@antasphere/slideless 0.13.3 → 0.13.6

package/dist/bin.js

@@ -1354,16 +1354,16 @@ var require_command = __commonJS({
        * @param {Function} listener
        * @return {Command} `this` command for chaining
        */
-      hook(event, listener) {
+      hook(event2, listener) {
         const allowedValues = ["preSubcommand", "preAction", "postAction"];
-        if (!allowedValues.includes(event)) {
-          throw new Error(`Unexpected value for event passed to hook : '${event}'.
+        if (!allowedValues.includes(event2)) {
+          throw new Error(`Unexpected value for event passed to hook : '${event2}'.
 Expecting one of '${allowedValues.join("', '")}'`);
         }
-        if (this._lifeCycleHooks[event]) {
-          this._lifeCycleHooks[event].push(listener);
+        if (this._lifeCycleHooks[event2]) {
+          this._lifeCycleHooks[event2].push(listener);
         } else {
-          this._lifeCycleHooks[event] = [listener];
+          this._lifeCycleHooks[event2] = [listener];
         }
         return this;
       }
@@ -2132,15 +2132,15 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {(Promise|undefined)}
        * @private
        */
-      _chainOrCallHooks(promise2, event) {
+      _chainOrCallHooks(promise2, event2) {
         let result = promise2;
         const hooks = [];
-        this._getCommandAndAncestors().reverse().filter((cmd) => cmd._lifeCycleHooks[event] !== void 0).forEach((hookedCommand) => {
-          hookedCommand._lifeCycleHooks[event].forEach((callback) => {
+        this._getCommandAndAncestors().reverse().filter((cmd) => cmd._lifeCycleHooks[event2] !== void 0).forEach((hookedCommand) => {
+          hookedCommand._lifeCycleHooks[event2].forEach((callback) => {
             hooks.push({ hookedCommand, callback });
           });
         });
-        if (event === "postAction") {
+        if (event2 === "postAction") {
           hooks.reverse();
         }
         hooks.forEach((hookDetail) => {
@@ -2158,10 +2158,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {(Promise|undefined)}
        * @private
        */
-      _chainOrCallSubCommandHook(promise2, subCommand, event) {
+      _chainOrCallSubCommandHook(promise2, subCommand, event2) {
         let result = promise2;
-        if (this._lifeCycleHooks[event] !== void 0) {
-          this._lifeCycleHooks[event].forEach((hook) => {
+        if (this._lifeCycleHooks[event2] !== void 0) {
+          this._lifeCycleHooks[event2].forEach((hook) => {
             result = this._chainOrCall(result, () => {
               return hook(this, subCommand);
             });
@@ -3535,7 +3535,7 @@ function migrateLegacyConfig(env, spec) {
   return { migrated: true, from, to };
 }
 
-// ../chassis-cli/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/config.js
 function createConfig(identity) {
   const TOOL = identity.tool;
   const LEGACY = { tool: TOOL, legacyDir: identity.legacyConfigDir };
@@ -3561,7 +3561,7 @@ function createConfig(identity) {
   return { configPath: configPath2, loadConfig: loadConfig3, saveConfig: saveConfig3, clearConfig: clearConfig2, removeConnectKey: removeConnectKey2 };
 }
 
-// ../chassis-sdk/dist/index.js
+// ../../node_modules/.pnpm/@antasphere+chassis-sdk@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-sdk/dist/index.js
 var PlatformApiError = class extends Error {
   status;
   code;
@@ -4074,7 +4074,7 @@ var ChassisClient = class {
   }
 };
 
-// ../chassis-cli/dist/workspace.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/workspace.js
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isWorkspaceId(value) {
   return UUID_RE.test(value);
@@ -4181,7 +4181,7 @@ ${workspaceLines(me.workspaces)}`;
   };
 }
 
-// ../chassis-cli/dist/context.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/context.js
 var CliApiRefusal = class extends CliUsageError {
   status;
   constructor(message, status) {
@@ -4475,7 +4475,7 @@ var {
   Help
 } = import_index.default;
 
-// ../chassis-cli/dist/stdin.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/stdin.js
 var claims = /* @__PURE__ */ new WeakMap();
 async function readAllStdin() {
   const chunks = [];
@@ -4496,7 +4496,7 @@ async function readSecretFromStdin(io, claimant) {
   return value;
 }
 
-// ../chassis-cli/dist/commands/auth.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/auth.js
 var HUB_URL_ENV = "ANTASPHERE_URL";
 var DEFAULT_HUB_URL = "https://account.antasphere.com";
 function describeCredential(source, profileName) {
@@ -4951,7 +4951,7 @@ ${organizationsLine(me)}`);
   });
 }
 
-// ../chassis-cli/dist/commands/workspaces.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/workspaces.js
 function registerWorkspaceCommands(kit, program2, io) {
   const { requireApiKey: requireApiKey2, resolveContext: resolveContext2, workspaceSource } = kit;
   const { describeSelection } = kit.workspace;
@@ -5023,7 +5023,7 @@ function registerWorkspaceCommands(kit, program2, io) {
   });
 }
 
-// ../chassis-cli/dist/commands/teams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/teams.js
 function explainTeamRefusal(e, ctx) {
   switch (e.code) {
     case "forbidden":
@@ -5227,7 +5227,7 @@ ${teamLines(team)}`);
   });
 }
 
-// ../chassis-cli/dist/commands/projects.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/projects.js
 var ROLES = ["viewer", "editor", "manager"];
 function parseRole(value) {
   if (ROLES.includes(value))
@@ -18278,8 +18278,8 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
       reg.add(this, meta3);
       return this;
     },
-    refine(check2, params) {
-      return this.check(refine(check2, params));
+    refine(check3, params) {
+      return this.check(refine(check3, params));
     },
     superRefine(refinement, params) {
       return this.check(superRefine(refinement, params));
@@ -20016,7 +20016,7 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../chassis-contract/dist/schemas/common.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/common.js
 var apiErrorSchema = external_exports.object({
   error: external_exports.object({
     code: external_exports.string(),
@@ -20121,12 +20121,12 @@ function isValidMediaType(value) {
   return value.length >= 1 && value.length <= 255 && isLatin1(value) && MEDIA_TYPE_RE.test(value);
 }
 
-// ../chassis-contract/dist/schemas/scope.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/scope.js
 function defineScopeSchema(scopes) {
   return external_exports.enum(scopes);
 }
 
-// ../chassis-contract/dist/seams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/seams.js
 var KNOWN_AUTH_METHODS = [
   "password",
   "email-otp",
@@ -20136,20 +20136,765 @@ var KNOWN_AUTH_METHODS = [
   "antasphere"
 ];
 
-// ../chassis-contract/dist/entitlements.js
-var ENTITLEMENT_TIERS = ["free", "pro"];
-var entitlementTierSchema = external_exports.enum(ENTITLEMENT_TIERS);
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/common.js
+var apiErrorSchema2 = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string(),
+    message: external_exports.string(),
+    details: external_exports.unknown().optional()
+  })
+});
+var workspaceRoleSchema2 = external_exports.enum(["owner", "admin", "member"]);
+var scopeSchema = external_exports.enum([
+  "account:read",
+  "account:write",
+  "data:export",
+  "sso:exchange",
+  "billing:read",
+  "billing:admin"
+]);
+var cursorPageQuerySchema2 = external_exports.object({
+  cursor: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(100).default(50)
+});
+function hasControlChars2(value) {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code === 9 || code === 10 || code === 13)
+      continue;
+    if (code < 32 || code === 127)
+      return true;
+  }
+  return false;
+}
+function noControlChars2(schema) {
+  return schema.refine((v) => !hasControlChars2(v), {
+    error: "must not contain NUL or other control characters"
+  });
+}
+function plainText2(min, max) {
+  return noControlChars2(external_exports.string().min(min).max(max));
+}
+function plainTextTrimmed(min, max) {
+  return noControlChars2(external_exports.string().trim().min(min).max(max));
+}
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/instance.js
+var instanceInfoSchema = external_exports.object({
+  name: external_exports.string(),
+  instanceId: external_exports.string().nullable(),
+  edition: external_exports.string(),
+  version: external_exports.string(),
+  apiVersion: external_exports.literal("v1"),
+  setupRequired: external_exports.boolean(),
+  /**
+   * Who may create an account here (ADR 027, `SIGNUP_MODE`): `open`, anyone
+   * through every self-service entrance (the hub's own posture, ADR 013);
+   * `invite`, only through an invitation, the first-boot setup or the
+   * operator's staff list. The sign-up page reads it to say so; `auth.signUp`
+   * is false under `invite` whatever the mail driver.
+   */
+  signupMode: external_exports.enum(["open", "invite"]),
+  auth: external_exports.object({
+    methods: external_exports.array(external_exports.enum(["password", "email-otp", "google", "api-key", "oauth"])),
+    passwordReset: external_exports.boolean(),
+    emailChange: external_exports.boolean(),
+    twoFactor: external_exports.boolean(),
+    signUp: external_exports.boolean()
+  }),
+  features: external_exports.object({
+    mcp: external_exports.boolean(),
+    oauth: external_exports.boolean(),
+    files: external_exports.boolean()
+  }),
+  /**
+   * Whether credits are sold here (ADR 027): the payment provider's name
+   * (`stripe`) when one is configured, `null` when none is. With `null` the
+   * dashboard shows no Billing section, no balance, no plan prompt and no
+   * staff pricing page; the money routes already answer 503 (ADR 023).
+   */
+  billing: external_exports.object({ provider: external_exports.string().nullable() }),
+  /**
+   * `true` while the operator's DEMO_SIGN_IN switch is on: demo links sign
+   * people in here, and the dashboard shows every signed-in person a banner
+   * saying so. ABSENT otherwise, never false, so an instance without the
+   * switch serves the same discovery bytes as before it existed.
+   */
+  demoSignIn: external_exports.boolean().optional()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/setup.js
+var setupRequestSchema = external_exports.object({
+  instanceName: plainText2(1, 120),
+  owner: external_exports.object({
+    email: external_exports.email(),
+    name: plainText2(1, 120),
+    password: external_exports.string().min(12).max(256)
+  }),
+  setupToken: external_exports.string().optional()
+});
+var setupResponseSchema = external_exports.object({
+  instanceId: external_exports.string(),
+  workspaceId: external_exports.string(),
+  ownerUserId: external_exports.string()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/orgs.js
+var lookKey = external_exports.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "a short lowercase key").nullable();
+var lookLevel = external_exports.number().min(0).max(1).nullable();
+var workspaceLookSchema = external_exports.object({
+  theme: lookKey,
+  pattern: lookKey,
+  field: lookLevel,
+  grain: lookLevel
+});
+var orgSchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  role: workspaceRoleSchema2,
+  /** The organization's look, a fact of the organization (every member sees the same tile). */
+  look: workspaceLookSchema,
+  /** Auto-provisioned personal org (ADR 013) vs a created organization. */
+  personal: external_exports.boolean(),
+  /**
+   * The org's account status. A suspended org stays VISIBLE here (the
+   * holder should see why it stopped working) but selection refuses it:
+   * naming it explicitly answers 403 workspace_suspended, and the default
+   * rules skip it.
+   */
+  status: external_exports.enum(["active", "suspended"]),
+  /** The caller's default organization (user_settings) — at most one true. */
+  isDefault: external_exports.boolean(),
+  createdAt: external_exports.string(),
+  /**
+   * The CALLER's own teams in this organization (not every team of it),
+   * ordered by name, so a federated tool reading GET /orgs as the user learns
+   * which teams they belong to without a second call. Added 2026-09-27:
+   * forward-compatible for readers — an answer from a hub that predates teams
+   * carries no field, and it parses as none.
+   */
+  teams: external_exports.array(external_exports.object({ id: external_exports.string(), slug: external_exports.string(), name: external_exports.string() })).default([])
+});
+var orgsListSchema = external_exports.object({
+  orgs: external_exports.array(orgSchema),
+  /**
+   * Read through a first-party tool's grant: the caller's OTHER
+   * organizations, where their owner or admin has not let them use THIS tool
+   * (tool access per team), in the same order as `orgs`; the tool lists them
+   * as places the person cannot open. `orgs` then holds only the
+   * organizations the tool may serve. Every other caller (a session, a key, a
+   * grant of a client outside the tool registry) reads every organization
+   * under `orgs` and an empty list here. Added 2026-09-27: forward-compatible
+   * for readers, an answer from a hub that predates it parses as none.
+   */
+  denied: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string() })).default([])
+});
+var orgCreateSchema = external_exports.object({
+  name: plainTextTrimmed(1, 120),
+  /** The look the person picked in the dialog: the organization is born with it on every member's screen. */
+  look: workspaceLookSchema.partial().optional()
+});
+var workspaceUpdateSchema = external_exports.object({
+  name: plainTextTrimmed(1, 120).optional(),
+  look: workspaceLookSchema.partial().optional()
+}).refine((b) => b.name !== void 0 || b.look !== void 0, { message: "nothing to change" });
+var workspaceUpdatedSchema = external_exports.object({
+  workspace: external_exports.object({
+    id: external_exports.string(),
+    name: external_exports.string(),
+    look: workspaceLookSchema
+  })
+});
+var orgCreatedSchema = external_exports.object({ org: orgSchema });
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/me.js
+var meResponseSchema = external_exports.object({
+  user: external_exports.object({
+    id: external_exports.string(),
+    email: external_exports.string(),
+    name: external_exports.string()
+  }),
+  /** The ACTIVE workspace this request resolved to (= activeWorkspaceId). */
+  workspace: external_exports.object({
+    id: external_exports.string(),
+    name: external_exports.string(),
+    /** The organization's look, a fact of the organization (schemas/orgs.ts). */
+    look: workspaceLookSchema
+  }),
+  role: workspaceRoleSchema2,
+  via: external_exports.enum(["session", "api_key", "oauth"]),
+  scopes: external_exports.array(scopeSchema).nullable(),
+  /** Expiry of the presented API key; null for sessions/OAuth or non-expiring keys. */
+  apiKeyExpiresAt: external_exports.string().nullable(),
+  /**
+   * ALL of the holder's active memberships, oldest first (user-scoped
+   * credentials: a credential identifies the USER, so every credential kind
+   * — session, API key, OAuth token — lists the same set; the workspace a
+   * request targets is a per-request selection among these).
+   */
+  workspaces: external_exports.array(external_exports.object({
+    id: external_exports.string(),
+    name: external_exports.string(),
+    role: workspaceRoleSchema2,
+    /** Each organization's look, so the switcher's tiles carry them (schemas/orgs.ts). */
+    look: workspaceLookSchema
+  })),
+  /** The workspace THIS request resolved to — what X-Workspace-Id selects. */
+  activeWorkspaceId: external_exports.string(),
+  /**
+   * The holder's default organization (user_settings) when it maps to a
+   * live active membership, else null. Selector-less requests on
+   * user-scoped credentials resolve here first.
+   */
+  defaultWorkspaceId: external_exports.string().nullable(),
+  /**
+   * Registered first-party tools the HOLDER has signed in to (ADR 015),
+   * oldest first — user_tool_usage joined against the live tool registry
+   * (a tool removed from the registry drops off the list; its rows stay).
+   * Holder-scoped like everything else on /me: a credential lists its own
+   * user's usage only. Reachable to machine keys under account:read (the
+   * /me allowlist entry) — the ecosystem "which tools does this user use"
+   * surface. Analytics, never an authorization input.
+   */
+  tools: external_exports.array(external_exports.object({
+    clientId: external_exports.string(),
+    slug: external_exports.string(),
+    name: external_exports.string(),
+    firstUsedAt: external_exports.string(),
+    lastUsedAt: external_exports.string()
+  })),
+  /**
+   * The holder is platform staff: their verified email is on the
+   * `SUPERADMIN_EMAILS` allowlist (every credential kind answers it). The
+   * dashboard's staff tab reads it to show itself; it is a display fact,
+   * never an authority — the `/admin/billing/*` routes stay gated
+   * server-side on the same rule.
+   */
+  staff: external_exports.boolean()
+});
+var defaultOrgSetSchema = external_exports.object({
+  workspaceId: external_exports.uuid().nullable()
+});
+var defaultOrgSchema = external_exports.object({
+  defaultWorkspaceId: external_exports.string().nullable()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/members.js
+var memberSchema = external_exports.object({
+  id: external_exports.string(),
+  userId: external_exports.string(),
+  email: external_exports.string(),
+  name: external_exports.string(),
+  role: workspaceRoleSchema2,
+  isActive: external_exports.boolean(),
+  createdAt: external_exports.string(),
+  lastSeenAt: external_exports.string().nullable()
+});
+var membersListSchema = external_exports.object({
+  members: external_exports.array(memberSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var memberUpdateSchema = external_exports.object({
+  role: workspaceRoleSchema2.optional(),
+  isActive: external_exports.boolean().optional()
+});
+var memberResetLinkSchema = external_exports.object({
+  resetUrl: external_exports.string(),
+  expiresAt: external_exports.string()
+});
+var memberChangeEmailLinkRequestSchema = external_exports.object({
+  newEmail: external_exports.email()
+});
+var memberChangeEmailLinkSchema = external_exports.object({
+  verifyUrl: external_exports.string(),
+  newEmail: external_exports.string(),
+  expiresAt: external_exports.string()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/teams.js
+var teamSlugSchema = external_exports.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "lowercase letters and digits, joined by single dashes").min(1).max(60);
+var teamSchema = external_exports.object({
+  id: external_exports.string(),
+  slug: external_exports.string(),
+  name: external_exports.string(),
+  membersCount: external_exports.number(),
+  /** The caller belongs to this team. */
+  isMember: external_exports.boolean(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
+});
+var teamsListSchema = external_exports.object({
+  teams: external_exports.array(teamSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var teamCreateSchema = external_exports.object({
+  name: plainTextTrimmed(1, 80),
+  /** Absent: derived from the name (lowercased, non-alphanumerics to dashes, cut to 60). */
+  slug: teamSlugSchema.optional()
+});
+var teamUpdateSchema = external_exports.object({
+  name: plainTextTrimmed(1, 80).optional(),
+  slug: teamSlugSchema.optional()
+}).refine((b) => b.name !== void 0 || b.slug !== void 0, { message: "nothing to change" });
+var teamMemberSchema = external_exports.object({
+  /** The person's membership id in the organization (the `/members/{id}` id). */
+  memberId: external_exports.string(),
+  userId: external_exports.string(),
+  email: external_exports.string(),
+  name: external_exports.string().nullable(),
+  /** The person's role in the ORGANIZATION (a team has no roles of its own). */
+  role: workspaceRoleSchema2,
+  isActive: external_exports.boolean(),
+  addedAt: external_exports.string()
+});
+var teamMembersListSchema = external_exports.object({
+  members: external_exports.array(teamMemberSchema),
+  nextCursor: external_exports.string().nullable()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/tool-access.js
+var TOOL_ACCESS_MODES = ["everyone", "teams"];
+var toolAccessModeSchema = external_exports.enum(TOOL_ACCESS_MODES);
+var toolSlugSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$/, "a tool slug (lowercase letters, digits, dashes)");
+var toolAccessEntrySchema = external_exports.object({
+  slug: external_exports.string(),
+  /** The tool's display name, from the registry. */
+  name: external_exports.string(),
+  /** `everyone` (the default, also when nothing was ever set) or `teams`. */
+  mode: toolAccessModeSchema,
+  /** With `teams`: the teams let in (none = owners and admins only). Empty with `everyone`. */
+  teams: external_exports.array(external_exports.object({ id: external_exports.string(), slug: external_exports.string(), name: external_exports.string() })),
+  /**
+   * The tool is opened to organizations by platform staff alone (PRDCT-2923):
+   * this entry is read-only for the organization, and it is listed only
+   * because staff granted the tool here. Absent (false) on every other tool.
+   */
+  restricted: external_exports.boolean().optional()
+});
+var toolAccessListSchema = external_exports.object({ tools: external_exports.array(toolAccessEntrySchema) });
+var toolAccessUpdateSchema = external_exports.discriminatedUnion("mode", [
+  external_exports.object({ mode: external_exports.literal("everyone") }),
+  external_exports.object({ mode: external_exports.literal("teams"), teamIds: external_exports.array(external_exports.uuid()).max(200) })
+]);
+var toolAccessQuerySchema = external_exports.object({
+  tool: toolSlugSchema.optional(),
+  client_id: external_exports.string().min(1).max(128).optional()
+});
+var myToolAccessSchema = external_exports.object({
+  tool: external_exports.object({
+    slug: external_exports.string(),
+    name: external_exports.string(),
+    /** Where "Continue to the tool" lands (the registry's launch URL). */
+    launchUrl: external_exports.url(),
+    /**
+     * The origins a page may send the browser back to for this tool (its
+     * launch and redirect origins, computed from the registry entry): a
+     * `return_to` whose origin is not one of these is never offered.
+     */
+    returnOrigins: external_exports.array(external_exports.string()),
+    /**
+     * Opened to organizations by platform staff alone (PRDCT-2923): a denied
+     * organization then lists no contacts, since its owners cannot grant it;
+     * the page says whom to ask instead. Absent (false) on every other tool.
+     */
+    restricted: external_exports.boolean().optional()
+  }),
+  granted: external_exports.array(external_exports.object({ id: external_exports.string(), name: external_exports.string() })),
+  denied: external_exports.array(external_exports.object({
+    id: external_exports.string(),
+    name: external_exports.string(),
+    contacts: external_exports.array(external_exports.object({ name: external_exports.string(), email: external_exports.string() }))
+  }))
+});
+var adminToolAccessQuerySchema = external_exports.object({ workspaceId: external_exports.uuid() });
+var adminToolAccessEntrySchema = external_exports.object({
+  slug: external_exports.string(),
+  name: external_exports.string(),
+  /** The organization holds the staff grant (an access row exists). */
+  granted: external_exports.boolean(),
+  /** Who last wrote the row (email), null when the organization holds no grant. */
+  grantedBy: external_exports.string().nullable(),
+  /** When the row was last written (ISO 8601), null when the organization holds no grant. */
+  grantedAt: external_exports.string().nullable()
+});
+var adminToolAccessListSchema = external_exports.object({
+  workspaceId: external_exports.string(),
+  name: external_exports.string(),
+  tools: external_exports.array(adminToolAccessEntrySchema)
+});
+var adminToolAccessSetRequestSchema = external_exports.object({
+  workspaceId: external_exports.uuid(),
+  slug: toolSlugSchema,
+  granted: external_exports.boolean()
+});
+var adminToolAccessSetSchema = external_exports.object({
+  workspaceId: external_exports.string(),
+  name: external_exports.string(),
+  slug: external_exports.string(),
+  granted: external_exports.boolean(),
+  /** false when the organization already stood where the request asked (idempotent). */
+  changed: external_exports.boolean()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/api-keys.js
+var apiKeySchema = external_exports.object({
+  id: external_exports.string(),
+  name: external_exports.string(),
+  keyId: external_exports.string(),
+  scopes: external_exports.array(scopeSchema),
+  /**
+   * Optional workspace PIN (user-scoped credentials): null = the key is a
+   * USER credential whose target workspace is selected per request
+   * (X-Workspace-Id → default org → oldest active membership); a value =
+   * the key reaches exactly that workspace (pre-0017 rows all carry one).
+   */
+  workspaceId: external_exports.string().nullable(),
+  createdBy: external_exports.string(),
+  createdAt: external_exports.string(),
+  lastUsedAt: external_exports.string().nullable(),
+  revokedAt: external_exports.string().nullable(),
+  expiresAt: external_exports.string().nullable()
+});
+var apiKeysListSchema = external_exports.object({
+  apiKeys: external_exports.array(apiKeySchema),
+  nextCursor: external_exports.string().nullable()
+});
+var apiKeyCreateSchema = external_exports.object({
+  name: plainText2(1, 120),
+  scopes: external_exports.array(scopeSchema).min(1),
+  /** TTL at mint; the server computes the absolute expiry. Omit = never expires. */
+  expiresInDays: external_exports.number().int().min(1).max(3650).optional(),
+  /**
+   * Optional least-privilege workspace PIN. Omit (the default) to mint a
+   * user-scoped key; set it to bind the key to ONE workspace the caller
+   * holds a live active membership of (fail-closed otherwise).
+   */
+  workspaceId: external_exports.uuid().optional()
+});
+var apiKeyCreatedSchema = external_exports.object({
+  apiKey: apiKeySchema,
+  /** Full key `<prefix>_<keyid>_<secret>` — shown once, never retrievable. */
+  key: external_exports.string()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/cli-auth.js
+var cliAuthRequestSchema = external_exports.object({
+  email: external_exports.email()
+});
+var cliAuthRequestedSchema = external_exports.object({
+  sent: external_exports.literal(true)
+});
+var cliAuthCompleteSchema = external_exports.object({
+  email: external_exports.email(),
+  otp: external_exports.string().min(4).max(16),
+  /** Display name for the minted key (defaults to a CLI-login label). */
+  keyName: plainText2(1, 120).optional(),
+  /** TTL at mint; the server computes the absolute expiry. Omit = never expires. */
+  expiresInDays: external_exports.number().int().min(1).max(3650).optional(),
+  /**
+   * Optional least-privilege workspace PIN — the account must hold an
+   * ACTIVE membership of it, and the minted key then reaches ONLY that
+   * workspace. Omit (the default) to mint a user-scoped key: the target
+   * workspace is selected per request (X-Workspace-Id → the account's
+   * default org → oldest active membership).
+   */
+  workspaceId: external_exports.uuid().optional()
+});
+var cliAuthCompletedSchema = external_exports.object({
+  /** Full key `<prefix>_<keyid>_<secret>` — shown once, never retrievable. */
+  key: external_exports.string(),
+  apiKey: apiKeySchema,
+  user: external_exports.object({
+    id: external_exports.string(),
+    email: external_exports.string(),
+    name: external_exports.string()
+  }),
+  /**
+   * The org context at login: the explicit pin when one was requested, else
+   * the workspace a selector-less request on this key resolves to TODAY
+   * (informational — an unpinned key follows the live selection rule).
+   */
+  workspaceId: external_exports.string()
+});
+var cliAuthRevokedSchema = external_exports.object({
+  revoked: external_exports.literal(true),
+  id: external_exports.string()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/invitations.js
+var invitationSchema = external_exports.object({
+  id: external_exports.string(),
+  email: external_exports.string(),
+  role: workspaceRoleSchema2,
+  invitedBy: external_exports.string(),
+  expiresAt: external_exports.string(),
+  acceptedAt: external_exports.string().nullable(),
+  revokedAt: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var invitationsListSchema = external_exports.object({
+  invitations: external_exports.array(invitationSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var invitationCreateSchema = external_exports.object({
+  email: external_exports.email(),
+  role: workspaceRoleSchema2.default("member")
+});
+var invitationCreatedSchema = external_exports.object({
+  invitation: invitationSchema,
+  acceptUrl: external_exports.string(),
+  emailSent: external_exports.boolean()
+});
+var invitationLookupSchema = external_exports.object({
+  email: external_exports.string(),
+  role: workspaceRoleSchema2,
+  workspaceName: external_exports.string(),
+  expiresAt: external_exports.string(),
+  /** True when an account with the invited email already exists (sign in to accept). */
+  accountExists: external_exports.boolean()
+});
+var invitationAcceptSchema = external_exports.object({
+  token: external_exports.string().min(16),
+  /** Required when the invited email has no account yet. */
+  name: plainText2(1, 120).optional(),
+  password: external_exports.string().min(12).max(256).optional()
+});
+var invitationAcceptedSchema = external_exports.object({
+  workspaceId: external_exports.string(),
+  userId: external_exports.string(),
+  role: workspaceRoleSchema2
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/audit.js
+var auditEntrySchema = external_exports.object({
+  id: external_exports.number(),
+  actorUserId: external_exports.string().nullable(),
+  actorEmail: external_exports.string().nullable(),
+  actorVia: external_exports.enum(["session", "api_key", "oauth", "system"]),
+  apiKeyId: external_exports.string().nullable(),
+  action: external_exports.string(),
+  resourceType: external_exports.string(),
+  resourceId: external_exports.string().nullable(),
+  requestId: external_exports.string().nullable(),
+  ip: external_exports.string().nullable(),
+  metadata: external_exports.unknown().nullable(),
+  createdAt: external_exports.string()
+});
+var auditListSchema = external_exports.object({
+  entries: external_exports.array(auditEntrySchema),
+  nextCursor: external_exports.string().nullable()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/break-glass.js
+var breakGlassClaimOwnershipRequestSchema = external_exports.object({
+  userId: external_exports.string().min(1).optional(),
+  workspaceId: external_exports.uuid().optional()
+});
+var breakGlassClaimOwnershipSchema = external_exports.object({
+  memberId: external_exports.string(),
+  userId: external_exports.string(),
+  email: external_exports.string(),
+  /** The workspace the ownership was claimed in. */
+  workspaceId: external_exports.string(),
+  role: workspaceRoleSchema2,
+  isActive: external_exports.boolean(),
+  /** true when the membership was created; false when an existing row was promoted/reactivated. */
+  created: external_exports.boolean()
+});
+var breakGlassResetTwoFactorRequestSchema = external_exports.object({
+  userId: external_exports.string().min(1)
+});
+var breakGlassResetTwoFactorSchema = external_exports.object({
+  userId: external_exports.string(),
+  /** true when a factor actually existed (row or enabled flag) before the reset. */
+  hadTwoFactor: external_exports.boolean()
+});
+var oauthClientSetDisabledRequestSchema = external_exports.object({
+  clientId: external_exports.string().min(1),
+  disabled: external_exports.boolean()
+});
+var oauthClientSetDisabledSchema = external_exports.object({
+  clientId: external_exports.string(),
+  name: external_exports.string().nullable(),
+  disabled: external_exports.boolean(),
+  /** false when the row already carried the requested state (idempotent). */
+  changed: external_exports.boolean()
+});
+var oauthGrantsRevokeRequestSchema = external_exports.object({
+  userId: external_exports.string().min(1),
+  clientId: external_exports.string().min(1).optional()
+});
+var oauthGrantsRevokedSchema = external_exports.object({
+  userId: external_exports.string(),
+  clientId: external_exports.string().nullable(),
+  refreshTokens: external_exports.number().int(),
+  accessTokens: external_exports.number().int(),
+  consents: external_exports.number().int()
+});
+var workspaceSetStatusRequestSchema = external_exports.object({
+  workspaceId: external_exports.uuid(),
+  status: external_exports.enum(["active", "suspended"])
+});
+var workspaceSetStatusSchema = external_exports.object({
+  workspaceId: external_exports.string(),
+  name: external_exports.string(),
+  status: external_exports.enum(["active", "suspended"]),
+  /** false when the row already carried the requested status (idempotent). */
+  changed: external_exports.boolean()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/connections.js
+var connectionSchema = external_exports.object({
+  clientId: external_exports.string(),
+  /** Display name — registry-sourced for first-party tools. */
+  name: external_exports.string(),
+  /** True when the client is a registry (first-party) tool. */
+  firstParty: external_exports.boolean(),
+  /** Scopes the standing grant covers (merged across grants). */
+  scopes: external_exports.array(external_exports.string()),
+  /** First connection (ISO 8601). */
+  connectedAt: external_exports.string(),
+  /** Last recorded sign-in / CLI connect (ISO 8601) — null when unknown. */
+  lastUsedAt: external_exports.string().nullable(),
+  /** Live standing refresh grants for this client (0 = none outstanding). */
+  activeGrants: external_exports.number().int()
+});
+var connectionsListSchema = external_exports.object({ connections: external_exports.array(connectionSchema) });
+var connectionRevokedSchema = external_exports.object({
+  clientId: external_exports.string(),
+  /** Standing refresh grants deleted — every generation of every family. */
+  refreshTokens: external_exports.number().int(),
+  /** Opaque access tokens deleted (JWT access tokens run out their ≤15 min). */
+  accessTokens: external_exports.number().int(),
+  /** Consent records deleted. */
+  consents: external_exports.number().int()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/sso.js
+var ssoToolTokenRequestSchema = external_exports.object({
+  /**
+   * The target tool's RFC 8707 resource identifier — MUST equal a registered
+   * tool's `resourceUrl` (the hub tool registry is the source of truth);
+   * anything else is a 400. Becomes the JWT `aud`.
+   */
+  resource: external_exports.url()
+});
+var ssoToolTokenSchema = external_exports.object({
+  token: external_exports.string(),
+  /** Absolute expiry (ISO 8601) — 120 seconds from mint. */
+  expiresAt: external_exports.string(),
+  /**
+   * The RAW refresh token of a standing OFFLINE GRANT minted for the target
+   * tool's OAuth client (scopes `offline_access account:read`, 365 d,
+   * user-scoped — org-free). Returned ONCE; the tool stores it (encrypted)
+   * on its account link so a headless-CLI user gets live as-the-user hub
+   * reads: refresh it at the hub token endpoint with the tool client's own
+   * credentials and `resource=<hub>/mcp`, then call GET /orgs as the user.
+   * Rotates on every use; reuse of a rotated token tears the whole
+   * (client, user) family down (RFC 9700) — single-flight your refreshes.
+   */
+  hubRefreshToken: external_exports.string()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/tool-info.js
+var toolInfoSchema = external_exports.object({
+  clientId: external_exports.string(),
+  name: external_exports.string(),
+  url: external_exports.url()
+});
+var toolInfoQuerySchema = external_exports.object({
+  client_id: plainText2(1, 128)
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/tools.js
+var toolCatalogEntrySchema = external_exports.object({
+  /** Registry slug — stable machine identity. */
+  slug: external_exports.string(),
+  /** The OAuth client id the tool signs in with (`tool-<slug>` by default). */
+  clientId: external_exports.string(),
+  /** Display name — registry-sourced, never client-declared. */
+  name: external_exports.string(),
+  /** Where "open the tool" lands (the registry's toolLaunchUrl). */
+  launchUrl: external_exports.url(),
+  /**
+   * The origins a hub page may send the browser back to for this tool: the
+   * launch URL's and each redirect URI's ORIGIN (never the URIs), computed
+   * server-side from the registry entry. A page offers "Back to <tool>" for
+   * a `return_to` only when its origin is one of these.
+   */
+  returnOrigins: external_exports.array(external_exports.string()),
+  /** True when the caller holds a standing grant on this tool. */
+  connected: external_exports.boolean(),
+  /** First connection (ISO 8601) — null when not connected. */
+  connectedAt: external_exports.string().nullable(),
+  /** Last recorded sign-in / CLI connect (ISO 8601) — null when unknown or not connected. */
+  lastUsedAt: external_exports.string().nullable(),
+  /**
+   * Opened to organizations by platform staff alone (PRDCT-2923). The
+   * catalog lists such a tool only to staff and to a member of an
+   * organization it is granted in; everyone else never sees the entry.
+   * Absent (false) on every other tool.
+   */
+  restricted: external_exports.boolean().optional()
+});
+var toolsListSchema = external_exports.object({ tools: external_exports.array(toolCatalogEntrySchema) });
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/account-confirm.js
+var accountConfirmRequestSchema = external_exports.object({
+  token: external_exports.string().min(16).max(4096),
+  decision: external_exports.enum(["confirm", "deny"])
+});
+var accountConfirmResultSchema = external_exports.object({
+  /**
+   * `verified`: the account is now active and the response carries the
+   * session cookie; `already_verified`: nothing to do (an earlier confirm,
+   * or a proof by another channel); `denied`: the row was removed.
+   */
+  status: external_exports.enum(["verified", "already_verified", "denied"])
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/files.js
+var fileSchema = external_exports.object({
+  id: external_exports.string(),
+  sha256: external_exports.string(),
+  sizeBytes: external_exports.number(),
+  contentType: external_exports.string(),
+  originalName: external_exports.string(),
+  /** Null once the uploader's account was deleted (files are workspace data). */
+  createdBy: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var filesListSchema = external_exports.object({
+  files: external_exports.array(fileSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var fileUploadedSchema = external_exports.object({
+  file: fileSchema,
+  /** True when identical bytes already existed for this workspace. */
+  deduplicated: external_exports.boolean()
+});
+var fileUploadQuerySchema = external_exports.object({
+  /** Original filename (the body is the raw bytes). */
+  name: plainText2(1, 255)
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/billing.js
+var BILLING_PLANS = ["free", "pro"];
+var billingPlanSchema = external_exports.enum(BILLING_PLANS);
+var accountRefSchema = external_exports.uuid();
+var usageEventIdSchema = external_exports.string().regex(/^[0-9A-HJKMNP-TV-Z]{26}$/, "a ULID");
+var usageViaSchema = external_exports.enum(["session", "api_key", "oauth"]);
 var usageEventSchema = external_exports.object({
-  id: external_exports.string().regex(/^[0-9A-HJKMNP-TV-Z]{26}$/, "a ULID"),
+  id: usageEventIdSchema,
   actionKey: external_exports.string().min(1).max(120).optional(),
   meter: external_exports.string().min(1).max(120).optional(),
   quantity: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
   unit: external_exports.string().min(1).max(40),
   occurredAt: external_exports.iso.datetime({ offset: true }),
   workspaceId: external_exports.string().min(1).max(128),
-  accountRef: external_exports.uuid(),
+  accountRef: accountRefSchema,
   userId: external_exports.string().min(1).max(128).nullable().optional(),
-  via: external_exports.enum(["session", "api_key", "oauth"]),
+  via: usageViaSchema,
   resourceType: external_exports.string().min(1).max(80).nullable().optional(),
   resourceId: external_exports.string().min(1).max(256).nullable().optional(),
   toolSlug: external_exports.string().min(1).max(64).optional(),
@@ -20163,6 +20908,8 @@ var usageEventSchema = external_exports.object({
   path: ["actionKey"]
 });
 var USAGE_EVENTS_BATCH_MAX = 500;
+var USAGE_EVENT_MAX_PAST_MS = 7 * 24 * 60 * 60 * 1e3;
+var USAGE_EVENT_MAX_FUTURE_MS = 5 * 60 * 1e3;
 var usageEventsBatchSchema = external_exports.object({
   events: external_exports.array(external_exports.unknown()).min(1).max(USAGE_EVENTS_BATCH_MAX)
 });
@@ -20174,10 +20921,17 @@ var USAGE_REJECT_REASONS = [
 ];
 var usageRejectReasonSchema = external_exports.enum(USAGE_REJECT_REASONS);
 var usageEventResultSchema = external_exports.object({
+  /** The posted id; null when the element carried none the hub could read. */
   id: external_exports.string().nullable(),
   status: external_exports.enum(["accepted", "duplicate", "rejected"]),
   reason: usageRejectReasonSchema.optional(),
+  /** The issues of an `invalid_event`, `[{ path, message }]`, field by field (a schema failure, the occurrence window, or a price past the storable range). */
   details: external_exports.unknown().optional(),
+  /**
+   * Phase 2: on `accepted`, the credits the event was charged, priced from
+   * the price book row effective at its `occurredAt` (0 when unpriced).
+   * Absent on `duplicate` and `rejected`, which write nothing.
+   */
   credits: external_exports.number().int().optional()
 });
 var usageIngestResultSchema = external_exports.object({
@@ -20186,28 +20940,778 @@ var usageIngestResultSchema = external_exports.object({
   duplicate: external_exports.number().int(),
   rejected: external_exports.number().int()
 });
-var USAGE_EVENT_MAX_PAST_MS = 7 * 24 * 60 * 60 * 1e3;
-var USAGE_EVENT_MAX_FUTURE_MS = 5 * 60 * 1e3;
+var usageEntitlementsQuerySchema = external_exports.object({ accountRef: accountRefSchema });
+var usageEntitlementsSchema = external_exports.object({
+  accountRef: accountRefSchema,
+  plan: billingPlanSchema,
+  /** Until when the plan is paid for (ISO 8601); null on `free` and on a live subscription. */
+  planUntil: external_exports.string().nullable(),
+  limits: external_exports.record(external_exports.string(), external_exports.union([external_exports.number(), external_exports.boolean()])),
+  features: external_exports.array(external_exports.string()),
+  upgradeUrl: external_exports.string()
+});
+var billingUsagePeriodSchema = external_exports.enum(["day", "month"]);
+var billingUsageQuerySchema = external_exports.object({
+  from: external_exports.iso.datetime({ offset: true }).optional(),
+  to: external_exports.iso.datetime({ offset: true }).optional(),
+  period: billingUsagePeriodSchema.default("day"),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(100).default(50)
+});
+var billingUsageEventSchema = external_exports.object({
+  id: external_exports.string(),
+  toolSlug: external_exports.string(),
+  actionKey: external_exports.string(),
+  quantity: external_exports.number(),
+  unit: external_exports.string(),
+  /** What was charged, from the price book at that moment; null while no price book exists (phase 1). */
+  credits: external_exports.number().nullable(),
+  userId: external_exports.string().nullable(),
+  /** The person, when the hub still knows them (a deleted account leaves null). */
+  userEmail: external_exports.string().nullable(),
+  userName: external_exports.string().nullable(),
+  via: usageViaSchema,
+  resourceType: external_exports.string().nullable(),
+  resourceId: external_exports.string().nullable(),
+  occurredAt: external_exports.string(),
+  receivedAt: external_exports.string()
+});
+var aggregateTotals = {
+  events: external_exports.number().int(),
+  quantity: external_exports.number(),
+  credits: external_exports.number().nullable()
+};
+var billingUsageSchema = external_exports.object({
+  window: external_exports.object({ from: external_exports.string(), to: external_exports.string(), period: billingUsagePeriodSchema }),
+  totals: external_exports.object(aggregateTotals),
+  byTool: external_exports.array(external_exports.object({ toolSlug: external_exports.string(), ...aggregateTotals })),
+  byAction: external_exports.array(external_exports.object({ toolSlug: external_exports.string(), actionKey: external_exports.string(), unit: external_exports.string(), ...aggregateTotals })),
+  /** The consumption per person; the row with a null user is the owner-attributed and anonymous usage. */
+  byUser: external_exports.array(external_exports.object({
+    userId: external_exports.string().nullable(),
+    userEmail: external_exports.string().nullable(),
+    userName: external_exports.string().nullable(),
+    ...aggregateTotals
+  })),
+  byPeriod: external_exports.array(external_exports.object({ period: external_exports.string(), ...aggregateTotals })),
+  events: external_exports.array(billingUsageEventSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var isoDateTime = () => external_exports.iso.datetime({ offset: true });
+var toolSlugSchema2 = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$/, "a tool slug");
+var actionKeySchema = external_exports.string().min(1).max(120);
+var unitSchema = external_exports.string().min(1).max(40);
+var BILLING_LEDGER_KINDS = [
+  "purchase",
+  "signup",
+  "promo",
+  "referral",
+  "manual",
+  "debit",
+  "refund",
+  "expiry"
+];
+var billingLedgerKindSchema = external_exports.enum(BILLING_LEDGER_KINDS);
+var BILLING_LOW_BALANCE_STATES = ["ok", "low", "empty"];
+var billingLowBalanceStateSchema = external_exports.enum(BILLING_LOW_BALANCE_STATES);
+var BILLING_SUBSCRIPTION_ACTIONS = ["subscribe", "cancel", "resume"];
+var billingSubscriptionActionSchema = external_exports.enum(BILLING_SUBSCRIPTION_ACTIONS);
+var BILLING_AUTO_RECHARGE_DISABLED_REASONS = [
+  "no_payment_method",
+  "declined_retrying",
+  "declined",
+  "authentication_required",
+  "monthly_cap"
+];
+var billingAutoRechargeDisabledReasonSchema = external_exports.enum(BILLING_AUTO_RECHARGE_DISABLED_REASONS);
+var PLAN_ENTITLEMENT_KINDS = ["limit", "feature"];
+var planEntitlementKindSchema = external_exports.enum(PLAN_ENTITLEMENT_KINDS);
+var PRICE_CREDITS_PER_UNIT_MAX = 1e7;
 var usageCheckRequestSchema = external_exports.object({
-  accountRef: external_exports.uuid(),
-  actionKey: external_exports.string().min(1).max(120),
+  accountRef: accountRefSchema,
+  actionKey: actionKeySchema,
   quantity: external_exports.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-  unit: external_exports.string().min(1).max(40).optional()
+  unit: unitSchema.optional()
 });
 var USAGE_CHECK_REASONS = ["insufficient_credits", "account_suspended", "unpriceable"];
+var usageCheckReasonSchema = external_exports.enum(USAGE_CHECK_REASONS);
 var usageCheckSchema = external_exports.object({
-  accountRef: external_exports.uuid(),
+  accountRef: accountRefSchema,
   actionKey: external_exports.string(),
   quantity: external_exports.number().int(),
   allowed: external_exports.boolean(),
   credits: external_exports.number().int(),
   balance: external_exports.number().int(),
+  /** The price book row's unit; null when the action is unpriced. */
   unit: external_exports.string().nullable(),
   priced: external_exports.boolean(),
-  plan: entitlementTierSchema,
-  reason: external_exports.enum(USAGE_CHECK_REASONS).nullable(),
+  plan: billingPlanSchema,
+  reason: usageCheckReasonSchema.nullable(),
+  /** `{PUBLIC_BASE_URL}/billing/top-up?org=&credits=&balance=&tool=&action=` */
   topUpUrl: external_exports.string()
 });
+var billingAddressSchema = external_exports.object({
+  line1: plainText2(1, 200),
+  line2: plainText2(1, 200).nullable().optional(),
+  postalCode: plainText2(1, 20),
+  city: plainText2(1, 120),
+  country: external_exports.string().regex(/^[A-Z]{2}$/, "an ISO 3166-1 alpha-2 country code")
+});
+var billingAccountSchema = external_exports.object({
+  accountId: external_exports.string(),
+  workspaceId: external_exports.string(),
+  balance: external_exports.number().int(),
+  currency: external_exports.string(),
+  currencyLocked: external_exports.boolean(),
+  rate: external_exports.object({
+    currency: external_exports.string(),
+    creditsPer: external_exports.number().int(),
+    minorUnits: external_exports.number().int()
+  }),
+  packs: external_exports.array(external_exports.number().int()),
+  /** The settings' floor for a custom amount, in credits (lane A, PRDCT-2715). */
+  customMinCredits: external_exports.number().int(),
+  /**
+   * Every currency the settings price, with its rate in `rate`'s shape,
+   * sorted by code: what a currency change means while the account is
+   * unlocked (lane A, PRDCT-2715).
+   */
+  currencies: external_exports.array(external_exports.object({ currency: external_exports.string(), creditsPer: external_exports.number().int(), minorUnits: external_exports.number().int() })),
+  /** The Pro plan's monthly price in the account's currency; null when the settings hold none for it. */
+  proMonthlyPrice: external_exports.object({ amountMinor: external_exports.number().int(), currency: external_exports.string() }).nullable(),
+  plan: billingPlanSchema,
+  planUntil: external_exports.string().nullable(),
+  lowBalance: external_exports.boolean(),
+  lowBalanceAt: external_exports.number().int(),
+  exhausted: external_exports.boolean(),
+  expiring: external_exports.object({ credits: external_exports.number().int(), at: external_exports.string() }).nullable(),
+  /**
+   * `customer`: a Stripe customer exists for the account. `livemode`: the
+   * provider charges real money (a live key); false on the sandbox and
+   * without a provider, so a staff link knows which Stripe dashboard.
+   */
+  stripe: external_exports.object({ customer: external_exports.boolean(), livemode: external_exports.boolean() }),
+  paymentMethod: external_exports.object({
+    brand: external_exports.string(),
+    last4: external_exports.string(),
+    expMonth: external_exports.number().int(),
+    expYear: external_exports.number().int()
+  }).nullable(),
+  subscription: external_exports.object({
+    status: external_exports.string(),
+    currentPeriodEnd: external_exports.string().nullable(),
+    cancelAtPeriodEnd: external_exports.boolean()
+  }).nullable(),
+  autoRecharge: external_exports.object({
+    enabled: external_exports.boolean(),
+    threshold: external_exports.number().int().nullable(),
+    credits: external_exports.number().int().nullable(),
+    monthlyCap: external_exports.number().int().nullable(),
+    disabledReason: billingAutoRechargeDisabledReasonSchema.nullable(),
+    rechargedThisMonth: external_exports.number().int()
+  }),
+  referral: external_exports.object({
+    code: external_exports.string(),
+    referredBy: external_exports.string().nullable(),
+    rewarded: external_exports.boolean(),
+    /**
+     * The reward this organization received for being referred was taken
+     * back: a refund of its qualifying purchase reversed it (PRDCT-2757,
+     * the fact being a `refund` ledger entry whose source is the referral).
+     */
+    reversed: external_exports.boolean(),
+    /** How many of the organizations this one referred had the reward taken back after a refund. */
+    referredReversed: external_exports.number().int()
+  }),
+  /**
+   * The settings' auto-recharge defaults, for a purchase page that offers
+   * auto-recharge beside a pack (PRDCT-2783): the threshold as a percentage
+   * of the credits bought, and the monthly cap in credits.
+   */
+  autoRechargeDefaults: external_exports.object({
+    thresholdPct: external_exports.number().int(),
+    monthlyCap: external_exports.number().int()
+  }),
+  lowBalanceState: billingLowBalanceStateSchema,
+  billing: external_exports.object({
+    email: external_exports.string().nullable(),
+    companyName: external_exports.string().nullable(),
+    vatNumber: external_exports.string().nullable(),
+    address: billingAddressSchema.nullable()
+  })
+});
+var billingAccountUpdateSchema = external_exports.object({
+  billingEmail: external_exports.email().nullable().optional(),
+  companyName: plainText2(1, 200).nullable().optional(),
+  vatNumber: external_exports.string().min(2).max(20).nullable().optional(),
+  address: billingAddressSchema.nullable().optional(),
+  currency: external_exports.string().regex(/^[A-Z]{3}$/, "an ISO 4217 currency code").optional()
+});
+var billingLedgerQuerySchema = external_exports.object({
+  kind: billingLedgerKindSchema.optional(),
+  from: isoDateTime().optional(),
+  to: isoDateTime().optional(),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(100).default(50)
+});
+var BILLING_LEDGER_SOURCE_KINDS = [
+  "usage_event",
+  "voucher",
+  "payment",
+  "checkout",
+  "referral",
+  "reason",
+  "grant"
+];
+var billingLedgerSourceKindSchema = external_exports.enum(BILLING_LEDGER_SOURCE_KINDS);
+var billingLedgerEntrySchema = external_exports.object({
+  id: external_exports.string(),
+  kind: billingLedgerKindSchema,
+  amount: external_exports.number().int(),
+  balanceAfter: external_exports.number().int(),
+  remaining: external_exports.number().int().nullable(),
+  sourceRef: external_exports.string().nullable(),
+  sourceKind: billingLedgerSourceKindSchema.nullable(),
+  expiresAt: external_exports.string().nullable(),
+  createdAt: external_exports.string(),
+  createdByEmail: external_exports.string().nullable()
+});
+var billingLedgerSchema = external_exports.object({
+  entries: external_exports.array(billingLedgerEntrySchema),
+  nextCursor: external_exports.string().nullable()
+});
+var billingEntitlementsQuerySchema = external_exports.object({
+  toolSlug: toolSlugSchema2.optional()
+});
+var resolvedEntitlementsSchema = external_exports.object({
+  limits: external_exports.record(external_exports.string(), external_exports.union([external_exports.number(), external_exports.boolean()])),
+  features: external_exports.array(external_exports.string())
+});
+var billingEntitlementsSchema = external_exports.object({
+  plan: billingPlanSchema,
+  tools: external_exports.array(external_exports.object({
+    toolSlug: external_exports.string(),
+    toolName: external_exports.string(),
+    tiers: external_exports.object({ free: resolvedEntitlementsSchema, pro: resolvedEntitlementsSchema }),
+    effective: resolvedEntitlementsSchema
+  }))
+});
+var voucherRedeemSchema = external_exports.object({
+  code: external_exports.string().trim().min(1).max(64)
+});
+var voucherRedeemedSchema = external_exports.object({
+  code: external_exports.string(),
+  credits: external_exports.number().int(),
+  balance: external_exports.number().int(),
+  ledgerId: external_exports.string(),
+  expiresAt: external_exports.string().nullable()
+});
+var billingCheckoutRequestSchema = external_exports.object({
+  pack: external_exports.number().int().positive().optional(),
+  credits: external_exports.number().int().positive().optional(),
+  autoRecharge: external_exports.boolean().optional()
+}).refine((body) => body.pack === void 0 !== (body.credits === void 0), {
+  message: "exactly one of pack or credits"
+});
+var billingCheckoutSchema = external_exports.object({
+  url: external_exports.url(),
+  sessionId: external_exports.string()
+});
+var BILLING_CHECKOUT_KINDS = ["purchase", "pro", "setup"];
+var billingCheckoutKindSchema = external_exports.enum(BILLING_CHECKOUT_KINDS);
+var BILLING_CHECKOUT_STATUSES = ["open", "complete", "expired"];
+var billingCheckoutStatusSchema = external_exports.enum(BILLING_CHECKOUT_STATUSES);
+var billingCheckoutSessionSchema = external_exports.object({
+  sessionId: external_exports.string(),
+  kind: billingCheckoutKindSchema,
+  status: billingCheckoutStatusSchema,
+  paid: external_exports.boolean(),
+  credits: external_exports.number().int().nullable(),
+  currency: external_exports.string(),
+  amounts: external_exports.object({
+    subtotalMinor: external_exports.number().int(),
+    discountMinor: external_exports.number().int(),
+    taxMinor: external_exports.number().int(),
+    totalMinor: external_exports.number().int()
+  }),
+  invoice: external_exports.object({
+    number: external_exports.string().nullable(),
+    hostedUrl: external_exports.string().nullable(),
+    pdfUrl: external_exports.string().nullable()
+  }).nullable(),
+  landed: external_exports.boolean(),
+  balanceBefore: external_exports.number().int().nullable(),
+  balanceAfter: external_exports.number().int().nullable(),
+  autoRecharge: external_exports.object({
+    requested: external_exports.boolean(),
+    enabled: external_exports.boolean(),
+    threshold: external_exports.number().int().nullable(),
+    credits: external_exports.number().int().nullable(),
+    monthlyCap: external_exports.number().int().nullable()
+  })
+});
+var billingInvoicesQuerySchema = external_exports.object({
+  cursor: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(100).default(20)
+});
+var billingInvoiceSchema = external_exports.object({
+  id: external_exports.string(),
+  number: external_exports.string().nullable(),
+  status: external_exports.string().nullable(),
+  amountMinor: external_exports.number().int(),
+  currency: external_exports.string(),
+  hostedUrl: external_exports.string().nullable(),
+  pdfUrl: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var billingInvoicesSchema = external_exports.object({
+  invoices: external_exports.array(billingInvoiceSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var billingReferralRequestSchema = external_exports.object({
+  code: external_exports.string().trim().min(6).max(32)
+});
+var billingPaymentMethodSetupSchema = external_exports.object({
+  url: external_exports.url(),
+  sessionId: external_exports.string()
+});
+var billingSubscriptionRequestSchema = external_exports.object({
+  action: billingSubscriptionActionSchema
+});
+var billingSubscriptionSchema = external_exports.object({
+  url: external_exports.url().nullable(),
+  subscription: billingAccountSchema.shape.subscription
+});
+var billingAutoRechargeUpdateSchema = external_exports.object({
+  enabled: external_exports.boolean().optional(),
+  threshold: external_exports.number().int().min(0).optional(),
+  credits: external_exports.number().int().positive().optional(),
+  monthlyCap: external_exports.number().int().min(0).optional()
+});
+var billingSettingsSchema = external_exports.object({
+  signupCredits: external_exports.number().int(),
+  packs: external_exports.array(external_exports.number().int()),
+  customMinCredits: external_exports.number().int(),
+  currencies: external_exports.record(external_exports.string(), external_exports.number().int()),
+  autoRechargeDefaultThresholdPct: external_exports.number().int(),
+  autoRechargeDefaultMonthlyCap: external_exports.number().int(),
+  referralReferrerCredits: external_exports.number().int(),
+  referralRefereeCredits: external_exports.number().int(),
+  promoGrantExpiryDays: external_exports.number().int(),
+  lowBalanceNoticePct: external_exports.number().int(),
+  updatedAt: external_exports.string()
+});
+var settingsInt = () => external_exports.number().int().min(0);
+var billingSettingsUpdateSchema = external_exports.object({
+  signupCredits: settingsInt().optional(),
+  packs: external_exports.array(external_exports.number().int().positive()).min(1).max(10).optional(),
+  customMinCredits: settingsInt().optional(),
+  currencies: external_exports.record(external_exports.string().regex(/^[A-Z]{3}$/, "an ISO 4217 currency code"), external_exports.number().int().positive()).optional(),
+  autoRechargeDefaultThresholdPct: settingsInt().max(100).optional(),
+  autoRechargeDefaultMonthlyCap: settingsInt().optional(),
+  referralReferrerCredits: settingsInt().optional(),
+  referralRefereeCredits: settingsInt().optional(),
+  promoGrantExpiryDays: settingsInt().optional(),
+  lowBalanceNoticePct: settingsInt().max(100).optional()
+});
+var billingSettingsAdminSchema = external_exports.object({
+  settings: billingSettingsSchema,
+  history: external_exports.array(external_exports.object({
+    at: external_exports.string(),
+    byEmail: external_exports.string().nullable(),
+    before: external_exports.record(external_exports.string(), external_exports.unknown()),
+    after: external_exports.record(external_exports.string(), external_exports.unknown())
+  }))
+});
+var priceBookRowSchema = external_exports.object({
+  id: external_exports.string(),
+  toolSlug: external_exports.string(),
+  actionKey: external_exports.string(),
+  label: external_exports.string().nullable(),
+  creditsPerUnit: external_exports.number().int(),
+  unit: external_exports.string(),
+  per: external_exports.number().int(),
+  freeQuantityPerMonth: external_exports.number().int().nullable(),
+  effectiveFrom: external_exports.string(),
+  version: external_exports.number().int()
+});
+var priceBookListQuerySchema = external_exports.object({
+  toolSlug: toolSlugSchema2.optional(),
+  all: external_exports.enum(["true", "false"]).default("false").transform((v) => v === "true")
+});
+var priceBookListSchema = external_exports.object({ prices: external_exports.array(priceBookRowSchema) });
+var priceBookPutSchema = external_exports.object({
+  toolSlug: toolSlugSchema2,
+  actionKey: actionKeySchema,
+  creditsPerUnit: external_exports.number().int().min(0).max(PRICE_CREDITS_PER_UNIT_MAX),
+  unit: unitSchema,
+  per: external_exports.number().int().min(1).optional(),
+  freeQuantityPerMonth: external_exports.number().int().min(0).nullable().optional(),
+  label: plainText2(1, 120).nullable().optional(),
+  effectiveFrom: isoDateTime().optional()
+});
+var priceBookSeedRequestSchema = external_exports.object({
+  toolSlug: toolSlugSchema2.optional()
+});
+var seedCounts = external_exports.object({ inserted: external_exports.number().int(), skipped: external_exports.number().int() });
+var priceBookSeedResultSchema = external_exports.object({
+  inserted: external_exports.number().int(),
+  skipped: external_exports.number().int(),
+  tools: external_exports.array(external_exports.object({
+    toolSlug: external_exports.string(),
+    ok: external_exports.boolean(),
+    prices: seedCounts,
+    entitlements: seedCounts,
+    error: external_exports.string().nullable()
+  }))
+});
+var entitlementValueSchema = external_exports.union([external_exports.number(), external_exports.boolean()]).nullable();
+var planEntitlementRowSchema = external_exports.object({
+  id: external_exports.string(),
+  toolSlug: external_exports.string(),
+  key: external_exports.string(),
+  kind: planEntitlementKindSchema,
+  tier: billingPlanSchema.nullable(),
+  value: entitlementValueSchema,
+  accountId: external_exports.string().nullable(),
+  /** The overridden organization's name; null on a tier default. */
+  workspaceName: external_exports.string().nullable(),
+  effectiveFrom: external_exports.string()
+});
+var planEntitlementsListQuerySchema = external_exports.object({
+  toolSlug: toolSlugSchema2.optional(),
+  accountId: external_exports.string().min(1).max(64).optional()
+});
+var planEntitlementsListSchema = external_exports.object({
+  entitlements: external_exports.array(planEntitlementRowSchema)
+});
+var planEntitlementPutSchema = external_exports.object({
+  toolSlug: toolSlugSchema2,
+  key: external_exports.string().min(1).max(120),
+  kind: planEntitlementKindSchema,
+  value: entitlementValueSchema,
+  tier: billingPlanSchema.optional(),
+  accountId: external_exports.string().min(1).max(64).optional()
+}).refine((e) => e.tier === void 0 !== (e.accountId === void 0), {
+  message: "exactly one of tier or accountId",
+  path: ["tier"]
+});
+var planEntitlementDeletedSchema = external_exports.object({
+  id: external_exports.string(),
+  deleted: external_exports.literal(true)
+});
+var billingAdminAccountsQuerySchema = external_exports.object({
+  q: plainText2(1, 120).optional(),
+  cursor: external_exports.string().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(100).default(50)
+});
+var billingAdminAccountSchema = external_exports.object({
+  accountId: external_exports.string(),
+  workspaceId: external_exports.string(),
+  workspaceName: external_exports.string(),
+  status: external_exports.enum(["active", "suspended"]),
+  balance: external_exports.number().int(),
+  currency: external_exports.string(),
+  plan: billingPlanSchema,
+  lowBalance: external_exports.boolean(),
+  subscriptionStatus: external_exports.string().nullable(),
+  autoRecharge: external_exports.object({
+    enabled: external_exports.boolean(),
+    disabledReason: billingAutoRechargeDisabledReasonSchema.nullable()
+  }),
+  stripeCustomerId: external_exports.string().nullable(),
+  createdAt: external_exports.string()
+});
+var billingAdminAccountsSchema = external_exports.object({
+  accounts: external_exports.array(billingAdminAccountSchema),
+  nextCursor: external_exports.string().nullable()
+});
+var billingGrantRequestSchema = external_exports.object({
+  credits: external_exports.number().int().refine((n) => n !== 0, { message: "a non-zero number of credits" }),
+  reason: plainText2(1, 500),
+  expiresAt: isoDateTime().optional()
+});
+var billingGrantedSchema = external_exports.object({
+  ledgerId: external_exports.string(),
+  balance: external_exports.number().int()
+});
+var voucherSchema = external_exports.object({
+  code: external_exports.string(),
+  credits: external_exports.number().int(),
+  maxRedemptions: external_exports.number().int().nullable(),
+  redemptions: external_exports.number().int(),
+  oncePerAccount: external_exports.boolean(),
+  expiresAt: external_exports.string().nullable(),
+  grantExpiresInDays: external_exports.number().int().nullable(),
+  active: external_exports.boolean(),
+  createdAt: external_exports.string(),
+  createdByEmail: external_exports.string().nullable()
+});
+var vouchersListSchema = external_exports.object({ vouchers: external_exports.array(voucherSchema) });
+var voucherCreateSchema = external_exports.object({
+  code: external_exports.string().trim().regex(/^[A-Z0-9][A-Z0-9-]{2,62}$/, "uppercase letters, digits and hyphens, 3 to 63 characters").optional(),
+  credits: external_exports.number().int().positive(),
+  maxRedemptions: external_exports.number().int().positive().optional(),
+  expiresAt: isoDateTime().optional(),
+  grantExpiresInDays: external_exports.number().int().positive().optional()
+});
+var voucherRedemptionsSchema = external_exports.object({
+  redemptions: external_exports.array(external_exports.object({
+    accountId: external_exports.string(),
+    workspaceName: external_exports.string().nullable(),
+    redeemedAt: external_exports.string(),
+    ledgerId: external_exports.string()
+  }))
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/schemas/demo-passes.js
+var DEMO_PASS_MAX_MINUTES = 10080;
+var demoPassSchema = external_exports.object({
+  id: external_exports.string(),
+  /** The person the pass signs in. */
+  userId: external_exports.string(),
+  email: external_exports.string(),
+  name: external_exports.string(),
+  /** The page the link lands on. */
+  targetPath: external_exports.string(),
+  /** The registry tool the link lands in; null = the hub's own dashboard. */
+  toolSlug: external_exports.string().nullable(),
+  /** The owner who minted it; null once that account is gone. */
+  createdBy: external_exports.string().nullable(),
+  createdAt: external_exports.string(),
+  expiresAt: external_exports.string(),
+  revokedAt: external_exports.string().nullable(),
+  lastUsedAt: external_exports.string().nullable(),
+  /** How many sessions the pass has opened. */
+  useCount: external_exports.number().int()
+});
+var demoPassesListSchema = external_exports.object({ passes: external_exports.array(demoPassSchema) });
+var demoPassMintSchema = external_exports.object({
+  email: external_exports.email(),
+  path: external_exports.string().optional(),
+  expiresInMinutes: external_exports.number().int().min(1).max(DEMO_PASS_MAX_MINUTES).optional(),
+  toolSlug: external_exports.string().min(1).max(128).optional()
+});
+var demoPassMintedSchema = external_exports.object({
+  pass: demoPassSchema,
+  /** The secret itself: shown here once, never again. */
+  secret: external_exports.string(),
+  /**
+   * `<PUBLIC_BASE_URL>/demo#pass=<secret>&to=<path>`, plus `&tool=<slug>` when
+   * the pass names a tool: the fragment never reaches a server log.
+   */
+  url: external_exports.string()
+});
+var demoPassRedeemSchema = external_exports.object({ pass: external_exports.string().min(1) });
+var demoPassRedeemedSchema = external_exports.object({
+  user: external_exports.object({ id: external_exports.string(), email: external_exports.string(), name: external_exports.string() }),
+  /** The pass's page: where the dashboard goes when the link names none. */
+  path: external_exports.string(),
+  /**
+   * The registry tool the pass lands in, and its launch URL: the dashboard
+   * leaves for `<toolUrl>/login?next=<path>`. Both absent when the pass names
+   * no tool, or names one the registry no longer holds (the hub's dashboard
+   * is then the landing).
+   */
+  toolSlug: external_exports.string().optional(),
+  toolUrl: external_exports.string().optional(),
+  /** When the PASS expires; a session it opened ends with it. */
+  expiresAt: external_exports.string()
+});
+
+// ../../node_modules/.pnpm/@antasphere+contract@0.16.3_hono@4.12.27/node_modules/@antasphere/contract/dist/wire.js
+var DAY = 24 * 60 * 60 * 1e3;
+var MIN = 60 * 1e3;
+var ULID = "01J8Z1X2Y3K4M5N6P7Q8R9S0TV";
+var ACCOUNT = "0b6c7c1e-4f4e-4a7b-9c1d-2e3f4a5b6c7d";
+var event = {
+  id: ULID,
+  actionKey: "presentations.publish",
+  quantity: 1,
+  unit: "call",
+  occurredAt: "2026-09-23T11:59:00.000Z",
+  workspaceId: "ws_1",
+  accountRef: ACCOUNT,
+  userId: "usr_1",
+  via: "session",
+  source: { instanceId: "inst_1", edition: "cloud", version: "0.7.0" }
+};
+var check2 = {
+  accountRef: ACCOUNT,
+  actionKey: "presentations.publish",
+  quantity: 1,
+  allowed: false,
+  credits: 50,
+  balance: 10,
+  unit: "call",
+  priced: true,
+  plan: "free",
+  reason: "insufficient_credits",
+  topUpUrl: "https://account.example/billing/top-up?org=x"
+};
+var entitlements = {
+  accountRef: ACCOUNT,
+  plan: "pro",
+  planUntil: null,
+  limits: { "presentations.maxBytes": 1048576, "things.max": true },
+  features: ["things.premium"],
+  upgradeUrl: "https://account.example/billing/upgrade?org=x"
+};
+var HUB_TOOL_WIRE_INPUTS = {
+  occurrenceOffsetsMs: [0, -3 * DAY, -7 * DAY, -7 * DAY - 1, 5 * MIN, 5 * MIN + 1, -30 * DAY, 60 * MIN],
+  probes: {
+    usageEvent: [
+      { name: "the plain event", input: event },
+      {
+        name: "meter as the legacy alias of actionKey",
+        input: { ...event, actionKey: void 0, meter: "presentations.publish" }
+      },
+      { name: "neither actionKey nor meter (the refinement)", input: { ...event, actionKey: void 0 } },
+      { name: "userId null: a resource owner the tool could not name", input: { ...event, userId: null } },
+      { name: "userId absent", input: { ...event, userId: void 0 } },
+      { name: "the calling tool named in the body", input: { ...event, toolSlug: "slideless" } },
+      { name: "a negative quantity", input: { ...event, quantity: -1 } },
+      { name: "a fractional quantity", input: { ...event, quantity: 1.5 } },
+      {
+        name: "a quantity past the safe integer range",
+        input: { ...event, quantity: Number.MAX_SAFE_INTEGER + 2 }
+      },
+      { name: "occurredAt without an offset", input: { ...event, occurredAt: "2026-09-23T11:59:00" } },
+      { name: "an id that is not a ULID", input: { ...event, id: "not-a-ulid" } },
+      { name: "an accountRef that is not a uuid", input: { ...event, accountRef: "org_1" } },
+      { name: "a via outside the three", input: { ...event, via: "mcp" } },
+      {
+        name: "the source without a version",
+        input: { ...event, source: { instanceId: "i", edition: "cloud" } }
+      },
+      { name: "an unknown field", input: { ...event, extra: true } }
+    ],
+    usageEventsBatch: [
+      { name: "one event", input: { events: [event] } },
+      { name: "an empty batch", input: { events: [] } },
+      { name: "two events", input: { events: [event, event] } },
+      { name: "an element that is not an event (parsed per element, not here)", input: { events: [42] } },
+      { name: "events missing", input: {} }
+    ],
+    usageIngestResult: [
+      {
+        name: "three answers with the counts",
+        input: {
+          results: [
+            { id: ULID, status: "accepted", credits: 50 },
+            { id: ULID, status: "duplicate" },
+            {
+              id: null,
+              status: "rejected",
+              reason: "invalid_event",
+              details: [{ path: "id", message: "a ULID" }]
+            }
+          ],
+          accepted: 1,
+          duplicate: 1,
+          rejected: 1
+        }
+      },
+      { name: "the counts missing", input: { results: [] } },
+      {
+        name: "a reason outside the closed list",
+        input: {
+          results: [{ id: ULID, status: "rejected", reason: "other" }],
+          accepted: 0,
+          duplicate: 0,
+          rejected: 1
+        }
+      },
+      {
+        name: "a status outside the three",
+        input: { results: [{ id: ULID, status: "stored" }], accepted: 1, duplicate: 0, rejected: 0 }
+      },
+      {
+        name: "fractional credits",
+        input: {
+          results: [{ id: ULID, status: "accepted", credits: 0.5 }],
+          accepted: 1,
+          duplicate: 0,
+          rejected: 0
+        }
+      }
+    ],
+    usageEntitlements: [
+      { name: "a pro account with a limit switched on", input: entitlements },
+      {
+        name: "a free account, nothing seeded",
+        input: { ...entitlements, plan: "free", limits: {}, features: [] }
+      },
+      { name: "upgradeUrl missing", input: { ...entitlements, upgradeUrl: void 0 } },
+      { name: "a plan outside the tiers", input: { ...entitlements, plan: "enterprise" } },
+      { name: "planUntil missing", input: { ...entitlements, planUntil: void 0 } },
+      { name: "a limit that is a string", input: { ...entitlements, limits: { "things.max": "10" } } }
+    ],
+    usageCheckRequest: [
+      {
+        name: "the plain request",
+        input: { accountRef: ACCOUNT, actionKey: "presentations.publish", quantity: 1, unit: "call" }
+      },
+      {
+        name: "unit absent",
+        input: { accountRef: ACCOUNT, actionKey: "presentations.publish", quantity: 1 }
+      },
+      {
+        name: "a zero quantity",
+        input: { accountRef: ACCOUNT, actionKey: "presentations.publish", quantity: 0 }
+      },
+      {
+        name: "a negative quantity",
+        input: { accountRef: ACCOUNT, actionKey: "presentations.publish", quantity: -1 }
+      },
+      {
+        name: "a quantity past the safe integer range",
+        input: {
+          accountRef: ACCOUNT,
+          actionKey: "presentations.publish",
+          quantity: Number.MAX_SAFE_INTEGER + 2
+        }
+      },
+      {
+        name: "an action key of 121 characters",
+        input: { accountRef: ACCOUNT, actionKey: "k".repeat(121), quantity: 1 }
+      },
+      { name: "an empty action key", input: { accountRef: ACCOUNT, actionKey: "", quantity: 1 } },
+      {
+        name: "an action key with a control character",
+        input: { accountRef: ACCOUNT, actionKey: "a\0b", quantity: 1 }
+      },
+      {
+        name: "a unit of 41 characters",
+        input: { accountRef: ACCOUNT, actionKey: "presentations.publish", quantity: 1, unit: "u".repeat(41) }
+      }
+    ],
+    usageCheck: [
+      { name: "a refusal for credits", input: check2 },
+      {
+        name: "allowed, reason null",
+        input: { ...check2, allowed: true, credits: 5, balance: 10, reason: null }
+      },
+      { name: "a suspended organization", input: { ...check2, reason: "account_suspended" } },
+      {
+        name: "unpriceable: the price past the safe integer range, clamped",
+        input: { ...check2, credits: Number.MAX_SAFE_INTEGER, reason: "unpriceable" }
+      },
+      { name: "a reason outside the closed list", input: { ...check2, reason: "over_quota" } },
+      { name: "a negative balance: the ledger went below zero", input: { ...check2, balance: -40 } },
+      {
+        name: "an unpriced action",
+        input: { ...check2, allowed: true, credits: 0, unit: null, priced: false, reason: null }
+      },
+      { name: "topUpUrl missing", input: { ...check2, topUpUrl: void 0 } },
+      { name: "a plan outside the tiers", input: { ...check2, plan: "enterprise" } },
+      { name: "fractional credits", input: { ...check2, credits: 0.5 } }
+    ]
+  }
+};
+
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/entitlements.js
+var entitlementTierSchema = billingPlanSchema;
 var entitlementActionSchema = external_exports.object({
   key: external_exports.string().min(1),
   creditsPerUnit: external_exports.number().int().min(0),
@@ -20240,8 +21744,8 @@ var entitlementProfileSchema = external_exports.object({
   upgradeUrl: external_exports.string()
 });
 
-// ../chassis-contract/dist/schemas/instance.js
-var instanceInfoSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/instance.js
+var instanceInfoSchema2 = external_exports.object({
   name: external_exports.string(),
   instanceId: external_exports.string().nullable(),
   edition: external_exports.string(),
@@ -20301,8 +21805,8 @@ var instanceInfoSchema = external_exports.object({
   entitlements: toolEntitlementsSchema.optional()
 });
 
-// ../chassis-contract/dist/schemas/setup.js
-var setupRequestSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/setup.js
+var setupRequestSchema2 = external_exports.object({
   instanceName: plainText(1, 120),
   owner: external_exports.object({
     email: external_exports.email(),
@@ -20311,32 +21815,32 @@ var setupRequestSchema = external_exports.object({
   }),
   setupToken: external_exports.string().optional()
 });
-var setupResponseSchema = external_exports.object({
+var setupResponseSchema2 = external_exports.object({
   instanceId: external_exports.string(),
   /** The first workspace (oss); null on cloud — no workspace is created there. */
   workspaceId: external_exports.string().nullable(),
   ownerUserId: external_exports.string()
 });
 
-// ../chassis-contract/dist/schemas/workspaces.js
-var lookKey = external_exports.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "a short lowercase key").nullable();
-var lookLevel = external_exports.number().min(0).max(1).nullable();
-var workspaceLookSchema = external_exports.object({
-  theme: lookKey,
-  pattern: lookKey,
-  field: lookLevel,
-  grain: lookLevel
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/workspaces.js
+var lookKey2 = external_exports.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "a short lowercase key").nullable();
+var lookLevel2 = external_exports.number().min(0).max(1).nullable();
+var workspaceLookSchema2 = external_exports.object({
+  theme: lookKey2,
+  pattern: lookKey2,
+  field: lookLevel2,
+  grain: lookLevel2
 });
 var workspaceCreateSchema = external_exports.object({
   name: plainText(1, 120),
-  look: workspaceLookSchema.partial().optional()
+  look: workspaceLookSchema2.partial().optional()
 });
 var workspaceCreatedSchema = external_exports.object({
   workspace: external_exports.object({
     /** The LOCAL workspace id — pass it as `X-Workspace-Id` to work in it. */
     id: external_exports.string(),
     name: external_exports.string(),
-    look: workspaceLookSchema
+    look: workspaceLookSchema2
   })
 });
 var defaultWorkspaceSetSchema = external_exports.object({
@@ -20346,24 +21850,24 @@ var defaultWorkspaceSchema = external_exports.object({
   /** The LOCAL id of the person's default workspace, or null when none is chosen. */
   defaultWorkspaceId: external_exports.string().nullable()
 });
-var workspaceUpdateSchema = external_exports.object({
+var workspaceUpdateSchema2 = external_exports.object({
   name: plainText(1, 120).optional(),
-  look: workspaceLookSchema.partial().optional()
+  look: workspaceLookSchema2.partial().optional()
 }).refine((b) => b.name !== void 0 || b.look !== void 0, { message: "nothing to change" });
-var workspaceUpdatedSchema = external_exports.object({
+var workspaceUpdatedSchema2 = external_exports.object({
   workspace: external_exports.object({
     id: external_exports.string(),
     name: external_exports.string(),
-    look: workspaceLookSchema
+    look: workspaceLookSchema2
   })
 });
 
-// ../chassis-contract/dist/schemas/me.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/me.js
 var onboardingDismissedSchema = external_exports.object({
   dismissed: external_exports.literal(true)
 });
-function defineMeSchemas(scopeSchema2) {
-  const meResponseSchema2 = external_exports.object({
+function defineMeSchemas(scopeSchema3) {
+  const meResponseSchema3 = external_exports.object({
     user: external_exports.object({
       id: external_exports.string(),
       email: external_exports.string(),
@@ -20385,7 +21889,7 @@ function defineMeSchemas(scopeSchema2) {
        */
       hubOrigin: external_exports.boolean(),
       /** The workspace's look, a fact of the workspace (schemas/workspaces.ts). */
-      look: workspaceLookSchema
+      look: workspaceLookSchema2
     }).nullable(),
     /** Null only in the zero-membership session state. */
     role: workspaceRoleSchema.nullable(),
@@ -20399,7 +21903,7 @@ function defineMeSchemas(scopeSchema2) {
      */
     origin: external_exports.enum(["local", "hub", "guest"]).nullable(),
     via: external_exports.enum(["session", "api_key", "oauth"]),
-    scopes: external_exports.array(scopeSchema2).nullable(),
+    scopes: external_exports.array(scopeSchema3).nullable(),
     /** Expiry of the presented API key; null for sessions/OAuth or non-expiring keys. */
     apiKeyExpiresAt: external_exports.string().nullable(),
     /**
@@ -20426,7 +21930,7 @@ function defineMeSchemas(scopeSchema2) {
        */
       centralAccountId: external_exports.string().nullable(),
       /** Each workspace's look, so the switcher's tiles carry them (schemas/workspaces.ts). */
-      look: workspaceLookSchema,
+      look: workspaceLookSchema2,
       /**
        * The hub asserted this org suspended (cloud edition): it stays
        * VISIBLE here but requests into it are refused. Always false on oss
@@ -20507,11 +22011,11 @@ function defineMeSchemas(scopeSchema2) {
      */
     hubNoAccessUrl: external_exports.string().optional()
   });
-  return { meResponseSchema: meResponseSchema2 };
+  return { meResponseSchema: meResponseSchema3 };
 }
 
-// ../chassis-contract/dist/schemas/members.js
-var memberSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/members.js
+var memberSchema2 = external_exports.object({
   id: external_exports.string(),
   userId: external_exports.string(),
   email: external_exports.string(),
@@ -20521,37 +22025,37 @@ var memberSchema = external_exports.object({
   createdAt: external_exports.string(),
   lastSeenAt: external_exports.string().nullable()
 });
-var membersListSchema = external_exports.object({
-  members: external_exports.array(memberSchema),
+var membersListSchema2 = external_exports.object({
+  members: external_exports.array(memberSchema2),
   nextCursor: external_exports.string().nullable()
 });
-var memberUpdateSchema = external_exports.object({
+var memberUpdateSchema2 = external_exports.object({
   role: workspaceRoleSchema.optional(),
   isActive: external_exports.boolean().optional()
 }).refine((v) => v.role !== void 0 || v.isActive !== void 0, {
   error: "at least one of role or isActive is required"
 });
-var memberResetLinkSchema = external_exports.object({
+var memberResetLinkSchema2 = external_exports.object({
   resetUrl: external_exports.string(),
   expiresAt: external_exports.string()
 });
-var memberChangeEmailLinkRequestSchema = external_exports.object({
+var memberChangeEmailLinkRequestSchema2 = external_exports.object({
   newEmail: external_exports.email()
 });
-var memberChangeEmailLinkSchema = external_exports.object({
+var memberChangeEmailLinkSchema2 = external_exports.object({
   verifyUrl: external_exports.string(),
   newEmail: external_exports.string(),
   expiresAt: external_exports.string()
 });
 
-// ../chassis-contract/dist/schemas/cli-auth.js
-var cliAuthRequestSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-auth.js
+var cliAuthRequestSchema2 = external_exports.object({
   email: external_exports.email()
 });
-var cliAuthRequestedSchema = external_exports.object({
+var cliAuthRequestedSchema2 = external_exports.object({
   sent: external_exports.literal(true)
 });
-var cliAuthCompleteSchema = external_exports.object({
+var cliAuthCompleteSchema2 = external_exports.object({
   email: external_exports.email(),
   otp: external_exports.string().min(4).max(16),
   /** Display name for the minted key (defaults to a CLI-login label). */
@@ -20566,15 +22070,15 @@ var cliAuthCompleteSchema = external_exports.object({
    */
   workspaceId: external_exports.uuid().optional()
 });
-var cliAuthRevokedSchema = external_exports.object({
+var cliAuthRevokedSchema2 = external_exports.object({
   revoked: external_exports.literal(true),
   id: external_exports.string()
 });
-function defineCliAuthSchemas(apiKeySchema2) {
-  const cliAuthCompletedSchema2 = external_exports.object({
+function defineCliAuthSchemas(apiKeySchema3) {
+  const cliAuthCompletedSchema3 = external_exports.object({
     /** Full key `<prefix>_<keyid>_<secret>` — shown once, never retrievable. */
     key: external_exports.string(),
-    apiKey: apiKeySchema2,
+    apiKey: apiKeySchema3,
     user: external_exports.object({
       id: external_exports.string(),
       email: external_exports.string(),
@@ -20583,10 +22087,10 @@ function defineCliAuthSchemas(apiKeySchema2) {
     /** The workspace the key is PINNED to; null = user-scoped (unpinned). */
     workspaceId: external_exports.string().nullable()
   });
-  return { cliAuthCompletedSchema: cliAuthCompletedSchema2 };
+  return { cliAuthCompletedSchema: cliAuthCompletedSchema3 };
 }
 
-// ../chassis-contract/dist/schemas/sso-connect.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-connect.js
 var ssoCliConnectSchema = external_exports.object({
   /** The hub-minted exchange JWT (compact JWS — three base64url segments). */
   token: external_exports.string().min(20).max(4096),
@@ -20601,13 +22105,13 @@ var ssoCliConnectSchema = external_exports.object({
   hubRefreshToken: external_exports.string().min(20).max(512).optional()
 });
 
-// ../chassis-contract/dist/schemas/sso-logout.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-logout.js
 var ssoLogoutResponseSchema = external_exports.object({
   url: external_exports.string().nullable()
 });
 
-// ../chassis-contract/dist/schemas/invitations.js
-var invitationSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/invitations.js
+var invitationSchema2 = external_exports.object({
   id: external_exports.string(),
   email: external_exports.string(),
   role: workspaceRoleSchema,
@@ -20617,39 +22121,39 @@ var invitationSchema = external_exports.object({
   revokedAt: external_exports.string().nullable(),
   createdAt: external_exports.string()
 });
-var invitationsListSchema = external_exports.object({
-  invitations: external_exports.array(invitationSchema),
+var invitationsListSchema2 = external_exports.object({
+  invitations: external_exports.array(invitationSchema2),
   nextCursor: external_exports.string().nullable()
 });
-var invitationCreateSchema = external_exports.object({
+var invitationCreateSchema2 = external_exports.object({
   email: external_exports.email(),
   role: workspaceRoleSchema.default("member")
 });
-var invitationCreatedSchema = external_exports.object({
-  invitation: invitationSchema,
+var invitationCreatedSchema2 = external_exports.object({
+  invitation: invitationSchema2,
   acceptUrl: external_exports.string(),
   emailSent: external_exports.boolean()
 });
-var invitationLookupSchema = external_exports.object({
+var invitationLookupSchema2 = external_exports.object({
   email: external_exports.string(),
   role: workspaceRoleSchema,
   workspaceName: external_exports.string(),
   expiresAt: external_exports.string()
 });
-var invitationAcceptSchema = external_exports.object({
+var invitationAcceptSchema2 = external_exports.object({
   token: external_exports.string().min(16),
   /** Required when the invited email has no account yet. */
   name: plainText(1, 120).optional(),
   password: external_exports.string().min(12).max(256).optional()
 });
-var invitationAcceptedSchema = external_exports.object({
+var invitationAcceptedSchema2 = external_exports.object({
   workspaceId: external_exports.string(),
   userId: external_exports.string(),
   role: workspaceRoleSchema
 });
 
-// ../chassis-contract/dist/schemas/audit.js
-var auditEntrySchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/audit.js
+var auditEntrySchema2 = external_exports.object({
   id: external_exports.number(),
   actorUserId: external_exports.string().nullable(),
   actorEmail: external_exports.string().nullable(),
@@ -20682,8 +22186,8 @@ var auditListQuerySchema = cursorPageQuerySchema.extend({
   /** Entries created at or before this instant (ISO 8601). */
   to: external_exports.iso.datetime().optional()
 });
-var auditListSchema = external_exports.object({
-  entries: external_exports.array(auditEntrySchema),
+var auditListSchema2 = external_exports.object({
+  entries: external_exports.array(auditEntrySchema2),
   nextCursor: external_exports.string().nullable(),
   /**
    * How many entries match the filters in all: counted on the first page
@@ -20693,12 +22197,12 @@ var auditListSchema = external_exports.object({
   total: external_exports.number().int().nullable()
 });
 
-// ../chassis-contract/dist/schemas/break-glass.js
-var breakGlassClaimOwnershipRequestSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/break-glass.js
+var breakGlassClaimOwnershipRequestSchema2 = external_exports.object({
   userId: external_exports.string().min(1).optional(),
   workspaceId: external_exports.uuid().optional()
 });
-var breakGlassClaimOwnershipSchema = external_exports.object({
+var breakGlassClaimOwnershipSchema2 = external_exports.object({
   memberId: external_exports.string(),
   userId: external_exports.string(),
   email: external_exports.string(),
@@ -20709,17 +22213,17 @@ var breakGlassClaimOwnershipSchema = external_exports.object({
   /** true when the membership was created; false when an existing row was promoted/reactivated. */
   created: external_exports.boolean()
 });
-var breakGlassResetTwoFactorRequestSchema = external_exports.object({
+var breakGlassResetTwoFactorRequestSchema2 = external_exports.object({
   userId: external_exports.string().min(1)
 });
-var breakGlassResetTwoFactorSchema = external_exports.object({
+var breakGlassResetTwoFactorSchema2 = external_exports.object({
   userId: external_exports.string(),
   /** true when a factor actually existed (row or enabled flag) before the reset. */
   hadTwoFactor: external_exports.boolean()
 });
 
-// ../chassis-contract/dist/schemas/files.js
-var fileSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/files.js
+var fileSchema2 = external_exports.object({
   id: external_exports.string(),
   sha256: external_exports.string(),
   sizeBytes: external_exports.number(),
@@ -20729,21 +22233,21 @@ var fileSchema = external_exports.object({
   createdBy: external_exports.string().nullable(),
   createdAt: external_exports.string()
 });
-var filesListSchema = external_exports.object({
-  files: external_exports.array(fileSchema),
+var filesListSchema2 = external_exports.object({
+  files: external_exports.array(fileSchema2),
   nextCursor: external_exports.string().nullable()
 });
-var fileUploadedSchema = external_exports.object({
-  file: fileSchema,
+var fileUploadedSchema2 = external_exports.object({
+  file: fileSchema2,
   /** True when identical bytes already existed for this workspace. */
   deduplicated: external_exports.boolean()
 });
-var fileUploadQuerySchema = external_exports.object({
+var fileUploadQuerySchema2 = external_exports.object({
   /** Original filename (the body is the raw bytes). */
   name: plainText(1, 255)
 });
 
-// ../chassis-contract/dist/schemas/projects.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/projects.js
 var projectRoleSchema = external_exports.enum(["manager", "editor", "viewer"]);
 var PROJECT_METADATA_MAX_LENGTH = 16 * 1024;
 var projectMetadataSchema = opaqueJsonChecks(external_exports.record(external_exports.string(), external_exports.unknown())).refine((v) => JSON.stringify(v).length <= PROJECT_METADATA_MAX_LENGTH, `metadata must serialize to at most ${PROJECT_METADATA_MAX_LENGTH} characters`);
@@ -20831,9 +22335,9 @@ var projectMemberParamsSchema = external_exports.object({
 });
 var projectTeamParamsSchema = external_exports.object({ id: external_exports.uuid(), teamId: external_exports.uuid() });
 
-// ../chassis-contract/dist/schemas/teams.js
-var teamSlugSchema = external_exports.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "lowercase letters and digits, joined by single dashes").min(1).max(60);
-var teamSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/teams.js
+var teamSlugSchema2 = external_exports.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "lowercase letters and digits, joined by single dashes").min(1).max(60);
+var teamSchema2 = external_exports.object({
   id: external_exports.string(),
   slug: external_exports.string(),
   name: external_exports.string(),
@@ -20848,20 +22352,20 @@ var teamSchema = external_exports.object({
   createdAt: external_exports.string(),
   updatedAt: external_exports.string()
 });
-var teamsListSchema = external_exports.object({
-  teams: external_exports.array(teamSchema),
+var teamsListSchema2 = external_exports.object({
+  teams: external_exports.array(teamSchema2),
   nextCursor: external_exports.string().nullable()
 });
-var teamCreateSchema = external_exports.object({
+var teamCreateSchema2 = external_exports.object({
   name: plainText(1, 80),
   /** Absent: derived from the name (lowercased, non-alphanumerics to dashes, cut to 60). */
-  slug: teamSlugSchema.optional()
+  slug: teamSlugSchema2.optional()
 });
-var teamUpdateSchema = external_exports.object({
+var teamUpdateSchema2 = external_exports.object({
   name: plainText(1, 80).optional(),
-  slug: teamSlugSchema.optional()
+  slug: teamSlugSchema2.optional()
 }).refine((b) => b.name !== void 0 || b.slug !== void 0, { error: "nothing to change" });
-var teamMemberSchema = external_exports.object({
+var teamMemberSchema2 = external_exports.object({
   userId: external_exports.string(),
   email: external_exports.string(),
   name: external_exports.string(),
@@ -20870,8 +22374,8 @@ var teamMemberSchema = external_exports.object({
   isActive: external_exports.boolean(),
   addedAt: external_exports.string()
 });
-var teamMembersListSchema = external_exports.object({
-  members: external_exports.array(teamMemberSchema),
+var teamMembersListSchema2 = external_exports.object({
+  members: external_exports.array(teamMemberSchema2),
   nextCursor: external_exports.string().nullable()
 });
 var teamMemberAddSchema = external_exports.object({
@@ -20885,9 +22389,9 @@ var teamMemberParamsSchema = external_exports.object({
   userId: noControlChars(external_exports.string().min(1).max(200))
 });
 
-// ../chassis-contract/dist/schemas/demo-passes.js
-var DEMO_PASS_MAX_MINUTES = 10080;
-var demoPassSchema = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/demo-passes.js
+var DEMO_PASS_MAX_MINUTES2 = 10080;
+var demoPassSchema2 = external_exports.object({
   id: external_exports.string(),
   /** The person the pass signs in. */
   userId: external_exports.string(),
@@ -20904,21 +22408,21 @@ var demoPassSchema = external_exports.object({
   /** How many sessions the pass has opened. */
   useCount: external_exports.number().int()
 });
-var demoPassesListSchema = external_exports.object({ passes: external_exports.array(demoPassSchema) });
-var demoPassMintSchema = external_exports.object({
+var demoPassesListSchema2 = external_exports.object({ passes: external_exports.array(demoPassSchema2) });
+var demoPassMintSchema2 = external_exports.object({
   email: external_exports.email(),
   path: external_exports.string().optional(),
-  expiresInMinutes: external_exports.number().int().min(1).max(DEMO_PASS_MAX_MINUTES).optional()
+  expiresInMinutes: external_exports.number().int().min(1).max(DEMO_PASS_MAX_MINUTES2).optional()
 });
-var demoPassMintedSchema = external_exports.object({
-  pass: demoPassSchema,
+var demoPassMintedSchema2 = external_exports.object({
+  pass: demoPassSchema2,
   /** The secret itself: shown here once, never again. */
   secret: external_exports.string(),
   /** `<PUBLIC_BASE_URL>/demo#pass=<secret>&to=<path>`: the fragment never reaches a server log. */
   url: external_exports.string()
 });
-var demoPassRedeemSchema = external_exports.object({ pass: external_exports.string().min(1) });
-var demoPassRedeemedSchema = external_exports.object({
+var demoPassRedeemSchema2 = external_exports.object({ pass: external_exports.string().min(1) });
+var demoPassRedeemedSchema2 = external_exports.object({
   user: external_exports.object({ id: external_exports.string(), email: external_exports.string(), name: external_exports.string() }),
   /** The pass's page: where the dashboard goes when the link names none. */
   path: external_exports.string(),
@@ -20926,13 +22430,13 @@ var demoPassRedeemedSchema = external_exports.object({
   expiresAt: external_exports.string()
 });
 
-// ../chassis-contract/dist/schemas/api-keys.js
-function defineApiKeySchemas(scopeSchema2) {
-  const apiKeySchema2 = external_exports.object({
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/api-keys.js
+function defineApiKeySchemas(scopeSchema3) {
+  const apiKeySchema3 = external_exports.object({
     id: external_exports.string(),
     name: external_exports.string(),
     keyId: external_exports.string(),
-    scopes: external_exports.array(scopeSchema2),
+    scopes: external_exports.array(scopeSchema3),
     /**
      * The key's optional workspace PIN (user-scoped credential model). null =
      * user-scoped: the key acts as its creator and the target workspace is a
@@ -20946,13 +22450,13 @@ function defineApiKeySchemas(scopeSchema2) {
     revokedAt: external_exports.string().nullable(),
     expiresAt: external_exports.string().nullable()
   });
-  const apiKeysListSchema2 = external_exports.object({
-    apiKeys: external_exports.array(apiKeySchema2),
+  const apiKeysListSchema3 = external_exports.object({
+    apiKeys: external_exports.array(apiKeySchema3),
     nextCursor: external_exports.string().nullable()
   });
-  const apiKeyCreateSchema2 = external_exports.object({
+  const apiKeyCreateSchema3 = external_exports.object({
     name: plainText(1, 120),
-    scopes: external_exports.array(scopeSchema2).min(1),
+    scopes: external_exports.array(scopeSchema3).min(1),
     /** TTL at mint; the server computes the absolute expiry. Omit = never expires. */
     expiresInDays: external_exports.number().int().min(1).max(3650).optional(),
     /**
@@ -20963,29 +22467,29 @@ function defineApiKeySchemas(scopeSchema2) {
      */
     workspaceId: external_exports.uuid().optional()
   });
-  const apiKeyCreatedSchema2 = external_exports.object({
-    apiKey: apiKeySchema2,
+  const apiKeyCreatedSchema3 = external_exports.object({
+    apiKey: apiKeySchema3,
     /** Full key `<prefix>_<keyid>_<secret>` — shown once, never retrievable. */
     key: external_exports.string()
   });
-  return { apiKeySchema: apiKeySchema2, apiKeysListSchema: apiKeysListSchema2, apiKeyCreateSchema: apiKeyCreateSchema2, apiKeyCreatedSchema: apiKeyCreatedSchema2 };
+  return { apiKeySchema: apiKeySchema3, apiKeysListSchema: apiKeysListSchema3, apiKeyCreateSchema: apiKeyCreateSchema3, apiKeyCreatedSchema: apiKeyCreatedSchema3 };
 }
 
-// ../chassis-contract/dist/define.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/define.js
 function defineChassisContract(tool) {
   return buildChassisContract(defineScopeSchema(tool.scopes));
 }
-function buildChassisContract(scopeSchema2) {
-  const apiKeys = defineApiKeySchemas(scopeSchema2);
+function buildChassisContract(scopeSchema3) {
+  const apiKeys = defineApiKeySchemas(scopeSchema3);
   return {
-    scopeSchema: scopeSchema2,
+    scopeSchema: scopeSchema3,
     ...apiKeys,
     ...defineCliAuthSchemas(apiKeys.apiKeySchema),
-    ...defineMeSchemas(scopeSchema2)
+    ...defineMeSchemas(scopeSchema3)
   };
 }
 
-// ../chassis-cli/dist/owner-session.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/owner-session.js
 var SIGN_IN_WAITS_MS = [4e3, 8e3, 12e3];
 var SESSION_COOKIE = /session_token$/;
 function sessionCookie(res) {
@@ -21066,7 +22570,7 @@ async function withOwnerSession(ctx, options, run2) {
   }
 }
 
-// ../chassis-cli/dist/commands/demo.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/demo.js
 var SWITCH_OFF = "Demo sign-in is off on this instance (DEMO_SIGN_IN), or this is the cloud edition, where demo links are minted at the Antasphere hub.";
 var NOT_AN_OWNER = "Only an owner of this workspace manages demo links: the account that signed in is not one.";
 var REFUSALS = /* @__PURE__ */ new Set([
@@ -21125,8 +22629,8 @@ function lifetimeMinutes(opts) {
     return void 0;
   const n = /^\d+$/.test(raw) ? Number(raw) : NaN;
   const minutes = opts.hours !== void 0 ? n * 60 : n;
-  if (!Number.isSafeInteger(minutes) || minutes < 1 || minutes > DEMO_PASS_MAX_MINUTES) {
-    throw new CliUsageError(`A demo link lives from one minute to a week (${DEMO_PASS_MAX_MINUTES} minutes): --${opts.hours !== void 0 ? "hours" : "minutes"} takes a whole number in that range.`);
+  if (!Number.isSafeInteger(minutes) || minutes < 1 || minutes > DEMO_PASS_MAX_MINUTES2) {
+    throw new CliUsageError(`A demo link lives from one minute to a week (${DEMO_PASS_MAX_MINUTES2} minutes): --${opts.hours !== void 0 ? "hours" : "minutes"} takes a whole number in that range.`);
   }
   return minutes;
 }
@@ -21220,14 +22724,14 @@ function registerDemoCommands(kit, program2, io) {
   });
 }
 
-// ../chassis-cli/dist/commands/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
 import { createWriteStream } from "node:fs";
 import { mkdir as mkdir2, readFile, writeFile } from "node:fs/promises";
 import { basename, resolve as resolve2, win32 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
-// ../chassis-cli/dist/safe-write.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/safe-write.js
 import { constants as FS } from "node:fs";
 import { mkdir, open, realpath, unlink } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute, relative, resolve } from "node:path";
@@ -21308,7 +22812,7 @@ async function streamContained(root, relPath, source) {
   }
 }
 
-// ../chassis-cli/dist/commands/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
 function safeDownloadName(originalName) {
   const name = basename(win32.basename(originalName));
   if (name === "" || name === "." || name === ".." || name.startsWith(".")) {
@@ -21435,7 +22939,7 @@ function registerFileCommands(kit, program2, io) {
   });
 }
 
-// ../chassis-cli/dist/commands/completion.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/completion.js
 function commandTree(program2) {
   return program2.commands.filter((c) => !c.name().startsWith("help")).map((c) => ({
     name: c.name(),
@@ -21510,7 +23014,7 @@ function registerCompletionCommand(identity, program2, io) {
   });
 }
 
-// ../chassis-cli/dist/program.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/program.js
 function creditFigures(credit) {
   const parts = [
     typeof credit?.credits === "number" ? `this needs ${credit.credits} credits` : null,
@@ -21592,7 +23096,7 @@ function createProgram(kit, definition) {
   return { buildProgram, run: run2 };
 }
 
-// ../chassis-cli/dist/identity.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/identity.js
 function cliIdentity(identity) {
   return {
     bin: identity.cli.bin,
@@ -21606,7 +23110,7 @@ function cliIdentity(identity) {
   };
 }
 
-// ../chassis-cli/dist/open.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/open.js
 import { spawn } from "node:child_process";
 function platformOpener(platform = process.platform) {
   if (platform === "darwin")
@@ -21632,7 +23136,7 @@ function isInteractive(io) {
   return io.out.isTTY === true;
 }
 
-// ../chassis-cli/dist/index.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.1_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/index.js
 function defineCli(definition) {
   const { identity, createClient } = definition;
   const config2 = createConfig(identity);
@@ -21670,13 +23174,13 @@ var IDENTITY = {
 // ../contract/dist/chassis.js
 var { read, write, dataExport } = IDENTITY.scopes;
 var chassisContract = defineChassisContract({ scopes: [read, write, dataExport] });
-var scopeSchema = chassisContract.scopeSchema;
-var apiKeySchema = chassisContract.apiKeySchema;
-var apiKeysListSchema = chassisContract.apiKeysListSchema;
-var apiKeyCreateSchema = chassisContract.apiKeyCreateSchema;
-var apiKeyCreatedSchema = chassisContract.apiKeyCreatedSchema;
-var cliAuthCompletedSchema = chassisContract.cliAuthCompletedSchema;
-var meResponseSchema = chassisContract.meResponseSchema;
+var scopeSchema2 = chassisContract.scopeSchema;
+var apiKeySchema2 = chassisContract.apiKeySchema;
+var apiKeysListSchema2 = chassisContract.apiKeysListSchema;
+var apiKeyCreateSchema2 = chassisContract.apiKeyCreateSchema;
+var apiKeyCreatedSchema2 = chassisContract.apiKeyCreatedSchema;
+var cliAuthCompletedSchema2 = chassisContract.cliAuthCompletedSchema;
+var meResponseSchema2 = chassisContract.meResponseSchema;
 
 // ../contract/dist/schemas/presentations.js
 var presentationKindSchema = external_exports.enum(["presentation", "app", "plan"]);
@@ -25915,7 +27419,7 @@ async function zipMode(ctx, io, id, responseId, filters, zip) {
 }
 
 // src/index.ts
-var VERSION = "0.13.3";
+var VERSION = "0.13.6";
 function registerTool(program2, io) {
   registerDeckCommands(program2, io);
   registerContentCommands(program2, io);