@azx-pbc/helix-cli 0.3.0 → 0.5.0

package/dist/helix.js

@@ -10,8 +10,13 @@ var options = {
   token: { type: "string" },
   promote: { type: "boolean" },
   "display-name": { type: "string" },
+  description: { type: "string" },
   visibility: { type: "string" },
   path: { type: "string" },
+  repo: { type: "string" },
+  branch: { type: "string" },
+  reusable: { type: "boolean" },
+  force: { type: "boolean" },
   help: { type: "boolean" }
 };
 function parseCliArgs(argv) {
@@ -20,7 +25,7 @@ function parseCliArgs(argv) {
 }
 
 // src/client.ts
-import { z as z22 } from "zod";
+import { z as z29 } from "zod";
 
 // ../shared/src/visibility.ts
 import { z } from "zod";
@@ -88,10 +93,19 @@ var DirectoryGroupsResponseSchema = z2.discriminatedUnion("available", [
 // ../shared/src/app.ts
 import { z as z3 } from "zod";
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var APP_DESCRIPTION_MAX = 500;
 var AppSchema = z3.object({
   id: z3.uuid(),
   slug: z3.string().min(1).max(63).regex(SLUG_PATTERN, "must be a lowercase DNS label (a-z, 0-9, hyphen)"),
   displayName: z3.string().min(1).max(200),
+  /**
+   * What the app is for, in one sentence. Plain text (≤ {@link APP_DESCRIPTION_MAX}
+   * chars) — it renders as a subtitle in list rows and the detail header, so
+   * markdown would invite a wall of text in a table cell. Optional on the wire
+   * like `url`/`ownerId`: the CLI parses this schema, and every row predating
+   * the field carries none. Never `null` — an unset description omits the key.
+   */
+  description: z3.string().max(APP_DESCRIPTION_MAX).optional(),
   visibility: VisibilitySchema,
   /** The version currently served; null before the first deploy. */
   currentVersionId: z3.uuid().nullable(),
@@ -109,9 +123,9 @@ var AppSchema = z3.object({
    */
   url: z3.url().optional(),
   /**
-   * Who owns this app — the portal actor that created it (`actor.sub`). The
-   * **identity** half: this is what `scope=mine` and `ownsApp` compare against,
-   * and it is never what a screen renders.
+   * Who owns this app — the creator's Entra `oid` (ADR-0048). The **identity**
+   * half: this is what `scope=mine` and `ownsApp` compare against, and it is
+   * never what a screen renders.
    *
    * Optional for the same reason as `url`: the CLI parses this schema, and rows
    * predating the approvals work carry no owner at all.
@@ -119,11 +133,12 @@ var AppSchema = z3.object({
   ownerId: z3.string().optional(),
   /**
    * The owner's claims as captured at create time. The **display** half: render
-   * these, never compare them. `ownerId` only looks like an email by accident of
-   * the portal verifier collapsing the subject to
-   * `email ?? preferred_username ?? sub`, and it is slated to be re-based onto an
-   * opaque directory id — so display travels separately. Absent for rows created
-   * before the columns existed; fall back to `ownerId`.
+   * these, never compare them. `ownerId` is the Entra `oid` (ADR-0048) — an
+   * opaque directory object id since the re-base, opaque-by-accident (an
+   * email) on rows created before it — so display travels separately. Absent
+   * for rows created before the columns existed; fall back to `ownerId` (the
+   * pre-re-base rows where it is still an email are the one case where the
+   * fallback renders something readable).
    */
   ownerName: z3.string().optional(),
   ownerEmail: z3.string().optional()
@@ -165,6 +180,16 @@ var DeployReportSchema = z4.object({
   /** Candidate roots the planner considered. */
   candidates: z4.array(z4.string().max(1024)).max(20).default([])
 });
+var VersionSourceSchema = z4.object({
+  provider: z4.literal("github"),
+  repoFullName: z4.string(),
+  repositoryId: z4.string(),
+  ref: z4.string(),
+  commitSha: z4.string(),
+  workflowRef: z4.string(),
+  runId: z4.string(),
+  runAttempt: z4.int().positive()
+});
 var VersionSchema = z4.object({
   id: z4.uuid(),
   appId: z4.uuid(),
@@ -175,20 +200,385 @@ var VersionSchema = z4.object({
   status: VersionStatusSchema,
   createdAt: z4.iso.datetime(),
   /** Client-asserted salvage provenance (ADR-0038); absent on CLI uploads. */
-  deployReport: DeployReportSchema.optional()
+  deployReport: DeployReportSchema.optional(),
+  /** Verified CI provenance (ADR-0051); absent on non-CI uploads. */
+  source: VersionSourceSchema.optional()
 });
 
 // ../shared/src/manifest.ts
+import { z as z8 } from "zod";
+
+// ../shared/src/providers.ts
+import { z as z7 } from "zod";
+
+// ../shared/src/env.ts
 import { z as z5 } from "zod";
-var LlmCapabilitySchema = z5.object({
-  models: z5.array(z5.string()).default([]),
+var ENVS = ["prod", "dev"];
+var EnvSchema = z5.enum(ENVS);
+
+// ../shared/src/secrets.ts
+import { z as z6 } from "zod";
+var FORBIDDEN_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "host",
+  "content-length",
+  "transfer-encoding",
+  "connection",
+  "te",
+  "upgrade",
+  "expect",
+  "trailer"
+]);
+var HEADER_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var HEADER_VALUE_SAFE = /^[\t\x20-\x7e]*$/;
+var HEADER_VALUE_WIRE = /^[\t\x20-\x7e\x80-\xff]*$/;
+var headerName = (from) => {
+  const base = z6.string().min(1);
+  return (from === "request" ? base.max(64).regex(HEADER_TOKEN, "must be an RFC 7230 token") : base).transform((n) => n.trim().toLowerCase()).refine((n) => !FORBIDDEN_HEADER_NAMES.has(n), "reserved header name").refine((n) => !n.startsWith("x-helix-"), "reserved header prefix");
+};
+var headerTemplate = (from) => from === "request" ? z6.string().max(512).regex(HEADER_VALUE_SAFE) : z6.string().regex(HEADER_VALUE_WIRE);
+var injectionRecipe = (from) => z6.discriminatedUnion("kind", [
+  /** `Authorization: Bearer <secret>` — the common case. */
+  z6.object({ kind: z6.literal("header-bearer") }),
+  /** Arbitrary header; `{}` in `template` is replaced with the secret. */
+  z6.object({
+    kind: z6.literal("header"),
+    name: headerName(from),
+    template: headerTemplate(from).default("{}")
+  }),
+  /** Query parameter `?<param>=<secret>`. */
+  z6.object({ kind: z6.literal("query"), param: z6.string().min(1) }),
+  /**
+   * HMAC over a timestamp. The signed input is the timestamp string **alone** —
+   * not the method, path, query, or body — so injection is a pure function of
+   * (private key, now) and needs no request context.
+   *
+   * The canonical form lives in the KIND NAME, deliberately. A scheme that signs
+   * method+path+body is a *sibling kind* (`hmac-request`) — a code change with
+   * tests, reviewed — never an admin-editable canonical-string template.
+   * Canonicalization is where implementations of this family go wrong, and it
+   * does not belong in a text box.
+   *
+   * SHA-256, lowercase-hex, and ISO-8601-with-milliseconds are fixed rather than
+   * configurable. Each would carry a default, and `app_secrets.injection` is a
+   * schemaless JSON column, so adding a knob later is purely additive with no
+   * migration — while fixing them now removes the weak-algorithm and
+   * unencodable-digest failure classes outright.
+   *
+   * The stored value is a JSON blob carrying both halves of the key pair
+   * ({@link HmacCredentialSchema}): regenerating the pair changes both, and a
+   * blob rotates atomically through the existing rotate route.
+   */
+  z6.object({
+    kind: z6.literal("hmac-timestamp"),
+    /** Header carrying the timestamp that is also the entire signed input. */
+    timestampHeader: headerName(from),
+    /** Header carrying the rendered credential + signature. */
+    authHeader: headerName(from).default("authorization"),
+    /**
+     * Value written to `authHeader`. `{credential}` and `{signature}` are
+     * substituted. Named rather than the `header` kind's bare `{}` because there
+     * are two substitutions: the convention is one value ⇒ `{}`, more than one ⇒
+     * named placeholders. Positional `{}` here would let a swapped template
+     * produce a well-formed header that silently fails to authenticate.
+     *
+     * Both placeholders are required. This recipe writes exactly two headers,
+     * one of them the timestamp, so there is no configuration where the public
+     * credential id travels elsewhere — omitting `{credential}` means the
+     * upstream can never identify the key and every call 401s.
+     */
+    template: headerTemplate(from).refine((t) => t.includes("{signature}"), "template must contain {signature}").refine((t) => t.includes("{credential}"), "template must contain {credential}")
+  }).refine(
+    (r) => r.timestampHeader !== r.authHeader,
+    "timestampHeader and authHeader must differ \u2014 the second write overwrites the first"
+  )
+]);
+var InjectionRecipeSchema = injectionRecipe("request");
+var StoredInjectionRecipeSchema = injectionRecipe("stored");
+var HeaderNameSchema = headerName("request");
+var HmacCredentialSchema = z6.object({
+  credential: z6.string().min(1),
+  key: z6.string().min(1)
+});
+var SECRET_SCOPES = ["app", "global", "platform"];
+var SecretScopeSchema = z6.enum(SECRET_SCOPES);
+var SecretMetadataSchema = z6.object({
+  id: z6.string(),
+  name: z6.string().min(1),
+  scope: SecretScopeSchema,
+  /** Partition tier (dev-mode §6): a dev fetch injects only `dev` connection secrets. */
+  env: EnvSchema,
+  /**
+   * The **stored** parser, not the strict one — this field describes a row, and
+   * the SPA re-parses this schema on every response. Using the strict parser here
+   * would let the portal return a name the browser then refuses, moving the read
+   * failure from the server to the client, where it presents as a dead page.
+   *
+   * `null` = the stored recipe is unreadable (it names a reserved header, or is
+   * not a recipe at all). The credential still exists and is still deletable; it
+   * cannot be rotated, and egress fails its hop closed. Recipes are immutable by
+   * design, so recovery is delete-and-recreate.
+   */
+  injection: StoredInjectionRecipeSchema.nullable(),
+  createdBy: z6.string(),
+  createdAt: z6.string(),
+  rotatedAt: z6.string().nullable().optional(),
+  lastUsedAt: z6.string().nullable().optional(),
+  boundApps: z6.array(z6.string()).default([])
+});
+var SecretCreateRequestSchema = z6.object({
+  name: z6.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits, and hyphens"),
+  value: z6.string().min(1),
+  /** Target tier (dev-mode §6). Defaults `prod`; `dev` configures a dev-tier credential. */
+  env: EnvSchema.default("prod"),
+  injection: InjectionRecipeSchema.default({ kind: "header-bearer" })
+});
+var SecretRotateRequestSchema = z6.object({ value: z6.string().min(1) });
+var SecretGrantRequestSchema = z6.object({ appSlug: z6.string().min(1) });
+
+// ../shared/src/providers.ts
+var PROVIDER_KINDS = ["rest-delegated"];
+var ProviderKindSchema = z7.enum(PROVIDER_KINDS);
+var PROVIDER_REF_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
+var PROVIDER_REF_MAX = 64;
+var ProviderRefSchema = z7.string().min(1).max(PROVIDER_REF_MAX).regex(PROVIDER_REF_PATTERN, "lowercase letters, digits, and hyphens");
+var TokenPlacementSchema = z7.discriminatedUnion("kind", [
+  /** `Authorization: Bearer <access token>` — the default placement. */
+  z7.strictObject({ kind: z7.literal("header-bearer") }),
+  /** The access token verbatim in the named header (no template machinery). */
+  z7.strictObject({ kind: z7.literal("header"), name: HeaderNameSchema })
+]);
+var ScopeTokenSchema = z7.string().min(1).max(256).regex(/^[\x21\x23-\x5b\x5d-\x7e]+$/, "must be an RFC 6749 scope token");
+var API_ORIGIN_RULE = "an API destination is an origin \u2014 scheme://host[:port], no path, query, credentials, or fragment";
+var BARE_ORIGIN = /^https?:\/\/[^/?#@\\]*(?:\/)?$/i;
+var ApiOriginSchema = z7.url({ protocol: /^https?$/ }).superRefine((value, ctx) => {
+  if (!BARE_ORIGIN.test(value)) {
+    ctx.addIssue({ code: "custom", message: API_ORIGIN_RULE });
+    return;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    ctx.addIssue({ code: "custom", message: API_ORIGIN_RULE });
+    return;
+  }
+  if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    ctx.addIssue({ code: "custom", message: API_ORIGIN_RULE });
+  }
+}).transform((value) => new URL(value).origin);
+var URL_PARSER_CONTROLS = /[\t\n\r]/g;
+var ENDPOINT_USERINFO = /^https?:\/\/[/\\]*[^/?#\\]*@/i;
+var OAuthEndpointSchema = z7.url({ protocol: /^https?$/ }).refine(
+  (value) => !ENDPOINT_USERINFO.test(value.replace(URL_PARSER_CONTROLS, "")),
+  "a vendor endpoint URL must not carry userinfo \u2014 client auth is never configured in the URL"
+);
+var MAX_API_ORIGINS = 16;
+var MAX_REQUESTED_SCOPES = 32;
+var noDuplicates = (values) => new Set(values).size === values.length;
+var ApiOriginsSchema = z7.array(ApiOriginSchema).min(1, "a provider needs at least one API destination \u2014 nothing can bind to it otherwise").max(MAX_API_ORIGINS).refine(noDuplicates, "duplicate API destination");
+var RequestedScopesSchema = z7.array(ScopeTokenSchema).max(MAX_REQUESTED_SCOPES).refine(noDuplicates, "duplicate requested scope");
+var ProviderDisplayNameSchema = z7.string().min(1).max(200);
+var ProviderEditableFieldsSchema = z7.strictObject({
+  displayName: ProviderDisplayNameSchema,
+  authorizeEndpoint: OAuthEndpointSchema,
+  tokenEndpoint: OAuthEndpointSchema,
+  requestedScopes: RequestedScopesSchema.default([]),
+  apiOrigins: ApiOriginsSchema,
+  tokenPlacement: TokenPlacementSchema.default({ kind: "header-bearer" })
+});
+var ProviderConfigSchema = ProviderEditableFieldsSchema.extend({
+  ref: ProviderRefSchema,
+  kind: ProviderKindSchema.default("rest-delegated")
+});
+var ProviderCreateRequestSchema = ProviderConfigSchema.extend({
+  env: EnvSchema,
+  clientId: z7.string().min(1),
+  clientSecret: z7.string().min(1)
+});
+var undefinedKeysMeanAbsence = (body) => {
+  if (typeof body !== "object" || body === null) return body;
+  const withoutUndefined = { ...body };
+  for (const key of Object.keys(withoutUndefined)) {
+    if (withoutUndefined[key] === void 0) delete withoutUndefined[key];
+  }
+  return withoutUndefined;
+};
+var OWN_PROTO_KEY_RULE = "an own __proto__ key is not a provider field \u2014 the body is refused whole";
+var ProviderUpdateRequestSchema = z7.preprocess(
+  (body, ctx) => {
+    const normalized = undefinedKeysMeanAbsence(body);
+    if (typeof normalized === "object" && normalized !== null && Object.hasOwn(normalized, "__proto__")) {
+      ctx.addIssue({ code: "custom", message: OWN_PROTO_KEY_RULE });
+    }
+    return normalized;
+  },
+  ProviderEditableFieldsSchema.extend({
+    requestedScopes: RequestedScopesSchema,
+    tokenPlacement: TokenPlacementSchema,
+    revision: z7.int().positive(),
+    clientId: z7.string().min(1).optional(),
+    clientSecret: z7.string().min(1).optional(),
+    /**
+     * The invalidation acknowledgement ({@link CONFIRM_INVALIDATION_FIELD}):
+     * the client sets it to `true` when submitting a sensitive delta through
+     * the review panel. Absent or
+     * `false` against a sensitive delta is the 409
+     * `confirmation_required` rejection — nothing is applied; against a
+     * non-sensitive edit it is irrelevant and ignored. Not stored: it is
+     * consent for the mutation, never provider state.
+     */
+    confirmInvalidation: z7.boolean().optional()
+  })
+);
+var ConnectionProviderSchema = ProviderEditableFieldsSchema.extend({
+  requestedScopes: RequestedScopesSchema,
+  tokenPlacement: TokenPlacementSchema,
+  id: z7.uuid(),
+  revision: z7.int().positive(),
+  ref: ProviderRefSchema,
+  kind: ProviderKindSchema,
+  env: EnvSchema,
+  clientIdMaterial: z7.string().min(1),
+  clientSecretMaterial: z7.string().min(1),
+  createdAt: z7.iso.datetime(),
+  updatedAt: z7.iso.datetime()
+});
+var ProviderMetadataSchema = ConnectionProviderSchema.omit({
+  clientIdMaterial: true,
+  clientSecretMaterial: true
+});
+var ProviderListResponseSchema = z7.strictObject({
+  callbackUrl: z7.url(),
+  providers: z7.array(ProviderMetadataSchema)
+});
+var ProviderExportDocumentSchema = z7.strictObject({
+  version: z7.literal(1),
+  provider: ProviderConfigSchema
+});
+var CatalogueProviderSchema = z7.strictObject({
+  ref: ProviderRefSchema,
+  kind: ProviderKindSchema,
+  displayName: z7.string().min(1).max(200),
+  apiOrigins: ApiOriginsSchema,
+  env: EnvSchema
+});
+var SENSITIVE_PROVIDER_FIELDS = [
+  "clientId",
+  "authorizeEndpoint",
+  "tokenEndpoint",
+  "requestedScopes",
+  "apiOrigins",
+  "tokenPlacement"
+];
+var CONFIRM_INVALIDATION_FIELD = "confirmInvalidation";
+var SensitiveProviderFieldSchema = z7.enum(SENSITIVE_PROVIDER_FIELDS);
+var PROVIDER_DIFF_FIELDS = [
+  "displayName",
+  "authorizeEndpoint",
+  "tokenEndpoint",
+  "requestedScopes",
+  "apiOrigins",
+  "tokenPlacement"
+];
+var ProviderDiffFieldSchema = z7.enum(PROVIDER_DIFF_FIELDS);
+var ProviderImportPreviewRequestSchema = z7.strictObject({
+  document: ProviderExportDocumentSchema,
+  mode: z7.enum(["create", "update"]).optional(),
+  env: EnvSchema.optional(),
+  targetId: z7.uuid().optional()
+});
+var ProviderImportCollisionSchema = z7.strictObject({
+  providerId: z7.uuid(),
+  ref: ProviderRefSchema,
+  env: EnvSchema
+});
+var ProviderImportPreviewTargetSchema = z7.strictObject({
+  providerId: z7.uuid(),
+  ref: ProviderRefSchema,
+  env: EnvSchema,
+  displayName: z7.string().min(1).max(200),
+  revision: z7.int().positive()
+});
+var ProviderImportPreviewDiffEntrySchema = z7.strictObject({
+  field: ProviderDiffFieldSchema,
+  current: z7.union([z7.string(), z7.array(z7.string()), TokenPlacementSchema]),
+  imported: z7.union([z7.string(), z7.array(z7.string()), TokenPlacementSchema])
+});
+var ProviderImportPreviewResponseSchema = z7.discriminatedUnion("mode", [
+  z7.strictObject({ mode: z7.literal(null), provider: ProviderConfigSchema }),
+  z7.strictObject({
+    mode: z7.literal("create"),
+    env: EnvSchema,
+    provider: ProviderConfigSchema,
+    collision: ProviderImportCollisionSchema.nullable()
+  }),
+  z7.strictObject({
+    mode: z7.literal("update"),
+    target: ProviderImportPreviewTargetSchema,
+    diff: z7.array(ProviderImportPreviewDiffEntrySchema),
+    sensitiveFields: z7.array(SensitiveProviderFieldSchema)
+  })
+]);
+var ProviderImportCreateRequestSchema = z7.strictObject({
+  mode: z7.literal("create"),
+  document: ProviderExportDocumentSchema,
+  env: EnvSchema,
+  clientId: z7.string().min(1),
+  clientSecret: z7.string().min(1)
+});
+var ProviderImportUpdateRequestSchema = z7.strictObject({
+  mode: z7.literal("update"),
+  document: ProviderExportDocumentSchema,
+  targetId: z7.uuid(),
+  revision: z7.int().positive(),
+  clientId: z7.string().min(1).optional(),
+  clientSecret: z7.string().min(1).optional(),
+  [CONFIRM_INVALIDATION_FIELD]: z7.boolean().optional()
+});
+var ProviderImportRequestSchema = z7.discriminatedUnion("mode", [
+  ProviderImportCreateRequestSchema,
+  ProviderImportUpdateRequestSchema
+]);
+var ProviderImportResponseSchema = z7.strictObject({
+  outcome: z7.enum(["created", "updated"]),
+  provider: ProviderMetadataSchema
+});
+var BoundAppSchema = z7.strictObject({
+  id: z7.uuid(),
+  slug: z7.string().max(63).regex(SLUG_PATTERN, "must be a lowercase DNS label (a-z, 0-9, hyphen)"),
+  displayName: z7.string().min(1).max(200)
+});
+var ProviderImpactSchema = z7.strictObject({
+  providerId: z7.uuid(),
+  ref: ProviderRefSchema,
+  env: EnvSchema,
+  displayName: z7.string().min(1).max(200),
+  revision: z7.int().positive(),
+  boundApps: z7.array(BoundAppSchema),
+  connections: z7.number().int().nonnegative(),
+  pendingAttempts: z7.number().int().nonnegative()
+});
+var ConfirmationRequiredDetailsSchema = z7.strictObject({
+  impact: ProviderImpactSchema,
+  sensitiveFields: z7.array(SensitiveProviderFieldSchema).optional()
+});
+var ProviderDeleteRequestSchema = z7.strictObject({
+  [CONFIRM_INVALIDATION_FIELD]: z7.boolean().optional()
+});
+var ProviderDeleteResponseSchema = z7.strictObject({
+  outcome: z7.enum(["deleted", "already_removed"])
+});
+
+// ../shared/src/manifest.ts
+var LlmCapabilitySchema = z8.object({
+  models: z8.array(z8.string()).default([]),
   /**
    * Per-app daily LLM spend cap in USD; unset ⇒ unbounded. Denominated in
    * dollars (not tokens) so the cap means the same thing across models — the
    * edge prices each call via `@azx-pbc/shared` pricing and enforces a daily +
    * rolling-hour burst window off the frozen `costMicroUsd` ledger column.
    */
-  dollarsPerDay: z5.number().positive().optional()
+  dollarsPerDay: z8.number().positive().optional()
 });
 var KEY_MAX_CHARS = 256;
 var PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
@@ -199,18 +589,18 @@ function isValidDataKey(key) {
   key === key.trim();
 }
 var DATA_KEY_RULE = "must be 1\u2013256 printable ASCII characters (0x20\u20130x7E) with no leading or trailing space";
-var DataKeySchema = z5.string().refine(isValidDataKey, { message: DATA_KEY_RULE });
-var DataCapabilitySchema = z5.object({
-  user: z5.boolean().default(false),
-  collections: z5.array(DataKeySchema).default([]),
-  sharedRead: z5.array(DataKeySchema).default([]),
-  sharedWrite: z5.array(DataKeySchema).default([]),
+var DataKeySchema = z8.string().refine(isValidDataKey, { message: DATA_KEY_RULE });
+var DataCapabilitySchema = z8.object({
+  user: z8.boolean().default(false),
+  collections: z8.array(DataKeySchema).default([]),
+  sharedRead: z8.array(DataKeySchema).default([]),
+  sharedWrite: z8.array(DataKeySchema).default([]),
   /** ADR-0042: authorize every key starting with one of these prefixes (read). */
-  sharedReadPrefixes: z5.array(DataKeySchema).default([]),
+  sharedReadPrefixes: z8.array(DataKeySchema).default([]),
   /** ADR-0042: authorize every key starting with one of these prefixes (write). */
-  sharedWritePrefixes: z5.array(DataKeySchema).default([]),
-  writesPerDay: z5.int().positive().optional(),
-  bytesPerDay: z5.int().positive().optional()
+  sharedWritePrefixes: z8.array(DataKeySchema).default([]),
+  writesPerDay: z8.int().positive().optional(),
+  bytesPerDay: z8.int().positive().optional()
 }).superRefine((d, ctx) => {
   if (d.sharedWritePrefixes.length > 0 && d.writesPerDay === void 0) {
     ctx.addIssue({
@@ -220,17 +610,37 @@ var DataCapabilitySchema = z5.object({
     });
   }
 });
-var FetchConnectionSchema = z5.object({
-  origin: z5.url(),
-  connection: z5.string().min(1).optional()
+var FetchConnectionSchema = z8.strictObject({
+  origin: z8.url(),
+  connection: z8.string().min(1).optional(),
+  provider: ProviderRefSchema.optional(),
+  required: z8.boolean().optional()
+}).superRefine((c, ctx) => {
+  if (c.connection !== void 0 && c.provider !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["provider"],
+      message: "an origin binds at most one credential source \u2014 declare a stored secret (connection) or an OAuth provider (provider), not both"
+    });
+  }
 });
-var FetchCapabilitySchema = z5.object({
-  /** Opt-in transparent `fetch` shim injected at serve time (fetch-proxy §3.2). */
-  shim: z5.boolean().default(false),
+var FetchCapabilitySchema = z8.object({
+  /**
+   * Legacy view of the fetch-shim grant. The grant is declared first-class as
+   * {@link ShimCapabilitySchema} (`capabilities.shim.fetch`); this boolean is
+   * the pre-`capabilities.shim` spelling, still accepted on input and kept synchronized
+   * with the canonical block on every parse (see {@link CapabilitiesSchema}) —
+   * new manifests should declare `capabilities.shim`, not this field.
+   */
+  shim: z8.boolean().default(false),
   /** Origins reached through the proxy (mode `proxy`); direct stays in `externalOrigins`. */
-  origins: z5.array(FetchConnectionSchema).default([]),
+  origins: z8.array(FetchConnectionSchema).default([]),
   /** Per-app daily proxied-request budget; unset ⇒ unbounded (fetch-proxy §7). */
-  requestsPerDay: z5.int().positive().optional()
+  requestsPerDay: z8.int().positive().optional()
+});
+var ShimCapabilitySchema = z8.object({
+  fetch: z8.boolean().default(false),
+  connect: z8.boolean().default(false)
 });
 var SCOPE_SEGMENT = /^[A-Za-z0-9\-._~]+$/;
 function isValidServiceWorkerScope(scope) {
@@ -243,36 +653,67 @@ function isValidServiceWorkerScope(scope) {
   }
   return !first.startsWith("_");
 }
-var OfflineCapabilitySchema = z5.object({
+var OfflineCapabilitySchema = z8.object({
   /**
    * URL path prefix the worker controls, e.g. `/app/`. Leading and trailing
    * slash required; never root, never a `_`-prefixed platform namespace.
    */
-  scope: z5.string().refine(isValidServiceWorkerScope, {
+  scope: z8.string().refine(isValidServiceWorkerScope, {
     message: "scope must be a non-root path prefix with a leading and trailing slash, and must not start with a reserved `_` segment (e.g. `/app/`)"
   })
 });
-var CapabilitiesSchema = z5.object({
+var CapabilitiesSchema = z8.object({
   llm: LlmCapabilitySchema.optional(),
   data: DataCapabilitySchema.optional(),
   /** Platform-registered MCP servers this app may reach (§6.1, exposed as REST). */
-  mcp: z5.array(z5.string()).default([]),
+  mcp: z8.array(z8.string()).default([]),
   /** Extra CSP `connect-src` origins for **direct** browser calls (§4.4). */
-  externalOrigins: z5.array(z5.url()).default([]),
+  externalOrigins: z8.array(z8.url()).default([]),
   /** Governed outbound HTTP via the fetch-proxy / egress plane (in build, M4.5). */
   fetch: FetchCapabilitySchema.optional(),
   /** Platform-owned, scope-confined service worker for offline cold boot (ADR-0035). */
-  offline: OfflineCapabilitySchema.optional()
+  offline: OfflineCapabilitySchema.optional(),
+  /** Injected platform helpers — the first-class shim grant. */
+  shim: ShimCapabilitySchema.optional()
+}).transform((caps) => {
+  const legacyShim = caps.fetch?.shim ?? false;
+  const fetchOn = legacyShim || (caps.shim?.fetch ?? false);
+  const connectOn = caps.shim?.connect ?? false;
+  const fetch2 = caps.fetch ?? (fetchOn ? { shim: fetchOn, origins: [] } : void 0);
+  return {
+    ...caps,
+    fetch: fetch2 === void 0 ? void 0 : { ...fetch2, shim: fetchOn },
+    ...fetchOn || connectOn ? { shim: { fetch: fetchOn, connect: connectOn } } : {}
+  };
+});
+var ProviderBindingStatusSchema = z8.strictObject({
+  /** The manifest origin as declared (matches `FetchConnection.origin`). */
+  origin: z8.string(),
+  /** The bound provider reference. */
+  ref: ProviderRefSchema,
+  /**
+   * Whether an approval that granted this binding still matches the provider
+   * row's current identity — the {@link isProviderBindingEffective} rule
+   * (the one definition; the portal never re-derives the comparison). `false`
+   * means the provider was deleted or a sensitive edit stale-dated the stamp.
+   */
+  effective: z8.boolean()
 });
-var AppManifestSchema = z5.object({
+var AppManifestSchema = z8.object({
   /** App slug; matches `App.slug`. */
-  app: z5.string().min(1),
+  app: z8.string().min(1),
   visibility: VisibilitySchema,
-  capabilities: CapabilitiesSchema.default({ mcp: [], externalOrigins: [] })
+  capabilities: CapabilitiesSchema.default({ mcp: [], externalOrigins: [] }),
+  /**
+   * Effectiveness of every provider-bound origin in `capabilities`, computed
+   * server-side on the read (never stored). Absent when the manifest declares
+   * no provider binding — every payload without one keeps its exact shape.
+   */
+  providerBindings: z8.array(ProviderBindingStatusSchema).optional()
 });
 
 // ../shared/src/approval.ts
-import { z as z6 } from "zod";
+import { z as z9 } from "zod";
 
 // ../shared/src/pricing.ts
 var MODEL_PRICING = {
@@ -320,6 +761,9 @@ var MODEL_PRICING = {
   "claude-opus-4-7": { inputPerMTok: 5, outputPerMTok: 25, provider: "anthropic" },
   "claude-opus-4-6": { inputPerMTok: 5, outputPerMTok: 25, provider: "anthropic" },
   "claude-sonnet-4-6": { inputPerMTok: 3, outputPerMTok: 15, provider: "anthropic" },
+  // Near-term churn: haiku-4-5's only two Foundry versions both stop serving
+  // 2026-10-19 (measured eastus2 2026-09-16). Not a cut — first-party serving
+  // is unaffected — but expect the Foundry deployments to need a successor.
   "claude-haiku-4-5": {
     inputPerMTok: 1,
     outputPerMTok: 5,
@@ -393,13 +837,14 @@ var MODEL_PRICING = {
   },
   // Previous generations, kept curated so a deployed app's manifest keeps working.
   // Rates re-verified 2026-09-14 and unchanged.
+  //
+  // `gpt-4o-mini`, `o3` and `o4-mini` were deliberately cut (2026-09-16) rather
+  // than retained on that principle: Azure AI Foundry's RP refuses any model
+  // whose *default* version is `Deprecating` (`ServiceModelDeprecating`), so
+  // they could never ride the one-flag Foundry path, and the current generation
+  // covers their price points first-party. A manifest still naming one gets the
+  // edge's `model_not_allowed` (no price configured) — the cut is the break.
   "gpt-4o": { inputPerMTok: 2.5, outputPerMTok: 10, provider: "openai", structuredOutputs: true },
-  "gpt-4o-mini": {
-    inputPerMTok: 0.15,
-    outputPerMTok: 0.6,
-    provider: "openai",
-    structuredOutputs: true
-  },
   "gpt-4.1": { inputPerMTok: 2, outputPerMTok: 8, provider: "openai", structuredOutputs: true },
   "gpt-4.1-mini": {
     inputPerMTok: 0.4,
@@ -412,28 +857,12 @@ var MODEL_PRICING = {
     outputPerMTok: 0.4,
     provider: "openai",
     structuredOutputs: true
-  },
-  o3: {
-    inputPerMTok: 2,
-    outputPerMTok: 8,
-    provider: "openai",
-    reasoning: true,
-    minCompletionTokens: 25e3,
-    structuredOutputs: true
-  },
-  "o4-mini": {
-    inputPerMTok: 1.1,
-    outputPerMTok: 4.4,
-    provider: "openai",
-    reasoning: true,
-    minCompletionTokens: 25e3,
-    structuredOutputs: true
   }
 };
 
 // ../shared/src/approval.ts
 var RISK_LEVELS = ["low", "med", "high"];
-var RiskSchema = z6.enum(RISK_LEVELS);
+var RiskSchema = z9.enum(RISK_LEVELS);
 var APPROVAL_STATUSES = [
   "pending",
   "approved",
@@ -441,151 +870,195 @@ var APPROVAL_STATUSES = [
   "withdrawn",
   "needs_changes"
 ];
-var ApprovalStatusSchema = z6.enum(APPROVAL_STATUSES);
-var DeltaSchema = z6.object({
-  path: z6.string(),
-  from: z6.union([z6.string(), z6.number(), z6.boolean()]).optional(),
-  to: z6.union([z6.string(), z6.number(), z6.boolean()]).optional()
+var ApprovalStatusSchema = z9.enum(APPROVAL_STATUSES);
+var ProviderStampSchema = z9.strictObject({
+  /** The env-unique reference the manifest binds (the catalogue/manifest key). */
+  ref: ProviderRefSchema,
+  /** Which partition the stamped row lives in — a ref may exist in both. */
+  env: EnvSchema,
+  /** The surrogate row id — delete+recreate mints a new one, dangling old stamps. */
+  providerId: z9.uuid(),
+  /** The row's revision at filing; a sensitive edit advances it. */
+  revision: z9.int().positive()
+});
+var DeltaSchema = z9.object({
+  path: z9.string(),
+  from: z9.union([z9.string(), z9.number(), z9.boolean()]).optional(),
+  to: z9.union([z9.string(), z9.number(), z9.boolean()]).optional(),
+  /**
+   * The provider stamps recorded **at filing** for a provider-bound origin
+   * delta — one per env-partitioned `connection_providers` row that
+   * existed under the bound ref when the request was filed (an
+   * approval records the provider's `ref` + `providerId` + `revision`, and
+   * env partitioning makes a ref's full identity the set of its rows).
+   *
+   * This is the payload half of the apply-time conflict: approving a request
+   * whose stamps no longer match the provider's current identity/revision
+   * approves nothing — an old pending approval cannot approve access to a
+   * newer configuration. Consumers read the rule itself from
+   * {@link isProviderBindingEffective}; none re-derives the comparison.
+   */
+  providerStamps: z9.array(ProviderStampSchema).optional(),
+  /**
+   * The requesting app's visibility **at filing**: `true` when the app was
+   * `public`, `false` (stamped as not-public) otherwise. The
+   * warning — a public app's anonymous visitors can never connect a vendor
+   * account — is data on the request, so the queue card needs no extra fetch.
+   * The flag never auto-rejects.
+   */
+  publicApp: z9.boolean().optional(),
+  /**
+   * This delta's own severity as classified at filing — what the request-level
+   * `risk` is the max of. Absent on requests filed before the field existed
+   * (deltas are stored as JSON, so nothing backfills them); renderers fall
+   * back to the aggregate rather than guessing.
+   */
+  risk: RiskSchema.optional()
 });
-var PriorDecisionsSchema = z6.object({
+var PriorDecisionsSchema = z9.object({
   /** Prior *decided* (non-pending) requests on this app — the history count. */
-  total: z6.number().int().nonnegative(),
+  total: z9.number().int().nonnegative(),
   /** Prior denied requests touching an overlapping policy area (quiet signal). */
-  deniedSameArea: z6.number().int().nonnegative(),
+  deniedSameArea: z9.number().int().nonnegative(),
   /** Prior denied requests sharing an exact delta path (loud signal; ⊆ area). */
-  deniedSameGrant: z6.number().int().nonnegative(),
+  deniedSameGrant: z9.number().int().nonnegative(),
   /** The most recent decided request (any status), for the "last decision" line. */
-  last: z6.object({
+  last: z9.object({
     status: ApprovalStatusSchema,
-    note: z6.string().nullable(),
-    decidedBy: z6.string().nullable(),
-    decidedAt: z6.string()
+    note: z9.string().nullable(),
+    decidedBy: z9.string().nullable(),
+    decidedAt: z9.string()
   }).optional()
 });
-var ApprovalRequestSchema = z6.object({
-  id: z6.string(),
-  appId: z6.string(),
+var ApprovalRequestSchema = z9.object({
+  id: z9.string(),
+  appId: z9.string(),
   /** Joined for the admin queue / banner; not a column. */
-  appSlug: z6.string().optional(),
-  appDisplayName: z6.string().optional(),
+  appSlug: z9.string().optional(),
+  appDisplayName: z9.string().optional(),
   status: ApprovalStatusSchema,
   risk: RiskSchema,
-  deltas: z6.array(DeltaSchema),
-  baseSnapshot: z6.unknown(),
-  requestedBy: z6.string(),
-  reason: z6.string().nullable().optional(),
-  decidedBy: z6.string().nullable().optional(),
-  decisionNote: z6.string().nullable().optional(),
-  createdAt: z6.string(),
-  decidedAt: z6.string().nullable().optional(),
+  deltas: z9.array(DeltaSchema),
+  baseSnapshot: z9.unknown(),
+  requestedBy: z9.string(),
+  reason: z9.string().nullable().optional(),
+  decidedBy: z9.string().nullable().optional(),
+  decisionNote: z9.string().nullable().optional(),
+  createdAt: z9.string(),
+  decidedAt: z9.string().nullable().optional(),
   /** Sibling-decision context for the admin queue (issue #26); read-side only. */
   priorDecisions: PriorDecisionsSchema.optional()
 });
-var ManifestUpdateResultSchema = z6.object({
+var ManifestUpdateResultSchema = z9.object({
   manifest: AppManifestSchema,
-  applied: z6.array(DeltaSchema),
-  pending: z6.string().nullable()
+  applied: z9.array(DeltaSchema),
+  pending: z9.string().nullable()
 });
-var VisibilityUpdateResultSchema = z6.object({
+var VisibilityUpdateResultSchema = z9.object({
   app: AppSchema,
-  applied: z6.array(DeltaSchema),
-  pending: z6.string().nullable()
+  applied: z9.array(DeltaSchema),
+  pending: z9.string().nullable()
 });
-var ApprovalDecisionRequestSchema = z6.object({
-  note: z6.string().max(2e3).optional()
+var ApprovalDecisionRequestSchema = z9.object({
+  note: z9.string().max(2e3).optional()
 });
 var CURATED_LLM_MODELS = Object.keys(MODEL_PRICING);
 
 // ../shared/src/health.ts
-import { z as z7 } from "zod";
-var HealthStateSchema = z7.enum(["ok", "degraded", "error"]);
-var HealthCheckSchema = z7.object({
+import { z as z10 } from "zod";
+var HealthStateSchema = z10.enum(["ok", "degraded", "error"]);
+var HealthCheckSchema = z10.object({
   /** Stable identifier an alert rule can key on, e.g. `registry-projection`. */
-  name: z7.string(),
+  name: z10.string(),
   status: HealthStateSchema,
   /** Operator-facing one-liner: what is wrong, and for how long. */
-  detail: z7.string().optional(),
+  detail: z10.string().optional(),
   /** Wall-clock instant this check last succeeded. Report-only — never the
    *  basis of a staleness decision (see the monotonic note in the edge's
    *  registry projection). */
-  lastSuccessAt: z7.iso.datetime().optional(),
+  lastSuccessAt: z10.iso.datetime().optional(),
   /** Numeric facts a dashboard or a log-based metric can key on. */
-  metrics: z7.record(z7.string(), z7.number()).optional()
+  metrics: z10.record(z10.string(), z10.number()).optional()
 });
-var HealthStatusSchema = z7.object({
+var HealthStatusSchema = z10.object({
   /** The roll-up: the worst state across `checks` (see `worstHealthState`). */
   status: HealthStateSchema,
-  service: z7.string(),
+  service: z10.string(),
   /** Process uptime in seconds. */
-  uptime: z7.number().nonnegative(),
+  uptime: z10.number().nonnegative(),
   /** Absent means the service reports liveness only (portal and egress today). */
-  checks: z7.array(HealthCheckSchema).optional()
+  checks: z10.array(HealthCheckSchema).optional()
 });
 
 // ../shared/src/api.ts
-import { z as z8 } from "zod";
-var CreateAppRequestSchema = z8.object({
+import { z as z11 } from "zod";
+var CreateAppRequestSchema = z11.object({
   slug: AppSchema.shape.slug,
   displayName: AppSchema.shape.displayName,
+  /** Optional one-line plain-text summary; rendered as a subtitle in the portal. */
+  description: AppSchema.shape.description,
   visibility: WritableVisibilitySchema.default({ mode: "internal" }),
   /** Optional per-app capability grant set at create time (architecture §6.3). */
   capabilities: CapabilitiesSchema.optional()
 });
-var SetManifestRequestSchema = z8.object({
+var UpdateAppRequestSchema = z11.object({
+  description: z11.string().max(APP_DESCRIPTION_MAX).nullable().optional()
+});
+var SetManifestRequestSchema = z11.object({
   capabilities: CapabilitiesSchema,
   /** Justification carried onto an approval request for any elevated deltas. */
-  reason: z8.string().max(2e3).optional()
+  reason: z11.string().max(2e3).optional()
 });
-var SetVisibilityRequestSchema = z8.object({
+var SetVisibilityRequestSchema = z11.object({
   visibility: WritableVisibilitySchema,
   /** Justification carried onto the approval request when going public. */
-  reason: z8.string().max(2e3).optional()
+  reason: z11.string().max(2e3).optional()
 });
 var MIN_PASSWORD_LENGTH = 12;
-var SetPasswordRequestSchema = z8.object({
-  password: z8.string().min(MIN_PASSWORD_LENGTH).optional()
+var SetPasswordRequestSchema = z11.object({
+  password: z11.string().min(MIN_PASSWORD_LENGTH).optional()
 });
-var PasswordCredentialResponseSchema = z8.object({
+var PasswordCredentialResponseSchema = z11.object({
   /** The shared passphrase, in cleartext, for the owner to copy/share. */
-  password: z8.string().min(1),
+  password: z11.string().min(1),
   /** The app's public URL, prebuilt so the UI can offer a one-click copy. */
-  url: z8.url(),
+  url: z11.url(),
   /** When the current password was set (ISO 8601). */
-  setAt: z8.string()
-});
-var CspWarningSchema = z8.object({
-  file: z8.string(),
-  origin: z8.string(),
-  hint: z8.string()
-});
-var OriginGrantRequestSchema = z8.object({
-  origin: z8.url(),
-  reason: z8.string().max(2e3).optional()
-});
-var CspViolationSchema = z8.object({
-  appId: z8.string(),
-  appSlug: z8.string().nullable(),
-  directive: z8.string(),
-  blockedUri: z8.string(),
-  count: z8.number().int(),
-  lastSeen: z8.string(),
+  setAt: z11.string()
+});
+var CspWarningSchema = z11.object({
+  file: z11.string(),
+  origin: z11.string(),
+  hint: z11.string()
+});
+var OriginGrantRequestSchema = z11.object({
+  origin: z11.url(),
+  reason: z11.string().max(2e3).optional()
+});
+var CspViolationSchema = z11.object({
+  appId: z11.string(),
+  appSlug: z11.string().nullable(),
+  directive: z11.string(),
+  blockedUri: z11.string(),
+  count: z11.number().int(),
+  lastSeen: z11.string(),
   /**
    * The blocked origin is already permitted by the app's *current* manifest, so
    * this historical report is no longer actionable. Derived at read time
    * (directive-aware — only `connect-src`/`img-src` are widened by an
    * `externalOrigins` grant); the row itself is never deleted.
    */
-  resolved: z8.boolean()
+  resolved: z11.boolean()
 });
-var CspViolationsPageSchema = z8.object({
-  violations: z8.array(CspViolationSchema)
+var CspViolationsPageSchema = z11.object({
+  violations: z11.array(CspViolationSchema)
 });
-var UploadVersionResponseSchema = z8.object({
+var UploadVersionResponseSchema = z11.object({
   version: VersionSchema,
-  warnings: z8.array(CspWarningSchema)
+  warnings: z11.array(CspWarningSchema)
 });
-var RollbackRequestSchema = z8.object({
-  toNumber: z8.int().positive().optional()
+var RollbackRequestSchema = z11.object({
+  toNumber: z11.int().positive().optional()
 });
 var API_ERROR_CODES = [
   "validation_failed",
@@ -596,6 +1069,14 @@ var API_ERROR_CODES = [
   /** Authenticated but not allowed — reserved for v1 RBAC. */
   "forbidden",
   "conflict",
+  /**
+   * Portal: a sensitive provider edit (or a deletion) arrived without its
+   * invalidation acknowledgement. HTTP 409 like `conflict`, but
+   * distinguishable: the SPA's
+   * review panel opens on this code, and `details` carries the impact payload
+   * (`ConfirmationRequiredDetailsSchema` in providers.ts) it renders.
+   */
+  "confirmation_required",
   /** Gateway: requested model is not in the app's manifest allowlist (§6.3). */
   "model_not_allowed",
   /** Gateway: the app's daily token budget is exhausted (§6.1). */
@@ -619,22 +1100,28 @@ var API_ERROR_CODES = [
   "capability_unavailable",
   "internal"
 ];
-var ApiErrorCodeSchema = z8.enum(API_ERROR_CODES);
-var ApiErrorSchema = z8.object({
-  error: z8.object({
+var ApiErrorCodeSchema = z11.enum(API_ERROR_CODES);
+var ApiErrorSchema = z11.object({
+  error: z11.object({
     code: ApiErrorCodeSchema,
-    message: z8.string(),
-    details: z8.unknown().optional()
+    message: z11.string(),
+    details: z11.unknown().optional()
   })
 });
 
 // ../shared/src/auth.ts
-import { z as z9 } from "zod";
-var MeResponseSchema = z9.object({
-  user: z9.object({
-    /** IdP subject (Entra object id) — stable, safe to key app data on. */
-    id: z9.string(),
-    displayName: z9.string(),
+import { z as z12 } from "zod";
+var MeResponseSchema = z12.object({
+  user: z12.object({
+    /**
+     * The principal id — Entra's `oid` claim (the directory object id), stable
+     * for the life of the user object and identical across every app
+     * registration in the tenant (ADR-0048): safe to key app data on, and the
+     * user scope partitions on exactly this value. Opaque by design — never
+     * render it; `displayName` and `email` are the half fit to display.
+     */
+    id: z12.string(),
+    displayName: z12.string(),
     /**
      * The captured address claim, or `null` when there isn't one — **nullable,
      * not optional, and the difference is the contract**. A missing key would
@@ -649,15 +1136,29 @@ var MeResponseSchema = z9.object({
      * to join on. Entra addresses are reassignable and B2B guests carry their
      * home-tenant address.
      */
-    email: z9.string().nullable()
+    email: z12.string().nullable()
   })
 });
-var PortalMeResponseSchema = z9.object({
-  sub: z9.string(),
+var PortalMeResponseSchema = z12.object({
+  /**
+   * The canonical principal id — Entra's `oid` claim from the access token
+   * (ADR-0048). This is what `App.ownerId` stores and what ownership compares;
+   * `sub` below is the display/audit half, never a join key.
+   *
+   * **Optional, not required**, for the same cross-version reason as the
+   * defaulted fields below: this schema parses `PortalClient.me()` in the
+   * *published* CLI, which routinely talks to portals older than itself, and
+   * portals are customer-deployed and version independently (ADR-0028). An
+   * older portal has no `oid` to echo — pre-ADR-0048 it has no such concept —
+   * and nothing in the CLI keys on it. A current portal always sends it (the
+   * dev-token actor gets a fixed synthetic value).
+   */
+  oid: z12.string().optional(),
+  sub: z12.string(),
   /** How the actor was established: `oidc` or `dev-token`. */
-  via: z9.string(),
-  name: z9.string().optional(),
-  email: z9.string().optional(),
+  via: z12.string(),
+  name: z12.string().optional(),
+  email: z12.string().optional(),
   /**
    * Whether the actor holds the `platform-admin` role. Computed server-side from
    * the actor's group/role claim — the raw ids never cross to the browser. Drives
@@ -669,7 +1170,7 @@ var PortalMeResponseSchema = z9.object({
    * polarity is the cautious one — a portal that never sent the field is not
    * telling us the caller is an admin.
    */
-  isAdmin: z9.boolean().default(false),
+  isAdmin: z12.boolean().default(false),
   /**
    * Whether this caller may run a tenant-wide group search (ADR-0040 decision
    * 11). Computed server-side from the deployment's `PORTAL_DIRECTORY_SEARCH`
@@ -695,7 +1196,7 @@ var PortalMeResponseSchema = z9.object({
    * describes the portal actually being talked to. Defaulting to `false` would
    * instead tell a client that search is unavailable where it works.
    */
-  canSearchDirectory: z9.boolean().default(true),
+  canSearchDirectory: z12.boolean().default(true),
   /**
    * Why search was refused, when it was — **present only when
    * {@link canSearchDirectory} is false**, and never `everyone`, which by
@@ -713,15 +1214,15 @@ var PortalMeResponseSchema = z9.object({
    * infer from the 403 they would get by asking. The admin group id still never
    * crosses.
    */
-  searchRestriction: z9.enum(["admins", "none"]).optional()
+  searchRestriction: z12.enum(["admins", "none"]).optional()
 });
-var AuthConfigResponseSchema = z9.object({
-  issuer: z9.url(),
-  cliClientId: z9.string().min(1),
+var AuthConfigResponseSchema = z12.object({
+  issuer: z12.url(),
+  cliClientId: z12.string().min(1),
   /** Public client the portal SPA uses for code+PKCE in the browser. */
-  webClientId: z9.string().min(1).optional(),
+  webClientId: z12.string().min(1).optional(),
   /** Expected token audience — part of what the CLI binds cached tokens to. */
-  audience: z9.string().min(1).optional(),
+  audience: z12.string().min(1).optional(),
   /**
    * Whether this deployment permits `public` (anonymous) apps. Drives the SPA's
    * visibility UI — it hides the public option when false. Absent = forbidden
@@ -729,9 +1230,9 @@ var AuthConfigResponseSchema = z9.object({
    * opt-in). Server-side enforcement is independent of this hint (portal routes
    * + edge serving).
    */
-  allowPublicApps: z9.boolean().optional(),
+  allowPublicApps: z12.boolean().optional(),
   /** Whether this deployment permits `password` (shared-passphrase) apps. Same shape as {@link allowPublicApps}. */
-  allowPasswordApps: z9.boolean().optional()
+  allowPasswordApps: z12.boolean().optional()
 });
 function portalApiScope(audience) {
   if (!audience || audience.startsWith("urn:")) return null;
@@ -740,27 +1241,27 @@ function portalApiScope(audience) {
 }
 
 // ../shared/src/deployment.ts
-import { z as z10 } from "zod";
-var DeploymentConfigResponseSchema = z10.object({
+import { z as z13 } from "zod";
+var DeploymentConfigResponseSchema = z13.object({
   /**
    * Scheme + host + (non-default) port where apps are served, as reachable by
    * this browser (architecture §4.1). The app slug is prepended as a subdomain:
    * `https://<slug>.<host>`.
    */
-  appPublicBase: z10.url(),
+  appPublicBase: z13.url(),
   /**
    * Base of the opt-in dev gateway (dev-mode design §3), absent when it is not
    * deployed. Unlike {@link appPublicBase} the slug goes in the *path*, not the
    * host. Absent ⇒ dev mode is unavailable here, so the UI says so instead of
    * printing an unreachable host.
    */
-  devApiBase: z10.url().optional(),
+  devApiBase: z13.url().optional(),
   /**
    * Month-to-date platform spend ceiling (USD) for the admin budget watch line.
    * Display-only — the gateway is the choke point, so the rollup is exact, but
    * nothing enforces this. Absent ⇒ no ceiling shown.
    */
-  platformMonthlyUsdCap: z10.number().positive().optional(),
+  platformMonthlyUsdCap: z13.number().positive().optional(),
   /**
    * Deploy bundle size caps in megabytes (`DEPLOY_MAX_FILE_MB` /
    * `DEPLOY_MAX_BUNDLE_MB` on the portal) — `deployMaxFileMb` is per file,
@@ -770,13 +1271,26 @@ var DeploymentConfigResponseSchema = z10.object({
    * substitute a default, because printing the wrong cap to an agent sends it
    * chasing a rejection it can't see the cause of.
    */
-  deployMaxFileMb: z10.number().positive().optional(),
-  deployMaxBundleMb: z10.number().positive().optional()
+  deployMaxFileMb: z13.number().positive().optional(),
+  deployMaxBundleMb: z13.number().positive().optional(),
+  /**
+   * Repo-backed deploys (ADR-0051). `audience` is the exact `aud` the CI route
+   * accepts, so `helix deploy` in GitHub Actions requests its token for this
+   * value rather than for whatever URL it was pointed at. `serverUrl` is the
+   * GitHub web origin for commit and run links. Optional only to tolerate a
+   * portal that predates the feature; when `enabled` is false the CI route and
+   * the binding routes answer 404 and clients hide the surface.
+   */
+  repoDeploy: z13.object({
+    enabled: z13.boolean(),
+    audience: z13.url(),
+    serverUrl: z13.url()
+  }).optional()
 });
 
 // ../shared/src/catalogue.ts
-import { z as z11 } from "zod";
-var CapabilityCatalogueSchema = z11.object({
+import { z as z14 } from "zod";
+var CapabilityCatalogueSchema = z14.object({
   /**
    * Visibility modes an app may declare here. `internal` is always present
    * (SSO, any directory principal — the baseline). `group` is present only when
@@ -785,24 +1299,28 @@ var CapabilityCatalogueSchema = z11.object({
    * present only when the operator policy permits them
    * (`PORTAL_ALLOW_*_APPS`). A mode absent from this list is not requestable.
    */
-  visibility: z11.object({
-    modes: z11.array(VisibilityModeSchema).min(1)
+  visibility: z14.object({
+    modes: z14.array(VisibilityModeSchema).min(1)
   }),
   /**
-   * LLM: the **servable** model ids, not merely the curated catalog. A model is
-   * servable when its upstream family is wired on this edge **and** the matching
-   * `platform` secret is seeded; a curated-but-unseeded model (e.g. a `gpt-*`
-   * model whose `openai` platform key was never added) is omitted, so an agent
-   * that reads this list never designs an app that 502s at call time. Every id
-   * in this list is also curated, so requesting one is baseline (auto-approve).
+   * LLM: the **servable** model ids, not merely the curated catalog. The set is
+   * the operator's declaration when one exists (`PORTAL_LLM_MODEL_ALLOWLIST`,
+   * minus `PORTAL_LLM_MODEL_BLOCKLIST` — ADR-0047; on a `deployFoundry` install
+   * the Bicep derives it from `foundryModels`, so it reads exactly what was
+   * deployed), and otherwise the ADR-0036 v1 heuristic: a model is servable
+   * when its upstream family has a seeded `platform` secret, so a
+   * curated-but-unseeded model (e.g. a `gpt-*` model whose `openai` platform
+   * key was never added) is omitted and an agent that reads this list never
+   * designs an app that 502s at call time. Every id in this list is also
+   * curated, so requesting one is baseline (auto-approve).
    *
    * `baselineDollarsPerDay` is the spend cap at/under which an LLM grant
    * auto-approves; above it queues. From `@azx-pbc/shared/approval.ts`, so the
    * catalogue and the classifier cannot drift.
    */
-  llm: z11.object({
-    models: z11.array(z11.string().min(1)),
-    baselineDollarsPerDay: z11.number().positive()
+  llm: z14.object({
+    models: z14.array(z14.string().min(1)),
+    baselineDollarsPerDay: z14.number().positive()
   }),
   /**
    * App-data: whether the three scopes are provisioned here, and the daily
@@ -811,10 +1329,10 @@ var CapabilityCatalogueSchema = z11.object({
    * a future deployment-level toggle, present before it is needed. The
    * baselines come from `@azx-pbc/shared/approval.ts`.
    */
-  data: z11.object({
-    provisioned: z11.boolean(),
-    baselineWritesPerDay: z11.number().positive(),
-    baselineBytesPerDay: z11.number().positive()
+  data: z14.object({
+    provisioned: z14.boolean(),
+    baselineWritesPerDay: z14.number().positive(),
+    baselineBytesPerDay: z14.number().positive()
   }),
   /**
    * The fetch-proxy (`/_api/fetch`) and direct-CSP surfaces.
@@ -826,42 +1344,51 @@ var CapabilityCatalogueSchema = z11.object({
    * values, and without the origin each one fronts: a global secret has no
    * stored origin (the origin is declared per-app in each manifest), so listing
    * one here would be a guess. An agent learns "this connection exists and is
-   * referenceable" and supplies the origin itself. `baselineRequestsPerDay` is
-   * the proxied-request budget at/under which a fetch grant auto-approves.
+   * referenceable" and supplies the origin itself. `providers` is the configured
+   * OAuth connection providers an app may bind from
+   * `capabilities.fetch.origins[].provider` — metadata-only
+   * {@link CatalogueProviderSchema} entries (ref, kind, display name, API
+   * destinations, env), never a credential field, served to every
+   * authenticated principal exactly like `connections`. An origin bound to a
+   * provider must be one of that provider's `apiOrigins` in the applicable
+   * environment, so an app author picks both from this list.
+   * `baselineRequestsPerDay` is the proxied-request budget at/under which a
+   * fetch grant auto-approves.
    */
-  fetch: z11.object({
-    externalOriginsPermitted: z11.boolean(),
-    connections: z11.array(z11.object({ name: z11.string().min(1) })),
-    baselineRequestsPerDay: z11.number().positive()
+  fetch: z14.object({
+    externalOriginsPermitted: z14.boolean(),
+    connections: z14.array(z14.object({ name: z14.string().min(1) })),
+    providers: z14.array(CatalogueProviderSchema),
+    baselineRequestsPerDay: z14.number().positive()
   }),
   /**
    * MCP is carried in the manifest but **not enforced** — no transport exists
    * today. Surfaced as `false` so an agent does not assume a working `mcp`
    * grant; declaring any server queues for approval regardless.
    */
-  mcp: z11.object({
-    enforced: z11.boolean()
+  mcp: z14.object({
+    enforced: z14.boolean()
   }),
   /**
    * Offline (ADR-0035): whether the platform service-worker grant is available,
    * and the rule a `scope` must satisfy (not the domain root, not a `/_…`
    * reserved path). Any grant or rescope queues for approval.
    */
-  offline: z11.object({
-    available: z11.boolean(),
+  offline: z14.object({
+    available: z14.boolean(),
     /** Human-facing summary of the scope rule; not machine-parsed. */
-    scopeRule: z11.string().min(1)
+    scopeRule: z14.string().min(1)
   }),
   /** Deploy bundle size caps in megabytes, as enforced on upload. */
-  deploy: z11.object({
-    maxFileMb: z11.number().positive(),
-    maxBundleMb: z11.number().positive()
+  deploy: z14.object({
+    maxFileMb: z14.number().positive(),
+    maxBundleMb: z14.number().positive()
   }),
   /**
    * The opt-in dev-gateway base, absent when it is not deployed here (same
    * convention as `DeploymentConfigResponseSchema.devApiBase`).
    */
-  devApiBase: z11.url().optional(),
+  devApiBase: z14.url().optional(),
   /**
    * The approval half of the catalogue (decision 3). The four baselines mirror
    * `@azx-pbc/shared/approval.ts` exactly, and `elevationTriggers` enumerates
@@ -869,15 +1396,15 @@ var CapabilityCatalogueSchema = z11.object({
    * thing an agent reads to design an app that ships immediately. A trigger
    * absent from this list never queues.
    */
-  approval: z11.object({
-    baselines: z11.object({
-      dollarsPerDay: z11.number().positive(),
-      writesPerDay: z11.number().positive(),
-      bytesPerDay: z11.number().positive(),
-      fetchRequestsPerDay: z11.number().positive()
+  approval: z14.object({
+    baselines: z14.object({
+      dollarsPerDay: z14.number().positive(),
+      writesPerDay: z14.number().positive(),
+      bytesPerDay: z14.number().positive(),
+      fetchRequestsPerDay: z14.number().positive()
     }),
-    elevationTriggers: z11.array(
-      z11.enum([
+    elevationTriggers: z14.array(
+      z14.enum([
         /** Any `externalOrigins` entry — widens CSP for a direct browser call. */
         "externalOrigins",
         /** Any `fetch.origins` entry — a proxied outbound origin. */
@@ -908,16 +1435,16 @@ var SCRYPT_PARAMS = {
 };
 
 // ../shared/src/llm.ts
-import { z as z12 } from "zod";
-var LlmMessageSchema = z12.object({
-  role: z12.enum(["user", "assistant"]),
-  content: z12.string().min(1)
+import { z as z15 } from "zod";
+var LlmMessageSchema = z15.object({
+  role: z15.enum(["user", "assistant"]),
+  content: z15.string().min(1)
 });
-var LlmUsageSchema = z12.object({
-  inputTokens: z12.int().nonnegative(),
-  outputTokens: z12.int().nonnegative(),
-  cacheReadInputTokens: z12.int().nonnegative().default(0),
-  cacheCreationInputTokens: z12.int().nonnegative().default(0)
+var LlmUsageSchema = z15.object({
+  inputTokens: z15.int().nonnegative(),
+  outputTokens: z15.int().nonnegative(),
+  cacheReadInputTokens: z15.int().nonnegative().default(0),
+  cacheCreationInputTokens: z15.int().nonnegative().default(0)
 });
 var MAX_SCHEMA_CHARS = 32768;
 var MAX_SCHEMA_DEPTH = 12;
@@ -940,11 +1467,11 @@ function withinSchemaBudget(schema) {
   }
   return serialized.length <= MAX_SCHEMA_CHARS && schemaDepth(schema) <= MAX_SCHEMA_DEPTH;
 }
-var LlmResponseFormatSchema = z12.object({
-  type: z12.literal("json_schema"),
+var LlmResponseFormatSchema = z15.object({
+  type: z15.literal("json_schema"),
   /** Schema name. OpenAI requires one; defaulted at translation when omitted. */
-  name: z12.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1-64 chars of [A-Za-z0-9_-]").optional(),
-  schema: z12.record(z12.string(), z12.unknown()).refine((s) => s.type === "object", 'schema root must be `{"type":"object"}`').refine(
+  name: z15.string().regex(/^[A-Za-z0-9_-]{1,64}$/, "must be 1-64 chars of [A-Za-z0-9_-]").optional(),
+  schema: z15.record(z15.string(), z15.unknown()).refine((s) => s.type === "object", 'schema root must be `{"type":"object"}`').refine(
     withinSchemaBudget,
     `schema must serialize to <= ${MAX_SCHEMA_CHARS} characters and nest <= ${MAX_SCHEMA_DEPTH} levels`
   )
@@ -954,18 +1481,18 @@ var LlmResponseFormatSchema = z12.object({
   // on `gpt-*` but not `claude-*`, which is exactly the provider leak this seam
   // exists to prevent. The platform always enforces; see ADR-0034.
 });
-var LlmChatRequestSchema = z12.object({
-  model: z12.string().min(1),
-  messages: z12.array(LlmMessageSchema).min(1),
+var LlmChatRequestSchema = z15.object({
+  model: z15.string().min(1),
+  messages: z15.array(LlmMessageSchema).min(1),
   /** Optional system prompt; maps to the vendor's system channel. */
-  system: z12.string().optional(),
-  maxTokens: z12.int().positive().max(128e3).optional(),
+  system: z15.string().optional(),
+  maxTokens: z15.int().positive().max(128e3).optional(),
   /** Sampling temperature; forwarded as-is (the vendor validates its own range). */
-  temperature: z12.number().optional(),
+  temperature: z15.number().optional(),
   /** Nucleus sampling; forwarded as-is. */
-  topP: z12.number().optional(),
+  topP: z15.number().optional(),
   /** Stop sequences; normalized to a list at the boundary. */
-  stop: z12.array(z12.string()).optional(),
+  stop: z15.array(z15.string()).optional(),
   /**
    * Constrain the completion to a JSON schema (ADR-0034). Refused up front when
    * the requested model can't enforce it (`ModelPrice.structuredOutputs`). The
@@ -974,70 +1501,70 @@ var LlmChatRequestSchema = z12.object({
    */
   responseFormat: LlmResponseFormatSchema.optional(),
   /** SSE streaming (default) vs a single JSON body. */
-  stream: z12.boolean().default(true)
+  stream: z15.boolean().default(true)
 });
-var LlmChatResponseSchema = z12.object({
-  model: z12.string(),
-  content: z12.string(),
-  stopReason: z12.string(),
+var LlmChatResponseSchema = z15.object({
+  model: z15.string(),
+  content: z15.string(),
+  stopReason: z15.string(),
   usage: LlmUsageSchema
 });
-var LlmStreamDeltaSchema = z12.object({ text: z12.string() });
-var LlmStreamDoneSchema = z12.object({
-  stopReason: z12.string(),
+var LlmStreamDeltaSchema = z15.object({ text: z15.string() });
+var LlmStreamDoneSchema = z15.object({
+  stopReason: z15.string(),
   usage: LlmUsageSchema
 });
-var LlmStreamErrorSchema = z12.object({
-  code: z12.string(),
-  message: z12.string()
+var LlmStreamErrorSchema = z15.object({
+  code: z15.string(),
+  message: z15.string()
 });
 
 // ../shared/src/llmOpenai.ts
-import { z as z13 } from "zod";
-var OpenAiRoleSchema = z13.enum(["system", "developer", "user", "assistant", "tool"]);
-var OpenAiMessageSchema = z13.object({
+import { z as z16 } from "zod";
+var OpenAiRoleSchema = z16.enum(["system", "developer", "user", "assistant", "tool"]);
+var OpenAiMessageSchema = z16.object({
   role: OpenAiRoleSchema,
-  content: z13.union([z13.string(), z13.array(z13.unknown())]).nullish(),
+  content: z16.union([z16.string(), z16.array(z16.unknown())]).nullish(),
   /** Present only on assistant tool-call turns — parsed to reject, never honored. */
-  tool_calls: z13.array(z13.unknown()).optional(),
-  tool_call_id: z13.string().optional(),
-  name: z13.string().optional()
-});
-var OpenAiStreamOptionsSchema = z13.object({
-  include_usage: z13.boolean().optional()
-});
-var OpenAiResponseFormatSchema = z13.discriminatedUnion("type", [
-  z13.object({
-    type: z13.literal("json_schema"),
-    json_schema: z13.object({
-      name: z13.string().optional(),
-      schema: z13.record(z13.string(), z13.unknown()),
-      strict: z13.boolean().nullish(),
+  tool_calls: z16.array(z16.unknown()).optional(),
+  tool_call_id: z16.string().optional(),
+  name: z16.string().optional()
+});
+var OpenAiStreamOptionsSchema = z16.object({
+  include_usage: z16.boolean().optional()
+});
+var OpenAiResponseFormatSchema = z16.discriminatedUnion("type", [
+  z16.object({
+    type: z16.literal("json_schema"),
+    json_schema: z16.object({
+      name: z16.string().optional(),
+      schema: z16.record(z16.string(), z16.unknown()),
+      strict: z16.boolean().nullish(),
       /**
        * Declared so the codec can reject it rather than zod silently stripping it.
        * It is honorable on the OpenAI path but has no Anthropic equivalent, so
        * forwarding it would make behaviour depend on the backing vendor — the same
        * provider leak that got `json_object` rejected (ADR-0034).
        */
-      description: z13.string().optional()
+      description: z16.string().optional()
     })
   }),
-  z13.object({ type: z13.literal("json_object") }),
-  z13.object({ type: z13.literal("text") })
+  z16.object({ type: z16.literal("json_object") }),
+  z16.object({ type: z16.literal("text") })
 ]);
-var OpenAiChatCompletionRequestSchema = z13.object({
-  model: z13.string().min(1),
-  messages: z13.array(OpenAiMessageSchema).min(1),
-  max_tokens: z13.int().positive().max(128e3).optional(),
-  max_completion_tokens: z13.int().positive().max(128e3).optional(),
-  temperature: z13.number().optional(),
-  top_p: z13.number().optional(),
-  stop: z13.union([z13.string(), z13.array(z13.string())]).optional(),
-  stream: z13.boolean().optional(),
+var OpenAiChatCompletionRequestSchema = z16.object({
+  model: z16.string().min(1),
+  messages: z16.array(OpenAiMessageSchema).min(1),
+  max_tokens: z16.int().positive().max(128e3).optional(),
+  max_completion_tokens: z16.int().positive().max(128e3).optional(),
+  temperature: z16.number().optional(),
+  top_p: z16.number().optional(),
+  stop: z16.union([z16.string(), z16.array(z16.string())]).optional(),
+  stream: z16.boolean().optional(),
   stream_options: OpenAiStreamOptionsSchema.optional(),
   /** Declared so the codec can reject tool use in v1 (not supported). */
-  tools: z13.array(z13.unknown()).optional(),
-  tool_choice: z13.unknown().optional(),
+  tools: z16.array(z16.unknown()).optional(),
+  tool_choice: z16.unknown().optional(),
   /**
    * Structured output (ADR-0034). Parsed, not rejected — see the union above.
    * `.nullish()` because clients and proxies that serialize every field send
@@ -1048,71 +1575,71 @@ var OpenAiChatCompletionRequestSchema = z13.object({
   // Behaviour-changing params the platform does not honor in v1. Declared (not
   // stripped) so the codec can reject them with a 400 rather than silently drop
   // them — the same "reject, never silently drop" contract as `tools`.
-  n: z13.unknown().optional(),
-  seed: z13.unknown().optional(),
-  logit_bias: z13.unknown().optional(),
-  presence_penalty: z13.unknown().optional(),
-  frequency_penalty: z13.unknown().optional(),
-  logprobs: z13.unknown().optional(),
-  top_logprobs: z13.unknown().optional()
-});
-var OpenAiUsageSchema = z13.object({
-  prompt_tokens: z13.int().nonnegative(),
-  completion_tokens: z13.int().nonnegative(),
-  total_tokens: z13.int().nonnegative()
-});
-var OpenAiChatCompletionResponseSchema = z13.object({
-  id: z13.string(),
-  object: z13.literal("chat.completion"),
-  created: z13.int(),
-  model: z13.string(),
-  choices: z13.array(
-    z13.object({
-      index: z13.int(),
-      message: z13.object({
-        role: z13.literal("assistant"),
-        content: z13.string()
+  n: z16.unknown().optional(),
+  seed: z16.unknown().optional(),
+  logit_bias: z16.unknown().optional(),
+  presence_penalty: z16.unknown().optional(),
+  frequency_penalty: z16.unknown().optional(),
+  logprobs: z16.unknown().optional(),
+  top_logprobs: z16.unknown().optional()
+});
+var OpenAiUsageSchema = z16.object({
+  prompt_tokens: z16.int().nonnegative(),
+  completion_tokens: z16.int().nonnegative(),
+  total_tokens: z16.int().nonnegative()
+});
+var OpenAiChatCompletionResponseSchema = z16.object({
+  id: z16.string(),
+  object: z16.literal("chat.completion"),
+  created: z16.int(),
+  model: z16.string(),
+  choices: z16.array(
+    z16.object({
+      index: z16.int(),
+      message: z16.object({
+        role: z16.literal("assistant"),
+        content: z16.string()
       }),
-      finish_reason: z13.string()
+      finish_reason: z16.string()
     })
   ),
   usage: OpenAiUsageSchema
 });
-var OpenAiChatCompletionChunkSchema = z13.object({
-  id: z13.string(),
-  object: z13.literal("chat.completion.chunk"),
-  created: z13.int(),
-  model: z13.string(),
-  choices: z13.array(
-    z13.object({
-      index: z13.int(),
-      delta: z13.object({
-        role: z13.literal("assistant").optional(),
-        content: z13.string().optional()
+var OpenAiChatCompletionChunkSchema = z16.object({
+  id: z16.string(),
+  object: z16.literal("chat.completion.chunk"),
+  created: z16.int(),
+  model: z16.string(),
+  choices: z16.array(
+    z16.object({
+      index: z16.int(),
+      delta: z16.object({
+        role: z16.literal("assistant").optional(),
+        content: z16.string().optional()
       }),
-      finish_reason: z13.string().nullable()
+      finish_reason: z16.string().nullable()
     })
   ),
   usage: OpenAiUsageSchema.nullish()
 });
-var OpenAiModelSchema = z13.object({
-  id: z13.string(),
-  object: z13.literal("model"),
-  created: z13.int(),
-  owned_by: z13.string()
+var OpenAiModelSchema = z16.object({
+  id: z16.string(),
+  object: z16.literal("model"),
+  created: z16.int(),
+  owned_by: z16.string()
 });
-var OpenAiModelListSchema = z13.object({
-  object: z13.literal("list"),
-  data: z13.array(OpenAiModelSchema)
+var OpenAiModelListSchema = z16.object({
+  object: z16.literal("list"),
+  data: z16.array(OpenAiModelSchema)
 });
 
 // ../shared/src/usage.ts
-import { z as z15 } from "zod";
+import { z as z18 } from "zod";
 
 // ../shared/src/principal.ts
-import { z as z14 } from "zod";
+import { z as z17 } from "zod";
 var PRINCIPAL_KINDS = ["user", "password", "anon", "dev"];
-var PrincipalKindSchema = z14.enum(PRINCIPAL_KINDS);
+var PrincipalKindSchema = z17.enum(PRINCIPAL_KINDS);
 
 // ../shared/src/usage.ts
 var GATEWAY_OUTCOMES = [
@@ -1121,159 +1648,208 @@ var GATEWAY_OUTCOMES = [
   "refusal",
   "quota_blocked",
   "conflict",
-  "forbidden"
+  "forbidden",
+  "connection_required"
 ];
-var GatewayOutcomeSchema = z15.enum(GATEWAY_OUTCOMES);
+var GatewayOutcomeSchema = z18.enum(GATEWAY_OUTCOMES);
 var USAGE_RANGES = ["24h", "7d", "30d"];
-var UsageRangeSchema = z15.enum(USAGE_RANGES);
+var UsageRangeSchema = z18.enum(USAGE_RANGES);
 var PLATFORM_RANGES = ["7d", "30d", "90d"];
-var PlatformRangeSchema = z15.enum(PLATFORM_RANGES);
-var UsageSeriesPointSchema = z15.object({
-  bucket: z15.iso.datetime(),
-  costUsd: z15.number().nonnegative(),
-  tokens: z15.int().nonnegative(),
-  requests: z15.int().nonnegative()
-});
-var UsageSummarySchema = z15.object({
-  appId: z15.uuid(),
+var PlatformRangeSchema = z18.enum(PLATFORM_RANGES);
+var UsageSeriesPointSchema = z18.object({
+  bucket: z18.iso.datetime(),
+  costUsd: z18.number().nonnegative(),
+  tokens: z18.int().nonnegative(),
+  requests: z18.int().nonnegative()
+});
+var UsageSummarySchema = z18.object({
+  appId: z18.uuid(),
   /** The rolling range these figures cover. */
   range: UsageRangeSchema,
-  requests: z15.int().nonnegative(),
-  inputTokens: z15.int().nonnegative(),
-  outputTokens: z15.int().nonnegative(),
+  requests: z18.int().nonnegative(),
+  inputTokens: z18.int().nonnegative(),
+  outputTokens: z18.int().nonnegative(),
   /** Cache-aware input token totals (0 until prompt caching is enabled). */
-  cacheReadInputTokens: z15.int().nonnegative(),
-  cacheCreationInputTokens: z15.int().nonnegative(),
+  cacheReadInputTokens: z18.int().nonnegative(),
+  cacheCreationInputTokens: z18.int().nonnegative(),
   /** Estimated spend in USD over the window at current rates (./pricing.ts). */
-  costUsd: z15.number().nonnegative(),
+  costUsd: z18.number().nonnegative(),
   /** 95th-percentile upstream latency (ms) over the window; null when no timed calls. */
-  latencyP95Ms: z15.number().nonnegative().nullable(),
+  latencyP95Ms: z18.number().nonnegative().nullable(),
   /** Fraction of calls in the window whose outcome was not `ok` (0..1). */
-  errorRate: z15.number().min(0).max(1),
+  errorRate: z18.number().min(0).max(1),
   /** Count of calls keyed by outcome — see {@link GATEWAY_OUTCOMES}. */
-  byOutcome: z15.record(z15.string(), z15.int().nonnegative()),
-  byModel: z15.array(
-    z15.object({
-      model: z15.string(),
-      tokens: z15.int().nonnegative(),
-      requests: z15.int().nonnegative(),
+  byOutcome: z18.record(z18.string(), z18.int().nonnegative()),
+  byModel: z18.array(
+    z18.object({
+      model: z18.string(),
+      tokens: z18.int().nonnegative(),
+      requests: z18.int().nonnegative(),
       /** Estimated spend in USD for this model over the window. */
-      costUsd: z15.number().nonnegative()
+      costUsd: z18.number().nonnegative()
     })
   ),
   /** Dense, zero-filled buckets across the range, oldest-first, for the trend chart. */
-  series: z15.array(UsageSeriesPointSchema),
+  series: z18.array(UsageSeriesPointSchema),
   /**
    * Today-since-midnight totals, independent of `range` — backs the daily-cap
    * gauge (the budget the edge enforces is per calendar day).
    */
-  today: z15.object({
-    tokens: z15.int().nonnegative(),
-    costUsd: z15.number().nonnegative()
+  today: z18.object({
+    tokens: z18.int().nonnegative(),
+    costUsd: z18.number().nonnegative()
   })
 });
-var GatewayCallSchema = z15.object({
-  id: z15.uuid(),
-  appId: z15.uuid(),
+var GatewayCallSchema = z18.object({
+  id: z18.uuid(),
+  appId: z18.uuid(),
   /** App slug at read time; null when the app row no longer exists. */
-  slug: z15.string().nullable(),
-  userOid: z15.string(),
+  slug: z18.string().nullable(),
+  userOid: z18.string(),
   /**
    * The caller's claims as captured when the call was made — the **display half**
    * (`App.ownerName`/`ownerEmail` applied to the ledger). Render these; never
    * compare them, and never join on them. Null for anonymous, shared-password and
    * dev-token callers, and for rows predating the columns, in which case the UI
-   * falls back to `userOid` — which is Entra's pairwise `sub` and identifies
-   * nobody, so it is a last resort rather than a label.
+   * falls back to `userOid` — an opaque principal id the platform declines
+   * to resolve (no Graph `/users` grant by design, ADR-0040 decision 3; and
+   * pre-re-base rows hold a pairwise `sub`), so it is a last resort rather
+   * than a label.
    */
-  userName: z15.string().nullable(),
-  userEmail: z15.string().nullable(),
+  userName: z18.string().nullable(),
+  userEmail: z18.string().nullable(),
   /**
    * Which kind of principal made the call. Read this instead of parsing
    * `userOid` — see {@link PrincipalKindSchema} for why the obvious shape test is
    * unsound. Null on rows written before the column, which render from `userOid`.
    */
   userKind: PrincipalKindSchema.nullable(),
-  capability: z15.string(),
-  model: z15.string(),
-  inputTokens: z15.int().nonnegative(),
-  outputTokens: z15.int().nonnegative(),
-  cacheReadInputTokens: z15.int().nonnegative(),
-  cacheCreationInputTokens: z15.int().nonnegative(),
+  capability: z18.string(),
+  model: z18.string(),
+  inputTokens: z18.int().nonnegative(),
+  outputTokens: z18.int().nonnegative(),
+  cacheReadInputTokens: z18.int().nonnegative(),
+  cacheCreationInputTokens: z18.int().nonnegative(),
   /** Estimated spend in USD for this single call at current rates. */
-  costUsd: z15.number().nonnegative(),
+  costUsd: z18.number().nonnegative(),
   /** Upstream round-trip latency in ms (0 when not measured). */
-  durationMs: z15.int().nonnegative(),
+  durationMs: z18.int().nonnegative(),
   /** Upstream/egress HTTP status — set for `fetch`; null for streamed `llm`. */
-  statusCode: z15.int().nullable(),
+  statusCode: z18.int().nullable(),
   /**
    * Request path of the proxied call — set for `fetch`; null otherwise. The
    * target's query string is excluded (see `redactFetchTarget` in `./logging.ts`)
    * because that is where credentials are conventionally placed — but a path can
    * carry one too, and nothing here detects that. See ADR-0021.
    */
-  path: z15.string().nullable(),
+  path: z18.string().nullable(),
   /** HTTP method of the proxied call — set for `fetch`; null otherwise. */
-  method: z15.string().nullable(),
+  method: z18.string().nullable(),
   /** LLM stop reason; null for non-LLM calls. */
-  stopReason: z15.string().nullable(),
-  /** Short upstream error string; null on success. */
-  errorDetail: z15.string().nullable(),
+  stopReason: z18.string().nullable(),
+  /**
+   * Short upstream error string; null on success. Admin-only in practice — it
+   * can quote request content and, on an auth failure, the key, so it serves
+   * the admin audit log's audience while the app-scoped feed
+   * (`/api/v1/apps/:slug/audit`) nulls it for non-admin callers.
+   */
+  errorDetail: z18.string().nullable(),
   outcome: GatewayOutcomeSchema,
-  createdAt: z15.iso.datetime()
+  createdAt: z18.iso.datetime()
 });
-var GatewayAuditPageSchema = z15.object({
-  rows: z15.array(GatewayCallSchema),
+var GatewayAuditPageSchema = z18.object({
+  rows: z18.array(GatewayCallSchema),
   /** Pass as `?before=` to fetch the next (older) page; absent when exhausted. */
-  nextBefore: z15.iso.datetime().optional()
+  nextBefore: z18.iso.datetime().optional()
 });
-var PlatformUsageSchema = z15.object({
+var PlatformUsageSchema = z18.object({
   /** The rolling range the series + breakdowns cover. */
   range: PlatformRangeSchema,
   /** Dense, zero-filled daily buckets across the range, oldest-first. */
-  series: z15.array(UsageSeriesPointSchema),
+  series: z18.array(UsageSeriesPointSchema),
   /** Per-app rollup over the range, busiest-first. */
-  byApp: z15.array(
-    z15.object({
-      slug: z15.string().nullable(),
-      tokens: z15.int().nonnegative(),
-      requests: z15.int().nonnegative(),
+  byApp: z18.array(
+    z18.object({
+      slug: z18.string().nullable(),
+      tokens: z18.int().nonnegative(),
+      requests: z18.int().nonnegative(),
       /** Estimated spend in USD for this app over the range. */
-      costUsd: z15.number().nonnegative()
+      costUsd: z18.number().nonnegative()
     })
   ),
   /** Month-to-date headline KPIs (independent of `range`). */
-  totals: z15.object({
-    tokensMTD: z15.int().nonnegative(),
-    requestsMTD: z15.int().nonnegative(),
+  totals: z18.object({
+    tokensMTD: z18.int().nonnegative(),
+    requestsMTD: z18.int().nonnegative(),
     /** Estimated month-to-date spend in USD across all apps. */
-    costMTD: z15.number().nonnegative(),
+    costMTD: z18.number().nonnegative(),
     /** Distinct `userOid`s seen month-to-date. */
-    activeUsers: z15.int().nonnegative()
+    activeUsers: z18.int().nonnegative()
   }),
   /** Token + cost share by capability over the range (essentially all `llm` in M4). */
-  capabilityMix: z15.array(
-    z15.object({
-      capability: z15.string(),
-      tokens: z15.int().nonnegative(),
+  capabilityMix: z18.array(
+    z18.object({
+      capability: z18.string(),
+      tokens: z18.int().nonnegative(),
       /** Estimated spend in USD for this capability over the range. */
-      costUsd: z15.number().nonnegative()
+      costUsd: z18.number().nonnegative()
     })
   )
 });
 
-// ../shared/src/data.ts
-import { z as z17 } from "zod";
-
-// ../shared/src/env.ts
-import { z as z16 } from "zod";
-var ENVS = ["prod", "dev"];
-var EnvSchema = z16.enum(ENVS);
+// ../shared/src/visitors.ts
+import { z as z19 } from "zod";
+var VISITOR_RANGES = ["7d", "30d", "90d"];
+var VisitorRangeSchema = z19.enum(VISITOR_RANGES);
+var count = z19.int().nonnegative();
+var VisitorTotalsSchema = z19.object({
+  visits: count,
+  uniqueVisitors: count
+});
+var GeoStatusSchema = z19.object({
+  available: z19.boolean(),
+  reason: z19.string().nullable(),
+  attribution: z19.object({ text: z19.string(), url: z19.url() }).nullable()
+});
+var VisitorLocationSchema = z19.object({
+  /** ISO 3166-1 alpha-2. */
+  country: z19.string(),
+  countryName: z19.string().nullable(),
+  /** First-level subdivision (state, province); null when the database has none. */
+  region: z19.string().nullable(),
+  visitors: count,
+  visits: count
+});
+var VisitorSeriesPointSchema = z19.object({
+  /** Bucket-start ISO timestamp (one calendar day). */
+  bucket: z19.iso.datetime(),
+  visits: count,
+  /** Distinct visitors that day — a visitor active on two days counts on each. */
+  uniqueVisitors: count
+});
+var VisitorSummarySchema = z19.object({
+  appId: z19.uuid(),
+  range: VisitorRangeSchema,
+  /** The selected window. */
+  current: VisitorTotalsSchema,
+  /** The window of the same length immediately before it, for the deltas. */
+  prior: VisitorTotalsSchema,
+  /** Dense, zero-filled daily buckets, oldest first. */
+  series: z19.array(VisitorSeriesPointSchema),
+  /** The top {@link VISITOR_LOCATION_LIMIT} locations by visitors. */
+  locations: z19.array(VisitorLocationSchema),
+  /** Every resolved location past the top ones. */
+  otherLocations: VisitorTotalsSchema,
+  /** Private, proxied or unknown networks, and every row when geo is unavailable. */
+  unresolved: VisitorTotalsSchema,
+  geo: GeoStatusSchema
+});
 
 // ../shared/src/data.ts
-var CollectionItemSchema = z17.object({
-  id: z17.uuid(),
-  collection: z17.string(),
+import { z as z20 } from "zod";
+var CollectionItemSchema = z20.object({
+  id: z20.uuid(),
+  collection: z20.string(),
   /**
    * Which tier collected the row (dev-mode §5). The runtime roles are RLS-pinned
    * to one tier each, but the portal reads across both, so the discriminator has
@@ -1282,157 +1858,215 @@ var CollectionItemSchema = z17.object({
    */
   env: EnvSchema,
   /** The submitting user, if authenticated; null for anonymous/public visitors. */
-  userOid: z17.string().nullable(),
+  userOid: z20.string().nullable(),
   /**
    * The submitter's captured claims — display half, rendered but never compared
    * (see `GatewayCallSchema.userName`). Null whenever `userOid` is, and for
    * password/dev-token principals.
    */
-  userName: z17.string().nullable(),
-  userEmail: z17.string().nullable(),
+  userName: z20.string().nullable(),
+  userEmail: z20.string().nullable(),
   /** The submitter's kind; null whenever `userOid` is, and on pre-column rows. */
   userKind: PrincipalKindSchema.nullable(),
-  item: z17.unknown(),
+  item: z20.unknown(),
   /** Hashed IP / truncated UA for abuse triage; null if not captured. */
-  meta: z17.unknown().nullable(),
-  createdAt: z17.iso.datetime()
+  meta: z20.unknown().nullable(),
+  createdAt: z20.iso.datetime()
 });
-var CollectionItemsPageSchema = z17.object({
-  rows: z17.array(CollectionItemSchema),
+var CollectionItemsPageSchema = z20.object({
+  rows: z20.array(CollectionItemSchema),
   /** Pass as `?before=` to fetch the next (older) page; absent when exhausted. */
-  nextBefore: z17.iso.datetime().optional()
+  nextBefore: z20.iso.datetime().optional()
 });
-var CollectionSummarySchema = z17.object({
-  name: z17.string(),
+var CollectionSummarySchema = z20.object({
+  name: z20.string(),
   env: EnvSchema,
-  count: z17.int().nonnegative(),
+  count: z20.int().nonnegative(),
   /** Newest row's timestamp; null only if the group is somehow empty. */
-  lastAt: z17.iso.datetime().nullable()
+  lastAt: z20.iso.datetime().nullable()
 });
 
 // ../shared/src/collectionTable.ts
 var BOM = String.fromCharCode(65279);
 
-// ../shared/src/secrets.ts
-import { z as z18 } from "zod";
-var FORBIDDEN_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "host",
-  "content-length",
-  "transfer-encoding",
-  "connection",
-  "te",
-  "upgrade",
-  "expect",
-  "trailer"
+// ../shared/src/connections.ts
+import { z as z21 } from "zod";
+var CONNECTION_STATUSES = ["live", "reconnect-needed", "invalidated"];
+var ConnectionStatusSchema = z21.enum(CONNECTION_STATUSES);
+var ConnectionMaterialSchema = z21.strictObject({
+  access: z21.string().min(1),
+  refresh: z21.string().min(1)
+});
+var MAX_GRANTED_SCOPES = 64;
+var GrantedScopesSchema = z21.array(ScopeTokenSchema).max(MAX_GRANTED_SCOPES);
+var UserConnectionSchema = z21.strictObject({
+  id: z21.uuid(),
+  userOid: z21.string().min(1),
+  providerId: z21.uuid(),
+  providerRevision: z21.int().positive(),
+  env: EnvSchema,
+  status: ConnectionStatusSchema,
+  material: z21.string().min(1),
+  grantedScopes: GrantedScopesSchema,
+  grantedAt: z21.iso.datetime(),
+  expiresAt: z21.iso.datetime(),
+  renewBeforeNext: z21.boolean(),
+  pendingRetire: z21.string().min(1).nullable(),
+  lastRenewedAt: z21.iso.datetime().nullable(),
+  createdAt: z21.iso.datetime(),
+  updatedAt: z21.iso.datetime()
+});
+var MyConnectionSchema = z21.strictObject({
+  id: z21.uuid(),
+  providerRef: ProviderRefSchema,
+  providerDisplayName: z21.string().min(1).max(200),
+  env: EnvSchema,
+  status: ConnectionStatusSchema.exclude(["invalidated"]),
+  grantedScopes: GrantedScopesSchema,
+  grantedAt: z21.iso.datetime(),
+  sharedApps: z21.array(BoundAppSchema)
+});
+var MyConnectionsResponseSchema = z21.strictObject({
+  connections: z21.array(MyConnectionSchema)
+});
+var DisconnectResponseSchema = z21.strictObject({
+  outcome: z21.enum(["disconnected", "already_removed"])
+});
+
+// ../shared/src/consent.ts
+import { z as z22 } from "zod";
+var ConsentStateSchema = z22.string().min(43).max(128);
+var ConsentNonceSchema = z22.string().min(16).max(128);
+var ConsentAttemptTagSchema = z22.string().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/, "must be URL-safe punctuation, letters, or digits");
+var ConsentIdentitySchema = z22.discriminatedUnion("kind", [
+  z22.strictObject({ kind: z22.literal("user"), userOid: z22.string().min(1).max(128) }),
+  z22.strictObject({
+    kind: z22.literal("dev"),
+    developerOid: z22.string().min(1).max(128),
+    nonce: ConsentNonceSchema
+  })
 ]);
-var HEADER_TOKEN = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
-var HEADER_VALUE_SAFE = /^[\t\x20-\x7e]*$/;
-var HEADER_VALUE_WIRE = /^[\t\x20-\x7e\x80-\xff]*$/;
-var headerName = (from) => {
-  const base = z18.string().min(1);
-  return (from === "request" ? base.max(64).regex(HEADER_TOKEN, "must be an RFC 7230 token") : base).transform((n) => n.trim().toLowerCase()).refine((n) => !FORBIDDEN_HEADER_NAMES.has(n), "reserved header name").refine((n) => !n.startsWith("x-helix-"), "reserved header prefix");
-};
-var headerTemplate = (from) => from === "request" ? z18.string().max(512).regex(HEADER_VALUE_SAFE) : z18.string().regex(HEADER_VALUE_WIRE);
-var injectionRecipe = (from) => z18.discriminatedUnion("kind", [
-  /** `Authorization: Bearer <secret>` — the common case. */
-  z18.object({ kind: z18.literal("header-bearer") }),
-  /** Arbitrary header; `{}` in `template` is replaced with the secret. */
-  z18.object({
-    kind: z18.literal("header"),
-    name: headerName(from),
-    template: headerTemplate(from).default("{}")
-  }),
-  /** Query parameter `?<param>=<secret>`. */
-  z18.object({ kind: z18.literal("query"), param: z18.string().min(1) }),
-  /**
-   * HMAC over a timestamp. The signed input is the timestamp string **alone** —
-   * not the method, path, query, or body — so injection is a pure function of
-   * (private key, now) and needs no request context.
-   *
-   * The canonical form lives in the KIND NAME, deliberately. A scheme that signs
-   * method+path+body is a *sibling kind* (`hmac-request`) — a code change with
-   * tests, reviewed — never an admin-editable canonical-string template.
-   * Canonicalization is where implementations of this family go wrong, and it
-   * does not belong in a text box.
-   *
-   * SHA-256, lowercase-hex, and ISO-8601-with-milliseconds are fixed rather than
-   * configurable. Each would carry a default, and `app_secrets.injection` is a
-   * schemaless JSON column, so adding a knob later is purely additive with no
-   * migration — while fixing them now removes the weak-algorithm and
-   * unencodable-digest failure classes outright.
-   *
-   * The stored value is a JSON blob carrying both halves of the key pair
-   * ({@link HmacCredentialSchema}): regenerating the pair changes both, and a
-   * blob rotates atomically through the existing rotate route.
-   */
-  z18.object({
-    kind: z18.literal("hmac-timestamp"),
-    /** Header carrying the timestamp that is also the entire signed input. */
-    timestampHeader: headerName(from),
-    /** Header carrying the rendered credential + signature. */
-    authHeader: headerName(from).default("authorization"),
-    /**
-     * Value written to `authHeader`. `{credential}` and `{signature}` are
-     * substituted. Named rather than the `header` kind's bare `{}` because there
-     * are two substitutions: the convention is one value ⇒ `{}`, more than one ⇒
-     * named placeholders. Positional `{}` here would let a swapped template
-     * produce a well-formed header that silently fails to authenticate.
-     *
-     * Both placeholders are required. This recipe writes exactly two headers,
-     * one of them the timestamp, so there is no configuration where the public
-     * credential id travels elsewhere — omitting `{credential}` means the
-     * upstream can never identify the key and every call 401s.
-     */
-    template: headerTemplate(from).refine((t) => t.includes("{signature}"), "template must contain {signature}").refine((t) => t.includes("{credential}"), "template must contain {credential}")
-  }).refine(
-    (r) => r.timestampHeader !== r.authHeader,
-    "timestampHeader and authHeader must differ \u2014 the second write overwrites the first"
-  )
+var HttpUrlNoUserinfoSchema = (() => {
+  const userinfo = /^https?:\/\/[/\\]*[^/?#\\]*@/i;
+  return z22.url({ protocol: /^https?$/ }).refine(
+    (value) => !userinfo.test(value.replace(/[\t\n\r]/g, "")),
+    "URL must not carry userinfo"
+  );
+})();
+var ConsultRequestSchema = z22.strictObject({
+  identity: ConsentIdentitySchema,
+  appSlug: z22.string().regex(SLUG_PATTERN, "must be a lowercase DNS label (a-z, 0-9, hyphen)"),
+  providerRef: ProviderRefSchema,
+  openerOrigin: HttpUrlNoUserinfoSchema.transform((value) => new URL(value).origin),
+  callbackUrl: HttpUrlNoUserinfoSchema
+});
+var ConsultResponseSchema = z22.discriminatedUnion("outcome", [
+  z22.strictObject({ outcome: z22.literal("already_connected") }),
+  z22.strictObject({ outcome: z22.literal("not_available") }),
+  z22.strictObject({ outcome: z22.literal("started"), authorizeUrl: z22.url() })
 ]);
-var InjectionRecipeSchema = injectionRecipe("request");
-var StoredInjectionRecipeSchema = injectionRecipe("stored");
-var HmacCredentialSchema = z18.object({
-  credential: z18.string().min(1),
-  key: z18.string().min(1)
+var CancelRequestSchema = z22.strictObject({
+  identity: ConsentIdentitySchema,
+  state: ConsentStateSchema
 });
-var SECRET_SCOPES = ["app", "global", "platform"];
-var SecretScopeSchema = z18.enum(SECRET_SCOPES);
-var SecretMetadataSchema = z18.object({
-  id: z18.string(),
-  name: z18.string().min(1),
-  scope: SecretScopeSchema,
-  /** Partition tier (dev-mode §6): a dev fetch injects only `dev` connection secrets. */
-  env: EnvSchema,
-  /**
-   * The **stored** parser, not the strict one — this field describes a row, and
-   * the SPA re-parses this schema on every response. Using the strict parser here
-   * would let the portal return a name the browser then refuses, moving the read
-   * failure from the server to the client, where it presents as a dead page.
-   *
-   * `null` = the stored recipe is unreadable (it names a reserved header, or is
-   * not a recipe at all). The credential still exists and is still deletable; it
-   * cannot be rotated, and egress fails its hop closed. Recipes are immutable by
-   * design, so recovery is delete-and-recreate.
-   */
-  injection: StoredInjectionRecipeSchema.nullable(),
-  createdBy: z18.string(),
-  createdAt: z18.string(),
-  rotatedAt: z18.string().nullable().optional(),
-  lastUsedAt: z18.string().nullable().optional(),
-  boundApps: z18.array(z18.string()).default([])
-});
-var SecretCreateRequestSchema = z18.object({
-  name: z18.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits, and hyphens"),
-  value: z18.string().min(1),
-  /** Target tier (dev-mode §6). Defaults `prod`; `dev` configures a dev-tier credential. */
-  env: EnvSchema.default("prod"),
-  injection: InjectionRecipeSchema.default({ kind: "header-bearer" })
+var CONSENT_CANCEL_OUTCOMES = ["cancelled", "not_cancellable"];
+var CancelResponseSchema = z22.strictObject({
+  outcome: z22.enum(CONSENT_CANCEL_OUTCOMES)
+});
+var ConnectionStatusIdentitySchema = z22.discriminatedUnion("kind", [
+  z22.strictObject({ kind: z22.literal("user"), userOid: z22.string().min(1).max(128) }),
+  z22.strictObject({ kind: z22.literal("dev"), developerOid: z22.string().min(1).max(128) })
+]);
+var ConnectionStatusRequestSchema = z22.strictObject({
+  identity: ConnectionStatusIdentitySchema,
+  appSlug: z22.string().regex(SLUG_PATTERN, "must be a lowercase DNS label (a-z, 0-9, hyphen)"),
+  providerRef: ProviderRefSchema
+});
+var ConnectionStatusResponseSchema = z22.strictObject({
+  status: z22.enum(["connected", "not_connected", "not_available"])
+});
+var AttemptCancelRequestSchema = z22.strictObject({
+  provider: ProviderRefSchema,
+  attempt: ConsentAttemptTagSchema
+});
+var DevConsentStartResponseSchema = z22.discriminatedUnion("outcome", [
+  z22.strictObject({ outcome: z22.literal("started"), popupUrl: z22.url() }),
+  z22.strictObject({ outcome: z22.literal("already_connected") }),
+  z22.strictObject({ outcome: z22.literal("not_available") })
+]);
+var HELIX_CONNECT_MESSAGE_SOURCE = "helix-connect";
+var CONNECT_MESSAGE_VERSION = 1;
+var CONSENT_MESSAGE_OUTCOMES = [
+  "connected",
+  "already_connected",
+  "denied",
+  "cancelled",
+  "timeout",
+  "blocked",
+  "signin_required",
+  "error"
+];
+var CONSENT_MESSAGE_REASONS = [
+  "conflict",
+  "provider_unavailable",
+  "provider_misconfigured",
+  "provider_incompatible",
+  "service_unavailable"
+];
+var ConnectOutcomeMessageSchema = z22.strictObject({
+  source: z22.literal(HELIX_CONNECT_MESSAGE_SOURCE),
+  version: z22.literal(CONNECT_MESSAGE_VERSION),
+  attempt: ConsentAttemptTagSchema.optional(),
+  provider: ProviderRefSchema,
+  outcome: z22.enum(CONSENT_MESSAGE_OUTCOMES),
+  reason: z22.enum(CONSENT_MESSAGE_REASONS).nullable()
+}).refine((message) => message.outcome === "error" || message.reason === null, {
+  error: "reason is only carried with the error outcome"
+});
+var ConnectResultSchema = z22.object({
+  outcome: z22.enum(CONSENT_MESSAGE_OUTCOMES),
+  provider: z22.string(),
+  attempt: ConsentAttemptTagSchema.optional(),
+  reason: z22.enum(CONSENT_MESSAGE_REASONS).optional()
+}).refine((result) => result.outcome === "error" || result.reason === void 0, {
+  error: "reason is only carried with the error outcome"
 });
-var SecretRotateRequestSchema = z18.object({ value: z18.string().min(1) });
-var SecretGrantRequestSchema = z18.object({ appSlug: z18.string().min(1) });
+
+// ../shared/src/exchange.ts
+import { z as z23 } from "zod";
+var ExchangeCodeSchema = z23.string().min(1).max(1024);
+var CodeVerifierSchema = z23.string().min(43).max(128).regex(/^[A-Za-z0-9\-._~]+$/, "must be an RFC 7636 code_verifier (43-128 unreserved characters)");
+var ExchangeRequestSchema = z23.strictObject({
+  providerId: z23.uuid(),
+  providerRevision: z23.int().positive(),
+  env: EnvSchema,
+  code: ExchangeCodeSchema,
+  codeVerifier: CodeVerifierSchema,
+  redirectUri: HttpUrlNoUserinfoSchema
+});
+var EXCHANGE_REJECTION_REASONS = [
+  "unusable_lifetime",
+  "missing_refresh_token",
+  "missing_permissions"
+];
+var ExchangeRejectionReasonSchema = z23.enum(EXCHANGE_REJECTION_REASONS);
+var MAX_EXCHANGED_SCOPES = 64;
+var ExchangedScopesSchema = z23.array(ScopeTokenSchema).max(MAX_EXCHANGED_SCOPES);
+var ExchangeResponseSchema = z23.discriminatedUnion("outcome", [
+  z23.strictObject({
+    outcome: z23.literal("exchanged"),
+    access: z23.string().min(1),
+    refresh: z23.string().min(1),
+    grantedScopes: ExchangedScopesSchema,
+    accessExpiresAt: z23.iso.datetime()
+  }),
+  z23.strictObject({ outcome: z23.literal("rejected"), reason: ExchangeRejectionReasonSchema }),
+  z23.strictObject({ outcome: z23.literal("provider_unavailable") }),
+  z23.strictObject({ outcome: z23.literal("exchange_failed") })
+]);
 
 // ../shared/src/devTokens.ts
-import { z as z19 } from "zod";
+import { z as z24 } from "zod";
 function isValidDevOrigin(input) {
   if (input.includes("*")) return false;
   let url;
@@ -1446,47 +2080,112 @@ function isValidDevOrigin(input) {
   if (url.username !== "" || url.password !== "") return false;
   return input === url.origin || input === `${url.origin}/`;
 }
-var DevOriginSchema = z19.string().refine(
+var DevOriginSchema = z24.string().refine(
   isValidDevOrigin,
   "must be an exact origin (scheme://host[:port]) \u2014 no path, query, or wildcard"
 ).transform((o) => new URL(o).origin);
-var TtlDaysSchema = z19.number().int().min(1).max(365).optional();
-var DevTokenMintRequestSchema = z19.object({
-  origins: z19.array(DevOriginSchema).min(1).max(20),
+var TtlDaysSchema = z24.number().int().min(1).max(365).optional();
+var DevTokenMintRequestSchema = z24.object({
+  origins: z24.array(DevOriginSchema).min(1).max(20),
   ttlDays: TtlDaysSchema
 });
-var DevTokenRotateRequestSchema = z19.object({
+var DevTokenRotateRequestSchema = z24.object({
   ttlDays: TtlDaysSchema
 });
-var DevTokenMetadataSchema = z19.object({
-  id: z19.string(),
-  developerOid: z19.string(),
-  origins: z19.array(z19.string()),
-  expiresAt: z19.string(),
-  revokedAt: z19.string().nullable().optional(),
-  createdAt: z19.string()
+var DevTokenMetadataSchema = z24.object({
+  id: z24.string(),
+  developerOid: z24.string(),
+  origins: z24.array(z24.string()),
+  expiresAt: z24.string(),
+  revokedAt: z24.string().nullable().optional(),
+  createdAt: z24.string()
 });
-var DevTokenMintResponseSchema = z19.object({
-  token: z19.string(),
+var DevTokenMintResponseSchema = z24.object({
+  token: z24.string(),
   metadata: DevTokenMetadataSchema
 });
 
+// ../shared/src/repoBinding.ts
+import { z as z25 } from "zod";
+function hasControlChar(v) {
+  for (let i = 0; i < v.length; i++) {
+    const c = v.charCodeAt(i);
+    if (c < 32 || c === 127) return true;
+  }
+  return false;
+}
+var RepoFullNameSchema = z25.string().max(140).regex(
+  /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}$/,
+  "must be owner/name, as in the repository's GitHub URL"
+).refine((v) => !/\/\.{1,2}$/.test(v), "must be owner/name, as in the repository's GitHub URL");
+var BranchNameSchema = z25.string().min(1).max(255).refine(
+  (v) => !v.startsWith("refs/") && !hasControlChar(v) && !/[\s~^:?*[\\]/.test(v) && !v.includes("..") && !v.includes("@{") && !v.includes("//") && !/^[-/]/.test(v) && !/(\/|\.lock|\.)$/.test(v),
+  "must be a branch name such as main, without refs/heads/"
+);
+var WorkflowRefSchema = z25.string().max(512).regex(
+  /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}\/\.github\/workflows\/[^@\s]+\.ya?ml@\S+$/,
+  "must look like owner/repo/.github/workflows/deploy.yml@refs/heads/main"
+);
+var EnvironmentNameSchema = z25.string().min(1).max(255).refine((v) => !hasControlChar(v) && v.trim() === v, "must be an environment name");
+var SetRepoBindingRequestSchema = z25.object({
+  repoFullName: RepoFullNameSchema,
+  branch: BranchNameSchema,
+  workflowRef: WorkflowRefSchema.optional(),
+  environment: EnvironmentNameSchema.optional()
+});
+var REPO_PROVIDERS = ["github"];
+var RepoBindingSchema = z25.object({
+  provider: z25.enum(REPO_PROVIDERS),
+  repoFullName: z25.string(),
+  branch: z25.string(),
+  workflowRef: z25.string().optional(),
+  environment: z25.string().optional(),
+  /** Pinned from the first accepted token; absent until then. */
+  repositoryId: z25.string().optional(),
+  repositoryOwnerId: z25.string().optional(),
+  pinnedAt: z25.iso.datetime().optional(),
+  createdAt: z25.iso.datetime(),
+  updatedAt: z25.iso.datetime()
+});
+
 // ../shared/src/instruction.ts
-import { z as z20 } from "zod";
+import { z as z26 } from "zod";
 var INSTRUCTION_CAPABILITIES = ["fetch", "llm"];
-var InstructionCapabilitySchema = z20.enum(INSTRUCTION_CAPABILITIES);
-var AttestedInstructionSchema = z20.object({
+var InstructionCapabilitySchema = z26.enum(INSTRUCTION_CAPABILITIES);
+var AttestedInstructionSchema = z26.strictObject({
   /** App the call is attributed to (registry app id). */
-  appId: z20.string().min(1),
+  appId: z26.string().min(1),
   /** Authenticated user, or the anonymous sentinel on `public` apps. */
-  userOid: z20.string().min(1),
+  userOid: z26.string().min(1),
+  /**
+   * Which kind of principal `userOid` is (the `PrincipalKind` vocabulary the
+   * edge records at capture time — recorded, never inferred). The delegated
+   * resolution refuses `anon` and `password` callers — they can
+   * never hold a connection — and serving that refusal
+   * requires knowing the KIND: `userOid`'s shape proves nothing (a shared-
+   * password pseudonym and an Entra `sub` share the base64url alphabet, and
+   * the sentinel is only exact for `anon`). Optional on the payload as a
+   * whole so secret-backed and keyless instructions keep minting unchanged;
+   * mandatory on a delegated one — the refine below makes a provider-bearing
+   * instruction without it unrepresentable, so an old edge cannot mint a
+   * delegated call egress would have to guess about.
+   */
+  userKind: PrincipalKindSchema.optional(),
   capability: InstructionCapabilitySchema,
   /** The allowlisted origin the edge authorized (scheme + host + port). */
-  origin: z20.url(),
+  origin: z26.url(),
   /** Connection (secret) name to inject, if this is a secret-backed call. */
-  connection: z20.string().min(1).optional(),
+  connection: z26.string().min(1).optional(),
+  /**
+   * Provider reference for a delegated call — the user's connection to this
+   * provider is what egress injects. Exactly
+   * one credential source travels: this and `connection` are XOR-enforced
+   * below — a delegated instruction carries a provider ref or a
+   * secret name, never both.
+   */
+  provider: ProviderRefSchema.optional(),
   /** Correlates the edge audit row with the egress call. */
-  requestId: z20.string().min(1),
+  requestId: z26.string().min(1),
   /**
    * The HTTP method + URL pathname the edge authorized (ADR-0013 step 2, issue #6).
    * Egress refuses a mismatched verb/resource, so a captured instruction can't be
@@ -1501,8 +2200,8 @@ var AttestedInstructionSchema = z20.object({
    * means "old edge", not tampering — egress asserts ONLY when the claim is
    * present. Make required once a fleet is reliably past deploy.
    */
-  method: z20.string().min(1).optional(),
-  path: z20.string().optional(),
+  method: z26.string().min(1).optional(),
+  path: z26.string().optional(),
   /**
    * Environment tier this call is scoped to (dev-mode design §6). Egress resolves
    * the connection secret within this tier — a `dev` instruction can never reach a
@@ -1511,12 +2210,27 @@ var AttestedInstructionSchema = z20.object({
    * minted before this field existed verifies as production.
    */
   env: EnvSchema.default("prod")
+}).superRefine((i, ctx) => {
+  if (i.connection !== void 0 && i.provider !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["provider"],
+      message: "an instruction carries exactly one credential source \u2014 a connection secret or a provider reference, never both."
+    });
+  }
+  if (i.provider !== void 0 && i.userKind === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["userKind"],
+      message: "a delegated instruction must carry the caller's principal kind \u2014 egress refuses anonymous and shared-password callers by kind, never by inferring it from userOid."
+    });
+  }
 });
 var INSTRUCTION_TTL_SECONDS = 30;
 var INSTRUCTION_BURN_RETENTION_SECONDS = INSTRUCTION_TTL_SECONDS + 15;
 
 // ../shared/src/fetch.ts
-import { z as z21 } from "zod";
+import { z as z27 } from "zod";
 var FETCH_ERROR_CODES = [
   "forbidden",
   "rate_limited",
@@ -1524,24 +2238,95 @@ var FETCH_ERROR_CODES = [
   "blocked",
   "too_large",
   "replay",
-  "upstream_error"
+  "upstream_error",
+  "connection_required",
+  "provider_unavailable",
+  "provider_misconfigured"
 ];
-var FetchErrorCodeSchema = z21.enum(FETCH_ERROR_CODES);
-var FetchProxyErrorSchema = z21.object({
+var FetchErrorCodeSchema = z27.enum(FETCH_ERROR_CODES);
+var FetchErrorProviderSchema = z27.strictObject({
+  ref: ProviderRefSchema,
+  displayName: z27.string().min(1).max(200).optional()
+});
+var FetchProxyErrorSchema = z27.object({
   code: FetchErrorCodeSchema,
-  message: z21.string()
+  message: z27.string(),
+  /** Present only on the delegated-call codes that carry it (`connection_required`, `provider_unavailable`). */
+  provider: FetchErrorProviderSchema.optional()
+});
+
+// ../shared/src/sessions.ts
+import { z as z28 } from "zod";
+var SessionPrincipalKindSchema = z28.enum(["user", "password"]);
+var SessionSummarySchema = z28.object({
+  id: z28.uuid(),
+  appId: z28.uuid(),
+  /** App slug at read time; the FK guarantees the app row exists. */
+  slug: z28.string(),
+  /**
+   * The identity half — Entra's `oid` claim since ADR-0048 (a pairwise `sub`
+   * on rows that predate the re-base; a `pw_*` pseudonym for shared-password
+   * visitors). Compared and joined on, never rendered except as a last
+   * resort: the platform deliberately holds no Graph `/users` grant, so no
+   * principal id it stores resolves to a name.
+   */
+  userOid: z28.string(),
+  /**
+   * The display half, captured at login. Render, never compare. Null for
+   * shared-password visitors (each login is a fresh pseudonym) and for rows
+   * predating the columns.
+   */
+  userName: z28.string().nullable(),
+  userEmail: z28.string().nullable(),
+  userKind: SessionPrincipalKindSchema.nullable(),
+  /** Group-id snapshot as of this session's login/refresh. */
+  groups: z28.array(z28.string()),
+  createdAt: z28.iso.datetime(),
+  /** Null while the handoff is un-redeemed — impossible here (live rows only). */
+  activatedAt: z28.iso.datetime().nullable(),
+  /** When silent re-auth (`prompt=none`) becomes due; past = overdue. */
+  refreshDueAt: z28.iso.datetime(),
+  /** Hard cap — the session is dead at this instant regardless of activity. */
+  expiresAt: z28.iso.datetime()
+});
+var SessionListResponseSchema = z28.object({
+  rows: z28.array(SessionSummarySchema),
+  groupNames: z28.record(z28.string(), z28.string().nullable()),
+  groupsResolved: z28.boolean()
+});
+var SessionRevokeRequestSchema = z28.object({
+  /**
+   * A session's principal id as seen in the list — the `oid` claim, a `pw_*`
+   * pseudonym, or a pre-re-base pairwise `sub`. Opaque to the admin; copied
+   * from the row they clicked, so its shape is whatever the session rows
+   * hold — bounded only against abuse, not parsed.
+   */
+  userOid: z28.string().min(1).max(200)
+});
+var SessionRevokeResultSchema = z28.object({
+  removed: z28.int().nonnegative(),
+  /** Slugs of the apps the removed sessions lived on; empty when none. */
+  apps: z28.array(z28.string())
 });
 
 // src/client.ts
 var CliError = class extends Error {
   code;
-  constructor(message, code) {
+  /** The portal envelope's `details`, when it sent one. */
+  details;
+  constructor(message, code, details) {
     super(message);
     this.name = "CliError";
     this.code = code;
+    this.details = details;
   }
 };
-var VersionListSchema = z22.array(VersionSchema);
+function errorReason(err) {
+  if (!(err instanceof CliError)) return void 0;
+  const reason = err.details?.reason;
+  return typeof reason === "string" ? reason : void 0;
+}
+var VersionListSchema = z29.array(VersionSchema);
 var PortalClient = class {
   #baseUrl;
   #tokenProvider;
@@ -1551,12 +2336,50 @@ var PortalClient = class {
     this.#tokenProvider = typeof token === "string" ? async () => token : token;
   }
   createApp(input) {
-    return this.#json(AppSchema, "POST", "/api/v1/apps", { auth: true, body: input });
+    return this.#json(AppSchema, "POST", "/api/v1/apps", {
+      auth: true,
+      body: {
+        slug: input.slug,
+        displayName: input.displayName,
+        // Sent only when set, so a description-free create posts exactly the
+        // body it always did — an older portal never sees a new key at all.
+        ...input.description !== void 0 ? { description: input.description } : {},
+        ...input.visibility !== void 0 ? { visibility: input.visibility } : {}
+      }
+    });
   }
   /** Public IdP discovery info — how `helix login` finds the issuer. */
   getAuthConfig() {
     return this.#json(AuthConfigResponseSchema, "GET", "/api/v1/auth/config", {});
   }
+  /** Public deployment topology (`GET /api/v1/config`), incl. the CI token audience. */
+  getDeploymentConfig() {
+    return this.#json(DeploymentConfigResponseSchema, "GET", "/api/v1/config", {});
+  }
+  /** The app's GitHub binding (ADR-0051), or null when it has none. */
+  async getRepoBinding(slug) {
+    try {
+      return await this.#json(RepoBindingSchema, "GET", `/api/v1/apps/${enc(slug)}/repo-binding`, {
+        auth: true
+      });
+    } catch (err) {
+      if (errorReason(err) === "no_binding") return null;
+      throw err;
+    }
+  }
+  putRepoBinding(slug, body) {
+    return this.#json(RepoBindingSchema, "PUT", `/api/v1/apps/${enc(slug)}/repo-binding`, {
+      auth: true,
+      body
+    });
+  }
+  async deleteRepoBinding(slug) {
+    const res = await fetch(this.#url(`/api/v1/apps/${enc(slug)}/repo-binding`), {
+      method: "DELETE",
+      headers: await this.#authHeaders(true)
+    });
+    if (!res.ok) await this.#parse(z29.unknown(), res);
+  }
   /** The authenticated actor, per the portal — powers `helix whoami`. */
   me() {
     return this.#json(PortalMeResponseSchema, "GET", "/api/v1/me", { auth: true });
@@ -1596,8 +2419,22 @@ var PortalClient = class {
     });
     return this.#parse(UploadVersionResponseSchema, res);
   }
-  #url(path3) {
-    return `${this.#baseUrl}${path3}`;
+  /**
+   * Upload from GitHub Actions to the CI route (ADR-0051), authenticated by the
+   * job's GitHub OIDC token rather than a Helix sign-in.
+   */
+  async uploadCiVersion(slug, zip, githubToken) {
+    const form = new FormData();
+    form.append("bundle", new Blob([new Uint8Array(zip)]), "bundle.zip");
+    const res = await fetch(this.#url(`/api/v1/apps/${enc(slug)}/ci/versions`), {
+      method: "POST",
+      headers: { authorization: `Bearer ${githubToken}` },
+      body: form
+    });
+    return this.#parse(UploadVersionResponseSchema, res);
+  }
+  #url(path5) {
+    return `${this.#baseUrl}${path5}`;
   }
   async #authHeaders(auth) {
     if (!auth) return {};
@@ -1607,10 +2444,10 @@ var PortalClient = class {
     }
     return { authorization: `Bearer ${token}` };
   }
-  async #json(schema, method, path3, opts) {
+  async #json(schema, method, path5, opts) {
     const headers = await this.#authHeaders(opts.auth ?? false);
     if (opts.body !== void 0) headers["content-type"] = "application/json";
-    const res = await fetch(this.#url(path3), {
+    const res = await fetch(this.#url(path5), {
       method,
       headers,
       body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
@@ -1622,20 +2459,26 @@ var PortalClient = class {
     const data = text ? JSON.parse(text) : void 0;
     if (!res.ok) {
       const parsed = ApiErrorSchema.safeParse(data);
-      if (parsed.success) throw new CliError(parsed.data.error.message, parsed.data.error.code);
+      if (parsed.success) {
+        const { message, code, details } = parsed.data.error;
+        throw new CliError(message, code, details);
+      }
       throw new CliError(`request failed (HTTP ${res.status})`);
     }
     return schema.parse(data);
   }
   /** A non-JSON GET (the markdown skill) — errors still typed via the envelope. */
-  async #text(path3, opts) {
+  async #text(path5, opts) {
     const headers = await this.#authHeaders(opts.auth ?? false);
-    const res = await fetch(this.#url(path3), { method: "GET", headers });
+    const res = await fetch(this.#url(path5), { method: "GET", headers });
     const body = await res.text();
     if (!res.ok) {
       const data = body ? safeJsonParse(body) : void 0;
       const parsed = ApiErrorSchema.safeParse(data);
-      if (parsed.success) throw new CliError(parsed.data.error.message, parsed.data.error.code);
+      if (parsed.success) {
+        const { message, code, details } = parsed.data.error;
+        throw new CliError(message, code, details);
+      }
       throw new CliError(`request failed (HTTP ${res.status})`);
     }
     return body;
@@ -1782,6 +2625,28 @@ async function deleteTokens(portalUrl, file = defaultTokenPath()) {
   return true;
 }
 
+// src/auth/githubActions.ts
+import { z as z30 } from "zod";
+function githubTokenSource(env) {
+  const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+  const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+  return requestUrl && requestToken ? { requestUrl, requestToken } : null;
+}
+var IdTokenResponseSchema = z30.object({ value: z30.string().min(1) });
+async function requestGithubIdToken(source, audience, fetchImpl = fetch) {
+  const url = new URL(source.requestUrl);
+  url.searchParams.set("audience", audience);
+  const res = await fetchImpl(url, {
+    headers: { authorization: `Bearer ${source.requestToken}`, accept: "application/json" }
+  });
+  if (!res.ok) {
+    throw new CliError(`GitHub refused the ID token request (HTTP ${res.status})`);
+  }
+  const parsed = IdTokenResponseSchema.safeParse(await res.json());
+  if (!parsed.success) throw new CliError("GitHub's ID token response had no token");
+  return parsed.data.value;
+}
+
 // src/commands.ts
 function requireSlug(config) {
   if (!config.slug) {
@@ -1821,24 +2686,68 @@ function printVersion(v) {
 }
 function printApp(app) {
   console.log(`  app ${app.slug} \u2014 live version: ${app.currentVersionId ?? "(none)"}`);
+  if (app.description) console.log(`  ${app.description}`);
 }
 async function createCommand(client, config, opts) {
   const slug = requireSlug(config);
   const app = await client.createApp({
     slug,
     displayName: opts.displayName ?? slug,
+    // Flag wins over helix.json, and an unset description is simply not sent —
+    // an older portal never sees a key it doesn't know.
+    description: opts.description ?? config.description,
     visibility: parseVisibility(opts.visibility)
   });
   console.log(`Created app "${app.slug}".`);
   printApp(app);
 }
-async function deployCommand(client, config, opts) {
+async function deployCommand(client, config, opts, env = process.env) {
   const slug = requireSlug(config);
+  const github = config.token ? null : githubTokenSource(env);
+  if (!config.token && !github && env.GITHUB_ACTIONS === "true") {
+    throw new CliError(
+      "running in GitHub Actions without an ID token; add `permissions: id-token: write` to the workflow (see `helix ci init`)"
+    );
+  }
+  if (github && !isSafePortalUrl(config.portalUrl)) {
+    throw new CliError(
+      `won't send a GitHub token over plain http (${config.portalUrl}); use the portal's https URL`
+    );
+  }
+  if (github && opts.promote) {
+    throw new CliError(
+      "CI deploys land as a preview; promote it in the portal or with `helix promote <n>`"
+    );
+  }
   const zip = config.bundle ? await readFile2(config.bundle) : await zipDirectory(config.dir);
   console.log(`Uploading bundle to "${slug}"\u2026`);
-  const { version, warnings } = await client.uploadVersion(slug, zip);
+  let result;
+  if (github) {
+    const deployment = await client.getDeploymentConfig();
+    if (!deployment.repoDeploy?.enabled) {
+      throw new CliError("this portal does not accept repo-backed deploys (ask its operator)");
+    }
+    const idToken = await requestGithubIdToken(github, deployment.repoDeploy.audience);
+    try {
+      result = await client.uploadCiVersion(slug, zip, idToken);
+    } catch (err) {
+      if (err instanceof CliError && err.code === "forbidden" && !errorReason(err)) {
+        throw new CliError(
+          `${err.message}; check that "${slug}" is connected to this repo (helix ci show)`,
+          err.code
+        );
+      }
+      throw err;
+    }
+  } else {
+    result = await client.uploadVersion(slug, zip);
+  }
+  const { version, warnings } = result;
   console.log(`Uploaded as preview:`);
   printVersion(version);
+  if (version.source) {
+    console.log(`  from: ${version.source.repoFullName}@${version.source.commitSha.slice(0, 7)}`);
+  }
   if (warnings.length > 0) {
     console.log(`
 ${warnings.length} CSP warning(s):`);
@@ -1854,6 +2763,10 @@ Promoted version ${version.number} to live.`);
 Not live yet \u2014 promote with: helix promote ${version.number}`);
   }
 }
+function isSafePortalUrl(url) {
+  const { protocol, hostname } = new URL(url);
+  return protocol === "https:" || protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(hostname);
+}
 async function versionsCommand(client, config) {
   const slug = requireSlug(config);
   const versions = await client.listVersions(slug);
@@ -1889,7 +2802,8 @@ async function loginCommand(client, config) {
   await writeTokens({ portalUrl: config.portalUrl, issuer }, tokens, void 0, { audience });
   const authed = new PortalClient(config.portalUrl, tokens.accessToken);
   const me = await authed.me();
-  console.log(`Logged in as ${me.name ?? me.sub} (${me.sub}).`);
+  const oid = me.oid ? ` \u2014 oid ${me.oid}` : "";
+  console.log(`Logged in as ${me.name ?? me.sub} (${me.sub})${oid}.`);
 }
 async function logoutCommand(config) {
   const forgot = await deleteTokens(config.portalUrl);
@@ -1897,7 +2811,8 @@ async function logoutCommand(config) {
 }
 async function whoamiCommand(client) {
   const me = await client.me();
-  console.log(`${me.sub} (via ${me.via}${me.name ? `, ${me.name}` : ""})`);
+  const oid = me.oid ? `${me.oid} \u2014 ` : "";
+  console.log(`${oid}${me.sub} (via ${me.via}${me.name ? `, ${me.name}` : ""})`);
 }
 async function skillCommand(client, _config, opts) {
   const skill = await client.getSkill();
@@ -1947,6 +2862,12 @@ function makeTokenProvider(opts, deps = defaultDeps) {
   };
 }
 
+// src/ci/commands.ts
+import { execFile } from "node:child_process";
+import { mkdir as mkdir2, readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
+import path4 from "node:path";
+import { promisify } from "node:util";
+
 // src/config.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import path2 from "node:path";
@@ -1971,10 +2892,346 @@ async function resolveConfig(flags, env = process.env, cwd = process.cwd()) {
     token: flags.token ?? env.HELIX_TOKEN ?? env.AZX_TOKEN,
     slug: flags.slug ?? file.slug,
     dir: flags.dir ?? file.dir ?? DEFAULT_DIR,
-    bundle: flags.bundle
+    bundle: flags.bundle,
+    description: flags.description ?? file.description
   };
 }
 
+// src/version.ts
+var CLI_VERSION = true ? "0.5.0" : "latest";
+
+// src/ci/remote.ts
+function parseGithubRemote(remote, githubHost = "github.com") {
+  const url = remote.trim();
+  const scp = /^[\w.-]+@([^:/]+):(.+)$/.exec(url);
+  let host;
+  let path5;
+  if (scp && !url.includes("://")) {
+    host = scp[1];
+    path5 = scp[2];
+  } else {
+    let parsed;
+    try {
+      parsed = new URL(url);
+    } catch {
+      return null;
+    }
+    if (!["https:", "http:", "ssh:", "git:"].includes(parsed.protocol)) return null;
+    host = parsed.hostname;
+    path5 = parsed.pathname.replace(/^\/+/, "");
+  }
+  if (host.toLowerCase() !== githubHost.toLowerCase()) return null;
+  const match = /^([A-Za-z0-9][A-Za-z0-9-]{0,38})\/([A-Za-z0-9._-]+?)(\.git)?\/?$/.exec(path5);
+  return match ? `${match[1]}/${match[2]}` : null;
+}
+
+// src/ci/workflow.ts
+import { access, readFile as readFile4 } from "node:fs/promises";
+import path3 from "node:path";
+var REUSABLE_WORKFLOW_PATH = "AZX-PBC-OSS/helix-actions/.github/workflows/deploy.yml";
+var REUSABLE_WORKFLOW_TAG = "v1";
+var REUSABLE_WORKFLOW_REF = `${REUSABLE_WORKFLOW_PATH}@refs/tags/${REUSABLE_WORKFLOW_TAG}`;
+var WORKFLOW_FILE = ".github/workflows/helix-deploy.yml";
+var DEFAULT_PNPM_VERSION = "10";
+async function exists(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var LOCKFILES = [
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["package-lock.json", "npm"]
+];
+var posix = (p) => p.split(path3.sep).join("/");
+async function readPackageJson(file) {
+  try {
+    return JSON.parse(await readFile4(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function detectBuildPlan(appDir, repoRoot) {
+  let packageManager = "npm";
+  let lockfilePath = null;
+  search: for (const dir of [appDir, repoRoot]) {
+    for (const [name, pm] of LOCKFILES) {
+      if (await exists(path3.join(dir, name))) {
+        packageManager = pm;
+        lockfilePath = posix(path3.relative(repoRoot, path3.join(dir, name)));
+        break search;
+      }
+    }
+  }
+  const appPkg = await readPackageJson(path3.join(appDir, "package.json"));
+  let pnpmPackageJson = null;
+  if (packageManager === "pnpm") {
+    for (const dir of [appDir, repoRoot]) {
+      const pkg = dir === appDir ? appPkg : await readPackageJson(path3.join(dir, "package.json"));
+      if (typeof pkg?.packageManager === "string" && pkg.packageManager.startsWith("pnpm@")) {
+        pnpmPackageJson = posix(path3.relative(repoRoot, path3.join(dir, "package.json")));
+        break;
+      }
+    }
+  }
+  const buildScript = typeof appPkg?.scripts?.build === "string" ? "build" : null;
+  return {
+    packageManager,
+    hasLockfile: lockfilePath !== null,
+    lockfilePath,
+    pnpmPackageJson,
+    buildScript
+  };
+}
+var INSTALL = {
+  npm: "npm ci",
+  pnpm: "pnpm install --frozen-lockfile",
+  yarn: "yarn install --frozen-lockfile"
+};
+var HEADER = (branch) => `# Deploys this app to Helix as a preview on every push to ${branch}.
+# Written by \`helix ci init\`. The repo needs no secret: the deploy job
+# authenticates with its own GitHub OIDC token. The build job runs the repo's
+# code without that permission. A preview goes live only when someone promotes
+# it, in the portal or with \`helix promote <n>\`.
+name: Deploy to Helix
+on:
+  push:
+    branches: [${JSON.stringify(branch)}]
+  workflow_dispatch:
+# Each job asks for only what it needs.
+permissions: {}
+`;
+var inDir = (workingDirectory, rel) => workingDirectory === "." ? rel : `${workingDirectory}/${rel}`;
+var FIND_OUTPUT = `if [ -f helix.json ]; then cfg=helix.json; elif [ -f azx.json ]; then cfg=azx.json; else echo "::error::no helix.json in this directory"; exit 1; fi
+          echo "config=$cfg" >> "$GITHUB_OUTPUT"
+          echo "dir=$(node -p "require('./' + process.argv[1]).dir || 'dist'" "$cfg")" >> "$GITHUB_OUTPUT"`;
+function renderStarterWorkflow(opts) {
+  const { plan, workingDirectory: wd } = opts;
+  const sub = wd !== ".";
+  const install = plan.hasLockfile ? INSTALL[plan.packageManager] : "npm install";
+  const pnpmSetup = plan.packageManager !== "pnpm" ? [] : [
+    "      - uses: pnpm/action-setup@v4",
+    "        with:",
+    plan.pnpmPackageJson ? `          package_json_file: ${plan.pnpmPackageJson}` : `          version: ${DEFAULT_PNPM_VERSION}`
+  ];
+  const cache = plan.lockfilePath ? [
+    `          cache: ${plan.packageManager}`,
+    `          cache-dependency-path: ${plan.lockfilePath}`
+  ] : [];
+  const lines = [
+    HEADER(opts.branch),
+    "jobs:",
+    "  build:",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      contents: read",
+    ...sub ? ["    defaults:", "      run:", `        working-directory: ${JSON.stringify(wd)}`] : [],
+    "    steps:",
+    "      - uses: actions/checkout@v4",
+    ...pnpmSetup,
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 24",
+    ...cache,
+    `      - run: ${install}`,
+    ...plan.buildScript ? [`      - run: ${plan.packageManager} run ${plan.buildScript}`] : [],
+    "      - id: output",
+    "        run: |",
+    `          ${FIND_OUTPUT}`,
+    "      - uses: actions/upload-artifact@v4",
+    "        with:",
+    "          name: helix-bundle",
+    "          path: |",
+    `            ${inDir(wd, "${{ steps.output.outputs.config }}")}`,
+    `            ${inDir(wd, "${{ steps.output.outputs.dir }}")}`,
+    "          include-hidden-files: true",
+    "          if-no-files-found: error",
+    "  deploy:",
+    "    needs: build",
+    "    runs-on: ubuntu-latest",
+    "    permissions:",
+    "      id-token: write",
+    "    steps:",
+    "      - uses: actions/download-artifact@v4",
+    "        with:",
+    "          name: helix-bundle",
+    `          path: ${JSON.stringify(wd)}`,
+    "      - uses: actions/setup-node@v4",
+    "        with:",
+    "          node-version: 24",
+    `      - run: npx --yes @azx-pbc/helix-cli@${opts.cliVersion} deploy`,
+    ...sub ? [`        working-directory: ${JSON.stringify(wd)}`] : [],
+    ""
+  ];
+  return lines.join("\n");
+}
+function renderReusableWorkflow(opts) {
+  const { plan } = opts;
+  const lines = [
+    HEADER(opts.branch),
+    "jobs:",
+    "  deploy:",
+    `    uses: ${REUSABLE_WORKFLOW_PATH}@${REUSABLE_WORKFLOW_TAG}`,
+    // A caller grants the reusable workflow at most these; its own jobs narrow
+    // them per job.
+    "    permissions:",
+    "      contents: read",
+    "      id-token: write",
+    "    with:",
+    `      package-manager: ${plan.packageManager}`,
+    `      working-directory: ${JSON.stringify(opts.workingDirectory)}`,
+    `      build-script: ${JSON.stringify(plan.buildScript ?? "")}`,
+    ...plan.packageManager === "pnpm" && !plan.pnpmPackageJson ? [`      pnpm-version: ${JSON.stringify(DEFAULT_PNPM_VERSION)}`] : [],
+    `      cli-version: ${JSON.stringify(opts.cliVersion)}`,
+    ""
+  ];
+  return lines.join("\n");
+}
+
+// src/ci/commands.ts
+var run = promisify(execFile);
+var defaultGit = async (args, cwd) => (await run("git", args, { cwd })).stdout.trim();
+function requireSlug2(config) {
+  if (!config.slug) throw new CliError("no app slug; set it in helix.json or pass --slug");
+  return config.slug;
+}
+async function ciInitCommand(client, config, opts, deps = {}) {
+  const cwd = deps.cwd ?? process.cwd();
+  const git = deps.git ?? defaultGit;
+  const log = deps.log ?? console.log;
+  const slug = requireSlug2(config);
+  const deployment = await client.getDeploymentConfig();
+  if (!deployment.repoDeploy?.enabled) {
+    throw new CliError("this portal does not accept repo-backed deploys (ask its operator)");
+  }
+  const githubHost = new URL(deployment.repoDeploy.serverUrl).hostname;
+  let repoRoot;
+  try {
+    repoRoot = await git(["rev-parse", "--show-toplevel"], cwd);
+  } catch {
+    throw new CliError("not inside a git checkout; run this from the app's directory in its repo");
+  }
+  const repo = opts.repo ?? parseGithubRemote(await originUrl(git, cwd), githubHost);
+  if (!repo) {
+    throw new CliError(
+      `couldn't read a ${githubHost} repo from the origin remote; pass --repo owner/name`
+    );
+  }
+  const branch = opts.branch ?? await defaultBranch(git, cwd);
+  if (!branch || branch === "HEAD") {
+    throw new CliError("couldn't tell which branch to deploy from; pass --branch <name>");
+  }
+  const workflowPath = path4.join(repoRoot, WORKFLOW_FILE);
+  if (!opts.force && await fileExists(workflowPath)) {
+    throw new CliError(`${WORKFLOW_FILE} already exists; pass --force to replace it`);
+  }
+  const workingDirectory = path4.relative(repoRoot, cwd).split(path4.sep).join("/") || ".";
+  const plan = await detectBuildPlan(cwd, repoRoot);
+  const render = opts.reusable ? renderReusableWorkflow : renderStarterWorkflow;
+  const workflow = render({ branch, workingDirectory, plan, cliVersion: CLI_VERSION });
+  const existing = await client.getRepoBinding(slug);
+  const workflowRef = opts.reusable ? REUSABLE_WORKFLOW_REF : existing?.workflowRef;
+  const environment = existing?.environment;
+  if (existing?.workflowRef && workflowRef !== existing.workflowRef && !opts.force) {
+    throw new CliError(
+      `the binding pins deploys to workflow ${existing.workflowRef}; --reusable would replace that pin. Pass --force to replace it.`
+    );
+  }
+  const binding = await client.putRepoBinding(slug, {
+    repoFullName: repo,
+    branch,
+    ...workflowRef ? { workflowRef } : {},
+    ...environment ? { environment } : {}
+  });
+  const configFile = await writeHelixJson(cwd, {
+    slug,
+    portalUrl: config.portalUrl,
+    dir: config.dir
+  });
+  await mkdir2(path4.dirname(workflowPath), { recursive: true });
+  await writeFile3(workflowPath, workflow, "utf8");
+  log(`Connected "${slug}" to ${repo}.`);
+  log(`Branch: ${branch}${opts.branch ? "" : " (use --branch to change)"}`);
+  printBinding(binding, log);
+  log(`Wrote ${path4.relative(cwd, workflowPath) || WORKFLOW_FILE} and ${configFile}.`);
+  if (isLocalPortal(config.portalUrl)) {
+    log(`warning: helix.json points CI at ${config.portalUrl}, which a GitHub runner can't reach.`);
+  }
+  log("Commit both files and push; each push lands a preview to promote.");
+}
+async function ciShowCommand(client, config, log = console.log) {
+  const slug = requireSlug2(config);
+  const binding = await client.getRepoBinding(slug);
+  if (!binding) {
+    log(`"${slug}" is not connected to a repo. Run: helix ci init`);
+    return;
+  }
+  printBinding(binding, log);
+}
+async function ciRemoveCommand(client, config, log = console.log) {
+  const slug = requireSlug2(config);
+  await client.deleteRepoBinding(slug);
+  log(`Disconnected "${slug}" from its repo. CI deploys to it are now refused.`);
+}
+function printBinding(b, log) {
+  log(`  repo:        ${b.repoFullName}`);
+  log(`  branch:      ${b.branch}`);
+  if (b.workflowRef) log(`  workflow:    ${b.workflowRef}`);
+  if (b.environment) log(`  environment: ${b.environment}`);
+  log(
+    b.repositoryId ? `  pinned:      repo id ${b.repositoryId}, owner id ${b.repositoryOwnerId ?? "?"}` : "  pinned:      not yet (the first deploy pins the repo's ids)"
+  );
+}
+async function originUrl(git, cwd) {
+  try {
+    return await git(["remote", "get-url", "origin"], cwd);
+  } catch {
+    return "";
+  }
+}
+async function defaultBranch(git, cwd) {
+  try {
+    const remoteHead = await git(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], cwd);
+    if (remoteHead.startsWith("origin/")) return remoteHead.slice("origin/".length);
+  } catch {
+  }
+  return git(["rev-parse", "--abbrev-ref", "HEAD"], cwd);
+}
+async function fileExists(file) {
+  try {
+    await readFile5(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function writeHelixJson(cwd, values) {
+  for (const name2 of CONFIG_FILENAMES) {
+    const file = path4.join(cwd, name2);
+    let existing;
+    try {
+      existing = JSON.parse(await readFile5(file, "utf8"));
+    } catch (err) {
+      if (err.code === "ENOENT") continue;
+      throw err;
+    }
+    await writeFile3(file, `${JSON.stringify({ ...existing, ...values }, null, 2)}
+`, "utf8");
+    return name2;
+  }
+  const name = CONFIG_FILENAMES[0];
+  await writeFile3(path4.join(cwd, name), `${JSON.stringify(values, null, 2)}
+`, "utf8");
+  return name;
+}
+function isLocalPortal(url) {
+  const host = new URL(url).hostname;
+  return host === "localhost" || host === "127.0.0.1" || host.endsWith(".local") || host === "::1";
+}
+
 // src/bin.ts
 var USAGE = `helix \u2014 Helix deploy CLI
 
@@ -1983,15 +3240,19 @@ Usage:
   helix logout
   helix whoami
   helix deploy   [--dir <dir>] [--bundle <zip>] [--promote]
-  helix create   [--display-name <name>] [--visibility <v>]
+  helix create   [--display-name <name>] [--description <text>] [--visibility <v>]
   helix versions
   helix promote  <number>
   helix rollback [number]
   helix skill    [--path <file>]   # write this deployment's agent skill to disk
+  helix ci init  [--repo <owner/name>] [--branch <b>] [--reusable] [--force]
+                                   # connect the app to its GitHub repo and write the workflow
+  helix ci show | helix ci remove
 
 Common flags: --slug <slug>  --portal-url <url>  --token <token>
-Env:  HELIX_PORTAL_URL, HELIX_TOKEN (static token \u2014 skips login; CI/scripts).
-Config file: helix.json { slug, portalUrl, dir }
+Env:  HELIX_PORTAL_URL, HELIX_TOKEN (static token \u2014 skips login; local scripts).
+      In GitHub Actions, deploy uses the job's OIDC token (permissions: id-token: write).
+Config file: helix.json { slug, portalUrl, dir, description }
 Visibility: internal | group:<id>[,<id>...] | password | public
 `;
 async function main() {
@@ -2031,9 +3292,28 @@ async function main() {
     case "create":
       await createCommand(client, config, {
         displayName: values["display-name"],
+        description: values.description ?? config.description,
         visibility: values.visibility
       });
       break;
+    case "ci": {
+      const sub = positionals[1];
+      if (sub === "init") {
+        await ciInitCommand(client, config, {
+          repo: values.repo,
+          branch: values.branch,
+          reusable: values.reusable,
+          force: values.force
+        });
+      } else if (sub === "show") {
+        await ciShowCommand(client, config);
+      } else if (sub === "remove") {
+        await ciRemoveCommand(client, config);
+      } else {
+        throw new CliError("usage: helix ci init | show | remove");
+      }
+      break;
+    }
     case "versions":
       await versionsCommand(client, config);
       break;