other"}(m,c?.type||d.mime_type||""),c?.type||d.mime_type||null,l.length,n,r,+!!d.local_only,s,s);let w=u(t);try{(0,j.Ip)(i.id,{action:"project.file.uploaded",title:`Uploaded ${m}`,summary:`Attached ${m} to the project folder`,status:"complete",source:"disk",details:{file_id:t,folder_id:k.id,kind:w.kind,size_bytes:w.size_bytes,local_only:w.local_only}})}catch{}return o({project_id:i.id,folder_id:k.id,file_id:t,action:"file.upload"}),w}function w(a,b={}){let c=["name","folder_id","local_only"],d=Object.entries(b).filter(([a,b])=>c.includes(a)&&void 0!==b);if(!d.length)return u(a);let e=d.map(([a])=>`${a} = ?`).concat("updated_at = ?").join(", "),f=d.map(([a,b])=>"local_only"===a?+!!b:b).concat((0,h.nowIso)(),a);(0,h.getDb)().prepare(`UPDATE disk_files SET ${e} WHERE id = ?`).run(...f);let g=u(a);return o({project_id:g?.project_id||null,folder_id:g?.folder_id||null,file_id:a,action:"file.update"}),g}function x(a){let b=u(a);if(!b)return!1;(0,h.getDb)().prepare("DELETE FROM disk_files WHERE id = ?").run(a);try{e.unlinkSync(b.storage_path)}catch{}return o({project_id:b.project_id,folder_id:b.folder_id||null,file_id:a,action:"file.delete"}),!0}function y(a,b){if(!b)throw Error("engine parameter required");let c=u(a);if(!c)throw Error("file not found");return c.local_only&&!["ollama","local_whisper"].includes(String(b))?{...c,content:"<redacted: local_only>",redacted:!0}:{...c,content:e.readFileSync(c.storage_path,"utf8"),redacted:!1}}function z(a,b){let c=y(a,b);if(c.redacted){let a=Error("local_only: engine not permitted");throw a.code="LOCAL_ONLY_DENIED",a}return c.storage_path}d()}catch(a){d(a)}})},78335:()=>{},78708:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{$A:()=>n,Ac:()=>j,FT:()=>k,N3:()=>q,Us:()=>m,f3:()=>o,uS:()=>p});var e=c(76760),f=c(73024),g=c(34255),h=c(9381),i=a([g]);g=(i.then?(await i)():i)[0];let p=e.join(h.un,"generated-clis"),q=e.join(h.un,"skills","printing-press");e.join(h.nJ,"printing-press-clis.json");let r=/^[a-z0-9][a-z0-9-]{0,63}$/;function j(a){return"string"==typeof a&&r.test(a)}function k(a){let b=e.resolve(a),c=e.resolve(p);if(!b.startsWith(c+e.sep)&&b!==c)throw Error(`Path is not under workspace/generated-clis/: ${a}`);return b}function l(a){if(!a)return null;let b=null,c=[],d=[];try{b=a.manifest_json?JSON.parse(a.manifest_json):null}catch{b=null}try{c=a.declared_scopes?JSON.parse(a.declared_scopes):[]}catch{c=[]}try{d=a.required_secrets?JSON.parse(a.required_secrets):[]}catch{d=[]}return{slug:a.slug,source_kind:a.source_kind,source_url:a.source_url||null,installed_at:a.installed_at,updated_at:a.updated_at,path:a.path,declared_scopes:c,required_secrets:d,quota_bytes:a.quota_bytes||0x6400000,manifest:b,status:a.status}}function m({includeRemoved:a=!1}={}){let b=(0,g.getDb)();return(a?b.prepare("SELECT * FROM printing_press_clis ORDER BY installed_at DESC").all():b.prepare("SELECT * FROM printing_press_clis WHERE status != 'removed' ORDER BY installed_at DESC").all()).map(l)}function n(a){if(!j(a))return null;let b=(0,g.getDb)().prepare("SELECT * FROM printing_press_clis WHERE slug = ?").get(a);return l(b)}function o(a){let b=n(a);if(!b)return null;try{return{slug:a,bytes:function a(b){if(!f.existsSync(b))return 0;let c=0;for(let d of f.readdirSync(b,{withFileTypes:!0})){let g=e.join(b,d.name);if(d.isDirectory())c+=a(g);else if(d.isFile())try{c+=f.statSync(g).size}catch{}}return c}(b.path),quota_bytes:b.quota_bytes}}catch{return{slug:a,bytes:0,quota_bytes:b.quota_bytes,error:"measure_failed"}}}d()}catch(a){d(a)}})},79133:(a,b,c)=>{"use strict";c.d(b,{A5:()=>j,Pf:()=>h,decryptFromDiskBuffer:()=>k});var d=c(77598),e=c(87181);let f=Buffer.from("madarx-artifact-dek-v1"),g="1"===process.env.MADARX_ARTIFACT_ENCRYPTION;function h(){return g}function i(a){if(!a)throw Error("deriveOrgDek requires orgId");let b=(0,d.createHash)("sha256").update(a).digest(),c=(0,e.K2)({allowGenerate:!0});return Buffer.from((0,d.hkdfSync)("sha256",c,b,f,32))}function j(a,b){let{ciphertext:c,iv:e,authTag:f}=function(a,b){let c=i(a),e=(0,d.randomBytes)(12),f=(0,d.createCipheriv)("aes-256-gcm",c,e),g=Buffer.isBuffer(b)?b:Buffer.from(b,"utf8");return{ciphertext:Buffer.concat([f.update(g),f.final()]),iv:e,authTag:f.getAuthTag()}}(a,b);return Buffer.concat([e,f,c])}function k(a,b){if(!Buffer.isBuffer(b)||b.length<28)throw Error("Invalid encrypted artifact: too short");let c=b.subarray(0,12),e=b.subarray(12,28),f=b.subarray(28),g=i(a),h=(0,d.createDecipheriv)("aes-256-gcm",g,c);return h.setAuthTag(e),Buffer.concat([h.update(f),h.final()])}},79278:(a,b,c)=>{"use strict";c.d(b,{Pw:()=>o,pE:()=>f});let d=/^[a-z][a-z0-9-]{2,63}$/,e=new Set(["bearer","api_key","basic","oauth2","none"]),f=["low","medium","high","irreversible_external"],g=new Set(["GET","POST","PUT","PATCH","DELETE"]),h=new Set(["POST","PUT","PATCH","DELETE"]),i=/^[a-z][a-z0-9_]{0,63}$/,j=/^[A-Z][A-Z0-9_]{1,63}$/,k=new Set(["token","key","secret","password","value","api_key","bearer","credentials","access_token","refresh_token","client_id","client_secret"]);function l(a,b,c){a.push(`${b}: ${c}`)}function m(a){return null!==a&&"object"==typeof a&&!Array.isArray(a)}function n(a){return f.indexOf(a)}function o(a,b={}){let c,p=[],q=[];try{c=JSON.stringify(a)}catch{return{ok:!1,errors:["manifest: not JSON-serialisable"],warnings:[],normalized:null}}if(!c||"undefined"===c)return{ok:!1,errors:["manifest: required"],warnings:[],normalized:null};if(Buffer.byteLength(c,"utf8")>65536)return{ok:!1,errors:[`manifest: serialized length ${Buffer.byteLength(c,"utf8")} bytes exceeds 65536-byte cap`],warnings:[],normalized:null};if(!m(a))return{ok:!1,errors:["manifest: must be a plain object"],warnings:[],normalized:null};a.slug&&"string"==typeof a.slug?d.test(a.slug)||l(p,"slug",`does not match ${d} (lowercase, starts with letter, 3-64 chars, hyphens allowed)`):l(p,"slug","required (string)"),null!=a.title&&"string"!=typeof a.title&&l(p,"title","must be a string");let r=null;if(a.base_url&&"string"==typeof a.base_url){let b;try{b=new URL(a.base_url)}catch{l(p,"base_url","must be a valid URL")}b&&("https:"!==b.protocol&&l(p,"base_url","must be https"),r=b.hostname.toLowerCase())}else l(p,"base_url","required (string)");let s=[];if(Array.isArray(a.allowed_hosts)&&0!==a.allowed_hosts.length?((s=a.allowed_hosts.map(a=>"string"==typeof a?a.toLowerCase():a)).forEach((a,b)=>{if("string"!=typeof a||!a)return void l(p,`allowed_hosts[${b}]`,"must be a non-empty string");(function(a){if(!a)return!1;let b=String(a).toLowerCase().replace(/^\[|\]$/g,"");if("localhost"===b||"::1"===b||b.endsWith(".localhost")||b.endsWith(".local"))return!0;if(b.includes(":"))return!!(b.startsWith("fc")||b.startsWith("fd")||b.startsWith("fe80:"))||"::"===b;let c=b.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);if(!c)return!1;let[d,e]=[Number(c[1]),Number(c[2])];return 10===d||127===d||0===d||169===d&&254===e||192===d&&168===e||172===d&&!!(e>=16)&&!!(e<=31)})(a)&&l(p,`allowed_hosts[${b}]`,`private/local hosts are not allowed ('${a}')`)}),r&&!s.includes(r)&&l(p,"allowed_hosts",`must include base_url host '${r}'`)):l(p,"allowed_hosts","required (non-empty array of host strings)"),!function(a,b){if(!m(a))return l(b,"auth","required (plain object)");for(let c of(a.type&&e.has(a.type)||l(b,"auth.type",`must be one of ${[...e].join(", ")}`),Object.keys(a)))k.has(c.toLowerCase())&&l(b,"auth",`raw secrets are not allowed; reference by *_ref only (found field '${c}')`);let c=a.type;if(("bearer"===c||"api_key"===c)&&(a.secret_ref&&"string"==typeof a.secret_ref?j.test(a.secret_ref)||l(b,"auth.secret_ref",`must match ${j} (uppercase, starts with letter, underscores/digits, max 64 chars)`):l(b,"auth.secret_ref","required for bearer/api_key auth (string)")),"basic"===c&&(a.username_ref&&"string"==typeof a.username_ref?j.test(a.username_ref)||l(b,"auth.username_ref",`must match ${j}`):l(b,"auth.username_ref","required for basic auth (string)"),a.password_ref&&"string"==typeof a.password_ref?j.test(a.password_ref)||l(b,"auth.password_ref",`must match ${j}`):l(b,"auth.password_ref","required for basic auth (string)")),"oauth2"===c){for(let c of(a.access_token_ref&&"string"==typeof a.access_token_ref?j.test(a.access_token_ref)||l(b,"auth.access_token_ref",`must match ${j}`):l(b,"auth.access_token_ref","required for oauth2 auth (vault ref)"),["refresh_token_ref","client_id_ref","client_secret_ref"]))null!=a[c]&&("string"==typeof a[c]&&j.test(a[c])||l(b,`auth.${c}`,`must match ${j}`));if(null!=a.token_url){let c=!1;try{c="https:"===new URL(a.token_url).protocol}catch{c=!1}c||l(b,"auth.token_url","must be a valid https URL")}}}(a.auth,p),null!=a.default_headers&&function(a,b){if(!m(a))return l(b,"default_headers","must be a plain object");for(let[c,d]of Object.entries(a))"string"!=typeof d&&l(b,`default_headers.${c}`,"header value must be a string"),/authorization/i.test(c)&&l(b,"default_headers",`must not set Authorization (use auth); found header '${c}'`)}(a.default_headers,p),!m(a.endpoints)||0===Object.keys(a.endpoints).length)return l(p,"endpoints","required (non-empty plain object)"),{ok:!1,errors:p,warnings:q,normalized:null};let t=Object.entries(a.endpoints);if(t.length>50)return l(p,"endpoints","exceeds 50 endpoint cap"),{ok:!1,errors:p,warnings:q,normalized:null};let u={};for(let[a,b]of t){let c=`endpoints.${a}`;i.test(a)||l(p,c,`endpoint name must match ${i}`);let d=function(a,b,c){let d;if(!m(a))return l(b,c,"must be a plain object"),null;if(a.method&&g.has(a.method)||l(b,`${c}.method`,`must be one of ${[...g].join(", ")} (uppercase)`),a.path&&"string"==typeof a.path)if(a.path.startsWith("/"))for(let d of function(a){let b,c=[],d=/\{([^}]+)\}/g;for(;null!==(b=d.exec(a));)c.push(b[1]);return c}(a.path))/^[a-z][a-z0-9_]*$/.test(d)||l(b,`${c}.path`,`placeholder '{${d}}' must match /^[a-z][a-z0-9_]*$/`);else l(b,`${c}.path`,"must start with '/'");else l(b,`${c}.path`,"required (string starting with /)");null!=a.description&&"string"!=typeof a.description&&l(b,`${c}.description`,"must be a string"),null==a.input_schema||m(a.input_schema)||l(b,`${c}.input_schema`,"must be a plain object");let e=a.method,i=h.has(e),j=a.risk,k=!1;return null==j||f.includes(j)||(l(b,`${c}.risk`,`must be one of ${f.join(", ")}`),j=void 0),null==j?d=i?"medium":"low":i&&n(j)<n("medium")?(d="medium",k=!0):d=j,{effectiveRisk:d,clampWarning:k}}(b,p,c);if(d){let{effectiveRisk:e,clampWarning:f}=d;f&&q.push(`${c}.risk: clamped low→medium for write method`),u[a]={method:b.method,path:b.path??null,risk:e,input_schema:null!=b.input_schema?structuredClone(b.input_schema):null,description:b.description??null}}}if(p.length>0)return{ok:!1,errors:p,warnings:q,normalized:null};let v={},w=new Set(["type","header","prefix","query_param","secret_ref","username_ref","password_ref","access_token_ref","refresh_token_ref","client_id_ref","client_secret_ref","token_url","provider"]);for(let[b,c]of Object.entries(a.auth))w.has(b)&&(v[b]=c);return{ok:!0,errors:[],warnings:q,normalized:{slug:a.slug,title:a.title??null,base_url:a.base_url,allowed_hosts:s,auth:v,default_headers:null!=a.default_headers?structuredClone(a.default_headers):{},endpoints:u}}}},80987:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Cw:()=>s,ID:()=>r,VC:()=>t,gE:()=>q});var e=c(31421),f=c(76760),g=c(73024),h=c(80099),i=c(9381),j=c(78708),k=c(41249),l=c(24516),m=a([j,l]);[j,l]=m.then?(await m)():m;let u=f.join(i.Dl,"scripts","printing-press"),v=f.join(u,"install.mjs"),w=f.join(u,"install-cli.mjs");function n(){return(0,k.Qw)((0,k.U5)())}function o(a,b,{cwd:c,timeoutMs:d,env:f}={}){return new Promise((g,h)=>{let i=(0,e.spawn)(a,b,{cwd:c,shell:!1,env:f||{PATH:process.env.PATH,HOME:process.env.HOME,NODE_ENV:"production"}}),j=Buffer.alloc(0),k=Buffer.alloc(0),l=!1,m=!1,n=!1,o=setTimeout(()=>{n=!0;try{i.kill("SIGKILL")}catch{}},d||6e4);i.stdout.on("data",a=>{j.length+a.length>262144?(j=Buffer.concat([j,a.slice(0,262144-j.length)]),l=!0):j=Buffer.concat([j,a])}),i.stderr.on("data",a=>{k.length+a.length>262144?(k=Buffer.concat([k,a.slice(0,262144-k.length)]),m=!0):k=Buffer.concat([k,a])}),i.on("error",a=>{clearTimeout(o),h(a)}),i.on("close",(a,b)=>{clearTimeout(o),g({exit_code:a,signal:b,timed_out:n,stdout:j.toString("utf8"),stderr:k.toString("utf8"),stdout_truncated:l,stderr_truncated:m})})})}function p(a){return(a?.declared_scopes||[]).some(a=>"string"==typeof a&&/write|mutate|delete|push/i.test(a))}async function q(a={},b={}){let c=n();if(!g.existsSync(u))return{ok:!1,status:"misconfigured",reason:`sub-package missing at ${u}`};let d=await o("node",[v],{cwd:u,timeoutMs:3e5});return d.timed_out?{ok:!1,status:"timeout",stderr:d.stderr}:0!==d.exit_code?{ok:!1,status:"failed",exit_code:d.exit_code,stderr:d.stderr,security_mode:c.mode}:{ok:!0,status:"installed",skills_dir:j.N3,security_mode:c.mode,stdout_tail:d.stdout.slice(-1024)}}async function r(a={},b={}){let c=n(),d=String(a.slug||"").trim();if(!(0,j.Ac)(d))return{ok:!1,status:"invalid_input",reason:"slug must match /^[a-z0-9][a-z0-9-]{0,63}$/"};let e=String(a.source||"starter-pack"),g=new Set(["starter-pack","github","local","spec"]);if(!g.has(e))return{ok:!1,status:"invalid_input",reason:`source must be one of ${[...g].join(", ")}`};let h=a.source_url?String(a.source_url):null;if("starter-pack"!==e&&!h)return{ok:!1,status:"invalid_input",reason:`source_url required when source=${e}`};let i=f.join(j.uS,d);try{(0,j.FT)(i)}catch(a){return{ok:!1,status:"unsafe_path",reason:a.message}}let k=[w,d,"--source",e];h&&k.push("--source-url",h);let l=await o("node",k,{cwd:u,timeoutMs:3e5});if(l.timed_out)return{ok:!1,status:"timeout",stderr:l.stderr};if(0!==l.exit_code)return{ok:!1,status:"failed",exit_code:l.exit_code,stderr:l.stderr};let m=(0,j.$A)(d);return m&&p(m)&&!c.allow_network_write_clis?{ok:!1,status:"refused",reason:`Security mode "${c.mode}" forbids CLIs declaring write scopes. Declared: ${JSON.stringify(m.declared_scopes)}`,cli:m}:{ok:!0,status:"generated",cli:m,security_mode:c.mode}}async function s(a={},b={}){let c,d,e=n(),h=String(a.slug||"").trim();if(!(0,j.Ac)(h))return{ok:!1,status:"invalid_input",reason:"invalid slug"};let i=(0,j.$A)(h);if(!i||"removed"===i.status)return{ok:!1,status:"not_installed",slug:h};if("disabled"===i.status)return{ok:!1,status:"disabled",slug:h};if(p(i)&&!e.allow_network_write_clis)return{ok:!1,status:"refused",reason:`Security mode "${e.mode}" forbids running CLIs with write scopes.`};let k=Array.isArray(a.args)?a.args.map(String):[];for(let a of k)if(/[;&|`$<>]/.test(a))return{ok:!1,status:"unsafe_args",reason:`argv contains shell metacharacter: ${a}`};try{(0,j.FT)(i.path)}catch(a){return{ok:!1,status:"unsafe_path",reason:a.message}}let m=process.env.GOBIN||(process.env.GOPATH?`${process.env.GOPATH}/bin`:null)||(process.env.HOME?`${process.env.HOME}/go/bin`:null),q=m?f.join(m,`${h}-pp-cli`):null,r=f.join(i.path,"bin"),t=f.join(i.path,"index.js");if(q&&g.existsSync(q))c=q,d=k;else if(g.existsSync(r))c=r,d=k;else{if(!g.existsSync(t))return{ok:!1,status:"no_entry_point",reason:`No entry point found. Tried: ${q||"(no go bin dir)"} , ${r}, ${t}`};c=process.execPath,d=[t,...k]}let u=function(a,b={}){let c={PATH:process.env.PATH,HOME:process.env.HOME,NODE_ENV:"production",PRINTING_PRESS_CLI_SLUG:a.slug,PRINTING_PRESS_DATA_DIR:a.path};for(let d of a.required_secrets||[])if("string"==typeof d&&/^[A-Z][A-Z0-9_]*$/.test(d))try{let a=(0,l.getSecret)(d,{agent_id:b.agent_id,project_id:b.project_id});a&&(c[d]=a)}catch{}return c}(i,b),v=Math.min(Number(a.timeout_ms)||6e4,3e5),w=await o(c,d,{cwd:i.path,timeoutMs:v,env:u});return{ok:0===w.exit_code,status:w.timed_out?"timeout":0===w.exit_code?"complete":"failed",slug:h,exit_code:w.exit_code,timed_out:w.timed_out,stdout:w.stdout,stderr:w.stderr,stdout_truncated:w.stdout_truncated,stderr_truncated:w.stderr_truncated,security_mode:e.mode}}let x=/\b(INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|REPLACE|ATTACH|DETACH|PRAGMA|VACUUM|REINDEX|TRUNCATE)\b/i;async function t(a={},b={}){let c,d=String(a.slug||"").trim();if(!(0,j.Ac)(d))return{ok:!1,status:"invalid_input",reason:"invalid slug"};let e=(0,j.$A)(d);if(!e||"removed"===e.status)return{ok:!1,status:"not_installed",slug:d};let i=String(a.sql||"").trim();if(!i)return{ok:!1,status:"invalid_input",reason:"sql is required"};if(i.includes(";"))return{ok:!1,status:"unsafe_sql",reason:"multi-statement queries are not allowed"};if(x.test(i))return{ok:!1,status:"unsafe_sql",reason:"only SELECT-style read queries are permitted"};if(!/^\s*(SELECT|WITH)\b/i.test(i))return{ok:!1,status:"unsafe_sql",reason:"query must begin with SELECT or WITH"};let k=process.env.XDG_DATA_HOME||(process.env.HOME?f.join(process.env.HOME,".local","share"):null),l=[f.join(e.path,"data.sqlite"),f.join(e.path,`${d}.sqlite`),k?f.join(k,`${d}-pp-cli`,"data.db"):null,k?f.join(k,`${d}-pp-cli`,"data.sqlite"):null].filter(Boolean),m=l.find(a=>g.existsSync(a));if(!m)return{ok:!1,status:"no_mirror",reason:"CLI has no local SQLite mirror",tried:l};if(m.startsWith(f.resolve(e.path)+f.sep))try{(0,j.FT)(m)}catch(a){return{ok:!1,status:"unsafe_path",reason:a.message}}let n=Array.isArray(a.params)?a.params:[];try{c=new h.DatabaseSync(m,{readOnly:!0})}catch(a){return{ok:!1,status:"open_failed",reason:a.message}}try{let a=c.prepare(i).all(...n).slice(0,1e3);return{ok:!0,status:"complete",slug:d,row_count:a.length,truncated:1e3===a.length,rows:a}}catch(a){return{ok:!1,status:"query_failed",reason:a.message}}finally{try{c.close()}catch{}}}d()}catch(a){d(a)}})},81553:(a,b,c)=>{"use strict";c.d(b,{YO:()=>j,ct:()=>m,mU:()=>k,rd:()=>g,runUpdateCheck:()=>n,shouldAutoApply:()=>o});var d=c(73024),e=c(76760),f=c(73136);let g="madarx",h=`https://registry.npmjs.org/${g}/latest`,i=e.dirname((0,f.fileURLToPath)("file:///home/runner/work/madarx-os/madarx-os/lib/update-check.js"));function j(){if(process.env.MADARX_VERSION)return process.env.MADARX_VERSION;for(let a of[e.join(i,"..","package.json"),e.join(process.cwd(),"package.json"),e.join(process.cwd(),".next","standalone","package.json")]){let b=function(a){try{let b=JSON.parse(d.readFileSync(a,"utf8"));if(b&&b.name===g&&b.version)return b.version}catch{}return null}(a);if(b)return b}return"0.0.0"}function k(a,b){let c=a=>String(a).split("-")[0].split(".").slice(0,3).map(a=>parseInt(a,10)||0),d=c(a),e=c(b);for(let a=0;a<Math.max(d.length,e.length);a++){let b=(d[a]||0)-(e[a]||0);if(0!==b)return b>0?1:-1}return 0}async function l({fetchImpl:a=fetch,timeoutMs:b=4e3}={}){try{let c=await a(h,{signal:AbortSignal.timeout(b)});if(!c.ok)return null;let d=await c.json();return d?.version||null}catch{return null}}function m(a){try{return JSON.parse(d.readFileSync(a,"utf8"))}catch{return null}}async function n({file:a,current:b=j(),fetchImpl:c=fetch,nowIso:f}={}){let g=await l({fetchImpl:c}),h=f||new Date().toISOString();if(!g){let c=a?m(a):null;return{ts:h,current:b,latest:c?.latest||null,behind:!1,reachable:!1}}let i=k(g,b)>0,o={ts:h,current:b,latest:g,behind:i,reachable:!0};return a&&(d.mkdirSync(e.dirname(a),{recursive:!0}),d.writeFileSync(a,JSON.stringify(o,null,2))),o}function o({behind:a,mode:b,apply:c}){return!!a&&"weekly"===b&&"auto"===c}},81833:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{BQ:()=>o,HO:()=>s,Jh:()=>n,OT:()=>r,Om:()=>k,bz:()=>m,cN:()=>p,h5:()=>q,iF:()=>i,k2:()=>l,pp:()=>j});var e=c(34255),f=a([e]);function g(a){return a?{id:String(a.id),name:String(a.name||""),position:Number(a.position)||0,is_active:1===a.is_active,created_at:a.created_at,updated_at:a.updated_at}:null}function h(a,b){return String(a||"").trim().slice(0,32)||b}function i(){let a=(0,e.getDb)();l();let b=a.prepare("SELECT * FROM dashboard_spaces ORDER BY position ASC, created_at ASC").all().map(g),c=b.find(a=>a.is_active)||b[0]||null;return{spaces:b,active_space_id:c?c.id:null}}function j(a){if(!a)return null;let b=(0,e.getDb)().prepare("SELECT * FROM dashboard_spaces WHERE id = ?").get(String(a));return g(b)}function k(a=[],{fallback:b="default"}={}){for(let b of Array.isArray(a)?a:[a])if(b&&j(b))return b;return b}function l(){let a=(0,e.getDb)(),b=a.prepare("SELECT COUNT(*) AS n FROM dashboard_spaces").get().n;if(0===b){let b=(0,e.nowIso)();a.prepare("INSERT INTO dashboard_spaces (id, name, position, is_active, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)").run("default","main",0,1,b,b)}a.prepare("UPDATE artifacts SET space_id = 'default' WHERE space_id IS NULL").run()}function m({name:a}={}){let b=(0,e.getDb)();l();let c=b.prepare("SELECT COUNT(*) AS n FROM dashboard_spaces").get().n;if(c>=32){let a=Error("Maximum of 32 spaces reached.");throw a.code="SPACE_LIMIT",a}let d=b.prepare("SELECT MAX(position) AS m FROM dashboard_spaces").get().m,f=(Number(d)||0)+1,g=(0,e.newId)("space"),i=(0,e.nowIso)(),k=h(a,`Space ${c+1}`);return b.prepare("INSERT INTO dashboard_spaces (id, name, position, is_active, created_at, updated_at) VALUES (?, ?, ?, 0, ?, ?)").run(g,k,f,i,i),j(g)}function n(a,b){let c=j(a);if(!c){let a=Error("Space not found.");throw a.code="SPACE_NOT_FOUND",a}let d=h(b,c.name);return d===c.name?c:((0,e.getDb)().prepare("UPDATE dashboard_spaces SET name = ?, updated_at = ? WHERE id = ?").run(d,(0,e.nowIso)(),a),j(a))}function o(a){if(!j(a)){let a=Error("Space not found.");throw a.code="SPACE_NOT_FOUND",a}let b=(0,e.getDb)(),c=(0,e.nowIso)(),d=b.prepare("BEGIN IMMEDIATE");try{d.run(),b.prepare("UPDATE dashboard_spaces SET is_active = 0, updated_at = ? WHERE is_active = 1").run(c),b.prepare("UPDATE dashboard_spaces SET is_active = 1, updated_at = ? WHERE id = ?").run(c,a),b.prepare("COMMIT").run()}catch(a){try{b.prepare("ROLLBACK").run()}catch{}throw a}return j(a)}function p(a){let b=(0,e.getDb)(),c=j(a);if(!c)return null;if(b.prepare("SELECT COUNT(*) AS n FROM dashboard_spaces").get().n<=1){let a=Error("Cannot delete the last remaining space.");throw a.code="SPACE_LAST",a}let d=b.prepare("SELECT * FROM dashboard_spaces WHERE id != ? ORDER BY position ASC, created_at ASC LIMIT 1").get(a);if(!d){let a=Error("No fallback space available.");throw a.code="SPACE_NO_FALLBACK",a}let f=(0,e.nowIso)(),g=b.prepare("BEGIN IMMEDIATE");try{g.run(),b.prepare("UPDATE artifacts SET space_id = ? WHERE space_id = ?").run(d.id,a),b.prepare("UPDATE space_share_links SET revoked = 1 WHERE space_id = ? AND revoked = 0").run(a),b.prepare("DELETE FROM dashboard_spaces WHERE id = ?").run(a),c.is_active&&b.prepare("UPDATE dashboard_spaces SET is_active = 1, updated_at = ? WHERE id = ?").run(f,d.id),b.prepare("COMMIT").run()}catch(a){try{b.prepare("ROLLBACK").run()}catch{}throw a}return{deleted_id:a,moved_to:d.id}}function q(a,b){if(!a){let a=Error("artifact_id is required.");throw a.code="ARTIFACT_REQUIRED",a}let c=j(b);if(!c){let a=Error("Space not found.");throw a.code="SPACE_NOT_FOUND",a}let d=(0,e.getDb)(),f=d.prepare("SELECT id FROM artifacts WHERE id = ?").get(String(a));if(!f){let a=Error("Artifact not found.");throw a.code="ARTIFACT_NOT_FOUND",a}return d.prepare("UPDATE artifacts SET space_id = ?, pinned_to_space_at = datetime('now') WHERE id = ?").run(c.id,f.id),{artifact_id:f.id,space_id:c.id}}function r(){let a=(0,e.getDb)();l();let b=a.prepare("SELECT * FROM dashboard_spaces ORDER BY position ASC, created_at ASC").all().map(g),c=a.prepare("SELECT id, space_id FROM artifacts WHERE space_id IS NOT NULL").all(),d=new Map(b.map(a=>[a.id,[]]));for(let a of c)d.has(a.space_id)&&d.get(a.space_id).push(String(a.id));let f=b.map(a=>({...a,artifact_ids:d.get(a.id)||[]})),h=f.find(a=>a.is_active)||f[0]||null;return{spaces:f,active_space_id:h?h.id:null}}function s({spaces:a=[],active_space_id:b=null}={}){if(!Array.isArray(a)||0===a.length)return null;let c=(0,e.getDb)();l();let d=c.prepare("SELECT COUNT(*) AS n FROM dashboard_spaces").get().n;if(!(1===d&&c.prepare("SELECT id FROM dashboard_spaces WHERE id = 'default'").get()))return null;let f=a.filter(a=>a&&"string"==typeof a.id&&a.id.length>0).slice(0,32);if(0===f.length)return null;let g=(0,e.nowIso)(),i=c.prepare("BEGIN IMMEDIATE");try{i.run(),c.prepare("DELETE FROM dashboard_spaces").run(),f.forEach((a,d)=>{let e=String(a.id),f=h(a.name,`Space ${d+1}`),i=b?e===String(b):0===d;c.prepare("INSERT INTO dashboard_spaces (id, name, position, is_active, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)").run(e,f,d,+!!i,g,g);let j=Array.isArray(a.artifactIds)?a.artifactIds:[],k=c.prepare("UPDATE artifacts SET space_id = ? WHERE id = ? AND (space_id IS NULL OR space_id = ?)");for(let a of j)"string"==typeof a&&k.run(e,a,e)});let a=c.prepare("SELECT COUNT(*) AS n FROM dashboard_spaces WHERE is_active = 1").get().n;if(0===a){let a=c.prepare("SELECT id FROM dashboard_spaces ORDER BY position ASC, created_at ASC LIMIT 1").get();a&&c.prepare("UPDATE dashboard_spaces SET is_active = 1 WHERE id = ?").run(a.id)}c.prepare("COMMIT").run()}catch(a){try{c.prepare("ROLLBACK").run()}catch{}throw a}return r()}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},81992:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{cS:()=>j,r_:()=>i,vg:()=>k});var e=c(25938),f=a([e]);function g(a,{includeBody:b=!1}={}){let c=Object.fromEntries((a.payload?.headers||[]).map(a=>[String(a.name).toLowerCase(),a.value])),d={id:a.id,thread_id:a.threadId,from:c.from||null,subject:c.subject||null,date:c.date||null,snippet:a.snippet||""};return b&&(d.to=c.to||null,d.body_text=function a(b={}){if(b.body?.data)return function(a=""){if(!a)return"";try{return Buffer.from(String(a),"base64url").toString("utf8")}catch{return""}}(b.body.data);let c=Array.isArray(b.parts)?b.parts:[],d=c.find(a=>"text/plain"===a.mimeType&&a.body?.data)||c.find(a=>a.body?.data);return d?a(d):""}(a.payload||{})),d}async function h(a,b,c,d){let f=(0,e.s)(d,c),g=await f(a,{headers:{Authorization:`Bearer ${b}`}});if(!g.ok)throw Error(`google api failed: ${g.status}`);return g.json()}async function i(a={},b={}){let c="gmail_messages_list",d=await (0,e.r)(b,c),f=new URL("https://gmail.googleapis.com/gmail/v1/users/me/messages");for(let b of(a.max_results&&f.searchParams.set("maxResults",String(a.max_results)),a.q&&f.searchParams.set("q",a.q),a.label_ids||a.labelIds||[]))f.searchParams.append("labelIds",String(b));let j=(await h(f,d,b,c)).messages||[];return Promise.all(j.map(async a=>{let e=await h(`https://gmail.googleapis.com/gmail/v1/users/me/messages/${encodeURIComponent(a.id)}?format=metadata`,d,b,c);return g(e)}))}async function j(a={},b={}){if(!a.message_id)throw Error("message_id is required");let c="gmail_message_read",d=await (0,e.r)(b,c),f=await h(`https://gmail.googleapis.com/gmail/v1/users/me/messages/${encodeURIComponent(a.message_id)}?format=full`,d,b,c);return g(f,{includeBody:!0})}async function k(a={},b={}){if(!a.thread_id)throw Error("thread_id is required");let c="gmail_thread_read",d=await (0,e.r)(b,c),f=await h(`https://gmail.googleapis.com/gmail/v1/users/me/threads/${encodeURIComponent(a.thread_id)}?format=full`,d,b,c);return{id:f.id,messages:(f.messages||[]).map(a=>g(a,{includeBody:!0}))}}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},83963:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{Dn:()=>ae,Fp:()=>aa,Fy:()=>F,G:()=>ai,HB:()=>R,Mu:()=>Y,Q4:()=>J,Qf:()=>_,Rz:()=>W,V0:()=>ag,VI:()=>P,Vk:()=>N,WH:()=>$,WX:()=>Z,X1:()=>X,createTask:()=>S,eE:()=>ac,fI:()=>B,gf:()=>I,gg:()=>O,hC:()=>ap,hW:()=>ak,iR:()=>ad,ij:()=>an,jN:()=>G,kP:()=>D,lC:()=>T,n5:()=>ao,nV:()=>aj,qF:()=>am,qt:()=>ah,rN:()=>ab,s_:()=>Q,vQ:()=>V,w4:()=>al,yS:()=>U,yX:()=>E,zP:()=>H});var e=c(34255),f=c(40563),g=c(61423),h=c(18313),i=a([e,f,g]);function j(a,b=null){if(!a)return b;try{return JSON.parse(a)}catch{return b}}function k(a){return null==a?null:JSON.stringify(a)}function l(a){let b=globalThis.__madarxLiveEventBus;if(!b?.subscribers)return{id:a.id||(0,e.newId)("evt"),ts:a.ts||Date.now(),...a};let c={id:a.id||`evt-${b.nextId++}-${Math.random().toString(36).slice(2,8)}`,ts:a.ts||Date.now(),...a};for(let a of b.subscribers)try{a(c)}catch{}return c}function m(a){return a?{...a,tools:j(a.tools,[]),files:j(a.files,[]),memory:j(a.memory,[]),permissions_json:j(a.permissions_json,{}),metadata_json:j(a.metadata_json,{})}:null}function n(a){return a?{...a,parent_task_id:a.parent_task_id||null,tags:j(a.tags_json,[]),watchers:j(a.watchers_json,[]),due_at:a.due_at||null,estimate_minutes:null==a.estimate_minutes?null:Number(a.estimate_minutes),recurrence:a.recurrence||null,acceptance_criteria:a.acceptance_criteria||null}:null}function o(a){return a?{id:a.id,task_id:a.task_id,label:a.label,done:!!a.done,position:Number(a.position)||0,created_at:a.created_at,done_at:a.done_at||null}:null}function p(a){if(null==a)return null;if(Array.isArray(a)){let b=a.map(a=>String(a).trim()).filter(Boolean).slice(0,24);return b.length?b:[]}return"string"==typeof a?a.split(",").map(a=>a.trim()).filter(Boolean).slice(0,24):null}function q(a){if(null==a)return null;let b=(Array.isArray(a)?a:String(a).split(",")).map(a=>String(a).trim()).filter(Boolean).slice(0,24);return Array.from(new Set(b))}function r(a){if(!a)return null;let b=String(a).trim();if(!b)return null;if(/^\d{4}-\d{2}-\d{2}$/.test(b))return`${b}T23:59:59.000Z`;let c=new Date(b);return Number.isNaN(c.getTime())?null:c.toISOString()}function s(a){if(null==a||""===a)return null;let b=Number(a);return!Number.isFinite(b)||b<0?null:Math.round(b)}function t(a){if(!a)return null;let b=String(a).trim();return b?b.length>64?b.slice(0,64):b:null}function u(a){return a?{...a}:null}function v(a){return a?{...a,payload:j(a.payload_json,null)}:null}function w(a){return a?{...a,usage:j(a.usage_json,null),result:j(a.result_json,null)}:null}function x(a){return a?{...a,payload:j(a.payload_json,null)}:null}function y(a){return a?{...a,details:j(a.details_json,null),cursor:a.seq}:null}function z(a){return m((0,e.getDb)().prepare("SELECT * FROM agents WHERE id = ?").get(a))}function A(a){if(!a)return null;let b=z(a);if(!b)throw Error(`Agent not found: ${a}`);if("terminated"===b.status)throw Error(`Terminated agents cannot receive assignments: ${a}`);return b}function B(a){if(!a?.type||!1===a.persist)return null;let b=function(a){let b={agent_run_start:"agent.run.status",agent_run_complete:"agent.run.status",agent_tool_start:"agent.run.event",agent_tool_result:"agent.run.event",log:"agent.run.log"},c=(0,h._d)(b[a.type]||a.type,null);return c&&h.eh.includes(c)?{actor_type:a.actor_type||(a.agent_id?"agent":"system"),actor_id:a.actor_id||a.agent_id||null,agent_id:a.agent_id||null,run_id:a.run_id||null,entity_type:a.entity_type||(a.task_id?"task":a.run_id?"agent_run":a.agent_id?"agent":"event"),entity_id:a.entity_id||a.task_id||a.run_id||a.id||null,action:c,details:{...a,legacy_type:b[a.type]?a.type:void 0},created_at:a.created_at||(0,e.nowIso)()}:null}(a);return b?C(b):null}function C({actor_type:a="system",actor_id:b=null,agent_id:c=null,run_id:d=null,entity_type:f=null,entity_id:g=null,action:h,details:i=null,created_at:j=(0,e.nowIso)()}={}){if(!h)throw Error("activity action is required");let l=(0,e.getDb)(),m=(0,e.newId)("activity");l.prepare(`
@@ -3428,7 +3437,7 @@ ${b}`:b;return v(r("codex"),["exec",d],{timeoutMs:Number(process.env.CODEX_TICK_
       FROM tasks
       WHERE completed_at IS NOT NULL
       GROUP BY assignee_agent_id
-    `),manager_delegation:c("SELECT * FROM manager_delegation_view ORDER BY delegated_task_count DESC"),workload:c("SELECT * FROM agent_workload_view ORDER BY active_tasks DESC, total_tasks DESC"),approval_latency:c("SELECT * FROM approval_latency_view ORDER BY created_at DESC LIMIT 100"),run_failures:c("SELECT * FROM run_failure_view ORDER BY created_at DESC LIMIT 100"),totals:{active_agents:Number(b("SELECT COUNT(*) AS count FROM agents WHERE status != 'terminated'").count||0),active_tasks:Number(b("SELECT COUNT(*) AS count FROM tasks WHERE status IN ('todo', 'in_progress', 'in_review', 'blocked')").count||0),blocked_tasks:Number(b("SELECT COUNT(*) AS count FROM tasks WHERE status = 'blocked'").count||0),pending_approvals:Number(b("SELECT COUNT(*) AS count FROM approval_requests WHERE status = 'pending'").count||0),running_executions:Number(b("SELECT COUNT(*) AS count FROM agent_runs WHERE status IN ('queued', 'running', 'waiting_approval')").count||0),recent_delegations:Number(b("SELECT COUNT(*) AS count FROM activity_log WHERE action IN ('task.assigned', 'task.reassigned') AND created_at >= datetime('now', '-7 day')").count||0),recent_completions:Number(b("SELECT COUNT(*) AS count FROM tasks WHERE status = 'done' AND completed_at >= datetime('now', '-7 day')").count||0)}}}[e,f,g]=i.then?(await i)():i,d()}catch(a){d(a)}})},85803:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{D6:()=>q,Hz:()=>r,Jz:()=>t,aU:()=>s});var e=c(76760),f=c(73024),g=c(9381),h=c(26531),i=c(59400),j=a([i]);i=(j.then?(await j)():j)[0];let u=e.join(g.nJ,"browser-profile"),v=e.join(g.nJ,"browser-screenshots"),w=null,x=null,y=null;function k(a){let b=Number(a);return!Number.isFinite(b)||b<=0?3e4:Math.min(12e4,Math.max(1e3,Math.floor(b)))}function l(a){return(0,h.nc)(String(a??"").slice(0,2e4))}function m(){y&&clearTimeout(y),y=setTimeout(()=>{n().catch(()=>{})},9e4),"function"==typeof y.unref&&y.unref()}async function n(){y&&(clearTimeout(y),y=null);let a=w;if(w=null,x=null,a)try{await a.close()}catch{}}async function o(){let a;if(w&&x&&!x.isClosed())return m(),x;try{({chromium:a}=await Promise.resolve().then(c.bind(c,83237)))}catch{throw Error("Playwright is not installed. Run: npm install playwright && npx playwright install chromium")}f.mkdirSync(u,{recursive:!0});try{w=await a.launchPersistentContext(u,{headless:!0,args:["--no-sandbox","--disable-dev-shm-usage"]})}catch(a){throw w=null,Error(`Failed to launch Chromium (${a?.message||a}). Provision it with: npx playwright install chromium`)}return w.setDefaultTimeout(3e4),x=w.pages()[0]||await w.newPage(),m(),x}async function p(a){let b="";try{b=await a.title()}catch{}return{url:a.url(),title:b}}async function q(a={}){let b=(0,i.vC)(a.url).href,c=k(a.timeout_ms);try{let d=await o();if(await d.goto(b,{waitUntil:"domcontentloaded",timeout:c}),a.wait_for)try{await d.waitForSelector(String(a.wait_for),{timeout:c})}catch{}let{url:e,title:f}=await p(d),g=await d.evaluate(()=>document.body?.innerText||"");return{ok:!0,tool:"browser_open",status:"complete",url:e,title:f,text:l(g)}}catch(a){return{ok:!1,tool:"browser_open",status:"failed",url:b,error:String(a?.message||a)}}}let z=new Set(["click","fill","type","select","press","scroll","wait"]);async function r(a={}){let b,c=String(a.action||"").toLowerCase();if(!z.has(c))return{ok:!1,tool:"browser_act",status:"error",error:`unknown action: ${c||"(none)"}`};let d=k(a.timeout_ms);try{b=await o()}catch(a){return{ok:!1,tool:"browser_act",status:"failed",error:String(a?.message||a)}}try{if("scroll"===c)await b.evaluate(()=>window.scrollBy(0,window.innerHeight));else if("wait"===c)a.selector?await b.waitForSelector(String(a.selector),{timeout:d}):await b.waitForTimeout(Math.min(d,1e4));else{let e=String(a.selector||"");if(!e)return{ok:!1,tool:"browser_act",status:"error",error:"selector is required"};let f=b.locator(e).first();"click"===c?await f.click({timeout:d}):"fill"===c?await f.fill(String(a.text??""),{timeout:d}):"type"===c?await f.pressSequentially(String(a.text??""),{timeout:d}):"select"===c?await f.selectOption(String(a.value??a.text??""),{timeout:d}):"press"===c&&await f.press(String(a.key||"Enter"),{timeout:d})}let{url:e,title:f}=await p(b);return{ok:!0,tool:"browser_act",status:"complete",action:c,url:e,title:f}}catch(a){return{ok:!1,tool:"browser_act",status:"failed",action:c,error:String(a?.message||a)}}}async function s(a={}){let b,c=String(a.mode||"text").toLowerCase(),d=a.selector?String(a.selector):null;try{b=await o()}catch(a){return{ok:!1,tool:"browser_extract",status:"failed",error:String(a?.message||a)}}try{let a="";a="html"===c?d?await b.locator(d).first().innerHTML().catch(()=>"")||"":await b.content():"json-ld"===c?(await b.evaluate(()=>Array.from(document.querySelectorAll('script[type="application/ld+json"]')).map(a=>a.textContent||""))).join("\n"):d?await b.locator(d).first().innerText().catch(()=>"")||"":await b.evaluate(()=>document.body?.innerText||"");let{url:e,title:f}=await p(b);return{ok:!0,tool:"browser_extract",status:"complete",mode:c,url:e,title:f,content:l(a)}}catch(a){return{ok:!1,tool:"browser_extract",status:"failed",error:String(a?.message||a)}}}async function t(a={}){let b;try{b=await o()}catch(a){return{ok:!1,tool:"browser_screenshot",status:"failed",error:String(a?.message||a)}}try{f.mkdirSync(v,{recursive:!0});let c=`shot-${Date.now()}.png`.replace(/[^a-zA-Z0-9_.-]/g,"-"),d=e.join(v,c),g={path:d,fullPage:!!a.full_page};a.selector?await b.locator(String(a.selector)).first().screenshot({path:d}):await b.screenshot(g);let{url:h,title:i}=await p(b);return{ok:!0,tool:"browser_screenshot",status:"complete",url:h,title:i,path:d}}catch(a){return{ok:!1,tool:"browser_screenshot",status:"failed",error:String(a?.message||a)}}}d()}catch(a){d(a)}})},87181:(a,b,c)=>{"use strict";c.d(b,{K2:()=>j});var d=c(77598),e=c(73024),f=c(76760);let g=null;function h(){return process.env.MADARX_ENV_FILE||f.join(process.cwd(),".env.local")}function i(a){return a?a.split("\n").map(a=>a.trim()).filter(a=>a.startsWith("MADARX_MASTER_KEY=")).map(a=>a.slice(18).replace(/^["']|["']$/g,"").trim()):[]}function j({db:a=null,allowGenerate:b=!0}={}){if(g)return g;try{let a=function(a=h()){let b="";try{b=e.readFileSync(a,"utf8")}catch(a){if("ENOENT"!==a.code)throw a;return null}let c=i(b);return c.length<=1||1===new Set(c).size?null:{file:a,keys:c}}();a&&console.warn(`[secrets] WARNING: ${a.file} contains ${a.keys.length} different MADARX_MASTER_KEY lines. Only one will be loaded (first-wins) and vault rows encrypted with any other key will silently fail to decrypt. Fix the file so only one MADARX_MASTER_KEY= line remains.`)}catch{}try{for(let{file:a,mode:b}of function({extraDirs:a=[]}={}){let b=[],c=[process.cwd(),f.join(process.env.HOME||"",".madarx"),...a].filter(Boolean),d=/^\.env(\.[^/]+)?\.(bak|backup)(-.*)?$/;for(let a of c){let c;try{c=e.readdirSync(a)}catch{continue}for(let g of c){let c;if(!d.test(g))continue;let h=f.join(a,g);try{c=e.statSync(h)}catch{continue}if(!c.isFile())continue;let i=511&c.mode;i>384&&b.push({file:h,mode:i})}}return b}())console.warn(`[secrets] WARNING: ${a} has mode ${b.toString(8)} (expected 600). This backup likely contains credentials and is readable by other local users. Fix: chmod 600 "${a}" — or delete the file if no longer needed.`)}catch{}let c=process.env.MADARX_MASTER_KEY;if(c){let a=Buffer.from(c,"base64");if(32!==a.length)throw Error(`MADARX_MASTER_KEY must be a base64-encoded 32-byte key (got ${a.length} bytes). Generate a new key with: node -e "console.log(require('node:crypto').randomBytes(32).toString('base64'))"`);return g=a}if(a&&function(a){try{return!!a.prepare("SELECT id FROM secrets WHERE status = ? LIMIT 1").get("active")}catch{return!1}}(a))throw Error("MADARX_MASTER_KEY is not set but the secrets vault has stored credentials.\nSet the env var to your master key before starting:\n  export MADARX_MASTER_KEY=<your-base64-key>\n\nIf you have lost the key, the vault contents are unrecoverable. You will need to\ndelete all rows from the secrets table and re-add credentials from scratch.");if(!b)throw Error("MADARX_MASTER_KEY is not set. Set it before using the secrets vault.");return g=function(){let a=(0,d.randomBytes)(32),b=a.toString("base64"),c=h(),g="";try{g=e.readFileSync(c,"utf8")}catch(a){if("ENOENT"!==a.code)throw a}let j=i(g);if(j.length>0)throw Error(`MADARX_MASTER_KEY is already present in ${c} (${j.length} entr${1===j.length?"y":"ies"} found). Refusing to append a second key — that would corrupt the vault. Either export MADARX_MASTER_KEY in your shell before starting, or fix .env.local by hand so only one MADARX_MASTER_KEY= line remains.`);let k=`
+    `),manager_delegation:c("SELECT * FROM manager_delegation_view ORDER BY delegated_task_count DESC"),workload:c("SELECT * FROM agent_workload_view ORDER BY active_tasks DESC, total_tasks DESC"),approval_latency:c("SELECT * FROM approval_latency_view ORDER BY created_at DESC LIMIT 100"),run_failures:c("SELECT * FROM run_failure_view ORDER BY created_at DESC LIMIT 100"),totals:{active_agents:Number(b("SELECT COUNT(*) AS count FROM agents WHERE status != 'terminated'").count||0),active_tasks:Number(b("SELECT COUNT(*) AS count FROM tasks WHERE status IN ('todo', 'in_progress', 'in_review', 'blocked')").count||0),blocked_tasks:Number(b("SELECT COUNT(*) AS count FROM tasks WHERE status = 'blocked'").count||0),pending_approvals:Number(b("SELECT COUNT(*) AS count FROM approval_requests WHERE status = 'pending'").count||0),running_executions:Number(b("SELECT COUNT(*) AS count FROM agent_runs WHERE status IN ('queued', 'running', 'waiting_approval')").count||0),recent_delegations:Number(b("SELECT COUNT(*) AS count FROM activity_log WHERE action IN ('task.assigned', 'task.reassigned') AND created_at >= datetime('now', '-7 day')").count||0),recent_completions:Number(b("SELECT COUNT(*) AS count FROM tasks WHERE status = 'done' AND completed_at >= datetime('now', '-7 day')").count||0)}}}[e,f,g]=i.then?(await i)():i,d()}catch(a){d(a)}})},85803:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{D6:()=>r,Hz:()=>s,Jz:()=>u,aU:()=>t});var e=c(76760),f=c(73024),g=c(9381),h=c(26531),i=c(59400),j=a([i]);i=(j.then?(await j)():j)[0];let v=e.join(g.nJ,"browser-profile"),w=e.join(g.nJ,"browser-screenshots"),x=null,y=null,z=null;function k(a){let b=Number(a);return!Number.isFinite(b)||b<=0?3e4:Math.min(12e4,Math.max(1e3,Math.floor(b)))}function l(a){return(0,h.nc)(String(a??"").slice(0,2e4))}async function m(a){let b=function(){let a=String(process.env.MADARX_BROWSER_HEADED||"").trim().toLowerCase();return"1"===a||"true"===a||"yes"===a||"on"===a}(),c={headless:!b,args:["--no-sandbox","--disable-dev-shm-usage"]};if(b)try{return await a.launchPersistentContext(v,{...c,channel:"chrome"})}catch{}return await a.launchPersistentContext(v,c)}function n(){z&&clearTimeout(z),z=setTimeout(()=>{o().catch(()=>{})},9e4),"function"==typeof z.unref&&z.unref()}async function o(){z&&(clearTimeout(z),z=null);let a=x;if(x=null,y=null,a)try{await a.close()}catch{}}async function p(){let a;if(x&&y&&!y.isClosed())return n(),y;try{({chromium:a}=await Promise.resolve().then(c.bind(c,83237)))}catch{throw Error("Playwright is not installed. Run: npm install playwright && npx playwright install chromium")}f.mkdirSync(v,{recursive:!0});try{x=await m(a)}catch(a){throw x=null,Error(`Failed to launch Chromium (${a?.message||a}). Provision it with: npx playwright install chromium`)}return x.setDefaultTimeout(3e4),y=x.pages()[0]||await x.newPage(),n(),y}async function q(a){let b="";try{b=await a.title()}catch{}return{url:a.url(),title:b}}async function r(a={}){let b=(0,i.vC)(a.url).href,c=k(a.timeout_ms);try{let d=await p();if(await d.goto(b,{waitUntil:"domcontentloaded",timeout:c}),a.wait_for)try{await d.waitForSelector(String(a.wait_for),{timeout:c})}catch{}let{url:e,title:f}=await q(d),g=await d.evaluate(()=>document.body?.innerText||"");return{ok:!0,tool:"browser_open",status:"complete",url:e,title:f,text:l(g)}}catch(a){return{ok:!1,tool:"browser_open",status:"failed",url:b,error:String(a?.message||a)}}}let A=new Set(["click","fill","type","select","press","scroll","wait"]);async function s(a={}){let b,c=String(a.action||"").toLowerCase();if(!A.has(c))return{ok:!1,tool:"browser_act",status:"error",error:`unknown action: ${c||"(none)"}`};let d=k(a.timeout_ms);try{b=await p()}catch(a){return{ok:!1,tool:"browser_act",status:"failed",error:String(a?.message||a)}}try{if("scroll"===c)await b.evaluate(()=>window.scrollBy(0,window.innerHeight));else if("wait"===c)a.selector?await b.waitForSelector(String(a.selector),{timeout:d}):await b.waitForTimeout(Math.min(d,1e4));else{let e=String(a.selector||"");if(!e)return{ok:!1,tool:"browser_act",status:"error",error:"selector is required"};let f=b.locator(e).first();"click"===c?await f.click({timeout:d}):"fill"===c?await f.fill(String(a.text??""),{timeout:d}):"type"===c?await f.pressSequentially(String(a.text??""),{timeout:d}):"select"===c?await f.selectOption(String(a.value??a.text??""),{timeout:d}):"press"===c&&await f.press(String(a.key||"Enter"),{timeout:d})}let{url:e,title:f}=await q(b);return{ok:!0,tool:"browser_act",status:"complete",action:c,url:e,title:f}}catch(a){return{ok:!1,tool:"browser_act",status:"failed",action:c,error:String(a?.message||a)}}}async function t(a={}){let b,c=String(a.mode||"text").toLowerCase(),d=a.selector?String(a.selector):null;try{b=await p()}catch(a){return{ok:!1,tool:"browser_extract",status:"failed",error:String(a?.message||a)}}try{let a="";a="html"===c?d?await b.locator(d).first().innerHTML().catch(()=>"")||"":await b.content():"json-ld"===c?(await b.evaluate(()=>Array.from(document.querySelectorAll('script[type="application/ld+json"]')).map(a=>a.textContent||""))).join("\n"):d?await b.locator(d).first().innerText().catch(()=>"")||"":await b.evaluate(()=>document.body?.innerText||"");let{url:e,title:f}=await q(b);return{ok:!0,tool:"browser_extract",status:"complete",mode:c,url:e,title:f,content:l(a)}}catch(a){return{ok:!1,tool:"browser_extract",status:"failed",error:String(a?.message||a)}}}async function u(a={}){let b;try{b=await p()}catch(a){return{ok:!1,tool:"browser_screenshot",status:"failed",error:String(a?.message||a)}}try{f.mkdirSync(w,{recursive:!0});let c=`shot-${Date.now()}.png`.replace(/[^a-zA-Z0-9_.-]/g,"-"),d=e.join(w,c),g={path:d,fullPage:!!a.full_page};a.selector?await b.locator(String(a.selector)).first().screenshot({path:d}):await b.screenshot(g);let{url:h,title:i}=await q(b);return{ok:!0,tool:"browser_screenshot",status:"complete",url:h,title:i,path:d}}catch(a){return{ok:!1,tool:"browser_screenshot",status:"failed",error:String(a?.message||a)}}}d()}catch(a){d(a)}})},87181:(a,b,c)=>{"use strict";c.d(b,{K2:()=>j});var d=c(77598),e=c(73024),f=c(76760);let g=null;function h(){return process.env.MADARX_ENV_FILE||f.join(process.cwd(),".env.local")}function i(a){return a?a.split("\n").map(a=>a.trim()).filter(a=>a.startsWith("MADARX_MASTER_KEY=")).map(a=>a.slice(18).replace(/^["']|["']$/g,"").trim()):[]}function j({db:a=null,allowGenerate:b=!0}={}){if(g)return g;try{let a=function(a=h()){let b="";try{b=e.readFileSync(a,"utf8")}catch(a){if("ENOENT"!==a.code)throw a;return null}let c=i(b);return c.length<=1||1===new Set(c).size?null:{file:a,keys:c}}();a&&console.warn(`[secrets] WARNING: ${a.file} contains ${a.keys.length} different MADARX_MASTER_KEY lines. Only one will be loaded (first-wins) and vault rows encrypted with any other key will silently fail to decrypt. Fix the file so only one MADARX_MASTER_KEY= line remains.`)}catch{}try{for(let{file:a,mode:b}of function({extraDirs:a=[]}={}){let b=[],c=[process.cwd(),f.join(process.env.HOME||"",".madarx"),...a].filter(Boolean),d=/^\.env(\.[^/]+)?\.(bak|backup)(-.*)?$/;for(let a of c){let c;try{c=e.readdirSync(a)}catch{continue}for(let g of c){let c;if(!d.test(g))continue;let h=f.join(a,g);try{c=e.statSync(h)}catch{continue}if(!c.isFile())continue;let i=511&c.mode;i>384&&b.push({file:h,mode:i})}}return b}())console.warn(`[secrets] WARNING: ${a} has mode ${b.toString(8)} (expected 600). This backup likely contains credentials and is readable by other local users. Fix: chmod 600 "${a}" — or delete the file if no longer needed.`)}catch{}let c=process.env.MADARX_MASTER_KEY;if(c){let a=Buffer.from(c,"base64");if(32!==a.length)throw Error(`MADARX_MASTER_KEY must be a base64-encoded 32-byte key (got ${a.length} bytes). Generate a new key with: node -e "console.log(require('node:crypto').randomBytes(32).toString('base64'))"`);return g=a}if(a&&function(a){try{return!!a.prepare("SELECT id FROM secrets WHERE status = ? LIMIT 1").get("active")}catch{return!1}}(a))throw Error("MADARX_MASTER_KEY is not set but the secrets vault has stored credentials.\nSet the env var to your master key before starting:\n  export MADARX_MASTER_KEY=<your-base64-key>\n\nIf you have lost the key, the vault contents are unrecoverable. You will need to\ndelete all rows from the secrets table and re-add credentials from scratch.");if(!b)throw Error("MADARX_MASTER_KEY is not set. Set it before using the secrets vault.");return g=function(){let a=(0,d.randomBytes)(32),b=a.toString("base64"),c=h(),g="";try{g=e.readFileSync(c,"utf8")}catch(a){if("ENOENT"!==a.code)throw a}let j=i(g);if(j.length>0)throw Error(`MADARX_MASTER_KEY is already present in ${c} (${j.length} entr${1===j.length?"y":"ies"} found). Refusing to append a second key — that would corrupt the vault. Either export MADARX_MASTER_KEY in your shell before starting, or fix .env.local by hand so only one MADARX_MASTER_KEY= line remains.`);let k=`
 # ============================================================
 # WARNING: MADARX_MASTER_KEY is the encryption key for all
 # integration credentials in the secrets vault. Keep this safe.
@@ -3470,7 +3479,15 @@ RULES:
         description=excluded.description,
         manifest_json=excluded.manifest_json,
         tags=excluded.tags
-    `).run(`agent:${c.slug}`,c.slug,c.title,c.description_long,c.role,JSON.stringify({agent:c,process_engine:!0}),c.approval_profile,JSON.stringify([c.role,c.engine_default,"process-engine"]),b)}d()}catch(a){d(a)}})},90712:(a,b,c)=>{"use strict";c.d(b,{F:()=>g});let d=new Set(["","on demand","live","event based","manual"]),e={sun:0,sunday:0,mon:1,monday:1,tue:2,tues:2,tuesday:2,wed:3,wednesday:3,thu:4,thurs:4,thursday:4,fri:5,friday:5,sat:6,saturday:6},f=Object.keys(e).join("|");function g(a,b=new Date().toISOString()){let c=String(a||"").trim().toLowerCase();if(d.has(c))return null;let h=new Date(b);if(Number.isNaN(h.getTime()))return null;let i=c.match(/^at\s+(.+)$/);if(i){let a=new Date(i[1]);return Number.isNaN(a.getTime())||a.getTime()<=h.getTime()?null:a.toISOString()}let j=c.match(/^daily\s+(\d{1,2}):(\d{2})$/);if(j){let a=Math.min(23,Math.max(0,Number(j[1]))),b=Math.min(59,Math.max(0,Number(j[2]))),c=new Date(h);return c.setSeconds(0,0),c.setHours(a,b,0,0),c.getTime()<=h.getTime()&&c.setDate(c.getDate()+1),c.toISOString()}let k=c.match(RegExp(`^weekly\\s+(${f})\\s+(\\d{1,2}):(\\d{2})$`));if(k){let a=e[k[1]],b=Math.min(23,Math.max(0,Number(k[2]))),c=Math.min(59,Math.max(0,Number(k[3]))),d=new Date(h);d.setSeconds(0,0),d.setHours(b,c,0,0);let f=(a-d.getDay()+7)%7;return 0===f&&d.getTime()<=h.getTime()&&(f=7),d.setDate(d.getDate()+f),d.toISOString()}let l=c.match(/^monthly\s+(last|\d{1,2})\s+(\d{1,2}):(\d{2})$/);if(l){let a=l[1],b=Math.min(23,Math.max(0,Number(l[2]))),c=Math.min(59,Math.max(0,Number(l[3]))),d=(d,e)=>{let f=new Date(d,e+1,0).getDate();return new Date(d,e,"last"===a?f:Math.min(Math.max(1,Number(a)),f),b,c,0,0)},e=d(h.getFullYear(),h.getMonth());return e.getTime()<=h.getTime()&&(e=d(h.getFullYear(),h.getMonth()+1)),e.toISOString()}let m=c.match(/^every\s+(\d{1,3})\s*mo$/);if(m){let a=Math.max(1,Number(m[1])),b=new Date(h);return b.setMonth(b.getMonth()+a),b.toISOString()}let n=c.match(/^every\s+(\d{1,3})\s*h$/);if(n)return new Date(h.getTime()+36e5*Number(n[1])).toISOString();let o=c.match(/^every\s+(\d{1,4})\s*m$/);return o?new Date(h.getTime()+6e4*Number(o[1])).toISOString():new Date(h.getTime()+36e5).toISOString()}},91437:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{I:()=>n,m:()=>m});var e=c(73024),f=c(76760),g=c(34255),h=c(61423),i=c(73912),j=c(4160),k=c(9381),l=a([g,h,i,j]);async function m(a,b={}){let c,{name:d,slug:l,asset_stage:n="exploration",commodity:o=null,deposit_type:p=null,portfolio_entry_id:q=null,description:r=null}=a||{};if(!d||!String(d).trim())return{status:"error",error:"name_required"};let s=(0,g.getDb)(),t=(0,g.nowIso)(),u=(0,h.DJ)(l||d);if(s.prepare("SELECT id FROM mines_projects WHERE slug = ? LIMIT 1").get(u))return{status:"error",error:"slug_in_use",slug:u};if(q){let a=s.prepare("SELECT id, project_id FROM mines_portfolio_entries WHERE id = ? LIMIT 1").get(q);if(!a)return{status:"error",error:"entry_not_found",portfolio_entry_id:q};if(a.project_id)return{status:"error",error:"entry_already_linked",portfolio_entry_id:q}}try{c=(0,h.gA)({name:String(d).trim(),slug:u,description:r||"Mine project: "+String(d).trim(),color:"#2A5C45"})}catch(a){if(a?.code==="PROJECT_SLUG_EXISTS")return{status:"error",error:"slug_in_use",slug:u};throw a}let v=c.id,w=c.slug,x=(0,g.newId)("mp"),y=q||null;s.prepare("BEGIN").run();try{if(s.prepare(`
+    `).run(`agent:${c.slug}`,c.slug,c.title,c.description_long,c.role,JSON.stringify({agent:c,process_engine:!0}),c.approval_profile,JSON.stringify([c.role,c.engine_default,"process-engine"]),b)}d()}catch(a){d(a)}})},89833:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{eE:()=>j,zE:()=>i});var e=c(72326),f=c(9381),g=c(26531),h=a([e]);e=(h.then?(await h)():h)[0];let k={"connect-chrome":{purpose:"Launch the visible GStack Chromium browser the operator can watch live.",invoke:"connect-chrome"},browse:{purpose:"Drive a browser to navigate, click, type, read pages, and capture screenshots.",invoke:"browse"},"qa-only":{purpose:"Run a QA pass against a running site and report findings (no fixes).",invoke:"qa-only"}};function i(a={}){if("1"===process.env.MADARX_SKILL_BRIDGE_DISABLED)throw Error("skill bridge is disabled (MADARX_SKILL_BRIDGE_DISABLED=1)");let b=String(a.skill||"").trim().toLowerCase();if(!b)throw Error("skill is required");let c=k[b];if(!c)throw Error(`skill "${b}" is not bridgeable. Allowed: ${Object.keys(k).join(", ")}`);let d=String(a.instruction||"").trim();if(!d)throw Error("instruction is required");if(d.length>4e3)throw Error(`instruction is too long: ${d.length} chars; max 4000`);let e=Math.max(5e3,Math.min(6e5,Number(a.timeout_ms||18e4)||18e4));return{skill:b,entry:c,instruction:d,timeoutMs:e}}async function j(a={},b={}){var c;let{skill:d,entry:h,instruction:k,timeoutMs:l}=i(a),m=Date.now(),n=`You are a single-purpose runner spawned by the madarX main agent.
+Your ONLY job: invoke the /${h.invoke} skill and carry out the operator instruction with it.
+Purpose of this skill: ${h.purpose}
+Rules:
+- Use ONLY the /${h.invoke} skill. Do not invoke other skills, write files outside workspace, or run unrelated commands.
+- Do not read secrets, .env files, or anything the deny list blocks.
+- When done, reply with a concise plain-text summary of what happened and what you observed (URLs visited, key results). No markdown tables.`,o=`Use the /${h.invoke} skill to do the following:
+
+${k}`;try{let a=(c=await (0,e.M2)({systemPrompt:n,userMessage:o,maxTurns:25,timeoutMs:l,allowedTools:["Skill","Bash","Read","Write","Glob","Grep","WebFetch","WebSearch"],addDirs:[f.un,f.nJ],agentId:b.agent_id||"main",agentName:"skill-bridge"}),(0,g.nc)(String(c||"").slice(0,function(){let a=Number(process.env.MADARX_TOOL_OUTPUT_MAX_BYTES||12e3);return!Number.isFinite(a)||a<=0?12e3:Math.min(12e3,Math.floor(a))}())));return{ok:!0,tool:"skill_bridge_run",status:"complete",skill:d,summary:a,duration_ms:Date.now()-m}}catch(a){return{ok:!1,tool:"skill_bridge_run",status:"failed",skill:d,error:String(a?.message||a).slice(0,1e3),duration_ms:Date.now()-m}}}d()}catch(a){d(a)}})},90712:(a,b,c)=>{"use strict";c.d(b,{F:()=>g});let d=new Set(["","on demand","live","event based","manual"]),e={sun:0,sunday:0,mon:1,monday:1,tue:2,tues:2,tuesday:2,wed:3,wednesday:3,thu:4,thurs:4,thursday:4,fri:5,friday:5,sat:6,saturday:6},f=Object.keys(e).join("|");function g(a,b=new Date().toISOString()){let c=String(a||"").trim().toLowerCase();if(d.has(c))return null;let h=new Date(b);if(Number.isNaN(h.getTime()))return null;let i=c.match(/^at\s+(.+)$/);if(i){let a=new Date(i[1]);return Number.isNaN(a.getTime())||a.getTime()<=h.getTime()?null:a.toISOString()}let j=c.match(/^daily\s+(\d{1,2}):(\d{2})$/);if(j){let a=Math.min(23,Math.max(0,Number(j[1]))),b=Math.min(59,Math.max(0,Number(j[2]))),c=new Date(h);return c.setSeconds(0,0),c.setHours(a,b,0,0),c.getTime()<=h.getTime()&&c.setDate(c.getDate()+1),c.toISOString()}let k=c.match(RegExp(`^weekly\\s+(${f})\\s+(\\d{1,2}):(\\d{2})$`));if(k){let a=e[k[1]],b=Math.min(23,Math.max(0,Number(k[2]))),c=Math.min(59,Math.max(0,Number(k[3]))),d=new Date(h);d.setSeconds(0,0),d.setHours(b,c,0,0);let f=(a-d.getDay()+7)%7;return 0===f&&d.getTime()<=h.getTime()&&(f=7),d.setDate(d.getDate()+f),d.toISOString()}let l=c.match(/^monthly\s+(last|\d{1,2})\s+(\d{1,2}):(\d{2})$/);if(l){let a=l[1],b=Math.min(23,Math.max(0,Number(l[2]))),c=Math.min(59,Math.max(0,Number(l[3]))),d=(d,e)=>{let f=new Date(d,e+1,0).getDate();return new Date(d,e,"last"===a?f:Math.min(Math.max(1,Number(a)),f),b,c,0,0)},e=d(h.getFullYear(),h.getMonth());return e.getTime()<=h.getTime()&&(e=d(h.getFullYear(),h.getMonth()+1)),e.toISOString()}let m=c.match(/^every\s+(\d{1,3})\s*mo$/);if(m){let a=Math.max(1,Number(m[1])),b=new Date(h);return b.setMonth(b.getMonth()+a),b.toISOString()}let n=c.match(/^every\s+(\d{1,3})\s*h$/);if(n)return new Date(h.getTime()+36e5*Number(n[1])).toISOString();let o=c.match(/^every\s+(\d{1,4})\s*m$/);return o?new Date(h.getTime()+6e4*Number(o[1])).toISOString():new Date(h.getTime()+36e5).toISOString()}},91437:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.d(b,{I:()=>n,m:()=>m});var e=c(73024),f=c(76760),g=c(34255),h=c(61423),i=c(73912),j=c(4160),k=c(9381),l=a([g,h,i,j]);async function m(a,b={}){let c,{name:d,slug:l,asset_stage:n="exploration",commodity:o=null,deposit_type:p=null,portfolio_entry_id:q=null,description:r=null}=a||{};if(!d||!String(d).trim())return{status:"error",error:"name_required"};let s=(0,g.getDb)(),t=(0,g.nowIso)(),u=(0,h.DJ)(l||d);if(s.prepare("SELECT id FROM mines_projects WHERE slug = ? LIMIT 1").get(u))return{status:"error",error:"slug_in_use",slug:u};if(q){let a=s.prepare("SELECT id, project_id FROM mines_portfolio_entries WHERE id = ? LIMIT 1").get(q);if(!a)return{status:"error",error:"entry_not_found",portfolio_entry_id:q};if(a.project_id)return{status:"error",error:"entry_already_linked",portfolio_entry_id:q}}try{c=(0,h.gA)({name:String(d).trim(),slug:u,description:r||"Mine project: "+String(d).trim(),color:"#2A5C45"})}catch(a){if(a?.code==="PROJECT_SLUG_EXISTS")return{status:"error",error:"slug_in_use",slug:u};throw a}let v=c.id,w=c.slug,x=(0,g.newId)("mp"),y=q||null;s.prepare("BEGIN").run();try{if(s.prepare(`
       INSERT INTO mines_projects
         (id, os_project_id, name, slug, asset_stage, commodity, deposit_type,
          country, state_province, has_technical_report, data_completeness, created_at, updated_at)