robotrock 1.0.0 → 1.3.0

package/dist/eve/tools/admin/manage-team-members.js

@@ -0,0 +1,1160 @@
+// src/http.ts
+var RobotRockError = class extends Error {
+  constructor(message, statusCode, response) {
+    super(message);
+    this.statusCode = statusCode;
+    this.response = response;
+    this.name = "RobotRockError";
+  }
+};
+async function parseResponseBody(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  const bodyText = await response.text();
+  if (!bodyText) {
+    return null;
+  }
+  if (contentType.toLowerCase().includes("application/json")) {
+    try {
+      return JSON.parse(bodyText);
+    } catch {
+    }
+  }
+  try {
+    return JSON.parse(bodyText);
+  } catch {
+    return bodyText;
+  }
+}
+function getErrorMessage(data, fallback) {
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const record = data;
+    const maybeMessage = record.message;
+    const maybeHint = record.hint;
+    if (typeof maybeMessage === "string" && maybeMessage.trim()) {
+      if (typeof maybeHint === "string" && maybeHint.trim()) {
+        return `${maybeMessage.trim()} ${maybeHint.trim()}`;
+      }
+      return maybeMessage;
+    }
+  }
+  if (typeof data === "string" && data.trim()) {
+    const compact = data.replace(/\s+/g, " ").trim();
+    const snippet = compact.length > 180 ? `${compact.slice(0, 180)}...` : compact;
+    return `${fallback}. Server returned non-JSON response: ${snippet}`;
+  }
+  return fallback;
+}
+
+// ../core/src/schemas/task.ts
+import { z } from "zod";
+
+// ../core/src/utils/safe-url.ts
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.goog"
+]);
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number(part));
+  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a, b, _c, _d] = octets;
+  if (a === void 0 || b === void 0) {
+    return true;
+  }
+  if (a === 127 || a === 0) return true;
+  if (a === 10) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromNumericHost(host) {
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
+  if (hexMatch) {
+    const num = Number.parseInt(hexMatch[1], 16);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  return null;
+}
+function isBlockedIpv4Mapped(host) {
+  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
+  if (mappedDotted) {
+    return isBlockedIpv4(mappedDotted[1]);
+  }
+  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+  if (mappedHex) {
+    const high = Number.parseInt(mappedHex[1], 16);
+    const low = Number.parseInt(mappedHex[2], 16);
+    if (Number.isFinite(high) && Number.isFinite(low)) {
+      const a = high >> 8 & 255;
+      const b = high & 255;
+      const c = low >> 8 & 255;
+      const d = low & 255;
+      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
+    }
+  }
+  return false;
+}
+function isBlockedIpv6(host) {
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  if (host.startsWith("fc") || host.startsWith("fd")) {
+    return true;
+  }
+  if (host.startsWith("fe80:")) {
+    return true;
+  }
+  if (isBlockedIpv4Mapped(host)) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  if (!host) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(host)) {
+    return true;
+  }
+  if (host.endsWith(".localhost") || host.endsWith(".local")) {
+    return true;
+  }
+  const numericIpv4 = ipv4FromNumericHost(host);
+  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
+    return true;
+  }
+  return isBlockedIpv4(host) || isBlockedIpv6(host);
+}
+function isLoopbackHandlerUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function isAllowedHandlerUrl(urlString) {
+  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
+}
+function isPublicHttpUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  return !isBlockedHostname(url.hostname);
+}
+var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
+var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
+
+// ../core/src/schemas/context-urls.ts
+function resolveLinkUrl(value) {
+  return value.startsWith("http://") || value.startsWith("https://") ? value : `https://${value}`;
+}
+function widgetType(ui, field) {
+  const fieldUi = ui?.[field];
+  if (typeof fieldUi !== "object" || fieldUi === null) {
+    return void 0;
+  }
+  const widget = fieldUi["ui:widget"];
+  return typeof widget === "string" ? widget : void 0;
+}
+function validateUrlValue(value, widget) {
+  if (widget === "image" || widget === "link") {
+    if (typeof value !== "string") {
+      return PUBLIC_HTTP_URL_ERROR;
+    }
+    const url = widget === "link" ? resolveLinkUrl(value) : value;
+    if (!isPublicHttpUrl(url)) {
+      return PUBLIC_HTTP_URL_ERROR;
+    }
+    return null;
+  }
+  if (widget === "attachments" && Array.isArray(value)) {
+    for (const item of value) {
+      if (typeof item !== "object" || item === null) {
+        continue;
+      }
+      const url = item.url;
+      if (typeof url === "string" && !isPublicHttpUrl(resolveLinkUrl(url))) {
+        return PUBLIC_HTTP_URL_ERROR;
+      }
+    }
+  }
+  return null;
+}
+function validateContextPublicUrls(context) {
+  if (!context?.data) {
+    return null;
+  }
+  for (const [field, value] of Object.entries(context.data)) {
+    const widget = widgetType(context.ui, field);
+    if (!widget) {
+      continue;
+    }
+    const error = validateUrlValue(value, widget);
+    if (error) {
+      return `context.data.${field}: ${error}`;
+    }
+  }
+  return null;
+}
+
+// ../core/src/schemas/task.ts
+var safeUrlSchema = z.string().refine((url) => isPublicHttpUrl(url), {
+  message: PUBLIC_HTTP_URL_ERROR
+});
+var handlerUrlSchema = z.string().refine((url) => isAllowedHandlerUrl(url), {
+  message: HANDLER_URL_ERROR
+});
+var jsonSchema7Schema = z.custom(
+  (val) => typeof val === "object" && val !== null,
+  { message: "Must be a valid JSON Schema object" }
+);
+var uiSchemaSchema = z.custom((val) => typeof val === "object" && val !== null, {
+  message: "Must be a valid UiSchema object"
+});
+var webhookHandlerSchema = z.object({
+  type: z.literal("webhook"),
+  url: handlerUrlSchema,
+  headers: z.record(z.string(), z.string())
+});
+var triggerHandlerSchema = webhookHandlerSchema.extend({
+  type: z.literal("trigger"),
+  tokenId: z.string().min(1)
+});
+var handlerSchema = z.discriminatedUnion("type", [webhookHandlerSchema, triggerHandlerSchema]);
+var taskActionInputSchema = z.object({
+  id: z.string().min(1),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  schema: jsonSchema7Schema.optional(),
+  ui: uiSchemaSchema.optional(),
+  data: z.record(z.string(), z.unknown()).optional()
+});
+var taskActionSchema = taskActionInputSchema.extend({
+  // Optional handlers for this action - if present, must have at least 1
+  handlers: z.array(handlerSchema).min(1).optional()
+});
+var uiFieldSchemaSchema = z.object({
+  "ui:widget": z.string().optional(),
+  "ui:title": z.string().optional(),
+  "ui:description": z.string().optional(),
+  "ui:options": z.record(z.string(), z.unknown()).optional(),
+  items: z.lazy(() => z.record(z.string(), uiFieldSchemaSchema)).optional()
+}).passthrough();
+var contextUiSchema = z.record(z.string(), uiFieldSchemaSchema).optional();
+var contextDataSchema = z.object({
+  data: z.record(z.string(), z.unknown()),
+  ui: contextUiSchema
+}).optional();
+var TASK_CONTEXT_FORMAT_VERSION = 2;
+var taskContextObjectBaseSchema = z.object({
+  /** Source application id; omitted tasks are grouped in the default inbox. */
+  app: z.string().min(1).optional(),
+  type: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional(),
+  validUntil: z.string().optional(),
+  context: contextDataSchema,
+  /** Task context wire format version. @default 2 */
+  contextVersion: z.literal(2).optional(),
+  /** @deprecated Use `contextVersion`. Accepted on ingest only. */
+  version: z.literal(2).optional(),
+  actions: z.array(taskActionSchema).min(1, "At least one action is required")
+});
+function normalizeTaskContextVersion(data) {
+  const { version: legacyVersion, contextVersion, ...rest } = data;
+  return {
+    ...rest,
+    contextVersion: contextVersion ?? legacyVersion ?? TASK_CONTEXT_FORMAT_VERSION
+  };
+}
+var taskContextObjectSchema = taskContextObjectBaseSchema.transform(
+  normalizeTaskContextVersion
+);
+function refineContextPublicUrls(data, ctx) {
+  const error = validateContextPublicUrls(data.context);
+  if (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: error,
+      path: ["context"]
+    });
+  }
+}
+var taskContextSchema = taskContextObjectSchema.superRefine(
+  refineContextPublicUrls
+);
+var assignToSchema = z.object({
+  users: z.array(z.string().email()).optional(),
+  groups: z.array(z.string().min(1)).optional()
+}).refine(
+  (data) => {
+    const groups = data.groups ?? [];
+    if (groups.includes("all") && groups.length > 1) {
+      return false;
+    }
+    return true;
+  },
+  { message: 'Cannot combine "all" with other group slugs' }
+);
+var threadUpdateMessageSchema = z.string().min(1).max(500);
+var threadUpdateStatuses = [
+  "info",
+  "queued",
+  "running",
+  "waiting",
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var threadUpdateStatusSchema = z.enum(threadUpdateStatuses);
+var threadUpdateInputSchema = z.object({
+  message: threadUpdateMessageSchema,
+  status: threadUpdateStatusSchema.optional()
+});
+var taskPriorities = ["low", "normal", "high", "urgent"];
+var taskPrioritySchema = z.enum(taskPriorities);
+var agentTelemetrySchema = z.object({
+  /** Agent or app version (semver, git SHA, deploy tag — caller-defined). */
+  version: z.string().min(1)
+});
+var createTaskBodySchema = taskContextObjectBaseSchema.extend({
+  assignTo: assignToSchema.optional(),
+  /**
+   * Groups related tasks together. When omitted, the server generates one and
+   * returns it so the caller can reuse it on later tasks in the same thread.
+   */
+  threadId: z.string().min(1).optional(),
+  /**
+   * Optional thread priority. When set, applies to the whole thread and
+   * overwrites any previous priority. Omit on later tasks to leave unchanged.
+   */
+  priority: taskPrioritySchema.optional(),
+  /**
+   * Optional initial status update logged against the task's thread. Shows in
+   * the inbox status bar and the thread update log.
+   */
+  update: threadUpdateInputSchema.optional(),
+  /** Agent release version — not shown in inbox UI. */
+  agent: agentTelemetrySchema.optional()
+}).transform(normalizeTaskContextVersion).superRefine(refineContextPublicUrls);
+var agentChatSeedActionSchema = z.object({
+  /** Stable action id echoed back on submit; auto-derived from title when omitted. */
+  id: z.string().min(1).optional(),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  /** JSON Schema object for the form fields. */
+  schema: z.record(z.string(), z.unknown()).optional(),
+  /** RJSF ui schema overrides (ui:widget, ui:enumNames, etc.). */
+  ui: z.record(z.string(), z.unknown()).optional(),
+  /** Optional default field values. */
+  data: z.record(z.string(), z.unknown()).optional()
+});
+var agentChatSeedMessageSchema = z.object({
+  role: z.enum(["user", "assistant"]),
+  text: z.string().min(1),
+  /** Optional display-name override for the message sender. */
+  senderName: z.string().min(1).optional(),
+  /**
+   * Optional structured input request rendered as a styled RobotRock action
+   * widget below the message text. Use this instead of asking the user to reply
+   * in plain text so the request is always a proper action form.
+   */
+  requestActionInput: z.object({
+    prompt: z.string().optional(),
+    action: agentChatSeedActionSchema
+  }).optional()
+});
+var eveAgentChatTransportSchema = z.object({
+  kind: z.literal("eve"),
+  chatId: z.string().min(1),
+  baseUrl: z.string().url(),
+  sessionId: z.string().optional(),
+  continuationToken: z.string().optional(),
+  streamIndex: z.number().int().nonnegative().optional(),
+  isStreaming: z.boolean().optional()
+});
+var createAgentChatBodySchema = z.object({
+  /** Agent id (eve agent name). Required unless `parentChatId` is set. */
+  agentIdentifier: z.string().min(1).optional(),
+  /** Inherit tenant/connection/agent from an existing chat (agent-spawned chats). */
+  parentChatId: z.string().min(1).optional(),
+  /** Convex tenantEveConnections id; resolved from the tenant when omitted. */
+  eveConnectionId: z.string().min(1).optional(),
+  /** Source application id; groups the chat under an inbox section. */
+  app: z.string().min(1).optional(),
+  /** Email of the user who owns the chat. Required unless `parentChatId` is set. */
+  ownerEmail: z.string().email().optional(),
+  title: z.string().min(1),
+  messages: z.array(agentChatSeedMessageSchema).default([]),
+  /** Provenance label stored on the session ("cron" | "agent" | ...). */
+  source: z.string().min(1).optional()
+}).refine((data) => Boolean(data.agentIdentifier || data.parentChatId), {
+  message: "Provide either agentIdentifier or parentChatId"
+}).refine((data) => Boolean(data.ownerEmail || data.parentChatId), {
+  message: "Provide ownerEmail unless parentChatId is set"
+});
+var agentChatAuditToolBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  toolCallId: z.string().min(1),
+  toolName: z.string().min(1),
+  input: z.record(z.string(), z.unknown()).default({}),
+  success: z.boolean(),
+  status: z.enum(["completed", "failed", "rejected"]),
+  error: z.string().optional(),
+  idempotencyKey: z.string().optional()
+});
+var agentChatAuditInputBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  actionId: z.string().min(1),
+  actionTitle: z.string().optional(),
+  prompt: z.string().optional(),
+  data: z.record(z.string(), z.unknown()).optional(),
+  idempotencyKey: z.string().optional(),
+  /** Eve input request id — used to merge staged HITL metadata. */
+  requestId: z.string().optional(),
+  /** Eve tool call id — fallback lookup for staged HITL metadata. */
+  toolCallId: z.string().optional()
+});
+var eveHitlStagedOptionSchema = z.object({
+  id: z.string(),
+  label: z.string()
+});
+var agentChatStageHitlBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  requests: z.array(
+    z.object({
+      requestId: z.string().min(1),
+      toolCallId: z.string().min(1),
+      toolName: z.string().min(1),
+      prompt: z.string().min(1),
+      display: z.enum(["confirmation", "select", "text"]).optional(),
+      allowFreeform: z.boolean().optional(),
+      options: z.array(eveHitlStagedOptionSchema).optional(),
+      toolInput: z.record(z.string(), z.unknown()).optional()
+    })
+  )
+});
+var agentChatLinkTaskBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  publicTaskId: z.string().min(1),
+  toolCallId: z.string().min(1)
+});
+
+// ../core/src/schemas/tool-result-display.ts
+import { z as z2 } from "zod";
+var toolDisplayMetadataSchema = z2.object({
+  widget: z2.string().optional(),
+  title: z2.string().optional(),
+  description: z2.string().optional()
+});
+var toolDisplayEnvelopeSchema = z2.object({
+  display: toolDisplayMetadataSchema.optional(),
+  data: z2.record(z2.string(), z2.unknown()),
+  ui: z2.record(
+    z2.string(),
+    z2.object({
+      "ui:widget": z2.string().optional(),
+      "ui:title": z2.string().optional(),
+      "ui:description": z2.string().optional(),
+      "ui:options": z2.record(z2.string(), z2.unknown()).optional()
+    }).passthrough()
+  ).optional()
+});
+
+// ../core/src/schemas/agent-admin.ts
+import { z as z3 } from "zod";
+var tenantRoleSchema = z3.enum(["admin", "member"]);
+var agentAdminUserSchema = z3.object({
+  id: z3.string(),
+  email: z3.string().email(),
+  name: z3.string()
+});
+var agentAdminMemberSchema = z3.object({
+  userId: z3.string(),
+  role: z3.string(),
+  membershipKind: z3.enum(["team", "assignee"]),
+  hasLoggedIn: z3.boolean(),
+  user: agentAdminUserSchema
+});
+var agentAdminGroupSchema = z3.object({
+  id: z3.string(),
+  name: z3.string(),
+  slug: z3.string(),
+  description: z3.string().nullable(),
+  memberCount: z3.number().optional()
+});
+var agentAdminGroupDetailSchema = agentAdminGroupSchema.extend({
+  members: z3.array(
+    z3.object({
+      userId: z3.string(),
+      user: agentAdminUserSchema
+    })
+  )
+});
+var agentAdminTaskSummarySchema = z3.object({
+  id: z3.string(),
+  convexId: z3.string(),
+  status: z3.string(),
+  type: z3.string().nullable(),
+  name: z3.string().nullable(),
+  description: z3.string().nullable(),
+  validUntil: z3.number(),
+  createdAt: z3.number(),
+  threadPriority: z3.string().nullable(),
+  handledByUserId: z3.string().nullable()
+});
+var inviteMemberBodySchema = z3.object({
+  email: z3.string().email(),
+  role: tenantRoleSchema.optional()
+});
+var updateMemberRoleBodySchema = z3.object({
+  role: tenantRoleSchema
+});
+var createGroupBodySchema = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().optional()
+});
+var updateGroupBodySchema = z3.object({
+  name: z3.string().min(1).optional(),
+  description: z3.string().optional()
+});
+var addGroupMemberBodySchema = z3.object({
+  userId: z3.string().min(1).describe("Convex user id or member email.")
+});
+var listTasksQuerySchema = z3.object({
+  statusFilter: z3.enum(["all", "open", "handled", "expired"]).optional(),
+  typeFilter: z3.string().optional(),
+  appFilter: z3.string().optional(),
+  sortField: z3.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z3.enum(["asc", "desc"]).optional(),
+  limit: z3.coerce.number().int().positive().max(100).optional(),
+  cursor: z3.string().optional()
+});
+var searchTasksQuerySchema = z3.object({
+  q: z3.string().min(1),
+  limit: z3.coerce.number().int().positive().max(100).optional()
+});
+var assignTasksResultSchema = z3.object({
+  taskId: z3.string(),
+  success: z3.boolean(),
+  message: z3.string().optional(),
+  name: z3.string().nullable().optional(),
+  description: z3.string().nullable().optional(),
+  type: z3.string().nullable().optional()
+});
+var assignTasksResponseSchema = z3.object({
+  results: z3.array(assignTasksResultSchema)
+});
+var assignTasksBodySchema = z3.object({
+  taskIds: z3.array(z3.string().min(1)).min(1).max(100),
+  assignTo: assignToSchema.refine(
+    (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+    { message: "assignTo needs at least one user email or group slug." }
+  )
+});
+
+// ../core/src/handler-retry.ts
+var HANDLER_RETRY_DELAYS_MS = [
+  6e4,
+  // 1m
+  3e5,
+  // 5m
+  18e5,
+  // 30m
+  36e5,
+  // 1h
+  216e5,
+  // 6h
+  864e5,
+  // 24h
+  1728e5
+  // 48h
+];
+var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
+
+// ../core/src/attribution/index.ts
+import { z as z4 } from "zod";
+
+// ../core/src/app-url.ts
+var PRODUCTION_APP_URL = "https://app.robotrock.io";
+var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
+var DEV_API_URL = "http://localhost:4001/v1";
+var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
+function normalizeRobotRockApiBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  if (trimmed.endsWith("/v1")) {
+    return trimmed;
+  }
+  return `${trimmed}/v1`;
+}
+function getRobotRockApiBaseUrl() {
+  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
+  if (explicit) {
+    return normalizeRobotRockApiBaseUrl(explicit);
+  }
+  if (process.env.NODE_ENV === "production") {
+    return PRODUCTION_API_URL;
+  }
+  return DEV_API_URL;
+}
+
+// ../core/src/attribution/index.ts
+var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
+var attributionSchema = z4.object({
+  utmSource: z4.string().optional(),
+  utmMedium: z4.string().optional(),
+  utmCampaign: z4.string().optional(),
+  utmContent: z4.string().optional(),
+  utmTerm: z4.string().optional(),
+  gclid: z4.string().optional(),
+  landingUrl: z4.string().optional(),
+  referrer: z4.string().optional(),
+  capturedAt: z4.number()
+});
+
+// src/auth-headers.ts
+var ROBOTROCK_ACTING_USER_ID_HEADER = "x-robotrock-acting-user-id";
+function buildRobotRockAuthHeaders(auth) {
+  if (auth.kind === "apiKey") {
+    const headers2 = {
+      "X-Api-Key": auth.apiKey
+    };
+    if (auth.actingUserId?.trim()) {
+      headers2[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+    }
+    return headers2;
+  }
+  const headers = {
+    Authorization: `Bearer ${auth.token}`,
+    "X-RobotRock-Tenant-Slug": auth.tenantSlug,
+    "X-RobotRock-Connection-Id": auth.connectionId
+  };
+  if (auth.actingUserId?.trim()) {
+    headers[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+  }
+  return headers;
+}
+function resolveRobotRockAuthConfig(overrides) {
+  if (overrides?.agentService) {
+    return {
+      kind: "agentService",
+      ...overrides.agentService
+    };
+  }
+  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock auth is required. Set ROBOTROCK_API_KEY, ROBOTROCK_AGENT_SERVICE_TOKEN with tenant context, or pass auth when creating the client."
+    );
+  }
+  return { kind: "apiKey", apiKey };
+}
+
+// src/eve/agent/attributes.ts
+function readStringAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function readStringArrayAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+  }
+  return [];
+}
+function parseTenantRole(value) {
+  if (value === "admin" || value === "member") {
+    return value;
+  }
+  return null;
+}
+
+// src/eve/agent/tenant.ts
+function tryResolveTenantCaller(ctx) {
+  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;
+  if (caller?.principalType !== "user") {
+    return null;
+  }
+  const email = readStringAttribute(caller.attributes, "email");
+  const name = readStringAttribute(caller.attributes, "name");
+  const tenantSlug = readStringAttribute(caller.attributes, "tenantSlug") ?? readStringAttribute(caller.attributes, "tenantId");
+  const role = parseTenantRole(readStringAttribute(caller.attributes, "role"));
+  if (!email || !tenantSlug || !caller.principalId || !role) {
+    return null;
+  }
+  const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
+  const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const groups = readStringArrayAttribute(caller.attributes, "groups");
+  return {
+    userId: caller.principalId,
+    email,
+    name: name ?? email.split("@")[0] ?? email,
+    tenantSlug,
+    ...connectionId ? { connectionId } : {},
+    role,
+    isAdmin: role === "admin",
+    groups,
+    ...workosUserId ? { workosUserId } : {}
+  };
+}
+function requireTenantCaller(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  if (!caller) {
+    throw new Error("An authenticated RobotRock tenant user is required.");
+  }
+  return caller;
+}
+function requireAdminCaller(ctx) {
+  const caller = requireTenantCaller(ctx);
+  if (!caller.isAdmin) {
+    throw new Error("Tenant admin access is required.");
+  }
+  return caller;
+}
+
+// src/agent-admin.ts
+async function agentAdminFetch(config, path, init) {
+  const baseUrl = (config.baseUrl?.trim() || getRobotRockApiBaseUrl()).replace(
+    /\/+$/,
+    ""
+  );
+  const url = `${baseUrl}/agent-admin${path}`;
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...buildRobotRockAuthHeaders(config.auth),
+      ...init?.headers ?? {}
+    }
+  });
+  const data = await parseResponseBody(response);
+  if (!response.ok) {
+    throw new RobotRockError(
+      getErrorMessage(data, `Agent admin request failed (${response.status})`),
+      response.status,
+      data
+    );
+  }
+  return data;
+}
+function createAgentAdminApi(config) {
+  return {
+    members: {
+      list: () => agentAdminFetch(config, "/members"),
+      get: (memberRef) => agentAdminFetch(config, `/members/${encodeURIComponent(memberRef)}`),
+      invite: (body) => agentAdminFetch(config, "/members", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      updateRole: (memberRef, role) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberRef)}/role`,
+        {
+          method: "PATCH",
+          body: JSON.stringify({ role })
+        }
+      ),
+      remove: (memberId) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberId)}`,
+        {
+          method: "DELETE"
+        }
+      )
+    },
+    groups: {
+      list: () => agentAdminFetch(config, "/groups"),
+      get: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`
+      ),
+      create: (body) => agentAdminFetch(config, "/groups", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      update: (groupId, body) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(body)
+        }
+      ),
+      delete: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "DELETE"
+        }
+      ),
+      addMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members`,
+        {
+          method: "POST",
+          body: JSON.stringify({ userId: memberRef })
+        }
+      ),
+      removeMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members/${encodeURIComponent(memberRef)}`,
+        { method: "DELETE" }
+      )
+    },
+    tasks: {
+      list: (query) => {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query ?? {})) {
+          if (value !== void 0 && value !== "") {
+            params.set(key, String(value));
+          }
+        }
+        const suffix = params.size > 0 ? `?${params.toString()}` : "";
+        return agentAdminFetch(
+          config,
+          `/tasks${suffix}`
+        );
+      },
+      search: (q, limit) => {
+        const params = new URLSearchParams({ q });
+        if (limit !== void 0) {
+          params.set("limit", String(limit));
+        }
+        return agentAdminFetch(
+          config,
+          `/tasks/search?${params.toString()}`
+        );
+      },
+      get: (taskId) => agentAdminFetch(config, `/tasks/${taskId}`),
+      assign: (body) => agentAdminFetch(config, "/tasks/assign", {
+        method: "POST",
+        body: JSON.stringify(body)
+      })
+    }
+  };
+}
+function createBoundAgentAdminClient(ctx) {
+  const caller = requireTenantCaller(ctx);
+  const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
+  const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  if (caller.connectionId && serviceToken) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: resolveRobotRockAuthConfig({
+        agentService: {
+          token: serviceToken,
+          tenantSlug: caller.tenantSlug,
+          connectionId: caller.connectionId,
+          actingUserId: caller.userId
+        }
+      })
+    });
+  }
+  const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
+  if (apiKey) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: {
+        kind: "apiKey",
+        apiKey,
+        actingUserId: caller.userId
+      }
+    });
+  }
+  throw new Error(
+    "Agent admin auth is unset. Set ROBOTROCK_AGENT_SERVICE_TOKEN for hosted multi-tenant agents, or ROBOTROCK_API_KEY for self-hosted and localhost deployments."
+  );
+}
+function requireBoundAgentAdminClient(ctx) {
+  requireAdminCaller(ctx);
+  return createBoundAgentAdminClient(ctx);
+}
+
+// src/eve/tool-result-display.ts
+function toolDisplayResult(data, options) {
+  const display = options?.widget || options?.title || options?.description ? {
+    ...options.widget ? { widget: options.widget } : {},
+    ...options.title ? { title: options.title } : {},
+    ...options.description ? { description: options.description } : {}
+  } : void 0;
+  return {
+    ...display ? { display } : {},
+    data,
+    ...options?.ui ? { ui: options.ui } : {}
+  };
+}
+
+// src/eve/tool-reply-guidance.ts
+var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
+var MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE = "Team members render as a list card in chat. Do not restate names, emails, or roles from the list. Only add context not shown (e.g. duplicates, next admin actions).";
+var MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE = "Team member details render in chat UI. Do not restate name, email, or role from the card. Only add next steps or policy context.";
+var ADMIN_MUTATION_REPLY_GUIDANCE = "The action result renders in chat UI. Do not restate fields already visible in the card. Confirm outcome briefly or add next steps only.";
+function withReplyGuidance(result, guidance) {
+  return {
+    ...result,
+    [TOOL_REPLY_GUIDANCE_FIELD]: guidance
+  };
+}
+
+// src/eve/tool-display-format.ts
+function formatToolObjectResult(data, options) {
+  return withReplyGuidance(
+    toolDisplayResult(data, {
+      title: options.title,
+      description: options.description,
+      ui: options.ui
+    }),
+    options.replyGuidance
+  );
+}
+function formatToolListResult(listKey, items, options) {
+  const listFieldUi = options.itemWidget ? {
+    "ui:widget": "list",
+    items: {
+      "ui:widget": options.itemWidget,
+      ...options.itemUi ?? {}
+    }
+  } : {
+    "ui:widget": "table",
+    ...options.itemUi ? { items: options.itemUi } : {}
+  };
+  return formatToolObjectResult(
+    { [listKey]: items },
+    {
+      title: options.title,
+      ui: {
+        [listKey]: listFieldUi
+      },
+      replyGuidance: options.replyGuidance
+    }
+  );
+}
+
+// src/eve/tools/admin/format-team-members-list.ts
+var MEMBER_DETAIL_UI = {
+  name: { "ui:title": "Name" },
+  email: { "ui:title": "Email" },
+  role: { "ui:title": "Role" },
+  membershipKind: { "ui:title": "Membership" }
+};
+function serializeMemberRow(member) {
+  return {
+    name: member.user.name,
+    email: member.user.email,
+    role: member.role,
+    membershipKind: member.membershipKind
+  };
+}
+function formatTeamMembersListResult(members) {
+  const countLabel = members.length === 1 ? "1 team member" : `${members.length} team members`;
+  return formatToolListResult(
+    "members",
+    members.map(serializeMemberRow),
+    {
+      title: countLabel,
+      itemWidget: "tenantMember",
+      replyGuidance: MANAGE_TEAM_MEMBERS_LIST_REPLY_GUIDANCE
+    }
+  );
+}
+function formatTeamMemberDetailResult(member, options) {
+  return formatToolObjectResult(serializeMemberRow(member), {
+    title: options?.title ?? member.user.name,
+    ui: MEMBER_DETAIL_UI,
+    replyGuidance: MANAGE_TEAM_MEMBERS_DETAIL_REPLY_GUIDANCE
+  });
+}
+
+// src/eve/tools/admin/manage-team-members.ts
+import { defineTool } from "eve/tools";
+import { z as z5 } from "zod";
+var MANAGE_TEAM_MEMBERS_TOOL_NAME = "manage_team_members";
+var manageTeamMembersInputSchema = z5.object({
+  action: z5.enum(["list", "get", "invite", "update_role", "remove"]),
+  userId: z5.string().min(1).optional().describe(
+    "Convex users table id for get, update_role, and remove. Prefer email when the member list only shows email."
+  ),
+  email: z5.string().email().optional().describe(
+    "Member email for get, update_role, and remove; invitee email for invite."
+  ),
+  role: z5.enum(["admin", "member"]).optional().describe("Role for invite and update_role.")
+}).superRefine((input, ctx) => {
+  const requireField = (field, message) => {
+    if (!input[field]) {
+      ctx.addIssue({ code: "custom", message, path: [field] });
+    }
+  };
+  const requireUserIdOrEmail = (message) => {
+    if (!input.userId && !input.email) {
+      ctx.addIssue({ code: "custom", message, path: ["email"] });
+    }
+  };
+  switch (input.action) {
+    case "get":
+      requireUserIdOrEmail("userId or email is required for this action.");
+      break;
+    case "remove":
+      requireUserIdOrEmail(
+        "userId or email is required when removing a member."
+      );
+      break;
+    case "invite":
+      requireField("email", "email is required when inviting a member.");
+      break;
+    case "update_role":
+      requireUserIdOrEmail(
+        "userId or email is required when updating a role."
+      );
+      requireField("role", "role is required when updating a role.");
+      break;
+  }
+});
+function resolveMemberRef(input) {
+  return input.userId ?? input.email;
+}
+function formatMemberMutationResult(payload, title) {
+  return formatToolObjectResult(payload, {
+    title,
+    ui: {
+      success: { "ui:title": "Success", "ui:widget": "boolean" },
+      promoted: { "ui:title": "Promoted existing user", "ui:widget": "boolean" }
+    },
+    replyGuidance: ADMIN_MUTATION_REPLY_GUIDANCE
+  });
+}
+function defineManageTeamMembersTool() {
+  return defineTool({
+    description: "Tenant-admin tool for workspace team members: list, get, invite, change role, or remove. Requires tenant admin access. Use member email from list results for get, update_role, and remove \u2014 internal ids are optional. Results render as chat UI cards \u2014 do not restate member names, emails, or roles in your reply.",
+    inputSchema: manageTeamMembersInputSchema,
+    async execute(input, ctx) {
+      const api = requireBoundAgentAdminClient(ctx);
+      try {
+        switch (input.action) {
+          case "list": {
+            const result = await api.members.list();
+            return formatTeamMembersListResult(
+              result.members
+            );
+          }
+          case "get": {
+            const result = await api.members.get(resolveMemberRef(input));
+            return formatTeamMemberDetailResult(result.member);
+          }
+          case "invite": {
+            const result = await api.members.invite({
+              email: input.email,
+              role: input.role
+            });
+            if (result.member) {
+              return formatTeamMemberDetailResult(
+                result.member,
+                { title: "Member invited" }
+              );
+            }
+            return formatMemberMutationResult(
+              result,
+              "Invitation sent"
+            );
+          }
+          case "update_role": {
+            const result = await api.members.updateRole(
+              resolveMemberRef(input),
+              input.role
+            );
+            return formatMemberMutationResult(
+              result,
+              "Member role updated"
+            );
+          }
+          case "remove": {
+            const memberId = resolveMemberRef(input);
+            const result = await api.members.remove(memberId);
+            return formatMemberMutationResult(
+              result,
+              "Member removed"
+            );
+          }
+        }
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var manageTeamMembersTool = defineManageTeamMembersTool();
+export {
+  MANAGE_TEAM_MEMBERS_TOOL_NAME,
+  defineManageTeamMembersTool,
+  manageTeamMembersInputSchema,
+  manageTeamMembersTool
+};
+//# sourceMappingURL=manage-team-members.js.map