madarx 2.17.0 → 2.19.0

package/.next/standalone/.next/server/chunks/2402.js

@@ -0,0 +1 @@
+"use strict";exports.id=2402,exports.ids=[2402],exports.modules={82402:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Sq:()=>h,bj:()=>k,f$:()=>f.f$,pt:()=>i,x$:()=>f.x$,x4:()=>j});var e=c(66700),f=c(87025),g=a([e]);function h(a){if(!a||"string"!=typeof a)return null;let b=a.trim();if(/^[a-z0-9]{20}$/.test(b))return b;try{let a=new URL(b.includes("://")?b:`https://${b}`).hostname,c=a.match(/^([a-z0-9]{20})\.supabase\.(co|in|red)$/);if(c)return c[1];let d=a.split(".")[0];if(/^[a-z0-9]{20}$/.test(d))return d}catch{}return null}function i(a){let b=h(a);return b?`https://supabase.com/dashboard/project/${b}/sql/new`:null}async function j(a={}){if(!(0,e.isSharedCloudReady)(a))return{configured:!1};let b=(0,e.getSharedCloudAdmin)(a),c=[],d=[];return await Promise.all(f.q_.map(async a=>{try{await b.select(a,{limit:1}),c.push(a)}catch{d.push(a)}})),c.sort(),d.sort(),{configured:!0,ready:0===d.length,present:c,missing:d,total:f.q_.length,version:f.f$}}async function k({ref:a,pat:b}={}){let c,d=h(a)||(/(^[a-z0-9]{20}$)/.test(String(a||""))?a:null);if(!d)return{ok:!1,error:"invalid_project_ref"};if(!b||"string"!=typeof b||b.trim().length<20)return{ok:!1,error:"invalid_access_token"};try{c=await fetch(`https://api.supabase.com/v1/projects/${d}/database/query`,{method:"POST",headers:{Authorization:`Bearer ${b.trim()}`,"Content-Type":"application/json"},body:JSON.stringify({query:f.x$}),redirect:"error",signal:AbortSignal.timeout(3e4)})}catch{return{ok:!1,error:"unreachable"}}return c.ok?{ok:!0}:401===c.status||403===c.status?{ok:!1,error:"unauthorized_token"}:404===c.status?{ok:!1,error:"project_not_found"}:{ok:!1,error:`apply_failed_${c.status}`}}e=(g.then?(await g)():g)[0],d()}catch(a){d(a)}})},87025:(a,b,c)=>{c.d(b,{f$:()=>f,q_:()=>e,x$:()=>d});let d="-- MadarX OS — Supabase shared-layer schema (generated bundle).\n-- Generated from supabase/migrations/*.sql — DO NOT EDIT THE BUNDLE.\n-- Idempotent: safe to run repeatedly in the Supabase SQL editor.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0001_shared_layer.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0001_shared_layer.sql — MadarX OS hybrid shared layer (Supabase / cloud).\n--\n-- WHAT THIS IS\n--   The cloud coordination layer for *explicitly shared* org collaboration.\n--   Personal work stays local: local SQLite + the filesystem remain the source\n--   of truth for private artifacts and local runs. Only data that a user\n--   explicitly publishes/shares is represented here. This migration deliberately\n--   does NOT mirror the full local runtime schema (agents, runs, heartbeat,\n--   secrets, egress, etc.) — only the shared surface needed for collaboration.\n--\n-- WHAT LIVES HERE\n--   organizations         — tenant boundary (id mirrors the local org id, text)\n--   org_memberships       — who belongs to which org, and their role\n--   shared_spaces         — explicitly shared spaces/projects (metadata only)\n--   shared_artifacts      — metadata for explicitly published artifacts; payload\n--                           is optional and only present when a user opts in\n--   shared_artifact_acl   — per-principal grants on a shared artifact\n--   share_links           — cloud-coordinated external share tokens (hash only)\n--\n-- SECURITY MODEL\n--   RLS is ON for every table. Authenticated end users only ever see rows for\n--   orgs they are a member of, and only mutate per their role. The server-side\n--   service-role key (used by lib/shared-cloud.js, never shipped to the browser)\n--   bypasses RLS to perform publish/unpublish on the user's behalf after the\n--   local app has already authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Tables use IF NOT EXISTS; policies are dropped-then-created.\n\n-- ── Extensions ────────────────────────────────────────────────────────────────\ncreate extension if not exists pgcrypto;\n\n-- ── organizations ─────────────────────────────────────────────────────────────\ncreate table if not exists public.organizations (\n  id          text primary key,\n  slug        text not null unique,\n  name        text not null,\n  plan        text not null default 'free',\n  created_at  timestamptz not null default now(),\n  updated_at  timestamptz not null default now()\n);\n\n-- ── org_memberships ───────────────────────────────────────────────────────────\ncreate table if not exists public.org_memberships (\n  id                 uuid primary key default gen_random_uuid(),\n  org_id             text not null references public.organizations(id) on delete cascade,\n  user_id            uuid not null references auth.users(id) on delete cascade,\n  role               text not null default 'member' check (role in ('owner','admin','member','viewer')),\n  invited_by_user_id uuid,\n  invited_at         timestamptz,\n  accepted_at        timestamptz,\n  created_at         timestamptz not null default now(),\n  unique (org_id, user_id)\n);\ncreate index if not exists idx_org_memberships_user on public.org_memberships(user_id);\ncreate index if not exists idx_org_memberships_org on public.org_memberships(org_id);\n\n-- ── shared_spaces ─────────────────────────────────────────────────────────────\n-- A space/project that was explicitly shared into the org. `local_space_id`\n-- points back to the source-of-truth row in the user's local SQLite.\ncreate table if not exists public.shared_spaces (\n  id             uuid primary key default gen_random_uuid(),\n  org_id         text not null references public.organizations(id) on delete cascade,\n  local_space_id text not null,\n  slug           text not null,\n  name           text not null,\n  description    text,\n  visibility     text not null default 'org' check (visibility in ('org','team','private')),\n  created_by     uuid,\n  created_at     timestamptz not null default now(),\n  updated_at     timestamptz not null default now(),\n  unique (org_id, local_space_id)\n);\ncreate index if not exists idx_shared_spaces_org on public.shared_spaces(org_id);\n\n-- ── shared_artifacts ──────────────────────────────────────────────────────────\n-- Metadata for an explicitly published artifact. `local_artifact_id` points back\n-- to the local source of truth. `content` is nullable on purpose: by default\n-- only metadata is published; the payload is uploaded only when the user opts in.\ncreate table if not exists public.shared_artifacts (\n  id                uuid primary key default gen_random_uuid(),\n  org_id            text not null references public.organizations(id) on delete cascade,\n  space_id          uuid references public.shared_spaces(id) on delete set null,\n  local_artifact_id text not null,\n  title             text not null,\n  kind              text not null default 'html',\n  scope             text not null default 'org' check (scope in ('private','team','org','link')),\n  content_hash      text,\n  byte_size         integer,\n  content           text,\n  storage_path      text,\n  published_by      uuid,\n  published_at      timestamptz not null default now(),\n  updated_at        timestamptz not null default now(),\n  unique (org_id, local_artifact_id)\n);\ncreate index if not exists idx_shared_artifacts_org on public.shared_artifacts(org_id);\ncreate index if not exists idx_shared_artifacts_space on public.shared_artifacts(space_id);\n\n-- ── shared_artifact_acl ───────────────────────────────────────────────────────\ncreate table if not exists public.shared_artifact_acl (\n  id             uuid primary key default gen_random_uuid(),\n  artifact_id    uuid not null references public.shared_artifacts(id) on delete cascade,\n  org_id         text not null references public.organizations(id) on delete cascade,\n  principal_type text not null check (principal_type in ('user','team','org')),\n  principal_id   text,\n  permission     text not null default 'read' check (permission in ('read','write','admin')),\n  created_by     uuid,\n  created_at     timestamptz not null default now(),\n  unique (artifact_id, principal_type, principal_id)\n);\ncreate index if not exists idx_shared_acl_artifact on public.shared_artifact_acl(artifact_id);\n\n-- ── share_links ───────────────────────────────────────────────────────────────\n-- Cloud-coordinated external share. Only the HMAC of the token is stored, so a\n-- DB leak cannot replay outstanding links.\ncreate table if not exists public.share_links (\n  id           uuid primary key default gen_random_uuid(),\n  artifact_id  uuid not null references public.shared_artifacts(id) on delete cascade,\n  org_id       text not null references public.organizations(id) on delete cascade,\n  token_hmac   text not null unique,\n  created_by   uuid,\n  expires_at   timestamptz,\n  max_views    integer,\n  access_count integer not null default 0,\n  revoked      boolean not null default false,\n  created_at   timestamptz not null default now()\n);\ncreate index if not exists idx_share_links_artifact on public.share_links(artifact_id);\n\n-- ── Membership helper functions (SECURITY DEFINER, search_path pinned) ─────────\ncreate or replace function public.is_org_member(p_org_id text)\nreturns boolean\nlanguage sql\nstable\nsecurity definer\nset search_path = public\nas $$\n  select exists (\n    select 1 from public.org_memberships m\n    where m.org_id = p_org_id and m.user_id = auth.uid()\n  );\n$$;\n\ncreate or replace function public.org_role(p_org_id text)\nreturns text\nlanguage sql\nstable\nsecurity definer\nset search_path = public\nas $$\n  select m.role\n  from public.org_memberships m\n  where m.org_id = p_org_id and m.user_id = auth.uid()\n  limit 1;\n$$;\n\n-- ── Enable RLS on every table ─────────────────────────────────────────────────\nalter table public.organizations      enable row level security;\nalter table public.org_memberships    enable row level security;\nalter table public.shared_spaces      enable row level security;\nalter table public.shared_artifacts   enable row level security;\nalter table public.shared_artifact_acl enable row level security;\nalter table public.share_links        enable row level security;\n\n-- ── Policies: organizations ───────────────────────────────────────────────────\ndrop policy if exists organizations_select on public.organizations;\ncreate policy organizations_select on public.organizations\n  for select to authenticated\n  using (public.is_org_member(id));\n\ndrop policy if exists organizations_update on public.organizations;\ncreate policy organizations_update on public.organizations\n  for update to authenticated\n  using (public.org_role(id) in ('owner','admin'))\n  with check (public.org_role(id) in ('owner','admin'));\n\n-- ── Policies: org_memberships ─────────────────────────────────────────────────\n-- A member can see the roster of any org they belong to.\ndrop policy if exists org_memberships_select on public.org_memberships;\ncreate policy org_memberships_select on public.org_memberships\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\n-- Only owners/admins manage membership.\ndrop policy if exists org_memberships_write on public.org_memberships;\ncreate policy org_memberships_write on public.org_memberships\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ── Policies: shared_spaces ───────────────────────────────────────────────────\ndrop policy if exists shared_spaces_select on public.shared_spaces;\ncreate policy shared_spaces_select on public.shared_spaces\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_spaces_write on public.shared_spaces;\ncreate policy shared_spaces_write on public.shared_spaces\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- ── Policies: shared_artifacts ────────────────────────────────────────────────\ndrop policy if exists shared_artifacts_select on public.shared_artifacts;\ncreate policy shared_artifacts_select on public.shared_artifacts\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_artifacts_write on public.shared_artifacts;\ncreate policy shared_artifacts_write on public.shared_artifacts\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- ── Policies: shared_artifact_acl ─────────────────────────────────────────────\ndrop policy if exists shared_artifact_acl_select on public.shared_artifact_acl;\ncreate policy shared_artifact_acl_select on public.shared_artifact_acl\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_artifact_acl_write on public.shared_artifact_acl;\ncreate policy shared_artifact_acl_write on public.shared_artifact_acl\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ── Policies: share_links ─────────────────────────────────────────────────────\ndrop policy if exists share_links_select on public.share_links;\ncreate policy share_links_select on public.share_links\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists share_links_write on public.share_links;\ncreate policy share_links_write on public.share_links\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to publish on a user's behalf\n-- after the local app has authorized the action.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0002_shared_brand.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0002_shared_brand.sql — Org-shared brand profile (MadarX OS shared layer).\n--\n-- WHAT THIS IS\n--   The org-wide brand identity, shared through the cloud coordination layer.\n--   A brand profile is local-first by default (it lives in each install's local\n--   SQLite `config` table). When an owner/admin explicitly *publishes* the brand,\n--   one canonical row lands here so every teammate can *adopt* it locally. This\n--   mirrors the artifact/space publish pattern in lib/shared-cloud.js: nothing\n--   leaves the machine implicitly; publish + adopt are explicit, audited actions.\n--\n-- WHAT LIVES HERE\n--   shared_brand_profiles — exactly ONE row per org (unique org_id). Holds the\n--   brand profile JSON (company name, colors, fonts, voice, presentation style,\n--   document types) and an optional inlined logo data URL. No secrets — a brand\n--   profile is pure identity, so the full payload is safe to store.\n--\n-- SECURITY MODEL\n--   RLS is ON. Any org member may READ their org's brand (so they can adopt it).\n--   Only owners/admins may WRITE it (brand identity is an admin-managed default,\n--   consistent with organizations_update). The service-role key used server-side\n--   by lib/shared-cloud.js bypasses RLS to publish on an owner's behalf after the\n--   local app has already authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Table uses IF NOT EXISTS; policies are dropped-then-created.\n\n-- ── shared_brand_profiles ─────────────────────────────────────────────────────\ncreate table if not exists public.shared_brand_profiles (\n  id            uuid primary key default gen_random_uuid(),\n  org_id        text not null unique references public.organizations(id) on delete cascade,\n  company_name  text not null default 'Brand',\n  profile_json  jsonb not null,\n  logo_data_url text,\n  content_hash  text,\n  published_by  uuid,\n  created_at    timestamptz not null default now(),\n  updated_at    timestamptz not null default now()\n);\ncreate index if not exists idx_shared_brand_org on public.shared_brand_profiles(org_id);\n\n-- ── RLS ───────────────────────────────────────────────────────────────────────\nalter table public.shared_brand_profiles enable row level security;\n\n-- Any member may read their org's brand (needed to adopt it locally).\ndrop policy if exists shared_brand_select on public.shared_brand_profiles;\ncreate policy shared_brand_select on public.shared_brand_profiles\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\n-- Only owners/admins may publish/replace the org brand.\ndrop policy if exists shared_brand_write on public.shared_brand_profiles;\ncreate policy shared_brand_write on public.shared_brand_profiles\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to publish on a user's behalf\n-- after the local app has authorized the action.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0002_shared_spaces_resources.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0002_shared_spaces_resources.sql — Shareable project folders + space resources.\n--\n-- WHAT THIS ADDS (on top of 0001_shared_layer.sql)\n--   1. shared_spaces.space_type   — distinguishes a shared *project folder*\n--      ('project') from a shared *dashboard/UI space* ('dashboard_space').\n--   2. shared_spaces.local_project_id — convenience pointer to the local\n--      projects.id when space_type = 'project' (local_space_id holds the same\n--      value; this column makes project-scoped joins explicit).\n--   3. shared_space_resources     — metadata-only index of the folders, files,\n--      and artifacts that live inside a shared project folder. NEVER stores file\n--      bodies; only name/path/kind/size/sha256/local_only + a metadata jsonb bag.\n--\n-- WHY space_type WIDENS UNIQUENESS\n--   0001 made shared_spaces unique on (org_id, local_space_id). A project id and\n--   a dashboard-space id are drawn from independent id namespaces and could\n--   collide, so the uniqueness is widened to (org_id, space_type, local_space_id).\n--\n-- SECURITY MODEL — identical to 0001\n--   RLS is ON for the new table. Authenticated end users only ever see rows for\n--   orgs they belong to (is_org_member). Writes are gated by org_role. The\n--   server-side service-role key (lib/shared-cloud.js, never shipped to the\n--   browser) bypasses RLS to publish on a user's behalf after the local app has\n--   already authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Columns use ADD COLUMN IF NOT EXISTS; constraints are guarded\n--   with IF EXISTS / catalog checks; the table uses IF NOT EXISTS; policies are\n--   dropped-then-created.\n\n-- ── shared_spaces: new columns ────────────────────────────────────────────────\nalter table public.shared_spaces add column if not exists space_type       text not null default 'dashboard_space';\nalter table public.shared_spaces add column if not exists local_project_id  text;\n\n-- space_type domain guard.\nalter table public.shared_spaces drop constraint if exists shared_spaces_space_type_check;\nalter table public.shared_spaces\n  add constraint shared_spaces_space_type_check\n  check (space_type in ('dashboard_space','project'));\n\n-- Widen uniqueness to include space_type. 0001 created the implicit constraint\n-- named shared_spaces_org_id_local_space_id_key; drop it then add the wider one.\nalter table public.shared_spaces drop constraint if exists shared_spaces_org_id_local_space_id_key;\ndo $$\nbegin\n  if not exists (\n    select 1 from pg_constraint where conname = 'shared_spaces_org_type_local_key'\n  ) then\n    alter table public.shared_spaces\n      add constraint shared_spaces_org_type_local_key\n      unique (org_id, space_type, local_space_id);\n  end if;\nend $$;\n\ncreate index if not exists idx_shared_spaces_type on public.shared_spaces(org_id, space_type);\n\n-- ── shared_space_resources ────────────────────────────────────────────────────\n-- Metadata-only index of what lives inside a shared project folder. The body of\n-- a file is NEVER uploaded here (or anywhere by default) — only its descriptive\n-- metadata. local_only files are excluded by the server library unless a caller\n-- passes an explicit unsafe override; even then only metadata is recorded and\n-- the row is flagged local_only = true.\ncreate table if not exists public.shared_space_resources (\n  id                uuid primary key default gen_random_uuid(),\n  org_id            text not null references public.organizations(id) on delete cascade,\n  shared_space_id   uuid not null references public.shared_spaces(id) on delete cascade,\n  local_resource_id text not null,\n  resource_type     text not null check (resource_type in ('folder','file','artifact')),\n  name              text not null,\n  path              text,\n  mime_type         text,\n  kind              text,\n  size_bytes        integer,\n  sha256            text,\n  local_only        boolean not null default false,\n  metadata          jsonb,\n  updated_at        timestamptz not null default now(),\n  unique (shared_space_id, resource_type, local_resource_id)\n);\ncreate index if not exists idx_shared_space_resources_space on public.shared_space_resources(shared_space_id);\ncreate index if not exists idx_shared_space_resources_org on public.shared_space_resources(org_id);\n\n-- ── RLS ───────────────────────────────────────────────────────────────────────\nalter table public.shared_space_resources enable row level security;\n\ndrop policy if exists shared_space_resources_select on public.shared_space_resources;\ncreate policy shared_space_resources_select on public.shared_space_resources\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_space_resources_write on public.shared_space_resources;\ncreate policy shared_space_resources_write on public.shared_space_resources\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to publish on a user's behalf\n-- after the local app has authorized the action.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0003_org_invites.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0003_org_invites.sql — Org invite & join (email pre-invite + shareable link).\n--\n-- WHAT THIS ADDS (on top of 0001_shared_layer.sql)\n--   public.org_invites — ONE table for BOTH invite kinds (eng-review decision 1):\n--     • email pre-invite → `email` set, `token_hash` NULL. Claimed on first login\n--       by verified-email match (claim_email_invites RPC). No placeholder users\n--       row, no pending membership — a real membership is created only on join.\n--     • shareable link   → `token_hash` set (SHA-256 of a ≥128-bit CSPRNG token;\n--       the raw token is NEVER stored), `email` NULL. Redeemed via\n--       redeem_invite_token RPC.\n--\n-- WHY RPCs INSTEAD OF LOOSENED RLS (eng-review decision 3)\n--   A not-yet-member cannot read org_invites under RLS (is_org_member is false),\n--   so redemption runs through two SECURITY DEFINER functions that derive the\n--   joining identity from auth.uid()/auth.email() and never trust client input.\n--   Members call them with their OWN JWT — the service-role key never reaches a\n--   member machine. The RPCs are appended by the Phase 2 / Phase 3 changesets.\n--\n-- HARDENING (H2–H5, non-negotiable)\n--   H2  every definer fn: SET search_path, schema-qualified, asserts auth.uid(),\n--       EXECUTE revoked from public/anon and granted to authenticated only.\n--   H3  email-claim requires auth.users.email_confirmed_at and normalized email.\n--   H4  use-count bump is a single conditional UPDATE (no check-then-write);\n--       membership insert is ON CONFLICT DO NOTHING (idempotent).\n--   H5  the granted role is bounded by the CREATOR's role — enforced DB-side by\n--       a BEFORE INSERT trigger here (not only in the API route): an owner may\n--       mint owner/admin/member/viewer; an admin may mint member/viewer only.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Table uses IF NOT EXISTS; policies/trigger/functions are\n--   dropped-then-created or use CREATE OR REPLACE.\n\n-- ── org_invites ───────────────────────────────────────────────────────────────\ncreate table if not exists public.org_invites (\n  id                 uuid primary key default gen_random_uuid(),\n  org_id             text not null references public.organizations(id) on delete cascade,\n  role               text not null default 'member' check (role in ('owner','admin','member','viewer')),\n  email              text,\n  token_hash         text unique,\n  label              text,\n  created_by_user_id uuid,\n  expires_at         timestamptz,\n  max_uses           integer,\n  used_count         integer not null default 0,\n  revoked_at         timestamptz,\n  created_at         timestamptz not null default now(),\n  -- Exactly one invite kind per row.\n  constraint org_invites_kind_chk check ((email is not null)::int + (token_hash is not null)::int = 1)\n);\ncreate index if not exists idx_org_invites_org   on public.org_invites(org_id);\ncreate index if not exists idx_org_invites_email on public.org_invites(lower(email));\ncreate index if not exists idx_org_invites_token on public.org_invites(token_hash);\n\nalter table public.org_invites enable row level security;\n\n-- SELECT: members of the org can see its invites (the roster/admin surface).\ndrop policy if exists org_invites_select on public.org_invites;\ncreate policy org_invites_select on public.org_invites\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\n-- INSERT/UPDATE/DELETE: owners/admins only. The role-grant ceiling (H5) is\n-- enforced in addition by the trigger below. Note: a not-yet-member redeeming a\n-- link does NOT write here directly — the SECURITY DEFINER RPCs do (and they bump\n-- used_count under the function's privileges, not the caller's).\ndrop policy if exists org_invites_write on public.org_invites;\ncreate policy org_invites_write on public.org_invites\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ── H5: role-grant ceiling, enforced DB-side ───────────────────────────────────\n-- The invite's granted role must be bounded by the creator's role in the org.\n-- Without this, anyone who can create an invite could mint an owner invite and\n-- self-escalate. Runs as a trigger so it binds the cloud path regardless of API.\ncreate or replace function public.org_invites_enforce_role_ceiling()\nreturns trigger\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, public\nas $$\ndeclare\n  v_creator_role text;\nbegin\n  -- Only the GRANTED ROLE is ceiling-bounded. used_count bumps and revoked_at\n  -- writes (which redeem_invite_token / revoke perform, sometimes as the joining\n  -- member) leave role unchanged and must pass freely — otherwise redemption,\n  -- which UPDATEs used_count under the member's own auth.uid(), would be blocked.\n  if tg_op = 'UPDATE' and new.role is not distinct from old.role then\n    return new;\n  end if;\n  -- Service-role / server path: auth.uid() is NULL. The owner app already\n  -- authorized the action at the API layer (requireRole admin) before using the\n  -- service key, which bypasses RLS by design. The ceiling exists to stop an\n  -- AUTHENTICATED admin from self-escalating via a direct PostgREST insert OR a\n  -- role-changing UPDATE (auth.uid() is set on those paths).\n  if auth.uid() is null then\n    return new;\n  end if;\n  v_creator_role := public.org_role(new.org_id);\n  if v_creator_role is null then\n    raise exception 'org_invites: creator is not a member of org %', new.org_id;\n  end if;\n  -- owner may grant any role; admin may grant member/viewer only.\n  if v_creator_role = 'owner' then\n    return new;\n  elsif v_creator_role = 'admin' and new.role in ('member','viewer') then\n    return new;\n  end if;\n  raise exception 'org_invites: role % cannot mint an invite granting %', v_creator_role, new.role;\nend;\n$$;\n\ndrop trigger if exists trg_org_invites_role_ceiling on public.org_invites;\ncreate trigger trg_org_invites_role_ceiling\n  before insert or update on public.org_invites\n  for each row execute function public.org_invites_enforce_role_ceiling();\n\nrevoke execute on function public.org_invites_enforce_role_ceiling() from public, anon;\n\n-- ── Phase 2: claim_email_invites() — email pre-invite claim (H2/H3/H4) ─────────\n-- Called by the member's session ONLY when they currently have no membership\n-- (bounded to first-login / no-org state). Derives identity from auth.uid()/\n-- auth.email(); accepts NO client input. Honors a claim only for a VERIFIED,\n-- normalized email (H3). Membership insert is idempotent (H4).\ncreate or replace function public.claim_email_invites()\nreturns table(org_id text, granted_role text)\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, public\nas $$\ndeclare\n  v_uid   uuid := auth.uid();\n  v_email text;\n  rec     record;\nbegin\n  if v_uid is null then\n    raise exception 'claim_email_invites: authentication required';\n  end if;\n  -- H3: verified email only, normalized (lower+trim).\n  select lower(trim(u.email)) into v_email\n    from auth.users u\n    where u.id = v_uid and u.email_confirmed_at is not null;\n  if v_email is null then\n    return;\n  end if;\n  for rec in\n    select * from public.org_invites\n      where lower(email) = v_email and revoked_at is null\n        and (expires_at is null or expires_at > now())\n  loop\n    insert into public.org_memberships (org_id, user_id, role, accepted_at)\n    values (rec.org_id, v_uid, rec.role, now())\n    on conflict (org_id, user_id) do nothing;\n    update public.org_invites\n      set used_count = used_count + 1, revoked_at = now()\n      where id = rec.id and revoked_at is null;\n    org_id := rec.org_id; granted_role := rec.role; return next;\n  end loop;\n  return;\nend;\n$$;\nrevoke execute on function public.claim_email_invites() from public, anon;\ngrant  execute on function public.claim_email_invites() to authenticated;\n\n-- ── Phase 3: redeem_invite_token() — shareable-link redemption (H2/H4, Q2) ─────\n-- Called by POST /api/orgs/join under the member's own JWT. Derives the joining\n-- identity from auth.uid(); accepts ONLY the opaque token (never org_id/role/\n-- user_id/used_count). H4: the use-count bump is a single conditional UPDATE.\n-- Q2: an existing member is a no-op that consumes no use.\ncreate or replace function public.redeem_invite_token(p_token text)\nreturns table(org_id text, granted_role text)\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, public\nas $$\ndeclare\n  v_uid  uuid := auth.uid();\n  v_hash text;\n  rec    public.org_invites%rowtype;\nbegin\n  if v_uid is null then\n    raise exception 'redeem_invite_token: authentication required';\n  end if;\n  if p_token is null or length(p_token) = 0 then\n    raise exception 'invalid invite token';\n  end if;\n  -- sha256() is a pg_catalog built-in (PG14+), so it resolves under the pinned\n  -- search_path WITHOUT depending on where pgcrypto's digest() was installed\n  -- (Supabase puts pgcrypto in `extensions`, not `public`). Matches the Node\n  -- hashToken(): sha256 hex of the token's UTF-8 bytes.\n  v_hash := encode(sha256(p_token::bytea), 'hex');\n\n  select * into rec from public.org_invites\n    where token_hash = v_hash and email is null;\n  if rec.id is null then\n    raise exception 'invalid invite token';\n  end if;\n\n  -- Q2: an existing member just resolves — consume no use.\n  if exists (select 1 from public.org_memberships m where m.org_id = rec.org_id and m.user_id = v_uid) then\n    org_id := rec.org_id;\n    select m.role into granted_role from public.org_memberships m\n      where m.org_id = rec.org_id and m.user_id = v_uid;\n    return next; return;\n  end if;\n\n  -- H4: atomic conditional bump (no check-then-write).\n  update public.org_invites\n    set used_count = used_count + 1\n    where id = rec.id and revoked_at is null\n      and (expires_at is null or expires_at > now())\n      and (max_uses is null or used_count < max_uses);\n  if not found then\n    raise exception 'invite is no longer valid (expired, revoked, or fully used)';\n  end if;\n\n  insert into public.org_memberships (org_id, user_id, role, accepted_at)\n  values (rec.org_id, v_uid, rec.role, now())\n  on conflict (org_id, user_id) do nothing;\n\n  org_id := rec.org_id; granted_role := rec.role; return next;\nend;\n$$;\nrevoke execute on function public.redeem_invite_token(text) from public, anon;\ngrant  execute on function public.redeem_invite_token(text) to authenticated;\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0004_tighten_share_links.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0004_tighten_share_links.sql — Narrow share_links writes to owner/admin.\n--\n-- WHY (locked tension resolution)\n--   0001 allowed share_links writes by (owner, admin, member). A public share\n--   link is an external-exposure decision; a plain member should not be able to\n--   mint one. This migration TIGHTENS that one policy to (owner, admin). It is\n--   the ONLY RLS change in the invite/join feature, and it is a tightening — not\n--   the loosening the original Phase 6 draft proposed. Members still publish\n--   artifacts and spaces (those policies are unchanged); they simply cannot mint\n--   public share-links.\n--\n-- IDEMPOTENCY\n--   Safe to re-run: the policy is dropped-then-created.\n\ndrop policy if exists share_links_write on public.share_links;\ncreate policy share_links_write on public.share_links\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0005_shared_space_acl.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0003_shared_space_acl.sql — Per-principal access grants for shared spaces.\n--\n-- WHAT THIS ADDS (on top of 0001 + 0002)\n--   shared_space_acl — grants a specific principal (a user, a team, or the whole\n--   org) a permission (read | write | admin) on a shared space/project folder.\n--   This is the space-level mirror of `shared_artifact_acl` (0001). The coarse\n--   `shared_spaces.visibility` flag stays the baseline; these rows AUGMENT it:\n--     - visibility='private' + user grants  → \"only these people\"\n--     - visibility='org'                    → every member gets baseline read;\n--                                             grants only ELEVATE permission.\n--\n-- PERMISSION SEMANTICS (enforced read-time in lib/shared-cloud.js)\n--   read   browse the space's resource index + open published artifact bodies\n--   write  read + re-sync / add resources\n--   admin  write + manage this space's ACL\n--\n-- PRINCIPAL TYPES\n--   'user' and 'org' are live. 'team' is kept in the CHECK domain for forward\n--   compatibility but is NOT yet targetable (no teams table exists — Phase 4).\n--\n-- SECURITY MODEL — identical to 0001/0002\n--   RLS ON. Authenticated end users only see rows for orgs they belong to\n--   (is_org_member). Writes require org_role in ('owner','admin'). The\n--   service-role key (lib/shared-cloud.js, server-only) bypasses RLS to write a\n--   grant AFTER the local app has authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Table uses IF NOT EXISTS; policies are dropped-then-created.\n\n-- ── shared_space_acl ────────────────────────────────────────────────────────────\ncreate table if not exists public.shared_space_acl (\n  id              uuid primary key default gen_random_uuid(),\n  shared_space_id uuid not null references public.shared_spaces(id) on delete cascade,\n  org_id          text not null references public.organizations(id) on delete cascade,\n  principal_type  text not null check (principal_type in ('user','team','org')),\n  principal_id    text not null,\n  permission      text not null default 'read' check (permission in ('read','write','admin')),\n  created_by      uuid,\n  created_at      timestamptz not null default now(),\n  updated_at      timestamptz not null default now(),\n  unique (shared_space_id, principal_type, principal_id)\n);\ncreate index if not exists idx_shared_space_acl_space on public.shared_space_acl(shared_space_id);\ncreate index if not exists idx_shared_space_acl_org on public.shared_space_acl(org_id);\n\n-- ── RLS ───────────────────────────────────────────────────────────────────────\nalter table public.shared_space_acl enable row level security;\n\ndrop policy if exists shared_space_acl_select on public.shared_space_acl;\ncreate policy shared_space_acl_select on public.shared_space_acl\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_space_acl_write on public.shared_space_acl;\ncreate policy shared_space_acl_write on public.shared_space_acl\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to write a grant after the\n-- local app has authorized the action.\n\n-- Refresh the PostgREST schema cache so new tables are visible now.\nnotify pgrst, 'reload schema';\n",e=["org_invites","org_memberships","organizations","share_links","shared_artifact_acl","shared_artifacts","shared_brand_profiles","shared_space_acl","shared_space_resources","shared_spaces"],f="065e7d20e9ca"}};

package/.next/standalone/.next/server/chunks/396.js

@@ -0,0 +1 @@
+"use strict";exports.id=396,exports.ids=[396],exports.modules={90396:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{getPublicBaseUrl:()=>h,wz:()=>i,x6:()=>j});var e=c(67179),f=a([e]);e=(f.then?(await f)():f)[0];let k="public_base_url",l=["MADARX_PUBLIC_URL","MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function g(a){if(!a||!String(a).trim())return"";let b=String(a).trim().replace(/\/+$/,"");return/^https?:\/\//i.test(b)?b:""}function h(){try{let a=g((0,e.getConfig)(k,null));if(a)return a}catch{}for(let a of l){let b=g(process.env[a]);if(b)return b}return""}function i(a){let b=null==a?"":String(a).trim();if(""===b)return(0,e.setConfig)(k,""),"";if(!function(a){let b=g(a);if(!b)return!1;try{return new URL(b),!0}catch{return!1}}(b))throw Error("public app URL must be a valid http(s) URL, e.g. https://madarx.io");let c=g(b);return(0,e.setConfig)(k,c),c}function j(a){let b=String(a||""),c=b.startsWith("/")?b:`/${b}`,d=h();return d?`${d}${c}`:c}d()}catch(a){d(a)}})}};

package/.next/standalone/.next/server/chunks/4804.js

@@ -5,4 +5,4 @@ ${d}`}(y,s?.id);G&&D.push(G);let H=function(a){if(!a?.active)return"";let b=(a.c
 ${A}`),z&&D.push(`Recent artifacts in current scope (most recent first):
 ${z}`),B&&D.push(`Owner approvals waiting (do NOT auto-bypass — surface and confirm):
 ${B}`),C&&D.push(`Durable memory the operator chose to share:
-${C}`),w.length&&D.push(`Voice providers configured: ${w.join(", ")}.`),D.push(`You have the FULL main-agent tool surface — same catalog the typed dashboard agent uses. Every call goes through the madarX approval, allowlist, rate-limit, and audit gates; never claim a tool ran until the call returns success. Available tools: ${x.join(", ")}.`),D.push('Cross-scope access: find_artifacts searches every project, not just the active one. Call list_projects to enumerate projects on demand. Call get_state with project_id="<slug or id>" to read a specific project, or with project_id=null to read across all projects. Spaces are client-side UI tabs that group artifacts — they do not gate your reach; any artifact in any space is reachable via find_artifacts.'),D.push('Rules: never speak API keys, ephemeral tokens, or secret values aloud. If a tool returns approval_required, tell the operator one short sentence and stop. Prefer artifact creation for anything longer than ~30 spoken seconds. Never invent artifact IDs — call find_artifacts or get_state first. To read an artifact\'s body, call read_artifact with the id from find_artifacts; do NOT claim you have read it until that call returns content. ARTIFACT CREATION — choose the right tool: (1) For any VISUAL result the operator expects to look designed — a list page, snapshot, brief, report, dashboard, presentation, landing page, "make a page for X", "show me X" — call generate_ui with a specific description that includes the actual content/data to render. generate_ui produces a full styled HTML document using the madarX brand system (typography, color, layout). (2) For plain written notes, scratch summaries, or pure markdown exports the operator asked for explicitly, use create_artifact with kind="markdown". Never use create_artifact for visual outputs — it stores raw text and the dashboard renders it as a basic document, not a designed page. Whenever the operator asks for a summary, brief, page, doc, or report, create the artifact unprompted as the result of the turn — do not ask for permission first.'),{instructions:D.join("\n\n").slice(0,7800),tools:x,capabilities:v,date_iso:l(),project:s?{id:s.id,slug:s.slug,name:s.name}:null,active_space:d?{id:d.id,name:d.name}:null,providers_configured:w}}d()}catch(a){d(a)}})},25018:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Ww:()=>j,dK:()=>i,lA:()=>k});var e=c(24516),f=a([e]);function g(a){return!!((0,e.getSecret)(a)||process.env[a])}function h(a){let b=process.env[a];return b&&/^https?:\/\//i.test(b.trim())?b.trim():null}function i(){let a={openai:g("OPENAI_API_KEY")},b={openai:g("OPENAI_API_KEY"),elevenlabs:g("ELEVENLABS_API_KEY"),local:!!h("MADARX_LOCAL_TTS_URL")},c={openai:g("OPENAI_API_KEY"),elevenlabs:g("ELEVENLABS_API_KEY"),local:!!h("MADARX_LOCAL_STT_URL")||"1"===process.env.LOCAL_WHISPER},d={anthropic:g("ANTHROPIC_API_KEY"),openai:g("OPENAI_API_KEY")};return{realtime:a,tts:b,stt:c,llm:d}}function j(a=i()){let b=[];return a.realtime.openai&&b.push("openai_realtime"),a.llm.anthropic&&b.push("anthropic_stream"),a.tts.openai&&b.push("openai_tts"),a.tts.elevenlabs&&b.push("elevenlabs_tts"),a.stt.elevenlabs&&b.push("elevenlabs_scribe"),a.stt.local&&b.push("local_stt"),a.tts.local&&b.push("local_tts"),b}function k(){let a=i();return{capabilities:a,default_mode:function(a=i()){return a.realtime.openai?"realtime":a.tts.openai||a.tts.elevenlabs||a.tts.local?"tts":a.stt.local&&a.tts.local?"local":"off"}(a),default_tts_provider:function(a=i()){let b=String(process.env.MADARX_VOICE_DEFAULT_PROVIDER||"").toLowerCase();return b&&a.tts[b]?b:a.tts.elevenlabs?"elevenlabs":a.tts.openai?"openai":a.tts.local?"local":null}(a),providers_configured:j(a),local_slots:{tts_url:h("MADARX_LOCAL_TTS_URL"),stt_url:h("MADARX_LOCAL_STT_URL")}}}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},62834:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{CW:()=>j,PA:()=>h,Q_:()=>i,h0:()=>k});var e=c(34255),f=a([e]);e=(f.then?(await f)():f)[0];let l=new Set(["agent","project","global"]);function g(a,b){if(!a)return null;let c={...a,local_only:1===a.local_only};return c.local_only&&"ollama"!==b?(c.content="[local-only memory redacted]",c.redacted=!0):c.redacted=!1,c}function h(a={}){if(!l.has(a.scope))throw Error("invalid memory scope");if(!a.content)throw Error("content is required");let b=(0,e.nowIso)(),c=(0,e.newId)("mem");return(0,e.getDb)().prepare("INSERT INTO agent_memory (id, agent_id, project_id, scope, kind, content, source, local_only, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").run(c,a.agent_id||null,a.project_id||null,a.scope,a.kind||"note",String(a.content),a.source||null,+!!a.local_only,b,b),(0,e.getDb)().prepare("SELECT * FROM agent_memory WHERE id = ?").get(c)}function i(a={}){let b=[],c=[];a.agent_id&&(b.push("(agent_id = ? OR scope != ?)"),c.push(a.agent_id,"agent")),a.project_id&&(b.push("(project_id = ? OR scope = ?)"),c.push(a.project_id,"global"));let d=`SELECT * FROM agent_memory ${b.length?"WHERE "+b.join(" AND "):""} ORDER BY updated_at DESC`;return(0,e.getDb)().prepare(d).all(...c).map(b=>g(b,a.engine||"ollama"))}function j(a,b,c="",d){if(!d)throw Error("engine parameter required");let f=String(c||"").toLowerCase().split(/\s+/).filter(Boolean).slice(0,8),h=[b||"",a||""],i="SELECT * FROM agent_memory WHERE (scope = 'global' OR (scope = 'project' AND project_id = ?) OR (scope = 'agent' AND agent_id = ?))";return f.length&&(i+=` AND (${f.map(()=>"LOWER(content) LIKE ?").join(" OR ")})`,h.push(...f.map(a=>`%${a}%`))),i+=" ORDER BY updated_at DESC LIMIT 50",(0,e.getDb)().prepare(i).all(...h).map(a=>g(a,d))}function k(a){return(0,e.getDb)().prepare("DELETE FROM agent_memory WHERE id = ?").run(a),!0}d()}catch(a){d(a)}})},71231:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Ed:()=>k,K_:()=>j,cl:()=>m,vQ:()=>l});var e=c(511),f=c(40718),g=a([e,f]);function h(a){return{type:"function",name:a.name,description:a.description||"",parameters:a.input_schema||{type:"object",properties:{}}}}function i(){return(0,e.Y)()}function j(){return i().map(a=>{var b;return{name:a.name,title:(b=a.name,String(b||"").replace(/[_-]+/g," ").replace(/\b\w/g,a=>a.toUpperCase())),description:a.description||"",risk_level:function(a){let b=(0,f.n4)().find(b=>b.name===a);return b?.risk_level?b.risk_level:/^(delete_|send_|whatsapp_|email_|gh_pr_merge|supabase_(update|delete|sql|rpc)|stripe_)/.test(a)?"medium":"low"}(a.name)}})}function k(){return i().map(h)}function l(a){return!!a&&i().some(b=>b.name===a)}async function m(a,b={},c={}){if(!a)throw Error("voice tool name is required");return(0,e.o8)(a,b||{},{project_id:c?.project_id??null,agent_id:c?.agent_id??null,triggered_by:"voice"})}[e,f]=g.then?(await g)():g,d()}catch(a){d(a)}})},95736:(a,b,c)=>{a.exports=c(44870)}};
+${C}`),w.length&&D.push(`Voice providers configured: ${w.join(", ")}.`),D.push(`You have the FULL main-agent tool surface — same catalog the typed dashboard agent uses. Every call goes through the madarX approval, allowlist, rate-limit, and audit gates; never claim a tool ran until the call returns success. Available tools: ${x.join(", ")}.`),D.push('Cross-scope access: find_artifacts searches every project, not just the active one. Call list_projects to enumerate projects on demand. Call get_state with project_id="<slug or id>" to read a specific project, or with project_id=null to read across all projects. Spaces are client-side UI tabs that group artifacts — they do not gate your reach; any artifact in any space is reachable via find_artifacts.'),D.push('Rules: never speak API keys, ephemeral tokens, or secret values aloud. If a tool returns approval_required, tell the operator one short sentence and stop. Prefer artifact creation for anything longer than ~30 spoken seconds. Never invent artifact IDs — call find_artifacts or get_state first. To read an artifact\'s body, call read_artifact with the id from find_artifacts; do NOT claim you have read it until that call returns content. ARTIFACT CREATION — choose the right tool: (1) For any VISUAL result the operator expects to look designed — a list page, snapshot, brief, report, dashboard, presentation, landing page, "make a page for X", "show me X" — call generate_ui with a specific description that includes the actual content/data to render. generate_ui produces a full styled HTML document using the madarX brand system (typography, color, layout). (2) For plain written notes, scratch summaries, or pure markdown exports the operator asked for explicitly, use create_artifact with kind="markdown". Never use create_artifact for visual outputs — it stores raw text and the dashboard renders it as a basic document, not a designed page. Whenever the operator asks for a summary, brief, page, doc, or report, create the artifact unprompted as the result of the turn — do not ask for permission first. BRAND IS MANDATORY: every visual artifact MUST follow the madarX brand guidelines above (palette, typography, layout) — generate_ui applies them automatically, so always route designed output through generate_ui. Never emit an off-brand layout, default-looking page, or any emoji in an artifact.'),{instructions:D.join("\n\n").slice(0,7800),tools:x,capabilities:v,date_iso:l(),project:s?{id:s.id,slug:s.slug,name:s.name}:null,active_space:d?{id:d.id,name:d.name}:null,providers_configured:w}}d()}catch(a){d(a)}})},25018:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Ww:()=>j,dK:()=>i,lA:()=>k});var e=c(24516),f=a([e]);function g(a){return!!((0,e.getSecret)(a)||process.env[a])}function h(a){let b=process.env[a];return b&&/^https?:\/\//i.test(b.trim())?b.trim():null}function i(){let a={openai:g("OPENAI_API_KEY")},b={openai:g("OPENAI_API_KEY"),elevenlabs:g("ELEVENLABS_API_KEY"),local:!!h("MADARX_LOCAL_TTS_URL")},c={openai:g("OPENAI_API_KEY"),elevenlabs:g("ELEVENLABS_API_KEY"),local:!!h("MADARX_LOCAL_STT_URL")||"1"===process.env.LOCAL_WHISPER},d={anthropic:g("ANTHROPIC_API_KEY"),openai:g("OPENAI_API_KEY")};return{realtime:a,tts:b,stt:c,llm:d}}function j(a=i()){let b=[];return a.realtime.openai&&b.push("openai_realtime"),a.llm.anthropic&&b.push("anthropic_stream"),a.tts.openai&&b.push("openai_tts"),a.tts.elevenlabs&&b.push("elevenlabs_tts"),a.stt.elevenlabs&&b.push("elevenlabs_scribe"),a.stt.local&&b.push("local_stt"),a.tts.local&&b.push("local_tts"),b}function k(){let a=i();return{capabilities:a,default_mode:function(a=i()){return a.realtime.openai?"realtime":a.tts.openai||a.tts.elevenlabs||a.tts.local?"tts":a.stt.local&&a.tts.local?"local":"off"}(a),default_tts_provider:function(a=i()){let b=String(process.env.MADARX_VOICE_DEFAULT_PROVIDER||"").toLowerCase();return b&&a.tts[b]?b:a.tts.elevenlabs?"elevenlabs":a.tts.openai?"openai":a.tts.local?"local":null}(a),providers_configured:j(a),local_slots:{tts_url:h("MADARX_LOCAL_TTS_URL"),stt_url:h("MADARX_LOCAL_STT_URL")}}}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},62834:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{CW:()=>j,PA:()=>h,Q_:()=>i,h0:()=>k});var e=c(34255),f=a([e]);e=(f.then?(await f)():f)[0];let l=new Set(["agent","project","global"]);function g(a,b){if(!a)return null;let c={...a,local_only:1===a.local_only};return c.local_only&&"ollama"!==b?(c.content="[local-only memory redacted]",c.redacted=!0):c.redacted=!1,c}function h(a={}){if(!l.has(a.scope))throw Error("invalid memory scope");if(!a.content)throw Error("content is required");let b=(0,e.nowIso)(),c=(0,e.newId)("mem");return(0,e.getDb)().prepare("INSERT INTO agent_memory (id, agent_id, project_id, scope, kind, content, source, local_only, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)").run(c,a.agent_id||null,a.project_id||null,a.scope,a.kind||"note",String(a.content),a.source||null,+!!a.local_only,b,b),(0,e.getDb)().prepare("SELECT * FROM agent_memory WHERE id = ?").get(c)}function i(a={}){let b=[],c=[];a.agent_id&&(b.push("(agent_id = ? OR scope != ?)"),c.push(a.agent_id,"agent")),a.project_id&&(b.push("(project_id = ? OR scope = ?)"),c.push(a.project_id,"global"));let d=`SELECT * FROM agent_memory ${b.length?"WHERE "+b.join(" AND "):""} ORDER BY updated_at DESC`;return(0,e.getDb)().prepare(d).all(...c).map(b=>g(b,a.engine||"ollama"))}function j(a,b,c="",d){if(!d)throw Error("engine parameter required");let f=String(c||"").toLowerCase().split(/\s+/).filter(Boolean).slice(0,8),h=[b||"",a||""],i="SELECT * FROM agent_memory WHERE (scope = 'global' OR (scope = 'project' AND project_id = ?) OR (scope = 'agent' AND agent_id = ?))";return f.length&&(i+=` AND (${f.map(()=>"LOWER(content) LIKE ?").join(" OR ")})`,h.push(...f.map(a=>`%${a}%`))),i+=" ORDER BY updated_at DESC LIMIT 50",(0,e.getDb)().prepare(i).all(...h).map(a=>g(a,d))}function k(a){return(0,e.getDb)().prepare("DELETE FROM agent_memory WHERE id = ?").run(a),!0}d()}catch(a){d(a)}})},71231:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Ed:()=>k,K_:()=>j,cl:()=>m,vQ:()=>l});var e=c(511),f=c(40718),g=a([e,f]);function h(a){return{type:"function",name:a.name,description:a.description||"",parameters:a.input_schema||{type:"object",properties:{}}}}[e,f]=g.then?(await g)():g;let n=new Set(["web_search","web_fetch","find_artifacts","get_state","create_artifact","update_artifact","generate_ui","voice_speak","create_agent","upsert_schedule"]);function i(){let a=(0,e.Y)();if("1"===process.env.MADARX_VOICE_FAST_TOOLS){let b=a.filter(a=>n.has(a.name));if(b.length)return b}return a}function j(){return i().map(a=>{var b;return{name:a.name,title:(b=a.name,String(b||"").replace(/[_-]+/g," ").replace(/\b\w/g,a=>a.toUpperCase())),description:a.description||"",risk_level:function(a){let b=(0,f.n4)().find(b=>b.name===a);return b?.risk_level?b.risk_level:/^(delete_|send_|whatsapp_|email_|gh_pr_merge|supabase_(update|delete|sql|rpc)|stripe_)/.test(a)?"medium":"low"}(a.name)}})}function k(){return i().map(h)}function l(a){return!!a&&(0,e.Y)().some(b=>b.name===a)}async function m(a,b={},c={}){if(!a)throw Error("voice tool name is required");return(0,e.o8)(a,b||{},{project_id:c?.project_id??null,agent_id:c?.agent_id??null,triggered_by:"voice"})}d()}catch(a){d(a)}})},95736:(a,b,c)=>{a.exports=c(44870)}};

package/.next/standalone/.next/server/chunks/5030.js

@@ -0,0 +1 @@
+exports.id=5030,exports.ids=[5030],exports.modules={6974:(a,b,c)=>{Promise.resolve().then(c.bind(c,35271))},33488:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{"409e7a24c2c43a0d5a44a39459b643ecf9537d842f":()=>e.$$RSC_SERVER_ACTION_0});var e=c(91845),f=a([e]);e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})},35271:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/admin/project-switcher.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/admin/project-switcher.jsx","default")},86893:(a,b,c)=>{"use strict";c.d(b,{hI:()=>g,iN:()=>f,pp:()=>i,qs:()=>h});var d=c(75338),e=c(35271);function f({kicker:a="madarX OS v1.0",title:b,description:c,actions:f,hideProjectSwitcher:g,children:h}){return(0,d.jsxs)("main",{className:"admin-shell",children:[(0,d.jsxs)("header",{className:"admin-header",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("span",{className:"admin-kicker",children:a}),(0,d.jsx)("h1",{children:b}),c?(0,d.jsx)("p",{children:c}):null]}),(0,d.jsxs)("div",{className:"admin-header-actions",children:[g?null:(0,d.jsx)(e.default,{}),f]})]}),h]})}function g({label:a,value:b,tone:c}){return(0,d.jsxs)("div",{className:`admin-stat ${c||""}`,children:[(0,d.jsx)("b",{children:b}),(0,d.jsx)("span",{children:a})]})}function h({children:a,tone:b="neutral"}){return(0,d.jsx)("span",{className:`admin-pill ${b}`,children:a})}function i({title:a,children:b}){return(0,d.jsxs)("div",{className:"admin-empty",children:[(0,d.jsx)("b",{children:a}),(0,d.jsx)("p",{children:b})]})}},89670:(a,b,c)=>{Promise.resolve().then(c.bind(c,94657))},91845:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{$$RSC_SERVER_ACTION_0:()=>u,default:()=>p,dynamic:()=>q,runtime:()=>r});var e=c(75338),f=c(75879);c(68633);var g=c(16780),h=c(82161),i=c(86893),j=c(83963),k=c(60105),l=a([j,k]);[j,k]=l.then?(await l)():l;let q="force-dynamic",r="nodejs",s={executive:"Executive",manager:"Manager",team_lead:"Team Lead",individual_contributor:"Contributor"},t={executive:"mars",manager:"ready",team_lead:"warn",individual_contributor:"neutral"};function m(a=""){return a.split(/\s+/).map(a=>a[0]).filter(Boolean).slice(0,2).join("").toUpperCase()||"\xb7"}let u=async function(a){let b=String(a.get("agent_id")||"").trim();if(!b)return;let c=String(a.get("reports_to")||"").trim(),d={reports_to:""===c?null:c},e=String(a.get("role")||"").trim();e&&(d.role=e);let f=String(a.get("title")||"").trim();(f||a.has("title"))&&(d.title=f||null);try{(0,j.jN)(b,d)}catch(a){console.warn("updateAgentOrg failed",a?.message)}(0,g.revalidatePath)("/org"),(0,g.revalidatePath)("/agents"),(0,h.redirect)("/org")};function n({node:a,workloadById:b}){let c=function(a){if(a.role&&s[a.role])return a.role;let b=a.reports?.length||0;return b>=4?"executive":b>=2?"manager":1===b?"team_lead":"individual_contributor"}(a),d=s[c],f=t[c],g=a.reports?.length||0,h=b.get(a.id),j=Number(h?.active_tasks||0),k=Number(h?.blocked_tasks||0),l=Number(h?.completed_tasks||0),n=a.status||"created";return(0,e.jsxs)("article",{className:`org-card org-card--${c}`,"data-reports":g>0?"has":"none",children:[(0,e.jsxs)("div",{className:"org-card-head",children:[(0,e.jsx)("div",{className:"org-card-avatar","aria-hidden":"true",children:m(a.name)}),(0,e.jsxs)("div",{className:"org-card-identity",children:[(0,e.jsx)("div",{className:"org-card-name",children:a.name}),(0,e.jsx)("div",{className:"org-card-title",children:a.title||a.mission?.slice(0,64)||"No title set"})]})]}),(0,e.jsxs)("div",{className:"org-card-meta",children:[(0,e.jsx)(i.qs,{tone:f,children:d}),(0,e.jsx)(i.qs,{tone:"heartbeat ok"===n?"ready":"terminated"===n?"danger":"neutral",children:n}),g>0?(0,e.jsxs)(i.qs,{tone:"neutral",children:[g," report",1===g?"":"s"]}):null]}),(0,e.jsxs)("dl",{className:"org-card-stats",children:[(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Active"}),(0,e.jsx)("dd",{children:j})]}),(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Blocked"}),(0,e.jsx)("dd",{className:k?"is-warn":"",children:k})]}),(0,e.jsxs)("div",{children:[(0,e.jsx)("dt",{children:"Done"}),(0,e.jsx)("dd",{children:l})]})]})]})}function o({node:a,workloadById:b}){let c=(a.reports||[]).length>0;return(0,e.jsxs)("li",{className:"org-branch",children:[(0,e.jsx)(n,{node:a,workloadById:b}),c?(0,e.jsx)("ul",{className:"org-children",children:a.reports.map(a=>(0,e.jsx)(o,{node:a,workloadById:b},a.id))}):null]})}function p(){let a=(0,j.zP)(),b=(0,j.hC)(),c=(0,k.vc)(),d=new Map((b.workload||[]).map(a=>[a.agent_id,a])),f=c.filter(a=>c.some(b=>b.reports_to===a.id)).length,g=c.filter(a=>!a.reports_to&&a.id).length;return(0,e.jsxs)(i.iN,{title:"Agent chart",description:"Company-style structure for your agent workforce. Set managers, define roles, and see workload at a glance.",children:[(0,e.jsxs)("section",{className:"admin-stats",children:[(0,e.jsx)(i.hI,{label:"Headcount",value:b.totals.active_agents}),(0,e.jsx)(i.hI,{label:"Leaders",value:f}),(0,e.jsx)(i.hI,{label:"Root nodes",value:g}),(0,e.jsx)(i.hI,{label:"Active tasks",value:b.totals.active_tasks})]}),(0,e.jsxs)("section",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Agent chart"}),(0,e.jsx)("small",{children:"Top-down hierarchy. Each card shows role, status, and current workload."})]}),a.length?(0,e.jsx)("div",{className:"org-chart-scroll",children:(0,e.jsx)("ul",{className:"org-chart",children:a.map(a=>(0,e.jsx)(o,{node:a,workloadById:d},a.id))})}):(0,e.jsx)(i.pp,{title:"No agents yet",children:"Create an agent on the Agents page, then come back here to assign managers."})]}),(0,e.jsxs)("section",{className:"admin-grid reports-layout",children:[(0,e.jsxs)("div",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Reporting lines"}),(0,e.jsx)("small",{children:"Re-parent any agent. Cycles are blocked automatically."})]}),c.length?(0,e.jsx)("div",{className:"admin-card-list compact",children:c.map(a=>{let b=a.reports_to?c.find(b=>b.id===a.reports_to):null,d=c.filter(b=>b.id!==a.id),f=a.role&&s[a.role]?a.role:"individual_contributor";return(0,e.jsxs)("form",{action:u,className:"org-reporting-row",children:[(0,e.jsx)("input",{type:"hidden",name:"agent_id",value:a.id}),(0,e.jsxs)("div",{className:"org-reporting-identity",children:[(0,e.jsx)("div",{className:"org-card-avatar small","aria-hidden":"true",children:m(a.name)}),(0,e.jsxs)("div",{children:[(0,e.jsx)("div",{className:"org-reporting-name",children:a.name}),(0,e.jsx)("div",{className:"org-reporting-sub",children:b?`Reports to ${b.name}`:"Top of chain"})]})]}),(0,e.jsxs)("div",{className:"org-reporting-fields",children:[(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Title"}),(0,e.jsx)("input",{type:"text",name:"title",defaultValue:a.title||"",placeholder:"e.g. Marketing Manager"})]}),(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Role"}),(0,e.jsx)("select",{name:"role",defaultValue:f,children:Object.entries(s).map(([a,b])=>(0,e.jsx)("option",{value:a,children:b},a))})]}),(0,e.jsxs)("label",{className:"org-reporting-field",children:[(0,e.jsx)("span",{children:"Manager"}),(0,e.jsxs)("select",{name:"reports_to",defaultValue:a.reports_to||"",children:[(0,e.jsx)("option",{value:"",children:"— None (top of chain)"}),d.map(a=>(0,e.jsx)("option",{value:a.id,children:a.name},a.id))]})]}),(0,e.jsx)("button",{className:"admin-button",type:"submit",children:"Save"})]})]},a.id)})}):(0,e.jsx)(i.pp,{title:"No agents yet",children:"Create agents to start building your org."})]}),(0,e.jsxs)("div",{className:"admin-panel",children:[(0,e.jsxs)("div",{className:"admin-panel-head",children:[(0,e.jsx)("span",{children:"Workload by agent"}),(0,e.jsx)("small",{children:"Derived from active tasks."})]}),b.workload.length?(0,e.jsx)("div",{className:"admin-card-list compact",children:b.workload.map(a=>(0,e.jsxs)("div",{className:"admin-record compact",children:[(0,e.jsxs)("div",{className:"admin-record-top",children:[(0,e.jsx)("b",{children:a.agent_name||a.agent_id}),(0,e.jsxs)(i.qs,{tone:a.blocked_tasks?"danger":a.active_tasks?"ready":"neutral",children:[a.active_tasks," active"]})]}),(0,e.jsxs)("p",{children:[a.total_tasks," total \xb7 ",a.blocked_tasks," blocked \xb7 ",a.completed_tasks," complete"]})]},a.agent_id))}):(0,e.jsx)(i.pp,{title:"No workload data",children:"Assign tasks to see workload distribution."})]})]})]})}(0,f.A)(u,"409e7a24c2c43a0d5a44a39459b643ecf9537d842f",null),d()}catch(a){d(a)}})},94657:(a,b,c)=>{"use strict";c.d(b,{default:()=>f});var d=c(21124),e=c(38301);function f(){let[a,b]=(0,e.useState)([]),[c,f]=(0,e.useState)("");return(0,d.jsx)("div",{className:"project-switcher","data-project-switcher":!0,children:(0,d.jsxs)("select",{value:c,onChange:a=>{var b;f(b=a.target.value),b?localStorage.setItem("madarx.activeProjectId",b):localStorage.removeItem("madarx.activeProjectId"),window.dispatchEvent(new CustomEvent("madarx:project-change",{detail:{project_id:b||null}}))},"aria-label":"Active project",children:[(0,d.jsx)("option",{value:"",children:"All projects"}),a.map(a=>(0,d.jsx)("option",{value:a.id,children:a.name},a.id))]})})}}};

package/.next/standalone/.next/server/chunks/5858.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=5858,exports.ids=[5858],exports.modules={35858:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{H1:()=>m,Mh:()=>l,NZ:()=>o,TJ:()=>n,UO:()=>k,er:()=>p,nT:()=>r,uS:()=>q});var e=c(77598),f=c(34255),g=c(4160),h=c(76031),i=c(95678),j=a([f,g]);function k(a){return a?(0,f.getDb)().prepare(`SELECT id, title, kind, content, source_md, created_at
+"use strict";exports.id=5858,exports.ids=[396,5858],exports.modules={35858:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{H1:()=>m,Mh:()=>l,NZ:()=>o,TJ:()=>n,UO:()=>k,er:()=>p,nT:()=>r,uS:()=>q});var e=c(77598),f=c(34255),g=c(4160),h=c(76031),i=c(95678),j=a([f,g,i]);function k(a){return a?(0,f.getDb)().prepare(`SELECT id, title, kind, content, source_md, created_at
          FROM artifacts
         WHERE space_id = ?
         ORDER BY created_at ASC, id ASC`).all(String(a)).map(a=>({id:a.id,title:a.title||"Untitled",kind:a.kind||"text",content:a.content||a.source_md||"",created_at:a.created_at||null})):[]}async function l(a,b={},c){let{expires_in_days:d=7,max_views:j=50,require_email_otp:k}=b;if(null!=d&&d>90)throw{status:400,error:"expires_in_days_exceeds_maximum",max:90};let m=(0,f.getDb)();if(!m.prepare("SELECT id FROM dashboard_spaces WHERE id = ?").get(String(a)))throw{status:404,error:"space_not_found"};let n=k;if(null==n){let a=m.prepare("SELECT require_share_email_verification FROM organizations WHERE id = ?").get(c.org_id);n=a?.require_share_email_verification===1}let o=(0,e.randomBytes)(32).toString("base64url"),p=await (0,h.Oj)(),q=(0,h.L5)(o,p),r=null;if(null!=d&&d>0){let a=new Date;a.setDate(a.getDate()+d),r=a.toISOString()}let s=(0,f.newId)("spaceshare"),t=c.org_id;m.prepare(`INSERT INTO space_share_links
@@ -25,4 +25,4 @@
 <p><strong>Your verification code is: ${i}</strong></p>
 <p>This code expires in 10 minutes. Do not share it with anyone.</p>`},{agent_id:null,owner_trusted:!0});if(!d||!1===d.ok)return{ok:!0,expires_in:600,email_sent:!1,email_error:d?.status||"unknown"}}catch(a){return{ok:!0,expires_in:600,email_sent:!1,email_error:a.message}}return{ok:!0,expires_in:600,email_sent:!0}}function r(a,b,c){let d=(0,f.getDb)(),h=d.prepare(`SELECT * FROM space_share_link_otps
         WHERE share_link_id = ? AND email = ? AND expires_at > ? AND verified_at IS NULL
-        ORDER BY created_at DESC LIMIT 1`).get(a,b,(0,f.nowIso)());if(!h)return{ok:!1,reason:"not_found_or_expired"};if(h.attempts>=5){try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_LOCKED_OUT,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP lockout for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts}})}catch{}return{ok:!1,reason:"lockout"}}let[i,j]=h.code_hash.split(":"),k=(0,e.createHash)("sha256").update(i+":"+c).digest("hex"),l=Buffer.from(k,"hex"),m=Buffer.from(j,"hex");if(!(l.length===m.length&&(0,e.timingSafeEqual)(l,m))){d.prepare("UPDATE space_share_link_otps SET attempts = attempts + 1 WHERE id = ?").run(h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_FAILED,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP failed for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts+1}})}catch{}return{ok:!1,reason:"invalid_code"}}d.prepare("UPDATE space_share_link_otps SET verified_at = ? WHERE id = ?").run((0,f.nowIso)(),h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_VERIFIED,action_target_id:a,action_target_type:"space",status:"success",summary:`Space share OTP verified for ${b} on link ${a}`,meta:{share_link_id:a}})}catch{}return{ok:!0}}[f,g]=j.then?(await j)():j,d()}catch(a){d(a)}})},76031:(a,b,c)=>{c.d(b,{L5:()=>g,Oj:()=>f,lr:()=>h,th:()=>j});var d=c(77598);let e=null;async function f(){if(e)return e;if(process.env.MADARX_SHARE_LINK_SECRET)return e=process.env.MADARX_SHARE_LINK_SECRET;try{let{getSecret:a,setSecret:b}=await Promise.resolve().then(c.bind(c,24516)),f=await a("MADARX_SHARE_LINK_SECRET",{scope:"global"});if(f)return e=f;let g=(0,d.randomBytes)(32).toString("hex");return console.warn("[share-secret] WARNING: MADARX_SHARE_LINK_SECRET is not set. A random key has been generated and stored in the secrets vault. Set MADARX_SHARE_LINK_SECRET in your environment before deploying to production — losing this key invalidates all existing share links."),await b("MADARX_SHARE_LINK_SECRET",g,{scope:"global",source:"auto_generated"}),e=g}catch(a){return console.warn("[share-secret] WARNING: Could not access secrets vault for MADARX_SHARE_LINK_SECRET. Using an ephemeral key — share links will break on restart. Error: "+a.message),e=(0,d.randomBytes)(32).toString("hex")}}function g(a,b){return(0,d.createHmac)("sha256",b).update(a).digest("hex")}function h(a,b){let c=Buffer.from(a,"hex"),e=Buffer.from(b,"hex");return c.length===e.length&&(0,d.timingSafeEqual)(c,e)}let i=new Map;function j(a){if(!a)return{ok:!0};let b=Date.now(),c=i.get(a);return!c||b-c.windowStart>=36e5?(i.set(a,{count:1,windowStart:b}),{ok:!0}):c.count>=100?{ok:!1,retryAfterMs:36e5-(b-c.windowStart)}:(c.count+=1,{ok:!0})}},95678:(a,b,c)=>{c.d(b,{_:()=>e});let d=["MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function e(a){let b=String(a||"").startsWith("/")?String(a||""):`/${a||""}`,c=function(){for(let a of d){let b=process.env[a];if(!b||!String(b).trim())continue;let c=String(b).trim().replace(/\/+$/,"");if(/^https?:\/\//i.test(c))return c}return""}();return c?`${c}${b}`:b}}};
+        ORDER BY created_at DESC LIMIT 1`).get(a,b,(0,f.nowIso)());if(!h)return{ok:!1,reason:"not_found_or_expired"};if(h.attempts>=5){try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_LOCKED_OUT,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP lockout for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts}})}catch{}return{ok:!1,reason:"lockout"}}let[i,j]=h.code_hash.split(":"),k=(0,e.createHash)("sha256").update(i+":"+c).digest("hex"),l=Buffer.from(k,"hex"),m=Buffer.from(j,"hex");if(!(l.length===m.length&&(0,e.timingSafeEqual)(l,m))){d.prepare("UPDATE space_share_link_otps SET attempts = attempts + 1 WHERE id = ?").run(h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_FAILED,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP failed for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts+1}})}catch{}return{ok:!1,reason:"invalid_code"}}d.prepare("UPDATE space_share_link_otps SET verified_at = ? WHERE id = ?").run((0,f.nowIso)(),h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_VERIFIED,action_target_id:a,action_target_type:"space",status:"success",summary:`Space share OTP verified for ${b} on link ${a}`,meta:{share_link_id:a}})}catch{}return{ok:!0}}[f,g,i]=j.then?(await j)():j,d()}catch(a){d(a)}})},76031:(a,b,c)=>{c.d(b,{L5:()=>g,Oj:()=>f,lr:()=>h,th:()=>j});var d=c(77598);let e=null;async function f(){if(e)return e;if(process.env.MADARX_SHARE_LINK_SECRET)return e=process.env.MADARX_SHARE_LINK_SECRET;try{let{getSecret:a,setSecret:b}=await Promise.resolve().then(c.bind(c,24516)),f=await a("MADARX_SHARE_LINK_SECRET",{scope:"global"});if(f)return e=f;let g=(0,d.randomBytes)(32).toString("hex");return console.warn("[share-secret] WARNING: MADARX_SHARE_LINK_SECRET is not set. A random key has been generated and stored in the secrets vault. Set MADARX_SHARE_LINK_SECRET in your environment before deploying to production — losing this key invalidates all existing share links."),await b("MADARX_SHARE_LINK_SECRET",g,{scope:"global",source:"auto_generated"}),e=g}catch(a){return console.warn("[share-secret] WARNING: Could not access secrets vault for MADARX_SHARE_LINK_SECRET. Using an ephemeral key — share links will break on restart. Error: "+a.message),e=(0,d.randomBytes)(32).toString("hex")}}function g(a,b){return(0,d.createHmac)("sha256",b).update(a).digest("hex")}function h(a,b){let c=Buffer.from(a,"hex"),e=Buffer.from(b,"hex");return c.length===e.length&&(0,d.timingSafeEqual)(c,e)}let i=new Map;function j(a){if(!a)return{ok:!0};let b=Date.now(),c=i.get(a);return!c||b-c.windowStart>=36e5?(i.set(a,{count:1,windowStart:b}),{ok:!0}):c.count>=100?{ok:!1,retryAfterMs:36e5-(b-c.windowStart)}:(c.count+=1,{ok:!0})}},90396:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{getPublicBaseUrl:()=>h,wz:()=>i,x6:()=>j});var e=c(67179),f=a([e]);e=(f.then?(await f)():f)[0];let k="public_base_url",l=["MADARX_PUBLIC_URL","MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function g(a){if(!a||!String(a).trim())return"";let b=String(a).trim().replace(/\/+$/,"");return/^https?:\/\//i.test(b)?b:""}function h(){try{let a=g((0,e.getConfig)(k,null));if(a)return a}catch{}for(let a of l){let b=g(process.env[a]);if(b)return b}return""}function i(a){let b=null==a?"":String(a).trim();if(""===b)return(0,e.setConfig)(k,""),"";if(!function(a){let b=g(a);if(!b)return!1;try{return new URL(b),!0}catch{return!1}}(b))throw Error("public app URL must be a valid http(s) URL, e.g. https://madarx.io");let c=g(b);return(0,e.setConfig)(k,c),c}function j(a){let b=String(a||""),c=b.startsWith("/")?b:`/${b}`,d=h();return d?`${d}${c}`:c}d()}catch(a){d(a)}})},95678:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{_:()=>g});var e=c(90396),f=a([e]);function g(a){return(0,e.x6)(a)}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})}};

package/.next/standalone/.next/server/chunks/6059.js

@@ -1 +1 @@
-exports.id=6059,exports.ids=[6059],exports.modules={2041:(a,b,c)=>{Promise.resolve().then(c.bind(c,43589)),Promise.resolve().then(c.bind(c,62592))},2987:(a,b,c)=>{"use strict";c.r(b),c.d(b,{default:()=>e});var d=c(97523);let e=async a=>[{type:"image/png",sizes:"64x64",url:(0,d.fillMetadataSegment)(".",await a.params,"icon.png")+"?4138ae2e9ba66d8a"}]},9866:(a,b,c)=>{"use strict";c.d(b,{N:()=>f});let d=null,e=new Set;function f(a){return e.add(a),()=>{if(e.delete(a),0===e.size&&d){try{d.close()}catch{}d=null}}}},30724:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/ui/sidebar-with-submenu.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/ui/sidebar-with-submenu.jsx","default")},43589:(a,b,c)=>{"use strict";c.d(b,{default:()=>t});var d=c(21124),e=c(38301),f=c(42378);let g=[{id:"set-anthropic-key",title:"Set Anthropic API key",category:"Credentials",keywords:["anthropic","api key","claude","apikey","llm","token","cloud engine"],kind:"secret",secretName:"ANTHROPIC_API_KEY",field:{label:"ANTHROPIC_API_KEY",type:"password",placeholder:"sk-ant-…",help:"Used by the Anthropic cloud engine. Stored encrypted in the secrets vault."},settingsHref:"/settings/tools",docSlug:"set-anthropic-key"},{id:"set-resend-key",title:"Set Resend API key (email)",category:"Credentials",keywords:["resend","email","api key","smtp","send mail"],kind:"secret",secretName:"RESEND_API_KEY",field:{label:"RESEND_API_KEY",type:"password",placeholder:"re_…",help:"Enables the email tool. Encrypted at rest."},settingsHref:"/settings/connectors",docSlug:"set-resend-key"},{id:"set-github-token",title:"Set GitHub token",category:"Credentials",keywords:["github","token","pat","api key","git","repo"],kind:"secret",secretName:"GITHUB_TOKEN",field:{label:"GITHUB_TOKEN",type:"password",placeholder:"ghp_… / github_pat_…",help:"Personal access token for the GitHub tool adapter."},settingsHref:"/settings/connectors",docSlug:"set-github-token"},{id:"set-supabase-url",title:"Set Supabase URL",category:"Credentials",keywords:["supabase","url","database","project url","connect"],kind:"secret",secretName:"SUPABASE_URL",field:{label:"SUPABASE_URL",type:"text",placeholder:"https://xxxx.supabase.co",help:"Project URL for Supabase writes + shared cloud layer."},settingsHref:"/settings/connectors",docSlug:"connect-supabase"},{id:"set-supabase-service-key",title:"Set Supabase service-role key",category:"Credentials",keywords:["supabase","service role","key","api key","secret","database"],kind:"secret",secretName:"SUPABASE_SERVICE_ROLE_KEY",field:{label:"SUPABASE_SERVICE_ROLE_KEY",type:"password",placeholder:"eyJ…",help:"Server-side service-role key. Never exposed to the browser."},settingsHref:"/settings/connectors",docSlug:"connect-supabase"},{id:"set-default-model",title:"Set default model",category:"Agent runtime",keywords:["model","default model","llm","opus","sonnet","haiku","picker"],kind:"config",configKey:"model",field:{label:"Default model",type:"select",help:"Model the main agent uses by default.",options:[{value:"claude-opus-4-7",label:"Opus 4.7"},{value:"claude-sonnet-4-6",label:"Sonnet 4.6"},{value:"claude-haiku-4-5-20251001",label:"Haiku 4.5"}]},settingsHref:"/settings/engines",docSlug:"choose-agent-engine"},{id:"set-design-style",title:"Set artifact design style",category:"Agent runtime",keywords:["design","style","aesthetic","minimal","bold","soft","balanced","artifact"],kind:"config",configKey:"designStyle",field:{label:"Design style",type:"select",help:"Visual style agents use when producing artifacts.",options:[{value:"balanced",label:"Balanced"},{value:"minimal",label:"Minimal"},{value:"bold",label:"Bold"},{value:"soft",label:"Soft"}]},settingsHref:"/settings/brand",docSlug:null},{id:"set-trust-mode",title:"Set main-agent trust mode",category:"Agent runtime",keywords:["trust","trust mode","auto","approval","safety","permission","gate"],kind:"trust-mode",field:{label:"Trust mode",type:"select",help:"Warning: auto lets the main agent run high-and-below risk tool calls WITHOUT asking you first (irreversible_external is always gated). Saving auto confirms this. approval_required is the safe default.",options:[{value:"approval_required",label:"Approval required (safe default)"},{value:"auto",label:"Auto (skip gate for ≤ high risk)"}]},settingsHref:"/settings/advanced",docSlug:"set-trust-mode"}],h=[{id:"start-whatsapp-bridge",slug:"start-whatsapp-bridge",title:"Start the WhatsApp bridge",summary:"Pair a dedicated WhatsApp number and run the gateway daemon so agents can send and receive messages.",category:"Channels",keywords:["whatsapp","bridge","gateway","baileys","pair","daemon","messages"],related:["secrets-vault-overview"]},{id:"set-api-key",slug:"set-api-key",title:"Set an API key",summary:"How API keys and secrets are stored, and the fastest way to add one from anywhere with Cmd+K.",category:"Credentials",keywords:["api key","secret","credential","token","vault","set key"],related:["set-anthropic-key","connect-supabase","secrets-vault-overview"]},{id:"set-anthropic-key",slug:"set-anthropic-key",title:"Set the Anthropic API key",summary:"Add the Anthropic key that powers the cloud engine.",category:"Credentials",keywords:["anthropic","api key","claude","cloud engine","llm"],related:["choose-agent-engine","set-api-key"]},{id:"set-resend-key",slug:"set-resend-key",title:"Set the Resend API key (email)",summary:"Enable the email tool by adding a Resend key.",category:"Credentials",keywords:["resend","email","api key","send mail"],related:["set-api-key"]},{id:"set-github-token",slug:"set-github-token",title:"Set a GitHub token",summary:"Add a personal access token to unlock the GitHub tool adapter.",category:"Credentials",keywords:["github","token","pat","repo","api key"],related:["set-api-key"]},{id:"connect-supabase",slug:"connect-supabase",title:"Connect Supabase",summary:"Wire up Supabase URL and keys for database writes and the shared cloud layer.",category:"Credentials",keywords:["supabase","database","connect","url","service role","shared cloud"],related:["set-api-key","secrets-vault-overview"]},{id:"choose-agent-engine",slug:"choose-agent-engine",title:"Choose an agent engine",summary:"Pick between claude-code, anthropic, ollama, codex, and hermes — and what each needs.",category:"Agent runtime",keywords:["engine","model","claude-code","ollama","codex","hermes","anthropic","local"],related:["set-anthropic-key"]},{id:"set-trust-mode",slug:"set-trust-mode",title:"Set trust mode",summary:"Control whether the main agent gates risky tool calls or runs them automatically.",category:"Agent runtime",keywords:["trust","trust mode","auto","approval","safety","risk","gate"],related:["create-agent"]},{id:"create-agent",slug:"create-agent",title:"Create an agent",summary:"Spin up a worker, set its schedule, scope its tools, and run it.",category:"Getting started",keywords:["agent","create","worker","new agent","caretaker","roster"],related:["schedules-and-cron","set-trust-mode"]},{id:"schedules-and-cron",slug:"schedules-and-cron",title:"Schedules and cron",summary:"How schedules queue durable heartbeat work, backfill missed windows, and run automatically.",category:"Getting started",keywords:["schedule","cron","daily","heartbeat","backfill","recurring"],related:["create-agent"]},{id:"secrets-vault-overview",slug:"secrets-vault-overview",title:"Secrets vault overview",summary:"Where credentials live, how they are encrypted, and why values are never shown back.",category:"Credentials",keywords:["secrets","vault","encryption","aes","master key","security"],related:["set-api-key"]},{id:"keyboard-shortcuts",slug:"keyboard-shortcuts",title:"Keyboard shortcuts",summary:"Every shortcut, including Cmd+K smart search and the composer keys.",category:"Getting started",keywords:["keyboard","shortcut","cmd k","command","hotkey","search"],related:[]}];function i({action:a,current:b,onClose:c,onSaved:g}){(0,f.useRouter)();let h=(0,e.useRef)(null),i=a.field,[j,k]=(0,e.useState)("select"===i.type&&(b?.value||i.options?.[0]?.value)||""),[l,m]=(0,e.useState)(!1),[n,o]=(0,e.useState)(""),[p,q]=(0,e.useState)(!1);async function r(b){if(b.preventDefault(),l)return;let d=String(j).trim();if(!d)return void o("Enter a value.");m(!0),o("");try{let{endpoint:b,method:e,body:f}=function(a,b){switch(a.kind){case"secret":return{endpoint:"/api/secrets",method:"POST",body:{name:a.secretName,value:b,scope:"global",source:"help-modal"}};case"config":return{endpoint:"/api/config",method:"PUT",body:{[a.configKey]:b}};case"trust-mode":return{endpoint:"/api/settings/trust-mode",method:"PATCH",body:"auto"===b?{mode:b,confirm:!0}:{mode:b}};default:throw Error(`unknown action kind: ${a.kind}`)}}(a,d),h=await fetch(b,{method:e,headers:{"content-type":"application/json"},body:JSON.stringify(f)});if(!h.ok){if(403===h.status)o("You need admin or owner access to change this.");else if(401===h.status)o("Sign in to change this setting.");else{let a=await h.text().catch(()=>""),b=a;try{b=JSON.parse(a)?.error||a}catch{}o(b||`Failed (${h.status}).`)}m(!1);return}q(!0),m(!1),g?.(a),window.setTimeout(()=>c(),700)}catch(a){o(a?.message||"Network error."),m(!1)}}let s=function(a,b){if(!b)return null;if("secret"===a.kind)return"set"===b.status?"Currently set":"Not set";if(null!=b.value){let c=a.field.options?.find(a=>a.value===b.value);return`Currently: ${c?c.label:b.value}`}return null}(a,b);return(0,d.jsx)("div",{className:"help-value-overlay",role:"presentation",onMouseDown:a=>{a.target===a.currentTarget&&c()},children:(0,d.jsxs)("form",{className:"help-value-modal",role:"dialog","aria-modal":"true","aria-label":a.title,onSubmit:r,children:[(0,d.jsxs)("header",{className:"help-value-head",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("small",{children:a.category}),(0,d.jsx)("h2",{children:a.title})]}),(0,d.jsx)("button",{type:"button",className:"help-value-close",onClick:c,"aria-label":"Close",children:"esc"})]}),(0,d.jsxs)("div",{className:"help-value-body",children:[(0,d.jsxs)("label",{className:"help-value-field",children:[(0,d.jsxs)("span",{className:"help-value-label",children:[i.label,s?(0,d.jsx)("em",{className:"help-value-status",children:s}):null]}),"select"===i.type?(0,d.jsx)("select",{ref:h,value:j,onChange:a=>k(a.target.value),disabled:l||p,children:i.options.map(a=>(0,d.jsx)("option",{value:a.value,children:a.label},a.value))}):(0,d.jsx)("input",{ref:h,type:"password"===i.type?"password":"text",value:j,placeholder:i.placeholder||"",onChange:a=>k(a.target.value),disabled:l||p,autoComplete:"off",spellCheck:!1})]}),i.help?(0,d.jsx)("p",{className:"help-value-help",children:i.help}):null,n?(0,d.jsx)("p",{className:"help-value-error",role:"alert",children:n}):null,p?(0,d.jsx)("p",{className:"help-value-ok",role:"status",children:"Saved."}):null]}),(0,d.jsxs)("footer",{className:"help-value-foot",children:[(0,d.jsxs)("div",{className:"help-value-links",children:[(0,d.jsx)("a",{href:a.settingsHref,onClick:c,children:"Open full settings"}),a.docSlug?(0,d.jsx)("a",{href:`/help/${a.docSlug}`,onClick:c,children:"Read the guide"}):null]}),(0,d.jsxs)("div",{className:"help-value-actions",children:[(0,d.jsx)("button",{type:"button",className:"help-value-btn ghost",onClick:c,disabled:l,children:"Cancel"}),(0,d.jsx)("button",{type:"submit",className:"help-value-btn primary",disabled:l||p,children:l?"Saving…":"Save"})]})]})]})})}let j=[{title:"Overview",href:"/",section:"Navigate",keys:["dashboard","home","canvas","main"]},{title:"Agents",href:"/agents",section:"Navigate",keys:["agent","worker","roster","team"]},{title:"Tasks",href:"/tasks",section:"Navigate",keys:["task","work","todo","kanban"]},{title:"Approvals",href:"/approvals",section:"Navigate",keys:["approve","permission","review"]},{title:"Tools",href:"/tools",section:"Navigate",keys:["tool","connector","capability"]},{title:"Schedules",href:"/schedules",section:"Navigate",keys:["cron","schedule","calendar"]},{title:"Reports",href:"/reports",section:"Navigate",keys:["report","artifact","brief"]},{title:"Activity",href:"/activity",section:"Navigate",keys:["activity","runs","history"]},{title:"Runtime",href:"/runtime",section:"Navigate",keys:["runtime","diagnostics","heartbeat","process"]},{title:"Brand",href:"/brand",section:"Navigate",keys:["brand","identity","design"]},{title:"Settings",href:"/settings",section:"Navigate",keys:["settings","config","preferences"]},{title:"Help",href:"/help",section:"Navigate",keys:["help","guide","docs","documentation","shortcuts"]}],k=[{id:"focus-main-agent",title:"Focus main agent composer",detail:"Jump to the prompt box without leaving the keyboard.",section:"Action",shortcut:"⌘J",keys:["chat","composer","prompt","ask","agent"],run:({router:a,pathname:b})=>{"/"!==b?(a.push("/"),window.setTimeout(()=>window.dispatchEvent(new Event("madarx:focus-composer")),180)):window.dispatchEvent(new Event("madarx:focus-composer"))}},{id:"new-chat",title:"New main-agent chat",detail:"Fresh conversation without using ⌘N, which belongs to the browser.",section:"Action",shortcut:"⌘⇧J",keys:["new","session","chat","fresh"],run:({router:a,pathname:b})=>{"/"!==b&&a.push("/"),window.setTimeout(()=>window.dispatchEvent(new Event("madarx:new-chat")),180*("/"!==b))}},{id:"settings-modal",title:"Open agent configuration",detail:"Close to the right thumb, but avoids browser-level ⌘, preferences.",section:"Action",shortcut:"⌘;",keys:["settings","preferences","config","model"],run:({router:a,pathname:b})=>{"/"!==b?(a.push("/"),window.setTimeout(()=>window.dispatchEvent(new Event("madarx:open-config")),180)):window.dispatchEvent(new Event("madarx:open-config"))}},{id:"shortcut-help",title:"Show keyboard shortcuts",detail:"Open this palette and filter to shortcut help.",section:"Action",shortcut:"⌘/",keys:["keyboard","shortcut","help","command"],run:({openWithQuery:a})=>a("shortcuts")}],l=[{title:"Open smart search",detail:"⌘Space or ⌘K. Thumb + home-row fallback; Ctrl Space also works when macOS owns Spotlight.",section:"Shortcuts",keys:["shortcut","search","spotlight","command space"]},{title:"Focus main agent",detail:"⌘J. Right thumb + index on home row; avoids browser shortcuts.",section:"Shortcuts",keys:["shortcut","composer","prompt"]},{title:"New chat",detail:"⌘⇧J. Same hand position as focus, with Shift; avoids ⌘N.",section:"Shortcuts",keys:["shortcut","new chat","session"]},{title:"Agents / Tasks / Runtime",detail:"⌘⇧A, ⌘⇧T, ⌘⇧D. Left-hand clusters for common operating surfaces.",section:"Shortcuts",keys:["shortcut","navigation","agents","tasks","runtime"]},{title:"Agent settings",detail:"⌘; sits under the right hand and avoids browser Preferences on ⌘,.",section:"Shortcuts",keys:["shortcut","settings","preferences"]}];function m(a){return String(a||"").toLowerCase().trim()}function n(){let a=(0,f.useRouter)(),b=(0,f.usePathname)(),c=(0,e.useRef)(null),[n,o]=(0,e.useState)(!1),[p,q]=(0,e.useState)(""),[r,s]=(0,e.useState)(0),[t,u]=(0,e.useState)({}),[v,w]=(0,e.useState)(!1),[x,y]=(0,e.useState)(null),z=(0,e.useCallback)(async()=>{try{let a=await fetch("/api/help",{cache:"no-store"});if(!a.ok)return;let b=await a.json(),c={};for(let a of b.actions||[])c[a.id]=a.current;u(c),w(!0)}catch{}},[]),A=(0,e.useMemo)(()=>{let a=j.map(a=>({...a,id:`nav:${a.href}`,kind:"nav",detail:"/"===a.href?"Return to the main command center.":`Open ${a.href}`,run:({router:b})=>b.push(a.href)}));return[...k,...g.map(a=>({id:`set:${a.id}`,kind:"setting",action:a,title:a.title,detail:a.field?.help||"Set this value.",section:"Set",keys:a.keywords})),...h.map(a=>({id:`doc:${a.slug}`,kind:"doc",title:a.title,detail:a.summary,section:"Doc",href:`/help/${a.slug}`,keys:a.keywords})),...a,...l]},[]),B=(0,e.useMemo)(()=>{let a=m(p);if(!a)return A.slice(0,10);let b=a.split(/\s+/).filter(Boolean);return A.map(c=>{let d=[c.title,c.detail,c.section,c.href,...c.keys||[]].filter(Boolean).join(" ").toLowerCase(),e=b.reduce((a,b)=>a+ +!!d.includes(b),0),f=3*!!m(c.title).startsWith(a);return{item:c,score:e+f}}).filter(({score:a})=>a>0).sort((a,b)=>b.score-a.score||a.item.title.localeCompare(b.item.title)).map(({item:a})=>a).slice(0,12)},[A,p]),C=a=>{q(a||""),o(!0),s(0)},D=()=>{o(!1),q(""),s(0)};(0,e.useCallback)(a=>{let b=g.find(b=>b.id===a);b&&y(b)},[]);let E=(0,e.useCallback)(()=>y(null),[]),F=x?(0,d.jsx)(i,{action:x,current:t[x.id],onClose:E,onSaved:z}):null;return n?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("div",{className:"smart-search-overlay",role:"presentation",onMouseDown:a=>{a.target===a.currentTarget&&D()},children:(0,d.jsxs)("section",{className:"smart-search-panel",role:"dialog","aria-modal":"true","aria-label":"Smart search",children:[(0,d.jsxs)("div",{className:"smart-search-head",children:[(0,d.jsx)("span",{className:"smart-search-orb","aria-hidden":"true"}),(0,d.jsx)("input",{ref:c,value:p,onChange:a=>q(a.target.value),placeholder:"Search docs, settings, pages…","aria-label":"Search madarX OS"}),(0,d.jsx)("kbd",{children:"esc"})]}),(0,d.jsx)("div",{className:"smart-search-results",role:"listbox","aria-label":"Smart search results",children:B.length?B.map((c,e)=>{let f="setting"===c.kind?t[c.action.id]:null,g=f&&"secret"===c.action.kind&&"set"===f.status?"Set":null;return(0,d.jsxs)("button",{type:"button",className:"smart-search-row"+(e===r?" is-active":""),onMouseEnter:()=>s(e),onClick:()=>(c=>{if(c){if("setting"===c.kind){y(c.action),D();return}if("doc"===c.kind){a.push(c.href),D();return}c.run&&(c.run({router:a,pathname:b,openWithQuery:C}),"Shortcuts"!==c.section&&D())}})(c),role:"option","aria-selected":e===r,children:[(0,d.jsxs)("span",{className:"smart-search-row-main",children:[(0,d.jsxs)("small",{children:[(0,d.jsx)("span",{className:`smart-search-kind kind-${c.kind||"nav"}`,children:c.section}),g?(0,d.jsx)("span",{className:"smart-search-pill",children:g}):null]}),(0,d.jsx)("b",{children:c.title}),(0,d.jsx)("em",{children:c.detail})]}),c.shortcut?(0,d.jsx)("kbd",{children:c.shortcut}):c.href?(0,d.jsx)("kbd",{children:c.href}):null]},c.id||c.title)}):(0,d.jsx)("div",{className:"smart-search-empty",children:"No matches. Try “api key”, “whatsapp”, “agent”, or “shortcut”."})}),(0,d.jsxs)("footer",{className:"smart-search-foot",children:[(0,d.jsxs)("span",{children:[(0,d.jsx)("kbd",{children:"↑"}),(0,d.jsx)("kbd",{children:"↓"})," select"]}),(0,d.jsxs)("span",{children:[(0,d.jsx)("kbd",{children:"return"})," open"]}),(0,d.jsxs)("span",{children:[(0,d.jsx)("kbd",{children:"⌘J"})," composer"]})]})]})}),F]}):F}var o=c(23062),p=c(17989);c(9866);let q=[["/agents","Agents"],["/tasks","Tasks"],["/approvals","Approvals"],["/marketplace","Marketplace"],["/tools","Tools"],["/schedules","Schedules"],["/reports","Reports"],["/activity","Activity"],["/runtime","Runtime"],["/workflows","Workflows"],["/brand","Brand"],["/team","Team"],["/whatsapp","WhatsApp"],["/settings","Settings"],["/help","Help"]];function r(){let a=(0,f.usePathname)(),b=(0,e.useMemo)(()=>(function(a){if(!a||"/"===a)return"Overview";let b=q.find(([b])=>a===b||a.startsWith(`${b}/`));return b?b[1]:"madarX"})(a),[a]),[c,g]=(0,e.useState)(()=>new Set),h=c.size;return(0,d.jsxs)("header",{className:"app-topbar",role:"banner",children:[(0,d.jsxs)("div",{className:"app-topbar-left",children:[(0,d.jsxs)("span",{className:"app-topbar-brand",children:["madar",(0,d.jsx)("b",{children:"X"})]}),(0,d.jsx)("span",{className:"app-topbar-sep","aria-hidden":!0}),(0,d.jsx)("span",{className:"app-topbar-section",children:b})]}),(0,d.jsxs)("div",{className:"app-topbar-right",children:[(0,d.jsx)("div",{id:"app-topbar-slot",className:"app-topbar-slot"}),(0,d.jsxs)("span",{className:`app-topbar-activity ${h?"is-running":""}`,title:h?`${h} agent${1===h?"":"s"} running`:"No agents running",children:[(0,d.jsx)("span",{className:"app-topbar-dot","aria-hidden":!0}),h?`${h} running`:"Idle"]}),(0,d.jsxs)("button",{type:"button",className:"app-topbar-search",onClick:function(){},"aria-label":"Open search (Command K)",children:[(0,d.jsx)(o.A,{size:13,"aria-hidden":!0}),(0,d.jsx)("span",{children:"Search"}),(0,d.jsxs)("kbd",{children:[(0,d.jsx)(p.A,{size:10,"aria-hidden":!0}),"K"]})]})]})]})}let s=["/login","/share"];function t({children:a,sidebar:b}){let c=(0,f.usePathname)();return(0,e.useMemo)(()=>s.some(a=>c===a||c?.startsWith(`${a}/`)),[c])?(0,d.jsx)("div",{className:"chromeless-page",children:a}):(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("div",{className:"app-shell",children:[(0,d.jsx)(r,{}),(0,d.jsx)("div",{className:"app-rail",children:b??null}),(0,d.jsx)("div",{className:"app-content",children:a})]}),(0,d.jsx)(n,{})]})}},50872:(a,b,c)=>{"use strict";c.d(b,{D:()=>e});var d=c(75338);function e({label:a}={}){return(0,d.jsx)("main",{className:"admin-shell","aria-busy":"true","aria-live":"polite",children:(0,d.jsxs)("div",{className:"nav-skeleton",role:"status",children:[(0,d.jsx)("span",{className:"sr-only",children:a?`Loading ${a}…`:"Loading…"}),(0,d.jsx)("div",{className:"nav-skeleton__header"}),(0,d.jsxs)("div",{className:"nav-skeleton__strip",children:[(0,d.jsx)("div",{className:"nav-skeleton__pill"}),(0,d.jsx)("div",{className:"nav-skeleton__pill"}),(0,d.jsx)("div",{className:"nav-skeleton__pill"}),(0,d.jsx)("div",{className:"nav-skeleton__pill"})]}),(0,d.jsxs)("div",{className:"nav-skeleton__rows",children:[(0,d.jsx)("div",{className:"nav-skeleton__row"}),(0,d.jsx)("div",{className:"nav-skeleton__row"}),(0,d.jsx)("div",{className:"nav-skeleton__row"}),(0,d.jsx)("div",{className:"nav-skeleton__row"})]})]})})}},62592:(a,b,c)=>{"use strict";c.d(b,{default:()=>J});var d=c(21124),e=c(38301),f=c(3991),g=c.n(f),h=c(42378),i=c(30242),j=c(11941),k=c(63881),l=c(23007),m=c(99802),n=c(93673),o=c(74905),p=c(39153),q=c(26890),r=c(77703),s=c(59153),t=c(30079),u=c(75571),v=c(13044),w=c(45423),x=c(79401),y=c(36248),z=c(81868),A=c(80207);let B="madarx:sidebarAvatar";function C(){let[a,b]=(0,e.useState)(null),c=(0,e.useRef)(null);return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("button",{type:"button",onClick:()=>c.current?.click(),"aria-label":a?"Change avatar":"Upload an avatar",title:a?"Change avatar":"Upload an avatar",className:"group relative w-9 h-9 rounded-full overflow-hidden flex items-center justify-center cursor-pointer border border-[rgba(20,22,26,0.16)] bg-[rgba(17,19,24,0.035)] transition-colors hover:border-[rgba(20,22,26,0.32)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[#111318] focus-visible:ring-offset-2 focus-visible:ring-offset-white/50",children:[a?(0,d.jsx)("img",{src:a,alt:"Avatar",className:"w-full h-full object-cover"}):(0,d.jsx)("svg",{width:"16",height:"16",viewBox:"0 0 24 24",fill:"none",stroke:"#9aa1ab",strokeWidth:"1.7",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:(0,d.jsx)("path",{d:"M12 16V8M8 12h8"})}),(0,d.jsx)("span",{className:"absolute inset-0 hidden group-hover:flex items-center justify-center bg-black/35 text-white",children:(0,d.jsxs)("svg",{width:"14",height:"14",viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:"1.8",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,d.jsx)("path",{d:"M12 16V6M12 6 7.5 10.5M12 6l4.5 4.5"}),(0,d.jsx)("path",{d:"M5 18v1.5A1.5 1.5 0 0 0 6.5 21h11a1.5 1.5 0 0 0 1.5-1.5V18"})]})}),a?(0,d.jsx)("span",{role:"button",tabIndex:-1,onClick:function(a){a.stopPropagation(),b(null);try{localStorage.removeItem(B)}catch{}},"aria-label":"Remove avatar",className:"absolute -top-0.5 -right-0.5 hidden group-hover:flex w-4 h-4 items-center justify-center rounded-full bg-[#111318] text-white text-[9px] leading-none",children:"\xd7"}):null]}),(0,d.jsx)("input",{ref:c,type:"file",accept:"image/*",hidden:!0,onChange:function(a){let c=a.target.files?.[0];if(a.target.value="",!c||!c.type.startsWith("image/")||c.size>2097152)return;let d=new FileReader;d.onload=()=>{let a=String(d.result||"");if(a){b(a);try{localStorage.setItem(B,a)}catch{}}},d.readAsDataURL(c)}})]})}let D=[{group:"work",name:"Spaces",href:"/",icon:k.A},{group:"work",name:"Projects",href:"/projects",icon:l.A},{group:"work",name:"Agents",href:"/agents",icon:m.A},{group:"work",name:"Tasks",href:"/tasks",icon:n.A},{group:"work",name:"Workflows",href:"/workflows",icon:o.A},{group:"work",name:"Approvals",href:"/approvals",icon:p.A},{group:"library",name:"Marketplace",href:"/marketplace",icon:q.A}],E={Pickaxe:r.A,Boxes:s.A,Gem:t.A,FlaskConical:u.A,Factory:v.A,Building2:w.A,Package:q.A,FolderOpen:l.A,Workflow:o.A},F=[{name:"Settings",icon:x.A,href:"/settings"}];function G(a,b){return!!a&&("/"===b?"/"===a:a===b||a.startsWith(`${b}/`))}function H(a){a.currentTarget?.blur?.()}function I({item:a,active:b}){let c=a.icon;return(0,d.jsxs)(g(),{href:a.href,prefetch:!0,"aria-label":a.name,"aria-current":b?"page":void 0,"data-active":b?"true":void 0,onClick:H,className:`relative flex items-center justify-center p-2 rounded-lg transition-colors duration-150 group ${b?"text-[#C2452A]":"text-[#69707a] hover:text-[#111318] hover:bg-[rgba(17,19,24,0.08)] active:bg-[rgba(17,19,24,0.12)]"}`,children:[(0,d.jsx)(c,{className:"w-5 h-5",strokeWidth:1.75,"aria-hidden":"true"}),(0,d.jsx)("span",{className:"absolute left-12 px-2 py-1 rounded-md whitespace-nowrap text-xs text-white bg-[#111318] hidden group-hover:inline-block group-focus-visible:inline-block z-50 shadow-lg pointer-events-none",children:a.name})]})}function J({moduleNav:a=[]}){let b=(0,h.usePathname)(),{session:c,signOut:f}=function(){let[a,b]=(0,e.useState)(null),c=(0,h.useRouter)();return{session:a,signOut:async function(){await fetch("/api/auth/session",{method:"DELETE"}).catch(()=>null),c.replace("/login"),c.refresh()}}}(),[k,l]=(0,e.useState)(null),m=(Array.isArray(a)?a:[]).map(a=>({group:"module",name:a.label,href:a.href,icon:E[a.icon]||s.A})),n=[...D.filter(a=>"work"===a.group),...m,...D.filter(a=>"library"===a.group)],o=c?.email||"Local owner",p="local"===(c?.auth_mode||"local"),q=(c?.email||c?.display_name||"AK").slice(0,2).toUpperCase();return(0,d.jsxs)("aside",{className:"relative z-30 h-full w-full rounded-[18px] border border-white/75 bg-[var(--glass)] backdrop-blur-[22px] backdrop-saturate-150 flex flex-col","aria-label":"Primary navigation",children:[(0,d.jsx)("div",{className:"h-20 flex items-center justify-center px-3 shrink-0",children:(0,d.jsx)(C,{})}),(0,d.jsxs)("div",{className:"flex-1 flex flex-col min-h-0",children:[(0,d.jsx)("ul",{className:"list-none m-0 p-0 px-3 text-sm font-medium flex-1 space-y-1",children:n.map((a,c)=>{let e=n[c-1],f=e&&e.group!==a.group,g=G(b,a.href);return(0,d.jsxs)("li",{children:[f?(0,d.jsx)("div",{"aria-hidden":"true",className:"mx-2 my-2 h-px bg-[rgba(20,22,26,0.09)]"}):null,(0,d.jsx)(I,{item:a,active:g})]},a.name)})}),(0,d.jsx)("ul",{className:"list-none m-0 p-0 px-3 pb-3 pt-2 text-sm font-medium space-y-1",children:F.map(a=>{let c=G(b,a.href);return(0,d.jsx)("li",{children:(0,d.jsx)(I,{item:a,active:c})},a.name)})}),(0,d.jsx)("div",{className:"relative py-4 px-3 border-t border-[rgba(20,22,26,0.09)] flex justify-center",children:(0,d.jsxs)(i.bL,{children:[(0,d.jsx)(i.l9,{className:"outline-none rounded-full border-0 bg-transparent p-0 appearance-none cursor-pointer focus-visible:ring-2 focus-visible:ring-[#111318] focus-visible:ring-offset-2 focus-visible:ring-offset-white/50","aria-label":"Account menu",children:(0,d.jsxs)(j.bL,{className:"w-10 h-10 rounded-full overflow-hidden cursor-pointer block",children:[(0,d.jsx)(j._V,{className:"w-full h-full object-cover",src:"/madarx-mark.svg",alt:"AK"}),(0,d.jsx)(j.H4,{className:"flex w-full h-full items-center justify-center text-white text-xs font-bold tracking-wider bg-gradient-to-br from-[#111318] to-[#565d6b]",delayMs:150,children:q})]})}),(0,d.jsx)(i.ZL,{children:(0,d.jsxs)(i.UC,{side:"right",align:"end",sideOffset:12,className:"w-64 rounded-xl bg-white shadow-[0_22px_60px_rgba(17,19,24,0.20)] border border-[rgba(20,22,26,0.09)] text-sm text-[#59606b] p-2 z-[100]",children:[(0,d.jsx)("div",{className:"px-2 py-1.5 text-[11px] uppercase tracking-[0.14em] text-[var(--accent-600)] font-bold",children:p?"Local operator":"Signed in"}),(0,d.jsx)("span",{className:"block text-[#68707b] px-2 pb-2 truncate",children:o}),(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsx)(g(),{href:"/",className:"block w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:"Spaces"})}),(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsx)(g(),{href:"/settings",className:"block w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:"Settings"})}),(0,d.jsx)(i.wv,{className:"my-1 h-px bg-[rgba(20,22,26,0.09)]"}),k?.behind&&k?.latest?(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsxs)(g(),{href:"/",className:"flex items-center justify-between gap-x-2 w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:[(0,d.jsxs)("span",{className:"flex items-center gap-x-2",children:[(0,d.jsx)(y.A,{className:"w-4 h-4 text-[var(--accent-600)]",strokeWidth:1.75}),"Update available"]}),(0,d.jsxs)("span",{className:"text-[11px] font-semibold text-[var(--accent-600)]",children:["v",k.latest]})]})}):(0,d.jsxs)("div",{className:"flex items-center justify-between px-2 py-2 text-[12px] text-[#9aa1ab]",children:[(0,d.jsx)("span",{children:"Version"}),(0,d.jsx)("span",{className:"font-medium text-[#68707b]",children:k?.current?`v${k.current}`:"—"})]}),(0,d.jsx)(i.wv,{className:"my-1 h-px bg-[rgba(20,22,26,0.09)]"}),p?(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsxs)(g(),{href:"/settings/account",className:"flex items-center gap-x-2 w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:[(0,d.jsx)(z.A,{className:"w-4 h-4",strokeWidth:1.75}),"Sign in with an account"]})}):(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsxs)("button",{type:"button",onClick:f,className:"flex items-center gap-x-2 w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer text-[#313740]",children:[(0,d.jsx)(A.A,{className:"w-4 h-4",strokeWidth:1.75}),"Sign out"]})})]})})]})})]})]})}},65593:(a,b,c)=>{Promise.resolve().then(c.bind(c,74138)),Promise.resolve().then(c.bind(c,30724))},67237:(a,b,c)=>{Promise.resolve().then(c.t.bind(c,81170,23)),Promise.resolve().then(c.t.bind(c,23597,23)),Promise.resolve().then(c.t.bind(c,36893,23)),Promise.resolve().then(c.t.bind(c,89748,23)),Promise.resolve().then(c.t.bind(c,6060,23)),Promise.resolve().then(c.t.bind(c,7184,23)),Promise.resolve().then(c.t.bind(c,69576,23)),Promise.resolve().then(c.t.bind(c,73041,23)),Promise.resolve().then(c.t.bind(c,51384,23))},70715:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{default:()=>k,metadata:()=>l});var e=c(75338),f=c(46609),g=c(30724),h=c(74138),i=c(23230);c(82704);var j=a([i]);i=(j.then?(await j)():j)[0];let l={title:"madarX OS",description:"Local-first agent command center for Client Workspace"};function k({children:a}){let b=[];try{b=(0,i.O2)()}catch{b=[]}return(0,e.jsx)("html",{lang:"en",className:f.variable,children:(0,e.jsx)("body",{children:(0,e.jsx)(h.default,{sidebar:(0,e.jsx)(g.default,{moduleNav:b}),children:a})})})}d()}catch(a){d(a)}})},74138:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/app-chrome.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/app-chrome.jsx","default")},80389:(a,b,c)=>{Promise.resolve().then(c.t.bind(c,54160,23)),Promise.resolve().then(c.t.bind(c,31603,23)),Promise.resolve().then(c.t.bind(c,68495,23)),Promise.resolve().then(c.t.bind(c,75170,23)),Promise.resolve().then(c.t.bind(c,77526,23)),Promise.resolve().then(c.t.bind(c,78922,23)),Promise.resolve().then(c.t.bind(c,29234,23)),Promise.resolve().then(c.t.bind(c,12263,23)),Promise.resolve().then(c.bind(c,82146))},82704:()=>{},90391:(a,b,c)=>{"use strict";c.r(b),c.d(b,{default:()=>f});var d=c(75338),e=c(50872);function f(){return(0,d.jsx)(e.D,{})}}};
+exports.id=6059,exports.ids=[6059],exports.modules={2041:(a,b,c)=>{Promise.resolve().then(c.bind(c,43589)),Promise.resolve().then(c.bind(c,62592))},2987:(a,b,c)=>{"use strict";c.r(b),c.d(b,{default:()=>e});var d=c(97523);let e=async a=>[{type:"image/png",sizes:"64x64",url:(0,d.fillMetadataSegment)(".",await a.params,"icon.png")+"?4138ae2e9ba66d8a"}]},9866:(a,b,c)=>{"use strict";c.d(b,{N:()=>f});let d=null,e=new Set;function f(a){return e.add(a),()=>{if(e.delete(a),0===e.size&&d){try{d.close()}catch{}d=null}}}},23315:(a,b,c)=>{"use strict";c.d(b,{U_:()=>h,bX:()=>i,wb:()=>g});let d={Bash:"run command",WebSearch:"web search",WebFetch:"fetch",Read:"read",Write:"write",Edit:"edit",MultiEdit:"edit",NotebookEdit:"edit notebook",Glob:"find files",Grep:"search files",LS:"list",TodoWrite:"plan",Task:"subagent",Skill:"skill",SlashCommand:"command",ExitPlanMode:"exit plan",AskUserQuestion:"ask"};function e(a){if(!a)return"";let b=String(a);return b.split("/").filter(Boolean).pop()||b}function f(a){try{return new URL(String(a)).hostname}catch{return String(a).slice(0,52)}}function g(a){if(!a||a<0)return null;if(a<1e3)return`${Math.round(a)}ms`;if(a<6e4)return`${(a/1e3).toFixed(1)}s`;let b=Math.round(a/1e3);return`${Math.floor(b/60)}m ${b%60}s`}function h(a){if(!a)return"";if(d[a])return d[a];if("string"==typeof a&&a.startsWith("mcp__")){let b=a.split("__");return b[b.length-1].replace(/_/g," ")}return a.replace(/_/g," ")}function i(a,b){return b?"web_search"===a&&b.query?`"${String(b.query).slice(0,52)}"`:"web_fetch"===a&&b.url?f(b.url):"browser_harness_run"===a&&b.script?"browser script":"create_artifact"===a&&b.title?`"${String(b.title).slice(0,40)}"`:"create_agent"===a&&b.name?`"${String(b.name).slice(0,40)}"`:("file_read"===a||"file_write"===a)&&b.path?e(b.path).slice(0,40):"Bash"===a&&b.command?String(b.command).slice(0,80):"WebSearch"===a&&b.query?`"${String(b.query).slice(0,52)}"`:"WebFetch"===a&&b.url?f(b.url):("Read"===a||"Write"===a||"Edit"===a||"MultiEdit"===a||"NotebookEdit"===a)&&b.file_path?e(b.file_path).slice(0,40):("Glob"===a||"Grep"===a)&&(b.pattern||b.path)?String(b.pattern||b.path).slice(0,52):"LS"===a&&b.path?e(b.path).slice(0,40)||"/":"TodoWrite"===a&&Array.isArray(b.todos)?`${b.todos.length} item${1===b.todos.length?"":"s"}`:"Task"===a&&b.description?`"${String(b.description).slice(0,52)}"`:"Skill"===a&&b.skill?`/${b.skill}`:"SlashCommand"===a&&b.command?String(b.command).slice(0,52):null:null}},30724:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/ui/sidebar-with-submenu.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/ui/sidebar-with-submenu.jsx","default")},43589:(a,b,c)=>{"use strict";c.d(b,{default:()=>x});var d=c(21124),e=c(38301),f=c(42378);let g=[{id:"set-anthropic-key",title:"Set Anthropic API key",category:"Credentials",keywords:["anthropic","api key","claude","apikey","llm","token","cloud engine"],kind:"secret",secretName:"ANTHROPIC_API_KEY",field:{label:"ANTHROPIC_API_KEY",type:"password",placeholder:"sk-ant-…",help:"Used by the Anthropic cloud engine. Stored encrypted in the secrets vault."},settingsHref:"/settings/tools",docSlug:"set-anthropic-key"},{id:"set-resend-key",title:"Set Resend API key (email)",category:"Credentials",keywords:["resend","email","api key","smtp","send mail"],kind:"secret",secretName:"RESEND_API_KEY",field:{label:"RESEND_API_KEY",type:"password",placeholder:"re_…",help:"Enables the email tool. Encrypted at rest."},settingsHref:"/settings/connectors",docSlug:"set-resend-key"},{id:"set-github-token",title:"Set GitHub token",category:"Credentials",keywords:["github","token","pat","api key","git","repo"],kind:"secret",secretName:"GITHUB_TOKEN",field:{label:"GITHUB_TOKEN",type:"password",placeholder:"ghp_… / github_pat_…",help:"Personal access token for the GitHub tool adapter."},settingsHref:"/settings/connectors",docSlug:"set-github-token"},{id:"set-supabase-url",title:"Set Supabase URL",category:"Credentials",keywords:["supabase","url","database","project url","connect"],kind:"secret",secretName:"SUPABASE_URL",field:{label:"SUPABASE_URL",type:"text",placeholder:"https://xxxx.supabase.co",help:"Project URL for Supabase writes + shared cloud layer."},settingsHref:"/settings/connectors",docSlug:"connect-supabase"},{id:"set-supabase-service-key",title:"Set Supabase service-role key",category:"Credentials",keywords:["supabase","service role","key","api key","secret","database"],kind:"secret",secretName:"SUPABASE_SERVICE_ROLE_KEY",field:{label:"SUPABASE_SERVICE_ROLE_KEY",type:"password",placeholder:"eyJ…",help:"Server-side service-role key. Never exposed to the browser."},settingsHref:"/settings/connectors",docSlug:"connect-supabase"},{id:"set-default-model",title:"Set default model",category:"Agent runtime",keywords:["model","default model","llm","opus","sonnet","haiku","picker"],kind:"config",configKey:"model",field:{label:"Default model",type:"select",help:"Model the main agent uses by default.",options:[{value:"claude-opus-4-7",label:"Opus 4.7"},{value:"claude-sonnet-4-6",label:"Sonnet 4.6"},{value:"claude-haiku-4-5-20251001",label:"Haiku 4.5"}]},settingsHref:"/settings/engines",docSlug:"choose-agent-engine"},{id:"set-design-style",title:"Set artifact design style",category:"Agent runtime",keywords:["design","style","aesthetic","minimal","bold","soft","balanced","artifact"],kind:"config",configKey:"designStyle",field:{label:"Design style",type:"select",help:"Visual style agents use when producing artifacts.",options:[{value:"balanced",label:"Balanced"},{value:"minimal",label:"Minimal"},{value:"bold",label:"Bold"},{value:"soft",label:"Soft"}]},settingsHref:"/settings/brand",docSlug:null},{id:"set-trust-mode",title:"Set main-agent trust mode",category:"Agent runtime",keywords:["trust","trust mode","auto","approval","safety","permission","gate"],kind:"trust-mode",field:{label:"Trust mode",type:"select",help:"Warning: auto lets the main agent run high-and-below risk tool calls WITHOUT asking you first (irreversible_external is always gated). Saving auto confirms this. approval_required is the safe default.",options:[{value:"approval_required",label:"Approval required (safe default)"},{value:"auto",label:"Auto (skip gate for ≤ high risk)"}]},settingsHref:"/settings/advanced",docSlug:"set-trust-mode"}],h=[{id:"start-whatsapp-bridge",slug:"start-whatsapp-bridge",title:"Start the WhatsApp bridge",summary:"Pair a dedicated WhatsApp number and run the gateway daemon so agents can send and receive messages.",category:"Channels",keywords:["whatsapp","bridge","gateway","baileys","pair","daemon","messages"],related:["secrets-vault-overview"]},{id:"set-api-key",slug:"set-api-key",title:"Set an API key",summary:"How API keys and secrets are stored, and the fastest way to add one from anywhere with Cmd+K.",category:"Credentials",keywords:["api key","secret","credential","token","vault","set key"],related:["set-anthropic-key","connect-supabase","secrets-vault-overview"]},{id:"set-anthropic-key",slug:"set-anthropic-key",title:"Set the Anthropic API key",summary:"Add the Anthropic key that powers the cloud engine.",category:"Credentials",keywords:["anthropic","api key","claude","cloud engine","llm"],related:["choose-agent-engine","set-api-key"]},{id:"set-resend-key",slug:"set-resend-key",title:"Set the Resend API key (email)",summary:"Enable the email tool by adding a Resend key.",category:"Credentials",keywords:["resend","email","api key","send mail"],related:["set-api-key"]},{id:"set-github-token",slug:"set-github-token",title:"Set a GitHub token",summary:"Add a personal access token to unlock the GitHub tool adapter.",category:"Credentials",keywords:["github","token","pat","repo","api key"],related:["set-api-key"]},{id:"connect-supabase",slug:"connect-supabase",title:"Connect Supabase",summary:"Wire up Supabase URL and keys for database writes and the shared cloud layer.",category:"Credentials",keywords:["supabase","database","connect","url","service role","shared cloud"],related:["set-api-key","secrets-vault-overview"]},{id:"choose-agent-engine",slug:"choose-agent-engine",title:"Choose an agent engine",summary:"Pick between claude-code, anthropic, ollama, codex, and hermes — and what each needs.",category:"Agent runtime",keywords:["engine","model","claude-code","ollama","codex","hermes","anthropic","local"],related:["set-anthropic-key"]},{id:"set-trust-mode",slug:"set-trust-mode",title:"Set trust mode",summary:"Control whether the main agent gates risky tool calls or runs them automatically.",category:"Agent runtime",keywords:["trust","trust mode","auto","approval","safety","risk","gate"],related:["create-agent"]},{id:"create-agent",slug:"create-agent",title:"Create an agent",summary:"Spin up a worker, set its schedule, scope its tools, and run it.",category:"Getting started",keywords:["agent","create","worker","new agent","caretaker","roster"],related:["schedules-and-cron","set-trust-mode"]},{id:"schedules-and-cron",slug:"schedules-and-cron",title:"Schedules and cron",summary:"How schedules queue durable heartbeat work, backfill missed windows, and run automatically.",category:"Getting started",keywords:["schedule","cron","daily","heartbeat","backfill","recurring"],related:["create-agent"]},{id:"secrets-vault-overview",slug:"secrets-vault-overview",title:"Secrets vault overview",summary:"Where credentials live, how they are encrypted, and why values are never shown back.",category:"Credentials",keywords:["secrets","vault","encryption","aes","master key","security"],related:["set-api-key"]},{id:"keyboard-shortcuts",slug:"keyboard-shortcuts",title:"Keyboard shortcuts",summary:"Every shortcut, including Cmd+K smart search and the composer keys.",category:"Getting started",keywords:["keyboard","shortcut","cmd k","command","hotkey","search"],related:[]}];function i({action:a,current:b,onClose:c,onSaved:g}){(0,f.useRouter)();let h=(0,e.useRef)(null),i=a.field,[j,k]=(0,e.useState)("select"===i.type&&(b?.value||i.options?.[0]?.value)||""),[l,m]=(0,e.useState)(!1),[n,o]=(0,e.useState)(""),[p,q]=(0,e.useState)(!1);async function r(b){if(b.preventDefault(),l)return;let d=String(j).trim();if(!d)return void o("Enter a value.");m(!0),o("");try{let{endpoint:b,method:e,body:f}=function(a,b){switch(a.kind){case"secret":return{endpoint:"/api/secrets",method:"POST",body:{name:a.secretName,value:b,scope:"global",source:"help-modal"}};case"config":return{endpoint:"/api/config",method:"PUT",body:{[a.configKey]:b}};case"trust-mode":return{endpoint:"/api/settings/trust-mode",method:"PATCH",body:"auto"===b?{mode:b,confirm:!0}:{mode:b}};default:throw Error(`unknown action kind: ${a.kind}`)}}(a,d),h=await fetch(b,{method:e,headers:{"content-type":"application/json"},body:JSON.stringify(f)});if(!h.ok){if(403===h.status)o("You need admin or owner access to change this.");else if(401===h.status)o("Sign in to change this setting.");else{let a=await h.text().catch(()=>""),b=a;try{b=JSON.parse(a)?.error||a}catch{}o(b||`Failed (${h.status}).`)}m(!1);return}q(!0),m(!1),g?.(a),window.setTimeout(()=>c(),700)}catch(a){o(a?.message||"Network error."),m(!1)}}let s=function(a,b){if(!b)return null;if("secret"===a.kind)return"set"===b.status?"Currently set":"Not set";if(null!=b.value){let c=a.field.options?.find(a=>a.value===b.value);return`Currently: ${c?c.label:b.value}`}return null}(a,b);return(0,d.jsx)("div",{className:"help-value-overlay",role:"presentation",onMouseDown:a=>{a.target===a.currentTarget&&c()},children:(0,d.jsxs)("form",{className:"help-value-modal",role:"dialog","aria-modal":"true","aria-label":a.title,onSubmit:r,children:[(0,d.jsxs)("header",{className:"help-value-head",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("small",{children:a.category}),(0,d.jsx)("h2",{children:a.title})]}),(0,d.jsx)("button",{type:"button",className:"help-value-close",onClick:c,"aria-label":"Close",children:"esc"})]}),(0,d.jsxs)("div",{className:"help-value-body",children:[(0,d.jsxs)("label",{className:"help-value-field",children:[(0,d.jsxs)("span",{className:"help-value-label",children:[i.label,s?(0,d.jsx)("em",{className:"help-value-status",children:s}):null]}),"select"===i.type?(0,d.jsx)("select",{ref:h,value:j,onChange:a=>k(a.target.value),disabled:l||p,children:i.options.map(a=>(0,d.jsx)("option",{value:a.value,children:a.label},a.value))}):(0,d.jsx)("input",{ref:h,type:"password"===i.type?"password":"text",value:j,placeholder:i.placeholder||"",onChange:a=>k(a.target.value),disabled:l||p,autoComplete:"off",spellCheck:!1})]}),i.help?(0,d.jsx)("p",{className:"help-value-help",children:i.help}):null,n?(0,d.jsx)("p",{className:"help-value-error",role:"alert",children:n}):null,p?(0,d.jsx)("p",{className:"help-value-ok",role:"status",children:"Saved."}):null]}),(0,d.jsxs)("footer",{className:"help-value-foot",children:[(0,d.jsxs)("div",{className:"help-value-links",children:[(0,d.jsx)("a",{href:a.settingsHref,onClick:c,children:"Open full settings"}),a.docSlug?(0,d.jsx)("a",{href:`/help/${a.docSlug}`,onClick:c,children:"Read the guide"}):null]}),(0,d.jsxs)("div",{className:"help-value-actions",children:[(0,d.jsx)("button",{type:"button",className:"help-value-btn ghost",onClick:c,disabled:l,children:"Cancel"}),(0,d.jsx)("button",{type:"submit",className:"help-value-btn primary",disabled:l||p,children:l?"Saving…":"Save"})]})]})]})})}let j=[{title:"Overview",href:"/",section:"Navigate",keys:["dashboard","home","canvas","main"]},{title:"Agents",href:"/agents",section:"Navigate",keys:["agent","worker","roster","team"]},{title:"Tasks",href:"/tasks",section:"Navigate",keys:["task","work","todo","kanban"]},{title:"Approvals",href:"/approvals",section:"Navigate",keys:["approve","permission","review"]},{title:"Tools",href:"/tools",section:"Navigate",keys:["tool","connector","capability"]},{title:"Schedules",href:"/schedules",section:"Navigate",keys:["cron","schedule","calendar"]},{title:"Reports",href:"/reports",section:"Navigate",keys:["report","artifact","brief"]},{title:"Activity",href:"/activity",section:"Navigate",keys:["activity","runs","history"]},{title:"Runtime",href:"/runtime",section:"Navigate",keys:["runtime","diagnostics","heartbeat","process"]},{title:"Brand",href:"/brand",section:"Navigate",keys:["brand","identity","design"]},{title:"Settings",href:"/settings",section:"Navigate",keys:["settings","config","preferences"]},{title:"Help",href:"/help",section:"Navigate",keys:["help","guide","docs","documentation","shortcuts"]}],k=[{id:"focus-main-agent",title:"Focus main agent composer",detail:"Jump to the prompt box without leaving the keyboard.",section:"Action",shortcut:"⌘J",keys:["chat","composer","prompt","ask","agent"],run:({router:a,pathname:b})=>{"/"!==b?(a.push("/"),window.setTimeout(()=>window.dispatchEvent(new Event("madarx:focus-composer")),180)):window.dispatchEvent(new Event("madarx:focus-composer"))}},{id:"new-chat",title:"New main-agent chat",detail:"Fresh conversation without using ⌘N, which belongs to the browser.",section:"Action",shortcut:"⌘⇧J",keys:["new","session","chat","fresh"],run:({router:a,pathname:b})=>{"/"!==b&&a.push("/"),window.setTimeout(()=>window.dispatchEvent(new Event("madarx:new-chat")),180*("/"!==b))}},{id:"settings-modal",title:"Open agent configuration",detail:"Close to the right thumb, but avoids browser-level ⌘, preferences.",section:"Action",shortcut:"⌘;",keys:["settings","preferences","config","model"],run:({router:a,pathname:b})=>{"/"!==b?(a.push("/"),window.setTimeout(()=>window.dispatchEvent(new Event("madarx:open-config")),180)):window.dispatchEvent(new Event("madarx:open-config"))}},{id:"shortcut-help",title:"Show keyboard shortcuts",detail:"Open this palette and filter to shortcut help.",section:"Action",shortcut:"⌘/",keys:["keyboard","shortcut","help","command"],run:({openWithQuery:a})=>a("shortcuts")}],l=[{title:"Open smart search",detail:"⌘Space or ⌘K. Thumb + home-row fallback; Ctrl Space also works when macOS owns Spotlight.",section:"Shortcuts",keys:["shortcut","search","spotlight","command space"]},{title:"Focus main agent",detail:"⌘J. Right thumb + index on home row; avoids browser shortcuts.",section:"Shortcuts",keys:["shortcut","composer","prompt"]},{title:"New chat",detail:"⌘⇧J. Same hand position as focus, with Shift; avoids ⌘N.",section:"Shortcuts",keys:["shortcut","new chat","session"]},{title:"Agents / Tasks / Runtime",detail:"⌘⇧A, ⌘⇧T, ⌘⇧D. Left-hand clusters for common operating surfaces.",section:"Shortcuts",keys:["shortcut","navigation","agents","tasks","runtime"]},{title:"Agent settings",detail:"⌘; sits under the right hand and avoids browser Preferences on ⌘,.",section:"Shortcuts",keys:["shortcut","settings","preferences"]}];function m(a){return String(a||"").toLowerCase().trim()}function n(){let a=(0,f.useRouter)(),b=(0,f.usePathname)(),c=(0,e.useRef)(null),[n,o]=(0,e.useState)(!1),[p,q]=(0,e.useState)(""),[r,s]=(0,e.useState)(0),[t,u]=(0,e.useState)({}),[v,w]=(0,e.useState)(!1),[x,y]=(0,e.useState)(null),z=(0,e.useCallback)(async()=>{try{let a=await fetch("/api/help",{cache:"no-store"});if(!a.ok)return;let b=await a.json(),c={};for(let a of b.actions||[])c[a.id]=a.current;u(c),w(!0)}catch{}},[]),A=(0,e.useMemo)(()=>{let a=j.map(a=>({...a,id:`nav:${a.href}`,kind:"nav",detail:"/"===a.href?"Return to the main command center.":`Open ${a.href}`,run:({router:b})=>b.push(a.href)}));return[...k,...g.map(a=>({id:`set:${a.id}`,kind:"setting",action:a,title:a.title,detail:a.field?.help||"Set this value.",section:"Set",keys:a.keywords})),...h.map(a=>({id:`doc:${a.slug}`,kind:"doc",title:a.title,detail:a.summary,section:"Doc",href:`/help/${a.slug}`,keys:a.keywords})),...a,...l]},[]),B=(0,e.useMemo)(()=>{let a=m(p);if(!a)return A.slice(0,10);let b=a.split(/\s+/).filter(Boolean);return A.map(c=>{let d=[c.title,c.detail,c.section,c.href,...c.keys||[]].filter(Boolean).join(" ").toLowerCase(),e=b.reduce((a,b)=>a+ +!!d.includes(b),0),f=3*!!m(c.title).startsWith(a);return{item:c,score:e+f}}).filter(({score:a})=>a>0).sort((a,b)=>b.score-a.score||a.item.title.localeCompare(b.item.title)).map(({item:a})=>a).slice(0,12)},[A,p]),C=a=>{q(a||""),o(!0),s(0)},D=()=>{o(!1),q(""),s(0)};(0,e.useCallback)(a=>{let b=g.find(b=>b.id===a);b&&y(b)},[]);let E=(0,e.useCallback)(()=>y(null),[]),F=x?(0,d.jsx)(i,{action:x,current:t[x.id],onClose:E,onSaved:z}):null;return n?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("div",{className:"smart-search-overlay",role:"presentation",onMouseDown:a=>{a.target===a.currentTarget&&D()},children:(0,d.jsxs)("section",{className:"smart-search-panel",role:"dialog","aria-modal":"true","aria-label":"Smart search",children:[(0,d.jsxs)("div",{className:"smart-search-head",children:[(0,d.jsx)("span",{className:"smart-search-orb","aria-hidden":"true"}),(0,d.jsx)("input",{ref:c,value:p,onChange:a=>q(a.target.value),placeholder:"Search docs, settings, pages…","aria-label":"Search madarX OS"}),(0,d.jsx)("kbd",{children:"esc"})]}),(0,d.jsx)("div",{className:"smart-search-results",role:"listbox","aria-label":"Smart search results",children:B.length?B.map((c,e)=>{let f="setting"===c.kind?t[c.action.id]:null,g=f&&"secret"===c.action.kind&&"set"===f.status?"Set":null;return(0,d.jsxs)("button",{type:"button",className:"smart-search-row"+(e===r?" is-active":""),onMouseEnter:()=>s(e),onClick:()=>(c=>{if(c){if("setting"===c.kind){y(c.action),D();return}if("doc"===c.kind){a.push(c.href),D();return}c.run&&(c.run({router:a,pathname:b,openWithQuery:C}),"Shortcuts"!==c.section&&D())}})(c),role:"option","aria-selected":e===r,children:[(0,d.jsxs)("span",{className:"smart-search-row-main",children:[(0,d.jsxs)("small",{children:[(0,d.jsx)("span",{className:`smart-search-kind kind-${c.kind||"nav"}`,children:c.section}),g?(0,d.jsx)("span",{className:"smart-search-pill",children:g}):null]}),(0,d.jsx)("b",{children:c.title}),(0,d.jsx)("em",{children:c.detail})]}),c.shortcut?(0,d.jsx)("kbd",{children:c.shortcut}):c.href?(0,d.jsx)("kbd",{children:c.href}):null]},c.id||c.title)}):(0,d.jsx)("div",{className:"smart-search-empty",children:"No matches. Try “api key”, “whatsapp”, “agent”, or “shortcut”."})}),(0,d.jsxs)("footer",{className:"smart-search-foot",children:[(0,d.jsxs)("span",{children:[(0,d.jsx)("kbd",{children:"↑"}),(0,d.jsx)("kbd",{children:"↓"})," select"]}),(0,d.jsxs)("span",{children:[(0,d.jsx)("kbd",{children:"return"})," open"]}),(0,d.jsxs)("span",{children:[(0,d.jsx)("kbd",{children:"⌘J"})," composer"]})]})]})}),F]}):F}var o=c(23312),p=c(37129),q=c(23062),r=c(17989);c(9866);var s=c(43929),t=c(23315);let u=[["/agents","Agents"],["/tasks","Tasks"],["/approvals","Approvals"],["/marketplace","Marketplace"],["/tools","Tools"],["/schedules","Schedules"],["/reports","Reports"],["/activity","Activity"],["/runtime","Runtime"],["/workflows","Workflows"],["/brand","Brand"],["/team","Team"],["/whatsapp","WhatsApp"],["/settings","Settings"],["/help","Help"]];function v(){let a=(0,f.usePathname)(),b=(0,e.useMemo)(()=>(function(a){if(!a||"/"===a)return"Overview";let b=u.find(([b])=>a===b||a.startsWith(`${b}/`));return b?b[1]:"madarX"})(a),[a]),[c,g]=(0,e.useState)({}),[h,i]=(0,e.useState)(!1),j=(0,e.useRef)(null),k=(0,e.useRef)(null),[l,m]=(0,e.useState)(null),n=(0,e.useMemo)(()=>Object.values(c).sort((a,b)=>(b.started_at||0)-(a.started_at||0)),[c]),v=n.filter(a=>"running"===a.status),w=v.length,x="Activity";if(1===w){let a=v[0];x=a.current_tool?`${a.agent_name} \xb7 ${(0,t.U_)(a.current_tool)}`:a.agent_name}else w>1&&(x=`${w} agents running`);return(0,d.jsxs)("header",{className:"app-topbar",role:"banner",children:[(0,d.jsxs)("div",{className:"app-topbar-left",children:[(0,d.jsxs)("span",{className:"app-topbar-brand",children:["madar",(0,d.jsx)("b",{children:"X"})]}),(0,d.jsx)("span",{className:"app-topbar-sep","aria-hidden":!0}),(0,d.jsx)("span",{className:"app-topbar-section",children:b})]}),(0,d.jsxs)("div",{className:"app-topbar-right",children:[(0,d.jsx)("div",{id:"app-topbar-slot",className:"app-topbar-slot"}),(0,d.jsxs)("div",{className:"app-topbar-activity-wrap",ref:j,children:[(0,d.jsxs)("button",{type:"button",className:`app-topbar-activity is-clickable ${w?"is-running":""}`,title:w?`${w} agent${1===w?"":"s"} running — click for details`:"Background agent activity",onClick:()=>i(a=>!a),"aria-expanded":h,"aria-haspopup":"dialog",children:[(0,d.jsx)(p.A,{size:12,className:"app-topbar-activity-glyph","aria-hidden":!0}),(0,d.jsx)("span",{className:"app-topbar-dot","aria-hidden":!0}),(0,d.jsx)("span",{className:"app-topbar-activity-label",children:x})]}),h&&"undefined"!=typeof document&&(0,o.createPortal)((0,d.jsxs)("div",{className:"bg-activity-pop",role:"dialog","aria-label":"Background agent activity",ref:k,style:l?{top:l.top,right:l.right}:{visibility:"hidden"},children:[(0,d.jsxs)("div",{className:"bg-activity-head",children:[(0,d.jsx)("b",{children:"Background agents"}),(0,d.jsx)("small",{children:w?`${w} working now`:n.length?"Recently finished":"Live view of agents the Main Agent spawns"})]}),0===n.length&&(0,d.jsxs)("div",{className:"bg-activity-empty",children:[(0,d.jsx)(p.A,{size:18,"aria-hidden":!0}),(0,d.jsx)("span",{children:"No background agents active right now."}),(0,d.jsx)("small",{children:"When the Main Agent calls a sub-agent, it shows here live."})]}),(0,d.jsx)("div",{className:"bg-activity-list",children:n.map(a=>(0,d.jsxs)("div",{className:`bg-activity-agent bg-activity-agent--${a.status}`,children:[(0,d.jsxs)("div",{className:"bg-activity-agent-head",children:[(0,d.jsxs)("span",{className:"bg-activity-agent-icon","aria-hidden":!0,children:["running"===a.status&&(0,d.jsx)(s.Nl,{}),"complete"===a.status&&(0,d.jsx)(s.Sr,{}),"failed"===a.status&&(0,d.jsx)(s.wx,{})]}),(0,d.jsx)("span",{className:"bg-activity-agent-name",children:a.agent_name}),a.triggered_by&&(0,d.jsxs)("span",{className:"bg-activity-agent-by",children:["via ",a.triggered_by]}),(0,d.jsx)("span",{className:"bg-activity-agent-status",children:"running"===a.status?a.current_tool?(0,t.U_)(a.current_tool):"working…":"complete"===a.status?"done":"failed"})]}),a.steps.length>0&&(0,d.jsx)("div",{className:"bg-activity-steps",children:a.steps.slice(-5).map((a,b)=>(0,d.jsxs)("div",{className:`bg-activity-step bg-activity-step--${a.status}`,children:[(0,d.jsxs)("span",{className:"bg-activity-step-icon","aria-hidden":!0,children:["running"===a.status&&(0,d.jsx)(s.Nl,{}),"done"===a.status&&(0,d.jsx)(s.Sr,{}),"error"===a.status&&(0,d.jsx)(s.wx,{})]}),(0,d.jsx)("code",{className:"bg-activity-step-name",children:(0,t.U_)(a.tool)}),(0,t.bX)(a.tool,a.input)&&(0,d.jsx)("span",{className:"bg-activity-step-sub",children:(0,t.bX)(a.tool,a.input)})]},b))})]},a.agent_id))}),(0,d.jsx)("a",{className:"bg-activity-foot",href:"/activity",children:"Open activity log →"})]}),document.body)]}),(0,d.jsxs)("button",{type:"button",className:"app-topbar-search",onClick:function(){},"aria-label":"Open search (Command K)",children:[(0,d.jsx)(q.A,{size:13,"aria-hidden":!0}),(0,d.jsx)("span",{children:"Search"}),(0,d.jsxs)("kbd",{children:[(0,d.jsx)(r.A,{size:10,"aria-hidden":!0}),"K"]})]})]})]})}let w=["/login","/share"];function x({children:a,sidebar:b}){let c=(0,f.usePathname)();return(0,e.useMemo)(()=>w.some(a=>c===a||c?.startsWith(`${a}/`)),[c])?(0,d.jsx)("div",{className:"chromeless-page",children:a}):(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("div",{className:"app-shell",children:[(0,d.jsx)(v,{}),(0,d.jsx)("div",{className:"app-rail",children:b??null}),(0,d.jsx)("div",{className:"app-content",children:a})]}),(0,d.jsx)(n,{})]})}},43929:(a,b,c)=>{"use strict";c.d(b,{Nl:()=>f,Sr:()=>g,YE:()=>i,wx:()=>h});var d=c(21124),e=c(38301);function f(){return(0,d.jsx)("svg",{width:"11",height:"11",viewBox:"0 0 11 11",fill:"none",children:(0,d.jsx)("circle",{cx:"5.5",cy:"5.5",r:"4",stroke:"currentColor",strokeWidth:"1.5",strokeDasharray:"6 4",strokeLinecap:"round",children:(0,d.jsx)("animateTransform",{attributeName:"transform",type:"rotate",from:"0 5.5 5.5",to:"360 5.5 5.5",dur:"0.75s",repeatCount:"indefinite"})})})}function g(){return(0,d.jsx)("svg",{width:"11",height:"11",viewBox:"0 0 11 11",fill:"none",children:(0,d.jsx)("path",{d:"M2 5.5L4.5 8L9 3",stroke:"currentColor",strokeWidth:"1.5",strokeLinecap:"round",strokeLinejoin:"round"})})}function h(){return(0,d.jsx)("svg",{width:"11",height:"11",viewBox:"0 0 11 11",fill:"none",children:(0,d.jsx)("path",{d:"M2.5 2.5L8.5 8.5M8.5 2.5L2.5 8.5",stroke:"currentColor",strokeWidth:"1.5",strokeLinecap:"round"})})}function i({startTime:a}){let[b,c]=(0,e.useState)(0);return b<60?(0,d.jsxs)(d.Fragment,{children:[b,"s"]}):(0,d.jsxs)(d.Fragment,{children:[Math.floor(b/60),"m ",b%60,"s"]})}},50872:(a,b,c)=>{"use strict";c.d(b,{D:()=>e});var d=c(75338);function e({label:a}={}){return(0,d.jsx)("main",{className:"admin-shell","aria-busy":"true","aria-live":"polite",children:(0,d.jsxs)("div",{className:"nav-skeleton",role:"status",children:[(0,d.jsx)("span",{className:"sr-only",children:a?`Loading ${a}…`:"Loading…"}),(0,d.jsx)("div",{className:"nav-skeleton__header"}),(0,d.jsxs)("div",{className:"nav-skeleton__strip",children:[(0,d.jsx)("div",{className:"nav-skeleton__pill"}),(0,d.jsx)("div",{className:"nav-skeleton__pill"}),(0,d.jsx)("div",{className:"nav-skeleton__pill"}),(0,d.jsx)("div",{className:"nav-skeleton__pill"})]}),(0,d.jsxs)("div",{className:"nav-skeleton__rows",children:[(0,d.jsx)("div",{className:"nav-skeleton__row"}),(0,d.jsx)("div",{className:"nav-skeleton__row"}),(0,d.jsx)("div",{className:"nav-skeleton__row"}),(0,d.jsx)("div",{className:"nav-skeleton__row"})]})]})})}},62592:(a,b,c)=>{"use strict";c.d(b,{default:()=>J});var d=c(21124),e=c(38301),f=c(3991),g=c.n(f),h=c(42378),i=c(30242),j=c(11941),k=c(63881),l=c(23007),m=c(99802),n=c(93673),o=c(74905),p=c(39153),q=c(26890),r=c(77703),s=c(59153),t=c(30079),u=c(75571),v=c(13044),w=c(45423),x=c(79401),y=c(36248),z=c(81868),A=c(80207);let B="madarx:sidebarAvatar";function C(){let[a,b]=(0,e.useState)(null),c=(0,e.useRef)(null);return(0,d.jsxs)(d.Fragment,{children:[(0,d.jsxs)("button",{type:"button",onClick:()=>c.current?.click(),"aria-label":a?"Change avatar":"Upload an avatar",title:a?"Change avatar":"Upload an avatar",className:"group relative w-9 h-9 rounded-full overflow-hidden flex items-center justify-center cursor-pointer border border-[rgba(20,22,26,0.16)] bg-[rgba(17,19,24,0.035)] transition-colors hover:border-[rgba(20,22,26,0.32)] focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[#111318] focus-visible:ring-offset-2 focus-visible:ring-offset-white/50",children:[a?(0,d.jsx)("img",{src:a,alt:"Avatar",className:"w-full h-full object-cover"}):(0,d.jsx)("svg",{width:"16",height:"16",viewBox:"0 0 24 24",fill:"none",stroke:"#9aa1ab",strokeWidth:"1.7",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:(0,d.jsx)("path",{d:"M12 16V8M8 12h8"})}),(0,d.jsx)("span",{className:"absolute inset-0 hidden group-hover:flex items-center justify-center bg-black/35 text-white",children:(0,d.jsxs)("svg",{width:"14",height:"14",viewBox:"0 0 24 24",fill:"none",stroke:"currentColor",strokeWidth:"1.8",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,d.jsx)("path",{d:"M12 16V6M12 6 7.5 10.5M12 6l4.5 4.5"}),(0,d.jsx)("path",{d:"M5 18v1.5A1.5 1.5 0 0 0 6.5 21h11a1.5 1.5 0 0 0 1.5-1.5V18"})]})}),a?(0,d.jsx)("span",{role:"button",tabIndex:-1,onClick:function(a){a.stopPropagation(),b(null);try{localStorage.removeItem(B)}catch{}},"aria-label":"Remove avatar",className:"absolute -top-0.5 -right-0.5 hidden group-hover:flex w-4 h-4 items-center justify-center rounded-full bg-[#111318] text-white text-[9px] leading-none",children:"\xd7"}):null]}),(0,d.jsx)("input",{ref:c,type:"file",accept:"image/*",hidden:!0,onChange:function(a){let c=a.target.files?.[0];if(a.target.value="",!c||!c.type.startsWith("image/")||c.size>2097152)return;let d=new FileReader;d.onload=()=>{let a=String(d.result||"");if(a){b(a);try{localStorage.setItem(B,a)}catch{}}},d.readAsDataURL(c)}})]})}let D=[{group:"work",name:"Spaces",href:"/",icon:k.A},{group:"work",name:"Projects",href:"/projects",icon:l.A},{group:"work",name:"Agents",href:"/agents",icon:m.A},{group:"work",name:"Tasks",href:"/tasks",icon:n.A},{group:"work",name:"Workflows",href:"/workflows",icon:o.A},{group:"work",name:"Approvals",href:"/approvals",icon:p.A},{group:"library",name:"Marketplace",href:"/marketplace",icon:q.A}],E={Pickaxe:r.A,Boxes:s.A,Gem:t.A,FlaskConical:u.A,Factory:v.A,Building2:w.A,Package:q.A,FolderOpen:l.A,Workflow:o.A},F=[{name:"Settings",icon:x.A,href:"/settings"}];function G(a,b){return!!a&&("/"===b?"/"===a:a===b||a.startsWith(`${b}/`))}function H(a){a.currentTarget?.blur?.()}function I({item:a,active:b}){let c=a.icon;return(0,d.jsxs)(g(),{href:a.href,prefetch:!0,"aria-label":a.name,"aria-current":b?"page":void 0,"data-active":b?"true":void 0,onClick:H,className:`relative flex items-center justify-center p-2 rounded-lg transition-colors duration-150 group ${b?"text-[#C2452A]":"text-[#69707a] hover:text-[#111318] hover:bg-[rgba(17,19,24,0.08)] active:bg-[rgba(17,19,24,0.12)]"}`,children:[(0,d.jsx)(c,{className:"w-5 h-5",strokeWidth:1.75,"aria-hidden":"true"}),(0,d.jsx)("span",{className:"absolute left-12 px-2 py-1 rounded-md whitespace-nowrap text-xs text-white bg-[#111318] hidden group-hover:inline-block group-focus-visible:inline-block z-50 shadow-lg pointer-events-none",children:a.name})]})}function J({moduleNav:a=[]}){let b=(0,h.usePathname)(),{session:c,signOut:f}=function(){let[a,b]=(0,e.useState)(null),c=(0,h.useRouter)();return{session:a,signOut:async function(){await fetch("/api/auth/session",{method:"DELETE"}).catch(()=>null),c.replace("/login"),c.refresh()}}}(),[k,l]=(0,e.useState)(null),m=(Array.isArray(a)?a:[]).map(a=>({group:"module",name:a.label,href:a.href,icon:E[a.icon]||s.A})),n=[...D.filter(a=>"work"===a.group),...m,...D.filter(a=>"library"===a.group)],o=c?.email||"Local owner",p="local"===(c?.auth_mode||"local"),q=(c?.email||c?.display_name||"AK").slice(0,2).toUpperCase();return(0,d.jsxs)("aside",{className:"relative z-30 h-full w-full rounded-[18px] border border-white/75 bg-[var(--glass)] backdrop-blur-[22px] backdrop-saturate-150 flex flex-col","aria-label":"Primary navigation",children:[(0,d.jsx)("div",{className:"h-20 flex items-center justify-center px-3 shrink-0",children:(0,d.jsx)(C,{})}),(0,d.jsxs)("div",{className:"flex-1 flex flex-col min-h-0",children:[(0,d.jsx)("ul",{className:"list-none m-0 p-0 px-3 text-sm font-medium flex-1 space-y-1",children:n.map((a,c)=>{let e=n[c-1],f=e&&e.group!==a.group,g=G(b,a.href);return(0,d.jsxs)("li",{children:[f?(0,d.jsx)("div",{"aria-hidden":"true",className:"mx-2 my-2 h-px bg-[rgba(20,22,26,0.09)]"}):null,(0,d.jsx)(I,{item:a,active:g})]},a.name)})}),(0,d.jsx)("ul",{className:"list-none m-0 p-0 px-3 pb-3 pt-2 text-sm font-medium space-y-1",children:F.map(a=>{let c=G(b,a.href);return(0,d.jsx)("li",{children:(0,d.jsx)(I,{item:a,active:c})},a.name)})}),(0,d.jsx)("div",{className:"relative py-4 px-3 border-t border-[rgba(20,22,26,0.09)] flex justify-center",children:(0,d.jsxs)(i.bL,{children:[(0,d.jsx)(i.l9,{className:"outline-none rounded-full border-0 bg-transparent p-0 appearance-none cursor-pointer focus-visible:ring-2 focus-visible:ring-[#111318] focus-visible:ring-offset-2 focus-visible:ring-offset-white/50","aria-label":"Account menu",children:(0,d.jsxs)(j.bL,{className:"w-10 h-10 rounded-full overflow-hidden cursor-pointer block",children:[(0,d.jsx)(j._V,{className:"w-full h-full object-cover",src:"/madarx-mark.svg",alt:"AK"}),(0,d.jsx)(j.H4,{className:"flex w-full h-full items-center justify-center text-white text-xs font-bold tracking-wider bg-gradient-to-br from-[#111318] to-[#565d6b]",delayMs:150,children:q})]})}),(0,d.jsx)(i.ZL,{children:(0,d.jsxs)(i.UC,{side:"right",align:"end",sideOffset:12,className:"w-64 rounded-xl bg-white shadow-[0_22px_60px_rgba(17,19,24,0.20)] border border-[rgba(20,22,26,0.09)] text-sm text-[#59606b] p-2 z-[100]",children:[(0,d.jsx)("div",{className:"px-2 py-1.5 text-[11px] uppercase tracking-[0.14em] text-[var(--accent-600)] font-bold",children:p?"Local operator":"Signed in"}),(0,d.jsx)("span",{className:"block text-[#68707b] px-2 pb-2 truncate",children:o}),(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsx)(g(),{href:"/",className:"block w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:"Spaces"})}),(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsx)(g(),{href:"/settings",className:"block w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:"Settings"})}),(0,d.jsx)(i.wv,{className:"my-1 h-px bg-[rgba(20,22,26,0.09)]"}),k?.behind&&k?.latest?(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsxs)(g(),{href:"/",className:"flex items-center justify-between gap-x-2 w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:[(0,d.jsxs)("span",{className:"flex items-center gap-x-2",children:[(0,d.jsx)(y.A,{className:"w-4 h-4 text-[var(--accent-600)]",strokeWidth:1.75}),"Update available"]}),(0,d.jsxs)("span",{className:"text-[11px] font-semibold text-[var(--accent-600)]",children:["v",k.latest]})]})}):(0,d.jsxs)("div",{className:"flex items-center justify-between px-2 py-2 text-[12px] text-[#9aa1ab]",children:[(0,d.jsx)("span",{children:"Version"}),(0,d.jsx)("span",{className:"font-medium text-[#68707b]",children:k?.current?`v${k.current}`:"—"})]}),(0,d.jsx)(i.wv,{className:"my-1 h-px bg-[rgba(20,22,26,0.09)]"}),p?(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsxs)(g(),{href:"/settings/account",className:"flex items-center gap-x-2 w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer no-underline text-[#313740]",children:[(0,d.jsx)(z.A,{className:"w-4 h-4",strokeWidth:1.75}),"Sign in with an account"]})}):(0,d.jsx)(i.q7,{asChild:!0,className:"outline-none",children:(0,d.jsxs)("button",{type:"button",onClick:f,className:"flex items-center gap-x-2 w-full p-2 text-left rounded-md hover:bg-[rgba(17,19,24,0.05)] active:bg-[rgba(17,19,24,0.1)] duration-150 cursor-pointer text-[#313740]",children:[(0,d.jsx)(A.A,{className:"w-4 h-4",strokeWidth:1.75}),"Sign out"]})})]})})]})})]})]})}},65593:(a,b,c)=>{Promise.resolve().then(c.bind(c,74138)),Promise.resolve().then(c.bind(c,30724))},67237:(a,b,c)=>{Promise.resolve().then(c.t.bind(c,81170,23)),Promise.resolve().then(c.t.bind(c,23597,23)),Promise.resolve().then(c.t.bind(c,36893,23)),Promise.resolve().then(c.t.bind(c,89748,23)),Promise.resolve().then(c.t.bind(c,6060,23)),Promise.resolve().then(c.t.bind(c,7184,23)),Promise.resolve().then(c.t.bind(c,69576,23)),Promise.resolve().then(c.t.bind(c,73041,23)),Promise.resolve().then(c.t.bind(c,51384,23))},70715:(a,b,c)=>{"use strict";c.a(a,async(a,d)=>{try{c.r(b),c.d(b,{default:()=>k,metadata:()=>l});var e=c(75338),f=c(46609),g=c(30724),h=c(74138),i=c(23230);c(82704);var j=a([i]);i=(j.then?(await j)():j)[0];let l={title:"madarX OS",description:"Local-first agent command center for Client Workspace"};function k({children:a}){let b=[];try{b=(0,i.O2)()}catch{b=[]}return(0,e.jsx)("html",{lang:"en",className:f.variable,children:(0,e.jsx)("body",{children:(0,e.jsx)(h.default,{sidebar:(0,e.jsx)(g.default,{moduleNav:b}),children:a})})})}d()}catch(a){d(a)}})},74138:(a,b,c)=>{"use strict";c.d(b,{default:()=>d});let d=(0,c(97954).registerClientReference)(function(){throw Error("Attempted to call the default export of \"/home/runner/work/madarx-os/madarx-os/app/components/app-chrome.jsx\" from the server, but it's on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")},"/home/runner/work/madarx-os/madarx-os/app/components/app-chrome.jsx","default")},80389:(a,b,c)=>{Promise.resolve().then(c.t.bind(c,54160,23)),Promise.resolve().then(c.t.bind(c,31603,23)),Promise.resolve().then(c.t.bind(c,68495,23)),Promise.resolve().then(c.t.bind(c,75170,23)),Promise.resolve().then(c.t.bind(c,77526,23)),Promise.resolve().then(c.t.bind(c,78922,23)),Promise.resolve().then(c.t.bind(c,29234,23)),Promise.resolve().then(c.t.bind(c,12263,23)),Promise.resolve().then(c.bind(c,82146))},82704:()=>{},90391:(a,b,c)=>{"use strict";c.r(b),c.d(b,{default:()=>f});var d=c(75338),e=c(50872);function f(){return(0,d.jsx)(e.D,{})}}};

package/.next/standalone/.next/server/chunks/6910.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=6910,exports.ids=[6910],exports.modules={46910:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{DX:()=>p,Lt:()=>k,S2:()=>m,Si:()=>r,Sp:()=>q,dr:()=>o,lO:()=>l,n0:()=>s,th:()=>h.th,vx:()=>n});var e=c(77598),f=c(34255),g=c(4160),h=c(76031),i=c(95678),j=a([f,g]);function k(a){let b=(0,f.getDb)().prepare("SELECT * FROM artifact_acls WHERE artifact_id = ?").get(a);return b||{artifact_id:a,scope:"private",team_id:null,updated_at:(0,f.nowIso)(),updated_by:null}}function l(a,{scope:b,team_id:c=null,updated_by:d}){let e=["private","team","org","link"];if(!e.includes(b))throw{status:400,error:"invalid_scope",validScopes:e};if("team"===b&&!c)throw{status:400,error:"team_id_required_for_team_scope"};let g=(0,f.getDb)(),h=g.prepare("SELECT scope FROM artifact_acls WHERE artifact_id = ?").get(a);return h?.scope==="link"&&"link"!==b&&g.prepare(`UPDATE artifact_share_links
+"use strict";exports.id=6910,exports.ids=[396,6910],exports.modules={46910:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{DX:()=>p,Lt:()=>k,S2:()=>m,Si:()=>r,Sp:()=>q,dr:()=>o,lO:()=>l,n0:()=>s,th:()=>h.th,vx:()=>n});var e=c(77598),f=c(34255),g=c(4160),h=c(76031),i=c(95678),j=a([f,g,i]);function k(a){let b=(0,f.getDb)().prepare("SELECT * FROM artifact_acls WHERE artifact_id = ?").get(a);return b||{artifact_id:a,scope:"private",team_id:null,updated_at:(0,f.nowIso)(),updated_by:null}}function l(a,{scope:b,team_id:c=null,updated_by:d}){let e=["private","team","org","link"];if(!e.includes(b))throw{status:400,error:"invalid_scope",validScopes:e};if("team"===b&&!c)throw{status:400,error:"team_id_required_for_team_scope"};let g=(0,f.getDb)(),h=g.prepare("SELECT scope FROM artifact_acls WHERE artifact_id = ?").get(a);return h?.scope==="link"&&"link"!==b&&g.prepare(`UPDATE artifact_share_links
          SET revoked = 1
        WHERE artifact_id = ? AND revoked = 0`).run(a),g.prepare(`INSERT INTO artifact_acls (artifact_id, scope, team_id, updated_at, updated_by)
      VALUES (?, ?, ?, ?, ?)
@@ -31,4 +31,4 @@
          AND expires_at > ?
          AND verified_at IS NULL
        ORDER BY created_at DESC
-       LIMIT 1`).get(a,b,(0,f.nowIso)());if(!h)return{ok:!1,reason:"not_found_or_expired"};if(h.attempts>=5){try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_LOCKED_OUT,action_target_id:a,action_target_type:"artifact",status:"denied",summary:`OTP lockout for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts}})}catch{}return{ok:!1,reason:"lockout"}}let[i,j]=h.code_hash.split(":"),k=(0,e.createHash)("sha256").update(i+":"+c).digest("hex");Buffer.from(i,"utf8");let l=Buffer.from(k,"hex"),m=Buffer.from(j,"hex");if(!(l.length===m.length&&(0,e.timingSafeEqual)(l,m))){d.prepare("UPDATE artifact_share_link_otps SET attempts = attempts + 1 WHERE id = ?").run(h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_FAILED,action_target_id:a,action_target_type:"artifact",status:"denied",summary:`OTP verification failed for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts+1}})}catch{}return{ok:!1,reason:"invalid_code"}}d.prepare("UPDATE artifact_share_link_otps SET verified_at = ? WHERE id = ?").run((0,f.nowIso)(),h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_VERIFIED,action_target_id:a,action_target_type:"artifact",status:"success",summary:`OTP verified for ${b} on link ${a}`,meta:{share_link_id:a}})}catch{}return{ok:!0}}[f,g]=j.then?(await j)():j,d()}catch(a){d(a)}})},76031:(a,b,c)=>{c.d(b,{L5:()=>g,Oj:()=>f,lr:()=>h,th:()=>j});var d=c(77598);let e=null;async function f(){if(e)return e;if(process.env.MADARX_SHARE_LINK_SECRET)return e=process.env.MADARX_SHARE_LINK_SECRET;try{let{getSecret:a,setSecret:b}=await Promise.resolve().then(c.bind(c,24516)),f=await a("MADARX_SHARE_LINK_SECRET",{scope:"global"});if(f)return e=f;let g=(0,d.randomBytes)(32).toString("hex");return console.warn("[share-secret] WARNING: MADARX_SHARE_LINK_SECRET is not set. A random key has been generated and stored in the secrets vault. Set MADARX_SHARE_LINK_SECRET in your environment before deploying to production — losing this key invalidates all existing share links."),await b("MADARX_SHARE_LINK_SECRET",g,{scope:"global",source:"auto_generated"}),e=g}catch(a){return console.warn("[share-secret] WARNING: Could not access secrets vault for MADARX_SHARE_LINK_SECRET. Using an ephemeral key — share links will break on restart. Error: "+a.message),e=(0,d.randomBytes)(32).toString("hex")}}function g(a,b){return(0,d.createHmac)("sha256",b).update(a).digest("hex")}function h(a,b){let c=Buffer.from(a,"hex"),e=Buffer.from(b,"hex");return c.length===e.length&&(0,d.timingSafeEqual)(c,e)}let i=new Map;function j(a){if(!a)return{ok:!0};let b=Date.now(),c=i.get(a);return!c||b-c.windowStart>=36e5?(i.set(a,{count:1,windowStart:b}),{ok:!0}):c.count>=100?{ok:!1,retryAfterMs:36e5-(b-c.windowStart)}:(c.count+=1,{ok:!0})}},95678:(a,b,c)=>{c.d(b,{_:()=>e});let d=["MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function e(a){let b=String(a||"").startsWith("/")?String(a||""):`/${a||""}`,c=function(){for(let a of d){let b=process.env[a];if(!b||!String(b).trim())continue;let c=String(b).trim().replace(/\/+$/,"");if(/^https?:\/\//i.test(c))return c}return""}();return c?`${c}${b}`:b}}};
+       LIMIT 1`).get(a,b,(0,f.nowIso)());if(!h)return{ok:!1,reason:"not_found_or_expired"};if(h.attempts>=5){try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_LOCKED_OUT,action_target_id:a,action_target_type:"artifact",status:"denied",summary:`OTP lockout for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts}})}catch{}return{ok:!1,reason:"lockout"}}let[i,j]=h.code_hash.split(":"),k=(0,e.createHash)("sha256").update(i+":"+c).digest("hex");Buffer.from(i,"utf8");let l=Buffer.from(k,"hex"),m=Buffer.from(j,"hex");if(!(l.length===m.length&&(0,e.timingSafeEqual)(l,m))){d.prepare("UPDATE artifact_share_link_otps SET attempts = attempts + 1 WHERE id = ?").run(h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_FAILED,action_target_id:a,action_target_type:"artifact",status:"denied",summary:`OTP verification failed for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts+1}})}catch{}return{ok:!1,reason:"invalid_code"}}d.prepare("UPDATE artifact_share_link_otps SET verified_at = ? WHERE id = ?").run((0,f.nowIso)(),h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_VERIFIED,action_target_id:a,action_target_type:"artifact",status:"success",summary:`OTP verified for ${b} on link ${a}`,meta:{share_link_id:a}})}catch{}return{ok:!0}}[f,g,i]=j.then?(await j)():j,d()}catch(a){d(a)}})},76031:(a,b,c)=>{c.d(b,{L5:()=>g,Oj:()=>f,lr:()=>h,th:()=>j});var d=c(77598);let e=null;async function f(){if(e)return e;if(process.env.MADARX_SHARE_LINK_SECRET)return e=process.env.MADARX_SHARE_LINK_SECRET;try{let{getSecret:a,setSecret:b}=await Promise.resolve().then(c.bind(c,24516)),f=await a("MADARX_SHARE_LINK_SECRET",{scope:"global"});if(f)return e=f;let g=(0,d.randomBytes)(32).toString("hex");return console.warn("[share-secret] WARNING: MADARX_SHARE_LINK_SECRET is not set. A random key has been generated and stored in the secrets vault. Set MADARX_SHARE_LINK_SECRET in your environment before deploying to production — losing this key invalidates all existing share links."),await b("MADARX_SHARE_LINK_SECRET",g,{scope:"global",source:"auto_generated"}),e=g}catch(a){return console.warn("[share-secret] WARNING: Could not access secrets vault for MADARX_SHARE_LINK_SECRET. Using an ephemeral key — share links will break on restart. Error: "+a.message),e=(0,d.randomBytes)(32).toString("hex")}}function g(a,b){return(0,d.createHmac)("sha256",b).update(a).digest("hex")}function h(a,b){let c=Buffer.from(a,"hex"),e=Buffer.from(b,"hex");return c.length===e.length&&(0,d.timingSafeEqual)(c,e)}let i=new Map;function j(a){if(!a)return{ok:!0};let b=Date.now(),c=i.get(a);return!c||b-c.windowStart>=36e5?(i.set(a,{count:1,windowStart:b}),{ok:!0}):c.count>=100?{ok:!1,retryAfterMs:36e5-(b-c.windowStart)}:(c.count+=1,{ok:!0})}},90396:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{getPublicBaseUrl:()=>h,wz:()=>i,x6:()=>j});var e=c(67179),f=a([e]);e=(f.then?(await f)():f)[0];let k="public_base_url",l=["MADARX_PUBLIC_URL","MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function g(a){if(!a||!String(a).trim())return"";let b=String(a).trim().replace(/\/+$/,"");return/^https?:\/\//i.test(b)?b:""}function h(){try{let a=g((0,e.getConfig)(k,null));if(a)return a}catch{}for(let a of l){let b=g(process.env[a]);if(b)return b}return""}function i(a){let b=null==a?"":String(a).trim();if(""===b)return(0,e.setConfig)(k,""),"";if(!function(a){let b=g(a);if(!b)return!1;try{return new URL(b),!0}catch{return!1}}(b))throw Error("public app URL must be a valid http(s) URL, e.g. https://madarx.io");let c=g(b);return(0,e.setConfig)(k,c),c}function j(a){let b=String(a||""),c=b.startsWith("/")?b:`/${b}`,d=h();return d?`${d}${c}`:c}d()}catch(a){d(a)}})},95678:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{_:()=>g});var e=c(90396),f=a([e]);function g(a){return(0,e.x6)(a)}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})}};

package/.next/standalone/.next/server/chunks/8421.js

@@ -0,0 +1 @@
+"use strict";exports.id=8421,exports.ids=[8043,8421],exports.modules={31575:(a,b,c)=>{c.d(b,{iN:()=>f,qs:()=>g});var d=c(21124),e=c(94657);function f({kicker:a="madarX OS v1.0",title:b,description:c,actions:f,hideProjectSwitcher:g,children:h}){return(0,d.jsxs)("main",{className:"admin-shell",children:[(0,d.jsxs)("header",{className:"admin-header",children:[(0,d.jsxs)("div",{children:[(0,d.jsx)("span",{className:"admin-kicker",children:a}),(0,d.jsx)("h1",{children:b}),c?(0,d.jsx)("p",{children:c}):null]}),(0,d.jsxs)("div",{className:"admin-header-actions",children:[g?null:(0,d.jsx)(e.default,{}),f]})]}),h]})}function g({children:a,tone:b="neutral"}){return(0,d.jsx)("span",{className:`admin-pill ${b}`,children:a})}},58043:(a,b,c)=>{c.r(b),c.d(b,{default:()=>g});var d=c(21124),e=c(45798),f=c(23415);function g({children:a}){return(0,d.jsx)(e.oz,{remarkPlugins:[f.A],children:a})}},90802:(a,b,c)=>{c.r(b),c.d(b,{default:()=>o});var d=c(21124),e=c(13973),f=c(38301),g=c(23312),h=c(31575),i=c(39693),j=c(58043);function k({item:a}){return"file"===a.source_type&&a.local_only?(0,d.jsxs)("div",{className:"project-preview-locked",children:[(0,d.jsx)(h.qs,{tone:"warn",children:"Local only"}),(0,d.jsx)("p",{children:"This document is marked local-only. Its contents stay on disk and are never sent to non-local engines or the preview surface."}),a.storage_path?(0,d.jsx)("code",{children:a.storage_path}):null]}):"html"===a.render_kind&&a.body?(0,d.jsx)(l,{content:a.body,title:a.title||a.name}):"markdown"===a.render_kind&&a.body?(0,d.jsxs)("div",{className:"project-preview-markdown",children:[(0,d.jsx)(j.default,{children:a.body}),a.body_truncated?(0,d.jsx)("small",{className:"project-preview-truncated",children:"Preview truncated — open the file to see everything."}):null]}):a.body?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("pre",{className:"project-preview-pre",children:a.body}),a.body_truncated?(0,d.jsx)("small",{className:"project-preview-truncated",children:"Preview truncated — open the file to see everything."}):null]}):(0,d.jsxs)("p",{children:["Preview unavailable for this ","artifact"===a.source_type?"artifact":a.kind||"file","."]})}function l({content:a,title:b}){let c=(0,f.useRef)(null),e=(0,f.useMemo)(()=>(0,i.sV)(a),[a]);return(0,d.jsx)("iframe",{ref:c,className:"project-slideover-iframe",srcDoc:e,sandbox:"allow-scripts allow-popups allow-popups-to-escape-sandbox",title:b||"Artifact preview",onLoad:i.MZ})}let m=(0,e.default)(()=>c.e(2255).then(c.bind(c,22255)),{loadableGenerated:{modules:["app/projects/[slug]/floating-artifact-window.jsx -> ./share-panel.jsx"]}});function n(){return{x:80,y:80,width:760,height:580}}function o({item:a,onClose:b,isProtected:c=!1,onToggleProtect:e,onDelete:h,deleting:i=!1,folders:j=[],rootFolderId:l=null,onMove:o,moving:p=!1,protectError:q=null,spaces:r=[],onBookmarkToSpace:s,bookmarking:t=!1}){let u="project-float-title",[v,w]=(0,f.useState)(n),[x,y]=(0,f.useState)(!1),[z,A]=(0,f.useState)(!1),[B,C]=(0,f.useState)(!1),[D,E]=(0,f.useState)(!1),[F,G]=(0,f.useState)(!1);(0,f.useRef)(!1).current=x;let H=()=>y(a=>!a);if(!a||"undefined"==typeof document)return null;let I="artifact"===a.source_type?a.title||a.path||a.id:a.name,J="file"===a.source_type&&a.local_only,K=!!a.body&&!J,L="artifact"===a.source_type?a.kind||"artifact":a.local_only?"local":a.kind||"file",M=function(a){if("artifact"===a.source_type){let b=a.agent_id||"";return b?"main-orchestrator"===b?"Main agent":"ops-agent"===b?"Caretaker":b:"Agent"}return"You"}(a),N=a.updated_at||a.created_at,O=x?{transform:"translate3d(0,0,0)",width:"100vw",height:"100vh"}:{transform:`translate3d(${v.x}px, ${v.y}px, 0)`,width:v.width,height:v.height};return(0,g.createPortal)((0,d.jsxs)("div",{className:`project-float-root${x?" is-expanded":""}`,role:"presentation","aria-hidden":a?void 0:"true",children:[(0,d.jsxs)("div",{className:`artifact-window-wrap project-float-wrap${x?" is-expanded":""}`,"data-dragging":z?"true":"false","data-resizing":B?"true":"false",style:O,children:[(0,d.jsxs)("div",{className:"window artifact-window project-float-window",role:"dialog","aria-modal":"true","aria-labelledby":u,children:[(0,d.jsx)("div",{className:"winbar",onPointerDown:F?void 0:function(a){if(x||a.target.closest("button, i, .winbar-dl, .winbar-protect, .winbar-share, .winbar-space, .artifact-kind-badge"))return;a.preventDefault();let b=a.clientX,c=a.clientY,d=v.x,e=v.y;A(!0),a.currentTarget.setPointerCapture?.(a.pointerId);let f=a.currentTarget;document.body.style.userSelect="none";let g=a=>{a.preventDefault();let f=window.innerWidth,g=window.innerHeight,h=a.clientX-b,i=a.clientY-c,j=Math.min(Math.max(8,d+h),f-v.width-8),k=Math.min(Math.max(8,e+i),g-v.height-8);w(a=>({...a,x:j,y:k}))},h=a=>{f.removeEventListener("pointermove",g),f.removeEventListener("pointerup",h),f.removeEventListener("pointercancel",h),f.releasePointerCapture?.(a.pointerId),document.body.style.userSelect="",A(!1)};f.addEventListener("pointermove",g),f.addEventListener("pointerup",h),f.addEventListener("pointercancel",h)},onDoubleClick:a=>{!a.target.closest("button, i, .winbar-dl, .winbar-protect, .winbar-share, .winbar-space, .winbar-delete, .confirm-label, .confirm-cancel, .confirm-delete, .artifact-kind-badge")&&(F||H())},title:x?"Double-click to exit full screen":"Drag to move \xb7 Double-click to expand",children:F?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("span",{className:"confirm-label",children:"Delete permanently?"}),(0,d.jsx)("button",{type:"button",className:"confirm-cancel",onPointerDown:a=>a.stopPropagation(),onClick:()=>G(!1),disabled:i,children:"Cancel"}),(0,d.jsx)("button",{type:"button",className:"confirm-delete",onPointerDown:a=>a.stopPropagation(),onClick:()=>h?.(),disabled:i,children:i?"Deleting…":"Delete"})]}):(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("i",{className:"dot-close",role:"button",tabIndex:0,onPointerDown:a=>a.stopPropagation(),onClick:b,onKeyDown:a=>{("Enter"===a.key||" "===a.key)&&(a.preventDefault(),b())},"aria-label":"Close",title:"Close"}),(0,d.jsx)("i",{className:"dot-zoom",role:"button",tabIndex:0,onPointerDown:a=>a.stopPropagation(),onClick:H,onKeyDown:a=>{("Enter"===a.key||" "===a.key)&&(a.preventDefault(),H())},"aria-label":x?"Exit full screen":"Expand to full screen","aria-pressed":x,title:x?"Exit full screen":"Expand"}),(0,d.jsx)("b",{id:u,title:I,children:I}),(0,d.jsx)("span",{className:"artifact-kind-badge "+(L||"text"),children:L}),(0,d.jsxs)("span",{className:"winbar-meta",children:[(0,d.jsx)("span",{children:M}),N?(0,d.jsxs)(d.Fragment,{children:[(0,d.jsx)("span",{"aria-hidden":"true",children:" \xb7 "}),(0,d.jsx)("time",{dateTime:N,children:function(a){if(!a)return"";try{return new Intl.DateTimeFormat("en",{month:"short",day:"numeric",hour:"2-digit",minute:"2-digit"}).format(new Date(a))}catch{return a}}(N)})]}):null]}),q?(0,d.jsx)("span",{className:"winbar-protect-error",role:"alert",children:q}):null,(0,d.jsx)("button",{type:"button",className:`winbar-protect${c?" on":""}`,onPointerDown:a=>a.stopPropagation(),onClick:()=>e?.(),"aria-pressed":c,"aria-label":c?"Remove protection":"Protect with passphrase",title:c?"Protected — click to remove":"Protect with passphrase",children:c?(0,d.jsxs)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,d.jsx)("rect",{x:"3",y:"7",width:"10",height:"7",rx:"1.5"}),(0,d.jsx)("path",{d:"M5 7V5a3 3 0 0 1 6 0v2"})]}):(0,d.jsxs)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,d.jsx)("rect",{x:"3",y:"7",width:"10",height:"7",rx:"1.5"}),(0,d.jsx)("path",{d:"M5 7V5a3 3 0 0 1 6 0"})]})}),(0,d.jsxs)("label",{className:"winbar-move",onPointerDown:a=>a.stopPropagation(),title:"Move to folder",children:[(0,d.jsx)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:(0,d.jsx)("path",{d:"M2 5a1 1 0 0 1 1-1h3.5l1.5 1.5H13a1 1 0 0 1 1 1v6a1 1 0 0 1-1 1H3a1 1 0 0 1-1-1V5Z"})}),(0,d.jsxs)("select",{"aria-label":"Move to folder",disabled:p,value:a?.folder_id||l||"",onChange:a=>{let b=a.target.value;o?.(b===l?l:b||null)},children:[l?(0,d.jsx)("option",{value:l,children:"Library (root)"}):(0,d.jsx)("option",{value:"",children:"Library (root)"}),j.filter(a=>null!=a.parent_id).map(a=>(0,d.jsx)("option",{value:a.id,children:a.path.replace(/^\/|\/$/g,"").split("/").slice(1).join(" / ")||a.name},a.id))]})]}),"artifact"===a.source_type&&r.length>0?(0,d.jsxs)("label",{className:"winbar-space",onPointerDown:a=>a.stopPropagation(),title:"Bookmark to a dashboard space",children:[(0,d.jsx)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:(0,d.jsx)("path",{d:"M4 2h8a1 1 0 0 1 1 1v11l-5-3-5 3V3a1 1 0 0 1 1-1Z"})}),(0,d.jsxs)("select",{"aria-label":"Bookmark to dashboard space",disabled:t,value:a?.space_id||"",onChange:a=>{let b=a.target.value;b&&s?.(b)},children:[(0,d.jsx)("option",{value:"",disabled:!0,children:"Pin to space…"}),r.map(a=>(0,d.jsx)("option",{value:a.id,children:a.name},a.id))]})]}):null,(0,d.jsx)("button",{type:"button",className:"winbar-share",onPointerDown:a=>a.stopPropagation(),onClick:()=>E(!0),"aria-label":"Share artifact",title:"Share",children:(0,d.jsxs)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,d.jsx)("circle",{cx:"12",cy:"3",r:"1.5"}),(0,d.jsx)("circle",{cx:"4",cy:"8",r:"1.5"}),(0,d.jsx)("circle",{cx:"12",cy:"13",r:"1.5"}),(0,d.jsx)("path",{d:"M10.5 3.9L5.5 7.1M5.5 8.9l5 3.2"})]})}),K?(0,d.jsx)("button",{type:"button",className:"winbar-dl",onPointerDown:a=>a.stopPropagation(),onClick:()=>(function(a){if(!a||!a.body)return;let b=function(a){let b=("artifact"===a.source_type?a.title||"artifact":a.name||"document").replace(/[\\/:*?"<>|]+/g,"-").trim()||"download";return"html"===a.render_kind?{ext:"html",mime:"text/html;charset=utf-8",name:b}:"markdown"===a.render_kind?{ext:"md",mime:"text/markdown;charset=utf-8",name:b}:{ext:"txt",mime:"text/plain;charset=utf-8",name:b}}(a),c=/\.[a-z0-9]+$/i.test(b.name)?b.name:`${b.name}.${b.ext}`,d=new Blob([a.body],{type:b.mime}),e=URL.createObjectURL(d),f=document.createElement("a");f.href=e,f.download=c,document.body.appendChild(f),f.click(),f.remove(),setTimeout(()=>URL.revokeObjectURL(e),1e3)})(a),"aria-label":`Download ${I}`,title:"Download",children:(0,d.jsxs)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2.2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:[(0,d.jsx)("path",{d:"M8 2v9M4 7l4 4 4-4"}),(0,d.jsx)("line",{x1:"2",y1:"14",x2:"14",y2:"14"})]})}):null,(0,d.jsx)("button",{type:"button",className:"winbar-delete",onPointerDown:a=>a.stopPropagation(),onClick:()=>G(!0),"aria-label":`Delete ${I}`,title:"Delete",children:(0,d.jsx)("svg",{width:"11",height:"11",viewBox:"0 0 16 16",fill:"none",stroke:"currentColor",strokeWidth:"2",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",children:(0,d.jsx)("path",{d:"M3 4h10M6.5 4V2.5h3V4M5 4l.7 9a1.5 1.5 0 0 0 1.5 1.4h1.6a1.5 1.5 0 0 0 1.5-1.4L11 4"})})})]})}),(0,d.jsx)("div",{className:"win-content project-float-body",children:(0,d.jsx)(k,{item:a})})]}),x?null:["nw","n","ne","e","se","s","sw","w"].map(a=>(0,d.jsx)("div",{className:`resize-edge resize-${a}`,onPointerDown:b=>(function(a,b){if(x)return;a.preventDefault(),a.stopPropagation();let c=a.clientX,d=a.clientY,e={...v};C(!0),a.currentTarget.setPointerCapture?.(a.pointerId);let f=a.currentTarget;document.body.style.userSelect="none",document.body.style.cursor=({n:"ns-resize",s:"ns-resize",e:"ew-resize",w:"ew-resize",ne:"nesw-resize",sw:"nesw-resize",nw:"nwse-resize",se:"nwse-resize"})[b]||"nwse-resize";let g=a=>{a.preventDefault();let f=window.innerWidth,g=window.innerHeight,h=a.clientX-c,i=a.clientY-d,j=e.x,k=e.y,l=e.width,m=e.height;b.includes("w")&&(e.width-h<320&&(h=e.width-320),e.x+h<8&&(h=8-e.x),j=e.x+h,l=e.width-h),b.includes("e")&&(e.width+h<320&&(h=320-e.width),e.x+e.width+h>f-8&&(h=f-8-e.x-e.width),l=e.width+h),b.includes("n")&&(e.height-i<220&&(i=e.height-220),e.y+i<8&&(i=8-e.y),k=e.y+i,m=e.height-i),b.includes("s")&&(e.height+i<220&&(i=220-e.height),e.y+e.height+i>g-8&&(i=g-8-e.y-e.height),m=e.height+i),w({x:j,y:k,width:l,height:m})},h=a=>{f.removeEventListener("pointermove",g),f.removeEventListener("pointerup",h),f.removeEventListener("pointercancel",h),f.releasePointerCapture?.(a.pointerId),document.body.style.userSelect="",document.body.style.cursor="",C(!1)};f.addEventListener("pointermove",g),f.addEventListener("pointerup",h),f.addEventListener("pointercancel",h)})(b,a)},a))]}),D&&(0,d.jsx)(m,{item:a,onClose:()=>E(!1)})]}),document.body)}}};