@agentconnect.md/setup 1.37.0-rc.3 → 1.37.0-rc.5

package/dist/index.js

@@ -36023,20 +36023,6 @@ const ZodRecord = /*@__PURE__*/ $constructor("ZodRecord", (inst, def) => {
 	inst.keyType = def.keyType;
 	inst.valueType = def.valueType;
 });
-function record$1(keyType, valueType, params) {
-	if (!valueType || !valueType._zod) return new ZodRecord({
-		type: "record",
-		keyType: string(),
-		valueType: keyType,
-		...normalizeParams(valueType)
-	});
-	return new ZodRecord({
-		type: "record",
-		keyType,
-		valueType,
-		...normalizeParams(params)
-	});
-}
 function partialRecord(keyType, valueType, params) {
 	const k = clone(keyType);
 	k._zod.values = void 0;
@@ -36293,1115 +36279,16 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../protocol/dist/envelope.js
+//#region ../protocol/dist/slack-app-manifest.js
 var import_fastify = /* @__PURE__ */ __toESM(require_fastify(), 1);
-object({
-	v: literal(1),
-	id: string().uuid(),
-	ts: string().datetime(),
-	type: string(),
-	corr: string().uuid().optional(),
-	payload: unknown()
-});
-object({
-	epoch: number$1().int(),
-	agentId: string().uuid().optional(),
-	launchId: string().uuid().optional()
-});
-/**
-* Builds the envelope schema for one frame `type` — the `type` literal plus the
-* typed payload — so a wire's discriminated union infers `payload` precisely.
-* Shared by the daemon↔CP union (`frame.ts`) and the relay wire unions
-* (`frames/relay-cp.ts` / `frames/relay-daemon.ts`), which are deliberately
-* SEPARATE unions over the same envelope shape (shared-bot-relay.md §8).
-*/
-function frameSchema(type, payload) {
-	return object({
-		v: literal(1),
-		id: string().uuid(),
-		ts: string().datetime(),
-		type: literal(type),
-		corr: string().uuid().optional(),
-		payload
-	});
-}
-const ErrorFrame = object({
-	code: _enum([
-		"UNKNOWN_FRAME",
-		"FRAME_TOO_LARGE",
-		"PROTOCOL_STATE",
-		"BAD_PAYLOAD",
-		"AUTH_FAILED",
-		"ATTESTATION_INVALID",
-		"STALE_EPOCH",
-		"STALE_LAUNCH",
-		"NO_SESSION",
-		"SCOPE_DENIED",
-		"DELEGATION_DENIED",
-		"INVOCATION_CONFLICT",
-		"LEASE_EXPIRED",
-		"LEASE_DENIED",
-		"RATE_LIMITED",
-		"CONFLICT",
-		"INTERNAL"
-	]),
-	message: string(),
-	retryable: boolean(),
-	details: record$1(string(), unknown()).optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/route.js
-const Platform = string().min(1);
-const SessionKey = object({
-	platform: Platform,
-	channel: string(),
-	thread: string().optional()
-});
-/** Trigger-matching rule for a binding (protocol §5.1). */
-const BindRule = object({ match: discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]) });
-object({
-	sessionKey: SessionKey,
-	agentId: string().uuid(),
-	workspaceId: string().uuid(),
-	bindRules: array(BindRule).default([])
-});
-object({
-	ok: boolean(),
-	sessionKey: SessionKey,
-	reason: string().optional()
-});
-object({
-	routingEpoch: number$1().int(),
-	rules: array(object({
-		match: unknown(),
-		agentId: string().uuid()
-	}))
-});
-object({
-	scope: union([
-		object({
-			kind: literal("agent"),
-			agentId: string().uuid()
-		}),
-		object({ kind: literal("daemon") }),
-		object({
-			kind: literal("session"),
-			sessionKey: SessionKey
-		})
-	]),
-	deadline: string().datetime()
-});
-object({
-	remaining: number$1().int(),
-	drained: array(SessionKey)
-});
-object({ released: array(SessionKey) });
-//#endregion
-//#region ../protocol/dist/frames/integration.js
-/**
-* Platform integration distribution (C→D) — the Slack "install" flow.
-*
-* The Control Plane is the source of truth for platform integrations and pushes
-* them to the daemon that owns the integration's agent (`integration/upsert`, and
-* the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket
-* Mode connection from the delivered config (see slack/connection.ts).
-*
-* SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT
-* platform tokens (botToken/appToken/appSecret). These payloads MUST NEVER be
-* logged — no body dump on decode error, no register/ok snapshot debug dump.
-* CP-owned integrations live only in daemon MEMORY and are re-converged on
-* reconnect; hand-authored agents keep tokens in their own `agent.json` (the
-* same trust boundary as the daemon process).
-*
-* `signingSecret` is intentionally absent: Socket Mode authenticates with the
-* app-level token, so the daemon never needs a signing secret.
-*/
-/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */
-const BindMatch = discriminatedUnion("kind", [
-	object({ kind: literal("mention") }),
-	object({ kind: literal("dm") }),
-	object({
-		kind: literal("keyword"),
-		value: string()
-	}),
-	object({ kind: literal("auto") })
-]);
-/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */
-const IntegrationBindRule = object({
-	channel: string().optional(),
-	thread: string().optional(),
-	match: BindMatch
-});
-object({
-	botToken: string(),
-	appToken: string().optional(),
-	appId: string().optional(),
-	shareable: boolean().default(false),
-	botUserId: string().optional()
-});
-object({ botToken: string() });
-object({
-	botToken: string(),
-	applicationId: string().optional()
-});
-/**
-* The Feishu / Lark config payload — the long-connection WebSocket
-* (`@larksuiteoapi/node-sdk` `WSClient`) + REST client. A Feishu self-built app
-* authenticates with an `appId` + `appSecret` PAIR — the SDK exchanges them for a
-* short-lived `tenant_access_token` internally (no Slack-style app-level token, no
-* signing secret). `appId` is a semi-public identifier (`cli_…`); `appSecret` is
-* plaintext secret material — NEVER log it. `botOpenId` is the bot's own open_id
-* for @-mention routing; lazily resolved by the daemon via `bot/info` if absent.
-*
-* The envelope's `mode` decides the transport: `direct` opens the SDK long
-* connection on the daemon; `shared` keeps only the authenticated REST client
-* (callbacks arrive through the relay, pre-addressed over rd/*).
-*
-* `region` selects the open-platform gateway the daemon SDK (and CP verifier)
-* talk to — `'feishu'` = mainland China (`open.feishu.cn`, the SDK default) vs
-* `'lark'` = international (`open.larksuite.com`). Same app model, different host;
-* an app is registered in exactly one region. Defaults to `'feishu'` so existing
-* installs are unaffected.
-*/
-const FeishuRegion = _enum(["feishu", "lark"]);
-object({
-	appId: string(),
-	appSecret: string(),
-	botOpenId: string().optional(),
-	region: FeishuRegion.default("feishu")
-});
-/**
-* §6.4 core routing ENVELOPE (integration-plugin-architecture.md D4): the knobs CORE
-* reads — routing, gating, ingress mode — platform-independent. This is the ONLY
-* carrier of these knobs on the wire: the opaque per-platform `config` payload
-* never duplicates them (the daemon reads routing exclusively from here).
-*/
-const IntegrationCoreEnvelope = object({
-	mode: _enum(["direct", "shared"]).default("direct"),
-	bindRules: array(IntegrationBindRule).default([]),
-	mutedChannels: array(string()).default([]),
-	gated: boolean().default(false)
-});
-object({
-	integrationId: string().uuid(),
-	agentId: string().uuid(),
-	platform: Platform,
-	core: IntegrationCoreEnvelope,
-	config: unknown().optional()
-});
-object({ integrationId: string().uuid() });
-/**
-* One conversation the bot participates in (metadata only — no messages).
-* `kind` distinguishes member channels from direct conversations (resource-
-* visibility.md §14.3): absent = 'channel' for wire compatibility. DM rows
-* (`kind: 'im'`, Slack "D…" ids) are reported for every integration on first
-* inbound DM; their `name` is the counterpart's display name. Group DMs
-* (`kind: 'mpim'`, Slack multi-person DMs) are reported on observation the same
-* way — never enumerated, because Slack does not list them as bot membership —
-* but they behave like a channel: several humans share the room, so the agent
-* stays mention-gated there rather than answering every message.
-*
-* `spaceId`/`space` identify the container the conversation lives in — a Discord
-* GUILD, which a bot in several servers needs for the channel to be identifiable at
-* all (every server has a "#general"). The ID is the identity: two distinct guilds
-* may carry the SAME name, so grouping on the name alone would merge them and hide
-* the ambiguity it was meant to resolve. `space` is the display label only. Both are
-* absent on platforms with one implicit container per bot (Slack workspace, Telegram,
-* Feishu tenant) and on DM rows.
-*/
-const IntegrationChannel = object({
-	id: string(),
-	name: string().optional(),
-	spaceId: string().optional(),
-	space: string().optional(),
-	isPrivate: boolean().optional(),
-	kind: _enum([
-		"channel",
-		"im",
-		"mpim"
-	]).optional()
-});
-object({
-	integrationId: string().uuid(),
-	channels: array(IntegrationChannel),
-	authoritative: boolean().optional(),
-	removed: array(string()).optional()
-});
-/**
-* What a leave targets. Platforms disagree about what a bot can withdraw from, and
-* the difference is not cosmetic — so the caller has to say which it means rather
-* than the daemon guessing from an id:
-*
-*  - `conversation` — one channel/group the bot is a member of (Slack
-*    `conversations.leave`, Telegram `leaveChat`).
-*  - `space` — the whole container. Discord has no per-channel membership for a
-*    bot at all: it is in a GUILD and sees that guild's channels through
-*    permissions, so the only thing it can leave is the entire server. That is a
-*    much larger action than leaving one channel and must be requested as such.
-*/
-const IntegrationLeaveTarget = discriminatedUnion("kind", [object({
-	kind: literal("conversation"),
-	channel: string().min(1)
-}), object({
-	kind: literal("space"),
-	spaceId: string().min(1)
-})]);
-object({
-	integrationId: string().uuid(),
-	target: IntegrationLeaveTarget
-});
-object({
-	integrationId: string().uuid(),
-	channels: array(string()).min(1)
-});
-object({
-	ok: boolean(),
-	error: string().optional()
-});
-//#endregion
-//#region ../protocol/dist/frames/cron.js
-/**
-* Cron sinks to the daemon (D5) — protocol §5.4.
-*
-* A cron periodically triggers ONE AGENT with a synthetic prompt (`trigger`) to
-* carry out some work. The CP owns the definition; the daemon owns firing +
-* last-run persistence, so crons fire even when the CP is down. On receipt the
-* daemon persists the def into the owning agent's `agent.json` `crons[]` (the
-* single source of truth, same model as integrations) — surviving a restart
-* with the CP down.
-*
-* `target` is OPTIONAL output routing: when present, the daemon posts the
-* trigger as a real message in that channel and the agent's session replies in
-* its thread; when absent the fire is headless (the agent works with no
-* platform output).
-*/
-const CronTarget = object({
-	platform: Platform.default("slack"),
-	channel: string(),
-	integrationId: string().uuid().optional()
-});
-object({
-	cronId: string().uuid(),
-	agentId: string().uuid(),
-	schedule: string(),
-	timezone: string().min(1),
-	target: CronTarget.optional(),
-	trigger: string(),
-	enabled: boolean().default(true)
-});
-object({ cronId: string().uuid() });
-/**
-* `cron/report` (D→C EVT, fire-and-forget) — one CP-owned cron fired. The
-* daemon stamps the fire into its local store first (it stays authoritative,
-* §5.4) and reports it here so the console's `lastRunAt` converges; the CP
-* upsert is latest-wins, so the daemon re-asserting its stored stamps on
-* reconnect (fires while the CP was unreachable) is idempotent and can never
-* regress the value. Hand-authored (no-origin) crons are never reported.
-*
-* Reports are keyed by `(cronId, firedAt)`: the FIRE report (no `status`)
-* opens the run, an optional SESSION report attaches the ACP session as soon
-* as it is initialized, and the COMPLETION report (with `status` + outcome
-* fields) closes the run once the dispatched turn ends. A completion without
-* a prior fire report (CP was down at fire time) still creates the run row.
-*/
-const CronRunStatus = _enum(["success", "failed"]);
-object({
-	cronId: string().uuid(),
-	agentId: string().uuid(),
-	firedAt: string().datetime(),
-	status: CronRunStatus.optional(),
-	durationMs: number$1().int().nonnegative().optional(),
-	sessionId: string().optional(),
-	reason: string().optional()
-});
-object({ cronId: string().uuid() });
-//#endregion
-//#region ../protocol/dist/frames/collab.js
-/**
-* Bot-AGNOSTIC agent-collaboration routing snapshot (agent-collaboration §2.3 / §6.2 / §6.5).
-*
-* The existing shared-bot `members` table is keyed by botId (`BotAssignment`) and
-* CANNOT address an agent on a DIFFERENT bot / arbitrary channel. This snapshot is
-* the fix: it maps a channel — `(orgId, platform, channelId)` — to the per-agent
-* placement + call policy the relay needs to route a cross-daemon `rd/agentmsg` and
-* the target daemon needs to terminal-verify a remote caller.
-*
-* It carries NO message body — pure routing/policy metadata, like the rest of the
-* control plane. The SAME shape is distributed two ways (§6.5):
-*  - CP→relay over the `rc/*` wire (`rc/collab-routes`) — the relay routes
-*    `toAgentId` → owning `daemonId` and authorizes the caller/target policy.
-*  - CP→daemon over the daemon↔CP wire — as a `register/ok` field (reconnect
-*    baseline) + a `collaboration/routes` EVT (hot push) — so the OWNING daemon of
-*    the target can terminal-verify (defense in depth, §2.5 #4) the remote caller's
-*    org/channel/placement against its OWN copy, never trusting the relay's claim
-*    blindly.
-*
-* FOLLOW-UP (scoped down in P2, see PR description): the full versioned lifecycle
-* of §6.5 — per-entry tombstones, TTL/expiry after a CP disconnect, and
-* fail-closed-on-stale — is NOT fully implemented here. `generation` is present as
-* the version hook and the snapshot is FULL-REPLACE (converge-don't-diff, same as
-* `register/ok`), which is enough to route + authorize on a live CP. TTL-expiry and
-* tombstone semantics are a follow-up within this phase.
-*/
-/** One agent's placement + call policy within a channel. `daemonId` is the owning
-*  daemon the relay forwards to; `integrationId` is the DEFINITE reply integration
-*  (§6.2 — no fallback to "first connection"). */
-const CollabAgentPlacement = object({
-	agentId: string().uuid(),
-	daemonId: string().uuid(),
-	integrationId: string().uuid().optional(),
-	/** Public Slack app id (`A…`) for this agent's bot. Receivers use it to recognize
-	*  AgentConnect-authored platform messages — the first half of verifying an
-	*  authorship claim (send-message-routing-rework.md §4). */
-	botAppId: string().optional(),
-	/** Public platform member id this agent's bot posts as (Slack `U…`) — the id a
-	*  `<@…>` mention resolves to. With {@link botShared} and `name` it is the complete
-	*  input for the conversation-specific mention ADDRESS
-	*  (send-message-routing-rework.md §8.5), which both directions need: rendering an
-	*  exact address to post, and resolving an inbound mention back to an agent.
-	*  Public metadata, never a credential. */
-	botUserId: string().optional(),
-	/** True when {@link botUserId} backs MORE THAN ONE agent (a shared bot). The bot user
-	*  id alone then cannot identify an agent, so its address carries the agent slug too
-	*  (`<@U_SHARED> reviewer`) and a BARE mention of it addresses no specific agent —
-	*  which is why a shared bot with no exact author claim fails closed at ingress (§4)
-	*  and why a bare shared-bot mention from an agent must not fall back to the channel
-	*  default (§6). */
-	botShared: boolean().optional(),
-	callPolicy: _enum(["all", "selected"]).default("all"),
-	allowedCallerAgentIds: array(string()).default([]),
-	/** Caller-side authorization. Effective A→B access requires A's outbound
-	* policy to admit B and B's inbound call policy to admit A. */
-	outboundPolicy: _enum(["all", "selected"]).default("all"),
-	allowedTargetAgentIds: array(string()).default([]),
-	name: string().optional(),
-	displayName: string().optional()
-});
-/**
-* One agent's placement + call policy carried OUTSIDE any channel — the org-scoped
-* peer directory entry.
-*
-* Every structure on the CP→daemon and CP→relay wires is channel-keyed, so an agent
-* with NO IM integration (webchat, hook, dream, memory-only) never appears in any
-* `channels[]` entry at all. The channel-keyed snapshot structurally cannot express
-* "which agents exist in this org", which is precisely the input channel-free
-* authorization needs: discovery and A2A authorization depend only on the directional
-* call policy (`outboundPolicy`/`allowedTargetAgentIds` on the caller,
-* `callPolicy`/`allowedCallerAgentIds` on the target), org-scoped, with channel
-* demoted to an optional filter. Hence the flat list below.
-*/
-const CollabOrgAgent = CollabAgentPlacement.extend({ orgId: string().min(1) });
-/** All agents present in one channel, across daemons. `orgId` scopes routing +
-*  authorization: a cross-org caller/target pair never resolves (§2.5 — cross-org
-*  rejected). */
-const CollabChannelRoute = object({
-	orgId: string().min(1),
-	platform: Platform,
-	channelId: string().min(1),
-	agents: array(CollabAgentPlacement)
-});
-/**
-* The full collaboration snapshot — FULL-REPLACE (converge-don't-diff): the
-* recipient replaces its whole table with `channels`. `generation` monotonically
-* increases per source so a recipient can ignore a stale re-order (version hook for
-* the §6.5 lifecycle follow-up).
-*/
-const CollabRoutesSnapshot = object({
-	generation: number$1().int().nonnegative().default(0),
-	channels: array(CollabChannelRoute).default([]),
-	/**
-	* FLAT org-scoped directory, alongside (not instead of) `channels`. It is the only
-	* place an integration-less agent can appear — see `CollabOrgAgent` — and therefore
-	* the authorization input for channel-free A2A. `default([])` keeps a snapshot from
-	* an older CP (which advertises no `agent-directory-org-scope-v1`) decodable.
-	*/
-	agents: array(CollabOrgAgent).default([]),
-	/**
-	* §6.1 origin-kind classification for the platform ids the EMITTER knows — how an
-	* older peer classifies an id a newer CP introduces (its own built-in seed only
-	* covers ids its build shipped with). Consumers overlay these entries on their
-	* seed; an id classified by neither defaults to `'chat'`, the fail-closed answer
-	* wherever placements matter (`coordsDecision`). Both fields read as open strings
-	* per the S1a rule. `default([])` keeps a pre-S1b snapshot decodable.
-	*/
-	platformKinds: array(object({
-		platformId: string().min(1),
-		originKind: string().min(1)
-	})).default([])
-});
-//#endregion
-//#region ../protocol/dist/frames/hook.js
-/** Decimal wire form for Prisma/GitHub bigint values. */
-const HookBigIntString = string().regex(/^(?:0|[1-9]\d*)$/);
-/** The highest formal-review event one hook permits. */
-const HookReviewPolicy = _enum([
-	"off",
-	"comment",
-	"request_changes",
-	"full"
-]);
-/** External run-reporting transport. `status` is reserved for the later R3. */
-const HookReportingMode = _enum([
-	"off",
-	"check",
-	"status"
-]);
-/** R2a only admits informational; `required` remains a fail-closed future mode. */
-const HookGateMode = _enum(["informational", "required"]);
-/**
-* Exact config + dispatch identity captured when the CP compiles a hook fire.
-*
-* The relay-facing frames expose these fields individually at top level so an
-* older CP/relay can omit them without making the whole fire undecodable. A
-* consumer MUST have every field before enabling review/reporting; absence is
-* not filled with a revision and therefore fails closed. Action-time RPCs use
-* this complete object so a partially rolled-out tuple cannot authorize an
-* effect.
-*/
-const HookConfigSnapshot = object({
-	configRevision: HookBigIntString,
-	dispatchRevision: HookBigIntString,
-	dispatchDaemonId: string().uuid(),
-	reviewPolicy: HookReviewPolicy,
-	reportingMode: HookReportingMode,
-	gateMode: HookGateMode
-});
-/** Optional top-level form used only on rolling-compatible delivery frames. */
-const OptionalHookConfigSnapshot = HookConfigSnapshot.partial();
-/**
-* Trusted, body-free GitHub subject/revision metadata. It is deliberately
-* separate from HookContext: HookContext contains attacker-authored prompt
-* excerpts, whereas this object is cut from a signature-verified payload and
-* fenced to the CP-compiled numeric repo/installation rule.
-*
-* `headSha` is absent for PR issue_comment deliveries because GitHub omits the
-* revision there; the daemon resolves it before `hook/start`. R2a informational
-* checks use `reportSha=headSha` once known. Review-comment deliveries may also
-* identify the triggering comment and its normalized thread root; both remain
-* optional so mixed-version relay/daemon rollouts continue to decode.
-*/
-const GithubHookMetadata = object({
-	repoId: HookBigIntString,
-	repoFullName: string().min(1),
-	sourceInstallationId: HookBigIntString,
-	subjectKind: _enum(["issue", "pull_request"]),
-	pullNumber: number$1().int().positive().optional(),
-	headSha: string().min(1).optional(),
-	baseSha: string().min(1).optional(),
-	reportSha: string().min(1).optional(),
-	headRepoFullName: string().min(1).optional(),
-	mergeCommitSha: string().min(1).optional(),
-	isDraft: boolean().optional(),
-	baseChanged: boolean().optional(),
-	explicitReviewRequest: boolean().optional(),
-	reviewCommentId: HookBigIntString.optional(),
-	reviewThreadRootCommentId: HookBigIntString.optional()
-}).superRefine((value, ctx) => {
-	if (value.subjectKind === "pull_request" && value.pullNumber === void 0) ctx.addIssue({
-		code: "custom",
-		path: ["pullNumber"],
-		message: "pullNumber is required for a pull_request subject"
-	});
-	if (value.reportSha !== void 0 && value.headSha === void 0) ctx.addIssue({
-		code: "custom",
-		path: ["reportSha"],
-		message: "reportSha requires an authoritative headSha"
-	});
-	if (value.reportSha !== void 0 && value.headSha !== void 0 && value.reportSha !== value.headSha) ctx.addIssue({
-		code: "custom",
-		path: ["reportSha"],
-		message: "R2a reports only the authoritative pull head SHA"
-	});
-});
-const HookReviewEvent = _enum([
-	"COMMENT",
-	"REQUEST_CHANGES",
-	"APPROVE"
-]);
-const HookReviewVerdict = _enum([
-	"pass",
-	"fail",
-	"neutral"
-]);
-/** Short machine code only; raw GitHub/runtime exception text never crosses to reporting. */
-const HookReviewResultCode = string().min(1).max(100).regex(/^[a-z0-9_:-]+$/);
-/**
-* Body-free outcome of one reserved formal-review attempt.
-*
-* `not_submitted` is only legal after a deterministic no-effect failure and
-* lets the CP release the reservation. An uncertain POST remains `ambiguous`
-* until marker reconciliation proves whether GitHub created it.
-*/
-const HookReviewResult = discriminatedUnion("state", [
-	object({
-		state: literal("submitted"),
-		reviewId: string().min(1),
-		event: HookReviewEvent,
-		verdict: HookReviewVerdict,
-		commitId: string().min(1)
-	}),
-	object({
-		state: literal("not_submitted"),
-		code: HookReviewResultCode
-	}),
-	object({
-		state: literal("ambiguous"),
-		code: HookReviewResultCode
-	})
-]);
-/** Body-free identity of the daemon's one fallback GitHub comment. */
-const GithubPublishedComment = object({
-	kind: _enum(["issue_comment", "review_comment"]),
-	commentId: HookBigIntString
-});
-object({
-	source: _enum(["webhook", "github"]),
-	event: string().optional(),
-	action: string().optional(),
-	repo: string().optional(),
-	number: number$1().int().optional(),
-	title: string().optional(),
-	senderLogin: string().optional(),
-	senderAvatarUrl: string().url().optional(),
-	authorAssociation: string().optional(),
-	labels: array(string()).optional(),
-	htmlUrl: string().optional(),
-	bodyExcerpt: string().optional(),
-	body: string().optional(),
-	truncated: boolean().optional()
-});
-object({
-	hookId: string().uuid(),
-	agentId: string().uuid(),
-	deliveryKey: string().min(1),
-	...OptionalHookConfigSnapshot.shape,
-	event: string().min(1).optional(),
-	github: GithubHookMetadata.optional(),
-	status: _enum(["success", "failed"]),
-	durationMs: number$1().int().nonnegative().optional(),
-	sessionId: string().optional(),
-	reason: string().optional(),
-	reviewAttemptId: string().uuid().optional(),
-	reviewResult: HookReviewResult.optional(),
-	publishedComment: GithubPublishedComment.optional()
-}).superRefine((report, ctx) => {
-	if (report.reviewAttemptId === void 0 !== (report.reviewResult === void 0)) ctx.addIssue({
-		code: "custom",
-		path: report.reviewAttemptId === void 0 ? ["reviewAttemptId"] : ["reviewResult"],
-		message: "reviewAttemptId and reviewResult must be reported together"
-	});
-	if (report.publishedComment && report.reviewResult?.state === "submitted") ctx.addIssue({
-		code: "custom",
-		path: ["publishedComment"],
-		message: "a submitted formal review and fallback comment are mutually exclusive"
-	});
-});
-object({
-	hookId: string().uuid(),
-	agentId: string().uuid(),
-	deliveryKey: string().min(1),
-	sessionId: string().min(1).optional(),
-	event: string().min(1).optional(),
-	github: GithubHookMetadata,
-	...HookConfigSnapshot.shape
-});
-object({ accepted: literal(true) });
-object({
-	hookId: string().uuid(),
-	deliveryKey: string().min(1),
-	attemptId: string().uuid(),
-	requestedEvent: HookReviewEvent,
-	requestedVerdict: HookReviewVerdict,
-	snapshot: HookConfigSnapshot
-});
-object({
-	attemptId: string().uuid(),
-	token: string().min(1),
-	ttlSec: number$1().int().positive(),
-	expiresAt: string().datetime(),
-	repoId: HookBigIntString,
-	repoFullName: string().min(1),
-	pullNumber: number$1().int().positive(),
-	expectedHeadSha: string().min(1),
-	expectedBaseSha: string().min(1)
-});
-object({
-	hookId: string().uuid(),
-	deliveryKey: string().min(1),
-	attemptId: string().uuid(),
-	snapshot: HookConfigSnapshot,
-	result: HookReviewResult
-});
-object({ accepted: literal(true) });
-//#endregion
-//#region ../protocol/dist/frames/remote-mcp.js
-/** Non-secret entitlement carried CP → relay → daemon after webchat verification. */
-const WebchatRemoteMcpEntitlement = object({
-	authorityId: string().uuid(),
-	authorityGeneration: number$1().int().positive(),
-	expiresAt: string().datetime()
-}).strict();
-const DescriptorFence = object({
-	authorityId: string().uuid(),
-	authorityGeneration: number$1().int().positive(),
-	conversationId: string().uuid(),
-	descriptorInstanceId: string().uuid(),
-	grantRevision: number$1().int().positive()
-}).strict();
-object({
-	authorityId: string().uuid(),
-	authorityGeneration: number$1().int().positive(),
-	conversationId: string().uuid(),
-	descriptorInstanceId: string().uuid()
-}).strict();
-DescriptorFence.extend({
-	grantId: string().uuid(),
-	token: string().min(32),
-	expiresAt: string().datetime(),
-	mcpUrl: string().url()
-}).strict();
-DescriptorFence.extend({ grantId: string().uuid() }).strict().extend({ activated: boolean() }).strict();
-object({
-	authorityId: string().uuid(),
-	authorityGeneration: number$1().int().positive(),
-	conversationId: string().uuid(),
-	reason: _enum([
-		"session_closed",
-		"session_expired",
-		"agent_detached",
-		"feature_disabled",
-		"security"
-	])
-}).strict().pick({
-	authorityId: true,
-	authorityGeneration: true,
-	conversationId: true
-}).extend({ revoked: boolean() }).strict();
-//#endregion
-//#region ../protocol/dist/frames/relay-cp.js
-const RcAuth = object({
-	method: _enum(["token", "apikey"]),
-	credential: string().min(1)
-});
-const RcDeploymentConfig = object({
-	revision: number$1().int().nonnegative(),
-	githubWebhookSecret: string().min(1).optional()
-});
-const RcAuthOk = object({
-	heartbeatSec: number$1().int(),
-	serverTime: string().datetime(),
-	deploymentConfig: RcDeploymentConfig.optional()
-});
-const RcRegister = object({
-	name: string().min(1),
-	daemonUrl: string().min(1)
-});
-const RcRegistered = object({ relayId: string().uuid() });
-const RcHeartbeat = object({});
-const RcVerify = discriminatedUnion("kind", [object({
-	kind: literal("daemon-key"),
-	credential: string().min(1)
-}), object({
-	kind: literal("webchat-token"),
-	credential: string().min(1),
-	conversationBinding: literal("v1").optional()
-})]);
-const RcWebchatParticipant = object({
-	agentId: string().uuid(),
-	daemonId: string().uuid().optional(),
-	primary: boolean().optional()
-});
-const RcVerifyResult = object({
-	ok: boolean(),
-	reason: string().optional(),
-	orgId: string().optional(),
-	daemonId: string().uuid().optional(),
-	userId: string().optional(),
-	user: string().optional(),
-	agentId: string().uuid().optional(),
-	conversationId: string().uuid().optional(),
-	participants: array(RcWebchatParticipant).max(16).optional(),
-	remoteMcp: WebchatRemoteMcpEntitlement.optional()
-});
-const RcGithubHookFence = object({
-	hookId: string().uuid(),
-	configRevision: HookBigIntString,
-	dispatchRevision: HookBigIntString
-}).strict();
-const RcGithubCommentAuthz = object({
-	hookId: string().uuid(),
-	installationId: string().regex(/^[1-9]\d*$/),
-	repoId: string().regex(/^[1-9]\d*$/),
-	repoFullName: string().regex(/^[^/\s]+\/[^/\s]+$/),
-	senderLogin: string().min(1),
-	subjectAuthorLogin: string().min(1).optional(),
-	configRevision: HookBigIntString,
-	dispatchRevision: HookBigIntString,
-	siblingFences: array(RcGithubHookFence).min(1).optional()
-}).strict();
-const RcGithubCommentAuthzResult = object({ allowed: boolean() }).strict();
-const GithubNumericId = string().regex(/^[1-9]\d*$/);
-const RcGithubRerequest = union([object({
-	checkRunId: GithubNumericId,
-	repoId: GithubNumericId,
-	headSha: string().min(1),
-	deliveryKey: string().min(1).max(200),
-	includeBaseSha: literal(true).optional()
-}).strict(), object({
-	scope: literal("suite"),
-	appId: GithubNumericId,
-	installationId: GithubNumericId,
-	repoId: GithubNumericId,
-	headSha: string().min(1),
-	deliveryKey: string().min(1).max(200)
-}).strict()]);
-const RcGithubRerequestTarget = object({
-	hookId: string().uuid(),
-	pullNumber: number$1().int().positive(),
-	baseSha: string().min(1),
-	configRevision: HookBigIntString,
-	dispatchRevision: HookBigIntString
-}).strict();
-const RcGithubRerequestResult = union([
-	object({ allowed: literal(false) }).strict(),
-	object({
-		allowed: literal(true),
-		hookId: string().uuid(),
-		pullNumber: number$1().int().positive(),
-		baseSha: string().min(1).optional(),
-		configRevision: HookBigIntString,
-		dispatchRevision: HookBigIntString
-	}).strict(),
-	object({
-		allowed: literal(true),
-		targets: array(RcGithubRerequestTarget).min(1)
-	}).strict()
-]);
-const RcHookAssign = object({
-	hookId: string().uuid(),
-	kind: _enum(["webhook", "github"]),
-	agentId: string().uuid(),
-	daemonId: string().uuid(),
-	...OptionalHookConfigSnapshot.shape,
-	sessionMode: _enum([
-		"perDelivery",
-		"perThread",
-		"shared"
-	]),
-	target: CronTarget.optional(),
-	webhook: object({
-		urlToken: string().min(1),
-		hmacSecret: string().optional()
-	}).optional(),
-	github: object({
-		repoId: string(),
-		repoFullName: string(),
-		sessionKeyPrefix: string().min(1).optional(),
-		events: array(string()),
-		labelFilter: array(string()),
-		commentFamilies: array(_enum(["issues", "pull_request"])).optional(),
-		mentionOnly: boolean(),
-		appSlug: string().optional(),
-		agentName: string().optional(),
-		installationIds: array(string())
-	}).optional()
-}).superRefine((rule, ctx) => {
-	if (rule.dispatchDaemonId !== void 0 && rule.dispatchDaemonId !== rule.daemonId) ctx.addIssue({
-		code: "custom",
-		path: ["dispatchDaemonId"],
-		message: "dispatchDaemonId must equal daemonId on a compiled rule"
-	});
-});
-const RcHookRemove = object({ hookId: string().uuid() });
-const RcRunReport = object({
-	hookId: string().uuid(),
-	deliveryKey: string().min(1),
-	firedAt: string().datetime(),
-	agentId: string().uuid(),
-	daemonId: string().uuid().optional(),
-	...OptionalHookConfigSnapshot.shape,
-	event: string().min(1).optional(),
-	github: GithubHookMetadata.optional(),
-	status: _enum(["accepted", "failed"]),
-	reason: string().optional()
-}).superRefine((report, ctx) => {
-	if (report.daemonId !== void 0 && report.dispatchDaemonId !== void 0 && report.daemonId !== report.dispatchDaemonId) ctx.addIssue({
-		code: "custom",
-		path: ["dispatchDaemonId"],
-		message: "dispatchDaemonId must equal daemonId on a delivery report"
-	});
-});
-const RcGithubInstallation = object({
-	installationId: string().min(1),
-	action: string().min(1)
-});
-const RcDaemonRevoke = object({ daemonId: string().uuid() });
 /** App-level Slack message shortcut for opening the controls of the session that
 * owns the selected message's conversation. Direct apps receive it over Socket
-* Mode; shared apps receive the same callback through the relay HTTP edge. */
+* Mode; shared apps receive the same callback through the relay HTTP edge.
+*
+* Declared to Slack by {@link buildSlackAppManifest} below, which is why it lives
+* here rather than beside the runtime Block Kit action ids in `frames/relay-cp.ts`:
+* those name controls on messages we post, this one names a manifest feature. */
 const SLACK_MANAGE_SESSION_SHORTCUT_CALLBACK_ID = "ac_manage_session";
-/** One short choice from the compact Slack status overflow. Slack caps option
-*  values at 150 characters; the longer session target rides in `block_id`. */
-const SlackStatusOverflowAction = _enum([
-	"switch-agent",
-	"manage",
-	"cancel"
-]);
-object({
-	v: literal(1),
-	action: SlackStatusOverflowAction,
-	target: string().min(1)
-}).strict();
-object({
-	v: literal(1),
-	agentId: string().min(1),
-	integrationId: string().min(1),
-	sessionKey: string().min(1)
-}).strict();
-const AttributedRoute = object({
-	agentId: string().uuid(),
-	daemonId: string().uuid(),
-	integrationId: string().uuid(),
-	scope: object({
-		channel: string().optional(),
-		thread: string().optional()
-	}).optional(),
-	match: BindMatch
-});
-const RcBotSecrets = union([
-	object({
-		botToken: string(),
-		signingSecret: string()
-	}).catchall(unknown()),
-	object({
-		verificationToken: string(),
-		encryptKey: string().optional()
-	}).catchall(unknown()),
-	record$1(string(), unknown())
-]);
-const RcAgentDirEntry = object({
-	agentId: string().uuid(),
-	name: string(),
-	daemonId: string().uuid(),
-	integrationId: string().uuid().optional()
-});
-const RcBotAssign = object({
-	botId: string().uuid(),
-	platform: Platform,
-	originKind: string().min(1).optional(),
-	credentialRevision: number$1().int().nonnegative().optional(),
-	secrets: RcBotSecrets,
-	ingress: unknown().optional(),
-	members: array(object({
-		daemonId: string().uuid(),
-		agentIds: array(string().uuid())
-	})),
-	agents: array(RcAgentDirEntry).default([]),
-	routes: array(AttributedRoute),
-	defaultAgentId: string().uuid().optional(),
-	defaultDaemonId: string().uuid().optional(),
-	gatedAgentIds: array(string().uuid()).default([]),
-	mutedChannels: array(string()).default([]),
-	gatedOffChannels: array(string()).default([]),
-	noticeAuthority: string().uuid().optional(),
-	noticedDmConversations: array(string()).default([])
-});
-const RcBotUnassign = object({
-	botId: string().uuid(),
-	credentialRevision: number$1().int().nonnegative().optional()
-});
-const RcRoutes = object({
-	botId: string().uuid(),
-	members: array(object({
-		daemonId: string().uuid(),
-		agentIds: array(string().uuid())
-	})),
-	agents: array(RcAgentDirEntry).default([]),
-	routes: array(AttributedRoute),
-	defaultAgentId: string().uuid().optional(),
-	defaultDaemonId: string().uuid().optional(),
-	gatedAgentIds: array(string().uuid()).default([]),
-	mutedChannels: array(string()).default([]),
-	gatedOffChannels: array(string()).default([]),
-	noticeAuthority: string().uuid().optional(),
-	noticedDmConversations: array(string()).default([])
-});
-const RcAssign = object({
-	botId: string().uuid(),
-	sessionKey: string().min(1),
-	agentId: string().uuid(),
-	daemonId: string().uuid()
-});
-const RcParticipantAssign = object({
-	botId: string().uuid(),
-	sessionKey: string().min(1),
-	agentId: string().uuid(),
-	daemonId: string().uuid()
-});
-const RcSetChannelAgent = object({
-	botId: string().uuid(),
-	channelId: string().min(1),
-	agentId: string().uuid()
-});
-const RcBotChannels = object({
-	botId: string().uuid(),
-	channels: array(IntegrationChannel)
-});
-const RcNoticePosted = object({
-	botId: string().uuid(),
-	channel: string().min(1)
-});
-const RcBotRevoked = object({
-	botId: string().uuid(),
-	reason: _enum(["app_uninstalled", "tokens_revoked"]),
-	credentialRevision: number$1().int().nonnegative().optional(),
-	eventAtMs: number$1().int().nonnegative().optional()
-});
-const RcBotRevokedOk = object({
-	botId: string().uuid(),
-	applied: boolean()
-});
-/** `type` string → payload schema for the relay↔CP wire. */
-const RELAY_CP_SCHEMAS = {
-	"rc/auth": RcAuth,
-	"rc/auth/ok": RcAuthOk,
-	"rc/register": RcRegister,
-	"rc/registered": RcRegistered,
-	"rc/heartbeat": RcHeartbeat,
-	"rc/verify": RcVerify,
-	"rc/verify/ok": RcVerifyResult,
-	"rc/github-comment-authz": RcGithubCommentAuthz,
-	"rc/github-comment-authz/ok": RcGithubCommentAuthzResult,
-	"rc/github-rerequest": RcGithubRerequest,
-	"rc/github-rerequest/ok": RcGithubRerequestResult,
-	"rc/hook-assign": RcHookAssign,
-	"rc/hook-remove": RcHookRemove,
-	"rc/run-report": RcRunReport,
-	"rc/github-installation": RcGithubInstallation,
-	"rc/daemon-revoke": RcDaemonRevoke,
-	"rc/bot-assign": RcBotAssign,
-	"rc/bot-unassign": RcBotUnassign,
-	"rc/routes": RcRoutes,
-	"rc/assign": RcAssign,
-	"rc/participant-assign": RcParticipantAssign,
-	"rc/set-channel-agent": RcSetChannelAgent,
-	"rc/bot-channels": RcBotChannels,
-	"rc/bot-conversation": object({
-		botId: string().uuid(),
-		conversation: IntegrationChannel
-	}),
-	"rc/bot-revoked": RcBotRevoked,
-	"rc/bot-revoked/ok": RcBotRevokedOk,
-	"rc/notice-posted": RcNoticePosted,
-	"rc/thread-assign": object({
-		botId: string().uuid(),
-		sessionKey: string().min(1),
-		agentId: string().uuid(),
-		daemonId: string().uuid()
-	}),
-	"rc/thread-participant": object({
-		botId: string().uuid(),
-		sessionKey: string().min(1),
-		agentId: string().uuid(),
-		daemonId: string().uuid()
-	}),
-	"rc/thread-lookup": object({
-		botId: string().uuid(),
-		sessionKey: string().min(1)
-	}),
-	"rc/thread-lookup/ok": object({
-		botId: string().uuid(),
-		sessionKey: string().min(1),
-		target: object({
-			agentId: string().uuid(),
-			daemonId: string().uuid()
-		}).nullable(),
-		participants: array(object({
-			agentId: string().uuid(),
-			daemonId: string().uuid()
-		})).default([])
-	}),
-	"rc/collab-routes": CollabRoutesSnapshot,
-	"rc/mcp-assign": object({
-		providerId: string().uuid(),
-		upstreamUrl: string(),
-		headers: array(object({
-			name: string(),
-			value: string()
-		})).default([]),
-		grantKeyHashes: array(string().min(1)).min(1)
-	}),
-	"rc/mcp-unassign": object({
-		providerId: string().uuid(),
-		grantKeyHash: string().optional()
-	}),
-	"rc/memoryconnection-assign": object({
-		connectionId: string().uuid(),
-		revision: number$1().int().positive(),
-		upstreamUrl: string().url().max(2048),
-		headers: array(object({
-			name: string().min(1).max(128),
-			value: string().max(16 * 1024)
-		})).max(64).default([]),
-		grantKeyHashes: array(string().regex(/^[a-f0-9]{64}$/)).min(1).max(64)
-	}),
-	"rc/memoryconnection-unassign": object({
-		connectionId: string().uuid(),
-		revision: number$1().int().positive(),
-		grantKeyHash: string().regex(/^[a-f0-9]{64}$/).optional()
-	}),
-	error: ErrorFrame
-};
-Object.keys(RELAY_CP_SCHEMAS);
-discriminatedUnion("type", [
-	frameSchema("rc/auth", RELAY_CP_SCHEMAS["rc/auth"]),
-	frameSchema("rc/auth/ok", RELAY_CP_SCHEMAS["rc/auth/ok"]),
-	frameSchema("rc/register", RELAY_CP_SCHEMAS["rc/register"]),
-	frameSchema("rc/registered", RELAY_CP_SCHEMAS["rc/registered"]),
-	frameSchema("rc/heartbeat", RELAY_CP_SCHEMAS["rc/heartbeat"]),
-	frameSchema("rc/verify", RELAY_CP_SCHEMAS["rc/verify"]),
-	frameSchema("rc/verify/ok", RELAY_CP_SCHEMAS["rc/verify/ok"]),
-	frameSchema("rc/github-comment-authz", RELAY_CP_SCHEMAS["rc/github-comment-authz"]),
-	frameSchema("rc/github-comment-authz/ok", RELAY_CP_SCHEMAS["rc/github-comment-authz/ok"]),
-	frameSchema("rc/github-rerequest", RELAY_CP_SCHEMAS["rc/github-rerequest"]),
-	frameSchema("rc/github-rerequest/ok", RELAY_CP_SCHEMAS["rc/github-rerequest/ok"]),
-	frameSchema("rc/hook-assign", RELAY_CP_SCHEMAS["rc/hook-assign"]),
-	frameSchema("rc/hook-remove", RELAY_CP_SCHEMAS["rc/hook-remove"]),
-	frameSchema("rc/run-report", RELAY_CP_SCHEMAS["rc/run-report"]),
-	frameSchema("rc/github-installation", RELAY_CP_SCHEMAS["rc/github-installation"]),
-	frameSchema("rc/daemon-revoke", RELAY_CP_SCHEMAS["rc/daemon-revoke"]),
-	frameSchema("rc/bot-assign", RELAY_CP_SCHEMAS["rc/bot-assign"]),
-	frameSchema("rc/bot-unassign", RELAY_CP_SCHEMAS["rc/bot-unassign"]),
-	frameSchema("rc/routes", RELAY_CP_SCHEMAS["rc/routes"]),
-	frameSchema("rc/assign", RELAY_CP_SCHEMAS["rc/assign"]),
-	frameSchema("rc/participant-assign", RELAY_CP_SCHEMAS["rc/participant-assign"]),
-	frameSchema("rc/set-channel-agent", RELAY_CP_SCHEMAS["rc/set-channel-agent"]),
-	frameSchema("rc/bot-channels", RELAY_CP_SCHEMAS["rc/bot-channels"]),
-	frameSchema("rc/bot-conversation", RELAY_CP_SCHEMAS["rc/bot-conversation"]),
-	frameSchema("rc/bot-revoked", RELAY_CP_SCHEMAS["rc/bot-revoked"]),
-	frameSchema("rc/bot-revoked/ok", RELAY_CP_SCHEMAS["rc/bot-revoked/ok"]),
-	frameSchema("rc/notice-posted", RELAY_CP_SCHEMAS["rc/notice-posted"]),
-	frameSchema("rc/thread-assign", RELAY_CP_SCHEMAS["rc/thread-assign"]),
-	frameSchema("rc/thread-participant", RELAY_CP_SCHEMAS["rc/thread-participant"]),
-	frameSchema("rc/thread-lookup", RELAY_CP_SCHEMAS["rc/thread-lookup"]),
-	frameSchema("rc/thread-lookup/ok", RELAY_CP_SCHEMAS["rc/thread-lookup/ok"]),
-	frameSchema("rc/collab-routes", RELAY_CP_SCHEMAS["rc/collab-routes"]),
-	frameSchema("rc/mcp-assign", RELAY_CP_SCHEMAS["rc/mcp-assign"]),
-	frameSchema("rc/mcp-unassign", RELAY_CP_SCHEMAS["rc/mcp-unassign"]),
-	frameSchema("rc/memoryconnection-assign", RELAY_CP_SCHEMAS["rc/memoryconnection-assign"]),
-	frameSchema("rc/memoryconnection-unassign", RELAY_CP_SCHEMAS["rc/memoryconnection-unassign"]),
-	frameSchema("error", RELAY_CP_SCHEMAS["error"])
-]);
-//#endregion
-//#region ../protocol/dist/slack-app-manifest.js
 /** Public platform profile copy. Never derive this from an Agent description. */
 const PLATFORM_APP_DESCRIPTION = "AI agent powered by AgentConnect.";
 const SLACK_BOT_SCOPES = [
@@ -57634,6 +56521,26 @@ async function disconnectPrisma() {
 	await singleton?.$disconnect();
 	singleton = void 0;
 }
+//#endregion
+//#region ../control-plane/dist/secrets/scope.js
+/** Deployment-owned material (the deployment config document's secrets). */
+const DEPLOYMENT_SCOPE = { kind: "deployment" };
+/**
+* Envelope marker for values sealed under a SCOPED key. It carries a format
+* version and nothing else — deliberately not the tenant id (see above). Its
+* one job is to let `open` tell a scoped value apart from a pre-scoping one, so
+* the rollout needs no backfill.
+*/
+const SECRET_ENVELOPE_PREFIX = "acv1:";
+/**
+* Org key names default to `<deployment key>-org-`, so they inherit whatever
+* namespace the deployment key already occupies. Deployments commonly share one
+* transit mount and rely on key naming alone to stay separated; a fixed prefix
+* would collide their org keys, a derived one cannot.
+*/
+function effectiveOrgKeyPrefix(transitKey, configured) {
+	return configured ?? `${transitKey}-org-`;
+}
 const HttpUrlSchema = string().url().superRefine((value, ctx) => {
 	const url = new URL(value);
 	if (url.protocol !== "http:" && url.protocol !== "https:") ctx.addIssue({
@@ -57888,7 +56795,7 @@ var DeploymentConfigService = class {
 		for (const [rawKey, value] of Object.entries(secretPatch)) {
 			const key = DeploymentSecretKeySchema.parse(rawKey);
 			prepared[key] = value === null ? null : {
-				sealedValue: await this.cipher.seal(value),
+				sealedValue: await this.cipher.seal(value, DEPLOYMENT_SCOPE),
 				fingerprint: fingerprint(value)
 			};
 		}
@@ -57909,7 +56816,7 @@ var DeploymentConfigService = class {
 		const secrets = {};
 		for (const secret of row.secrets) {
 			const parsed = DeploymentSecretKeySchema.safeParse(secret.key);
-			if (parsed.success && openedKeys.has(parsed.data)) secrets[parsed.data] = await this.cipher.open(secret.sealedValue);
+			if (parsed.success && openedKeys.has(parsed.data)) secrets[parsed.data] = await this.cipher.open(secret.sealedValue, DEPLOYMENT_SCOPE);
 		}
 		return {
 			schemaVersion: 1,
@@ -58105,12 +57012,19 @@ var PgDeploymentConfigStore = class extends DeploymentConfigService {
 *
 * Envelope encryption as a service: the data key never leaves Vault; the CP
 * sends base64 plaintext to `transit/encrypt/<key>` and stores the returned
-* self-describing `vault:vN:…` ciphertext in the existing text columns.
+* ciphertext, behind this deployment's envelope tag, in the existing text
+* columns. WHICH key is chosen comes from the {@link SecretScope} the caller
+* passes — the deployment's key, or `<orgKeyPrefix><orgId>` — so an
+* organization's material can be destroyed with its key
+* (docs/designs/per-org-secret-encryption.md).
 *
 * Contract (pinned on the port):
-* - `open` PASSES THROUGH values it did not seal (no `vault:vN:` prefix ⇒
-*   return as-is): existing plaintext rows keep reading after the flip, and the
-*   next write re-seals them — the rollout is online, no backfill required.
+* - `open` PASSES THROUGH values it did not seal (neither the envelope tag nor
+*   a bare `vault:vN:` prefix ⇒ return as-is): existing plaintext rows keep
+*   reading after the flip, and the next write re-seals them — the rollout is
+*   online, no backfill required.
+* - A value sealed under one scope does NOT open under another: Transit rejects
+*   a ciphertext presented to a different key, which is the cross-tenant fence.
 * - No argument or response body is ever logged; errors carry only the HTTP
 *   status and Vault's `errors[]` strings.
 *
@@ -58121,11 +57035,13 @@ var PgDeploymentConfigStore = class extends DeploymentConfigService {
 * that exact login wire shape ({role, jwt}), so nothing here is bound to
 * Kubernetes — a k8s ServiceAccount token is just the common jwtPath.
 *
-* `open` results are cached in-process keyed by ciphertext (bounded, insertion-
-* order eviction): reconcile opens every owned agent's secrets per register, and
-* Transit ciphertexts are stable until re-sealed, so the cache turns that into
-* one network call per distinct value. `seal` is never cached — Transit returns
-* fresh ciphertext per call by design.
+* `open` results are cached in-process keyed by key name AND ciphertext
+* (bounded, insertion-order eviction): reconcile opens every owned agent's
+* secrets per register, and Transit ciphertexts are stable until re-sealed, so
+* the cache turns that into one network call per distinct value. The key name
+* belongs in the cache key because the stored string alone no longer implies
+* one. `seal` is never cached — Transit returns fresh ciphertext per call by
+* design.
 */
 /** Transit ciphertext is self-describing: `vault:v<key-version>:<base64>`. */
 const CIPHERTEXT_RE = /^vault:v\d+:/;
@@ -58134,6 +57050,7 @@ const RENEW_FRACTION = .8;
 var VaultTransitSecretCipher = class {
 	base;
 	key;
+	orgKeyPrefix;
 	mount;
 	namespace;
 	auth;
@@ -58146,6 +57063,7 @@ var VaultTransitSecretCipher = class {
 	constructor(opts) {
 		this.base = `${opts.addr.replace(/\/+$/, "")}/v1`;
 		this.key = opts.key;
+		this.orgKeyPrefix = opts.orgKeyPrefix;
 		this.mount = opts.mount ?? "transit";
 		this.namespace = opts.namespace;
 		this.auth = opts.auth;
@@ -58153,19 +57071,31 @@ var VaultTransitSecretCipher = class {
 		this.now = opts.now ?? Date.now;
 		this.openCacheMax = opts.openCacheMax ?? 5e3;
 	}
-	async seal(plaintext) {
-		const data = await this.transit("encrypt", { plaintext: Buffer.from(plaintext, "utf8").toString("base64") });
-		if (typeof data.ciphertext !== "string") throw new Error("vault transit encrypt: no ciphertext in response");
-		return data.ciphertext;
+	/**
+	* The key a scope resolves to. Org keys are created lazily by Transit on the
+	* first encrypt (the policy must permit creation on that path); nothing here
+	* is coupled to organization creation.
+	*/
+	keyFor(scope) {
+		return scope.kind === "deployment" ? this.key : `${this.orgKeyPrefix}${scope.orgId}`;
 	}
-	async open(stored) {
-		if (!CIPHERTEXT_RE.test(stored)) return stored;
-		const hit = this.openCache.get(stored);
+	async seal(plaintext, scope) {
+		const data = await this.transit("encrypt", this.keyFor(scope), { plaintext: Buffer.from(plaintext, "utf8").toString("base64") });
+		if (typeof data.ciphertext !== "string") throw new Error("vault transit encrypt: no ciphertext in response");
+		return `${SECRET_ENVELOPE_PREFIX}${data.ciphertext}`;
+	}
+	async open(stored, scope) {
+		const scoped = stored.startsWith(SECRET_ENVELOPE_PREFIX);
+		if (!scoped && !CIPHERTEXT_RE.test(stored)) return stored;
+		const key = scoped ? this.keyFor(scope) : this.key;
+		const ciphertext = scoped ? stored.slice(5) : stored;
+		const cacheKey = `${key}\u0000${ciphertext}`;
+		const hit = this.openCache.get(cacheKey);
 		if (hit !== void 0) return hit;
-		const data = await this.transit("decrypt", { ciphertext: stored });
+		const data = await this.transit("decrypt", key, { ciphertext });
 		if (typeof data.plaintext !== "string") throw new Error("vault transit decrypt: no plaintext in response");
 		const value = Buffer.from(data.plaintext, "base64").toString("utf8");
-		this.cacheOpen(stored, value);
+		this.cacheOpen(cacheKey, value);
 		return value;
 	}
 	cacheOpen(ciphertext, plaintext) {
@@ -58175,8 +57105,8 @@ var VaultTransitSecretCipher = class {
 		}
 		this.openCache.set(ciphertext, plaintext);
 	}
-	async transit(op, body) {
-		const path = `${this.mount}/${op}/${this.key}`;
+	async transit(op, key, body) {
+		const path = `${this.mount}/${op}/${key}`;
 		let res = await this.post(path, body, await this.token());
 		if (res.status === 403 && this.auth.method === "jwt") {
 			this.clientToken = void 0;
@@ -58252,11 +57182,21 @@ async function describeError(res) {
 * as Vault Transit stores ciphertext. The composition root selects one provider,
 * so every store switches together.
 *
+* Every call carries a {@link SecretScope} naming WHOSE key to use — the
+* deployment's, or one organization's (docs/designs/per-org-secret-encryption.md).
+* The scope comes from the caller, never from the stored value.
+*
 * Contract for an encrypting implementation (e.g. Vault Transit):
-* - `seal` returns a self-describing value (Transit's `vault:v1:…` is already one).
+* - `seal` returns a self-describing value carrying the envelope version
+*   (`acv1:` + Transit's own `vault:v1:…`).
 * - `open` MUST pass through values it did not seal (no recognizable prefix ⇒
 *   return as-is): existing plaintext rows keep working, and re-sealing on the
 *   next write migrates them lazily — the flip is online, no backfill required.
+*   Values sealed before scoping existed (a bare `vault:vN:`) open under the
+*   deployment key whatever `scope` says; only the envelope-tagged arm is
+*   scoped.
+* - A value sealed under one scope MUST NOT open under another. Failing closed
+*   there is the point of passing the scope in.
 * - Neither side ever logs its argument.
 *
 * This is NOT the C5 `SecretsProvider` lease broker (`providers/provider.ts`),
@@ -58297,6 +57237,7 @@ function makeSecretCipher(config) {
 	return new VaultTransitSecretCipher({
 		addr: config.VAULT_ADDR,
 		key: config.VAULT_TRANSIT_KEY,
+		orgKeyPrefix: effectiveOrgKeyPrefix(config.VAULT_TRANSIT_KEY, config.VAULT_TRANSIT_ORG_KEY_PREFIX),
 		mount: config.VAULT_TRANSIT_MOUNT,
 		...config.VAULT_NAMESPACE ? { namespace: config.VAULT_NAMESPACE } : {},
 		auth