@burdenoff/fluidgrids-fe-sdk 2026.1111.17 → 2026.1111.19

package/dist/{SettingsPage-CgkRlCM5.js → SettingsPage-CJLZvv4J.js}

@@ -13,7 +13,8 @@ import { KF as WorkflowSearchAttributeType } from "./graphql-types-CDKVWH2R.js";
 import { H as useFlowStore } from "./node-operation-selection--oy-yEq_.js";
 import { At as useSaveStatusStore, Qt as findSaveConflict } from "./FluidGridsProvider-dvZSNtSW.js";
 import { a as useLogStreamDestinations, i as useLogStreamDestinationActions } from "./useObservability-CfEw3ZFD.js";
-import { Wt as useWorkflowDefinitionQuery, a as useConnections, n as useAgentDefinitions, qt as useWorkflowDefinitionsQuery, zt as useUpdateWorkflowDefinitionMutation } from "./useAgentDefinitions-Dpz0HDTq.js";
+import { n as useConnections } from "./useConnections-Cs7LCWEM.js";
+import { Nt as useUpdateWorkflowDefinitionMutation, Rt as useWorkflowDefinitionQuery, Vt as useWorkflowDefinitionsQuery, n as useAgentDefinitions } from "./useAgentDefinitions-B0dam3_o.js";
 import { a as formToInput$2, i as emptyAgentForm, n as agentToForm, o as grantDays, r as describeRule, t as AgentFormError } from "./agent-form-Bfvm32j1.js";
 import { i as getGlobalStoreClient } from "./node-registry-refresh-Dy0uRg9f.js";
 import { t as FluidGridsDocsLink } from "./FluidGridsDocsLink-JxkBpOeb.js";
@@ -30,437 +31,6 @@ import { print } from "graphql";
 import { clearGraphqlFetchResponseCache, getStoredOrganizationId, getStoredProjectId, getWorkspaceTokenPayload, graphqlFetchPinned, isWorkspaceTokenValidForContext, prepareWorkspaceRequest } from "@burdenoff/fe-libs/shared";
 import { resolveExternalGatewayUrls } from "@burdenoff/fe-libs/shared/config";
 
-// src/modules/agent-definitions/components/AgentsTab.tsx
-/**
-* Settings → Agents (BOFF-9962): FluidGrids agents with their own identity.
-*
-* Builders create an agent, choose the tools it may call (node type and operations) and the
-* connections those tools may use, and can require approval for every tool call. Each person
-* lets the agent act for them with a time-boxed grant (30 days by default, 365 at most) and can
-* withdraw it at any time; admins can revoke anyone's grant. An AI Agent node that names the agent
-* runs its tools as "agent for user", and every call is recorded under both identities. Giving an
-* agent more access withdraws other people's grants until they grant again.
-*/
-function errorMessage$2(err) {
-	if (err instanceof AgentFormError) return err.message;
-	return describeOperationError(err);
-}
-function AgentEditor({ initial, onCancel, onSave }) {
-	const tr = useTr();
-	const [form, setForm] = useState(initial);
-	const [busy, setBusy] = useState(false);
-	const { connections, loading: connectionsLoading } = useConnections();
-	const setTool = (index, patch) => setForm((current) => ({
-		...current,
-		tools: current.tools.map((row, i) => i === index ? {
-			...row,
-			...patch
-		} : row)
-	}));
-	const toggleConnection = (id, on) => setForm((current) => ({
-		...current,
-		connectionScope: on ? [.../* @__PURE__ */ new Set([...current.connectionScope, id])] : current.connectionScope.filter((value) => value !== id)
-	}));
-	const submit = async () => {
-		setBusy(true);
-		try {
-			await onSave(form);
-		} catch (err) {
-			toast.error(errorMessage$2(err));
-		} finally {
-			setBusy(false);
-		}
-	};
-	return /* @__PURE__ */ jsxs("div", {
-		className: "rounded-lg border border-border-secondary bg-background-primary p-4 space-y-4",
-		"data-testid": "agent-definition-editor",
-		children: [
-			/* @__PURE__ */ jsxs("div", {
-				className: "grid gap-3 sm:grid-cols-2",
-				children: [/* @__PURE__ */ jsxs("div", {
-					className: "space-y-1",
-					children: [/* @__PURE__ */ jsx(Label, {
-						htmlFor: "agent-name",
-						children: tr("fluidgrids.agents.name", "Name")
-					}), /* @__PURE__ */ jsx(Input, {
-						id: "agent-name",
-						value: form.name,
-						onChange: (e) => setForm({
-							...form,
-							name: e.target.value
-						}),
-						"data-testid": "agent-definition-name"
-					})]
-				}), /* @__PURE__ */ jsxs("div", {
-					className: "flex items-end gap-2",
-					children: [/* @__PURE__ */ jsx(Switch, {
-						id: "agent-active",
-						checked: form.status === "ACTIVE",
-						onCheckedChange: (on) => setForm({
-							...form,
-							status: on ? "ACTIVE" : "DISABLED"
-						})
-					}), /* @__PURE__ */ jsx(Label, {
-						htmlFor: "agent-active",
-						children: tr("fluidgrids.agents.active", "Active")
-					})]
-				})]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "space-y-1",
-				children: [/* @__PURE__ */ jsx(Label, {
-					htmlFor: "agent-description",
-					children: tr("fluidgrids.agents.description", "Description")
-				}), /* @__PURE__ */ jsx(Textarea, {
-					id: "agent-description",
-					value: form.description,
-					onChange: (e) => setForm({
-						...form,
-						description: e.target.value
-					}),
-					rows: 2
-				})]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "space-y-2",
-				children: [
-					/* @__PURE__ */ jsx(Label, { children: tr("fluidgrids.agents.tools", "Tools the agent may call") }),
-					/* @__PURE__ */ jsx("p", {
-						className: "text-xs text-text-secondary",
-						children: tr("fluidgrids.agents.toolsHelp", "A node type (for example store/slack) and the operations of it the agent may call, separated by commas. Leave the operations empty to allow every operation of that node type. Nothing else can be called.")
-					}),
-					form.tools.map((row, index) => /* @__PURE__ */ jsxs("div", {
-						className: "flex flex-wrap items-center gap-2",
-						"data-testid": `agent-definition-tool-${index}`,
-						children: [
-							/* @__PURE__ */ jsx(Input, {
-								className: "w-48",
-								placeholder: "store/slack",
-								value: row.nodeType,
-								onChange: (e) => setTool(index, { nodeType: e.target.value }),
-								"aria-label": tr("fluidgrids.agents.nodeType", "Node type")
-							}),
-							/* @__PURE__ */ jsx(Input, {
-								className: "min-w-48 flex-1",
-								placeholder: "postMessage, listChannels",
-								value: row.operations,
-								onChange: (e) => setTool(index, { operations: e.target.value }),
-								"aria-label": tr("fluidgrids.agents.operations", "Operations")
-							}),
-							/* @__PURE__ */ jsx(Button$1, {
-								variant: "ghost",
-								size: "sm",
-								onClick: () => setForm({
-									...form,
-									tools: form.tools.filter((_, i) => i !== index)
-								}),
-								"aria-label": tr("fluidgrids.agents.removeTool", "Remove tool"),
-								children: /* @__PURE__ */ jsx(Icon, {
-									icon: "mdi:close",
-									width: 16
-								})
-							})
-						]
-					}, index)),
-					/* @__PURE__ */ jsxs(Button$1, {
-						variant: "outline",
-						size: "sm",
-						onClick: () => setForm({
-							...form,
-							tools: [...form.tools, {
-								nodeType: "",
-								operations: ""
-							}]
-						}),
-						children: [/* @__PURE__ */ jsx(Icon, {
-							icon: "mdi:plus",
-							width: 16
-						}), tr("fluidgrids.agents.addTool", "Add tool")]
-					})
-				]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "space-y-2",
-				children: [/* @__PURE__ */ jsx(Label, { children: tr("fluidgrids.agents.connections", "Connections the agent's tools may use") }), connectionsLoading ? /* @__PURE__ */ jsx("p", {
-					className: "text-xs text-text-secondary",
-					children: tr("fluidgrids.agents.loadingConnections", "Loading connections…")
-				}) : connections.length === 0 ? /* @__PURE__ */ jsx("p", {
-					className: "text-xs text-text-secondary",
-					children: tr("fluidgrids.agents.noConnections", "This workspace has no connections yet.")
-				}) : /* @__PURE__ */ jsx("div", {
-					className: "grid gap-1 sm:grid-cols-2",
-					children: connections.map((connection) => /* @__PURE__ */ jsxs("label", {
-						className: "flex items-center gap-2 text-sm text-text-primary",
-						children: [
-							/* @__PURE__ */ jsx(Checkbox, {
-								checked: form.connectionScope.includes(connection.id),
-								onCheckedChange: (on) => toggleConnection(connection.id, on === true)
-							}),
-							/* @__PURE__ */ jsx("span", { children: connection.name }),
-							/* @__PURE__ */ jsx("span", {
-								className: "text-xs text-text-tertiary",
-								children: connection.provider?.name ?? connection.providerId
-							})
-						]
-					}, connection.id))
-				})]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "flex items-center gap-2",
-				children: [/* @__PURE__ */ jsx(Switch, {
-					id: "agent-approval",
-					checked: form.requireToolApproval,
-					onCheckedChange: (on) => setForm({
-						...form,
-						requireToolApproval: on
-					})
-				}), /* @__PURE__ */ jsx(Label, {
-					htmlFor: "agent-approval",
-					children: tr("fluidgrids.agents.requireApproval", "Every tool call waits for a person's approval")
-				})]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "flex gap-2",
-				children: [/* @__PURE__ */ jsx(Button$1, {
-					onClick: () => void submit(),
-					disabled: busy,
-					"data-testid": "agent-definition-save",
-					children: tr("fluidgrids.agents.save", "Save agent")
-				}), /* @__PURE__ */ jsx(Button$1, {
-					variant: "outline",
-					onClick: onCancel,
-					disabled: busy,
-					children: tr("fluidgrids.agents.cancel", "Cancel")
-				})]
-			})
-		]
-	});
-}
-function AgentGrants({ agent, loadGrants, onGrant, onRevoke }) {
-	const tr = useTr();
-	const [grants, setGrants] = useState(null);
-	const [days, setDays] = useState(String(30));
-	const [busy, setBusy] = useState(false);
-	const load = useCallback(async () => {
-		try {
-			setGrants(await loadGrants(agent.id));
-		} catch (err) {
-			setGrants([]);
-			toast.error(errorMessage$2(err));
-		}
-	}, [agent.id, loadGrants]);
-	useEffect(() => {
-		load();
-	}, [load]);
-	const run = async (action, done) => {
-		setBusy(true);
-		try {
-			await action();
-			toast.success(done);
-			await load();
-		} catch (err) {
-			toast.error(errorMessage$2(err));
-		} finally {
-			setBusy(false);
-		}
-	};
-	const mine = grants?.find((grant) => grant.isMine && grant.status === "ACTIVE");
-	return /* @__PURE__ */ jsxs("div", {
-		className: "space-y-2",
-		"data-testid": `agent-grants-${agent.id}`,
-		children: [/* @__PURE__ */ jsx("div", {
-			className: "flex flex-wrap items-center gap-2",
-			children: mine ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("span", {
-				className: "text-sm text-text-primary",
-				children: mine.expiresAt ? tr("fluidgrids.agents.myGrantUntil", "This agent may act for you until {{date}}.", { date: new Date(mine.expiresAt).toLocaleDateString() }) : tr("fluidgrids.agents.myGrant", "This agent may act for you.")
-			}), /* @__PURE__ */ jsx(Button$1, {
-				variant: "outline",
-				size: "sm",
-				disabled: busy,
-				onClick: () => void run(() => onRevoke(agent.id, null), tr("fluidgrids.agents.withdrawn", "Grant withdrawn")),
-				"data-testid": "agent-grant-withdraw",
-				children: tr("fluidgrids.agents.withdraw", "Withdraw my grant")
-			})] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
-				/* @__PURE__ */ jsx(Label, {
-					htmlFor: `grant-days-${agent.id}`,
-					className: "text-sm",
-					children: tr("fluidgrids.agents.grantFor", "Let it act for me for")
-				}),
-				/* @__PURE__ */ jsx(Input, {
-					id: `grant-days-${agent.id}`,
-					className: "w-20",
-					type: "number",
-					min: 1,
-					max: 365,
-					value: days,
-					onChange: (e) => setDays(e.target.value)
-				}),
-				/* @__PURE__ */ jsx("span", {
-					className: "text-sm text-text-secondary",
-					children: tr("fluidgrids.agents.days", "days")
-				}),
-				/* @__PURE__ */ jsx(Button$1, {
-					size: "sm",
-					disabled: busy || agent.status !== "ACTIVE",
-					onClick: () => void run(async () => onGrant(agent.id, grantDays(days)), tr("fluidgrids.agents.granted", "Grant given")),
-					"data-testid": "agent-grant-give",
-					children: tr("fluidgrids.agents.grant", "Grant")
-				})
-			] })
-		}), grants && grants.length > 0 ? /* @__PURE__ */ jsx("ul", {
-			className: "space-y-1 text-xs text-text-secondary",
-			children: grants.map((grant) => /* @__PURE__ */ jsxs("li", {
-				className: "flex items-center gap-2",
-				children: [
-					/* @__PURE__ */ jsx("span", {
-						className: "font-mono",
-						children: grant.userId
-					}),
-					/* @__PURE__ */ jsx(Badge, {
-						variant: "outline",
-						children: grant.status
-					}),
-					grant.expiresAt ? /* @__PURE__ */ jsx("span", { children: tr("fluidgrids.agents.until", "until {{date}}", { date: new Date(grant.expiresAt).toLocaleDateString() }) }) : null,
-					!grant.isMine && grant.status === "ACTIVE" ? /* @__PURE__ */ jsx(Button$1, {
-						variant: "ghost",
-						size: "sm",
-						disabled: busy,
-						onClick: () => void run(() => onRevoke(agent.id, grant.userId), tr("fluidgrids.agents.revoked", "Grant revoked")),
-						children: tr("fluidgrids.agents.revoke", "Revoke")
-					}) : null
-				]
-			}, grant.userId))
-		}) : null]
-	});
-}
-function AgentsTab() {
-	const tr = useTr();
-	const { agents, loading, error, save, remove, grants, grant, revoke } = useAgentDefinitions();
-	const [editing, setEditing] = useState(null);
-	const onSave = async (form) => {
-		const input = formToInput$2(form);
-		await save(editing?.id ?? null, input);
-		toast.success(tr("fluidgrids.agents.saved", "Agent saved"));
-		setEditing(null);
-	};
-	const onDelete = async (agent) => {
-		try {
-			await remove(agent.id);
-			toast.success(tr("fluidgrids.agents.deleted", "Agent deleted"));
-		} catch (err) {
-			toast.error(errorMessage$2(err));
-		}
-	};
-	return /* @__PURE__ */ jsxs("div", {
-		className: "space-y-4",
-		"data-testid": "agents-tab",
-		children: [
-			/* @__PURE__ */ jsxs("div", {
-				className: "flex flex-wrap items-start justify-between gap-2",
-				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h3", {
-					className: "text-base font-semibold text-text-primary",
-					children: tr("fluidgrids.agents.title", "Agents")
-				}), /* @__PURE__ */ jsx("p", {
-					className: "text-sm text-text-secondary",
-					children: tr("fluidgrids.agents.subtitle", "Give an AI Agent node an identity of its own. It can only call the tools and connections you allow, only for people who granted it, and every tool call is recorded under the agent and the person.")
-				})] }), !editing ? /* @__PURE__ */ jsxs(Button$1, {
-					onClick: () => setEditing({
-						id: null,
-						form: emptyAgentForm()
-					}),
-					"data-testid": "agent-definition-new",
-					children: [/* @__PURE__ */ jsx(Icon, {
-						icon: "mdi:plus",
-						width: 16
-					}), tr("fluidgrids.agents.new", "New agent")]
-				}) : null]
-			}),
-			editing ? /* @__PURE__ */ jsx(AgentEditor, {
-				initial: editing.form,
-				onCancel: () => setEditing(null),
-				onSave
-			}) : null,
-			error ? /* @__PURE__ */ jsx("p", {
-				className: "text-sm text-destructive",
-				children: errorMessage$2(error)
-			}) : null,
-			loading ? /* @__PURE__ */ jsx("p", {
-				className: "text-sm text-text-secondary",
-				children: tr("fluidgrids.agents.loading", "Loading agents…")
-			}) : agents.length === 0 && !error ? /* @__PURE__ */ jsx("p", {
-				className: "text-sm text-text-secondary",
-				children: tr("fluidgrids.agents.empty", "No agents yet.")
-			}) : /* @__PURE__ */ jsx("ul", {
-				className: "space-y-3",
-				children: agents.map((agent) => /* @__PURE__ */ jsxs("li", {
-					className: "rounded-lg border border-border-secondary bg-background-secondary p-3 space-y-2",
-					"data-testid": `agent-definition-${agent.id}`,
-					children: [
-						/* @__PURE__ */ jsxs("div", {
-							className: "flex flex-wrap items-center justify-between gap-2",
-							children: [/* @__PURE__ */ jsxs("div", {
-								className: "flex items-center gap-2",
-								children: [
-									/* @__PURE__ */ jsx(Icon, {
-										icon: "mdi:robot-outline",
-										width: 18
-									}),
-									/* @__PURE__ */ jsx("span", {
-										className: "font-medium text-text-primary",
-										children: agent.name
-									}),
-									/* @__PURE__ */ jsx(Badge, {
-										variant: "outline",
-										children: agent.status
-									}),
-									agent.requireToolApproval ? /* @__PURE__ */ jsx(Badge, {
-										variant: "outline",
-										children: tr("fluidgrids.agents.approvalBadge", "Approval required")
-									}) : null
-								]
-							}), /* @__PURE__ */ jsxs("div", {
-								className: "flex gap-1",
-								children: [/* @__PURE__ */ jsx(Button$1, {
-									variant: "ghost",
-									size: "sm",
-									onClick: () => setEditing({
-										id: agent.id,
-										form: agentToForm(agent)
-									}),
-									children: tr("fluidgrids.agents.edit", "Edit")
-								}), /* @__PURE__ */ jsx(Button$1, {
-									variant: "ghost",
-									size: "sm",
-									onClick: () => void onDelete(agent),
-									children: tr("fluidgrids.agents.delete", "Delete")
-								})]
-							})]
-						}),
-						agent.description ? /* @__PURE__ */ jsx("p", {
-							className: "text-sm text-text-secondary",
-							children: agent.description
-						}) : null,
-						/* @__PURE__ */ jsx("div", {
-							className: "text-xs text-text-secondary",
-							children: agent.toolAllowlist.length > 0 ? agent.toolAllowlist.map(describeRule).join(" · ") : tr("fluidgrids.agents.noTools", "No tools allowed")
-						}),
-						/* @__PURE__ */ jsx("div", {
-							className: "text-xs text-text-tertiary",
-							children: tr("fluidgrids.agents.connectionCount", "{{count}} connections in scope", { count: agent.connectionScope.length })
-						}),
-						/* @__PURE__ */ jsx(AgentGrants, {
-							agent,
-							loadGrants: grants,
-							onGrant: grant,
-							onRevoke: revoke
-						})
-					]
-				}, agent.id))
-			})
-		]
-	});
-}
-
 // src/modules/action-policies/utils/policy-form.ts
 const POLICY_EFFECTS = [
 	"REQUIRE_APPROVAL",
@@ -744,7 +314,7 @@ function needsAllowFallback(draft, others) {
 * rule; changing a policy or deciding an approval needs workflow publish rights.
 */
 const FIELD$1 = "rounded-md border border-border-secondary bg-background-secondary px-2 py-1.5 text-sm text-text-primary";
-function errorMessage$1(err) {
+function errorMessage$2(err) {
 	if (err instanceof PolicyFormError) return err.message;
 	return describeOperationError(err);
 }
@@ -858,7 +428,7 @@ function PolicyEditor({ initial, conditionEditable, storedCondition, others, onC
 		try {
 			await action();
 		} catch (err) {
-			toast.error(errorMessage$1(err));
+			toast.error(errorMessage$2(err));
 		} finally {
 			setBusy(false);
 		}
@@ -1213,7 +783,7 @@ function ApprovalsList({ approvals, onDecide }) {
 							await onDecide(approval.id, true);
 							toast.success(tr("fluidgrids.actionPolicies.approved", "Approved — the run continues"));
 						} catch (err) {
-							toast.error(errorMessage$1(err));
+							toast.error(errorMessage$2(err));
 						} finally {
 							setBusy(null);
 						}
@@ -1229,7 +799,7 @@ function ApprovalsList({ approvals, onDecide }) {
 							await onDecide(approval.id, false);
 							toast.success(tr("fluidgrids.actionPolicies.declined", "Declined — the node fails"));
 						} catch (err) {
-							toast.error(errorMessage$1(err));
+							toast.error(errorMessage$2(err));
 						} finally {
 							setBusy(null);
 						}
@@ -1356,7 +926,7 @@ function ActionPoliciesTab() {
 									try {
 										setPreview(await dryRun({ excludePolicyId: policy.id }));
 									} catch (err) {
-										toast.error(errorMessage$1(err));
+										toast.error(errorMessage$2(err));
 									}
 								},
 								children: tr("fluidgrids.actionPolicies.withoutIt", "Without it")
@@ -1389,7 +959,7 @@ function ActionPoliciesTab() {
 										await remove(policy.id);
 										toast.success(tr("fluidgrids.actionPolicies.deleted", "Policy deleted"));
 									} catch (err) {
-										toast.error(errorMessage$1(err));
+										toast.error(errorMessage$2(err));
 									}
 								},
 								children: confirmDelete === policy.id ? tr("fluidgrids.actionPolicies.confirmDelete", "Confirm delete") : tr("fluidgrids.actionPolicies.delete", "Delete")
@@ -2744,1190 +2314,1621 @@ function WorkflowNotificationsTab({ workflowKey }) {
 						})
 					})
 				]
-			}),
-			/* @__PURE__ */ jsxs("div", {
-				className: "flex flex-wrap items-center justify-between gap-3",
-				children: [/* @__PURE__ */ jsx("p", {
-					className: "text-xs text-text-secondary",
-					children: settings && !settings.customized ? tr("fluidgrids.settings.workflowNotifications.defaultsNote", "These are the defaults; nobody has changed them for this workflow yet.") : null
-				}), /* @__PURE__ */ jsx(Button$1, {
-					"data-agent": "confirm",
-					onClick: () => void handleSave(),
-					disabled: locked,
-					"data-testid": "workflow-notifications-save",
-					children: saving ? tr("fluidgrids.settings.execution.saving", "Saving…") : tr("fluidgrids.settings.execution.save", "Save")
-				})]
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "flex flex-wrap items-center justify-between gap-3",
+				children: [/* @__PURE__ */ jsx("p", {
+					className: "text-xs text-text-secondary",
+					children: settings && !settings.customized ? tr("fluidgrids.settings.workflowNotifications.defaultsNote", "These are the defaults; nobody has changed them for this workflow yet.") : null
+				}), /* @__PURE__ */ jsx(Button$1, {
+					"data-agent": "confirm",
+					onClick: () => void handleSave(),
+					disabled: locked,
+					"data-testid": "workflow-notifications-save",
+					children: saving ? tr("fluidgrids.settings.execution.saving", "Saving…") : tr("fluidgrids.settings.execution.save", "Save")
+				})]
+			})
+		]
+	});
+}
+
+// src/modules/settings/components/RunControlTab.tsx
+/**
+* Settings → Run control (BOFF-9906, Phase C): the workspace's activity pause
+* rules (run control), its search attribute definitions (search attributes),
+* the archive destination of finished runs (run archival) and the codec
+* server the run page decodes encoded payloads with (self-hosted workers).
+* Each card shows, and reads, only while its own flag is on; the tab shows
+* while any of them is.
+*/
+/**
+* Whether the Run control tab has anything to show. Pause rules act on durable
+* activities, so the service refuses their writes unless durable functions are
+* on as well (`runControlDurable`, not `runControl` alone).
+*/
+function hasRunControlSettings(flags) {
+	return flags.runControlDurable || flags.searchAttributes || flags.runArchival || flags.selfHostedWorkers;
+}
+function RunControlTab({ flags }) {
+	return /* @__PURE__ */ jsxs("div", {
+		className: "space-y-6",
+		"data-testid": "settings-run-control",
+		children: [
+			flags.runControlDurable && /* @__PURE__ */ jsx(PauseRulesCard, {}),
+			flags.searchAttributes && /* @__PURE__ */ jsx(SearchAttributeDefinitionsCard, {}),
+			flags.runArchival && /* @__PURE__ */ jsx(ArchiveSettingsCard, {}),
+			flags.selfHostedWorkers && /* @__PURE__ */ jsx(CodecServerCard, {})
+		]
+	});
+}
+function Card$1({ icon, title, description, children, testId }) {
+	return /* @__PURE__ */ jsxs("section", {
+		className: "rounded-lg border border-border-secondary bg-background-secondary p-4 sm:p-6",
+		"data-testid": testId,
+		children: [
+			/* @__PURE__ */ jsxs("div", {
+				className: "mb-1 flex items-center gap-2",
+				children: [/* @__PURE__ */ jsx(Icon, {
+					icon,
+					width: 18,
+					className: "text-text-secondary"
+				}), /* @__PURE__ */ jsx("h3", {
+					className: "text-base font-semibold text-text-primary",
+					children: title
+				})]
+			}),
+			/* @__PURE__ */ jsx("p", {
+				className: "mb-4 text-sm text-text-secondary",
+				children: description
+			}),
+			children
+		]
+	});
+}
+function PauseRulesCard() {
+	const tr = useTr();
+	const rules = useResource("pause-rules", true, fetchPauseRules);
+	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_UPDATE);
+	const [form, setForm] = useState({
+		activityType: "",
+		workflowKey: "",
+		reason: "",
+		expiresAt: ""
+	});
+	const [busy, setBusy] = useState(false);
+	const [error, setError] = useState(null);
+	const expires = form.expiresAt ? new Date(form.expiresAt) : null;
+	const valid = (form.activityType.trim() || form.workflowKey.trim()) && form.reason.trim() && (!expires || !Number.isNaN(expires.getTime()) && expires.getTime() > Date.now());
+	const create = async () => {
+		if (!valid) return;
+		setBusy(true);
+		setError(null);
+		try {
+			await createPauseRule({
+				activityType: form.activityType.trim() || null,
+				workflowKey: form.workflowKey.trim() || null,
+				reason: form.reason.trim(),
+				expiresAt: expires ? expires.toISOString() : null
+			});
+			setForm({
+				activityType: "",
+				workflowKey: "",
+				reason: "",
+				expiresAt: ""
+			});
+			await rules.refetch();
+		} catch (err) {
+			setError(describeOperationError(err));
+		} finally {
+			setBusy(false);
+		}
+	};
+	const remove = async (id) => {
+		try {
+			await deletePauseRule(id);
+			toast.success(tr("fluidgrids.settings.pauseRules.deleted", "Rule deleted; what it paused is unpaused"));
+			await rules.refetch();
+		} catch (err) {
+			toast.error(describeOperationError(err));
+		}
+	};
+	return /* @__PURE__ */ jsxs(Card$1, {
+		icon: "mdi:pause-octagon-outline",
+		title: tr("fluidgrids.settings.pauseRules.title", "Activity pause rules"),
+		description: tr("fluidgrids.settings.pauseRules.description", "A rule pauses matching durable activities when they are scheduled or retried, for example while a downstream system is down. Deleting it unpauses them."),
+		testId: "settings-pause-rules",
+		children: [
+			/* @__PURE__ */ jsx(FieldError, { message: rules.error }),
+			rules.data && rules.data.length === 0 && /* @__PURE__ */ jsx("p", {
+				className: "mb-3 text-sm text-text-secondary",
+				children: tr("fluidgrids.settings.pauseRules.empty", "No pause rules.")
+			}),
+			rules.data && rules.data.length > 0 && /* @__PURE__ */ jsx("ul", {
+				className: "mb-4 divide-y divide-border-secondary rounded-md border border-border-secondary",
+				children: rules.data.map((rule) => /* @__PURE__ */ jsxs("li", {
+					className: "flex flex-wrap items-center gap-3 px-3 py-2 text-sm",
+					"data-testid": `pause-rule-${rule.id}`,
+					children: [
+						/* @__PURE__ */ jsx("code", {
+							className: "font-mono text-xs text-text-primary",
+							children: rule.activityType ?? rule.nodeType ?? "*"
+						}),
+						rule.workflowKey && /* @__PURE__ */ jsx("span", {
+							className: "text-xs text-text-secondary",
+							children: rule.workflowKey
+						}),
+						/* @__PURE__ */ jsx("span", {
+							className: "text-text-primary",
+							children: rule.reason
+						}),
+						rule.expiresAt && /* @__PURE__ */ jsx("span", {
+							className: "text-xs text-text-secondary",
+							children: tr("fluidgrids.settings.pauseRules.until", "until {{date}}", { date: new Date(rule.expiresAt).toLocaleString() })
+						}),
+						canEdit && /* @__PURE__ */ jsx(Button$1, {
+							size: "sm",
+							variant: "ghost",
+							className: "ml-auto text-[var(--color-status-error-text)]",
+							onClick: () => void remove(rule.id),
+							"data-testid": `pause-rule-delete-${rule.id}`,
+							children: tr("fluidgrids.settings.common.delete", "Delete")
+						})
+					]
+				}, rule.id))
+			}),
+			canEdit && /* @__PURE__ */ jsxs("div", {
+				className: "grid gap-3 sm:grid-cols-2",
+				children: [
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "pause-rule-type",
+							children: tr("fluidgrids.settings.pauseRules.activityType", "Activity or node type")
+						}), /* @__PURE__ */ jsx(Input, {
+							id: "pause-rule-type",
+							value: form.activityType,
+							placeholder: "store/crm",
+							onChange: (event) => setForm({
+								...form,
+								activityType: event.target.value
+							}),
+							"data-testid": "pause-rule-type"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "pause-rule-workflow",
+							children: tr("fluidgrids.settings.pauseRules.workflowKey", "Workflow key (optional)")
+						}), /* @__PURE__ */ jsx(Input, {
+							id: "pause-rule-workflow",
+							value: form.workflowKey,
+							onChange: (event) => setForm({
+								...form,
+								workflowKey: event.target.value
+							}),
+							"data-testid": "pause-rule-workflow"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "pause-rule-reason",
+							children: tr("fluidgrids.settings.pauseRules.reason", "Reason")
+						}), /* @__PURE__ */ jsx(Input, {
+							id: "pause-rule-reason",
+							value: form.reason,
+							onChange: (event) => setForm({
+								...form,
+								reason: event.target.value
+							}),
+							"data-testid": "pause-rule-reason"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "pause-rule-expires",
+							children: tr("fluidgrids.settings.pauseRules.expiresAt", "Ends at (optional)")
+						}), /* @__PURE__ */ jsx(Input, {
+							id: "pause-rule-expires",
+							type: "datetime-local",
+							value: form.expiresAt,
+							onChange: (event) => setForm({
+								...form,
+								expiresAt: event.target.value
+							}),
+							"data-testid": "pause-rule-expires"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "sm:col-span-2",
+						children: [/* @__PURE__ */ jsx(FieldError, {
+							message: error,
+							testId: "pause-rule-error"
+						}), /* @__PURE__ */ jsx(Button$1, {
+							onClick: () => void create(),
+							disabled: !valid || busy,
+							"data-testid": "pause-rule-create",
+							children: tr("fluidgrids.settings.pauseRules.create", "Add rule")
+						})]
+					})
+				]
 			})
 		]
 	});
 }
-
-// src/modules/settings/components/RunControlTab.tsx
-/**
-* Settings → Run control (BOFF-9906, Phase C): the workspace's activity pause
-* rules (run control), its search attribute definitions (search attributes),
-* the archive destination of finished runs (run archival) and the codec
-* server the run page decodes encoded payloads with (self-hosted workers).
-* Each card shows, and reads, only while its own flag is on; the tab shows
-* while any of them is.
-*/
-/**
-* Whether the Run control tab has anything to show. Pause rules act on durable
-* activities, so the service refuses their writes unless durable functions are
-* on as well (`runControlDurable`, not `runControl` alone).
-*/
-function hasRunControlSettings(flags) {
-	return flags.runControlDurable || flags.searchAttributes || flags.runArchival || flags.selfHostedWorkers;
-}
-function RunControlTab({ flags }) {
-	return /* @__PURE__ */ jsxs("div", {
-		className: "space-y-6",
-		"data-testid": "settings-run-control",
-		children: [
-			flags.runControlDurable && /* @__PURE__ */ jsx(PauseRulesCard, {}),
-			flags.searchAttributes && /* @__PURE__ */ jsx(SearchAttributeDefinitionsCard, {}),
-			flags.runArchival && /* @__PURE__ */ jsx(ArchiveSettingsCard, {}),
-			flags.selfHostedWorkers && /* @__PURE__ */ jsx(CodecServerCard, {})
-		]
-	});
-}
-function Card$1({ icon, title, description, children, testId }) {
-	return /* @__PURE__ */ jsxs("section", {
-		className: "rounded-lg border border-border-secondary bg-background-secondary p-4 sm:p-6",
-		"data-testid": testId,
+const ATTRIBUTE_TYPES = [
+	"KEYWORD",
+	"TEXT",
+	"INT",
+	"DOUBLE",
+	"BOOL",
+	"DATETIME",
+	"KEYWORD_LIST"
+];
+/** A letter, then letters, digits and underscores (at most 64). */
+const SEARCH_ATTRIBUTE_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+function SearchAttributeDefinitionsCard() {
+	const tr = useTr();
+	const definitions = useResource("search-attributes", true, fetchSearchAttributes);
+	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_UPDATE);
+	const [name, setName] = useState("");
+	const [type, setType] = useState("KEYWORD");
+	const [description, setDescription] = useState("");
+	const [busy, setBusy] = useState(false);
+	const [error, setError] = useState(null);
+	const validName = SEARCH_ATTRIBUTE_NAME.test(name.trim());
+	const create = async () => {
+		if (!validName) return;
+		setBusy(true);
+		setError(null);
+		try {
+			await createSearchAttribute({
+				name,
+				type,
+				description
+			});
+			setName("");
+			setDescription("");
+			await definitions.refetch();
+		} catch (err) {
+			setError(describeOperationError(err));
+		} finally {
+			setBusy(false);
+		}
+	};
+	const remove = async (id) => {
+		try {
+			await deleteSearchAttribute(id);
+			await definitions.refetch();
+		} catch (err) {
+			toast.error(describeOperationError(err));
+		}
+	};
+	return /* @__PURE__ */ jsxs(Card$1, {
+		icon: "mdi:tag-search-outline",
+		title: tr("fluidgrids.settings.searchAttributes.title", "Search attributes"),
+		description: tr("fluidgrids.settings.searchAttributes.description", "Typed values runs carry so the Runs list can filter on them (at most 50). Deleting one leaves the runs' values in place."),
+		testId: "settings-search-attributes",
 		children: [
-			/* @__PURE__ */ jsxs("div", {
-				className: "mb-1 flex items-center gap-2",
-				children: [/* @__PURE__ */ jsx(Icon, {
-					icon,
-					width: 18,
-					className: "text-text-secondary"
-				}), /* @__PURE__ */ jsx("h3", {
-					className: "text-base font-semibold text-text-primary",
-					children: title
-				})]
-			}),
-			/* @__PURE__ */ jsx("p", {
-				className: "mb-4 text-sm text-text-secondary",
-				children: description
+			/* @__PURE__ */ jsx(FieldError, { message: definitions.error }),
+			definitions.data && definitions.data.length > 0 && /* @__PURE__ */ jsx("ul", {
+				className: "mb-4 divide-y divide-border-secondary rounded-md border border-border-secondary",
+				children: definitions.data.map((definition) => /* @__PURE__ */ jsxs("li", {
+					className: "flex flex-wrap items-center gap-3 px-3 py-2 text-sm",
+					"data-testid": `search-attribute-${definition.name}`,
+					children: [
+						/* @__PURE__ */ jsx("code", {
+							className: "font-mono text-xs text-text-primary",
+							children: definition.name
+						}),
+						/* @__PURE__ */ jsx(StatusPill, {
+							tone: "neutral",
+							children: definition.type
+						}),
+						definition.description && /* @__PURE__ */ jsx("span", {
+							className: "text-xs text-text-secondary",
+							children: definition.description
+						}),
+						canEdit && /* @__PURE__ */ jsx(Button$1, {
+							size: "sm",
+							variant: "ghost",
+							className: "ml-auto text-[var(--color-status-error-text)]",
+							onClick: () => void remove(definition.id),
+							children: tr("fluidgrids.settings.common.delete", "Delete")
+						})
+					]
+				}, definition.id))
 			}),
-			children
+			canEdit && /* @__PURE__ */ jsxs("div", {
+				className: "grid gap-3 sm:grid-cols-3",
+				children: [
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "search-attribute-name",
+							children: tr("fluidgrids.settings.searchAttributes.name", "Name")
+						}), /* @__PURE__ */ jsx(Input, {
+							id: "search-attribute-name",
+							value: name,
+							placeholder: "customerId",
+							onChange: (event) => setName(event.target.value),
+							"data-testid": "search-attribute-name"
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "search-attribute-type",
+							children: tr("fluidgrids.settings.searchAttributes.type", "Type")
+						}), /* @__PURE__ */ jsx(NativeSelect, {
+							id: "search-attribute-type",
+							value: type,
+							onChange: (value) => setType(ATTRIBUTE_TYPES.find((item) => item === value) ?? "KEYWORD"),
+							testId: "search-attribute-type",
+							children: ATTRIBUTE_TYPES.map((item) => /* @__PURE__ */ jsx("option", {
+								value: item,
+								children: item
+							}, item))
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "space-y-1.5",
+						children: [/* @__PURE__ */ jsx(Label, {
+							htmlFor: "search-attribute-description",
+							children: tr("fluidgrids.settings.searchAttributes.descriptionField", "Description (optional)")
+						}), /* @__PURE__ */ jsx(Input, {
+							id: "search-attribute-description",
+							value: description,
+							maxLength: 1e3,
+							onChange: (event) => setDescription(event.target.value)
+						})]
+					}),
+					/* @__PURE__ */ jsxs("div", {
+						className: "sm:col-span-3",
+						children: [
+							name && !validName && /* @__PURE__ */ jsx(FieldError, { message: tr("fluidgrids.settings.searchAttributes.badName", "Start with a letter; use letters, digits and underscores (at most 64).") }),
+							/* @__PURE__ */ jsx(FieldError, {
+								message: error,
+								testId: "search-attribute-error"
+							}),
+							/* @__PURE__ */ jsx(Button$1, {
+								onClick: () => void create(),
+								disabled: !validName || busy,
+								"data-testid": "search-attribute-create",
+								children: tr("fluidgrids.settings.searchAttributes.create", "Add attribute")
+							})
+						]
+					})
+				]
+			})
 		]
 	});
 }
-function PauseRulesCard() {
+/** An IAM role ARN in another account (the service refuses its own). */
+const ROLE_ARN = /^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/;
+/** An S3 bucket name. */
+const BUCKET_NAME = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
+function ArchiveSettingsCard() {
 	const tr = useTr();
-	const rules = useResource("pause-rules", true, fetchPauseRules);
-	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_UPDATE);
+	const archive = useResource("archive-settings", true, fetchArchiveSettings);
+	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_DELETE);
 	const [form, setForm] = useState({
-		activityType: "",
-		workflowKey: "",
-		reason: "",
-		expiresAt: ""
+		enabled: false,
+		bucket: "",
+		prefix: "",
+		region: "",
+		roleArn: "",
+		includePayloads: true
 	});
 	const [busy, setBusy] = useState(false);
 	const [error, setError] = useState(null);
-	const expires = form.expiresAt ? new Date(form.expiresAt) : null;
-	const valid = (form.activityType.trim() || form.workflowKey.trim()) && form.reason.trim() && (!expires || !Number.isNaN(expires.getTime()) && expires.getTime() > Date.now());
-	const create = async () => {
+	useEffect(() => {
+		const current = archive.data;
+		if (current) setForm({
+			enabled: current.enabled,
+			bucket: current.bucket,
+			prefix: current.prefix,
+			region: current.region,
+			roleArn: current.roleArn,
+			includePayloads: current.includePayloads
+		});
+	}, [archive.data]);
+	const valid = BUCKET_NAME.test(form.bucket.trim()) && /^[a-z]{2}-[a-z]+-\d$/.test(form.region.trim()) && ROLE_ARN.test(form.roleArn.trim());
+	const save = async () => {
 		if (!valid) return;
 		setBusy(true);
 		setError(null);
 		try {
-			await createPauseRule({
-				activityType: form.activityType.trim() || null,
-				workflowKey: form.workflowKey.trim() || null,
-				reason: form.reason.trim(),
-				expiresAt: expires ? expires.toISOString() : null
-			});
-			setForm({
-				activityType: "",
-				workflowKey: "",
-				reason: "",
-				expiresAt: ""
-			});
-			await rules.refetch();
+			archive.set(await saveArchiveSettings({
+				enabled: form.enabled,
+				bucket: form.bucket.trim(),
+				prefix: form.prefix.trim().replace(/^\/+|\/+$/g, ""),
+				region: form.region.trim(),
+				roleArn: form.roleArn.trim(),
+				includePayloads: form.includePayloads
+			}));
+			toast.success(tr("fluidgrids.settings.archive.saved", "Archive destination saved"));
 		} catch (err) {
 			setError(describeOperationError(err));
 		} finally {
 			setBusy(false);
 		}
 	};
-	const remove = async (id) => {
+	const clear = async () => {
+		setBusy(true);
+		setError(null);
 		try {
-			await deletePauseRule(id);
-			toast.success(tr("fluidgrids.settings.pauseRules.deleted", "Rule deleted; what it paused is unpaused"));
-			await rules.refetch();
+			await clearArchiveSettings();
+			archive.set(null);
+			setForm({
+				enabled: false,
+				bucket: "",
+				prefix: "",
+				region: "",
+				roleArn: "",
+				includePayloads: true
+			});
 		} catch (err) {
-			toast.error(describeOperationError(err));
+			setError(describeOperationError(err));
+		} finally {
+			setBusy(false);
 		}
 	};
 	return /* @__PURE__ */ jsxs(Card$1, {
-		icon: "mdi:pause-octagon-outline",
-		title: tr("fluidgrids.settings.pauseRules.title", "Activity pause rules"),
-		description: tr("fluidgrids.settings.pauseRules.description", "A rule pauses matching durable activities when they are scheduled or retried, for example while a downstream system is down. Deleting it unpauses them."),
-		testId: "settings-pause-rules",
+		icon: "mdi:archive-arrow-down-outline",
+		title: tr("fluidgrids.settings.archive.title", "Run archive"),
+		description: tr("fluidgrids.settings.archive.description", "Before retention deletes a finished run, it is written to an S3 bucket in your AWS account. The service assumes your role with this workspace's id as the external id, and checks the destination with a probe object when you enable it."),
+		testId: "settings-archive",
 		children: [
-			/* @__PURE__ */ jsx(FieldError, { message: rules.error }),
-			rules.data && rules.data.length === 0 && /* @__PURE__ */ jsx("p", {
-				className: "mb-3 text-sm text-text-secondary",
-				children: tr("fluidgrids.settings.pauseRules.empty", "No pause rules.")
-			}),
-			rules.data && rules.data.length > 0 && /* @__PURE__ */ jsx("ul", {
-				className: "mb-4 divide-y divide-border-secondary rounded-md border border-border-secondary",
-				children: rules.data.map((rule) => /* @__PURE__ */ jsxs("li", {
-					className: "flex flex-wrap items-center gap-3 px-3 py-2 text-sm",
-					"data-testid": `pause-rule-${rule.id}`,
-					children: [
-						/* @__PURE__ */ jsx("code", {
-							className: "font-mono text-xs text-text-primary",
-							children: rule.activityType ?? rule.nodeType ?? "*"
-						}),
-						rule.workflowKey && /* @__PURE__ */ jsx("span", {
-							className: "text-xs text-text-secondary",
-							children: rule.workflowKey
-						}),
-						/* @__PURE__ */ jsx("span", {
-							className: "text-text-primary",
-							children: rule.reason
-						}),
-						rule.expiresAt && /* @__PURE__ */ jsx("span", {
-							className: "text-xs text-text-secondary",
-							children: tr("fluidgrids.settings.pauseRules.until", "until {{date}}", { date: new Date(rule.expiresAt).toLocaleString() })
-						}),
-						canEdit && /* @__PURE__ */ jsx(Button$1, {
-							size: "sm",
-							variant: "ghost",
-							className: "ml-auto text-[var(--color-status-error-text)]",
-							onClick: () => void remove(rule.id),
-							"data-testid": `pause-rule-delete-${rule.id}`,
-							children: tr("fluidgrids.settings.common.delete", "Delete")
-						})
-					]
-				}, rule.id))
+			archive.data && archive.data.failingRuns > 0 && /* @__PURE__ */ jsx("div", {
+				role: "status",
+				className: "mb-4 rounded-md border border-[var(--color-status-warning-border)] bg-[var(--color-status-warning-bg-subtle)] p-3 text-sm text-[var(--color-status-warning-text)]",
+				"data-testid": "archive-failing",
+				children: tr("fluidgrids.settings.archive.failing", "{{count}} runs could not be archived, so their purge waits. Last error: {{error}}", {
+					count: archive.data.failingRuns,
+					error: archive.data.lastError ?? "—"
+				})
 			}),
-			canEdit && /* @__PURE__ */ jsxs("div", {
+			/* @__PURE__ */ jsx(FieldError, { message: archive.error }),
+			/* @__PURE__ */ jsxs("div", {
 				className: "grid gap-3 sm:grid-cols-2",
 				children: [
 					/* @__PURE__ */ jsxs("div", {
 						className: "space-y-1.5",
 						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "pause-rule-type",
-							children: tr("fluidgrids.settings.pauseRules.activityType", "Activity or node type")
+							htmlFor: "archive-bucket",
+							children: tr("fluidgrids.settings.archive.bucket", "Bucket")
 						}), /* @__PURE__ */ jsx(Input, {
-							id: "pause-rule-type",
-							value: form.activityType,
-							placeholder: "store/crm",
+							id: "archive-bucket",
+							value: form.bucket,
+							disabled: !canEdit,
 							onChange: (event) => setForm({
 								...form,
-								activityType: event.target.value
+								bucket: event.target.value
 							}),
-							"data-testid": "pause-rule-type"
+							"data-testid": "archive-bucket"
 						})]
 					}),
 					/* @__PURE__ */ jsxs("div", {
 						className: "space-y-1.5",
 						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "pause-rule-workflow",
-							children: tr("fluidgrids.settings.pauseRules.workflowKey", "Workflow key (optional)")
+							htmlFor: "archive-prefix",
+							children: tr("fluidgrids.settings.archive.prefix", "Key prefix (optional)")
 						}), /* @__PURE__ */ jsx(Input, {
-							id: "pause-rule-workflow",
-							value: form.workflowKey,
+							id: "archive-prefix",
+							value: form.prefix,
+							disabled: !canEdit,
 							onChange: (event) => setForm({
 								...form,
-								workflowKey: event.target.value
+								prefix: event.target.value
 							}),
-							"data-testid": "pause-rule-workflow"
+							"data-testid": "archive-prefix"
 						})]
 					}),
 					/* @__PURE__ */ jsxs("div", {
 						className: "space-y-1.5",
 						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "pause-rule-reason",
-							children: tr("fluidgrids.settings.pauseRules.reason", "Reason")
+							htmlFor: "archive-region",
+							children: tr("fluidgrids.settings.archive.region", "Region")
 						}), /* @__PURE__ */ jsx(Input, {
-							id: "pause-rule-reason",
-							value: form.reason,
+							id: "archive-region",
+							value: form.region,
+							placeholder: "ap-south-1",
+							disabled: !canEdit,
 							onChange: (event) => setForm({
 								...form,
-								reason: event.target.value
+								region: event.target.value
 							}),
-							"data-testid": "pause-rule-reason"
+							"data-testid": "archive-region"
 						})]
 					}),
 					/* @__PURE__ */ jsxs("div", {
 						className: "space-y-1.5",
 						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "pause-rule-expires",
-							children: tr("fluidgrids.settings.pauseRules.expiresAt", "Ends at (optional)")
+							htmlFor: "archive-role",
+							children: tr("fluidgrids.settings.archive.roleArn", "Role ARN")
 						}), /* @__PURE__ */ jsx(Input, {
-							id: "pause-rule-expires",
-							type: "datetime-local",
-							value: form.expiresAt,
+							id: "archive-role",
+							value: form.roleArn,
+							placeholder: "arn:aws:iam::123456789012:role/fluidgrids-archive",
+							disabled: !canEdit,
 							onChange: (event) => setForm({
 								...form,
-								expiresAt: event.target.value
+								roleArn: event.target.value
 							}),
-							"data-testid": "pause-rule-expires"
+							"data-testid": "archive-role"
 						})]
 					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "sm:col-span-2",
-						children: [/* @__PURE__ */ jsx(FieldError, {
-							message: error,
-							testId: "pause-rule-error"
-						}), /* @__PURE__ */ jsx(Button$1, {
-							onClick: () => void create(),
-							disabled: !valid || busy,
-							"data-testid": "pause-rule-create",
-							children: tr("fluidgrids.settings.pauseRules.create", "Add rule")
+					/* @__PURE__ */ jsxs("label", {
+						className: "flex items-center justify-between gap-3 text-sm sm:col-span-2",
+						children: [tr("fluidgrids.settings.archive.includePayloads", "Include payloads, inputs and outputs"), /* @__PURE__ */ jsx(Switch, {
+							checked: form.includePayloads,
+							disabled: !canEdit,
+							onCheckedChange: (includePayloads) => setForm({
+								...form,
+								includePayloads
+							})
+						})]
+					}),
+					/* @__PURE__ */ jsxs("label", {
+						className: "flex items-center justify-between gap-3 text-sm sm:col-span-2",
+						children: [tr("fluidgrids.settings.archive.enabled", "Archive runs before they are purged"), /* @__PURE__ */ jsx(Switch, {
+							checked: form.enabled,
+							disabled: !canEdit,
+							onCheckedChange: (enabled) => setForm({
+								...form,
+								enabled
+							}),
+							"data-testid": "archive-enabled"
 						})]
 					})
 				]
+			}),
+			/* @__PURE__ */ jsx(FieldError, {
+				message: error,
+				testId: "archive-error"
+			}),
+			canEdit && /* @__PURE__ */ jsxs("div", {
+				className: "mt-4 flex gap-2",
+				children: [/* @__PURE__ */ jsx(Button$1, {
+					onClick: () => void save(),
+					disabled: !valid || busy,
+					"data-testid": "archive-save",
+					children: tr("fluidgrids.settings.common.save", "Save")
+				}), archive.data && /* @__PURE__ */ jsx(Button$1, {
+					variant: "outline",
+					onClick: () => void clear(),
+					disabled: busy,
+					"data-testid": "archive-clear",
+					children: tr("fluidgrids.settings.archive.remove", "Remove destination")
+				})]
 			})
 		]
 	});
 }
-const ATTRIBUTE_TYPES = [
-	"KEYWORD",
-	"TEXT",
-	"INT",
-	"DOUBLE",
-	"BOOL",
-	"DATETIME",
-	"KEYWORD_LIST"
-];
-/** A letter, then letters, digits and underscores (at most 64). */
-const SEARCH_ATTRIBUTE_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-function SearchAttributeDefinitionsCard() {
+function CodecServerCard() {
 	const tr = useTr();
-	const definitions = useResource("search-attributes", true, fetchSearchAttributes);
-	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_UPDATE);
-	const [name, setName] = useState("");
-	const [type, setType] = useState("KEYWORD");
-	const [description, setDescription] = useState("");
+	const settings = useResource("codec-server", true, fetchCodecServerSettings);
+	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_DELETE);
+	const [url, setUrl] = useState("");
+	const [includeCredentials, setIncludeCredentials] = useState(false);
 	const [busy, setBusy] = useState(false);
 	const [error, setError] = useState(null);
-	const validName = SEARCH_ATTRIBUTE_NAME.test(name.trim());
-	const create = async () => {
-		if (!validName) return;
-		setBusy(true);
-		setError(null);
-		try {
-			await createSearchAttribute({
-				name,
-				type,
-				description
-			});
-			setName("");
-			setDescription("");
-			await definitions.refetch();
+	useEffect(() => {
+		if (!settings.data) return;
+		setUrl(settings.data.codecServerUrl ?? "");
+		setIncludeCredentials(settings.data.codecServerIncludeCredentials);
+	}, [settings.data]);
+	const check = url.trim() ? checkCodecServerUrl(url) : null;
+	const save = async () => {
+		if (check && !check.ok) return;
+		setBusy(true);
+		setError(null);
+		try {
+			settings.set(await saveCodecServerSettings({
+				codecServerUrl: url.trim(),
+				codecServerIncludeCredentials: includeCredentials
+			}));
+			toast.success(tr("fluidgrids.settings.codec.saved", "Codec server saved"));
 		} catch (err) {
 			setError(describeOperationError(err));
 		} finally {
 			setBusy(false);
 		}
 	};
-	const remove = async (id) => {
-		try {
-			await deleteSearchAttribute(id);
-			await definitions.refetch();
-		} catch (err) {
-			toast.error(describeOperationError(err));
-		}
-	};
 	return /* @__PURE__ */ jsxs(Card$1, {
-		icon: "mdi:tag-search-outline",
-		title: tr("fluidgrids.settings.searchAttributes.title", "Search attributes"),
-		description: tr("fluidgrids.settings.searchAttributes.description", "Typed values runs carry so the Runs list can filter on them (at most 50). Deleting one leaves the runs' values in place."),
-		testId: "settings-search-attributes",
-		children: [
-			/* @__PURE__ */ jsx(FieldError, { message: definitions.error }),
-			definitions.data && definitions.data.length > 0 && /* @__PURE__ */ jsx("ul", {
-				className: "mb-4 divide-y divide-border-secondary rounded-md border border-border-secondary",
-				children: definitions.data.map((definition) => /* @__PURE__ */ jsxs("li", {
-					className: "flex flex-wrap items-center gap-3 px-3 py-2 text-sm",
-					"data-testid": `search-attribute-${definition.name}`,
+		icon: "mdi:lock-open-outline",
+		title: tr("fluidgrids.settings.codec.title", "Codec server"),
+		description: tr("fluidgrids.settings.codec.description", "Payloads your self-hosted workers encode stay encoded in FluidGrids. The run page can send them to your codec server (Temporal's codec-server protocol) to show them decoded. No FluidGrids token is ever sent there."),
+		testId: "settings-codec",
+		children: [/* @__PURE__ */ jsx(FieldError, { message: settings.error }), /* @__PURE__ */ jsxs("div", {
+			className: "space-y-3",
+			children: [
+				/* @__PURE__ */ jsxs("div", {
+					className: "space-y-1.5",
 					children: [
-						/* @__PURE__ */ jsx("code", {
-							className: "font-mono text-xs text-text-primary",
-							children: definition.name
+						/* @__PURE__ */ jsx(Label, {
+							htmlFor: "codec-url",
+							children: tr("fluidgrids.settings.codec.url", "Codec server URL")
 						}),
-						/* @__PURE__ */ jsx(StatusPill, {
-							tone: "neutral",
-							children: definition.type
+						/* @__PURE__ */ jsx(Input, {
+							id: "codec-url",
+							value: url,
+							disabled: !canEdit,
+							placeholder: "https://codec.example.com",
+							onChange: (event) => setUrl(event.target.value),
+							"data-testid": "codec-url"
 						}),
-						definition.description && /* @__PURE__ */ jsx("span", {
-							className: "text-xs text-text-secondary",
-							children: definition.description
+						check && !check.ok && /* @__PURE__ */ jsx(FieldError, {
+							message: tr("fluidgrids.settings.codec.badUrl", "Use an https URL (http only for localhost)."),
+							testId: "codec-url-error"
 						}),
-						canEdit && /* @__PURE__ */ jsx(Button$1, {
-							size: "sm",
-							variant: "ghost",
-							className: "ml-auto text-[var(--color-status-error-text)]",
-							onClick: () => void remove(definition.id),
-							children: tr("fluidgrids.settings.common.delete", "Delete")
+						/* @__PURE__ */ jsx("p", {
+							className: "text-xs text-text-secondary",
+							children: tr("fluidgrids.settings.codec.empty", "Leave it empty to show encoded payloads as encoded.")
 						})
 					]
-				}, definition.id))
-			}),
-			canEdit && /* @__PURE__ */ jsxs("div", {
-				className: "grid gap-3 sm:grid-cols-3",
-				children: [
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "search-attribute-name",
-							children: tr("fluidgrids.settings.searchAttributes.name", "Name")
-						}), /* @__PURE__ */ jsx(Input, {
-							id: "search-attribute-name",
-							value: name,
-							placeholder: "customerId",
-							onChange: (event) => setName(event.target.value),
-							"data-testid": "search-attribute-name"
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "search-attribute-type",
-							children: tr("fluidgrids.settings.searchAttributes.type", "Type")
-						}), /* @__PURE__ */ jsx(NativeSelect, {
-							id: "search-attribute-type",
-							value: type,
-							onChange: (value) => setType(ATTRIBUTE_TYPES.find((item) => item === value) ?? "KEYWORD"),
-							testId: "search-attribute-type",
-							children: ATTRIBUTE_TYPES.map((item) => /* @__PURE__ */ jsx("option", {
-								value: item,
-								children: item
-							}, item))
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "search-attribute-description",
-							children: tr("fluidgrids.settings.searchAttributes.descriptionField", "Description (optional)")
-						}), /* @__PURE__ */ jsx(Input, {
-							id: "search-attribute-description",
-							value: description,
-							maxLength: 1e3,
-							onChange: (event) => setDescription(event.target.value)
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "sm:col-span-3",
-						children: [
-							name && !validName && /* @__PURE__ */ jsx(FieldError, { message: tr("fluidgrids.settings.searchAttributes.badName", "Start with a letter; use letters, digits and underscores (at most 64).") }),
-							/* @__PURE__ */ jsx(FieldError, {
-								message: error,
-								testId: "search-attribute-error"
-							}),
-							/* @__PURE__ */ jsx(Button$1, {
-								onClick: () => void create(),
-								disabled: !validName || busy,
-								"data-testid": "search-attribute-create",
-								children: tr("fluidgrids.settings.searchAttributes.create", "Add attribute")
-							})
-						]
-					})
-				]
-			})
-		]
+				}),
+				/* @__PURE__ */ jsxs("label", {
+					className: "flex items-center justify-between gap-3 text-sm",
+					children: [tr("fluidgrids.settings.codec.credentials", "Send my browser's own credentials (cookies) to it"), /* @__PURE__ */ jsx(Switch, {
+						checked: includeCredentials,
+						disabled: !canEdit,
+						onCheckedChange: setIncludeCredentials,
+						"data-testid": "codec-credentials"
+					})]
+				}),
+				/* @__PURE__ */ jsx(FieldError, {
+					message: error,
+					testId: "codec-error"
+				}),
+				canEdit && /* @__PURE__ */ jsx(Button$1, {
+					onClick: () => void save(),
+					disabled: busy || check !== null && !check.ok,
+					"data-testid": "codec-save",
+					children: tr("fluidgrids.settings.common.save", "Save")
+				})
+			]
+		})]
 	});
 }
-/** An IAM role ARN in another account (the service refuses its own). */
-const ROLE_ARN = /^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/;
-/** An S3 bucket name. */
-const BUCKET_NAME = /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/;
-function ArchiveSettingsCard() {
+
+// src/modules/settings/utils/error-trigger.ts
+/**
+* Error Workflow setting (BOFF-7514): the chosen workflow starts at its Error
+* Trigger node, so one without that node never starts. Mirrors the backend's
+* `findErrorTriggerNodeId` in wspace-workflow-svc.
+*/
+const ERROR_TRIGGER_NODE_TYPE = "internal:error-trigger";
+function asRecord(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+/** Reads `data.nodes`, falling back to the legacy top-level `nodes`. */
+function hasErrorTriggerNode(definitionJson) {
+	const definition = asRecord(definitionJson);
+	const dataNodes = asRecord(definition?.data)?.nodes;
+	const nodes = Array.isArray(dataNodes) ? dataNodes : definition?.nodes;
+	return Array.isArray(nodes) && nodes.some((node) => asRecord(node)?.type === "internal:error-trigger");
+}
+
+// src/modules/settings/utils/optional-positive-int.ts
+/**
+* Number inputs whose empty value means "no limit" — Max parallel executions
+* (BOFF-7647) and Timeout in seconds (BOFF-7514). Empty is also what an unset
+* value means to the engine; anything else is clamped to a whole number of at
+* least 1.
+*/
+function parseOptionalPositiveInt(value) {
+	if (value.trim() === "") return void 0;
+	const parsed = Number(value);
+	return Number.isFinite(parsed) ? Math.max(1, Math.trunc(parsed)) : void 0;
+}
+
+// src/modules/observability/types.ts
+const LOG_STREAM_EVENT_TYPES = [
+	"LOG_ERROR",
+	"LOG_WARN",
+	"NODE_FAILED",
+	"NODE_RETRIED",
+	"RUN_CANCELLED",
+	"RUN_COMPLETED",
+	"RUN_FAILED",
+	"RUN_STARTED"
+];
+
+// src/modules/observability/components/LogStreamingTab.tsx
+const DEFAULT_EVENT_FILTERS = [
+	"RUN_FAILED",
+	"NODE_FAILED",
+	"LOG_ERROR"
+];
+const PROVIDERS = [
+	"WEBHOOK",
+	"SYSLOG",
+	"SENTRY"
+];
+function emptyForm() {
+	return {
+		name: "",
+		provider: "WEBHOOK",
+		endpoint: "",
+		eventFilters: DEFAULT_EVENT_FILTERS,
+		isEnabled: true,
+		secret: "",
+		configText: "{}"
+	};
+}
+function formFromDestination(destination) {
+	return {
+		name: destination.name,
+		provider: destination.provider,
+		endpoint: destination.endpoint,
+		eventFilters: destination.eventFilters,
+		isEnabled: destination.isEnabled,
+		secret: "",
+		configText: JSON.stringify(destination.config ?? {}, null, 2)
+	};
+}
+function eventLabel(event) {
+	return event.toLowerCase().split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+}
+function endpointPlaceholder(provider) {
+	switch (provider) {
+		case "SYSLOG": return "logs.example.com:514";
+		case "SENTRY": return "https://public@sentry.example/1";
+		case "WEBHOOK": return "https://hooks.example.com/workflows";
+	}
+}
+function parseConfig(configText) {
+	try {
+		const parsed = JSON.parse(configText || "{}");
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+		return parsed;
+	} catch {
+		return null;
+	}
+}
+function formToInput(form) {
+	const config = parseConfig(form.configText);
+	if (!config || !form.name.trim() || !form.endpoint.trim()) return null;
+	return {
+		name: form.name.trim(),
+		provider: form.provider,
+		endpoint: form.endpoint.trim(),
+		eventFilters: form.eventFilters,
+		isEnabled: form.isEnabled,
+		config,
+		...form.secret ? { secret: form.secret } : {}
+	};
+}
+/**
+* Log stream destinations settings. Gated by the `fluidgrids.log-streams`
+* kill switch: when an admin turns it off for the workspace, the tab explains
+* that instead of loading destinations the backend would refuse to change.
+*/
+function LogStreamingTab() {
+	if (!useFluidGridsFlag(FLUIDGRIDS_FLAGS.logStreams)) return /* @__PURE__ */ jsx(LogStreamingDisabledNotice, {});
+	return /* @__PURE__ */ jsx(LogStreamingSettings, {});
+}
+function LogStreamingDisabledNotice() {
 	const tr = useTr();
-	const archive = useResource("archive-settings", true, fetchArchiveSettings);
-	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_DELETE);
-	const [form, setForm] = useState({
-		enabled: false,
-		bucket: "",
-		prefix: "",
-		region: "",
-		roleArn: "",
-		includePayloads: true
+	return /* @__PURE__ */ jsx(Card, {
+		className: "bg-background-secondary border-border-secondary",
+		"data-testid": "log-streaming-disabled",
+		children: /* @__PURE__ */ jsxs(CardContent, {
+			className: "flex items-start gap-3 p-6",
+			children: [/* @__PURE__ */ jsx(Icon, {
+				icon: "mdi:transit-connection-variant",
+				width: 20,
+				className: "mt-0.5 shrink-0 text-text-tertiary",
+				"aria-hidden": "true"
+			}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h2", {
+				className: "text-base font-semibold text-text-primary",
+				children: tr("fluidgrids.settings.logStreaming.disabledTitle", "Log streaming is turned off")
+			}), /* @__PURE__ */ jsx("p", {
+				className: "mt-1 text-sm text-text-secondary",
+				children: tr("fluidgrids.settings.logStreaming.disabledBody", "An administrator has turned off log streaming for this workspace. Run events are not forwarded to external destinations.")
+			})] })]
+		})
 	});
-	const [busy, setBusy] = useState(false);
-	const [error, setError] = useState(null);
+}
+function LogStreamingSettings() {
+	const tr = useTr();
+	const { destinations, loading, error, refetch } = useLogStreamDestinations();
+	const actions = useLogStreamDestinationActions();
+	const [form, setForm] = useState(emptyForm);
+	const [editingId, setEditingId] = useState(null);
+	const [showForm, setShowForm] = useState(false);
+	const editingDestination = useMemo(() => destinations.find((destination) => destination.id === editingId), [destinations, editingId]);
 	useEffect(() => {
-		const current = archive.data;
-		if (current) setForm({
-			enabled: current.enabled,
-			bucket: current.bucket,
-			prefix: current.prefix,
-			region: current.region,
-			roleArn: current.roleArn,
-			includePayloads: current.includePayloads
-		});
-	}, [archive.data]);
-	const valid = BUCKET_NAME.test(form.bucket.trim()) && /^[a-z]{2}-[a-z]+-\d$/.test(form.region.trim()) && ROLE_ARN.test(form.roleArn.trim());
-	const save = async () => {
-		if (!valid) return;
-		setBusy(true);
-		setError(null);
-		try {
-			archive.set(await saveArchiveSettings({
-				enabled: form.enabled,
-				bucket: form.bucket.trim(),
-				prefix: form.prefix.trim().replace(/^\/+|\/+$/g, ""),
-				region: form.region.trim(),
-				roleArn: form.roleArn.trim(),
-				includePayloads: form.includePayloads
-			}));
-			toast.success(tr("fluidgrids.settings.archive.saved", "Archive destination saved"));
-		} catch (err) {
-			setError(describeOperationError(err));
-		} finally {
-			setBusy(false);
+		if (editingDestination) setForm(formFromDestination(editingDestination));
+	}, [editingDestination]);
+	const resetForm = useCallback(() => {
+		setForm(emptyForm());
+		setEditingId(null);
+		setShowForm(false);
+	}, []);
+	const save = useCallback(async () => {
+		const input = formToInput(form);
+		if (!input) {
+			toast.error(tr("fluidgrids.settings.logStreaming.invalidForm", "Enter a name, endpoint, and valid JSON configuration."));
+			return;
 		}
-	};
-	const clear = async () => {
-		setBusy(true);
-		setError(null);
-		try {
-			await clearArchiveSettings();
-			archive.set(null);
-			setForm({
-				enabled: false,
-				bucket: "",
-				prefix: "",
-				region: "",
-				roleArn: "",
-				includePayloads: true
-			});
-		} catch (err) {
-			setError(describeOperationError(err));
-		} finally {
-			setBusy(false);
+		const result = editingId ? await actions.update(editingId, input) : await actions.create(input);
+		if (!result?.success) {
+			toast.error(result?.message || tr("fluidgrids.settings.logStreaming.saveFailed", "Could not save log streaming destination."));
+			return;
 		}
-	};
-	return /* @__PURE__ */ jsxs(Card$1, {
-		icon: "mdi:archive-arrow-down-outline",
-		title: tr("fluidgrids.settings.archive.title", "Run archive"),
-		description: tr("fluidgrids.settings.archive.description", "Before retention deletes a finished run, it is written to an S3 bucket in your AWS account. The service assumes your role with this workspace's id as the external id, and checks the destination with a probe object when you enable it."),
-		testId: "settings-archive",
-		children: [
-			archive.data && archive.data.failingRuns > 0 && /* @__PURE__ */ jsx("div", {
-				role: "status",
-				className: "mb-4 rounded-md border border-[var(--color-status-warning-border)] bg-[var(--color-status-warning-bg-subtle)] p-3 text-sm text-[var(--color-status-warning-text)]",
-				"data-testid": "archive-failing",
-				children: tr("fluidgrids.settings.archive.failing", "{{count}} runs could not be archived, so their purge waits. Last error: {{error}}", {
-					count: archive.data.failingRuns,
-					error: archive.data.lastError ?? "—"
-				})
-			}),
-			/* @__PURE__ */ jsx(FieldError, { message: archive.error }),
-			/* @__PURE__ */ jsxs("div", {
-				className: "grid gap-3 sm:grid-cols-2",
-				children: [
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "archive-bucket",
-							children: tr("fluidgrids.settings.archive.bucket", "Bucket")
-						}), /* @__PURE__ */ jsx(Input, {
-							id: "archive-bucket",
-							value: form.bucket,
-							disabled: !canEdit,
-							onChange: (event) => setForm({
-								...form,
-								bucket: event.target.value
-							}),
-							"data-testid": "archive-bucket"
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "archive-prefix",
-							children: tr("fluidgrids.settings.archive.prefix", "Key prefix (optional)")
-						}), /* @__PURE__ */ jsx(Input, {
-							id: "archive-prefix",
-							value: form.prefix,
-							disabled: !canEdit,
-							onChange: (event) => setForm({
-								...form,
-								prefix: event.target.value
-							}),
-							"data-testid": "archive-prefix"
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "archive-region",
-							children: tr("fluidgrids.settings.archive.region", "Region")
-						}), /* @__PURE__ */ jsx(Input, {
-							id: "archive-region",
-							value: form.region,
-							placeholder: "ap-south-1",
-							disabled: !canEdit,
-							onChange: (event) => setForm({
-								...form,
-								region: event.target.value
-							}),
-							"data-testid": "archive-region"
-						})]
-					}),
-					/* @__PURE__ */ jsxs("div", {
-						className: "space-y-1.5",
-						children: [/* @__PURE__ */ jsx(Label, {
-							htmlFor: "archive-role",
-							children: tr("fluidgrids.settings.archive.roleArn", "Role ARN")
-						}), /* @__PURE__ */ jsx(Input, {
-							id: "archive-role",
-							value: form.roleArn,
-							placeholder: "arn:aws:iam::123456789012:role/fluidgrids-archive",
-							disabled: !canEdit,
-							onChange: (event) => setForm({
-								...form,
-								roleArn: event.target.value
-							}),
-							"data-testid": "archive-role"
-						})]
-					}),
-					/* @__PURE__ */ jsxs("label", {
-						className: "flex items-center justify-between gap-3 text-sm sm:col-span-2",
-						children: [tr("fluidgrids.settings.archive.includePayloads", "Include payloads, inputs and outputs"), /* @__PURE__ */ jsx(Switch, {
-							checked: form.includePayloads,
-							disabled: !canEdit,
-							onCheckedChange: (includePayloads) => setForm({
-								...form,
-								includePayloads
-							})
-						})]
-					}),
-					/* @__PURE__ */ jsxs("label", {
-						className: "flex items-center justify-between gap-3 text-sm sm:col-span-2",
-						children: [tr("fluidgrids.settings.archive.enabled", "Archive runs before they are purged"), /* @__PURE__ */ jsx(Switch, {
-							checked: form.enabled,
-							disabled: !canEdit,
-							onCheckedChange: (enabled) => setForm({
-								...form,
-								enabled
-							}),
-							"data-testid": "archive-enabled"
-						})]
-					})
-				]
-			}),
-			/* @__PURE__ */ jsx(FieldError, {
-				message: error,
-				testId: "archive-error"
+		toast.success(tr("fluidgrids.settings.logStreaming.saved", "Log streaming destination saved."));
+		resetForm();
+		await refetch();
+	}, [
+		actions,
+		editingId,
+		form,
+		refetch,
+		resetForm,
+		tr
+	]);
+	const remove = useCallback(async (destination) => {
+		if (!window.confirm(`Delete “${destination.name}”?`)) return;
+		const result = await actions.remove(destination.id);
+		if (!result?.success) {
+			toast.error(result?.message || tr("fluidgrids.settings.logStreaming.deleteFailed", "Could not delete destination."));
+			return;
+		}
+		toast.success(tr("fluidgrids.settings.logStreaming.deleted", "Log streaming destination deleted."));
+		if (editingId === destination.id) resetForm();
+		await refetch();
+	}, [
+		actions,
+		editingId,
+		refetch,
+		resetForm,
+		tr
+	]);
+	const sendTest = useCallback(async (destination) => {
+		const result = await actions.test(destination.id);
+		if (!result) return;
+		if (result.success) toast.success(tr("fluidgrids.settings.logStreaming.testSucceeded", "Test event delivered."));
+		else toast.error(result.message || tr("fluidgrids.settings.logStreaming.testFailed", "Test event could not be delivered."));
+		await refetch();
+	}, [
+		actions,
+		refetch,
+		tr
+	]);
+	const toggleEvent = (event) => {
+		setForm((current) => ({
+			...current,
+			eventFilters: current.eventFilters.includes(event) ? current.eventFilters.filter((item) => item !== event) : [...current.eventFilters, event]
+		}));
+	};
+	return /* @__PURE__ */ jsxs("div", {
+		className: "space-y-6",
+		children: [
+			/* @__PURE__ */ jsxs("div", {
+				className: "flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",
+				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h2", {
+					className: "text-lg font-semibold text-text-primary",
+					children: tr("fluidgrids.settings.logStreaming.title", "Log streaming")
+				}), /* @__PURE__ */ jsx("p", {
+					className: "mt-1 max-w-2xl text-sm text-text-secondary",
+					children: tr("fluidgrids.settings.logStreaming.description", "Send workflow run and node events to workspace-managed observability destinations. Secrets are write-only and never returned.")
+				})] }), /* @__PURE__ */ jsxs(Button$1, {
+					onClick: () => {
+						setForm(emptyForm());
+						setEditingId(null);
+						setShowForm(true);
+					},
+					disabled: actions.loading,
+					children: [/* @__PURE__ */ jsx(Icon, {
+						icon: "mdi:plus",
+						className: "mr-1",
+						width: 16
+					}), tr("fluidgrids.settings.logStreaming.add", "Add destination")]
+				})]
 			}),
-			canEdit && /* @__PURE__ */ jsxs("div", {
-				className: "mt-4 flex gap-2",
-				children: [/* @__PURE__ */ jsx(Button$1, {
-					onClick: () => void save(),
-					disabled: !valid || busy,
-					"data-testid": "archive-save",
-					children: tr("fluidgrids.settings.common.save", "Save")
-				}), archive.data && /* @__PURE__ */ jsx(Button$1, {
+			error && /* @__PURE__ */ jsxs("div", {
+				role: "alert",
+				className: "rounded-lg border border-status-error-border bg-status-error-bg-subtle p-4 text-sm text-status-error-text",
+				children: [error.message, /* @__PURE__ */ jsx(Button$1, {
 					variant: "outline",
-					onClick: () => void clear(),
-					disabled: busy,
-					"data-testid": "archive-clear",
-					children: tr("fluidgrids.settings.archive.remove", "Remove destination")
+					size: "sm",
+					className: "ml-3",
+					onClick: () => void refetch(),
+					children: tr("fluidgrids.settings.logStreaming.retry", "Retry")
 				})]
-			})
-		]
-	});
-}
-function CodecServerCard() {
-	const tr = useTr();
-	const settings = useResource("codec-server", true, fetchCodecServerSettings);
-	const { allowed: canEdit } = useFluidGridsPermission(FLUIDGRIDS_PERMISSIONS.WORKFLOW_DELETE);
-	const [url, setUrl] = useState("");
-	const [includeCredentials, setIncludeCredentials] = useState(false);
-	const [busy, setBusy] = useState(false);
-	const [error, setError] = useState(null);
-	useEffect(() => {
-		if (!settings.data) return;
-		setUrl(settings.data.codecServerUrl ?? "");
-		setIncludeCredentials(settings.data.codecServerIncludeCredentials);
-	}, [settings.data]);
-	const check = url.trim() ? checkCodecServerUrl(url) : null;
-	const save = async () => {
-		if (check && !check.ok) return;
-		setBusy(true);
-		setError(null);
-		try {
-			settings.set(await saveCodecServerSettings({
-				codecServerUrl: url.trim(),
-				codecServerIncludeCredentials: includeCredentials
-			}));
-			toast.success(tr("fluidgrids.settings.codec.saved", "Codec server saved"));
-		} catch (err) {
-			setError(describeOperationError(err));
-		} finally {
-			setBusy(false);
-		}
-	};
-	return /* @__PURE__ */ jsxs(Card$1, {
-		icon: "mdi:lock-open-outline",
-		title: tr("fluidgrids.settings.codec.title", "Codec server"),
-		description: tr("fluidgrids.settings.codec.description", "Payloads your self-hosted workers encode stay encoded in FluidGrids. The run page can send them to your codec server (Temporal's codec-server protocol) to show them decoded. No FluidGrids token is ever sent there."),
-		testId: "settings-codec",
-		children: [/* @__PURE__ */ jsx(FieldError, { message: settings.error }), /* @__PURE__ */ jsxs("div", {
-			className: "space-y-3",
-			children: [
-				/* @__PURE__ */ jsxs("div", {
-					className: "space-y-1.5",
+			}),
+			showForm && /* @__PURE__ */ jsxs(Card, {
+				className: "border-border-secondary bg-background-secondary",
+				children: [/* @__PURE__ */ jsx(CardHeader, { children: /* @__PURE__ */ jsxs("div", {
+					className: "flex items-center justify-between gap-3",
+					children: [/* @__PURE__ */ jsx("h3", {
+						className: "font-medium text-text-primary",
+						children: editingId ? tr("fluidgrids.settings.logStreaming.edit", "Edit destination") : tr("fluidgrids.settings.logStreaming.new", "New destination")
+					}), /* @__PURE__ */ jsx(Button$1, {
+						variant: "ghost",
+						size: "sm",
+						onClick: resetForm,
+						children: /* @__PURE__ */ jsx(Icon, {
+							icon: "mdi:close",
+							width: 18
+						})
+					})]
+				}) }), /* @__PURE__ */ jsxs(CardContent, {
+					className: "space-y-5",
 					children: [
-						/* @__PURE__ */ jsx(Label, {
-							htmlFor: "codec-url",
-							children: tr("fluidgrids.settings.codec.url", "Codec server URL")
+						/* @__PURE__ */ jsxs("div", {
+							className: "grid gap-4 md:grid-cols-2",
+							children: [/* @__PURE__ */ jsxs("div", {
+								className: "space-y-2",
+								children: [/* @__PURE__ */ jsx(Label, {
+									htmlFor: "log-stream-name",
+									children: tr("fluidgrids.settings.logStreaming.name", "Name")
+								}), /* @__PURE__ */ jsx(Input, {
+									id: "log-stream-name",
+									value: form.name,
+									onChange: (event) => setForm((current) => ({
+										...current,
+										name: event.target.value
+									})),
+									placeholder: "Production error stream"
+								})]
+							}), /* @__PURE__ */ jsxs("div", {
+								className: "space-y-2",
+								children: [/* @__PURE__ */ jsx(Label, {
+									htmlFor: "log-stream-provider",
+									children: tr("fluidgrids.settings.logStreaming.provider", "Provider")
+								}), /* @__PURE__ */ jsx("select", {
+									id: "log-stream-provider",
+									value: form.provider,
+									onChange: (event) => setForm((current) => ({
+										...current,
+										provider: event.target.value,
+										endpoint: ""
+									})),
+									className: "w-full rounded-md border border-border-secondary bg-background-primary px-3 py-2 text-sm text-text-primary",
+									children: PROVIDERS.map((provider) => /* @__PURE__ */ jsx("option", {
+										value: provider,
+										children: provider
+									}, provider))
+								})]
+							})]
 						}),
-						/* @__PURE__ */ jsx(Input, {
-							id: "codec-url",
-							value: url,
-							disabled: !canEdit,
-							placeholder: "https://codec.example.com",
-							onChange: (event) => setUrl(event.target.value),
-							"data-testid": "codec-url"
+						/* @__PURE__ */ jsxs("div", {
+							className: "space-y-2",
+							children: [/* @__PURE__ */ jsx(Label, {
+								htmlFor: "log-stream-endpoint",
+								children: tr("fluidgrids.settings.logStreaming.endpoint", "Endpoint")
+							}), /* @__PURE__ */ jsx(Input, {
+								id: "log-stream-endpoint",
+								value: form.endpoint,
+								onChange: (event) => setForm((current) => ({
+									...current,
+									endpoint: event.target.value
+								})),
+								placeholder: endpointPlaceholder(form.provider),
+								type: form.provider === "WEBHOOK" || form.provider === "SENTRY" ? "url" : "text"
+							})]
 						}),
-						check && !check.ok && /* @__PURE__ */ jsx(FieldError, {
-							message: tr("fluidgrids.settings.codec.badUrl", "Use an https URL (http only for localhost)."),
-							testId: "codec-url-error"
+						form.provider === "WEBHOOK" && /* @__PURE__ */ jsxs("div", {
+							className: "space-y-2",
+							children: [/* @__PURE__ */ jsx(Label, {
+								htmlFor: "log-stream-secret",
+								children: tr("fluidgrids.settings.logStreaming.secret", "Signing secret")
+							}), /* @__PURE__ */ jsx(Input, {
+								id: "log-stream-secret",
+								value: form.secret,
+								onChange: (event) => setForm((current) => ({
+									...current,
+									secret: event.target.value
+								})),
+								placeholder: editingId ? "Leave blank to keep the current secret" : "Enter a signing secret",
+								type: "password",
+								autoComplete: "new-password"
+							})]
+						}),
+						/* @__PURE__ */ jsxs("div", {
+							className: "space-y-2",
+							children: [/* @__PURE__ */ jsx(Label, {
+								htmlFor: "log-stream-config",
+								children: tr("fluidgrids.settings.logStreaming.config", "Provider configuration (JSON)")
+							}), /* @__PURE__ */ jsx("textarea", {
+								id: "log-stream-config",
+								value: form.configText,
+								onChange: (event) => setForm((current) => ({
+									...current,
+									configText: event.target.value
+								})),
+								className: "min-h-24 w-full rounded-md border border-border-secondary bg-background-primary px-3 py-2 font-mono text-xs text-text-primary",
+								spellCheck: false
+							})]
+						}),
+						/* @__PURE__ */ jsxs("fieldset", {
+							className: "space-y-2",
+							children: [/* @__PURE__ */ jsx("legend", {
+								className: "text-sm font-medium text-text-primary",
+								children: tr("fluidgrids.settings.logStreaming.events", "Events to stream")
+							}), /* @__PURE__ */ jsx("div", {
+								className: "grid gap-2 sm:grid-cols-2 lg:grid-cols-4",
+								children: LOG_STREAM_EVENT_TYPES.map((event) => /* @__PURE__ */ jsxs("label", {
+									className: "flex items-center gap-2 text-sm text-text-secondary",
+									children: [/* @__PURE__ */ jsx("input", {
+										type: "checkbox",
+										checked: form.eventFilters.includes(event),
+										onChange: () => toggleEvent(event),
+										className: "size-4 rounded border-border-secondary accent-action-primary-bg"
+									}), eventLabel(event)]
+								}, event))
+							})]
+						}),
+						/* @__PURE__ */ jsxs("label", {
+							className: "flex items-center gap-2 text-sm text-text-secondary",
+							children: [/* @__PURE__ */ jsx("input", {
+								type: "checkbox",
+								checked: form.isEnabled,
+								onChange: (event) => setForm((current) => ({
+									...current,
+									isEnabled: event.target.checked
+								})),
+								className: "size-4 rounded border-border-secondary accent-action-primary-bg"
+							}), tr("fluidgrids.settings.logStreaming.enabled", "Destination enabled")]
 						}),
-						/* @__PURE__ */ jsx("p", {
-							className: "text-xs text-text-secondary",
-							children: tr("fluidgrids.settings.codec.empty", "Leave it empty to show encoded payloads as encoded.")
+						/* @__PURE__ */ jsxs("div", {
+							className: "flex justify-end gap-2",
+							children: [/* @__PURE__ */ jsx(Button$1, {
+								variant: "outline",
+								onClick: resetForm,
+								children: tr("fluidgrids.settings.logStreaming.cancel", "Cancel")
+							}), /* @__PURE__ */ jsx(Button$1, {
+								"data-agent": "confirm",
+								onClick: () => void save(),
+								disabled: actions.loading,
+								children: actions.loading ? tr("fluidgrids.settings.logStreaming.saving", "Saving…") : tr("fluidgrids.settings.logStreaming.save", "Save destination")
+							})]
 						})
 					]
-				}),
-				/* @__PURE__ */ jsxs("label", {
-					className: "flex items-center justify-between gap-3 text-sm",
-					children: [tr("fluidgrids.settings.codec.credentials", "Send my browser's own credentials (cookies) to it"), /* @__PURE__ */ jsx(Switch, {
-						checked: includeCredentials,
-						disabled: !canEdit,
-						onCheckedChange: setIncludeCredentials,
-						"data-testid": "codec-credentials"
-					})]
-				}),
-				/* @__PURE__ */ jsx(FieldError, {
-					message: error,
-					testId: "codec-error"
-				}),
-				canEdit && /* @__PURE__ */ jsx(Button$1, {
-					onClick: () => void save(),
-					disabled: busy || check !== null && !check.ok,
-					"data-testid": "codec-save",
-					children: tr("fluidgrids.settings.common.save", "Save")
-				})
-			]
-		})]
-	});
-}
-
-// src/modules/settings/utils/error-trigger.ts
-/**
-* Error Workflow setting (BOFF-7514): the chosen workflow starts at its Error
-* Trigger node, so one without that node never starts. Mirrors the backend's
-* `findErrorTriggerNodeId` in wspace-workflow-svc.
-*/
-const ERROR_TRIGGER_NODE_TYPE = "internal:error-trigger";
-function asRecord(value) {
-	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-/** Reads `data.nodes`, falling back to the legacy top-level `nodes`. */
-function hasErrorTriggerNode(definitionJson) {
-	const definition = asRecord(definitionJson);
-	const dataNodes = asRecord(definition?.data)?.nodes;
-	const nodes = Array.isArray(dataNodes) ? dataNodes : definition?.nodes;
-	return Array.isArray(nodes) && nodes.some((node) => asRecord(node)?.type === "internal:error-trigger");
-}
-
-// src/modules/settings/utils/optional-positive-int.ts
-/**
-* Number inputs whose empty value means "no limit" — Max parallel executions
-* (BOFF-7647) and Timeout in seconds (BOFF-7514). Empty is also what an unset
-* value means to the engine; anything else is clamped to a whole number of at
-* least 1.
-*/
-function parseOptionalPositiveInt(value) {
-	if (value.trim() === "") return void 0;
-	const parsed = Number(value);
-	return Number.isFinite(parsed) ? Math.max(1, Math.trunc(parsed)) : void 0;
-}
-
-// src/modules/observability/types.ts
-const LOG_STREAM_EVENT_TYPES = [
-	"LOG_ERROR",
-	"LOG_WARN",
-	"NODE_FAILED",
-	"NODE_RETRIED",
-	"RUN_CANCELLED",
-	"RUN_COMPLETED",
-	"RUN_FAILED",
-	"RUN_STARTED"
-];
-
-// src/modules/observability/components/LogStreamingTab.tsx
-const DEFAULT_EVENT_FILTERS = [
-	"RUN_FAILED",
-	"NODE_FAILED",
-	"LOG_ERROR"
-];
-const PROVIDERS = [
-	"WEBHOOK",
-	"SYSLOG",
-	"SENTRY"
-];
-function emptyForm() {
-	return {
-		name: "",
-		provider: "WEBHOOK",
-		endpoint: "",
-		eventFilters: DEFAULT_EVENT_FILTERS,
-		isEnabled: true,
-		secret: "",
-		configText: "{}"
-	};
-}
-function formFromDestination(destination) {
-	return {
-		name: destination.name,
-		provider: destination.provider,
-		endpoint: destination.endpoint,
-		eventFilters: destination.eventFilters,
-		isEnabled: destination.isEnabled,
-		secret: "",
-		configText: JSON.stringify(destination.config ?? {}, null, 2)
-	};
-}
-function eventLabel(event) {
-	return event.toLowerCase().split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
-}
-function endpointPlaceholder(provider) {
-	switch (provider) {
-		case "SYSLOG": return "logs.example.com:514";
-		case "SENTRY": return "https://public@sentry.example/1";
-		case "WEBHOOK": return "https://hooks.example.com/workflows";
-	}
-}
-function parseConfig(configText) {
-	try {
-		const parsed = JSON.parse(configText || "{}");
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-		return parsed;
-	} catch {
-		return null;
-	}
-}
-function formToInput(form) {
-	const config = parseConfig(form.configText);
-	if (!config || !form.name.trim() || !form.endpoint.trim()) return null;
-	return {
-		name: form.name.trim(),
-		provider: form.provider,
-		endpoint: form.endpoint.trim(),
-		eventFilters: form.eventFilters,
-		isEnabled: form.isEnabled,
-		config,
-		...form.secret ? { secret: form.secret } : {}
-	};
+				})]
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "space-y-3",
+				children: [
+					loading && destinations.length === 0 && /* @__PURE__ */ jsx("div", {
+						className: "rounded-lg border border-border-secondary bg-background-secondary p-6 text-sm text-text-secondary",
+						children: tr("fluidgrids.settings.logStreaming.loading", "Loading destinations…")
+					}),
+					!loading && destinations.length === 0 && /* @__PURE__ */ jsxs("div", {
+						className: "rounded-lg border border-dashed border-border-secondary bg-background-secondary p-8 text-center",
+						children: [
+							/* @__PURE__ */ jsx(Icon, {
+								icon: "mdi:transit-connection-variant",
+								className: "mx-auto mb-3 text-text-secondary",
+								width: 32
+							}),
+							/* @__PURE__ */ jsx("p", {
+								className: "font-medium text-text-primary",
+								children: tr("fluidgrids.settings.logStreaming.emptyTitle", "No log destinations yet")
+							}),
+							/* @__PURE__ */ jsx("p", {
+								className: "mt-1 text-sm text-text-secondary",
+								children: tr("fluidgrids.settings.logStreaming.emptyDescription", "Add a webhook, syslog target, or Sentry DSN to start streaming events.")
+							})
+						]
+					}),
+					destinations.map((destination) => /* @__PURE__ */ jsx(Card, {
+						className: "border-border-secondary bg-background-secondary",
+						children: /* @__PURE__ */ jsxs(CardContent, {
+							className: "flex flex-col gap-4 p-4 sm:flex-row sm:items-center sm:justify-between",
+							children: [/* @__PURE__ */ jsxs("div", {
+								className: "min-w-0",
+								children: [
+									/* @__PURE__ */ jsxs("div", {
+										className: "flex flex-wrap items-center gap-2",
+										children: [
+											/* @__PURE__ */ jsx("h3", {
+												className: "font-medium text-text-primary",
+												children: destination.name
+											}),
+											/* @__PURE__ */ jsx("span", {
+												className: "rounded-full bg-background-tertiary px-2 py-0.5 text-xs text-text-secondary",
+												children: destination.provider
+											}),
+											/* @__PURE__ */ jsx("span", {
+												className: destination.isEnabled ? "text-xs text-status-success-text" : "text-xs text-text-secondary",
+												children: destination.isEnabled ? tr("fluidgrids.settings.logStreaming.enabledBadge", "Enabled") : tr("fluidgrids.settings.logStreaming.disabledBadge", "Disabled")
+											})
+										]
+									}),
+									/* @__PURE__ */ jsx("p", {
+										className: "mt-1 truncate text-sm text-text-secondary",
+										children: destination.endpoint
+									}),
+									/* @__PURE__ */ jsxs("p", {
+										className: "mt-1 text-xs text-text-secondary",
+										children: [destination.eventFilters.length > 0 ? destination.eventFilters.map(eventLabel).join(", ") : tr("fluidgrids.settings.logStreaming.allEvents", "All events"), destination.hasSecret && " · Secret configured"]
+									}),
+									destination.lastDispatchError && /* @__PURE__ */ jsx("p", {
+										className: "mt-2 text-xs text-status-error-text",
+										children: destination.lastDispatchError
+									})
+								]
+							}), /* @__PURE__ */ jsxs("div", {
+								className: "flex shrink-0 flex-wrap gap-2",
+								children: [
+									/* @__PURE__ */ jsxs(Button$1, {
+										variant: "outline",
+										size: "sm",
+										onClick: () => void sendTest(destination),
+										disabled: actions.loading,
+										children: [/* @__PURE__ */ jsx(Icon, {
+											icon: "mdi:send-check-outline",
+											className: "mr-1",
+											width: 15
+										}), tr("fluidgrids.settings.logStreaming.test", "Send test")]
+									}),
+									/* @__PURE__ */ jsx(Button$1, {
+										variant: "outline",
+										size: "sm",
+										onClick: () => {
+											setEditingId(destination.id);
+											setShowForm(true);
+										},
+										disabled: actions.loading,
+										children: tr("fluidgrids.settings.logStreaming.editButton", "Edit")
+									}),
+									/* @__PURE__ */ jsxs(Button$1, {
+										variant: "ghost",
+										size: "sm",
+										onClick: () => void remove(destination),
+										disabled: actions.loading,
+										children: [/* @__PURE__ */ jsx(Icon, {
+											icon: "mdi:trash-can-outline",
+											className: "text-status-error-text",
+											width: 17
+										}), /* @__PURE__ */ jsx("span", {
+											className: "sr-only",
+											children: tr("fluidgrids.settings.logStreaming.delete", "Delete")
+										})]
+									})
+								]
+							})]
+						})
+					}, destination.id))
+				]
+			})
+		]
+	});
 }
+
+// src/modules/agent-definitions/components/AgentsTab.tsx
 /**
-* Log stream destinations settings. Gated by the `fluidgrids.log-streams`
-* kill switch: when an admin turns it off for the workspace, the tab explains
-* that instead of loading destinations the backend would refuse to change.
+* Settings → Agents (BOFF-9962): FluidGrids agents with their own identity.
+*
+* Builders create an agent, choose the tools it may call (node type and operations) and the
+* connections those tools may use, and can require approval for every tool call. Each person
+* lets the agent act for them with a time-boxed grant (30 days by default, 365 at most) and can
+* withdraw it at any time; admins can revoke anyone's grant. An AI Agent node that names the agent
+* runs its tools as "agent for user", and every call is recorded under both identities. Giving an
+* agent more access withdraws other people's grants until they grant again.
 */
-function LogStreamingTab() {
-	if (!useFluidGridsFlag(FLUIDGRIDS_FLAGS.logStreams)) return /* @__PURE__ */ jsx(LogStreamingDisabledNotice, {});
-	return /* @__PURE__ */ jsx(LogStreamingSettings, {});
-}
-function LogStreamingDisabledNotice() {
-	const tr = useTr();
-	return /* @__PURE__ */ jsx(Card, {
-		className: "bg-background-secondary border-border-secondary",
-		"data-testid": "log-streaming-disabled",
-		children: /* @__PURE__ */ jsxs(CardContent, {
-			className: "flex items-start gap-3 p-6",
-			children: [/* @__PURE__ */ jsx(Icon, {
-				icon: "mdi:transit-connection-variant",
-				width: 20,
-				className: "mt-0.5 shrink-0 text-text-tertiary",
-				"aria-hidden": "true"
-			}), /* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h2", {
-				className: "text-base font-semibold text-text-primary",
-				children: tr("fluidgrids.settings.logStreaming.disabledTitle", "Log streaming is turned off")
-			}), /* @__PURE__ */ jsx("p", {
-				className: "mt-1 text-sm text-text-secondary",
-				children: tr("fluidgrids.settings.logStreaming.disabledBody", "An administrator has turned off log streaming for this workspace. Run events are not forwarded to external destinations.")
-			})] })]
-		})
-	});
+function errorMessage$1(err) {
+	if (err instanceof AgentFormError) return err.message;
+	return describeOperationError(err);
 }
-function LogStreamingSettings() {
+function AgentEditor({ initial, onCancel, onSave }) {
 	const tr = useTr();
-	const { destinations, loading, error, refetch } = useLogStreamDestinations();
-	const actions = useLogStreamDestinationActions();
-	const [form, setForm] = useState(emptyForm);
-	const [editingId, setEditingId] = useState(null);
-	const [showForm, setShowForm] = useState(false);
-	const editingDestination = useMemo(() => destinations.find((destination) => destination.id === editingId), [destinations, editingId]);
-	useEffect(() => {
-		if (editingDestination) setForm(formFromDestination(editingDestination));
-	}, [editingDestination]);
-	const resetForm = useCallback(() => {
-		setForm(emptyForm());
-		setEditingId(null);
-		setShowForm(false);
-	}, []);
-	const save = useCallback(async () => {
-		const input = formToInput(form);
-		if (!input) {
-			toast.error(tr("fluidgrids.settings.logStreaming.invalidForm", "Enter a name, endpoint, and valid JSON configuration."));
-			return;
-		}
-		const result = editingId ? await actions.update(editingId, input) : await actions.create(input);
-		if (!result?.success) {
-			toast.error(result?.message || tr("fluidgrids.settings.logStreaming.saveFailed", "Could not save log streaming destination."));
-			return;
-		}
-		toast.success(tr("fluidgrids.settings.logStreaming.saved", "Log streaming destination saved."));
-		resetForm();
-		await refetch();
-	}, [
-		actions,
-		editingId,
-		form,
-		refetch,
-		resetForm,
-		tr
-	]);
-	const remove = useCallback(async (destination) => {
-		if (!window.confirm(`Delete “${destination.name}”?`)) return;
-		const result = await actions.remove(destination.id);
-		if (!result?.success) {
-			toast.error(result?.message || tr("fluidgrids.settings.logStreaming.deleteFailed", "Could not delete destination."));
-			return;
+	const [form, setForm] = useState(initial);
+	const [busy, setBusy] = useState(false);
+	const { connections, loading: connectionsLoading } = useConnections();
+	const setTool = (index, patch) => setForm((current) => ({
+		...current,
+		tools: current.tools.map((row, i) => i === index ? {
+			...row,
+			...patch
+		} : row)
+	}));
+	const toggleConnection = (id, on) => setForm((current) => ({
+		...current,
+		connectionScope: on ? [.../* @__PURE__ */ new Set([...current.connectionScope, id])] : current.connectionScope.filter((value) => value !== id)
+	}));
+	const submit = async () => {
+		setBusy(true);
+		try {
+			await onSave(form);
+		} catch (err) {
+			toast.error(errorMessage$1(err));
+		} finally {
+			setBusy(false);
 		}
-		toast.success(tr("fluidgrids.settings.logStreaming.deleted", "Log streaming destination deleted."));
-		if (editingId === destination.id) resetForm();
-		await refetch();
-	}, [
-		actions,
-		editingId,
-		refetch,
-		resetForm,
-		tr
-	]);
-	const sendTest = useCallback(async (destination) => {
-		const result = await actions.test(destination.id);
-		if (!result) return;
-		if (result.success) toast.success(tr("fluidgrids.settings.logStreaming.testSucceeded", "Test event delivered."));
-		else toast.error(result.message || tr("fluidgrids.settings.logStreaming.testFailed", "Test event could not be delivered."));
-		await refetch();
-	}, [
-		actions,
-		refetch,
-		tr
-	]);
-	const toggleEvent = (event) => {
-		setForm((current) => ({
-			...current,
-			eventFilters: current.eventFilters.includes(event) ? current.eventFilters.filter((item) => item !== event) : [...current.eventFilters, event]
-		}));
 	};
 	return /* @__PURE__ */ jsxs("div", {
-		className: "space-y-6",
+		className: "rounded-lg border border-border-secondary bg-background-primary p-4 space-y-4",
+		"data-testid": "agent-definition-editor",
 		children: [
 			/* @__PURE__ */ jsxs("div", {
-				className: "flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between",
-				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h2", {
-					className: "text-lg font-semibold text-text-primary",
-					children: tr("fluidgrids.settings.logStreaming.title", "Log streaming")
-				}), /* @__PURE__ */ jsx("p", {
-					className: "mt-1 max-w-2xl text-sm text-text-secondary",
-					children: tr("fluidgrids.settings.logStreaming.description", "Send workflow run and node events to workspace-managed observability destinations. Secrets are write-only and never returned.")
-				})] }), /* @__PURE__ */ jsxs(Button$1, {
-					onClick: () => {
-						setForm(emptyForm());
-						setEditingId(null);
-						setShowForm(true);
-					},
-					disabled: actions.loading,
-					children: [/* @__PURE__ */ jsx(Icon, {
-						icon: "mdi:plus",
-						className: "mr-1",
-						width: 16
-					}), tr("fluidgrids.settings.logStreaming.add", "Add destination")]
+				className: "grid gap-3 sm:grid-cols-2",
+				children: [/* @__PURE__ */ jsxs("div", {
+					className: "space-y-1",
+					children: [/* @__PURE__ */ jsx(Label, {
+						htmlFor: "agent-name",
+						children: tr("fluidgrids.agents.name", "Name")
+					}), /* @__PURE__ */ jsx(Input, {
+						id: "agent-name",
+						value: form.name,
+						onChange: (e) => setForm({
+							...form,
+							name: e.target.value
+						}),
+						"data-testid": "agent-definition-name"
+					})]
+				}), /* @__PURE__ */ jsxs("div", {
+					className: "flex items-end gap-2",
+					children: [/* @__PURE__ */ jsx(Switch, {
+						id: "agent-active",
+						checked: form.status === "ACTIVE",
+						onCheckedChange: (on) => setForm({
+							...form,
+							status: on ? "ACTIVE" : "DISABLED"
+						})
+					}), /* @__PURE__ */ jsx(Label, {
+						htmlFor: "agent-active",
+						children: tr("fluidgrids.agents.active", "Active")
+					})]
+				})]
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "space-y-1",
+				children: [/* @__PURE__ */ jsx(Label, {
+					htmlFor: "agent-description",
+					children: tr("fluidgrids.agents.description", "Description")
+				}), /* @__PURE__ */ jsx(Textarea, {
+					id: "agent-description",
+					value: form.description,
+					onChange: (e) => setForm({
+						...form,
+						description: e.target.value
+					}),
+					rows: 2
 				})]
 			}),
-			error && /* @__PURE__ */ jsxs("div", {
-				role: "alert",
-				className: "rounded-lg border border-status-error-border bg-status-error-bg-subtle p-4 text-sm text-status-error-text",
-				children: [error.message, /* @__PURE__ */ jsx(Button$1, {
-					variant: "outline",
-					size: "sm",
-					className: "ml-3",
-					onClick: () => void refetch(),
-					children: tr("fluidgrids.settings.logStreaming.retry", "Retry")
+			/* @__PURE__ */ jsxs("div", {
+				className: "space-y-2",
+				children: [
+					/* @__PURE__ */ jsx(Label, { children: tr("fluidgrids.agents.tools", "Tools the agent may call") }),
+					/* @__PURE__ */ jsx("p", {
+						className: "text-xs text-text-secondary",
+						children: tr("fluidgrids.agents.toolsHelp", "A node type (for example store/slack) and the operations of it the agent may call, separated by commas. Leave the operations empty to allow every operation of that node type. Nothing else can be called.")
+					}),
+					form.tools.map((row, index) => /* @__PURE__ */ jsxs("div", {
+						className: "flex flex-wrap items-center gap-2",
+						"data-testid": `agent-definition-tool-${index}`,
+						children: [
+							/* @__PURE__ */ jsx(Input, {
+								className: "w-48",
+								placeholder: "store/slack",
+								value: row.nodeType,
+								onChange: (e) => setTool(index, { nodeType: e.target.value }),
+								"aria-label": tr("fluidgrids.agents.nodeType", "Node type")
+							}),
+							/* @__PURE__ */ jsx(Input, {
+								className: "min-w-48 flex-1",
+								placeholder: "postMessage, listChannels",
+								value: row.operations,
+								onChange: (e) => setTool(index, { operations: e.target.value }),
+								"aria-label": tr("fluidgrids.agents.operations", "Operations")
+							}),
+							/* @__PURE__ */ jsx(Button$1, {
+								variant: "ghost",
+								size: "sm",
+								onClick: () => setForm({
+									...form,
+									tools: form.tools.filter((_, i) => i !== index)
+								}),
+								"aria-label": tr("fluidgrids.agents.removeTool", "Remove tool"),
+								children: /* @__PURE__ */ jsx(Icon, {
+									icon: "mdi:close",
+									width: 16
+								})
+							})
+						]
+					}, index)),
+					/* @__PURE__ */ jsxs(Button$1, {
+						variant: "outline",
+						size: "sm",
+						onClick: () => setForm({
+							...form,
+							tools: [...form.tools, {
+								nodeType: "",
+								operations: ""
+							}]
+						}),
+						children: [/* @__PURE__ */ jsx(Icon, {
+							icon: "mdi:plus",
+							width: 16
+						}), tr("fluidgrids.agents.addTool", "Add tool")]
+					})
+				]
+			}),
+			/* @__PURE__ */ jsxs("div", {
+				className: "space-y-2",
+				children: [/* @__PURE__ */ jsx(Label, { children: tr("fluidgrids.agents.connections", "Connections the agent's tools may use") }), connectionsLoading ? /* @__PURE__ */ jsx("p", {
+					className: "text-xs text-text-secondary",
+					children: tr("fluidgrids.agents.loadingConnections", "Loading connections…")
+				}) : connections.length === 0 ? /* @__PURE__ */ jsx("p", {
+					className: "text-xs text-text-secondary",
+					children: tr("fluidgrids.agents.noConnections", "This workspace has no connections yet.")
+				}) : /* @__PURE__ */ jsx("div", {
+					className: "grid gap-1 sm:grid-cols-2",
+					children: connections.map((connection) => /* @__PURE__ */ jsxs("label", {
+						className: "flex items-center gap-2 text-sm text-text-primary",
+						children: [
+							/* @__PURE__ */ jsx(Checkbox, {
+								checked: form.connectionScope.includes(connection.id),
+								onCheckedChange: (on) => toggleConnection(connection.id, on === true)
+							}),
+							/* @__PURE__ */ jsx("span", { children: connection.name }),
+							/* @__PURE__ */ jsx("span", {
+								className: "text-xs text-text-tertiary",
+								children: connection.provider?.name ?? connection.providerId
+							})
+						]
+					}, connection.id))
 				})]
 			}),
-			showForm && /* @__PURE__ */ jsxs(Card, {
-				className: "border-border-secondary bg-background-secondary",
-				children: [/* @__PURE__ */ jsx(CardHeader, { children: /* @__PURE__ */ jsxs("div", {
-					className: "flex items-center justify-between gap-3",
-					children: [/* @__PURE__ */ jsx("h3", {
-						className: "font-medium text-text-primary",
-						children: editingId ? tr("fluidgrids.settings.logStreaming.edit", "Edit destination") : tr("fluidgrids.settings.logStreaming.new", "New destination")
-					}), /* @__PURE__ */ jsx(Button$1, {
-						variant: "ghost",
-						size: "sm",
-						onClick: resetForm,
-						children: /* @__PURE__ */ jsx(Icon, {
-							icon: "mdi:close",
-							width: 18
-						})
-					})]
-				}) }), /* @__PURE__ */ jsxs(CardContent, {
-					className: "space-y-5",
-					children: [
-						/* @__PURE__ */ jsxs("div", {
-							className: "grid gap-4 md:grid-cols-2",
-							children: [/* @__PURE__ */ jsxs("div", {
-								className: "space-y-2",
-								children: [/* @__PURE__ */ jsx(Label, {
-									htmlFor: "log-stream-name",
-									children: tr("fluidgrids.settings.logStreaming.name", "Name")
-								}), /* @__PURE__ */ jsx(Input, {
-									id: "log-stream-name",
-									value: form.name,
-									onChange: (event) => setForm((current) => ({
-										...current,
-										name: event.target.value
-									})),
-									placeholder: "Production error stream"
-								})]
-							}), /* @__PURE__ */ jsxs("div", {
-								className: "space-y-2",
-								children: [/* @__PURE__ */ jsx(Label, {
-									htmlFor: "log-stream-provider",
-									children: tr("fluidgrids.settings.logStreaming.provider", "Provider")
-								}), /* @__PURE__ */ jsx("select", {
-									id: "log-stream-provider",
-									value: form.provider,
-									onChange: (event) => setForm((current) => ({
-										...current,
-										provider: event.target.value,
-										endpoint: ""
-									})),
-									className: "w-full rounded-md border border-border-secondary bg-background-primary px-3 py-2 text-sm text-text-primary",
-									children: PROVIDERS.map((provider) => /* @__PURE__ */ jsx("option", {
-										value: provider,
-										children: provider
-									}, provider))
-								})]
-							})]
-						}),
-						/* @__PURE__ */ jsxs("div", {
-							className: "space-y-2",
-							children: [/* @__PURE__ */ jsx(Label, {
-								htmlFor: "log-stream-endpoint",
-								children: tr("fluidgrids.settings.logStreaming.endpoint", "Endpoint")
-							}), /* @__PURE__ */ jsx(Input, {
-								id: "log-stream-endpoint",
-								value: form.endpoint,
-								onChange: (event) => setForm((current) => ({
-									...current,
-									endpoint: event.target.value
-								})),
-								placeholder: endpointPlaceholder(form.provider),
-								type: form.provider === "WEBHOOK" || form.provider === "SENTRY" ? "url" : "text"
-							})]
-						}),
-						form.provider === "WEBHOOK" && /* @__PURE__ */ jsxs("div", {
-							className: "space-y-2",
-							children: [/* @__PURE__ */ jsx(Label, {
-								htmlFor: "log-stream-secret",
-								children: tr("fluidgrids.settings.logStreaming.secret", "Signing secret")
-							}), /* @__PURE__ */ jsx(Input, {
-								id: "log-stream-secret",
-								value: form.secret,
-								onChange: (event) => setForm((current) => ({
-									...current,
-									secret: event.target.value
-								})),
-								placeholder: editingId ? "Leave blank to keep the current secret" : "Enter a signing secret",
-								type: "password",
-								autoComplete: "new-password"
-							})]
-						}),
-						/* @__PURE__ */ jsxs("div", {
-							className: "space-y-2",
-							children: [/* @__PURE__ */ jsx(Label, {
-								htmlFor: "log-stream-config",
-								children: tr("fluidgrids.settings.logStreaming.config", "Provider configuration (JSON)")
-							}), /* @__PURE__ */ jsx("textarea", {
-								id: "log-stream-config",
-								value: form.configText,
-								onChange: (event) => setForm((current) => ({
-									...current,
-									configText: event.target.value
-								})),
-								className: "min-h-24 w-full rounded-md border border-border-secondary bg-background-primary px-3 py-2 font-mono text-xs text-text-primary",
-								spellCheck: false
-							})]
-						}),
-						/* @__PURE__ */ jsxs("fieldset", {
-							className: "space-y-2",
-							children: [/* @__PURE__ */ jsx("legend", {
-								className: "text-sm font-medium text-text-primary",
-								children: tr("fluidgrids.settings.logStreaming.events", "Events to stream")
-							}), /* @__PURE__ */ jsx("div", {
-								className: "grid gap-2 sm:grid-cols-2 lg:grid-cols-4",
-								children: LOG_STREAM_EVENT_TYPES.map((event) => /* @__PURE__ */ jsxs("label", {
-									className: "flex items-center gap-2 text-sm text-text-secondary",
-									children: [/* @__PURE__ */ jsx("input", {
-										type: "checkbox",
-										checked: form.eventFilters.includes(event),
-										onChange: () => toggleEvent(event),
-										className: "size-4 rounded border-border-secondary accent-action-primary-bg"
-									}), eventLabel(event)]
-								}, event))
-							})]
-						}),
-						/* @__PURE__ */ jsxs("label", {
-							className: "flex items-center gap-2 text-sm text-text-secondary",
-							children: [/* @__PURE__ */ jsx("input", {
-								type: "checkbox",
-								checked: form.isEnabled,
-								onChange: (event) => setForm((current) => ({
-									...current,
-									isEnabled: event.target.checked
-								})),
-								className: "size-4 rounded border-border-secondary accent-action-primary-bg"
-							}), tr("fluidgrids.settings.logStreaming.enabled", "Destination enabled")]
-						}),
-						/* @__PURE__ */ jsxs("div", {
-							className: "flex justify-end gap-2",
-							children: [/* @__PURE__ */ jsx(Button$1, {
-								variant: "outline",
-								onClick: resetForm,
-								children: tr("fluidgrids.settings.logStreaming.cancel", "Cancel")
-							}), /* @__PURE__ */ jsx(Button$1, {
-								"data-agent": "confirm",
-								onClick: () => void save(),
-								disabled: actions.loading,
-								children: actions.loading ? tr("fluidgrids.settings.logStreaming.saving", "Saving…") : tr("fluidgrids.settings.logStreaming.save", "Save destination")
-							})]
-						})
-					]
+			/* @__PURE__ */ jsxs("div", {
+				className: "flex items-center gap-2",
+				children: [/* @__PURE__ */ jsx(Switch, {
+					id: "agent-approval",
+					checked: form.requireToolApproval,
+					onCheckedChange: (on) => setForm({
+						...form,
+						requireToolApproval: on
+					})
+				}), /* @__PURE__ */ jsx(Label, {
+					htmlFor: "agent-approval",
+					children: tr("fluidgrids.agents.requireApproval", "Every tool call waits for a person's approval")
 				})]
 			}),
 			/* @__PURE__ */ jsxs("div", {
-				className: "space-y-3",
+				className: "flex gap-2",
+				children: [/* @__PURE__ */ jsx(Button$1, {
+					onClick: () => void submit(),
+					disabled: busy,
+					"data-testid": "agent-definition-save",
+					children: tr("fluidgrids.agents.save", "Save agent")
+				}), /* @__PURE__ */ jsx(Button$1, {
+					variant: "outline",
+					onClick: onCancel,
+					disabled: busy,
+					children: tr("fluidgrids.agents.cancel", "Cancel")
+				})]
+			})
+		]
+	});
+}
+function AgentGrants({ agent, loadGrants, onGrant, onRevoke }) {
+	const tr = useTr();
+	const [grants, setGrants] = useState(null);
+	const [days, setDays] = useState(String(30));
+	const [busy, setBusy] = useState(false);
+	const load = useCallback(async () => {
+		try {
+			setGrants(await loadGrants(agent.id));
+		} catch (err) {
+			setGrants([]);
+			toast.error(errorMessage$1(err));
+		}
+	}, [agent.id, loadGrants]);
+	useEffect(() => {
+		load();
+	}, [load]);
+	const run = async (action, done) => {
+		setBusy(true);
+		try {
+			await action();
+			toast.success(done);
+			await load();
+		} catch (err) {
+			toast.error(errorMessage$1(err));
+		} finally {
+			setBusy(false);
+		}
+	};
+	const mine = grants?.find((grant) => grant.isMine && grant.status === "ACTIVE");
+	return /* @__PURE__ */ jsxs("div", {
+		className: "space-y-2",
+		"data-testid": `agent-grants-${agent.id}`,
+		children: [/* @__PURE__ */ jsx("div", {
+			className: "flex flex-wrap items-center gap-2",
+			children: mine ? /* @__PURE__ */ jsxs(Fragment, { children: [/* @__PURE__ */ jsx("span", {
+				className: "text-sm text-text-primary",
+				children: mine.expiresAt ? tr("fluidgrids.agents.myGrantUntil", "This agent may act for you until {{date}}.", { date: new Date(mine.expiresAt).toLocaleDateString() }) : tr("fluidgrids.agents.myGrant", "This agent may act for you.")
+			}), /* @__PURE__ */ jsx(Button$1, {
+				variant: "outline",
+				size: "sm",
+				disabled: busy,
+				onClick: () => void run(() => onRevoke(agent.id, null), tr("fluidgrids.agents.withdrawn", "Grant withdrawn")),
+				"data-testid": "agent-grant-withdraw",
+				children: tr("fluidgrids.agents.withdraw", "Withdraw my grant")
+			})] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+				/* @__PURE__ */ jsx(Label, {
+					htmlFor: `grant-days-${agent.id}`,
+					className: "text-sm",
+					children: tr("fluidgrids.agents.grantFor", "Let it act for me for")
+				}),
+				/* @__PURE__ */ jsx(Input, {
+					id: `grant-days-${agent.id}`,
+					className: "w-20",
+					type: "number",
+					min: 1,
+					max: 365,
+					value: days,
+					onChange: (e) => setDays(e.target.value)
+				}),
+				/* @__PURE__ */ jsx("span", {
+					className: "text-sm text-text-secondary",
+					children: tr("fluidgrids.agents.days", "days")
+				}),
+				/* @__PURE__ */ jsx(Button$1, {
+					size: "sm",
+					disabled: busy || agent.status !== "ACTIVE",
+					onClick: () => void run(async () => onGrant(agent.id, grantDays(days)), tr("fluidgrids.agents.granted", "Grant given")),
+					"data-testid": "agent-grant-give",
+					children: tr("fluidgrids.agents.grant", "Grant")
+				})
+			] })
+		}), grants && grants.length > 0 ? /* @__PURE__ */ jsx("ul", {
+			className: "space-y-1 text-xs text-text-secondary",
+			children: grants.map((grant) => /* @__PURE__ */ jsxs("li", {
+				className: "flex items-center gap-2",
 				children: [
-					loading && destinations.length === 0 && /* @__PURE__ */ jsx("div", {
-						className: "rounded-lg border border-border-secondary bg-background-secondary p-6 text-sm text-text-secondary",
-						children: tr("fluidgrids.settings.logStreaming.loading", "Loading destinations…")
+					/* @__PURE__ */ jsx("span", {
+						className: "font-mono",
+						children: grant.userId
 					}),
-					!loading && destinations.length === 0 && /* @__PURE__ */ jsxs("div", {
-						className: "rounded-lg border border-dashed border-border-secondary bg-background-secondary p-8 text-center",
-						children: [
-							/* @__PURE__ */ jsx(Icon, {
-								icon: "mdi:transit-connection-variant",
-								className: "mx-auto mb-3 text-text-secondary",
-								width: 32
-							}),
-							/* @__PURE__ */ jsx("p", {
-								className: "font-medium text-text-primary",
-								children: tr("fluidgrids.settings.logStreaming.emptyTitle", "No log destinations yet")
-							}),
-							/* @__PURE__ */ jsx("p", {
-								className: "mt-1 text-sm text-text-secondary",
-								children: tr("fluidgrids.settings.logStreaming.emptyDescription", "Add a webhook, syslog target, or Sentry DSN to start streaming events.")
-							})
-						]
+					/* @__PURE__ */ jsx(Badge, {
+						variant: "outline",
+						children: grant.status
 					}),
-					destinations.map((destination) => /* @__PURE__ */ jsx(Card, {
-						className: "border-border-secondary bg-background-secondary",
-						children: /* @__PURE__ */ jsxs(CardContent, {
-							className: "flex flex-col gap-4 p-4 sm:flex-row sm:items-center sm:justify-between",
+					grant.expiresAt ? /* @__PURE__ */ jsx("span", { children: tr("fluidgrids.agents.until", "until {{date}}", { date: new Date(grant.expiresAt).toLocaleDateString() }) }) : null,
+					!grant.isMine && grant.status === "ACTIVE" ? /* @__PURE__ */ jsx(Button$1, {
+						variant: "ghost",
+						size: "sm",
+						disabled: busy,
+						onClick: () => void run(() => onRevoke(agent.id, grant.userId), tr("fluidgrids.agents.revoked", "Grant revoked")),
+						children: tr("fluidgrids.agents.revoke", "Revoke")
+					}) : null
+				]
+			}, grant.userId))
+		}) : null]
+	});
+}
+function AgentsTab() {
+	const tr = useTr();
+	const { agents, loading, error, save, remove, grants, grant, revoke } = useAgentDefinitions();
+	const [editing, setEditing] = useState(null);
+	const onSave = async (form) => {
+		const input = formToInput$2(form);
+		await save(editing?.id ?? null, input);
+		toast.success(tr("fluidgrids.agents.saved", "Agent saved"));
+		setEditing(null);
+	};
+	const onDelete = async (agent) => {
+		try {
+			await remove(agent.id);
+			toast.success(tr("fluidgrids.agents.deleted", "Agent deleted"));
+		} catch (err) {
+			toast.error(errorMessage$1(err));
+		}
+	};
+	return /* @__PURE__ */ jsxs("div", {
+		className: "space-y-4",
+		"data-testid": "agents-tab",
+		children: [
+			/* @__PURE__ */ jsxs("div", {
+				className: "flex flex-wrap items-start justify-between gap-2",
+				children: [/* @__PURE__ */ jsxs("div", { children: [/* @__PURE__ */ jsx("h3", {
+					className: "text-base font-semibold text-text-primary",
+					children: tr("fluidgrids.agents.title", "Agents")
+				}), /* @__PURE__ */ jsx("p", {
+					className: "text-sm text-text-secondary",
+					children: tr("fluidgrids.agents.subtitle", "Give an AI Agent node an identity of its own. It can only call the tools and connections you allow, only for people who granted it, and every tool call is recorded under the agent and the person.")
+				})] }), !editing ? /* @__PURE__ */ jsxs(Button$1, {
+					onClick: () => setEditing({
+						id: null,
+						form: emptyAgentForm()
+					}),
+					"data-testid": "agent-definition-new",
+					children: [/* @__PURE__ */ jsx(Icon, {
+						icon: "mdi:plus",
+						width: 16
+					}), tr("fluidgrids.agents.new", "New agent")]
+				}) : null]
+			}),
+			editing ? /* @__PURE__ */ jsx(AgentEditor, {
+				initial: editing.form,
+				onCancel: () => setEditing(null),
+				onSave
+			}) : null,
+			error ? /* @__PURE__ */ jsx("p", {
+				className: "text-sm text-destructive",
+				children: errorMessage$1(error)
+			}) : null,
+			loading ? /* @__PURE__ */ jsx("p", {
+				className: "text-sm text-text-secondary",
+				children: tr("fluidgrids.agents.loading", "Loading agents…")
+			}) : agents.length === 0 && !error ? /* @__PURE__ */ jsx("p", {
+				className: "text-sm text-text-secondary",
+				children: tr("fluidgrids.agents.empty", "No agents yet.")
+			}) : /* @__PURE__ */ jsx("ul", {
+				className: "space-y-3",
+				children: agents.map((agent) => /* @__PURE__ */ jsxs("li", {
+					className: "rounded-lg border border-border-secondary bg-background-secondary p-3 space-y-2",
+					"data-testid": `agent-definition-${agent.id}`,
+					children: [
+						/* @__PURE__ */ jsxs("div", {
+							className: "flex flex-wrap items-center justify-between gap-2",
 							children: [/* @__PURE__ */ jsxs("div", {
-								className: "min-w-0",
+								className: "flex items-center gap-2",
 								children: [
-									/* @__PURE__ */ jsxs("div", {
-										className: "flex flex-wrap items-center gap-2",
-										children: [
-											/* @__PURE__ */ jsx("h3", {
-												className: "font-medium text-text-primary",
-												children: destination.name
-											}),
-											/* @__PURE__ */ jsx("span", {
-												className: "rounded-full bg-background-tertiary px-2 py-0.5 text-xs text-text-secondary",
-												children: destination.provider
-											}),
-											/* @__PURE__ */ jsx("span", {
-												className: destination.isEnabled ? "text-xs text-status-success-text" : "text-xs text-text-secondary",
-												children: destination.isEnabled ? tr("fluidgrids.settings.logStreaming.enabledBadge", "Enabled") : tr("fluidgrids.settings.logStreaming.disabledBadge", "Disabled")
-											})
-										]
-									}),
-									/* @__PURE__ */ jsx("p", {
-										className: "mt-1 truncate text-sm text-text-secondary",
-										children: destination.endpoint
+									/* @__PURE__ */ jsx(Icon, {
+										icon: "mdi:robot-outline",
+										width: 18
 									}),
-									/* @__PURE__ */ jsxs("p", {
-										className: "mt-1 text-xs text-text-secondary",
-										children: [destination.eventFilters.length > 0 ? destination.eventFilters.map(eventLabel).join(", ") : tr("fluidgrids.settings.logStreaming.allEvents", "All events"), destination.hasSecret && " · Secret configured"]
+									/* @__PURE__ */ jsx("span", {
+										className: "font-medium text-text-primary",
+										children: agent.name
 									}),
-									destination.lastDispatchError && /* @__PURE__ */ jsx("p", {
-										className: "mt-2 text-xs text-status-error-text",
-										children: destination.lastDispatchError
-									})
-								]
-							}), /* @__PURE__ */ jsxs("div", {
-								className: "flex shrink-0 flex-wrap gap-2",
-								children: [
-									/* @__PURE__ */ jsxs(Button$1, {
+									/* @__PURE__ */ jsx(Badge, {
 										variant: "outline",
-										size: "sm",
-										onClick: () => void sendTest(destination),
-										disabled: actions.loading,
-										children: [/* @__PURE__ */ jsx(Icon, {
-											icon: "mdi:send-check-outline",
-											className: "mr-1",
-											width: 15
-										}), tr("fluidgrids.settings.logStreaming.test", "Send test")]
+										children: agent.status
 									}),
-									/* @__PURE__ */ jsx(Button$1, {
+									agent.requireToolApproval ? /* @__PURE__ */ jsx(Badge, {
 										variant: "outline",
-										size: "sm",
-										onClick: () => {
-											setEditingId(destination.id);
-											setShowForm(true);
-										},
-										disabled: actions.loading,
-										children: tr("fluidgrids.settings.logStreaming.editButton", "Edit")
-									}),
-									/* @__PURE__ */ jsxs(Button$1, {
-										variant: "ghost",
-										size: "sm",
-										onClick: () => void remove(destination),
-										disabled: actions.loading,
-										children: [/* @__PURE__ */ jsx(Icon, {
-											icon: "mdi:trash-can-outline",
-											className: "text-status-error-text",
-											width: 17
-										}), /* @__PURE__ */ jsx("span", {
-											className: "sr-only",
-											children: tr("fluidgrids.settings.logStreaming.delete", "Delete")
-										})]
-									})
+										children: tr("fluidgrids.agents.approvalBadge", "Approval required")
+									}) : null
 								]
+							}), /* @__PURE__ */ jsxs("div", {
+								className: "flex gap-1",
+								children: [/* @__PURE__ */ jsx(Button$1, {
+									variant: "ghost",
+									size: "sm",
+									onClick: () => setEditing({
+										id: agent.id,
+										form: agentToForm(agent)
+									}),
+									children: tr("fluidgrids.agents.edit", "Edit")
+								}), /* @__PURE__ */ jsx(Button$1, {
+									variant: "ghost",
+									size: "sm",
+									onClick: () => void onDelete(agent),
+									children: tr("fluidgrids.agents.delete", "Delete")
+								})]
 							})]
+						}),
+						agent.description ? /* @__PURE__ */ jsx("p", {
+							className: "text-sm text-text-secondary",
+							children: agent.description
+						}) : null,
+						/* @__PURE__ */ jsx("div", {
+							className: "text-xs text-text-secondary",
+							children: agent.toolAllowlist.length > 0 ? agent.toolAllowlist.map(describeRule).join(" · ") : tr("fluidgrids.agents.noTools", "No tools allowed")
+						}),
+						/* @__PURE__ */ jsx("div", {
+							className: "text-xs text-text-tertiary",
+							children: tr("fluidgrids.agents.connectionCount", "{{count}} connections in scope", { count: agent.connectionScope.length })
+						}),
+						/* @__PURE__ */ jsx(AgentGrants, {
+							agent,
+							loadGrants: grants,
+							onGrant: grant,
+							onRevoke: revoke
 						})
-					}, destination.id))
-				]
+					]
+				}, agent.id))
 			})
 		]
 	});