madarx 2.18.0 → 2.21.0

package/.next/standalone/.next/server/chunks/2402.js

@@ -0,0 +1 @@
+"use strict";exports.id=2402,exports.ids=[2402],exports.modules={82402:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Sq:()=>h,bj:()=>k,f$:()=>f.f$,pt:()=>i,x$:()=>f.x$,x4:()=>j});var e=c(66700),f=c(87025),g=a([e]);function h(a){if(!a||"string"!=typeof a)return null;let b=a.trim();if(/^[a-z0-9]{20}$/.test(b))return b;try{let a=new URL(b.includes("://")?b:`https://${b}`).hostname,c=a.match(/^([a-z0-9]{20})\.supabase\.(co|in|red)$/);if(c)return c[1];let d=a.split(".")[0];if(/^[a-z0-9]{20}$/.test(d))return d}catch{}return null}function i(a){let b=h(a);return b?`https://supabase.com/dashboard/project/${b}/sql/new`:null}async function j(a={}){if(!(0,e.isSharedCloudReady)(a))return{configured:!1};let b=(0,e.getSharedCloudAdmin)(a),c=[],d=[];return await Promise.all(f.q_.map(async a=>{try{await b.select(a,{limit:1}),c.push(a)}catch{d.push(a)}})),c.sort(),d.sort(),{configured:!0,ready:0===d.length,present:c,missing:d,total:f.q_.length,version:f.f$}}async function k({ref:a,pat:b}={}){let c,d=h(a)||(/(^[a-z0-9]{20}$)/.test(String(a||""))?a:null);if(!d)return{ok:!1,error:"invalid_project_ref"};if(!b||"string"!=typeof b||b.trim().length<20)return{ok:!1,error:"invalid_access_token"};try{c=await fetch(`https://api.supabase.com/v1/projects/${d}/database/query`,{method:"POST",headers:{Authorization:`Bearer ${b.trim()}`,"Content-Type":"application/json"},body:JSON.stringify({query:f.x$}),redirect:"error",signal:AbortSignal.timeout(3e4)})}catch{return{ok:!1,error:"unreachable"}}return c.ok?{ok:!0}:401===c.status||403===c.status?{ok:!1,error:"unauthorized_token"}:404===c.status?{ok:!1,error:"project_not_found"}:{ok:!1,error:`apply_failed_${c.status}`}}e=(g.then?(await g)():g)[0],d()}catch(a){d(a)}})},87025:(a,b,c)=>{c.d(b,{f$:()=>f,q_:()=>e,x$:()=>d});let d="-- MadarX OS — Supabase shared-layer schema (generated bundle).\n-- Generated from supabase/migrations/*.sql — DO NOT EDIT THE BUNDLE.\n-- Idempotent: safe to run repeatedly in the Supabase SQL editor.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0001_shared_layer.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0001_shared_layer.sql — MadarX OS hybrid shared layer (Supabase / cloud).\n--\n-- WHAT THIS IS\n--   The cloud coordination layer for *explicitly shared* org collaboration.\n--   Personal work stays local: local SQLite + the filesystem remain the source\n--   of truth for private artifacts and local runs. Only data that a user\n--   explicitly publishes/shares is represented here. This migration deliberately\n--   does NOT mirror the full local runtime schema (agents, runs, heartbeat,\n--   secrets, egress, etc.) — only the shared surface needed for collaboration.\n--\n-- WHAT LIVES HERE\n--   organizations         — tenant boundary (id mirrors the local org id, text)\n--   org_memberships       — who belongs to which org, and their role\n--   shared_spaces         — explicitly shared spaces/projects (metadata only)\n--   shared_artifacts      — metadata for explicitly published artifacts; payload\n--                           is optional and only present when a user opts in\n--   shared_artifact_acl   — per-principal grants on a shared artifact\n--   share_links           — cloud-coordinated external share tokens (hash only)\n--\n-- SECURITY MODEL\n--   RLS is ON for every table. Authenticated end users only ever see rows for\n--   orgs they are a member of, and only mutate per their role. The server-side\n--   service-role key (used by lib/shared-cloud.js, never shipped to the browser)\n--   bypasses RLS to perform publish/unpublish on the user's behalf after the\n--   local app has already authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Tables use IF NOT EXISTS; policies are dropped-then-created.\n\n-- ── Extensions ────────────────────────────────────────────────────────────────\ncreate extension if not exists pgcrypto;\n\n-- ── organizations ─────────────────────────────────────────────────────────────\ncreate table if not exists public.organizations (\n  id          text primary key,\n  slug        text not null unique,\n  name        text not null,\n  plan        text not null default 'free',\n  created_at  timestamptz not null default now(),\n  updated_at  timestamptz not null default now()\n);\n\n-- ── org_memberships ───────────────────────────────────────────────────────────\ncreate table if not exists public.org_memberships (\n  id                 uuid primary key default gen_random_uuid(),\n  org_id             text not null references public.organizations(id) on delete cascade,\n  user_id            uuid not null references auth.users(id) on delete cascade,\n  role               text not null default 'member' check (role in ('owner','admin','member','viewer')),\n  invited_by_user_id uuid,\n  invited_at         timestamptz,\n  accepted_at        timestamptz,\n  created_at         timestamptz not null default now(),\n  unique (org_id, user_id)\n);\ncreate index if not exists idx_org_memberships_user on public.org_memberships(user_id);\ncreate index if not exists idx_org_memberships_org on public.org_memberships(org_id);\n\n-- ── shared_spaces ─────────────────────────────────────────────────────────────\n-- A space/project that was explicitly shared into the org. `local_space_id`\n-- points back to the source-of-truth row in the user's local SQLite.\ncreate table if not exists public.shared_spaces (\n  id             uuid primary key default gen_random_uuid(),\n  org_id         text not null references public.organizations(id) on delete cascade,\n  local_space_id text not null,\n  slug           text not null,\n  name           text not null,\n  description    text,\n  visibility     text not null default 'org' check (visibility in ('org','team','private')),\n  created_by     uuid,\n  created_at     timestamptz not null default now(),\n  updated_at     timestamptz not null default now(),\n  unique (org_id, local_space_id)\n);\ncreate index if not exists idx_shared_spaces_org on public.shared_spaces(org_id);\n\n-- ── shared_artifacts ──────────────────────────────────────────────────────────\n-- Metadata for an explicitly published artifact. `local_artifact_id` points back\n-- to the local source of truth. `content` is nullable on purpose: by default\n-- only metadata is published; the payload is uploaded only when the user opts in.\ncreate table if not exists public.shared_artifacts (\n  id                uuid primary key default gen_random_uuid(),\n  org_id            text not null references public.organizations(id) on delete cascade,\n  space_id          uuid references public.shared_spaces(id) on delete set null,\n  local_artifact_id text not null,\n  title             text not null,\n  kind              text not null default 'html',\n  scope             text not null default 'org' check (scope in ('private','team','org','link')),\n  content_hash      text,\n  byte_size         integer,\n  content           text,\n  storage_path      text,\n  published_by      uuid,\n  published_at      timestamptz not null default now(),\n  updated_at        timestamptz not null default now(),\n  unique (org_id, local_artifact_id)\n);\ncreate index if not exists idx_shared_artifacts_org on public.shared_artifacts(org_id);\ncreate index if not exists idx_shared_artifacts_space on public.shared_artifacts(space_id);\n\n-- ── shared_artifact_acl ───────────────────────────────────────────────────────\ncreate table if not exists public.shared_artifact_acl (\n  id             uuid primary key default gen_random_uuid(),\n  artifact_id    uuid not null references public.shared_artifacts(id) on delete cascade,\n  org_id         text not null references public.organizations(id) on delete cascade,\n  principal_type text not null check (principal_type in ('user','team','org')),\n  principal_id   text,\n  permission     text not null default 'read' check (permission in ('read','write','admin')),\n  created_by     uuid,\n  created_at     timestamptz not null default now(),\n  unique (artifact_id, principal_type, principal_id)\n);\ncreate index if not exists idx_shared_acl_artifact on public.shared_artifact_acl(artifact_id);\n\n-- ── share_links ───────────────────────────────────────────────────────────────\n-- Cloud-coordinated external share. Only the HMAC of the token is stored, so a\n-- DB leak cannot replay outstanding links.\ncreate table if not exists public.share_links (\n  id           uuid primary key default gen_random_uuid(),\n  artifact_id  uuid not null references public.shared_artifacts(id) on delete cascade,\n  org_id       text not null references public.organizations(id) on delete cascade,\n  token_hmac   text not null unique,\n  created_by   uuid,\n  expires_at   timestamptz,\n  max_views    integer,\n  access_count integer not null default 0,\n  revoked      boolean not null default false,\n  created_at   timestamptz not null default now()\n);\ncreate index if not exists idx_share_links_artifact on public.share_links(artifact_id);\n\n-- ── Membership helper functions (SECURITY DEFINER, search_path pinned) ─────────\ncreate or replace function public.is_org_member(p_org_id text)\nreturns boolean\nlanguage sql\nstable\nsecurity definer\nset search_path = public\nas $$\n  select exists (\n    select 1 from public.org_memberships m\n    where m.org_id = p_org_id and m.user_id = auth.uid()\n  );\n$$;\n\ncreate or replace function public.org_role(p_org_id text)\nreturns text\nlanguage sql\nstable\nsecurity definer\nset search_path = public\nas $$\n  select m.role\n  from public.org_memberships m\n  where m.org_id = p_org_id and m.user_id = auth.uid()\n  limit 1;\n$$;\n\n-- ── Enable RLS on every table ─────────────────────────────────────────────────\nalter table public.organizations      enable row level security;\nalter table public.org_memberships    enable row level security;\nalter table public.shared_spaces      enable row level security;\nalter table public.shared_artifacts   enable row level security;\nalter table public.shared_artifact_acl enable row level security;\nalter table public.share_links        enable row level security;\n\n-- ── Policies: organizations ───────────────────────────────────────────────────\ndrop policy if exists organizations_select on public.organizations;\ncreate policy organizations_select on public.organizations\n  for select to authenticated\n  using (public.is_org_member(id));\n\ndrop policy if exists organizations_update on public.organizations;\ncreate policy organizations_update on public.organizations\n  for update to authenticated\n  using (public.org_role(id) in ('owner','admin'))\n  with check (public.org_role(id) in ('owner','admin'));\n\n-- ── Policies: org_memberships ─────────────────────────────────────────────────\n-- A member can see the roster of any org they belong to.\ndrop policy if exists org_memberships_select on public.org_memberships;\ncreate policy org_memberships_select on public.org_memberships\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\n-- Only owners/admins manage membership.\ndrop policy if exists org_memberships_write on public.org_memberships;\ncreate policy org_memberships_write on public.org_memberships\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ── Policies: shared_spaces ───────────────────────────────────────────────────\ndrop policy if exists shared_spaces_select on public.shared_spaces;\ncreate policy shared_spaces_select on public.shared_spaces\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_spaces_write on public.shared_spaces;\ncreate policy shared_spaces_write on public.shared_spaces\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- ── Policies: shared_artifacts ────────────────────────────────────────────────\ndrop policy if exists shared_artifacts_select on public.shared_artifacts;\ncreate policy shared_artifacts_select on public.shared_artifacts\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_artifacts_write on public.shared_artifacts;\ncreate policy shared_artifacts_write on public.shared_artifacts\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- ── Policies: shared_artifact_acl ─────────────────────────────────────────────\ndrop policy if exists shared_artifact_acl_select on public.shared_artifact_acl;\ncreate policy shared_artifact_acl_select on public.shared_artifact_acl\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_artifact_acl_write on public.shared_artifact_acl;\ncreate policy shared_artifact_acl_write on public.shared_artifact_acl\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ── Policies: share_links ─────────────────────────────────────────────────────\ndrop policy if exists share_links_select on public.share_links;\ncreate policy share_links_select on public.share_links\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists share_links_write on public.share_links;\ncreate policy share_links_write on public.share_links\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to publish on a user's behalf\n-- after the local app has authorized the action.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0002_shared_brand.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0002_shared_brand.sql — Org-shared brand profile (MadarX OS shared layer).\n--\n-- WHAT THIS IS\n--   The org-wide brand identity, shared through the cloud coordination layer.\n--   A brand profile is local-first by default (it lives in each install's local\n--   SQLite `config` table). When an owner/admin explicitly *publishes* the brand,\n--   one canonical row lands here so every teammate can *adopt* it locally. This\n--   mirrors the artifact/space publish pattern in lib/shared-cloud.js: nothing\n--   leaves the machine implicitly; publish + adopt are explicit, audited actions.\n--\n-- WHAT LIVES HERE\n--   shared_brand_profiles — exactly ONE row per org (unique org_id). Holds the\n--   brand profile JSON (company name, colors, fonts, voice, presentation style,\n--   document types) and an optional inlined logo data URL. No secrets — a brand\n--   profile is pure identity, so the full payload is safe to store.\n--\n-- SECURITY MODEL\n--   RLS is ON. Any org member may READ their org's brand (so they can adopt it).\n--   Only owners/admins may WRITE it (brand identity is an admin-managed default,\n--   consistent with organizations_update). The service-role key used server-side\n--   by lib/shared-cloud.js bypasses RLS to publish on an owner's behalf after the\n--   local app has already authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Table uses IF NOT EXISTS; policies are dropped-then-created.\n\n-- ── shared_brand_profiles ─────────────────────────────────────────────────────\ncreate table if not exists public.shared_brand_profiles (\n  id            uuid primary key default gen_random_uuid(),\n  org_id        text not null unique references public.organizations(id) on delete cascade,\n  company_name  text not null default 'Brand',\n  profile_json  jsonb not null,\n  logo_data_url text,\n  content_hash  text,\n  published_by  uuid,\n  created_at    timestamptz not null default now(),\n  updated_at    timestamptz not null default now()\n);\ncreate index if not exists idx_shared_brand_org on public.shared_brand_profiles(org_id);\n\n-- ── RLS ───────────────────────────────────────────────────────────────────────\nalter table public.shared_brand_profiles enable row level security;\n\n-- Any member may read their org's brand (needed to adopt it locally).\ndrop policy if exists shared_brand_select on public.shared_brand_profiles;\ncreate policy shared_brand_select on public.shared_brand_profiles\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\n-- Only owners/admins may publish/replace the org brand.\ndrop policy if exists shared_brand_write on public.shared_brand_profiles;\ncreate policy shared_brand_write on public.shared_brand_profiles\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to publish on a user's behalf\n-- after the local app has authorized the action.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0002_shared_spaces_resources.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0002_shared_spaces_resources.sql — Shareable project folders + space resources.\n--\n-- WHAT THIS ADDS (on top of 0001_shared_layer.sql)\n--   1. shared_spaces.space_type   — distinguishes a shared *project folder*\n--      ('project') from a shared *dashboard/UI space* ('dashboard_space').\n--   2. shared_spaces.local_project_id — convenience pointer to the local\n--      projects.id when space_type = 'project' (local_space_id holds the same\n--      value; this column makes project-scoped joins explicit).\n--   3. shared_space_resources     — metadata-only index of the folders, files,\n--      and artifacts that live inside a shared project folder. NEVER stores file\n--      bodies; only name/path/kind/size/sha256/local_only + a metadata jsonb bag.\n--\n-- WHY space_type WIDENS UNIQUENESS\n--   0001 made shared_spaces unique on (org_id, local_space_id). A project id and\n--   a dashboard-space id are drawn from independent id namespaces and could\n--   collide, so the uniqueness is widened to (org_id, space_type, local_space_id).\n--\n-- SECURITY MODEL — identical to 0001\n--   RLS is ON for the new table. Authenticated end users only ever see rows for\n--   orgs they belong to (is_org_member). Writes are gated by org_role. The\n--   server-side service-role key (lib/shared-cloud.js, never shipped to the\n--   browser) bypasses RLS to publish on a user's behalf after the local app has\n--   already authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Columns use ADD COLUMN IF NOT EXISTS; constraints are guarded\n--   with IF EXISTS / catalog checks; the table uses IF NOT EXISTS; policies are\n--   dropped-then-created.\n\n-- ── shared_spaces: new columns ────────────────────────────────────────────────\nalter table public.shared_spaces add column if not exists space_type       text not null default 'dashboard_space';\nalter table public.shared_spaces add column if not exists local_project_id  text;\n\n-- space_type domain guard.\nalter table public.shared_spaces drop constraint if exists shared_spaces_space_type_check;\nalter table public.shared_spaces\n  add constraint shared_spaces_space_type_check\n  check (space_type in ('dashboard_space','project'));\n\n-- Widen uniqueness to include space_type. 0001 created the implicit constraint\n-- named shared_spaces_org_id_local_space_id_key; drop it then add the wider one.\nalter table public.shared_spaces drop constraint if exists shared_spaces_org_id_local_space_id_key;\ndo $$\nbegin\n  if not exists (\n    select 1 from pg_constraint where conname = 'shared_spaces_org_type_local_key'\n  ) then\n    alter table public.shared_spaces\n      add constraint shared_spaces_org_type_local_key\n      unique (org_id, space_type, local_space_id);\n  end if;\nend $$;\n\ncreate index if not exists idx_shared_spaces_type on public.shared_spaces(org_id, space_type);\n\n-- ── shared_space_resources ────────────────────────────────────────────────────\n-- Metadata-only index of what lives inside a shared project folder. The body of\n-- a file is NEVER uploaded here (or anywhere by default) — only its descriptive\n-- metadata. local_only files are excluded by the server library unless a caller\n-- passes an explicit unsafe override; even then only metadata is recorded and\n-- the row is flagged local_only = true.\ncreate table if not exists public.shared_space_resources (\n  id                uuid primary key default gen_random_uuid(),\n  org_id            text not null references public.organizations(id) on delete cascade,\n  shared_space_id   uuid not null references public.shared_spaces(id) on delete cascade,\n  local_resource_id text not null,\n  resource_type     text not null check (resource_type in ('folder','file','artifact')),\n  name              text not null,\n  path              text,\n  mime_type         text,\n  kind              text,\n  size_bytes        integer,\n  sha256            text,\n  local_only        boolean not null default false,\n  metadata          jsonb,\n  updated_at        timestamptz not null default now(),\n  unique (shared_space_id, resource_type, local_resource_id)\n);\ncreate index if not exists idx_shared_space_resources_space on public.shared_space_resources(shared_space_id);\ncreate index if not exists idx_shared_space_resources_org on public.shared_space_resources(org_id);\n\n-- ── RLS ───────────────────────────────────────────────────────────────────────\nalter table public.shared_space_resources enable row level security;\n\ndrop policy if exists shared_space_resources_select on public.shared_space_resources;\ncreate policy shared_space_resources_select on public.shared_space_resources\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_space_resources_write on public.shared_space_resources;\ncreate policy shared_space_resources_write on public.shared_space_resources\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin','member'))\n  with check (public.org_role(org_id) in ('owner','admin','member'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to publish on a user's behalf\n-- after the local app has authorized the action.\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0003_org_invites.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0003_org_invites.sql — Org invite & join (email pre-invite + shareable link).\n--\n-- WHAT THIS ADDS (on top of 0001_shared_layer.sql)\n--   public.org_invites — ONE table for BOTH invite kinds (eng-review decision 1):\n--     • email pre-invite → `email` set, `token_hash` NULL. Claimed on first login\n--       by verified-email match (claim_email_invites RPC). No placeholder users\n--       row, no pending membership — a real membership is created only on join.\n--     • shareable link   → `token_hash` set (SHA-256 of a ≥128-bit CSPRNG token;\n--       the raw token is NEVER stored), `email` NULL. Redeemed via\n--       redeem_invite_token RPC.\n--\n-- WHY RPCs INSTEAD OF LOOSENED RLS (eng-review decision 3)\n--   A not-yet-member cannot read org_invites under RLS (is_org_member is false),\n--   so redemption runs through two SECURITY DEFINER functions that derive the\n--   joining identity from auth.uid()/auth.email() and never trust client input.\n--   Members call them with their OWN JWT — the service-role key never reaches a\n--   member machine. The RPCs are appended by the Phase 2 / Phase 3 changesets.\n--\n-- HARDENING (H2–H5, non-negotiable)\n--   H2  every definer fn: SET search_path, schema-qualified, asserts auth.uid(),\n--       EXECUTE revoked from public/anon and granted to authenticated only.\n--   H3  email-claim requires auth.users.email_confirmed_at and normalized email.\n--   H4  use-count bump is a single conditional UPDATE (no check-then-write);\n--       membership insert is ON CONFLICT DO NOTHING (idempotent).\n--   H5  the granted role is bounded by the CREATOR's role — enforced DB-side by\n--       a BEFORE INSERT trigger here (not only in the API route): an owner may\n--       mint owner/admin/member/viewer; an admin may mint member/viewer only.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Table uses IF NOT EXISTS; policies/trigger/functions are\n--   dropped-then-created or use CREATE OR REPLACE.\n\n-- ── org_invites ───────────────────────────────────────────────────────────────\ncreate table if not exists public.org_invites (\n  id                 uuid primary key default gen_random_uuid(),\n  org_id             text not null references public.organizations(id) on delete cascade,\n  role               text not null default 'member' check (role in ('owner','admin','member','viewer')),\n  email              text,\n  token_hash         text unique,\n  label              text,\n  created_by_user_id uuid,\n  expires_at         timestamptz,\n  max_uses           integer,\n  used_count         integer not null default 0,\n  revoked_at         timestamptz,\n  created_at         timestamptz not null default now(),\n  -- Exactly one invite kind per row.\n  constraint org_invites_kind_chk check ((email is not null)::int + (token_hash is not null)::int = 1)\n);\ncreate index if not exists idx_org_invites_org   on public.org_invites(org_id);\ncreate index if not exists idx_org_invites_email on public.org_invites(lower(email));\ncreate index if not exists idx_org_invites_token on public.org_invites(token_hash);\n\nalter table public.org_invites enable row level security;\n\n-- SELECT: members of the org can see its invites (the roster/admin surface).\ndrop policy if exists org_invites_select on public.org_invites;\ncreate policy org_invites_select on public.org_invites\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\n-- INSERT/UPDATE/DELETE: owners/admins only. The role-grant ceiling (H5) is\n-- enforced in addition by the trigger below. Note: a not-yet-member redeeming a\n-- link does NOT write here directly — the SECURITY DEFINER RPCs do (and they bump\n-- used_count under the function's privileges, not the caller's).\ndrop policy if exists org_invites_write on public.org_invites;\ncreate policy org_invites_write on public.org_invites\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ── H5: role-grant ceiling, enforced DB-side ───────────────────────────────────\n-- The invite's granted role must be bounded by the creator's role in the org.\n-- Without this, anyone who can create an invite could mint an owner invite and\n-- self-escalate. Runs as a trigger so it binds the cloud path regardless of API.\ncreate or replace function public.org_invites_enforce_role_ceiling()\nreturns trigger\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, public\nas $$\ndeclare\n  v_creator_role text;\nbegin\n  -- Only the GRANTED ROLE is ceiling-bounded. used_count bumps and revoked_at\n  -- writes (which redeem_invite_token / revoke perform, sometimes as the joining\n  -- member) leave role unchanged and must pass freely — otherwise redemption,\n  -- which UPDATEs used_count under the member's own auth.uid(), would be blocked.\n  if tg_op = 'UPDATE' and new.role is not distinct from old.role then\n    return new;\n  end if;\n  -- Service-role / server path: auth.uid() is NULL. The owner app already\n  -- authorized the action at the API layer (requireRole admin) before using the\n  -- service key, which bypasses RLS by design. The ceiling exists to stop an\n  -- AUTHENTICATED admin from self-escalating via a direct PostgREST insert OR a\n  -- role-changing UPDATE (auth.uid() is set on those paths).\n  if auth.uid() is null then\n    return new;\n  end if;\n  v_creator_role := public.org_role(new.org_id);\n  if v_creator_role is null then\n    raise exception 'org_invites: creator is not a member of org %', new.org_id;\n  end if;\n  -- owner may grant any role; admin may grant member/viewer only.\n  if v_creator_role = 'owner' then\n    return new;\n  elsif v_creator_role = 'admin' and new.role in ('member','viewer') then\n    return new;\n  end if;\n  raise exception 'org_invites: role % cannot mint an invite granting %', v_creator_role, new.role;\nend;\n$$;\n\ndrop trigger if exists trg_org_invites_role_ceiling on public.org_invites;\ncreate trigger trg_org_invites_role_ceiling\n  before insert or update on public.org_invites\n  for each row execute function public.org_invites_enforce_role_ceiling();\n\nrevoke execute on function public.org_invites_enforce_role_ceiling() from public, anon;\n\n-- ── Phase 2: claim_email_invites() — email pre-invite claim (H2/H3/H4) ─────────\n-- Called by the member's session ONLY when they currently have no membership\n-- (bounded to first-login / no-org state). Derives identity from auth.uid()/\n-- auth.email(); accepts NO client input. Honors a claim only for a VERIFIED,\n-- normalized email (H3). Membership insert is idempotent (H4).\ncreate or replace function public.claim_email_invites()\nreturns table(org_id text, granted_role text)\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, public\nas $$\ndeclare\n  v_uid   uuid := auth.uid();\n  v_email text;\n  rec     record;\nbegin\n  if v_uid is null then\n    raise exception 'claim_email_invites: authentication required';\n  end if;\n  -- H3: verified email only, normalized (lower+trim).\n  select lower(trim(u.email)) into v_email\n    from auth.users u\n    where u.id = v_uid and u.email_confirmed_at is not null;\n  if v_email is null then\n    return;\n  end if;\n  for rec in\n    select * from public.org_invites\n      where lower(email) = v_email and revoked_at is null\n        and (expires_at is null or expires_at > now())\n  loop\n    insert into public.org_memberships (org_id, user_id, role, accepted_at)\n    values (rec.org_id, v_uid, rec.role, now())\n    on conflict (org_id, user_id) do nothing;\n    update public.org_invites\n      set used_count = used_count + 1, revoked_at = now()\n      where id = rec.id and revoked_at is null;\n    org_id := rec.org_id; granted_role := rec.role; return next;\n  end loop;\n  return;\nend;\n$$;\nrevoke execute on function public.claim_email_invites() from public, anon;\ngrant  execute on function public.claim_email_invites() to authenticated;\n\n-- ── Phase 3: redeem_invite_token() — shareable-link redemption (H2/H4, Q2) ─────\n-- Called by POST /api/orgs/join under the member's own JWT. Derives the joining\n-- identity from auth.uid(); accepts ONLY the opaque token (never org_id/role/\n-- user_id/used_count). H4: the use-count bump is a single conditional UPDATE.\n-- Q2: an existing member is a no-op that consumes no use.\ncreate or replace function public.redeem_invite_token(p_token text)\nreturns table(org_id text, granted_role text)\nlanguage plpgsql\nsecurity definer\nset search_path = pg_catalog, public\nas $$\ndeclare\n  v_uid  uuid := auth.uid();\n  v_hash text;\n  rec    public.org_invites%rowtype;\nbegin\n  if v_uid is null then\n    raise exception 'redeem_invite_token: authentication required';\n  end if;\n  if p_token is null or length(p_token) = 0 then\n    raise exception 'invalid invite token';\n  end if;\n  -- sha256() is a pg_catalog built-in (PG14+), so it resolves under the pinned\n  -- search_path WITHOUT depending on where pgcrypto's digest() was installed\n  -- (Supabase puts pgcrypto in `extensions`, not `public`). Matches the Node\n  -- hashToken(): sha256 hex of the token's UTF-8 bytes.\n  v_hash := encode(sha256(p_token::bytea), 'hex');\n\n  select * into rec from public.org_invites\n    where token_hash = v_hash and email is null;\n  if rec.id is null then\n    raise exception 'invalid invite token';\n  end if;\n\n  -- Q2: an existing member just resolves — consume no use.\n  if exists (select 1 from public.org_memberships m where m.org_id = rec.org_id and m.user_id = v_uid) then\n    org_id := rec.org_id;\n    select m.role into granted_role from public.org_memberships m\n      where m.org_id = rec.org_id and m.user_id = v_uid;\n    return next; return;\n  end if;\n\n  -- H4: atomic conditional bump (no check-then-write).\n  update public.org_invites\n    set used_count = used_count + 1\n    where id = rec.id and revoked_at is null\n      and (expires_at is null or expires_at > now())\n      and (max_uses is null or used_count < max_uses);\n  if not found then\n    raise exception 'invite is no longer valid (expired, revoked, or fully used)';\n  end if;\n\n  insert into public.org_memberships (org_id, user_id, role, accepted_at)\n  values (rec.org_id, v_uid, rec.role, now())\n  on conflict (org_id, user_id) do nothing;\n\n  org_id := rec.org_id; granted_role := rec.role; return next;\nend;\n$$;\nrevoke execute on function public.redeem_invite_token(text) from public, anon;\ngrant  execute on function public.redeem_invite_token(text) to authenticated;\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0004_tighten_share_links.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0004_tighten_share_links.sql — Narrow share_links writes to owner/admin.\n--\n-- WHY (locked tension resolution)\n--   0001 allowed share_links writes by (owner, admin, member). A public share\n--   link is an external-exposure decision; a plain member should not be able to\n--   mint one. This migration TIGHTENS that one policy to (owner, admin). It is\n--   the ONLY RLS change in the invite/join feature, and it is a tightening — not\n--   the loosening the original Phase 6 draft proposed. Members still publish\n--   artifacts and spaces (those policies are unchanged); they simply cannot mint\n--   public share-links.\n--\n-- IDEMPOTENCY\n--   Safe to re-run: the policy is dropped-then-created.\n\ndrop policy if exists share_links_write on public.share_links;\ncreate policy share_links_write on public.share_links\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- ════════════════════════════════════════════════════════════════════\n-- ▶ 0005_shared_space_acl.sql\n-- ════════════════════════════════════════════════════════════════════\n-- 0003_shared_space_acl.sql — Per-principal access grants for shared spaces.\n--\n-- WHAT THIS ADDS (on top of 0001 + 0002)\n--   shared_space_acl — grants a specific principal (a user, a team, or the whole\n--   org) a permission (read | write | admin) on a shared space/project folder.\n--   This is the space-level mirror of `shared_artifact_acl` (0001). The coarse\n--   `shared_spaces.visibility` flag stays the baseline; these rows AUGMENT it:\n--     - visibility='private' + user grants  → \"only these people\"\n--     - visibility='org'                    → every member gets baseline read;\n--                                             grants only ELEVATE permission.\n--\n-- PERMISSION SEMANTICS (enforced read-time in lib/shared-cloud.js)\n--   read   browse the space's resource index + open published artifact bodies\n--   write  read + re-sync / add resources\n--   admin  write + manage this space's ACL\n--\n-- PRINCIPAL TYPES\n--   'user' and 'org' are live. 'team' is kept in the CHECK domain for forward\n--   compatibility but is NOT yet targetable (no teams table exists — Phase 4).\n--\n-- SECURITY MODEL — identical to 0001/0002\n--   RLS ON. Authenticated end users only see rows for orgs they belong to\n--   (is_org_member). Writes require org_role in ('owner','admin'). The\n--   service-role key (lib/shared-cloud.js, server-only) bypasses RLS to write a\n--   grant AFTER the local app has authorized the action.\n--\n-- IDEMPOTENCY\n--   Safe to re-run. Table uses IF NOT EXISTS; policies are dropped-then-created.\n\n-- ── shared_space_acl ────────────────────────────────────────────────────────────\ncreate table if not exists public.shared_space_acl (\n  id              uuid primary key default gen_random_uuid(),\n  shared_space_id uuid not null references public.shared_spaces(id) on delete cascade,\n  org_id          text not null references public.organizations(id) on delete cascade,\n  principal_type  text not null check (principal_type in ('user','team','org')),\n  principal_id    text not null,\n  permission      text not null default 'read' check (permission in ('read','write','admin')),\n  created_by      uuid,\n  created_at      timestamptz not null default now(),\n  updated_at      timestamptz not null default now(),\n  unique (shared_space_id, principal_type, principal_id)\n);\ncreate index if not exists idx_shared_space_acl_space on public.shared_space_acl(shared_space_id);\ncreate index if not exists idx_shared_space_acl_org on public.shared_space_acl(org_id);\n\n-- ── RLS ───────────────────────────────────────────────────────────────────────\nalter table public.shared_space_acl enable row level security;\n\ndrop policy if exists shared_space_acl_select on public.shared_space_acl;\ncreate policy shared_space_acl_select on public.shared_space_acl\n  for select to authenticated\n  using (public.is_org_member(org_id));\n\ndrop policy if exists shared_space_acl_write on public.shared_space_acl;\ncreate policy shared_space_acl_write on public.shared_space_acl\n  for all to authenticated\n  using (public.org_role(org_id) in ('owner','admin'))\n  with check (public.org_role(org_id) in ('owner','admin'));\n\n-- NOTE: the service-role key bypasses RLS by design. lib/shared-cloud.js uses it\n-- server-side only (never in browser/client code) to write a grant after the\n-- local app has authorized the action.\n\n-- Refresh the PostgREST schema cache so new tables are visible now.\nnotify pgrst, 'reload schema';\n",e=["org_invites","org_memberships","organizations","share_links","shared_artifact_acl","shared_artifacts","shared_brand_profiles","shared_space_acl","shared_space_resources","shared_spaces"],f="065e7d20e9ca"}};

package/.next/standalone/.next/server/chunks/3230.js

@@ -5,27 +5,27 @@
     `).run(+!!c,c?d:null,b):a.prepare(`
       INSERT INTO marketplace_installations (item_id, installed, installed_at)
       VALUES (?, ?, ?)
-    `).run(b,+!!c,c?d:null)}function k(a,b){let c=(0,e.getDb)(),d=(0,e.nowIso)(),i=a?.module?.module_id||a?.slug;"mines"===i?(0,g.g)():function(a){let b=Array.isArray(a?.module?.agents)?a.module.agents:[];for(let a of b)try{(0,h.pz)(a,"personal")}catch{}}(a),j(c,a.id,!0,d);try{(0,f.appendComplianceAudit)({user_id:n,org_id:m,action:"marketplace.module.installed",status:"success",summary:`Installed module ${a.title||a.slug||a.id}`,action_target_id:a.id,action_target_type:"marketplace_module",meta:{module_id:i,slug:a.slug}})}catch{}return b(a.id)}function l(a,b){let c=(0,e.getDb)(),d=(0,e.nowIso)(),i=a?.module?.module_id||a?.slug,k=0,l=0;c.exec("BEGIN");try{"mines"===i?(k=function(a){try{let b=a.prepare("SELECT COUNT(*) AS n FROM mines_projects").get(),c=Number(b?.n)||0;return c>0&&a.prepare("DELETE FROM mines_projects").run(),c}catch{return 0}}(c),l=(0,g.L)()):l=function(a,b){let c=Array.isArray(b?.module?.agents)?b.module.agents:[],d=0;for(let b of c)try{let c=a.prepare("SELECT agent_id FROM agent_template_installations WHERE template_slug = ? AND project_id = 'personal'").get(b);c?.agent_id&&((0,h.I2)(c.agent_id),d+=1)}catch{}return d}(c,a),j(c,a.id,!1,d),c.exec("COMMIT")}catch(a){throw c.exec("ROLLBACK"),a}try{(0,f.appendComplianceAudit)({user_id:n,org_id:m,action:"marketplace.module.uninstalled",status:"success",summary:`Uninstalled module ${a.title||a.slug||a.id} (removed ${l} agent(s), ${k} project(s))`,action_target_id:a.id,action_target_type:"marketplace_module",meta:{module_id:i,slug:a.slug,removed_agents:l,removed_projects:k}})}catch{}return b(a.id)}d()}catch(a){d(a)}})},23230:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Gq:()=>u,N4:()=>y,O2:()=>x,QH:()=>t,Uk:()=>v,iN:()=>z});var e=c(73024),f=c(76760),g=c(34255),h=c(9381),i=c(26531),j=c(40718),k=c(93154),l=c(9013),m=c(17298),n=a([g,j,k,l,m]);[g,j,k,l,m]=n.then?(await n)():n;let A=new Set(["tool","skill","bundle","agent","connection","workflow","module"]);function o(a,b){if(!a)return b;try{let c=JSON.parse(a);return null==c?b:c}catch{return b}}function p(a){let b=!!a.enabled,c=!!a.available;return{id:`tool:${a.name}`,kind:"tool",slug:a.name,title:a.title||a.name,description:a.description||"",category:a.category,author:"madarx",source:{kind:"builtin",url:null},version:null,installed:b,available:c,risk_summary:null,tags:[a.category,a.risk_level].filter(Boolean),tool:{risk_level:a.risk_level,approval_mode:a.approval_mode,required_env:a.required_env||[],missing_env:a.missing_env||[],available:c,connector:a.connector||null},skill:null,bundle:null,agent:null}}function q(a,b){let c=o(a.manifest_json,{}),d=o(a.tags,[]),e=o(b?.settings_json,{})||{},f={id:a.id,kind:a.kind,slug:a.slug,title:a.title,description:a.description||"",category:a.category,author:a.author,source:{kind:a.source_kind,url:a.source_url||null},version:a.version||null,installed:!!b?.installed,available:!0,risk_summary:a.risk_summary||null,tags:Array.isArray(d)?d:[],tool:null,skill:null,bundle:null,agent:null,connection:null,workflow:null,module:null};if("skill"===a.kind)f.skill={invocation:c.invocation||`/${a.slug}`,file_paths:Array.isArray(c.file_paths)?c.file_paths:[],trigger_examples:Array.isArray(c.trigger_examples)?c.trigger_examples:[]};else if("connection"===a.kind)f.connection={service_key:c.service_key||a.slug,setup_kind:c.setup_kind||"api_key",benefit:c.benefit||a.description||"",credentials:Array.isArray(c.credentials)?c.credentials:[],verify_endpoint:c.verify_endpoint||null,verify_supported:!!c.verify_supported,deep_link:c.deep_link||null,unlocks_tool_slugs:Array.isArray(c.unlocks_tool_slugs)?c.unlocks_tool_slugs:[],engines:Array.isArray(c.engines)?c.engines:[],logo_glyph:c.logo_glyph||a.slug,requires_daemon:c.requires_daemon||null,last_verified_at:e.last_verified_at||null,account_label:e.account_label||null,last_4:e.last_4||null,summary:e.summary||null};else if("agent"===a.kind){f.agent=c.agent||c||{};try{let b=(0,g.getDb)().prepare("SELECT agent_id, project_id FROM agent_template_installations WHERE template_slug = ? AND status = 'active'").all(a.slug);f.installed=b.length>0,f.install_count=b.length,f.agent.installed_instances=b.map(a=>({agent_id:a.agent_id,project_id:a.project_id}))}catch{}}else if("bundle"===a.kind)f.bundle={item_refs:Array.isArray(c.item_refs)?c.item_refs:[],published_count:Number.isFinite(c.published_count)?c.published_count:Array.isArray(c.item_refs)?c.item_refs.length:0,license:c.license||null,note:c.note||null};else if("workflow"===a.kind){let d=c.source_spec_json&&"object"==typeof c.source_spec_json?c.source_spec_json:null,g=d&&Array.isArray(d.stages)?d.stages.length:0,h=d&&Array.isArray(d.stages)?d.stages.map(a=>a&&a.kind).filter(Boolean):[];f.workflow={definition_slug:d?.slug||a.slug,schema_version:d?.schema_version||1,stage_count:g,stage_kinds:h,summary:c.summary||a.description||"",source_spec_json:d};try{let c=e.workflow_definition_slug,d=e.installed_by_marketplace_item_id;if(b?.installed&&d===a.id&&c){let a=(0,l.Ao)(c);f.installed=!!(a&&"archived"!==a.status)}}catch{}}else"module"===a.kind&&(f.module={module_id:c.module_id||a.slug,agents:Array.isArray(c.agents)?c.agents:[],tools:Array.isArray(c.tools)?c.tools:[],skill_packs:Array.isArray(c.skill_packs)?c.skill_packs:[],connections:Array.isArray(c.connections)?c.connections:[],workflow_templates:Array.isArray(c.workflow_templates)?c.workflow_templates:[],nav:Array.isArray(c.nav)?c.nav:[]});return f}function r(){return(0,j.n4)().map(p)}function s(a){let b=(0,g.getDb)(),c=[],d=`
+    `).run(b,+!!c,c?d:null)}function k(a,b){let c=(0,e.getDb)(),d=(0,e.nowIso)(),i=a?.module?.module_id||a?.slug;"mines"===i?(0,g.g)():function(a){let b=Array.isArray(a?.module?.agents)?a.module.agents:[];for(let a of b)try{(0,h.pz)(a,"personal")}catch{}}(a),j(c,a.id,!0,d);try{(0,f.appendComplianceAudit)({user_id:n,org_id:m,action:"marketplace.module.installed",status:"success",summary:`Installed module ${a.title||a.slug||a.id}`,action_target_id:a.id,action_target_type:"marketplace_module",meta:{module_id:i,slug:a.slug}})}catch{}return b(a.id)}function l(a,b){let c=(0,e.getDb)(),d=(0,e.nowIso)(),i=a?.module?.module_id||a?.slug,k=0,l=0;c.exec("BEGIN");try{"mines"===i?(k=function(a){try{let b=a.prepare("SELECT COUNT(*) AS n FROM mines_projects").get(),c=Number(b?.n)||0;return c>0&&a.prepare("DELETE FROM mines_projects").run(),c}catch{return 0}}(c),l=(0,g.L)()):l=function(a,b){let c=Array.isArray(b?.module?.agents)?b.module.agents:[],d=0;for(let b of c)try{let c=a.prepare("SELECT agent_id FROM agent_template_installations WHERE template_slug = ? AND project_id = 'personal'").get(b);c?.agent_id&&((0,h.I2)(c.agent_id),d+=1)}catch{}return d}(c,a),j(c,a.id,!1,d),c.exec("COMMIT")}catch(a){throw c.exec("ROLLBACK"),a}try{(0,f.appendComplianceAudit)({user_id:n,org_id:m,action:"marketplace.module.uninstalled",status:"success",summary:`Uninstalled module ${a.title||a.slug||a.id} (removed ${l} agent(s), ${k} project(s))`,action_target_id:a.id,action_target_type:"marketplace_module",meta:{module_id:i,slug:a.slug,removed_agents:l,removed_projects:k}})}catch{}return b(a.id)}d()}catch(a){d(a)}})},23230:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Gq:()=>u,N4:()=>x,O2:()=>w,QH:()=>t,Uk:()=>function a(b,c){let d=u(b);if(!d)throw Error(`Unknown marketplace item: ${b}`);if("tool"===d.kind)return(0,j.G7)(d.slug,!!c),u(b);if("agent"===d.kind){if(c)(0,k.pz)(d.slug,"personal");else{let a=d.agent?.installed_instances||[];a[0]?.agent_id&&(0,k.I2)(a[0].agent_id)}return u(b)}if("bundle"===d.kind)return function(b,c){let d=Array.isArray(b.bundle?.item_refs)?b.bundle.item_refs:[],e=[];for(let b of d){if("string"!=typeof b||b.startsWith("bundle:"))continue;let d=u(b);if(d)try{a(d.id,c),e.push({id:d.id,ok:!0})}catch(a){e.push({id:d.id,ok:!1,error:String(a?.message||a)})}}let f=(0,g.getDb)(),h=(0,g.nowIso)();f.prepare("SELECT item_id FROM marketplace_installations WHERE item_id=?").get(b.id)?f.prepare("UPDATE marketplace_installations SET installed=?, installed_at=? WHERE item_id=?").run(+!!c,c?h:null,b.id):f.prepare("INSERT INTO marketplace_installations (item_id, installed, installed_at) VALUES (?, ?, ?)").run(b.id,+!!c,c?h:null);let i=b.bundle?.requires_connection||b.manifest?.requires_connection||null;return{status:c?"installed":"uninstalled",item:u(b.id),installed_items:e,requires_connection:c?i:null}}(d,c);if("connection"===d.kind)return{status:"setup_required",reason:"Open the setup assistant to connect this service.",item:d};if("workflow"===d.kind)return function(a,b){let c=a?.workflow?.source_spec_json;if(!c||"object"!=typeof c)return{status:"error",reason:"Workflow template has no source spec",item:a};let d=c.slug||a.workflow.definition_slug;if(!d)return{status:"error",reason:"Workflow spec missing slug",item:a};let e=(0,g.getDb)(),f=(0,g.nowIso)();if(b){let b=(0,l.Ao)(d);if(b&&"archived"!==b.status)return{status:"already_present",reason:"A workflow with this slug already exists. It was not installed as this marketplace item, so uninstall will not archive it.",item:u(a.id)};try{(0,l.R1)(c,{source_spec_json:JSON.stringify(c),created_by_user_id:null}),function(a,b="personal"){for(let c of function(a){if(!a||!Array.isArray(a.stages))return[];let b=new Set;for(let c of a.stages){if(c?.kind!=="agent_run")continue;let a=c?.config?.agent_template_slug;"string"==typeof a&&a.trim()&&b.add(a.trim())}return[...b]}(a))(0,k.pz)(c,b)}(c,"personal")}catch(b){return{status:"error",reason:b?.code==="spec_invalid"?`Workflow spec invalid: ${(b.errors||[]).join("; ")}`:b?.message||"Workflow install failed",item:a}}return v(e,a.id,!0,f,{installed_by_marketplace_item_id:a.id,workflow_definition_slug:d,workflow_definition_id:`procdef:${d}`,installed_source:"marketplace"}),u(a.id)}let h=e.prepare("SELECT settings_json FROM marketplace_installations WHERE item_id=? AND installed=1").get(a.id),i=o(h?.settings_json,{})||{};if(i.installed_by_marketplace_item_id!==a.id||i.workflow_definition_slug!==d)return v(e,a.id,!1,f,i),u(a.id);let j=(0,l.wN)(d);return j.ok||"in_flight_cases"!==j.error?(v(e,a.id,!1,f),u(a.id)):{status:"in_flight_cases",in_flight_cases:j.in_flight_cases,reason:`Cannot uninstall — ${j.in_flight_cases} case(s) still running. Finish or cancel them first.`,item:u(a.id)}}(d,c);if("module"===d.kind)return c?(0,m.E)(d,u):(0,m.v)(d,u);"skill"===d.kind&&c&&function(a){try{let b=(0,g.getDb)().prepare("SELECT manifest_json FROM marketplace_items WHERE id=?").get(a.id),c=o(b?.manifest_json,{}),d="string"==typeof c.source_markdown?c.source_markdown:null;if(!d)return;let j=(Array.isArray(c.file_paths)&&c.file_paths.length?c.file_paths:[`skills/${a.slug}/SKILL.md`])[0],k=f.join(h.un,j);if(!(0,i.wn)(k))return;e.mkdirSync(f.dirname(k),{recursive:!0}),e.existsSync(k)||e.writeFileSync(k,d,"utf8")}catch{}}(d);let n=(0,g.getDb)(),p=(0,g.nowIso)();return n.prepare("SELECT item_id FROM marketplace_installations WHERE item_id=?").get(b)?n.prepare(`
+      UPDATE marketplace_installations
+         SET installed=?, installed_at=?
+       WHERE item_id=?
+    `).run(+!!c,c?p:null,b):n.prepare(`
+      INSERT INTO marketplace_installations (item_id, installed, installed_at)
+      VALUES (?, ?, ?)
+    `).run(b,+!!c,c?p:null),u(b)},iN:()=>y});var e=c(73024),f=c(76760),g=c(34255),h=c(9381),i=c(26531),j=c(40718),k=c(93154),l=c(9013),m=c(17298),n=a([g,j,k,l,m]);[g,j,k,l,m]=n.then?(await n)():n;let z=new Set(["tool","skill","bundle","agent","connection","workflow","module"]);function o(a,b){if(!a)return b;try{let c=JSON.parse(a);return null==c?b:c}catch{return b}}function p(a){let b=!!a.enabled,c=!!a.available;return{id:`tool:${a.name}`,kind:"tool",slug:a.name,title:a.title||a.name,description:a.description||"",category:a.category,author:"madarx",source:{kind:"builtin",url:null},version:null,installed:b,available:c,risk_summary:null,tags:[a.category,a.risk_level].filter(Boolean),tool:{risk_level:a.risk_level,approval_mode:a.approval_mode,required_env:a.required_env||[],missing_env:a.missing_env||[],available:c,connector:a.connector||null},skill:null,bundle:null,agent:null}}function q(a,b){let c=o(a.manifest_json,{}),d=o(a.tags,[]),e=o(b?.settings_json,{})||{},f={id:a.id,kind:a.kind,slug:a.slug,title:a.title,description:a.description||"",category:a.category,author:a.author,source:{kind:a.source_kind,url:a.source_url||null},version:a.version||null,installed:!!b?.installed,available:!0,risk_summary:a.risk_summary||null,tags:Array.isArray(d)?d:[],tool:null,skill:null,bundle:null,agent:null,connection:null,workflow:null,module:null};if("skill"===a.kind)f.skill={invocation:c.invocation||`/${a.slug}`,file_paths:Array.isArray(c.file_paths)?c.file_paths:[],trigger_examples:Array.isArray(c.trigger_examples)?c.trigger_examples:[]};else if("connection"===a.kind)f.connection={service_key:c.service_key||a.slug,setup_kind:c.setup_kind||"api_key",benefit:c.benefit||a.description||"",credentials:Array.isArray(c.credentials)?c.credentials:[],verify_endpoint:c.verify_endpoint||null,verify_supported:!!c.verify_supported,deep_link:c.deep_link||null,unlocks_tool_slugs:Array.isArray(c.unlocks_tool_slugs)?c.unlocks_tool_slugs:[],engines:Array.isArray(c.engines)?c.engines:[],logo_glyph:c.logo_glyph||a.slug,requires_daemon:c.requires_daemon||null,last_verified_at:e.last_verified_at||null,account_label:e.account_label||null,last_4:e.last_4||null,summary:e.summary||null};else if("agent"===a.kind){f.agent=c.agent||c||{};try{let b=(0,g.getDb)().prepare("SELECT agent_id, project_id FROM agent_template_installations WHERE template_slug = ? AND status = 'active'").all(a.slug);f.installed=b.length>0,f.install_count=b.length,f.agent.installed_instances=b.map(a=>({agent_id:a.agent_id,project_id:a.project_id}))}catch{}}else if("bundle"===a.kind)f.bundle={item_refs:Array.isArray(c.item_refs)?c.item_refs:[],published_count:Number.isFinite(c.published_count)?c.published_count:Array.isArray(c.item_refs)?c.item_refs.length:0,license:c.license||null,note:c.note||null,requires_connection:c.requires_connection||null,unlocks_tool_slugs:Array.isArray(c.unlocks_tool_slugs)?c.unlocks_tool_slugs:[],install_hint:c.install_hint||null};else if("workflow"===a.kind){let d=c.source_spec_json&&"object"==typeof c.source_spec_json?c.source_spec_json:null,g=d&&Array.isArray(d.stages)?d.stages.length:0,h=d&&Array.isArray(d.stages)?d.stages.map(a=>a&&a.kind).filter(Boolean):[];f.workflow={definition_slug:d?.slug||a.slug,schema_version:d?.schema_version||1,stage_count:g,stage_kinds:h,summary:c.summary||a.description||"",source_spec_json:d};try{let c=e.workflow_definition_slug,d=e.installed_by_marketplace_item_id;if(b?.installed&&d===a.id&&c){let a=(0,l.Ao)(c);f.installed=!!(a&&"archived"!==a.status)}}catch{}}else"module"===a.kind&&(f.module={module_id:c.module_id||a.slug,agents:Array.isArray(c.agents)?c.agents:[],tools:Array.isArray(c.tools)?c.tools:[],skill_packs:Array.isArray(c.skill_packs)?c.skill_packs:[],connections:Array.isArray(c.connections)?c.connections:[],workflow_templates:Array.isArray(c.workflow_templates)?c.workflow_templates:[],nav:Array.isArray(c.nav)?c.nav:[]});return f}function r(){return(0,j.n4)().map(p)}function s(a){let b=(0,g.getDb)(),c=[],d=`
     SELECT i.*, m.installed, m.settings_json
       FROM marketplace_items i
  LEFT JOIN marketplace_installations m ON m.item_id = i.id
-  `;return a&&(d+=" WHERE i.kind = ?",c.push(a)),d+=" ORDER BY i.kind ASC, i.created_at ASC",b.prepare(d).all(...c).map(a=>q(a,{installed:a.installed,settings_json:a.settings_json}))}function t(a={}){let b,{kind:c,category:d,query:e}=a;return c&&!A.has(c)?[]:(b="tool"===c?r():"skill"===c||"bundle"===c||"agent"===c||"connection"===c||"workflow"===c||"module"===c?s(c):[...r(),...s()],b=function(a,b){if(!b)return a;let c=String(b).toLowerCase();return a.filter(a=>String(a.category||"").toLowerCase()===c)}(b,d),b=function(a,b){if(!b)return a;let c=String(b).trim();return c?a.map(a=>({item:a,score:function(a,b){if(!b)return 0;let c=b.toLowerCase(),d=String(a.title||"").toLowerCase(),e=String(a.slug||"").toLowerCase(),f=String(a.description||"").toLowerCase(),g=String(a.author||"").toLowerCase(),h=Array.isArray(a.tags)?a.tags.join(" ").toLowerCase():"";return d.startsWith(c)||e.startsWith(c)?100:d.includes(c)||e.includes(c)?80:g.includes(c)?60:h.includes(c)?50:30*!!f.includes(c)}(a,c)})).filter(a=>a.score>0).sort((a,b)=>b.score-a.score).map(a=>a.item):a}(b,e))}function u(a){if(!a)return null;if("string"==typeof a&&a.startsWith("tool:")){let b=a.slice(5),c=(0,j.n4)().find(a=>a.name===b);return c?p(c):null}let b=(0,g.getDb)().prepare(`
+  `;return a&&(d+=" WHERE i.kind = ?",c.push(a)),d+=" ORDER BY i.kind ASC, i.created_at ASC",b.prepare(d).all(...c).map(a=>q(a,{installed:a.installed,settings_json:a.settings_json}))}function t(a={}){let b,{kind:c,category:d,query:e}=a;return c&&!z.has(c)?[]:(b="tool"===c?r():"skill"===c||"bundle"===c||"agent"===c||"connection"===c||"workflow"===c||"module"===c?s(c):[...r(),...s()],b=function(a,b){if(!b)return a;let c=String(b).toLowerCase();return a.filter(a=>String(a.category||"").toLowerCase()===c)}(b,d),b=function(a,b){if(!b)return a;let c=String(b).trim();return c?a.map(a=>({item:a,score:function(a,b){if(!b)return 0;let c=b.toLowerCase(),d=String(a.title||"").toLowerCase(),e=String(a.slug||"").toLowerCase(),f=String(a.description||"").toLowerCase(),g=String(a.author||"").toLowerCase(),h=Array.isArray(a.tags)?a.tags.join(" ").toLowerCase():"";return d.startsWith(c)||e.startsWith(c)?100:d.includes(c)||e.includes(c)?80:g.includes(c)?60:h.includes(c)?50:30*!!f.includes(c)}(a,c)})).filter(a=>a.score>0).sort((a,b)=>b.score-a.score).map(a=>a.item):a}(b,e))}function u(a){if(!a)return null;if("string"==typeof a&&a.startsWith("tool:")){let b=a.slice(5),c=(0,j.n4)().find(a=>a.name===b);return c?p(c):null}let b=(0,g.getDb)().prepare(`
     SELECT i.*, m.installed, m.settings_json
       FROM marketplace_items i
  LEFT JOIN marketplace_installations m ON m.item_id = i.id
      WHERE i.id = ?
-  `).get(a);return b?q(b,{installed:b.installed,settings_json:b.settings_json}):null}function v(a,b){let c=u(a);if(!c)throw Error(`Unknown marketplace item: ${a}`);if("tool"===c.kind)return(0,j.G7)(c.slug,!!b),u(a);if("agent"===c.kind){if(b)(0,k.pz)(c.slug,"personal");else{let a=c.agent?.installed_instances||[];a[0]?.agent_id&&(0,k.I2)(a[0].agent_id)}return u(a)}if("bundle"===c.kind)return{status:"deferred",reason:"Bundle install lands in Phase 2 (GitHub importer).",item:c};if("connection"===c.kind)return{status:"setup_required",reason:"Open the setup assistant to connect this service.",item:c};if("workflow"===c.kind)return function(a,b){let c=a?.workflow?.source_spec_json;if(!c||"object"!=typeof c)return{status:"error",reason:"Workflow template has no source spec",item:a};let d=c.slug||a.workflow.definition_slug;if(!d)return{status:"error",reason:"Workflow spec missing slug",item:a};let e=(0,g.getDb)(),f=(0,g.nowIso)();if(b){let b=(0,l.Ao)(d);if(b&&"archived"!==b.status)return{status:"already_present",reason:"A workflow with this slug already exists. It was not installed as this marketplace item, so uninstall will not archive it.",item:u(a.id)};try{(0,l.R1)(c,{source_spec_json:JSON.stringify(c),created_by_user_id:null}),function(a,b="personal"){for(let c of function(a){if(!a||!Array.isArray(a.stages))return[];let b=new Set;for(let c of a.stages){if(c?.kind!=="agent_run")continue;let a=c?.config?.agent_template_slug;"string"==typeof a&&a.trim()&&b.add(a.trim())}return[...b]}(a))(0,k.pz)(c,b)}(c,"personal")}catch(b){return{status:"error",reason:b?.code==="spec_invalid"?`Workflow spec invalid: ${(b.errors||[]).join("; ")}`:b?.message||"Workflow install failed",item:a}}return w(e,a.id,!0,f,{installed_by_marketplace_item_id:a.id,workflow_definition_slug:d,workflow_definition_id:`procdef:${d}`,installed_source:"marketplace"}),u(a.id)}let h=e.prepare("SELECT settings_json FROM marketplace_installations WHERE item_id=? AND installed=1").get(a.id),i=o(h?.settings_json,{})||{};if(i.installed_by_marketplace_item_id!==a.id||i.workflow_definition_slug!==d)return w(e,a.id,!1,f,i),u(a.id);let j=(0,l.wN)(d);return j.ok||"in_flight_cases"!==j.error?(w(e,a.id,!1,f),u(a.id)):{status:"in_flight_cases",in_flight_cases:j.in_flight_cases,reason:`Cannot uninstall — ${j.in_flight_cases} case(s) still running. Finish or cancel them first.`,item:u(a.id)}}(c,b);if("module"===c.kind)return b?(0,m.E)(c,u):(0,m.v)(c,u);"skill"===c.kind&&b&&function(a){try{let b=(0,g.getDb)().prepare("SELECT manifest_json FROM marketplace_items WHERE id=?").get(a.id),c=o(b?.manifest_json,{}),d="string"==typeof c.source_markdown?c.source_markdown:null;if(!d)return;let j=(Array.isArray(c.file_paths)&&c.file_paths.length?c.file_paths:[`skills/${a.slug}/SKILL.md`])[0],k=f.join(h.un,j);if(!(0,i.wn)(k))return;e.mkdirSync(f.dirname(k),{recursive:!0}),e.existsSync(k)||e.writeFileSync(k,d,"utf8")}catch{}}(c);let d=(0,g.getDb)(),n=(0,g.nowIso)();return d.prepare("SELECT item_id FROM marketplace_installations WHERE item_id=?").get(a)?d.prepare(`
-      UPDATE marketplace_installations
-         SET installed=?, installed_at=?
-       WHERE item_id=?
-    `).run(+!!b,b?n:null,a):d.prepare(`
-      INSERT INTO marketplace_installations (item_id, installed, installed_at)
-      VALUES (?, ?, ?)
-    `).run(a,+!!b,b?n:null),u(a)}function w(a,b,c,d,e=null){let f=a.prepare("SELECT item_id FROM marketplace_installations WHERE item_id=?").get(b),g=e?JSON.stringify(e):null;f?a.prepare(`
+  `).get(a);return b?q(b,{installed:b.installed,settings_json:b.settings_json}):null}function v(a,b,c,d,e=null){let f=a.prepare("SELECT item_id FROM marketplace_installations WHERE item_id=?").get(b),g=e?JSON.stringify(e):null;f?a.prepare(`
       UPDATE marketplace_installations
          SET installed=?, installed_at=?, settings_json=?
        WHERE item_id=?
     `).run(+!!c,c?d:null,g,b):a.prepare(`
       INSERT INTO marketplace_installations (item_id, installed, installed_at, settings_json)
       VALUES (?, ?, ?, ?)
-    `).run(b,+!!c,c?d:null,g)}function x(){let a=[];try{for(let b of t({kind:"module"}))if(b.installed)for(let c of b.module?.nav||[])c&&"string"==typeof c.href&&"string"==typeof c.label&&a.push({label:c.label,href:c.href,icon:"string"==typeof c.icon?c.icon:"Package",group:"string"==typeof c.group?c.group:"Modules"})}catch{}return a}function y(){let a=r().length,b=s(),c=b.filter(a=>"skill"===a.kind).length,d=b.filter(a=>"bundle"===a.kind).length,e=b.filter(a=>"agent"===a.kind).length,f=b.filter(a=>"connection"===a.kind).length,g=b.filter(a=>"workflow"===a.kind).length,h=b.filter(a=>"module"===a.kind).length;return{tool:a,skill:c,bundle:d,agent:e,connection:f,workflow:g,module:h,all:a+c+d+e+f+g+h}}function z(a){let b=t({kind:a}),c=new Set,d=[];for(let a of b)!a.category||c.has(a.category)||(c.add(a.category),d.push(a.category));return d}d()}catch(a){d(a)}})}};
+    `).run(b,+!!c,c?d:null,g)}function w(){let a=[];try{for(let b of t({kind:"module"}))if(b.installed)for(let c of b.module?.nav||[])c&&"string"==typeof c.href&&"string"==typeof c.label&&a.push({label:c.label,href:c.href,icon:"string"==typeof c.icon?c.icon:"Package",group:"string"==typeof c.group?c.group:"Modules"})}catch{}return a}function x(){let a=r().length,b=s(),c=b.filter(a=>"skill"===a.kind).length,d=b.filter(a=>"bundle"===a.kind).length,e=b.filter(a=>"agent"===a.kind).length,f=b.filter(a=>"connection"===a.kind).length,g=b.filter(a=>"workflow"===a.kind).length,h=b.filter(a=>"module"===a.kind).length;return{tool:a,skill:c,bundle:d,agent:e,connection:f,workflow:g,module:h,all:a+c+d+e+f+g+h}}function y(a){let b=t({kind:a}),c=new Set,d=[];for(let a of b)!a.category||c.has(a.category)||(c.add(a.category),d.push(a.category));return d}d()}catch(a){d(a)}})}};

package/.next/standalone/.next/server/chunks/396.js

@@ -0,0 +1 @@
+"use strict";exports.id=396,exports.ids=[396],exports.modules={90396:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{getPublicBaseUrl:()=>h,wz:()=>i,x6:()=>j});var e=c(67179),f=a([e]);e=(f.then?(await f)():f)[0];let k="public_base_url",l=["MADARX_PUBLIC_URL","MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function g(a){if(!a||!String(a).trim())return"";let b=String(a).trim().replace(/\/+$/,"");return/^https?:\/\//i.test(b)?b:""}function h(){try{let a=g((0,e.getConfig)(k,null));if(a)return a}catch{}for(let a of l){let b=g(process.env[a]);if(b)return b}return""}function i(a){let b=null==a?"":String(a).trim();if(""===b)return(0,e.setConfig)(k,""),"";if(!function(a){let b=g(a);if(!b)return!1;try{return new URL(b),!0}catch{return!1}}(b))throw Error("public app URL must be a valid http(s) URL, e.g. https://madarx.io");let c=g(b);return(0,e.setConfig)(k,c),c}function j(a){let b=String(a||""),c=b.startsWith("/")?b:`/${b}`,d=h();return d?`${d}${c}`:c}d()}catch(a){d(a)}})}};

package/.next/standalone/.next/server/chunks/511.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=511,exports.ids=[511,4143],exports.modules={511:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Oj:()=>W,Y:()=>G,o8:()=>N});var e=c(73024),f=c(76760),g=c(60105),h=c(14743),i=c(19151),j=c(2167),k=c(78224),l=c(89847),m=c(1623),n=c(8727),o=c(91648),p=c(26531),q=c(40718),r=c(23230),s=c(83963),t=c(63332),u=c(64143),v=c(61423),w=c(81833),x=a([g,h,i,j,k,m,n,o,q,r,s,t,v,w]);[g,h,i,j,k,m,n,o,q,r,s,t,v,w]=x.then?(await x)():x;let T=`You are a senior UI/UX engineer producing a production-grade HTML file.
+"use strict";exports.id=511,exports.ids=[511,4143],exports.modules={511:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Oj:()=>$,Y:()=>J,o8:()=>R});var e=c(73024),f=c(76760),g=c(60105),h=c(14743),i=c(19151),j=c(2167),k=c(78224),l=c(89847),m=c(1623),n=c(8727),o=c(91648),p=c(26531),q=c(40718),r=c(23230),s=c(41647),t=c(5295),u=c(83963),v=c(63332),w=c(64143),x=c(61423),y=c(81833),z=a([g,h,i,j,k,m,n,o,q,r,s,u,v,x,y]);[g,h,i,j,k,m,n,o,q,r,s,u,v,x,y]=z.then?(await z)():z;let X=`You are a senior UI/UX engineer producing a production-grade HTML file.
 
 ABSOLUTE BANS — zero tolerance:
 - ZERO EMOJIS — anywhere, ever. No emoji icons, no decorative emoji, no bullet emoji, no status emoji, no Unicode symbols used as graphics. This rule has no exceptions regardless of style or context.
@@ -61,13 +61,13 @@ TECHNICAL:
 - Fully responsive (mobile / tablet / desktop)
 - Semantic HTML5
 
-OUTPUT: HTML only. No markdown fences. No explanation. Start with <!DOCTYPE html>.`,U={balanced:"",minimal:"\nSTYLE — MINIMAL: Extreme restraint. Near-monochrome palette (black, white, one subtle accent). Maximum whitespace. Typography-first layout. No decorative elements. Every pixel earns its place.",bold:"\nSTYLE — BOLD: High contrast. Large commanding typography. Strong visual weight. Dark backgrounds or very high-contrast light. Dramatic hierarchy. Assertive, confident presence.",soft:"\nSTYLE — SOFT: Warm gentle palette. Rounded corners everywhere (16-24px). Subtle soft shadows. Light, airy feel. Pastel or muted accent colors. Comfortable, inviting reading experience."};async function y({description:a,project_id:b=null}){let c=(0,m.wA)(),d=(0,o.$F)(),e=`${T}${U[c]??""}
+OUTPUT: HTML only. No markdown fences. No explanation. Start with <!DOCTYPE html>.`,Y={balanced:"",minimal:"\nSTYLE — MINIMAL: Extreme restraint. Near-monochrome palette (black, white, one subtle accent). Maximum whitespace. Typography-first layout. No decorative elements. Every pixel earns its place.",bold:"\nSTYLE — BOLD: High contrast. Large commanding typography. Strong visual weight. Dark backgrounds or very high-contrast light. Dramatic hierarchy. Assertive, confident presence.",soft:"\nSTYLE — SOFT: Warm gentle palette. Rounded corners everywhere (16-24px). Subtle soft shadows. Light, airy feel. Pastel or muted accent colors. Comfortable, inviting reading experience."};async function A({description:a,project_id:b=null}){let c=(0,m.wA)(),d=(0,o.$F)(),e=`${X}${Y[c]??""}
 
-${(0,o.nX)(d)}`,f=await (0,i.chatWithClaude)([{role:"user",content:`Build this UI: ${a}`}],e),h=(0,n.vr)(f.content[0]?.text?.trim()??""),j=a.slice(0,80);return{...(0,g.Dg)({title:j,kind:"html",content:h,project_id:b}),style:c}}async function z({prompt:a,title:b,session_id:c,model:d,timeout_ms:e,project_id:f=null}){let h=(0,l.ZQ)(a),i=await (0,j.Nw)({prompt:h,session_id:c,model:d,timeout_ms:e}),k=b||`Hermes result: ${a.slice(0,60)}`,m=(0,l.un)(i.response,{title:k}),n=m.violations?.length?`
+${(0,o.nX)(d)}`,f=await (0,i.chatWithClaude)([{role:"user",content:`Build this UI: ${a}`}],e),h=(0,n.vr)(f.content[0]?.text?.trim()??""),j=a.slice(0,80);return{...(0,g.Dg)({title:j,kind:"html",content:h,project_id:b}),style:c}}async function B({prompt:a,title:b,session_id:c,model:d,timeout_ms:e,project_id:f=null}){let h=(0,l.ZQ)(a),i=await (0,j.Nw)({prompt:h,session_id:c,model:d,timeout_ms:e}),k=b||`Hermes result: ${a.slice(0,60)}`,m=(0,l.un)(i.response,{title:k}),n=m.violations?.length?`
 
 ---
 
-*Format enforcement — source: ${m.source}; violations: ${m.violations.join(", ")}*`:"",o=`${m.content||"(no response)"}${n}`;return{...(0,g.Dg)({title:k,kind:"markdown",content:o,project_id:f}),hermes_session_id:i.session_id,hermes_model:i.model,format_source:m.source,format_ok:m.ok,format_violations:m.violations,mocked:!0===i.mocked}}async function A({prompt:a,title:b,session_id:c,model:d,timeout_ms:e,cwd:f,project_id:g=null}){let h=(0,k.o0)({prompt:a,title:b,session_id:c,model:d,timeout_ms:e,cwd:f,project_id:g});return"1"!==process.env.HERMES_JOB_DISABLE_SPAWN&&(0,k._3)(h.id),{job_id:h.id,artifact_id:h.artifact_id,run_id:h.run_id,file_path:h.file_path,status:h.status,title:h.title}}async function B(a={}){let b,c=null;if(a.file_path){let{path:d}=(0,p.hC)(a.file_path),g=e.statSync(d);if(!g.isFile())throw Error("Brand guidelines path is not a file");if(g.size>2e6)throw Error(`Brand guidelines file is too large: ${g.size} bytes`);let h=f.extname(d).toLowerCase();if(![".html",".htm",".md",".txt",".css",".svg",".pdf"].includes(h))throw Error("Supported guidelines formats: .html, .md, .txt, .css, .svg, .pdf");b=(0,o.hO)(d),c=d}else if(a.content)b=(0,o.RN)(a.content,a.filename||"inline-brand-guidelines.md"),c=a.filename||"inline content";else throw Error("Provide either file_path or content");if(a.logo_path){let{path:c}=(0,p.hC)(a.logo_path),d=e.statSync(c);if(!d.isFile())throw Error("Logo path is not a file");if(d.size>1e6)throw Error(`Logo file is too large: ${d.size} bytes`);let g=f.extname(c).toLowerCase();if(![".svg",".png",".jpg",".jpeg",".webp"].includes(g))throw Error("Supported logo formats: .svg, .png, .jpg, .jpeg, .webp");b=(0,o.xo)(c)}return{ok:!0,imported_from:c,brand:{active:b.active,company_name:b.company_name,colors:b.colors,fonts:b.fonts,voice:b.voice,document_types:b.document_types,presentation_style:b.presentation_style,guidelines_path:b.guidelines_path,logo_path:b.logo_path}}}function C(a){return(a?.content||[]).filter(a=>a?.type==="text"||"string"==typeof a?.text).map(a=>a.text||"").join("\n").trim()}async function D({name:a,mission:b,tools:c}){try{let d=await (0,i.chatWithClaude)([{role:"user",content:`Write the skills.md file for a new local sub-agent.
+*Format enforcement — source: ${m.source}; violations: ${m.violations.join(", ")}*`:"",o=`${m.content||"(no response)"}${n}`;return{...(0,g.Dg)({title:k,kind:"markdown",content:o,project_id:f}),hermes_session_id:i.session_id,hermes_model:i.model,format_source:m.source,format_ok:m.ok,format_violations:m.violations,mocked:!0===i.mocked}}async function C({prompt:a,title:b,session_id:c,model:d,timeout_ms:e,cwd:f,project_id:g=null}){let h=(0,k.o0)({prompt:a,title:b,session_id:c,model:d,timeout_ms:e,cwd:f,project_id:g});return"1"!==process.env.HERMES_JOB_DISABLE_SPAWN&&(0,k._3)(h.id),{job_id:h.id,artifact_id:h.artifact_id,run_id:h.run_id,file_path:h.file_path,status:h.status,title:h.title}}async function D(a={}){let b,c=null;if(a.file_path){let{path:d}=(0,p.hC)(a.file_path),g=e.statSync(d);if(!g.isFile())throw Error("Brand guidelines path is not a file");if(g.size>2e6)throw Error(`Brand guidelines file is too large: ${g.size} bytes`);let h=f.extname(d).toLowerCase();if(![".html",".htm",".md",".txt",".css",".svg",".pdf"].includes(h))throw Error("Supported guidelines formats: .html, .md, .txt, .css, .svg, .pdf");b=(0,o.hO)(d),c=d}else if(a.content)b=(0,o.RN)(a.content,a.filename||"inline-brand-guidelines.md"),c=a.filename||"inline content";else throw Error("Provide either file_path or content");if(a.logo_path){let{path:c}=(0,p.hC)(a.logo_path),d=e.statSync(c);if(!d.isFile())throw Error("Logo path is not a file");if(d.size>1e6)throw Error(`Logo file is too large: ${d.size} bytes`);let g=f.extname(c).toLowerCase();if(![".svg",".png",".jpg",".jpeg",".webp"].includes(g))throw Error("Supported logo formats: .svg, .png, .jpg, .jpeg, .webp");b=(0,o.xo)(c)}return{ok:!0,imported_from:c,brand:{active:b.active,company_name:b.company_name,colors:b.colors,fonts:b.fonts,voice:b.voice,document_types:b.document_types,presentation_style:b.presentation_style,guidelines_path:b.guidelines_path,logo_path:b.logo_path}}}function E(a){return(a?.content||[]).filter(a=>a?.type==="text"||"string"==typeof a?.text).map(a=>a.text||"").join("\n").trim()}async function F({name:a,mission:b,tools:c}){try{let d=await (0,i.chatWithClaude)([{role:"user",content:`Write the skills.md file for a new local sub-agent.
 
 <agent_name>${a}</agent_name>
 <agent_mission>${b}</agent_mission>
@@ -79,13 +79,13 @@ Return a markdown document with:
 - A "## Core playbooks" section with 4 to 6 bullets, each a concrete, mission-specific play this agent will run (not generic boilerplate). Bullets must reflect the mission and use the listed tools where relevant.
 - A "## Operating limits" section with 2-3 bullets covering approval, workspace boundaries, and heartbeat updates.
 
-Hard rules: zero emojis, no decorative symbols, no horizontal rules, plain markdown only, no extra commentary outside the file content.`}],"You write concise, mission-specific playbooks for local-first AI agents. Output the markdown file content only, no preamble."),e=C(d);if(!e)return null;return e}catch{return null}}async function E(a){let b=Array.isArray(a.tools)?a.tools:String(a.tools||"").split(",").map(a=>a.trim()).filter(Boolean),c=a.name||"madarX Custom Agent",d=a.mission||"Support the user with scheduled local work.",e=null;try{let a=await (0,i.chatWithClaude)([{role:"user",content:`Create a focused system prompt for this scheduled local agent.
+Hard rules: zero emojis, no decorative symbols, no horizontal rules, plain markdown only, no extra commentary outside the file content.`}],"You write concise, mission-specific playbooks for local-first AI agents. Output the markdown file content only, no preamble."),e=E(d);if(!e)return null;return e}catch{return null}}async function G(a){let b=Array.isArray(a.tools)?a.tools:String(a.tools||"").split(",").map(a=>a.trim()).filter(Boolean),c=a.name||"madarX Custom Agent",d=a.mission||"Support the user with scheduled local work.",e=null;try{let a=await (0,i.chatWithClaude)([{role:"user",content:`Create a focused system prompt for this scheduled local agent.
 
 <agent_name>${c}</agent_name>
 <agent_mission>${d}</agent_mission>
 <allowed_tools>${b.join(", ")}</allowed_tools>
 
-Return only the system prompt text. It must preserve human approval before external sends/posts/deployments and keep work inside the local workspace.`}],"You write concise, operational system prompts for local-first AI agents. Return plain text only.");e=C(a)}catch{e=null}let f=await D({name:c,mission:d,tools:b}),h=(0,n.vr)(f||function({name:a,mission:b,tools:c}){let d=c.length?c.join(", "):"web search, browser, files";return`# ${a} Skills
+Return only the system prompt text. It must preserve human approval before external sends/posts/deployments and keep work inside the local workspace.`}],"You write concise, operational system prompts for local-first AI agents. Return plain text only.");e=E(a)}catch{e=null}let f=await F({name:c,mission:d,tools:b}),h=(0,n.vr)(f||function({name:a,mission:b,tools:c}){let d=c.length?c.join(", "):"web search, browser, files";return`# ${a} Skills
 
 ## Mission
 ${b}
@@ -96,7 +96,7 @@ ${b}
 - Save every output as a local artifact under your project's artifacts folder (workspace/projects/<slug>/artifacts/).
 - Hand off any external send, post, deployment, or destructive command to the main agent for approval before acting.
 - After each run, update heartbeat.json with status, summary, and next-run plan.
-`}({name:c,mission:d,tools:b})),j={...a,name:c,mission:d,tools:b,skills_markdown:h};return e&&(j.system_prompt=e),void 0!==a.whatsapp_notify_chat_id&&(j.whatsapp_notify_chat_id=a.whatsapp_notify_chat_id||null),(0,g.Sn)(j)}let V="tool-smith-agent";function F(a){return String(a||"").toLowerCase().replace(/[._-]+/g," ").split(/[^a-z0-9]+/).filter(a=>a.length>=3)}let W=[{name:"create_agent",description:"Create a new named sub-agent in the local workspace with files and optional schedule. Pick the engine based on what the agent actually does (see engine field).",input_schema:{type:"object",properties:{name:{type:"string",description:"Human-readable agent name."},mission:{type:"string",description:"What this agent does (its standing job — used as the default instruction every run)."},expected_output:{type:"string",description:"OPTIONAL standing deliverable contract: what a GOOD result looks like every run — format, required sections, acceptance criteria, definition of done. Set this whenever the agent has a repeatable output shape so runs are consistent and verifiable. A per-call run_agent override or a delegated task's acceptance_criteria takes precedence over this for a specific run."},schedule:{type:"string",description:'Cron-like schedule: "daily HH:MM", "every 5m", or "on demand".'},tools:{type:"array",items:{type:"string"},description:'madarX tool identifiers the agent is allowed to use (e.g. "web_search", "web_fetch", "file_read", "create_artifact"). Lowercase snake_case, NOT Claude Code tool names.'},type:{type:"string",description:'Agent type label, e.g. "custom" or "intelligence".'},engine:{type:"string",enum:["anthropic","claude-code","ollama","codex","hermes"],description:'DEFAULT is "claude-code" — uses the local Claude Code CLI with permissions from .claude/settings.json (Read/Glob/Grep/WebSearch/WebFetch auto-allowed; edits scoped to workspace/). Use this for almost everything. "anthropic" only when the agent needs the madarx tool marketplace specifically (create_artifact, generate_ui, whatsapp_send, competitor_report, marketing_plan — these do not exist under claude-code). "ollama" for cheap local-LLM work. "codex" for OpenAI Codex CLI. "hermes" rare. If the user does not specify, leave engine unset and the default applies.'},whatsapp_notify_chat_id:{type:"string",description:'OPTIONAL WhatsApp chat id (e.g. 9715XXXXXXXX@s.whatsapp.net, or plain digits). When set, every scheduled run that produces a report artifact will auto-deliver the rendered HTML file to this chat. The bridge must be paired; if not, delivery is skipped silently. Set this only when the owner explicitly says "send to whatsapp" or "deliver to me on whatsapp".'}},required:["name","mission"]}},{name:"set_agent_whatsapp_notify",description:'Enable, change, or disable WhatsApp delivery of scheduled-run artifacts for an existing agent. Pass an empty string or null in chat_id to disable. Use this when the owner says "send X to me on whatsapp", "stop whatsapping me X", or wants to switch the notify chat. The bridge must be paired for delivery to actually happen; the setting is stored either way.',input_schema:{type:"object",properties:{agent_id:{type:"string",description:"Slug id of the agent. Use get_state to look it up if unsure."},agent_name:{type:"string",description:"Fuzzy human-readable name (used only when agent_id is missing)."},chat_id:{type:"string",description:"WhatsApp chat id to receive scheduled HTML artifacts. Pass empty string to disable."}},required:["chat_id"]}},{name:"upsert_schedule",description:"Create or update a recurring schedule for an existing agent.",input_schema:{type:"object",properties:{agent_id:{type:"string",description:"Slug ID of the agent."},schedule:{type:"string",description:'Schedule spec: "daily HH:MM", "every 5m", etc.'},action_kind:{type:"string",description:'What the schedule runs: "agent-tick", "competitor-report", "marketing-plan", or "heartbeat".'},enabled:{type:"boolean",description:"Whether the schedule is active (default true)."}},required:["agent_id","schedule"]}},{name:"competitor_report",description:"Generate a daily competitor intelligence report and save it as a local artifact.",input_schema:{type:"object",properties:{triggered_by:{type:"string",description:"Source label for the audit log."}}}},{name:"marketing_plan",description:"Generate a 7-day marketing content plan and save it as a local artifact.",input_schema:{type:"object",properties:{triggered_by:{type:"string",description:"Source label for the audit log."}}}},{name:"heartbeat_tick",description:"Update the heartbeat timestamp for all generated agents.",input_schema:{type:"object",properties:{triggered_by:{type:"string",description:"Source label for the audit log."}}}},{name:"claude_dry_run",description:"Prepare a Claude Code command string for human review. Never executes automatically — requires owner approval.",input_schema:{type:"object",properties:{prompt:{type:"string",description:"The task description to pass to the Claude Code runner."}},required:["prompt"]}},{name:"get_state",description:"Retrieve a LIGHTWEIGHT snapshot of runtime state: agents, runs, schedules, connectors, and artifact metadata only. Artifact bodies are stripped to a short snippet — use find_artifacts to search and show_artifact to load full content for a specific id. Use this as a directory; never expect full document bodies here.",input_schema:{type:"object",properties:{}}},{name:"create_artifact",description:'Save a written-content artifact (report, list, plan, brief, summary, doc). Provide the body as well-structured markdown and madarX will render it into a styled HTML document automatically, with a one-click "Download .md" for the source. Do NOT include the user prompt, instructions, or meta commentary inside the body — only the result content. Do NOT use for full UI/landing pages — use generate_ui instead.',input_schema:{type:"object",properties:{title:{type:"string",description:"Short, human-readable artifact title shown in the document header."},kind:{type:"string",enum:["markdown","text"],description:'Always "markdown" unless the content is truly plain text with no structure.'},content:{type:"string",description:"The full body as GitHub-flavored markdown. Use headings (##), lists, tables, and bold sparingly. No emojis. Result content only — never echo the prompt."},project_id:{type:"string",description:"Optional destination project id or slug. Omit to use the active/default project."},space_id:{type:"string",description:"Optional dashboard space id where the artifact should appear. Omit to use the calling agent default or the main space."},dedupe_key:{type:"string",description:"Optional idempotency key. Pass empty string only when intentionally creating multiple artifacts with the same title in one day."}},required:["title","kind","content"]}},{name:"update_artifact",description:"Update an existing artifact with revised or extended content. Use this instead of create_artifact when continuing, refining, or expanding a previous result for the same task. Keeps the same artifact visible and editable rather than spawning a new one.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"ID of the artifact to update."},title:{type:"string",description:"New title — omit to keep the existing title."},content:{type:"string",description:"Full updated body as GitHub-flavored markdown. Must be the complete content, not a diff."}},required:["artifact_id","content"]}},{name:"delete_artifact",description:"Permanently delete a saved artifact from the dashboard. Use only when the owner explicitly asks to remove or trash an artifact, or when the previous artifact is being replaced by a brand-new one and the prior result must not linger. This is irreversible from the agent side; the artifact file on disk is unlinked as well.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"ID of the artifact to delete."}},required:["artifact_id"]}},{name:"move_artifact",description:'Move an existing artifact from one project to another. Updates the artifact\'s project_id, relocates the file on disk into the target project\'s artifacts directory, and writes changelog entries on both source and target projects. Use this when the owner asks to "move", "reassign", "relocate", or "transfer" an artifact between projects/spaces. The artifact id and title stay the same; only the project membership and disk location change.',input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"ID of the artifact to move."},target_project_id:{type:"string",description:'Destination project id or slug (e.g. "planify" or "personal"). Use list_projects to discover valid values.'}},required:["artifact_id","target_project_id"]}},{name:"read_artifact",description:"Load the full content for a specific artifact after finding it. Use this before editing, summarizing, or continuing an existing document. Returns rendered content and markdown source when available.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"Exact artifact id to read."},title_query:{type:"string",description:"Optional fuzzy title query when artifact_id is not known. Must resolve to one artifact."},max_chars:{type:"number",description:"Maximum content characters to return, default 12000."}}}},{name:"list_spaces",description:"List dashboard spaces/tabs. Use include_artifact_ids when the owner asks which artifacts are displayed in each space.",input_schema:{type:"object",properties:{include_artifact_ids:{type:"boolean",description:"When true, include artifact_ids grouped under each space."}}}},{name:"create_space",description:"Create a new dashboard space/tab where artifacts can be displayed.",input_schema:{type:"object",properties:{name:{type:"string",description:"Short dashboard space name."}},required:["name"]}},{name:"rename_space",description:"Rename an existing dashboard space/tab.",input_schema:{type:"object",properties:{space_id:{type:"string",description:"Space id to rename."},name:{type:"string",description:"New short space name."}},required:["space_id","name"]}},{name:"set_active_space",description:"Make a dashboard space/tab the active space.",input_schema:{type:"object",properties:{space_id:{type:"string",description:"Space id to activate."}},required:["space_id"]}},{name:"delete_space",description:"Delete a dashboard space/tab. Artifacts are not deleted; they are moved to a fallback space. Do not use to delete artifacts.",input_schema:{type:"object",properties:{space_id:{type:"string",description:"Space id to delete."}},required:["space_id"]}},{name:"move_artifact_to_space",description:"Display an existing artifact in a different dashboard space/tab, or remove it from a custom space by moving it back to the default main space. The artifact id, project, file, and content stay unchanged.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"Artifact id to move between dashboard spaces."},space_id:{type:"string",description:'Destination dashboard space id. Use "default" to remove from a custom space back to main.'}},required:["artifact_id","space_id"]}},{name:"import_brand_guidelines",description:"Import a local brand guidelines file or pasted guidelines content, extract brand colors/fonts/voice/document defaults, and set it as the default brand system for future documents, presentations, and generated UI artifacts. Use this when the owner provides a brand guidelines HTML/Markdown/text file path, pastes guidelines content, or asks to update branding.",input_schema:{type:"object",properties:{file_path:{type:"string",description:"Path to a local .html, .md, .txt, .css, .svg, or .pdf brand guidelines file under an allowed root."},content:{type:"string",description:"Pasted brand guidelines content when no local file path is available."},filename:{type:"string",description:"Optional filename for pasted content, e.g. brand-guidelines.md."},logo_path:{type:"string",description:"Optional local path to the primary brand logo file (.svg, .png, .jpg, .jpeg, .webp)."}}}},{name:"generate_ui",description:"Build a production-quality HTML/CSS UI — landing page, dashboard, component, presentation, or any visual interface. Automatically applies professional design rules (typography scale, intentional color, no generic AI patterns). Use this for ALL HTML/UI creation requests.",input_schema:{type:"object",properties:{description:{type:"string",description:"What to build — be specific: layout, sections, content, purpose, and any brand or color hints."}},required:["description"]}},{name:"send_to_hermes",description:"Send a command or task to the local Hermes agent and save the final Hermes response as a dashboard artifact. Use this when the user asks Hermes to do work, wants a Hermes result, or asks to route a command through Hermes.",input_schema:{type:"object",properties:{prompt:{type:"string",description:"The exact task or command Hermes should run."},title:{type:"string",description:"Optional artifact title for the Hermes result."},session_id:{type:"string",description:"Optional stable Hermes session id. Usually omit."},model:{type:"string",description:"Optional Hermes model override. Usually omit so Hermes uses its configured model."},timeout_ms:{type:"number",description:"Optional timeout in milliseconds. Use 600000 or higher for project run/build tasks."}},required:["prompt"]}},{name:"start_hermes_job",description:"Start a long-running local Hermes job in the background and immediately create a live-updating dashboard artifact. Use for running projects, builds, tests, installs, dev servers, or multi-step Hermes work that may take more than a minute.",input_schema:{type:"object",properties:{prompt:{type:"string",description:"The full task Hermes should perform."},title:{type:"string",description:"Artifact/job title."},session_id:{type:"string",description:"Optional Hermes session id."},model:{type:"string",description:"Optional Hermes model override."},timeout_ms:{type:"number",description:"Optional job timeout in milliseconds. Use 1800000 for long project tasks."},cwd:{type:"string",description:"Optional absolute working directory for the project Hermes should run."}},required:["prompt"]}},{name:"run_agent",description:'Run an existing sub-agent NOW (on demand, outside its normal schedule). Use this when the owner says "run X", "trigger X", "do today\'s run of X", etc. The run executes synchronously and publishes live tool-call events to the dashboard. Returns the run summary and a short result preview.',input_schema:{type:"object",properties:{agent_id:{type:"string",description:'Slug id (e.g. "uae-ai-initiatives-tracker"). Prefer this if known. Use list_agents / get_state first to look it up.'},agent_name:{type:"string",description:'Fuzzy human-readable name (e.g. "UAE tracker"). Used only if agent_id is not provided. Case-insensitive substring match against agent names; ambiguous matches error.'},wake_reason:{type:"string",description:'Short label for the audit log, e.g. "owner requested via whatsapp".'},instruction:{type:"string",description:"OPTIONAL task-specific instruction for THIS run only — what to do right now. Overrides the agent's standing mission for this single run; never saved onto the agent. Use it to dispatch an existing agent at an ad-hoc job (e.g. \"compare this week's numbers to last week and flag anomalies\"). Omit to run the agent's standing mission. The agent can still only use the tools it was granted — this does not expand its permissions."},expected_output:{type:"string",description:"OPTIONAL deliverable contract for THIS run only — what a complete, correct result must contain (format, sections, acceptance criteria). Overrides the agent's standing expected_output for this run. Use it to pin down what 'done' looks like for an ad-hoc instruction."}}}},{name:"mines_run_report",description:'Generate ONE mines diligence report for a project as a single action (the workflow authors the number-free narrative and the report tool renders every figure from cited database rows). Use report_kind "pfs_readiness_report" when the owner asks to "assess PFS readiness". The report\'s LLM authoring runs on the configured engine (Claude Code CLI for the personal tier, Anthropic API for production) — it works even when no Anthropic API key is set. Returns the artifact id.',input_schema:{type:"object",properties:{project_id:{type:"string",description:"mines_projects.id. Use list/get_state or find the project first if unknown."},report_kind:{type:"string",description:"One of: pfs_readiness_report, due_diligence_memo, investor_presentation, data_quality_report, interpretation_memo."},engine:{type:"string",description:'OPTIONAL engine override: "claude-code" (personal CLI subscription) or "anthropic" (production API). Defaults to the mines agents\' configured engine. This is a cost/scale tier, not a capability change.'}},required:["project_id","report_kind"]}},{name:"find_artifacts",description:'Search past artifacts (reports, briefs, generated UIs) by title, agent, or kind. Use when the owner asks for "the latest X report", "send me yesterday\'s brief", or "what did <agent> produce". Returns up to 50 rows, most recent first, with id/title/kind/agent_name/created_at — NOT the full content. To deliver one, follow up with send_artifact_to_whatsapp. SEARCH BROADLY: title_query does word-level matching (every word must appear, any order), but if the first query returns 0 rows, RETRY with a shorter / broader query — try just the noun ("brief", "report") before concluding nothing exists. Real titles often include words the owner did not say (e.g. "AI Daily Brief scheduled report" vs the owner saying "AI brief").',input_schema:{type:"object",properties:{title_query:{type:"string",description:'Fuzzy substring of the artifact title (case-insensitive). E.g. "conflict" matches "Conflict brief 2026-05-13".'},agent_id:{type:"string",description:"Filter to one specific agent id."},agent_name:{type:"string",description:'Fuzzy substring of the agent name (case-insensitive). E.g. "conflict" matches "Conflict Brief Agent".'},kind:{type:"string",description:'Filter by kind: "html", "document" (rendered markdown), or other.'},project_id:{type:"string",description:"Filter to one project id or slug."},space_id:{type:"string",description:'Filter to one dashboard space id, e.g. "default".'},limit:{type:"number",description:"Max rows to return (default 10, max 50)."}}}},{name:"send_artifact_to_whatsapp",description:'Deliver an existing artifact as an .html file to a WhatsApp chat. Use after find_artifacts (or get_state) to send a past report on demand — e.g. "send me the latest conflict brief on whatsapp". Pass either artifact_id (preferred) or title_query (fuzzy match — must resolve to one row). If chat_id is omitted on the WhatsApp channel, defaults to the chat the owner is messaging from. The WhatsApp bridge must be paired.',input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"Exact artifact id (preferred). Get this from find_artifacts."},title_query:{type:"string",description:"Fuzzy substring of the title. Used only when artifact_id is omitted; ambiguous matches error."},chat_id:{type:"string",description:"WhatsApp chat id to deliver to. Omit on inbound WhatsApp to send back to the same chat."}}}},{name:"whatsapp_send",description:'Send a WhatsApp message to a chat the owner has added to the allowlist. Use sparingly for proactive owner alerts and follow-ups (e.g., "scheduled report is ready"). The bridge must be paired and online; if not, this returns an error.',input_schema:{type:"object",properties:{chat_id:{type:"string",description:"Allowlisted WhatsApp chat id (full JID like 9715XXXXXXXX@s.whatsapp.net, or plain digits which are normalized)."},text:{type:"string",description:"Plain text message body. WhatsApp does not render markdown — keep it conversational."}},required:["chat_id","text"]}},{name:"list_available_tools",description:'List all marketplace tools with their enabled status, availability, risk level, and missing credentials. Use this before saying "I cannot do X" to check whether a tool exists. Filter by category (travel, web, github, email, supabase, vercel, local_machine, browser, voice, calendar) or by enabled_only to see what is currently active.',input_schema:{type:"object",properties:{category:{type:"string",description:"Optional category filter: travel, web, github, email, supabase, vercel, local_machine, browser, voice, calendar."},enabled_only:{type:"boolean",description:"When true, return only currently-enabled tools."}}}},{name:"install_tool",description:"Enable a marketplace tool by name so it becomes available for immediate use. Call this after list_available_tools identifies a disabled tool that can satisfy the principal's request. If the tool has missing credentials, the response includes a missing_credentials list — surface this to the principal. Tools rated irreversible_external will still require per-call owner approval when invoked.",input_schema:{type:"object",properties:{tool_name:{type:"string",description:'Exact tool name from list_available_tools, e.g. "flight_search" or "hotel_rates".'}},required:["tool_name"]}},{name:"uninstall_tool",description:"Disable a marketplace tool by name. Use when the principal asks to turn off a tool or when a tool is causing issues.",input_schema:{type:"object",properties:{tool_name:{type:"string",description:'Exact tool name to disable, e.g. "email_send".'}},required:["tool_name"]}},{name:"request_capability",description:'Delegate to Tool Smith to BUILD a capability that does not exist yet. Use when an agent needs a tool/skill/integration the system lacks (e.g. "log meetings to Notion" with no Notion tool). First dedupes against existing capabilities; if none matches, files a build task for the tool-smith-agent which authors a composite tool, a REST connector, a skill, or proposes code. Returns the task id. The authored capability is still subject to all runtime gates when used.',input_schema:{type:"object",properties:{capability_description:{type:"string",description:'Plain-language description of the capability needed, e.g. "create pages in Notion" or "summarize a daily competitor digest".'},target_agent_id:{type:"string",description:"Optional id of the agent that should be granted the capability once built."},acceptance_criteria:{type:"string",description:"Optional explicit acceptance criteria for the build."}},required:["capability_description"]}}],X=new Set(["send_to_hermes","start_hermes_job"]);function G(){let a=(0,j.oG)()?W:W.filter(a=>!X.has(a.name));return(0,q.Cz)(a)}function H(a,b=180){let c="string"==typeof a?a:null==a?"":String(a);return c.length<=b?c:c.slice(0,b)+`…[+${c.length-b} bytes, use show_artifact/find_artifacts]`}function I(a){if(!a)return a;let b="string"==typeof a.content?a.content:"";return{id:a.id,title:a.title,kind:a.kind,project_id:a.project_id??null,created_at:a.created_at,updated_at:a.updated_at,content_bytes:b.length,content_preview:b?H(b):""}}function J(a){if(!a)return a;let b=Array.isArray(a.memory)?a.memory.slice(-2):[];return{id:a.id,name:a.name,engine:a.engine,status:a.status,project_id:a.project_id??null,schedule:a.schedule,last_run_at:a.last_run_at??null,tools_count:Array.isArray(a.tools)?a.tools.length:0,memory_count:Array.isArray(a.memory)?a.memory.length:0,memory_recent:b.map(a=>"string"==typeof a?H(a,200):a)}}function K(a){return a?{id:a.id,agent_id:a.agent_id??null,project_id:a.project_id??null,status:a.status,started_at:a.started_at,finished_at:a.finished_at??null,summary:H(a.summary??a.note??"",160)}:a}function L(a){return a?{id:a.id,action_type:a.action_type,status:a.status,requested_at:a.requested_at,agent_id:a.agent_id??null,summary:H(a.summary??a.note??"",160)}:a}function M(a){return a?{id:a.id,schedule_id:a.schedule_id??null,agent_id:a.agent_id??null,status:a.status,scheduled_for:a.scheduled_for??null,attempts:a.attempts??0}:a}async function N(a,b={},c={}){let d;var e=await O(a,b,c);try{d=JSON.stringify(e)}catch{return e}return!d||d.length<=6e4?e:{ok:!1,truncated:!0,original_bytes:d.length,max_bytes:6e4,preview:d.slice(0,59744),error:`tool_result exceeded 60000 bytes (got ${d.length}); narrow the query or use show_artifact for a specific id.`}}async function O(a,b={},c={}){switch(a){case"create_agent":return E(b);case"upsert_schedule":return(0,g.Nv)(b);case"competitor_report":return(0,g.NK)({triggered_by:b.triggered_by??"claude"});case"marketing_plan":return(0,g.mk)({triggered_by:b.triggered_by??"claude"});case"heartbeat_tick":return(0,g.IG)({triggered_by:b.triggered_by??"claude"});case"claude_dry_run":return(0,g.nF)({prompt:b.prompt},{triggered_by:"claude"});case"get_state":{let a=b.project_id??null;var d,e,f=(0,g.Gu)({project_id:a?String(a):null});if(!f||"object"!=typeof f)return f;return{ok:f.ok,product:f.product,workspace:f.workspace,project_filter:f.project_filter,projects:f.projects,agents:Array.isArray(f.agents)?f.agents.map(J):f.agents,tasks:f.tasks,runs:Array.isArray(f.runs)?f.runs.slice(0,8).map(K):f.runs,audit:(d=f.audit,(Array.isArray(d)?d.slice(0,6):[]).map(a=>({id:a.id,type:a.type,at:a.at,actor:a.user_id||a.acting_on_behalf_of_user_id||null,target:a.action_target_id??null,note:H(a.note??a.detail??"",160)}))),activity:(e=f.activity,(Array.isArray(e)?e.slice(0,10):[]).map(a=>({id:a.id,type:a.type,at:a.at,agent_id:a.agent_id??null,project_id:a.project_id??null,summary:H(a.summary??a.detail??"",160)}))),schedules:f.schedules,connectors:f.connectors,artifacts:Array.isArray(f.artifacts)?f.artifacts.map(I):f.artifacts,heartbeat_tasks:Array.isArray(f.heartbeat_tasks)?f.heartbeat_tasks.slice(0,5).map(M):f.heartbeat_tasks,heartbeat_task_events_count:Array.isArray(f.heartbeat_task_events)?f.heartbeat_task_events.length:0,approvals:Array.isArray(f.approvals)?f.approvals.slice(0,6).map(L):f.approvals,pending_approvals:Array.isArray(f.pending_approvals)?f.pending_approvals.slice(0,6).map(L):f.pending_approvals,local_processes:f.local_processes,local_tool_audit_count:Array.isArray(f.local_tool_audit)?f.local_tool_audit.length:0,main_agent_trust_mode:f.main_agent_trust_mode,reporting_summary:f.reporting&&"object"==typeof f.reporting?{keys:Object.keys(f.reporting)}:null,_note:"Artifact bodies + heartbeat events + reporting stripped. Use find_artifacts/show_artifact for content; query specific endpoints (/api/heartbeat, /api/audit) for full lists."}}case"list_projects":return{ok:!0,projects:(0,v.hF)({status:"all"})};case"create_artifact":{let a=new Set(["markdown","text"]).has(b.kind)?b.kind:"markdown";return(0,g.Dg)({...b,kind:a,project_id:b.project_id??c.project_id??null,agent_id:b.agent_id??c.agent_id??null,heartbeat_task_id:b.heartbeat_task_id??c.heartbeat_task_id??null,dedupe_key:b.dedupe_key,space_id:b.space_id??c.space_id??null})}case"update_artifact":return(0,g.eP)(b.artifact_id,{title:b.title,content:b.content});case"delete_artifact":return(0,g.CM)(b.artifact_id);case"move_artifact":return(0,g.S9)(b.artifact_id,{target_project_id:b.target_project_id});case"list_spaces":return{ok:!0,...b.include_artifact_ids?(0,w.OT)():(0,w.iF)()};case"create_space":return{ok:!0,space:(0,w.bz)({name:b.name})};case"rename_space":return{ok:!0,space:(0,w.Jh)(b.space_id,b.name)};case"set_active_space":return{ok:!0,space:(0,w.BQ)(b.space_id)};case"delete_space":return{ok:!0,...(0,w.cN)(b.space_id)};case"move_artifact_to_space":return{ok:!0,...(0,w.h5)(b.artifact_id,b.space_id)};case"import_brand_guidelines":return B(b);case"generate_ui":return y({...b,project_id:b.project_id??c.project_id??null});case"send_to_hermes":return z({...b,project_id:b.project_id??c.project_id??null});case"start_hermes_job":return A({...b,project_id:b.project_id??c.project_id??null});case"whatsapp_send":return(0,u.op)(b.chat_id,b.text);case"run_agent":return S(b);case"mines_run_report":return(0,t.Ij)({projectId:b.project_id,report_kind:b.report_kind,engine:b.engine||null,user_id:c.user_id||c.acting_on_behalf_of_user_id||"local-user",org_id:c.org_id||"personal-org"});case"set_agent_whatsapp_notify":var h=b;let i=R(h);if(!i.ok)return{ok:!1,error:i.error};let j=null==h.chat_id?null:String(h.chat_id).trim()||null;return{...(0,g.bC)(i.agent.id,j),agent_name:i.agent.name};case"find_artifacts":var k=b;let l=(0,g.n1)({title_query:k.title_query,agent_id:k.agent_id,agent_name:k.agent_name,kind:k.kind,project_id:k.project_id,space_id:k.space_id,limit:k.limit});return{ok:!0,count:l.length,artifacts:l.map(a=>({id:a.id,title:a.title||"(untitled)",kind:a.kind,agent_name:a.agent_name||null,agent_id:a.agent_id||null,created_at:a.created_at,project_id:a.project_id||null,space_id:a.space_id||null,path:a.path}))};case"read_artifact":return function(a){let b=P({artifact_id:a.artifact_id,title_query:a.title_query});if(!b.ok)return b;let c=b.artifact;if(c.is_protected)return{ok:!1,error:"Artifact is passphrase-protected; cannot be read from voice without unlock."};if(c.encrypted)return{ok:!1,error:"Artifact body is encrypted at rest; voice read path does not decrypt."};let d=Math.min(Math.max(Number(a.max_chars)||12e3,1e3),14e3),e=String(c.content||""),f=c.source_md?String(c.source_md):null,g=f||e,h=g.length>d;return{ok:!0,artifact:{id:c.id,title:c.title||"(untitled)",kind:c.kind,agent_id:c.agent_id||null,created_at:c.created_at,path:c.path||null,project_id:c.project_id||null,space_id:c.space_id||null,content_format:f?"markdown":"rendered",total_chars:g.length,returned_chars:Math.min(g.length,d),truncated:h,content:h?g.slice(0,d):g}}}(b);case"send_artifact_to_whatsapp":return Q(b,c);case"list_available_tools":return function({category:a,enabled_only:b}={}){let c=(0,q.n4)();if(a){let b=String(a).toLowerCase();c=c.filter(a=>(a.category||"").toLowerCase()===b)}return b&&(c=c.filter(a=>a.enabled)),{ok:!0,count:c.length,tools:c.map(a=>({name:a.name,title:a.title,description:a.description,category:a.category,enabled:a.enabled,available:a.available,risk_level:a.risk_level,allowlist_required:a.allowlist_required,missing_env:a.missing_env}))}}(b);case"install_tool":return function({tool_name:a}={}){if(!a||"string"!=typeof a)return{ok:!1,error:"tool_name is required"};try{let b=(0,q.G7)(a,!0);if(!b)return{ok:!1,error:`Unknown tool: ${a}`};let c={ok:!0,status:"enabled",tool_name:b.name,title:b.title,category:b.category,risk_level:b.risk_level};return b.missing_env&&b.missing_env.length>0&&(c.missing_credentials=b.missing_env,c.note=`Tool enabled but not yet usable — configure: ${b.missing_env.join(", ")}`),"irreversible_external"===b.risk_level&&(c.warning="This tool is rated irreversible_external. Each call will require owner approval regardless of trust mode."),c}catch(a){return{ok:!1,error:a.message}}}(b);case"uninstall_tool":return function({tool_name:a}={}){if(!a||"string"!=typeof a)return{ok:!1,error:"tool_name is required"};try{let b=(0,q.G7)(a,!1);if(!b)return{ok:!1,error:`Unknown tool: ${a}`};return{ok:!0,status:"disabled",tool_name:b.name,title:b.title}}catch(a){return{ok:!1,error:a.message}}}(b);case"request_capability":return function(a={},b={}){let c=String(a.capability_description||"").trim();if(!c)return{ok:!1,error:"capability_description is required"};let d=function(a){let b=new Set(F(a));if(!b.size)return null;let c=[];try{for(let a of(0,q.n4)())c.push({name:a.name,kind:"tool",text:`${a.name} ${a.title||""} ${a.description||""}`})}catch{}try{for(let a of(0,r.QH)({kind:"skill"}))c.push({name:a.slug,kind:"skill",text:`${a.slug} ${a.title||""} ${a.description||""}`})}catch{}for(let a of c){let c=F(a.name);if(c.length&&c.every(a=>b.has(a)))return{name:a.name,kind:a.kind};let d=new Set(F(a.text)),e=0;for(let a of b)d.has(a)&&e++;if(e>=2&&c.some(a=>b.has(a)))return{name:a.name,kind:a.kind}}return null}(c);if(d)return{ok:!0,status:"exists",match:d,message:`A capability already covers this: ${d.name} (${d.kind}). Grant it instead of rebuilding.`};try{let a=Date.now()-36e5,b=(0,s.Vk)({assignee_agent_id:V,limit:50}).filter(b=>{if(["done","cancelled"].includes(b.status))return!1;let c=Date.parse(b.created_at||"");return Number.isFinite(c)&&c>=a});if(b.length>=5)return{ok:!1,status:"rate_limited",message:`Too many capability build requests in flight (${b.length}). Wait for some to finish.`}}catch{}try{let d=a.target_agent_id?String(a.target_agent_id):null,e=(0,s.createTask)({title:`Build capability: ${c.slice(0,80)}`,description:["A capability is needed that does not exist yet:",`  "${c}"`,"\nChoose the right authoring path and build it:\n  - composite tool (chain existing tools), or\n  - REST connector (new API + secret-by-reference), or\n  - skill (instruction recipe), or\n  - propose_tool (non-REST; staged code, human merge).\n",d?`Grant the result to agent: ${d}.`:"Return the slug so it can be granted to the requester."].join("\n"),acceptance_criteria:a.acceptance_criteria||"Capability authored and its slug returned so it can be granted to the requesting agent.",assignee_agent_id:V,created_by_agent_id:b.agent_id||"main-orchestrator",priority:"p1",project_id:b.project_id||null});return{ok:!0,status:"requested",task_id:e.id,assignee:V,target_agent_id:d,message:`Delegated to Tool Smith (task ${e.id}). It will author the capability and return a slug to grant.`}}catch(a){return{ok:!1,status:"error",error:"tool_smith_unavailable",message:String(a?.message||a)}}}(b,c);default:return(0,q.executeRegistryTool)(a,b)}}function P({artifact_id:a,title_query:b}){if(a){let b=(0,g.jZ)(a);return b?{ok:!0,artifact:b}:{ok:!1,error:`No artifact with id "${a}".`}}if(b){let a=(0,g.n1)({title_query:b,limit:5});return 0===a.length?{ok:!1,error:`No artifact title matches "${b}".`}:a.length>1?{ok:!1,error:`Ambiguous match for "${b}". Candidates: ${a.map(a=>`${a.title} (${a.id})`).join("; ")}. Pass artifact_id to disambiguate.`}:{ok:!0,artifact:(0,g.jZ)(a[0].id)}}return{ok:!1,error:"Pass either artifact_id or title_query."}}async function Q(a,b){let c=P(a);if(!c.ok)return c;let d=c.artifact;if("html"!==d.kind&&"document"!==d.kind)return{ok:!1,error:`Artifact kind "${d.kind}" is not HTML-renderable; only html and document artifacts can be sent.`};if(!d.content||!String(d.content).trim())return{ok:!1,error:`Artifact ${d.id} has no rendered content to send.`};let e=a.chat_id&&String(a.chat_id).trim()||b.chat_id||null;if(!e)return{ok:!1,error:"No chat_id available — pass chat_id, or call this from the WhatsApp channel where the sender is known."};let f=await (0,u.getBridgeHealth)();if(!f||!1===f.ok||"paired"!==f.pairing_state)return{ok:!1,error:`WhatsApp bridge not paired (state=${f?.pairing_state||"unknown"}). Pair via /whatsapp before retrying.`};let g=String(d.title||"artifact").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,60)||"artifact";try{let a=await (0,u.sendWhatsAppDocument)({chat_id:e,content:d.content,filename:`${g}.html`,mimetype:"text/html",caption:d.title||void 0});return{ok:!0,artifact_id:d.id,title:d.title,chat_id:e,message_id:a?.message_id||null}}catch(a){return{ok:!1,error:`Bridge send failed: ${a.message}`,artifact_id:d.id}}}function R({agent_id:a,agent_name:b}){if(a){let b=(0,g.vc)().find(b=>b.id===a);return b?{ok:!0,agent:b}:{ok:!1,error:`No agent with id "${a}". Use get_state to list agents.`}}if(b){let a=String(b).toLowerCase().trim(),c=(0,g.vc)(),d=c.find(b=>(b.name||"").toLowerCase()===a);if(d)return{ok:!0,agent:d};let e=c.filter(b=>(b.name||"").toLowerCase().includes(a)||(b.id||"").toLowerCase().includes(a));return 1===e.length?{ok:!0,agent:e[0]}:0===e.length?{ok:!1,error:`No agent matches "${b}". Existing: ${c.map(a=>a.name).join(", ")||"(none)"}`}:{ok:!1,error:`Ambiguous match for "${b}". Candidates: ${e.map(a=>`${a.name} (${a.id})`).join(", ")}. Pass agent_id to disambiguate.`}}return{ok:!1,error:"Pass either agent_id or agent_name."}}async function S(a){let b=R(a);if(!b.ok)return{ok:!1,error:b.error};let c=b.agent,d=a.wake_reason||"on-demand from main agent",e="string"==typeof a.instruction&&a.instruction.trim()?a.instruction.trim():null,f="string"==typeof a.expected_output&&a.expected_output.trim()?a.expected_output.trim():null;try{(e||f)&&(0,g.appendAudit)({type:"agent.run.override",summary:`Ad-hoc run of ${c.name} with per-call contract`,status:"complete",meta:{agent_id:c.id,wake_reason:d,has_instruction:!!e,has_expected_output:!!f}});let a=await (0,h.G)(c.id,{triggered_by:"main_agent",wake_reason:d,instruction:e,expected_output:f});if(!a)return{ok:!1,error:`runAgentTick returned null for ${c.id}`};return{ok:!0,agent_id:c.id,agent_name:c.name,run_id:a.id,status:a.status||"complete",title:a.artifact_title||a.title,preview:(a.preview||"").slice(0,600),artifact_id:a.artifact_id||null,artifact:a.artifact||null}}catch(a){return{ok:!1,error:a.message,agent_id:c.id}}}d()}catch(a){d(a)}})},2167:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Nw:()=>n,oG:()=>l,qC:()=>k,v8:()=>m});var e=c(31421),f=c(73024),g=c(76760),h=c(9381),i=c(24516),j=a([i]);function k(){let a=(0,i.getSecret)("HERMES_AGENT_DIR");return g.resolve(process.env.HERMES_AGENT_DIR||a||g.join(h.Dl,"..","hermes-agent"))}function l(){try{let a=k(),b=g.join(h.Dl,"scripts","hermes-command.py");return f.existsSync(a)&&f.existsSync(b)}catch{return!1}}function m(){let a=k(),b=g.join(h.Dl,"scripts","hermes-command.py"),c=f.existsSync(a),d=f.existsSync(b);return{available:c&&d,hermes_dir:a,dir_exists:c,script_exists:d,env_override:!!(process.env.HERMES_AGENT_DIR||(0,i.getSecret)("HERMES_AGENT_DIR"))}}function n({prompt:a,session_id:b,model:c,timeout_ms:d,cwd:i}={}){if(!a||"string"!=typeof a)throw Error("prompt is required");if(process.env.HERMES_MOCK_RESPONSE)return Promise.resolve({ok:!0,response:process.env.HERMES_MOCK_RESPONSE,session_id:b||"madarx-hermes-mock",model:c||null,mocked:!0});let{hermesDir:j,python:l,env:m}=function(a={}){let b=k(),c=function(a=k()){for(let b of[process.env.HERMES_PYTHON,process.env.PYTHON,g.join(a,".venv","bin","python"),"/opt/homebrew/bin/python3.12","/opt/homebrew/bin/python3.11","/opt/homebrew/bin/python3.10",g.join(process.env.HOME||"",".local","bin","python3.12"),g.join(process.env.HOME||"",".local","bin","python3.11"),g.join(process.env.HOME||"",".local","bin","python3.10"),"python3.12","python3.11","python3.10","python3"].filter(Boolean))if(!b.includes("/")||f.existsSync(b))return b;return"python3"}(b);return{hermesDir:b,python:c,env:{...function(){let a=g.join(h.Dl,".env.local");if(!f.existsSync(a))return{};let b={};for(let c of f.readFileSync(a,"utf8").split(/\r?\n/)){let a=c.trim();if(!a||a.startsWith("#")||!a.includes("="))continue;let d=a.indexOf("="),e=a.slice(0,d).trim(),f=a.slice(d+1).trim();(f.startsWith('"')&&f.endsWith('"')||f.startsWith("'")&&f.endsWith("'"))&&(f=f.slice(1,-1)),b[e]=f}return b}(),...process.env,...a,HERMES_AGENT_DIR:b,HERMES_PYTHON_USED:c}}}(),o=Number(d||process.env.HERMES_TIMEOUT_MS||6e5),p=function({prompt:a,session_id:b,model:c,cwd:d}={}){let e=k(),f=[g.join(h.Dl,"scripts","hermes-command.py"),"--hermes-dir",e,"--prompt",a];return b&&f.push("--session-id",b),c&&f.push("--model",c),d&&f.push("--cwd",d),f}({prompt:a,session_id:b,model:c,cwd:i});return new Promise((a,b)=>{let c=(0,e.spawn)(l,p,{cwd:j,env:m,stdio:["ignore","pipe","pipe"]}),d="",f="",g=!1,h=setTimeout(()=>{g=!0,c.kill("SIGTERM"),b(Error(`Hermes timed out after ${Math.round(o/1e3)}s`))},o);c.stdout.on("data",a=>{d+=a.toString()}),c.stderr.on("data",a=>{f+=a.toString()}),c.on("error",a=>{g||(g=!0,clearTimeout(h),b(a))}),c.on("close",c=>{if(!g){if(g=!0,clearTimeout(h),0!==c)return void b(Error((f||d||`Hermes exited with code ${c}`).trim()));try{let b=function(a){let b=String(a||"").trim();if(!b)throw Error("Hermes returned no output");let c=b.split("\n").filter(Boolean).at(-1);try{return JSON.parse(c)}catch{throw Error(`Hermes returned non-JSON output: ${b.slice(-500)}`)}}(d);if(!b.ok)throw Error(b.error||"Hermes command failed");if(!String(b.response||"").trim())throw Error("Hermes completed without a final response");a(b)}catch(a){b(a)}}})})}i=(j.then?(await j)():j)[0],d()}catch(a){d(a)}})},64143:(a,b,c)=>{c.d(b,{Wl:()=>g,Xj:()=>j,getBridgeHealth:()=>f,op:()=>h,sendWhatsAppDocument:()=>i});let d=process.env.WHATSAPP_BRIDGE_URL||"http://127.0.0.1:3210";async function e(a,b,c,{timeoutMs:f=1e4}={}){let g=new AbortController,h=setTimeout(()=>g.abort(),f);try{let e=await fetch(`${(process.env.WHATSAPP_BRIDGE_URL||d).replace(/\/$/,"")}${b}`,{method:a,headers:c?{"Content-Type":"application/json"}:void 0,body:c?JSON.stringify(c):void 0,signal:g.signal}),f=await e.text(),h=null;try{h=f?JSON.parse(f):null}catch{}if(!e.ok){let a=Error(h?.error||`whatsapp-bridge ${e.status}`);throw a.status=e.status,a.body=h||f,a}return h}finally{clearTimeout(h)}}async function f(){try{return await e("GET","/health",null,{timeoutMs:3e3})}catch(a){return{ok:!1,error:a.message,status:a.status||null}}}async function g(){try{return await e("GET","/qr",null,{timeoutMs:3e3})}catch(a){return{ok:!1,error:a.message,status:a.status||null}}}async function h(a,b){if(!a)throw Error("chat_id is required");if(!b||!String(b).trim())throw Error("text is required");return e("POST","/send",{chat_id:a,text:String(b)})}async function i({chat_id:a,content:b,filename:c,mimetype:d,caption:f}){if(!a)throw Error("chat_id is required");if(!c)throw Error("filename is required");if(null==b)throw Error("content is required");let g=Buffer.isBuffer(b)?b:Buffer.from(String(b),"utf8");if(!g.length)throw Error("content is empty");return e("POST","/send-document",{chat_id:a,content_base64:g.toString("base64"),filename:c,mimetype:d||"application/octet-stream",caption:f||void 0},{timeoutMs:3e4})}async function j(){return e("POST","/logout",{},{timeoutMs:15e3})}},78224:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Z2:()=>u,Zn:()=>t,_3:()=>y,o0:()=>x,qw:()=>s,rK:()=>z,vy:()=>r});var e=c(73024),f=c(76760),g=c(31421),h=c(34255),i=c(9381),j=c(73066),k=c(61423),l=c(60105),m=c(8727),n=a([h,j,k,l,m]);[h,j,k,l,m]=n.then?(await n)():n;let A=new Set(["complete","failed","cancelled","stale"]);function o(a){return a?{...a}:null}function p(a){return a?{...a,payload:function(a,b){if(!a)return null;try{return JSON.parse(a)}catch{return null}}(a.payload,null)}:null}function q(a,b){let c=f.resolve(i.Dl,a),d=e.realpathSync(i.un),g=e.existsSync(f.dirname(c))?e.realpathSync(f.dirname(c)):f.resolve(f.dirname(c)),h=f.join(g,f.basename(c));if(!(h===d||h.startsWith(`${d}${f.sep}`)))throw Error(`Refusing to write artifact outside workspace: ${a}`);e.mkdirSync(f.dirname(c),{recursive:!0}),e.writeFileSync(c,b,"utf8")}function r(a=20){return(0,h.getDb)().prepare("SELECT * FROM hermes_jobs ORDER BY updated_at DESC LIMIT ?").all(a).map(o)}function s(a){let b=(0,h.getDb)();return o(b.prepare("SELECT * FROM hermes_jobs WHERE id = ?").get(a))}function t(a,b=200){return(0,h.getDb)().prepare("SELECT * FROM hermes_job_events WHERE job_id = ? ORDER BY at ASC LIMIT ?").all(a,b).map(p)}function u(a){let b=s(a);return b?{...b,events:t(a,500)}:null}function v(a,b=[]){let c=a.status||"queued",d=[],e=[...b].reverse().find(a=>"final"===a.type),f=[...b].reverse().find(a=>"error"===a.type);e?.message?d.push(e.message,""):(a.error||f?.message)&&d.push("## Error","",a.error||f.message,"");let g=b.filter(a=>!["final"].includes(a.type));if(g.length){for(let a of(d.push("## Progress",""),g.slice(-80))){let b=a.at?a.at.replace("T"," ").replace(/\.\d+Z$/,"Z"):"",c=(function(a,b=6e3){let c=String(a||"");return c.length>b?`${c.slice(0,b)}
+`}({name:c,mission:d,tools:b})),j={...a,name:c,mission:d,tools:b,skills_markdown:h};return e&&(j.system_prompt=e),void 0!==a.whatsapp_notify_chat_id&&(j.whatsapp_notify_chat_id=a.whatsapp_notify_chat_id||null),(0,g.Sn)(j)}let Z="tool-smith-agent";function H(a){return String(a||"").toLowerCase().replace(/[._-]+/g," ").split(/[^a-z0-9]+/).filter(a=>a.length>=3)}let $=[{name:"create_agent",description:"Create a new named sub-agent in the local workspace with files and optional schedule. Pick the engine based on what the agent actually does (see engine field).",input_schema:{type:"object",properties:{name:{type:"string",description:"Human-readable agent name."},mission:{type:"string",description:"What this agent does (its standing job — used as the default instruction every run)."},expected_output:{type:"string",description:"OPTIONAL standing deliverable contract: what a GOOD result looks like every run — format, required sections, acceptance criteria, definition of done. Set this whenever the agent has a repeatable output shape so runs are consistent and verifiable. A per-call run_agent override or a delegated task's acceptance_criteria takes precedence over this for a specific run."},schedule:{type:"string",description:'Cron-like schedule: "daily HH:MM", "every 5m", or "on demand".'},tools:{type:"array",items:{type:"string"},description:'madarX tool identifiers the agent is allowed to use (e.g. "web_search", "web_fetch", "file_read", "create_artifact"). Lowercase snake_case, NOT Claude Code tool names.'},type:{type:"string",description:'Agent type label, e.g. "custom" or "intelligence".'},engine:{type:"string",enum:["anthropic","claude-code","ollama","codex","hermes"],description:'DEFAULT is "claude-code" — uses the local Claude Code CLI with permissions from .claude/settings.json (Read/Glob/Grep/WebSearch/WebFetch auto-allowed; edits scoped to workspace/). Use this for almost everything. "anthropic" only when the agent needs the madarx tool marketplace specifically (create_artifact, generate_ui, whatsapp_send, competitor_report, marketing_plan — these do not exist under claude-code). "ollama" for cheap local-LLM work. "codex" for OpenAI Codex CLI. "hermes" rare. If the user does not specify, leave engine unset and the default applies.'},whatsapp_notify_chat_id:{type:"string",description:'OPTIONAL WhatsApp chat id (e.g. 9715XXXXXXXX@s.whatsapp.net, or plain digits). When set, every scheduled run that produces a report artifact will auto-deliver the rendered HTML file to this chat. The bridge must be paired; if not, delivery is skipped silently. Set this only when the owner explicitly says "send to whatsapp" or "deliver to me on whatsapp".'}},required:["name","mission"]}},{name:"set_agent_whatsapp_notify",description:'Enable, change, or disable WhatsApp delivery of scheduled-run artifacts for an existing agent. Pass an empty string or null in chat_id to disable. Use this when the owner says "send X to me on whatsapp", "stop whatsapping me X", or wants to switch the notify chat. The bridge must be paired for delivery to actually happen; the setting is stored either way.',input_schema:{type:"object",properties:{agent_id:{type:"string",description:"Slug id of the agent. Use get_state to look it up if unsure."},agent_name:{type:"string",description:"Fuzzy human-readable name (used only when agent_id is missing)."},chat_id:{type:"string",description:"WhatsApp chat id to receive scheduled HTML artifacts. Pass empty string to disable."}},required:["chat_id"]}},{name:"upsert_schedule",description:"Create or update a recurring schedule for an existing agent.",input_schema:{type:"object",properties:{agent_id:{type:"string",description:"Slug ID of the agent."},schedule:{type:"string",description:'Schedule spec: "daily HH:MM", "every 5m", etc.'},action_kind:{type:"string",description:'What the schedule runs: "agent-tick", "competitor-report", "marketing-plan", or "heartbeat".'},enabled:{type:"boolean",description:"Whether the schedule is active (default true)."}},required:["agent_id","schedule"]}},{name:"competitor_report",description:"Generate a daily competitor intelligence report and save it as a local artifact.",input_schema:{type:"object",properties:{triggered_by:{type:"string",description:"Source label for the audit log."}}}},{name:"marketing_plan",description:"Generate a 7-day marketing content plan and save it as a local artifact.",input_schema:{type:"object",properties:{triggered_by:{type:"string",description:"Source label for the audit log."}}}},{name:"heartbeat_tick",description:"Update the heartbeat timestamp for all generated agents.",input_schema:{type:"object",properties:{triggered_by:{type:"string",description:"Source label for the audit log."}}}},{name:"claude_dry_run",description:"Prepare a Claude Code command string for human review. Never executes automatically — requires owner approval.",input_schema:{type:"object",properties:{prompt:{type:"string",description:"The task description to pass to the Claude Code runner."}},required:["prompt"]}},{name:"get_state",description:"Retrieve a LIGHTWEIGHT snapshot of runtime state: agents, runs, schedules, connectors, and artifact metadata only. Artifact bodies are stripped to a short snippet — use find_artifacts to search and show_artifact to load full content for a specific id. Use this as a directory; never expect full document bodies here.",input_schema:{type:"object",properties:{}}},{name:"create_artifact",description:'Save a written-content artifact (report, list, plan, brief, summary, doc). Provide the body as well-structured markdown and madarX will render it into a styled HTML document automatically, with a one-click "Download .md" for the source. Do NOT include the user prompt, instructions, or meta commentary inside the body — only the result content. Do NOT use for full UI/landing pages — use generate_ui instead.',input_schema:{type:"object",properties:{title:{type:"string",description:"Short, human-readable artifact title shown in the document header."},kind:{type:"string",enum:["markdown","text"],description:'Always "markdown" unless the content is truly plain text with no structure.'},content:{type:"string",description:"The full body as GitHub-flavored markdown. Use headings (##), lists, tables, and bold sparingly. No emojis. Result content only — never echo the prompt."},project_id:{type:"string",description:"Optional destination project id or slug. Omit to use the active/default project."},space_id:{type:"string",description:"Optional dashboard space id where the artifact should appear. Omit to use the calling agent default or the main space."},dedupe_key:{type:"string",description:"Optional idempotency key. Pass empty string only when intentionally creating multiple artifacts with the same title in one day."}},required:["title","kind","content"]}},{name:"update_artifact",description:"Update an existing artifact with revised or extended content. Use this instead of create_artifact when continuing, refining, or expanding a previous result for the same task. Keeps the same artifact visible and editable rather than spawning a new one.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"ID of the artifact to update."},title:{type:"string",description:"New title — omit to keep the existing title."},content:{type:"string",description:"Full updated body as GitHub-flavored markdown. Must be the complete content, not a diff."}},required:["artifact_id","content"]}},{name:"delete_artifact",description:"Permanently delete a saved artifact from the dashboard. Use only when the owner explicitly asks to remove or trash an artifact, or when the previous artifact is being replaced by a brand-new one and the prior result must not linger. This is irreversible from the agent side; the artifact file on disk is unlinked as well.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"ID of the artifact to delete."}},required:["artifact_id"]}},{name:"move_artifact",description:'Move an existing artifact from one project to another. Updates the artifact\'s project_id, relocates the file on disk into the target project\'s artifacts directory, and writes changelog entries on both source and target projects. Use this when the owner asks to "move", "reassign", "relocate", or "transfer" an artifact between projects/spaces. The artifact id and title stay the same; only the project membership and disk location change.',input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"ID of the artifact to move."},target_project_id:{type:"string",description:'Destination project id or slug (e.g. "planify" or "personal"). Use list_projects to discover valid values.'}},required:["artifact_id","target_project_id"]}},{name:"read_artifact",description:"Load the full content for a specific artifact after finding it. Use this before editing, summarizing, or continuing an existing document. Returns rendered content and markdown source when available.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"Exact artifact id to read."},title_query:{type:"string",description:"Optional fuzzy title query when artifact_id is not known. Must resolve to one artifact."},max_chars:{type:"number",description:"Maximum content characters to return, default 12000."}}}},{name:"list_spaces",description:"List dashboard spaces/tabs. Use include_artifact_ids when the owner asks which artifacts are displayed in each space.",input_schema:{type:"object",properties:{include_artifact_ids:{type:"boolean",description:"When true, include artifact_ids grouped under each space."}}}},{name:"create_space",description:"Create a new dashboard space/tab where artifacts can be displayed.",input_schema:{type:"object",properties:{name:{type:"string",description:"Short dashboard space name."}},required:["name"]}},{name:"rename_space",description:"Rename an existing dashboard space/tab.",input_schema:{type:"object",properties:{space_id:{type:"string",description:"Space id to rename."},name:{type:"string",description:"New short space name."}},required:["space_id","name"]}},{name:"set_active_space",description:"Make a dashboard space/tab the active space.",input_schema:{type:"object",properties:{space_id:{type:"string",description:"Space id to activate."}},required:["space_id"]}},{name:"delete_space",description:"Delete a dashboard space/tab. Artifacts are not deleted; they are moved to a fallback space. Do not use to delete artifacts.",input_schema:{type:"object",properties:{space_id:{type:"string",description:"Space id to delete."}},required:["space_id"]}},{name:"move_artifact_to_space",description:"Display an existing artifact in a different dashboard space/tab, or remove it from a custom space by moving it back to the default main space. The artifact id, project, file, and content stay unchanged.",input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"Artifact id to move between dashboard spaces."},space_id:{type:"string",description:'Destination dashboard space id. Use "default" to remove from a custom space back to main.'}},required:["artifact_id","space_id"]}},{name:"import_brand_guidelines",description:"Import a local brand guidelines file or pasted guidelines content, extract brand colors/fonts/voice/document defaults, and set it as the default brand system for future documents, presentations, and generated UI artifacts. Use this when the owner provides a brand guidelines HTML/Markdown/text file path, pastes guidelines content, or asks to update branding.",input_schema:{type:"object",properties:{file_path:{type:"string",description:"Path to a local .html, .md, .txt, .css, .svg, or .pdf brand guidelines file under an allowed root."},content:{type:"string",description:"Pasted brand guidelines content when no local file path is available."},filename:{type:"string",description:"Optional filename for pasted content, e.g. brand-guidelines.md."},logo_path:{type:"string",description:"Optional local path to the primary brand logo file (.svg, .png, .jpg, .jpeg, .webp)."}}}},{name:"generate_ui",description:"Build a production-quality HTML/CSS UI — landing page, dashboard, component, presentation, or any visual interface. Automatically applies professional design rules (typography scale, intentional color, no generic AI patterns). Use this for ALL HTML/UI creation requests.",input_schema:{type:"object",properties:{description:{type:"string",description:"What to build — be specific: layout, sections, content, purpose, and any brand or color hints."}},required:["description"]}},{name:"send_to_hermes",description:"Send a command or task to the local Hermes agent and save the final Hermes response as a dashboard artifact. Use this when the user asks Hermes to do work, wants a Hermes result, or asks to route a command through Hermes.",input_schema:{type:"object",properties:{prompt:{type:"string",description:"The exact task or command Hermes should run."},title:{type:"string",description:"Optional artifact title for the Hermes result."},session_id:{type:"string",description:"Optional stable Hermes session id. Usually omit."},model:{type:"string",description:"Optional Hermes model override. Usually omit so Hermes uses its configured model."},timeout_ms:{type:"number",description:"Optional timeout in milliseconds. Use 600000 or higher for project run/build tasks."}},required:["prompt"]}},{name:"start_hermes_job",description:"Start a long-running local Hermes job in the background and immediately create a live-updating dashboard artifact. Use for running projects, builds, tests, installs, dev servers, or multi-step Hermes work that may take more than a minute.",input_schema:{type:"object",properties:{prompt:{type:"string",description:"The full task Hermes should perform."},title:{type:"string",description:"Artifact/job title."},session_id:{type:"string",description:"Optional Hermes session id."},model:{type:"string",description:"Optional Hermes model override."},timeout_ms:{type:"number",description:"Optional job timeout in milliseconds. Use 1800000 for long project tasks."},cwd:{type:"string",description:"Optional absolute working directory for the project Hermes should run."}},required:["prompt"]}},{name:"run_agent",description:'Run an existing sub-agent NOW (on demand, outside its normal schedule). Use this when the owner says "run X", "trigger X", "do today\'s run of X", etc. The run executes synchronously and publishes live tool-call events to the dashboard. Returns the run summary and a short result preview.',input_schema:{type:"object",properties:{agent_id:{type:"string",description:'Slug id (e.g. "uae-ai-initiatives-tracker"). Prefer this if known. Use list_agents / get_state first to look it up.'},agent_name:{type:"string",description:'Fuzzy human-readable name (e.g. "UAE tracker"). Used only if agent_id is not provided. Case-insensitive substring match against agent names; ambiguous matches error.'},wake_reason:{type:"string",description:'Short label for the audit log, e.g. "owner requested via whatsapp".'},instruction:{type:"string",description:"OPTIONAL task-specific instruction for THIS run only — what to do right now. Overrides the agent's standing mission for this single run; never saved onto the agent. Use it to dispatch an existing agent at an ad-hoc job (e.g. \"compare this week's numbers to last week and flag anomalies\"). Omit to run the agent's standing mission. The agent can still only use the tools it was granted — this does not expand its permissions."},expected_output:{type:"string",description:"OPTIONAL deliverable contract for THIS run only — what a complete, correct result must contain (format, sections, acceptance criteria). Overrides the agent's standing expected_output for this run. Use it to pin down what 'done' looks like for an ad-hoc instruction."}}}},{name:"mines_run_report",description:'Generate ONE mines diligence report for a project as a single action (the workflow authors the number-free narrative and the report tool renders every figure from cited database rows). Use report_kind "pfs_readiness_report" when the owner asks to "assess PFS readiness". The report\'s LLM authoring runs on the configured engine (Claude Code CLI for the personal tier, Anthropic API for production) — it works even when no Anthropic API key is set. Returns the artifact id.',input_schema:{type:"object",properties:{project_id:{type:"string",description:"mines_projects.id. Use list/get_state or find the project first if unknown."},report_kind:{type:"string",description:"One of: pfs_readiness_report, due_diligence_memo, investor_presentation, data_quality_report, interpretation_memo."},engine:{type:"string",description:'OPTIONAL engine override: "claude-code" (personal CLI subscription) or "anthropic" (production API). Defaults to the mines agents\' configured engine. This is a cost/scale tier, not a capability change.'}},required:["project_id","report_kind"]}},{name:"find_artifacts",description:'Search past artifacts (reports, briefs, generated UIs) by title, agent, or kind. Use when the owner asks for "the latest X report", "send me yesterday\'s brief", or "what did <agent> produce". Returns up to 50 rows, most recent first, with id/title/kind/agent_name/created_at — NOT the full content. To deliver one, follow up with send_artifact_to_whatsapp. SEARCH BROADLY: title_query does word-level matching (every word must appear, any order), but if the first query returns 0 rows, RETRY with a shorter / broader query — try just the noun ("brief", "report") before concluding nothing exists. Real titles often include words the owner did not say (e.g. "AI Daily Brief scheduled report" vs the owner saying "AI brief").',input_schema:{type:"object",properties:{title_query:{type:"string",description:'Fuzzy substring of the artifact title (case-insensitive). E.g. "conflict" matches "Conflict brief 2026-05-13".'},agent_id:{type:"string",description:"Filter to one specific agent id."},agent_name:{type:"string",description:'Fuzzy substring of the agent name (case-insensitive). E.g. "conflict" matches "Conflict Brief Agent".'},kind:{type:"string",description:'Filter by kind: "html", "document" (rendered markdown), or other.'},project_id:{type:"string",description:"Filter to one project id or slug."},space_id:{type:"string",description:'Filter to one dashboard space id, e.g. "default".'},limit:{type:"number",description:"Max rows to return (default 10, max 50)."}}}},{name:"send_artifact_to_whatsapp",description:'Deliver an existing artifact as an .html file to a WhatsApp chat. Use after find_artifacts (or get_state) to send a past report on demand — e.g. "send me the latest conflict brief on whatsapp". Pass either artifact_id (preferred) or title_query (fuzzy match — must resolve to one row). If chat_id is omitted on the WhatsApp channel, defaults to the chat the owner is messaging from. The WhatsApp bridge must be paired.',input_schema:{type:"object",properties:{artifact_id:{type:"string",description:"Exact artifact id (preferred). Get this from find_artifacts."},title_query:{type:"string",description:"Fuzzy substring of the title. Used only when artifact_id is omitted; ambiguous matches error."},chat_id:{type:"string",description:"WhatsApp chat id to deliver to. Omit on inbound WhatsApp to send back to the same chat."}}}},{name:"whatsapp_send",description:'Send a WhatsApp message to a chat the owner has added to the allowlist. Use sparingly for proactive owner alerts and follow-ups (e.g., "scheduled report is ready"). The bridge must be paired and online; if not, this returns an error.',input_schema:{type:"object",properties:{chat_id:{type:"string",description:"Allowlisted WhatsApp chat id (full JID like 9715XXXXXXXX@s.whatsapp.net, or plain digits which are normalized)."},text:{type:"string",description:"Plain text message body. WhatsApp does not render markdown — keep it conversational."}},required:["chat_id","text"]}},{name:"list_available_tools",description:'List all marketplace tools with their enabled status, availability, risk level, and missing credentials. Use this before saying "I cannot do X" to check whether a tool exists. Filter by category (travel, web, github, email, supabase, vercel, local_machine, browser, voice, calendar) or by enabled_only to see what is currently active.',input_schema:{type:"object",properties:{category:{type:"string",description:"Optional category filter: travel, web, github, email, supabase, vercel, local_machine, browser, voice, calendar."},enabled_only:{type:"boolean",description:"When true, return only currently-enabled tools."}}}},{name:"install_tool",description:"Enable a marketplace tool by name so it becomes available for immediate use. Call this after list_available_tools identifies a disabled tool that can satisfy the principal's request. If the tool has missing credentials, the response includes a missing_credentials list — surface this to the principal. Tools rated irreversible_external will still require per-call owner approval when invoked.",input_schema:{type:"object",properties:{tool_name:{type:"string",description:'Exact tool name from list_available_tools, e.g. "flight_search" or "hotel_rates".'}},required:["tool_name"]}},{name:"uninstall_tool",description:"Disable a marketplace tool by name. Use when the principal asks to turn off a tool or when a tool is causing issues.",input_schema:{type:"object",properties:{tool_name:{type:"string",description:'Exact tool name to disable, e.g. "email_send".'}},required:["tool_name"]}},{name:"route_goal",description:"CALL THIS FIRST for any non-trivial request, BEFORE attempting a specialist task yourself. It grounds your delegation decision: given the user goal, it returns the live capability registry — every active agent with its role, mission, skills, and granted tools; the enabled-tool catalog; whether Tool Smith is available to build missing capabilities — plus the fallback ladder. Reason over it and pick the path: delegate to a fit specialist (run_agent), create_then_delegate when none fits (create_agent), build_capability when a specialist exists but lacks a required tool (request_capability), or direct_fallback for a trivial one-line factual answer. Read-only, no side effects.",input_schema:{type:"object",properties:{goal:{type:"string",description:'The user goal in one sentence, e.g. "find a return flight DXB to London for May 18-25" or "draft a reply to this email".'}},required:["goal"]}},{name:"request_capability",description:'Delegate to Tool Smith to BUILD a capability that does not exist yet. Use when an agent needs a tool/skill/integration the system lacks (e.g. "log meetings to Notion" with no Notion tool). First dedupes against existing capabilities; if none matches, files a build task for the tool-smith-agent which authors a composite tool, a REST connector, a skill, or proposes code. Returns the task id. The authored capability is still subject to all runtime gates when used.',input_schema:{type:"object",properties:{capability_description:{type:"string",description:'Plain-language description of the capability needed, e.g. "create pages in Notion" or "summarize a daily competitor digest".'},target_agent_id:{type:"string",description:"Optional id of the agent that should be granted the capability once built."},acceptance_criteria:{type:"string",description:"Optional explicit acceptance criteria for the build."}},required:["capability_description"]}}],_=new Set(["send_to_hermes","start_hermes_job"]);function I(){if("off"===process.env.MADARX_DELEGATION_ENFORCEMENT)return new Set;try{return new Set((0,q.n4)().filter(t.Wp).map(a=>a.name))}catch{return new Set}}function J(){let a=(0,j.oG)()?$:$.filter(a=>!_.has(a.name)),b=I();return(0,q.Cz)(a).filter(a=>!b.has(a.name))}function K(a,b=180){let c="string"==typeof a?a:null==a?"":String(a);return c.length<=b?c:c.slice(0,b)+`…[+${c.length-b} bytes, use show_artifact/find_artifacts]`}function L(a){if(!a)return a;let b="string"==typeof a.content?a.content:"";return{id:a.id,title:a.title,kind:a.kind,project_id:a.project_id??null,created_at:a.created_at,updated_at:a.updated_at,content_bytes:b.length,content_preview:b?K(b):""}}function M(a){if(!a)return a;let b=Array.isArray(a.memory)?a.memory.slice(-2):[];return{id:a.id,name:a.name,engine:a.engine,status:a.status,project_id:a.project_id??null,schedule:a.schedule,last_run_at:a.last_run_at??null,tools_count:Array.isArray(a.tools)?a.tools.length:0,memory_count:Array.isArray(a.memory)?a.memory.length:0,memory_recent:b.map(a=>"string"==typeof a?K(a,200):a)}}function N(a){return a?{id:a.id,agent_id:a.agent_id??null,project_id:a.project_id??null,status:a.status,started_at:a.started_at,finished_at:a.finished_at??null,summary:K(a.summary??a.note??"",160)}:a}function O(a){return a?{id:a.id,action_type:a.action_type,status:a.status,requested_at:a.requested_at,agent_id:a.agent_id??null,summary:K(a.summary??a.note??"",160)}:a}function P(a){return a?{id:a.id,schedule_id:a.schedule_id??null,agent_id:a.agent_id??null,status:a.status,scheduled_for:a.scheduled_for??null,attempts:a.attempts??0}:a}function Q(a){let b;try{b=JSON.stringify(a)}catch{return a}return!b||b.length<=6e4?a:{ok:!1,truncated:!0,original_bytes:b.length,max_bytes:6e4,preview:b.slice(0,59744),error:`tool_result exceeded 60000 bytes (got ${b.length}); narrow the query or use show_artifact for a specific id.`}}async function R(a,b={},c={}){if(I().has(a))return Q({ok:!1,error:"delegate_required",message:`"${a}" is a specialist tool you do not own directly. Call route_goal(goal), then delegate to the agent that owns it with run_agent — or request_capability if no agent has it.`});let d=await S(a,b,c);return Q(d)}async function S(a,b={},c={}){switch(a){case"create_agent":return G(b);case"upsert_schedule":return(0,g.Nv)(b);case"competitor_report":return(0,g.NK)({triggered_by:b.triggered_by??"claude"});case"marketing_plan":return(0,g.mk)({triggered_by:b.triggered_by??"claude"});case"heartbeat_tick":return(0,g.IG)({triggered_by:b.triggered_by??"claude"});case"claude_dry_run":return(0,g.nF)({prompt:b.prompt},{triggered_by:"claude"});case"get_state":{let a=b.project_id??null;var d,e,f=(0,g.Gu)({project_id:a?String(a):null});if(!f||"object"!=typeof f)return f;return{ok:f.ok,product:f.product,workspace:f.workspace,project_filter:f.project_filter,projects:f.projects,agents:Array.isArray(f.agents)?f.agents.map(M):f.agents,tasks:f.tasks,runs:Array.isArray(f.runs)?f.runs.slice(0,8).map(N):f.runs,audit:(d=f.audit,(Array.isArray(d)?d.slice(0,6):[]).map(a=>({id:a.id,type:a.type,at:a.at,actor:a.user_id||a.acting_on_behalf_of_user_id||null,target:a.action_target_id??null,note:K(a.note??a.detail??"",160)}))),activity:(e=f.activity,(Array.isArray(e)?e.slice(0,10):[]).map(a=>({id:a.id,type:a.type,at:a.at,agent_id:a.agent_id??null,project_id:a.project_id??null,summary:K(a.summary??a.detail??"",160)}))),schedules:f.schedules,connectors:f.connectors,artifacts:Array.isArray(f.artifacts)?f.artifacts.map(L):f.artifacts,heartbeat_tasks:Array.isArray(f.heartbeat_tasks)?f.heartbeat_tasks.slice(0,5).map(P):f.heartbeat_tasks,heartbeat_task_events_count:Array.isArray(f.heartbeat_task_events)?f.heartbeat_task_events.length:0,approvals:Array.isArray(f.approvals)?f.approvals.slice(0,6).map(O):f.approvals,pending_approvals:Array.isArray(f.pending_approvals)?f.pending_approvals.slice(0,6).map(O):f.pending_approvals,local_processes:f.local_processes,local_tool_audit_count:Array.isArray(f.local_tool_audit)?f.local_tool_audit.length:0,main_agent_trust_mode:f.main_agent_trust_mode,reporting_summary:f.reporting&&"object"==typeof f.reporting?{keys:Object.keys(f.reporting)}:null,_note:"Artifact bodies + heartbeat events + reporting stripped. Use find_artifacts/show_artifact for content; query specific endpoints (/api/heartbeat, /api/audit) for full lists."}}case"list_projects":return{ok:!0,projects:(0,x.hF)({status:"all"})};case"create_artifact":{let a=new Set(["markdown","text"]).has(b.kind)?b.kind:"markdown";return(0,g.Dg)({...b,kind:a,project_id:b.project_id??c.project_id??null,agent_id:b.agent_id??c.agent_id??null,heartbeat_task_id:b.heartbeat_task_id??c.heartbeat_task_id??null,dedupe_key:b.dedupe_key,space_id:b.space_id??c.space_id??null})}case"update_artifact":return(0,g.eP)(b.artifact_id,{title:b.title,content:b.content});case"delete_artifact":return(0,g.CM)(b.artifact_id);case"move_artifact":return(0,g.S9)(b.artifact_id,{target_project_id:b.target_project_id});case"list_spaces":return{ok:!0,...b.include_artifact_ids?(0,y.OT)():(0,y.iF)()};case"create_space":return{ok:!0,space:(0,y.bz)({name:b.name})};case"rename_space":return{ok:!0,space:(0,y.Jh)(b.space_id,b.name)};case"set_active_space":return{ok:!0,space:(0,y.BQ)(b.space_id)};case"delete_space":return{ok:!0,...(0,y.cN)(b.space_id)};case"move_artifact_to_space":return{ok:!0,...(0,y.h5)(b.artifact_id,b.space_id)};case"import_brand_guidelines":return D(b);case"generate_ui":return A({...b,project_id:b.project_id??c.project_id??null});case"send_to_hermes":return B({...b,project_id:b.project_id??c.project_id??null});case"start_hermes_job":return C({...b,project_id:b.project_id??c.project_id??null});case"whatsapp_send":return(0,w.op)(b.chat_id,b.text);case"run_agent":return W(b,c);case"mines_run_report":return(0,v.Ij)({projectId:b.project_id,report_kind:b.report_kind,engine:b.engine||null,user_id:c.user_id||c.acting_on_behalf_of_user_id||"local-user",org_id:c.org_id||"personal-org"});case"set_agent_whatsapp_notify":var h=b;let i=V(h);if(!i.ok)return{ok:!1,error:i.error};let j=null==h.chat_id?null:String(h.chat_id).trim()||null;return{...(0,g.bC)(i.agent.id,j),agent_name:i.agent.name};case"find_artifacts":var k=b;let l=(0,g.n1)({title_query:k.title_query,agent_id:k.agent_id,agent_name:k.agent_name,kind:k.kind,project_id:k.project_id,space_id:k.space_id,limit:k.limit});return{ok:!0,count:l.length,artifacts:l.map(a=>({id:a.id,title:a.title||"(untitled)",kind:a.kind,agent_name:a.agent_name||null,agent_id:a.agent_id||null,created_at:a.created_at,project_id:a.project_id||null,space_id:a.space_id||null,path:a.path}))};case"read_artifact":return function(a){let b=T({artifact_id:a.artifact_id,title_query:a.title_query});if(!b.ok)return b;let c=b.artifact;if(c.is_protected)return{ok:!1,error:"Artifact is passphrase-protected; cannot be read from voice without unlock."};if(c.encrypted)return{ok:!1,error:"Artifact body is encrypted at rest; voice read path does not decrypt."};let d=Math.min(Math.max(Number(a.max_chars)||12e3,1e3),14e3),e=String(c.content||""),f=c.source_md?String(c.source_md):null,g=f||e,h=g.length>d;return{ok:!0,artifact:{id:c.id,title:c.title||"(untitled)",kind:c.kind,agent_id:c.agent_id||null,created_at:c.created_at,path:c.path||null,project_id:c.project_id||null,space_id:c.space_id||null,content_format:f?"markdown":"rendered",total_chars:g.length,returned_chars:Math.min(g.length,d),truncated:h,content:h?g.slice(0,d):g}}}(b);case"send_artifact_to_whatsapp":return U(b,c);case"list_available_tools":return function({category:a,enabled_only:b}={}){let c=(0,q.n4)();if(a){let b=String(a).toLowerCase();c=c.filter(a=>(a.category||"").toLowerCase()===b)}return b&&(c=c.filter(a=>a.enabled)),{ok:!0,count:c.length,tools:c.map(a=>({name:a.name,title:a.title,description:a.description,category:a.category,enabled:a.enabled,available:a.available,risk_level:a.risk_level,allowlist_required:a.allowlist_required,missing_env:a.missing_env}))}}(b);case"install_tool":return function({tool_name:a}={}){if(!a||"string"!=typeof a)return{ok:!1,error:"tool_name is required"};try{let b=(0,q.G7)(a,!0);if(!b)return{ok:!1,error:`Unknown tool: ${a}`};let c={ok:!0,status:"enabled",tool_name:b.name,title:b.title,category:b.category,risk_level:b.risk_level};return b.missing_env&&b.missing_env.length>0&&(c.missing_credentials=b.missing_env,c.note=`Tool enabled but not yet usable — configure: ${b.missing_env.join(", ")}`),"irreversible_external"===b.risk_level&&(c.warning="This tool is rated irreversible_external. Each call will require owner approval regardless of trust mode."),c}catch(a){return{ok:!1,error:a.message}}}(b);case"uninstall_tool":return function({tool_name:a}={}){if(!a||"string"!=typeof a)return{ok:!1,error:"tool_name is required"};try{let b=(0,q.G7)(a,!1);if(!b)return{ok:!1,error:`Unknown tool: ${a}`};return{ok:!0,status:"disabled",tool_name:b.name,title:b.title}}catch(a){return{ok:!1,error:a.message}}}(b);case"route_goal":return(0,s.Sh)({goal:b.goal,project_id:c.project_id||null});case"request_capability":return function(a={},b={}){let c=String(a.capability_description||"").trim();if(!c)return{ok:!1,error:"capability_description is required"};let d=function(a){let b=new Set(H(a));if(!b.size)return null;let c=[];try{for(let a of(0,q.n4)())c.push({name:a.name,kind:"tool",text:`${a.name} ${a.title||""} ${a.description||""}`})}catch{}try{for(let a of(0,r.QH)({kind:"skill"}))c.push({name:a.slug,kind:"skill",text:`${a.slug} ${a.title||""} ${a.description||""}`})}catch{}for(let a of c){let c=H(a.name);if(c.length&&c.every(a=>b.has(a)))return{name:a.name,kind:a.kind};let d=new Set(H(a.text)),e=0;for(let a of b)d.has(a)&&e++;if(e>=2&&c.some(a=>b.has(a)))return{name:a.name,kind:a.kind}}return null}(c);if(d)return{ok:!0,status:"exists",match:d,message:`A capability already covers this: ${d.name} (${d.kind}). Grant it instead of rebuilding.`};try{let a=Date.now()-36e5,b=(0,u.Vk)({assignee_agent_id:Z,limit:50}).filter(b=>{if(["done","cancelled"].includes(b.status))return!1;let c=Date.parse(b.created_at||"");return Number.isFinite(c)&&c>=a});if(b.length>=5)return{ok:!1,status:"rate_limited",message:`Too many capability build requests in flight (${b.length}). Wait for some to finish.`}}catch{}try{let d=a.target_agent_id?String(a.target_agent_id):null,e=(0,u.createTask)({title:`Build capability: ${c.slice(0,80)}`,description:["A capability is needed that does not exist yet:",`  "${c}"`,"\nChoose the right authoring path and build it:\n  - composite tool (chain existing tools), or\n  - REST connector (new API + secret-by-reference), or\n  - skill (instruction recipe), or\n  - propose_tool (non-REST; staged code, human merge).\n",d?`Grant the result to agent: ${d}.`:"Return the slug so it can be granted to the requester."].join("\n"),acceptance_criteria:a.acceptance_criteria||"Capability authored and its slug returned so it can be granted to the requesting agent.",assignee_agent_id:Z,created_by_agent_id:b.agent_id||"main-orchestrator",priority:"p1",project_id:b.project_id||null});return{ok:!0,status:"requested",task_id:e.id,assignee:Z,target_agent_id:d,message:`Delegated to Tool Smith (task ${e.id}). It will author the capability and return a slug to grant.`}}catch(a){return{ok:!1,status:"error",error:"tool_smith_unavailable",message:String(a?.message||a)}}}(b,c);default:return(0,q.executeRegistryTool)(a,b)}}function T({artifact_id:a,title_query:b}){if(a){let b=(0,g.jZ)(a);return b?{ok:!0,artifact:b}:{ok:!1,error:`No artifact with id "${a}".`}}if(b){let a=(0,g.n1)({title_query:b,limit:5});return 0===a.length?{ok:!1,error:`No artifact title matches "${b}".`}:a.length>1?{ok:!1,error:`Ambiguous match for "${b}". Candidates: ${a.map(a=>`${a.title} (${a.id})`).join("; ")}. Pass artifact_id to disambiguate.`}:{ok:!0,artifact:(0,g.jZ)(a[0].id)}}return{ok:!1,error:"Pass either artifact_id or title_query."}}async function U(a,b){let c=T(a);if(!c.ok)return c;let d=c.artifact;if("html"!==d.kind&&"document"!==d.kind)return{ok:!1,error:`Artifact kind "${d.kind}" is not HTML-renderable; only html and document artifacts can be sent.`};if(!d.content||!String(d.content).trim())return{ok:!1,error:`Artifact ${d.id} has no rendered content to send.`};let e=a.chat_id&&String(a.chat_id).trim()||b.chat_id||null;if(!e)return{ok:!1,error:"No chat_id available — pass chat_id, or call this from the WhatsApp channel where the sender is known."};let f=await (0,w.getBridgeHealth)();if(!f||!1===f.ok||"paired"!==f.pairing_state)return{ok:!1,error:`WhatsApp bridge not paired (state=${f?.pairing_state||"unknown"}). Pair via /whatsapp before retrying.`};let g=String(d.title||"artifact").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,60)||"artifact";try{let a=await (0,w.sendWhatsAppDocument)({chat_id:e,content:d.content,filename:`${g}.html`,mimetype:"text/html",caption:d.title||void 0});return{ok:!0,artifact_id:d.id,title:d.title,chat_id:e,message_id:a?.message_id||null}}catch(a){return{ok:!1,error:`Bridge send failed: ${a.message}`,artifact_id:d.id}}}function V({agent_id:a,agent_name:b}){if(a){let b=(0,g.vc)().find(b=>b.id===a);return b?{ok:!0,agent:b}:{ok:!1,error:`No agent with id "${a}". Use get_state to list agents.`}}if(b){let a=String(b).toLowerCase().trim(),c=(0,g.vc)(),d=c.find(b=>(b.name||"").toLowerCase()===a);if(d)return{ok:!0,agent:d};let e=c.filter(b=>(b.name||"").toLowerCase().includes(a)||(b.id||"").toLowerCase().includes(a));return 1===e.length?{ok:!0,agent:e[0]}:0===e.length?{ok:!1,error:`No agent matches "${b}". Existing: ${c.map(a=>a.name).join(", ")||"(none)"}`}:{ok:!1,error:`Ambiguous match for "${b}". Candidates: ${e.map(a=>`${a.name} (${a.id})`).join(", ")}. Pass agent_id to disambiguate.`}}return{ok:!1,error:"Pass either agent_id or agent_name."}}async function W(a,b={}){let c=V(a);if(!c.ok)return{ok:!1,error:c.error};let d=c.agent,e=a.wake_reason||"on-demand from main agent",f="string"==typeof a.instruction&&a.instruction.trim()?a.instruction.trim():null,i="string"==typeof a.expected_output&&a.expected_output.trim()?a.expected_output.trim():null,j=Array.isArray(b.pending_approvals)?b.pending_approvals:[];try{(f||i)&&(0,g.appendAudit)({type:"agent.run.override",summary:`Ad-hoc run of ${d.name} with per-call contract`,status:"complete",meta:{agent_id:d.id,wake_reason:e,has_instruction:!!f,has_expected_output:!!i}});let a=await (0,h.G)(d.id,{triggered_by:"main_agent",wake_reason:e,instruction:f,expected_output:i,pending_approvals:j});if(!a)return{ok:!1,error:`runAgentTick returned null for ${d.id}`};return{ok:!0,agent_id:d.id,agent_name:d.name,run_id:a.id,status:a.pending_approval?"awaiting_approval":a.status||"complete",title:a.artifact_title||a.title,preview:(a.preview||"").slice(0,600),artifact_id:a.artifact_id||null,artifact:a.artifact||null,pending_approval:a.pending_approval||null}}catch(a){return{ok:!1,error:a.message,agent_id:d.id}}}d()}catch(a){d(a)}})},2167:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Nw:()=>n,oG:()=>l,qC:()=>k,v8:()=>m});var e=c(31421),f=c(73024),g=c(76760),h=c(9381),i=c(24516),j=a([i]);function k(){let a=(0,i.getSecret)("HERMES_AGENT_DIR");return g.resolve(process.env.HERMES_AGENT_DIR||a||g.join(h.Dl,"..","hermes-agent"))}function l(){try{let a=k(),b=g.join(h.Dl,"scripts","hermes-command.py");return f.existsSync(a)&&f.existsSync(b)}catch{return!1}}function m(){let a=k(),b=g.join(h.Dl,"scripts","hermes-command.py"),c=f.existsSync(a),d=f.existsSync(b);return{available:c&&d,hermes_dir:a,dir_exists:c,script_exists:d,env_override:!!(process.env.HERMES_AGENT_DIR||(0,i.getSecret)("HERMES_AGENT_DIR"))}}function n({prompt:a,session_id:b,model:c,timeout_ms:d,cwd:i}={}){if(!a||"string"!=typeof a)throw Error("prompt is required");if(process.env.HERMES_MOCK_RESPONSE)return Promise.resolve({ok:!0,response:process.env.HERMES_MOCK_RESPONSE,session_id:b||"madarx-hermes-mock",model:c||null,mocked:!0});let{hermesDir:j,python:l,env:m}=function(a={}){let b=k(),c=function(a=k()){for(let b of[process.env.HERMES_PYTHON,process.env.PYTHON,g.join(a,".venv","bin","python"),"/opt/homebrew/bin/python3.12","/opt/homebrew/bin/python3.11","/opt/homebrew/bin/python3.10",g.join(process.env.HOME||"",".local","bin","python3.12"),g.join(process.env.HOME||"",".local","bin","python3.11"),g.join(process.env.HOME||"",".local","bin","python3.10"),"python3.12","python3.11","python3.10","python3"].filter(Boolean))if(!b.includes("/")||f.existsSync(b))return b;return"python3"}(b);return{hermesDir:b,python:c,env:{...function(){let a=g.join(h.Dl,".env.local");if(!f.existsSync(a))return{};let b={};for(let c of f.readFileSync(a,"utf8").split(/\r?\n/)){let a=c.trim();if(!a||a.startsWith("#")||!a.includes("="))continue;let d=a.indexOf("="),e=a.slice(0,d).trim(),f=a.slice(d+1).trim();(f.startsWith('"')&&f.endsWith('"')||f.startsWith("'")&&f.endsWith("'"))&&(f=f.slice(1,-1)),b[e]=f}return b}(),...process.env,...a,HERMES_AGENT_DIR:b,HERMES_PYTHON_USED:c}}}(),o=Number(d||process.env.HERMES_TIMEOUT_MS||6e5),p=function({prompt:a,session_id:b,model:c,cwd:d}={}){let e=k(),f=[g.join(h.Dl,"scripts","hermes-command.py"),"--hermes-dir",e,"--prompt",a];return b&&f.push("--session-id",b),c&&f.push("--model",c),d&&f.push("--cwd",d),f}({prompt:a,session_id:b,model:c,cwd:i});return new Promise((a,b)=>{let c=(0,e.spawn)(l,p,{cwd:j,env:m,stdio:["ignore","pipe","pipe"]}),d="",f="",g=!1,h=setTimeout(()=>{g=!0,c.kill("SIGTERM"),b(Error(`Hermes timed out after ${Math.round(o/1e3)}s`))},o);c.stdout.on("data",a=>{d+=a.toString()}),c.stderr.on("data",a=>{f+=a.toString()}),c.on("error",a=>{g||(g=!0,clearTimeout(h),b(a))}),c.on("close",c=>{if(!g){if(g=!0,clearTimeout(h),0!==c)return void b(Error((f||d||`Hermes exited with code ${c}`).trim()));try{let b=function(a){let b=String(a||"").trim();if(!b)throw Error("Hermes returned no output");let c=b.split("\n").filter(Boolean).at(-1);try{return JSON.parse(c)}catch{throw Error(`Hermes returned non-JSON output: ${b.slice(-500)}`)}}(d);if(!b.ok)throw Error(b.error||"Hermes command failed");if(!String(b.response||"").trim())throw Error("Hermes completed without a final response");a(b)}catch(a){b(a)}}})})}i=(j.then?(await j)():j)[0],d()}catch(a){d(a)}})},41647:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Sh:()=>m});var e=c(73024),f=c(76760),g=c(9381),h=c(60105),i=c(40718),j=c(5295),k=a([h,i]);[h,i]=k.then?(await k)():k;let n="tool-smith-agent",o=[{step:"delegate",when:"A live specialist exists whose role/tools cover the goal. Dispatch it with run_agent."},{step:"create_then_delegate",when:"No fit specialist exists yet. Spawn one (create_agent from the closest template/mission), then delegate."},{step:"build_capability",when:"A specialist exists but lacks a required tool. Call request_capability so Tool Smith builds + grants it, then delegate."},{step:"direct_fallback",when:"Trivial one-line factual ask, or no capability can be built — answer directly / re-grant the tool for this one turn (audited)."}];function l(a){return"terminated"!==a&&"paused"!==a}function m({goal:a="",project_id:b=null}={}){let c=(0,h.vc)(),d=(b?c.filter(a=>!a.project_id||a.project_id===b):c).filter(a=>a.id!==n&&l(a.status)).map(a=>({id:a.id,name:a.name,role:a.role||a.type||null,title:a.title||null,mission:a.mission||null,status:a.status||null,tools:function(a){try{let b=(0,h.K2)(a).filter(a=>"disabled"!==a.mode);if(b.length)return b.map(a=>a.tool_name)}catch{}return[]}(a.id),skills:function(a){try{return e.readFileSync(f.join(g.bo,a,"skills.md"),"utf8").trim().slice(0,1200)}catch{return""}}(a.id)})),k=(0,i.n4)().map(a=>({name:a.name,category:a.category||null,title:a.title||null,enabled:!!a.enabled,available:!!a.available,specialist:(0,j.Wp)(a)})),p=c.find(a=>a.id===n&&l(a.status)),q=function(a){let b=String(a||"");if(!b.trim())return null;for(let[a,c]of j.Wq)if(a.test(b))return{category:c,role:(0,j.W6)(c)||null};return null}(a);return{goal:String(a||""),agents:d,agent_count:d.length,tools_catalog:k,tool_smith_available:!!p,fast_path_hint:q,recommendation_ladder:o,routing_note:"Reason over agents[] (role/mission/skills/tools) vs. what this goal needs. Pick a ladder step: delegate an existing fit specialist, create_then_delegate when none fits, build_capability via Tool Smith when a specialist lacks a tool, or direct_fallback for trivial asks. fast_path_hint is only a shortcut for obvious domains — do not treat it as the answer when the goal is broader."}}d()}catch(a){d(a)}})},64143:(a,b,c)=>{c.d(b,{Wl:()=>g,Xj:()=>j,getBridgeHealth:()=>f,op:()=>h,sendWhatsAppDocument:()=>i});let d=process.env.WHATSAPP_BRIDGE_URL||"http://127.0.0.1:3210";async function e(a,b,c,{timeoutMs:f=1e4}={}){let g=new AbortController,h=setTimeout(()=>g.abort(),f);try{let e=await fetch(`${(process.env.WHATSAPP_BRIDGE_URL||d).replace(/\/$/,"")}${b}`,{method:a,headers:c?{"Content-Type":"application/json"}:void 0,body:c?JSON.stringify(c):void 0,signal:g.signal}),f=await e.text(),h=null;try{h=f?JSON.parse(f):null}catch{}if(!e.ok){let a=Error(h?.error||`whatsapp-bridge ${e.status}`);throw a.status=e.status,a.body=h||f,a}return h}finally{clearTimeout(h)}}async function f(){try{return await e("GET","/health",null,{timeoutMs:3e3})}catch(a){return{ok:!1,error:a.message,status:a.status||null}}}async function g(){try{return await e("GET","/qr",null,{timeoutMs:3e3})}catch(a){return{ok:!1,error:a.message,status:a.status||null}}}async function h(a,b){if(!a)throw Error("chat_id is required");if(!b||!String(b).trim())throw Error("text is required");return e("POST","/send",{chat_id:a,text:String(b)})}async function i({chat_id:a,content:b,filename:c,mimetype:d,caption:f}){if(!a)throw Error("chat_id is required");if(!c)throw Error("filename is required");if(null==b)throw Error("content is required");let g=Buffer.isBuffer(b)?b:Buffer.from(String(b),"utf8");if(!g.length)throw Error("content is empty");return e("POST","/send-document",{chat_id:a,content_base64:g.toString("base64"),filename:c,mimetype:d||"application/octet-stream",caption:f||void 0},{timeoutMs:3e4})}async function j(){return e("POST","/logout",{},{timeoutMs:15e3})}},78224:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{Z2:()=>u,Zn:()=>t,_3:()=>y,o0:()=>x,qw:()=>s,rK:()=>z,vy:()=>r});var e=c(73024),f=c(76760),g=c(31421),h=c(34255),i=c(9381),j=c(73066),k=c(61423),l=c(60105),m=c(8727),n=a([h,j,k,l,m]);[h,j,k,l,m]=n.then?(await n)():n;let A=new Set(["complete","failed","cancelled","stale"]);function o(a){return a?{...a}:null}function p(a){return a?{...a,payload:function(a,b){if(!a)return null;try{return JSON.parse(a)}catch{return null}}(a.payload,null)}:null}function q(a,b){let c=f.resolve(i.Dl,a),d=e.realpathSync(i.un),g=e.existsSync(f.dirname(c))?e.realpathSync(f.dirname(c)):f.resolve(f.dirname(c)),h=f.join(g,f.basename(c));if(!(h===d||h.startsWith(`${d}${f.sep}`)))throw Error(`Refusing to write artifact outside workspace: ${a}`);e.mkdirSync(f.dirname(c),{recursive:!0}),e.writeFileSync(c,b,"utf8")}function r(a=20){return(0,h.getDb)().prepare("SELECT * FROM hermes_jobs ORDER BY updated_at DESC LIMIT ?").all(a).map(o)}function s(a){let b=(0,h.getDb)();return o(b.prepare("SELECT * FROM hermes_jobs WHERE id = ?").get(a))}function t(a,b=200){return(0,h.getDb)().prepare("SELECT * FROM hermes_job_events WHERE job_id = ? ORDER BY at ASC LIMIT ?").all(a,b).map(p)}function u(a){let b=s(a);return b?{...b,events:t(a,500)}:null}function v(a,b=[]){let c=a.status||"queued",d=[],e=[...b].reverse().find(a=>"final"===a.type),f=[...b].reverse().find(a=>"error"===a.type);e?.message?d.push(e.message,""):(a.error||f?.message)&&d.push("## Error","",a.error||f.message,"");let g=b.filter(a=>!["final"].includes(a.type));if(g.length){for(let a of(d.push("## Progress",""),g.slice(-80))){let b=a.at?a.at.replace("T"," ").replace(/\.\d+Z$/,"Z"):"",c=(function(a,b=6e3){let c=String(a||"");return c.length>b?`${c.slice(0,b)}
 
 [truncated ${c.length-b} chars]`:c})(a.message||a.type,1200).replace(/\n/g,"\n  ");d.push(`- ${b} ${a.type}: ${c}`.trim())}d.push("")}return"running"===c?d.push("## Current state","","Hermes is still running. This artifact updates as new progress arrives.",""):"queued"===c&&d.push("## Current state","","Hermes is queued and will start shortly.",""),`${d.join("\n")}
 `}function w(a,{type:b,message:c,payload:d}={}){let e=(0,h.getDb)(),f=(0,h.newId)("hermes-event"),g=(0,h.nowIso)();return e.prepare(`

package/.next/standalone/.next/server/chunks/5858.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=5858,exports.ids=[5858],exports.modules={35858:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{H1:()=>m,Mh:()=>l,NZ:()=>o,TJ:()=>n,UO:()=>k,er:()=>p,nT:()=>r,uS:()=>q});var e=c(77598),f=c(34255),g=c(4160),h=c(76031),i=c(95678),j=a([f,g]);function k(a){return a?(0,f.getDb)().prepare(`SELECT id, title, kind, content, source_md, created_at
+"use strict";exports.id=5858,exports.ids=[396,5858],exports.modules={35858:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{H1:()=>m,Mh:()=>l,NZ:()=>o,TJ:()=>n,UO:()=>k,er:()=>p,nT:()=>r,uS:()=>q});var e=c(77598),f=c(34255),g=c(4160),h=c(76031),i=c(95678),j=a([f,g,i]);function k(a){return a?(0,f.getDb)().prepare(`SELECT id, title, kind, content, source_md, created_at
          FROM artifacts
         WHERE space_id = ?
         ORDER BY created_at ASC, id ASC`).all(String(a)).map(a=>({id:a.id,title:a.title||"Untitled",kind:a.kind||"text",content:a.content||a.source_md||"",created_at:a.created_at||null})):[]}async function l(a,b={},c){let{expires_in_days:d=7,max_views:j=50,require_email_otp:k}=b;if(null!=d&&d>90)throw{status:400,error:"expires_in_days_exceeds_maximum",max:90};let m=(0,f.getDb)();if(!m.prepare("SELECT id FROM dashboard_spaces WHERE id = ?").get(String(a)))throw{status:404,error:"space_not_found"};let n=k;if(null==n){let a=m.prepare("SELECT require_share_email_verification FROM organizations WHERE id = ?").get(c.org_id);n=a?.require_share_email_verification===1}let o=(0,e.randomBytes)(32).toString("base64url"),p=await (0,h.Oj)(),q=(0,h.L5)(o,p),r=null;if(null!=d&&d>0){let a=new Date;a.setDate(a.getDate()+d),r=a.toISOString()}let s=(0,f.newId)("spaceshare"),t=c.org_id;m.prepare(`INSERT INTO space_share_links
@@ -25,4 +25,4 @@
 <p><strong>Your verification code is: ${i}</strong></p>
 <p>This code expires in 10 minutes. Do not share it with anyone.</p>`},{agent_id:null,owner_trusted:!0});if(!d||!1===d.ok)return{ok:!0,expires_in:600,email_sent:!1,email_error:d?.status||"unknown"}}catch(a){return{ok:!0,expires_in:600,email_sent:!1,email_error:a.message}}return{ok:!0,expires_in:600,email_sent:!0}}function r(a,b,c){let d=(0,f.getDb)(),h=d.prepare(`SELECT * FROM space_share_link_otps
         WHERE share_link_id = ? AND email = ? AND expires_at > ? AND verified_at IS NULL
-        ORDER BY created_at DESC LIMIT 1`).get(a,b,(0,f.nowIso)());if(!h)return{ok:!1,reason:"not_found_or_expired"};if(h.attempts>=5){try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_LOCKED_OUT,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP lockout for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts}})}catch{}return{ok:!1,reason:"lockout"}}let[i,j]=h.code_hash.split(":"),k=(0,e.createHash)("sha256").update(i+":"+c).digest("hex"),l=Buffer.from(k,"hex"),m=Buffer.from(j,"hex");if(!(l.length===m.length&&(0,e.timingSafeEqual)(l,m))){d.prepare("UPDATE space_share_link_otps SET attempts = attempts + 1 WHERE id = ?").run(h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_FAILED,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP failed for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts+1}})}catch{}return{ok:!1,reason:"invalid_code"}}d.prepare("UPDATE space_share_link_otps SET verified_at = ? WHERE id = ?").run((0,f.nowIso)(),h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_VERIFIED,action_target_id:a,action_target_type:"space",status:"success",summary:`Space share OTP verified for ${b} on link ${a}`,meta:{share_link_id:a}})}catch{}return{ok:!0}}[f,g]=j.then?(await j)():j,d()}catch(a){d(a)}})},76031:(a,b,c)=>{c.d(b,{L5:()=>g,Oj:()=>f,lr:()=>h,th:()=>j});var d=c(77598);let e=null;async function f(){if(e)return e;if(process.env.MADARX_SHARE_LINK_SECRET)return e=process.env.MADARX_SHARE_LINK_SECRET;try{let{getSecret:a,setSecret:b}=await Promise.resolve().then(c.bind(c,24516)),f=await a("MADARX_SHARE_LINK_SECRET",{scope:"global"});if(f)return e=f;let g=(0,d.randomBytes)(32).toString("hex");return console.warn("[share-secret] WARNING: MADARX_SHARE_LINK_SECRET is not set. A random key has been generated and stored in the secrets vault. Set MADARX_SHARE_LINK_SECRET in your environment before deploying to production — losing this key invalidates all existing share links."),await b("MADARX_SHARE_LINK_SECRET",g,{scope:"global",source:"auto_generated"}),e=g}catch(a){return console.warn("[share-secret] WARNING: Could not access secrets vault for MADARX_SHARE_LINK_SECRET. Using an ephemeral key — share links will break on restart. Error: "+a.message),e=(0,d.randomBytes)(32).toString("hex")}}function g(a,b){return(0,d.createHmac)("sha256",b).update(a).digest("hex")}function h(a,b){let c=Buffer.from(a,"hex"),e=Buffer.from(b,"hex");return c.length===e.length&&(0,d.timingSafeEqual)(c,e)}let i=new Map;function j(a){if(!a)return{ok:!0};let b=Date.now(),c=i.get(a);return!c||b-c.windowStart>=36e5?(i.set(a,{count:1,windowStart:b}),{ok:!0}):c.count>=100?{ok:!1,retryAfterMs:36e5-(b-c.windowStart)}:(c.count+=1,{ok:!0})}},95678:(a,b,c)=>{c.d(b,{_:()=>e});let d=["MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function e(a){let b=String(a||"").startsWith("/")?String(a||""):`/${a||""}`,c=function(){for(let a of d){let b=process.env[a];if(!b||!String(b).trim())continue;let c=String(b).trim().replace(/\/+$/,"");if(/^https?:\/\//i.test(c))return c}return""}();return c?`${c}${b}`:b}}};
+        ORDER BY created_at DESC LIMIT 1`).get(a,b,(0,f.nowIso)());if(!h)return{ok:!1,reason:"not_found_or_expired"};if(h.attempts>=5){try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_LOCKED_OUT,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP lockout for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts}})}catch{}return{ok:!1,reason:"lockout"}}let[i,j]=h.code_hash.split(":"),k=(0,e.createHash)("sha256").update(i+":"+c).digest("hex"),l=Buffer.from(k,"hex"),m=Buffer.from(j,"hex");if(!(l.length===m.length&&(0,e.timingSafeEqual)(l,m))){d.prepare("UPDATE space_share_link_otps SET attempts = attempts + 1 WHERE id = ?").run(h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_FAILED,action_target_id:a,action_target_type:"space",status:"denied",summary:`Space share OTP failed for ${b} on link ${a}`,meta:{share_link_id:a,attempts:h.attempts+1}})}catch{}return{ok:!1,reason:"invalid_code"}}d.prepare("UPDATE space_share_link_otps SET verified_at = ? WHERE id = ?").run((0,f.nowIso)(),h.id);try{(0,g.appendComplianceAudit)({user_id:null,org_id:"personal-org",action:g.ComplianceActions.SHARE_OTP_VERIFIED,action_target_id:a,action_target_type:"space",status:"success",summary:`Space share OTP verified for ${b} on link ${a}`,meta:{share_link_id:a}})}catch{}return{ok:!0}}[f,g,i]=j.then?(await j)():j,d()}catch(a){d(a)}})},76031:(a,b,c)=>{c.d(b,{L5:()=>g,Oj:()=>f,lr:()=>h,th:()=>j});var d=c(77598);let e=null;async function f(){if(e)return e;if(process.env.MADARX_SHARE_LINK_SECRET)return e=process.env.MADARX_SHARE_LINK_SECRET;try{let{getSecret:a,setSecret:b}=await Promise.resolve().then(c.bind(c,24516)),f=await a("MADARX_SHARE_LINK_SECRET",{scope:"global"});if(f)return e=f;let g=(0,d.randomBytes)(32).toString("hex");return console.warn("[share-secret] WARNING: MADARX_SHARE_LINK_SECRET is not set. A random key has been generated and stored in the secrets vault. Set MADARX_SHARE_LINK_SECRET in your environment before deploying to production — losing this key invalidates all existing share links."),await b("MADARX_SHARE_LINK_SECRET",g,{scope:"global",source:"auto_generated"}),e=g}catch(a){return console.warn("[share-secret] WARNING: Could not access secrets vault for MADARX_SHARE_LINK_SECRET. Using an ephemeral key — share links will break on restart. Error: "+a.message),e=(0,d.randomBytes)(32).toString("hex")}}function g(a,b){return(0,d.createHmac)("sha256",b).update(a).digest("hex")}function h(a,b){let c=Buffer.from(a,"hex"),e=Buffer.from(b,"hex");return c.length===e.length&&(0,d.timingSafeEqual)(c,e)}let i=new Map;function j(a){if(!a)return{ok:!0};let b=Date.now(),c=i.get(a);return!c||b-c.windowStart>=36e5?(i.set(a,{count:1,windowStart:b}),{ok:!0}):c.count>=100?{ok:!1,retryAfterMs:36e5-(b-c.windowStart)}:(c.count+=1,{ok:!0})}},90396:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{getPublicBaseUrl:()=>h,wz:()=>i,x6:()=>j});var e=c(67179),f=a([e]);e=(f.then?(await f)():f)[0];let k="public_base_url",l=["MADARX_PUBLIC_URL","MADARX_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SHARE_BASE_URL","NEXT_PUBLIC_SITE_URL"];function g(a){if(!a||!String(a).trim())return"";let b=String(a).trim().replace(/\/+$/,"");return/^https?:\/\//i.test(b)?b:""}function h(){try{let a=g((0,e.getConfig)(k,null));if(a)return a}catch{}for(let a of l){let b=g(process.env[a]);if(b)return b}return""}function i(a){let b=null==a?"":String(a).trim();if(""===b)return(0,e.setConfig)(k,""),"";if(!function(a){let b=g(a);if(!b)return!1;try{return new URL(b),!0}catch{return!1}}(b))throw Error("public app URL must be a valid http(s) URL, e.g. https://madarx.io");let c=g(b);return(0,e.setConfig)(k,c),c}function j(a){let b=String(a||""),c=b.startsWith("/")?b:`/${b}`,d=h();return d?`${d}${c}`:c}d()}catch(a){d(a)}})},95678:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{_:()=>g});var e=c(90396),f=a([e]);function g(a){return(0,e.x6)(a)}e=(f.then?(await f)():f)[0],d()}catch(a){d(a)}})}};