robotrock 1.3.4 → 1.5.0

package/dist/eve/tools/admin/get-workspace-usage.js

@@ -0,0 +1,1365 @@
+// src/eve/tools/admin/get-workspace-usage.ts
+import { defineTool } from "eve/tools";
+import { z as z6 } from "zod";
+
+// src/http.ts
+var RobotRockError = class extends Error {
+  constructor(message, statusCode, response) {
+    super(message);
+    this.statusCode = statusCode;
+    this.response = response;
+    this.name = "RobotRockError";
+  }
+};
+async function parseResponseBody(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  const bodyText = await response.text();
+  if (!bodyText) {
+    return null;
+  }
+  if (contentType.toLowerCase().includes("application/json")) {
+    try {
+      return JSON.parse(bodyText);
+    } catch {
+    }
+  }
+  try {
+    return JSON.parse(bodyText);
+  } catch {
+    return bodyText;
+  }
+}
+function getErrorMessage(data, fallback) {
+  if (data && typeof data === "object" && !Array.isArray(data)) {
+    const record = data;
+    const maybeMessage = record.message;
+    const maybeHint = record.hint;
+    if (typeof maybeMessage === "string" && maybeMessage.trim()) {
+      if (typeof maybeHint === "string" && maybeHint.trim()) {
+        return `${maybeMessage.trim()} ${maybeHint.trim()}`;
+      }
+      return maybeMessage;
+    }
+  }
+  if (typeof data === "string" && data.trim()) {
+    const compact = data.replace(/\s+/g, " ").trim();
+    const snippet = compact.length > 180 ? `${compact.slice(0, 180)}...` : compact;
+    return `${fallback}. Server returned non-JSON response: ${snippet}`;
+  }
+  return fallback;
+}
+
+// ../core/src/schemas/task.ts
+import { z } from "zod";
+
+// ../core/src/utils/safe-url.ts
+var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata.goog"
+]);
+function normalizeHostname(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+function isBlockedIpv4(host) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!match) {
+    return false;
+  }
+  const octets = match.slice(1, 5).map((part) => Number(part));
+  if (octets.some((octet) => Number.isNaN(octet) || octet < 0 || octet > 255)) {
+    return true;
+  }
+  const [a, b, _c, _d] = octets;
+  if (a === void 0 || b === void 0) {
+    return true;
+  }
+  if (a === 127 || a === 0) return true;
+  if (a === 10) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromNumericHost(host) {
+  if (/^\d+$/.test(host)) {
+    const num = Number(host);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  const hexMatch = /^0x([0-9a-f]{1,8})$/i.exec(host);
+  if (hexMatch) {
+    const num = Number.parseInt(hexMatch[1], 16);
+    if (!Number.isFinite(num) || num < 0 || num > 4294967295) {
+      return null;
+    }
+    const a = num >>> 24 & 255;
+    const b = num >>> 16 & 255;
+    const c = num >>> 8 & 255;
+    const d = num & 255;
+    return `${a}.${b}.${c}.${d}`;
+  }
+  return null;
+}
+function isBlockedIpv4Mapped(host) {
+  const mappedDotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
+  if (mappedDotted) {
+    return isBlockedIpv4(mappedDotted[1]);
+  }
+  const mappedHex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+  if (mappedHex) {
+    const high = Number.parseInt(mappedHex[1], 16);
+    const low = Number.parseInt(mappedHex[2], 16);
+    if (Number.isFinite(high) && Number.isFinite(low)) {
+      const a = high >> 8 & 255;
+      const b = high & 255;
+      const c = low >> 8 & 255;
+      const d = low & 255;
+      return isBlockedIpv4(`${a}.${b}.${c}.${d}`);
+    }
+  }
+  return false;
+}
+function isBlockedIpv6(host) {
+  if (host === "::1" || host === "0:0:0:0:0:0:0:1") {
+    return true;
+  }
+  if (host.startsWith("fc") || host.startsWith("fd")) {
+    return true;
+  }
+  if (host.startsWith("fe80:")) {
+    return true;
+  }
+  if (isBlockedIpv4Mapped(host)) {
+    return true;
+  }
+  return false;
+}
+function isBlockedHostname(hostname) {
+  const host = normalizeHostname(hostname);
+  if (!host) {
+    return true;
+  }
+  if (BLOCKED_HOSTNAMES.has(host)) {
+    return true;
+  }
+  if (host.endsWith(".localhost") || host.endsWith(".local")) {
+    return true;
+  }
+  const numericIpv4 = ipv4FromNumericHost(host);
+  if (numericIpv4 && isBlockedIpv4(numericIpv4)) {
+    return true;
+  }
+  return isBlockedIpv4(host) || isBlockedIpv6(host);
+}
+function isLoopbackHandlerUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  const host = url.hostname.toLowerCase();
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]" || host.endsWith(".localhost");
+}
+function isAllowedHandlerUrl(urlString) {
+  return isPublicHttpUrl(urlString) || isLoopbackHandlerUrl(urlString);
+}
+function isPublicHttpUrl(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return false;
+  }
+  if (url.username || url.password) {
+    return false;
+  }
+  return !isBlockedHostname(url.hostname);
+}
+var PUBLIC_HTTP_URL_ERROR = "URL must be a public http:// or https:// address";
+var HANDLER_URL_ERROR = "Handler URL must be a public or loopback http:// or https:// address";
+
+// ../core/src/schemas/context-urls.ts
+function resolveLinkUrl(value) {
+  return value.startsWith("http://") || value.startsWith("https://") ? value : `https://${value}`;
+}
+function widgetType(ui, field) {
+  const fieldUi = ui?.[field];
+  if (typeof fieldUi !== "object" || fieldUi === null) {
+    return void 0;
+  }
+  const widget = fieldUi["ui:widget"];
+  return typeof widget === "string" ? widget : void 0;
+}
+function validateUrlValue(value, widget) {
+  if (widget === "image" || widget === "link") {
+    if (typeof value !== "string") {
+      return PUBLIC_HTTP_URL_ERROR;
+    }
+    const url = widget === "link" ? resolveLinkUrl(value) : value;
+    if (!isPublicHttpUrl(url)) {
+      return PUBLIC_HTTP_URL_ERROR;
+    }
+    return null;
+  }
+  if (widget === "attachments" && Array.isArray(value)) {
+    for (const item of value) {
+      if (typeof item !== "object" || item === null) {
+        continue;
+      }
+      const url = item.url;
+      if (typeof url === "string" && !isPublicHttpUrl(resolveLinkUrl(url))) {
+        return PUBLIC_HTTP_URL_ERROR;
+      }
+    }
+  }
+  return null;
+}
+function validateContextPublicUrls(context) {
+  if (!context?.data) {
+    return null;
+  }
+  for (const [field, value] of Object.entries(context.data)) {
+    const widget = widgetType(context.ui, field);
+    if (!widget) {
+      continue;
+    }
+    const error = validateUrlValue(value, widget);
+    if (error) {
+      return `context.data.${field}: ${error}`;
+    }
+  }
+  return null;
+}
+
+// ../core/src/schemas/task.ts
+var safeUrlSchema = z.string().refine((url) => isPublicHttpUrl(url), {
+  message: PUBLIC_HTTP_URL_ERROR
+});
+var handlerUrlSchema = z.string().refine((url) => isAllowedHandlerUrl(url), {
+  message: HANDLER_URL_ERROR
+});
+var jsonSchema7Schema = z.custom(
+  (val) => typeof val === "object" && val !== null,
+  { message: "Must be a valid JSON Schema object" }
+);
+var uiSchemaSchema = z.custom((val) => typeof val === "object" && val !== null, {
+  message: "Must be a valid UiSchema object"
+});
+var webhookHandlerSchema = z.object({
+  type: z.literal("webhook"),
+  url: handlerUrlSchema,
+  headers: z.record(z.string(), z.string())
+});
+var triggerHandlerSchema = webhookHandlerSchema.extend({
+  type: z.literal("trigger"),
+  tokenId: z.string().min(1)
+});
+var handlerSchema = z.discriminatedUnion("type", [webhookHandlerSchema, triggerHandlerSchema]);
+var taskActionInputSchema = z.object({
+  id: z.string().min(1),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  schema: jsonSchema7Schema.optional(),
+  ui: uiSchemaSchema.optional(),
+  data: z.record(z.string(), z.unknown()).optional()
+});
+var taskActionSchema = taskActionInputSchema.extend({
+  // Optional handlers for this action - if present, must have at least 1
+  handlers: z.array(handlerSchema).min(1).optional()
+});
+var uiFieldSchemaSchema = z.object({
+  "ui:widget": z.string().optional(),
+  "ui:title": z.string().optional(),
+  "ui:description": z.string().optional(),
+  "ui:options": z.record(z.string(), z.unknown()).optional(),
+  items: z.lazy(() => z.record(z.string(), uiFieldSchemaSchema)).optional()
+}).passthrough();
+var contextUiSchema = z.record(z.string(), uiFieldSchemaSchema).optional();
+var contextDataSchema = z.object({
+  data: z.record(z.string(), z.unknown()),
+  ui: contextUiSchema
+}).optional();
+var TASK_CONTEXT_FORMAT_VERSION = 2;
+var taskContextObjectBaseSchema = z.object({
+  /** Source application id; omitted tasks are grouped in the default inbox. */
+  app: z.string().min(1).optional(),
+  type: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional(),
+  validUntil: z.string().optional(),
+  context: contextDataSchema,
+  /** Task context wire format version. @default 2 */
+  contextVersion: z.literal(2).optional(),
+  /** @deprecated Use `contextVersion`. Accepted on ingest only. */
+  version: z.literal(2).optional(),
+  actions: z.array(taskActionSchema).min(1, "At least one action is required")
+});
+function normalizeTaskContextVersion(data) {
+  const { version: legacyVersion, contextVersion, ...rest } = data;
+  return {
+    ...rest,
+    contextVersion: contextVersion ?? legacyVersion ?? TASK_CONTEXT_FORMAT_VERSION
+  };
+}
+var taskContextObjectSchema = taskContextObjectBaseSchema.transform(
+  normalizeTaskContextVersion
+);
+function refineContextPublicUrls(data, ctx) {
+  const error = validateContextPublicUrls(data.context);
+  if (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: error,
+      path: ["context"]
+    });
+  }
+}
+var taskContextSchema = taskContextObjectSchema.superRefine(
+  refineContextPublicUrls
+);
+var assignToSchema = z.object({
+  users: z.array(z.string().email()).optional(),
+  groups: z.array(z.string().min(1)).optional()
+}).refine(
+  (data) => {
+    const groups = data.groups ?? [];
+    if (groups.includes("all") && groups.length > 1) {
+      return false;
+    }
+    return true;
+  },
+  { message: 'Cannot combine "all" with other group slugs' }
+);
+var threadUpdateMessageSchema = z.string().min(1).max(500);
+var threadUpdateStatuses = [
+  "info",
+  "queued",
+  "running",
+  "waiting",
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var threadUpdateStatusSchema = z.enum(threadUpdateStatuses);
+var threadUpdateInputSchema = z.object({
+  message: threadUpdateMessageSchema,
+  status: threadUpdateStatusSchema.optional()
+});
+var taskPriorities = ["low", "normal", "high", "urgent"];
+var taskPrioritySchema = z.enum(taskPriorities);
+var agentTelemetrySchema = z.object({
+  /** Agent or app version (semver, git SHA, deploy tag — caller-defined). */
+  version: z.string().min(1)
+});
+var createTaskBodySchema = taskContextObjectBaseSchema.extend({
+  assignTo: assignToSchema.optional(),
+  /**
+   * Groups related tasks together. When omitted, the server generates one and
+   * returns it so the caller can reuse it on later tasks in the same thread.
+   */
+  threadId: z.string().min(1).optional(),
+  /**
+   * Optional thread priority. When set, applies to the whole thread and
+   * overwrites any previous priority. Omit on later tasks to leave unchanged.
+   */
+  priority: taskPrioritySchema.optional(),
+  /**
+   * Optional initial status update logged against the task's thread. Shows in
+   * the inbox status bar and the thread update log.
+   */
+  update: threadUpdateInputSchema.optional(),
+  /** Agent release version — not shown in inbox UI. */
+  agent: agentTelemetrySchema.optional()
+}).transform(normalizeTaskContextVersion).superRefine(refineContextPublicUrls);
+var agentChatSeedActionSchema = z.object({
+  /** Stable action id echoed back on submit; auto-derived from title when omitted. */
+  id: z.string().min(1).optional(),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  /** JSON Schema object for the form fields. */
+  schema: z.record(z.string(), z.unknown()).optional(),
+  /** RJSF ui schema overrides (ui:widget, ui:enumNames, etc.). */
+  ui: z.record(z.string(), z.unknown()).optional(),
+  /** Optional default field values. */
+  data: z.record(z.string(), z.unknown()).optional()
+});
+var agentChatSeedMessageSchema = z.object({
+  role: z.enum(["user", "assistant"]),
+  text: z.string().min(1),
+  /** Optional display-name override for the message sender. */
+  senderName: z.string().min(1).optional(),
+  /**
+   * Optional structured input request rendered as a styled RobotRock action
+   * widget below the message text. Use this instead of asking the user to reply
+   * in plain text so the request is always a proper action form.
+   */
+  requestActionInput: z.object({
+    prompt: z.string().optional(),
+    action: agentChatSeedActionSchema
+  }).optional()
+});
+var eveAgentChatTransportSchema = z.object({
+  kind: z.literal("eve"),
+  chatId: z.string().min(1),
+  baseUrl: z.string().url(),
+  sessionId: z.string().optional(),
+  continuationToken: z.string().optional(),
+  streamIndex: z.number().int().nonnegative().optional(),
+  isStreaming: z.boolean().optional()
+});
+var createAgentChatBodySchema = z.object({
+  /** Agent id (eve agent name). Required unless `parentChatId` is set. */
+  agentIdentifier: z.string().min(1).optional(),
+  /** Inherit tenant/connection/agent from an existing chat (agent-spawned chats). */
+  parentChatId: z.string().min(1).optional(),
+  /** Convex tenantEveConnections id; resolved from the tenant when omitted. */
+  eveConnectionId: z.string().min(1).optional(),
+  /** Source application id; groups the chat under an inbox section. */
+  app: z.string().min(1).optional(),
+  /** Email of the user who owns the chat. Required unless `parentChatId` is set. */
+  ownerEmail: z.string().email().optional(),
+  title: z.string().min(1),
+  messages: z.array(agentChatSeedMessageSchema).default([]),
+  /** Provenance label stored on the session ("cron" | "agent" | ...). */
+  source: z.string().min(1).optional()
+}).refine((data) => Boolean(data.agentIdentifier || data.parentChatId), {
+  message: "Provide either agentIdentifier or parentChatId"
+}).refine((data) => Boolean(data.ownerEmail || data.parentChatId), {
+  message: "Provide ownerEmail unless parentChatId is set"
+});
+var agentChatAuditToolBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  toolCallId: z.string().min(1),
+  toolName: z.string().min(1),
+  input: z.record(z.string(), z.unknown()).default({}),
+  success: z.boolean(),
+  status: z.enum(["completed", "failed", "rejected"]),
+  error: z.string().optional(),
+  idempotencyKey: z.string().optional()
+});
+var agentChatAuditInputBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  userId: z.string().min(1),
+  actionId: z.string().min(1),
+  actionTitle: z.string().optional(),
+  prompt: z.string().optional(),
+  data: z.record(z.string(), z.unknown()).optional(),
+  idempotencyKey: z.string().optional(),
+  /** Eve input request id — used to merge staged HITL metadata. */
+  requestId: z.string().optional(),
+  /** Eve tool call id — fallback lookup for staged HITL metadata. */
+  toolCallId: z.string().optional()
+});
+var eveHitlStagedOptionSchema = z.object({
+  id: z.string(),
+  label: z.string()
+});
+var agentChatStageHitlBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  requests: z.array(
+    z.object({
+      requestId: z.string().min(1),
+      toolCallId: z.string().min(1),
+      toolName: z.string().min(1),
+      prompt: z.string().min(1),
+      display: z.enum(["confirmation", "select", "text"]).optional(),
+      allowFreeform: z.boolean().optional(),
+      options: z.array(eveHitlStagedOptionSchema).optional(),
+      toolInput: z.record(z.string(), z.unknown()).optional()
+    })
+  )
+});
+var agentChatLinkTaskBodySchema = z.object({
+  eveSessionId: z.string().min(1),
+  publicTaskId: z.string().min(1),
+  toolCallId: z.string().min(1)
+});
+var AGENT_FILE_TAGS_MAX = 20;
+var AGENT_FILE_TAG_MAX_LENGTH = 64;
+function normalizeAgentFileTags(tags) {
+  if (!tags?.length) return void 0;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of tags) {
+    const tag = raw.trim().toLowerCase().slice(0, AGENT_FILE_TAG_MAX_LENGTH);
+    if (!tag || seen.has(tag)) continue;
+    seen.add(tag);
+    out.push(tag);
+    if (out.length >= AGENT_FILE_TAGS_MAX) break;
+  }
+  return out.length > 0 ? out : void 0;
+}
+var agentChatUploadImageBodySchema = z.object({
+  mediaType: z.string().min(1),
+  /** Raw base64 (no data: URL prefix). */
+  base64: z.string().min(1),
+  chatId: z.string().min(1).optional(),
+  publicTaskId: z.string().min(1).optional(),
+  source: z.string().min(1).optional(),
+  /** Display / search name (e.g. `sunset-robot.png`). */
+  filename: z.string().min(1).max(255).optional(),
+  /** Human-readable description (e.g. generation prompt). */
+  description: z.string().min(1).max(2e3).optional(),
+  /**
+   * Optional labels for later grouping/filtering.
+   * Normalized to lowercase trimmed unique strings (max 20, 64 chars each).
+   */
+  tags: z.array(z.string().min(1).max(AGENT_FILE_TAG_MAX_LENGTH)).max(AGENT_FILE_TAGS_MAX).optional().transform((tags) => normalizeAgentFileTags(tags))
+}).refine((data) => Boolean(data.chatId || data.publicTaskId), {
+  message: "Provide chatId and/or publicTaskId"
+});
+
+// ../core/src/schemas/tool-result-display.ts
+import { z as z2 } from "zod";
+var toolDisplayMetadataSchema = z2.object({
+  widget: z2.string().optional(),
+  title: z2.string().optional(),
+  description: z2.string().optional()
+});
+var toolDisplayEnvelopeSchema = z2.object({
+  display: toolDisplayMetadataSchema.optional(),
+  data: z2.record(z2.string(), z2.unknown()),
+  ui: z2.record(
+    z2.string(),
+    z2.object({
+      "ui:widget": z2.string().optional(),
+      "ui:title": z2.string().optional(),
+      "ui:description": z2.string().optional(),
+      "ui:options": z2.record(z2.string(), z2.unknown()).optional()
+    }).passthrough()
+  ).optional()
+});
+
+// ../core/src/schemas/agent-admin.ts
+import { z as z3 } from "zod";
+var tenantRoleSchema = z3.enum(["admin", "member"]);
+var agentAdminUserSchema = z3.object({
+  id: z3.string(),
+  email: z3.string().email(),
+  name: z3.string(),
+  profilePictureUrl: z3.string().nullable().optional()
+});
+var agentAdminMemberSchema = z3.object({
+  userId: z3.string(),
+  role: z3.string(),
+  membershipKind: z3.enum(["team", "assignee"]),
+  hasLoggedIn: z3.boolean(),
+  user: agentAdminUserSchema
+});
+var agentAdminGroupSchema = z3.object({
+  id: z3.string(),
+  name: z3.string(),
+  slug: z3.string(),
+  description: z3.string().nullable(),
+  memberCount: z3.number().optional()
+});
+var agentAdminGroupDetailSchema = agentAdminGroupSchema.extend({
+  members: z3.array(
+    z3.object({
+      userId: z3.string(),
+      user: agentAdminUserSchema
+    })
+  )
+});
+var agentAdminTaskSummarySchema = z3.object({
+  id: z3.string(),
+  convexId: z3.string(),
+  status: z3.string(),
+  type: z3.string().nullable(),
+  name: z3.string().nullable(),
+  description: z3.string().nullable(),
+  validUntil: z3.number(),
+  createdAt: z3.number(),
+  threadPriority: z3.string().nullable(),
+  handledByUserId: z3.string().nullable()
+});
+var inviteMemberBodySchema = z3.object({
+  email: z3.string().email(),
+  role: tenantRoleSchema.optional()
+});
+var updateMemberRoleBodySchema = z3.object({
+  role: tenantRoleSchema
+});
+var createGroupBodySchema = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().optional()
+});
+var updateGroupBodySchema = z3.object({
+  name: z3.string().min(1).optional(),
+  description: z3.string().optional()
+});
+var addGroupMemberBodySchema = z3.object({
+  userId: z3.string().min(1).describe("Convex user id or member email.")
+});
+var listTasksQuerySchema = z3.object({
+  statusFilter: z3.enum(["all", "open", "handled", "expired"]).optional(),
+  typeFilter: z3.string().optional(),
+  appFilter: z3.string().optional(),
+  sortField: z3.enum(["type", "date", "status", "validUntil"]).optional(),
+  sortDirection: z3.enum(["asc", "desc"]).optional(),
+  limit: z3.coerce.number().int().positive().max(100).optional(),
+  cursor: z3.string().optional()
+});
+var searchTasksQuerySchema = z3.object({
+  q: z3.string().min(1),
+  limit: z3.coerce.number().int().positive().max(100).optional()
+});
+var assignTasksResultSchema = z3.object({
+  taskId: z3.string(),
+  success: z3.boolean(),
+  message: z3.string().optional(),
+  name: z3.string().nullable().optional(),
+  description: z3.string().nullable().optional(),
+  type: z3.string().nullable().optional()
+});
+var assignTasksResponseSchema = z3.object({
+  results: z3.array(assignTasksResultSchema)
+});
+var assignTasksBodySchema = z3.object({
+  taskIds: z3.array(z3.string().min(1)).min(1).max(100),
+  assignTo: assignToSchema.refine(
+    (value) => (value.users?.length ?? 0) > 0 || (value.groups?.length ?? 0) > 0,
+    { message: "assignTo needs at least one user email or group slug." }
+  )
+});
+var agentAdminPlanLimitsSchema = z3.object({
+  tasksPerDay: z3.number(),
+  members: z3.number(),
+  apiKeys: z3.number(),
+  groups: z3.number(),
+  auditLogRetention: z3.number(),
+  rateLimitPerSecond: z3.number(),
+  taskRetentionDays: z3.number()
+});
+var agentAdminUsageSchema = z3.object({
+  workspace: z3.string(),
+  planName: z3.string(),
+  planType: z3.string(),
+  trialState: z3.enum(["none", "active", "expired"]),
+  daysRemaining: z3.number().nullable(),
+  isPaidPro: z3.boolean(),
+  subscriptionStatus: z3.string().nullable(),
+  tasksToday: z3.number(),
+  maxTasksPerDay: z3.number().nullable(),
+  tasksResetAt: z3.number(),
+  openTasks: z3.number(),
+  totalTasks: z3.number(),
+  seatsCurrent: z3.number(),
+  seatsMax: z3.number().nullable(),
+  groupsCurrent: z3.number(),
+  groupsMax: z3.number().nullable(),
+  apiKeysCurrent: z3.number(),
+  apiKeysMax: z3.number().nullable(),
+  rateLimitPerSecond: z3.number(),
+  limits: agentAdminPlanLimitsSchema
+});
+
+// ../core/src/handler-retry.ts
+var HANDLER_RETRY_DELAYS_MS = [
+  6e4,
+  // 1m
+  3e5,
+  // 5m
+  18e5,
+  // 30m
+  36e5,
+  // 1h
+  216e5,
+  // 6h
+  864e5,
+  // 24h
+  1728e5
+  // 48h
+];
+var HANDLER_MAX_ATTEMPTS = HANDLER_RETRY_DELAYS_MS.length + 1;
+
+// ../core/src/attribution/index.ts
+import { z as z4 } from "zod";
+
+// ../core/src/app-url.ts
+var PRODUCTION_APP_URL = "https://app.robotrock.io";
+var PRODUCTION_API_URL = "https://api.robotrock.io/v1";
+var DEV_API_URL = "http://localhost:4001/v1";
+var APP_SIGNUP_URL = `${PRODUCTION_APP_URL}/sign-up`;
+function normalizeRobotRockApiBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  if (trimmed.endsWith("/v1")) {
+    return trimmed;
+  }
+  return `${trimmed}/v1`;
+}
+function getRobotRockApiBaseUrl() {
+  const explicit = process.env.ROBOTROCK_BASE_URL?.trim() || process.env.ROBOTROCK_API_URL?.trim();
+  if (explicit) {
+    return normalizeRobotRockApiBaseUrl(explicit);
+  }
+  if (process.env.NODE_ENV === "production") {
+    return PRODUCTION_API_URL;
+  }
+  return DEV_API_URL;
+}
+
+// ../core/src/attribution/index.ts
+var ATTRIBUTION_COOKIE_MAX_AGE = 60 * 60 * 24 * 90;
+var attributionSchema = z4.object({
+  utmSource: z4.string().optional(),
+  utmMedium: z4.string().optional(),
+  utmCampaign: z4.string().optional(),
+  utmContent: z4.string().optional(),
+  utmTerm: z4.string().optional(),
+  gclid: z4.string().optional(),
+  landingUrl: z4.string().optional(),
+  referrer: z4.string().optional(),
+  capturedAt: z4.number()
+});
+
+// src/auth-headers.ts
+var ROBOTROCK_ACTING_USER_ID_HEADER = "x-robotrock-acting-user-id";
+function buildRobotRockAuthHeaders(auth) {
+  if (auth.kind === "apiKey") {
+    const headers2 = {
+      "X-Api-Key": auth.apiKey
+    };
+    if (auth.actingUserId?.trim()) {
+      headers2[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+    }
+    return headers2;
+  }
+  const headers = {
+    Authorization: `Bearer ${auth.token}`,
+    "X-RobotRock-Tenant-Slug": auth.tenantSlug,
+    "X-RobotRock-Connection-Id": auth.connectionId
+  };
+  if (auth.actingUserId?.trim()) {
+    headers[ROBOTROCK_ACTING_USER_ID_HEADER] = auth.actingUserId.trim();
+  }
+  return headers;
+}
+function resolveRobotRockAuthConfig(overrides) {
+  if (overrides?.agentService) {
+    return {
+      kind: "agentService",
+      ...overrides.agentService
+    };
+  }
+  const apiKey = overrides?.apiKey ?? process.env.ROBOTROCK_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "RobotRock auth is required. Set ROBOTROCK_API_KEY, ROBOTROCK_AGENT_SERVICE_TOKEN with tenant context, or pass auth when creating the client."
+    );
+  }
+  return {
+    kind: "apiKey",
+    apiKey,
+    ...overrides?.actingUserId?.trim() ? { actingUserId: overrides.actingUserId.trim() } : {}
+  };
+}
+
+// src/eve/agent/attributes.ts
+function readStringAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return value;
+  }
+  if (Array.isArray(value) && typeof value[0] === "string" && value[0].length > 0) {
+    return value[0];
+  }
+  return void 0;
+}
+function readStringArrayAttribute(attributes, key) {
+  const value = attributes?.[key];
+  if (typeof value === "string" && value.length > 0) {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.filter(
+      (entry) => typeof entry === "string" && entry.length > 0
+    );
+  }
+  return [];
+}
+function parseTenantRole(value) {
+  if (value === "admin" || value === "member") {
+    return value;
+  }
+  return null;
+}
+
+// src/eve/agent/tenant.ts
+function tryResolveTenantCaller(ctx) {
+  const caller = ctx.session.auth.initiator ?? ctx.session.auth.current;
+  if (caller?.principalType !== "user") {
+    return null;
+  }
+  const email = readStringAttribute(caller.attributes, "email");
+  const name = readStringAttribute(caller.attributes, "name");
+  const tenantSlug = readStringAttribute(caller.attributes, "tenantSlug") ?? readStringAttribute(caller.attributes, "tenantId");
+  const role = parseTenantRole(readStringAttribute(caller.attributes, "role"));
+  if (!email || !tenantSlug || !caller.principalId || !role) {
+    return null;
+  }
+  const workosUserId = readStringAttribute(caller.attributes, "workosUserId");
+  const connectionId = readStringAttribute(caller.attributes, "connectionId");
+  const chatId = readStringAttribute(caller.attributes, "chatId");
+  const groups = readStringArrayAttribute(caller.attributes, "groups");
+  return {
+    userId: caller.principalId,
+    email,
+    name: name ?? email.split("@")[0] ?? email,
+    tenantSlug,
+    ...connectionId ? { connectionId } : {},
+    ...chatId ? { chatId } : {},
+    role,
+    isAdmin: role === "admin",
+    groups,
+    ...workosUserId ? { workosUserId } : {}
+  };
+}
+function requireTenantCaller(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  if (!caller) {
+    throw new Error("An authenticated RobotRock tenant user is required.");
+  }
+  return caller;
+}
+function requireAdminCaller(ctx) {
+  const caller = requireTenantCaller(ctx);
+  if (!caller.isAdmin) {
+    throw new Error("Tenant admin access is required.");
+  }
+  return caller;
+}
+
+// src/chat-correlation.ts
+var ROBOTROCK_CHAT_ID_HEADER = "x-robotrock-chat-id";
+var ROBOTROCK_EVE_SESSION_ID_HEADER = "x-robotrock-eve-session-id";
+function resolveChatCorrelationFromEnv() {
+  const chatId = process.env.ROBOTROCK_CHAT_ID?.trim();
+  const eveSessionId = process.env.ROBOTROCK_EVE_SESSION_ID?.trim();
+  if (!chatId && !eveSessionId) {
+    return void 0;
+  }
+  return {
+    ...chatId ? { chatId } : {},
+    ...eveSessionId ? { eveSessionId } : {}
+  };
+}
+function buildChatCorrelationHeaders(correlation) {
+  if (!correlation) {
+    return {};
+  }
+  const headers = {};
+  const chatId = correlation.chatId?.trim();
+  const eveSessionId = correlation.eveSessionId?.trim();
+  if (chatId) {
+    headers[ROBOTROCK_CHAT_ID_HEADER] = chatId;
+  }
+  if (eveSessionId) {
+    headers[ROBOTROCK_EVE_SESSION_ID_HEADER] = eveSessionId;
+  }
+  return headers;
+}
+
+// src/agent-admin.ts
+async function agentAdminFetch(config, path, init) {
+  const baseUrl = (config.baseUrl?.trim() || getRobotRockApiBaseUrl()).replace(
+    /\/+$/,
+    ""
+  );
+  const url = `${baseUrl}/agent-admin${path}`;
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      ...buildRobotRockAuthHeaders(config.auth),
+      ...buildChatCorrelationHeaders(config.chatCorrelation),
+      ...init?.headers ?? {}
+    }
+  });
+  const data = await parseResponseBody(response);
+  if (!response.ok) {
+    throw new RobotRockError(
+      getErrorMessage(data, `Agent admin request failed (${response.status})`),
+      response.status,
+      data
+    );
+  }
+  return data;
+}
+function createAgentAdminApi(config) {
+  return {
+    usage: {
+      get: () => agentAdminFetch(config, "/usage")
+    },
+    members: {
+      list: () => agentAdminFetch(config, "/members"),
+      get: (memberRef) => agentAdminFetch(config, `/members/${encodeURIComponent(memberRef)}`),
+      invite: (body) => agentAdminFetch(config, "/members", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      updateRole: (memberRef, role) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberRef)}/role`,
+        {
+          method: "PATCH",
+          body: JSON.stringify({ role })
+        }
+      ),
+      remove: (memberId) => agentAdminFetch(
+        config,
+        `/members/${encodeURIComponent(memberId)}`,
+        {
+          method: "DELETE"
+        }
+      )
+    },
+    groups: {
+      list: () => agentAdminFetch(config, "/groups"),
+      get: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`
+      ),
+      create: (body) => agentAdminFetch(config, "/groups", {
+        method: "POST",
+        body: JSON.stringify(body)
+      }),
+      update: (groupId, body) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "PATCH",
+          body: JSON.stringify(body)
+        }
+      ),
+      delete: (groupId) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupId)}`,
+        {
+          method: "DELETE"
+        }
+      ),
+      addMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members`,
+        {
+          method: "POST",
+          body: JSON.stringify({ userId: memberRef })
+        }
+      ),
+      removeMember: (groupRef, memberRef) => agentAdminFetch(
+        config,
+        `/groups/${encodeURIComponent(groupRef)}/members/${encodeURIComponent(memberRef)}`,
+        { method: "DELETE" }
+      )
+    },
+    tasks: {
+      list: (query) => {
+        const params = new URLSearchParams();
+        for (const [key, value] of Object.entries(query ?? {})) {
+          if (value !== void 0 && value !== "") {
+            params.set(key, String(value));
+          }
+        }
+        const suffix = params.size > 0 ? `?${params.toString()}` : "";
+        return agentAdminFetch(
+          config,
+          `/tasks${suffix}`
+        );
+      },
+      search: (q, limit) => {
+        const params = new URLSearchParams({ q });
+        if (limit !== void 0) {
+          params.set("limit", String(limit));
+        }
+        return agentAdminFetch(
+          config,
+          `/tasks/search?${params.toString()}`
+        );
+      },
+      get: (taskId) => agentAdminFetch(config, `/tasks/${taskId}`),
+      assign: (body) => agentAdminFetch(config, "/tasks/assign", {
+        method: "POST",
+        body: JSON.stringify(body)
+      })
+    }
+  };
+}
+function resolveBoundChatCorrelation(ctx) {
+  const caller = tryResolveTenantCaller(ctx);
+  return {
+    eveSessionId: ctx.session.id,
+    ...caller?.chatId ? { chatId: caller.chatId } : {},
+    ...resolveChatCorrelationFromEnv()
+  };
+}
+function createBoundAgentAdminClient(ctx) {
+  const caller = requireTenantCaller(ctx);
+  const baseUrl = process.env.ROBOTROCK_BASE_URL?.trim();
+  const serviceToken = process.env.ROBOTROCK_AGENT_SERVICE_TOKEN?.trim();
+  const chatCorrelation = resolveBoundChatCorrelation(ctx);
+  if (caller.connectionId && serviceToken) {
+    return createAgentAdminApi({
+      baseUrl,
+      chatCorrelation,
+      auth: resolveRobotRockAuthConfig({
+        agentService: {
+          token: serviceToken,
+          tenantSlug: caller.tenantSlug,
+          connectionId: caller.connectionId,
+          actingUserId: caller.userId
+        }
+      })
+    });
+  }
+  const apiKey = process.env.ROBOTROCK_API_KEY?.trim();
+  if (apiKey) {
+    return createAgentAdminApi({
+      baseUrl,
+      chatCorrelation,
+      auth: {
+        kind: "apiKey",
+        apiKey,
+        actingUserId: caller.userId
+      }
+    });
+  }
+  throw new Error(
+    "Agent admin auth is unset. Set ROBOTROCK_AGENT_SERVICE_TOKEN for hosted multi-tenant agents, or ROBOTROCK_API_KEY for self-hosted and localhost deployments."
+  );
+}
+function requireBoundAgentAdminClient(ctx) {
+  requireAdminCaller(ctx);
+  return createBoundAgentAdminClient(ctx);
+}
+
+// src/eve/entity-schemas.ts
+import { z as z5 } from "zod";
+
+// src/eve/tool-ui-hint.ts
+var TOOL_UI_HINT_FIELD = "uiHint";
+function withUiHint(result, hint) {
+  return {
+    ...result,
+    [TOOL_UI_HINT_FIELD]: hint
+  };
+}
+
+// src/eve/tool-result-ui-meta.ts
+var TOOL_UI_FIELD = "ui";
+var TOOL_RESULT_UI_ENTITY_ID_RE = /^[a-z][a-z0-9_]{0,63}$/;
+function withToolUi(result, ui) {
+  const existing = typeof result[TOOL_UI_FIELD] === "object" && result[TOOL_UI_FIELD] !== null && !Array.isArray(result[TOOL_UI_FIELD]) ? result[TOOL_UI_FIELD] : {};
+  return {
+    ...result,
+    [TOOL_UI_FIELD]: {
+      ...existing,
+      ...ui
+    }
+  };
+}
+
+// src/eve/entity-schemas.ts
+var toolResultUiMetaSchema = z5.object({
+  present: z5.boolean().optional(),
+  entity: z5.string().regex(TOOL_RESULT_UI_ENTITY_ID_RE).optional(),
+  rowsPath: z5.string().min(1).optional(),
+  layout: z5.enum(["list", "chart", "table"]).optional()
+}).strict();
+var agentOnlyFields = {
+  replyGuidance: z5.string().optional(),
+  ui: toolResultUiMetaSchema.optional(),
+  uiHint: z5.enum(["list", "chart", "table"]).optional()
+};
+function withAgentOnlyFields(shape) {
+  return z5.object({
+    ...shape,
+    ...agentOnlyFields
+  });
+}
+var productEntityRowSchema = z5.object({
+  id: z5.string().min(1),
+  name: z5.string().min(1),
+  price: z5.number(),
+  currency: z5.string().min(1),
+  inStock: z5.boolean(),
+  url: z5.string().min(1)
+});
+var metricPointEntityRowSchema = z5.object({
+  date: z5.string().optional().describe("X-axis value when xKey is date/time"),
+  category: z5.string().optional().describe("X-axis value when xKey is category"),
+  label: z5.string().optional().describe("X-axis value when xKey is label")
+}).catchall(z5.union([z5.string(), z5.number()])).describe(
+  "Wide chart point: x-axis field + numeric columns named by yKeys (one series per column)"
+);
+var toolChartResultSchema = withAgentOnlyFields({
+  title: z5.string().min(1).optional().describe("Chart title shown above the plot"),
+  description: z5.string().min(1).optional().describe("Optional short subtitle"),
+  type: z5.enum(["line", "bar", "area"]).describe("TRL/shadcn chart variant (time series \u2192 line, categories \u2192 bar)"),
+  xKey: z5.string().min(1).describe('Field on each series row for the x-axis, e.g. "date" or "category"'),
+  yKeys: z5.array(z5.string().min(1)).min(1).describe(
+    'Numeric series column names on each row, e.g. ["NL","BE"] or ["created","handled"]'
+  ),
+  series: z5.array(metricPointEntityRowSchema).describe(
+    "Wide-format points only \u2014 one object per x value with yKeys as numeric fields"
+  )
+});
+var memberEntityRowSchema = z5.object({
+  name: z5.string(),
+  email: z5.string(),
+  role: z5.string(),
+  membershipKind: z5.string(),
+  profilePictureUrl: z5.string().nullable()
+});
+var taskEntityRowSchema = z5.object({
+  id: z5.string().min(1),
+  name: z5.string().min(1),
+  status: z5.string().min(1),
+  type: z5.string().nullable(),
+  description: z5.string().nullable(),
+  validUntil: z5.number(),
+  createdAt: z5.number(),
+  url: z5.string().min(1),
+  threadPriority: z5.string().nullable().optional()
+});
+var groupEntityRowSchema = z5.object({
+  name: z5.string().min(1),
+  slug: z5.string().min(1),
+  description: z5.string().nullable(),
+  memberCount: z5.number().nullable(),
+  url: z5.string().min(1)
+});
+var groupDetailEntitySchema = z5.object({
+  name: z5.string().min(1),
+  slug: z5.string().min(1),
+  description: z5.string().nullable(),
+  url: z5.string().min(1),
+  members: z5.array(
+    z5.object({
+      name: z5.string(),
+      email: z5.string(),
+      profilePictureUrl: z5.string().nullable()
+    })
+  )
+});
+var statusEntityRowSchema = z5.object({
+  id: z5.string().min(1),
+  name: z5.string().min(1),
+  status: z5.string().min(1),
+  url: z5.string().min(1),
+  type: z5.string().nullable().optional(),
+  description: z5.string().nullable().optional()
+});
+var agentAdminErrorResultSchema = z5.object({
+  ok: z5.literal(false),
+  status: z5.number().optional(),
+  message: z5.string(),
+  response: z5.unknown().optional()
+});
+var agentAdminMutationResultSchema = z5.object({
+  ...agentOnlyFields
+}).passthrough();
+var searchProductsOutputSchema = withAgentOnlyFields({
+  items: z5.array(productEntityRowSchema)
+});
+var generateRandomChartOutputSchema = toolChartResultSchema.extend({
+  title: z5.string().min(1)
+});
+var generateImageOutputSchema = withAgentOnlyFields({
+  prompt: z5.string().min(1),
+  mediaType: z5.string().min(1),
+  model: z5.string().min(1),
+  storageId: z5.string().min(1),
+  url: z5.string().min(1),
+  /** @deprecated Legacy sessions only — prefer storageId/url. */
+  base64: z5.string().min(1).optional()
+});
+var manageTeamMembersListOutputSchema = withAgentOnlyFields({
+  members: z5.array(memberEntityRowSchema)
+});
+var manageTeamMembersDetailOutputSchema = withAgentOnlyFields(
+  memberEntityRowSchema.shape
+);
+var manageTeamMembersOutputSchema = z5.union([
+  manageTeamMembersListOutputSchema,
+  manageTeamMembersDetailOutputSchema,
+  agentAdminMutationResultSchema,
+  agentAdminErrorResultSchema
+]);
+var manageGroupsListOutputSchema = withAgentOnlyFields({
+  groups: z5.array(groupEntityRowSchema)
+});
+var manageGroupsDetailOutputSchema = withAgentOnlyFields(
+  groupDetailEntitySchema.shape
+);
+var manageGroupsSummaryOutputSchema = withAgentOnlyFields(
+  groupEntityRowSchema.shape
+);
+var manageGroupsOutputSchema = z5.union([
+  manageGroupsListOutputSchema,
+  manageGroupsDetailOutputSchema,
+  manageGroupsSummaryOutputSchema,
+  agentAdminMutationResultSchema,
+  agentAdminErrorResultSchema
+]);
+var queryTasksListOutputSchema = withAgentOnlyFields({
+  items: z5.array(taskEntityRowSchema),
+  nextCursor: z5.string().nullable().optional()
+});
+var queryTasksDetailOutputSchema = withAgentOnlyFields({
+  id: z5.string().nullable(),
+  status: z5.string().nullable(),
+  type: z5.string().nullable(),
+  name: z5.string().nullable(),
+  description: z5.string().nullable(),
+  validUntil: z5.number().nullable(),
+  createdAt: z5.number().nullable(),
+  url: z5.string().min(1).nullable()
+});
+var queryTasksOutputSchema = z5.union([
+  queryTasksListOutputSchema,
+  queryTasksDetailOutputSchema,
+  agentAdminErrorResultSchema
+]);
+var assignTasksOutputSchema = z5.union([
+  withAgentOnlyFields({
+    results: z5.array(statusEntityRowSchema)
+  }),
+  agentAdminErrorResultSchema
+]);
+var workspaceUsageEntitySchema = z5.object({
+  workspace: z5.string(),
+  plan: z5.string(),
+  planType: z5.string(),
+  trialState: z5.string(),
+  daysRemaining: z5.number().nullable(),
+  isPaidPro: z5.boolean(),
+  subscriptionStatus: z5.string(),
+  tasksToday: z5.string(),
+  tasksResetAt: z5.string(),
+  openTasks: z5.number(),
+  totalTasks: z5.number(),
+  seats: z5.string(),
+  groups: z5.string(),
+  apiKeys: z5.string(),
+  rateLimitPerSecond: z5.number()
+});
+var getWorkspaceUsageOutputSchema = z5.union([
+  withAgentOnlyFields({
+    usage: workspaceUsageEntitySchema
+  }),
+  agentAdminErrorResultSchema
+]);
+
+// src/eve/tool-reply-guidance.ts
+var TOOL_REPLY_GUIDANCE_FIELD = "replyGuidance";
+var GET_WORKSPACE_USAGE_REPLY_GUIDANCE = "Workspace plan and usage render as a card in chat. Do not restate plan name, task counts, seats, groups, API keys, or rate limits from the card. Only add context not shown (e.g. upgrade options, that LLM token/cost meters are not tracked, or next steps). Never invent token or dollar spend numbers.";
+function withReplyGuidance(result, guidance) {
+  return {
+    ...result,
+    [TOOL_REPLY_GUIDANCE_FIELD]: guidance
+  };
+}
+
+// src/eve/tool-display-format.ts
+function formatToolObjectResult(data, options) {
+  let result = withReplyGuidance(
+    data,
+    options.replyGuidance
+  );
+  if (options.ui) {
+    result = withToolUi(result, options.ui);
+  }
+  if (options.uiHint) {
+    result = withUiHint(result, options.uiHint);
+  }
+  return result;
+}
+
+// src/eve/tools/admin/format-workspace-usage.ts
+function formatLimit(current, max) {
+  return max === null ? `${current} / unlimited` : `${current} / ${max}`;
+}
+function formatWorkspaceUsageResult(usage) {
+  const tasksLimit = usage.maxTasksPerDay === null ? `${usage.tasksToday} / unlimited` : `${usage.tasksToday} / ${usage.maxTasksPerDay}`;
+  return formatToolObjectResult(
+    {
+      usage: {
+        workspace: usage.workspace,
+        plan: usage.planName,
+        planType: usage.planType,
+        trialState: usage.trialState,
+        daysRemaining: usage.daysRemaining,
+        isPaidPro: usage.isPaidPro,
+        subscriptionStatus: usage.subscriptionStatus ?? "\u2014",
+        tasksToday: tasksLimit,
+        tasksResetAt: new Date(usage.tasksResetAt).toISOString(),
+        openTasks: usage.openTasks,
+        totalTasks: usage.totalTasks,
+        seats: formatLimit(usage.seatsCurrent, usage.seatsMax),
+        groups: formatLimit(usage.groupsCurrent, usage.groupsMax),
+        apiKeys: formatLimit(usage.apiKeysCurrent, usage.apiKeysMax),
+        rateLimitPerSecond: usage.rateLimitPerSecond
+      }
+    },
+    {
+      replyGuidance: GET_WORKSPACE_USAGE_REPLY_GUIDANCE,
+      ui: { entity: "usage" }
+    }
+  );
+}
+
+// src/eve/tools/admin/get-workspace-usage.ts
+var GET_WORKSPACE_USAGE_TOOL_NAME = "get_workspace_usage";
+var getWorkspaceUsageInputSchema = z6.object({});
+function defineGetWorkspaceUsageTool() {
+  return defineTool({
+    description: "Tenant-admin tool for workspace plan, limits, and usage (tasks today, seats, groups, API keys, rate limits). Does not include LLM token counts or dollar spend \u2014 those are not tracked. Requires tenant admin access. Call get_my_access in the same turn before this tool. Results render as a chat UI card \u2014 do not restate plan or usage numbers in your reply.",
+    inputSchema: getWorkspaceUsageInputSchema,
+    outputSchema: getWorkspaceUsageOutputSchema,
+    async execute(_input, ctx) {
+      const api = requireBoundAgentAdminClient(ctx);
+      try {
+        const result = await api.usage.get();
+        return formatWorkspaceUsageResult(result.usage);
+      } catch (error) {
+        if (error instanceof RobotRockError) {
+          return {
+            ok: false,
+            status: error.statusCode,
+            message: error.message,
+            response: error.response
+          };
+        }
+        throw error;
+      }
+    }
+  });
+}
+var getWorkspaceUsageTool = defineGetWorkspaceUsageTool();
+export {
+  GET_WORKSPACE_USAGE_TOOL_NAME,
+  defineGetWorkspaceUsageTool,
+  getWorkspaceUsageInputSchema,
+  getWorkspaceUsageTool
+};
+//# sourceMappingURL=get-workspace-usage.js.map