robotrock 1.0.0 → 1.3.0

package/dist/eve/tools/admin/query-tasks.js

@@ -0,0 +1,1161 @@
+// src/eve/tools/admin/query-tasks.ts
+import { defineTool } from "eve/tools";
+import { z as z5 } from "zod";
+
+// src/http.ts
+var RobotRockError = class extends Error {
+  constructor(message, statusCode, response) {
+    super(message);
+    this.statusCode = statusCode;
+    this.response = response;
+    this.name = "RobotRockError";
+  }
+};
+async function parseResponseBody(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  const bodyText = await response.text();
+  if (!bodyText) {
+    return null;
+  }
+  if (contentType.toLowerCase().includes("application/json")) {
+    try {
+      return JSON.parse(bodyText);
+    } catch {
+    }
+  }
+  try {
+    return JSON.parse(bodyText);
+  } catch {
+    return bodyText;
+  }
+}
+function getErrorMessage(data, fallback) {
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const record = data;
+    const maybeMessage = record.message;
+    const maybeHint = record.hint;
+    if (typeof maybeMessage === "string" && maybeMessage.trim()) {
+      if (typeof maybeHint === "string" && maybeHint.trim()) {
+        return `${maybeMessage.trim()} ${maybeHint.trim()}`;
+      }
+      return maybeMessage;
+    }
+  }
+  if (typeof data === "string" && data.trim()) {
+    const compact = data.replace(/\s+/g, " ").trim();
+    const snippet = compact.length > 180 ? `${compact.slice(0, 180)}...` : compact;
+    return `${fallback}. Server returned non-JSON response: ${snippet}`;
+  }
+  return fallback;
+}
+
+// ../core/src/schemas/task.ts
+import { z } from "zod";
+
+// ../core/src/utils/safe-url.ts
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.goog"
+]);
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number(part));
+  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a, b, _c, _d] = octets;
+  if (a === void 0 || b === void 0) {
+    return true;
+  }
+  if (a === 127 || a === 0) return true;
+  if (a === 10) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromNumericHost(host) {
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
+  if (hexMatch) {
+    const num = Number.parseInt(hexMatch[1], 16);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  return null;
+}
+function isBlockedIpv4Mapped(host) {
+  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
+  if (mappedDotted) {
+    return isBlockedIpv4(mappedDotted[1]);
+  }
+  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+  if (mappedHex) {
+    const high = Number.parseInt(mappedHex[1], 16);
+    const low = Number.parseInt(mappedHex[2], 16);
+    if (Number.isFinite(high) && Number.isFinite(low)) {
+      const a = high >> 8 & 255;
+      const b = high & 255;
+      const c = low >> 8 & 255;
+      const d = low & 255;
+      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
+    }
+  }
+  return false;
+}
+function isBlockedIpv6(host) {
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  if (host.startsWith("fc") || host.startsWith("fd")) {
+    return true;
+  }
+  if (host.startsWith("fe80:")) {
+    return true;
+  }
+  if (isBlockedIpv4Mapped(host)) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  if (!host) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(host)) {
+    return true;
+  }
+  if (host.endsWith(".localhost") || host.endsWith(".local")) {
+    return true;
+  }
+  const numericIpv4 = ipv4FromNumericHost(host);
+  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
+    return true;
+  }
+  return isBlockedIpv4(host) || isBlockedIpv6(host);
+}
+function isLoopbackHandlerUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function isAllowedHandlerUrl(urlString) {
+  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
+}
+function isPublicHttpUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  return !isBlockedHostname(url.hostname);
+}
+var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
+var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
+
+// ../core/src/schemas/context-urls.ts
+function resolveLinkUrl(value) {
+  return value.startsWith("http://") || value.startsWith("https://") ? value : `https://${value}`;
+}
+function widgetType(ui, field) {
+  const fieldUi = ui?.[field];
+  if (typeof fieldUi !== "object" || fieldUi === null) {
+    return void 0;
+  }
+  const widget = fieldUi["ui:widget"];
+  return typeof widget === "string" ? widget : void 0;
+}
+function validateUrlValue(value, widget) {
+  if (widget === "image" || widget === "link") {
+    if (typeof value !== "string") {
+      return PUBLIC_HTTP_URL_ERROR;
+    }
+    const url = widget === "link" ? resolveLinkUrl(value) : value;
+    if (!isPublicHttpUrl(url)) {
+      return PUBLIC_HTTP_URL_ERROR;
+    }
+    return null;
+  }
+  if (widget === "attachments" && Array.isArray(value)) {
+    for (const item of value) {
+      if (typeof item !== "object" || item === null) {
+        continue;
+      }
+      const url = item.url;
+      if (typeof url === "string" && !isPublicHttpUrl(resolveLinkUrl(url))) {
+        return PUBLIC_HTTP_URL_ERROR;
+      }
+    }
+  }
+  return null;
+}
+function validateContextPublicUrls(context) {
+  if (!context?.data) {
+    return null;
+  }
+  for (const [field, value] of Object.entries(context.data)) {
+    const widget = widgetType(context.ui, field);
+    if (!widget) {
+      continue;
+    }
+    const error = validateUrlValue(value, widget);
+    if (error) {
+      return `context.data.${field}: ${error}`;
+    }
+  }
+  return null;
+}
+
+// ../core/src/schemas/task.ts
+var safeUrlSchema = z.string().refine((url) => isPublicHttpUrl(url), {
+  message: PUBLIC_HTTP_URL_ERROR
+});
+var handlerUrlSchema = z.string().refine((url) => isAllowedHandlerUrl(url), {
+  message: HANDLER_URL_ERROR
+});
+var jsonSchema7Schema = z.custom(
+  (val) => typeof val === "object" && val !== null,
+  { message: "Must be a valid JSON Schema object" }
+);
+var uiSchemaSchema = z.custom((val) => typeof val === "object" && val !== null, {
+  message: "Must be a valid UiSchema object"
+});
+var webhookHandlerSchema = z.object({
+  type: z.literal("webhook"),
+  url: handlerUrlSchema,
+  headers: z.record(z.string(), z.string())
+});
+var triggerHandlerSchema = webhookHandlerSchema.extend({
+  type: z.literal("trigger"),
+  tokenId: z.string().min(1)
+});
+var handlerSchema = z.discriminatedUnion("type", [webhookHandlerSchema, triggerHandlerSchema]);
+var taskActionInputSchema = z.object({
+  id: z.string().min(1),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  schema: jsonSchema7Schema.optional(),
+  ui: uiSchemaSchema.optional(),
+  data: z.record(z.string(), z.unknown()).optional()
+});
+var taskActionSchema = taskActionInputSchema.extend({
+  // Optional handlers for this action - if present, must have at least 1
+  handlers: z.array(handlerSchema).min(1).optional()
+});
+var uiFieldSchemaSchema = z.object({
+  "ui:widget": z.string().optional(),
+  "ui:title": z.string().optional(),
+  "ui:description": z.string().optional(),
+  "ui:options": z.record(z.string(), z.unknown()).optional(),
+  items: z.lazy(() => z.record(z.string(), uiFieldSchemaSchema)).optional()
+}).passthrough();
+var contextUiSchema = z.record(z.string(), uiFieldSchemaSchema).optional();
+var contextDataSchema = z.object({
+  data: z.record(z.string(), z.unknown()),
+  ui: contextUiSchema
+}).optional();
+var TASK_CONTEXT_FORMAT_VERSION = 2;
+var taskContextObjectBaseSchema = z.object({
+  /** Source application id; omitted tasks are grouped in the default inbox. */
+  app: z.string().min(1).optional(),
+  type: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional(),
+  validUntil: z.string().optional(),
+  context: contextDataSchema,
+  /** Task context wire format version. @default 2 */
+  contextVersion: z.literal(2).optional(),
+  /** @deprecated Use `contextVersion`. Accepted on ingest only. */
+  version: z.literal(2).optional(),
+  actions: z.array(taskActionSchema).min(1, "At least one action is required")
+});
+function normalizeTaskContextVersion(data) {
+  const { version: legacyVersion, contextVersion, ...rest } = data;
+  return {
+    ...rest,
+    contextVersion: contextVersion ?? legacyVersion ?? TASK_CONTEXT_FORMAT_VERSION
+  };
+}
+var taskContextObjectSchema = taskContextObjectBaseSchema.transform(
+  normalizeTaskContextVersion
+);
+function refineContextPublicUrls(data, ctx) {
+  const error = validateContextPublicUrls(data.context);
+  if (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: error,
+      path: ["context"]
+    });
+  }
+}
+var taskContextSchema = taskContextObjectSchema.superRefine(
+  refineContextPublicUrls
+);
+var assignToSchema = z.object({
+  users: z.array(z.string().email()).optional(),
+  groups: z.array(z.string().min(1)).optional()
+}).refine(
+  (data) => {
+    const groups = data.groups ?? [];
+    if (groups.includes("all") && groups.length > 1) {
+      return false;
+    }
+    return true;
+  },
+  { message: 'Cannot combine "all" with other group slugs' }
+);
+var threadUpdateMessageSchema = z.string().min(1).max(500);
+var threadUpdateStatuses = [
+  "info",
+  "queued",
+  "running",
+  "waiting",
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var threadUpdateStatusSchema = z.enum(threadUpdateStatuses);
+var threadUpdateInputSchema = z.object({
+  message: threadUpdateMessageSchema,
+  status: threadUpdateStatusSchema.optional()
+});
+var taskPriorities = ["low", "normal", "high", "urgent"];
+var taskPrioritySchema = z.enum(taskPriorities);
+var agentTelemetrySchema = z.object({
+  /** Agent or app version (semver, git SHA, deploy tag — caller-defined). */
+  version: z.string().min(1)
+});
+var createTaskBodySchema = taskContextObjectBaseSchema.extend({
+  assignTo: assignToSchema.optional(),
+  /**
+   * Groups related tasks together. When omitted, the server generates one and
+   * returns it so the caller can reuse it on later tasks in the same thread.
+   */
+  threadId: z.string().min(1).optional(),
+  /**
+   * Optional thread priority. When set, applies to the whole thread and
+   * overwrites any previous priority. Omit on later tasks to leave unchanged.
+   */
+  priority: taskPrioritySchema.optional(),
+  /**
+   * Optional initial status update logged against the task's thread. Shows in
+   * the inbox status bar and the thread update log.
+   */
+  update: threadUpdateInputSchema.optional(),
+  /** Agent release version — not shown in inbox UI. */
+  agent: agentTelemetrySchema.optional()
+}).transform(normalizeTaskContextVersion).superRefine(refineContextPublicUrls);
+var agentChatSeedActionSchema = z.object({
+  /** Stable action id echoed back on submit; auto-derived from title when omitted. */
+  id: z.string().min(1).optional(),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  /** JSON Schema object for the form fields. */
+  schema: z.record(z.string(), z.unknown()).optional(),
+  /** RJSF ui schema overrides (ui:widget, ui:enumNames, etc.). */
+  ui: z.record(z.string(), z.unknown()).optional(),
+  /** Optional default field values. */
+  data: z.record(z.string(), z.unknown()).optional()
+});
+var agentChatSeedMessageSchema = z.object({
+  role: z.enum(["user", "assistant"]),
+  text: z.string().min(1),
+  /** Optional display-name override for the message sender. */
+  senderName: z.string().min(1).optional(),
+  /**
+   * Optional structured input request rendered as a styled RobotRock action
+   * widget below the message text. Use this instead of asking the user to reply
+   * in plain text so the request is always a proper action form.
+   */
+  requestActionInput: z.object({
+    prompt: z.string().optional(),
+    action: agentChatSeedActionSchema
+  }).optional()
+});
+var eveAgentChatTransportSchema = z.object({
+  kind: z.literal("eve"),
+  chatId: z.string().min(1),
+  baseUrl: z.string().url(),
+  sessionId: z.string().optional(),
+  continuationToken: z.string().optional(),
+  streamIndex: z.number().int().nonnegative().optional(),
+  isStreaming: z.boolean().optional()
+});
+var createAgentChatBodySchema = z.object({
+  /** Agent id (eve agent name). Required unless `parentChatId` is set. */
+  agentIdentifier: z.string().min(1).optional(),
+  /** Inherit tenant/connection/agent from an existing chat (agent-spawned chats). */
+  parentChatId: z.string().min(1).optional(),
+  /** Convex tenantEveConnections id; resolved from the tenant when omitted. */
+  eveConnectionId: z.string().min(1).optional(),
+  /** Source application id; groups the chat under an inbox section. */
+  app: z.string().min(1).optional(),
+  /** Email of the user who owns the chat. Required unless `parentChatId` is set. */
+  ownerEmail: z.string().email().optional(),
+  title: z.string().min(1),
+  messages: z.array(agentChatSeedMessageSchema).default([]),
+  /** Provenance label stored on the session ("cron" | "agent" | ...). */
+  source: z.string().min(1).optional()
+}).refine((data) => Boolean(data.agentIdentifier || data.parentChatId), {
+  message: "Provide either agentIdentifier or parentChatId"
+}).refine((data) => Boolean(data.ownerEmail || data.parentChatId), {
+  message: "Provide ownerEmail unless parentChatId is set"
+});
+var agentChatAuditToolBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  toolCallId: z.string().min(1),
+  toolName: z.string().min(1),
+  input: z.record(z.string(), z.unknown()).default({}),
+  success: z.boolean(),
+  status: z.enum(["completed", "failed", "rejected"]),
+  error: z.string().optional(),
+  idempotencyKey: z.string().optional()
+});
+var agentChatAuditInputBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  actionId: z.string().min(1),
+  actionTitle: z.string().optional(),
+  prompt: z.string().optional(),
+  data: z.record(z.string(), z.unknown()).optional(),
+  idempotencyKey: z.string().optional(),
+  /** Eve input request id — used to merge staged HITL metadata. */
+  requestId: z.string().optional(),
+  /** Eve tool call id — fallback lookup for staged HITL metadata. */
+  toolCallId: z.string().optional()
+});
+var eveHitlStagedOptionSchema = z.object({
+  id: z.string(),
+  label: z.string()
+});
+var agentChatStageHitlBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  requests: z.array(
+    z.object({
+      requestId: z.string().min(1),
+      toolCallId: z.string().min(1),
+      toolName: z.string().min(1),
+      prompt: z.string().min(1),
+      display: z.enum(["confirmation", "select", "text"]).optional(),
+      allowFreeform: z.boolean().optional(),
+      options: z.array(eveHitlStagedOptionSchema).optional(),
+      toolInput: z.record(z.string(), z.unknown()).optional()
+    })
+  )
+});
+var agentChatLinkTaskBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  publicTaskId: z.string().min(1),
+  toolCallId: z.string().min(1)
+});
+
+// ../core/src/schemas/tool-result-display.ts
+import { z as z2 } from "zod";
+var toolDisplayMetadataSchema = z2.object({
+  widget: z2.string().optional(),
+  title: z2.string().optional(),
+  description: z2.string().optional()
+});
+var toolDisplayEnvelopeSchema = z2.object({
+  display: toolDisplayMetadataSchema.optional(),
+  data: z2.record(z2.string(), z2.unknown()),
+  ui: z2.record(
+    z2.string(),
+    z2.object({
+      "ui:widget": z2.string().optional(),
+      "ui:title": z2.string().optional(),
+      "ui:description": z2.string().optional(),
+      "ui:options": z2.record(z2.string(), z2.unknown()).optional()
+    }).passthrough()
+  ).optional()
+});
+
+// ../core/src/schemas/agent-admin.ts
+import { z as z3 } from "zod";
+var tenantRoleSchema = z3.enum(["admin", "member"]);
+var agentAdminUserSchema = z3.object({
+  id: z3.string(),
+  email: z3.string().email(),
+  name: z3.string()
+});
+var agentAdminMemberSchema = z3.object({
+  userId: z3.string(),
+  role: z3.string(),
+  membershipKind: z3.enum(["team", "assignee"]),
+  hasLoggedIn: z3.boolean(),
+  user: agentAdminUserSchema
+});
+var agentAdminGroupSchema = z3.object({
+  id: z3.string(),
+  name: z3.string(),
+  slug: z3.string(),
+  description: z3.string().nullable(),
+  memberCount: z3.number().optional()
+});
+var agentAdminGroupDetailSchema = agentAdminGroupSchema.extend({
+  members: z3.array(
+    z3.object({
+      userId: z3.string(),
+      user: agentAdminUserSchema
+    })
+  )
+});
+var agentAdminTaskSummarySchema = z3.object({
+  id: z3.string(),
+  convexId: z3.string(),
+  status: z3.string(),
+  type: z3.string().nullable(),
+  name: z3.string().nullable(),
+  description: z3.string().nullable(),
+  validUntil: z3.number(),
+  createdAt: z3.number(),
+  threadPriority: z3.string().nullable(),
+  handledByUserId: z3.string().nullable()
+});
+var inviteMemberBodySchema = z3.object({
+  email: z3.string().email(),
+  role: tenantRoleSchema.optional()
+});
+var updateMemberRoleBodySchema = z3.object({
+  role: tenantRoleSchema
+});
+var createGroupBodySchema = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().optional()
+});
+var updateGroupBodySchema = z3.object({
+  name: z3.string().min(1).optional(),
+  description: z3.string().optional()
+});
+var addGroupMemberBodySchema = z3.object({
+  userId: z3.string().min(1).describe("Convex user id or member email.")
+});
+var listTasksQuerySchema = z3.object({
+  statusFilter: z3.enum(["all", "open", "handled", "expired"]).optional(),
+  typeFilter: z3.string().optional(),
+  appFilter: z3.string().optional(),
+  sortField: z3.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z3.enum(["asc", "desc"]).optional(),
+  limit: z3.coerce.number().int().positive().max(100).optional(),
+  cursor: z3.string().optional()
+});
+var searchTasksQuerySchema = z3.object({
+  q: z3.string().min(1),
+  limit: z3.coerce.number().int().positive().max(100).optional()
+});
+var assignTasksResultSchema = z3.object({
+  taskId: z3.string(),
+  success: z3.boolean(),
+  message: z3.string().optional(),
+  name: z3.string().nullable().optional(),
+  description: z3.string().nullable().optional(),
+  type: z3.string().nullable().optional()
+});
+var assignTasksResponseSchema = z3.object({
+  results: z3.array(assignTasksResultSchema)
+});
+var assignTasksBodySchema = z3.object({
+  taskIds: z3.array(z3.string().min(1)).min(1).max(100),
+  assignTo: assignToSchema.refine(
+    (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+    { message: "assignTo needs at least one user email or group slug." }
+  )
+});
+
+// ../core/src/handler-retry.ts
+var HANDLER_RETRY_DELAYS_MS = [
+  6e4,
+  // 1m
+  3e5,
+  // 5m
+  18e5,
+  // 30m
+  36e5,
+  // 1h
+  216e5,
+  // 6h
+  864e5,
+  // 24h
+  1728e5
+  // 48h
+];
+var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
+
+// ../core/src/attribution/index.ts
+import { z as z4 } from "zod";
+
+// ../core/src/app-url.ts
+var PRODUCTION_APP_URL = "https://app.robotrock.io";
+var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
+var DEV_API_URL = "http://localhost:4001/v1";
+var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
+function normalizeRobotRockApiBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  if (trimmed.endsWith("/v1")) {
+    return trimmed;
+  }
+  return `${trimmed}/v1`;
+}
+function getRobotRockApiBaseUrl() {
+  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
+  if (explicit) {
+    return normalizeRobotRockApiBaseUrl(explicit);
+  }
+  if (process.env.NODE_ENV === "production") {
+    return PRODUCTION_API_URL;
+  }
+  return DEV_API_URL;
+}
+
+// ../core/src/attribution/index.ts
+var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
+var attributionSchema = z4.object({
+  utmSource: z4.string().optional(),
+  utmMedium: z4.string().optional(),
+  utmCampaign: z4.string().optional(),
+  utmContent: z4.string().optional(),
+  utmTerm: z4.string().optional(),
+  gclid: z4.string().optional(),
+  landingUrl: z4.string().optional(),
+  referrer: z4.string().optional(),
+  capturedAt: z4.number()
+});
+
+// src/auth-headers.ts
+var ROBOTROCK_ACTING_USER_ID_HEADER = "x-robotrock-acting-user-id";
+function buildRobotRockAuthHeaders(auth) {
+  if (auth.kind === "apiKey") {
+    const headers2 = {
+      "X-Api-Key": auth.apiKey
+    };
+    if (auth.actingUserId?.trim()) {
+      headers2[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+    }
+    return headers2;
+  }
+  const headers = {
+    Authorization: `Bearer ${auth.token}`,
+    "X-RobotRock-Tenant-Slug": auth.tenantSlug,
+    "X-RobotRock-Connection-Id": auth.connectionId
+  };
+  if (auth.actingUserId?.trim()) {
+    headers[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+  }
+  return headers;
+}
+function resolveRobotRockAuthConfig(overrides) {
+  if (overrides?.agentService) {
+    return {
+      kind: "agentService",
+      ...overrides.agentService
+    };
+  }
+  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock auth is required. Set ROBOTROCK_API_KEY, ROBOTROCK_AGENT_SERVICE_TOKEN with tenant context, or pass auth when creating the client."
+    );
+  }
+  return { kind: "apiKey", apiKey };
+}
+
+// src/eve/agent/attributes.ts
+function readStringAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function readStringArrayAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+  }
+  return [];
+}
+function parseTenantRole(value) {
+  if (value === "admin" || value === "member") {
+    return value;
+  }
+  return null;
+}
+
+// src/eve/agent/tenant.ts
+function tryResolveTenantCaller(ctx) {
+  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;
+  if (caller?.principalType !== "user") {
+    return null;
+  }
+  const email = readStringAttribute(caller.attributes, "email");
+  const name = readStringAttribute(caller.attributes, "name");
+  const tenantSlug = readStringAttribute(caller.attributes, "tenantSlug") ?? readStringAttribute(caller.attributes, "tenantId");
+  const role = parseTenantRole(readStringAttribute(caller.attributes, "role"));
+  if (!email || !tenantSlug || !caller.principalId || !role) {
+    return null;
+  }
+  const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
+  const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const groups = readStringArrayAttribute(caller.attributes, "groups");
+  return {
+    userId: caller.principalId,
+    email,
+    name: name ?? email.split("@")[0] ?? email,
+    tenantSlug,
+    ...connectionId ? { connectionId } : {},
+    role,
+    isAdmin: role === "admin",
+    groups,
+    ...workosUserId ? { workosUserId } : {}
+  };
+}
+function requireTenantCaller(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  if (!caller) {
+    throw new Error("An authenticated RobotRock tenant user is required.");
+  }
+  return caller;
+}
+function requireAdminCaller(ctx) {
+  const caller = requireTenantCaller(ctx);
+  if (!caller.isAdmin) {
+    throw new Error("Tenant admin access is required.");
+  }
+  return caller;
+}
+
+// src/agent-admin.ts
+async function agentAdminFetch(config, path, init) {
+  const baseUrl = (config.baseUrl?.trim() || getRobotRockApiBaseUrl()).replace(
+    /\/+$/,
+    ""
+  );
+  const url = `${baseUrl}/agent-admin${path}`;
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...buildRobotRockAuthHeaders(config.auth),
+      ...init?.headers ?? {}
+    }
+  });
+  const data = await parseResponseBody(response);
+  if (!response.ok) {
+    throw new RobotRockError(
+      getErrorMessage(data, `Agent admin request failed (${response.status})`),
+      response.status,
+      data
+    );
+  }
+  return data;
+}
+function createAgentAdminApi(config) {
+  return {
+    members: {
+      list: () => agentAdminFetch(config, "/members"),
+      get: (memberRef) => agentAdminFetch(config, `/members/${encodeURIComponent(memberRef)}`),
+      invite: (body) => agentAdminFetch(config, "/members", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      updateRole: (memberRef, role) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberRef)}/role`,
+        {
+          method: "PATCH",
+          body: JSON.stringify({ role })
+        }
+      ),
+      remove: (memberId) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberId)}`,
+        {
+          method: "DELETE"
+        }
+      )
+    },
+    groups: {
+      list: () => agentAdminFetch(config, "/groups"),
+      get: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`
+      ),
+      create: (body) => agentAdminFetch(config, "/groups", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      update: (groupId, body) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(body)
+        }
+      ),
+      delete: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "DELETE"
+        }
+      ),
+      addMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members`,
+        {
+          method: "POST",
+          body: JSON.stringify({ userId: memberRef })
+        }
+      ),
+      removeMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members/${encodeURIComponent(memberRef)}`,
+        { method: "DELETE" }
+      )
+    },
+    tasks: {
+      list: (query) => {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query ?? {})) {
+          if (value !== void 0 && value !== "") {
+            params.set(key, String(value));
+          }
+        }
+        const suffix = params.size > 0 ? `?${params.toString()}` : "";
+        return agentAdminFetch(
+          config,
+          `/tasks${suffix}`
+        );
+      },
+      search: (q, limit) => {
+        const params = new URLSearchParams({ q });
+        if (limit !== void 0) {
+          params.set("limit", String(limit));
+        }
+        return agentAdminFetch(
+          config,
+          `/tasks/search?${params.toString()}`
+        );
+      },
+      get: (taskId) => agentAdminFetch(config, `/tasks/${taskId}`),
+      assign: (body) => agentAdminFetch(config, "/tasks/assign", {
+        method: "POST",
+        body: JSON.stringify(body)
+      })
+    }
+  };
+}
+function createBoundAgentAdminClient(ctx) {
+  const caller = requireTenantCaller(ctx);
+  const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
+  const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  if (caller.connectionId && serviceToken) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: resolveRobotRockAuthConfig({
+        agentService: {
+          token: serviceToken,
+          tenantSlug: caller.tenantSlug,
+          connectionId: caller.connectionId,
+          actingUserId: caller.userId
+        }
+      })
+    });
+  }
+  const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
+  if (apiKey) {
+    return createAgentAdminApi({
+      baseUrl,
+      auth: {
+        kind: "apiKey",
+        apiKey,
+        actingUserId: caller.userId
+      }
+    });
+  }
+  throw new Error(
+    "Agent admin auth is unset. Set ROBOTROCK_AGENT_SERVICE_TOKEN for hosted multi-tenant agents, or ROBOTROCK_API_KEY for self-hosted and localhost deployments."
+  );
+}
+function requireBoundAgentAdminClient(ctx) {
+  requireAdminCaller(ctx);
+  return createBoundAgentAdminClient(ctx);
+}
+
+// src/eve/tool-result-display.ts
+function toolDisplayResult(data, options) {
+  const display = options?.widget || options?.title || options?.description ? {
+    ...options.widget ? { widget: options.widget } : {},
+    ...options.title ? { title: options.title } : {},
+    ...options.description ? { description: options.description } : {}
+  } : void 0;
+  return {
+    ...display ? { display } : {},
+    data,
+    ...options?.ui ? { ui: options.ui } : {}
+  };
+}
+
+// src/eve/tool-reply-guidance.ts
+var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
+var QUERY_TASKS_LIST_REPLY_GUIDANCE = "Tasks render as a list card in chat. Do not restate task names, ids, or statuses from the list. Only add context not shown (e.g. filters applied, recommended next action).";
+var QUERY_TASKS_DETAIL_REPLY_GUIDANCE = "Task details render in chat UI. Do not restate fields already visible in the card. Only add analysis or next steps.";
+function withReplyGuidance(result, guidance) {
+  return {
+    ...result,
+    [TOOL_REPLY_GUIDANCE_FIELD]: guidance
+  };
+}
+
+// src/eve/tool-display-format.ts
+function formatToolObjectResult(data, options) {
+  return withReplyGuidance(
+    toolDisplayResult(data, {
+      title: options.title,
+      description: options.description,
+      ui: options.ui
+    }),
+    options.replyGuidance
+  );
+}
+function formatToolListResult(listKey, items, options) {
+  const listFieldUi = options.itemWidget ? {
+    "ui:widget": "list",
+    items: {
+      "ui:widget": options.itemWidget,
+      ...options.itemUi ?? {}
+    }
+  } : {
+    "ui:widget": "table",
+    ...options.itemUi ? { items: options.itemUi } : {}
+  };
+  return formatToolObjectResult(
+    { [listKey]: items },
+    {
+      title: options.title,
+      ui: {
+        [listKey]: listFieldUi
+      },
+      replyGuidance: options.replyGuidance
+    }
+  );
+}
+
+// src/eve/tools/admin/format-tasks-list.ts
+function resolveTaskCardLabel(task) {
+  return task.name?.trim() || task.description?.trim() || task.type?.trim() || task.id?.trim() || "Untitled task";
+}
+function formatTasksListResult(items, options) {
+  const title = options?.title ?? (items.length === 1 ? "1 task" : `${items.length} tasks`);
+  const result = formatToolListResult(
+    "items",
+    items.map((task) => ({
+      id: task.id,
+      name: resolveTaskCardLabel(task),
+      status: task.status,
+      type: task.type,
+      description: task.description
+    })),
+    {
+      title,
+      itemWidget: "tenantTask",
+      replyGuidance: QUERY_TASKS_LIST_REPLY_GUIDANCE
+    }
+  );
+  if (options?.nextCursor) {
+    return {
+      ...result,
+      data: {
+        ...result.data,
+        nextCursor: options.nextCursor
+      },
+      display: {
+        ...result.display,
+        description: "More tasks available \u2014 pass nextCursor to list again."
+      }
+    };
+  }
+  return result;
+}
+function formatTaskSearchResult(items, total) {
+  return formatTasksListResult(items, {
+    title: total === 1 ? "1 matching task" : `${total} matching tasks`
+  });
+}
+function formatTaskDetailResult(task) {
+  const title = resolveTaskCardLabel({
+    name: typeof task.name === "string" ? task.name : null,
+    description: typeof task.description === "string" ? task.description : null,
+    type: typeof task.type === "string" ? task.type : null,
+    id: typeof task.id === "string" ? task.id : null
+  });
+  return formatToolObjectResult(
+    {
+      id: task.id ?? null,
+      status: task.status ?? null,
+      type: task.type ?? null,
+      name: task.name ?? null,
+      description: task.description ?? null,
+      validUntil: task.validUntil ?? null,
+      createdAt: task.createdAt ?? null
+    },
+    {
+      title,
+      ui: {
+        id: { "ui:title": "Task ID" },
+        status: { "ui:title": "Status" },
+        type: { "ui:title": "Type" },
+        name: { "ui:title": "Name" },
+        description: { "ui:title": "Description" },
+        validUntil: { "ui:title": "Valid until", "ui:widget": "date" },
+        createdAt: { "ui:title": "Created", "ui:widget": "date" }
+      },
+      replyGuidance: QUERY_TASKS_DETAIL_REPLY_GUIDANCE
+    }
+  );
+}
+
+// src/eve/tools/admin/query-tasks.ts
+var QUERY_TASKS_TOOL_NAME = "query_tasks";
+var queryTasksInputSchema = z5.object({
+  action: z5.enum(["list", "get", "search"]),
+  statusFilter: z5.enum(["all", "open", "handled", "expired"]).optional().describe("Filter by task status for list."),
+  typeFilter: z5.string().optional(),
+  appFilter: z5.string().optional(),
+  sortField: z5.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z5.enum(["asc", "desc"]).optional(),
+  limit: z5.number().int().positive().max(100).optional(),
+  cursor: z5.string().optional(),
+  taskId: z5.string().min(1).optional().describe("Public task id or Convex tasks table id for get."),
+  query: z5.string().min(1).optional().describe("Search type, name, description, or id for search.")
+}).superRefine((input, ctx) => {
+  switch (input.action) {
+    case "get":
+      if (!input.taskId) {
+        ctx.addIssue({
+          code: "custom",
+          message: "taskId is required for get.",
+          path: ["taskId"]
+        });
+      }
+      break;
+    case "search":
+      if (!input.query) {
+        ctx.addIssue({
+          code: "custom",
+          message: "query is required for search.",
+          path: ["query"]
+        });
+      }
+      break;
+  }
+});
+function defineQueryTasksTool() {
+  return defineTool({
+    description: "Tenant-admin tool to list, fetch detail, or search inbox tasks in the workspace. Requires tenant admin access. Results render as chat UI cards \u2014 do not restate task names, ids, or statuses in your reply.",
+    inputSchema: queryTasksInputSchema,
+    async execute(input, ctx) {
+      const api = requireBoundAgentAdminClient(ctx);
+      try {
+        switch (input.action) {
+          case "list": {
+            const result = await api.tasks.list({
+              statusFilter: input.statusFilter,
+              typeFilter: input.typeFilter,
+              appFilter: input.appFilter,
+              sortField: input.sortField,
+              sortDirection: input.sortDirection,
+              limit: input.limit,
+              cursor: input.cursor
+            });
+            return formatTasksListResult(result.items, {
+              nextCursor: result.nextCursor
+            });
+          }
+          case "get": {
+            const result = await api.tasks.get(input.taskId);
+            return formatTaskDetailResult(result.task);
+          }
+          case "search": {
+            const result = await api.tasks.search(input.query, input.limit);
+            return formatTaskSearchResult(
+              result.items,
+              result.total
+            );
+          }
+        }
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var queryTasksTool = defineQueryTasksTool();
+export {
+  QUERY_TASKS_TOOL_NAME,
+  defineQueryTasksTool,
+  queryTasksInputSchema,
+  queryTasksTool
+};
+//# sourceMappingURL=query-tasks.js.map